@mrciphersmith/keryx 0.2.84 → 0.2.88

package/dist/cli.js

@@ -923,6 +923,7 @@ var init_providers = __esm(() => {
       label: "xAI (Grok)",
       baseUrl: "https://api.x.ai",
       envKey: "XAI_API_KEY",
+      streamUsage: true,
       models: ["grok-2-latest", "grok-2", "grok-beta"],
       note: "xAI \xB7 OpenAI-compatible"
     },
@@ -2343,6 +2344,7 @@ ${message.content}` });
     const payload = {
       model: request.modelId,
       stream: true,
+      ...this.deps.grant?.streamUsage === true ? { stream_options: { include_usage: true } } : {},
       messages,
       ...request.tools !== undefined ? {
         tools: request.tools.map((tool) => ({
@@ -3696,6 +3698,7 @@ function makeProvider(name, _model, opts) {
     }
     const grant = {
       network: true,
+      ...compat.streamUsage === true ? { streamUsage: true } : {},
       baseUrl: opts.baseUrl ?? resolveProviderBaseUrl(compat, env),
       ...compat.allowLoopback === true ? { allowLoopback: true } : {},
       ...compat.allowPrivateLan === true ? { allowPrivateLan: true } : {},
@@ -35094,6 +35097,7 @@ function createFlowService(deps) {
           acChecksum: null,
           acConfirmed: {},
           pr: { url: null },
+          ...input.baseBranch === undefined ? {} : { baseBranch: input.baseBranch },
           tasks: DEFAULT_TASKS.map((task) => ({ ...task, status: "todo" })),
           history: [{ at: createdAt, event: "created" }]
         };
@@ -35302,6 +35306,10 @@ function createFlowService(deps) {
           if (!pr.isDraft) {
             detail += " (warning: PR is not a draft)";
           }
+          if (flow.baseBranch === undefined && typeof pr.baseRefName === "string" && pr.baseRefName !== "") {
+            flow.baseBranch = pr.baseRefName;
+            detail += ` (base: ${pr.baseRefName})`;
+          }
         } else {
           detail += " (tracker unavailable: existence not verified)";
         }
@@ -35353,6 +35361,7 @@ function createFlowService(deps) {
             detail: "tracker unavailable; verify PR checks manually"
           });
         }
+        gates.push(await baseBranchCondition(cwd, flow, mergedCommit ?? undefined, flow.pr.url && deps.tracker && await deps.tracker.detect() ? (await deps.tracker.prStatus(flow.pr.url)).baseRefName : undefined, commitContainedIn));
         gates.push(taskGate(flow));
         try {
           gates.push(await reviewGate({
@@ -35657,6 +35666,70 @@ function buildIssueComment2(flow, gates) {
   ].join(`
 `);
 }
+async function baseBranchCondition(cwd, flow, mergedCommit, prBase, containedIn) {
+  const recorded = flow.baseBranch;
+  if (recorded === undefined || recorded.trim() === "") {
+    return {
+      name: "base-branch",
+      status: "skipped",
+      detail: "not recorded: this flow never named a base branch, so there is nothing to compare the merge against. Not a pass \u2014 `keryx flow init --base <branch>` or `flow implemented --pr <url>` records one."
+    };
+  }
+  if (mergedCommit !== undefined) {
+    const contained = await containedIn(cwd, mergedCommit, `origin/${recorded}`);
+    if (contained === null) {
+      return {
+        name: "base-branch",
+        status: "fail",
+        detail: `unobserved: origin/${recorded} could not be resolved, so whether ${mergedCommit} landed there is unknown. Fetch the remote (\`git fetch origin ${recorded}\`) and re-run; an unresolvable base is not a passing one.`
+      };
+    }
+    return contained ? {
+      name: "base-branch",
+      status: "pass",
+      detail: `${mergedCommit} is contained in origin/${recorded}, the base this flow recorded`
+    } : {
+      name: "base-branch",
+      status: "fail",
+      detail: `violated: this flow recorded base ${recorded}, but ${mergedCommit} is not contained in origin/${recorded}. The merge landed somewhere else.`
+    };
+  }
+  if (prBase === undefined || prBase === null || prBase === "") {
+    return {
+      name: "base-branch",
+      status: "fail",
+      detail: `unobserved: this flow recorded base ${recorded}, but the tracker did not report the pull request's base. An unread base is not a matching one.`
+    };
+  }
+  return prBase === recorded ? {
+    name: "base-branch",
+    status: "pass",
+    detail: `the pull request targets ${prBase}, the base this flow recorded`
+  } : {
+    name: "base-branch",
+    status: "fail",
+    detail: `violated: this flow recorded base ${recorded}, but the pull request now targets ${prBase}. It was retargeted after the base was recorded.`
+  };
+}
+async function commitContainedIn(cwd, commit, ref) {
+  if (!/^[0-9a-f]{7,64}$/i.test(commit)) {
+    return null;
+  }
+  const resolved = Bun.spawn(["git", "rev-parse", "--verify", `${ref}^{commit}`], {
+    cwd,
+    stdout: "ignore",
+    stderr: "ignore"
+  });
+  if (await resolved.exited !== 0) {
+    return null;
+  }
+  const process2 = Bun.spawn(["git", "merge-base", "--is-ancestor", commit, ref], {
+    cwd,
+    stdout: "ignore",
+    stderr: "ignore"
+  });
+  return await process2.exited === 0;
+}
 async function verifyCommitOnMain(cwd, commit) {
   if (!/^[0-9a-f]{7,64}$/i.test(commit)) {
     return { status: "fail", detail: "merged commit must be a hexadecimal Git commit id" };
@@ -35736,9 +35809,9 @@ var init_github = __esm(() => {
     },
     async prStatus(url) {
       try {
-        const view = await gh(["pr", "view", url, "--json", "isDraft,state,headRefOid"]);
+        const view = await gh(["pr", "view", url, "--json", "isDraft,state,headRefOid,baseRefName"]);
         if (view.exitCode !== 0) {
-          return { exists: false, isDraft: false, checksGreen: null, headSha: null };
+          return { exists: false, isDraft: false, checksGreen: null, headSha: null, baseRefName: null };
         }
         const parsed = JSON.parse(view.stdout);
         const checks = await gh(["pr", "checks", url]);
@@ -35746,10 +35819,11 @@ var init_github = __esm(() => {
           exists: true,
           isDraft: parsed.isDraft === true,
           checksGreen: checks.exitCode === 0,
-          headSha: typeof parsed.headRefOid === "string" && parsed.headRefOid !== "" ? parsed.headRefOid : null
+          headSha: typeof parsed.headRefOid === "string" && parsed.headRefOid !== "" ? parsed.headRefOid : null,
+          baseRefName: typeof parsed.baseRefName === "string" && parsed.baseRefName !== "" ? parsed.baseRefName : null
         };
       } catch {
-        return { exists: false, isDraft: false, checksGreen: null, headSha: null };
+        return { exists: false, isDraft: false, checksGreen: null, headSha: null, baseRefName: null };
       }
     },
     async comment(ref, body) {
@@ -40091,9 +40165,9 @@ var init_memory = __esm(() => {
 
 // src/lib/serve-config.ts
 import { existsSync as existsSync25 } from "fs";
-import path167 from "path";
+import path168 from "path";
 function serveConfigPath(dir) {
-  return path167.join(keryxConfigDir(dir), "serve.json");
+  return path168.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -43232,63 +43306,112 @@ var CONTRACTS = [
   {
     name: "agent-event",
     fileName: "agent-event.schema.json",
-    description: "Append-only lifecycle event emitted by orchestrators and subagents."
+    description: "Append-only lifecycle event emitted by orchestrators and subagents.",
+    enforcement: {
+      kind: "none",
+      reason: "Events are appended by whichever agent is running, in that agent's own runtime. No keryx process sits between the emitter and the log, so there is no point at which a malformed event could be refused rather than written."
+    }
   },
   {
     name: "flow-orchestrator-input",
     fileName: "flow-orchestrator-input-contract.schema.json",
     description: "Dispatch payload handed to flow-orchestrator (request + base branch + completion outcome + constraints).",
-    sourcePath: "src/gdskills/bundled/skills/orchestration/flow-orchestrator/input-contract.schema.json"
+    sourcePath: "src/gdskills/bundled/skills/orchestration/flow-orchestrator/input-contract.schema.json",
+    enforcement: {
+      kind: "none",
+      reason: "This payload is handed from one AGENT to another. In a session driven by a host agent's own dispatch tool, no keryx process is on that path, so nothing can refuse a malformed dispatch. Same structural position as reviewer-input, recorded for the same reason. Registering it made `keryx skills contracts validate --schema flow-orchestrator-input` possible, which is a validator an agent must remember to run, not an enforcement."
+    }
   },
   {
     name: "review-pr-feedback-input",
     fileName: "review-pr-feedback-input-contract.schema.json",
     description: "Request handed to review-pr-feedback (PR reference, --fix, and the operator confirmation --fix requires).",
-    sourcePath: "src/gdskills/bundled/skills/review/review-pr-feedback/input-contract.schema.json"
+    sourcePath: "src/gdskills/bundled/skills/review/review-pr-feedback/input-contract.schema.json",
+    enforcement: {
+      kind: "none",
+      reason: "The request is what an operator or a host agent hands the skill before any keryx command runs, so keryx is not yet in the path when the payload would have to be refused. This is the one where that hurts most: `--fix` merges third-party review comments into somebody else's pull request, and `operator_confirmed` is the fence. The conditional is expressed in the schema and `keryx skills contracts validate --schema review-pr-feedback-input` will apply it \u2014 but only when something invokes it."
+    }
   },
   {
     name: "review-pr-feedback-output",
     fileName: "review-pr-feedback-output-contract.schema.json",
     description: "Result review-pr-feedback returns: verdict counts, the injection-screen record, and what the fix run merged.",
-    sourcePath: "src/gdskills/bundled/skills/review/review-pr-feedback/output-contract.schema.json"
+    sourcePath: "src/gdskills/bundled/skills/review/review-pr-feedback/output-contract.schema.json",
+    enforcement: {
+      kind: "opt-in",
+      module: "src/commands/review.ts",
+      switchedOnBy: "keryx review comments reply --result <file>",
+      refuses: "A result that contradicts itself, before the pass is built and before any network call: an analyze-mode run reporting a branch and a merge, or a record saying the injection screen never ran while claiming it excluded comments."
+    }
   },
   {
     name: "job-orchestrator-state",
     fileName: "job-orchestrator-state.schema.json",
     description: "Persisted job package state (.metaproject/jobs/<name>/state.json), written by `keryx job`.",
-    sourcePath: "src/gdskills/bundled/skills/orchestration/job-orchestrator/state.schema.json"
+    sourcePath: "src/gdskills/bundled/skills/orchestration/job-orchestrator/state.schema.json",
+    enforcement: {
+      kind: "production",
+      module: "src/job/store.ts",
+      refuses: "`writeJob` refuses to write a state file that does not satisfy the schema, so an invalid job package cannot reach disk."
+    }
   },
   {
     name: "orchestrator-state",
     fileName: "orchestrator-state.schema.json",
-    description: "Persisted resumable orchestrator state."
+    description: "Persisted resumable orchestrator state.",
+    enforcement: {
+      kind: "none",
+      reason: "No keryx command reads or writes this file. It describes state an orchestrator agent persists for itself, in its own runtime, so there is no keryx-owned write path to refuse at. Contrast job-orchestrator-state, which looks similar and IS enforced for exactly one reason: `keryx job` writes that one."
+    }
   },
   {
     name: "review-finding",
     fileName: "review-finding.schema.json",
-    description: "Normalized reviewer finding consumed by review-orchestrator and learning flows."
+    description: "Normalized reviewer finding consumed by review-orchestrator and learning flows.",
+    enforcement: {
+      kind: "production",
+      module: "src/review/managed.ts",
+      refuses: "`createManagedReviewPackage` refuses to record findings that do not satisfy the schema, and the disposition sub-schema is applied the same way, so a review round cannot be written with a malformed finding or an unreadable outcome."
+    }
   },
   {
     name: "subagent-dispatch",
     fileName: "subagent-dispatch.schema.json",
-    description: "Orchestrator-to-subagent dispatch payload."
+    description: "Orchestrator-to-subagent dispatch payload.",
+    enforcement: {
+      kind: "none",
+      reason: "The dispatch is built and consumed inside the harness without the canonical schema being loaded: `subagent-dispatch` appears only as a label on the extension metadata. Its sibling `subagent-result` IS validated, because the harness parses a child's reply back and has to decide whether it is well-formed; nothing performs the equivalent act on the way out."
+    }
   },
   {
     name: "subagent-result",
     fileName: "subagent-result.schema.json",
-    description: "Subagent-to-orchestrator result payload."
+    description: "Subagent-to-orchestrator result payload.",
+    enforcement: {
+      kind: "production",
+      module: "src/harness/external/runtime.ts",
+      refuses: "A child's reply that does not parse as a well-formed result is rejected when the harness reads it back, so a malformed result cannot be persisted as if the child had succeeded."
+    }
   },
   {
     name: "task-implementer-input",
     fileName: "task-implementer-input-contract.schema.json",
     description: "Task request handed to task-implementer (task + workspace + automation), validated before dispatch.",
-    sourcePath: "src/gdskills/bundled/skills/orchestration/task-implementer/input-contract.schema.json"
+    sourcePath: "src/gdskills/bundled/skills/orchestration/task-implementer/input-contract.schema.json",
+    enforcement: {
+      kind: "none",
+      reason: "Dispatched agent-to-agent, like flow-orchestrator-input. The skill's Phase 1.4 lists five `ASSERT \u2026 \u2192 ABORT(\u2026)` refusals; registering the contract is what lets `keryx skills contracts validate` perform them, and nothing forces that call. The comment beside this registration has said so since it was written."
+    }
   },
   {
     name: "task-implementer-output",
     fileName: "task-implementer-output-contract.schema.json",
     description: "JSON result task-implementer writes in Phase 6.1 before it emits its STATUS line.",
-    sourcePath: "src/gdskills/bundled/skills/orchestration/task-implementer/output-contract.schema.json"
+    sourcePath: "src/gdskills/bundled/skills/orchestration/task-implementer/output-contract.schema.json",
+    enforcement: {
+      kind: "none",
+      reason: "The skill writes this file itself, in its own runtime, and no keryx command reads it back. Contrast subagent-result, which is the same shape of thing and IS enforced for one reason: the harness reads that one back and must decide whether it is well-formed."
+    }
   }
 ];
 function normalizeContractName(value) {
@@ -44483,6 +44606,13 @@ function renderMetaprojectGitignoreBlock() {
 .metaproject/data/security/raw/**
 .metaproject/data/security/artifacts/latest.md
 .metaproject/data/security/artifacts/latest.json
+# Forgetting/retention runtime state: the auto-sweep stamp is rewritten by the
+# gdctx write path on every call, not a project artifact. These lines were added
+# to this repository's .gitignore by hand INSIDE the managed block, where the
+# next \`keryx update\` regenerated them away \u2014 which is how they came to belong
+# here instead.
+.metaproject/data/forgetting/
+.metaproject/data/retention/
 .metaproject/reports/
 `;
 }
@@ -46155,7 +46285,33 @@ function renderGdgraphPostCommitHook() {
     return 0
   fi
 
-  if ! printf '%s\\n' "$changed_files" | grep -E '(^src/|^lib/|^app/|^packages/|^services/|^scripts/|^docs/|^\\.metaproject/(modules|skills|rules)/|package\\.json$|tsconfig.*\\.json$|bun\\.lockb?$|pnpm-lock\\.yaml$|yarn\\.lock$|package-lock\\.json$)' >/dev/null 2>&1; then
+  # Two questions, because the graph is fed by two different things.
+  #
+  # The second one is here because the first one alone was wrong. It lists
+  # directory prefixes \u2014 src/, lib/, app/ and so on \u2014 while the builder indexes
+  # any source file anywhere except the directories it never walks. Everything
+  # in between was indexed AND undetected: a commit to \`vscode-extension/src/\`,
+  # to a source file at the repository root, or to any directory not on the
+  # list left the graph stale and printed NOTHING. Every other path in this
+  # function says something when the graph may be stale; that one returned 0 in
+  # silence, which is the failure this hook exists to end.
+  #
+  # The prefix list is kept rather than replaced, so nothing that rebuilt
+  # before stops rebuilding: it covers paths that change how the graph resolves
+  # without being indexed themselves, such as docs/ and the metaproject rules.
+  # The extension test only widens.
+  #
+  # The exclusion mirrors IGNORE_DIRS in src/gdgraph/build.ts. It has to: a
+  # rebuild triggered by a file the builder never reads is a rebuild that
+  # cannot change the answer, and every dependency bump would pay for it.
+  if printf '%s\\n' "$changed_files" | grep -E '(^src/|^lib/|^app/|^packages/|^services/|^scripts/|^docs/|^\\.metaproject/(modules|skills|rules)/|package\\.json$|tsconfig.*\\.json$|bun\\.lockb?$|pnpm-lock\\.yaml$|yarn\\.lock$|package-lock\\.json$)' >/dev/null 2>&1; then
+    :
+  elif printf '%s\\n' "$changed_files" \\
+    | grep -E '\\.(ts|tsx|js|jsx|java|py)$' \\
+    | grep -Ev '(^|/)(\\.git|\\.claude|\\.metaproject|node_modules|\\.cache|\\.docusaurus|\\.next|\\.turbo|dist|build|coverage|generated|out|public|storybook-static)/' \\
+      >/dev/null 2>&1; then
+    :
+  else
     return 0
   fi
 
@@ -47005,7 +47161,7 @@ import path43 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.84",
+  version: "0.2.88",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -47059,6 +47215,7 @@ var package_default = {
     check: "bun run lint && bun run typecheck && bun run typecheck:scripts && bun test",
     "check:core": "bun run lint && bun run typecheck && bun run typecheck:scripts && bun run test:core",
     "check:doc-links": "bun scripts/check-doc-links.ts",
+    "check:retired-spellings": "bun scripts/check-retired-cli-spellings.ts",
     "baseline:review-precision": "bun scripts/review-precision-baseline.ts",
     "test:guards": "bun test src/lib/config-dir.ast.test.ts src/lib/config-dir.readers.test.ts src/lib/production-graph.test.ts src/harness/policy/profiles.test.ts src/lib/serve-server.test.ts src/gdskills/agent-catalogue-xref.test.ts src/gdskills/enforcement-claims.test.ts",
     lint: "eslint ."
@@ -48494,7 +48651,7 @@ var MCP_MANAGED_KEY = "_keryxManaged";
 var MCP_MANAGED_SENTINEL = "mcp-client-config";
 var MCP_SERVER_NAME = "keryx";
 var MCP_SERVER_COMMAND = "keryx";
-var MCP_SERVER_ARGS = ["mcp", "serve"];
+var MCP_SERVER_ARGS = ["serve-mcp"];
 var MCP_SDK_HINT = "bun add @modelcontextprotocol/sdk";
 function mcpServerEntry(projectRoot) {
   const args = projectRoot ? [...MCP_SERVER_ARGS, "--cwd", projectRoot] : [...MCP_SERVER_ARGS];
@@ -48812,12 +48969,12 @@ protocol adapter \u2014 it defines no new module logic.
 
 ## Commands
 
-- \`keryx mcp serve\` \u2014 stdio JSON-RPC MCP server (default transport).
-- \`keryx mcp serve --http\` \u2014 isolated HTTP/SSE opt-in (localhost only;
+- \`keryx serve-mcp\` \u2014 stdio JSON-RPC MCP server (default transport).
+- \`keryx serve-mcp --http\` \u2014 isolated HTTP/SSE opt-in (localhost only;
   requires \`http.enabled=true\` in this module's manifest entry).
-- \`keryx mcp serve --cwd <project-root>\` \u2014 expose a specific project,
+- \`keryx serve-mcp --cwd <project-root>\` \u2014 expose a specific project,
   independent of the MCP client's launch directory.
-- \`keryx mcp install --runtime <cursor|claude|opencode|vscode|generic|all> [--dry-run]\` \u2014
+- \`keryx integrate <cursor|claude|opencode|vscode|generic|all> [--dry-run]\` \u2014
   wire this project into an editor/agent: writes a project-local client
   config (cursor \u2192 \`.cursor/mcp.json\`, claude \u2192 \`.mcp.json\`, opencode \u2192
   \`opencode.json\`, vscode \u2192 \`.vscode/mcp.json\`) and sets
@@ -48827,17 +48984,17 @@ protocol adapter \u2014 it defines no new module logic.
   step; hand-editing a client config file directly is unnecessary and skips
   setting \`modules.mcp.enabled\`. \`all\` expands to cursor + claude +
   opencode; \`vscode\` is opt-in only (not bundled into \`all\`) \u2014 request it
-  explicitly with \`--runtime vscode\`.
-- \`keryx mcp uninstall --runtime <cursor|claude|opencode|vscode|generic|all>\` \u2014
+  explicitly as \`keryx integrate vscode\`.
+- \`keryx integrate --remove <cursor|claude|opencode|vscode|generic|all>\` \u2014
   remove the managed client config again.
 - **codex CLI**: not a \`--runtime\` here \u2014 codex's client config is a single
   GLOBAL \`~/.codex/config.toml\`, not a project-local file, and it already
   ships its own safe, native installer for it. Run
-  \`codex mcp add keryx -- keryx mcp serve --cwd <project-root>\` once
+  \`codex mcp add keryx -- keryx serve-mcp --cwd <project-root>\` once
   (verified live: codex successfully discovers and calls this server's
   tools headlessly with \`codex exec --approve-for-me\`); \`codex mcp remove
   keryx\` to undo. \`modules.mcp.enabled=true\` still needs
-  \`keryx mcp install --runtime generic\` (or any other runtime) run once,
+  \`keryx integrate generic\` (or any other editor) run once,
   since codex's own installer has no notion of the keryx manifest.
 
 ## Notes
@@ -48952,7 +49109,7 @@ async function installMcpClient(projectRoot, ids, options = {}) {
   const sdk = await probeMcpSdk();
   return { outcomes, unknown, manifest, sdk, dryRun };
 }
-async function uninstallMcpClient(projectRoot, ids) {
+async function uninstallMcpClient(projectRoot, ids, options = {}) {
   const absoluteProjectRoot = path52.resolve(projectRoot);
   const { runtimes, unknown } = resolveMcpRuntimes(ids);
   const outcomes = [];
@@ -48969,7 +49126,9 @@ async function uninstallMcpClient(projectRoot, ids) {
     const settings = await readSettings2(file);
     const hadManaged = runtime.hasManaged(settings);
     const stripped = runtime.strip(settings);
-    await writeSettings2(file, stripped);
+    if (options.dryRun !== true) {
+      await writeSettings2(file, stripped);
+    }
     outcomes.push({ id: runtime.id, filePath: file, removed: hadManaged });
   }
   return { outcomes, unknown };
@@ -49589,7 +49748,7 @@ async function initCommand(args) {
       }
     }
     if (!report.sdk.available) {
-      note(`Optional MCP SDK not found \u2014 install it to run \`keryx mcp serve\`: ${report.sdk.hint}`);
+      note(`Optional MCP SDK not found \u2014 install it to run \`keryx serve-mcp\`: ${report.sdk.hint}`);
     }
   }
   const enabledModuleCount = [
@@ -49674,7 +49833,7 @@ async function initCommand(args) {
   steps.push(`After pulling changes, run ${style.cyan("keryx update")} to refresh service files.`);
   nextSteps(steps);
   if (!enableMcp && !options.yes) {
-    note(`Wire an editor/agent to the MCP server later with ${style.cyan("keryx mcp install")}.`);
+    note(`Wire an editor/agent to the MCP server later with ${style.cyan("keryx integrate <editor>")}.`);
   }
 }
 function parseInitArgs(args) {
@@ -49929,7 +50088,7 @@ ${blockEnd}`;
   const existing = await pathExists(hookPath) ? await readFile23(hookPath, "utf8") : `#!/usr/bin/env sh
 `;
   const blockPattern = new RegExp(`${escapeRegExp2(blockStart)}[\\s\\S]*?${escapeRegExp2(blockEnd)}`);
-  const next = blockPattern.test(existing) ? existing.replace(blockPattern, managedBlock) : `${existing.trimEnd()}
+  const next = blockPattern.test(existing) ? existing.replace(blockPattern, () => managedBlock) : `${existing.trimEnd()}
 
 ${managedBlock}
 `;
@@ -59686,12 +59845,16 @@ async function runInit(args) {
     cwd: process.cwd(),
     title: optionValue(args, "--title"),
     issue: optionValue(args, "--issue"),
-    slug: optionValue(args, "--slug")
+    slug: optionValue(args, "--slug"),
+    baseBranch: optionValue(args, "--base")
   });
   banner("flow init", `Created flow ${result.flow.id}`);
   console.log(`  ${style.green(symbols.ok)} ${style.bold(result.flow.title)}`);
   note(result.dir);
   console.log(`  status: ${flowStatusLabel(result.flow.status)}`);
+  if (result.flow.baseBranch !== undefined) {
+    console.log(`  base:   ${result.flow.baseBranch}`);
+  }
   if (result.contextNotes.length > 0) {
     heading("Context collected");
     for (const contextNote of result.contextNotes) {
@@ -60095,7 +60258,7 @@ function requireId(args) {
 function printHelp10() {
   helpTitle("keryx flow", "agent-first managed work (flows)");
   helpUsage([
-    'keryx flow init (--issue <url> | --title "<t>") [--slug <s>]',
+    'keryx flow init (--issue <url> | --title "<t>") [--slug <s>] [--base <branch>]',
     "keryx flow list",
     "keryx flow status <id>",
     "keryx flow freeze <id>",
@@ -64724,6 +64887,7 @@ var COMMENTS_REPLY_FLAGS = [
   "--pr",
   "--self",
   "--outcomes",
+  "--result",
   "--sha",
   "--round",
   "--final",
@@ -65183,6 +65347,7 @@ async function runCommentsReply(args) {
   const round = parseNonNegativeInteger(optionValue(args, "--round"), "--round") ?? 1;
   const isFinal = args.includes("--final");
   const dryRun = args.includes("--dry-run");
+  await refuseInvalidResult(optionValue(args, "--result"), optionValue(args, "--outcomes"));
   const cwd = process.cwd();
   const port = await resolvePort(args);
   const state = await readPrCommentState(cwd, repo, number);
@@ -65262,6 +65427,28 @@ async function resolveSelfLogin(args) {
   }
   return login;
 }
+async function refuseInvalidResult(source, outcomesSource) {
+  if (source === undefined) {
+    return;
+  }
+  if (source === "-" && outcomesSource === "-") {
+    throw new Error("`--result -` and `--outcomes -` both read standard input, which can only be consumed once. Pass at least one of them as a file path.");
+  }
+  const raw = source === "-" ? await Bun.stdin.text() : await readFile87(source, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`\`--result ${source}\` is not JSON: ${error instanceof Error ? error.message : String(error)}. Nothing was posted.`);
+  }
+  const schema = await loadSchema("review-pr-feedback-output");
+  const errors = await validateJson(parsed, schema);
+  if (errors.length > 0) {
+    throw new Error(`\`--result ${source}\` does not satisfy the review-pr-feedback-output contract, so nothing was posted:
+${errors.map((error) => `  ${error.path}: ${error.message}`).join(`
+`)}`);
+  }
+}
 async function readOutcomes(source) {
   if (source === undefined) {
     throw new Error("`--outcomes <file|->` is required: it carries one disposition and one reply sentence per collected comment. The judgement is the model's; this command only enforces the budget, the threading and the once-at-the-end rule.");
@@ -69187,12 +69374,109 @@ async function sandboxCommand(args = [], deps = {}) {
 
 // src/commands/mcp.ts
 init_args();
-import path168 from "path";
+
+// src/commands/integrate.ts
+import path162 from "path";
+var EDITOR_USAGE = `<cursor|claude|opencode|vscode|generic|all>`;
+var DEFAULT_EDITORS = ["all"];
+async function integrateCommand(args = [], cwd = process.cwd(), label) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printIntegrateHelp();
+    return;
+  }
+  const editors = parseEditors(args);
+  if (args.includes("--remove")) {
+    await removeIntegration(cwd, editors, args.includes("--dry-run"), label ?? "keryx integrate --remove");
+    return;
+  }
+  await addIntegration(cwd, editors, args.includes("--dry-run"), label ?? "keryx integrate");
+}
+function parseEditors(args) {
+  const named = args.filter((argument) => !argument.startsWith("-")).flatMap((argument) => argument.split(",")).map((argument) => argument.trim()).filter(Boolean);
+  return named.length > 0 ? named : [...DEFAULT_EDITORS];
+}
+async function addIntegration(cwd, editors, dryRun, label) {
+  const report = await installMcpClient(cwd, editors, { dryRun });
+  if (report.unknown.length > 0) {
+    console.error(`Unknown runtime(s): ${report.unknown.join(", ")}`);
+    process.exitCode = 1;
+    return;
+  }
+  heading(`${label}${dryRun ? " (dry run)" : ""}`);
+  for (const outcome of report.outcomes) {
+    if (outcome.filePath === null) {
+      console.log(`  ${style.cyan(symbols.arrow)} ${outcome.id} \u2014 paste this into your MCP client config:`);
+      console.log(outcome.snippet ?? "");
+      continue;
+    }
+    const rel = path162.relative(cwd, outcome.filePath);
+    if (outcome.errors.length > 0) {
+      for (const e of outcome.errors) {
+        console.log(`  ${style.red(symbols.cross)} ${e}`);
+      }
+      process.exitCode = 1;
+      continue;
+    }
+    if (dryRun) {
+      console.log(`  ${style.cyan(symbols.arrow)} ${outcome.id} \u2192 would write ${rel}:`);
+      console.log(outcome.snippet ?? "");
+    } else {
+      console.log(`  ${style.green(symbols.ok)} ${outcome.id} \u2192 ${rel}`);
+    }
+  }
+  if (report.manifest.message) {
+    note(report.manifest.message);
+  } else if (dryRun && report.manifest.changed) {
+    note("would set modules.mcp.enabled=true in .metaproject/metaproject.json");
+  } else if (report.manifest.changed) {
+    note("set modules.mcp.enabled=true in .metaproject/metaproject.json");
+  }
+  if (!report.sdk.available) {
+    note(`Optional MCP SDK not found \u2014 install it to run \`keryx serve-mcp\`: ${report.sdk.hint}`);
+  }
+}
+async function removeIntegration(cwd, editors, dryRun, label) {
+  const report = await uninstallMcpClient(cwd, editors, { dryRun });
+  if (report.unknown.length > 0) {
+    console.error(`Unknown runtime(s): ${report.unknown.join(", ")}`);
+    process.exitCode = 1;
+    return;
+  }
+  heading(label);
+  for (const outcome of report.outcomes) {
+    if (outcome.filePath === null) {
+      console.log(`  ${style.gray(symbols.off)} ${outcome.id} ${style.dim("no file to change")}`);
+      continue;
+    }
+    const rel = path162.relative(cwd, outcome.filePath);
+    console.log(`  ${outcome.removed ? style.green(symbols.ok) : style.gray(symbols.off)} ${outcome.id} ${style.dim(outcome.removed ? `${dryRun ? "would be removed from" : "removed from"} ${rel}` : "nothing to remove")}`);
+  }
+}
+function printIntegrateHelp() {
+  helpTitle("keryx integrate", "wire this project into an editor or agent as an MCP server");
+  helpUsage([
+    `keryx integrate ${EDITOR_USAGE}            # write the client config`,
+    `keryx integrate --remove ${EDITOR_USAGE}   # remove the managed keryx server`,
+    `keryx integrate ${EDITOR_USAGE} --dry-run  # print the planned change, write nothing`
+  ]);
+  helpOptions([
+    { flag: "--remove", desc: "Remove the managed keryx server instead of writing it." },
+    { flag: "--dry-run", desc: "Print the planned change and write nothing. Works with --remove too." }
+  ]);
+  heading("Notes");
+  console.log(`  ${style.dim(`Editors: ${mcpRuntimeIds().join(", ")}, or all (=cursor,claude,opencode). Comma-separated. Default: all.`)}`);
+  console.log(`  ${style.dim("Writes a project-local MCP client config (cursor \u2192 .cursor/mcp.json, claude \u2192 .mcp.json, opencode \u2192 opencode.json, vscode \u2192 .vscode/mcp.json), sets modules.mcp.enabled=true, and prints a snippet for `generic`. `vscode` is opt-in only \u2014 not included in `all`.")}`);
+  console.log(`  ${style.dim("Only probes the optional @modelcontextprotocol/sdk \u2014 it never installs it and never opens a network connection.")}`);
+}
+
+// src/commands/serve-mcp.ts
+init_args();
+import path169 from "path";
 
 // src/mcp/discovery.ts
 init_fs();
 init_json();
-import path162 from "path";
+import path163 from "path";
 var MODULE_MANIFEST_KEY = {
   gdgraph: "gdgraph",
   security: "security",
@@ -69254,7 +69538,7 @@ function buildDiscovery(manifest) {
   };
 }
 async function loadDiscovery(cwd) {
-  const manifestPath = path162.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path163.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return buildDiscovery({});
   }
@@ -69327,7 +69611,7 @@ init_store2();
 init_fs();
 import { createHash as createHash33, randomUUID as randomUUID17 } from "crypto";
 import { appendFile as appendFile7, mkdir as mkdir58, open as open2, readFile as readFile93, rename as rename7, rm as rm12, stat as stat16, writeFile as writeFile50 } from "fs/promises";
-import path163 from "path";
+import path164 from "path";
 
 // src/sac/policy-experiment.ts
 import { createHash as createHash32, createHmac as createHmac2 } from "crypto";
@@ -69683,7 +69967,7 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2565(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath = path163.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path164.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile93(configPath, "utf8").catch((error) => {
@@ -69785,7 +70069,7 @@ async function diagnosePolicyReadiness(workspaceRoot) {
     const integrityReady = steps.every((entry) => entry.step === "activation-flags" || entry.status === "pass");
     return Object.freeze({ configPresent, enabled, killSwitch, integrityReady, candidateWouldActivate: integrityReady && enabled && !killSwitch, steps: Object.freeze([...steps]) });
   };
-  const configPath = path163.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path164.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile93(configPath, "utf8").catch((error) => {
@@ -70040,9 +70324,9 @@ class FwkReadService {
     const recordedAt = nowIso2(now);
     const id = `receipt-${randomUUID17().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id) => `./ids/${id}`), omittedOptional: assembly.omittedOptional.map((id) => `./ids/${id}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path163.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path163.join(path163.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir58(path163.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path164.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path164.join(path164.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir58(path164.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock2(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -70154,7 +70438,7 @@ init_workspace_service();
 init_sac();
 import { appendFile as appendFile8, mkdir as mkdir59, readFile as readFile94 } from "fs/promises";
 import { randomUUID as randomUUID18 } from "crypto";
-import path164 from "path";
+import path165 from "path";
 
 class CollaborationServiceError extends Error {
   code;
@@ -70170,7 +70454,7 @@ class CollaborationService {
     this.input = input;
   }
   file(id) {
-    return path164.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path165.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input) {
     const manifest = await this.input.workspaces.show(input);
@@ -70207,7 +70491,7 @@ class CollaborationService {
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
         ...suppliedHandoff ? { handoff: { ...suppliedHandoff, from: actor.subject } } : {}
       });
-      await mkdir59(path164.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir59(path165.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile8(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -70262,9 +70546,9 @@ init_workspace_service();
 init_fs();
 init_machine_wrap_up();
 import { mkdir as mkdir60, readdir as readdir31, readFile as readFile95 } from "fs/promises";
-import path165 from "path";
+import path166 from "path";
 function externalSlatesDir(cwd) {
-  return path165.join(cwd, ".keryx", "external-slates");
+  return path166.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -70274,14 +70558,14 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path165.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path166.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path165.join(externalSlatesDir(cwd), externalSessionId);
+  return path166.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
@@ -70926,7 +71210,7 @@ function buildToolRegistry() {
 // src/mcp/resources.ts
 init_fs();
 init_contained_read();
-import path166 from "path";
+import path167 from "path";
 import { lstat as lstat4, readdir as readdir32, realpath as realpath7, stat as stat17 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
@@ -70939,13 +71223,13 @@ function mimeForPath(filePath) {
   return "text/plain";
 }
 function dataRoot3(cwd) {
-  return path166.join(cwd, ".metaproject", "data");
+  return path167.join(cwd, ".metaproject", "data");
 }
 function wikiRoot(cwd) {
-  return path166.join(cwd, ".metaproject", "wiki");
+  return path167.join(cwd, ".metaproject", "wiki");
 }
 function memoryRoot2(cwd) {
-  return path166.join(cwd, ".metaproject", "memory");
+  return path167.join(cwd, ".metaproject", "memory");
 }
 var MAX_RESOURCE_BYTES = 8 * 1024 * 1024;
 async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
@@ -70971,7 +71255,7 @@ async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
     return [];
   }
   for (const entry of entries) {
-    const full = path166.join(root, entry.name);
+    const full = path167.join(root, entry.name);
     const info = await stat17(full).catch(() => null);
     if (!info || !isPathInside(ownerReal, await realpath7(full).catch(() => "")))
       continue;
@@ -70999,9 +71283,9 @@ async function listArtifacts(cwd) {
     if (!moduleEntry.isDirectory()) {
       continue;
     }
-    const artifactsDir = path166.join(base, moduleEntry.name, "artifacts");
+    const artifactsDir = path167.join(base, moduleEntry.name, "artifacts");
     for (const file of await walkFiles(artifactsDir)) {
-      const rel = toPosix(path166.relative(artifactsDir, file));
+      const rel = toPosix(path167.relative(artifactsDir, file));
       const relPath = `${moduleEntry.name}/${rel}`;
       listings.push({
         uri: `${URI_PREFIX}artifacts/${relPath}`,
@@ -71015,7 +71299,7 @@ async function listArtifacts(cwd) {
 async function listUnderRoot(cwd, cls, root) {
   const listings = [];
   for (const file of await walkFiles(root)) {
-    const rel = toPosix(path166.relative(root, file));
+    const rel = toPosix(path167.relative(root, file));
     listings.push({
       uri: `${URI_PREFIX}${cls}/${rel}`,
       name: rel,
@@ -71065,12 +71349,12 @@ function resolveConfined(cwd, cls, relPath) {
     if (moduleName.includes("..") || moduleName.length === 0) {
       return null;
     }
-    const root = path166.join(dataRoot3(cwd), moduleName, "artifacts");
-    const absolute = path166.resolve(root, rest);
+    const root = path167.join(dataRoot3(cwd), moduleName, "artifacts");
+    const absolute = path167.resolve(root, rest);
     return isPathInside(root, absolute) ? { root, absolute } : null;
   }
   const root = cls === "wiki" ? wikiRoot(cwd) : memoryRoot2(cwd);
-  const absolute = path166.resolve(root, relPath);
+  const absolute = path167.resolve(root, relPath);
   return isPathInside(root, absolute) ? { root, absolute } : null;
 }
 async function readResource(cwd, roots, uri) {
@@ -71183,7 +71467,7 @@ class McpSdkMissingError extends Error {
       "Install it (it is an optional dependency):",
       "  bun add @modelcontextprotocol/sdk",
       "",
-      "Then re-run `keryx mcp serve`. All other commands run without the SDK."
+      "Then re-run `keryx serve-mcp`. All other commands run without the SDK."
     ].join(`
 `));
     this.name = "McpSdkMissingError";
@@ -71274,6 +71558,36 @@ function resolveServeRoot(explicitCwd, processCwd, env) {
   return processCwd;
 }
 
+// src/commands/serve-mcp.ts
+async function serveMcpCommand(args = [], cwd = process.cwd()) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printServeMcpHelp();
+    return;
+  }
+  const http = args.includes("--http");
+  const projectRoot = path169.resolve(resolveServeRoot(optionValue(args, "--cwd"), cwd, process.env));
+  try {
+    await serveMcp({ cwd: projectRoot, http });
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+function printServeMcpHelp() {
+  helpTitle("keryx serve-mcp", "expose Metaproject services over the Model Context Protocol");
+  helpUsage([
+    "keryx serve-mcp [--cwd <project-root>]          # stdio JSON-RPC MCP server (default)",
+    "keryx serve-mcp --http [--cwd <project-root>]   # HTTP/SSE opt-in (requires capabilities.http.enabled)"
+  ]);
+  helpOptions([
+    { flag: "--http", desc: "Use the isolated HTTP/SSE transport (localhost only) instead of stdio." },
+    { flag: "--cwd", desc: "Project root whose .metaproject workspace should be exposed. Defaults to the process cwd." }
+  ]);
+  heading("Notes");
+  console.log(`  ${style.dim("Requires the optional @modelcontextprotocol/sdk. Disabled by default (modules.mcp.enabled=false); `keryx integrate <editor>` turns it on and wires a client.")}`);
+  console.log(`  ${style.dim("`keryx mcp serve` is the retired spelling of this command. It still works and prints one deprecation line on stderr.")}`);
+}
+
 // src/commands/mcp.ts
 async function mcpCommand(args = [], cwd = process.cwd()) {
   const subcommand = args[0];
@@ -71282,127 +71596,65 @@ async function mcpCommand(args = [], cwd = process.cwd()) {
     return;
   }
   if (subcommand === "install") {
-    await handleInstall2(cwd, args.slice(1));
+    announceRename("`keryx mcp install --runtime <editor>`", "`keryx integrate <editor>`");
+    await integrateCommand(toIntegrateArgs(args.slice(1)), cwd, "keryx mcp install");
     return;
   }
   if (subcommand === "uninstall") {
-    await handleUninstall2(cwd, args.slice(1));
+    announceRename("`keryx mcp uninstall --runtime <editor>`", "`keryx integrate --remove <editor>`");
+    await integrateCommand(["--remove", ...toIntegrateArgs(args.slice(1))], cwd, "keryx mcp uninstall");
     return;
   }
   if (!subcommand || subcommand === "serve") {
-    const http = args.includes("--http");
-    const projectRoot = path168.resolve(resolveServeRoot(optionValue(args, "--cwd"), cwd, process.env));
-    try {
-      await serveMcp({ cwd: projectRoot, http });
-    } catch (error) {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exitCode = 1;
-    }
+    announceRename("`keryx mcp serve`", "`keryx serve-mcp`");
+    await serveMcpCommand(args.slice(1), cwd);
     return;
   }
   console.error(`Unknown mcp command: ${subcommand}`);
   printMcpHelp();
   process.exitCode = 1;
 }
-var RUNTIME_USAGE = `<cursor|claude|opencode|vscode|generic|all>`;
-function parseRequestedRuntimes(args, fallback) {
-  const runtimeArg = optionValue(args, "--runtime") ?? fallback;
-  return runtimeArg.split(",").map((s) => s.trim()).filter(Boolean);
-}
-async function handleInstall2(cwd, args) {
-  const dryRun = args.includes("--dry-run");
-  const requested = parseRequestedRuntimes(args, "all");
-  const report = await installMcpClient(cwd, requested, { dryRun });
-  if (report.unknown.length > 0) {
-    console.error(`Unknown runtime(s): ${report.unknown.join(", ")}`);
-    process.exitCode = 1;
-    return;
-  }
-  heading(`keryx mcp install${dryRun ? " (dry run)" : ""}`);
-  for (const outcome of report.outcomes) {
-    if (outcome.filePath === null) {
-      console.log(`  ${style.cyan(symbols.arrow)} ${outcome.id} \u2014 paste this into your MCP client config:`);
-      console.log(outcome.snippet ?? "");
-      continue;
-    }
-    const rel = path168.relative(cwd, outcome.filePath);
-    if (outcome.errors.length > 0) {
-      for (const e of outcome.errors) {
-        console.log(`  ${style.red(symbols.cross)} ${e}`);
-      }
-      process.exitCode = 1;
-      continue;
-    }
-    if (dryRun) {
-      console.log(`  ${style.cyan(symbols.arrow)} ${outcome.id} \u2192 would write ${rel}:`);
-      console.log(outcome.snippet ?? "");
-    } else {
-      console.log(`  ${style.green(symbols.ok)} ${outcome.id} \u2192 ${rel}`);
-    }
-  }
-  if (report.manifest.message) {
-    note(report.manifest.message);
-  } else if (dryRun && report.manifest.changed) {
-    note("would set modules.mcp.enabled=true in .metaproject/metaproject.json");
-  } else if (report.manifest.changed) {
-    note("set modules.mcp.enabled=true in .metaproject/metaproject.json");
-  }
-  if (!report.sdk.available) {
-    note(`Optional MCP SDK not found \u2014 install it to run \`keryx mcp serve\`: ${report.sdk.hint}`);
-  }
+function announceRename(retired, replacement) {
+  console.error(`${retired} is deprecated \u2014 use ${replacement} instead.`);
 }
-async function handleUninstall2(cwd, args) {
-  const requested = parseRequestedRuntimes(args, "all");
-  const report = await uninstallMcpClient(cwd, requested);
-  if (report.unknown.length > 0) {
-    console.error(`Unknown runtime(s): ${report.unknown.join(", ")}`);
-    process.exitCode = 1;
-    return;
-  }
-  heading("keryx mcp uninstall");
-  for (const outcome of report.outcomes) {
-    if (outcome.filePath === null) {
-      console.log(`  ${style.gray(symbols.off)} ${outcome.id} ${style.dim("no file to change")}`);
-      continue;
-    }
-    const rel = path168.relative(cwd, outcome.filePath);
-    console.log(`  ${outcome.removed ? style.green(symbols.ok) : style.gray(symbols.off)} ${outcome.id} ${style.dim(outcome.removed ? `removed from ${rel}` : "nothing to remove")}`);
-  }
+function toIntegrateArgs(rest) {
+  const runtimeArg = optionValue(rest, "--runtime");
+  const editors = runtimeArg === undefined ? ["all"] : [runtimeArg];
+  const flags = rest.filter((argument) => argument.startsWith("-") && argument !== "--runtime" && !argument.startsWith("--runtime="));
+  return [...editors, ...flags];
 }
 function printMcpHelp() {
-  helpTitle("keryx mcp", "expose Metaproject services over the Model Context Protocol");
+  helpTitle("keryx mcp", "retired spelling of the MCP publisher surface \u2014 see the replacements below");
   helpUsage([
-    "keryx mcp serve [--cwd <project-root>]          # stdio JSON-RPC MCP server (default)",
-    "keryx mcp serve --http [--cwd <project-root>]   # HTTP/SSE opt-in (requires capabilities.http.enabled)",
-    "keryx mcp                  # alias for `mcp serve`",
-    `keryx mcp install --runtime ${RUNTIME_USAGE}   # wire this project into an editor/agent`,
-    `keryx mcp uninstall --runtime ${RUNTIME_USAGE} # remove the managed keryx server`
+    "keryx serve-mcp [--http] [--cwd <project-root>]   # replaces `keryx mcp serve`",
+    `keryx integrate ${EDITOR_USAGE}          # replaces \`keryx mcp install --runtime\``,
+    `keryx integrate --remove ${EDITOR_USAGE} # replaces \`keryx mcp uninstall --runtime\``
   ]);
   helpOptions([
-    { flag: "--http", desc: "Use the isolated HTTP/SSE transport (localhost only) instead of stdio." },
-    { flag: "--cwd", desc: "Project root whose .metaproject workspace should be exposed. Defaults to the process cwd." },
+    { flag: "--http", desc: "serve only: use the isolated HTTP/SSE transport (localhost only) instead of stdio." },
+    { flag: "--cwd", desc: "serve only: project root whose .metaproject workspace should be exposed. Defaults to the process cwd." },
     {
       flag: "--runtime",
-      desc: `Target client(s) for install/uninstall: ${mcpRuntimeIds().join(", ")}, or all (=cursor,claude,opencode). Comma-separated. Default: all.`
+      desc: `install/uninstall only: target client(s) \u2014 ${mcpRuntimeIds().join(", ")}, or all (=cursor,claude,opencode). Comma-separated. Default: all.`
     },
     { flag: "--dry-run", desc: "install only: print the planned change and write nothing." }
   ]);
   heading("Notes");
-  console.log(`  ${style.dim("`install` writes a project-local MCP client config (cursor \u2192 .cursor/mcp.json, claude \u2192 .mcp.json, opencode \u2192 opencode.json, vscode \u2192 .vscode/mcp.json), sets modules.mcp.enabled=true, and prints a snippet for `generic`. `vscode` is opt-in only \u2014 not included in `all`.")}`);
-  console.log(`  ${style.dim("Requires the optional @modelcontextprotocol/sdk to serve. Disabled by default (modules.mcp.enabled=false). `install` only probes the SDK \u2014 it never installs it or opens a network connection.")}`);
+  console.log(`  ${style.dim("Every `keryx mcp \u2026` invocation still works and still behaves identically; each prints one deprecation line on stderr naming its replacement.")}`);
+  console.log(`  ${style.dim("Run `keryx serve-mcp --help` or `keryx integrate --help` for the current surface.")}`);
 }
 
 // src/commands/status.ts
 init_fs();
 init_json();
-import path169 from "path";
+import path170 from "path";
 async function statusCommand(args = []) {
   if (args.includes("--help") || args.includes("-h")) {
     printHelp16();
     return;
   }
-  const root = path169.join(process.cwd(), ".metaproject");
-  const manifestPath = path169.join(root, "metaproject.json");
+  const root = path170.join(process.cwd(), ".metaproject");
+  const manifestPath = path170.join(root, "metaproject.json");
   if (!await pathExists(root)) {
     console.log("Metaproject: not initialized");
     console.log("Run: keryx init");
@@ -71442,7 +71694,7 @@ Reports the workspace root and one enabled/disabled line per module. Use
 
 // src/commands/harness.ts
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
-import path172 from "path";
+import path173 from "path";
 import { randomUUID as randomUUID20 } from "crypto";
 
 // src/security/harness-scan.ts
@@ -72515,7 +72767,7 @@ ${command.argv.join(" ")}`);
 }
 
 // src/harness/process/sandbox/profile.ts
-import path170 from "path";
+import path171 from "path";
 var DEFAULT_SECRET_SUBPATHS = [
   ".ssh",
   ".gnupg",
@@ -72540,7 +72792,7 @@ function defaultReadDenyList(home) {
   if (!home) {
     return [];
   }
-  return DEFAULT_SECRET_SUBPATHS.map((sub) => path170.join(home, sub));
+  return DEFAULT_SECRET_SUBPATHS.map((sub) => path171.join(home, sub));
 }
 function defaultSandboxProfile(cwd, tmpDir, home) {
   return {
@@ -72560,10 +72812,10 @@ function dedupe3(values) {
 init_config_dir();
 init_shell_config();
 import { existsSync as existsSync26 } from "fs";
-import path171 from "path";
+import path172 from "path";
 var SECRET_KEY_PATTERN2 = /api[_-]?key|secret|token|password|credential/i;
 function sandboxConfigPath(dir) {
-  return path171.join(path171.dirname(shellConfigPath(dir)), "sandbox.json");
+  return path172.join(path172.dirname(shellConfigPath(dir)), "sandbox.json");
 }
 function isShellDefault(v) {
   return v === "off" || v === "workspace" || v === "strict" || v === "1";
@@ -73682,7 +73934,7 @@ async function harnessExec(args, deps) {
     env: commandEnv,
     cwd
   };
-  const worktreeRoot = path172.parse(path172.resolve(cwd, commandPath)).root || cwd;
+  const worktreeRoot = path173.parse(path173.resolve(cwd, commandPath)).root || cwd;
   const budget = {
     reservationId: idSeq(),
     maxRuntimeMs: maxRuntimeMs ?? EXEC_DEFAULT_RUNTIME_MS
@@ -73869,6 +74121,8 @@ function harnessWave(args, deps) {
 }
 
 // src/commands/shell.ts
+init_grants();
+init_providers();
 init_make_provider();
 init_orient();
 init_metaproject_adapter();
@@ -75544,7 +75798,7 @@ function workspaceReadTool(cwd) {
 // src/harness/tool/builtin/workspace-lifecycle-tool.ts
 import { randomUUID as randomUUID22 } from "crypto";
 import { writeFile as writeFile52 } from "fs/promises";
-import path173 from "path";
+import path174 from "path";
 init_slate();
 init_store3();
 init_guard2();
@@ -75690,7 +75944,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         return { output: `workspace_propose: unrecognized 'kind' \u2014 expected one of: ${PROPOSAL_KINDS.join(", ")}`, isError: true };
       }
       const explicitSessionId = typeof input.sessionId === "string" && input.sessionId.length > 0 ? input.sessionId : undefined;
-      const sessionRef = explicitSessionId ?? path173.basename(getSessionDir() ?? "");
+      const sessionRef = explicitSessionId ?? path174.basename(getSessionDir() ?? "");
       if (sessionRef.length === 0) {
         return { output: "workspace_propose: no 'sessionId' given and no active session in this run", isError: true };
       }
@@ -75780,7 +76034,7 @@ init_shell_config();
 init_command_risk();
 init_shell_syntax();
 import { existsSync as existsSync28 } from "fs";
-import path174 from "path";
+import path175 from "path";
 import { createHash as createHash40 } from "crypto";
 var PREFIX_BANNED = new Set([
   "sh",
@@ -75985,7 +76239,7 @@ function emptyShellPermissions() {
   return { allow: [] };
 }
 function shellPermissionsPath(dir) {
-  return path174.join(path174.dirname(shellConfigPath(dir)), "permissions.json");
+  return path175.join(path175.dirname(shellConfigPath(dir)), "permissions.json");
 }
 function loadShellPermissionsWithAudit(dir) {
   try {
@@ -76023,7 +76277,7 @@ function loadShellPermissions(dir) {
 function saveShellPermissions(perms, dir, options = {}) {
   try {
     const file = shellPermissionsPath(dir);
-    ensureKeryxConfigDir(path174.dirname(file));
+    ensureKeryxConfigDir(path175.dirname(file));
     const cleaned = Array.from(new Set(perms.allow.map((p) => p.trim()).filter((p) => p.length > 0)));
     const body = {
       allow: options.skipValidation === true ? cleaned : cleaned.filter((p) => validateShellPattern(p).ok)
@@ -76340,12 +76594,12 @@ function remoteRequest(providerId, endpoint, query, key) {
 // src/lib/search-config.ts
 init_config_dir();
 import { existsSync as existsSync29 } from "fs";
-import path175 from "path";
+import path176 from "path";
 function searchConfigPath(dir) {
-  return path175.join(keryxConfigDir(dir), "search-providers.json");
+  return path176.join(keryxConfigDir(dir), "search-providers.json");
 }
 function searchCredentialPath(dir) {
-  return path175.join(keryxConfigDir(dir), "search-credentials.json");
+  return path176.join(keryxConfigDir(dir), "search-credentials.json");
 }
 function readJson5(file) {
   try {
@@ -76474,7 +76728,7 @@ function createDefaultSearchProviderController(configDir) {
 import { createHash as createHash41, randomUUID as randomUUID24 } from "crypto";
 import { mkdtemp, rm as rm13 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import path176 from "path";
+import path177 from "path";
 init_metaproject_adapter();
 init_ledger();
 init_orchestrate();
@@ -76737,8 +76991,8 @@ function createSpawnSubagentTool(deps) {
       let dispatchId = "";
       let closing = false;
       try {
-        ephemeralDir = await mkdtemp(path176.join(tmpdir4(), "keryx-subagent-slate-"));
-        dispatchId = path176.basename(ephemeralDir);
+        ephemeralDir = await mkdtemp(path177.join(tmpdir4(), "keryx-subagent-slate-"));
+        dispatchId = path177.basename(ephemeralDir);
         openedChildSlate = await openSlate({
           dir: ephemeralDir,
           cwd,
@@ -76981,7 +77235,7 @@ import { randomUUID as randomUUID25 } from "crypto";
 import { execFile as execFile4 } from "child_process";
 import { mkdir as mkdir61 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import path178 from "path";
+import path179 from "path";
 import { promisify as promisify4 } from "util";
 
 // src/harness/child/git-worktree-port.ts
@@ -77280,7 +77534,7 @@ function canNestExternalChild(env, maxDepth) {
 // src/harness/external/runtime.ts
 import { mkdtemp as mkdtemp2, rm as rm14, writeFile as writeFile53 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import path177 from "path";
+import path178 from "path";
 
 // src/harness/external/prompt.ts
 var EXTERNAL_RUNTIME_DIRECTIVE = [
@@ -78323,8 +78577,8 @@ async function prepareResultSchema() {
   try {
     const schema = await loadSchema("subagent-result");
     const schemaText = JSON.stringify(schema, null, 2);
-    schemaDir = await mkdtemp2(path177.join(tmpdir5(), "keryx-external-result-schema-"));
-    const schemaPath = path177.join(schemaDir, "subagent-result.schema.json");
+    schemaDir = await mkdtemp2(path178.join(tmpdir5(), "keryx-external-result-schema-"));
+    const schemaPath = path178.join(schemaDir, "subagent-result.schema.json");
     await writeFile53(schemaPath, schemaText, "utf8");
     return { ok: true, schema, schemaText, schemaPath, schemaDir };
   } catch (error) {
@@ -78581,7 +78835,7 @@ async function createRunExternal(options) {
   }
   const config = gate.config;
   const idSeq = options.idSeq ?? (() => randomUUID25());
-  const worktreesDir = options.worktreesDir ?? path178.join(tmpdir6(), "keryx-external-worktrees");
+  const worktreesDir = options.worktreesDir ?? path179.join(tmpdir6(), "keryx-external-worktrees");
   const spawn = options.spawn ?? createBunSpawnPort();
   const worktree = options.worktree ?? ensuringParentDir(createGitWorktreePort({ repoRoot: options.cwd, worktreesDir }), worktreesDir);
   const readWorkingDiff = options.readWorkingDiff ?? (() => defaultWorkingDiff(options.cwd));
@@ -78888,7 +79142,7 @@ class LiveMarkdownBlock {
 // src/tui/theme.ts
 init_config_dir();
 import { existsSync as existsSync30 } from "fs";
-import path179 from "path";
+import path180 from "path";
 var THEME_NAMES = ["groknight", "grokday", "tokyonight", "keryx"];
 var THEME_IDS = ["auto", ...THEME_NAMES];
 var DEFAULT_THEME_ID = "groknight";
@@ -79018,7 +79272,7 @@ function onThemeChange(listener) {
   };
 }
 function tuiConfigPath(dir) {
-  return path179.join(keryxConfigDir(dir), "tui.json");
+  return path180.join(keryxConfigDir(dir), "tui.json");
 }
 function loadPersistedThemeId(dir) {
   try {
@@ -79075,7 +79329,7 @@ init_workspace_service();
 init_service8();
 init_store2();
 init_fs();
-import path180 from "path";
+import path181 from "path";
 import { readFile as readFile97 } from "fs/promises";
 var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
 var DEFAULT_AUTO_GOAL_ROUNDS = 8;
@@ -79151,7 +79405,7 @@ function getFlowService() {
 async function autoProvisionFlow(cwd, goalText) {
   const service = getFlowService();
   const result = await service.init({ cwd, title: goalText });
-  const acFile = path180.join(cwd, result.dir, "acceptance-criteria.md");
+  const acFile = path181.join(cwd, result.dir, "acceptance-criteria.md");
   await writeFileAtomic(acFile, [
     "# Acceptance Criteria",
     "",
@@ -80702,7 +80956,7 @@ init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID27 } from "crypto";
 import { readdir as readdir34, stat as stat18 } from "fs/promises";
-import path181 from "path";
+import path182 from "path";
 
 // src/sac/lifecycle-flag.ts
 init_store();
@@ -80861,7 +81115,7 @@ async function readExternalUnboundCandidates(cwd) {
         }
         return groups;
       }, []));
-      const metaPath = path181.join(extDir, `${id}.json`);
+      const metaPath = path182.join(extDir, `${id}.json`);
       if (await pathExists(unboundDismissedReceiptPath(metaPath)))
         continue;
       candidates.push({
@@ -80875,7 +81129,7 @@ async function readExternalUnboundCandidates(cwd) {
   return candidates;
 }
 async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
-  const evidenceDir = path181.join(externalSlatesDir(cwd), externalSessionId);
+  const evidenceDir = path182.join(externalSlatesDir(cwd), externalSessionId);
   let entries;
   try {
     entries = (await readdir34(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -80884,7 +81138,7 @@ async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path181.join(evidenceDir, entries[i]);
+    const evidencePath = path182.join(evidenceDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -80927,7 +81181,7 @@ var SESSION_ATTRIBUTION_SLACK_MS = 5 * 60000;
 var MTIME_CLOCK_SKEW_TOLERANCE_MS = 5000;
 async function collectReceiptTargets(cwd, owner) {
   const targets = new Set;
-  const workspacesDir = path181.join(cwd, ".metaproject", "workspaces");
+  const workspacesDir = path182.join(cwd, ".metaproject", "workspaces");
   let workspaceIds;
   try {
     workspaceIds = (await readdir34(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -80935,7 +81189,7 @@ async function collectReceiptTargets(cwd, owner) {
     return targets;
   }
   for (const workspaceId of workspaceIds) {
-    const receiptsDir = path181.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
+    const receiptsDir = path182.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
     let files;
     try {
       files = (await readdir34(receiptsDir)).filter((name) => name.endsWith(".json"));
@@ -80943,7 +81197,7 @@ async function collectReceiptTargets(cwd, owner) {
       continue;
     }
     for (const file of files) {
-      const result = readConfigFile(path181.join(receiptsDir, file));
+      const result = readConfigFile(path182.join(receiptsDir, file));
       if (!result.ok)
         continue;
       try {
@@ -80986,7 +81240,7 @@ async function findSkillFiles(dir) {
   }
   const found = [];
   for (const entry of entries) {
-    const full = path181.join(dir, entry.name);
+    const full = path182.join(dir, entry.name);
     if (entry.isDirectory()) {
       found.push(...await findSkillFiles(full));
     } else if (entry.isFile() && entry.name === "SKILL.md") {
@@ -81045,10 +81299,10 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
       changedAt: attribution.changedAt
     });
   }
-  const sacSkillsDir = path181.join(cwd, ".metaproject", "project-skills", "sac");
+  const sacSkillsDir = path182.join(cwd, ".metaproject", "project-skills", "sac");
   const skillFiles = await findSkillFiles(sacSkillsDir);
   for (const absolutePath of skillFiles) {
-    const targetRef = path181.relative(path181.join(cwd, ".metaproject"), absolutePath).split(path181.sep).join("/");
+    const targetRef = path182.relative(path182.join(cwd, ".metaproject"), absolutePath).split(path182.sep).join("/");
     if (skillReceipts.has(targetRef))
       continue;
     const attribution = await attributeToSession(absolutePath, scoped);
@@ -81066,12 +81320,12 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
   return items;
 }
 async function isSlateEngaged(dir) {
-  if (await pathExists(path181.join(dir, "slate.json")))
+  if (await pathExists(path182.join(dir, "slate.json")))
     return true;
-  if (await pathExists(path181.join(dir, "terminal-state.json")))
+  if (await pathExists(path182.join(dir, "terminal-state.json")))
     return true;
   try {
-    const entries = await readdir34(path181.join(dir, "slate-archive"));
+    const entries = await readdir34(path182.join(dir, "slate-archive"));
     return entries.length > 0;
   } catch {
     return false;
@@ -81085,7 +81339,7 @@ async function safeReadSlate(dir) {
   }
 }
 async function readTerminalState(dir) {
-  const result = readConfigFile(path181.join(dir, "terminal-state.json"));
+  const result = readConfigFile(path182.join(dir, "terminal-state.json"));
   if (!result.ok) {
     return;
   }
@@ -81109,7 +81363,7 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (session === undefined) {
     throw new Error(`No session or evidence path matches "${target}"`);
   }
-  const archiveDir = path181.join(sessionDir(session.projectPath, session.id), "slate-archive");
+  const archiveDir = path182.join(sessionDir(session.projectPath, session.id), "slate-archive");
   let entries;
   try {
     entries = (await readdir34(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -81119,7 +81373,7 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (entries.length === 0)
     throw new Error(`No unbound-candidate artifacts for session ${session.id}`);
   entries.sort();
-  return path181.join(archiveDir, entries[entries.length - 1]);
+  return path182.join(archiveDir, entries[entries.length - 1]);
 }
 async function dismissUnboundByTarget(cwd, target, reason) {
   const evidencePath = await resolveUnboundCandidateTarget(cwd, target);
@@ -81145,7 +81399,7 @@ async function dismissUnboundCandidate(candidatePath, reason) {
   return { removed: candidatePath, receipt: receiptPath };
 }
 async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path181.join(dir, "slate-archive");
+  const archiveDir = path182.join(dir, "slate-archive");
   let entries;
   try {
     entries = (await readdir34(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -81154,7 +81408,7 @@ async function readNewestUnboundCandidate(dir) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path181.join(archiveDir, entries[i]);
+    const evidencePath = path182.join(archiveDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -81184,7 +81438,7 @@ function isFailureOutcome(g) {
   return g.outcome === "error" || g.outcome === "no_credential" || g.outcome === "conflict";
 }
 async function readNewestWrapUpOutcome(dir) {
-  const archiveDir = path181.join(dir, "slate-archive");
+  const archiveDir = path182.join(dir, "slate-archive");
   let entries;
   try {
     entries = (await readdir34(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
@@ -81193,7 +81447,7 @@ async function readNewestWrapUpOutcome(dir) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path181.join(archiveDir, entries[i]);
+    const evidencePath = path182.join(archiveDir, entries[i]);
     const result = readConfigFile(evidencePath);
     if (!result.ok) {
       continue;
@@ -82407,10 +82661,11 @@ var MCP_INSPECTOR_FOOTER = [
   { key: "\u2190/\u2192", label: "tabs" },
   { key: "esc", label: "close" }
 ];
-var MCP_TOOLS_COMMAND = "/mcp";
+var MCP_TOOLS_COMMAND = "/integrations";
+var MCP_TOOLS_COMMAND_RETIRED = "/mcp";
 function isMcpToolsCommand(line) {
   const token = line.trim().split(/\s+/)[0] ?? "";
-  return token === MCP_TOOLS_COMMAND;
+  return token === MCP_TOOLS_COMMAND || token === MCP_TOOLS_COMMAND_RETIRED;
 }
 var TOOLS_TAB_HEADER = "Built into keryx \u2014 not from an external MCP server (keryx doesn't consume MCP servers as a client yet).";
 var MCP_TAB_HEADER_1 = "Connects/disconnects ONLY keryx's own MCP server, one editor config at a time.";
@@ -83453,9 +83708,14 @@ var AGENT_SLASH_COMMANDS = [
     description: "Show project-wide items needing review (proposals, blocked sessions)",
     modes: AGENT_ONLY
   },
+  {
+    name: "/integrations",
+    description: "Wire this project into an editor over MCP (keryx integrate)",
+    modes: AGENT_ONLY
+  },
   {
     name: "/mcp",
-    description: "Show available tools and MCP client connect status",
+    description: "Deprecated alias of /integrations",
     modes: AGENT_ONLY
   },
   {
@@ -84649,10 +84909,10 @@ function describeElicitationPrompt(tool, inputJson) {
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path182 from "path";
+import path183 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path182.join(keryxConfigDir(dir), "permission-mode.json");
+  return path183.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -84820,6 +85080,20 @@ async function runAfterForegroundSettlement(owner, action) {
     action();
   }
 }
+async function forceForegroundQueueItem(owner, handoff, item, deps) {
+  const ownsSettlement = handoff.enqueue(item);
+  owner.cancel(deps.cancelReason ?? "queue item forced");
+  deps.announce?.();
+  if (!ownsSettlement) {
+    return;
+  }
+  await runAfterForegroundSettlement(owner, () => {
+    const next = handoff.takeAfterSettlement();
+    if (next !== undefined) {
+      deps.run(next);
+    }
+  });
+}
 function createForegroundAgentIoFacade(owner, token, io) {
   const accepts = () => owner.accepts(token);
   return {
@@ -85156,7 +85430,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path183 from "path";
+import path184 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -85358,7 +85632,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path183.join(configDir, "version-check.json");
+  const cacheFile = path184.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -90686,19 +90960,11 @@ Staying in the current session.
         return;
       mainQueue = removeMainQueueItem(mainQueue, index);
       paintMainQueue();
-      (async () => {
-        const waitsForSettlement = forceHandoff.enqueue(item);
-        foregroundOperation.cancel("queue item forced");
-        io.onSystem?.(`\u25C7 main turn interrupted \u2014 q${index + 1} will run next.
-`);
-        if (!waitsForSettlement)
-          return;
-        await runAfterForegroundSettlement(foregroundOperation, () => {
-          const next = forceHandoff.takeAfterSettlement();
-          if (next !== undefined)
-            runLine(next.question);
-        });
-      })();
+      forceForegroundQueueItem(foregroundOperation, forceHandoff, item, {
+        announce: () => io.onSystem?.(`\u25C7 main turn interrupted \u2014 q${index + 1} will run next.
+`),
+        run: (next) => runLine(next.question)
+      });
     };
     const handleQueueNavKey = (key) => {
       if (!queueNavActive) {
@@ -92329,10 +92595,24 @@ function realMakeProvider(write) {
     }
     return makeProvider(name, model, {
       fetch: globalThis.fetch,
-      ...baseUrl !== undefined ? { baseUrl } : {}
+      ...baseUrl !== undefined ? { baseUrl } : {},
+      ...oauthCredentialsFor(name)
     });
   };
 }
+function oauthCredentialsFor(name) {
+  const definition = providerByName(name);
+  const envKey = definition?.envKey;
+  if (envKey === undefined)
+    return {};
+  const fromEnv = process.env[envKey];
+  if (fromEnv !== undefined && fromEnv.length > 0)
+    return {};
+  const grant = loadOAuthGrant(name);
+  if (grant === undefined || grant.access.length === 0)
+    return {};
+  return { credentials: { ...process.env, [envKey]: grant.access } };
+}
 function realSelectProviderModel(baseUrl) {
   return async (io, opts) => {
     const detected = await detectProviders({
@@ -93738,7 +94018,7 @@ Shell:
 init_fs();
 import { readFile as readFile98 } from "fs/promises";
 import { stdin } from "process";
-import path184 from "path";
+import path185 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -93784,8 +94064,8 @@ async function modulesCommand(args = []) {
     return;
   }
   const wantsJson = args.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path184.join(process.cwd(), ".metaproject");
-  const manifestPath = path184.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path185.join(process.cwd(), ".metaproject");
+  const manifestPath = path185.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -93916,9 +94196,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync8
 } from "fs";
-import path185 from "path";
+import path186 from "path";
 function serveCredentialPath(dir) {
-  return path185.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path186.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -94152,22 +94432,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash43 } from "crypto";
 import { existsSync as existsSync32, readdirSync as readdirSync3, rmSync as rmSync2 } from "fs";
-import path186 from "path";
+import path187 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path186.join(keryxConfigDir(dir), "turns");
+  return path187.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path186.join(turnsRoot(dir), turnId);
+  return path187.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest = createHash43("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path186.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path187.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest = createHash43("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path186.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path187.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -94231,7 +94511,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path186.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path187.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -94240,12 +94520,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path186.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path187.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error) {
     if (error?.code !== "ENOENT") {
       throw error;
     }
-    appendOwnerOnlyLine(path186.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path187.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -94253,7 +94533,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path186.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path187.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -94281,7 +94561,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path186.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path187.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -94300,7 +94580,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path186.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path187.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -94346,7 +94626,7 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 
 // src/lib/serve-turn.ts
 import { randomUUID as randomUUID31 } from "crypto";
-import path187 from "path";
+import path188 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -94415,9 +94695,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path187.resolve(declared);
+  const wanted = path188.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path187.resolve(entry.path) === wanted) {
+    if (path188.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -95453,7 +95733,7 @@ function printHelp19() {
 import { spawn as spawn6 } from "child_process";
 import { chmod as chmod4, mkdir as mkdir62, readFile as readFile99, readdir as readdir35, writeFile as writeFile54 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync33 } from "fs";
-import path188 from "path";
+import path189 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_config();
 init_config2();
@@ -95470,8 +95750,8 @@ async function updateCommand(args = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path188.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path188.basename(projectRoot)}/`);
+  const metaprojectRoot = path189.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path189.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -95532,7 +95812,7 @@ async function updateCommand(args = []) {
   nextSteps(steps);
 }
 async function previewServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path188.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path189.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const enableTasks = moduleEnabled2(manifest, "tasks") || !options.noTasks;
@@ -95561,12 +95841,12 @@ async function previewServiceFiles(projectRoot, options) {
   });
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path188.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path189.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile54(path188.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile54(path189.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -95603,9 +95883,9 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path188.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path189.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
   await writeRoutingEntrypointPair(metaprojectRoot, {
     enableGdgraph,
     enableGdctx,
@@ -95628,7 +95908,7 @@ async function refreshServiceFiles(projectRoot, options) {
       }
     }
   });
-  await writeTextIfChanged4(path188.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path189.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -95640,7 +95920,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path188.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path189.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -95653,31 +95933,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   if (enableGdskills) {
     await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
@@ -95686,25 +95966,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path188.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path188.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path189.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path189.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -95717,24 +95997,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path188.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path188.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path189.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path189.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -95785,13 +96065,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path188.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path189.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path188.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path189.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -95811,7 +96091,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path188.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path189.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -95831,11 +96111,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path188.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path189.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path188.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path189.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -95850,7 +96130,7 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot = path188.join(metaprojectRoot, "flows");
+  const flowsRoot = path189.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot)) {
     return null;
   }
@@ -95862,7 +96142,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path188.join(flowsRoot, dir, "flow.json");
+    const flowPath = path189.join(flowsRoot, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -95870,7 +96150,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile99(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath = path188.join(flowsRoot, dir, "acceptance-criteria.md");
+      const acPath = path189.join(flowsRoot, dir, "acceptance-criteria.md");
       if (await pathExists(acPath)) {
         const acContent = await readFile99(acPath, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -95924,7 +96204,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path188.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path189.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -95941,7 +96221,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath = path188.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath = path189.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath)) {
     return;
   }
@@ -96050,8 +96330,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path188.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path188.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path189.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path189.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -96102,8 +96382,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath = path188.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path188.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath = path189.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path189.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath)) {
     const report = JSON.parse(await readFile99(reportPath, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -96132,7 +96412,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path188.relative(root, filePath).split(path188.sep).join("/");
+    const relativePath = path189.relative(root, filePath).split(path189.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -96153,7 +96433,7 @@ async function listMarkdownFiles(root) {
   const entries = await readdir35(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path188.join(root, entry.name);
+    const fullPath = path189.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -96201,7 +96481,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path188.basename(path188.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path189.basename(path189.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys),
     paths: {
@@ -96291,11 +96571,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile54(path188.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile54(path189.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path188.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path189.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -96318,7 +96598,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path188.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path189.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -96354,72 +96634,72 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path188.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path188.join(projectRuntime, ".git"))) {
+  const projectRuntime = path189.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path189.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path188.join(home, ".keryx", "keryx");
-  if (await pathExists(path188.join(globalRuntime, ".git"))) {
+  const globalRuntime = path189.join(home, ".keryx", "keryx");
+  if (await pathExists(path189.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path188.join(metaprojectRoot, "core"),
-    path188.join(metaprojectRoot, "hooks", "post-update.d"),
-    path188.join(metaprojectRoot, "modules"),
-    path188.join(metaprojectRoot, "rules"),
-    path188.join(metaprojectRoot, "skills", "project-rules"),
+    path189.join(metaprojectRoot, "core"),
+    path189.join(metaprojectRoot, "hooks", "post-update.d"),
+    path189.join(metaprojectRoot, "modules"),
+    path189.join(metaprojectRoot, "rules"),
+    path189.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path188.join(metaprojectRoot, "core", "gdgraph"),
-      path188.join(metaprojectRoot, "skills", "gdgraph")
+      path189.join(metaprojectRoot, "core", "gdgraph"),
+      path189.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path188.join(metaprojectRoot, "core", "gdctx"),
-      path188.join(metaprojectRoot, "skills", "gdctx")
+      path189.join(metaprojectRoot, "core", "gdctx"),
+      path189.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path188.join(metaprojectRoot, "skills", "gdwiki"),
-      path188.join(metaprojectRoot, "wiki", "templates")
+      path189.join(metaprojectRoot, "skills", "gdwiki"),
+      path189.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path188.join(metaprojectRoot, "core", "health"),
-      path188.join(metaprojectRoot, "skills", "health")
+      path189.join(metaprojectRoot, "core", "health"),
+      path189.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path188.join(metaprojectRoot, "core", "testing"),
-      path188.join(metaprojectRoot, "skills", "testing")
+      path189.join(metaprojectRoot, "core", "testing"),
+      path189.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path188.join(metaprojectRoot, "core", "memory"),
-      path188.join(metaprojectRoot, "skills", "memory"),
-      path188.join(metaprojectRoot, "memory", "templates")
+      path189.join(metaprojectRoot, "core", "memory"),
+      path189.join(metaprojectRoot, "skills", "memory"),
+      path189.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path188.join(metaprojectRoot, "flows"),
-      path188.join(metaprojectRoot, "skills", "flow")
+      path189.join(metaprojectRoot, "flows"),
+      path189.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path188.join(metaprojectRoot, "core", "security")
+      path189.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path188.join(metaprojectRoot, "skills", "sac")
+      path189.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
   await Promise.all(dirs.map((dir) => mkdir62(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path188.join(metaprojectRoot, "core", "gdgraph");
+  const gdgraphCoreRoot = path189.join(metaprojectRoot, "core", "gdgraph");
   await mkdir62(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path188.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path189.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path188.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path189.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
@@ -96427,7 +96707,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
     return;
   }
   await mkdir62(hooksRoot, { recursive: true });
-  const hookPath = path188.join(hooksRoot, hookName);
+  const hookPath = path189.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -96436,7 +96716,7 @@ ${blockEnd}`;
   const existing = await pathExists(hookPath) ? await readFile99(hookPath, "utf8") : `#!/usr/bin/env sh
 `;
   const blockPattern = new RegExp(`${escapeRegExp7(blockStart)}[\\s\\S]*?${escapeRegExp7(blockEnd)}`);
-  const next = blockPattern.test(existing) ? existing.replace(blockPattern, managedBlock) : `${existing.trimEnd()}
+  const next = blockPattern.test(existing) ? existing.replace(blockPattern, () => managedBlock) : `${existing.trimEnd()}
 
 ${managedBlock}
 `;
@@ -96448,7 +96728,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path188.join(hooksRoot, hookName);
+  const hookPath = path189.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -96470,7 +96750,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path188.join(hooksRoot, "pre-push");
+  const hookPath = path189.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -96485,7 +96765,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile99(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path188.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path189.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -96554,7 +96834,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path188.join(root, candidate))) {
+    if (await pathExists(path189.join(root, candidate))) {
       return true;
     }
   }
@@ -96577,13 +96857,13 @@ function parseUpdateArgs(args) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path188.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path189.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
   const entries = (await readdir35(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path188.join(hooksDir, entry);
+    const hookPath = path189.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -96624,14 +96904,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile99(filePath, "utf8") === content) {
     return;
   }
-  await mkdir62(path188.dirname(filePath), { recursive: true });
+  await mkdir62(path189.dirname(filePath), { recursive: true });
   await writeFile54(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir62(path188.dirname(filePath), { recursive: true });
+  await mkdir62(path189.dirname(filePath), { recursive: true });
   await writeFile54(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -96639,7 +96919,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile99(to, "utf8") === next) {
     return;
   }
-  await mkdir62(path188.dirname(to), { recursive: true });
+  await mkdir62(path189.dirname(to), { recursive: true });
   await writeFile54(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -96648,7 +96928,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path188.join(path188.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path189.join(path189.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync33(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -96683,7 +96963,7 @@ function printHelp20() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn7 } from "child_process";
-import path189 from "path";
+import path190 from "path";
 init_args();
 async function dashboardCommand(args = []) {
   const options = parseOptions(args);
@@ -96694,7 +96974,7 @@ async function dashboardCommand(args = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path189.relative(process.cwd(), result.path);
+    const rel = path190.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -96702,7 +96982,7 @@ async function dashboardCommand(args = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path189.relative(process.cwd(), result.path);
+    const rel = path190.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -96751,7 +97031,7 @@ import { readFileSync as readFileSync8 } from "fs";
 // src/agents/bootstrap.ts
 import { mkdir as mkdir63, readFile as readFile100, writeFile as writeFile55 } from "fs/promises";
 import { homedir as homedir8 } from "os";
-import path190 from "path";
+import path191 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -96761,35 +97041,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path190.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path191.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path190.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path191.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path190.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path191.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path190.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path191.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path190.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path191.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -96837,7 +97117,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir63(path190.dirname(filePath), { recursive: true });
+    await mkdir63(path191.dirname(filePath), { recursive: true });
     await writeFile55(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -97199,7 +97479,7 @@ function reduceAgents(events) {
 
 // src/commands/agents.ts
 init_args();
-var RUNTIME_USAGE2 = "<claude|opencode|zcode|codex|antigravity|all>";
+var RUNTIME_USAGE = "<claude|opencode|zcode|codex|antigravity|all>";
 async function agentsCommand(args = []) {
   const subcommand = args[0];
   if (!subcommand || subcommand === "--help" || subcommand === "-h") {
@@ -97345,9 +97625,9 @@ async function bootstrapCommand(args) {
 function printAgentsHelp() {
   helpTitle("keryx agents", "manage agent bootstrap instructions and monitor a subagent fleet");
   helpUsage([
-    `keryx agents bootstrap status --runtime ${RUNTIME_USAGE2}`,
-    `keryx agents bootstrap install --runtime ${RUNTIME_USAGE2} [--dry-run]`,
-    `keryx agents bootstrap uninstall --runtime ${RUNTIME_USAGE2} [--dry-run]`,
+    `keryx agents bootstrap status --runtime ${RUNTIME_USAGE}`,
+    `keryx agents bootstrap install --runtime ${RUNTIME_USAGE} [--dry-run]`,
+    `keryx agents bootstrap uninstall --runtime ${RUNTIME_USAGE} [--dry-run]`,
     "keryx agents bootstrap print",
     "keryx agents monitor <events-file> [--json]",
     "keryx agents external list [--json] [--no-probe]",
@@ -97357,9 +97637,9 @@ function printAgentsHelp() {
 function printBootstrapHelp() {
   helpTitle("keryx agents bootstrap", "install optional Metaproject routing into global agent entrypoints");
   helpUsage([
-    `keryx agents bootstrap status --runtime ${RUNTIME_USAGE2}`,
-    `keryx agents bootstrap install --runtime ${RUNTIME_USAGE2} [--dry-run]`,
-    `keryx agents bootstrap uninstall --runtime ${RUNTIME_USAGE2} [--dry-run]`,
+    `keryx agents bootstrap status --runtime ${RUNTIME_USAGE}`,
+    `keryx agents bootstrap install --runtime ${RUNTIME_USAGE} [--dry-run]`,
+    `keryx agents bootstrap uninstall --runtime ${RUNTIME_USAGE} [--dry-run]`,
     "keryx agents bootstrap print"
   ]);
   helpOptions([
@@ -97374,7 +97654,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile101 } from "fs/promises";
-import path192 from "path";
+import path193 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -98191,7 +98471,7 @@ function buildContainmentManifest(inputs, options = {}) {
 
 // src/metrics/oracle-runner.ts
 import { mkdir as mkdir64, writeFile as writeFile56 } from "fs/promises";
-import path191 from "path";
+import path192 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -98637,9 +98917,9 @@ function buildEvidenceBundle(input, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path191.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  const dir = path192.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
   await mkdir64(dir, { recursive: true });
-  const write = (name, value) => writeFile56(path191.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const write = (name, value) => writeFile56(path192.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -98679,7 +98959,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path192.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path193.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest = await readLatestPointer(root);
     console.log(`latest: ${latest.status}`);
     return;
@@ -98691,7 +98971,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+    const record = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error of result.errors)
@@ -98716,7 +98996,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path192.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path193.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -98733,8 +99013,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile101(path192.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile101(path192.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile101(path193.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile101(path193.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -98768,8 +99048,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path192.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path192.relative(projectRoot, path192.resolve(projectRoot, out))}`);
+    await Bun.write(path193.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path193.relative(projectRoot, path193.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args[1] === "run") {
@@ -98783,7 +99063,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
     const input = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input);
     console.log(stableJson(result));
@@ -98795,7 +99075,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -98866,7 +99146,7 @@ async function runHarnessLayer(projectRoot, args, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error) {
@@ -98897,7 +99177,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -98922,7 +99202,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -98947,7 +99227,7 @@ async function runSafetyContainmentLayer(projectRoot, args, ladder, caseClass) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -99009,12 +99289,12 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path192.resolve(projectRoot, outDir);
+    const resolvedOut = path193.resolve(projectRoot, outDir);
     for (const input of inputs) {
       for (const named of input.golds) {
         const bundle = buildEvidenceBundle({ target: input.target, system: input.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path192.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path192.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path193.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path193.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -99038,7 +99318,7 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args, ladder) {
@@ -99075,7 +99355,7 @@ async function runTestingLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args, ladder) {
@@ -99112,11 +99392,11 @@ async function runMemoryLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -99172,7 +99452,7 @@ async function runWikiLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -99210,7 +99490,7 @@ async function collect(projectRoot, args) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile101(path192.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile101(path193.resolve(projectRoot, eventFile), "utf8"));
   const events = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args, "--started-at") ?? events[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args, "--finished-at") ?? events.at(-1)?.timestamp_utc ?? startedAt;
@@ -99226,11 +99506,11 @@ async function collect(projectRoot, args) {
     parentRunId: optionValue(args, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record, { cwd: projectRoot });
-  console.log(`json: ${path192.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path192.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path193.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path193.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path192.join(projectRoot, ".metaproject", "data", "metrics");
+  return path193.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -100122,6 +100402,8 @@ var CLI_ROUTES = {
   commands: commandsCommand,
   security: securityCommand,
   sandbox: sandboxCommand,
+  "serve-mcp": serveMcpCommand,
+  integrate: integrateCommand,
   mcp: mcpCommand,
   harness: harnessCommand,
   shell: shellCommand,
@@ -100260,10 +100542,12 @@ Usage:
   keryx security incidents [--limit <n>]
   keryx security hooks install --runtime <claude|cursor|windsurf|generic-mcp|all>
   keryx security eval [--corpus <name|all>] [--with-model]
-  keryx mcp serve [--http] [--cwd <project-root>]
+  keryx serve-mcp [--http] [--cwd <project-root>]
+  keryx integrate [--remove] <cursor|claude|opencode|vscode|generic|all> [--dry-run]
+  keryx mcp serve [--http] ...                  # retired: use keryx serve-mcp
   keryx workspace create --title <title> [--component <workspace-relative-ref>]
   keryx workspace list|show|add-resource
-  keryx mcp install|uninstall --runtime <cursor|claude|opencode|generic|all> [--dry-run]
+  keryx mcp install|uninstall --runtime ...     # retired: use keryx integrate
   keryx retention status [--json]
   keryx retention sweep [--apply] [--target <id>]... [--max-age-days <n>] [--max-bytes <n>] [--json]
                                                Bound gdctx raw/artifacts logs and owner write-conflict
@@ -100308,7 +100592,9 @@ Commands:
   commands  Agent-callable command registry (intents, args, output, model usage)
   security  Policy-based scanning, redaction, guardrails and audit reports
   sandbox   Report OS sandbox launcher availability and the per-capability containment matrix
-  mcp       Expose Metaproject services over the Model Context Protocol (opt-in)
+  serve-mcp Expose Metaproject services over the Model Context Protocol (opt-in)
+  integrate Wire this project into an editor or agent as an MCP server
+  mcp       Retired spelling of serve-mcp / integrate; still works, names its replacement
   metrics   Provenance-aware execution observability: run records, baselines, benchmarks
   workspace Shared Agent Context: workspaces, FWK reads, propose/review (module sac)
   retention Bound stores that grow without bound (gdctx raw/artifacts, owner write-conflict sidecars)