@massa-ai/tools-api 1.39.0 → 1.41.0

package/dist/index.js

@@ -728,9 +728,296 @@ var init_env = __esm(() => {
   } catch {}
 });
 
+// ../../packages/shared/dist/config/config-writer.js
+import fs2 from "fs";
+function maskSensitive(config) {
+  const masked = JSON.parse(JSON.stringify(config));
+  if (masked.security?.apiKey)
+    masked.security.apiKey = MASK_SENTINEL;
+  if (masked.llm?.apiKey)
+    masked.llm.apiKey = MASK_SENTINEL;
+  if (masked.embedding?.apiKey)
+    masked.embedding.apiKey = MASK_SENTINEL;
+  if (masked.database?.url)
+    masked.database.url = MASK_SENTINEL;
+  return masked;
+}
+function restartNeededSections(config) {
+  return RESTART_SECTIONS.filter((s) => {
+    if (s === "database")
+      return config.database !== undefined;
+    if (s === "embedding")
+      return config.embedding !== undefined;
+    if (s === "llm")
+      return config.llm !== undefined;
+    if (s === "security")
+      return config.security !== undefined;
+    return false;
+  });
+}
+function applyMaskedSentinel(partial, current) {
+  const result = JSON.parse(JSON.stringify(partial));
+  if (result.security?.apiKey === MASK_SENTINEL && current.security?.apiKey) {
+    result.security.apiKey = current.security.apiKey;
+  }
+  if (result.llm?.apiKey === MASK_SENTINEL && current.llm?.apiKey) {
+    result.llm.apiKey = current.llm.apiKey;
+  }
+  if (result.embedding?.apiKey === MASK_SENTINEL && current.embedding?.apiKey) {
+    result.embedding.apiKey = current.embedding.apiKey;
+  }
+  if (result.database?.url === MASK_SENTINEL && current.database?.url) {
+    result.database.url = current.database.url;
+  }
+  return result;
+}
+function checkNumber(val, min, max) {
+  if (typeof val !== "number" || !Number.isFinite(val))
+    return false;
+  if (min !== undefined && val < min)
+    return false;
+  if (max !== undefined && val > max)
+    return false;
+  return true;
+}
+function checkBoolean(val) {
+  return typeof val === "boolean";
+}
+function checkString(val) {
+  return typeof val === "string";
+}
+function validatePartial(partial) {
+  const details = [];
+  if (partial.database !== undefined) {
+    if (!checkString(partial.database.url))
+      details.push("database.url must be a string");
+  }
+  if (partial.embedding !== undefined) {
+    const e = partial.embedding;
+    if (!VALID_EMBEDDING_PROVIDERS.includes(e.provider))
+      details.push(`embedding.provider must be one of: ${VALID_EMBEDDING_PROVIDERS.join(", ")}`);
+    if (!checkString(e.model))
+      details.push("embedding.model must be a string");
+    if (e.baseURL !== undefined && !checkString(e.baseURL))
+      details.push("embedding.baseURL must be a string");
+    if (e.apiKey !== undefined && !checkString(e.apiKey))
+      details.push("embedding.apiKey must be a string");
+    if (e.dimensions !== undefined && !checkNumber(e.dimensions, 1))
+      details.push("embedding.dimensions must be a positive number");
+  }
+  if (partial.compression !== undefined) {
+    const c = partial.compression;
+    if (!checkString(c.defaultStrategy))
+      details.push("compression.defaultStrategy must be a string");
+    if (!checkNumber(c.minTokensForCompression, 0))
+      details.push("compression.minTokensForCompression must be a non-negative number");
+    if (!checkNumber(c.targetCompressionRatio, 0, 1))
+      details.push("compression.targetCompressionRatio must be a number between 0 and 1");
+    if (c.prompt !== undefined && !checkString(c.prompt))
+      details.push("compression.prompt must be a string");
+  }
+  if (partial.impact !== undefined) {
+    if (!checkBoolean(partial.impact.bfsCteEnabled))
+      details.push("impact.bfsCteEnabled must be a boolean");
+  }
+  if (partial.cache !== undefined) {
+    const c = partial.cache;
+    if (!checkBoolean(c.enabled))
+      details.push("cache.enabled must be a boolean");
+    if (!checkNumber(c.l1MaxSizeMB, 0))
+      details.push("cache.l1MaxSizeMB must be a non-negative number");
+    if (!checkNumber(c.l2MaxSizeMB, 0))
+      details.push("cache.l2MaxSizeMB must be a non-negative number");
+    if (!checkNumber(c.defaultTTLSeconds, 0))
+      details.push("cache.defaultTTLSeconds must be a non-negative number");
+  }
+  if (partial.dataDir !== undefined) {
+    if (!checkString(partial.dataDir))
+      details.push("dataDir must be a string");
+  }
+  if (partial.logging !== undefined) {
+    const l = partial.logging;
+    if (!VALID_LOG_LEVELS.includes(l.level))
+      details.push(`logging.level must be one of: ${VALID_LOG_LEVELS.join(", ")}`);
+    if (!checkBoolean(l.enableMetrics))
+      details.push("logging.enableMetrics must be a boolean");
+    if (l.file !== undefined && !checkString(l.file))
+      details.push("logging.file must be a string");
+  }
+  if (partial.search !== undefined) {
+    const s = partial.search;
+    if (!checkNumber(s.autoReindexMaxFiles, 0))
+      details.push("search.autoReindexMaxFiles must be a non-negative number");
+    const qu = s.queryUnderstanding;
+    if (qu !== undefined) {
+      if (!checkBoolean(qu.enabled))
+        details.push("search.queryUnderstanding.enabled must be a boolean");
+      if (!checkBoolean(qu.hydeEnabled))
+        details.push("search.queryUnderstanding.hydeEnabled must be a boolean");
+      if (!checkNumber(qu.cacheTtlMs, 0))
+        details.push("search.queryUnderstanding.cacheTtlMs must be a non-negative number");
+      if (!checkNumber(qu.cacheMaxSize, 0))
+        details.push("search.queryUnderstanding.cacheMaxSize must be a non-negative number");
+    }
+    const rr = s.rerank;
+    if (rr !== undefined) {
+      if (!checkBoolean(rr.enabled))
+        details.push("search.rerank.enabled must be a boolean");
+      if (!checkNumber(rr.rerankWindow, 0))
+        details.push("search.rerank.rerankWindow must be a non-negative number");
+    }
+  }
+  if (partial.llm !== undefined) {
+    const l = partial.llm;
+    if (!checkBoolean(l.enabled))
+      details.push("llm.enabled must be a boolean");
+    if (!checkString(l.baseUrl))
+      details.push("llm.baseUrl must be a string");
+    if (!checkString(l.apiKey))
+      details.push("llm.apiKey must be a string");
+    if (!checkString(l.model))
+      details.push("llm.model must be a string");
+    if (!checkString(l.codeModel))
+      details.push("llm.codeModel must be a string");
+    if (!checkNumber(l.temperature))
+      details.push("llm.temperature must be a number");
+    if (!checkNumber(l.maxOutputTokens, 1))
+      details.push("llm.maxOutputTokens must be a positive number");
+    if (!checkNumber(l.timeoutMs, 1))
+      details.push("llm.timeoutMs must be a positive number");
+    if (!checkBoolean(l.disableThink))
+      details.push("llm.disableThink must be a boolean");
+  }
+  if (partial.memory !== undefined) {
+    const m = partial.memory;
+    if (m.decay !== undefined) {
+      const d = m.decay;
+      if (!checkNumber(d.lambda))
+        details.push("memory.decay.lambda must be a number");
+      if (!checkNumber(d.sigma))
+        details.push("memory.decay.sigma must be a number");
+      if (!checkNumber(d.mu))
+        details.push("memory.decay.mu must be a number");
+      if (!checkNumber(d.coldThreshold))
+        details.push("memory.decay.coldThreshold must be a number");
+    }
+    if (m.bootstrap !== undefined) {
+      const b = m.bootstrap;
+      if (!checkBoolean(b.enabled))
+        details.push("memory.bootstrap.enabled must be a boolean");
+      if (!checkNumber(b.maxSeedMemories, 0))
+        details.push("memory.bootstrap.maxSeedMemories must be a non-negative number");
+      if (!checkNumber(b.centralityLimit, 0))
+        details.push("memory.bootstrap.centralityLimit must be a non-negative number");
+      if (!checkNumber(b.gitLogLimit, 0))
+        details.push("memory.bootstrap.gitLogLimit must be a non-negative number");
+      if (!checkBoolean(b.refreshEnabled))
+        details.push("memory.bootstrap.refreshEnabled must be a boolean");
+    }
+    if (m.autoImprove !== undefined) {
+      const a = m.autoImprove;
+      if (!checkBoolean(a.enabled))
+        details.push("memory.autoImprove.enabled must be a boolean");
+      if (!checkBoolean(a.reviewGate))
+        details.push("memory.autoImprove.reviewGate must be a boolean");
+      if (!checkNumber(a.minObservations, 0))
+        details.push("memory.autoImprove.minObservations must be a non-negative number");
+      if (!checkNumber(a.minIntervalMs, 0))
+        details.push("memory.autoImprove.minIntervalMs must be a non-negative number");
+      if (!checkNumber(a.maxWindow, 0))
+        details.push("memory.autoImprove.maxWindow must be a non-negative number");
+      if (!checkNumber(a.minQueryHits, 0))
+        details.push("memory.autoImprove.minQueryHits must be a non-negative number");
+      if (!checkNumber(a.minFileHits, 0))
+        details.push("memory.autoImprove.minFileHits must be a non-negative number");
+      if (!checkNumber(a.minFixHits, 0))
+        details.push("memory.autoImprove.minFixHits must be a non-negative number");
+    }
+    if (m.autoImportance !== undefined) {
+      if (!checkBoolean(m.autoImportance.enabled))
+        details.push("memory.autoImportance.enabled must be a boolean");
+    }
+  }
+  if (partial.hooks !== undefined) {
+    const h = partial.hooks;
+    if (!checkBoolean(h.enabled))
+      details.push("hooks.enabled must be a boolean");
+    if (!checkNumber(h.maxPayloadBytes, 0))
+      details.push("hooks.maxPayloadBytes must be a non-negative number");
+    if (h.queue !== undefined) {
+      if (!checkNumber(h.queue.maxPending, 0))
+        details.push("hooks.queue.maxPending must be a non-negative number");
+    }
+    if (h.bridge !== undefined) {
+      const b = h.bridge;
+      if (!checkBoolean(b.enabled))
+        details.push("hooks.bridge.enabled must be a boolean");
+      if (!checkNumber(b.minObservations, 0))
+        details.push("hooks.bridge.minObservations must be a non-negative number");
+      if (!checkNumber(b.minIntervalMs, 0))
+        details.push("hooks.bridge.minIntervalMs must be a non-negative number");
+      if (!checkNumber(b.maxWindow, 0))
+        details.push("hooks.bridge.maxWindow must be a non-negative number");
+    }
+  }
+  if (partial.synapse !== undefined) {
+    const syn = partial.synapse;
+    if (!checkBoolean(syn.enabled))
+      details.push("synapse.enabled must be a boolean");
+  }
+  if (partial.handoffs !== undefined) {
+    if (!checkBoolean(partial.handoffs.enabled))
+      details.push("handoffs.enabled must be a boolean");
+  }
+  if (partial.security !== undefined) {
+    const sec = partial.security;
+    if (sec.apiKey !== undefined && !checkString(sec.apiKey))
+      details.push("security.apiKey must be a string");
+    if (sec.corsOrigins !== undefined) {
+      if (!Array.isArray(sec.corsOrigins) || !sec.corsOrigins.every(checkString))
+        details.push("security.corsOrigins must be an array of strings");
+    }
+    if (sec.allowedExtensions !== undefined) {
+      if (!Array.isArray(sec.allowedExtensions) || sec.allowedExtensions.length === 0)
+        details.push("security.allowedExtensions must be a non-empty array");
+      else if (!sec.allowedExtensions.every((e) => typeof e === "string" && e.startsWith(".") && e.length >= 2))
+        details.push("security.allowedExtensions[] must be dot-prefixed extensions");
+    }
+  }
+  return details;
+}
+function savePartialConfig(partial) {
+  const current = loadConfig();
+  const mergedPartial = applyMaskedSentinel(partial, current);
+  const details = validatePartial(mergedPartial);
+  if (details.length > 0) {
+    return { success: false, details };
+  }
+  const merged = { ...current, ...mergedPartial };
+  const configPath = getConfigPath();
+  if (fs2.existsSync(configPath)) {
+    const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const backupPath = `${configPath}.bak.${timestamp}`;
+    fs2.copyFileSync(configPath, backupPath);
+  }
+  saveConfig(merged);
+  return {
+    success: true,
+    config: merged,
+    restartNeededSections: restartNeededSections(merged)
+  };
+}
+var MASK_SENTINEL = "***", RESTART_SECTIONS, VALID_EMBEDDING_PROVIDERS, VALID_LOG_LEVELS;
+var init_config_writer = __esm(() => {
+  init_config_loader();
+  RESTART_SECTIONS = ["database", "embedding", "llm", "security"];
+  VALID_EMBEDDING_PROVIDERS = ["ollama", "mistral", "openai", "google", "cohere"];
+  VALID_LOG_LEVELS = ["debug", "info", "warn", "error"];
+});
+
 // ../../packages/shared/dist/config/api-key.js
 import crypto3 from "crypto";
-import fs2 from "fs";
+import fs3 from "fs";
 import path4 from "path";
 function usable(value) {
   const trimmed = value?.trim();
@@ -756,15 +1043,15 @@ function provisionApiKey() {
       return { key: existing, provisioned: false, source: "config" };
     let fd;
     try {
-      fs2.mkdirSync(configDir2, { recursive: true });
-      fd = fs2.openSync(lockPath, "wx");
+      fs3.mkdirSync(configDir2, { recursive: true });
+      fd = fs3.openSync(lockPath, "wx");
     } catch (error) {
       if (error.code !== "EEXIST") {
         throw new ApiKeyProvisioningError(configPath, error);
       }
       if (Date.now() > deadline) {
         try {
-          fs2.unlinkSync(lockPath);
+          fs3.unlinkSync(lockPath);
         } catch {}
       }
       sleepSync(LOCK_POLL_MS);
@@ -779,9 +1066,9 @@ function provisionApiKey() {
     } catch (error) {
       throw new ApiKeyProvisioningError(configPath, error);
     } finally {
-      fs2.closeSync(fd);
+      fs3.closeSync(fd);
       try {
-        fs2.unlinkSync(lockPath);
+        fs3.unlinkSync(lockPath);
       } catch {}
     }
   }
@@ -1098,6 +1385,8 @@ var init_config = __esm(() => {
   init_config_loader();
   init_massa_ai_config();
   init_config_loader();
+  init_config_writer();
+  init_xdg();
   init_api_key();
   DEFAULT_ALLOWED_EXTENSIONS = [
     ".ts",
@@ -6603,7 +6892,7 @@ var init_types = __esm(() => {
 var init_interfaces = () => {};
 
 // ../../packages/shared/dist/utils/logger.js
-import fs3 from "fs";
+import fs4 from "fs";
 
 class Logger {
   _level;
@@ -6660,7 +6949,7 @@ class Logger {
     const filePath = this.logFilePath;
     if (filePath) {
       try {
-        fs3.appendFileSync(filePath, message + `
+        fs4.appendFileSync(filePath, message + `
 `);
       } catch {}
     }
@@ -7073,7 +7362,7 @@ var init_hosts = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/state.js
-import fs4 from "fs";
+import fs5 from "fs";
 import path7 from "path";
 function namedError(name, message) {
   const err = new InstallStateError(message);
@@ -7100,7 +7389,7 @@ function validateShape(raw2, filePath) {
 function readInstallState(filePath) {
   let text;
   try {
-    text = fs4.readFileSync(filePath, "utf-8");
+    text = fs5.readFileSync(filePath, "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT")
@@ -7120,8 +7409,8 @@ function writeInstallState(filePath, state) {
   const text = `${JSON.stringify(validated, null, 2)}
 `;
   try {
-    fs4.mkdirSync(path7.dirname(filePath), { recursive: true });
-    fs4.writeFileSync(filePath, text);
+    fs5.mkdirSync(path7.dirname(filePath), { recursive: true });
+    fs5.writeFileSync(filePath, text);
   } catch (err) {
     throw UnwritableInstallStateError(filePath, err.message);
   }
@@ -7148,7 +7437,7 @@ var init_state = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/lock.js
-import fs5 from "fs";
+import fs6 from "fs";
 import path8 from "path";
 import os4 from "os";
 import crypto4 from "crypto";
@@ -7161,7 +7450,7 @@ function namedError2(name, message) {
 function readOwner(ownerPath) {
   let raw2;
   try {
-    raw2 = JSON.parse(fs5.readFileSync(ownerPath, "utf-8"));
+    raw2 = JSON.parse(fs6.readFileSync(ownerPath, "utf-8"));
   } catch {
     return null;
   }
@@ -7177,7 +7466,7 @@ function releaseIfOwned(lockDir, ownerPath, token) {
   const owner = readOwner(ownerPath);
   if (owner === null || owner.token !== token)
     return;
-  fs5.rmSync(lockDir, { recursive: true, force: true });
+  fs6.rmSync(lockDir, { recursive: true, force: true });
 }
 function acquireLock(stateFilePath, options = {}) {
   const lockDir = `${stateFilePath}.switch.lock`;
@@ -7186,11 +7475,11 @@ function acquireLock(stateFilePath, options = {}) {
   const identity = options.identity ?? DEFAULT_IDENTITY;
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
   const createFresh = () => {
-    fs5.mkdirSync(lockDir);
+    fs6.mkdirSync(lockDir);
     const pid = identity.pid();
     const startedAt = identity.processStart(pid);
     if (startedAt == null) {
-      fs5.rmSync(lockDir, { recursive: true, force: true });
+      fs6.rmSync(lockDir, { recursive: true, force: true });
       throw LockAcquireError(lockDir, "could not determine this process's start-time identity");
     }
     const token = crypto4.randomUUID();
@@ -7201,8 +7490,8 @@ function acquireLock(stateFilePath, options = {}) {
       token,
       timestamp: clock.now()
     };
-    fs5.mkdirSync(path8.dirname(ownerPath), { recursive: true });
-    fs5.writeFileSync(ownerPath, JSON.stringify(record));
+    fs6.mkdirSync(path8.dirname(ownerPath), { recursive: true });
+    fs6.writeFileSync(ownerPath, JSON.stringify(record));
     return { lockDir, release: () => releaseIfOwned(lockDir, ownerPath, token) };
   };
   try {
@@ -7217,11 +7506,11 @@ function acquireLock(stateFilePath, options = {}) {
     throw LockHeldError(lockDir);
   const reclaimDir = `${lockDir}.reclaim.${owner.token}`;
   try {
-    fs5.renameSync(lockDir, reclaimDir);
+    fs6.renameSync(lockDir, reclaimDir);
   } catch {
     throw LockHeldError(lockDir);
   }
-  fs5.rmSync(reclaimDir, { recursive: true, force: true });
+  fs6.rmSync(reclaimDir, { recursive: true, force: true });
   try {
     return createFresh();
   } catch {
@@ -7255,7 +7544,7 @@ var init_lock = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/engine.js
-import fs6 from "fs";
+import fs7 from "fs";
 import path9 from "path";
 import os5 from "os";
 import crypto5 from "crypto";
@@ -7289,7 +7578,7 @@ function listProfiles(opts = {}) {
         availableProfiles: []
       };
     }
-    const installed = fs6.existsSync(layout.activeDir);
+    const installed = fs7.existsSync(layout.activeDir);
     const availableProfiles = listVariantProfiles(layout);
     const platform = state.platforms[host];
     return {
@@ -7305,9 +7594,9 @@ function listProfiles(opts = {}) {
   return { hosts };
 }
 function listVariantProfiles(layout) {
-  if (!fs6.existsSync(layout.variantsRoot))
+  if (!fs7.existsSync(layout.variantsRoot))
     return [];
-  return fs6.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  return fs7.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
 }
 function matchesGlob(filename, glob) {
   const starIdx = glob.indexOf("*");
@@ -7320,32 +7609,32 @@ function matchesGlob(filename, glob) {
 function assertStateWritable(stateFilePath) {
   const dir = path9.dirname(stateFilePath);
   try {
-    fs6.mkdirSync(dir, { recursive: true });
+    fs7.mkdirSync(dir, { recursive: true });
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
-  const checkPath = fs6.existsSync(stateFilePath) ? stateFilePath : dir;
+  const checkPath = fs7.existsSync(stateFilePath) ? stateFilePath : dir;
   try {
-    fs6.accessSync(checkPath, fs6.constants.W_OK);
+    fs7.accessSync(checkPath, fs7.constants.W_OK);
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
 }
 function copyFileRouteVariant(layout, variantDir) {
-  fs6.mkdirSync(layout.activeDir, { recursive: true });
+  fs7.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs6.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs7.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
-    fs6.copyFileSync(path9.join(variantDir, entry.name), path9.join(layout.activeDir, entry.name));
+    fs7.copyFileSync(path9.join(variantDir, entry.name), path9.join(layout.activeDir, entry.name));
     changed++;
   }
   return changed;
 }
 function repointOpencodeVariant(layout, variantDir) {
-  fs6.mkdirSync(layout.activeDir, { recursive: true });
+  fs7.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs6.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs7.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
     const dest = path9.join(layout.activeDir, entry.name);
@@ -7353,15 +7642,15 @@ function repointOpencodeVariant(layout, variantDir) {
     let destExists = true;
     let destIsSymlink = false;
     try {
-      destIsSymlink = fs6.lstatSync(dest).isSymbolicLink();
+      destIsSymlink = fs7.lstatSync(dest).isSymbolicLink();
     } catch {
       destExists = false;
     }
     if (destExists && !destIsSymlink)
       continue;
     const tmp = `${dest}.massa-ai-switch.${crypto5.randomUUID()}`;
-    fs6.symlinkSync(target, tmp);
-    fs6.renameSync(tmp, dest);
+    fs7.symlinkSync(target, tmp);
+    fs7.renameSync(tmp, dest);
     changed++;
   }
   return changed;
@@ -7383,13 +7672,13 @@ function switchProfile(opts) {
   if (fileHosts.length === 0) {
     return { profile: opts.profile, dryRun, hosts: orderRows(universe, skipRows), restartRequired: false };
   }
-  const installedFileHosts = fileHosts.filter((h) => fs6.existsSync(h.layout.activeDir));
+  const installedFileHosts = fileHosts.filter((h) => fs7.existsSync(h.layout.activeDir));
   if (installedFileHosts.length === 0)
     throw NoHostsDetectedError();
   const withAvailability = fileHosts.map((h) => {
-    const variantsRootExists = fs6.existsSync(h.layout.variantsRoot);
+    const variantsRootExists = fs7.existsSync(h.layout.variantsRoot);
     const variantDir = h.layout.variantDir(opts.profile);
-    const available = variantsRootExists && fs6.existsSync(variantDir) && fs6.statSync(variantDir).isDirectory();
+    const available = variantsRootExists && fs7.existsSync(variantDir) && fs7.statSync(variantDir).isDirectory();
     return { ...h, variantsRootExists, variantDir, available };
   });
   if (!withAvailability.some((h) => h.available)) {
@@ -11597,8 +11886,8 @@ var init_esm4 = __esm(() => {
     #children;
     nocase;
     #fs;
-    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs7 = defaultFS } = {}) {
-      this.#fs = fsFromOption(fs7);
+    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs8 = defaultFS } = {}) {
+      this.#fs = fsFromOption(fs8);
       if (cwd instanceof URL || cwd.startsWith("file://")) {
         cwd = fileURLToPath(cwd);
       }
@@ -12073,8 +12362,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(dir) {
       return win32.parse(dir).root.toUpperCase();
     }
-    newRoot(fs7) {
-      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs7 });
+    newRoot(fs8) {
+      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs8 });
     }
     isAbsolute(p) {
       return p.startsWith("/") || p.startsWith("\\") || /^[a-z]:(\/|\\)/i.test(p);
@@ -12090,8 +12379,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(_dir) {
       return "/";
     }
-    newRoot(fs7) {
-      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs7 });
+    newRoot(fs8) {
+      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs8 });
     }
     isAbsolute(p) {
       return p.startsWith("/");
@@ -13497,7 +13786,7 @@ var init_capture_policy = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/ignore-patterns.js
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import path11 from "path";
 function buildExtensionGlob(extensions2) {
   return extensions2.map((ext2) => `**/*${ext2}`);
@@ -13522,7 +13811,7 @@ async function loadProjectIgnore(projectPath) {
   ig.add(DEFAULT_IGNORES);
   try {
     const gitignorePath = path11.join(projectPath, ".gitignore");
-    const gitignoreContent = await fs7.readFile(gitignorePath, "utf8");
+    const gitignoreContent = await fs8.readFile(gitignorePath, "utf8");
     const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
     ig.add(rules);
@@ -13773,7 +14062,7 @@ var init_alias_resolver = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/index-manager.js
-import fs8 from "fs";
+import fs9 from "fs";
 import path12 from "path";
 
 class IndexManager {
@@ -13869,7 +14158,7 @@ class IndexManager {
       for (const filePath of indexedFiles) {
         const fullPath = path12.join(projectPath, filePath);
         try {
-          const stat2 = await fs8.promises.stat(fullPath);
+          const stat2 = await fs9.promises.stat(fullPath);
           fileMetadata[filePath] = {
             path: filePath,
             mtime: stat2.mtimeMs,
@@ -13922,7 +14211,7 @@ class IndexManager {
         }
         const fullPath = path12.join(projectPath, match2);
         try {
-          const stat2 = await fs8.promises.stat(fullPath);
+          const stat2 = await fs9.promises.stat(fullPath);
           files.set(match2, {
             path: match2,
             mtime: stat2.mtimeMs,
@@ -35546,7 +35835,7 @@ var require_token_io = __commonJS((exports, module) => {
   });
   module.exports = __toCommonJS2(token_io_exports);
   var import_path9 = __toESM2(__require("path"));
-  var import_fs6 = __toESM2(__require("fs"));
+  var import_fs7 = __toESM2(__require("fs"));
   var import_os3 = __toESM2(__require("os"));
   var import_token_error = require_token_error();
   function findRootDir() {
@@ -35554,7 +35843,7 @@ var require_token_io = __commonJS((exports, module) => {
       let dir = process.cwd();
       while (dir !== import_path9.default.dirname(dir)) {
         const pkgPath = import_path9.default.join(dir, ".vercel");
-        if (import_fs6.default.existsSync(pkgPath)) {
+        if (import_fs7.default.existsSync(pkgPath)) {
           return dir;
         }
         dir = import_path9.default.dirname(dir);
@@ -35613,7 +35902,7 @@ var require_auth_config = __commonJS((exports, module) => {
     writeAuthConfig: () => writeAuthConfig
   });
   module.exports = __toCommonJS2(auth_config_exports);
-  var fs9 = __toESM2(__require("fs"));
+  var fs10 = __toESM2(__require("fs"));
   var path13 = __toESM2(__require("path"));
   var import_token_util = require_token_util();
   function getAuthConfigPath() {
@@ -35626,10 +35915,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function readAuthConfig() {
     try {
       const authPath = getAuthConfigPath();
-      if (!fs9.existsSync(authPath)) {
+      if (!fs10.existsSync(authPath)) {
         return null;
       }
-      const content = fs9.readFileSync(authPath, "utf8");
+      const content = fs10.readFileSync(authPath, "utf8");
       if (!content) {
         return null;
       }
@@ -35641,10 +35930,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function writeAuthConfig(config3) {
     const authPath = getAuthConfigPath();
     const authDir = path13.dirname(authPath);
-    if (!fs9.existsSync(authDir)) {
-      fs9.mkdirSync(authDir, { mode: 504, recursive: true });
+    if (!fs10.existsSync(authDir)) {
+      fs10.mkdirSync(authDir, { mode: 504, recursive: true });
     }
-    fs9.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
+    fs10.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
   }
   function isValidAccessToken(authConfig, expirationBufferMs = 0) {
     if (!authConfig.token)
@@ -35820,7 +36109,7 @@ var require_token_util = __commonJS((exports, module) => {
   });
   module.exports = __toCommonJS2(token_util_exports);
   var path13 = __toESM2(__require("path"));
-  var fs9 = __toESM2(__require("fs"));
+  var fs10 = __toESM2(__require("fs"));
   var import_token_error = require_token_error();
   var import_token_io = require_token_io();
   var import_auth_config = require_auth_config();
@@ -35901,10 +36190,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");
     }
     const prjPath = path13.join(dir, ".vercel", "project.json");
-    if (!fs9.existsSync(prjPath)) {
+    if (!fs10.existsSync(prjPath)) {
       throw new import_token_error.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");
     }
-    const prj = JSON.parse(fs9.readFileSync(prjPath, "utf8"));
+    const prj = JSON.parse(fs10.readFileSync(prjPath, "utf8"));
     if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
       throw new TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");
     }
@@ -35917,9 +36206,9 @@ var require_token_util = __commonJS((exports, module) => {
     }
     const tokenPath = path13.join(dir, "com.vercel.token", `${projectId}.json`);
     const tokenJson = JSON.stringify(token);
-    fs9.mkdirSync(path13.dirname(tokenPath), { mode: 504, recursive: true });
-    fs9.writeFileSync(tokenPath, tokenJson);
-    fs9.chmodSync(tokenPath, 432);
+    fs10.mkdirSync(path13.dirname(tokenPath), { mode: 504, recursive: true });
+    fs10.writeFileSync(tokenPath, tokenJson);
+    fs10.chmodSync(tokenPath, 432);
     return;
   }
   function loadToken(projectId) {
@@ -35928,10 +36217,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");
     }
     const tokenPath = path13.join(dir, "com.vercel.token", `${projectId}.json`);
-    if (!fs9.existsSync(tokenPath)) {
+    if (!fs10.existsSync(tokenPath)) {
       return null;
     }
-    const token = JSON.parse(fs9.readFileSync(tokenPath, "utf8"));
+    const token = JSON.parse(fs10.readFileSync(tokenPath, "utf8"));
     assertVercelOidcTokenResponse(token);
     return token;
   }
@@ -63361,26 +63650,26 @@ var require_process = __commonJS((exports, module) => {
 
 // ../../node_modules/detect-libc/lib/filesystem.js
 var require_filesystem = __commonJS((exports, module) => {
-  var fs9 = __require("fs");
+  var fs10 = __require("fs");
   var LDD_PATH = "/usr/bin/ldd";
   var SELF_PATH = "/proc/self/exe";
   var MAX_LENGTH = 2048;
   var readFileSync2 = (path13) => {
-    const fd = fs9.openSync(path13, "r");
+    const fd = fs10.openSync(path13, "r");
     const buffer = Buffer.alloc(MAX_LENGTH);
-    const bytesRead = fs9.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-    fs9.close(fd, () => {});
+    const bytesRead = fs10.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+    fs10.close(fd, () => {});
     return buffer.subarray(0, bytesRead);
   };
   var readFile = (path13) => new Promise((resolve4, reject) => {
-    fs9.open(path13, "r", (err, fd) => {
+    fs10.open(path13, "r", (err, fd) => {
       if (err) {
         reject(err);
       } else {
         const buffer = Buffer.alloc(MAX_LENGTH);
-        fs9.read(fd, buffer, 0, MAX_LENGTH, 0, (_2, bytesRead) => {
+        fs10.read(fd, buffer, 0, MAX_LENGTH, 0, (_2, bytesRead) => {
           resolve4(buffer.subarray(0, bytesRead));
-          fs9.close(fd, () => {});
+          fs10.close(fd, () => {});
         });
       }
     });
@@ -100060,10 +100349,10 @@ Note that ${s.bold("include")} statements only accept relation fields.`, a12;
       super(t2, "P2023", r2);
     }
   };
-  var fs9 = new WeakMap;
+  var fs10 = new WeakMap;
   function Ep(e) {
-    let t2 = fs9.get(e);
-    return t2 || (t2 = Object.entries(e), fs9.set(e, t2)), t2;
+    let t2 = fs10.get(e);
+    return t2 || (t2 = Object.entries(e), fs10.set(e, t2)), t2;
   }
   function hs(e, t2, r2) {
     switch (t2.type) {
@@ -115803,7 +116092,7 @@ var init_managed_run_repository_pg = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/project-indexer.js
-import fs9 from "fs/promises";
+import fs10 from "fs/promises";
 import path14 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function runWithIndexLock(lockMap, projectId, work) {
@@ -116063,7 +116352,7 @@ async function checkSearchAdmission(deps, projectId, projectPath) {
 }
 async function indexFile(deps, filePath, projectId, projectRoot, centralityMap) {
   projectId = await getProjectIdentityAliasResolver().resolve(projectId);
-  const content = await fs9.readFile(filePath, "utf-8");
+  const content = await fs10.readFile(filePath, "utf-8");
   const relativePath = path14.relative(projectRoot, filePath);
   const maxFileSize = config.get("security").maxFileSize || 1024 * 1024;
   if (content.length > maxFileSize) {
@@ -116929,7 +117218,7 @@ function stripNul(content) {
 }
 
 // ../../packages/core/dist/services/etl/stages/discover.js
-import fs10 from "fs/promises";
+import fs11 from "fs/promises";
 import path15 from "path";
 import { createHash as createHash5 } from "crypto";
 
@@ -117017,8 +117306,8 @@ class DiscoverStage {
   async processFile(ctx, relativePath, forceReindex) {
     const absolutePath = path15.join(ctx.projectPath, relativePath);
     try {
-      const stat2 = await fs10.stat(absolutePath);
-      const content = stripNul(await fs10.readFile(absolutePath, "utf-8"));
+      const stat2 = await fs11.stat(absolutePath);
+      const content = stripNul(await fs11.readFile(absolutePath, "utf-8"));
       const contentHash = createHash5("sha256").update(content).digest("hex");
       let needsReparse = forceReindex;
       if (!forceReindex) {
@@ -117062,7 +117351,7 @@ class DiscoverStage {
     }
     try {
       const gitignorePath = path15.join(projectPath, ".gitignore");
-      const gitignoreContent = await fs10.readFile(gitignorePath, "utf8");
+      const gitignoreContent = await fs11.readFile(gitignorePath, "utf8");
       const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
       ig.add(rules);
@@ -119391,7 +119680,7 @@ var init_structural_runtime = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/parse.js
 import path16 from "path";
-import fs11 from "fs/promises";
+import fs12 from "fs/promises";
 function resolveChunkerMaxChars() {
   const global2 = Number(process.env.EMBEDDING_MAX_CHARS);
   if (Number.isFinite(global2) && global2 > 0)
@@ -119483,7 +119772,7 @@ class ParseStage {
     if (!file3.needsReparse) {
       const extension = path16.extname(file3.relativePath).toLowerCase();
       if ([".c", ".cpp", ".hpp"].includes(extension)) {
-        const content = file3.snapshotContent ?? await fs11.readFile(file3.absolutePath, "utf8");
+        const content = file3.snapshotContent ?? await fs12.readFile(file3.absolutePath, "utf8");
         const outcome = await this.runtime.parse({ extension, source: Buffer.from(content) });
         if (outcome.status === "failed")
           throw new StructuralEtlParseError(file3.relativePath, outcome.failureKind, `Structural evidence parse failed (${outcome.failureKind})`, outcome.diagnosticCount, outcome.diagnostics.slice(0, 10));
@@ -119495,7 +119784,7 @@ class ParseStage {
       return { file: file3, chunks: [], symbols: [], rawImports: [], rawEdges: [] };
     }
     try {
-      const content = file3.snapshotContent ?? await fs11.readFile(file3.absolutePath, "utf-8");
+      const content = file3.snapshotContent ?? await fs12.readFile(file3.absolutePath, "utf-8");
       const ext2 = path16.extname(file3.relativePath).toLowerCase();
       const chunkerMaxChars = resolveChunkerMaxChars();
       const chunks = smartChunk(content, file3.relativePath, chunkerMaxChars ? { maxChunkChars: chunkerMaxChars } : {});
@@ -120536,7 +120825,7 @@ var init_data_document2 = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/resolve.js
 import path19 from "path";
-import fs12 from "fs";
+import fs13 from "fs";
 
 class ResolveStage {
   symbolRepository;
@@ -120853,7 +121142,7 @@ class ResolveStage {
     const aliases = [];
     const tsconfigPath = path19.join(projectPath, "tsconfig.json");
     try {
-      const raw2 = fs12.readFileSync(tsconfigPath, "utf-8");
+      const raw2 = fs13.readFileSync(tsconfigPath, "utf-8");
       const stripped = raw2.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
       const tsconfig = JSON.parse(stripped);
       const paths = tsconfig?.compilerOptions?.paths ?? {};
@@ -123149,7 +123438,7 @@ __export(exports_symbol_graph_service, {
   SymbolGraphService: () => SymbolGraphService
 });
 import path23 from "path";
-import fs13 from "fs/promises";
+import fs14 from "fs/promises";
 
 class SymbolGraphService {
   identityLookup;
@@ -123477,7 +123766,7 @@ class SymbolGraphService {
   async readSnippet(relativePath, lineStart, lineEnd, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs13.readFile(absolutePath, "utf-8");
+      const content = await fs14.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       return lines.slice(Math.max(0, lineStart - 1), Math.min(lines.length, lineEnd)).join(`
@@ -123489,7 +123778,7 @@ class SymbolGraphService {
   async readContext(relativePath, lineNumber, contextLines, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs13.readFile(absolutePath, "utf-8");
+      const content = await fs14.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       const start = Math.max(0, lineNumber - contextLines - 1);
@@ -128024,9 +128313,9 @@ function detectRuntimes(deps) {
     r: exists("Rscript") ? "Rscript" : null
   };
 }
-function getRuntimeSummary(runtimes) {
+function getRuntimeSummary(runtimes, deps) {
   const lines = [];
-  const fmt = (label, cmd) => cmd ? `  ${label.padEnd(11)} ${cmd} (${getVersion(cmd)})` : `  ${label.padEnd(11)} not available`;
+  const fmt = (label, cmd) => cmd ? `  ${label.padEnd(11)} ${cmd} (${getVersion(cmd, ["--version"], deps)})` : `  ${label.padEnd(11)} not available`;
   lines.push(fmt("JavaScript:", runtimes.javascript));
   lines.push(fmt("TypeScript:", runtimes.typescript));
   lines.push(fmt("Python:", runtimes.python));
@@ -130662,7 +130951,7 @@ var init_l1_memory_cache = __esm(() => {
 });
 
 // ../../packages/core/dist/services/health/local-health-checker.js
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path28 from "path";
 
@@ -130698,10 +130987,10 @@ class LocalHealthChecker {
     const start = Date.now();
     try {
       if (!existsSync3(this.dataDir))
-        await fs16.mkdir(this.dataDir, { recursive: true });
+        await fs17.mkdir(this.dataDir, { recursive: true });
       const probe2 = path28.join(this.dataDir, ".health-check-test");
-      await fs16.writeFile(probe2, "ok");
-      await fs16.unlink(probe2);
+      await fs17.writeFile(probe2, "ok");
+      await fs17.unlink(probe2);
       return { available: true, latency: Date.now() - start, details: { path: this.dataDir, writable: true } };
     } catch (error51) {
       return { available: false, latency: Date.now() - start, error: `Data directory error: ${error51.message}` };
@@ -132625,7 +132914,7 @@ var init_scheduler2 = __esm(() => {
 });
 
 // ../../packages/core/dist/services/pricing/models-dev-client.js
-import fs17 from "fs/promises";
+import fs18 from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path29 from "path";
 function getModelsDevClient() {
@@ -132655,7 +132944,7 @@ var init_models_dev_client = __esm(() => {
         if (!existsSync4(cachePath)) {
           return null;
         }
-        const content = await fs17.readFile(cachePath, "utf-8");
+        const content = await fs18.readFile(cachePath, "utf-8");
         const data = JSON.parse(content);
         const age = Date.now() - data.timestamp;
         if (age > ModelsDevClient.LOCAL_CACHE_TTL) {
@@ -132683,13 +132972,13 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         const dir = path29.dirname(cachePath);
-        await fs17.mkdir(dir, { recursive: true });
+        await fs18.mkdir(dir, { recursive: true });
         const data = {
           timestamp: Date.now(),
           version: "1.0.0",
           models: Object.fromEntries(models)
         };
-        await fs17.writeFile(cachePath, JSON.stringify(data), "utf-8");
+        await fs18.writeFile(cachePath, JSON.stringify(data), "utf-8");
         logger.debug("Saved pricing to local cache", {
           models: models.size,
           path: cachePath
@@ -133018,7 +133307,7 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         if (existsSync4(cachePath)) {
-          await fs17.unlink(cachePath);
+          await fs18.unlink(cachePath);
           logger.debug("Local pricing cache file deleted");
         }
       } catch (error51) {
@@ -158254,20 +158543,20 @@ class ElysiaFile {
           warnMissing();
           return;
         }
-        const fs3 = process.getBuiltinModule("fs");
-        if (!fs3) {
+        const fs4 = process.getBuiltinModule("fs");
+        if (!fs4) {
           warnMissing();
           return;
         }
-        if (typeof fs3.createReadStream != "function") {
+        if (typeof fs4.createReadStream != "function") {
           warnMissing();
           return;
         }
-        if (typeof fs3.promises?.stat != "function") {
+        if (typeof fs4.promises?.stat != "function") {
           warnMissing();
           return;
         }
-        createReadStream = fs3.createReadStream, stat = fs3.promises.stat;
+        createReadStream = fs4.createReadStream, stat = fs4.promises.stat;
       }
       this.value = createReadStream(path6), this.stats = stat(path6);
     }
@@ -175718,7 +176007,7 @@ init_dist();
 init_db_connection();
 init_alias_resolver();
 init_safe_error_summary();
-import fs14 from "fs";
+import fs15 from "fs";
 import os6 from "os";
 import path25 from "path";
 
@@ -175845,9 +176134,7 @@ class AttributionResolver {
       }
       return { projectId: caller, source: "verbatim" };
     } catch (error51) {
-      logger.warn("[hook-attribution] resolution failed; using caller id (sanitized)", {
-        name: error51 instanceof Error ? error51.name : "unknown"
-      });
+      logger.warn("[hook-attribution] resolution failed; using caller id", safeErrorSummary(error51));
       return { projectId: caller, source: "verbatim" };
     }
   }
@@ -175904,7 +176191,7 @@ class AttributionResolver {
 }
 function defaultCanonicalize(cwd) {
   try {
-    return fs14.realpathSync(cwd);
+    return fs15.realpathSync(cwd);
   } catch {
     try {
       return path25.resolve(cwd);
@@ -176444,7 +176731,7 @@ init_code_compressor();
 
 // ../../packages/core/dist/services/file-read/file-content-cache.js
 init_dist();
-import fs15 from "fs/promises";
+import fs16 from "fs/promises";
 
 class FileContentCache {
   extractMetadata;
@@ -176477,7 +176764,7 @@ class FileContentCache {
         metadata: cached2.metadata
       };
     }
-    const content = await fs15.readFile(filePath, "utf-8");
+    const content = await fs16.readFile(filePath, "utf-8");
     const metadata = await this.extractMetadata(content, filePath, options);
     evictOldest(this.fileCache, this.FILE_CACHE_MAX_ENTRIES - 1);
     this.fileCache.set(cacheKey, {
@@ -177518,7 +177805,7 @@ init_event_bus();
 init_llm_client();
 init_symbol_graph_service();
 import { randomUUID as randomUUID9 } from "crypto";
-import fs18 from "fs";
+import fs19 from "fs";
 import path30 from "path";
 import { spawn as spawn2 } from "child_process";
 var FALLBACK_BOOTSTRAP = {
@@ -177704,8 +177991,8 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   try {
     for (const name26 of README_CANDIDATES) {
       const p = path30.join(projectRoot, name26);
-      if (fs18.existsSync(p) && fs18.statSync(p).isFile()) {
-        const buf = fs18.readFileSync(p);
+      if (fs19.existsSync(p) && fs19.statSync(p).isFile()) {
+        const buf = fs19.readFileSync(p);
         signals.readme = buf.slice(0, MAX_README_BYTES).toString("utf8");
         break;
       }
@@ -177715,11 +178002,11 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   }
   try {
     const docsDir = path30.join(projectRoot, "docs");
-    if (fs18.existsSync(docsDir) && fs18.statSync(docsDir).isDirectory()) {
+    if (fs19.existsSync(docsDir) && fs19.statSync(docsDir).isDirectory()) {
       const entries = walkMarkdown(docsDir).slice(0, MAX_DOCS);
       for (const rel of entries) {
         try {
-          const buf = fs18.readFileSync(rel);
+          const buf = fs19.readFileSync(rel);
           signals.docs.push({
             path: path30.relative(projectRoot, rel),
             snippet: buf.slice(0, MAX_DOC_BYTES).toString("utf8")
@@ -177733,9 +178020,9 @@ async function scanSignals(_projectId, projectRoot, caps, symbolGraph, gitRunner
   try {
     for (const name26 of MANIFEST_FILES) {
       const p = path30.join(projectRoot, name26);
-      if (!fs18.existsSync(p) || !fs18.statSync(p).isFile())
+      if (!fs19.existsSync(p) || !fs19.statSync(p).isFile())
         continue;
-      const raw2 = fs18.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
+      const raw2 = fs19.readFileSync(p).slice(0, MAX_MANIFEST_BYTES).toString("utf8");
       const kind = name26;
       if (name26 === "package.json") {
         try {
@@ -177775,7 +178062,7 @@ function walkMarkdown(dir) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs18.readdirSync(cur, { withFileTypes: true });
+      entries = fs19.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -178699,6 +178986,7 @@ var memoryRoutes = new Elysia({ prefix: "/api/v1/memory" }).post("/store", async
 });
 
 // src/routes/checkpoints.ts
+init_services();
 init_dist();
 var listCheckpointsTool = null;
 var createCheckpointTool = null;
@@ -178721,6 +179009,13 @@ function getRestoreCheckpointTool() {
   }
   return restoreCheckpointTool;
 }
+var checkpointManager = null;
+function getCheckpointManager() {
+  if (!checkpointManager) {
+    checkpointManager = CheckpointManager.getInstance();
+  }
+  return checkpointManager;
+}
 var checkpointRoutes = new Elysia({ prefix: "/api/v1/checkpoints" }).post("/list", async ({ body }) => {
   try {
     return await getListCheckpointsTool().handle(body);
@@ -178809,11 +179104,39 @@ var checkpointRoutes = new Elysia({ prefix: "/api/v1/checkpoints" }).post("/list
     summary: "Restore checkpoint",
     description: "Restore a saved checkpoint and return its state plus integrity checks."
   }
+}).post("/delete", ({ body, set: set3 }) => {
+  try {
+    const { id } = body;
+    const existed = getCheckpointManager().deleteCheckpoint(id);
+    if (!existed) {
+      set3.status = 404;
+      return { success: false, error: "not found" };
+    }
+    set3.status = 200;
+    return { success: true, data: { ok: true } };
+  } catch (error51) {
+    logger.error("Failed to delete checkpoint", error51);
+    set3.status = 500;
+    return {
+      success: false,
+      error: `Checkpoint service error: ${error51.message}`
+    };
+  }
+}, {
+  body: t.Object({
+    id: t.String({ description: "Checkpoint ID to delete" }),
+    projectId: t.Optional(t.String({ description: "Project ID (unused, for API parity)" }))
+  }),
+  detail: {
+    tags: ["checkpoint"],
+    summary: "Delete checkpoint by ID",
+    description: "Deletes a checkpoint. Returns 200 {ok:true} on mirror-hit, 404 on non-existent ID, 500 on store error. Mirror-sync: the in-memory mirror is updated immediately; the durable PG delete is async (Plan Challenge F4 \u2014 a restart before the durable delete completes could re-show the row)."
+  }
 });
 
 // src/routes/project.ts
 init_dist();
-import fs19 from "fs/promises";
+import fs20 from "fs/promises";
 import path31 from "path";
 var indexProjectTool = null;
 var indexStatusTool = null;
@@ -179025,8 +179348,8 @@ var projectRoutes = new Elysia({ prefix: "/api/v1/project" }).get("/list", async
   const finalProjectId = rawBase.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 128);
   const uploadRoot = process.env.MASSA_AI_UPLOAD_DIR || path31.join(getGlobalDataDir(), "uploads");
   const stagingDir = path31.resolve(uploadRoot, finalProjectId);
-  await fs19.rm(stagingDir, { recursive: true, force: true });
-  await fs19.mkdir(stagingDir, { recursive: true });
+  await fs20.rm(stagingDir, { recursive: true, force: true });
+  await fs20.mkdir(stagingDir, { recursive: true });
   const WRITE_BATCH = 20;
   for (let i = 0;i < body.files.length; i += WRITE_BATCH) {
     await Promise.all(body.files.slice(i, i + WRITE_BATCH).map(async (file3) => {
@@ -179037,8 +179360,8 @@ var projectRoutes = new Elysia({ prefix: "/api/v1/project" }).get("/list", async
       if (!dest.startsWith(stagingDir + path31.sep)) {
         throw new Error(`Path escapes staging directory: ${file3.relativePath}`);
       }
-      await fs19.mkdir(path31.dirname(dest), { recursive: true });
-      await fs19.writeFile(dest, file3.content, "utf-8");
+      await fs20.mkdir(path31.dirname(dest), { recursive: true });
+      await fs20.writeFile(dest, file3.content, "utf-8");
     }));
   }
   return await getIndexProjectTool().handle({
@@ -179193,7 +179516,7 @@ var analyticsRoutes = new Elysia({ prefix: "/api/v1/analytics" }).post("/", asyn
 // src/routes/system.ts
 init_dist();
 import path32 from "path";
-import fs20 from "fs";
+import fs21 from "fs";
 import os7 from "os";
 function databaseUrlParts() {
   const url2 = new URL(process.env.DATABASE_URL);
@@ -179269,9 +179592,9 @@ var systemRoutes = new Elysia({ prefix: "/api/v1/system" }).get("/info", async (
 }).get("/metrics", async () => {
   const metricsPath = path32.join(process.cwd(), "data", "metrics.json");
   let metrics2 = {};
-  if (fs20.existsSync(metricsPath)) {
+  if (fs21.existsSync(metricsPath)) {
     try {
-      metrics2 = JSON.parse(fs20.readFileSync(metricsPath, "utf-8"));
+      metrics2 = JSON.parse(fs21.readFileSync(metricsPath, "utf-8"));
     } catch {}
   }
   const database = await getDatabaseInfo();
@@ -179421,7 +179744,7 @@ var eventsRoutes = new Elysia({ prefix: "/api/v1" }).get("/events", async ({ que
 });
 
 // src/routes/workspace.ts
-import fs21 from "fs/promises";
+import fs22 from "fs/promises";
 import path33 from "path";
 import { realpathSync as realpathSync4 } from "fs";
 var indexProjectTool2 = null;
@@ -179947,7 +180270,7 @@ var workspaceRoutes = new Elysia({ prefix: "/api/v1" }).get("/workspace/list", a
       end = start + 20;
     }
     const absolutePath = path33.join(workspace.project_path, file3);
-    const content = await fs21.readFile(absolutePath, "utf-8");
+    const content = await fs22.readFile(absolutePath, "utf-8");
     const lines = content.split(/\r?\n/);
     const slice = lines.slice(start - 1, Math.min(lines.length, end));
     const formatted = slice.map((text3, idx) => ({
@@ -180872,7 +181195,7 @@ var webRoutes = new Elysia({ prefix: "/api/v1/web" }).post("/fetch_and_index", a
 });
 
 // src/routes/web-ui.ts
-import fs22 from "fs/promises";
+import fs23 from "fs/promises";
 import path34 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -180931,7 +181254,7 @@ var STATIC_DIR_CANDIDATES = buildStaticDirCandidates(path34.dirname(fileURLToPat
 async function resolveStaticDir() {
   for (const dir of STATIC_DIR_CANDIDATES) {
     try {
-      const st = await fs22.stat(dir);
+      const st = await fs23.stat(dir);
       if (st.isDirectory())
         return dir;
     } catch {}
@@ -180969,7 +181292,7 @@ async function resolveSafePath(staticDir, sub) {
     return null;
   }
   try {
-    await fs22.stat(abs);
+    await fs23.stat(abs);
     return { abs, exists: true };
   } catch {
     return { abs, exists: false };
@@ -180992,7 +181315,7 @@ function injectAccessMarkup(html, apiKey, trusted) {
   return out;
 }
 async function readShell(indexPath, remoteAddress) {
-  const raw2 = await fs22.readFile(indexPath, "utf-8");
+  const raw2 = await fs23.readFile(indexPath, "utf-8");
   const trusted = isTrustedWebUiCaller(remoteAddress);
   return Buffer.from(injectAccessMarkup(raw2, getConfiguredApiKey(), trusted), "utf-8");
 }
@@ -181042,7 +181365,7 @@ var webUiRoutes = new Elysia().get("/ui", async ({ set: set3, request }) => {
   }
   if (resolved.exists) {
     try {
-      const body = await fs22.readFile(resolved.abs);
+      const body = await fs23.readFile(resolved.abs);
       set3.headers["content-type"] = contentTypeFor(resolved.abs);
       return body;
     } catch {
@@ -181277,13 +181600,241 @@ var profileRoutes = new Elysia({ prefix: "/api/v1/profiles" }).get("/", ({ query
   }
 });
 
+// src/routes/config.ts
+init_dist();
+var CONFIG_DETAIL = {
+  tags: ["config"]
+};
+var configRoutes = new Elysia({ prefix: "/api/v1/config" }).get("/", ({ set: set3 }) => {
+  const config3 = loadConfig();
+  const masked = maskSensitive(config3);
+  const restart = restartNeededSections(config3);
+  set3.status = 200;
+  return {
+    success: true,
+    data: { config: masked, restartNeededSections: restart }
+  };
+}, {
+  detail: {
+    ...CONFIG_DETAIL,
+    summary: "Get current config with sensitive fields masked",
+    description: "Returns the current config.json with security.apiKey, llm.apiKey, embedding.apiKey, and database.url masked to '***'. Includes restartNeededSections \u2014 the subset of [database, embedding, llm, security] present in the config."
+  }
+}).put("/", ({ body, set: set3 }) => {
+  const result = savePartialConfig(body);
+  if (!result.success) {
+    set3.status = 400;
+    return {
+      success: false,
+      error: "validation failed",
+      details: result.details
+    };
+  }
+  const masked = maskSensitive(result.config);
+  set3.status = 200;
+  return {
+    success: true,
+    data: { config: masked, restartNeededSections: result.restartNeededSections }
+  };
+}, {
+  body: t.Object({}, { additionalProperties: true }),
+  detail: {
+    ...CONFIG_DETAIL,
+    summary: "Update config sections (partial, validated, atomic)",
+    description: "Accepts one or more top-level config sections. Validates each provided section, backs up to config.json.bak.<timestamp>, merges shallowly per top-level key, writes atomically. Returns the updated masked config + restartNeededSections. A sensitive field equal to '***' preserves the existing value."
+  }
+});
+
+// src/routes/model-registry.ts
+init_config();
+import fs24 from "fs";
+import path35 from "path";
+import { spawnSync } from "child_process";
+var _profilesLib = null;
+function profilesLib() {
+  if (!_profilesLib) {
+    const libPath = ["..", "..", "..", "..", "scripts", "lib", "model-profiles.ts"].join("/");
+    _profilesLib = __require(libPath);
+  }
+  return _profilesLib;
+}
+var REGISTRY_DETAIL = {
+  tags: ["model-registry"]
+};
+var OVERLAY_PATH = path35.join(configDir("massa-ai"), "model-profiles.json");
+var GENERATE_SCRIPT = path35.resolve(import.meta.dirname, "../../../../scripts/generate-subagent-artifacts.ts");
+var modelRegistryRoutes = new Elysia({ prefix: "/api/v1/model-registry" }).get("/", ({ set: set3 }) => {
+  const lib = profilesLib();
+  const result = lib.loadEffectiveRegistry({ overlayPath: OVERLAY_PATH });
+  set3.status = 200;
+  return {
+    success: true,
+    data: {
+      registry: result.registry,
+      source: result.source,
+      ...result.overlayError ? { overlayError: result.overlayError } : {}
+    }
+  };
+}, {
+  detail: {
+    ...REGISTRY_DETAIL,
+    summary: "Get effective registry (builtin + overlay) with source attribution",
+    description: "Returns the merged registry (builtin + overlay), source attribution (builtin, overlay, tombstoned), and overlayError if the overlay is corrupted (200 status, never fails)."
+  }
+}).put("/", ({ body, set: set3 }) => {
+  const lib = profilesLib();
+  const overlay = body;
+  const builtin = lib.loadRegistry(lib.DEFAULT_REGISTRY_PATH);
+  const merged = mergeOverlayForValidation(builtin, overlay);
+  try {
+    lib.validateRegistry(merged);
+  } catch (e) {
+    if (e instanceof lib.RegistryValidationError) {
+      set3.status = 400;
+      return {
+        success: false,
+        error: "validation failed",
+        details: e.violations
+      };
+    }
+    throw e;
+  }
+  try {
+    writeOverlayAtomically(OVERLAY_PATH, overlay);
+  } catch (e) {
+    set3.status = 500;
+    return {
+      success: false,
+      error: `overlay write failed: ${e.message}`
+    };
+  }
+  const result = lib.loadEffectiveRegistry({ overlayPath: OVERLAY_PATH });
+  set3.status = 200;
+  return {
+    success: true,
+    data: {
+      registry: result.registry,
+      source: result.source
+    }
+  };
+}, {
+  body: t.Object({}, { additionalProperties: true }),
+  detail: {
+    ...REGISTRY_DETAIL,
+    summary: "Write overlay (full-replace, validated, atomic)",
+    description: "Accepts the full overlay object. Validates the merged result (builtin + overlay) via validateRegistry(). On success, writes atomically to ~/.config/massa-ai/model-profiles.json and returns the updated effective registry. On failure, returns 400 with all violations."
+  }
+}).post("/regenerate", ({ set: set3 }) => {
+  try {
+    const child = spawnSync("bun", [GENERATE_SCRIPT], {
+      env: { ...process.env },
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (child.exitCode !== 0) {
+      set3.status = 500;
+      return {
+        success: false,
+        error: `regeneration failed (exit ${child.exitCode}): ${child.stderr?.toString().trim()}`
+      };
+    }
+    set3.status = 200;
+    return {
+      success: true,
+      data: { regenerated: true }
+    };
+  } catch (e) {
+    set3.status = 500;
+    return {
+      success: false,
+      error: `regeneration error: ${e.message}`
+    };
+  }
+}, {
+  detail: {
+    ...REGISTRY_DETAIL,
+    summary: "Regenerate subagent artifacts (spawn child process)",
+    description: "Spawns `bun scripts/generate-subagent-artifacts.ts` as a child process with inherited env. Returns {regenerated:true} on success or 500 on non-zero exit. Does not switch profiles."
+  }
+}).delete("/overlay", ({ set: set3 }) => {
+  const lib = profilesLib();
+  try {
+    if (fs24.existsSync(OVERLAY_PATH)) {
+      fs24.unlinkSync(OVERLAY_PATH);
+    }
+    const builtin = lib.loadRegistry(lib.DEFAULT_REGISTRY_PATH);
+    set3.status = 200;
+    return {
+      success: true,
+      data: {
+        registry: builtin,
+        source: { builtin, overlay: null, tombstoned: [] }
+      }
+    };
+  } catch (e) {
+    set3.status = 500;
+    return {
+      success: false,
+      error: `failed to delete overlay: ${e.message}`
+    };
+  }
+}, {
+  detail: {
+    ...REGISTRY_DETAIL,
+    summary: "Delete overlay (reset to built-in)",
+    description: "Deletes the overlay file at ~/.config/massa-ai/model-profiles.json and returns the builtin registry."
+  }
+});
+function mergeOverlayForValidation(builtin, overlay) {
+  const result = JSON.parse(JSON.stringify(builtin));
+  if (overlay.tiers && Array.isArray(overlay.tiers)) {
+    result.tiers = [...overlay.tiers];
+  }
+  if (overlay.hostDefaults) {
+    result.hostDefaults = { ...overlay.hostDefaults };
+  }
+  if (overlay.workflowTiers) {
+    result.workflowTiers = { ...overlay.workflowTiers };
+  }
+  if (overlay.profiles) {
+    const profiles = result.profiles;
+    for (const [key, val] of Object.entries(overlay.profiles)) {
+      if (val && typeof val === "object" && !Array.isArray(val)) {
+        if (val._delete === true) {
+          delete profiles[key];
+          continue;
+        }
+        const { _delete: _unused, ...profileData } = val;
+        profiles[key] = profileData;
+      }
+    }
+    result.profiles = profiles;
+  }
+  return result;
+}
+function writeOverlayAtomically(overlayPath, data) {
+  const dir = path35.dirname(overlayPath);
+  if (!fs24.existsSync(dir)) {
+    fs24.mkdirSync(dir, { recursive: true });
+  }
+  const tmp = `${overlayPath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs24.writeFileSync(tmp, JSON.stringify(data, null, 2));
+    fs24.renameSync(tmp, overlayPath);
+  } catch (e) {
+    try {
+      fs24.unlinkSync(tmp);
+    } catch {}
+    throw e;
+  }
+}
+
 // src/middleware/error.ts
 init_dist();
-var errorHandler = new Elysia({ name: "error-handler" }).onError(({ code, error: error51, set: set3, path: path35, request }) => {
+var errorHandler = new Elysia({ name: "error-handler" }).onError(({ code, error: error51, set: set3, path: path36, request }) => {
   logger.error("[massa-ai-api] Request failed", undefined, {
     ...safeErrorSummary(error51),
     code,
-    path: path35,
+    path: path36,
     method: request.method
   });
   if (error51 instanceof SearchServiceError) {
@@ -181399,7 +181950,7 @@ var app = new Elysia({ adapter: node() }).use(cors(buildCorsOptions(config.get("
     },
     security: [{ ApiKeyAuth: [] }]
   }
-})).use(errorHandler).use(authMiddleware).use(searchRoutes).use(memoryRoutes).use(checkpointRoutes).use(projectRoutes).use(contextRoutes).use(analyticsRoutes).use(systemRoutes).use(eventsRoutes).use(workspaceRoutes).use(fileRoutes).use(synapseRoutes).use(hookRoutes).use(bootstrapRoutes).use(handoffRoutes).use(proposalRoutes).use(executorRoutes).use(webRoutes).use(webUiRoutes).use(architectureRoutes).use(dashboardRoutes).use(profileRoutes).get("/health", () => buildHealthResponse(getParserReadiness()));
+})).use(errorHandler).use(authMiddleware).use(searchRoutes).use(memoryRoutes).use(checkpointRoutes).use(projectRoutes).use(contextRoutes).use(analyticsRoutes).use(systemRoutes).use(eventsRoutes).use(workspaceRoutes).use(fileRoutes).use(synapseRoutes).use(hookRoutes).use(bootstrapRoutes).use(handoffRoutes).use(proposalRoutes).use(executorRoutes).use(webRoutes).use(webUiRoutes).use(architectureRoutes).use(dashboardRoutes).use(profileRoutes).use(configRoutes).use(modelRegistryRoutes).get("/health", () => buildHealthResponse(getParserReadiness()));
 initAuthOrExit();
 warnIfTrustOverrideEnabled();
 await listenAfterParserValidation({