@kontextmind/kxm 0.7.20 → 0.7.21

package/plugins/kxm/dist/cli.js

@@ -2987,7 +2987,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve31.call(this, root, ref);
+      let _sch = resolve30.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3014,7 +3014,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve31(root, ref) {
+    function resolve30(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3839,7 +3839,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve31(baseURI, relativeURI, options) {
+    function resolve30(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4201,7 +4201,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve31,
+      resolve: resolve30,
       resolveComponent,
       equal,
       serialize,
@@ -14779,8 +14779,8 @@ var require_dist = __commonJS({
 });
 
 // plugins/kxm/src/cli.ts
-import { resolve as resolve30 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { resolve as resolve29 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -18329,6 +18329,25 @@ function planKxmPackageUpdate(source, latest, releaseDir, asset) {
   return steps;
 }
 
+// plugins/kxm/src/repo-root.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var ROOT_MARKERS = ["scripts/kxm-hub.mjs", "scripts/kxm.mjs"];
+var MAX_WALK_DEPTH = 10;
+function findKxmRepoRoot(fromUrl = import.meta.url) {
+  let dir = dirname(fileURLToPath(fromUrl));
+  for (let depth = 0; depth < MAX_WALK_DEPTH; depth += 1) {
+    if (ROOT_MARKERS.some((marker) => existsSync2(join2(dir, marker)))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `kxm: cannot locate the KXM repo root from ${fileURLToPath(fromUrl)} (walked ${MAX_WALK_DEPTH} levels looking for ${ROOT_MARKERS[0]})`
+  );
+}
+
 // plugins/kxm/src/client.ts
 import { createHash as createHash3 } from "node:crypto";
 
@@ -19427,7 +19446,7 @@ var HubClient = class {
       if (signal?.aborted) throw new MeshWaitError("aborted", messageId);
       const message = await this.getMessage(messageId);
       if (["replied", "cancelled", "expired", "error"].includes(message.status)) return message;
-      await new Promise((resolve31, reject) => {
+      await new Promise((resolve30, reject) => {
         const onAbort = () => {
           signal?.removeEventListener("abort", onAbort);
           clearTimeout(timer);
@@ -19435,7 +19454,7 @@ var HubClient = class {
         };
         const timer = setTimeout(() => {
           signal?.removeEventListener("abort", onAbort);
-          resolve31();
+          resolve30();
         }, Math.min(500, Math.max(1, deadline - Date.now())));
         signal?.addEventListener("abort", onAbort, { once: true });
         if (signal?.aborted) onAbort();
@@ -19490,7 +19509,7 @@ var HubClient = class {
       } catch (error) {
         if (this.stopped || error instanceof Error && error.name === "AbortError") return;
       }
-      if (!this.stopped) await new Promise((resolve31) => setTimeout(resolve31, this.options.reconnectMs));
+      if (!this.stopped) await new Promise((resolve30) => setTimeout(resolve30, this.options.reconnectMs));
     }
   }
   headers(includeIdentity = true) {
@@ -19573,12 +19592,12 @@ var HubClient = class {
 
 // plugins/kxm/src/project-name.ts
 import { readFileSync as readFileSync2 } from "node:fs";
-import { basename, join as join2 } from "node:path";
+import { basename, join as join3 } from "node:path";
 function defaultProjectName(cwd, env = process.env) {
   const fromEnv = env.KXM_PROJECT?.trim();
   if (fromEnv) return fromEnv;
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
     if (typeof pkg.name === "string" && pkg.name.trim().length > 0) return pkg.name.trim();
   } catch {
   }
@@ -19587,9 +19606,9 @@ function defaultProjectName(cwd, env = process.env) {
 
 // plugins/kxm/src/commands.ts
 import { createHash as createHash4, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join as join3, resolve } from "node:path";
+import { dirname as dirname2, join as join4, resolve } from "node:path";
 function requiredString(value, name) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${name} is required`);
   return value.trim();
@@ -20338,14 +20357,14 @@ function parseSessionToken(token) {
 }
 function resolveUserConfigDirectory(overrideDir) {
   if (overrideDir) return resolve(overrideDir);
-  return resolve(process.env.KXM_USER_CONFIG_DIR?.trim() || join3(homedir(), ".config", "kxm"));
+  return resolve(process.env.KXM_USER_CONFIG_DIR?.trim() || join4(homedir(), ".config", "kxm"));
 }
 function sessionTokenPath(userConfigDir) {
-  return join3(resolveUserConfigDirectory(userConfigDir), "session.token");
+  return join4(resolveUserConfigDirectory(userConfigDir), "session.token");
 }
 function persistSessionTokenToDisk(token, options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  const dir = dirname(filePath);
+  const dir = dirname2(filePath);
   mkdirSync2(dir, { recursive: true, mode: 448 });
   const mode = options?.mode ?? 384;
   writeFileSync2(filePath, `${token.trim()}
@@ -20358,7 +20377,7 @@ function persistSessionTokenToDisk(token, options) {
 }
 function readSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  if (!existsSync2(filePath)) return void 0;
+  if (!existsSync3(filePath)) return void 0;
   try {
     const token = readFileSync3(filePath, "utf8").trim();
     if (!token) return void 0;
@@ -20371,7 +20390,7 @@ function readSessionTokenFromDisk(options) {
 }
 function clearSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  if (!existsSync2(filePath)) return false;
+  if (!existsSync3(filePath)) return false;
   try {
     unlinkSync(filePath);
     return true;
@@ -20470,7 +20489,7 @@ function enforceToolPolicy(commandName, env = process.env, options) {
     return { allowed: true };
   }
   const tokenFile = sessionTokenPath(env.KXM_USER_CONFIG_DIR);
-  if (existsSync2(tokenFile)) {
+  if (existsSync3(tokenFile)) {
     let tokenRaw;
     try {
       tokenRaw = readFileSync3(tokenFile, "utf8").trim();
@@ -20497,9 +20516,8 @@ function enforceToolPolicy(commandName, env = process.env, options) {
 var import__ = __toESM(require__(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, readdirSync, realpathSync } from "node:fs";
-import { basename as basename2, dirname as dirname2, extname, isAbsolute, join as join4, relative, resolve as resolve2, sep } from "node:path";
-import { fileURLToPath } from "node:url";
+import { existsSync as existsSync5, lstatSync, readFileSync as readFileSync4, readdirSync, realpathSync } from "node:fs";
+import { basename as basename2, dirname as dirname3, extname, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "node:path";
 
 // plugins/kxm/src/restricted-yaml.mjs
 var import_yaml = __toESM(require_dist(), 1);
@@ -20827,7 +20845,7 @@ function resolveVnextTemplateBaseline(value) {
 
 // plugins/kxm/src/vnext-harness.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { win32 as win32Path } from "node:path";
 
 // plugins/kxm/src/vnext-oneshot-process.ts
@@ -20853,7 +20871,7 @@ function defaultSpawn(command, args, options) {
   if (options.signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: null, started: false, observedChildExit: false, error: new Error("process_aborted") });
   }
-  return new Promise((resolve31) => {
+  return new Promise((resolve30) => {
     const stdout = [];
     const stderr = [];
     let outputBytes = 0;
@@ -20884,7 +20902,7 @@ function defaultSpawn(command, args, options) {
       const started = Boolean(child?.pid);
       if (started && !observedChildExit) error ??= new Error("process_exit_unobserved");
       const unverifiedDescendants = stopping || started && !observedChildExit;
-      resolve31({
+      resolve30({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         code,
@@ -21376,7 +21394,7 @@ function findWinNpmInnerExe(cliId, options = {}) {
   if ((options.platform ?? process.platform) !== "win32") return void 0;
   const segments = WIN_NPM_INNER_EXE[cliId];
   if (!segments) return void 0;
-  const exists = options.existsSync ?? existsSync3;
+  const exists = options.existsSync ?? existsSync4;
   const pathEnv = options.pathEnv ?? process.env.PATH ?? "";
   for (const dir of pathEnv.split(";").filter(Boolean)) {
     if (!exists(win32Path.join(dir, `${cliId}.cmd`))) continue;
@@ -21893,8 +21911,10 @@ var VnextConfigError = class extends Error {
     this.issues = sorted;
   }
 };
-var PACKAGE_ROOT = resolve2(dirname2(fileURLToPath(import.meta.url)), "../../..");
-var DEFAULT_SCHEMA_DIR = join4(PACKAGE_ROOT, "schemas", "vnext");
+function defaultVnextSchemaDir() {
+  return join5(findKxmRepoRoot(import.meta.url), "schemas", "vnext");
+}
+var DEFAULT_SCHEMA_DIR = defaultVnextSchemaDir();
 var RESOURCE_SCHEMA = Object.freeze({
   project: { identity: "kxm.project.v1", file: "project.schema.json" },
   repository: { identity: "kxm.repository.v1", file: "repository.schema.json" },
@@ -21959,10 +21979,10 @@ var VnextSchemaRegistry = class {
   constructor(schemasDir = DEFAULT_SCHEMA_DIR) {
     this.schemasDir = resolve2(schemasDir);
     this.ajv = new import__.Ajv2020({ allErrors: true, strict: true, strictRequired: false });
-    const common = readJsonObject(join4(this.schemasDir, "common.schema.json"));
+    const common = readJsonObject(join5(this.schemasDir, "common.schema.json"));
     this.ajv.addSchema(common);
     for (const definition of Object.values(RESOURCE_SCHEMA)) {
-      this.ajv.addSchema(readJsonObject(join4(this.schemasDir, definition.file)));
+      this.ajv.addSchema(readJsonObject(join5(this.schemasDir, definition.file)));
     }
     const localBindingsFile = "local-repository-bindings.schema.json";
     const templateProvenanceFile = "template-provenance.schema.json";
@@ -21972,14 +21992,14 @@ var VnextSchemaRegistry = class {
     const migrationReceiptFile = "migration-receipt.schema.json";
     const permissionDiffFile = "permission-diff.schema.json";
     const runEventFile = "run-event.schema.json";
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, localBindingsFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, templateProvenanceFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, initOperationFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationPlanFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationDecisionFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, migrationReceiptFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, permissionDiffFile)));
-    this.ajv.addSchema(readJsonObject(join4(this.schemasDir, runEventFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, localBindingsFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, templateProvenanceFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, initOperationFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, migrationPlanFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, migrationDecisionFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, migrationReceiptFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, permissionDiffFile)));
+    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, runEventFile)));
     for (const [kind, definition] of Object.entries(RESOURCE_SCHEMA)) {
       const validator = this.ajv.getSchema(`https://schemas.kxm.dev/vnext/${definition.file}`);
       if (!validator) throw new Error(`schema did not compile: ${definition.file}`);
@@ -22074,15 +22094,15 @@ function containedHostPath(root, candidate) {
 function portableBindingIssue(root, pathHint, repositoryId) {
   let current = root;
   for (const segment of pathHint === "." ? [] : pathHint.split("/")) {
-    current = join4(current, segment);
-    if (!existsSync4(current)) break;
+    current = join5(current, segment);
+    if (!existsSync5(current)) break;
     const stat = lstatSync(current);
     if (stat.isSymbolicLink()) {
       return issue2("path", "repository_binding_path_link", ".kxm/project.yaml", `portable pathHint for ${repositoryId} traverses a symbolic link or junction`);
     }
   }
   const binding = resolve2(root, ...pathHint.split("/"));
-  if (existsSync4(binding)) {
+  if (existsSync5(binding)) {
     const realRoot = canonicalHostPath(root);
     const realBinding = canonicalHostPath(binding);
     if (!containedHostPath(realRoot, realBinding)) {
@@ -22120,9 +22140,9 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
   }
   if (stat.isSymbolicLink()) fail2("path", "resource_symlink", label, "configuration resources must not be symbolic links");
   const boundary = resolve2(containmentRoot);
-  let parent = dirname2(file);
+  let parent = dirname3(file);
   while (parent !== boundary) {
-    if (parent === dirname2(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
+    if (parent === dirname3(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
     let parentStat;
     try {
       parentStat = lstatSync(parent);
@@ -22130,7 +22150,7 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
       fail2("discovery", "resource_parent_missing", label, "resource parent does not exist");
     }
     if (parentStat.isSymbolicLink()) fail2("path", "resource_parent_symlink", label, "configuration resource parents must not be symbolic links");
-    parent = dirname2(parent);
+    parent = dirname3(parent);
   }
   if (!stat.isFile()) fail2("path", "resource_not_file", label, "configuration resource must be a regular file");
   const value = parseRestrictedYaml2(readFileSync4(file), label);
@@ -22139,22 +22159,22 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
   return { kind, ...id === void 0 ? {} : { id }, file, logicalPath, value };
 }
 function readTemplateProvenance(registry, root) {
-  const file = join4(root, ".kxm", "template-provenance.yaml");
-  if (!existsSync4(file)) return void 0;
+  const file = join5(root, ".kxm", "template-provenance.yaml");
+  if (!existsSync5(file)) return void 0;
   const label = ".kxm/template-provenance.yaml";
   const stat = lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     fail2("path", "resource_not_file", label, "template provenance must be a regular file, not a link or directory");
   }
-  const configRoot = join4(root, ".kxm");
-  let parent = dirname2(file);
+  const configRoot = join5(root, ".kxm");
+  let parent = dirname3(file);
   while (parent !== root) {
     const parentStat = lstatSync(parent);
     if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
       fail2("path", "resource_parent_symlink", label, "template provenance parents must be regular directories");
     }
     if (parent === configRoot) break;
-    parent = dirname2(parent);
+    parent = dirname3(parent);
   }
   const value = parseRestrictedYaml2(readFileSync4(file), label);
   const issues = registry.validateTemplateProvenance(value, label);
@@ -22187,7 +22207,7 @@ function readTemplateProvenance(registry, root) {
 }
 function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const resources = /* @__PURE__ */ new Map();
-  if (!existsSync4(directory)) return resources;
+  if (!existsSync5(directory)) return resources;
   const stat = lstatSync(directory);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     fail2("path", "resource_directory_invalid", displayPath(root, directory), "resource directory must be a regular directory");
@@ -22196,27 +22216,27 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => compareCodeUnits3(left.name, right.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join4(directory, entry.name)), "nested resource directories are not allowed"));
+      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join5(directory, entry.name)), "nested resource directories are not allowed"));
       continue;
     }
     if (!entry.name.toLowerCase().endsWith(".yaml") && !entry.name.toLowerCase().endsWith(".yml")) continue;
     if (!entry.isFile() || extname(entry.name) !== ".yaml") {
-      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join4(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
+      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join5(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
       continue;
     }
     const id = basename2(entry.name, ".yaml");
     if (kind === "model" && id === "inventory") continue;
     if (!resourceIdentifier(id)) {
-      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join4(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
+      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join5(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
       continue;
     }
     const collision = [...resources.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) {
-      issues.push(issue2("path", "resource_id_collision", displayPath(root, join4(directory, entry.name)), `${id} case-folds to existing ${collision}`));
+      issues.push(issue2("path", "resource_id_collision", displayPath(root, join5(directory, entry.name)), `${id} case-folds to existing ${collision}`));
       continue;
     }
     try {
-      const resource = readResource(registry, root, join4(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
+      const resource = readResource(registry, root, join5(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
       resources.set(id, resource);
     } catch (error) {
       if (error instanceof VnextConfigError) issues.push(...error.issues);
@@ -22537,8 +22557,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue2("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join48 = objectValue(step.join);
-    const minimumPassed = join48 && typeof join48.minimumPassed === "number" ? join48.minimumPassed : void 0;
+    const join49 = objectValue(step.join);
+    const minimumPassed = join49 && typeof join49.minimumPassed === "number" ? join49.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue2("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -22752,9 +22772,9 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (!workflows.has(defaultWorkflow)) issues.push(issue2("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
   if (projectRoot) {
-    const writerRolePath = join4(projectRoot, ".kxm", "roles", "writer.yaml");
+    const writerRolePath = join5(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync4(writerRolePath) && implementerAgent) {
+    if (existsSync5(writerRolePath) && implementerAgent) {
       try {
         const rawRole = parseRestrictedYaml2(readFileSync4(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
@@ -22803,7 +22823,7 @@ function gitEnvironment() {
 }
 function discoverGitRoot(start = process.cwd()) {
   let current = resolve2(start);
-  if (existsSync4(current) && !lstatSync(current).isDirectory()) current = dirname2(current);
+  if (existsSync5(current) && !lstatSync(current).isDirectory()) current = dirname3(current);
   const result = spawnSync2("git", ["-C", current, "rev-parse", "--show-toplevel"], {
     encoding: "utf8",
     env: gitEnvironment(),
@@ -22812,11 +22832,11 @@ function discoverGitRoot(start = process.cwd()) {
   });
   if (result.status !== 0 || result.error || !result.stdout.trim()) return void 0;
   const root = resolve2(result.stdout.trim());
-  return existsSync4(root) && lstatSync(root).isDirectory() ? root : void 0;
+  return existsSync5(root) && lstatSync(root).isDirectory() ? root : void 0;
 }
 function discoverVnextProjectRoot(start = process.cwd()) {
   const gitRoot = discoverGitRoot(start);
-  return gitRoot && existsSync4(join4(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
+  return gitRoot && existsSync5(join5(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
 }
 function assertNoRegisteredGates(options) {
   if ("registeredGates" in options) {
@@ -22833,7 +22853,7 @@ function loadVnextProject(projectRoot, options = {}) {
     migrationReceipt = receiptCheck.receipt;
   }
   const registry = new VnextSchemaRegistry(options.schemasDir);
-  const project = readResource(registry, root, join4(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
+  const project = readResource(registry, root, join5(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
   const earlyIssues = [];
   validatePortablePaths(project, earlyIssues);
   const templateProvenance = readTemplateProvenance(registry, root);
@@ -22855,16 +22875,16 @@ function loadVnextProject(projectRoot, options = {}) {
     }
   }
   if (earlyIssues.length > 0) throw new VnextConfigError(earlyIssues);
-  const agents = listNamedResources(registry, root, join4(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join4(root, ".kxm", "models"), ".kxm/models", "model");
-  const workflows = listNamedResources(registry, root, join4(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
-  const gatePath = join4(root, ".kxm", "gates.yaml");
-  const gateRegistry = existsSync4(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
+  const agents = listNamedResources(registry, root, join5(root, ".kxm", "agents"), ".kxm/agents", "agent");
+  const models = listNamedResources(registry, root, join5(root, ".kxm", "models"), ".kxm/models", "model");
+  const workflows = listNamedResources(registry, root, join5(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
+  const gatePath = join5(root, ".kxm", "gates.yaml");
+  const gateRegistry = existsSync5(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
   const environments = [];
   const repositories = /* @__PURE__ */ new Map();
   const loadIssues = [];
-  const projectEnvironment = join4(root, ".kxm", "project", "env.yaml");
-  if (existsSync4(projectEnvironment)) {
+  const projectEnvironment = join5(root, ".kxm", "project", "env.yaml");
+  if (existsSync5(projectEnvironment)) {
     try {
       environments.push(readResource(registry, root, projectEnvironment, ".kxm/project/env.yaml", "environment"));
     } catch (error) {
@@ -22906,7 +22926,7 @@ function loadVnextProject(projectRoot, options = {}) {
       if (required) loadIssues.push(issue2("discovery", "repository_binding_missing", ".kxm/project.yaml", `required repository ${repositoryId} has no portable pathHint or host-local binding`));
       continue;
     }
-    if (!existsSync4(binding)) {
+    if (!existsSync5(binding)) {
       if (required || hasLocalBinding) loadIssues.push(issue2("discovery", "repository_binding_unavailable", ".kxm/project.yaml", `${hasLocalBinding ? "explicit" : "required"} repository binding ${repositoryId} is unavailable`));
       continue;
     }
@@ -22929,9 +22949,9 @@ function loadVnextProject(projectRoot, options = {}) {
       continue;
     }
     seenBindings.set(foldedBinding, repositoryId);
-    const repositoryFile = join4(binding, ".kxm", "repo", "repo.yaml");
+    const repositoryFile = join5(binding, ".kxm", "repo", "repo.yaml");
     let definitionValidated = false;
-    if (existsSync4(repositoryFile)) {
+    if (existsSync5(repositoryFile)) {
       try {
         const resource = readResource(registry, root, repositoryFile, `.kxm/repositories/${repositoryId}/repo.yaml`, "repository", repositoryId, binding);
         if (resource.value.repositoryId !== repositoryId) {
@@ -22947,8 +22967,8 @@ function loadVnextProject(projectRoot, options = {}) {
     } else if (required || hasLocalBinding) {
       loadIssues.push(issue2("discovery", "repository_definition_missing", `.kxm/repositories/${repositoryId}/repo.yaml`, `${hasLocalBinding ? "explicit" : "required"} repository ${repositoryId} has no repo.yaml`));
     }
-    const environmentFile = join4(binding, ".kxm", "repo", "env.yaml");
-    if (existsSync4(environmentFile)) {
+    const environmentFile = join5(binding, ".kxm", "repo", "env.yaml");
+    if (existsSync5(environmentFile)) {
       if (!definitionValidated) {
         loadIssues.push(issue2("reference", "repository_environment_without_definition", `.kxm/repositories/${repositoryId}/env.yaml`, `repository ${repositoryId} environment requires a validated matching repo.yaml`));
       } else {
@@ -23026,21 +23046,21 @@ function legacyInputsAt(root) {
     ".kxm/config/workflows",
     ".kxm/state/kxm.db"
   ];
-  return candidates.filter((candidate) => existsSync4(join4(root, ...candidate.split("/"))));
+  return candidates.filter((candidate) => existsSync5(join5(root, ...candidate.split("/"))));
 }
 var VNEXT_MIGRATION_RECEIPT_PATH = ".kxm/migration-receipt.yaml";
 var LEGACY_CONFIG_FILES = [".kxm/config/agents.json", ".kxm/config/gates.json"];
 function legacyConfigFilesAt(root) {
   const files = [];
   for (const component of [".kxm", ".kxm/config"]) {
-    const absolute = join4(root, ...component.split("/"));
-    if (existsSync4(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
+    const absolute = join5(root, ...component.split("/"));
+    if (existsSync5(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
   }
   for (const candidate of LEGACY_CONFIG_FILES) {
-    if (existsSync4(join4(root, ...candidate.split("/")))) files.push(candidate);
+    if (existsSync5(join5(root, ...candidate.split("/")))) files.push(candidate);
   }
-  const workflowsDir = join4(root, ".kxm", "config", "workflows");
-  if (existsSync4(workflowsDir)) {
+  const workflowsDir = join5(root, ".kxm", "config", "workflows");
+  if (existsSync5(workflowsDir)) {
     const stat = lstatSync(workflowsDir);
     if (stat.isSymbolicLink()) {
       files.push(".kxm/config/workflows");
@@ -23055,8 +23075,8 @@ function legacyConfigFilesAt(root) {
   return files;
 }
 function hashFileRecord(root, relativePath) {
-  const absolute = join4(root, ...relativePath.split("/"));
-  if (!existsSync4(absolute)) return void 0;
+  const absolute = join5(root, ...relativePath.split("/"));
+  if (!existsSync5(absolute)) return void 0;
   const bytes = readFileSync4(absolute);
   return {
     path: relativePath,
@@ -23069,9 +23089,9 @@ function migrationReceiptSelfHash(receipt) {
   return `sha256:${createHash6("sha256").update(vnextCanonicalJson(unsigned), "utf8").digest("hex")}`;
 }
 function readVnextMigrationReceipt(root, options = {}) {
-  const receiptPath = join4(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  const receiptPath = join5(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
   const legacyFiles = legacyConfigFilesAt(root);
-  if (!existsSync4(receiptPath)) {
+  if (!existsSync5(receiptPath)) {
     return {
       issues: legacyFiles.map((file) => issue2("semantic", "legacy_vnext_conflict", file, "legacy and vNext configuration cannot coexist before an accepted migration receipt"))
     };
@@ -23116,7 +23136,7 @@ function readVnextMigrationReceipt(root, options = {}) {
 }
 function discoverLegacyRoot(start) {
   let initial = resolve2(start);
-  if (existsSync4(initial) && !lstatSync(initial).isDirectory()) initial = dirname2(initial);
+  if (existsSync5(initial) && !lstatSync(initial).isDirectory()) initial = dirname3(initial);
   const candidate = discoverGitRoot(initial) ?? initial;
   const inputs = legacyInputsAt(candidate);
   return inputs.length > 0 ? { root: candidate, inputs } : void 0;
@@ -23143,7 +23163,7 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
   }
   const gitRoot = discoverGitRoot(inspectedFrom);
   const candidateRoot = gitRoot ?? inspectedFrom;
-  if (existsSync4(join4(candidateRoot, ".kxm"))) {
+  if (existsSync5(join5(candidateRoot, ".kxm"))) {
     return {
       mode: "repair",
       inspectedFrom,
@@ -23159,14 +23179,13 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join10, resolve as resolve7 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { chmodSync as chmodSync4, existsSync as existsSync11, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join11 } from "node:path";
 
 // plugins/kxm/src/vnext-runtime-store.ts
 import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, realpathSync as realpathSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join7, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, realpathSync as realpathSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname6, join as join8, resolve as resolve5 } from "node:path";
 
 // plugins/kxm/src/vnext-bindings.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -23174,7 +23193,7 @@ import { createHash as createHash7, randomUUID as randomUUID3 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   closeSync,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   fsyncSync,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync3,
@@ -23227,7 +23246,7 @@ var DatabaseSync = class {
 };
 
 // plugins/kxm/src/vnext-bindings.ts
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, parse, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join6, parse, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
 var activeLocks = /* @__PURE__ */ new WeakSet();
@@ -23261,12 +23280,12 @@ function vnextUserStateRoot(options = {}) {
   }
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join5(home, "AppData", "Local");
+    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join6(home, "AppData", "Local");
     return resolve3(base2, "KXM");
   }
   if (platform === "darwin") return resolve3(home, "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join5(home, ".local", "state");
+  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join6(home, ".local", "state");
   return resolve3(base, "kxm");
 }
 function projectBindingKey(projectRoot, platform = process.platform) {
@@ -23276,10 +23295,10 @@ function projectBindingKey(projectRoot, platform = process.platform) {
 }
 function vnextLocalBindingFile(projectRoot, options = {}) {
   const stateRoot = vnextUserStateRoot(options);
-  return join5(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
+  return join6(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
 }
 function checkedDirectory(path4, description) {
-  if (!existsSync5(path4)) return false;
+  if (!existsSync6(path4)) return false;
   const stat = lstatSync2(path4);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     bindingError("path", "local_binding_directory_invalid", `${description} must be a regular directory, not a link or file`);
@@ -23287,8 +23306,8 @@ function checkedDirectory(path4, description) {
   return true;
 }
 function existingBindingDirectory(file, stateRoot) {
-  const projects = join5(stateRoot, "projects");
-  const project = dirname3(file);
+  const projects = join6(stateRoot, "projects");
+  const project = dirname4(file);
   if (!checkedDirectory(stateRoot, "local state root")) return false;
   if (!checkedDirectory(projects, "local projects directory")) return false;
   return checkedDirectory(project, "local project binding directory");
@@ -23314,7 +23333,7 @@ function readVnextLocalBindings(projectRoot, options = {}) {
   const root = resolve3(projectRoot);
   const stateRoot = vnextUserStateRoot(options);
   const file = vnextLocalBindingFile(root, options);
-  if (!existingBindingDirectory(file, stateRoot) || !existsSync5(file)) return void 0;
+  if (!existingBindingDirectory(file, stateRoot) || !existsSync6(file)) return void 0;
   const stat = lstatSync2(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     bindingError("path", "local_binding_file_invalid", "binding record must be a regular file, not a link or directory");
@@ -23362,10 +23381,10 @@ function syncDirectory(path4) {
   }
 }
 function createDirectoryIfMissing(path4) {
-  if (existsSync5(path4)) return;
+  if (existsSync6(path4)) return;
   try {
     mkdirSync3(path4, { mode: 448 });
-    syncDirectory(dirname3(path4));
+    syncDirectory(dirname4(path4));
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
   }
@@ -23373,9 +23392,9 @@ function createDirectoryIfMissing(path4) {
 function ensureDurableDirectory(path4, description) {
   const missing = [];
   let current = resolve3(path4);
-  while (!existsSync5(current)) {
+  while (!existsSync6(current)) {
     missing.push(current);
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current) bindingError("path", "local_binding_directory_invalid", `${description} has no existing filesystem ancestor`);
     current = parent;
   }
@@ -23383,17 +23402,17 @@ function ensureDurableDirectory(path4, description) {
   for (const directory of missing.reverse()) {
     mkdirSync3(directory, { mode: 448 });
     checkedDirectory(directory, description);
-    syncDirectory(dirname3(directory));
+    syncDirectory(dirname4(directory));
   }
 }
 function ensureBindingDirectory(file, stateRoot) {
   ensureDurableDirectory(stateRoot, "local state root");
   checkedDirectory(stateRoot, "local state root");
   syncDirectory(stateRoot);
-  const projects = join5(stateRoot, "projects");
+  const projects = join6(stateRoot, "projects");
   createDirectoryIfMissing(projects);
   checkedDirectory(projects, "local projects directory");
-  const project = dirname3(file);
+  const project = dirname4(file);
   createDirectoryIfMissing(project);
   checkedDirectory(project, "local project binding directory");
 }
@@ -23403,7 +23422,7 @@ function assertNoLinkedDirectoryComponents(path4, description) {
   let current = filesystemRoot;
   const remainder = relative2(filesystemRoot, absolute);
   for (const segment of remainder.split(sep2).filter(Boolean)) {
-    current = join5(current, segment);
+    current = join6(current, segment);
     const stat = lstatSync2(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", `${description} contains a linked or non-directory component`);
@@ -23430,8 +23449,8 @@ function projectOperationLockFile(projectRoot) {
   if (gitStat.isSymbolicLink() || !gitStat.isDirectory()) {
     bindingError("path", "project_operation_lock_parent_invalid", "authoritative Git metadata must resolve to a regular directory");
   }
-  const lockDirectory = join5(gitDirectory, "kxm");
-  if (existsSync5(lockDirectory)) {
+  const lockDirectory = join6(gitDirectory, "kxm");
+  if (existsSync6(lockDirectory)) {
     const stat = lstatSync2(lockDirectory);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", "Git-local KXM lock directory must be regular, not a link or file");
@@ -23440,12 +23459,12 @@ function projectOperationLockFile(projectRoot) {
     mkdirSync3(lockDirectory, { mode: 448 });
     syncDirectory(gitDirectory);
   }
-  return join5(lockDirectory, "project-operation-lock.sqlite");
+  return join6(lockDirectory, "project-operation-lock.sqlite");
 }
 function withVnextLocalBindingLock(projectRoot, options, callback) {
   const root = resolve3(projectRoot);
   const file = projectOperationLockFile(root);
-  if (existsSync5(file)) {
+  if (existsSync6(file)) {
     const stat = lstatSync2(file);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       bindingError("path", "local_binding_lock_invalid", "project-operation lock must be a regular file, not a link or directory");
@@ -23499,7 +23518,7 @@ function writeVnextLocalBindings(projectRoot, projectId, repositories, options =
   const { file, record } = planned;
   if (!planned.written) return planned;
   ensureBindingDirectory(file, vnextUserStateRoot(options));
-  const temporary = join5(dirname3(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
+  const temporary = join6(dirname4(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
   let descriptor;
   try {
     descriptor = openSync(temporary, "wx", 384);
@@ -23509,7 +23528,7 @@ function writeVnextLocalBindings(projectRoot, projectId, repositories, options =
     closeSync(descriptor);
     descriptor = void 0;
     renameSync(temporary, file);
-    syncDirectory(dirname3(file));
+    syncDirectory(dirname4(file));
   } finally {
     if (descriptor !== void 0) closeSync(descriptor);
     rmSync(temporary, { force: true });
@@ -23526,7 +23545,7 @@ import { createHash as createHash8, randomBytes } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   copyFileSync,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
@@ -23534,14 +23553,14 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { basename as basename3, dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join7, resolve as resolve4 } from "node:path";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new VnextConfigError([issue3]);
 }
 function checkedParent(path4, description) {
-  const parent = dirname4(path4);
-  if (!existsSync6(parent)) mkdirSync4(parent, { recursive: true, mode: 448 });
+  const parent = dirname5(path4);
+  if (!existsSync7(parent)) mkdirSync4(parent, { recursive: true, mode: 448 });
   const stat = lstatSync3(parent, { throwIfNoEntry: false });
   if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
     throw databaseError("runtime_path_invalid", description, `${description} parent must be a regular directory, not a link`);
@@ -23694,7 +23713,7 @@ function backupDatabaseFile(sourcePath, targetPath, storeId) {
     throw databaseError("runtime_path_invalid", resolvedSource, `source database ${resolvedSource} must be a regular file, not a link or directory`);
   }
   checkedParent(resolvedTarget, "backup target");
-  if (existsSync6(resolvedTarget)) {
+  if (existsSync7(resolvedTarget)) {
     unlinkSync2(resolvedTarget);
   }
   const sourceDb = new DatabaseSync(resolvedSource);
@@ -23772,7 +23791,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   }
   checkedParent(resolvedTarget, "restore target");
   for (const file of [resolvedTarget, `${resolvedTarget}-wal`, `${resolvedTarget}-shm`]) {
-    if (existsSync6(file)) {
+    if (existsSync7(file)) {
       try {
         unlinkSync2(file);
       } catch {
@@ -23804,27 +23823,27 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
 function discoverProjectStores(projectRoot, options = {}) {
   const root = resolve4(projectRoot);
   const stores = [];
-  const hubPath = options.hubDataPath ? resolve4(options.hubDataPath) : join6(root, ".kxm", "state", "kxm.db");
-  if (existsSync6(hubPath)) {
+  const hubPath = options.hubDataPath ? resolve4(options.hubDataPath) : join7(root, ".kxm", "state", "kxm.db");
+  if (existsSync7(hubPath)) {
     stores.push({ storeId: "hub-store", sourcePath: hubPath, maxSupportedVersion: 3 });
   }
-  const registryPath = join6(root, ".kxm", "runtime", "registry.db");
-  if (existsSync6(registryPath)) {
+  const registryPath = join7(root, ".kxm", "runtime", "registry.db");
+  if (existsSync7(registryPath)) {
     stores.push({ storeId: "registry", sourcePath: registryPath, maxSupportedVersion: 1 });
   }
-  const bindingsPath = join6(root, ".kxm", "runtime", "bindings.db");
-  if (existsSync6(bindingsPath)) {
+  const bindingsPath = join7(root, ".kxm", "runtime", "bindings.db");
+  if (existsSync7(bindingsPath)) {
     stores.push({ storeId: "binding-store", sourcePath: bindingsPath, maxSupportedVersion: 1 });
   }
-  const eventsDir = join6(root, ".kxm", "runtime", "events");
-  if (existsSync6(eventsDir)) {
+  const eventsDir = join7(root, ".kxm", "runtime", "events");
+  if (existsSync7(eventsDir)) {
     const entries = readdirSync2(eventsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".db")) {
         const key = entry.name.replace(/\.db$/, "");
         stores.push({
           storeId: `events:${key}`,
-          sourcePath: join6(eventsDir, entry.name),
+          sourcePath: join7(eventsDir, entry.name),
           maxSupportedVersion: 3
         });
       }
@@ -23843,8 +23862,8 @@ function createBackup(options = {}) {
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-");
   const backupId = `bk_${randomBytes(8).toString("hex")}`;
-  const outDir = options.outDir ? resolve4(options.outDir) : join6(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
-  if (!existsSync6(outDir)) {
+  const outDir = options.outDir ? resolve4(options.outDir) : join7(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
+  if (!existsSync7(outDir)) {
     mkdirSync4(outDir, { recursive: true, mode: 448 });
   }
   const backedUpStores = [];
@@ -23856,7 +23875,7 @@ function createBackup(options = {}) {
       filename = `${sanitizedId}-${filename}`;
     }
     usedFilenames.add(filename);
-    const targetFile2 = join6(outDir, filename);
+    const targetFile2 = join7(outDir, filename);
     const record = backupDatabaseFile(store.sourcePath, targetFile2, store.storeId);
     backedUpStores.push(record);
   }
@@ -23871,7 +23890,7 @@ function createBackup(options = {}) {
   const manifestSha256 = `sha256:${createHash8("sha256").update(manifestJson, "utf8").digest("hex")}`;
   manifest.manifestSha256 = manifestSha256;
   const finalJson = JSON.stringify(manifest, null, 2) + "\n";
-  const manifestPath = join6(outDir, "manifest.json");
+  const manifestPath = join7(outDir, "manifest.json");
   writeFileSync4(manifestPath, finalJson, "utf8");
   return { manifest, outDir };
 }
@@ -23882,12 +23901,12 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     throw databaseError("runtime_path_invalid", manifestPath, `manifest path ${manifestPath} does not exist`);
   }
   if (stat.isDirectory()) {
-    manifestPath = join6(manifestPath, "manifest.json");
+    manifestPath = join7(manifestPath, "manifest.json");
   }
-  if (!existsSync6(manifestPath)) {
+  if (!existsSync7(manifestPath)) {
     throw databaseError("runtime_path_invalid", manifestPath, `backup manifest ${manifestPath} not found`);
   }
-  const manifestDir = dirname4(manifestPath);
+  const manifestDir = dirname5(manifestPath);
   const rawText = readFileSync6(manifestPath, "utf8");
   let manifest;
   try {
@@ -23900,8 +23919,8 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   }
   const restoredStores = [];
   for (const store of manifest.stores) {
-    const backupFilePath = join6(manifestDir, store.backupFile);
-    if (!existsSync6(backupFilePath)) {
+    const backupFilePath = join7(manifestDir, store.backupFile);
+    if (!existsSync7(backupFilePath)) {
       throw databaseError("restore_file_missing", backupFilePath, `backup file ${store.backupFile} missing from ${manifestDir}`);
     }
     const actualSha256 = fileSha256(backupFilePath);
@@ -23919,7 +23938,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
       const rel = targetPath.slice(manifest.projectRoot.length).replace(/^[\\/]+/, "");
-      targetPath = join6(resolve4(options.projectRoot), rel);
+      targetPath = join7(resolve4(options.projectRoot), rel);
     }
     const result = restoreDatabaseFile(
       backupFilePath,
@@ -23940,12 +23959,12 @@ function restoreBackup(manifestPathOrDir, options = {}) {
 // plugins/kxm/src/vnext-runtime-store.ts
 function vnextRuntimePaths(options = {}) {
   const stateRoot = options.stateRoot ? resolve5(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
-  const runtimeDir = join7(stateRoot, "runtime");
+  const runtimeDir = join8(stateRoot, "runtime");
   return {
     stateRoot,
     runtimeDir,
-    registryDb: join7(runtimeDir, "registry.db"),
-    projectsDir: join7(runtimeDir, "projects")
+    registryDb: join8(runtimeDir, "registry.db"),
+    projectsDir: join8(runtimeDir, "projects")
   };
 }
 function runtimeIssue(phase, code, file, message) {
@@ -24304,7 +24323,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join48 = compileJoin(step, id, sink);
+  const join49 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits4);
@@ -24332,7 +24351,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join48
+    join: join49
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -24382,15 +24401,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join48 = objectValue2(step.join);
-  if (!join48) return { strategy: "all" };
-  const declared = stringValue2(join48.strategy);
+  const join49 = objectValue2(step.join);
+  if (!join49) return { strategy: "all" };
+  const declared = stringValue2(join49.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join48.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join49.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join48.cancelRemaining === "boolean" ? { cancelRemaining: join48.cancelRemaining } : {}
+    ...typeof join49.cancelRemaining === "boolean" ? { cancelRemaining: join49.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -24670,8 +24689,8 @@ var RECORD_LIMIT = 16 * 1024 * 1024;
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync8, statSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync8, statSync } from "node:fs";
+import { join as join9 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
 var PRICES_SCHEMA = "kxm.prices.v1";
@@ -24823,8 +24842,8 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync8(join8(rootOrPath, ".kxm", "prices.yaml")) ? join8(rootOrPath, ".kxm", "prices.yaml") : existsSync8(join8(rootOrPath, "prices.yaml")) ? join8(rootOrPath, "prices.yaml") : existsSync8(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
-  if (!candidatePath || !existsSync8(candidatePath)) {
+  const candidatePath = existsSync9(join9(rootOrPath, ".kxm", "prices.yaml")) ? join9(rootOrPath, ".kxm", "prices.yaml") : existsSync9(join9(rootOrPath, "prices.yaml")) ? join9(rootOrPath, "prices.yaml") : existsSync9(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  if (!candidatePath || !existsSync9(candidatePath)) {
     return void 0;
   }
   const content = readFileSync8(candidatePath, "utf8");
@@ -24848,12 +24867,12 @@ var import_yaml5 = __toESM(require_dist(), 1);
 
 // plugins/kxm/src/producers.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { existsSync as existsSync9, readFileSync as readFileSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync3 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync3 } from "node:fs";
+import { join as join10 } from "node:path";
 var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
 function loadProducerPolicy(root) {
-  const path4 = join9(root, ".kxm", "producers.yaml");
-  if (!existsSync9(path4)) return empty();
+  const path4 = join10(root, ".kxm", "producers.yaml");
+  if (!existsSync10(path4)) return empty();
   const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
   if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
   return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x2) => typeof x2 === "string"), demoted: value.demoted.filter((x2) => typeof x2 === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x2) => typeof x2 === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
@@ -24864,8 +24883,8 @@ function updateProducer(root, model, status) {
   policy.demoted = policy.demoted.filter((x2) => x2 !== model);
   policy[status].push(model);
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join9(root, ".kxm"), { recursive: true });
-  writeFileSync6(join9(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync6(join10(root, ".kxm"), { recursive: true });
+  writeFileSync6(join10(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function setModelState(root, model, state, role, removeRole2 = false) {
@@ -24875,9 +24894,9 @@ function setModelState(root, model, state, role, removeRole2 = false) {
   policy[state].push(model);
   if (role) {
     if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
-    const rolePath = join9(root, ".kxm", "roles", `${role}.yaml`);
+    const rolePath = join10(root, ".kxm", "roles", `${role}.yaml`);
     let roleFile = {};
-    if (existsSync9(rolePath)) {
+    if (existsSync10(rolePath)) {
       const parsed = (0, import_yaml4.parse)(readFileSync9(rolePath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed;
     }
@@ -24889,28 +24908,28 @@ function setModelState(root, model, state, role, removeRole2 = false) {
     roleFile.schema ??= "kxm.role.v1";
     roleFile.id ??= role;
     roleFile.roster = roster;
-    mkdirSync6(join9(root, ".kxm", "roles"), { recursive: true });
+    mkdirSync6(join10(root, ".kxm", "roles"), { recursive: true });
     writeFileSync6(rolePath, (0, import_yaml4.stringify)(roleFile), "utf8");
   }
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join9(root, ".kxm"), { recursive: true });
-  writeFileSync6(join9(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync6(join10(root, ".kxm"), { recursive: true });
+  writeFileSync6(join10(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function listRoleBindings(root) {
-  const dir = join9(root, ".kxm", "roles");
+  const dir = join10(root, ".kxm", "roles");
   const result = {};
-  if (!existsSync9(dir)) return result;
+  if (!existsSync10(dir)) return result;
   for (const file of readdirSync3(dir).filter((name) => name.endsWith(".yaml"))) {
     const role = file.slice(0, -5);
-    const value = (0, import_yaml4.parse)(readFileSync9(join9(dir, file), "utf8"));
+    const value = (0, import_yaml4.parse)(readFileSync9(join10(dir, file), "utf8"));
     result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model) => typeof model === "string");
   }
   return result;
 }
 function listInventoryModels(root) {
-  const path4 = join9(root, ".kxm", "models", "inventory.yaml");
-  if (!existsSync9(path4)) return [];
+  const path4 = join10(root, ".kxm", "models", "inventory.yaml");
+  if (!existsSync10(path4)) return [];
   const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
   return (value.models ?? []).map((m2) => m2.id).filter((id) => typeof id === "string");
 }
@@ -25543,9 +25562,8 @@ function formatRoutingReport(report2, options = {}) {
 }
 
 // plugins/kxm/src/vnext-runtime-supervisor.ts
-var repoRoot = resolve7(fileURLToPath2(new URL("../../../", import.meta.url)));
 function vnextSupervisorTokenFile(paths) {
-  return join10(paths.runtimeDir, "supervisor.token");
+  return join11(paths.runtimeDir, "supervisor.token");
 }
 function readVnextSupervisorToken(paths) {
   const file = vnextSupervisorTokenFile(paths);
@@ -25568,11 +25586,11 @@ function processAlive(pid) {
 var HEARTBEAT_STALE_MS = 15e3;
 var SUPERVISOR_ERROR_MAX_AGE_MS = 3e4;
 function supervisorErrorFile(paths) {
-  return join10(paths.runtimeDir, "supervisor.error");
+  return join11(paths.runtimeDir, "supervisor.error");
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
-  if (existsSync10(file)) rmSync2(file, { force: true });
+  if (existsSync11(file)) rmSync2(file, { force: true });
 }
 function readRecentSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
@@ -25587,7 +25605,7 @@ function readRecentSupervisorError(paths) {
   }
 }
 function vnextSupervisorStatus(paths) {
-  if (!existsSync10(paths.registryDb)) return { running: false };
+  if (!existsSync11(paths.registryDb)) return { running: false };
   const registry = new VnextRuntimeRegistry(paths.registryDb);
   try {
     const record = registry.supervisor();
@@ -25648,7 +25666,7 @@ async function ensureVnextSupervisor(options = {}) {
     throw runtimeError("runtime_supervisor_unreachable", paths.registryDb, `runtime supervisor pid ${status.pid} is registered as running but cannot be probed`);
   }
   clearSupervisorError(paths);
-  const scriptPath = join10(repoRoot, "scripts", "kxm-runtime-supervisor.mjs");
+  const scriptPath = join11(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
   const spawnImpl = options.spawnImpl ?? ((script, env) => {
     const child = spawn2(process.execPath, [script], {
       detached: true,
@@ -25701,8 +25719,7 @@ async function vnextRuntimeRequest(handle, method, path4, body) {
 
 // plugins/kxm/src/cli/types.ts
 import { spawn as spawn3 } from "node:child_process";
-import { join as join13, resolve as resolve9 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { join as join14, resolve as resolve8 } from "node:path";
 
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
@@ -25733,7 +25750,7 @@ function redactStringList(values, maxItems = 32) {
 
 // plugins/kxm/src/telemetry.ts
 import { appendFileSync, mkdirSync as mkdirSync8, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname7, join as join11 } from "node:path";
+import { dirname as dirname8, join as join12 } from "node:path";
 var TELEMETRY_SCHEMA = "kxm.telemetry.v1";
 function inferImprovementTarget(input) {
   const explicit = input.env?.KXM_IMPROVE_TARGET?.trim();
@@ -25743,12 +25760,12 @@ function inferImprovementTarget(input) {
   return project || workflowId ? "project" : "cli";
 }
 function appendTelemetry(path4, event) {
-  mkdirSync8(dirname7(path4), { recursive: true });
+  mkdirSync8(dirname8(path4), { recursive: true });
   appendFileSync(path4, `${JSON.stringify(event)}
 `, { encoding: "utf8", mode: 384 });
 }
 function telemetryPath(logsDir) {
-  return join11(logsDir, "telemetry.jsonl");
+  return join12(logsDir, "telemetry.jsonl");
 }
 function makeTelemetryEvent(input) {
   return {
@@ -25840,9 +25857,9 @@ function workerResult(worker, payload) {
 }
 
 // plugins/kxm/src/hub-binding.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join13, resolve as resolve7 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
 var HubBindingError = class extends Error {
@@ -25855,20 +25872,20 @@ function resolveUserStateRoot(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
     if (!isAbsolute5(explicit)) throw new HubBindingError("local_state_root_not_absolute");
-    return resolve8(explicit);
+    return resolve7(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join12(homedir3(), "AppData", "Local");
-    return resolve8(base2, "KXM");
+    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join13(homedir3(), "AppData", "Local");
+    return resolve7(base2, "KXM");
   }
-  if (process.platform === "darwin") return resolve8(homedir3(), "Library", "Application Support", "KXM");
+  if (process.platform === "darwin") return resolve7(homedir3(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join12(homedir3(), ".local", "state");
-  return resolve8(base, "kxm");
+  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join13(homedir3(), ".local", "state");
+  return resolve7(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
-  return join12(resolveUserStateRoot(env), "hub-binding.json");
+  return join13(resolveUserStateRoot(env), "hub-binding.json");
 }
 function validateHubUrl(raw) {
   let parsed;
@@ -25893,7 +25910,7 @@ function isAbortError(error) {
 }
 function readHubBinding(env = process.env) {
   const file = hubBindingFile(env);
-  if (!existsSync11(file)) return void 0;
+  if (!existsSync12(file)) return void 0;
   let parsed;
   try {
     parsed = JSON.parse(readFileSync12(file, "utf8"));
@@ -25918,8 +25935,8 @@ function readHubBinding(env = process.env) {
 }
 function writeHubBinding(record, env = process.env) {
   const file = hubBindingFile(env);
-  mkdirSync9(dirname8(file), { recursive: true, mode: 448 });
-  const temporary = join12(dirname8(file), `.hub-binding-${process.pid}.tmp`);
+  mkdirSync9(dirname9(file), { recursive: true, mode: 448 });
+  const temporary = join13(dirname9(file), `.hub-binding-${process.pid}.tmp`);
   try {
     writeFileSync8(temporary, `${JSON.stringify(record, null, 2)}
 `, { encoding: "utf8", mode: 384 });
@@ -25964,10 +25981,9 @@ async function probeHubHealth(url, fetchImpl, timeoutMs = HUB_HEALTH_PROBE_MS) {
 }
 
 // plugins/kxm/src/cli/types.ts
-var repoRoot2 = resolve9(fileURLToPath3(new URL("../../../../", import.meta.url)));
 function spawnScript(scriptName, extraEnv = {}) {
   return new Promise((resolveExit) => {
-    const child = spawn3(process.execPath, [join13(repoRoot2, "scripts", scriptName)], {
+    const child = spawn3(process.execPath, [join14(findKxmRepoRoot(import.meta.url), "scripts", scriptName)], {
       stdio: "inherit",
       env: { ...process.env, ...extraEnv }
     });
@@ -26051,16 +26067,16 @@ function redactCliValue(value, field = "") {
   return value;
 }
 function workspaceDirs(cwd, workspaceFlag, env) {
-  const workdir = resolve9(env.KXM_WORKDIR?.trim() || cwd);
-  const workspace = resolve9(workdir, workspaceFlag || env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
+  const workdir = resolve8(env.KXM_WORKDIR?.trim() || cwd);
+  const workspace = resolve8(workdir, workspaceFlag || env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
   const derive = workspaceFlag !== void 0;
   return {
     workdir,
     workspace,
-    config: derive ? join13(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join13(workspace, "config")),
-    logs: derive ? join13(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join13(workspace, "logs")),
-    assets: derive ? join13(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join13(workspace, "assets")),
-    state: derive ? join13(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join13(workspace, "state"))
+    config: derive ? join14(workspace, "config") : resolve8(workdir, env.KXM_CONFIG_DIR?.trim() || join14(workspace, "config")),
+    logs: derive ? join14(workspace, "logs") : resolve8(workdir, env.KXM_LOGS_DIR?.trim() || join14(workspace, "logs")),
+    assets: derive ? join14(workspace, "assets") : resolve8(workdir, env.KXM_ASSETS_DIR?.trim() || join14(workspace, "assets")),
+    state: derive ? join14(workspace, "state") : resolve8(workdir, env.KXM_STATE_DIR?.trim() || join14(workspace, "state"))
   };
 }
 function maskEnvName(name) {
@@ -26128,20 +26144,20 @@ function workspaceEnv(runtime) {
 // plugins/kxm/src/cli/roles.ts
 var import_yaml8 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
-import { join as join16, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
+import { join as join17, resolve as resolve11 } from "node:path";
 import { createInterface } from "node:readline";
 
 // plugins/kxm/src/role.ts
 var import_yaml7 = __toESM(require_dist(), 1);
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readdirSync as readdirSync4, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readdirSync as readdirSync4, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join16 } from "node:path";
 
 // plugins/kxm/src/config.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname9, join as join14, resolve as resolve10 } from "node:path";
+import { dirname as dirname10, join as join15, resolve as resolve9 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
 var DEFAULT_KXM_CONFIG = {
   schema: KXM_CONFIG_SCHEMA,
@@ -26194,11 +26210,11 @@ var DEFAULT_KXM_CONFIG = {
   }
 };
 function userConfigDirectory(overrideDir) {
-  if (overrideDir) return resolve10(overrideDir);
-  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join14(homedir4(), ".config", "kxm"));
+  if (overrideDir) return resolve9(overrideDir);
+  return resolve9(process.env.KXM_USER_CONFIG_DIR?.trim() || join15(homedir4(), ".config", "kxm"));
 }
-function repoConfigDirectory(repoRoot6) {
-  return resolve10(repoRoot6, ".kxm");
+function repoConfigDirectory(repoRoot) {
+  return resolve9(repoRoot, ".kxm");
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -26216,14 +26232,14 @@ function normalizeHubConfig(raw) {
   const autoStart = raw?.autoStart;
   return { autoStart: autoStart === "off" || autoStart === "background" ? autoStart : DEFAULT_KXM_CONFIG.hub.autoStart };
 }
-function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
+function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   const userDir = userConfigDirectory(options.userConfigDir);
-  const userConfigFile = join14(userDir, "config.yaml");
-  const repoDir = repoConfigDirectory(repoRoot6);
-  const repoConfigFile = join14(repoDir, "config.yaml");
+  const userConfigFile = join15(userDir, "config.yaml");
+  const repoDir = repoConfigDirectory(repoRoot);
+  const repoConfigFile = join15(repoDir, "config.yaml");
   let userRaw = {};
   let userLoadedPath;
-  if (existsSync12(userConfigFile)) {
+  if (existsSync13(userConfigFile)) {
     try {
       const text = readFileSync13(userConfigFile, "utf8");
       userRaw = (0, import_yaml6.parse)(text) ?? {};
@@ -26234,7 +26250,7 @@ function loadKxmConfig(repoRoot6 = process.cwd(), options = {}) {
   }
   let repoRaw = {};
   let repoLoadedPath;
-  if (existsSync12(repoConfigFile)) {
+  if (existsSync13(repoConfigFile)) {
     try {
       const text = readFileSync13(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml6.parse)(text) ?? {};
@@ -26271,12 +26287,12 @@ function getKxmConfigValue(config, keyPath) {
   }
   return current;
 }
-function setKxmConfigValue(repoRoot6, keyPath, value, options = {}) {
+function setKxmConfigValue(repoRoot, keyPath, value, options = {}) {
   const scope = options.scope ?? "project";
-  const targetFile2 = scope === "user" ? join14(userConfigDirectory(options.userConfigDir), "config.yaml") : join14(repoConfigDirectory(repoRoot6), "config.yaml");
-  mkdirSync10(dirname9(targetFile2), { recursive: true });
+  const targetFile2 = scope === "user" ? join15(userConfigDirectory(options.userConfigDir), "config.yaml") : join15(repoConfigDirectory(repoRoot), "config.yaml");
+  mkdirSync10(dirname10(targetFile2), { recursive: true });
   let existing = {};
-  if (existsSync12(targetFile2)) {
+  if (existsSync13(targetFile2)) {
     try {
       existing = (0, import_yaml6.parse)(readFileSync13(targetFile2, "utf8")) ?? {};
     } catch {
@@ -26387,21 +26403,21 @@ var DEFAULT_ROLES = {
     ]
   }
 };
-function rolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
+function rolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join15(userConfigDirectory(userConfigDir), "roles");
+    return join16(userConfigDirectory(userConfigDir), "roles");
   }
-  return join15(repoConfigDirectory(repoRoot6), "roles");
+  return join16(repoConfigDirectory(repoRoot), "roles");
 }
-function ensureRolesDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
-  const dir = rolesDirectory(scope, repoRoot6, userConfigDir);
-  if (!existsSync13(dir)) {
+function ensureRolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
+  const dir = rolesDirectory(scope, repoRoot, userConfigDir);
+  if (!existsSync14(dir)) {
     mkdirSync11(dir, { recursive: true });
   }
   return dir;
 }
 function parseRoleFile(filePath) {
-  if (!existsSync13(filePath)) return void 0;
+  if (!existsSync14(filePath)) return void 0;
   try {
     const raw = readFileSync14(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
@@ -26426,14 +26442,14 @@ function parseRoleFile(filePath) {
 }
 function listRoles(options = {}) {
   const scopeFilter = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const globalDir = rolesDirectory("global", repoRoot6, options.userConfigDir);
-  const localDir = rolesDirectory("local", repoRoot6, options.userConfigDir);
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
+  const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
   const localRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync13(localDir)) {
+  if (scopeFilter !== "global" && existsSync14(localDir)) {
     for (const entry of readdirSync4(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join15(localDir, entry);
+        const filePath = join16(localDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           localRoles.set(parsed.id, { role: parsed, filePath });
@@ -26442,10 +26458,10 @@ function listRoles(options = {}) {
     }
   }
   const globalRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync13(globalDir)) {
+  if (scopeFilter !== "local" && existsSync14(globalDir)) {
     for (const entry of readdirSync4(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join15(globalDir, entry);
+        const filePath = join16(globalDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           globalRoles.set(parsed.id, { role: parsed, filePath });
@@ -26490,16 +26506,16 @@ function listRoles(options = {}) {
 }
 function getRole(roleId, options = {}) {
   const scope = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
+  const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
-    const localDir = rolesDirectory("local", repoRoot6, options.userConfigDir);
-    const localFile = join15(localDir, `${roleId}.yaml`);
+    const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
+    const localFile = join16(localDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(localFile);
     if (parsed) return { role: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
-    const globalDir = rolesDirectory("global", repoRoot6, options.userConfigDir);
-    const globalFile = join15(globalDir, `${roleId}.yaml`);
+    const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
+    const globalFile = join16(globalDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(globalFile);
     if (parsed) return { role: parsed, scope: "global", filePath: globalFile };
   }
@@ -26507,10 +26523,10 @@ function getRole(roleId, options = {}) {
 }
 function addRole(role, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureRolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join15(dir, `${role.id}.yaml`);
-  if (existsSync13(filePath) && !options.overwrite) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join16(dir, `${role.id}.yaml`);
+  if (existsSync14(filePath) && !options.overwrite) {
     throw new Error(`role_already_exists: role '${role.id}' already exists at ${filePath}`);
   }
   writeFileSync10(filePath, (0, import_yaml7.stringify)(role), "utf8");
@@ -26518,10 +26534,10 @@ function addRole(role, options = {}) {
 }
 function removeRole(roleId, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = rolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join15(dir, `${roleId}.yaml`);
-  if (!existsSync13(filePath)) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = rolesDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join16(dir, `${roleId}.yaml`);
+  if (!existsSync14(filePath)) {
     throw new Error(`role_not_found: role '${roleId}' not found in ${scope} directory (${filePath})`);
   }
   rmSync4(filePath);
@@ -26540,9 +26556,9 @@ function modifyRole(roleId, updates, options = {}) {
     // preserve identity
   };
   const scope = options.scope ?? target.scope;
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureRolesDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join15(dir, `${roleId}.yaml`);
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join16(dir, `${roleId}.yaml`);
   writeFileSync10(filePath, (0, import_yaml7.stringify)(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
@@ -26589,18 +26605,18 @@ var DEFAULT_ROLE_SEATS = {
     requiredEvidenceKind: "test_run"
   }
 };
-function findExistingRoleHostsFile(scope, repoRoot6 = process.cwd(), userConfigDir) {
-  const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot6);
-  const yamlPath = join15(dir, "role-hosts.yaml");
-  const ymlPath = join15(dir, "role-hosts.yml");
-  const jsonPath = join15(dir, "role-hosts.json");
-  if (existsSync13(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
-  if (existsSync13(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
-  if (existsSync13(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
+function findExistingRoleHostsFile(scope, repoRoot = process.cwd(), userConfigDir) {
+  const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot);
+  const yamlPath = join16(dir, "role-hosts.yaml");
+  const ymlPath = join16(dir, "role-hosts.yml");
+  const jsonPath = join16(dir, "role-hosts.json");
+  if (existsSync14(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
+  if (existsSync14(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
+  if (existsSync14(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
   return { filePath: yamlPath, exists: false, format: "yaml" };
 }
 function parseRoleHostsFile(filePath) {
-  if (!existsSync13(filePath)) return void 0;
+  if (!existsSync14(filePath)) return void 0;
   try {
     const raw = readFileSync14(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
@@ -26617,11 +26633,11 @@ function parseRoleHostsFile(filePath) {
 }
 function loadRoleHostsConfig(options = {}) {
   const scopeFilter = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
+  const repoRoot = options.repoRoot ?? process.cwd();
   let localConfig;
   let localPath;
   if (scopeFilter !== "global") {
-    const localFound = findExistingRoleHostsFile("local", repoRoot6, options.userConfigDir);
+    const localFound = findExistingRoleHostsFile("local", repoRoot, options.userConfigDir);
     if (localFound.exists) {
       localConfig = parseRoleHostsFile(localFound.filePath);
       localPath = localFound.filePath;
@@ -26630,7 +26646,7 @@ function loadRoleHostsConfig(options = {}) {
   let globalConfig;
   let globalPath;
   if (scopeFilter !== "local") {
-    const globalFound = findExistingRoleHostsFile("global", repoRoot6, options.userConfigDir);
+    const globalFound = findExistingRoleHostsFile("global", repoRoot, options.userConfigDir);
     if (globalFound.exists) {
       globalConfig = parseRoleHostsFile(globalFound.filePath);
       globalPath = globalFound.filePath;
@@ -26672,13 +26688,13 @@ function loadRoleHostsConfig(options = {}) {
 }
 function saveRoleHostsConfig(config, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot6);
-  if (!existsSync13(dir)) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot);
+  if (!existsSync14(dir)) {
     mkdirSync11(dir, { recursive: true });
   }
   const format = options.format ?? "yaml";
-  const filePath = join15(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  const filePath = join16(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
   const payload = {
     schema: KXM_ROLE_HOSTS_SCHEMA,
     seats: config.seats ?? {},
@@ -26919,7 +26935,7 @@ async function cmdRoleAdd(runtime, roleId, options) {
   }
   let roleDef;
   if (options.file) {
-    const filePath = resolve12(runtime.cwd, options.file);
+    const filePath = resolve11(runtime.cwd, options.file);
     const content = readFileSync15(filePath, "utf8");
     roleDef = (0, import_yaml8.parse)(content);
     roleDef.id = roleId;
@@ -27219,8 +27235,8 @@ async function cmdRoleResume(runtime, runId, ruling) {
       return 1;
     }
   }
-  const dbPath = join16(runtime.cwd, ".kxm", "state", "kxm.db");
-  if (existsSync14(dbPath)) {
+  const dbPath = join17(runtime.cwd, ".kxm", "state", "kxm.db");
+  if (existsSync15(dbPath)) {
     try {
       const database = new DatabaseSync(dbPath);
       try {
@@ -27282,12 +27298,12 @@ async function cmdRoleResume(runtime, runId, ruling) {
 
 // plugins/kxm/src/cli/workflows.ts
 import { createHmac as createHmac3, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync17 } from "node:fs";
-import { join as join18, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
+import { join as join19, resolve as resolve14 } from "node:path";
 
 // plugins/kxm/src/retrospective.ts
 import { mkdirSync as mkdirSync12, renameSync as renameSync4, writeFileSync as writeFileSync11 } from "node:fs";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 var MAX_RETROSPECTIVE_ENTRIES = 500;
 var SAFE_RUN_ID = /^run_[A-Za-z0-9_-]{1,120}$/;
 function durationMs(startedAt, completedAt) {
@@ -27500,9 +27516,9 @@ function renderRetrospectiveMarkdown(doc) {
 function writeRetrospective(outDir, doc) {
   if (!SAFE_RUN_ID.test(doc.runId)) throw new Error("invalid retrospective run id");
   mkdirSync12(outDir, { recursive: true });
-  const root = resolve13(outDir);
-  const jsonPath = resolve13(root, `${doc.runId}.json`);
-  const mdPath = resolve13(root, `${doc.runId}.md`);
+  const root = resolve12(outDir);
+  const jsonPath = resolve12(root, `${doc.runId}.json`);
+  const mdPath = resolve12(root, `${doc.runId}.md`);
   const prefix = `${root}${process.platform === "win32" ? "\\" : "/"}`;
   if (!jsonPath.startsWith(prefix) || !mdPath.startsWith(prefix)) throw new Error("retrospective path escaped output directory");
   const jsonTmp = `${jsonPath}.tmp`;
@@ -27602,7 +27618,7 @@ async function watchGithubChecks(input) {
   }
   const fetchImpl = input.fetchImpl ?? fetch;
   const now = input.now ?? Date.now;
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve31) => setTimeout(resolve31, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve30) => setTimeout(resolve30, ms)));
   const deadline = now() + input.timeoutMs;
   const headers = {
     authorization: `Bearer ${token}`,
@@ -27701,8 +27717,8 @@ async function watchGithubChecks(input) {
 
 // plugins/kxm/src/workflow-manager.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join18 } from "node:path";
 var WORKFLOW_TEMPLATES = {
   "implement-and-verify": {
     schema: "kxm.workflow.v1",
@@ -27851,21 +27867,21 @@ var WORKFLOW_TEMPLATES = {
   }
 };
 var DEFAULT_WORKFLOW_TEMPLATE = WORKFLOW_TEMPLATES["implement-and-verify"];
-function workflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
+function workflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join17(userConfigDirectory(userConfigDir), "workflows");
+    return join18(userConfigDirectory(userConfigDir), "workflows");
   }
-  return join17(repoConfigDirectory(repoRoot6), "workflows");
+  return join18(repoConfigDirectory(repoRoot), "workflows");
 }
-function ensureWorkflowsDirectory(scope, repoRoot6 = process.cwd(), userConfigDir) {
-  const dir = workflowsDirectory(scope, repoRoot6, userConfigDir);
-  if (!existsSync15(dir)) {
+function ensureWorkflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
+  const dir = workflowsDirectory(scope, repoRoot, userConfigDir);
+  if (!existsSync16(dir)) {
     mkdirSync13(dir, { recursive: true });
   }
   return dir;
 }
 function parseWorkflowFile(filePath) {
-  if (!existsSync15(filePath)) return void 0;
+  if (!existsSync16(filePath)) return void 0;
   try {
     const raw = readFileSync16(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
@@ -27877,14 +27893,14 @@ function parseWorkflowFile(filePath) {
 }
 function listWorkflowDefinitions(options = {}) {
   const scopeFilter = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const globalDir = workflowsDirectory("global", repoRoot6, options.userConfigDir);
-  const localDir = workflowsDirectory("local", repoRoot6, options.userConfigDir);
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
+  const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
   const localDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync15(localDir)) {
+  if (scopeFilter !== "global" && existsSync16(localDir)) {
     for (const entry of readdirSync5(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join17(localDir, entry);
+        const filePath = join18(localDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27894,10 +27910,10 @@ function listWorkflowDefinitions(options = {}) {
     }
   }
   const globalDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync15(globalDir)) {
+  if (scopeFilter !== "local" && existsSync16(globalDir)) {
     for (const entry of readdirSync5(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join17(globalDir, entry);
+        const filePath = join18(globalDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27950,16 +27966,16 @@ function listWorkflowDefinitions(options = {}) {
 }
 function getWorkflowDefinition(workflowId, options = {}) {
   const scope = options.scope ?? "all";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
+  const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
-    const localDir = workflowsDirectory("local", repoRoot6, options.userConfigDir);
-    const localFile = join17(localDir, `${workflowId}.yaml`);
+    const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
+    const localFile = join18(localDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(localFile);
     if (parsed) return { workflow: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
-    const globalDir = workflowsDirectory("global", repoRoot6, options.userConfigDir);
-    const globalFile = join17(globalDir, `${workflowId}.yaml`);
+    const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
+    const globalFile = join18(globalDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(globalFile);
     if (parsed) return { workflow: parsed, scope: "global", filePath: globalFile };
   }
@@ -27967,10 +27983,10 @@ function getWorkflowDefinition(workflowId, options = {}) {
 }
 function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureWorkflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join17(dir, `${workflowId}.yaml`);
-  if (existsSync15(filePath) && !options.overwrite) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join18(dir, `${workflowId}.yaml`);
+  if (existsSync16(filePath) && !options.overwrite) {
     throw new Error(`workflow_already_exists: workflow '${workflowId}' already exists at ${filePath}`);
   }
   const payload = typeof content === "string" ? content : (0, import_yaml9.stringify)(content);
@@ -27979,10 +27995,10 @@ function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE,
 }
 function removeWorkflowDefinition(workflowId, options = {}) {
   const scope = options.scope ?? "local";
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = workflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join17(dir, `${workflowId}.yaml`);
-  if (!existsSync15(filePath)) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join18(dir, `${workflowId}.yaml`);
+  if (!existsSync16(filePath)) {
     throw new Error(`workflow_not_found: workflow '${workflowId}' not found in ${scope} directory (${filePath})`);
   }
   rmSync5(filePath);
@@ -27998,9 +28014,9 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
     ...updates
   };
   const scope = options.scope ?? target.scope;
-  const repoRoot6 = options.repoRoot ?? process.cwd();
-  const dir = ensureWorkflowsDirectory(scope, repoRoot6, options.userConfigDir);
-  const filePath = join17(dir, `${workflowId}.yaml`);
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
+  const filePath = join18(dir, `${workflowId}.yaml`);
   writeFileSync12(filePath, (0, import_yaml9.stringify)(updated), "utf8");
   return { id: workflowId, workflow: updated, filePath, scope };
 }
@@ -28008,7 +28024,7 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
 // plugins/kxm/src/cli/workflows.ts
 var CLI_NAME = "kxm";
 function localWorkflowSnapshot(dataPath, runId) {
-  if (!existsSync16(dataPath)) throw new Error("state_database_not_found");
+  if (!existsSync17(dataPath)) throw new Error("state_database_not_found");
   const database = new DatabaseSync(dataPath, { readOnly: true });
   try {
     const rows = runId ? database.prepare("SELECT record FROM workflow_runs WHERE id = ?").all(runId) : database.prepare("SELECT record FROM workflow_runs ORDER BY rowid DESC LIMIT 200").all();
@@ -28085,7 +28101,7 @@ function activeWorkflowDefinition(runtime, definitionId) {
   let raw;
   if (file) {
     try {
-      raw = readFileSync17(resolve15(runtime.cwd, file), "utf8");
+      raw = readFileSync17(resolve14(runtime.cwd, file), "utf8");
     } catch {
       throw new Error("workflow definition file is unavailable");
     }
@@ -28166,7 +28182,7 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
     }
   }
   if (options.file) {
-    const filePath = resolve15(runtime.cwd, options.file);
+    const filePath = resolve14(runtime.cwd, options.file);
     content = readFileSync17(filePath, "utf8");
   } else if (!content) {
     content = {
@@ -28325,7 +28341,7 @@ async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   }
   let payload;
   try {
-    const raw = payloadFlag.startsWith("@") ? readFileSync17(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
+    const raw = payloadFlag.startsWith("@") ? readFileSync17(resolve14(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
     const value = JSON.parse(raw);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("object required");
     payload = value;
@@ -28392,7 +28408,7 @@ async function cmdWorkflowDegrade(runtime, runId, stageId, options) {
   }
 }
 async function cmdWorkflowInspect(runtime, action, runId) {
-  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join18(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve14(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join19(runtime.dirs.state, "kxm.db"));
   if (action === "get" && !runId) {
     runtime.io.stderr(`Usage: ${CLI_NAME} workflow get <runId>
 `);
@@ -28561,14 +28577,14 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 2;
   }
   const snapshotFlag = String(options.input || "");
-  const snapshotPath = snapshotFlag ? resolve15(runtime.cwd, snapshotFlag) : "";
+  const snapshotPath = snapshotFlag ? resolve14(runtime.cwd, snapshotFlag) : "";
   let snapshot;
   try {
     if (snapshotPath) {
-      if (!existsSync16(snapshotPath)) throw new Error("snapshot_missing");
+      if (!existsSync17(snapshotPath)) throw new Error("snapshot_missing");
       snapshot = JSON.parse(readFileSync17(snapshotPath, "utf8"));
     } else {
-      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join18(runtime.dirs.state, "kxm.db"));
+      const dataPath = resolve14(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join19(runtime.dirs.state, "kxm.db"));
       const local = localWorkflowSnapshot(dataPath, runId);
       if (!local.runs[0]) throw new Error("workflow_not_found");
       snapshot = { run: local.runs[0], journal: local.journal };
@@ -28580,8 +28596,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 1;
   }
   const doc = buildRetrospective(snapshot.run, snapshot.journal);
-  const outDir = resolve15(runtime.cwd, String(options.outDir || join18(runtime.dirs.assets, "retrospectives")));
-  const assetsRoot = resolve15(runtime.dirs.assets);
+  const outDir = resolve14(runtime.cwd, String(options.outDir || join19(runtime.dirs.assets, "retrospectives")));
+  const assetsRoot = resolve14(runtime.dirs.assets);
   const assetsPrefix = `${assetsRoot}${process.platform === "win32" ? "\\" : "/"}`;
   if (outDir !== assetsRoot && !outDir.startsWith(assetsPrefix)) {
     print(runtime.io, runtime.json, { ok: false, command: "retrospective export", error: "output_outside_workspace_assets" }, "retrospectives must stay under the workspace assets directory");
@@ -28598,8 +28614,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
 
 // plugins/kxm/src/cli/tasks.ts
 var import_yaml13 = __toESM(require_dist(), 1);
-import { existsSync as existsSync22, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
-import { basename as basename6, join as join26, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
+import { basename as basename6, join as join27, resolve as resolve20 } from "node:path";
 
 // plugins/kxm/src/suggest.ts
 var WORKFLOW_PATTERNS = [
@@ -28710,18 +28726,18 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
 // plugins/kxm/src/task-manager.ts
 var import_yaml10 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync18, readdirSync as readdirSync6, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join19, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync14, readFileSync as readFileSync18, readdirSync as readdirSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join20, resolve as resolve15 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
 var TASK_SCHEMA = "kxm.task.v1";
-function goalsDirectory(repoRoot6) {
-  return resolve16(repoRoot6, ".kxm", "goals");
+function goalsDirectory(repoRoot) {
+  return resolve15(repoRoot, ".kxm", "goals");
 }
-function tasksDirectory(repoRoot6) {
-  return resolve16(repoRoot6, ".kxm", "tasks");
+function tasksDirectory(repoRoot) {
+  return resolve15(repoRoot, ".kxm", "tasks");
 }
-function createGoal(repoRoot6, input) {
-  const dir = goalsDirectory(repoRoot6);
+function createGoal(repoRoot, input) {
+  const dir = goalsDirectory(repoRoot);
   mkdirSync14(dir, { recursive: true });
   const id = `goal_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -28736,19 +28752,19 @@ function createGoal(repoRoot6, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join19(dir, `${id}.yaml`);
+  const filePath = join20(dir, `${id}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
-function listGoals(repoRoot6) {
-  const dir = goalsDirectory(repoRoot6);
-  if (!existsSync17(dir)) return [];
+function listGoals(repoRoot) {
+  const dir = goalsDirectory(repoRoot);
+  if (!existsSync18(dir)) return [];
   const goals = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync18(join19(dir, entry.name), "utf8");
+        const text = readFileSync18(join20(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === GOAL_SCHEMA) goals.push(doc);
       } catch {
@@ -28757,8 +28773,8 @@ function listGoals(repoRoot6) {
   }
   return goals.sort((a, b2) => a.createdAt.localeCompare(b2.createdAt));
 }
-function createTask(repoRoot6, input) {
-  const dir = tasksDirectory(repoRoot6);
+function createTask(repoRoot, input) {
+  const dir = tasksDirectory(repoRoot);
   mkdirSync14(dir, { recursive: true });
   const id = `task_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -28781,19 +28797,19 @@ function createTask(repoRoot6, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join19(dir, `${id}.yaml`);
+  const filePath = join20(dir, `${id}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
-function listTasks(repoRoot6, options = {}) {
-  const dir = tasksDirectory(repoRoot6);
-  if (!existsSync17(dir)) return [];
+function listTasks(repoRoot, options = {}) {
+  const dir = tasksDirectory(repoRoot);
+  if (!existsSync18(dir)) return [];
   const tasks = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync18(join19(dir, entry.name), "utf8");
+        const text = readFileSync18(join20(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === TASK_SCHEMA) {
           if (options.goalId && doc.goalId !== options.goalId) continue;
@@ -28806,10 +28822,10 @@ function listTasks(repoRoot6, options = {}) {
   }
   return tasks.sort((a, b2) => a.createdAt.localeCompare(b2.createdAt));
 }
-function getTask(repoRoot6, taskId) {
-  const dir = tasksDirectory(repoRoot6);
-  const filePath = join19(dir, `${taskId}.yaml`);
-  if (!existsSync17(filePath)) return void 0;
+function getTask(repoRoot, taskId) {
+  const dir = tasksDirectory(repoRoot);
+  const filePath = join20(dir, `${taskId}.yaml`);
+  if (!existsSync18(filePath)) return void 0;
   try {
     const text = readFileSync18(filePath, "utf8");
     const doc = (0, import_yaml10.parse)(text);
@@ -28818,20 +28834,20 @@ function getTask(repoRoot6, taskId) {
     return void 0;
   }
 }
-function updateTaskStatus(repoRoot6, taskId, status, options = {}) {
-  const task = getTask(repoRoot6, taskId);
+function updateTaskStatus(repoRoot, taskId, status, options = {}) {
+  const task = getTask(repoRoot, taskId);
   if (!task) {
     throw new Error(`Task ${taskId} not found`);
   }
   task.status = status;
   if (options.workflowRunId) task.workflowRunId = options.workflowRunId;
   task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const filePath = join19(tasksDirectory(repoRoot6), `${taskId}.yaml`);
+  const filePath = join20(tasksDirectory(repoRoot), `${taskId}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
-function syncTaskWithTracker(repoRoot6, taskId, options = {}) {
-  const task = getTask(repoRoot6, taskId);
+function syncTaskWithTracker(repoRoot, taskId, options = {}) {
+  const task = getTask(repoRoot, taskId);
   if (!task) {
     throw new Error(`Task ${taskId} not found`);
   }
@@ -28842,7 +28858,7 @@ function syncTaskWithTracker(repoRoot6, taskId, options = {}) {
   task.trackerSync.syncStatus = "synced";
   task.trackerSync.lastSyncedAt = now;
   task.updatedAt = now;
-  const filePath = join19(tasksDirectory(repoRoot6), `${taskId}.yaml`);
+  const filePath = join20(tasksDirectory(repoRoot), `${taskId}.yaml`);
   writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
@@ -29609,14 +29625,13 @@ function createStudioServer(options = {}) {
 }
 
 // plugins/kxm/src/cli/vnext.ts
-import { join as join25, resolve as resolve20 } from "node:path";
+import { join as join26, resolve as resolve19 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // plugins/kxm/src/model-inventory.ts
 var import_yaml11 = __toESM(require_dist(), 1);
 import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var OR_URL = "https://openrouter.ai/api/v1/models";
 var NOUS_URL = "https://inference-api.nousresearch.com/v1/models";
 function price(value) {
@@ -29702,22 +29717,22 @@ async function refreshModelInventory(options) {
   sources.nous = { url: nousUrl, ok: !nous.error, ...nous.error ? { error: nous.error } : {} };
   for (const item of nous.data) add(item, "nous", "discount");
   const inventory = { schema: "kxm.model-inventory.v1", fetchedAt, currency: "USD", sources, models: [...byId.values()].sort((a, b2) => a.id.localeCompare(b2.id)) };
-  mkdirSync15(join20(options.outputRoot, ".kxm", "models"), { recursive: true });
-  writeFileSync14(join20(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
+  mkdirSync15(join21(options.outputRoot, ".kxm", "models"), { recursive: true });
+  writeFileSync14(join21(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
   return inventory;
 }
 
 // plugins/kxm/src/vnext-init.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { existsSync as existsSync20 } from "node:fs";
-import { basename as basename5, join as join23 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { basename as basename5, join as join24 } from "node:path";
 
 // plugins/kxm/src/vnext-repair.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync2,
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync7,
@@ -29729,14 +29744,14 @@ import {
   rmSync as rmSync7,
   writeFileSync as writeFileSync16
 } from "node:fs";
-import { dirname as dirname13, isAbsolute as isAbsolute6, join as join22, relative as relative4, resolve as resolve18 } from "node:path";
+import { dirname as dirname14, isAbsolute as isAbsolute6, join as join23, relative as relative4, resolve as resolve17 } from "node:path";
 
 // plugins/kxm/src/vnext-permission.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync18, mkdtempSync, mkdirSync as mkdirSync16, readFileSync as readFileSync19, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync19, mkdtempSync, mkdirSync as mkdirSync16, readFileSync as readFileSync19, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname12, join as join21, resolve as resolve17, sep as sep3 } from "node:path";
+import { dirname as dirname13, join as join22, resolve as resolve16, sep as sep3 } from "node:path";
 var PROSE_FIELDS = {
   project: /* @__PURE__ */ new Set(["name", "description"]),
   repository: /* @__PURE__ */ new Set(["description"]),
@@ -30257,8 +30272,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
   const tree = resolveTreeRevision(root, revision);
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-  const shadow = mkdtempSync(join21(tmpdir(), "kxm-permission-base-"));
-  const shadowResolved = resolve17(shadow);
+  const shadow = mkdtempSync(join22(tmpdir(), "kxm-permission-base-"));
+  const shadowResolved = resolve16(shadow);
   const shadowMembersDir = `.kxm-shadow-members-${createHash12("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
     for (const path4 of paths) {
@@ -30271,8 +30286,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
           message: "Git tree entry contains a traversal or non-portable segment"
         }]);
       }
-      const absolute = join21(shadowResolved, ...segments);
-      const resolved = resolve17(absolute);
+      const absolute = join22(shadowResolved, ...segments);
+      const resolved = resolve16(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep3}`)) {
         throw new VnextConfigError([{
           phase: "path",
@@ -30282,11 +30297,11 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const content = gitBuffer(root, ["cat-file", "blob", `${tree}:${path4}`]);
-      mkdirSync16(dirname12(absolute), { recursive: true });
+      mkdirSync16(dirname13(absolute), { recursive: true });
       writeFileSync15(absolute, content);
     }
     initShadowGitRoot(shadowResolved);
-    const baseProjectFile = join21(shadowResolved, ".kxm", "project.yaml");
+    const baseProjectFile = join22(shadowResolved, ".kxm", "project.yaml");
     let baseProject;
     try {
       baseProject = loadBaseProjectDeclarations(baseProjectFile);
@@ -30316,8 +30331,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const boundPath = options.repositoryBindings?.[member.repositoryId];
-      const memberWorktree = boundPath ? resolve17(boundPath) : member.pathHint ? resolve17(root, ...member.pathHint.split("/")) : void 0;
-      if (!memberWorktree || !existsSync18(memberWorktree)) {
+      const memberWorktree = boundPath ? resolve16(boundPath) : member.pathHint ? resolve16(root, ...member.pathHint.split("/")) : void 0;
+      if (!memberWorktree || !existsSync19(memberWorktree)) {
         if (member.required === false) continue;
         throw new VnextConfigError([{
           phase: "discovery",
@@ -30364,8 +30379,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       const memberTree = git(memberWorktree, ["rev-parse", "--verify", "--quiet", `${pinnedCommit}^{tree}`]).trim();
       const memberListing = gitBuffer(memberWorktree, ["ls-tree", "-r", "-z", "--name-only", memberTree]).toString("utf8");
       const memberPaths = memberListing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-      const memberShadowRoot = join21(shadowResolved, shadowMembersDir, member.repositoryId);
-      if (!resolve17(memberShadowRoot).startsWith(`${resolve17(shadowResolved, shadowMembersDir)}${sep3}`)) {
+      const memberShadowRoot = join22(shadowResolved, shadowMembersDir, member.repositoryId);
+      if (!resolve16(memberShadowRoot).startsWith(`${resolve16(shadowResolved, shadowMembersDir)}${sep3}`)) {
         throw new VnextConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
@@ -30378,13 +30393,13 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
-        const absolute = join21(memberShadowRoot, ...segments);
-        const resolved = resolve17(absolute);
-        if (!resolved.startsWith(`${resolve17(memberShadowRoot)}${sep3}`)) {
+        const absolute = join22(memberShadowRoot, ...segments);
+        const resolved = resolve16(absolute);
+        if (!resolved.startsWith(`${resolve16(memberShadowRoot)}${sep3}`)) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry escapes the shadow root" }]);
         }
         const content = gitBuffer(memberWorktree, ["cat-file", "blob", `${memberTree}:${path4}`]);
-        mkdirSync16(dirname12(absolute), { recursive: true });
+        mkdirSync16(dirname13(absolute), { recursive: true });
         writeFileSync15(absolute, content);
       }
       initShadowGitRoot(memberShadowRoot);
@@ -30406,7 +30421,7 @@ function portableMemberPathHint(pathHint) {
   return pathHint !== "." && vnextPortablePath(pathHint);
 }
 function loadBaseProjectDeclarations(projectFile) {
-  if (!existsSync18(projectFile)) return [];
+  if (!existsSync19(projectFile)) return [];
   const value = parseRestrictedYaml2(readFileSync19(projectFile, "utf8"), ".kxm/project.yaml");
   const repositories = Array.isArray(value?.repositories) ? value.repositories : [];
   const members = [];
@@ -30510,7 +30525,7 @@ function writeDurableNew(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync2(descriptor);
   }
-  syncDirectory2(dirname13(file));
+  syncDirectory2(dirname14(file));
 }
 function writeDurable(file, bytes, mode) {
   let descriptor;
@@ -30527,27 +30542,27 @@ function writeDurable(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync2(descriptor);
   }
-  syncDirectory2(dirname13(file));
+  syncDirectory2(dirname14(file));
 }
 function sameHostPath3(left, right) {
-  const first = resolve18(left);
-  const second = resolve18(right);
+  const first = resolve17(left);
+  const second = resolve17(right);
   return process.platform === "win32" ? first.toLocaleLowerCase("en-US") === second.toLocaleLowerCase("en-US") : first === second;
 }
 function transactionRoot(projectRoot) {
-  return join22(resolve18(projectRoot), TRANSACTION_NAME);
+  return join23(resolve17(projectRoot), TRANSACTION_NAME);
 }
 function operationFile(projectRoot) {
-  return join22(transactionRoot(projectRoot), OPERATION_FILE);
+  return join23(transactionRoot(projectRoot), OPERATION_FILE);
 }
 function targetFile(projectRoot, portablePath2) {
-  return join22(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
+  return join23(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
 }
 function shadowRoot(projectRoot) {
-  return join22(transactionRoot(projectRoot), "shadow");
+  return join23(transactionRoot(projectRoot), "shadow");
 }
 function backupFile(projectRoot, portablePath2) {
-  return join22(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
+  return join23(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
 }
 function portableManagedPath(path4) {
   return path4.startsWith(".kxm/") && path4 !== VNEXT_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute6(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
@@ -30559,21 +30574,21 @@ function readRegularBounded(file, label) {
   return readFileSync20(file);
 }
 function readOptionalManaged(projectRoot, path4) {
-  const file = join22(projectRoot, ...path4.split("/"));
-  if (!existsSync19(file)) return void 0;
-  let parent = dirname13(file);
-  const boundary = resolve18(projectRoot);
+  const file = join23(projectRoot, ...path4.split("/"));
+  if (!existsSync20(file)) return void 0;
+  let parent = dirname14(file);
+  const boundary = resolve17(projectRoot);
   while (parent !== boundary) {
     const stat = lstatSync7(parent);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_parent_invalid", path4, "managed file parents must be regular directories", "path");
-    parent = dirname13(parent);
+    parent = dirname14(parent);
   }
   return readRegularBounded(file, path4);
 }
 function readProjectAndProvenance(projectRoot, schemasDir) {
-  const projectFile = join22(projectRoot, ".kxm", "project.yaml");
-  const provenanceFile = join22(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
-  if (!existsSync19(projectFile) || !existsSync19(provenanceFile)) return void 0;
+  const projectFile = join23(projectRoot, ".kxm", "project.yaml");
+  const provenanceFile = join23(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
+  if (!existsSync20(projectFile) || !existsSync20(provenanceFile)) return void 0;
   const projectBytes = readOptionalManaged(projectRoot, ".kxm/project.yaml");
   const provenanceBytes = readOptionalManaged(projectRoot, VNEXT_TEMPLATE_PROVENANCE_PATH);
   if (!projectBytes || !provenanceBytes) return void 0;
@@ -30609,7 +30624,7 @@ function readProjectAndProvenance(projectRoot, schemasDir) {
 }
 function planVnextTemplateRepair(projectRoot, options = {}) {
   assertNoRegisteredGates(options);
-  const root = resolve18(projectRoot);
+  const root = resolve17(projectRoot);
   const source = readProjectAndProvenance(root, options.schemasDir);
   if (!source) return void 0;
   const target = renderVnextTemplate(
@@ -30737,7 +30752,7 @@ function operationPlanSha(operation) {
 function writeOperation(projectRoot, operation) {
   const root = transactionRoot(projectRoot);
   const file = operationFile(projectRoot);
-  const temporary = join22(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
+  const temporary = join23(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
   try {
     writeDurableNew(temporary, Buffer.from(`${JSON.stringify(operation, null, 2)}
 `, "utf8"), 384);
@@ -30754,11 +30769,11 @@ function updatePhase(projectRoot, operation, phase) {
 }
 function readOperation(projectRoot, schemasDir) {
   const root = transactionRoot(projectRoot);
-  if (!existsSync19(root)) return void 0;
+  if (!existsSync20(root)) return void 0;
   const stat = lstatSync7(root);
   if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("init_transaction_invalid", TRANSACTION_NAME, "initialization transaction must be a regular directory", "path");
   const file = operationFile(projectRoot);
-  if (!existsSync19(file)) {
+  if (!existsSync20(file)) {
     const entries = readdirSync7(root, { withFileTypes: true });
     const recoverable = entries.every((entry) => entry.isFile() && /^\.operation-op_[a-f0-9]{32}-[a-f0-9-]{36}\.tmp$/.test(entry.name));
     if (recoverable) return void 0;
@@ -30786,15 +30801,15 @@ function readOperation(projectRoot, schemasDir) {
   return operation;
 }
 function hasVnextInitTransaction(projectRoot) {
-  return existsSync19(transactionRoot(projectRoot));
+  return existsSync20(transactionRoot(projectRoot));
 }
 function readTarget(projectRoot, path4) {
-  return readOptionalManaged(join22(transactionRoot(projectRoot), "targets"), path4);
+  return readOptionalManaged(join23(transactionRoot(projectRoot), "targets"), path4);
 }
 function writeTarget(projectRoot, path4, bytes) {
   if (bytes.byteLength > MAX_MANAGED_FILE_BYTES) fail3("template_target_too_large", path4, `target exceeds ${MAX_MANAGED_FILE_BYTES} bytes`);
   const file = targetFile(projectRoot, path4);
-  mkdirSync17(dirname13(file), { recursive: true, mode: 448 });
+  mkdirSync17(dirname14(file), { recursive: true, mode: 448 });
   writeDurableNew(file, bytes, 384);
 }
 function writeAndVerifyBackups(projectRoot, operation) {
@@ -30806,7 +30821,7 @@ function writeAndVerifyBackups(projectRoot, operation) {
       fail3("repair_preimage_changed", entry.path, "destination changed before transaction preparation; local bytes were preserved");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync17(dirname13(file), { recursive: true, mode: 448 });
+    mkdirSync17(dirname14(file), { recursive: true, mode: 448 });
     writeDurableNew(file, current, 384);
   }
 }
@@ -30821,7 +30836,7 @@ function writeKnownBackups(projectRoot, operation) {
       fail3("init_transaction_backup_source_invalid", entry.path, "supported source template cannot reproduce the pinned preimage");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync17(dirname13(file), { recursive: true, mode: 448 });
+    mkdirSync17(dirname14(file), { recursive: true, mode: 448 });
     writeDurableNew(file, bytes, 384);
   }
 }
@@ -30829,7 +30844,7 @@ function verifyBackups(projectRoot, operation) {
   if (operation.kind !== "repair") return;
   for (const entry of operation.files) {
     if (entry.observedSha256 === null) continue;
-    const bytes = readOptionalManaged(join22(transactionRoot(projectRoot), "backups"), entry.path);
+    const bytes = readOptionalManaged(join23(transactionRoot(projectRoot), "backups"), entry.path);
     if (!bytes || vnextContentSha256(bytes) !== entry.observedSha256) {
       fail3("init_transaction_backup_invalid", entry.path, "pinned preimage backup is missing or corrupt");
     }
@@ -30863,10 +30878,10 @@ function sourceConfigFiles(projectRoot) {
     ".kxm/repo/repo.yaml",
     ".kxm/repo/env.yaml"
   ];
-  const files = fixed.filter((path4) => existsSync19(join22(projectRoot, ...path4.split("/"))));
+  const files = fixed.filter((path4) => existsSync20(join23(projectRoot, ...path4.split("/"))));
   for (const directory of ["agents", "models", "workflows"]) {
-    const absolute = join22(projectRoot, ".kxm", directory);
-    if (!existsSync19(absolute)) continue;
+    const absolute = join23(projectRoot, ".kxm", directory);
+    if (!existsSync20(absolute)) continue;
     const stat = lstatSync7(absolute);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_directory_invalid", `.kxm/${directory}`, "configuration directory must be regular", "path");
     for (const entry of readdirSync7(absolute, { withFileTypes: true })) {
@@ -30887,8 +30902,8 @@ function absoluteMemberBindings(projectRoot, project, explicit = {}) {
     const repository = candidate;
     if (repository.role !== "member" || typeof repository.id !== "string" || Object.hasOwn(bindings, repository.id)) continue;
     if (typeof repository.pathHint === "string") {
-      const candidate2 = resolve18(projectRoot, ...repository.pathHint.split("/"));
-      if (existsSync19(candidate2)) bindings[repository.id] = candidate2;
+      const candidate2 = resolve17(projectRoot, ...repository.pathHint.split("/"));
+      if (existsSync20(candidate2)) bindings[repository.id] = candidate2;
     }
   }
   return bindings;
@@ -30902,9 +30917,9 @@ function prepareShadow(projectRoot, operation, options) {
       const bytes = readOptionalManaged(projectRoot, path4);
       if (!bytes) fail3("repair_snapshot_file_missing", path4, "configuration changed during shadow preparation");
       total += bytes.byteLength;
-      const source = join22(projectRoot, ...path4.split("/"));
-      const destination = join22(shadow, ...path4.split("/"));
-      mkdirSync17(dirname13(destination), { recursive: true, mode: 448 });
+      const source = join23(projectRoot, ...path4.split("/"));
+      const destination = join23(shadow, ...path4.split("/"));
+      mkdirSync17(dirname14(destination), { recursive: true, mode: 448 });
       writeDurableNew(destination, bytes, lstatSync7(source).mode & 511);
       if (total > MAX_MANAGED_TOTAL_BYTES) fail3("repair_snapshot_too_large", ".kxm", `configuration snapshot exceeds ${MAX_MANAGED_TOTAL_BYTES} bytes`, "parse");
     }
@@ -30912,12 +30927,12 @@ function prepareShadow(projectRoot, operation, options) {
   for (const entry of operation.files) {
     const bytes = readTarget(projectRoot, entry.path);
     if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-    const destination = join22(shadow, ...entry.path.split("/"));
-    mkdirSync17(dirname13(destination), { recursive: true, mode: 448 });
-    const mode = existsSync19(destination) ? lstatSync7(destination).mode & 511 : 420;
+    const destination = join23(shadow, ...entry.path.split("/"));
+    mkdirSync17(dirname14(destination), { recursive: true, mode: 448 });
+    const mode = existsSync20(destination) ? lstatSync7(destination).mode & 511 : 420;
     writeDurable(destination, bytes, mode);
   }
-  const project = parseRestrictedYaml2(readFileSync20(join22(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
+  const project = parseRestrictedYaml2(readFileSync20(join23(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
   const bound = absoluteMemberBindings(projectRoot, project, options.repositoryBindings);
   loadVnextProject(shadow, { ...loaderOptions(options), repositoryBindings: bound });
   const provenance = readProjectAndProvenance(shadow, options.schemasDir)?.provenance;
@@ -30926,7 +30941,7 @@ function prepareShadow(projectRoot, operation, options) {
   }
 }
 function createOperation(projectRoot, kind, rendered, files, sourceTemplateRevision) {
-  const root = resolve18(projectRoot);
+  const root = resolve17(projectRoot);
   const operationWithoutHash = {
     schema: "kxm.init-operation.v1",
     operationId: `op_${randomUUID10().replaceAll("-", "")}`,
@@ -30955,7 +30970,7 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   const transaction = transactionRoot(projectRoot);
   validateOperationRecord(operation, options.schemasDir);
   validateOperationIntent(projectRoot, operation);
-  if (existsSync19(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
+  if (existsSync20(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
   mkdirSync17(transaction, { mode: 448 });
   syncDirectory2(projectRoot);
   writeOperation(projectRoot, operation);
@@ -30977,25 +30992,25 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   }
 }
 function ensureDestinationParents(projectRoot, path4) {
-  const boundary = resolve18(projectRoot);
+  const boundary = resolve17(projectRoot);
   const segments = path4.split("/").slice(0, -1);
   let current = boundary;
   for (const segment of segments) {
-    current = join22(current, segment);
-    if (!existsSync19(current)) mkdirSync17(current, { mode: 448 });
+    current = join23(current, segment);
+    if (!existsSync20(current)) mkdirSync17(current, { mode: 448 });
     const stat = lstatSync7(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_destination_parent_invalid", path4, "destination parent must be a regular directory", "path");
   }
 }
 function destinationSha(projectRoot, path4) {
-  const file = join22(projectRoot, ...path4.split("/"));
-  if (!existsSync19(file)) return void 0;
+  const file = join23(projectRoot, ...path4.split("/"));
+  if (!existsSync20(file)) return void 0;
   return vnextContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
   const nonce = randomUUID10();
-  const source = join22(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
-  const target = join22(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
+  const source = join23(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
+  const target = join23(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
   try {
     writeDurableNew(source, Buffer.from("kxm-link-probe\n", "utf8"), 384);
     try {
@@ -31010,19 +31025,19 @@ function requireConditionalLinkSupport(directory, operationId, path4) {
   }
 }
 function atomicInstallTarget(projectRoot, operation, entry) {
-  const destination = join22(projectRoot, ...entry.path.split("/"));
+  const destination = join23(projectRoot, ...entry.path.split("/"));
   ensureDestinationParents(projectRoot, entry.path);
-  const directory = dirname13(destination);
+  const directory = dirname14(destination);
   const temporaryPrefix = `.kxm-repair-${operation.operationId}-`;
   const pathKey = vnextContentSha256(entry.path).slice("sha256:".length, "sha256:".length + 16);
-  const displaced = join22(directory, `${temporaryPrefix}${pathKey}.preimage`);
-  if (existsSync19(displaced)) {
+  const displaced = join23(directory, `${temporaryPrefix}${pathKey}.preimage`);
+  if (existsSync20(displaced)) {
     const stat = lstatSync7(displaced);
     if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_preimage_temporary_invalid", entry.path, "stale displaced preimage is not a regular file", "path");
     if (entry.observedSha256 === null || vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
       fail3("repair_preimage_temporary_mismatch", entry.path, "stale displaced preimage does not match the pinned operation");
     }
-    if (!existsSync19(destination)) {
+    if (!existsSync20(destination)) {
       try {
         linkSync(displaced, destination);
       } catch {
@@ -31037,7 +31052,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     const owned = candidate.name.startsWith(temporaryPrefix) && (candidate.name.endsWith(".tmp") || candidate.name.endsWith(".link-source") || candidate.name.endsWith(".link-target"));
     if (!owned) continue;
     if (!candidate.isFile()) fail3("repair_temporary_invalid", entry.path, "stale operation temporary is not a regular file", "path");
-    rmSync7(join22(directory, candidate.name), { force: true });
+    rmSync7(join23(directory, candidate.name), { force: true });
   }
   const current = destinationSha(projectRoot, entry.path);
   if (current === entry.targetSha256) return;
@@ -31047,15 +31062,15 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   requireConditionalLinkSupport(directory, operation.operationId, entry.path);
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-  const temporary = join22(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
-  const mode = existsSync19(destination) ? lstatSync7(destination).mode & 511 : 420;
+  const temporary = join23(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
+  const mode = existsSync20(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
     if (entry.observedSha256 !== null) {
       renameSync5(destination, displaced);
       syncDirectory2(directory);
       if (vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
-        if (!existsSync19(destination)) {
+        if (!existsSync20(destination)) {
           try {
             linkSync(displaced, destination);
           } catch {
@@ -31071,7 +31086,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     try {
       linkSync(temporary, destination);
     } catch {
-      if (!existsSync19(destination) && existsSync19(displaced)) {
+      if (!existsSync20(destination) && existsSync20(displaced)) {
         try {
           linkSync(displaced, destination);
         } catch {
@@ -31093,12 +31108,12 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   if (destinationSha(projectRoot, entry.path) !== entry.targetSha256) fail3("repair_install_verification_failed", entry.path, "installed target hash does not match the pinned operation");
 }
 function installedCreateMatches(projectRoot, operation) {
-  const configRoot = join22(projectRoot, ".kxm");
-  if (!existsSync19(configRoot)) return false;
+  const configRoot = join23(projectRoot, ".kxm");
+  if (!existsSync20(configRoot)) return false;
   const actual = [];
   const visit2 = (directory) => {
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      const absolute = join22(directory, entry.name);
+      const absolute = join23(directory, entry.name);
       if (entry.isSymbolicLink()) fail3("create_resume_link", relativeConfigPath(projectRoot, absolute), "created configuration must not contain links", "path");
       if (entry.isDirectory()) visit2(absolute);
       else if (entry.isFile()) actual.push(relativeConfigPath(projectRoot, absolute));
@@ -31111,15 +31126,15 @@ function installedCreateMatches(projectRoot, operation) {
   return actual.length === expected.length && actual.every((path4, index) => path4 === expected[index]) && operation.files.every((entry) => destinationSha(projectRoot, entry.path) === entry.targetSha256);
 }
 function relativeConfigPath(projectRoot, file) {
-  return relative4(resolve18(projectRoot), file).replaceAll("\\", "/");
+  return relative4(resolve17(projectRoot), file).replaceAll("\\", "/");
 }
 function syncTreeDirectories(root) {
-  if (!existsSync19(root)) return;
+  if (!existsSync20(root)) return;
   const directories = [];
   const visit2 = (directory) => {
     directories.push(directory);
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      if (entry.isDirectory()) visit2(join22(directory, entry.name));
+      if (entry.isDirectory()) visit2(join23(directory, entry.name));
     }
   };
   visit2(root);
@@ -31133,7 +31148,7 @@ function rebuildCreateShadow(projectRoot, operation, options) {
   if (stat.isSymbolicLink() || !stat.isDirectory() || !installedCreateMatches(shadow, operation)) {
     fail3("create_shadow_invalid", TRANSACTION_NAME, "reconstructed create shadow does not exactly match pinned target files", "path");
   }
-  syncTreeDirectories(join22(shadow, ".kxm"));
+  syncTreeDirectories(join23(shadow, ".kxm"));
 }
 function applyOperation(projectRoot, original, options, resumed) {
   assertNoRegisteredGates(options);
@@ -31143,10 +31158,10 @@ function applyOperation(projectRoot, original, options, resumed) {
   verifyBackups(projectRoot, operation);
   operation = updatePhase(projectRoot, operation, "applying");
   if (operation.kind === "create") {
-    const destination = join22(projectRoot, ".kxm");
-    if (!existsSync19(destination)) {
+    const destination = join23(projectRoot, ".kxm");
+    if (!existsSync20(destination)) {
       rebuildCreateShadow(projectRoot, operation, effectiveOptions);
-      renameSync5(join22(shadowRoot(projectRoot), ".kxm"), destination);
+      renameSync5(join23(shadowRoot(projectRoot), ".kxm"), destination);
       syncDirectory2(projectRoot);
     } else if (!installedCreateMatches(projectRoot, operation)) {
       fail3("create_resume_conflict", ".kxm", "existing project configuration does not match the pinned create operation");
@@ -31173,7 +31188,7 @@ function applyOperation(projectRoot, original, options, resumed) {
   operation = updatePhase(projectRoot, operation, "verified");
   if (options.testFaultAt === "verified") throw new Error("injected init fault after verification");
   const files = operation.files.map((entry) => entry.path);
-  syncTreeDirectories(join22(projectRoot, ".kxm"));
+  syncTreeDirectories(join23(projectRoot, ".kxm"));
   return { kind: operation.kind, resumed, bundle, files };
 }
 function prepareAndApplyVnextCreate(projectRoot, rendered, options = {}) {
@@ -31288,7 +31303,7 @@ function finishPreparingOperation(projectRoot, operation, options) {
   const rendered = rendererForOperation(operation);
   if (!rendered) fail3("init_transaction_renderer_unavailable", TRANSACTION_NAME, "this binary cannot reproduce the pinned pre-application target");
   for (const directory of ["targets", "backups", "shadow"]) {
-    rmSync7(join22(transactionRoot(projectRoot), directory), { recursive: true, force: true });
+    rmSync7(join23(transactionRoot(projectRoot), directory), { recursive: true, force: true });
   }
   for (const entry of operation.files) {
     const bytes = rendered.files.get(entry.path);
@@ -31307,7 +31322,7 @@ function resumeVnextInitTransaction(projectRoot, options = {}) {
   let operation = readOperation(projectRoot, options.schemasDir);
   if (!operation) {
     const root = transactionRoot(projectRoot);
-    if (existsSync19(root)) {
+    if (existsSync20(root)) {
       rmSync7(root, { recursive: true, force: true });
       syncDirectory2(projectRoot);
     }
@@ -31323,7 +31338,7 @@ function commitVnextInitTransaction(projectRoot, schemasDir) {
     fail3("init_transaction_not_verified", TRANSACTION_NAME, "initialization transaction cannot commit before installed state is verified");
   }
   const transaction = transactionRoot(projectRoot);
-  const retired = join22(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
+  const retired = join23(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
   renameSync5(transaction, retired);
   syncDirectory2(projectRoot);
   rmSync7(retired, { recursive: true, force: true });
@@ -31432,7 +31447,7 @@ function validateBindingIdentities(bundle, persisted, explicit) {
 }
 function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const storeOptions = bindingStoreOptions(options);
-  const persisted = existsSync20(join23(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
+  const persisted = existsSync21(join24(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
   const repositoryBindings = Object.fromEntries([
     ...Object.entries(persisted?.repositories ?? {}),
     ...Object.entries(options.repositoryBindings ?? {})
@@ -31621,7 +31636,7 @@ function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock)
   const files = [...rendered.files.keys()];
   if (options.dryRun) return { action: "planned", plan, projectRoot: gitRoot, files };
   if (!mutationLock) throw new Error("project mutation lock is required to create configuration");
-  if (existsSync20(join23(gitRoot, ".kxm"))) {
+  if (existsSync21(join24(gitRoot, ".kxm"))) {
     throw new VnextConfigError([initIssue("workspace_changed", ".kxm", "workspace changed after planning; existing .kxm state was not overwritten")]);
   }
   const created = prepareAndApplyVnextCreate(gitRoot, rendered, transactionOptions);
@@ -31653,8 +31668,8 @@ function initializeVnextProject(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-migrate.ts
 var import_yaml12 = __toESM(require_dist(), 1);
 import { createHash as createHash13 } from "node:crypto";
-import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync21, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync18, openSync as openSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join24 } from "node:path";
+import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync22, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync18, openSync as openSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join25 } from "node:path";
 var MAX_LEGACY_JSON_BYTES = 1024 * 1024;
 var MAX_LEGACY_JSON_DEPTH = 32;
 var MAX_LEGACY_JSON_NODES = 32768;
@@ -31823,7 +31838,7 @@ function readVnextLegacySources(root) {
     throw new VnextConfigError([migrateIssue("discovery", "legacy_source_limit", ".kxm/config", `legacy configuration exceeds ${MAX_LEGACY_SOURCES} files`)]);
   }
   return files.map((path4) => {
-    const absolute = join24(root, ...path4.split("/"));
+    const absolute = join25(root, ...path4.split("/"));
     const stat = lstatSync8(absolute);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       throw new VnextConfigError([migrateIssue("path", "legacy_source_invalid", path4, "legacy configuration must be a regular file, not a link")]);
@@ -32901,7 +32916,7 @@ function planVnextMigration(projectRoot, options = {}) {
   };
 }
 function readVnextMigrationDecisions(path4, schemasDir) {
-  if (!existsSync21(path4)) {
+  if (!existsSync22(path4)) {
     throw new VnextConfigError([migrateIssue("discovery", "decisions_missing", path4, "migration decisions file does not exist")]);
   }
   const registry = new VnextSchemaRegistry(schemasDir);
@@ -32944,9 +32959,9 @@ function writeDurable2(path4, content) {
       chmodSync6(path4, 384);
     } catch {
     }
-    syncDirectory3(join24(path4, ".."));
+    syncDirectory3(join25(path4, ".."));
   } finally {
-    if (created && existsSync21(temp)) rmSync8(temp, { force: true });
+    if (created && existsSync22(temp)) rmSync8(temp, { force: true });
   }
 }
 function applyVnextMigration(projectRoot, options = {}) {
@@ -32956,8 +32971,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     ...options.schemasDir === void 0 ? {} : { schemasDir: options.schemasDir }
   };
   const execute = (lock) => {
-    const receiptAbsolute = join24(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
-    if (existsSync21(receiptAbsolute)) {
+    const receiptAbsolute = join25(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+    if (existsSync22(receiptAbsolute)) {
       const stat = lstatSync8(receiptAbsolute);
       if (stat.isSymbolicLink() || !stat.isFile()) {
         throw new VnextConfigError([migrateIssue("path", "migration_receipt_invalid", VNEXT_MIGRATION_RECEIPT_PATH, "migration receipt must be a regular file, not a link")]);
@@ -33010,7 +33025,7 @@ function applyVnextMigration(projectRoot, options = {}) {
       return { action: "planned", projectRoot: root, files: [], plan: first.plan };
     }
     const files = [...first.resources.entries()].sort(([left], [right]) => compareCodeUnits6(left, right)).map(([path4, value]) => ({ path: path4, bytes: Buffer.from((0, import_yaml12.stringify)(value, { lineWidth: 0 }), "utf8") }));
-    const collisions = files.filter((file) => existsSync21(join24(root, ...file.path.split("/"))));
+    const collisions = files.filter((file) => existsSync22(join25(root, ...file.path.split("/"))));
     if (collisions.length > 0) {
       throw new VnextConfigError(collisions.map((file) => migrateIssue("semantic", "migration_target_exists", file.path, "target resource already exists; refusing to overwrite")));
     }
@@ -33019,8 +33034,8 @@ function applyVnextMigration(projectRoot, options = {}) {
       const segments = file.path.split("/");
       let current = root;
       for (const segment of segments.slice(0, -1)) {
-        current = join24(current, segment);
-        if (!existsSync21(current)) continue;
+        current = join25(current, segment);
+        if (!existsSync22(current)) continue;
         const stat = lstatSync8(current);
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
           parentIssues.push(migrateIssue("path", "migration_target_parent_invalid", file.path, `migration target parent ${segment} must be a regular directory, not a link`));
@@ -33036,8 +33051,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     const written = [];
     try {
       for (const file of files) {
-        const absolute = join24(root, ...file.path.split("/"));
-        mkdirSync18(join24(absolute, ".."), { recursive: true });
+        const absolute = join25(root, ...file.path.split("/"));
+        mkdirSync18(join25(absolute, ".."), { recursive: true });
         written.push(absolute);
         writeDurable2(absolute, file.bytes);
       }
@@ -33083,8 +33098,8 @@ ${bundle.configRevision}`).slice(7, 39)}`,
 }
 function verifyVnextMigration(projectRoot, options = {}) {
   const root = migrationGitRoot(projectRoot);
-  const receiptAbsolute = join24(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
-  if (!existsSync21(receiptAbsolute)) {
+  const receiptAbsolute = join25(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  if (!existsSync22(receiptAbsolute)) {
     return {
       ok: false,
       projectRoot: root,
@@ -33132,7 +33147,6 @@ function verifyVnextMigration(projectRoot, options = {}) {
 
 // plugins/kxm/src/cli/vnext.ts
 var vnextDriveCliSeams = {};
-var repoRoot3 = resolve20(fileURLToPath4(new URL("../../../../", import.meta.url)));
 function initPlanPayload(plan) {
   return {
     mode: plan.mode,
@@ -33382,7 +33396,7 @@ async function cmdBackup(runtime, options) {
   try {
     const { manifest, outDir } = createBackup({
       projectRoot: runtime.cwd,
-      ...options.out ? { outDir: resolve20(runtime.cwd, options.out) } : {}
+      ...options.out ? { outDir: resolve19(runtime.cwd, options.out) } : {}
     });
     const payload = {
       ok: true,
@@ -33394,7 +33408,7 @@ async function cmdBackup(runtime, options) {
     const summary = [
       `Created SQLite backup with ${manifest.stores.length} store(s):`,
       ...manifest.stores.map((s) => `  - ${s.storeId}: ${s.sourcePath} -> ${s.backupFile} (schema v${s.schemaVersion}, ${s.bytes} bytes, sha256 ${s.sha256.slice(0, 12)}...)`),
-      `Manifest: ${join25(outDir, "manifest.json")}`
+      `Manifest: ${join26(outDir, "manifest.json")}`
     ].join("\n");
     print(runtime.io, runtime.json, payload, summary);
     return 0;
@@ -33409,7 +33423,7 @@ async function cmdBackup(runtime, options) {
 }
 async function cmdRestore(runtime, manifestArg) {
   try {
-    const result = restoreBackup(resolve20(runtime.cwd, manifestArg), {
+    const result = restoreBackup(resolve19(runtime.cwd, manifestArg), {
       projectRoot: runtime.cwd
     });
     const payload = {
@@ -33669,7 +33683,7 @@ async function selectProducerModel(runtime, requested) {
   if (runtime.json || !process.stdin.isTTY || models.length === 0) return void 0;
   runtime.io.stdout(models.slice(0, 100).map((model, index2) => `${index2 + 1}. ${model}`).join("\n") + "\nSelect model number: ");
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve31) => rl.once("line", resolve31));
+  const answer = await new Promise((resolve30) => rl.once("line", resolve30));
   rl.close();
   const index = Number.parseInt(answer.trim(), 10) - 1;
   return Number.isInteger(index) && index >= 0 && index < models.length ? models[index] : void 0;
@@ -33695,7 +33709,7 @@ async function cmdModelsScreen(runtime) {
     return 2;
   }
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const ask = (q2) => new Promise((resolve31) => rl.question(q2, resolve31));
+  const ask = (q2) => new Promise((resolve30) => rl.question(q2, resolve30));
   try {
     while (true) {
       const policy = loadProducerPolicy(runtime.dirs.workdir);
@@ -33959,11 +33973,11 @@ async function cmdStudioLayout(runtime, workflowPath) {
     const projectRoot = discoverVnextProjectRoot(runtime.cwd) ?? runtime.cwd;
     let filePath = workflowPath;
     if (!filePath) {
-      filePath = resolve21(projectRoot, ".kxm", "workflows", "default.yaml");
+      filePath = resolve20(projectRoot, ".kxm", "workflows", "default.yaml");
     }
     let yamlContent;
     let workflowId = "default";
-    if (existsSync22(filePath)) {
+    if (existsSync23(filePath)) {
       yamlContent = readFileSync22(filePath, "utf8");
     } else {
       yamlContent = `schema: kxm.workflow.v1
@@ -34037,14 +34051,14 @@ async function cmdStudioServe(runtime, options) {
       sessionToken,
       planProvider: () => {
         try {
-          const wfDir = join26(runtime.cwd, ".kxm", "workflows");
-          const defaultPath = join26(wfDir, "default.yaml");
-          let targetPath = existsSync22(defaultPath) ? defaultPath : void 0;
-          if (!targetPath && existsSync22(wfDir)) {
+          const wfDir = join27(runtime.cwd, ".kxm", "workflows");
+          const defaultPath = join27(wfDir, "default.yaml");
+          let targetPath = existsSync23(defaultPath) ? defaultPath : void 0;
+          if (!targetPath && existsSync23(wfDir)) {
             const yml = readdirSync8(wfDir).find((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
-            if (yml) targetPath = join26(wfDir, yml);
+            if (yml) targetPath = join27(wfDir, yml);
           }
-          if (targetPath && existsSync22(targetPath)) {
+          if (targetPath && existsSync23(targetPath)) {
             const raw = readFileSync22(targetPath, "utf8");
             const parsed = (0, import_yaml13.parse)(raw);
             const wfId = basename6(targetPath).replace(/\.(yaml|yml)$/, "");
@@ -34096,13 +34110,13 @@ Press Ctrl+C to stop.
 
 // plugins/kxm/src/cli/context-skills.ts
 import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join30, relative as relative5 } from "node:path";
+import { join as join31, relative as relative5 } from "node:path";
 
 // plugins/kxm/src/memory.ts
 var import_yaml14 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "node:fs";
-import { extname as extname2, join as join27, resolve as resolve22 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "node:fs";
+import { extname as extname2, join as join28, resolve as resolve21 } from "node:path";
 var MEMORY_SCHEMA = "kxm.memory.v1";
 var MEMORY_BRIEF_SCHEMA = "kxm.memory-brief.v1";
 var MEMORY_MARKER_START = "<!-- kxm:memory:start -->";
@@ -34227,20 +34241,20 @@ ${yamlText}
 ---
 `;
 }
-function memoryDirectories(repoRoot6) {
-  const root = resolve22(repoRoot6);
-  const memoryDir = join27(root, ".kxm", "memory");
-  const candidatesDir = join27(memoryDir, "candidates");
+function memoryDirectories(repoRoot) {
+  const root = resolve21(repoRoot);
+  const memoryDir = join28(root, ".kxm", "memory");
+  const candidatesDir = join28(memoryDir, "candidates");
   return { memoryDir, candidatesDir };
 }
-function loadAuthoredMemory(repoRoot6) {
-  const { memoryDir } = memoryDirectories(repoRoot6);
-  if (!existsSync23(memoryDir)) return [];
+function loadAuthoredMemory(repoRoot) {
+  const { memoryDir } = memoryDirectories(repoRoot);
+  if (!existsSync24(memoryDir)) return [];
   const records = [];
   const entries = readdirSync9(memoryDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && extname2(entry.name) === ".md") {
-      const fullPath = join27(memoryDir, entry.name);
+      const fullPath = join28(memoryDir, entry.name);
       try {
         const text = readFileSync23(fullPath, "utf8");
         const record = parseMemoryRecord(text, entry.name);
@@ -34254,8 +34268,8 @@ function loadAuthoredMemory(repoRoot6) {
   }
   return records.sort((left, right) => left.id.localeCompare(right.id));
 }
-function createMemoryNote(repoRoot6, summary, options = {}) {
-  const { candidatesDir } = memoryDirectories(repoRoot6);
+function createMemoryNote(repoRoot, summary, options = {}) {
+  const { candidatesDir } = memoryDirectories(repoRoot);
   mkdirSync19(candidatesDir, { recursive: true });
   const scope = options.scope ?? "project";
   if (!VALID_SCOPES.has(scope)) {
@@ -34281,12 +34295,12 @@ function createMemoryNote(repoRoot6, summary, options = {}) {
     evidenceRefs: [],
     ...options.body ? { body: options.body.trim() } : {}
   };
-  const targetPath = join27(candidatesDir, `${id}.md`);
+  const targetPath = join28(candidatesDir, `${id}.md`);
   writeFileSync18(targetPath, formatMemoryRecord(record), "utf8");
   return { record, path: targetPath };
 }
-function generateMemoryBrief(repoRoot6) {
-  const facts = loadAuthoredMemory(repoRoot6);
+function generateMemoryBrief(repoRoot) {
+  const facts = loadAuthoredMemory(repoRoot);
   return {
     schema: MEMORY_BRIEF_SCHEMA,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -34318,7 +34332,7 @@ function formatHarnessMemoryBlock(records) {
 }
 function updateHarnessDocument(filePath, block, defaultHeader) {
   let original = "";
-  if (existsSync23(filePath)) {
+  if (existsSync24(filePath)) {
     original = readFileSync23(filePath, "utf8");
   }
   let updated = "";
@@ -34352,20 +34366,20 @@ ${block}
   }
   return false;
 }
-function syncHarnessMemory(repoRoot6) {
-  const root = resolve22(repoRoot6);
+function syncHarnessMemory(repoRoot) {
+  const root = resolve21(repoRoot);
   const records = loadAuthoredMemory(root);
   const block = formatHarnessMemoryBlock(records);
   const updated = [];
   const created = [];
-  const agentsPath = join27(root, "AGENTS.md");
+  const agentsPath = join28(root, "AGENTS.md");
   const agentsHeader = "# AGENTS\n\nFollow project instructions.\n";
-  const agentsExisted = existsSync23(agentsPath);
+  const agentsExisted = existsSync24(agentsPath);
   if (updateHarnessDocument(agentsPath, block, agentsHeader)) {
     if (agentsExisted) updated.push("AGENTS.md");
     else created.push("AGENTS.md");
   }
-  const claudePath = join27(root, "CLAUDE.md");
+  const claudePath = join28(root, "CLAUDE.md");
   const claudeHeader = `# KXM (Claude)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34376,12 +34390,12 @@ you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).
 If \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are
 artifacts, not hub \`peer-reply\` evidence.
 `;
-  const claudeExisted = existsSync23(claudePath);
+  const claudeExisted = existsSync24(claudePath);
   if (updateHarnessDocument(claudePath, block, claudeHeader)) {
     if (claudeExisted) updated.push("CLAUDE.md");
     else created.push("CLAUDE.md");
   }
-  const geminiPath = join27(root, "GEMINI.md");
+  const geminiPath = join28(root, "GEMINI.md");
   const geminiHeader = `# KXM (Gemini / Antigravity)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34390,7 +34404,7 @@ Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 Google / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route
 for Gemini models. Starting rotation remains Grok.
 `;
-  const geminiExisted = existsSync23(geminiPath);
+  const geminiExisted = existsSync24(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {
     if (geminiExisted) updated.push("GEMINI.md");
     else created.push("GEMINI.md");
@@ -34401,8 +34415,8 @@ for Gemini models. Starting rotation remains Grok.
 // plugins/kxm/src/skills.ts
 var import_yaml15 = __toESM(require_dist(), 1);
 import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
+import { join as join29 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
 var SKILL_EVALUATION_SCHEMA = "kxm.skill-evaluation.v1";
 var SKILL_DECISION_SCHEMA = "kxm.skill-decision.v1";
@@ -34496,20 +34510,20 @@ var SkillLifecycle = class {
     this.allowOptimizationEvals = options.allowOptimizationEvals === true;
   }
   dir(state) {
-    return join28(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
+    return join29(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
   }
   historyFile(id) {
-    return join28(this.root, "history", `${id}.jsonl`);
+    return join29(this.root, "history", `${id}.jsonl`);
   }
   paths(state, id) {
-    const dir = join28(this.dir(state), id);
-    return { dir, metadata: join28(dir, "metadata.json"), skill: join28(dir, "SKILL.md") };
+    const dir = join29(this.dir(state), id);
+    return { dir, metadata: join29(dir, "metadata.json"), skill: join29(dir, "SKILL.md") };
   }
   appendHistory(id, record) {
-    mkdirSync20(join28(this.root, "history"), { recursive: true });
+    mkdirSync20(join29(this.root, "history"), { recursive: true });
     const line = `${JSON.stringify(record)}
 `;
-    if (existsSync24(this.historyFile(id))) {
+    if (existsSync25(this.historyFile(id))) {
       const existing = readFileSync24(this.historyFile(id), "utf8");
       const lines = existing.split("\n").filter((entry) => entry.trim());
       writeFileSync19(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
@@ -34519,24 +34533,24 @@ var SkillLifecycle = class {
   }
   history(id) {
     const file = this.historyFile(id);
-    if (!existsSync24(file)) return [];
+    if (!existsSync25(file)) return [];
     return readFileSync24(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   }
   readMetadata(state, id) {
     const { metadata } = this.paths(state, id);
-    if (!existsSync24(metadata)) {
+    if (!existsSync25(metadata)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${state}`);
     }
     return JSON.parse(readFileSync24(metadata, "utf8"));
   }
   move(from, to, id) {
-    const fromDir = join28(this.dir(from), id);
-    const toDir = join28(this.dir(to), id);
-    if (!existsSync24(fromDir)) {
+    const fromDir = join29(this.dir(from), id);
+    const toDir = join29(this.dir(to), id);
+    if (!existsSync25(fromDir)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${from}`);
     }
     mkdirSync20(this.dir(to), { recursive: true });
-    if (existsSync24(toDir)) rmSync9(toDir, { recursive: true, force: true });
+    if (existsSync25(toDir)) rmSync9(toDir, { recursive: true, force: true });
     renameSync7(fromDir, toDir);
   }
   /** Submit a new skill candidate. Content is redacted of secret material at
@@ -34579,7 +34593,7 @@ var SkillLifecycle = class {
     const contentSha256 = skillContentSha256(content);
     const id = skillIdFor(name, contentSha256);
     const { dir, metadata, skill } = this.paths("candidate", id);
-    if (existsSync24(metadata)) {
+    if (existsSync25(metadata)) {
       throw new SkillLifecycleError(
         "skill_candidate_exists",
         `identical candidate ${id} already exists; changed behavior requires changed content`
@@ -34694,9 +34708,9 @@ var SkillLifecycle = class {
     const metadataContent = readFileSync24(candidatePaths.metadata, "utf8");
     writeFileSync19(promotedPaths.skill, skillContent);
     writeFileSync19(promotedPaths.metadata, metadataContent);
-    const patchesDir = join28(this.root, "patches");
+    const patchesDir = join29(this.root, "patches");
     mkdirSync20(patchesDir, { recursive: true });
-    const patchPath = join28(patchesDir, `${candidateId}.patch`);
+    const patchPath = join29(patchesDir, `${candidateId}.patch`);
     const relSkillPath = `.kxm/skills/promoted/${candidateId}/SKILL.md`;
     const relMetaPath = `.kxm/skills/promoted/${candidateId}/metadata.json`;
     const patch = `${createUnifiedPatch(relSkillPath, skillContent)}${createUnifiedPatch(relMetaPath, metadataContent)}`;
@@ -34742,7 +34756,7 @@ var SkillLifecycle = class {
   }
   list(state) {
     const dir = this.dir(state);
-    if (!existsSync24(dir)) return [];
+    if (!existsSync25(dir)) return [];
     const ids = readdirSorted(dir);
     return ids.map((id) => {
       try {
@@ -34770,16 +34784,16 @@ function boundedList(value, field) {
   return [...new Set(refs)];
 }
 function readdirSorted(dir) {
-  return readdirSync10(dir).filter((entry) => statSync3(join28(dir, entry)).isDirectory()).sort();
+  return readdirSync10(dir).filter((entry) => statSync3(join29(dir, entry)).isDirectory()).sort();
 }
 
 // plugins/kxm/src/wiki.ts
 import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 function writeCompiledWiki(root, wiki) {
   const written = [];
   for (const [relativePath, content] of [...wiki.pages].sort(([left], [right]) => left.localeCompare(right))) {
-    const absolute = join29(root, relativePath);
+    const absolute = join30(root, relativePath);
     mkdirSync21(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
     writeFileSync20(absolute, content);
     written.push(relativePath);
@@ -34947,7 +34961,7 @@ function skillStateFromFlag(value) {
   throw new Error(`invalid skill state ${value}`);
 }
 function skillsRoot(runtime) {
-  return join30(runtime.dirs.workdir, ".kxm", "skills");
+  return join31(runtime.dirs.workdir, ".kxm", "skills");
 }
 function csv(value) {
   if (!value) return void 0;
@@ -35122,8 +35136,8 @@ async function cmdMemorySync(runtime) {
 
 // plugins/kxm/src/cli/hub.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync30, mkdirSync as mkdirSync25, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join40, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync25, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join41, resolve as resolve24 } from "node:path";
 
 // node_modules/marked/lib/marked.esm.js
 function M() {
@@ -39285,10 +39299,10 @@ var TuiBase = class _TuiBase extends Container {
    * @returns Promise containing the parsed RGB color, or undefined if it times out or fails to parse.
    */
   queryTerminalBackgroundColor({ timeoutMs }) {
-    return new Promise((resolve31) => {
+    return new Promise((resolve30) => {
       const query = {
         settled: false,
-        resolve: resolve31,
+        resolve: resolve30,
         timer: void 0
       };
       query.timer = setTimeout(() => {
@@ -39311,7 +39325,7 @@ var TuiBase = class _TuiBase extends Container {
    * `CSI ? 997 ; 1 n` for dark or `CSI ? 997 ; 2 n` for light.
    */
   queryTerminalColorScheme({ timeoutMs }) {
-    return new Promise((resolve31) => {
+    return new Promise((resolve30) => {
       let settled = false;
       let timer;
       let unsubscribe = () => {
@@ -39325,7 +39339,7 @@ var TuiBase = class _TuiBase extends Container {
           timer = void 0;
         }
         unsubscribe();
-        resolve31(scheme);
+        resolve30(scheme);
       };
       unsubscribe = this.onTerminalColorSchemeChange(settle);
       timer = setTimeout(() => settle(void 0), timeoutMs);
@@ -41056,19 +41070,19 @@ import * as path2 from "node:path";
 
 // node_modules/@earendil-works/pi-tui/dist/native-module-path.js
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname16, join as join31 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { dirname as dirname16, join as join32 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleRequire = createRequire2(import.meta.url);
 var TUI_PACKAGE_NAME = "@earendil-works/pi-tui";
 function getNativeModuleCandidates(nativePath, options = {}) {
-  const moduleDir = dirname16(fileURLToPath5(options.moduleUrl ?? import.meta.url));
+  const moduleDir = dirname16(fileURLToPath2(options.moduleUrl ?? import.meta.url));
   const candidates = [];
   try {
     const packageEntry = (options.resolvePackage ?? moduleRequire.resolve)(TUI_PACKAGE_NAME);
-    candidates.push(join31(dirname16(packageEntry), "..", nativePath));
+    candidates.push(join32(dirname16(packageEntry), "..", nativePath));
   } catch {
   }
-  candidates.push(join31(moduleDir, "..", nativePath), join31(moduleDir, nativePath), join31(dirname16(options.execPath ?? process.execPath), nativePath));
+  candidates.push(join32(moduleDir, "..", nativePath), join32(moduleDir, nativePath), join32(dirname16(options.execPath ?? process.execPath), nativePath));
   return Array.from(new Set(candidates));
 }
 
@@ -41409,7 +41423,7 @@ var ProcessTerminal = class {
           break;
         if (now - lastDataTime >= idleMs)
           break;
-        await new Promise((resolve31) => setTimeout(resolve31, Math.min(idleMs, timeLeft)));
+        await new Promise((resolve30) => setTimeout(resolve30, Math.min(idleMs, timeLeft)));
       }
     } finally {
       process.stdin.removeListener("data", onData);
@@ -43525,7 +43539,7 @@ var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 
 // plugins/kxm/src/tui.ts
 import { mkdirSync as mkdirSync22 } from "node:fs";
-import { join as join35, resolve as resolve24, dirname as dirname17 } from "node:path";
+import { join as join36, resolve as resolve23, dirname as dirname17 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // plugins/kxm/src/external-effects.ts
@@ -43536,9 +43550,9 @@ function slugifyBranchPart(text, maxLength = 40) {
 }
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync25, readdirSync as readdirSync11, readFileSync as readFileSync26 } from "node:fs";
+import { existsSync as existsSync26, readdirSync as readdirSync11, readFileSync as readFileSync26 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { isAbsolute as isAbsolute7, join as join34, resolve as resolve23 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join35, resolve as resolve22 } from "node:path";
 function processExists2(pid) {
   try {
     process.kill(pid, 0);
@@ -43658,36 +43672,36 @@ function readOpenMessageMetadata(database) {
   return messages;
 }
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
-  const stateDir = env.KXM_STATE_DIR?.trim() || join34(cwd, ".kxm", "state");
+  const stateDir = env.KXM_STATE_DIR?.trim() || join35(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve23(cwd, configured) : join34(stateDir, "kxm.db");
+  const dataPath = configured ? resolve22(cwd, configured) : join35(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveVnextStateRoot(stateDir, options) {
-  if (options?.vnextStateRoot && existsSync25(options.vnextStateRoot)) {
-    return resolve23(options.vnextStateRoot);
+  if (options?.vnextStateRoot && existsSync26(options.vnextStateRoot)) {
+    return resolve22(options.vnextStateRoot);
   }
-  if (existsSync25(join34(stateDir, "runtime", "registry.db")) || existsSync25(join34(stateDir, "runtime", "projects"))) {
+  if (existsSync26(join35(stateDir, "runtime", "registry.db")) || existsSync26(join35(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute7(explicit) && existsSync25(resolve23(explicit))) {
-    return resolve23(explicit);
+  if (explicit && isAbsolute7(explicit) && existsSync26(resolve22(explicit))) {
+    return resolve22(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    base = localAppData && isAbsolute7(localAppData) ? localAppData : join34(homedir5(), "AppData", "Local");
-    base = resolve23(base, "KXM");
+    base = localAppData && isAbsolute7(localAppData) ? localAppData : join35(homedir5(), "AppData", "Local");
+    base = resolve22(base, "KXM");
   } else if (process.platform === "darwin") {
-    base = resolve23(homedir5(), "Library", "Application Support", "KXM");
+    base = resolve22(homedir5(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
-    base = xdgState && isAbsolute7(xdgState) ? xdgState : join34(homedir5(), ".local", "state");
-    base = resolve23(base, "kxm");
+    base = xdgState && isAbsolute7(xdgState) ? xdgState : join35(homedir5(), ".local", "state");
+    base = resolve22(base, "kxm");
   }
-  if (existsSync25(base)) return base;
+  if (existsSync26(base)) return base;
   return void 0;
 }
 function loadLocalMeshSnapshot(dataPath, stateDir, options) {
@@ -43698,7 +43712,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let legacyRuns = [];
   let legacyRunTotal = 0;
   let plans = [];
-  if (existsSync25(dataPath)) {
+  if (existsSync26(dataPath)) {
     hasLegacy = true;
     const database = new DatabaseSync(dataPath, { readOnly: true });
     try {
@@ -43718,11 +43732,11 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let vnextRunTotal = 0;
   const vnextStateRoot = resolveVnextStateRoot(stateDir, options);
   if (vnextStateRoot) {
-    const runtimeDir = join34(vnextStateRoot, "runtime");
-    const registryDbPath = join34(runtimeDir, "registry.db");
-    const projectsDir = join34(runtimeDir, "projects");
+    const runtimeDir = join35(vnextStateRoot, "runtime");
+    const registryDbPath = join35(runtimeDir, "registry.db");
+    const projectsDir = join35(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
-    if (existsSync25(registryDbPath)) {
+    if (existsSync26(registryDbPath)) {
       hasVnext = true;
       try {
         const regDb = new DatabaseSync(registryDbPath, { readOnly: true });
@@ -43738,7 +43752,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       } catch {
       }
     }
-    if (existsSync25(projectsDir)) {
+    if (existsSync26(projectsDir)) {
       try {
         for (const entry of readdirSync11(projectsDir, { withFileTypes: true })) {
           if (entry.isDirectory()) {
@@ -43749,8 +43763,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       }
     }
     for (const key of projectKeys) {
-      const eventDbPath = join34(projectsDir, key, "run-events.db");
-      if (existsSync25(eventDbPath)) {
+      const eventDbPath = join35(projectsDir, key, "run-events.db");
+      if (existsSync26(eventDbPath)) {
         hasVnext = true;
         try {
           const eventDb = new DatabaseSync(eventDbPath, { readOnly: true });
@@ -43780,10 +43794,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
   }
   const pids = [];
-  if (existsSync25(stateDir)) {
+  if (existsSync26(stateDir)) {
     for (const file of readdirSync11(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
-        const record = JSON.parse(readFileSync26(join34(stateDir, file), "utf8"));
+        const record = JSON.parse(readFileSync26(join35(stateDir, file), "utf8"));
         pids.push({
           file,
           ...record.role ? { role: record.role } : {},
@@ -43822,8 +43836,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   } else {
     source = "legacy";
   }
-  const telemetryFile = join34(stateDir, "telemetry.jsonl");
-  const spend = existsSync25(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
+  const telemetryFile = join35(stateDir, "telemetry.jsonl");
+  const spend = existsSync26(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
     agents: agents.sort((a, b2) => Number(b2.online) - Number(a.online) || a.name.localeCompare(b2.name)),
@@ -43938,10 +43952,10 @@ function copyToClipboard(text) {
     return false;
   }
 }
-function spawnDegradeWorktree(repoRoot6, runId, options) {
+function spawnDegradeWorktree(repoRoot, runId, options) {
   const runner = options?.execFn ?? ((cmd, args) => {
     const res = spawnSync5(cmd, args, {
-      cwd: repoRoot6,
+      cwd: repoRoot,
       encoding: "utf8",
       windowsHide: true,
       env: Object.fromEntries(
@@ -43957,8 +43971,8 @@ function spawnDegradeWorktree(repoRoot6, runId, options) {
   const cleanRunId = runId.replace(/^run_/, "");
   const desc = options?.description ? slugifyBranchPart(options.description, 30) : "degrade";
   const branchName = `kxm/run-${cleanRunId}-${desc}`;
-  const relativeWtPath = join35(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
-  const absoluteWtPath = resolve24(repoRoot6, relativeWtPath);
+  const relativeWtPath = join36(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
+  const absoluteWtPath = resolve23(repoRoot, relativeWtPath);
   const jumpCommand = `cd "${absoluteWtPath}"`;
   try {
     mkdirSync22(dirname17(absoluteWtPath), { recursive: true });
@@ -44360,11 +44374,11 @@ async function readJson(response) {
 }
 async function waitForReconnect(signal, milliseconds = 1e3) {
   if (signal.aborted) return;
-  await new Promise((resolve31) => {
+  await new Promise((resolve30) => {
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve31();
+      resolve30();
     };
     const timer = setTimeout(done, milliseconds);
     timer.unref();
@@ -44556,8 +44570,8 @@ async function runMeshTui(input) {
             body: JSON.stringify({ signalKey: "operator-degrade", status: "degraded", summary: "Degraded to operator worktree from kxm dash" }),
             signal: abort.signal
           });
-          const repoRoot6 = process.cwd();
-          const degradeRes = spawnDegradeWorktree(repoRoot6, targetId, {
+          const repoRoot = process.cwd();
+          const degradeRes = spawnDegradeWorktree(repoRoot, targetId, {
             description: "operator-degrade"
           });
           if (dashboard) {
@@ -44727,8 +44741,8 @@ async function runMeshTui(input) {
 // plugins/kxm/src/session-work.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync23, readFileSync as readFileSync27, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync23, readFileSync as readFileSync27, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join37 } from "node:path";
 var MAX_SESSION_BRIEF_TASKS = 5;
 var MAX_SESSION_BRIEF_PLANS = 5;
 var SESSION_BRIEF_SCHEMA = "kxm.session-brief.v1";
@@ -44884,9 +44898,9 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
   };
 }
 function readCachedSessionBrief(stateDir) {
-  const file = join36(stateDir, "session-brief.json");
+  const file = join37(stateDir, "session-brief.json");
   try {
-    if (!existsSync26(file)) return void 0;
+    if (!existsSync27(file)) return void 0;
     const raw = readFileSync27(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
@@ -44903,7 +44917,7 @@ function readCachedSessionBrief(stateDir) {
 function writeCachedSessionBrief(stateDir, brief) {
   try {
     mkdirSync23(stateDir, { recursive: true, mode: 448 });
-    const file = join36(stateDir, "session-brief.json");
+    const file = join37(stateDir, "session-brief.json");
     const tmp = `${file}.tmp.${randomUUID13().slice(0, 8)}`;
     writeFileSync21(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
     renameSync8(tmp, file);
@@ -44912,8 +44926,8 @@ function writeCachedSessionBrief(stateDir, brief) {
 }
 function estimateSessionCost(stateDir) {
   try {
-    const telemetryFile = join36(stateDir, "telemetry.jsonl");
-    if (!existsSync26(telemetryFile)) return void 0;
+    const telemetryFile = join37(stateDir, "telemetry.jsonl");
+    if (!existsSync27(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
     let totalCost = 0;
@@ -45081,11 +45095,11 @@ function formatSessionBriefText(brief) {
 }
 
 // plugins/kxm/src/kxm-install-kind.ts
-import { existsSync as existsSync27, readFileSync as readFileSync28 } from "node:fs";
-import { dirname as dirname18, join as join37 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync28 } from "node:fs";
+import { dirname as dirname18, join as join38 } from "node:path";
 function packageIsKxm(root) {
   try {
-    const pkg = JSON.parse(readFileSync28(join37(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync28(join38(root, "package.json"), "utf8"));
     return pkg.name === "@kontextmind/kxm";
   } catch {
     return false;
@@ -45107,8 +45121,8 @@ function lastSegments(path4) {
 function segmentEq(left, right, platform) {
   return platform === "win32" ? left.toLocaleLowerCase("en-US") === right.toLocaleLowerCase("en-US") : left === right;
 }
-function isNpmPackageLayout(repoRoot6, platform) {
-  const last = lastSegments(repoRoot6);
+function isNpmPackageLayout(repoRoot, platform) {
+  const last = lastSegments(repoRoot);
   const expected = ["node_modules", "@kontextmind", "kxm"];
   return last.length === 3 && last.every((part, i) => segmentEq(part, expected[i], platform));
 }
@@ -45134,12 +45148,12 @@ function report(kind, root) {
   return { kind, root, instruction: installKindInstruction(kind, root) };
 }
 function classifyInstallRoot(probe) {
-  const piGitRoot = join37(probe.homeDir, ".pi", "agent", "git");
+  const piGitRoot = join38(probe.homeDir, ".pi", "agent", "git");
   if (isUnder(probe.repoRoot, piGitRoot, probe.platform)) return report("pi-git", probe.repoRoot);
-  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join37(probe.homeDir, ".claude");
-  const pluginsRoot = join37(claudeHome, "plugins");
+  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join38(probe.homeDir, ".claude");
+  const pluginsRoot = join38(claudeHome, "plugins");
   if (isUnder(probe.moduleDir, pluginsRoot, probe.platform)) return report("claude-marketplace", probe.moduleDir);
-  const hasGit = existsSync27(join37(probe.repoRoot, ".git"));
+  const hasGit = existsSync28(join38(probe.repoRoot, ".git"));
   if (hasGit && packageIsKxm(probe.repoRoot)) return report("source", probe.repoRoot);
   if (isNpmPackageLayout(probe.repoRoot, probe.platform) && packageIsKxm(probe.repoRoot) && !hasGit) {
     return report("npm-package", probe.repoRoot);
@@ -45160,11 +45174,11 @@ function resolveInstallKind(probe, npmGlobalRoot) {
 
 // plugins/kxm/src/kxm-update-config.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync28, readFileSync as readFileSync29 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync29 } from "node:fs";
+import { join as join39 } from "node:path";
 function loadKxmUpdateConfig(env = process.env) {
-  const path4 = join38(vnextUserStateRoot({ env }), "update.yaml");
-  if (!existsSync28(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
+  const path4 = join39(vnextUserStateRoot({ env }), "update.yaml");
+  if (!existsSync29(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
   let parsed;
   try {
     parsed = (0, import_yaml16.parse)(readFileSync29(path4, "utf8"));
@@ -45193,8 +45207,8 @@ function loadKxmUpdateConfig(env = process.env) {
 }
 
 // plugins/kxm/src/session.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync24, readFileSync as readFileSync30, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync24, readFileSync as readFileSync30, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join40 } from "node:path";
 var SESSION_SCHEMA = "kxm.session.v1";
 var SessionConfigError = class extends Error {
   code = "session_config_invalid";
@@ -45204,12 +45218,12 @@ var SessionConfigError = class extends Error {
   }
 };
 function workflowAssetDirs(assetsDir, workflowId) {
-  const root = join39(assetsDir, "workflows", workflowId);
-  return [root, join39(root, "inputs"), join39(root, "outputs"), join39(root, "generated")];
+  const root = join40(assetsDir, "workflows", workflowId);
+  return [root, join40(root, "inputs"), join40(root, "outputs"), join40(root, "generated")];
 }
 function sessionAssetDirs(assetsDir, sessionId) {
-  const root = join39(assetsDir, "sessions", sessionId);
-  return [root, join39(root, "inputs"), join39(root, "outputs")];
+  const root = join40(assetsDir, "sessions", sessionId);
+  return [root, join40(root, "inputs"), join40(root, "outputs")];
 }
 function rosterNames(configDir) {
   return [...loadRosterMap(configDir).values()].map((row) => String(row.name));
@@ -45259,7 +45273,7 @@ function workerFromRosterRow(name, row, project) {
 function loadRosterMap(configDir) {
   const byName = /* @__PURE__ */ new Map();
   for (const [file, key] of [["agents.json", "agents"], ["gates.json", "gates"]]) {
-    const path4 = join39(configDir, file);
+    const path4 = join40(configDir, file);
     for (const row of loadRoster(path4, key)) {
       const name = String(row.name).trim();
       const lowered = name.toLowerCase();
@@ -45273,7 +45287,7 @@ function loadRosterMap(configDir) {
   return byName;
 }
 function loadRoster(path4, key) {
-  if (!existsSync29(path4)) return [];
+  if (!existsSync30(path4)) return [];
   let parsed;
   try {
     parsed = JSON.parse(readFileSync30(path4, "utf8"));
@@ -45301,7 +45315,7 @@ function loadRoster(path4, key) {
   });
 }
 function createSession(input) {
-  const assetDir = input.mode === "workflow" && input.workflowId ? join39("assets", "workflows", input.workflowId) : join39("assets", "sessions", input.id);
+  const assetDir = input.mode === "workflow" && input.workflowId ? join40("assets", "workflows", input.workflowId) : join40("assets", "sessions", input.id);
   return {
     schema: SESSION_SCHEMA,
     id: input.id,
@@ -45314,8 +45328,8 @@ function createSession(input) {
   };
 }
 function writeSession(assetsDir, session, dryRun = false) {
-  const dir = join39(assetsDir, "sessions", session.id);
-  const path4 = join39(dir, "session.json");
+  const dir = join40(assetsDir, "sessions", session.id);
+  const path4 = join40(dir, "session.json");
   if (!dryRun) {
     mkdirSync24(dir, { recursive: true });
     writeFileSync22(path4, `${JSON.stringify(session, null, 2)}
@@ -45325,7 +45339,7 @@ function writeSession(assetsDir, session, dryRun = false) {
 }
 
 // plugins/kxm/src/cli/hub.ts
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { dirname as dirname19 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 async function hubGet(url, fetchImpl) {
@@ -45345,23 +45359,23 @@ async function hubGet(url, fetchImpl) {
 function installProbeFrom(runtime) {
   const partial = runtime.io.installProbe ?? {};
   return {
-    moduleDir: partial.moduleDir ?? dirname19(fileURLToPath6(import.meta.url)),
-    repoRoot: partial.repoRoot ?? resolve25("."),
+    moduleDir: partial.moduleDir ?? dirname19(fileURLToPath3(import.meta.url)),
+    repoRoot: partial.repoRoot ?? resolve24("."),
     homeDir: partial.homeDir ?? homedir6(),
     platform: partial.platform ?? process.platform,
     env: partial.env ?? runtime.env
   };
 }
 function warnIgnoredProjectUpdateYaml(runtime) {
-  const projectFile = join40(runtime.dirs.workspace, "update.yaml");
-  if (!existsSync30(projectFile)) return;
-  const userFile = join40(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+  const projectFile = join41(runtime.dirs.workspace, "update.yaml");
+  if (!existsSync31(projectFile)) return;
+  const userFile = join41(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
   runtime.io.stderr(`kxm: ignoring .kxm/update.yaml in ${runtime.dirs.workdir}; update settings are read only from ${userFile}
 `);
 }
 async function refreshKxmUpdateNotice(runtime, config) {
   const resolved = config ?? loadKxmUpdateConfig(runtime.env);
-  const current = readInstalledKxmVersion(resolve25("."));
+  const current = readInstalledKxmVersion(resolve24("."));
   const fetched = await fetchLatestKxmVersion(resolved.source, runtime.env, runtime.fetchImpl);
   const notice = noticeFromVersions(current, fetched.latest, resolved, fetched.error, fetched.asset);
   writeUpdateCache(runtime.dirs.state, notice);
@@ -45381,7 +45395,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const screen = requested;
-  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join40(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve24(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, {
       ok: true,
@@ -45427,7 +45441,7 @@ async function cmdHub(runtime) {
         config = loadKxmUpdateConfig(runtime.env);
       } catch (error) {
         if (error instanceof KxmUpdateConfigError) {
-          const yamlPath = join40(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+          const yamlPath = join41(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
           runtime.io.stderr(`kxm: ${error.message}; update check skipped; fix or remove ${yamlPath}
 `);
         } else {
@@ -45563,7 +45577,7 @@ async function cmdWorker(runtime, options) {
   return await (runtime.io.spawnWorker ?? ((launchEnv) => spawnScript("kxm-worker.mjs", launchEnv)))(extraEnv);
 }
 async function cmdStop(runtime, waitMsFlag) {
-  const pids = existsSync30(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
+  const pids = existsSync31(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, { ok: true, command: "stop", dryRun: true, pidFiles: pids }, "would signal pid files");
     return 0;
@@ -45578,7 +45592,7 @@ async function cmdStop(runtime, waitMsFlag) {
   const orphans = [];
   for (const file of pids) {
     try {
-      const record = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+      const record = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
       const expectedControl = file === "hub.pid" ? "hub.stop" : file.startsWith("worker-") ? `${file.slice(0, -4)}.stop` : void 0;
       const expectedRole = file === "hub.pid" ? "hub" : file.startsWith("worker-") ? "worker" : void 0;
       if (record.version !== 1 || !Number.isInteger(record.pid) || record.pid <= 0 || !record.startedAt || !expectedControl || record.controlFile !== expectedControl || record.role !== expectedRole) {
@@ -45598,7 +45612,7 @@ async function cmdStop(runtime, waitMsFlag) {
         ignored.push(file);
         continue;
       }
-      writeFileSync23(join40(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+      writeFileSync23(join41(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `, { encoding: "utf8", mode: 384 });
       requested.push(file);
       records.set(file, { pid: record.pid, startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {} });
@@ -45616,7 +45630,7 @@ async function cmdStop(runtime, waitMsFlag) {
   while (Date.now() <= deadline && stopped.size < requested.length) {
     for (const [file, record] of records) {
       try {
-        const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
         if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.generation !== record.generation || !processExists(record.pid)) stopped.add(file);
       } catch {
         stopped.add(file);
@@ -45629,7 +45643,7 @@ async function cmdStop(runtime, waitMsFlag) {
   for (const file of orphans) {
     while (Date.now() <= deadlineOrphans) {
       try {
-        const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
         if (!Number.isInteger(current.serverPid) || !processExists(current.serverPid)) break;
       } catch {
         break;
@@ -45637,14 +45651,14 @@ async function cmdStop(runtime, waitMsFlag) {
       await (runtime.io.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms))))(100);
     }
     try {
-      const current = JSON.parse(readFileSync31(join40(runtime.dirs.state, file), "utf8"));
+      const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
       if (Number.isInteger(current.serverPid) && processExists(current.serverPid)) {
         try {
           process.kill(current.serverPid, "SIGKILL");
         } catch {
         }
       }
-      rmSync10(join40(runtime.dirs.state, file), { force: true });
+      rmSync10(join41(runtime.dirs.state, file), { force: true });
     } catch {
     }
     stopped.add(file);
@@ -45655,11 +45669,11 @@ async function cmdStop(runtime, waitMsFlag) {
 }
 async function cmdSessionStatus(runtime) {
   const stateDir = runtime.dirs.state;
-  const names3 = existsSync30(stateDir) ? readdirSync12(stateDir) : [];
+  const names3 = existsSync31(stateDir) ? readdirSync12(stateDir) : [];
   const claims = [];
   for (const file of names3.filter((name) => name.endsWith(".pid"))) {
     try {
-      const record = JSON.parse(readFileSync31(join40(stateDir, file), "utf8"));
+      const record = JSON.parse(readFileSync31(join41(stateDir, file), "utf8"));
       claims.push({
         file,
         role: record.role,
@@ -45674,7 +45688,7 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync31(join40(stateDir, file), "utf8"));
+      const envelope = JSON.parse(readFileSync31(join41(stateDir, file), "utf8"));
       recoveries.push({
         file,
         reason: envelope.reason,
@@ -45779,7 +45793,7 @@ async function cmdSessionBrief(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: true, command: "session brief", sessionToken }, sessionToken);
     return 0;
   }
-  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join40(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve24(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
   const env = {
     ...runtime.env,
     KXM_STATE_DIR: runtime.dirs.state,
@@ -45871,16 +45885,15 @@ async function cmdSessionStart(runtime, options) {
 // plugins/kxm/src/cli/system.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync36, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync37, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync12 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join46, resolve as resolve29 } from "node:path";
+import { join as join47, resolve as resolve28 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // plugins/kxm/src/improve.ts
 import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join41, relative as relative6, resolve as resolve26 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24 } from "node:fs";
+import { join as join42, relative as relative6, resolve as resolve25 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
 var IMPROVEMENT_REPORT_SCHEMA = "kxm.improvement-report.v2";
 function classifyCandidateKind(stepId, agentRole) {
@@ -46051,8 +46064,8 @@ function groupRoutingRecords(records, options = {}) {
   });
 }
 function buildImprovementReport(records, options = {}) {
-  const projectRoot = options.projectRoot ? resolve26(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve26(options.candidatesDir) : join41(projectRoot, ".kxm", "candidates");
+  const projectRoot = options.projectRoot ? resolve25(options.projectRoot) : process.cwd();
+  const candidatesDir = options.candidatesDir ? resolve25(options.candidatesDir) : join42(projectRoot, ".kxm", "candidates");
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
   for (const group of groups) {
@@ -46064,7 +46077,7 @@ function buildImprovementReport(records, options = {}) {
       group.workflowHash
     );
     const diffFileName = `${group.candidateId}.diff`;
-    const diffFilePath = join41(candidatesDir, diffFileName);
+    const diffFilePath = join42(candidatesDir, diffFileName);
     const relDiffPath = relative6(projectRoot, diffFilePath).replace(/\\/g, "/");
     const candidate = {
       schema: CANDIDATE_SCHEMA,
@@ -46086,11 +46099,11 @@ function buildImprovementReport(records, options = {}) {
       createdAt: nowIso()
     };
     if (!options.dryRun) {
-      if (!existsSync31(candidatesDir)) {
+      if (!existsSync32(candidatesDir)) {
         mkdirSync26(candidatesDir, { recursive: true });
       }
       writeFileSync24(diffFilePath, diff, "utf8");
-      const jsonFilePath = join41(candidatesDir, `${group.candidateId}.json`);
+      const jsonFilePath = join42(candidatesDir, `${group.candidateId}.json`);
       writeFileSync24(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
     }
     candidates.push(candidate);
@@ -46106,7 +46119,7 @@ function buildImprovementReport(records, options = {}) {
 }
 function writeImprovementReport(improvementsDir, report2, dryRun = false) {
   const stamp = report2.createdAt.replace(/[:.]/g, "-");
-  const path4 = join41(improvementsDir, `${stamp}.json`);
+  const path4 = join42(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
     mkdirSync26(improvementsDir, { recursive: true });
     writeFileSync24(path4, `${JSON.stringify(report2, null, 2)}
@@ -46149,8 +46162,8 @@ function formatImprovementReport(report2) {
 
 // plugins/kxm/src/modes.ts
 var import_yaml17 = __toESM(require_dist(), 1);
-import { existsSync as existsSync32, readFileSync as readFileSync33 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync33, readFileSync as readFileSync33 } from "node:fs";
+import { join as join43 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -46213,8 +46226,8 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join42(projectRoot, ".kxm", "modes.yaml");
-  if (!existsSync32(modesPath)) {
+  const modesPath = join43(projectRoot, ".kxm", "modes.yaml");
+  if (!existsSync33(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
@@ -46304,9 +46317,9 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join42(projectRoot, relPath);
+    const fullPath = join43(projectRoot, relPath);
     let chars = 0;
-    if (existsSync32(fullPath)) {
+    if (existsSync33(fullPath)) {
       try {
         chars = readFileSync33(fullPath, "utf8").length;
       } catch {
@@ -46440,9 +46453,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync33, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join43, resolve as resolve27 } from "node:path";
+import { join as join44, resolve as resolve26 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -46468,8 +46481,8 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join43(homedir7(), ".ssh", "config");
-  if (!existsSync33(targetPath)) {
+  const targetPath = configPath ?? join44(homedir7(), ".ssh", "config");
+  if (!existsSync34(targetPath)) {
     return [];
   }
   try {
@@ -46550,15 +46563,15 @@ function resolveSshHostG(host, execFn = spawnSync7) {
   }
 }
 function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
-  const resolved = resolve27(socketDir);
-  if (!existsSync33(resolved)) {
+  const resolved = resolve26(socketDir);
+  if (!existsSync34(resolved)) {
     mkdirSync27(resolved, { recursive: true, mode: 448 });
   }
   return resolved;
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join43(socketDir, "%C");
+  const controlPath = join44(socketDir, "%C");
   const persist = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -46583,7 +46596,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join43(resolvedDir, "%C");
+  const controlPath = join44(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -46595,7 +46608,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join43(resolvedDir, "%C");
+  const controlPath = join44(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -47041,9 +47054,9 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 }
 
 // plugins/kxm/src/completion-install.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { basename as basename9, delimiter, dirname as dirname21, isAbsolute as isAbsolute8, join as join44, resolve as resolve28 } from "node:path";
+import { basename as basename9, delimiter, dirname as dirname21, isAbsolute as isAbsolute8, join as join45, resolve as resolve27 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -47059,31 +47072,31 @@ function effectiveHome(options) {
   const env = options.env ?? process.env;
   if (options.homeDir) return options.homeDir;
   const envHome = env.HOME?.trim() ?? env.USERPROFILE?.trim();
-  return envHome && envHome.length > 0 ? resolve28(envHome) : homedir8();
+  return envHome && envHome.length > 0 ? resolve27(envHome) : homedir8();
 }
 function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
-  const base = explicit && explicit.length > 0 ? resolve28(explicit) : resolve28(effectiveHome(options), ".config", "kxm");
-  return join44(base, "completions", `kxm.${shell}`);
+  const base = explicit && explicit.length > 0 ? resolve27(explicit) : resolve27(effectiveHome(options), ".config", "kxm");
+  return join45(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
-  const candidates = [join44(home, ".bashrc"), join44(home, ".bash_profile")];
-  const existing = candidates.find((candidate) => existsSync34(candidate));
+  const candidates = [join45(home, ".bashrc"), join45(home, ".bash_profile")];
+  const existing = candidates.find((candidate) => existsSync35(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join44(resolve28(env.ZDOTDIR.trim()), ".zshrc");
-  return join44(home, ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join45(resolve27(env.ZDOTDIR.trim()), ".zshrc");
+  return join45(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join44(resolve28(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
-  return join44(home, ".config", "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join45(resolve27(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  return join45(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
   if (shell === "fish") {
@@ -47115,16 +47128,16 @@ function installShellCompletion(shellInput, options = {}) {
   const scriptPath = completionScriptPath(shell, options);
   const { rcFile } = completionRcTarget(shell, options);
   const script = generateShellCompletion(shell);
-  const existingScript = existsSync34(scriptPath);
+  const existingScript = existsSync35(scriptPath);
   const existingScriptMatches = existingScript && readFileSync35(scriptPath, "utf8") === script;
   let rcModified = false;
   let alreadyInstalled = false;
   if (shell === "fish") {
     const fishTarget = fishCompletionTarget(shell, options);
-    const fishInstalled = existsSync34(fishTarget) && readFileSync35(fishTarget, "utf8") === script;
+    const fishInstalled = existsSync35(fishTarget) && readFileSync35(fishTarget, "utf8") === script;
     alreadyInstalled = fishInstalled;
     if (!options.dryRun && (!fishInstalled || options.overwrite)) {
-      mkdirSync28(resolve28(fishTarget, ".."), { recursive: true });
+      mkdirSync28(resolve27(fishTarget, ".."), { recursive: true });
       writeFileSync25(fishTarget, script, { encoding: "utf8" });
     }
     return {
@@ -47138,12 +47151,12 @@ function installShellCompletion(shellInput, options = {}) {
   }
   if (rcFile) {
     const line = sourceLine(shell, scriptPath);
-    const rcContent = existsSync34(rcFile) ? readFileSync35(rcFile, "utf8") : "";
+    const rcContent = existsSync35(rcFile) ? readFileSync35(rcFile, "utf8") : "";
     alreadyInstalled = rcContent.includes(line) || rcContent.includes(`${COMPLETION_MARKER}`);
   }
   if (!options.dryRun) {
     if (!existingScriptMatches || options.overwrite) {
-      mkdirSync28(resolve28(scriptPath, ".."), { recursive: true });
+      mkdirSync28(resolve27(scriptPath, ".."), { recursive: true });
       writeFileSync25(scriptPath, script, { encoding: "utf8" });
     }
     if (rcFile && !alreadyInstalled) {
@@ -47153,8 +47166,8 @@ function installShellCompletion(shellInput, options = {}) {
 ${marker}
 ${line}
 `;
-      mkdirSync28(resolve28(rcFile, ".."), { recursive: true });
-      writeFileSync25(rcFile, (existsSync34(rcFile) ? readFileSync35(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
+      mkdirSync28(resolve27(rcFile, ".."), { recursive: true });
+      writeFileSync25(rcFile, (existsSync35(rcFile) ? readFileSync35(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
       rcModified = true;
     }
   }
@@ -47171,13 +47184,13 @@ function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
   if (argv1 && isAbsolute8(argv1)) {
     const dir = dirname21(argv1);
-    if (existsSync34(join44(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+    if (existsSync35(join45(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
     if (!part) continue;
-    const candidate = resolve28(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
-    if (existsSync34(candidate)) return resolve28(part);
+    const candidate = resolve27(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
+    if (existsSync35(candidate)) return resolve27(part);
   }
   return void 0;
 }
@@ -47195,7 +47208,7 @@ function installPathEntry(shellInput, options = {}) {
   }
   const { rcFile } = completionRcTarget(shell, options);
   const line = pathLine(binDir);
-  const rcContent = existsSync34(rcFile ?? "") ? readFileSync35(rcFile, "utf8") : "";
+  const rcContent = existsSync35(rcFile ?? "") ? readFileSync35(rcFile, "utf8") : "";
   const alreadyInstalled = rcContent.includes(binDir) || (options.env?.PATH ?? process.env.PATH ?? "").split(delimiter).includes(binDir);
   if (!options.dryRun && rcFile && !alreadyInstalled) {
     mkdirSync28(dirname21(rcFile), { recursive: true });
@@ -47209,8 +47222,8 @@ ${line}
 
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml18 = __toESM(require_dist(), 1);
-import { existsSync as existsSync35, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname22, join as join45 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
+import { dirname as dirname22, join as join46 } from "node:path";
 var NATIVE_VENDOR_HARNESS = Object.freeze({
   anthropic: "claude",
   openai: "codex",
@@ -47609,13 +47622,13 @@ function renderGuideSetupFiles(projectRoot, plan) {
     const stage = roleStages.get(role);
     if (!stage) continue;
     files.push({
-      path: join45(projectRoot, ".kxm", "agents", `${role}.yaml`),
+      path: join46(projectRoot, ".kxm", "agents", `${role}.yaml`),
       content: (0, import_yaml18.stringify)(agentDocument(role, stage, binding))
     });
   }
   for (const workflow of plan.workflows) {
     files.push({
-      path: join45(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
+      path: join46(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
       content: (0, import_yaml18.stringify)(workflowDocument(workflow))
     });
   }
@@ -47625,7 +47638,7 @@ function writeGuideSetupFiles(files) {
   const written = [];
   const existed = [];
   for (const file of files) {
-    if (existsSync35(file.path)) {
+    if (existsSync36(file.path)) {
       existed.push(file.path);
       continue;
     }
@@ -47653,7 +47666,6 @@ function parseGuideSelection(input, catalog = GUIDE_WORKFLOWS) {
 }
 
 // plugins/kxm/src/cli/system.ts
-var repoRoot4 = resolve29(fileURLToPath7(new URL("../../../../", import.meta.url)));
 function cliSpawn(runtime, command, args, extra) {
   if (runtime.io.spawnSync) return runtime.io.spawnSync(command, args);
   const result = spawnSync8(command, [...args], {
@@ -47694,7 +47706,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync2(join46(tmpdir2(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync2(join47(tmpdir2(), "kxm-pkg-update-"));
   try {
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset);
     if (runtime.dryRun) {
@@ -47703,7 +47715,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync36(step.path) ? createHash16("sha256").update(readFileSync36(step.path)).digest("hex") : "missing";
+          const actual = existsSync37(step.path) ? createHash16("sha256").update(readFileSync36(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -47822,7 +47834,7 @@ async function cmdUpdate(runtime, harness, options) {
   warnIgnoredProjectUpdateYaml(runtime);
   const probe = installProbeFrom(runtime);
   const classified = classifyInstallRoot(probe);
-  const current = readInstalledKxmVersion(repoRoot4);
+  const current = readInstalledKxmVersion(findKxmRepoRoot(import.meta.url));
   let notice;
   let kindReport = classified;
   if (classified.kind === "source") {
@@ -47968,8 +47980,8 @@ async function cmdValidate(runtime, fileFlag) {
     return 2;
   }
   const selectedFile = explicitFile || configuredFile;
-  const file = selectedFile ? resolve29(runtime.cwd, selectedFile) : void 0;
-  if (file && !existsSync36(file)) {
+  const file = selectedFile ? resolve28(runtime.cwd, selectedFile) : void 0;
+  if (file && !existsSync37(file)) {
     printWorker(runtime, worker, { ok: false, command: "validate", error: "file_not_found", file }, `workflow file not found: ${file}`);
     return 1;
   }
@@ -47999,7 +48011,7 @@ async function cmdValidate(runtime, fileFlag) {
 }
 async function cmdArtifactsExist(runtime, pathFlag) {
   const worker = gateOf(runtime, "artifacts-exist");
-  const checked = verifyArtifactExists(runtime.dirs.assets, resolve29(runtime.cwd, pathFlag));
+  const checked = verifyArtifactExists(runtime.dirs.assets, resolve28(runtime.cwd, pathFlag));
   if (!checked.ok) {
     printWorker(
       runtime,
@@ -48018,15 +48030,15 @@ async function cmdArtifactsExist(runtime, pathFlag) {
   return 0;
 }
 async function cmdImprove(runtime, options = {}) {
-  const file = options.file ? resolve29(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
-  const routingRecords = existsSync36(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
-  const candidatesDir = options.outDir ? resolve29(runtime.cwd, options.outDir) : join46(runtime.cwd, ".kxm", "candidates");
+  const file = options.file ? resolve28(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
+  const routingRecords = existsSync37(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
+  const candidatesDir = options.outDir ? resolve28(runtime.cwd, options.outDir) : join47(runtime.cwd, ".kxm", "candidates");
   const report2 = buildImprovementReport(routingRecords, {
     candidatesDir,
     projectRoot: runtime.cwd,
     dryRun: runtime.dryRun
   });
-  const reportDir = join46(runtime.dirs.assets, "improvements");
+  const reportDir = join47(runtime.dirs.assets, "improvements");
   const reportPath = writeImprovementReport(reportDir, report2, runtime.dryRun);
   const text = formatImprovementReport(report2);
   print(runtime.io, runtime.json, {
@@ -48158,7 +48170,7 @@ async function maybeOfferCompletionInstall(runtime) {
   if (!pathNeeded) {
     const scriptPath = completionScriptPath(shell, { env: runtime.env, configDir: runtime.env.KXM_USER_CONFIG_DIR });
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
-    if (rcFile && existsSync36(rcFile)) {
+    if (rcFile && existsSync37(rcFile)) {
       try {
         if (readFileSync36(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
@@ -48292,7 +48304,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve29(runtime.cwd, options.prices) : join46(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve28(runtime.cwd, options.prices) : join47(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }
@@ -48376,7 +48388,6 @@ async function cmdRoutingBenchmark(runtime, options) {
 
 // plugins/kxm/src/cli.ts
 var CLI_NAME2 = "kxm";
-var repoRoot5 = resolve30(fileURLToPath8(new URL("../../../", import.meta.url)));
 var USAGE_ERROR_CODES = /* @__PURE__ */ new Set([
   "commander.help",
   "commander.helpDisplayed",
@@ -48519,7 +48530,7 @@ function createProgram(ctx, result) {
     };
   };
   const program2 = new Command(CLI_NAME2);
-  program2.description("KontextMind local-first orchestration CLI").version(readInstalledKxmVersion(repoRoot5), "-V, --version", "Print the installed kxm version").exitOverride().configureOutput({
+  program2.description("KontextMind local-first orchestration CLI").version(readInstalledKxmVersion(findKxmRepoRoot(import.meta.url)), "-V, --version", "Print the installed kxm version").exitOverride().configureOutput({
     writeOut: (text) => ctx.io.stdout(text),
     writeErr: (text) => ctx.io.stderr(text)
   }).helpCommand("help", "Show help");
@@ -48986,7 +48997,7 @@ async function runCli(argv, env = process.env, io = { stdout: (text) => process.
     throw error;
   }
 }
-if (process.argv[1] && resolve30(process.argv[1]) === fileURLToPath8(import.meta.url)) {
+if (process.argv[1] && resolve29(process.argv[1]) === fileURLToPath4(import.meta.url)) {
   const code = await runCli(process.argv.slice(2));
   process.exitCode = code;
 }