@mrciphersmith/keryx 0.2.49 → 0.2.51

package/dist/cli.js

@@ -186,14 +186,14 @@ var init_config_dir = __esm(() => {
 // src/lib/fs.ts
 var exports_fs = {};
 __export(exports_fs, {
-  writeFileAtomic: () => writeFileAtomic,
-  withFileLock: () => withFileLock2,
-  toPosix: () => toPosix,
-  pathExists: () => pathExists,
-  isPathInside: () => isPathInside,
-  isNotFound: () => isNotFound,
+  DEFAULT_LOCK_STALE_MS: () => DEFAULT_LOCK_STALE_MS,
   isLockHeld: () => isLockHeld,
-  DEFAULT_LOCK_STALE_MS: () => DEFAULT_LOCK_STALE_MS
+  isNotFound: () => isNotFound,
+  isPathInside: () => isPathInside,
+  pathExists: () => pathExists,
+  toPosix: () => toPosix,
+  withFileLock: () => withFileLock2,
+  writeFileAtomic: () => writeFileAtomic
 });
 import { randomUUID as randomUUID4 } from "crypto";
 import { access, mkdir, readFile, rename, rm, stat, utimes, writeFile } from "fs/promises";
@@ -5372,13 +5372,13 @@ var init_service2 = __esm(() => {
 // src/lib/shell-config.ts
 var exports_shell_config = {};
 __export(exports_shell_config, {
-  shellConfigPath: () => shellConfigPath,
-  saveShellConfig: () => saveShellConfig,
-  saveProviderBaseUrl: () => saveProviderBaseUrl,
-  saveApiKey: () => saveApiKey,
-  loadShellConfig: () => loadShellConfig,
+  applySavedApiKeys: () => applySavedApiKeys,
   envWithSavedApiKeys: () => envWithSavedApiKeys,
-  applySavedApiKeys: () => applySavedApiKeys
+  loadShellConfig: () => loadShellConfig,
+  saveApiKey: () => saveApiKey,
+  saveProviderBaseUrl: () => saveProviderBaseUrl,
+  saveShellConfig: () => saveShellConfig,
+  shellConfigPath: () => shellConfigPath
 });
 import { existsSync as existsSync7 } from "fs";
 import path35 from "path";
@@ -5987,6 +5987,40 @@ function createTreesitterSpec(cwd, config) {
     load: (ctx) => new TreesitterAdapter(cwd, config, ctx.dep)
   };
 }
+async function loadTreesitterDepLiteral() {
+  try {
+    return await import("web-tree-sitter");
+  } catch {
+    return;
+  }
+}
+async function resolveTreesitterCapability(cwd, config, resolve = resolveCapability) {
+  const spec = createTreesitterSpec(cwd, config);
+  try {
+    if (!await isCapabilityEnabled(cwd, spec.id)) {
+      return null;
+    }
+    const literalDep = await loadTreesitterDepLiteral();
+    if (literalDep === undefined) {
+      return await resolve(cwd, spec);
+    }
+    const adapter = spec.load({ dep: literalDep, asset: null });
+    let available;
+    try {
+      available = await adapter.isAvailable();
+    } catch {
+      warnCapabilityDegraded(spec.id, "adapter availability check threw");
+      return null;
+    }
+    if (!available) {
+      warnCapabilityDegraded(spec.id, "adapter reported unavailable");
+      return null;
+    }
+    return adapter;
+  } catch {
+    return null;
+  }
+}
 
 class TreesitterAdapter {
   cwd;
@@ -6102,6 +6136,8 @@ function compareCalls2(a, b) {
   return a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : 0;
 }
 var init_adapter = __esm(() => {
+  init_seam();
+  init_warn_once();
   init_extract();
   init_grammars();
 });
@@ -6113,13 +6149,13 @@ __export(exports_enrich, {
 });
 import { mkdir as mkdir18, writeFile as writeFile20 } from "fs/promises";
 import path48 from "path";
-async function enrichBuildWithSymbols(cwd, files, resolve = resolveCapability) {
+async function enrichBuildWithSymbols(cwd, files, resolve) {
   const config = await loadGdgraphConfig(cwd);
-  const spec = createTreesitterSpec(cwd, {
+  const treesitterConfig = {
     languages: config.treesitter.languages,
     grammarsPath: config.treesitter.grammarsPath
-  });
-  const adapter = await resolve(cwd, spec);
+  };
+  const adapter = resolve ? await resolve(cwd, createTreesitterSpec(cwd, treesitterConfig)) : await resolveTreesitterCapability(cwd, treesitterConfig);
   if (!adapter) {
     return { enriched: false, symbols: 0, calls: 0 };
   }
@@ -6746,10 +6782,10 @@ var init_target = () => {};
 // src/gdgraph/query.ts
 var exports_query = {};
 __export(exports_query, {
-  loadGraph: () => loadGraph,
-  getOrphans: () => getOrphans,
+  getAffected: () => getAffected,
   getCycles: () => getCycles,
-  getAffected: () => getAffected
+  getOrphans: () => getOrphans,
+  loadGraph: () => loadGraph
 });
 import { readFile as readFile24 } from "fs/promises";
 import path51 from "path";
@@ -7388,12 +7424,12 @@ var init_repomap = __esm(() => {
 // src/sync/provenance.ts
 var exports_provenance = {};
 __export(exports_provenance, {
-  recordProvenance: () => recordProvenance,
-  readProvenance: () => readProvenance,
-  provenancePath: () => provenancePath,
-  gitHead: () => gitHead,
+  SYNCED_MODULES: () => SYNCED_MODULES,
   gitCmd: () => gitCmd,
-  SYNCED_MODULES: () => SYNCED_MODULES
+  gitHead: () => gitHead,
+  provenancePath: () => provenancePath,
+  readProvenance: () => readProvenance,
+  recordProvenance: () => recordProvenance
 });
 import { mkdir as mkdir21, readFile as readFile25, writeFile as writeFile23 } from "fs/promises";
 import path54 from "path";
@@ -7455,11 +7491,11 @@ var init_provenance = __esm(() => {
 // src/ctx/orient.ts
 var exports_orient = {};
 __export(exports_orient, {
-  wikiContext: () => wikiContext,
-  uncommittedCodeCount: () => uncommittedCodeCount,
-  metaprojectIndexContext: () => metaprojectIndexContext,
+  buildOrientation: () => buildOrientation,
   graphContext: () => graphContext,
-  buildOrientation: () => buildOrientation
+  metaprojectIndexContext: () => metaprojectIndexContext,
+  uncommittedCodeCount: () => uncommittedCodeCount,
+  wikiContext: () => wikiContext
 });
 import path55 from "path";
 import { spawn as spawn2 } from "child_process";
@@ -7666,9 +7702,9 @@ var init_orient = __esm(() => {
 // src/gdgraph/symbols-capability.ts
 var exports_symbols_capability = {};
 __export(exports_symbols_capability, {
-  setTreesitterEnabled: () => setTreesitterEnabled,
+  TREESITTER_CAPABILITY: () => TREESITTER_CAPABILITY,
   isTreesitterEnabled: () => isTreesitterEnabled,
-  TREESITTER_CAPABILITY: () => TREESITTER_CAPABILITY
+  setTreesitterEnabled: () => setTreesitterEnabled
 });
 function treesitterEntry(enabled) {
   return {
@@ -8081,9 +8117,9 @@ function titleSimilarity(a, b) {
 // src/wiki/collect.ts
 var exports_collect = {};
 __export(exports_collect, {
-  keyFilesForPage: () => keyFilesForPage,
+  collectPages: () => collectPages,
   computeModuleKeyFiles: () => computeModuleKeyFiles,
-  collectPages: () => collectPages
+  keyFilesForPage: () => keyFilesForPage
 });
 import { readFile as readFile29, readdir as readdir6 } from "fs/promises";
 import path58 from "path";
@@ -8581,18 +8617,18 @@ var init_backlinks = __esm(() => {
 // src/wiki/service.ts
 var exports_service = {};
 __export(exports_service, {
-  wikiValidate: () => wikiValidate,
-  wikiStatus: () => wikiStatus,
-  wikiPruneOrphans: () => wikiPruneOrphans,
-  wikiPagesForFile: () => wikiPagesForFile,
-  wikiGenerateIndex: () => wikiGenerateIndex,
-  wikiCreatePage: () => wikiCreatePage,
-  wikiCollect: () => wikiCollect,
-  wikiCheckLinks: () => wikiCheckLinks,
-  validModuleNames: () => validModuleNames,
-  moduleNameFromProjectPath: () => moduleNameFromProjectPath,
+  createGdWikiService: () => createGdWikiService,
   extractModuleApi: () => extractModuleApi,
-  createGdWikiService: () => createGdWikiService
+  moduleNameFromProjectPath: () => moduleNameFromProjectPath,
+  validModuleNames: () => validModuleNames,
+  wikiCheckLinks: () => wikiCheckLinks,
+  wikiCollect: () => wikiCollect,
+  wikiCreatePage: () => wikiCreatePage,
+  wikiGenerateIndex: () => wikiGenerateIndex,
+  wikiPagesForFile: () => wikiPagesForFile,
+  wikiPruneOrphans: () => wikiPruneOrphans,
+  wikiStatus: () => wikiStatus,
+  wikiValidate: () => wikiValidate
 });
 import { spawn as spawn3 } from "child_process";
 import { mkdir as mkdir23, readFile as readFile30, readdir as readdir7, rm as rm3, writeFile as writeFile25 } from "fs/promises";
@@ -11454,9 +11490,396 @@ var init_anthropic_provider = __esm(() => {
   };
 });
 
+// src/harness/provider/compat/openai-compat-provider.ts
+function isPlainObject4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asRecord3(value) {
+  return isPlainObject4(value) ? value : {};
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function asString3(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function asNumber3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function retryableFor2(kind, fallback) {
+  const concrete = defaultRetryable(kind);
+  return concrete === undefined ? fallback : concrete;
+}
+function mergeUsage2(promptTokens, completionTokens, totalTokens) {
+  const usage = { exact: true };
+  if (promptTokens !== undefined) {
+    usage.inputTokens = promptTokens;
+  }
+  if (completionTokens !== undefined) {
+    usage.outputTokens = completionTokens;
+  }
+  if (totalTokens !== undefined) {
+    usage.totalTokens = totalTokens;
+  } else if (promptTokens !== undefined || completionTokens !== undefined) {
+    usage.totalTokens = (promptTokens ?? 0) + (completionTokens ?? 0);
+  }
+  return usage;
+}
+function classifyHttpError2(status) {
+  if (status >= 500) {
+    return { kind: "unavailable", retryable: retryableFor2("unavailable", true), message: "" };
+  }
+  return { kind: "invalid_request", retryable: retryableFor2("invalid_request", false), message: "" };
+}
+
+class OpenAiCompatEngine {
+  deps;
+  identity;
+  constructor(deps, identity) {
+    this.deps = deps;
+    this.identity = identity;
+  }
+  get label() {
+    return this.identity.providerLabel ?? this.identity.providerId;
+  }
+  describe() {
+    const capabilities = {
+      streaming: true,
+      toolCalls: true,
+      parallelToolCalls: true,
+      structuredOutput: false,
+      reasoningMetadata: false,
+      promptCaching: false,
+      vision: false,
+      tokenCounting: false,
+      modelListing: false
+    };
+    return {
+      capabilities,
+      descriptor: { providerId: this.identity.providerId, providerRevision: this.identity.providerRevision }
+    };
+  }
+  descriptorDocument() {
+    return {
+      schemaVersion: 1,
+      providerId: this.identity.providerId,
+      providerRevision: this.identity.providerRevision,
+      models: [{ modelId: this.identity.defaultModel.modelId, revision: this.identity.defaultModel.revision }],
+      capabilities: {
+        streaming: true,
+        tools: true,
+        parallelToolCalls: true,
+        cancellation: true,
+        structuredOutput: false
+      },
+      remoteState: { storage: false, retention: false, continuation: false }
+    };
+  }
+  async* stream(request, opts) {
+    let sequence = 0;
+    const stamp = (body) => ({ ...body, sequence: sequence++, attemptId: opts.attemptId });
+    const errorEvent = (error) => stamp({ kind: "provider_error", error });
+    const grant = this.deps.grant;
+    if (grant === undefined || grant.network !== true) {
+      yield errorEvent({
+        kind: "invalid_request",
+        retryable: retryableFor2("invalid_request", false),
+        message: `a network capability grant is required to reach the ${this.label} API`
+      });
+      return;
+    }
+    const baseUrl = grant.baseUrl ?? this.identity.defaultBaseUrl;
+    let host;
+    try {
+      host = new URL(baseUrl).hostname;
+    } catch {
+      host = baseUrl;
+    }
+    const permitted = !isPrivateEgressHost(host) || grant.allowLoopback === true && isLoopbackHost(host);
+    if (!permitted) {
+      yield errorEvent({
+        kind: "invalid_request",
+        retryable: retryableFor2("invalid_request", false),
+        message: `egress to a private/loopback/link-local/metadata host is denied: ${host}`
+      });
+      return;
+    }
+    const url = `${baseUrl.replace(/\/+$/, "")}${grant.chatPath ?? "/v1/chat/completions"}`;
+    const messages = [];
+    if (request.systemInstruction.length > 0) {
+      messages.push({ role: "system", content: request.systemInstruction });
+    }
+    for (const linked of linkToolCalls(request.messages)) {
+      const message = linked.message;
+      if (message.role === "tool") {
+        if (linked.linkedToolCallId !== undefined) {
+          messages.push({ role: "tool", tool_call_id: linked.linkedToolCallId, content: message.content });
+          continue;
+        }
+        messages.push({ role: "user", content: `Tool result:
+${message.content}` });
+        continue;
+      }
+      if (message.role === "assistant" && message.content.length === 0 && linked.linkedCalls.length === 0) {
+        continue;
+      }
+      if (message.role === "assistant" && linked.linkedCalls.length > 0) {
+        messages.push({
+          role: "assistant",
+          content: message.content,
+          tool_calls: linked.linkedCalls.map((call) => ({
+            id: call.id,
+            type: "function",
+            function: { name: call.name, arguments: call.arguments }
+          }))
+        });
+        continue;
+      }
+      messages.push({ role: message.role, content: message.content });
+    }
+    const payload = {
+      model: request.modelId,
+      stream: true,
+      messages,
+      ...request.tools !== undefined ? {
+        tools: request.tools.map((tool) => ({
+          type: "function",
+          function: {
+            name: tool.name,
+            ...tool.description !== undefined ? { description: tool.description } : {},
+            parameters: tool.inputSchema
+          }
+        }))
+      } : {}
+    };
+    const headers = { "content-type": "application/json" };
+    if (grant.apiKey !== undefined && grant.apiKey.length > 0) {
+      headers.authorization = `Bearer ${grant.apiKey}`;
+    }
+    if (grant.headers !== undefined) {
+      Object.assign(headers, grant.headers);
+    }
+    const init = {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload),
+      ...opts.signal !== undefined ? { signal: opts.signal } : {}
+    };
+    let response;
+    try {
+      response = await this.deps.fetch(url, init);
+    } catch (cause) {
+      if (opts.signal?.aborted === true) {
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+        return;
+      }
+      yield errorEvent({
+        kind: "unavailable",
+        retryable: retryableFor2("unavailable", true),
+        message: `network request to the ${this.label} API failed: ${String(cause)}`
+      });
+      return;
+    }
+    if (!response.ok) {
+      const error = classifyHttpError2(response.status);
+      let providerMessage = `${this.label} API returned HTTP ${response.status}`;
+      try {
+        const parsed = asRecord3(JSON.parse(await response.text()));
+        const detail = asString3(asRecord3(parsed.error).message);
+        if (detail !== undefined && detail.length > 0) {
+          providerMessage = detail;
+        }
+      } catch {}
+      error.message = providerMessage;
+      yield stamp({ kind: "provider_error", error });
+      return;
+    }
+    let bodyText;
+    try {
+      bodyText = await response.text();
+    } catch (cause) {
+      const aborted = opts.signal?.aborted === true || typeof cause === "object" && cause !== null && cause.name === "AbortError";
+      if (aborted) {
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+        return;
+      }
+      yield errorEvent({
+        kind: "malformed",
+        retryable: retryableFor2("malformed", false),
+        message: `${this.label} SSE body read failed: ${String(cause)}`
+      });
+      return;
+    }
+    if (bodyText.length === 0) {
+      yield errorEvent({
+        kind: "malformed",
+        retryable: retryableFor2("malformed", false),
+        message: "empty response body"
+      });
+      return;
+    }
+    const parser = new AnthropicSSEParser;
+    const records = parser.push(bodyText);
+    const torn = parser.flush();
+    const bodies = [];
+    let sawStart = false;
+    let sawFinish = false;
+    let sawDone = false;
+    let malformed;
+    const pendingTools = new Map;
+    const toolCallKey = (toolCall) => {
+      const index = asNumber3(toolCall.index);
+      if (index !== undefined) {
+        return `idx:${index}`;
+      }
+      const id = asString3(toolCall.id);
+      if (id !== undefined && id.length > 0) {
+        return `id:${id}`;
+      }
+      return "idx:0";
+    };
+    const flushPendingToolEnds = () => {
+      for (const acc of pendingTools.values()) {
+        if (acc.ended) {
+          continue;
+        }
+        if (!acc.started) {
+          const startBody = { kind: "tool_call_start", toolCallId: acc.id };
+          if (acc.name.length > 0) {
+            startBody.toolName = acc.name;
+          }
+          bodies.push(startBody);
+          acc.started = true;
+        }
+        bodies.push({ kind: "tool_call_end", toolCallId: acc.id, input: acc.arguments });
+        acc.ended = true;
+      }
+      pendingTools.clear();
+    };
+    for (const record of records) {
+      const trimmed = record.data.trim();
+      if (trimmed === "[DONE]") {
+        sawDone = true;
+        flushPendingToolEnds();
+        continue;
+      }
+      if (!sawStart) {
+        sawStart = true;
+        bodies.push({ kind: "model_start" });
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(record.data);
+      } catch {
+        malformed = {
+          kind: "malformed",
+          retryable: retryableFor2("malformed", false),
+          message: `${this.label} SSE data line was not valid JSON`
+        };
+        break;
+      }
+      const data = asRecord3(parsed);
+      if (data.usage !== undefined) {
+        const usage = asRecord3(data.usage);
+        bodies.push({
+          kind: "usage_update",
+          usage: mergeUsage2(asNumber3(usage.prompt_tokens), asNumber3(usage.completion_tokens), asNumber3(usage.total_tokens))
+        });
+      }
+      const choice0 = asRecord3(asArray(data.choices)[0]);
+      const delta = asRecord3(choice0.delta);
+      const reasoning = asString3(delta.reasoning) ?? asString3(delta.reasoning_content);
+      if (reasoning !== undefined && reasoning.length > 0) {
+        bodies.push({ kind: "reasoning_delta", text: reasoning });
+      }
+      const content = asString3(delta.content);
+      if (content !== undefined && content.length > 0) {
+        bodies.push({ kind: "text_delta", text: content });
+      }
+      for (const rawToolCall of asArray(delta.tool_calls)) {
+        const toolCall = asRecord3(rawToolCall);
+        const fn = asRecord3(toolCall.function);
+        const toolCallId = asString3(toolCall.id);
+        const toolName = asString3(fn.name);
+        const argumentsFragment = asString3(fn.arguments) ?? "";
+        const key = toolCallKey(toolCall);
+        let acc = pendingTools.get(key);
+        if (acc === undefined) {
+          acc = {
+            id: toolCallId ?? `call_${key.replace(/[^a-zA-Z0-9_:-]/g, "_")}`,
+            name: toolName ?? "",
+            arguments: "",
+            started: false,
+            ended: false
+          };
+          pendingTools.set(key, acc);
+        }
+        if (toolCallId !== undefined && toolCallId.length > 0) {
+          acc.id = toolCallId;
+        }
+        if (toolName !== undefined && toolName.length > 0) {
+          acc.name = toolName;
+        }
+        if (!acc.started) {
+          const startBody = { kind: "tool_call_start", toolCallId: acc.id };
+          if (acc.name.length > 0) {
+            startBody.toolName = acc.name;
+          }
+          bodies.push(startBody);
+          acc.started = true;
+        }
+        if (argumentsFragment.length > 0) {
+          acc.arguments += argumentsFragment;
+          bodies.push({
+            kind: "tool_call_delta",
+            toolCallId: acc.id,
+            inputDelta: argumentsFragment
+          });
+        }
+      }
+      const finishReason = asString3(choice0.finish_reason);
+      if (finishReason !== undefined && finishReason.length > 0) {
+        sawFinish = true;
+        flushPendingToolEnds();
+      }
+    }
+    if (malformed === undefined && torn.length > 0) {
+      malformed = {
+        kind: "malformed",
+        retryable: retryableFor2("malformed", false),
+        message: `${this.label} SSE stream ended mid-record (torn stream)`
+      };
+    }
+    if (malformed === undefined) {
+      flushPendingToolEnds();
+    }
+    if (malformed === undefined && sawStart && (sawDone || sawFinish)) {
+      bodies.push({ kind: "model_end" });
+    }
+    for (const body of bodies) {
+      if (opts.signal?.aborted === true) {
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+        return;
+      }
+      yield stamp(body);
+    }
+    if (opts.signal?.aborted === true) {
+      yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+      return;
+    }
+    if (malformed !== undefined) {
+      yield stamp({ kind: "provider_error", error: malformed });
+    }
+  }
+}
+var init_openai_compat_provider = __esm(() => {
+  init_guard2();
+  init_provider_port();
+});
+
 // src/harness/provider/fake-provider.ts
 import { createHash as createHash5 } from "crypto";
-function isPlainObject4(value) {
+function isPlainObject5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function canonicalize(value) {
@@ -11483,7 +11906,7 @@ function requestHashOf(request) {
 }
 function extractUnknownExtensions(payload) {
   const provider = payload.provider;
-  if (!isPlainObject4(provider)) {
+  if (!isPlainObject5(provider)) {
     return;
   }
   const extensions = {};
@@ -11561,7 +11984,7 @@ class FakeProvider {
         }
         case "tool_call": {
           const input2 = payload.input;
-          if (!isPlainObject4(input2)) {
+          if (!isPlainObject5(input2)) {
             yield emit({
               kind: "provider_error",
               error: {
@@ -11587,7 +12010,7 @@ class FakeProvider {
         }
         case "finish": {
           const usage = payload.usage;
-          if (isPlainObject4(usage)) {
+          if (isPlainObject5(usage)) {
             yield emit({ kind: "usage_update", usage: mapUsage(usage) });
           }
           const body = { kind: "model_end" };
@@ -11615,49 +12038,143 @@ var init_fake_provider = __esm(() => {
   init_provider_port();
 });
 
-// src/harness/provider/ollama/ollama-provider.ts
-function isPlainObject5(value) {
+// src/harness/provider/gemini/gemini-provider.ts
+function isPlainObject6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function asRecord3(value) {
-  return isPlainObject5(value) ? value : {};
+function asRecord4(value) {
+  return isPlainObject6(value) ? value : {};
 }
-function asArray(value) {
+function asArray2(value) {
   return Array.isArray(value) ? value : [];
 }
-function asString3(value) {
+function asString4(value) {
   return typeof value === "string" ? value : undefined;
 }
-function asNumber3(value) {
+function asNumber4(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
-function retryableFor2(kind, fallback) {
+function asBoolean(value) {
+  return value === true;
+}
+function toGeminiContents(messages) {
+  const out = [];
+  for (const linked of linkToolCalls(messages)) {
+    const message = linked.message;
+    if (message.role === "system") {
+      continue;
+    }
+    if (message.role === "assistant" && message.content.length === 0 && linked.linkedCalls.length === 0) {
+      continue;
+    }
+    if (message.role === "tool" && linked.linkedToolCallId !== undefined) {
+      const call = linked.message.toolCallId;
+      out.push({
+        role: "user",
+        parts: [
+          {
+            functionResponse: {
+              name: findToolName(messages, linked.linkedToolCallId) ?? "",
+              id: call,
+              response: parseFunctionResponse(message.content)
+            }
+          }
+        ]
+      });
+      continue;
+    }
+    if (message.role === "assistant" && linked.linkedCalls.length > 0) {
+      const parts = [];
+      if (message.content.length > 0) {
+        parts.push({ text: message.content });
+      }
+      for (const call of linked.linkedCalls) {
+        parts.push({
+          functionCall: { name: call.name, id: call.id, args: parseToolInput2(call.arguments) }
+        });
+      }
+      out.push({ role: "model", parts });
+      continue;
+    }
+    out.push({
+      role: message.role === "assistant" ? "model" : "user",
+      parts: [{ text: message.content }]
+    });
+  }
+  return out;
+}
+function findToolName(messages, toolCallId) {
+  for (const message of messages) {
+    if (message.role !== "assistant" || !Array.isArray(message.toolCalls)) {
+      continue;
+    }
+    const match = message.toolCalls.find((call) => call.id === toolCallId);
+    if (match !== undefined) {
+      return match.name;
+    }
+  }
+  return;
+}
+function parseFunctionResponse(rawContent) {
+  if (rawContent.trim().length === 0) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(rawContent);
+    return isPlainObject6(parsed) ? parsed : { result: parsed };
+  } catch {
+    return { result: rawContent };
+  }
+}
+function parseToolInput2(rawArguments) {
+  if (rawArguments.trim().length === 0) {
+    return {};
+  }
+  try {
+    return asRecord4(JSON.parse(rawArguments));
+  } catch {
+    return {};
+  }
+}
+function retryableFor3(kind, fallback) {
   const concrete = defaultRetryable(kind);
   return concrete === undefined ? fallback : concrete;
 }
-function mergeUsage2(promptTokens, completionTokens, totalTokens) {
+function mergeUsage3(promptTokens, candidatesTokens, totalTokens) {
   const usage = { exact: true };
   if (promptTokens !== undefined) {
     usage.inputTokens = promptTokens;
   }
-  if (completionTokens !== undefined) {
-    usage.outputTokens = completionTokens;
+  if (candidatesTokens !== undefined) {
+    usage.outputTokens = candidatesTokens;
   }
   if (totalTokens !== undefined) {
     usage.totalTokens = totalTokens;
-  } else if (promptTokens !== undefined || completionTokens !== undefined) {
-    usage.totalTokens = (promptTokens ?? 0) + (completionTokens ?? 0);
+  } else if (promptTokens !== undefined || candidatesTokens !== undefined) {
+    usage.totalTokens = (promptTokens ?? 0) + (candidatesTokens ?? 0);
   }
   return usage;
 }
-function classifyHttpError2(status) {
-  if (status >= 500) {
-    return { kind: "unavailable", retryable: retryableFor2("unavailable", true), message: "" };
+function classifyGeminiError(httpStatus, rpcStatus) {
+  if (rpcStatus === "UNAUTHENTICATED" || httpStatus === 401 || httpStatus === 403) {
+    return { kind: "authentication", retryable: retryableFor3("authentication", false), message: "" };
   }
-  return { kind: "invalid_request", retryable: retryableFor2("invalid_request", false), message: "" };
+  if (rpcStatus === "RESOURCE_EXHAUSTED" || httpStatus === 429) {
+    return { kind: "rate_limit", retryable: retryableFor3("rate_limit", true), message: "" };
+  }
+  if (rpcStatus === "UNAVAILABLE" || httpStatus >= 500) {
+    return { kind: "unavailable", retryable: retryableFor3("unavailable", true), message: "" };
+  }
+  if (rpcStatus === "INVALID_ARGUMENT" || httpStatus === 400) {
+    return { kind: "invalid_request", retryable: retryableFor3("invalid_request", false), message: "" };
+  }
+  if (httpStatus >= 400) {
+    return { kind: "invalid_request", retryable: retryableFor3("invalid_request", false), message: "" };
+  }
+  return { kind: "unknown", retryable: retryableFor3("unknown", false), message: "" };
 }
 
-class OllamaProvider {
+class GeminiProvider {
   deps;
   constructor(deps) {
     this.deps = deps;
@@ -11667,22 +12184,22 @@ class OllamaProvider {
       streaming: true,
       toolCalls: true,
       parallelToolCalls: true,
-      structuredOutput: false,
-      reasoningMetadata: false,
-      promptCaching: false,
-      vision: false,
+      structuredOutput: true,
+      reasoningMetadata: true,
+      promptCaching: true,
+      vision: true,
       tokenCounting: false,
       modelListing: false
     };
     return {
       capabilities,
-      descriptor: { providerId: "ollama", providerRevision: PROVIDER_REVISION2 }
+      descriptor: { providerId: "gemini", providerRevision: PROVIDER_REVISION2 }
     };
   }
   descriptorDocument() {
     return {
       schemaVersion: 1,
-      providerId: "ollama",
+      providerId: "gemini",
       providerRevision: PROVIDER_REVISION2,
       models: [{ modelId: DEFAULT_MODEL2.modelId, revision: DEFAULT_MODEL2.revision }],
       capabilities: {
@@ -11690,7 +12207,7 @@ class OllamaProvider {
         tools: true,
         parallelToolCalls: true,
         cancellation: true,
-        structuredOutput: false
+        structuredOutput: true
       },
       remoteState: { storage: false, retention: false, continuation: false }
     };
@@ -11700,11 +12217,12 @@ class OllamaProvider {
     const stamp = (body) => ({ ...body, sequence: sequence++, attemptId: opts.attemptId });
     const errorEvent = (error) => stamp({ kind: "provider_error", error });
     const grant = this.deps.grant;
-    if (grant === undefined || grant.network !== true) {
+    const redact = (message) => grant !== undefined && grant.apiKey.length > 0 ? message.split(grant.apiKey).join("[redacted]") : message;
+    if (grant === undefined || grant.network !== true || typeof grant.apiKey !== "string" || grant.apiKey.length === 0) {
       yield errorEvent({
-        kind: "invalid_request",
-        retryable: retryableFor2("invalid_request", false),
-        message: "a network capability grant is required to reach the Ollama API"
+        kind: "authentication",
+        retryable: retryableFor3("authentication", false),
+        message: "network capability grant with an apiKey is required to reach the Gemini API"
       });
       return;
     }
@@ -11715,70 +12233,459 @@ class OllamaProvider {
     } catch {
       host = baseUrl;
     }
-    const permitted = !isPrivateEgressHost(host) || grant.allowLoopback === true && isLoopbackHost(host);
-    if (!permitted) {
+    if (isPrivateEgressHost(host)) {
       yield errorEvent({
         kind: "invalid_request",
-        retryable: retryableFor2("invalid_request", false),
-        message: `egress to a private/loopback/link-local/metadata host is denied: ${host}`
+        retryable: retryableFor3("invalid_request", false),
+        message: redact(`egress to a private/loopback/link-local/metadata host is denied: ${host}`)
       });
       return;
     }
-    const url = `${baseUrl.replace(/\/+$/, "")}${grant.chatPath ?? "/v1/chat/completions"}`;
-    const messages = [];
-    if (request.systemInstruction.length > 0) {
-      messages.push({ role: "system", content: request.systemInstruction });
+    const url = `${baseUrl.replace(/\/+$/, "")}/v1beta/models/${encodeURIComponent(request.modelId)}:streamGenerateContent?alt=sse`;
+    const headers = {
+      "x-goog-api-key": grant.apiKey,
+      "content-type": "application/json"
+    };
+    const payload = {
+      contents: toGeminiContents(request.messages),
+      ...request.systemInstruction.length > 0 ? { systemInstruction: { parts: [{ text: request.systemInstruction }] } } : {},
+      ...request.tools !== undefined && request.tools.length > 0 ? {
+        tools: [
+          {
+            functionDeclarations: request.tools.map((tool) => ({
+              name: tool.name,
+              ...tool.description !== undefined ? { description: tool.description } : {},
+              parameters: tool.inputSchema
+            }))
+          }
+        ]
+      } : {},
+      generationConfig: {
+        maxOutputTokens: request.budget.maxOutputTokens,
+        ...request.options?.temperature !== undefined ? { temperature: request.options.temperature } : {}
+      }
+    };
+    const init = {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload),
+      ...opts.signal !== undefined ? { signal: opts.signal } : {}
+    };
+    let response;
+    try {
+      response = await this.deps.fetch(url, init);
+    } catch (cause) {
+      if (opts.signal?.aborted === true) {
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor3("cancelled", false), message: "attempt cancelled" });
+        return;
+      }
+      yield errorEvent({
+        kind: "unavailable",
+        retryable: retryableFor3("unavailable", true),
+        message: redact(`network request to the Gemini API failed: ${String(cause)}`)
+      });
+      return;
     }
-    for (const linked of linkToolCalls(request.messages)) {
-      const message = linked.message;
-      if (message.role === "tool") {
-        if (linked.linkedToolCallId !== undefined) {
-          messages.push({ role: "tool", tool_call_id: linked.linkedToolCallId, content: message.content });
+    if (!response.ok) {
+      let error;
+      let providerMessage = `Gemini API returned HTTP ${response.status}`;
+      try {
+        const parsed = asRecord4(JSON.parse(await response.text()));
+        const envelope = asRecord4(parsed.error);
+        const rpcStatus = asString4(envelope.status);
+        const httpCode = asNumber4(envelope.code) ?? response.status;
+        error = classifyGeminiError(httpCode, rpcStatus);
+        const detail = asString4(envelope.message);
+        if (detail !== undefined && detail.length > 0) {
+          providerMessage = detail;
+        }
+      } catch {
+        error = classifyGeminiError(response.status, undefined);
+      }
+      error.message = redact(providerMessage);
+      yield stamp({ kind: "provider_error", error });
+      return;
+    }
+    let bodyText;
+    try {
+      bodyText = await response.text();
+    } catch (cause) {
+      const aborted = opts.signal?.aborted === true || typeof cause === "object" && cause !== null && cause.name === "AbortError";
+      if (aborted) {
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor3("cancelled", false), message: "attempt cancelled" });
+        return;
+      }
+      yield errorEvent({
+        kind: "malformed",
+        retryable: retryableFor3("malformed", false),
+        message: redact(`Gemini SSE body read failed: ${String(cause)}`)
+      });
+      return;
+    }
+    if (bodyText.length === 0) {
+      yield errorEvent({
+        kind: "malformed",
+        retryable: retryableFor3("malformed", false),
+        message: redact("empty response body")
+      });
+      return;
+    }
+    const parser = new AnthropicSSEParser;
+    const records = parser.push(bodyText);
+    const torn = parser.flush();
+    const bodies = [];
+    let sawFirstChunk = false;
+    let sawFinish = false;
+    let malformed;
+    let promptTokens;
+    let candidatesTokens;
+    let totalTokens;
+    let cachedContentTokens;
+    let thoughtsTokens;
+    for (const record of records) {
+      let parsed;
+      try {
+        parsed = JSON.parse(record.data);
+      } catch {
+        malformed = {
+          kind: "malformed",
+          retryable: retryableFor3("malformed", false),
+          message: redact("Gemini SSE data line was not valid JSON")
+        };
+        break;
+      }
+      const chunk = asRecord4(parsed);
+      if (!sawFirstChunk) {
+        sawFirstChunk = true;
+        bodies.push({ kind: "model_start" });
+      }
+      const candidates = asArray2(chunk.candidates);
+      const firstCandidate = asRecord4(candidates[0]);
+      const content = asRecord4(firstCandidate.content);
+      const parts = asArray2(content.parts);
+      for (const rawPart of parts) {
+        const part = asRecord4(rawPart);
+        const text = asString4(part.text);
+        if (text !== undefined) {
+          if (asBoolean(part.thought)) {
+            bodies.push({ kind: "reasoning_delta", text });
+          } else {
+            bodies.push({ kind: "text_delta", text });
+          }
           continue;
         }
-        messages.push({ role: "user", content: `Tool result:
-${message.content}` });
-        continue;
+        const functionCall = asRecord4(part.functionCall);
+        const callName = asString4(functionCall.name);
+        if (callName !== undefined) {
+          const callId = asString4(functionCall.id) ?? callName;
+          const argsInput = JSON.stringify(asRecord4(functionCall.args));
+          bodies.push({ kind: "tool_call_start", toolCallId: callId, toolName: callName });
+          bodies.push({ kind: "tool_call_end", toolCallId: callId, input: argsInput });
+        }
       }
-      if (message.role === "assistant" && message.content.length === 0 && linked.linkedCalls.length === 0) {
+      const usageMetadata = asRecord4(chunk.usageMetadata);
+      if (Object.keys(usageMetadata).length > 0) {
+        promptTokens = asNumber4(usageMetadata.promptTokenCount) ?? promptTokens;
+        candidatesTokens = asNumber4(usageMetadata.candidatesTokenCount) ?? candidatesTokens;
+        totalTokens = asNumber4(usageMetadata.totalTokenCount) ?? totalTokens;
+        cachedContentTokens = asNumber4(usageMetadata.cachedContentTokenCount) ?? cachedContentTokens;
+        thoughtsTokens = asNumber4(usageMetadata.thoughtsTokenCount) ?? thoughtsTokens;
+      }
+      const finishReason = asString4(firstCandidate.finishReason);
+      if (finishReason !== undefined && finishReason.length > 0) {
+        sawFinish = true;
+      }
+    }
+    if (promptTokens !== undefined || candidatesTokens !== undefined || totalTokens !== undefined) {
+      const usage = mergeUsage3(promptTokens, candidatesTokens, totalTokens);
+      const unknownExtensions = {};
+      if (cachedContentTokens !== undefined) {
+        unknownExtensions["gemini.cached_content_tokens"] = cachedContentTokens;
+      }
+      if (thoughtsTokens !== undefined) {
+        unknownExtensions["gemini.thoughts_tokens"] = thoughtsTokens;
+      }
+      bodies.push({
+        kind: "usage_update",
+        usage,
+        ...Object.keys(unknownExtensions).length > 0 ? { unknownExtensions } : {}
+      });
+    }
+    if (sawFinish) {
+      bodies.push({ kind: "model_end" });
+    }
+    if (malformed === undefined) {
+      if (torn.length > 0) {
+        malformed = {
+          kind: "malformed",
+          retryable: retryableFor3("malformed", false),
+          message: redact("Gemini SSE stream ended mid-record (torn stream)")
+        };
+      } else if (sawFirstChunk && !sawFinish) {
+        malformed = {
+          kind: "malformed",
+          retryable: retryableFor3("malformed", false),
+          message: redact("Gemini SSE stream ended before a finishReason was reported (truncated stream)")
+        };
+      }
+    }
+    for (const body of bodies) {
+      if (opts.signal?.aborted === true) {
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor3("cancelled", false), message: "attempt cancelled" });
+        return;
+      }
+      yield stamp(body);
+    }
+    if (opts.signal?.aborted === true) {
+      yield errorEvent({ kind: "cancelled", retryable: retryableFor3("cancelled", false), message: "attempt cancelled" });
+      return;
+    }
+    if (malformed !== undefined) {
+      yield stamp({ kind: "provider_error", error: malformed });
+    }
+  }
+}
+var DEFAULT_BASE_URL2 = "https://generativelanguage.googleapis.com", PROVIDER_REVISION2 = "gemini-2026-08-20", DEFAULT_MODEL2;
+var init_gemini_provider = __esm(() => {
+  init_guard2();
+  init_provider_port();
+  DEFAULT_MODEL2 = {
+    modelId: "gemini-2.5-flash",
+    revision: "2.5"
+  };
+});
+
+// src/harness/provider/ollama/ollama-provider.ts
+class OllamaProvider {
+  engine;
+  constructor(deps) {
+    this.engine = new OpenAiCompatEngine(deps, {
+      defaultBaseUrl: DEFAULT_BASE_URL3,
+      providerRevision: PROVIDER_REVISION3,
+      providerId: "ollama",
+      providerLabel: "Ollama",
+      defaultModel: DEFAULT_MODEL3
+    });
+  }
+  describe() {
+    return this.engine.describe();
+  }
+  descriptorDocument() {
+    return this.engine.descriptorDocument();
+  }
+  stream(request, opts) {
+    return this.engine.stream(request, opts);
+  }
+}
+var DEFAULT_BASE_URL3 = "http://localhost:11434", PROVIDER_REVISION3 = "ollama-2024-10-22", DEFAULT_MODEL3;
+var init_ollama_provider = __esm(() => {
+  init_openai_compat_provider();
+  DEFAULT_MODEL3 = {
+    modelId: "llama3.1:latest",
+    revision: "latest"
+  };
+});
+
+// src/harness/provider/openai/openai-provider.ts
+function isPlainObject7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asRecord5(value) {
+  return isPlainObject7(value) ? value : {};
+}
+function asString5(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function asNumber5(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function toResponsesInput(messages) {
+  const out = [];
+  for (const linked of linkToolCalls(messages)) {
+    const message = linked.message;
+    if (message.role === "tool") {
+      if (linked.linkedToolCallId !== undefined) {
+        out.push({ type: "function_call_output", call_id: linked.linkedToolCallId, output: message.content });
         continue;
       }
-      if (message.role === "assistant" && linked.linkedCalls.length > 0) {
-        messages.push({
+      out.push({ type: "message", role: "user", content: [{ type: "input_text", text: message.content }] });
+      continue;
+    }
+    if (message.role === "assistant" && message.content.length === 0 && linked.linkedCalls.length === 0) {
+      continue;
+    }
+    if (message.role === "assistant" && linked.linkedCalls.length > 0) {
+      if (message.content.length > 0) {
+        out.push({
+          type: "message",
           role: "assistant",
-          content: message.content,
-          tool_calls: linked.linkedCalls.map((call) => ({
-            id: call.id,
-            type: "function",
-            function: { name: call.name, arguments: call.arguments }
-          }))
+          content: [{ type: "output_text", text: message.content }]
         });
-        continue;
       }
-      messages.push({ role: message.role, content: message.content });
+      for (const call of linked.linkedCalls) {
+        out.push({ type: "function_call", call_id: call.id, name: call.name, arguments: call.arguments });
+      }
+      continue;
+    }
+    out.push({
+      type: "message",
+      role: message.role === "assistant" ? "assistant" : "user",
+      content: [{ type: message.role === "assistant" ? "output_text" : "input_text", text: message.content }]
+    });
+  }
+  return out;
+}
+function retryableFor4(kind, fallback) {
+  const concrete = defaultRetryable(kind);
+  return concrete === undefined ? fallback : concrete;
+}
+function mergeUsage4(inputTokens, outputTokens, totalTokens) {
+  const usage = { exact: true };
+  if (inputTokens !== undefined) {
+    usage.inputTokens = inputTokens;
+  }
+  if (outputTokens !== undefined) {
+    usage.outputTokens = outputTokens;
+  }
+  if (totalTokens !== undefined) {
+    usage.totalTokens = totalTokens;
+  } else if (inputTokens !== undefined || outputTokens !== undefined) {
+    usage.totalTokens = (inputTokens ?? 0) + (outputTokens ?? 0);
+  }
+  return usage;
+}
+function extractErrorFields(data) {
+  const nested = asRecord5(data.error);
+  const code = asString5(nested.code) ?? asString5(data.code);
+  const message = asString5(nested.message) ?? asString5(data.message);
+  const param = asString5(nested.param) ?? asString5(data.param);
+  const out = {};
+  if (code !== undefined) {
+    out.code = code;
+  }
+  if (message !== undefined) {
+    out.message = message;
+  }
+  if (param !== undefined) {
+    out.param = param;
+  }
+  return out;
+}
+function classifyHttpError3(status, headers, code) {
+  if (status === 401) {
+    return { kind: "authentication", retryable: retryableFor4("authentication", false), message: "" };
+  }
+  if (status === 429) {
+    const error = { kind: "rate_limit", retryable: retryableFor4("rate_limit", true), message: "" };
+    const retryAfter = headers.get("retry-after");
+    const seconds = retryAfter === null ? undefined : Number.parseInt(retryAfter, 10);
+    if (seconds !== undefined && Number.isFinite(seconds)) {
+      error.retryAfterMs = seconds * 1000;
+    }
+    return error;
+  }
+  if (status === 400) {
+    if (code === "context_length_exceeded") {
+      return { kind: "context_overflow", retryable: retryableFor4("context_overflow", false), message: "" };
     }
+    return { kind: "invalid_request", retryable: retryableFor4("invalid_request", false), message: "" };
+  }
+  if (status >= 500) {
+    return { kind: "unavailable", retryable: retryableFor4("unavailable", true), message: "" };
+  }
+  if (status >= 400) {
+    return { kind: "invalid_request", retryable: retryableFor4("invalid_request", false), message: "" };
+  }
+  return { kind: "unknown", retryable: retryableFor4("unknown", false), message: "" };
+}
+
+class OpenAiProvider {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  describe() {
+    const capabilities = {
+      streaming: true,
+      toolCalls: true,
+      parallelToolCalls: true,
+      structuredOutput: true,
+      reasoningMetadata: true,
+      promptCaching: true,
+      vision: false,
+      tokenCounting: false,
+      modelListing: false
+    };
+    return {
+      capabilities,
+      descriptor: { providerId: "openai", providerRevision: PROVIDER_REVISION4 }
+    };
+  }
+  descriptorDocument() {
+    return {
+      schemaVersion: 1,
+      providerId: "openai",
+      providerRevision: PROVIDER_REVISION4,
+      models: [{ modelId: DEFAULT_MODEL4.modelId, revision: DEFAULT_MODEL4.revision }],
+      capabilities: {
+        streaming: true,
+        tools: true,
+        parallelToolCalls: true,
+        cancellation: true,
+        structuredOutput: true
+      },
+      remoteState: { storage: false, retention: false, continuation: false }
+    };
+  }
+  async* stream(request, opts) {
+    let sequence = 0;
+    const stamp = (body) => ({ ...body, sequence: sequence++, attemptId: opts.attemptId });
+    const errorEvent = (error) => stamp({ kind: "provider_error", error });
+    const grant = this.deps.grant;
+    const redact = (message) => grant !== undefined && grant.apiKey.length > 0 ? message.split(grant.apiKey).join("[redacted]") : message;
+    if (grant === undefined || grant.network !== true || typeof grant.apiKey !== "string" || grant.apiKey.length === 0) {
+      yield errorEvent({
+        kind: "authentication",
+        retryable: retryableFor4("authentication", false),
+        message: "network capability grant with an apiKey is required to reach the OpenAI API"
+      });
+      return;
+    }
+    const baseUrl = grant.baseUrl ?? DEFAULT_BASE_URL4;
+    let host;
+    try {
+      host = new URL(baseUrl).hostname;
+    } catch {
+      host = baseUrl;
+    }
+    if (isPrivateEgressHost(host)) {
+      yield errorEvent({
+        kind: "invalid_request",
+        retryable: retryableFor4("invalid_request", false),
+        message: redact(`egress to a private/loopback/link-local/metadata host is denied: ${host}`)
+      });
+      return;
+    }
+    const url = `${baseUrl.replace(/\/+$/, "")}/v1/responses`;
+    const headers = {
+      authorization: `Bearer ${grant.apiKey}`,
+      "content-type": "application/json"
+    };
     const payload = {
       model: request.modelId,
+      instructions: request.systemInstruction,
+      input: toResponsesInput(request.messages),
       stream: true,
-      messages,
       ...request.tools !== undefined ? {
         tools: request.tools.map((tool) => ({
           type: "function",
-          function: {
-            name: tool.name,
-            ...tool.description !== undefined ? { description: tool.description } : {},
-            parameters: tool.inputSchema
-          }
-        }))
+          name: tool.name,
+          ...tool.description !== undefined ? { description: tool.description } : {},
+          parameters: tool.inputSchema
+        })),
+        parallel_tool_calls: true
       } : {}
     };
-    const headers = { "content-type": "application/json" };
-    if (grant.apiKey !== undefined && grant.apiKey.length > 0) {
-      headers.authorization = `Bearer ${grant.apiKey}`;
-    }
-    if (grant.headers !== undefined) {
-      Object.assign(headers, grant.headers);
-    }
     const init = {
       method: "POST",
       headers,
@@ -11790,27 +12697,28 @@ ${message.content}` });
       response = await this.deps.fetch(url, init);
     } catch (cause) {
       if (opts.signal?.aborted === true) {
-        yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor4("cancelled", false), message: "attempt cancelled" });
         return;
       }
       yield errorEvent({
         kind: "unavailable",
-        retryable: retryableFor2("unavailable", true),
-        message: `network request to the Ollama API failed: ${String(cause)}`
+        retryable: retryableFor4("unavailable", true),
+        message: redact(`network request to the OpenAI API failed: ${String(cause)}`)
       });
       return;
     }
     if (!response.ok) {
-      const error = classifyHttpError2(response.status);
-      let providerMessage = `Ollama API returned HTTP ${response.status}`;
+      let bodyRecord = {};
       try {
-        const parsed = asRecord3(JSON.parse(await response.text()));
-        const detail = asString3(asRecord3(parsed.error).message);
-        if (detail !== undefined && detail.length > 0) {
-          providerMessage = detail;
-        }
+        bodyRecord = asRecord5(JSON.parse(await response.text()));
       } catch {}
-      error.message = providerMessage;
+      const fields = extractErrorFields(bodyRecord);
+      const error = classifyHttpError3(response.status, response.headers, fields.code);
+      let providerMessage = `OpenAI API returned HTTP ${response.status}`;
+      if (fields.message !== undefined && fields.message.length > 0) {
+        providerMessage = fields.message;
+      }
+      error.message = redact(providerMessage);
       yield stamp({ kind: "provider_error", error });
       return;
     }
@@ -11820,21 +12728,21 @@ ${message.content}` });
     } catch (cause) {
       const aborted = opts.signal?.aborted === true || typeof cause === "object" && cause !== null && cause.name === "AbortError";
       if (aborted) {
-        yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor4("cancelled", false), message: "attempt cancelled" });
         return;
       }
       yield errorEvent({
         kind: "malformed",
-        retryable: retryableFor2("malformed", false),
-        message: `Ollama SSE body read failed: ${String(cause)}`
+        retryable: retryableFor4("malformed", false),
+        message: redact(`OpenAI SSE body read failed: ${String(cause)}`)
       });
       return;
     }
     if (bodyText.length === 0) {
       yield errorEvent({
         kind: "malformed",
-        retryable: retryableFor2("malformed", false),
-        message: "empty response body"
+        retryable: retryableFor4("malformed", false),
+        message: redact("empty response body")
       });
       return;
     }
@@ -11842,149 +12750,193 @@ ${message.content}` });
     const records = parser.push(bodyText);
     const torn = parser.flush();
     const bodies = [];
+    const pendingTools = new Map;
     let sawStart = false;
-    let sawFinish = false;
-    let sawDone = false;
+    let sawCompleted = false;
     let malformed;
-    const pendingTools = new Map;
-    const toolCallKey = (toolCall) => {
-      const index = asNumber3(toolCall.index);
-      if (index !== undefined) {
-        return `idx:${index}`;
-      }
-      const id = asString3(toolCall.id);
-      if (id !== undefined && id.length > 0) {
-        return `id:${id}`;
-      }
-      return "idx:0";
-    };
-    const flushPendingToolEnds = () => {
-      for (const acc of pendingTools.values()) {
-        if (acc.ended) {
-          continue;
-        }
-        if (!acc.started) {
-          const startBody = { kind: "tool_call_start", toolCallId: acc.id };
-          if (acc.name.length > 0) {
-            startBody.toolName = acc.name;
-          }
-          bodies.push(startBody);
-          acc.started = true;
-        }
-        bodies.push({ kind: "tool_call_end", toolCallId: acc.id, input: acc.arguments });
-        acc.ended = true;
-      }
-      pendingTools.clear();
-    };
+    let terminalError;
     for (const record of records) {
-      const trimmed = record.data.trim();
-      if (trimmed === "[DONE]") {
-        sawDone = true;
-        flushPendingToolEnds();
-        continue;
-      }
-      if (!sawStart) {
-        sawStart = true;
-        bodies.push({ kind: "model_start" });
-      }
       let parsed;
       try {
         parsed = JSON.parse(record.data);
       } catch {
         malformed = {
           kind: "malformed",
-          retryable: retryableFor2("malformed", false),
-          message: "Ollama SSE data line was not valid JSON"
+          retryable: retryableFor4("malformed", false),
+          message: redact("OpenAI SSE data line was not valid JSON")
         };
         break;
       }
-      const data = asRecord3(parsed);
-      if (data.usage !== undefined) {
-        const usage = asRecord3(data.usage);
-        bodies.push({
-          kind: "usage_update",
-          usage: mergeUsage2(asNumber3(usage.prompt_tokens), asNumber3(usage.completion_tokens), asNumber3(usage.total_tokens))
-        });
-      }
-      const choice0 = asRecord3(asArray(data.choices)[0]);
-      const delta = asRecord3(choice0.delta);
-      const reasoning = asString3(delta.reasoning) ?? asString3(delta.reasoning_content);
-      if (reasoning !== undefined && reasoning.length > 0) {
-        bodies.push({ kind: "reasoning_delta", text: reasoning });
-      }
-      const content = asString3(delta.content);
-      if (content !== undefined && content.length > 0) {
-        bodies.push({ kind: "text_delta", text: content });
-      }
-      for (const rawToolCall of asArray(delta.tool_calls)) {
-        const toolCall = asRecord3(rawToolCall);
-        const fn = asRecord3(toolCall.function);
-        const toolCallId = asString3(toolCall.id);
-        const toolName = asString3(fn.name);
-        const argumentsFragment = asString3(fn.arguments) ?? "";
-        const key = toolCallKey(toolCall);
-        let acc = pendingTools.get(key);
-        if (acc === undefined) {
-          acc = {
-            id: toolCallId ?? `call_${key.replace(/[^a-zA-Z0-9_:-]/g, "_")}`,
-            name: toolName ?? "",
-            arguments: "",
-            started: false,
-            ended: false
-          };
-          pendingTools.set(key, acc);
+      const data = asRecord5(parsed);
+      const eventType = asString5(data.type) ?? asString5(record.event);
+      switch (eventType) {
+        case "response.created": {
+          break;
         }
-        if (toolCallId !== undefined && toolCallId.length > 0) {
-          acc.id = toolCallId;
+        case "response.output_item.added": {
+          const item = asRecord5(data.item);
+          if (asString5(item.type) === "function_call") {
+            if (!sawStart) {
+              sawStart = true;
+              bodies.push({ kind: "model_start" });
+            }
+            const itemId = asString5(data.item_id) ?? asString5(item.id) ?? "";
+            const callId = asString5(item.call_id) ?? itemId;
+            const toolName = asString5(item.name);
+            pendingTools.set(itemId, { callId, name: toolName ?? "", arguments: asString5(item.arguments) ?? "" });
+            const startBody = { kind: "tool_call_start", toolCallId: callId };
+            if (toolName !== undefined) {
+              startBody.toolName = toolName;
+            }
+            bodies.push(startBody);
+          }
+          break;
         }
-        if (toolName !== undefined && toolName.length > 0) {
-          acc.name = toolName;
+        case "response.output_text.delta": {
+          if (!sawStart) {
+            sawStart = true;
+            bodies.push({ kind: "model_start" });
+          }
+          const text = asString5(data.delta);
+          const body = { kind: "text_delta" };
+          if (text !== undefined) {
+            body.text = text;
+          }
+          bodies.push(body);
+          break;
         }
-        if (!acc.started) {
-          const startBody = { kind: "tool_call_start", toolCallId: acc.id };
-          if (acc.name.length > 0) {
-            startBody.toolName = acc.name;
+        case "response.reasoning_summary_text.delta": {
+          if (!sawStart) {
+            sawStart = true;
+            bodies.push({ kind: "model_start" });
           }
-          bodies.push(startBody);
-          acc.started = true;
+          const text = asString5(data.delta);
+          if (text !== undefined && text.length > 0) {
+            bodies.push({ kind: "reasoning_delta", text });
+          }
+          break;
         }
-        if (argumentsFragment.length > 0) {
-          acc.arguments += argumentsFragment;
-          bodies.push({
-            kind: "tool_call_delta",
-            toolCallId: acc.id,
-            inputDelta: argumentsFragment
-          });
+        case "response.function_call_arguments.delta": {
+          const itemId = asString5(data.item_id) ?? "";
+          const fragment = asString5(data.delta) ?? "";
+          const pending = pendingTools.get(itemId);
+          const toolCallId = pending?.callId ?? itemId;
+          if (pending !== undefined) {
+            pending.arguments += fragment;
+          }
+          if (fragment.length > 0) {
+            bodies.push({ kind: "tool_call_delta", toolCallId, inputDelta: fragment });
+          }
+          break;
+        }
+        case "response.function_call_arguments.done": {
+          const itemId = asString5(data.item_id) ?? "";
+          const pending = pendingTools.get(itemId);
+          const fullArguments = asString5(data.arguments) ?? pending?.arguments ?? "";
+          const toolCallId = pending?.callId ?? itemId;
+          bodies.push({ kind: "tool_call_end", toolCallId, input: fullArguments });
+          pendingTools.delete(itemId);
+          break;
         }
+        case "response.output_item.done": {
+          const item = asRecord5(data.item);
+          if (asString5(item.type) === "function_call") {
+            const itemId = asString5(data.item_id) ?? asString5(item.id) ?? "";
+            const pending = pendingTools.get(itemId);
+            if (pending !== undefined) {
+              const fullArguments = asString5(item.arguments) ?? pending.arguments;
+              bodies.push({ kind: "tool_call_end", toolCallId: pending.callId, input: fullArguments });
+              pendingTools.delete(itemId);
+            }
+          }
+          break;
+        }
+        case "response.completed": {
+          sawCompleted = true;
+          const usage = asRecord5(asRecord5(data.response).usage);
+          const inputTokens = asNumber5(usage.input_tokens);
+          const outputTokens = asNumber5(usage.output_tokens);
+          const totalTokens = asNumber5(usage.total_tokens);
+          const reasoningTokens = asNumber5(asRecord5(usage.output_tokens_details).reasoning_tokens);
+          const usageBody = {
+            kind: "usage_update",
+            usage: mergeUsage4(inputTokens, outputTokens, totalTokens)
+          };
+          if (reasoningTokens !== undefined) {
+            usageBody.unknownExtensions = { "openai.reasoning_tokens": reasoningTokens };
+          }
+          bodies.push(usageBody);
+          bodies.push({ kind: "model_end" });
+          break;
+        }
+        case "response.failed":
+        case "response.incomplete": {
+          const fields = extractErrorFields(asRecord5(data.response));
+          const code = fields.code;
+          let kind = "unknown";
+          if (code === "context_length_exceeded") {
+            kind = "context_overflow";
+          } else if (code !== undefined && code.length > 0) {
+            kind = "invalid_request";
+          }
+          let message = fields.message;
+          if (message === undefined || message.length === 0) {
+            message = kind === "context_overflow" ? "OpenAI Responses API returned an error with no message; likely context-length overflow" : "OpenAI Responses API returned an error with no message";
+          }
+          terminalError = { kind, retryable: retryableFor4(kind, false), message: redact(message) };
+          break;
+        }
+        case "error": {
+          const fields = extractErrorFields(data);
+          const code = fields.code;
+          let kind = "unknown";
+          if (code === "context_length_exceeded") {
+            kind = "context_overflow";
+          } else if (code !== undefined && code.length > 0) {
+            kind = "invalid_request";
+          }
+          let message = fields.message;
+          if (message === undefined || message.length === 0) {
+            message = kind === "context_overflow" ? "OpenAI Responses API returned an error with no message; likely context-length overflow" : "OpenAI Responses API returned an error with no message; likely context-length overflow (unconfirmed cause)";
+          }
+          terminalError = { kind, retryable: retryableFor4(kind, false), message: redact(message) };
+          break;
+        }
+        default:
+          break;
       }
-      const finishReason = asString3(choice0.finish_reason);
-      if (finishReason !== undefined && finishReason.length > 0) {
-        sawFinish = true;
-        flushPendingToolEnds();
+      if (terminalError !== undefined) {
+        break;
       }
     }
-    if (malformed === undefined && torn.length > 0) {
-      malformed = {
-        kind: "malformed",
-        retryable: retryableFor2("malformed", false),
-        message: "Ollama SSE stream ended mid-record (torn stream)"
-      };
-    }
-    if (malformed === undefined) {
-      flushPendingToolEnds();
-    }
-    if (malformed === undefined && sawStart && (sawDone || sawFinish)) {
-      bodies.push({ kind: "model_end" });
+    if (malformed === undefined && terminalError === undefined) {
+      if (torn.length > 0) {
+        malformed = {
+          kind: "malformed",
+          retryable: retryableFor4("malformed", false),
+          message: redact("OpenAI SSE stream ended mid-record (torn stream)")
+        };
+      } else if (sawStart && !sawCompleted) {
+        malformed = {
+          kind: "malformed",
+          retryable: retryableFor4("malformed", false),
+          message: redact("OpenAI SSE stream ended before response.completed (truncated stream)")
+        };
+      }
     }
     for (const body of bodies) {
       if (opts.signal?.aborted === true) {
-        yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+        yield errorEvent({ kind: "cancelled", retryable: retryableFor4("cancelled", false), message: "attempt cancelled" });
         return;
       }
       yield stamp(body);
     }
     if (opts.signal?.aborted === true) {
-      yield errorEvent({ kind: "cancelled", retryable: retryableFor2("cancelled", false), message: "attempt cancelled" });
+      yield errorEvent({ kind: "cancelled", retryable: retryableFor4("cancelled", false), message: "attempt cancelled" });
+      return;
+    }
+    if (terminalError !== undefined) {
+      yield stamp({ kind: "provider_error", error: terminalError });
       return;
     }
     if (malformed !== undefined) {
@@ -11992,13 +12944,13 @@ ${message.content}` });
     }
   }
 }
-var DEFAULT_BASE_URL2 = "http://localhost:11434", PROVIDER_REVISION2 = "ollama-2024-10-22", DEFAULT_MODEL2;
-var init_ollama_provider = __esm(() => {
+var DEFAULT_BASE_URL4 = "https://api.openai.com", PROVIDER_REVISION4 = "openai-responses-2026-08", DEFAULT_MODEL4;
+var init_openai_provider = __esm(() => {
   init_guard2();
   init_provider_port();
-  DEFAULT_MODEL2 = {
-    modelId: "llama3.1:latest",
-    revision: "latest"
+  DEFAULT_MODEL4 = {
+    modelId: "gpt-4.1",
+    revision: "2026-08"
   };
 });
 
@@ -12012,6 +12964,20 @@ function makeProvider(name, _model, opts) {
     }
     return new AnthropicProvider({ fetch: opts.fetch, grant: { network: true, apiKey } });
   }
+  if (name === "openai") {
+    const apiKey = env.OPENAI_API_KEY;
+    if (apiKey === undefined || apiKey.length === 0) {
+      return new FakeProvider([]);
+    }
+    return new OpenAiProvider({ fetch: opts.fetch, grant: { network: true, apiKey } });
+  }
+  if (name === "gemini") {
+    const apiKey = env.GEMINI_API_KEY !== undefined && env.GEMINI_API_KEY.length > 0 ? env.GEMINI_API_KEY : env.GOOGLE_API_KEY;
+    if (apiKey === undefined || apiKey.length === 0) {
+      return new FakeProvider([]);
+    }
+    return new GeminiProvider({ fetch: opts.fetch, grant: { network: true, apiKey } });
+  }
   if (name === "ollama") {
     return new OllamaProvider({
       fetch: opts.fetch,
@@ -12032,18 +12998,26 @@ function makeProvider(name, _model, opts) {
       ...compat.chatPath !== undefined ? { chatPath: compat.chatPath } : {},
       ...apiKey !== undefined ? { apiKey } : {}
     };
-    return new OllamaProvider({
-      fetch: opts.fetch,
-      grant
-    });
+    return new OpenAiCompatEngine({ fetch: opts.fetch, grant }, OLLAMA_COMPAT_IDENTITY);
   }
   return new FakeProvider([]);
 }
+var OLLAMA_COMPAT_IDENTITY;
 var init_make_provider = __esm(() => {
   init_providers();
   init_anthropic_provider();
+  init_openai_compat_provider();
   init_fake_provider();
+  init_gemini_provider();
   init_ollama_provider();
+  init_openai_provider();
+  OLLAMA_COMPAT_IDENTITY = {
+    defaultBaseUrl: "http://localhost:11434",
+    providerRevision: "ollama-2024-10-22",
+    providerId: "ollama",
+    providerLabel: "Ollama",
+    defaultModel: { modelId: "llama3.1:latest", revision: "latest" }
+  };
 });
 
 // src/harness/provider/single-turn.ts
@@ -12062,6 +13036,14 @@ function hasCredential(provider, env) {
     const key = env.ANTHROPIC_API_KEY;
     return key !== undefined && key.length > 0;
   }
+  if (provider === "openai") {
+    const key = env.OPENAI_API_KEY;
+    return key !== undefined && key.length > 0;
+  }
+  if (provider === "gemini") {
+    const key = env.GEMINI_API_KEY ?? env.GOOGLE_API_KEY;
+    return key !== undefined && key.length > 0;
+  }
   const compat = providerByName(provider);
   if (compat) {
     if (compat.requiresApiKey === false) {
@@ -12078,6 +13060,8 @@ function hasCredential(provider, env) {
 function keyedProviderCandidates() {
   return [
     "anthropic",
+    "openai",
+    "gemini",
     ...OPENAI_COMPAT_PROVIDERS.filter((provider) => provider.requiresApiKey !== false).map((p) => p.name)
   ];
 }
@@ -12153,7 +13137,9 @@ var init_single_turn = __esm(() => {
   init_shell_config();
   DEFAULT_MODELS = {
     anthropic: "claude-haiku-4-5-20251001",
-    ollama: "llama3.2"
+    ollama: "llama3.2",
+    openai: "gpt-5.6-luna",
+    gemini: "gemini-2.5-flash-lite"
   };
 });
 
@@ -13196,23 +14182,23 @@ var init_slate = __esm(() => {
 // src/flow/store.ts
 var exports_store = {};
 __export(exports_store, {
-  writeFlow: () => writeFlow,
-  slugify: () => slugify2,
-  resolveFlowDir: () => resolveFlowDir,
-  readFlow: () => readFlow,
-  readAcCriteria: () => readAcCriteria,
-  nextFlowId: () => nextFlowId,
-  migrateFlow: () => migrateFlow,
-  listFlowDirs: () => listFlowDirs,
-  groupFlowDirsById: () => groupFlowDirsById,
-  flowsRoot: () => flowsRoot,
-  flowIdOf: () => flowIdOf,
-  duplicateFlowIds: () => duplicateFlowIds,
-  deriveFlowWork: () => deriveFlowWork,
-  assertAcIntact: () => assertAcIntact,
-  appendJournal: () => appendJournal,
+  acChecksum: () => acChecksum,
   acPath: () => acPath,
-  acChecksum: () => acChecksum
+  appendJournal: () => appendJournal,
+  assertAcIntact: () => assertAcIntact,
+  deriveFlowWork: () => deriveFlowWork,
+  duplicateFlowIds: () => duplicateFlowIds,
+  flowIdOf: () => flowIdOf,
+  flowsRoot: () => flowsRoot,
+  groupFlowDirsById: () => groupFlowDirsById,
+  listFlowDirs: () => listFlowDirs,
+  migrateFlow: () => migrateFlow,
+  nextFlowId: () => nextFlowId,
+  readAcCriteria: () => readAcCriteria,
+  readFlow: () => readFlow,
+  resolveFlowDir: () => resolveFlowDir,
+  slugify: () => slugify2,
+  writeFlow: () => writeFlow
 });
 import { createHash as createHash7 } from "crypto";
 import { appendFile as appendFile2, mkdir as mkdir26, readFile as readFile32, readdir as readdir8 } from "fs/promises";
@@ -16069,7 +17055,7 @@ function renderWrapUpMemoryEntry(input2) {
 
 Version: 0.1.0
 Type: task-note
-Status: draft
+Status: accepted
 Confidence: medium
 
 ## Summary
@@ -16169,7 +17155,7 @@ function renderWrapUpDecisionPage(input2) {
 
 Version: 0.1.0
 Type: decision
-Status: draft
+Status: accepted
 
 ## Summary
 
@@ -17897,7 +18883,7 @@ function buildAgentSystemInstruction(orient, ctx = {}) {
 Project orientation (trusted context):
 ${trimmed}`;
 }
-function parseToolInput2(raw) {
+function parseToolInput3(raw) {
   const text = raw.trim();
   if (text.length === 0) {
     return {};
@@ -17940,7 +18926,7 @@ function stableStringify2(value) {
   return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify2(obj[k])}`).join(",")}}`;
 }
 function toolCallHash(name, input2) {
-  const parsed = parseToolInput2(input2);
+  const parsed = parseToolInput3(input2);
   return `${name}\x00${stableStringify2(parsed)}`;
 }
 function budgetUsed(state) {
@@ -18371,7 +19357,7 @@ ${modelOutput}` : modelOutput,
       }
       if (options.slateSession !== undefined && options.slateSession.opened === true) {
         try {
-          const touchedPaths = extractTouchedFromToolInput(call.name, parseToolInput2(call.input));
+          const touchedPaths = extractTouchedFromToolInput(call.name, parseToolInput3(call.input));
           const touch = await recordSlateTouch(options.slateSession.dir, touchedPaths, {
             runtime: { provider: deps.providerId, model: deps.modelId }
           });
@@ -18630,7 +19616,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, on
   if (tool === undefined) {
     return { output: `unknown tool: ${call.name}`, isError: true };
   }
-  const input2 = parseToolInput2(call.input);
+  const input2 = parseToolInput3(call.input);
   const validation = validateAgainstSchemaObject(tool.definition.inputSchema, input2);
   if (!validation.valid) {
     const detail = validation.errors.map((e) => `${e.path}: ${e.message}`).join("; ");
@@ -23336,7 +24322,7 @@ var init_github = __esm(() => {
 });
 
 // src/harness/tool/metaproject-adapter.ts
-import { readFile as readFile55 } from "fs/promises";
+import { readdir as readdir14, readFile as readFile55 } from "fs/promises";
 import { isAbsolute, join, relative, resolve } from "path";
 function errorMessage(cause) {
   return cause instanceof Error ? cause.message : String(cause);
@@ -23357,6 +24343,131 @@ function confineToWiki(cwd, candidate) {
   }
   return target;
 }
+function confineToSkills(cwd, candidate) {
+  const skillsRoot = join(cwd, ".metaproject", "skills", "gdskills");
+  const target = resolve(cwd, candidate);
+  const rel = relative(skillsRoot, target);
+  if (rel === "") {
+    return null;
+  }
+  if (rel.startsWith("..") || isAbsolute(rel)) {
+    return null;
+  }
+  return target;
+}
+function stripSkillFieldQuotes(value) {
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      return value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function parseSkillFrontmatter(content) {
+  if (!content.startsWith("---")) {
+    return {};
+  }
+  const end = content.indexOf(`
+---`, 3);
+  if (end === -1) {
+    return {};
+  }
+  const lines = content.slice(3, end).split(`
+`);
+  let description;
+  const triggers = [];
+  let inTriggers = false;
+  for (const line of lines) {
+    const descMatch = /^description:\s*(.*)$/.exec(line);
+    if (descMatch !== null && descMatch[1] !== undefined) {
+      description = stripSkillFieldQuotes(descMatch[1].trim());
+      inTriggers = false;
+      continue;
+    }
+    if (/^triggers:\s*$/.test(line)) {
+      inTriggers = true;
+      continue;
+    }
+    if (inTriggers) {
+      const itemMatch = /^\s+-\s*(.+)$/.exec(line);
+      if (itemMatch !== null && itemMatch[1] !== undefined) {
+        triggers.push(stripSkillFieldQuotes(itemMatch[1].trim()));
+        continue;
+      }
+      inTriggers = false;
+    }
+  }
+  return { ...description !== undefined ? { description } : {}, ...triggers.length > 0 ? { triggers } : {} };
+}
+async function parseCatalogSummaries(cwd) {
+  const summaries = new Map;
+  let content;
+  try {
+    content = await readFile55(join(cwd, ".metaproject", "skills", "catalog.md"), "utf8");
+  } catch {
+    return summaries;
+  }
+  const rowPattern = /^\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|\s*$/;
+  for (const line of content.split(`
+`)) {
+    const match = rowPattern.exec(line);
+    if (match === null) {
+      continue;
+    }
+    const [, name, , purpose] = match;
+    if (name === undefined || purpose === undefined || name === "Skill" || /^-+$/.test(name)) {
+      continue;
+    }
+    summaries.set(name, purpose);
+  }
+  return summaries;
+}
+async function walkSkillCatalog(cwd) {
+  const root = join(cwd, ".metaproject", "skills", "gdskills");
+  const entries = [];
+  let categoryDirs;
+  try {
+    categoryDirs = await readdir14(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const catalogSummaries = await parseCatalogSummaries(cwd);
+  for (const categoryDir of categoryDirs) {
+    if (!categoryDir.isDirectory()) {
+      continue;
+    }
+    const categoryPath = join(root, categoryDir.name);
+    let skillDirs;
+    try {
+      skillDirs = await readdir14(categoryPath, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const skillDir of skillDirs) {
+      if (!skillDir.isDirectory()) {
+        continue;
+      }
+      const skillMdPath = join(categoryPath, skillDir.name, "SKILL.md");
+      let content;
+      try {
+        content = await readFile55(skillMdPath, "utf8");
+      } catch {
+        continue;
+      }
+      const { description, triggers } = parseSkillFrontmatter(content);
+      entries.push({
+        name: skillDir.name,
+        path: relative(cwd, skillMdPath),
+        category: categoryDir.name,
+        description: description ?? catalogSummaries.get(skillDir.name) ?? "",
+        ...triggers !== undefined ? { triggers } : {}
+      });
+    }
+  }
+  return entries.sort((a, b) => a.path.localeCompare(b.path));
+}
 function createMetaprojectAdapter(cwd, overrides = {}) {
   const deps = { ...DEFAULT_DEPS, ...overrides };
   const gdgraph = deps.createGdgraphService();
@@ -23624,6 +24735,36 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
       } catch (cause) {
         return { file: input2.file, backlinks: [], error: errorMessage(cause) };
       }
+    },
+    async skillsCatalog() {
+      const skills = await walkSkillCatalog(cwd);
+      return { skills, generatedAt: deps.now() };
+    },
+    async loadSkill(input2) {
+      const catalog = await walkSkillCatalog(cwd);
+      const byName = catalog.find((entry) => entry.name === input2.name);
+      if (byName !== undefined) {
+        try {
+          const content = await readFile55(join(cwd, byName.path), "utf8");
+          return { name: input2.name, path: byName.path, content, found: true };
+        } catch {
+          return { name: input2.name, path: "", content: "", found: false };
+        }
+      }
+      const confined = confineToSkills(cwd, input2.name);
+      if (confined === null) {
+        return { name: input2.name, path: "", content: "", found: false };
+      }
+      const byPath = catalog.find((entry) => join(cwd, entry.path) === confined);
+      if (byPath === undefined) {
+        return { name: input2.name, path: "", content: "", found: false };
+      }
+      try {
+        const content = await readFile55(confined, "utf8");
+        return { name: input2.name, path: byPath.path, content, found: true };
+      } catch {
+        return { name: input2.name, path: "", content: "", found: false };
+      }
     }
   };
 }
@@ -23660,6 +24801,7 @@ var init_metaproject_adapter = __esm(() => {
     }),
     wikiAsk,
     wikiPagesForFile,
+    now: () => new Date().toISOString(),
     repomapCompute: async (cwd, options) => {
       const [graph, config] = await Promise.all([loadGraph(cwd), loadGdgraphConfig(cwd)]);
       return computeRepomap(graph, config, options);
@@ -23734,6 +24876,24 @@ function formatWiki(result) {
   }
   return { output: result.content.length > 0 ? result.content : "(empty page)", isError: false };
 }
+function formatSkillsCatalog(result) {
+  if (result.skills.length === 0) {
+    return { output: "No skills found under .metaproject/skills/gdskills/.", isError: false };
+  }
+  const lines = result.skills.map((skill2) => {
+    const triggers = skill2.triggers !== undefined && skill2.triggers.length > 0 ? ` [triggers: ${skill2.triggers.join(", ")}]` : "";
+    return `  - ${skill2.name} (${skill2.category}) \u2014 ${skill2.description || "(no description)"}${triggers}
+    ${skill2.path}`;
+  });
+  return { output: [`Skills (${result.skills.length}):`, ...lines].join(`
+`), isError: false };
+}
+function formatSkillLoad(result) {
+  if (!result.found) {
+    return { output: `skill_load: no skill found for '${result.name}'.`, isError: true };
+  }
+  return { output: result.content, isError: false };
+}
 function formatPath(result) {
   if (result.error !== undefined) {
     return { output: `graph_path failed: ${result.error}`, isError: true };
@@ -23847,7 +25007,7 @@ function toInteractiveTools(ops, port) {
     invoke: (input2) => op.invoke(port, input2)
   }));
 }
-var AFFECTED_OUTPUT_SCHEMA, QUERY_OUTPUT_SCHEMA, MEMORY_OUTPUT_SCHEMA, WIKI_OUTPUT_SCHEMA, SEARCH_OUTPUT_SCHEMA, PATH_OUTPUT_SCHEMA, TEST_RELATED_OUTPUT_SCHEMA, HEALTH_OUTPUT_SCHEMA, SYMBOL_OUTPUT_SCHEMA, REPOMAP_OUTPUT_SCHEMA, WIKI_ASK_OUTPUT_SCHEMA, WIKI_BACKLINKS_OUTPUT_SCHEMA, FLOW_STATUS_OUTPUT_SCHEMA, METAPROJECT_OPERATIONS;
+var AFFECTED_OUTPUT_SCHEMA, QUERY_OUTPUT_SCHEMA, MEMORY_OUTPUT_SCHEMA, WIKI_OUTPUT_SCHEMA, SEARCH_OUTPUT_SCHEMA, PATH_OUTPUT_SCHEMA, TEST_RELATED_OUTPUT_SCHEMA, HEALTH_OUTPUT_SCHEMA, SYMBOL_OUTPUT_SCHEMA, REPOMAP_OUTPUT_SCHEMA, WIKI_ASK_OUTPUT_SCHEMA, WIKI_BACKLINKS_OUTPUT_SCHEMA, FLOW_STATUS_OUTPUT_SCHEMA, SKILLS_CATALOG_OUTPUT_SCHEMA, SKILL_LOAD_OUTPUT_SCHEMA, METAPROJECT_OPERATIONS;
 var init_metaproject_operations = __esm(() => {
   AFFECTED_OUTPUT_SCHEMA = {
     type: "object",
@@ -23984,6 +25144,24 @@ var init_metaproject_operations = __esm(() => {
     },
     required: ["flows"]
   };
+  SKILLS_CATALOG_OUTPUT_SCHEMA = {
+    type: "object",
+    properties: {
+      skills: { type: "array" },
+      generatedAt: { type: "string" }
+    },
+    required: ["skills", "generatedAt"]
+  };
+  SKILL_LOAD_OUTPUT_SCHEMA = {
+    type: "object",
+    properties: {
+      name: { type: "string" },
+      path: { type: "string" },
+      content: { type: "string" },
+      found: { type: "boolean" }
+    },
+    required: ["name", "path", "content", "found"]
+  };
   METAPROJECT_OPERATIONS = [
     {
       name: "search_code",
@@ -24260,6 +25438,47 @@ var init_metaproject_operations = __esm(() => {
         const id = typeof input2.id === "string" && input2.id.trim().length > 0 ? input2.id.trim() : undefined;
         return formatFlowStatus(await port.flowStatus(id !== undefined ? { id } : {}));
       }
+    },
+    {
+      name: "skills_catalog",
+      risk: "read",
+      module: "gdskills",
+      description: "List every skill discovered under .metaproject/skills/gdskills/ \u2014 name, category, description, and " + "triggers for each. Use this instead of reading .metaproject/index.md or catalog.md to find which skill " + "applies to a task. No input.",
+      inputSchema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      outputSchema: SKILLS_CATALOG_OUTPUT_SCHEMA,
+      invoke: async (port) => {
+        if (port.skillsCatalog === undefined) {
+          return { output: "skills_catalog is not available in this session.", isError: true };
+        }
+        return formatSkillsCatalog(await port.skillsCatalog({}));
+      }
+    },
+    {
+      name: "skill_load",
+      risk: "read",
+      module: "gdskills",
+      description: `Load one skill's full SKILL.md content by name (e.g. "flow-orchestrator") or exact project-relative ` + "path, as returned by `skills_catalog`. Input: { name: string }.",
+      inputSchema: {
+        type: "object",
+        properties: { name: { type: "string" } },
+        required: ["name"],
+        additionalProperties: false
+      },
+      outputSchema: SKILL_LOAD_OUTPUT_SCHEMA,
+      invoke: async (port, input2) => {
+        if (port.loadSkill === undefined) {
+          return { output: "skill_load is not available in this session.", isError: true };
+        }
+        const name = requireString(input2, "name", "skill_load");
+        if ("error" in name) {
+          return name.error;
+        }
+        return formatSkillLoad(await port.loadSkill({ name: name.value }));
+      }
     }
   ];
 });
@@ -24513,30 +25732,30 @@ var init_staleness2 = __esm(() => {
 // src/wiki/enrich.ts
 var exports_enrich2 = {};
 __export(exports_enrich2, {
-  wikiEnrich: () => wikiEnrich,
-  validateEnrichedMarkdown: () => validateEnrichedMarkdown,
-  setFrontmatterStatus: () => setFrontmatterStatus,
-  selectPages: () => selectPages,
-  saveResumeState: () => saveResumeState,
-  resumeStatePath: () => resumeStatePath,
-  resolveEnrichProviderModel: () => resolveEnrichProviderModel,
-  repairEnrichedFrontmatter: () => repairEnrichedFrontmatter,
-  planWikiEnrich: () => planWikiEnrich,
-  parseBatchResponse: () => parseBatchResponse,
-  mapPool: () => mapPool,
-  loadResumeState: () => loadResumeState,
-  isWikiEnrichIntent: () => isWikiEnrichIntent,
-  hasYamlFrontmatter: () => hasYamlFrontmatter,
-  hasCredential: () => hasCredential,
-  groupLightPagesIntoBatches: () => groupLightPagesIntoBatches,
-  extractYamlFrontmatterBlock: () => extractYamlFrontmatterBlock,
-  ensureWikiFrontmatter: () => ensureWikiFrontmatter,
-  defaultEnrichProgress: () => defaultEnrichProgress,
-  buildBatchUserPrompt: () => buildBatchUserPrompt,
-  batchGroupKey: () => batchGroupKey,
-  MAX_CONCURRENCY: () => MAX_CONCURRENCY,
+  DEFAULT_CONCURRENCY: () => DEFAULT_CONCURRENCY,
   DEFAULT_MAX_OUTPUT_TOKENS: () => DEFAULT_MAX_OUTPUT_TOKENS,
-  DEFAULT_CONCURRENCY: () => DEFAULT_CONCURRENCY
+  MAX_CONCURRENCY: () => MAX_CONCURRENCY,
+  batchGroupKey: () => batchGroupKey,
+  buildBatchUserPrompt: () => buildBatchUserPrompt,
+  defaultEnrichProgress: () => defaultEnrichProgress,
+  ensureWikiFrontmatter: () => ensureWikiFrontmatter,
+  extractYamlFrontmatterBlock: () => extractYamlFrontmatterBlock,
+  groupLightPagesIntoBatches: () => groupLightPagesIntoBatches,
+  hasCredential: () => hasCredential,
+  hasYamlFrontmatter: () => hasYamlFrontmatter,
+  isWikiEnrichIntent: () => isWikiEnrichIntent,
+  loadResumeState: () => loadResumeState,
+  mapPool: () => mapPool,
+  parseBatchResponse: () => parseBatchResponse,
+  planWikiEnrich: () => planWikiEnrich,
+  repairEnrichedFrontmatter: () => repairEnrichedFrontmatter,
+  resolveEnrichProviderModel: () => resolveEnrichProviderModel,
+  resumeStatePath: () => resumeStatePath,
+  saveResumeState: () => saveResumeState,
+  selectPages: () => selectPages,
+  setFrontmatterStatus: () => setFrontmatterStatus,
+  validateEnrichedMarkdown: () => validateEnrichedMarkdown,
+  wikiEnrich: () => wikiEnrich
 });
 import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { readFile as readFile57, writeFile as writeFile36 } from "fs/promises";
@@ -25588,9 +26807,9 @@ var init_enrich2 = __esm(() => {
 // src/sync/hooks.ts
 var exports_hooks = {};
 __export(exports_hooks, {
-  uninstallSyncHooks: () => uninstallSyncHooks,
+  SYNC_HOOKS: () => SYNC_HOOKS,
   installSyncHooks: () => installSyncHooks,
-  SYNC_HOOKS: () => SYNC_HOOKS
+  uninstallSyncHooks: () => uninstallSyncHooks
 });
 import { chmod as chmod3, mkdir as mkdir42, readFile as readFile59, writeFile as writeFile38 } from "fs/promises";
 import path111 from "path";
@@ -25773,8 +26992,8 @@ var init_reflect = __esm(() => {
 // src/lib/narrate.ts
 var exports_narrate = {};
 __export(exports_narrate, {
-  narrate: () => narrate,
-  formatMissingCredentialHint: () => formatMissingCredentialHint
+  formatMissingCredentialHint: () => formatMissingCredentialHint,
+  narrate: () => narrate
 });
 function formatMissingCredentialHint(provider) {
   const env = envWithSavedApiKeys(process.env);
@@ -26206,9 +27425,9 @@ var init_memory = __esm(() => {
 // src/lib/contained-path.ts
 var exports_contained_path = {};
 __export(exports_contained_path, {
-  resolveProjectRoot: () => resolveProjectRoot2,
+  resolveContainedPath: () => resolveContainedPath,
   resolveContainedPathSync: () => resolveContainedPathSync,
-  resolveContainedPath: () => resolveContainedPath
+  resolveProjectRoot: () => resolveProjectRoot2
 });
 import { realpath as realpath3 } from "fs/promises";
 import { existsSync as existsSync21, realpathSync as realpathSync2 } from "fs";
@@ -32398,10 +33617,72 @@ var GENERIC_RUNTIME = {
   validate: mcpValidate("generic"),
   hasManaged: mcpHasManaged
 };
+function readVscodeServers(settings) {
+  return typeof settings.servers === "object" && settings.servers !== null && !Array.isArray(settings.servers) ? { ...settings.servers } : {};
+}
+function vscodeManagedEntry(projectRoot) {
+  return {
+    type: "stdio",
+    ...mcpServerEntry(projectRoot),
+    [MCP_MANAGED_KEY]: MCP_MANAGED_SENTINEL
+  };
+}
+function vscodeMerge(settings, projectRoot) {
+  const servers = readVscodeServers(settings);
+  servers[MCP_SERVER_NAME] = vscodeManagedEntry(projectRoot);
+  settings.servers = servers;
+  return settings;
+}
+function vscodeStrip(settings) {
+  if (typeof settings.servers !== "object" || settings.servers === null || Array.isArray(settings.servers)) {
+    return settings;
+  }
+  const servers = { ...settings.servers };
+  if (isManagedEntry(servers[MCP_SERVER_NAME])) {
+    delete servers[MCP_SERVER_NAME];
+  }
+  if (Object.keys(servers).length > 0)
+    settings.servers = servers;
+  else
+    delete settings.servers;
+  return settings;
+}
+function vscodeValidate(settings) {
+  const errors = [];
+  const servers = settings.servers;
+  if (typeof servers !== "object" || servers === null || Array.isArray(servers)) {
+    errors.push("vscode: servers is missing or not an object");
+    return errors;
+  }
+  const entry = servers[MCP_SERVER_NAME];
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+    errors.push(`vscode: missing servers.${MCP_SERVER_NAME} entry`);
+    return errors;
+  }
+  if (entry.type !== "stdio") {
+    errors.push(`vscode: servers.${MCP_SERVER_NAME}.type must be "stdio"`);
+  }
+  if (entry.command !== MCP_SERVER_COMMAND) {
+    errors.push(`vscode: servers.${MCP_SERVER_NAME}.command must be "${MCP_SERVER_COMMAND}"`);
+  }
+  return errors;
+}
+function vscodeHasManaged(settings) {
+  return isManagedEntry(readVscodeServers(settings)[MCP_SERVER_NAME]);
+}
+var VSCODE_RUNTIME = {
+  id: "vscode",
+  settingsPath: (root) => path40.join(root, ".vscode", "mcp.json"),
+  merge: vscodeMerge,
+  strip: vscodeStrip,
+  validate: vscodeValidate,
+  hasManaged: vscodeHasManaged
+};
 var MCP_CLIENT_RUNTIMES = [
   CURSOR_RUNTIME,
   CLAUDE_RUNTIME2,
   OPENCODE_RUNTIME,
+  VSCODE_RUNTIME,
   GENERIC_RUNTIME
 ];
 var ALL_RUNTIME_IDS = ["cursor", "claude", "opencode"];
@@ -32428,6 +33709,21 @@ function renderMcpClientSnippet(projectRoot) {
   return `${JSON.stringify({ mcpServers: { [MCP_SERVER_NAME]: mcpServerEntry(projectRoot) } }, null, 2)}
 `;
 }
+async function mcpClientStatus(projectRoot, ids = mcpRuntimeIds()) {
+  const absoluteProjectRoot = path40.resolve(projectRoot);
+  const { runtimes } = resolveMcpRuntimes(ids);
+  const statuses = [];
+  for (const runtime of runtimes) {
+    const file = runtime.settingsPath(absoluteProjectRoot);
+    if (file === null) {
+      statuses.push({ id: runtime.id, filePath: null, connected: false });
+      continue;
+    }
+    const settings = await readSettings2(file);
+    statuses.push({ id: runtime.id, filePath: file, connected: runtime.hasManaged(settings) });
+  }
+  return statuses;
+}
 async function readSettings2(file) {
   if (!await pathExists(file)) {
     return {};
@@ -32471,7 +33767,7 @@ function buildMcpModuleEntry() {
     expose: {
       tools: true,
       resources: true,
-      modules: ["gdgraph", "gdctx", "security", "flow", "memory", "health", "testing", "wiki", "standard", "sac"]
+      modules: ["gdgraph", "gdctx", "security", "flow", "memory", "health", "testing", "wiki", "standard", "sac", "gdskills"]
     }
   };
 }
@@ -32499,16 +33795,18 @@ protocol adapter \u2014 it defines no new module logic.
   requires \`http.enabled=true\` in this module's manifest entry).
 - \`keryx mcp serve --cwd <project-root>\` \u2014 expose a specific project,
   independent of the MCP client's launch directory.
-- \`keryx mcp install --runtime <cursor|claude|opencode|generic|all> [--dry-run]\` \u2014
+- \`keryx mcp install --runtime <cursor|claude|opencode|vscode|generic|all> [--dry-run]\` \u2014
   wire this project into an editor/agent: writes a project-local client
   config (cursor \u2192 \`.cursor/mcp.json\`, claude \u2192 \`.mcp.json\`, opencode \u2192
-  \`opencode.json\`) and sets \`modules.mcp.enabled=true\`. \`--dry-run\`
-  prints the change without writing anything. This is the command to run
-  when a user asks to "connect" or "enable" MCP for this project \u2014 it is
-  the full, real setup step; hand-editing a client config file directly is
-  unnecessary and skips setting \`modules.mcp.enabled\`. \`all\` expands to
-  cursor + claude + opencode.
-- \`keryx mcp uninstall --runtime <cursor|claude|opencode|generic|all>\` \u2014
+  \`opencode.json\`, vscode \u2192 \`.vscode/mcp.json\`) and sets
+  \`modules.mcp.enabled=true\`. \`--dry-run\` prints the change without
+  writing anything. This is the command to run when a user asks to
+  "connect" or "enable" MCP for this project \u2014 it is the full, real setup
+  step; hand-editing a client config file directly is unnecessary and skips
+  setting \`modules.mcp.enabled\`. \`all\` expands to cursor + claude +
+  opencode; \`vscode\` is opt-in only (not bundled into \`all\`) \u2014 request it
+  explicitly with \`--runtime vscode\`.
+- \`keryx mcp uninstall --runtime <cursor|claude|opencode|vscode|generic|all>\` \u2014
   remove the managed client config again.
 - **codex CLI**: not a \`--runtime\` here \u2014 codex's client config is a single
   GLOBAL \`~/.codex/config.toml\`, not a project-local file, and it already
@@ -32790,7 +34088,14 @@ skill's Reporting section).
 }
 
 // src/commands/init.ts
-var MCP_INIT_RUNTIMES = ["cursor", "claude", "opencode", "generic", "skip"];
+var MCP_INIT_RUNTIMES = [
+  "cursor",
+  "claude",
+  "opencode",
+  "vscode",
+  "generic",
+  "skip"
+];
 async function initCommand(args) {
   const options = parseInitArgs(args);
   if (options.help) {
@@ -35962,7 +37267,7 @@ the derived layers in step.
 init_args();
 init_fs();
 init_json();
-import { readdir as readdir17, readFile as readFile64 } from "fs/promises";
+import { readdir as readdir18, readFile as readFile64 } from "fs/promises";
 import path120 from "path";
 
 // src/gdskills/contracts.ts
@@ -36094,7 +37399,7 @@ async function validateValue(value, schema, valuePath, errors, rootSchema, schem
       });
     }
   }
-  if (isPlainObject6(value)) {
+  if (isPlainObject8(value)) {
     const required2 = schema.required ?? [];
     for (const key of required2) {
       if (!(key in value)) {
@@ -36114,7 +37419,7 @@ async function validateValue(value, schema, valuePath, errors, rootSchema, schem
           path: `${valuePath}.${key}`,
           message: "Additional property is not allowed"
         });
-      } else if (isPlainObject6(schema.additionalProperties)) {
+      } else if (isPlainObject8(schema.additionalProperties)) {
         await validateValue(nestedValue, schema.additionalProperties, `${valuePath}.${key}`, errors, rootSchema, schemaCache);
       }
     }
@@ -36173,11 +37478,11 @@ function matchesType3(value, type) {
     if (entry === "integer")
       return Number.isInteger(value);
     if (entry === "object")
-      return isPlainObject6(value);
+      return isPlainObject8(value);
     return typeof value === entry;
   });
 }
-function isPlainObject6(value) {
+function isPlainObject8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function formatType(type) {
@@ -36594,7 +37899,7 @@ function unique(values) {
 // src/gdskills/export.ts
 init_fs();
 init_json();
-import { copyFile as copyFile3, mkdir as mkdir45, readdir as readdir15, writeFile as writeFile40 } from "fs/promises";
+import { copyFile as copyFile3, mkdir as mkdir45, readdir as readdir16, writeFile as writeFile40 } from "fs/promises";
 import path117 from "path";
 
 // src/gdskills/resolve.ts
@@ -36644,7 +37949,7 @@ async function normalizePackagePath(candidate) {
 // src/gdskills/export-plugin.ts
 init_fs();
 init_json();
-import { copyFile as copyFile2, mkdir as mkdir44, readdir as readdir14, readFile as readFile62, writeFile as writeFile39 } from "fs/promises";
+import { copyFile as copyFile2, mkdir as mkdir44, readdir as readdir15, readFile as readFile62, writeFile as writeFile39 } from "fs/promises";
 import path116 from "path";
 var SAFE_DIRS = ["references", "templates", "assets", "scripts"];
 function skillTitle(skillMd, fallback) {
@@ -36666,7 +37971,7 @@ function skillVersion(skillMd) {
   return skillMd.match(/^Version:\s*(.+)$/m)?.[1]?.trim() ?? "0.1.0";
 }
 async function listFiles(root) {
-  const entries = await readdir14(root, { withFileTypes: true });
+  const entries = await readdir15(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const full = path116.join(root, entry.name);
@@ -36856,7 +38161,7 @@ async function copyDirectoryIfExists(sourceDir, targetDir) {
   }
 }
 async function listFiles2(root) {
-  const entries = await readdir15(root, { withFileTypes: true });
+  const entries = await readdir16(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const entryPath = path117.join(root, entry.name);
@@ -36877,7 +38182,7 @@ function inferModuleFromPackageRoot(packageRoot) {
 
 // src/gdskills/sync.ts
 init_fs();
-import { copyFile as copyFile4, mkdir as mkdir46, readdir as readdir16, writeFile as writeFile41 } from "fs/promises";
+import { copyFile as copyFile4, mkdir as mkdir46, readdir as readdir17, writeFile as writeFile41 } from "fs/promises";
 import path118 from "path";
 async function syncRuntimeSkills(projectRoot, options) {
   const metaprojectRoot = path118.join(projectRoot, ".metaproject");
@@ -36942,7 +38247,7 @@ function validateSyncTarget(projectRoot, targetRoot) {
   }
 }
 async function listSkillArtifactDirs(sourceRoot) {
-  const entries = await readdir16(sourceRoot, { withFileTypes: true });
+  const entries = await readdir17(sourceRoot, { withFileTypes: true });
   const dirs = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) {
@@ -36972,7 +38277,7 @@ async function copyDirectory(sourceDir, targetDir) {
   }
 }
 async function listFiles3(root) {
-  const entries = await readdir16(root, { withFileTypes: true });
+  const entries = await readdir17(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const entryPath = path118.join(root, entry.name);
@@ -38150,7 +39455,7 @@ async function listJsonFiles(root) {
   if (!await pathExists(root)) {
     return [];
   }
-  const entries = await readdir17(root, { withFileTypes: true });
+  const entries = await readdir18(root, { withFileTypes: true });
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => path120.join(root, entry.name));
 }
 function countVerificationStatuses(reports) {
@@ -38326,14 +39631,14 @@ init_service6();
 // src/health/history.ts
 init_fs();
 init_util();
-import { readdir as readdir18, readFile as readFile65 } from "fs/promises";
+import { readdir as readdir19, readFile as readFile65 } from "fs/promises";
 import path121 from "path";
 async function loadHistory(cwd, limit = 20) {
   const dir = path121.join(dataRoot2(cwd), "history");
   if (!await pathExists(dir)) {
     return [];
   }
-  const files = (await readdir18(dir)).filter((file) => file.endsWith(".json")).sort();
+  const files = (await readdir19(dir)).filter((file) => file.endsWith(".json")).sort();
   const points = [];
   for (const file of files.slice(-limit)) {
     try {
@@ -39320,7 +40625,7 @@ init_args();
 init_validator();
 init_fs();
 init_store2();
-import { mkdir as mkdir48, readFile as readFile66, readdir as readdir19 } from "fs/promises";
+import { mkdir as mkdir48, readFile as readFile66, readdir as readdir20 } from "fs/promises";
 import path124 from "path";
 
 // src/review/types.ts
@@ -39748,7 +41053,7 @@ async function resolveReviewPackagePath(cwd, ref) {
     if (!await pathExists(reviewsDir)) {
       continue;
     }
-    for (const entry of await readdir19(reviewsDir, { withFileTypes: true })) {
+    for (const entry of await readdir20(reviewsDir, { withFileTypes: true })) {
       if (entry.isDirectory() && entry.name === ref) {
         return path124.join(reviewsDir, entry.name);
       }
@@ -40135,7 +41440,7 @@ var SCHEMA_REGISTRY2 = {
 
 // src/standard/validate.ts
 var DATE_TIME_PATTERN3 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
-function isPlainObject7(value) {
+function isPlainObject9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function matchesType4(value, type) {
@@ -40148,7 +41453,7 @@ function matchesType4(value, type) {
     if (entry === "integer")
       return Number.isInteger(value);
     if (entry === "object")
-      return isPlainObject7(value);
+      return isPlainObject9(value);
     return typeof value === entry;
   });
 }
@@ -40223,7 +41528,7 @@ function walk4(value, schema, valuePath, rootSchema, errors) {
       errors.push({ path: valuePath, message: "Expected array items to be unique" });
     }
   }
-  if (isPlainObject7(value)) {
+  if (isPlainObject9(value)) {
     for (const key of schema.required ?? []) {
       if (!(key in value)) {
         errors.push({ path: `${valuePath}.${key}`, message: "Missing required property" });
@@ -40236,7 +41541,7 @@ function walk4(value, schema, valuePath, rootSchema, errors) {
         walk4(nested, nestedSchema, `${valuePath}.${key}`, rootSchema, errors);
       } else if (schema.additionalProperties === false) {
         errors.push({ path: `${valuePath}.${key}`, message: "Additional property is not allowed" });
-      } else if (isPlainObject7(schema.additionalProperties)) {
+      } else if (isPlainObject9(schema.additionalProperties)) {
         walk4(nested, schema.additionalProperties, `${valuePath}.${key}`, rootSchema, errors);
       }
     }
@@ -40319,7 +41624,7 @@ async function validateWorkspace2(cwd) {
       errors.push(issue("module-schema", `module "${key}" ${schemaError.path.replace(/^\$\.?/, "") || "(root)"}: ${schemaError.message}`, `Fix the modules.${key} entry in metaproject.json.`));
     }
   }
-  if (isPlainObject7(manifest.paths)) {
+  if (isPlainObject9(manifest.paths)) {
     for (const [key, value] of Object.entries(manifest.paths)) {
       if (typeof value !== "string") {
         continue;
@@ -40427,7 +41732,7 @@ async function runCapabilities(cwd) {
 init_fs();
 init_json();
 import path128 from "path";
-import { readdir as readdir20 } from "fs/promises";
+import { readdir as readdir21 } from "fs/promises";
 function llmsPath(cwd) {
   return path128.join(cwd, ".metaproject", "llms.txt");
 }
@@ -40480,7 +41785,7 @@ async function collectArtifactIndex(cwd) {
   const walk5 = async (dir) => {
     let entries;
     try {
-      entries = await readdir20(dir, { withFileTypes: true });
+      entries = await readdir21(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -41251,7 +42556,7 @@ Usage:
 }
 
 // src/commands/security.ts
-import { mkdir as mkdir51, readdir as readdir21, readFile as readFile72, writeFile as writeFile45 } from "fs/promises";
+import { mkdir as mkdir51, readdir as readdir22, readFile as readFile72, writeFile as writeFile45 } from "fs/promises";
 import path131 from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 init_args();
@@ -41718,7 +43023,7 @@ async function collectManifestFiles(target) {
   }
   let entries;
   try {
-    entries = await readdir21(target, { withFileTypes: true });
+    entries = await readdir22(target, { withFileTypes: true });
   } catch {
     return [target];
   }
@@ -42574,10 +43879,10 @@ async function resolveLedgerState(ledger, checkpointPath, verifier) {
 }
 var policyRefPattern = /^\.\/.+/;
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var asString4 = (value) => typeof value === "string" && value.length > 0;
+var asString6 = (value) => typeof value === "string" && value.length > 0;
 var isBaselineArtifact = (artifact) => artifact.schemaVersion === "1.0" && artifact.kind === "deterministic-baseline" && isImmutableVersion2(artifact.version) && artifact.selection === "eligible-ids-in-input-order";
-var isCandidateArtifact = (artifact) => artifact.schemaVersion === "1.0" && artifact.kind === "offline-selection-advisor" && isImmutableVersion2(artifact.version) && asString4(artifact.output) && typeof artifact.mutations === "boolean";
-var isEvaluationReport = (report) => report.schemaVersion === "1.0" && asString4(report.status) && asString4(report.baselineVersion) && asString4(report.baselineDigest) && reportHashPattern.test(report.baselineDigest) && asString4(report.candidateVersion) && asString4(report.candidateDigest) && reportHashPattern.test(report.candidateDigest) && asString4(report.corpusVersion) && asString4(report.corpusDigest) && reportHashPattern.test(report.corpusDigest) && asString4(report.reportDigest) && reportHashPattern.test(report.reportDigest) && asString4(report.sandboxProfileDigest) && reportHashPattern.test(report.sandboxProfileDigest) && isRecord3(report.train) && typeof report.train.status === "string" && typeof report.train.cases === "number" && isRecord3(report.holdout) && typeof report.holdout.status === "string" && typeof report.holdout.cases === "number" && isRecord3(report.adversarial) && typeof report.adversarial.status === "string" && typeof report.adversarial.cases === "number" && Array.isArray(report.candidateSelectedIds) && Array.isArray(report.reasons);
+var isCandidateArtifact = (artifact) => artifact.schemaVersion === "1.0" && artifact.kind === "offline-selection-advisor" && isImmutableVersion2(artifact.version) && asString6(artifact.output) && typeof artifact.mutations === "boolean";
+var isEvaluationReport = (report) => report.schemaVersion === "1.0" && asString6(report.status) && asString6(report.baselineVersion) && asString6(report.baselineDigest) && reportHashPattern.test(report.baselineDigest) && asString6(report.candidateVersion) && asString6(report.candidateDigest) && reportHashPattern.test(report.candidateDigest) && asString6(report.corpusVersion) && asString6(report.corpusDigest) && reportHashPattern.test(report.corpusDigest) && asString6(report.reportDigest) && reportHashPattern.test(report.reportDigest) && asString6(report.sandboxProfileDigest) && reportHashPattern.test(report.sandboxProfileDigest) && isRecord3(report.train) && typeof report.train.status === "string" && typeof report.train.cases === "number" && isRecord3(report.holdout) && typeof report.holdout.status === "string" && typeof report.holdout.cases === "number" && isRecord3(report.adversarial) && typeof report.adversarial.status === "string" && typeof report.adversarial.cases === "number" && Array.isArray(report.candidateSelectedIds) && Array.isArray(report.reasons);
 var isConfigRecord = (value) => typeof value.enabled === "boolean" && typeof value.killSwitch === "boolean";
 async function readPinnedJson(input2) {
   const ref = await resolveWorkspaceReference({ workspaceRoot: input2.workspaceRoot, kind: "artifact", uri: input2.uri });
@@ -42627,7 +43932,7 @@ async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
   const corpusDigest = configJson.corpusDigest;
   const evaluationRef = configJson.evaluationReportRef;
   const evaluationDigest = configJson.evaluationDigest;
-  if (!asString4(candidateRef) || !asString4(candidateDigest) || !asString4(baselineRef) || !asString4(baselineDigest) || !asString4(corpusRef) || !asString4(corpusDigest) || !asString4(evaluationRef) || !asString4(evaluationDigest))
+  if (!asString6(candidateRef) || !asString6(candidateDigest) || !asString6(baselineRef) || !asString6(baselineDigest) || !asString6(corpusRef) || !asString6(corpusDigest) || !asString6(evaluationRef) || !asString6(evaluationDigest))
     return canonicalFallback;
   if (!workspacePathPattern3.test(candidateRef) || !workspacePathPattern3.test(baselineRef) || !workspacePathPattern3.test(corpusRef) || !workspacePathPattern3.test(evaluationRef))
     return canonicalFallback;
@@ -42742,7 +44047,7 @@ async function diagnosePolicyReadiness(workspaceRoot) {
   const corpusDigest = configJson.corpusDigest;
   const evaluationRef = configJson.evaluationReportRef;
   const evaluationDigest = configJson.evaluationDigest;
-  if (!asString4(candidateRef) || !asString4(candidateDigest) || !asString4(baselineRef) || !asString4(baselineDigest) || !asString4(corpusRef) || !asString4(corpusDigest) || !asString4(evaluationRef) || !asString4(evaluationDigest)) {
+  if (!asString6(candidateRef) || !asString6(candidateDigest) || !asString6(baselineRef) || !asString6(baselineDigest) || !asString6(corpusRef) || !asString6(corpusDigest) || !asString6(evaluationRef) || !asString6(evaluationDigest)) {
     fail("config-pins", "pins are present but not non-empty strings");
     return finalize(true, enabled, killSwitch);
   }
@@ -43437,7 +44742,7 @@ function buildToolRegistry() {
 // src/mcp/resources.ts
 init_fs();
 import path135 from "path";
-import { readdir as readdir22, readFile as readFile76, stat as stat7 } from "fs/promises";
+import { readdir as readdir23, readFile as readFile76, stat as stat7 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
   if (filePath.endsWith(".json") || filePath.endsWith(".jsonl")) {
@@ -43464,7 +44769,7 @@ async function walkFiles(root) {
   const out = [];
   let entries;
   try {
-    entries = await readdir22(root, { withFileTypes: true });
+    entries = await readdir23(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -43486,7 +44791,7 @@ async function listArtifacts(cwd) {
   const listings = [];
   let modules;
   try {
-    modules = await readdir22(base, { withFileTypes: true });
+    modules = await readdir23(base, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -43778,7 +45083,7 @@ async function mcpCommand(args2 = [], cwd = process.cwd()) {
   printMcpHelp();
   process.exitCode = 1;
 }
-var RUNTIME_USAGE = `<cursor|claude|opencode|generic|all>`;
+var RUNTIME_USAGE = `<cursor|claude|opencode|vscode|generic|all>`;
 function parseRequestedRuntimes(args2, fallback) {
   const runtimeArg = optionValue(args2, "--runtime") ?? fallback;
   return runtimeArg.split(",").map((s) => s.trim()).filter(Boolean);
@@ -43862,7 +45167,7 @@ function printMcpHelp() {
     { flag: "--dry-run", desc: "install only: print the planned change and write nothing." }
   ]);
   heading("Notes");
-  console.log(`  ${style.dim("`install` writes a project-local MCP client config (cursor \u2192 .cursor/mcp.json, claude \u2192 .mcp.json, opencode \u2192 opencode.json), sets modules.mcp.enabled=true, and prints a snippet for `generic`.")}`);
+  console.log(`  ${style.dim("`install` writes a project-local MCP client config (cursor \u2192 .cursor/mcp.json, claude \u2192 .mcp.json, opencode \u2192 opencode.json, vscode \u2192 .vscode/mcp.json), sets modules.mcp.enabled=true, and prints a snippet for `generic`. `vscode` is opt-in only \u2014 not included in `all`.")}`);
   console.log(`  ${style.dim("Requires the optional @modelcontextprotocol/sdk to serve. Disabled by default (modules.mcp.enabled=false). `install` only probes the SDK \u2014 it never installs it or opens a network connection.")}`);
 }
 
@@ -45328,6 +46633,9 @@ function buildDefaultMaskProviders(openaiCompat) {
     out.push({ envKey: p.envKey, baseUrl: p.baseUrl });
   }
   out.push({ envKey: "ANTHROPIC_API_KEY", baseUrl: "https://api.anthropic.com" });
+  out.push({ envKey: "OPENAI_API_KEY", baseUrl: "https://api.openai.com" });
+  out.push({ envKey: "GEMINI_API_KEY", baseUrl: "https://generativelanguage.googleapis.com" });
+  out.push({ envKey: "GOOGLE_API_KEY", baseUrl: "https://generativelanguage.googleapis.com" });
   return out;
 }
 function parseMaskMode(raw) {
@@ -45827,6 +47135,8 @@ init_workspace_service();
 var HARNESS_PROVIDER_OPTIONS = [
   "fake",
   "anthropic",
+  "openai",
+  "gemini",
   "ollama",
   ...OPENAI_COMPAT_PROVIDERS.map((provider) => provider.name)
 ];
@@ -45992,6 +47302,20 @@ async function harnessCommand(args2, deps) {
       return;
     }
   }
+  if (provider === "openai") {
+    const apiKey = env.OPENAI_API_KEY;
+    if (apiKey === undefined || apiKey.length === 0) {
+      console.log("OPENAI_API_KEY is not set: the openai provider is required to have a credential and fails closed (no network was contacted).");
+      return;
+    }
+  }
+  if (provider === "gemini") {
+    const apiKey = env.GEMINI_API_KEY !== undefined && env.GEMINI_API_KEY.length > 0 ? env.GEMINI_API_KEY : env.GOOGLE_API_KEY;
+    if (apiKey === undefined || apiKey.length === 0) {
+      console.log("GEMINI_API_KEY (or GOOGLE_API_KEY) is not set: the gemini provider is required to have a credential and fails closed (no network was contacted).");
+      return;
+    }
+  }
   const providerPort = makeProvider(provider, model, {
     fetch: fetchImpl,
     env,
@@ -46597,7 +47921,7 @@ async function buildApprovalContext(port, command) {
 import { randomUUID as randomUUID20 } from "crypto";
 
 // src/harness/tool/builtin/interactive-tools.ts
-import { readdir as readdir23 } from "fs/promises";
+import { readdir as readdir24 } from "fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
 import { realpathSync as realpathSync4 } from "fs";
 var MAX_READ_BYTES = 20000;
@@ -46649,7 +47973,7 @@ function builtinReadOnlyTools(root) {
         return { output: `path escapes the project root: ${requested}`, isError: true };
       }
       try {
-        const entries = await readdir23(target, { withFileTypes: true });
+        const entries = await readdir24(target, { withFileTypes: true });
         const lines = entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).sort();
         return { output: lines.length > 0 ? lines.join(`
 `) : "(empty)", isError: false };
@@ -50330,7 +51654,7 @@ function buildClaudeResumeArgv(sessionRef, message2, input2) {
 function asObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
 }
-function asString5(value) {
+function asString7(value) {
   return typeof value === "string" ? value : undefined;
 }
 function asFiniteNumber(value) {
@@ -50343,16 +51667,16 @@ function truncate3(text, limit) {
 var CLAUDE_UNMAPPED_SYSTEM_SUBTYPES = ["hook_started", "hook_response"];
 var CLAUDE_UNMAPPED_LINE_TYPES = ["rate_limit_event"];
 function systemEvents(obj) {
-  const subtype = asString5(obj.subtype);
+  const subtype = asString7(obj.subtype);
   if (subtype === "init") {
-    const sessionRef = asString5(obj.session_id);
+    const sessionRef = asString7(obj.session_id);
     return [sessionRef === undefined ? { kind: "child_started" } : { kind: "child_started", sessionRef }];
   }
   if (subtype === "api_retry") {
     const attempt = asFiniteNumber(obj.attempt);
     const max = asFiniteNumber(obj.max_retries);
     const status = asFiniteNumber(obj.error_status);
-    const error2 = asString5(obj.error);
+    const error2 = asString7(obj.error);
     const parts = [
       attempt === undefined ? "api retry" : `api retry ${attempt}${max === undefined ? "" : `/${max}`}`,
       status === undefined ? undefined : `status ${status}`,
@@ -50363,32 +51687,32 @@ function systemEvents(obj) {
   return [];
 }
 function toolResultDetail(content) {
-  const direct = asString5(content);
+  const direct = asString7(content);
   if (direct !== undefined)
     return truncate3(direct, TOOL_DETAIL_LIMIT);
   if (!Array.isArray(content))
     return;
-  const text = content.map((entry) => asString5(asObject(entry)?.text)).filter((entry) => entry !== undefined).join(`
+  const text = content.map((entry) => asString7(asObject(entry)?.text)).filter((entry) => entry !== undefined).join(`
 `);
   return text.length === 0 ? undefined : truncate3(text, TOOL_DETAIL_LIMIT);
 }
 function assistantBlockEvent(block) {
-  switch (asString5(block.type)) {
+  switch (asString7(block.type)) {
     case "tool_use": {
-      const name = asString5(block.name) ?? "unknown";
+      const name = asString7(block.name) ?? "unknown";
       const detail = block.input === undefined ? undefined : truncate3(JSON.stringify(block.input), TOOL_DETAIL_LIMIT);
       return detail === undefined ? { kind: "tool_call", name } : { kind: "tool_call", name, detail };
     }
     case "text":
-      return { kind: "assistant_text", text: asString5(block.text) ?? "" };
+      return { kind: "assistant_text", text: asString7(block.text) ?? "" };
     case "thinking":
-      return { kind: "thinking", text: asString5(block.thinking) ?? asString5(block.text) ?? "" };
+      return { kind: "thinking", text: asString7(block.thinking) ?? asString7(block.text) ?? "" };
     default:
       return;
   }
 }
 function userBlockEvent(block) {
-  if (asString5(block.type) !== "tool_result")
+  if (asString7(block.type) !== "tool_result")
     return;
   const detail = toolResultDetail(block.content);
   return detail === undefined ? { kind: "tool_result" } : { kind: "tool_result", detail };
@@ -50426,14 +51750,14 @@ function usageEvent(obj) {
   };
 }
 function describeFailure(obj) {
-  const subtype = asString5(obj.subtype) ?? "unknown";
+  const subtype = asString7(obj.subtype) ?? "unknown";
   const parts = [`result.subtype "${subtype}"`];
-  const text = asString5(obj.result);
+  const text = asString7(obj.result);
   if (text !== undefined && text.length > 0)
     parts.push(truncate3(text, TOOL_DETAIL_LIMIT));
   const errors = obj.errors;
   if (Array.isArray(errors)) {
-    const flat = errors.map((entry) => asString5(entry)).filter((entry) => entry !== undefined);
+    const flat = errors.map((entry) => asString7(entry)).filter((entry) => entry !== undefined);
     if (flat.length > 0)
       parts.push(truncate3(flat.join("; "), TOOL_DETAIL_LIMIT));
   }
@@ -50443,10 +51767,10 @@ function describeFailure(obj) {
   return parts.join(" \u2014 ");
 }
 function resultEvents(obj) {
-  const subtype = asString5(obj.subtype);
+  const subtype = asString7(obj.subtype);
   const succeeded = subtype === undefined ? obj.is_error === false : subtype === "success";
   const terminal = succeeded ? (() => {
-    const text = asString5(obj.result);
+    const text = asString7(obj.result);
     return text === undefined ? { kind: "child_finished" } : { kind: "child_finished", text };
   })() : { kind: "child_failed", message: describeFailure(obj) };
   const usage = usageEvent(obj);
@@ -50465,7 +51789,7 @@ function parseClaudeEvents(line) {
   const obj = asObject(parsed);
   if (obj === undefined)
     return [];
-  switch (asString5(obj.type)) {
+  switch (asString7(obj.type)) {
     case "system":
       return systemEvents(obj);
     case "assistant":
@@ -50495,13 +51819,13 @@ function isRecognisedClaudeLine(line) {
   const obj = asObject(parsed);
   if (obj === undefined)
     return false;
-  const type = asString5(obj.type);
+  const type = asString7(obj.type);
   if (type === undefined)
     return false;
   if (CLAUDE_UNMAPPED_LINE_TYPES.includes(type))
     return true;
   if (type === "system") {
-    const subtype = asString5(obj.subtype) ?? "";
+    const subtype = asString7(obj.subtype) ?? "";
     return subtype === "init" || subtype === "api_retry" || CLAUDE_UNMAPPED_SYSTEM_SUBTYPES.includes(subtype);
   }
   return type === "assistant" || type === "user" || type === "result";
@@ -50595,9 +51919,9 @@ function parseCodexEvents(line) {
   const record = readJsonObject(line);
   if (record === undefined)
     return [];
-  switch (asString6(record.type)) {
+  switch (asString8(record.type)) {
     case "thread.started": {
-      const threadId = asString6(record.thread_id);
+      const threadId = asString8(record.thread_id);
       return [threadId === undefined ? { kind: "child_started" } : { kind: "child_started", sessionRef: threadId }];
     }
     case "turn.started":
@@ -50615,7 +51939,7 @@ function parseCodexEvents(line) {
     case "turn.failed":
       return [{ kind: "child_failed", message: parseFailureMessage(record.error) }];
     case "error":
-      return [{ kind: "retry", message: asString6(record.message) ?? "codex reported a non-terminal error" }];
+      return [{ kind: "retry", message: asString8(record.message) ?? "codex reported a non-terminal error" }];
     default:
       return [];
   }
@@ -50636,7 +51960,7 @@ function isRecognisedCodexLine(line) {
   const record = readJsonObject(line);
   if (record === undefined)
     return false;
-  const type = asString6(record.type);
+  const type = asString8(record.type);
   return type !== undefined && RECOGNISED_TYPES.has(type);
 }
 var NARRATED_FAILURE_LINE = /^\s*(error\b|usage:)/i;
@@ -50696,25 +52020,25 @@ function readJsonObject(line) {
     return;
   }
 }
-function asString6(value) {
+function asString8(value) {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
-function asNumber4(value) {
+function asNumber6(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 function parseCompletedItem(raw) {
   if (typeof raw !== "object" || raw === null)
     return [];
   const item = raw;
-  switch (asString6(item.type)) {
+  switch (asString8(item.type)) {
     case "command_execution": {
-      const command = asString6(item.command);
+      const command = asString8(item.command);
       return [
         command === undefined ? { kind: "tool_call", name: "command_execution" } : { kind: "tool_call", name: "command_execution", detail: command }
       ];
     }
     case "agent_message": {
-      const text = asString6(item.text);
+      const text = asString8(item.text);
       return text === undefined ? [] : [{ kind: "assistant_text", text }];
     }
     default:
@@ -50725,8 +52049,8 @@ function parseUsage(raw) {
   if (typeof raw !== "object" || raw === null)
     return;
   const usage = raw;
-  const inputTokens = asNumber4(usage.input_tokens);
-  const outputTokens = asNumber4(usage.output_tokens);
+  const inputTokens = asNumber6(usage.input_tokens);
+  const outputTokens = asNumber6(usage.output_tokens);
   if (inputTokens === undefined && outputTokens === undefined)
     return;
   return {
@@ -50737,11 +52061,11 @@ function parseUsage(raw) {
 }
 function parseFailureMessage(raw) {
   if (typeof raw === "object" && raw !== null) {
-    const message2 = asString6(raw.message);
+    const message2 = asString8(raw.message);
     if (message2 !== undefined)
       return message2;
   }
-  return asString6(raw) ?? "codex reported a failed turn without a message";
+  return asString8(raw) ?? "codex reported a failed turn without a message";
 }
 function lastTerminalEvent(events) {
   for (let i = events.length - 1;i >= 0; i -= 1) {
@@ -51627,7 +52951,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.49",
+  version: "0.2.51",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -52888,7 +54212,7 @@ init_store3();
 init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID24 } from "crypto";
-import { readdir as readdir24 } from "fs/promises";
+import { readdir as readdir25 } from "fs/promises";
 import path148 from "path";
 
 // src/sac/lifecycle-flag.ts
@@ -52938,6 +54262,7 @@ async function computeLifecycleFlags(cwd, now = () => new Date) {
 }
 
 // src/sac/catch-up.ts
+init_proposal_evidence();
 async function buildCatchUp(input2) {
   const [proposals, sessionCategories, lifecycleFlagsAll] = await Promise.all([
     collectProposals(input2.cwd, input2.workspaceId),
@@ -52957,8 +54282,20 @@ async function collectProposals(cwd, workspaceId) {
   const scoped = workspaceId === undefined ? groups : groups.filter((group) => group.workspace.id === workspaceId);
   const flattened = scoped.flatMap((group) => group.proposals.map((proposal) => ({ group, proposal })));
   return Promise.all(flattened.map(async ({ group, proposal }) => {
-    const fresh = await proposalService.isEvidenceFresh(proposal, actor);
-    return { type: "proposal", workspaceId: group.workspace.id, proposalId: proposal.id, fresh };
+    const [fresh, note2] = await Promise.all([
+      proposalService.isEvidenceFresh(proposal, actor),
+      readSidecarNote(cwd, group.workspace.id, proposal.id)
+    ]);
+    return {
+      type: "proposal",
+      workspaceId: group.workspace.id,
+      proposalId: proposal.id,
+      fresh,
+      kind: proposal.kind,
+      author: proposal.author,
+      createdAt: proposal.createdAt,
+      note: note2
+    };
   }));
 }
 async function classifySession(session) {
@@ -53019,7 +54356,7 @@ async function isSlateEngaged(dir) {
   if (await pathExists(path148.join(dir, "terminal-state.json")))
     return true;
   try {
-    const entries = await readdir24(path148.join(dir, "slate-archive"));
+    const entries = await readdir25(path148.join(dir, "slate-archive"));
     return entries.length > 0;
   } catch {
     return false;
@@ -53047,7 +54384,7 @@ async function readNewestUnboundCandidate(dir) {
   const archiveDir = path148.join(dir, "slate-archive");
   let entries;
   try {
-    entries = (await readdir24(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+    entries = (await readdir25(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
   } catch {
     return;
   }
@@ -53084,7 +54421,7 @@ async function readNewestWrapUpOutcome(dir) {
   const archiveDir = path148.join(dir, "slate-archive");
   let entries;
   try {
-    entries = (await readdir24(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
+    entries = (await readdir25(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
   } catch {
     return;
   }
@@ -53529,7 +54866,7 @@ function openFlows(otui, chrome, options) {
 
 // src/tui/busy-dispatch.ts
 function classifyBusyDispatch(params) {
-  const { line, commandName, isSessionInfo, isFlows, isWorkspace, isReview } = params;
+  const { line, commandName, isSessionInfo, isFlows, isWorkspace, isReview, isMcp } = params;
   if (commandName === "/exit")
     return "exit";
   if (commandName === "/help")
@@ -53548,7 +54885,7 @@ function classifyBusyDispatch(params) {
     return "copy";
   if (commandName === "/mode")
     return "mode";
-  const isBusyReadonlyCommand = isSessionInfo || isFlows || isWorkspace || isReview;
+  const isBusyReadonlyCommand = isSessionInfo || isFlows || isWorkspace || isReview || isMcp;
   if (isBusyReadonlyCommand && isSessionInfo)
     return "session-info";
   if (isBusyReadonlyCommand && isFlows)
@@ -53557,6 +54894,8 @@ function classifyBusyDispatch(params) {
     return "workspace";
   if (isBusyReadonlyCommand && isReview)
     return "review";
+  if (isBusyReadonlyCommand && isMcp)
+    return "mcp";
   if (commandName !== undefined || line.startsWith("/"))
     return "deferred";
   return "not-a-command";
@@ -53816,7 +55155,8 @@ function openWorkspace(otui, chrome, options) {
 var REVIEW_COMMAND = "/review";
 var REVIEW_FOOTER = [
   { key: "[/]", label: "item" },
-  { key: "a y", label: "accept" },
+  { key: "a y", label: "accept proposal" },
+  { key: "d y", label: "decline proposal" },
   { key: "\u2191/\u2193", label: "scroll" },
   { key: "\u2190/\u2192", label: "tabs" },
   { key: "esc", label: "close" }
@@ -53834,7 +55174,7 @@ var TYPE_LABEL = {
 function summarizeReviewItem(item) {
   switch (item.type) {
     case "proposal":
-      return `${item.proposalId} in ${item.workspaceId}${item.fresh ? "" : " (stale)"}`;
+      return `${item.kind} ${item.proposalId} in ${item.workspaceId}${item.fresh ? "" : " (stale)"}`;
     case "blocked":
       return `${item.sessionId} \u2014 ${item.terminalState.reason}`;
     case "unbound-candidate":
@@ -53858,9 +55198,13 @@ function describeReviewItem(item) {
       return [
         `Proposal   ${item.proposalId}`,
         `Workspace  ${item.workspaceId}`,
+        `Kind       ${item.kind}`,
+        `Author     ${item.author}`,
+        `Created    ${item.createdAt}`,
         `Evidence   ${item.fresh ? "fresh" : "stale \u2014 evidence has drifted since this proposal was created; re-run wrap-up before deciding"}`,
+        ...item.note !== undefined ? ["", `Note       ${item.note}`] : [],
         "",
-        `Reject/dismiss from a terminal: keryx workspace review ${item.workspaceId} ${item.proposalId} --decision <rejected|dismissed>`
+        `Dismiss (archive with no decision) from a terminal: keryx workspace review ${item.workspaceId} ${item.proposalId} --decision dismissed`
       ];
     case "blocked":
       return [
@@ -53913,25 +55257,37 @@ function describeGroupOutcome(g) {
     }
   }
 }
+var DECISION_VERB = { accept: "Accept", decline: "Decline" };
+var DECISION_ING = { accept: "Accepting", decline: "Declining" };
+var DECISION_DONE = { accept: "Accepted", decline: "Declined" };
+var DECISION_COMMAND = {
+  accept: "running `keryx workspace confirm-review` then `keryx workspace review`",
+  decline: "running `keryx workspace review --decision rejected`"
+};
 function formatReviewDetailLines(item, status) {
   if (item === undefined) {
     return ["No item selected.", "", "Press Enter (or click a row) on the Review tab to view one."];
   }
   const lines = describeReviewItem(item);
   if (item.type !== "proposal") {
+    if (status.kind === "unavailable") {
+      return [...lines, "", `[${status.decision === "accept" ? "a" : "d"}] does nothing here \u2014 accept/decline only apply to a pending proposal, not to this item.`];
+    }
     return lines;
   }
   const withAction = [...lines, ""];
   if (status.kind === "armed") {
-    withAction.push("Press [y] to CONFIRM accept, any other key cancels.");
+    withAction.push(`Press [y] to CONFIRM ${status.decision}, any other key cancels.`);
   } else if (status.kind === "running") {
-    withAction.push("Accepting\u2026 running `keryx workspace confirm-review` then `keryx workspace review`.");
+    withAction.push(`${DECISION_ING[status.decision]}\u2026 ${DECISION_COMMAND[status.decision]}.`);
   } else if (status.kind === "done" && status.outcome.ok) {
-    withAction.push("\u2713 Accepted.");
+    withAction.push(`\u2713 ${DECISION_DONE[status.decision]}.`);
   } else if (status.kind === "done" && !status.outcome.ok) {
-    withAction.push(`\u2717 Accept failed: ${status.outcome.message}`);
+    withAction.push(`\u2717 ${DECISION_VERB[status.decision]} failed: ${status.outcome.message}`);
+  } else if (status.kind === "unavailable") {
+    withAction.push(`[${status.decision === "accept" ? "a" : "d"}] does nothing \u2014 no ${status.decision} handler is configured for this modal.`);
   } else {
-    withAction.push("[a] Accept this proposal");
+    withAction.push("[a] Accept this proposal   [d] Decline this proposal");
   }
   return withAction;
 }
@@ -54028,17 +55384,19 @@ function presentReview(openModal2, otui, chrome, options) {
     status = { kind: "idle" };
     paintSelection();
   };
-  const runAccept = () => {
+  const handlerFor = (decision) => decision === "accept" ? options.acceptProposal : options.declineProposal;
+  const runDecision = (decision) => {
     const item = items[selected];
-    if (item === undefined || item.type !== "proposal" || options.acceptProposal === undefined) {
+    const run = handlerFor(decision);
+    if (item === undefined || item.type !== "proposal" || run === undefined) {
       return;
     }
-    status = { kind: "running" };
+    status = { kind: "running", decision };
     paintSelection();
-    options.acceptProposal(item).then((outcome) => {
-      status = { kind: "done", outcome };
+    run(item).then((outcome) => {
+      status = { kind: "done", decision, outcome };
       if (outcome.ok) {
-        options.onAccepted?.(item);
+        options.onResolved?.(item);
       }
       paintSelection();
     });
@@ -54078,7 +55436,7 @@ function presentReview(openModal2, otui, chrome, options) {
       const onDetail = handle.activeTab() === "detail";
       if (onDetail && status.kind === "armed") {
         if (token === "y") {
-          runAccept();
+          runDecision(status.decision);
         } else {
           status = { kind: "idle" };
           paintSelection();
@@ -54097,8 +55455,9 @@ function presentReview(openModal2, otui, chrome, options) {
         handle.setTab("detail");
         return;
       }
-      if (onDetail && token === "a" && items[selected]?.type === "proposal" && options.acceptProposal !== undefined && status.kind !== "running") {
-        status = { kind: "armed" };
+      if (onDetail && (token === "a" || token === "d") && status.kind !== "running") {
+        const decision = token === "a" ? "accept" : "decline";
+        status = items[selected]?.type === "proposal" && handlerFor(decision) !== undefined ? { kind: "armed", decision } : { kind: "unavailable", decision };
         paintSelection();
         return;
       }
@@ -54162,6 +55521,228 @@ async function acceptProposalViaShell(run, workspaceId, proposalId) {
   }
   return { ok: true };
 }
+async function declineProposalViaShell(run, workspaceId, proposalId) {
+  const decline = await run(`keryx workspace review ${shQuote(workspaceId)} ${shQuote(proposalId)} --decision rejected`);
+  if (decline.isError) {
+    return { ok: false, message: decline.output };
+  }
+  return { ok: true };
+}
+
+// src/tui/mcp-inspector.ts
+var MCP_INSPECTOR_FOOTER = [
+  { key: "\u2191/\u2193", label: "select" },
+  { key: "c/d", label: "connect/disconnect" },
+  { key: "y", label: "confirm" },
+  { key: "\u2190/\u2192", label: "tabs" },
+  { key: "esc", label: "close" }
+];
+var MCP_TOOLS_COMMAND = "/mcp";
+function isMcpToolsCommand(line) {
+  const token = line.trim().split(/\s+/)[0] ?? "";
+  return token === MCP_TOOLS_COMMAND;
+}
+var RUNTIME_LABELS = {
+  cursor: "Cursor",
+  claude: "Claude Code",
+  opencode: "opencode",
+  vscode: "VS Code",
+  generic: "Generic (manual)"
+};
+function runtimeLabel(id) {
+  return RUNTIME_LABELS[id] ?? id;
+}
+function formatToolsListLines(tools) {
+  if (tools.length === 0) {
+    return ["No tools available."];
+  }
+  return tools.map((tool) => {
+    const risk = (tool.risk ?? "read").padEnd(6);
+    const name = tool.name.padEnd(28);
+    return `${name} ${risk} ${tool.description ?? ""}`.trimEnd();
+  });
+}
+function isActionable(id) {
+  return id !== "generic";
+}
+function formatMcpListLines(runtimes, selected, status) {
+  if (runtimes.length === 0) {
+    return ["No MCP client runtimes registered."];
+  }
+  return runtimes.map((runtime, index) => {
+    const mark = index === selected ? ">" : " ";
+    const label = runtimeLabel(runtime.id).padEnd(20);
+    const statusText = runtime.connected ? "\u25CF connected" : "\u25CB not connected";
+    let action = "";
+    if (!isActionable(runtime.id)) {
+      action = "  (copy snippet manually)";
+    } else if (status.kind === "armed" && status.target.id === runtime.id) {
+      action = `  [press y to ${status.target.action}]`;
+    } else if (status.kind === "running" && status.target.id === runtime.id) {
+      action = `  ${status.target.action === "connect" ? "connecting\u2026" : "disconnecting\u2026"}`;
+    } else if (status.kind === "done" && status.target.id === runtime.id) {
+      action = status.outcome.ok ? "  \u2713 done" : `  \u2717 ${status.outcome.message}`;
+    } else {
+      action = runtime.connected ? "  [d] disconnect" : "  [c] connect";
+    }
+    return `${mark} ${label} ${statusText}${action}`;
+  });
+}
+function presentMcpTools(openModal2, otui, chrome, options) {
+  const runtimes = options.runtimes.map((r) => ({ ...r }));
+  let mcpSelected = 0;
+  let toolsScroll = 0;
+  let mcpScroll = 0;
+  let status = { kind: "idle" };
+  let toolsNode;
+  let mcpNode;
+  let unsubscribeKey;
+  const rendererHint = options.renderer ?? chrome?.renderer;
+  const bodyRows = options.visibleRows ?? (typeof rendererHint?.width === "number" && typeof rendererHint.height === "number" ? modalBodyRows(resolveModalPanelSize(rendererHint.width, rendererHint.height).height) : 13);
+  const toolLines = () => formatToolsListLines(options.tools);
+  const mcpLines = () => formatMcpListLines(runtimes, mcpSelected, status);
+  const paint = () => {
+    toolsScroll = clampScroll3(toolsScroll, toolLines().length, bodyRows);
+    mcpScroll = scrollToReveal3(mcpSelected, mcpScroll, bodyRows);
+    mcpScroll = clampScroll3(mcpScroll, mcpLines().length, bodyRows);
+    if (toolsNode !== undefined) {
+      toolsNode.content = windowLines3(toolLines(), toolsScroll, bodyRows).join(`
+`);
+    }
+    if (mcpNode !== undefined) {
+      mcpNode.content = windowLines3(mcpLines(), mcpScroll, bodyRows).join(`
+`);
+    }
+  };
+  const moveMcpSelection = (next) => {
+    if (runtimes.length === 0) {
+      return;
+    }
+    const clamped = Math.min(runtimes.length - 1, Math.max(0, next));
+    if (clamped === mcpSelected) {
+      return;
+    }
+    mcpSelected = clamped;
+    status = { kind: "idle" };
+    paint();
+  };
+  const runAction = () => {
+    if (status.kind !== "armed") {
+      return;
+    }
+    const target = status.target;
+    status = { kind: "running", target };
+    paint();
+    const fn = target.action === "connect" ? options.connect : options.disconnect;
+    fn(target.id).then((outcome) => {
+      status = { kind: "done", target, outcome };
+      if (outcome.ok) {
+        const row = runtimes.find((r) => r.id === target.id);
+        if (row !== undefined) {
+          row.connected = target.action === "connect";
+        }
+      }
+      options.onStatusChange?.(runtimes);
+      paint();
+    });
+  };
+  const handle = openModal2(otui, chrome, {
+    title: "Tools & MCP",
+    tabs: [
+      { id: "tools", label: "Tools" },
+      { id: "mcp", label: "MCP" }
+    ],
+    initialTab: "tools",
+    footer: MCP_INSPECTOR_FOOTER,
+    renderTab: (tabId, body, ctx) => {
+      const renderer = options.renderer ?? chrome?.renderer;
+      const parent = body;
+      const ctor = otui.TextRenderable;
+      if (parent.add === undefined || ctor === undefined) {
+        return;
+      }
+      if (tabId === "tools") {
+        toolsScroll = clampScroll3(toolsScroll, toolLines().length, bodyRows);
+        toolsNode = new ctor(renderer, { id: "mcp-tools-body", content: windowLines3(toolLines(), toolsScroll, bodyRows).join(`
+`) });
+        parent.add(toolsNode);
+        return;
+      }
+      mcpScroll = scrollToReveal3(mcpSelected, mcpScroll, bodyRows);
+      mcpNode = new ctor(renderer, { id: "mcp-mcp-body", content: windowLines3(mcpLines(), mcpScroll, bodyRows).join(`
+`) });
+      parent.add(mcpNode);
+    },
+    onClose: () => {
+      unsubscribeKey?.();
+    }
+  });
+  if (handle === undefined) {
+    return;
+  }
+  if (options.onKeypress !== undefined) {
+    unsubscribeKey = options.onKeypress((key) => {
+      const token = key.name || key.sequence;
+      const onMcp = handle.activeTab() === "mcp";
+      if (onMcp && status.kind === "armed") {
+        if (token === "y") {
+          runAction();
+        } else {
+          status = { kind: "idle" };
+          paint();
+        }
+        return;
+      }
+      if (onMcp && token === "c") {
+        const row = runtimes[mcpSelected];
+        if (row !== undefined && isActionable(row.id) && !row.connected && status.kind !== "running") {
+          status = { kind: "armed", target: { id: row.id, action: "connect" } };
+          paint();
+        }
+        return;
+      }
+      if (onMcp && token === "d") {
+        const row = runtimes[mcpSelected];
+        if (row !== undefined && isActionable(row.id) && row.connected && status.kind !== "running") {
+          status = { kind: "armed", target: { id: row.id, action: "disconnect" } };
+          paint();
+        }
+        return;
+      }
+      if (token === "up" || token === "k") {
+        if (onMcp) {
+          moveMcpSelection(mcpSelected - 1);
+        } else {
+          toolsScroll = clampScroll3(toolsScroll - 1, toolLines().length, bodyRows);
+          paint();
+        }
+        return;
+      }
+      if (token === "down" || token === "j") {
+        if (onMcp) {
+          moveMcpSelection(mcpSelected + 1);
+        } else {
+          toolsScroll = clampScroll3(toolsScroll + 1, toolLines().length, bodyRows);
+          paint();
+        }
+        return;
+      }
+      if (token === "pageup" || token === "pagedown") {
+        const step = token === "pageup" ? -bodyRows : bodyRows;
+        if (onMcp) {
+          mcpScroll = clampScroll3(mcpScroll + step, mcpLines().length, bodyRows);
+        } else {
+          toolsScroll = clampScroll3(toolsScroll + step, toolLines().length, bodyRows);
+        }
+        paint();
+      }
+    });
+  }
+  return handle;
+}
+function openMcpTools(otui, chrome, options) {
+  return presentMcpTools((hostOtui, hostChrome, input2) => openModal(hostOtui, hostChrome, input2), otui, chrome, options);
+}
 
 // src/tui/tui-shell.ts
 init_slate();
@@ -54532,6 +56113,11 @@ var AGENT_SLASH_COMMANDS = [
     description: "Show project-wide items needing review (proposals, blocked sessions)",
     modes: AGENT_ONLY
   },
+  {
+    name: "/mcp",
+    description: "Show available tools and MCP client connect status",
+    modes: AGENT_ONLY
+  },
   {
     name: "/compact",
     description: "Compact model context \u2014 /compact [focus] (archive kept)",
@@ -54921,6 +56507,38 @@ init_providers();
 init_patch_risk();
 init_shell_config();
 
+// src/mcp-client/wire.ts
+var STANDARD_ELICITATION_PARAM_KEYS = new Set(["message", "requestedSchema"]);
+
+// src/mcp-client/elicitation.ts
+init_command_risk();
+function extractCodexCommand(vendor) {
+  const raw = vendor.codex_command;
+  if (!Array.isArray(raw))
+    return;
+  return raw.every((entry) => typeof entry === "string") ? raw : undefined;
+}
+var SHELL_BASENAMES = new Set(["zsh", "bash", "sh", "ksh", "dash", "fish"]);
+var MCP_ELICITATION_TOOL_PREFIX = "mcp_elicitation:";
+function describeElicitationPrompt(tool, inputJson) {
+  if (!tool.startsWith(MCP_ELICITATION_TOOL_PREFIX))
+    return;
+  let parsed;
+  try {
+    parsed = JSON.parse(inputJson);
+  } catch {
+    return { message: inputJson, command: undefined };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { message: inputJson, command: undefined };
+  }
+  const obj = parsed;
+  const message2 = typeof obj.message === "string" && obj.message.trim().length > 0 ? obj.message : "codex is requesting approval for an action";
+  const vendor = typeof obj.vendor === "object" && obj.vendor !== null ? obj.vendor : {};
+  const command = extractCodexCommand(vendor)?.join(" ");
+  return { message: message2, command };
+}
+
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
@@ -55078,6 +56696,10 @@ function onKeypress2(r, handler) {
   return () => r._internalKeyInput.offInternal("keypress", handler);
 }
 function showComposerChoice(otui, r, dock, request) {
+  if (dock.visible === true) {
+    request.onBusy?.();
+    return Promise.resolve(request.cancelId);
+  }
   return new Promise((resolve3) => {
     const options = request.options.map((o) => ({
       ...o,
@@ -58556,6 +60178,275 @@ ${rows.join(`
   (none)`}
 `;
 }
+async function selectSearchProviderAndReport(controller, onSystem, providerId) {
+  const result = await controller.select(providerId);
+  if (!result.ok) {
+    if (result.reason === "not-configured") {
+      onSystem?.(`Cannot select '${providerId}': provider is not configured.
+`);
+    } else if (result.reason === "not-connected") {
+      onSystem?.(`Cannot select '${providerId}': provider is not connected (run /search-provider ${providerId} <params> to test).
+`);
+    } else {
+      onSystem?.(`Cannot select '${providerId}': ${result.reason}.
+`);
+    }
+    return;
+  }
+  onSystem?.(`Search provider '${providerId}' selected.
+`);
+}
+function promptSearchFieldStep(otui, r, field3, value) {
+  return new Promise((resolve3) => {
+    const box = overlayBox(otui, r, "search-field-picker");
+    r.root.add(box);
+    box.add(new otui.TextRenderable(r, { id: "sf-title", content: otui.t`${otui.bold(field3.label)} ${otui.dim(`${field3.required ? "required" : "optional"} \xB7 Enter \xB7 Esc to go back`)}` }));
+    const input2 = new otui.InputRenderable(r, { id: "sf-input", value, marginTop: 1 });
+    box.add(input2);
+    input2.focus();
+    const cleanup = () => {
+      unsub();
+      input2.blur();
+      r.root.remove(box);
+    };
+    const unsub = onKeypress4(r, (key) => {
+      if (key.name === "escape") {
+        cleanup();
+        resolve3({ kind: "back" });
+        key.preventDefault();
+        key.stopPropagation();
+      }
+    });
+    input2.on(otui.InputRenderableEvents.ENTER, () => {
+      const entered = input2.value.trim();
+      cleanup();
+      resolve3({ kind: "value", value: entered });
+    });
+  });
+}
+function promptSearchCredentialStep(otui, r, opts) {
+  return new Promise((resolve3) => {
+    const box = overlayBox(otui, r, "search-credential-picker");
+    r.root.add(box);
+    box.add(new otui.TextRenderable(r, { id: "sc-title", content: otui.t`${otui.bold(`Paste your ${opts.label}`)} ${otui.dim("(Enter \xB7 Esc to go back)")}` }));
+    box.add(new otui.TextRenderable(r, {
+      id: "sc-note",
+      content: otui.t`${otui.dim("Saved to your keryx config dir (owner-only, 0600)")}`,
+      marginTop: 1
+    }));
+    const keyInput = new otui.InputRenderable(r, { id: "sc-input", placeholder: "...", marginTop: 1 });
+    box.add(keyInput);
+    keyInput.focus();
+    const cleanup = () => {
+      unsub();
+      keyInput.blur();
+      r.root.remove(box);
+    };
+    const unsub = onKeypress4(r, (key) => {
+      if (key.name === "escape") {
+        cleanup();
+        resolve3({ kind: "back" });
+        key.preventDefault();
+        key.stopPropagation();
+      }
+    });
+    keyInput.on(otui.InputRenderableEvents.ENTER, () => {
+      const value = keyInput.value.trim();
+      cleanup();
+      resolve3(value.length > 0 ? { kind: "key", value } : { kind: "skip" });
+    });
+  });
+}
+function promptSetActiveProviderStep(otui, r) {
+  return new Promise((resolve3) => {
+    const box = overlayBox(otui, r, "search-active-picker");
+    r.root.add(box);
+    box.add(new otui.TextRenderable(r, { id: "sa-title", content: otui.t`${otui.bold("Set as active provider after a successful test?")} ${otui.dim("(\u2191/\u2193, Enter \xB7 Esc to go back)")}` }));
+    const select = new otui.SelectRenderable(r, {
+      id: "sa-select",
+      width: 60,
+      height: selectBoxHeight(2, true),
+      options: [
+        { name: "Yes", description: "select it once the test passes" },
+        { name: "No", description: "leave it configured but inactive" }
+      ],
+      selectedTextColor: "#ffd166"
+    });
+    box.add(select);
+    select.focus();
+    const cleanup = () => {
+      unsub();
+      select.blur();
+      r.root.remove(box);
+    };
+    const unsub = onKeypress4(r, (key) => {
+      if (key.name === "escape") {
+        cleanup();
+        resolve3(undefined);
+        key.preventDefault();
+        key.stopPropagation();
+      }
+    });
+    select.on(otui.SelectRenderableEvents.ITEM_SELECTED, () => {
+      const chosen = select.getSelectedOption();
+      cleanup();
+      resolve3(chosen === null ? undefined : chosen.name === "Yes");
+    });
+  });
+}
+function pickSearchProviderStep(otui, r, providers) {
+  return new Promise((resolve3) => {
+    const box = overlayBox(otui, r, "search-provider-picker");
+    r.root.add(box);
+    box.add(new otui.TextRenderable(r, { id: "spp-title", content: otui.t`${otui.bold("Select a search provider")} ${otui.dim("(\u2191/\u2193, Enter \xB7 Esc to cancel)")}` }));
+    const labelOf = (p) => `${p.id} (${p.displayName})`;
+    const select = new otui.SelectRenderable(r, {
+      id: "spp-select",
+      width: 60,
+      height: selectBoxHeight(providers.length, true),
+      showScrollIndicator: true,
+      options: providers.map((p) => ({ name: labelOf(p), description: p.kind })),
+      selectedTextColor: "#ffd166"
+    });
+    box.add(select);
+    select.focus();
+    const cleanup = () => {
+      unsub();
+      select.blur();
+      r.root.remove(box);
+    };
+    const unsub = onKeypress4(r, (key) => {
+      if (key.name === "escape") {
+        cleanup();
+        resolve3(undefined);
+        key.preventDefault();
+        key.stopPropagation();
+      }
+    });
+    select.on(otui.SelectRenderableEvents.ITEM_SELECTED, () => {
+      const chosen = select.getSelectedOption();
+      cleanup();
+      resolve3(chosen === null ? undefined : providers.find((p) => labelOf(p) === chosen.name));
+    });
+  });
+}
+async function runSearchProviderFieldsStep(otui, r, provider, seed) {
+  const subSteps = [
+    ...provider.fields.map((field3) => ({ kind: "field", field: field3 })),
+    ...provider.credentialSchema.required ? [{ kind: "credential" }] : [],
+    { kind: "toggle" }
+  ];
+  const fields = { ...seed.fields };
+  let credential2 = seed.credential;
+  let setActive = seed.setActive;
+  let index = 0;
+  while (index < subSteps.length) {
+    const step = subSteps[index];
+    if (step === undefined)
+      break;
+    if (step.kind === "field") {
+      const result = await promptSearchFieldStep(otui, r, step.field, fields[step.field.id] ?? step.field.defaultValue ?? "");
+      if (result.kind === "back") {
+        index -= 1;
+        if (index < 0)
+          return { kind: "back" };
+        continue;
+      }
+      fields[step.field.id] = result.value;
+      index += 1;
+      continue;
+    }
+    if (step.kind === "credential") {
+      const result = await promptSearchCredentialStep(otui, r, {
+        label: provider.credentialSchema.label ?? `${provider.displayName} credential`
+      });
+      if (result.kind === "back") {
+        index -= 1;
+        if (index < 0)
+          return { kind: "back" };
+        continue;
+      }
+      credential2 = result.kind === "key" ? result.value : undefined;
+      index += 1;
+      continue;
+    }
+    const toggle = await promptSetActiveProviderStep(otui, r);
+    if (toggle === undefined) {
+      index -= 1;
+      if (index < 0)
+        return { kind: "back" };
+      continue;
+    }
+    setActive = toggle;
+    index += 1;
+  }
+  return { kind: "done", fields, credential: credential2, setActive };
+}
+function runSearchProviderTestStep(otui, r, controller, provider, fields, credential2, setActive) {
+  return new Promise((resolve3) => {
+    const box = overlayBox(otui, r, "search-test-picker");
+    r.root.add(box);
+    const status = new otui.TextRenderable(r, { id: "st-title", content: otui.t`${otui.bold(`Testing '${provider.id}'`)} ${otui.dim("...")}` });
+    box.add(status);
+    let settled;
+    const cleanup = () => {
+      unsub();
+      r.root.remove(box);
+    };
+    const unsub = onKeypress4(r, (key) => {
+      if (settled === "failure" && key.name === "escape") {
+        cleanup();
+        resolve3("retry");
+        key.preventDefault();
+        key.stopPropagation();
+      } else if (settled === "success" && (key.name === "return" || key.name === "linefeed" || key.name === "kpenter")) {
+        cleanup();
+        resolve3("done");
+        key.preventDefault();
+        key.stopPropagation();
+      }
+    });
+    (async () => {
+      controller.configure(provider.id, { ...provider.defaults, ...fields }, credential2);
+      const tested = await controller.test(provider.id);
+      if (!tested.ok) {
+        settled = "failure";
+        const reason = tested.reason === "missing-credential" ? "missing credential" : "connection validation failed";
+        status.content = otui.t`${otui.red("\u2717")} ${otui.bold(`'${provider.id}' test failed: ${reason}`)} ${otui.dim("(Esc to go back and retry)")}`;
+        return;
+      }
+      settled = "success";
+      if (!setActive) {
+        status.content = otui.t`${otui.green("\u2713")} ${otui.bold(`'${provider.id}' configured and tested successfully`)} ${otui.dim("(Enter to close)")}`;
+        return;
+      }
+      const selected = await controller.select(provider.id);
+      status.content = selected.ok ? otui.t`${otui.green("\u2713")} ${otui.bold(`'${provider.id}' configured, tested, and set as active`)} ${otui.dim("(Enter to close)")}` : otui.t`${otui.green("\u2713")} ${otui.bold(`'${provider.id}' configured and tested`)} ${otui.dim(`but could not be set active (${selected.reason ?? "unknown"})`)} ${otui.dim("(Enter to close)")}`;
+    })();
+  });
+}
+async function searchProviderWizardInTui(otui, r, controller) {
+  const providers = controller.configurable();
+  providerLoop:
+    while (true) {
+      const provider = await pickSearchProviderStep(otui, r, providers);
+      if (provider === undefined) {
+        return;
+      }
+      let seed = { fields: { ...provider.defaults }, credential: undefined, setActive: false };
+      while (true) {
+        const step2 = await runSearchProviderFieldsStep(otui, r, provider, seed);
+        if (step2.kind === "back") {
+          continue providerLoop;
+        }
+        seed = { fields: step2.fields, credential: step2.credential, setActive: step2.setActive };
+        const result = await runSearchProviderTestStep(otui, r, controller, provider, seed.fields, seed.credential, seed.setActive);
+        if (result === "done") {
+          return;
+        }
+      }
+    }
+}
 function promptBaseUrlStep(otui, r, label, baseUrl2) {
   return new Promise((resolve3) => {
     const box = overlayBox(otui, r, "base-url-picker");
@@ -59032,7 +60923,13 @@ async function launchTuiAgentShell(opts) {
     const sbContext = new otui.TextRenderable(r, { id: "sb-ctx-v", content: otui.t`${otui.dim("0 tokens")}` });
     sidebar.add(sbContext);
     sidebar.add(new otui.TextRenderable(r, { id: "sb-tools-k", content: otui.t`${otui.dim("Tools")}`, marginTop: 1 }));
-    sidebar.add(new otui.TextRenderable(r, { id: "sb-tools-v", content: otui.t`${otui.dim(`${deps.tools.length} available`)}` }));
+    sidebar.add(new otui.TextRenderable(r, {
+      id: "sb-tools-v",
+      content: otui.t`${otui.dim(`${deps.tools.length} available`)}`,
+      onMouseDown: () => {
+        showTools();
+      }
+    }));
     sidebar.add(new otui.TextRenderable(r, { id: "sb-status-k", content: otui.t`${otui.dim("Status")}`, marginTop: 1 }));
     const sbWorkers = new otui.TextRenderable(r, {
       id: "sb-status-v",
@@ -59332,6 +61229,51 @@ async function launchTuiAgentShell(opts) {
         }));
         return id === "allow";
       }
+      if (tool.startsWith(MCP_ELICITATION_TOOL_PREFIX)) {
+        const described = describeElicitationPrompt(tool, inputJson) ?? { message: inputJson, command: undefined };
+        transcript.add(new otui.TextRenderable(r, {
+          id: `ap${uid++}`,
+          content: otui.t`${otui.yellow("\u2699 codex is requesting approval")}`
+        }));
+        transcript.add(new otui.TextRenderable(r, { id: `ap${uid++}`, content: otui.t`${otui.dim(described.message)}` }));
+        if (described.command !== undefined) {
+          transcript.add(new otui.TextRenderable(r, {
+            id: `ap${uid++}`,
+            content: otui.t`${otui.dim(`command: ${described.command}`)}`
+          }));
+        }
+        if (meta?.destructive === true) {
+          transcript.add(new otui.TextRenderable(r, {
+            id: `ap${uid++}`,
+            content: otui.t`${otui.yellow("deletes a file, touches .git/, or touches many files in one call")}`
+          }));
+        }
+        if (meta?.credentials === true) {
+          transcript.add(new otui.TextRenderable(r, {
+            id: `ap${uid++}`,
+            content: otui.t`${otui.yellow("touches the agent's own permission/credential files")}`
+          }));
+        }
+        chrome.hideMenu();
+        setMainAgent("blocked", "approval");
+        const elicitationSubtitle = described.message.length > 80 ? `${described.message.slice(0, 77)}\u2026` : described.message;
+        const id = await showComposerChoice(otui, r, chrome.dock, {
+          title: "Approve codex elicitation?",
+          subtitle: elicitationSubtitle,
+          cancelId: "deny",
+          options: [
+            { id: "allow", label: "Approve", description: "codex proceeds with this action", recommended: true },
+            { id: "deny", label: "Deny", description: "codex's action is refused" }
+          ]
+        });
+        input2.focus();
+        setMainAgent("running", id === "allow" ? "write" : "denied");
+        transcript.add(new otui.TextRenderable(r, {
+          id: `ap${uid++}`,
+          content: id === "allow" ? otui.t`${otui.green("\u25C7 codex elicitation approved")}` : otui.t`${otui.red("\u25C7 codex elicitation denied")}`
+        }));
+        return id === "allow";
+      }
       const ev = evaluateShellApproval({
         inputJson,
         ...meta !== undefined ? { meta } : {},
@@ -59762,7 +61704,8 @@ Staying in the current session.
         openReview(otui, chrome, {
           items,
           acceptProposal: (item) => acceptProposalViaShell(makeCommandRunner(cwd), item.workspaceId, item.proposalId),
-          onAccepted: () => {
+          declineProposal: (item) => declineProposalViaShell(makeCommandRunner(cwd), item.workspaceId, item.proposalId),
+          onResolved: () => {
             refreshReviewSidebar();
           },
           renderer: r,
@@ -59770,6 +61713,38 @@ Staying in the current session.
         });
       })();
     };
+    const showTools = () => {
+      (async () => {
+        const cwd = inspectorCwd();
+        const runtimes = await mcpClientStatus(cwd, mcpRuntimeIds());
+        openMcpTools(otui, chrome, {
+          tools: deps.tools.map((t) => t.definition),
+          runtimes,
+          connect: async (id) => {
+            try {
+              const report = await installMcpClient(cwd, [id]);
+              const outcome = report.outcomes[0];
+              if (outcome !== undefined && outcome.errors.length > 0) {
+                return { ok: false, message: outcome.errors.join("; ") };
+              }
+              return { ok: true };
+            } catch (error2) {
+              return { ok: false, message: error2 instanceof Error ? error2.message : String(error2) };
+            }
+          },
+          disconnect: async (id) => {
+            try {
+              await uninstallMcpClient(cwd, [id]);
+              return { ok: true };
+            } catch (error2) {
+              return { ok: false, message: error2 instanceof Error ? error2.message : String(error2) };
+            }
+          },
+          renderer: r,
+          ...inspectorKeys
+        });
+      })();
+    };
     const runModeCommand = (line) => {
       const modeArgs = line.trim().split(/\s+/).slice(1).filter((p) => p.length > 0);
       const wanted = modeArgs[0] ?? "";
@@ -59777,6 +61752,7 @@ Staying in the current session.
       const applyMode = async (next) => {
         if (next === "auto") {
           chrome.hideMenu();
+          let blockedByOpenDialog = false;
           const confirmId = await chrome.withOverlay(() => showComposerChoice(otui, r, chrome.dock, {
             title: "Switch to auto mode?",
             subtitle: "Skips confirmation for EVERY action, including destructive commands. Only credential-touching commands still ask.",
@@ -59784,9 +61760,16 @@ Staying in the current session.
             options: [
               { id: "confirm", label: "Confirm", description: "I understand the risk" },
               { id: "cancel", label: "Cancel", description: "Keep the current mode", recommended: true }
-            ]
+            ],
+            onBusy: () => {
+              blockedByOpenDialog = true;
+              chrome.showToast("Answer the open approval first, then retry /mode.");
+            }
           }));
           input2.focus();
+          if (blockedByOpenDialog) {
+            return;
+          }
           if (confirmId !== "confirm") {
             chrome.showToast("Cancelled \u2014 mode unchanged.");
             return;
@@ -59816,6 +61799,7 @@ Staying in the current session.
       const stored = getProjectPermissionMode(sessionCwd);
       chrome.hideMenu();
       (async () => {
+        let blockedByOpenDialog = false;
         const id = await chrome.withOverlay(() => showComposerChoice(otui, r, chrome.dock, {
           title: `Permission mode (current: ${permissionMode})`,
           subtitle: stored !== undefined ? `Project default: ${stored}` : "No project default set.",
@@ -59825,9 +61809,16 @@ Staying in the current session.
             label: m,
             description: MODE_PICKER_DESCRIPTIONS[m],
             recommended: m === permissionMode
-          }))
+          })),
+          onBusy: () => {
+            blockedByOpenDialog = true;
+            chrome.showToast("Answer the open approval first, then retry /mode.");
+          }
         }));
         input2.focus();
+        if (blockedByOpenDialog) {
+          return;
+        }
         if (isPermissionMode(id) && id !== permissionMode) {
           await applyMode(id);
         }
@@ -60225,7 +62216,8 @@ Staying in the current session.
           isSessionInfo: isSessionInfoCommand(line),
           isFlows: isFlowsCommand(line),
           isWorkspace: isWorkspaceCommand(line),
-          isReview: isReviewCommand(line)
+          isReview: isReviewCommand(line),
+          isMcp: isMcpToolsCommand(line)
         });
         switch (decision) {
           case "exit": {
@@ -60333,6 +62325,10 @@ Staying in the current session.
             showReview();
             return;
           }
+          case "mcp": {
+            showTools();
+            return;
+          }
           case "deferred": {
             transcript.add(new otui.TextRenderable(r, {
               id: `c${uid++}`,
@@ -60356,6 +62352,7 @@ Staying in the current session.
           return;
         }
         (async () => {
+          let blockedByOpenDialog = false;
           const chosen = await showComposerChoice(otui, r, chrome.dock, {
             title: "Main agent is busy",
             subtitle: line,
@@ -60363,8 +62360,17 @@ Staying in the current session.
               { id: "main", label: "Main queue", description: "queue for the main agent; remove/edit/force later", recommended: true },
               { id: "side", label: "Side-1", description: "read-only answer, outside main history (as before)" }
             ],
-            cancelId: "side"
+            cancelId: "side",
+            onBusy: () => {
+              blockedByOpenDialog = true;
+              chrome.showToast("Answer the open approval first, then resend.");
+            }
           });
+          if (blockedByOpenDialog) {
+            input2.value = line;
+            input2.focus();
+            return;
+          }
           if (chosen === "main") {
             const id = `mq${mainQueueSeq++}`;
             mainQueue.push({ id, question: line, displayQuestion: displayLine });
@@ -60459,7 +62465,8 @@ Staying in the current session.
             const args2 = parseSearchProviderArgs(line.slice(16));
             const all = searchProviderController.configurable();
             if (args2.providerId === undefined) {
-              io.onSystem?.(describeSearchProviderList("Search providers (use /search-provider <id> [key=...]):", all));
+              await chrome.withOverlay(() => searchProviderWizardInTui(otui, r, searchProviderController));
+              input2.focus();
               return;
             }
             const descriptor = all.find((candidate) => candidate.id === args2.providerId);
@@ -60488,11 +62495,18 @@ Staying in the current session.
             const providerId = args2.providerId;
             if (providerId === undefined) {
               const selectable = searchProviderController.selectable();
-              io.onSystem?.(describeSearchProviderList("Connected search providers (use /search-connect <id> to select):", selectable));
               if (selectable.length === 0) {
+                io.onSystem?.(describeSearchProviderList("Connected search providers (use /search-connect <id> to select):", selectable));
                 io.onSystem?.(`No connected search providers found. Run /search-provider first.
 `);
+                return;
+              }
+              const picked = await chrome.withOverlay(() => pickSearchProviderStep(otui, r, selectable));
+              input2.focus();
+              if (picked === undefined) {
+                return;
               }
+              await selectSearchProviderAndReport(searchProviderController, io.onSystem, picked.id);
               return;
             }
             const normalizedProviderId = searchProviderController.configurable().find((candidate) => candidate.id === providerId)?.id;
@@ -60501,22 +62515,7 @@ Staying in the current session.
 `);
               return;
             }
-            const result = await searchProviderController.select(normalizedProviderId);
-            if (!result.ok) {
-              if (result.reason === "not-configured") {
-                io.onSystem?.(`Cannot select '${providerId}': provider is not configured.
-`);
-              } else if (result.reason === "not-connected") {
-                io.onSystem?.(`Cannot select '${providerId}': provider is not connected (run /search-provider ${providerId} <params> to test).
-`);
-              } else {
-                io.onSystem?.(`Cannot select '${providerId}': ${result.reason}.
-`);
-              }
-              return;
-            }
-            io.onSystem?.(`Search provider '${providerId}' selected.
-`);
+            await selectSearchProviderAndReport(searchProviderController, io.onSystem, normalizedProviderId);
           })();
           return;
         }
@@ -60550,6 +62549,10 @@ Staying in the current session.
           showReview();
           return;
         }
+        if (isMcpToolsCommand(command.name)) {
+          showTools();
+          return;
+        }
         if (command.name === "/copy") {
           const target = newestBlock();
           if (target === undefined || !copyBlock(target.id)) {
@@ -61256,6 +63259,8 @@ init_guard2();
 init_providers();
 var DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434";
 var ANTHROPIC_MODELS = ["claude-sonnet-5", "claude-opus-4-8", "claude-haiku-4-5"];
+var OPENAI_MODELS = ["gpt-5.6", "gpt-5.6-terra", "gpt-5.6-luna"];
+var GEMINI_MODELS = ["gemini-3.7-flash", "gemini-2.5-pro", "gemini-2.5-flash-lite"];
 var FAKE_MODELS = ["fake-echo"];
 function isEmbeddingModel(model) {
   const name = typeof model.name === "string" ? model.name.toLowerCase() : "";
@@ -61316,6 +63321,14 @@ async function detectProviders(deps) {
   if (typeof anthropicKey === "string" && anthropicKey.length > 0) {
     detected.push({ name: "anthropic", models: [...ANTHROPIC_MODELS] });
   }
+  const openaiKey = deps.env.OPENAI_API_KEY;
+  if (typeof openaiKey === "string" && openaiKey.length > 0) {
+    detected.push({ name: "openai", models: [...OPENAI_MODELS] });
+  }
+  const geminiKey = deps.env.GEMINI_API_KEY ?? deps.env.GOOGLE_API_KEY;
+  if (typeof geminiKey === "string" && geminiKey.length > 0) {
+    detected.push({ name: "gemini", models: [...GEMINI_MODELS] });
+  }
   for (const p of OPENAI_COMPAT_PROVIDERS) {
     if (!isProviderPlatformSupported(p, platform)) {
       continue;
@@ -62154,6 +64167,37 @@ ${GUTTER}${style.dim("[y/N] ")}`);
         const approved2 = /^y(es)?$/i.test(answer2);
         out(approved2 ? style.green(`approved
 `) : style.red(`denied
+`));
+        if (!approved2) {
+          return false;
+        }
+        return meta?.fingerprint !== undefined ? { approved: true, fingerprint: meta.fingerprint } : true;
+      }
+      if (tool.startsWith(MCP_ELICITATION_TOOL_PREFIX)) {
+        const described = describeElicitationPrompt(tool, input2) ?? { message: input2, command: undefined };
+        out(`
+${GUTTER}${style.yellow("Approve codex elicitation?")}
+`);
+        out(`${indentBlock(described.message, GUTTER)}
+`);
+        if (described.command !== undefined) {
+          out(`${GUTTER}${style.dim(`command: ${described.command}`)}
+`);
+        }
+        if (meta?.destructive === true) {
+          out(`${GUTTER}${style.yellow("deletes a file, touches .git/, or touches many files in one call")}
+`);
+        }
+        if (meta?.credentials === true) {
+          out(`${GUTTER}${style.yellow("touches the agent's own permission/credential files")}
+`);
+        }
+        out(`
+${GUTTER}${style.dim("[y/N] ")}`);
+        const answer2 = (await readLine() ?? "").trim();
+        const approved2 = /^y(es)?$/i.test(answer2);
+        out(approved2 ? style.green(`approved
+`) : style.red(`denied
 `));
         if (!approved2) {
           return false;
@@ -65129,7 +67173,7 @@ function printHelp17() {
 
 // src/commands/update.ts
 import { spawn as spawn5 } from "child_process";
-import { chmod as chmod4, mkdir as mkdir55, readFile as readFile79, readdir as readdir25, writeFile as writeFile49 } from "fs/promises";
+import { chmod as chmod4, mkdir as mkdir55, readFile as readFile79, readdir as readdir26, writeFile as writeFile49 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync30 } from "fs";
 import path156 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
@@ -65481,7 +67525,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
   }
   let dirEntries;
   try {
-    dirEntries = (await readdir25(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
+    dirEntries = (await readdir26(flowsRoot2, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
   } catch {
     return null;
   }
@@ -65775,7 +67819,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   return pages;
 }
 async function listMarkdownFiles(root) {
-  const entries = await readdir25(root, { withFileTypes: true });
+  const entries = await readdir26(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const fullPath = path156.join(root, entry.name);
@@ -66215,7 +68259,7 @@ async function runPostUpdateHooks(projectRoot) {
   if (!await pathExists(hooksDir)) {
     return;
   }
-  const entries = (await readdir25(hooksDir)).sort();
+  const entries = (await readdir26(hooksDir)).sort();
   for (const entry of entries) {
     const hookPath = path156.join(hooksDir, entry);
     try {
@@ -67921,7 +69965,7 @@ function oracleRates(score) {
     rates.recall = deriveRate(score.truePositives, score.goldSize, ORACLE_RELIABILITY);
   return Object.keys(rates).length > 0 ? rates : undefined;
 }
-var DEFAULT_MODEL3 = "gdgraph-oracle";
+var DEFAULT_MODEL5 = "gdgraph-oracle";
 var GOLD_KIND_LABELS = {
   "co-change": "co-change prediction",
   dependency: "graph correctness"
@@ -67960,7 +70004,7 @@ function scoreGoldRun(input2, named, options = {}) {
     variant: "baseline",
     run_id: `${taskId}#1`,
     ladder: options.ladder ?? "metastore",
-    model: options.model ?? DEFAULT_MODEL3,
+    model: options.model ?? DEFAULT_MODEL5,
     cacheState: options.cacheState ?? "unknown",
     leakageAssertion: options.leakageAssertion ?? "not-applicable",
     caseKind: "deterministic",
@@ -68204,7 +70248,7 @@ function buildEvidenceBundle(input2, options = {}) {
     run: {
       target: score.target,
       variant,
-      model: options.model ?? DEFAULT_MODEL3,
+      model: options.model ?? DEFAULT_MODEL5,
       seed,
       cacheState: options.cacheState ?? "unknown",
       startedAt: timestamp,
@@ -69195,7 +71239,7 @@ keryx workspace list-proposals [<workspace-id>]`);
 }
 function renderCatchUp(report, includeLifecycleFlags = true) {
   const sections = [];
-  sections.push(renderSection("Pending proposals", report.proposals, (item) => `- Accept, reject, or dismiss proposal ${item.proposalId} in workspace ${item.workspaceId}? ` + `Recommendation: ${item.fresh ? "evidence is fresh \u2014 review now (`keryx workspace review " + item.workspaceId + " " + item.proposalId + " --decision <accepted|rejected|dismissed>`)" : "evidence has drifted since this proposal was created \u2014 treat as stale, re-run wrap-up before deciding"}.`));
+  sections.push(renderSection("Pending proposals", report.proposals, (item) => `- Accept, reject, or dismiss ${item.kind} proposal ${item.proposalId} in workspace ${item.workspaceId}` + `${item.note !== undefined ? `: "${item.note}"` : ""}? ` + `Recommendation: ${item.fresh ? "evidence is fresh \u2014 review now (`keryx workspace review " + item.workspaceId + " " + item.proposalId + " --decision <accepted|rejected|dismissed>`)" : "evidence has drifted since this proposal was created \u2014 treat as stale, re-run wrap-up before deciding"}.`));
   sections.push(renderSection("Blocked sessions (stopped unattended)", report.blocked, (item) => `- Session ${item.sessionId} stopped unattended (${item.terminalState.reason}) at ${item.terminalState.occurredAt}. Resume it, or archive and move on? ` + `Recommendation: \`keryx shell -r ${item.sessionId}\` to resume and unblock it.`));
   sections.push(renderSection("Unbound candidates (wrap-up ran, no workspace bound)", report.unboundCandidates, (item) => `- Session ${item.sessionId} produced untriaged seeds with no workspace bound (${item.summary}). Bind to a workspace and propose, or discard? ` + `Recommendation: pick a workspace, then \`keryx workspace propose <workspace-id> --kind <kind> --session ${item.sessionId}\` (evidence: ${item.evidencePath}).`));
   sections.push(renderSection("Unknown (no resolution recorded)", report.unknown, (item) => `- Session ${item.sessionId} was last seen ${item.lastSeenAt} with no proposal, terminal state, or unbound-candidate artifact recorded. Investigate, or ignore? ` + `Recommendation: \`keryx sessions list\` / \`keryx shell -r ${item.sessionId}\` to see what happened.`));
@@ -69403,6 +71447,6 @@ if (import.meta.main) {
   });
 }
 export {
-  main,
-  CLI_ROUTES
+  CLI_ROUTES,
+  main
 };