@kyo-so/cli 0.8.0 → 0.9.0

package/dist/bin/kyoso.js

@@ -7587,7 +7587,7 @@ ${lanes.join(`
       getCurrentDirectory,
       getAccessibleSortedChildDirectories,
       fileSystemEntryExists,
-      realpath,
+      realpath: realpath2,
       setTimeout: setTimeout2,
       clearTimeout: clearTimeout2
     }) {
@@ -7763,13 +7763,13 @@ ${lanes.join(`
         const parentWatcher = cache.get(parentDirPath);
         if (!parentWatcher)
           return false;
-        const target = normalizePath(realpath(parentDir));
+        const target = normalizePath(realpath2(parentDir));
         let hasChanges;
         let newChildWatches;
         if (filePathComparer(target, parentDir) === 0) {
           hasChanges = enumerateInsertsAndDeletes(fileSystemEntryExists(parentDir, 1) ? mapDefined(getAccessibleSortedChildDirectories(parentDir), (child) => {
             const childFullName = getNormalizedAbsolutePath(child, parentDir);
-            return !isIgnoredPath(childFullName, options) && filePathComparer(childFullName, normalizePath(realpath(childFullName))) === 0 ? childFullName : undefined;
+            return !isIgnoredPath(childFullName, options) && filePathComparer(childFullName, normalizePath(realpath2(childFullName))) === 0 ? childFullName : undefined;
           }) : emptyArray, parentWatcher.childWatches, (child, childWatcher) => filePathComparer(child, childWatcher.dirName), createAndAddChildDirectoryWatcher, closeFileWatcher, addChildDirectoryWatcher);
         } else if (parentWatcher.targetWatcher && filePathComparer(target, parentWatcher.targetWatcher.dirName) === 0) {
           hasChanges = false;
@@ -7843,7 +7843,7 @@ ${lanes.join(`
       getCurrentDirectory,
       fsSupportsRecursiveFsWatch,
       getAccessibleSortedChildDirectories,
-      realpath,
+      realpath: realpath2,
       tscWatchFile,
       useNonPollingWatchers,
       tscWatchDirectory,
@@ -7928,7 +7928,7 @@ ${lanes.join(`
             fileSystemEntryExists,
             getAccessibleSortedChildDirectories,
             watchDirectory: nonRecursiveWatchDirectory,
-            realpath,
+            realpath: realpath2,
             setTimeout: setTimeout2,
             clearTimeout: clearTimeout2
           });
@@ -8104,7 +8104,7 @@ ${lanes.join(`
           fileSystemEntryExists,
           fsSupportsRecursiveFsWatch,
           getAccessibleSortedChildDirectories: (path) => getAccessibleFileSystemEntries(path).directories,
-          realpath,
+          realpath: realpath2,
           tscWatchFile: process.env.TSC_WATCHFILE,
           useNonPollingWatchers: !!process.env.TSC_NONPOLLING_WATCHER,
           tscWatchDirectory: process.env.TSC_WATCHDIRECTORY,
@@ -8178,7 +8178,7 @@ ${lanes.join(`
           enableCPUProfiler,
           disableCPUProfiler,
           cpuProfilingEnabled: () => !!activeSession || contains(process.execArgv, "--cpu-prof") || contains(process.execArgv, "--prof"),
-          realpath,
+          realpath: realpath2,
           debugMode: !!process.env.NODE_INSPECTOR_IPC || !!process.env.VSCODE_INSPECTOR_OPTIONS || some(process.execArgv, (arg) => /^--(?:inspect|debug)(?:-brk)?(?:=\d+)?$/i.test(arg)) || !!process.recordreplay,
           tryEnableSourceMapsForHost() {
             try {
@@ -8391,7 +8391,7 @@ ${lanes.join(`
           }
         }
         function readDirectory(path, extensions, excludes, includes, depth) {
-          return matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, process.cwd(), depth, getAccessibleFileSystemEntries, realpath);
+          return matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, process.cwd(), depth, getAccessibleFileSystemEntries, realpath2);
         }
         function fileSystemEntryExists(path, entryKind) {
           const stat = statSync(path);
@@ -8419,7 +8419,7 @@ ${lanes.join(`
         function fsRealPathHandlingLongPath(path) {
           return path.length < 260 ? _fs.realpathSync.native(path) : _fs.realpathSync(path);
         }
-        function realpath(path) {
+        function realpath2(path) {
           try {
             return fsRealpath(path);
           } catch {
@@ -19724,18 +19724,18 @@ ${lanes.join(`
         diagnostics.add(createCompilerDiagnostic(Diagnostics.Could_not_write_file_0_Colon_1, fileName, hostErrorMessage));
       }, sourceFiles, data);
     }
-    function ensureDirectoriesExist(directoryPath, createDirectory, directoryExists) {
+    function ensureDirectoriesExist(directoryPath, createDirectory2, directoryExists) {
       if (directoryPath.length > getRootLength(directoryPath) && !directoryExists(directoryPath)) {
         const parentDirectory = getDirectoryPath(directoryPath);
-        ensureDirectoriesExist(parentDirectory, createDirectory, directoryExists);
-        createDirectory(directoryPath);
+        ensureDirectoriesExist(parentDirectory, createDirectory2, directoryExists);
+        createDirectory2(directoryPath);
       }
     }
-    function writeFileEnsuringDirectories(path, data, writeByteOrderMark, writeFile22, createDirectory, directoryExists) {
+    function writeFileEnsuringDirectories(path, data, writeByteOrderMark, writeFile22, createDirectory2, directoryExists) {
       try {
         writeFile22(path, data, writeByteOrderMark);
       } catch {
-        ensureDirectoriesExist(getDirectoryPath(normalizePath(path)), createDirectory, directoryExists);
+        ensureDirectoriesExist(getDirectoryPath(normalizePath(path)), createDirectory2, directoryExists);
         writeFile22(path, data, writeByteOrderMark);
       }
     }
@@ -21670,7 +21670,7 @@ ${lanes.join(`
     function getRegexFromPattern(pattern, useCaseSensitiveFileNames2) {
       return new RegExp(pattern, useCaseSensitiveFileNames2 ? "" : "i");
     }
-    function matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, currentDirectory, depth, getFileSystemEntries, realpath) {
+    function matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, currentDirectory, depth, getFileSystemEntries, realpath2) {
       path = normalizePath(path);
       currentDirectory = normalizePath(currentDirectory);
       const patterns = getFileMatcherPatterns(path, excludes, includes, useCaseSensitiveFileNames2, currentDirectory);
@@ -21685,7 +21685,7 @@ ${lanes.join(`
       }
       return flatten(results);
       function visitDirectory(path2, absolutePath, depth2) {
-        const canonicalPath = toCanonical(realpath(absolutePath));
+        const canonicalPath = toCanonical(realpath2(absolutePath));
         if (visited.has(canonicalPath))
           return;
         visited.set(canonicalPath, true);
@@ -41674,11 +41674,11 @@ ${lanes.join(`
           if (i < rootLength) {
             return;
           }
-          const sep = directory.lastIndexOf(directorySeparator, i - 1);
-          if (sep === -1) {
+          const sep3 = directory.lastIndexOf(directorySeparator, i - 1);
+          if (sep3 === -1) {
             return;
           }
-          return directory.substr(0, Math.max(sep, rootLength));
+          return directory.substr(0, Math.max(sep3, rootLength));
         }
       }
     }
@@ -98915,14 +98915,14 @@ ${lanes.join(`
         }
       }
       function createImportCallExpressionAMD(arg, containsLexicalThis) {
-        const resolve = factory2.createUniqueName("resolve");
+        const resolve3 = factory2.createUniqueName("resolve");
         const reject = factory2.createUniqueName("reject");
         const parameters = [
-          factory2.createParameterDeclaration(undefined, undefined, resolve),
+          factory2.createParameterDeclaration(undefined, undefined, resolve3),
           factory2.createParameterDeclaration(undefined, undefined, reject)
         ];
         const body = factory2.createBlock([
-          factory2.createExpressionStatement(factory2.createCallExpression(factory2.createIdentifier("require"), undefined, [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve, reject]))
+          factory2.createExpressionStatement(factory2.createCallExpression(factory2.createIdentifier("require"), undefined, [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve3, reject]))
         ]);
         let func;
         if (languageVersion >= 2) {
@@ -107027,12 +107027,12 @@ ${lanes.join(`
         directoryExists: host.directoryExists && directoryExists,
         getDirectories,
         readDirectory,
-        createDirectory: host.createDirectory && createDirectory,
+        createDirectory: host.createDirectory && createDirectory2,
         writeFile: host.writeFile && writeFile22,
         addOrDeleteFileOrDirectory,
         addOrDeleteFile,
         clearCache,
-        realpath: host.realpath && realpath
+        realpath: host.realpath && realpath2
       };
       function toPath3(fileName) {
         return toPath(fileName, currentDirectory, getCanonicalFileName);
@@ -107104,7 +107104,7 @@ ${lanes.join(`
         const path = toPath3(dirPath);
         return cachedReadDirectoryResult.has(ensureTrailingDirectorySeparator(path)) || host.directoryExists(dirPath);
       }
-      function createDirectory(dirPath) {
+      function createDirectory2(dirPath) {
         const path = toPath3(dirPath);
         const result = getCachedFileSystemEntriesForBaseDir(path);
         if (result) {
@@ -107130,7 +107130,7 @@ ${lanes.join(`
         const rootResult = tryReadDirectory2(rootDir, rootDirPath);
         let rootSymLinkResult;
         if (rootResult !== undefined) {
-          return matchFiles(rootDir, extensions, excludes, includes, useCaseSensitiveFileNames2, currentDirectory, depth, getFileSystemEntries, realpath);
+          return matchFiles(rootDir, extensions, excludes, includes, useCaseSensitiveFileNames2, currentDirectory, depth, getFileSystemEntries, realpath2);
         }
         return host.readDirectory(rootDir, extensions, excludes, includes, depth);
         function getFileSystemEntries(dir) {
@@ -107153,7 +107153,7 @@ ${lanes.join(`
           return result;
         }
       }
-      function realpath(s) {
+      function realpath2(s) {
         return host.realpath ? host.realpath(s) : s;
       }
       function clearFirstAncestorEntry(fileOrDirectoryPath) {
@@ -107527,11 +107527,11 @@ ${lanes.join(`
         return text !== undefined ? createSourceFile(fileName, text, languageVersionOrOptions, setParentNodes) : undefined;
       };
     }
-    function createWriteFileMeasuringIO(actualWriteFile, createDirectory, directoryExists) {
+    function createWriteFileMeasuringIO(actualWriteFile, createDirectory2, directoryExists) {
       return (fileName, data, writeByteOrderMark, onError) => {
         try {
           mark("beforeIOWrite");
-          writeFileEnsuringDirectories(fileName, data, writeByteOrderMark, actualWriteFile, createDirectory, directoryExists);
+          writeFileEnsuringDirectories(fileName, data, writeByteOrderMark, actualWriteFile, createDirectory2, directoryExists);
           mark("afterIOWrite");
           measure("I/O Write", "beforeIOWrite", "afterIOWrite");
         } catch (e) {
@@ -107558,7 +107558,7 @@ ${lanes.join(`
         return getDirectoryPath(normalizePath(system.getExecutingFilePath()));
       }
       const newLine = getNewLineCharacter(options);
-      const realpath = system.realpath && ((path) => system.realpath(path));
+      const realpath2 = system.realpath && ((path) => system.realpath(path));
       const compilerHost = {
         getSourceFile: createGetSourceFile((fileName) => compilerHost.readFile(fileName), setParentNodes),
         getDefaultLibLocation,
@@ -107574,7 +107574,7 @@ ${lanes.join(`
         directoryExists: (directoryName) => system.directoryExists(directoryName),
         getEnvironmentVariable: (name) => system.getEnvironmentVariable ? system.getEnvironmentVariable(name) : "",
         getDirectories: (path) => system.getDirectories(path),
-        realpath,
+        realpath: realpath2,
         readDirectory: (path, extensions, include, exclude, depth) => system.readDirectory(path, extensions, include, exclude, depth),
         createDirectory: (d) => system.createDirectory(d),
         createHash: maybeBind(system, system.createHash)
@@ -108611,10 +108611,10 @@ ${lanes.join(`
       }
       function getDefaultLibFilePriority(a) {
         if (containsPath(defaultLibraryPath, a.fileName, false)) {
-          const basename = getBaseFileName(a.fileName);
-          if (basename === "lib.d.ts" || basename === "lib.es6.d.ts")
+          const basename2 = getBaseFileName(a.fileName);
+          if (basename2 === "lib.d.ts" || basename2 === "lib.es6.d.ts")
             return 0;
-          const name = removeSuffix(removePrefix(basename, "lib."), ".d.ts");
+          const name = removeSuffix(removePrefix(basename2, "lib."), ".d.ts");
           const index = libs.indexOf(name);
           if (index !== -1)
             return index + 1;
@@ -160210,9 +160210,9 @@ ${options.prefix}` : `
           if (this.host.realpath) {
             Debug.assert(!!this.containingProjects.length);
             const project = this.containingProjects[0];
-            const realpath = this.host.realpath(this.path);
-            if (realpath) {
-              this.realpath = project.toPath(realpath);
+            const realpath2 = this.host.realpath(this.path);
+            if (realpath2) {
+              this.realpath = project.toPath(realpath2);
               if (this.realpath !== this.path) {
                 project.projectService.realpathToScriptInfos.add(this.realpath, this);
               }
@@ -161298,8 +161298,8 @@ ${options.prefix}` : `
           }
         };
         for (const file2 of files) {
-          const basename = getBaseFileName(file2);
-          if (basename === "package.json" || basename === "bower.json") {
+          const basename2 = getBaseFileName(file2);
+          if (basename2 === "package.json" || basename2 === "bower.json") {
             createProjectWatcher(file2, "FileWatcher");
             continue;
           }
@@ -163486,9 +163486,9 @@ ${options.prefix}` : `
         this.filenameToScriptInfo.delete(info.path);
         this.filenameToScriptInfoVersion.set(info.path, info.textStorage.version);
         this.stopWatchingScriptInfo(info);
-        const realpath = info.getRealpathIfDifferent();
-        if (realpath) {
-          this.realpathToScriptInfos.remove(realpath, info);
+        const realpath2 = info.getRealpathIfDifferent();
+        if (realpath2) {
+          this.realpathToScriptInfos.remove(realpath2, info);
         }
         info.closeSourceMapFileWatcher();
       }
@@ -164146,9 +164146,9 @@ All files are: ${JSON.stringify(names)}`, "Err");
       getSymlinkedProjects(info) {
         let projects;
         if (this.realpathToScriptInfos) {
-          const realpath = info.getRealpathIfDifferent();
-          if (realpath) {
-            forEach(this.realpathToScriptInfos.get(realpath), combineProjects);
+          const realpath2 = info.getRealpathIfDifferent();
+          if (realpath2) {
+            forEach(this.realpathToScriptInfos.get(realpath2), combineProjects);
           }
           forEach(this.realpathToScriptInfos.get(info.path), combineProjects);
         }
@@ -164186,8 +164186,8 @@ All files are: ${JSON.stringify(names)}`, "Err");
           const fileOrDirectoryPath = removeIgnoredPath(this.toPath(fileOrDirectory));
           if (!fileOrDirectoryPath)
             return;
-          const basename = getBaseFileName(fileOrDirectoryPath);
-          if (((_a3 = result.affectedModuleSpecifierCacheProjects) == null ? undefined : _a3.size) && (basename === "package.json" || basename === "node_modules")) {
+          const basename2 = getBaseFileName(fileOrDirectoryPath);
+          if (((_a3 = result.affectedModuleSpecifierCacheProjects) == null ? undefined : _a3.size) && (basename2 === "package.json" || basename2 === "node_modules")) {
             result.affectedModuleSpecifierCacheProjects.forEach((project) => {
               var _a22;
               (_a22 = project.getModuleSpecifierCache()) == null || _a22.clear();
@@ -169234,8 +169234,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
       installPackage(options) {
         this.packageInstallId++;
         const request = { kind: "installPackage", ...options, id: this.packageInstallId };
-        const promise2 = new Promise((resolve, reject) => {
-          (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map)).set(this.packageInstallId, { resolve, reject });
+        const promise2 = new Promise((resolve3, reject) => {
+          (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map)).set(this.packageInstallId, { resolve: resolve3, reject });
         });
         this.installer.send(request);
         return promise2;
@@ -169495,7 +169495,7 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
 });
 
 // src/cli/main.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 
 // src/cli/args.ts
 function parseArgs(argv) {
@@ -169599,14 +169599,364 @@ function languageFromPath(path) {
 }
 
 // src/cli/doctor.ts
-import { accessSync } from "node:fs";
-import { delimiter as delimiter2, resolve as resolve4 } from "node:path";
+import { accessSync as accessSync2 } from "node:fs";
+import { delimiter as delimiter3, resolve as resolve8 } from "node:path";
+
+// src/audit/stateRoot.ts
+import { createHash } from "node:crypto";
+import { lstat, mkdir as mkdir2, realpath } from "node:fs/promises";
+import { basename, dirname as dirname2, isAbsolute, join, resolve as resolve2 } from "node:path";
+
+// src/context/pathPolicy.ts
+import { normalize, sep } from "node:path";
+
+// src/core/errors.ts
+class KyosoRequestError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "KyosoRequestError";
+  }
+}
+
+// src/context/pathPolicy.ts
+function normalizeRelativePath(path) {
+  const normalized = normalize(path).replaceAll("\\", "/");
+  if (normalized === "." || normalized.startsWith("..") || normalized.includes(`${sep}..${sep}`) || normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
+    throw new KyosoRequestError(`Path escapes workspace root: ${path}`, "INVALID_PATH");
+  }
+  return normalized;
+}
+function isDeniedPath(path, denyPatterns) {
+  return matchesPathPattern(path, denyPatterns, "deny");
+}
+function isAllowedPath(path, allowPatterns) {
+  if (allowPatterns.length === 0)
+    return true;
+  return matchesPathPattern(path, allowPatterns, "allow");
+}
+function matchesPathPattern(path, patterns, mode) {
+  const normalized = normalizeRelativePath(path);
+  const segments = normalized.split("/");
+  return patterns.some((pattern) => {
+    const normalizedPattern = normalizeRelativePath(pattern);
+    if (normalizedPattern.endsWith(".*") && !normalizedPattern.includes("/")) {
+      const base = normalizedPattern.slice(0, -2);
+      if (mode === "allow") {
+        const firstSegment = segments[0] ?? "";
+        return firstSegment === base || firstSegment.startsWith(`${base}.`);
+      }
+      return segments.some((segment) => segment === base || segment.startsWith(`${base}.`));
+    }
+    if (normalizedPattern.includes("*")) {
+      const escaped = normalizedPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+      const regex = mode === "allow" ? new RegExp(`^${escaped}($|/)`) : new RegExp(`(^|/)${escaped}($|/)`);
+      return regex.test(normalized);
+    }
+    if (!normalizedPattern.includes("/")) {
+      if (mode === "allow") {
+        return normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`);
+      }
+      return segments.includes(normalizedPattern);
+    }
+    if (mode === "allow") {
+      return normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`);
+    }
+    return normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`) || normalized.endsWith(`/${normalizedPattern}`) || normalized.includes(`/${normalizedPattern}/`);
+  });
+}
+
+// src/core/constants.ts
+var DEFAULT_AGENT_TIMEOUT_MS = 120000;
+var RAW_OUTPUT_MAX_CHARS = 16384;
+var TRACE_DIR = ".kyoso/traces";
+var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
+var KYOSO_VERSION = "0.9.0";
+
+// src/utils/pathContainment.ts
+import { resolve, sep as sep2 } from "node:path";
+function isPathWithin(candidate, root) {
+  const resolvedCandidate = resolve(candidate);
+  const resolvedRoot = resolve(root);
+  const boundary = resolvedRoot.endsWith(sep2) ? resolvedRoot : `${resolvedRoot}${sep2}`;
+  return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(boundary);
+}
+
+// src/audit/stateRoot.ts
+var PRIVATE_DIRECTORY_MODE = 448;
+var UNSAFE_DIRECTORY_MODE = 18;
+var STICKY_DIRECTORY_MODE = 512;
+var AUDIT_WARNING_DIRECTORY_IGNORED = "AUDIT_DIRECTORY_IGNORED: Audit directory is invalid; using the default logical directory.";
+var AUDIT_WARNING_UNSUPPORTED_PLATFORM = "AUDIT_DISABLED_UNSUPPORTED_PLATFORM: Audit trace writing is unavailable on this platform.";
+var AUDIT_WARNING_UNSUPPORTED_CAPABILITY = "AUDIT_DISABLED_UNSUPPORTED_CAPABILITY: Audit trace writing requires unavailable filesystem capabilities.";
+var AUDIT_WARNING_UNSAFE_STATE_ROOT = "AUDIT_DISABLED_UNSAFE_STATE_ROOT: Audit state root could not be verified.";
+async function resolveAuditStateRoot(options) {
+  const warnings = [];
+  const logicalDirectory = validateAuditDirectory(options.directory, warnings);
+  const platform = options.platform ?? process.platform;
+  if (platform === "win32") {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSUPPORTED_PLATFORM] };
+  }
+  const uid = getCurrentUid(options.getuid);
+  if (uid === undefined) {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSUPPORTED_CAPABILITY] };
+  }
+  try {
+    const workspaceRoot = await realpath(resolve2(options.cwd));
+    const candidate = resolveStateBaseCandidate(options.env ?? process.env);
+    if (!candidate)
+      throw new Error("missing trusted state base");
+    const stateBase = await ensureTrustedStateBase({
+      candidate,
+      workspaceRoot,
+      uid
+    });
+    const kyosoRoot = await ensureTrustedDirectory({
+      root: stateBase,
+      segments: ["kyoso"],
+      uid,
+      workspaceRoot
+    });
+    return {
+      stateBase,
+      kyosoRoot,
+      workspaceRoot,
+      workspaceHash: createHash("sha256").update(workspaceRoot).digest("hex"),
+      logicalDirectory,
+      uid,
+      warnings
+    };
+  } catch {
+    return { warnings: [...warnings, AUDIT_WARNING_UNSAFE_STATE_ROOT] };
+  }
+}
+async function inspectAuditStateRootCapability(options) {
+  const platform = options.platform ?? process.platform;
+  if (platform === "win32" || getCurrentUid(options.getuid) === undefined) {
+    return { available: false };
+  }
+  try {
+    const uid = getCurrentUid(options.getuid);
+    if (uid === undefined)
+      return { available: false };
+    const workspaceRoot = await realpath(resolve2(options.cwd));
+    const candidate = resolveStateBaseCandidate(options.env ?? process.env);
+    if (!candidate || isPathWithin(candidate, workspaceRoot)) {
+      return { available: false };
+    }
+    const existing = await findExistingAncestor(candidate);
+    assertSafeDirectory(existing.path, uid, await lstat(existing.path), {
+      allowFilesystemRoot: true
+    });
+    const realExisting = await realpath(existing.path);
+    if (isPathWithin(realExisting, workspaceRoot))
+      return { available: false };
+    await assertTrustedAncestorChain(realExisting, uid);
+    if (existing.missingSegments.length === 0) {
+      const kyosoRoot = join(realExisting, "kyoso");
+      const kyosoStat = await optionalLstat(kyosoRoot);
+      if (kyosoStat)
+        assertSafeDirectory(kyosoRoot, uid, kyosoStat);
+    }
+    return { available: true };
+  } catch {
+    return { available: false };
+  }
+}
+async function ensureTrustedDirectory(options) {
+  const realRoot = await realpath(options.root);
+  assertSafeDirectory(realRoot, options.uid, await lstat(realRoot));
+  if (options.workspaceRoot && isPathWithin(realRoot, options.workspaceRoot)) {
+    throw new Error("trusted directory resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(realRoot, options.uid);
+  let current = realRoot;
+  for (const segment of options.segments) {
+    if (!isSafePathSegment(segment))
+      throw new Error("unsafe path segment");
+    const next = join(current, segment);
+    let entry = await optionalLstat(next);
+    if (!entry) {
+      await createDirectory(next);
+      entry = await lstat(next);
+    }
+    assertSafeDirectory(next, options.uid, entry);
+    const realNext = await realpath(next);
+    if (!isPathWithin(realNext, realRoot)) {
+      throw new Error("managed directory escaped trusted root");
+    }
+    if (options.workspaceRoot && isPathWithin(realNext, options.workspaceRoot)) {
+      throw new Error("managed directory resolves inside workspace");
+    }
+    current = realNext;
+  }
+  return current;
+}
+function isResolvedAuditStateRoot(resolution) {
+  return "kyosoRoot" in resolution;
+}
+function validateAuditDirectory(directory, warnings) {
+  try {
+    if (directory.trim().length === 0 || isAbsolute(directory) || directory.split(/[\\/]+/).includes("..")) {
+      throw new Error("unsafe logical directory");
+    }
+    const normalized = normalizeRelativePath(directory);
+    if (normalized === "." || normalized.split("/").includes("..")) {
+      throw new Error("unsafe logical directory");
+    }
+    return normalized;
+  } catch {
+    warnings.push(AUDIT_WARNING_DIRECTORY_IGNORED);
+    return TRACE_DIR;
+  }
+}
+function resolveStateBaseCandidate(env) {
+  const xdgStateHome = env.XDG_STATE_HOME?.trim();
+  if (xdgStateHome && isAbsolute(xdgStateHome)) {
+    return resolve2(xdgStateHome);
+  }
+  const home = env.HOME?.trim();
+  if (!home || !isAbsolute(home))
+    return;
+  return join(resolve2(home), ".local", "state");
+}
+async function ensureTrustedStateBase(options) {
+  if (isPathWithin(options.candidate, options.workspaceRoot)) {
+    throw new Error("state base is inside workspace");
+  }
+  const existing = await findExistingAncestor(options.candidate);
+  assertSafeDirectory(existing.path, options.uid, await lstat(existing.path), {
+    allowFilesystemRoot: true
+  });
+  const realExisting = await realpath(existing.path);
+  if (isPathWithin(realExisting, options.workspaceRoot)) {
+    throw new Error("state base resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(realExisting, options.uid);
+  let current = realExisting;
+  for (const segment of existing.missingSegments) {
+    current = join(current, segment);
+    await createDirectory(current);
+    const entry = await lstat(current);
+    assertSafeDirectory(current, options.uid, entry);
+    const realCurrent = await realpath(current);
+    if (!isPathWithin(realCurrent, realExisting)) {
+      throw new Error("state base changed while being created");
+    }
+    if (isPathWithin(realCurrent, options.workspaceRoot)) {
+      throw new Error("state base resolves inside workspace");
+    }
+    current = realCurrent;
+  }
+  const stateBase = await realpath(current);
+  assertSafeDirectory(stateBase, options.uid, await lstat(stateBase));
+  if (isPathWithin(stateBase, options.workspaceRoot)) {
+    throw new Error("state base resolves inside workspace");
+  }
+  await assertTrustedAncestorChain(stateBase, options.uid);
+  return stateBase;
+}
+async function findExistingAncestor(candidate) {
+  let current = resolve2(candidate);
+  const missingSegments = [];
+  while (true) {
+    const entry = await optionalLstat(current);
+    if (entry) {
+      if (entry.isSymbolicLink() || !entry.isDirectory()) {
+        throw new Error("state base ancestor is unsafe");
+      }
+      return { path: current, missingSegments };
+    }
+    const parent = dirname2(current);
+    if (parent === current)
+      throw new Error("state base has no existing ancestor");
+    missingSegments.unshift(basename(current));
+    current = parent;
+  }
+}
+function assertSafeDirectory(path, uid, entry, options = {}) {
+  const stat = entry;
+  if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error("state directory is unsafe");
+  }
+  if (numericStatValue(stat.uid) !== uid && !(options.allowFilesystemRoot && isFilesystemRoot(path))) {
+    throw new Error("state directory owner is unsafe");
+  }
+  const mode = numericStatValue(stat.mode);
+  if ((mode & UNSAFE_DIRECTORY_MODE) !== 0) {
+    throw new Error("state directory mode is unsafe");
+  }
+}
+function numericStatValue(value) {
+  return typeof value === "number" ? value : Number(value);
+}
+function getCurrentUid(getuid) {
+  const resolveUid = getuid ?? (typeof process.getuid === "function" ? process.getuid.bind(process) : undefined);
+  try {
+    const uid = resolveUid?.();
+    return typeof uid === "number" && Number.isInteger(uid) && uid >= 0 ? uid : undefined;
+  } catch {
+    return;
+  }
+}
+function isFilesystemRoot(path) {
+  return dirname2(path) === path;
+}
+async function assertTrustedAncestorChain(path, uid) {
+  let child = path;
+  while (!isFilesystemRoot(child)) {
+    const parent = dirname2(child);
+    const [parentStat, childStat] = await Promise.all([
+      lstat(parent),
+      lstat(child)
+    ]);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+      throw new Error("state directory ancestor is unsafe");
+    }
+    const parentMode = numericStatValue(parentStat.mode);
+    const parentUid = numericStatValue(parentStat.uid);
+    const childUid = numericStatValue(childStat.uid);
+    const parentWritableByOthers = (parentMode & UNSAFE_DIRECTORY_MODE) !== 0;
+    const stickyChildEntry = (parentMode & STICKY_DIRECTORY_MODE) !== 0 && childUid === uid;
+    if (parentUid !== uid && parentUid !== 0 || parentWritableByOthers && !stickyChildEntry) {
+      throw new Error("state directory ancestor permissions are unsafe");
+    }
+    child = parent;
+  }
+}
+function isSafePathSegment(segment) {
+  return segment.length > 0 && segment !== "." && segment !== ".." && !segment.includes("/") && !segment.includes("\\");
+}
+async function optionalLstat(path) {
+  try {
+    return await lstat(path);
+  } catch (error) {
+    if (isMissingPathError(error))
+      return;
+    throw error;
+  }
+}
+async function createDirectory(path) {
+  try {
+    await mkdir2(path, { mode: PRIVATE_DIRECTORY_MODE });
+  } catch (error) {
+    if (!isAlreadyExistsError(error))
+      throw error;
+  }
+}
+function isMissingPathError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function isAlreadyExistsError(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
 
 // src/config/loadConfig.ts
 import { access as access2, readFile as readFile4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { stderr, stdin } from "node:process";
-import { extname as extname3, join as join2, resolve as resolve2 } from "node:path";
+import { extname as extname3, join as join3, resolve as resolve4 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/config/defaultConfig.ts
@@ -184360,12 +184710,6 @@ var kyosoConfigSecuritySensitivePrefixes = [
 // src/security/redact.ts
 var REDACTION = "[KYOSO_REDACTED]";
 
-// src/core/constants.ts
-var DEFAULT_AGENT_TIMEOUT_MS = 120000;
-var RAW_OUTPUT_MAX_CHARS = 16384;
-var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-var KYOSO_VERSION = "0.8.0";
-
 // src/security/sanitizeText.ts
 var SENSITIVE_TEXT_PATTERNS = [
   /\bsk-(?:proj-)?[A-Za-z0-9_-]{8,}\b/g,
@@ -184833,7 +185177,7 @@ function skipVoid(str, ptr, banNewLines, banComments) {
   }
   return ptr;
 }
-function skipUntil(str, ptr, sep, end, banNewLines = false) {
+function skipUntil(str, ptr, sep3, end, banNewLines = false) {
   if (!end) {
     ptr = indexOfNewline(str, ptr);
     return ptr < 0 ? str.length : ptr;
@@ -184842,7 +185186,7 @@ function skipUntil(str, ptr, sep, end, banNewLines = false) {
     let c = str[i];
     if (c === "#") {
       i = indexOfNewline(str, i);
-    } else if (c === sep) {
+    } else if (c === sep3) {
       return i + 1;
     } else if (c === end || banNewLines && (c === `
 ` || c === "\r" && str[i + 1] === `
@@ -185340,7 +185684,7 @@ function formatTomlError(configPath, error51) {
 // src/config/tsConfigLoader.ts
 var import_typescript = __toESM(require_typescript(), 1);
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname2, extname as extname2 } from "node:path";
+import { dirname as dirname3, extname as extname2 } from "node:path";
 import { pathToFileURL } from "node:url";
 import vm from "node:vm";
 
@@ -185374,20 +185718,20 @@ function loadTypeScriptConfig(filePath, source) {
 ${transpiled}
 })`, { filename: filePath });
   const runner = script.runInThisContext();
-  runner(module.exports, require2, module, filePath, dirname2(filePath), defineConfig);
+  runner(module.exports, require2, module, filePath, dirname3(filePath), defineConfig);
   return module.exports;
 }
 
 // src/config/trustedConfig.ts
-import { createHash } from "node:crypto";
-import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { createHash as createHash2 } from "node:crypto";
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname3, join, resolve } from "node:path";
+import { dirname as dirname4, join as join2, resolve as resolve3 } from "node:path";
 function hashConfigSource(source) {
-  return createHash("sha256").update(source).digest("hex");
+  return createHash2("sha256").update(source).digest("hex");
 }
 function defaultTrustedConfigStorePath(env = process.env) {
-  return env.KYOSO_TRUST_STORE_PATH ? resolve(env.KYOSO_TRUST_STORE_PATH) : join(env.HOME ? resolve(env.HOME) : homedir(), ".kyoso", "trusted-configs.json");
+  return env.KYOSO_TRUST_STORE_PATH ? resolve3(env.KYOSO_TRUST_STORE_PATH) : join2(env.HOME ? resolve3(env.HOME) : homedir(), ".kyoso", "trusted-configs.json");
 }
 async function isTrustedConfig(storePath, configPath, configHash) {
   const store = await readTrustedConfigStore(storePath);
@@ -185396,7 +185740,7 @@ async function isTrustedConfig(storePath, configPath, configHash) {
 async function trustConfig(storePath, configPath, configHash) {
   const store = await readTrustedConfigStore(storePath);
   store[configPath] = configHash;
-  await mkdir2(dirname3(storePath), { recursive: true });
+  await mkdir3(dirname4(storePath), { recursive: true });
   await writeFile2(storePath, `${JSON.stringify(store, null, 2)}
 `, {
     encoding: "utf8",
@@ -185408,7 +185752,7 @@ async function readTrustedConfigStore(storePath) {
   try {
     parsed = JSON.parse(await readFile3(storePath, "utf8"));
   } catch (error51) {
-    if (isMissingPathError(error51))
+    if (isMissingPathError2(error51))
       return {};
     if (error51 instanceof SyntaxError)
       return {};
@@ -185426,7 +185770,7 @@ async function readTrustedConfigStore(storePath) {
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isMissingPathError(error51) {
+function isMissingPathError2(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
 }
 
@@ -185457,7 +185801,7 @@ async function loadConfig(options = {}) {
       sources.push({ path: globalConfigPath, layer: "global_toml" });
     }
     if (options.configPath) {
-      const explicitConfigPath = resolve2(cwd, options.configPath);
+      const explicitConfigPath = resolve4(cwd, options.configPath);
       if (!await exists2(explicitConfigPath)) {
         throw new Error(`Config file not found: ${explicitConfigPath} (from --config)`);
       }
@@ -185474,8 +185818,8 @@ async function loadConfig(options = {}) {
       sources.push(loaded.source);
       warnings.push(...loaded.warnings);
     } else {
-      const projectTomlPath = resolve2(cwd, "kyoso.toml");
-      const projectTsPath = resolve2(cwd, "kyoso.config.ts");
+      const projectTomlPath = resolve4(cwd, "kyoso.toml");
+      const projectTsPath = resolve4(cwd, "kyoso.config.ts");
       const hasProjectToml = await exists2(projectTomlPath);
       const hasProjectTs = await exists2(projectTsPath);
       if (hasProjectToml) {
@@ -185511,8 +185855,8 @@ async function loadConfig(options = {}) {
   };
 }
 function resolveGlobalTomlConfigPath(env = process.env) {
-  const configHome = env.XDG_CONFIG_HOME ? resolve2(env.XDG_CONFIG_HOME) : join2(env.HOME ? resolve2(env.HOME) : homedir2(), ".config");
-  return join2(configHome, "kyoso", "config.toml");
+  const configHome = env.XDG_CONFIG_HOME ? resolve4(env.XDG_CONFIG_HOME) : join3(env.HOME ? resolve4(env.HOME) : homedir2(), ".config");
+  return join3(configHome, "kyoso", "config.toml");
 }
 function collectGlobalConfigWarnings(configPath, config2) {
   const unknownSettings = flattenLeaves(config2).map((leaf) => leaf.path).filter((path) => !isKnownGlobalConfigPath(path)).map((path) => ({
@@ -185947,23 +186291,1174 @@ function hasEnv(env, key) {
   return typeof env[key] === "string" && env[key].trim().length > 0;
 }
 
-// src/cli/setup.ts
+// src/cli/codexPluginDetector.ts
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { cp, mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+
+// src/cli/pluginRuntimeContract.ts
+var PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
+var MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
+var PLUGIN_RUNTIME_EXPECTED_CONTRACT = {
+  distribution: {
+    pluginVersion: "0.1.0",
+    mcpCommand: "npx",
+    mcpPackagePin: "@kyo-so/cli@0.8.0"
+  },
+  marketplace: {
+    name: "kyoso",
+    listed: true,
+    pluginId: "kyoso@kyoso",
+    selector: "kyoso@kyoso",
+    installPolicy: "AVAILABLE",
+    authPolicy: "ON_USE"
+  },
+  transitions: {
+    beforeAdd: { installed: false, enabled: false },
+    afterAdd: { installed: true, enabled: true },
+    disabled: { installed: true, enabled: false },
+    afterRemove: { installed: false, enabled: false },
+    installPluginId: "kyoso@kyoso",
+    removePluginId: "kyoso@kyoso"
+  },
+  mcp: {
+    default: {
+      enabled: true,
+      command: "$NODE",
+      args: ["$PROBE_SERVER", "$OBSERVATION"],
+      envVars: [
+        "OPENAI_API_KEY",
+        "CODEX_API_KEY",
+        "CODEX_HOME",
+        "CODEX_ACCESS_TOKEN",
+        "ANTHROPIC_API_KEY",
+        "CLAUDE_CODE_OAUTH_TOKEN"
+      ],
+      cwd: null,
+      startupTimeoutSec: 20,
+      toolTimeoutSec: 360
+    },
+    pluginOverride: {
+      enabled: false,
+      command: "$NODE",
+      args: ["$PROBE_SERVER", "$OBSERVATION"],
+      envVars: [
+        "OPENAI_API_KEY",
+        "CODEX_API_KEY",
+        "CODEX_HOME",
+        "CODEX_ACCESS_TOKEN",
+        "ANTHROPIC_API_KEY",
+        "CLAUDE_CODE_OAUTH_TOKEN"
+      ],
+      cwd: null,
+      startupTimeoutSec: 20,
+      toolTimeoutSec: 360
+    },
+    manualOverride: {
+      enabled: true,
+      command: "manual-kyoso",
+      args: ["mcp"],
+      envVars: [],
+      cwd: null,
+      startupTimeoutSec: null,
+      toolTimeoutSec: null
+    }
+  },
+  appServer: {
+    default: {
+      serverFound: true,
+      toolNames: ["probe_environment"],
+      authStatus: "unsupported",
+      skillFound: false,
+      skillEnabled: null,
+      skillHasKyosoMcpDependency: false
+    },
+    pluginOverride: {
+      serverFound: true,
+      toolNames: [],
+      authStatus: "unsupported",
+      skillFound: false,
+      skillEnabled: null,
+      skillHasKyosoMcpDependency: false,
+      mcpObservationWritten: false
+    }
+  },
+  environment: {
+    cwdIsWorkspace: true,
+    homeInherited: true,
+    codexHomeForwarded: true,
+    tempDirectoryInherited: true,
+    pathInherited: true,
+    allowlistedEnvForwarded: {
+      OPENAI_API_KEY: true,
+      CODEX_API_KEY: true,
+      CODEX_ACCESS_TOKEN: true,
+      ANTHROPIC_API_KEY: true,
+      CLAUDE_CODE_OAUTH_TOKEN: true
+    },
+    deniedSentinelForwarded: false
+  },
+  isolation: {
+    distinctHomeAndCodexHome: true,
+    distinctWorkspace: true
+  }
+};
+var PLUGIN_LIST_JSON_SCHEMA = {
+  collections: ["installed", "available"],
+  entry: {
+    pluginId: "kyoso@kyoso",
+    requiredFields: ["pluginId", "installed", "enabled"]
+  }
+};
+var pluginRuntimeContract = {
+  schemaVersion: PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION,
+  minimumSupportedCodexVersion: MINIMUM_SUPPORTED_CODEX_VERSION,
+  pluginId: "kyoso@kyoso",
+  pluginListTopLevelKeys: PLUGIN_LIST_JSON_SCHEMA.collections,
+  expectedContract: PLUGIN_RUNTIME_EXPECTED_CONTRACT
+};
+
+// src/cli/codexPluginDetector.ts
+var CODEX_PLUGIN_INSPECTION_TIMEOUT_MS = 5000;
+var MAX_CODEX_INSPECTION_TIMEOUT_MS = 1e4;
+var CODEX_INSPECTION_MAX_BUFFER_BYTES = 1024 * 1024;
+function inspectCodexPlugin(options) {
+  const input2 = normalizeOptions(options);
+  const versionResult = input2.runCodex(commandFor(input2, ["--version"]));
+  if (versionResult.kind !== "completed") {
+    return unsupported("version", failureReason(versionResult));
+  }
+  const codexVersion = parseCodexVersion(versionResult.stdout);
+  if (!codexVersion)
+    return unsupported("version", "invalid_output");
+  if (compareSemver(codexVersion, MINIMUM_SUPPORTED_CODEX_VERSION) < 0) {
+    return unsupported("version", "unsupported_version");
+  }
+  const pluginListResult = input2.runCodex(commandFor(input2, ["plugin", "list", "--json"]));
+  if (pluginListResult.kind !== "completed") {
+    return unsupported("plugin_list", failureReason(pluginListResult));
+  }
+  const parsed = parseJson(pluginListResult.stdout);
+  if (parsed === undefined)
+    return unsupported("plugin_list", "invalid_output");
+  const plugin = parsePluginList(parsed);
+  if (!plugin)
+    return unsupported("plugin_list", "unknown_schema");
+  return { status: "supported", codexVersion, plugin };
+}
+function inspectCodexMcpList(options) {
+  const input2 = normalizeOptions(options);
+  const result = input2.runCodex(commandFor(input2, ["mcp", "list", "--json"]));
+  if (result.kind !== "completed") {
+    return unsupported("mcp_list", failureReason(result));
+  }
+  const parsed = parseJson(result.stdout);
+  if (parsed === undefined)
+    return unsupported("mcp_list", "invalid_output");
+  const kyoso = parseMcpList(parsed);
+  if (!kyoso)
+    return unsupported("mcp_list", "unknown_schema");
+  return { status: "supported", kyoso };
+}
+function formatCodexInspectionFailure(failure) {
+  const operation = {
+    version: "Codex version",
+    plugin_list: "Codex Plugin list",
+    mcp_list: "Codex MCP list"
+  }[failure.operation];
+  const reason = {
+    unavailable: "is unavailable",
+    timeout: "timed out",
+    command_failed: "could not be inspected",
+    invalid_output: "returned unsupported output",
+    unknown_schema: "returned an unsupported schema",
+    unsupported_version: "is below the supported version"
+  }[failure.reason];
+  return `${operation} ${reason}.`;
+}
+function normalizeOptions(options) {
+  return {
+    cwd: options.cwd,
+    env: options.env ?? process.env,
+    timeoutMs: boundedTimeout(options.timeoutMs),
+    runCodex: options.runCodex ?? runCodex
+  };
+}
+function boundedTimeout(timeoutMs) {
+  if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+    return CODEX_PLUGIN_INSPECTION_TIMEOUT_MS;
+  }
+  return Math.min(timeoutMs, MAX_CODEX_INSPECTION_TIMEOUT_MS);
+}
+function commandFor(options, args) {
+  return {
+    args,
+    cwd: options.cwd,
+    env: options.env,
+    timeoutMs: options.timeoutMs
+  };
+}
+function runCodex(command) {
+  const result = spawnSync("codex", command.args, {
+    cwd: command.cwd,
+    env: command.env,
+    encoding: "utf8",
+    timeout: command.timeoutMs,
+    maxBuffer: CODEX_INSPECTION_MAX_BUFFER_BYTES,
+    windowsHide: true
+  });
+  const errorCode = commandErrorCode(result.error);
+  if (errorCode === "ENOENT")
+    return { kind: "unavailable" };
+  if (errorCode === "ETIMEDOUT")
+    return { kind: "timeout" };
+  if (result.error || result.status === null || result.status !== 0) {
+    return { kind: "failed" };
+  }
+  return {
+    kind: "completed",
+    exitCode: result.status,
+    stdout: String(result.stdout ?? "")
+  };
+}
+function commandErrorCode(error51) {
+  if (typeof error51 !== "object" || error51 === null || !("code" in error51) || typeof error51.code !== "string") {
+    return;
+  }
+  return error51.code;
+}
+function failureReason(result) {
+  if (result.kind === "unavailable")
+    return "unavailable";
+  if (result.kind === "timeout")
+    return "timeout";
+  return "command_failed";
+}
+function unsupported(operation, reason) {
+  return { status: "unsupported", failure: { operation, reason } };
+}
+function parseJson(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return;
+  }
+}
+function parsePluginList(value) {
+  if (!isRecord5(value))
+    return;
+  const allowedKeys = new Set(PLUGIN_LIST_JSON_SCHEMA.collections);
+  if (Object.keys(value).some((key) => !allowedKeys.has(key))) {
+    return;
+  }
+  const installed = parsePluginEntries(value.installed);
+  const available = parsePluginEntries(value.available);
+  if (!installed || !available)
+    return;
+  const matches = [...installed, ...available].filter((entry2) => entry2.pluginId === PLUGIN_RUNTIME_EXPECTED_CONTRACT.marketplace.pluginId);
+  if (matches.length > 1)
+    return;
+  if (matches.length === 0) {
+    return pluginState(false, false);
+  }
+  const entry = matches[0];
+  if (!entry.installed && entry.enabled)
+    return;
+  return pluginState(entry.installed, entry.enabled);
+}
+function parsePluginEntries(value) {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value))
+    return;
+  const entries = [];
+  for (const item of value) {
+    if (!isRecord5(item))
+      return;
+    if (typeof item.pluginId !== "string" || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean") {
+      return;
+    }
+    entries.push({
+      pluginId: item.pluginId,
+      installed: item.installed,
+      enabled: item.enabled
+    });
+  }
+  return entries;
+}
+function pluginState(installed, enabled) {
+  return {
+    pluginId: PLUGIN_RUNTIME_EXPECTED_CONTRACT.marketplace.pluginId,
+    installed,
+    enabled,
+    state: installed ? enabled ? "enabled" : "disabled" : "not_installed"
+  };
+}
+function parseMcpList(value) {
+  if (!Array.isArray(value))
+    return;
+  const matches = [];
+  for (const item of value) {
+    if (!isRecord5(item) || typeof item.name !== "string")
+      return "unknown";
+    if (item.name !== "kyoso")
+      continue;
+    if (typeof item.enabled !== "boolean")
+      return "unknown";
+    matches.push(item.enabled);
+  }
+  if (matches.length === 0)
+    return "missing";
+  if (matches.length > 1)
+    return "unknown";
+  return matches[0] ? "enabled" : "disabled";
+}
+function parseCodexVersion(output2) {
+  for (const line of output2.split(/\r?\n/)) {
+    const match = /^codex-cli\s+(\S+)\s*$/.exec(line.trim());
+    const version2 = match?.[1];
+    if (version2 && parseSemver(version2))
+      return version2;
+  }
+  return;
+}
+function compareSemver(left, right) {
+  const parsedLeft = parseSemver(left);
+  const parsedRight = parseSemver(right);
+  if (!parsedLeft || !parsedRight)
+    return 0;
+  for (const key of ["major", "minor", "patch"]) {
+    if (parsedLeft[key] !== parsedRight[key]) {
+      return parsedLeft[key] < parsedRight[key] ? -1 : 1;
+    }
+  }
+  return comparePrerelease(parsedLeft.prerelease, parsedRight.prerelease);
+}
+function parseSemver(value) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (!match)
+    return;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  if (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor) || !Number.isSafeInteger(patch)) {
+    return;
+  }
+  return {
+    major,
+    minor,
+    patch,
+    prerelease: match[4]?.split(".") ?? []
+  };
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 && right.length === 0)
+    return 0;
+  if (left.length === 0)
+    return 1;
+  if (right.length === 0)
+    return -1;
+  const count = Math.max(left.length, right.length);
+  for (let index = 0;index < count; index += 1) {
+    const leftPart = left[index];
+    const rightPart = right[index];
+    if (leftPart === undefined)
+      return -1;
+    if (rightPart === undefined)
+      return 1;
+    if (leftPart === rightPart)
+      continue;
+    const leftNumeric = /^\d+$/.test(leftPart);
+    const rightNumeric = /^\d+$/.test(rightPart);
+    if (leftNumeric && rightNumeric) {
+      return Number(leftPart) < Number(rightPart) ? -1 : 1;
+    }
+    if (leftNumeric)
+      return -1;
+    if (rightNumeric)
+      return 1;
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/cli/integration.ts
+import {
+  accessSync,
+  constants,
+  existsSync,
+  readFileSync,
+  realpathSync
+} from "node:fs";
+import { tmpdir } from "node:os";
+import {
+  delimiter,
+  dirname as dirname5,
+  extname as extname4,
+  isAbsolute as isAbsolute2,
+  join as join4,
+  relative,
+  resolve as resolve5
+} from "node:path";
+function detectCli(options) {
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  return {
+    kyoso: detectInstalledKyoso(options.cwd, env, platform),
+    npx: commandExists("npx", env, platform),
+    bunx: commandExists("bunx", env, platform)
+  };
+}
+function determineNonPluginIntegration(options) {
+  const warnings = manualMcpWarnings(options.manualMcpStatus);
+  if (options.manualMcpStatus === "unknown") {
+    return { mode: "unknown", warnings };
+  }
+  if (options.manualMcpStatus === "enabled") {
+    return {
+      mode: options.hasSkill ? "manual-mcp" : "mcp-only",
+      warnings
+    };
+  }
+  const cliWarnings = cliIdentityWarnings(options.cli.kyoso);
+  warnings.push(...cliWarnings);
+  if (options.hasSkill) {
+    if (options.cli.kyoso.kind === "installed") {
+      return { mode: "cli-skill", warnings };
+    }
+    if (options.cli.npx || options.cli.bunx) {
+      warnings.push("Package-runner fallback may require network access and can drift between versions.");
+      return { mode: "skill-on-demand", warnings };
+    }
+    if (options.cli.kyoso.kind === "unknown") {
+      return { mode: "unknown", warnings };
+    }
+    warnings.push("The Skill is installed, but no supported Kyoso CLI execution path was found.");
+    return { mode: "missing", warnings };
+  }
+  if (options.cli.kyoso.kind === "installed") {
+    return { mode: "cli-only", warnings };
+  }
+  if (options.cli.kyoso.kind === "unknown") {
+    return { mode: "unknown", warnings };
+  }
+  return { mode: "missing", warnings };
+}
+function formatCliAvailability(cli) {
+  if (cli.kind === "installed") {
+    return `installed @kyo-so/cli ${cli.version} (${cli.scope})`;
+  }
+  if (cli.kind === "transient") {
+    return "temporary runner (not treated as an installed CLI)";
+  }
+  if (cli.kind === "unknown") {
+    return "unrecognized PATH entry (not treated as an installed CLI)";
+  }
+  return "missing";
+}
+function detectInstalledKyoso(cwd, env, platform) {
+  const executable = resolveCommand("kyoso", env, platform);
+  if (!executable)
+    return { kind: "missing" };
+  let realExecutable;
+  try {
+    realExecutable = realpathSync(executable);
+  } catch {
+    return { kind: "unknown" };
+  }
+  if (isTransientPath(realExecutable, cwd))
+    return { kind: "transient" };
+  const packageInfo = findKyosoPackage(realExecutable);
+  if (!packageInfo)
+    return { kind: "unknown" };
+  return {
+    kind: "installed",
+    version: packageInfo.version,
+    scope: isWithin(packageInfo.directory, realPathOrResolved(cwd)) ? "project" : "global"
+  };
+}
+function findKyosoPackage(executable) {
+  let directory = dirname5(executable);
+  for (;; ) {
+    const packagePath = join4(directory, "package.json");
+    if (existsSync(packagePath)) {
+      try {
+        const parsed = JSON.parse(readFileSync(packagePath, "utf8"));
+        if (isRecord6(parsed) && parsed.name === "@kyo-so/cli" && typeof parsed.version === "string" && parsed.version.trim().length > 0) {
+          return { directory, version: parsed.version };
+        }
+      } catch {}
+    }
+    const parent = dirname5(directory);
+    if (parent === directory)
+      return;
+    directory = parent;
+  }
+}
+function isTransientPath(path, cwd) {
+  if (path.split(/[\\/]/).includes("_npx"))
+    return true;
+  const temporaryRoot = realPathOrResolved(tmpdir());
+  return isWithin(path, temporaryRoot) && !isWithin(path, realPathOrResolved(cwd));
+}
+function realPathOrResolved(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve5(path);
+  }
+}
+function manualMcpWarnings(status) {
+  if (status === "disabled")
+    return ["Manual MCP registration is disabled."];
+  if (status === "unknown") {
+    return [
+      "Manual MCP registration could not be safely classified from its configuration."
+    ];
+  }
+  return [];
+}
+function cliIdentityWarnings(cli) {
+  if (cli.kind === "transient") {
+    return [
+      "A temporary Kyoso runner was found on PATH and is not treated as an installed CLI."
+    ];
+  }
+  if (cli.kind === "unknown") {
+    return [
+      "A PATH entry named kyoso does not identify itself as @kyo-so/cli and is not treated as an installed CLI."
+    ];
+  }
+  return [];
+}
+function commandExists(command, env, platform) {
+  return resolveCommand(command, env, platform) !== undefined;
+}
+function resolveCommand(command, env, platform) {
+  for (const path of env.PATH?.split(delimiter) ?? []) {
+    if (path.length === 0)
+      continue;
+    for (const name of commandNames(command, env, platform)) {
+      const candidate = join4(path, name);
+      try {
+        accessSync(candidate, constants.X_OK);
+        return candidate;
+      } catch {}
+    }
+  }
+  return;
+}
+function commandNames(command, env, platform) {
+  if (platform !== "win32" || extname4(command).length > 0)
+    return [command];
+  const names = [command];
+  const seen = new Set([command.toLowerCase()]);
+  for (const extension of env.PATHEXT?.split(";") ?? []) {
+    const normalized = extension.trim();
+    if (!normalized.startsWith(".") || /[\\/]/.test(normalized))
+      continue;
+    const candidate = `${command}${normalized}`;
+    const key = candidate.toLowerCase();
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    names.push(candidate);
+  }
+  return names;
+}
+function isWithin(path, parent) {
+  const relativePath = relative(resolve5(parent), resolve5(path));
+  return relativePath === "" || !relativePath.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && relativePath !== ".." && !isAbsolute2(relativePath);
+}
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/cli/setup.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { delimiter, dirname as dirname4, join as join3 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname7, join as join6, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/cli/skillInstall.ts
+import { createHash as createHash3, randomUUID } from "node:crypto";
+import {
+  copyFile,
+  link,
+  lstat as lstat2,
+  mkdir as mkdir4,
+  mkdtemp,
+  readFile as readFile5,
+  readdir,
+  realpath as realpath2,
+  rename,
+  rm,
+  writeFile as writeFile3
+} from "node:fs/promises";
+import {
+  basename as basename2,
+  dirname as dirname6,
+  isAbsolute as isAbsolute3,
+  join as join5,
+  relative as relative2,
+  resolve as resolve6,
+  sep as sep3
+} from "node:path";
+
+// src/cli/knownSkillDigests.ts
+var CURRENT_SKILL_DIGEST = "sha256:98e715396ee3e1994c29ab49bc489197f242091c8ac0e06e182c0eccd5ab277e";
+var KNOWN_SKILL_DIGESTS_BY_VERSION = {
+  "0.8.0": [
+    {
+      digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8",
+      kind: "historical"
+    }
+  ]
+};
+function knownSkillDigest(digest) {
+  if (digest === CURRENT_SKILL_DIGEST) {
+    return { version: KYOSO_VERSION, kind: "current" };
+  }
+  for (const [version2, entries] of Object.entries(KNOWN_SKILL_DIGESTS_BY_VERSION)) {
+    const entry = entries.find((candidate) => candidate.digest === digest);
+    if (entry)
+      return { version: version2, kind: entry.kind };
+  }
+  return;
+}
+
+// src/cli/skillInstall.ts
+var SKILL_INSTALL_MARKER = ".kyoso-install.json";
+var SKILL_INSTALL_BACKUP = ".kyoso-review.backup";
+var SKILL_INSTALL_TRANSACTION = ".kyoso-review.install-transaction.json";
+async function ensureManagedSkill(options) {
+  const sourceDigest = await hashSkillDirectory(options.sourceDir);
+  if (sourceDigest !== CURRENT_SKILL_DIGEST) {
+    throw new Error(`Bundled kyoso-review digest is ${sourceDigest}; update knownSkillDigests.ts before distributing it.`);
+  }
+  const safeDestination = await resolveSafeDestination(options.trustedRoot, options.destinationDir);
+  const destinationDir = safeDestination.destinationDir;
+  const recovery = await recoverInterruptedReplacement({
+    destinationDir,
+    trustedRoot: safeDestination.realRoot,
+    write: options.write
+  });
+  if (recovery.status !== "none") {
+    return {
+      status: recovery.status,
+      path: destinationDir,
+      detail: recovery.detail
+    };
+  }
+  const destinationStat = await optionalLstat2(destinationDir);
+  if (!destinationStat) {
+    const detail2 = copyDetail(options.sourceDir, destinationDir, "create");
+    if (!options.write) {
+      return { status: "dry-run", path: destinationDir, detail: detail2 };
+    }
+    await replaceSkillDirectory({
+      sourceDir: options.sourceDir,
+      destinationDir,
+      trustedRoot: safeDestination.realRoot,
+      destinationExists: false
+    });
+    return { status: "created", path: destinationDir, detail: detail2 };
+  }
+  if (!destinationStat.isDirectory()) {
+    if (!options.force) {
+      return conflictResult(destinationDir, "destination exists and is not a directory");
+    }
+    const detail2 = copyDetail(options.sourceDir, destinationDir, "force replace");
+    if (!options.write) {
+      return { status: "dry-run", path: destinationDir, detail: detail2 };
+    }
+    await replaceSkillDirectory({
+      sourceDir: options.sourceDir,
+      destinationDir,
+      trustedRoot: safeDestination.realRoot,
+      destinationExists: true
+    });
+    return { status: "updated", path: destinationDir, detail: detail2 };
+  }
+  if (await realpath2(options.sourceDir) === await realpath2(destinationDir)) {
+    return {
+      status: "skipped",
+      path: destinationDir,
+      detail: "canonical source is already the destination"
+    };
+  }
+  const actualDigest = await hashSkillDirectory(destinationDir);
+  const marker = await readInstallMarker(destinationDir);
+  if (options.force) {
+    const detail2 = [
+      `force replace ${destinationDir}`,
+      `from ${actualDigest}`,
+      `to   ${CURRENT_SKILL_DIGEST}`
+    ].join(`
+`);
+    if (!options.write) {
+      return { status: "dry-run", path: destinationDir, detail: detail2 };
+    }
+    await replaceSkillDirectory({
+      sourceDir: options.sourceDir,
+      destinationDir,
+      trustedRoot: safeDestination.realRoot,
+      destinationExists: true
+    });
+    return { status: "updated", path: destinationDir, detail: detail2 };
+  }
+  if (marker.kind === "invalid") {
+    return conflictResult(destinationDir, marker.reason);
+  }
+  if (marker.kind === "valid") {
+    if (marker.value.digest !== actualDigest) {
+      return conflictResult(destinationDir, `managed digest ${marker.value.digest} does not match installed digest ${actualDigest}`);
+    }
+    if (actualDigest === CURRENT_SKILL_DIGEST && marker.value.cliVersion === KYOSO_VERSION) {
+      return {
+        status: "skipped",
+        path: destinationDir,
+        detail: `managed skill is current (${CURRENT_SKILL_DIGEST})`
+      };
+    }
+    if (actualDigest === CURRENT_SKILL_DIGEST) {
+      const detail3 = `refresh install marker to CLI ${KYOSO_VERSION}`;
+      if (!options.write) {
+        return { status: "dry-run", path: destinationDir, detail: detail3 };
+      }
+      await writeInstallMarker(destinationDir);
+      return { status: "updated", path: destinationDir, detail: detail3 };
+    }
+    const detail2 = [
+      `update managed skill from ${actualDigest}`,
+      `to ${CURRENT_SKILL_DIGEST}`
+    ].join(`
+`);
+    if (!options.write) {
+      return { status: "dry-run", path: destinationDir, detail: detail2 };
+    }
+    await replaceSkillDirectory({
+      sourceDir: options.sourceDir,
+      destinationDir,
+      trustedRoot: safeDestination.realRoot,
+      destinationExists: true
+    });
+    return { status: "updated", path: destinationDir, detail: detail2 };
+  }
+  const known = knownSkillDigest(actualDigest);
+  if (!known) {
+    return conflictResult(destinationDir, `unmanaged skill digest ${actualDigest} is not recognized`);
+  }
+  if (actualDigest === CURRENT_SKILL_DIGEST) {
+    const detail2 = `adopt existing ${known.version} skill and write ${SKILL_INSTALL_MARKER}`;
+    if (!options.write) {
+      return { status: "dry-run", path: destinationDir, detail: detail2 };
+    }
+    await writeInstallMarker(destinationDir);
+    return { status: "updated", path: destinationDir, detail: detail2 };
+  }
+  const detail = [
+    `adopt known ${known.version} ${known.kind} skill (${actualDigest})`,
+    `update to ${CURRENT_SKILL_DIGEST}`
+  ].join(`
+`);
+  if (!options.write) {
+    return { status: "dry-run", path: destinationDir, detail };
+  }
+  await replaceSkillDirectory({
+    sourceDir: options.sourceDir,
+    destinationDir,
+    trustedRoot: safeDestination.realRoot,
+    destinationExists: true
+  });
+  return { status: "updated", path: destinationDir, detail };
+}
+async function hashSkillDirectory(directory) {
+  const rootStat = await lstat2(directory);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error(`Skill root must be a regular directory: ${directory}`);
+  }
+  const files = await listRegularFiles(directory);
+  files.sort((left, right) => Buffer.compare(Buffer.from(left.relativePath), Buffer.from(right.relativePath)));
+  const hash2 = createHash3("sha256");
+  for (const file2 of files) {
+    const bytes = await readFile5(file2.absolutePath);
+    hash2.update(file2.relativePath);
+    hash2.update("\x00");
+    hash2.update(String(bytes.byteLength));
+    hash2.update("\x00");
+    hash2.update(bytes);
+  }
+  return `sha256:${hash2.digest("hex")}`;
+}
+async function listRegularFiles(directory, prefix = "") {
+  const result = [];
+  const entries = await readdir(directory);
+  for (const name of entries) {
+    const relativePath = prefix.length > 0 ? `${prefix}/${name}` : name;
+    const absolutePath = join5(directory, name);
+    const stat = await lstat2(absolutePath);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Skill directory contains a symlink: ${relativePath}`);
+    }
+    if (relativePath === SKILL_INSTALL_MARKER) {
+      if (!stat.isFile()) {
+        throw new Error(`${SKILL_INSTALL_MARKER} must be a regular file`);
+      }
+      continue;
+    }
+    if (stat.isDirectory()) {
+      result.push(...await listRegularFiles(absolutePath, relativePath));
+      continue;
+    }
+    if (!stat.isFile()) {
+      throw new Error(`Skill directory contains a non-regular file: ${relativePath}`);
+    }
+    result.push({ relativePath, absolutePath });
+  }
+  return result;
+}
+async function resolveSafeDestination(trustedRoot, destinationDir) {
+  const logicalRoot = resolve6(trustedRoot);
+  const logicalDestination = resolve6(destinationDir);
+  const relativeDestination = relative2(logicalRoot, logicalDestination);
+  if (relativeDestination === "" || !isPathWithin(logicalDestination, logicalRoot)) {
+    throw new Error(`Skill destination escapes trusted install root: ${destinationDir}`);
+  }
+  const realRoot = await realpath2(logicalRoot);
+  const safeDestination = resolve6(realRoot, relativeDestination);
+  if (!isPathWithin(safeDestination, realRoot)) {
+    throw new Error(`Skill destination escapes trusted install root: ${destinationDir}`);
+  }
+  await assertExistingSegmentsSafe(realRoot, safeDestination);
+  return { realRoot, destinationDir: safeDestination };
+}
+async function assertExistingSegmentsSafe(realRoot, destination) {
+  const segments = relative2(realRoot, destination).split(sep3).filter(Boolean);
+  let current = realRoot;
+  for (const segment of segments) {
+    current = join5(current, segment);
+    const stat = await optionalLstat2(current);
+    if (!stat)
+      return;
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Skill install path contains a symlink: ${current}`);
+    }
+    if (current !== destination && !stat.isDirectory()) {
+      throw new Error(`Skill install parent is not a directory: ${current}`);
+    }
+  }
+}
+async function ensureSafeParent(realRoot, destinationDir) {
+  const parent = dirname6(destinationDir);
+  const relativeParent = relative2(realRoot, parent);
+  if (relativeParent === ".." || relativeParent.startsWith(`..${sep3}`) || isAbsolute3(relativeParent)) {
+    throw new Error(`Skill install parent escapes trusted root: ${parent}`);
+  }
+  const segments = relative2(realRoot, parent).split(sep3).filter(Boolean);
+  let current = realRoot;
+  for (const segment of segments) {
+    current = join5(current, segment);
+    let stat = await optionalLstat2(current);
+    if (!stat) {
+      await mkdir4(current);
+      stat = await lstat2(current);
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`Skill install parent is unsafe: ${current}`);
+    }
+  }
+}
+async function replaceSkillDirectory(options) {
+  await ensureSafeParent(options.trustedRoot, options.destinationDir);
+  await assertExistingSegmentsSafe(options.trustedRoot, options.destinationDir);
+  const parent = dirname6(options.destinationDir);
+  const mutationGuard = await captureMutationGuard(parent);
+  const stage = await mkdtemp(join5(parent, ".kyoso-review.stage-"));
+  const backup = join5(parent, SKILL_INSTALL_BACKUP);
+  const transaction = join5(parent, SKILL_INSTALL_TRANSACTION);
+  let backupCreated = false;
+  let transactionCreated = false;
+  try {
+    await copySkillFiles(options.sourceDir, stage);
+    await writeInstallMarker(stage);
+    const stagedDigest = await hashSkillDirectory(stage);
+    if (stagedDigest !== CURRENT_SKILL_DIGEST) {
+      throw new Error(`Staged kyoso-review digest mismatch: ${stagedDigest} != ${CURRENT_SKILL_DIGEST}`);
+    }
+    if (options.destinationExists) {
+      await assertMutationGuard(mutationGuard);
+      if (await optionalLstat2(backup) || await optionalLstat2(transaction)) {
+        throw interruptedReplacementConflict(options.destinationDir, backup);
+      }
+      await writeReplacementTransaction(transaction, options.destinationDir);
+      transactionCreated = true;
+      await assertMutationGuard(mutationGuard);
+      await rename(options.destinationDir, backup);
+      backupCreated = true;
+      await assertMutationGuard(mutationGuard);
+    }
+    try {
+      await assertMutationGuard(mutationGuard);
+      await rename(stage, options.destinationDir);
+      await assertMutationGuard(mutationGuard);
+    } catch (error51) {
+      if (backupCreated && !await optionalLstat2(options.destinationDir)) {
+        await assertMutationGuard(mutationGuard);
+        await rename(backup, options.destinationDir);
+        backupCreated = false;
+        await assertMutationGuard(mutationGuard);
+        await rm(transaction, { force: true });
+        transactionCreated = false;
+        await assertMutationGuard(mutationGuard);
+      }
+      throw error51;
+    }
+    if (backupCreated) {
+      await assertMutationGuard(mutationGuard);
+      await rm(backup, { recursive: true, force: true });
+      backupCreated = false;
+      await assertMutationGuard(mutationGuard);
+      await rm(transaction, { force: true });
+      transactionCreated = false;
+      await assertMutationGuard(mutationGuard);
+    }
+  } finally {
+    await assertMutationGuard(mutationGuard);
+    await rm(stage, { recursive: true, force: true });
+    if (backupCreated && !await optionalLstat2(options.destinationDir)) {
+      await assertMutationGuard(mutationGuard);
+      await rename(backup, options.destinationDir);
+      backupCreated = false;
+      await assertMutationGuard(mutationGuard);
+    }
+    if (transactionCreated && !backupCreated) {
+      await rm(transaction, { force: true });
+    }
+  }
+}
+async function captureMutationGuard(parent) {
+  const stat = await lstat2(parent);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error(`Skill install parent is unsafe: ${parent}`);
+  }
+  const realParent = await realpath2(parent);
+  if (realParent !== parent) {
+    throw new Error(`Skill install parent changed during setup: ${parent}`);
+  }
+  return {
+    parent,
+    realParent,
+    device: stat.dev,
+    inode: stat.ino
+  };
+}
+async function assertMutationGuard(guard) {
+  const stat = await optionalLstat2(guard.parent);
+  if (!stat || stat.isSymbolicLink() || !stat.isDirectory() || stat.dev !== guard.device || stat.ino !== guard.inode || await realpath2(guard.parent) !== guard.realParent) {
+    throw new Error(`Skill install parent changed during setup: ${guard.parent}. No further path mutation was attempted.`);
+  }
+}
+async function recoverInterruptedReplacement(options) {
+  const parent = dirname6(options.destinationDir);
+  const backup = join5(parent, SKILL_INSTALL_BACKUP);
+  const transaction = join5(parent, SKILL_INSTALL_TRANSACTION);
+  const backupStat = await optionalLstat2(backup);
+  const transactionStat = await optionalLstat2(transaction);
+  if (!backupStat && !transactionStat)
+    return { status: "none" };
+  if (backupStat?.isSymbolicLink()) {
+    throw new Error(`Interrupted Skill backup is a symlink: ${backup}`);
+  }
+  if (transactionStat?.isSymbolicLink() || !transactionStat?.isFile()) {
+    throw new Error(`Interrupted Skill transaction marker is not a regular file: ${transaction}`);
+  }
+  if (!backupStat) {
+    await assertExistingSegmentsSafe(options.trustedRoot, transaction);
+  } else {
+    await assertExistingSegmentsSafe(options.trustedRoot, backup);
+  }
+  const parsed = await readReplacementTransaction(transaction);
+  if (parsed.destinationName !== basename2(options.destinationDir) || parsed.backupName !== SKILL_INSTALL_BACKUP) {
+    throw new Error(`Interrupted Skill transaction does not match ${options.destinationDir}: ${transaction}`);
+  }
+  const destinationStat = await optionalLstat2(options.destinationDir);
+  if (backupStat && destinationStat) {
+    throw interruptedReplacementConflict(options.destinationDir, backup);
+  }
+  if (!backupStat && !destinationStat) {
+    throw new Error(`Interrupted Skill transaction has neither destination nor backup: ${transaction}`);
+  }
+  if (!options.write) {
+    return {
+      status: "dry-run",
+      detail: backupStat ? `recover interrupted skill replacement from ${SKILL_INSTALL_BACKUP}` : `clean completed Skill replacement marker ${SKILL_INSTALL_TRANSACTION}`
+    };
+  }
+  const mutationGuard = await captureMutationGuard(parent);
+  await assertMutationGuard(mutationGuard);
+  if (backupStat) {
+    await rename(backup, options.destinationDir);
+  }
+  await assertMutationGuard(mutationGuard);
+  await rm(transaction, { force: true });
+  await assertMutationGuard(mutationGuard);
+  return {
+    status: "updated",
+    detail: backupStat ? `recovered interrupted skill replacement from ${SKILL_INSTALL_BACKUP}; rerun setup to apply the requested install` : `cleaned completed Skill replacement marker ${SKILL_INSTALL_TRANSACTION}; rerun setup to verify the installed Skill`
+  };
+}
+function interruptedReplacementConflict(destinationDir, backup) {
+  return new Error(`Interrupted Skill replacement is ambiguous because both ${destinationDir} and ${backup} exist. Inspect both directories and remove ${backup} only after preserving any needed files.`);
+}
+async function writeReplacementTransaction(transactionPath, destinationDir) {
+  const transaction = {
+    schemaVersion: 1,
+    installer: "@kyo-so/cli",
+    destinationName: basename2(destinationDir),
+    backupName: SKILL_INSTALL_BACKUP
+  };
+  const temporaryPath = `${transactionPath}.tmp-${randomUUID()}`;
+  await writeFile3(temporaryPath, `${JSON.stringify(transaction, null, 2)}
+`, {
+    encoding: "utf8",
+    flag: "wx"
+  });
+  try {
+    await link(temporaryPath, transactionPath);
+  } finally {
+    await rm(temporaryPath, { force: true });
+  }
+}
+async function readReplacementTransaction(transactionPath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile5(transactionPath, "utf8"));
+  } catch (error51) {
+    throw new Error(`Interrupted Skill transaction is invalid: ${transactionPath}: ${error51 instanceof Error ? error51.message : String(error51)}`);
+  }
+  if (!isReplacementTransaction(parsed)) {
+    throw new Error(`Interrupted Skill transaction has an invalid schema: ${transactionPath}`);
+  }
+  return parsed;
+}
+function isReplacementTransaction(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const candidate = value;
+  return candidate.schemaVersion === 1 && candidate.installer === "@kyo-so/cli" && typeof candidate.destinationName === "string" && candidate.destinationName.length > 0 && candidate.backupName === SKILL_INSTALL_BACKUP;
+}
+async function copySkillFiles(sourceDir, destinationDir) {
+  for (const file2 of await listRegularFiles(sourceDir)) {
+    const destination = join5(destinationDir, ...file2.relativePath.split("/"));
+    await mkdir4(dirname6(destination), { recursive: true });
+    await copyFile(file2.absolutePath, destination);
+  }
+}
+async function readInstallMarker(destinationDir) {
+  const markerPath = join5(destinationDir, SKILL_INSTALL_MARKER);
+  const markerStat = await optionalLstat2(markerPath);
+  if (!markerStat)
+    return { kind: "missing" };
+  if (markerStat.isSymbolicLink() || !markerStat.isFile()) {
+    return {
+      kind: "invalid",
+      reason: `${SKILL_INSTALL_MARKER} is not a regular file`
+    };
+  }
+  try {
+    const parsed = JSON.parse(await readFile5(markerPath, "utf8"));
+    if (!isInstallMarker(parsed)) {
+      return {
+        kind: "invalid",
+        reason: `${SKILL_INSTALL_MARKER} has an invalid schema`
+      };
+    }
+    return { kind: "valid", value: parsed };
+  } catch (error51) {
+    return {
+      kind: "invalid",
+      reason: `${SKILL_INSTALL_MARKER} is invalid: ${error51 instanceof Error ? error51.message : String(error51)}`
+    };
+  }
+}
+async function writeInstallMarker(destinationDir) {
+  const marker = {
+    schemaVersion: 1,
+    installer: "@kyo-so/cli",
+    cliVersion: KYOSO_VERSION,
+    digest: CURRENT_SKILL_DIGEST
+  };
+  const markerPath = join5(destinationDir, SKILL_INSTALL_MARKER);
+  const temporaryPath = join5(destinationDir, `${SKILL_INSTALL_MARKER}.tmp-${randomUUID()}`);
+  await writeFile3(temporaryPath, `${JSON.stringify(marker, null, 2)}
+`, {
+    encoding: "utf8",
+    flag: "wx"
+  });
+  try {
+    await rename(temporaryPath, markerPath);
+  } finally {
+    await rm(temporaryPath, { force: true });
+  }
+}
+function isInstallMarker(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const candidate = value;
+  return candidate.schemaVersion === 1 && candidate.installer === "@kyo-so/cli" && typeof candidate.cliVersion === "string" && candidate.cliVersion.length > 0 && typeof candidate.digest === "string" && /^sha256:[0-9a-f]{64}$/.test(candidate.digest);
+}
+function copyDetail(sourceDir, destinationDir, action) {
+  return [
+    `${action} ${sourceDir}`,
+    `to ${destinationDir}`,
+    `digest ${CURRENT_SKILL_DIGEST}`
+  ].join(`
+`);
+}
+function conflictResult(destinationDir, reason) {
+  return {
+    status: "conflict",
+    path: destinationDir,
+    detail: `${reason}
+Existing skill was not changed. Rerun with --force to replace only this skill directory.`
+  };
+}
+async function optionalLstat2(path) {
+  try {
+    return await lstat2(path);
+  } catch (error51) {
+    if (isMissingPathError3(error51))
+      return;
+    throw error51;
+  }
+}
+function isMissingPathError3(error51) {
+  return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
+}
+
+// src/cli/setup.ts
 async function runSetup(options) {
   const client = parseClient(options.client);
+  validateSkillOnlyOptions(options, client);
   const runner = parseRunner(options.runner);
   const command = options.command ? parseCommandSpec(options.command) : commandForRunner(runner);
+  const env = options.env ?? process.env;
+  const home = resolveUserHome(env);
   const context = {
     cwd: options.cwd,
-    home: options.env?.HOME ?? homedir3(),
-    env: options.env ?? process.env,
+    home,
+    codexHome: dirname7(resolveCodexConfigPath(env, options.cwd)),
+    env,
     write: options.write,
     scope: options.global ? "global" : "project",
+    skillOnly: options.skillOnly ?? false,
+    force: options.force ?? false,
     mcpCommand: command,
     sourceSkillDir: resolveBundledSkillDir()
   };
@@ -186006,50 +187501,103 @@ function buildClaudeMcpEntry(command) {
 function skillDestination(client, scope, cwd, home) {
   if (client === "codex") {
     const root2 = scope === "global" ? home : cwd;
-    return join3(root2, ".agents", "skills", "kyoso-review");
+    return join6(root2, ".agents", "skills", "kyoso-review");
   }
   const root = scope === "global" ? home : cwd;
-  return join3(root, ".claude", "skills", "kyoso-review");
+  return join6(root, ".claude", "skills", "kyoso-review");
+}
+function resolveUserHome(env = process.env) {
+  return env.HOME ? resolve7(env.HOME) : homedir3();
+}
+function resolveCodexConfigPath(env = process.env, cwd = process.cwd()) {
+  const codexHome = env.CODEX_HOME ? resolve7(cwd, env.CODEX_HOME) : join6(resolveUserHome(env), ".codex");
+  return join6(codexHome, "config.toml");
+}
+function detectCodexPluginMcpOverride(options) {
+  const env = options.env ?? process.env;
+  const path = resolveCodexConfigPath(env, options.cwd);
+  if (!existsSync2(path))
+    return { status: "missing", path };
+  try {
+    const parsed = parse5(readTextSync(path));
+    if (hasUnprobedProjectIntegrationOverride(parsed, options.cwd, resolveUserHome(env))) {
+      return { status: "unknown", path };
+    }
+    return {
+      status: nestedMcpEntryStatus(parsed, [
+        "plugins",
+        "kyoso@kyoso",
+        "mcp_servers",
+        "kyoso"
+      ]),
+      path
+    };
+  } catch {
+    return { status: "unknown", path };
+  }
 }
 function detectSetup(options) {
-  const home = options.home ?? homedir3();
+  const env = options.env ?? process.env;
+  const home = options.home ? resolve7(options.home) : resolveUserHome(env);
+  const codexConfigPath = options.codexHome ? join6(resolve7(options.codexHome), "config.toml") : options.home ? join6(home, ".codex", "config.toml") : resolveCodexConfigPath(env, options.cwd);
+  const codexMcp = detectCodexMcp(codexConfigPath, options.cwd, home);
+  const claudeMcp = mergeMcpDetections([
+    detectClaudeMcp(join6(options.cwd, ".mcp.json"), options.cwd, home),
+    detectClaudeMcp(join6(home, ".claude.json"), options.cwd, home)
+  ]);
+  const codexSkillPaths = existingSkillPaths([
+    join6(options.cwd, ".agents", "skills", "kyoso-review"),
+    join6(home, ".agents", "skills", "kyoso-review")
+  ]);
+  const claudeSkillPaths = existingSkillPaths([
+    join6(options.cwd, ".claude", "skills", "kyoso-review"),
+    join6(home, ".claude", "skills", "kyoso-review")
+  ]);
   return {
     codex: {
-      mcp: hasCodexMcp(join3(home, ".codex", "config.toml")),
-      skill: existsSync(join3(options.cwd, ".agents", "skills", "kyoso-review", "SKILL.md")) || existsSync(join3(home, ".agents", "skills", "kyoso-review", "SKILL.md"))
+      mcp: codexMcp.status === "enabled",
+      skill: codexSkillPaths.length > 0,
+      manualMcpStatus: codexMcp.status,
+      mcpPaths: codexMcp.paths,
+      skillPaths: codexSkillPaths
     },
     "claude-code": {
-      mcp: hasClaudeMcp(join3(options.cwd, ".mcp.json")) || hasClaudeMcp(join3(home, ".claude.json")),
-      skill: existsSync(join3(options.cwd, ".claude", "skills", "kyoso-review", "SKILL.md")) || existsSync(join3(home, ".claude", "skills", "kyoso-review", "SKILL.md"))
+      mcp: claudeMcp.status === "enabled",
+      skill: claudeSkillPaths.length > 0,
+      manualMcpStatus: claudeMcp.status,
+      mcpPaths: claudeMcp.paths,
+      skillPaths: claudeSkillPaths
     }
   };
 }
 async function setupCodex(context) {
+  if (context.skillOnly) {
+    return [
+      await ensureSkill(context, "codex", "Codex skill"),
+      ...singleAgentAdvice(context, "codex")
+    ];
+  }
   return [
     await ensureCodexMcp(context),
-    await ensureSkill({
-      title: "Codex skill",
-      sourceDir: context.sourceSkillDir,
-      destinationDir: skillDestination("codex", context.scope, context.cwd, context.home),
-      write: context.write
-    }),
+    await ensureSkill(context, "codex", "Codex skill"),
     ...singleAgentAdvice(context, "codex")
   ];
 }
 async function setupClaudeCode(context) {
+  if (context.skillOnly) {
+    return [
+      await ensureSkill(context, "claude-code", "Claude Code skill"),
+      ...singleAgentAdvice(context, "claude-code")
+    ];
+  }
   return [
     await ensureClaudeMcp(context),
-    await ensureSkill({
-      title: "Claude Code skill",
-      sourceDir: context.sourceSkillDir,
-      destinationDir: skillDestination("claude-code", context.scope, context.cwd, context.home),
-      write: context.write
-    }),
+    await ensureSkill(context, "claude-code", "Claude Code skill"),
     ...singleAgentAdvice(context, "claude-code")
   ];
 }
 async function ensureCodexMcp(context) {
-  const configPath = join3(context.home, ".codex", "config.toml");
+  const configPath = join6(context.codexHome, "config.toml");
   const snippet = buildCodexMcpToml(context.mcpCommand);
   const current = await readOptionalFile(configPath);
   if (hasCodexMcpContent(current)) {
@@ -186057,7 +187605,7 @@ async function ensureCodexMcp(context) {
       title: "Codex MCP",
       status: "skipped",
       path: configPath,
-      detail: "existing [mcp_servers.kyoso] kept"
+      detail: codexMcpStatusFromContent(current) === "disabled" ? disabledCodexMcpDetail(configPath) : "existing [mcp_servers.kyoso] kept"
     };
   }
   const detail = diffForAppend(configPath, snippet);
@@ -186068,8 +187616,8 @@ async function ensureCodexMcp(context) {
 `) ? `
 
 ` : "";
-  await mkdir3(dirname4(configPath), { recursive: true });
-  await writeFile3(configPath, `${current}${separator}${snippet}`, "utf8");
+  await mkdir5(dirname7(configPath), { recursive: true });
+  await writeFile4(configPath, `${current}${separator}${snippet}`, "utf8");
   return {
     title: "Codex MCP",
     status: current.length > 0 ? "updated" : "created",
@@ -186081,15 +187629,15 @@ async function ensureClaudeMcp(context) {
   if (context.scope === "global") {
     return ensureClaudeGlobalMcp(context);
   }
-  const configPath = join3(context.cwd, ".mcp.json");
+  const configPath = join6(context.cwd, ".mcp.json");
   const current = await readJsonObject(configPath);
   const mcpServers = recordValue(current.mcpServers);
-  if (isRecord5(mcpServers.kyoso)) {
+  if (isRecord7(mcpServers.kyoso)) {
     return {
       title: "Claude Code MCP",
       status: "skipped",
       path: configPath,
-      detail: "existing mcpServers.kyoso kept"
+      detail: mcpEntryStatus(mcpServers.kyoso) === "disabled" ? disabledClaudeMcpDetail(configPath) : "existing mcpServers.kyoso kept"
     };
   }
   const next = {
@@ -186108,7 +187656,7 @@ async function ensureClaudeMcp(context) {
       detail
     };
   }
-  await writeFile3(configPath, `${JSON.stringify(next, null, 2)}
+  await writeFile4(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return {
     title: "Claude Code MCP",
@@ -186118,13 +187666,14 @@ async function ensureClaudeMcp(context) {
   };
 }
 function ensureClaudeGlobalMcp(context) {
-  const configPath = join3(context.home, ".claude.json");
-  if (hasClaudeMcp(configPath)) {
+  const configPath = join6(context.home, ".claude.json");
+  const existingMcp = detectClaudeMcp(configPath, context.cwd, context.home);
+  if (existingMcp.status !== "missing") {
     return {
       title: "Claude Code MCP",
       status: "skipped",
       path: configPath,
-      detail: "existing mcpServers.kyoso kept"
+      detail: existingMcp.status === "disabled" ? disabledClaudeMcpDetail(configPath) : "existing mcpServers.kyoso kept"
     };
   }
   const json2 = JSON.stringify(buildClaudeMcpEntry(context.mcpCommand));
@@ -186138,7 +187687,7 @@ function ensureClaudeGlobalMcp(context) {
       detail: commandLine
     };
   }
-  const result = spawnSync("claude", args, { encoding: "utf8" });
+  const result = spawnSync2("claude", args, { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(result.stderr || result.stdout || "claude mcp add-json failed");
   }
@@ -186149,43 +187698,25 @@ function ensureClaudeGlobalMcp(context) {
     detail: commandLine
   };
 }
-async function ensureSkill(options) {
-  const destinationSkill = join3(options.destinationDir, "SKILL.md");
-  if (existsSync(destinationSkill)) {
-    return {
-      title: options.title,
-      status: "skipped",
-      path: options.destinationDir,
-      detail: "existing kyoso-review skill kept"
-    };
-  }
-  const detail = [
-    `copy ${options.sourceDir}`,
-    `to   ${options.destinationDir}`
-  ].join(`
-`);
-  if (!options.write) {
-    return {
-      title: options.title,
-      status: "dry-run",
-      path: options.destinationDir,
-      detail
-    };
-  }
-  await mkdir3(dirname4(options.destinationDir), { recursive: true });
-  await cp(options.sourceDir, options.destinationDir, {
-    recursive: true,
-    force: false
+async function ensureSkill(context, client, title) {
+  const result = await ensureManagedSkill({
+    sourceDir: context.sourceSkillDir,
+    destinationDir: skillDestination(client, context.scope, context.cwd, context.home),
+    trustedRoot: context.scope === "global" ? context.home : context.cwd,
+    write: context.write,
+    force: context.force
   });
   return {
-    title: options.title,
-    status: "created",
-    path: options.destinationDir,
-    detail
+    title,
+    ...result
   };
 }
 function renderSetupOverview(context) {
-  const detected = detectSetup({ cwd: context.cwd, home: context.home });
+  const detected = detectSetup({
+    cwd: context.cwd,
+    home: context.home,
+    codexHome: context.codexHome
+  });
   return [
     "Kyoso setup",
     "",
@@ -186194,8 +187725,10 @@ function renderSetupOverview(context) {
     `  claude-code: MCP ${statusWord(detected["claude-code"].mcp)}, skill ${statusWord(detected["claude-code"].skill)}`,
     "",
     "Commands",
-    "  kyoso setup codex [--write] [--runner npx|bunx] [--global]",
-    "  kyoso setup claude-code [--write] [--runner npx|bunx] [--global]",
+    "  kyoso setup codex [--write] [--runner npx|bunx] [--command <command>] [--global] [--force]",
+    "  kyoso setup claude-code [--write] [--runner npx|bunx] [--command <command>] [--global] [--force]",
+    "  kyoso setup codex --skill-only [--write] [--global] [--force]",
+    "  kyoso setup claude-code --skill-only [--write] [--global] [--force]",
     "",
     `Default MCP command: ${context.mcpCommand.command} ${context.mcpCommand.args.join(" ")}`,
     "Dry-run is the default. Add --write to modify files."
@@ -186221,6 +187754,19 @@ function parseClient(client) {
     return client;
   throw new Error(`Invalid setup client "${client}". Expected codex or claude-code.`);
 }
+function validateSkillOnlyOptions(options, client) {
+  if (!options.skillOnly)
+    return;
+  if (!client) {
+    throw new Error("--skill-only requires setup client codex or claude-code.");
+  }
+  if (options.runner !== undefined) {
+    throw new Error("--skill-only cannot be combined with --runner.");
+  }
+  if (options.command !== undefined) {
+    throw new Error("--skill-only cannot be combined with --command.");
+  }
+}
 function parseRunner(runner) {
   if (runner === undefined || runner === "npx")
     return "npx";
@@ -186268,21 +187814,21 @@ function splitCommand(value) {
   return parts;
 }
 function resolveBundledSkillDir() {
-  const start = dirname4(fileURLToPath(import.meta.url));
+  const start = dirname7(fileURLToPath(import.meta.url));
   let current = start;
   for (let depth = 0;depth < 5; depth += 1) {
-    const candidate = join3(current, ".agents", "skills", "kyoso-review");
-    if (existsSync(join3(candidate, "SKILL.md")))
+    const candidate = join6(current, ".agents", "skills", "kyoso-review");
+    if (existsSync2(join6(candidate, "SKILL.md")))
       return candidate;
-    current = dirname4(current);
+    current = dirname7(current);
   }
   throw new Error("Bundled kyoso-review skill was not found in this package.");
 }
 async function readOptionalFile(path) {
   try {
-    return await readFile5(path, "utf8");
+    return await readFile6(path, "utf8");
   } catch (error51) {
-    if (isMissingPathError2(error51))
+    if (isMissingPathError4(error51))
       return "";
     throw error51;
   }
@@ -186292,41 +187838,180 @@ async function readJsonObject(path) {
   if (content.trim().length === 0)
     return {};
   const parsed = JSON.parse(content);
-  if (!isRecord5(parsed))
+  if (!isRecord7(parsed))
     throw new Error(`${path} must contain a JSON object`);
   return parsed;
 }
-function hasCodexMcp(path) {
-  return existsSync(path) && hasCodexMcpContent(readTextSync(path));
-}
 function hasCodexMcpContent(content) {
   return /^\s*\[mcp_servers\.(?:"kyoso"|kyoso)]\s*$/m.test(content);
 }
-function hasClaudeMcp(path) {
-  if (!existsSync(path))
-    return false;
+function codexMcpStatusFromContent(content) {
+  try {
+    const parsed = parse5(content);
+    if (!isRecord7(parsed))
+      return "unknown";
+    if (!isRecord7(parsed.mcp_servers))
+      return "missing";
+    if (!("kyoso" in parsed.mcp_servers))
+      return "missing";
+    return mcpEntryStatus(parsed.mcp_servers.kyoso);
+  } catch {
+    return "unknown";
+  }
+}
+function disabledCodexMcpDetail(configPath) {
+  return [
+    "existing [mcp_servers.kyoso] is disabled and was kept unchanged.",
+    `To re-enable it, edit ${configPath} and change enabled = false to enabled = true.`
+  ].join(" ");
+}
+function disabledClaudeMcpDetail(configPath) {
+  return [
+    "existing mcpServers.kyoso is disabled and was kept unchanged.",
+    `To re-enable it, edit ${configPath} and change "enabled": false to "enabled": true.`
+  ].join(" ");
+}
+function detectCodexMcp(path, cwd, home) {
+  if (!existsSync2(path))
+    return { status: "missing", paths: [] };
+  try {
+    const parsed = parse5(readTextSync(path));
+    if (hasUnprobedProjectIntegrationOverride(parsed, cwd, home)) {
+      return { status: "unknown", paths: [path] };
+    }
+    if (!isRecord7(parsed))
+      return { status: "unknown", paths: [path] };
+    if (!("mcp_servers" in parsed))
+      return { status: "missing", paths: [] };
+    if (!isRecord7(parsed.mcp_servers)) {
+      return { status: "unknown", paths: [path] };
+    }
+    if (!("kyoso" in parsed.mcp_servers)) {
+      return { status: "missing", paths: [] };
+    }
+    return { status: mcpEntryStatus(parsed.mcp_servers.kyoso), paths: [path] };
+  } catch {
+    return { status: "unknown", paths: [path] };
+  }
+}
+function detectClaudeMcp(path, cwd, home) {
+  if (!existsSync2(path))
+    return { status: "missing", paths: [] };
   try {
     const parsed = JSON.parse(readTextSync(path));
-    return jsonHasKyosoMcp(parsed);
+    const statuses = jsonMcpStatuses(parsed, cwd, home);
+    if (statuses.length === 0)
+      return { status: "missing", paths: [] };
+    return { status: mergeMcpStatuses(statuses), paths: [path] };
   } catch {
-    return false;
+    return { status: "unknown", paths: [path] };
+  }
+}
+function jsonMcpStatuses(value, cwd, home) {
+  if (!isRecord7(value))
+    return ["unknown"];
+  const statuses = directMcpStatuses(value);
+  if (!("projects" in value))
+    return statuses;
+  if (!isRecord7(value.projects))
+    return [...statuses, "unknown"];
+  const currentProject = normalizeProjectPath(cwd, home);
+  for (const [projectPath, projectConfig] of Object.entries(value.projects)) {
+    if (normalizeProjectPath(projectPath, home) !== currentProject)
+      continue;
+    if (!isRecord7(projectConfig)) {
+      statuses.push("unknown");
+      continue;
+    }
+    statuses.push(...directMcpStatuses(projectConfig));
   }
+  return statuses;
 }
-function jsonHasKyosoMcp(value) {
-  if (!isRecord5(value))
+function directMcpStatuses(value) {
+  const statuses = [];
+  if ("mcpServers" in value) {
+    if (!isRecord7(value.mcpServers)) {
+      statuses.push("unknown");
+    } else if ("kyoso" in value.mcpServers) {
+      statuses.push(mcpEntryStatus(value.mcpServers.kyoso));
+    }
+  }
+  return statuses;
+}
+function nestedMcpEntryStatus(value, path) {
+  let current = value;
+  for (const key of path) {
+    if (!isRecord7(current))
+      return "unknown";
+    if (!(key in current))
+      return "missing";
+    current = current[key];
+  }
+  return mcpEntryStatus(current);
+}
+function hasUnprobedProjectIntegrationOverride(value, cwd, home) {
+  if (!isRecord7(value) || !isRecord7(value.projects))
     return false;
-  if (isRecord5(value.mcpServers) && isRecord5(value.mcpServers.kyoso)) {
-    return true;
+  const currentProject = normalizeProjectPath(cwd, home);
+  for (const [projectPath, projectConfig] of Object.entries(value.projects)) {
+    if (normalizeProjectPath(projectPath, home) !== currentProject || !isRecord7(projectConfig)) {
+      continue;
+    }
+    if ("mcp_servers" in projectConfig || "plugins" in projectConfig) {
+      return true;
+    }
   }
-  return Object.values(value).some((child) => jsonHasKyosoMcp(child));
+  return false;
+}
+function normalizeProjectPath(path, home) {
+  if (path.trim().length === 0)
+    return;
+  const expanded = path === "~" ? home : path.startsWith("~/") || path.startsWith("~\\") ? join6(home, path.slice(2)) : path;
+  const resolved = resolve7(expanded);
+  let normalized;
+  try {
+    normalized = realpathSync2(resolved);
+  } catch {
+    normalized = resolved;
+  }
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function mcpEntryStatus(value) {
+  if (!isRecord7(value))
+    return "unknown";
+  if (!("enabled" in value))
+    return "enabled";
+  if (value.enabled === true)
+    return "enabled";
+  if (value.enabled === false)
+    return "disabled";
+  return "unknown";
+}
+function mergeMcpDetections(detections) {
+  return {
+    status: mergeMcpStatuses(detections.map((detection) => detection.status)),
+    paths: detections.flatMap((detection) => detection.paths)
+  };
+}
+function mergeMcpStatuses(statuses) {
+  if (statuses.includes("enabled"))
+    return "enabled";
+  if (statuses.includes("unknown"))
+    return "unknown";
+  if (statuses.includes("disabled"))
+    return "disabled";
+  return "missing";
+}
+function existingSkillPaths(paths) {
+  return [...new Set(paths)].filter((path) => existsSync2(join6(path, "SKILL.md")));
 }
 function readTextSync(path) {
-  return readFileSync(path, "utf8");
+  return readFileSync2(path, "utf8");
 }
 function recordValue(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 }
-function isRecord5(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function diffForAppend(path, snippet) {
@@ -186357,7 +188042,7 @@ function statusWord(value) {
   return value ? "ok" : "missing";
 }
 function singleAgentAdvice(context, client) {
-  if (client === "claude-code" && !commandExists("codex", context.env)) {
+  if (client === "claude-code" && !commandExists2("codex", context.env)) {
     return [
       {
         title: "Single-agent config",
@@ -186373,7 +188058,7 @@ function singleAgentAdvice(context, client) {
       }
     ];
   }
-  if (client === "codex" && !commandExists("claude", context.env)) {
+  if (client === "codex" && !commandExists2("claude", context.env)) {
     return [
       {
         title: "Single-agent config",
@@ -186401,11 +188086,11 @@ function shellQuote(value) {
     return value;
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function commandExists(command, env) {
-  const paths = env.PATH?.split(delimiter) ?? [];
-  return paths.some((path) => existsSync(join3(path, command)));
+function commandExists2(command, env) {
+  const paths = env.PATH?.split(delimiter2) ?? [];
+  return paths.some((path) => existsSync2(join6(path, command)));
 }
-function isMissingPathError2(error51) {
+function isMissingPathError4(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
 }
 
@@ -186414,11 +188099,11 @@ async function runDoctor(options) {
   const env = options.env ?? process.env;
   const loaded = await loadConfig(options);
   const globalConfigPath = resolveGlobalTomlConfigPath(env);
-  const projectTomlPath = resolve4(options.cwd, "kyoso.toml");
-  const projectTsPath = resolve4(options.cwd, "kyoso.config.ts");
+  const projectTomlPath = resolve8(options.cwd, "kyoso.toml");
+  const projectTsPath = resolve8(options.cwd, "kyoso.config.ts");
   const lines = ["Kyoso doctor", "", "Runtime"];
-  lines.push(`  Bun: ${commandExists2("bun", env) ? "ok" : "warning not found"}`);
-  lines.push(`  Node/npm: ${commandExists2("npm", env) ? "ok" : "warning npm not found"}`);
+  lines.push(`  Bun: ${commandExists3("bun", env) ? "ok" : "warning not found"}`);
+  lines.push(`  Node/npm: ${commandExists3("npm", env) ? "ok" : "warning npm not found"}`);
   lines.push("", "Config");
   lines.push(`  global config.toml: ${formatLayer(loaded, "global_toml", globalConfigPath)}`);
   lines.push(`  kyoso.toml: ${formatLayer(loaded, "project_toml", projectTomlPath)}`);
@@ -186428,36 +188113,37 @@ async function runDoctor(options) {
     lines.push(`  config hash: ${loaded.configHash}`);
   for (const warning of loaded.warnings)
     lines.push(`  warning: ${warning}`);
-  const setup = detectSetup({ cwd: options.cwd, home: env.HOME });
+  const setup = detectSetup({ cwd: options.cwd, env });
+  const cli = detectCli({ cwd: options.cwd, env });
+  const codexIntegration = determineCodexIntegration({
+    cwd: options.cwd,
+    env,
+    setup: setup.codex,
+    cli,
+    pluginInspector: options.pluginInspector ?? inspectCodexPlugin,
+    mcpListInspector: options.mcpListInspector ?? inspectCodexMcpList
+  });
+  const claudeIntegration = determineClientIntegration("claude-code", setup["claude-code"], cli);
   lines.push("", "MCP", "  stdio server: ok");
-  lines.push(`  Codex registration: ${setup.codex.mcp ? "ok" : "missing"}`);
-  lines.push(`  Claude Code registration: ${setup["claude-code"].mcp ? "ok" : "missing"}`);
-  if (!setup.codex.mcp) {
-    lines.push("    next: run `npx @kyo-so/cli setup codex --write`");
-  }
-  if (!setup["claude-code"].mcp) {
-    lines.push("    next: run `npx @kyo-so/cli setup claude-code --write`");
-  }
+  lines.push(`  Codex registration: ${formatManualMcpStatus(setup.codex.manualMcpStatus)}`);
+  lines.push(`  Claude Code registration: ${formatManualMcpStatus(setup["claude-code"].manualMcpStatus)}`);
   lines.push("", "Skills");
   lines.push(`  Codex kyoso-review: ${setup.codex.skill ? "ok" : "missing"}`);
   lines.push(`  Claude Code kyoso-review: ${setup["claude-code"].skill ? "ok" : "missing"}`);
-  if (!setup.codex.skill) {
-    lines.push("    next: run `npx @kyo-so/cli setup codex --write`");
-  }
-  if (!setup["claude-code"].skill) {
-    lines.push("    next: run `npx @kyo-so/cli setup claude-code --write`");
-  }
+  lines.push("", "Integration");
+  appendIntegration(lines, codexIntegration);
+  appendIntegration(lines, claudeIntegration);
   lines.push("", "ACP agents");
   const agentCommandExists = {
-    codex: commandExists2(loaded.config.agents.codex.command, env),
-    claude: commandExists2(loaded.config.agents.claude.command, env)
+    codex: commandExists3(loaded.config.agents.codex.command, env),
+    claude: commandExists3(loaded.config.agents.claude.command, env)
   };
   for (const agent of ["codex", "claude"]) {
     const config2 = loaded.config.agents[agent];
     const exists3 = agentCommandExists[agent];
     lines.push(`  ${agent === "codex" ? "Codex" : "Claude"}: ${exists3 ? "ok" : "warning command not found"}`);
     lines.push(`    command: ${[config2.command, ...config2.args].join(" ")}`);
-    if (!exists3 && config2.command === "npx" && commandExists2("bunx", env)) {
+    if (!exists3 && config2.command === "npx" && commandExists3("bunx", env)) {
       lines.push('    hint: set agents.<name>.command = "bunx" in config.toml');
     }
     if (agent === "claude") {
@@ -186492,10 +188178,209 @@ async function runDoctor(options) {
   lines.push(`  network default: ${loaded.config.network.defaultMode}`);
   lines.push("", "Audit");
   lines.push(`  directory: ${loaded.config.audit.directory}`);
+  const auditStateRoot = await inspectAuditStateRootCapability({
+    cwd: options.cwd,
+    env
+  });
+  lines.push(`  state root: ${auditStateRoot.available ? "available" : "unavailable"}`);
   lines.push(`  raw agent output: ${loaded.config.audit.includeRawAgentOutput ? "enabled" : "disabled"}`);
   return lines.join(`
 `);
 }
+function determineCodexIntegration(options) {
+  const fallback = determineClientIntegration("codex", options.setup, options.cli);
+  const plugin = options.pluginInspector({
+    cwd: options.cwd,
+    env: options.env
+  });
+  if (plugin.status === "unsupported") {
+    return withPluginDetails(withIntegrationWarnings(fallback, [
+      `Plugin detection unsupported: ${formatCodexInspectionFailure(plugin.failure)}`
+    ], undefined, "not applicable"), "unsupported", "not applicable");
+  }
+  if (plugin.plugin.state === "not_installed") {
+    return withPluginDetails(fallback, "not installed", "not applicable");
+  }
+  if (plugin.plugin.state === "disabled") {
+    return withPluginDetails(withIntegrationWarnings(fallback, ["Plugin disabled."], undefined, undefined), "installed, disabled", "disabled with Plugin");
+  }
+  const pluginWarnings = pluginSkillWarnings(options.setup);
+  const override = detectCodexPluginMcpOverride({
+    cwd: options.cwd,
+    env: options.env
+  });
+  if (options.setup.manualMcpStatus === "unknown") {
+    return withPluginDetails(withIntegrationWarnings(fallback, [
+      ...pluginWarnings,
+      "Plugin MCP origin is unknown because the manual MCP configuration could not be classified."
+    ], "unknown", "unknown"), "installed, enabled", "unknown");
+  }
+  if (options.setup.manualMcpStatus === "enabled" && override.status !== "disabled") {
+    return withPluginDetails(withIntegrationWarnings({
+      ...fallback,
+      mode: "manual-mcp",
+      advice: integrationAdvice("manual-mcp", "codex")
+    }, [
+      ...pluginWarnings,
+      "Plugin and manual Codex MCP registrations coexist; neither registration was changed.",
+      "Plugin MCP origin is unknown while a manual MCP registration is enabled."
+    ], undefined, "unknown"), "installed, enabled", "unknown");
+  }
+  if (override.status === "unknown") {
+    return withPluginDetails(withIntegrationWarnings(fallback, [
+      ...pluginWarnings,
+      "Plugin MCP override could not be safely classified from the Codex configuration."
+    ], "unknown", "unknown"), "installed, enabled", "unknown");
+  }
+  if (override.status === "disabled" && options.setup.manualMcpStatus === "enabled") {
+    return withPluginDetails(withIntegrationWarnings({
+      ...fallback,
+      mode: "manual-mcp",
+      advice: integrationAdvice("manual-mcp", "codex")
+    }, [
+      ...pluginWarnings,
+      "Plugin and manual Codex MCP registrations coexist; neither registration was changed.",
+      "Plugin MCP is disabled by configuration override while the manual MCP remains enabled."
+    ], undefined, "disabled by configuration override"), "installed, enabled", "disabled by configuration override");
+  }
+  if (override.status === "disabled" && options.setup.manualMcpStatus === "disabled") {
+    return withPluginDetails(withIntegrationWarnings({
+      ...fallback,
+      mode: "plugin-skill",
+      advice: integrationAdvice("plugin-skill", "codex")
+    }, pluginWarnings, undefined, "disabled by configuration override"), "installed, enabled", "disabled by configuration override");
+  }
+  if (options.setup.manualMcpStatus === "disabled") {
+    return withPluginDetails(withIntegrationWarnings({
+      ...fallback,
+      mode: "plugin-mcp",
+      advice: integrationAdvice("plugin-mcp", "codex")
+    }, pluginWarnings, undefined, "enabled (manual registration is disabled)"), "installed, enabled", "enabled (manual registration is disabled)");
+  }
+  const effectiveMcp = options.mcpListInspector({
+    cwd: options.cwd,
+    env: options.env
+  });
+  if (effectiveMcp.status === "unsupported") {
+    return withPluginDetails(withIntegrationWarnings(fallback, [
+      ...pluginWarnings,
+      `Plugin MCP effective-state check unsupported: ${formatCodexInspectionFailure(effectiveMcp.failure)}`
+    ], "unknown", "unknown"), "installed, enabled", "unknown");
+  }
+  const expectedEffectiveState = override.status === "disabled" ? "disabled" : "enabled";
+  if (effectiveMcp.kyoso === "enabled" && expectedEffectiveState === "enabled") {
+    return withPluginDetails(withIntegrationWarnings({
+      ...fallback,
+      mode: "plugin-mcp",
+      advice: integrationAdvice("plugin-mcp", "codex")
+    }, pluginWarnings, undefined, "enabled"), "installed, enabled", "enabled");
+  }
+  if (effectiveMcp.kyoso === "disabled" && expectedEffectiveState === "disabled") {
+    return withPluginDetails(withIntegrationWarnings({
+      ...fallback,
+      mode: "plugin-skill",
+      advice: integrationAdvice("plugin-skill", "codex")
+    }, pluginWarnings, undefined, "disabled"), "installed, enabled", "disabled");
+  }
+  if (effectiveMcp.kyoso === "enabled" || effectiveMcp.kyoso === "disabled") {
+    return withPluginDetails(withIntegrationWarnings(fallback, [
+      ...pluginWarnings,
+      "Plugin MCP effective state does not match the recorded configuration precedence; Plugin MCP mode was not inferred."
+    ], "unknown", "unknown"), "installed, enabled", "unknown");
+  }
+  return withPluginDetails(withIntegrationWarnings(fallback, [
+    ...pluginWarnings,
+    "Plugin MCP effective state is unknown; Plugin MCP mode was not inferred."
+  ], "unknown", "unknown"), "installed, enabled", "unknown");
+}
+function determineClientIntegration(client, setup, cli) {
+  const integration = determineNonPluginIntegration({
+    manualMcpStatus: setup.manualMcpStatus,
+    hasSkill: setup.skill,
+    cli
+  });
+  return {
+    client: client === "codex" ? "Codex" : "Claude Code",
+    commandClient: client,
+    mode: integration.mode,
+    setup,
+    cli,
+    warnings: integration.warnings,
+    advice: integrationAdvice(integration.mode, client)
+  };
+}
+function withPluginDetails(integration, plugin, pluginMcp) {
+  return { ...integration, plugin, pluginMcp };
+}
+function withIntegrationWarnings(integration, warnings, mode, pluginMcp) {
+  const nextMode = mode ?? integration.mode;
+  return {
+    ...integration,
+    mode: nextMode,
+    warnings: [...integration.warnings, ...warnings],
+    advice: integrationAdvice(nextMode, integration.commandClient),
+    ...pluginMcp ? { pluginMcp } : {}
+  };
+}
+function pluginSkillWarnings(setup) {
+  if (!setup.skill)
+    return [];
+  return [
+    `Plugin Skill and manual Skill copy coexist; priority is not inferred. Manual Skill path(s): ${setup.skillPaths.join(", ")}`
+  ];
+}
+function appendIntegration(lines, integration) {
+  lines.push(`  ${integration.client} integration: ${integration.mode}`);
+  lines.push(`    manual MCP: ${formatManualMcpStatus(integration.setup.manualMcpStatus)}`);
+  if (integration.setup.mcpPaths.length > 0) {
+    lines.push(`    manual MCP path(s): ${integration.setup.mcpPaths.join(", ")}`);
+  }
+  lines.push(`    Skill: ${integration.setup.skill ? "ok" : "missing"}`);
+  if (integration.setup.skillPaths.length > 0) {
+    lines.push(`    manual Skill path(s): ${integration.setup.skillPaths.join(", ")}`);
+  }
+  lines.push(`    CLI: ${formatCliAvailability(integration.cli.kyoso)}`);
+  lines.push(`    npx: ${integration.cli.npx ? "available" : "missing"}`);
+  lines.push(`    bunx: ${integration.cli.bunx ? "available" : "missing"}`);
+  if (integration.plugin)
+    lines.push(`    Plugin: ${integration.plugin}`);
+  if (integration.pluginMcp) {
+    lines.push(`    Plugin MCP: ${integration.pluginMcp}`);
+  }
+  for (const warning of integration.warnings) {
+    lines.push(`    warning: ${warning}`);
+  }
+  lines.push(`    ${integration.advice}`);
+}
+function formatManualMcpStatus(status) {
+  if (status === "enabled")
+    return "ok";
+  return status;
+}
+function integrationAdvice(mode, client) {
+  if (mode === "plugin-mcp" || mode === "manual-mcp") {
+    return "status: ready";
+  }
+  if (mode === "plugin-skill") {
+    return "status: bundled Plugin MCP is disabled; re-enable it or remove the Plugin and use CLI plus Skill-only.";
+  }
+  if (mode === "cli-skill") {
+    return "status: ready; MCP is optional for CLI plus Skill mode.";
+  }
+  if (mode === "skill-on-demand") {
+    return "status: runnable on demand; package-runner fallback may need network access.";
+  }
+  if (mode === "mcp-only") {
+    return `next: run \`npx @kyo-so/cli setup ${client} --write --skill-only\``;
+  }
+  if (mode === "cli-only") {
+    return `next: run \`kyoso setup ${client} --write --skill-only\``;
+  }
+  if (mode === "missing") {
+    return "next: choose a Marketplace Plugin, CLI plus Skill, or traditional MCP setup.";
+  }
+  return "status: inspect the warnings before changing integration state.";
+}
 function formatLayer(loaded, layer, defaultPath) {
   const source = loaded.sources.find((candidate) => candidate.layer === layer);
   return source ? `found ${source.path}` : `not found ${defaultPath}`;
@@ -186529,11 +188414,11 @@ function formatClaudeDualAuthWarning(preferApiKey) {
 function hasEnv2(env, key) {
   return typeof env[key] === "string" && env[key].trim().length > 0;
 }
-function commandExists2(command, env) {
-  const paths = env.PATH?.split(delimiter2) ?? [];
+function commandExists3(command, env) {
+  const paths = env.PATH?.split(delimiter3) ?? [];
   return paths.some((path) => {
     try {
-      accessSync(`${path}/${command}`);
+      accessSync2(`${path}/${command}`);
       return true;
     } catch {
       return false;
@@ -186542,13 +188427,13 @@ function commandExists2(command, env) {
 }
 
 // src/cli/init.ts
-import { access as access3, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { access as access3, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 async function runInit(options) {
-  const configPath = join4(options.cwd, "kyoso.toml");
-  const tsConfigPath = join4(options.cwd, "kyoso.config.ts");
-  const skillPath = join4(options.cwd, ".agents/skills/kyoso-review/SKILL.md");
-  const gitignorePath = join4(options.cwd, ".gitignore");
+  const configPath = join7(options.cwd, "kyoso.toml");
+  const tsConfigPath = join7(options.cwd, "kyoso.config.ts");
+  const skillPath = join7(options.cwd, ".agents/skills/kyoso-review/SKILL.md");
+  const gitignorePath = join7(options.cwd, ".gitignore");
   const configResult = await writeFileWithOverwritePrompt(configPath, CONFIG_TEMPLATE, options.force);
   const skillResult = await writeFileWithOverwritePrompt(skillPath, SKILL_TEMPLATE, options.force);
   const gitignoreResult = await ensureGitignoreEntry(gitignorePath, ".kyoso/");
@@ -186566,11 +188451,11 @@ async function runInit(options) {
 async function ensureGitignoreEntry(path, entry) {
   let content = "";
   try {
-    content = await readFile6(path, "utf8");
+    content = await readFile7(path, "utf8");
   } catch (error51) {
-    if (!isMissingPathError3(error51))
+    if (!isMissingPathError5(error51))
       throw error51;
-    await writeFile4(path, `${entry}
+    await writeFile5(path, `${entry}
 `, "utf8");
     return "created";
   }
@@ -186580,11 +188465,11 @@ async function ensureGitignoreEntry(path, entry) {
   const separator = content.length > 0 && !content.endsWith(`
 `) ? `
 ` : "";
-  await writeFile4(path, `${content}${separator}${entry}
+  await writeFile5(path, `${content}${separator}${entry}
 `, "utf8");
   return "updated";
 }
-function isMissingPathError3(error51) {
+function isMissingPathError5(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
 }
 async function exists3(path) {
@@ -187067,11 +188952,11 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
       const rhs = this.rhs === undefined ? "" : ` = ${this.rhs}`;
       return `${varKind} ${this.name}${rhs};` + _n;
     }
-    optimizeNames(names, constants) {
+    optimizeNames(names, constants2) {
       if (!names[this.name.str])
         return;
       if (this.rhs)
-        this.rhs = optimizeExpr(this.rhs, names, constants);
+        this.rhs = optimizeExpr(this.rhs, names, constants2);
       return this;
     }
     get names() {
@@ -187088,10 +188973,10 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
     render({ _n }) {
       return `${this.lhs} = ${this.rhs};` + _n;
     }
-    optimizeNames(names, constants) {
+    optimizeNames(names, constants2) {
       if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
         return;
-      this.rhs = optimizeExpr(this.rhs, names, constants);
+      this.rhs = optimizeExpr(this.rhs, names, constants2);
       return this;
     }
     get names() {
@@ -187150,8 +189035,8 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
     optimizeNodes() {
       return `${this.code}` ? this : undefined;
     }
-    optimizeNames(names, constants) {
-      this.code = optimizeExpr(this.code, names, constants);
+    optimizeNames(names, constants2) {
+      this.code = optimizeExpr(this.code, names, constants2);
       return this;
     }
     get names() {
@@ -187180,12 +189065,12 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
       }
       return nodes.length > 0 ? this : undefined;
     }
-    optimizeNames(names, constants) {
+    optimizeNames(names, constants2) {
       const { nodes } = this;
       let i = nodes.length;
       while (i--) {
         const n = nodes[i];
-        if (n.optimizeNames(names, constants))
+        if (n.optimizeNames(names, constants2))
           continue;
         subtractNames(names, n.names);
         nodes.splice(i, 1);
@@ -187238,12 +189123,12 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
         return;
       return this;
     }
-    optimizeNames(names, constants) {
+    optimizeNames(names, constants2) {
       var _a3;
-      this.else = (_a3 = this.else) === null || _a3 === undefined ? undefined : _a3.optimizeNames(names, constants);
-      if (!(super.optimizeNames(names, constants) || this.else))
+      this.else = (_a3 = this.else) === null || _a3 === undefined ? undefined : _a3.optimizeNames(names, constants2);
+      if (!(super.optimizeNames(names, constants2) || this.else))
         return;
-      this.condition = optimizeExpr(this.condition, names, constants);
+      this.condition = optimizeExpr(this.condition, names, constants2);
       return this;
     }
     get names() {
@@ -187266,10 +189151,10 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
     render(opts) {
       return `for(${this.iteration})` + super.render(opts);
     }
-    optimizeNames(names, constants) {
-      if (!super.optimizeNames(names, constants))
+    optimizeNames(names, constants2) {
+      if (!super.optimizeNames(names, constants2))
         return;
-      this.iteration = optimizeExpr(this.iteration, names, constants);
+      this.iteration = optimizeExpr(this.iteration, names, constants2);
       return this;
     }
     get names() {
@@ -187304,10 +189189,10 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
     render(opts) {
       return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
     }
-    optimizeNames(names, constants) {
-      if (!super.optimizeNames(names, constants))
+    optimizeNames(names, constants2) {
+      if (!super.optimizeNames(names, constants2))
         return;
-      this.iterable = optimizeExpr(this.iterable, names, constants);
+      this.iterable = optimizeExpr(this.iterable, names, constants2);
       return this;
     }
     get names() {
@@ -187348,11 +189233,11 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
       (_b = this.finally) === null || _b === undefined || _b.optimizeNodes();
       return this;
     }
-    optimizeNames(names, constants) {
+    optimizeNames(names, constants2) {
       var _a3, _b;
-      super.optimizeNames(names, constants);
-      (_a3 = this.catch) === null || _a3 === undefined || _a3.optimizeNames(names, constants);
-      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants);
+      super.optimizeNames(names, constants2);
+      (_a3 = this.catch) === null || _a3 === undefined || _a3.optimizeNames(names, constants2);
+      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants2);
       return this;
     }
     get names() {
@@ -187621,7 +189506,7 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
   function addExprNames(names, from) {
     return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
   }
-  function optimizeExpr(expr, names, constants) {
+  function optimizeExpr(expr, names, constants2) {
     if (expr instanceof code_1.Name)
       return replaceName(expr);
     if (!canOptimize(expr))
@@ -187636,14 +189521,14 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
       return items;
     }, []));
     function replaceName(n) {
-      const c = constants[n.str];
+      const c = constants2[n.str];
       if (c === undefined || names[n.str] !== 1)
         return n;
       delete names[n.str];
       return c;
     }
     function canOptimize(e) {
-      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants[c.str] !== undefined);
+      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== undefined);
     }
   }
   function subtractNames(names, from) {
@@ -188780,8 +190665,8 @@ var require_resolve = /* @__PURE__ */ __commonJSMin((exports) => {
     }
     return count;
   }
-  function getFullPath(resolver, id = "", normalize) {
-    if (normalize !== false)
+  function getFullPath(resolver, id = "", normalize2) {
+    if (normalize2 !== false)
       id = normalizeId(id);
     return _getFullPath(resolver, resolver.parse(id));
   }
@@ -189496,7 +191381,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve5.call(this, root, ref);
+    let _sch = resolve9.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a3 = root.localRefs) === null || _a3 === undefined ? undefined : _a3[ref];
       const { schemaId } = this.opts;
@@ -189527,7 +191412,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve5(root, ref) {
+  function resolve9(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -190026,60 +191911,60 @@ var require_schemes = /* @__PURE__ */ __commonJSMin((exports, module) => {
 var require_fast_uri = /* @__PURE__ */ __commonJSMin((exports, module) => {
   const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
   const { SCHEMES, getSchemeHandler } = require_schemes();
-  function normalize(uri, options) {
+  function normalize2(uri, options) {
     if (typeof uri === "string")
       uri = serialize(parse6(uri, options), options);
     else if (typeof uri === "object")
       uri = parse6(serialize(uri, options), options);
     return uri;
   }
-  function resolve5(baseURI, relativeURI, options) {
+  function resolve9(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative3, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse6(serialize(base, options), options);
-      relative = parse6(serialize(relative, options), options);
+      relative3 = parse6(serialize(relative3, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative3.scheme) {
+      target.scheme = relative3.scheme;
+      target.userinfo = relative3.userinfo;
+      target.host = relative3.host;
+      target.port = relative3.port;
+      target.path = removeDotSegments(relative3.path || "");
+      target.query = relative3.query;
     } else {
-      if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative3.userinfo !== undefined || relative3.host !== undefined || relative3.port !== undefined) {
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (!relative.path) {
+        if (!relative3.path) {
           target.path = base.path;
-          if (relative.query !== undefined)
-            target.query = relative.query;
+          if (relative3.query !== undefined)
+            target.query = relative3.query;
           else
             target.query = base.query;
         } else {
-          if (relative.path[0] === "/")
-            target.path = removeDotSegments(relative.path);
+          if (relative3.path[0] === "/")
+            target.path = removeDotSegments(relative3.path);
           else {
             if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path)
-              target.path = "/" + relative.path;
+              target.path = "/" + relative3.path;
             else if (!base.path)
-              target.path = relative.path;
+              target.path = relative3.path;
             else
-              target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+              target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative3.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -190087,7 +191972,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative3.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -190243,8 +192128,8 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin((exports, module) => {
   }
   const fastUri = {
     SCHEMES,
-    normalize,
-    resolve: resolve5,
+    normalize: normalize2,
+    resolve: resolve9,
     resolveComponent,
     equal,
     serialize,
@@ -197386,14 +199271,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve9, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve5();
+      resolve9();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -198155,7 +200040,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve9, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -198231,7 +200116,7 @@ var Protocol = class {
           return reject(decoded.error);
         if (decoded.kind === "input_required") {
           if (options?.allowInputRequired === true)
-            return resolve5(manualInputRequiredValue(decoded));
+            return resolve9(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -198243,12 +200128,12 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve5(this._resolveNonCompleteResult(decoded, flow));
+          return resolve9(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
           if (parseResult.success)
-            resolve5(parseResult.data);
+            resolve9(parseResult.data);
           else
             reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
@@ -199792,7 +201677,7 @@ var StdioServerTransport = class {
   send(message) {
     if (this._closed)
       return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve9, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error51) => {
@@ -199809,7 +201694,7 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve5();
+        resolve9();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
@@ -199817,7 +201702,7 @@ var StdioServerTransport = class {
           return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve5();
+        resolve9();
       } else if (!settled)
         this._stdout.once("drain", onDrain);
     });
@@ -199825,7 +201710,7 @@ var StdioServerTransport = class {
 };
 
 // src/core/runReview.ts
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 
 // src/config/configOverrides.ts
 var NUMBER_VALUE = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i;
@@ -199888,7 +201773,7 @@ function parseConfigOverrideValue(value, currentValue) {
 function readPath2(target, path) {
   let current = target;
   for (const key of path) {
-    if (!isRecord6(current))
+    if (!isRecord8(current))
       return;
     current = current[key];
   }
@@ -199898,7 +201783,7 @@ function writePath2(target, path, value) {
   let current = target;
   for (const key of path.slice(0, -1)) {
     const child = current[key];
-    if (!isRecord6(child)) {
+    if (!isRecord8(child)) {
       throw new Error(`Cannot apply --set key ${JSON.stringify(path.join("."))}.`);
     }
     current = child;
@@ -199907,14 +201792,14 @@ function writePath2(target, path, value) {
   if (leaf)
     current[leaf] = value;
 }
-function isRecord6(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/acp/AcpAgentProcess.ts
 import { spawn } from "node:child_process";
-import { readFile as readFile7, realpath } from "node:fs/promises";
-import { isAbsolute, relative, resolve as resolve5 } from "node:path";
+import { readFile as readFile8, realpath as realpath3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve9 } from "node:path";
 import { Readable, Writable } from "node:stream";
 
 // node_modules/@agentclientprotocol/sdk/dist/schema/index.js
@@ -199986,6 +201871,48 @@ function requiredDefaultOnError(schema, fallback) {
     return exports_external.NEVER;
   });
 }
+function stringTag(value, key) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return;
+  }
+  const tag = value[key];
+  return typeof tag === "string" ? tag : undefined;
+}
+function excludeKnownTags(schema, key, knownTags) {
+  return schema.superRefine((value, context) => {
+    const tag = stringTag(value, key);
+    if (tag !== undefined && knownTags.includes(tag)) {
+      context.addIssue({
+        code: "custom",
+        path: [key],
+        message: `${key} ${JSON.stringify(tag)} is reserved by a known variant, ` + `but the value does not match that variant's schema`
+      });
+    }
+  });
+}
+function preserveCustomPayload(schema, key, knownTags) {
+  return exports_external.unknown().transform((value, context) => {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+      for (const issue2 of result.error.issues) {
+        context.addIssue({ ...issue2, input: value });
+      }
+      return exports_external.NEVER;
+    }
+    const output2 = result.data;
+    const tag = stringTag(value, key);
+    if (tag !== undefined && !knownTags.includes(tag)) {
+      const raw = value;
+      for (const [property, rawValue] of Object.entries(raw)) {
+        if (property === "__proto__")
+          continue;
+        if (!Object.hasOwn(output2, property))
+          output2[property] = rawValue;
+      }
+    }
+    return output2;
+  });
+}
 function vecSkipError(itemSchema) {
   return exports_external.array(itemSchema.catch(skippedItem)).transform((items) => items.filter((item) => item !== skippedItem));
 }
@@ -200409,15 +202336,15 @@ var zTitledMultiSelectItems = object({
     return;
   })
 });
-var zMultiSelectItems = union([
+var zMultiSelectItems = preserveCustomPayload(union([
   zStringMultiSelectItems.and(object({
     type: literal("string")
   })),
-  object({
+  excludeKnownTags(object({
     type: string2()
-  }),
+  }), "type", ["string"]),
   zTitledMultiSelectItems
-]);
+]), "type", ["string"]);
 var zMultiSelectPropertySchema = object({
   title: defaultOnError(string2().nullish(), () => {
     return;
@@ -200435,7 +202362,7 @@ var zMultiSelectPropertySchema = object({
     return;
   })
 });
-var zElicitationPropertySchema = union([
+var zElicitationPropertySchema = preserveCustomPayload(union([
   zStringPropertySchema.and(object({
     type: literal("string")
   })),
@@ -200451,10 +202378,10 @@ var zElicitationPropertySchema = union([
   zMultiSelectPropertySchema.and(object({
     type: literal("array")
   })),
-  object({
+  excludeKnownTags(object({
     type: string2()
-  })
-]);
+  }), "type", ["array", "boolean", "integer", "number", "string"])
+]), "type", ["array", "boolean", "integer", "number", "string"]);
 var zElicitationSchema = object({
   type: defaultOnError(zElicitationSchemaType.optional().default("object"), () => "object"),
   title: defaultOnError(string2().nullish(), () => {
@@ -200477,22 +202404,22 @@ var zElicitationUrlMode = intersection(union([zElicitationSessionScope, zElicita
   elicitationId: zElicitationId,
   url: url()
 }));
-var zCreateElicitationRequest = intersection(union([
+var zCreateElicitationRequest = preserveCustomPayload(intersection(union([
   zElicitationFormMode.and(object({
     mode: literal("form")
   })),
   zElicitationUrlMode.and(object({
     mode: literal("url")
   })),
-  intersection(union([zElicitationSessionScope, zElicitationRequestScope]), object({
+  excludeKnownTags(intersection(union([zElicitationSessionScope, zElicitationRequestScope]), object({
     mode: string2()
-  }))
+  })), "mode", ["form", "url"])
 ]), object({
   message: string2(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
-}));
+})), "mode", ["form", "url"]);
 var zMcpServerAcpId = string2();
 var zConnectMcpRequest = object({
   serverId: zMcpServerAcpId,
@@ -202092,7 +204019,7 @@ var zElicitationContentValue = union([
 var zElicitationAcceptAction = object({
   content: record(string2(), zElicitationContentValue).nullish()
 });
-var zCreateElicitationResponse = intersection(union([
+var zCreateElicitationResponse = preserveCustomPayload(intersection(union([
   zElicitationAcceptAction.and(object({
     action: literal("accept")
   })),
@@ -202102,14 +204029,14 @@ var zCreateElicitationResponse = intersection(union([
   object({
     action: literal("cancel")
   }),
-  object({
+  excludeKnownTags(object({
     action: string2()
-  })
+  }), "action", ["accept", "cancel", "decline"])
 ]), object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
-}));
+})), "action", ["accept", "cancel", "decline"]);
 var zConnectMcpResponse = object({
   connectionId: zMcpConnectionId,
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
@@ -202245,16 +204172,34 @@ var zCancelRequestNotification = object({
     return;
   })
 });
+
+// node_modules/@agentclientprotocol/sdk/dist/schema/guards.gen.js
+var zGuardCreateElicitationRequestForm = zElicitationFormMode.and(object({ mode: literal("form") })).and(object({ message: string2() }));
+var zGuardCreateElicitationRequestUrl = zElicitationUrlMode.and(object({ mode: literal("url") })).and(object({ message: string2() }));
+var zGuardCreateElicitationRequestCustom = union([zElicitationSessionScope, zElicitationRequestScope]).and(object({ message: string2() }));
+var zGuardElicitationPropertySchemaString = zStringPropertySchema.and(object({ type: literal("string") }));
+var zGuardElicitationPropertySchemaNumber = zNumberPropertySchema.and(object({ type: literal("number") }));
+var zGuardElicitationPropertySchemaInteger = zIntegerPropertySchema.and(object({ type: literal("integer") }));
+var zGuardElicitationPropertySchemaBoolean = zBooleanPropertySchema.and(object({ type: literal("boolean") }));
+var zGuardElicitationPropertySchemaArray = zMultiSelectPropertySchema.and(object({ type: literal("array") }));
+var zGuardMultiSelectItemsString = zStringMultiSelectItems.and(object({ type: literal("string") }));
+var zGuardCreateElicitationResponseAccept = zElicitationAcceptAction.and(object({ action: literal("accept") }));
+var zGuardCreateElicitationResponseDecline = object({
+  action: literal("decline")
+});
+var zGuardCreateElicitationResponseCancel = object({
+  action: literal("cancel")
+});
 // node_modules/@agentclientprotocol/sdk/dist/jsonrpc.js
 var CANCEL_REQUEST_METHOD = "$/cancel_request";
-function isRecord7(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null;
 }
 function isJsonRpcId(value) {
   return value === null || typeof value === "string" || typeof value === "number" && Number.isFinite(value);
 }
 function cancelRequestId(params) {
-  if (!isRecord7(params) || !isJsonRpcId(params["requestId"])) {
+  if (!isRecord9(params) || !isJsonRpcId(params["requestId"])) {
     return;
   }
   return params["requestId"];
@@ -202478,12 +204423,12 @@ class Connection {
     }
     const id = this.nextRequestId++;
     let cancel = () => {};
-    const responsePromise = new Promise((resolve5, reject) => {
+    const responsePromise = new Promise((resolve9, reject) => {
       const pendingResponse = {
         resolve: (response) => {
           try {
             const value = mapResponse ? mapResponse(response) : response;
-            resolve5(value);
+            resolve9(value);
           } catch (error51) {
             reject(error51);
           }
@@ -202548,8 +204493,8 @@ class Connection {
   initialize(stream, handlers) {
     this.stream = stream;
     this.staticHandlers = handlers;
-    this.closedPromise = new Promise((resolve5) => {
-      this.abortController.signal.addEventListener("abort", () => resolve5());
+    this.closedPromise = new Promise((resolve9) => {
+      this.abortController.signal.addEventListener("abort", () => resolve9());
     });
     this.receive();
   }
@@ -202601,7 +204546,7 @@ class Connection {
     if (this.abortController.signal.aborted) {
       return;
     }
-    if (!isRecord7(message)) {
+    if (!isRecord9(message)) {
       console.error("Invalid message", { message });
       return;
     }
@@ -202694,7 +204639,7 @@ class Connection {
       pendingResponse.cleanup?.();
       if ("result" in response) {
         pendingResponse.resolve(response.result);
-      } else if ("error" in response && isRecord7(response.error)) {
+      } else if ("error" in response && isRecord9(response.error)) {
         const { code, message, data } = response.error;
         pendingResponse.reject(new RequestError(code, message, data));
       } else {
@@ -202904,7 +204849,7 @@ function ndJsonStream(output2, input2) {
         if (trimmedLine) {
           try {
             const message = JSON.parse(trimmedLine);
-            if (isRecord7(message)) {
+            if (isRecord9(message)) {
               controller.enqueue(message);
             } else {
               console.warn("Skipping JSON line that is not an object:", trimmedLine);
@@ -203262,8 +205207,8 @@ class AsyncQueue {
     if (this.failed) {
       return Promise.reject(this.failure);
     }
-    return new Promise((resolve5, reject) => {
-      this.waiters.push({ resolve: resolve5, reject });
+    return new Promise((resolve9, reject) => {
+      this.waiters.push({ resolve: resolve9, reject });
     });
   }
 }
@@ -203965,7 +205910,7 @@ function isSeverity(value) {
   return typeof value === "string" && severities.includes(value);
 }
 function normalizeCisaSecureByDesign(value) {
-  if (!isRecord8(value))
+  if (!isRecord10(value))
     return;
   const normalized = {};
   const customerSecurityOutcomes = normalizeGateStatus(value.customerSecurityOutcomes);
@@ -204006,7 +205951,7 @@ function normalizeFindingFiles(value) {
   if (!Array.isArray(value))
     return;
   const files = value.flatMap((item) => {
-    if (!isRecord8(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
+    if (!isRecord10(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
       return [];
     }
     const file2 = {
@@ -204025,7 +205970,7 @@ function normalizeFindingFiles(value) {
 function normalizeLineNumber(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 }
-function isRecord8(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -204228,14 +206173,14 @@ function resolveEffortConfigOption(agent, effort) {
   return;
 }
 async function readWorkspaceFile(workspaceDir, requestedPath, line, limit) {
-  const workspaceRoot = await realpath(workspaceDir);
+  const workspaceRoot = await realpath3(workspaceDir);
   const candidates = resolveReadablePaths(workspaceRoot, requestedPath);
   let content;
   for (const absolute of candidates) {
     const readablePath = await resolveReadableFile(workspaceRoot, absolute);
     if (!readablePath)
       continue;
-    content = await readFile7(readablePath, "utf8").catch(() => {
+    content = await readFile8(readablePath, "utf8").catch(() => {
       return;
     });
     if (content !== undefined)
@@ -204251,8 +206196,8 @@ async function readWorkspaceFile(workspaceDir, requestedPath, line, limit) {
 `);
 }
 async function resolveReadableFile(workspaceRoot, absolute) {
-  const realPath = await realpath(absolute).catch((error51) => {
-    if (isMissingPathError4(error51))
+  const realPath = await realpath3(absolute).catch((error51) => {
+    if (isMissingPathError6(error51))
       return;
     throw error51;
   });
@@ -204262,18 +206207,18 @@ async function resolveReadableFile(workspaceRoot, absolute) {
   return realPath;
 }
 function resolveReadablePaths(workspaceRoot, requestedPath) {
-  const primary = resolve5(workspaceRoot, requestedPath);
+  const primary = resolve9(workspaceRoot, requestedPath);
   assertWithinWorkspace(workspaceRoot, primary);
-  const relativePath = relative(workspaceRoot, primary).replaceAll("\\", "/");
+  const relativePath = relative3(workspaceRoot, primary).replaceAll("\\", "/");
   if (relativePath.startsWith("context/") || relativePath.startsWith("repo/")) {
     return [primary];
   }
-  const repoPath = resolve5(workspaceRoot, "repo", relativePath);
+  const repoPath = resolve9(workspaceRoot, "repo", relativePath);
   assertWithinWorkspace(workspaceRoot, repoPath);
-  return isAbsolute(requestedPath) ? [primary, repoPath] : [repoPath, primary];
+  return isAbsolute4(requestedPath) ? [primary, repoPath] : [repoPath, primary];
 }
 function assertWithinWorkspace(workspaceRoot, absolute) {
-  const relativePath = relative(workspaceRoot, absolute);
+  const relativePath = relative3(workspaceRoot, absolute);
   if (relativePath.startsWith("..") || relativePath === "" || relativePath.startsWith("/")) {
     throw RequestError.invalidRequest({
       policy: "Kyoso only allows reads from the temporary snapshot."
@@ -204290,7 +206235,7 @@ function terminateChild(child) {
   }, 2000);
   killTimer.unref();
 }
-function isMissingPathError4(error51) {
+function isMissingPathError6(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT";
 }
 function buildAgentFailure(rawDetail, fallbackMessage) {
@@ -204986,68 +206931,78 @@ function normalizeTitle(value) {
   return value.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
 }
 
-// src/audit/trace.ts
-import { mkdir as mkdir4, appendFile } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join5 } from "node:path";
-
-// src/context/pathPolicy.ts
-import { normalize, sep } from "node:path";
-
-// src/core/errors.ts
-class KyosoRequestError extends Error {
-  code;
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "KyosoRequestError";
+// src/audit/safeTraceFile.ts
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat3, open, realpath as realpath4, stat } from "node:fs/promises";
+import { join as join8 } from "node:path";
+var AUDIT_WARNING_UNSUPPORTED_OPEN_CAPABILITY = "AUDIT_DISABLED_UNSUPPORTED_CAPABILITY: Audit trace writing requires unavailable filesystem capabilities.";
+async function openVerifiedTraceFile(options) {
+  const flags = secureOpenFlags(options.openConstants);
+  if (flags === undefined)
+    throw new Error("secure open capability unavailable");
+  if (!isSafeTraceId(options.traceId))
+    throw new Error("unsafe trace id");
+  const traceDirectory = await ensureTrustedDirectory({
+    root: options.kyosoRoot,
+    segments: [
+      "workspaces",
+      options.workspaceHash,
+      ...options.logicalDirectory.split("/"),
+      options.date
+    ],
+    uid: options.uid,
+    workspaceRoot: options.workspaceRoot
+  });
+  const tracePath = join8(traceDirectory, `${options.traceId}.jsonl`);
+  if (await optionalLstat3(tracePath)) {
+    throw new Error("trace path already exists");
   }
-}
-
-// src/context/pathPolicy.ts
-function normalizeRelativePath(path) {
-  const normalized = normalize(path).replaceAll("\\", "/");
-  if (normalized === "." || normalized.startsWith("..") || normalized.includes(`${sep}..${sep}`) || normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
-    throw new KyosoRequestError(`Path escapes workspace root: ${path}`, "INVALID_PATH");
+  await options.beforeOpen?.(tracePath);
+  const handle = await open(tracePath, flags, 384);
+  try {
+    const [handleStat, pathStat, realTracePath] = await Promise.all([
+      handle.stat({ bigint: true }),
+      stat(tracePath, { bigint: true }),
+      realpath4(tracePath)
+    ]);
+    if (!handleStat.isFile() || !pathStat.isFile() || handleStat.dev !== pathStat.dev || handleStat.ino !== pathStat.ino || !isPathWithin(realTracePath, options.kyosoRoot)) {
+      throw new Error("trace file identity could not be verified");
+    }
+    return { handle, tracePath };
+  } catch (error51) {
+    try {
+      await handle.close();
+    } catch {}
+    throw error51;
   }
-  return normalized;
 }
-function isDeniedPath(path, denyPatterns) {
-  return matchesPathPattern(path, denyPatterns, "deny");
+function secureOpenFlags(provided) {
+  const openConstants = provided ?? constants2;
+  const required2 = [
+    openConstants.O_CREAT,
+    openConstants.O_EXCL,
+    openConstants.O_APPEND,
+    openConstants.O_WRONLY,
+    openConstants.O_NOFOLLOW,
+    openConstants.O_NONBLOCK
+  ];
+  if (required2.some((flag) => typeof flag !== "number" || flag <= 0)) {
+    return;
+  }
+  return required2.reduce((combined, flag) => combined | flag, 0);
 }
-function isAllowedPath(path, allowPatterns) {
-  if (allowPatterns.length === 0)
-    return true;
-  return matchesPathPattern(path, allowPatterns, "allow");
+function isSafeTraceId(traceId) {
+  return traceId.length > 0 && traceId !== "." && traceId !== ".." && !traceId.includes("/") && !traceId.includes("\\");
 }
-function matchesPathPattern(path, patterns, mode) {
-  const normalized = normalizeRelativePath(path);
-  const segments = normalized.split("/");
-  return patterns.some((pattern) => {
-    const normalizedPattern = normalizeRelativePath(pattern);
-    if (normalizedPattern.endsWith(".*") && !normalizedPattern.includes("/")) {
-      const base = normalizedPattern.slice(0, -2);
-      if (mode === "allow") {
-        const firstSegment = segments[0] ?? "";
-        return firstSegment === base || firstSegment.startsWith(`${base}.`);
-      }
-      return segments.some((segment) => segment === base || segment.startsWith(`${base}.`));
-    }
-    if (normalizedPattern.includes("*")) {
-      const escaped = normalizedPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
-      const regex = mode === "allow" ? new RegExp(`^${escaped}($|/)`) : new RegExp(`(^|/)${escaped}($|/)`);
-      return regex.test(normalized);
-    }
-    if (!normalizedPattern.includes("/")) {
-      if (mode === "allow") {
-        return normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`);
-      }
-      return segments.includes(normalizedPattern);
-    }
-    if (mode === "allow") {
-      return normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`);
+async function optionalLstat3(path) {
+  try {
+    return await lstat3(path);
+  } catch (error51) {
+    if (typeof error51 === "object" && error51 !== null && "code" in error51 && error51.code === "ENOENT") {
+      return;
     }
-    return normalized === normalizedPattern || normalized.startsWith(`${normalizedPattern}/`) || normalized.endsWith(`/${normalizedPattern}`) || normalized.includes(`/${normalizedPattern}/`);
-  });
+    throw error51;
+  }
 }
 
 // src/audit/sanitize.ts
@@ -205070,46 +207025,149 @@ function sanitizeForAudit(value, options = {}) {
 }
 
 // src/audit/trace.ts
+var AUDIT_WARNING_WRITE_FAILED = "AUDIT_WRITE_FAILED: Audit trace writing failed; no further audit events will be written.";
+var AUDIT_WARNING_FINALIZE_FAILED = "AUDIT_FINALIZE_FAILED: Audit trace close failed.";
+var AUDIT_WARNING_WRITE_AFTER_FINALIZE = "AUDIT_WRITE_AFTER_FINALIZE: Audit trace is already finalized.";
 function createTraceWriter(options) {
   const warnings = [];
-  if (!options.enabled) {
-    return {
-      warnings,
-      async write() {
-        return;
-      }
-    };
-  }
+  const warningSet = new Set;
   const date5 = new Date().toISOString().slice(0, 10);
-  const directory = validateAuditDirectory(options.directory, warnings);
-  const tracePath = join5(options.cwd, directory, date5, `${options.traceId}.jsonl`);
+  let tracePath;
+  let handle;
+  let disabled = !options.enabled;
+  let finalizing = false;
+  let finalized = false;
+  let queue = Promise.resolve();
+  let finalizePromise;
+  const addWarning = (warning) => {
+    if (warningSet.has(warning))
+      return;
+    warningSet.add(warning);
+    warnings.push(warning);
+  };
+  const closeHandle = async () => {
+    const current = handle;
+    handle = undefined;
+    if (!current)
+      return;
+    try {
+      await (options.closeHandle ?? defaultCloseHandle)(current);
+    } catch {
+      addWarning(AUDIT_WARNING_FINALIZE_FAILED);
+    }
+  };
+  const disableAfterWriteFailure = async () => {
+    disabled = true;
+    addWarning(AUDIT_WARNING_WRITE_FAILED);
+    await closeHandle();
+  };
+  const openIfNeeded = async () => {
+    if (handle || disabled)
+      return;
+    if (secureOpenFlags(options.openConstants) === undefined) {
+      disabled = true;
+      addWarning(AUDIT_WARNING_UNSUPPORTED_OPEN_CAPABILITY);
+      return;
+    }
+    const stateRoot = await resolveAuditStateRoot({
+      cwd: options.cwd,
+      directory: options.directory,
+      env: options.env,
+      platform: options.platform,
+      getuid: options.getuid
+    });
+    for (const warning of stateRoot.warnings)
+      addWarning(warning);
+    if (!isResolvedAuditStateRoot(stateRoot)) {
+      disabled = true;
+      return;
+    }
+    try {
+      const opened = await openVerifiedTraceFile({
+        kyosoRoot: stateRoot.kyosoRoot,
+        workspaceHash: stateRoot.workspaceHash,
+        logicalDirectory: stateRoot.logicalDirectory,
+        date: date5,
+        traceId: options.traceId,
+        uid: stateRoot.uid,
+        workspaceRoot: stateRoot.workspaceRoot,
+        openConstants: options.openConstants,
+        beforeOpen: options.beforeOpen
+      });
+      handle = opened.handle;
+      tracePath = opened.tracePath;
+    } catch {
+      disabled = true;
+      addWarning(AUDIT_WARNING_WRITE_FAILED);
+    }
+  };
+  const writeOne = async (event) => {
+    if (disabled)
+      return;
+    try {
+      await openIfNeeded();
+      if (disabled || !handle)
+        return;
+      const line = Buffer.from(`${JSON.stringify(sanitizeForAudit(event, {
+        includeRawAgentOutput: options.includeRawAgentOutput
+      }))}
+`, "utf8");
+      await writeFully(handle, line, options.writeChunk);
+    } catch {
+      await disableAfterWriteFailure();
+    }
+  };
   return {
-    tracePath,
+    get tracePath() {
+      return tracePath;
+    },
     warnings,
-    async write(event) {
-      try {
-        await mkdir4(dirname5(tracePath), { recursive: true });
-        await appendFile(tracePath, `${JSON.stringify(sanitizeForAudit(event, {
-          includeRawAgentOutput: options.includeRawAgentOutput
-        }))}
-`, "utf8");
-      } catch (error51) {
-        warnings.push(`Audit write failed: ${error51 instanceof Error ? error51.message : String(error51)}`);
-      }
+    write(event) {
+      if (finalizing || finalized) {
+        addWarning(AUDIT_WARNING_WRITE_AFTER_FINALIZE);
+        return Promise.resolve();
+      }
+      const task = queue.then(() => writeOne(event));
+      queue = task.catch(async () => {
+        await disableAfterWriteFailure();
+      });
+      return task.catch(() => {
+        return;
+      });
+    },
+    finalize() {
+      if (finalizePromise)
+        return finalizePromise;
+      finalizing = true;
+      finalizePromise = queue.then(async () => {
+        await closeHandle();
+        finalized = true;
+      }).catch(() => {
+        disabled = true;
+        addWarning(AUDIT_WARNING_FINALIZE_FAILED);
+        finalized = true;
+      });
+      return finalizePromise;
     }
   };
 }
-function validateAuditDirectory(directory, warnings) {
-  try {
-    if (isAbsolute2(directory) || directory.split(/[\\/]+/).includes("..")) {
-      throw new Error("unsafe path");
+async function writeFully(handle, buffer, writeChunk) {
+  let offset = 0;
+  while (offset < buffer.byteLength) {
+    const bytesWritten = await (writeChunk ?? defaultWriteChunk)(handle, buffer, offset);
+    if (!Number.isInteger(bytesWritten) || bytesWritten <= 0) {
+      throw new Error("partial audit write could not advance");
     }
-    return normalizeRelativePath(directory);
-  } catch {
-    warnings.push(`Unsafe audit directory ignored: ${directory}`);
-    return ".kyoso/traces";
+    offset += bytesWritten;
   }
 }
+async function defaultWriteChunk(handle, buffer, offset) {
+  const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset, null);
+  return bytesWritten;
+}
+async function defaultCloseHandle(handle) {
+  await handle.close();
+}
 
 // src/context/truncate.ts
 function truncateUtf8(input2, maxBytes) {
@@ -205526,40 +207584,40 @@ function decide(input2) {
 }
 
 // src/workspace/createSnapshot.ts
-import { chmod, mkdir as mkdir5, mkdtemp, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname6, join as join6 } from "node:path";
-import { tmpdir } from "node:os";
+import { chmod, mkdir as mkdir6, mkdtemp as mkdtemp2, writeFile as writeFile6 } from "node:fs/promises";
+import { dirname as dirname8, join as join9 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
 async function createSnapshot(traceId, tool, request, options = {}) {
-  const root = await mkdtemp(join6(tmpdir(), `kyoso-${traceId}-`));
-  const repoDir = join6(root, "repo");
-  const contextDir = join6(root, "context");
-  await mkdir5(repoDir, { recursive: true });
-  await mkdir5(contextDir, { recursive: true });
+  const root = await mkdtemp2(join9(tmpdir2(), `kyoso-${traceId}-`));
+  const repoDir = join9(root, "repo");
+  const contextDir = join9(root, "context");
+  await mkdir6(repoDir, { recursive: true });
+  await mkdir6(contextDir, { recursive: true });
   let fileCount = 0;
   for (const file2 of request.selectedFiles ?? []) {
-    const relative2 = normalizeRelativePath(file2.path);
-    if (isDeniedPath(relative2, options.denyPatterns ?? []))
+    const relative4 = normalizeRelativePath(file2.path);
+    if (isDeniedPath(relative4, options.denyPatterns ?? []))
       continue;
-    if (!isAllowedPath(relative2, options.allowPatterns ?? []))
+    if (!isAllowedPath(relative4, options.allowPatterns ?? []))
       continue;
-    const dest = join6(repoDir, relative2);
-    await mkdir5(dirname6(dest), { recursive: true });
-    await writeFile5(dest, file2.content, "utf8");
+    const dest = join9(repoDir, relative4);
+    await mkdir6(dirname8(dest), { recursive: true });
+    await writeFile6(dest, file2.content, "utf8");
     await chmod(dest, 292).catch(() => {
       return;
     });
     fileCount += 1;
   }
-  await writeFile5(join6(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
-  await writeFile5(join6(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
-  await writeFile5(join6(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
-  await writeFile5(join6(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
+  await writeFile6(join9(contextDir, "request.json"), JSON.stringify(stripContents(request), null, 2), "utf8");
+  await writeFile6(join9(contextDir, "selected_files_manifest.json"), JSON.stringify(buildSelectedFilesManifest(request), null, 2), "utf8");
+  await writeFile6(join9(contextDir, "instructions.codex.md"), buildAgentPrompt(tool, request, "codex", options.agentRoles?.codex ?? "implementation_reviewer"), "utf8");
+  await writeFile6(join9(contextDir, "instructions.claude.md"), buildAgentPrompt(tool, request, "claude", options.agentRoles?.claude ?? "architecture_security_reviewer"), "utf8");
   if (request.repoSummary)
-    await writeFile5(join6(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
+    await writeFile6(join9(contextDir, "repo_summary.md"), request.repoSummary, "utf8");
   if (request.currentPlan)
-    await writeFile5(join6(contextDir, "current_plan.md"), request.currentPlan, "utf8");
+    await writeFile6(join9(contextDir, "current_plan.md"), request.currentPlan, "utf8");
   if (request.diff?.unifiedDiff)
-    await writeFile5(join6(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
+    await writeFile6(join9(contextDir, "diff.patch"), request.diff.unifiedDiff, "utf8");
   return { root, repoDir, contextDir, fileCount };
 }
 function stripContents(request) {
@@ -205581,17 +207639,17 @@ function buildSelectedFilesManifest(request) {
 }
 
 // src/workspace/cleanup.ts
-import { rm } from "node:fs/promises";
+import { rm as rm2 } from "node:fs/promises";
 async function cleanupSnapshot(path) {
   if (process.env.KYOSO_KEEP_TEMP === "1")
     return;
-  await rm(path, { recursive: true, force: true });
+  await rm2(path, { recursive: true, force: true });
 }
 
 // src/utils/ids.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function newTraceId() {
-  return `tr_${randomUUID()}`;
+  return `tr_${randomUUID2()}`;
 }
 
 // src/core/verification.ts
@@ -205649,7 +207707,7 @@ function parseVerificationVerdicts(rawText) {
     if (!Array.isArray(parsed.verdicts))
       return;
     return parsed.verdicts.flatMap((item) => {
-      if (!isRecord9(item))
+      if (!isRecord11(item))
         return [];
       if (typeof item.findingId !== "string")
         return [];
@@ -205727,7 +207785,7 @@ function verificationNote(reasoning) {
 function isVerdict(value) {
   return value === "confirmed" || value === "refuted" || value === "uncertain";
 }
-function isRecord9(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -205736,43 +207794,50 @@ async function runReview(tool, request, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const traceId = newTraceId();
   const startedAt = new Date().toISOString();
+  const auditEnv = { ...process.env, ...options.env };
+  const traceWriterFactory = options.traceWriterFactory ?? createTraceWriter;
   let snapshot;
   try {
     assertNotChildAgent(options.env ?? process.env);
   } catch (error51) {
     if (error51 instanceof KyosoRequestError) {
       const config2 = kyosoConfigSchema.parse(defaultConfig);
-      const trace2 = createTraceWriter({
+      const trace2 = traceWriterFactory({
         enabled: config2.audit.enabled,
         directory: config2.audit.directory,
         traceId,
-        cwd
-      });
-      await trace2.write({
-        type: "request_received",
-        traceId,
-        tool,
-        timestamp: new Date().toISOString()
-      });
-      return await buildPolicyBlockResult({
-        tool,
-        trace: trace2,
-        traceId,
-        startedAt,
-        networkMode: config2.network.defaultMode,
-        warning: error51.message,
-        finding: {
-          id: "KYOSO-1",
-          severity: "critical",
-          category: "other",
-          title: "Recursive Kyoso invocation blocked",
-          evidence: error51.message,
-          recommendation: "Do not expose Kyoso MCP tools to Kyoso child agents.",
-          sourceAgents: ["kyoso_policy"],
-          confidence: "high"
-        },
-        redactionsApplied: 0
+        cwd,
+        env: auditEnv
       });
+      try {
+        await trace2.write({
+          type: "request_received",
+          traceId,
+          tool,
+          timestamp: new Date().toISOString()
+        });
+        return await buildPolicyBlockResult({
+          tool,
+          trace: trace2,
+          traceId,
+          startedAt,
+          networkMode: config2.network.defaultMode,
+          warning: error51.message,
+          finding: {
+            id: "KYOSO-1",
+            severity: "critical",
+            category: "other",
+            title: "Recursive Kyoso invocation blocked",
+            evidence: error51.message,
+            recommendation: "Do not expose Kyoso MCP tools to Kyoso child agents.",
+            sourceAgents: ["kyoso_policy"],
+            confidence: "high"
+          },
+          redactionsApplied: 0
+        });
+      } finally {
+        await trace2.finalize();
+      }
     }
     throw error51;
   }
@@ -205797,12 +207862,13 @@ async function runReview(tool, request, options = {}) {
     ...baseLoaded,
     config: applyConfigOverrides(baseLoaded.config, options.configOverrides)
   } : baseLoaded;
-  const trace = createTraceWriter({
+  const trace = traceWriterFactory({
     enabled: loaded.config.audit.enabled,
     directory: loaded.config.audit.directory,
     traceId,
     cwd,
-    includeRawAgentOutput: loaded.config.audit.includeRawAgentOutput
+    includeRawAgentOutput: loaded.config.audit.includeRawAgentOutput,
+    env: auditEnv
   });
   const warnings = [...loaded.warnings, ...trace.warnings];
   try {
@@ -205884,11 +207950,11 @@ async function runReview(tool, request, options = {}) {
       manager,
       trace
     });
-    warnings.push(...agentResults.flatMap((result2) => (result2.warnings ?? []).map((warning) => `Agent ${result2.agent} ${warning}`)));
+    warnings.push(...agentResults.flatMap((result) => (result.warnings ?? []).map((warning) => `Agent ${result.agent} ${warning}`)));
     const normalizedAgentResults = agentResults.map(normalizeAgentRunResult);
-    const agentsUsed = normalizedAgentResults.map((result2) => result2.agent);
+    const agentsUsed = normalizedAgentResults.map((result) => result.agent);
     const reviewMode = agentsUsed.length === 1 ? "single_agent" : "multi_agent";
-    const completed = normalizedAgentResults.filter((result2) => result2.status === "completed");
+    const completed = normalizedAgentResults.filter((result) => result.status === "completed");
     const degraded = completed.length !== agentResults.length;
     let aggregate = aggregateAgentResults(normalizedAgentResults, {
       reviewMode
@@ -205915,7 +207981,7 @@ async function runReview(tool, request, options = {}) {
             severity: "critical",
             category: "other",
             title: "All backend agents failed",
-            evidence: normalizedAgentResults.map((result2) => `${result2.agent}: ${result2.error?.code ?? result2.status}`).join("; "),
+            evidence: normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
             recommendation: "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
             sourceAgents: ["kyoso_policy"],
             confidence: "high"
@@ -205965,7 +208031,7 @@ async function runReview(tool, request, options = {}) {
       residualRisks: tool === "security_review" && aggregate.residualRisks.length === 0 ? [
         "No residual risks were reported by completed agents; verify security assumptions before release."
       ] : aggregate.residualRisks,
-      agentOpinions: normalizedAgentResults.map((result2) => agentOpinionSummary(result2, request.options?.includeAgentRawOutputs === true)),
+      agentOpinions: normalizedAgentResults.map((result) => agentOpinionSummary(result, request.options?.includeAgentRawOutputs === true)),
       audit: {
         traceId,
         startedAt,
@@ -205997,15 +208063,10 @@ async function runReview(tool, request, options = {}) {
       judgeComment: judgeComments.get(disagreement.topic) ?? disagreement.judgeComment
     }));
     const crossModelAnalysis = buildCrossModelAnalysis(judge, reviewMode);
-    const result = {
+    const resultAfterJudge = {
       ...resultWithoutMarkdown,
       disagreements,
-      ...crossModelAnalysis ? { crossModelAnalysis } : {},
-      summaryMarkdown: renderMarkdownResult(tool, {
-        ...resultWithoutMarkdown,
-        disagreements,
-        ...crossModelAnalysis ? { crossModelAnalysis } : {}
-      }, { summaryText: judge.output.summaryText })
+      ...crossModelAnalysis ? { crossModelAnalysis } : {}
     };
     const judgeEvent = {
       type: "judge_completed",
@@ -206017,7 +208078,7 @@ async function runReview(tool, request, options = {}) {
     if (judge.error)
       judgeEvent.error = judge.error;
     await trace.write(judgeEvent);
-    result.audit.completedAt = new Date().toISOString();
+    resultAfterJudge.audit.completedAt = new Date().toISOString();
     await trace.write({
       type: "decision_completed",
       traceId,
@@ -206029,8 +208090,14 @@ async function runReview(tool, request, options = {}) {
       traceId,
       timestamp: new Date().toISOString()
     });
-    return result;
+    return await finalizeReviewResult({
+      tool,
+      trace,
+      result: resultAfterJudge,
+      summaryText: judge.output.summaryText
+    });
   } finally {
+    await trace.finalize();
     if (snapshot)
       await cleanupSnapshot(snapshot.root);
   }
@@ -206279,10 +208346,6 @@ async function buildSecretBlockResult(input2) {
       warnings: input2.warnings
     }
   };
-  const result = {
-    ...resultWithoutMarkdown,
-    summaryMarkdown: renderMarkdownResult(input2.tool, resultWithoutMarkdown)
-  };
   await input2.trace.write({
     type: "decision_completed",
     traceId: input2.traceId,
@@ -206294,7 +208357,11 @@ async function buildSecretBlockResult(input2) {
     traceId: input2.traceId,
     timestamp: new Date().toISOString()
   });
-  return result;
+  return await finalizeReviewResult({
+    tool: input2.tool,
+    trace: input2.trace,
+    result: resultWithoutMarkdown
+  });
 }
 function buildSecretFinding(secretScan, options) {
   return {
@@ -206344,10 +208411,6 @@ async function buildPolicyBlockResult(input2) {
       warnings: [input2.warning]
     }
   };
-  const result = {
-    ...resultWithoutMarkdown,
-    summaryMarkdown: renderMarkdownResult(input2.tool, resultWithoutMarkdown)
-  };
   await input2.trace.write({
     type: "decision_completed",
     traceId: input2.traceId,
@@ -206359,7 +208422,30 @@ async function buildPolicyBlockResult(input2) {
     traceId: input2.traceId,
     timestamp: new Date().toISOString()
   });
-  return result;
+  return await finalizeReviewResult({
+    tool: input2.tool,
+    trace: input2.trace,
+    result: resultWithoutMarkdown
+  });
+}
+async function finalizeReviewResult(input2) {
+  await input2.trace.finalize();
+  const result = {
+    ...input2.result,
+    audit: {
+      ...input2.result.audit,
+      warnings: Array.from(new Set([
+        ...input2.result.audit.warnings ?? [],
+        ...input2.trace.warnings
+      ]))
+    }
+  };
+  return {
+    ...result,
+    summaryMarkdown: renderMarkdownResult(input2.tool, result, {
+      summaryText: input2.summaryText
+    })
+  };
 }
 function mergeDenyPatterns(configDeny, requestDeny) {
   return Array.from(new Set([...configDeny, ...requestDeny ?? []]));
@@ -206367,7 +208453,7 @@ function mergeDenyPatterns(configDeny, requestDeny) {
 function assertTrustedWorkspaceRoot(requestRoot, configRoot, cwd) {
   if (!requestRoot)
     return;
-  if (resolve6(cwd, requestRoot) !== resolve6(cwd, configRoot)) {
+  if (resolve10(cwd, requestRoot) !== resolve10(cwd, configRoot)) {
     throw new KyosoRequestError("workspace.root is not trusted by config", "UNTRUSTED_WORKSPACE_ROOT");
   }
 }
@@ -206485,7 +208571,9 @@ async function main() {
       write: booleanFlag(parsed.flags, "write"),
       global: booleanFlag(parsed.flags, "global"),
       runner: stringFlag(parsed.flags, "runner"),
-      command: stringFlag(parsed.flags, "command")
+      command: stringFlag(parsed.flags, "command"),
+      skillOnly: booleanFlag(parsed.flags, "skill-only"),
+      force: booleanFlag(parsed.flags, "force")
     }));
     return;
   }
@@ -206542,7 +208630,7 @@ async function buildDiff(tool, flags) {
     return;
   const base = stringFlag(flags, "base") ?? "main";
   const head = stringFlag(flags, "head") ?? "HEAD";
-  const result = spawnSync2("git", ["diff", base, head], { encoding: "utf8" });
+  const result = spawnSync3("git", ["diff", base, head], { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(result.stderr || `git diff failed for ${base}..${head}`);
   }
@@ -206588,7 +208676,8 @@ var HELP = `Kyoso
 
 Usage:
   kyoso mcp [--config kyoso.toml|kyoso.config.ts] [--ignore-config] [--trust-config] [--allow-unknown-config] [--network model_only|unrestricted]
-  kyoso setup [codex|claude-code] [--write] [--runner npx|bunx] [--command <command>] [--global]
+  kyoso setup [codex|claude-code] [--write] [--runner npx|bunx] [--command <command>] [--global] [--force]
+  kyoso setup codex|claude-code --skill-only [--write] [--global] [--force]
   kyoso plan --goal <text> [--plan <path-or-text>] [--file <path>] [--set <key>=<value>]... [--json] [--trust-config] [--allow-unknown-config]
   kyoso security --goal <text> [--diff <path>] [--file <path>] [--set <key>=<value>]... [--json] [--allow-secret-redaction] [--trust-config] [--allow-unknown-config]
   kyoso diff --base main --head HEAD [--set <key>=<value>]... [--json] [--trust-config] [--allow-unknown-config]