@kontextmind/kxm 0.7.164 → 0.7.166

package/plugins/kxm/dist/extension.js

@@ -10319,7 +10319,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve8.call(this, root, ref);
+      let _sch = resolve9.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -10346,7 +10346,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve8(root, ref) {
+    function resolve9(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -11171,7 +11171,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve8(baseURI, relativeURI, options) {
+    function resolve9(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -11533,7 +11533,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve8,
+      resolve: resolve9,
       resolveComponent,
       equal,
       serialize,
@@ -14523,9 +14523,9 @@ var require_dist2 = __commonJS({
 });
 
 // plugins/kxm/src/extension.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync14, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname7, join as join15 } from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync14, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname8, join as join15 } from "node:path";
 
 // plugins/kxm/src/commands.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
@@ -14967,7 +14967,7 @@ var HubClient = class {
       if (signal?.aborted) throw new MeshWaitError("aborted", messageId);
       const message = await this.getMessage(messageId);
       if (["replied", "cancelled", "expired", "error"].includes(message.status)) return message;
-      await new Promise((resolve8, reject) => {
+      await new Promise((resolve9, reject) => {
         const onAbort = () => {
           signal?.removeEventListener("abort", onAbort);
           clearTimeout(timer);
@@ -14975,7 +14975,7 @@ var HubClient = class {
         };
         const timer = setTimeout(() => {
           signal?.removeEventListener("abort", onAbort);
-          resolve8();
+          resolve9();
         }, Math.min(500, Math.max(1, deadline - Date.now())));
         signal?.addEventListener("abort", onAbort, { once: true });
         if (signal?.aborted) onAbort();
@@ -15030,7 +15030,7 @@ var HubClient = class {
       } catch (error2) {
         if (this.stopped || error2 instanceof Error && error2.name === "AbortError") return;
       }
-      if (!this.stopped) await new Promise((resolve8) => setTimeout(resolve8, this.options.reconnectMs));
+      if (!this.stopped) await new Promise((resolve9) => setTimeout(resolve9, this.options.reconnectMs));
     }
   }
   headers(includeIdentity = true) {
@@ -15995,9 +15995,25 @@ function enforceToolPolicy(commandName, env = process.env, options) {
 // plugins/kxm/src/config.ts
 var import_yaml = __toESM(require_dist(), 1);
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { tmpdir, homedir as homedir2 } from "node:os";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
+var KxmHubConfigError = class extends Error {
+  code = "hub_config_invalid";
+  constructor(message) {
+    super(message);
+    this.name = "KxmHubConfigError";
+  }
+};
+var HUB_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var HUB_OP_REF = /^op:\/\/\S+\/\S+\/\S+$/;
+var LITERAL_SECRET_KEY = /^(token|secret|password|authToken|auth_token|apiKey|api_key|api_token|bearer|credential|access_token)$/i;
+function isHubKeyEnvName(value) {
+  return HUB_ENV_NAME.test(value);
+}
+function isHubOpReference(value) {
+  return HUB_OP_REF.test(value);
+}
 var IMPROVEMENT_PROMOTION_POLICIES = ["manual_pr", "critic_quorum", "auto_threshold"];
 var DEFAULT_KXM_CONFIG = {
   schema: KXM_CONFIG_SCHEMA,
@@ -16068,9 +16084,151 @@ function deepMerge(target, source) {
   }
   return result2;
 }
+function literalSecretMessage(path) {
+  return `refusing literal hub token at ${path}: store an op:// reference (key.op) or an environment variable name (key.env), never the token`;
+}
+function rejectLiteralHubSecrets(value, path) {
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => rejectLiteralHubSecrets(item, `${path}[${index}]`));
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = `${path}.${key}`;
+    if (typeof child === "string" && (key === "key" || LITERAL_SECRET_KEY.test(key))) {
+      throw new KxmHubConfigError(literalSecretMessage(childPath));
+    }
+    if (child && typeof child === "object") rejectLiteralHubSecrets(child, childPath);
+  }
+}
+function parseKeyRef(raw, path) {
+  if (raw === void 0) return void 0;
+  if (typeof raw === "string") throw new KxmHubConfigError(literalSecretMessage(path));
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new KxmHubConfigError(`${path} must be a key reference with op and/or env, never a token`);
+  }
+  const row = raw;
+  for (const key of Object.keys(row)) {
+    if (key !== "op" && key !== "env") {
+      throw new KxmHubConfigError(literalSecretMessage(`${path}.${key}`));
+    }
+  }
+  const ref = {};
+  if (row.op !== void 0) {
+    if (typeof row.op !== "string" || !isHubOpReference(row.op)) {
+      throw new KxmHubConfigError(`${path}.op must be an op://vault/item/field reference, not a token`);
+    }
+    ref.op = row.op;
+  }
+  if (row.env !== void 0) {
+    if (typeof row.env !== "string" || !isHubKeyEnvName(row.env)) {
+      throw new KxmHubConfigError(`${path}.env must be an environment variable name, not a token`);
+    }
+    ref.env = row.env;
+  }
+  if (!ref.op && !ref.env) throw new KxmHubConfigError(`${path} needs key.op, key.env, or both`);
+  return ref;
+}
+function parseEndpoint(raw, path) {
+  if (raw === void 0) return void 0;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new KxmHubConfigError(`${path} must be an object with url, project, and key`);
+  }
+  const row = raw;
+  const endpoint = {};
+  if (row.url !== void 0) {
+    if (typeof row.url !== "string" || !isHubUrl(row.url)) {
+      throw new KxmHubConfigError(`${path}.url must be an http or https URL without credentials, query, or fragment`);
+    }
+    endpoint.url = row.url.replace(/\/$/, "");
+  }
+  if (row.project !== void 0) {
+    if (typeof row.project !== "string" || !isHubProjectId(row.project)) {
+      throw new KxmHubConfigError(`${path}.project must be a single-line project id, not a token`);
+    }
+    endpoint.project = row.project.trim();
+  }
+  const key = parseKeyRef(row.key, `${path}.key`);
+  if (key) endpoint.key = key;
+  for (const name of Object.keys(row)) {
+    if (name !== "url" && name !== "project" && name !== "key") {
+      if (typeof row[name] === "string") throw new KxmHubConfigError(literalSecretMessage(`${path}.${name}`));
+      throw new KxmHubConfigError(`${path}.${name} is not a hub endpoint field`);
+    }
+  }
+  return endpoint;
+}
+function isHubUrl(raw) {
+  try {
+    const parsed = new URL(raw);
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username === "" && parsed.password === "" && parsed.search === "" && parsed.hash === "" && !raw.includes("?") && !raw.includes("#");
+  } catch {
+    return false;
+  }
+}
+function isHubProjectId(raw) {
+  const value = raw.trim();
+  return value.length > 0 && value.length <= 200 && !/[\s\r\n]/.test(value);
+}
+function parseProjectMap(raw) {
+  if (raw === void 0) return void 0;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new KxmHubConfigError("hub.projects must be a map of project id to key reference, never a token");
+  }
+  const projects = {};
+  for (const [project, value] of Object.entries(raw)) {
+    if (!isHubProjectId(project)) {
+      throw new KxmHubConfigError(`hub.projects key ${JSON.stringify(project)} must be a project id, not a token`);
+    }
+    const ref = parseKeyRef(value, `hub.projects.${project}`);
+    if (!ref) throw new KxmHubConfigError(`hub.projects.${project} needs an op:// reference or an environment variable name`);
+    projects[project.trim()] = ref;
+  }
+  return projects;
+}
 function normalizeHubConfig(raw) {
   const autoStart = raw?.autoStart;
-  return { autoStart: autoStart === "off" || autoStart === "background" ? autoStart : DEFAULT_KXM_CONFIG.hub.autoStart };
+  const hub = {
+    autoStart: autoStart === "off" || autoStart === "background" ? autoStart : DEFAULT_KXM_CONFIG.hub.autoStart
+  };
+  if (raw === void 0) return hub;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new KxmHubConfigError("hub must be an object");
+  }
+  rejectLiteralHubSecrets(raw, "hub");
+  const row = raw;
+  if (row.mode !== void 0) {
+    if (row.mode !== "local" && row.mode !== "cloud") {
+      throw new KxmHubConfigError("hub.mode must be local or cloud");
+    }
+    hub.mode = row.mode;
+  }
+  const local = parseEndpoint(row.local, "hub.local");
+  const cloud = parseEndpoint(row.cloud, "hub.cloud");
+  const projects = parseProjectMap(row.projects);
+  if (local) hub.local = local;
+  if (cloud) hub.cloud = cloud;
+  if (projects && Object.keys(projects).length > 0) hub.projects = projects;
+  return hub;
+}
+function findConfigRoot(start) {
+  let dir = resolve2(start);
+  for (; ; ) {
+    if (existsSync2(join2(dir, ".kxm", "project.yaml")) || existsSync2(join2(dir, ".kxm", "config.yaml"))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return resolve2(start);
+    dir = parent;
+  }
+}
+function userConfigDirForEnv(env) {
+  const explicit = env.KXM_USER_CONFIG_DIR?.trim();
+  if (explicit) return explicit;
+  if (env === process.env) return void 0;
+  return join2(tmpdir(), "kxm-no-user-config");
+}
+function loadHubSettings(start, env = process.env) {
+  const userConfigDir = userConfigDirForEnv(env);
+  return loadKxmConfig(findConfigRoot(start), userConfigDir === void 0 ? {} : { userConfigDir }).hub;
 }
 function recordOf(raw) {
   return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
@@ -16145,15 +16303,27 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
 
 // plugins/kxm/src/hub-autostart.ts
 import { spawn } from "node:child_process";
-import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync5 } from "node:fs";
-import { join as join6, resolve as resolve5 } from "node:path";
+import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6 } from "node:fs";
+import { join as join7, resolve as resolve6 } from "node:path";
 
 // plugins/kxm/src/hub-binding.ts
+import { spawnSync } from "node:child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname3, isAbsolute, join as join3, resolve as resolve3 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
+var CloudTokenError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "CloudTokenError";
+    this.code = code;
+  }
+};
+var TOKEN_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var TOKEN_COMMAND_TIMEOUT_MS = 15e3;
+var TOKEN_COMMAND_MAX_BUFFER = 4096;
 var HubBindingError = class extends Error {
   constructor(message) {
     super(message);
@@ -16191,6 +16361,99 @@ function validateHubUrl(raw) {
   }
   return parsed.href.replace(/\/$/, "");
 }
+function splitTokenCommand(raw) {
+  if (/[|&;<>$`\n\r]/.test(raw)) {
+    throw new CloudTokenError(
+      "cloud_token_command_invalid",
+      "token command must be a program and arguments, not a shell pipeline"
+    );
+  }
+  const args = [];
+  let current = "";
+  let quote;
+  for (const ch of raw) {
+    if (quote) {
+      if (ch === quote) quote = void 0;
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      if (current.length > 0) {
+        args.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (quote) {
+    throw new CloudTokenError("cloud_token_command_invalid", "token command has an unclosed quote");
+  }
+  if (current.length > 0) args.push(current);
+  if (args.length === 0) {
+    throw new CloudTokenError("cloud_token_command_invalid", "token command is empty");
+  }
+  return args;
+}
+function isCloudTokenEnvName(value) {
+  return TOKEN_ENV_NAME.test(value);
+}
+function resolveCloudHubToken(binding, env = process.env) {
+  if (!binding.cloud) {
+    throw new CloudTokenError("cloud_token_missing", "cloud hub token is missing; the local hub-env token was not used");
+  }
+  if (binding.tokenEnv) {
+    const value = env[binding.tokenEnv]?.trim();
+    if (value) return value;
+  }
+  if (binding.tokenCommand) return runTokenCommand(binding.tokenCommand, env);
+  const source = binding.tokenEnv ? `${binding.tokenEnv} is unset or empty` : "no token source is configured";
+  throw new CloudTokenError(
+    "cloud_token_missing",
+    `cloud hub token is missing: ${source}; the local hub-env token was not used`
+  );
+}
+function runTokenCommand(command, env) {
+  const argv = splitTokenCommand(command);
+  const [program, ...args] = argv;
+  const result2 = spawnSync(program, args, {
+    encoding: "utf8",
+    shell: false,
+    timeout: TOKEN_COMMAND_TIMEOUT_MS,
+    maxBuffer: TOKEN_COMMAND_MAX_BUFFER,
+    env,
+    windowsHide: true
+  });
+  if (result2.error || result2.status !== 0) {
+    throw new CloudTokenError(
+      "cloud_token_command_failed",
+      "token command failed; the local hub-env token was not used"
+    );
+  }
+  const stdout = result2.stdout ?? "";
+  if (stdout.trim().length === 0 || stdout.trim() !== stdout.trim().split(/\r?\n/)[0]) {
+    throw new CloudTokenError(
+      "cloud_token_command_failed",
+      "token command did not print a single token; the local hub-env token was not used"
+    );
+  }
+  return stdout.trim();
+}
+function hubBindingScope(url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return "remote";
+  }
+  if (host === "localhost" || host === "::1" || host === "[::1]" || host.endsWith(".localhost")) return "loopback";
+  const v4 = /^127\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/.exec(host);
+  return v4 && [v4[1], v4[2], v4[3]].every((part) => Number(part) <= 255) ? "loopback" : "remote";
+}
 function isIsoTimestamp(value) {
   if (Number.isNaN(Date.parse(value))) return false;
   return value === new Date(value).toISOString();
@@ -16214,7 +16477,9 @@ function readHubBinding(env = process.env) {
   }
   const row = parsed;
   const keys = Object.keys(row);
-  if (keys.length !== 3 || row.schema !== HUB_BINDING_SCHEMA || typeof row.url !== "string" || typeof row.boundAt !== "string" || !isIsoTimestamp(row.boundAt)) {
+  const allowed = /* @__PURE__ */ new Set(["schema", "url", "boundAt", "cloud", "tokenEnv", "tokenCommand"]);
+  const cloudish = keys.some((key) => key === "cloud" || key === "tokenEnv" || key === "tokenCommand");
+  if (keys.some((key) => !allowed.has(key)) || !cloudish && keys.length !== 3 || row.schema !== HUB_BINDING_SCHEMA || typeof row.url !== "string" || typeof row.boundAt !== "string" || !isIsoTimestamp(row.boundAt)) {
     throw new HubBindingError(`malformed hub binding at ${file}`);
   }
   let url;
@@ -16223,7 +16488,34 @@ function readHubBinding(env = process.env) {
   } catch {
     throw new HubBindingError(`malformed hub binding at ${file}`);
   }
-  return { schema: HUB_BINDING_SCHEMA, url, boundAt: row.boundAt };
+  if (!cloudish) return { schema: HUB_BINDING_SCHEMA, url, boundAt: row.boundAt };
+  if (row.cloud !== true) throw new HubBindingError(`malformed hub binding at ${file}`);
+  let tokenEnv;
+  let tokenCommand;
+  if (row.tokenEnv !== void 0) {
+    if (typeof row.tokenEnv !== "string" || !isCloudTokenEnvName(row.tokenEnv)) {
+      throw new HubBindingError(`malformed hub binding at ${file}`);
+    }
+    tokenEnv = row.tokenEnv;
+  }
+  if (row.tokenCommand !== void 0) {
+    if (typeof row.tokenCommand !== "string") throw new HubBindingError(`malformed hub binding at ${file}`);
+    try {
+      splitTokenCommand(row.tokenCommand);
+    } catch {
+      throw new HubBindingError(`malformed hub binding at ${file}`);
+    }
+    tokenCommand = row.tokenCommand;
+  }
+  if (!tokenEnv && !tokenCommand) throw new HubBindingError(`malformed hub binding at ${file}`);
+  return {
+    schema: HUB_BINDING_SCHEMA,
+    url,
+    boundAt: row.boundAt,
+    cloud: true,
+    ...tokenEnv ? { tokenEnv } : {},
+    ...tokenCommand ? { tokenCommand } : {}
+  };
 }
 async function probeHubHealth(url, fetchImpl, timeoutMs = HUB_HEALTH_PROBE_MS) {
   const started = Date.now();
@@ -16249,11 +16541,207 @@ async function probeHubHealth(url, fetchImpl, timeoutMs = HUB_HEALTH_PROBE_MS) {
   }
 }
 
+// plugins/kxm/src/hub-identity.ts
+var import_yaml2 = __toESM(require_dist(), 1);
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import { basename, dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
+var OP_TIMEOUT_MS = 15e3;
+var OP_MAX_BUFFER = 4096;
+function normalizeUrl(raw) {
+  try {
+    return validateHubUrl(raw);
+  } catch {
+    return void 0;
+  }
+}
+function projectYamlId(start) {
+  let dir = resolve4(start);
+  for (; ; ) {
+    const file = join4(dir, ".kxm", "project.yaml");
+    if (existsSync4(file)) {
+      try {
+        const doc = (0, import_yaml2.parse)(readFileSync4(file, "utf8"));
+        if (doc && typeof doc === "object" && !Array.isArray(doc) && typeof doc.id === "string" && doc.id.trim()) {
+          return doc.id.trim();
+        }
+      } catch {
+      }
+      return void 0;
+    }
+    const parent = dirname4(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function packageName(cwd) {
+  try {
+    const pkg = JSON.parse(readFileSync4(join4(cwd, "package.json"), "utf8"));
+    if (typeof pkg.name === "string" && pkg.name.trim().length > 0) return pkg.name.trim();
+  } catch {
+  }
+  return void 0;
+}
+function activeBinding(env) {
+  try {
+    return readHubBinding(env);
+  } catch (error2) {
+    if (error2 instanceof HubBindingError) return void 0;
+    throw error2;
+  }
+}
+function endpointFor(mode, settings) {
+  return mode === "cloud" ? settings.cloud : settings.local;
+}
+function resolveProjectIdentity(cwd, env = process.env, explicit) {
+  const fromExplicit = explicit?.trim();
+  if (fromExplicit) return { project: fromExplicit, source: "flag", sourceLabel: "--project" };
+  const fromEnv = env.KXM_PROJECT?.trim();
+  if (fromEnv) return { project: fromEnv, source: "env", sourceLabel: "KXM_PROJECT" };
+  const settings = loadHubSettings(cwd, env);
+  const mode = settings.mode ?? (activeBinding(env)?.cloud ? "cloud" : "local");
+  const fromConfig = endpointFor(mode, settings)?.project?.trim();
+  if (fromConfig) {
+    return { project: fromConfig, source: "config", sourceLabel: `.kxm/config.yaml hub.${mode}.project` };
+  }
+  const fromProject = projectYamlId(cwd);
+  if (fromProject) return { project: fromProject, source: "project.yaml", sourceLabel: ".kxm/project.yaml id" };
+  const fromPackage = packageName(cwd);
+  if (fromPackage) return { project: fromPackage, source: "package.json", sourceLabel: "package.json name" };
+  return { project: basename(cwd), source: "directory", sourceLabel: "directory name" };
+}
+function opReferenceFromTokenCommand(command) {
+  try {
+    const args = splitTokenCommand(command);
+    if (args[0] === "op" && args[1] === "read" && args[2] && isHubOpReference(args[2])) return args[2];
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function defaultOpRead(reference, env) {
+  if (!isHubOpReference(reference)) {
+    throw new CloudTokenError("cloud_token_command_invalid", `refusing to resolve ${reference}; an op:// reference is required`);
+  }
+  const result2 = spawnSync2("op", ["read", reference], {
+    encoding: "utf8",
+    shell: false,
+    timeout: OP_TIMEOUT_MS,
+    maxBuffer: OP_MAX_BUFFER,
+    env,
+    windowsHide: true
+  });
+  if (result2.error || result2.status !== 0) {
+    throw new CloudTokenError(
+      "cloud_token_command_failed",
+      `op read failed for ${reference}; the token was not saved`
+    );
+  }
+  const line = (result2.stdout ?? "").trim();
+  if (!line || line.split(/\r?\n/).length !== 1) {
+    throw new CloudTokenError(
+      "cloud_token_command_failed",
+      `op read did not print a single token for ${reference}; the token was not saved`
+    );
+  }
+  return line;
+}
+function resolveKeyReference(ref, env, opRead = defaultOpRead) {
+  if (!ref) return void 0;
+  if (ref.env) {
+    const value = env[ref.env]?.trim();
+    if (value) return { value, source: `env:${ref.env}` };
+  }
+  if (ref.op) {
+    const value = opRead(ref.op, env).trim();
+    if (!value || value.split(/\r?\n/).length !== 1) {
+      throw new CloudTokenError("cloud_token_command_failed", `op read did not print a single token for ${ref.op}`);
+    }
+    return { value, source: `op:${ref.op}` };
+  }
+  return void 0;
+}
+function keySourceFor(input) {
+  const ref = input.endpoint?.key;
+  if (input.mode === "local" && input.env.KXM_AUTH_TOKEN?.trim()) return "env:KXM_AUTH_TOKEN";
+  if (ref?.env && input.env[ref.env]?.trim()) return `env:${ref.env}`;
+  if (ref?.op) return `op:${ref.op}`;
+  if (ref?.env) return `env:${ref.env}`;
+  if (input.mode === "cloud") {
+    if (input.binding?.tokenEnv) return `env:${input.binding.tokenEnv}`;
+    if (input.binding?.tokenCommand) {
+      const op = opReferenceFromTokenCommand(input.binding.tokenCommand);
+      return op ? `op:${op}` : "command";
+    }
+    return "missing";
+  }
+  if (input.hasSavedProjectToken?.(input.project)) return "hub-env";
+  return "missing";
+}
+function describeHubConnection(cwd, env = process.env, hooks = {}) {
+  const settings = loadHubSettings(cwd, env);
+  const binding = activeBinding(env);
+  const mode = settings.mode ?? (binding?.cloud ? "cloud" : "local");
+  const modeSource = settings.mode ? "config" : binding?.cloud ? "binding" : "default";
+  const endpoint = endpointFor(mode, settings);
+  const fromEnv = env.KXM_SERVER_URL?.trim();
+  const fromConfig = endpoint?.url?.trim();
+  const fromBinding = binding?.url;
+  let url = "http://127.0.0.1:7331";
+  let urlSource = "default";
+  if (fromEnv) {
+    url = fromEnv.replace(/\/$/, "");
+    urlSource = "env";
+  } else if (fromConfig) {
+    url = fromConfig.replace(/\/$/, "");
+    urlSource = "config";
+  } else if (fromBinding) {
+    url = fromBinding;
+    urlSource = "binding";
+  }
+  const identity = resolveProjectIdentity(cwd, env, hooks.explicitProject);
+  const configuredCloudUrl = settings.cloud?.url ?? (binding?.cloud ? binding.url : void 0);
+  let scope;
+  if (mode === "cloud") {
+    const override = fromEnv ? normalizeUrl(fromEnv) : void 0;
+    const named = configuredCloudUrl ? normalizeUrl(configuredCloudUrl) : void 0;
+    scope = override && named && override !== named ? hubBindingScope(url) : "remote";
+  } else {
+    scope = hubBindingScope(url);
+  }
+  return {
+    ...identity,
+    mode,
+    modeSource,
+    url,
+    urlSource,
+    scope,
+    ...endpoint ? { endpoint } : {},
+    ...binding ? { binding } : {},
+    keySource: keySourceFor({
+      mode,
+      env,
+      ...endpoint ? { endpoint } : {},
+      ...binding ? { binding } : {},
+      project: identity.project,
+      ...hooks.hasSavedProjectToken ? { hasSavedProjectToken: hooks.hasSavedProjectToken } : {}
+    })
+  };
+}
+function projectTokenMissingMessage(identity) {
+  return [
+    `kxm has no project token for project ${identity.project} (from ${identity.sourceLabel}).`,
+    `Ask the user to set this project's token. Set KXM_AUTH_TOKEN, or set hub.local.project or hub.cloud.project in .kxm/config.yaml to the project key the hub already knows, or add a key reference under hub.projects.${identity.project} (key.op is an op:// reference, key.env is an environment variable name, never the token) and restart the hub.`,
+    "KXM_PROJECT or --project overrides the id for one command.",
+    "An agent never uses the hub admin token."
+  ].join(" ");
+}
+
 // plugins/kxm/src/hub-env.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { randomBytes } from "node:crypto";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join4, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join5, resolve as resolve5 } from "node:path";
 var HUB_ENV_SCHEMA = "kxm.hub-env.v1";
 var HubEnvError = class extends Error {
   constructor(message) {
@@ -16265,30 +16753,30 @@ function resolveUserStateRoot2(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
     if (!isAbsolute2(explicit)) throw new HubEnvError("local_state_root_not_absolute");
-    return resolve4(explicit);
+    return resolve5(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join4(homedir4(), "AppData", "Local");
-    return resolve4(base2, "KXM");
+    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join5(homedir4(), "AppData", "Local");
+    return resolve5(base2, "KXM");
   }
-  if (process.platform === "darwin") return resolve4(homedir4(), "Library", "Application Support", "KXM");
+  if (process.platform === "darwin") return resolve5(homedir4(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join4(homedir4(), ".local", "state");
-  return resolve4(base, "kxm");
+  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join5(homedir4(), ".local", "state");
+  return resolve5(base, "kxm");
 }
 function hubEnvFile(env = process.env) {
-  return join4(resolveUserStateRoot2(env), "hub-env.json");
+  return join5(resolveUserStateRoot2(env), "hub-env.json");
 }
 function generateHubAuthToken() {
   return `kxm_admin_${randomBytes(24).toString("base64url")}`;
 }
 function readHubEnvRecord(env = process.env) {
   const file = hubEnvFile(env);
-  if (!existsSync4(file)) return void 0;
+  if (!existsSync5(file)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(file, "utf8"));
+    parsed = JSON.parse(readFileSync5(file, "utf8"));
   } catch (error2) {
     throw new HubEnvError(`hub env file is malformed at ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`);
   }
@@ -16322,9 +16810,9 @@ function readHubEnvRecord(env = process.env) {
 }
 function writeHubEnvRecord(record2, env = process.env) {
   const file = hubEnvFile(env);
-  const directory = dirname4(file);
+  const directory = dirname5(file);
   mkdirSync4(directory, { recursive: true });
-  const temporary = join4(directory, `.hub-env-${process.pid}.tmp`);
+  const temporary = join5(directory, `.hub-env-${process.pid}.tmp`);
   writeFileSync4(temporary, `${JSON.stringify(record2, void 0, 2)}
 `, { encoding: "utf8", mode: 384 });
   try {
@@ -16393,9 +16881,24 @@ function resolveHubCredentials(options = {}) {
     written: needsPersist === true
   };
 }
-function resolveAgentHubAuthToken(env, project) {
+function cloudModeToken(cwd, env, explicitProject, opRead) {
+  const connection = describeHubConnection(cwd, env, explicitProject === void 0 ? {} : { explicitProject });
+  if (connection.mode !== "cloud") return void 0;
+  const fromConfig = resolveKeyReference(connection.endpoint?.key, env, opRead);
+  if (fromConfig) return fromConfig.value;
+  if (connection.binding?.cloud) return resolveCloudHubToken(connection.binding, env);
+  throw new CloudTokenError(
+    "cloud_token_missing",
+    "cloud hub token is missing; the local hub-env token was not used"
+  );
+}
+function resolveAgentHubAuthToken(env, project, cwd = process.cwd(), opRead) {
+  const cloud = cloudModeToken(cwd, env, void 0, opRead);
+  if (cloud) return cloud;
   const envToken = env.KXM_AUTH_TOKEN?.trim();
   if (envToken) return envToken;
+  const fromConfig = resolveKeyReference(describeHubConnection(cwd, env).endpoint?.key, env, opRead);
+  if (fromConfig) return fromConfig.value;
   const tokens = readHubEnvRecord(env)?.projectTokens;
   if (!tokens || !Object.hasOwn(tokens, project)) return void 0;
   return tokens[project]?.trim() || void 0;
@@ -16403,26 +16906,30 @@ function resolveAgentHubAuthToken(env, project) {
 var AgentProjectTokenMissingError = class extends Error {
   code = "project_token_missing";
   project;
-  constructor(project) {
-    super(
-      `kxm has no project token for project ${project} on this machine. Set KXM_AUTH_TOKEN to that project's token, or add ${project} to the hub KXM_PROJECT_TOKENS (list every existing project too, because that variable replaces the saved map). An agent never uses the hub admin token.`
-    );
+  projectSource;
+  hint;
+  constructor(projectOrIdentity) {
+    const identity = typeof projectOrIdentity === "string" ? { project: projectOrIdentity, source: "env", sourceLabel: "the project id sent to the hub" } : projectOrIdentity;
+    const message = projectTokenMissingMessage(identity);
+    super(message);
     this.name = "AgentProjectTokenMissingError";
-    this.project = project;
+    this.project = identity.project;
+    this.projectSource = typeof projectOrIdentity === "string" ? "unknown" : identity.source;
+    this.hint = message;
   }
 };
 
 // plugins/kxm/src/repo-root.ts
-import { existsSync as existsSync5 } from "node:fs";
-import { dirname as dirname5, join as join5 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { dirname as dirname6, join as join6 } from "node:path";
 import { fileURLToPath } from "node:url";
 var ROOT_MARKERS = ["scripts/kxm-hub.mjs", "scripts/kxm.mjs"];
 var MAX_WALK_DEPTH = 10;
 function tryFindKxmRepoRoot(fromUrl = import.meta.url) {
-  let dir = dirname5(fileURLToPath(fromUrl));
+  let dir = dirname6(fileURLToPath(fromUrl));
   for (let depth = 0; depth < MAX_WALK_DEPTH; depth += 1) {
-    if (ROOT_MARKERS.some((marker) => existsSync5(join5(dir, marker)))) return dir;
-    const parent = dirname5(dir);
+    if (ROOT_MARKERS.some((marker) => existsSync6(join6(dir, marker)))) return dir;
+    const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -16455,7 +16962,7 @@ function defaultProcessExists(pid) {
 function readLiveHubClaim(stateDir, processExists2 = defaultProcessExists) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(join6(stateDir, "hub.pid"), "utf8"));
+    parsed = JSON.parse(readFileSync6(join7(stateDir, "hub.pid"), "utf8"));
   } catch {
     return void 0;
   }
@@ -16470,7 +16977,7 @@ function readLiveHubClaim(stateDir, processExists2 = defaultProcessExists) {
   };
 }
 function defaultHubWrapperScriptPath(moduleUrl = import.meta.url) {
-  return join6(findKxmRepoRoot(moduleUrl), "scripts", "kxm-hub.mjs");
+  return join7(findKxmRepoRoot(moduleUrl), "scripts", "kxm-hub.mjs");
 }
 function defaultHubSpawner(command, args, options) {
   const child = spawn(command, [...args], options);
@@ -16479,7 +16986,7 @@ function defaultHubSpawner(command, args, options) {
 }
 function logTail(logPath, maxChars = 2e3) {
   try {
-    return redactSecrets(readFileSync5(logPath, "utf8").trim().slice(-maxChars));
+    return redactSecrets(readFileSync6(logPath, "utf8").trim().slice(-maxChars));
   } catch {
     return "";
   }
@@ -16492,11 +16999,28 @@ async function ensureHubRunning(options) {
   if (binding) {
     const { health } = await probeHubHealth(binding.url, fetchImpl);
     if (health === "on") return { status: "bound-healthy", url: binding.url };
+    if (binding.cloud) return { status: "failed", reason: "cloud_hub_unreachable", logPath: "" };
+  }
+  if (!binding?.cloud) {
+    try {
+      const connection = describeHubConnection(options.cwd, env);
+      if (connection.mode === "cloud") {
+        const { health } = await probeHubHealth(connection.url, fetchImpl);
+        if (health === "on") return { status: "bound-healthy", url: connection.url };
+        return { status: "failed", reason: "cloud_hub_unreachable", logPath: "" };
+      }
+    } catch (error2) {
+      return {
+        status: "failed",
+        reason: error2 instanceof Error ? error2.message : "hub_config_invalid",
+        logPath: ""
+      };
+    }
   }
-  const workdir = resolve5(env.KXM_WORKDIR?.trim() || options.cwd);
-  const workspaceDir = resolve5(workdir, env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
-  const stateDir = resolve5(workdir, env.KXM_STATE_DIR?.trim() || join6(workspaceDir, "state"));
-  const logsDir = resolve5(workdir, env.KXM_LOGS_DIR?.trim() || join6(workspaceDir, "logs"));
+  const workdir = resolve6(env.KXM_WORKDIR?.trim() || options.cwd);
+  const workspaceDir = resolve6(workdir, env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
+  const stateDir = resolve6(workdir, env.KXM_STATE_DIR?.trim() || join7(workspaceDir, "state"));
+  const logsDir = resolve6(workdir, env.KXM_LOGS_DIR?.trim() || join7(workspaceDir, "logs"));
   const processExists2 = options.processExists ?? defaultProcessExists;
   const live = readLiveHubClaim(stateDir, processExists2);
   if (live) return { status: "claim-alive", pid: live.pid };
@@ -16506,7 +17030,7 @@ async function ensureHubRunning(options) {
     if (health === "on") return { status: "url-healthy", url: serverUrl };
   }
   const credentials = resolveHubCredentials({ env });
-  const logPath = join6(logsDir, HUB_AUTOSTART_LOG_NAME);
+  const logPath = join7(logsDir, HUB_AUTOSTART_LOG_NAME);
   mkdirSync5(logsDir, { recursive: true });
   const logFd = openSync(logPath, "a");
   let child;
@@ -16553,20 +17077,6 @@ async function ensureHubRunning(options) {
   }
 }
 
-// plugins/kxm/src/project-name.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import { basename, join as join7 } from "node:path";
-function defaultProjectName(cwd, env = process.env) {
-  const fromEnv = env.KXM_PROJECT?.trim();
-  if (fromEnv) return fromEnv;
-  try {
-    const pkg = JSON.parse(readFileSync6(join7(cwd, "package.json"), "utf8"));
-    if (typeof pkg.name === "string" && pkg.name.trim().length > 0) return pkg.name.trim();
-  } catch {
-  }
-  return basename(cwd);
-}
-
 // plugins/kxm/src/nous-pi.ts
 import { readFile } from "node:fs/promises";
 
@@ -18437,7 +18947,7 @@ function closeServerGracefully(server) {
   server.close();
 }
 function startCallbackServer(expectedState) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     let timeout;
     let resolveCode;
@@ -18516,7 +19026,7 @@ function startCallbackServer(expectedState) {
         finish(() => rejectCode(new Error("OAuth callback timed out waiting for browser login")));
         close();
       }, OAUTH_CALLBACK_TIMEOUT_MS);
-      resolve8({ server, waitForCode: () => codePromise, cleanup });
+      resolve9({ server, waitForCode: () => codePromise, cleanup });
     });
   });
 }
@@ -19135,8 +19645,8 @@ var AssistantMessageEventStream = class {
   finalResultPromise;
   resolveFinalResult;
   constructor() {
-    this.finalResultPromise = new Promise((resolve8) => {
-      this.resolveFinalResult = resolve8;
+    this.finalResultPromise = new Promise((resolve9) => {
+      this.resolveFinalResult = resolve9;
     });
   }
   push(event) {
@@ -19166,8 +19676,8 @@ var AssistantMessageEventStream = class {
       } else if (this.done) {
         return;
       } else {
-        const next = await new Promise((resolve8) => {
-          this.waiting.push(resolve8);
+        const next = await new Promise((resolve9) => {
+          this.waiting.push(resolve9);
         });
         if (next.done) return;
         if (next.value) yield next.value;
@@ -20486,8 +20996,8 @@ var AssistantMessageEventStream2 = class {
   finalResultPromise;
   resolveFinalResult;
   constructor() {
-    this.finalResultPromise = new Promise((resolve8) => {
-      this.resolveFinalResult = resolve8;
+    this.finalResultPromise = new Promise((resolve9) => {
+      this.resolveFinalResult = resolve9;
     });
   }
   push(event) {
@@ -20517,8 +21027,8 @@ var AssistantMessageEventStream2 = class {
       } else if (this.done) {
         return;
       } else {
-        const next = await new Promise((resolve8) => {
-          this.waiting.push(resolve8);
+        const next = await new Promise((resolve9) => {
+          this.waiting.push(resolve9);
         });
         if (next.done) return;
         if (next.value) yield next.value;
@@ -20544,11 +21054,11 @@ function emptyUsage() {
 }
 
 // plugins/kxm/src/providers/claude-bridge/config.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { join as join8 } from "node:path";
 function tryParseJson(path) {
-  if (!existsSync6(path)) return {};
+  if (!existsSync7(path)) return {};
   try {
     return JSON.parse(readFileSync7(path, "utf-8"));
   } catch (error2) {
@@ -33576,7 +34086,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+        await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -33593,7 +34103,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -33671,7 +34181,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve8(parseResult.data);
+            resolve9(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -33932,12 +34442,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve8, interval);
+      const timeoutId = setTimeout(resolve9, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -35028,7 +35538,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+      await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -35646,8 +36156,8 @@ function makePromptStream() {
     try {
       while (true) {
         while (queue.length === 0 && !done && !failure) {
-          await new Promise((resolve8) => {
-            wake = resolve8;
+          await new Promise((resolve9) => {
+            wake = resolve9;
           });
         }
         if (failure) throw failure;
@@ -35668,8 +36178,8 @@ function makePromptStream() {
   }
   return {
     stream: gen(),
-    push: (msg) => failure || done ? Promise.reject(failure ?? new Error("prompt stream closed")) : new Promise((resolve8, reject) => {
-      queue.push({ msg, resolve: resolve8, reject });
+    push: (msg) => failure || done ? Promise.reject(failure ?? new Error("prompt stream closed")) : new Promise((resolve9, reject) => {
+      queue.push({ msg, resolve: resolve9, reject });
       kick();
     }),
     end: () => {
@@ -36080,8 +36590,8 @@ function buildMcpServers(tools, queryCtx) {
         queryCtx.pendingResults.delete(toolCallId);
         return result2;
       }
-      return new Promise((resolve8) => {
-        queryCtx.pendingToolCalls.set(toolCallId, { toolName: tool.name, resolve: resolve8 });
+      return new Promise((resolve9) => {
+        queryCtx.pendingToolCalls.set(toolCallId, { toolName: tool.name, resolve: resolve9 });
       });
     }
   }));
@@ -36601,20 +37111,20 @@ async function consumeWorkerRecoveryEnvelope(client, stateDir, agentName, projec
 }
 
 // plugins/kxm/src/session-work.ts
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join13 } from "node:path";
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync10 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { isAbsolute as isAbsolute3, join as join11, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join11, resolve as resolve8 } from "node:path";
 
 // plugins/kxm/src/sqlite.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 import { pathToFileURL } from "node:url";
 var requireFromHere = createRequire2(import.meta.url);
 function loadNative() {
@@ -36653,15 +37163,15 @@ var DatabaseSync = class {
   }
 };
 function openReadOnlyDatabase(path) {
-  if (existsSync7(`${path}-wal`)) return new DatabaseSync(path, { readOnly: true });
-  const uri = pathToFileURL(resolve6(path));
+  if (existsSync8(`${path}-wal`)) return new DatabaseSync(path, { readOnly: true });
+  const uri = pathToFileURL(resolve7(path));
   uri.searchParams.set("immutable", "1");
   return new DatabaseSync(uri.href, { readOnly: true });
 }
 
 // plugins/kxm/src/telemetry.ts
 import { appendFileSync, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { dirname as dirname7, join as join10 } from "node:path";
 function telemetryPath(logsDir) {
   return join10(logsDir, "telemetry.jsonl");
 }
@@ -36825,34 +37335,34 @@ function readOpenMessageMetadata(database, where = OPEN_MESSAGE_WHERE, params =
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
   const stateDir = env.KXM_STATE_DIR?.trim() || join11(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve7(cwd, configured) : join11(stateDir, "kxm.db");
+  const dataPath = configured ? resolve8(cwd, configured) : join11(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveKxmStateRoot(stateDir, options) {
-  if (options?.kxmStateRoot && existsSync8(options.kxmStateRoot)) {
-    return resolve7(options.kxmStateRoot);
+  if (options?.kxmStateRoot && existsSync9(options.kxmStateRoot)) {
+    return resolve8(options.kxmStateRoot);
   }
-  if (existsSync8(join11(stateDir, "runtime", "registry.db")) || existsSync8(join11(stateDir, "runtime", "projects"))) {
+  if (existsSync9(join11(stateDir, "runtime", "registry.db")) || existsSync9(join11(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute3(explicit) && existsSync8(resolve7(explicit))) {
-    return resolve7(explicit);
+  if (explicit && isAbsolute3(explicit) && existsSync9(resolve8(explicit))) {
+    return resolve8(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
     base = localAppData && isAbsolute3(localAppData) ? localAppData : join11(homedir6(), "AppData", "Local");
-    base = resolve7(base, "KXM");
+    base = resolve8(base, "KXM");
   } else if (process.platform === "darwin") {
-    base = resolve7(homedir6(), "Library", "Application Support", "KXM");
+    base = resolve8(homedir6(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
     base = xdgState && isAbsolute3(xdgState) ? xdgState : join11(homedir6(), ".local", "state");
-    base = resolve7(base, "kxm");
+    base = resolve8(base, "kxm");
   }
-  if (existsSync8(base)) return base;
+  if (existsSync9(base)) return base;
   return void 0;
 }
 function readRuntimeRuns(eventDb, projectId) {
@@ -36885,7 +37395,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let legacyRuns = [];
   let legacyRunTotal = 0;
   let plans = [];
-  if (existsSync8(dataPath)) {
+  if (existsSync9(dataPath)) {
     hasLegacy = true;
     const database = openReadOnlyDatabase(dataPath);
     try {
@@ -36920,7 +37430,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     const registryDbPath = join11(runtimeDir, "registry.db");
     const projectsDir = join11(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
-    if (existsSync8(registryDbPath)) {
+    if (existsSync9(registryDbPath)) {
       hasKxm = true;
       try {
         const regDb = openReadOnlyDatabase(registryDbPath);
@@ -36936,7 +37446,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       } catch {
       }
     }
-    if (!scope && existsSync8(projectsDir)) {
+    if (!scope && existsSync9(projectsDir)) {
       try {
         for (const entry of readdirSync(projectsDir, { withFileTypes: true })) {
           if (entry.isDirectory()) {
@@ -36949,7 +37459,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     for (const key of projectKeys) {
       if (scope && !RUNTIME_PROJECT_KEY.test(key)) continue;
       const eventDbPath = join11(projectsDir, key, "run-events.db");
-      if (existsSync8(eventDbPath)) {
+      if (existsSync9(eventDbPath)) {
         hasKxm = true;
         try {
           const eventDb = openReadOnlyDatabase(eventDbPath);
@@ -36967,7 +37477,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
   }
   const pids = [];
-  if (existsSync8(stateDir)) {
+  if (existsSync9(stateDir)) {
     for (const file of readdirSync(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
         const record2 = JSON.parse(readFileSync10(join11(stateDir, file), "utf8"));
@@ -37010,7 +37520,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     source = "legacy";
   }
   const telemetryFile = join11(stateDir, "telemetry.jsonl");
-  const spend = existsSync8(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
+  const spend = existsSync9(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
     agents: agents.sort((a, b) => Number(b.online) - Number(a.online) || a.name.localeCompare(b.name)),
@@ -37025,13 +37535,13 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
 }
 
 // plugins/kxm/src/kxm-update.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync5, mkdirSync as mkdirSync7 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync5, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join12 } from "node:path";
 var KXM_UPDATE_CACHE = "update-check.json";
 var CACHE_TTL_MS = 6 * 60 * 60 * 1e3;
 function readUpdateCache(stateDir, now = Date.now()) {
   const path = join12(stateDir, KXM_UPDATE_CACHE);
-  if (!existsSync9(path)) return void 0;
+  if (!existsSync10(path)) return void 0;
   try {
     const row = JSON.parse(readFileSync11(path, "utf8"));
     if (typeof row.checkedAt !== "number" || !row.notice || now - row.checkedAt > CACHE_TTL_MS) return void 0;
@@ -37099,10 +37609,10 @@ function formatShipLine(ship) {
 }
 function readGitShip(cwd) {
   try {
-    const dirty = spawnSync("git", ["--no-optional-locks", "-C", cwd, "status", "--porcelain"], { encoding: "utf8", windowsHide: true });
+    const dirty = spawnSync3("git", ["--no-optional-locks", "-C", cwd, "status", "--porcelain"], { encoding: "utf8", windowsHide: true });
     if (dirty.status !== 0) return void 0;
     const isDirty2 = dirty.stdout.trim().length > 0;
-    const upstream = spawnSync("git", ["-C", cwd, "rev-list", "--count", "@{u}..HEAD"], { encoding: "utf8", windowsHide: true });
+    const upstream = spawnSync3("git", ["-C", cwd, "rev-list", "--count", "@{u}..HEAD"], { encoding: "utf8", windowsHide: true });
     if (upstream.status === 0) {
       return {
         dirty: isDirty2,
@@ -37110,9 +37620,9 @@ function readGitShip(cwd) {
       };
     }
     for (const baseRef of ["origin/HEAD", "main", "origin/main", "master", "origin/master"]) {
-      const mb = spawnSync("git", ["-C", cwd, "merge-base", baseRef, "HEAD"], { encoding: "utf8", windowsHide: true });
+      const mb = spawnSync3("git", ["-C", cwd, "merge-base", baseRef, "HEAD"], { encoding: "utf8", windowsHide: true });
       if (mb.status === 0 && mb.stdout.trim()) {
-        const count = spawnSync("git", ["-C", cwd, "rev-list", "--count", `${mb.stdout.trim()}..HEAD`], { encoding: "utf8", windowsHide: true });
+        const count = spawnSync3("git", ["-C", cwd, "rev-list", "--count", `${mb.stdout.trim()}..HEAD`], { encoding: "utf8", windowsHide: true });
         if (count.status === 0) {
           return {
             dirty: isDirty2,
@@ -37202,7 +37712,7 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
 function readCachedSessionBrief(stateDir) {
   const file = join13(stateDir, "session-brief.json");
   try {
-    if (!existsSync10(file)) return void 0;
+    if (!existsSync11(file)) return void 0;
     const raw = readFileSync12(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
@@ -37229,7 +37739,7 @@ function writeCachedSessionBrief(stateDir, brief) {
 function estimateSessionCost(stateDir) {
   try {
     const telemetryFile = join13(stateDir, "telemetry.jsonl");
-    if (!existsSync10(telemetryFile)) return void 0;
+    if (!existsSync11(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
     let totalCost = 0;
@@ -37404,11 +37914,11 @@ function kxmSlashCompletions(prefix) {
 }
 
 // plugins/kxm/src/workflow-tui.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync13 } from "node:fs";
 import { join as join14 } from "node:path";
 function loadActiveWorkflowProgress(repoRoot = process.cwd(), targetRunId) {
   const dbPath = join14(repoConfigDirectory(repoRoot), "state", "kxm.db");
-  if (!existsSync11(dbPath)) return void 0;
+  if (!existsSync12(dbPath)) return void 0;
   let db;
   try {
     db = new DatabaseSync(dbPath, { readOnly: true });
@@ -37445,7 +37955,7 @@ function loadActiveWorkflowProgress(repoRoot = process.cwd(), targetRunId) {
     try {
       const logsDir = join14(repoConfigDirectory(repoRoot), "logs");
       const telemFile = telemetryPath(logsDir);
-      if (existsSync11(telemFile)) {
+      if (existsSync12(telemFile)) {
         const records = readRoutingRecords(telemFile);
         const routingRunId = (routing) => "runId" in routing ? routing.runId : routing.workflowRunId;
         let matching = records.filter((r) => routingRunId(r.routing) === runId);
@@ -37737,7 +38247,7 @@ function piMeshExtension(pi) {
       messageId: message.id,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    mkdirSync9(dirname7(path), { recursive: true });
+    mkdirSync9(dirname8(path), { recursive: true });
     const tmp = `${path}.${process.pid}.tmp`;
     writeFileSync7(tmp, `${JSON.stringify(request)}
 `, { encoding: "utf8", mode: 384 });
@@ -37768,7 +38278,7 @@ function piMeshExtension(pi) {
       removeMatchingLegacyRecoveryContext();
       return;
     }
-    mkdirSync9(dirname7(path), { recursive: true });
+    mkdirSync9(dirname8(path), { recursive: true });
     const tmp = `${path}.${process.pid}.tmp`;
     writeFileSync7(tmp, `${JSON.stringify({ version: 1, agentName, project: projectName, runId: runId ?? null, stageId: recoveryStageId ?? null, activeMessageIds, pendingMessageIds, artifactPointers: recoveryArtifacts.slice(0, 16), updatedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `, { encoding: "utf8", mode: 384 });
@@ -37818,7 +38328,7 @@ function piMeshExtension(pi) {
     ctx2.ui.setEditorText?.(item.prompt);
   }
   async function showKxmHub(ctx2) {
-    const url = (process.env.KXM_SERVER_URL ?? "http://127.0.0.1:7331").replace(/\/$/, "");
+    const url = describeHubConnection(process.cwd(), process.env).url;
     let health = "unreachable";
     try {
       const response = await fetch(`${url}/health`);
@@ -38108,8 +38618,9 @@ function piMeshExtension(pi) {
       return;
     }
     currentPiSessionId = ctx2.sessionManager?.getSessionId();
-    const serverUrl = process.env.KXM_SERVER_URL ?? "http://127.0.0.1:7331";
-    const project = defaultProjectName(ctx2.cwd, process.env);
+    const identity = resolveProjectIdentity(ctx2.cwd, process.env);
+    const serverUrl = describeHubConnection(ctx2.cwd, process.env).url;
+    const project = identity.project;
     const name = process.env.KXM_AGENT_NAME ?? pi.getSessionName() ?? `pi-${process.pid}`;
     agentName = name;
     projectName = project;
@@ -38135,14 +38646,15 @@ function piMeshExtension(pi) {
     }
     let hubAuthToken;
     try {
-      hubAuthToken = resolveAgentHubAuthToken(process.env, project);
+      hubAuthToken = resolveAgentHubAuthToken(process.env, project, ctx2.cwd);
     } catch (error2) {
-      ctx2.ui.notify(`kxm could not read persisted hub credentials: ${error2 instanceof Error ? error2.message : String(error2)}`, "error");
+      const detail = error2 instanceof CloudTokenError ? error2.message : `kxm could not read persisted hub credentials: ${error2 instanceof Error ? error2.message : String(error2)}`;
+      ctx2.ui.notify(detail, "error");
       await applySessionChrome(ctx2, event, true);
       return;
     }
     if (!hubAuthToken) {
-      ctx2.ui.notify(new AgentProjectTokenMissingError(project).message, "error");
+      ctx2.ui.notify(new AgentProjectTokenMissingError(identity).message, "error");
       await applySessionChrome(ctx2, event, true);
       return;
     }
@@ -38356,12 +38868,12 @@ function piMeshExtension(pi) {
       if (command === "memory") {
         const cwd = typeof ctx2.cwd === "string" ? ctx2.cwd : process.cwd();
         const kxmBin = process.env.KXM_BIN || "kxm";
-        const res = spawnSync2(kxmBin, ["memory", "brief"], { cwd, encoding: "utf8", windowsHide: true });
+        const res = spawnSync4(kxmBin, ["memory", "brief"], { cwd, encoding: "utf8", windowsHide: true });
         let memText = res.status === 0 && res.stdout ? res.stdout.trim() : "";
         if (!memText) {
           const script = join15(cwd, "scripts", "kxm.mjs");
-          if (existsSync12(script)) {
-            const scriptRes = spawnSync2(process.execPath, [script, "memory", "brief"], { cwd, encoding: "utf8", windowsHide: true });
+          if (existsSync13(script)) {
+            const scriptRes = spawnSync4(process.execPath, [script, "memory", "brief"], { cwd, encoding: "utf8", windowsHide: true });
             if (scriptRes.status === 0 && scriptRes.stdout) memText = scriptRes.stdout.trim();
           }
         }