@kody-ade/kody-engine 0.4.564 → 0.4.566

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.564",
+      version: "0.4.566",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -669,6 +669,29 @@ var init_format = __esm({
   }
 });
 
+// src/fileEditGuards.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+function createMissingParentWriteGuard(cwd) {
+  return async (input) => {
+    const toolInput = input.tool_input;
+    if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) return {};
+    const filePath = toolInput.file_path;
+    if (typeof filePath !== "string" || filePath.length === 0) return {};
+    const resolvedPath = path3.resolve(cwd, filePath);
+    if (fs3.existsSync(path3.dirname(resolvedPath))) return {};
+    return {
+      decision: "block",
+      reason: `Cannot write ${resolvedPath}: its parent directory does not exist. Locate and edit the real repository source path first. If this task genuinely requires a new directory, create that directory explicitly before writing the file.`
+    };
+  };
+}
+var init_fileEditGuards = __esm({
+  "src/fileEditGuards.ts"() {
+    "use strict";
+  }
+});
+
 // src/agency/capability-contract-validation.ts
 import Ajv from "ajv";
 function createCapabilityContractValueValidator(compile) {
@@ -741,12 +764,12 @@ var init_capability_contract_validation = __esm({
 });
 
 // src/outputContractHooks.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 function outputContractError(contract) {
   let value;
   try {
-    value = JSON.parse(fs3.readFileSync(contract.path, "utf8"));
+    value = JSON.parse(fs4.readFileSync(contract.path, "utf8"));
   } catch (error) {
     return `The required output file is missing or is not valid JSON: ${error instanceof Error ? error.message : String(error)}`;
   }
@@ -761,12 +784,12 @@ function correctionMessage(contract, error) {
   return `The authoritative output does not match its required contract: ${error}. Please overwrite ${contract.path} with only the required JSON shape before finishing.`;
 }
 function createOutputContractPostWriteHook(contract) {
-  const expectedPath = path3.resolve(contract.path);
+  const expectedPath = path4.resolve(contract.path);
   return async (input) => {
     const toolInput = input.tool_input;
     if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) return {};
     const filePath = toolInput.file_path;
-    if (typeof filePath !== "string" || path3.resolve(filePath) !== expectedPath) return {};
+    if (typeof filePath !== "string" || path4.resolve(filePath) !== expectedPath) return {};
     const error = outputContractError(contract);
     if (!error) return {};
     return {
@@ -779,7 +802,7 @@ function createOutputContractPostWriteHook(contract) {
 }
 function createOutputContractStopHook(contract) {
   return async () => {
-    if (!fs3.existsSync(contract.path)) {
+    if (!fs4.existsSync(contract.path)) {
       return {
         decision: "block",
         reason: "Continue the Journey from the current page and complete the next unresolved user outcome. Do not write the result merely because you paused; write it only after the Journey passes, fails, or cannot safely continue."
@@ -810,21 +833,21 @@ __export(runtimePaths_exports, {
 });
 import { createHash } from "crypto";
 import * as os2 from "os";
-import * as path4 from "path";
+import * as path5 from "path";
 function runtimeDirForCwd(cwd, ...parts) {
-  const key = createHash("sha256").update(path4.resolve(cwd)).digest("hex").slice(0, 16);
-  return path4.join(os2.tmpdir(), "kody-engine", key, ...parts);
+  const key = createHash("sha256").update(path5.resolve(cwd)).digest("hex").slice(0, 16);
+  return path5.join(os2.tmpdir(), "kody-engine", key, ...parts);
 }
 function runtimeStatePath(cwd, ...parts) {
   const configuredRoot = process.env.KODY_RUNTIME_DIR?.trim();
-  const base = configuredRoot ? path4.resolve(configuredRoot) : runtimeDirForCwd(cwd);
-  return path4.join(base, ...parts);
+  const base = configuredRoot ? path5.resolve(configuredRoot) : runtimeDirForCwd(cwd);
+  return path5.join(base, ...parts);
 }
 function agentRunDir(cwd) {
   return runtimeStatePath(cwd, "agent-runs");
 }
 function lastRunLogPath(cwd) {
-  return path4.join(agentRunDir(cwd), "last-run.jsonl");
+  return path5.join(agentRunDir(cwd), "last-run.jsonl");
 }
 var init_runtimePaths = __esm({
   "src/runtimePaths.ts"() {
@@ -833,31 +856,31 @@ var init_runtimePaths = __esm({
 });
 
 // src/scripts/buildSyntheticPlugin.ts
-import * as fs4 from "fs";
+import * as fs5 from "fs";
 import * as os3 from "os";
-import * as path5 from "path";
+import * as path6 from "path";
 function getPluginsCatalogRoot() {
-  const here = path5.dirname(new URL(import.meta.url).pathname);
+  const here = path6.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path5.join(here, "..", "plugins"),
+    path6.join(here, "..", "plugins"),
     // dev: src/scripts → src/plugins
-    path5.join(here, "..", "..", "plugins"),
+    path6.join(here, "..", "..", "plugins"),
     // built: dist/scripts → dist/plugins
-    path5.join(here, "..", "..", "src", "plugins")
+    path6.join(here, "..", "..", "src", "plugins")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs4.existsSync(c) && fs4.statSync(c).isDirectory()) return c;
+    if (fs5.existsSync(c) && fs5.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
 function copyDir(src, dst) {
-  fs4.mkdirSync(dst, { recursive: true });
-  for (const ent of fs4.readdirSync(src, { withFileTypes: true })) {
-    const s = path5.join(src, ent.name);
-    const d = path5.join(dst, ent.name);
+  fs5.mkdirSync(dst, { recursive: true });
+  for (const ent of fs5.readdirSync(src, { withFileTypes: true })) {
+    const s = path6.join(src, ent.name);
+    const d = path6.join(dst, ent.name);
     if (ent.isDirectory()) copyDir(s, d);
-    else if (ent.isFile()) fs4.copyFileSync(s, d);
+    else if (ent.isFile()) fs5.copyFileSync(s, d);
   }
 }
 var buildSyntheticPlugin;
@@ -870,47 +893,47 @@ var init_buildSyntheticPlugin = __esm({
       if (!needsSynthetic) return;
       const catalog = getPluginsCatalogRoot();
       const runId = `${profile.name}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-      const root = path5.join(os3.tmpdir(), `kody-synth-${runId}`);
-      fs4.mkdirSync(path5.join(root, ".claude-plugin"), { recursive: true });
+      const root = path6.join(os3.tmpdir(), `kody-synth-${runId}`);
+      fs5.mkdirSync(path6.join(root, ".claude-plugin"), { recursive: true });
       const resolvePart = (bucket, entry) => {
-        const local = path5.join(profile.dir, bucket, entry);
-        if (fs4.existsSync(local)) return local;
-        const shared = path5.resolve(profile.dir, "..", "..", "shared", bucket, entry);
-        if (fs4.existsSync(shared)) return shared;
-        const central = path5.join(catalog, bucket, entry);
-        if (fs4.existsSync(central)) return central;
+        const local = path6.join(profile.dir, bucket, entry);
+        if (fs5.existsSync(local)) return local;
+        const shared = path6.resolve(profile.dir, "..", "..", "shared", bucket, entry);
+        if (fs5.existsSync(shared)) return shared;
+        const central = path6.join(catalog, bucket, entry);
+        if (fs5.existsSync(central)) return central;
         throw new Error(
-          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path5.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
+          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path6.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
         );
       };
       if (cc.skills.length > 0) {
-        const dst = path5.join(root, "skills");
-        fs4.mkdirSync(dst, { recursive: true });
+        const dst = path6.join(root, "skills");
+        fs5.mkdirSync(dst, { recursive: true });
         for (const name of cc.skills) {
-          copyDir(resolvePart("skills", name), path5.join(dst, name));
+          copyDir(resolvePart("skills", name), path6.join(dst, name));
         }
       }
       if (cc.commands.length > 0) {
-        const dst = path5.join(root, "commands");
-        fs4.mkdirSync(dst, { recursive: true });
+        const dst = path6.join(root, "commands");
+        fs5.mkdirSync(dst, { recursive: true });
         for (const name of cc.commands) {
-          fs4.copyFileSync(resolvePart("commands", `${name}.md`), path5.join(dst, `${name}.md`));
+          fs5.copyFileSync(resolvePart("commands", `${name}.md`), path6.join(dst, `${name}.md`));
         }
       }
       if (cc.hooks.length > 0) {
-        const dst = path5.join(root, "hooks");
-        fs4.mkdirSync(dst, { recursive: true });
+        const dst = path6.join(root, "hooks");
+        fs5.mkdirSync(dst, { recursive: true });
         const merged = { hooks: {} };
         for (const name of cc.hooks) {
           const src = resolvePart("hooks", `${name}.json`);
-          const parsed = JSON.parse(fs4.readFileSync(src, "utf-8"));
+          const parsed = JSON.parse(fs5.readFileSync(src, "utf-8"));
           for (const [event, entries] of Object.entries(parsed.hooks ?? {})) {
             if (!Array.isArray(entries)) continue;
             if (!merged.hooks[event]) merged.hooks[event] = [];
             merged.hooks[event].push(...entries);
           }
         }
-        fs4.writeFileSync(path5.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)}
+        fs5.writeFileSync(path6.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)}
 `);
       }
       const manifest = {
@@ -920,7 +943,7 @@ var init_buildSyntheticPlugin = __esm({
       };
       if (cc.skills.length > 0) manifest.skills = ["./skills/"];
       if (cc.commands.length > 0) manifest.commands = ["./commands/"];
-      fs4.writeFileSync(path5.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}
+      fs5.writeFileSync(path6.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}
 `);
       ctx.data.syntheticPluginPath = root;
     };
@@ -928,8 +951,8 @@ var init_buildSyntheticPlugin = __esm({
 });
 
 // src/subagents.ts
-import * as fs5 from "fs";
-import * as path6 from "path";
+import * as fs6 from "fs";
+import * as path7 from "path";
 async function enforceSubagentModelInheritance(input) {
   const toolInput = input.tool_input;
   if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) return {};
@@ -964,12 +987,12 @@ function splitFrontmatter(raw) {
   return { fm, body: (match[2] ?? "").trim() };
 }
 function resolveAgentFile(profileDir, name) {
-  const local = path6.join(profileDir, "agents", `${name}.md`);
-  if (fs5.existsSync(local)) return local;
-  const shared = path6.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
-  if (fs5.existsSync(shared)) return shared;
-  const central = path6.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
-  if (fs5.existsSync(central)) return central;
+  const local = path7.join(profileDir, "agents", `${name}.md`);
+  if (fs6.existsSync(local)) return local;
+  const shared = path7.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
+  if (fs6.existsSync(shared)) return shared;
+  const central = path7.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
+  if (fs6.existsSync(central)) return central;
   throw new Error(
     `loadSubagents: agent '${name}' not found in ${profileDir}/agents/, hydrated shared assets, or engine catalog`
   );
@@ -980,7 +1003,7 @@ function captureSubagentTemplates(profile) {
   const out = {};
   for (const name of names) {
     try {
-      out[name] = fs5.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
+      out[name] = fs6.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
     } catch {
     }
   }
@@ -991,7 +1014,7 @@ function loadSubagents(profile) {
   if (!names || names.length === 0) return void 0;
   const agents = {};
   for (const name of names) {
-    const raw = profile.subagentTemplates?.[name] ?? fs5.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
+    const raw = profile.subagentTemplates?.[name] ?? fs6.readFileSync(resolveAgentFile(profile.dir, name), "utf-8");
     const { fm, body } = splitFrontmatter(raw);
     if (!body) throw new Error(`loadSubagents: agent '${name}' has an empty prompt body`);
     const def = {
@@ -1024,8 +1047,8 @@ __export(events_exports, {
   resolveRunId: () => resolveRunId
 });
 import * as crypto from "crypto";
-import * as fs6 from "fs";
-import * as path7 from "path";
+import * as fs7 from "fs";
+import * as path8 from "path";
 function resolveRunId() {
   if (process.env.KODY_RUN_ID) {
     cachedRunId = process.env.KODY_RUN_ID;
@@ -1058,16 +1081,16 @@ function emitEvent(cwd, ev) {
       ...ev
     };
     const file = eventsPath(cwd, runId);
-    fs6.mkdirSync(path7.dirname(file), { recursive: true });
-    fs6.appendFileSync(file, `${JSON.stringify(fullEvent)}
+    fs7.mkdirSync(path8.dirname(file), { recursive: true });
+    fs7.appendFileSync(file, `${JSON.stringify(fullEvent)}
 `);
   } catch {
   }
 }
 function readEvents(cwd, runId) {
   const file = eventsPath(cwd, runId);
-  if (!fs6.existsSync(file)) return [];
-  const lines = fs6.readFileSync(file, "utf-8").split("\n");
+  if (!fs7.existsSync(file)) return [];
+  const lines = fs7.readFileSync(file, "utf-8").split("\n");
   const out = [];
   for (const line of lines) {
     const trimmed = line.trim();
@@ -1081,10 +1104,10 @@ function readEvents(cwd, runId) {
 }
 function listRuns(cwd) {
   const runsDir = runtimeStatePath(cwd, "agent-runs");
-  if (!fs6.existsSync(runsDir)) return [];
-  return fs6.readdirSync(runsDir).filter((name) => {
+  if (!fs7.existsSync(runsDir)) return [];
+  return fs7.readdirSync(runsDir).filter((name) => {
     try {
-      return fs6.statSync(path7.join(runsDir, name)).isDirectory();
+      return fs7.statSync(path8.join(runsDir, name)).isDirectory();
     } catch {
       return false;
     }
@@ -1121,7 +1144,7 @@ function buildVerifyEnv(source = process.env) {
   return env;
 }
 function runCommand(command, cwd) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -1150,11 +1173,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve21({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve23({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve21({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve23({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -1463,7 +1486,7 @@ function cmsHeaders(opts) {
     }
   };
 }
-async function callDashboardCms(opts, path55, init = {}) {
+async function callDashboardCms(opts, path58, init = {}) {
   const baseUrl = dashboardBaseUrl(opts);
   if (!baseUrl) {
     return {
@@ -1475,7 +1498,7 @@ async function callDashboardCms(opts, path55, init = {}) {
   const headerResult = cmsHeaders(opts);
   if (!headerResult.ok) return headerResult;
   try {
-    const res = await fetch(`${baseUrl}${path55}`, {
+    const res = await fetch(`${baseUrl}${path58}`, {
       ...init,
       headers: {
         ...headerResult.headers,
@@ -1547,8 +1570,8 @@ function documentArg(value) {
 function normalizeCmsDocumentIdInput(input) {
   const trimmed = stripWrappingQuotes(input.trim());
   const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? trimmed;
-  const path55 = parseDocumentPath(withoutQuery);
-  return path55 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
+  const path58 = parseDocumentPath(withoutQuery);
+  return path58 ?? parseDocumentIdSegment(withoutQuery) ?? withoutQuery;
 }
 function stripWrappingQuotes(value) {
   let current = value;
@@ -1559,9 +1582,9 @@ function stripWrappingQuotes(value) {
   }
 }
 function parseDocumentPath(value) {
-  const path55 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
-  if (!path55?.includes("/content/entries/")) return null;
-  const parts = path55.split("/").filter(Boolean).map(decodePathPart);
+  const path58 = value.startsWith("http://") || value.startsWith("https://") ? urlPathname(value) : value;
+  if (!path58?.includes("/content/entries/")) return null;
+  const parts = path58.split("/").filter(Boolean).map(decodePathPart);
   const entriesIndex = parts.findIndex((part, index) => part === "content" && parts[index + 1] === "entries");
   const idPart = parts[entriesIndex + 3];
   if (!idPart || idPart === "new") return null;
@@ -2006,8 +2029,8 @@ var init_issue = __esm({
 });
 
 // src/capabilityFolders.ts
-import * as fs7 from "fs";
-import * as path8 from "path";
+import * as fs8 from "fs";
+import * as path9 from "path";
 function capabilityOutputConditionPaths(config) {
   if (config.outputSchema) {
     return new Set(schemaPropertyPaths(config.outputSchema, "result"));
@@ -2022,43 +2045,43 @@ function capabilityOutputConditionPaths(config) {
   ]);
 }
 function listCapabilityFolderSlugs(absDir) {
-  if (!fs7.existsSync(absDir)) return [];
+  if (!fs8.existsSync(absDir)) return [];
   let entries;
   try {
-    entries = fs7.readdirSync(absDir, { withFileTypes: true });
+    entries = fs8.readdirSync(absDir, { withFileTypes: true });
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isDirectory() && !e.name.startsWith("_") && !e.name.startsWith(".")).filter((e) => isCapabilityFolder(path8.join(absDir, e.name))).map((e) => e.name).sort();
+  return entries.filter((e) => e.isDirectory() && !e.name.startsWith("_") && !e.name.startsWith(".")).filter((e) => isCapabilityFolder(path9.join(absDir, e.name))).map((e) => e.name).sort();
 }
 function isCapabilityFolder(dir) {
-  const entries = fs7.readdirSync(dir, { withFileTypes: true });
-  const legacyBody = path8.join(dir, CAPABILITY_BODY_FILE);
-  if (fs7.existsSync(legacyBody)) {
+  const entries = fs8.readdirSync(dir, { withFileTypes: true });
+  const legacyBody = path9.join(dir, CAPABILITY_BODY_FILE);
+  if (fs8.existsSync(legacyBody)) {
     return entries.every(
       (entry) => entry.name === CAPABILITY_BODY_FILE || entry.name === CAPABILITY_CONTRACT_FILE || entry.isDirectory() && (entry.name === "skills" || entry.name === "tools")
     );
   }
-  const canonicalBody = path8.join(dir, CANONICAL_CAPABILITY_BODY_FILE);
-  const canonicalDefinition = path8.join(dir, CANONICAL_CAPABILITY_DEFINITION_FILE);
-  if (!fs7.existsSync(canonicalBody) || !fs7.existsSync(canonicalDefinition)) return false;
+  const canonicalBody = path9.join(dir, CANONICAL_CAPABILITY_BODY_FILE);
+  const canonicalDefinition = path9.join(dir, CANONICAL_CAPABILITY_DEFINITION_FILE);
+  if (!fs8.existsSync(canonicalBody) || !fs8.existsSync(canonicalDefinition)) return false;
   return entries.every(
     (entry) => entry.name === CANONICAL_CAPABILITY_BODY_FILE || entry.name === CANONICAL_CAPABILITY_DEFINITION_FILE
   );
 }
 function readCapabilityFolder(root, slug) {
-  const dir = path8.join(root, slug);
-  const legacyBodyPath = path8.join(dir, CAPABILITY_BODY_FILE);
-  const canonicalBodyPath = path8.join(dir, CANONICAL_CAPABILITY_BODY_FILE);
-  const bodyPath = fs7.existsSync(legacyBodyPath) ? legacyBodyPath : canonicalBodyPath;
-  const contractPath = path8.join(dir, CAPABILITY_CONTRACT_FILE);
-  if (!fs7.existsSync(bodyPath) || !fs7.statSync(bodyPath).isFile()) return null;
+  const dir = path9.join(root, slug);
+  const legacyBodyPath = path9.join(dir, CAPABILITY_BODY_FILE);
+  const canonicalBodyPath = path9.join(dir, CANONICAL_CAPABILITY_BODY_FILE);
+  const bodyPath = fs8.existsSync(legacyBodyPath) ? legacyBodyPath : canonicalBodyPath;
+  const contractPath = path9.join(dir, CAPABILITY_CONTRACT_FILE);
+  if (!fs8.existsSync(bodyPath) || !fs8.statSync(bodyPath).isFile()) return null;
   if (!isCapabilityFolder(dir)) return null;
   try {
-    const rawBody = fs7.readFileSync(bodyPath, "utf-8");
+    const rawBody = fs8.readFileSync(bodyPath, "utf-8");
     if (bodyPath === canonicalBodyPath) {
-      const definitionPath = path8.join(dir, CANONICAL_CAPABILITY_DEFINITION_FILE);
-      const definition = JSON.parse(fs7.readFileSync(definitionPath, "utf-8"));
+      const definitionPath = path9.join(dir, CANONICAL_CAPABILITY_DEFINITION_FILE);
+      const definition = JSON.parse(fs8.readFileSync(definitionPath, "utf-8"));
       if (definition.id !== slug || typeof definition.action !== "string") return null;
       const { title: title2, body: body2 } = parseCapabilityBody(rawBody, slug);
       return {
@@ -2078,8 +2101,8 @@ function readCapabilityFolder(root, slug) {
         rawProfile: definition
       };
     }
-    const contract = fs7.existsSync(contractPath) ? parseCapabilityContract(fs7.readFileSync(contractPath, "utf-8")) : void 0;
-    if (contract?.execution === "script" && !isRegularFile(path8.join(dir, "tools", "run.sh"))) {
+    const contract = fs8.existsSync(contractPath) ? parseCapabilityContract(fs8.readFileSync(contractPath, "utf-8")) : void 0;
+    if (contract?.execution === "script" && !isRegularFile(path9.join(dir, "tools", "run.sh"))) {
       throw new Error('script-backed Capability requires a regular "tools/run.sh" file');
     }
     const { title, body } = parseCapabilityBody(rawBody, slug);
@@ -2192,7 +2215,7 @@ function parseCapabilityRequirements(raw) {
 }
 function isRegularFile(filePath) {
   try {
-    const stat = fs7.lstatSync(filePath);
+    const stat = fs8.lstatSync(filePath);
     return stat.isFile() && !stat.isSymbolicLink();
   } catch {
     return false;
@@ -2201,8 +2224,8 @@ function isRegularFile(filePath) {
 function schemaPropertyPaths(schema, prefix) {
   const properties = isPlainObject(schema.properties) ? schema.properties : {};
   return Object.entries(properties).flatMap(([name, property]) => {
-    const path55 = `${prefix}.${name}`;
-    return isPlainObject(property) ? [path55, ...schemaPropertyPaths(property, path55)] : [path55];
+    const path58 = `${prefix}.${name}`;
+    return isPlainObject(property) ? [path58, ...schemaPropertyPaths(property, path58)] : [path58];
   });
 }
 function parseCapabilityBody(raw, slug) {
@@ -2266,6 +2289,7 @@ function parseWorkflowStep(value) {
   const target = stringField(raw.target);
   const delivery = stringField(raw.delivery);
   const targetFact = stringField(raw.targetFact ?? raw.target_fact);
+  const timeoutSeconds = typeof raw.timeoutSeconds === "number" && Number.isInteger(raw.timeoutSeconds) && raw.timeoutSeconds > 0 && raw.timeoutSeconds <= 3600 ? raw.timeoutSeconds : void 0;
   const hasInput = Object.hasOwn(raw, "input");
   const inputs = parseWorkflowInputBindings(raw.inputs);
   const next = parseWorkflowTransitions(raw.next);
@@ -2281,6 +2305,7 @@ function parseWorkflowStep(value) {
     ...delivery === "pull-request" ? { delivery } : {},
     ...targetFact ? { targetFact } : {},
     ...reason ? { reason } : {},
+    ...timeoutSeconds ? { timeoutSeconds } : {},
     ...next ? { next } : {},
     ...isPlainObject(raw.runWhen) ? { runWhen: raw.runWhen } : {},
     ...stringList(raw.continueOn ?? raw.continue_on).length > 0 ? { continueOn: stringList(raw.continueOn ?? raw.continue_on) } : {},
@@ -2366,51 +2391,51 @@ var init_capabilityFolders = __esm({
 });
 
 // src/definition-paths.ts
-import * as fs8 from "fs";
-import * as path9 from "path";
+import * as fs9 from "fs";
+import * as path10 from "path";
 function definitionsRoot(cwd = process.cwd()) {
   const override = process.env.KODY_DEFINITIONS_ROOT?.trim();
   const overrideCwd = process.env.KODY_DEFINITIONS_ROOT_CWD?.trim();
-  if (override && overrideCwd && path9.resolve(cwd) === path9.resolve(overrideCwd)) {
-    return storeCatalogRoot(path9.resolve(override));
+  if (override && overrideCwd && path10.resolve(cwd) === path10.resolve(overrideCwd)) {
+    return storeCatalogRoot(path10.resolve(override));
   }
-  const hydrated = path9.join(cwd, ".kody-engine", "definitions");
-  if (fs8.existsSync(hydrated)) return hydrated;
-  return override ? storeCatalogRoot(path9.resolve(override)) : hydrated;
+  const hydrated = path10.join(cwd, ".kody-engine", "definitions");
+  if (fs9.existsSync(hydrated)) return hydrated;
+  return override ? storeCatalogRoot(path10.resolve(override)) : hydrated;
 }
 function hasExplicitDefinitionsRoot(cwd = process.cwd(), env = process.env) {
   const root = env.KODY_DEFINITIONS_ROOT?.trim();
   const rootCwd = env.KODY_DEFINITIONS_ROOT_CWD?.trim();
-  return Boolean(root && rootCwd && path9.resolve(cwd) === path9.resolve(rootCwd));
+  return Boolean(root && rootCwd && path10.resolve(cwd) === path10.resolve(rootCwd));
 }
 function capabilitiesRoot(cwd = process.cwd()) {
-  return storeAssetRoot(cwd, "capabilities") ?? path9.join(definitionsRoot(cwd), "capabilities");
+  return storeAssetRoot(cwd, "capabilities") ?? path10.join(definitionsRoot(cwd), "capabilities");
 }
 function implementationsRoot(cwd = process.cwd()) {
-  return path9.join(definitionsRoot(cwd), "implementations");
+  return path10.join(definitionsRoot(cwd), "implementations");
 }
 function agentsRoot(cwd = process.cwd()) {
-  return storeAssetRoot(cwd, "agent") ?? path9.join(definitionsRoot(cwd), "agents");
+  return storeAssetRoot(cwd, "agent") ?? path10.join(definitionsRoot(cwd), "agents");
 }
 function storeCatalogRoot(root) {
   const manifest = readStoreManifest(root);
-  const roots = ["capabilities", "workflows", "loops"].map((kind) => manifest?.assetRoots?.[kind]).filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => path9.dirname(value));
-  return roots.length === 3 && new Set(roots).size === 1 ? path9.join(root, roots[0]) : root;
+  const roots = ["capabilities", "workflows", "loops"].map((kind) => manifest?.assetRoots?.[kind]).filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => path10.dirname(value));
+  return roots.length === 3 && new Set(roots).size === 1 ? path10.join(root, roots[0]) : root;
 }
 function storeAssetRoot(cwd, kind) {
   const override = process.env.KODY_DEFINITIONS_ROOT?.trim();
   if (!override) return null;
   const overrideCwd = process.env.KODY_DEFINITIONS_ROOT_CWD?.trim();
-  if (overrideCwd && path9.resolve(cwd) !== path9.resolve(overrideCwd)) return null;
-  const root = path9.resolve(override);
+  if (overrideCwd && path10.resolve(cwd) !== path10.resolve(overrideCwd)) return null;
+  const root = path10.resolve(override);
   const configured = readStoreManifest(root)?.assetRoots?.[kind];
-  return typeof configured === "string" && configured.trim() ? path9.join(root, configured) : null;
+  return typeof configured === "string" && configured.trim() ? path10.join(root, configured) : null;
 }
 function readStoreManifest(root) {
-  const file = path9.join(root, "kody-store.json");
-  if (!fs8.existsSync(file)) return null;
+  const file = path10.join(root, "kody-store.json");
+  if (!fs9.existsSync(file)) return null;
   try {
-    return JSON.parse(fs8.readFileSync(file, "utf8"));
+    return JSON.parse(fs9.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
@@ -2422,32 +2447,32 @@ var init_definition_paths = __esm({
 });
 
 // src/registry.ts
-import * as fs9 from "fs";
-import * as path10 from "path";
+import * as fs10 from "fs";
+import * as path11 from "path";
 function getImplementationsRoot() {
-  const here = path10.dirname(new URL(import.meta.url).pathname);
+  const here = path11.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path10.join(here, "implementations"),
+    path11.join(here, "implementations"),
     // dev: src/
-    path10.join(here, "..", "implementations"),
+    path11.join(here, "..", "implementations"),
     // built: dist/bin → dist/implementations
-    path10.join(here, "..", "src", "implementations")
+    path11.join(here, "..", "src", "implementations")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs9.existsSync(c) && fs9.statSync(c).isDirectory()) return c;
+    if (fs10.existsSync(c) && fs10.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
 function getRuntimeServicesRoot() {
-  const here = path10.dirname(new URL(import.meta.url).pathname);
+  const here = path11.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path10.join(here, "runtime-services"),
-    path10.join(here, "..", "runtime-services"),
-    path10.join(here, "..", "src", "runtime-services")
+    path11.join(here, "runtime-services"),
+    path11.join(here, "..", "runtime-services"),
+    path11.join(here, "..", "src", "runtime-services")
   ];
   for (const candidate of candidates) {
-    if (fs9.existsSync(candidate) && fs9.statSync(candidate).isDirectory()) return candidate;
+    if (fs10.existsSync(candidate) && fs10.statSync(candidate).isDirectory()) return candidate;
   }
   return candidates[0];
 }
@@ -2455,17 +2480,17 @@ function getProjectCapabilitiesRoot() {
   return capabilitiesRoot();
 }
 function getBuiltinCapabilitiesRoot() {
-  const here = path10.dirname(new URL(import.meta.url).pathname);
+  const here = path11.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path10.join(here, "capabilities"),
+    path11.join(here, "capabilities"),
     // dev: src/
-    path10.join(here, "..", "capabilities"),
+    path11.join(here, "..", "capabilities"),
     // built: dist/bin → dist/capabilities
-    path10.join(here, "..", "src", "capabilities")
+    path11.join(here, "..", "src", "capabilities")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs9.existsSync(c) && fs9.statSync(c).isDirectory()) return c;
+    if (fs10.existsSync(c) && fs10.statSync(c).isDirectory()) return c;
   }
   return candidates[0];
 }
@@ -2488,14 +2513,14 @@ function listImplementations(roots = getImplementationRoots()) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const root of rootList) {
-    if (!fs9.existsSync(root)) continue;
+    if (!fs10.existsSync(root)) continue;
     const requireImplementationProfile = isCapabilityRoot(root);
-    const entries = fs9.readdirSync(root, { withFileTypes: true });
+    const entries = fs10.readdirSync(root, { withFileTypes: true });
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       if (seen.has(ent.name)) continue;
       const profilePath = implementationRuntimePath(root, ent.name);
-      if (fs9.existsSync(profilePath) && fs9.statSync(profilePath).isFile() && isImplementationProfile(profilePath, requireImplementationProfile)) {
+      if (fs10.existsSync(profilePath) && fs10.statSync(profilePath).isFile() && isImplementationProfile(profilePath, requireImplementationProfile)) {
         out.push({ name: ent.name, profilePath });
         seen.add(ent.name);
       }
@@ -2515,7 +2540,7 @@ function resolveImplementationCandidates(name, roots = getRuntimeProfileRootsFor
   const out = [];
   for (const root of rootList) {
     const profilePath = implementationRuntimePath(root, name);
-    if (fs9.existsSync(profilePath) && fs9.statSync(profilePath).isFile() && isImplementationProfile(profilePath, isCapabilityRoot(root))) {
+    if (fs10.existsSync(profilePath) && fs10.statSync(profilePath).isFile() && isImplementationProfile(profilePath, isCapabilityRoot(root))) {
       out.push(profilePath);
     }
   }
@@ -2589,7 +2614,7 @@ function implementationDeclaresInput(implementation, inputName, cwd = process.cw
   const profilePath = resolveImplementation(implementation, getRuntimeProfileRootsForCwd(cwd));
   if (!profilePath) return false;
   try {
-    const document = JSON.parse(fs9.readFileSync(profilePath, "utf-8"));
+    const document = JSON.parse(fs10.readFileSync(profilePath, "utf-8"));
     const raw = document.config ?? document;
     if (!Array.isArray(raw.inputs)) return false;
     return raw.inputs.some((entry) => {
@@ -2605,29 +2630,29 @@ function isSafeName(name) {
   return /^[a-z][a-z0-9-]*$/.test(name) && !name.includes("..");
 }
 function isCapabilityRoot(root) {
-  const normalized = path10.normalize(root);
-  if (path10.basename(normalized) === "capabilities") return true;
+  const normalized = path11.normalize(root);
+  if (path11.basename(normalized) === "capabilities") return true;
   const knownRoots = [getProjectCapabilitiesRoot(), getBuiltinCapabilitiesRoot()];
-  return knownRoots.some((candidate) => candidate && path10.normalize(candidate) === normalized);
+  return knownRoots.some((candidate) => candidate && path11.normalize(candidate) === normalized);
 }
 function implementationRuntimePath(root, name) {
-  const runtimePath = path10.join(root, name, "runtime.json");
-  if (fs9.existsSync(runtimePath)) return runtimePath;
-  const internalProfilePath = path10.join(root, name, "profile.json");
-  if (fs9.existsSync(internalProfilePath)) return internalProfilePath;
-  return path10.join(root, name, CAPABILITY_PROFILE_FILE);
+  const runtimePath = path11.join(root, name, "runtime.json");
+  if (fs10.existsSync(runtimePath)) return runtimePath;
+  const internalProfilePath = path11.join(root, name, "profile.json");
+  if (fs10.existsSync(internalProfilePath)) return internalProfilePath;
+  return path11.join(root, name, CAPABILITY_PROFILE_FILE);
 }
 function isImplementationProfile(profilePath, requireImplementationProfile) {
   if (!requireImplementationProfile) return true;
   try {
-    const raw = JSON.parse(fs9.readFileSync(profilePath, "utf-8"));
+    const raw = JSON.parse(fs10.readFileSync(profilePath, "utf-8"));
     return typeof raw.role === "string" && PUBLIC_IMPLEMENTATION_ROLES.has(raw.role);
   } catch {
     return false;
   }
 }
 function listFolderCapabilityActions(root, source) {
-  if (!fs9.existsSync(root) || !fs9.statSync(root).isDirectory()) return [];
+  if (!fs10.existsSync(root) || !fs10.statSync(root).isDirectory()) return [];
   const out = [];
   for (const slug of listCapabilityFolderSlugs(root)) {
     if (!isSafeName(slug)) continue;
@@ -2659,7 +2684,7 @@ function hasUnresolvedExplicitImplementation(capability, implementation) {
   return resolveImplementation(implementation) === null;
 }
 function listBuiltinCapabilityActions(root = getBuiltinCapabilitiesRoot()) {
-  if (!fs9.existsSync(root) || !fs9.statSync(root).isDirectory()) return [];
+  if (!fs10.existsSync(root) || !fs10.statSync(root).isDirectory()) return [];
   const out = [];
   for (const slug of listCapabilityFolderSlugs(root)) {
     if (!isSafeName(slug)) continue;
@@ -2684,7 +2709,7 @@ function getProfileInputs(name, roots = getImplementationRoots()) {
   const profilePath = resolveImplementation(name, roots);
   if (!profilePath) return null;
   try {
-    const document = JSON.parse(fs9.readFileSync(profilePath, "utf-8"));
+    const document = JSON.parse(fs10.readFileSync(profilePath, "utf-8"));
     if (!document || typeof document !== "object") return [];
     const raw = "config" in document && document.config && typeof document.config === "object" ? document.config : document;
     if (!Array.isArray(raw.inputs)) return [];
@@ -3781,8 +3806,8 @@ var init_capabilityMcp = __esm({
 
 // src/repoWorkspace.ts
 import { spawn as spawn2, spawnSync } from "child_process";
-import * as fs10 from "fs";
-import * as path11 from "path";
+import * as fs11 from "fs";
+import * as path12 from "path";
 function buildCloneProcess(repo, token, baseEnv = process.env) {
   const url = `https://github.com/${repo}.git`;
   const env = { ...baseEnv };
@@ -3797,10 +3822,10 @@ function buildCloneProcess(repo, token, baseEnv = process.env) {
 async function resolveAndClone(reposRoot, repo, repoToken, cloneRepo) {
   const name = repo?.trim();
   if (!name || !REPO_RE.test(name)) return null;
-  const root = path11.resolve(reposRoot);
-  const dir = path11.resolve(root, name);
-  if (dir !== root && !dir.startsWith(root + path11.sep)) return null;
-  if (fs10.existsSync(path11.join(dir, ".git"))) return dir;
+  const root = path12.resolve(reposRoot);
+  const dir = path12.resolve(root, name);
+  if (dir !== root && !dir.startsWith(root + path12.sep)) return null;
+  if (fs11.existsSync(path12.join(dir, ".git"))) return dir;
   const inflight = repoClones.get(dir);
   if (inflight) {
     await inflight;
@@ -3832,9 +3857,9 @@ var init_repoWorkspace = __esm({
     repoClones = /* @__PURE__ */ new Map();
     GIT_CREDENTIAL_HELPER = `!f() { if [ "$1" = get ] && [ -n "$GITHUB_TOKEN" ]; then printf '%s\\n' username=x-access-token "password=$GITHUB_TOKEN"; fi; }; f`;
     defaultCloneRepo = (repo, token, dir) => {
-      fs10.mkdirSync(path11.dirname(dir), { recursive: true });
+      fs11.mkdirSync(path12.dirname(dir), { recursive: true });
       const clone = buildCloneProcess(repo, token);
-      return new Promise((resolve21, reject) => {
+      return new Promise((resolve23, reject) => {
         const child = spawn2("git", ["clone", "--depth=1", clone.url, dir], {
           env: clone.env,
           stdio: "inherit"
@@ -3854,7 +3879,7 @@ var init_repoWorkspace = __esm({
             }
           } catch {
           }
-          resolve21();
+          resolve23();
         });
         child.on("error", reject);
       });
@@ -3926,8 +3951,8 @@ var init_fetchRepoMcp = __esm({
 });
 
 // src/agent.ts
-import * as fs11 from "fs";
-import * as path12 from "path";
+import * as fs12 from "fs";
+import * as path13 from "path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 function classifySubtype(subtype) {
   if (!subtype) return "generic_failed";
@@ -3996,8 +4021,8 @@ function buildAgentEnvironment(baseEnv, repoToken, requestEnvironment) {
 }
 async function runAgent(opts) {
   const ndjsonDir = opts.ndjsonDir ?? agentRunDir(opts.cwd);
-  fs11.mkdirSync(ndjsonDir, { recursive: true });
-  const ndjsonPath = path12.join(ndjsonDir, "last-run.jsonl");
+  fs12.mkdirSync(ndjsonDir, { recursive: true });
+  const ndjsonPath = path13.join(ndjsonDir, "last-run.jsonl");
   const env = buildAgentEnvironment(process.env, opts.repoToken, opts.environment);
   if (opts.litellmUrl) {
     env.ANTHROPIC_BASE_URL = opts.litellmUrl;
@@ -4015,12 +4040,13 @@ async function runAgent(opts) {
   let getSubmitted;
   const invokedSubagents = /* @__PURE__ */ new Set();
   const subagentInvocationHook = createSubagentInvocationHook(invokedSubagents);
+  const missingParentWriteGuard = createMissingParentWriteGuard(opts.cwd);
   const outputContractPostWriteHook = opts.outputContract ? createOutputContractPostWriteHook(opts.outputContract) : null;
   const outputContractStopHook = opts.outputContract ? createOutputContractStopHook(opts.outputContract) : null;
   for (let attempt = 0; ; attempt++) {
     let ndjsonWriteFailed = false;
     let ndjsonWriteError;
-    const fullLog = fs11.createWriteStream(ndjsonPath, { flags: "w" });
+    const fullLog = fs12.createWriteStream(ndjsonPath, { flags: "w" });
     fullLog.on("error", (err) => {
       ndjsonWriteFailed = true;
       ndjsonWriteError = err instanceof Error ? err.message : String(err);
@@ -4051,6 +4077,10 @@ async function runAgent(opts) {
             {
               matcher: "Agent",
               hooks: [enforceSubagentModelInheritance]
+            },
+            {
+              matcher: "Write",
+              hooks: [missingParentWriteGuard]
             }
           ],
           PostToolUse: [
@@ -4201,10 +4231,10 @@ async function runAgent(opts) {
         let timer;
         let next;
         if (turnTimeoutMs > 0) {
-          const timeoutPromise = new Promise((resolve21) => {
+          const timeoutPromise = new Promise((resolve23) => {
             timer = setTimeout(() => {
               timedOut = true;
-              resolve21({ done: true, value: void 0 });
+              resolve23({ done: true, value: void 0 });
             }, turnTimeoutMs);
           });
           next = await Promise.race([nextPromise, timeoutPromise]);
@@ -4220,7 +4250,7 @@ async function runAgent(opts) {
             try {
               await Promise.race([
                 iterator.return(void 0).catch(() => void 0),
-                new Promise((resolve21) => setTimeout(resolve21, 1e4).unref())
+                new Promise((resolve23) => setTimeout(resolve23, 1e4).unref())
               ]);
             } catch {
             }
@@ -4403,6 +4433,7 @@ var init_agent = __esm({
     init_claudeBinary();
     init_config();
     init_format();
+    init_fileEditGuards();
     init_outputContractHooks();
     init_runtimePaths();
     init_subagents();
@@ -4424,8 +4455,8 @@ var init_agent = __esm({
 });
 
 // src/agents.ts
-import * as fs12 from "fs";
-import * as path13 from "path";
+import * as fs13 from "fs";
+import * as path14 from "path";
 function stripFrontmatter(raw) {
   const match = /^---\n[\s\S]*?\n---\n?([\s\S]*)$/.exec(raw);
   return (match ? match[1] : raw).trim();
@@ -4434,8 +4465,8 @@ function loadAgentIdentity(cwd, slug, agentsDir = agentsRoot(cwd)) {
   const trimmed = slug.trim();
   if (!trimmed) throw new Error("loadAgentIdentity: empty agent slug");
   const agentPath = resolveAgentFile2(cwd, trimmed, agentsDir);
-  if (fs12.existsSync(agentPath)) {
-    const body = stripFrontmatter(fs12.readFileSync(agentPath, "utf-8"));
+  if (fs13.existsSync(agentPath)) {
+    const body = stripFrontmatter(fs13.readFileSync(agentPath, "utf-8"));
     if (body) return body;
     const builtinForEmpty = BUILTIN_AGENTS[trimmed];
     if (builtinForEmpty) return builtinForEmpty;
@@ -4446,8 +4477,8 @@ function loadAgentIdentity(cwd, slug, agentsDir = agentsRoot(cwd)) {
   throw new Error(`loadAgentIdentity: agent '${trimmed}' declared but ${agentPath} does not exist`);
 }
 function resolveAgentFile2(cwd, slug, agentsDir = agentsRoot(cwd)) {
-  const localPath = path13.resolve(cwd, agentsDir, `${slug}.md`);
-  if (fs12.existsSync(localPath)) return localPath;
+  const localPath = path14.resolve(cwd, agentsDir, `${slug}.md`);
+  if (fs13.existsSync(localPath)) return localPath;
   return localPath;
 }
 function frameAgentIdentity(slug, agent) {
@@ -4479,14 +4510,14 @@ var init_agents = __esm({
 });
 
 // src/task-artifacts.ts
-import fs13 from "fs";
-import path14 from "path";
+import fs14 from "fs";
+import path15 from "path";
 import posixPath from "path/posix";
 function prepareTaskArtifactsDir(cwd, taskId) {
   const safeId = String(taskId).replace(/[^a-zA-Z0-9._-]/g, "_");
   const absDir = runtimeStatePath(cwd, "task-artifacts", safeId);
   const relDir = absDir;
-  fs13.mkdirSync(absDir, { recursive: true });
+  fs14.mkdirSync(absDir, { recursive: true });
   return { taskId: safeId, absDir, relDir };
 }
 function initializeTaskArtifacts(artifacts, metadata = { taskType: "job" }) {
@@ -4516,16 +4547,16 @@ function initializeTaskArtifacts(artifacts, metadata = { taskType: "job" }) {
     "handoff-notes.md": "Baseline handoff: the agent did not provide additional notes.\n"
   };
   for (const file of TASK_ARTIFACT_FILES) {
-    const full = path14.join(artifacts.absDir, file);
-    if (!fs13.existsSync(full)) fs13.writeFileSync(full, defaults[file], "utf8");
+    const full = path15.join(artifacts.absDir, file);
+    if (!fs14.existsSync(full)) fs14.writeFileSync(full, defaults[file], "utf8");
   }
 }
 function verifyTaskArtifacts(absDir) {
   const missing = [];
   for (const name of TASK_ARTIFACT_FILES) {
-    const full = path14.join(absDir, name);
+    const full = path15.join(absDir, name);
     try {
-      const stat = fs13.statSync(full);
+      const stat = fs14.statSync(full);
       if (!stat.isFile() || stat.size === 0) missing.push(name);
     } catch {
       missing.push(name);
@@ -4541,11 +4572,11 @@ async function persistTaskArtifactsToState(config, _cwd, artifacts) {
   if (hasStateBackendConfig() && tenantId2) {
     const backend = createStateBackendFromEnv();
     for (const file of TASK_ARTIFACT_FILES) {
-      const full = path14.join(artifacts.absDir, file);
-      if (!fs13.existsSync(full)) continue;
-      const stat = fs13.statSync(full);
+      const full = path15.join(artifacts.absDir, file);
+      if (!fs14.existsSync(full)) continue;
+      const stat = fs14.statSync(full);
       if (!stat.isFile() || stat.size === 0) continue;
-      const content = fs13.readFileSync(full, "utf-8");
+      const content = fs14.readFileSync(full, "utf-8");
       const kind = file.replace(/\.(json|md)$/, "");
       let doc = content;
       if (file.endsWith(".json")) {
@@ -4693,6 +4724,15 @@ function validateWorkflow(value, options = {}) {
     if (step.input !== void 0 && step.inputs !== void 0) {
       issue(issues, "conflicting_inputs", base, "workflow step cannot declare both input and inputs");
     }
+    const timeoutSeconds = step.timeoutSeconds;
+    if (timeoutSeconds !== void 0 && (typeof timeoutSeconds !== "number" || !Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3600)) {
+      issue(
+        issues,
+        "invalid_step_timeout",
+        `${base}.timeoutSeconds`,
+        "workflow step timeoutSeconds must be an integer from 1 to 3600"
+      );
+    }
     validateInputBindings(
       step.inputs,
       `${base}.inputs`,
@@ -4845,15 +4885,15 @@ function validateWorkflow(value, options = {}) {
   }
   return issues;
 }
-function validateInputBindings(value, path55, issues, declaredInputs) {
+function validateInputBindings(value, path58, issues, declaredInputs) {
   if (value === void 0) return;
   const bindings = asRecord(value);
   if (!bindings || Object.keys(bindings).length === 0) {
-    issue(issues, "invalid_inputs", path55, "workflow step inputs must contain at least one named mapping");
+    issue(issues, "invalid_inputs", path58, "workflow step inputs must contain at least one named mapping");
     return;
   }
   for (const [name, value2] of Object.entries(bindings)) {
-    const bindingPath = `${path55}.${name}`;
+    const bindingPath = `${path58}.${name}`;
     if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(name)) {
       issue(issues, "invalid_input_name", bindingPath, `workflow input name ${name} is invalid`);
     }
@@ -4872,7 +4912,7 @@ function validateInputBindings(value, path55, issues, declaredInputs) {
     }
   }
 }
-function validateInputBindingSources(value, path55, issues, capabilitiesByStep, capabilityOutputs) {
+function validateInputBindingSources(value, path58, issues, capabilitiesByStep, capabilityOutputs) {
   const bindings = asRecord(value);
   if (!bindings) return;
   for (const [name, rawBinding] of Object.entries(bindings)) {
@@ -4885,7 +4925,7 @@ function validateInputBindingSources(value, path55, issues, capabilitiesByStep,
       issue(
         issues,
         "missing_input_step",
-        `${path55}.${name}.from`,
+        `${path58}.${name}.from`,
         `workflow input mapping references missing step ${sourceStep ?? "<none>"}`
       );
       continue;
@@ -4896,7 +4936,7 @@ function validateInputBindingSources(value, path55, issues, capabilitiesByStep,
       issue(
         issues,
         "undeclared_step_output",
-        `${path55}.${name}.from`,
+        `${path58}.${name}.from`,
         `workflow input mapping reads ${outputPath}, but step ${sourceStep} does not declare it`
       );
     }
@@ -4905,11 +4945,11 @@ function validateInputBindingSources(value, path55, issues, capabilitiesByStep,
 function formatWorkflowValidationIssues(issues) {
   return issues.map((entry) => `${entry.path}: ${entry.message}`);
 }
-function validateDataMatch(value, path55, issues, capabilityOutputs) {
+function validateDataMatch(value, path58, issues, capabilityOutputs) {
   if (value === void 0) return;
   const match = asRecord(value);
   if (!match || Object.keys(match).length === 0) {
-    issue(issues, "invalid_condition", path55, "workflow condition must contain at least one match");
+    issue(issues, "invalid_condition", path58, "workflow condition must contain at least one match");
     return;
   }
   for (const [field, expected] of Object.entries(match)) {
@@ -4917,7 +4957,7 @@ function validateDataMatch(value, path55, issues, capabilityOutputs) {
       issue(
         issues,
         "invalid_data_path",
-        `${path55}.${field}`,
+        `${path58}.${field}`,
         `workflow condition must read from facts, evidence, artifacts, result, workflow, or lastOutcome`
       );
     }
@@ -4925,12 +4965,12 @@ function validateDataMatch(value, path55, issues, capabilityOutputs) {
       issue(
         issues,
         "undeclared_result_path",
-        `${path55}.${field}`,
+        `${path58}.${field}`,
         `workflow condition reads ${field}, but the source capability does not declare it`
       );
     }
     if (!isComparable(expected)) {
-      issue(issues, "invalid_condition_value", `${path55}.${field}`, "workflow condition value must be a JSON scalar");
+      issue(issues, "invalid_condition_value", `${path58}.${field}`, "workflow condition value must be a JSON scalar");
     }
   }
 }
@@ -4954,8 +4994,8 @@ function isJsonValue(value) {
   if (!value || typeof value !== "object") return false;
   return Object.values(value).every(isJsonValue);
 }
-function issue(issues, code, path55, message) {
-  issues.push({ code, path: path55, message });
+function issue(issues, code, path58, message) {
+  issues.push({ code, path: path58, message });
 }
 var SAFE_NAME, SAFE_STEP_ID, SAFE_DATA_PATH, SAFE_INPUT_SOURCE, SUPPORTED_STEP_FIELDS, SUPPORTED_TRANSITION_FIELDS;
 var init_workflowValidation = __esm({
@@ -4976,6 +5016,7 @@ var init_workflowValidation = __esm({
       "delivery",
       "targetFact",
       "reason",
+      "timeoutSeconds",
       "next",
       "runWhen",
       "continueOn",
@@ -4987,8 +5028,8 @@ var init_workflowValidation = __esm({
 });
 
 // src/workflowDefinitions.ts
-import * as fs19 from "fs";
-import * as path20 from "path";
+import * as fs20 from "fs";
+import * as path21 from "path";
 function isWorkflowDefinitionId(value) {
   return WORKFLOW_ID_PATTERN.test(value);
 }
@@ -5033,12 +5074,12 @@ function readWorkflowDefinition(_config, cwd, id) {
   const root = cwd ?? process.cwd();
   const relativePath = workflowDefinitionPath(id);
   const candidates = [
-    path20.join(root, ".kody-engine", "runtime", relativePath),
-    path20.join(definitionsRoot(root), relativePath)
+    path21.join(root, ".kody-engine", "runtime", relativePath),
+    path21.join(definitionsRoot(root), relativePath)
   ];
   for (const filePath of candidates) {
-    if (!fs19.existsSync(filePath)) continue;
-    const workflow = parseWorkflowDefinition(fs19.readFileSync(filePath, "utf8"));
+    if (!fs20.existsSync(filePath)) continue;
+    const workflow = parseWorkflowDefinition(fs20.readFileSync(filePath, "utf8"));
     if (workflow) return workflow;
   }
   return null;
@@ -5046,7 +5087,7 @@ function readWorkflowDefinition(_config, cwd, id) {
 function workflowDefinitionToCapabilityFolder(id, workflow, source = workflowDefinitionPath(id)) {
   return {
     slug: id,
-    dir: path20.dirname(source),
+    dir: path21.dirname(source),
     profilePath: source,
     bodyPath: source,
     title: workflow.name,
@@ -5102,7 +5143,7 @@ var init_workflowDefinitions = __esm({
 
 // src/gha.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs22 from "fs";
+import * as fs23 from "fs";
 function getRunUrl() {
   const server = process.env.GITHUB_SERVER_URL;
   const repo = process.env.GITHUB_REPOSITORY;
@@ -5113,10 +5154,10 @@ function getRunUrl() {
 function reactToTriggerComment(cwd) {
   if (process.env.GITHUB_EVENT_NAME !== "issue_comment") return;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs22.existsSync(eventPath)) return;
+  if (!eventPath || !fs23.existsSync(eventPath)) return;
   let event = null;
   try {
-    event = JSON.parse(fs22.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs23.readFileSync(eventPath, "utf-8"));
   } catch {
     return;
   }
@@ -5646,15 +5687,15 @@ var init_lifecycles = __esm({
 
 // src/profile.ts
 import { createHash as createHash3 } from "crypto";
-import * as fs23 from "fs";
-import * as path22 from "path";
+import * as fs24 from "fs";
+import * as path23 from "path";
 function loadProfile(profilePath) {
-  if (!fs23.existsSync(profilePath)) {
+  if (!fs24.existsSync(profilePath)) {
     throw new ProfileError(profilePath, "file not found");
   }
   let raw;
   try {
-    raw = JSON.parse(fs23.readFileSync(profilePath, "utf-8"));
+    raw = JSON.parse(fs24.readFileSync(profilePath, "utf-8"));
   } catch (err) {
     throw new ProfileError(profilePath, `invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -5666,7 +5707,7 @@ function loadProfile(profilePath) {
   const unknownKeys = Object.keys(r).filter((k) => !KNOWN_PROFILE_KEYS.has(k));
   if (unknownKeys.length > 0) {
     process.stderr.write(
-      `[kody profile] ${path22.basename(path22.dirname(profilePath))}: unknown top-level keys ignored: ${unknownKeys.join(", ")}
+      `[kody profile] ${path23.basename(path23.dirname(profilePath))}: unknown top-level keys ignored: ${unknownKeys.join(", ")}
 `
     );
   }
@@ -5676,7 +5717,7 @@ function loadProfile(profilePath) {
     if (!refPath) {
       throw new ProfileError(profilePath, `capability references unknown implementation '${execRef}'`);
     }
-    if (path22.resolve(refPath) === path22.resolve(profilePath)) {
+    if (path23.resolve(refPath) === path23.resolve(profilePath)) {
     } else {
       const base = loadProfile(refPath);
       return {
@@ -5774,8 +5815,8 @@ function loadProfile(profilePath) {
     // Phase 5 in-process handoff opt-in. Default false; containers
     // flip to true after end-to-end verification.
     preloadContext: r.preloadContext === true,
-    dir: path22.dirname(profilePath),
-    promptTemplates: readPromptTemplates(path22.dirname(profilePath))
+    dir: path23.dirname(profilePath),
+    promptTemplates: readPromptTemplates(path23.dirname(profilePath))
   };
   if (lifecycle) {
     applyLifecycle(profile, profilePath);
@@ -5810,19 +5851,19 @@ function loadProfile(profilePath) {
   return profile;
 }
 function compileRuntimeDocument(runtimePath, document) {
-  if (path22.basename(runtimePath) !== "runtime.json") return document;
+  if (path23.basename(runtimePath) !== "runtime.json") return document;
   if (document.adapter !== "kody-engine-profile") {
     throw new ProfileError(runtimePath, "unsupported runtime adapter document");
   }
-  const implementationDir = path22.dirname(runtimePath);
-  const implementation = readJsonObject(path22.join(implementationDir, "definition.json"), "Implementation definition");
-  const definitionsRoot2 = path22.dirname(path22.dirname(implementationDir));
+  const implementationDir = path23.dirname(runtimePath);
+  const implementation = readJsonObject(path23.join(implementationDir, "definition.json"), "Implementation definition");
+  const definitionsRoot2 = path23.dirname(path23.dirname(implementationDir));
   const capabilityId = implementation.capabilityRef && typeof implementation.capabilityRef === "object" && !Array.isArray(implementation.capabilityRef) ? implementation.capabilityRef.id : void 0;
   if (typeof capabilityId !== "string" || !capabilityId) {
     throw new ProfileError(runtimePath, "Implementation capabilityRef is invalid");
   }
   const capability = readJsonObject(
-    path22.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
+    path23.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
     "Capability definition"
   );
   const {
@@ -5861,7 +5902,7 @@ function canonical(value) {
 }
 function readJsonObject(filePath, label) {
   try {
-    const value = JSON.parse(fs23.readFileSync(filePath, "utf-8"));
+    const value = JSON.parse(fs24.readFileSync(filePath, "utf-8"));
     if (!value || typeof value !== "object" || Array.isArray(value)) {
       throw new Error("must be an object");
     }
@@ -5879,17 +5920,17 @@ function readPromptTemplates(dir) {
   const out = {};
   const read = (p) => {
     try {
-      out[p] = fs23.readFileSync(p, "utf-8");
+      out[p] = fs24.readFileSync(p, "utf-8");
     } catch {
     }
   };
-  read(path22.join(dir, "prompt.md"));
-  read(path22.join(dir, "capability.md"));
-  read(path22.join(dir, "capability.md"));
+  read(path23.join(dir, "prompt.md"));
+  read(path23.join(dir, "capability.md"));
+  read(path23.join(dir, "capability.md"));
   try {
-    const promptsDir = path22.join(dir, "prompts");
-    for (const ent of fs23.readdirSync(promptsDir)) {
-      if (ent.endsWith(".md")) read(path22.join(promptsDir, ent));
+    const promptsDir = path23.join(dir, "prompts");
+    for (const ent of fs24.readdirSync(promptsDir)) {
+      if (ent.endsWith(".md")) read(path23.join(promptsDir, ent));
     }
   } catch {
   }
@@ -6666,16 +6707,16 @@ var init_state = __esm({
 });
 
 // src/prompt.ts
-import * as fs24 from "fs";
-import * as path23 from "path";
+import * as fs25 from "fs";
+import * as path24 from "path";
 function loadProjectConventions(projectDir) {
   const out = [];
   for (const rel of CONVENTION_FILES) {
-    const abs = path23.join(projectDir, rel);
-    if (!fs24.existsSync(abs)) continue;
+    const abs = path24.join(projectDir, rel);
+    if (!fs25.existsSync(abs)) continue;
     let content;
     try {
-      content = fs24.readFileSync(abs, "utf-8");
+      content = fs25.readFileSync(abs, "utf-8");
     } catch {
       continue;
     }
@@ -6910,8 +6951,8 @@ var loadMemoryContext_exports = {};
 __export(loadMemoryContext_exports, {
   loadMemoryContext: () => loadMemoryContext
 });
-import * as fs25 from "fs";
-import * as path24 from "path";
+import * as fs26 from "fs";
+import * as path25 from "path";
 function formatBlockFromBackend(docs) {
   const pages = docs.flatMap((record2) => {
     if (!record2.doc || typeof record2.doc !== "object") return [];
@@ -6934,21 +6975,21 @@ function collectPages(memoryAbs) {
   walkMd(memoryAbs, (file) => {
     let stat;
     try {
-      stat = fs25.statSync(file);
+      stat = fs26.statSync(file);
     } catch {
       return;
     }
     let raw;
     try {
-      raw = fs25.readFileSync(file, "utf-8");
+      raw = fs26.readFileSync(file, "utf-8");
     } catch {
       return;
     }
     const fm = raw.match(/^---\s*\n([\s\S]*?)\n---/);
-    const title = fm?.[1]?.match(/^title:\s*(.+)$/m)?.[1]?.trim() ?? path24.basename(file, ".md");
+    const title = fm?.[1]?.match(/^title:\s*(.+)$/m)?.[1]?.trim() ?? path25.basename(file, ".md");
     const updated = fm?.[1]?.match(/^updated:\s*([0-9T:.+\-Z]+)/m)?.[1]?.trim() ?? "";
     out.push({
-      relPath: path24.relative(memoryAbs, file),
+      relPath: path25.relative(memoryAbs, file),
       title,
       updated,
       content: raw.length > PER_PAGE_MAX_BYTES ? raw.slice(0, PER_PAGE_MAX_BYTES) + TRUNCATED_SUFFIX2 : raw,
@@ -7016,16 +7057,16 @@ function walkMd(root, visit) {
     const dir = stack.pop();
     let names;
     try {
-      names = fs25.readdirSync(dir);
+      names = fs26.readdirSync(dir);
     } catch {
       continue;
     }
     for (const name of names) {
       if (name.startsWith(".")) continue;
-      const full = path24.join(dir, name);
+      const full = path25.join(dir, name);
       let stat;
       try {
-        stat = fs25.statSync(full);
+        stat = fs26.statSync(full);
       } catch {
         continue;
       }
@@ -7060,8 +7101,8 @@ var init_loadMemoryContext = __esm({
         }
         return;
       }
-      const memoryAbs = path24.join(ctx.cwd, MEMORY_DIR_RELATIVE);
-      if (!fs25.existsSync(memoryAbs)) {
+      const memoryAbs = path25.join(ctx.cwd, MEMORY_DIR_RELATIVE);
+      if (!fs26.existsSync(memoryAbs)) {
         ctx.data.memoryContext = "";
         return;
       }
@@ -7105,11 +7146,11 @@ var init_loadCoverageRules = __esm({
 
 // src/container.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 function getProfileInputsForChild(profileName, _cwd) {
   try {
     const profilePath = resolveProfilePath(profileName);
-    if (!fs26.existsSync(profilePath)) return null;
+    if (!fs27.existsSync(profilePath)) return null;
     return loadProfile(profilePath).inputs;
   } catch {
     return null;
@@ -7573,10 +7614,10 @@ var init_lifecycleLabels = __esm({
 
 // src/litellm.ts
 import { execFileSync as execFileSync4, spawn as spawn4 } from "child_process";
-import * as fs27 from "fs";
+import * as fs28 from "fs";
 import * as net from "net";
 import * as os4 from "os";
-import * as path25 from "path";
+import * as path26 from "path";
 async function checkLitellmHealth(url) {
   try {
     const response = await fetch(`${url}/health`, { signal: AbortSignal.timeout(3e3) });
@@ -7646,7 +7687,7 @@ function locateLitellmScript() {
 }
 function resolveLitellmCommand() {
   const imageScript = "/opt/venv/bin/litellm";
-  if (fs27.existsSync(imageScript)) return imageScript;
+  if (fs28.existsSync(imageScript)) return imageScript;
   try {
     execFileSync4("which", ["litellm"], { timeout: 3e3, stdio: "pipe" });
     return "litellm";
@@ -7689,13 +7730,13 @@ async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL
   const spawnProxy = () => {
     const portMatch = activeUrl.match(/:(\d+)/);
     const port = portMatch ? portMatch[1] : "4000";
-    const configPath = path25.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.yaml`);
-    fs27.writeFileSync(configPath, generateLitellmConfigYaml(model));
+    const configPath = path26.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.yaml`);
+    fs28.writeFileSync(configPath, generateLitellmConfigYaml(model));
     const args = ["--config", configPath, "--port", port];
-    const nextLogPath = path25.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.log`);
-    const outFd = fs27.openSync(nextLogPath, "w");
+    const nextLogPath = path26.join(os4.tmpdir(), `kody-local-litellm-${Date.now()}.log`);
+    const outFd = fs28.openSync(nextLogPath, "w");
     child = spawn4(cmd, args, { stdio: ["ignore", outFd, outFd], detached: true, env: childEnv });
-    fs27.closeSync(outFd);
+    fs28.closeSync(outFd);
     logPath = nextLogPath;
   };
   const waitForHealth = async () => {
@@ -7709,7 +7750,7 @@ async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL
   const readLogTail = () => {
     if (!logPath) return "";
     try {
-      return fs27.readFileSync(logPath, "utf-8").slice(-2e3);
+      return fs28.readFileSync(logPath, "utf-8").slice(-2e3);
     } catch {
       return "";
     }
@@ -7782,20 +7823,20 @@ async function nextAvailableLitellmUrl(url) {
   throw new Error(`no free LiteLLM port found after ${startPort}`);
 }
 function canListen(port, host) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const server = net.createServer();
-    server.once("error", () => resolve21(false));
+    server.once("error", () => resolve23(false));
     server.once("listening", () => {
-      server.close(() => resolve21(true));
+      server.close(() => resolve23(true));
     });
     server.listen(port, host);
   });
 }
 function readDotenvApiKeys(projectDir) {
-  const dotenvPath = path25.join(projectDir, ".env");
-  if (!fs27.existsSync(dotenvPath)) return {};
+  const dotenvPath = path26.join(projectDir, ".env");
+  if (!fs28.existsSync(dotenvPath)) return {};
   const result = {};
-  for (const rawLine of fs27.readFileSync(dotenvPath, "utf-8").split("\n")) {
+  for (const rawLine of fs28.readFileSync(dotenvPath, "utf-8").split("\n")) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) continue;
     const match = line.match(/^([A-Z_][A-Z0-9_]*_API_KEY)=(.*)$/);
@@ -8454,8 +8495,8 @@ var init_pushWithRetry = __esm({
 
 // src/commit.ts
 import { execFileSync as execFileSync6 } from "child_process";
-import * as fs28 from "fs";
-import * as path26 from "path";
+import * as fs29 from "fs";
+import * as path27 from "path";
 function isGitHubYamlPath(filePath) {
   const normalized = filePath.replace(/^\.\/+/, "");
   return normalized.startsWith(".github/") && /\.ya?ml$/i.test(normalized);
@@ -8497,18 +8538,18 @@ function ensureGitIdentity(cwd) {
 }
 function abortUnfinishedGitOps(cwd) {
   const aborted = [];
-  const gitDir = path26.join(cwd ?? process.cwd(), ".git");
-  if (!fs28.existsSync(gitDir)) return aborted;
-  if (fs28.existsSync(path26.join(gitDir, "MERGE_HEAD"))) {
+  const gitDir = path27.join(cwd ?? process.cwd(), ".git");
+  if (!fs29.existsSync(gitDir)) return aborted;
+  if (fs29.existsSync(path27.join(gitDir, "MERGE_HEAD"))) {
     if (tryGit(["merge", "--abort"], cwd)) aborted.push("merge");
   }
-  if (fs28.existsSync(path26.join(gitDir, "CHERRY_PICK_HEAD"))) {
+  if (fs29.existsSync(path27.join(gitDir, "CHERRY_PICK_HEAD"))) {
     if (tryGit(["cherry-pick", "--abort"], cwd)) aborted.push("cherry-pick");
   }
-  if (fs28.existsSync(path26.join(gitDir, "REVERT_HEAD"))) {
+  if (fs29.existsSync(path27.join(gitDir, "REVERT_HEAD"))) {
     if (tryGit(["revert", "--abort"], cwd)) aborted.push("revert");
   }
-  if (fs28.existsSync(path26.join(gitDir, "rebase-merge")) || fs28.existsSync(path26.join(gitDir, "rebase-apply"))) {
+  if (fs29.existsSync(path27.join(gitDir, "rebase-merge")) || fs29.existsSync(path27.join(gitDir, "rebase-apply"))) {
     if (tryGit(["rebase", "--abort"], cwd)) aborted.push("rebase");
   }
   try {
@@ -8565,7 +8606,7 @@ function normalizeCommitMessage(raw) {
 function commitAndPush(branch, agentMessage, cwd) {
   const allChanged = listChangedFiles(cwd);
   const allowedFiles = allChanged.filter((f) => !isForbiddenPath(f));
-  const mergeHeadExists = fs28.existsSync(path26.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
+  const mergeHeadExists = fs29.existsSync(path27.join(cwd ?? process.cwd(), ".git", "MERGE_HEAD"));
   if (allowedFiles.length === 0 && !mergeHeadExists) {
     return { committed: false, pushed: false, sha: "", message: "" };
   }
@@ -9205,13 +9246,13 @@ var init_state2 = __esm({
 });
 
 // src/goal/runLog.ts
-import * as fs29 from "fs";
+import * as fs30 from "fs";
 function stageGoalRunLogEvent(data, goalId, event, at = nowIso()) {
   const logs = goalRunLogs(data);
   const existing = logs[goalId];
-  const path55 = existing?.path ?? goalRunLogPath(goalId, data);
+  const path58 = existing?.path ?? goalRunLogPath(goalId, data);
   logs[goalId] = {
-    path: path55,
+    path: path58,
     events: [...existing?.events ?? [], buildGoalRunLogEvent(data, goalId, event, at)]
   };
 }
@@ -9547,8 +9588,8 @@ function readGithubEvent() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
   if (!eventPath) return null;
   try {
-    if (!fs29.existsSync(eventPath)) return null;
-    const parsed = JSON.parse(fs29.readFileSync(eventPath, "utf-8"));
+    if (!fs30.existsSync(eventPath)) return null;
+    const parsed = JSON.parse(fs30.readFileSync(eventPath, "utf-8"));
     return recordValue3(parsed);
   } catch {
     return null;
@@ -9658,8 +9699,8 @@ var init_stateStore = __esm({
 });
 
 // src/goal/targetLoopResolution.ts
-import * as fs30 from "fs";
-import * as path27 from "path";
+import * as fs31 from "fs";
+import * as path28 from "path";
 async function resolveActiveGoalLoopTarget(config, cwd, loopGoalId, loopGoal) {
   const targetId = loopGoal.loopTarget?.id.trim() ?? "";
   assertSafeGoalId(targetId, "loop target");
@@ -9737,11 +9778,11 @@ function goalInstanceTime(state) {
   return Number.isNaN(parsed) ? 0 : parsed;
 }
 function loadGoalTemplate(cwd, targetId) {
-  return readJsonObject2(path27.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
+  return readJsonObject2(path28.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
 }
 function readJsonObject2(filePath) {
-  if (!fs30.existsSync(filePath)) return null;
-  const parsed = JSON.parse(fs30.readFileSync(filePath, "utf8"));
+  if (!fs31.existsSync(filePath)) return null;
+  const parsed = JSON.parse(fs31.readFileSync(filePath, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`goal template ${filePath} must be a JSON object`);
   }
@@ -10088,15 +10129,15 @@ var init_backendStateBackend = __esm({
         this.jobsDir = opts.jobsDir.replace(/\/+$/, "");
       }
       async load(slug) {
-        const path55 = stateFilePath(this.jobsDir, slug);
+        const path58 = stateFilePath(this.jobsDir, slug);
         const loaded = await createStateBackendFromEnv().get(this.tenantId, `capabilities/${slug}`, "job-state");
         if (!loaded) {
-          return { path: path55, handle: null, state: initialStateEnvelope("seed"), created: true };
+          return { path: path58, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
         if (!isStateEnvelope(loaded.doc)) {
           throw new Error(`BackendStateBackend: capabilities/${slug} is not a StateEnvelope`);
         }
-        return { path: path55, handle: loaded.updatedAt, state: loaded.doc, created: false };
+        return { path: path58, handle: loaded.updatedAt, state: loaded.doc, created: false };
       }
       async save(loaded, next) {
         if (!loaded.created && isStateUnchanged(loaded.state, next)) return false;
@@ -10116,8 +10157,8 @@ var init_backendStateBackend = __esm({
 });
 
 // src/scripts/jobState/localFileBackend.ts
-import * as fs31 from "fs";
-import * as path28 from "path";
+import * as fs32 from "fs";
+import * as path29 from "path";
 function sanitizeKey(s) {
   return s.replace(/[^A-Za-z0-9._-]/g, "-");
 }
@@ -10173,7 +10214,7 @@ var init_localFileBackend = __esm({
         if (!opts.owner || !opts.repo) throw new Error("LocalFileBackend: owner and repo are required");
         this.cwd = opts.cwd;
         this.jobsDir = opts.jobsDir;
-        this.absDir = path28.resolve(opts.cwd, opts.jobsDir);
+        this.absDir = path29.resolve(opts.cwd, opts.jobsDir);
         this.owner = opts.owner;
         this.repo = opts.repo;
         this.cache = opts.cache ?? defaultCacheAdapter();
@@ -10188,7 +10229,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        fs31.mkdirSync(this.absDir, { recursive: true });
+        fs32.mkdirSync(this.absDir, { recursive: true });
         const prefix = this.cacheKeyPrefix();
         const probeKey = `${prefix}probe-${Date.now()}`;
         try {
@@ -10217,7 +10258,7 @@ var init_localFileBackend = __esm({
 `);
           return;
         }
-        if (!fs31.existsSync(this.absDir)) {
+        if (!fs32.existsSync(this.absDir)) {
           return;
         }
         const key = `${this.cacheKeyPrefix()}${process.env.GITHUB_RUN_ID ?? "norunid"}-${Date.now()}`;
@@ -10233,11 +10274,11 @@ var init_localFileBackend = __esm({
       }
       load(slug) {
         const relPath = stateFilePath(this.jobsDir, slug);
-        const absPath = path28.resolve(this.cwd, relPath);
-        if (!fs31.existsSync(absPath)) {
+        const absPath = path29.resolve(this.cwd, relPath);
+        if (!fs32.existsSync(absPath)) {
           return { path: relPath, handle: null, state: initialStateEnvelope("seed"), created: true };
         }
-        const raw = fs31.readFileSync(absPath, "utf-8");
+        const raw = fs32.readFileSync(absPath, "utf-8");
         let parsed;
         try {
           parsed = JSON.parse(raw);
@@ -10254,13 +10295,13 @@ var init_localFileBackend = __esm({
         if (!loaded.created && isStateUnchanged(loaded.state, next)) {
           return false;
         }
-        const absPath = path28.resolve(this.cwd, loaded.path);
-        fs31.mkdirSync(path28.dirname(absPath), { recursive: true });
+        const absPath = path29.resolve(this.cwd, loaded.path);
+        fs32.mkdirSync(path29.dirname(absPath), { recursive: true });
         const body = `${JSON.stringify(next, null, 2)}
 `;
         const tmpPath = `${absPath}.${process.pid}.tmp`;
-        fs31.writeFileSync(tmpPath, body, "utf-8");
-        fs31.renameSync(tmpPath, absPath);
+        fs32.writeFileSync(tmpPath, body, "utf-8");
+        fs32.renameSync(tmpPath, absPath);
         return true;
       }
       cacheKeyPrefix() {
@@ -10292,7 +10333,7 @@ var init_jobState = __esm({
 });
 
 // src/scripts/goalCapabilityScheduling.ts
-import * as path29 from "path";
+import * as path30 from "path";
 function isCapabilityCadenceGoal(goal, extra) {
   return extra.scheduleMode === "agentLoop" || extra.scheduler === "agentLoop" || goal.type === "standing" && goal.capabilities.length > 0;
 }
@@ -10348,7 +10389,7 @@ function planTargetLoopSchedule(opts) {
 }
 async function planGoalCapabilitySchedule(opts) {
   const jobsDir = opts.jobsDir ?? capabilitiesRoot(opts.cwd);
-  const jobsRoot = path29.resolve(opts.cwd, jobsDir);
+  const jobsRoot = path30.resolve(opts.cwd, jobsDir);
   const now = opts.now ?? /* @__PURE__ */ new Date();
   const at = now.toISOString();
   const backend = resolveBackend({ config: opts.config, cwd: opts.cwd, jobsDir });
@@ -12164,8 +12205,8 @@ var init_classifyByLabel = __esm({
 
 // src/scripts/commitAndPush.ts
 import { createHash as createHash5 } from "crypto";
-import * as fs32 from "fs";
-import * as path30 from "path";
+import * as fs33 from "fs";
+import * as path31 from "path";
 function sentinelPathForStage(cwd, profileName, workflowExecutionKey) {
   const runId = resolveRunId();
   const executionSuffix = typeof workflowExecutionKey === "string" && workflowExecutionKey.length > 0 ? `-${createHash5("sha256").update(workflowExecutionKey).digest("hex").slice(0, 16)}` : "";
@@ -12187,9 +12228,9 @@ var init_commitAndPush = __esm({
       }
       const idempotencyEnabled = process.env.KODY_COMMIT_IDEMPOTENCY !== "0";
       const sentinel = idempotencyEnabled ? sentinelPathForStage(ctx.cwd, profile.name, ctx.data.workflowExecutionKey) : null;
-      if (sentinel && fs32.existsSync(sentinel)) {
+      if (sentinel && fs33.existsSync(sentinel)) {
         try {
-          const replay = JSON.parse(fs32.readFileSync(sentinel, "utf-8"));
+          const replay = JSON.parse(fs33.readFileSync(sentinel, "utf-8"));
           ctx.data.commitResult = replay.commitResult ?? { committed: false, pushed: false };
           if (Array.isArray(replay.changedFiles)) ctx.data.changedFiles = replay.changedFiles;
           if (typeof replay.hasCommitsAhead === "boolean") ctx.data.hasCommitsAhead = replay.hasCommitsAhead;
@@ -12249,8 +12290,8 @@ var init_commitAndPush = __esm({
       const result = ctx.data.commitResult;
       if (sentinel && result?.committed) {
         try {
-          fs32.mkdirSync(path30.dirname(sentinel), { recursive: true });
-          fs32.writeFileSync(
+          fs33.mkdirSync(path31.dirname(sentinel), { recursive: true });
+          fs33.writeFileSync(
             sentinel,
             JSON.stringify(
               {
@@ -12344,8 +12385,8 @@ var init_commitGoalState = __esm({
 });
 
 // src/scripts/composePrompt.ts
-import * as fs33 from "fs";
-import * as path31 from "path";
+import * as fs34 from "fs";
+import * as path32 from "path";
 function fenceUntrusted(value) {
   if (value.trim().length === 0) return value;
   const safe = value.replace(/-{3,}\s*END UNTRUSTED INPUT\s*-{3,}/gi, "[END UNTRUSTED INPUT]");
@@ -12469,10 +12510,10 @@ var init_composePrompt = __esm({
       const explicit = ctx.data.promptTemplate;
       const mode = ctx.args.mode;
       const candidates = [
-        explicit ? path31.join(profile.dir, explicit) : null,
-        mode ? path31.join(profile.dir, "prompts", `${mode}.md`) : null,
-        path31.join(profile.dir, "prompt.md"),
-        path31.join(profile.dir, "capability.md")
+        explicit ? path32.join(profile.dir, explicit) : null,
+        mode ? path32.join(profile.dir, "prompts", `${mode}.md`) : null,
+        path32.join(profile.dir, "prompt.md"),
+        path32.join(profile.dir, "capability.md")
       ].filter(Boolean);
       let templatePath = "";
       let template = "";
@@ -12485,7 +12526,7 @@ var init_composePrompt = __esm({
           break;
         }
         try {
-          template = fs33.readFileSync(c, "utf-8");
+          template = fs34.readFileSync(c, "utf-8");
           templatePath = c;
           break;
         } catch (err) {
@@ -12496,7 +12537,7 @@ var init_composePrompt = __esm({
       if (!templatePath) {
         let dirState;
         try {
-          dirState = `dir contents: [${fs33.readdirSync(profile.dir).join(", ")}]`;
+          dirState = `dir contents: [${fs34.readdirSync(profile.dir).join(", ")}]`;
         } catch (err) {
           dirState = `readdir(${profile.dir}) failed: ${err?.code ?? String(err)}`;
         }
@@ -13230,19 +13271,19 @@ var init_deriveQaScopeFromIssue = __esm({
 
 // src/scripts/diagMcp.ts
 import { execFileSync as execFileSync9 } from "child_process";
-import * as fs34 from "fs";
+import * as fs35 from "fs";
 import * as os5 from "os";
-import * as path32 from "path";
+import * as path33 from "path";
 var diagMcp;
 var init_diagMcp = __esm({
   "src/scripts/diagMcp.ts"() {
     "use strict";
     diagMcp = async (_ctx) => {
       const home = os5.homedir();
-      const cacheDir = path32.join(home, ".cache", "ms-playwright");
+      const cacheDir = path33.join(home, ".cache", "ms-playwright");
       let entries = [];
       try {
-        entries = fs34.readdirSync(cacheDir);
+        entries = fs35.readdirSync(cacheDir);
       } catch {
       }
       const hasChromium = entries.some((e) => e.startsWith("chromium"));
@@ -13270,13 +13311,13 @@ var init_diagMcp = __esm({
 });
 
 // src/scripts/frameworkDetectors.ts
-import * as fs35 from "fs";
-import * as path33 from "path";
+import * as fs36 from "fs";
+import * as path34 from "path";
 function detectFrameworks(cwd) {
   const out = [];
   let deps = {};
   try {
-    const pkg = JSON.parse(fs35.readFileSync(path33.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs36.readFileSync(path34.join(cwd, "package.json"), "utf-8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return out;
@@ -13313,25 +13354,25 @@ function detectFrameworks(cwd) {
 }
 function findFile(cwd, candidates) {
   for (const c of candidates) {
-    if (fs35.existsSync(path33.join(cwd, c))) return c;
+    if (fs36.existsSync(path34.join(cwd, c))) return c;
   }
   return null;
 }
 function discoverPayloadCollections(cwd) {
   const out = [];
   for (const dir of COLLECTION_DIRS) {
-    const full = path33.join(cwd, dir);
-    if (!fs35.existsSync(full)) continue;
+    const full = path34.join(cwd, dir);
+    if (!fs36.existsSync(full)) continue;
     let files;
     try {
-      files = fs35.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs36.readdirSync(full).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const file of files) {
       try {
-        const filePath = path33.join(full, file);
-        const content = fs35.readFileSync(filePath, "utf-8").slice(0, 1e4);
+        const filePath = path34.join(full, file);
+        const content = fs36.readFileSync(filePath, "utf-8").slice(0, 1e4);
         const slugMatch = content.match(/slug:\s*['"]([a-z0-9-]+)['"]/);
         if (!slugMatch) continue;
         const slug = slugMatch[1];
@@ -13345,7 +13386,7 @@ function discoverPayloadCollections(cwd) {
         out.push({
           name,
           slug,
-          filePath: path33.relative(cwd, filePath),
+          filePath: path34.relative(cwd, filePath),
           fields: fields.slice(0, 20),
           hasAdmin
         });
@@ -13358,28 +13399,28 @@ function discoverPayloadCollections(cwd) {
 function discoverAdminComponents(cwd, collections) {
   const out = [];
   for (const dir of ADMIN_COMPONENT_DIRS) {
-    const full = path33.join(cwd, dir);
-    if (!fs35.existsSync(full)) continue;
+    const full = path34.join(cwd, dir);
+    if (!fs36.existsSync(full)) continue;
     let entries;
     try {
-      entries = fs35.readdirSync(full, { withFileTypes: true });
+      entries = fs36.readdirSync(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const entryPath = path33.join(full, entry.name);
+      const entryPath = path34.join(full, entry.name);
       let name;
       let filePath;
       if (entry.isDirectory()) {
         const indexFile = ["index.tsx", "index.ts", "index.jsx", "index.js"].find(
-          (f) => fs35.existsSync(path33.join(entryPath, f))
+          (f) => fs36.existsSync(path34.join(entryPath, f))
         );
         if (!indexFile) continue;
         name = entry.name;
-        filePath = path33.relative(cwd, path33.join(entryPath, indexFile));
+        filePath = path34.relative(cwd, path34.join(entryPath, indexFile));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
         name = entry.name.replace(/\.(tsx?|jsx?)$/, "");
-        filePath = path33.relative(cwd, entryPath);
+        filePath = path34.relative(cwd, entryPath);
       } else {
         continue;
       }
@@ -13387,7 +13428,7 @@ function discoverAdminComponents(cwd, collections) {
       if (collections) {
         for (const col of collections) {
           try {
-            const colContent = fs35.readFileSync(path33.join(cwd, col.filePath), "utf-8");
+            const colContent = fs36.readFileSync(path34.join(cwd, col.filePath), "utf-8");
             if (colContent.includes(name)) {
               usedInCollection = col.slug;
               break;
@@ -13405,8 +13446,8 @@ function scanApiRoutes(cwd) {
   const out = [];
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const apiDir = path33.join(cwd, appDir, "api");
-    if (!fs35.existsSync(apiDir)) continue;
+    const apiDir = path34.join(cwd, appDir, "api");
+    if (!fs36.existsSync(apiDir)) continue;
     walkApiRoutes(apiDir, "/api", cwd, out);
     break;
   }
@@ -13415,14 +13456,14 @@ function scanApiRoutes(cwd) {
 function walkApiRoutes(dir, prefix, cwd, out) {
   let entries;
   try {
-    entries = fs35.readdirSync(dir, { withFileTypes: true });
+    entries = fs36.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   const routeFile = entries.find((e) => e.isFile() && /^route\.(ts|js|tsx|jsx)$/.test(e.name));
   if (routeFile) {
     try {
-      const content = fs35.readFileSync(path33.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
+      const content = fs36.readFileSync(path34.join(dir, routeFile.name), "utf-8").slice(0, 5e3);
       const methods = HTTP_METHODS.filter(
         (m) => new RegExp(`export\\s+(?:async\\s+)?function\\s+${m}\\b`).test(content)
       );
@@ -13430,7 +13471,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
         out.push({
           path: prefix,
           methods,
-          filePath: path33.relative(cwd, path33.join(dir, routeFile.name))
+          filePath: path34.relative(cwd, path34.join(dir, routeFile.name))
         });
       }
     } catch {
@@ -13441,7 +13482,7 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkApiRoutes(path33.join(dir, entry.name), prefix, cwd, out);
+      walkApiRoutes(path34.join(dir, entry.name), prefix, cwd, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -13449,16 +13490,16 @@ function walkApiRoutes(dir, prefix, cwd, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkApiRoutes(path33.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
+    walkApiRoutes(path34.join(dir, entry.name), `${prefix}/${segment}`, cwd, out);
   }
 }
 function scanEnvVars(cwd) {
   const candidates = [".env.example", ".env.local.example", ".env.template"];
   for (const envFile of candidates) {
-    const envPath = path33.join(cwd, envFile);
-    if (!fs35.existsSync(envPath)) continue;
+    const envPath = path34.join(cwd, envFile);
+    if (!fs36.existsSync(envPath)) continue;
     try {
-      const content = fs35.readFileSync(envPath, "utf-8");
+      const content = fs36.readFileSync(envPath, "utf-8");
       const vars = [];
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
@@ -13503,8 +13544,8 @@ var init_frameworkDetectors = __esm({
 });
 
 // src/scripts/discoverQaContext.ts
-import * as fs36 from "fs";
-import * as path34 from "path";
+import * as fs37 from "fs";
+import * as path35 from "path";
 function runQaDiscovery(cwd) {
   const out = {
     routes: [],
@@ -13535,9 +13576,9 @@ function runQaDiscovery(cwd) {
 }
 function detectDevServer(cwd, out) {
   try {
-    const pkg = JSON.parse(fs36.readFileSync(path34.join(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(fs37.readFileSync(path35.join(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-    const pm = fs36.existsSync(path34.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs36.existsSync(path34.join(cwd, "yarn.lock")) ? "yarn" : fs36.existsSync(path34.join(cwd, "bun.lockb")) ? "bun" : "npm";
+    const pm = fs37.existsSync(path35.join(cwd, "pnpm-lock.yaml")) ? "pnpm" : fs37.existsSync(path35.join(cwd, "yarn.lock")) ? "yarn" : fs37.existsSync(path35.join(cwd, "bun.lockb")) ? "bun" : "npm";
     if (pkg.scripts?.dev) out.devCommand = `${pm} dev`;
     if (allDeps.next || allDeps.nuxt) out.devPort = 3e3;
     else if (allDeps.vite) out.devPort = 5173;
@@ -13547,8 +13588,8 @@ function detectDevServer(cwd, out) {
 function scanFrontendRoutes(cwd, out) {
   const appDirs = ["src/app", "app"];
   for (const appDir of appDirs) {
-    const full = path34.join(cwd, appDir);
-    if (!fs36.existsSync(full)) continue;
+    const full = path35.join(cwd, appDir);
+    if (!fs37.existsSync(full)) continue;
     walkFrontendRoutes(full, "", out);
     break;
   }
@@ -13556,7 +13597,7 @@ function scanFrontendRoutes(cwd, out) {
 function walkFrontendRoutes(dir, prefix, out) {
   let entries;
   try {
-    entries = fs36.readdirSync(dir, { withFileTypes: true });
+    entries = fs37.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -13573,7 +13614,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     if (entry.name === "node_modules" || entry.name === ".next") continue;
     let segment = entry.name;
     if (segment.startsWith("(") && segment.endsWith(")")) {
-      walkFrontendRoutes(path34.join(dir, entry.name), prefix, out);
+      walkFrontendRoutes(path35.join(dir, entry.name), prefix, out);
       continue;
     }
     if (segment.startsWith("[[") && segment.endsWith("]]")) {
@@ -13581,7 +13622,7 @@ function walkFrontendRoutes(dir, prefix, out) {
     } else if (segment.startsWith("[") && segment.endsWith("]")) {
       segment = `:${segment.slice(1, -1)}`;
     }
-    walkFrontendRoutes(path34.join(dir, entry.name), `${prefix}/${segment}`, out);
+    walkFrontendRoutes(path35.join(dir, entry.name), `${prefix}/${segment}`, out);
   }
 }
 function detectAuthFiles(cwd, out) {
@@ -13598,23 +13639,23 @@ function detectAuthFiles(cwd, out) {
     "src/app/api/oauth"
   ];
   for (const c of candidates) {
-    if (fs36.existsSync(path34.join(cwd, c))) out.authFiles.push(c);
+    if (fs37.existsSync(path35.join(cwd, c))) out.authFiles.push(c);
   }
 }
 function detectRoles(cwd, out) {
   const rolePaths = ["src/types", "src/lib", "src/utils", "src/constants", "src/access", "src/collections"];
   for (const rp of rolePaths) {
-    const dir = path34.join(cwd, rp);
-    if (!fs36.existsSync(dir)) continue;
+    const dir = path35.join(cwd, rp);
+    if (!fs37.existsSync(dir)) continue;
     let files;
     try {
-      files = fs36.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      files = fs37.readdirSync(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
     } catch {
       continue;
     }
     for (const f of files) {
       try {
-        const content = fs36.readFileSync(path34.join(dir, f), "utf-8").slice(0, 5e3);
+        const content = fs37.readFileSync(path35.join(dir, f), "utf-8").slice(0, 5e3);
         const roleMatches = content.match(/(?:role|Role|ROLE)\s*[=:]\s*['"](\w+)['"]/g);
         if (roleMatches) {
           for (const m of roleMatches) {
@@ -13875,8 +13916,8 @@ var init_dispatchClassified = __esm({
 });
 
 // src/loopDefinitions.ts
-import * as fs37 from "fs";
-import * as path35 from "path";
+import * as fs38 from "fs";
+import * as path36 from "path";
 function normalizeLoopDefinition(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const raw = value;
@@ -13903,10 +13944,10 @@ function readLoopDefinition(cwd, id) {
   if (!ID.test(id)) return null;
   const roots = loopRoots(cwd);
   for (const root of roots) {
-    const filePath = path35.join(root, "loops", id, "loop.json");
-    if (!fs37.existsSync(filePath)) continue;
+    const filePath = path36.join(root, "loops", id, "loop.json");
+    if (!fs38.existsSync(filePath)) continue;
     try {
-      const loop = normalizeLoopDefinition(JSON.parse(fs37.readFileSync(filePath, "utf8")));
+      const loop = normalizeLoopDefinition(JSON.parse(fs38.readFileSync(filePath, "utf8")));
       if (loop?.id === id) return loop;
       process.stderr.write(`[kody] invalid Loop definition: ${filePath}
 `);
@@ -13916,7 +13957,7 @@ function readLoopDefinition(cwd, id) {
     }
   }
   process.stderr.write(
-    `[kody] Loop not found: ${id} (${roots.map((root) => path35.join(root, "loops", id, "loop.json")).join(", ")})
+    `[kody] Loop not found: ${id} (${roots.map((root) => path36.join(root, "loops", id, "loop.json")).join(", ")})
 `
   );
   return null;
@@ -13925,14 +13966,14 @@ function listLoopDefinitions(cwd) {
   const roots = loopRoots(cwd);
   const byId = /* @__PURE__ */ new Map();
   for (const root of roots.reverse()) {
-    const loopsDir = path35.join(root, "loops");
-    if (!fs37.existsSync(loopsDir)) continue;
-    for (const id of fs37.readdirSync(loopsDir).sort()) {
+    const loopsDir = path36.join(root, "loops");
+    if (!fs38.existsSync(loopsDir)) continue;
+    for (const id of fs38.readdirSync(loopsDir).sort()) {
       if (!ID.test(id)) continue;
-      const filePath = path35.join(loopsDir, id, "loop.json");
-      if (!fs37.existsSync(filePath)) continue;
+      const filePath = path36.join(loopsDir, id, "loop.json");
+      if (!fs38.existsSync(filePath)) continue;
       try {
-        const loop = normalizeLoopDefinition(JSON.parse(fs37.readFileSync(filePath, "utf8")));
+        const loop = normalizeLoopDefinition(JSON.parse(fs38.readFileSync(filePath, "utf8")));
         if (loop?.id === id) byId.set(id, loop);
       } catch {
         process.stderr.write(`[kody] unreadable Loop definition: ${filePath}
@@ -13944,8 +13985,8 @@ function listLoopDefinitions(cwd) {
 }
 function loopRoots(cwd) {
   return [
-    path35.join(cwd, ".kody-engine", "runtime"),
-    path35.join(cwd, ".kody-engine", "definitions"),
+    path36.join(cwd, ".kody-engine", "runtime"),
+    path36.join(cwd, ".kody-engine", "definitions"),
     definitionsRoot(cwd)
   ].filter((root, index, roots) => roots.indexOf(root) === index);
 }
@@ -15223,15 +15264,15 @@ var init_fixFlow = __esm({
 });
 
 // src/workflow-template.ts
-import * as fs38 from "fs";
-import * as path36 from "path";
+import * as fs39 from "fs";
+import * as path37 from "path";
 import { fileURLToPath } from "url";
 function loadKodyWorkflowTemplate() {
-  const here = path36.dirname(fileURLToPath(import.meta.url));
-  const candidates = [path36.resolve(here, "../templates/kody.yml"), path36.resolve(here, "../../templates/kody.yml")];
-  const source = candidates.find((candidate) => fs38.existsSync(candidate));
+  const here = path37.dirname(fileURLToPath(import.meta.url));
+  const candidates = [path37.resolve(here, "../templates/kody.yml"), path37.resolve(here, "../../templates/kody.yml")];
+  const source = candidates.find((candidate) => fs39.existsSync(candidate));
   if (!source) throw new Error(`Kody workflow template is missing: ${KODY_WORKFLOW_TEMPLATE_PATH}`);
-  return fs38.readFileSync(source, "utf8");
+  return fs39.readFileSync(source, "utf8");
 }
 var KODY_WORKFLOW_TEMPLATE_PATH;
 var init_workflow_template = __esm({
@@ -15243,12 +15284,12 @@ var init_workflow_template = __esm({
 
 // src/scripts/initFlow.ts
 import { execFileSync as execFileSync14 } from "child_process";
-import * as fs39 from "fs";
-import * as path37 from "path";
+import * as fs40 from "fs";
+import * as path38 from "path";
 function detectPackageManager(cwd) {
-  if (fs39.existsSync(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs39.existsSync(path37.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs39.existsSync(path37.join(cwd, "bun.lockb"))) return "bun";
+  if (fs40.existsSync(path38.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs40.existsSync(path38.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs40.existsSync(path38.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function qualityCommandsFor(pm) {
@@ -15320,22 +15361,22 @@ function performInit(cwd, force) {
   const pm = detectPackageManager(cwd);
   const ownerRepo = detectOwnerRepo(cwd);
   const defaultBranch = defaultBranchFromGit(cwd);
-  const configPath = path37.join(cwd, "kody.config.json");
-  if (fs39.existsSync(configPath) && !force) {
+  const configPath = path38.join(cwd, "kody.config.json");
+  if (fs40.existsSync(configPath) && !force) {
     skipped.push("kody.config.json");
   } else {
     const cfg = makeConfig(pm, ownerRepo, defaultBranch);
-    fs39.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
+    fs40.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}
 `);
     wrote.push("kody.config.json");
   }
-  const workflowDir = path37.join(cwd, ".github", "workflows");
-  const workflowPath = path37.join(workflowDir, "kody.yml");
-  if (fs39.existsSync(workflowPath) && !force) {
+  const workflowDir = path38.join(cwd, ".github", "workflows");
+  const workflowPath = path38.join(workflowDir, "kody.yml");
+  if (fs40.existsSync(workflowPath) && !force) {
     skipped.push(".github/workflows/kody.yml");
   } else {
-    fs39.mkdirSync(workflowDir, { recursive: true });
-    fs39.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
+    fs40.mkdirSync(workflowDir, { recursive: true });
+    fs40.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
     wrote.push(".github/workflows/kody.yml");
   }
   let labels;
@@ -15386,7 +15427,7 @@ Nothing to do. All files already present. (Use --force to overwrite.)
 });
 
 // src/scripts/loadAgentAdhoc.ts
-import * as fs40 from "fs";
+import * as fs41 from "fs";
 function resolveMessage(messageArg) {
   const fromComment = readCommentBody();
   if (fromComment) return stripDirective(fromComment);
@@ -15394,9 +15435,9 @@ function resolveMessage(messageArg) {
 }
 function readCommentBody() {
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventPath || !fs40.existsSync(eventPath)) return "";
+  if (!eventPath || !fs41.existsSync(eventPath)) return "";
   try {
-    const event = JSON.parse(fs40.readFileSync(eventPath, "utf-8"));
+    const event = JSON.parse(fs41.readFileSync(eventPath, "utf-8"));
     return String(event.comment?.body ?? "");
   } catch {
     return "";
@@ -15450,10 +15491,10 @@ var init_loadAgentAdhoc = __esm({
         throw new Error("loadAgentAdhoc: ctx.args.agent must be a non-empty slug");
       }
       const agentPath = resolveAgentFile2(ctx.cwd, agentSlug, agentsDir);
-      if (!fs40.existsSync(agentPath)) {
+      if (!fs41.existsSync(agentPath)) {
         throw new Error(`loadAgentAdhoc: agent identity not found: ${agentPath}`);
       }
-      const { title, body } = parseAgentFile(fs40.readFileSync(agentPath, "utf-8"), agentSlug);
+      const { title, body } = parseAgentFile(fs41.readFileSync(agentPath, "utf-8"), agentSlug);
       const message = resolveMessage(ctx.args.message);
       if (!message) {
         throw new Error(
@@ -15525,13 +15566,13 @@ var init_loadCapabilityState = __esm({
 function isCompanyIntentId(value) {
   return SLUG_RE2.test(value);
 }
-function normalizeCompanyIntent(path55, raw) {
+function normalizeCompanyIntent(path58, raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`${path55}: intent must be JSON object`);
+    throw new Error(`${path58}: intent must be JSON object`);
   }
   const input = raw;
   const id = stringField4(input.id);
-  if (!id || !isCompanyIntentId(id)) throw new Error(`${path55}: invalid intent id`);
+  if (!id || !isCompanyIntentId(id)) throw new Error(`${path58}: invalid intent id`);
   const createdAt = stringField4(input.createdAt) || nowIso();
   const updatedAt = stringField4(input.updatedAt) || createdAt;
   const description = stringField4(input.description);
@@ -15693,7 +15734,7 @@ function retryDelaysMs() {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve23) => setTimeout(resolve23, ms));
 }
 async function fetchGoalStateWithRetry(config, goalId, cwd) {
   let state = await fetchGoalStateAsync(config, goalId, cwd);
@@ -15822,8 +15863,8 @@ var init_loadIssueStateComment = __esm({
 });
 
 // src/scripts/loadJobFromFile.ts
-import * as fs41 from "fs";
-import * as path38 from "path";
+import * as fs42 from "fs";
+import * as path39 from "path";
 function parseJobFile(raw, slug) {
   let stripped = raw;
   if (stripped.startsWith("---\n")) {
@@ -15862,10 +15903,10 @@ var init_loadJobFromFile = __esm({
       if (!slug) {
         throw new Error(`loadJobFromFile: ctx.args.${slugArg} must be a non-empty slug`);
       }
-      const capability = resolveCapabilityFolder(slug, path38.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path39.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         throw new Error(
-          `loadJobFromFile: capability folder not found or incomplete: ${path38.resolve(ctx.cwd, jobsDir, slug)}`
+          `loadJobFromFile: capability folder not found or incomplete: ${path39.resolve(ctx.cwd, jobsDir, slug)}`
         );
       }
       const { title, body, config } = capability;
@@ -15875,12 +15916,12 @@ var init_loadJobFromFile = __esm({
       let agentIdentity = "";
       if (agentSlug) {
         const agentPath = resolveAgentFile2(ctx.cwd, agentSlug, agentsDir);
-        if (!fs41.existsSync(agentPath)) {
+        if (!fs42.existsSync(agentPath)) {
           throw new Error(
             `loadJobFromFile: capability '${slug}' declares agent '${agentSlug}' but ${agentPath} does not exist`
           );
         }
-        const agentRaw = fs41.readFileSync(agentPath, "utf-8");
+        const agentRaw = fs42.readFileSync(agentPath, "utf-8");
         const parsed = parseJobFile(agentRaw, agentSlug);
         agentTitle = parsed.title;
         agentIdentity = parsed.body;
@@ -15960,13 +16001,13 @@ ${truncate2(issue2.body, FINDING_BODY_MAX_BYTES)}`;
 });
 
 // src/scripts/kodyVariables.ts
-import * as fs42 from "fs";
-import * as path39 from "path";
+import * as fs43 from "fs";
+import * as path40 from "path";
 function readKodyVariables(cwd) {
-  const full = path39.join(cwd, KODY_VARIABLES_REL_PATH);
+  const full = path40.join(cwd, KODY_VARIABLES_REL_PATH);
   let raw;
   try {
-    raw = fs42.readFileSync(full, "utf-8");
+    raw = fs43.readFileSync(full, "utf-8");
   } catch {
     return {};
   }
@@ -15991,8 +16032,8 @@ var init_kodyVariables = __esm({
 });
 
 // src/scripts/loadQaContext.ts
-import * as fs43 from "fs";
-import * as path40 from "path";
+import * as fs44 from "fs";
+import * as path41 from "path";
 function parseSlugList(value) {
   const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
   return inner.split(",").map(
@@ -16021,18 +16062,18 @@ function readProfileAgents(raw) {
   return { agent: agent ?? legacy ?? ["kody"], body };
 }
 function readProfile(cwd) {
-  const dir = path40.join(cwd, CONTEXT_DIR_REL_PATH);
-  if (!fs43.existsSync(dir)) return "";
+  const dir = path41.join(cwd, CONTEXT_DIR_REL_PATH);
+  if (!fs44.existsSync(dir)) return "";
   let entries;
   try {
-    entries = fs43.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    entries = fs44.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const blocks = [];
   for (const file of entries) {
     try {
-      const raw = fs43.readFileSync(path40.join(dir, file), "utf-8");
+      const raw = fs44.readFileSync(path41.join(dir, file), "utf-8");
       const { agent, body } = readProfileAgents(raw);
       if (!agent.includes(QA_AGENT) && !agent.includes(ALL_AGENTS)) continue;
       blocks.push(`## ${file}
@@ -16082,9 +16123,9 @@ var init_loadQaContext = __esm({
 
 // src/scripts/loadSimpleCapability.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import * as fs44 from "fs";
+import * as fs45 from "fs";
 import * as os6 from "os";
-import * as path41 from "path";
+import * as path42 from "path";
 function registerCapabilitySubagents(profile, toolRoot, toolFiles) {
   const subagentFiles = toolFiles.flatMap((file) => {
     const match = /^agents\/([a-z][a-z0-9-]{0,63})\.md$/.exec(file);
@@ -16097,7 +16138,7 @@ function registerCapabilitySubagents(profile, toolRoot, toolFiles) {
   profile.subagentTemplates = {
     ...profile.subagentTemplates ?? {},
     ...Object.fromEntries(
-      subagentFiles.map(({ name, file }) => [name, fs44.readFileSync(path41.join(toolRoot, file), "utf-8")])
+      subagentFiles.map(({ name, file }) => [name, fs45.readFileSync(path42.join(toolRoot, file), "utf-8")])
     )
   };
   if (!profile.claudeCode.tools.includes("Agent")) {
@@ -16138,14 +16179,14 @@ function scalar(value) {
   return value;
 }
 function listFiles(root) {
-  if (!fs44.existsSync(root)) return [];
+  if (!fs45.existsSync(root)) return [];
   const files = [];
   const visit = (dir) => {
-    for (const entry of fs44.readdirSync(dir, { withFileTypes: true })) {
-      const absolute = path41.join(dir, entry.name);
+    for (const entry of fs45.readdirSync(dir, { withFileTypes: true })) {
+      const absolute = path42.join(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) visit(absolute);
-      else if (entry.isFile()) files.push(path41.relative(root, absolute));
+      else if (entry.isFile()) files.push(path42.relative(root, absolute));
     }
   };
   visit(root);
@@ -16168,8 +16209,8 @@ var init_loadSimpleCapability = __esm({
       if (!capability) {
         throw new Error(`Capability "${slug}" is not a valid simple capability folder`);
       }
-      const toolRoot = path41.join(capability.dir, "tools");
-      const skillRoot = path41.join(capability.dir, "skills");
+      const toolRoot = path42.join(capability.dir, "tools");
+      const skillRoot = path42.join(capability.dir, "skills");
       const toolFiles = listFiles(toolRoot);
       const skillFiles = listFiles(skillRoot);
       const parsedInput = parseInput(ctx.args.input);
@@ -16194,14 +16235,14 @@ var init_loadSimpleCapability = __esm({
       }
       if (requiredSubagents.length > 0) ctx.data.requiredSubagents = requiredSubagents;
       if (capability.contract?.execution === "script") {
-        ctx.data.capabilityScriptPath = path41.join(capability.dir, "tools", "run.sh");
+        ctx.data.capabilityScriptPath = path42.join(capability.dir, "tools", "run.sh");
         ctx.data.capabilitySecretNames = capability.contract.secrets ?? [];
         ctx.data.capabilityScriptTimeoutMs = capability.contract.timeoutMs;
       }
       if (capability.config.outputSchema) {
         ctx.data.capabilityOutputSchema = capability.config.outputSchema;
       }
-      const outputPath = ctx.data.capabilityExecution === "agent" && capability.config.outputSchema ? path41.join(os6.tmpdir(), `kody-capability-output-${randomUUID2()}.json`) : void 0;
+      const outputPath = ctx.data.capabilityExecution === "agent" && capability.config.outputSchema ? path42.join(os6.tmpdir(), `kody-capability-output-${randomUUID2()}.json`) : void 0;
       if (outputPath) ctx.data.capabilityOutputPath = outputPath;
       ctx.data.capabilityEnvironment = {
         ...capabilityInputEnvironment(input),
@@ -16224,7 +16265,7 @@ var init_loadSimpleCapability = __esm({
           ...skillFiles.flatMap((file) => [
             `### ${file}`,
             "",
-            fs44.readFileSync(path41.join(skillRoot, file), "utf-8"),
+            fs45.readFileSync(path42.join(skillRoot, file), "utf-8"),
             ""
           ])
         ] : [],
@@ -16233,7 +16274,7 @@ var init_loadSimpleCapability = __esm({
           "## Tools",
           "",
           "Inspect or run these capability-owned files when needed:",
-          ...toolFiles.map((file) => `- ${path41.join(toolRoot, file)}`)
+          ...toolFiles.map((file) => `- ${path42.join(toolRoot, file)}`)
         ] : [],
         "",
         ...capability.config.outputSchema ? [
@@ -16264,8 +16305,8 @@ var init_loadSimpleCapability = __esm({
 });
 
 // src/taskContext.ts
-import * as fs45 from "fs";
-import * as path42 from "path";
+import * as fs46 from "fs";
+import * as path43 from "path";
 function buildTaskContext(args) {
   return {
     schemaVersion: TASK_CONTEXT_SCHEMA_VERSION,
@@ -16281,9 +16322,9 @@ function buildTaskContext(args) {
 function persistTaskContext(cwd, ctx) {
   try {
     const dir = runtimeStatePath(cwd, "agent-runs", ctx.runId);
-    fs45.mkdirSync(dir, { recursive: true });
-    const file = path42.join(dir, "task-context.json");
-    fs45.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
+    fs46.mkdirSync(dir, { recursive: true });
+    const file = path43.join(dir, "task-context.json");
+    fs46.writeFileSync(file, `${JSON.stringify(ctx, null, 2)}
 `);
     return file;
   } catch (err) {
@@ -16710,19 +16751,19 @@ function parseAgencyModelProposal(raw) {
 function normalizeBundleFiles(bundle) {
   const seen = /* @__PURE__ */ new Set();
   return bundle.files.map((file, index) => {
-    const path55 = file.path.replace(/^\/+/, "");
-    const parts = path55.split("/");
-    if (!path55 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
+    const path58 = file.path.replace(/^\/+/, "");
+    const parts = path58.split("/");
+    if (!path58 || file.path.startsWith("/") || file.path.includes("\\") || parts.some((part) => !part || part === "." || part === "..")) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is unsafe`);
     }
     if (!/^(agents\/[^/]+\.md|capabilities\/[^/]+\/.+|goals\/(?:templates\/)?[^/]+\/.+|workflows\/[^/]+\.json)$/.test(
-      path55
+      path58
     )) {
       throw new Error(`openAgencyModelReviewPr: files[${index}].path is not a supported definition path`);
     }
-    if (seen.has(path55)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path55}`);
-    seen.add(path55);
-    return { path: path55, content: file.content.replace(/\r\n?/g, "\n") };
+    if (seen.has(path58)) throw new Error(`openAgencyModelReviewPr: duplicate generated file path: ${path58}`);
+    seen.add(path58);
+    return { path: path58, content: file.content.replace(/\r\n?/g, "\n") };
   });
 }
 function buildProposalId(issueNumber, bundle, sourceLabel) {
@@ -17204,16 +17245,16 @@ var init_parseReproOutput = __esm({
 });
 
 // src/scripts/parseSimpleCapabilityOutput.ts
-import * as fs46 from "fs";
+import * as fs47 from "fs";
 function stringList2(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 function readOutputFile(outputPath) {
-  if (!outputPath || !fs46.existsSync(outputPath)) return { found: false };
+  if (!outputPath || !fs47.existsSync(outputPath)) return { found: false };
   try {
-    return { found: true, value: JSON.parse(fs46.readFileSync(outputPath, "utf-8")) };
+    return { found: true, value: JSON.parse(fs47.readFileSync(outputPath, "utf-8")) };
   } finally {
-    fs46.rmSync(outputPath, { force: true });
+    fs47.rmSync(outputPath, { force: true });
   }
 }
 function parseOutput(text2) {
@@ -17832,9 +17873,9 @@ var init_postResearchComment = __esm({
 });
 
 // src/scripts/prepareBrowserAuth.ts
-import * as fs47 from "fs";
+import * as fs48 from "fs";
 import * as os7 from "os";
-import * as path43 from "path";
+import * as path44 from "path";
 function appendAuthMessage(ctx, message) {
   const current = typeof ctx.data.qaAuthBlock === "string" ? ctx.data.qaAuthBlock.trim() : "";
   ctx.data.qaAuthBlock = current ? `${current}
@@ -17873,9 +17914,9 @@ async function githubJson(url, token) {
   return await response.json();
 }
 function writeKodyStorageState(input) {
-  const directory = fs47.mkdtempSync(path43.join(os7.tmpdir(), "kody-browser-auth-"));
-  fs47.chmodSync(directory, 448);
-  const file = path43.join(directory, "storage-state.json");
+  const directory = fs48.mkdtempSync(path44.join(os7.tmpdir(), "kody-browser-auth-"));
+  fs48.chmodSync(directory, 448);
+  const file = path44.join(directory, "storage-state.json");
   const now = Date.now();
   const repoEntry = {
     repoUrl: input.repoUrl,
@@ -17905,7 +17946,7 @@ function writeKodyStorageState(input) {
       }
     ]
   };
-  fs47.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
+  fs48.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
   return { directory, file };
 }
 function configurePlaywright(profile, storageStatePath) {
@@ -17987,7 +18028,7 @@ async function prepareMethod(ctx, profile, method) {
     configurePlaywright(profile, state.file);
     const authDirectory = state.directory;
     registerRuntimeCleanup(ctx, () => {
-      fs47.rmSync(authDirectory, { recursive: true, force: true });
+      fs48.rmSync(authDirectory, { recursive: true, force: true });
     });
     appendAuthMessage(
       ctx,
@@ -17995,7 +18036,7 @@ async function prepareMethod(ctx, profile, method) {
     );
     return true;
   } catch (error) {
-    if (state) fs47.rmSync(state.directory, { recursive: true, force: true });
+    if (state) fs48.rmSync(state.directory, { recursive: true, force: true });
     const reason = error instanceof Error ? error.message : String(error);
     appendAuthMessage(
       ctx,
@@ -18134,7 +18175,7 @@ var init_prepareCapabilityDelivery = __esm({
 
 // src/scripts/prepareSimpleCapabilityRuntime.ts
 import { isIP } from "net";
-import * as path44 from "path";
+import * as path45 from "path";
 function requirementsFrom(ctx) {
   const raw = ctx.data.capabilityRequirements;
   return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
@@ -18178,7 +18219,7 @@ function browserRuntime(ctx, requirements) {
       "--allowed-origins",
       origin,
       "--output-dir",
-      path44.resolve(ctx.cwd, "test-results", "quality-runs", qualityRunId)
+      path45.resolve(ctx.cwd, "test-results", "quality-runs", qualityRunId)
     ]
   };
 }
@@ -18543,9 +18584,9 @@ function latestResult(raw, agentResult) {
 function recordField4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function resolveDotted(root, path55) {
-  if (!path55) return void 0;
-  return path55.split(".").reduce((value, key) => recordField4(value)?.[key], root);
+function resolveDotted(root, path58) {
+  if (!path58) return void 0;
+  return path58.split(".").reduce((value, key) => recordField4(value)?.[key], root);
 }
 function stringValue5(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
@@ -19387,7 +19428,7 @@ var init_previewBuildHelpers = __esm({
 // src/scripts/previewBuildRun.ts
 import { spawn as spawn5 } from "child_process";
 async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve21, reject) => {
+  await new Promise((resolve23, reject) => {
     const child = spawn5(cmd, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env ?? {} },
@@ -19399,7 +19440,7 @@ async function runCmd(cmd, args, opts = {}) {
     }
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve21();
+      if (code === 0) resolve23();
       else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
     });
   });
@@ -19471,12 +19512,12 @@ fi
 
 // src/scripts/runPreviewBuild.ts
 import { copyFile, writeFile } from "fs/promises";
-import * as path45 from "path";
+import * as path46 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function bundledDockerfilePath(mode) {
-  const here = path45.dirname(fileURLToPath2(import.meta.url));
+  const here = path46.dirname(fileURLToPath2(import.meta.url));
   const file = mode === "dev" ? "default-Dockerfile.preview.dev" : "default-Dockerfile.preview.prod";
-  return path45.join(here, "preview-build-templates", file);
+  return path46.join(here, "preview-build-templates", file);
 }
 function required(name) {
   const v = (process.env[name] ?? "").trim();
@@ -19711,10 +19752,10 @@ var init_runPreviewBuild = __esm({
         console.log(`[preview-build] vault: ${Object.keys(buildEnv).length} secrets, mode=${buildMode}`);
         if (Object.keys(buildEnv).length > 0) {
           const lines = Object.entries(buildEnv).map(([k, v]) => `${k}=${JSON.stringify(v)}`);
-          await writeFile(path45.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
+          await writeFile(path46.join(ctx.cwd, ".env.production.local"), `${lines.join("\n")}
 `, "utf8");
         }
-        const consumerDockerfile = path45.join(ctx.cwd, "Dockerfile.preview");
+        const consumerDockerfile = path46.join(ctx.cwd, "Dockerfile.preview");
         const { stat } = await import("fs/promises");
         let hasConsumerDockerfile = false;
         try {
@@ -19898,8 +19939,8 @@ var init_tickShellRunner = __esm({
 });
 
 // src/scripts/runScheduledImplementationTick.ts
-import * as fs48 from "fs";
-import * as path46 from "path";
+import * as fs49 from "fs";
+import * as path47 from "path";
 var runScheduledImplementationTick;
 var init_runScheduledImplementationTick = __esm({
   "src/scripts/runScheduledImplementationTick.ts"() {
@@ -19920,14 +19961,14 @@ var init_runScheduledImplementationTick = __esm({
         ctx.output.reason = `runScheduledImplementationTick: args.slug or ctx.args.${slugArg} must be non-empty capability slug`;
         return;
       }
-      const capability = resolveCapabilityFolder(slug, path46.resolve(ctx.cwd, jobsDir));
+      const capability = resolveCapabilityFolder(slug, path47.resolve(ctx.cwd, jobsDir));
       if (!capability) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: capability folder not found or incomplete: ${slug} (searched ${jobsDir} and company store)`;
         return;
       }
-      const shellPath = path46.join(profile.dir, shell);
-      if (!fs48.existsSync(shellPath)) {
+      const shellPath = path47.join(profile.dir, shell);
+      if (!fs49.existsSync(shellPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runScheduledImplementationTick: shell not found: ${shell} (looked in ${profile.dir})`;
         return;
@@ -19959,13 +20000,13 @@ var init_runScheduledImplementationTick = __esm({
 
 // src/scripts/runSimpleCapabilityScript.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import * as fs49 from "fs";
+import * as fs50 from "fs";
 function formatDuration2(timeoutMs) {
   return timeoutMs % 6e4 === 0 ? `${timeoutMs / 6e4} minutes` : `${timeoutMs}ms`;
 }
 function isRegularFile2(filePath) {
   try {
-    const stat = fs49.lstatSync(filePath);
+    const stat = fs50.lstatSync(filePath);
     return stat.isFile() && !stat.isSymbolicLink();
   } catch {
     return false;
@@ -20044,8 +20085,8 @@ var init_runSimpleCapabilityScript = __esm({
 });
 
 // src/scripts/runTickScript.ts
-import * as fs50 from "fs";
-import * as path47 from "path";
+import * as fs51 from "fs";
+import * as path48 from "path";
 var runTickScript;
 var init_runTickScript = __esm({
   "src/scripts/runTickScript.ts"() {
@@ -20065,10 +20106,10 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: ctx.args.${slugArg} must be a non-empty slug`;
         return;
       }
-      const capability = readCapabilityFolder(path47.resolve(ctx.cwd, jobsDir), slug);
+      const capability = readCapabilityFolder(path48.resolve(ctx.cwd, jobsDir), slug);
       if (!capability) {
         ctx.output.exitCode = 99;
-        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path47.resolve(ctx.cwd, jobsDir, slug)}`;
+        ctx.output.reason = `runTickScript: capability folder not found or incomplete: ${path48.resolve(ctx.cwd, jobsDir, slug)}`;
         return;
       }
       const tickScript = capability.config.tickScript;
@@ -20077,8 +20118,8 @@ var init_runTickScript = __esm({
         ctx.output.reason = `runTickScript: capability ${slug} has no \`tickScript\` in profile.json \u2014 route via capability-tick instead`;
         return;
       }
-      const scriptPath = path47.isAbsolute(tickScript) ? tickScript : path47.join(ctx.cwd, tickScript);
-      if (!fs50.existsSync(scriptPath)) {
+      const scriptPath = path48.isAbsolute(tickScript) ? tickScript : path48.join(ctx.cwd, tickScript);
+      if (!fs51.existsSync(scriptPath)) {
         ctx.output.exitCode = 99;
         ctx.output.reason = `runTickScript: tickScript not found: ${scriptPath}`;
         return;
@@ -20360,7 +20401,7 @@ var init_syncFlow = __esm({
 });
 
 // src/scripts/validateAgencyModelProposal.ts
-import * as path48 from "path";
+import * as path49 from "path";
 function validateModelBundle(bundle, expectedKind, options = {}) {
   const failures = [];
   validateOneModel(bundle.model, bundle.files, "model", true, failures, expectedKind, options);
@@ -20678,7 +20719,7 @@ var init_validateAgencyModelProposal = __esm({
       const bundle = parseAgencyModelProposal(raw);
       const expectedKind = readExpectedModelKind(args);
       const failures = validateModelBundle(bundle, expectedKind, {
-        capabilityRoot: path48.join(ctx.cwd, ".kody", "capabilities")
+        capabilityRoot: path49.join(ctx.cwd, ".kody", "capabilities")
       });
       if (failures.length > 0) {
         throw new Error(`validateAgencyModelProposal: ${failures.join("; ")}`);
@@ -20741,7 +20782,7 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const child = spawn6(command, {
       cwd,
       shell: true,
@@ -20768,11 +20809,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve21({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve23({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve21({ exitCode: -1, output: err.message });
+      resolve23({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -21178,21 +21219,21 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve21) => {
+    next: (timeoutMs) => new Promise((resolve23) => {
       if (queue.length > 0) {
-        resolve21(queue.shift());
+        resolve23(queue.shift());
         return;
       }
       if (ended) {
-        resolve21(null);
+        resolve23(null);
         return;
       }
-      waiter = resolve21;
+      waiter = resolve23;
       const t = setTimeout(
         () => {
-          if (waiter === resolve21) {
+          if (waiter === resolve23) {
             waiter = null;
-            resolve21(null);
+            resolve23(null);
           }
         },
         Math.max(0, timeoutMs)
@@ -21229,7 +21270,7 @@ var init_warmupMcp = __esm({
 });
 
 // src/scripts/writeAgentRunSummary.ts
-import * as fs51 from "fs";
+import * as fs52 from "fs";
 var writeAgentRunSummary;
 var init_writeAgentRunSummary = __esm({
   "src/scripts/writeAgentRunSummary.ts"() {
@@ -21255,7 +21296,7 @@ var init_writeAgentRunSummary = __esm({
       if (reason) lines.push(`- **Reason:** ${reason}`);
       lines.push("");
       try {
-        fs51.appendFileSync(summaryPath, `${lines.join("\n")}
+        fs52.appendFileSync(summaryPath, `${lines.join("\n")}
 `);
       } catch {
       }
@@ -21593,17 +21634,17 @@ var init_scripts = __esm({
 });
 
 // src/stateWorkspace.ts
-import * as fs52 from "fs";
-import * as path49 from "path";
+import * as fs53 from "fs";
+import * as path50 from "path";
 function tenantId(config) {
   const owner = config.github?.owner?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[0]?.trim();
   const repo = config.github?.repo?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[1]?.trim();
   return owner && repo ? `${owner}/${repo}` : null;
 }
 function writeRuntimeFile(cwd, relativePath, content) {
-  const target = path49.join(cwd, RUNTIME_ROOT, relativePath);
-  fs52.mkdirSync(path49.dirname(target), { recursive: true });
-  fs52.writeFileSync(target, content, "utf8");
+  const target = path50.join(cwd, RUNTIME_ROOT, relativePath);
+  fs53.mkdirSync(path50.dirname(target), { recursive: true });
+  fs53.writeFileSync(target, content, "utf8");
 }
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -21668,11 +21709,11 @@ async function hydrateStateWorkspace(config, cwd, backendOverride) {
       throw new Error("Kody backend access is required for runtime workspace documents");
     return;
   }
-  const key = `${path49.resolve(cwd)}|${tenant}`;
+  const key = `${path50.resolve(cwd)}|${tenant}`;
   if (hydratedWorkspaces.has(key)) return;
   const backend = backendOverride ?? createStateBackendFromEnv();
-  const root = path49.join(cwd, RUNTIME_ROOT);
-  fs52.rmSync(root, { recursive: true, force: true });
+  const root = path50.join(cwd, RUNTIME_ROOT);
+  fs53.rmSync(root, { recursive: true, force: true });
   await Promise.all([
     hydratePrefix(backend, tenant, cwd, "context:"),
     hydratePrefix(backend, tenant, cwd, "memory:"),
@@ -21688,7 +21729,7 @@ var init_stateWorkspace = __esm({
   "src/stateWorkspace.ts"() {
     "use strict";
     init_state_backend();
-    RUNTIME_ROOT = path49.join(".kody-engine", "runtime");
+    RUNTIME_ROOT = path50.join(".kody-engine", "runtime");
     hydratedWorkspaces = /* @__PURE__ */ new Set();
   }
 });
@@ -21759,9 +21800,9 @@ var init_tools = __esm({
 
 // src/executor.ts
 import { spawn as spawn8 } from "child_process";
-import * as fs53 from "fs";
+import * as fs54 from "fs";
 import * as os8 from "os";
-import * as path50 from "path";
+import * as path51 from "path";
 function isMutatingPostflight(scriptName) {
   return MUTATING_POSTFLIGHTS.has(scriptName ?? "");
 }
@@ -22013,7 +22054,7 @@ async function runImplementation(profileName, input) {
   const jobWhyBlock = typeof ctx.data.jobWhy === "string" ? operatorRequestBlock(ctx.data.jobWhy) : null;
   const jobRefBlock = jobReferenceBlock(profileName, profile, ctx.data);
   const invokeAgent = async (prompt) => {
-    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path50.isAbsolute(p) ? p : path50.resolve(profile.dir, p)).filter((p) => p.length > 0);
+    const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path51.isAbsolute(p) ? p : path51.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;
     const pluginPaths = [...externalPlugins, ...syntheticPath ? [syntheticPath] : []];
     const agents = loadSubagents(profile);
@@ -22493,17 +22534,17 @@ function clearStampedLifecycleLabels(profile, ctx) {
 function resolveProfilePath(profileName, cwd = process.cwd()) {
   const found = resolveImplementation(profileName, getRuntimeProfileRootsForCwd(cwd));
   if (found) return found;
-  const here = path50.dirname(new URL(import.meta.url).pathname);
+  const here = path51.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path50.join(here, "implementations", profileName, "profile.json"),
+    path51.join(here, "implementations", profileName, "profile.json"),
     // same-dir sibling (dev)
-    path50.join(here, "..", "implementations", profileName, "profile.json"),
+    path51.join(here, "..", "implementations", profileName, "profile.json"),
     // up one (prod: dist/bin → dist/implementations)
-    path50.join(here, "..", "src", "implementations", profileName, "profile.json")
+    path51.join(here, "..", "src", "implementations", profileName, "profile.json")
     // fallback
   ];
   for (const c of candidates) {
-    if (fs53.existsSync(c)) return c;
+    if (fs54.existsSync(c)) return c;
   }
   return candidates[0];
 }
@@ -22618,15 +22659,15 @@ function resolveShellTimeoutMs(entry) {
 }
 async function runShellEntry(entry, ctx, profile) {
   const shellName = entry.shell;
-  const shellPath = path50.join(profile.dir, shellName);
-  if (!fs53.existsSync(shellPath)) {
+  const shellPath = path51.join(profile.dir, shellName);
+  if (!fs54.existsSync(shellPath)) {
     ctx.skipAgent = true;
     ctx.output.exitCode = 99;
     ctx.output.reason = `shell script not found: ${shellName} (looked in ${profile.dir})`;
     return;
   }
   const positional = entry.with ? Object.values(entry.with).map((v) => String(v)) : [];
-  const outputFile = path50.join(
+  const outputFile = path51.join(
     os8.tmpdir(),
     `kody-shell-output-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
   );
@@ -22656,14 +22697,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve21) => {
+    (resolve23) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve21({ code, signal, spawnErr });
+        resolve23({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));
@@ -22693,9 +22734,9 @@ async function runShellEntry(entry, ctx, profile) {
   }
   let sideChannelText = "";
   try {
-    if (fs53.existsSync(outputFile)) {
-      sideChannelText = fs53.readFileSync(outputFile, "utf-8");
-      fs53.rmSync(outputFile, { force: true });
+    if (fs54.existsSync(outputFile)) {
+      sideChannelText = fs54.readFileSync(outputFile, "utf-8");
+      fs54.rmSync(outputFile, { force: true });
     }
   } catch {
   }
@@ -23545,25 +23586,31 @@ async function runGraphCapabilityWorkflow(parent, workflow, capability, base, ch
 
 `
     );
-    result = await runJob(child, {
-      ...base,
-      preloadedData: {
-        ...chainData,
-        runSubjectType: "capability",
-        runSubjectId: step.capability,
-        runSubjectLabel: step.id,
-        workflowStep: step.id,
-        workflowStepIndex: index + 1,
-        workflowExecutionKey: graphWorkflowExecutionKey(
-          base.preloadedData?.workflowExecutionKey,
-          capability.slug,
-          step.id,
-          state.transitionCounts
-        ),
-        workflowStepReason: step.reason,
-        workflowContinueOn: step.continueOn ?? []
-      }
-    });
+    const stepAbort = workflowStepAbortController(base.abortController, step.timeoutSeconds);
+    try {
+      result = await runJob(child, {
+        ...base,
+        abortController: stepAbort.controller,
+        preloadedData: {
+          ...chainData,
+          runSubjectType: "capability",
+          runSubjectId: step.capability,
+          runSubjectLabel: step.id,
+          workflowStep: step.id,
+          workflowStepIndex: index + 1,
+          workflowExecutionKey: graphWorkflowExecutionKey(
+            base.preloadedData?.workflowExecutionKey,
+            capability.slug,
+            step.id,
+            state.transitionCounts
+          ),
+          workflowStepReason: step.reason,
+          workflowContinueOn: step.continueOn ?? []
+        }
+      });
+    } finally {
+      stepAbort.cleanup();
+    }
     finishWorkflowStep(state, step, result);
     mergeWorkflowResults(state, result.capabilityResults);
     if (result.capabilityOutput && typeof result.capabilityOutput === "object" && !Array.isArray(result.capabilityOutput)) {
@@ -23699,11 +23746,11 @@ function exhaustedWorkflowTransitions(step, data, counts) {
 }
 function workflowResultConditionPaths(transitions) {
   return transitions.flatMap(
-    (transition) => Object.keys(transition.when ?? {}).filter((path55) => path55.startsWith("result."))
+    (transition) => Object.keys(transition.when ?? {}).filter((path58) => path58.startsWith("result."))
   );
 }
 function conditionMatches(condition, context) {
-  return Object.entries(condition).every(([path55, expected]) => valueMatches(resolveDottedPath2(context, path55), expected));
+  return Object.entries(condition).every(([path58, expected]) => valueMatches(resolveDottedPath2(context, path58), expected));
 }
 function withWorkflowBoundaryEval(capability, result) {
   const capabilityKind = capability.config.capabilityKind;
@@ -23871,6 +23918,24 @@ function canContinueWorkflow(step, outcome) {
   if (!outcome || !step.continueOn || step.continueOn.length === 0) return false;
   return step.continueOn.includes(outcome.type);
 }
+function workflowStepAbortController(parent, timeoutSeconds) {
+  if (!timeoutSeconds) return { controller: parent, cleanup: () => void 0 };
+  const controller = new AbortController();
+  const forwardParentAbort = () => controller.abort(parent?.signal.reason);
+  if (parent?.signal.aborted) forwardParentAbort();
+  else parent?.signal.addEventListener("abort", forwardParentAbort, { once: true });
+  const timer = setTimeout(() => {
+    controller.abort(new Error(`workflow step timed out after ${timeoutSeconds}s`));
+  }, timeoutSeconds * 1e3);
+  timer.unref?.();
+  return {
+    controller,
+    cleanup: () => {
+      clearTimeout(timer);
+      parent?.signal.removeEventListener("abort", forwardParentAbort);
+    }
+  };
+}
 function workflowOutcome(result) {
   return result.taskState?.core.lastOutcome ?? null;
 }
@@ -24133,7 +24198,7 @@ function translateOpenAISseToBrain(opts) {
 
 // src/servers/brain-serve.ts
 import { createServer as createServer2 } from "http";
-import * as path53 from "path";
+import * as path54 from "path";
 
 // src/chat/loop.ts
 init_agent();
@@ -24141,13 +24206,13 @@ init_agents();
 init_config();
 init_registry();
 init_task_artifacts();
-import * as fs17 from "fs";
-import * as path18 from "path";
+import * as fs18 from "fs";
+import * as path19 from "path";
 
 // src/chat/attachments.ts
 init_runtimePaths();
-import * as fs14 from "fs";
-import * as path15 from "path";
+import * as fs15 from "fs";
+import * as path16 from "path";
 var INLINE_ATTACHMENT_RE = /(?:\[(?:Image|File): ([^\]]*)\]\n)?data:([\w.+-]+\/[\w.+-]+);base64,([A-Za-z0-9+/=]+)/g;
 var EXT_BY_MIME = {
   "image/png": "png",
@@ -24180,11 +24245,11 @@ function prepareAttachments(turns, cwd, sessionId) {
         if (!isImage) return `[File: ${name}]`;
         try {
           if (!dirEnsured) {
-            fs14.mkdirSync(dir, { recursive: true });
+            fs15.mkdirSync(dir, { recursive: true });
             dirEnsured = true;
           }
-          const filePath = path15.join(dir, `${imageCounter}.${extFor(mime)}`);
-          fs14.writeFileSync(filePath, Buffer.from(data, "base64"));
+          const filePath = path16.join(dir, `${imageCounter}.${extFor(mime)}`);
+          fs15.writeFileSync(filePath, Buffer.from(data, "base64"));
           imageCounter += 1;
           imagePaths.push(filePath);
           return `[Image "${name}" is attached \u2014 saved to ${filePath}. Use the Read tool on that exact path to view it.]`;
@@ -24201,8 +24266,8 @@ function prepareAttachments(turns, cwd, sessionId) {
 
 // src/chat/codex-app-server.ts
 import { spawn as spawn3 } from "child_process";
-import * as fs15 from "fs";
-import * as path16 from "path";
+import * as fs16 from "fs";
+import * as path17 from "path";
 import { createInterface } from "readline";
 function codexThreadStartParams(args) {
   return {
@@ -24287,9 +24352,9 @@ var CodexAppServerClient = class {
     await this.request("thread/resume", { threadId });
   }
   async runTurn(args) {
-    await new Promise((resolve21, reject) => {
+    await new Promise((resolve23, reject) => {
       this.process.turnWaiters.set(args.threadId, {
-        resolve: resolve21,
+        resolve: resolve23,
         reject,
         onNotification: args.onNotification,
         queue: Promise.resolve()
@@ -24306,8 +24371,8 @@ var CodexAppServerClient = class {
   }
   request(method, params) {
     const id = this.process.nextId++;
-    return new Promise((resolve21, reject) => {
-      this.process.pending.set(id, { resolve: resolve21, reject });
+    return new Promise((resolve23, reject) => {
+      this.process.pending.set(id, { resolve: resolve23, reject });
       this.process.child.stdin.write(`${JSON.stringify({ method, id, params })}
 `);
     });
@@ -24373,11 +24438,11 @@ var CodexAppServerClient = class {
 };
 var clients = /* @__PURE__ */ new Map();
 function threadMapPath(cwd) {
-  return path16.join(cwd, ".kody-engine", "runtime", "codex-threads.json");
+  return path17.join(cwd, ".kody-engine", "runtime", "codex-threads.json");
 }
 function readThreadMap(cwd) {
   try {
-    const value = JSON.parse(fs15.readFileSync(threadMapPath(cwd), "utf8"));
+    const value = JSON.parse(fs16.readFileSync(threadMapPath(cwd), "utf8"));
     if (!value || typeof value !== "object" || Array.isArray(value)) return {};
     return Object.fromEntries(
       Object.entries(value).filter(
@@ -24390,8 +24455,8 @@ function readThreadMap(cwd) {
 }
 function writeThreadMap(cwd, map) {
   const file = threadMapPath(cwd);
-  fs15.mkdirSync(path16.dirname(file), { recursive: true });
-  fs15.writeFileSync(file, `${JSON.stringify(map, null, 2)}
+  fs16.mkdirSync(path17.dirname(file), { recursive: true });
+  fs16.writeFileSync(file, `${JSON.stringify(map, null, 2)}
 `);
 }
 async function runCodexChatTurn(args) {
@@ -24481,8 +24546,8 @@ async function runCodexChatTurn(args) {
 }
 
 // src/chat/events.ts
-import * as fs16 from "fs";
-import * as path17 from "path";
+import * as fs17 from "fs";
+import * as path18 from "path";
 import posixPath2 from "path/posix";
 var BackendEventSink = class {
   constructor(append, tenantId2, sessionId) {
@@ -24498,7 +24563,7 @@ var BackendEventSink = class {
   }
 };
 function eventsFilePath(cwd, sessionId) {
-  return path17.join(cwd, ".kody-engine", "runtime", "events", `${sessionId}.jsonl`);
+  return path18.join(cwd, ".kody-engine", "runtime", "events", `${sessionId}.jsonl`);
 }
 var FileSink = class {
   constructor(file) {
@@ -24506,8 +24571,8 @@ var FileSink = class {
   }
   file;
   async emit(event) {
-    fs16.mkdirSync(path17.dirname(this.file), { recursive: true });
-    fs16.appendFileSync(this.file, `${JSON.stringify(event)}
+    fs17.mkdirSync(path18.dirname(this.file), { recursive: true });
+    fs17.appendFileSync(this.file, `${JSON.stringify(event)}
 `);
   }
 };
@@ -24772,7 +24837,7 @@ function buildImplementationCatalog() {
   const entries = [];
   for (const { name, profilePath } of discovered) {
     try {
-      const raw = JSON.parse(fs17.readFileSync(profilePath, "utf-8"));
+      const raw = JSON.parse(fs18.readFileSync(profilePath, "utf-8"));
       const describe = typeof raw.describe === "string" ? raw.describe : "";
       const firstSentence = describe.split(/(?<=[.!?])\s+/, 1)[0] ?? "";
       entries.push({ name, describe: firstSentence.trim() });
@@ -24894,7 +24959,7 @@ async function runChatTurn(opts) {
     quiet: opts.quiet,
     additionalDirectories: [
       taskArtifactsPaths.absDir,
-      ...Array.from(new Set(imagePaths.map((p2) => path18.dirname(p2))))
+      ...Array.from(new Set(imagePaths.map((p2) => path19.dirname(p2))))
     ],
     systemPromptAppend: systemPrompt,
     ...opts.reasoningEffort ? { reasoningEffort: opts.reasoningEffort } : {},
@@ -25082,10 +25147,10 @@ async function emit(sink, type, sessionId, suffix, payload) {
 var MEMORY_INDEX_REL = ".kody-engine/runtime/memory/INDEX.md";
 var MAX_INDEX_BYTES = 8e3;
 function readMemoryIndexBlock(cwd) {
-  const indexPath = path18.join(cwd, MEMORY_INDEX_REL);
+  const indexPath = path19.join(cwd, MEMORY_INDEX_REL);
   let raw;
   try {
-    raw = fs17.readFileSync(indexPath, "utf-8");
+    raw = fs18.readFileSync(indexPath, "utf-8");
   } catch {
     return "";
   }
@@ -25105,17 +25170,17 @@ _\u2026 (memory index truncated; use recall_search to read more)_` : trimmed;
 var CONTEXT_DIR_REL = ".kody-engine/runtime/context";
 var MAX_CONTEXT_BYTES = 12e3;
 function readContextBlock(cwd) {
-  const dir = path18.join(cwd, CONTEXT_DIR_REL);
+  const dir = path19.join(cwd, CONTEXT_DIR_REL);
   let files;
   try {
-    files = fs17.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    files = fs18.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return "";
   }
   const sections = [];
   for (const file of files) {
     try {
-      const content = fs17.readFileSync(path18.join(dir, file), "utf-8").trim();
+      const content = fs18.readFileSync(path19.join(dir, file), "utf-8").trim();
       if (content) sections.push(`### ${file.replace(/\.md$/, "")}
 
 ${content}`);
@@ -25141,7 +25206,7 @@ var SYSTEM_PROMPT_OVERRIDE_REL = ".kody-engine/runtime/system-prompt.md";
 function readSystemPromptOverride(cwd) {
   let raw;
   try {
-    raw = fs17.readFileSync(path18.join(cwd, SYSTEM_PROMPT_OVERRIDE_REL), "utf-8");
+    raw = fs18.readFileSync(path19.join(cwd, SYSTEM_PROMPT_OVERRIDE_REL), "utf-8");
   } catch {
     return null;
   }
@@ -25149,10 +25214,10 @@ function readSystemPromptOverride(cwd) {
   return trimmed.length > 0 ? trimmed : null;
 }
 function readInstructionsBlock(cwd) {
-  const instructionsPath = path18.join(cwd, INSTRUCTIONS_REL);
+  const instructionsPath = path19.join(cwd, INSTRUCTIONS_REL);
   let raw;
   try {
-    raw = fs17.readFileSync(instructionsPath, "utf-8");
+    raw = fs18.readFileSync(instructionsPath, "utf-8");
   } catch {
     return "";
   }
@@ -25186,15 +25251,15 @@ function resolveBrainDriver(runtime) {
 }
 
 // src/chat/session.ts
-import * as fs18 from "fs";
-import * as path19 from "path";
+import * as fs19 from "fs";
+import * as path20 from "path";
 import posixPath3 from "path/posix";
 function sessionFilePath(cwd, sessionId) {
-  return path19.join(cwd, ".kody-engine", "runtime", "sessions", `${sessionId}.jsonl`);
+  return path20.join(cwd, ".kody-engine", "runtime", "sessions", `${sessionId}.jsonl`);
 }
 function readSession(file) {
-  if (!fs18.existsSync(file)) return [];
-  const raw = fs18.readFileSync(file, "utf-8").trim();
+  if (!fs19.existsSync(file)) return [];
+  const raw = fs19.readFileSync(file, "utf-8").trim();
   if (!raw) return [];
   const turns = [];
   for (const line of raw.split("\n")) {
@@ -25217,8 +25282,8 @@ init_config();
 init_state_backend();
 init_workflowDefinitions();
 import { createHash as createHash2 } from "crypto";
-import * as fs20 from "fs";
-import * as path21 from "path";
+import * as fs21 from "fs";
+import * as path22 from "path";
 var SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 var REPOSITORY_OWNED_NAMESPACES = ["loops"];
 function assertSafeDefinitionPath(filePath) {
@@ -25250,9 +25315,9 @@ function verifyDefinition(definition) {
 }
 function writeBundle(root, bundle) {
   for (const [filePath, contents] of Object.entries(bundle.files)) {
-    const target = path21.join(root, filePath);
-    fs20.mkdirSync(path21.dirname(target), { recursive: true });
-    fs20.writeFileSync(target, contents, "utf8");
+    const target = path22.join(root, filePath);
+    fs21.mkdirSync(path22.dirname(target), { recursive: true });
+    fs21.writeFileSync(target, contents, "utf8");
   }
 }
 function writeDefinition(root, kind, definition) {
@@ -25260,22 +25325,22 @@ function writeDefinition(root, kind, definition) {
   if (kind === "agent") {
     const raw = bundle.files["agent.md"];
     if (typeof raw !== "string") throw new Error(`agent definition ${definition.slug} is missing agent.md`);
-    fs20.writeFileSync(path21.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
+    fs21.writeFileSync(path22.join(root, "agents", `${definition.slug}.md`), raw, "utf8");
     return;
   }
   if (kind === "goal") {
-    writeBundle(path21.join(root, "goals", definition.slug), bundle);
+    writeBundle(path22.join(root, "goals", definition.slug), bundle);
     return;
   }
   if (kind === "implementation") {
-    writeBundle(path21.join(root, "implementations", definition.slug), bundle);
+    writeBundle(path22.join(root, "implementations", definition.slug), bundle);
     return;
   }
   if (kind === "asset") {
-    writeBundle(path21.join(root, "shared"), bundle);
+    writeBundle(path22.join(root, "shared"), bundle);
     return;
   }
-  writeBundle(path21.join(root, "capabilities", definition.slug), bundle);
+  writeBundle(path22.join(root, "capabilities", definition.slug), bundle);
 }
 function writeWorkflow(root, document) {
   const workflow = normalizeWorkflowDefinition(document.definition);
@@ -25283,28 +25348,28 @@ function writeWorkflow(root, document) {
   const contents = `${JSON.stringify(workflow, null, 2)}
 `;
   const bundle = { schemaVersion: 1, files: { "workflow.json": contents } };
-  const target = path21.join(root, workflowDefinitionPath(document.workflowId));
-  fs20.mkdirSync(path21.dirname(target), { recursive: true });
-  fs20.writeFileSync(target, contents, "utf8");
+  const target = path22.join(root, workflowDefinitionPath(document.workflowId));
+  fs21.mkdirSync(path22.dirname(target), { recursive: true });
+  fs21.writeFileSync(target, contents, "utf8");
   return definitionVersion(bundle);
 }
 function preserveRepositoryDefinitions(root, staging) {
   for (const namespace of REPOSITORY_OWNED_NAMESPACES) {
-    const source = path21.join(root, namespace);
-    if (!fs20.existsSync(source)) continue;
-    fs20.cpSync(source, path21.join(staging, namespace), { recursive: true });
+    const source = path22.join(root, namespace);
+    if (!fs21.existsSync(source)) continue;
+    fs21.cpSync(source, path22.join(staging, namespace), { recursive: true });
   }
 }
 async function hydrateDefinitions(options) {
-  const root = path21.join(options.cwd, ".kody-engine", "definitions");
+  const root = path22.join(options.cwd, ".kody-engine", "definitions");
   const staging = `${root}.tmp-${process.pid}-${Date.now()}`;
-  fs20.rmSync(staging, { recursive: true, force: true });
-  fs20.mkdirSync(path21.join(staging, "agents"), { recursive: true });
-  fs20.mkdirSync(path21.join(staging, "capabilities"), { recursive: true });
-  fs20.mkdirSync(path21.join(staging, "goals"), { recursive: true });
-  fs20.mkdirSync(path21.join(staging, "implementations"), { recursive: true });
-  fs20.mkdirSync(path21.join(staging, "shared"), { recursive: true });
-  fs20.mkdirSync(path21.join(staging, "workflows"), { recursive: true });
+  fs21.rmSync(staging, { recursive: true, force: true });
+  fs21.mkdirSync(path22.join(staging, "agents"), { recursive: true });
+  fs21.mkdirSync(path22.join(staging, "capabilities"), { recursive: true });
+  fs21.mkdirSync(path22.join(staging, "goals"), { recursive: true });
+  fs21.mkdirSync(path22.join(staging, "implementations"), { recursive: true });
+  fs21.mkdirSync(path22.join(staging, "shared"), { recursive: true });
+  fs21.mkdirSync(path22.join(staging, "workflows"), { recursive: true });
   try {
     const [capabilities, agents, goals, implementations, assets, workflows] = await Promise.all([
       options.backend.listDefinitions(options.tenantId, "capability"),
@@ -25345,13 +25410,13 @@ async function hydrateDefinitions(options) {
       hydratedAt: (/* @__PURE__ */ new Date()).toISOString(),
       versions: Object.fromEntries(Object.entries(versions).sort(([left], [right]) => left.localeCompare(right)))
     };
-    fs20.writeFileSync(path21.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    fs21.writeFileSync(path22.join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-    fs20.rmSync(root, { recursive: true, force: true });
-    fs20.renameSync(staging, root);
+    fs21.rmSync(root, { recursive: true, force: true });
+    fs21.renameSync(staging, root);
     return { root, tenantId: options.tenantId, versions: manifest.versions };
   } catch (error) {
-    fs20.rmSync(staging, { recursive: true, force: true });
+    fs21.rmSync(staging, { recursive: true, force: true });
     throw error;
   }
 }
@@ -25373,8 +25438,8 @@ async function hydrateDefinitionsFromEnv(cwd = process.cwd(), env = process.env)
 
 // src/kody-cli.ts
 import { execFileSync as execFileSync24 } from "child_process";
-import * as fs54 from "fs";
-import * as path51 from "path";
+import * as fs55 from "fs";
+import * as path52 from "path";
 
 // src/app-auth.ts
 import { createSign } from "crypto";
@@ -25503,7 +25568,7 @@ init_definition_paths();
 
 // src/dispatch.ts
 init_config();
-import * as fs21 from "fs";
+import * as fs22 from "fs";
 
 // src/cron-match.ts
 var FIELD_BOUNDS = [
@@ -25610,10 +25675,10 @@ function autoDispatch(opts) {
   }
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventName || !eventPath || !fs21.existsSync(eventPath)) return null;
+  if (!eventName || !eventPath || !fs22.existsSync(eventPath)) return null;
   let event = {};
   try {
-    event = JSON.parse(fs21.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs22.readFileSync(eventPath, "utf-8"));
   } catch {
     return null;
   }
@@ -25737,7 +25802,7 @@ function autoDispatchTyped(opts) {
   if (legacy) return { kind: "route", ...legacy };
   const eventName = process.env.GITHUB_EVENT_NAME;
   const eventPath = process.env.GITHUB_EVENT_PATH;
-  if (!eventName || !eventPath || !fs21.existsSync(eventPath)) {
+  if (!eventName || !eventPath || !fs22.existsSync(eventPath)) {
     return { kind: "silent", reason: "no GHA event context" };
   }
   if (eventName !== "issue_comment") {
@@ -25745,7 +25810,7 @@ function autoDispatchTyped(opts) {
   }
   let event = {};
   try {
-    event = JSON.parse(fs21.readFileSync(eventPath, "utf-8"));
+    event = JSON.parse(fs22.readFileSync(eventPath, "utf-8"));
   } catch {
     return { kind: "silent", reason: "GHA event payload unreadable" };
   }
@@ -25799,7 +25864,7 @@ function dispatchScheduledWatches(opts) {
   for (const exe of listRuntimeProfilesForCwd(opts?.cwd ?? process.cwd())) {
     let raw;
     try {
-      raw = fs21.readFileSync(exe.profilePath, "utf-8");
+      raw = fs22.readFileSync(exe.profilePath, "utf-8");
     } catch {
       continue;
     }
@@ -26176,9 +26241,9 @@ async function resolveAuthToken(env = process.env) {
   return void 0;
 }
 function detectPackageManager2(cwd) {
-  if (fs54.existsSync(path51.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs54.existsSync(path51.join(cwd, "yarn.lock"))) return "yarn";
-  if (fs54.existsSync(path51.join(cwd, "bun.lockb"))) return "bun";
+  if (fs55.existsSync(path52.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs55.existsSync(path52.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs55.existsSync(path52.join(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function shouldChainScheduledWatch(match) {
@@ -26281,8 +26346,8 @@ function postFailureTail(issueNumber, cwd, reason) {
   const logPath = lastRunLogPath(cwd);
   let tail = "";
   try {
-    if (fs54.existsSync(logPath)) {
-      const content = fs54.readFileSync(logPath, "utf-8");
+    if (fs55.existsSync(logPath)) {
+      const content = fs55.readFileSync(logPath, "utf-8");
       tail = content.slice(-3e3);
     }
   } catch {
@@ -26311,7 +26376,7 @@ async function runCi(argv) {
     return 0;
   }
   const args = parseCiArgs(argv);
-  const cwd = args.cwd ? path51.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path52.resolve(args.cwd) : process.cwd();
   try {
     const n = unpackAllSecrets();
     if (n > 0) process.stdout.write(`\u2192 kody: unpacked ${n} secret(s) from ALL_SECRETS
@@ -26377,9 +26442,9 @@ async function runCi(argv) {
       forceRunCliArgs = { goal: envForceMessage };
     }
   }
-  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs54.existsSync(dispatchEventPath)) {
+  if (!args.issueNumber && !autoFallback && !forceRunAction && !runRequestFanOut && eventName === "workflow_dispatch" && dispatchEventPath && fs55.existsSync(dispatchEventPath)) {
     try {
-      const evt = JSON.parse(fs54.readFileSync(dispatchEventPath, "utf-8"));
+      const evt = JSON.parse(fs55.readFileSync(dispatchEventPath, "utf-8"));
       const inputs = objectValue2(evt.inputs);
       const issueInput = parseInt(String(inputs?.issue_number ?? ""), 10);
       const sessionInput = String(inputs?.sessionId ?? "");
@@ -26794,8 +26859,8 @@ init_repoWorkspace();
 
 // src/scripts/brainTurnLog.ts
 init_runtimePaths();
-import * as fs55 from "fs";
-import * as path52 from "path";
+import * as fs56 from "fs";
+import * as path53 from "path";
 import posixPath4 from "path/posix";
 var live = /* @__PURE__ */ new Map();
 function brainEventsFilePath(dir, chatId) {
@@ -26803,8 +26868,8 @@ function brainEventsFilePath(dir, chatId) {
 }
 function lastPersistedSeq(dir, chatId) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs55.existsSync(p)) return 0;
-  const lines = fs55.readFileSync(p, "utf-8").split("\n").filter(Boolean);
+  if (!fs56.existsSync(p)) return 0;
+  const lines = fs56.readFileSync(p, "utf-8").split("\n").filter(Boolean);
   if (lines.length === 0) return 0;
   try {
     return JSON.parse(lines[lines.length - 1]).seq || 0;
@@ -26814,9 +26879,9 @@ function lastPersistedSeq(dir, chatId) {
 }
 function readSince(dir, chatId, since) {
   const p = brainEventsFilePath(dir, chatId);
-  if (!fs55.existsSync(p)) return [];
+  if (!fs56.existsSync(p)) return [];
   const out = [];
-  for (const line of fs55.readFileSync(p, "utf-8").split("\n")) {
+  for (const line of fs56.readFileSync(p, "utf-8").split("\n")) {
     if (!line) continue;
     try {
       const rec = JSON.parse(line);
@@ -26842,12 +26907,12 @@ function beginTurn(dir, chatId) {
   };
   live.set(chatId, state);
   const p = brainEventsFilePath(dir, chatId);
-  fs55.mkdirSync(path52.dirname(p), { recursive: true });
+  fs56.mkdirSync(path53.dirname(p), { recursive: true });
   return (event) => {
     state.seq += 1;
     const rec = { seq: state.seq, turn, ts: Date.now(), event };
     try {
-      fs55.appendFileSync(p, `${JSON.stringify(rec)}
+      fs56.appendFileSync(p, `${JSON.stringify(rec)}
 `);
     } catch (err) {
       process.stderr.write(
@@ -26886,7 +26951,7 @@ function endTurnIfUnterminated(dir, chatId, errMessage) {
     event: { type: "error", error: errMessage || "turn ended unexpectedly", chatId }
   };
   try {
-    fs55.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
+    fs56.appendFileSync(brainEventsFilePath(dir, chatId), `${JSON.stringify(rec)}
 `);
   } catch {
   }
@@ -26980,17 +27045,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve23, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve21({});
+        resolve23({});
         return;
       }
       try {
-        resolve21(JSON.parse(raw));
+        resolve23(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -27282,7 +27347,7 @@ function buildServer(opts) {
   const runTurn = opts.runTurn ?? runChatTurn;
   const createStore = opts.createStore ?? createSessionStore;
   const cloneRepo = opts.cloneRepo ?? defaultCloneRepo;
-  const reposRoot = opts.reposRoot ?? path53.join(path53.dirname(path53.resolve(opts.cwd)), "repos");
+  const reposRoot = opts.reposRoot ?? path54.join(path54.dirname(path54.resolve(opts.cwd)), "repos");
   return createServer2(async (req, res) => {
     if (!req.method || !req.url) {
       sendJson(res, 400, { error: "bad request" });
@@ -27363,11 +27428,11 @@ async function brainServe(opts) {
     litellmUrl,
     driver
   });
-  await new Promise((resolve21) => {
+  await new Promise((resolve23) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(`[brain-serve] listening on 0.0.0.0:${port} (cwd=${opts.cwd})
 `);
-      resolve21();
+      resolve23();
     });
   });
   const shutdown = (signal) => {
@@ -27622,14 +27687,14 @@ async function startBrainProxy(opts) {
   const { httpServer, handler } = buildBrainProxy(opts);
   const port = opts.port ?? 0;
   const host = opts.host ?? "127.0.0.1";
-  await new Promise((resolve21) => httpServer.listen(port, host, () => resolve21()));
+  await new Promise((resolve23) => httpServer.listen(port, host, () => resolve23()));
   const addr = httpServer.address();
   return {
     httpServer,
     port: addr.port,
     url: `http://${host}:${addr.port}`,
-    stop: () => new Promise((resolve21) => {
-      httpServer.close(() => resolve21());
+    stop: () => new Promise((resolve23) => {
+      httpServer.close(() => resolve23());
     }),
     handler
   };
@@ -27779,23 +27844,23 @@ function buildMcpHttpServer(opts) {
     httpServer,
     routes,
     port,
-    stop: () => new Promise((resolve21) => {
+    stop: () => new Promise((resolve23) => {
       let pending = transports.size;
       if (pending === 0) {
-        httpServer.close(() => resolve21());
+        httpServer.close(() => resolve23());
         return;
       }
       for (const transport of transports.values()) {
         void transport.close().finally(() => {
           pending--;
-          if (pending === 0) httpServer.close(() => resolve21());
+          if (pending === 0) httpServer.close(() => resolve23());
         });
       }
     })
   };
 }
 function listenMcpHttpServer(server, host = "127.0.0.1") {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve23, reject) => {
     server.httpServer.once("error", reject);
     server.httpServer.listen(server.port, host, () => {
       server.httpServer.off("error", reject);
@@ -27803,7 +27868,7 @@ function listenMcpHttpServer(server, host = "127.0.0.1") {
       if (addr && typeof addr === "object") {
         server.port = addr.port;
       }
-      resolve21();
+      resolve23();
     });
   });
 }
@@ -27886,7 +27951,7 @@ async function loadConfigSafe() {
 }
 
 // src/chat-cli.ts
-import * as path54 from "path";
+import * as path55 from "path";
 
 // src/chat/inbox.ts
 import { execFileSync as execFileSync25 } from "child_process";
@@ -27953,7 +28018,7 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve23) => setTimeout(resolve23, ms));
 }
 function currentBranch(cwd) {
   try {
@@ -28177,7 +28242,7 @@ async function runChat(argv) {
 ${CHAT_HELP}`);
     return 64;
   }
-  const cwd = args.cwd ? path54.resolve(args.cwd) : process.cwd();
+  const cwd = args.cwd ? path55.resolve(args.cwd) : process.cwd();
   const sessionId = args.sessionId;
   const runRequest = readRunRequestFromEnv();
   if (runRequest && "request" in runRequest) {
@@ -28302,6 +28367,575 @@ init_definition_paths();
 init_job();
 init_registry();
 
+// src/servers/brain-terminal-agent.ts
+init_repoWorkspace();
+import * as path57 from "path";
+import { createInterface as createInterface2 } from "readline";
+
+// src/terminal/brain-terminal-session.ts
+import { createHash as createHash9 } from "crypto";
+var MAX_CAPTURE_CHARS = 2e5;
+function requiredIdentifier(value, name, max = 240) {
+  if (typeof value !== "string" || !value.trim() || value.length > max) {
+    throw new Error(`${name} must be a non-empty string of at most ${max} characters`);
+  }
+  return value.trim();
+}
+function terminalSize(value, name) {
+  if (!Number.isInteger(value) || Number(value) < 1 || Number(value) > 1e3) {
+    throw new Error(`${name} must be an integer between 1 and 1000`);
+  }
+  return Number(value);
+}
+function revision(value) {
+  if (value === void 0) return void 0;
+  if (!Number.isInteger(value) || Number(value) < 0) {
+    throw new Error("afterRevision must be a non-negative integer");
+  }
+  return Number(value);
+}
+function parseBrainTerminalOpenRequest(value) {
+  if (!value || typeof value !== "object") throw new Error("open request must be an object");
+  const request = value;
+  if (request.type !== "open") throw new Error("first terminal message must be open");
+  if (!request.session || typeof request.session !== "object") throw new Error("session is required");
+  const session = request.session;
+  if (!session.scope || typeof session.scope !== "object") throw new Error("session scope is required");
+  const scope = session.scope;
+  return {
+    type: "open",
+    session: {
+      id: requiredIdentifier(session.id, "session.id"),
+      scope: {
+        owner: requiredIdentifier(scope.owner, "scope.owner", 100),
+        repo: requiredIdentifier(scope.repo, "scope.repo", 100),
+        conversationId: requiredIdentifier(scope.conversationId, "scope.conversationId")
+      }
+    },
+    cwd: requiredIdentifier(request.cwd, "cwd", 1e3),
+    afterRevision: revision(request.afterRevision),
+    cols: terminalSize(request.cols, "cols"),
+    rows: terminalSize(request.rows, "rows")
+  };
+}
+function parseBrainTerminalStatusRequest(value) {
+  if (!value || typeof value !== "object") throw new Error("status request must be an object");
+  const request = value;
+  if (request.type !== "status") throw new Error("terminal request must be status");
+  return { type: "status", sessionId: requiredIdentifier(request.sessionId, "sessionId") };
+}
+function parseBrainTerminalCommand(value) {
+  if (!value || typeof value !== "object") throw new Error("terminal command must be an object");
+  const command = value;
+  const sessionId = requiredIdentifier(command.sessionId, "sessionId");
+  switch (command.type) {
+    case "attach":
+      return { type: "attach", sessionId, afterRevision: revision(command.afterRevision) };
+    case "input": {
+      const inputId = requiredIdentifier(command.inputId, "inputId");
+      if (typeof command.data !== "string" || command.data.length === 0) {
+        throw new Error("data must be a non-empty string");
+      }
+      return { type: "input", sessionId, inputId, data: command.data };
+    }
+    case "resize":
+      return {
+        type: "resize",
+        sessionId,
+        cols: terminalSize(command.cols, "cols"),
+        rows: terminalSize(command.rows, "rows")
+      };
+    case "detach":
+      return { type: "detach", sessionId };
+    case "restart":
+      return { type: "restart", sessionId };
+    default:
+      throw new Error("unknown terminal command");
+  }
+}
+function sessionName(id) {
+  return `kody_${createHash9("sha256").update(id).digest("hex").slice(0, 32)}`;
+}
+function stateEvent(session) {
+  return {
+    type: "state",
+    sessionId: session.id,
+    generation: session.generation,
+    state: session.state,
+    processId: session.processId
+  };
+}
+function failedEvent(session, code, cause) {
+  return {
+    type: "failed",
+    sessionId: session.id,
+    generation: session.generation,
+    code,
+    message: cause instanceof Error ? cause.message : String(cause)
+  };
+}
+var BrainTerminalSessionAgent = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  dependencies;
+  session = null;
+  now() {
+    return (this.dependencies.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+  }
+  requireSession() {
+    if (!this.session) throw new Error("terminal session is not open");
+    return this.session;
+  }
+  async persist(session) {
+    this.session = session;
+    await this.dependencies.store.write(session);
+  }
+  async open(rawRequest) {
+    const request = parseBrainTerminalOpenRequest(rawRequest);
+    let session = await this.dependencies.store.read(request.session.id);
+    if (session && (session.scope.owner !== request.session.scope.owner || session.scope.repo !== request.session.scope.repo || session.scope.conversationId !== request.session.scope.conversationId)) {
+      throw new Error("terminal session scope does not match stored identity");
+    }
+    if (!session) {
+      session = {
+        version: 1,
+        id: request.session.id,
+        scope: request.session.scope,
+        sessionName: sessionName(request.session.id),
+        cwd: request.cwd,
+        generation: 1,
+        state: "starting",
+        revision: 0,
+        output: "",
+        processId: null,
+        cols: request.cols,
+        rows: request.rows,
+        updatedAt: this.now()
+      };
+      await this.persist(session);
+      let started;
+      try {
+        started = await this.dependencies.runtime.start(
+          session.sessionName,
+          session.cwd,
+          session.cols,
+          session.rows
+        );
+      } catch (cause) {
+        session = { ...session, state: "failed", updatedAt: this.now() };
+        await this.persist(session);
+        return [failedEvent(session, "runtime_start_failed", cause)];
+      }
+      session = { ...session, state: "ready", processId: started.processId, updatedAt: this.now() };
+      await this.persist(session);
+    } else {
+      const runtime = await this.dependencies.runtime.inspect(session.sessionName);
+      session = {
+        ...session,
+        state: runtime.alive ? "ready" : session.state === "failed" ? "failed" : "exited",
+        processId: runtime.processId,
+        cols: request.cols,
+        rows: request.rows,
+        updatedAt: this.now()
+      };
+      if (runtime.alive) {
+        await this.dependencies.runtime.resize(session.sessionName, request.cols, request.rows);
+      }
+      await this.persist(session);
+    }
+    const events = [stateEvent(session)];
+    if (session.output && (request.afterRevision === void 0 || request.afterRevision < session.revision)) {
+      events.push({
+        type: "output",
+        sessionId: session.id,
+        generation: session.generation,
+        revision: session.revision,
+        data: `\x1B[2J\x1B[H${session.output}`
+      });
+    }
+    return events;
+  }
+  async inspectStored(sessionId) {
+    const id = requiredIdentifier(sessionId, "sessionId");
+    const session = await this.dependencies.store.read(id);
+    if (!session) return null;
+    const runtime = await this.dependencies.runtime.inspect(session.sessionName);
+    const next = {
+      ...session,
+      state: runtime.alive ? session.state : "exited",
+      processId: runtime.processId,
+      updatedAt: this.now()
+    };
+    await this.persist(next);
+    return {
+      id: next.id,
+      generation: next.generation,
+      state: next.state,
+      revision: next.revision,
+      processId: next.processId
+    };
+  }
+  async status() {
+    const session = this.requireSession();
+    const runtime = await this.dependencies.runtime.inspect(session.sessionName);
+    const nextState = runtime.alive ? session.state : session.state === "failed" ? "failed" : "exited";
+    if (nextState !== session.state || runtime.processId !== session.processId) {
+      await this.persist({
+        ...session,
+        state: nextState,
+        processId: runtime.processId,
+        updatedAt: this.now()
+      });
+    }
+    const current = this.requireSession();
+    return {
+      id: current.id,
+      generation: current.generation,
+      state: current.state,
+      revision: current.revision,
+      processId: current.processId
+    };
+  }
+  async captureOutput() {
+    const session = this.requireSession();
+    if (session.state !== "ready" && session.state !== "detached") return null;
+    const output = (await this.dependencies.runtime.capture(session.sessionName)).slice(-MAX_CAPTURE_CHARS);
+    if (output === session.output) return null;
+    const next = {
+      ...session,
+      output,
+      revision: session.revision + 1,
+      updatedAt: this.now()
+    };
+    await this.persist(next);
+    return {
+      type: "output",
+      sessionId: next.id,
+      generation: next.generation,
+      revision: next.revision,
+      data: `\x1B[2J\x1B[H${output}`
+    };
+  }
+  async detach() {
+    const session = this.requireSession();
+    const next = { ...session, state: "detached", updatedAt: this.now() };
+    await this.persist(next);
+    return stateEvent(next);
+  }
+  async command(rawCommand) {
+    const command = parseBrainTerminalCommand(rawCommand);
+    const session = this.requireSession();
+    if (command.sessionId !== session.id) throw new Error("terminal command session identity mismatch");
+    switch (command.type) {
+      case "attach":
+        return stateEvent(session);
+      case "input":
+        if (session.state !== "ready") throw new Error(`input is not allowed while terminal is ${session.state}`);
+        await this.dependencies.runtime.input(session.sessionName, command.data);
+        return {
+          type: "input-accepted",
+          sessionId: session.id,
+          generation: session.generation,
+          inputId: command.inputId
+        };
+      case "resize":
+        if (session.state !== "ready") throw new Error(`resize is not allowed while terminal is ${session.state}`);
+        await this.dependencies.runtime.resize(session.sessionName, command.cols, command.rows);
+        await this.persist({ ...session, cols: command.cols, rows: command.rows, updatedAt: this.now() });
+        return null;
+      case "detach":
+        return this.detach();
+      case "restart": {
+        if (session.state === "starting") throw new Error("restart is not allowed while terminal is starting");
+        await this.dependencies.runtime.stop(session.sessionName);
+        const starting = {
+          ...session,
+          generation: session.generation + 1,
+          state: "starting",
+          revision: 0,
+          output: "",
+          processId: null,
+          updatedAt: this.now()
+        };
+        await this.persist(starting);
+        let started;
+        try {
+          started = await this.dependencies.runtime.start(
+            starting.sessionName,
+            starting.cwd,
+            starting.cols,
+            starting.rows
+          );
+        } catch (cause) {
+          const failed = { ...starting, state: "failed", updatedAt: this.now() };
+          await this.persist(failed);
+          return failedEvent(failed, "runtime_start_failed", cause);
+        }
+        const ready = { ...starting, state: "ready", processId: started.processId, updatedAt: this.now() };
+        await this.persist(ready);
+        return stateEvent(ready);
+      }
+    }
+  }
+};
+
+// src/terminal/brain-terminal-adapters.ts
+import { createHash as createHash10, randomBytes as randomBytes2 } from "crypto";
+import { mkdir, readFile, rename, writeFile as writeFile2 } from "fs/promises";
+import * as path56 from "path";
+import { spawn as spawn9 } from "child_process";
+function runTerminalCommand(command, args, input) {
+  return new Promise((resolve23, reject) => {
+    const child = spawn9(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    child.on("error", reject);
+    child.on("close", (code) => {
+      resolve23({
+        code: code ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8")
+      });
+    });
+    if (input !== void 0) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+function storeKey(id) {
+  return createHash10("sha256").update(id).digest("hex");
+}
+function isStoredSession(value) {
+  if (!value || typeof value !== "object") return false;
+  const session = value;
+  return session.version === 1 && typeof session.id === "string" && typeof session.sessionName === "string" && typeof session.cwd === "string" && Number.isInteger(session.generation) && Number.isInteger(session.revision) && typeof session.output === "string" && typeof session.scope?.owner === "string" && typeof session.scope?.repo === "string" && typeof session.scope?.conversationId === "string";
+}
+var FileBrainTerminalMetadataStore = class {
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  file(id) {
+    return path56.join(this.root, `${storeKey(id)}.json`);
+  }
+  async read(id) {
+    try {
+      const parsed = JSON.parse(await readFile(this.file(id), "utf8"));
+      if (!isStoredSession(parsed) || parsed.id !== id) {
+        throw new Error("stored terminal session is invalid");
+      }
+      return parsed;
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  }
+  async write(session) {
+    await mkdir(this.root, { recursive: true, mode: 448 });
+    const target = this.file(session.id);
+    const temporary = `${target}.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
+    await writeFile2(temporary, `${JSON.stringify(session)}
+`, { mode: 384 });
+    await rename(temporary, target);
+  }
+};
+function commandError(action, result) {
+  const detail = result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`;
+  return new Error(`tmux ${action} failed: ${detail.slice(0, 500)}`);
+}
+var TmuxBrainTerminalRuntime = class {
+  constructor(run = runTerminalCommand) {
+    this.run = run;
+  }
+  run;
+  async tmux(action, args, input) {
+    const result = await this.run("tmux", args, input);
+    if (result.code !== 0) throw commandError(action, result);
+    return result;
+  }
+  async start(sessionName2, cwd, cols, rows) {
+    await this.tmux("start", [
+      "new-session",
+      "-d",
+      "-s",
+      sessionName2,
+      "-x",
+      String(cols),
+      "-y",
+      String(rows),
+      "-c",
+      cwd,
+      "/bin/bash",
+      "-l"
+    ]);
+    await this.tmux("configure", ["set-option", "-t", sessionName2, "status", "off"]);
+    await this.tmux("configure", ["set-option", "-t", sessionName2, "history-limit", "50000"]);
+    await this.tmux("configure", ["set-option", "-w", "-t", sessionName2, "remain-on-exit", "on"]);
+    const inspected = await this.inspect(sessionName2);
+    if (!inspected.alive || inspected.processId === null) throw new Error("tmux terminal did not start");
+    return { processId: inspected.processId };
+  }
+  async inspect(sessionName2) {
+    const result = await this.run("tmux", [
+      "list-panes",
+      "-t",
+      sessionName2,
+      "-F",
+      "#{pane_dead}:#{pane_pid}"
+    ]);
+    if (result.code !== 0) return { alive: false, processId: null };
+    const [dead, pid] = result.stdout.trim().split(":");
+    const processId = Number(pid);
+    return {
+      alive: dead === "0" && Number.isInteger(processId) && processId > 0,
+      processId: Number.isInteger(processId) && processId > 0 ? processId : null
+    };
+  }
+  async capture(sessionName2) {
+    const alternate = await this.run("tmux", [
+      "display-message",
+      "-p",
+      "-t",
+      sessionName2,
+      "#{alternate_on}"
+    ]);
+    if (alternate.code !== 0) throw commandError("inspect screen", alternate);
+    const args = alternate.stdout.trim() === "1" ? ["capture-pane", "-p", "-e", "-t", sessionName2] : ["capture-pane", "-p", "-e", "-J", "-S", "-50000", "-t", sessionName2];
+    return (await this.tmux("capture", args)).stdout;
+  }
+  async input(sessionName2, data) {
+    const bufferName = `kody_${randomBytes2(8).toString("hex")}`;
+    await this.tmux("load input", ["load-buffer", "-b", bufferName, "-"], data);
+    await this.tmux("paste input", ["paste-buffer", "-d", "-b", bufferName, "-t", sessionName2]);
+  }
+  async resize(sessionName2, cols, rows) {
+    await this.tmux("resize", [
+      "resize-window",
+      "-t",
+      sessionName2,
+      "-x",
+      String(cols),
+      "-y",
+      String(rows)
+    ]);
+  }
+  async stop(sessionName2) {
+    const result = await this.run("tmux", ["kill-session", "-t", sessionName2]);
+    if (result.code !== 0 && !/can't find session|no server running/i.test(result.stderr)) {
+      throw commandError("stop", result);
+    }
+  }
+};
+
+// src/servers/brain-terminal-agent.ts
+var DEFAULT_POLL_INTERVAL_MS = 150;
+function writeEvent(output, event) {
+  output.write(`${JSON.stringify(event)}
+`);
+}
+async function brainTerminalAgent(options) {
+  const input = options.input ?? process.stdin;
+  const output = options.output ?? process.stdout;
+  const error = options.error ?? process.stderr;
+  const reposRoot = process.env.BRAIN_REPOS_ROOT?.trim() || path57.join(path57.dirname(path57.resolve(options.cwd)), "repos");
+  const stateRoot = process.env.BRAIN_TERMINAL_STATE_ROOT?.trim() || path57.join(path57.dirname(reposRoot), ".kody", "terminal-sessions");
+  const agent = new BrainTerminalSessionAgent({
+    store: new FileBrainTerminalMetadataStore(stateRoot),
+    runtime: new TmuxBrainTerminalRuntime()
+  });
+  const lines = createInterface2({ input, crlfDelay: Infinity });
+  let opened = false;
+  let poll = null;
+  let pollRunning = false;
+  const stopPoll = () => {
+    if (poll) clearInterval(poll);
+    poll = null;
+  };
+  const capture = async () => {
+    if (pollRunning) return;
+    pollRunning = true;
+    try {
+      const event = await agent.captureOutput();
+      if (event) writeEvent(output, event);
+      const status = await agent.status();
+      if (status.state === "exited") {
+        writeEvent(output, {
+          type: "exited",
+          sessionId: status.id,
+          generation: status.generation
+        });
+        stopPoll();
+      }
+    } catch (cause) {
+      error.write(`[brain-terminal-agent] capture failed: ${cause instanceof Error ? cause.message : String(cause)}
+`);
+    } finally {
+      pollRunning = false;
+    }
+  };
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      const value = JSON.parse(line);
+      if (!opened) {
+        if (value && typeof value === "object" && value.type === "status") {
+          const request = parseBrainTerminalStatusRequest(value);
+          const status = await agent.inspectStored(request.sessionId);
+          if (status) {
+            writeEvent(output, {
+              type: "state",
+              sessionId: status.id,
+              generation: status.generation,
+              state: status.state,
+              processId: status.processId
+            });
+          } else {
+            writeEvent(output, {
+              type: "failed",
+              sessionId: request.sessionId,
+              generation: 1,
+              code: "session_not_found",
+              message: "Terminal session not found"
+            });
+          }
+          return 0;
+        }
+        const requested = parseBrainTerminalOpenRequest(value);
+        const repo = `${requested.session.scope.owner}/${requested.session.scope.repo}`;
+        const workspaceCwd = await ensureRepoCwd({
+          baseCwd: options.cwd,
+          reposRoot,
+          repo,
+          repoToken: process.env.KODY_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? process.env.GH_PAT,
+          cloneRepo: defaultCloneRepo
+        });
+        const events = await agent.open({ ...requested, cwd: workspaceCwd });
+        for (const event2 of events) writeEvent(output, event2);
+        opened = true;
+        poll = setInterval(() => void capture(), options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+        poll.unref?.();
+        continue;
+      }
+      const command = parseBrainTerminalCommand(value);
+      const event = await agent.command(command);
+      if (event) writeEvent(output, event);
+      if (command.type === "detach") stopPoll();
+    }
+    if (opened) await agent.detach();
+    return 0;
+  } catch (cause) {
+    stopPoll();
+    error.write(`[brain-terminal-agent] ${cause instanceof Error ? cause.message : String(cause)}
+`);
+    return 1;
+  } finally {
+    stopPoll();
+    lines.close();
+  }
+}
+
 // src/servers/pool-serve.ts
 import { createServer as createServer5 } from "http";
 
@@ -28373,8 +29007,8 @@ var FlyClient = class {
   get fetch() {
     return this.opts.fetchImpl ?? fetch;
   }
-  async call(path55, init = {}) {
-    const res = await this.fetch(`${FLY_API_BASE}${path55}`, {
+  async call(path58, init = {}) {
+    const res = await this.fetch(`${FLY_API_BASE}${path58}`, {
       method: init.method ?? "GET",
       headers: {
         Authorization: `Bearer ${this.opts.token}`,
@@ -28385,7 +29019,7 @@ var FlyClient = class {
     if (res.status === 404 && init.allow404) return null;
     if (!res.ok) {
       const text2 = await res.text().catch(() => "");
-      throw new Error(`Fly API ${res.status} on ${path55}: ${text2.slice(0, 200) || res.statusText}`);
+      throw new Error(`Fly API ${res.status} on ${path58}: ${text2.slice(0, 200) || res.statusText}`);
     }
     if (res.status === 204) return null;
     const raw = await res.text();
@@ -28898,14 +29532,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve23, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve21({});
+      if (!raw.trim()) return resolve23({});
       try {
-        resolve21(JSON.parse(raw));
+        resolve23(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -29059,10 +29693,10 @@ async function poolServe() {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve21) => {
+  await new Promise((resolve23) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve21();
+      resolve23();
     });
   });
   if (loopTickEnabled) void runLoopTick();
@@ -29080,8 +29714,8 @@ async function poolServe() {
 }
 
 // src/servers/runner-serve.ts
-import { spawn as spawn9 } from "child_process";
-import * as fs56 from "fs";
+import { spawn as spawn10 } from "child_process";
+import * as fs57 from "fs";
 import { createServer as createServer6 } from "http";
 var DEFAULT_PORT2 = 8080;
 var DEFAULT_WORKDIR = "/workspace/repo";
@@ -29102,17 +29736,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve23, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve21({});
+        resolve23({});
         return;
       }
       try {
-        resolve21(JSON.parse(raw));
+        resolve23(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -29157,8 +29791,8 @@ async function defaultRunJob(job) {
   const workdir = process.env.RUNNER_WORKDIR ?? DEFAULT_WORKDIR;
   const branch = job.ref ?? "main";
   const authUrl = `https://x-access-token:${job.githubToken}@github.com/${job.repo}.git`;
-  fs56.rmSync(workdir, { recursive: true, force: true });
-  fs56.mkdirSync(workdir, { recursive: true });
+  fs57.rmSync(workdir, { recursive: true, force: true });
+  fs57.mkdirSync(workdir, { recursive: true });
   const allSecrets = typeof job.allSecrets === "string" ? job.allSecrets : JSON.stringify(job.allSecrets ?? {});
   const target = job.runRequest.target;
   const interactive = target.type === "chat";
@@ -29187,13 +29821,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve21) => {
-    const child = spawn9(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve21(code ?? 0));
+  const run = (cmd, args, cwd) => new Promise((resolve23) => {
+    const child = spawn10(cmd, args, { stdio: "inherit", env: childEnv, cwd });
+    child.on("exit", (code) => resolve23(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve21(1);
+      resolve23(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -29269,11 +29903,11 @@ async function runnerServe() {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve21) => {
+  await new Promise((resolve23) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve21();
+      resolve23();
     });
   });
   const shutdown = (signal) => {
@@ -29291,7 +29925,7 @@ async function runnerServe() {
 // src/servers/serve.ts
 init_config();
 init_litellm();
-import { spawn as spawn10 } from "child_process";
+import { spawn as spawn11 } from "child_process";
 function parseTarget(positional) {
   if (!Array.isArray(positional) || positional.length === 0) return "none";
   const first = String(positional[0]).toLowerCase();
@@ -29341,15 +29975,15 @@ async function serve(opts) {
     if (usesProxy) process.stdout.write(`  ANTHROPIC_BASE_URL=${url}
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
-    const child = spawn10("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
-    const exitCode = await new Promise((resolve21) => {
-      child.on("exit", (code) => resolve21(code ?? 0));
+    const child = spawn11("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
+    const exitCode = await new Promise((resolve23) => {
+      child.on("exit", (code) => resolve23(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve21(1);
+        resolve23(1);
       });
     });
     killProxy();
@@ -29361,7 +29995,7 @@ async function serve(opts) {
     if (usesProxy) process.stdout.write(`  ANTHROPIC_BASE_URL=${url}
 `);
     try {
-      const code = spawn10("code", [opts.cwd], { stdio: "inherit", env: editorEnv, detached: true });
+      const code = spawn11("code", [opts.cwd], { stdio: "inherit", env: editorEnv, detached: true });
       code.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch VS Code: ${err.message}
 `);
@@ -29709,7 +30343,15 @@ function parseArgs(argv) {
     if (result.cliArgs.quiet === true) result.quiet = true;
     return result;
   }
-  const SERVER_VERBS = /* @__PURE__ */ new Set(["serve", "pool-serve", "runner-serve", "brain-serve", "brain-proxy", "mcp-http-server"]);
+  const SERVER_VERBS = /* @__PURE__ */ new Set([
+    "serve",
+    "pool-serve",
+    "runner-serve",
+    "brain-serve",
+    "brain-terminal-agent",
+    "brain-proxy",
+    "mcp-http-server"
+  ]);
   if (SERVER_VERBS.has(cmd)) {
     result.command = "server";
     result.serverName = cmd;
@@ -29813,6 +30455,8 @@ ${HELP_TEXT}`);
           return await runnerServe();
         case "brain-serve":
           return await brainServe({ cwd: cwd2 });
+        case "brain-terminal-agent":
+          return await brainTerminalAgent({ cwd: cwd2 });
         case "brain-proxy":
           return await brainProxy();
         case "mcp-http-server":