@kontextmind/kxm 0.7.20 → 0.7.22

package/plugins/kxm/dist/runtime.js

@@ -2986,7 +2986,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve9.call(this, root, ref);
+      let _sch = resolve8.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3013,7 +3013,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve9(root, ref) {
+    function resolve8(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3838,7 +3838,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve9(baseURI, relativeURI, options) {
+    function resolve8(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4200,7 +4200,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve9,
+      resolve: resolve8,
       resolveComponent,
       equal,
       serialize,
@@ -14779,16 +14779,15 @@ var require_dist = __commonJS({
 
 // plugins/kxm/src/vnext-runtime.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // plugins/kxm/src/vnext-config.ts
 var import__ = __toESM(require__(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync2, lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
+import { existsSync as existsSync3, lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { basename, dirname as dirname2, extname, isAbsolute, join as join2, relative, resolve, sep } from "node:path";
 
 // plugins/kxm/src/restricted-yaml.mjs
 var import_yaml = __toESM(require_dist(), 1);
@@ -15114,9 +15113,28 @@ function resolveVnextTemplateBaseline(value) {
   return void 0;
 }
 
+// plugins/kxm/src/repo-root.ts
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+var ROOT_MARKERS = ["scripts/kxm-hub.mjs", "scripts/kxm.mjs"];
+var MAX_WALK_DEPTH = 10;
+function findKxmRepoRoot(fromUrl = import.meta.url) {
+  let dir = dirname(fileURLToPath(fromUrl));
+  for (let depth = 0; depth < MAX_WALK_DEPTH; depth += 1) {
+    if (ROOT_MARKERS.some((marker) => existsSync(join(dir, marker)))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `kxm: cannot locate the KXM repo root from ${fileURLToPath(fromUrl)} (walked ${MAX_WALK_DEPTH} levels looking for ${ROOT_MARKERS[0]})`
+  );
+}
+
 // plugins/kxm/src/vnext-harness.ts
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { win32 as win32Path } from "node:path";
 
 // plugins/kxm/src/vnext-oneshot-process.ts
@@ -15142,7 +15160,7 @@ function defaultSpawn(command, args, options) {
   if (options.signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: null, started: false, observedChildExit: false, error: new Error("process_aborted") });
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve8) => {
     const stdout = [];
     const stderr = [];
     let outputBytes = 0;
@@ -15173,7 +15191,7 @@ function defaultSpawn(command, args, options) {
       const started = Boolean(child?.pid);
       if (started && !observedChildExit) error ??= new Error("process_exit_unobserved");
       const unverifiedDescendants = stopping || started && !observedChildExit;
-      resolve9({
+      resolve8({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         code,
@@ -15665,7 +15683,7 @@ function findWinNpmInnerExe(cliId, options = {}) {
   if ((options.platform ?? process.platform) !== "win32") return void 0;
   const segments = WIN_NPM_INNER_EXE[cliId];
   if (!segments) return void 0;
-  const exists = options.existsSync ?? existsSync;
+  const exists = options.existsSync ?? existsSync2;
   const pathEnv = options.pathEnv ?? process.env.PATH ?? "";
   for (const dir of pathEnv.split(";").filter(Boolean)) {
     if (!exists(win32Path.join(dir, `${cliId}.cmd`))) continue;
@@ -16348,8 +16366,10 @@ var VnextConfigError = class extends Error {
     this.issues = sorted;
   }
 };
-var PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
-var DEFAULT_SCHEMA_DIR = join(PACKAGE_ROOT, "schemas", "vnext");
+function defaultVnextSchemaDir() {
+  return join2(findKxmRepoRoot(import.meta.url), "schemas", "vnext");
+}
+var DEFAULT_SCHEMA_DIR = defaultVnextSchemaDir();
 var RESOURCE_SCHEMA = Object.freeze({
   project: { identity: "kxm.project.v1", file: "project.schema.json" },
   repository: { identity: "kxm.repository.v1", file: "repository.schema.json" },
@@ -16414,10 +16434,10 @@ var VnextSchemaRegistry = class {
   constructor(schemasDir = DEFAULT_SCHEMA_DIR) {
     this.schemasDir = resolve(schemasDir);
     this.ajv = new import__.Ajv2020({ allErrors: true, strict: true, strictRequired: false });
-    const common = readJsonObject(join(this.schemasDir, "common.schema.json"));
+    const common = readJsonObject(join2(this.schemasDir, "common.schema.json"));
     this.ajv.addSchema(common);
     for (const definition of Object.values(RESOURCE_SCHEMA)) {
-      this.ajv.addSchema(readJsonObject(join(this.schemasDir, definition.file)));
+      this.ajv.addSchema(readJsonObject(join2(this.schemasDir, definition.file)));
     }
     const localBindingsFile = "local-repository-bindings.schema.json";
     const templateProvenanceFile = "template-provenance.schema.json";
@@ -16427,14 +16447,14 @@ var VnextSchemaRegistry = class {
     const migrationReceiptFile = "migration-receipt.schema.json";
     const permissionDiffFile = "permission-diff.schema.json";
     const runEventFile = "run-event.schema.json";
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, localBindingsFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, templateProvenanceFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, initOperationFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, migrationPlanFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, migrationDecisionFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, migrationReceiptFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, permissionDiffFile)));
-    this.ajv.addSchema(readJsonObject(join(this.schemasDir, runEventFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, localBindingsFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, templateProvenanceFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, initOperationFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, migrationPlanFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, migrationDecisionFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, migrationReceiptFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, permissionDiffFile)));
+    this.ajv.addSchema(readJsonObject(join2(this.schemasDir, runEventFile)));
     for (const [kind, definition] of Object.entries(RESOURCE_SCHEMA)) {
       const validator = this.ajv.getSchema(`https://schemas.kxm.dev/vnext/${definition.file}`);
       if (!validator) throw new Error(`schema did not compile: ${definition.file}`);
@@ -16541,15 +16561,15 @@ function containedHostPath(root, candidate) {
 function portableBindingIssue(root, pathHint, repositoryId) {
   let current = root;
   for (const segment of pathHint === "." ? [] : pathHint.split("/")) {
-    current = join(current, segment);
-    if (!existsSync2(current)) break;
+    current = join2(current, segment);
+    if (!existsSync3(current)) break;
     const stat = lstatSync(current);
     if (stat.isSymbolicLink()) {
       return issue2("path", "repository_binding_path_link", ".kxm/project.yaml", `portable pathHint for ${repositoryId} traverses a symbolic link or junction`);
     }
   }
   const binding = resolve(root, ...pathHint.split("/"));
-  if (existsSync2(binding)) {
+  if (existsSync3(binding)) {
     const realRoot = canonicalHostPath(root);
     const realBinding = canonicalHostPath(binding);
     if (!containedHostPath(realRoot, realBinding)) {
@@ -16587,9 +16607,9 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
   }
   if (stat.isSymbolicLink()) fail2("path", "resource_symlink", label, "configuration resources must not be symbolic links");
   const boundary = resolve(containmentRoot);
-  let parent = dirname(file);
+  let parent = dirname2(file);
   while (parent !== boundary) {
-    if (parent === dirname(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
+    if (parent === dirname2(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
     let parentStat;
     try {
       parentStat = lstatSync(parent);
@@ -16597,7 +16617,7 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
       fail2("discovery", "resource_parent_missing", label, "resource parent does not exist");
     }
     if (parentStat.isSymbolicLink()) fail2("path", "resource_parent_symlink", label, "configuration resource parents must not be symbolic links");
-    parent = dirname(parent);
+    parent = dirname2(parent);
   }
   if (!stat.isFile()) fail2("path", "resource_not_file", label, "configuration resource must be a regular file");
   const value = parseRestrictedYaml2(readFileSync(file), label);
@@ -16606,22 +16626,22 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
   return { kind, ...id === void 0 ? {} : { id }, file, logicalPath, value };
 }
 function readTemplateProvenance(registry, root) {
-  const file = join(root, ".kxm", "template-provenance.yaml");
-  if (!existsSync2(file)) return void 0;
+  const file = join2(root, ".kxm", "template-provenance.yaml");
+  if (!existsSync3(file)) return void 0;
   const label = ".kxm/template-provenance.yaml";
   const stat = lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     fail2("path", "resource_not_file", label, "template provenance must be a regular file, not a link or directory");
   }
-  const configRoot = join(root, ".kxm");
-  let parent = dirname(file);
+  const configRoot = join2(root, ".kxm");
+  let parent = dirname2(file);
   while (parent !== root) {
     const parentStat = lstatSync(parent);
     if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
       fail2("path", "resource_parent_symlink", label, "template provenance parents must be regular directories");
     }
     if (parent === configRoot) break;
-    parent = dirname(parent);
+    parent = dirname2(parent);
   }
   const value = parseRestrictedYaml2(readFileSync(file), label);
   const issues = registry.validateTemplateProvenance(value, label);
@@ -16654,7 +16674,7 @@ function readTemplateProvenance(registry, root) {
 }
 function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const resources = /* @__PURE__ */ new Map();
-  if (!existsSync2(directory)) return resources;
+  if (!existsSync3(directory)) return resources;
   const stat = lstatSync(directory);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     fail2("path", "resource_directory_invalid", displayPath(root, directory), "resource directory must be a regular directory");
@@ -16663,27 +16683,27 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => compareCodeUnits3(left.name, right.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join(directory, entry.name)), "nested resource directories are not allowed"));
+      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join2(directory, entry.name)), "nested resource directories are not allowed"));
       continue;
     }
     if (!entry.name.toLowerCase().endsWith(".yaml") && !entry.name.toLowerCase().endsWith(".yml")) continue;
     if (!entry.isFile() || extname(entry.name) !== ".yaml") {
-      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
+      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join2(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
       continue;
     }
     const id = basename(entry.name, ".yaml");
     if (kind === "model" && id === "inventory") continue;
     if (!resourceIdentifier(id)) {
-      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
+      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join2(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
       continue;
     }
     const collision = [...resources.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) {
-      issues.push(issue2("path", "resource_id_collision", displayPath(root, join(directory, entry.name)), `${id} case-folds to existing ${collision}`));
+      issues.push(issue2("path", "resource_id_collision", displayPath(root, join2(directory, entry.name)), `${id} case-folds to existing ${collision}`));
       continue;
     }
     try {
-      const resource = readResource(registry, root, join(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
+      const resource = readResource(registry, root, join2(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
       resources.set(id, resource);
     } catch (error) {
       if (error instanceof VnextConfigError) issues.push(...error.issues);
@@ -16975,8 +16995,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue2("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join17 = objectValue(step.join);
-    const minimumPassed = join17 && typeof join17.minimumPassed === "number" ? join17.minimumPassed : void 0;
+    const join18 = objectValue(step.join);
+    const minimumPassed = join18 && typeof join18.minimumPassed === "number" ? join18.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue2("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -17190,9 +17210,9 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (!workflows.has(defaultWorkflow)) issues.push(issue2("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
   if (projectRoot) {
-    const writerRolePath = join(projectRoot, ".kxm", "roles", "writer.yaml");
+    const writerRolePath = join2(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync2(writerRolePath) && implementerAgent) {
+    if (existsSync3(writerRolePath) && implementerAgent) {
       try {
         const rawRole = parseRestrictedYaml2(readFileSync(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
@@ -17241,7 +17261,7 @@ function gitEnvironment() {
 }
 function discoverGitRoot(start = process.cwd()) {
   let current = resolve(start);
-  if (existsSync2(current) && !lstatSync(current).isDirectory()) current = dirname(current);
+  if (existsSync3(current) && !lstatSync(current).isDirectory()) current = dirname2(current);
   const result = spawnSync2("git", ["-C", current, "rev-parse", "--show-toplevel"], {
     encoding: "utf8",
     env: gitEnvironment(),
@@ -17250,7 +17270,7 @@ function discoverGitRoot(start = process.cwd()) {
   });
   if (result.status !== 0 || result.error || !result.stdout.trim()) return void 0;
   const root = resolve(result.stdout.trim());
-  return existsSync2(root) && lstatSync(root).isDirectory() ? root : void 0;
+  return existsSync3(root) && lstatSync(root).isDirectory() ? root : void 0;
 }
 function assertNoRegisteredGates(options) {
   if ("registeredGates" in options) {
@@ -17267,7 +17287,7 @@ function loadVnextProject(projectRoot, options = {}) {
     migrationReceipt = receiptCheck.receipt;
   }
   const registry = new VnextSchemaRegistry(options.schemasDir);
-  const project = readResource(registry, root, join(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
+  const project = readResource(registry, root, join2(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
   const earlyIssues = [];
   validatePortablePaths(project, earlyIssues);
   const templateProvenance = readTemplateProvenance(registry, root);
@@ -17289,16 +17309,16 @@ function loadVnextProject(projectRoot, options = {}) {
     }
   }
   if (earlyIssues.length > 0) throw new VnextConfigError(earlyIssues);
-  const agents = listNamedResources(registry, root, join(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join(root, ".kxm", "models"), ".kxm/models", "model");
-  const workflows = listNamedResources(registry, root, join(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
-  const gatePath = join(root, ".kxm", "gates.yaml");
-  const gateRegistry = existsSync2(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
+  const agents = listNamedResources(registry, root, join2(root, ".kxm", "agents"), ".kxm/agents", "agent");
+  const models = listNamedResources(registry, root, join2(root, ".kxm", "models"), ".kxm/models", "model");
+  const workflows = listNamedResources(registry, root, join2(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
+  const gatePath = join2(root, ".kxm", "gates.yaml");
+  const gateRegistry = existsSync3(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
   const environments = [];
   const repositories = /* @__PURE__ */ new Map();
   const loadIssues = [];
-  const projectEnvironment = join(root, ".kxm", "project", "env.yaml");
-  if (existsSync2(projectEnvironment)) {
+  const projectEnvironment = join2(root, ".kxm", "project", "env.yaml");
+  if (existsSync3(projectEnvironment)) {
     try {
       environments.push(readResource(registry, root, projectEnvironment, ".kxm/project/env.yaml", "environment"));
     } catch (error) {
@@ -17340,7 +17360,7 @@ function loadVnextProject(projectRoot, options = {}) {
       if (required) loadIssues.push(issue2("discovery", "repository_binding_missing", ".kxm/project.yaml", `required repository ${repositoryId} has no portable pathHint or host-local binding`));
       continue;
     }
-    if (!existsSync2(binding)) {
+    if (!existsSync3(binding)) {
       if (required || hasLocalBinding) loadIssues.push(issue2("discovery", "repository_binding_unavailable", ".kxm/project.yaml", `${hasLocalBinding ? "explicit" : "required"} repository binding ${repositoryId} is unavailable`));
       continue;
     }
@@ -17363,9 +17383,9 @@ function loadVnextProject(projectRoot, options = {}) {
       continue;
     }
     seenBindings.set(foldedBinding, repositoryId);
-    const repositoryFile = join(binding, ".kxm", "repo", "repo.yaml");
+    const repositoryFile = join2(binding, ".kxm", "repo", "repo.yaml");
     let definitionValidated = false;
-    if (existsSync2(repositoryFile)) {
+    if (existsSync3(repositoryFile)) {
       try {
         const resource = readResource(registry, root, repositoryFile, `.kxm/repositories/${repositoryId}/repo.yaml`, "repository", repositoryId, binding);
         if (resource.value.repositoryId !== repositoryId) {
@@ -17381,8 +17401,8 @@ function loadVnextProject(projectRoot, options = {}) {
     } else if (required || hasLocalBinding) {
       loadIssues.push(issue2("discovery", "repository_definition_missing", `.kxm/repositories/${repositoryId}/repo.yaml`, `${hasLocalBinding ? "explicit" : "required"} repository ${repositoryId} has no repo.yaml`));
     }
-    const environmentFile = join(binding, ".kxm", "repo", "env.yaml");
-    if (existsSync2(environmentFile)) {
+    const environmentFile = join2(binding, ".kxm", "repo", "env.yaml");
+    if (existsSync3(environmentFile)) {
       if (!definitionValidated) {
         loadIssues.push(issue2("reference", "repository_environment_without_definition", `.kxm/repositories/${repositoryId}/env.yaml`, `repository ${repositoryId} environment requires a validated matching repo.yaml`));
       } else {
@@ -17419,14 +17439,14 @@ var LEGACY_CONFIG_FILES = [".kxm/config/agents.json", ".kxm/config/gates.json"];
 function legacyConfigFilesAt(root) {
   const files = [];
   for (const component of [".kxm", ".kxm/config"]) {
-    const absolute = join(root, ...component.split("/"));
-    if (existsSync2(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
+    const absolute = join2(root, ...component.split("/"));
+    if (existsSync3(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
   }
   for (const candidate of LEGACY_CONFIG_FILES) {
-    if (existsSync2(join(root, ...candidate.split("/")))) files.push(candidate);
+    if (existsSync3(join2(root, ...candidate.split("/")))) files.push(candidate);
   }
-  const workflowsDir = join(root, ".kxm", "config", "workflows");
-  if (existsSync2(workflowsDir)) {
+  const workflowsDir = join2(root, ".kxm", "config", "workflows");
+  if (existsSync3(workflowsDir)) {
     const stat = lstatSync(workflowsDir);
     if (stat.isSymbolicLink()) {
       files.push(".kxm/config/workflows");
@@ -17441,8 +17461,8 @@ function legacyConfigFilesAt(root) {
   return files;
 }
 function hashFileRecord(root, relativePath) {
-  const absolute = join(root, ...relativePath.split("/"));
-  if (!existsSync2(absolute)) return void 0;
+  const absolute = join2(root, ...relativePath.split("/"));
+  if (!existsSync3(absolute)) return void 0;
   const bytes = readFileSync(absolute);
   return {
     path: relativePath,
@@ -17455,9 +17475,9 @@ function migrationReceiptSelfHash(receipt) {
   return `sha256:${createHash2("sha256").update(vnextCanonicalJson(unsigned), "utf8").digest("hex")}`;
 }
 function readVnextMigrationReceipt(root, options = {}) {
-  const receiptPath = join(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  const receiptPath = join2(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
   const legacyFiles = legacyConfigFilesAt(root);
-  if (!existsSync2(receiptPath)) {
+  if (!existsSync3(receiptPath)) {
     return {
       issues: legacyFiles.map((file) => issue2("semantic", "legacy_vnext_conflict", file, "legacy and vNext configuration cannot coexist before an accepted migration receipt"))
     };
@@ -17503,8 +17523,8 @@ function readVnextMigrationReceipt(root, options = {}) {
 
 // plugins/kxm/src/vnext-runtime-store.ts
 import { createHash as createHash4, randomUUID } from "node:crypto";
-import { existsSync as existsSync4, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync5, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, join as join5, resolve as resolve4 } from "node:path";
 
 // plugins/kxm/src/vnext-bindings.ts
 import { homedir } from "node:os";
@@ -17549,7 +17569,7 @@ var DatabaseSync = class {
 };
 
 // plugins/kxm/src/vnext-bindings.ts
-import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, parse, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
 function bindingIssue(phase, code, message) {
@@ -17569,12 +17589,12 @@ function vnextUserStateRoot(options = {}) {
   }
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join2(home, "AppData", "Local");
+    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join3(home, "AppData", "Local");
     return resolve2(base2, "KXM");
   }
   if (platform === "darwin") return resolve2(home, "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join2(home, ".local", "state");
+  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join3(home, ".local", "state");
   return resolve2(base, "kxm");
 }
 
@@ -17583,7 +17603,7 @@ import { createHash as createHash3, randomBytes } from "node:crypto";
 import {
   chmodSync,
   copyFileSync,
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   lstatSync as lstatSync2,
   mkdirSync,
   readdirSync as readdirSync2,
@@ -17591,14 +17611,14 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { basename as basename2, dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join4, resolve as resolve3 } from "node:path";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new VnextConfigError([issue3]);
 }
 function checkedParent(path, description) {
-  const parent = dirname3(path);
-  if (!existsSync3(parent)) mkdirSync(parent, { recursive: true, mode: 448 });
+  const parent = dirname4(path);
+  if (!existsSync4(parent)) mkdirSync(parent, { recursive: true, mode: 448 });
   const stat = lstatSync2(parent, { throwIfNoEntry: false });
   if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
     throw databaseError("runtime_path_invalid", description, `${description} parent must be a regular directory, not a link`);
@@ -17772,7 +17792,7 @@ function backupDatabaseFile(sourcePath, targetPath, storeId) {
     throw databaseError("runtime_path_invalid", resolvedSource, `source database ${resolvedSource} must be a regular file, not a link or directory`);
   }
   checkedParent(resolvedTarget, "backup target");
-  if (existsSync3(resolvedTarget)) {
+  if (existsSync4(resolvedTarget)) {
     unlinkSync(resolvedTarget);
   }
   const sourceDb = new DatabaseSync(resolvedSource);
@@ -17850,7 +17870,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   }
   checkedParent(resolvedTarget, "restore target");
   for (const file of [resolvedTarget, `${resolvedTarget}-wal`, `${resolvedTarget}-shm`]) {
-    if (existsSync3(file)) {
+    if (existsSync4(file)) {
       try {
         unlinkSync(file);
       } catch {
@@ -17882,27 +17902,27 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
 function discoverProjectStores(projectRoot, options = {}) {
   const root = resolve3(projectRoot);
   const stores = [];
-  const hubPath = options.hubDataPath ? resolve3(options.hubDataPath) : join3(root, ".kxm", "state", "kxm.db");
-  if (existsSync3(hubPath)) {
+  const hubPath = options.hubDataPath ? resolve3(options.hubDataPath) : join4(root, ".kxm", "state", "kxm.db");
+  if (existsSync4(hubPath)) {
     stores.push({ storeId: "hub-store", sourcePath: hubPath, maxSupportedVersion: 3 });
   }
-  const registryPath = join3(root, ".kxm", "runtime", "registry.db");
-  if (existsSync3(registryPath)) {
+  const registryPath = join4(root, ".kxm", "runtime", "registry.db");
+  if (existsSync4(registryPath)) {
     stores.push({ storeId: "registry", sourcePath: registryPath, maxSupportedVersion: 1 });
   }
-  const bindingsPath = join3(root, ".kxm", "runtime", "bindings.db");
-  if (existsSync3(bindingsPath)) {
+  const bindingsPath = join4(root, ".kxm", "runtime", "bindings.db");
+  if (existsSync4(bindingsPath)) {
     stores.push({ storeId: "binding-store", sourcePath: bindingsPath, maxSupportedVersion: 1 });
   }
-  const eventsDir = join3(root, ".kxm", "runtime", "events");
-  if (existsSync3(eventsDir)) {
+  const eventsDir = join4(root, ".kxm", "runtime", "events");
+  if (existsSync4(eventsDir)) {
     const entries = readdirSync2(eventsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".db")) {
         const key = entry.name.replace(/\.db$/, "");
         stores.push({
           storeId: `events:${key}`,
-          sourcePath: join3(eventsDir, entry.name),
+          sourcePath: join4(eventsDir, entry.name),
           maxSupportedVersion: 3
         });
       }
@@ -17921,8 +17941,8 @@ function createBackup(options = {}) {
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-");
   const backupId = `bk_${randomBytes(8).toString("hex")}`;
-  const outDir = options.outDir ? resolve3(options.outDir) : join3(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
-  if (!existsSync3(outDir)) {
+  const outDir = options.outDir ? resolve3(options.outDir) : join4(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
+  if (!existsSync4(outDir)) {
     mkdirSync(outDir, { recursive: true, mode: 448 });
   }
   const backedUpStores = [];
@@ -17934,7 +17954,7 @@ function createBackup(options = {}) {
       filename = `${sanitizedId}-${filename}`;
     }
     usedFilenames.add(filename);
-    const targetFile = join3(outDir, filename);
+    const targetFile = join4(outDir, filename);
     const record2 = backupDatabaseFile(store.sourcePath, targetFile, store.storeId);
     backedUpStores.push(record2);
   }
@@ -17949,7 +17969,7 @@ function createBackup(options = {}) {
   const manifestSha256 = `sha256:${createHash3("sha256").update(manifestJson, "utf8").digest("hex")}`;
   manifest.manifestSha256 = manifestSha256;
   const finalJson = JSON.stringify(manifest, null, 2) + "\n";
-  const manifestPath = join3(outDir, "manifest.json");
+  const manifestPath = join4(outDir, "manifest.json");
   writeFileSync(manifestPath, finalJson, "utf8");
   return { manifest, outDir };
 }
@@ -17960,12 +17980,12 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     throw databaseError("runtime_path_invalid", manifestPath, `manifest path ${manifestPath} does not exist`);
   }
   if (stat.isDirectory()) {
-    manifestPath = join3(manifestPath, "manifest.json");
+    manifestPath = join4(manifestPath, "manifest.json");
   }
-  if (!existsSync3(manifestPath)) {
+  if (!existsSync4(manifestPath)) {
     throw databaseError("runtime_path_invalid", manifestPath, `backup manifest ${manifestPath} not found`);
   }
-  const manifestDir = dirname3(manifestPath);
+  const manifestDir = dirname4(manifestPath);
   const rawText = readFileSync2(manifestPath, "utf8");
   let manifest;
   try {
@@ -17978,8 +17998,8 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   }
   const restoredStores = [];
   for (const store of manifest.stores) {
-    const backupFilePath = join3(manifestDir, store.backupFile);
-    if (!existsSync3(backupFilePath)) {
+    const backupFilePath = join4(manifestDir, store.backupFile);
+    if (!existsSync4(backupFilePath)) {
       throw databaseError("restore_file_missing", backupFilePath, `backup file ${store.backupFile} missing from ${manifestDir}`);
     }
     const actualSha256 = fileSha256(backupFilePath);
@@ -17997,7 +18017,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
       const rel = targetPath.slice(manifest.projectRoot.length).replace(/^[\\/]+/, "");
-      targetPath = join3(resolve3(options.projectRoot), rel);
+      targetPath = join4(resolve3(options.projectRoot), rel);
     }
     const result = restoreDatabaseFile(
       backupFilePath,
@@ -18018,12 +18038,12 @@ function restoreBackup(manifestPathOrDir, options = {}) {
 // plugins/kxm/src/vnext-runtime-store.ts
 function vnextRuntimePaths(options = {}) {
   const stateRoot = options.stateRoot ? resolve4(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
-  const runtimeDir = join4(stateRoot, "runtime");
+  const runtimeDir = join5(stateRoot, "runtime");
   return {
     stateRoot,
     runtimeDir,
-    registryDb: join4(runtimeDir, "registry.db"),
-    projectsDir: join4(runtimeDir, "projects")
+    registryDb: join5(runtimeDir, "registry.db"),
+    projectsDir: join5(runtimeDir, "projects")
   };
 }
 function runtimeIssue(phase, code, file, message) {
@@ -18486,7 +18506,7 @@ var VnextRunEventStore = class {
   }
   readRunPrompts() {
     const sidecar = this.runPromptSidecarPath();
-    if (!existsSync4(sidecar)) return {};
+    if (!existsSync5(sidecar)) return {};
     try {
       const parsed = JSON.parse(readFileSync3(sidecar, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -20504,7 +20524,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join17 = compileJoin(step, id, sink);
+  const join18 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits4);
@@ -20532,7 +20552,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join17
+    join: join18
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -20582,15 +20602,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join17 = objectValue2(step.join);
-  if (!join17) return { strategy: "all" };
-  const declared = stringValue2(join17.strategy);
+  const join18 = objectValue2(step.join);
+  if (!join18) return { strategy: "all" };
+  const declared = stringValue2(join18.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join17.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join18.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join17.cancelRemaining === "boolean" ? { cancelRemaining: join17.cancelRemaining } : {}
+    ...typeof join18.cancelRemaining === "boolean" ? { cancelRemaining: join18.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -21911,12 +21931,12 @@ function enqueueVnextScheduledRun(storePath, runId, configRevision, bound, start
   if (owner.admitted.has(runId) || owner.queue.some((item) => item.runId === runId)) {
     return Promise.reject(runtimeError("run_busy", runId, `run ${runId} is already admitted or queued`));
   }
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve8, reject) => {
     owner.queue.push({
       runId,
       configRevision,
       bound,
-      start: (token) => start(token).then(resolve9, reject),
+      start: (token) => start(token).then(resolve8, reject),
       fail: (error) => reject(error)
     });
     pump(storePath, owner);
@@ -21977,11 +21997,11 @@ function vnextToolPolicyRevision(bundle) {
   return sha256Of(vnextCanonicalJson({ policies, gateRegistry: bundle.gateRegistry?.value ?? null }));
 }
 function collectMemoryFiles(dir, baseDir, ignoreSubdirs = /* @__PURE__ */ new Set()) {
-  if (!existsSync5(dir)) return [];
+  if (!existsSync6(dir)) return [];
   const entries = readdirSync3(dir, { withFileTypes: true });
   const results = [];
   for (const entry of entries) {
-    const fullPath = join5(dir, entry.name);
+    const fullPath = join6(dir, entry.name);
     if (entry.isDirectory()) {
       if (ignoreSubdirs.has(entry.name)) continue;
       results.push(...collectMemoryFiles(fullPath, baseDir, ignoreSubdirs));
@@ -21994,15 +22014,15 @@ function collectMemoryFiles(dir, baseDir, ignoreSubdirs = /* @__PURE__ */ new Se
 }
 function computeVnextMemoryRevision(bundle, options = {}) {
   const hash = createHash6("sha256");
-  const memoryDir = options.memoryDir ?? join5(bundle.projectRoot, ".kxm", "memory");
+  const memoryDir = options.memoryDir ?? join6(bundle.projectRoot, ".kxm", "memory");
   const memoryFiles = collectMemoryFiles(memoryDir, memoryDir, /* @__PURE__ */ new Set(["candidates"])).sort((left, right) => compareCodeUnits5(left.relPath, right.relPath));
   for (const file of memoryFiles) {
     hash.update(`memory:${file.relPath}\0`, "utf8");
     hash.update(readFileSync4(file.fullPath));
     hash.update("\0", "utf8");
   }
-  const skillsDir = options.skillsDir ?? join5(bundle.projectRoot, ".kxm", "skills");
-  const promotedSkillsDir = join5(skillsDir, "promoted");
+  const skillsDir = options.skillsDir ?? join6(bundle.projectRoot, ".kxm", "skills");
+  const promotedSkillsDir = join6(skillsDir, "promoted");
   const skillFiles = collectMemoryFiles(promotedSkillsDir, promotedSkillsDir).sort((left, right) => compareCodeUnits5(left.relPath, right.relPath));
   for (const file of skillFiles) {
     hash.update(`skill:${file.relPath}\0`, "utf8");
@@ -22086,7 +22106,7 @@ function openVnextRuntimeContext(projectRoot, options) {
       configRevision: bundle.configRevision,
       now: options.now ?? (/* @__PURE__ */ new Date()).toISOString()
     });
-    const eventStore = new VnextRunEventStore(join5(paths.projectsDir, registration.projectKey, "run-events.db"));
+    const eventStore = new VnextRunEventStore(join6(paths.projectsDir, registration.projectKey, "run-events.db"));
     registerVnextRuntimeHandle(eventStore.path);
     return {
       registry,
@@ -22416,18 +22436,17 @@ function assertVnextConfigError(error) {
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash12, createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync9, lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync10, lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { createServer } from "node:http";
-import { dirname as dirname5, isAbsolute as isAbsolute4, join as join12, resolve as resolve6 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join13 } from "node:path";
 
 // plugins/kxm/src/vnext-oneshot-producer.ts
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // plugins/kxm/src/vnext-oneshot-evidence.ts
 import { createHash as createHash7, randomUUID as randomUUID3 } from "node:crypto";
 import { lstat, mkdir, open, rename } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var ONESHOT_EVIDENCE_SCHEMA = "kxm.oneshot-evidence.v2";
 var RETIRED_ONESHOT_EVIDENCE_SCHEMAS = /* @__PURE__ */ new Set(["kxm.oneshot-evidence.v1"]);
 var TEXT_LIMIT = 4 * 1024 * 1024;
@@ -22457,7 +22476,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
     throw new Error("oneshot_evidence_root_not_private");
   }
   const id = `evd_${randomUUID3().replaceAll("-", "")}`;
-  const dir = join6(root, id);
+  const dir = join7(root, id);
   await mkdir(dir, { mode: 448 });
   const secrets = [...new Set(sensitive.filter((value) => value.length >= 8))].sort((a, b) => b.length - a.length);
   const redact = (value) => {
@@ -22477,7 +22496,7 @@ async function beginOneShotEvidence(root, intent, sensitive) {
     const bytes = JSON.stringify(value);
     if (Buffer.byteLength(bytes) > RECORD_LIMIT) throw new Error("oneshot_evidence_record_limit");
     parseOneShotEvidenceRecord(bytes);
-    const target = join6(dir, name);
+    const target = join7(dir, name);
     const partial = `${target}.partial`;
     const file = await open(partial, "wx", 384);
     try {
@@ -22544,8 +22563,8 @@ async function beginOneShotEvidence(root, intent, sensitive) {
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync5, statSync } from "node:fs";
+import { join as join8 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
 var PRICES_SCHEMA = "kxm.prices.v1";
@@ -22697,8 +22716,8 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync6(join7(rootOrPath, ".kxm", "prices.yaml")) ? join7(rootOrPath, ".kxm", "prices.yaml") : existsSync6(join7(rootOrPath, "prices.yaml")) ? join7(rootOrPath, "prices.yaml") : existsSync6(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
-  if (!candidatePath || !existsSync6(candidatePath)) {
+  const candidatePath = existsSync7(join8(rootOrPath, ".kxm", "prices.yaml")) ? join8(rootOrPath, ".kxm", "prices.yaml") : existsSync7(join8(rootOrPath, "prices.yaml")) ? join8(rootOrPath, "prices.yaml") : existsSync7(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  if (!candidatePath || !existsSync7(candidatePath)) {
     return void 0;
   }
   const content = readFileSync5(candidatePath, "utf8");
@@ -22720,28 +22739,28 @@ function loadPriceCatalogForEstimate(options) {
 // plugins/kxm/src/vnext-engine.ts
 var import_yaml5 = __toESM(require_dist(), 1);
 import { createHash as createHash11, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { join as join11 } from "node:path";
 
 // plugins/kxm/src/producers.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { existsSync as existsSync7, readFileSync as readFileSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
 function loadProducerPolicy(root) {
-  const path = join8(root, ".kxm", "producers.yaml");
-  if (!existsSync7(path)) return empty();
+  const path = join9(root, ".kxm", "producers.yaml");
+  if (!existsSync8(path)) return empty();
   const value = (0, import_yaml4.parse)(readFileSync6(path, "utf8"));
   if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
   return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x) => typeof x === "string"), demoted: value.demoted.filter((x) => typeof x === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x) => typeof x === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, v.filter((x) => typeof x === "string")])) : {} };
 }
 function listRoleBindings(root) {
-  const dir = join8(root, ".kxm", "roles");
+  const dir = join9(root, ".kxm", "roles");
   const result = {};
-  if (!existsSync7(dir)) return result;
+  if (!existsSync8(dir)) return result;
   for (const file of readdirSync4(dir).filter((name) => name.endsWith(".yaml"))) {
     const role = file.slice(0, -5);
-    const value = (0, import_yaml4.parse)(readFileSync6(join8(dir, file), "utf8"));
+    const value = (0, import_yaml4.parse)(readFileSync6(join9(dir, file), "utf8"));
     result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model) => typeof model === "string");
   }
   return result;
@@ -23012,7 +23031,7 @@ function pruneContextPacket(packet, tokenBudget) {
 }
 
 // plugins/kxm/src/vnext-engine-artifacts.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // plugins/kxm/src/artifacts-exist.ts
 import { lstatSync as lstatSync4, realpathSync as realpathSync3, statSync as statSync2 } from "node:fs";
@@ -23059,14 +23078,14 @@ function verifyArtifactExists(rootInput, pathInput) {
 // plugins/kxm/src/vnext-engine-artifacts.ts
 var vnextArtifactsGateSeams = {};
 function evaluateArtifactsGate(context, definition) {
-  const root = join9(context.projectRoot, ".kxm", "assets");
+  const root = join10(context.projectRoot, ".kxm", "assets");
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const startTime = process.hrtime.bigint();
   let checkedCount = 0;
   let failedCount = 0;
   for (const [index, path] of definition.paths.entries()) {
     checkedCount += 1;
-    const result = verifyArtifactExists(root, join9(root, path));
+    const result = verifyArtifactExists(root, join10(root, path));
     if (!result.ok) failedCount += 1;
     vnextArtifactsGateSeams.afterPathChecked?.({ path, index, checkedCount, failedCount });
   }
@@ -23222,8 +23241,8 @@ var CommandObserver = class {
     this.requestStop("error", "lost-close");
   }
   run() {
-    return new Promise((resolve9) => {
-      this.resolveOutcome = resolve9;
+    return new Promise((resolve8) => {
+      this.resolveOutcome = resolve8;
       try {
         this.start();
       } catch (error) {
@@ -24424,8 +24443,8 @@ var VnextRunScheduler = class _VnextRunScheduler {
       resolve: (_value) => void 0,
       reject: (_error) => void 0
     };
-    const settled = new Promise((resolve9, reject) => {
-      pending.resolve = resolve9;
+    const settled = new Promise((resolve8, reject) => {
+      pending.resolve = resolve8;
       pending.reject = reject;
     });
     void settled.then(void 0, () => void 0);
@@ -24760,8 +24779,8 @@ function unreconciledPanelAttemptId(state) {
 }
 function resolveProducerRoute(projectRoot, step, agentId) {
   let agentModel;
-  const agentFile = join10(projectRoot, ".kxm", "agents", `${agentId}.yaml`);
-  if (existsSync8(agentFile)) {
+  const agentFile = join11(projectRoot, ".kxm", "agents", `${agentId}.yaml`);
+  if (existsSync9(agentFile)) {
     try {
       const parsed = (0, import_yaml5.parse)(readFileSync7(agentFile, "utf8"));
       if (typeof parsed?.model === "string") {
@@ -26344,7 +26363,7 @@ Return a final JSON object with an "outcome" field chosen from ${JSON.stringify(
     }
     const spawnFn = options.spawnProcess ?? defaultSpawn;
     const cwd = options.projectRoot ?? process.cwd();
-    const evidence = await beginOneShotEvidence(options.evidenceRoot ?? join11(vnextUserStateRoot(), "runtime", "oneshot-evidence"), {
+    const evidence = await beginOneShotEvidence(options.evidenceRoot ?? join12(vnextUserStateRoot(), "runtime", "oneshot-evidence"), {
       runId: request.runId,
       stepId: request.stepId,
       attemptId: request.attemptId,
@@ -26488,13 +26507,12 @@ Return a final JSON object with an "outcome" field chosen from ${JSON.stringify(
 }
 
 // plugins/kxm/src/vnext-runtime-supervisor.ts
-var repoRoot = resolve6(fileURLToPath2(new URL("../../../", import.meta.url)));
 function vnextSupervisorTokenFile(paths) {
-  return join12(paths.runtimeDir, "supervisor.token");
+  return join13(paths.runtimeDir, "supervisor.token");
 }
 function publishVnextSupervisorToken(paths, token) {
   const file = vnextSupervisorTokenFile(paths);
-  mkdirSync4(dirname5(file), { recursive: true, mode: 448 });
+  mkdirSync4(dirname6(file), { recursive: true, mode: 448 });
   const temp = `${file}.${process.pid}.tmp`;
   writeFileSync4(temp, `${token}
 `, { encoding: "utf8", mode: 384 });
@@ -26532,11 +26550,11 @@ function processAlive(pid) {
 var HEARTBEAT_STALE_MS = 15e3;
 var SUPERVISOR_ERROR_MAX_AGE_MS = 3e4;
 function supervisorErrorFile(paths) {
-  return join12(paths.runtimeDir, "supervisor.error");
+  return join13(paths.runtimeDir, "supervisor.error");
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
-  if (existsSync9(file)) rmSync(file, { force: true });
+  if (existsSync10(file)) rmSync(file, { force: true });
 }
 function recordSupervisorError(paths, message) {
   try {
@@ -26559,7 +26577,7 @@ function readRecentSupervisorError(paths) {
   }
 }
 function vnextSupervisorStatus(paths) {
-  if (!existsSync9(paths.registryDb)) return { running: false };
+  if (!existsSync10(paths.registryDb)) return { running: false };
   const registry = new VnextRuntimeRegistry(paths.registryDb);
   try {
     const record2 = registry.supervisor();
@@ -26620,7 +26638,7 @@ async function ensureVnextSupervisor(options = {}) {
     throw runtimeError("runtime_supervisor_unreachable", paths.registryDb, `runtime supervisor pid ${status.pid} is registered as running but cannot be probed`);
   }
   clearSupervisorError(paths);
-  const scriptPath = join12(repoRoot, "scripts", "kxm-runtime-supervisor.mjs");
+  const scriptPath = join13(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
   const spawnImpl = options.spawnImpl ?? ((script, env) => {
     const child = spawn3(process.execPath, [script], {
       detached: true,
@@ -26705,8 +26723,8 @@ async function waitForDriveSessions(settled, graceMs) {
   try {
     await Promise.race([
       Promise.allSettled(settled),
-      new Promise((resolve9) => {
-        timeout = setTimeout(resolve9, graceMs);
+      new Promise((resolve8) => {
+        timeout = setTimeout(resolve8, graceMs);
         timeout.unref?.();
       })
     ]);
@@ -27073,7 +27091,7 @@ async function vnextRuntimeRequest(handle, method, path, body) {
 
 // plugins/kxm/src/vnext-pi-producer.ts
 import { spawn as spawn4 } from "node:child_process";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function formatPiSessionKey(params) {
   if (params.agentId === "coordinator") {
@@ -27272,8 +27290,8 @@ var PiSession = class {
     }
     const id = `cmd_${++this.commandCounter}`;
     const payload = { ...command, id };
-    return new Promise((resolve9, reject) => {
-      this.pendingCommands.set(id, { resolve: resolve9, reject });
+    return new Promise((resolve8, reject) => {
+      this.pendingCommands.set(id, { resolve: resolve8, reject });
       try {
         this.process.stdin.write(JSON.stringify(payload) + "\n");
       } catch (err) {
@@ -27294,7 +27312,7 @@ var PiSession = class {
       return { outcome, text: "aborted", usage: {} };
     }
     this.status = "busy";
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve8, reject) => {
       let signalCleanup;
       if (signal) {
         const onAbort = () => {
@@ -27308,7 +27326,7 @@ var PiSession = class {
         signalCleanup = () => signal.removeEventListener("abort", onAbort);
       }
       this.activePrompt = {
-        resolve: resolve9,
+        resolve: resolve8,
         reject,
         allowedOutcomes,
         text: "",
@@ -27425,7 +27443,7 @@ function createVnextPiProducer(options = {}) {
     const args = ["--mode", "rpc", "--name", displayName];
     if (options.sessionDir) {
       const safeDirName = key.replace(/[^a-zA-Z0-9_-]/g, "_");
-      args.push("--session-dir", join13(options.sessionDir, request.runId, safeDirName));
+      args.push("--session-dir", join14(options.sessionDir, request.runId, safeDirName));
     }
     if (model) {
       args.push("--model", model);
@@ -27553,8 +27571,8 @@ function createVnextPiProducer(options = {}) {
 }
 
 // plugins/kxm/src/logger.ts
-import { appendFileSync, existsSync as existsSync10, mkdirSync as mkdirSync5, renameSync as renameSync2, statSync as statSync3, unlinkSync as unlinkSync2 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
+import { appendFileSync, existsSync as existsSync11, mkdirSync as mkdirSync5, renameSync as renameSync2, statSync as statSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
@@ -27617,7 +27635,7 @@ function redactLogValue(val, key) {
 function rotateLogFiles(filePath, maxFiles) {
   for (let i = maxFiles; i >= 1; i--) {
     const current = `${filePath}.${i}`;
-    if (existsSync10(current)) {
+    if (existsSync11(current)) {
       if (i >= maxFiles) {
         try {
           unlinkSync2(current);
@@ -27631,7 +27649,7 @@ function rotateLogFiles(filePath, maxFiles) {
       }
     }
   }
-  if (existsSync10(filePath)) {
+  if (existsSync11(filePath)) {
     try {
       renameSync2(filePath, `${filePath}.1`);
     } catch {
@@ -27648,7 +27666,7 @@ function createLogger(options) {
   const shouldStdout = options.stdout ?? !isDaemon;
   const correlationDefaults = options.correlation ?? {};
   let currentSize = 0;
-  if (filePath && existsSync10(filePath)) {
+  if (filePath && existsSync11(filePath)) {
     try {
       currentSize = statSync3(filePath).size;
     } catch {
@@ -27686,7 +27704,7 @@ function createLogger(options) {
         currentSize = 0;
       }
       try {
-        mkdirSync5(dirname6(filePath), { recursive: true });
+        mkdirSync5(dirname7(filePath), { recursive: true });
         appendFileSync(filePath, line, { encoding: "utf8", mode: 384 });
         currentSize += lineBytes;
       } catch {
@@ -27729,8 +27747,8 @@ function createLogger(options) {
 
 // plugins/kxm/src/improve.ts
 import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join14, relative as relative4, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join15, relative as relative4, resolve as resolve6 } from "node:path";
 
 // plugins/kxm/src/protocol.ts
 var DEFAULT_MESSAGE_TTL_MS = 24 * 60 * 6e4;
@@ -27913,8 +27931,8 @@ function groupRoutingRecords(records, options = {}) {
   });
 }
 function buildImprovementReport(records, options = {}) {
-  const projectRoot = options.projectRoot ? resolve7(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve7(options.candidatesDir) : join14(projectRoot, ".kxm", "candidates");
+  const projectRoot = options.projectRoot ? resolve6(options.projectRoot) : process.cwd();
+  const candidatesDir = options.candidatesDir ? resolve6(options.candidatesDir) : join15(projectRoot, ".kxm", "candidates");
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
   for (const group of groups) {
@@ -27926,7 +27944,7 @@ function buildImprovementReport(records, options = {}) {
       group.workflowHash
     );
     const diffFileName = `${group.candidateId}.diff`;
-    const diffFilePath = join14(candidatesDir, diffFileName);
+    const diffFilePath = join15(candidatesDir, diffFileName);
     const relDiffPath = relative4(projectRoot, diffFilePath).replace(/\\/g, "/");
     const candidate = {
       schema: CANDIDATE_SCHEMA,
@@ -27948,11 +27966,11 @@ function buildImprovementReport(records, options = {}) {
       createdAt: nowIso()
     };
     if (!options.dryRun) {
-      if (!existsSync11(candidatesDir)) {
+      if (!existsSync12(candidatesDir)) {
         mkdirSync6(candidatesDir, { recursive: true });
       }
       writeFileSync5(diffFilePath, diff, "utf8");
-      const jsonFilePath = join14(candidatesDir, `${group.candidateId}.json`);
+      const jsonFilePath = join15(candidatesDir, `${group.candidateId}.json`);
       writeFileSync5(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
     }
     candidates.push(candidate);
@@ -27968,7 +27986,7 @@ function buildImprovementReport(records, options = {}) {
 }
 function writeImprovementReport(improvementsDir, report, dryRun = false) {
   const stamp = report.createdAt.replace(/[:.]/g, "-");
-  const path = join14(improvementsDir, `${stamp}.json`);
+  const path = join15(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
     mkdirSync6(improvementsDir, { recursive: true });
     writeFileSync5(path, `${JSON.stringify(report, null, 2)}
@@ -28472,8 +28490,8 @@ Instructions for Operator:
 
 // plugins/kxm/src/modes.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { join as join16 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -28536,8 +28554,8 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join15(projectRoot, ".kxm", "modes.yaml");
-  if (!existsSync12(modesPath)) {
+  const modesPath = join16(projectRoot, ".kxm", "modes.yaml");
+  if (!existsSync13(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
@@ -28627,9 +28645,9 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join15(projectRoot, relPath);
+    const fullPath = join16(projectRoot, relPath);
     let chars = 0;
-    if (existsSync12(fullPath)) {
+    if (existsSync13(fullPath)) {
       try {
         chars = readFileSync10(fullPath, "utf8").length;
       } catch {
@@ -28763,9 +28781,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync11, readdirSync as readdirSync5, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync11, readdirSync as readdirSync5, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join16, resolve as resolve8 } from "node:path";
+import { join as join17, resolve as resolve7 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -28791,8 +28809,8 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join16(homedir2(), ".ssh", "config");
-  if (!existsSync13(targetPath)) {
+  const targetPath = configPath ?? join17(homedir2(), ".ssh", "config");
+  if (!existsSync14(targetPath)) {
     return [];
   }
   try {
@@ -28873,15 +28891,15 @@ function resolveSshHostG(host, execFn = spawnSync3) {
   }
 }
 function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
-  const resolved = resolve8(socketDir);
-  if (!existsSync13(resolved)) {
+  const resolved = resolve7(socketDir);
+  if (!existsSync14(resolved)) {
     mkdirSync7(resolved, { recursive: true, mode: 448 });
   }
   return resolved;
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join16(socketDir, "%C");
+  const controlPath = join17(socketDir, "%C");
   const persist2 = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -28906,7 +28924,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync3) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join16(resolvedDir, "%C");
+  const controlPath = join17(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -28918,7 +28936,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync3) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join16(resolvedDir, "%C");
+  const controlPath = join17(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -28934,7 +28952,7 @@ function pruneSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
   try {
     const entries = readdirSync5(resolvedDir);
     for (const entry of entries) {
-      const fullPath = join16(resolvedDir, entry);
+      const fullPath = join17(resolvedDir, entry);
       try {
         const stat = statSync4(fullPath);
         if (stat.isSocket()) {