@mrciphersmith/keryx 0.2.96 → 0.2.97

package/dist/cli.js

@@ -40253,9 +40253,9 @@ var init_memory = __esm(() => {
 
 // src/lib/serve-config.ts
 import { existsSync as existsSync25 } from "fs";
-import path173 from "path";
+import path174 from "path";
 function serveConfigPath(dir) {
-  return path173.join(keryxConfigDir(dir), "serve.json");
+  return path174.join(keryxConfigDir(dir), "serve.json");
 }
 function parseIpv4(value) {
   const parts = value.split(".");
@@ -47249,7 +47249,7 @@ import path43 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.96",
+  version: "0.2.97",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -69894,12 +69894,12 @@ function entryProblems(name, entry) {
 }
 function oauthProblems(name, oauth) {
   const problems = [];
-  const known = new Set(["clientId", "clientSecretEnvVar", "scopes", "callbackPort"]);
+  const known = new Set(["clientId", "scopes", "callbackPort"]);
   for (const key of Object.keys(oauth)) {
     if (!known.has(key))
       problems.push(`server "${name}" oauth has unknown field "${key}"`);
   }
-  for (const field of ["clientId", "clientSecretEnvVar"]) {
+  for (const field of ["clientId"]) {
     if (oauth[field] !== undefined && typeof oauth[field] !== "string") {
       problems.push(`server "${name}" oauth.${field} must be a string`);
     }
@@ -70459,6 +70459,229 @@ function createMcpInteractiveTools(deps) {
   return [searchTool, useTool];
 }
 
+// src/mcp-servers/credentials.ts
+init_config_dir();
+import path165 from "path";
+var FORGET_CODE_VERIFIER = { code_verifier: undefined };
+var CREDENTIALS_SCHEMA_VERSION = 1;
+function credentialsFile(configDir) {
+  return path165.join(configDir ?? ensureKeryxConfigDir(), "mcp-credentials.json");
+}
+function credentialKey(serverName, serverUrl) {
+  return `${serverName}:${serverUrl}`;
+}
+function readAll2(configDir) {
+  const file = credentialsFile(configDir);
+  const read = readConfigFile(file);
+  if (!read.ok) {
+    return isDefiniteAbsence(read.reason) ? { file: {} } : { file: {}, problem: `${file} could not be read (${read.reason})` };
+  }
+  try {
+    const parsed = parseJsonTolerant(read.text);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return { file: {}, problem: `${file} must be a JSON object` };
+    }
+    const parsedFile = parsed;
+    if (typeof parsedFile.schemaVersion === "number" && parsedFile.schemaVersion > CREDENTIALS_SCHEMA_VERSION) {
+      return {
+        file: {},
+        problem: `${file} was written by a newer keryx ` + `(schemaVersion ${parsedFile.schemaVersion} > ${CREDENTIALS_SCHEMA_VERSION}); nothing was changed`
+      };
+    }
+    return { file: parsedFile };
+  } catch (error) {
+    return {
+      file: {},
+      problem: `${file} is not valid JSON (${error instanceof Error ? error.message : String(error)}); nothing was changed`
+    };
+  }
+}
+function readCredential(serverName, serverUrl, configDir) {
+  const { file, problem } = readAll2(configDir);
+  const record = file.credentials?.[credentialKey(serverName, serverUrl)];
+  return problem === undefined ? { record } : { record, problem };
+}
+function writeCredential(serverName, serverUrl, patch, configDir) {
+  const target = credentialsFile(configDir);
+  const outcome = withFileLock2(`${target}.lock`, () => mergeUnlocked(target, serverName, serverUrl, patch, configDir));
+  if (outcome === null) {
+    return { ok: false, error: `${target} is locked by another keryx; nothing was written` };
+  }
+  return outcome;
+}
+function mergeUnlocked(target, serverName, serverUrl, patch, configDir) {
+  const { file, problem } = readAll2(configDir);
+  if (problem !== undefined) {
+    return { ok: false, error: problem };
+  }
+  const key = credentialKey(serverName, serverUrl);
+  const credentials = { ...file.credentials, [key]: { ...file.credentials?.[key], ...patch } };
+  writeOwnerOnlyFileAtomic(target, `${JSON.stringify({ schemaVersion: CREDENTIALS_SCHEMA_VERSION, credentials }, null, 2)}
+`);
+  return { ok: true, file: target };
+}
+function clearCredential(serverName, serverUrl, configDir) {
+  const target = credentialsFile(configDir);
+  const outcome = withFileLock2(`${target}.lock`, () => {
+    const { file, problem } = readAll2(configDir);
+    if (problem !== undefined)
+      return { ok: false, error: problem };
+    const credentials = { ...file.credentials };
+    delete credentials[credentialKey(serverName, serverUrl)];
+    writeOwnerOnlyFileAtomic(target, `${JSON.stringify({ schemaVersion: CREDENTIALS_SCHEMA_VERSION, credentials }, null, 2)}
+`);
+    return { ok: true, file: target };
+  });
+  if (outcome === null) {
+    return { ok: false, error: `${target} is locked by another keryx; nothing was removed` };
+  }
+  return outcome;
+}
+function forgetByName(serverName, configDir) {
+  const target = credentialsFile(configDir);
+  const outcome = withFileLock2(`${target}.lock`, () => {
+    const { file, problem } = readAll2(configDir);
+    if (problem !== undefined)
+      return { count: 0, error: problem };
+    const credentials = { ...file.credentials };
+    let count = 0;
+    for (const key of Object.keys(credentials)) {
+      const separator = key.indexOf(":");
+      if (separator === -1)
+        continue;
+      if (key.slice(0, separator) !== serverName)
+        continue;
+      delete credentials[key];
+      count++;
+    }
+    if (count > 0) {
+      writeOwnerOnlyFileAtomic(target, `${JSON.stringify({ schemaVersion: CREDENTIALS_SCHEMA_VERSION, credentials }, null, 2)}
+`);
+    }
+    return { count };
+  });
+  return outcome ?? { count: 0, error: `${target} is locked by another keryx; nothing was removed` };
+}
+var EXPIRY_MARGIN_MS = 30000;
+function isExpired(tokens, now) {
+  if (tokens === undefined)
+    return true;
+  if (tokens.expires_at === undefined) {
+    return false;
+  }
+  return tokens.expires_at - EXPIRY_MARGIN_MS <= now;
+}
+function describeCredential(record, now) {
+  if (record?.tokens === undefined)
+    return "no stored credential";
+  if (isExpired(record.tokens, now)) {
+    return record.tokens.refresh_token === undefined ? "stored credential has expired; re-authenticate" : "stored credential has expired; it will be refreshed on the next connect";
+  }
+  if (record.tokens.expires_at === undefined)
+    return "stored credential, no stated expiry";
+  const minutes = Math.max(0, Math.round((record.tokens.expires_at - now) / 60000));
+  return `stored credential, valid for about ${minutes} more minute(s)`;
+}
+function usesOAuth(server) {
+  if (typeof server.url !== "string" || server.url === "")
+    return false;
+  if (server.oauth === false)
+    return false;
+  if (server.bearer_token_env_var !== undefined && server.bearer_token_env_var !== "")
+    return false;
+  return !Object.keys(server.headers ?? {}).some((name) => name.toLowerCase() === "authorization");
+}
+
+// src/mcp-servers/oauth-provider.ts
+class OAuthInteractionRequiredError extends Error {
+  serverName;
+  constructor(serverName) {
+    super(`server "${serverName}" needs OAuth and this process cannot ask: run \`keryx mcp auth ${serverName}\` in a terminal`);
+    this.serverName = serverName;
+    this.name = "OAuthInteractionRequiredError";
+  }
+}
+var CLIENT_NAME = "keryx";
+function createOAuthProvider(deps) {
+  const now = deps.now ?? Date.now;
+  const read = () => readCredential(deps.serverName, deps.serverUrl, deps.configDir);
+  return {
+    get redirectUrl() {
+      return deps.redirectUrl;
+    },
+    get clientMetadata() {
+      return {
+        client_name: CLIENT_NAME,
+        redirect_uris: deps.redirectUrl === undefined ? [] : [deps.redirectUrl],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        ...deps.scopes === undefined || deps.scopes.length === 0 ? {} : { scope: deps.scopes.join(" ") },
+        token_endpoint_auth_method: "none"
+      };
+    },
+    state() {
+      if (deps.state === undefined) {
+        if (!deps.interactive)
+          throw new OAuthInteractionRequiredError(deps.serverName);
+        throw new Error("no callback listener is running; state is minted by the listener");
+      }
+      return deps.state;
+    },
+    clientInformation() {
+      if (deps.clientId !== undefined && deps.clientId !== "") {
+        return { client_id: deps.clientId };
+      }
+      return read().record?.client;
+    },
+    saveClientInformation(client) {
+      if (!deps.interactive)
+        throw new OAuthInteractionRequiredError(deps.serverName);
+      const write = writeCredential(deps.serverName, deps.serverUrl, { client }, deps.configDir);
+      if (!write.ok)
+        throw new Error(write.error);
+    },
+    tokens() {
+      const stored = read().record?.tokens;
+      if (stored === undefined)
+        return;
+      if (isExpired(stored, now()) && stored.refresh_token === undefined)
+        return;
+      return stored;
+    },
+    saveTokens(sdkTokens) {
+      const tokens = {
+        access_token: sdkTokens.access_token,
+        ...sdkTokens.token_type === undefined ? {} : { token_type: sdkTokens.token_type },
+        ...sdkTokens.refresh_token === undefined ? {} : { refresh_token: sdkTokens.refresh_token },
+        ...sdkTokens.scope === undefined ? {} : { scope: sdkTokens.scope },
+        ...sdkTokens.expires_in === undefined ? {} : { expires_at: now() + sdkTokens.expires_in * 1000 }
+      };
+      const write = writeCredential(deps.serverName, deps.serverUrl, { tokens, ...FORGET_CODE_VERIFIER }, deps.configDir);
+      if (!write.ok)
+        throw new Error(write.error);
+    },
+    async redirectToAuthorization(url) {
+      if (!deps.interactive)
+        throw new OAuthInteractionRequiredError(deps.serverName);
+      if (deps.openBrowser === undefined)
+        throw new OAuthInteractionRequiredError(deps.serverName);
+      await deps.openBrowser(url);
+    },
+    saveCodeVerifier(codeVerifier) {
+      const write = writeCredential(deps.serverName, deps.serverUrl, { code_verifier: codeVerifier }, deps.configDir);
+      if (!write.ok)
+        throw new Error(write.error);
+    },
+    codeVerifier() {
+      const verifier = read().record?.code_verifier;
+      if (verifier === undefined) {
+        throw new Error("no PKCE verifier stored; the authorisation was not started by this keryx");
+      }
+      return verifier;
+    }
+  };
+}
+
 // src/mcp-servers/doctor.ts
 function redactValues(values) {
   const out = {};
@@ -70555,12 +70778,38 @@ async function diagnose(server, options) {
         detail: describeHollow(resolved.hollow)
       };
     }
+    const declaresOAuth = server.raw.oauth !== undefined && server.raw.oauth !== false;
+    if (declaresOAuth && usesOAuth(server.raw)) {
+      const stored = readCredential(server.name, server.url ?? "", options.configDir);
+      if (stored.problem !== undefined) {
+        return { ...base, status: "needs_auth", toolCount: 0, skipped: [], detail: stored.problem };
+      }
+      const tokens = stored.record?.tokens;
+      if (tokens === undefined || isExpired(tokens, (options.now ?? Date.now)()) && tokens.refresh_token === undefined) {
+        return {
+          ...base,
+          status: "needs_auth",
+          toolCount: 0,
+          skipped: [],
+          detail: tokens === undefined ? `no stored credential; run \`keryx mcp auth ${server.name}\`` : `stored credential has expired and cannot be refreshed; run \`keryx mcp auth ${server.name}\``
+        };
+      }
+    }
   }
   const timeoutMs = server.startup_timeout_sec !== undefined ? server.startup_timeout_sec * 1000 : options.connectTimeoutMs ?? DEFAULT_DOCTOR_TIMEOUT_MS;
   let connection;
   try {
     connection = await withTimeout(options.connect(server), timeoutMs, server.name);
   } catch (error) {
+    if (base.transport === "http" && usesOAuth(server.raw) && needsAuthorisation(error)) {
+      return {
+        ...base,
+        status: "needs_auth",
+        toolCount: 0,
+        skipped: [],
+        detail: `${displayUrl(server.raw.url)} requires authorisation; run \`keryx mcp auth ${server.name}\``
+      };
+    }
     return {
       ...base,
       status: "failed",
@@ -70586,6 +70835,20 @@ async function diagnose(server, options) {
     } catch {}
   }
 }
+function needsAuthorisation(error) {
+  if (httpStatusOf(error) === 401)
+    return true;
+  if (error instanceof OAuthInteractionRequiredError)
+    return true;
+  return DEAD_CREDENTIAL_CODES.has(oauthErrorCodeOf(error));
+}
+var DEAD_CREDENTIAL_CODES = new Set(["invalid_grant", "invalid_client"]);
+function oauthErrorCodeOf(error) {
+  if (typeof error !== "object" || error === null)
+    return "";
+  const code = error.errorCode;
+  return typeof code === "string" ? code : "";
+}
 function explainConnectFailure(transport, server, error) {
   const message = sanitiseForDisplay(messageOf(error));
   if (transport !== "http")
@@ -70710,193 +70973,144 @@ function formatDoctorReport(report) {
 `);
 }
 
-// src/mcp-servers/runtime.ts
-import path166 from "path";
-
-// src/mcp-servers/manager.ts
-var DEFAULT_CONNECT_CONCURRENCY = 4;
-var DEFAULT_STARTUP_TIMEOUT_MS = 15000;
-async function startServers(servers, connect, options = {}) {
-  const concurrency = Math.max(1, options.concurrency ?? DEFAULT_CONNECT_CONCURRENCY);
-  const states = new Map;
-  const catalogs = [];
-  const enabled = [];
-  for (const server of servers) {
-    if (server.enabled) {
-      enabled.push(server);
-    } else {
-      states.set(server.name, { name: server.name, status: "disabled", toolCount: 0 });
-    }
+// src/lib/oauth/open-url.ts
+import { spawn as spawn5 } from "child_process";
+function browserOpenPlan(url, platform = process.platform, env = process.env) {
+  if (url.length === 0) {
+    return;
   }
-  let next = 0;
-  const worker = async () => {
-    for (;; ) {
-      const index = next++;
-      const server = enabled[index];
-      if (server === undefined)
-        return;
-      const timeoutMs = server.startup_timeout_sec !== undefined ? server.startup_timeout_sec * 1000 : options.defaultStartupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
-      let connection;
-      try {
-        connection = await withTimeout2(connect(server), timeoutMs, server.name, (late) => {
-          late.close().catch(() => {});
+  if (platform === "darwin") {
+    return { cmd: "open", args: [url] };
+  }
+  if (platform === "win32") {
+    return { cmd: "cmd", args: ["/c", "start", "", url] };
+  }
+  if (typeof env.DISPLAY === "string" && env.DISPLAY.length > 0) {
+    return { cmd: "xdg-open", args: [url] };
+  }
+  if (typeof env.WAYLAND_DISPLAY === "string" && env.WAYLAND_DISPLAY.length > 0) {
+    return { cmd: "xdg-open", args: [url] };
+  }
+  return;
+}
+function openVerificationUrl(url, deps = {}) {
+  const plan = browserOpenPlan(url, deps.platform ?? process.platform, deps.env ?? process.env);
+  if (plan === undefined) {
+    return;
+  }
+  const spawnFn = deps.spawn ?? spawn5;
+  try {
+    const child = spawnFn(plan.cmd, plan.args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+
+// src/mcp-servers/oauth-callback.ts
+import { randomBytes as randomBytes4, timingSafeEqual } from "crypto";
+function matchesState(given, expected) {
+  if (given === null)
+    return false;
+  const a = Buffer.from(given, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length)
+    return false;
+  return timingSafeEqual(a, b);
+}
+var LOOPBACK_HOST = "127.0.0.1";
+var CALLBACK_TIMEOUT_MS = 5 * 60000;
+function page(title, detail) {
+  return [
+    "<!doctype html><meta charset=utf-8>",
+    `<title>${title}</title>`,
+    '<body style="font:14px system-ui;padding:3rem;max-width:34rem">',
+    `<h1 style="font-size:1.1rem">${title}</h1>`,
+    `<p>${detail}</p>`,
+    "</body>"
+  ].join("");
+}
+function startCallbackListener(options = {}) {
+  const state = randomBytes4(32).toString("base64url");
+  const timeoutMs = options.timeoutMs ?? CALLBACK_TIMEOUT_MS;
+  const serve = options.serve ?? Bun.serve;
+  let settle = () => {};
+  const result = new Promise((resolve) => {
+    settle = resolve;
+  });
+  let done = false;
+  let timer;
+  const server = serve({
+    hostname: LOOPBACK_HOST,
+    port: options.port ?? 0,
+    fetch(request) {
+      const url = new URL(request.url);
+      if (done) {
+        return new Response(page("Already handled", "This authorisation was already completed."), {
+          status: 410,
+          headers: { "content-type": "text/html" }
         });
-        const tools = await withTimeout2(connection.listTools(), timeoutMs, server.name);
-        const catalog = catalogForServer(server.name, tools);
-        catalogs.push(catalog);
-        states.set(server.name, {
-          name: server.name,
-          status: "connected",
-          toolCount: catalog.entries.length,
-          connection
+      }
+      const given = url.searchParams.get("state");
+      if (!matchesState(given, state)) {
+        return new Response(page("Not this flow", "This request did not come from the authorisation keryx started."), {
+          status: 400,
+          headers: { "content-type": "text/html" }
         });
-      } catch (error) {
-        if (connection !== undefined) {
-          try {
-            await connection.close();
-          } catch {}
-        }
-        states.set(server.name, {
-          name: server.name,
-          status: "failed",
-          error: error instanceof Error ? error.message : String(error),
-          toolCount: 0
+      }
+      const error = url.searchParams.get("error");
+      if (error !== null) {
+        const description = url.searchParams.get("error_description");
+        done = true;
+        settle({ ok: false, reason: description === null ? error : `${error}: ${description}` });
+        return new Response(page("Authorisation refused", "You can close this tab and return to keryx."), {
+          status: 200,
+          headers: { "content-type": "text/html" }
+        });
+      }
+      const code = url.searchParams.get("code");
+      if (code === null || code === "") {
+        return new Response(page("No code", "The authorisation server returned no code."), {
+          status: 400,
+          headers: { "content-type": "text/html" }
         });
       }
+      done = true;
+      settle({ ok: true, code });
+      return new Response(page("Authorised", "keryx has what it needs. You can close this tab."), {
+        status: 200,
+        headers: { "content-type": "text/html" }
+      });
     }
-  };
-  await Promise.all(Array.from({ length: Math.min(concurrency, Math.max(enabled.length, 1)) }, worker));
-  return {
-    servers: [...states.values()].sort((a, b) => a.name.localeCompare(b.name)),
-    catalog: mergeCatalogs(catalogs)
-  };
-}
-async function withTimeout2(work, ms, name, onAbandoned) {
-  let timer;
-  let settled = false;
-  try {
-    return await Promise.race([
-      work,
-      new Promise((_resolve, reject) => {
-        timer = setTimeout(() => reject(new Error(`server "${name}" did not answer within ${ms}ms`)), ms);
-      })
-    ]).then((value) => {
-      settled = true;
-      return value;
-    });
-  } finally {
+  });
+  const close = () => {
     if (timer !== undefined)
       clearTimeout(timer);
-    if (!settled && onAbandoned !== undefined) {
-      work.then(onAbandoned).catch(() => {});
-    }
-  }
-}
-async function closeServers(states) {
-  await Promise.all(states.map(async (state) => {
+    timer = undefined;
     try {
-      await state.connection?.close();
+      server.stop(true);
     } catch {}
-  }));
-}
-
-// src/mcp-servers/trust.ts
-init_config_dir();
-import { createHash as createHash31 } from "crypto";
-import path165 from "path";
-function trustFile(configDir) {
-  return path165.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-trust.json");
-}
-function serverFingerprint(server) {
-  const material = JSON.stringify({
-    command: server.command ?? null,
-    args: server.args ?? [],
-    url: server.url ?? null,
-    env: server.env ?? {},
-    cwd: server.cwd ?? null,
-    headers: sortedKeys(server.headers),
-    bearer_token_env_var: server.bearer_token_env_var ?? null
+  };
+  timer = setTimeout(() => {
+    if (done)
+      return;
+    done = true;
+    settle({
+      ok: false,
+      reason: `no response within ${Math.round(timeoutMs / 1000)}s \u2014 the browser tab was never completed`
+    });
+  }, timeoutMs);
+  timer.unref?.();
+  result.then(() => {
+    const drain = setTimeout(close, 50);
+    drain.unref?.();
   });
-  return createHash31("sha256").update(material).digest("hex").slice(0, 32);
-}
-function sortedKeys(values) {
-  return Object.entries(values ?? {}).sort(([a], [b]) => a.localeCompare(b));
-}
-function trustKey(server) {
-  return `${server.file}::${server.name}`;
-}
-function loadTrustStore(configDir) {
-  const read = readConfigFile(trustFile(configDir));
-  if (!read.ok)
-    return {};
-  try {
-    const parsed = parseJsonTolerant(read.text);
-    const approvals = parsed.approvals;
-    if (approvals === undefined)
-      return {};
-    const clean = {};
-    for (const [key, value] of Object.entries(approvals)) {
-      if (typeof value === "string")
-        clean[key] = value;
-    }
-    return clean;
-  } catch {
-    return {};
-  }
-}
-function requiresApproval(server, approvals) {
-  if (!server.projectLocal)
-    return false;
-  return approvals[trustKey(server)] !== serverFingerprint(server);
-}
-function approveServer(server, configDir) {
-  const file = trustFile(configDir);
-  const read = readConfigFile(file);
-  if (!read.ok && !isDefiniteAbsence(read.reason)) {
-    return { ok: false, error: `${file} could not be read (${read.reason}); nothing was written` };
-  }
-  const approvals = loadTrustStore(configDir);
-  approvals[trustKey(server)] = serverFingerprint(server);
-  writeOwnerOnlyFileAtomic(file, `${JSON.stringify({ approvals }, null, 2)}
-`);
-  return { ok: true, file };
-}
-function revokeServer(server, configDir) {
-  const file = trustFile(configDir);
-  const approvals = loadTrustStore(configDir);
-  delete approvals[trustKey(server)];
-  writeOwnerOnlyFileAtomic(file, `${JSON.stringify({ approvals }, null, 2)}
-`);
-  return { ok: true, file };
-}
-function describeForApproval(server) {
-  const raw = server.raw;
-  if (raw.url !== undefined && raw.url.length > 0) {
-    const shown = displayUrl(raw.url);
-    const credentials = credentialSummary(raw);
-    return credentials === undefined ? shown : `${shown}  [sends ${credentials}]`;
-  }
-  return [raw.command, ...raw.args ?? []].filter(Boolean).join(" ");
-}
-function credentialSummary(raw) {
-  const named = new Set;
-  if (raw.bearer_token_env_var !== undefined && raw.bearer_token_env_var !== "") {
-    named.add(raw.bearer_token_env_var);
-  }
-  for (const value of Object.values(raw.headers ?? {})) {
-    for (const match of value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)/g))
-      named.add(match[1]);
-  }
-  const headerNames = Object.keys(raw.headers ?? {});
-  if (named.size === 0 && headerNames.length === 0)
-    return;
-  const parts = [];
-  if (named.size > 0)
-    parts.push([...named].sort().join(", "));
-  const literal = headerNames.filter((n) => !/\$\{/.test(raw.headers?.[n] ?? ""));
-  if (literal.length > 0)
-    parts.push(`literal header(s) ${literal.sort().join(", ")}`);
-  return parts.join(" + ");
+  return {
+    redirectUrl: `http://${LOOPBACK_HOST}:${server.port}/callback`,
+    boundHost: server.hostname ?? "",
+    state,
+    result,
+    close
+  };
 }
 
 // src/mcp-client/wire.ts
@@ -71015,6 +71229,7 @@ async function connectHttpMcpServer(url, options = {}) {
   }
   const sdk = await loadHttpSdk();
   const transport = new sdk.StreamableHTTPClientTransport(parsed, {
+    ...options.authProvider === undefined ? {} : { authProvider: options.authProvider },
     fetch: (input, init) => fetch(input, { ...init, redirect: "error" }),
     requestInit: {
       ...Object.keys(headers).length > 0 ? { headers } : {},
@@ -71148,6 +71363,195 @@ async function connectStdioMcpServer(argv, options, handshakeTimeoutMs, signal,
   };
 }
 
+// src/mcp-servers/runtime.ts
+import path167 from "path";
+
+// src/mcp-servers/manager.ts
+var DEFAULT_CONNECT_CONCURRENCY = 4;
+var DEFAULT_STARTUP_TIMEOUT_MS = 15000;
+async function startServers(servers, connect, options = {}) {
+  const concurrency = Math.max(1, options.concurrency ?? DEFAULT_CONNECT_CONCURRENCY);
+  const states = new Map;
+  const catalogs = [];
+  const enabled = [];
+  for (const server of servers) {
+    if (server.enabled) {
+      enabled.push(server);
+    } else {
+      states.set(server.name, { name: server.name, status: "disabled", toolCount: 0 });
+    }
+  }
+  let next = 0;
+  const worker = async () => {
+    for (;; ) {
+      const index = next++;
+      const server = enabled[index];
+      if (server === undefined)
+        return;
+      const timeoutMs = server.startup_timeout_sec !== undefined ? server.startup_timeout_sec * 1000 : options.defaultStartupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+      let connection;
+      try {
+        connection = await withTimeout2(connect(server), timeoutMs, server.name, (late) => {
+          late.close().catch(() => {});
+        });
+        const tools = await withTimeout2(connection.listTools(), timeoutMs, server.name);
+        const catalog = catalogForServer(server.name, tools);
+        catalogs.push(catalog);
+        states.set(server.name, {
+          name: server.name,
+          status: "connected",
+          toolCount: catalog.entries.length,
+          connection
+        });
+      } catch (error) {
+        if (connection !== undefined) {
+          try {
+            await connection.close();
+          } catch {}
+        }
+        states.set(server.name, {
+          name: server.name,
+          status: "failed",
+          error: error instanceof Error ? error.message : String(error),
+          toolCount: 0
+        });
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, Math.max(enabled.length, 1)) }, worker));
+  return {
+    servers: [...states.values()].sort((a, b) => a.name.localeCompare(b.name)),
+    catalog: mergeCatalogs(catalogs)
+  };
+}
+async function withTimeout2(work, ms, name, onAbandoned) {
+  let timer;
+  let settled = false;
+  try {
+    return await Promise.race([
+      work,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error(`server "${name}" did not answer within ${ms}ms`)), ms);
+      })
+    ]).then((value) => {
+      settled = true;
+      return value;
+    });
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+    if (!settled && onAbandoned !== undefined) {
+      work.then(onAbandoned).catch(() => {});
+    }
+  }
+}
+async function closeServers(states) {
+  await Promise.all(states.map(async (state) => {
+    try {
+      await state.connection?.close();
+    } catch {}
+  }));
+}
+
+// src/mcp-servers/trust.ts
+init_config_dir();
+import { createHash as createHash31 } from "crypto";
+import path166 from "path";
+function trustFile(configDir) {
+  return path166.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-trust.json");
+}
+function serverFingerprint(server) {
+  const material = JSON.stringify({
+    command: server.command ?? null,
+    args: server.args ?? [],
+    url: server.url ?? null,
+    env: server.env ?? {},
+    cwd: server.cwd ?? null,
+    headers: sortedKeys(server.headers),
+    bearer_token_env_var: server.bearer_token_env_var ?? null
+  });
+  return createHash31("sha256").update(material).digest("hex").slice(0, 32);
+}
+function sortedKeys(values) {
+  return Object.entries(values ?? {}).sort(([a], [b]) => a.localeCompare(b));
+}
+function trustKey(server) {
+  return `${server.file}::${server.name}`;
+}
+function loadTrustStore(configDir) {
+  const read = readConfigFile(trustFile(configDir));
+  if (!read.ok)
+    return {};
+  try {
+    const parsed = parseJsonTolerant(read.text);
+    const approvals = parsed.approvals;
+    if (approvals === undefined)
+      return {};
+    const clean = {};
+    for (const [key, value] of Object.entries(approvals)) {
+      if (typeof value === "string")
+        clean[key] = value;
+    }
+    return clean;
+  } catch {
+    return {};
+  }
+}
+function requiresApproval(server, approvals) {
+  if (!server.projectLocal)
+    return false;
+  return approvals[trustKey(server)] !== serverFingerprint(server);
+}
+function approveServer(server, configDir) {
+  const file = trustFile(configDir);
+  const read = readConfigFile(file);
+  if (!read.ok && !isDefiniteAbsence(read.reason)) {
+    return { ok: false, error: `${file} could not be read (${read.reason}); nothing was written` };
+  }
+  const approvals = loadTrustStore(configDir);
+  approvals[trustKey(server)] = serverFingerprint(server);
+  writeOwnerOnlyFileAtomic(file, `${JSON.stringify({ approvals }, null, 2)}
+`);
+  return { ok: true, file };
+}
+function revokeServer(server, configDir) {
+  const file = trustFile(configDir);
+  const approvals = loadTrustStore(configDir);
+  delete approvals[trustKey(server)];
+  writeOwnerOnlyFileAtomic(file, `${JSON.stringify({ approvals }, null, 2)}
+`);
+  return { ok: true, file };
+}
+function describeForApproval(server) {
+  const raw = server.raw;
+  if (raw.url !== undefined && raw.url.length > 0) {
+    const shown = displayUrl(raw.url);
+    const credentials = credentialSummary(raw);
+    return credentials === undefined ? shown : `${shown}  [sends ${credentials}]`;
+  }
+  return [raw.command, ...raw.args ?? []].filter(Boolean).join(" ");
+}
+function credentialSummary(raw) {
+  const named = new Set;
+  if (raw.bearer_token_env_var !== undefined && raw.bearer_token_env_var !== "") {
+    named.add(raw.bearer_token_env_var);
+  }
+  for (const value of Object.values(raw.headers ?? {})) {
+    for (const match of value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)/g))
+      named.add(match[1]);
+  }
+  const headerNames = Object.keys(raw.headers ?? {});
+  if (named.size === 0 && headerNames.length === 0)
+    return;
+  const parts = [];
+  if (named.size > 0)
+    parts.push([...named].sort().join(", "));
+  const literal = headerNames.filter((n) => !/\$\{/.test(raw.headers?.[n] ?? ""));
+  if (literal.length > 0)
+    parts.push(`literal header(s) ${literal.sort().join(", ")}`);
+  return parts.join(" + ");
+}
+
 // src/harness/external/env.ts
 var EXTERNAL_ENV_DENY = [
   "ANTHROPIC_API_KEY",
@@ -71376,7 +71780,7 @@ function createMcpRuntime(options) {
   ];
   const kills = [];
   const env = options.env ?? process.env;
-  const connect = options.connect ?? ((server) => defaultConnect(server, env, dialling.signal, kills));
+  const connect = options.connect ?? ((server) => defaultConnect(server, env, dialling.signal, kills, options.configDir));
   const settled = startServers(launchable, connect).then((result) => {
     catalog = result.catalog;
     states = [...heldStates, ...result.servers].sort((a, b) => a.name.localeCompare(b.name));
@@ -71421,7 +71825,25 @@ function handshakeBudgetMs(server) {
 }
 var MAX_TIMEOUT_MS = 24 * 60 * 60 * 1000;
 var DEFAULT_HANDSHAKE_MS = 15000;
-async function connectRemote(server, env, signal) {
+var SESSION_REDIRECT_URL = "http://127.0.0.1/keryx-session-never-listens";
+function sessionAuthProviderOptions(server, runtimeConfigDir, stored, now = Date.now()) {
+  if (!usesOAuth(server.raw))
+    return;
+  const tokens = stored?.tokens;
+  if (tokens === undefined)
+    return;
+  if (isExpired(tokens, now) && tokens.refresh_token === undefined)
+    return;
+  return {
+    serverName: server.name,
+    serverUrl: server.url,
+    ...runtimeConfigDir === undefined ? {} : { configDir: runtimeConfigDir },
+    redirectUrl: SESSION_REDIRECT_URL,
+    interactive: false,
+    ...server.oauth === false || server.oauth?.clientId === undefined ? {} : { clientId: server.oauth.clientId }
+  };
+}
+async function connectRemote(server, env, signal, runtimeConfigDir) {
   const target = remoteTargetProblem(server.raw, env);
   if (target !== undefined) {
     throw new Error(`server "${server.name}": ${target}`);
@@ -71430,8 +71852,11 @@ async function connectRemote(server, env, signal) {
   if (!resolved.ok) {
     throw new Error(`server "${server.name}": ${describeHollow(resolved.hollow)}`);
   }
+  const options = sessionAuthProviderOptions(server, runtimeConfigDir, server.url === undefined ? undefined : readCredential(server.name, server.url, runtimeConfigDir).record);
+  const authProvider = options === undefined ? undefined : createOAuthProvider(options);
   return connectHttpMcpServer(server.url, {
     headers: resolved.headers,
+    ...authProvider === undefined ? {} : { authProvider },
     handshakeTimeoutMs: handshakeBudgetMs(server),
     ...signal === undefined ? {} : { signal }
   });
@@ -71441,9 +71866,9 @@ function timeoutFor(server, rawName) {
     return;
   return server.tool_timeouts?.[rawName] ?? server.tool_timeout_sec;
 }
-async function defaultConnect(server, env, signal, kills) {
+async function defaultConnect(server, env, signal, kills, configDir) {
   if (transportOf(server) === "http")
-    return connectRemote(server, env, signal);
+    return connectRemote(server, env, signal, configDir);
   const command = server.command;
   if (command === undefined || command === "") {
     throw new Error(`server "${server.name}" sets neither command nor url`);
@@ -71456,22 +71881,22 @@ async function defaultConnect(server, env, signal, kills) {
 function defaultServerCwd(server, fallbackCwd = process.cwd()) {
   if (server.source !== "project")
     return fallbackCwd;
-  return path166.dirname(path166.dirname(server.file));
+  return path167.dirname(path167.dirname(server.file));
 }
 
 // src/mcp-servers/store.ts
 init_config_dir();
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import path167 from "path";
+import path168 from "path";
 var SERVER_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
 function userConfigFile(configDir) {
-  return path167.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers.json");
+  return path168.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers.json");
 }
 function projectConfigFile(projectRoot) {
-  return path167.join(projectRoot, ".keryx", "mcp-servers.json");
+  return path168.join(projectRoot, ".keryx", "mcp-servers.json");
 }
 function overlayFile(configDir) {
-  return path167.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-disabled.json");
+  return path168.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-disabled.json");
 }
 function readForWrite(file) {
   const read = readConfigFile(file);
@@ -71510,7 +71935,7 @@ function writeDocument(file, doc, scope) {
     writeOwnerOnlyFileAtomic(file, body);
     return;
   }
-  mkdirSync6(path167.dirname(file), { recursive: true });
+  mkdirSync6(path168.dirname(file), { recursive: true });
   writeFileSync7(file, body, { encoding: "utf8" });
 }
 function addServer(options) {
@@ -71614,7 +72039,9 @@ var MCP_CONSUMER_SUBCOMMANDS = [
   "disable",
   "trust",
   "untrust",
-  "doctor"
+  "doctor",
+  "auth",
+  "logout"
 ];
 function isMcpConsumerSubcommand(value) {
   return MCP_CONSUMER_SUBCOMMANDS.includes(value ?? "");
@@ -71637,6 +72064,10 @@ async function runMcpConsumerCommand(subcommand, args, deps) {
       return trustCommand(args, deps, false);
     case "doctor":
       return doctorCommand(args, deps);
+    case "auth":
+      return authCommand(args, deps);
+    case "logout":
+      return logoutCommand(args, deps);
   }
 }
 function projectRootOf(deps) {
@@ -71778,6 +72209,178 @@ function addCommand(argv, deps) {
   deps.log(`Run \`keryx mcp doctor ${name}\` to check it connects.`);
   return 0;
 }
+function logoutCommand(args, deps) {
+  const own = splitAtSeparator(args).own;
+  const name = own[0];
+  if (name === undefined || name.startsWith("-")) {
+    deps.err("usage: keryx mcp logout <name>");
+    return 1;
+  }
+  const config = load(deps);
+  const server = config.servers.find((candidate) => candidate.name === name);
+  const url = server?.url;
+  if (url === undefined) {
+    const removed = forgetByName(name, deps.configDir);
+    if (removed.count === 0) {
+      deps.err(`no stored credential for "${name}".`);
+      return 1;
+    }
+    deps.log(`Forgot ${removed.count} stored credential(s) for "${name}".`);
+    return 0;
+  }
+  const existing = readCredential(name, url, deps.configDir);
+  if (existing.problem !== undefined) {
+    deps.err(existing.problem);
+    return 1;
+  }
+  if (existing.record === undefined) {
+    deps.log(`"${name}" has no stored credential; nothing to forget.`);
+    return 0;
+  }
+  const cleared = clearCredential(name, url, deps.configDir);
+  if (!cleared.ok) {
+    deps.err(cleared.error);
+    return 1;
+  }
+  deps.log(`Forgot the stored credential for "${name}".`);
+  deps.log(`Run \`keryx mcp auth ${name}\` to authorise again.`);
+  return 0;
+}
+async function authCommand(args, deps) {
+  const own = splitAtSeparator(args).own;
+  const unknown = own.filter((arg, index, all) => isUnknownFlag(arg, index, all));
+  if (unknown.length > 0) {
+    deps.err(`unknown option ${unknown[0]}`);
+    return 1;
+  }
+  const name = positional3(args);
+  if (name === undefined) {
+    deps.err("usage: keryx mcp auth <name>");
+    return 1;
+  }
+  const config = load(deps);
+  const server = config.servers.find((candidate) => candidate.name === name);
+  if (server === undefined) {
+    deps.err(config.servers.length === 0 ? `no server named "${name}" \u2014 no MCP servers are configured` : `no server named "${name}". Configured: ${config.servers.map((s) => s.name).join(", ")}`);
+    return 1;
+  }
+  if (transportOf(server) !== "http") {
+    deps.err(`"${name}" is a local (stdio) server; OAuth applies to remote ones.`);
+    return 1;
+  }
+  if (requiresApproval(server, loadTrustStore(deps.configDir))) {
+    deps.err(`"${name}" is a project server that has not been approved.`);
+    deps.err(`Read what it connects to, then: keryx mcp trust ${name}`);
+    return 1;
+  }
+  const env = deps.env ?? process.env;
+  const targetProblem = remoteTargetProblem(server.raw, env);
+  if (targetProblem !== undefined) {
+    deps.err(`"${name}": ${targetProblem}`);
+    return 1;
+  }
+  if (!usesOAuth(server.raw)) {
+    deps.err(`"${name}" does not use OAuth \u2014 it authenticates with a header or bearer_token_env_var.`);
+    deps.err("Nothing to do. Remove that credential first if you meant to switch to OAuth.");
+    return 1;
+  }
+  const interactive = resolveInteractive(deps.interactive, process.stdin, process.stdout);
+  if (!interactive) {
+    deps.err(`"${name}" needs OAuth, and this process has no terminal to ask in.`);
+    deps.err("Run `keryx mcp auth " + name + "` from an interactive shell.");
+    return 1;
+  }
+  deps.log(`Authorising "${name}" at ${displayUrl(server.raw.url)}\u2026`);
+  deps.log("A browser window will open. keryx never sees your password \u2014 only the token the server issues.");
+  return await runOAuthFlow(server, deps);
+}
+async function runOAuthFlow(server, deps) {
+  const configuredPort = server.oauth === false ? undefined : server.oauth?.callbackPort;
+  const listener = startCallbackListener(configuredPort === undefined ? {} : { port: configuredPort });
+  try {
+    const provider = createOAuthProvider({
+      serverName: server.name,
+      serverUrl: server.url,
+      ...deps.configDir === undefined ? {} : { configDir: deps.configDir },
+      interactive: true,
+      openBrowser: deps.openBrowser ?? ((url) => {
+        openAuthorisationUrl(url, deps.log);
+      }),
+      redirectUrl: listener.redirectUrl,
+      state: listener.state,
+      ...server.oauth === false || server.oauth?.clientId === undefined ? {} : { clientId: server.oauth.clientId },
+      ...server.oauth === false || server.oauth?.scopes === undefined ? {} : { scopes: server.oauth.scopes }
+    });
+    let opened = false;
+    const legOne = await connectHttpMcpServer(server.url, {
+      authProvider: {
+        ...provider,
+        redirectToAuthorization: async (url) => {
+          opened = true;
+          await provider.redirectToAuthorization(url);
+        }
+      },
+      handshakeTimeoutMs: 30000
+    }).then((connection) => ({ ok: true, connection }), (error) => ({ ok: false, error }));
+    if (legOne.ok) {
+      await legOne.connection.close();
+      const existing = readCredential(server.name, server.url, deps.configDir).record;
+      if (existing?.tokens === undefined) {
+        deps.log(`"${server.name}" connects without authentication; there is nothing to authorise.`);
+      } else {
+        deps.log(`"${server.name}" is already authorised; nothing to do.`);
+      }
+      return 0;
+    }
+    if (!opened) {
+      const message = legOne.error instanceof Error ? legOne.error.message : String(legOne.error);
+      deps.err(`Could not start authorisation for "${server.name}": ${sanitiseForDisplay(message)}`);
+      return 1;
+    }
+    const result = await listener.result;
+    if (!result.ok) {
+      deps.err(`Authorisation did not complete: ${result.reason}`);
+      return 1;
+    }
+    const sdk = await loadAuthSdk();
+    await sdk.auth(provider, { serverUrl: server.url, authorizationCode: result.code });
+    const stored = readCredential(server.name, server.url, deps.configDir).record;
+    if (stored?.tokens === undefined || stored.tokens.access_token === "") {
+      deps.err("The exchange returned no token. Nothing was stored.");
+      return 1;
+    }
+    deps.log(`Authorised "${server.name}" \u2014 ${describeCredential(stored, Date.now())}.`);
+    deps.log(`Stored owner-only in ${credentialsFile(deps.configDir)}.`);
+    return 0;
+  } catch (error) {
+    deps.err(`Authorisation failed: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  } finally {
+    listener.close();
+  }
+}
+async function loadAuthSdk() {
+  const mod = await import("@modelcontextprotocol/sdk/client/auth.js");
+  return mod;
+}
+function resolveInteractive(explicit, stdin, stdout) {
+  return explicit ?? bothStreamsAreATerminal(stdin, stdout);
+}
+function bothStreamsAreATerminal(stdin, stdout) {
+  return stdin.isTTY === true && stdout.isTTY === true;
+}
+function openAuthorisationUrl(url, log, platform = process.platform, env = process.env) {
+  const plan = browserOpenPlan(url.toString(), platform, env);
+  if (plan === undefined) {
+    log("No graphical session detected, so nothing was opened.");
+    log(`Open this URL yourself to continue:
+
+  ${url.toString()}
+`);
+    return;
+  }
+  openVerificationUrl(url.toString());
+}
 function removeCommand(args, deps) {
   const own = splitAtSeparator(args).own;
   const unknown = own.filter((arg, index, all) => isUnknownFlag(arg, index, all));
@@ -71928,9 +72531,10 @@ async function doctorCommand(args, deps) {
     const env = deps.env ?? process.env;
     report = await runDoctor2(config, {
       only,
-      connect: deps.connect ?? ((server) => defaultConnect(server, env, dialling.signal, kills)),
+      connect: deps.connect ?? ((server) => defaultConnect(server, env, dialling.signal, kills, deps.configDir)),
       heldForApproval: (server) => requiresApproval(server, approvals),
-      env
+      env,
+      configDir: deps.configDir
     });
   } finally {
     process.removeListener("SIGINT", onInt);
@@ -72037,12 +72641,12 @@ function positional3(args) {
 
 // src/commands/serve-mcp.ts
 init_args();
-import path174 from "path";
+import path175 from "path";
 
 // src/mcp/discovery.ts
 init_fs();
 init_json();
-import path168 from "path";
+import path169 from "path";
 var MODULE_MANIFEST_KEY = {
   gdgraph: "gdgraph",
   security: "security",
@@ -72104,7 +72708,7 @@ function buildDiscovery(manifest) {
   };
 }
 async function loadDiscovery(cwd) {
-  const manifestPath = path168.join(cwd, ".metaproject", "metaproject.json");
+  const manifestPath = path169.join(cwd, ".metaproject", "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return buildDiscovery({});
   }
@@ -72177,7 +72781,7 @@ init_store2();
 init_fs();
 import { createHash as createHash34, randomUUID as randomUUID17 } from "crypto";
 import { appendFile as appendFile7, mkdir as mkdir58, open as open2, readFile as readFile93, rename as rename7, rm as rm12, stat as stat16, writeFile as writeFile50 } from "fs/promises";
-import path169 from "path";
+import path170 from "path";
 
 // src/sac/policy-experiment.ts
 import { createHash as createHash33, createHmac as createHmac2 } from "crypto";
@@ -72533,7 +73137,7 @@ function hasReportIntegrity(report) {
   return reportHashPattern.test(reportDigest) && sha2565(body) === reportDigest;
 }
 async function resolvePolicySelection(workspaceRoot, canonicalFallback) {
-  const configPath = path169.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path170.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile93(configPath, "utf8").catch((error) => {
@@ -72635,7 +73239,7 @@ async function diagnosePolicyReadiness(workspaceRoot) {
     const integrityReady = steps.every((entry) => entry.step === "activation-flags" || entry.status === "pass");
     return Object.freeze({ configPresent, enabled, killSwitch, integrityReady, candidateWouldActivate: integrityReady && enabled && !killSwitch, steps: Object.freeze([...steps]) });
   };
-  const configPath = path169.join(workspaceRoot, ...policyExperimentConfigPath);
+  const configPath = path170.join(workspaceRoot, ...policyExperimentConfigPath);
   let configJson;
   try {
     const raw = await readFile93(configPath, "utf8").catch((error) => {
@@ -72890,9 +73494,9 @@ class FwkReadService {
     const recordedAt = nowIso2(now);
     const id = `receipt-${randomUUID17().replace(/-/g, "").slice(0, 16)}`;
     const base = { schemaVersion: "1.0", id, workspaceId, actor, action, decision, recordedAt, cost: { tokens: 0, toolCalls: 1, elapsedMs: 0 }, contextAssembly: { traceRef: assembly.traceRef, configurationRevision: assembly.configurationRevision, selected: assembly.selected.map((id) => `./ids/${id}`), omittedOptional: assembly.omittedOptional.map((id) => `./ids/${id}`) }, policy: { ref: assembly.policyRef, revision: assembly.policyRevision }, ...action === "resource" ? { resourceRef: `./ids/${resourceId ?? "unknown"}` } : {} };
-    const ledger = path169.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
-    const checkpointPath = path169.join(path169.dirname(ledger), "access-receipts.checkpoint.json");
-    await mkdir58(path169.dirname(ledger), { recursive: true, mode: 448 });
+    const ledger = path170.join(this.options.canonical.workspaceRoot, ".metaproject", "context-operations", "access-receipts.jsonl");
+    const checkpointPath = path170.join(path170.dirname(ledger), "access-receipts.checkpoint.json");
+    await mkdir58(path170.dirname(ledger), { recursive: true, mode: 448 });
     return withFileLock(`${ledger}.lock`, async () => {
       const state = await resolveLedgerState(ledger, checkpointPath, this.options.verifyReceiptLedger ?? verifyAccessReceiptLedger);
       const receipt = sealAccessReceipt(base, state.headHash);
@@ -73004,7 +73608,7 @@ init_workspace_service();
 init_sac();
 import { appendFile as appendFile8, mkdir as mkdir59, readFile as readFile94 } from "fs/promises";
 import { randomUUID as randomUUID18 } from "crypto";
-import path170 from "path";
+import path171 from "path";
 
 class CollaborationServiceError extends Error {
   code;
@@ -73020,7 +73624,7 @@ class CollaborationService {
     this.input = input;
   }
   file(id) {
-    return path170.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
+    return path171.join(this.input.workspaceRoot, ".metaproject", "workspaces", id, "activity.jsonl");
   }
   async overview(input) {
     const manifest = await this.input.workspaces.show(input);
@@ -73057,7 +73661,7 @@ class CollaborationService {
         occurredAt: (this.input.now ?? (() => new Date))().toISOString(),
         ...suppliedHandoff ? { handoff: { ...suppliedHandoff, from: actor.subject } } : {}
       });
-      await mkdir59(path170.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
+      await mkdir59(path171.dirname(this.file(manifest.id)), { recursive: true, mode: 448 });
       await appendFile8(this.file(manifest.id), `${JSON.stringify(activity)}
 `, { mode: 384 });
       return normalizeCollaborationResult(activity);
@@ -73112,9 +73716,9 @@ init_workspace_service();
 init_fs();
 init_machine_wrap_up();
 import { mkdir as mkdir60, readdir as readdir31, readFile as readFile95 } from "fs/promises";
-import path171 from "path";
+import path172 from "path";
 function externalSlatesDir(cwd) {
-  return path171.join(cwd, ".keryx", "external-slates");
+  return path172.join(cwd, ".keryx", "external-slates");
 }
 var EXTERNAL_SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 function assertValidExternalSessionId(externalSessionId) {
@@ -73124,14 +73728,14 @@ function assertValidExternalSessionId(externalSessionId) {
 }
 function externalSlatePath(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path171.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
+  return path172.join(externalSlatesDir(cwd), `${externalSessionId}.json`);
 }
 function externalSlateLockPath(cwd, externalSessionId) {
   return `${externalSlatePath(cwd, externalSessionId)}.lock`;
 }
 function externalSlateEvidenceDir(cwd, externalSessionId) {
   assertValidExternalSessionId(externalSessionId);
-  return path171.join(externalSlatesDir(cwd), externalSessionId);
+  return path172.join(externalSlatesDir(cwd), externalSessionId);
 }
 async function readExternalSlate(cwd, externalSessionId) {
   try {
@@ -73776,7 +74380,7 @@ function buildToolRegistry() {
 // src/mcp/resources.ts
 init_fs();
 init_contained_read();
-import path172 from "path";
+import path173 from "path";
 import { lstat as lstat4, readdir as readdir32, realpath as realpath7, stat as stat17 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
@@ -73789,13 +74393,13 @@ function mimeForPath(filePath) {
   return "text/plain";
 }
 function dataRoot3(cwd) {
-  return path172.join(cwd, ".metaproject", "data");
+  return path173.join(cwd, ".metaproject", "data");
 }
 function wikiRoot(cwd) {
-  return path172.join(cwd, ".metaproject", "wiki");
+  return path173.join(cwd, ".metaproject", "wiki");
 }
 function memoryRoot2(cwd) {
-  return path172.join(cwd, ".metaproject", "memory");
+  return path173.join(cwd, ".metaproject", "memory");
 }
 var MAX_RESOURCE_BYTES = 8 * 1024 * 1024;
 async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
@@ -73821,7 +74425,7 @@ async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
     return [];
   }
   for (const entry of entries) {
-    const full = path172.join(root, entry.name);
+    const full = path173.join(root, entry.name);
     const info = await stat17(full).catch(() => null);
     if (!info || !isPathInside(ownerReal, await realpath7(full).catch(() => "")))
       continue;
@@ -73849,9 +74453,9 @@ async function listArtifacts(cwd) {
     if (!moduleEntry.isDirectory()) {
       continue;
     }
-    const artifactsDir = path172.join(base, moduleEntry.name, "artifacts");
+    const artifactsDir = path173.join(base, moduleEntry.name, "artifacts");
     for (const file of await walkFiles(artifactsDir)) {
-      const rel = toPosix(path172.relative(artifactsDir, file));
+      const rel = toPosix(path173.relative(artifactsDir, file));
       const relPath = `${moduleEntry.name}/${rel}`;
       listings.push({
         uri: `${URI_PREFIX}artifacts/${relPath}`,
@@ -73865,7 +74469,7 @@ async function listArtifacts(cwd) {
 async function listUnderRoot(cwd, cls, root) {
   const listings = [];
   for (const file of await walkFiles(root)) {
-    const rel = toPosix(path172.relative(root, file));
+    const rel = toPosix(path173.relative(root, file));
     listings.push({
       uri: `${URI_PREFIX}${cls}/${rel}`,
       name: rel,
@@ -73915,12 +74519,12 @@ function resolveConfined(cwd, cls, relPath) {
     if (moduleName.includes("..") || moduleName.length === 0) {
       return null;
     }
-    const root = path172.join(dataRoot3(cwd), moduleName, "artifacts");
-    const absolute = path172.resolve(root, rest);
+    const root = path173.join(dataRoot3(cwd), moduleName, "artifacts");
+    const absolute = path173.resolve(root, rest);
     return isPathInside(root, absolute) ? { root, absolute } : null;
   }
   const root = cls === "wiki" ? wikiRoot(cwd) : memoryRoot2(cwd);
-  const absolute = path172.resolve(root, relPath);
+  const absolute = path173.resolve(root, relPath);
   return isPathInside(root, absolute) ? { root, absolute } : null;
 }
 async function readResource(cwd, roots, uri) {
@@ -74131,7 +74735,7 @@ async function serveMcpCommand(args = [], cwd = process.cwd()) {
     return;
   }
   const http = args.includes("--http");
-  const projectRoot = path174.resolve(resolveServeRoot(optionValue(args, "--cwd"), cwd, process.env));
+  const projectRoot = path175.resolve(resolveServeRoot(optionValue(args, "--cwd"), cwd, process.env));
   try {
     await serveMcp({ cwd: projectRoot, http });
   } catch (error) {
@@ -74207,7 +74811,9 @@ function printMcpHelp() {
     "keryx mcp add <name> --transport http <url>    # a remote one",
     "keryx mcp remove|enable|disable <name>",
     "keryx mcp trust|untrust <name>                 # approve a project-scoped server",
-    "keryx mcp doctor [name] [--json]               # dial it and say what is wrong"
+    "keryx mcp doctor [name] [--json]               # dial it and say what is wrong",
+    "keryx mcp auth <name>                          # authorise a remote server in your browser",
+    "keryx mcp logout <name>                        # forget its stored credential"
   ]);
   heading("Publishing keryx itself (the retired `keryx mcp` spellings)");
   helpUsage([
@@ -74233,14 +74839,14 @@ function printMcpHelp() {
 // src/commands/status.ts
 init_fs();
 init_json();
-import path175 from "path";
+import path176 from "path";
 async function statusCommand(args = []) {
   if (args.includes("--help") || args.includes("-h")) {
     printHelp16();
     return;
   }
-  const root = path175.join(process.cwd(), ".metaproject");
-  const manifestPath = path175.join(root, "metaproject.json");
+  const root = path176.join(process.cwd(), ".metaproject");
+  const manifestPath = path176.join(root, "metaproject.json");
   if (!await pathExists(root)) {
     console.log("Metaproject: not initialized");
     console.log("Run: keryx init");
@@ -74280,7 +74886,7 @@ Reports the workspace root and one enabled/disabled line per module. Use
 
 // src/commands/harness.ts
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
-import path178 from "path";
+import path179 from "path";
 import { randomUUID as randomUUID20 } from "crypto";
 
 // src/security/harness-scan.ts
@@ -75353,7 +75959,7 @@ ${command.argv.join(" ")}`);
 }
 
 // src/harness/process/sandbox/profile.ts
-import path176 from "path";
+import path177 from "path";
 var DEFAULT_SECRET_SUBPATHS = [
   ".ssh",
   ".gnupg",
@@ -75378,7 +75984,7 @@ function defaultReadDenyList(home) {
   if (!home) {
     return [];
   }
-  return DEFAULT_SECRET_SUBPATHS.map((sub) => path176.join(home, sub));
+  return DEFAULT_SECRET_SUBPATHS.map((sub) => path177.join(home, sub));
 }
 function defaultSandboxProfile(cwd, tmpDir, home) {
   return {
@@ -75398,10 +76004,10 @@ function dedupe3(values) {
 init_config_dir();
 init_shell_config();
 import { existsSync as existsSync26 } from "fs";
-import path177 from "path";
+import path178 from "path";
 var SECRET_KEY_PATTERN2 = /api[_-]?key|secret|token|password|credential/i;
 function sandboxConfigPath(dir) {
-  return path177.join(path177.dirname(shellConfigPath(dir)), "sandbox.json");
+  return path178.join(path178.dirname(shellConfigPath(dir)), "sandbox.json");
 }
 function isShellDefault(v) {
   return v === "off" || v === "workspace" || v === "strict" || v === "1";
@@ -76520,7 +77126,7 @@ async function harnessExec(args, deps) {
     env: commandEnv,
     cwd
   };
-  const worktreeRoot = path178.parse(path178.resolve(cwd, commandPath)).root || cwd;
+  const worktreeRoot = path179.parse(path179.resolve(cwd, commandPath)).root || cwd;
   const budget = {
     reservationId: idSeq(),
     maxRuntimeMs: maxRuntimeMs ?? EXEC_DEFAULT_RUNTIME_MS
@@ -78466,7 +79072,7 @@ function workspaceReadTool(cwd) {
 // src/harness/tool/builtin/workspace-lifecycle-tool.ts
 import { randomUUID as randomUUID22 } from "crypto";
 import { writeFile as writeFile52 } from "fs/promises";
-import path179 from "path";
+import path180 from "path";
 init_slate();
 init_store3();
 init_guard2();
@@ -78612,7 +79218,7 @@ function workspaceProposeTool(cwd, getSessionDir) {
         return { output: `workspace_propose: unrecognized 'kind' \u2014 expected one of: ${PROPOSAL_KINDS.join(", ")}`, isError: true };
       }
       const explicitSessionId = typeof input.sessionId === "string" && input.sessionId.length > 0 ? input.sessionId : undefined;
-      const sessionRef = explicitSessionId ?? path179.basename(getSessionDir() ?? "");
+      const sessionRef = explicitSessionId ?? path180.basename(getSessionDir() ?? "");
       if (sessionRef.length === 0) {
         return { output: "workspace_propose: no 'sessionId' given and no active session in this run", isError: true };
       }
@@ -78784,7 +79390,7 @@ init_shell_config();
 init_command_risk();
 init_shell_syntax();
 import { existsSync as existsSync30 } from "fs";
-import path180 from "path";
+import path181 from "path";
 import { createHash as createHash41 } from "crypto";
 var PREFIX_BANNED = new Set([
   "sh",
@@ -78989,7 +79595,7 @@ function emptyShellPermissions() {
   return { allow: [] };
 }
 function shellPermissionsPath(dir) {
-  return path180.join(path180.dirname(shellConfigPath(dir)), "permissions.json");
+  return path181.join(path181.dirname(shellConfigPath(dir)), "permissions.json");
 }
 function loadShellPermissionsWithAudit(dir) {
   try {
@@ -79027,7 +79633,7 @@ function loadShellPermissions(dir) {
 function saveShellPermissions(perms, dir, options = {}) {
   try {
     const file = shellPermissionsPath(dir);
-    ensureKeryxConfigDir(path180.dirname(file));
+    ensureKeryxConfigDir(path181.dirname(file));
     const cleaned = Array.from(new Set(perms.allow.map((p) => p.trim()).filter((p) => p.length > 0)));
     const body = {
       allow: options.skipValidation === true ? cleaned : cleaned.filter((p) => validateShellPattern(p).ok)
@@ -79466,12 +80072,12 @@ function remoteRequest(providerId, endpoint, query, key) {
 // src/lib/search-config.ts
 init_config_dir();
 import { existsSync as existsSync31 } from "fs";
-import path181 from "path";
+import path182 from "path";
 function searchConfigPath(dir) {
-  return path181.join(keryxConfigDir(dir), "search-providers.json");
+  return path182.join(keryxConfigDir(dir), "search-providers.json");
 }
 function searchCredentialPath(dir) {
-  return path181.join(keryxConfigDir(dir), "search-credentials.json");
+  return path182.join(keryxConfigDir(dir), "search-credentials.json");
 }
 function readJson5(file) {
   try {
@@ -79600,7 +80206,7 @@ function createDefaultSearchProviderController(configDir) {
 import { createHash as createHash42, randomUUID as randomUUID24 } from "crypto";
 import { mkdtemp, rm as rm13 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import path182 from "path";
+import path183 from "path";
 init_metaproject_adapter();
 init_ledger();
 init_orchestrate();
@@ -79863,8 +80469,8 @@ function createSpawnSubagentTool(deps) {
       let dispatchId = "";
       let closing = false;
       try {
-        ephemeralDir = await mkdtemp(path182.join(tmpdir4(), "keryx-subagent-slate-"));
-        dispatchId = path182.basename(ephemeralDir);
+        ephemeralDir = await mkdtemp(path183.join(tmpdir4(), "keryx-subagent-slate-"));
+        dispatchId = path183.basename(ephemeralDir);
         openedChildSlate = await openSlate({
           dir: ephemeralDir,
           cwd,
@@ -80107,7 +80713,7 @@ import { randomUUID as randomUUID25 } from "crypto";
 import { execFile as execFile4 } from "child_process";
 import { mkdir as mkdir61 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import path184 from "path";
+import path185 from "path";
 import { promisify as promisify4 } from "util";
 
 // src/harness/child/git-worktree-port.ts
@@ -80359,7 +80965,7 @@ function readRuntimeBlock(dispatch) {
 // src/harness/external/runtime.ts
 import { mkdtemp as mkdtemp2, rm as rm14, writeFile as writeFile53 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import path183 from "path";
+import path184 from "path";
 
 // src/harness/external/prompt.ts
 var EXTERNAL_RUNTIME_DIRECTIVE = [
@@ -81402,8 +82008,8 @@ async function prepareResultSchema() {
   try {
     const schema = await loadSchema("subagent-result");
     const schemaText = JSON.stringify(schema, null, 2);
-    schemaDir = await mkdtemp2(path183.join(tmpdir5(), "keryx-external-result-schema-"));
-    const schemaPath = path183.join(schemaDir, "subagent-result.schema.json");
+    schemaDir = await mkdtemp2(path184.join(tmpdir5(), "keryx-external-result-schema-"));
+    const schemaPath = path184.join(schemaDir, "subagent-result.schema.json");
     await writeFile53(schemaPath, schemaText, "utf8");
     return { ok: true, schema, schemaText, schemaPath, schemaDir };
   } catch (error) {
@@ -81660,7 +82266,7 @@ async function createRunExternal(options) {
   }
   const config = gate.config;
   const idSeq = options.idSeq ?? (() => randomUUID25());
-  const worktreesDir = options.worktreesDir ?? path184.join(tmpdir6(), "keryx-external-worktrees");
+  const worktreesDir = options.worktreesDir ?? path185.join(tmpdir6(), "keryx-external-worktrees");
   const spawn = options.spawn ?? createBunSpawnPort();
   const worktree = options.worktree ?? ensuringParentDir(createGitWorktreePort({ repoRoot: options.cwd, worktreesDir }), worktreesDir);
   const readWorkingDiff = options.readWorkingDiff ?? (() => defaultWorkingDiff(options.cwd));
@@ -81970,7 +82576,7 @@ class LiveMarkdownBlock {
 // src/tui/theme.ts
 init_config_dir();
 import { existsSync as existsSync32 } from "fs";
-import path185 from "path";
+import path186 from "path";
 var THEME_NAMES = ["groknight", "grokday", "tokyonight", "keryx"];
 var THEME_IDS = ["auto", ...THEME_NAMES];
 var DEFAULT_THEME_ID = "groknight";
@@ -82100,7 +82706,7 @@ function onThemeChange(listener) {
   };
 }
 function tuiConfigPath(dir) {
-  return path185.join(keryxConfigDir(dir), "tui.json");
+  return path186.join(keryxConfigDir(dir), "tui.json");
 }
 function loadPersistedThemeId(dir) {
   try {
@@ -82157,7 +82763,7 @@ init_workspace_service();
 init_service8();
 init_store2();
 init_fs();
-import path186 from "path";
+import path187 from "path";
 import { readFile as readFile97 } from "fs/promises";
 var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
 var DEFAULT_AUTO_GOAL_ROUNDS = 8;
@@ -82233,7 +82839,7 @@ function getFlowService() {
 async function autoProvisionFlow(cwd, goalText) {
   const service = getFlowService();
   const result = await service.init({ cwd, title: goalText });
-  const acFile = path186.join(cwd, result.dir, "acceptance-criteria.md");
+  const acFile = path187.join(cwd, result.dir, "acceptance-criteria.md");
   await writeFileAtomic(acFile, [
     "# Acceptance Criteria",
     "",
@@ -83784,7 +84390,7 @@ init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID27 } from "crypto";
 import { readdir as readdir34, stat as stat18 } from "fs/promises";
-import path187 from "path";
+import path188 from "path";
 
 // src/sac/lifecycle-flag.ts
 init_store();
@@ -83943,7 +84549,7 @@ async function readExternalUnboundCandidates(cwd) {
         }
         return groups;
       }, []));
-      const metaPath = path187.join(extDir, `${id}.json`);
+      const metaPath = path188.join(extDir, `${id}.json`);
       if (await pathExists(unboundDismissedReceiptPath(metaPath)))
         continue;
       candidates.push({
@@ -83957,7 +84563,7 @@ async function readExternalUnboundCandidates(cwd) {
   return candidates;
 }
 async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
-  const evidenceDir = path187.join(externalSlatesDir(cwd), externalSessionId);
+  const evidenceDir = path188.join(externalSlatesDir(cwd), externalSessionId);
   let entries;
   try {
     entries = (await readdir34(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -83966,7 +84572,7 @@ async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path187.join(evidenceDir, entries[i]);
+    const evidencePath = path188.join(evidenceDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -84009,7 +84615,7 @@ var SESSION_ATTRIBUTION_SLACK_MS = 5 * 60000;
 var MTIME_CLOCK_SKEW_TOLERANCE_MS = 5000;
 async function collectReceiptTargets(cwd, owner) {
   const targets = new Set;
-  const workspacesDir = path187.join(cwd, ".metaproject", "workspaces");
+  const workspacesDir = path188.join(cwd, ".metaproject", "workspaces");
   let workspaceIds;
   try {
     workspaceIds = (await readdir34(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -84017,7 +84623,7 @@ async function collectReceiptTargets(cwd, owner) {
     return targets;
   }
   for (const workspaceId of workspaceIds) {
-    const receiptsDir = path187.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
+    const receiptsDir = path188.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
     let files;
     try {
       files = (await readdir34(receiptsDir)).filter((name) => name.endsWith(".json"));
@@ -84025,7 +84631,7 @@ async function collectReceiptTargets(cwd, owner) {
       continue;
     }
     for (const file of files) {
-      const result = readConfigFile(path187.join(receiptsDir, file));
+      const result = readConfigFile(path188.join(receiptsDir, file));
       if (!result.ok)
         continue;
       try {
@@ -84068,7 +84674,7 @@ async function findSkillFiles(dir) {
   }
   const found = [];
   for (const entry of entries) {
-    const full = path187.join(dir, entry.name);
+    const full = path188.join(dir, entry.name);
     if (entry.isDirectory()) {
       found.push(...await findSkillFiles(full));
     } else if (entry.isFile() && entry.name === "SKILL.md") {
@@ -84127,10 +84733,10 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
       changedAt: attribution.changedAt
     });
   }
-  const sacSkillsDir = path187.join(cwd, ".metaproject", "project-skills", "sac");
+  const sacSkillsDir = path188.join(cwd, ".metaproject", "project-skills", "sac");
   const skillFiles = await findSkillFiles(sacSkillsDir);
   for (const absolutePath of skillFiles) {
-    const targetRef = path187.relative(path187.join(cwd, ".metaproject"), absolutePath).split(path187.sep).join("/");
+    const targetRef = path188.relative(path188.join(cwd, ".metaproject"), absolutePath).split(path188.sep).join("/");
     if (skillReceipts.has(targetRef))
       continue;
     const attribution = await attributeToSession(absolutePath, scoped);
@@ -84148,12 +84754,12 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
   return items;
 }
 async function isSlateEngaged(dir) {
-  if (await pathExists(path187.join(dir, "slate.json")))
+  if (await pathExists(path188.join(dir, "slate.json")))
     return true;
-  if (await pathExists(path187.join(dir, "terminal-state.json")))
+  if (await pathExists(path188.join(dir, "terminal-state.json")))
     return true;
   try {
-    const entries = await readdir34(path187.join(dir, "slate-archive"));
+    const entries = await readdir34(path188.join(dir, "slate-archive"));
     return entries.length > 0;
   } catch {
     return false;
@@ -84167,7 +84773,7 @@ async function safeReadSlate(dir) {
   }
 }
 async function readTerminalState(dir) {
-  const result = readConfigFile(path187.join(dir, "terminal-state.json"));
+  const result = readConfigFile(path188.join(dir, "terminal-state.json"));
   if (!result.ok) {
     return;
   }
@@ -84191,7 +84797,7 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (session === undefined) {
     throw new Error(`No session or evidence path matches "${target}"`);
   }
-  const archiveDir = path187.join(sessionDir(session.projectPath, session.id), "slate-archive");
+  const archiveDir = path188.join(sessionDir(session.projectPath, session.id), "slate-archive");
   let entries;
   try {
     entries = (await readdir34(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -84201,7 +84807,7 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (entries.length === 0)
     throw new Error(`No unbound-candidate artifacts for session ${session.id}`);
   entries.sort();
-  return path187.join(archiveDir, entries[entries.length - 1]);
+  return path188.join(archiveDir, entries[entries.length - 1]);
 }
 async function dismissUnboundByTarget(cwd, target, reason) {
   const evidencePath = await resolveUnboundCandidateTarget(cwd, target);
@@ -84227,7 +84833,7 @@ async function dismissUnboundCandidate(candidatePath, reason) {
   return { removed: candidatePath, receipt: receiptPath };
 }
 async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path187.join(dir, "slate-archive");
+  const archiveDir = path188.join(dir, "slate-archive");
   let entries;
   try {
     entries = (await readdir34(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
@@ -84236,7 +84842,7 @@ async function readNewestUnboundCandidate(dir) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path187.join(archiveDir, entries[i]);
+    const evidencePath = path188.join(archiveDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -84266,7 +84872,7 @@ function isFailureOutcome(g) {
   return g.outcome === "error" || g.outcome === "no_credential" || g.outcome === "conflict";
 }
 async function readNewestWrapUpOutcome(dir) {
-  const archiveDir = path187.join(dir, "slate-archive");
+  const archiveDir = path188.join(dir, "slate-archive");
   let entries;
   try {
     entries = (await readdir34(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
@@ -84275,7 +84881,7 @@ async function readNewestWrapUpOutcome(dir) {
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path187.join(archiveDir, entries[i]);
+    const evidencePath = path188.join(archiveDir, entries[i]);
     const result = readConfigFile(evidencePath);
     if (!result.ok) {
       continue;
@@ -87756,41 +88362,6 @@ init_patch_risk();
 init_catalog();
 init_grants();
 init_login();
-
-// src/lib/oauth/open-url.ts
-import { spawn as spawn5 } from "child_process";
-function browserOpenPlan(url, platform = process.platform, env = process.env) {
-  if (url.length === 0) {
-    return;
-  }
-  if (platform === "darwin") {
-    return { cmd: "open", args: [url] };
-  }
-  if (platform === "win32") {
-    return { cmd: "cmd", args: ["/c", "start", "", url] };
-  }
-  if (typeof env.DISPLAY === "string" && env.DISPLAY.length > 0) {
-    return { cmd: "xdg-open", args: [url] };
-  }
-  if (typeof env.WAYLAND_DISPLAY === "string" && env.WAYLAND_DISPLAY.length > 0) {
-    return { cmd: "xdg-open", args: [url] };
-  }
-  return;
-}
-function openVerificationUrl(url, deps = {}) {
-  const plan = browserOpenPlan(url, deps.platform ?? process.platform, deps.env ?? process.env);
-  if (plan === undefined) {
-    return;
-  }
-  const spawnFn = deps.spawn ?? spawn5;
-  try {
-    const child = spawnFn(plan.cmd, plan.args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
-
-// src/tui/tui-shell.ts
 init_shell_config();
 init_provider_config();
 
@@ -87826,10 +88397,10 @@ function describeElicitationPrompt(tool, inputJson) {
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path188 from "path";
+import path189 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path188.join(keryxConfigDir(dir), "permission-mode.json");
+  return path189.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock2(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -88347,7 +88918,7 @@ function showComposerChoice(otui, r, dock, request) {
 // src/lib/version-check.ts
 init_config_dir();
 init_fs();
-import path189 from "path";
+import path190 from "path";
 var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
 var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
 var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
@@ -88549,7 +89120,7 @@ async function checkVersion(options) {
   const now = options.now ?? Date.now;
   const timestamp = now();
   const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path189.join(configDir, "version-check.json");
+  const cacheFile = path190.join(configDir, "version-check.json");
   const cache = parseCache(cacheFile);
   if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
     return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
@@ -97125,7 +97696,7 @@ Shell:
 init_fs();
 import { readFile as readFile98 } from "fs/promises";
 import { stdin } from "process";
-import path190 from "path";
+import path191 from "path";
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -97171,8 +97742,8 @@ async function modulesCommand(args = []) {
     return;
   }
   const wantsJson = args.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path190.join(process.cwd(), ".metaproject");
-  const manifestPath = path190.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path191.join(process.cwd(), ".metaproject");
+  const manifestPath = path191.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -97291,7 +97862,7 @@ init_serve_config();
 
 // src/lib/serve-credential.ts
 init_config_dir();
-import { createHash as createHash43, randomBytes as randomBytes4, randomUUID as randomUUID30 } from "crypto";
+import { createHash as createHash43, randomBytes as randomBytes5, randomUUID as randomUUID30 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
@@ -97303,9 +97874,9 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync9
 } from "fs";
-import path191 from "path";
+import path192 from "path";
 function serveCredentialPath(dir) {
-  return path191.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path192.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -97411,8 +97982,8 @@ function withServeCredentialLock(dir, fn, onWaiting) {
   });
 }
 function mintRecord(now) {
-  const token = randomBytes4(32).toString("base64url");
-  const salt = randomBytes4(32).toString("hex");
+  const token = randomBytes5(32).toString("base64url");
+  const salt = randomBytes5(32).toString("hex");
   return {
     token,
     record: { id: randomUUID30(), algorithm: "sha256", salt, hash: hashToken(salt, token), createdAt: now }
@@ -97539,22 +98110,22 @@ class AuthFailureThrottle {
 init_config_dir();
 import { createHash as createHash44 } from "crypto";
 import { existsSync as existsSync34, readdirSync as readdirSync3, rmSync as rmSync2 } from "fs";
-import path192 from "path";
+import path193 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path192.join(keryxConfigDir(dir), "turns");
+  return path193.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path192.join(turnsRoot(dir), turnId);
+  return path193.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest = createHash44("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path192.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path193.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest = createHash44("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path192.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path193.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -97618,7 +98189,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path192.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path193.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -97627,12 +98198,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path192.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path193.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error) {
     if (error?.code !== "ENOENT") {
       throw error;
     }
-    appendOwnerOnlyLine(path192.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path193.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -97640,7 +98211,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path192.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path193.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -97668,7 +98239,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path192.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path193.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -97687,7 +98258,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path192.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path193.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -97733,7 +98304,7 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 
 // src/lib/serve-turn.ts
 import { randomUUID as randomUUID31 } from "crypto";
-import path193 from "path";
+import path194 from "path";
 init_service();
 var REMOTE_ORIGIN = "remote:http";
 var MAX_PROMPT_CHARS = 32000;
@@ -97802,9 +98373,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path193.resolve(declared);
+  const wanted = path194.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path193.resolve(entry.path) === wanted) {
+    if (path194.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -98840,7 +99411,7 @@ function printHelp19() {
 import { spawn as spawn6 } from "child_process";
 import { chmod as chmod4, mkdir as mkdir62, readFile as readFile99, readdir as readdir35, writeFile as writeFile54 } from "fs/promises";
 import { access as access4, constants as constants2, existsSync as existsSync35 } from "fs";
-import path194 from "path";
+import path195 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 init_config2();
 init_config();
@@ -98857,8 +99428,8 @@ async function updateCommand(args = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path194.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path194.basename(projectRoot)}/`);
+  const metaprojectRoot = path195.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path195.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -98919,7 +99490,7 @@ async function updateCommand(args = []) {
   nextSteps(steps);
 }
 async function previewServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path194.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path195.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const enableTasks = moduleEnabled2(manifest, "tasks") || !options.noTasks;
@@ -98948,12 +99519,12 @@ async function previewServiceFiles(projectRoot, options) {
   });
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path194.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path195.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
-    await writeFile54(path194.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+    await writeFile54(path195.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   }
   const enableGdgraph = moduleEnabled2(manifest, "gdgraph");
@@ -98990,9 +99561,9 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path194.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path195.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
   await writeRoutingEntrypointPair(metaprojectRoot, {
     enableGdgraph,
     enableGdctx,
@@ -99015,7 +99586,7 @@ async function refreshServiceFiles(projectRoot, options) {
       }
     }
   });
-  await writeTextIfChanged4(path194.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path195.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -99027,7 +99598,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path194.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path195.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -99040,31 +99611,31 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   if (enableGdskills) {
     await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
@@ -99073,25 +99644,25 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path194.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path194.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path195.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path195.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -99104,24 +99675,24 @@ async function refreshServiceFiles(projectRoot, options) {
     await installManagedHook2(projectRoot, "post-commit", "metaproject-dashboard-post-commit", renderMetaprojectDashboardPostCommitHook());
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path194.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path194.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path195.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path195.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       await installManagedHook2(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
     }
@@ -99172,13 +99743,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path194.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path195.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path194.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path195.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -99198,7 +99769,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path194.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path195.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -99218,11 +99789,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path194.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path195.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path194.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path195.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -99237,7 +99808,7 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot = path194.join(metaprojectRoot, "flows");
+  const flowsRoot = path195.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot)) {
     return null;
   }
@@ -99249,7 +99820,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path194.join(flowsRoot, dir, "flow.json");
+    const flowPath = path195.join(flowsRoot, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -99257,7 +99828,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile99(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath = path194.join(flowsRoot, dir, "acceptance-criteria.md");
+      const acPath = path195.join(flowsRoot, dir, "acceptance-criteria.md");
       if (await pathExists(acPath)) {
         const acContent = await readFile99(acPath, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -99311,7 +99882,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path194.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path195.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -99328,7 +99899,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath = path194.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath = path195.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath)) {
     return;
   }
@@ -99437,8 +100008,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path194.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path194.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path195.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path195.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -99489,8 +100060,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath = path194.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path194.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath = path195.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path195.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath)) {
     const report = JSON.parse(await readFile99(reportPath, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -99519,7 +100090,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path194.relative(root, filePath).split(path194.sep).join("/");
+    const relativePath = path195.relative(root, filePath).split(path195.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -99540,7 +100111,7 @@ async function listMarkdownFiles(root) {
   const entries = await readdir35(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path194.join(root, entry.name);
+    const fullPath = path195.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -99588,7 +100159,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path194.basename(path194.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path195.basename(path195.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys),
     paths: {
@@ -99678,11 +100249,11 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
       metaproject: ".metaproject/index.md"
     }
   };
-  await writeFile54(path194.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
+  await writeFile54(path195.join(metaprojectRoot, "metaproject.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path194.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path195.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -99705,7 +100276,7 @@ async function enableTasksInManifest(metaprojectRoot) {
 `, "utf8");
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path194.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path195.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -99741,72 +100312,72 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path194.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path194.join(projectRuntime, ".git"))) {
+  const projectRuntime = path195.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path195.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path194.join(home, ".keryx", "keryx");
-  if (await pathExists(path194.join(globalRuntime, ".git"))) {
+  const globalRuntime = path195.join(home, ".keryx", "keryx");
+  if (await pathExists(path195.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path194.join(metaprojectRoot, "core"),
-    path194.join(metaprojectRoot, "hooks", "post-update.d"),
-    path194.join(metaprojectRoot, "modules"),
-    path194.join(metaprojectRoot, "rules"),
-    path194.join(metaprojectRoot, "skills", "project-rules"),
+    path195.join(metaprojectRoot, "core"),
+    path195.join(metaprojectRoot, "hooks", "post-update.d"),
+    path195.join(metaprojectRoot, "modules"),
+    path195.join(metaprojectRoot, "rules"),
+    path195.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path194.join(metaprojectRoot, "core", "gdgraph"),
-      path194.join(metaprojectRoot, "skills", "gdgraph")
+      path195.join(metaprojectRoot, "core", "gdgraph"),
+      path195.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path194.join(metaprojectRoot, "core", "gdctx"),
-      path194.join(metaprojectRoot, "skills", "gdctx")
+      path195.join(metaprojectRoot, "core", "gdctx"),
+      path195.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path194.join(metaprojectRoot, "skills", "gdwiki"),
-      path194.join(metaprojectRoot, "wiki", "templates")
+      path195.join(metaprojectRoot, "skills", "gdwiki"),
+      path195.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path194.join(metaprojectRoot, "core", "health"),
-      path194.join(metaprojectRoot, "skills", "health")
+      path195.join(metaprojectRoot, "core", "health"),
+      path195.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path194.join(metaprojectRoot, "core", "testing"),
-      path194.join(metaprojectRoot, "skills", "testing")
+      path195.join(metaprojectRoot, "core", "testing"),
+      path195.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path194.join(metaprojectRoot, "core", "memory"),
-      path194.join(metaprojectRoot, "skills", "memory"),
-      path194.join(metaprojectRoot, "memory", "templates")
+      path195.join(metaprojectRoot, "core", "memory"),
+      path195.join(metaprojectRoot, "skills", "memory"),
+      path195.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path194.join(metaprojectRoot, "flows"),
-      path194.join(metaprojectRoot, "skills", "flow")
+      path195.join(metaprojectRoot, "flows"),
+      path195.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path194.join(metaprojectRoot, "core", "security")
+      path195.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path194.join(metaprojectRoot, "skills", "sac")
+      path195.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
   await Promise.all(dirs.map((dir) => mkdir62(dir, { recursive: true })));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path194.join(metaprojectRoot, "core", "gdgraph");
+  const gdgraphCoreRoot = path195.join(metaprojectRoot, "core", "gdgraph");
   await mkdir62(gdgraphCoreRoot, { recursive: true });
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path194.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path195.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path194.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path195.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function installManagedHook2(projectRoot, hookName, blockId, content) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
@@ -99814,7 +100385,7 @@ async function installManagedHook2(projectRoot, hookName, blockId, content) {
     return;
   }
   await mkdir62(hooksRoot, { recursive: true });
-  const hookPath = path194.join(hooksRoot, hookName);
+  const hookPath = path195.join(hooksRoot, hookName);
   const blockStart = `# keryx:${blockId}:begin`;
   const blockEnd = `# keryx:${blockId}:end`;
   const managedBlock = `${blockStart}
@@ -99835,7 +100406,7 @@ async function removeManagedHook2(projectRoot, hookName, blockId) {
   if (!hooksRoot) {
     return;
   }
-  const hookPath = path194.join(hooksRoot, hookName);
+  const hookPath = path195.join(hooksRoot, hookName);
   if (!await pathExists(hookPath)) {
     return;
   }
@@ -99857,7 +100428,7 @@ async function prePushHasSecurityBlock2(projectRoot) {
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path194.join(hooksRoot, "pre-push");
+  const hookPath = path195.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -99872,7 +100443,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile99(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path194.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path195.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -99941,7 +100512,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path194.join(root, candidate))) {
+    if (await pathExists(path195.join(root, candidate))) {
       return true;
     }
   }
@@ -99964,13 +100535,13 @@ function parseUpdateArgs(args) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path194.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path195.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
   const entries = (await readdir35(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path194.join(hooksDir, entry);
+    const hookPath = path195.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -100011,14 +100582,14 @@ async function writeTextIfChanged4(filePath, content) {
   if (await pathExists(filePath) && await readFile99(filePath, "utf8") === content) {
     return;
   }
-  await mkdir62(path194.dirname(filePath), { recursive: true });
+  await mkdir62(path195.dirname(filePath), { recursive: true });
   await writeFile54(filePath, content, "utf8");
 }
 async function writeTextIfMissing4(filePath, content) {
   if (await pathExists(filePath)) {
     return;
   }
-  await mkdir62(path194.dirname(filePath), { recursive: true });
+  await mkdir62(path195.dirname(filePath), { recursive: true });
   await writeFile54(filePath, content, "utf8");
 }
 async function copyFileIfChanged2(from, to) {
@@ -100026,7 +100597,7 @@ async function copyFileIfChanged2(from, to) {
   if (await pathExists(to) && await readFile99(to, "utf8") === next) {
     return;
   }
-  await mkdir62(path194.dirname(to), { recursive: true });
+  await mkdir62(path195.dirname(to), { recursive: true });
   await writeFile54(to, next, "utf8");
 }
 function runtimeSourcePath2(relativePath) {
@@ -100035,7 +100606,7 @@ function runtimeSourcePath2(relativePath) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path194.join(path194.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
+    const packagedSourcePath = path195.join(path195.dirname(fileURLToPath7(import.meta.url)), "..", "src", relativePath.slice(3));
     if (existsSync35(packagedSourcePath)) {
       return packagedSourcePath;
     }
@@ -100070,7 +100641,7 @@ function printHelp20() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn7 } from "child_process";
-import path195 from "path";
+import path196 from "path";
 init_args();
 async function dashboardCommand(args = []) {
   const options = parseOptions(args);
@@ -100081,7 +100652,7 @@ async function dashboardCommand(args = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path195.relative(process.cwd(), result.path);
+    const rel = path196.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -100089,7 +100660,7 @@ async function dashboardCommand(args = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path195.relative(process.cwd(), result.path);
+    const rel = path196.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -100138,7 +100709,7 @@ import { readFileSync as readFileSync8 } from "fs";
 // src/agents/bootstrap.ts
 import { mkdir as mkdir63, readFile as readFile100, writeFile as writeFile55 } from "fs/promises";
 import { homedir as homedir8 } from "os";
-import path196 from "path";
+import path197 from "path";
 init_fs();
 var AGENT_BOOTSTRAP_START = "<!-- keryx:global-bootstrap -->";
 var AGENT_BOOTSTRAP_END = "<!-- /keryx:global-bootstrap -->";
@@ -100148,35 +100719,35 @@ var AGENT_BOOTSTRAP_RUNTIMES = [
     aliases: ["claude-code"],
     label: "Claude Code",
     fileName: "CLAUDE.md",
-    filePath: (homeRoot) => path196.join(homeRoot, ".claude", "CLAUDE.md")
+    filePath: (homeRoot) => path197.join(homeRoot, ".claude", "CLAUDE.md")
   },
   {
     id: "opencode",
     aliases: ["open-code"],
     label: "OpenCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path196.join(homeRoot, ".config", "opencode", "AGENTS.md")
+    filePath: (homeRoot) => path197.join(homeRoot, ".config", "opencode", "AGENTS.md")
   },
   {
     id: "zcode",
     aliases: ["zed", "zed-code"],
     label: "ZCode",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path196.join(homeRoot, ".zcode", "AGENTS.md")
+    filePath: (homeRoot) => path197.join(homeRoot, ".zcode", "AGENTS.md")
   },
   {
     id: "codex",
     aliases: [],
     label: "Codex",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path196.join(homeRoot, ".codex", "AGENTS.md")
+    filePath: (homeRoot) => path197.join(homeRoot, ".codex", "AGENTS.md")
   },
   {
     id: "antigravity",
     aliases: ["antigravuty", "antigravity-code"],
     label: "Antigravity",
     fileName: "AGENTS.md",
-    filePath: (homeRoot) => path196.join(homeRoot, ".config", "antigravity", "AGENTS.md")
+    filePath: (homeRoot) => path197.join(homeRoot, ".config", "antigravity", "AGENTS.md")
   }
 ];
 function agentBootstrapRuntimeIds() {
@@ -100224,7 +100795,7 @@ async function installAgentBootstrap(runtime, options = {}) {
   const dryRun = options.dryRun === true;
   const wrote = next !== current;
   if (wrote && !dryRun) {
-    await mkdir63(path196.dirname(filePath), { recursive: true });
+    await mkdir63(path197.dirname(filePath), { recursive: true });
     await writeFile55(filePath, next, "utf8");
   }
   const status = dryRun ? statusFromContent(runtime, filePath, exists, next) : await agentBootstrapStatus(runtime, homeRoot);
@@ -100761,7 +101332,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile101 } from "fs/promises";
-import path198 from "path";
+import path199 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -101578,7 +102149,7 @@ function buildContainmentManifest(inputs, options = {}) {
 
 // src/metrics/oracle-runner.ts
 import { mkdir as mkdir64, writeFile as writeFile56 } from "fs/promises";
-import path197 from "path";
+import path198 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -102024,9 +102595,9 @@ function buildEvidenceBundle(input, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path197.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  const dir = path198.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
   await mkdir64(dir, { recursive: true });
-  const write = (name, value) => writeFile56(path197.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const write = (name, value) => writeFile56(path198.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -102066,7 +102637,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path198.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path199.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest = await readLatestPointer(root);
     console.log(`latest: ${latest.status}`);
     return;
@@ -102078,7 +102649,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+    const record = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error of result.errors)
@@ -102103,7 +102674,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path198.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path199.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -102120,8 +102691,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile101(path198.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile101(path198.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile101(path199.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile101(path199.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -102155,8 +102726,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path198.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path198.relative(projectRoot, path198.resolve(projectRoot, out))}`);
+    await Bun.write(path199.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path199.relative(projectRoot, path199.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args[1] === "run") {
@@ -102170,7 +102741,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
     const input = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input);
     console.log(stableJson(result));
@@ -102182,7 +102753,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -102253,7 +102824,7 @@ async function runHarnessLayer(projectRoot, args, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error) {
@@ -102284,7 +102855,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -102309,7 +102880,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -102334,7 +102905,7 @@ async function runSafetyContainmentLayer(projectRoot, args, ladder, caseClass) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -102396,12 +102967,12 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path198.resolve(projectRoot, outDir);
+    const resolvedOut = path199.resolve(projectRoot, outDir);
     for (const input of inputs) {
       for (const named of input.golds) {
         const bundle = buildEvidenceBundle({ target: input.target, system: input.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path198.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path198.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path199.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path199.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -102425,7 +102996,7 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args, ladder) {
@@ -102462,7 +103033,7 @@ async function runTestingLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args, ladder) {
@@ -102499,11 +103070,11 @@ async function runMemoryLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -102559,7 +103130,7 @@ async function runWikiLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -102597,7 +103168,7 @@ async function collect(projectRoot, args) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile101(path198.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile101(path199.resolve(projectRoot, eventFile), "utf8"));
   const events = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args, "--started-at") ?? events[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args, "--finished-at") ?? events.at(-1)?.timestamp_utc ?? startedAt;
@@ -102613,11 +103184,11 @@ async function collect(projectRoot, args) {
     parentRunId: optionValue(args, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record, { cwd: projectRoot });
-  console.log(`json: ${path198.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path198.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path199.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path199.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path198.join(projectRoot, ".metaproject", "data", "metrics");
+  return path199.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -103090,7 +103661,7 @@ Providers with a sanctioned subscription login: grok (SuperGrok), openai (ChatGP
 Claude Pro/Max, Gemini Google-account login, and DeepSeek OAuth are not offered.
 `);
 }
-async function authCommand(args) {
+async function authCommand2(args) {
   const command = args[0];
   if (!command || command === "--help" || command === "-h") {
     printAuthHelp();
@@ -103484,7 +104055,7 @@ var CLI_ROUTES = {
   modules: modulesCommand,
   projects: projectsCommand,
   providers: providersCommand,
-  auth: authCommand,
+  auth: authCommand2,
   serve: serveCommand,
   update: updateCommand,
   dashboard: dashboardCommand,