@nail00749/agent-gvozd 0.1.1 → 0.1.2

package/dist/cli.js

@@ -987,13 +987,12 @@ ${b}
 var i = `${styleText("gray", S_BAR)}  `;
 
 // src/cli.ts
-import { realpathSync as realpathSync3 } from "node:fs";
+import { realpathSync as realpathSync5 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/config.ts
-import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { existsSync as existsSync2, lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, relative as relative2, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -6466,12 +6465,180 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
   return _superRefine(fn, params);
 }
+// src/config-root.ts
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+var GVOZD_CONFIG_ROOT_ENV = "GVOZD_OPENCODE_CONFIG_ROOT";
+function absolute(path, label) {
+  if (!isAbsolute(path))
+    throw new Error(`${label} must be an absolute path`);
+  return resolve(path);
+}
+function resolveOpenCodeConfigRootContract(env = process.env, platform = process.platform, home = homedir(), explicitRoot) {
+  if (explicitRoot)
+    return { path: absolute(explicitRoot, "OpenCode config root"), source: "explicit" };
+  const override = env[GVOZD_CONFIG_ROOT_ENV];
+  if (override) {
+    return { path: absolute(override, GVOZD_CONFIG_ROOT_ENV), source: GVOZD_CONFIG_ROOT_ENV };
+  }
+  if (env.XDG_CONFIG_HOME) {
+    return { path: join(absolute(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME"), "opencode"), source: "XDG_CONFIG_HOME" };
+  }
+  if (platform === "win32" && env.APPDATA) {
+    return { path: join(env.APPDATA, "opencode"), source: "APPDATA" };
+  }
+  return { path: join(home, ".config", "opencode"), source: "platform-default" };
+}
+function resolveOpenCodeConfigRoot(env = process.env, platform = process.platform, home = homedir(), explicitRoot) {
+  return resolveOpenCodeConfigRootContract(env, platform, home, explicitRoot).path;
+}
+
+// src/project-trust.ts
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2 } from "node:path";
+var PROJECT_TRUST_ENV = "GVOZD_TRUST_PROJECT_CONFIG";
+function findRoot(start) {
+  let current = resolve2(start);
+  while (true) {
+    if (existsSync(join2(current, ".git")))
+      return realpathSync(current);
+    const parent = dirname(current);
+    if (parent === current)
+      return realpathSync(resolve2(start));
+    current = parent;
+  }
+}
+function within(base, target, label) {
+  const child = relative(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute2(child))
+    return;
+  throw new Error(`${label} must stay inside ${base}: ${target}`);
+}
+function rejectSymlinkComponents(base, target, label) {
+  within(base, target, label);
+  const segments = relative(base, target).split(/[\\/]/).filter(Boolean);
+  let current = base;
+  for (const segment of segments) {
+    current = join2(current, segment);
+    if (!existsSync(current))
+      continue;
+    if (lstatSync(current).isSymbolicLink())
+      throw new Error(`${label} must not contain symlink components: ${current}`);
+  }
+}
+function readJsonc(path) {
+  const bytes = readFileSync(path);
+  const errors = [];
+  const value = parse2(bytes.toString("utf8"), errors, { allowTrailingComma: true, disallowComments: false });
+  if (errors.length > 0 || !value || typeof value !== "object" || Array.isArray(value)) {
+    const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
+    throw new Error(`Invalid JSONC in ${path}${details ? `: ${details}` : ""}`);
+  }
+  return { value, bytes };
+}
+function promptFromPatch(patch) {
+  if (!patch || typeof patch !== "object" || Array.isArray(patch))
+    return;
+  const prompt = patch.prompt;
+  return typeof prompt === "string" && prompt.length > 0 ? prompt : undefined;
+}
+function collectProjectTrustInputs(projectDirectory) {
+  const canonicalRoot = findRoot(projectDirectory);
+  const layer = join2(canonicalRoot, "docs", ".gvozd");
+  const rootPath = join2(layer, "config.jsonc");
+  if (!existsSync(rootPath))
+    return {
+      canonicalRoot,
+      inputs: [{ identity: "docs/.gvozd/config.jsonc:<missing>", bytes: Buffer.alloc(0) }]
+    };
+  rejectSymlinkComponents(canonicalRoot, rootPath, "Project config path");
+  const rootStat = lstatSync(rootPath);
+  if (!rootStat.isFile() || rootStat.isSymbolicLink())
+    throw new Error(`Project config must be a regular non-symlink file: ${rootPath}`);
+  const root = readJsonc(rootPath);
+  const files = new Map([[relative(canonicalRoot, rootPath).replaceAll("\\", "/"), root.bytes]]);
+  const prompts = [];
+  const inlineAgents = root.value.agents;
+  if (inlineAgents && typeof inlineAgents === "object" && !Array.isArray(inlineAgents)) {
+    for (const patch of Object.values(inlineAgents)) {
+      const prompt = promptFromPatch(patch);
+      if (prompt)
+        prompts.push({ source: rootPath, value: prompt });
+    }
+  }
+  const configuredDirectory = root.value.agentsDirectory;
+  if (configuredDirectory !== undefined && (typeof configuredDirectory !== "string" || configuredDirectory.length === 0)) {
+    throw new Error(`Invalid agentsDirectory in ${rootPath}`);
+  }
+  const agentsDirectory = resolve2(layer, configuredDirectory ?? "agents");
+  within(layer, agentsDirectory, "agentsDirectory");
+  if (existsSync(agentsDirectory)) {
+    rejectSymlinkComponents(canonicalRoot, agentsDirectory, "agentsDirectory");
+    const stat = lstatSync(agentsDirectory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    within(realpathSync(layer), realpathSync(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync(agentsDirectory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      if (!entry.name.endsWith(".jsonc"))
+        continue;
+      const path = join2(agentsDirectory, entry.name);
+      if (!entry.isFile())
+        throw new Error(`Agent fragment must be a regular non-symlink file: ${path}`);
+      rejectSymlinkComponents(canonicalRoot, path, "Agent fragment path");
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error(`Agent fragment must be a regular non-symlink file: ${path}`);
+      const fragment = readJsonc(path);
+      files.set(relative(canonicalRoot, path).replaceAll("\\", "/"), fragment.bytes);
+      const prompt = promptFromPatch(fragment.value);
+      if (prompt)
+        prompts.push({ source: path, value: prompt });
+    }
+  }
+  for (const prompt of prompts) {
+    const path = resolve2(dirname(prompt.source), prompt.value);
+    within(layer, path, "Agent prompt");
+    rejectSymlinkComponents(canonicalRoot, path, "Agent prompt");
+    if (!existsSync(path))
+      throw new Error(`Agent prompt is missing: ${path}`);
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink())
+      throw new Error(`Agent prompt must be a regular non-symlink file: ${path}`);
+    const canonical = realpathSync(path);
+    within(realpathSync(layer), canonical, "Agent prompt");
+    files.set(relative(canonicalRoot, path).replaceAll("\\", "/"), readFileSync(path));
+  }
+  return {
+    canonicalRoot,
+    inputs: [...files].map(([identity, bytes]) => ({ identity, bytes })).sort((left, right) => left.identity.localeCompare(right.identity))
+  };
+}
+function computeProjectTrustToken(projectDirectory) {
+  const collected = collectProjectTrustInputs(projectDirectory);
+  const hash = createHash("sha256");
+  hash.update("agent-gvozd-project-trust-v1\x00");
+  hash.update(collected.canonicalRoot);
+  hash.update("\x00");
+  for (const input of collected.inputs) {
+    hash.update(String(Buffer.byteLength(input.identity)));
+    hash.update(":");
+    hash.update(input.identity);
+    hash.update(":");
+    hash.update(String(input.bytes.length));
+    hash.update(":");
+    hash.update(input.bytes);
+    hash.update("\x00");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
 // src/config.ts
 var permissionSchema = object({
   action: string2().min(1),
   resource: string2().min(1),
   effect: _enum(["allow", "ask", "deny"])
-});
+}).strict();
 var modelRefSchema = string2().min(1).regex(/^[^/#\s]+\/[^#\s]+(?:#[^#\s]+)?$/, "Expected provider/model or provider/model#variant");
 var agentIdSchema = string2().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/, "Expected a filesystem-safe agent ID");
 var fileLeaseRoleSchema = _enum(["coordinator", "writer", "readonly"]);
@@ -6485,12 +6652,13 @@ var agentPatchSchema = object({
   permissions: array(permissionSchema).optional(),
   fileLease: fileLeaseRoleSchema.optional(),
   disabled: boolean2().optional()
-});
+}).strict();
 var rootPatchSchema = object({
+  $schema: string2().min(1).optional(),
   defaultAgent: agentIdSchema.optional(),
   agentsDirectory: string2().min(1).optional(),
   agents: record(agentIdSchema, agentPatchSchema).optional()
-});
+}).strict();
 var resolvedAgentSchema = agentPatchSchema.extend({
   description: string2().min(1),
   mode: _enum(["primary", "subagent", "all"]),
@@ -6502,9 +6670,18 @@ var resolvedAgentSchema = agentPatchSchema.extend({
   fileLease: fileLeaseRoleSchema,
   disabled: boolean2()
 });
-function readJsonc(path) {
+var SAFE_UNTRUSTED_AGENT_FIELDS = new Set(["description"]);
+function assertTrustedProjectPatch(patch, sourcePath, id, trusted, knownAgents) {
+  if (trusted)
+    return;
+  const fields = Object.keys(patch).filter((field) => !SAFE_UNTRUSTED_AGENT_FIELDS.has(field));
+  if (fields.length === 0 && knownAgents.has(id))
+    return;
+  throw new Error(`Untrusted project config ${sourcePath} cannot override ${fields.join(", ") || `unknown agent ${id}`}. ` + `Set ${PROJECT_TRUST_ENV} to the exact token returned by computeProjectTrustToken() after reviewing these files.`);
+}
+function readJsonc2(path) {
   const errors = [];
-  const value = parse2(readFileSync(path, "utf8"), errors, {
+  const value = parse2(readFileSync2(path, "utf8"), errors, {
     allowTrailingComma: true,
     disallowComments: false
   });
@@ -6515,45 +6692,62 @@ function readJsonc(path) {
   return value;
 }
 function assertWithin(base, target, label) {
-  const child = relative(base, target);
-  if (child === "" || !child.startsWith("..") && !isAbsolute(child))
+  const child = relative2(base, target);
+  if (child === "" || !child.startsWith("..") && !isAbsolute3(child))
     return;
   throw new Error(`${label} must stay inside ${base}: ${target}`);
 }
 function resolvePrompt(patch, sourcePath, layerDirectory) {
   if (!patch.prompt)
     return patch;
-  const prompt = resolve(dirname(sourcePath), patch.prompt);
+  const prompt = resolve3(dirname2(sourcePath), patch.prompt);
   assertWithin(layerDirectory, prompt, "Agent prompt");
-  if (!existsSync(prompt))
+  if (!existsSync2(prompt))
     throw new Error(`Agent prompt is missing: ${prompt}`);
-  const canonical = realpathSync(prompt);
-  assertWithin(realpathSync(layerDirectory), canonical, "Agent prompt");
-  return { ...patch, prompt: canonical };
-}
-function loadLayer(directory, rootFileName, required) {
-  const rootPath = join(directory, rootFileName);
-  if (!existsSync(rootPath)) {
+  const promptStat = lstatSync2(prompt);
+  if (promptStat.isSymbolicLink() || !promptStat.isFile())
+    throw new Error(`Agent prompt must be a regular non-symlink file: ${prompt}`);
+  const canonical = realpathSync2(prompt);
+  assertWithin(realpathSync2(layerDirectory), canonical, "Agent prompt");
+  const promptContent = readFileSync2(canonical, "utf8");
+  return { ...patch, prompt: canonical, promptContent };
+}
+function loadLayer(directory, rootFileName, required, projectPolicy) {
+  const rootPath = join3(directory, rootFileName);
+  if (!existsSync2(rootPath)) {
     if (required)
       throw new Error(`Required config is missing: ${rootPath}`);
     return { agents: {}, sources: [] };
   }
-  const root = rootPatchSchema.parse(readJsonc(rootPath));
+  const root = rootPatchSchema.parse(readJsonc2(rootPath));
+  if (projectPolicy && !projectPolicy.trusted) {
+    const restricted = ["defaultAgent", "agentsDirectory"].filter((field) => Object.prototype.hasOwnProperty.call(root, field));
+    if (restricted.length > 0)
+      throw new Error(`Untrusted project config ${rootPath} cannot override ${restricted.join(", ")}`);
+  }
   const agents = {};
   for (const [id, patch] of Object.entries(root.agents ?? {})) {
+    if (projectPolicy)
+      assertTrustedProjectPatch(patch, rootPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
     agents[id] = resolvePrompt(patch, rootPath, directory);
   }
-  const agentsDirectory = resolve(directory, root.agentsDirectory ?? "agents");
+  const agentsDirectory = resolve3(directory, root.agentsDirectory ?? "agents");
   assertWithin(directory, agentsDirectory, "agentsDirectory");
-  if (existsSync(agentsDirectory)) {
-    assertWithin(realpathSync(directory), realpathSync(agentsDirectory), "agentsDirectory");
-    for (const entry of readdirSync(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  if (existsSync2(agentsDirectory)) {
+    const directoryStat = lstatSync2(agentsDirectory);
+    if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
+      throw new Error(`agentsDirectory must be a regular directory: ${agentsDirectory}`);
+    }
+    assertWithin(realpathSync2(directory), realpathSync2(agentsDirectory), "agentsDirectory");
+    for (const entry of readdirSync2(agentsDirectory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isFile() || !entry.name.endsWith(".jsonc"))
         continue;
       const id = entry.name.slice(0, -".jsonc".length);
       agentIdSchema.parse(id);
-      const agentPath = join(agentsDirectory, entry.name);
-      const patch = agentPatchSchema.parse(readJsonc(agentPath));
+      const agentPath = join3(agentsDirectory, entry.name);
+      const patch = agentPatchSchema.parse(readJsonc2(agentPath));
+      if (projectPolicy)
+        assertTrustedProjectPatch(patch, agentPath, id, projectPolicy.trusted, projectPolicy.knownAgents);
       agents[id] = mergeAgent(agents[id], resolvePrompt(patch, agentPath, directory));
     }
   }
@@ -6567,22 +6761,24 @@ function mergeAgent(base, override) {
   return { ...base ?? {}, ...override };
 }
 function resolveAgentConfig(patch) {
-  const parsed = agentPatchSchema.parse(patch);
-  return resolvedAgentSchema.parse({
+  const parsed = agentPatchSchema.extend({ promptContent: string2().optional() }).parse(patch);
+  const { promptContent, ...agentPatch } = parsed;
+  const resolved = resolvedAgentSchema.parse({
     skills: [],
     mcp: [],
     permissions: [],
     fileLease: "readonly",
     disabled: false,
-    ...parsed
+    ...agentPatch
   });
+  return promptContent === undefined ? resolved : { ...resolved, promptContent };
 }
 function findPackageRoot() {
-  let current = dirname(fileURLToPath(import.meta.url));
+  let current = dirname2(fileURLToPath(import.meta.url));
   while (true) {
-    if (existsSync(join(current, "defaults", "default.jsonc")))
+    if (existsSync2(join3(current, "defaults", "default.jsonc")))
       return current;
-    const parent = dirname(current);
+    const parent = dirname2(current);
     if (parent === current)
       break;
     current = parent;
@@ -6590,34 +6786,35 @@ function findPackageRoot() {
   throw new Error("Unable to locate agent-gvozd package defaults");
 }
 function findProjectRoot(start) {
-  let current = resolve(start);
+  let current = resolve3(start);
   while (true) {
-    const git = join(current, ".git");
-    if (existsSync(git))
+    const git = join3(current, ".git");
+    if (existsSync2(git))
       return current;
-    const parent = dirname(current);
+    const parent = dirname2(current);
     if (parent === current)
-      return resolve(start);
+      return resolve3(start);
     current = parent;
   }
 }
-function resolveOpenCodeConfigRoot(env = process.env, platform = process.platform, home = homedir()) {
-  if (env.XDG_CONFIG_HOME)
-    return join(env.XDG_CONFIG_HOME, "opencode");
-  if (platform === "win32" && env.APPDATA)
-    return join(env.APPDATA, "opencode");
-  return join(home, ".config", "opencode");
-}
 function loadConfig(projectDirectory, options = {}) {
   const projectRoot = findProjectRoot(projectDirectory);
   const packageRoot = findPackageRoot();
-  const projectConfigDirectory = join(projectRoot, "docs", ".gvozd");
-  const globalConfigDirectory = join(options.configRoot ?? resolveOpenCodeConfigRoot(options.env, options.platform, options.home), "gvozd");
-  const layers = [
-    loadLayer(join(packageRoot, "defaults"), "default.jsonc", true),
-    loadLayer(globalConfigDirectory, "config.jsonc", false),
-    ...options.includeProject === false ? [] : [loadLayer(projectConfigDirectory, "config.jsonc", false)]
+  const projectConfigDirectory = join3(projectRoot, "docs", ".gvozd");
+  const globalConfigDirectory = join3(resolveOpenCodeConfigRoot(options.env, options.platform, options.home, options.configRoot), "gvozd");
+  const baseLayers = [
+    loadLayer(join3(packageRoot, "defaults"), "default.jsonc", true),
+    loadLayer(globalConfigDirectory, "config.jsonc", false)
   ];
+  const knownAgents = new Set(baseLayers.flatMap((layer) => Object.keys(layer.agents)));
+  const includeProject = options.includeProject !== false;
+  const suppliedToken = includeProject ? options.projectTrustToken ?? (options.env ?? process.env)[PROJECT_TRUST_ENV] : undefined;
+  const trustProjectConfig = includeProject && suppliedToken !== undefined && suppliedToken === computeProjectTrustToken(projectRoot);
+  const projectLayer = includeProject ? loadLayer(projectConfigDirectory, "config.jsonc", false, { trusted: trustProjectConfig, knownAgents }) : undefined;
+  if (trustProjectConfig && suppliedToken !== computeProjectTrustToken(projectRoot)) {
+    throw new Error("Project configuration changed while its trust token was being validated; review it and compute a new token");
+  }
+  const layers = [...baseLayers, ...projectLayer ? [projectLayer] : []];
   let defaultAgent;
   const agents = {};
   for (const layer of layers) {
@@ -6630,7 +6827,12 @@ function loadConfig(projectDirectory, options = {}) {
     throw new Error("defaultAgent is not configured");
   const resolvedAgents = Object.fromEntries(Object.entries(agents).map(([id, patch]) => [
     id,
-    resolveAgentConfig(patch)
+    (() => {
+      const agent = resolveAgentConfig(patch);
+      if (agent.promptContent === undefined)
+        throw new Error(`Agent prompt snapshot is missing after configuration load: ${agent.prompt}`);
+      return agent;
+    })()
   ]));
   const defaultConfig = resolvedAgents[defaultAgent];
   if (!defaultConfig || defaultConfig.disabled || defaultConfig.mode === "subagent") {
@@ -6648,15 +6850,79 @@ function loadConfig(projectDirectory, options = {}) {
 }
 
 // src/cli/doctor.ts
-import { lstatSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, lstatSync as lstatSync3, readFileSync as readFileSync3, readdirSync as readdirSync3 } from "node:fs";
+import { join as join4, resolve as resolve4 } from "node:path";
 
-// src/agent-generation.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+// src/agent-permissions.ts
+function normalizeMcpName(name) {
+  return name.replaceAll(/[^A-Za-z0-9_-]/g, "_");
+}
+function buildAgentPermissions(agent, mcpServers) {
+  const result = [
+    ...agent.permissions,
+    { action: "skill", resource: "*", effect: "deny" },
+    ...agent.skills.map((skill) => ({ action: "skill", resource: skill, effect: "allow" }))
+  ];
+  for (const server of mcpServers) {
+    const prefix = `${normalizeMcpName(server)}_`;
+    result.push({
+      action: `${prefix}*`,
+      resource: "*",
+      effect: agent.mcp.includes(server) ? "allow" : "deny"
+    });
+    result.push(...agent.permissions.filter((rule) => rule.action.startsWith(prefix)));
+  }
+  return result;
+}
+
+// src/release-metadata.ts
+var PACKAGE_NAME = "@nail00749/agent-gvozd";
+var PACKAGE_VERSION = "0.1.2";
+var PACKAGE_SPEC = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
+var SUPPORTED_OPENCODE_VERSION = "0.0.0-beta-19425";
+var CONFIG_SCHEMA_VERSION = 1;
 
 // src/constants.ts
 var GENERATED_MARKER = "# Generated by agent-gvozd sync. Do not edit this file directly.";
 var GENERATED_PLUGIN_MARKER = "// Generated by agent-gvozd sync. Do not edit this file directly.";
+function hasGeneratedAgentMarker(content) {
+  return content.startsWith(`---
+${GENERATED_MARKER}
+`);
+}
+function hasGeneratedPluginMarker(content) {
+  return content.startsWith(`${GENERATED_PLUGIN_MARKER}
+`);
+}
+function hasGeneratedSchemaMarker(content) {
+  const errors = [];
+  const value = parse2(content, errors, { allowTrailingComma: true, disallowComments: false });
+  return errors.length === 0 && value !== null && typeof value === "object" && !Array.isArray(value) && value.$comment === GENERATED_PLUGIN_MARKER && value["x-agent-gvozd-schema-version"] === CONFIG_SCHEMA_VERSION;
+}
+function stable(value) {
+  if (Array.isArray(value))
+    return value.map(stable);
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, stable(entry)]));
+}
+function isEquivalentLegacySchema(content, generated) {
+  try {
+    const previous = JSON.parse(content);
+    const expected = JSON.parse(generated);
+    if (!previous || Array.isArray(previous) || previous.$comment !== undefined)
+      return false;
+    if (previous["x-agent-gvozd-schema-version"] !== undefined && previous["x-agent-gvozd-schema-version"] !== CONFIG_SCHEMA_VERSION)
+      return false;
+    delete previous.$comment;
+    delete previous["x-agent-gvozd-schema-version"];
+    delete expected.$comment;
+    delete expected["x-agent-gvozd-schema-version"];
+    return JSON.stringify(stable(previous)) === JSON.stringify(stable(expected));
+  } catch {
+    return false;
+  }
+}
 
 // src/agent-generation.ts
 function yamlString(value) {
@@ -6675,12 +6941,11 @@ function renderPermissions(rules) {
   ];
 }
 function renderAgent(agent) {
-  const prompt = readFileSync2(agent.prompt, "utf8").trim();
-  const permissions = [
-    ...agent.permissions,
-    { action: "skill", resource: "*", effect: "deny" },
-    ...agent.skills.map((skill) => ({ action: "skill", resource: skill, effect: "allow" }))
-  ];
+  if (agent.promptContent === undefined) {
+    throw new Error(`Agent is missing its immutable prompt snapshot (${agent.prompt})`);
+  }
+  const prompt = agent.promptContent.trim();
+  const permissions = buildAgentPermissions(agent, []);
   return [
     "---",
     GENERATED_MARKER,
@@ -6695,9 +6960,15 @@ function renderAgent(agent) {
 `);
 }
 
+// src/runtime-events.ts
+function redactDiagnostic(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi, "[redacted private key]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]*@/gi, "$1[redacted]@").replace(/([?&](?:access_?token|auth(?:orization)?|api_?key|cookie|credential|password|secret|token)=)[^&#\s]*/gi, "$1[redacted]").replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b([A-Za-z0-9_]*(?:token|password|authorization|api_?key|secret|credential|cookie)[A-Za-z0-9_]*)\s*[:=]\s*["']?[^\s,;}"']+/gi, "$1=[redacted]").replace(/\s+/g, " ").slice(0, 300);
+}
+
 // src/cli/opencode.ts
 import { spawn } from "node:child_process";
-import { isAbsolute as isAbsolute2 } from "node:path";
+import { isAbsolute as isAbsolute4 } from "node:path";
 var MAX_OUTPUT_BYTES = 64 * 1024;
 var DEFAULT_TIMEOUT_MS = 15000;
 function appendBounded(current, chunk) {
@@ -6709,43 +6980,96 @@ function appendBounded(current, chunk) {
 var defaultProcessRunner = {
   run(executable, args, timeoutMs = DEFAULT_TIMEOUT_MS) {
     return new Promise((resolve, reject) => {
+      const grouped = process.platform !== "win32";
       const child = spawn(executable, [...args], {
+        detached: grouped,
         shell: false,
         stdio: ["ignore", "pipe", "pipe"]
       });
       let stdout = "";
       let stderr = "";
+      let settled = false;
       let timedOut = false;
       let forceKill;
+      let hardDeadline;
+      const terminate = (signal) => {
+        try {
+          if (grouped && child.pid)
+            process.kill(-child.pid, signal);
+          else
+            child.kill(signal);
+        } catch {
+          try {
+            child.kill(signal);
+          } catch {}
+        }
+      };
+      const onStdout = (chunk) => {
+        stdout = appendBounded(stdout, chunk);
+      };
+      const onStderr = (chunk) => {
+        stderr = appendBounded(stderr, chunk);
+      };
+      const timeoutError = () => {
+        const error = new Error(`OpenCode command timed out after ${timeoutMs}ms`);
+        error.code = "ETIMEDOUT";
+        return error;
+      };
+      const clearTimers = () => {
+        clearTimeout(timer);
+        if (forceKill)
+          clearTimeout(forceKill);
+        if (hardDeadline)
+          clearTimeout(hardDeadline);
+      };
+      const settleTimeout = (destroy) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimers();
+        if (destroy) {
+          child.stdout.off("data", onStdout);
+          child.stderr.off("data", onStderr);
+          child.stdout.destroy();
+          child.stderr.destroy();
+        }
+        reject(timeoutError());
+      };
       const timer = setTimeout(() => {
+        if (settled)
+          return;
         timedOut = true;
-        child.kill("SIGTERM");
-        forceKill = setTimeout(() => child.kill("SIGKILL"), 500);
+        terminate("SIGTERM");
+        forceKill = setTimeout(() => terminate("SIGKILL"), 500);
         forceKill.unref();
+        hardDeadline = setTimeout(() => settleTimeout(true), 1750);
+        hardDeadline.unref();
       }, timeoutMs);
       timer.unref();
-      child.stdout.on("data", (chunk) => {
-        stdout = appendBounded(stdout, chunk);
-      });
-      child.stderr.on("data", (chunk) => {
-        stderr = appendBounded(stderr, chunk);
-      });
+      child.stdout.on("data", onStdout);
+      child.stderr.on("data", onStderr);
       child.once("error", (error) => {
-        clearTimeout(timer);
-        if (forceKill)
-          clearTimeout(forceKill);
+        clearTimers();
+        if (settled)
+          return;
+        settled = true;
+        if (timedOut) {
+          child.stdout.off("data", onStdout);
+          child.stderr.off("data", onStderr);
+          child.stdout.destroy();
+          child.stderr.destroy();
+        }
         reject(error);
       });
       child.once("close", (code) => {
-        clearTimeout(timer);
-        if (forceKill)
-          clearTimeout(forceKill);
+        clearTimers();
+        if (settled)
+          return;
         if (timedOut) {
-          const error = new Error(`OpenCode command timed out after ${timeoutMs}ms`);
-          error.code = "ETIMEDOUT";
-          reject(error);
+          settleTimeout(false);
           return;
         }
+        settled = true;
         resolve({ code: code ?? 1, stdout, stderr });
       });
     });
@@ -6757,8 +7081,8 @@ function bounded(value) {
 async function checked(runner, executable, args, timeoutMs) {
   const result = await runner.run(executable, args, timeoutMs);
   if (result.code !== 0) {
-    const detail = bounded(result.stderr).trim();
-    throw new Error(`${executable} ${args.join(" ")} exited ${result.code}${detail ? `: ${detail}` : ""}`);
+    const detail = redactDiagnostic(bounded(result.stderr).trim());
+    throw new Error(`OpenCode command exited ${result.code}${detail ? `: ${detail}` : ""}`);
   }
   return bounded(result.stdout);
 }
@@ -6770,7 +7094,7 @@ function parseDebugPaths(output) {
       continue;
     paths[match[1]] = match[2];
   }
-  if (!paths.config || !isAbsolute2(paths.config)) {
+  if (!paths.config || !isAbsolute4(paths.config)) {
     throw new Error("OpenCode did not report an absolute config path");
   }
   return paths;
@@ -6875,10 +7199,6 @@ function manualProfile(provider, fast, deep, catalog) {
 
 // src/cli/doctor.ts
 var SETUP_COMMAND = "gvozd setup";
-function redact(value) {
-  const message = value instanceof Error ? value.message : String(value);
-  return message.replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [redacted]").replace(/\b([A-Za-z0-9_]*(?:token|password|authorization|api_?key|secret|credential|cookie)[A-Za-z0-9_]*)\s*[:=]\s*["']?[^\s,;}"']+/gi, "$1=[redacted]").replace(/\s+/g, " ").slice(0, 300);
-}
 function aggregate(checks) {
   if (checks.some((check) => check.status === "fail"))
     return "fail";
@@ -6888,7 +7208,7 @@ function aggregate(checks) {
 }
 function safeFile(path) {
   try {
-    const stat = lstatSync(path);
+    const stat = lstatSync3(path);
     return stat.isFile() && !stat.isSymbolicLink();
   } catch {
     return false;
@@ -6900,8 +7220,10 @@ function escapeRegExp(value) {
 function hasAgentIdentifier(output, id) {
   return new RegExp(`(?:^|[^A-Za-z0-9_-])${escapeRegExp(id)}(?=$|[^A-Za-z0-9_-])`, "m").test(output);
 }
-function hasPluginIdentifier(output, name) {
-  return new RegExp(`(?:^|[\\s"'|│])${escapeRegExp(name)}(?:@[^\\s"'|│,}\\]]+)?(?=$|[\\s"'|│,}\\]])`, "m").test(output);
+function hasInstalledPluginVersion(output, name, version) {
+  const boundary = `[\\s"'|│,}\\]]`;
+  const pattern = `(?:^|${boundary})${escapeRegExp(name)}(?:@|\\s+)v?${escapeRegExp(version)}(?=$|${boundary})`;
+  return new RegExp(pattern, "m").test(output);
 }
 function checkGlobalFiles(config, configRoot) {
   const missing = [];
@@ -6909,27 +7231,43 @@ function checkGlobalFiles(config, configRoot) {
   for (const [id, agent] of Object.entries(config.agents).sort(([left], [right]) => left.localeCompare(right))) {
     if (agent.disabled)
       continue;
-    const path = join2(configRoot, "agents", `${id}.md`);
+    const path = join4(configRoot, "agents", `${id}.md`);
     if (!safeFile(path)) {
       missing.push(id);
       continue;
     }
     const content = readFileSync3(path, "utf8");
-    if (!content.includes(GENERATED_MARKER) || content !== renderAgent(agent))
+    if (!hasGeneratedAgentMarker(content) || content !== renderAgent(agent))
       stale.push(id);
   }
-  if (missing.length + stale.length === 0) {
-    return { id: "global-agents", status: "pass", summary: `${Object.keys(config.agents).length} managed global agents are current` };
+  const enabled = new Set(Object.entries(config.agents).filter(([, agent]) => !agent.disabled).map(([id]) => `${id}.md`));
+  const orphans = [];
+  const directory = join4(configRoot, "agents");
+  if (existsSync3(directory) && lstatSync3(directory).isDirectory() && !lstatSync3(directory).isSymbolicLink()) {
+    for (const entry of readdirSync3(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      if (!entry.isFile() || !entry.name.endsWith(".md") || enabled.has(entry.name))
+        continue;
+      const content = readFileSync3(join4(directory, entry.name), "utf8");
+      if (hasGeneratedAgentMarker(content))
+        orphans.push(entry.name.slice(0, -3));
+    }
+  }
+  if (missing.length + stale.length + orphans.length === 0) {
+    return { id: "global-agents", status: "pass", summary: `${enabled.size} managed global agents are current` };
   }
-  const details = [missing.length ? `missing: ${missing.join(", ")}` : "", stale.length ? `unmanaged or stale: ${stale.join(", ")}` : ""].filter(Boolean).join("; ");
+  const details = [
+    missing.length ? `missing: ${missing.join(", ")}` : "",
+    stale.length ? `unmanaged or stale: ${stale.join(", ")}` : "",
+    orphans.length ? `orphan managed agents: ${orphans.join(", ")}` : ""
+  ].filter(Boolean).join("; ");
   return { id: "global-agents", status: "fail", summary: details, remediation: SETUP_COMMAND };
 }
 function checkLegacy(config) {
   const duplicates = [];
-  const plugin = join2(config.projectRoot, ".opencode", "plugins", "agent-gvozd", "index.ts");
+  const plugin = join4(config.projectRoot, ".opencode", "plugins", "agent-gvozd", "index.ts");
   if (safeFile(plugin))
     duplicates.push("local plugin");
-  const agents = Object.keys(config.agents).filter((id) => safeFile(join2(config.projectRoot, ".opencode", "agents", `${id}.md`)));
+  const agents = Object.keys(config.agents).filter((id) => safeFile(join4(config.projectRoot, ".opencode", "agents", `${id}.md`)));
   if (agents.length > 0)
     duplicates.push(`${agents.length} local agents`);
   if (duplicates.length === 0)
@@ -6942,58 +7280,59 @@ function checkLegacy(config) {
   };
 }
 async function runDoctor(input) {
-  const packageName = input.packageName ?? "@nail00749/agent-gvozd";
-  const packageVersion = input.packageVersion ?? "0.1.0";
-  const supportedVersion = input.supportedOpenCodeVersion ?? "0.0.0-beta-19425";
+  const packageName = input.packageName ?? PACKAGE_NAME;
+  const packageVersion = input.packageVersion ?? PACKAGE_VERSION;
+  const supportedVersion = input.supportedOpenCodeVersion ?? SUPPORTED_OPENCODE_VERSION;
   const checks = [];
   try {
     const version = await input.client.version();
-    checks.push(parseOpenCodeVersion(version) === supportedVersion ? { id: "opencode-version", status: "pass", summary: `OpenCode ${supportedVersion} is available` } : { id: "opencode-version", status: "fail", summary: `unsupported OpenCode version: ${redact(version)}`, remediation: `Install OpenCode ${supportedVersion}` });
+    checks.push(parseOpenCodeVersion(version) === supportedVersion ? { id: "opencode-version", status: "pass", summary: `OpenCode ${supportedVersion} is available` } : { id: "opencode-version", status: "fail", summary: `unsupported OpenCode version: ${redactDiagnostic(version)}`, remediation: `Install OpenCode ${supportedVersion}` });
   } catch (error) {
-    checks.push({ id: "opencode-version", status: "fail", summary: `OpenCode version check failed: ${redact(error)}`, remediation: `Install OpenCode ${supportedVersion}` });
+    checks.push({ id: "opencode-version", status: "fail", summary: `OpenCode version check failed: ${redactDiagnostic(error)}`, remediation: `Install OpenCode ${supportedVersion}` });
   }
   try {
     await input.client.serviceStatus();
     checks.push({ id: "service", status: "pass", summary: "OpenCode service is reachable" });
   } catch (error) {
-    checks.push({ id: "service", status: "fail", summary: `OpenCode service is unavailable: ${redact(error)}`, remediation: `${input.client.executable} service restart` });
+    checks.push({ id: "service", status: "fail", summary: `OpenCode service is unavailable: ${redactDiagnostic(error)}`, remediation: `${input.client.executable} service restart` });
   }
   try {
     const output = await input.client.pluginList();
-    checks.push(hasPluginIdentifier(output, packageName) ? { id: "plugin", status: "pass", summary: `${packageName} is registered` } : { id: "plugin", status: "fail", summary: `${packageName} is not registered`, remediation: SETUP_COMMAND });
+    checks.push(hasInstalledPluginVersion(output, packageName, packageVersion) ? { id: "plugin", status: "pass", summary: `${packageName} ${packageVersion} is registered` } : { id: "plugin", status: "fail", summary: `${packageName} ${packageVersion} is not registered`, remediation: SETUP_COMMAND });
   } catch (error) {
-    checks.push({ id: "plugin", status: "fail", summary: `plugin list failed: ${redact(error)}`, remediation: SETUP_COMMAND });
+    checks.push({ id: "plugin", status: "fail", summary: `plugin list failed: ${redactDiagnostic(error)}`, remediation: SETUP_COMMAND });
   }
   try {
-    const output = await input.client.pluginCheck(`${packageName}@^${packageVersion}`);
-    const unhealthy = /\b(error|failed|incompatible)\b/i.test(output);
-    checks.push(unhealthy ? { id: "plugin-check", status: "fail", summary: "OpenCode reports an unhealthy Gvozd plugin", remediation: SETUP_COMMAND } : { id: "plugin-check", status: "pass", summary: "Gvozd plugin check passed" });
+    await input.client.pluginCheck(PACKAGE_SPEC);
+    checks.push({ id: "plugin-check", status: "pass", summary: "Gvozd plugin check passed" });
   } catch (error) {
-    checks.push({ id: "plugin-check", status: "fail", summary: `plugin check failed: ${redact(error)}`, remediation: SETUP_COMMAND });
+    checks.push({ id: "plugin-check", status: "fail", summary: `plugin check failed: ${redactDiagnostic(error)}`, remediation: SETUP_COMMAND });
   }
   try {
     const paths = await input.client.debugPaths();
-    checks.push(resolve2(paths.config) === resolve2(input.configRoot) ? { id: "config-root", status: "pass", summary: "runtime and CLI config roots match" } : { id: "config-root", status: "fail", summary: "runtime and CLI config roots differ", remediation: `${input.client.executable} debug paths` });
+    const reported = resolve4(paths.config);
+    const expected = resolve4(input.runtimeConfigRoot ?? input.configRoot);
+    checks.push(reported === resolve4(input.configRoot) && reported === expected ? { id: "config-root", status: "pass", summary: "runtime and CLI config roots match" } : { id: "config-root", status: "fail", summary: "OpenCode debug path and independently resolved runtime config root differ", remediation: `${input.client.executable} debug paths; set GVOZD_OPENCODE_CONFIG_ROOT to the reported config path before starting OpenCode` });
   } catch (error) {
-    checks.push({ id: "config-root", status: "fail", summary: `config path check failed: ${redact(error)}` });
+    checks.push({ id: "config-root", status: "fail", summary: `config path check failed: ${redactDiagnostic(error)}` });
   }
   let config;
   let globalConfig;
-  const configPath = join2(input.configRoot, "gvozd", "config.jsonc");
-  const schemaPath = join2(input.configRoot, "gvozd", "schema.json");
+  const configPath = join4(input.configRoot, "gvozd", "config.jsonc");
+  const schemaPath = join4(input.configRoot, "gvozd", "schema.json");
   try {
     if (!safeFile(configPath) || !safeFile(schemaPath))
       throw new Error("global config.jsonc or schema.json is missing");
     const schemaErrors = [];
     const schema = parse2(readFileSync3(schemaPath, "utf8"), schemaErrors);
-    if (schemaErrors.length > 0 || schema?.["x-agent-gvozd-schema-version"] !== 1 || !readFileSync3(schemaPath, "utf8").includes(GENERATED_PLUGIN_MARKER)) {
+    if (schemaErrors.length > 0 || schema?.["x-agent-gvozd-schema-version"] !== CONFIG_SCHEMA_VERSION || schema?.$comment !== GENERATED_PLUGIN_MARKER) {
       throw new Error("global schema is invalid, incompatible, or unmanaged");
     }
     globalConfig = loadConfig(input.cwd, { configRoot: input.configRoot, includeProject: false });
     config = loadConfig(input.cwd, { configRoot: input.configRoot });
     checks.push({ id: "config", status: "pass", summary: "global Gvozd config and schema are valid" });
   } catch (error) {
-    checks.push({ id: "config", status: "fail", summary: `global config check failed: ${redact(error)}`, remediation: SETUP_COMMAND });
+    checks.push({ id: "config", status: "fail", summary: `global config check failed: ${redactDiagnostic(error)}`, remediation: SETUP_COMMAND });
   }
   let catalog = parseModels([]);
   try {
@@ -7003,12 +7342,14 @@ async function runDoctor(input) {
     if (!config) {
       checks.push({ id: "models", status: "fail", summary: "configured models cannot be validated without a valid config", remediation: SETUP_COMMAND });
     } else {
-      const configured = new Set(Object.values(config.agents).flatMap((agent) => agent.models));
-      const missing = [...configured].filter((model) => !catalog.models.includes(model)).sort();
-      checks.push(missing.length === 0 ? { id: "models", status: "pass", summary: `${catalog.models.length} available models cover the Gvozd profile` } : { id: "models", status: "fail", summary: `configured models are unavailable: ${missing.join(", ")}`, remediation: "gvozd config" });
+      const available = new Set(catalog.models);
+      const enabled = Object.entries(config.agents).filter(([, agent]) => !agent.disabled);
+      const unavailableAgents = enabled.filter(([, agent]) => !agent.models.some((model) => available.has(model))).map(([id]) => id);
+      const missingFallbacks = [...new Set(enabled.flatMap(([, agent]) => agent.models.filter((model) => !available.has(model))))].sort();
+      checks.push(unavailableAgents.length > 0 ? { id: "models", status: "fail", summary: `no configured model is available for: ${unavailableAgents.join(", ")}`, remediation: "gvozd config" } : missingFallbacks.length > 0 ? { id: "models", status: "warn", summary: `primary coverage is available; unavailable fallback models: ${missingFallbacks.join(", ")}`, remediation: "gvozd config" } : { id: "models", status: "pass", summary: `${catalog.models.length} available models cover the Gvozd profile` });
     }
   } catch (error) {
-    checks.push({ id: "models", status: "fail", summary: `model catalog check failed: ${redact(error)}`, remediation: `${input.client.executable} auth` });
+    checks.push({ id: "models", status: "fail", summary: `model catalog check failed: ${redactDiagnostic(error)}`, remediation: `${input.client.executable} auth` });
   }
   if (globalConfig)
     checks.push(checkGlobalFiles(globalConfig, input.configRoot));
@@ -7019,7 +7360,7 @@ async function runDoctor(input) {
     const missing = Object.entries(config?.agents ?? {}).filter(([, agent]) => !agent.disabled).map(([id]) => id).filter((id) => !hasAgentIdentifier(output, id));
     checks.push(missing.length === 0 && config ? { id: "runtime-agents", status: "pass", summary: "all enabled Gvozd agents are visible to OpenCode" } : { id: "runtime-agents", status: "fail", summary: `runtime agents are missing: ${missing.join(", ") || "config unavailable"}`, remediation: `${input.client.executable} service restart` });
   } catch (error) {
-    checks.push({ id: "runtime-agents", status: "fail", summary: `runtime agent check failed: ${redact(error)}`, remediation: `${input.client.executable} service restart` });
+    checks.push({ id: "runtime-agents", status: "fail", summary: `runtime agent check failed: ${redactDiagnostic(error)}`, remediation: `${input.client.executable} service restart` });
   }
   checks.push(config ? checkLegacy(config) : { id: "legacy-local", status: "warn", summary: "legacy duplicates could not be checked" });
   return { schemaVersion: 1, status: aggregate(checks), checks };
@@ -7044,20 +7385,84 @@ function doctorOperationalFailure(error) {
   const checks = [{
     id: "opencode-discovery",
     status: "fail",
-    summary: `OpenCode discovery failed: ${redact(error)}`,
-    remediation: "Install OpenCode 0.0.0-beta-19425 and run gvozd doctor again"
+    summary: `OpenCode discovery failed: ${redactDiagnostic(error)}`,
+    remediation: `Install OpenCode ${SUPPORTED_OPENCODE_VERSION} and run gvozd doctor again`
   }];
   return { schemaVersion: 1, status: "fail", checks };
 }
 
 // src/cli/setup.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname6, join as join8 } from "node:path";
 
 // src/cli/config-store.ts
-import { closeSync, existsSync as existsSync3, lstatSync as lstatSync2, mkdirSync, openSync, readFileSync as readFileSync4, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { accessSync, closeSync, constants as fsConstants, existsSync as existsSync4, lstatSync as lstatSync5, mkdirSync, openSync, readFileSync as readFileSync4, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname3, join as join6 } from "node:path";
+
+// src/secure-path.ts
+import { lstatSync as lstatSync4, realpathSync as realpathSync3 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join5, parse as parse6, relative as relative3, resolve as resolve5, sep } from "node:path";
+function secureCanonicalPath(target, label = "Path") {
+  if (!isAbsolute5(target))
+    throw new Error(`${label} must be absolute: ${target}`);
+  const lexical = resolve5(target);
+  const root = parse6(lexical).root;
+  const components = relative3(root, lexical).split(sep).filter(Boolean);
+  let current = root;
+  let nearestExisting = root;
+  const missingSuffix = [];
+  let missing = false;
+  const rootStat = lstatSync4(root);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+    throw new Error(`${label} has an unsafe filesystem root: ${root}`);
+  const existingDirectories = [{ path: root, stat: rootStat }];
+  for (const component of components) {
+    current = join5(current, component);
+    if (missing) {
+      missingSuffix.push(component);
+      continue;
+    }
+    let stat;
+    try {
+      stat = lstatSync4(current);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+      missing = true;
+      missingSuffix.push(component);
+      continue;
+    }
+    if (stat.isSymbolicLink())
+      throw new Error(`${label} contains a symbolic-link component: ${current}`);
+    if (current !== lexical && !stat.isDirectory()) {
+      throw new Error(`${label} contains a non-directory ancestor: ${current}`);
+    }
+    if (stat.isDirectory())
+      existingDirectories.push({ path: current, stat });
+    nearestExisting = current;
+  }
+  if (process.platform !== "win32") {
+    const uid = process.getuid?.();
+    for (let index = 0;index < existingDirectories.length; index++) {
+      const entry = existingDirectories[index];
+      if ((entry.stat.mode & 18) === 0)
+        continue;
+      const sticky = (entry.stat.mode & 512) !== 0;
+      const hasPrivateBoundary = sticky && uid !== undefined && existingDirectories.slice(index + 1).some((candidate) => candidate.stat.uid === uid && (candidate.stat.mode & 18) === 0);
+      if (!hasPrivateBoundary) {
+        throw new Error(`${label} contains a group/world-writable directory without an existing private boundary: ${entry.path}`);
+      }
+    }
+  }
+  const canonicalAncestor = realpathSync3(nearestExisting);
+  if (canonicalAncestor !== nearestExisting) {
+    throw new Error(`${label} contains a non-canonical or changed ancestor: ${nearestExisting}`);
+  }
+  return resolve5(canonicalAncestor, ...missingSuffix);
+}
+
+// src/cli/config-store.ts
 var FAST_AGENT_IDS = ["back-fast", "front-fast", "review-fast", "researcher", "git", "docs", "verifier"];
 var DEEP_AGENT_IDS = ["master", "planner", "back-deep", "front-deep", "review-deep", "debugger", "security", "devops"];
 var ALL_AGENT_IDS = [...DEEP_AGENT_IDS, ...FAST_AGENT_IDS, "explorer"];
@@ -7084,14 +7489,30 @@ function applyModelProfile(source, profile) {
   updated = setJsonc(updated, ["agents", "explorer", "models"], profile.agentOverrides.explorer ?? profile.fast);
   return updated;
 }
-function atomicWrite(path, content) {
-  mkdirSync(dirname2(path), { recursive: true, mode: 448 });
-  const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+function matchesSnapshot(path, expected) {
+  if (!expected.exists)
+    return !existsSync4(path);
+  if (!existsSync4(path))
+    return false;
+  const stat = lstatSync5(path);
+  return stat.isFile() && !stat.isSymbolicLink() && stat.dev === expected.dev && stat.ino === expected.ino && readFileSync4(path, "utf8") === expected.bytes;
+}
+function atomicWrite(path, content, expected) {
+  const canonicalPath = secureCanonicalPath(path, "Managed global config path");
+  if (canonicalPath !== expected.path)
+    throw new Error(`Global config path changed after preflight: ${path}`);
+  mkdirSync(dirname3(canonicalPath), { recursive: true, mode: 448 });
+  if (secureCanonicalPath(canonicalPath, "Managed global config path") !== canonicalPath)
+    throw new Error(`Global config path changed during write: ${path}`);
+  assertWriteable(dirname3(canonicalPath), "Managed global config directory");
+  const temporary = `${canonicalPath}.tmp-${process.pid}-${randomUUID()}`;
   const descriptor = openSync(temporary, "wx", 384);
   try {
     writeFileSync(descriptor, content);
     closeSync(descriptor);
-    renameSync(temporary, path);
+    if (!matchesSnapshot(canonicalPath, expected))
+      throw new Error(`Refusing to replace concurrently changed file: ${canonicalPath}`);
+    renameSync(temporary, canonicalPath);
   } catch (error) {
     try {
       closeSync(descriptor);
@@ -7103,51 +7524,105 @@ function atomicWrite(path, content) {
   }
 }
 function isRegularFile(path) {
-  const stat = lstatSync2(path);
+  const stat = lstatSync5(path);
   return stat.isFile() && !stat.isSymbolicLink();
 }
-function preflightGlobalConfig(configRoot) {
-  const rootStat = existsSync3(configRoot) ? lstatSync2(configRoot) : undefined;
+function assertWriteable(path, label) {
+  let candidate = path;
+  while (!existsSync4(candidate)) {
+    const parent = dirname3(candidate);
+    if (parent === candidate)
+      break;
+    candidate = parent;
+  }
+  try {
+    const stat = lstatSync5(candidate);
+    if (stat.isSymbolicLink() || !stat.isDirectory() && candidate !== path)
+      throw new Error("unsafe parent");
+    const uid = process.getuid?.();
+    if (uid !== undefined && (stat.uid !== uid || (stat.mode & 18) !== 0))
+      throw new Error("unsafe ownership or mode");
+    accessSync(candidate, fsConstants.W_OK | (stat.isDirectory() ? fsConstants.X_OK : 0));
+  } catch {
+    throw new Error(`${label} is not writeable: ${path}`);
+  }
+}
+function legacySchemaMatches(source, generated) {
+  try {
+    const previous = JSON.parse(source);
+    if (previous.$comment !== undefined || ![undefined, 1].includes(previous["x-agent-gvozd-schema-version"]))
+      return false;
+    if (previous.$id !== "https://example.invalid/agent-gvozd.schema.json")
+      return false;
+    return generated ? isEquivalentLegacySchema(source, generated) : true;
+  } catch {
+    return false;
+  }
+}
+function snapshot(path) {
+  if (!existsSync4(path))
+    return Object.freeze({ path, exists: false });
+  const stat = lstatSync5(path);
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error(`Managed global config snapshot target is unsafe: ${path}`);
+  return Object.freeze({ path, exists: true, bytes: readFileSync4(path, "utf8"), dev: stat.dev, ino: stat.ino });
+}
+function preflightGlobalConfig(configRoot, schemaSource) {
+  const canonicalRoot = secureCanonicalPath(configRoot, "OpenCode config root");
+  const rootStat = existsSync4(canonicalRoot) ? lstatSync5(canonicalRoot) : undefined;
   if (rootStat && (rootStat.isSymbolicLink() || !rootStat.isDirectory())) {
-    throw new Error(`OpenCode config root is not a safe directory: ${configRoot}`);
+    throw new Error(`OpenCode config root is not a safe directory: ${canonicalRoot}`);
   }
-  const directory = join3(configRoot, "gvozd");
-  const directoryStat = existsSync3(directory) ? lstatSync2(directory) : undefined;
+  assertWriteable(canonicalRoot, "OpenCode config root");
+  const directory = secureCanonicalPath(join6(canonicalRoot, "gvozd"), "Global Gvozd directory");
+  const directoryStat = existsSync4(directory) ? lstatSync5(directory) : undefined;
   if (directoryStat && (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())) {
     throw new Error(`Global Gvozd path is not a safe directory: ${directory}`);
   }
-  const configPath = join3(directory, "config.jsonc");
-  const schemaPath = join3(directory, "schema.json");
-  if (existsSync3(configPath)) {
+  assertWriteable(directory, "Global Gvozd directory");
+  const configPath = join6(directory, "config.jsonc");
+  const schemaPath = join6(directory, "schema.json");
+  if (existsSync4(configPath)) {
     if (!isRegularFile(configPath))
       throw new Error(`Global Gvozd config is not a safe file: ${configPath}`);
     assertValidJsonc(readFileSync4(configPath, "utf8"), configPath);
+    assertWriteable(configPath, "Global Gvozd config");
   }
-  if (existsSync3(schemaPath) && (!isRegularFile(schemaPath) || !readFileSync4(schemaPath, "utf8").includes(GENERATED_PLUGIN_MARKER))) {
-    throw new Error(`Refusing to overwrite unmanaged Gvozd schema: ${schemaPath}`);
+  if (existsSync4(schemaPath)) {
+    if (!isRegularFile(schemaPath))
+      throw new Error(`Refusing to overwrite unmanaged Gvozd schema: ${schemaPath}`);
+    const schema = readFileSync4(schemaPath, "utf8");
+    if (!hasGeneratedSchemaMarker(schema) && !legacySchemaMatches(schema, schemaSource)) {
+      throw new Error(`Refusing to overwrite unmanaged Gvozd schema: ${schemaPath}`);
+    }
+    assertWriteable(schemaPath, "Global Gvozd schema");
   }
+  return Object.freeze({ configRoot: canonicalRoot, config: snapshot(configPath), schema: snapshot(schemaPath) });
 }
 function writeGlobalConfig(input) {
-  preflightGlobalConfig(input.configRoot);
-  const directory = join3(input.configRoot, "gvozd");
-  const configPath = join3(directory, "config.jsonc");
-  const schemaPath = join3(directory, "schema.json");
-  const base = existsSync3(configPath) ? readFileSync4(configPath, "utf8") : `{
+  const state = input.snapshot ?? preflightGlobalConfig(input.configRoot, input.schemaSource);
+  const canonicalRoot = secureCanonicalPath(input.configRoot, "OpenCode config root");
+  if (state.configRoot !== canonicalRoot)
+    throw new Error("Global config snapshot belongs to another config root");
+  const directory = join6(state.configRoot, "gvozd");
+  const configPath = join6(directory, "config.jsonc");
+  const schemaPath = join6(directory, "schema.json");
+  const base = state.config.exists ? state.config.bytes : `{
   "$schema": "./schema.json",
   "agents": {}
 }
 `;
-  if (!input.schemaSource.includes(GENERATED_PLUGIN_MARKER)) {
+  if (!hasGeneratedSchemaMarker(input.schemaSource)) {
     throw new Error("Package schema is missing the Gvozd ownership marker");
   }
   const config = applyModelProfile(base, input.profile);
   assertValidJsonc(input.schemaSource, "package Gvozd schema");
   atomicWrite(schemaPath, input.schemaSource.endsWith(`
 `) ? input.schemaSource : `${input.schemaSource}
-`);
+`, state.schema);
   atomicWrite(configPath, config.endsWith(`
 `) ? config : `${config}
-`);
+`, state.config);
   return { configPath, schemaPath, config };
 }
 
@@ -7220,20 +7695,43 @@ function profileFromAgents(agents, catalog) {
 }
 
 // src/cli/global-sync.ts
-import { closeSync as closeSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { accessSync as accessSync2, closeSync as closeSync2, constants as fsConstants2, existsSync as existsSync5, lstatSync as lstatSync6, mkdirSync as mkdirSync2, openSync as openSync2, readFileSync as readFileSync5, readdirSync as readdirSync4, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { join as join4 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 function stat(path) {
   try {
-    return lstatSync3(path);
+    return lstatSync6(path);
   } catch (error) {
     if (error.code === "ENOENT")
       return;
     throw error;
   }
 }
+function assertWriteable2(path, label) {
+  let candidate = path;
+  while (!existsSync5(candidate)) {
+    const parent = dirname4(candidate);
+    if (parent === candidate)
+      break;
+    candidate = parent;
+  }
+  try {
+    const current = lstatSync6(candidate);
+    if (current.isSymbolicLink() || !current.isDirectory() && candidate !== path)
+      throw new Error("unsafe parent");
+    const uid = process.getuid?.();
+    if (uid !== undefined && (current.uid !== uid || (current.mode & 18) !== 0))
+      throw new Error("unsafe ownership or mode");
+    accessSync2(candidate, fsConstants2.W_OK | (current.isDirectory() ? fsConstants2.X_OK : 0));
+  } catch {
+    throw new Error(`${label} is not writeable: ${path}`);
+  }
+}
 function createFile(path, content) {
-  const descriptor = openSync2(path, "wx", 384);
+  const canonicalPath = secureCanonicalPath(path, "Managed global agent path");
+  if (canonicalPath !== path)
+    throw new Error(`Managed global agent path changed: ${path}`);
+  const descriptor = openSync2(canonicalPath, "wx", 384);
   try {
     writeFileSync2(descriptor, content);
   } finally {
@@ -7241,6 +7739,8 @@ function createFile(path, content) {
   }
 }
 function replaceFile(path, content) {
+  if (secureCanonicalPath(path, "Managed global agent path") !== path)
+    throw new Error(`Managed global agent path changed: ${path}`);
   const temporary = `${path}.tmp-${process.pid}-${randomUUID2()}`;
   createFile(temporary, content);
   try {
@@ -7253,21 +7753,41 @@ function replaceFile(path, content) {
   }
 }
 function writeManagedAgents(input) {
-  const agentsDirectory = join4(input.configRoot, "agents");
-  const result = { created: [], updated: [], unchanged: [], conflicts: [] };
+  const configRoot = secureCanonicalPath(input.configRoot, "OpenCode config root");
+  const agentsDirectory = secureCanonicalPath(join7(configRoot, "agents"), "OpenCode agents path");
+  const result = { created: [], updated: [], unchanged: [], conflicts: [], removed: [] };
   const writes = [];
-  const rootStat = stat(input.configRoot);
+  const removals = new Map;
+  const enabled = new Set(Object.entries(input.agents).filter(([, agent]) => !agent.disabled).map(([id]) => `${id}.md`));
+  const rootStat = stat(configRoot);
   if (rootStat && (rootStat.isSymbolicLink() || !rootStat.isDirectory())) {
-    throw new Error(`OpenCode config root is not a safe directory: ${input.configRoot}`);
+    throw new Error(`OpenCode config root is not a safe directory: ${configRoot}`);
   }
+  assertWriteable2(configRoot, "OpenCode config root");
   const directoryStat = stat(agentsDirectory);
   if (directoryStat && (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())) {
     throw new Error(`OpenCode agents path is not a safe directory: ${agentsDirectory}`);
   }
+  assertWriteable2(agentsDirectory, "OpenCode agents directory");
+  if (directoryStat) {
+    for (const entry of readdirSync4(agentsDirectory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      if (!entry.isFile() || !entry.name.endsWith(".md") || enabled.has(entry.name))
+        continue;
+      const path = join7(agentsDirectory, entry.name);
+      const currentStat = stat(path);
+      if (!currentStat || currentStat.isSymbolicLink() || !currentStat.isFile())
+        continue;
+      if (hasGeneratedAgentMarker(readFileSync5(path, "utf8"))) {
+        assertWriteable2(path, "Managed global agent");
+        result.removed.push(path);
+        removals.set(path, readFileSync5(path, "utf8"));
+      }
+    }
+  }
   for (const [id, agent] of Object.entries(input.agents).sort(([left], [right]) => left.localeCompare(right))) {
     if (agent.disabled)
       continue;
-    const path = join4(agentsDirectory, `${id}.md`);
+    const path = join7(agentsDirectory, `${id}.md`);
     const content = renderAgent(agent);
     const currentStat = stat(path);
     if (!currentStat) {
@@ -7280,45 +7800,134 @@ function writeManagedAgents(input) {
       continue;
     }
     const current = readFileSync5(path, "utf8");
-    if (!current.includes(GENERATED_MARKER)) {
+    if (!hasGeneratedAgentMarker(current)) {
       result.conflicts.push(path);
       continue;
     }
+    assertWriteable2(path, "Managed global agent");
     if (current === content) {
       result.unchanged.push(path);
       continue;
     }
     result.updated.push(path);
-    writes.push({ path, content, replace: true });
+    writes.push({ path, content, replace: true, previous: current });
   }
   if (result.conflicts.length > 0) {
     throw new Error(`Refusing to overwrite unmanaged global agents: ${result.conflicts.join(", ")}`);
   }
   if (input.check)
     return result;
-  mkdirSync2(input.configRoot, { recursive: true, mode: 448 });
+  if (secureCanonicalPath(configRoot, "OpenCode config root") !== configRoot)
+    throw new Error("OpenCode config root changed before write");
+  mkdirSync2(configRoot, { recursive: true, mode: 448 });
+  if (secureCanonicalPath(configRoot, "OpenCode config root") !== configRoot)
+    throw new Error("OpenCode config root changed during creation");
+  assertWriteable2(configRoot, "OpenCode config root");
+  if (secureCanonicalPath(agentsDirectory, "OpenCode agents path") !== agentsDirectory)
+    throw new Error("OpenCode agents path changed before creation");
   mkdirSync2(agentsDirectory, { recursive: true, mode: 448 });
+  if (secureCanonicalPath(agentsDirectory, "OpenCode agents path") !== agentsDirectory)
+    throw new Error("OpenCode agents path changed before write");
+  assertWriteable2(configRoot, "OpenCode config root");
+  assertWriteable2(agentsDirectory, "OpenCode agents directory");
+  for (const path of result.removed) {
+    if (secureCanonicalPath(path, "Managed global agent path") !== path)
+      throw new Error(`Managed global agent path changed: ${path}`);
+    const currentStat = stat(path);
+    if (!currentStat || currentStat.isSymbolicLink() || !currentStat.isFile()) {
+      throw new Error(`Refusing to remove a changed or unmanaged global agent: ${path}`);
+    }
+    const current = readFileSync5(path, "utf8");
+    if (!hasGeneratedAgentMarker(current) || current !== removals.get(path)) {
+      throw new Error(`Refusing to remove a concurrently changed global agent: ${path}`);
+    }
+    unlinkSync2(path);
+  }
   for (const write of writes) {
-    if (write.replace)
+    if (write.replace) {
+      const currentStat = stat(write.path);
+      const current = currentStat?.isFile() && !currentStat.isSymbolicLink() ? readFileSync5(write.path, "utf8") : undefined;
+      if (!current || !hasGeneratedAgentMarker(current) || current !== write.previous) {
+        throw new Error(`Refusing to replace a concurrently changed global agent: ${write.path}`);
+      }
       replaceFile(write.path, write.content);
-    else
+    } else
       createFile(write.path, write.content);
   }
   return result;
 }
 
+// src/file-lock.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { accessSync as accessSync3, closeSync as closeSync3, constants, existsSync as existsSync6, fstatSync, lstatSync as lstatSync7, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync6, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
+function assertSecure(path) {
+  const stat = lstatSync7(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error(`Lock directory is unsafe: ${path}`);
+  const uid = process.getuid?.();
+  if (uid !== undefined && (stat.uid !== uid || (stat.mode & 18) !== 0)) {
+    throw new Error(`Lock directory must be owner-controlled and not group/world writable: ${path}`);
+  }
+  accessSync3(path, constants.W_OK | constants.X_OK);
+}
+function acquire(path, operation) {
+  const canonicalPath = secureCanonicalPath(path, "Lock path");
+  const directory = dirname5(canonicalPath);
+  mkdirSync3(directory, { recursive: true, mode: 448 });
+  if (secureCanonicalPath(canonicalPath, "Lock path") !== canonicalPath)
+    throw new Error(`Lock path changed during creation: ${path}`);
+  assertSecure(directory);
+  const nonce = `${process.pid}:${randomUUID3()}
+`;
+  let descriptor;
+  try {
+    descriptor = openSync3(canonicalPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      throw new Error(`Another Gvozd ${operation} is active or left a lock at ${canonicalPath}; inspect it manually and do not delete it while work may be running`);
+    }
+    throw error;
+  }
+  const created = fstatSync(descriptor);
+  writeFileSync3(descriptor, nonce);
+  return { path: canonicalPath, descriptor, nonce, dev: created.dev, ino: created.ino };
+}
+function release(lock) {
+  closeSync3(lock.descriptor);
+  if (existsSync6(lock.path)) {
+    const current = lstatSync7(lock.path);
+    if (current.isFile() && !current.isSymbolicLink() && current.dev === lock.dev && current.ino === lock.ino && readFileSync6(lock.path, "utf8") === lock.nonce)
+      unlinkSync3(lock.path);
+  }
+}
+async function withExclusiveFileLock(path, callback) {
+  const lock = acquire(path, "setup");
+  try {
+    return await callback();
+  } finally {
+    release(lock);
+  }
+}
+function withExclusiveFileLockSync(path, callback, operation = "operation") {
+  const lock = acquire(path, operation);
+  try {
+    return callback();
+  } finally {
+    release(lock);
+  }
+}
+
 // src/cli/setup.ts
-var PACKAGE_SPEC = "@nail00749/agent-gvozd@^0.1.0";
-var SUPPORTED_VERSION = "0.0.0-beta-19425";
 function assertVersion(version) {
-  if (parseOpenCodeVersion(version) !== SUPPORTED_VERSION) {
-    throw new Error(`Unsupported OpenCode version. Gvozd 0.1.0 requires ${SUPPORTED_VERSION}.`);
+  if (parseOpenCodeVersion(version) !== SUPPORTED_OPENCODE_VERSION) {
+    throw new Error(`Unsupported OpenCode version. Gvozd ${PACKAGE_VERSION} requires ${SUPPORTED_OPENCODE_VERSION}.`);
   }
 }
 async function selectProfile(input, client, configRoot) {
   const catalog = parseModels(await client.models());
   const config = loadConfig(input.cwd, { configRoot, includeProject: false });
-  const hasGlobalConfig = existsSync4(join5(configRoot, "gvozd", "config.jsonc"));
+  const hasGlobalConfig = existsSync7(join8(configRoot, "gvozd", "config.jsonc"));
   return chooseModelProfile({
     catalog,
     ui: input.ui,
@@ -7335,54 +7944,100 @@ async function confirm2(input, message) {
   const answer = await input.ui.confirm({ message, initialValue: true });
   return typeof answer === "symbol" ? false : answer;
 }
+function sameSnapshot(left, right) {
+  return left.configRoot === right.configRoot && left.config.exists === right.config.exists && left.config.dev === right.config.dev && left.config.ino === right.config.ino && left.config.bytes === right.config.bytes && left.schema.exists === right.schema.exists && left.schema.dev === right.schema.dev && left.schema.ino === right.schema.ino && left.schema.bytes === right.schema.bytes;
+}
 async function runSetup(input) {
   const client = await (input.findClient ?? (() => findOpenCode()))();
   const paths = await client.debugPaths();
-  const configRoot = paths.config;
-  if (!configRoot)
+  if (!paths.config)
     throw new Error("OpenCode did not report its config path");
-  assertVersion(await client.version());
+  const configRoot = secureCanonicalPath(paths.config, "OpenCode config root");
   preflightGlobalConfig(configRoot);
+  const runtimeConfigRoot = input.runtimeConfigRoot ?? resolveOpenCodeConfigRoot();
+  assertVersion(await client.version());
   const before = loadConfig(input.cwd, { configRoot, includeProject: false });
-  writeManagedAgents({ configRoot, agents: before.agents, check: true });
+  const schemaSource = join8(dirname6(before.sources[0]), "schema.json");
+  const packagedSchema = readFileSync7(schemaSource, "utf8");
+  const previewSnapshot = preflightGlobalConfig(configRoot, packagedSchema);
+  const preview = writeManagedAgents({ configRoot, agents: before.agents, check: true });
   const profile = await selectProfile(input, client, configRoot);
   if (!profile)
     return { status: "cancelled" };
-  input.output?.(`Register ${PACKAGE_SPEC}
-Write ${join5(configRoot, "gvozd", "config.jsonc")}
-Write managed agents in ${join5(configRoot, "agents")}`);
+  input.output?.([
+    `Register ${PACKAGE_SPEC}`,
+    `Write ${join8(configRoot, "gvozd", "config.jsonc")}`,
+    `Write managed agents in ${join8(configRoot, "agents")}`,
+    ...preview.removed.length > 0 ? [`Remove ${preview.removed.length} stale or disabled managed agent(s)`] : []
+  ].join(`
+`));
   if (!await confirm2(input, "Run setup?"))
     return { status: "cancelled" };
-  await client.pluginAdd(PACKAGE_SPEC);
-  try {
-    const schemaSource = join5(dirname3(before.sources[0]), "schema.json");
-    writeGlobalConfig({ configRoot, profile, schemaSource: readFileSync6(schemaSource, "utf8") });
-    const configured = loadConfig(input.cwd, { configRoot, includeProject: false });
-    writeManagedAgents({ configRoot, agents: configured.agents });
-    await client.serviceRestart();
-    const report = await runDoctor({ client, configRoot, cwd: input.cwd });
-    return { status: "complete", report };
-  } catch (error) {
-    throw new Error(`Gvozd plugin was registered, but setup is incomplete: ${error instanceof Error ? error.message : String(error)}. Rerun: gvozd setup`);
-  }
+  return withExclusiveFileLock(join8(configRoot, "gvozd", "setup.lock"), async () => {
+    if (secureCanonicalPath(configRoot, "OpenCode config root") !== configRoot)
+      throw new Error("OpenCode config root changed while setup awaited the lock");
+    const lockedSchema = readFileSync7(schemaSource, "utf8");
+    const snapshot = preflightGlobalConfig(configRoot, lockedSchema);
+    if (!sameSnapshot(previewSnapshot, snapshot))
+      throw new Error("Global Gvozd configuration changed while setup awaited confirmation; review and rerun setup");
+    const lockedBefore = loadConfig(input.cwd, { configRoot, includeProject: false });
+    writeManagedAgents({ configRoot, agents: lockedBefore.agents, check: true });
+    const lockedProfile = input.yes ? await selectProfile(input, client, configRoot) : profile;
+    if (!lockedProfile)
+      throw new Error("Model profile changed while setup awaited the global lock; rerun setup");
+    if (!sameSnapshot(snapshot, preflightGlobalConfig(configRoot, lockedSchema))) {
+      throw new Error("Global Gvozd configuration changed during locked setup revalidation; review and rerun setup");
+    }
+    writeManagedAgents({ configRoot, agents: lockedBefore.agents, check: true });
+    await client.pluginAdd(PACKAGE_SPEC);
+    try {
+      writeGlobalConfig({ configRoot, profile: lockedProfile, schemaSource: lockedSchema, snapshot });
+      const configured = loadConfig(input.cwd, { configRoot, includeProject: false });
+      writeManagedAgents({ configRoot, agents: configured.agents });
+      await client.serviceRestart();
+      const report = await runDoctor({ client, configRoot, runtimeConfigRoot, cwd: input.cwd });
+      return { status: "complete", report };
+    } catch (error) {
+      const detail = redactDiagnostic(error);
+      throw new Error(`${PACKAGE_NAME} remains registered, but setup is incomplete: ${detail}. ` + `Managed files under ${configRoot} may be partially updated; no automatic rollback was attempted because concurrent or user changes cannot be distinguished safely. ` + "Fix the reported cause, then rerun: gvozd setup");
+    }
+  });
 }
 async function runConfigure(input) {
   const client = await (input.findClient ?? (() => findOpenCode()))();
   const paths = await client.debugPaths();
-  const configRoot = paths.config;
-  if (!configRoot)
+  if (!paths.config)
     throw new Error("OpenCode did not report its config path");
-  assertVersion(await client.version());
+  const configRoot = secureCanonicalPath(paths.config, "OpenCode config root");
   preflightGlobalConfig(configRoot);
+  const runtimeConfigRoot = input.runtimeConfigRoot ?? resolveOpenCodeConfigRoot();
+  assertVersion(await client.version());
+  const config = loadConfig(input.cwd, { configRoot, includeProject: false });
+  const schemaSource = join8(dirname6(config.sources[0]), "schema.json");
+  const packagedSchema = readFileSync7(schemaSource, "utf8");
+  const previewSnapshot = preflightGlobalConfig(configRoot, packagedSchema);
   const profile = await selectProfile(input, client, configRoot);
   if (!profile || !await confirm2(input, "Apply model configuration?"))
     return { status: "cancelled" };
-  const config = loadConfig(input.cwd, { configRoot, includeProject: false });
-  const schemaSource = join5(dirname3(config.sources[0]), "schema.json");
-  writeGlobalConfig({ configRoot, profile, schemaSource: readFileSync6(schemaSource, "utf8") });
-  await client.serviceRestart();
-  const report = await runDoctor({ client, configRoot, cwd: input.cwd });
-  return { status: "complete", report };
+  return withExclusiveFileLock(join8(configRoot, "gvozd", "setup.lock"), async () => {
+    if (secureCanonicalPath(configRoot, "OpenCode config root") !== configRoot)
+      throw new Error("OpenCode config root changed while configuration awaited the lock");
+    const lockedSchema = readFileSync7(schemaSource, "utf8");
+    const snapshot = preflightGlobalConfig(configRoot, lockedSchema);
+    if (!sameSnapshot(previewSnapshot, snapshot))
+      throw new Error("Global Gvozd configuration changed while configuration awaited confirmation; review and rerun");
+    loadConfig(input.cwd, { configRoot, includeProject: false });
+    const lockedProfile = input.yes ? await selectProfile(input, client, configRoot) : profile;
+    if (!lockedProfile)
+      throw new Error("Model profile changed while configuration awaited the global lock; rerun configuration");
+    if (!sameSnapshot(snapshot, preflightGlobalConfig(configRoot, lockedSchema))) {
+      throw new Error("Global Gvozd configuration changed during locked configuration revalidation; review and rerun");
+    }
+    writeGlobalConfig({ configRoot, profile: lockedProfile, schemaSource: lockedSchema, snapshot });
+    await client.serviceRestart();
+    const report = await runDoctor({ client, configRoot, runtimeConfigRoot, cwd: input.cwd });
+    return { status: "complete", report };
+  });
 }
 function setupExitCode(result) {
   if (result.status === "cancelled")
@@ -7391,13 +8046,13 @@ function setupExitCode(result) {
 }
 
 // src/sync.ts
-import { closeSync as closeSync3, lstatSync as lstatSync4, mkdirSync as mkdirSync3, openSync as openSync3, readFileSync as readFileSync7, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { basename, dirname as dirname4, join as join6, relative as relative2 } from "node:path";
+import { closeSync as closeSync4, lstatSync as lstatSync8, mkdirSync as mkdirSync4, openSync as openSync4, readFileSync as readFileSync8, readdirSync as readdirSync5, realpathSync as realpathSync4, renameSync as renameSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { basename, dirname as dirname7, join as join9, relative as relative4 } from "node:path";
 function renderPluginEntrypoint(config, destination) {
   let moduleSpecifier = "agent-gvozd/server";
-  if (realpathSync2(config.packageRoot) === realpathSync2(config.projectRoot)) {
-    moduleSpecifier = relative2(destination, join6(config.packageRoot, "src", "index")).replaceAll("\\", "/");
+  if (realpathSync4(config.packageRoot) === realpathSync4(config.projectRoot)) {
+    moduleSpecifier = relative4(destination, join9(config.packageRoot, "src", "index")).replaceAll("\\", "/");
     if (!moduleSpecifier.startsWith("."))
       moduleSpecifier = `./${moduleSpecifier}`;
   }
@@ -7432,7 +8087,7 @@ function renderDiff(path, before, after) {
 }
 function stat2(path) {
   try {
-    return lstatSync4(path);
+    return lstatSync8(path);
   } catch (error) {
     if (error.code === "ENOENT")
       return;
@@ -7440,9 +8095,9 @@ function stat2(path) {
   }
 }
 function safeDirectory(root, segments, create) {
-  let current = realpathSync2(root);
+  let current = realpathSync4(root);
   for (const segment of segments) {
-    current = join6(current, segment);
+    current = join9(current, segment);
     const currentStat = stat2(current);
     if (currentStat) {
       if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
@@ -7451,7 +8106,7 @@ function safeDirectory(root, segments, create) {
       continue;
     }
     if (create)
-      mkdirSync3(current);
+      mkdirSync4(current);
   }
   return current;
 }
@@ -7464,145 +8119,191 @@ function assertRegularFile(path) {
   return true;
 }
 function createFile2(path, content) {
-  const descriptor = openSync3(path, "wx", 384);
+  const descriptor = openSync4(path, "wx", 384);
   try {
-    writeFileSync3(descriptor, content);
+    writeFileSync4(descriptor, content);
   } finally {
-    closeSync3(descriptor);
+    closeSync4(descriptor);
   }
 }
 function replaceFile2(path, content) {
-  const temporary = `${path}.tmp-${process.pid}-${randomUUID3()}`;
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID4()}`;
   createFile2(temporary, content);
   try {
     renameSync3(temporary, path);
   } catch (error) {
     try {
-      unlinkSync3(temporary);
+      unlinkSync4(temporary);
     } catch {}
     throw error;
   }
 }
-function ensureProjectTemplate(config, check) {
+function planProjectTemplate(config, result, check) {
   const directory = safeDirectory(config.projectRoot, ["docs", ".gvozd"], !check);
-  const path = join6(directory, "config.jsonc");
-  if (check)
-    return;
-  if (!assertRegularFile(path)) {
-    createFile2(path, [
-      "{",
-      '  "$schema": "./schema.json",',
-      "  // Project overrides are merged after built-in and global configuration.",
-      '  "agents": {}',
-      "}",
-      ""
-    ].join(`
-`));
+  const writes = [];
+  const configPath = join9(directory, "config.jsonc");
+  if (!assertRegularFile(configPath)) {
+    result.created.push(configPath);
+    writes.push({
+      target: configPath,
+      replace: false,
+      content: [
+        "{",
+        '  "$schema": "./schema.json",',
+        "  // Project overrides are merged after built-in and global configuration.",
+        '  "agents": {}',
+        "}",
+        ""
+      ].join(`
+`)
+    });
   }
-  const schemaSource = join6(dirname4(config.sources[0]), "schema.json");
-  const schemaTarget = join6(directory, "schema.json");
-  const schema = readFileSync7(schemaSource, "utf8");
-  if (assertRegularFile(schemaTarget))
-    replaceFile2(schemaTarget, schema);
-  else
-    createFile2(schemaTarget, schema);
+  const schemaSource = join9(dirname7(config.sources[0]), "schema.json");
+  const schemaTarget = join9(directory, "schema.json");
+  const schema = readFileSync8(schemaSource, "utf8");
+  if (!assertRegularFile(schemaTarget)) {
+    result.created.push(schemaTarget);
+    writes.push({ target: schemaTarget, content: schema, replace: false });
+  } else {
+    const current = readFileSync8(schemaTarget, "utf8");
+    if (current !== schema) {
+      if (!hasGeneratedSchemaMarker(current) && !isEquivalentLegacySchema(current, schema)) {
+        throw new Error(`Refusing to overwrite an unmanaged project schema: ${schemaTarget}`);
+      }
+      result.updated.push(schemaTarget);
+      writes.push({ target: schemaTarget, content: schema, replace: true, previous: current });
+    }
+  }
+  return writes;
 }
-function syncAgents(config, options = {}) {
+function syncAgentsUnlocked(config, options) {
   const check = options.check ?? false;
   const destination = safeDirectory(config.projectRoot, [".opencode", "agents"], false);
   const pluginDestination = safeDirectory(config.projectRoot, [".opencode", "plugins", "agent-gvozd"], false);
   const result = { created: [], updated: [], removed: [], unchanged: [] };
   const writes = [];
   let pluginWrite;
+  const removals = new Map;
+  const templateWrites = planProjectTemplate(config, result, check);
   const enabled = new Set(Object.entries(config.agents).filter(([, agent]) => !agent.disabled).map(([id]) => `${id}.md`));
   if (stat2(destination)) {
-    for (const entry of readdirSync2(destination, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    for (const entry of readdirSync5(destination, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isFile() || !entry.name.endsWith(".md") || enabled.has(entry.name))
         continue;
-      const target = join6(destination, entry.name);
-      const current = readFileSync7(target, "utf8");
-      if (!current.includes(GENERATED_MARKER))
+      const target = join9(destination, entry.name);
+      const current = readFileSync8(target, "utf8");
+      if (!hasGeneratedAgentMarker(current))
         continue;
       result.removed.push(target);
+      removals.set(target, current);
       options.onDiff?.(renderDiff(target, current, ""));
     }
   }
   for (const [id, agent] of Object.entries(config.agents)) {
     if (agent.disabled)
       continue;
-    const target = join6(destination, `${id}.md`);
+    const target = join9(destination, `${id}.md`);
     const content = renderAgent(agent);
     if (!assertRegularFile(target)) {
       result.created.push(target);
       writes.push({ target, content, replace: false });
       continue;
     }
-    const current = readFileSync7(target, "utf8");
+    const current = readFileSync8(target, "utf8");
     if (current === content) {
       result.unchanged.push(target);
       continue;
     }
-    if (!current.includes(GENERATED_MARKER)) {
+    if (!hasGeneratedAgentMarker(current)) {
       throw new Error(`Refusing to overwrite a non-generated agent file: ${target}`);
     }
     result.updated.push(target);
     options.onDiff?.(renderDiff(target, current, content));
-    writes.push({ target, content, replace: true });
+    writes.push({ target, content, replace: true, previous: current });
   }
-  const pluginTarget = join6(pluginDestination, "index.ts");
+  const pluginTarget = join9(pluginDestination, "index.ts");
   const pluginContent = renderPluginEntrypoint(config, pluginDestination);
   if (!assertRegularFile(pluginTarget)) {
     result.created.push(pluginTarget);
     pluginWrite = { target: pluginTarget, content: pluginContent, replace: false };
   } else {
-    const current = readFileSync7(pluginTarget, "utf8");
+    const current = readFileSync8(pluginTarget, "utf8");
     if (current === pluginContent) {
       result.unchanged.push(pluginTarget);
     } else {
-      if (!current.includes(GENERATED_PLUGIN_MARKER)) {
+      if (!hasGeneratedPluginMarker(current)) {
         throw new Error(`Refusing to overwrite a non-generated plugin entrypoint: ${pluginTarget}`);
       }
       result.updated.push(pluginTarget);
       options.onDiff?.(renderDiff(pluginTarget, current, pluginContent));
-      pluginWrite = { target: pluginTarget, content: pluginContent, replace: true };
+      pluginWrite = { target: pluginTarget, content: pluginContent, replace: true, previous: current };
     }
   }
   if (!check) {
     const writableDestination = safeDirectory(config.projectRoot, [".opencode", "agents"], true);
     const writablePluginDestination = safeDirectory(config.projectRoot, [".opencode", "plugins", "agent-gvozd"], true);
     for (const target of result.removed) {
-      if (!assertRegularFile(target) || !readFileSync7(target, "utf8").includes(GENERATED_MARKER)) {
+      if (!assertRegularFile(target)) {
         throw new Error(`Refusing to remove a changed or unsafe agent file: ${target}`);
       }
-      unlinkSync3(target);
+      const current = readFileSync8(target, "utf8");
+      if (!hasGeneratedAgentMarker(current) || current !== removals.get(target)) {
+        throw new Error(`Refusing to remove a concurrently changed agent file: ${target}`);
+      }
+      unlinkSync4(target);
     }
     for (const write of writes) {
       if (!write.replace) {
-        createFile2(join6(writableDestination, basename(write.target)), write.content);
+        createFile2(join9(writableDestination, basename(write.target)), write.content);
         continue;
       }
-      if (!assertRegularFile(write.target) || !readFileSync7(write.target, "utf8").includes(GENERATED_MARKER)) {
+      if (!assertRegularFile(write.target)) {
         throw new Error(`Refusing to replace a changed or unsafe agent file: ${write.target}`);
       }
+      const current = readFileSync8(write.target, "utf8");
+      if (!hasGeneratedAgentMarker(current) || current !== write.previous) {
+        throw new Error(`Refusing to replace a concurrently changed agent file: ${write.target}`);
+      }
       replaceFile2(write.target, write.content);
     }
     if (pluginWrite) {
-      const target = join6(writablePluginDestination, basename(pluginWrite.target));
+      const target = join9(writablePluginDestination, basename(pluginWrite.target));
       if (!pluginWrite.replace) {
         createFile2(target, pluginWrite.content);
       } else {
-        if (!assertRegularFile(target) || !readFileSync7(target, "utf8").includes(GENERATED_PLUGIN_MARKER)) {
+        if (!assertRegularFile(target)) {
           throw new Error(`Refusing to replace a changed or unsafe plugin entrypoint: ${target}`);
         }
+        const current = readFileSync8(target, "utf8");
+        if (!hasGeneratedPluginMarker(current) || current !== pluginWrite.previous) {
+          throw new Error(`Refusing to replace a concurrently changed plugin entrypoint: ${target}`);
+        }
         replaceFile2(target, pluginWrite.content);
       }
     }
+    const templateDirectory = safeDirectory(config.projectRoot, ["docs", ".gvozd"], true);
+    for (const write of templateWrites) {
+      const target = join9(templateDirectory, basename(write.target));
+      if (!write.replace)
+        createFile2(target, write.content);
+      else {
+        if (!assertRegularFile(target) || readFileSync8(target, "utf8") !== write.previous) {
+          throw new Error(`Refusing to replace a concurrently changed project schema: ${target}`);
+        }
+        replaceFile2(target, write.content);
+      }
+    }
   }
-  ensureProjectTemplate(config, check);
   if (!check)
     safeDirectory(config.projectRoot, ["docs", ".gvozd", "tasks"], true);
   return result;
 }
+function syncAgents(config, options = {}) {
+  if (options.check)
+    return syncAgentsUnlocked(config, options);
+  const root = realpathSync4(config.projectRoot);
+  return withExclusiveFileLockSync(join9(root, ".agent-gvozd-sync.lock"), () => syncAgentsUnlocked(config, options), "sync");
+}
 function formatSyncResult(result, check) {
   const lines = [check ? "agent-gvozd sync check" : "agent-gvozd sync complete"];
   for (const [label, paths] of [
@@ -7631,8 +8332,23 @@ var promptUI = {
   intro,
   outro
 };
+var HELP = [
+  "Usage: gvozd <setup|config|doctor|sync|trust-project> [options]",
+  "",
+  "Commands:",
+  "  setup [--yes]    Install or upgrade the global agent team",
+  "  config [--yes]   Configure model preferences",
+  "  doctor [--json]  Diagnose the global installation",
+  "  sync [--check]   Maintain the legacy project-local installation",
+  "  trust-project [directory]  Print the current project trust token",
+  "",
+  "Options:",
+  "  --help           Show this help",
+  "  --version        Show the Gvozd version"
+].join(`
+`);
 function usage(io) {
-  io.stderr("Usage: gvozd <setup|config|doctor|sync> [options]");
+  io.stderr(HELP);
   return 2;
 }
 function parseFlags(args, allowed) {
@@ -7644,6 +8360,14 @@ function parseFlags(args, allowed) {
 async function runCli(args, io = defaultIO, commands = { setup: runSetup, configure: runConfigure }) {
   const [command, ...rest] = args;
   try {
+    if ((command === "--help" || command === "help") && rest.length === 0) {
+      io.stdout(HELP);
+      return 0;
+    }
+    if (command === "--version" && rest.length === 0) {
+      io.stdout(PACKAGE_VERSION);
+      return 0;
+    }
     if (command === "setup" || command === "config") {
       const parsed = parseFlags(rest, ["--yes"]);
       if (!parsed || parsed.positional.length > 0)
@@ -7672,7 +8396,12 @@ async function runCli(args, io = defaultIO, commands = { setup: runSetup, config
       try {
         const client = await (commands.findClient ?? findOpenCode)();
         const paths = await client.debugPaths();
-        report = await runDoctor({ client, configRoot: paths.config, cwd: io.cwd() });
+        report = await runDoctor({
+          client,
+          configRoot: paths.config,
+          runtimeConfigRoot: resolveOpenCodeConfigRoot(),
+          cwd: io.cwd()
+        });
       } catch (error) {
         report = doctorOperationalFailure(error);
       }
@@ -7690,14 +8419,21 @@ async function runCli(args, io = defaultIO, commands = { setup: runSetup, config
       io.stdout(formatSyncResult(result, check));
       return check && result.created.length + result.updated.length + result.removed.length > 0 ? 1 : 0;
     }
+    if (command === "trust-project") {
+      const parsed = parseFlags(rest, []);
+      if (!parsed || parsed.positional.length > 1)
+        return usage(io);
+      io.stdout(computeProjectTrustToken(parsed.positional[0] ?? io.cwd()));
+      return 0;
+    }
     return usage(io);
   } catch (error) {
-    io.stderr(error instanceof Error ? error.message : String(error));
+    io.stderr(redactDiagnostic(error));
     return 1;
   }
 }
 var invokedPath = process.argv[1];
-if (invokedPath && realpathSync3(invokedPath) === realpathSync3(fileURLToPath2(import.meta.url))) {
+if (invokedPath && realpathSync5(invokedPath) === realpathSync5(fileURLToPath2(import.meta.url))) {
   process.exitCode = await runCli(process.argv.slice(2));
 }
 export {