@mrciphersmith/keryx 0.2.17 → 0.2.18

package/dist/cli.js

@@ -55,9 +55,12 @@ import {
   chmodSync,
   mkdirSync,
   readFileSync,
+  renameSync,
   statSync,
+  unlinkSync,
   writeFileSync
 } from "fs";
+import { randomUUID } from "crypto";
 import { homedir } from "os";
 import path from "path";
 function keryxConfigDir(dir) {
@@ -146,6 +149,21 @@ function writeOwnerOnlyFile(file, body) {
     chmodSync(file, 384);
   } catch {}
 }
+function writeOwnerOnlyFileAtomic(file, body) {
+  const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, body, { encoding: "utf8", mode: 384 });
+    if (process.platform !== "win32") {
+      chmodSync(temporary, 384);
+    }
+    renameSync(temporary, file);
+  } catch (cause) {
+    try {
+      unlinkSync(temporary);
+    } catch {}
+    throw cause;
+  }
+}
 function ensureKeryxConfigDir(dir) {
   const base = keryxConfigDir(dir);
   try {
@@ -174,7 +192,7 @@ __export(exports_fs, {
   pathExists: () => pathExists,
   isPathInside: () => isPathInside
 });
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { access, mkdir, rename, rm, stat, writeFile } from "fs/promises";
 import path5 from "path";
 async function pathExists(filePath) {
@@ -195,7 +213,7 @@ function isPathInside(root, candidate) {
 async function writeFileAtomic(filePath, content) {
   const dir = path5.dirname(filePath);
   await mkdir(dir, { recursive: true });
-  const tmp = path5.join(dir, `.${path5.basename(filePath)}.${process.pid}.${Date.now()}.${randomUUID3()}.tmp`);
+  const tmp = path5.join(dir, `.${path5.basename(filePath)}.${process.pid}.${Date.now()}.${randomUUID4()}.tmp`);
   try {
     await writeFile(tmp, content, "utf8");
     await rename(tmp, filePath);
@@ -11146,7 +11164,7 @@ var init_search = __esm(() => {
 });
 
 // src/memory/report.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import { access as access2, mkdir as mkdir27, readdir as readdir7, rename as rename3, rm as rm5, stat as stat4, writeFile as writeFile30 } from "fs/promises";
 import path71 from "path";
 function runtimeRoot(cwd) {
@@ -11306,7 +11324,7 @@ class MemoryReportStore {
   nextRunId;
   constructor(dependencies = {}) {
     this.clock = dependencies.clock ?? (() => new Date);
-    this.nextRunId = dependencies.runId ?? (() => randomUUID5());
+    this.nextRunId = dependencies.runId ?? (() => randomUUID6());
   }
   async writeReport(input2) {
     const runId = input2.runId ?? this.nextRunId();
@@ -11327,7 +11345,7 @@ class MemoryReportStore {
       if ((await stat4(candidate)).mtimeMs <= staleBefore)
         await rm5(candidate, { recursive: true, force: true });
     }
-    const staging = path71.join(tempRoot, `${runId}.${randomUUID5()}`);
+    const staging = path71.join(tempRoot, `${runId}.${randomUUID6()}`);
     try {
       await mkdir27(staging);
       await Promise.all([
@@ -12714,17 +12732,17 @@ import {
   fsyncSync,
   openSync as openSync2,
   realpathSync,
-  renameSync,
+  renameSync as renameSync2,
   statSync as statSync3,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "fs";
 import path3 from "path";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/lib/file-lock.ts
 import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import path2 from "path";
 var LOCK_STALE_MS = 1e4;
 var LOCK_TIMEOUT_MS = 15000;
@@ -12743,7 +12761,7 @@ function withFileLock(lockPath, fn, options = {}) {
   } catch {
     return null;
   }
-  const nonce = randomUUID();
+  const nonce = randomUUID2();
   const started = Date.now();
   const deadline = started + LOCK_TIMEOUT_MS;
   let handle = null;
@@ -12925,7 +12943,7 @@ function quarantineDamagedRegistry(dir, onWarn) {
 }
 function saveProjectRegistry(registry, dir, onWarn) {
   const file = projectRegistryPath(dir);
-  const temp = `${file}.${randomUUID2()}.tmp`;
+  const temp = `${file}.${randomUUID3()}.tmp`;
   try {
     ensureKeryxConfigDir(dir);
     const sorted = {
@@ -12940,11 +12958,11 @@ function saveProjectRegistry(registry, dir, onWarn) {
     } finally {
       closeSync2(handle);
     }
-    renameSync(temp, file);
+    renameSync2(temp, file);
     return true;
   } catch {
     try {
-      unlinkSync(temp);
+      unlinkSync2(temp);
     } catch {}
     return false;
   }
@@ -12981,7 +12999,7 @@ function registerProject(projectPath, options = {}) {
       return { ok: true, entry: existing, created: false };
     }
     const entry = {
-      projectId: randomUUID2(),
+      projectId: randomUUID3(),
       path: absolute,
       displayName: options.displayName ?? path3.basename(absolute),
       state: "active",
@@ -13694,7 +13712,7 @@ function sessionDir(projectPath, sessionId, dataDir) {
 
 // src/harness/process/sandbox/network-run.ts
 import { Worker } from "worker_threads";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { existsSync as existsSync3 } from "fs";
 import { rm as rm2, writeFile as writeFile3 } from "fs/promises";
 import { fileURLToPath } from "url";
@@ -13789,7 +13807,7 @@ async function setupNetworkRun(profile, options = {}) {
   for (const cred of options.masks ?? []) {
     if (cred.realValue.length === 0)
       continue;
-    const sentinel = `keryx-sentinel-${randomUUID4()}`;
+    const sentinel = `keryx-sentinel-${randomUUID5()}`;
     maskedEnv[cred.name] = sentinel;
     proxyMasks.push({ sentinel, realValue: cred.realValue, injectHosts: cred.injectHosts });
   }
@@ -13799,7 +13817,7 @@ async function setupNetworkRun(profile, options = {}) {
   const trustEnv = {};
   let caPemPath;
   if (tlsTerminate && caCertPem) {
-    caPemPath = path9.join(tmpdir(), `keryx-run-ca-${randomUUID4()}.pem`);
+    caPemPath = path9.join(tmpdir(), `keryx-run-ca-${randomUUID5()}.pem`);
     await writeFile3(caPemPath, caCertPem, { mode: 420 });
     trustEnv.SSL_CERT_FILE = caPemPath;
     trustEnv.CURL_CA_BUNDLE = caPemPath;
@@ -17192,7 +17210,8 @@ function renderIndexMarkdown({
     "First choose the capability: graph/navigation, compact context, wiki/domain knowledge, memory, testing, health, security, skills/orchestration, or flow lifecycle.",
     "If the same capability is available through MCP tools/resources, prefer MCP because it preserves structured inputs and outputs. If MCP is unavailable, use the module skill and `keryx` CLI fallback.",
     "Load the narrowest relevant skill/rule before reading broad source files. Do not ask the user which internal command to run unless multiple user-level outcomes are genuinely possible.",
-    "When reporting results, name the Metaproject sources used at a high level (for example: graph, wiki, memory, health), not every internal command."
+    "When reporting results, name the Metaproject sources used at a high level (for example: graph, wiki, memory, health), not every internal command.",
+    "Once per session, run `keryx version check --json`. Notify the user only when the result is `update-available`; this is an advisory and never installs anything. A timeout, offline registry, `unavailable`, or `unknown-command` result is non-blocking: never block project work on the check."
   ].map((item) => `- ${item}`).join(`
 `);
   const intentRows = [
@@ -32023,6 +32042,15 @@ var COMMAND_DESCRIPTORS = [
     args: [{ name: "json", type: "bool", required: false, desc: "structured module state" }],
     json: true,
     read: true
+  },
+  {
+    module: "core",
+    command: "version check",
+    summary: "Check the fixed npm latest endpoint for a newer Keryx release.",
+    intent: ["check keryx version", "check for update", "\u043F\u0440\u043E\u0432\u0435\u0440\u044C \u0432\u0435\u0440\u0441\u0438\u044E keryx"],
+    args: [{ name: "json", type: "bool", required: false, desc: "typed structured result" }],
+    json: true,
+    read: true
   }
 ];
 function sortKey(descriptor) {
@@ -34743,7 +34771,7 @@ Reports the workspace root and one enabled/disabled line per module. Use
 // src/commands/harness.ts
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import path118 from "path";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // src/security/harness-scan.ts
 init_guard();
@@ -37093,7 +37121,7 @@ function resolveRuntime(deps) {
   const env = deps?.env ?? process.env;
   const clock = deps?.clock ?? (() => new Date().toISOString());
   let idCounter = 0;
-  const idSeq = deps?.idSeq ?? (() => `${randomUUID6()}-${idCounter++}`);
+  const idSeq = deps?.idSeq ?? (() => `${randomUUID7()}-${idCounter++}`);
   return { env, clock, idSeq };
 }
 function shellAllowProfile() {
@@ -37184,7 +37212,7 @@ async function harnessCommand(args, deps) {
   const env = deps?.env ?? process.env;
   const clock = deps?.clock ?? (() => new Date().toISOString());
   let idCounter = 0;
-  const idSeq = deps?.idSeq ?? (() => `${randomUUID6()}-${idCounter++}`);
+  const idSeq = deps?.idSeq ?? (() => `${randomUUID7()}-${idCounter++}`);
   const fetchImpl = deps?.fetch ?? globalThis.fetch;
   if (provider === "anthropic") {
     const apiKey = env.ANTHROPIC_API_KEY;
@@ -37301,7 +37329,7 @@ function harnessReplay(args, deps) {
   }
   const clock = deps?.clock ?? (() => new Date().toISOString());
   let idCounter = 0;
-  const idSeq = deps?.idSeq ?? (() => `${randomUUID6()}-${idCounter++}`);
+  const idSeq = deps?.idSeq ?? (() => `${randomUUID7()}-${idCounter++}`);
   const fixture = (() => {
     if (parsed.fixture === undefined || parsed.fixture.length === 0) {
       return { ok: true, value: buildReplayFixture(run, { idSeq }), built: true };
@@ -37741,7 +37769,7 @@ function harnessWave(args, deps) {
 // src/commands/shell.ts
 init_make_provider();
 init_orient();
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import * as readline2 from "readline";
 
 // src/harness/tool/builtin/ask-user-tool.ts
@@ -38385,7 +38413,7 @@ function shellExecTool(root, run = makeCommandRunner(root)) {
 }
 
 // src/harness/tool/builtin/spawn-subagent-tool.ts
-import { createHash as createHash17, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash17, randomUUID as randomUUID8 } from "crypto";
 
 // src/harness/child/ledger.ts
 function decrement(remaining, reservation) {
@@ -39501,7 +39529,7 @@ function sha2565(text) {
 var parentShellPolicy = shellParentProfile;
 var childReadOnlyPolicy = shellChildReadOnlyProfile;
 function createSpawnSubagentTool(deps) {
-  const idSeq = deps.idSeq ?? (() => randomUUID7());
+  const idSeq = deps.idSeq ?? (() => randomUUID8());
   const clock = deps.clock ?? (() => new Date().toISOString());
   const parentRunId = deps.parentRunId ?? idSeq();
   const parentSessionId = deps.parentSessionId ?? idSeq();
@@ -40350,11 +40378,11 @@ import {
   existsSync as existsSync23,
   mkdirSync as mkdirSync6,
   readdirSync,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   writeFileSync as writeFileSync7
 } from "fs";
 import path120 from "path";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var SESSION_SCHEMA_VERSION = 1;
 function nowIso() {
   return new Date().toISOString();
@@ -40393,7 +40421,7 @@ function tighten(target) {
 function atomicWriteText(file, body) {
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync7(tmp, body, { encoding: "utf8", mode: 384 });
-  renameSync2(tmp, file);
+  renameSync3(tmp, file);
 }
 function atomicWriteJson(file, value) {
   atomicWriteText(file, `${JSON.stringify(value, null, 2)}
@@ -40501,7 +40529,7 @@ function readJsonl2(file) {
 function createSession(opts) {
   const projectPath = resolveProjectRoot(opts.cwd);
   const projectKey2 = projectKeyFromPath(projectPath);
-  const id = opts.id ?? randomUUID8();
+  const id = opts.id ?? randomUUID9();
   const dir = sessionDir(projectPath, id, opts.dataDir);
   ensureDir(dir, opts.dataDir);
   const ts = nowIso();
@@ -40944,6 +40972,279 @@ function showComposerChoice(otui, r, dock, request) {
   });
 }
 
+// src/lib/version-check.ts
+init_config_dir();
+init_fs();
+import path121 from "path";
+var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
+var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
+var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
+var VERSION_STRING_LIMIT_CHARS = 64;
+var REQUEST_TIMEOUT_MS = 2000;
+var SUCCESS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+var FAILURE_BACKOFF_MS = 15 * 60 * 1000;
+var CACHE_LOCK_TIMEOUT_MS = 250;
+var CACHE_LOCK_RETRY_MS = 10;
+var CACHE_LOCK_STALE_MS = 5000;
+var SYSTEM_TIMER = {
+  schedule: (callback, delayMs) => setTimeout(callback, delayMs),
+  cancel: (handle) => clearTimeout(handle)
+};
+function formatVersionUpdateAdvisory(result) {
+  if (result.status !== "update-available")
+    return;
+  return `Keryx update ${result.currentVersion} \u2192 ${result.latestVersion}
+${result.installCommand}`;
+}
+var STRICT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function parseSemVer(value) {
+  if (value.length > VERSION_STRING_LIMIT_CHARS)
+    return;
+  const match = STRICT_SEMVER.exec(value);
+  if (match === null)
+    return;
+  const prereleaseText = match[4];
+  const prerelease = [];
+  if (prereleaseText !== undefined) {
+    for (const identifier of prereleaseText.split(".")) {
+      if (/^\d+$/.test(identifier)) {
+        if (identifier.length > 1 && identifier.startsWith("0"))
+          return;
+        prerelease.push(BigInt(identifier));
+      } else {
+        prerelease.push(identifier);
+      }
+    }
+  }
+  return {
+    major: BigInt(match[1]),
+    minor: BigInt(match[2]),
+    patch: BigInt(match[3]),
+    prerelease
+  };
+}
+function compareSemVer(left, right) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (left[key] < right[key])
+      return -1;
+    if (left[key] > right[key])
+      return 1;
+  }
+  if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+    if (left.prerelease.length === right.prerelease.length)
+      return 0;
+    return left.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.prerelease.length, right.prerelease.length);
+  for (let index = 0;index < length; index += 1) {
+    const a = left.prerelease[index];
+    const b = right.prerelease[index];
+    if (a === undefined || b === undefined) {
+      if (a === b)
+        return 0;
+      return a === undefined ? -1 : 1;
+    }
+    if (typeof a === "bigint" && typeof b === "bigint") {
+      if (a < b)
+        return -1;
+      if (a > b)
+        return 1;
+    } else if (typeof a === "bigint") {
+      return -1;
+    } else if (typeof b === "bigint") {
+      return 1;
+    } else if (a !== b) {
+      return a < b ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function parseCache(file) {
+  const read = readConfigFile(file);
+  if (!read.ok)
+    return;
+  try {
+    const value = JSON.parse(read.text);
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+      return;
+    const record = value;
+    const cache = {};
+    if (typeof record.latestVersion === "string" && parseSemVer(record.latestVersion) !== undefined) {
+      cache.latestVersion = record.latestVersion;
+    }
+    if (typeof record.successAt === "number" && Number.isFinite(record.successAt))
+      cache.successAt = record.successAt;
+    if (typeof record.failureAt === "number" && Number.isFinite(record.failureAt))
+      cache.failureAt = record.failureAt;
+    return cache;
+  } catch {
+    return;
+  }
+}
+function resultFor(currentVersion, current, latestVersion, source) {
+  const latest2 = parseSemVer(latestVersion);
+  return compareSemVer(current, latest2) < 0 ? { status: "update-available", currentVersion, latestVersion, installCommand: FIXED_INSTALL_COMMAND, source } : { status: "up-to-date", currentVersion, latestVersion, source };
+}
+function cancelWithoutWaiting(cancel) {
+  try {
+    cancel().catch(() => {});
+  } catch {}
+}
+async function boundedResponseText(response) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null && /^\d+$/.test(declared) && BigInt(declared) > BigInt(RESPONSE_BODY_LIMIT_BYTES)) {
+    if (response.body !== null) {
+      cancelWithoutWaiting(() => response.body.cancel());
+    }
+    return;
+  }
+  if (response.body === null)
+    return "";
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let size = 0;
+  let text = "";
+  try {
+    for (;; ) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > RESPONSE_BODY_LIMIT_BYTES) {
+        cancelWithoutWaiting(() => reader.cancel());
+        return;
+      }
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return text + decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
+}
+function unavailable(currentVersion, reason, cache) {
+  return {
+    status: "unavailable",
+    currentVersion,
+    reason,
+    ...cache?.latestVersion !== undefined ? { cachedLatestVersion: cache.latestVersion } : {}
+  };
+}
+function saveCache(file, cache) {
+  try {
+    writeOwnerOnlyFileAtomic(file, `${JSON.stringify(cache, null, 2)}
+`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function mergeSuccessfulCache(committed, latestVersion, successAt) {
+  if (committed.latestVersion === undefined || committed.successAt === undefined) {
+    return { latestVersion, successAt };
+  }
+  if (committed.successAt > successAt)
+    return committed;
+  if (committed.successAt < successAt)
+    return { latestVersion, successAt };
+  const committedVersion = parseSemVer(committed.latestVersion);
+  const candidateVersion = parseSemVer(latestVersion);
+  if (committedVersion !== undefined && candidateVersion !== undefined) {
+    const precedence = compareSemVer(committedVersion, candidateVersion);
+    if (precedence > 0)
+      return committed;
+    if (precedence < 0)
+      return { latestVersion, successAt };
+    if (committed.latestVersion >= latestVersion)
+      return committed;
+  }
+  return { latestVersion, successAt };
+}
+async function updateCache(file, update) {
+  try {
+    return await withFileLock2(`${file}.lock`, async () => saveCache(file, update(parseCache(file) ?? {})), {
+      timeoutMs: CACHE_LOCK_TIMEOUT_MS,
+      retryMs: CACHE_LOCK_RETRY_MS,
+      staleMs: CACHE_LOCK_STALE_MS
+    });
+  } catch {
+    return false;
+  }
+}
+async function checkVersion(options) {
+  const current = parseSemVer(options.currentVersion);
+  if (current === undefined)
+    return unavailable(options.currentVersion, "invalid-current-version");
+  const now = options.now ?? Date.now;
+  const timestamp = now();
+  const configDir = ensureKeryxConfigDir(options.cacheDir);
+  const cacheFile = path121.join(configDir, "version-check.json");
+  const cache = parseCache(cacheFile);
+  if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
+    return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
+  }
+  if (cache?.failureAt !== undefined && timestamp - cache.failureAt >= 0 && timestamp - cache.failureAt < FAILURE_BACKOFF_MS) {
+    return unavailable(options.currentVersion, "suppressed", cache);
+  }
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const controller = new AbortController;
+  const timer = options.timer ?? SYSTEM_TIMER;
+  let timeout;
+  let timeoutScheduled = false;
+  let failure;
+  let latestVersion;
+  try {
+    timeout = timer.schedule(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    timeoutScheduled = true;
+    const response = await fetchImpl(REGISTRY_URL, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      signal: controller.signal,
+      credentials: "omit"
+    });
+    if (!response.ok) {
+      failure = "http";
+    } else {
+      const body = await boundedResponseText(response);
+      if (body === undefined) {
+        failure = "response-too-large";
+      } else {
+        let parsed;
+        try {
+          parsed = JSON.parse(body);
+        } catch {
+          parsed = undefined;
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          failure = "malformed-response";
+        } else {
+          const record = parsed;
+          if (record.name !== "@mrciphersmith/keryx" || typeof record.version !== "string") {
+            failure = "malformed-response";
+          } else if (parseSemVer(record.version) === undefined) {
+            failure = "invalid-latest-version";
+          } else {
+            latestVersion = record.version;
+          }
+        }
+      }
+    }
+  } catch {
+    failure = controller.signal.aborted ? "timeout" : "network";
+  } finally {
+    if (timeoutScheduled) {
+      try {
+        timer.cancel(timeout);
+      } catch {}
+    }
+  }
+  if (latestVersion === undefined) {
+    await updateCache(cacheFile, (committed) => ({ ...committed, failureAt: timestamp }));
+    return unavailable(options.currentVersion, failure ?? "network", cache);
+  }
+  await updateCache(cacheFile, (committed) => mergeSuccessfulCache(committed, latestVersion, timestamp));
+  return resultFor(options.currentVersion, current, latestVersion, "registry");
+}
+
 // src/tui/shell-chrome.ts
 function onKeypress2(r, handler) {
   r._internalKeyInput.onInternal("keypress", handler);
@@ -40957,6 +41258,14 @@ var SIDEBAR_BORDER_LEFT = 1;
 var SIDEBAR_PADDING_LEFT = 2;
 var SIDEBAR_PADDING_RIGHT = 1;
 var SIDEBAR_TEXT_WIDTH = SIDEBAR_WIDTH - SIDEBAR_BORDER_LEFT - SIDEBAR_PADDING_LEFT - SIDEBAR_PADDING_RIGHT;
+function formatSidebarVersionUpdateAdvisory(result) {
+  const advisory = formatVersionUpdateAdvisory(result);
+  if (advisory === undefined || result.status !== "update-available")
+    return;
+  const split = Math.ceil(result.installCommand.length / 2);
+  return advisory.replace(result.installCommand, `${result.installCommand.slice(0, split)}
+${result.installCommand.slice(split)}`);
+}
 var SPINNER = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var SPINNER_MS = 120;
 var TOAST_MS = 5000;
@@ -40986,6 +41295,7 @@ async function createShellChrome(otui, renderer, opts) {
   const toastMs = opts.toastMs ?? TOAST_MS;
   const filter = opts.filterCommands ?? ((query) => prefixFilter(opts.commands, query));
   let uid = 0;
+  let alive = true;
   const rootRow = new otui.BoxRenderable(r, { id: "root-row", flexGrow: 1, flexDirection: "row" });
   r.root.add(rootRow);
   const main = new otui.BoxRenderable(r, { id: "main", flexGrow: 1, minWidth: 0, flexDirection: "column" });
@@ -41004,6 +41314,21 @@ async function createShellChrome(otui, renderer, opts) {
   rootRow.add(sidebar);
   const sidebarTop = new otui.BoxRenderable(r, { id: "sb-top", flexShrink: 0, flexDirection: "column" });
   sidebar.add(sidebarTop);
+  if (opts.versionCheck !== undefined) {
+    const versionNotice = new otui.TextRenderable(r, {
+      id: `sb-version-${uid++}`,
+      content: ""
+    });
+    sidebarTop.add(versionNotice);
+    opts.versionCheck.then((result) => {
+      const advisory = formatSidebarVersionUpdateAdvisory(result);
+      if (!alive || advisory === undefined)
+        return;
+      try {
+        versionNotice.content = otui.t`${otui.yellow(advisory)}`;
+      } catch {}
+    }, () => {});
+  }
   const sidebarSpacer = new otui.BoxRenderable(r, { id: "sb-spacer", flexGrow: 1 });
   sidebar.add(sidebarSpacer);
   const toastText = new otui.TextRenderable(r, { id: "sb-toast", content: "" });
@@ -41384,6 +41709,7 @@ async function createShellChrome(otui, renderer, opts) {
       };
     },
     destroy: () => {
+      alive = false;
       clearBusyTimer();
       clearToastTimer();
       unsubscribeMenuKeys();
@@ -42847,7 +43173,8 @@ async function launchTuiAgentShell(opts) {
       placeholder: "type a task or / for commands \xB7 Enter send \xB7 Shift+Enter newline",
       commands: commandsForMode("agent"),
       headerMeta: "\u21910 \u21930",
-      filterCommands: (query) => filterCommands(query, "agent")
+      filterCommands: (query) => filterCommands(query, "agent"),
+      ...opts.versionCheck !== undefined ? { versionCheck: opts.versionCheck } : {}
     });
     mountedChrome = chrome;
     const transcript = chrome.transcript;
@@ -43905,7 +44232,8 @@ async function mountChatShell(otui, renderer, opts) {
     placeholder: "type a message or / for commands \xB7 Enter send \xB7 Shift+Enter newline",
     commands: commandsForMode("chat"),
     headerMeta: "~0",
-    filterCommands: (query) => filterCommands(query, "chat")
+    filterCommands: (query) => filterCommands(query, "chat"),
+    ...opts.versionCheck !== undefined ? { versionCheck: opts.versionCheck } : {}
   });
   let uid = 0;
   const transcript = chrome.transcript;
@@ -44057,7 +44385,8 @@ async function launchTuiChatShell(opts) {
       },
       onExit: () => {
         r.destroy();
-      }
+      },
+      ...opts.versionCheck !== undefined ? { versionCheck: opts.versionCheck } : {}
     });
     await Promise.race([exited, handle.done]);
     return true;
@@ -44072,6 +44401,76 @@ async function launchTuiChatShell(opts) {
 
 // src/commands/shell.ts
 init_shell_config();
+// package.json
+var package_default = {
+  name: "@mrciphersmith/keryx",
+  version: "0.2.18",
+  description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
+  private: false,
+  publishConfig: {
+    access: "public"
+  },
+  license: "MIT",
+  type: "module",
+  repository: {
+    type: "git",
+    url: "git+ssh://git@github.com/MrCipherSmith/keryx.git"
+  },
+  keywords: [
+    "ai-agents",
+    "coding-agents",
+    "agent-harness",
+    "agent-context",
+    "repository-context",
+    "code-graph",
+    "project-memory",
+    "test-impact-analysis",
+    "developer-tools",
+    "model-context-protocol",
+    "mcp",
+    "claude-code",
+    "cursor",
+    "codex",
+    "cli",
+    "bun"
+  ],
+  bin: {
+    keryx: "./dist/cli.js"
+  },
+  scripts: {
+    keryx: "bun ./src/cli.ts",
+    build: "bun build ./src/cli.ts --outdir ./dist --target bun --external @modelcontextprotocol/sdk --external web-tree-sitter --external @opentui/core && bun build ./src/harness/process/sandbox/proxy-worker.ts --outdir ./dist --target bun --external @modelcontextprotocol/sdk --external web-tree-sitter --external @opentui/core",
+    prepare: "bun run build",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    check: "tsc --noEmit && bun test",
+    "check:doc-links": "bun scripts/check-doc-links.ts",
+    "test:guards": "bun test src/lib/config-dir.ast.test.ts src/lib/config-dir.readers.test.ts src/lib/production-graph.test.ts src/harness/policy/profiles.test.ts src/lib/serve-server.test.ts"
+  },
+  files: [
+    "dist",
+    "src/gdgraph",
+    "src/gdskills/bundled",
+    "src/gdskills/contracts",
+    "LICENSE",
+    "README.md",
+    "package.json"
+  ],
+  dependencies: {},
+  optionalDependencies: {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@opentui/core": "^0.4.5",
+    "web-tree-sitter": "^0.22.0"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    "bun-types": "latest",
+    typescript: "^5"
+  },
+  engines: {
+    bun: ">=1.1.0"
+  }
+};
 
 // src/commands/select.ts
 init_guard2();
@@ -44380,6 +44779,7 @@ Starting a new session.
     provider = makeActive();
   };
   for await (const line of io.lines) {
+    io.onSafeBoundary?.();
     if (line.startsWith("/")) {
       const parts = line.trim().split(/\s+/);
       const command = parts[0] ?? "";
@@ -44528,6 +44928,7 @@ Starting a new session.
     } else {
       history.pop();
     }
+    io.onSafeBoundary?.();
     io.write(`
 
 `);
@@ -44609,7 +45010,32 @@ function countRows(text, columns) {
   }
   return rows;
 }
-function createRichIo(lines) {
+function createVersionAdvisoryBoundary(versionCheck) {
+  let active = true;
+  let pending;
+  let shown = false;
+  versionCheck.then((result) => {
+    if (active)
+      pending = formatVersionUpdateAdvisory(result);
+  }, () => {});
+  return {
+    flush: (write) => {
+      if (!active || shown || pending === undefined)
+        return;
+      shown = true;
+      const advisory = pending;
+      pending = undefined;
+      write(`
+${advisory}
+`);
+    },
+    destroy: () => {
+      active = false;
+      pending = undefined;
+    }
+  };
+}
+function createRichIo(lines, versionCheck) {
   const stdout2 = process.stdout;
   const rich = colorEnabled() && Boolean(stdout2.isTTY);
   const out = (s) => {
@@ -44619,6 +45045,7 @@ function createRichIo(lines) {
   let frame = 0;
   let awaitingFirstToken = false;
   let raw = "";
+  const advisory = createVersionAdvisoryBoundary(versionCheck);
   const stopSpinner = () => {
     if (spinner !== undefined) {
       clearInterval(spinner);
@@ -44702,10 +45129,18 @@ ${GUTTER}${style.cyan("\u25C6")} ${style.bold(title)}  ${style.dim(subtitle)}
 
 `);
     }
+    advisory.flush(emitSystem);
     printPrompt();
   };
-  const io = { lines, write, onTurnStart, onTurnEnd, onSystem: emitSystem };
-  return { io, emitSystem, printHeader, printPrompt };
+  const io = {
+    lines,
+    write,
+    onTurnStart,
+    onTurnEnd,
+    onSystem: emitSystem,
+    onSafeBoundary: () => advisory.flush(emitSystem)
+  };
+  return { io, emitSystem, printHeader, printPrompt, destroy: advisory.destroy };
 }
 function turnSeparator() {
   return style.dim("\u2500".repeat(24));
@@ -44926,6 +45361,7 @@ New session ${shortSessionId(live.summary.id)}.
     if (line === undefined) {
       return;
     }
+    rich.safeBoundary?.();
     if (line.startsWith("/")) {
       const parts = line.trim().split(/\s+/);
       const command = parts[0] ?? "";
@@ -45022,6 +45458,7 @@ ${GUTTER}${usageLine}
 ${GUTTER}${turnSeparator()}
 
 `);
+    rich.safeBoundary?.();
     rich.printPrompt();
   }
 }
@@ -45100,13 +45537,17 @@ function chooseShellSurface(flags, isTty) {
   }
   return flags.modeFlag === false ? "tui-chat" : "tui-agent";
 }
-async function shellCommand(args2) {
+async function shellCommand(args2, runtime = {}) {
+  const versionCheck = (runtime.checkVersion ?? (() => checkVersion({
+    currentVersion: package_default.version,
+    ...runtime.cacheDir !== undefined ? { cacheDir: runtime.cacheDir } : {}
+  })))();
   const flags = parseShellCliFlags(args2);
   let providerArg = flags.providerArg;
   let modelArg = flags.modelArg;
   let baseUrl = flags.baseUrl;
   let modeFlag = flags.modeFlag;
-  const surface = chooseShellSurface(flags, process.stdout.isTTY === true);
+  const surface = chooseShellSurface(flags, runtime.isTty ?? process.stdout.isTTY === true);
   if (surface !== "readline") {
     const cwd = process.cwd();
     const tuiProviderFactory = realMakeProvider(() => {});
@@ -45151,7 +45592,7 @@ async function shellCommand(args2) {
           modelId: sel.model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID9()
+        idSeq: () => randomUUID10()
       };
     };
     const redetect = () => detectProviders({
@@ -45163,7 +45604,8 @@ async function shellCommand(args2) {
       providerArg,
       modelArg,
       baseUrl,
-      detect: redetect
+      detect: redetect,
+      ...runtime.cacheDir !== undefined ? { configDir: runtime.cacheDir } : {}
     });
     const tuiInitial = startup.initial;
     const tuiDetected = startup.detected;
@@ -45173,7 +45615,7 @@ async function shellCommand(args2) {
       if (flags.resumePick === true && chatResumeId === undefined) {
         chatResumeId = latestSession(cwd)?.id;
       }
-      if (await launchTuiChatShell({
+      if (await (runtime.launchChat ?? launchTuiChatShell)({
         detected: tuiDetected,
         redetect,
         ...tuiInitial !== undefined ? { initial: tuiInitial } : {},
@@ -45181,18 +45623,19 @@ async function shellCommand(args2) {
         makeShellDeps: (sel) => ({
           makeProvider: chatFactory,
           clock: () => new Date().toISOString(),
-          idSeq: () => randomUUID9(),
+          idSeq: () => randomUUID10(),
           initial: sel,
           session: {
             cwd,
             ...flags.continueLast === true ? { continueLast: true } : {},
             ...chatResumeId !== undefined ? { resumeId: chatResumeId } : {}
           }
-        })
+        }),
+        versionCheck
       })) {
         return;
       }
-    } else if (await launchTuiAgentShell({
+    } else if (await (runtime.launchAgent ?? launchTuiAgentShell)({
       detected: tuiDetected,
       makeAgentDeps,
       redetect,
@@ -45202,7 +45645,8 @@ async function shellCommand(args2) {
         ...flags.continueLast === true ? { continueLast: true } : {},
         ...flags.resumeId !== undefined ? { resumeId: flags.resumeId } : {},
         ...flags.resumePick === true ? { pickOnStart: true } : {}
-      }
+      },
+      versionCheck
     })) {
       return;
     }
@@ -45210,7 +45654,7 @@ async function shellCommand(args2) {
   const rl = readline2.createInterface({ input: process.stdin });
   const lineIterator = rl[Symbol.asyncIterator]();
   const sharedLines = { [Symbol.asyncIterator]: () => lineIterator };
-  const { io, emitSystem, printHeader, printPrompt } = createRichIo(sharedLines);
+  const { io, emitSystem, printHeader, printPrompt, destroy } = createRichIo(sharedLines, versionCheck);
   let provider;
   let model;
   try {
@@ -45249,7 +45693,7 @@ async function shellCommand(args2) {
     const deps = {
       makeProvider: baseFactory,
       clock: () => new Date().toISOString(),
-      idSeq: () => randomUUID9(),
+      idSeq: () => randomUUID10(),
       initial: baseUrl === undefined ? { provider, model } : { provider, model, baseUrl },
       selectProviderModel: realSelectProviderModel(baseUrl)
     };
@@ -45293,13 +45737,13 @@ async function shellCommand(args2) {
           modelId: model
         }),
         maxToolCalls: resolveAgentMaxToolCalls(),
-        idSeq: () => randomUUID9()
+        idSeq: () => randomUUID10()
       };
       let resumeId = flags.resumeId;
       if (flags.resumePick === true && resumeId === undefined) {
         resumeId = latestSession(process.cwd())?.id;
       }
-      await runAgentRepl(sharedLines, { printPrompt }, agentDeps, metaprojectPort, {
+      await runAgentRepl(sharedLines, { printPrompt, safeBoundary: io.onSafeBoundary }, agentDeps, metaprojectPort, {
         cwd: process.cwd(),
         ...flags.continueLast === true ? { continueLast: true } : {},
         ...resumeId !== undefined ? { resumeId } : {}
@@ -45319,6 +45763,7 @@ async function shellCommand(args2) {
       });
     }
   } finally {
+    destroy();
     rl.close();
   }
 }
@@ -45463,7 +45908,7 @@ Shell:
 init_fs();
 import { readFile as readFile63 } from "fs/promises";
 import { stdin } from "process";
-import path121 from "path";
+import path122 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -45502,8 +45947,8 @@ async function modulesCommand(args2 = []) {
     return;
   }
   const wantsJson = args2.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path121.join(process.cwd(), ".metaproject");
-  const manifestPath = path121.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path122.join(process.cwd(), ".metaproject");
+  const manifestPath = path122.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -45617,18 +46062,18 @@ function printHelp16() {
 }
 
 // src/commands/serve.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 
 // src/lib/serve-config.ts
 init_config_dir();
 import { existsSync as existsSync24 } from "fs";
-import path122 from "path";
+import path123 from "path";
 var SERVE_CONFIG_SCHEMA_VERSION = "1.0.0";
 var DEFAULT_SERVE_BIND_ADDRESS = "127.0.0.1";
 var DEFAULT_SERVE_PORT = 7377;
 var DEFAULT_SERVE_PROFILE = "remote-restricted";
 function serveConfigPath(dir) {
-  return path122.join(keryxConfigDir(dir), "serve.json");
+  return path123.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -45944,21 +46389,21 @@ function saveServeConfig(config, dir, onWarn) {
 
 // src/lib/serve-credential.ts
 init_config_dir();
-import { createHash as createHash19, randomBytes as randomBytes2, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash19, randomBytes as randomBytes2, randomUUID as randomUUID11 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
   existsSync as existsSync25,
   fsyncSync as fsyncSync2,
   openSync as openSync3,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   statSync as statSync5,
-  unlinkSync as unlinkSync2,
+  unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync8
 } from "fs";
-import path123 from "path";
+import path124 from "path";
 function serveCredentialPath(dir) {
-  return path123.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path124.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -46028,7 +46473,7 @@ function readServeCredential(dir) {
 }
 function writeStore(store, dir) {
   const file = serveCredentialPath(dir);
-  const temp = `${file}.${randomUUID10()}.tmp`;
+  const temp = `${file}.${randomUUID11()}.tmp`;
   try {
     ensureKeryxConfigDir(dir);
     const handle = openSync3(temp, "wx", 384);
@@ -46039,12 +46484,12 @@ function writeStore(store, dir) {
     } finally {
       closeSync3(handle);
     }
-    renameSync3(temp, file);
+    renameSync4(temp, file);
     tighten2(file, 384);
     return true;
   } catch {
     try {
-      unlinkSync2(temp);
+      unlinkSync3(temp);
     } catch {}
     return false;
   }
@@ -46068,7 +46513,7 @@ function mintRecord(now) {
   const salt = randomBytes2(32).toString("hex");
   return {
     token,
-    record: { id: randomUUID10(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
+    record: { id: randomUUID11(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
   };
 }
 function issueServeToken(dir, now = () => new Date().toISOString(), onWaiting) {
@@ -46189,22 +46634,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash20 } from "crypto";
 import { existsSync as existsSync26, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import path124 from "path";
+import path125 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path124.join(keryxConfigDir(dir), "turns");
+  return path125.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path124.join(turnsRoot(dir), turnId);
+  return path125.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest = createHash20("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path124.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path125.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest = createHash20("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path124.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path125.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -46268,7 +46713,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path124.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path125.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -46277,12 +46722,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path124.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path125.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error) {
     if (error?.code !== "ENOENT") {
       throw error;
     }
-    appendOwnerOnlyLine(path124.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path125.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -46290,7 +46735,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path124.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path125.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -46318,7 +46763,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path124.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path125.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -46337,7 +46782,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path124.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path125.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -46382,8 +46827,8 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 }
 
 // src/lib/serve-turn.ts
-import { randomUUID as randomUUID11 } from "crypto";
-import path125 from "path";
+import { randomUUID as randomUUID12 } from "crypto";
+import path126 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -46452,9 +46897,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path125.resolve(declared);
+  const wanted = path126.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path125.resolve(entry.path) === wanted) {
+    if (path126.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -46501,7 +46946,7 @@ async function redactOut(security, text) {
 async function runRemoteTurn(input2) {
   const scanRoot = input2.scanRoot;
   const security = createSecurityService(scanRoot);
-  const newId = input2.newId ?? (() => randomUUID11());
+  const newId = input2.newId ?? (() => randomUUID12());
   const clock = input2.clock ?? (() => new Date().toISOString());
   const turnId = input2.turnId ?? newId();
   const sessionId = input2.request.sessionId ?? newId();
@@ -46644,7 +47089,7 @@ function outcomeOf(status, gate, unresolvedBlockerIds) {
 }
 function createSubmitTurn(deps) {
   return async (request, project) => {
-    const turnId = (deps.newId ?? (() => randomUUID11()))();
+    const turnId = (deps.newId ?? (() => randomUUID12()))();
     const scanned = await scanPrompt(deps.dir, request.prompt);
     if (scanned.rejected) {
       return { kind: "rejected" };
@@ -47331,7 +47776,7 @@ function runConfig(args2) {
       return;
     }
     const credential = readServeCredential();
-    const credentialId = credential.status === "ok" ? credential.record.id : randomUUID12();
+    const credentialId = credential.status === "ok" ? credential.record.id : randomUUID13();
     const config = defaultServeConfig(credentialId, {
       address: parsed.parsed.values.get("--bind") ?? DEFAULT_SERVE_BIND_ADDRESS,
       port: port ?? DEFAULT_SERVE_PORT,
@@ -47489,7 +47934,7 @@ function printHelp17() {
 import { spawn as spawn5 } from "child_process";
 import { chmod as chmod4, mkdir as mkdir45, readFile as readFile64, readdir as readdir20, writeFile as writeFile42 } from "fs/promises";
 import { access as access3, constants, existsSync as existsSync27 } from "fs";
-import path126 from "path";
+import path127 from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 init_config();
 init_config2();
@@ -47504,8 +47949,8 @@ async function updateCommand(args2 = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path126.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path126.basename(projectRoot)}/`);
+  const metaprojectRoot = path127.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path127.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -47548,12 +47993,12 @@ async function updateCommand(args2 = []) {
   nextSteps(steps);
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path126.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path127.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile42(path126.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile42(path127.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -47588,11 +48033,11 @@ async function refreshServiceFiles(projectRoot, options) {
     enableTasks,
     enableSecurity
   });
-  await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path126.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path126.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
-  await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
-  await writeTextIfChanged4(path126.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
+  await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path127.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path127.join(metaprojectRoot, "rules", "README.md"), renderProjectRulesReadme());
+  await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path127.join(metaprojectRoot, "index.md"), renderIndexMarkdown({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -47605,7 +48050,7 @@ async function refreshServiceFiles(projectRoot, options) {
     ruleSources,
     hasDistilledEntrypoints: await hasDistilledEntrypoints(metaprojectRoot)
   }));
-  await writeTextIfChanged4(path126.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path127.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -47617,7 +48062,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path126.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path127.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -47630,24 +48075,24 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
@@ -47659,25 +48104,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path126.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path126.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path127.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path127.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -47690,24 +48135,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path126.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path126.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path127.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path127.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -47756,13 +48201,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path126.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path127.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path126.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path127.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -47782,7 +48227,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path126.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path127.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -47802,11 +48247,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path126.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path127.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path126.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path127.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -47821,7 +48266,7 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot2 = path126.join(metaprojectRoot, "flows");
+  const flowsRoot2 = path127.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot2)) {
     return null;
   }
@@ -47833,7 +48278,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path126.join(flowsRoot2, dir, "flow.json");
+    const flowPath = path127.join(flowsRoot2, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -47841,7 +48286,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile64(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath2 = path126.join(flowsRoot2, dir, "acceptance-criteria.md");
+      const acPath2 = path127.join(flowsRoot2, dir, "acceptance-criteria.md");
       if (await pathExists(acPath2)) {
         const acContent = await readFile64(acPath2, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -47894,7 +48339,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path126.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path127.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -47911,7 +48356,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath2 = path126.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath2 = path127.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath2)) {
     return;
   }
@@ -48020,8 +48465,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path126.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path126.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path127.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path127.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -48072,8 +48517,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath2 = path126.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path126.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath2 = path127.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path127.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath2)) {
     const report = JSON.parse(await readFile64(reportPath2, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -48102,7 +48547,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path126.relative(root, filePath).split(path126.sep).join("/");
+    const relativePath = path127.relative(root, filePath).split(path127.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -48123,7 +48568,7 @@ async function listMarkdownFiles(root) {
   const entries = await readdir20(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path126.join(root, entry.name);
+    const fullPath = path127.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -48171,7 +48616,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path126.basename(path126.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path127.basename(path127.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys2),
     paths: {
@@ -48254,11 +48699,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile42(path126.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile42(path127.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path126.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path127.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -48281,7 +48726,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path126.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path127.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -48317,69 +48762,69 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path126.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path126.join(projectRuntime, ".git"))) {
+  const projectRuntime = path127.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path127.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path126.join(home, ".keryx", "keryx");
-  if (await pathExists(path126.join(globalRuntime, ".git"))) {
+  const globalRuntime = path127.join(home, ".keryx", "keryx");
+  if (await pathExists(path127.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path126.join(metaprojectRoot, "core"),
-    path126.join(metaprojectRoot, "hooks", "post-update.d"),
-    path126.join(metaprojectRoot, "modules"),
-    path126.join(metaprojectRoot, "rules"),
-    path126.join(metaprojectRoot, "skills", "project-rules"),
+    path127.join(metaprojectRoot, "core"),
+    path127.join(metaprojectRoot, "hooks", "post-update.d"),
+    path127.join(metaprojectRoot, "modules"),
+    path127.join(metaprojectRoot, "rules"),
+    path127.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path126.join(metaprojectRoot, "core", "gdgraph"),
-      path126.join(metaprojectRoot, "skills", "gdgraph")
+      path127.join(metaprojectRoot, "core", "gdgraph"),
+      path127.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path126.join(metaprojectRoot, "core", "gdctx"),
-      path126.join(metaprojectRoot, "skills", "gdctx")
+      path127.join(metaprojectRoot, "core", "gdctx"),
+      path127.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path126.join(metaprojectRoot, "skills", "gdwiki"),
-      path126.join(metaprojectRoot, "wiki", "templates")
+      path127.join(metaprojectRoot, "skills", "gdwiki"),
+      path127.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path126.join(metaprojectRoot, "core", "health"),
-      path126.join(metaprojectRoot, "skills", "health")
+      path127.join(metaprojectRoot, "core", "health"),
+      path127.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path126.join(metaprojectRoot, "core", "testing"),
-      path126.join(metaprojectRoot, "skills", "testing")
+      path127.join(metaprojectRoot, "core", "testing"),
+      path127.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path126.join(metaprojectRoot, "core", "memory"),
-      path126.join(metaprojectRoot, "skills", "memory"),
-      path126.join(metaprojectRoot, "memory", "templates")
+      path127.join(metaprojectRoot, "core", "memory"),
+      path127.join(metaprojectRoot, "skills", "memory"),
+      path127.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path126.join(metaprojectRoot, "flows"),
-      path126.join(metaprojectRoot, "skills", "flow")
+      path127.join(metaprojectRoot, "flows"),
+      path127.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path126.join(metaprojectRoot, "core", "security")
+      path127.join(metaprojectRoot, "core", "security")
     ] : []
   ];
   await Promise.all(dirs.map((dir) => mkdir45(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path126.join(metaprojectRoot, "core", "gdgraph");
+  const gdgraphCoreRoot = path127.join(metaprojectRoot, "core", "gdgraph");
   await mkdir45(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path126.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path127.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path126.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path127.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
@@ -48387,7 +48832,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
     return;
   }
   await mkdir45(hooksRoot, { recursive: true });
-  const hookPath = path126.join(hooksRoot, hookName);
+  const hookPath = path127.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -48408,7 +48853,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path126.join(hooksRoot, hookName);
+  const hookPath = path127.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -48430,7 +48875,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path126.join(hooksRoot, "pre-push");
+  const hookPath = path127.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -48445,7 +48890,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile64(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path126.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path127.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -48513,7 +48958,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path126.join(root, candidate))) {
+    if (await pathExists(path127.join(root, candidate))) {
       return true;
     }
   }
@@ -48534,13 +48979,13 @@ function parseUpdateArgs(args2) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path126.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path127.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
   const entries = (await readdir20(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path126.join(hooksDir, entry);
+    const hookPath = path127.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -48581,14 +49026,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile64(filePath, "utf8") === content) {
     return;
   }
-  await mkdir45(path126.dirname(filePath), { recursive: true });
+  await mkdir45(path127.dirname(filePath), { recursive: true });
   await writeFile42(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir45(path126.dirname(filePath), { recursive: true });
+  await mkdir45(path127.dirname(filePath), { recursive: true });
   await writeFile42(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -48596,7 +49041,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile64(to, "utf8") === next) {
     return;
   }
-  await mkdir45(path126.dirname(to), { recursive: true });
+  await mkdir45(path127.dirname(to), { recursive: true });
   await writeFile42(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -48605,7 +49050,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path126.join(path126.dirname(fileURLToPath6(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path127.join(path127.dirname(fileURLToPath6(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync27(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -48637,7 +49082,7 @@ function printHelp18() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn6 } from "child_process";
-import path127 from "path";
+import path128 from "path";
 init_args();
 async function dashboardCommand(args2 = []) {
   const options = parseOptions(args2);
@@ -48648,7 +49093,7 @@ async function dashboardCommand(args2 = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path127.relative(process.cwd(), result.path);
+    const rel = path128.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -48656,7 +49101,7 @@ async function dashboardCommand(args2 = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path127.relative(process.cwd(), result.path);
+    const rel = path128.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -48705,7 +49150,7 @@ import { readFileSync as readFileSync10 } from "fs";
 // src/agents/bootstrap.ts
 import { mkdir as mkdir46, readFile as readFile65, writeFile as writeFile43 } from "fs/promises";
 import { homedir as homedir6 } from "os";
-import path128 from "path";
+import path129 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -48715,35 +49160,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path128.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path129.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path128.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path129.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path128.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path129.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path128.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path129.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path128.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path129.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -48791,7 +49236,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir46(path128.dirname(filePath), { recursive: true });
+    await mkdir46(path129.dirname(filePath), { recursive: true });
     await writeFile43(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists2, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -49139,7 +49584,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile66 } from "fs/promises";
-import path129 from "path";
+import path130 from "path";
 
 // src/metrics/benchmark.ts
 function createPairedBenchmarkTemplate(taskIds) {
@@ -49367,7 +49812,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path129.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path130.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest2 = await readLatestPointer(root);
     console.log(`latest: ${latest2.status}`);
     return;
@@ -49379,7 +49824,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record2 = JSON.parse(await readFile66(path129.resolve(projectRoot, file), "utf8"));
+    const record2 = JSON.parse(await readFile66(path130.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record2);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error of result.errors)
@@ -49404,7 +49849,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path129.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path130.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -49421,8 +49866,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile66(path129.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile66(path129.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile66(path130.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile66(path130.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -49456,8 +49901,8 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path129.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path129.relative(projectRoot, path129.resolve(projectRoot, out))}`);
+    await Bun.write(path130.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path130.relative(projectRoot, path130.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args2[1] === "validate") {
@@ -49467,7 +49912,7 @@ async function metricsCommand(args2 = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile66(path129.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile66(path130.resolve(projectRoot, file), "utf8"));
     const input2 = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input2);
     console.log(stableJson(result));
@@ -49485,7 +49930,7 @@ async function collect(projectRoot, args2) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile66(path129.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile66(path130.resolve(projectRoot, eventFile), "utf8"));
   const events2 = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args2, "--started-at") ?? events2[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args2, "--finished-at") ?? events2.at(-1)?.timestamp_utc ?? startedAt;
@@ -49501,11 +49946,11 @@ async function collect(projectRoot, args2) {
     parentRunId: optionValue(args2, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record2, { cwd: projectRoot });
-  console.log(`json: ${path129.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path129.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path130.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path130.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path129.join(projectRoot, ".metaproject", "data", "metrics");
+  return path130.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -49523,76 +49968,35 @@ Usage:
   keryx metrics benchmark validate <manifest.json>
 `);
 }
-// package.json
-var package_default = {
-  name: "@mrciphersmith/keryx",
-  version: "0.2.17",
-  description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
-  private: false,
-  publishConfig: {
-    access: "public"
-  },
-  license: "MIT",
-  type: "module",
-  repository: {
-    type: "git",
-    url: "git+ssh://git@github.com/MrCipherSmith/keryx.git"
-  },
-  keywords: [
-    "ai-agents",
-    "coding-agents",
-    "agent-harness",
-    "agent-context",
-    "repository-context",
-    "code-graph",
-    "project-memory",
-    "test-impact-analysis",
-    "developer-tools",
-    "model-context-protocol",
-    "mcp",
-    "claude-code",
-    "cursor",
-    "codex",
-    "cli",
-    "bun"
-  ],
-  bin: {
-    keryx: "./dist/cli.js"
-  },
-  scripts: {
-    keryx: "bun ./src/cli.ts",
-    build: "bun build ./src/cli.ts --outdir ./dist --target bun --external @modelcontextprotocol/sdk --external web-tree-sitter --external @opentui/core && bun build ./src/harness/process/sandbox/proxy-worker.ts --outdir ./dist --target bun --external @modelcontextprotocol/sdk --external web-tree-sitter --external @opentui/core",
-    prepare: "bun run build",
-    typecheck: "tsc --noEmit",
-    test: "bun test",
-    check: "tsc --noEmit && bun test",
-    "check:doc-links": "bun scripts/check-doc-links.ts",
-    "test:guards": "bun test src/lib/config-dir.ast.test.ts src/lib/config-dir.readers.test.ts src/lib/production-graph.test.ts src/harness/policy/profiles.test.ts src/lib/serve-server.test.ts"
-  },
-  files: [
-    "dist",
-    "src/gdgraph",
-    "src/gdskills/bundled",
-    "src/gdskills/contracts",
-    "LICENSE",
-    "README.md",
-    "package.json"
-  ],
-  dependencies: {},
-  optionalDependencies: {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "@opentui/core": "^0.4.5",
-    "web-tree-sitter": "^0.22.0"
-  },
-  devDependencies: {
-    "@types/bun": "latest",
-    "bun-types": "latest",
-    typescript: "^5"
-  },
-  engines: {
-    bun: ">=1.1.0"
+
+// src/commands/version.ts
+async function versionCommand(args2, deps = {}) {
+  const json = args2.length === 2 && args2[1] === "--json";
+  if (args2[0] !== "check" || args2.length !== 1 && !json) {
+    console.error("Usage: keryx version check [--json]");
+    process.exitCode = 1;
+    return;
   }
-};
+  const options = {
+    currentVersion: deps.currentVersion ?? package_default.version,
+    ...deps.fetch !== undefined ? { fetch: deps.fetch } : {},
+    ...deps.cacheDir !== undefined ? { cacheDir: deps.cacheDir } : {},
+    ...deps.now !== undefined ? { now: deps.now } : {}
+  };
+  const result = await (deps.check ?? checkVersion)(options);
+  if (json) {
+    console.log(JSON.stringify(result));
+    return;
+  }
+  if (result.status === "update-available") {
+    console.log(`Keryx ${result.currentVersion} \u2192 ${result.latestVersion}`);
+    console.log(result.installCommand);
+  } else if (result.status === "up-to-date") {
+    console.log(`Keryx ${result.currentVersion} is up to date.`);
+  } else {
+    console.log(`Keryx version check unavailable (${result.reason}).`);
+  }
+}
 
 // src/cli.ts
 var VERSION2 = package_default.version;
@@ -49627,7 +50031,8 @@ var CLI_ROUTES = {
   harness: harnessCommand,
   shell: shellCommand,
   sessions: sessionsCommand,
-  session: sessionsCommand
+  session: sessionsCommand,
+  version: versionCommand
 };
 async function main() {
   const args2 = process.argv.slice(2);
@@ -49658,6 +50063,7 @@ Usage:
                                                Start TUI agent shell (sessions are per-project)
   keryx sessions list|fork <id>|export <id>|path
                                                List / branch / export sessions for the current project
+  keryx version check [--json]                 Check npm latest (advisory; never installs)
   keryx harness run --provider <fake|anthropic|ollama> --model <m> [--base-url <url>] [--record <path>] "<prompt>"
   keryx harness exec [--allow-env KEY]... [--max-runtime-ms N] [--allow-real-subprocess]
                      [--allowed-domains a,b] [--mask-env NAME@host] [--tls-terminate] [--mask-mode auto|manual|off] [--auto-mask] -- <path> [args...]
@@ -49741,6 +50147,7 @@ Commands:
   shell     Start the interactive TUI agent harness. Use --no-tui or --chat to opt out.
             Sessions: -c continue last in this project, -r [id] resume (per-project).
   sessions  List or export per-project shell sessions
+  version   Check whether a newer npm release is available
   harness   Run a single provider turn (harness run) and print structured events
   init      Initialize .metaproject in the current project
   status    Show local Metaproject status