@kontextmind/kxm 0.7.17 → 0.7.19

package/plugins/kxm/dist/cli.js

@@ -8072,36 +8072,38 @@ var require_Alias = __commonJS({
           if (node.anchor === this.source)
             found = node;
         }
+        if (found && ctx) {
+          const { anchors: anchors2, doc: doc2, maxAliasCount } = ctx;
+          let data = anchors2.get(found);
+          if (!data) {
+            toJS.toJS(found, null, ctx);
+            data = anchors2.get(found);
+          }
+          if (data?.res === void 0) {
+            const msg = "This should not happen: Alias anchor was not resolved?";
+            throw new ReferenceError(msg);
+          }
+          if (maxAliasCount >= 0) {
+            data.count += 1;
+            if (data.aliasCount === 0)
+              data.aliasCount = getAliasCount(doc2, found, anchors2);
+            if (data.count * data.aliasCount > maxAliasCount) {
+              const msg = "Excessive alias count indicates a resource exhaustion attack";
+              throw new ReferenceError(msg);
+            }
+          }
+        }
         return found;
       }
       toJSON(_arg, ctx) {
         if (!ctx)
           return { source: this.source };
-        const { anchors: anchors2, doc, maxAliasCount } = ctx;
-        const source = this.resolve(doc, ctx);
+        const source = this.resolve(ctx.doc, ctx);
         if (!source) {
           const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
           throw new ReferenceError(msg);
         }
-        let data = anchors2.get(source);
-        if (!data) {
-          toJS.toJS(source, null, ctx);
-          data = anchors2.get(source);
-        }
-        if (data?.res === void 0) {
-          const msg = "This should not happen: Alias anchor was not resolved?";
-          throw new ReferenceError(msg);
-        }
-        if (maxAliasCount >= 0) {
-          data.count += 1;
-          if (data.aliasCount === 0)
-            data.aliasCount = getAliasCount(doc, source, anchors2);
-          if (data.count * data.aliasCount > maxAliasCount) {
-            const msg = "Excessive alias count indicates a resource exhaustion attack";
-            throw new ReferenceError(msg);
-          }
-        }
-        return data.res;
+        return ctx.anchors.get(source).res;
       }
       toString(ctx, _onComment, _onChompKeep) {
         const src = `*${this.source}`;
@@ -12103,37 +12105,38 @@ var require_resolve_flow_scalar = __commonJS({
       }
       if (badChar)
         onError(0, "BAD_SCALAR_START", `Plain value cannot start with ${badChar}`);
-      return foldLines(source);
+      return unfoldLines(source);
     }
     function singleQuotedValue(source, onError) {
       if (source[source.length - 1] !== "'" || source.length === 1)
         onError(source.length, "MISSING_CHAR", "Missing closing 'quote");
-      return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+      return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
     }
-    function foldLines(source) {
-      let first, line;
+    function unfoldLines(source) {
+      const line = /(.*?)\r?\n/sy;
+      let match = line.exec(source);
+      if (!match)
+        return source;
+      let trimEnd, trimBoth;
       try {
-        first = new RegExp("(.*?)(?<![ 	])[ 	]*\r?\n", "sy");
-        line = new RegExp("[ 	]*(.*?)(?:(?<![ 	])[ 	]*)?\r?\n", "sy");
+        trimEnd = new RegExp("(?<![ 	])[ 	]+$");
+        trimBoth = new RegExp("^[ 	]+|(?<![ 	])[ 	]+$", "g");
       } catch {
-        first = /(.*?)[ \t]*\r?\n/sy;
-        line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+        trimEnd = /[ \t]+$/;
+        trimBoth = /^[ \t]+|[ \t]+$/g;
       }
-      let match = first.exec(source);
-      if (!match)
-        return source;
-      let res = match[1];
+      let res = match[1].replace(trimEnd, "");
       let sep4 = " ";
-      let pos = first.lastIndex;
-      line.lastIndex = pos;
+      let pos = line.lastIndex;
       while (match = line.exec(source)) {
-        if (match[1] === "") {
+        const lm = match[1].replace(trimBoth, "");
+        if (lm === "") {
           if (sep4 === "\n")
             res += sep4;
           else
             sep4 = "\n";
         } else {
-          res += sep4 + match[1];
+          res += sep4 + lm;
           sep4 = " ";
         }
         pos = line.lastIndex;
@@ -14776,7 +14779,7 @@ var require_dist = __commonJS({
 });
 
 // plugins/kxm/src/cli.ts
-import { basename as basename10, resolve as resolve30 } from "node:path";
+import { resolve as resolve30 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 
 // node_modules/commander/lib/error.js
@@ -19568,11 +19571,25 @@ var HubClient = class {
   }
 };
 
+// plugins/kxm/src/project-name.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { basename, join as join2 } from "node:path";
+function defaultProjectName(cwd, env = process.env) {
+  const fromEnv = env.KXM_PROJECT?.trim();
+  if (fromEnv) return fromEnv;
+  try {
+    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    if (typeof pkg.name === "string" && pkg.name.trim().length > 0) return pkg.name.trim();
+  } catch {
+  }
+  return basename(cwd);
+}
+
 // plugins/kxm/src/commands.ts
 import { createHash as createHash4, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join as join2, resolve } from "node:path";
+import { dirname, join as join3, resolve } from "node:path";
 function requiredString(value, name) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${name} is required`);
   return value.trim();
@@ -20321,10 +20338,10 @@ function parseSessionToken(token) {
 }
 function resolveUserConfigDirectory(overrideDir) {
   if (overrideDir) return resolve(overrideDir);
-  return resolve(process.env.KXM_USER_CONFIG_DIR?.trim() || join2(homedir(), ".config", "kxm"));
+  return resolve(process.env.KXM_USER_CONFIG_DIR?.trim() || join3(homedir(), ".config", "kxm"));
 }
 function sessionTokenPath(userConfigDir) {
-  return join2(resolveUserConfigDirectory(userConfigDir), "session.token");
+  return join3(resolveUserConfigDirectory(userConfigDir), "session.token");
 }
 function persistSessionTokenToDisk(token, options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
@@ -20343,7 +20360,7 @@ function readSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
   if (!existsSync2(filePath)) return void 0;
   try {
-    const token = readFileSync2(filePath, "utf8").trim();
+    const token = readFileSync3(filePath, "utf8").trim();
     if (!token) return void 0;
     const payload = parseSessionToken(token);
     if (!payload) return void 0;
@@ -20456,7 +20473,7 @@ function enforceToolPolicy(commandName, env = process.env, options) {
   if (existsSync2(tokenFile)) {
     let tokenRaw;
     try {
-      tokenRaw = readFileSync2(tokenFile, "utf8").trim();
+      tokenRaw = readFileSync3(tokenFile, "utf8").trim();
     } catch {
       return { allowed: false, error: "session_token_invalid", detail: "Session token file on disk could not be read" };
     }
@@ -20480,8 +20497,8 @@ function enforceToolPolicy(commandName, env = process.env, options) {
 var import__ = __toESM(require__(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync3, readdirSync, realpathSync } from "node:fs";
-import { basename, dirname as dirname2, extname, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "node:path";
+import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync, realpathSync } from "node:fs";
+import { basename as basename2, dirname as dirname2, extname, isAbsolute, join as join4, relative, resolve as resolve2, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // plugins/kxm/src/restricted-yaml.mjs
@@ -21877,7 +21894,7 @@ var VnextConfigError = class extends Error {
   }
 };
 var PACKAGE_ROOT = resolve2(dirname2(fileURLToPath(import.meta.url)), "../../..");
-var DEFAULT_SCHEMA_DIR = join3(PACKAGE_ROOT, "schemas", "vnext");
+var DEFAULT_SCHEMA_DIR = join4(PACKAGE_ROOT, "schemas", "vnext");
 var RESOURCE_SCHEMA = Object.freeze({
   project: { identity: "kxm.project.v1", file: "project.schema.json" },
   repository: { identity: "kxm.repository.v1", file: "repository.schema.json" },
@@ -21923,7 +21940,7 @@ function parseRestrictedYaml2(input, label = "<yaml>", limits = VNEXT_YAML_LIMIT
   }
 }
 function readJsonObject(file) {
-  const parsed = JSON.parse(readFileSync3(file, "utf8"));
+  const parsed = JSON.parse(readFileSync4(file, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${file} is not a JSON object`);
   return parsed;
 }
@@ -21942,10 +21959,10 @@ var VnextSchemaRegistry = class {
   constructor(schemasDir = DEFAULT_SCHEMA_DIR) {
     this.schemasDir = resolve2(schemasDir);
     this.ajv = new import__.Ajv2020({ allErrors: true, strict: true, strictRequired: false });
-    const common = readJsonObject(join3(this.schemasDir, "common.schema.json"));
+    const common = readJsonObject(join4(this.schemasDir, "common.schema.json"));
     this.ajv.addSchema(common);
     for (const definition of Object.values(RESOURCE_SCHEMA)) {
-      this.ajv.addSchema(readJsonObject(join3(this.schemasDir, definition.file)));
+      this.ajv.addSchema(readJsonObject(join4(this.schemasDir, definition.file)));
     }
     const localBindingsFile = "local-repository-bindings.schema.json";
     const templateProvenanceFile = "template-provenance.schema.json";
@@ -21955,14 +21972,14 @@ var VnextSchemaRegistry = class {
     const migrationReceiptFile = "migration-receipt.schema.json";
     const permissionDiffFile = "permission-diff.schema.json";
     const runEventFile = "run-event.schema.json";
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, localBindingsFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, templateProvenanceFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, initOperationFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, migrationPlanFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, migrationDecisionFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, migrationReceiptFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, permissionDiffFile)));
-    this.ajv.addSchema(readJsonObject(join3(this.schemasDir, runEventFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, localBindingsFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, templateProvenanceFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, initOperationFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationPlanFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationDecisionFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationReceiptFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, permissionDiffFile)));
+    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, runEventFile)));
     for (const [kind, definition] of Object.entries(RESOURCE_SCHEMA)) {
       const validator = this.ajv.getSchema(`https://schemas.kxm.dev/vnext/${definition.file}`);
       if (!validator) throw new Error(`schema did not compile: ${definition.file}`);
@@ -22057,7 +22074,7 @@ function containedHostPath(root, candidate) {
 function portableBindingIssue(root, pathHint, repositoryId) {
   let current = root;
   for (const segment of pathHint === "." ? [] : pathHint.split("/")) {
-    current = join3(current, segment);
+    current = join4(current, segment);
     if (!existsSync4(current)) break;
     const stat = lstatSync(current);
     if (stat.isSymbolicLink()) {
@@ -22116,20 +22133,20 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
     parent = dirname2(parent);
   }
   if (!stat.isFile()) fail2("path", "resource_not_file", label, "configuration resource must be a regular file");
-  const value = parseRestrictedYaml2(readFileSync3(file), label);
+  const value = parseRestrictedYaml2(readFileSync4(file), label);
   const issues = registry.validate(kind, value, label);
   if (issues.length > 0) throw new VnextConfigError(issues);
   return { kind, ...id === void 0 ? {} : { id }, file, logicalPath, value };
 }
 function readTemplateProvenance(registry, root) {
-  const file = join3(root, ".kxm", "template-provenance.yaml");
+  const file = join4(root, ".kxm", "template-provenance.yaml");
   if (!existsSync4(file)) return void 0;
   const label = ".kxm/template-provenance.yaml";
   const stat = lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     fail2("path", "resource_not_file", label, "template provenance must be a regular file, not a link or directory");
   }
-  const configRoot = join3(root, ".kxm");
+  const configRoot = join4(root, ".kxm");
   let parent = dirname2(file);
   while (parent !== root) {
     const parentStat = lstatSync(parent);
@@ -22139,7 +22156,7 @@ function readTemplateProvenance(registry, root) {
     if (parent === configRoot) break;
     parent = dirname2(parent);
   }
-  const value = parseRestrictedYaml2(readFileSync3(file), label);
+  const value = parseRestrictedYaml2(readFileSync4(file), label);
   const issues = registry.validateTemplateProvenance(value, label);
   if (issues.length > 0) throw new VnextConfigError(issues);
   if (!resolveVnextTemplateBaseline(value)) {
@@ -22179,27 +22196,27 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => compareCodeUnits3(left.name, right.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join3(directory, entry.name)), "nested resource directories are not allowed"));
+      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join4(directory, entry.name)), "nested resource directories are not allowed"));
       continue;
     }
     if (!entry.name.toLowerCase().endsWith(".yaml") && !entry.name.toLowerCase().endsWith(".yml")) continue;
     if (!entry.isFile() || extname(entry.name) !== ".yaml") {
-      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join3(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
+      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join4(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
       continue;
     }
-    const id = basename(entry.name, ".yaml");
+    const id = basename2(entry.name, ".yaml");
     if (kind === "model" && id === "inventory") continue;
     if (!resourceIdentifier(id)) {
-      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join3(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
+      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join4(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
       continue;
     }
     const collision = [...resources.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) {
-      issues.push(issue2("path", "resource_id_collision", displayPath(root, join3(directory, entry.name)), `${id} case-folds to existing ${collision}`));
+      issues.push(issue2("path", "resource_id_collision", displayPath(root, join4(directory, entry.name)), `${id} case-folds to existing ${collision}`));
       continue;
     }
     try {
-      const resource = readResource(registry, root, join3(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
+      const resource = readResource(registry, root, join4(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
       resources.set(id, resource);
     } catch (error) {
       if (error instanceof VnextConfigError) issues.push(...error.issues);
@@ -22520,8 +22537,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue2("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join47 = objectValue(step.join);
-    const minimumPassed = join47 && typeof join47.minimumPassed === "number" ? join47.minimumPassed : void 0;
+    const join48 = objectValue(step.join);
+    const minimumPassed = join48 && typeof join48.minimumPassed === "number" ? join48.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue2("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -22735,11 +22752,11 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (!workflows.has(defaultWorkflow)) issues.push(issue2("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
   if (projectRoot) {
-    const writerRolePath = join3(projectRoot, ".kxm", "roles", "writer.yaml");
+    const writerRolePath = join4(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
     if (existsSync4(writerRolePath) && implementerAgent) {
       try {
-        const rawRole = parseRestrictedYaml2(readFileSync3(writerRolePath, "utf8"));
+        const rawRole = parseRestrictedYaml2(readFileSync4(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
         const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
         const enabledRosterModels = rosterEntries.filter((entry) => entry.enabled !== false).map((entry) => stringValue(entry.model)).filter((m2) => Boolean(m2));
@@ -22799,7 +22816,7 @@ function discoverGitRoot(start = process.cwd()) {
 }
 function discoverVnextProjectRoot(start = process.cwd()) {
   const gitRoot = discoverGitRoot(start);
-  return gitRoot && existsSync4(join3(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
+  return gitRoot && existsSync4(join4(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
 }
 function assertNoRegisteredGates(options) {
   if ("registeredGates" in options) {
@@ -22816,7 +22833,7 @@ function loadVnextProject(projectRoot, options = {}) {
     migrationReceipt = receiptCheck.receipt;
   }
   const registry = new VnextSchemaRegistry(options.schemasDir);
-  const project = readResource(registry, root, join3(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
+  const project = readResource(registry, root, join4(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
   const earlyIssues = [];
   validatePortablePaths(project, earlyIssues);
   const templateProvenance = readTemplateProvenance(registry, root);
@@ -22838,15 +22855,15 @@ function loadVnextProject(projectRoot, options = {}) {
     }
   }
   if (earlyIssues.length > 0) throw new VnextConfigError(earlyIssues);
-  const agents = listNamedResources(registry, root, join3(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join3(root, ".kxm", "models"), ".kxm/models", "model");
-  const workflows = listNamedResources(registry, root, join3(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
-  const gatePath = join3(root, ".kxm", "gates.yaml");
+  const agents = listNamedResources(registry, root, join4(root, ".kxm", "agents"), ".kxm/agents", "agent");
+  const models = listNamedResources(registry, root, join4(root, ".kxm", "models"), ".kxm/models", "model");
+  const workflows = listNamedResources(registry, root, join4(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
+  const gatePath = join4(root, ".kxm", "gates.yaml");
   const gateRegistry = existsSync4(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
   const environments = [];
   const repositories = /* @__PURE__ */ new Map();
   const loadIssues = [];
-  const projectEnvironment = join3(root, ".kxm", "project", "env.yaml");
+  const projectEnvironment = join4(root, ".kxm", "project", "env.yaml");
   if (existsSync4(projectEnvironment)) {
     try {
       environments.push(readResource(registry, root, projectEnvironment, ".kxm/project/env.yaml", "environment"));
@@ -22912,7 +22929,7 @@ function loadVnextProject(projectRoot, options = {}) {
       continue;
     }
     seenBindings.set(foldedBinding, repositoryId);
-    const repositoryFile = join3(binding, ".kxm", "repo", "repo.yaml");
+    const repositoryFile = join4(binding, ".kxm", "repo", "repo.yaml");
     let definitionValidated = false;
     if (existsSync4(repositoryFile)) {
       try {
@@ -22930,7 +22947,7 @@ function loadVnextProject(projectRoot, options = {}) {
     } else if (required || hasLocalBinding) {
       loadIssues.push(issue2("discovery", "repository_definition_missing", `.kxm/repositories/${repositoryId}/repo.yaml`, `${hasLocalBinding ? "explicit" : "required"} repository ${repositoryId} has no repo.yaml`));
     }
-    const environmentFile = join3(binding, ".kxm", "repo", "env.yaml");
+    const environmentFile = join4(binding, ".kxm", "repo", "env.yaml");
     if (existsSync4(environmentFile)) {
       if (!definitionValidated) {
         loadIssues.push(issue2("reference", "repository_environment_without_definition", `.kxm/repositories/${repositoryId}/env.yaml`, `repository ${repositoryId} environment requires a validated matching repo.yaml`));
@@ -23009,20 +23026,20 @@ function legacyInputsAt(root) {
     ".kxm/config/workflows",
     ".kxm/state/kxm.db"
   ];
-  return candidates.filter((candidate) => existsSync4(join3(root, ...candidate.split("/"))));
+  return candidates.filter((candidate) => existsSync4(join4(root, ...candidate.split("/"))));
 }
 var VNEXT_MIGRATION_RECEIPT_PATH = ".kxm/migration-receipt.yaml";
 var LEGACY_CONFIG_FILES = [".kxm/config/agents.json", ".kxm/config/gates.json"];
 function legacyConfigFilesAt(root) {
   const files = [];
   for (const component of [".kxm", ".kxm/config"]) {
-    const absolute = join3(root, ...component.split("/"));
+    const absolute = join4(root, ...component.split("/"));
     if (existsSync4(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
   }
   for (const candidate of LEGACY_CONFIG_FILES) {
-    if (existsSync4(join3(root, ...candidate.split("/")))) files.push(candidate);
+    if (existsSync4(join4(root, ...candidate.split("/")))) files.push(candidate);
   }
-  const workflowsDir = join3(root, ".kxm", "config", "workflows");
+  const workflowsDir = join4(root, ".kxm", "config", "workflows");
   if (existsSync4(workflowsDir)) {
     const stat = lstatSync(workflowsDir);
     if (stat.isSymbolicLink()) {
@@ -23038,9 +23055,9 @@ function legacyConfigFilesAt(root) {
   return files;
 }
 function hashFileRecord(root, relativePath) {
-  const absolute = join3(root, ...relativePath.split("/"));
+  const absolute = join4(root, ...relativePath.split("/"));
   if (!existsSync4(absolute)) return void 0;
-  const bytes = readFileSync3(absolute);
+  const bytes = readFileSync4(absolute);
   return {
     path: relativePath,
     sha256: `sha256:${createHash6("sha256").update(bytes).digest("hex")}`,
@@ -23052,7 +23069,7 @@ function migrationReceiptSelfHash(receipt) {
   return `sha256:${createHash6("sha256").update(vnextCanonicalJson(unsigned), "utf8").digest("hex")}`;
 }
 function readVnextMigrationReceipt(root, options = {}) {
-  const receiptPath = join3(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  const receiptPath = join4(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
   const legacyFiles = legacyConfigFilesAt(root);
   if (!existsSync4(receiptPath)) {
     return {
@@ -23065,7 +23082,7 @@ function readVnextMigrationReceipt(root, options = {}) {
   }
   let receipt;
   try {
-    receipt = parseRestrictedYaml2(readFileSync3(receiptPath), VNEXT_MIGRATION_RECEIPT_PATH);
+    receipt = parseRestrictedYaml2(readFileSync4(receiptPath), VNEXT_MIGRATION_RECEIPT_PATH);
   } catch (error) {
     if (error instanceof VnextConfigError) return { issues: [...error.issues] };
     throw error;
@@ -23126,7 +23143,7 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
   }
   const gitRoot = discoverGitRoot(inspectedFrom);
   const candidateRoot = gitRoot ?? inspectedFrom;
-  if (existsSync4(join3(candidateRoot, ".kxm"))) {
+  if (existsSync4(join4(candidateRoot, ".kxm"))) {
     return {
       mode: "repair",
       inspectedFrom,
@@ -23142,14 +23159,14 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join9, resolve as resolve7 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join10, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // plugins/kxm/src/vnext-runtime-store.ts
 import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync6, realpathSync as realpathSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join6, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, realpathSync as realpathSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5, join as join7, resolve as resolve5 } from "node:path";
 
 // plugins/kxm/src/vnext-bindings.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -23162,7 +23179,7 @@ import {
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync3,
   openSync,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   realpathSync as realpathSync2,
   renameSync,
   rmSync,
@@ -23210,7 +23227,7 @@ var DatabaseSync = class {
 };
 
 // plugins/kxm/src/vnext-bindings.ts
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, parse, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, parse, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
 var activeLocks = /* @__PURE__ */ new WeakSet();
@@ -23244,12 +23261,12 @@ function vnextUserStateRoot(options = {}) {
   }
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join4(home, "AppData", "Local");
+    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join5(home, "AppData", "Local");
     return resolve3(base2, "KXM");
   }
   if (platform === "darwin") return resolve3(home, "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join4(home, ".local", "state");
+  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join5(home, ".local", "state");
   return resolve3(base, "kxm");
 }
 function projectBindingKey(projectRoot, platform = process.platform) {
@@ -23259,7 +23276,7 @@ function projectBindingKey(projectRoot, platform = process.platform) {
 }
 function vnextLocalBindingFile(projectRoot, options = {}) {
   const stateRoot = vnextUserStateRoot(options);
-  return join4(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
+  return join5(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
 }
 function checkedDirectory(path4, description) {
   if (!existsSync5(path4)) return false;
@@ -23270,7 +23287,7 @@ function checkedDirectory(path4, description) {
   return true;
 }
 function existingBindingDirectory(file, stateRoot) {
-  const projects = join4(stateRoot, "projects");
+  const projects = join5(stateRoot, "projects");
   const project = dirname3(file);
   if (!checkedDirectory(stateRoot, "local state root")) return false;
   if (!checkedDirectory(projects, "local projects directory")) return false;
@@ -23305,7 +23322,7 @@ function readVnextLocalBindings(projectRoot, options = {}) {
   if (stat.size > MAX_BINDING_RECORD_BYTES) {
     bindingError("parse", "local_binding_file_too_large", `binding record exceeds ${MAX_BINDING_RECORD_BYTES} bytes`);
   }
-  const parsed = parseRestrictedYaml2(readFileSync4(file), BINDING_LABEL);
+  const parsed = parseRestrictedYaml2(readFileSync5(file), BINDING_LABEL);
   return asRecord2(parsed, file, root, options.schemasDir);
 }
 function normalizedRecord(projectRoot, projectId, repositories, schemasDir) {
@@ -23373,7 +23390,7 @@ function ensureBindingDirectory(file, stateRoot) {
   ensureDurableDirectory(stateRoot, "local state root");
   checkedDirectory(stateRoot, "local state root");
   syncDirectory(stateRoot);
-  const projects = join4(stateRoot, "projects");
+  const projects = join5(stateRoot, "projects");
   createDirectoryIfMissing(projects);
   checkedDirectory(projects, "local projects directory");
   const project = dirname3(file);
@@ -23386,7 +23403,7 @@ function assertNoLinkedDirectoryComponents(path4, description) {
   let current = filesystemRoot;
   const remainder = relative2(filesystemRoot, absolute);
   for (const segment of remainder.split(sep2).filter(Boolean)) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     const stat = lstatSync2(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", `${description} contains a linked or non-directory component`);
@@ -23413,7 +23430,7 @@ function projectOperationLockFile(projectRoot) {
   if (gitStat.isSymbolicLink() || !gitStat.isDirectory()) {
     bindingError("path", "project_operation_lock_parent_invalid", "authoritative Git metadata must resolve to a regular directory");
   }
-  const lockDirectory = join4(gitDirectory, "kxm");
+  const lockDirectory = join5(gitDirectory, "kxm");
   if (existsSync5(lockDirectory)) {
     const stat = lstatSync2(lockDirectory);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
@@ -23423,7 +23440,7 @@ function projectOperationLockFile(projectRoot) {
     mkdirSync3(lockDirectory, { mode: 448 });
     syncDirectory(gitDirectory);
   }
-  return join4(lockDirectory, "project-operation-lock.sqlite");
+  return join5(lockDirectory, "project-operation-lock.sqlite");
 }
 function withVnextLocalBindingLock(projectRoot, options, callback) {
   const root = resolve3(projectRoot);
@@ -23482,7 +23499,7 @@ function writeVnextLocalBindings(projectRoot, projectId, repositories, options =
   const { file, record } = planned;
   if (!planned.written) return planned;
   ensureBindingDirectory(file, vnextUserStateRoot(options));
-  const temporary = join4(dirname3(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
+  const temporary = join5(dirname3(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
   let descriptor;
   try {
     descriptor = openSync(temporary, "wx", 384);
@@ -23513,11 +23530,11 @@ import {
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { basename as basename2, dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+import { basename as basename3, dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new VnextConfigError([issue3]);
@@ -23666,7 +23683,7 @@ function checkIntegrity(database) {
   return rows.length === 1 && rows[0]?.integrity_check === "ok";
 }
 function fileSha256(filePath) {
-  const bytes = readFileSync5(filePath);
+  const bytes = readFileSync6(filePath);
   return `sha256:${createHash8("sha256").update(bytes).digest("hex")}`;
 }
 function backupDatabaseFile(sourcePath, targetPath, storeId) {
@@ -23713,7 +23730,7 @@ function backupDatabaseFile(sourcePath, targetPath, storeId) {
   return {
     storeId,
     sourcePath: resolvedSource,
-    backupFile: basename2(resolvedTarget),
+    backupFile: basename3(resolvedTarget),
     schemaVersion,
     sha256,
     bytes,
@@ -23779,7 +23796,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   return {
     storeId,
     sourcePath: resolvedTarget,
-    backupFile: basename2(resolvedBackup),
+    backupFile: basename3(resolvedBackup),
     schemaVersion,
     integrity: "ok"
   };
@@ -23787,19 +23804,19 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
 function discoverProjectStores(projectRoot, options = {}) {
   const root = resolve4(projectRoot);
   const stores = [];
-  const hubPath = options.hubDataPath ? resolve4(options.hubDataPath) : join5(root, ".kxm", "state", "kxm.db");
+  const hubPath = options.hubDataPath ? resolve4(options.hubDataPath) : join6(root, ".kxm", "state", "kxm.db");
   if (existsSync6(hubPath)) {
     stores.push({ storeId: "hub-store", sourcePath: hubPath, maxSupportedVersion: 3 });
   }
-  const registryPath = join5(root, ".kxm", "runtime", "registry.db");
+  const registryPath = join6(root, ".kxm", "runtime", "registry.db");
   if (existsSync6(registryPath)) {
     stores.push({ storeId: "registry", sourcePath: registryPath, maxSupportedVersion: 1 });
   }
-  const bindingsPath = join5(root, ".kxm", "runtime", "bindings.db");
+  const bindingsPath = join6(root, ".kxm", "runtime", "bindings.db");
   if (existsSync6(bindingsPath)) {
     stores.push({ storeId: "binding-store", sourcePath: bindingsPath, maxSupportedVersion: 1 });
   }
-  const eventsDir = join5(root, ".kxm", "runtime", "events");
+  const eventsDir = join6(root, ".kxm", "runtime", "events");
   if (existsSync6(eventsDir)) {
     const entries = readdirSync2(eventsDir, { withFileTypes: true });
     for (const entry of entries) {
@@ -23807,7 +23824,7 @@ function discoverProjectStores(projectRoot, options = {}) {
         const key = entry.name.replace(/\.db$/, "");
         stores.push({
           storeId: `events:${key}`,
-          sourcePath: join5(eventsDir, entry.name),
+          sourcePath: join6(eventsDir, entry.name),
           maxSupportedVersion: 3
         });
       }
@@ -23826,20 +23843,20 @@ function createBackup(options = {}) {
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-");
   const backupId = `bk_${randomBytes(8).toString("hex")}`;
-  const outDir = options.outDir ? resolve4(options.outDir) : join5(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
+  const outDir = options.outDir ? resolve4(options.outDir) : join6(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
   if (!existsSync6(outDir)) {
     mkdirSync4(outDir, { recursive: true, mode: 448 });
   }
   const backedUpStores = [];
   const usedFilenames = /* @__PURE__ */ new Set();
   for (const store of stores) {
-    let filename = basename2(store.sourcePath);
+    let filename = basename3(store.sourcePath);
     if (usedFilenames.has(filename)) {
       const sanitizedId = store.storeId.replace(/[^a-zA-Z0-9_.-]/g, "_");
       filename = `${sanitizedId}-${filename}`;
     }
     usedFilenames.add(filename);
-    const targetFile2 = join5(outDir, filename);
+    const targetFile2 = join6(outDir, filename);
     const record = backupDatabaseFile(store.sourcePath, targetFile2, store.storeId);
     backedUpStores.push(record);
   }
@@ -23854,7 +23871,7 @@ function createBackup(options = {}) {
   const manifestSha256 = `sha256:${createHash8("sha256").update(manifestJson, "utf8").digest("hex")}`;
   manifest.manifestSha256 = manifestSha256;
   const finalJson = JSON.stringify(manifest, null, 2) + "\n";
-  const manifestPath = join5(outDir, "manifest.json");
+  const manifestPath = join6(outDir, "manifest.json");
   writeFileSync4(manifestPath, finalJson, "utf8");
   return { manifest, outDir };
 }
@@ -23865,13 +23882,13 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     throw databaseError("runtime_path_invalid", manifestPath, `manifest path ${manifestPath} does not exist`);
   }
   if (stat.isDirectory()) {
-    manifestPath = join5(manifestPath, "manifest.json");
+    manifestPath = join6(manifestPath, "manifest.json");
   }
   if (!existsSync6(manifestPath)) {
     throw databaseError("runtime_path_invalid", manifestPath, `backup manifest ${manifestPath} not found`);
   }
   const manifestDir = dirname4(manifestPath);
-  const rawText = readFileSync5(manifestPath, "utf8");
+  const rawText = readFileSync6(manifestPath, "utf8");
   let manifest;
   try {
     manifest = JSON.parse(rawText);
@@ -23883,7 +23900,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   }
   const restoredStores = [];
   for (const store of manifest.stores) {
-    const backupFilePath = join5(manifestDir, store.backupFile);
+    const backupFilePath = join6(manifestDir, store.backupFile);
     if (!existsSync6(backupFilePath)) {
       throw databaseError("restore_file_missing", backupFilePath, `backup file ${store.backupFile} missing from ${manifestDir}`);
     }
@@ -23902,7 +23919,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
       const rel = targetPath.slice(manifest.projectRoot.length).replace(/^[\\/]+/, "");
-      targetPath = join5(resolve4(options.projectRoot), rel);
+      targetPath = join6(resolve4(options.projectRoot), rel);
     }
     const result = restoreDatabaseFile(
       backupFilePath,
@@ -23923,12 +23940,12 @@ function restoreBackup(manifestPathOrDir, options = {}) {
 // plugins/kxm/src/vnext-runtime-store.ts
 function vnextRuntimePaths(options = {}) {
   const stateRoot = options.stateRoot ? resolve5(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
-  const runtimeDir = join6(stateRoot, "runtime");
+  const runtimeDir = join7(stateRoot, "runtime");
   return {
     stateRoot,
     runtimeDir,
-    registryDb: join6(runtimeDir, "registry.db"),
-    projectsDir: join6(runtimeDir, "projects")
+    registryDb: join7(runtimeDir, "registry.db"),
+    projectsDir: join7(runtimeDir, "projects")
   };
 }
 function runtimeIssue(phase, code, file, message) {
@@ -24287,7 +24304,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join47 = compileJoin(step, id, sink);
+  const join48 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits4);
@@ -24315,7 +24332,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join47
+    join: join48
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -24365,15 +24382,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join47 = objectValue2(step.join);
-  if (!join47) return { strategy: "all" };
-  const declared = stringValue2(join47.strategy);
+  const join48 = objectValue2(step.join);
+  if (!join48) return { strategy: "all" };
+  const declared = stringValue2(join48.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join47.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join48.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join47.cancelRemaining === "boolean" ? { cancelRemaining: join47.cancelRemaining } : {}
+    ...typeof join48.cancelRemaining === "boolean" ? { cancelRemaining: join48.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -24653,8 +24670,8 @@ var RECORD_LIMIT = 16 * 1024 * 1024;
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync7, statSync } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync8, statSync } from "node:fs";
+import { join as join8 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
 var PRICES_SCHEMA = "kxm.prices.v1";
@@ -24806,11 +24823,11 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync8(join7(rootOrPath, ".kxm", "prices.yaml")) ? join7(rootOrPath, ".kxm", "prices.yaml") : existsSync8(join7(rootOrPath, "prices.yaml")) ? join7(rootOrPath, "prices.yaml") : existsSync8(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  const candidatePath = existsSync8(join8(rootOrPath, ".kxm", "prices.yaml")) ? join8(rootOrPath, ".kxm", "prices.yaml") : existsSync8(join8(rootOrPath, "prices.yaml")) ? join8(rootOrPath, "prices.yaml") : existsSync8(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
   if (!candidatePath || !existsSync8(candidatePath)) {
     return void 0;
   }
-  const content = readFileSync7(candidatePath, "utf8");
+  const content = readFileSync8(candidatePath, "utf8");
   return parsePriceCatalog(content);
 }
 function loadPriceCatalogForEstimate(options) {
@@ -24831,13 +24848,13 @@ var import_yaml5 = __toESM(require_dist(), 1);
 
 // plugins/kxm/src/producers.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { existsSync as existsSync9, readFileSync as readFileSync8, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync3 } from "node:fs";
+import { join as join9 } from "node:path";
 var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
 function loadProducerPolicy(root) {
-  const path4 = join8(root, ".kxm", "producers.yaml");
+  const path4 = join9(root, ".kxm", "producers.yaml");
   if (!existsSync9(path4)) return empty();
-  const value = (0, import_yaml4.parse)(readFileSync8(path4, "utf8"));
+  const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
   if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
   return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x2) => typeof x2 === "string"), demoted: value.demoted.filter((x2) => typeof x2 === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x2) => typeof x2 === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
 }
@@ -24847,8 +24864,8 @@ function updateProducer(root, model, status) {
   policy.demoted = policy.demoted.filter((x2) => x2 !== model);
   policy[status].push(model);
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join8(root, ".kxm"), { recursive: true });
-  writeFileSync6(join8(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync6(join9(root, ".kxm"), { recursive: true });
+  writeFileSync6(join9(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function setModelState(root, model, state, role, removeRole2 = false) {
@@ -24858,10 +24875,10 @@ function setModelState(root, model, state, role, removeRole2 = false) {
   policy[state].push(model);
   if (role) {
     if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
-    const rolePath = join8(root, ".kxm", "roles", `${role}.yaml`);
+    const rolePath = join9(root, ".kxm", "roles", `${role}.yaml`);
     let roleFile = {};
     if (existsSync9(rolePath)) {
-      const parsed = (0, import_yaml4.parse)(readFileSync8(rolePath, "utf8"));
+      const parsed = (0, import_yaml4.parse)(readFileSync9(rolePath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed;
     }
     const roster = Array.isArray(roleFile.roster) ? roleFile.roster.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
@@ -24872,29 +24889,29 @@ function setModelState(root, model, state, role, removeRole2 = false) {
     roleFile.schema ??= "kxm.role.v1";
     roleFile.id ??= role;
     roleFile.roster = roster;
-    mkdirSync6(join8(root, ".kxm", "roles"), { recursive: true });
+    mkdirSync6(join9(root, ".kxm", "roles"), { recursive: true });
     writeFileSync6(rolePath, (0, import_yaml4.stringify)(roleFile), "utf8");
   }
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join8(root, ".kxm"), { recursive: true });
-  writeFileSync6(join8(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync6(join9(root, ".kxm"), { recursive: true });
+  writeFileSync6(join9(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function listRoleBindings(root) {
-  const dir = join8(root, ".kxm", "roles");
+  const dir = join9(root, ".kxm", "roles");
   const result = {};
   if (!existsSync9(dir)) return result;
   for (const file of readdirSync3(dir).filter((name) => name.endsWith(".yaml"))) {
     const role = file.slice(0, -5);
-    const value = (0, import_yaml4.parse)(readFileSync8(join8(dir, file), "utf8"));
+    const value = (0, import_yaml4.parse)(readFileSync9(join9(dir, file), "utf8"));
     result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model) => typeof model === "string");
   }
   return result;
 }
 function listInventoryModels(root) {
-  const path4 = join8(root, ".kxm", "models", "inventory.yaml");
+  const path4 = join9(root, ".kxm", "models", "inventory.yaml");
   if (!existsSync9(path4)) return [];
-  const value = (0, import_yaml4.parse)(readFileSync8(path4, "utf8"));
+  const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
   return (value.models ?? []).map((m2) => m2.id).filter((id) => typeof id === "string");
 }
 
@@ -25528,7 +25545,7 @@ function formatRoutingReport(report2, options = {}) {
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 var repoRoot = resolve7(fileURLToPath2(new URL("../../../", import.meta.url)));
 function vnextSupervisorTokenFile(paths) {
-  return join9(paths.runtimeDir, "supervisor.token");
+  return join10(paths.runtimeDir, "supervisor.token");
 }
 function readVnextSupervisorToken(paths) {
   const file = vnextSupervisorTokenFile(paths);
@@ -25537,7 +25554,7 @@ function readVnextSupervisorToken(paths) {
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw runtimeError("runtime_path_invalid", file, "supervisor token file must be a regular file, not a link");
   }
-  const token = readFileSync9(file, "utf8").trim();
+  const token = readFileSync10(file, "utf8").trim();
   return token.length >= 32 ? token : void 0;
 }
 function processAlive(pid) {
@@ -25551,7 +25568,7 @@ function processAlive(pid) {
 var HEARTBEAT_STALE_MS = 15e3;
 var SUPERVISOR_ERROR_MAX_AGE_MS = 3e4;
 function supervisorErrorFile(paths) {
-  return join9(paths.runtimeDir, "supervisor.error");
+  return join10(paths.runtimeDir, "supervisor.error");
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
@@ -25564,7 +25581,7 @@ function readRecentSupervisorError(paths) {
   const ageMs = Date.now() - stat.mtimeMs;
   if (ageMs > SUPERVISOR_ERROR_MAX_AGE_MS) return void 0;
   try {
-    return readFileSync9(file, "utf8").trim();
+    return readFileSync10(file, "utf8").trim();
   } catch {
     return void 0;
   }
@@ -25631,7 +25648,7 @@ async function ensureVnextSupervisor(options = {}) {
     throw runtimeError("runtime_supervisor_unreachable", paths.registryDb, `runtime supervisor pid ${status.pid} is registered as running but cannot be probed`);
   }
   clearSupervisorError(paths);
-  const scriptPath = join9(repoRoot, "scripts", "kxm-runtime-supervisor.mjs");
+  const scriptPath = join10(repoRoot, "scripts", "kxm-runtime-supervisor.mjs");
   const spawnImpl = options.spawnImpl ?? ((script, env) => {
     const child = spawn2(process.execPath, [script], {
       detached: true,
@@ -25684,12 +25701,13 @@ async function vnextRuntimeRequest(handle, method, path4, body) {
 
 // plugins/kxm/src/cli/types.ts
 import { spawn as spawn3 } from "node:child_process";
-import { join as join12, resolve as resolve9 } from "node:path";
+import { join as join13, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
   /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bsk-ant-[A-Za-z0-9_-]{8,}\b/g,
   /\bghp_[A-Za-z0-9_]{20,}\b/g,
   /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
   /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi,
@@ -25697,9 +25715,9 @@ var SECRET_PATTERNS = [
   /\bya29\.[A-Za-z0-9._~+/-]+=*/g,
   /\b1\/\/[A-Za-z0-9_-]+/g,
   /\b1\/[A-Za-z0-9_-]{20,}/g,
-  /("?(?:access_token|refresh_token|id_token)"?\s*[:=]\s*")[^"]*(")/gi,
+  /("?(?:access_token|refresh_token|id_token|sessionKey|session_key|claude_oauth_token|anthropicApiKey)"?\s*[:=]\s*")[^"]*(")/gi,
   /\bKXM_[A-Z0-9_]*(TOKEN|SECRET|KEY)[A-Z0-9_]*=\S+/gi,
-  /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET)=\S+/gi,
+  /\b(GITHUB_TOKEN|GH_TOKEN|KXM_AUTH_TOKEN|KXM_WORKFLOW_SIGNAL_SECRET|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CLAUDE_API_KEY)=\S+/gi,
   /\b[A-Fa-f0-9]{64}\b/g
 ];
 function redactSecrets(value) {
@@ -25714,8 +25732,8 @@ function redactStringList(values, maxItems = 32) {
 }
 
 // plugins/kxm/src/telemetry.ts
-import { appendFileSync, mkdirSync as mkdirSync8, readFileSync as readFileSync10 } from "node:fs";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { appendFileSync, mkdirSync as mkdirSync8, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname7, join as join11 } from "node:path";
 var TELEMETRY_SCHEMA = "kxm.telemetry.v1";
 function inferImprovementTarget(input) {
   const explicit = input.env?.KXM_IMPROVE_TARGET?.trim();
@@ -25730,7 +25748,7 @@ function appendTelemetry(path4, event) {
 `, { encoding: "utf8", mode: 384 });
 }
 function telemetryPath(logsDir) {
-  return join10(logsDir, "telemetry.jsonl");
+  return join11(logsDir, "telemetry.jsonl");
 }
 function makeTelemetryEvent(input) {
   return {
@@ -25745,7 +25763,7 @@ function makeTelemetryEvent(input) {
 function readRoutingRecords(path4) {
   const records = [];
   try {
-    const raw = readFileSync10(path4, "utf8");
+    const raw = readFileSync11(path4, "utf8");
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim()) continue;
       try {
@@ -25822,9 +25840,9 @@ function workerResult(worker, payload) {
 }
 
 // plugins/kxm/src/hub-binding.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync11, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute5, join as join11, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12, resolve as resolve8 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
 var HubBindingError = class extends Error {
@@ -25841,16 +25859,16 @@ function resolveUserStateRoot(env) {
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join11(homedir3(), "AppData", "Local");
+    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join12(homedir3(), "AppData", "Local");
     return resolve8(base2, "KXM");
   }
   if (process.platform === "darwin") return resolve8(homedir3(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join11(homedir3(), ".local", "state");
+  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join12(homedir3(), ".local", "state");
   return resolve8(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
-  return join11(resolveUserStateRoot(env), "hub-binding.json");
+  return join12(resolveUserStateRoot(env), "hub-binding.json");
 }
 function validateHubUrl(raw) {
   let parsed;
@@ -25878,7 +25896,7 @@ function readHubBinding(env = process.env) {
   if (!existsSync11(file)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(file, "utf8"));
+    parsed = JSON.parse(readFileSync12(file, "utf8"));
   } catch {
     throw new HubBindingError(`malformed hub binding at ${file}`);
   }
@@ -25901,7 +25919,7 @@ function readHubBinding(env = process.env) {
 function writeHubBinding(record, env = process.env) {
   const file = hubBindingFile(env);
   mkdirSync9(dirname8(file), { recursive: true, mode: 448 });
-  const temporary = join11(dirname8(file), `.hub-binding-${process.pid}.tmp`);
+  const temporary = join12(dirname8(file), `.hub-binding-${process.pid}.tmp`);
   try {
     writeFileSync8(temporary, `${JSON.stringify(record, null, 2)}
 `, { encoding: "utf8", mode: 384 });
@@ -25949,7 +25967,7 @@ async function probeHubHealth(url, fetchImpl, timeoutMs = HUB_HEALTH_PROBE_MS) {
 var repoRoot2 = resolve9(fileURLToPath3(new URL("../../../../", import.meta.url)));
 function spawnScript(scriptName, extraEnv = {}) {
   return new Promise((resolveExit) => {
-    const child = spawn3(process.execPath, [join12(repoRoot2, "scripts", scriptName)], {
+    const child = spawn3(process.execPath, [join13(repoRoot2, "scripts", scriptName)], {
       stdio: "inherit",
       env: { ...process.env, ...extraEnv }
     });
@@ -26039,10 +26057,10 @@ function workspaceDirs(cwd, workspaceFlag, env) {
   return {
     workdir,
     workspace,
-    config: derive ? join12(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join12(workspace, "config")),
-    logs: derive ? join12(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join12(workspace, "logs")),
-    assets: derive ? join12(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join12(workspace, "assets")),
-    state: derive ? join12(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join12(workspace, "state"))
+    config: derive ? join13(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join13(workspace, "config")),
+    logs: derive ? join13(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join13(workspace, "logs")),
+    assets: derive ? join13(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join13(workspace, "assets")),
+    state: derive ? join13(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join13(workspace, "state"))
   };
 }
 function maskEnvName(name) {
@@ -26110,20 +26128,20 @@ function workspaceEnv(runtime) {
 // plugins/kxm/src/cli/roles.ts
 var import_yaml8 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
-import { join as join15, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
+import { join as join16, resolve as resolve12 } from "node:path";
 import { createInterface } from "node:readline";
 
 // plugins/kxm/src/role.ts
 var import_yaml7 = __toESM(require_dist(), 1);
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readdirSync as readdirSync4, readFileSync as readFileSync13, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, readdirSync as readdirSync4, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // plugins/kxm/src/config.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname9, join as join13, resolve as resolve10 } from "node:path";
+import { dirname as dirname9, join as join14, resolve as resolve10 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
 var DEFAULT_KXM_CONFIG = {
   schema: KXM_CONFIG_SCHEMA,
@@ -26144,6 +26162,9 @@ var DEFAULT_KXM_CONFIG = {
   sync: {
     defaultTracker: "none"
   },
+  hub: {
+    autoStart: "background"
+  },
   improvement: {
     promotionPolicy: "manual_pr",
     telemetryHalfLifeDays: 14,
@@ -26174,7 +26195,7 @@ var DEFAULT_KXM_CONFIG = {
 };
 function userConfigDirectory(overrideDir) {
   if (overrideDir) return resolve10(overrideDir);
-  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join13(homedir4(), ".config", "kxm"));
+  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join14(homedir4(), ".config", "kxm"));
 }
 function repoConfigDirectory(repoRoot6) {
   return resolve10(repoRoot6, ".kxm");
@@ -26191,16 +26212,20 @@ function deepMerge(target, source) {
   }
   return result;
 }
+function normalizeHubConfig(raw) {
+  const autoStart = raw?.autoStart;
+  return { autoStart: autoStart === "off" || autoStart === "background" ? autoStart : DEFAULT_KXM_CONFIG.hub.autoStart };
+}
 function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
   const userDir = userConfigDirectory(options.userConfigDir);
-  const userConfigFile = join13(userDir, "config.yaml");
+  const userConfigFile = join14(userDir, "config.yaml");
   const repoDir = repoConfigDirectory(repoRoot6);
-  const repoConfigFile = join13(repoDir, "config.yaml");
+  const repoConfigFile = join14(repoDir, "config.yaml");
   let userRaw = {};
   let userLoadedPath;
   if (existsSync12(userConfigFile)) {
     try {
-      const text = readFileSync12(userConfigFile, "utf8");
+      const text = readFileSync13(userConfigFile, "utf8");
       userRaw = (0, import_yaml6.parse)(text) ?? {};
       userLoadedPath = userConfigFile;
     } catch (error) {
@@ -26211,7 +26236,7 @@ function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
   let repoLoadedPath;
   if (existsSync12(repoConfigFile)) {
     try {
-      const text = readFileSync12(repoConfigFile, "utf8");
+      const text = readFileSync13(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml6.parse)(text) ?? {};
       repoLoadedPath = repoConfigFile;
     } catch (error) {
@@ -26227,6 +26252,7 @@ function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
     defaults: mergedAll.defaults ?? {},
     dash: mergedAll.dash ?? {},
     sync: mergedAll.sync ?? {},
+    hub: normalizeHubConfig(mergedAll.hub),
     improvement: mergedAll.improvement ?? DEFAULT_KXM_CONFIG.improvement,
     routing: mergedAll.routing ?? DEFAULT_KXM_CONFIG.routing,
     telemetry: mergedAll.telemetry ?? DEFAULT_KXM_CONFIG.telemetry,
@@ -26247,12 +26273,12 @@ function getKxmConfigValue(config, keyPath) {
 }
 function setKxmConfigValue(repoRoot6, keyPath, value, options = {}) {
   const scope = options.scope ?? "project";
-  const targetFile2 = scope === "user" ? join13(userConfigDirectory(options.userConfigDir), "config.yaml") : join13(repoConfigDirectory(repoRoot6), "config.yaml");
+  const targetFile2 = scope === "user" ? join14(userConfigDirectory(options.userConfigDir), "config.yaml") : join14(repoConfigDirectory(repoRoot6), "config.yaml");
   mkdirSync10(dirname9(targetFile2), { recursive: true });
   let existing = {};
   if (existsSync12(targetFile2)) {
     try {
-      existing = (0, import_yaml6.parse)(readFileSync12(targetFile2, "utf8")) ?? {};
+      existing = (0, import_yaml6.parse)(readFileSync13(targetFile2, "utf8")) ?? {};
     } catch {
       existing = {};
     }
@@ -26363,9 +26389,9 @@ var DEFAULT_ROLES = {
 };
 function rolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join14(userConfigDirectory(userConfigDir), "roles");
+    return join15(userConfigDirectory(userConfigDir), "roles");
   }
-  return join14(repoConfigDirectory(repoRoot6), "roles");
+  return join15(repoConfigDirectory(repoRoot6), "roles");
 }
 function ensureRolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
   const dir = rolesDirectory(scope, repoRoot6, userConfigDir);
@@ -26377,7 +26403,7 @@ function ensureRolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
 function parseRoleFile(filePath) {
   if (!existsSync13(filePath)) return void 0;
   try {
-    const raw = readFileSync13(filePath, "utf8");
+    const raw = readFileSync14(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
     if (!parsed || typeof parsed !== "object" || parsed.schema !== KXM_ROLE_SCHEMA) {
       return void 0;
@@ -26407,7 +26433,7 @@ function listRoles(options = {}) {
   if (scopeFilter !== "global" && existsSync13(localDir)) {
     for (const entry of readdirSync4(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join14(localDir, entry);
+        const filePath = join15(localDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           localRoles.set(parsed.id, { role: parsed, filePath });
@@ -26419,7 +26445,7 @@ function listRoles(options = {}) {
   if (scopeFilter !== "local" && existsSync13(globalDir)) {
     for (const entry of readdirSync4(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join14(globalDir, entry);
+        const filePath = join15(globalDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           globalRoles.set(parsed.id, { role: parsed, filePath });
@@ -26467,13 +26493,13 @@ function getRole(roleId, options = {}) {
   const repoRoot6 = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
     const localDir = rolesDirectory("local", repoRoot6, options.userConfigDir);
-    const localFile = join14(localDir, `${roleId}.yaml`);
+    const localFile = join15(localDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(localFile);
     if (parsed) return { role: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
     const globalDir = rolesDirectory("global", repoRoot6, options.userConfigDir);
-    const globalFile = join14(globalDir, `${roleId}.yaml`);
+    const globalFile = join15(globalDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(globalFile);
     if (parsed) return { role: parsed, scope: "global", filePath: globalFile };
   }
@@ -26483,7 +26509,7 @@ function addRole(role, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot6 = options.repoRoot ?? process.cwd();
   const dir = ensureRolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join14(dir, `${role.id}.yaml`);
+  const filePath = join15(dir, `${role.id}.yaml`);
   if (existsSync13(filePath) && !options.overwrite) {
     throw new Error(`role_already_exists: role '${role.id}' already exists at ${filePath}`);
   }
@@ -26494,7 +26520,7 @@ function removeRole(roleId, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot6 = options.repoRoot ?? process.cwd();
   const dir = rolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join14(dir, `${roleId}.yaml`);
+  const filePath = join15(dir, `${roleId}.yaml`);
   if (!existsSync13(filePath)) {
     throw new Error(`role_not_found: role '${roleId}' not found in ${scope} directory (${filePath})`);
   }
@@ -26516,7 +26542,7 @@ function modifyRole(roleId, updates, options = {}) {
   const scope = options.scope ?? target.scope;
   const repoRoot6 = options.repoRoot ?? process.cwd();
   const dir = ensureRolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join14(dir, `${roleId}.yaml`);
+  const filePath = join15(dir, `${roleId}.yaml`);
   writeFileSync10(filePath, (0, import_yaml7.stringify)(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
@@ -26565,9 +26591,9 @@ var DEFAULT_ROLE_SEATS = {
 };
 function findExistingRoleHostsFile(scope, repoRoot6 = process.cwd(), userConfigDir) {
   const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot6);
-  const yamlPath = join14(dir, "role-hosts.yaml");
-  const ymlPath = join14(dir, "role-hosts.yml");
-  const jsonPath = join14(dir, "role-hosts.json");
+  const yamlPath = join15(dir, "role-hosts.yaml");
+  const ymlPath = join15(dir, "role-hosts.yml");
+  const jsonPath = join15(dir, "role-hosts.json");
   if (existsSync13(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
   if (existsSync13(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
   if (existsSync13(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
@@ -26576,7 +26602,7 @@ function findExistingRoleHostsFile(scope, repoRoot6 = process.cwd(), userConfigD
 function parseRoleHostsFile(filePath) {
   if (!existsSync13(filePath)) return void 0;
   try {
-    const raw = readFileSync13(filePath, "utf8");
+    const raw = readFileSync14(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     if (parsed.schema && parsed.schema !== KXM_ROLE_HOSTS_SCHEMA) return void 0;
@@ -26652,7 +26678,7 @@ function saveRoleHostsConfig(config, options = {}) {
     mkdirSync11(dir, { recursive: true });
   }
   const format = options.format ?? "yaml";
-  const filePath = join14(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  const filePath = join15(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
   const payload = {
     schema: KXM_ROLE_HOSTS_SCHEMA,
     seats: config.seats ?? {},
@@ -26894,7 +26920,7 @@ async function cmdRoleAdd(runtime, roleId, options) {
   let roleDef;
   if (options.file) {
     const filePath = resolve12(runtime.cwd, options.file);
-    const content = readFileSync14(filePath, "utf8");
+    const content = readFileSync15(filePath, "utf8");
     roleDef = (0, import_yaml8.parse)(content);
     roleDef.id = roleId;
   } else {
@@ -27193,7 +27219,7 @@ async function cmdRoleResume(runtime, runId, ruling) {
       return 1;
     }
   }
-  const dbPath = join15(runtime.cwd, ".kxm", "state", "kxm.db");
+  const dbPath = join16(runtime.cwd, ".kxm", "state", "kxm.db");
   if (existsSync14(dbPath)) {
     try {
       const database = new DatabaseSync(dbPath);
@@ -27256,8 +27282,8 @@ async function cmdRoleResume(runtime, runId, ruling) {
 
 // plugins/kxm/src/cli/workflows.ts
 import { createHmac as createHmac3, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
-import { join as join17, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync17 } from "node:fs";
+import { join as join18, resolve as resolve15 } from "node:path";
 
 // plugins/kxm/src/retrospective.ts
 import { mkdirSync as mkdirSync12, renameSync as renameSync4, writeFileSync as writeFileSync11 } from "node:fs";
@@ -27675,8 +27701,8 @@ async function watchGithubChecks(input) {
 
 // plugins/kxm/src/workflow-manager.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync15, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join17 } from "node:path";
 var WORKFLOW_TEMPLATES = {
   "implement-and-verify": {
     schema: "kxm.workflow.v1",
@@ -27827,9 +27853,9 @@ var WORKFLOW_TEMPLATES = {
 var DEFAULT_WORKFLOW_TEMPLATE = WORKFLOW_TEMPLATES["implement-and-verify"];
 function workflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join16(userConfigDirectory(userConfigDir), "workflows");
+    return join17(userConfigDirectory(userConfigDir), "workflows");
   }
-  return join16(repoConfigDirectory(repoRoot6), "workflows");
+  return join17(repoConfigDirectory(repoRoot6), "workflows");
 }
 function ensureWorkflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
   const dir = workflowsDirectory(scope, repoRoot6, userConfigDir);
@@ -27841,7 +27867,7 @@ function ensureWorkflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDi
 function parseWorkflowFile(filePath) {
   if (!existsSync15(filePath)) return void 0;
   try {
-    const raw = readFileSync15(filePath, "utf8");
+    const raw = readFileSync16(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     return parsed;
@@ -27858,7 +27884,7 @@ function listWorkflowDefinitions(options = {}) {
   if (scopeFilter !== "global" && existsSync15(localDir)) {
     for (const entry of readdirSync5(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join16(localDir, entry);
+        const filePath = join17(localDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27871,7 +27897,7 @@ function listWorkflowDefinitions(options = {}) {
   if (scopeFilter !== "local" && existsSync15(globalDir)) {
     for (const entry of readdirSync5(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join16(globalDir, entry);
+        const filePath = join17(globalDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27927,13 +27953,13 @@ function getWorkflowDefinition(workflowId, options = {}) {
   const repoRoot6 = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
     const localDir = workflowsDirectory("local", repoRoot6, options.userConfigDir);
-    const localFile = join16(localDir, `${workflowId}.yaml`);
+    const localFile = join17(localDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(localFile);
     if (parsed) return { workflow: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
     const globalDir = workflowsDirectory("global", repoRoot6, options.userConfigDir);
-    const globalFile = join16(globalDir, `${workflowId}.yaml`);
+    const globalFile = join17(globalDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(globalFile);
     if (parsed) return { workflow: parsed, scope: "global", filePath: globalFile };
   }
@@ -27943,7 +27969,7 @@ function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE,
   const scope = options.scope ?? "local";
   const repoRoot6 = options.repoRoot ?? process.cwd();
   const dir = ensureWorkflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join16(dir, `${workflowId}.yaml`);
+  const filePath = join17(dir, `${workflowId}.yaml`);
   if (existsSync15(filePath) && !options.overwrite) {
     throw new Error(`workflow_already_exists: workflow '${workflowId}' already exists at ${filePath}`);
   }
@@ -27955,7 +27981,7 @@ function removeWorkflowDefinition(workflowId, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot6 = options.repoRoot ?? process.cwd();
   const dir = workflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join16(dir, `${workflowId}.yaml`);
+  const filePath = join17(dir, `${workflowId}.yaml`);
   if (!existsSync15(filePath)) {
     throw new Error(`workflow_not_found: workflow '${workflowId}' not found in ${scope} directory (${filePath})`);
   }
@@ -27974,7 +28000,7 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
   const scope = options.scope ?? target.scope;
   const repoRoot6 = options.repoRoot ?? process.cwd();
   const dir = ensureWorkflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join16(dir, `${workflowId}.yaml`);
+  const filePath = join17(dir, `${workflowId}.yaml`);
   writeFileSync12(filePath, (0, import_yaml9.stringify)(updated), "utf8");
   return { id: workflowId, workflow: updated, filePath, scope };
 }
@@ -28059,7 +28085,7 @@ function activeWorkflowDefinition(runtime, definitionId) {
   let raw;
   if (file) {
     try {
-      raw = readFileSync16(resolve15(runtime.cwd, file), "utf8");
+      raw = readFileSync17(resolve15(runtime.cwd, file), "utf8");
     } catch {
       throw new Error("workflow definition file is unavailable");
     }
@@ -28141,7 +28167,7 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
   }
   if (options.file) {
     const filePath = resolve15(runtime.cwd, options.file);
-    content = readFileSync16(filePath, "utf8");
+    content = readFileSync17(filePath, "utf8");
   } else if (!content) {
     content = {
       schema: "kxm.workflow.v1",
@@ -28299,7 +28325,7 @@ async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   }
   let payload;
   try {
-    const raw = payloadFlag.startsWith("@") ? readFileSync16(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
+    const raw = payloadFlag.startsWith("@") ? readFileSync17(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
     const value = JSON.parse(raw);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("object required");
     payload = value;
@@ -28366,7 +28392,7 @@ async function cmdWorkflowDegrade(runtime, runId, stageId, options) {
   }
 }
 async function cmdWorkflowInspect(runtime, action, runId) {
-  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join17(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join18(runtime.dirs.state, "kxm.db"));
   if (action === "get" && !runId) {
     runtime.io.stderr(`Usage: ${CLI_NAME} workflow get <runId>
 `);
@@ -28540,9 +28566,9 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
   try {
     if (snapshotPath) {
       if (!existsSync16(snapshotPath)) throw new Error("snapshot_missing");
-      snapshot = JSON.parse(readFileSync16(snapshotPath, "utf8"));
+      snapshot = JSON.parse(readFileSync17(snapshotPath, "utf8"));
     } else {
-      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join17(runtime.dirs.state, "kxm.db"));
+      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join18(runtime.dirs.state, "kxm.db"));
       const local = localWorkflowSnapshot(dataPath, runId);
       if (!local.runs[0]) throw new Error("workflow_not_found");
       snapshot = { run: local.runs[0], journal: local.journal };
@@ -28554,7 +28580,7 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 1;
   }
   const doc = buildRetrospective(snapshot.run, snapshot.journal);
-  const outDir = resolve15(runtime.cwd, String(options.outDir || join17(runtime.dirs.assets, "retrospectives")));
+  const outDir = resolve15(runtime.cwd, String(options.outDir || join18(runtime.dirs.assets, "retrospectives")));
   const assetsRoot = resolve15(runtime.dirs.assets);
   const assetsPrefix = `${assetsRoot}${process.platform === "win32" ? "\\" : "/"}`;
   if (outDir !== assetsRoot && !outDir.startsWith(assetsPrefix)) {
@@ -28572,8 +28598,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
 
 // plugins/kxm/src/cli/tasks.ts
 var import_yaml13 = __toESM(require_dist(), 1);
-import { existsSync as existsSync22, readFileSync as readFileSync21, readdirSync as readdirSync8 } from "node:fs";
-import { basename as basename5, join as join25, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
+import { basename as basename6, join as join26, resolve as resolve21 } from "node:path";
 
 // plugins/kxm/src/suggest.ts
 var WORKFLOW_PATTERNS = [
@@ -28684,8 +28710,8 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
 // plugins/kxm/src/task-manager.ts
 var import_yaml10 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync17, readdirSync as readdirSync6, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join18, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync18, readdirSync as readdirSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join19, resolve as resolve16 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
 var TASK_SCHEMA = "kxm.task.v1";
 function goalsDirectory(repoRoot6) {
@@ -28710,7 +28736,7 @@ function createGoal(repoRoot6, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join18(dir, `${id}.yaml`);
+  const filePath = join19(dir, `${id}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
@@ -28722,7 +28748,7 @@ function listGoals(repoRoot6) {
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync17(join18(dir, entry.name), "utf8");
+        const text = readFileSync18(join19(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === GOAL_SCHEMA) goals.push(doc);
       } catch {
@@ -28755,7 +28781,7 @@ function createTask(repoRoot6, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join18(dir, `${id}.yaml`);
+  const filePath = join19(dir, `${id}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
@@ -28767,7 +28793,7 @@ function listTasks(repoRoot6, options = {}) {
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync17(join18(dir, entry.name), "utf8");
+        const text = readFileSync18(join19(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === TASK_SCHEMA) {
           if (options.goalId && doc.goalId !== options.goalId) continue;
@@ -28782,10 +28808,10 @@ function listTasks(repoRoot6, options = {}) {
 }
 function getTask(repoRoot6, taskId) {
   const dir = tasksDirectory(repoRoot6);
-  const filePath = join18(dir, `${taskId}.yaml`);
+  const filePath = join19(dir, `${taskId}.yaml`);
   if (!existsSync17(filePath)) return void 0;
   try {
-    const text = readFileSync17(filePath, "utf8");
+    const text = readFileSync18(filePath, "utf8");
     const doc = (0, import_yaml10.parse)(text);
     return doc && doc.schema === TASK_SCHEMA ? doc : void 0;
   } catch {
@@ -28800,7 +28826,7 @@ function updateTaskStatus(repoRoot6, taskId, status, options = {}) {
   task.status = status;
   if (options.workflowRunId) task.workflowRunId = options.workflowRunId;
   task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const filePath = join18(tasksDirectory(repoRoot6), `${taskId}.yaml`);
+  const filePath = join19(tasksDirectory(repoRoot6), `${taskId}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
@@ -28816,7 +28842,7 @@ function syncTaskWithTracker(repoRoot6, taskId, options = {}) {
   task.trackerSync.syncStatus = "synced";
   task.trackerSync.lastSyncedAt = now;
   task.updatedAt = now;
-  const filePath = join18(tasksDirectory(repoRoot6), `${taskId}.yaml`);
+  const filePath = join19(tasksDirectory(repoRoot6), `${taskId}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
@@ -29583,14 +29609,14 @@ function createStudioServer(options = {}) {
 }
 
 // plugins/kxm/src/cli/vnext.ts
-import { join as join24, resolve as resolve20 } from "node:path";
+import { join as join25, resolve as resolve20 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // plugins/kxm/src/model-inventory.ts
 var import_yaml11 = __toESM(require_dist(), 1);
 import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var OR_URL = "https://openrouter.ai/api/v1/models";
 var NOUS_URL = "https://inference-api.nousresearch.com/v1/models";
 function price(value) {
@@ -29676,15 +29702,15 @@ async function refreshModelInventory(options) {
   sources.nous = { url: nousUrl, ok: !nous.error, ...nous.error ? { error: nous.error } : {} };
   for (const item of nous.data) add(item, "nous", "discount");
   const inventory = { schema: "kxm.model-inventory.v1", fetchedAt, currency: "USD", sources, models: [...byId.values()].sort((a, b2) => a.id.localeCompare(b2.id)) };
-  mkdirSync15(join19(options.outputRoot, ".kxm", "models"), { recursive: true });
-  writeFileSync14(join19(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
+  mkdirSync15(join20(options.outputRoot, ".kxm", "models"), { recursive: true });
+  writeFileSync14(join20(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
   return inventory;
 }
 
 // plugins/kxm/src/vnext-init.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
 import { existsSync as existsSync20 } from "node:fs";
-import { basename as basename4, join as join22 } from "node:path";
+import { basename as basename5, join as join23 } from "node:path";
 
 // plugins/kxm/src/vnext-repair.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
@@ -29697,20 +29723,20 @@ import {
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync17,
   openSync as openSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync7,
   renameSync as renameSync5,
   rmSync as rmSync7,
   writeFileSync as writeFileSync16
 } from "node:fs";
-import { dirname as dirname13, isAbsolute as isAbsolute6, join as join21, relative as relative4, resolve as resolve18 } from "node:path";
+import { dirname as dirname13, isAbsolute as isAbsolute6, join as join22, relative as relative4, resolve as resolve18 } from "node:path";
 
 // plugins/kxm/src/vnext-permission.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync18, mkdtempSync, mkdirSync as mkdirSync16, readFileSync as readFileSync18, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync18, mkdtempSync, mkdirSync as mkdirSync16, readFileSync as readFileSync19, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname12, join as join20, resolve as resolve17, sep as sep3 } from "node:path";
+import { dirname as dirname12, join as join21, resolve as resolve17, sep as sep3 } from "node:path";
 var PROSE_FIELDS = {
   project: /* @__PURE__ */ new Set(["name", "description"]),
   repository: /* @__PURE__ */ new Set(["description"]),
@@ -30231,7 +30257,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
   const tree = resolveTreeRevision(root, revision);
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-  const shadow = mkdtempSync(join20(tmpdir(), "kxm-permission-base-"));
+  const shadow = mkdtempSync(join21(tmpdir(), "kxm-permission-base-"));
   const shadowResolved = resolve17(shadow);
   const shadowMembersDir = `.kxm-shadow-members-${createHash12("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
@@ -30245,7 +30271,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
           message: "Git tree entry contains a traversal or non-portable segment"
         }]);
       }
-      const absolute = join20(shadowResolved, ...segments);
+      const absolute = join21(shadowResolved, ...segments);
       const resolved = resolve17(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep3}`)) {
         throw new VnextConfigError([{
@@ -30260,7 +30286,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       writeFileSync15(absolute, content);
     }
     initShadowGitRoot(shadowResolved);
-    const baseProjectFile = join20(shadowResolved, ".kxm", "project.yaml");
+    const baseProjectFile = join21(shadowResolved, ".kxm", "project.yaml");
     let baseProject;
     try {
       baseProject = loadBaseProjectDeclarations(baseProjectFile);
@@ -30338,7 +30364,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       const memberTree = git(memberWorktree, ["rev-parse", "--verify", "--quiet", `${pinnedCommit}^{tree}`]).trim();
       const memberListing = gitBuffer(memberWorktree, ["ls-tree", "-r", "-z", "--name-only", memberTree]).toString("utf8");
       const memberPaths = memberListing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-      const memberShadowRoot = join20(shadowResolved, shadowMembersDir, member.repositoryId);
+      const memberShadowRoot = join21(shadowResolved, shadowMembersDir, member.repositoryId);
       if (!resolve17(memberShadowRoot).startsWith(`${resolve17(shadowResolved, shadowMembersDir)}${sep3}`)) {
         throw new VnextConfigError([{
           phase: "path",
@@ -30352,7 +30378,7 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
-        const absolute = join20(memberShadowRoot, ...segments);
+        const absolute = join21(memberShadowRoot, ...segments);
         const resolved = resolve17(absolute);
         if (!resolved.startsWith(`${resolve17(memberShadowRoot)}${sep3}`)) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry escapes the shadow root" }]);
@@ -30381,7 +30407,7 @@ function portableMemberPathHint(pathHint) {
 }
 function loadBaseProjectDeclarations(projectFile) {
   if (!existsSync18(projectFile)) return [];
-  const value = parseRestrictedYaml2(readFileSync18(projectFile, "utf8"), ".kxm/project.yaml");
+  const value = parseRestrictedYaml2(readFileSync19(projectFile, "utf8"), ".kxm/project.yaml");
   const repositories = Array.isArray(value?.repositories) ? value.repositories : [];
   const members = [];
   for (const entry of repositories) {
@@ -30509,19 +30535,19 @@ function sameHostPath3(left, right) {
   return process.platform === "win32" ? first.toLocaleLowerCase("en-US") === second.toLocaleLowerCase("en-US") : first === second;
 }
 function transactionRoot(projectRoot) {
-  return join21(resolve18(projectRoot), TRANSACTION_NAME);
+  return join22(resolve18(projectRoot), TRANSACTION_NAME);
 }
 function operationFile(projectRoot) {
-  return join21(transactionRoot(projectRoot), OPERATION_FILE);
+  return join22(transactionRoot(projectRoot), OPERATION_FILE);
 }
 function targetFile(projectRoot, portablePath2) {
-  return join21(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
+  return join22(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
 }
 function shadowRoot(projectRoot) {
-  return join21(transactionRoot(projectRoot), "shadow");
+  return join22(transactionRoot(projectRoot), "shadow");
 }
 function backupFile(projectRoot, portablePath2) {
-  return join21(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
+  return join22(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
 }
 function portableManagedPath(path4) {
   return path4.startsWith(".kxm/") && path4 !== VNEXT_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute6(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
@@ -30530,10 +30556,10 @@ function readRegularBounded(file, label) {
   const stat = lstatSync7(file);
   if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_file_invalid", label, "managed file must be a regular file, not a link or directory", "path");
   if (stat.size > MAX_MANAGED_FILE_BYTES) fail3("repair_file_too_large", label, `managed file exceeds ${MAX_MANAGED_FILE_BYTES} bytes`, "parse");
-  return readFileSync19(file);
+  return readFileSync20(file);
 }
 function readOptionalManaged(projectRoot, path4) {
-  const file = join21(projectRoot, ...path4.split("/"));
+  const file = join22(projectRoot, ...path4.split("/"));
   if (!existsSync19(file)) return void 0;
   let parent = dirname13(file);
   const boundary = resolve18(projectRoot);
@@ -30545,8 +30571,8 @@ function readOptionalManaged(projectRoot, path4) {
   return readRegularBounded(file, path4);
 }
 function readProjectAndProvenance(projectRoot, schemasDir) {
-  const projectFile = join21(projectRoot, ".kxm", "project.yaml");
-  const provenanceFile = join21(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
+  const projectFile = join22(projectRoot, ".kxm", "project.yaml");
+  const provenanceFile = join22(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
   if (!existsSync19(projectFile) || !existsSync19(provenanceFile)) return void 0;
   const projectBytes = readOptionalManaged(projectRoot, ".kxm/project.yaml");
   const provenanceBytes = readOptionalManaged(projectRoot, VNEXT_TEMPLATE_PROVENANCE_PATH);
@@ -30711,7 +30737,7 @@ function operationPlanSha(operation) {
 function writeOperation(projectRoot, operation) {
   const root = transactionRoot(projectRoot);
   const file = operationFile(projectRoot);
-  const temporary = join21(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
+  const temporary = join22(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
   try {
     writeDurableNew(temporary, Buffer.from(`${JSON.stringify(operation, null, 2)}
 `, "utf8"), 384);
@@ -30763,7 +30789,7 @@ function hasVnextInitTransaction(projectRoot) {
   return existsSync19(transactionRoot(projectRoot));
 }
 function readTarget(projectRoot, path4) {
-  return readOptionalManaged(join21(transactionRoot(projectRoot), "targets"), path4);
+  return readOptionalManaged(join22(transactionRoot(projectRoot), "targets"), path4);
 }
 function writeTarget(projectRoot, path4, bytes) {
   if (bytes.byteLength > MAX_MANAGED_FILE_BYTES) fail3("template_target_too_large", path4, `target exceeds ${MAX_MANAGED_FILE_BYTES} bytes`);
@@ -30803,7 +30829,7 @@ function verifyBackups(projectRoot, operation) {
   if (operation.kind !== "repair") return;
   for (const entry of operation.files) {
     if (entry.observedSha256 === null) continue;
-    const bytes = readOptionalManaged(join21(transactionRoot(projectRoot), "backups"), entry.path);
+    const bytes = readOptionalManaged(join22(transactionRoot(projectRoot), "backups"), entry.path);
     if (!bytes || vnextContentSha256(bytes) !== entry.observedSha256) {
       fail3("init_transaction_backup_invalid", entry.path, "pinned preimage backup is missing or corrupt");
     }
@@ -30837,9 +30863,9 @@ function sourceConfigFiles(projectRoot) {
     ".kxm/repo/repo.yaml",
     ".kxm/repo/env.yaml"
   ];
-  const files = fixed.filter((path4) => existsSync19(join21(projectRoot, ...path4.split("/"))));
+  const files = fixed.filter((path4) => existsSync19(join22(projectRoot, ...path4.split("/"))));
   for (const directory of ["agents", "models", "workflows"]) {
-    const absolute = join21(projectRoot, ".kxm", directory);
+    const absolute = join22(projectRoot, ".kxm", directory);
     if (!existsSync19(absolute)) continue;
     const stat = lstatSync7(absolute);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_directory_invalid", `.kxm/${directory}`, "configuration directory must be regular", "path");
@@ -30876,8 +30902,8 @@ function prepareShadow(projectRoot, operation, options) {
       const bytes = readOptionalManaged(projectRoot, path4);
       if (!bytes) fail3("repair_snapshot_file_missing", path4, "configuration changed during shadow preparation");
       total += bytes.byteLength;
-      const source = join21(projectRoot, ...path4.split("/"));
-      const destination = join21(shadow, ...path4.split("/"));
+      const source = join22(projectRoot, ...path4.split("/"));
+      const destination = join22(shadow, ...path4.split("/"));
       mkdirSync17(dirname13(destination), { recursive: true, mode: 448 });
       writeDurableNew(destination, bytes, lstatSync7(source).mode & 511);
       if (total > MAX_MANAGED_TOTAL_BYTES) fail3("repair_snapshot_too_large", ".kxm", `configuration snapshot exceeds ${MAX_MANAGED_TOTAL_BYTES} bytes`, "parse");
@@ -30886,12 +30912,12 @@ function prepareShadow(projectRoot, operation, options) {
   for (const entry of operation.files) {
     const bytes = readTarget(projectRoot, entry.path);
     if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-    const destination = join21(shadow, ...entry.path.split("/"));
+    const destination = join22(shadow, ...entry.path.split("/"));
     mkdirSync17(dirname13(destination), { recursive: true, mode: 448 });
     const mode = existsSync19(destination) ? lstatSync7(destination).mode & 511 : 420;
     writeDurable(destination, bytes, mode);
   }
-  const project = parseRestrictedYaml2(readFileSync19(join21(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
+  const project = parseRestrictedYaml2(readFileSync20(join22(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
   const bound = absoluteMemberBindings(projectRoot, project, options.repositoryBindings);
   loadVnextProject(shadow, { ...loaderOptions(options), repositoryBindings: bound });
   const provenance = readProjectAndProvenance(shadow, options.schemasDir)?.provenance;
@@ -30955,21 +30981,21 @@ function ensureDestinationParents(projectRoot, path4) {
   const segments = path4.split("/").slice(0, -1);
   let current = boundary;
   for (const segment of segments) {
-    current = join21(current, segment);
+    current = join22(current, segment);
     if (!existsSync19(current)) mkdirSync17(current, { mode: 448 });
     const stat = lstatSync7(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_destination_parent_invalid", path4, "destination parent must be a regular directory", "path");
   }
 }
 function destinationSha(projectRoot, path4) {
-  const file = join21(projectRoot, ...path4.split("/"));
+  const file = join22(projectRoot, ...path4.split("/"));
   if (!existsSync19(file)) return void 0;
   return vnextContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
   const nonce = randomUUID10();
-  const source = join21(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
-  const target = join21(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
+  const source = join22(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
+  const target = join22(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
   try {
     writeDurableNew(source, Buffer.from("kxm-link-probe\n", "utf8"), 384);
     try {
@@ -30984,16 +31010,16 @@ function requireConditionalLinkSupport(directory, operationId, path4) {
   }
 }
 function atomicInstallTarget(projectRoot, operation, entry) {
-  const destination = join21(projectRoot, ...entry.path.split("/"));
+  const destination = join22(projectRoot, ...entry.path.split("/"));
   ensureDestinationParents(projectRoot, entry.path);
   const directory = dirname13(destination);
   const temporaryPrefix = `.kxm-repair-${operation.operationId}-`;
   const pathKey = vnextContentSha256(entry.path).slice("sha256:".length, "sha256:".length + 16);
-  const displaced = join21(directory, `${temporaryPrefix}${pathKey}.preimage`);
+  const displaced = join22(directory, `${temporaryPrefix}${pathKey}.preimage`);
   if (existsSync19(displaced)) {
     const stat = lstatSync7(displaced);
     if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_preimage_temporary_invalid", entry.path, "stale displaced preimage is not a regular file", "path");
-    if (entry.observedSha256 === null || vnextContentSha256(readFileSync19(displaced)) !== entry.observedSha256) {
+    if (entry.observedSha256 === null || vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
       fail3("repair_preimage_temporary_mismatch", entry.path, "stale displaced preimage does not match the pinned operation");
     }
     if (!existsSync19(destination)) {
@@ -31011,7 +31037,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     const owned = candidate.name.startsWith(temporaryPrefix) && (candidate.name.endsWith(".tmp") || candidate.name.endsWith(".link-source") || candidate.name.endsWith(".link-target"));
     if (!owned) continue;
     if (!candidate.isFile()) fail3("repair_temporary_invalid", entry.path, "stale operation temporary is not a regular file", "path");
-    rmSync7(join21(directory, candidate.name), { force: true });
+    rmSync7(join22(directory, candidate.name), { force: true });
   }
   const current = destinationSha(projectRoot, entry.path);
   if (current === entry.targetSha256) return;
@@ -31021,14 +31047,14 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   requireConditionalLinkSupport(directory, operation.operationId, entry.path);
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-  const temporary = join21(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
+  const temporary = join22(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
   const mode = existsSync19(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
     if (entry.observedSha256 !== null) {
       renameSync5(destination, displaced);
       syncDirectory2(directory);
-      if (vnextContentSha256(readFileSync19(displaced)) !== entry.observedSha256) {
+      if (vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
         if (!existsSync19(destination)) {
           try {
             linkSync(displaced, destination);
@@ -31067,12 +31093,12 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   if (destinationSha(projectRoot, entry.path) !== entry.targetSha256) fail3("repair_install_verification_failed", entry.path, "installed target hash does not match the pinned operation");
 }
 function installedCreateMatches(projectRoot, operation) {
-  const configRoot = join21(projectRoot, ".kxm");
+  const configRoot = join22(projectRoot, ".kxm");
   if (!existsSync19(configRoot)) return false;
   const actual = [];
   const visit2 = (directory) => {
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      const absolute = join21(directory, entry.name);
+      const absolute = join22(directory, entry.name);
       if (entry.isSymbolicLink()) fail3("create_resume_link", relativeConfigPath(projectRoot, absolute), "created configuration must not contain links", "path");
       if (entry.isDirectory()) visit2(absolute);
       else if (entry.isFile()) actual.push(relativeConfigPath(projectRoot, absolute));
@@ -31093,7 +31119,7 @@ function syncTreeDirectories(root) {
   const visit2 = (directory) => {
     directories.push(directory);
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      if (entry.isDirectory()) visit2(join21(directory, entry.name));
+      if (entry.isDirectory()) visit2(join22(directory, entry.name));
     }
   };
   visit2(root);
@@ -31107,7 +31133,7 @@ function rebuildCreateShadow(projectRoot, operation, options) {
   if (stat.isSymbolicLink() || !stat.isDirectory() || !installedCreateMatches(shadow, operation)) {
     fail3("create_shadow_invalid", TRANSACTION_NAME, "reconstructed create shadow does not exactly match pinned target files", "path");
   }
-  syncTreeDirectories(join21(shadow, ".kxm"));
+  syncTreeDirectories(join22(shadow, ".kxm"));
 }
 function applyOperation(projectRoot, original, options, resumed) {
   assertNoRegisteredGates(options);
@@ -31117,10 +31143,10 @@ function applyOperation(projectRoot, original, options, resumed) {
   verifyBackups(projectRoot, operation);
   operation = updatePhase(projectRoot, operation, "applying");
   if (operation.kind === "create") {
-    const destination = join21(projectRoot, ".kxm");
+    const destination = join22(projectRoot, ".kxm");
     if (!existsSync19(destination)) {
       rebuildCreateShadow(projectRoot, operation, effectiveOptions);
-      renameSync5(join21(shadowRoot(projectRoot), ".kxm"), destination);
+      renameSync5(join22(shadowRoot(projectRoot), ".kxm"), destination);
       syncDirectory2(projectRoot);
     } else if (!installedCreateMatches(projectRoot, operation)) {
       fail3("create_resume_conflict", ".kxm", "existing project configuration does not match the pinned create operation");
@@ -31147,7 +31173,7 @@ function applyOperation(projectRoot, original, options, resumed) {
   operation = updatePhase(projectRoot, operation, "verified");
   if (options.testFaultAt === "verified") throw new Error("injected init fault after verification");
   const files = operation.files.map((entry) => entry.path);
-  syncTreeDirectories(join21(projectRoot, ".kxm"));
+  syncTreeDirectories(join22(projectRoot, ".kxm"));
   return { kind: operation.kind, resumed, bundle, files };
 }
 function prepareAndApplyVnextCreate(projectRoot, rendered, options = {}) {
@@ -31262,7 +31288,7 @@ function finishPreparingOperation(projectRoot, operation, options) {
   const rendered = rendererForOperation(operation);
   if (!rendered) fail3("init_transaction_renderer_unavailable", TRANSACTION_NAME, "this binary cannot reproduce the pinned pre-application target");
   for (const directory of ["targets", "backups", "shadow"]) {
-    rmSync7(join21(transactionRoot(projectRoot), directory), { recursive: true, force: true });
+    rmSync7(join22(transactionRoot(projectRoot), directory), { recursive: true, force: true });
   }
   for (const entry of operation.files) {
     const bytes = rendered.files.get(entry.path);
@@ -31297,7 +31323,7 @@ function commitVnextInitTransaction(projectRoot, schemasDir) {
     fail3("init_transaction_not_verified", TRANSACTION_NAME, "initialization transaction cannot commit before installed state is verified");
   }
   const transaction = transactionRoot(projectRoot);
-  const retired = join21(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
+  const retired = join22(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
   renameSync5(transaction, retired);
   syncDirectory2(projectRoot);
   rmSync7(retired, { recursive: true, force: true });
@@ -31318,7 +31344,7 @@ function initIssue(code, file, message) {
   return { phase: "discovery", code, file, message };
 }
 function normalizedProjectName(root, requested) {
-  const name = (requested ?? basename4(root) ?? "KXM Project").trim();
+  const name = (requested ?? basename5(root) ?? "KXM Project").trim();
   if (name.length < 1 || name.length > 120 || /[\u0000\r\n]/.test(name)) {
     throw new VnextConfigError([initIssue("project_name_invalid", ".kxm/project.yaml", "project name must contain 1-120 characters on one line")]);
   }
@@ -31406,7 +31432,7 @@ function validateBindingIdentities(bundle, persisted, explicit) {
 }
 function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const storeOptions = bindingStoreOptions(options);
-  const persisted = existsSync20(join22(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
+  const persisted = existsSync20(join23(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
   const repositoryBindings = Object.fromEntries([
     ...Object.entries(persisted?.repositories ?? {}),
     ...Object.entries(options.repositoryBindings ?? {})
@@ -31595,7 +31621,7 @@ function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock)
   const files = [...rendered.files.keys()];
   if (options.dryRun) return { action: "planned", plan, projectRoot: gitRoot, files };
   if (!mutationLock) throw new Error("project mutation lock is required to create configuration");
-  if (existsSync20(join22(gitRoot, ".kxm"))) {
+  if (existsSync20(join23(gitRoot, ".kxm"))) {
     throw new VnextConfigError([initIssue("workspace_changed", ".kxm", "workspace changed after planning; existing .kxm state was not overwritten")]);
   }
   const created = prepareAndApplyVnextCreate(gitRoot, rendered, transactionOptions);
@@ -31627,8 +31653,8 @@ function initializeVnextProject(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-migrate.ts
 var import_yaml12 = __toESM(require_dist(), 1);
 import { createHash as createHash13 } from "node:crypto";
-import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync21, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync18, openSync as openSync3, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join23 } from "node:path";
+import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync21, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync18, openSync as openSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join24 } from "node:path";
 var MAX_LEGACY_JSON_BYTES = 1024 * 1024;
 var MAX_LEGACY_JSON_DEPTH = 32;
 var MAX_LEGACY_JSON_NODES = 32768;
@@ -31797,12 +31823,12 @@ function readVnextLegacySources(root) {
     throw new VnextConfigError([migrateIssue("discovery", "legacy_source_limit", ".kxm/config", `legacy configuration exceeds ${MAX_LEGACY_SOURCES} files`)]);
   }
   return files.map((path4) => {
-    const absolute = join23(root, ...path4.split("/"));
+    const absolute = join24(root, ...path4.split("/"));
     const stat = lstatSync8(absolute);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       throw new VnextConfigError([migrateIssue("path", "legacy_source_invalid", path4, "legacy configuration must be a regular file, not a link")]);
     }
-    const buffer = readFileSync20(absolute);
+    const buffer = readFileSync21(absolute);
     let text;
     try {
       text = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
@@ -32879,7 +32905,7 @@ function readVnextMigrationDecisions(path4, schemasDir) {
     throw new VnextConfigError([migrateIssue("discovery", "decisions_missing", path4, "migration decisions file does not exist")]);
   }
   const registry = new VnextSchemaRegistry(schemasDir);
-  const value = parseRestrictedYaml2(readFileSync20(path4), path4);
+  const value = parseRestrictedYaml2(readFileSync21(path4), path4);
   const issues = registry.validateMigrationDecision(value, path4);
   if (issues.length > 0) throw new VnextConfigError(issues);
   return value;
@@ -32918,7 +32944,7 @@ function writeDurable2(path4, content) {
       chmodSync6(path4, 384);
     } catch {
     }
-    syncDirectory3(join23(path4, ".."));
+    syncDirectory3(join24(path4, ".."));
   } finally {
     if (created && existsSync21(temp)) rmSync8(temp, { force: true });
   }
@@ -32930,7 +32956,7 @@ function applyVnextMigration(projectRoot, options = {}) {
     ...options.schemasDir === void 0 ? {} : { schemasDir: options.schemasDir }
   };
   const execute = (lock) => {
-    const receiptAbsolute = join23(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+    const receiptAbsolute = join24(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
     if (existsSync21(receiptAbsolute)) {
       const stat = lstatSync8(receiptAbsolute);
       if (stat.isSymbolicLink() || !stat.isFile()) {
@@ -32984,7 +33010,7 @@ function applyVnextMigration(projectRoot, options = {}) {
       return { action: "planned", projectRoot: root, files: [], plan: first.plan };
     }
     const files = [...first.resources.entries()].sort(([left], [right]) => compareCodeUnits6(left, right)).map(([path4, value]) => ({ path: path4, bytes: Buffer.from((0, import_yaml12.stringify)(value, { lineWidth: 0 }), "utf8") }));
-    const collisions = files.filter((file) => existsSync21(join23(root, ...file.path.split("/"))));
+    const collisions = files.filter((file) => existsSync21(join24(root, ...file.path.split("/"))));
     if (collisions.length > 0) {
       throw new VnextConfigError(collisions.map((file) => migrateIssue("semantic", "migration_target_exists", file.path, "target resource already exists; refusing to overwrite")));
     }
@@ -32993,7 +33019,7 @@ function applyVnextMigration(projectRoot, options = {}) {
       const segments = file.path.split("/");
       let current = root;
       for (const segment of segments.slice(0, -1)) {
-        current = join23(current, segment);
+        current = join24(current, segment);
         if (!existsSync21(current)) continue;
         const stat = lstatSync8(current);
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
@@ -33010,8 +33036,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     const written = [];
     try {
       for (const file of files) {
-        const absolute = join23(root, ...file.path.split("/"));
-        mkdirSync18(join23(absolute, ".."), { recursive: true });
+        const absolute = join24(root, ...file.path.split("/"));
+        mkdirSync18(join24(absolute, ".."), { recursive: true });
         written.push(absolute);
         writeDurable2(absolute, file.bytes);
       }
@@ -33057,7 +33083,7 @@ ${bundle.configRevision}`).slice(7, 39)}`,
 }
 function verifyVnextMigration(projectRoot, options = {}) {
   const root = migrationGitRoot(projectRoot);
-  const receiptAbsolute = join23(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  const receiptAbsolute = join24(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
   if (!existsSync21(receiptAbsolute)) {
     return {
       ok: false,
@@ -33368,7 +33394,7 @@ async function cmdBackup(runtime, options) {
     const summary = [
       `Created SQLite backup with ${manifest.stores.length} store(s):`,
       ...manifest.stores.map((s) => `  - ${s.storeId}: ${s.sourcePath} -> ${s.backupFile} (schema v${s.schemaVersion}, ${s.bytes} bytes, sha256 ${s.sha256.slice(0, 12)}...)`),
-      `Manifest: ${join24(outDir, "manifest.json")}`
+      `Manifest: ${join25(outDir, "manifest.json")}`
     ].join("\n");
     print(runtime.io, runtime.json, payload, summary);
     return 0;
@@ -33938,7 +33964,7 @@ async function cmdStudioLayout(runtime, workflowPath) {
     let yamlContent;
     let workflowId = "default";
     if (existsSync22(filePath)) {
-      yamlContent = readFileSync21(filePath, "utf8");
+      yamlContent = readFileSync22(filePath, "utf8");
     } else {
       yamlContent = `schema: kxm.workflow.v1
 description: Feature implementation workflow
@@ -34011,17 +34037,17 @@ async function cmdStudioServe(runtime, options) {
       sessionToken,
       planProvider: () => {
         try {
-          const wfDir = join25(runtime.cwd, ".kxm", "workflows");
-          const defaultPath = join25(wfDir, "default.yaml");
+          const wfDir = join26(runtime.cwd, ".kxm", "workflows");
+          const defaultPath = join26(wfDir, "default.yaml");
           let targetPath = existsSync22(defaultPath) ? defaultPath : void 0;
           if (!targetPath && existsSync22(wfDir)) {
             const yml = readdirSync8(wfDir).find((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
-            if (yml) targetPath = join25(wfDir, yml);
+            if (yml) targetPath = join26(wfDir, yml);
           }
           if (targetPath && existsSync22(targetPath)) {
-            const raw = readFileSync21(targetPath, "utf8");
+            const raw = readFileSync22(targetPath, "utf8");
             const parsed = (0, import_yaml13.parse)(raw);
-            const wfId = basename5(targetPath).replace(/\.(yaml|yml)$/, "");
+            const wfId = basename6(targetPath).replace(/\.(yaml|yml)$/, "");
             return compileVnextWorkflow({ id: wfId, value: parsed });
           }
         } catch {
@@ -34069,14 +34095,14 @@ Press Ctrl+C to stop.
 }
 
 // plugins/kxm/src/cli/context-skills.ts
-import { readFileSync as readFileSync24 } from "node:fs";
-import { join as join29, relative as relative5 } from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { join as join30, relative as relative5 } from "node:path";
 
 // plugins/kxm/src/memory.ts
 var import_yaml14 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync22, writeFileSync as writeFileSync18 } from "node:fs";
-import { extname as extname2, join as join26, resolve as resolve22 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "node:fs";
+import { extname as extname2, join as join27, resolve as resolve22 } from "node:path";
 var MEMORY_SCHEMA = "kxm.memory.v1";
 var MEMORY_BRIEF_SCHEMA = "kxm.memory-brief.v1";
 var MEMORY_MARKER_START = "<!-- kxm:memory:start -->";
@@ -34203,8 +34229,8 @@ ${yamlText}
 }
 function memoryDirectories(repoRoot6) {
   const root = resolve22(repoRoot6);
-  const memoryDir = join26(root, ".kxm", "memory");
-  const candidatesDir = join26(memoryDir, "candidates");
+  const memoryDir = join27(root, ".kxm", "memory");
+  const candidatesDir = join27(memoryDir, "candidates");
   return { memoryDir, candidatesDir };
 }
 function loadAuthoredMemory(repoRoot6) {
@@ -34214,9 +34240,9 @@ function loadAuthoredMemory(repoRoot6) {
   const entries = readdirSync9(memoryDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && extname2(entry.name) === ".md") {
-      const fullPath = join26(memoryDir, entry.name);
+      const fullPath = join27(memoryDir, entry.name);
       try {
-        const text = readFileSync22(fullPath, "utf8");
+        const text = readFileSync23(fullPath, "utf8");
         const record = parseMemoryRecord(text, entry.name);
         if (record.lifecycle === "active") {
           records.push(record);
@@ -34255,7 +34281,7 @@ function createMemoryNote(repoRoot6, summary, options = {}) {
     evidenceRefs: [],
     ...options.body ? { body: options.body.trim() } : {}
   };
-  const targetPath = join26(candidatesDir, `${id}.md`);
+  const targetPath = join27(candidatesDir, `${id}.md`);
   writeFileSync18(targetPath, formatMemoryRecord(record), "utf8");
   return { record, path: targetPath };
 }
@@ -34293,7 +34319,7 @@ function formatHarnessMemoryBlock(records) {
 function updateHarnessDocument(filePath, block, defaultHeader) {
   let original = "";
   if (existsSync23(filePath)) {
-    original = readFileSync22(filePath, "utf8");
+    original = readFileSync23(filePath, "utf8");
   }
   let updated = "";
   if (original.includes(MEMORY_MARKER_START) && original.includes(MEMORY_MARKER_END)) {
@@ -34332,14 +34358,14 @@ function syncHarnessMemory(repoRoot6) {
   const block = formatHarnessMemoryBlock(records);
   const updated = [];
   const created = [];
-  const agentsPath = join26(root, "AGENTS.md");
+  const agentsPath = join27(root, "AGENTS.md");
   const agentsHeader = "# AGENTS\n\nFollow project instructions.\n";
   const agentsExisted = existsSync23(agentsPath);
   if (updateHarnessDocument(agentsPath, block, agentsHeader)) {
     if (agentsExisted) updated.push("AGENTS.md");
     else created.push("AGENTS.md");
   }
-  const claudePath = join26(root, "CLAUDE.md");
+  const claudePath = join27(root, "CLAUDE.md");
   const claudeHeader = `# KXM (Claude)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34355,7 +34381,7 @@ artifacts, not hub \`peer-reply\` evidence.
     if (claudeExisted) updated.push("CLAUDE.md");
     else created.push("CLAUDE.md");
   }
-  const geminiPath = join26(root, "GEMINI.md");
+  const geminiPath = join27(root, "GEMINI.md");
   const geminiHeader = `# KXM (Gemini / Antigravity)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34375,8 +34401,8 @@ for Gemini models. Starting rotation remains Grok.
 // plugins/kxm/src/skills.ts
 var import_yaml15 = __toESM(require_dist(), 1);
 import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync23, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
+import { join as join28 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
 var SKILL_EVALUATION_SCHEMA = "kxm.skill-evaluation.v1";
 var SKILL_DECISION_SCHEMA = "kxm.skill-decision.v1";
@@ -34470,21 +34496,21 @@ var SkillLifecycle = class {
     this.allowOptimizationEvals = options.allowOptimizationEvals === true;
   }
   dir(state) {
-    return join27(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
+    return join28(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
   }
   historyFile(id) {
-    return join27(this.root, "history", `${id}.jsonl`);
+    return join28(this.root, "history", `${id}.jsonl`);
   }
   paths(state, id) {
-    const dir = join27(this.dir(state), id);
-    return { dir, metadata: join27(dir, "metadata.json"), skill: join27(dir, "SKILL.md") };
+    const dir = join28(this.dir(state), id);
+    return { dir, metadata: join28(dir, "metadata.json"), skill: join28(dir, "SKILL.md") };
   }
   appendHistory(id, record) {
-    mkdirSync20(join27(this.root, "history"), { recursive: true });
+    mkdirSync20(join28(this.root, "history"), { recursive: true });
     const line = `${JSON.stringify(record)}
 `;
     if (existsSync24(this.historyFile(id))) {
-      const existing = readFileSync23(this.historyFile(id), "utf8");
+      const existing = readFileSync24(this.historyFile(id), "utf8");
       const lines = existing.split("\n").filter((entry) => entry.trim());
       writeFileSync19(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
     } else {
@@ -34494,18 +34520,18 @@ var SkillLifecycle = class {
   history(id) {
     const file = this.historyFile(id);
     if (!existsSync24(file)) return [];
-    return readFileSync23(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+    return readFileSync24(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   }
   readMetadata(state, id) {
     const { metadata } = this.paths(state, id);
     if (!existsSync24(metadata)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${state}`);
     }
-    return JSON.parse(readFileSync23(metadata, "utf8"));
+    return JSON.parse(readFileSync24(metadata, "utf8"));
   }
   move(from, to, id) {
-    const fromDir = join27(this.dir(from), id);
-    const toDir = join27(this.dir(to), id);
+    const fromDir = join28(this.dir(from), id);
+    const toDir = join28(this.dir(to), id);
     if (!existsSync24(fromDir)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${from}`);
     }
@@ -34664,13 +34690,13 @@ var SkillLifecycle = class {
     const candidatePaths = this.paths("candidate", candidateId);
     const promotedPaths = this.paths("promoted", candidateId);
     mkdirSync20(promotedPaths.dir, { recursive: true });
-    const skillContent = readFileSync23(candidatePaths.skill, "utf8");
-    const metadataContent = readFileSync23(candidatePaths.metadata, "utf8");
+    const skillContent = readFileSync24(candidatePaths.skill, "utf8");
+    const metadataContent = readFileSync24(candidatePaths.metadata, "utf8");
     writeFileSync19(promotedPaths.skill, skillContent);
     writeFileSync19(promotedPaths.metadata, metadataContent);
-    const patchesDir = join27(this.root, "patches");
+    const patchesDir = join28(this.root, "patches");
     mkdirSync20(patchesDir, { recursive: true });
-    const patchPath = join27(patchesDir, `${candidateId}.patch`);
+    const patchPath = join28(patchesDir, `${candidateId}.patch`);
     const relSkillPath = `.kxm/skills/promoted/${candidateId}/SKILL.md`;
     const relMetaPath = `.kxm/skills/promoted/${candidateId}/metadata.json`;
     const patch = `${createUnifiedPatch(relSkillPath, skillContent)}${createUnifiedPatch(relMetaPath, metadataContent)}`;
@@ -34698,7 +34724,7 @@ var SkillLifecycle = class {
   verify(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    const content = readFileSync23(skill, "utf8");
+    const content = readFileSync24(skill, "utf8");
     if (skillContentSha256(content) !== metadata.contentSha256) {
       throw new SkillLifecycleError(
         "skill_integrity_violation",
@@ -34729,7 +34755,7 @@ var SkillLifecycle = class {
   read(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    return { metadata, content: readFileSync23(skill, "utf8") };
+    return { metadata, content: readFileSync24(skill, "utf8") };
   }
 };
 function boundedList(value, field) {
@@ -34744,16 +34770,16 @@ function boundedList(value, field) {
   return [...new Set(refs)];
 }
 function readdirSorted(dir) {
-  return readdirSync10(dir).filter((entry) => statSync3(join27(dir, entry)).isDirectory()).sort();
+  return readdirSync10(dir).filter((entry) => statSync3(join28(dir, entry)).isDirectory()).sort();
 }
 
 // plugins/kxm/src/wiki.ts
 import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 function writeCompiledWiki(root, wiki) {
   const written = [];
   for (const [relativePath, content] of [...wiki.pages].sort(([left], [right]) => left.localeCompare(right))) {
-    const absolute = join28(root, relativePath);
+    const absolute = join29(root, relativePath);
     mkdirSync21(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
     writeFileSync20(absolute, content);
     written.push(relativePath);
@@ -34921,7 +34947,7 @@ function skillStateFromFlag(value) {
   throw new Error(`invalid skill state ${value}`);
 }
 function skillsRoot(runtime) {
-  return join29(runtime.dirs.workdir, ".kxm", "skills");
+  return join30(runtime.dirs.workdir, ".kxm", "skills");
 }
 function csv(value) {
   if (!value) return void 0;
@@ -34938,7 +34964,7 @@ async function cmdSkillsCreate(runtime, options) {
     const metadata = lifecycle.create({
       name: options.name,
       description: options.description ?? "",
-      content: readFileSync24(options.file, "utf8"),
+      content: readFileSync25(options.file, "utf8"),
       createdBy: options.createdBy,
       sources: {
         runIds: csv(options.run) ?? [],
@@ -35096,8 +35122,8 @@ async function cmdMemorySync(runtime) {
 
 // plugins/kxm/src/cli/hub.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync30, mkdirSync as mkdirSync25, readFileSync as readFileSync30, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
-import { basename as basename7, join as join39, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync25, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join40, resolve as resolve25 } from "node:path";
 
 // node_modules/marked/lib/marked.esm.js
 function M() {
@@ -41030,7 +41056,7 @@ import * as path2 from "node:path";
 
 // node_modules/@earendil-works/pi-tui/dist/native-module-path.js
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname16, join as join30 } from "node:path";
+import { dirname as dirname16, join as join31 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var moduleRequire = createRequire2(import.meta.url);
 var TUI_PACKAGE_NAME = "@earendil-works/pi-tui";
@@ -41039,10 +41065,10 @@ function getNativeModuleCandidates(nativePath, options = {}) {
   const candidates = [];
   try {
     const packageEntry = (options.resolvePackage ?? moduleRequire.resolve)(TUI_PACKAGE_NAME);
-    candidates.push(join30(dirname16(packageEntry), "..", nativePath));
+    candidates.push(join31(dirname16(packageEntry), "..", nativePath));
   } catch {
   }
-  candidates.push(join30(moduleDir, "..", nativePath), join30(moduleDir, nativePath), join30(dirname16(options.execPath ?? process.execPath), nativePath));
+  candidates.push(join31(moduleDir, "..", nativePath), join31(moduleDir, nativePath), join31(dirname16(options.execPath ?? process.execPath), nativePath));
   return Array.from(new Set(candidates));
 }
 
@@ -43499,7 +43525,7 @@ var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 
 // plugins/kxm/src/tui.ts
 import { mkdirSync as mkdirSync22 } from "node:fs";
-import { join as join34, resolve as resolve24, dirname as dirname17 } from "node:path";
+import { join as join35, resolve as resolve24, dirname as dirname17 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // plugins/kxm/src/external-effects.ts
@@ -43510,9 +43536,9 @@ function slugifyBranchPart(text, maxLength = 40) {
 }
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync25, readdirSync as readdirSync11, readFileSync as readFileSync25 } from "node:fs";
+import { existsSync as existsSync25, readdirSync as readdirSync11, readFileSync as readFileSync26 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { isAbsolute as isAbsolute7, join as join33, resolve as resolve23 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join34, resolve as resolve23 } from "node:path";
 function processExists2(pid) {
   try {
     process.kill(pid, 0);
@@ -43632,16 +43658,16 @@ function readOpenMessageMetadata(database) {
   return messages;
 }
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
-  const stateDir = env.KXM_STATE_DIR?.trim() || join33(cwd, ".kxm", "state");
+  const stateDir = env.KXM_STATE_DIR?.trim() || join34(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve23(cwd, configured) : join33(stateDir, "kxm.db");
+  const dataPath = configured ? resolve23(cwd, configured) : join34(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveVnextStateRoot(stateDir, options) {
   if (options?.vnextStateRoot && existsSync25(options.vnextStateRoot)) {
     return resolve23(options.vnextStateRoot);
   }
-  if (existsSync25(join33(stateDir, "runtime", "registry.db")) || existsSync25(join33(stateDir, "runtime", "projects"))) {
+  if (existsSync25(join34(stateDir, "runtime", "registry.db")) || existsSync25(join34(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
@@ -43652,13 +43678,13 @@ function resolveVnextStateRoot(stateDir, options) {
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    base = localAppData && isAbsolute7(localAppData) ? localAppData : join33(homedir5(), "AppData", "Local");
+    base = localAppData && isAbsolute7(localAppData) ? localAppData : join34(homedir5(), "AppData", "Local");
     base = resolve23(base, "KXM");
   } else if (process.platform === "darwin") {
     base = resolve23(homedir5(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
-    base = xdgState && isAbsolute7(xdgState) ? xdgState : join33(homedir5(), ".local", "state");
+    base = xdgState && isAbsolute7(xdgState) ? xdgState : join34(homedir5(), ".local", "state");
     base = resolve23(base, "kxm");
   }
   if (existsSync25(base)) return base;
@@ -43692,9 +43718,9 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let vnextRunTotal = 0;
   const vnextStateRoot = resolveVnextStateRoot(stateDir, options);
   if (vnextStateRoot) {
-    const runtimeDir = join33(vnextStateRoot, "runtime");
-    const registryDbPath = join33(runtimeDir, "registry.db");
-    const projectsDir = join33(runtimeDir, "projects");
+    const runtimeDir = join34(vnextStateRoot, "runtime");
+    const registryDbPath = join34(runtimeDir, "registry.db");
+    const projectsDir = join34(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
     if (existsSync25(registryDbPath)) {
       hasVnext = true;
@@ -43723,7 +43749,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       }
     }
     for (const key of projectKeys) {
-      const eventDbPath = join33(projectsDir, key, "run-events.db");
+      const eventDbPath = join34(projectsDir, key, "run-events.db");
       if (existsSync25(eventDbPath)) {
         hasVnext = true;
         try {
@@ -43757,7 +43783,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   if (existsSync25(stateDir)) {
     for (const file of readdirSync11(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
-        const record = JSON.parse(readFileSync25(join33(stateDir, file), "utf8"));
+        const record = JSON.parse(readFileSync26(join34(stateDir, file), "utf8"));
         pids.push({
           file,
           ...record.role ? { role: record.role } : {},
@@ -43796,7 +43822,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   } else {
     source = "legacy";
   }
-  const telemetryFile = join33(stateDir, "telemetry.jsonl");
+  const telemetryFile = join34(stateDir, "telemetry.jsonl");
   const spend = existsSync25(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
@@ -43931,7 +43957,7 @@ function spawnDegradeWorktree(repoRoot6, runId, options) {
   const cleanRunId = runId.replace(/^run_/, "");
   const desc = options?.description ? slugifyBranchPart(options.description, 30) : "degrade";
   const branchName = `kxm/run-${cleanRunId}-${desc}`;
-  const relativeWtPath = join34(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
+  const relativeWtPath = join35(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
   const absoluteWtPath = resolve24(repoRoot6, relativeWtPath);
   const jumpCommand = `cd "${absoluteWtPath}"`;
   try {
@@ -44701,8 +44727,8 @@ async function runMeshTui(input) {
 // plugins/kxm/src/session-work.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync23, readFileSync as readFileSync26, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync23, readFileSync as readFileSync27, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join36 } from "node:path";
 var MAX_SESSION_BRIEF_TASKS = 5;
 var MAX_SESSION_BRIEF_PLANS = 5;
 var SESSION_BRIEF_SCHEMA = "kxm.session-brief.v1";
@@ -44858,10 +44884,10 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
   };
 }
 function readCachedSessionBrief(stateDir) {
-  const file = join35(stateDir, "session-brief.json");
+  const file = join36(stateDir, "session-brief.json");
   try {
     if (!existsSync26(file)) return void 0;
-    const raw = readFileSync26(file, "utf8");
+    const raw = readFileSync27(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
       const ageMs = Date.now() - Date.parse(parsed.generatedAt);
@@ -44877,7 +44903,7 @@ function readCachedSessionBrief(stateDir) {
 function writeCachedSessionBrief(stateDir, brief) {
   try {
     mkdirSync23(stateDir, { recursive: true, mode: 448 });
-    const file = join35(stateDir, "session-brief.json");
+    const file = join36(stateDir, "session-brief.json");
     const tmp = `${file}.tmp.${randomUUID13().slice(0, 8)}`;
     writeFileSync21(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
     renameSync8(tmp, file);
@@ -44886,7 +44912,7 @@ function writeCachedSessionBrief(stateDir, brief) {
 }
 function estimateSessionCost(stateDir) {
   try {
-    const telemetryFile = join35(stateDir, "telemetry.jsonl");
+    const telemetryFile = join36(stateDir, "telemetry.jsonl");
     if (!existsSync26(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
@@ -45055,11 +45081,11 @@ function formatSessionBriefText(brief) {
 }
 
 // plugins/kxm/src/kxm-install-kind.ts
-import { existsSync as existsSync27, readFileSync as readFileSync27 } from "node:fs";
-import { dirname as dirname18, join as join36 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync28 } from "node:fs";
+import { dirname as dirname18, join as join37 } from "node:path";
 function packageIsKxm(root) {
   try {
-    const pkg = JSON.parse(readFileSync27(join36(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync28(join37(root, "package.json"), "utf8"));
     return pkg.name === "@kontextmind/kxm";
   } catch {
     return false;
@@ -45108,12 +45134,12 @@ function report(kind, root) {
   return { kind, root, instruction: installKindInstruction(kind, root) };
 }
 function classifyInstallRoot(probe) {
-  const piGitRoot = join36(probe.homeDir, ".pi", "agent", "git");
+  const piGitRoot = join37(probe.homeDir, ".pi", "agent", "git");
   if (isUnder(probe.repoRoot, piGitRoot, probe.platform)) return report("pi-git", probe.repoRoot);
-  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join36(probe.homeDir, ".claude");
-  const pluginsRoot = join36(claudeHome, "plugins");
+  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join37(probe.homeDir, ".claude");
+  const pluginsRoot = join37(claudeHome, "plugins");
   if (isUnder(probe.moduleDir, pluginsRoot, probe.platform)) return report("claude-marketplace", probe.moduleDir);
-  const hasGit = existsSync27(join36(probe.repoRoot, ".git"));
+  const hasGit = existsSync27(join37(probe.repoRoot, ".git"));
   if (hasGit && packageIsKxm(probe.repoRoot)) return report("source", probe.repoRoot);
   if (isNpmPackageLayout(probe.repoRoot, probe.platform) && packageIsKxm(probe.repoRoot) && !hasGit) {
     return report("npm-package", probe.repoRoot);
@@ -45134,14 +45160,14 @@ function resolveInstallKind(probe, npmGlobalRoot) {
 
 // plugins/kxm/src/kxm-update-config.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync28, readFileSync as readFileSync28 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync29 } from "node:fs";
+import { join as join38 } from "node:path";
 function loadKxmUpdateConfig(env = process.env) {
-  const path4 = join37(vnextUserStateRoot({ env }), "update.yaml");
+  const path4 = join38(vnextUserStateRoot({ env }), "update.yaml");
   if (!existsSync28(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
   let parsed;
   try {
-    parsed = (0, import_yaml16.parse)(readFileSync28(path4, "utf8"));
+    parsed = (0, import_yaml16.parse)(readFileSync29(path4, "utf8"));
   } catch {
     throw new KxmUpdateConfigError("update.yaml is not valid YAML");
   }
@@ -45167,8 +45193,8 @@ function loadKxmUpdateConfig(env = process.env) {
 }
 
 // plugins/kxm/src/session.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync24, readFileSync as readFileSync29, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync24, readFileSync as readFileSync30, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join39 } from "node:path";
 var SESSION_SCHEMA = "kxm.session.v1";
 var SessionConfigError = class extends Error {
   code = "session_config_invalid";
@@ -45178,12 +45204,12 @@ var SessionConfigError = class extends Error {
   }
 };
 function workflowAssetDirs(assetsDir, workflowId) {
-  const root = join38(assetsDir, "workflows", workflowId);
-  return [root, join38(root, "inputs"), join38(root, "outputs"), join38(root, "generated")];
+  const root = join39(assetsDir, "workflows", workflowId);
+  return [root, join39(root, "inputs"), join39(root, "outputs"), join39(root, "generated")];
 }
 function sessionAssetDirs(assetsDir, sessionId) {
-  const root = join38(assetsDir, "sessions", sessionId);
-  return [root, join38(root, "inputs"), join38(root, "outputs")];
+  const root = join39(assetsDir, "sessions", sessionId);
+  return [root, join39(root, "inputs"), join39(root, "outputs")];
 }
 function rosterNames(configDir) {
   return [...loadRosterMap(configDir).values()].map((row) => String(row.name));
@@ -45233,7 +45259,7 @@ function workerFromRosterRow(name, row, project) {
 function loadRosterMap(configDir) {
   const byName = /* @__PURE__ */ new Map();
   for (const [file, key] of [["agents.json", "agents"], ["gates.json", "gates"]]) {
-    const path4 = join38(configDir, file);
+    const path4 = join39(configDir, file);
     for (const row of loadRoster(path4, key)) {
       const name = String(row.name).trim();
       const lowered = name.toLowerCase();
@@ -45250,7 +45276,7 @@ function loadRoster(path4, key) {
   if (!existsSync29(path4)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync29(path4, "utf8"));
+    parsed = JSON.parse(readFileSync30(path4, "utf8"));
   } catch (error) {
     throw new SessionConfigError(
       `${key} roster at ${path4} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -45275,7 +45301,7 @@ function loadRoster(path4, key) {
   });
 }
 function createSession(input) {
-  const assetDir = input.mode === "workflow" && input.workflowId ? join38("assets", "workflows", input.workflowId) : join38("assets", "sessions", input.id);
+  const assetDir = input.mode === "workflow" && input.workflowId ? join39("assets", "workflows", input.workflowId) : join39("assets", "sessions", input.id);
   return {
     schema: SESSION_SCHEMA,
     id: input.id,
@@ -45288,8 +45314,8 @@ function createSession(input) {
   };
 }
 function writeSession(assetsDir, session, dryRun = false) {
-  const dir = join38(assetsDir, "sessions", session.id);
-  const path4 = join38(dir, "session.json");
+  const dir = join39(assetsDir, "sessions", session.id);
+  const path4 = join39(dir, "session.json");
   if (!dryRun) {
     mkdirSync24(dir, { recursive: true });
     writeFileSync22(path4, `${JSON.stringify(session, null, 2)}
@@ -45327,9 +45353,9 @@ function installProbeFrom(runtime) {
   };
 }
 function warnIgnoredProjectUpdateYaml(runtime) {
-  const projectFile = join39(runtime.dirs.workspace, "update.yaml");
+  const projectFile = join40(runtime.dirs.workspace, "update.yaml");
   if (!existsSync30(projectFile)) return;
-  const userFile = join39(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+  const userFile = join40(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
   runtime.io.stderr(`kxm: ignoring .kxm/update.yaml in ${runtime.dirs.workdir}; update settings are read only from ${userFile}
 `);
 }
@@ -45355,7 +45381,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const screen = requested;
-  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join39(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join40(runtime.dirs.state, "kxm.db"));
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, {
       ok: true,
@@ -45371,7 +45397,7 @@ async function cmdDash(runtime, options = {}) {
     runtime.io.stderr("kxm dash does not support --json; use kxm hub view\n");
     return 2;
   }
-  const project = runtime.env.KXM_PROJECT?.trim() || basename7(runtime.dirs.workdir) || "project";
+  const project = defaultProjectName(runtime.dirs.workdir, runtime.env) || "project";
   const authToken = runtime.env.KXM_AUTH_TOKEN?.trim();
   return await runMeshTui({
     serverUrl: runtime.serverUrl,
@@ -45401,7 +45427,7 @@ async function cmdHub(runtime) {
         config = loadKxmUpdateConfig(runtime.env);
       } catch (error) {
         if (error instanceof KxmUpdateConfigError) {
-          const yamlPath = join39(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+          const yamlPath = join40(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
           runtime.io.stderr(`kxm: ${error.message}; update check skipped; fix or remove ${yamlPath}
 `);
         } else {
@@ -45552,7 +45578,7 @@ async function cmdStop(runtime, waitMsFlag) {
   const orphans = [];
   for (const file of pids) {
     try {
-      const record = JSON.parse(readFileSync30(join39(runtime.dirs.state, file), "utf8"));
+      const record = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
       const expectedControl = file === "hub.pid" ? "hub.stop" : file.startsWith("worker-") ? `${file.slice(0, -4)}.stop` : void 0;
       const expectedRole = file === "hub.pid" ? "hub" : file.startsWith("worker-") ? "worker" : void 0;
       if (record.version !== 1 || !Number.isInteger(record.pid) || record.pid <= 0 || !record.startedAt || !expectedControl || record.controlFile !== expectedControl || record.role !== expectedRole) {
@@ -45572,7 +45598,7 @@ async function cmdStop(runtime, waitMsFlag) {
         ignored.push(file);
         continue;
       }
-      writeFileSync23(join39(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+      writeFileSync23(join40(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `, { encoding: "utf8", mode: 384 });
       requested.push(file);
       records.set(file, { pid: record.pid, startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {} });
@@ -45590,7 +45616,7 @@ async function cmdStop(runtime, waitMsFlag) {
   while (Date.now() <= deadline && stopped.size < requested.length) {
     for (const [file, record] of records) {
       try {
-        const current = JSON.parse(readFileSync30(join39(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
         if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.generation !== record.generation || !processExists(record.pid)) stopped.add(file);
       } catch {
         stopped.add(file);
@@ -45603,7 +45629,7 @@ async function cmdStop(runtime, waitMsFlag) {
   for (const file of orphans) {
     while (Date.now() <= deadlineOrphans) {
       try {
-        const current = JSON.parse(readFileSync30(join39(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
         if (!Number.isInteger(current.serverPid) || !processExists(current.serverPid)) break;
       } catch {
         break;
@@ -45611,14 +45637,14 @@ async function cmdStop(runtime, waitMsFlag) {
       await (runtime.io.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms))))(100);
     }
     try {
-      const current = JSON.parse(readFileSync30(join39(runtime.dirs.state, file), "utf8"));
+      const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
       if (Number.isInteger(current.serverPid) && processExists(current.serverPid)) {
         try {
           process.kill(current.serverPid, "SIGKILL");
         } catch {
         }
       }
-      rmSync10(join39(runtime.dirs.state, file), { force: true });
+      rmSync10(join40(runtime.dirs.state, file), { force: true });
     } catch {
     }
     stopped.add(file);
@@ -45633,7 +45659,7 @@ async function cmdSessionStatus(runtime) {
   const claims = [];
   for (const file of names3.filter((name) => name.endsWith(".pid"))) {
     try {
-      const record = JSON.parse(readFileSync30(join39(stateDir, file), "utf8"));
+      const record = JSON.parse(readFileSync31(join40(stateDir, file), "utf8"));
       claims.push({
         file,
         role: record.role,
@@ -45648,7 +45674,7 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync30(join39(stateDir, file), "utf8"));
+      const envelope = JSON.parse(readFileSync31(join40(stateDir, file), "utf8"));
       recoveries.push({
         file,
         reason: envelope.reason,
@@ -45753,7 +45779,7 @@ async function cmdSessionBrief(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: true, command: "session brief", sessionToken }, sessionToken);
     return 0;
   }
-  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join39(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join40(runtime.dirs.state, "kxm.db"));
   const env = {
     ...runtime.env,
     KXM_STATE_DIR: runtime.dirs.state,
@@ -45845,16 +45871,16 @@ async function cmdSessionStart(runtime, options) {
 // plugins/kxm/src/cli/system.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync36, mkdtempSync as mkdtempSync2, readFileSync as readFileSync35, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync36, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync12 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join45, resolve as resolve29 } from "node:path";
+import { join as join46, resolve as resolve29 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // plugins/kxm/src/improve.ts
 import { createHash as createHash15 } from "node:crypto";
 import { existsSync as existsSync31, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join40, relative as relative6, resolve as resolve26 } from "node:path";
+import { join as join41, relative as relative6, resolve as resolve26 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
 var IMPROVEMENT_REPORT_SCHEMA = "kxm.improvement-report.v2";
 function classifyCandidateKind(stepId, agentRole) {
@@ -46026,7 +46052,7 @@ function groupRoutingRecords(records, options = {}) {
 }
 function buildImprovementReport(records, options = {}) {
   const projectRoot = options.projectRoot ? resolve26(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve26(options.candidatesDir) : join40(projectRoot, ".kxm", "candidates");
+  const candidatesDir = options.candidatesDir ? resolve26(options.candidatesDir) : join41(projectRoot, ".kxm", "candidates");
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
   for (const group of groups) {
@@ -46038,7 +46064,7 @@ function buildImprovementReport(records, options = {}) {
       group.workflowHash
     );
     const diffFileName = `${group.candidateId}.diff`;
-    const diffFilePath = join40(candidatesDir, diffFileName);
+    const diffFilePath = join41(candidatesDir, diffFileName);
     const relDiffPath = relative6(projectRoot, diffFilePath).replace(/\\/g, "/");
     const candidate = {
       schema: CANDIDATE_SCHEMA,
@@ -46064,7 +46090,7 @@ function buildImprovementReport(records, options = {}) {
         mkdirSync26(candidatesDir, { recursive: true });
       }
       writeFileSync24(diffFilePath, diff, "utf8");
-      const jsonFilePath = join40(candidatesDir, `${group.candidateId}.json`);
+      const jsonFilePath = join41(candidatesDir, `${group.candidateId}.json`);
       writeFileSync24(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
     }
     candidates.push(candidate);
@@ -46080,7 +46106,7 @@ function buildImprovementReport(records, options = {}) {
 }
 function writeImprovementReport(improvementsDir, report2, dryRun = false) {
   const stamp = report2.createdAt.replace(/[:.]/g, "-");
-  const path4 = join40(improvementsDir, `${stamp}.json`);
+  const path4 = join41(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
     mkdirSync26(improvementsDir, { recursive: true });
     writeFileSync24(path4, `${JSON.stringify(report2, null, 2)}
@@ -46123,8 +46149,8 @@ function formatImprovementReport(report2) {
 
 // plugins/kxm/src/modes.ts
 var import_yaml17 = __toESM(require_dist(), 1);
-import { existsSync as existsSync32, readFileSync as readFileSync32 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync32, readFileSync as readFileSync33 } from "node:fs";
+import { join as join42 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -46187,12 +46213,12 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join41(projectRoot, ".kxm", "modes.yaml");
+  const modesPath = join42(projectRoot, ".kxm", "modes.yaml");
   if (!existsSync32(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
-    const raw = readFileSync32(modesPath, "utf8");
+    const raw = readFileSync33(modesPath, "utf8");
     const parsed = (0, import_yaml17.parse)(raw);
     if (parsed && parsed.schema === "kxm.modes.v1" && parsed.majorModes) {
       return {
@@ -46278,11 +46304,11 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join41(projectRoot, relPath);
+    const fullPath = join42(projectRoot, relPath);
     let chars = 0;
     if (existsSync32(fullPath)) {
       try {
-        chars = readFileSync32(fullPath, "utf8").length;
+        chars = readFileSync33(fullPath, "utf8").length;
       } catch {
         chars = 0;
       }
@@ -46414,9 +46440,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync33, mkdirSync as mkdirSync27, readFileSync as readFileSync33, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join42, resolve as resolve27 } from "node:path";
+import { join as join43, resolve as resolve27 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -46442,12 +46468,12 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join42(homedir7(), ".ssh", "config");
+  const targetPath = configPath ?? join43(homedir7(), ".ssh", "config");
   if (!existsSync33(targetPath)) {
     return [];
   }
   try {
-    const content = readFileSync33(targetPath, "utf-8");
+    const content = readFileSync34(targetPath, "utf-8");
     const lines = content.split("\n");
     const hosts = [];
     let currentHosts = [];
@@ -46532,7 +46558,7 @@ function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join42(socketDir, "%C");
+  const controlPath = join43(socketDir, "%C");
   const persist = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -46557,7 +46583,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join42(resolvedDir, "%C");
+  const controlPath = join43(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -46569,7 +46595,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join42(resolvedDir, "%C");
+  const controlPath = join43(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -47015,9 +47041,9 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 }
 
 // plugins/kxm/src/completion-install.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync28, readFileSync as readFileSync34, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { basename as basename9, delimiter, dirname as dirname21, isAbsolute as isAbsolute8, join as join43, resolve as resolve28 } from "node:path";
+import { basename as basename9, delimiter, dirname as dirname21, isAbsolute as isAbsolute8, join as join44, resolve as resolve28 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -47039,25 +47065,25 @@ function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
   const base = explicit && explicit.length > 0 ? resolve28(explicit) : resolve28(effectiveHome(options), ".config", "kxm");
-  return join43(base, "completions", `kxm.${shell}`);
+  return join44(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
-  const candidates = [join43(home, ".bashrc"), join43(home, ".bash_profile")];
+  const candidates = [join44(home, ".bashrc"), join44(home, ".bash_profile")];
   const existing = candidates.find((candidate) => existsSync34(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join43(resolve28(env.ZDOTDIR.trim()), ".zshrc");
-  return join43(home, ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join44(resolve28(env.ZDOTDIR.trim()), ".zshrc");
+  return join44(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join43(resolve28(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
-  return join43(home, ".config", "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join44(resolve28(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  return join44(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
   if (shell === "fish") {
@@ -47090,12 +47116,12 @@ function installShellCompletion(shellInput, options = {}) {
   const { rcFile } = completionRcTarget(shell, options);
   const script = generateShellCompletion(shell);
   const existingScript = existsSync34(scriptPath);
-  const existingScriptMatches = existingScript && readFileSync34(scriptPath, "utf8") === script;
+  const existingScriptMatches = existingScript && readFileSync35(scriptPath, "utf8") === script;
   let rcModified = false;
   let alreadyInstalled = false;
   if (shell === "fish") {
     const fishTarget = fishCompletionTarget(shell, options);
-    const fishInstalled = existsSync34(fishTarget) && readFileSync34(fishTarget, "utf8") === script;
+    const fishInstalled = existsSync34(fishTarget) && readFileSync35(fishTarget, "utf8") === script;
     alreadyInstalled = fishInstalled;
     if (!options.dryRun && (!fishInstalled || options.overwrite)) {
       mkdirSync28(resolve28(fishTarget, ".."), { recursive: true });
@@ -47112,7 +47138,7 @@ function installShellCompletion(shellInput, options = {}) {
   }
   if (rcFile) {
     const line = sourceLine(shell, scriptPath);
-    const rcContent = existsSync34(rcFile) ? readFileSync34(rcFile, "utf8") : "";
+    const rcContent = existsSync34(rcFile) ? readFileSync35(rcFile, "utf8") : "";
     alreadyInstalled = rcContent.includes(line) || rcContent.includes(`${COMPLETION_MARKER}`);
   }
   if (!options.dryRun) {
@@ -47128,7 +47154,7 @@ ${marker}
 ${line}
 `;
       mkdirSync28(resolve28(rcFile, ".."), { recursive: true });
-      writeFileSync25(rcFile, (existsSync34(rcFile) ? readFileSync34(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
+      writeFileSync25(rcFile, (existsSync34(rcFile) ? readFileSync35(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
       rcModified = true;
     }
   }
@@ -47145,7 +47171,7 @@ function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
   if (argv1 && isAbsolute8(argv1)) {
     const dir = dirname21(argv1);
-    if (existsSync34(join43(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+    if (existsSync34(join44(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
@@ -47169,7 +47195,7 @@ function installPathEntry(shellInput, options = {}) {
   }
   const { rcFile } = completionRcTarget(shell, options);
   const line = pathLine(binDir);
-  const rcContent = existsSync34(rcFile ?? "") ? readFileSync34(rcFile, "utf8") : "";
+  const rcContent = existsSync34(rcFile ?? "") ? readFileSync35(rcFile, "utf8") : "";
   const alreadyInstalled = rcContent.includes(binDir) || (options.env?.PATH ?? process.env.PATH ?? "").split(delimiter).includes(binDir);
   if (!options.dryRun && rcFile && !alreadyInstalled) {
     mkdirSync28(dirname21(rcFile), { recursive: true });
@@ -47184,7 +47210,7 @@ ${line}
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml18 = __toESM(require_dist(), 1);
 import { existsSync as existsSync35, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname22, join as join44 } from "node:path";
+import { dirname as dirname22, join as join45 } from "node:path";
 var NATIVE_VENDOR_HARNESS = Object.freeze({
   anthropic: "claude",
   openai: "codex",
@@ -47583,13 +47609,13 @@ function renderGuideSetupFiles(projectRoot, plan) {
     const stage = roleStages.get(role);
     if (!stage) continue;
     files.push({
-      path: join44(projectRoot, ".kxm", "agents", `${role}.yaml`),
+      path: join45(projectRoot, ".kxm", "agents", `${role}.yaml`),
       content: (0, import_yaml18.stringify)(agentDocument(role, stage, binding))
     });
   }
   for (const workflow of plan.workflows) {
     files.push({
-      path: join44(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
+      path: join45(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
       content: (0, import_yaml18.stringify)(workflowDocument(workflow))
     });
   }
@@ -47668,7 +47694,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync2(join45(tmpdir2(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync2(join46(tmpdir2(), "kxm-pkg-update-"));
   try {
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset);
     if (runtime.dryRun) {
@@ -47677,7 +47703,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync36(step.path) ? createHash16("sha256").update(readFileSync35(step.path)).digest("hex") : "missing";
+          const actual = existsSync36(step.path) ? createHash16("sha256").update(readFileSync36(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -47948,7 +47974,7 @@ async function cmdValidate(runtime, fileFlag) {
     return 1;
   }
   try {
-    const raw = file ? readFileSync35(file, "utf8") : inline;
+    const raw = file ? readFileSync36(file, "utf8") : inline;
     const warnings = [];
     const definitions = parseWorkflowDefinitions(raw, runtime.env, (message) => warnings.push(message));
     const secretEnvs = definitions.map((definition) => ({
@@ -47994,13 +48020,13 @@ async function cmdArtifactsExist(runtime, pathFlag) {
 async function cmdImprove(runtime, options = {}) {
   const file = options.file ? resolve29(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
   const routingRecords = existsSync36(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
-  const candidatesDir = options.outDir ? resolve29(runtime.cwd, options.outDir) : join45(runtime.cwd, ".kxm", "candidates");
+  const candidatesDir = options.outDir ? resolve29(runtime.cwd, options.outDir) : join46(runtime.cwd, ".kxm", "candidates");
   const report2 = buildImprovementReport(routingRecords, {
     candidatesDir,
     projectRoot: runtime.cwd,
     dryRun: runtime.dryRun
   });
-  const reportDir = join45(runtime.dirs.assets, "improvements");
+  const reportDir = join46(runtime.dirs.assets, "improvements");
   const reportPath = writeImprovementReport(reportDir, report2, runtime.dryRun);
   const text = formatImprovementReport(report2);
   print(runtime.io, runtime.json, {
@@ -48134,7 +48160,7 @@ async function maybeOfferCompletionInstall(runtime) {
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
     if (rcFile && existsSync36(rcFile)) {
       try {
-        if (readFileSync35(rcFile, "utf8").includes(scriptPath)) return;
+        if (readFileSync36(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
       }
     }
@@ -48266,7 +48292,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve29(runtime.cwd, options.prices) : join45(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve29(runtime.cwd, options.prices) : join46(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }
@@ -48369,7 +48395,7 @@ function addGlobalOptions(command) {
 }
 async function ensureCliClient(runtime) {
   const serverUrl = runtime.serverUrl;
-  const project = runtime.env.KXM_PROJECT?.trim() || basename10(runtime.dirs.workspace || runtime.cwd);
+  const project = defaultProjectName(runtime.cwd, runtime.env);
   const name = runtime.env.KXM_AGENT_NAME?.trim() || `cli-${process.pid}`;
   const purpose = runtime.env.KXM_AGENT_PURPOSE?.trim() || "CLI agent client";
   const authToken = runtime.env.KXM_AUTH_TOKEN?.trim();