@mrciphersmith/keryx 0.2.97 → 0.2.98

package/dist/cli.js

@@ -301,6 +301,13 @@ var init_provider_config = __esm(() => {
 // src/lib/shell-config.ts
 import { existsSync as existsSync2 } from "fs";
 import path3 from "path";
+function noteSavedCredentialEnv(keys) {
+  for (const key of keys)
+    savedCredentialKeys.add(key);
+}
+function savedCredentialEnvKeys() {
+  return savedCredentialKeys;
+}
 function shellConfigPath(dir) {
   return path3.join(keryxConfigDir(dir), "auth.json");
 }
@@ -383,10 +390,13 @@ function applySavedApiKeys(dir) {
       }
     }
   } catch {}
+  noteSavedCredentialEnv(applied);
   return applied;
 }
+var savedCredentialKeys;
 var init_shell_config = __esm(() => {
   init_config_dir();
+  savedCredentialKeys = new Set;
 });
 
 // src/lib/oauth/grants.ts
@@ -472,6 +482,7 @@ function applyOAuthAccessToEnv(dir) {
       applied.push(envKey);
     }
   }
+  noteSavedCredentialEnv(applied);
   return applied;
 }
 function grantFromTokens(method, tokens, now = Date.now) {
@@ -571,10 +582,61 @@ function customCompatProviders(dir) {
 function allOpenAiCompatProviders(dir) {
   return [...OPENAI_COMPAT_PROVIDERS, ...customCompatProviders(dir)];
 }
+function modelsErrorDetail(body) {
+  const text = body.slice(0, MODELS_ERROR_BODY_LIMIT).trim();
+  if (text.length === 0) {
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = undefined;
+  }
+  if (typeof parsed === "object" && parsed !== null) {
+    const record = parsed;
+    const error = record.error;
+    if (typeof error === "string" && error.length > 0) {
+      return error;
+    }
+    if (typeof error === "object" && error !== null) {
+      const message = error.message;
+      if (typeof message === "string" && message.length > 0) {
+        return message;
+      }
+    }
+    for (const field of ["detail", "message"]) {
+      const value = record[field];
+      if (typeof value === "string" && value.length > 0) {
+        return value;
+      }
+    }
+    return;
+  }
+  if (text.startsWith("<") || text.includes("<html")) {
+    return;
+  }
+  const firstLine = text.split(`
+`, 1)[0]?.trim();
+  return firstLine !== undefined && firstLine.length > 0 ? firstLine : undefined;
+}
+function modelsFailureLine(providerLabel, failure) {
+  const detail = "detail" in failure && failure.detail !== undefined ? ` \u2014 ${failure.detail}` : "";
+  switch (failure.kind) {
+    case "rejected":
+      return `${providerLabel} rejected the credential (HTTP ${failure.status})${detail}`;
+    case "http":
+      return `${providerLabel} could not list models (HTTP ${failure.status})${detail}`;
+    case "unreachable":
+      return `${providerLabel} could not be reached${detail}`;
+    case "empty":
+      return `${providerLabel} reports no models`;
+  }
+}
 async function fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, opts) {
   const url = `${provider.baseUrl.replace(/\/+$/, "")}${provider.modelsPath ?? DEFAULT_MODELS_PATH}`;
   const timeoutMs = opts?.timeoutMs ?? MODELS_FETCH_TIMEOUT_MS;
-  const fallback = { models: [], source: "fallback" };
+  const fallback = (failure) => ({ models: [], source: "fallback", failure });
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -584,7 +646,9 @@ async function fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, opts)
     }
     const res = await fetchFn(url, init);
     if (!res.ok) {
-      return fallback;
+      const detail = modelsErrorDetail(await res.text().catch(() => ""));
+      const kind = res.status === 401 || res.status === 403 ? "rejected" : "http";
+      return fallback({ kind, status: res.status, ...detail === undefined ? {} : { detail } });
     }
     const body = await res.json();
     const ids = Array.isArray(body?.data) ? body.data.map((m) => {
@@ -597,11 +661,13 @@ async function fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, opts)
       return "";
     }).filter((id) => id.length > 0) : [];
     if (ids.length === 0) {
-      return fallback;
+      return fallback({ kind: "empty" });
     }
     return { models: Array.from(new Set(ids)).sort(), source: "live" };
-  } catch {
-    return fallback;
+  } catch (err) {
+    const aborted = controller.signal.aborted;
+    const message = err instanceof Error ? err.message : String(err);
+    return fallback({ kind: "unreachable", detail: aborted ? `timed out after ${timeoutMs}ms` : message });
   } finally {
     clearTimeout(timer);
   }
@@ -821,7 +887,7 @@ optimisation. With no second family configured it reports single-family review
 with a stated reason and exits 0 \u2014 that is a normal configuration, not an error.
 `);
 }
-var DEFAULT_MODELS_PATH = "/v1/models", OPENAI_COMPAT_PROVIDERS, MODELS_FETCH_TIMEOUT_MS = 1e4, BALANCE_FETCH_TIMEOUT_MS = 8000;
+var DEFAULT_MODELS_PATH = "/v1/models", OPENAI_COMPAT_PROVIDERS, MODELS_FETCH_TIMEOUT_MS = 1e4, MODELS_ERROR_BODY_LIMIT = 4096, BALANCE_FETCH_TIMEOUT_MS = 8000;
 var init_providers = __esm(() => {
   init_provider_config();
   init_grants();
@@ -13250,7 +13316,7 @@ var init_staleness = __esm(() => {
 });
 
 // src/wiki/staleness.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { readFile as readFile29 } from "fs/promises";
 import path68 from "path";
 async function computePageNodeHash(cwd, keyFiles, graph) {
@@ -13261,7 +13327,7 @@ async function computePageNodeHash(cwd, keyFiles, graph) {
     if (knownPaths.has(file)) {
       try {
         const content = await readFile29(path68.join(cwd, file), "utf8");
-        digest = createHash6("sha256").update(content).digest("hex");
+        digest = createHash7("sha256").update(content).digest("hex");
       } catch {
         digest = "<missing>";
       }
@@ -13271,7 +13337,7 @@ async function computePageNodeHash(cwd, keyFiles, graph) {
   entries.sort((a, b) => a.path.localeCompare(b.path));
   const combined = entries.map((entry) => `${entry.path}:${entry.digest}`).join(`
 `);
-  return createHash6("sha256").update(combined).digest("hex");
+  return createHash7("sha256").update(combined).digest("hex");
 }
 function isPageUnchangedSinceLastEnrich(pagePath, currentHash, completedNodeHashes) {
   const previous = completedNodeHashes?.[pagePath];
@@ -13325,7 +13391,7 @@ var init_staleness2 = __esm(() => {
 });
 
 // src/wiki/provenance.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function parseProvenance(content) {
   const verifiedAt = singleLineField(content, "VerifiedAt");
   const verifiedScope = singleLineField(content, "VerifiedScope");
@@ -13337,7 +13403,7 @@ function parseProvenance(content) {
 }
 async function computeVerifiedScope(cwd, describePaths, graph) {
   if (describePaths.length === 0) {
-    return `sha256:${createHash7("sha256").update("<empty-describe-set>").digest("hex")}`;
+    return `sha256:${createHash8("sha256").update("<empty-describe-set>").digest("hex")}`;
   }
   return `sha256:${await computePageNodeHash(cwd, describePaths, graph)}`;
 }
@@ -13542,7 +13608,7 @@ var init_collect = __esm(() => {
 });
 
 // src/wiki/section-marker.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { readFile as readFile31 } from "fs/promises";
 function parseMarkers(content) {
   const lines = content.split(`
@@ -13673,7 +13739,7 @@ function proposeSectionId(headingText, fallbackOrdinal) {
   return slug.length > 0 && ID_RE.test(slug) ? slug : `section-${fallbackOrdinal}`;
 }
 function digest(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
 function planPageMigration(relativePath, content) {
   const lines = content.split(`
@@ -13813,7 +13879,7 @@ var init_section_marker = __esm(() => {
 });
 
 // src/wiki/section-index.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function resolveWikiPageIdentity(relativePath, content) {
   const markers = parseMarkers(content);
   if (markers.page) {
@@ -13905,7 +13971,7 @@ function detectLanguage(text) {
   return ru ? "ru" : "en";
 }
 function digestOf2(value) {
-  return createHash9("sha256").update(value).digest("hex");
+  return createHash10("sha256").update(value).digest("hex");
 }
 function fieldFromLines(lines, name) {
   const pattern = new RegExp(`^${name}:\\s*(.+)$`, "i");
@@ -14436,7 +14502,7 @@ async function runRuntimeEmbedder(dep, asset, texts, dims) {
 var MEMORY_EMBEDDING_ID = "memory.embedding", DEFAULT_EMBED_DIMS = 96;
 
 // src/memory/embedding/index.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { mkdir as mkdir21, readFile as readFile32, writeFile as writeFile24 } from "fs/promises";
 import path70 from "path";
 function embeddingsDir(cwd) {
@@ -14449,7 +14515,7 @@ ${entry.tags.join(" ")}
 ${entry.details}`.trim();
 }
 function contentHash(text) {
-  return createHash10("sha256").update(text).digest("hex").slice(0, 16);
+  return createHash11("sha256").update(text).digest("hex").slice(0, 16);
 }
 async function buildEmbeddingIndex(cwd, entries, embedder, model, now) {
   const sorted = [...entries].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
@@ -15181,7 +15247,7 @@ var init_backlinks = __esm(() => {
 });
 
 // src/ctx/assembly.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { mkdir as mkdir22, rename as rename2, writeFile as writeFile25 } from "fs/promises";
 import path73 from "path";
 function assembleContext(input) {
@@ -15236,7 +15302,7 @@ async function recordContextAssembly(input) {
   await rename2(temporary, target);
 }
 function traceIdFor(correlationId, outcome) {
-  return createHash11("sha256").update(`${outcome}\x00${correlationId}`).digest("hex").slice(0, 24);
+  return createHash12("sha256").update(`${outcome}\x00${correlationId}`).digest("hex").slice(0, 24);
 }
 function traceRefFor(traceId) {
   return `./.metaproject/context-operations/traces/${traceId}.json`;
@@ -16095,9 +16161,9 @@ var init_evidence = __esm(() => {
 });
 
 // src/wiki/managed-block.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 function hashBlockContent(content) {
-  return createHash12("sha256").update(content.trim()).digest("hex");
+  return createHash13("sha256").update(content.trim()).digest("hex");
 }
 function findManagedBlock(content) {
   const lines = content.split(`
@@ -16348,7 +16414,7 @@ var init_template_structure = __esm(() => {
 
 // src/wiki/service.ts
 import { spawn as spawn2 } from "child_process";
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { mkdir as mkdir23, readFile as readFile35, readdir as readdir7, rm as rm6, writeFile as writeFile26 } from "fs/promises";
 import path75 from "path";
 function wikiRootPath2(cwd) {
@@ -16650,7 +16716,7 @@ function resolveEvidenceScope(cwd, override) {
   const absolute = path75.resolve(cwd);
   return {
     projectId: override?.projectId ?? (path75.basename(absolute) || "project"),
-    checkoutId: override?.checkoutId ?? `checkout:${createHash13("sha256").update(absolute).digest("hex").slice(0, 16)}`,
+    checkoutId: override?.checkoutId ?? `checkout:${createHash14("sha256").update(absolute).digest("hex").slice(0, 16)}`,
     ...override?.workspaceId ? { workspaceId: override.workspaceId } : {},
     ...override?.taskId ? { taskId: override.taskId } : {}
   };
@@ -17456,7 +17522,7 @@ var init_service3 = __esm(() => {
 });
 
 // src/gdgraph/wiki-layer.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { mkdir as mkdir24, stat as stat8, writeFile as writeFile27 } from "fs/promises";
 import path76 from "path";
 function storageDir(projectRoot) {
@@ -17513,7 +17579,7 @@ function buildWikiLayer(input) {
 function computeFingerprints(fileRecords, mtimes) {
   return fileRecords.map((record) => ({
     path: record.path,
-    contentHash: createHash14("sha256").update(record.content).digest("hex"),
+    contentHash: createHash15("sha256").update(record.content).digest("hex"),
     mtimeMs: mtimes.get(record.path) ?? 0
   })).sort((a, b) => a.path.localeCompare(b.path));
 }
@@ -22153,7 +22219,7 @@ var init_slate = __esm(() => {
 });
 
 // src/flow/store.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { appendFile as appendFile3, mkdir as mkdir30, readFile as readFile48, readdir as readdir9 } from "fs/promises";
 import path90 from "path";
 function flowsRoot(cwd) {
@@ -22325,7 +22391,7 @@ async function acChecksum(cwd, dir) {
 `).split(`
 `).map((line) => line.trimEnd()).join(`
 `).trim();
-  return `sha256:${createHash15("sha256").update(normalized).digest("hex")}`;
+  return `sha256:${createHash16("sha256").update(normalized).digest("hex")}`;
 }
 async function assertAcIntact(cwd, dir, flow) {
   if (!flow.acChecksum) {
@@ -22365,7 +22431,7 @@ var init_slate_course = __esm(() => {
 });
 
 // src/sac/trusted-wrap-up.ts
-import { createHash as createHash16, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash17, randomUUID as randomUUID7 } from "crypto";
 function createTrustedWrapUpAuthority(input) {
   const now = input.now ?? (() => new Date);
   return Object.freeze({
@@ -22397,7 +22463,7 @@ function createTrustedWrapUpAuthority(input) {
   });
 }
 function digest2(value) {
-  return createHash16("sha256").update(value).digest("hex");
+  return createHash17("sha256").update(value).digest("hex");
 }
 var issued, consumed;
 var init_trusted_wrap_up = __esm(() => {
@@ -22407,7 +22473,7 @@ var init_trusted_wrap_up = __esm(() => {
 
 // src/sac/index.ts
 import { access as access2, readFile as readFile49, realpath as realpath5 } from "fs/promises";
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import path91 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 async function resolveSacNormativeSchemaPath(fileName, searchFrom = [fileURLToPath5(new URL(".", import.meta.url)), process.cwd()]) {
@@ -23085,7 +23151,7 @@ async function validateSacContract(input) {
   return { valid: errors.length === 0, errors };
 }
 function hashSacRecord(value) {
-  return createHash17("sha256").update(typeof value === "string" ? value : JSON.stringify(value)).digest("hex");
+  return createHash18("sha256").update(typeof value === "string" ? value : JSON.stringify(value)).digest("hex");
 }
 async function resolveWorkspaceReference(input) {
   if (!workspacePathPattern.test(input.uri) || path91.isAbsolute(input.uri) || /^[a-z][a-z0-9+.-]*:/i.test(input.uri) || input.uri.includes("\\"))
@@ -23196,7 +23262,7 @@ var init_secure_resource_read = __esm(() => {
 
 // src/sac/workspace-service.ts
 import { mkdir as mkdir31, readdir as readdir10, readFile as readFile50 } from "fs/promises";
-import { createHash as createHash18, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash19, randomUUID as randomUUID8 } from "crypto";
 import path93 from "path";
 
 class WorkspaceService {
@@ -23486,7 +23552,7 @@ class WorkspaceService {
   }
   contentDigest(absolutePath) {
     try {
-      return createHash18("sha256").update(readWorkspaceFileNoFollow(this.root, absolutePath)).digest("hex");
+      return createHash19("sha256").update(readWorkspaceFileNoFollow(this.root, absolutePath)).digest("hex");
     } catch {
       return;
     }
@@ -23618,7 +23684,7 @@ var init_workspace_service = __esm(() => {
 });
 
 // src/sac/guarded-owner-writer.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 function createGuardedOwnerWriter(input) {
   const recoverReceipt = input.recoverReceipt;
   return Object.freeze({
@@ -23643,7 +23709,7 @@ function receiptMatchesIntent(input) {
   return binding.owner === input.owner && binding.bindingHash === bindingHash(input.owner, input.intent) && binding.intentRef === input.intent.intentRef && binding.proposalId === input.intent.proposalId && binding.proposalRevision === input.intent.proposalRevision && binding.workspaceId === input.intent.workspaceId && binding.correlationId === input.intent.correlationId && binding.idempotencyKey === input.intent.idempotencyKey && binding.reviewerSubject === input.intent.reviewerSubject && binding.reviewerAuthority === input.intent.reviewerAuthority && binding.policyRevision === input.intent.policyRevision;
 }
 function bindingHash(owner, intent) {
-  return createHash19("sha256").update(JSON.stringify({ owner, ...intent })).digest("hex");
+  return createHash20("sha256").update(JSON.stringify({ owner, ...intent })).digest("hex");
 }
 var init_guarded_owner_writer = () => {};
 
@@ -24296,7 +24362,7 @@ var init_wrap_up_evidence = __esm(() => {
 });
 
 // src/sac/session-wrap-up.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 import { mkdir as mkdir32, writeFile as writeFile33 } from "fs/promises";
 import path95 from "path";
 function sessionEvidenceRef(workspaceId, sessionId) {
@@ -24362,12 +24428,12 @@ async function resolveSessionWrapUp(input) {
     await writeFile33(path95.join(input.cwd, noticeRelPath), floor.notice, "utf8");
   const observedAt = now().toISOString();
   const evidence = [
-    { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash20("sha256").update(safeWrapUp.content).digest("hex"), observedAt },
-    { kind: diffKind, uri: `./${diffRelPath}`, revision: createHash20("sha256").update(safeDiff.content).digest("hex"), observedAt },
-    { kind: "session", uri: `./${relPath}`, revision: createHash20("sha256").update(safeSession.content).digest("hex"), observedAt }
+    { kind: "wrap-up", uri: `./${wrapUpRelPath}`, revision: createHash21("sha256").update(safeWrapUp.content).digest("hex"), observedAt },
+    { kind: diffKind, uri: `./${diffRelPath}`, revision: createHash21("sha256").update(safeDiff.content).digest("hex"), observedAt },
+    { kind: "session", uri: `./${relPath}`, revision: createHash21("sha256").update(safeSession.content).digest("hex"), observedAt }
   ];
   if (floor.notice !== undefined) {
-    evidence.push({ kind: REDACTION_NOTICE_KIND, uri: `./${noticeRelPath}`, revision: createHash20("sha256").update(floor.notice).digest("hex"), observedAt });
+    evidence.push({ kind: REDACTION_NOTICE_KIND, uri: `./${noticeRelPath}`, revision: createHash21("sha256").update(floor.notice).digest("hex"), observedAt });
   }
   return {
     workspaceId: input.workspaceId,
@@ -24393,7 +24459,7 @@ var init_session_wrap_up = __esm(() => {
 });
 
 // src/sac/review-confirm-token.ts
-import { createHash as createHash21, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash22, randomBytes as randomBytes3 } from "crypto";
 import { readFile as readFile51 } from "fs/promises";
 import path96 from "path";
 function confirmTokenPath(cwd, workspaceId, proposalId) {
@@ -24403,7 +24469,7 @@ function confirmReceiptPath(cwd, workspaceId, proposalId, idempotencyKey) {
   return path96.join(cwd, ".metaproject", "workspaces", workspaceId, "proposals", `${proposalId}.${sha256(idempotencyKey)}.confirm-receipt.json`);
 }
 function sha256(text) {
-  return createHash21("sha256").update(text).digest("hex");
+  return createHash22("sha256").update(text).digest("hex");
 }
 async function mintConfirmToken(cwd, workspaceId, proposalId, deps = {}) {
   const now = deps.now ?? (() => new Date);
@@ -24564,7 +24630,7 @@ function round(value) {
 var init_dedup = () => {};
 
 // src/sac/proposal-evidence.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 import { readFile as readFile52, rm as rm8 } from "fs/promises";
 import path97 from "path";
 function proposalPath(cwd, workspaceId, proposalId) {
@@ -24592,7 +24658,7 @@ async function readVerifiedProposalEvidence(cwd, workspaceId, proposalId) {
   } catch {
     return { ok: false, code: "evidence_file_unreadable" };
   }
-  if (createHash22("sha256").update(content).digest("hex") !== evidence.revision) {
+  if (createHash23("sha256").update(content).digest("hex") !== evidence.revision) {
     return { ok: false, code: "evidence_revision_mismatch" };
   }
   return { proposal, evidence, content };
@@ -24603,7 +24669,7 @@ async function readSidecarNote(cwd, workspaceId, proposalId) {
   });
 }
 function digestOf3(content) {
-  return createHash22("sha256").update(content).digest("hex");
+  return createHash23("sha256").update(content).digest("hex");
 }
 async function readTargetVersion(absolutePath) {
   try {
@@ -25295,7 +25361,7 @@ var init_wiki_owner_writer = __esm(() => {
 });
 
 // src/gdskills/project-skills.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 import { homedir as homedir3 } from "os";
 import { mkdir as mkdir34, readFile as readFile57, stat as stat11 } from "fs/promises";
 import path101 from "path";
@@ -25363,7 +25429,7 @@ function resolveOriginPath(ref, projectRoot) {
   return path101.resolve(projectRoot, trimmed);
 }
 function hashOriginContent(content) {
-  return `sha256:${createHash23("sha256").update(content).digest("hex")}`;
+  return `sha256:${createHash24("sha256").update(content).digest("hex")}`;
 }
 async function readSkillOrigin(projectRoot, ref, now = () => new Date) {
   const resolved = resolveOriginPath(ref, projectRoot);
@@ -25623,7 +25689,7 @@ ${filesToRead}
 
 ## Verification
 
-- Current state: not verified.
+- Verification status: see \`verification.md\` (written by \`keryx skills verify\`).
 - Run: \`keryx skills verify ${moduleName}/${skillName}\`
 `;
 }
@@ -25874,7 +25940,7 @@ var init_skill_owner_writer = __esm(() => {
 });
 
 // src/sac/proposal-lifecycle.ts
-import { createHash as createHash24, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash25, randomUUID as randomUUID11 } from "crypto";
 import { appendFile as appendFile4, mkdir as mkdir35, readdir as readdir12, readFile as readFile59 } from "fs/promises";
 import path102 from "path";
 function supportsOwnerWriteRecovery(writer) {
@@ -26311,7 +26377,7 @@ class ProposalLifecycleService {
   }
 }
 function hash(value) {
-  return createHash24("sha256").update(value).digest("hex");
+  return createHash25("sha256").update(value).digest("hex");
 }
 function recordHash(value) {
   return hash(JSON.stringify(value));
@@ -26535,7 +26601,7 @@ var init_workspace_resolve = __esm(() => {
 });
 
 // src/sac/machine-wrap-up.ts
-import { createHash as createHash25, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash26, randomUUID as randomUUID13 } from "crypto";
 import { mkdir as mkdir36 } from "fs/promises";
 import path103 from "path";
 function groupSeedsByKind(slate) {
@@ -26550,7 +26616,7 @@ function groupSeedsByKind(slate) {
   return map;
 }
 function sha2562(value) {
-  return createHash25("sha256").update(value).digest("hex");
+  return createHash26("sha256").update(value).digest("hex");
 }
 function mechanicalSummary(diff, course) {
   return `Mechanical wrap-up summary (model turn unavailable or timed out):
@@ -28496,9 +28562,9 @@ var init_orchestrate = __esm(() => {
 });
 
 // src/harness/policy/profiles.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 function sha256Hex2(input) {
-  return createHash26("sha256").update(input, "utf8").digest("hex");
+  return createHash27("sha256").update(input, "utf8").digest("hex");
 }
 function readOnlyReview() {
   return {
@@ -29718,7 +29784,7 @@ var init_supersede = __esm(() => {
 });
 
 // src/memory/service.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import { mkdir as mkdir38, readFile as readFile63, writeFile as writeFile36 } from "fs/promises";
 import path110 from "path";
 function dataRoot(cwd) {
@@ -29775,7 +29841,7 @@ function createMemoryService() {
       const indexPath = path110.join(indexDir, "index.json");
       await writeFile36(indexPath, `${JSON.stringify({
         catalogVersion: 1,
-        sourceFingerprint: createHash27("sha256").update(JSON.stringify(entries.map((e) => ({
+        sourceFingerprint: createHash28("sha256").update(JSON.stringify(entries.map((e) => ({
           path: e.relativePath,
           content: [e.title, e.type, e.status, e.confidence, e.summary, e.details, e.tags, e.scopes, e.validFrom, e.validTo].join("\x00")
         })))).digest("hex"),
@@ -35918,7 +35984,7 @@ var init_github = __esm(() => {
 });
 
 // src/harness/tool/metaproject-adapter.ts
-import { lstat as lstat3, readdir as readdir17, readFile as readFile74, realpath as realpath6, stat as stat14 } from "fs/promises";
+import { lstat as lstat4, readdir as readdir17, readFile as readFile74, realpath as realpath6, stat as stat14 } from "fs/promises";
 import { isAbsolute, join, relative, resolve } from "path";
 function isMissingExecutable(cause) {
   const message = cause instanceof Error ? cause.message : String(cause);
@@ -35974,12 +36040,16 @@ function flattenAttribution(attribution) {
 }
 async function projectRemovalTrail(cwd, query) {
   const lookup = searchRemovals(await loadDeletionTrail(cwd), query);
+  if (lookup.verdict === "trail-absent") {
+    return { verdict: "trail-absent", summary: TRAIL_ABSENT_SUMMARY };
+  }
+  const summary = clipAutomaticRecallText(lookup.reason.split(`${cwd}/`).join(""), MAX_REMOVAL_SUMMARY_BYTES);
   if (lookup.verdict !== "recorded-removed") {
-    return { verdict: lookup.verdict, summary: clipAutomaticRecallText(lookup.reason, MAX_REMOVAL_SUMMARY_BYTES) };
+    return { verdict: lookup.verdict, summary };
   }
   return {
     verdict: "recorded-removed",
-    summary: clipAutomaticRecallText(lookup.reason, MAX_REMOVAL_SUMMARY_BYTES),
+    summary,
     totalRemovals: lookup.occurrences.length,
     removals: lookup.occurrences.slice(0, MAX_REMOVAL_RECORDS).map((item) => ({
       layer: item.layer,
@@ -36049,7 +36119,7 @@ async function parseCatalogSummaries(cwd) {
 async function walkSkillCatalog(cwd) {
   const root = join(cwd, ".metaproject", "skills", "gdskills");
   const entries = [];
-  const rootInfo = await lstat3(root).catch(() => null);
+  const rootInfo = await lstat4(root).catch(() => null);
   if (!rootInfo || !rootInfo.isDirectory() || rootInfo.isSymbolicLink())
     return entries;
   const rootReal = await realpath6(root).catch(() => null);
@@ -36735,7 +36805,7 @@ function createMetaprojectAdapter(cwd, overrides = {}) {
     }
   };
 }
-var DEFAULT_DEPS, MAX_EXCERPT_BYTES = 400, MAX_QUERY_BYTES2 = 4096, UNKNOWN_PROVENANCE = "unknown", MAX_SEARCH_OUTPUT_BYTES = 20000, SEARCH_CODE_RG_MISSING, MAX_REMOVAL_RECORDS = 5, MAX_REMOVAL_SUMMARY_BYTES = 1600;
+var DEFAULT_DEPS, MAX_EXCERPT_BYTES = 400, MAX_QUERY_BYTES2 = 4096, UNKNOWN_PROVENANCE = "unknown", MAX_SEARCH_OUTPUT_BYTES = 20000, SEARCH_CODE_RG_MISSING, MAX_REMOVAL_RECORDS = 5, MAX_REMOVAL_SUMMARY_BYTES = 1600, TRAIL_ABSENT_SUMMARY = 'no removal has ever been recorded in this project (it has no deletion trail) \u2014 not the claim "this never existed".';
 var init_metaproject_adapter = __esm(() => {
   init_wiki_freshness();
   init_fs();
@@ -38150,7 +38220,7 @@ var init_metaproject_operations = __esm(() => {
 });
 
 // src/wiki/deep-enrich.ts
-import { randomUUID as randomUUID15, createHash as createHash28 } from "crypto";
+import { randomUUID as randomUUID15, createHash as createHash29 } from "crypto";
 function composeAbortSignals(external, timeout) {
   if (external === undefined) {
     return { signal: timeout, dispose: () => {} };
@@ -38181,7 +38251,7 @@ function errorMessage2(cause) {
   return cause instanceof Error ? cause.message : String(cause);
 }
 function sha256Hex3(text) {
-  return createHash28("sha256").update(text).digest("hex");
+  return createHash29("sha256").update(text).digest("hex");
 }
 function buildDeepEnrichTools(port) {
   const deepOps = METAPROJECT_OPERATIONS.filter((op) => DEEP_ENRICH_OPS.includes(op.name));
@@ -41172,15 +41242,43 @@ async function refreshProviderGrant(provider, http, dir) {
   saveOAuthGrant(provider, next, dir);
   return next;
 }
+async function refreshSavedGrants(http, dir, providers = SESSION_REFRESHED_GRANTS) {
+  const warnings = [];
+  const now = http.now ?? Date.now;
+  for (const provider of providers) {
+    if (!SESSION_REFRESHED_GRANTS.includes(provider))
+      continue;
+    const grant = loadOAuthGrant(provider, dir);
+    if (grant === undefined)
+      continue;
+    if (grant.refresh === undefined || grant.refresh.length === 0) {
+      if (grant.expires !== undefined && grant.expires <= now()) {
+        warnings.push(`${provider}: the saved login has expired and holds no refresh token. Run \`keryx auth login ${provider}\`.`);
+      }
+      continue;
+    }
+    if (!grantNeedsRefresh(grant, http.now))
+      continue;
+    try {
+      await refreshProviderGrant(provider, http, dir);
+    } catch (cause) {
+      const reason = cause instanceof Error ? cause.message : String(cause);
+      warnings.push(`${provider}: the saved login is expiring or expired and could not be refreshed (${reason}). ` + `Run \`keryx auth login ${provider}\`.`);
+    }
+  }
+  return warnings;
+}
 function logoutProvider(provider, dir) {
   deleteOAuthGrant(provider, dir);
 }
+var SESSION_REFRESHED_GRANTS;
 var init_login = __esm(() => {
   init_catalog();
   init_copilot();
   init_device_code();
   init_grants();
   init_openai_codex();
+  SESSION_REFRESHED_GRANTS = ["grok", "github-copilot"];
 });
 
 // src/cli.ts
@@ -41193,7 +41291,7 @@ import {
   chmod as chmod2,
   mkdir as mkdir14,
   readFile as readFile23,
-  unlink,
+  unlink as unlink2,
   writeFile as writeFile16
 } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
@@ -42784,7 +42882,7 @@ var BUNDLED_GDSKILLS = [
     "If the request asks to create, run, resume, track, or finish a managed flow and Task Manager is enabled, route implementation work to `gdskills/orchestration/flow-orchestrator/SKILL.md` before `job-orchestrator`.",
     "Prefer project-local skills and module manifests before broad raw file search.",
     "Route to the narrowest applicable skill and record unavailable modules explicitly."
-  ], ["any repository task", "route context", "which skill should be used", "ordinary product-development request", "agent should decide tools"]),
+  ], ["any repository task", "route context", "which skill should be used", "ordinary product-development request", "agent should decide tools"], "Use when a request's routing to a Metaproject module, skill, or project-skill is unclear and needs deciding before any work starts. NOT for: picking between gdgraph, gdctx, gdwiki, memory, and health once the module is already known (see context-router)."),
   skill("context-router", "core", ["minimal", "recommended", "full"], "Choose between gdgraph, gdctx, gdwiki, memory, health, and project-skills before raw file reads.", [
     "Start from the user's goal, not from command names.",
     "Use gdgraph for file relationships and affected context.",
@@ -42794,13 +42892,13 @@ var BUNDLED_GDSKILLS = [
     "Use health for normalized quality and gate status; use testing for test selection and test context.",
     "Prefer MCP tools/resources for these capabilities when connected; otherwise use the matching skill and CLI command.",
     "Use project-skills for known modules, components, stores, services, and domain entities."
-  ], ["find files", "understand code", "collect context", "what should I inspect", "agent routing"]),
+  ], ["find files", "understand code", "collect context", "what should I inspect", "agent routing"], "Use when the Metaproject module or skill is already known and the next step is picking gdgraph, gdctx, gdwiki, memory, health, or project-skills before reading raw files. NOT for: deciding which top-level skill or module should handle a request (see metaproject-router)."),
   skill("entity-skill-router", "core", ["minimal", "recommended", "full"], "Select relevant project-skills for known modules, components, stores, services, and domain entities.", [
     "Check `.metaproject/project-skills` for matching module/entity skills.",
     "Use gdgraph affected context to find nearby entities when the target is a file.",
     "Load only the matching project-skill and directly referenced files.",
     "If no project-skill exists, suggest creating one with `keryx skills generate`."
-  ], ["project skill", "component pattern", "module-specific work"]),
+  ], ["project skill", "component pattern", "module-specific work"], "Use when a known module, component, store, service, or domain entity already has a project-skill that should be loaded instead of searched for from scratch. NOT for: scaffolding a project-skill that does not exist yet (see entity-skill-creator), checking one against current code (see entity-skill-verifier), or applying a finding to one (see entity-skill-learner)."),
   skill("entity-skill-creator", "core", ["minimal", "recommended", "full"], "Create canonical project-skills from a path, symbol, wiki page, module, component, store, service, or domain entity.", [
     "Normalize the target into module, entity, files, symbols, and wiki references.",
     "Collect evidence from gdgraph, gdctx, gdwiki, health, and memory when available.",
@@ -42809,7 +42907,7 @@ var BUNDLED_GDSKILLS = [
     "To refresh a project-skill from its Origin (or a new file), run `keryx skills update <module>/<name> [--from <origin>]`.",
     "Run `keryx skills route <target>` and `keryx skills inspect <module>/<skill-name>` to confirm registration and routing.",
     "Run `keryx skills verify <module>/<skill-name>` and finish with `keryx skills status`."
-  ], ["create skill", "generate project skill", "new entity skill", "\u0441\u043E\u0437\u0434\u0430\u0439 \u0441\u043A\u0438\u043B", "\u0441\u043E\u0437\u0434\u0430\u0439 \u0441\u043A\u0438\u043B\u043B \u0434\u043B\u044F <path>", "import skill", "import skills from", "update skill from", "\u043F\u043E\u0434\u0442\u044F\u043D\u0438 \u0441\u043A\u0438\u043B\u044B", "\u043E\u0431\u043D\u043E\u0432\u0438 \u0441\u043A\u0438\u043B"]),
+  ], ["create skill", "generate project skill", "new entity skill", "\u0441\u043E\u0437\u0434\u0430\u0439 \u0441\u043A\u0438\u043B", "\u0441\u043E\u0437\u0434\u0430\u0439 \u0441\u043A\u0438\u043B\u043B \u0434\u043B\u044F <path>", "import skill", "import skills from", "update skill from", "\u043F\u043E\u0434\u0442\u044F\u043D\u0438 \u0441\u043A\u0438\u043B\u044B", "\u043E\u0431\u043D\u043E\u0432\u0438 \u0441\u043A\u0438\u043B"], "Use when no project-skill exists yet for a target module, component, store, service, or domain entity, or one needs scaffolding, importing, or refreshing from its origin. NOT for: loading a project-skill that already exists (see entity-skill-router)."),
   skill("reviewer-skill-creator", "core", ["recommended", "full"], "Create a project-local reviewer for review-orchestrator from a rules file, review profile, or written team standard.", [
     "Read the source in full and sort it into method, convention, and persona before writing anything.",
     "Scaffold with `keryx skills create <target> --module review --name <reviewer> --note <gist> --origin <source file>`; the target is a routing key, the note is the prose.",
@@ -42819,18 +42917,18 @@ var BUNDLED_GDSKILLS = [
     "Confirm with `keryx review reviewers` \u2014 creating files is not registration, and registration is not discovery.",
     "For existing SKILL.md packages, run `keryx skills import --from <dir|file|https-url> --module <module>`; `keryx review import` is the review-shaped alias with the review-vantage-* prefix."
   ], ["create a reviewer", "new reviewer for review-orchestrator", "make a reviewer from this profile", "\u0441\u043E\u0437\u0434\u0430\u0439 \u0440\u0435\u0432\u044C\u044E\u0435\u0440\u0430", "\u0441\u043E\u0437\u0434\u0430\u0439 \u043D\u043E\u0432\u043E\u0433\u043E \u0440\u0435\u0432\u044C\u044E\u0435\u0440\u0430 \u043D\u0430 \u043E\u0441\u043D\u043E\u0432\u0430\u043D\u0438\u0438", "import vantage reviewers", "import overlay reviewers"]),
-  skill("entity-skill-verifier", "core", ["minimal", "recommended", "full"], "Verify project-skills against current code, graph, wiki, health, memory, tests, and review lessons.", [
-    "Resolve candidate skills through ownership and gdgraph affected context.",
-    "Compare skill claims with current code, wiki decisions, health reports, and memory.",
-    "Classify each skill as fresh, stale, needs-review, or blocked.",
-    "Write a verification report and only update generated sections when policy allows it."
-  ], ["verify skill", "skill-verify-skill", "stale skill"]),
+  skill("entity-skill-verifier", "core", ["minimal", "recommended", "full"], "Run `keryx skills verify` to check a project-skill's required files, SKILL.md metadata, manifest registration, target-path existence, and evidence artifacts (gdgraph, gdctx, validated gdwiki, Code Health, canonical accepted memory), then classify it as fresh, needs-review, stale, or blocked. The command does not read the skill's prose or compare it against current code \u2014 that comparison is a manual agent step.", [
+    "Resolve the target project-skill through gdgraph affected context or `keryx skills route <target>`.",
+    "Run `keryx skills verify <module>/<skill-name>` (`--dry-run` previews without writing).",
+    "The command checks required files, SKILL.md metadata (version, target, last-verified), manifest registration, target path existence, and evidence artifacts for gdgraph, gdctx, gdwiki, Code Health, and memory consultation, then classifies the skill fresh, needs-review, stale, or blocked and writes the JSON report plus `verification.md`.",
+    "Manually read the skill and the code, wiki, and health evidence it points at to check its claims \u2014 the command does not do this comparison \u2014 then route stale or blocked findings to entity-skill-learner."
+  ], ["verify skill", "skill-verify-skill", "stale skill"], "Use when an existing project-skill needs classifying \u2014 fresh, needs-review, stale, or blocked \u2014 from its required files, metadata, manifest registration, target-path existence, and evidence artifacts (gdgraph, gdctx, gdwiki, Code Health, memory), followed by a manual read of its claims against current code as this skill's next step. NOT for: applying a review, test, or health finding to update a skill (see entity-skill-learner)."),
   skill("entity-skill-learner", "core", ["minimal", "recommended", "full"], "Update project-skills from review findings, test failures, health reports, memory entries, and verifier reports.", [
     "Parse the source report and map findings to project-skills.",
     "Classify lessons as anti-patterns, checklist changes, template changes, workflow changes, or architecture rules.",
     "Respect manual sections and autonomy policy.",
     "Increment version and append `skill-changelog.md` entries with provenance."
-  ], ["learn from review", "update skill", "skill lesson"]),
+  ], ["learn from review", "update skill", "skill lesson"], "Use when a review finding, test failure, health report, memory entry, or verifier report points at a project-skill that needs updating. NOT for: checking a skill's current accuracy with no source report driving it (see entity-skill-verifier)."),
   skill("job-orchestrator", "orchestration", ["recommended", "full"], "Run full task pipelines: clarify, collect context, plan, implement, verify, review, and summarize.", [
     "Clarify ambiguity with interviewer-style questions only when required.",
     "Collect compact context through Metaproject modules before implementation.",
@@ -43177,7 +43275,7 @@ var BUNDLED_GDSKILLS = [
     "Find existing root agent entrypoints.",
     "Keep managed Metaproject blocks idempotent.",
     "Ensure local `.metaproject/index.md` and skill catalog are first-class references."
-  ], ["agents.md", "claude.md", "entrypoint"]),
+  ], ["agents.md", "claude.md", "entrypoint"], "Use when AGENTS.md or CLAUDE.md needs its managed Metaproject block added, refreshed, or kept idempotent. NOT for: splitting an oversized entrypoint into rules and project-skills (see agent-entrypoint-distiller)."),
   skill("agent-entrypoint-distiller", "platform", ["minimal", "recommended", "full"], "Split large AGENTS.md/CLAUDE.md files into high-priority Metaproject rules and project-specific skills.", [
     "Run `keryx rules distill` when the user asks to decompose a large CLAUDE.md/AGENTS.md.",
     "Keep root entrypoints compact: non-project/highest-priority instructions plus `.metaproject/index.md` routing.",
@@ -43187,7 +43285,7 @@ var BUNDLED_GDSKILLS = [
     "Install hooks only when explicitly enabled.",
     "Keep hooks lightweight and idempotent.",
     "Avoid network and destructive behavior inside hooks."
-  ], ["install hook", "git hook", "post-commit"]),
+  ], ["install hook", "git hook", "post-commit"], "Use when a lightweight, explicitly-enabled git hook for graph, health, or skill verification needs installing or checking. NOT for: general hook design guidance not tied to these three (see hookify)."),
   skill("hookify", "platform", ["full"], "Use hook guidance for safe hook design and installation.", [
     "Detect existing hooks and preserve user content.",
     "Install idempotent managed blocks.",
@@ -43202,23 +43300,23 @@ var BUNDLED_GDSKILLS = [
     "Read bundled and project-local skill metadata.",
     "Generate concise catalog entries grouped by category.",
     "Keep catalog deterministic and local-first."
-  ], ["skill catalog", "list skills", "skills registry"]),
+  ], ["skill catalog", "list skills", "skills registry"], "Use when `.metaproject/skills/catalog.md` or the machine-readable skill registry is missing or out of date with bundled and project-local skill metadata. NOT for: turning skills into runtime artifacts (see skill-runtime-exporter) or pushing them to local runtimes (see skill-sync)."),
   skill("skill-runtime-exporter", "platform", ["full"], "Export canonical skills to runtime-compatible Codex or Claude artifacts.", [
     "Read canonical skill packages.",
     "Remove management-only files from runtime exports.",
     "Keep runtime `SKILL.md` concise with references, scripts, and assets as needed."
-  ], ["export skill", "runtime skill", "codex skill"]),
+  ], ["export skill", "runtime skill", "codex skill"], "Use when canonical skill packages need turning into runtime-compatible Codex or Claude artifacts, stripped of management-only files. NOT for: regenerating the skill catalog (see skill-catalog-manager) or pushing the export to local runtimes (see skill-sync)."),
   skill("skill-sync", "platform", ["full"], "Sync exported runtime skills to configured local runtimes only when explicitly enabled.", [
     "Read configured runtime targets.",
     "Validate runtime skill packages before sync.",
     "Sync only selected skills and report changed files."
-  ], ["sync skills", "install runtime skills", "global skill sync"])
+  ], ["sync skills", "install runtime skills", "global skill sync"], "Use when already-exported runtime skills need pushing to configured local runtimes, and only when sync is explicitly enabled. NOT for: producing the runtime export itself (see skill-runtime-exporter).")
 ];
-function skill(name, category, profiles, purpose, workflow, triggers) {
+function skill(name, category, profiles, purpose, workflow, triggers, descriptionOverride) {
   return {
     name,
     category,
-    description: `Use when ${purpose.charAt(0).toLowerCase()}${purpose.slice(1)}`,
+    description: descriptionOverride ?? `Use when ${purpose.charAt(0).toLowerCase()}${purpose.slice(1)}`,
     purpose,
     workflow,
     triggers,
@@ -43243,9 +43341,10 @@ function renderBundledSkill(skillEntry) {
   const workflow = skillEntry.workflow.map((step, index) => `${index + 1}. ${step}`).join(`
 `);
   const commandContract = renderAgentCommandContract(skillEntry);
+  const descriptionField = skillEntry.description.includes(":") ? `description: ${JSON.stringify(skillEntry.description)}` : `description: ${skillEntry.description}`;
   return `---
 name: ${skillEntry.name}
-description: ${skillEntry.description}
+${descriptionField}
 ---
 
 # ${skillEntry.name}
@@ -43380,8 +43479,9 @@ ${sections}
 
 // src/gdskills/install.ts
 init_fs();
-import { cp, copyFile, mkdir as mkdir7, readFile as readFile10, writeFile as writeFile7 } from "fs/promises";
+import { cp, copyFile, lstat as lstat3, mkdir as mkdir7, readFile as readFile10, unlink, writeFile as writeFile7 } from "fs/promises";
 import { existsSync as existsSync9 } from "fs";
+import { createHash as createHash5 } from "crypto";
 import path31 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -43742,6 +43842,27 @@ function relativeContractPath(contract) {
   return contract.sourcePath ?? path30.join("src", "gdskills", "contracts", contract.fileName);
 }
 
+// src/gdskills/retired-rules.ts
+var RETIRED_RULES = [
+  {
+    fileName: "review-agent-profile.mdc",
+    shippedSha256: [
+      "e29a832821e501fa8a0acb5130007db1e21f1cee29f8ab6b2a1a7b35f9945281"
+    ],
+    reason: "Byte-identical duplicate of code-review-ai-assistant.mdc \u2014 nothing distinguished the two, and only the latter was ever routed to."
+  },
+  {
+    fileName: "review-strict-profile.mdc",
+    shippedSha256: [
+      "2e8847426bfba76ece8a208952402edadc6a062920aed07a721902b635a3f0e6",
+      "bc7e6df820682f75cbc1349e70d98b5692aa1c4bae903e28f41a67edb7a5a484"
+    ],
+    reason: "Outlived the review-strict skill it backed; review-orchestrator's Step 6 now resolves the model tier directly via `keryx review tier` instead."
+  }
+];
+var LARGEST_SHIPPED_RETIRED_RULE_BYTES = 2248;
+var RETIRED_RULE_SIZE_CAP_BYTES = LARGEST_SHIPPED_RETIRED_RULE_BYTES * 4;
+
 // src/gdskills/install.ts
 async function installGdskills(metaprojectRoot, profile, options = {}) {
   const skills = getBundledSkillsForProfile(profile);
@@ -43773,18 +43894,20 @@ async function installGdskills(metaprojectRoot, profile, options = {}) {
     }
   }
   await installBundledSharedSkills(skillsRoot);
-  await installBundledRules(metaprojectRoot);
+  const retiredRuleOutcomes = await installBundledRules(metaprojectRoot);
   const catalogPath = path31.join(metaprojectRoot, "skills", "catalog.md");
   await writeFile7(catalogPath, await preserveProjectSkillsSection(catalogPath, renderGdskillsCatalog(profile)), "utf8");
   const manifestPath = path31.join(metaprojectRoot, "modules", "gdskills.md");
   await writeFile7(manifestPath, renderGdskillsManifest(profile), "utf8");
   await installContracts(contractsRoot);
+  const warnings = retiredRuleOutcomes.map(retiredRuleWarning).filter((warning) => warning !== null);
   return {
     profile,
     installedSkills: skills.length,
     skillsRoot,
     catalogPath,
-    manifestPath
+    manifestPath,
+    warnings
   };
 }
 async function installBundledSharedSkills(skillsRoot) {
@@ -43796,10 +43919,83 @@ async function installBundledSharedSkills(skillsRoot) {
 }
 async function installBundledRules(metaprojectRoot) {
   const rulesSource = bundledRulesSourcePath();
+  const rulesTarget = path31.join(metaprojectRoot, "rules", "core");
   if (!existsSync9(rulesSource)) {
-    return;
+    return [];
+  }
+  await cp(rulesSource, rulesTarget, { recursive: true, force: true });
+  return removeUnmodifiedRetiredRules(rulesTarget);
+}
+async function removeUnmodifiedRetiredRules(rulesTarget, fsOps = { unlink }) {
+  const outcomes = [];
+  for (const retired of RETIRED_RULES) {
+    const installedPath = path31.join(rulesTarget, retired.fileName);
+    let stage = "lstat";
+    try {
+      const stats = await lstat3(installedPath);
+      if (!stats.isFile()) {
+        outcomes.push({ fileName: retired.fileName, action: "kept-not-regular-file" });
+        continue;
+      }
+      if (stats.size > RETIRED_RULE_SIZE_CAP_BYTES) {
+        outcomes.push({ fileName: retired.fileName, action: "kept-oversized", sizeBytes: stats.size });
+        continue;
+      }
+      stage = "read";
+      const content = await readFile10(installedPath);
+      const hash = createHash5("sha256").update(normalizeRetiredRuleContent(content)).digest("hex");
+      if (retired.shippedSha256.includes(hash)) {
+        stage = "unlink";
+        await fsOps.unlink(installedPath);
+        outcomes.push({ fileName: retired.fileName, action: "removed" });
+      } else {
+        outcomes.push({ fileName: retired.fileName, action: "kept-modified" });
+      }
+    } catch (error) {
+      if (isErrnoException(error) && error.code === "ENOENT") {
+        continue;
+      }
+      outcomes.push({
+        fileName: retired.fileName,
+        action: "kept-error",
+        stage,
+        errorCode: isErrnoException(error) && error.code ? error.code : "UNKNOWN"
+      });
+    }
+  }
+  return outcomes;
+}
+function normalizeRetiredRuleContent(content) {
+  let text = content.toString("utf8");
+  if (text.charCodeAt(0) === 65279) {
+    text = text.slice(1);
+  }
+  return text.replace(/\r\n/g, `
+`);
+}
+function isErrnoException(error) {
+  return error instanceof Error && "code" in error;
+}
+function retiredRuleWarning(outcome) {
+  if (outcome.action === "removed") {
+    return null;
+  }
+  const reason = RETIRED_RULES.find((retired) => retired.fileName === outcome.fileName)?.reason ?? "no longer shipped by keryx";
+  const prefix = `${outcome.fileName} is no longer shipped by keryx (${reason})`;
+  switch (outcome.action) {
+    case "kept-modified":
+      return `${prefix}; kept because it differs from every shipped version \u2014 delete it, or rename it if you still rely on it`;
+    case "kept-not-regular-file":
+      return `${prefix}; kept because it is not a regular file (a symlink, directory, or similar) \u2014 keryx will not read or remove it; delete or rename it yourself if appropriate`;
+    case "kept-oversized":
+      return `${prefix}; kept because it is ${outcome.sizeBytes} bytes, far larger than any version keryx ever shipped under this name \u2014 inspect it, then delete or rename it if appropriate`;
+    case "kept-error":
+      return outcome.stage === "unlink" ? `${prefix}; matches a shipped version but could not be removed (${outcome.errorCode}) \u2014 delete it by hand` : `${prefix}; kept because it could not be read (${outcome.errorCode}) \u2014 inspect it, then delete or rename it if appropriate`;
+    default: {
+      const exhaustive = outcome;
+      throw new Error(`unhandled retired rule outcome: ${JSON.stringify(exhaustive)}`);
+    }
   }
-  await cp(rulesSource, path31.join(metaprojectRoot, "rules", "core"), { recursive: true, force: true });
 }
 async function preserveProjectSkillsSection(catalogPath, nextCatalog) {
   if (!await pathExists(catalogPath)) {
@@ -46105,13 +46301,33 @@ function escapeHtml(value) {
 function renderProjectRulesReadme() {
   return `# Project Rules
 
-This directory stores repository-level instructions imported from root agent entrypoints such as \`AGENTS.md\` or \`CLAUDE.md\`.
+This directory holds two different kinds of rule files. Do not treat them the same way.
 
-Rules:
+## Imported entrypoint rules (this directory)
+
+The \`.md\` files here (e.g. \`agents-md.md\`, \`claude-md.md\`) are repository-level instructions
+imported from root agent entrypoints such as \`AGENTS.md\` or \`CLAUDE.md\`.
 
 - treat files here as high-priority agent-readable mirrors of root instructions;
 - update the root entrypoint first when changing project-wide instructions;
 - rerun \`keryx rules sync\`, \`keryx init\`, or \`keryx update\` to resync imported rule files.
+
+## Core rule library (\`core/*.mdc\`)
+
+\`core/*.mdc\` is an on-demand rule library, not something loaded automatically. A rule file is
+read only when a skill or \`routing.md\` cites it by path.
+
+- \`alwaysApply\` and \`globs\` in each rule's frontmatter are Cursor-format metadata for Cursor's
+  own auto-attach behavior; keryx itself does not read or act on either field;
+- a stack-specific rule (e.g. \`nestjs-dto.mdc\`, \`mobx-store-template.mdc\`) declares the stack(s)
+  it applies to via a \`stack_requires\` frontmatter key, using the same tag vocabulary as a
+  skill's \`metadata.stack_requires\`; it is only relevant to projects on that stack;
+- the bundled tree (\`src/gdskills/bundled/rules/core/\`) is the source of truth \u2014 \`core/\` here is
+  an installed mirror, and \`keryx init\`/\`keryx update\` overwrite it wholesale on install;
+  a rule retired from the bundled tree is removed from here too when it is an unmodified shipped
+  copy; otherwise it is kept (with a warning that says why \u2014 edited, not a regular file, oversized,
+  or unreadable/unremovable), since discarding it silently could lose your changes or hide a
+  filesystem problem.
 `;
 }
 function renderImportedAgentRules({
@@ -46119,7 +46335,7 @@ function renderImportedAgentRules({
   content
 }) {
   const body = extractAgentRuleBody(content);
-  const normalizedBody = body.length > 0 ? body : `This root entrypoint delegates agent routing to \`.metaproject/index.md\`.
+  const normalizedBody = body.length > 0 && !isHeadingOnlyBody(body) ? body : `This root entrypoint delegates agent routing to \`.metaproject/index.md\`.
 
 Read \`.metaproject/index.md\` first, then follow the high-priority rules, skills, and module references listed there.`;
   return `---
@@ -46143,6 +46359,9 @@ This file is generated from the repository root agent entrypoint. Edit \`${sourc
 ${normalizedBody}
 `;
 }
+function isHeadingOnlyBody(body) {
+  return body.replace(/^#[^\n]*\n?/, "").trim().length === 0;
+}
 function extractAgentRuleBody(content) {
   const marker = "<!-- keryx:index -->";
   const endMarker = "<!-- /keryx:index -->";
@@ -47243,13 +47462,13 @@ import { readFile as readFile17, rm as rm3 } from "fs/promises";
 import path44 from "path";
 
 // src/lib/install-plan.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { readFile as readFile16 } from "fs/promises";
 import path43 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.97",
+  version: "0.2.98",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -47390,7 +47609,7 @@ function parseDivergenceResolution(args) {
   return;
 }
 function digestOf(content) {
-  return `sha256:${createHash5("sha256").update(content, "utf8").digest("hex")}`;
+  return `sha256:${createHash6("sha256").update(content, "utf8").digest("hex")}`;
 }
 function installJournalPath(metaprojectRoot) {
   return path43.join(metaprojectRoot, INSTALL_JOURNAL_RELATIVE_PATH);
@@ -49612,8 +49831,10 @@ async function initCommand(args) {
       await installGdwikiPostCommitHook(projectRoot);
     }
   }
+  let gdskillsWarnings = [];
   if (enableGdskills) {
-    await installGdskills(metaprojectRoot, gdskillsProfile);
+    const gdskillsInstallResult = await installGdskills(metaprojectRoot, gdskillsProfile);
+    gdskillsWarnings = gdskillsInstallResult.warnings;
     if (enableGdskillsHook) {
       await installGdskillsPostCommitHook(projectRoot);
     }
@@ -49867,6 +50088,12 @@ async function initCommand(args) {
   if (enableSac) {
     statusLine("sac", true, "shared agent context: cross-session workspace propose/review (opt-in)");
   }
+  if (gdskillsWarnings.length > 0) {
+    heading("Warnings");
+    for (const warning of gdskillsWarnings) {
+      note(warning);
+    }
+  }
   const gitHooksRoot = await resolveGitHooksRoot(projectRoot);
   const hookLines = [];
   if (enableGdgraph) {
@@ -50240,7 +50467,7 @@ Use this skill when a task requires code graph context, dependency impact analys
 4. Use \`keryx gdgraph affected <target>\` before implementation or review.
 `;
   if (await readFile23(legacyReadmePath, "utf8") === legacyContent) {
-    await unlink(legacyReadmePath);
+    await unlink2(legacyReadmePath);
   }
 }
 function runtimeSourcePath(relativePath) {
@@ -53184,7 +53411,7 @@ function readLiteral(source, start, quote) {
 
 // src/wiki/freshness/queue.ts
 init_fs();
-import { readFile as readFile43, rename as rename3, stat as stat10, unlink as unlink2, writeFile as writeFile30 } from "fs/promises";
+import { readFile as readFile43, rename as rename3, stat as stat10, unlink as unlink3, writeFile as writeFile30 } from "fs/promises";
 import path86 from "path";
 var QUEUE_FILE = "freshness-queue.jsonl";
 var ROTATED_FILE = "freshness-queue.1.jsonl";
@@ -53225,7 +53452,7 @@ async function drainQueue(cwd) {
 async function clearQueue(cwd) {
   for (const file of [rotatedQueuePath(cwd), queuePath(cwd)]) {
     if (await pathExists(file)) {
-      await unlink2(file).catch(() => {
+      await unlink3(file).catch(() => {
         return;
       });
     }
@@ -57464,6 +57691,8 @@ var BUNDLED_SKILL_CHECKS = [
   "frontmatter:name-unique",
   "frontmatter:description",
   "frontmatter:metadata",
+  "frontmatter:harness-claude",
+  "frontmatter:category",
   "catalog:registered",
   "model:concrete-declaration",
   "persona:name",
@@ -57608,17 +57837,60 @@ var INSTALLED_PREFIXES = [
 var GENERATED_PATH_ROOTS = [
   { prefix: "rules/entrypoints/", producedBy: "keryx rules distill" }
 ];
-var PATH_REFERENCE = /(?:^|[\s"'`([])((?:\.metaproject\/|skills\/|rules\/|scripts\/)[\w./@-]*[\w.@-])/g;
-function normaliseReferencePath(reference) {
+var PATH_REFERENCE = /(?:^|[\s"'`([])((?:\.metaproject\/|skills\/|rules\/|scripts\/)[\w./@*-]*[\w.@*-])/g;
+function resolveInstalledReference(reference, known) {
   for (const [from, to] of INSTALLED_PREFIXES) {
     if (reference.startsWith(from))
       return to + reference.slice(from.length);
   }
   if (reference.startsWith(".metaproject/"))
     return;
-  const root = reference.split("/")[0] ?? "";
+  const segments = reference.split("/");
+  const root = segments[0] ?? "";
+  if (root === "skills") {
+    if (segments.length === 3 && known.has(segments[2] ?? ""))
+      return reference;
+    return null;
+  }
   return CHECKED_PATH_ROOTS.includes(root) ? reference : undefined;
 }
+function scanCrossReferences(text, root, known, checkSkillNames, add) {
+  text.split(`
+`).forEach((line, index) => {
+    if (checkSkillNames) {
+      for (const pattern of SKILL_REFERENCE_PATTERNS) {
+        for (const match of line.matchAll(pattern)) {
+          const referenced = match[1];
+          if (!referenced.includes("-"))
+            continue;
+          if (known.has(referenced))
+            continue;
+          if (KNOWN_EXTERNAL_SKILL_REFERENCES.has(referenced))
+            continue;
+          add("xref:skill", index + 1, `names a skill \`${referenced}\` that this tree does not ship; either bundle it or stop naming it.`);
+        }
+      }
+    }
+    for (const match of line.matchAll(PATH_REFERENCE)) {
+      const raw = match[1];
+      if (raw.includes("<") || raw.includes("*") || raw.includes("$"))
+        continue;
+      const resolved = resolveInstalledReference(raw, known);
+      if (resolved === undefined)
+        continue;
+      if (resolved === null) {
+        add("xref:path", index + 1, `path \`${raw}\` names the SOURCE tree's own layout, not an installed one \u2014 an installed project has no top-level \`skills/\`, only \`.metaproject/skills/gdskills/\u2026\`. Write \`.metaproject/skills/gdskills/${raw.slice("skills/".length)}\` (or the \`skills/gdskills/\u2026\` form), or, to name the whole skill rather than a file in it, drop everything past its directory.`);
+        continue;
+      }
+      if (GENERATED_PATH_ROOTS.some((entry) => resolved === entry.prefix.replace(/\/$/, "") || resolved.startsWith(entry.prefix))) {
+        continue;
+      }
+      if (existsSync24(path143.join(root, resolved)))
+        continue;
+      add("xref:path", index + 1, `path \`${raw}\` resolves to nothing under the shipped tree (looked for \`${resolved}\`).`);
+    }
+  });
+}
 var SKILL_DOCUMENT_NAMES = new Set(HARNESS_SKILL_RUNTIMES.map((runtime) => skillBuildFileName(runtime)));
 var KNOWN_SKILL_COMPANION_DOCUMENTS = new Map([
   [
@@ -57650,6 +57922,12 @@ function bundledSkillFiles(root) {
 function bundledSkillDocuments(root) {
   return walkSkillDocuments(root, (name) => SKILL_DOCUMENT_NAMES.has(name));
 }
+function bundledRuleFiles(root) {
+  const rulesRoot = path143.join(root, "rules", "core");
+  if (!existsSync24(rulesRoot))
+    return [];
+  return readdirSync2(rulesRoot, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => path143.join(rulesRoot, entry.name)).sort();
+}
 function defaultBundledRoot() {
   const directPath = path143.join(import.meta.dir, "bundled");
   if (existsSync24(directPath))
@@ -57672,6 +57950,7 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
     const skillDir = path143.dirname(file);
     const skill = path143.basename(skillDir);
     const rel = path143.relative(skillsRoot, file).split(path143.sep).join("/");
+    const category = path143.dirname(rel).split("/")[0] ?? "";
     const text = readFileSync6(file, "utf8");
     const add = (check, line, message) => {
       findings.push({ check, skill, file: rel, line, message });
@@ -57710,9 +57989,25 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
         if (metadataVersion === null) {
           add("frontmatter:metadata", 1, "frontmatter `metadata` declares no `version`; without one a skill cannot be said to have changed.");
         }
+        const metadataCategory = /^\s{2,}category\s*:\s*(.+)$/m.exec(block);
+        if (metadataCategory !== null) {
+          const declaredCategory = (metadataCategory[1] ?? "").trim().replace(/^["']|["']$/g, "");
+          if (declaredCategory.length > 0 && declaredCategory !== category) {
+            add("frontmatter:category", 1, `frontmatter \`metadata.category\` is "${declaredCategory}" but this skill ships under \`${category}/${skill}\`; set it to "${category}" or drop the field.`);
+          }
+        }
+      }
+      if (path143.basename(file) === "SKILL.md") {
+        const compatibleHarnesses = /^\s{2,}compatible_harnesses\s*:\s*(.+)$/m.exec(block);
+        if (compatibleHarnesses !== null) {
+          const declared = (compatibleHarnesses[1] ?? "").trim().replace(/^["']|["']$/g, "");
+          const harnesses = declared.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+          if (!harnesses.includes("claude")) {
+            add("frontmatter:harness-claude", 1, `frontmatter \`compatible_harnesses\` ("${declared}") omits \`claude\`, but this file IS the Claude build \u2014 add \`claude\` to the list.`);
+          }
+        }
       }
     }
-    const category = path143.dirname(rel).split("/")[0] ?? "";
     if (!catalogued.has(`${category}/${skill}`)) {
       add("catalog:registered", null, `BUNDLED_GDSKILLS (src/gdskills/catalog.ts) does not name \`${category}/${skill}\`, so \`keryx skills install\` never copies this directory and no user ever sees it.`);
     }
@@ -57726,35 +58021,15 @@ function evaluateBundledTree(root = defaultBundledRoot()) {
     for (const offender of homePathOffenders(text)) {
       add("path:personal-home", offender.line, offender.why);
     }
-    text.split(`
-`).forEach((line, index) => {
-      for (const pattern of SKILL_REFERENCE_PATTERNS) {
-        for (const match of line.matchAll(pattern)) {
-          const referenced = match[1];
-          if (!referenced.includes("-"))
-            continue;
-          if (known.has(referenced))
-            continue;
-          if (KNOWN_EXTERNAL_SKILL_REFERENCES.has(referenced))
-            continue;
-          add("xref:skill", index + 1, `names a skill \`${referenced}\` that this tree does not ship; either bundle it or stop naming it.`);
-        }
-      }
-      for (const match of line.matchAll(PATH_REFERENCE)) {
-        const raw = match[1];
-        if (raw.includes("<") || raw.includes("*") || raw.includes("$"))
-          continue;
-        const normalised = normaliseReferencePath(raw);
-        if (normalised === undefined)
-          continue;
-        if (GENERATED_PATH_ROOTS.some((entry) => normalised === entry.prefix.replace(/\/$/, "") || normalised.startsWith(entry.prefix))) {
-          continue;
-        }
-        if (existsSync24(path143.join(root, normalised)))
-          continue;
-        add("xref:path", index + 1, `path \`${raw}\` resolves to nothing under the shipped tree (looked for \`${normalised}\`).`);
-      }
-    });
+    scanCrossReferences(text, root, known, true, add);
+  }
+  for (const file of bundledRuleFiles(root)) {
+    const rel = path143.relative(root, file).split(path143.sep).join("/");
+    const text = readFileSync6(file, "utf8");
+    const add = (check, line, message) => {
+      findings.push({ check, skill: path143.basename(file, path143.extname(file)), file: rel, line, message });
+    };
+    scanCrossReferences(text, root, known, false, add);
   }
   for (const dir of [...new Set(files.map((file) => path143.dirname(file)))].sort()) {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
@@ -57878,6 +58153,12 @@ async function skillsCommand(args) {
     note(`skills   ${relativeToCwd(result.skillsRoot)}`);
     note(`catalog  ${relativeToCwd(result.catalogPath)}`);
     note(`manifest ${relativeToCwd(result.manifestPath)}`);
+    if (result.warnings.length > 0) {
+      console.log("Warnings:");
+      for (const warning of result.warnings) {
+        console.log(`- ${warning}`);
+      }
+    }
     nextSteps([
       `Browse the catalog: ${style.cyan("keryx skills catalog")}.`,
       `Route a request: ${style.cyan("keryx skills route <target>")}.`
@@ -64758,14 +65039,17 @@ init_pr_comments();
 init_loop();
 
 // src/review/stack.ts
-var STACK_TAGS = ["nestjs", "react", "mobx", "prisma"];
+var STACK_TAGS = ["nestjs", "react", "mobx", "prisma", "playwright", "sql", "http-server"];
 function isStackTag(value) {
   return STACK_TAGS.includes(value);
 }
 var TAG_MARKERS = {
   react: ["react", "react-dom"],
   mobx: ["mobx", "mobx-react", "mobx-react-lite"],
-  prisma: ["prisma", "@prisma/client"]
+  prisma: ["prisma", "@prisma/client"],
+  playwright: ["@playwright/test", "playwright"],
+  sql: ["prisma", "@prisma/client", "typeorm", "sequelize", "knex", "drizzle-orm", "pg", "mysql2", "better-sqlite3", "kysely"],
+  "http-server": ["express", "fastify", "koa", "hono", "@nestjs/core", "@hapi/hapi"]
 };
 var DEPENDENCY_FIELDS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
 async function detectProjectStack(cwd, options = {}) {
@@ -68127,14 +68411,14 @@ init_fs();
 init_json();
 
 // src/security/detect/mcp.ts
-import { createHash as createHash29 } from "crypto";
+import { createHash as createHash30 } from "crypto";
 function hashToolDefinition(tool) {
   const canonical = JSON.stringify({
     name: tool.name,
     description: tool.description ?? "",
     inputSchema: tool.inputSchema ?? null
   });
-  return createHash29("sha256").update(canonical).digest("hex");
+  return createHash30("sha256").update(canonical).digest("hex");
 }
 var POISONING_PATTERNS = [
   {
@@ -69236,7 +69520,7 @@ function wrapBwrap(command, profile, launcherPath = BWRAP_PROGRAM) {
 }
 
 // src/harness/process/sandbox/adapter.ts
-import { createHash as createHash30 } from "crypto";
+import { createHash as createHash31 } from "crypto";
 
 // src/harness/process/sandbox/wrap.ts
 function wrapWithSandbox(command, profile, opts) {
@@ -69266,7 +69550,7 @@ function wrapWithSandbox(command, profile, opts) {
 function spawnError(command, message) {
   return {
     kind: "spawn-error",
-    observedHash: createHash30("sha256").update(`${command.path}
+    observedHash: createHash31("sha256").update(`${command.path}
 ${command.argv.join(" ")}`, "utf8").digest("hex"),
     errorMessage: message
   };
@@ -71455,7 +71739,7 @@ async function closeServers(states) {
 
 // src/mcp-servers/trust.ts
 init_config_dir();
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 import path166 from "path";
 function trustFile(configDir) {
   return path166.join(configDir ?? ensureKeryxConfigDir(), "mcp-servers-trust.json");
@@ -71470,7 +71754,7 @@ function serverFingerprint(server) {
     headers: sortedKeys(server.headers),
     bearer_token_env_var: server.bearer_token_env_var ?? null
   });
-  return createHash31("sha256").update(material).digest("hex").slice(0, 32);
+  return createHash32("sha256").update(material).digest("hex").slice(0, 32);
 }
 function sortedKeys(values) {
   return Object.entries(values ?? {}).sort(([a], [b]) => a.localeCompare(b));
@@ -72369,7 +72653,7 @@ function resolveInteractive(explicit, stdin, stdout) {
 function bothStreamsAreATerminal(stdin, stdout) {
   return stdin.isTTY === true && stdout.isTTY === true;
 }
-function openAuthorisationUrl(url, log, platform = process.platform, env = process.env) {
+function openAuthorisationUrl(url, log, platform = process.platform, env = process.env, open = openVerificationUrl) {
   const plan = browserOpenPlan(url.toString(), platform, env);
   if (plan === undefined) {
     log("No graphical session detected, so nothing was opened.");
@@ -72379,7 +72663,7 @@ function openAuthorisationUrl(url, log, platform = process.platform, env = proce
 `);
     return;
   }
-  openVerificationUrl(url.toString());
+  open(url.toString(), { platform, env });
 }
 function removeCommand(args, deps) {
   const own = splitAtSeparator(args).own;
@@ -72779,17 +73063,17 @@ init_sac();
 init_workspace_service();
 init_store2();
 init_fs();
-import { createHash as createHash34, randomUUID as randomUUID17 } from "crypto";
+import { createHash as createHash35, randomUUID as randomUUID17 } from "crypto";
 import { appendFile as appendFile7, mkdir as mkdir58, open as open2, readFile as readFile93, rename as rename7, rm as rm12, stat as stat16, writeFile as writeFile50 } from "fs/promises";
 import path170 from "path";
 
 // src/sac/policy-experiment.ts
-import { createHash as createHash33, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash34, createHmac as createHmac2 } from "crypto";
 
 // src/sac/receipt-integrity.ts
 init_sac();
-import { createHash as createHash32 } from "crypto";
-var sha2563 = (value) => createHash32("sha256").update(value, "utf8").digest("hex");
+import { createHash as createHash33 } from "crypto";
+var sha2563 = (value) => createHash33("sha256").update(value, "utf8").digest("hex");
 function bodyOf(receipt) {
   const { integrity: _integrity, ...body } = receipt;
   return body;
@@ -72846,7 +73130,7 @@ function stableValue(value) {
   return value;
 }
 var stableJson2 = (value) => JSON.stringify(stableValue(value));
-var sha2564 = (value) => createHash33("sha256").update(stableJson2(value), "utf8").digest("hex");
+var sha2564 = (value) => createHash34("sha256").update(stableJson2(value), "utf8").digest("hex");
 var workspacePathPattern2 = /^\.\/(?!.*(?:^|\/)\.\.(?:\/|$))(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
 var trustedOutcomes = new WeakMap;
 var trustedSandboxEvidence = new WeakMap;
@@ -72866,7 +73150,7 @@ function policyCorpusDigest(manifest, rows, quarantine) {
 function splitFor(receiptHash, outcome, split) {
   if (outcome.caseClass === "adversarial")
     return "adversarial";
-  const byte = Number.parseInt(createHash33("sha256").update(`${split.seed}\x00${receiptHash}`).digest("hex").slice(0, 2), 16);
+  const byte = Number.parseInt(createHash34("sha256").update(`${split.seed}\x00${receiptHash}`).digest("hex").slice(0, 2), 16);
   return byte / 256 * 100 < split.holdoutPercent ? "holdout" : "train";
 }
 function quarantineCounts(entries) {
@@ -72950,12 +73234,12 @@ var stableValue2 = (value) => {
   return value;
 };
 var stableJson3 = (value) => JSON.stringify(stableValue2(value));
-var sha2565 = (value) => createHash34("sha256").update(stableJson3(value), "utf8").digest("hex");
+var sha2565 = (value) => createHash35("sha256").update(stableJson3(value), "utf8").digest("hex");
 var isImmutableVersion2 = (value) => typeof value === "string" && value.length >= 3 && value.length <= 256 && /^[A-Za-z0-9][A-Za-z0-9._:+-]*$/.test(value) && /\d/.test(value) && !immutableVersionPattern.test(value);
 var receiptHashPattern2 = /^[a-f0-9]{64}$/;
 var ledgerDigestChunkBytes = 64 * 1024;
 var isMissing = (error) => error instanceof Error && error.code === "ENOENT";
-var checkpointHash = (body) => createHash34("sha256").update(JSON.stringify(body), "utf8").digest("hex");
+var checkpointHash = (body) => createHash35("sha256").update(JSON.stringify(body), "utf8").digest("hex");
 async function ledgerByteLength(ledger) {
   const value = await stat16(ledger, { bigint: true });
   if (value.size > BigInt(Number.MAX_SAFE_INTEGER))
@@ -72963,7 +73247,7 @@ async function ledgerByteLength(ledger) {
   return Number(value.size);
 }
 async function digestLedgerPrefix(handle, byteLength) {
-  const digest = createHash34("sha256");
+  const digest = createHash35("sha256");
   if (byteLength === 0)
     return digest;
   const buffer = Buffer.alloc(Math.min(ledgerDigestChunkBytes, byteLength));
@@ -73087,7 +73371,7 @@ async function auditLedger(ledger, checkpointPath, verifier) {
   const verification = await verifier(receipts);
   if (!verification.ok)
     throw new Error(`invalid access receipt ledger: ${verification.reason} at record ${verification.firstInvalidIndex}`);
-  const digest = createHash34("sha256").update(bytes);
+  const digest = createHash35("sha256").update(bytes);
   const tailOffset = receipts.length === 0 ? 0 : bytes.lastIndexOf(10, bytes.length - 2) + 1;
   const state = { ledgerBytes: bytes.length, recordCount: receipts.length, headHash: verification.headHash, tailOffset, digest };
   await writeCheckpoint(checkpointPath, { schemaVersion: "1.1", ledgerBytes: state.ledgerBytes, recordCount: state.recordCount, headHash: state.headHash, tailOffset, contentDigest: digest.copy().digest("hex") });
@@ -73103,7 +73387,7 @@ async function resolveLedgerState(ledger, checkpointPath, verifier) {
       throw error;
     if (document.present)
       throw new Error("invalid access receipt ledger: orphaned-checkpoint");
-    return { ledgerBytes: 0, recordCount: 0, headHash: "GENESIS", tailOffset: 0, digest: createHash34("sha256") };
+    return { ledgerBytes: 0, recordCount: 0, headHash: "GENESIS", tailOffset: 0, digest: createHash35("sha256") };
   }
   if (document.checkpoint) {
     const fast = await fastCheckpointState(ledger, document.checkpoint, ledgerBytes);
@@ -73122,7 +73406,7 @@ var isConfigRecord = (value) => typeof value.enabled === "boolean" && typeof val
 async function readPinnedJson(input) {
   const ref = await resolveWorkspaceReference({ workspaceRoot: input.workspaceRoot, kind: "artifact", uri: input.uri });
   const raw = await readFile93(ref, "utf8");
-  const digest = createHash34("sha256").update(raw).digest("hex");
+  const digest = createHash35("sha256").update(raw).digest("hex");
   if (digest !== input.digest)
     throw new Error("policy experiment pinned artifact digest mismatch");
   return { artifact: JSON.parse(raw), digest };
@@ -73552,7 +73836,7 @@ function createLocalFwkReadService(cwd, opts) {
       const facts = await Promise.all(manifest.resources.filter((resource) => resource.kind === "evidence").map(async (resource, index) => {
         try {
           const raw = await workspaces.readResourceForActor({ actorContext, workspaceId, resource });
-          const revision = createHash34("sha256").update(raw).digest("hex");
+          const revision = createHash35("sha256").update(raw).digest("hex");
           return { id: `fact-${index}`, uri: resource.uri, revision: resource.revision ?? revision, observedAt: manifest.updatedAt, expiresAt: "9999-12-31T23:59:59Z", trust: "primary", visible: true, statement: `Evidence reference ${resource.uri}`, status: resource.revision === revision || resource.revision === undefined ? "fresh" : "stale" };
         } catch (error) {
           withhold(error);
@@ -73562,7 +73846,7 @@ function createLocalFwkReadService(cwd, opts) {
       const knowHow = await Promise.all(manifest.resources.filter((resource) => resource.kind === "wiki" || resource.kind === "memory" || resource.kind === "skill").map(async (resource, index) => {
         try {
           const raw = await workspaces.readResourceForActor({ actorContext, workspaceId, resource, encoding: "utf8" });
-          const revision = createHash34("sha256").update(raw).digest("hex");
+          const revision = createHash35("sha256").update(raw).digest("hex");
           const accepted = /^Status:\s*(accepted|reviewed)\s*$/mi.test(raw);
           return { id: `knowhow-${index}`, kind: resource.kind, uri: resource.uri, revision: resource.revision ?? revision, trust: "accepted", status: resource.revision === revision || resource.revision === undefined ? "fresh" : "stale", accepted, visible: true };
         } catch (error) {
@@ -74381,7 +74665,7 @@ function buildToolRegistry() {
 init_fs();
 init_contained_read();
 import path173 from "path";
-import { lstat as lstat4, readdir as readdir32, realpath as realpath7, stat as stat17 } from "fs/promises";
+import { lstat as lstat5, readdir as readdir32, realpath as realpath7, stat as stat17 } from "fs/promises";
 var URI_PREFIX = "metaproject://";
 function mimeForPath(filePath) {
   if (filePath.endsWith(".json") || filePath.endsWith(".jsonl")) {
@@ -74406,7 +74690,7 @@ async function walkFiles(root, ownerRoot = root, ancestors = new Set) {
   if (!await pathExists(root)) {
     return [];
   }
-  const ownerInfo = await lstat4(ownerRoot).catch(() => null);
+  const ownerInfo = await lstat5(ownerRoot).catch(() => null);
   if (!ownerInfo || !ownerInfo.isDirectory() || ownerInfo.isSymbolicLink())
     return [];
   const ownerReal = await realpath7(ownerRoot).catch(() => null);
@@ -74942,7 +75226,7 @@ init_make_provider();
 init_profiles();
 
 // src/harness/run/run.ts
-import { createHash as createHash38 } from "crypto";
+import { createHash as createHash39 } from "crypto";
 
 // src/harness/completion/gate.ts
 var SCHEMA_VERSION3 = 1;
@@ -74993,10 +75277,10 @@ function evaluateCompletion(input, deps) {
 }
 
 // src/harness/evidence/redaction.ts
-import { createHash as createHash35 } from "crypto";
+import { createHash as createHash36 } from "crypto";
 var CLEAN_CATEGORY = "none";
 function hashContent(content) {
-  return createHash35("sha256").update(content, "utf8").digest("hex");
+  return createHash36("sha256").update(content, "utf8").digest("hex");
 }
 function redactForPersistence(content, deps) {
   const scan = deps.scan(content);
@@ -75047,7 +75331,7 @@ async function metaprojectBlastRadius(port, target) {
 }
 
 // src/harness/session/session.ts
-import { createHash as createHash36 } from "crypto";
+import { createHash as createHash37 } from "crypto";
 var SCHEMA_VERSION4 = 1;
 function canonicalStringify(value) {
   if (Array.isArray(value)) {
@@ -75061,7 +75345,7 @@ function canonicalStringify(value) {
   return JSON.stringify(value) ?? "null";
 }
 function sha2566(input) {
-  return createHash36("sha256").update(input, "utf8").digest("hex");
+  return createHash37("sha256").update(input, "utf8").digest("hex");
 }
 function deepFreeze(value) {
   if (value !== null && typeof value === "object") {
@@ -75153,11 +75437,11 @@ class AppendOnlySession {
 }
 
 // src/harness/context/manifest.ts
-import { createHash as createHash37 } from "crypto";
+import { createHash as createHash38 } from "crypto";
 var MAX_CONTEXT_BYTES = 2 * 1024 * 1024;
 var MAX_CONTEXT_TOKENS = 200000;
 function sha2567(input) {
-  return createHash37("sha256").update(input, "utf8").digest("hex");
+  return createHash38("sha256").update(input, "utf8").digest("hex");
 }
 function normalizeSource2(value) {
   const record = typeof value === "object" && value !== null ? value : {};
@@ -75283,7 +75567,7 @@ function canonicalize2(value) {
   return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalize2(record[key])}`).join(",")}}`;
 }
 function sha2568(input) {
-  return createHash38("sha256").update(input, "utf8").digest("hex");
+  return createHash39("sha256").update(input, "utf8").digest("hex");
 }
 function uniqueInOrder2(values) {
   const seen = new Set;
@@ -75721,7 +76005,7 @@ function replayOffline(fixture, run, deps) {
 }
 
 // src/harness/tool/registry.ts
-import { createHash as createHash39 } from "crypto";
+import { createHash as createHash40 } from "crypto";
 function canonicalize3(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value) ?? "null";
@@ -75735,7 +76019,7 @@ function canonicalize3(value) {
   return `{${entries.join(",")}}`;
 }
 function sha2569(input) {
-  return createHash39("sha256").update(input, "utf8").digest("hex");
+  return createHash40("sha256").update(input, "utf8").digest("hex");
 }
 function definitionHash(definition) {
   return sha2569(canonicalize3(definition));
@@ -75886,11 +76170,11 @@ function runContainedProcess(input, deps) {
 
 // src/harness/process/real-process-adapter.ts
 import { spawnSync } from "child_process";
-import { createHash as createHash40 } from "crypto";
+import { createHash as createHash41 } from "crypto";
 var DEFAULT_TIMEOUT_MS = 5000;
 var DEFAULT_MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
 function sha256Hex4(input) {
-  return createHash40("sha256").update(input, "utf8").digest("hex");
+  return createHash41("sha256").update(input, "utf8").digest("hex");
 }
 function byteLength(chunk) {
   if (chunk === null || chunk === undefined)
@@ -77807,12 +78091,14 @@ function resolveShellRestrictedMasks(env, sandboxConfigDir, projectRoot) {
     tlsTerminate: result.resolution.tlsTerminate
   };
 }
-async function resolveShellEnv() {
+async function resolveShellEnv(configDir) {
   await Promise.resolve().then(() => init_shell_config());
-  applySavedApiKeys();
+  const passSaved = process.env.KERYX_SHELL_PASS_SAVED_KEYS === "1";
+  const source = passSaved ? envWithSavedApiKeys(process.env, configDir) : process.env;
+  const withheld = passSaved ? new Set : savedCredentialEnvKeys();
   const env = {};
-  for (const [key, value] of Object.entries(process.env)) {
-    if (typeof value === "string")
+  for (const [key, value] of Object.entries(source)) {
+    if (typeof value === "string" && !withheld.has(key))
       env[key] = value;
   }
   return env;
@@ -77833,7 +78119,8 @@ async function resolveShellSpawn(root, command, baseEnv, detectOpts) {
   }
   let netClose = async () => {};
   if (profile.network === "restricted") {
-    const masks = resolveShellRestrictedMasks(env, undefined, root);
+    await Promise.resolve().then(() => init_shell_config());
+    const masks = resolveShellRestrictedMasks(envWithSavedApiKeys(env), undefined, root);
     if (!masks.ok)
       return { ok: false, error: `shell_exec: ${masks.reason}` };
     const net = await setupNetworkRun(profile, {
@@ -79391,7 +79678,7 @@ init_command_risk();
 init_shell_syntax();
 import { existsSync as existsSync30 } from "fs";
 import path181 from "path";
-import { createHash as createHash41 } from "crypto";
+import { createHash as createHash42 } from "crypto";
 var PREFIX_BANNED = new Set([
   "sh",
   "bash",
@@ -79711,7 +79998,7 @@ function shellPermissionsFingerprint(dir) {
     if (!read.ok) {
       return "";
     }
-    return createHash41("sha256").update(read.text, "utf8").digest("hex");
+    return createHash42("sha256").update(read.text, "utf8").digest("hex");
   } catch {
     return "";
   }
@@ -80203,7 +80490,7 @@ function createDefaultSearchProviderController(configDir) {
   return new SearchProviderController(registry, configDir);
 }
 // src/harness/tool/builtin/spawn-subagent-tool.ts
-import { createHash as createHash42, randomUUID as randomUUID24 } from "crypto";
+import { createHash as createHash43, randomUUID as randomUUID24 } from "crypto";
 import { mkdtemp, rm as rm13 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
 import path183 from "path";
@@ -80253,7 +80540,7 @@ function readExternalRuntimeRequest(input) {
   return raw.kind === "external" ? raw : undefined;
 }
 function sha25610(text) {
-  return createHash42("sha256").update(text).digest("hex");
+  return createHash43("sha256").update(text).digest("hex");
 }
 var parentShellPolicy = shellParentProfile;
 var childReadOnlyPolicy = shellChildReadOnlyProfile;
@@ -92740,6 +93027,9 @@ function promptApiKeyStep(otui, r, opts) {
     const box = overlayBox(otui, r, "key-picker");
     r.root.add(box);
     box.add(new otui.TextRenderable(r, { id: "kp-title", content: otui.t`${otui.bold(`Paste your ${opts.label} API key`)} ${otui.dim("(Enter \xB7 Esc to go back)")}` }));
+    if (opts.notice !== undefined) {
+      box.add(new otui.TextRenderable(r, { id: "kp-notice", content: otui.t`${otui.red("\u2717")} ${opts.notice}`, marginTop: 1 }));
+    }
     box.add(new otui.TextRenderable(r, {
       id: "kp-note",
       content: otui.t`${otui.dim(`Set as ${opts.envKey} \xB7 saved to your keryx config dir (owner-only, 0600)`)}`,
@@ -92859,9 +93149,14 @@ function runDeviceLoginInTui(otui, r, provider) {
     });
   });
 }
-async function modelsForPicker(prov) {
-  const result = await resolveModelsForPicker(globalThis.fetch, prov, process.env);
-  return result.models;
+async function modelsForPicker(prov, deps = {}) {
+  return await resolveModelsForPicker(deps.fetch ?? globalThis.fetch, prov, deps.env ?? process.env);
+}
+function modelPickerNotice(label, result) {
+  if (result.models.length > 0 || result.failure === undefined) {
+    return;
+  }
+  return modelsFailureLine(label, result.failure);
 }
 function pickProviderStep(otui, r, detected) {
   return new Promise((resolve) => {
@@ -92948,44 +93243,66 @@ function selectProviderModelInTui(otui, r, detected, options = {}) {
           continue;
         }
         if (!options.onlyConnected && selectedBaseUrl !== undefined)
-          saveProviderBaseUrl(prov.name, selectedBaseUrl);
+          saveProviderBaseUrl(prov.name, selectedBaseUrl, options.configDir);
         const selectedProvider = selectedBaseUrl === undefined ? prov : { ...prov, baseUrl: selectedBaseUrl };
         const envKey = prov.envKey;
-        if (!options.onlyConnected && envKey !== undefined) {
-          const existingKey = process.env[envKey];
-          const hasOauth = oauthAccessToken(prov.name) !== undefined;
-          if ((existingKey === undefined || existingKey.length === 0) && !hasOauth) {
-            const offered = [];
-            if (catalogAllows(prov.name, "device-code"))
-              offered.push("device-code");
-            if (catalogMethods(prov.name).includes("api-key"))
-              offered.push("api-key");
-            let method = offered.length === 1 ? offered[0] : undefined;
-            if (offered.length > 1) {
-              method = await pickAuthMethodStep(otui, r, prov.label ?? prov.name, offered);
-              if (method === undefined) {
-                continue;
-              }
+        const label = prov.label ?? prov.name;
+        const collectCredential = async (notice) => {
+          if (options.onlyConnected || envKey === undefined) {
+            return "ok";
+          }
+          if (notice === undefined) {
+            const existingKey = (options.env ?? process.env)[envKey];
+            const hasOauth = oauthAccessToken(prov.name, options.configDir) !== undefined;
+            if (existingKey !== undefined && existingKey.length > 0 || hasOauth) {
+              return "ok";
             }
-            if (method === "device-code") {
-              const ok = await runDeviceLoginInTui(otui, r, prov.name);
-              if (!ok) {
-                continue;
-              }
-            } else {
-              const kr = await promptApiKeyStep(otui, r, { label: prov.label ?? prov.name, envKey });
-              if (kr.kind === "back") {
-                continue;
-              }
-              if (kr.kind === "key") {
-                process.env[envKey] = kr.value;
-                saveApiKey(envKey, kr.value);
-              }
+          }
+          const offered = [];
+          if (catalogAllows(prov.name, "device-code"))
+            offered.push("device-code");
+          if (catalogMethods(prov.name).includes("api-key"))
+            offered.push("api-key");
+          let method = offered.length === 1 ? offered[0] : undefined;
+          if (offered.length > 1) {
+            method = await pickAuthMethodStep(otui, r, label, offered);
+            if (method === undefined) {
+              return "back";
             }
           }
+          if (method === "device-code") {
+            return await runDeviceLoginInTui(otui, r, prov.name) ? "ok" : "back";
+          }
+          const kr = await promptApiKeyStep(otui, r, {
+            label,
+            envKey,
+            ...notice === undefined ? {} : { notice }
+          });
+          if (kr.kind === "back") {
+            return "back";
+          }
+          if (kr.kind === "key") {
+            process.env[envKey] = kr.value;
+            noteSavedCredentialEnv([envKey]);
+            saveApiKey(envKey, kr.value, options.configDir);
+          }
+          return "ok";
+        };
+        if (await collectCredential() === "back") {
+          continue;
+        }
+        const modelDeps = {
+          ...options.fetch === undefined ? {} : { fetch: options.fetch },
+          ...options.env === undefined ? {} : { env: options.env }
+        };
+        let models = await modelsForPicker(selectedProvider, modelDeps);
+        if (models.failure?.kind === "rejected") {
+          if (await collectCredential(modelsFailureLine(label, models.failure)) === "back") {
+            continue;
+          }
+          models = await modelsForPicker(selectedProvider, modelDeps);
         }
-        const models = await modelsForPicker(selectedProvider);
-        const model = await pickModelInTui(otui, r, models);
+        const model = await pickModelInTui(otui, r, models.models, modelPickerNotice(label, models));
         if (model === undefined) {
           continue;
         }
@@ -92999,13 +93316,16 @@ function adaptiveSelectHeight(count, available, per = 1) {
   const min = Math.max(1, Math.floor(available / 4));
   return Math.min(available, Math.max(min, count * per));
 }
-function pickModelInTui(otui, r, models) {
+function pickModelInTui(otui, r, models, notice) {
   return new Promise((resolve) => {
     const all = models;
-    const NO_MODELS = "(no models found)";
+    const NO_MODELS = notice ?? "(no models found)";
     const box = overlayBox(otui, r, "model-picker");
     r.root.add(box);
     box.add(new otui.TextRenderable(r, { id: "mp-title", content: otui.t`${otui.bold("Select a model")}` }));
+    if (all.length === 0 && notice !== undefined) {
+      box.add(new otui.TextRenderable(r, { id: "mp-notice", content: otui.t`${otui.red("\u2717")} ${notice}` }));
+    }
     const filterLine = new otui.TextRenderable(r, { id: "mp-filter", content: otui.t`${otui.dim("type to filter \xB7 \u2191/\u2193 Enter \xB7 Esc to go back")}` });
     box.add(filterLine);
     const NO_MATCH = "(no match)";
@@ -95101,8 +95421,9 @@ ${formatThemeList(getThemeId())}`);
           (async () => {
             const detected = opts.redetect !== undefined ? await opts.redetect() : opts.detected;
             const prov = detected.find((d) => d.name === currentSel.provider);
-            const models = prov !== undefined ? await modelsForPicker(prov) : [];
-            const chosen = await chrome.withOverlay(() => pickModelInTui(otui, r, models));
+            const models = prov !== undefined ? await modelsForPicker(prov) : undefined;
+            const notice = prov === undefined || models === undefined ? undefined : modelPickerNotice(prov.label ?? prov.name, models);
+            const chosen = await chrome.withOverlay(() => pickModelInTui(otui, r, models?.models ?? [], notice));
             if (chosen !== undefined) {
               await switchTo(currentSel.baseUrl === undefined ? { provider: currentSel.provider, model: chosen } : { provider: currentSel.provider, model: chosen, baseUrl: currentSel.baseUrl });
               try {
@@ -95777,7 +96098,8 @@ async function launchTuiChatShell(opts) {
           return await selectProviderModelInTui(otui, r, detected);
         }
         const prov = detected.find((d) => d.name === only);
-        const chosen = await pickModelInTui(otui, r, prov !== undefined ? await modelsForPicker(prov) : []);
+        const models = prov === undefined ? undefined : await modelsForPicker(prov);
+        const chosen = await pickModelInTui(otui, r, models?.models ?? [], prov === undefined || models === undefined ? undefined : modelPickerNotice(prov.label ?? prov.name, models));
         if (chosen === undefined) {
           return;
         }
@@ -96167,17 +96489,19 @@ function oauthCredentialsFor(name) {
 }
 function realSelectProviderModel(baseUrl) {
   return async (io, opts) => {
+    const env = envWithSavedApiKeys(process.env);
     const detected = await detectProviders({
       fetch: globalThis.fetch,
-      env: process.env,
+      env,
       platform: process.platform,
       ...baseUrl !== undefined ? { baseUrl } : {}
     });
     const filtered = opts?.onlyProvider !== undefined ? detected.filter((d) => d.name === opts.onlyProvider) : detected;
     const list = filtered.length > 0 ? filtered : detected;
-    return pickProviderModel(io, list, { fetch: globalThis.fetch, env: process.env });
+    return pickProviderModel(io, list, { fetch: globalThis.fetch, env });
   };
 }
+var GRANT_REFRESH_TIMEOUT_MS = 5000;
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var PROMPT_MARK = "\u276F ";
 var GUTTER = "  ";
@@ -97051,14 +97375,6 @@ ${GUTTER}${turnSeparator()}
 }
 async function resolveTuiStartup(opts) {
   const savedCfg = loadShellConfig(opts.configDir);
-  await Promise.resolve().then(() => init_login());
-  const oauthFetch = (input, init) => globalThis.fetch(input, init);
-  await refreshProviderGrant("grok", { fetch: oauthFetch }, opts.configDir).catch(() => {
-    return;
-  });
-  await refreshProviderGrant("github-copilot", { fetch: oauthFetch }, opts.configDir).catch(() => {
-    return;
-  });
   const appliedKeys = applySavedApiKeys(opts.configDir);
   const { providerArg, modelArg, baseUrl } = opts;
   if (providerArg !== undefined && modelArg !== undefined) {
@@ -97237,6 +97553,15 @@ Example: keryx shell --provider ollama --model llama3.1:latest`);
   const modelArg = flags.modelArg;
   let baseUrl = flags.baseUrl;
   let modeFlag = flags.modeFlag;
+  {
+    await Promise.resolve().then(() => init_login());
+    const oauthFetch = (input, init) => globalThis.fetch(input, init);
+    const http = { fetch: oauthFetch, signal: AbortSignal.timeout(GRANT_REFRESH_TIMEOUT_MS) };
+    const warnings = await refreshSavedGrants(http, runtime.cacheDir, providerArg === undefined ? undefined : [providerArg]);
+    for (const warning of warnings)
+      process.stderr.write(`keryx: ${warning}
+`);
+  }
   const surface = chooseShellSurface(flags, runtime.isTty ?? process.stdout.isTTY === true);
   if (surface !== "readline") {
     const cwd = process.cwd();
@@ -97862,7 +98187,7 @@ init_serve_config();
 
 // src/lib/serve-credential.ts
 init_config_dir();
-import { createHash as createHash43, randomBytes as randomBytes5, randomUUID as randomUUID30 } from "crypto";
+import { createHash as createHash44, randomBytes as randomBytes5, randomUUID as randomUUID30 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync3,
@@ -97889,10 +98214,10 @@ function constantTimeEqual(a, b) {
   return difference === 0;
 }
 function hashToken(salt, token) {
-  return createHash43("sha256").update(Buffer.from(salt, "hex")).update(Buffer.from(token, "utf8")).digest("hex");
+  return createHash44("sha256").update(Buffer.from(salt, "hex")).update(Buffer.from(token, "utf8")).digest("hex");
 }
 function credentialFingerprint(record) {
-  return createHash43("sha256").update(`keryx-serve-fingerprint:${record.hash}`).digest("hex").slice(0, 8);
+  return createHash44("sha256").update(`keryx-serve-fingerprint:${record.hash}`).digest("hex").slice(0, 8);
 }
 function isValidRecord(value) {
   if (typeof value !== "object" || value === null) {
@@ -98108,7 +98433,7 @@ class AuthFailureThrottle {
 
 // src/lib/serve-turn-store.ts
 init_config_dir();
-import { createHash as createHash44 } from "crypto";
+import { createHash as createHash45 } from "crypto";
 import { existsSync as existsSync34, readdirSync as readdirSync3, rmSync as rmSync2 } from "fs";
 import path193 from "path";
 var MAX_TURN_EVENTS = 1e4;
@@ -98120,11 +98445,11 @@ function turnDir(turnId, dir) {
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
-  const digest = createHash44("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
+  const digest = createHash45("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
   return path193.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
-  const digest = createHash44("sha256").update(idempotencyKey, "utf8").digest("hex");
+  const digest = createHash45("sha256").update(idempotencyKey, "utf8").digest("hex");
   return path193.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
@@ -99480,6 +99805,12 @@ async function updateCommand(args = []) {
   if (summary.modules.sac) {
     statusLine("sac", true, "shared agent context: cross-session workspace propose/review (opt-in)");
   }
+  if (summary.gdskillsWarnings.length > 0) {
+    heading("Warnings");
+    for (const warning of summary.gdskillsWarnings) {
+      note(warning);
+    }
+  }
   const steps = [];
   if (options.hooks) {
     await runPostUpdateHooks(projectRoot);
@@ -99637,8 +99968,10 @@ async function refreshServiceFiles(projectRoot, options) {
     await writeTextIfMissing4(path195.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
     await writeTextIfChanged4(path195.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
+  let gdskillsWarnings = [];
   if (enableGdskills) {
-    await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
+    const gdskillsInstallResult = await installGdskills(metaprojectRoot, gdskillsProfile, { createDataDirs: false });
+    gdskillsWarnings = gdskillsInstallResult.warnings;
     if (manifest.modules?.gdskills?.hooks?.gitPostCommit) {
       await installManagedHook2(projectRoot, "post-commit", "gdskills-post-commit", renderGdskillsPostCommitHook());
     }
@@ -99738,6 +100071,7 @@ async function refreshServiceFiles(projectRoot, options) {
       sac: enableSac
     },
     gdskillsProfile,
+    gdskillsWarnings,
     backfilledTasks: backfillTasks,
     recoveredManifest
   };