@mrciphersmith/keryx 0.3.16 → 0.3.18

package/dist/cli.js

@@ -5275,10 +5275,14 @@ function configuredProviders(env = process.env, dir) {
 }
 async function providersCommand(args, deps = {}) {
   const command = args[0];
-  if (!command || command === "--help" || command === "-h") {
+  if (command === "--help" || command === "-h") {
     printProvidersHelp();
     return;
   }
+  if (!command) {
+    await runProvidersStatus([], deps);
+    return;
+  }
   if (command === "list") {
     runProvidersList(args.slice(1));
     return;
@@ -17637,7 +17641,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.16",
+    version: "0.3.18",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -28951,7 +28955,7 @@ function retryableFor2(kind, fallback) {
   const concrete = defaultRetryable(kind);
   return concrete === undefined ? fallback : concrete;
 }
-function mergeUsage2(promptTokens, completionTokens, totalTokens) {
+function mergeUsage2(promptTokens, completionTokens, totalTokens, cacheReadTokens) {
   const usage = { exact: true };
   if (promptTokens !== undefined) {
     usage.inputTokens = promptTokens;
@@ -28964,6 +28968,9 @@ function mergeUsage2(promptTokens, completionTokens, totalTokens) {
   } else if (promptTokens !== undefined || completionTokens !== undefined) {
     usage.totalTokens = (promptTokens ?? 0) + (completionTokens ?? 0);
   }
+  if (cacheReadTokens !== undefined) {
+    usage.cacheReadTokens = cacheReadTokens;
+  }
   return usage;
 }
 function classifyHttpError2(status, headers, code) {
@@ -29390,6 +29397,14 @@ ${message.content}` });
         }
         return "idx:0";
       };
+      const pendingToolCallStillAccumulating = () => {
+        for (const acc of pendingTools.values()) {
+          if (!acc.ended) {
+            return acc.id;
+          }
+        }
+        return;
+      };
       const flushPendingToolEnds = () => {
         for (const acc of pendingTools.values()) {
           if (acc.ended) {
@@ -29483,7 +29498,7 @@ ${message.content}` });
               const usage = asRecord4(data.usage);
               bodies.push({
                 kind: "usage_update",
-                usage: mergeUsage2(asNumber3(usage.prompt_tokens), asNumber3(usage.completion_tokens), asNumber3(usage.total_tokens))
+                usage: mergeUsage2(asNumber3(usage.prompt_tokens), asNumber3(usage.completion_tokens), asNumber3(usage.total_tokens), asNumber3(asRecord4(usage.prompt_tokens_details).cached_tokens))
               });
             }
             const choice0 = asRecord4(asArray(data.choices)[0]);
@@ -29596,6 +29611,7 @@ ${message.content}` });
           parser.push(trailing);
         }
         const torn = parser.flush();
+        const pendingToolCallId = pendingToolCallStillAccumulating();
         if (torn.length > 0) {
           malformed = {
             kind: "malformed",
@@ -29608,8 +29624,14 @@ ${message.content}` });
             retryable: retryableFor2("malformed", false),
             message: "empty response body"
           };
+        } else if (pendingToolCallId !== undefined) {
+          malformed = {
+            kind: "malformed",
+            retryable: retryableFor2("malformed", false),
+            message: `${this.label} SSE stream ended while a tool call was still accumulating`,
+            detail: { pendingToolCallId }
+          };
         } else {
-          flushPendingToolEnds();
           if (sawStart && sawFinish) {
             flushThinkTagParser();
             flushFieldTagStripper();
@@ -30268,6 +30290,16 @@ class GeminiProvider {
             break;
           }
           const chunk = asRecord5(parsed);
+          const errorEnvelope = asRecord5(chunk.error);
+          if (Object.keys(errorEnvelope).length > 0) {
+            const classified = classifyGeminiError(asNumber4(errorEnvelope.code) ?? 0, asString4(errorEnvelope.status));
+            const envelopeMessage = asString4(errorEnvelope.message);
+            malformed = {
+              ...classified,
+              message: redact(envelopeMessage !== undefined && envelopeMessage.length > 0 ? envelopeMessage : "Gemini stream carried an in-band error envelope")
+            };
+            break;
+          }
           if (!sawFirstChunk) {
             sawFirstChunk = true;
             bodies.push({ kind: "model_start" });
@@ -30291,7 +30323,7 @@ class GeminiProvider {
                 bodies.push({ kind: "text_delta", text });
               }
             } else if (callName !== undefined) {
-              const callId = asString4(functionCall.id) ?? callName;
+              const callId = asString4(functionCall.id) ?? `${callName}#${functionCallIndexInRound}`;
               const argsInput = JSON.stringify(asRecord5(functionCall.args));
               bodies.push({ kind: "tool_call_start", toolCallId: callId, toolName: callName });
               bodies.push({ kind: "tool_call_end", toolCallId: callId, input: argsInput });
@@ -30508,7 +30540,7 @@ function retryableFor4(kind, fallback) {
   const concrete = defaultRetryable(kind);
   return concrete === undefined ? fallback : concrete;
 }
-function mergeUsage4(inputTokens, outputTokens, totalTokens) {
+function mergeUsage4(inputTokens, outputTokens, totalTokens, cacheReadTokens) {
   const usage = { exact: true };
   if (inputTokens !== undefined) {
     usage.inputTokens = inputTokens;
@@ -30521,6 +30553,9 @@ function mergeUsage4(inputTokens, outputTokens, totalTokens) {
   } else if (inputTokens !== undefined || outputTokens !== undefined) {
     usage.totalTokens = (inputTokens ?? 0) + (outputTokens ?? 0);
   }
+  if (cacheReadTokens !== undefined) {
+    usage.cacheReadTokens = cacheReadTokens;
+  }
   return usage;
 }
 function extractErrorFields(data) {
@@ -30938,9 +30973,10 @@ class OpenAiProvider {
               const outputTokens = asNumber5(usage.output_tokens);
               const totalTokens = asNumber5(usage.total_tokens);
               const reasoningTokens = asNumber5(asRecord6(usage.output_tokens_details).reasoning_tokens);
+              const cacheReadTokens = asNumber5(asRecord6(usage.input_tokens_details).cached_tokens);
               const usageBody = {
                 kind: "usage_update",
-                usage: mergeUsage4(inputTokens, outputTokens, totalTokens)
+                usage: mergeUsage4(inputTokens, outputTokens, totalTokens, cacheReadTokens)
               };
               if (reasoningTokens !== undefined) {
                 usageBody.unknownExtensions = { "openai.reasoning_tokens": reasoningTokens };
@@ -34739,6 +34775,23 @@ function tokenize(text) {
 function tokenSet(text) {
   return new Set(tokenize(text));
 }
+function stem(token) {
+  let base = token;
+  if (base.length >= 6 && base.endsWith("ies")) {
+    base = `${base.slice(0, -3)}y`;
+  } else {
+    for (const suffix of ["ing", "edly", "ed", "es", "s"]) {
+      if (base.length - suffix.length >= 3 && base.endsWith(suffix)) {
+        base = base.slice(0, base.length - suffix.length);
+        break;
+      }
+    }
+  }
+  if (base.length >= 4 && base.endsWith("e")) {
+    base = base.slice(0, -1);
+  }
+  return base;
+}
 function jaccard(a, b) {
   if (a.size === 0 || b.size === 0) {
     return 0;
@@ -35296,7 +35349,7 @@ var init_ingest = __esm(() => {
 function searchEntries(entries, query, filters, config, now) {
   validateQuery(query);
   validateSearchFilters(filters, now);
-  const queryTokens = [...new Set(tokenize(query))];
+  const queryTokens = [...new Set(tokenize(query).map(stem))];
   const today = now.toISOString().slice(0, 10);
   const filtered = entries.filter((entry) => matchesFilters(entry, filters) && classMatch(entry, filters.class) && temporalMatch(entry, filters.asOf ?? null, config, today, Boolean(filters.status)));
   const scored = filtered.map((entry) => scoreEntry(entry, queryTokens, filters, config, now));
@@ -35305,7 +35358,7 @@ function searchEntries(entries, query, filters, config, now) {
 function candidatePool(entries, query, filters, config, now, k) {
   validateQuery(query);
   validateSearchFilters(filters, now);
-  const queryTokens = [...new Set(tokenize(query))];
+  const queryTokens = [...new Set(tokenize(query).map(stem))];
   const today = now.toISOString().slice(0, 10);
   return entries.filter((entry) => matchesFilters(entry, filters) && classMatch(entry, filters.class) && temporalMatch(entry, filters.asOf ?? null, config, today, Boolean(filters.status))).map((entry) => scoreEntry(entry, queryTokens, filters, config, now)).sort((a, b) => b.score - a.score).slice(0, Math.min(MAX_GENERAL_RESULTS, Math.max(0, k)));
 }
@@ -35356,8 +35409,8 @@ function temporalMatch(entry, asOf, config, today, hasStatusFilter) {
   }, new Date(`${today}T00:00:00.000Z`)).current;
 }
 function scoreEntry(entry, queryTokens, filters, config, now) {
-  const bodyTokens = tokenSet(`${entry.title} ${entry.summary} ${entry.details} ${entry.tags.join(" ")}`);
-  const titleTokens = tokenSet(entry.title);
+  const bodyTokens = new Set([...tokenSet(`${entry.title} ${entry.summary} ${entry.details} ${entry.tags.join(" ")}`)].map(stem));
+  const titleTokens = new Set([...tokenSet(entry.title)].map(stem));
   let hits = 0;
   let titleHits = 0;
   for (const token of queryTokens) {
@@ -36214,6 +36267,7 @@ var init_service5 = __esm(() => {
   init_harness_identity();
   init_embedding();
   init_types3();
+  init_embedding();
 });
 
 // src/wiki/ask.ts
@@ -39595,6 +39649,7 @@ var init_service7 = __esm(() => {
   init_query();
   init_repomap();
   init_affected_report();
+  init_staleness();
   UnknownGraphTargetError = class UnknownGraphTargetError extends Error {
     target;
     constructor(target) {
@@ -58125,8 +58180,10 @@ async function runAgentTurn(io, deps, history, userLine, options = {}) {
 
 ${buildControlMarkerInstruction(controlNonce)}`
   };
+  const caughtToolErrors = [];
   try {
-    const result = await runAgentTurnCore(io, turnDeps, history, userLine, options);
+    const coreResult = await runAgentTurnCore(io, turnDeps, history, userLine, options, caughtToolErrors);
+    const result = caughtToolErrors.length > 0 ? { ...coreResult, caughtToolErrors } : coreResult;
     await fireStopHookBestEffort(io, deps, result);
     return result;
   } finally {
@@ -58208,7 +58265,7 @@ function computeReasoningDurationMs(startedAt, endedAt) {
   const endMs = Date.parse(endedAt);
   return !Number.isNaN(startMs) && !Number.isNaN(endMs) && endMs >= startMs ? endMs - startMs : undefined;
 }
-async function runAgentTurnCore(io, deps, history, userLine, options = {}) {
+async function runAgentTurnCore(io, deps, history, userLine, options = {}, caughtToolErrors = []) {
   const now = deps.now ?? (() => new Date().toISOString());
   const controlNonce = deps.controlNonce ?? generateControlNonce();
   const scrub = (text) => scrubControlNonce(text, controlNonce);
@@ -58798,7 +58855,7 @@ ${shown.join(`
     }
     const spawnConcurrencyCandidates = calls.filter((call) => call.name === "spawn_subagent" && reservationByCallId.get(call.id)?.ok === true);
     const untrustedGateBlocksSpawns = untrustedContentSeen || batchContainsUntrustedWeb;
-    const concurrentSpawnResults = spawnConcurrencyCandidates.length >= 2 && !untrustedGateBlocksSpawns && maxToolCalls === undefined ? await runConcurrentSpawnBatch(spawnConcurrencyCandidates, toolByName, io, deps, hasInvocationCapacity, reserveInvocation, signal) : undefined;
+    const concurrentSpawnResults = spawnConcurrencyCandidates.length >= 2 && !untrustedGateBlocksSpawns && maxToolCalls === undefined ? await runConcurrentSpawnBatch(spawnConcurrencyCandidates, toolByName, io, deps, hasInvocationCapacity, reserveInvocation, signal, caughtToolErrors) : undefined;
     const answeredToolIds = new Set;
     let anchorsToAnnounce;
     let repeatedFailureHint;
@@ -58898,7 +58955,19 @@ ${shown.join(`
       if (toolByName.has(call.name)) {
         turnExecutedToolCall = true;
       }
-      const result = concurrentSpawnResults?.get(call.id) ?? await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.readOnly, io.onAutoApproved, hasInvocationCapacity, reserveInvocation, invocationBudget.maxCalls, signal, deps.busLeases, deps.hardDeny === undefined ? undefined : { check: deps.hardDeny, onDenied: io.onUnattendedDenial }, deps.hooks);
+      const precomputedResult = concurrentSpawnResults?.get(call.id);
+      let result;
+      if (precomputedResult !== undefined) {
+        result = precomputedResult;
+      } else {
+        try {
+          result = await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.readOnly, io.onAutoApproved, hasInvocationCapacity, reserveInvocation, invocationBudget.maxCalls, signal, deps.busLeases, deps.hardDeny === undefined ? undefined : { check: deps.hardDeny, onDenied: io.onUnattendedDenial }, deps.hooks);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          result = { output: `${call.name} failed: ${message}`, isError: true };
+          caughtToolErrors.push({ toolName: call.name, message });
+        }
+      }
       io.onToolResult?.(call.name, result);
       const modelOutput = redactSensitiveText(result.output);
       const untrusted = result.untrusted === true;
@@ -59348,7 +59417,7 @@ function isApprovalFor(response, fingerprint) {
   }
   return response.fingerprint === undefined || response.fingerprint === fingerprint;
 }
-async function runConcurrentSpawnBatch(spawnCalls, toolByName, io, deps, hasInvocationCapacity, reserveInvocation, signal) {
+async function runConcurrentSpawnBatch(spawnCalls, toolByName, io, deps, hasInvocationCapacity, reserveInvocation, signal, caughtToolErrors) {
   const maxConcurrency = deps.maxSubagentConcurrency ?? DEFAULT_MAX_SUBAGENT_CONCURRENCY;
   const perTaskRuntimeMs = NOMINAL_CONCURRENT_SPAWN_RUNTIME_MS;
   const tasks = spawnCalls.map((call) => ({
@@ -59375,6 +59444,7 @@ async function runConcurrentSpawnBatch(spawnCalls, toolByName, io, deps, hasInvo
           output: `subagent call ${call.id} failed: sequential fallback error: ${message}`,
           isError: true
         });
+        caughtToolErrors.push({ toolName: call.name, message });
       }
     }
     return results;
@@ -59402,6 +59472,9 @@ async function runConcurrentSpawnBatch(spawnCalls, toolByName, io, deps, hasInvo
     const results = new Map;
     for (const call of spawnCalls) {
       const settled = partialResults?.get(call.id);
+      if (settled === undefined) {
+        caughtToolErrors.push({ toolName: call.name, message });
+      }
       results.set(call.id, settled ?? {
         output: `subagent call ${call.id} failed: concurrent wave error: ${message}`,
         isError: true
@@ -60502,7 +60575,8 @@ function computeGate2(input) {
   }
   const missingOptional = sources.filter((s) => !s.required && s.status === "missing");
   for (const source of missingOptional) {
-    reasons.push(`OPTIONAL: ${source.source} source missing`);
+    const detail = source.error ? `: ${source.error}` : "";
+    reasons.push(`OPTIONAL: ${source.source} source missing${detail}`);
   }
   const brokenOptional = sources.filter((s) => !s.required && s.status === "configured-but-failed");
   if (brokenOptional.length > 0) {
@@ -62307,6 +62381,12 @@ function errorCodeSuffix(error) {
   const code = safeErrorCode(error);
   return code ? ` (${code})` : "";
 }
+function missingSourceReason(sourceId) {
+  if (sourceId === "tests") {
+    return "no `bun` binary found (checked node_modules/.bin and PATH)";
+  }
+  return;
+}
 function safeValidationError(error) {
   return error !== undefined && KNOWN_VALIDATION_ERRORS.has(error) ? error : "source output format was not recognized";
 }
@@ -62341,7 +62421,8 @@ async function runAdapter(adapter, ctx, cfg, stamp) {
     };
   }
   if (status === "skipped" || status === "missing") {
-    return { info: { ...base, status }, findings: [] };
+    const reason = missingSourceReason(adapter.id);
+    return { info: { ...base, status, ...reason !== undefined ? { error: reason } : {} }, findings: [] };
   }
   let raw;
   try {
@@ -62355,7 +62436,7 @@ async function runAdapter(adapter, ctx, cfg, stamp) {
       } catch (error) {
         if (error instanceof NoImportError) {
           if (adapter.id === "tests") {
-            return { info: { ...base, status: "missing" }, findings: [] };
+            return { info: { ...base, status }, findings: [] };
           }
           raw = await adapter.run(ctx);
         } else {
@@ -62720,6 +62801,7 @@ var init_service10 = __esm(() => {
   init_sources();
   init_util();
   init_lifecycle2();
+  init_wiki_freshness();
 });
 
 // src/flow/machine.ts
@@ -70731,6 +70813,7 @@ async function runSearch(args) {
   }
   const report = args.includes("--save-report") ? await getService().writeReport({ cwd: process.cwd(), search: result, filters }) : undefined;
   const removalTrail = result.results.length === 0 ? searchRemovals(await loadDeletionTrail(process.cwd()), query) : null;
+  const semanticHint = result.results.length === 0 && !filters.semantic ? await loadEmbeddingIndex(process.cwd()) !== null ? "Zero hits in lexical mode. An embeddings index exists for this project \u2014 try `--semantic`." : "Zero hits in lexical mode. No embeddings index exists yet \u2014 build one with `keryx memory index --embeddings`, then retry with `--semantic`." : undefined;
   const asOfMode = Boolean(filters.asOf);
   const now = new Date;
   const historicalByPath = new Map;
@@ -70759,11 +70842,16 @@ async function runSearch(args) {
         };
       }),
       ...removalTrail ? { removalTrail } : {},
+      ...semanticHint ? { semanticHint } : {},
       ...report ? { report } : {}
     }, null, 2));
     return;
   }
   console.log(renderSearchMarkdown(query, result.results).trimEnd());
+  if (semanticHint) {
+    console.log("");
+    console.log(semanticHint);
+  }
   if (removalTrail) {
     console.log("");
     console.log("## Removal trail");
@@ -71060,6 +71148,7 @@ var init_memory = __esm(() => {
   init_config4();
   init_reflect();
   init_search();
+  init_service5();
   init_report2();
   init_lifecycle();
   init_args();
@@ -71636,7 +71725,7 @@ var init_debug_log = __esm(() => {
 // src/tui/debug-watcher.ts
 import { spawn as spawn8, spawnSync as spawnSync8 } from "child_process";
 import { closeSync as closeSync6, constants as constants4, openSync as openSync7, readdirSync as readdirSync11, readFileSync as readFileSync24, readlinkSync as readlinkSync3, statSync as statSync16 } from "fs";
-import path316 from "path";
+import path317 from "path";
 function parseEpollFdinfo(text) {
   const out = [];
   for (const line of text.split(`
@@ -71825,8 +71914,8 @@ async function runDebugWatcher(argv) {
     process.exitCode = 2;
     return;
   }
-  const logFile = path316.join(dirArg, "watcher.ndjson");
-  const shellLog = path316.join(dirArg, "shell.ndjson");
+  const logFile = path317.join(dirArg, "watcher.ndjson");
+  const shellLog = path317.join(dirArg, "shell.ndjson");
   const log = (kind, data = {}) => {
     try {
       appendOwnerOnlyLine(logFile, JSON.stringify({ ts: new Date().toISOString(), watcher: process.pid, target: pid, kind, ...data }));
@@ -107084,6 +107173,18 @@ var HELP_GROUPS = [
     summary: "Grouped command help by task \u2014 keryx help [group|command]."
   },
   { kind: "slash", name: "/help", group: "Start here", summary: "Show available commands, grouped by task." },
+  {
+    kind: "cli",
+    name: "doctor",
+    group: "Start here",
+    summary: "One-page health check: version, Bun floor, ripgrep, sandbox, providers, MCP, integrations, standard, worktrees, graph/wiki freshness."
+  },
+  {
+    kind: "slash",
+    name: "/doctor",
+    group: "Start here",
+    summary: "Same one-page health check, inside the session."
+  },
   {
     kind: "cli",
     name: "auth",
@@ -109216,6 +109317,19 @@ var COMMAND_DESCRIPTORS = [
     json: false,
     read: true
   },
+  {
+    module: "core",
+    command: "doctor",
+    summary: "One-page health check: version, Bun floor, ripgrep, sandbox, providers, MCP, integrations, standard, worktrees, graph/wiki freshness.",
+    intent: ["keryx doctor", "health check", "\u043F\u0440\u043E\u0432\u0435\u0440\u044C \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u0435", "is keryx set up correctly", "\u0434\u0438\u0430\u0433\u043D\u043E\u0441\u0442\u0438\u043A\u0430"],
+    args: [{ name: "json", type: "bool", required: false, desc: "structured {checks:[{id,status,detail,fix?}]}" }],
+    json: true,
+    read: false,
+    sideEffects: [
+      "makes an outbound HTTPS request to the npm registry as part of its version check, unless served from the local cache or failure-backoff window",
+      "writes <per-user keryx config dir>/version-check.json (outside this project) as part of that same check"
+    ]
+  },
   {
     module: "core",
     command: "status",
@@ -111307,6 +111421,49 @@ async function sandboxCommand(args = [], deps = {}) {
 init_args();
 init_ui();
 
+// src/lib/suggest.ts
+var MAX_SUGGESTIONS = 3;
+var MAX_EDIT_DISTANCE = 2;
+function levenshtein2(a, b) {
+  const rows = a.length + 1;
+  const cols = b.length + 1;
+  const dp = Array.from({ length: rows }, () => new Array(cols).fill(0));
+  for (let i = 0;i < rows; i += 1) {
+    const row = dp[i];
+    if (row !== undefined)
+      row[0] = i;
+  }
+  const first = dp[0];
+  if (first !== undefined) {
+    for (let j = 0;j < cols; j += 1)
+      first[j] = j;
+  }
+  for (let i = 1;i < rows; i += 1) {
+    for (let j = 1;j < cols; j += 1) {
+      const same = a[i - 1] === b[j - 1];
+      const up = dp[i - 1]?.[j] ?? 0;
+      const left = dp[i]?.[j - 1] ?? 0;
+      const diag = dp[i - 1]?.[j - 1] ?? 0;
+      const row = dp[i];
+      if (row !== undefined)
+        row[j] = same ? diag : 1 + Math.min(up, left, diag);
+    }
+  }
+  return dp[rows - 1]?.[cols - 1] ?? Math.max(a.length, b.length);
+}
+function suggestClosest(input, known) {
+  const needle = input.trim().toLowerCase();
+  if (needle.length === 0) {
+    return [];
+  }
+  return [...new Set(known)].map((candidate) => ({ candidate, distance: levenshtein2(needle, candidate.toLowerCase()) })).filter((entry) => entry.distance <= MAX_EDIT_DISTANCE).sort((a, b) => a.distance - b.distance || a.candidate.localeCompare(b.candidate)).slice(0, MAX_SUGGESTIONS).map((entry) => entry.candidate);
+}
+function formatUnknownCommandMessage(input, known, helpCommand = "keryx --help") {
+  const suggestions = suggestClosest(input, known);
+  const didYouMean = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}?` : "";
+  return `Unknown command: ${input}.${didYouMean} Run \`${helpCommand}\` for the list.`;
+}
+
 // src/commands/integrate.ts
 init_ui();
 import path257 from "path";
@@ -111853,12 +112010,12 @@ function loadMcpServers(options) {
     const home = options.home ?? (options.configDir === undefined ? undefined : NO_HOME);
     for (const entry of compatFiles(options.cwd, home)) {
       const read = readCompatFile(entry, options.cwd);
-      problems.push(...read.problems);
+      problems.push(...read.problems.map((p) => ({ ...p, foreign: true })));
       for (const [name, value] of Object.entries(read.servers)) {
         const found = entryProblems(name, value);
         if (found.length > 0) {
           for (const message of found)
-            problems.push({ file: entry.file, message });
+            problems.push({ file: entry.file, message, foreign: true });
           continue;
         }
         winner.set(name, {
@@ -114032,19 +114189,31 @@ function publicView(server, env) {
 function listCommand(args, deps) {
   const config = load(deps);
   const wantJson = splitAtSeparator(args).own.includes("--json");
+  const ownProblems = config.problems.filter((p) => !p.foreign);
+  const foreignProblems = config.problems.filter((p) => p.foreign);
   if (wantJson) {
     const env = deps.env ?? process.env;
-    deps.log(JSON.stringify({ servers: config.servers.map((s) => publicView(s, env)), problems: config.problems }, null, 2));
-    return config.problems.length > 0 ? 1 : 0;
+    deps.log(JSON.stringify({
+      servers: config.servers.map((s) => publicView(s, env)),
+      problems: ownProblems,
+      warnings: foreignProblems
+    }, null, 2));
+    return ownProblems.length > 0 ? 1 : 0;
   }
-  for (const problem of config.problems) {
+  for (const problem of ownProblems) {
     deps.err(`config problem \u2014 ${problem.file}: ${problem.message}`);
   }
+  if (foreignProblems.length > 0) {
+    deps.err("warnings:");
+    for (const problem of foreignProblems) {
+      deps.err(`  ${problem.file}: ${problem.message}`);
+    }
+  }
   if (config.servers.length === 0) {
     deps.log("No MCP servers configured.");
     deps.log(`  user:    ${userConfigFile(deps.configDir)}`);
     deps.log(`  project: ${projectConfigFile(projectRootOf2(deps))}`);
-    return config.problems.length > 0 ? 1 : 0;
+    return ownProblems.length > 0 ? 1 : 0;
   }
   const approvals = loadTrustStore(deps.configDir);
   let held = 0;
@@ -114063,7 +114232,7 @@ function listCommand(args, deps) {
     deps.log(`${held} server(s) from committed config are not started until approved \u2014 a committed config is code someone else wrote.`);
     deps.log("Read what it launches above, then: keryx mcp trust <name>");
   }
-  return config.problems.length > 0 ? 1 : 0;
+  return ownProblems.length > 0 ? 1 : 0;
 }
 function describeTarget(server) {
   const raw = server.raw;
@@ -116960,8 +117129,12 @@ async function mcpCommand(args = [], cwd = process.cwd()) {
     await serveMcpCommand(args.slice(1), cwd);
     return;
   }
-  console.error(`Unknown mcp command: ${subcommand}`);
-  printMcpHelp();
+  console.error(formatUnknownCommandMessage(subcommand ?? "", [
+    ...MCP_CONSUMER_SUBCOMMANDS,
+    "install",
+    "uninstall",
+    "serve"
+  ], "keryx mcp --help"));
   process.exitCode = 1;
 }
 function announceRename(retired, replacement) {
@@ -127578,7 +127751,7 @@ async function dispatchLocked(projectRoot, entry, flow, dispatch, deps, runId) {
     });
     const provider = guardUsage(built, () => meter.markUsageMissing());
     try {
-      const tools = buildUnattendedRoster(worktree, unattendedRunner(worktree, sandbox));
+      const tools = [...buildUnattendedRoster(worktree, unattendedRunner(worktree, sandbox)), ...deps.extraTools ?? []];
       const toolNames = tools.map((t) => t.definition.name);
       const shellHooks = buildShellHookRuntime({
         projectRoot: worktree,
@@ -127633,6 +127806,9 @@ async function dispatchLocked(projectRoot, entry, flow, dispatch, deps, runId) {
         signal: controller.signal
       });
       finishReason = result.finishReason;
+      if (result.caughtToolErrors !== undefined && result.caughtToolErrors.length > 0) {
+        crashed = result.caughtToolErrors.map((e) => `${e.toolName}: ${e.message}`).join("; ");
+      }
     } catch (error) {
       crashed = error instanceof Error ? error.message : String(error);
     } finally {
@@ -135479,6 +135655,569 @@ class NextStepSuggestionGate {
   }
 }
 
+// src/commands/doctor.ts
+init_package();
+import { readdir as readdir53 } from "fs/promises";
+import { existsSync as existsSync48 } from "fs";
+import path302 from "path";
+
+// src/lib/version-check.ts
+init_config_dir();
+init_fs();
+import path301 from "path";
+var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
+var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
+var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
+var VERSION_STRING_LIMIT_CHARS = 64;
+var REQUEST_TIMEOUT_MS = 2000;
+var SUCCESS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+var FAILURE_BACKOFF_MS = 15 * 60 * 1000;
+var CACHE_LOCK_TIMEOUT_MS2 = 250;
+var CACHE_LOCK_RETRY_MS2 = 10;
+var CACHE_LOCK_STALE_MS2 = 5000;
+var SYSTEM_TIMER = {
+  schedule: (callback, delayMs) => setTimeout(callback, delayMs),
+  cancel: (handle) => clearTimeout(handle)
+};
+function formatVersionUpdateAdvisory(result) {
+  if (result.status !== "update-available")
+    return;
+  return `Keryx update ${result.currentVersion} \u2192 ${result.latestVersion}
+${result.installCommand}`;
+}
+var STRICT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function parseSemVer(value) {
+  if (value.length > VERSION_STRING_LIMIT_CHARS)
+    return;
+  const match = STRICT_SEMVER.exec(value);
+  if (match === null)
+    return;
+  const prereleaseText = match[4];
+  const prerelease = [];
+  if (prereleaseText !== undefined) {
+    for (const identifier of prereleaseText.split(".")) {
+      if (/^\d+$/.test(identifier)) {
+        if (identifier.length > 1 && identifier.startsWith("0"))
+          return;
+        prerelease.push(BigInt(identifier));
+      } else {
+        prerelease.push(identifier);
+      }
+    }
+  }
+  return {
+    major: BigInt(match[1]),
+    minor: BigInt(match[2]),
+    patch: BigInt(match[3]),
+    prerelease
+  };
+}
+function compareSemVer(left, right) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (left[key] < right[key])
+      return -1;
+    if (left[key] > right[key])
+      return 1;
+  }
+  if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+    if (left.prerelease.length === right.prerelease.length)
+      return 0;
+    return left.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.prerelease.length, right.prerelease.length);
+  for (let index = 0;index < length; index += 1) {
+    const a = left.prerelease[index];
+    const b = right.prerelease[index];
+    if (a === undefined || b === undefined) {
+      if (a === b)
+        return 0;
+      return a === undefined ? -1 : 1;
+    }
+    if (typeof a === "bigint" && typeof b === "bigint") {
+      if (a < b)
+        return -1;
+      if (a > b)
+        return 1;
+    } else if (typeof a === "bigint") {
+      return -1;
+    } else if (typeof b === "bigint") {
+      return 1;
+    } else if (a !== b) {
+      return a < b ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function parseCache(file) {
+  const read = readConfigFile(file);
+  if (!read.ok)
+    return;
+  try {
+    const value = JSON.parse(read.text);
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+      return;
+    const record = value;
+    const cache = {};
+    if (typeof record.latestVersion === "string" && parseSemVer(record.latestVersion) !== undefined) {
+      cache.latestVersion = record.latestVersion;
+    }
+    if (typeof record.successAt === "number" && Number.isFinite(record.successAt))
+      cache.successAt = record.successAt;
+    if (typeof record.failureAt === "number" && Number.isFinite(record.failureAt))
+      cache.failureAt = record.failureAt;
+    return cache;
+  } catch {
+    return;
+  }
+}
+function resultFor(currentVersion, current, latestVersion, source) {
+  const latest = parseSemVer(latestVersion);
+  return compareSemVer(current, latest) < 0 ? { status: "update-available", currentVersion, latestVersion, installCommand: FIXED_INSTALL_COMMAND, source } : { status: "up-to-date", currentVersion, latestVersion, source };
+}
+function cancelWithoutWaiting(cancel) {
+  try {
+    cancel().catch(() => {});
+  } catch {}
+}
+async function boundedResponseText(response) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null && /^\d+$/.test(declared) && BigInt(declared) > BigInt(RESPONSE_BODY_LIMIT_BYTES)) {
+    if (response.body !== null) {
+      cancelWithoutWaiting(() => response.body.cancel());
+    }
+    return;
+  }
+  if (response.body === null)
+    return "";
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let size = 0;
+  let text = "";
+  try {
+    for (;; ) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > RESPONSE_BODY_LIMIT_BYTES) {
+        cancelWithoutWaiting(() => reader.cancel());
+        return;
+      }
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return text + decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
+}
+function unavailable(currentVersion, reason, cache) {
+  return {
+    status: "unavailable",
+    currentVersion,
+    reason,
+    ...cache?.latestVersion !== undefined ? { cachedLatestVersion: cache.latestVersion } : {}
+  };
+}
+function saveCache2(file, cache) {
+  try {
+    writeOwnerOnlyFileAtomic(file, `${JSON.stringify(cache, null, 2)}
+`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function mergeSuccessfulCache(committed, latestVersion, successAt) {
+  if (committed.latestVersion === undefined || committed.successAt === undefined) {
+    return { latestVersion, successAt };
+  }
+  if (committed.successAt > successAt)
+    return committed;
+  if (committed.successAt < successAt)
+    return { latestVersion, successAt };
+  const committedVersion = parseSemVer(committed.latestVersion);
+  const candidateVersion = parseSemVer(latestVersion);
+  if (committedVersion !== undefined && candidateVersion !== undefined) {
+    const precedence = compareSemVer(committedVersion, candidateVersion);
+    if (precedence > 0)
+      return committed;
+    if (precedence < 0)
+      return { latestVersion, successAt };
+    if (committed.latestVersion >= latestVersion)
+      return committed;
+  }
+  return { latestVersion, successAt };
+}
+async function updateCache(file, update) {
+  try {
+    return await withFileLock(`${file}.lock`, async () => saveCache2(file, update(parseCache(file) ?? {})), {
+      timeoutMs: CACHE_LOCK_TIMEOUT_MS2,
+      retryMs: CACHE_LOCK_RETRY_MS2,
+      staleMs: CACHE_LOCK_STALE_MS2
+    });
+  } catch {
+    return false;
+  }
+}
+async function checkVersion(options) {
+  const current = parseSemVer(options.currentVersion);
+  if (current === undefined)
+    return unavailable(options.currentVersion, "invalid-current-version");
+  const now = options.now ?? Date.now;
+  const timestamp = now();
+  const configDir = ensureKeryxConfigDir(options.cacheDir);
+  const cacheFile = path301.join(configDir, "version-check.json");
+  const cache = parseCache(cacheFile);
+  if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
+    return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
+  }
+  if (cache?.failureAt !== undefined && timestamp - cache.failureAt >= 0 && timestamp - cache.failureAt < FAILURE_BACKOFF_MS) {
+    return unavailable(options.currentVersion, "suppressed", cache);
+  }
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const controller = new AbortController;
+  const timer = options.timer ?? SYSTEM_TIMER;
+  let timeout;
+  let timeoutScheduled = false;
+  let failure;
+  let latestVersion;
+  try {
+    timeout = timer.schedule(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    timeoutScheduled = true;
+    const response = await fetchImpl(REGISTRY_URL, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      signal: controller.signal,
+      credentials: "omit"
+    });
+    if (!response.ok) {
+      failure = "http";
+    } else {
+      const body = await boundedResponseText(response);
+      if (body === undefined) {
+        failure = "response-too-large";
+      } else {
+        let parsed;
+        try {
+          parsed = JSON.parse(body);
+        } catch {
+          parsed = undefined;
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          failure = "malformed-response";
+        } else {
+          const record = parsed;
+          if (record.name !== "@mrciphersmith/keryx" || typeof record.version !== "string") {
+            failure = "malformed-response";
+          } else if (parseSemVer(record.version) === undefined) {
+            failure = "invalid-latest-version";
+          } else {
+            latestVersion = record.version;
+          }
+        }
+      }
+    }
+  } catch {
+    failure = controller.signal.aborted ? "timeout" : "network";
+  } finally {
+    if (timeoutScheduled) {
+      try {
+        timer.cancel(timeout);
+      } catch {}
+    }
+  }
+  if (latestVersion === undefined) {
+    await updateCache(cacheFile, (committed) => ({ ...committed, failureAt: timestamp }));
+    return unavailable(options.currentVersion, failure ?? "network", cache);
+  }
+  await updateCache(cacheFile, (committed) => mergeSuccessfulCache(committed, latestVersion, timestamp));
+  return resultFor(options.currentVersion, current, latestVersion, "registry");
+}
+
+// src/commands/doctor.ts
+init_contained_path();
+init_providers();
+init_service();
+init_service7();
+init_service10();
+async function registeredWorktrees(cwd) {
+  if (!Bun.which("git"))
+    return new Set;
+  try {
+    const proc = Bun.spawn(["git", "worktree", "list", "--porcelain"], { cwd, stdout: "pipe", stderr: "ignore" });
+    const [stdout, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+    if (code !== 0)
+      return new Set;
+    const paths = new Set;
+    for (const line of stdout.split(`
+`)) {
+      if (line.startsWith("worktree ")) {
+        paths.add(path302.resolve(line.slice("worktree ".length).trim()));
+      }
+    }
+    return paths;
+  } catch {
+    return new Set;
+  }
+}
+async function checkWorktrees(cwd) {
+  const worktreesDir = path302.join(cwd, ".claude", "worktrees");
+  let entries;
+  try {
+    entries = (await readdir53(worktreesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return { id: "worktrees", status: "ok", detail: "no .claude/worktrees directory" };
+  }
+  if (entries.length === 0) {
+    return { id: "worktrees", status: "ok", detail: ".claude/worktrees is empty" };
+  }
+  const registered = await registeredWorktrees(cwd);
+  const stale = entries.filter((name) => {
+    const full = path302.resolve(worktreesDir, name);
+    return !existsSync48(path302.join(full, ".git")) || !registered.has(full);
+  });
+  if (stale.length === 0) {
+    return {
+      id: "worktrees",
+      status: "ok",
+      detail: `${entries.length} worktree(s) under .claude/worktrees, all registered`
+    };
+  }
+  return {
+    id: "worktrees",
+    status: "warn",
+    detail: `${stale.length} stale entr${stale.length === 1 ? "y" : "ies"} under .claude/worktrees: ${stale.join(", ")}`,
+    fix: "git worktree prune, then remove the listed directories under .claude/worktrees by hand"
+  };
+}
+function meetsBunFloor(current, floor) {
+  const floorMatch = /^>=\s*(\d+)\.(\d+)\.(\d+)/.exec(floor);
+  const currentMatch = /^(\d+)\.(\d+)\.(\d+)/.exec(current);
+  if (!floorMatch || !currentMatch)
+    return true;
+  for (let i = 1;i <= 3; i += 1) {
+    const f = Number(floorMatch[i]);
+    const c = Number(currentMatch[i]);
+    if (c !== f)
+      return c > f;
+  }
+  return true;
+}
+function checkBun(bunFloorOverride) {
+  const floor = bunFloorOverride ?? package_default.engines?.bun;
+  const current = Bun.version;
+  if (floor === undefined || meetsBunFloor(current, floor)) {
+    return { id: "bun", status: "ok", detail: `Bun ${current}${floor ? ` (floor ${floor})` : ""}` };
+  }
+  return {
+    id: "bun",
+    status: "fail",
+    detail: `Bun ${current} is below the documented floor ${floor}`,
+    fix: "upgrade Bun: https://bun.sh/docs/installation"
+  };
+}
+function checkRipgrep() {
+  const rg = Bun.which("rg");
+  return rg ? { id: "ripgrep", status: "ok", detail: `rg at ${rg}` } : {
+    id: "ripgrep",
+    status: "warn",
+    detail: "ripgrep (rg) not found on PATH \u2014 keryx ctx rg and search_code are unavailable",
+    fix: "brew install ripgrep (macOS) or apt install ripgrep (Debian/Ubuntu)"
+  };
+}
+async function checkVersionAvailability() {
+  const result = await checkVersion({ currentVersion: package_default.version });
+  if (result.status === "update-available") {
+    return {
+      id: "version",
+      status: "warn",
+      detail: `keryx ${result.currentVersion} \u2192 ${result.latestVersion} is available`,
+      fix: result.installCommand
+    };
+  }
+  if (result.status === "up-to-date") {
+    return { id: "version", status: "ok", detail: `keryx ${result.currentVersion} is up to date` };
+  }
+  return { id: "version", status: "ok", detail: `keryx ${result.currentVersion}; update check unavailable (${result.reason})` };
+}
+function checkSandbox() {
+  const report = buildSandboxReport();
+  if (report.launcher.available) {
+    return { id: "sandbox", status: "ok", detail: `${report.launcherName ?? "sandbox launcher"} available` };
+  }
+  const known = report.launcherName !== undefined;
+  return {
+    id: "sandbox",
+    status: "warn",
+    detail: known ? `${report.launcherName} not installed on ${report.platform} \u2014 OS-sandboxed shell exec is unavailable` : `no OS sandbox launcher support on ${report.platform}`,
+    fix: known ? "keryx sandbox status for what installing it would unlock" : "keryx sandbox status for details"
+  };
+}
+function checkProviders(env) {
+  const providers = configuredProviders(env);
+  if (providers.length === 0) {
+    return {
+      id: "providers",
+      status: "warn",
+      detail: "no provider credentials configured",
+      fix: "keryx auth login <provider>, or set a provider API key"
+    };
+  }
+  return {
+    id: "providers",
+    status: "ok",
+    detail: `${providers.length} provider(s) configured: ${providers.map((p) => p.name).join(", ")}`
+  };
+}
+function checkMcp(cwd) {
+  const projectRoot = resolveProjectRoot(cwd);
+  const config = loadMcpServers({ cwd, gitRoot: projectRoot });
+  const ownProblems = config.problems.filter((p) => !p.foreign);
+  if (ownProblems.length > 0) {
+    return {
+      id: "mcp",
+      status: "fail",
+      detail: `${ownProblems.length} config problem(s) in keryx's own MCP config: ${ownProblems.map((p) => p.message).join("; ")}`,
+      fix: "keryx mcp list for details"
+    };
+  }
+  const approvals = loadTrustStore();
+  const held = config.servers.filter((server) => server.enabled && requiresApproval(server, approvals));
+  if (held.length > 0) {
+    return {
+      id: "mcp",
+      status: "warn",
+      detail: `${held.length} server(s) from committed config awaiting approval: ${held.map((s) => s.name).join(", ")}`,
+      fix: "keryx mcp trust <name>, after reading what it launches"
+    };
+  }
+  return {
+    id: "mcp",
+    status: "ok",
+    detail: `${config.servers.length} server(s) configured; run \`keryx mcp doctor\` to also check connectivity`
+  };
+}
+async function checkIntegrations(cwd) {
+  const results = await Promise.all(harnessAdapterIds().map(async (id) => {
+    try {
+      return await doctorIntegration(cwd, id);
+    } catch {
+      return { runtimeId: id, surfaces: [], problems: [], ok: true };
+    }
+  }));
+  const drifted = results.filter((r) => !r.ok);
+  if (drifted.length === 0) {
+    return { id: "integrations", status: "ok", detail: "no drift in any installed integration" };
+  }
+  return {
+    id: "integrations",
+    status: "warn",
+    detail: `drift in: ${drifted.map((r) => r.runtimeId).join(", ")}`,
+    fix: "keryx integrations doctor --runtime all"
+  };
+}
+async function checkStandard(cwd) {
+  const result = await runDoctor(cwd);
+  if (result.errors.length > 0) {
+    return {
+      id: "standard",
+      status: "fail",
+      detail: `${result.errors.length} error(s): ${result.errors.map((e) => e.message).join("; ")}`,
+      fix: "keryx standard doctor"
+    };
+  }
+  if (result.warnings.length > 0) {
+    return {
+      id: "standard",
+      status: "warn",
+      detail: `${result.warnings.length} warning(s): ${result.warnings.map((w) => w.message).join("; ")}`,
+      fix: "keryx standard doctor"
+    };
+  }
+  return { id: "standard", status: "ok", detail: "workspace is Metaproject Standard compliant" };
+}
+async function checkGraphFreshness(cwd) {
+  const result = await checkGraphStaleness(cwd);
+  if (result.status === "fresh") {
+    return { id: "graph-freshness", status: "ok", detail: "code graph is fresh" };
+  }
+  return {
+    id: "graph-freshness",
+    status: "warn",
+    detail: result.reasons.join("; ") || `code graph is ${result.status}`,
+    fix: "keryx gdgraph build"
+  };
+}
+async function checkWikiFreshness(cwd) {
+  const metric = await readWikiFreshnessMetric(cwd);
+  if (metric.status === "measured") {
+    const pct = metric.ratio !== undefined ? `${Math.round(metric.ratio * 100)}%` : "an unmeasured share";
+    return {
+      id: "wiki-freshness",
+      status: "ok",
+      detail: `${pct} of ${metric.pagesTotal ?? "?"} wiki page(s) fresh`
+    };
+  }
+  return {
+    id: "wiki-freshness",
+    status: "warn",
+    detail: metric.reason ?? `wiki freshness: ${metric.status}`,
+    fix: "keryx wiki freshness"
+  };
+}
+async function buildDoctorReport(cwd, env = process.env, overrides = {}) {
+  const checks = await Promise.all([
+    checkVersionAvailability(),
+    Promise.resolve(checkBun(overrides.bunFloor)),
+    Promise.resolve(checkRipgrep()),
+    Promise.resolve(checkSandbox()),
+    Promise.resolve(checkProviders(env)),
+    Promise.resolve(checkMcp(cwd)),
+    checkIntegrations(cwd),
+    checkStandard(cwd),
+    checkWorktrees(cwd),
+    checkGraphFreshness(cwd),
+    checkWikiFreshness(cwd)
+  ]);
+  return { checks };
+}
+function doctorFailed(report) {
+  return report.checks.some((check) => check.status === "fail");
+}
+function formatDoctorReport2(report) {
+  const symbolFor = { ok: "\u2713", warn: "!", fail: "\u2717" };
+  const lines = ["keryx doctor", ""];
+  for (const check of report.checks) {
+    lines.push(`  ${symbolFor[check.status]} ${check.id}: ${check.detail}`);
+    if (check.fix) {
+      lines.push(`      fix: ${check.fix}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+async function doctorCommand2(args = [], cwd = process.cwd(), overrides = {}) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`keryx doctor [--json]
+
+One page: keryx's own version and update availability, the Bun floor,
+ripgrep on PATH, the OS sandbox launcher, providers with a credential
+present (names only), MCP servers and their trust state, integrations
+drift, Metaproject Standard warnings, stale .claude/worktrees entries, and
+graph/wiki freshness. Exits 0 unless something is a "fail".`);
+    return;
+  }
+  const report = await buildDoctorReport(cwd, process.env, overrides);
+  if (args.includes("--json")) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    console.log(formatDoctorReport2(report));
+  }
+  if (doctorFailed(report)) {
+    process.exitCode = 1;
+  }
+}
+
 // src/tui/tui-shell.ts
 init_slate_lifecycle();
 init_slate();
@@ -135491,7 +136230,7 @@ init_workspace_service();
 init_service11();
 init_store3();
 init_fs();
-import path301 from "path";
+import path303 from "path";
 import { readFile as readFile157 } from "fs/promises";
 var POSITIVE_INTEGER = /^[1-9][0-9]*$/;
 var DEFAULT_AUTO_GOAL_ROUNDS = 8;
@@ -135567,7 +136306,7 @@ function getFlowService() {
 async function autoProvisionFlow(cwd, goalText) {
   const service = getFlowService();
   const result = await service.init({ cwd, title: goalText });
-  const acFile = path301.join(cwd, result.dir, "acceptance-criteria.md");
+  const acFile = path303.join(cwd, result.dir, "acceptance-criteria.md");
   await writeFileAtomic(acFile, [
     "# Acceptance Criteria",
     "",
@@ -137255,8 +137994,8 @@ init_store4();
 init_proposal_lifecycle();
 init_workspace_service();
 import { randomUUID as randomUUID34 } from "crypto";
-import { readdir as readdir53, stat as stat30 } from "fs/promises";
-import path302 from "path";
+import { readdir as readdir54, stat as stat30 } from "fs/promises";
+import path304 from "path";
 
 // src/sac/lifecycle-flag.ts
 init_store();
@@ -137395,7 +138134,7 @@ async function readExternalUnboundCandidates(cwd) {
   const extDir = externalSlatesDir(cwd);
   let externalIds;
   try {
-    const entries = await readdir53(extDir);
+    const entries = await readdir54(extDir);
     externalIds = entries.filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -".json".length));
   } catch {
     return [];
@@ -137426,7 +138165,7 @@ async function readExternalUnboundCandidates(cwd) {
         }
         return groups;
       }, []));
-      const metaPath = path302.join(extDir, `${id}.json`);
+      const metaPath = path304.join(extDir, `${id}.json`);
       if (await pathExists(unboundDismissedReceiptPath(metaPath)))
         continue;
       candidates.push({
@@ -137440,16 +138179,16 @@ async function readExternalUnboundCandidates(cwd) {
   return candidates;
 }
 async function readNewestUnboundCandidateForExternal(cwd, externalSessionId) {
-  const evidenceDir = path302.join(externalSlatesDir(cwd), externalSessionId);
+  const evidenceDir = path304.join(externalSlatesDir(cwd), externalSessionId);
   let entries;
   try {
-    entries = (await readdir53(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+    entries = (await readdir54(evidenceDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
   } catch {
     return;
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path302.join(evidenceDir, entries[i]);
+    const evidencePath = path304.join(evidenceDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -137492,23 +138231,23 @@ var SESSION_ATTRIBUTION_SLACK_MS = 5 * 60000;
 var MTIME_CLOCK_SKEW_TOLERANCE_MS = 5000;
 async function collectReceiptTargets(cwd, owner) {
   const targets = new Set;
-  const workspacesDir = path302.join(cwd, ".metaproject", "workspaces");
+  const workspacesDir = path304.join(cwd, ".metaproject", "workspaces");
   let workspaceIds;
   try {
-    workspaceIds = (await readdir53(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+    workspaceIds = (await readdir54(workspacesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
   } catch {
     return targets;
   }
   for (const workspaceId of workspaceIds) {
-    const receiptsDir = path302.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
+    const receiptsDir = path304.join(workspacesDir, workspaceId, `${owner}-write-receipts`);
     let files;
     try {
-      files = (await readdir53(receiptsDir)).filter((name) => name.endsWith(".json"));
+      files = (await readdir54(receiptsDir)).filter((name) => name.endsWith(".json"));
     } catch {
       continue;
     }
     for (const file of files) {
-      const result = readConfigFile(path302.join(receiptsDir, file));
+      const result = readConfigFile(path304.join(receiptsDir, file));
       if (!result.ok)
         continue;
       try {
@@ -137545,13 +138284,13 @@ async function attributeToSession(absolutePath, sessionsNewestFirst) {
 async function findSkillFiles(dir) {
   let entries;
   try {
-    entries = await readdir53(dir, { withFileTypes: true });
+    entries = await readdir54(dir, { withFileTypes: true });
   } catch {
     return [];
   }
   const found = [];
   for (const entry of entries) {
-    const full = path302.join(dir, entry.name);
+    const full = path304.join(dir, entry.name);
     if (entry.isDirectory()) {
       found.push(...await findSkillFiles(full));
     } else if (entry.isFile() && entry.name === "SKILL.md") {
@@ -137610,10 +138349,10 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
       changedAt: attribution.changedAt
     });
   }
-  const sacSkillsDir = path302.join(cwd, ".metaproject", "project-skills", "sac");
+  const sacSkillsDir = path304.join(cwd, ".metaproject", "project-skills", "sac");
   const skillFiles = await findSkillFiles(sacSkillsDir);
   for (const absolutePath of skillFiles) {
-    const targetRef = path302.relative(path302.join(cwd, ".metaproject"), absolutePath).split(path302.sep).join("/");
+    const targetRef = path304.relative(path304.join(cwd, ".metaproject"), absolutePath).split(path304.sep).join("/");
     if (skillReceipts.has(targetRef))
       continue;
     const attribution = await attributeToSession(absolutePath, scoped);
@@ -137631,12 +138370,12 @@ async function detectUnreviewedSacPathChanges(cwd, sessions) {
   return items;
 }
 async function isSlateEngaged(dir) {
-  if (await pathExists(path302.join(dir, "slate.json")))
+  if (await pathExists(path304.join(dir, "slate.json")))
     return true;
-  if (await pathExists(path302.join(dir, "terminal-state.json")))
+  if (await pathExists(path304.join(dir, "terminal-state.json")))
     return true;
   try {
-    const entries = await readdir53(path302.join(dir, "slate-archive"));
+    const entries = await readdir54(path304.join(dir, "slate-archive"));
     return entries.length > 0;
   } catch {
     return false;
@@ -137661,7 +138400,7 @@ async function safeReadSlate(dir) {
   }
 }
 async function readTerminalState(dir) {
-  const result = readConfigFile(path302.join(dir, "terminal-state.json"));
+  const result = readConfigFile(path304.join(dir, "terminal-state.json"));
   if (!result.ok) {
     return;
   }
@@ -137685,17 +138424,17 @@ async function resolveUnboundCandidateTarget(cwd, target) {
   if (session === undefined) {
     throw new Error(`No session or evidence path matches "${target}"`);
   }
-  const archiveDir = path302.join(sessionDir(session.projectPath, session.id), "slate-archive");
+  const archiveDir = path304.join(sessionDir(session.projectPath, session.id), "slate-archive");
   let entries;
   try {
-    entries = (await readdir53(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+    entries = (await readdir54(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
   } catch {
     throw new Error(`No unbound-candidate artifacts for session ${session.id}`);
   }
   if (entries.length === 0)
     throw new Error(`No unbound-candidate artifacts for session ${session.id}`);
   entries.sort();
-  return path302.join(archiveDir, entries[entries.length - 1]);
+  return path304.join(archiveDir, entries[entries.length - 1]);
 }
 async function dismissUnboundByTarget(cwd, target, reason) {
   const evidencePath = await resolveUnboundCandidateTarget(cwd, target);
@@ -137721,16 +138460,16 @@ async function dismissUnboundCandidate(candidatePath, reason) {
   return { removed: candidatePath, receipt: receiptPath };
 }
 async function readNewestUnboundCandidate(dir) {
-  const archiveDir = path302.join(dir, "slate-archive");
+  const archiveDir = path304.join(dir, "slate-archive");
   let entries;
   try {
-    entries = (await readdir53(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
+    entries = (await readdir54(archiveDir)).filter((name) => name.endsWith("-unbound-candidate.json"));
   } catch {
     return;
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path302.join(archiveDir, entries[i]);
+    const evidencePath = path304.join(archiveDir, entries[i]);
     if (await pathExists(unboundDismissedReceiptPath(evidencePath)))
       continue;
     const result = readConfigFile(evidencePath);
@@ -137760,16 +138499,16 @@ function isFailureOutcome2(g) {
   return g.outcome === "error" || g.outcome === "no_credential" || g.outcome === "conflict";
 }
 async function readNewestWrapUpOutcome(dir) {
-  const archiveDir = path302.join(dir, "slate-archive");
+  const archiveDir = path304.join(dir, "slate-archive");
   let entries;
   try {
-    entries = (await readdir53(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
+    entries = (await readdir54(archiveDir)).filter((name) => name.endsWith("-wrap-up-outcome.json"));
   } catch {
     return;
   }
   entries.sort();
   for (let i = entries.length - 1;i >= 0; i--) {
-    const evidencePath = path302.join(archiveDir, entries[i]);
+    const evidencePath = path304.join(archiveDir, entries[i]);
     const result = readConfigFile(evidencePath);
     if (!result.ok) {
       continue;
@@ -138376,6 +139115,11 @@ var AGENT_SLASH_COMMANDS = [
     modes: BOTH
   },
   { name: "/flows", description: "Browse project flows and inspect one", modes: BOTH },
+  {
+    name: "/doctor",
+    description: "One-page health check: version, sandbox, providers, MCP, integrations, freshness",
+    modes: BOTH
+  },
   {
     name: "/ac",
     description: "Check the active flow's acceptance criteria (advisory, cached) \u2014 press `c` in /flows to re-check",
@@ -138718,7 +139462,7 @@ function classifyBusyDispatch(params) {
 init_fs();
 init_json();
 import { mkdir as mkdir67 } from "fs/promises";
-import path304 from "path";
+import path306 from "path";
 
 // src/governance/aggregate.ts
 init_store3();
@@ -138726,17 +139470,17 @@ init_store3();
 // src/governance/spend.ts
 init_fs();
 init_store3();
-import { readdir as readdir54, readFile as readFile158 } from "fs/promises";
-import path303 from "path";
+import { readdir as readdir55, readFile as readFile158 } from "fs/promises";
+import path305 from "path";
 async function readFlowReviewManifests(cwd, flowDir) {
-  const reviewsDir = path303.join(flowsRoot(cwd), flowDir, "reviews");
+  const reviewsDir = path305.join(flowsRoot(cwd), flowDir, "reviews");
   if (!await pathExists(reviewsDir)) {
     return [];
   }
-  const entries = (await readdir54(reviewsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory());
+  const entries = (await readdir55(reviewsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory());
   const manifests = [];
   for (const entry of entries) {
-    const manifestPath = path303.join(reviewsDir, entry.name, "manifest.json");
+    const manifestPath = path305.join(reviewsDir, entry.name, "manifest.json");
     if (!await pathExists(manifestPath)) {
       continue;
     }
@@ -138983,11 +139727,11 @@ async function collectProjectGovernance(root, filters, displayName) {
 // src/governance/report.ts
 var GOVERNANCE_SCHEMA_VERSION = 1;
 function governanceDataRoot(cwd) {
-  return path304.join(cwd, ".metaproject", "data", "governance");
+  return path306.join(cwd, ".metaproject", "data", "governance");
 }
 function artifactPaths(cwd) {
-  const artifacts = path304.join(governanceDataRoot(cwd), "artifacts");
-  return { markdown: path304.join(artifacts, "latest.md"), json: path304.join(artifacts, "latest.json") };
+  const artifacts = path306.join(governanceDataRoot(cwd), "artifacts");
+  return { markdown: path306.join(artifacts, "latest.md"), json: path306.join(artifacts, "latest.json") };
 }
 async function buildGovernanceReport(options) {
   const { cwd, filters, allProjects, now } = options;
@@ -138995,9 +139739,9 @@ async function buildGovernanceReport(options) {
   if (allProjects) {
     const warnings = [];
     const registered = listProjects(options.registryDir, (message) => warnings.push(message));
-    const seen = new Set([path304.resolve(cwd)]);
+    const seen = new Set([path306.resolve(cwd)]);
     for (const entry of registered) {
-      const resolved = path304.resolve(entry.path);
+      const resolved = path306.resolve(entry.path);
       if (seen.has(resolved)) {
         continue;
       }
@@ -139150,7 +139894,7 @@ function renderTriggerSpendLine(spend) {
 }
 async function writeGovernanceArtifacts(cwd, report) {
   const { markdown, json } = artifactPaths(cwd);
-  await mkdir67(path304.dirname(markdown), { recursive: true });
+  await mkdir67(path306.dirname(markdown), { recursive: true });
   await writeFileAtomic(markdown, renderGovernanceMarkdown(report));
   await writeFileAtomic(json, `${JSON.stringify(report, null, 2)}
 `);
@@ -139355,7 +140099,7 @@ function mountGovernancePanel(otui, renderer, parent, options) {
 
 // src/tui/governance-inspector.ts
 import { readFile as readFile159 } from "fs/promises";
-import path305 from "path";
+import path307 from "path";
 var GOVERNANCE_COMMAND = "/governance";
 var GOVERNANCE_FOOTER = [
   { key: "\u2191/\u2193 j/k", label: "scroll" },
@@ -139366,7 +140110,7 @@ var GOVERNANCE_FOOTER = [
 var HEADER_TEXT_ROWS = 2;
 var GOVERNANCE_HEADER_ROWS = HEADER_TEXT_ROWS + 1;
 function governanceMarkdownPath(cwd) {
-  return path305.join(governanceDataRoot(cwd), "artifacts", "latest.md");
+  return path307.join(governanceDataRoot(cwd), "artifacts", "latest.md");
 }
 async function defaultReadMarkdown(cwd) {
   try {
@@ -139511,7 +140255,7 @@ function openGovernanceReport(otui, chrome, options) {
 
 // src/tui/trigger-ledger.ts
 import { stat as fsStat2 } from "fs/promises";
-import path306 from "path";
+import path308 from "path";
 var DEFAULT_RECORDS_PER_ENTRY = 20;
 function isScheduledEntry(entry) {
   return entry.fire.kind === "schedule";
@@ -139570,7 +140314,7 @@ function triggerLedgerPaths(root) {
   return {
     runs: triggerRunsPath(root),
     triggers: triggersConfigPath(root),
-    governance: path306.join(governanceDataRoot(root), "artifacts", "latest.json"),
+    governance: path308.join(governanceDataRoot(root), "artifacts", "latest.json"),
     schedules: scheduleStorePath(root)
   };
 }
@@ -140143,7 +140887,7 @@ function openTriggers(otui, chrome, options) {
 // src/tui/trigger-run-now.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import { closeSync as closeSync5, constants as constants3, fstatSync as fstatSync3, lstatSync as lstatSync6, mkdirSync as mkdirSync7, openSync as openSync5, readdirSync as readdirSync10, readSync as readSync3, unlinkSync as unlinkSync4, writeSync } from "fs";
-import path307 from "path";
+import path309 from "path";
 var OUTPUT_TAIL_CHARS = 4000;
 var defaultSpawn = (command, args, options) => nodeSpawn2(command, [...args], { cwd: options.cwd, env: options.env, detached: true, stdio: [...options.stdio] });
 function triggerRunArgv(name, invocation = resolveKeryxInvocation(), options = {}) {
@@ -140158,7 +140902,7 @@ function runNowChildEnv(env) {
   return out;
 }
 function runNowLogDir(root) {
-  return path307.join(triggerDataDir(root), "run-now");
+  return path309.join(triggerDataDir(root), "run-now");
 }
 var RUN_NOW_LOGS_KEPT = 5;
 var OUTPUT_TAIL_BYTES = 16 * 1024;
@@ -140166,13 +140910,13 @@ function stampOf(iso) {
   return iso.replace(/[:.]/g, "-");
 }
 function runNowLogPath(root, name, startedAt) {
-  return path307.join(runNowLogDir(root), `${name}-${stampOf(startedAt)}.log`);
+  return path309.join(runNowLogDir(root), `${name}-${stampOf(startedAt)}.log`);
 }
 function isCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 function prepareRunNowLogDir(root) {
-  mkdirSync7(path307.join(root, ".metaproject", "data"), { recursive: true });
+  mkdirSync7(path309.join(root, ".metaproject", "data"), { recursive: true });
   for (const segment of [triggerDataDir(root), runNowLogDir(root)]) {
     let info;
     try {
@@ -140191,7 +140935,7 @@ function prepareRunNowLogDir(root) {
   }
   const dir = runNowLogDir(root);
   try {
-    const fd = openSync5(path307.join(dir, ".gitignore"), constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | (constants3.O_NOFOLLOW ?? 0), 420);
+    const fd = openSync5(path309.join(dir, ".gitignore"), constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | (constants3.O_NOFOLLOW ?? 0), 420);
     try {
       writeSync(fd, `# keryx run-now logs \u2014 never commit
 *
@@ -140232,7 +140976,7 @@ function pruneRunLogs(dir, name, keep) {
   }
   for (const old of names.slice(0, Math.max(0, names.length - keep))) {
     try {
-      unlinkSync4(path307.join(dir, old));
+      unlinkSync4(path309.join(dir, old));
     } catch {}
   }
 }
@@ -141250,279 +141994,6 @@ function mountSchedulesSidebar(options) {
 // src/tui/tui-shell.ts
 init_debug_log();
 
-// src/lib/version-check.ts
-init_config_dir();
-init_fs();
-import path308 from "path";
-var REGISTRY_URL = "https://registry.npmjs.org/@mrciphersmith%2Fkeryx/latest";
-var FIXED_INSTALL_COMMAND = "npm install -g @mrciphersmith/keryx@latest";
-var RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
-var VERSION_STRING_LIMIT_CHARS = 64;
-var REQUEST_TIMEOUT_MS = 2000;
-var SUCCESS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
-var FAILURE_BACKOFF_MS = 15 * 60 * 1000;
-var CACHE_LOCK_TIMEOUT_MS2 = 250;
-var CACHE_LOCK_RETRY_MS2 = 10;
-var CACHE_LOCK_STALE_MS2 = 5000;
-var SYSTEM_TIMER = {
-  schedule: (callback, delayMs) => setTimeout(callback, delayMs),
-  cancel: (handle) => clearTimeout(handle)
-};
-function formatVersionUpdateAdvisory(result) {
-  if (result.status !== "update-available")
-    return;
-  return `Keryx update ${result.currentVersion} \u2192 ${result.latestVersion}
-${result.installCommand}`;
-}
-var STRICT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
-function parseSemVer(value) {
-  if (value.length > VERSION_STRING_LIMIT_CHARS)
-    return;
-  const match = STRICT_SEMVER.exec(value);
-  if (match === null)
-    return;
-  const prereleaseText = match[4];
-  const prerelease = [];
-  if (prereleaseText !== undefined) {
-    for (const identifier of prereleaseText.split(".")) {
-      if (/^\d+$/.test(identifier)) {
-        if (identifier.length > 1 && identifier.startsWith("0"))
-          return;
-        prerelease.push(BigInt(identifier));
-      } else {
-        prerelease.push(identifier);
-      }
-    }
-  }
-  return {
-    major: BigInt(match[1]),
-    minor: BigInt(match[2]),
-    patch: BigInt(match[3]),
-    prerelease
-  };
-}
-function compareSemVer(left, right) {
-  for (const key of ["major", "minor", "patch"]) {
-    if (left[key] < right[key])
-      return -1;
-    if (left[key] > right[key])
-      return 1;
-  }
-  if (left.prerelease.length === 0 || right.prerelease.length === 0) {
-    if (left.prerelease.length === right.prerelease.length)
-      return 0;
-    return left.prerelease.length === 0 ? 1 : -1;
-  }
-  const length = Math.max(left.prerelease.length, right.prerelease.length);
-  for (let index = 0;index < length; index += 1) {
-    const a = left.prerelease[index];
-    const b = right.prerelease[index];
-    if (a === undefined || b === undefined) {
-      if (a === b)
-        return 0;
-      return a === undefined ? -1 : 1;
-    }
-    if (typeof a === "bigint" && typeof b === "bigint") {
-      if (a < b)
-        return -1;
-      if (a > b)
-        return 1;
-    } else if (typeof a === "bigint") {
-      return -1;
-    } else if (typeof b === "bigint") {
-      return 1;
-    } else if (a !== b) {
-      return a < b ? -1 : 1;
-    }
-  }
-  return 0;
-}
-function parseCache(file) {
-  const read = readConfigFile(file);
-  if (!read.ok)
-    return;
-  try {
-    const value = JSON.parse(read.text);
-    if (value === null || typeof value !== "object" || Array.isArray(value))
-      return;
-    const record = value;
-    const cache = {};
-    if (typeof record.latestVersion === "string" && parseSemVer(record.latestVersion) !== undefined) {
-      cache.latestVersion = record.latestVersion;
-    }
-    if (typeof record.successAt === "number" && Number.isFinite(record.successAt))
-      cache.successAt = record.successAt;
-    if (typeof record.failureAt === "number" && Number.isFinite(record.failureAt))
-      cache.failureAt = record.failureAt;
-    return cache;
-  } catch {
-    return;
-  }
-}
-function resultFor(currentVersion, current, latestVersion, source) {
-  const latest = parseSemVer(latestVersion);
-  return compareSemVer(current, latest) < 0 ? { status: "update-available", currentVersion, latestVersion, installCommand: FIXED_INSTALL_COMMAND, source } : { status: "up-to-date", currentVersion, latestVersion, source };
-}
-function cancelWithoutWaiting(cancel) {
-  try {
-    cancel().catch(() => {});
-  } catch {}
-}
-async function boundedResponseText(response) {
-  const declared = response.headers.get("content-length");
-  if (declared !== null && /^\d+$/.test(declared) && BigInt(declared) > BigInt(RESPONSE_BODY_LIMIT_BYTES)) {
-    if (response.body !== null) {
-      cancelWithoutWaiting(() => response.body.cancel());
-    }
-    return;
-  }
-  if (response.body === null)
-    return "";
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder;
-  let size = 0;
-  let text = "";
-  try {
-    for (;; ) {
-      const chunk = await reader.read();
-      if (chunk.done)
-        break;
-      size += chunk.value.byteLength;
-      if (size > RESPONSE_BODY_LIMIT_BYTES) {
-        cancelWithoutWaiting(() => reader.cancel());
-        return;
-      }
-      text += decoder.decode(chunk.value, { stream: true });
-    }
-    return text + decoder.decode();
-  } finally {
-    reader.releaseLock();
-  }
-}
-function unavailable(currentVersion, reason, cache) {
-  return {
-    status: "unavailable",
-    currentVersion,
-    reason,
-    ...cache?.latestVersion !== undefined ? { cachedLatestVersion: cache.latestVersion } : {}
-  };
-}
-function saveCache2(file, cache) {
-  try {
-    writeOwnerOnlyFileAtomic(file, `${JSON.stringify(cache, null, 2)}
-`);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function mergeSuccessfulCache(committed, latestVersion, successAt) {
-  if (committed.latestVersion === undefined || committed.successAt === undefined) {
-    return { latestVersion, successAt };
-  }
-  if (committed.successAt > successAt)
-    return committed;
-  if (committed.successAt < successAt)
-    return { latestVersion, successAt };
-  const committedVersion = parseSemVer(committed.latestVersion);
-  const candidateVersion = parseSemVer(latestVersion);
-  if (committedVersion !== undefined && candidateVersion !== undefined) {
-    const precedence = compareSemVer(committedVersion, candidateVersion);
-    if (precedence > 0)
-      return committed;
-    if (precedence < 0)
-      return { latestVersion, successAt };
-    if (committed.latestVersion >= latestVersion)
-      return committed;
-  }
-  return { latestVersion, successAt };
-}
-async function updateCache(file, update) {
-  try {
-    return await withFileLock(`${file}.lock`, async () => saveCache2(file, update(parseCache(file) ?? {})), {
-      timeoutMs: CACHE_LOCK_TIMEOUT_MS2,
-      retryMs: CACHE_LOCK_RETRY_MS2,
-      staleMs: CACHE_LOCK_STALE_MS2
-    });
-  } catch {
-    return false;
-  }
-}
-async function checkVersion(options) {
-  const current = parseSemVer(options.currentVersion);
-  if (current === undefined)
-    return unavailable(options.currentVersion, "invalid-current-version");
-  const now = options.now ?? Date.now;
-  const timestamp = now();
-  const configDir = ensureKeryxConfigDir(options.cacheDir);
-  const cacheFile = path308.join(configDir, "version-check.json");
-  const cache = parseCache(cacheFile);
-  if (cache?.latestVersion !== undefined && cache.successAt !== undefined && timestamp - cache.successAt >= 0 && timestamp - cache.successAt < SUCCESS_CACHE_TTL_MS) {
-    return resultFor(options.currentVersion, current, cache.latestVersion, "cache");
-  }
-  if (cache?.failureAt !== undefined && timestamp - cache.failureAt >= 0 && timestamp - cache.failureAt < FAILURE_BACKOFF_MS) {
-    return unavailable(options.currentVersion, "suppressed", cache);
-  }
-  const fetchImpl = options.fetch ?? globalThis.fetch;
-  const controller = new AbortController;
-  const timer = options.timer ?? SYSTEM_TIMER;
-  let timeout;
-  let timeoutScheduled = false;
-  let failure;
-  let latestVersion;
-  try {
-    timeout = timer.schedule(() => controller.abort(), REQUEST_TIMEOUT_MS);
-    timeoutScheduled = true;
-    const response = await fetchImpl(REGISTRY_URL, {
-      method: "GET",
-      headers: { accept: "application/json" },
-      signal: controller.signal,
-      credentials: "omit"
-    });
-    if (!response.ok) {
-      failure = "http";
-    } else {
-      const body = await boundedResponseText(response);
-      if (body === undefined) {
-        failure = "response-too-large";
-      } else {
-        let parsed;
-        try {
-          parsed = JSON.parse(body);
-        } catch {
-          parsed = undefined;
-        }
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-          failure = "malformed-response";
-        } else {
-          const record = parsed;
-          if (record.name !== "@mrciphersmith/keryx" || typeof record.version !== "string") {
-            failure = "malformed-response";
-          } else if (parseSemVer(record.version) === undefined) {
-            failure = "invalid-latest-version";
-          } else {
-            latestVersion = record.version;
-          }
-        }
-      }
-    }
-  } catch {
-    failure = controller.signal.aborted ? "timeout" : "network";
-  } finally {
-    if (timeoutScheduled) {
-      try {
-        timer.cancel(timeout);
-      } catch {}
-    }
-  }
-  if (latestVersion === undefined) {
-    await updateCache(cacheFile, (committed) => ({ ...committed, failureAt: timestamp }));
-    return unavailable(options.currentVersion, failure ?? "network", cache);
-  }
-  await updateCache(cacheFile, (committed) => mergeSuccessfulCache(committed, latestVersion, timestamp));
-  return resultFor(options.currentVersion, current, latestVersion, "registry");
-}
-
 // src/tui/shell-chrome.ts
 init_debug_log();
 
@@ -143826,7 +144297,7 @@ init_model_tier();
 init_config_dir();
 init_fs();
 init_table();
-import path309 from "path";
+import path310 from "path";
 var UNCATEGORIZED = "uncategorized";
 var EMPTY_TASK_COST_STORE = {};
 var MIN_MEASURED_TASKS = 20;
@@ -143892,7 +144363,7 @@ var TASK_COST_LOCK_TIMEOUT_MS = 3000;
 var TASK_COST_LOCK_RETRY_MS = 15;
 var TASK_COST_LOCK_STALE_MS = 1e4;
 function taskCostFilePath(dir) {
-  return path309.join(ensureKeryxSubdir(["routing"], dir), TASK_COST_FILE);
+  return path310.join(ensureKeryxSubdir(["routing"], dir), TASK_COST_FILE);
 }
 function isTaskCostRecord(value) {
   if (typeof value !== "object" || value === null)
@@ -144956,11 +145427,11 @@ function openConform(otui, chrome, options) {
 }
 
 // src/tui/conform-source.ts
-import { readFile as readFile160, readdir as readdir55, stat as stat31 } from "fs/promises";
-import path310 from "path";
+import { readFile as readFile160, readdir as readdir56, stat as stat31 } from "fs/promises";
+import path311 from "path";
 async function readRecentConformDocs2(cwd) {
   try {
-    const raw = JSON.parse(await readFile160(path310.join(cwd, CONFORM_RECENTS_PATH), "utf8"));
+    const raw = JSON.parse(await readFile160(path311.join(cwd, CONFORM_RECENTS_PATH), "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -144981,25 +145452,25 @@ async function currentBranchPrTarget(cwd) {
   }
 }
 async function mostRecentReviewPackage(cwd) {
-  const flowsDir = path310.join(cwd, ".metaproject", "flows");
+  const flowsDir = path311.join(cwd, ".metaproject", "flows");
   let best;
   try {
-    for (const flowEntry of await readdir55(flowsDir, { withFileTypes: true })) {
+    for (const flowEntry of await readdir56(flowsDir, { withFileTypes: true })) {
       if (!flowEntry.isDirectory())
         continue;
-      const reviewsDir = path310.join(flowsDir, flowEntry.name, "reviews");
+      const reviewsDir = path311.join(flowsDir, flowEntry.name, "reviews");
       let reviewEntries;
       try {
-        reviewEntries = await readdir55(reviewsDir, { withFileTypes: true });
+        reviewEntries = await readdir56(reviewsDir, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const reviewEntry of reviewEntries) {
         if (!reviewEntry.isDirectory())
           continue;
-        const dir = path310.join(reviewsDir, reviewEntry.name);
+        const dir = path311.join(reviewsDir, reviewEntry.name);
         try {
-          const info = await stat31(path310.join(dir, "report.md"));
+          const info = await stat31(path311.join(dir, "report.md"));
           if (best === undefined || info.mtimeMs > best.mtimeMs)
             best = { dir, mtimeMs: info.mtimeMs };
         } catch {}
@@ -145025,14 +145496,14 @@ async function loadConformSetup(cwd) {
     targets.push(pr);
   const reviewDir = await mostRecentReviewPackage(cwd);
   if (reviewDir !== undefined) {
-    targets.push({ id: `report:${reviewDir}`, kind: "report", label: `most recent review package \u2014 ${path310.relative(cwd, reviewDir)}` });
+    targets.push({ id: `report:${reviewDir}`, kind: "report", label: `most recent review package \u2014 ${path311.relative(cwd, reviewDir)}` });
   }
   targets.push({ id: "diff:working", kind: "diff", label: "the working diff" });
   return { recents, targets };
 }
 async function readReportFindings2(reportDir) {
   try {
-    const raw = JSON.parse(await readFile160(path310.join(reportDir, "findings.json"), "utf8"));
+    const raw = JSON.parse(await readFile160(path311.join(reportDir, "findings.json"), "utf8"));
     return Array.isArray(raw) ? raw : [];
   } catch {
     return [];
@@ -145148,7 +145619,7 @@ async function runConformForTarget(cwd, refPath, target, signal) {
       await scoreHunkRegions(hunkClauses, hunkRegionsFromDiff(info.diff));
     } else if (target.kind === "report") {
       const reportDir = target.id.slice("report:".length);
-      const reportMarkdown = await readFile160(path310.join(reportDir, "report.md"), "utf8").catch(() => "");
+      const reportMarkdown = await readFile160(path311.join(reportDir, "report.md"), "utf8").catch(() => "");
       const findings = await readReportFindings2(reportDir);
       const facts = computeReportConformFacts(reportMarkdown, findings);
       const redacted = reportRedactedStateText(reportMarkdown);
@@ -145174,7 +145645,7 @@ async function runConformForTarget(cwd, refPath, target, signal) {
 async function writeRecentConformDoc(cwd, refPath) {
   await Promise.resolve().then(() => init_fs());
   const current = await readRecentConformDocs2(cwd);
-  await writeFileAtomic(path310.join(cwd, CONFORM_RECENTS_PATH), `${JSON.stringify(withRecentDoc(current, refPath), null, 2)}
+  await writeFileAtomic(path311.join(cwd, CONFORM_RECENTS_PATH), `${JSON.stringify(withRecentDoc(current, refPath), null, 2)}
 `, {
     mode: 384
   }).catch(() => {});
@@ -145310,8 +145781,8 @@ async function runJevContractForShell(cwd, gitDiff = defaultGitDiff3) {
 }
 
 // src/tui/jev-triage-command.ts
-import { readdir as readdir56, readFile as readFile161, stat as stat32 } from "fs/promises";
-import path311 from "path";
+import { readdir as readdir57, readFile as readFile161, stat as stat32 } from "fs/promises";
+import path312 from "path";
 var JEV_TRIAGE_COMMAND = "/triage";
 function isJevTriageCommand(name) {
   return name === JEV_TRIAGE_COMMAND;
@@ -145320,25 +145791,25 @@ function renderJevTriageForShell(result) {
   return renderTriageMarkdown(result).trimEnd();
 }
 async function resolveLatestReviewPackage(cwd) {
-  const flowsDir = path311.join(cwd, ".metaproject", "flows");
+  const flowsDir = path312.join(cwd, ".metaproject", "flows");
   let flowEntries;
   try {
-    flowEntries = (await readdir56(flowsDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+    flowEntries = (await readdir57(flowsDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return;
   }
   const candidates = [];
   for (const flowName of flowEntries) {
-    const reviewsDir = path311.join(flowsDir, flowName, "reviews");
+    const reviewsDir = path312.join(flowsDir, flowName, "reviews");
     let reviewEntries;
     try {
-      reviewEntries = (await readdir56(reviewsDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+      reviewEntries = (await readdir57(reviewsDir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
     } catch {
       continue;
     }
     for (const reviewName of reviewEntries) {
-      const packageDir = path311.join(reviewsDir, reviewName);
-      const findingsPath = path311.join(packageDir, "findings.json");
+      const packageDir = path312.join(reviewsDir, reviewName);
+      const findingsPath = path312.join(packageDir, "findings.json");
       try {
         const stats = await stat32(findingsPath);
         candidates.push({ dir: packageDir, mtimeMs: stats.mtimeMs });
@@ -145361,9 +145832,9 @@ async function runJevTriageForShell(cwd) {
   if (packageDir === undefined) {
     return "review-jev-triage: no review package found under .metaproject/flows/*/reviews/ \u2014 run a review round first.";
   }
-  const findingsRaw = JSON.parse(await readFile161(path311.join(packageDir, "findings.json"), "utf8"));
+  const findingsRaw = JSON.parse(await readFile161(path312.join(packageDir, "findings.json"), "utf8"));
   const result = await computeJevTriageResult({ findingsRaw });
-  return `review-jev-triage: ${path311.relative(cwd, packageDir)}
+  return `review-jev-triage: ${path312.relative(cwd, packageDir)}
 ${renderJevTriageForShell(result)}`;
 }
 
@@ -148277,10 +148748,10 @@ function openHelpModal(otui, chrome, options) {
 
 // src/tui/help-first-run.ts
 init_config_dir();
-import path312 from "path";
+import path313 from "path";
 var FIRST_RUN_HELP_FILE = "help-first-run.json";
 function firstRunHelpPath(dir) {
-  return path312.join(keryxConfigDir(dir), FIRST_RUN_HELP_FILE);
+  return path313.join(keryxConfigDir(dir), FIRST_RUN_HELP_FILE);
 }
 function helpFirstRunShown(dir) {
   const result = readConfigFile(firstRunHelpPath(dir));
@@ -149364,10 +149835,10 @@ function describeElicitationPrompt(tool, inputJson) {
 // src/lib/permission-mode-config.ts
 init_permission_mode();
 init_config_dir();
-import path313 from "path";
+import path314 from "path";
 var EMPTY3 = { schemaVersion: 1, projects: {} };
 function permissionModeConfigPath(dir) {
-  return path313.join(keryxConfigDir(dir), "permission-mode.json");
+  return path314.join(keryxConfigDir(dir), "permission-mode.json");
 }
 function withRegistryLock2(dir, fn) {
   return withFileLock2(`${permissionModeConfigPath(dir)}.lock`, fn, {
@@ -152316,7 +152787,7 @@ function mountExecutionPlanPanel(otui, renderer, parent, options) {
 // src/commands/schedule.ts
 import { createInterface } from "readline/promises";
 import { readFile as readFile162 } from "fs/promises";
-import path315 from "path";
+import path316 from "path";
 
 // src/commands/trigger.ts
 init_gdgraph();
@@ -152327,9 +152798,9 @@ init_agent();
 init_agent_hooks();
 import { execFile as execFile11 } from "child_process";
 import { randomUUID as randomUUID36 } from "crypto";
-import { mkdtemp as mkdtemp5, mkdir as mkdir68, readdir as readdir57, rm as rm19, writeFile as writeFile47 } from "fs/promises";
+import { mkdtemp as mkdtemp5, mkdir as mkdir68, readdir as readdir58, rm as rm19, writeFile as writeFile47 } from "fs/promises";
 import { homedir as homedir13, tmpdir as tmpdir11 } from "os";
-import path314 from "path";
+import path315 from "path";
 init_interactive_tools();
 
 // src/harness/process/sandbox/proxy.ts
@@ -152797,9 +153268,9 @@ function refusal3(runId, code, detail, action) {
 function agentTaskScratchParent(env = process.env) {
   const uid = typeof process.getuid === "function" ? process.getuid() : 0;
   const runtime = env["XDG_RUNTIME_DIR"];
-  if (runtime !== undefined && runtime.length > 0 && path314.isAbsolute(runtime))
-    return path314.join(runtime, "keryx-agent-tasks");
-  return path314.join(tmpdir11(), `keryx-agent-tasks-${uid}`);
+  if (runtime !== undefined && runtime.length > 0 && path315.isAbsolute(runtime))
+    return path315.join(runtime, "keryx-agent-tasks");
+  return path315.join(tmpdir11(), `keryx-agent-tasks-${uid}`);
 }
 function lastAssistantText(history) {
   for (let i = history.length - 1;i >= 0; i -= 1) {
@@ -152810,9 +153281,9 @@ function lastAssistantText(history) {
   return "";
 }
 async function pruneReports(dir, keep) {
-  const names = (await readdir57(dir).catch(() => [])).filter((n) => n.endsWith(".md")).sort();
+  const names = (await readdir58(dir).catch(() => [])).filter((n) => n.endsWith(".md")).sort();
   for (const old of names.slice(0, Math.max(0, names.length - keep))) {
-    await rm19(path314.join(dir, old), { force: true }).catch(() => {});
+    await rm19(path315.join(dir, old), { force: true }).catch(() => {});
   }
 }
 async function runAgentTaskDispatch(projectRoot, entry, action, deps = {}) {
@@ -152849,10 +153320,10 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
     };
   }
   const scratchParent = parent.dir;
-  const scratch = await mkdtemp5(path314.join(scratchParent, `${entry.name.replace(/[^A-Za-z0-9._-]/g, "-")}-`));
-  const workdir = path314.join(scratch, "work");
-  const scratchHome = path314.join(scratch, "home");
-  const grantedCwd = path314.join(scratch, "granted-cwd");
+  const scratch = await mkdtemp5(path315.join(scratchParent, `${entry.name.replace(/[^A-Za-z0-9._-]/g, "-")}-`));
+  const workdir = path315.join(scratch, "work");
+  const scratchHome = path315.join(scratch, "home");
+  const grantedCwd = path315.join(scratch, "granted-cwd");
   await mkdir68(workdir, { recursive: true });
   await mkdir68(scratchHome, { recursive: true });
   await mkdir68(grantedCwd, { recursive: true, mode: 448 });
@@ -152865,7 +153336,7 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
     const invocation = keryxInvocation();
     let networkInput = action.grants.network === "full";
     if (action.grants.network === "allowlist") {
-      const proxySocketPath = path314.join(scratch, "net-proxy.sock");
+      const proxySocketPath = path315.join(scratch, "net-proxy.sock");
       try {
         const proxy = await createAllowlistProxy({
           allowedDomains: [...action.grants.domains],
@@ -152950,7 +153421,12 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
       const env = deps.grantedEnv ?? process.env;
       const extraSecrets = await ghAuthToken(binaries.realpaths["gh"], grantedCwd, env);
       const granted = action.grants.tools.map((id) => grantedToolSpec(id)).filter((spec) => spec !== undefined).map((spec) => grantedTool(spec, action, grantedCwd, env, grantedCalls, binaries.realpaths, extraSecrets, binaries.stats));
-      const tools = [...builtinReadOnlyTools(projectRoot), shellExecTool(workdir, sandboxedRunner(workdir, sandbox)), ...granted];
+      const tools = [
+        ...builtinReadOnlyTools(projectRoot),
+        shellExecTool(workdir, sandboxedRunner(workdir, sandbox)),
+        ...granted,
+        ...deps.extraTools ?? []
+      ];
       const offending = tools.filter((t) => UNATTENDED_EXCLUDED_TOOLS.includes(t.definition.name));
       if (offending.length > 0)
         throw new Error(`agent-task roster must not offer: ${offending.map((t) => t.definition.name).join(", ")}`);
@@ -153000,6 +153476,9 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
       };
       const result = await runAgentTurn(io, agentDeps, history, buildAgentTaskPrompt(entry, action), { signal: controller.signal });
       finishReason = result.finishReason;
+      if (result.caughtToolErrors !== undefined && result.caughtToolErrors.length > 0) {
+        crashed = result.caughtToolErrors.map((e) => `${e.toolName}: ${e.message}`).join("; ");
+      }
     } catch (error) {
       crashed = error instanceof Error ? error.message : String(error);
     } finally {
@@ -153014,12 +153493,12 @@ async function runLocked(projectRoot, entry, action, deps, runId, now) {
     let reportNote = "";
     try {
       await ensureTriggerDataIgnored(projectRoot);
-      const dir = path314.join(triggerReportsDir(projectRoot), entry.name);
+      const dir = path315.join(triggerReportsDir(projectRoot), entry.name);
       await mkdir68(dir, { recursive: true });
-      const file = path314.join(dir, `${runId}.md`);
+      const file = path315.join(dir, `${runId}.md`);
       await writeFile47(file, renderReport2({ entry, action, runId, at: now().toISOString(), outcome, why, cost, grantedCalls, denials, sandboxNote, summary, networkDecisions }), "utf8");
       await pruneReports(dir, action.report.keep);
-      reportPath = path314.relative(projectRoot, file);
+      reportPath = path315.relative(projectRoot, file);
     } catch (error) {
       reportNote = ` (report NOT written: ${error instanceof Error ? error.message : String(error)})`;
     }
@@ -153927,7 +154406,7 @@ async function showSubcommand(cwd, name, host, deps) {
   if (row.reportPath !== undefined) {
     console.log(`
 --- ${row.reportPath} ---`);
-    console.log(await readFile162(path315.join(cwd, row.reportPath), "utf8").catch(() => "(the report could not be read)"));
+    console.log(await readFile162(path316.join(cwd, row.reportPath), "utf8").catch(() => "(the report could not be read)"));
   }
 }
 async function simpleAction(cwd, name, verb, action) {
@@ -155089,14 +155568,19 @@ function attachUsageIo(io, chrome) {
     }
   });
 }
-function estimateTaskCostUsd(profile, inputTokens, outputTokens) {
+var OPENAI_CACHED_INPUT_DISCOUNT = 0.5;
+function estimateTaskCostUsd(profile, providerId, inputTokens, outputTokens, cacheReadTokens) {
   if (profile === undefined)
     return;
   const priceIn = profile.priceInputPerMillion.value;
   const priceOut = profile.priceOutputPerMillion.value;
   if (priceIn === "unknown" || priceOut === "unknown")
     return;
-  return inputTokens / 1e6 * priceIn + outputTokens / 1e6 * priceOut;
+  const cachedInputDiscount = providerId === "openai" || providerId === "openai-codex" ? OPENAI_CACHED_INPUT_DISCOUNT : 1;
+  const cacheRead = cacheReadTokens !== undefined && cacheReadTokens > 0 ? Math.min(cacheReadTokens, inputTokens) : 0;
+  const fullPriceInputTokens = inputTokens - cacheRead;
+  const inputCost = fullPriceInputTokens / 1e6 * priceIn + cacheRead / 1e6 * priceIn * cachedInputDiscount;
+  return inputCost + outputTokens / 1e6 * priceOut;
 }
 async function recordTurnTaskCostBestEffort(input) {
   if (input.inputTokens === 0 && input.outputTokens === 0)
@@ -155104,7 +155588,7 @@ async function recordTurnTaskCostBestEffort(input) {
   try {
     const profiles = loadModelProfiles(input.userConfigDir);
     const profile = profiles[profileKey(input.providerId, input.modelId)];
-    const costUsd = estimateTaskCostUsd(profile, input.inputTokens, input.outputTokens);
+    const costUsd = estimateTaskCostUsd(profile, input.providerId, input.inputTokens, input.outputTokens, input.cacheReadTokens);
     await appendTaskCostRecord({
       providerId: input.providerId,
       modelId: input.modelId,
@@ -159560,6 +160044,14 @@ ${formatThemeList(getThemeId())}`);
           });
           return;
         }
+        if (command.name === "/doctor") {
+          (async () => {
+            const report = await buildDoctorReport(sessionCwd);
+            io.onSystem?.(`${formatDoctorReport2(report)}
+`);
+          })();
+          return;
+        }
         if (command.name === "/game") {
           showGame(line);
           return;
@@ -159870,10 +160362,12 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
       };
       let turnInputTokens = 0;
       let turnOutputTokens = 0;
+      let turnCacheReadTokens = 0;
       const prevOnUsageForCost = io.onUsage;
       io.onUsage = (usage) => {
         turnInputTokens += usage.inputTokens ?? 0;
         turnOutputTokens += usage.outputTokens ?? 0;
+        turnCacheReadTokens += usage.cacheReadTokens ?? 0;
         prevOnUsageForCost?.(usage);
       };
       const suggestNextStep = async () => {
@@ -159973,6 +160467,7 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
             modelId: deps.modelId,
             inputTokens: turnInputTokens,
             outputTokens: turnOutputTokens,
+            ...turnCacheReadTokens > 0 ? { cacheReadTokens: turnCacheReadTokens } : {},
             success: !turnFailed,
             ...turnCategory !== undefined ? { category: turnCategory } : {}
           });
@@ -160515,6 +161010,7 @@ var READLINE_AGENT_COMMANDS = [
   "/compact",
   "/status",
   "/flows",
+  "/doctor",
   "/theme",
   "/mode",
   "/reasoning",
@@ -161025,6 +161521,12 @@ Kept the current session.
           system(HELP_TEXT);
           continue;
         }
+        if (command === "/doctor") {
+          const report = await buildDoctorReport(deps.session?.cwd ?? process.cwd());
+          system(`${formatDoctorReport2(report)}
+`);
+          continue;
+        }
         if (isSessionInfoCommand(command)) {
           const cwd = deps.session?.cwd;
           const [workspaces, flows] = cwd === undefined ? [[], []] : await Promise.all([loadInspectorWorkspaces(cwd), loadInspectorFlows(cwd)]);
@@ -161579,7 +162081,9 @@ async function runAgentRepl(lines, rich, deps, metaprojectPort, sessionOpts, ini
       return settled;
     }
     const completion = new Promise((resolve) => {
+      completionWaiters = [];
       completionWaiters.push(() => resolve({ kind: "completion" }));
+      rich.onCompletionWaitersSize?.(completionWaiters.length);
     });
     const winner = await Promise.race([pendingLine, completion]);
     if (winner.kind !== "completion") {
@@ -162194,6 +162698,10 @@ ${GUTTER}${turnSeparator()}
           await runBusSlashCommand(bus, rest, (text) => agentIo.onSystem?.(text));
         } else if (command === "/help") {
           agentIo.onSystem?.(readlineAgentHelpText());
+        } else if (command === "/doctor") {
+          const report = await buildDoctorReport(sessionCwd);
+          agentIo.onSystem?.(`${formatDoctorReport2(report)}
+`);
         } else if (isSessionInfoCommand(command)) {
           const cwd = sessionCwd;
           const [workspaces, flows] = await Promise.all([
@@ -162240,6 +162748,8 @@ ${GUTTER}${turnSeparator()}
             continue;
           }
           await closeSlateSession(slateSession, mintTimestampAttemptId);
+          lastToolOutput = undefined;
+          lastToolName = undefined;
           if (nextLive !== undefined) {
             live = nextLive;
             history = [];
@@ -165738,7 +166248,7 @@ init_fs();
 init_prompt();
 import { readFile as readFile163 } from "fs/promises";
 import { stdin } from "process";
-import path317 from "path";
+import path318 from "path";
 init_ui();
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
@@ -165785,8 +166295,8 @@ async function modulesCommand(args = []) {
     return;
   }
   const wantsJson = args.includes("--json") && (sub === undefined || sub === "status" || sub === "list" || sub === "--json");
-  const metaprojectRoot = path317.join(process.cwd(), ".metaproject");
-  const manifestPath = path317.join(metaprojectRoot, "metaproject.json");
+  const metaprojectRoot = path318.join(process.cwd(), ".metaproject");
+  const manifestPath = path318.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     if (wantsJson) {
       console.log(JSON.stringify({ schemaVersion: 1, error: "not-initialized", modules: [] }, null, 2));
@@ -165909,7 +166419,7 @@ import { createHash as createHash68, randomBytes as randomBytes11, randomUUID as
 import {
   chmodSync as chmodSync5,
   closeSync as closeSync7,
-  existsSync as existsSync48,
+  existsSync as existsSync49,
   fsyncSync as fsyncSync2,
   openSync as openSync8,
   renameSync as renameSync5,
@@ -165917,9 +166427,9 @@ import {
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync10
 } from "fs";
-import path318 from "path";
+import path319 from "path";
 function serveCredentialPath(dir) {
-  return path318.join(keryxConfigDir(dir), "serve-credentials.json");
+  return path319.join(keryxConfigDir(dir), "serve-credentials.json");
 }
 function constantTimeEqual(a, b) {
   const width = Math.max(a.length, b.length);
@@ -165953,7 +166463,7 @@ function isGroupOrOtherAccessible(file) {
 }
 function readServeCredential(dir) {
   const file = serveCredentialPath(dir);
-  if (!existsSync48(file)) {
+  if (!existsSync49(file)) {
     return { status: "absent" };
   }
   if (isGroupOrOtherAccessible(file)) {
@@ -166152,23 +166662,23 @@ class AuthFailureThrottle {
 // src/lib/serve-turn-store.ts
 init_config_dir();
 import { createHash as createHash69 } from "crypto";
-import { existsSync as existsSync49, readdirSync as readdirSync12, rmSync as rmSync4 } from "fs";
-import path319 from "path";
+import { existsSync as existsSync50, readdirSync as readdirSync12, rmSync as rmSync4 } from "fs";
+import path320 from "path";
 var MAX_TURN_EVENTS = 1e4;
 function turnsRoot(dir) {
-  return path319.join(keryxConfigDir(dir), "turns");
+  return path320.join(keryxConfigDir(dir), "turns");
 }
 function turnDir(turnId, dir) {
-  return path319.join(turnsRoot(dir), turnId);
+  return path320.join(turnsRoot(dir), turnId);
 }
 function keyPath(project, idempotencyKey, dir) {
   const projectBytes = Buffer.byteLength(project, "utf8");
   const digest = createHash69("sha256").update(`${projectBytes}:${project}\x00${idempotencyKey}`, "utf8").digest("hex");
-  return path319.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path320.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function legacyKeyPath(idempotencyKey, dir) {
   const digest = createHash69("sha256").update(idempotencyKey, "utf8").digest("hex");
-  return path319.join(turnsRoot(dir), "keys", `${digest}.json`);
+  return path320.join(turnsRoot(dir), "keys", `${digest}.json`);
 }
 function adoptLegacyClaim(project, idempotencyKey, dir) {
   const legacy = legacyKeyPath(idempotencyKey, dir);
@@ -166232,7 +166742,7 @@ function ensureTurnDir(turnId, dir) {
 }
 function createTurnRecord(record, dir) {
   ensureTurnDir(record.turnId, dir);
-  writeOwnerOnlyFile(path319.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
+  writeOwnerOnlyFile(path320.join(turnDir(record.turnId, dir), "turn.json"), `${JSON.stringify(record, null, 2)}
 `);
 }
 function appendTurnEvent(event, dir, opts) {
@@ -166241,12 +166751,12 @@ function appendTurnEvent(event, dir, opts) {
   }
   const line = JSON.stringify(event);
   try {
-    appendOwnerOnlyLine(path319.join(turnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path320.join(turnDir(event.turnId, dir), "events.jsonl"), line);
   } catch (error) {
     if (error?.code !== "ENOENT") {
       throw error;
     }
-    appendOwnerOnlyLine(path319.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
+    appendOwnerOnlyLine(path320.join(ensureTurnDir(event.turnId, dir), "events.jsonl"), line);
   }
   return true;
 }
@@ -166254,7 +166764,7 @@ function readTurnEvents(turnId, after = -1, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path319.join(turnDir(turnId, dir), "events.jsonl"));
+  const read = readTurnFile(path320.join(turnDir(turnId, dir), "events.jsonl"));
   if (!read.ok) {
     if (isDefiniteAbsence2(read.reason)) {
       return { ok: true, value: [] };
@@ -166282,7 +166792,7 @@ function readTurnRecord(turnId, dir) {
   if (!isTurnId(turnId)) {
     return { ok: false, reason: "not-a-turn-id" };
   }
-  const read = readTurnFile(path319.join(turnDir(turnId, dir), "turn.json"));
+  const read = readTurnFile(path320.join(turnDir(turnId, dir), "turn.json"));
   if (!read.ok) {
     return { ok: false, reason: read.reason };
   }
@@ -166301,7 +166811,7 @@ function finishTurn(turnId, result, dir) {
   if (!record.ok) {
     return false;
   }
-  writeOwnerOnlyFile(path319.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
+  writeOwnerOnlyFile(path320.join(turnDir(turnId, dir), "turn.json"), `${JSON.stringify({ ...record.value, result }, null, 2)}
 `);
   return true;
 }
@@ -166348,7 +166858,7 @@ function releaseIdempotencyKey(project, idempotencyKey, turnId, dir) {
 // src/lib/serve-turn.ts
 import { randomUUID as randomUUID44 } from "crypto";
 init_hooks();
-import path320 from "path";
+import path321 from "path";
 init_service4();
 init_service9();
 init_impact_evidence_hook_adapter();
@@ -166419,9 +166929,9 @@ function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
 }
 function resolveProject(declared, dir) {
-  const wanted = path320.resolve(declared);
+  const wanted = path321.resolve(declared);
   for (const entry of listProjects(dir, () => {})) {
-    if (path320.resolve(entry.path) === wanted) {
+    if (path321.resolve(entry.path) === wanted) {
       return { ok: true, project: entry.path };
     }
   }
@@ -166494,7 +167004,7 @@ function buildRemoteHookRuntime(opts) {
   });
   emitRemoteHookNotices(opts.projectRoot, formatHookLoadNotices(loaded, {
     projectRoot: opts.projectRoot,
-    userFile: path320.join(homeDir, ".keryx", "hooks.json"),
+    userFile: path321.join(homeDir, ".keryx", "hooks.json"),
     surface: "headless"
   }));
   if (!loaded.ok) {
@@ -167543,9 +168053,9 @@ function printHelp23() {
 // src/commands/update.ts
 init_contained_write();
 import { spawn as spawn9 } from "child_process";
-import { readFile as readFile164, readdir as readdir58 } from "fs/promises";
-import { access as access4, constants as constants5, existsSync as existsSync50 } from "fs";
-import path321 from "path";
+import { readFile as readFile164, readdir as readdir59 } from "fs/promises";
+import { access as access4, constants as constants5, existsSync as existsSync51 } from "fs";
+import path322 from "path";
 import { fileURLToPath as fileURLToPath10 } from "url";
 init_catalog2();
 init_model_choice();
@@ -167560,17 +168070,17 @@ init_ui();
 init_install_plan();
 init_templates3();
 function containFromMetaprojectPath(filePath) {
-  const marker = `${path321.sep}.metaproject${path321.sep}`;
+  const marker = `${path322.sep}.metaproject${path322.sep}`;
   const idx = filePath.lastIndexOf(marker);
   if (idx < 0) {
-    if (filePath.endsWith(`${path321.sep}.metaproject`)) {
-      const root = filePath.slice(0, filePath.length - ".metaproject".length - path321.sep.length);
+    if (filePath.endsWith(`${path322.sep}.metaproject`)) {
+      const root = filePath.slice(0, filePath.length - ".metaproject".length - path322.sep.length);
       return { root, rel: ".metaproject" };
     }
     throw new Error(`${filePath}: expected a path under a .metaproject directory`);
   }
   const root = filePath.slice(0, idx);
-  const rel = filePath.slice(idx + path321.sep.length).split(path321.sep).join("/");
+  const rel = filePath.slice(idx + path322.sep.length).split(path322.sep).join("/");
   return { root, rel };
 }
 async function updateCommand(args = []) {
@@ -167580,8 +168090,8 @@ async function updateCommand(args = []) {
     return;
   }
   const projectRoot = process.cwd();
-  const metaprojectRoot = path321.join(projectRoot, ".metaproject");
-  banner("keryx update", `Refreshing the .metaproject workspace in ${path321.basename(projectRoot)}/`);
+  const metaprojectRoot = path322.join(projectRoot, ".metaproject");
+  banner("keryx update", `Refreshing the .metaproject workspace in ${path322.basename(projectRoot)}/`);
   if (!await pathExists(metaprojectRoot)) {
     console.log(`  ${style.red(symbols.cross)} Metaproject is not initialized.`);
     console.log(`  ${style.cyan(symbols.arrow)} Run ${style.cyan("keryx init")} first.`);
@@ -167657,7 +168167,7 @@ async function updateCommand(args = []) {
   nextSteps(steps);
 }
 async function previewServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path321.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path322.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const enableTasks = moduleEnabled2(manifest, "tasks") || !options.noTasks;
@@ -167686,13 +168196,13 @@ async function previewServiceFiles(projectRoot, options) {
   });
 }
 async function refreshServiceFiles(projectRoot, options) {
-  const metaprojectRoot = path321.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path322.join(projectRoot, ".metaproject");
   const manifestState = await readManifest5(metaprojectRoot);
   const manifest = manifestState.manifest;
   const recoveredManifest = !manifestState.exists || !manifestState.valid;
   if (manifestState.migrated) {
     {
-      const { root, rel } = containFromMetaprojectPath(path321.join(metaprojectRoot, "metaproject.json"));
+      const { root, rel } = containFromMetaprojectPath(path322.join(metaprojectRoot, "metaproject.json"));
       await writeContained(root, rel, `${JSON.stringify(manifest, null, 2)}
 `);
     }
@@ -167732,9 +168242,9 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     enableSac
   });
-  await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
-  await writeTextIfChanged4(path321.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
-  await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
+  await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "README.md"), renderMetaprojectCoreReadme());
+  await writeTextIfChanged4(path322.join(metaprojectRoot, "hooks", "README.md"), renderHooksReadme());
+  await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "project-rules", "README.md"), renderProjectRulesSkillReadme({ sources: ruleSources }));
   await writeRoutingEntrypointPair(metaprojectRoot, {
     enableGdgraph,
     enableGdctx,
@@ -167758,7 +168268,7 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   });
   console.log(`  ${await describeModelChoiceStatus(projectRoot)}`);
-  await writeTextIfChanged4(path321.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
+  await writeTextIfChanged4(path322.join(metaprojectRoot, "keryx-dashboard.html"), renderMetaprojectDashboardHtml({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -167770,7 +168280,7 @@ async function refreshServiceFiles(projectRoot, options) {
     enableSecurity,
     data: dashboardData
   }));
-  await writeTextIfMissing4(path321.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
+  await writeTextIfMissing4(path322.join(metaprojectRoot, "README.md"), renderMetaprojectReadme({
     enableGdgraph,
     enableGdctx,
     enableGdwiki,
@@ -167783,9 +168293,9 @@ async function refreshServiceFiles(projectRoot, options) {
   }));
   if (enableGdgraph) {
     await installGdgraphCoreScripts2(metaprojectRoot);
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "gdgraph.md"), renderGdgraphManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "gdgraph", "README.md"), renderGdgraphCoreReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "gdgraph", "SKILL.md"), renderGdgraphSkillReadme());
     await seedAssetsLock(metaprojectRoot);
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       const warning = await installManagedHookOrWarn(projectRoot, "post-commit", "gdgraph-post-commit", renderGdgraphPostCommitHook());
@@ -167794,15 +168304,15 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableGdctx) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "gdctx.config.json"), renderGdctxConfig());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "gdctx.md"), renderGdctxManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "gdctx", "README.md"), renderGdctxCoreReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "gdctx", "SKILL.md"), renderGdctxSkillReadme());
   }
   if (enableGdwiki) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "wiki", "templates", "page.md"), renderWikiPageTemplate());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "gdwiki.md"), renderGdwikiManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "gdwiki", "SKILL.md"), renderGdwikiSkillReadme());
     if (manifest.modules?.gdgraph?.hooks?.gitPostCommit) {
       const warning = await installManagedHookOrWarn(projectRoot, "post-commit", "gdwiki-post-commit", renderGdwikiPostCommitHook());
       if (warning)
@@ -167810,8 +168320,8 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableSac) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "modules", "sac.md"), renderSacManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "sac", "SKILL.md"), renderSacSkillReadme());
   }
   let gdskillsWarnings = [];
   let gdskillsNotices = [];
@@ -167826,10 +168336,10 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableHealth) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "health.config.json"), renderHealthConfig());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "health.md"), renderHealthManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "health", "README.md"), renderHealthCoreReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "health", "SKILL.md"), renderHealthSkillReadme());
     if (manifest.modules?.health?.hooks?.gitPostCommit) {
       const warning = await installManagedHookOrWarn(projectRoot, "post-commit", "health-post-commit", renderHealthPostCommitHook());
       if (warning)
@@ -167837,16 +168347,16 @@ async function refreshServiceFiles(projectRoot, options) {
     }
   }
   if (enableTesting) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "testing.config.json"), renderTestingConfig({
       postCommitRefresh: Boolean(manifest.modules?.testing?.hooks?.gitPostCommit),
       prePushGate: Boolean(manifest.modules?.testing?.hooks?.prePush)
     }));
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "testing.md"), renderTestingManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "testing", "README.md"), renderTestingCoreReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "testing", "SKILL.md"), renderTestingSkillReadme());
     if (enableGdwiki) {
-      await writeTextIfMissing4(path321.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
-      await writeTextIfMissing4(path321.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
+      await writeTextIfMissing4(path322.join(metaprojectRoot, "wiki", "testing", "README.md"), renderTestingWikiReadme());
+      await writeTextIfMissing4(path322.join(metaprojectRoot, "wiki", "testing", "conventions.md"), renderTestingWikiConventions());
     }
     if (manifest.modules?.testing?.hooks?.gitPostCommit) {
       const warning = await installManagedHookOrWarn(projectRoot, "post-commit", "testing-post-commit", renderTestingPostCommitHook());
@@ -167865,24 +168375,24 @@ async function refreshServiceFiles(projectRoot, options) {
       hookWarnings.push(warning);
   }
   if (enableMemory) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "memory.config.json"), renderMemoryConfig());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "memory", "templates", "entry.md"), renderMemoryEntryTemplate());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "memory.md"), renderMemoryManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "memory", "README.md"), renderMemoryCoreReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "memory", "SKILL.md"), renderMemorySkillReadme());
   }
   if (enableTasks) {
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "flows", "README.md"), renderFlowsReadme());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "tasks.md"), renderTasksManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "flow", "SKILL.md"), renderFlowSkillRouter());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "flow", "init.md"), renderFlowInitSkill());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "flow", "manage.md"), renderFlowManageSkill());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "skills", "flow", "complete.md"), renderFlowCompleteSkill());
   }
   if (enableSecurity) {
-    await writeTextIfMissing4(path321.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
-    await writeTextIfChanged4(path321.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
+    await writeTextIfMissing4(path322.join(metaprojectRoot, "security.config.json"), renderSecurityConfig());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "modules", "security.md"), renderSecurityManifest());
+    await writeTextIfChanged4(path322.join(metaprojectRoot, "core", "security", "README.md"), renderSecurityCoreReadme());
     if (manifest.modules?.security?.hooks?.prePush) {
       const warning = await installManagedHookOrWarn(projectRoot, "pre-push", "security-pre-push", renderSecurityPrePushHook());
       if (warning)
@@ -167940,13 +168450,13 @@ async function refreshServiceFiles(projectRoot, options) {
   };
 }
 async function buildDashboard(projectRoot = process.cwd()) {
-  const metaprojectRoot = path321.join(projectRoot, ".metaproject");
+  const metaprojectRoot = path322.join(projectRoot, ".metaproject");
   if (!await pathExists(metaprojectRoot)) {
     throw new Error("Metaproject is not initialized. Run: keryx init");
   }
   const manifest = (await readManifest5(metaprojectRoot)).manifest;
   const data = await collectDashboardData(metaprojectRoot);
-  const dashboardPath = path321.join(metaprojectRoot, "keryx-dashboard.html");
+  const dashboardPath = path322.join(metaprojectRoot, "keryx-dashboard.html");
   await writeTextIfChanged4(dashboardPath, renderMetaprojectDashboardHtml({
     enableGdgraph: moduleEnabled2(manifest, "gdgraph"),
     enableGdctx: moduleEnabled2(manifest, "gdctx"),
@@ -167966,7 +168476,7 @@ async function shouldInstallDashboardPostCommitHook(projectRoot, manifest) {
   if (Object.values(modules).some((module) => Boolean(module.hooks?.gitPostCommit))) {
     return true;
   }
-  const hookPath = path321.join(projectRoot, ".git", "hooks", "post-commit");
+  const hookPath = path322.join(projectRoot, ".git", "hooks", "post-commit");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -167986,11 +168496,11 @@ async function collectDashboardData(metaprojectRoot) {
   if (testing) {
     data.testing = testing;
   }
-  const wiki = await collectMarkdownPages(path321.join(metaprojectRoot, "wiki"), "wiki");
+  const wiki = await collectMarkdownPages(path322.join(metaprojectRoot, "wiki"), "wiki");
   if (wiki.length > 0) {
     data.wiki = { pages: wiki };
   }
-  const memory = await collectMarkdownPages(path321.join(metaprojectRoot, "memory"), "memory");
+  const memory = await collectMarkdownPages(path322.join(metaprojectRoot, "memory"), "memory");
   if (memory.length > 0) {
     data.memory = { entries: memory };
   }
@@ -168005,19 +168515,19 @@ async function collectDashboardData(metaprojectRoot) {
   return data;
 }
 async function collectTasksDashboardData(metaprojectRoot) {
-  const flowsRoot = path321.join(metaprojectRoot, "flows");
+  const flowsRoot = path322.join(metaprojectRoot, "flows");
   if (!await pathExists(flowsRoot)) {
     return null;
   }
   let dirEntries;
   try {
-    dirEntries = (await readdir58(flowsRoot, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
+    dirEntries = (await readdir59(flowsRoot, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d{3}-/.test(entry.name)).map((entry) => entry.name).sort();
   } catch {
     return null;
   }
   const flows = [];
   for (const dir of dirEntries) {
-    const flowPath = path321.join(flowsRoot, dir, "flow.json");
+    const flowPath = path322.join(flowsRoot, dir, "flow.json");
     if (!await pathExists(flowPath)) {
       continue;
     }
@@ -168025,7 +168535,7 @@ async function collectTasksDashboardData(metaprojectRoot) {
       const flow = JSON.parse(await readFile164(flowPath, "utf8"));
       const tasks = Array.isArray(flow.tasks) ? flow.tasks : [];
       let acTotal = 0;
-      const acPath = path321.join(flowsRoot, dir, "acceptance-criteria.md");
+      const acPath = path322.join(flowsRoot, dir, "acceptance-criteria.md");
       if (await pathExists(acPath)) {
         const acContent = await readFile164(acPath, "utf8");
         acTotal = (acContent.match(/^- AC\d+:/gm) ?? []).length;
@@ -168079,7 +168589,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
     "data/testing/context.md"
   ];
   for (const href of staticHrefs) {
-    const filePath = path321.join(metaprojectRoot, ...href.split("/"));
+    const filePath = path322.join(metaprojectRoot, ...href.split("/"));
     if (!await pathExists(filePath)) {
       continue;
     }
@@ -168096,7 +168606,7 @@ async function collectDashboardDocs(metaprojectRoot, wiki, memory) {
   return docs;
 }
 async function collectHealthDashboardData(metaprojectRoot) {
-  const reportPath = path321.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
+  const reportPath = path322.join(metaprojectRoot, "data", "health", "artifacts", "latest.json");
   if (!await pathExists(reportPath)) {
     return;
   }
@@ -168205,8 +168715,8 @@ function metricToScope(metric) {
   };
 }
 async function collectGraphDashboardData(metaprojectRoot) {
-  const nodesPath = path321.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
-  const edgesPath = path321.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
+  const nodesPath = path322.join(metaprojectRoot, "data", "gdgraph", "storage", "nodes.jsonl");
+  const edgesPath = path322.join(metaprojectRoot, "data", "gdgraph", "storage", "edges.jsonl");
   if (!await pathExists(nodesPath) || !await pathExists(edgesPath)) {
     return;
   }
@@ -168257,8 +168767,8 @@ async function collectGraphDashboardData(metaprojectRoot) {
   };
 }
 async function collectTestingDashboardData(metaprojectRoot) {
-  const reportPath = path321.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
-  const contextPath = path321.join(metaprojectRoot, "data", "testing", "context.md");
+  const reportPath = path322.join(metaprojectRoot, "data", "testing", "artifacts", "latest.json");
+  const contextPath = path322.join(metaprojectRoot, "data", "testing", "context.md");
   if (await pathExists(reportPath)) {
     const report = JSON.parse(await readFile164(reportPath, "utf8"));
     const totalTests = numberOrUndefined(report.total);
@@ -168287,7 +168797,7 @@ async function collectMarkdownPages(root, hrefPrefix) {
   const files = await listMarkdownFiles(root);
   const pages = [];
   for (const filePath of files.slice(0, 40)) {
-    const relativePath = path321.relative(root, filePath).split(path321.sep).join("/");
+    const relativePath = path322.relative(root, filePath).split(path322.sep).join("/");
     if (relativePath === "index.md" || relativePath.startsWith("templates/")) {
       continue;
     }
@@ -168305,10 +168815,10 @@ async function collectMarkdownPages(root, hrefPrefix) {
   return pages;
 }
 async function listMarkdownFiles(root) {
-  const entries = await readdir58(root, { withFileTypes: true });
+  const entries = await readdir59(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path321.join(root, entry.name);
+    const fullPath = path322.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(fullPath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -168356,7 +168866,7 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
   const manifest = {
     schemaVersion: 1,
     standardVersion: STANDARD_VERSION,
-    name: `${path321.basename(path321.dirname(metaprojectRoot))}-metaproject`,
+    name: `${path322.basename(path322.dirname(metaprojectRoot))}-metaproject`,
     createdBy: "keryx",
     profiles: computeProfiles(enabledModuleKeys),
     paths: {
@@ -168447,13 +168957,13 @@ async function writeRecoveredManifest(metaprojectRoot, modules) {
     }
   };
   {
-    const { root, rel } = containFromMetaprojectPath(path321.join(metaprojectRoot, "metaproject.json"));
+    const { root, rel } = containFromMetaprojectPath(path322.join(metaprojectRoot, "metaproject.json"));
     await writeContained(root, rel, `${JSON.stringify(manifest, null, 2)}
 `);
   }
 }
 async function enableTasksInManifest(metaprojectRoot) {
-  const manifestPath = path321.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path322.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -168479,7 +168989,7 @@ async function enableTasksInManifest(metaprojectRoot) {
   }
 }
 async function updateManifestAgentEntrypoints(metaprojectRoot, ruleSources) {
-  const manifestPath = path321.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path322.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return;
   }
@@ -168547,61 +169057,61 @@ async function updateRuntime(projectRoot) {
   }
 }
 async function findRuntimeRoot(projectRoot) {
-  const projectRuntime = path321.join(projectRoot, ".metaproject", "runtime", "keryx");
-  if (await pathExists(path321.join(projectRuntime, ".git"))) {
+  const projectRuntime = path322.join(projectRoot, ".metaproject", "runtime", "keryx");
+  if (await pathExists(path322.join(projectRuntime, ".git"))) {
     return projectRuntime;
   }
   const home = process.env.HOME;
   if (!home) {
     return null;
   }
-  const globalRuntime = path321.join(home, ".keryx", "keryx");
-  if (await pathExists(path321.join(globalRuntime, ".git"))) {
+  const globalRuntime = path322.join(home, ".keryx", "keryx");
+  if (await pathExists(path322.join(globalRuntime, ".git"))) {
     return globalRuntime;
   }
   return null;
 }
 async function createServiceDirs(metaprojectRoot, modules) {
   const dirs = [
-    path321.join(metaprojectRoot, "core"),
-    path321.join(metaprojectRoot, "hooks", "post-update.d"),
-    path321.join(metaprojectRoot, "modules"),
-    path321.join(metaprojectRoot, "rules"),
-    path321.join(metaprojectRoot, "skills", "project-rules"),
+    path322.join(metaprojectRoot, "core"),
+    path322.join(metaprojectRoot, "hooks", "post-update.d"),
+    path322.join(metaprojectRoot, "modules"),
+    path322.join(metaprojectRoot, "rules"),
+    path322.join(metaprojectRoot, "skills", "project-rules"),
     ...modules.enableGdgraph ? [
-      path321.join(metaprojectRoot, "core", "gdgraph"),
-      path321.join(metaprojectRoot, "skills", "gdgraph")
+      path322.join(metaprojectRoot, "core", "gdgraph"),
+      path322.join(metaprojectRoot, "skills", "gdgraph")
     ] : [],
     ...modules.enableGdctx ? [
-      path321.join(metaprojectRoot, "core", "gdctx"),
-      path321.join(metaprojectRoot, "skills", "gdctx")
+      path322.join(metaprojectRoot, "core", "gdctx"),
+      path322.join(metaprojectRoot, "skills", "gdctx")
     ] : [],
     ...modules.enableGdwiki ? [
-      path321.join(metaprojectRoot, "skills", "gdwiki"),
-      path321.join(metaprojectRoot, "wiki", "templates")
+      path322.join(metaprojectRoot, "skills", "gdwiki"),
+      path322.join(metaprojectRoot, "wiki", "templates")
     ] : [],
     ...modules.enableHealth ? [
-      path321.join(metaprojectRoot, "core", "health"),
-      path321.join(metaprojectRoot, "skills", "health")
+      path322.join(metaprojectRoot, "core", "health"),
+      path322.join(metaprojectRoot, "skills", "health")
     ] : [],
     ...modules.enableTesting ? [
-      path321.join(metaprojectRoot, "core", "testing"),
-      path321.join(metaprojectRoot, "skills", "testing")
+      path322.join(metaprojectRoot, "core", "testing"),
+      path322.join(metaprojectRoot, "skills", "testing")
     ] : [],
     ...modules.enableMemory ? [
-      path321.join(metaprojectRoot, "core", "memory"),
-      path321.join(metaprojectRoot, "skills", "memory"),
-      path321.join(metaprojectRoot, "memory", "templates")
+      path322.join(metaprojectRoot, "core", "memory"),
+      path322.join(metaprojectRoot, "skills", "memory"),
+      path322.join(metaprojectRoot, "memory", "templates")
     ] : [],
     ...modules.enableTasks ? [
-      path321.join(metaprojectRoot, "flows"),
-      path321.join(metaprojectRoot, "skills", "flow")
+      path322.join(metaprojectRoot, "flows"),
+      path322.join(metaprojectRoot, "skills", "flow")
     ] : [],
     ...modules.enableSecurity ? [
-      path321.join(metaprojectRoot, "core", "security")
+      path322.join(metaprojectRoot, "core", "security")
     ] : [],
     ...modules.enableSac ? [
-      path321.join(metaprojectRoot, "skills", "sac")
+      path322.join(metaprojectRoot, "skills", "sac")
     ] : []
   ];
   await Promise.all(dirs.map((dir) => {
@@ -168610,22 +169120,22 @@ async function createServiceDirs(metaprojectRoot, modules) {
   }));
 }
 async function installGdgraphCoreScripts2(metaprojectRoot) {
-  const gdgraphCoreRoot = path321.join(metaprojectRoot, "core", "gdgraph");
+  const gdgraphCoreRoot = path322.join(metaprojectRoot, "core", "gdgraph");
   {
     const { root, rel } = containFromMetaprojectPath(gdgraphCoreRoot);
     await mkdirContained(root, rel);
   }
   for (const file of GDGRAPH_CORE_SOURCES) {
-    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path321.join(gdgraphCoreRoot, file));
+    await copyFileIfChanged2(runtimeSourcePath2(`../gdgraph/${file}`), path322.join(gdgraphCoreRoot, file));
   }
-  await writeTextIfChanged4(path321.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
+  await writeTextIfChanged4(path322.join(gdgraphCoreRoot, "cli.ts"), renderGdgraphCoreCli());
 }
 async function prePushHasSecurityBlock2(projectRoot) {
   const hooksRoot = await resolveGitHooksRoot(projectRoot);
   if (!hooksRoot) {
     return false;
   }
-  const hookPath = path321.join(hooksRoot, "pre-push");
+  const hookPath = path322.join(hooksRoot, "pre-push");
   if (!await pathExists(hookPath)) {
     return false;
   }
@@ -168640,7 +169150,7 @@ async function agentSettingsHasSecuritySentinel2(projectRoot) {
   return (await readFile164(file, "utf8")).includes(AGENT_HOOKS_SENTINEL);
 }
 async function readManifest5(metaprojectRoot) {
-  const manifestPath = path321.join(metaprojectRoot, "metaproject.json");
+  const manifestPath = path322.join(metaprojectRoot, "metaproject.json");
   if (!await pathExists(manifestPath)) {
     return {
       exists: false,
@@ -168709,7 +169219,7 @@ async function inferManifestFromExistingMetaproject(metaprojectRoot) {
 }
 async function anyPathExists(root, candidates) {
   for (const candidate of candidates) {
-    if (await pathExists(path321.join(root, candidate))) {
+    if (await pathExists(path322.join(root, candidate))) {
       return true;
     }
   }
@@ -168732,13 +169242,13 @@ function parseUpdateArgs(args) {
   };
 }
 async function runPostUpdateHooks(projectRoot) {
-  const hooksDir = path321.join(projectRoot, ".metaproject", "hooks", "post-update.d");
+  const hooksDir = path322.join(projectRoot, ".metaproject", "hooks", "post-update.d");
   if (!await pathExists(hooksDir)) {
     return;
   }
-  const entries = (await readdir58(hooksDir)).sort();
+  const entries = (await readdir59(hooksDir)).sort();
   for (const entry of entries) {
-    const hookPath = path321.join(hooksDir, entry);
+    const hookPath = path322.join(hooksDir, entry);
     try {
       await accessExecutable(hookPath);
     } catch {
@@ -168799,12 +169309,12 @@ async function copyFileIfChanged2(from, to) {
 }
 function runtimeSourcePath2(relativePath) {
   const directPath = fileURLToPath10(new URL(relativePath, import.meta.url));
-  if (existsSync50(directPath)) {
+  if (existsSync51(directPath)) {
     return directPath;
   }
   if (relativePath.startsWith("../")) {
-    const packagedSourcePath = path321.join(path321.dirname(fileURLToPath10(import.meta.url)), "..", "src", relativePath.slice(3));
-    if (existsSync50(packagedSourcePath)) {
+    const packagedSourcePath = path322.join(path322.dirname(fileURLToPath10(import.meta.url)), "..", "src", relativePath.slice(3));
+    if (existsSync51(packagedSourcePath)) {
       return packagedSourcePath;
     }
   }
@@ -168835,7 +169345,7 @@ function printHelp24() {
 
 // src/commands/dashboard.ts
 import { spawn as spawn10 } from "child_process";
-import path322 from "path";
+import path323 from "path";
 init_args();
 init_ui();
 async function dashboardCommand(args = []) {
@@ -168847,7 +169357,7 @@ async function dashboardCommand(args = []) {
   }
   if (subcommand === "build") {
     const result = await buildDashboard();
-    const rel = path322.relative(process.cwd(), result.path);
+    const rel = path323.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Dashboard built ${style.cyan(symbols.arrow)} ${style.cyan(rel)}`);
     note(`Open it: keryx dashboard open`);
     return;
@@ -168855,7 +169365,7 @@ async function dashboardCommand(args = []) {
   if (subcommand === "open") {
     const result = await buildDashboard();
     await openFile(result.path);
-    const rel = path322.relative(process.cwd(), result.path);
+    const rel = path323.relative(process.cwd(), result.path);
     console.log(`  ${style.green(symbols.ok)} Opened ${style.cyan(rel)}`);
     return;
   }
@@ -168906,7 +169416,7 @@ import { readFileSync as readFileSync27 } from "fs";
 import { randomUUID as randomUUID46 } from "crypto";
 import { mkdir as mkdir69 } from "fs/promises";
 import { tmpdir as tmpdir12 } from "os";
-import path323 from "path";
+import path324 from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/harness/external-agent-probe.ts
@@ -169168,7 +169678,7 @@ async function runCommand4(args, deps, log) {
   const requestApproval = unattended ? undefined : seams.requestApproval ?? terminalApprover();
   const timeoutRaw = optionValue(args, "--timeout");
   const timeoutMs = timeoutRaw !== undefined && Number.isInteger(Number(timeoutRaw)) && Number(timeoutRaw) > 0 ? Number(timeoutRaw) : gate.config.defaultTimeoutMs;
-  const worktreesDir = path323.join(tmpdir12(), "keryx-external-worktrees");
+  const worktreesDir = path324.join(tmpdir12(), "keryx-external-worktrees");
   const worktree = seams.worktree ?? createGitWorktreePort({ repoRoot: cwd, worktreesDir });
   if (seams.worktree === undefined)
     await mkdir69(worktreesDir, { recursive: true });
@@ -169256,8 +169766,8 @@ init_service8();
 init_bundled_eval();
 init_args();
 init_ui();
-import { existsSync as existsSync51, lstatSync as lstatSync7, readFileSync as readFileSync26, writeFileSync as writeFileSync11 } from "fs";
-import path324 from "path";
+import { existsSync as existsSync52, lstatSync as lstatSync7, readFileSync as readFileSync26, writeFileSync as writeFileSync11 } from "fs";
+import path325 from "path";
 function resolveDeps(deps) {
   return {
     cwd: deps.cwd ?? process.cwd(),
@@ -169590,11 +170100,11 @@ function generateCommand(args, depsIn) {
     process.exitCode = 1;
     return;
   }
-  const bundledAgentsRoot = path324.join(depsIn.bundledRoot ?? defaultBundledRoot(), "agents");
-  const stacksRoot = path324.join(bundledAgentsRoot, "..", "stacks");
-  const packDir = path324.join(stacksRoot, stackId);
-  const packJsonPath = path324.join(packDir, "pack.json");
-  if (!existsSync51(packJsonPath)) {
+  const bundledAgentsRoot = path325.join(depsIn.bundledRoot ?? defaultBundledRoot(), "agents");
+  const stacksRoot = path325.join(bundledAgentsRoot, "..", "stacks");
+  const packDir = path325.join(stacksRoot, stackId);
+  const packJsonPath = path325.join(packDir, "pack.json");
+  if (!existsSync52(packJsonPath)) {
     error(`No stack pack "${stackId}" found at ${packJsonPath}.`);
     process.exitCode = 1;
     return;
@@ -169640,9 +170150,9 @@ function generateCommand(args, depsIn) {
   }
   const prepared = [];
   for (const file of generatedFiles) {
-    const filePath = path324.join(bundledAgentsRoot, file.fileName);
-    const relative = path324.relative(bundledAgentsRoot, filePath);
-    if (relative.startsWith("..") || path324.isAbsolute(relative)) {
+    const filePath = path325.join(bundledAgentsRoot, file.fileName);
+    const relative = path325.relative(bundledAgentsRoot, filePath);
+    if (relative.startsWith("..") || path325.isAbsolute(relative)) {
       error(`Refusing to write "${file.fileName}": it resolves outside the bundled agents directory.`);
       process.exitCode = 1;
       return;
@@ -169963,7 +170473,7 @@ function printBootstrapHelp() {
 // src/commands/metrics.ts
 init_args();
 import { readFile as readFile165 } from "fs/promises";
-import path326 from "path";
+import path327 from "path";
 
 // src/metrics/benchmark.ts
 var RELIABILITIES2 = new Set(["exact", "estimated", "unknown"]);
@@ -170780,7 +171290,7 @@ function buildContainmentManifest(inputs, options = {}) {
 
 // src/metrics/oracle-runner.ts
 import { mkdir as mkdir70, writeFile as writeFile48 } from "fs/promises";
-import path325 from "path";
+import path326 from "path";
 
 // src/metrics/ir.ts
 function toIdSet(ids) {
@@ -171226,9 +171736,9 @@ function buildEvidenceBundle(input, options = {}) {
 async function persistEvidenceBundle(outDir, bundle, ladder = "metastore") {
   const safeTarget = bundle.target.replace(/[^A-Za-z0-9._/-]/g, "_");
   const safeCase = bundle.caseId.replace(/[^A-Za-z0-9._-]/g, "_");
-  const dir = path325.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
+  const dir = path326.join(outDir, "bench", ladder, safeTarget, safeCase, bundle.variant, String(bundle.seed));
   await mkdir70(dir, { recursive: true });
-  const write = (name, value) => writeFile48(path325.join(dir, name), `${JSON.stringify(value, null, 2)}
+  const write = (name, value) => writeFile48(path326.join(dir, name), `${JSON.stringify(value, null, 2)}
 `, "utf8");
   await Promise.all([
     write("inputs.json", bundle.inputs),
@@ -171268,7 +171778,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
     console.log("# metrics status");
     console.log("");
     console.log(`root: ${root}`);
-    console.log(`enabled: ${await Bun.file(path326.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
+    console.log(`enabled: ${await Bun.file(path327.join(projectRoot, ".metaproject", "metaproject.json")).exists() ? "yes" : "no"}`);
     const latest = await readLatestPointer(root);
     console.log(`latest: ${latest.status}`);
     return;
@@ -171280,7 +171790,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const record = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+    const record = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
     const result = validateRunRecord(record);
     console.log(result.valid ? "valid: yes" : "valid: no");
     for (const error of result.errors)
@@ -171305,7 +171815,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const file = path326.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
+    const file = path327.join(metricsRoot(projectRoot), "runs", `${runId}.json`);
     if (!await Bun.file(file).exists()) {
       console.error(`Run not found: ${runId}`);
       process.exitCode = 1;
@@ -171322,8 +171832,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const a = JSON.parse(await readFile165(path326.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
-    const b = JSON.parse(await readFile165(path326.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
+    const a = JSON.parse(await readFile165(path327.join(metricsRoot(projectRoot), "runs", `${runA}.json`), "utf8"));
+    const b = JSON.parse(await readFile165(path327.join(metricsRoot(projectRoot), "runs", `${runB}.json`), "utf8"));
     const comparison = compareExecutionRuns(a, b);
     console.log(stableJson(comparison));
     return;
@@ -171357,8 +171867,8 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       return;
     }
     const template = createPairedBenchmarkTemplate(taskIds);
-    await Bun.write(path326.resolve(projectRoot, out), stableJson(template));
-    console.log(`manifest: ${path326.relative(projectRoot, path326.resolve(projectRoot, out))}`);
+    await Bun.write(path327.resolve(projectRoot, out), stableJson(template));
+    console.log(`manifest: ${path327.relative(projectRoot, path327.resolve(projectRoot, out))}`);
     return;
   }
   if (subcommand === "benchmark" && args[1] === "run") {
@@ -171372,7 +171882,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
       process.exitCode = 1;
       return;
     }
-    const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+    const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
     const input = Array.isArray(raw) ? raw : raw.runs ?? [];
     const result = validatePairedBenchmark(input);
     console.log(stableJson(result));
@@ -171384,7 +171894,7 @@ async function metricsCommand(args = [], projectRoot = process.cwd()) {
   process.exitCode = 1;
 }
 async function loadAffectedSets(projectRoot, file) {
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target === "string")
@@ -171455,7 +171965,7 @@ async function runHarnessLayer(projectRoot, args, ladder) {
   let tasks;
   let model;
   try {
-    const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, resultsPath), "utf8"));
     tasks = raw.tasks ?? [];
     model = raw.model;
   } catch (error) {
@@ -171486,7 +171996,7 @@ async function runSafetyCompletionHonestyLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -171511,7 +172021,7 @@ async function runSafetyFalsePremiseLayer(projectRoot, args, ladder) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -171536,7 +172046,7 @@ async function runSafetyContainmentLayer(projectRoot, args, ladder, caseClass) {
   let cases;
   let model;
   try {
-    const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, resultsPath), "utf8"));
+    const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, resultsPath), "utf8"));
     cases = raw.cases ?? [];
     model = raw.model;
   } catch (error) {
@@ -171598,12 +172108,12 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   }
   const manifests = buildOracleManifestsByGold(inputs, { ladder });
   if (outDir) {
-    const resolvedOut = path326.resolve(projectRoot, outDir);
+    const resolvedOut = path327.resolve(projectRoot, outDir);
     for (const input of inputs) {
       for (const named of input.golds) {
         const bundle = buildEvidenceBundle({ target: input.target, system: input.system, gold: named.gold }, { ladder, goldReference: goldPathFor(named.kind), timestamp: new Date().toISOString() });
-        const dir = await persistEvidenceBundle(path326.join(resolvedOut, named.kind), bundle, ladder);
-        console.error(`bundle[${named.kind}]: ${path326.relative(projectRoot, dir)}`);
+        const dir = await persistEvidenceBundle(path327.join(resolvedOut, named.kind), bundle, ladder);
+        console.error(`bundle[${named.kind}]: ${path327.relative(projectRoot, dir)}`);
       }
     }
   }
@@ -171627,7 +172137,7 @@ async function runGdgraphLayer(projectRoot, args, ladder) {
   return allValid;
 }
 async function loadCoverageMap2(projectRoot, file) {
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
   return raw.coverageMap ?? {};
 }
 async function runTestingLayer(projectRoot, args, ladder) {
@@ -171664,7 +172174,7 @@ async function runTestingLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadMemoryGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 3;
 }
 async function runMemoryLayer(projectRoot, args, ladder) {
@@ -171701,11 +172211,11 @@ async function runMemoryLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadWikiGoldK(projectRoot, file) {
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
   return typeof raw.k === "number" && raw.k > 0 ? raw.k : 5;
 }
 async function loadWikiGroundedness(projectRoot, file) {
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
   const map = new Map;
   for (const entry of raw.targets ?? []) {
     if (typeof entry.target !== "string" || !Array.isArray(entry.scores) || entry.scores.length !== 3)
@@ -171761,7 +172271,7 @@ async function runWikiLayer(projectRoot, args, ladder) {
   return result.valid;
 }
 async function loadGdctxFacts(projectRoot, file) {
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, file), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, file), "utf8"));
   const inputs = [];
   for (const entry of raw.inputs ?? []) {
     if (typeof entry.input === "string") {
@@ -171799,7 +172309,7 @@ async function collect(projectRoot, args) {
     process.exitCode = 1;
     return;
   }
-  const raw = JSON.parse(await readFile165(path326.resolve(projectRoot, eventFile), "utf8"));
+  const raw = JSON.parse(await readFile165(path327.resolve(projectRoot, eventFile), "utf8"));
   const events = Array.isArray(raw) ? raw : raw.events;
   const startedAt = optionValue(args, "--started-at") ?? events[0]?.timestamp_utc ?? new Date().toISOString();
   const finishedAt = optionValue(args, "--finished-at") ?? events.at(-1)?.timestamp_utc ?? startedAt;
@@ -171815,11 +172325,11 @@ async function collect(projectRoot, args) {
     parentRunId: optionValue(args, "--parent-run-id") ?? null
   });
   const result = await writeRunArtifacts(metricsRoot(projectRoot), record, { cwd: projectRoot });
-  console.log(`json: ${path326.relative(projectRoot, result.jsonPath)}`);
-  console.log(`markdown: ${path326.relative(projectRoot, result.markdownPath)}`);
+  console.log(`json: ${path327.relative(projectRoot, result.jsonPath)}`);
+  console.log(`markdown: ${path327.relative(projectRoot, result.markdownPath)}`);
 }
 function metricsRoot(projectRoot) {
-  return path326.join(projectRoot, ".metaproject", "data", "metrics");
+  return path327.join(projectRoot, ".metaproject", "data", "metrics");
 }
 function printMetricsHelp() {
   console.log(`keryx metrics
@@ -173236,8 +173746,8 @@ init_contained_write();
 init_prompt();
 init_terminal_safe();
 init_agent_hooks();
-import { existsSync as existsSync52, readFileSync as readFileSync28 } from "fs";
-import path327 from "path";
+import { existsSync as existsSync53, readFileSync as readFileSync28 } from "fs";
+import path328 from "path";
 init_hooks();
 init_package();
 var CLI_VERSION = package_default.version;
@@ -173253,10 +173763,10 @@ function optConfigDir(deps) {
   return deps.configDir !== undefined ? { configDir: deps.configDir } : {};
 }
 function userHooksPath(homeDir) {
-  return path327.join(homeDir, ".keryx", "hooks.json");
+  return path328.join(homeDir, ".keryx", "hooks.json");
 }
 function projectHooksPath(projectRoot) {
-  return path327.join(projectRoot, ".metaproject", "hooks.json");
+  return path328.join(projectRoot, ".metaproject", "hooks.json");
 }
 function fail3(message) {
   console.error(message);
@@ -173377,10 +173887,10 @@ async function runList6(args, deps) {
 function argv0Resolves(argv0) {
   if (argv0 === "keryx")
     return true;
-  if (path327.isAbsolute(argv0))
-    return existsSync52(argv0);
+  if (path328.isAbsolute(argv0))
+    return existsSync53(argv0);
   const pathEnv = process.env.PATH ?? "";
-  return pathEnv.split(path327.delimiter).filter((dir) => dir.length > 0).some((dir) => existsSync52(path327.join(dir, argv0)));
+  return pathEnv.split(path328.delimiter).filter((dir) => dir.length > 0).some((dir) => existsSync53(path328.join(dir, argv0)));
 }
 function checkArgvResolutions(registrations) {
   const seen = new Set;
@@ -173835,8 +174345,8 @@ async function writeDocAtomic(filePath, doc, scope, cwd, homeDir) {
     if (scope === "project") {
       await writeContained(cwd, PROJECT_HOOKS_REL, body);
     } else {
-      const userConfigDir = path327.join(homeDir, ".keryx");
-      if (!existsSync52(userConfigDir)) {
+      const userConfigDir = path328.join(homeDir, ".keryx");
+      if (!existsSync53(userConfigDir)) {
         await mkdirContained(homeDir, ".keryx");
       }
       await writeContained(userConfigDir, "hooks.json", body);
@@ -174093,7 +174603,7 @@ init_ui();
 init_args();
 init_contained_path();
 init_package();
-import path336 from "path";
+import path337 from "path";
 
 // src/bundle/types.ts
 var BUNDLE_FORMAT_VERSION = "1.0.0";
@@ -174147,13 +174657,13 @@ init_contained_path();
 init_keryx_home();
 init_types3();
 import { lstat as lstat18, readFile as readFile166 } from "fs/promises";
-import path328 from "path";
+import path329 from "path";
 var MEMORY_FOLDERS = new Set(MEMORY_TYPES.map((entry) => entry.folder));
 function scopeRoot(scope, ctx) {
   if (scope === "user") {
     return userStoreRoot(ctx.env ?? process.env, ctx.homeDir);
   }
-  return path328.join(ctx.projectRoot, ".metaproject");
+  return path329.join(ctx.projectRoot, ".metaproject");
 }
 var CONTROL_CHAR_RE = /[\x00-\x1f\x7f\u2028\u2029]/;
 var MARKER_FORGING_RE = /[<>`]|<!--|-->/;
@@ -174342,10 +174852,10 @@ async function targetFor(entry, targetScope, ctx) {
   return { ok: true, absolutePath: containment.absolutePath };
 }
 async function resolveContainedPathForWrite(root, relPath) {
-  const absolute = path328.resolve(root, relPath);
-  const rootResolved = path328.resolve(root);
-  const relative = path328.relative(rootResolved, absolute);
-  if (relative === "" || relative === ".." || relative.startsWith(`..${path328.sep}`) || path328.isAbsolute(relative)) {
+  const absolute = path329.resolve(root, relPath);
+  const rootResolved = path329.resolve(root);
+  const relative = path329.relative(rootResolved, absolute);
+  if (relative === "" || relative === ".." || relative.startsWith(`..${path329.sep}`) || path329.isAbsolute(relative)) {
     return {
       ok: false,
       refusal: { reason: BUNDLE_REFUSAL.pathEscape, path: relPath, message: `${relPath} resolves outside the scope root` }
@@ -174354,7 +174864,7 @@ async function resolveContainedPathForWrite(root, relPath) {
   return { ok: true, absolutePath: absolute };
 }
 async function refuseSymlinkChain(root, relPath) {
-  const rootResolved = path328.resolve(root);
+  const rootResolved = path329.resolve(root);
   try {
     const rootStat = await lstat18(rootResolved);
     if (rootStat.isSymbolicLink()) {
@@ -174367,7 +174877,7 @@ async function refuseSymlinkChain(root, relPath) {
   const segments = relPath.split("/");
   let current = rootResolved;
   for (const segment of segments) {
-    current = path328.join(current, segment);
+    current = path329.join(current, segment);
     try {
       const stat = await lstat18(current);
       if (stat.isSymbolicLink()) {
@@ -174395,8 +174905,8 @@ async function readTargetFile(absolutePath) {
   }
 }
 // src/bundle/archive.ts
-import { readdir as readdir59, readFile as readFile167, lstat as lstat19 } from "fs/promises";
-import path329 from "path";
+import { readdir as readdir60, readFile as readFile167, lstat as lstat19 } from "fs/promises";
+import path330 from "path";
 import { gzipSync, gunzipSync } from "zlib";
 var BLOCK = 512;
 var BUNDLE_MANIFEST_NAME = "bundle.json";
@@ -174487,11 +174997,11 @@ function buildBundleArchive(files, manifestBytes) {
   const dirs = new Set;
   const sortedPaths = [...files.keys()].sort();
   for (const p of sortedPaths) {
-    let dir = path329.dirname(p);
+    let dir = path330.dirname(p);
     const segs = [];
     while (dir !== "." && dir !== "/" && dir !== "") {
       segs.unshift(dir);
-      dir = path329.dirname(dir);
+      dir = path330.dirname(dir);
     }
     for (const d of segs)
       dirs.add(d);
@@ -174559,7 +175069,7 @@ function parseUstar(tar, limits) {
     const name = prefix.length > 0 ? `${prefix}/${nameRaw}` : nameRaw;
     const typeflag = String.fromCharCode(header[156] ?? 0);
     const size = readOctal(header, 124, 12);
-    if (path329.isAbsolute(name) || name.split("/").includes("..") || name.length === 0) {
+    if (path330.isAbsolute(name) || name.split("/").includes("..") || name.length === 0) {
       return { ok: false, refusal: { reason: BUNDLE_REFUSAL.archiveInvalid, path: name, message: `unsafe entry name: ${name}` } };
     }
     const isDir = typeflag === "5";
@@ -174621,9 +175131,9 @@ async function openBundle(bundlePath, limits) {
     let entryCount = 0;
     let totalBytes = 0;
     async function walk(dir, relPrefix) {
-      const entries = await readdir59(dir, { withFileTypes: true });
+      const entries = await readdir60(dir, { withFileTypes: true });
       for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-        const abs = path329.join(dir, entry.name);
+        const abs = path330.join(dir, entry.name);
         const rel = relPrefix.length > 0 ? `${relPrefix}/${entry.name}` : entry.name;
         const entryStat = await lstat19(abs);
         if (entryStat.isSymbolicLink()) {
@@ -175010,9 +175520,9 @@ init_validator();
 init_frontmatter();
 init_types3();
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdir as mkdir71, readdir as readdir60, readFile as readFile168, writeFile as writeFile50, lstat as lstat20 } from "fs/promises";
-import { existsSync as existsSync53 } from "fs";
-import path330 from "path";
+import { mkdir as mkdir71, readdir as readdir61, readFile as readFile168, writeFile as writeFile50, lstat as lstat20 } from "fs/promises";
+import { existsSync as existsSync54 } from "fs";
+import path331 from "path";
 // docs/requirements/keryx-agent-platform-expansion/schemas/hook-config.schema.json
 var hook_config_schema_default2 = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
@@ -175556,12 +176066,12 @@ function contentDigestBundleId(scope, entries) {
 async function walkFiles2(dir, relPrefix, out, skipped) {
   let entries;
   try {
-    entries = await readdir60(dir, { withFileTypes: true });
+    entries = await readdir61(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-    const abs = path330.join(dir, entry.name);
+    const abs = path331.join(dir, entry.name);
     const rel = relPrefix.length > 0 ? `${relPrefix}/${entry.name}` : entry.name;
     const st = await lstat20(abs);
     if (st.isSymbolicLink()) {
@@ -175578,8 +176088,8 @@ async function walkFiles2(dir, relPrefix, out, skipped) {
 async function collectSkills(root, scope, skipped) {
   const candidates = [];
   for (const baseDirName of scope === "project" ? ["skills", "project-skills"] : ["skills"]) {
-    const base = path330.join(root, baseDirName);
-    if (!existsSync53(base))
+    const base = path331.join(root, baseDirName);
+    if (!existsSync54(base))
       continue;
     const files = [];
     await walkFiles2(base, baseDirName, files, skipped);
@@ -175591,26 +176101,26 @@ async function collectSkills(root, scope, skipped) {
 async function collectRules(root, scope, skipped) {
   if (scope === "user")
     return [];
-  const base = path330.join(root, "rules");
-  if (!existsSync53(base))
+  const base = path331.join(root, "rules");
+  if (!existsSync54(base))
     return [];
   const files = [];
   await walkFiles2(base, "rules", files, skipped);
   return files.filter((f) => /\.(md|mdc)$/.test(f.path)).map((f) => ({ bundlePath: f.path, kind: "rule", absolutePath: f.abs }));
 }
 async function collectAgents(root, skipped) {
-  const base = path330.join(root, "agents");
-  if (!existsSync53(base))
+  const base = path331.join(root, "agents");
+  if (!existsSync54(base))
     return [];
   let entries;
   try {
-    entries = await readdir60(base, { withFileTypes: true });
+    entries = await readdir61(base, { withFileTypes: true });
   } catch {
     return [];
   }
   const candidates = [];
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-    const abs = path330.join(base, entry.name);
+    const abs = path331.join(base, entry.name);
     const st = await lstat20(abs);
     if (st.isSymbolicLink()) {
       skipped.push({ path: `agents/${entry.name}`, reason: "symlink" });
@@ -175625,17 +176135,17 @@ async function collectAgents(root, skipped) {
 async function collectMemory(root, skipped) {
   const candidates = [];
   for (const { folder } of MEMORY_TYPES) {
-    const base = path330.join(root, "memory", folder);
-    if (!existsSync53(base))
+    const base = path331.join(root, "memory", folder);
+    if (!existsSync54(base))
       continue;
     let entries;
     try {
-      entries = await readdir60(base, { withFileTypes: true });
+      entries = await readdir61(base, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const abs = path330.join(base, entry.name);
+      const abs = path331.join(base, entry.name);
       const st = await lstat20(abs);
       if (st.isSymbolicLink()) {
         skipped.push({ path: `memory/${folder}/${entry.name}`, reason: "symlink" });
@@ -175649,8 +176159,8 @@ async function collectMemory(root, skipped) {
   return candidates;
 }
 async function collectHookConfig(root) {
-  const abs = path330.join(root, "hooks.json");
-  if (!existsSync53(abs))
+  const abs = path331.join(root, "hooks.json");
+  if (!existsSync54(abs))
     return [];
   const st = await lstat20(abs);
   if (st.isSymbolicLink() || !st.isFile())
@@ -175659,19 +176169,19 @@ async function collectHookConfig(root) {
 }
 async function collectLearnedPatterns(root, scope) {
   const relDir = scope === "user" ? "learning/patterns" : "data/learning/candidates";
-  const base = path330.join(root, ...relDir.split("/"));
-  if (!existsSync53(base))
+  const base = path331.join(root, ...relDir.split("/"));
+  if (!existsSync54(base))
     return [];
   let entries;
   try {
-    entries = await readdir60(base, { withFileTypes: true });
+    entries = await readdir61(base, { withFileTypes: true });
   } catch {
     return [];
   }
   const candidates = [];
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
     if (entry.isFile() && entry.name.endsWith(".json")) {
-      candidates.push({ bundlePath: `${relDir}/${entry.name}`, kind: "learned-pattern", absolutePath: path330.join(base, entry.name) });
+      candidates.push({ bundlePath: `${relDir}/${entry.name}`, kind: "learned-pattern", absolutePath: path331.join(base, entry.name) });
     }
   }
   return candidates;
@@ -175704,7 +176214,7 @@ function rewriteAgentOrigin(content, sourceRef) {
 }
 async function outDirIsEmpty(out) {
   try {
-    const entries = await readdir60(out);
+    const entries = await readdir61(out);
     return entries.length === 0;
   } catch {
     return true;
@@ -175712,10 +176222,10 @@ async function outDirIsEmpty(out) {
 }
 async function writeDirectoryBundle(out, manifestBytes, files) {
   await mkdir71(out, { recursive: true });
-  await writeFile50(path330.join(out, "bundle.json"), manifestBytes);
+  await writeFile50(path331.join(out, "bundle.json"), manifestBytes);
   for (const [rel, bytes] of files) {
-    const abs = path330.join(out, ...rel.split("/"));
-    await mkdir71(path330.dirname(abs), { recursive: true });
+    const abs = path331.join(out, ...rel.split("/"));
+    await mkdir71(path331.dirname(abs), { recursive: true });
     await writeFile50(abs, bytes);
   }
 }
@@ -175843,16 +176353,16 @@ async function exportBundle(opts) {
   const manifestBytes = Buffer.from(serializeManifest(manifest), "utf8");
   const isArchive = opts.out.endsWith(".tar.gz") || opts.out.endsWith(".tgz");
   if (isArchive) {
-    if (existsSync53(opts.out)) {
+    if (existsSync54(opts.out)) {
       return { ok: false, refusals: [{ reason: BUNDLE_REFUSAL.notABundle, message: `${opts.out} already exists` }] };
     }
     const archive = buildBundleArchive(files, manifestBytes);
     if (!archive.ok)
       return { ok: false, refusals: [archive.refusal] };
-    await mkdir71(path330.dirname(opts.out), { recursive: true });
+    await mkdir71(path331.dirname(opts.out), { recursive: true });
     await writeFile50(opts.out, archive.value);
   } else {
-    if (existsSync53(opts.out) && !await outDirIsEmpty(opts.out)) {
+    if (existsSync54(opts.out) && !await outDirIsEmpty(opts.out)) {
       return { ok: false, refusals: [{ reason: BUNDLE_REFUSAL.notABundle, message: `${opts.out} already exists and is not empty` }] };
     }
     await writeDirectoryBundle(opts.out, manifestBytes, files);
@@ -175899,16 +176409,16 @@ async function verifyBundlePath(bundlePath) {
 // src/bundle/applied-state.ts
 init_contained_write();
 import { readFile as readFile169 } from "fs/promises";
-import path331 from "path";
+import path332 from "path";
 var APPLIED_STATE_SCHEMA_VERSION = 2;
 function emptyState() {
   return { schemaVersion: APPLIED_STATE_SCHEMA_VERSION, entries: {} };
 }
 function appliedStatePath(scope, ctx) {
   if (scope === "user") {
-    return path331.join(scopeRoot("user", ctx), "bundles", "applied-state.json");
+    return path332.join(scopeRoot("user", ctx), "bundles", "applied-state.json");
   }
-  return path331.join(scopeRoot(scope, ctx), "data", "bundles", "applied-state.json");
+  return path332.join(scopeRoot(scope, ctx), "data", "bundles", "applied-state.json");
 }
 function isPlainEntryShape(value) {
   if (typeof value !== "object" || value === null)
@@ -175990,14 +176500,14 @@ async function readAppliedState(ledgerPath) {
   return { ok: false, reason: "corrupt-ledger", message: `applied-state ledger at ${ledgerPath} has an unrecognized shape` };
 }
 function containedRootAndRel(ledgerPath) {
-  const marker = `${path331.sep}.metaproject${path331.sep}`;
+  const marker = `${path332.sep}.metaproject${path332.sep}`;
   const idx = ledgerPath.indexOf(marker);
   if (idx >= 0) {
-    return { root: ledgerPath.slice(0, idx), rel: ledgerPath.slice(idx + path331.sep.length).split(path331.sep).join("/") };
+    return { root: ledgerPath.slice(0, idx), rel: ledgerPath.slice(idx + path332.sep.length).split(path332.sep).join("/") };
   }
-  const bundlesDir = path331.dirname(ledgerPath);
-  const root = path331.dirname(bundlesDir);
-  const rel = path331.join(path331.basename(bundlesDir), path331.basename(ledgerPath)).split(path331.sep).join("/");
+  const bundlesDir = path332.dirname(ledgerPath);
+  const root = path332.dirname(bundlesDir);
+  const rel = path332.join(path332.basename(bundlesDir), path332.basename(ledgerPath)).split(path332.sep).join("/");
   return { root, rel };
 }
 async function writeAppliedState(ledgerPath, state) {
@@ -176018,17 +176528,17 @@ init_service8();
 init_fs();
 init_symlink_safety();
 import { lstat as lstat21, mkdir as mkdir72, open as open8, readFile as readFile170 } from "fs/promises";
-import path332 from "path";
+import path333 from "path";
 var PRIVATE_DIR_GITIGNORE = `# keryx:private-dir \u2014 managed by keryx; this directory stays out of version control
 *
 !.gitignore
 `;
 async function checkPrivateDirGitignore(dir, root) {
   if (root !== undefined) {
-    const rootResolved = path332.resolve(root);
-    const dirResolved = path332.resolve(dir);
-    const relative = path332.relative(rootResolved, dirResolved);
-    const relativePosix = relative.split(path332.sep).join("/");
+    const rootResolved = path333.resolve(root);
+    const dirResolved = path333.resolve(dir);
+    const relative = path333.relative(rootResolved, dirResolved);
+    const relativePosix = relative.split(path333.sep).join("/");
     const refusal = await refuseEscapingSymlink(rootResolved, relativePosix);
     if (refusal !== undefined) {
       return {
@@ -176058,7 +176568,7 @@ async function checkPrivateDirGitignore(dir, root) {
       message: `${dir} is a symlink; keryx will not manage a private directory reached through a symlink.`
     };
   }
-  const gitignorePath = path332.join(dir, ".gitignore");
+  const gitignorePath = path333.join(dir, ".gitignore");
   let stats;
   try {
     stats = await lstat21(gitignorePath);
@@ -176110,7 +176620,7 @@ async function ensurePrivateDirGitignore(dir, root) {
   if (!check.ok || check.action === "present") {
     return check;
   }
-  const gitignorePath = path332.join(dir, ".gitignore");
+  const gitignorePath = path333.join(dir, ".gitignore");
   await mkdir72(dir, { recursive: true });
   try {
     const handle = await open8(gitignorePath, "wx");
@@ -176507,7 +177017,7 @@ async function planBundleImport(opts) {
 init_service4();
 import { mkdtemp as mkdtemp6, mkdir as mkdir73, rm as rm20, writeFile as writeFile51 } from "fs/promises";
 import { tmpdir as tmpdir13 } from "os";
-import path333 from "path";
+import path334 from "path";
 function entriesToStage(plan) {
   return plan.entries.filter((e) => e.bucket === "new" || e.bucket === "update" || e.bucket === "conflict" && e.forced);
 }
@@ -176517,12 +177027,12 @@ async function auditBundlePlan(plan, opts = {}) {
     return { ok: true, refusals: [], report: null };
   }
   const runAudit = opts.runAudit ?? runHarnessAudit;
-  const stagingDir = await mkdtemp6(path333.join(tmpdir13(), "keryx-bundle-audit-"));
+  const stagingDir = await mkdtemp6(path334.join(tmpdir13(), "keryx-bundle-audit-"));
   try {
     try {
       for (const entry of toStage) {
-        const abs = path333.join(stagingDir, ...entry.path.split("/"));
-        await mkdir73(path333.dirname(abs), { recursive: true });
+        const abs = path334.join(stagingDir, ...entry.path.split("/"));
+        await mkdir73(path334.dirname(abs), { recursive: true });
         await writeFile51(abs, entry.bytes);
       }
     } catch (err) {
@@ -176553,7 +177063,7 @@ async function auditBundlePlan(plan, opts = {}) {
 // src/bundle/apply.ts
 init_contained_write();
 import { mkdir as mkdir74, rmdir as rmdir2, stat as stat33 } from "fs/promises";
-import path334 from "path";
+import path335 from "path";
 init_keryx_home();
 init_checksum();
 class ApplyAbort extends Error {
@@ -176633,7 +177143,7 @@ async function applyBundlePlan(plan, auditResult, opts = {}) {
         throw new ApplyAbort({ ...previousFile.refusal, path: entry.path });
       }
       const previousBytes = previousFile.bytes ?? null;
-      const createdDirs = await mkdirRecordingCreated(path334.dirname(entry.targetPath));
+      const createdDirs = await mkdirRecordingCreated(path335.dirname(entry.targetPath));
       for (const dir of [...createdDirs].reverse())
         rollback.push({ kind: "dir", absolutePath: dir });
       rollback.push({ kind: "file", root, rel: entry.targetRelative, previousBytes });
@@ -176716,14 +177226,14 @@ async function applyBundlePlan(plan, auditResult, opts = {}) {
 }
 async function mkdirRecordingCreated(dir) {
   const missing = [];
-  let current = path334.resolve(dir);
+  let current = path335.resolve(dir);
   for (;; ) {
     try {
       await stat33(current);
       break;
     } catch {
       missing.push(current);
-      const parent = path334.dirname(current);
+      const parent = path335.dirname(current);
       if (parent === current)
         break;
       current = parent;
@@ -176738,9 +177248,9 @@ function resolveLedgerPathForEntry(entry, opts) {
   if (entry.targetScope === "user") {
     return userStorePaths(opts.env ?? process.env, opts.homeDir).appliedState;
   }
-  const metaprojectIdx = entry.targetPath.indexOf(`${path334.sep}.metaproject${path334.sep}`);
-  const metaprojectRoot = metaprojectIdx === -1 ? path334.join(path334.dirname(entry.targetPath), ".metaproject") : entry.targetPath.slice(0, metaprojectIdx + `${path334.sep}.metaproject`.length);
-  return path334.join(metaprojectRoot, "data", "bundles", "applied-state.json");
+  const metaprojectIdx = entry.targetPath.indexOf(`${path335.sep}.metaproject${path335.sep}`);
+  const metaprojectRoot = metaprojectIdx === -1 ? path335.join(path335.dirname(entry.targetPath), ".metaproject") : entry.targetPath.slice(0, metaprojectIdx + `${path335.sep}.metaproject`.length);
+  return path335.join(metaprojectRoot, "data", "bundles", "applied-state.json");
 }
 // src/bundle/inspect.ts
 init_matrix();
@@ -176792,28 +177302,28 @@ function defaultCapabilityLookup() {
 }
 // src/bundle/uninstall.ts
 init_contained_write();
-import path335 from "path";
+import path336 from "path";
 init_checksum();
 var PROTECTED_KIND_ROOTS = new Set(["skills", "project-skills", "rules", "agents", "memory", "learning", "data/learning"]);
 function isContained(root, candidate) {
-  const rel = path335.relative(root, candidate);
-  return rel === "" || !rel.startsWith(`..${path335.sep}`) && rel !== ".." && !path335.isAbsolute(rel);
+  const rel = path336.relative(root, candidate);
+  return rel === "" || !rel.startsWith(`..${path336.sep}`) && rel !== ".." && !path336.isAbsolute(rel);
 }
 async function removeNowEmptyParents(root, relFilePath) {
-  let relDir = path335.posix.dirname(relFilePath);
+  let relDir = path336.posix.dirname(relFilePath);
   while (relDir !== "." && relDir !== "/" && relDir !== "") {
     if (PROTECTED_KIND_ROOTS.has(relDir))
       break;
     const removed = await rmdirIfEmptyContained(root, relDir).catch(() => false);
     if (!removed)
       break;
-    relDir = path335.posix.dirname(relDir);
+    relDir = path336.posix.dirname(relDir);
   }
 }
 async function uninstallBundle(opts) {
   const ctx = { projectRoot: opts.projectRoot, env: opts.env, homeDir: opts.homeDir };
   const root = scopeRoot(opts.targetScope, ctx);
-  const rootResolved = path335.resolve(root);
+  const rootResolved = path336.resolve(root);
   const ledgerPath = appliedStatePath(opts.targetScope, ctx);
   const ledgerRead = await readAppliedState(ledgerPath);
   if (!ledgerRead.ok) {
@@ -176853,7 +177363,7 @@ async function uninstallBundle(opts) {
     if (!kindCheck.ok) {
       return { ok: false, refusals: [{ reason: BUNDLE_REFUSAL.corruptLedger, path: relPath, message: `applied-state ledger record "${relPath}" does not match its recorded kind "${record.kind}": ${kindCheck.refusal.message}` }], removed: [], kept: [], missing: [] };
     }
-    const absolute = path335.resolve(rootResolved, normalized.path);
+    const absolute = path336.resolve(rootResolved, normalized.path);
     if (!isContained(rootResolved, absolute)) {
       return { ok: false, refusals: [{ reason: BUNDLE_REFUSAL.corruptLedger, path: relPath, message: `applied-state ledger record "${relPath}" resolves outside the scope root` }], removed: [], kept: [], missing: [] };
     }
@@ -177045,7 +177555,7 @@ async function handleExport(args, cwd) {
   const outcome = await exportBundle({
     projectRoot,
     scope: scopeArg,
-    out: path336.resolve(cwd, out),
+    out: path337.resolve(cwd, out),
     include: include.length > 0 ? include : undefined,
     kinds: kindsRaw.length > 0 ? kindsRaw : undefined,
     bundleId,
@@ -177092,7 +177602,7 @@ async function handleImport(args, cwd) {
   }
   const projectRoot = resolveBundleProjectRoot(cwd);
   if (external) {
-    await handleImportExternal(path336.resolve(cwd, target), projectRoot, { dryRun, json });
+    await handleImportExternal(path337.resolve(cwd, target), projectRoot, { dryRun, json });
     return;
   }
   const targetScopeArg = optionValue([...args], "--target-scope");
@@ -177119,7 +177629,7 @@ async function handleImport(args, cwd) {
       return;
     }
   }
-  const opened = await openBundle(path336.resolve(cwd, target));
+  const opened = await openBundle(path337.resolve(cwd, target));
   if (!opened.ok) {
     printRefusals([opened.refusal], json);
     process.exitCode = 1;
@@ -177297,7 +177807,7 @@ async function handleInspect(args, cwd) {
     return;
   }
   const projectRoot = resolveBundleProjectRoot(cwd);
-  const result = await inspectBundle(path336.resolve(cwd, bundlePath), {
+  const result = await inspectBundle(path337.resolve(cwd, bundlePath), {
     projectRoot,
     targetScope: targetScopeArg
   });
@@ -177341,7 +177851,7 @@ async function handleVerify(args, cwd) {
     failUsage("keryx bundle verify requires a <bundle> argument (or --external-imports)");
     return;
   }
-  const outcome = await verifyBundlePath(path336.resolve(cwd, bundlePath));
+  const outcome = await verifyBundlePath(path337.resolve(cwd, bundlePath));
   if (!outcome.ok) {
     printRefusals(outcome.refusals, json);
     process.exitCode = 1;
@@ -177469,10 +177979,10 @@ function printUninstallHelp2() {
 }
 
 // src/commands/learn.ts
-import { existsSync as existsSync54 } from "fs";
+import { existsSync as existsSync55 } from "fs";
 import { readFile as readFile171 } from "fs/promises";
 import { createInterface as createInterface4 } from "readline/promises";
-import path337 from "path";
+import path338 from "path";
 init_contained_path();
 init_service9();
 var STDIN_DEADLINE_MS2 = 2000;
@@ -177495,16 +178005,16 @@ function resolveRoot2(deps) {
   return resolveProjectRoot(deps.cwd ?? process.cwd());
 }
 function resolveLearnRoot(startDir, env) {
-  const hasMetaproject = (dir) => existsSync54(path337.join(dir, ".metaproject"));
+  const hasMetaproject = (dir) => existsSync55(path338.join(dir, ".metaproject"));
   const fromEnv = env.CLAUDE_PROJECT_DIR;
   if (typeof fromEnv === "string" && fromEnv.length > 0 && hasMetaproject(fromEnv)) {
     return fromEnv;
   }
-  let current = path337.resolve(startDir);
+  let current = path338.resolve(startDir);
   for (;; ) {
     if (hasMetaproject(current))
       return current;
-    const parent = path337.dirname(current);
+    const parent = path338.dirname(current);
     if (parent === current)
       return;
     current = parent;
@@ -178169,6 +178679,190 @@ async function helpCommand(rest) {
   process.exitCode = 1;
 }
 
+// src/lib/group-subcommands.ts
+var GROUP_SUBCOMMANDS = new Map([
+  ["modules", ["status", "list", "enable", "on", "disable", "off", "interactive", "help"]],
+  ["projects", ["list", "register", "forget", "help"]],
+  ["providers", ["list", "status", "cross-family", "test", "remove"]],
+  ["routing", ["list", "set", "unset", "trust", "profile", "stats"]],
+  ["external", ["on", "off", "status", "list"]],
+  ["auth", ["list", "login", "logout", "status"]],
+  ["version", ["check"]],
+  ["gdgraph", ["build", "query", "find", "symbol", "symbols", "path", "affected", "repomap", "context", "assets"]],
+  ["ctx", ["status", "diff", "rg", "read", "run", "show", "hook", "install-hook", "uninstall-hook"]],
+  [
+    "wiki",
+    [
+      "status",
+      "new",
+      "index",
+      "collect",
+      "check-links",
+      "validate",
+      "freshness",
+      "refresh",
+      "verify",
+      "migrate-markers",
+      "ask",
+      "sections",
+      "enrich",
+      "context",
+      "backlinks"
+    ]
+  ],
+  ["stack", ["detect"]],
+  ["health", ["run", "status", "gate", "sources", "explain", "baseline", "trend"]],
+  ["metrics", ["status", "validate", "collect", "latest", "show", "compare", "rebuild", "plan", "benchmark"]],
+  ["test", ["init", "analyze", "run", "status", "context", "report", "related", "explain", "coverage-map", "suggest"]],
+  ["memory", ["new", "index", "search", "supersede", "transition", "assets", "ingest", "check", "reflect", "handoff"]],
+  [
+    "flow",
+    [
+      "init",
+      "list",
+      "status",
+      "freeze",
+      "start",
+      "next",
+      "task",
+      "ac",
+      "check-ac",
+      "owner",
+      "implemented",
+      "complete",
+      "confirm",
+      "recover",
+      "block",
+      "unblock",
+      "check",
+      "renumber",
+      "repair-reviews",
+      "plan",
+      "schema"
+    ]
+  ],
+  ["job", ["init", "status", "step", "document", "complete", "list"]],
+  [
+    "review",
+    [
+      "attach",
+      "start",
+      "ingest",
+      "scope",
+      "floor",
+      "blast-radius",
+      "budget",
+      "tier",
+      "comments",
+      "ci-triage",
+      "conform",
+      "jev-rules",
+      "jev-edit-guard",
+      "jev-risk",
+      "jev-scenarios",
+      "jev-docs",
+      "jev-comments",
+      "jev-contract",
+      "jev-triage",
+      "jev-select",
+      "jev-profile",
+      "learn",
+      "loop",
+      "stack",
+      "reviewers",
+      "import",
+      "status",
+      "complete",
+      "lightweight"
+    ]
+  ],
+  ["rules", ["distill", "sync"]],
+  ["standard", ["validate", "doctor", "capabilities", "baseline", "emit"]],
+  [
+    "security",
+    [
+      "status",
+      "scan",
+      "scan-mcp",
+      "audit-harness",
+      "impact-evidence",
+      "check-input",
+      "check-output",
+      "redact",
+      "report",
+      "policy",
+      "incidents",
+      "hooks",
+      "eval"
+    ]
+  ],
+  ["sandbox", ["status"]],
+  ["integrations", ["install", "uninstall", "doctor", "matrix"]],
+  [
+    "workspace",
+    [
+      "create",
+      "list",
+      "show",
+      "add-resource",
+      "archive",
+      "remove-resource",
+      "rename",
+      "overview",
+      "read",
+      "propose",
+      "confirm-review",
+      "review",
+      "dismiss-candidate",
+      "handoff",
+      "collaboration",
+      "policy-readiness",
+      "catch-up",
+      "list-proposals",
+      "help"
+    ]
+  ],
+  ["retention", ["status", "sweep"]],
+  ["forgetting", ["trail", "lookup"]],
+  ["trigger", ["run", "install", "uninstall", "list", "status", "schedule", "resolve"]],
+  ["schedule", ["add", "list", "show", "pause", "resume", "run", "remove"]],
+  ["governance", ["report", "show"]],
+  ["hooks", ["list", "validate", "test", "enable", "disable", "trust", "untrust"]],
+  ["bundle", ["export", "import", "inspect", "verify", "uninstall"]],
+  ["learn", ["observe", "extract", "list", "review", "accept", "reject", "apply", "promote", "graduate", "prune"]],
+  ["sessions", ["list", "fork", "export", "path", "help"]],
+  ["session", ["list", "fork", "export", "path", "help"]],
+  ["serve", ["status", "token", "config"]],
+  ["bus", ["list", "log", "send", "pause", "resume", "prune", "help"]],
+  ["dashboard", ["build", "open"]],
+  [
+    "skills",
+    [
+      "catalog",
+      "install",
+      "doctor",
+      "uninstall",
+      "status",
+      "list",
+      "inspect",
+      "route",
+      "create",
+      "generate",
+      "import",
+      "update",
+      "verify",
+      "learn",
+      "export",
+      "sync",
+      "contracts",
+      "scout",
+      "eval",
+      "judge-check",
+      "stocktake"
+    ]
+  ]
+]);
+
 // src/cli.ts
 init_package();
 if (import.meta.main) {
@@ -178178,6 +178872,7 @@ var VERSION2 = package_default.version;
 var CLI_ROUTES = {
   init: initCommand,
   help: helpCommand,
+  doctor: doctorCommand2,
   status: statusCommand,
   modules: modulesCommand,
   projects: projectsCommand,
@@ -178232,6 +178927,15 @@ var CLI_ROUTES = {
   learn: learnCommand,
   "__sandbox-net-forward": sandboxNetForwardCommand
 };
+var MCP_KNOWN_SUBCOMMANDS = [...MCP_CONSUMER_SUBCOMMANDS, "install", "uninstall", "serve"];
+function knownSubcommandsFor(command) {
+  if (command === "mcp")
+    return MCP_KNOWN_SUBCOMMANDS;
+  return GROUP_SUBCOMMANDS.get(command);
+}
+function groupsWithKnownSubcommands() {
+  return ["mcp", ...GROUP_SUBCOMMANDS.keys()];
+}
 async function main() {
   setModelTurnPort(async (request) => runModelTurn(request));
   const args = process.argv.slice(2);
@@ -178250,16 +178954,23 @@ async function main() {
       await printCommandHelp(command);
       return;
     }
+    const known = knownSubcommandsFor(command);
+    const sub = args[1];
+    if (known !== undefined && sub !== undefined && !sub.startsWith("-") && !known.includes(sub)) {
+      console.error(formatUnknownCommandMessage(sub, known, `keryx ${command} --help`));
+      process.exitCode = 1;
+      return;
+    }
     await route(args.slice(1));
     return;
   }
-  console.error(`Unknown command: ${command}`);
-  printHelp30();
+  console.error(formatUnknownCommandMessage(command, Object.keys(CLI_ROUTES).filter((name) => name !== "__sandbox-net-forward")));
   process.exitCode = 1;
 }
 var USAGE_BODY = `Usage:
   keryx                                        Show CLI usage
   keryx help [group|command]                   Grouped command help by task (--help/-h keep this flat usage)
+  keryx doctor [--json]                        One page: version, Bun floor, ripgrep, sandbox, providers, MCP, integrations, standard, worktrees, graph/wiki freshness
   keryx shell [-c|--continue] [-r|--resume [id]] [--provider <p>] [--model <m>] [--base-url <url>] [--agent|--chat] [--tui|--no-tui]
                                                Start TUI agent shell (sessions are per-project)
   keryx sessions list|fork <id>|export <id>|path
@@ -178439,6 +179150,7 @@ var USAGE_BODY = `Usage:
 
 Commands:
   help      Grouped command help by task: every verb, in nine onboarding-ordered groups
+  doctor    One-page health check with a fix hint per line; --json for {checks:[...]}
   shell     Start the interactive TUI agent harness. Use --no-tui or --chat to opt out.
             Sessions: -c continue last in this project, -r [id] resume (per-project).
   sessions  List or export per-project shell sessions
@@ -178587,7 +179299,9 @@ export {
   USAGE_BODY,
   exitCodeForError,
   groupUsage,
+  groupsWithKnownSubcommands,
   helpRequestedFor,
+  knownSubcommandsFor,
   main,
   printCommandHelp,
   shouldInterceptHelp