@kontextmind/kxm 0.7.21 → 0.7.23

package/plugins/kxm/dist/cli.js

@@ -2987,7 +2987,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve30.call(this, root, ref);
+      let _sch = resolve31.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3014,7 +3014,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve30(root, ref) {
+    function resolve31(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3839,7 +3839,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve30(baseURI, relativeURI, options) {
+    function resolve31(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4201,7 +4201,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve30,
+      resolve: resolve31,
       resolveComponent,
       equal,
       serialize,
@@ -14779,7 +14779,7 @@ var require_dist = __commonJS({
 });
 
 // plugins/kxm/src/cli.ts
-import { resolve as resolve29 } from "node:path";
+import { resolve as resolve30 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // node_modules/commander/lib/error.js
@@ -19446,7 +19446,7 @@ var HubClient = class {
       if (signal?.aborted) throw new MeshWaitError("aborted", messageId);
       const message = await this.getMessage(messageId);
       if (["replied", "cancelled", "expired", "error"].includes(message.status)) return message;
-      await new Promise((resolve30, reject) => {
+      await new Promise((resolve31, reject) => {
         const onAbort = () => {
           signal?.removeEventListener("abort", onAbort);
           clearTimeout(timer);
@@ -19454,7 +19454,7 @@ var HubClient = class {
         };
         const timer = setTimeout(() => {
           signal?.removeEventListener("abort", onAbort);
-          resolve30();
+          resolve31();
         }, Math.min(500, Math.max(1, deadline - Date.now())));
         signal?.addEventListener("abort", onAbort, { once: true });
         if (signal?.aborted) onAbort();
@@ -19478,7 +19478,7 @@ var HubClient = class {
     while (!this.stopped && this.agent) {
       this.eventsAbort = new AbortController();
       try {
-        const response = await fetch(
+        const response = await (this.options.fetchImpl ?? fetch)(
           `${this.options.serverUrl.replace(/\/$/, "")}/v1/events?agentId=${encodeURIComponent(this.agent.id)}`,
           {
             headers: this.headers(),
@@ -19509,7 +19509,7 @@ var HubClient = class {
       } catch (error) {
         if (this.stopped || error instanceof Error && error.name === "AbortError") return;
       }
-      if (!this.stopped) await new Promise((resolve30) => setTimeout(resolve30, this.options.reconnectMs));
+      if (!this.stopped) await new Promise((resolve31) => setTimeout(resolve31, this.options.reconnectMs));
     }
   }
   headers(includeIdentity = true) {
@@ -19555,7 +19555,7 @@ var HubClient = class {
     const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
     let response;
     try {
-      response = await fetch(`${this.options.serverUrl.replace(/\/$/, "")}${path4}`, {
+      response = await (this.options.fetchImpl ?? fetch)(`${this.options.serverUrl.replace(/\/$/, "")}${path4}`, {
         ...init,
         signal,
         headers: { ...this.headers(includeIdentity), ...init.headers ?? {} }
@@ -19590,14 +19590,88 @@ var HubClient = class {
   }
 };
 
+// plugins/kxm/src/hub-env.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
+var HUB_ENV_SCHEMA = "kxm.hub-env.v1";
+var HubEnvError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HubEnvError";
+  }
+};
+function resolveUserStateRoot(env) {
+  const explicit = env.KXM_STATE_HOME?.trim();
+  if (explicit) {
+    if (!isAbsolute(explicit)) throw new HubEnvError("local_state_root_not_absolute");
+    return resolve(explicit);
+  }
+  if (process.platform === "win32") {
+    const localAppData = env.LOCALAPPDATA?.trim();
+    const base2 = localAppData && isAbsolute(localAppData) ? localAppData : join3(homedir(), "AppData", "Local");
+    return resolve(base2, "KXM");
+  }
+  if (process.platform === "darwin") return resolve(homedir(), "Library", "Application Support", "KXM");
+  const xdgState = env.XDG_STATE_HOME?.trim();
+  const base = xdgState && isAbsolute(xdgState) ? xdgState : join3(homedir(), ".local", "state");
+  return resolve(base, "kxm");
+}
+function hubEnvFile(env = process.env) {
+  return join3(resolveUserStateRoot(env), "hub-env.json");
+}
+function readHubEnvRecord(env = process.env) {
+  const file = hubEnvFile(env);
+  if (!existsSync3(file)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(file, "utf8"));
+  } catch (error) {
+    throw new HubEnvError(`hub env file is malformed at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new HubEnvError(`hub env file is malformed at ${file}: expected a JSON object`);
+  }
+  const record = parsed;
+  if (record.schema !== HUB_ENV_SCHEMA) {
+    throw new HubEnvError(`hub env file at ${file} has unsupported schema ${String(record.schema)}`);
+  }
+  if (record.authToken !== void 0 && (typeof record.authToken !== "string" || record.authToken.trim().length === 0)) {
+    throw new HubEnvError(`hub env file at ${file} has an invalid authToken`);
+  }
+  if (record.projectTokens !== void 0) {
+    const tokens = record.projectTokens;
+    if (!tokens || typeof tokens !== "object" || Array.isArray(tokens)) {
+      throw new HubEnvError(`hub env file at ${file} has invalid projectTokens`);
+    }
+    for (const [project, token] of Object.entries(tokens)) {
+      if (!project.trim() || typeof token !== "string" || !token.trim()) {
+        throw new HubEnvError(`hub env file at ${file} has an empty project name or token`);
+      }
+    }
+  }
+  return {
+    schema: HUB_ENV_SCHEMA,
+    createdAt: typeof record.createdAt === "string" ? record.createdAt : "",
+    ...record.authToken !== void 0 ? { authToken: record.authToken } : {},
+    ...record.projectTokens !== void 0 ? { projectTokens: record.projectTokens } : {}
+  };
+}
+function resolveClientHubAuthToken(env, project) {
+  const envToken = env.KXM_AUTH_TOKEN?.trim();
+  if (envToken) return envToken;
+  const record = readHubEnvRecord(env);
+  return record?.projectTokens?.[project]?.trim() || record?.authToken?.trim() || void 0;
+}
+
 // plugins/kxm/src/project-name.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { basename, join as join3 } from "node:path";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { basename, join as join4 } from "node:path";
 function defaultProjectName(cwd, env = process.env) {
   const fromEnv = env.KXM_PROJECT?.trim();
   if (fromEnv) return fromEnv;
   try {
-    const pkg = JSON.parse(readFileSync2(join3(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join4(cwd, "package.json"), "utf8"));
     if (typeof pkg.name === "string" && pkg.name.trim().length > 0) return pkg.name.trim();
   } catch {
   }
@@ -19606,9 +19680,9 @@ function defaultProjectName(cwd, env = process.env) {
 
 // plugins/kxm/src/commands.ts
 import { createHash as createHash4, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { dirname as dirname2, join as join4, resolve } from "node:path";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
 function requiredString(value, name) {
   if (typeof value !== "string" || value.trim() === "") throw new Error(`${name} is required`);
   return value.trim();
@@ -20356,18 +20430,18 @@ function parseSessionToken(token) {
   return void 0;
 }
 function resolveUserConfigDirectory(overrideDir) {
-  if (overrideDir) return resolve(overrideDir);
-  return resolve(process.env.KXM_USER_CONFIG_DIR?.trim() || join4(homedir(), ".config", "kxm"));
+  if (overrideDir) return resolve2(overrideDir);
+  return resolve2(process.env.KXM_USER_CONFIG_DIR?.trim() || join5(homedir2(), ".config", "kxm"));
 }
 function sessionTokenPath(userConfigDir) {
-  return join4(resolveUserConfigDirectory(userConfigDir), "session.token");
+  return join5(resolveUserConfigDirectory(userConfigDir), "session.token");
 }
 function persistSessionTokenToDisk(token, options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  const dir = dirname2(filePath);
-  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const dir = dirname3(filePath);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
   const mode = options?.mode ?? 384;
-  writeFileSync2(filePath, `${token.trim()}
+  writeFileSync3(filePath, `${token.trim()}
 `, { encoding: "utf8", mode });
   try {
     chmodSync(filePath, mode);
@@ -20377,9 +20451,9 @@ function persistSessionTokenToDisk(token, options) {
 }
 function readSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  if (!existsSync3(filePath)) return void 0;
+  if (!existsSync4(filePath)) return void 0;
   try {
-    const token = readFileSync3(filePath, "utf8").trim();
+    const token = readFileSync4(filePath, "utf8").trim();
     if (!token) return void 0;
     const payload = parseSessionToken(token);
     if (!payload) return void 0;
@@ -20390,7 +20464,7 @@ function readSessionTokenFromDisk(options) {
 }
 function clearSessionTokenFromDisk(options) {
   const filePath = sessionTokenPath(options?.userConfigDir);
-  if (!existsSync3(filePath)) return false;
+  if (!existsSync4(filePath)) return false;
   try {
     unlinkSync(filePath);
     return true;
@@ -20489,10 +20563,10 @@ function enforceToolPolicy(commandName, env = process.env, options) {
     return { allowed: true };
   }
   const tokenFile = sessionTokenPath(env.KXM_USER_CONFIG_DIR);
-  if (existsSync3(tokenFile)) {
+  if (existsSync4(tokenFile)) {
     let tokenRaw;
     try {
-      tokenRaw = readFileSync3(tokenFile, "utf8").trim();
+      tokenRaw = readFileSync4(tokenFile, "utf8").trim();
     } catch {
       return { allowed: false, error: "session_token_invalid", detail: "Session token file on disk could not be read" };
     }
@@ -20516,8 +20590,8 @@ function enforceToolPolicy(commandName, env = process.env, options) {
 var import__ = __toESM(require__(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync5, lstatSync, readFileSync as readFileSync4, readdirSync, realpathSync } from "node:fs";
-import { basename as basename2, dirname as dirname3, extname, isAbsolute, join as join5, relative, resolve as resolve2, sep } from "node:path";
+import { existsSync as existsSync6, lstatSync, readFileSync as readFileSync5, readdirSync, realpathSync } from "node:fs";
+import { basename as basename2, dirname as dirname4, extname, isAbsolute as isAbsolute2, join as join6, relative, resolve as resolve3, sep } from "node:path";
 
 // plugins/kxm/src/restricted-yaml.mjs
 var import_yaml = __toESM(require_dist(), 1);
@@ -20845,7 +20919,7 @@ function resolveVnextTemplateBaseline(value) {
 
 // plugins/kxm/src/vnext-harness.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { win32 as win32Path } from "node:path";
 
 // plugins/kxm/src/vnext-oneshot-process.ts
@@ -20871,7 +20945,7 @@ function defaultSpawn(command, args, options) {
   if (options.signal?.aborted) {
     return Promise.resolve({ stdout: "", stderr: "", code: null, started: false, observedChildExit: false, error: new Error("process_aborted") });
   }
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     const stdout = [];
     const stderr = [];
     let outputBytes = 0;
@@ -20902,7 +20976,7 @@ function defaultSpawn(command, args, options) {
       const started = Boolean(child?.pid);
       if (started && !observedChildExit) error ??= new Error("process_exit_unobserved");
       const unverifiedDescendants = stopping || started && !observedChildExit;
-      resolve30({
+      resolve31({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         code,
@@ -21394,7 +21468,7 @@ function findWinNpmInnerExe(cliId, options = {}) {
   if ((options.platform ?? process.platform) !== "win32") return void 0;
   const segments = WIN_NPM_INNER_EXE[cliId];
   if (!segments) return void 0;
-  const exists = options.existsSync ?? existsSync4;
+  const exists = options.existsSync ?? existsSync5;
   const pathEnv = options.pathEnv ?? process.env.PATH ?? "";
   for (const dir of pathEnv.split(";").filter(Boolean)) {
     if (!exists(win32Path.join(dir, `${cliId}.cmd`))) continue;
@@ -21912,7 +21986,7 @@ var VnextConfigError = class extends Error {
   }
 };
 function defaultVnextSchemaDir() {
-  return join5(findKxmRepoRoot(import.meta.url), "schemas", "vnext");
+  return join6(findKxmRepoRoot(import.meta.url), "schemas", "vnext");
 }
 var DEFAULT_SCHEMA_DIR = defaultVnextSchemaDir();
 var RESOURCE_SCHEMA = Object.freeze({
@@ -21960,7 +22034,7 @@ function parseRestrictedYaml2(input, label = "<yaml>", limits = VNEXT_YAML_LIMIT
   }
 }
 function readJsonObject(file) {
-  const parsed = JSON.parse(readFileSync4(file, "utf8"));
+  const parsed = JSON.parse(readFileSync5(file, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${file} is not a JSON object`);
   return parsed;
 }
@@ -21977,12 +22051,12 @@ var VnextSchemaRegistry = class {
   permissionDiffValidator;
   runEventValidator;
   constructor(schemasDir = DEFAULT_SCHEMA_DIR) {
-    this.schemasDir = resolve2(schemasDir);
+    this.schemasDir = resolve3(schemasDir);
     this.ajv = new import__.Ajv2020({ allErrors: true, strict: true, strictRequired: false });
-    const common = readJsonObject(join5(this.schemasDir, "common.schema.json"));
+    const common = readJsonObject(join6(this.schemasDir, "common.schema.json"));
     this.ajv.addSchema(common);
     for (const definition of Object.values(RESOURCE_SCHEMA)) {
-      this.ajv.addSchema(readJsonObject(join5(this.schemasDir, definition.file)));
+      this.ajv.addSchema(readJsonObject(join6(this.schemasDir, definition.file)));
     }
     const localBindingsFile = "local-repository-bindings.schema.json";
     const templateProvenanceFile = "template-provenance.schema.json";
@@ -21992,14 +22066,14 @@ var VnextSchemaRegistry = class {
     const migrationReceiptFile = "migration-receipt.schema.json";
     const permissionDiffFile = "permission-diff.schema.json";
     const runEventFile = "run-event.schema.json";
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, localBindingsFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, templateProvenanceFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, initOperationFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, migrationPlanFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, migrationDecisionFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, migrationReceiptFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, permissionDiffFile)));
-    this.ajv.addSchema(readJsonObject(join5(this.schemasDir, runEventFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, localBindingsFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, templateProvenanceFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, initOperationFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, migrationPlanFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, migrationDecisionFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, migrationReceiptFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, permissionDiffFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, runEventFile)));
     for (const [kind, definition] of Object.entries(RESOURCE_SCHEMA)) {
       const validator = this.ajv.getSchema(`https://schemas.kxm.dev/vnext/${definition.file}`);
       if (!validator) throw new Error(`schema did not compile: ${definition.file}`);
@@ -22075,7 +22149,7 @@ function schemaIssue(file, error) {
   return issue2("schema", `schema_${error.keyword}`, file, `${location} ${error.message ?? "is invalid"}${suffix}`);
 }
 function canonicalHostPath(path4) {
-  const resolved = resolve2(path4);
+  const resolved = resolve3(path4);
   try {
     return realpathSync.native(resolved);
   } catch {
@@ -22089,20 +22163,20 @@ function sameHostPath(left, right) {
 }
 function containedHostPath(root, candidate) {
   const path4 = relative(root, candidate);
-  return path4 === "" || !isAbsolute(path4) && path4 !== ".." && !path4.startsWith(`..${sep}`);
+  return path4 === "" || !isAbsolute2(path4) && path4 !== ".." && !path4.startsWith(`..${sep}`);
 }
 function portableBindingIssue(root, pathHint, repositoryId) {
   let current = root;
   for (const segment of pathHint === "." ? [] : pathHint.split("/")) {
-    current = join5(current, segment);
-    if (!existsSync5(current)) break;
+    current = join6(current, segment);
+    if (!existsSync6(current)) break;
     const stat = lstatSync(current);
     if (stat.isSymbolicLink()) {
       return issue2("path", "repository_binding_path_link", ".kxm/project.yaml", `portable pathHint for ${repositoryId} traverses a symbolic link or junction`);
     }
   }
-  const binding = resolve2(root, ...pathHint.split("/"));
-  if (existsSync5(binding)) {
+  const binding = resolve3(root, ...pathHint.split("/"));
+  if (existsSync6(binding)) {
     const realRoot = canonicalHostPath(root);
     const realBinding = canonicalHostPath(binding);
     if (!containedHostPath(realRoot, realBinding)) {
@@ -22139,10 +22213,10 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
     fail2("discovery", "resource_missing", label, "resource does not exist");
   }
   if (stat.isSymbolicLink()) fail2("path", "resource_symlink", label, "configuration resources must not be symbolic links");
-  const boundary = resolve2(containmentRoot);
-  let parent = dirname3(file);
+  const boundary = resolve3(containmentRoot);
+  let parent = dirname4(file);
   while (parent !== boundary) {
-    if (parent === dirname3(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
+    if (parent === dirname4(parent)) fail2("path", "resource_outside_project", label, "resource escapes the project root");
     let parentStat;
     try {
       parentStat = lstatSync(parent);
@@ -22150,33 +22224,33 @@ function readResource(registry, root, file, logicalPath, kind, id, containmentRo
       fail2("discovery", "resource_parent_missing", label, "resource parent does not exist");
     }
     if (parentStat.isSymbolicLink()) fail2("path", "resource_parent_symlink", label, "configuration resource parents must not be symbolic links");
-    parent = dirname3(parent);
+    parent = dirname4(parent);
   }
   if (!stat.isFile()) fail2("path", "resource_not_file", label, "configuration resource must be a regular file");
-  const value = parseRestrictedYaml2(readFileSync4(file), label);
+  const value = parseRestrictedYaml2(readFileSync5(file), label);
   const issues = registry.validate(kind, value, label);
   if (issues.length > 0) throw new VnextConfigError(issues);
   return { kind, ...id === void 0 ? {} : { id }, file, logicalPath, value };
 }
 function readTemplateProvenance(registry, root) {
-  const file = join5(root, ".kxm", "template-provenance.yaml");
-  if (!existsSync5(file)) return void 0;
+  const file = join6(root, ".kxm", "template-provenance.yaml");
+  if (!existsSync6(file)) return void 0;
   const label = ".kxm/template-provenance.yaml";
   const stat = lstatSync(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     fail2("path", "resource_not_file", label, "template provenance must be a regular file, not a link or directory");
   }
-  const configRoot = join5(root, ".kxm");
-  let parent = dirname3(file);
+  const configRoot = join6(root, ".kxm");
+  let parent = dirname4(file);
   while (parent !== root) {
     const parentStat = lstatSync(parent);
     if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
       fail2("path", "resource_parent_symlink", label, "template provenance parents must be regular directories");
     }
     if (parent === configRoot) break;
-    parent = dirname3(parent);
+    parent = dirname4(parent);
   }
-  const value = parseRestrictedYaml2(readFileSync4(file), label);
+  const value = parseRestrictedYaml2(readFileSync5(file), label);
   const issues = registry.validateTemplateProvenance(value, label);
   if (issues.length > 0) throw new VnextConfigError(issues);
   if (!resolveVnextTemplateBaseline(value)) {
@@ -22207,7 +22281,7 @@ function readTemplateProvenance(registry, root) {
 }
 function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const resources = /* @__PURE__ */ new Map();
-  if (!existsSync5(directory)) return resources;
+  if (!existsSync6(directory)) return resources;
   const stat = lstatSync(directory);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     fail2("path", "resource_directory_invalid", displayPath(root, directory), "resource directory must be a regular directory");
@@ -22216,27 +22290,27 @@ function listNamedResources(registry, root, directory, logicalDirectory, kind) {
   const entries = readdirSync(directory, { withFileTypes: true }).sort((left, right) => compareCodeUnits3(left.name, right.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join5(directory, entry.name)), "nested resource directories are not allowed"));
+      issues.push(issue2("path", "nested_resource_directory", displayPath(root, join6(directory, entry.name)), "nested resource directories are not allowed"));
       continue;
     }
     if (!entry.name.toLowerCase().endsWith(".yaml") && !entry.name.toLowerCase().endsWith(".yml")) continue;
     if (!entry.isFile() || extname(entry.name) !== ".yaml") {
-      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join5(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
+      issues.push(issue2("path", "resource_filename_invalid", displayPath(root, join6(directory, entry.name)), "resource must be a regular file with the exact .yaml extension"));
       continue;
     }
     const id = basename2(entry.name, ".yaml");
     if (kind === "model" && id === "inventory") continue;
     if (!resourceIdentifier(id)) {
-      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join5(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
+      issues.push(issue2("path", "resource_id_invalid", displayPath(root, join6(directory, entry.name)), `filename-derived identity ${id} is invalid or platform-reserved`));
       continue;
     }
     const collision = [...resources.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) {
-      issues.push(issue2("path", "resource_id_collision", displayPath(root, join5(directory, entry.name)), `${id} case-folds to existing ${collision}`));
+      issues.push(issue2("path", "resource_id_collision", displayPath(root, join6(directory, entry.name)), `${id} case-folds to existing ${collision}`));
       continue;
     }
     try {
-      const resource = readResource(registry, root, join5(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
+      const resource = readResource(registry, root, join6(directory, entry.name), `${logicalDirectory}/${id}.yaml`, kind, id);
       resources.set(id, resource);
     } catch (error) {
       if (error instanceof VnextConfigError) issues.push(...error.issues);
@@ -22557,8 +22631,8 @@ function validateWorkflow(workflow, agents, models, repositories, gates, issues)
       const writable = Object.values(objectValue(step.repositories) ?? {}).filter((access) => access === "write").length;
       if (maxWriteRepositories > writable) issues.push(issue2("semantic", "write_repository_bound_invalid", file, `${stepId} maxWriteRepositories exceeds writable repository scope`));
     }
-    const join49 = objectValue(step.join);
-    const minimumPassed = join49 && typeof join49.minimumPassed === "number" ? join49.minimumPassed : void 0;
+    const join50 = objectValue(step.join);
+    const minimumPassed = join50 && typeof join50.minimumPassed === "number" ? join50.minimumPassed : void 0;
     if (minimumPassed !== void 0 && minimumPassed > maximum) issues.push(issue2("semantic", "join_impossible", file, `${stepId} minimumPassed exceeds assignment maximum`));
     const distinctBy = names(assignment?.distinctBy);
     if (distinctBy.length > 0) {
@@ -22772,11 +22846,11 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (!workflows.has(defaultWorkflow)) issues.push(issue2("reference", "default_workflow_unknown", project.logicalPath, `default workflow ${defaultWorkflow} does not exist`));
   for (const workflow of workflows.values()) validateWorkflow(workflow, agents, models, repositoryIds, gates, issues);
   if (projectRoot) {
-    const writerRolePath = join5(projectRoot, ".kxm", "roles", "writer.yaml");
+    const writerRolePath = join6(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync5(writerRolePath) && implementerAgent) {
+    if (existsSync6(writerRolePath) && implementerAgent) {
       try {
-        const rawRole = parseRestrictedYaml2(readFileSync4(writerRolePath, "utf8"));
+        const rawRole = parseRestrictedYaml2(readFileSync5(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
         const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
         const enabledRosterModels = rosterEntries.filter((entry) => entry.enabled !== false).map((entry) => stringValue(entry.model)).filter((m2) => Boolean(m2));
@@ -22822,8 +22896,8 @@ function gitEnvironment() {
   return Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_")));
 }
 function discoverGitRoot(start = process.cwd()) {
-  let current = resolve2(start);
-  if (existsSync5(current) && !lstatSync(current).isDirectory()) current = dirname3(current);
+  let current = resolve3(start);
+  if (existsSync6(current) && !lstatSync(current).isDirectory()) current = dirname4(current);
   const result = spawnSync2("git", ["-C", current, "rev-parse", "--show-toplevel"], {
     encoding: "utf8",
     env: gitEnvironment(),
@@ -22831,12 +22905,12 @@ function discoverGitRoot(start = process.cwd()) {
     windowsHide: true
   });
   if (result.status !== 0 || result.error || !result.stdout.trim()) return void 0;
-  const root = resolve2(result.stdout.trim());
-  return existsSync5(root) && lstatSync(root).isDirectory() ? root : void 0;
+  const root = resolve3(result.stdout.trim());
+  return existsSync6(root) && lstatSync(root).isDirectory() ? root : void 0;
 }
 function discoverVnextProjectRoot(start = process.cwd()) {
   const gitRoot = discoverGitRoot(start);
-  return gitRoot && existsSync5(join5(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
+  return gitRoot && existsSync6(join6(gitRoot, ".kxm", "project.yaml")) ? gitRoot : void 0;
 }
 function assertNoRegisteredGates(options) {
   if ("registeredGates" in options) {
@@ -22845,7 +22919,7 @@ function assertNoRegisteredGates(options) {
 }
 function loadVnextProject(projectRoot, options = {}) {
   assertNoRegisteredGates(options);
-  const root = resolve2(projectRoot);
+  const root = resolve3(projectRoot);
   let migrationReceipt;
   if (legacyConfigFilesAt(root).length > 0 && options.allowUnreceiptedLegacyConfig !== true) {
     const receiptCheck = readVnextMigrationReceipt(root, options);
@@ -22853,7 +22927,7 @@ function loadVnextProject(projectRoot, options = {}) {
     migrationReceipt = receiptCheck.receipt;
   }
   const registry = new VnextSchemaRegistry(options.schemasDir);
-  const project = readResource(registry, root, join5(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
+  const project = readResource(registry, root, join6(root, ".kxm", "project.yaml"), ".kxm/project.yaml", "project");
   const earlyIssues = [];
   validatePortablePaths(project, earlyIssues);
   const templateProvenance = readTemplateProvenance(registry, root);
@@ -22875,16 +22949,16 @@ function loadVnextProject(projectRoot, options = {}) {
     }
   }
   if (earlyIssues.length > 0) throw new VnextConfigError(earlyIssues);
-  const agents = listNamedResources(registry, root, join5(root, ".kxm", "agents"), ".kxm/agents", "agent");
-  const models = listNamedResources(registry, root, join5(root, ".kxm", "models"), ".kxm/models", "model");
-  const workflows = listNamedResources(registry, root, join5(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
-  const gatePath = join5(root, ".kxm", "gates.yaml");
-  const gateRegistry = existsSync5(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
+  const agents = listNamedResources(registry, root, join6(root, ".kxm", "agents"), ".kxm/agents", "agent");
+  const models = listNamedResources(registry, root, join6(root, ".kxm", "models"), ".kxm/models", "model");
+  const workflows = listNamedResources(registry, root, join6(root, ".kxm", "workflows"), ".kxm/workflows", "workflow");
+  const gatePath = join6(root, ".kxm", "gates.yaml");
+  const gateRegistry = existsSync6(gatePath) ? readResource(registry, root, gatePath, ".kxm/gates.yaml", "gate-registry") : void 0;
   const environments = [];
   const repositories = /* @__PURE__ */ new Map();
   const loadIssues = [];
-  const projectEnvironment = join5(root, ".kxm", "project", "env.yaml");
-  if (existsSync5(projectEnvironment)) {
+  const projectEnvironment = join6(root, ".kxm", "project", "env.yaml");
+  if (existsSync6(projectEnvironment)) {
     try {
       environments.push(readResource(registry, root, projectEnvironment, ".kxm/project/env.yaml", "environment"));
     } catch (error) {
@@ -22902,7 +22976,7 @@ function loadVnextProject(projectRoot, options = {}) {
     if (!repositoryId) continue;
     const hasLocalBinding = Object.hasOwn(options.repositoryBindings ?? {}, repositoryId);
     const localBinding = options.repositoryBindings?.[repositoryId];
-    if (hasLocalBinding && (!localBinding || !isAbsolute(localBinding))) {
+    if (hasLocalBinding && (!localBinding || !isAbsolute2(localBinding))) {
       loadIssues.push(issue2("path", "repository_binding_not_absolute", ".kxm/project.yaml", `host-local binding for ${repositoryId} must be absolute`));
       continue;
     }
@@ -22921,12 +22995,12 @@ function loadVnextProject(projectRoot, options = {}) {
         continue;
       }
     }
-    const binding = hasLocalBinding && localBinding ? resolve2(localBinding) : role === "control" ? root : pathHint && portablePath(pathHint) ? resolve2(root, ...pathHint.split("/")) : void 0;
+    const binding = hasLocalBinding && localBinding ? resolve3(localBinding) : role === "control" ? root : pathHint && portablePath(pathHint) ? resolve3(root, ...pathHint.split("/")) : void 0;
     if (!binding) {
       if (required) loadIssues.push(issue2("discovery", "repository_binding_missing", ".kxm/project.yaml", `required repository ${repositoryId} has no portable pathHint or host-local binding`));
       continue;
     }
-    if (!existsSync5(binding)) {
+    if (!existsSync6(binding)) {
       if (required || hasLocalBinding) loadIssues.push(issue2("discovery", "repository_binding_unavailable", ".kxm/project.yaml", `${hasLocalBinding ? "explicit" : "required"} repository binding ${repositoryId} is unavailable`));
       continue;
     }
@@ -22949,9 +23023,9 @@ function loadVnextProject(projectRoot, options = {}) {
       continue;
     }
     seenBindings.set(foldedBinding, repositoryId);
-    const repositoryFile = join5(binding, ".kxm", "repo", "repo.yaml");
+    const repositoryFile = join6(binding, ".kxm", "repo", "repo.yaml");
     let definitionValidated = false;
-    if (existsSync5(repositoryFile)) {
+    if (existsSync6(repositoryFile)) {
       try {
         const resource = readResource(registry, root, repositoryFile, `.kxm/repositories/${repositoryId}/repo.yaml`, "repository", repositoryId, binding);
         if (resource.value.repositoryId !== repositoryId) {
@@ -22967,8 +23041,8 @@ function loadVnextProject(projectRoot, options = {}) {
     } else if (required || hasLocalBinding) {
       loadIssues.push(issue2("discovery", "repository_definition_missing", `.kxm/repositories/${repositoryId}/repo.yaml`, `${hasLocalBinding ? "explicit" : "required"} repository ${repositoryId} has no repo.yaml`));
     }
-    const environmentFile = join5(binding, ".kxm", "repo", "env.yaml");
-    if (existsSync5(environmentFile)) {
+    const environmentFile = join6(binding, ".kxm", "repo", "env.yaml");
+    if (existsSync6(environmentFile)) {
       if (!definitionValidated) {
         loadIssues.push(issue2("reference", "repository_environment_without_definition", `.kxm/repositories/${repositoryId}/env.yaml`, `repository ${repositoryId} environment requires a validated matching repo.yaml`));
       } else {
@@ -23036,7 +23110,7 @@ function verifyVnextMigrationReceiptTarget(root, receipt, resources, configRevis
 }
 function relativePortable(root, absolute) {
   const rel = relative(root, absolute);
-  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) return void 0;
+  if (!rel || isAbsolute2(rel) || rel === ".." || rel.startsWith(`..${sep}`)) return void 0;
   return rel.split(sep).join("/");
 }
 function legacyInputsAt(root) {
@@ -23046,21 +23120,21 @@ function legacyInputsAt(root) {
     ".kxm/config/workflows",
     ".kxm/state/kxm.db"
   ];
-  return candidates.filter((candidate) => existsSync5(join5(root, ...candidate.split("/"))));
+  return candidates.filter((candidate) => existsSync6(join6(root, ...candidate.split("/"))));
 }
 var VNEXT_MIGRATION_RECEIPT_PATH = ".kxm/migration-receipt.yaml";
 var LEGACY_CONFIG_FILES = [".kxm/config/agents.json", ".kxm/config/gates.json"];
 function legacyConfigFilesAt(root) {
   const files = [];
   for (const component of [".kxm", ".kxm/config"]) {
-    const absolute = join5(root, ...component.split("/"));
-    if (existsSync5(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
+    const absolute = join6(root, ...component.split("/"));
+    if (existsSync6(absolute) && lstatSync(absolute).isSymbolicLink()) return [component];
   }
   for (const candidate of LEGACY_CONFIG_FILES) {
-    if (existsSync5(join5(root, ...candidate.split("/")))) files.push(candidate);
+    if (existsSync6(join6(root, ...candidate.split("/")))) files.push(candidate);
   }
-  const workflowsDir = join5(root, ".kxm", "config", "workflows");
-  if (existsSync5(workflowsDir)) {
+  const workflowsDir = join6(root, ".kxm", "config", "workflows");
+  if (existsSync6(workflowsDir)) {
     const stat = lstatSync(workflowsDir);
     if (stat.isSymbolicLink()) {
       files.push(".kxm/config/workflows");
@@ -23075,9 +23149,9 @@ function legacyConfigFilesAt(root) {
   return files;
 }
 function hashFileRecord(root, relativePath) {
-  const absolute = join5(root, ...relativePath.split("/"));
-  if (!existsSync5(absolute)) return void 0;
-  const bytes = readFileSync4(absolute);
+  const absolute = join6(root, ...relativePath.split("/"));
+  if (!existsSync6(absolute)) return void 0;
+  const bytes = readFileSync5(absolute);
   return {
     path: relativePath,
     sha256: `sha256:${createHash6("sha256").update(bytes).digest("hex")}`,
@@ -23089,9 +23163,9 @@ function migrationReceiptSelfHash(receipt) {
   return `sha256:${createHash6("sha256").update(vnextCanonicalJson(unsigned), "utf8").digest("hex")}`;
 }
 function readVnextMigrationReceipt(root, options = {}) {
-  const receiptPath = join5(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  const receiptPath = join6(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
   const legacyFiles = legacyConfigFilesAt(root);
-  if (!existsSync5(receiptPath)) {
+  if (!existsSync6(receiptPath)) {
     return {
       issues: legacyFiles.map((file) => issue2("semantic", "legacy_vnext_conflict", file, "legacy and vNext configuration cannot coexist before an accepted migration receipt"))
     };
@@ -23102,7 +23176,7 @@ function readVnextMigrationReceipt(root, options = {}) {
   }
   let receipt;
   try {
-    receipt = parseRestrictedYaml2(readFileSync4(receiptPath), VNEXT_MIGRATION_RECEIPT_PATH);
+    receipt = parseRestrictedYaml2(readFileSync5(receiptPath), VNEXT_MIGRATION_RECEIPT_PATH);
   } catch (error) {
     if (error instanceof VnextConfigError) return { issues: [...error.issues] };
     throw error;
@@ -23135,14 +23209,14 @@ function readVnextMigrationReceipt(root, options = {}) {
   return issues.length > 0 ? { issues } : { receipt, issues: [] };
 }
 function discoverLegacyRoot(start) {
-  let initial = resolve2(start);
-  if (existsSync5(initial) && !lstatSync(initial).isDirectory()) initial = dirname3(initial);
+  let initial = resolve3(start);
+  if (existsSync6(initial) && !lstatSync(initial).isDirectory()) initial = dirname4(initial);
   const candidate = discoverGitRoot(initial) ?? initial;
   const inputs = legacyInputsAt(candidate);
   return inputs.length > 0 ? { root: candidate, inputs } : void 0;
 }
 function planVnextInitialization(start = process.cwd(), options = {}) {
-  const inspectedFrom = resolve2(start);
+  const inspectedFrom = resolve3(start);
   const projectRoot = discoverVnextProjectRoot(inspectedFrom);
   if (projectRoot) {
     try {
@@ -23163,7 +23237,7 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
   }
   const gitRoot = discoverGitRoot(inspectedFrom);
   const candidateRoot = gitRoot ?? inspectedFrom;
-  if (existsSync5(join5(candidateRoot, ".kxm"))) {
+  if (existsSync6(join6(candidateRoot, ".kxm"))) {
     return {
       mode: "repair",
       inspectedFrom,
@@ -23179,13 +23253,13 @@ function planVnextInitialization(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync11, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname7, isAbsolute as isAbsolute4, join as join11 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync12, lstatSync as lstatSync6, mkdirSync as mkdirSync8, readFileSync as readFileSync11, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname8, isAbsolute as isAbsolute5, join as join12 } from "node:path";
 
 // plugins/kxm/src/vnext-runtime-store.ts
 import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync8, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, realpathSync as realpathSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname6, join as join8, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync9, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync8, realpathSync as realpathSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join9, resolve as resolve6 } from "node:path";
 
 // plugins/kxm/src/vnext-bindings.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -23193,18 +23267,18 @@ import { createHash as createHash7, randomUUID as randomUUID3 } from "node:crypt
 import {
   chmodSync as chmodSync2,
   closeSync,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   fsyncSync,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   openSync,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   realpathSync as realpathSync2,
-  renameSync,
-  rmSync,
-  writeFileSync as writeFileSync3
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 
 // plugins/kxm/src/sqlite.ts
 import { createRequire } from "node:module";
@@ -23246,7 +23320,7 @@ var DatabaseSync = class {
 };
 
 // plugins/kxm/src/vnext-bindings.ts
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join6, parse, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join7, parse, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
 var MAX_BINDING_RECORD_BYTES = 256 * 1024;
 var BINDING_LABEL = "Runtime-local repository bindings";
 var activeLocks = /* @__PURE__ */ new WeakSet();
@@ -23257,7 +23331,7 @@ function bindingError(phase, code, message) {
   throw new VnextConfigError([bindingIssue(phase, code, message)]);
 }
 function canonicalHostPath2(path4) {
-  const absolute = resolve3(path4);
+  const absolute = resolve4(path4);
   try {
     return realpathSync2.native(absolute);
   } catch {
@@ -23272,21 +23346,21 @@ function sameHostPath2(left, right, platform = process.platform) {
 function vnextUserStateRoot(options = {}) {
   const env = options.env ?? process.env;
   const platform = options.platform ?? process.platform;
-  const home = options.homeDir ?? homedir2();
+  const home = options.homeDir ?? homedir3();
   const explicit = options.stateRoot ?? env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute2(explicit)) bindingError("path", "local_state_root_not_absolute", "KXM_STATE_HOME must be an absolute host-local path");
-    return resolve3(explicit);
+    if (!isAbsolute3(explicit)) bindingError("path", "local_state_root_not_absolute", "KXM_STATE_HOME must be an absolute host-local path");
+    return resolve4(explicit);
   }
   if (platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute2(localAppData) ? localAppData : join6(home, "AppData", "Local");
-    return resolve3(base2, "KXM");
+    const base2 = localAppData && isAbsolute3(localAppData) ? localAppData : join7(home, "AppData", "Local");
+    return resolve4(base2, "KXM");
   }
-  if (platform === "darwin") return resolve3(home, "Library", "Application Support", "KXM");
+  if (platform === "darwin") return resolve4(home, "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute2(xdgState) ? xdgState : join6(home, ".local", "state");
-  return resolve3(base, "kxm");
+  const base = xdgState && isAbsolute3(xdgState) ? xdgState : join7(home, ".local", "state");
+  return resolve4(base, "kxm");
 }
 function projectBindingKey(projectRoot, platform = process.platform) {
   const canonical2 = canonicalHostPath2(projectRoot);
@@ -23295,10 +23369,10 @@ function projectBindingKey(projectRoot, platform = process.platform) {
 }
 function vnextLocalBindingFile(projectRoot, options = {}) {
   const stateRoot = vnextUserStateRoot(options);
-  return join6(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
+  return join7(stateRoot, "projects", projectBindingKey(projectRoot, options.platform), "repository-bindings.json");
 }
 function checkedDirectory(path4, description) {
-  if (!existsSync6(path4)) return false;
+  if (!existsSync7(path4)) return false;
   const stat = lstatSync2(path4);
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     bindingError("path", "local_binding_directory_invalid", `${description} must be a regular directory, not a link or file`);
@@ -23306,8 +23380,8 @@ function checkedDirectory(path4, description) {
   return true;
 }
 function existingBindingDirectory(file, stateRoot) {
-  const projects = join6(stateRoot, "projects");
-  const project = dirname4(file);
+  const projects = join7(stateRoot, "projects");
+  const project = dirname5(file);
   if (!checkedDirectory(stateRoot, "local state root")) return false;
   if (!checkedDirectory(projects, "local projects directory")) return false;
   return checkedDirectory(project, "local project binding directory");
@@ -23330,10 +23404,10 @@ function asRecord2(value, file, projectRoot, schemasDir) {
   };
 }
 function readVnextLocalBindings(projectRoot, options = {}) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   const stateRoot = vnextUserStateRoot(options);
   const file = vnextLocalBindingFile(root, options);
-  if (!existingBindingDirectory(file, stateRoot) || !existsSync6(file)) return void 0;
+  if (!existingBindingDirectory(file, stateRoot) || !existsSync7(file)) return void 0;
   const stat = lstatSync2(file);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     bindingError("path", "local_binding_file_invalid", "binding record must be a regular file, not a link or directory");
@@ -23341,12 +23415,12 @@ function readVnextLocalBindings(projectRoot, options = {}) {
   if (stat.size > MAX_BINDING_RECORD_BYTES) {
     bindingError("parse", "local_binding_file_too_large", `binding record exceeds ${MAX_BINDING_RECORD_BYTES} bytes`);
   }
-  const parsed = parseRestrictedYaml2(readFileSync5(file), BINDING_LABEL);
+  const parsed = parseRestrictedYaml2(readFileSync6(file), BINDING_LABEL);
   return asRecord2(parsed, file, root, options.schemasDir);
 }
 function normalizedRecord(projectRoot, projectId, repositories, schemasDir) {
   const normalizedRepositories = Object.fromEntries(Object.entries(repositories).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([repositoryId, path4]) => {
-    if (!isAbsolute2(path4)) bindingError("path", "repository_binding_not_absolute", `host-local binding for ${repositoryId} must be absolute`);
+    if (!isAbsolute3(path4)) bindingError("path", "repository_binding_not_absolute", `host-local binding for ${repositoryId} must be absolute`);
     return [repositoryId, canonicalHostPath2(path4)];
   }));
   const value = {
@@ -23381,48 +23455,48 @@ function syncDirectory(path4) {
   }
 }
 function createDirectoryIfMissing(path4) {
-  if (existsSync6(path4)) return;
+  if (existsSync7(path4)) return;
   try {
-    mkdirSync3(path4, { mode: 448 });
-    syncDirectory(dirname4(path4));
+    mkdirSync4(path4, { mode: 448 });
+    syncDirectory(dirname5(path4));
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
   }
 }
 function ensureDurableDirectory(path4, description) {
   const missing = [];
-  let current = resolve3(path4);
-  while (!existsSync6(current)) {
+  let current = resolve4(path4);
+  while (!existsSync7(current)) {
     missing.push(current);
-    const parent = dirname4(current);
+    const parent = dirname5(current);
     if (parent === current) bindingError("path", "local_binding_directory_invalid", `${description} has no existing filesystem ancestor`);
     current = parent;
   }
   checkedDirectory(current, `${description} ancestor`);
   for (const directory of missing.reverse()) {
-    mkdirSync3(directory, { mode: 448 });
+    mkdirSync4(directory, { mode: 448 });
     checkedDirectory(directory, description);
-    syncDirectory(dirname4(directory));
+    syncDirectory(dirname5(directory));
   }
 }
 function ensureBindingDirectory(file, stateRoot) {
   ensureDurableDirectory(stateRoot, "local state root");
   checkedDirectory(stateRoot, "local state root");
   syncDirectory(stateRoot);
-  const projects = join6(stateRoot, "projects");
+  const projects = join7(stateRoot, "projects");
   createDirectoryIfMissing(projects);
   checkedDirectory(projects, "local projects directory");
-  const project = dirname4(file);
+  const project = dirname5(file);
   createDirectoryIfMissing(project);
   checkedDirectory(project, "local project binding directory");
 }
 function assertNoLinkedDirectoryComponents(path4, description) {
-  const absolute = resolve3(path4);
+  const absolute = resolve4(path4);
   const filesystemRoot = parse(absolute).root;
   let current = filesystemRoot;
   const remainder = relative2(filesystemRoot, absolute);
   for (const segment of remainder.split(sep2).filter(Boolean)) {
-    current = join6(current, segment);
+    current = join7(current, segment);
     const stat = lstatSync2(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", `${description} contains a linked or non-directory component`);
@@ -23443,28 +23517,28 @@ function projectOperationLockFile(projectRoot) {
   if (result.status !== 0 || result.error || !result.stdout.trim()) {
     bindingError("discovery", "project_operation_lock_unavailable", "cannot resolve the authoritative Git metadata path for project locking");
   }
-  const gitDirectory = resolve3(result.stdout.trim());
+  const gitDirectory = resolve4(result.stdout.trim());
   assertNoLinkedDirectoryComponents(gitDirectory, "authoritative Git metadata path");
   const gitStat = lstatSync2(gitDirectory);
   if (gitStat.isSymbolicLink() || !gitStat.isDirectory()) {
     bindingError("path", "project_operation_lock_parent_invalid", "authoritative Git metadata must resolve to a regular directory");
   }
-  const lockDirectory = join6(gitDirectory, "kxm");
-  if (existsSync6(lockDirectory)) {
+  const lockDirectory = join7(gitDirectory, "kxm");
+  if (existsSync7(lockDirectory)) {
     const stat = lstatSync2(lockDirectory);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       bindingError("path", "project_operation_lock_parent_invalid", "Git-local KXM lock directory must be regular, not a link or file");
     }
   } else {
-    mkdirSync3(lockDirectory, { mode: 448 });
+    mkdirSync4(lockDirectory, { mode: 448 });
     syncDirectory(gitDirectory);
   }
-  return join6(lockDirectory, "project-operation-lock.sqlite");
+  return join7(lockDirectory, "project-operation-lock.sqlite");
 }
 function withVnextLocalBindingLock(projectRoot, options, callback) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   const file = projectOperationLockFile(root);
-  if (existsSync6(file)) {
+  if (existsSync7(file)) {
     const stat = lstatSync2(file);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       bindingError("path", "local_binding_lock_invalid", "project-operation lock must be a regular file, not a link or directory");
@@ -23497,7 +23571,7 @@ function withVnextLocalBindingLock(projectRoot, options, callback) {
   }
 }
 function planVnextLocalBindings(projectRoot, projectId, repositories, options = {}) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   const file = vnextLocalBindingFile(root, options);
   const record = normalizedRecord(root, projectId, repositories, options.schemasDir);
   const existing = readVnextLocalBindings(root, options);
@@ -23507,7 +23581,7 @@ function planVnextLocalBindings(projectRoot, projectId, repositories, options =
   return { file, written: !existing || !recordsEqual(existing, record), record };
 }
 function writeVnextLocalBindings(projectRoot, projectId, repositories, options = {}, lock) {
-  const root = resolve3(projectRoot);
+  const root = resolve4(projectRoot);
   if (!lock) {
     return withVnextLocalBindingLock(root, options, (acquired) => writeVnextLocalBindings(root, projectId, repositories, options, acquired));
   }
@@ -23518,20 +23592,20 @@ function writeVnextLocalBindings(projectRoot, projectId, repositories, options =
   const { file, record } = planned;
   if (!planned.written) return planned;
   ensureBindingDirectory(file, vnextUserStateRoot(options));
-  const temporary = join6(dirname4(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
+  const temporary = join7(dirname5(file), `.repository-bindings-${process.pid}-${randomUUID3()}.tmp`);
   let descriptor;
   try {
     descriptor = openSync(temporary, "wx", 384);
-    writeFileSync3(descriptor, `${JSON.stringify(record, null, 2)}
+    writeFileSync4(descriptor, `${JSON.stringify(record, null, 2)}
 `, "utf8");
     fsyncSync(descriptor);
     closeSync(descriptor);
     descriptor = void 0;
-    renameSync(temporary, file);
-    syncDirectory(dirname4(file));
+    renameSync2(temporary, file);
+    syncDirectory(dirname5(file));
   } finally {
     if (descriptor !== void 0) closeSync(descriptor);
-    rmSync(temporary, { force: true });
+    rmSync2(temporary, { force: true });
   }
   const verified = readVnextLocalBindings(root, options);
   if (!verified || !recordsEqual(verified, record)) {
@@ -23545,22 +23619,22 @@ import { createHash as createHash8, randomBytes } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   copyFileSync,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { basename as basename3, dirname as dirname5, join as join7, resolve as resolve4 } from "node:path";
+import { basename as basename3, dirname as dirname6, join as join8, resolve as resolve5 } from "node:path";
 function databaseError(code, file, message) {
   const issue3 = { phase: "semantic", code, file, message };
   return new VnextConfigError([issue3]);
 }
 function checkedParent(path4, description) {
-  const parent = dirname5(path4);
-  if (!existsSync7(parent)) mkdirSync4(parent, { recursive: true, mode: 448 });
+  const parent = dirname6(path4);
+  if (!existsSync8(parent)) mkdirSync5(parent, { recursive: true, mode: 448 });
   const stat = lstatSync3(parent, { throwIfNoEntry: false });
   if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
     throw databaseError("runtime_path_invalid", description, `${description} parent must be a regular directory, not a link`);
@@ -23702,18 +23776,18 @@ function checkIntegrity(database) {
   return rows.length === 1 && rows[0]?.integrity_check === "ok";
 }
 function fileSha256(filePath) {
-  const bytes = readFileSync6(filePath);
+  const bytes = readFileSync7(filePath);
   return `sha256:${createHash8("sha256").update(bytes).digest("hex")}`;
 }
 function backupDatabaseFile(sourcePath, targetPath, storeId) {
-  const resolvedSource = resolve4(sourcePath);
-  const resolvedTarget = resolve4(targetPath);
+  const resolvedSource = resolve5(sourcePath);
+  const resolvedTarget = resolve5(targetPath);
   const sourceStat = lstatSync3(resolvedSource, { throwIfNoEntry: false });
   if (!sourceStat || !sourceStat.isFile() || sourceStat.isSymbolicLink()) {
     throw databaseError("runtime_path_invalid", resolvedSource, `source database ${resolvedSource} must be a regular file, not a link or directory`);
   }
   checkedParent(resolvedTarget, "backup target");
-  if (existsSync7(resolvedTarget)) {
+  if (existsSync8(resolvedTarget)) {
     unlinkSync2(resolvedTarget);
   }
   const sourceDb = new DatabaseSync(resolvedSource);
@@ -23757,8 +23831,8 @@ function backupDatabaseFile(sourcePath, targetPath, storeId) {
   };
 }
 function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVersion, maxSupportedVersion) {
-  const resolvedBackup = resolve4(backupPath);
-  const resolvedTarget = resolve4(targetPath);
+  const resolvedBackup = resolve5(backupPath);
+  const resolvedTarget = resolve5(targetPath);
   const backupStat = lstatSync3(resolvedBackup, { throwIfNoEntry: false });
   if (!backupStat || !backupStat.isFile() || backupStat.isSymbolicLink()) {
     throw databaseError("runtime_path_invalid", resolvedBackup, `backup database ${resolvedBackup} must be a regular file, not a link or directory`);
@@ -23791,7 +23865,7 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   }
   checkedParent(resolvedTarget, "restore target");
   for (const file of [resolvedTarget, `${resolvedTarget}-wal`, `${resolvedTarget}-shm`]) {
-    if (existsSync7(file)) {
+    if (existsSync8(file)) {
       try {
         unlinkSync2(file);
       } catch {
@@ -23821,29 +23895,29 @@ function restoreDatabaseFile(backupPath, targetPath, storeId, expectedSchemaVers
   };
 }
 function discoverProjectStores(projectRoot, options = {}) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   const stores = [];
-  const hubPath = options.hubDataPath ? resolve4(options.hubDataPath) : join7(root, ".kxm", "state", "kxm.db");
-  if (existsSync7(hubPath)) {
+  const hubPath = options.hubDataPath ? resolve5(options.hubDataPath) : join8(root, ".kxm", "state", "kxm.db");
+  if (existsSync8(hubPath)) {
     stores.push({ storeId: "hub-store", sourcePath: hubPath, maxSupportedVersion: 3 });
   }
-  const registryPath = join7(root, ".kxm", "runtime", "registry.db");
-  if (existsSync7(registryPath)) {
+  const registryPath = join8(root, ".kxm", "runtime", "registry.db");
+  if (existsSync8(registryPath)) {
     stores.push({ storeId: "registry", sourcePath: registryPath, maxSupportedVersion: 1 });
   }
-  const bindingsPath = join7(root, ".kxm", "runtime", "bindings.db");
-  if (existsSync7(bindingsPath)) {
+  const bindingsPath = join8(root, ".kxm", "runtime", "bindings.db");
+  if (existsSync8(bindingsPath)) {
     stores.push({ storeId: "binding-store", sourcePath: bindingsPath, maxSupportedVersion: 1 });
   }
-  const eventsDir = join7(root, ".kxm", "runtime", "events");
-  if (existsSync7(eventsDir)) {
+  const eventsDir = join8(root, ".kxm", "runtime", "events");
+  if (existsSync8(eventsDir)) {
     const entries = readdirSync2(eventsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".db")) {
         const key = entry.name.replace(/\.db$/, "");
         stores.push({
           storeId: `events:${key}`,
-          sourcePath: join7(eventsDir, entry.name),
+          sourcePath: join8(eventsDir, entry.name),
           maxSupportedVersion: 3
         });
       }
@@ -23852,7 +23926,7 @@ function discoverProjectStores(projectRoot, options = {}) {
   return stores;
 }
 function createBackup(options = {}) {
-  const projectRoot = options.projectRoot ? resolve4(options.projectRoot) : process.cwd();
+  const projectRoot = options.projectRoot ? resolve5(options.projectRoot) : process.cwd();
   const stores = discoverProjectStores(projectRoot, {
     ...options.hubDataPath !== void 0 ? { hubDataPath: options.hubDataPath } : {}
   });
@@ -23862,9 +23936,9 @@ function createBackup(options = {}) {
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-");
   const backupId = `bk_${randomBytes(8).toString("hex")}`;
-  const outDir = options.outDir ? resolve4(options.outDir) : join7(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
-  if (!existsSync7(outDir)) {
-    mkdirSync4(outDir, { recursive: true, mode: 448 });
+  const outDir = options.outDir ? resolve5(options.outDir) : join8(projectRoot, ".kxm", "backups", `backup-${timestamp}`);
+  if (!existsSync8(outDir)) {
+    mkdirSync5(outDir, { recursive: true, mode: 448 });
   }
   const backedUpStores = [];
   const usedFilenames = /* @__PURE__ */ new Set();
@@ -23875,7 +23949,7 @@ function createBackup(options = {}) {
       filename = `${sanitizedId}-${filename}`;
     }
     usedFilenames.add(filename);
-    const targetFile2 = join7(outDir, filename);
+    const targetFile2 = join8(outDir, filename);
     const record = backupDatabaseFile(store.sourcePath, targetFile2, store.storeId);
     backedUpStores.push(record);
   }
@@ -23890,24 +23964,24 @@ function createBackup(options = {}) {
   const manifestSha256 = `sha256:${createHash8("sha256").update(manifestJson, "utf8").digest("hex")}`;
   manifest.manifestSha256 = manifestSha256;
   const finalJson = JSON.stringify(manifest, null, 2) + "\n";
-  const manifestPath = join7(outDir, "manifest.json");
-  writeFileSync4(manifestPath, finalJson, "utf8");
+  const manifestPath = join8(outDir, "manifest.json");
+  writeFileSync5(manifestPath, finalJson, "utf8");
   return { manifest, outDir };
 }
 function restoreBackup(manifestPathOrDir, options = {}) {
-  let manifestPath = resolve4(manifestPathOrDir);
+  let manifestPath = resolve5(manifestPathOrDir);
   const stat = lstatSync3(manifestPath, { throwIfNoEntry: false });
   if (!stat) {
     throw databaseError("runtime_path_invalid", manifestPath, `manifest path ${manifestPath} does not exist`);
   }
   if (stat.isDirectory()) {
-    manifestPath = join7(manifestPath, "manifest.json");
+    manifestPath = join8(manifestPath, "manifest.json");
   }
-  if (!existsSync7(manifestPath)) {
+  if (!existsSync8(manifestPath)) {
     throw databaseError("runtime_path_invalid", manifestPath, `backup manifest ${manifestPath} not found`);
   }
-  const manifestDir = dirname5(manifestPath);
-  const rawText = readFileSync6(manifestPath, "utf8");
+  const manifestDir = dirname6(manifestPath);
+  const rawText = readFileSync7(manifestPath, "utf8");
   let manifest;
   try {
     manifest = JSON.parse(rawText);
@@ -23919,8 +23993,8 @@ function restoreBackup(manifestPathOrDir, options = {}) {
   }
   const restoredStores = [];
   for (const store of manifest.stores) {
-    const backupFilePath = join7(manifestDir, store.backupFile);
-    if (!existsSync7(backupFilePath)) {
+    const backupFilePath = join8(manifestDir, store.backupFile);
+    if (!existsSync8(backupFilePath)) {
       throw databaseError("restore_file_missing", backupFilePath, `backup file ${store.backupFile} missing from ${manifestDir}`);
     }
     const actualSha256 = fileSha256(backupFilePath);
@@ -23938,7 +24012,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
       const rel = targetPath.slice(manifest.projectRoot.length).replace(/^[\\/]+/, "");
-      targetPath = join7(resolve4(options.projectRoot), rel);
+      targetPath = join8(resolve5(options.projectRoot), rel);
     }
     const result = restoreDatabaseFile(
       backupFilePath,
@@ -23958,13 +24032,13 @@ function restoreBackup(manifestPathOrDir, options = {}) {
 
 // plugins/kxm/src/vnext-runtime-store.ts
 function vnextRuntimePaths(options = {}) {
-  const stateRoot = options.stateRoot ? resolve5(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
-  const runtimeDir = join8(stateRoot, "runtime");
+  const stateRoot = options.stateRoot ? resolve6(options.stateRoot) : vnextUserStateRoot({ ...options.env ? { env: options.env } : {}, ...options.homeDir ? { homeDir: options.homeDir } : {} });
+  const runtimeDir = join9(stateRoot, "runtime");
   return {
     stateRoot,
     runtimeDir,
-    registryDb: join8(runtimeDir, "registry.db"),
-    projectsDir: join8(runtimeDir, "projects")
+    registryDb: join9(runtimeDir, "registry.db"),
+    projectsDir: join9(runtimeDir, "projects")
   };
 }
 function runtimeIssue(phase, code, file, message) {
@@ -23976,9 +24050,9 @@ function runtimeError(code, file, message) {
 function projectRuntimeKey(projectRoot) {
   let canonical2;
   try {
-    canonical2 = realpathSync3.native(resolve5(projectRoot));
+    canonical2 = realpathSync3.native(resolve6(projectRoot));
   } catch {
-    canonical2 = resolve5(projectRoot);
+    canonical2 = resolve6(projectRoot);
   }
   const folded = process.platform === "win32" ? canonical2.toLocaleLowerCase("en-US") : canonical2;
   return createHash9("sha256").update(folded, "utf8").digest("hex").slice(0, 24);
@@ -24012,7 +24086,7 @@ var VnextRuntimeRegistry = class {
   path;
   database;
   constructor(path4) {
-    this.path = resolve5(path4);
+    this.path = resolve6(path4);
     this.database = openDatabase(this.path, "runtime registry", {
       schema: REGISTRY_SCHEMA,
       version: VNEXT_REGISTRY_SCHEMA_VERSION,
@@ -24102,7 +24176,7 @@ var VnextRuntimeRegistry = class {
   }
   /** Register or revalidate a project's home binding. Home Runtime is immutable. */
   registerProject(registration) {
-    const projectRoot = resolve5(registration.projectRoot);
+    const projectRoot = resolve6(registration.projectRoot);
     const projectKey = projectRuntimeKey(projectRoot);
     this.database.exec("BEGIN IMMEDIATE");
     try {
@@ -24323,7 +24397,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
   const maxAttempts = compileCountField(step.maxAttempts, 1, `${id}.maxAttempts`, id, sink);
   const timeoutMs = compileOptionalDuration(step.timeoutMs, `${id}.timeoutMs`, id, sink);
   const assignments = compileAssignments(step, id, agent, sink);
-  const join49 = compileJoin(step, id, sink);
+  const join50 = compileJoin(step, id, sink);
   const requiredEvidence = compileEvidence(step, id, sink);
   const transitions = compileTransitions(step, id, index, stepIndex, sink);
   const outcomes = Object.keys(transitions).sort(compareCodeUnits4);
@@ -24351,7 +24425,7 @@ function compileStep(step, index, stepIndex, requirePlanHash, sink) {
     transitions: orderedTransitions,
     requiresPlanHash: requirePlanHash.includes(id),
     assignments,
-    join: join49
+    join: join50
   };
   if (kind === "agent" || kind === "moa") {
     if (!agent) return void 0;
@@ -24401,15 +24475,15 @@ function compileAssignments(step, stepId, primaryAgentId, sink) {
   };
 }
 function compileJoin(step, stepId, sink) {
-  const join49 = objectValue2(step.join);
-  if (!join49) return { strategy: "all" };
-  const declared = stringValue2(join49.strategy);
+  const join50 = objectValue2(step.join);
+  if (!join50) return { strategy: "all" };
+  const declared = stringValue2(join50.strategy);
   const strategy = declared && JOIN_STRATEGIES.has(declared) ? declared : "all";
-  const minimumPassed = compileOptionalCount(join49.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
+  const minimumPassed = compileOptionalCount(join50.minimumPassed, `${stepId}.join.minimumPassed`, stepId, sink);
   const compiled = {
     strategy,
     ...minimumPassed !== void 0 ? { minimumPassed } : {},
-    ...typeof join49.cancelRemaining === "boolean" ? { cancelRemaining: join49.cancelRemaining } : {}
+    ...typeof join50.cancelRemaining === "boolean" ? { cancelRemaining: join50.cancelRemaining } : {}
   };
   return compiled;
 }
@@ -24689,8 +24763,8 @@ var RECORD_LIMIT = 16 * 1024 * 1024;
 // plugins/kxm/src/prices.ts
 var import_yaml3 = __toESM(require_dist(), 1);
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync8, statSync } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, statSync } from "node:fs";
+import { join as join10 } from "node:path";
 
 // plugins/kxm/src/price-calc.ts
 var PRICES_SCHEMA = "kxm.prices.v1";
@@ -24842,11 +24916,11 @@ function parsePriceCatalog(text) {
   return catalog;
 }
 function loadPriceCatalog(rootOrPath) {
-  const candidatePath = existsSync9(join9(rootOrPath, ".kxm", "prices.yaml")) ? join9(rootOrPath, ".kxm", "prices.yaml") : existsSync9(join9(rootOrPath, "prices.yaml")) ? join9(rootOrPath, "prices.yaml") : existsSync9(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
-  if (!candidatePath || !existsSync9(candidatePath)) {
+  const candidatePath = existsSync10(join10(rootOrPath, ".kxm", "prices.yaml")) ? join10(rootOrPath, ".kxm", "prices.yaml") : existsSync10(join10(rootOrPath, "prices.yaml")) ? join10(rootOrPath, "prices.yaml") : existsSync10(rootOrPath) && statSync(rootOrPath).isFile() ? rootOrPath : void 0;
+  if (!candidatePath || !existsSync10(candidatePath)) {
     return void 0;
   }
-  const content = readFileSync8(candidatePath, "utf8");
+  const content = readFileSync9(candidatePath, "utf8");
   return parsePriceCatalog(content);
 }
 function loadPriceCatalogForEstimate(options) {
@@ -24867,13 +24941,13 @@ var import_yaml5 = __toESM(require_dist(), 1);
 
 // plugins/kxm/src/producers.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { existsSync as existsSync10, readFileSync as readFileSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6, readdirSync as readdirSync3 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readdirSync as readdirSync3 } from "node:fs";
+import { join as join11 } from "node:path";
 var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
 function loadProducerPolicy(root) {
-  const path4 = join10(root, ".kxm", "producers.yaml");
-  if (!existsSync10(path4)) return empty();
-  const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
+  const path4 = join11(root, ".kxm", "producers.yaml");
+  if (!existsSync11(path4)) return empty();
+  const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
   if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
   return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x2) => typeof x2 === "string"), demoted: value.demoted.filter((x2) => typeof x2 === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x2) => typeof x2 === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
 }
@@ -24883,8 +24957,8 @@ function updateProducer(root, model, status) {
   policy.demoted = policy.demoted.filter((x2) => x2 !== model);
   policy[status].push(model);
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join10(root, ".kxm"), { recursive: true });
-  writeFileSync6(join10(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync7(join11(root, ".kxm"), { recursive: true });
+  writeFileSync7(join11(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function setModelState(root, model, state, role, removeRole2 = false) {
@@ -24894,10 +24968,10 @@ function setModelState(root, model, state, role, removeRole2 = false) {
   policy[state].push(model);
   if (role) {
     if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
-    const rolePath = join10(root, ".kxm", "roles", `${role}.yaml`);
+    const rolePath = join11(root, ".kxm", "roles", `${role}.yaml`);
     let roleFile = {};
-    if (existsSync10(rolePath)) {
-      const parsed = (0, import_yaml4.parse)(readFileSync9(rolePath, "utf8"));
+    if (existsSync11(rolePath)) {
+      const parsed = (0, import_yaml4.parse)(readFileSync10(rolePath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed;
     }
     const roster = Array.isArray(roleFile.roster) ? roleFile.roster.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
@@ -24908,42 +24982,42 @@ function setModelState(root, model, state, role, removeRole2 = false) {
     roleFile.schema ??= "kxm.role.v1";
     roleFile.id ??= role;
     roleFile.roster = roster;
-    mkdirSync6(join10(root, ".kxm", "roles"), { recursive: true });
-    writeFileSync6(rolePath, (0, import_yaml4.stringify)(roleFile), "utf8");
+    mkdirSync7(join11(root, ".kxm", "roles"), { recursive: true });
+    writeFileSync7(rolePath, (0, import_yaml4.stringify)(roleFile), "utf8");
   }
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync6(join10(root, ".kxm"), { recursive: true });
-  writeFileSync6(join10(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  mkdirSync7(join11(root, ".kxm"), { recursive: true });
+  writeFileSync7(join11(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function listRoleBindings(root) {
-  const dir = join10(root, ".kxm", "roles");
+  const dir = join11(root, ".kxm", "roles");
   const result = {};
-  if (!existsSync10(dir)) return result;
+  if (!existsSync11(dir)) return result;
   for (const file of readdirSync3(dir).filter((name) => name.endsWith(".yaml"))) {
     const role = file.slice(0, -5);
-    const value = (0, import_yaml4.parse)(readFileSync9(join10(dir, file), "utf8"));
+    const value = (0, import_yaml4.parse)(readFileSync10(join11(dir, file), "utf8"));
     result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model) => typeof model === "string");
   }
   return result;
 }
 function listInventoryModels(root) {
-  const path4 = join10(root, ".kxm", "models", "inventory.yaml");
-  if (!existsSync10(path4)) return [];
-  const value = (0, import_yaml4.parse)(readFileSync9(path4, "utf8"));
+  const path4 = join11(root, ".kxm", "models", "inventory.yaml");
+  if (!existsSync11(path4)) return [];
+  const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
   return (value.models ?? []).map((m2) => m2.id).filter((id) => typeof id === "string");
 }
 
 // plugins/kxm/src/artifacts-exist.ts
 import { lstatSync as lstatSync5, realpathSync as realpathSync4, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve7 } from "node:path";
 function staysUnder(root, candidate) {
   const child = relative3(root, candidate);
-  return child === "" || !isAbsolute3(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  return child === "" || !isAbsolute4(child) && child !== ".." && !child.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 function verifyArtifactExists(rootInput, pathInput) {
-  const lexicalRoot = resolve6(rootInput);
-  const lexicalPath = resolve6(pathInput);
+  const lexicalRoot = resolve7(rootInput);
+  const lexicalPath = resolve7(pathInput);
   if (!staysUnder(lexicalRoot, lexicalPath)) {
     return { ok: false, error: "artifact_outside_workspace_assets", path: lexicalPath };
   }
@@ -25563,7 +25637,7 @@ function formatRoutingReport(report2, options = {}) {
 
 // plugins/kxm/src/vnext-runtime-supervisor.ts
 function vnextSupervisorTokenFile(paths) {
-  return join11(paths.runtimeDir, "supervisor.token");
+  return join12(paths.runtimeDir, "supervisor.token");
 }
 function readVnextSupervisorToken(paths) {
   const file = vnextSupervisorTokenFile(paths);
@@ -25572,7 +25646,7 @@ function readVnextSupervisorToken(paths) {
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw runtimeError("runtime_path_invalid", file, "supervisor token file must be a regular file, not a link");
   }
-  const token = readFileSync10(file, "utf8").trim();
+  const token = readFileSync11(file, "utf8").trim();
   return token.length >= 32 ? token : void 0;
 }
 function processAlive(pid) {
@@ -25586,11 +25660,11 @@ function processAlive(pid) {
 var HEARTBEAT_STALE_MS = 15e3;
 var SUPERVISOR_ERROR_MAX_AGE_MS = 3e4;
 function supervisorErrorFile(paths) {
-  return join11(paths.runtimeDir, "supervisor.error");
+  return join12(paths.runtimeDir, "supervisor.error");
 }
 function clearSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
-  if (existsSync11(file)) rmSync2(file, { force: true });
+  if (existsSync12(file)) rmSync3(file, { force: true });
 }
 function readRecentSupervisorError(paths) {
   const file = supervisorErrorFile(paths);
@@ -25599,13 +25673,13 @@ function readRecentSupervisorError(paths) {
   const ageMs = Date.now() - stat.mtimeMs;
   if (ageMs > SUPERVISOR_ERROR_MAX_AGE_MS) return void 0;
   try {
-    return readFileSync10(file, "utf8").trim();
+    return readFileSync11(file, "utf8").trim();
   } catch {
     return void 0;
   }
 }
 function vnextSupervisorStatus(paths) {
-  if (!existsSync11(paths.registryDb)) return { running: false };
+  if (!existsSync12(paths.registryDb)) return { running: false };
   const registry = new VnextRuntimeRegistry(paths.registryDb);
   try {
     const record = registry.supervisor();
@@ -25666,7 +25740,7 @@ async function ensureVnextSupervisor(options = {}) {
     throw runtimeError("runtime_supervisor_unreachable", paths.registryDb, `runtime supervisor pid ${status.pid} is registered as running but cannot be probed`);
   }
   clearSupervisorError(paths);
-  const scriptPath = join11(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
+  const scriptPath = join12(findKxmRepoRoot(import.meta.url), "scripts", "kxm-runtime-supervisor.mjs");
   const spawnImpl = options.spawnImpl ?? ((script, env) => {
     const child = spawn2(process.execPath, [script], {
       detached: true,
@@ -25719,7 +25793,7 @@ async function vnextRuntimeRequest(handle, method, path4, body) {
 
 // plugins/kxm/src/cli/types.ts
 import { spawn as spawn3 } from "node:child_process";
-import { join as join14, resolve as resolve8 } from "node:path";
+import { join as join15, resolve as resolve9 } from "node:path";
 
 // plugins/kxm/src/redact.ts
 var SECRET_PATTERNS = [
@@ -25749,8 +25823,8 @@ function redactStringList(values, maxItems = 32) {
 }
 
 // plugins/kxm/src/telemetry.ts
-import { appendFileSync, mkdirSync as mkdirSync8, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname8, join as join12 } from "node:path";
+import { appendFileSync, mkdirSync as mkdirSync9, readFileSync as readFileSync12 } from "node:fs";
+import { dirname as dirname9, join as join13 } from "node:path";
 var TELEMETRY_SCHEMA = "kxm.telemetry.v1";
 function inferImprovementTarget(input) {
   const explicit = input.env?.KXM_IMPROVE_TARGET?.trim();
@@ -25760,12 +25834,12 @@ function inferImprovementTarget(input) {
   return project || workflowId ? "project" : "cli";
 }
 function appendTelemetry(path4, event) {
-  mkdirSync8(dirname8(path4), { recursive: true });
+  mkdirSync9(dirname9(path4), { recursive: true });
   appendFileSync(path4, `${JSON.stringify(event)}
 `, { encoding: "utf8", mode: 384 });
 }
 function telemetryPath(logsDir) {
-  return join12(logsDir, "telemetry.jsonl");
+  return join13(logsDir, "telemetry.jsonl");
 }
 function makeTelemetryEvent(input) {
   return {
@@ -25780,7 +25854,7 @@ function makeTelemetryEvent(input) {
 function readRoutingRecords(path4) {
   const records = [];
   try {
-    const raw = readFileSync11(path4, "utf8");
+    const raw = readFileSync12(path4, "utf8");
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim()) continue;
       try {
@@ -25857,9 +25931,9 @@ function workerResult(worker, payload) {
 }
 
 // plugins/kxm/src/hub-binding.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join13, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join14, resolve as resolve8 } from "node:path";
 var HUB_BINDING_SCHEMA = "kxm.hub-binding.v1";
 var HUB_HEALTH_PROBE_MS = 300;
 var HubBindingError = class extends Error {
@@ -25868,24 +25942,24 @@ var HubBindingError = class extends Error {
     this.name = "HubBindingError";
   }
 };
-function resolveUserStateRoot(env) {
+function resolveUserStateRoot2(env) {
   const explicit = env.KXM_STATE_HOME?.trim();
   if (explicit) {
-    if (!isAbsolute5(explicit)) throw new HubBindingError("local_state_root_not_absolute");
-    return resolve7(explicit);
+    if (!isAbsolute6(explicit)) throw new HubBindingError("local_state_root_not_absolute");
+    return resolve8(explicit);
   }
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    const base2 = localAppData && isAbsolute5(localAppData) ? localAppData : join13(homedir3(), "AppData", "Local");
-    return resolve7(base2, "KXM");
+    const base2 = localAppData && isAbsolute6(localAppData) ? localAppData : join14(homedir4(), "AppData", "Local");
+    return resolve8(base2, "KXM");
   }
-  if (process.platform === "darwin") return resolve7(homedir3(), "Library", "Application Support", "KXM");
+  if (process.platform === "darwin") return resolve8(homedir4(), "Library", "Application Support", "KXM");
   const xdgState = env.XDG_STATE_HOME?.trim();
-  const base = xdgState && isAbsolute5(xdgState) ? xdgState : join13(homedir3(), ".local", "state");
-  return resolve7(base, "kxm");
+  const base = xdgState && isAbsolute6(xdgState) ? xdgState : join14(homedir4(), ".local", "state");
+  return resolve8(base, "kxm");
 }
 function hubBindingFile(env = process.env) {
-  return join13(resolveUserStateRoot(env), "hub-binding.json");
+  return join14(resolveUserStateRoot2(env), "hub-binding.json");
 }
 function validateHubUrl(raw) {
   let parsed;
@@ -25910,10 +25984,10 @@ function isAbortError(error) {
 }
 function readHubBinding(env = process.env) {
   const file = hubBindingFile(env);
-  if (!existsSync12(file)) return void 0;
+  if (!existsSync13(file)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(file, "utf8"));
+    parsed = JSON.parse(readFileSync13(file, "utf8"));
   } catch {
     throw new HubBindingError(`malformed hub binding at ${file}`);
   }
@@ -25935,21 +26009,21 @@ function readHubBinding(env = process.env) {
 }
 function writeHubBinding(record, env = process.env) {
   const file = hubBindingFile(env);
-  mkdirSync9(dirname9(file), { recursive: true, mode: 448 });
-  const temporary = join13(dirname9(file), `.hub-binding-${process.pid}.tmp`);
+  mkdirSync10(dirname10(file), { recursive: true, mode: 448 });
+  const temporary = join14(dirname10(file), `.hub-binding-${process.pid}.tmp`);
   try {
-    writeFileSync8(temporary, `${JSON.stringify(record, null, 2)}
+    writeFileSync9(temporary, `${JSON.stringify(record, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-    renameSync3(temporary, file);
+    renameSync4(temporary, file);
   } finally {
-    rmSync3(temporary, { force: true });
+    rmSync4(temporary, { force: true });
   }
   return file;
 }
 function removeHubBinding(env = process.env) {
   const file = hubBindingFile(env);
   try {
-    rmSync3(file);
+    rmSync4(file);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -25983,7 +26057,7 @@ async function probeHubHealth(url, fetchImpl, timeoutMs = HUB_HEALTH_PROBE_MS) {
 // plugins/kxm/src/cli/types.ts
 function spawnScript(scriptName, extraEnv = {}) {
   return new Promise((resolveExit) => {
-    const child = spawn3(process.execPath, [join14(findKxmRepoRoot(import.meta.url), "scripts", scriptName)], {
+    const child = spawn3(process.execPath, [join15(findKxmRepoRoot(import.meta.url), "scripts", scriptName)], {
       stdio: "inherit",
       env: { ...process.env, ...extraEnv }
     });
@@ -26067,16 +26141,16 @@ function redactCliValue(value, field = "") {
   return value;
 }
 function workspaceDirs(cwd, workspaceFlag, env) {
-  const workdir = resolve8(env.KXM_WORKDIR?.trim() || cwd);
-  const workspace = resolve8(workdir, workspaceFlag || env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
+  const workdir = resolve9(env.KXM_WORKDIR?.trim() || cwd);
+  const workspace = resolve9(workdir, workspaceFlag || env.KXM_WORKSPACE_DIR?.trim() || ".kxm");
   const derive = workspaceFlag !== void 0;
   return {
     workdir,
     workspace,
-    config: derive ? join14(workspace, "config") : resolve8(workdir, env.KXM_CONFIG_DIR?.trim() || join14(workspace, "config")),
-    logs: derive ? join14(workspace, "logs") : resolve8(workdir, env.KXM_LOGS_DIR?.trim() || join14(workspace, "logs")),
-    assets: derive ? join14(workspace, "assets") : resolve8(workdir, env.KXM_ASSETS_DIR?.trim() || join14(workspace, "assets")),
-    state: derive ? join14(workspace, "state") : resolve8(workdir, env.KXM_STATE_DIR?.trim() || join14(workspace, "state"))
+    config: derive ? join15(workspace, "config") : resolve9(workdir, env.KXM_CONFIG_DIR?.trim() || join15(workspace, "config")),
+    logs: derive ? join15(workspace, "logs") : resolve9(workdir, env.KXM_LOGS_DIR?.trim() || join15(workspace, "logs")),
+    assets: derive ? join15(workspace, "assets") : resolve9(workdir, env.KXM_ASSETS_DIR?.trim() || join15(workspace, "assets")),
+    state: derive ? join15(workspace, "state") : resolve9(workdir, env.KXM_STATE_DIR?.trim() || join15(workspace, "state"))
   };
 }
 function maskEnvName(name) {
@@ -26144,20 +26218,20 @@ function workspaceEnv(runtime) {
 // plugins/kxm/src/cli/roles.ts
 var import_yaml8 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
-import { join as join17, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join18, resolve as resolve12 } from "node:path";
 import { createInterface } from "node:readline";
 
 // plugins/kxm/src/role.ts
 var import_yaml7 = __toESM(require_dist(), 1);
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readdirSync as readdirSync4, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, readdirSync as readdirSync4, readFileSync as readFileSync15, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // plugins/kxm/src/config.ts
 var import_yaml6 = __toESM(require_dist(), 1);
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname10, join as join15, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname11, join as join16, resolve as resolve10 } from "node:path";
 var KXM_CONFIG_SCHEMA = "kxm.config.v1";
 var DEFAULT_KXM_CONFIG = {
   schema: KXM_CONFIG_SCHEMA,
@@ -26210,11 +26284,11 @@ var DEFAULT_KXM_CONFIG = {
   }
 };
 function userConfigDirectory(overrideDir) {
-  if (overrideDir) return resolve9(overrideDir);
-  return resolve9(process.env.KXM_USER_CONFIG_DIR?.trim() || join15(homedir4(), ".config", "kxm"));
+  if (overrideDir) return resolve10(overrideDir);
+  return resolve10(process.env.KXM_USER_CONFIG_DIR?.trim() || join16(homedir5(), ".config", "kxm"));
 }
 function repoConfigDirectory(repoRoot) {
-  return resolve9(repoRoot, ".kxm");
+  return resolve10(repoRoot, ".kxm");
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -26234,14 +26308,14 @@ function normalizeHubConfig(raw) {
 }
 function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   const userDir = userConfigDirectory(options.userConfigDir);
-  const userConfigFile = join15(userDir, "config.yaml");
+  const userConfigFile = join16(userDir, "config.yaml");
   const repoDir = repoConfigDirectory(repoRoot);
-  const repoConfigFile = join15(repoDir, "config.yaml");
+  const repoConfigFile = join16(repoDir, "config.yaml");
   let userRaw = {};
   let userLoadedPath;
-  if (existsSync13(userConfigFile)) {
+  if (existsSync14(userConfigFile)) {
     try {
-      const text = readFileSync13(userConfigFile, "utf8");
+      const text = readFileSync14(userConfigFile, "utf8");
       userRaw = (0, import_yaml6.parse)(text) ?? {};
       userLoadedPath = userConfigFile;
     } catch (error) {
@@ -26250,9 +26324,9 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   }
   let repoRaw = {};
   let repoLoadedPath;
-  if (existsSync13(repoConfigFile)) {
+  if (existsSync14(repoConfigFile)) {
     try {
-      const text = readFileSync13(repoConfigFile, "utf8");
+      const text = readFileSync14(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml6.parse)(text) ?? {};
       repoLoadedPath = repoConfigFile;
     } catch (error) {
@@ -26289,12 +26363,12 @@ function getKxmConfigValue(config, keyPath) {
 }
 function setKxmConfigValue(repoRoot, keyPath, value, options = {}) {
   const scope = options.scope ?? "project";
-  const targetFile2 = scope === "user" ? join15(userConfigDirectory(options.userConfigDir), "config.yaml") : join15(repoConfigDirectory(repoRoot), "config.yaml");
-  mkdirSync10(dirname10(targetFile2), { recursive: true });
+  const targetFile2 = scope === "user" ? join16(userConfigDirectory(options.userConfigDir), "config.yaml") : join16(repoConfigDirectory(repoRoot), "config.yaml");
+  mkdirSync11(dirname11(targetFile2), { recursive: true });
   let existing = {};
-  if (existsSync13(targetFile2)) {
+  if (existsSync14(targetFile2)) {
     try {
-      existing = (0, import_yaml6.parse)(readFileSync13(targetFile2, "utf8")) ?? {};
+      existing = (0, import_yaml6.parse)(readFileSync14(targetFile2, "utf8")) ?? {};
     } catch {
       existing = {};
     }
@@ -26312,7 +26386,7 @@ function setKxmConfigValue(repoRoot, keyPath, value, options = {}) {
     cursor2 = cursor2[p];
   }
   cursor2[parts[parts.length - 1]] = value;
-  writeFileSync9(targetFile2, (0, import_yaml6.stringify)(existing).trim() + "\n", "utf8");
+  writeFileSync10(targetFile2, (0, import_yaml6.stringify)(existing).trim() + "\n", "utf8");
 }
 function formatKxmConfig(config) {
   const display = {
@@ -26405,21 +26479,21 @@ var DEFAULT_ROLES = {
 };
 function rolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join16(userConfigDirectory(userConfigDir), "roles");
+    return join17(userConfigDirectory(userConfigDir), "roles");
   }
-  return join16(repoConfigDirectory(repoRoot), "roles");
+  return join17(repoConfigDirectory(repoRoot), "roles");
 }
 function ensureRolesDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = rolesDirectory(scope, repoRoot, userConfigDir);
-  if (!existsSync14(dir)) {
-    mkdirSync11(dir, { recursive: true });
+  if (!existsSync15(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   return dir;
 }
 function parseRoleFile(filePath) {
-  if (!existsSync14(filePath)) return void 0;
+  if (!existsSync15(filePath)) return void 0;
   try {
-    const raw = readFileSync14(filePath, "utf8");
+    const raw = readFileSync15(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
     if (!parsed || typeof parsed !== "object" || parsed.schema !== KXM_ROLE_SCHEMA) {
       return void 0;
@@ -26446,10 +26520,10 @@ function listRoles(options = {}) {
   const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
   const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
   const localRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync14(localDir)) {
+  if (scopeFilter !== "global" && existsSync15(localDir)) {
     for (const entry of readdirSync4(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join16(localDir, entry);
+        const filePath = join17(localDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           localRoles.set(parsed.id, { role: parsed, filePath });
@@ -26458,10 +26532,10 @@ function listRoles(options = {}) {
     }
   }
   const globalRoles = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync14(globalDir)) {
+  if (scopeFilter !== "local" && existsSync15(globalDir)) {
     for (const entry of readdirSync4(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join16(globalDir, entry);
+        const filePath = join17(globalDir, entry);
         const parsed = parseRoleFile(filePath);
         if (parsed) {
           globalRoles.set(parsed.id, { role: parsed, filePath });
@@ -26509,13 +26583,13 @@ function getRole(roleId, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
     const localDir = rolesDirectory("local", repoRoot, options.userConfigDir);
-    const localFile = join16(localDir, `${roleId}.yaml`);
+    const localFile = join17(localDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(localFile);
     if (parsed) return { role: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
     const globalDir = rolesDirectory("global", repoRoot, options.userConfigDir);
-    const globalFile = join16(globalDir, `${roleId}.yaml`);
+    const globalFile = join17(globalDir, `${roleId}.yaml`);
     const parsed = parseRoleFile(globalFile);
     if (parsed) return { role: parsed, scope: "global", filePath: globalFile };
   }
@@ -26525,22 +26599,22 @@ function addRole(role, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join16(dir, `${role.id}.yaml`);
-  if (existsSync14(filePath) && !options.overwrite) {
+  const filePath = join17(dir, `${role.id}.yaml`);
+  if (existsSync15(filePath) && !options.overwrite) {
     throw new Error(`role_already_exists: role '${role.id}' already exists at ${filePath}`);
   }
-  writeFileSync10(filePath, (0, import_yaml7.stringify)(role), "utf8");
+  writeFileSync11(filePath, (0, import_yaml7.stringify)(role), "utf8");
   return { id: role.id, filePath, scope };
 }
 function removeRole(roleId, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = rolesDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join16(dir, `${roleId}.yaml`);
-  if (!existsSync14(filePath)) {
+  const filePath = join17(dir, `${roleId}.yaml`);
+  if (!existsSync15(filePath)) {
     throw new Error(`role_not_found: role '${roleId}' not found in ${scope} directory (${filePath})`);
   }
-  rmSync4(filePath);
+  rmSync5(filePath);
   return { id: roleId, removed: true, filePath, scope };
 }
 function modifyRole(roleId, updates, options = {}) {
@@ -26558,8 +26632,8 @@ function modifyRole(roleId, updates, options = {}) {
   const scope = options.scope ?? target.scope;
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = ensureRolesDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join16(dir, `${roleId}.yaml`);
-  writeFileSync10(filePath, (0, import_yaml7.stringify)(updated), "utf8");
+  const filePath = join17(dir, `${roleId}.yaml`);
+  writeFileSync11(filePath, (0, import_yaml7.stringify)(updated), "utf8");
   return { id: roleId, role: updated, filePath, scope };
 }
 var KXM_ROLE_HOSTS_SCHEMA = "kxm.role-hosts.v1";
@@ -26607,18 +26681,18 @@ var DEFAULT_ROLE_SEATS = {
 };
 function findExistingRoleHostsFile(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = scope === "global" ? userConfigDirectory(userConfigDir) : repoConfigDirectory(repoRoot);
-  const yamlPath = join16(dir, "role-hosts.yaml");
-  const ymlPath = join16(dir, "role-hosts.yml");
-  const jsonPath = join16(dir, "role-hosts.json");
-  if (existsSync14(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
-  if (existsSync14(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
-  if (existsSync14(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
+  const yamlPath = join17(dir, "role-hosts.yaml");
+  const ymlPath = join17(dir, "role-hosts.yml");
+  const jsonPath = join17(dir, "role-hosts.json");
+  if (existsSync15(yamlPath)) return { filePath: yamlPath, exists: true, format: "yaml" };
+  if (existsSync15(ymlPath)) return { filePath: ymlPath, exists: true, format: "yaml" };
+  if (existsSync15(jsonPath)) return { filePath: jsonPath, exists: true, format: "json" };
   return { filePath: yamlPath, exists: false, format: "yaml" };
 }
 function parseRoleHostsFile(filePath) {
-  if (!existsSync14(filePath)) return void 0;
+  if (!existsSync15(filePath)) return void 0;
   try {
-    const raw = readFileSync14(filePath, "utf8");
+    const raw = readFileSync15(filePath, "utf8");
     const parsed = (0, import_yaml7.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     if (parsed.schema && parsed.schema !== KXM_ROLE_HOSTS_SCHEMA) return void 0;
@@ -26690,18 +26764,18 @@ function saveRoleHostsConfig(config, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = scope === "global" ? userConfigDirectory(options.userConfigDir) : repoConfigDirectory(repoRoot);
-  if (!existsSync14(dir)) {
-    mkdirSync11(dir, { recursive: true });
+  if (!existsSync15(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   const format = options.format ?? "yaml";
-  const filePath = join16(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
+  const filePath = join17(dir, format === "json" ? "role-hosts.json" : "role-hosts.yaml");
   const payload = {
     schema: KXM_ROLE_HOSTS_SCHEMA,
     seats: config.seats ?? {},
     ...config.hostProviders && Object.keys(config.hostProviders).length > 0 ? { hostProviders: config.hostProviders } : {}
   };
   const content = format === "json" ? JSON.stringify(payload, null, 2) + "\n" : (0, import_yaml7.stringify)(payload);
-  writeFileSync10(filePath, content, "utf8");
+  writeFileSync11(filePath, content, "utf8");
   return { filePath, scope };
 }
 function setRoleSeatHost(seatId, host, options = {}) {
@@ -26935,8 +27009,8 @@ async function cmdRoleAdd(runtime, roleId, options) {
   }
   let roleDef;
   if (options.file) {
-    const filePath = resolve11(runtime.cwd, options.file);
-    const content = readFileSync15(filePath, "utf8");
+    const filePath = resolve12(runtime.cwd, options.file);
+    const content = readFileSync16(filePath, "utf8");
     roleDef = (0, import_yaml8.parse)(content);
     roleDef.id = roleId;
   } else {
@@ -27235,8 +27309,8 @@ async function cmdRoleResume(runtime, runId, ruling) {
       return 1;
     }
   }
-  const dbPath = join17(runtime.cwd, ".kxm", "state", "kxm.db");
-  if (existsSync15(dbPath)) {
+  const dbPath = join18(runtime.cwd, ".kxm", "state", "kxm.db");
+  if (existsSync16(dbPath)) {
     try {
       const database = new DatabaseSync(dbPath);
       try {
@@ -27298,12 +27372,12 @@ async function cmdRoleResume(runtime, runId, ruling) {
 
 // plugins/kxm/src/cli/workflows.ts
 import { createHmac as createHmac3, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
-import { join as join19, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import { join as join20, resolve as resolve15 } from "node:path";
 
 // plugins/kxm/src/retrospective.ts
-import { mkdirSync as mkdirSync12, renameSync as renameSync4, writeFileSync as writeFileSync11 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { mkdirSync as mkdirSync13, renameSync as renameSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
 var MAX_RETROSPECTIVE_ENTRIES = 500;
 var SAFE_RUN_ID = /^run_[A-Za-z0-9_-]{1,120}$/;
 function durationMs(startedAt, completedAt) {
@@ -27515,19 +27589,19 @@ function renderRetrospectiveMarkdown(doc) {
 }
 function writeRetrospective(outDir, doc) {
   if (!SAFE_RUN_ID.test(doc.runId)) throw new Error("invalid retrospective run id");
-  mkdirSync12(outDir, { recursive: true });
-  const root = resolve12(outDir);
-  const jsonPath = resolve12(root, `${doc.runId}.json`);
-  const mdPath = resolve12(root, `${doc.runId}.md`);
+  mkdirSync13(outDir, { recursive: true });
+  const root = resolve13(outDir);
+  const jsonPath = resolve13(root, `${doc.runId}.json`);
+  const mdPath = resolve13(root, `${doc.runId}.md`);
   const prefix = `${root}${process.platform === "win32" ? "\\" : "/"}`;
   if (!jsonPath.startsWith(prefix) || !mdPath.startsWith(prefix)) throw new Error("retrospective path escaped output directory");
   const jsonTmp = `${jsonPath}.tmp`;
   const mdTmp = `${mdPath}.tmp`;
-  writeFileSync11(jsonTmp, `${JSON.stringify(doc, null, 2)}
+  writeFileSync12(jsonTmp, `${JSON.stringify(doc, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-  writeFileSync11(mdTmp, renderRetrospectiveMarkdown(doc), { encoding: "utf8", mode: 384 });
-  renameSync4(jsonTmp, jsonPath);
-  renameSync4(mdTmp, mdPath);
+  writeFileSync12(mdTmp, renderRetrospectiveMarkdown(doc), { encoding: "utf8", mode: 384 });
+  renameSync5(jsonTmp, jsonPath);
+  renameSync5(mdTmp, mdPath);
   return { jsonPath, mdPath };
 }
 
@@ -27618,7 +27692,7 @@ async function watchGithubChecks(input) {
   }
   const fetchImpl = input.fetchImpl ?? fetch;
   const now = input.now ?? Date.now;
-  const sleep = input.sleep ?? ((ms) => new Promise((resolve30) => setTimeout(resolve30, ms)));
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve31) => setTimeout(resolve31, ms)));
   const deadline = now() + input.timeoutMs;
   const headers = {
     authorization: `Bearer ${token}`,
@@ -27717,8 +27791,8 @@ async function watchGithubChecks(input) {
 
 // plugins/kxm/src/workflow-manager.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import { existsSync as existsSync16, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync14, readdirSync as readdirSync5, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 var WORKFLOW_TEMPLATES = {
   "implement-and-verify": {
     schema: "kxm.workflow.v1",
@@ -27869,21 +27943,21 @@ var WORKFLOW_TEMPLATES = {
 var DEFAULT_WORKFLOW_TEMPLATE = WORKFLOW_TEMPLATES["implement-and-verify"];
 function workflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   if (scope === "global") {
-    return join18(userConfigDirectory(userConfigDir), "workflows");
+    return join19(userConfigDirectory(userConfigDir), "workflows");
   }
-  return join18(repoConfigDirectory(repoRoot), "workflows");
+  return join19(repoConfigDirectory(repoRoot), "workflows");
 }
 function ensureWorkflowsDirectory(scope, repoRoot = process.cwd(), userConfigDir) {
   const dir = workflowsDirectory(scope, repoRoot, userConfigDir);
-  if (!existsSync16(dir)) {
-    mkdirSync13(dir, { recursive: true });
+  if (!existsSync17(dir)) {
+    mkdirSync14(dir, { recursive: true });
   }
   return dir;
 }
 function parseWorkflowFile(filePath) {
-  if (!existsSync16(filePath)) return void 0;
+  if (!existsSync17(filePath)) return void 0;
   try {
-    const raw = readFileSync16(filePath, "utf8");
+    const raw = readFileSync17(filePath, "utf8");
     const parsed = (0, import_yaml9.parse)(raw);
     if (!parsed || typeof parsed !== "object") return void 0;
     return parsed;
@@ -27897,10 +27971,10 @@ function listWorkflowDefinitions(options = {}) {
   const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
   const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
   const localDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "global" && existsSync16(localDir)) {
+  if (scopeFilter !== "global" && existsSync17(localDir)) {
     for (const entry of readdirSync5(localDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join18(localDir, entry);
+        const filePath = join19(localDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27910,10 +27984,10 @@ function listWorkflowDefinitions(options = {}) {
     }
   }
   const globalDefs = /* @__PURE__ */ new Map();
-  if (scopeFilter !== "local" && existsSync16(globalDir)) {
+  if (scopeFilter !== "local" && existsSync17(globalDir)) {
     for (const entry of readdirSync5(globalDir)) {
       if (entry.endsWith(".yaml") || entry.endsWith(".yml")) {
-        const filePath = join18(globalDir, entry);
+        const filePath = join19(globalDir, entry);
         const def = parseWorkflowFile(filePath);
         if (def) {
           const id = def.id || entry.replace(/\.ya?ml$/i, "");
@@ -27969,13 +28043,13 @@ function getWorkflowDefinition(workflowId, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   if (scope !== "global") {
     const localDir = workflowsDirectory("local", repoRoot, options.userConfigDir);
-    const localFile = join18(localDir, `${workflowId}.yaml`);
+    const localFile = join19(localDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(localFile);
     if (parsed) return { workflow: parsed, scope: "local", filePath: localFile };
   }
   if (scope !== "local") {
     const globalDir = workflowsDirectory("global", repoRoot, options.userConfigDir);
-    const globalFile = join18(globalDir, `${workflowId}.yaml`);
+    const globalFile = join19(globalDir, `${workflowId}.yaml`);
     const parsed = parseWorkflowFile(globalFile);
     if (parsed) return { workflow: parsed, scope: "global", filePath: globalFile };
   }
@@ -27985,23 +28059,23 @@ function addWorkflowDefinition(workflowId, content = DEFAULT_WORKFLOW_TEMPLATE,
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join18(dir, `${workflowId}.yaml`);
-  if (existsSync16(filePath) && !options.overwrite) {
+  const filePath = join19(dir, `${workflowId}.yaml`);
+  if (existsSync17(filePath) && !options.overwrite) {
     throw new Error(`workflow_already_exists: workflow '${workflowId}' already exists at ${filePath}`);
   }
   const payload = typeof content === "string" ? content : (0, import_yaml9.stringify)(content);
-  writeFileSync12(filePath, payload, "utf8");
+  writeFileSync13(filePath, payload, "utf8");
   return { id: workflowId, filePath, scope };
 }
 function removeWorkflowDefinition(workflowId, options = {}) {
   const scope = options.scope ?? "local";
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = workflowsDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join18(dir, `${workflowId}.yaml`);
-  if (!existsSync16(filePath)) {
+  const filePath = join19(dir, `${workflowId}.yaml`);
+  if (!existsSync17(filePath)) {
     throw new Error(`workflow_not_found: workflow '${workflowId}' not found in ${scope} directory (${filePath})`);
   }
-  rmSync5(filePath);
+  rmSync6(filePath);
   return { id: workflowId, removed: true, filePath, scope };
 }
 function modifyWorkflowDefinition(workflowId, updates, options = {}) {
@@ -28016,15 +28090,15 @@ function modifyWorkflowDefinition(workflowId, updates, options = {}) {
   const scope = options.scope ?? target.scope;
   const repoRoot = options.repoRoot ?? process.cwd();
   const dir = ensureWorkflowsDirectory(scope, repoRoot, options.userConfigDir);
-  const filePath = join18(dir, `${workflowId}.yaml`);
-  writeFileSync12(filePath, (0, import_yaml9.stringify)(updated), "utf8");
+  const filePath = join19(dir, `${workflowId}.yaml`);
+  writeFileSync13(filePath, (0, import_yaml9.stringify)(updated), "utf8");
   return { id: workflowId, workflow: updated, filePath, scope };
 }
 
 // plugins/kxm/src/cli/workflows.ts
 var CLI_NAME = "kxm";
 function localWorkflowSnapshot(dataPath, runId) {
-  if (!existsSync17(dataPath)) throw new Error("state_database_not_found");
+  if (!existsSync18(dataPath)) throw new Error("state_database_not_found");
   const database = new DatabaseSync(dataPath, { readOnly: true });
   try {
     const rows = runId ? database.prepare("SELECT record FROM workflow_runs WHERE id = ?").all(runId) : database.prepare("SELECT record FROM workflow_runs ORDER BY rowid DESC LIMIT 200").all();
@@ -28101,7 +28175,7 @@ function activeWorkflowDefinition(runtime, definitionId) {
   let raw;
   if (file) {
     try {
-      raw = readFileSync17(resolve14(runtime.cwd, file), "utf8");
+      raw = readFileSync18(resolve15(runtime.cwd, file), "utf8");
     } catch {
       throw new Error("workflow definition file is unavailable");
     }
@@ -28182,8 +28256,8 @@ async function cmdWorkflowAdd(runtime, workflowId, options) {
     }
   }
   if (options.file) {
-    const filePath = resolve14(runtime.cwd, options.file);
-    content = readFileSync17(filePath, "utf8");
+    const filePath = resolve15(runtime.cwd, options.file);
+    content = readFileSync18(filePath, "utf8");
   } else if (!content) {
     content = {
       schema: "kxm.workflow.v1",
@@ -28341,7 +28415,7 @@ async function cmdWorkflowStart(runtime, definitionIdArg, options) {
   }
   let payload;
   try {
-    const raw = payloadFlag.startsWith("@") ? readFileSync17(resolve14(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
+    const raw = payloadFlag.startsWith("@") ? readFileSync18(resolve15(runtime.cwd, payloadFlag.slice(1)), "utf8") : payloadFlag;
     const value = JSON.parse(raw);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("object required");
     payload = value;
@@ -28408,7 +28482,7 @@ async function cmdWorkflowDegrade(runtime, runId, stageId, options) {
   }
 }
 async function cmdWorkflowInspect(runtime, action, runId) {
-  const dataPath = resolve14(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join19(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
   if (action === "get" && !runId) {
     runtime.io.stderr(`Usage: ${CLI_NAME} workflow get <runId>
 `);
@@ -28577,14 +28651,14 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 2;
   }
   const snapshotFlag = String(options.input || "");
-  const snapshotPath = snapshotFlag ? resolve14(runtime.cwd, snapshotFlag) : "";
+  const snapshotPath = snapshotFlag ? resolve15(runtime.cwd, snapshotFlag) : "";
   let snapshot;
   try {
     if (snapshotPath) {
-      if (!existsSync17(snapshotPath)) throw new Error("snapshot_missing");
-      snapshot = JSON.parse(readFileSync17(snapshotPath, "utf8"));
+      if (!existsSync18(snapshotPath)) throw new Error("snapshot_missing");
+      snapshot = JSON.parse(readFileSync18(snapshotPath, "utf8"));
     } else {
-      const dataPath = resolve14(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join19(runtime.dirs.state, "kxm.db"));
+      const dataPath = resolve15(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join20(runtime.dirs.state, "kxm.db"));
       const local = localWorkflowSnapshot(dataPath, runId);
       if (!local.runs[0]) throw new Error("workflow_not_found");
       snapshot = { run: local.runs[0], journal: local.journal };
@@ -28596,8 +28670,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
     return 1;
   }
   const doc = buildRetrospective(snapshot.run, snapshot.journal);
-  const outDir = resolve14(runtime.cwd, String(options.outDir || join19(runtime.dirs.assets, "retrospectives")));
-  const assetsRoot = resolve14(runtime.dirs.assets);
+  const outDir = resolve15(runtime.cwd, String(options.outDir || join20(runtime.dirs.assets, "retrospectives")));
+  const assetsRoot = resolve15(runtime.dirs.assets);
   const assetsPrefix = `${assetsRoot}${process.platform === "win32" ? "\\" : "/"}`;
   if (outDir !== assetsRoot && !outDir.startsWith(assetsPrefix)) {
     print(runtime.io, runtime.json, { ok: false, command: "retrospective export", error: "output_outside_workspace_assets" }, "retrospectives must stay under the workspace assets directory");
@@ -28614,8 +28688,8 @@ async function cmdRetrospectiveExport(runtime, runId, options) {
 
 // plugins/kxm/src/cli/tasks.ts
 var import_yaml13 = __toESM(require_dist(), 1);
-import { existsSync as existsSync23, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
-import { basename as basename6, join as join27, resolve as resolve20 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync23, readdirSync as readdirSync8 } from "node:fs";
+import { basename as basename6, join as join28, resolve as resolve21 } from "node:path";
 
 // plugins/kxm/src/suggest.ts
 var WORKFLOW_PATTERNS = [
@@ -28726,19 +28800,19 @@ function suggestWorkflowAndRoles(prompt, options = {}) {
 // plugins/kxm/src/task-manager.ts
 var import_yaml10 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync14, readFileSync as readFileSync18, readdirSync as readdirSync6, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join20, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync15, readFileSync as readFileSync19, readdirSync as readdirSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join21, resolve as resolve16 } from "node:path";
 var GOAL_SCHEMA = "kxm.goal.v1";
 var TASK_SCHEMA = "kxm.task.v1";
 function goalsDirectory(repoRoot) {
-  return resolve15(repoRoot, ".kxm", "goals");
+  return resolve16(repoRoot, ".kxm", "goals");
 }
 function tasksDirectory(repoRoot) {
-  return resolve15(repoRoot, ".kxm", "tasks");
+  return resolve16(repoRoot, ".kxm", "tasks");
 }
 function createGoal(repoRoot, input) {
   const dir = goalsDirectory(repoRoot);
-  mkdirSync14(dir, { recursive: true });
+  mkdirSync15(dir, { recursive: true });
   const id = `goal_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
@@ -28752,19 +28826,19 @@ function createGoal(repoRoot, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join20(dir, `${id}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
+  const filePath = join21(dir, `${id}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
 function listGoals(repoRoot) {
   const dir = goalsDirectory(repoRoot);
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const goals = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync18(join20(dir, entry.name), "utf8");
+        const text = readFileSync19(join21(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === GOAL_SCHEMA) goals.push(doc);
       } catch {
@@ -28775,7 +28849,7 @@ function listGoals(repoRoot) {
 }
 function createTask(repoRoot, input) {
   const dir = tasksDirectory(repoRoot);
-  mkdirSync14(dir, { recursive: true });
+  mkdirSync15(dir, { recursive: true });
   const id = `task_${randomUUID8().replaceAll("-", "").slice(0, 12)}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record = {
@@ -28797,19 +28871,19 @@ function createTask(repoRoot, input) {
     createdAt: now,
     updatedAt: now
   };
-  const filePath = join20(dir, `${id}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
+  const filePath = join21(dir, `${id}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(record).trim() + "\n", "utf8");
   return record;
 }
 function listTasks(repoRoot, options = {}) {
   const dir = tasksDirectory(repoRoot);
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   const tasks = [];
   const entries = readdirSync6(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml"))) {
       try {
-        const text = readFileSync18(join20(dir, entry.name), "utf8");
+        const text = readFileSync19(join21(dir, entry.name), "utf8");
         const doc = (0, import_yaml10.parse)(text);
         if (doc && doc.schema === TASK_SCHEMA) {
           if (options.goalId && doc.goalId !== options.goalId) continue;
@@ -28824,10 +28898,10 @@ function listTasks(repoRoot, options = {}) {
 }
 function getTask(repoRoot, taskId) {
   const dir = tasksDirectory(repoRoot);
-  const filePath = join20(dir, `${taskId}.yaml`);
-  if (!existsSync18(filePath)) return void 0;
+  const filePath = join21(dir, `${taskId}.yaml`);
+  if (!existsSync19(filePath)) return void 0;
   try {
-    const text = readFileSync18(filePath, "utf8");
+    const text = readFileSync19(filePath, "utf8");
     const doc = (0, import_yaml10.parse)(text);
     return doc && doc.schema === TASK_SCHEMA ? doc : void 0;
   } catch {
@@ -28842,8 +28916,8 @@ function updateTaskStatus(repoRoot, taskId, status, options = {}) {
   task.status = status;
   if (options.workflowRunId) task.workflowRunId = options.workflowRunId;
   task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const filePath = join20(tasksDirectory(repoRoot), `${taskId}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
+  const filePath = join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
 function syncTaskWithTracker(repoRoot, taskId, options = {}) {
@@ -28858,8 +28932,8 @@ function syncTaskWithTracker(repoRoot, taskId, options = {}) {
   task.trackerSync.syncStatus = "synced";
   task.trackerSync.lastSyncedAt = now;
   task.updatedAt = now;
-  const filePath = join20(tasksDirectory(repoRoot), `${taskId}.yaml`);
-  writeFileSync13(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
+  const filePath = join21(tasksDirectory(repoRoot), `${taskId}.yaml`);
+  writeFileSync14(filePath, (0, import_yaml10.stringify)(task).trim() + "\n", "utf8");
   return task;
 }
 
@@ -29625,13 +29699,13 @@ function createStudioServer(options = {}) {
 }
 
 // plugins/kxm/src/cli/vnext.ts
-import { join as join26, resolve as resolve19 } from "node:path";
+import { join as join27, resolve as resolve20 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 
 // plugins/kxm/src/model-inventory.ts
 var import_yaml11 = __toESM(require_dist(), 1);
-import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join21 } from "node:path";
+import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
 var OR_URL = "https://openrouter.ai/api/v1/models";
 var NOUS_URL = "https://inference-api.nousresearch.com/v1/models";
 function price(value) {
@@ -29717,41 +29791,41 @@ async function refreshModelInventory(options) {
   sources.nous = { url: nousUrl, ok: !nous.error, ...nous.error ? { error: nous.error } : {} };
   for (const item of nous.data) add(item, "nous", "discount");
   const inventory = { schema: "kxm.model-inventory.v1", fetchedAt, currency: "USD", sources, models: [...byId.values()].sort((a, b2) => a.id.localeCompare(b2.id)) };
-  mkdirSync15(join21(options.outputRoot, ".kxm", "models"), { recursive: true });
-  writeFileSync14(join21(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
+  mkdirSync16(join22(options.outputRoot, ".kxm", "models"), { recursive: true });
+  writeFileSync15(join22(options.outputRoot, ".kxm", "models", "inventory.yaml"), (0, import_yaml11.stringify)(inventory), "utf8");
   return inventory;
 }
 
 // plugins/kxm/src/vnext-init.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { existsSync as existsSync21 } from "node:fs";
-import { basename as basename5, join as join24 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { basename as basename5, join as join25 } from "node:path";
 
 // plugins/kxm/src/vnext-repair.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync2,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync7,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   openSync as openSync2,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync7,
-  renameSync as renameSync5,
-  rmSync as rmSync7,
-  writeFileSync as writeFileSync16
+  renameSync as renameSync6,
+  rmSync as rmSync8,
+  writeFileSync as writeFileSync17
 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute6, join as join23, relative as relative4, resolve as resolve17 } from "node:path";
+import { dirname as dirname15, isAbsolute as isAbsolute7, join as join24, relative as relative4, resolve as resolve18 } from "node:path";
 
 // plugins/kxm/src/vnext-permission.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync19, mkdtempSync, mkdirSync as mkdirSync16, readFileSync as readFileSync19, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync20, mkdtempSync, mkdirSync as mkdirSync17, readFileSync as readFileSync20, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname13, join as join22, resolve as resolve16, sep as sep3 } from "node:path";
+import { dirname as dirname14, join as join23, resolve as resolve17, sep as sep3 } from "node:path";
 var PROSE_FIELDS = {
   project: /* @__PURE__ */ new Set(["name", "description"]),
   repository: /* @__PURE__ */ new Set(["description"]),
@@ -30272,8 +30346,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
   const tree = resolveTreeRevision(root, revision);
   const listing = gitBuffer(root, ["ls-tree", "-r", "-z", "--name-only", tree]).toString("utf8");
   const paths = listing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-  const shadow = mkdtempSync(join22(tmpdir(), "kxm-permission-base-"));
-  const shadowResolved = resolve16(shadow);
+  const shadow = mkdtempSync(join23(tmpdir(), "kxm-permission-base-"));
+  const shadowResolved = resolve17(shadow);
   const shadowMembersDir = `.kxm-shadow-members-${createHash12("sha256").update(shadowResolved, "utf8").digest("hex").slice(0, 8)}`;
   try {
     for (const path4 of paths) {
@@ -30286,8 +30360,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
           message: "Git tree entry contains a traversal or non-portable segment"
         }]);
       }
-      const absolute = join22(shadowResolved, ...segments);
-      const resolved = resolve16(absolute);
+      const absolute = join23(shadowResolved, ...segments);
+      const resolved = resolve17(absolute);
       if (!resolved.startsWith(`${shadowResolved}${sep3}`)) {
         throw new VnextConfigError([{
           phase: "path",
@@ -30297,11 +30371,11 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const content = gitBuffer(root, ["cat-file", "blob", `${tree}:${path4}`]);
-      mkdirSync16(dirname13(absolute), { recursive: true });
-      writeFileSync15(absolute, content);
+      mkdirSync17(dirname14(absolute), { recursive: true });
+      writeFileSync16(absolute, content);
     }
     initShadowGitRoot(shadowResolved);
-    const baseProjectFile = join22(shadowResolved, ".kxm", "project.yaml");
+    const baseProjectFile = join23(shadowResolved, ".kxm", "project.yaml");
     let baseProject;
     try {
       baseProject = loadBaseProjectDeclarations(baseProjectFile);
@@ -30331,8 +30405,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         }]);
       }
       const boundPath = options.repositoryBindings?.[member.repositoryId];
-      const memberWorktree = boundPath ? resolve16(boundPath) : member.pathHint ? resolve16(root, ...member.pathHint.split("/")) : void 0;
-      if (!memberWorktree || !existsSync19(memberWorktree)) {
+      const memberWorktree = boundPath ? resolve17(boundPath) : member.pathHint ? resolve17(root, ...member.pathHint.split("/")) : void 0;
+      if (!memberWorktree || !existsSync20(memberWorktree)) {
         if (member.required === false) continue;
         throw new VnextConfigError([{
           phase: "discovery",
@@ -30379,8 +30453,8 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       const memberTree = git(memberWorktree, ["rev-parse", "--verify", "--quiet", `${pinnedCommit}^{tree}`]).trim();
       const memberListing = gitBuffer(memberWorktree, ["ls-tree", "-r", "-z", "--name-only", memberTree]).toString("utf8");
       const memberPaths = memberListing.split("\0").filter((line) => line.length > 0 && (line.startsWith(".kxm/") || line.includes("/.kxm/")));
-      const memberShadowRoot = join22(shadowResolved, shadowMembersDir, member.repositoryId);
-      if (!resolve16(memberShadowRoot).startsWith(`${resolve16(shadowResolved, shadowMembersDir)}${sep3}`)) {
+      const memberShadowRoot = join23(shadowResolved, shadowMembersDir, member.repositoryId);
+      if (!resolve17(memberShadowRoot).startsWith(`${resolve17(shadowResolved, shadowMembersDir)}${sep3}`)) {
         throw new VnextConfigError([{
           phase: "path",
           code: "git_tree_path_invalid",
@@ -30393,14 +30467,14 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
         if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || /[\\:]/.test(segment))) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry contains a traversal or non-portable segment" }]);
         }
-        const absolute = join22(memberShadowRoot, ...segments);
-        const resolved = resolve16(absolute);
-        if (!resolved.startsWith(`${resolve16(memberShadowRoot)}${sep3}`)) {
+        const absolute = join23(memberShadowRoot, ...segments);
+        const resolved = resolve17(absolute);
+        if (!resolved.startsWith(`${resolve17(memberShadowRoot)}${sep3}`)) {
           throw new VnextConfigError([{ phase: "path", code: "git_tree_path_invalid", file: path4, message: "member Git tree entry escapes the shadow root" }]);
         }
         const content = gitBuffer(memberWorktree, ["cat-file", "blob", `${memberTree}:${path4}`]);
-        mkdirSync16(dirname13(absolute), { recursive: true });
-        writeFileSync15(absolute, content);
+        mkdirSync17(dirname14(absolute), { recursive: true });
+        writeFileSync16(absolute, content);
       }
       initShadowGitRoot(memberShadowRoot);
       shadowBindings[member.repositoryId] = memberShadowRoot;
@@ -30414,15 +30488,15 @@ function loadVnextProjectAtRevision(root, revision, options = {}) {
       throw error;
     }
   } finally {
-    rmSync6(shadow, { recursive: true, force: true });
+    rmSync7(shadow, { recursive: true, force: true });
   }
 }
 function portableMemberPathHint(pathHint) {
   return pathHint !== "." && vnextPortablePath(pathHint);
 }
 function loadBaseProjectDeclarations(projectFile) {
-  if (!existsSync19(projectFile)) return [];
-  const value = parseRestrictedYaml2(readFileSync19(projectFile, "utf8"), ".kxm/project.yaml");
+  if (!existsSync20(projectFile)) return [];
+  const value = parseRestrictedYaml2(readFileSync20(projectFile, "utf8"), ".kxm/project.yaml");
   const repositories = Array.isArray(value?.repositories) ? value.repositories : [];
   const members = [];
   for (const entry of repositories) {
@@ -30514,7 +30588,7 @@ function writeDurableNew(file, bytes, mode) {
   let descriptor;
   try {
     descriptor = openSync2(file, "wx", mode);
-    writeFileSync16(descriptor, bytes);
+    writeFileSync17(descriptor, bytes);
     fsyncSync2(descriptor);
     closeSync2(descriptor);
     descriptor = void 0;
@@ -30525,13 +30599,13 @@ function writeDurableNew(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync2(descriptor);
   }
-  syncDirectory2(dirname14(file));
+  syncDirectory2(dirname15(file));
 }
 function writeDurable(file, bytes, mode) {
   let descriptor;
   try {
     descriptor = openSync2(file, "w", mode);
-    writeFileSync16(descriptor, bytes);
+    writeFileSync17(descriptor, bytes);
     fsyncSync2(descriptor);
     closeSync2(descriptor);
     descriptor = void 0;
@@ -30542,53 +30616,53 @@ function writeDurable(file, bytes, mode) {
   } finally {
     if (descriptor !== void 0) closeSync2(descriptor);
   }
-  syncDirectory2(dirname14(file));
+  syncDirectory2(dirname15(file));
 }
 function sameHostPath3(left, right) {
-  const first = resolve17(left);
-  const second = resolve17(right);
+  const first = resolve18(left);
+  const second = resolve18(right);
   return process.platform === "win32" ? first.toLocaleLowerCase("en-US") === second.toLocaleLowerCase("en-US") : first === second;
 }
 function transactionRoot(projectRoot) {
-  return join23(resolve17(projectRoot), TRANSACTION_NAME);
+  return join24(resolve18(projectRoot), TRANSACTION_NAME);
 }
 function operationFile(projectRoot) {
-  return join23(transactionRoot(projectRoot), OPERATION_FILE);
+  return join24(transactionRoot(projectRoot), OPERATION_FILE);
 }
 function targetFile(projectRoot, portablePath2) {
-  return join23(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
+  return join24(transactionRoot(projectRoot), "targets", ...portablePath2.split("/"));
 }
 function shadowRoot(projectRoot) {
-  return join23(transactionRoot(projectRoot), "shadow");
+  return join24(transactionRoot(projectRoot), "shadow");
 }
 function backupFile(projectRoot, portablePath2) {
-  return join23(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
+  return join24(transactionRoot(projectRoot), "backups", ...portablePath2.split("/"));
 }
 function portableManagedPath(path4) {
-  return path4.startsWith(".kxm/") && path4 !== VNEXT_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute6(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
+  return path4.startsWith(".kxm/") && path4 !== VNEXT_TEMPLATE_PROVENANCE_PATH && path4.length <= 1024 && !path4.includes("\\") && !isAbsolute7(path4) && PORTABLE_PATH.test(path4) && !/[<>:"|?*]/.test(path4);
 }
 function readRegularBounded(file, label) {
   const stat = lstatSync7(file);
   if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_file_invalid", label, "managed file must be a regular file, not a link or directory", "path");
   if (stat.size > MAX_MANAGED_FILE_BYTES) fail3("repair_file_too_large", label, `managed file exceeds ${MAX_MANAGED_FILE_BYTES} bytes`, "parse");
-  return readFileSync20(file);
+  return readFileSync21(file);
 }
 function readOptionalManaged(projectRoot, path4) {
-  const file = join23(projectRoot, ...path4.split("/"));
-  if (!existsSync20(file)) return void 0;
-  let parent = dirname14(file);
-  const boundary = resolve17(projectRoot);
+  const file = join24(projectRoot, ...path4.split("/"));
+  if (!existsSync21(file)) return void 0;
+  let parent = dirname15(file);
+  const boundary = resolve18(projectRoot);
   while (parent !== boundary) {
     const stat = lstatSync7(parent);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_parent_invalid", path4, "managed file parents must be regular directories", "path");
-    parent = dirname14(parent);
+    parent = dirname15(parent);
   }
   return readRegularBounded(file, path4);
 }
 function readProjectAndProvenance(projectRoot, schemasDir) {
-  const projectFile = join23(projectRoot, ".kxm", "project.yaml");
-  const provenanceFile = join23(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
-  if (!existsSync20(projectFile) || !existsSync20(provenanceFile)) return void 0;
+  const projectFile = join24(projectRoot, ".kxm", "project.yaml");
+  const provenanceFile = join24(projectRoot, ...VNEXT_TEMPLATE_PROVENANCE_PATH.split("/"));
+  if (!existsSync21(projectFile) || !existsSync21(provenanceFile)) return void 0;
   const projectBytes = readOptionalManaged(projectRoot, ".kxm/project.yaml");
   const provenanceBytes = readOptionalManaged(projectRoot, VNEXT_TEMPLATE_PROVENANCE_PATH);
   if (!projectBytes || !provenanceBytes) return void 0;
@@ -30624,7 +30698,7 @@ function readProjectAndProvenance(projectRoot, schemasDir) {
 }
 function planVnextTemplateRepair(projectRoot, options = {}) {
   assertNoRegisteredGates(options);
-  const root = resolve17(projectRoot);
+  const root = resolve18(projectRoot);
   const source = readProjectAndProvenance(root, options.schemasDir);
   if (!source) return void 0;
   const target = renderVnextTemplate(
@@ -30752,14 +30826,14 @@ function operationPlanSha(operation) {
 function writeOperation(projectRoot, operation) {
   const root = transactionRoot(projectRoot);
   const file = operationFile(projectRoot);
-  const temporary = join23(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
+  const temporary = join24(root, `.operation-${operation.operationId}-${randomUUID10()}.tmp`);
   try {
     writeDurableNew(temporary, Buffer.from(`${JSON.stringify(operation, null, 2)}
 `, "utf8"), 384);
-    renameSync5(temporary, file);
+    renameSync6(temporary, file);
     syncDirectory2(root);
   } finally {
-    rmSync7(temporary, { force: true });
+    rmSync8(temporary, { force: true });
   }
 }
 function updatePhase(projectRoot, operation, phase) {
@@ -30769,11 +30843,11 @@ function updatePhase(projectRoot, operation, phase) {
 }
 function readOperation(projectRoot, schemasDir) {
   const root = transactionRoot(projectRoot);
-  if (!existsSync20(root)) return void 0;
+  if (!existsSync21(root)) return void 0;
   const stat = lstatSync7(root);
   if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("init_transaction_invalid", TRANSACTION_NAME, "initialization transaction must be a regular directory", "path");
   const file = operationFile(projectRoot);
-  if (!existsSync20(file)) {
+  if (!existsSync21(file)) {
     const entries = readdirSync7(root, { withFileTypes: true });
     const recoverable = entries.every((entry) => entry.isFile() && /^\.operation-op_[a-f0-9]{32}-[a-f0-9-]{36}\.tmp$/.test(entry.name));
     if (recoverable) return void 0;
@@ -30796,20 +30870,20 @@ function readOperation(projectRoot, schemasDir) {
     seen.add(folded);
     prior = entry.path;
   }
-  if (!isAbsolute6(operation.projectRoot)) fail3("init_transaction_project_root_invalid", TRANSACTION_NAME, "operation project root must be absolute", "path");
+  if (!isAbsolute7(operation.projectRoot)) fail3("init_transaction_project_root_invalid", TRANSACTION_NAME, "operation project root must be absolute", "path");
   validateOperationIntent(projectRoot, operation);
   return operation;
 }
 function hasVnextInitTransaction(projectRoot) {
-  return existsSync20(transactionRoot(projectRoot));
+  return existsSync21(transactionRoot(projectRoot));
 }
 function readTarget(projectRoot, path4) {
-  return readOptionalManaged(join23(transactionRoot(projectRoot), "targets"), path4);
+  return readOptionalManaged(join24(transactionRoot(projectRoot), "targets"), path4);
 }
 function writeTarget(projectRoot, path4, bytes) {
   if (bytes.byteLength > MAX_MANAGED_FILE_BYTES) fail3("template_target_too_large", path4, `target exceeds ${MAX_MANAGED_FILE_BYTES} bytes`);
   const file = targetFile(projectRoot, path4);
-  mkdirSync17(dirname14(file), { recursive: true, mode: 448 });
+  mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
   writeDurableNew(file, bytes, 384);
 }
 function writeAndVerifyBackups(projectRoot, operation) {
@@ -30821,7 +30895,7 @@ function writeAndVerifyBackups(projectRoot, operation) {
       fail3("repair_preimage_changed", entry.path, "destination changed before transaction preparation; local bytes were preserved");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync17(dirname14(file), { recursive: true, mode: 448 });
+    mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
     writeDurableNew(file, current, 384);
   }
 }
@@ -30836,7 +30910,7 @@ function writeKnownBackups(projectRoot, operation) {
       fail3("init_transaction_backup_source_invalid", entry.path, "supported source template cannot reproduce the pinned preimage");
     }
     const file = backupFile(projectRoot, entry.path);
-    mkdirSync17(dirname14(file), { recursive: true, mode: 448 });
+    mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
     writeDurableNew(file, bytes, 384);
   }
 }
@@ -30844,7 +30918,7 @@ function verifyBackups(projectRoot, operation) {
   if (operation.kind !== "repair") return;
   for (const entry of operation.files) {
     if (entry.observedSha256 === null) continue;
-    const bytes = readOptionalManaged(join23(transactionRoot(projectRoot), "backups"), entry.path);
+    const bytes = readOptionalManaged(join24(transactionRoot(projectRoot), "backups"), entry.path);
     if (!bytes || vnextContentSha256(bytes) !== entry.observedSha256) {
       fail3("init_transaction_backup_invalid", entry.path, "pinned preimage backup is missing or corrupt");
     }
@@ -30878,10 +30952,10 @@ function sourceConfigFiles(projectRoot) {
     ".kxm/repo/repo.yaml",
     ".kxm/repo/env.yaml"
   ];
-  const files = fixed.filter((path4) => existsSync20(join23(projectRoot, ...path4.split("/"))));
+  const files = fixed.filter((path4) => existsSync21(join24(projectRoot, ...path4.split("/"))));
   for (const directory of ["agents", "models", "workflows"]) {
-    const absolute = join23(projectRoot, ".kxm", directory);
-    if (!existsSync20(absolute)) continue;
+    const absolute = join24(projectRoot, ".kxm", directory);
+    if (!existsSync21(absolute)) continue;
     const stat = lstatSync7(absolute);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_directory_invalid", `.kxm/${directory}`, "configuration directory must be regular", "path");
     for (const entry of readdirSync7(absolute, { withFileTypes: true })) {
@@ -30902,24 +30976,24 @@ function absoluteMemberBindings(projectRoot, project, explicit = {}) {
     const repository = candidate;
     if (repository.role !== "member" || typeof repository.id !== "string" || Object.hasOwn(bindings, repository.id)) continue;
     if (typeof repository.pathHint === "string") {
-      const candidate2 = resolve17(projectRoot, ...repository.pathHint.split("/"));
-      if (existsSync20(candidate2)) bindings[repository.id] = candidate2;
+      const candidate2 = resolve18(projectRoot, ...repository.pathHint.split("/"));
+      if (existsSync21(candidate2)) bindings[repository.id] = candidate2;
     }
   }
   return bindings;
 }
 function prepareShadow(projectRoot, operation, options) {
   const shadow = shadowRoot(projectRoot);
-  mkdirSync17(shadow, { recursive: true, mode: 448 });
+  mkdirSync18(shadow, { recursive: true, mode: 448 });
   let total = 0;
   if (operation.kind === "repair") {
     for (const path4 of sourceConfigFiles(projectRoot)) {
       const bytes = readOptionalManaged(projectRoot, path4);
       if (!bytes) fail3("repair_snapshot_file_missing", path4, "configuration changed during shadow preparation");
       total += bytes.byteLength;
-      const source = join23(projectRoot, ...path4.split("/"));
-      const destination = join23(shadow, ...path4.split("/"));
-      mkdirSync17(dirname14(destination), { recursive: true, mode: 448 });
+      const source = join24(projectRoot, ...path4.split("/"));
+      const destination = join24(shadow, ...path4.split("/"));
+      mkdirSync18(dirname15(destination), { recursive: true, mode: 448 });
       writeDurableNew(destination, bytes, lstatSync7(source).mode & 511);
       if (total > MAX_MANAGED_TOTAL_BYTES) fail3("repair_snapshot_too_large", ".kxm", `configuration snapshot exceeds ${MAX_MANAGED_TOTAL_BYTES} bytes`, "parse");
     }
@@ -30927,12 +31001,12 @@ function prepareShadow(projectRoot, operation, options) {
   for (const entry of operation.files) {
     const bytes = readTarget(projectRoot, entry.path);
     if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-    const destination = join23(shadow, ...entry.path.split("/"));
-    mkdirSync17(dirname14(destination), { recursive: true, mode: 448 });
-    const mode = existsSync20(destination) ? lstatSync7(destination).mode & 511 : 420;
+    const destination = join24(shadow, ...entry.path.split("/"));
+    mkdirSync18(dirname15(destination), { recursive: true, mode: 448 });
+    const mode = existsSync21(destination) ? lstatSync7(destination).mode & 511 : 420;
     writeDurable(destination, bytes, mode);
   }
-  const project = parseRestrictedYaml2(readFileSync20(join23(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
+  const project = parseRestrictedYaml2(readFileSync21(join24(shadow, ".kxm", "project.yaml")), ".kxm/project.yaml");
   const bound = absoluteMemberBindings(projectRoot, project, options.repositoryBindings);
   loadVnextProject(shadow, { ...loaderOptions(options), repositoryBindings: bound });
   const provenance = readProjectAndProvenance(shadow, options.schemasDir)?.provenance;
@@ -30941,7 +31015,7 @@ function prepareShadow(projectRoot, operation, options) {
   }
 }
 function createOperation(projectRoot, kind, rendered, files, sourceTemplateRevision) {
-  const root = resolve17(projectRoot);
+  const root = resolve18(projectRoot);
   const operationWithoutHash = {
     schema: "kxm.init-operation.v1",
     operationId: `op_${randomUUID10().replaceAll("-", "")}`,
@@ -30970,8 +31044,8 @@ function prepareOperation(projectRoot, operation, rendered, options) {
   const transaction = transactionRoot(projectRoot);
   validateOperationRecord(operation, options.schemasDir);
   validateOperationIntent(projectRoot, operation);
-  if (existsSync20(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
-  mkdirSync17(transaction, { mode: 448 });
+  if (existsSync21(transaction)) fail3("init_transaction_exists", TRANSACTION_NAME, "an initialization transaction already exists and must be resumed");
+  mkdirSync18(transaction, { mode: 448 });
   syncDirectory2(projectRoot);
   writeOperation(projectRoot, operation);
   try {
@@ -30987,30 +31061,30 @@ function prepareOperation(projectRoot, operation, rendered, options) {
     syncTreeDirectories(transaction);
     return updatePhase(projectRoot, operation, "prepared");
   } catch (error) {
-    rmSync7(transaction, { recursive: true, force: true });
+    rmSync8(transaction, { recursive: true, force: true });
     throw error;
   }
 }
 function ensureDestinationParents(projectRoot, path4) {
-  const boundary = resolve17(projectRoot);
+  const boundary = resolve18(projectRoot);
   const segments = path4.split("/").slice(0, -1);
   let current = boundary;
   for (const segment of segments) {
-    current = join23(current, segment);
-    if (!existsSync20(current)) mkdirSync17(current, { mode: 448 });
+    current = join24(current, segment);
+    if (!existsSync21(current)) mkdirSync18(current, { mode: 448 });
     const stat = lstatSync7(current);
     if (stat.isSymbolicLink() || !stat.isDirectory()) fail3("repair_destination_parent_invalid", path4, "destination parent must be a regular directory", "path");
   }
 }
 function destinationSha(projectRoot, path4) {
-  const file = join23(projectRoot, ...path4.split("/"));
-  if (!existsSync20(file)) return void 0;
+  const file = join24(projectRoot, ...path4.split("/"));
+  if (!existsSync21(file)) return void 0;
   return vnextContentSha256(readRegularBounded(file, path4));
 }
 function requireConditionalLinkSupport(directory, operationId, path4) {
   const nonce = randomUUID10();
-  const source = join23(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
-  const target = join23(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
+  const source = join24(directory, `.kxm-repair-${operationId}-${nonce}.link-source`);
+  const target = join24(directory, `.kxm-repair-${operationId}-${nonce}.link-target`);
   try {
     writeDurableNew(source, Buffer.from("kxm-link-probe\n", "utf8"), 384);
     try {
@@ -31019,25 +31093,25 @@ function requireConditionalLinkSupport(directory, operationId, path4) {
       fail3("repair_hard_link_unsupported", path4, "filesystem does not support the conditional hard-link install required for safe repair");
     }
   } finally {
-    rmSync7(target, { force: true });
-    rmSync7(source, { force: true });
+    rmSync8(target, { force: true });
+    rmSync8(source, { force: true });
     syncDirectory2(directory);
   }
 }
 function atomicInstallTarget(projectRoot, operation, entry) {
-  const destination = join23(projectRoot, ...entry.path.split("/"));
+  const destination = join24(projectRoot, ...entry.path.split("/"));
   ensureDestinationParents(projectRoot, entry.path);
-  const directory = dirname14(destination);
+  const directory = dirname15(destination);
   const temporaryPrefix = `.kxm-repair-${operation.operationId}-`;
   const pathKey = vnextContentSha256(entry.path).slice("sha256:".length, "sha256:".length + 16);
-  const displaced = join23(directory, `${temporaryPrefix}${pathKey}.preimage`);
-  if (existsSync20(displaced)) {
+  const displaced = join24(directory, `${temporaryPrefix}${pathKey}.preimage`);
+  if (existsSync21(displaced)) {
     const stat = lstatSync7(displaced);
     if (stat.isSymbolicLink() || !stat.isFile()) fail3("repair_preimage_temporary_invalid", entry.path, "stale displaced preimage is not a regular file", "path");
-    if (entry.observedSha256 === null || vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
+    if (entry.observedSha256 === null || vnextContentSha256(readFileSync21(displaced)) !== entry.observedSha256) {
       fail3("repair_preimage_temporary_mismatch", entry.path, "stale displaced preimage does not match the pinned operation");
     }
-    if (!existsSync20(destination)) {
+    if (!existsSync21(destination)) {
       try {
         linkSync(displaced, destination);
       } catch {
@@ -31045,14 +31119,14 @@ function atomicInstallTarget(projectRoot, operation, entry) {
       }
       syncDirectory2(directory);
     }
-    rmSync7(displaced, { force: true });
+    rmSync8(displaced, { force: true });
     syncDirectory2(directory);
   }
   for (const candidate of readdirSync7(directory, { withFileTypes: true })) {
     const owned = candidate.name.startsWith(temporaryPrefix) && (candidate.name.endsWith(".tmp") || candidate.name.endsWith(".link-source") || candidate.name.endsWith(".link-target"));
     if (!owned) continue;
     if (!candidate.isFile()) fail3("repair_temporary_invalid", entry.path, "stale operation temporary is not a regular file", "path");
-    rmSync7(join23(directory, candidate.name), { force: true });
+    rmSync8(join24(directory, candidate.name), { force: true });
   }
   const current = destinationSha(projectRoot, entry.path);
   if (current === entry.targetSha256) return;
@@ -31062,22 +31136,22 @@ function atomicInstallTarget(projectRoot, operation, entry) {
   requireConditionalLinkSupport(directory, operation.operationId, entry.path);
   const bytes = readTarget(projectRoot, entry.path);
   if (!bytes) fail3("init_transaction_target_missing", entry.path, "pinned target artifact is missing");
-  const temporary = join23(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
-  const mode = existsSync20(destination) ? lstatSync7(destination).mode & 511 : 420;
+  const temporary = join24(directory, `${temporaryPrefix}${randomUUID10()}.tmp`);
+  const mode = existsSync21(destination) ? lstatSync7(destination).mode & 511 : 420;
   try {
     writeDurableNew(temporary, bytes, mode);
     if (entry.observedSha256 !== null) {
-      renameSync5(destination, displaced);
+      renameSync6(destination, displaced);
       syncDirectory2(directory);
-      if (vnextContentSha256(readFileSync20(displaced)) !== entry.observedSha256) {
-        if (!existsSync20(destination)) {
+      if (vnextContentSha256(readFileSync21(displaced)) !== entry.observedSha256) {
+        if (!existsSync21(destination)) {
           try {
             linkSync(displaced, destination);
           } catch {
             fail3("repair_preimage_restore_blocked", entry.path, "changed destination was displaced but could not be conditionally restored; its bytes remain in the operation preimage file");
           }
           syncDirectory2(directory);
-          rmSync7(displaced, { force: true });
+          rmSync8(displaced, { force: true });
           syncDirectory2(directory);
         }
         fail3("repair_preimage_changed", entry.path, "destination changed at replacement time; concurrent bytes were preserved at the destination or in the operation preimage file");
@@ -31086,7 +31160,7 @@ function atomicInstallTarget(projectRoot, operation, entry) {
     try {
       linkSync(temporary, destination);
     } catch {
-      if (!existsSync20(destination) && existsSync20(displaced)) {
+      if (!existsSync21(destination) && existsSync21(displaced)) {
         try {
           linkSync(displaced, destination);
         } catch {
@@ -31094,26 +31168,26 @@ function atomicInstallTarget(projectRoot, operation, entry) {
         }
         syncDirectory2(directory);
       }
-      rmSync7(displaced, { force: true });
+      rmSync8(displaced, { force: true });
       syncDirectory2(directory);
       fail3("repair_destination_recreated", entry.path, "destination was recreated concurrently or conditional install is unsupported; pinned target was not installed");
     }
     syncDirectory2(directory);
-    rmSync7(temporary, { force: true });
-    rmSync7(displaced, { force: true });
+    rmSync8(temporary, { force: true });
+    rmSync8(displaced, { force: true });
     syncDirectory2(directory);
   } finally {
-    rmSync7(temporary, { force: true });
+    rmSync8(temporary, { force: true });
   }
   if (destinationSha(projectRoot, entry.path) !== entry.targetSha256) fail3("repair_install_verification_failed", entry.path, "installed target hash does not match the pinned operation");
 }
 function installedCreateMatches(projectRoot, operation) {
-  const configRoot = join23(projectRoot, ".kxm");
-  if (!existsSync20(configRoot)) return false;
+  const configRoot = join24(projectRoot, ".kxm");
+  if (!existsSync21(configRoot)) return false;
   const actual = [];
   const visit2 = (directory) => {
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      const absolute = join23(directory, entry.name);
+      const absolute = join24(directory, entry.name);
       if (entry.isSymbolicLink()) fail3("create_resume_link", relativeConfigPath(projectRoot, absolute), "created configuration must not contain links", "path");
       if (entry.isDirectory()) visit2(absolute);
       else if (entry.isFile()) actual.push(relativeConfigPath(projectRoot, absolute));
@@ -31126,15 +31200,15 @@ function installedCreateMatches(projectRoot, operation) {
   return actual.length === expected.length && actual.every((path4, index) => path4 === expected[index]) && operation.files.every((entry) => destinationSha(projectRoot, entry.path) === entry.targetSha256);
 }
 function relativeConfigPath(projectRoot, file) {
-  return relative4(resolve17(projectRoot), file).replaceAll("\\", "/");
+  return relative4(resolve18(projectRoot), file).replaceAll("\\", "/");
 }
 function syncTreeDirectories(root) {
-  if (!existsSync20(root)) return;
+  if (!existsSync21(root)) return;
   const directories = [];
   const visit2 = (directory) => {
     directories.push(directory);
     for (const entry of readdirSync7(directory, { withFileTypes: true })) {
-      if (entry.isDirectory()) visit2(join23(directory, entry.name));
+      if (entry.isDirectory()) visit2(join24(directory, entry.name));
     }
   };
   visit2(root);
@@ -31142,13 +31216,13 @@ function syncTreeDirectories(root) {
 }
 function rebuildCreateShadow(projectRoot, operation, options) {
   const shadow = shadowRoot(projectRoot);
-  rmSync7(shadow, { recursive: true, force: true });
+  rmSync8(shadow, { recursive: true, force: true });
   prepareShadow(projectRoot, operation, options);
   const stat = lstatSync7(shadow);
   if (stat.isSymbolicLink() || !stat.isDirectory() || !installedCreateMatches(shadow, operation)) {
     fail3("create_shadow_invalid", TRANSACTION_NAME, "reconstructed create shadow does not exactly match pinned target files", "path");
   }
-  syncTreeDirectories(join23(shadow, ".kxm"));
+  syncTreeDirectories(join24(shadow, ".kxm"));
 }
 function applyOperation(projectRoot, original, options, resumed) {
   assertNoRegisteredGates(options);
@@ -31158,10 +31232,10 @@ function applyOperation(projectRoot, original, options, resumed) {
   verifyBackups(projectRoot, operation);
   operation = updatePhase(projectRoot, operation, "applying");
   if (operation.kind === "create") {
-    const destination = join23(projectRoot, ".kxm");
-    if (!existsSync20(destination)) {
+    const destination = join24(projectRoot, ".kxm");
+    if (!existsSync21(destination)) {
       rebuildCreateShadow(projectRoot, operation, effectiveOptions);
-      renameSync5(join23(shadowRoot(projectRoot), ".kxm"), destination);
+      renameSync6(join24(shadowRoot(projectRoot), ".kxm"), destination);
       syncDirectory2(projectRoot);
     } else if (!installedCreateMatches(projectRoot, operation)) {
       fail3("create_resume_conflict", ".kxm", "existing project configuration does not match the pinned create operation");
@@ -31188,7 +31262,7 @@ function applyOperation(projectRoot, original, options, resumed) {
   operation = updatePhase(projectRoot, operation, "verified");
   if (options.testFaultAt === "verified") throw new Error("injected init fault after verification");
   const files = operation.files.map((entry) => entry.path);
-  syncTreeDirectories(join23(projectRoot, ".kxm"));
+  syncTreeDirectories(join24(projectRoot, ".kxm"));
   return { kind: operation.kind, resumed, bundle, files };
 }
 function prepareAndApplyVnextCreate(projectRoot, rendered, options = {}) {
@@ -31303,7 +31377,7 @@ function finishPreparingOperation(projectRoot, operation, options) {
   const rendered = rendererForOperation(operation);
   if (!rendered) fail3("init_transaction_renderer_unavailable", TRANSACTION_NAME, "this binary cannot reproduce the pinned pre-application target");
   for (const directory of ["targets", "backups", "shadow"]) {
-    rmSync7(join23(transactionRoot(projectRoot), directory), { recursive: true, force: true });
+    rmSync8(join24(transactionRoot(projectRoot), directory), { recursive: true, force: true });
   }
   for (const entry of operation.files) {
     const bytes = rendered.files.get(entry.path);
@@ -31322,8 +31396,8 @@ function resumeVnextInitTransaction(projectRoot, options = {}) {
   let operation = readOperation(projectRoot, options.schemasDir);
   if (!operation) {
     const root = transactionRoot(projectRoot);
-    if (existsSync20(root)) {
-      rmSync7(root, { recursive: true, force: true });
+    if (existsSync21(root)) {
+      rmSync8(root, { recursive: true, force: true });
       syncDirectory2(projectRoot);
     }
     return void 0;
@@ -31338,10 +31412,10 @@ function commitVnextInitTransaction(projectRoot, schemasDir) {
     fail3("init_transaction_not_verified", TRANSACTION_NAME, "initialization transaction cannot commit before installed state is verified");
   }
   const transaction = transactionRoot(projectRoot);
-  const retired = join23(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
-  renameSync5(transaction, retired);
+  const retired = join24(projectRoot, `${TRANSACTION_NAME}-cleanup-${operation.operationId}-${randomUUID10()}`);
+  renameSync6(transaction, retired);
   syncDirectory2(projectRoot);
-  rmSync7(retired, { recursive: true, force: true });
+  rmSync8(retired, { recursive: true, force: true });
   syncDirectory2(projectRoot);
 }
 function inspectVnextInitTransaction(projectRoot, schemasDir) {
@@ -31447,7 +31521,7 @@ function validateBindingIdentities(bundle, persisted, explicit) {
 }
 function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock) {
   const storeOptions = bindingStoreOptions(options);
-  const persisted = existsSync21(join24(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
+  const persisted = existsSync22(join25(gitRoot, ".kxm", "project.yaml")) ? readVnextLocalBindings(gitRoot, storeOptions) : void 0;
   const repositoryBindings = Object.fromEntries([
     ...Object.entries(persisted?.repositories ?? {}),
     ...Object.entries(options.repositoryBindings ?? {})
@@ -31636,7 +31710,7 @@ function initializeVnextProjectAtGitRoot(start, gitRoot, options, mutationLock)
   const files = [...rendered.files.keys()];
   if (options.dryRun) return { action: "planned", plan, projectRoot: gitRoot, files };
   if (!mutationLock) throw new Error("project mutation lock is required to create configuration");
-  if (existsSync21(join24(gitRoot, ".kxm"))) {
+  if (existsSync22(join25(gitRoot, ".kxm"))) {
     throw new VnextConfigError([initIssue("workspace_changed", ".kxm", "workspace changed after planning; existing .kxm state was not overwritten")]);
   }
   const created = prepareAndApplyVnextCreate(gitRoot, rendered, transactionOptions);
@@ -31668,8 +31742,8 @@ function initializeVnextProject(start = process.cwd(), options = {}) {
 // plugins/kxm/src/vnext-migrate.ts
 var import_yaml12 = __toESM(require_dist(), 1);
 import { createHash as createHash13 } from "node:crypto";
-import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync22, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync18, openSync as openSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join25 } from "node:path";
+import { chmodSync as chmodSync6, closeSync as closeSync3, existsSync as existsSync23, fsyncSync as fsyncSync3, lstatSync as lstatSync8, mkdirSync as mkdirSync19, openSync as openSync3, readFileSync as readFileSync22, renameSync as renameSync7, rmSync as rmSync9, writeFileSync as writeFileSync18 } from "node:fs";
+import { join as join26 } from "node:path";
 var MAX_LEGACY_JSON_BYTES = 1024 * 1024;
 var MAX_LEGACY_JSON_DEPTH = 32;
 var MAX_LEGACY_JSON_NODES = 32768;
@@ -31838,12 +31912,12 @@ function readVnextLegacySources(root) {
     throw new VnextConfigError([migrateIssue("discovery", "legacy_source_limit", ".kxm/config", `legacy configuration exceeds ${MAX_LEGACY_SOURCES} files`)]);
   }
   return files.map((path4) => {
-    const absolute = join25(root, ...path4.split("/"));
+    const absolute = join26(root, ...path4.split("/"));
     const stat = lstatSync8(absolute);
     if (stat.isSymbolicLink() || !stat.isFile()) {
       throw new VnextConfigError([migrateIssue("path", "legacy_source_invalid", path4, "legacy configuration must be a regular file, not a link")]);
     }
-    const buffer = readFileSync21(absolute);
+    const buffer = readFileSync22(absolute);
     let text;
     try {
       text = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
@@ -32916,11 +32990,11 @@ function planVnextMigration(projectRoot, options = {}) {
   };
 }
 function readVnextMigrationDecisions(path4, schemasDir) {
-  if (!existsSync22(path4)) {
+  if (!existsSync23(path4)) {
     throw new VnextConfigError([migrateIssue("discovery", "decisions_missing", path4, "migration decisions file does not exist")]);
   }
   const registry = new VnextSchemaRegistry(schemasDir);
-  const value = parseRestrictedYaml2(readFileSync21(path4), path4);
+  const value = parseRestrictedYaml2(readFileSync22(path4), path4);
   const issues = registry.validateMigrationDecision(value, path4);
   if (issues.length > 0) throw new VnextConfigError(issues);
   return value;
@@ -32949,19 +33023,19 @@ function writeDurable2(path4, content) {
     const descriptor = openSync3(temp, "wx", 384);
     created = true;
     try {
-      writeFileSync17(descriptor, content);
+      writeFileSync18(descriptor, content);
       fsyncSync3(descriptor);
     } finally {
       closeSync3(descriptor);
     }
-    renameSync6(temp, path4);
+    renameSync7(temp, path4);
     try {
       chmodSync6(path4, 384);
     } catch {
     }
-    syncDirectory3(join25(path4, ".."));
+    syncDirectory3(join26(path4, ".."));
   } finally {
-    if (created && existsSync22(temp)) rmSync8(temp, { force: true });
+    if (created && existsSync23(temp)) rmSync9(temp, { force: true });
   }
 }
 function applyVnextMigration(projectRoot, options = {}) {
@@ -32971,8 +33045,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     ...options.schemasDir === void 0 ? {} : { schemasDir: options.schemasDir }
   };
   const execute = (lock) => {
-    const receiptAbsolute = join25(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
-    if (existsSync22(receiptAbsolute)) {
+    const receiptAbsolute = join26(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+    if (existsSync23(receiptAbsolute)) {
       const stat = lstatSync8(receiptAbsolute);
       if (stat.isSymbolicLink() || !stat.isFile()) {
         throw new VnextConfigError([migrateIssue("path", "migration_receipt_invalid", VNEXT_MIGRATION_RECEIPT_PATH, "migration receipt must be a regular file, not a link")]);
@@ -33025,7 +33099,7 @@ function applyVnextMigration(projectRoot, options = {}) {
       return { action: "planned", projectRoot: root, files: [], plan: first.plan };
     }
     const files = [...first.resources.entries()].sort(([left], [right]) => compareCodeUnits6(left, right)).map(([path4, value]) => ({ path: path4, bytes: Buffer.from((0, import_yaml12.stringify)(value, { lineWidth: 0 }), "utf8") }));
-    const collisions = files.filter((file) => existsSync22(join25(root, ...file.path.split("/"))));
+    const collisions = files.filter((file) => existsSync23(join26(root, ...file.path.split("/"))));
     if (collisions.length > 0) {
       throw new VnextConfigError(collisions.map((file) => migrateIssue("semantic", "migration_target_exists", file.path, "target resource already exists; refusing to overwrite")));
     }
@@ -33034,8 +33108,8 @@ function applyVnextMigration(projectRoot, options = {}) {
       const segments = file.path.split("/");
       let current = root;
       for (const segment of segments.slice(0, -1)) {
-        current = join25(current, segment);
-        if (!existsSync22(current)) continue;
+        current = join26(current, segment);
+        if (!existsSync23(current)) continue;
         const stat = lstatSync8(current);
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
           parentIssues.push(migrateIssue("path", "migration_target_parent_invalid", file.path, `migration target parent ${segment} must be a regular directory, not a link`));
@@ -33051,8 +33125,8 @@ function applyVnextMigration(projectRoot, options = {}) {
     const written = [];
     try {
       for (const file of files) {
-        const absolute = join25(root, ...file.path.split("/"));
-        mkdirSync18(join25(absolute, ".."), { recursive: true });
+        const absolute = join26(root, ...file.path.split("/"));
+        mkdirSync19(join26(absolute, ".."), { recursive: true });
         written.push(absolute);
         writeDurable2(absolute, file.bytes);
       }
@@ -33086,7 +33160,7 @@ ${bundle.configRevision}`).slice(7, 39)}`,
     } catch (error) {
       for (const absolute of written.reverse()) {
         try {
-          rmSync8(absolute, { force: true });
+          rmSync9(absolute, { force: true });
         } catch {
         }
       }
@@ -33098,8 +33172,8 @@ ${bundle.configRevision}`).slice(7, 39)}`,
 }
 function verifyVnextMigration(projectRoot, options = {}) {
   const root = migrationGitRoot(projectRoot);
-  const receiptAbsolute = join25(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
-  if (!existsSync22(receiptAbsolute)) {
+  const receiptAbsolute = join26(root, ...VNEXT_MIGRATION_RECEIPT_PATH.split("/"));
+  if (!existsSync23(receiptAbsolute)) {
     return {
       ok: false,
       projectRoot: root,
@@ -33396,7 +33470,7 @@ async function cmdBackup(runtime, options) {
   try {
     const { manifest, outDir } = createBackup({
       projectRoot: runtime.cwd,
-      ...options.out ? { outDir: resolve19(runtime.cwd, options.out) } : {}
+      ...options.out ? { outDir: resolve20(runtime.cwd, options.out) } : {}
     });
     const payload = {
       ok: true,
@@ -33408,7 +33482,7 @@ async function cmdBackup(runtime, options) {
     const summary = [
       `Created SQLite backup with ${manifest.stores.length} store(s):`,
       ...manifest.stores.map((s) => `  - ${s.storeId}: ${s.sourcePath} -> ${s.backupFile} (schema v${s.schemaVersion}, ${s.bytes} bytes, sha256 ${s.sha256.slice(0, 12)}...)`),
-      `Manifest: ${join26(outDir, "manifest.json")}`
+      `Manifest: ${join27(outDir, "manifest.json")}`
     ].join("\n");
     print(runtime.io, runtime.json, payload, summary);
     return 0;
@@ -33423,7 +33497,7 @@ async function cmdBackup(runtime, options) {
 }
 async function cmdRestore(runtime, manifestArg) {
   try {
-    const result = restoreBackup(resolve19(runtime.cwd, manifestArg), {
+    const result = restoreBackup(resolve20(runtime.cwd, manifestArg), {
       projectRoot: runtime.cwd
     });
     const payload = {
@@ -33683,7 +33757,7 @@ async function selectProducerModel(runtime, requested) {
   if (runtime.json || !process.stdin.isTTY || models.length === 0) return void 0;
   runtime.io.stdout(models.slice(0, 100).map((model, index2) => `${index2 + 1}. ${model}`).join("\n") + "\nSelect model number: ");
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve30) => rl.once("line", resolve30));
+  const answer = await new Promise((resolve31) => rl.once("line", resolve31));
   rl.close();
   const index = Number.parseInt(answer.trim(), 10) - 1;
   return Number.isInteger(index) && index >= 0 && index < models.length ? models[index] : void 0;
@@ -33709,7 +33783,7 @@ async function cmdModelsScreen(runtime) {
     return 2;
   }
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const ask = (q2) => new Promise((resolve30) => rl.question(q2, resolve30));
+  const ask = (q2) => new Promise((resolve31) => rl.question(q2, resolve31));
   try {
     while (true) {
       const policy = loadProducerPolicy(runtime.dirs.workdir);
@@ -33973,12 +34047,12 @@ async function cmdStudioLayout(runtime, workflowPath) {
     const projectRoot = discoverVnextProjectRoot(runtime.cwd) ?? runtime.cwd;
     let filePath = workflowPath;
     if (!filePath) {
-      filePath = resolve20(projectRoot, ".kxm", "workflows", "default.yaml");
+      filePath = resolve21(projectRoot, ".kxm", "workflows", "default.yaml");
     }
     let yamlContent;
     let workflowId = "default";
-    if (existsSync23(filePath)) {
-      yamlContent = readFileSync22(filePath, "utf8");
+    if (existsSync24(filePath)) {
+      yamlContent = readFileSync23(filePath, "utf8");
     } else {
       yamlContent = `schema: kxm.workflow.v1
 description: Feature implementation workflow
@@ -34051,15 +34125,15 @@ async function cmdStudioServe(runtime, options) {
       sessionToken,
       planProvider: () => {
         try {
-          const wfDir = join27(runtime.cwd, ".kxm", "workflows");
-          const defaultPath = join27(wfDir, "default.yaml");
-          let targetPath = existsSync23(defaultPath) ? defaultPath : void 0;
-          if (!targetPath && existsSync23(wfDir)) {
+          const wfDir = join28(runtime.cwd, ".kxm", "workflows");
+          const defaultPath = join28(wfDir, "default.yaml");
+          let targetPath = existsSync24(defaultPath) ? defaultPath : void 0;
+          if (!targetPath && existsSync24(wfDir)) {
             const yml = readdirSync8(wfDir).find((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
-            if (yml) targetPath = join27(wfDir, yml);
+            if (yml) targetPath = join28(wfDir, yml);
           }
-          if (targetPath && existsSync23(targetPath)) {
-            const raw = readFileSync22(targetPath, "utf8");
+          if (targetPath && existsSync24(targetPath)) {
+            const raw = readFileSync23(targetPath, "utf8");
             const parsed = (0, import_yaml13.parse)(raw);
             const wfId = basename6(targetPath).replace(/\.(yaml|yml)$/, "");
             return compileVnextWorkflow({ id: wfId, value: parsed });
@@ -34109,14 +34183,14 @@ Press Ctrl+C to stop.
 }
 
 // plugins/kxm/src/cli/context-skills.ts
-import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join31, relative as relative5 } from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import { join as join32, relative as relative5 } from "node:path";
 
 // plugins/kxm/src/memory.ts
 var import_yaml14 = __toESM(require_dist(), 1);
 import { randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync19, readdirSync as readdirSync9, readFileSync as readFileSync23, writeFileSync as writeFileSync18 } from "node:fs";
-import { extname as extname2, join as join28, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync20, readdirSync as readdirSync9, readFileSync as readFileSync24, writeFileSync as writeFileSync19 } from "node:fs";
+import { extname as extname2, join as join29, resolve as resolve22 } from "node:path";
 var MEMORY_SCHEMA = "kxm.memory.v1";
 var MEMORY_BRIEF_SCHEMA = "kxm.memory-brief.v1";
 var MEMORY_MARKER_START = "<!-- kxm:memory:start -->";
@@ -34242,21 +34316,21 @@ ${yamlText}
 `;
 }
 function memoryDirectories(repoRoot) {
-  const root = resolve21(repoRoot);
-  const memoryDir = join28(root, ".kxm", "memory");
-  const candidatesDir = join28(memoryDir, "candidates");
+  const root = resolve22(repoRoot);
+  const memoryDir = join29(root, ".kxm", "memory");
+  const candidatesDir = join29(memoryDir, "candidates");
   return { memoryDir, candidatesDir };
 }
 function loadAuthoredMemory(repoRoot) {
   const { memoryDir } = memoryDirectories(repoRoot);
-  if (!existsSync24(memoryDir)) return [];
+  if (!existsSync25(memoryDir)) return [];
   const records = [];
   const entries = readdirSync9(memoryDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && extname2(entry.name) === ".md") {
-      const fullPath = join28(memoryDir, entry.name);
+      const fullPath = join29(memoryDir, entry.name);
       try {
-        const text = readFileSync23(fullPath, "utf8");
+        const text = readFileSync24(fullPath, "utf8");
         const record = parseMemoryRecord(text, entry.name);
         if (record.lifecycle === "active") {
           records.push(record);
@@ -34270,7 +34344,7 @@ function loadAuthoredMemory(repoRoot) {
 }
 function createMemoryNote(repoRoot, summary, options = {}) {
   const { candidatesDir } = memoryDirectories(repoRoot);
-  mkdirSync19(candidatesDir, { recursive: true });
+  mkdirSync20(candidatesDir, { recursive: true });
   const scope = options.scope ?? "project";
   if (!VALID_SCOPES.has(scope)) {
     throw new Error(`invalid memory note scope: ${scope}; must be one of agent, project, run, operator`);
@@ -34295,8 +34369,8 @@ function createMemoryNote(repoRoot, summary, options = {}) {
     evidenceRefs: [],
     ...options.body ? { body: options.body.trim() } : {}
   };
-  const targetPath = join28(candidatesDir, `${id}.md`);
-  writeFileSync18(targetPath, formatMemoryRecord(record), "utf8");
+  const targetPath = join29(candidatesDir, `${id}.md`);
+  writeFileSync19(targetPath, formatMemoryRecord(record), "utf8");
   return { record, path: targetPath };
 }
 function generateMemoryBrief(repoRoot) {
@@ -34332,8 +34406,8 @@ function formatHarnessMemoryBlock(records) {
 }
 function updateHarnessDocument(filePath, block, defaultHeader) {
   let original = "";
-  if (existsSync24(filePath)) {
-    original = readFileSync23(filePath, "utf8");
+  if (existsSync25(filePath)) {
+    original = readFileSync24(filePath, "utf8");
   }
   let updated = "";
   if (original.includes(MEMORY_MARKER_START) && original.includes(MEMORY_MARKER_END)) {
@@ -34361,25 +34435,25 @@ ${block}
 `;
   }
   if (updated !== original) {
-    writeFileSync18(filePath, updated, "utf8");
+    writeFileSync19(filePath, updated, "utf8");
     return true;
   }
   return false;
 }
 function syncHarnessMemory(repoRoot) {
-  const root = resolve21(repoRoot);
+  const root = resolve22(repoRoot);
   const records = loadAuthoredMemory(root);
   const block = formatHarnessMemoryBlock(records);
   const updated = [];
   const created = [];
-  const agentsPath = join28(root, "AGENTS.md");
+  const agentsPath = join29(root, "AGENTS.md");
   const agentsHeader = "# AGENTS\n\nFollow project instructions.\n";
-  const agentsExisted = existsSync24(agentsPath);
+  const agentsExisted = existsSync25(agentsPath);
   if (updateHarnessDocument(agentsPath, block, agentsHeader)) {
     if (agentsExisted) updated.push("AGENTS.md");
     else created.push("AGENTS.md");
   }
-  const claudePath = join28(root, "CLAUDE.md");
+  const claudePath = join29(root, "CLAUDE.md");
   const claudeHeader = `# KXM (Claude)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34390,12 +34464,12 @@ you to implement. Default writer is native Grok CLI (\`grok --model grok-4.6\`).
 If \`grok\` is logged out, fail closed; do not fall back to Pi. Your reviews are
 artifacts, not hub \`peer-reply\` evidence.
 `;
-  const claudeExisted = existsSync24(claudePath);
+  const claudeExisted = existsSync25(claudePath);
   if (updateHarnessDocument(claudePath, block, claudeHeader)) {
     if (claudeExisted) updated.push("CLAUDE.md");
     else created.push("CLAUDE.md");
   }
-  const geminiPath = join28(root, "GEMINI.md");
+  const geminiPath = join29(root, "GEMINI.md");
   const geminiHeader = `# KXM (Gemini / Antigravity)
 
 Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
@@ -34404,7 +34478,7 @@ Follow [\`AGENTS.md\`](AGENTS.md). Official phase tracking:
 Google / Antigravity CLI (\`agy\`) is an admitted native writer and experiment edit route
 for Gemini models. Starting rotation remains Grok.
 `;
-  const geminiExisted = existsSync24(geminiPath);
+  const geminiExisted = existsSync25(geminiPath);
   if (updateHarnessDocument(geminiPath, block, geminiHeader)) {
     if (geminiExisted) updated.push("GEMINI.md");
     else created.push("GEMINI.md");
@@ -34415,8 +34489,8 @@ for Gemini models. Starting rotation remains Grok.
 // plugins/kxm/src/skills.ts
 var import_yaml15 = __toESM(require_dist(), 1);
 import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync20, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync9, statSync as statSync3, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync21, readdirSync as readdirSync10, readFileSync as readFileSync25, renameSync as renameSync8, rmSync as rmSync10, statSync as statSync3, writeFileSync as writeFileSync20 } from "node:fs";
+import { join as join30 } from "node:path";
 var SKILL_CANDIDATE_SCHEMA = "kxm.skill-candidate.v1";
 var SKILL_EVALUATION_SCHEMA = "kxm.skill-evaluation.v1";
 var SKILL_DECISION_SCHEMA = "kxm.skill-decision.v1";
@@ -34510,48 +34584,48 @@ var SkillLifecycle = class {
     this.allowOptimizationEvals = options.allowOptimizationEvals === true;
   }
   dir(state) {
-    return join29(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
+    return join30(this.root, state === "candidate" ? "candidates" : `${state}s`.replace("rejecteds", "rejected").replace("promoteds", "promoted"));
   }
   historyFile(id) {
-    return join29(this.root, "history", `${id}.jsonl`);
+    return join30(this.root, "history", `${id}.jsonl`);
   }
   paths(state, id) {
-    const dir = join29(this.dir(state), id);
-    return { dir, metadata: join29(dir, "metadata.json"), skill: join29(dir, "SKILL.md") };
+    const dir = join30(this.dir(state), id);
+    return { dir, metadata: join30(dir, "metadata.json"), skill: join30(dir, "SKILL.md") };
   }
   appendHistory(id, record) {
-    mkdirSync20(join29(this.root, "history"), { recursive: true });
+    mkdirSync21(join30(this.root, "history"), { recursive: true });
     const line = `${JSON.stringify(record)}
 `;
-    if (existsSync25(this.historyFile(id))) {
-      const existing = readFileSync24(this.historyFile(id), "utf8");
+    if (existsSync26(this.historyFile(id))) {
+      const existing = readFileSync25(this.historyFile(id), "utf8");
       const lines = existing.split("\n").filter((entry) => entry.trim());
-      writeFileSync19(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
+      writeFileSync20(this.historyFile(id), [...lines.slice(-499), line.trim()].join("\n") + "\n");
     } else {
-      writeFileSync19(this.historyFile(id), line);
+      writeFileSync20(this.historyFile(id), line);
     }
   }
   history(id) {
     const file = this.historyFile(id);
-    if (!existsSync25(file)) return [];
-    return readFileSync24(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+    if (!existsSync26(file)) return [];
+    return readFileSync25(file, "utf8").split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   }
   readMetadata(state, id) {
     const { metadata } = this.paths(state, id);
-    if (!existsSync25(metadata)) {
+    if (!existsSync26(metadata)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${state}`);
     }
-    return JSON.parse(readFileSync24(metadata, "utf8"));
+    return JSON.parse(readFileSync25(metadata, "utf8"));
   }
   move(from, to, id) {
-    const fromDir = join29(this.dir(from), id);
-    const toDir = join29(this.dir(to), id);
-    if (!existsSync25(fromDir)) {
+    const fromDir = join30(this.dir(from), id);
+    const toDir = join30(this.dir(to), id);
+    if (!existsSync26(fromDir)) {
       throw new SkillLifecycleError("skill_not_found", `skill ${id} not found in ${from}`);
     }
-    mkdirSync20(this.dir(to), { recursive: true });
-    if (existsSync25(toDir)) rmSync9(toDir, { recursive: true, force: true });
-    renameSync7(fromDir, toDir);
+    mkdirSync21(this.dir(to), { recursive: true });
+    if (existsSync26(toDir)) rmSync10(toDir, { recursive: true, force: true });
+    renameSync8(fromDir, toDir);
   }
   /** Submit a new skill candidate. Content is redacted of secret material at
    * creation; the ID is derived from name + content hash. */
@@ -34593,7 +34667,7 @@ var SkillLifecycle = class {
     const contentSha256 = skillContentSha256(content);
     const id = skillIdFor(name, contentSha256);
     const { dir, metadata, skill } = this.paths("candidate", id);
-    if (existsSync25(metadata)) {
+    if (existsSync26(metadata)) {
       throw new SkillLifecycleError(
         "skill_candidate_exists",
         `identical candidate ${id} already exists; changed behavior requires changed content`
@@ -34612,9 +34686,9 @@ var SkillLifecycle = class {
       createdAt: this.now(),
       ...input.supersedes ? { supersedes: input.supersedes } : {}
     };
-    mkdirSync20(dir, { recursive: true });
-    writeFileSync19(skill, content);
-    writeFileSync19(metadata, `${JSON.stringify(record, null, 2)}
+    mkdirSync21(dir, { recursive: true });
+    writeFileSync20(skill, content);
+    writeFileSync20(metadata, `${JSON.stringify(record, null, 2)}
 `);
     this.appendHistory(id, { schema: "kxm.skill-history-event.v1", event: "candidate_created", by: createdBy, supersedes: input.supersedes, at: record.createdAt });
     return record;
@@ -34703,18 +34777,18 @@ var SkillLifecycle = class {
     };
     const candidatePaths = this.paths("candidate", candidateId);
     const promotedPaths = this.paths("promoted", candidateId);
-    mkdirSync20(promotedPaths.dir, { recursive: true });
-    const skillContent = readFileSync24(candidatePaths.skill, "utf8");
-    const metadataContent = readFileSync24(candidatePaths.metadata, "utf8");
-    writeFileSync19(promotedPaths.skill, skillContent);
-    writeFileSync19(promotedPaths.metadata, metadataContent);
-    const patchesDir = join29(this.root, "patches");
-    mkdirSync20(patchesDir, { recursive: true });
-    const patchPath = join29(patchesDir, `${candidateId}.patch`);
+    mkdirSync21(promotedPaths.dir, { recursive: true });
+    const skillContent = readFileSync25(candidatePaths.skill, "utf8");
+    const metadataContent = readFileSync25(candidatePaths.metadata, "utf8");
+    writeFileSync20(promotedPaths.skill, skillContent);
+    writeFileSync20(promotedPaths.metadata, metadataContent);
+    const patchesDir = join30(this.root, "patches");
+    mkdirSync21(patchesDir, { recursive: true });
+    const patchPath = join30(patchesDir, `${candidateId}.patch`);
     const relSkillPath = `.kxm/skills/promoted/${candidateId}/SKILL.md`;
     const relMetaPath = `.kxm/skills/promoted/${candidateId}/metadata.json`;
     const patch = `${createUnifiedPatch(relSkillPath, skillContent)}${createUnifiedPatch(relMetaPath, metadataContent)}`;
-    writeFileSync19(patchPath, patch, "utf8");
+    writeFileSync20(patchPath, patch, "utf8");
     this.appendHistory(candidateId, record);
     return { ...metadata, patch, patchPath };
   }
@@ -34738,7 +34812,7 @@ var SkillLifecycle = class {
   verify(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    const content = readFileSync24(skill, "utf8");
+    const content = readFileSync25(skill, "utf8");
     if (skillContentSha256(content) !== metadata.contentSha256) {
       throw new SkillLifecycleError(
         "skill_integrity_violation",
@@ -34756,7 +34830,7 @@ var SkillLifecycle = class {
   }
   list(state) {
     const dir = this.dir(state);
-    if (!existsSync25(dir)) return [];
+    if (!existsSync26(dir)) return [];
     const ids = readdirSorted(dir);
     return ids.map((id) => {
       try {
@@ -34769,7 +34843,7 @@ var SkillLifecycle = class {
   read(state, id) {
     const metadata = this.readMetadata(state, id);
     const { skill } = this.paths(state, id);
-    return { metadata, content: readFileSync24(skill, "utf8") };
+    return { metadata, content: readFileSync25(skill, "utf8") };
   }
 };
 function boundedList(value, field) {
@@ -34784,18 +34858,18 @@ function boundedList(value, field) {
   return [...new Set(refs)];
 }
 function readdirSorted(dir) {
-  return readdirSync10(dir).filter((entry) => statSync3(join29(dir, entry)).isDirectory()).sort();
+  return readdirSync10(dir).filter((entry) => statSync3(join30(dir, entry)).isDirectory()).sort();
 }
 
 // plugins/kxm/src/wiki.ts
-import { mkdirSync as mkdirSync21, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join30 } from "node:path";
+import { mkdirSync as mkdirSync22, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join31 } from "node:path";
 function writeCompiledWiki(root, wiki) {
   const written = [];
   for (const [relativePath, content] of [...wiki.pages].sort(([left], [right]) => left.localeCompare(right))) {
-    const absolute = join30(root, relativePath);
-    mkdirSync21(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
-    writeFileSync20(absolute, content);
+    const absolute = join31(root, relativePath);
+    mkdirSync22(absolute.slice(0, absolute.lastIndexOf("/")), { recursive: true });
+    writeFileSync21(absolute, content);
     written.push(relativePath);
   }
   return written;
@@ -34961,7 +35035,7 @@ function skillStateFromFlag(value) {
   throw new Error(`invalid skill state ${value}`);
 }
 function skillsRoot(runtime) {
-  return join31(runtime.dirs.workdir, ".kxm", "skills");
+  return join32(runtime.dirs.workdir, ".kxm", "skills");
 }
 function csv(value) {
   if (!value) return void 0;
@@ -34978,7 +35052,7 @@ async function cmdSkillsCreate(runtime, options) {
     const metadata = lifecycle.create({
       name: options.name,
       description: options.description ?? "",
-      content: readFileSync25(options.file, "utf8"),
+      content: readFileSync26(options.file, "utf8"),
       createdBy: options.createdBy,
       sources: {
         runIds: csv(options.run) ?? [],
@@ -35136,8 +35210,8 @@ async function cmdMemorySync(runtime) {
 
 // plugins/kxm/src/cli/hub.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync31, mkdirSync as mkdirSync25, readFileSync as readFileSync31, readdirSync as readdirSync12, rmSync as rmSync10, writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join41, resolve as resolve24 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync26, readFileSync as readFileSync32, readdirSync as readdirSync12, rmSync as rmSync11, writeFileSync as writeFileSync24 } from "node:fs";
+import { join as join42, resolve as resolve25 } from "node:path";
 
 // node_modules/marked/lib/marked.esm.js
 function M() {
@@ -39299,10 +39373,10 @@ var TuiBase = class _TuiBase extends Container {
    * @returns Promise containing the parsed RGB color, or undefined if it times out or fails to parse.
    */
   queryTerminalBackgroundColor({ timeoutMs }) {
-    return new Promise((resolve30) => {
+    return new Promise((resolve31) => {
       const query = {
         settled: false,
-        resolve: resolve30,
+        resolve: resolve31,
         timer: void 0
       };
       query.timer = setTimeout(() => {
@@ -39325,7 +39399,7 @@ var TuiBase = class _TuiBase extends Container {
    * `CSI ? 997 ; 1 n` for dark or `CSI ? 997 ; 2 n` for light.
    */
   queryTerminalColorScheme({ timeoutMs }) {
-    return new Promise((resolve30) => {
+    return new Promise((resolve31) => {
       let settled = false;
       let timer;
       let unsubscribe = () => {
@@ -39339,7 +39413,7 @@ var TuiBase = class _TuiBase extends Container {
           timer = void 0;
         }
         unsubscribe();
-        resolve30(scheme);
+        resolve31(scheme);
       };
       unsubscribe = this.onTerminalColorSchemeChange(settle);
       timer = setTimeout(() => settle(void 0), timeoutMs);
@@ -41070,19 +41144,19 @@ import * as path2 from "node:path";
 
 // node_modules/@earendil-works/pi-tui/dist/native-module-path.js
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname16, join as join32 } from "node:path";
+import { dirname as dirname17, join as join33 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleRequire = createRequire2(import.meta.url);
 var TUI_PACKAGE_NAME = "@earendil-works/pi-tui";
 function getNativeModuleCandidates(nativePath, options = {}) {
-  const moduleDir = dirname16(fileURLToPath2(options.moduleUrl ?? import.meta.url));
+  const moduleDir = dirname17(fileURLToPath2(options.moduleUrl ?? import.meta.url));
   const candidates = [];
   try {
     const packageEntry = (options.resolvePackage ?? moduleRequire.resolve)(TUI_PACKAGE_NAME);
-    candidates.push(join32(dirname16(packageEntry), "..", nativePath));
+    candidates.push(join33(dirname17(packageEntry), "..", nativePath));
   } catch {
   }
-  candidates.push(join32(moduleDir, "..", nativePath), join32(moduleDir, nativePath), join32(dirname16(options.execPath ?? process.execPath), nativePath));
+  candidates.push(join33(moduleDir, "..", nativePath), join33(moduleDir, nativePath), join33(dirname17(options.execPath ?? process.execPath), nativePath));
   return Array.from(new Set(candidates));
 }
 
@@ -41423,7 +41497,7 @@ var ProcessTerminal = class {
           break;
         if (now - lastDataTime >= idleMs)
           break;
-        await new Promise((resolve30) => setTimeout(resolve30, Math.min(idleMs, timeLeft)));
+        await new Promise((resolve31) => setTimeout(resolve31, Math.min(idleMs, timeLeft)));
       }
     } finally {
       process.stdin.removeListener("data", onData);
@@ -43538,8 +43612,8 @@ var TuiAltScreen = class extends TuiBase {
 var MAX_RENDER_WRITE_CHARS = 1024 * 1024;
 
 // plugins/kxm/src/tui.ts
-import { mkdirSync as mkdirSync22 } from "node:fs";
-import { join as join36, resolve as resolve23, dirname as dirname17 } from "node:path";
+import { mkdirSync as mkdirSync23 } from "node:fs";
+import { join as join37, resolve as resolve24, dirname as dirname18 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // plugins/kxm/src/external-effects.ts
@@ -43550,9 +43624,9 @@ function slugifyBranchPart(text, maxLength = 40) {
 }
 
 // plugins/kxm/src/local-snapshot.ts
-import { existsSync as existsSync26, readdirSync as readdirSync11, readFileSync as readFileSync26 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { isAbsolute as isAbsolute7, join as join35, resolve as resolve22 } from "node:path";
+import { existsSync as existsSync27, readdirSync as readdirSync11, readFileSync as readFileSync27 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { isAbsolute as isAbsolute8, join as join36, resolve as resolve23 } from "node:path";
 function processExists2(pid) {
   try {
     process.kill(pid, 0);
@@ -43672,36 +43746,36 @@ function readOpenMessageMetadata(database) {
   return messages;
 }
 function resolveKxmSnapshotPaths(cwd, env = process.env) {
-  const stateDir = env.KXM_STATE_DIR?.trim() || join35(cwd, ".kxm", "state");
+  const stateDir = env.KXM_STATE_DIR?.trim() || join36(cwd, ".kxm", "state");
   const configured = env.KXM_DATA_PATH?.trim();
-  const dataPath = configured ? resolve22(cwd, configured) : join35(stateDir, "kxm.db");
+  const dataPath = configured ? resolve23(cwd, configured) : join36(stateDir, "kxm.db");
   return { dataPath, stateDir };
 }
 function resolveVnextStateRoot(stateDir, options) {
-  if (options?.vnextStateRoot && existsSync26(options.vnextStateRoot)) {
-    return resolve22(options.vnextStateRoot);
+  if (options?.vnextStateRoot && existsSync27(options.vnextStateRoot)) {
+    return resolve23(options.vnextStateRoot);
   }
-  if (existsSync26(join35(stateDir, "runtime", "registry.db")) || existsSync26(join35(stateDir, "runtime", "projects"))) {
+  if (existsSync27(join36(stateDir, "runtime", "registry.db")) || existsSync27(join36(stateDir, "runtime", "projects"))) {
     return stateDir;
   }
   const env = options?.env ?? process.env;
   const explicit = env.KXM_STATE_HOME?.trim() || env.KXM_USER_STATE_DIR?.trim() || env.KXM_STATE_ROOT?.trim();
-  if (explicit && isAbsolute7(explicit) && existsSync26(resolve22(explicit))) {
-    return resolve22(explicit);
+  if (explicit && isAbsolute8(explicit) && existsSync27(resolve23(explicit))) {
+    return resolve23(explicit);
   }
   let base;
   if (process.platform === "win32") {
     const localAppData = env.LOCALAPPDATA?.trim();
-    base = localAppData && isAbsolute7(localAppData) ? localAppData : join35(homedir5(), "AppData", "Local");
-    base = resolve22(base, "KXM");
+    base = localAppData && isAbsolute8(localAppData) ? localAppData : join36(homedir6(), "AppData", "Local");
+    base = resolve23(base, "KXM");
   } else if (process.platform === "darwin") {
-    base = resolve22(homedir5(), "Library", "Application Support", "KXM");
+    base = resolve23(homedir6(), "Library", "Application Support", "KXM");
   } else {
     const xdgState = env.XDG_STATE_HOME?.trim();
-    base = xdgState && isAbsolute7(xdgState) ? xdgState : join35(homedir5(), ".local", "state");
-    base = resolve22(base, "kxm");
+    base = xdgState && isAbsolute8(xdgState) ? xdgState : join36(homedir6(), ".local", "state");
+    base = resolve23(base, "kxm");
   }
-  if (existsSync26(base)) return base;
+  if (existsSync27(base)) return base;
   return void 0;
 }
 function loadLocalMeshSnapshot(dataPath, stateDir, options) {
@@ -43712,7 +43786,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let legacyRuns = [];
   let legacyRunTotal = 0;
   let plans = [];
-  if (existsSync26(dataPath)) {
+  if (existsSync27(dataPath)) {
     hasLegacy = true;
     const database = new DatabaseSync(dataPath, { readOnly: true });
     try {
@@ -43732,11 +43806,11 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   let vnextRunTotal = 0;
   const vnextStateRoot = resolveVnextStateRoot(stateDir, options);
   if (vnextStateRoot) {
-    const runtimeDir = join35(vnextStateRoot, "runtime");
-    const registryDbPath = join35(runtimeDir, "registry.db");
-    const projectsDir = join35(runtimeDir, "projects");
+    const runtimeDir = join36(vnextStateRoot, "runtime");
+    const registryDbPath = join36(runtimeDir, "registry.db");
+    const projectsDir = join36(runtimeDir, "projects");
     const projectKeys = /* @__PURE__ */ new Set();
-    if (existsSync26(registryDbPath)) {
+    if (existsSync27(registryDbPath)) {
       hasVnext = true;
       try {
         const regDb = new DatabaseSync(registryDbPath, { readOnly: true });
@@ -43752,7 +43826,7 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       } catch {
       }
     }
-    if (existsSync26(projectsDir)) {
+    if (existsSync27(projectsDir)) {
       try {
         for (const entry of readdirSync11(projectsDir, { withFileTypes: true })) {
           if (entry.isDirectory()) {
@@ -43763,8 +43837,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
       }
     }
     for (const key of projectKeys) {
-      const eventDbPath = join35(projectsDir, key, "run-events.db");
-      if (existsSync26(eventDbPath)) {
+      const eventDbPath = join36(projectsDir, key, "run-events.db");
+      if (existsSync27(eventDbPath)) {
         hasVnext = true;
         try {
           const eventDb = new DatabaseSync(eventDbPath, { readOnly: true });
@@ -43794,10 +43868,10 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
     }
   }
   const pids = [];
-  if (existsSync26(stateDir)) {
+  if (existsSync27(stateDir)) {
     for (const file of readdirSync11(stateDir).filter((name) => name.endsWith(".pid"))) {
       try {
-        const record = JSON.parse(readFileSync26(join35(stateDir, file), "utf8"));
+        const record = JSON.parse(readFileSync27(join36(stateDir, file), "utf8"));
         pids.push({
           file,
           ...record.role ? { role: record.role } : {},
@@ -43836,8 +43910,8 @@ function loadLocalMeshSnapshot(dataPath, stateDir, options) {
   } else {
     source = "legacy";
   }
-  const telemetryFile = join35(stateDir, "telemetry.jsonl");
-  const spend = existsSync26(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
+  const telemetryFile = join36(stateDir, "telemetry.jsonl");
+  const spend = existsSync27(telemetryFile) ? readRoutingRecords(telemetryFile) : [];
   return {
     source,
     agents: agents.sort((a, b2) => Number(b2.online) - Number(a.online) || a.name.localeCompare(b2.name)),
@@ -43971,11 +44045,11 @@ function spawnDegradeWorktree(repoRoot, runId, options) {
   const cleanRunId = runId.replace(/^run_/, "");
   const desc = options?.description ? slugifyBranchPart(options.description, 30) : "degrade";
   const branchName = `kxm/run-${cleanRunId}-${desc}`;
-  const relativeWtPath = join36(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
-  const absoluteWtPath = resolve23(repoRoot, relativeWtPath);
+  const relativeWtPath = join37(".kxm", "worktrees", `run-${cleanRunId}-${desc}`);
+  const absoluteWtPath = resolve24(repoRoot, relativeWtPath);
   const jumpCommand = `cd "${absoluteWtPath}"`;
   try {
-    mkdirSync22(dirname17(absoluteWtPath), { recursive: true });
+    mkdirSync23(dirname18(absoluteWtPath), { recursive: true });
     const branchCheck = runner("git", ["rev-parse", "--verify", `refs/heads/${branchName}`]);
     let wtRes;
     if (branchCheck.status === 0) {
@@ -44374,11 +44448,11 @@ async function readJson(response) {
 }
 async function waitForReconnect(signal, milliseconds = 1e3) {
   if (signal.aborted) return;
-  await new Promise((resolve30) => {
+  await new Promise((resolve31) => {
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve30();
+      resolve31();
     };
     const timer = setTimeout(done, milliseconds);
     timer.unref();
@@ -44741,8 +44815,8 @@ async function runMeshTui(input) {
 // plugins/kxm/src/session-work.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID13 } from "node:crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync23, readFileSync as readFileSync27, renameSync as renameSync8, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join37 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync24, readFileSync as readFileSync28, renameSync as renameSync9, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join38 } from "node:path";
 var MAX_SESSION_BRIEF_TASKS = 5;
 var MAX_SESSION_BRIEF_PLANS = 5;
 var SESSION_BRIEF_SCHEMA = "kxm.session-brief.v1";
@@ -44898,10 +44972,10 @@ function buildSessionBrief(snapshot, current, hub, ship, updateLatest, cost, ses
   };
 }
 function readCachedSessionBrief(stateDir) {
-  const file = join37(stateDir, "session-brief.json");
+  const file = join38(stateDir, "session-brief.json");
   try {
-    if (!existsSync27(file)) return void 0;
-    const raw = readFileSync27(file, "utf8");
+    if (!existsSync28(file)) return void 0;
+    const raw = readFileSync28(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && parsed.schema === "kxm.session-brief.v1" && typeof parsed.generatedAt === "string") {
       const ageMs = Date.now() - Date.parse(parsed.generatedAt);
@@ -44916,18 +44990,18 @@ function readCachedSessionBrief(stateDir) {
 }
 function writeCachedSessionBrief(stateDir, brief) {
   try {
-    mkdirSync23(stateDir, { recursive: true, mode: 448 });
-    const file = join37(stateDir, "session-brief.json");
+    mkdirSync24(stateDir, { recursive: true, mode: 448 });
+    const file = join38(stateDir, "session-brief.json");
     const tmp = `${file}.tmp.${randomUUID13().slice(0, 8)}`;
-    writeFileSync21(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
-    renameSync8(tmp, file);
+    writeFileSync22(tmp, JSON.stringify(brief, null, 2), { encoding: "utf8", mode: 384 });
+    renameSync9(tmp, file);
   } catch {
   }
 }
 function estimateSessionCost(stateDir) {
   try {
-    const telemetryFile = join37(stateDir, "telemetry.jsonl");
-    if (!existsSync27(telemetryFile)) return void 0;
+    const telemetryFile = join38(stateDir, "telemetry.jsonl");
+    if (!existsSync28(telemetryFile)) return void 0;
     const records = readRoutingRecords(telemetryFile);
     if (records.length === 0) return void 0;
     let totalCost = 0;
@@ -45095,11 +45169,11 @@ function formatSessionBriefText(brief) {
 }
 
 // plugins/kxm/src/kxm-install-kind.ts
-import { existsSync as existsSync28, readFileSync as readFileSync28 } from "node:fs";
-import { dirname as dirname18, join as join38 } from "node:path";
+import { existsSync as existsSync29, readFileSync as readFileSync29 } from "node:fs";
+import { dirname as dirname19, join as join39 } from "node:path";
 function packageIsKxm(root) {
   try {
-    const pkg = JSON.parse(readFileSync28(join38(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync29(join39(root, "package.json"), "utf8"));
     return pkg.name === "@kontextmind/kxm";
   } catch {
     return false;
@@ -45148,12 +45222,12 @@ function report(kind, root) {
   return { kind, root, instruction: installKindInstruction(kind, root) };
 }
 function classifyInstallRoot(probe) {
-  const piGitRoot = join38(probe.homeDir, ".pi", "agent", "git");
+  const piGitRoot = join39(probe.homeDir, ".pi", "agent", "git");
   if (isUnder(probe.repoRoot, piGitRoot, probe.platform)) return report("pi-git", probe.repoRoot);
-  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join38(probe.homeDir, ".claude");
-  const pluginsRoot = join38(claudeHome, "plugins");
+  const claudeHome = probe.env.CLAUDE_CONFIG_DIR?.trim() || join39(probe.homeDir, ".claude");
+  const pluginsRoot = join39(claudeHome, "plugins");
   if (isUnder(probe.moduleDir, pluginsRoot, probe.platform)) return report("claude-marketplace", probe.moduleDir);
-  const hasGit = existsSync28(join38(probe.repoRoot, ".git"));
+  const hasGit = existsSync29(join39(probe.repoRoot, ".git"));
   if (hasGit && packageIsKxm(probe.repoRoot)) return report("source", probe.repoRoot);
   if (isNpmPackageLayout(probe.repoRoot, probe.platform) && packageIsKxm(probe.repoRoot) && !hasGit) {
     return report("npm-package", probe.repoRoot);
@@ -45167,21 +45241,21 @@ function resolveInstallKind(probe, npmGlobalRoot) {
   if (typeof globalRoot !== "string" || globalRoot.trim() === "") {
     return report("unknown", classified.root);
   }
-  const expected = dirname18(dirname18(classified.root));
+  const expected = dirname19(dirname19(classified.root));
   if (sameHostPath2(globalRoot.trim(), expected, probe.platform)) return report("npm-global", classified.root);
   return report("npm-local", classified.root);
 }
 
 // plugins/kxm/src/kxm-update-config.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync29, readFileSync as readFileSync29 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync30 } from "node:fs";
+import { join as join40 } from "node:path";
 function loadKxmUpdateConfig(env = process.env) {
-  const path4 = join39(vnextUserStateRoot({ env }), "update.yaml");
-  if (!existsSync29(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
+  const path4 = join40(vnextUserStateRoot({ env }), "update.yaml");
+  if (!existsSync30(path4)) return { schema: KXM_UPDATE_SCHEMA, auto: false, source: "github" };
   let parsed;
   try {
-    parsed = (0, import_yaml16.parse)(readFileSync29(path4, "utf8"));
+    parsed = (0, import_yaml16.parse)(readFileSync30(path4, "utf8"));
   } catch {
     throw new KxmUpdateConfigError("update.yaml is not valid YAML");
   }
@@ -45207,8 +45281,8 @@ function loadKxmUpdateConfig(env = process.env) {
 }
 
 // plugins/kxm/src/session.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync24, readFileSync as readFileSync30, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join40 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync25, readFileSync as readFileSync31, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join41 } from "node:path";
 var SESSION_SCHEMA = "kxm.session.v1";
 var SessionConfigError = class extends Error {
   code = "session_config_invalid";
@@ -45218,12 +45292,12 @@ var SessionConfigError = class extends Error {
   }
 };
 function workflowAssetDirs(assetsDir, workflowId) {
-  const root = join40(assetsDir, "workflows", workflowId);
-  return [root, join40(root, "inputs"), join40(root, "outputs"), join40(root, "generated")];
+  const root = join41(assetsDir, "workflows", workflowId);
+  return [root, join41(root, "inputs"), join41(root, "outputs"), join41(root, "generated")];
 }
 function sessionAssetDirs(assetsDir, sessionId) {
-  const root = join40(assetsDir, "sessions", sessionId);
-  return [root, join40(root, "inputs"), join40(root, "outputs")];
+  const root = join41(assetsDir, "sessions", sessionId);
+  return [root, join41(root, "inputs"), join41(root, "outputs")];
 }
 function rosterNames(configDir) {
   return [...loadRosterMap(configDir).values()].map((row) => String(row.name));
@@ -45273,7 +45347,7 @@ function workerFromRosterRow(name, row, project) {
 function loadRosterMap(configDir) {
   const byName = /* @__PURE__ */ new Map();
   for (const [file, key] of [["agents.json", "agents"], ["gates.json", "gates"]]) {
-    const path4 = join40(configDir, file);
+    const path4 = join41(configDir, file);
     for (const row of loadRoster(path4, key)) {
       const name = String(row.name).trim();
       const lowered = name.toLowerCase();
@@ -45287,10 +45361,10 @@ function loadRosterMap(configDir) {
   return byName;
 }
 function loadRoster(path4, key) {
-  if (!existsSync30(path4)) return [];
+  if (!existsSync31(path4)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync30(path4, "utf8"));
+    parsed = JSON.parse(readFileSync31(path4, "utf8"));
   } catch (error) {
     throw new SessionConfigError(
       `${key} roster at ${path4} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
@@ -45315,7 +45389,7 @@ function loadRoster(path4, key) {
   });
 }
 function createSession(input) {
-  const assetDir = input.mode === "workflow" && input.workflowId ? join40("assets", "workflows", input.workflowId) : join40("assets", "sessions", input.id);
+  const assetDir = input.mode === "workflow" && input.workflowId ? join41("assets", "workflows", input.workflowId) : join41("assets", "sessions", input.id);
   return {
     schema: SESSION_SCHEMA,
     id: input.id,
@@ -45328,11 +45402,11 @@ function createSession(input) {
   };
 }
 function writeSession(assetsDir, session, dryRun = false) {
-  const dir = join40(assetsDir, "sessions", session.id);
-  const path4 = join40(dir, "session.json");
+  const dir = join41(assetsDir, "sessions", session.id);
+  const path4 = join41(dir, "session.json");
   if (!dryRun) {
-    mkdirSync24(dir, { recursive: true });
-    writeFileSync22(path4, `${JSON.stringify(session, null, 2)}
+    mkdirSync25(dir, { recursive: true });
+    writeFileSync23(path4, `${JSON.stringify(session, null, 2)}
 `, { encoding: "utf8" });
   }
   return path4;
@@ -45340,8 +45414,8 @@ function writeSession(assetsDir, session, dryRun = false) {
 
 // plugins/kxm/src/cli/hub.ts
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname19 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { dirname as dirname20 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 async function hubGet(url, fetchImpl) {
   try {
     const response = await fetchImpl(url);
@@ -45359,23 +45433,23 @@ async function hubGet(url, fetchImpl) {
 function installProbeFrom(runtime) {
   const partial = runtime.io.installProbe ?? {};
   return {
-    moduleDir: partial.moduleDir ?? dirname19(fileURLToPath3(import.meta.url)),
-    repoRoot: partial.repoRoot ?? resolve24("."),
-    homeDir: partial.homeDir ?? homedir6(),
+    moduleDir: partial.moduleDir ?? dirname20(fileURLToPath3(import.meta.url)),
+    repoRoot: partial.repoRoot ?? resolve25("."),
+    homeDir: partial.homeDir ?? homedir7(),
     platform: partial.platform ?? process.platform,
     env: partial.env ?? runtime.env
   };
 }
 function warnIgnoredProjectUpdateYaml(runtime) {
-  const projectFile = join41(runtime.dirs.workspace, "update.yaml");
-  if (!existsSync31(projectFile)) return;
-  const userFile = join41(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+  const projectFile = join42(runtime.dirs.workspace, "update.yaml");
+  if (!existsSync32(projectFile)) return;
+  const userFile = join42(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
   runtime.io.stderr(`kxm: ignoring .kxm/update.yaml in ${runtime.dirs.workdir}; update settings are read only from ${userFile}
 `);
 }
 async function refreshKxmUpdateNotice(runtime, config) {
   const resolved = config ?? loadKxmUpdateConfig(runtime.env);
-  const current = readInstalledKxmVersion(resolve24("."));
+  const current = readInstalledKxmVersion(resolve25("."));
   const fetched = await fetchLatestKxmVersion(resolved.source, runtime.env, runtime.fetchImpl);
   const notice = noticeFromVersions(current, fetched.latest, resolved, fetched.error, fetched.asset);
   writeUpdateCache(runtime.dirs.state, notice);
@@ -45395,7 +45469,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const screen = requested;
-  const dataPath = resolve24(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join42(runtime.dirs.state, "kxm.db"));
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, {
       ok: true,
@@ -45412,7 +45486,7 @@ async function cmdDash(runtime, options = {}) {
     return 2;
   }
   const project = defaultProjectName(runtime.dirs.workdir, runtime.env) || "project";
-  const authToken = runtime.env.KXM_AUTH_TOKEN?.trim();
+  const authToken = resolveClientHubAuthToken(runtime.env, project);
   return await runMeshTui({
     serverUrl: runtime.serverUrl,
     dataPath,
@@ -45441,7 +45515,7 @@ async function cmdHub(runtime) {
         config = loadKxmUpdateConfig(runtime.env);
       } catch (error) {
         if (error instanceof KxmUpdateConfigError) {
-          const yamlPath = join41(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
+          const yamlPath = join42(vnextUserStateRoot({ env: runtime.env }), "update.yaml");
           runtime.io.stderr(`kxm: ${error.message}; update check skipped; fix or remove ${yamlPath}
 `);
         } else {
@@ -45577,7 +45651,7 @@ async function cmdWorker(runtime, options) {
   return await (runtime.io.spawnWorker ?? ((launchEnv) => spawnScript("kxm-worker.mjs", launchEnv)))(extraEnv);
 }
 async function cmdStop(runtime, waitMsFlag) {
-  const pids = existsSync31(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
+  const pids = existsSync32(runtime.dirs.state) ? readdirSync12(runtime.dirs.state).filter((name) => name.endsWith(".pid")) : [];
   if (runtime.dryRun) {
     print(runtime.io, runtime.json, { ok: true, command: "stop", dryRun: true, pidFiles: pids }, "would signal pid files");
     return 0;
@@ -45592,7 +45666,7 @@ async function cmdStop(runtime, waitMsFlag) {
   const orphans = [];
   for (const file of pids) {
     try {
-      const record = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+      const record = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
       const expectedControl = file === "hub.pid" ? "hub.stop" : file.startsWith("worker-") ? `${file.slice(0, -4)}.stop` : void 0;
       const expectedRole = file === "hub.pid" ? "hub" : file.startsWith("worker-") ? "worker" : void 0;
       if (record.version !== 1 || !Number.isInteger(record.pid) || record.pid <= 0 || !record.startedAt || !expectedControl || record.controlFile !== expectedControl || record.role !== expectedRole) {
@@ -45612,7 +45686,7 @@ async function cmdStop(runtime, waitMsFlag) {
         ignored.push(file);
         continue;
       }
-      writeFileSync23(join41(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+      writeFileSync24(join42(runtime.dirs.state, record.controlFile), `${JSON.stringify({ startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {}, requestedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `, { encoding: "utf8", mode: 384 });
       requested.push(file);
       records.set(file, { pid: record.pid, startedAt: record.startedAt, ...record.generation ? { generation: record.generation } : {} });
@@ -45630,7 +45704,7 @@ async function cmdStop(runtime, waitMsFlag) {
   while (Date.now() <= deadline && stopped.size < requested.length) {
     for (const [file, record] of records) {
       try {
-        const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
         if (current.pid !== record.pid || current.startedAt !== record.startedAt || current.generation !== record.generation || !processExists(record.pid)) stopped.add(file);
       } catch {
         stopped.add(file);
@@ -45643,7 +45717,7 @@ async function cmdStop(runtime, waitMsFlag) {
   for (const file of orphans) {
     while (Date.now() <= deadlineOrphans) {
       try {
-        const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+        const current = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
         if (!Number.isInteger(current.serverPid) || !processExists(current.serverPid)) break;
       } catch {
         break;
@@ -45651,14 +45725,14 @@ async function cmdStop(runtime, waitMsFlag) {
       await (runtime.io.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms))))(100);
     }
     try {
-      const current = JSON.parse(readFileSync31(join41(runtime.dirs.state, file), "utf8"));
+      const current = JSON.parse(readFileSync32(join42(runtime.dirs.state, file), "utf8"));
       if (Number.isInteger(current.serverPid) && processExists(current.serverPid)) {
         try {
           process.kill(current.serverPid, "SIGKILL");
         } catch {
         }
       }
-      rmSync10(join41(runtime.dirs.state, file), { force: true });
+      rmSync11(join42(runtime.dirs.state, file), { force: true });
     } catch {
     }
     stopped.add(file);
@@ -45669,11 +45743,11 @@ async function cmdStop(runtime, waitMsFlag) {
 }
 async function cmdSessionStatus(runtime) {
   const stateDir = runtime.dirs.state;
-  const names3 = existsSync31(stateDir) ? readdirSync12(stateDir) : [];
+  const names3 = existsSync32(stateDir) ? readdirSync12(stateDir) : [];
   const claims = [];
   for (const file of names3.filter((name) => name.endsWith(".pid"))) {
     try {
-      const record = JSON.parse(readFileSync31(join41(stateDir, file), "utf8"));
+      const record = JSON.parse(readFileSync32(join42(stateDir, file), "utf8"));
       claims.push({
         file,
         role: record.role,
@@ -45688,7 +45762,7 @@ async function cmdSessionStatus(runtime) {
   const recoveries = [];
   for (const file of names3.filter((name) => name.startsWith("worker-recovery-") && name.endsWith(".json"))) {
     try {
-      const envelope = JSON.parse(readFileSync31(join41(stateDir, file), "utf8"));
+      const envelope = JSON.parse(readFileSync32(join42(stateDir, file), "utf8"));
       recoveries.push({
         file,
         reason: envelope.reason,
@@ -45793,7 +45867,7 @@ async function cmdSessionBrief(runtime, options = {}) {
     print(runtime.io, runtime.json, { ok: true, command: "session brief", sessionToken }, sessionToken);
     return 0;
   }
-  const dataPath = resolve24(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join41(runtime.dirs.state, "kxm.db"));
+  const dataPath = resolve25(runtime.dirs.workdir, runtime.env.KXM_DATA_PATH?.trim() || join42(runtime.dirs.state, "kxm.db"));
   const env = {
     ...runtime.env,
     KXM_STATE_DIR: runtime.dirs.state,
@@ -45869,7 +45943,7 @@ async function cmdSessionStart(runtime, options) {
     ...workflowId ? workflowAssetDirs(runtime.dirs.assets, workflowId) : []
   ];
   if (!runtime.dryRun) {
-    for (const directory of created) mkdirSync25(directory, { recursive: true });
+    for (const directory of created) mkdirSync26(directory, { recursive: true });
     writeSession(runtime.dirs.assets, session);
   }
   print(runtime.io, runtime.json, {
@@ -45885,15 +45959,15 @@ async function cmdSessionStart(runtime, options) {
 // plugins/kxm/src/cli/system.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync37, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync12 } from "node:fs";
+import { existsSync as existsSync38, mkdtempSync as mkdtempSync2, readFileSync as readFileSync37, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join47, resolve as resolve28 } from "node:path";
+import { join as join48, resolve as resolve29 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // plugins/kxm/src/improve.ts
 import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join42, relative as relative6, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync27, writeFileSync as writeFileSync25 } from "node:fs";
+import { join as join43, relative as relative6, resolve as resolve26 } from "node:path";
 var CANDIDATE_SCHEMA = "kxm.candidate.v1";
 var IMPROVEMENT_REPORT_SCHEMA = "kxm.improvement-report.v2";
 function classifyCandidateKind(stepId, agentRole) {
@@ -46064,8 +46138,8 @@ function groupRoutingRecords(records, options = {}) {
   });
 }
 function buildImprovementReport(records, options = {}) {
-  const projectRoot = options.projectRoot ? resolve25(options.projectRoot) : process.cwd();
-  const candidatesDir = options.candidatesDir ? resolve25(options.candidatesDir) : join42(projectRoot, ".kxm", "candidates");
+  const projectRoot = options.projectRoot ? resolve26(options.projectRoot) : process.cwd();
+  const candidatesDir = options.candidatesDir ? resolve26(options.candidatesDir) : join43(projectRoot, ".kxm", "candidates");
   const groups = groupRoutingRecords(records, options);
   const candidates = [];
   for (const group of groups) {
@@ -46077,7 +46151,7 @@ function buildImprovementReport(records, options = {}) {
       group.workflowHash
     );
     const diffFileName = `${group.candidateId}.diff`;
-    const diffFilePath = join42(candidatesDir, diffFileName);
+    const diffFilePath = join43(candidatesDir, diffFileName);
     const relDiffPath = relative6(projectRoot, diffFilePath).replace(/\\/g, "/");
     const candidate = {
       schema: CANDIDATE_SCHEMA,
@@ -46099,12 +46173,12 @@ function buildImprovementReport(records, options = {}) {
       createdAt: nowIso()
     };
     if (!options.dryRun) {
-      if (!existsSync32(candidatesDir)) {
-        mkdirSync26(candidatesDir, { recursive: true });
+      if (!existsSync33(candidatesDir)) {
+        mkdirSync27(candidatesDir, { recursive: true });
       }
-      writeFileSync24(diffFilePath, diff, "utf8");
-      const jsonFilePath = join42(candidatesDir, `${group.candidateId}.json`);
-      writeFileSync24(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
+      writeFileSync25(diffFilePath, diff, "utf8");
+      const jsonFilePath = join43(candidatesDir, `${group.candidateId}.json`);
+      writeFileSync25(jsonFilePath, JSON.stringify(candidate, null, 2) + "\n", "utf8");
     }
     candidates.push(candidate);
   }
@@ -46119,10 +46193,10 @@ function buildImprovementReport(records, options = {}) {
 }
 function writeImprovementReport(improvementsDir, report2, dryRun = false) {
   const stamp = report2.createdAt.replace(/[:.]/g, "-");
-  const path4 = join42(improvementsDir, `${stamp}.json`);
+  const path4 = join43(improvementsDir, `${stamp}.json`);
   if (!dryRun) {
-    mkdirSync26(improvementsDir, { recursive: true });
-    writeFileSync24(path4, `${JSON.stringify(report2, null, 2)}
+    mkdirSync27(improvementsDir, { recursive: true });
+    writeFileSync25(path4, `${JSON.stringify(report2, null, 2)}
 `, { encoding: "utf8" });
   }
   return path4;
@@ -46162,8 +46236,8 @@ function formatImprovementReport(report2) {
 
 // plugins/kxm/src/modes.ts
 var import_yaml17 = __toESM(require_dist(), 1);
-import { existsSync as existsSync33, readFileSync as readFileSync33 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync34, readFileSync as readFileSync34 } from "node:fs";
+import { join as join44 } from "node:path";
 var DEFAULT_MODES_CONFIG = Object.freeze({
   schema: "kxm.modes.v1",
   majorModes: {
@@ -46226,12 +46300,12 @@ function loadModesConfig(projectRoot) {
   if (!projectRoot) {
     return DEFAULT_MODES_CONFIG;
   }
-  const modesPath = join43(projectRoot, ".kxm", "modes.yaml");
-  if (!existsSync33(modesPath)) {
+  const modesPath = join44(projectRoot, ".kxm", "modes.yaml");
+  if (!existsSync34(modesPath)) {
     return DEFAULT_MODES_CONFIG;
   }
   try {
-    const raw = readFileSync33(modesPath, "utf8");
+    const raw = readFileSync34(modesPath, "utf8");
     const parsed = (0, import_yaml17.parse)(raw);
     if (parsed && parsed.schema === "kxm.modes.v1" && parsed.majorModes) {
       return {
@@ -46317,11 +46391,11 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     estimatedTokens: estimateTokens(baseSystemPromptChars)
   });
   for (const relPath of resolved.contextFiles) {
-    const fullPath = join43(projectRoot, relPath);
+    const fullPath = join44(projectRoot, relPath);
     let chars = 0;
-    if (existsSync33(fullPath)) {
+    if (existsSync34(fullPath)) {
       try {
-        chars = readFileSync33(fullPath, "utf8").length;
+        chars = readFileSync34(fullPath, "utf8").length;
       } catch {
         chars = 0;
       }
@@ -46453,9 +46527,9 @@ ${divider}
 
 // plugins/kxm/src/ssh-remote.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync34, mkdirSync as mkdirSync27, readFileSync as readFileSync34, readdirSync as readdirSync13, rmSync as rmSync11, statSync as statSync5 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join44, resolve as resolve26 } from "node:path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync28, readFileSync as readFileSync35, readdirSync as readdirSync13, rmSync as rmSync12, statSync as statSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join45, resolve as resolve27 } from "node:path";
 var MAX_SSH_OUTPUT_BYTES = 50 * 1024;
 var MAX_SSH_OUTPUT_LINES = 2e3;
 var DEFAULT_SOCKET_DIR = ".kxm/run/ssh-sockets";
@@ -46481,12 +46555,12 @@ function truncateSshOutput(raw) {
   return { text, truncated };
 }
 function parseSshConfig(configPath) {
-  const targetPath = configPath ?? join44(homedir7(), ".ssh", "config");
-  if (!existsSync34(targetPath)) {
+  const targetPath = configPath ?? join45(homedir8(), ".ssh", "config");
+  if (!existsSync35(targetPath)) {
     return [];
   }
   try {
-    const content = readFileSync34(targetPath, "utf-8");
+    const content = readFileSync35(targetPath, "utf-8");
     const lines = content.split("\n");
     const hosts = [];
     let currentHosts = [];
@@ -46563,15 +46637,15 @@ function resolveSshHostG(host, execFn = spawnSync7) {
   }
 }
 function ensureSocketDir(socketDir = DEFAULT_SOCKET_DIR) {
-  const resolved = resolve26(socketDir);
-  if (!existsSync34(resolved)) {
-    mkdirSync27(resolved, { recursive: true, mode: 448 });
+  const resolved = resolve27(socketDir);
+  if (!existsSync35(resolved)) {
+    mkdirSync28(resolved, { recursive: true, mode: 448 });
   }
   return resolved;
 }
 function buildSshArgs(options) {
   const socketDir = ensureSocketDir(options.socketDir ?? DEFAULT_SOCKET_DIR);
-  const controlPath = join44(socketDir, "%C");
+  const controlPath = join45(socketDir, "%C");
   const persist = options.controlPersist ?? DEFAULT_CONTROL_PERSIST;
   const args = [
     "-o",
@@ -46596,7 +46670,7 @@ function buildSshArgs(options) {
 }
 function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join44(resolvedDir, "%C");
+  const controlPath = join45(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "check", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -46608,7 +46682,7 @@ function checkControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawn
 }
 function closeControlSocket(host, socketDir = DEFAULT_SOCKET_DIR, execFn = spawnSync7) {
   const resolvedDir = ensureSocketDir(socketDir);
-  const controlPath = join44(resolvedDir, "%C");
+  const controlPath = join45(resolvedDir, "%C");
   try {
     const result = execFn("ssh", ["-O", "stop", "-o", `ControlPath=${controlPath}`, host], {
       encoding: "utf-8"
@@ -47054,9 +47128,9 @@ complete -c kxm -n "__fish_seen_subcommand_from goal" -a "create list get"
 }
 
 // plugins/kxm/src/completion-install.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync25 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { basename as basename9, delimiter, dirname as dirname21, isAbsolute as isAbsolute8, join as join45, resolve as resolve27 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync29, readFileSync as readFileSync36, writeFileSync as writeFileSync26 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { basename as basename9, delimiter, dirname as dirname22, isAbsolute as isAbsolute9, join as join46, resolve as resolve28 } from "node:path";
 var COMPLETION_MARKER = "# kxm completion";
 var PATH_MARKER = "# kxm path";
 function detectShell(env = process.env, platform = process.platform) {
@@ -47072,31 +47146,31 @@ function effectiveHome(options) {
   const env = options.env ?? process.env;
   if (options.homeDir) return options.homeDir;
   const envHome = env.HOME?.trim() ?? env.USERPROFILE?.trim();
-  return envHome && envHome.length > 0 ? resolve27(envHome) : homedir8();
+  return envHome && envHome.length > 0 ? resolve28(envHome) : homedir9();
 }
 function completionScriptPath(shell, options = {}) {
   const env = options.env ?? process.env;
   const explicit = options.configDir ?? env.KXM_USER_CONFIG_DIR?.trim();
-  const base = explicit && explicit.length > 0 ? resolve27(explicit) : resolve27(effectiveHome(options), ".config", "kxm");
-  return join45(base, "completions", `kxm.${shell}`);
+  const base = explicit && explicit.length > 0 ? resolve28(explicit) : resolve28(effectiveHome(options), ".config", "kxm");
+  return join46(base, "completions", `kxm.${shell}`);
 }
 function bashRcCandidate(options) {
   const home = effectiveHome(options);
-  const candidates = [join45(home, ".bashrc"), join45(home, ".bash_profile")];
-  const existing = candidates.find((candidate) => existsSync35(candidate));
+  const candidates = [join46(home, ".bashrc"), join46(home, ".bash_profile")];
+  const existing = candidates.find((candidate) => existsSync36(candidate));
   return existing ?? candidates[0];
 }
 function zshRcCandidate(options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.ZDOTDIR?.trim()) return join45(resolve27(env.ZDOTDIR.trim()), ".zshrc");
-  return join45(home, ".zshrc");
+  if (env.ZDOTDIR?.trim()) return join46(resolve28(env.ZDOTDIR.trim()), ".zshrc");
+  return join46(home, ".zshrc");
 }
 function fishCompletionTarget(shell, options) {
   const env = options.env ?? process.env;
   const home = effectiveHome(options);
-  if (env.XDG_CONFIG_HOME?.trim()) return join45(resolve27(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
-  return join45(home, ".config", "fish", "completions", "kxm.fish");
+  if (env.XDG_CONFIG_HOME?.trim()) return join46(resolve28(env.XDG_CONFIG_HOME.trim()), "fish", "completions", "kxm.fish");
+  return join46(home, ".config", "fish", "completions", "kxm.fish");
 }
 function completionRcTarget(shell, options = {}) {
   if (shell === "fish") {
@@ -47128,17 +47202,17 @@ function installShellCompletion(shellInput, options = {}) {
   const scriptPath = completionScriptPath(shell, options);
   const { rcFile } = completionRcTarget(shell, options);
   const script = generateShellCompletion(shell);
-  const existingScript = existsSync35(scriptPath);
-  const existingScriptMatches = existingScript && readFileSync35(scriptPath, "utf8") === script;
+  const existingScript = existsSync36(scriptPath);
+  const existingScriptMatches = existingScript && readFileSync36(scriptPath, "utf8") === script;
   let rcModified = false;
   let alreadyInstalled = false;
   if (shell === "fish") {
     const fishTarget = fishCompletionTarget(shell, options);
-    const fishInstalled = existsSync35(fishTarget) && readFileSync35(fishTarget, "utf8") === script;
+    const fishInstalled = existsSync36(fishTarget) && readFileSync36(fishTarget, "utf8") === script;
     alreadyInstalled = fishInstalled;
     if (!options.dryRun && (!fishInstalled || options.overwrite)) {
-      mkdirSync28(resolve27(fishTarget, ".."), { recursive: true });
-      writeFileSync25(fishTarget, script, { encoding: "utf8" });
+      mkdirSync29(resolve28(fishTarget, ".."), { recursive: true });
+      writeFileSync26(fishTarget, script, { encoding: "utf8" });
     }
     return {
       ok: true,
@@ -47151,13 +47225,13 @@ function installShellCompletion(shellInput, options = {}) {
   }
   if (rcFile) {
     const line = sourceLine(shell, scriptPath);
-    const rcContent = existsSync35(rcFile) ? readFileSync35(rcFile, "utf8") : "";
+    const rcContent = existsSync36(rcFile) ? readFileSync36(rcFile, "utf8") : "";
     alreadyInstalled = rcContent.includes(line) || rcContent.includes(`${COMPLETION_MARKER}`);
   }
   if (!options.dryRun) {
     if (!existingScriptMatches || options.overwrite) {
-      mkdirSync28(resolve27(scriptPath, ".."), { recursive: true });
-      writeFileSync25(scriptPath, script, { encoding: "utf8" });
+      mkdirSync29(resolve28(scriptPath, ".."), { recursive: true });
+      writeFileSync26(scriptPath, script, { encoding: "utf8" });
     }
     if (rcFile && !alreadyInstalled) {
       const line = sourceLine(shell, scriptPath);
@@ -47166,8 +47240,8 @@ function installShellCompletion(shellInput, options = {}) {
 ${marker}
 ${line}
 `;
-      mkdirSync28(resolve27(rcFile, ".."), { recursive: true });
-      writeFileSync25(rcFile, (existsSync35(rcFile) ? readFileSync35(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
+      mkdirSync29(resolve28(rcFile, ".."), { recursive: true });
+      writeFileSync26(rcFile, (existsSync36(rcFile) ? readFileSync36(rcFile, "utf8") : "") + stanza, { encoding: "utf8" });
       rcModified = true;
     }
   }
@@ -47182,15 +47256,15 @@ ${line}
 }
 function kxmBinDir(env = process.env) {
   const argv1 = env.KXM_ENTRY ?? process.argv[1];
-  if (argv1 && isAbsolute8(argv1)) {
-    const dir = dirname21(argv1);
-    if (existsSync35(join45(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
+  if (argv1 && isAbsolute9(argv1)) {
+    const dir = dirname22(argv1);
+    if (existsSync36(join46(dir, process.platform === "win32" ? "kxm.cmd" : "kxm"))) return dir;
   }
   const pathEnv = env.PATH ?? "";
   for (const part of pathEnv.split(delimiter)) {
     if (!part) continue;
-    const candidate = resolve27(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
-    if (existsSync35(candidate)) return resolve27(part);
+    const candidate = resolve28(part, process.platform === "win32" ? "kxm.cmd" : "kxm");
+    if (existsSync36(candidate)) return resolve28(part);
   }
   return void 0;
 }
@@ -47208,11 +47282,11 @@ function installPathEntry(shellInput, options = {}) {
   }
   const { rcFile } = completionRcTarget(shell, options);
   const line = pathLine(binDir);
-  const rcContent = existsSync35(rcFile ?? "") ? readFileSync35(rcFile, "utf8") : "";
+  const rcContent = existsSync36(rcFile ?? "") ? readFileSync36(rcFile, "utf8") : "";
   const alreadyInstalled = rcContent.includes(binDir) || (options.env?.PATH ?? process.env.PATH ?? "").split(delimiter).includes(binDir);
   if (!options.dryRun && rcFile && !alreadyInstalled) {
-    mkdirSync28(dirname21(rcFile), { recursive: true });
-    writeFileSync25(rcFile, rcContent + `
+    mkdirSync29(dirname22(rcFile), { recursive: true });
+    writeFileSync26(rcFile, rcContent + `
 ${PATH_MARKER}
 ${line}
 `, { encoding: "utf8" });
@@ -47222,8 +47296,8 @@ ${line}
 
 // plugins/kxm/src/init-guide-setup.ts
 var import_yaml18 = __toESM(require_dist(), 1);
-import { existsSync as existsSync36, mkdirSync as mkdirSync29, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname22, join as join46 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync30, writeFileSync as writeFileSync27 } from "node:fs";
+import { dirname as dirname23, join as join47 } from "node:path";
 var NATIVE_VENDOR_HARNESS = Object.freeze({
   anthropic: "claude",
   openai: "codex",
@@ -47622,13 +47696,13 @@ function renderGuideSetupFiles(projectRoot, plan) {
     const stage = roleStages.get(role);
     if (!stage) continue;
     files.push({
-      path: join46(projectRoot, ".kxm", "agents", `${role}.yaml`),
+      path: join47(projectRoot, ".kxm", "agents", `${role}.yaml`),
       content: (0, import_yaml18.stringify)(agentDocument(role, stage, binding))
     });
   }
   for (const workflow of plan.workflows) {
     files.push({
-      path: join46(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
+      path: join47(projectRoot, ".kxm", "workflows", `${workflow.slug}.yaml`),
       content: (0, import_yaml18.stringify)(workflowDocument(workflow))
     });
   }
@@ -47638,12 +47712,12 @@ function writeGuideSetupFiles(files) {
   const written = [];
   const existed = [];
   for (const file of files) {
-    if (existsSync36(file.path)) {
+    if (existsSync37(file.path)) {
       existed.push(file.path);
       continue;
     }
-    mkdirSync29(dirname22(file.path), { recursive: true });
-    writeFileSync26(file.path, file.content, "utf8");
+    mkdirSync30(dirname23(file.path), { recursive: true });
+    writeFileSync27(file.path, file.content, "utf8");
     written.push(file.path);
   }
   return { written, existed };
@@ -47706,7 +47780,7 @@ function applyKxmPackageUpdate(runtime, notice) {
       detail: `release v${notice.latest} has no sha256 digest for ${name}; refusing to install`
     };
   }
-  const releaseDir = mkdtempSync2(join47(tmpdir2(), "kxm-pkg-update-"));
+  const releaseDir = mkdtempSync2(join48(tmpdir2(), "kxm-pkg-update-"));
   try {
     const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset);
     if (runtime.dryRun) {
@@ -47715,7 +47789,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     for (const step of planned) {
       if (step.kind === "verify") {
         if (!verifyReleaseAssetDigest(step.path, step.sha256)) {
-          const actual = existsSync37(step.path) ? createHash16("sha256").update(readFileSync36(step.path)).digest("hex") : "missing";
+          const actual = existsSync38(step.path) ? createHash16("sha256").update(readFileSync37(step.path)).digest("hex") : "missing";
           return {
             ok: false,
             error: "release_digest_mismatch",
@@ -47732,7 +47806,7 @@ function applyKxmPackageUpdate(runtime, notice) {
     }
     return { ok: true, detail: `installed ${notice.latest} from ${notice.source}` };
   } finally {
-    rmSync12(releaseDir, { recursive: true, force: true });
+    rmSync13(releaseDir, { recursive: true, force: true });
   }
 }
 async function cmdExplain(runtime, options) {
@@ -47980,13 +48054,13 @@ async function cmdValidate(runtime, fileFlag) {
     return 2;
   }
   const selectedFile = explicitFile || configuredFile;
-  const file = selectedFile ? resolve28(runtime.cwd, selectedFile) : void 0;
-  if (file && !existsSync37(file)) {
+  const file = selectedFile ? resolve29(runtime.cwd, selectedFile) : void 0;
+  if (file && !existsSync38(file)) {
     printWorker(runtime, worker, { ok: false, command: "validate", error: "file_not_found", file }, `workflow file not found: ${file}`);
     return 1;
   }
   try {
-    const raw = file ? readFileSync36(file, "utf8") : inline;
+    const raw = file ? readFileSync37(file, "utf8") : inline;
     const warnings = [];
     const definitions = parseWorkflowDefinitions(raw, runtime.env, (message) => warnings.push(message));
     const secretEnvs = definitions.map((definition) => ({
@@ -48011,7 +48085,7 @@ async function cmdValidate(runtime, fileFlag) {
 }
 async function cmdArtifactsExist(runtime, pathFlag) {
   const worker = gateOf(runtime, "artifacts-exist");
-  const checked = verifyArtifactExists(runtime.dirs.assets, resolve28(runtime.cwd, pathFlag));
+  const checked = verifyArtifactExists(runtime.dirs.assets, resolve29(runtime.cwd, pathFlag));
   if (!checked.ok) {
     printWorker(
       runtime,
@@ -48030,15 +48104,15 @@ async function cmdArtifactsExist(runtime, pathFlag) {
   return 0;
 }
 async function cmdImprove(runtime, options = {}) {
-  const file = options.file ? resolve28(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
-  const routingRecords = existsSync37(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
-  const candidatesDir = options.outDir ? resolve28(runtime.cwd, options.outDir) : join47(runtime.cwd, ".kxm", "candidates");
+  const file = options.file ? resolve29(runtime.cwd, options.file) : telemetryPath(runtime.dirs.logs);
+  const routingRecords = existsSync38(file) ? readRoutingRecords(file).map((entry) => entry.routing) : [];
+  const candidatesDir = options.outDir ? resolve29(runtime.cwd, options.outDir) : join48(runtime.cwd, ".kxm", "candidates");
   const report2 = buildImprovementReport(routingRecords, {
     candidatesDir,
     projectRoot: runtime.cwd,
     dryRun: runtime.dryRun
   });
-  const reportDir = join47(runtime.dirs.assets, "improvements");
+  const reportDir = join48(runtime.dirs.assets, "improvements");
   const reportPath = writeImprovementReport(reportDir, report2, runtime.dryRun);
   const text = formatImprovementReport(report2);
   print(runtime.io, runtime.json, {
@@ -48170,9 +48244,9 @@ async function maybeOfferCompletionInstall(runtime) {
   if (!pathNeeded) {
     const scriptPath = completionScriptPath(shell, { env: runtime.env, configDir: runtime.env.KXM_USER_CONFIG_DIR });
     const { rcFile } = completionRcTarget(shell, { env: runtime.env });
-    if (rcFile && existsSync37(rcFile)) {
+    if (rcFile && existsSync38(rcFile)) {
       try {
-        if (readFileSync36(rcFile, "utf8").includes(scriptPath)) return;
+        if (readFileSync37(rcFile, "utf8").includes(scriptPath)) return;
       } catch {
       }
     }
@@ -48304,7 +48378,7 @@ async function cmdRoutingReport(runtime, options) {
   let catalog;
   if (includeEquivalentListCost) {
     try {
-      const pricesPath = options.prices ? resolve28(runtime.cwd, options.prices) : join47(runtime.dirs.workspace, "prices.yaml");
+      const pricesPath = options.prices ? resolve29(runtime.cwd, options.prices) : join48(runtime.dirs.workspace, "prices.yaml");
       catalog = loadPriceCatalog(pricesPath);
     } catch {
     }
@@ -48409,12 +48483,13 @@ async function ensureCliClient(runtime) {
   const project = defaultProjectName(runtime.cwd, runtime.env);
   const name = runtime.env.KXM_AGENT_NAME?.trim() || `cli-${process.pid}`;
   const purpose = runtime.env.KXM_AGENT_PURPOSE?.trim() || "CLI agent client";
-  const authToken = runtime.env.KXM_AUTH_TOKEN?.trim();
+  const authToken = resolveClientHubAuthToken(runtime.env, project);
   const client = new HubClient({
     serverUrl,
     name,
     project,
     purpose,
+    fetchImpl: runtime.fetchImpl,
     ...authToken ? { authToken } : {}
   });
   await client.start(() => {
@@ -48997,7 +49072,7 @@ async function runCli(argv, env = process.env, io = { stdout: (text) => process.
     throw error;
   }
 }
-if (process.argv[1] && resolve29(process.argv[1]) === fileURLToPath4(import.meta.url)) {
+if (process.argv[1] && resolve30(process.argv[1]) === fileURLToPath4(import.meta.url)) {
   const code = await runCli(process.argv.slice(2));
   process.exitCode = code;
 }