@nathapp/nax 0.80.0-canary.4 → 0.80.0

package/dist/nax.js

@@ -18428,19 +18428,23 @@ function redactValue(input, seen = new WeakSet, depth = 0) {
 }
 var SECRET_KEY_PATTERN, SECRET_VALUE_PATTERNS, REDACTED = "[REDACTED]", MAX_REDACT_DEPTH = 100, CIRCULAR_REF_MARKER = "[Circular]";
 var init_redact = __esm(() => {
-  SECRET_KEY_PATTERN = /(SECRET|TOKEN(?!s\b)|API_?KEY|PASSWORD|PRIVATE_?KEY|ACCESS_?KEY|WEBHOOK)/i;
+  SECRET_KEY_PATTERN = /(SECRET|TOKEN(?!s\b)|API_?KEY|PASSWORD|PRIVATE_?KEY|ACCESS_?KEY|WEBHOOK|(?:\w+)?_URL|\w+_URI|\w+_DSN|CONNECTION\s*STRING)/i;
   SECRET_VALUE_PATTERNS = [
     /sk-[A-Za-z0-9_-]{16,}/g,
     /ghp_[A-Za-z0-9]{16,}/g,
     /gh[opsu]_[A-Za-z0-9]{16,}/g,
+    /github_pat_[A-Za-z0-9_]{20,}/g,
     /npm_[A-Za-z0-9]{8,}/g,
     /AKIA[0-9A-Z]{16}/g,
     /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+    /\b\d{6,}:[A-Za-z0-9_-]{30,}\b/g,
     /(?:SECRET|TOKEN|API_?KEY|PASSWORD|PRIVATE_?KEY|ACCESS_?KEY|WEBHOOK)=[^\s"',]+/gi,
     /-----BEGIN [A-Z ]*(?:PRIVATE KEY|CERTIFICATE)(?: BLOCK)?-----[\s\S]{0,65536}?-----END [A-Z ]*(?:PRIVATE KEY|CERTIFICATE)(?: BLOCK)?-----/g,
     /eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
-    /\b(?:Bearer|Basic)\s+(?=[A-Za-z0-9\-._~+/]*[0-9+/_-])[A-Za-z0-9\-._~+/]{8,}={0,2}/gi,
-    /(?:x-api-key|api[_-]?key)\s*[:=]\s*[^\s"',]+/gi
+    /\bBearer\s+(?=[A-Za-z0-9\-._~+/]*[0-9+/_-])[A-Za-z0-9\-._~+/]{8,}={0,2}/gi,
+    /\b[Bb][Aa][Ss][Ii][Cc]\s+(?=[A-Za-z0-9+/]*[A-Z])(?=[A-Za-z0-9+/]*[a-z])[A-Za-z0-9+/]{8,}={0,2}/g,
+    /(?:x-api-key|api[_-]?key)\s*[:=]\s*[^\s"',]+/gi,
+    /\b[a-z][a-z0-9+.-]*:\/\/(?:[^/\s@]*:[^/\s@]+)@/gi
   ];
 });
 
@@ -19122,23 +19126,66 @@ var init_config_guards = __esm(() => {
 });
 
 // src/config/dotenv.ts
+function parseQuotedValue(raw, quote) {
+  let value = "";
+  for (let i = 1;i < raw.length; i++) {
+    const c = raw[i];
+    if (quote === '"' && c === "\\" && i + 1 < raw.length) {
+      const next = raw[i + 1];
+      if (next === "n") {
+        value += `
+`;
+        i++;
+        continue;
+      }
+      if (next === '"' || next === "\\") {
+        value += next;
+        i++;
+        continue;
+      }
+      value += c;
+      continue;
+    }
+    if (c === quote) {
+      return value;
+    }
+    value += c;
+  }
+  return value;
+}
+function stripInlineComment(raw) {
+  for (let i = 0;i < raw.length; i++) {
+    if (raw[i] === "#" && (i === 0 || /\s/.test(raw[i - 1] ?? ""))) {
+      return raw.slice(0, i);
+    }
+  }
+  return raw;
+}
 function parseDotenv(content) {
   if (!content)
     return {};
   const result = {};
   for (const rawLine of content.split(`
 `)) {
-    const line = rawLine.trim();
+    let line = rawLine.trim();
     if (!line || line.startsWith("#"))
       continue;
-    const stripped = line.startsWith("export ") ? line.slice(7).trim() : line;
-    const eqIndex = stripped.indexOf("=");
+    if (line.startsWith("export ")) {
+      line = line.slice(7).trim();
+      if (line.length >= 2 && (line[0] === '"' || line[0] === "'") && line.endsWith(line[0])) {
+        line = line.slice(1, -1);
+      }
+    }
+    const eqIndex = line.indexOf("=");
     if (eqIndex === -1)
       continue;
-    const key = stripped.slice(0, eqIndex).trim();
-    let value = stripped.slice(eqIndex + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
+    const key = line.slice(0, eqIndex).trim();
+    const rawValue = line.slice(eqIndex + 1).trim();
+    let value;
+    if (rawValue.startsWith('"') || rawValue.startsWith("'")) {
+      value = parseQuotedValue(rawValue, rawValue[0]);
+    } else {
+      value = stripInlineComment(rawValue).trim();
     }
     result[key] = value;
   }
@@ -19161,12 +19208,13 @@ function resolveEnvVars(config2, env2, path = []) {
   return config2;
 }
 function resolveString(str, env2, path) {
-  return str.replace(/\$\$([A-Za-z_][A-Za-z0-9_]*)/g, `${DOUBLE_DOLLAR_PLACEHOLDER}$1`).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, varName) => {
+  const resolveOne = (varName) => {
     if (!(varName in env2)) {
       throw new UnresolvedEnvVarError(varName, path);
     }
     return env2[varName];
-  }).replace(new RegExp(`${DOUBLE_DOLLAR_PLACEHOLDER}([A-Za-z_][A-Za-z0-9_]*)`, "g"), "$$$1");
+  };
+  return str.replace(/\$\$(\{[A-Za-z_][A-Za-z0-9_]*\}|[A-Za-z_][A-Za-z0-9_]*)/g, `${DOUBLE_DOLLAR_PLACEHOLDER}$1`).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_match, varName) => resolveOne(varName)).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, varName) => resolveOne(varName)).replace(new RegExp(`${DOUBLE_DOLLAR_PLACEHOLDER}(\\{[A-Za-z_][A-Za-z0-9_]*\\}|[A-Za-z_][A-Za-z0-9_]*)`, "g"), "$$$1");
 }
 var UnresolvedEnvVarError, DOUBLE_DOLLAR_PLACEHOLDER = "__DOLLAR_ESCAPE__";
 var init_dotenv = __esm(() => {
@@ -19526,6 +19574,14 @@ async function loadProfile(profileName, projectRoot) {
   }
   return base;
 }
+function sensitiveFilteredProcessEnv() {
+  const filtered = {};
+  for (const [key, value] of Object.entries(_profileDeps.env)) {
+    if (value !== undefined && !SENSITIVE_ENV_KEY_PATTERN.test(key))
+      filtered[key] = value;
+  }
+  return filtered;
+}
 async function loadProfileEnv(profileName, projectRoot) {
   validateProfileName(profileName);
   const globalPath = join2(globalConfigDir(), "profiles", `${profileName}.env`);
@@ -19533,11 +19589,7 @@ async function loadProfileEnv(profileName, projectRoot) {
   const globalFile = Bun.file(globalPath);
   const projectFile = Bun.file(projectPath);
   const [globalExists, projectExists] = await Promise.all([globalFile.exists(), projectFile.exists()]);
-  let merged = {};
-  for (const [key, value] of Object.entries(_profileDeps.env)) {
-    if (value !== undefined && !SENSITIVE_ENV_KEY_PATTERN.test(key))
-      merged[key] = value;
-  }
+  let merged = sensitiveFilteredProcessEnv();
   if (!globalExists && !projectExists) {
     return merged;
   }
@@ -19645,6 +19697,20 @@ var init_profile = __esm(() => {
 // src/config/loader.ts
 import { existsSync as existsSync3 } from "fs";
 import { basename as basename2, dirname, join as join3, resolve as resolve3 } from "path";
+function resolveEnvVarsWarnOnFailure(config2, logger, layerName) {
+  try {
+    return resolveEnvVars(config2, sensitiveFilteredProcessEnv());
+  } catch (err) {
+    if (err instanceof UnresolvedEnvVarError) {
+      logger?.warn("config", `${layerName} references undefined environment variable \u2014 left unresolved`, {
+        varName: err.varName,
+        path: err.path.join(".") || "(root)"
+      });
+      return config2;
+    }
+    throw err;
+  }
+}
 function globalConfigPath() {
   return join3(globalConfigDir(), "config.json");
 }
@@ -19696,6 +19762,7 @@ async function loadConfig(startDir, cliOverrides) {
       });
     }
   }
+  rawConfig = resolveEnvVarsWarnOnFailure(rawConfig, logger, "global/project config");
   for (const name of overlayChain) {
     const profileData = await loadProfile(name, projectRoot);
     const profileEnv = await loadProfileEnv(name, projectRoot);
@@ -19794,13 +19861,23 @@ async function loadConfigForWorkdir(rootConfigPath, packageDir, cliOverrides) {
   const { profile: packageProfile, ...packageFields } = packageOverride;
   let merged = mergePackageConfig(rootConfig, packageFields);
   merged = stripRemovedNoOpKeys(merged, defaultConfigWarn);
+  const envResolvedMerged = resolveEnvVarsWarnOnFailure(merged, logger, `per-package config (${packageDir})`);
   const packageChain = parseProfileList(packageProfile).filter((name) => name && name !== "default");
-  let rawMerged = merged;
+  let rawMerged = envResolvedMerged;
   if (packageChain.length > 0) {
     const packageRoot = join3(repoRoot, packageDir);
     for (const name of packageChain) {
       const profileData = await loadProfile(name, packageRoot);
-      rawMerged = deepMergeConfig(rawMerged, profileData);
+      const profileEnv = await loadProfileEnv(name, packageRoot);
+      let resolvedProfileData;
+      try {
+        resolvedProfileData = Object.keys(profileEnv).length > 0 ? resolveEnvVars(profileData, profileEnv) : profileData;
+      } catch (err) {
+        const varName = err instanceof UnresolvedEnvVarError ? err.varName : undefined;
+        const path = err instanceof UnresolvedEnvVarError ? err.path.join(".") : undefined;
+        throw new NaxError(`Per-package profile "${name}" (${packageDir}) references an undefined environment variable${varName ? ` $${varName}` : ""}${path ? ` at "${path}"` : ""}.`, "PROFILE_ENV_VAR_UNRESOLVED", { stage: "config", profileName: name, packageDir, varName, path, cause: err });
+      }
+      rawMerged = deepMergeConfig(rawMerged, resolvedProfileData);
     }
     rawMerged.profile = packageChain.join("+");
     rawMerged.profileChain = packageChain;
@@ -19809,6 +19886,7 @@ async function loadConfigForWorkdir(rootConfigPath, packageDir, cliOverrides) {
   rejectLegacyRectificationKeys(rawMerged);
   rejectDeadQualityFlags(rawMerged);
   rejectUnimplementedScopedProfile(rawMerged);
+  rejectUnimplementedPermissionsBlock(rawMerged);
   rawMerged = stripRemovedNoOpKeys(rawMerged, defaultConfigWarn);
   const result = NaxConfigSchema.safeParse(rawMerged);
   if (!result.success) {
@@ -20250,6 +20328,7 @@ __export(exports_config, {
   trackedSpawnDeadlines: () => trackedSpawnDeadlines,
   testPatternConfigSelector: () => testPatternConfigSelector,
   tddConfigSelector: () => tddConfigSelector,
+  sensitiveFilteredProcessEnv: () => sensitiveFilteredProcessEnv,
   routingConfigSelector: () => routingConfigSelector,
   reviewConfigSelector: () => reviewConfigSelector,
   resolveTestStrategy: () => resolveTestStrategy,
@@ -23503,10 +23582,10 @@ class AgentManager {
         const adapter = this._resolveRegistry().getAgent(currentAgent);
         if (!adapter) {
           _finalStatus = "error";
-          return {
-            result: { output: "", tokenUsage: { inputTokens: 0, outputTokens: 0 }, estimatedCostUsd: 0 },
-            fallbacks
-          };
+          throw new NaxError(`Agent "${currentAgent}" not found in registry`, "AGENT_NOT_FOUND", {
+            stage: "complete",
+            agentName: currentAgent
+          });
         }
         let result;
         try {
@@ -23655,7 +23734,7 @@ class AgentManager {
       throw new NaxError("AgentManager.runAsSession: _sendPrompt is not wired \u2014 pass sendPrompt at construction via NaxRuntime", "SEND_PROMPT_UNAVAILABLE", { stage: opts.pipelineStage ?? "run", agentName });
     }
     const stage = opts.pipelineStage ?? "run";
-    const resolvedPermissions = resolvePermissions(this._config, stage);
+    const resolvedPermissions = resolvePermissions(opts.config ?? this._config, stage);
     const sessionRole = handle.role ?? opts.sessionRole ?? "main";
     const start = Date.now();
     try {
@@ -23697,7 +23776,7 @@ class AgentManager {
   }
   async completeAs(agentName, prompt, options) {
     const stage = options.pipelineStage ?? "complete";
-    const resolvedPermissions = resolvePermissions(this._config, stage);
+    const resolvedPermissions = resolvePermissions(options.config ?? this._config, stage);
     const augmented = {
       ...options,
       resolvedPermissions,
@@ -25127,7 +25206,9 @@ function buildDigest(chunks) {
   const scopeRank = Object.fromEntries(SCOPE_ORDER2.map((s, i) => [s, i]));
   const sorted = [...chunks].sort((a, b) => {
     const scopeDiff = (scopeRank[a.scope] ?? 99) - (scopeRank[b.scope] ?? 99);
-    return scopeDiff !== 0 ? scopeDiff : a.id.localeCompare(b.id);
+    if (scopeDiff !== 0)
+      return scopeDiff;
+    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
   });
   const lines = [];
   for (const chunk of sorted) {
@@ -25508,16 +25589,13 @@ var init_manager_run = __esm(() => {
 // src/session/manager-sweep.ts
 function sweepOrphansImpl(sessions, ttlMs) {
   const cutoff = _sessionManagerDeps.nowMs() - ttlMs;
-  const terminal = ["COMPLETED", "FAILED"];
   let removed = 0;
   for (const [id, session] of sessions.entries()) {
-    if (!terminal.includes(session.state))
-      continue;
     const lastActivityMs = session.lastActivityAt ? new Date(session.lastActivityAt).getTime() : Number.NaN;
-    if (!Number.isFinite(lastActivityMs) || lastActivityMs < cutoff) {
-      sessions.delete(id);
-      removed++;
-    }
+    if (Number.isFinite(lastActivityMs) && lastActivityMs >= cutoff)
+      continue;
+    sessions.delete(id);
+    removed++;
   }
   if (removed > 0) {
     getLogger().debug("session", "Swept orphan sessions", { removed });
@@ -25821,8 +25899,10 @@ class SessionManager {
       if (terminal.includes(session.state))
         continue;
       const updated = { ...session, state: "COMPLETED", lastActivityAt: now };
-      this._sessions.set(id, updated);
       this._persistDescriptor(updated);
+      this._sessions.delete(id);
+      if (updated.handle)
+        this._liveHandles.delete(updated.handle);
       closed.push({ ...updated });
       getLogger().debug("session", "Session closed by closeStory", {
         storyId,
@@ -25869,7 +25949,7 @@ class SessionManager {
     if (!adapter) {
       throw new NaxError(`SessionManager.openSession: no adapter found for agent "${opts.agentName}"`, "ADAPTER_NOT_FOUND", { stage: "session", agentName: opts.agentName });
     }
-    const resolvedPermissions = resolvePermissions(this._config, opts.pipelineStage);
+    const resolvedPermissions = resolvePermissions(opts.config ?? this._config, opts.pipelineStage);
     const existingDescriptor = this._findByName(name);
     const resume = existingDescriptor !== undefined;
     const handle = await adapter.openSession(name, {
@@ -28886,19 +28966,55 @@ function buildTestCandidates(sourceFile, workdir, packagePrefix, shapes, testDir
   const sourceAbs = `${workdir}/${sourceFile}`;
   return [...new Set(candidates)].filter((c) => c !== sourceAbs);
 }
+function tokenizeCommand(command) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  for (const char of command.trim()) {
+    if (quote) {
+      current += char;
+      if (char === quote)
+        quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      current += char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (current)
+    tokens.push(current);
+  return tokens;
+}
+function unquote(token) {
+  if (token.length >= 2 && (token[0] === '"' || token[0] === "'") && token[token.length - 1] === token[0]) {
+    return token.slice(1, -1);
+  }
+  return token;
+}
 function buildSmartTestCommand(testFiles, baseCommand) {
   if (testFiles.length === 0) {
     return baseCommand;
   }
   const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
   const quotedTestFiles = testFiles.map(shellQuote);
-  const parts = baseCommand.trim().split(/\s+/);
+  const parts = tokenizeCommand(baseCommand);
   let lastPathIndex = -1;
   for (let i = parts.length - 1;i >= 0; i--) {
-    if (!parts[i].includes("/"))
+    const bare = unquote(parts[i]);
+    if (!bare.includes("/"))
       continue;
-    const precededByPathFlag = i > 0 && PATH_TAKING_FLAGS.includes(parts[i - 1]);
-    const isCombinedFlagValue = PATH_TAKING_FLAGS.some((flag) => parts[i].startsWith(`${flag}=`));
+    const precededByPathFlag = i > 0 && PATH_TAKING_FLAGS.includes(unquote(parts[i - 1]));
+    const isCombinedFlagValue = PATH_TAKING_FLAGS.some((flag) => bare.startsWith(`${flag}=`));
     if (precededByPathFlag || isCombinedFlagValue)
       continue;
     lastPathIndex = i;
@@ -30742,8 +30858,22 @@ function validateInjectedStory(raw, existingIds) {
   } else {
     id = deriveNextStoryId(existingIds);
   }
-  const tags = Array.isArray(s.tags) ? s.tags.filter((t) => typeof t === "string") : [];
-  const dependencies = Array.isArray(s.dependencies) ? s.dependencies.filter((d) => typeof d === "string") : [];
+  if (Array.isArray(s.tags)) {
+    for (let i = 0;i < s.tags.length; i++) {
+      if (typeof s.tags[i] !== "string") {
+        throw new NaxError(`[queue] INJECT story.tags[${i}] must be a string (got ${typeof s.tags[i]})`, "SCHEMA_VALIDATION_FAILED", { stage: "queue", tagIndex: i, tagType: typeof s.tags[i] });
+      }
+    }
+  }
+  if (Array.isArray(s.dependencies)) {
+    for (let i = 0;i < s.dependencies.length; i++) {
+      if (typeof s.dependencies[i] !== "string") {
+        throw new NaxError(`[queue] INJECT story.dependencies[${i}] must be a string (got ${typeof s.dependencies[i]})`, "SCHEMA_VALIDATION_FAILED", { stage: "queue", depIndex: i, depType: typeof s.dependencies[i] });
+      }
+    }
+  }
+  const tags = Array.isArray(s.tags) ? s.tags : [];
+  const dependencies = Array.isArray(s.dependencies) ? s.dependencies : [];
   for (const dep of dependencies) {
     if (!existingIds.has(dep)) {
       throw new NaxError(`[queue] INJECT story.dependencies references unknown story ID "${dep}"`, "SCHEMA_VALIDATION_FAILED", { stage: "queue", dep });
@@ -30929,14 +31059,28 @@ function validateStory(raw, index, allIds, seenIds) {
   }
   const noTestJustification = typeof rawJustification === "string" && rawJustification.trim() !== "" ? rawJustification.trim() : undefined;
   const rawDeps = s.dependencies;
-  const dependencies = Array.isArray(rawDeps) ? Array.from(new Set(rawDeps.map((dep) => normalizeStoryId(dep)))) : [];
+  const dependencies = Array.isArray(rawDeps) ? (() => {
+    for (const [i, dep] of rawDeps.entries()) {
+      if (typeof dep !== "string") {
+        throw new NaxError(`[schema] story[${index}].dependencies[${i}] must be a string (got ${typeof dep})`, "SCHEMA_VALIDATION_FAILED", { stage: "schema", index, depIndex: i, depType: typeof dep });
+      }
+    }
+    return Array.from(new Set(rawDeps.map((dep) => normalizeStoryId(dep))));
+  })() : [];
   for (const dep of dependencies) {
     if (!allIds.has(normalizeStoryId(dep))) {
       throw new NaxError(`[schema] story[${index}].dependencies references unknown story ID "${dep}"`, "SCHEMA_VALIDATION_FAILED", { stage: "schema", index, dep });
     }
   }
   const rawTags = s.tags;
-  const tags = Array.isArray(rawTags) ? rawTags : [];
+  const tags = Array.isArray(rawTags) ? (() => {
+    for (const [i, tag] of rawTags.entries()) {
+      if (typeof tag !== "string") {
+        throw new NaxError(`[schema] story[${index}].tags[${i}] must be a string (got ${typeof tag})`, "SCHEMA_VALIDATION_FAILED", { stage: "schema", index, tagIndex: i, tagType: typeof tag });
+      }
+    }
+    return rawTags;
+  })() : [];
   const rawWorkdir = s.workdir;
   let workdir;
   if (rawWorkdir !== undefined && rawWorkdir !== null) {
@@ -33054,6 +33198,84 @@ function computePollutionMetrics(manifests) {
   };
 }
 
+// src/utils/path-file-lock.ts
+import { randomUUID as randomUUID5 } from "crypto";
+import { open, readdir, stat as stat2, unlink as unlink2 } from "fs/promises";
+import { basename as basename7, dirname as dirname8 } from "path";
+function buildCandidatePath(targetPath) {
+  const time3 = _pathFileLockDeps.now().toString().padStart(LOCK_TIME_WIDTH, "0");
+  return `${targetPath}.lock.${time3}.${process.pid}.${_pathFileLockDeps.randomUUID()}`;
+}
+function candidatePid(fileName) {
+  const segments = fileName.split(".");
+  const pid = Number(segments.at(-2));
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+function candidateTime(fileName) {
+  const segments = fileName.split(".");
+  const timestamp = Number(segments.at(-3));
+  return Number.isFinite(timestamp) ? timestamp : null;
+}
+async function listLiveCandidates(targetPath) {
+  const directory = dirname8(targetPath);
+  const prefix = `${basename7(targetPath)}.lock.`;
+  const candidates = (await _pathFileLockDeps.readdir(directory).catch(() => [])).filter((name) => name.startsWith(prefix));
+  const live = [];
+  for (const candidate of candidates) {
+    const pid = candidatePid(candidate);
+    const createdAt = candidateTime(candidate);
+    const candidatePath = `${directory}/${candidate}`;
+    if (pid !== null && createdAt !== null && _pathFileLockDeps.isPidAlive(pid)) {
+      const stats = await _pathFileLockDeps.stat(candidatePath).catch(() => null);
+      if (stats)
+        live.push({ name: candidate, createdAt: stats.birthtimeMs });
+    } else {
+      await _pathFileLockDeps.unlink(candidatePath).catch(() => {});
+    }
+  }
+  return live.sort((a, b) => a.createdAt - b.createdAt || a.name.localeCompare(b.name)).map(({ name }) => name);
+}
+async function acquire(targetPath, retryMs, timeoutMs) {
+  const candidatePath = buildCandidatePath(targetPath);
+  const handle = await _pathFileLockDeps.open(candidatePath, "wx");
+  await handle.close();
+  const deadline = _pathFileLockDeps.now() + timeoutMs;
+  while (_pathFileLockDeps.now() < deadline) {
+    const candidates = await listLiveCandidates(targetPath);
+    if (candidates[0] === basename7(candidatePath)) {
+      return async () => {
+        await _pathFileLockDeps.unlink(candidatePath).catch(() => {});
+      };
+    }
+    await _pathFileLockDeps.sleep(retryMs);
+  }
+  await _pathFileLockDeps.unlink(candidatePath).catch(() => {});
+  throw new Error(`[path-lock] Timed out acquiring path lock: ${targetPath}`);
+}
+async function withPathFileLock(targetPath, operation, options = {}) {
+  const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const release = await acquire(targetPath, retryMs, timeoutMs);
+  try {
+    return await operation();
+  } finally {
+    await release();
+  }
+}
+var DEFAULT_RETRY_MS = 10, DEFAULT_TIMEOUT_MS = 5000, LOCK_TIME_WIDTH = 13, _pathFileLockDeps;
+var init_path_file_lock = __esm(() => {
+  _pathFileLockDeps = {
+    open,
+    readdir,
+    stat: stat2,
+    unlink: unlink2,
+    randomUUID: randomUUID5,
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve9) => setTimeout(resolve9, ms)),
+    isPidAlive: isProcessAlive
+  };
+});
+
 // src/metrics/types.ts
 class TokenUsage {
   inputTokens;
@@ -33303,9 +33525,12 @@ async function saveRunMetrics(outputDir, runMetrics) {
       cacheCreationInputTokens: totalCacheCreationInputTokens
     })
   } : runMetrics;
-  const existing = await loadJsonFile(metricsPath, "metrics");
-  const allMetrics = Array.isArray(existing) ? existing : [];
-  allMetrics.push(finalMetrics);
+  const allMetrics = await withPathFileLock(metricsPath, async () => {
+    const existing = await loadJsonFile(metricsPath, "metrics");
+    const base = Array.isArray(existing) ? existing : [];
+    base.push(finalMetrics);
+    return base;
+  });
   const isTruncating = allMetrics.length > MAX_RETAINED_RUNS;
   const cappedMetrics = isTruncating ? allMetrics.slice(allMetrics.length - MAX_RETAINED_RUNS) : allMetrics;
   if (isTruncating && !hasWarnedAboutRunTruncation) {
@@ -33331,6 +33556,7 @@ var init_tracker = __esm(() => {
   init_manifest_store();
   init_logger2();
   init_json_file();
+  init_path_file_lock();
 });
 
 // src/metrics/aggregator.ts
@@ -33521,12 +33747,12 @@ function buildLastRun(runs) {
 function buildModelEfficiency(metrics) {
   if (!metrics)
     return [];
-  return Object.entries(metrics.modelEfficiency).map(([model, stat2]) => ({
+  return Object.entries(metrics.modelEfficiency).map(([model, stat3]) => ({
     model,
-    attempts: stat2.attempts,
-    passRate: stat2.passRate,
-    avgCost: stat2.avgCost,
-    totalCost: stat2.totalCost
+    attempts: stat3.attempts,
+    passRate: stat3.passRate,
+    avgCost: stat3.avgCost,
+    totalCost: stat3.totalCost
   })).sort((x, y) => y.totalCost - x.totalCost);
 }
 function stripInternalFields(report) {
@@ -33658,6 +33884,19 @@ var init_prior_run_failure = __esm(() => {
   };
 });
 
+// src/utils/jsonl-tail.ts
+async function readJsonlTail(path2, maxBytes = DEFAULT_JSONL_TAIL_BYTES) {
+  const file3 = Bun.file(path2);
+  const size = file3.size;
+  if (size <= maxBytes)
+    return file3.text();
+  const tail = await file3.slice(size - maxBytes).text();
+  const newlineIndex = tail.indexOf(`
+`);
+  return newlineIndex === -1 ? "" : tail.slice(newlineIndex + 1);
+}
+var DEFAULT_JSONL_TAIL_BYTES = 65536;
+
 // src/context/engine/providers/session-scratch.ts
 import { createHash as createHash9 } from "crypto";
 function contentHash86(content) {
@@ -33762,12 +34001,12 @@ class SessionScratchProvider {
 }
 var MAX_ENTRIES_PER_DIR = 20, MAX_CHUNK_TOKENS3 = 500, _sessionScratchDeps;
 var init_session_scratch = __esm(() => {
-  init_scratch_writer();
+  init_session();
   init_path_filters();
   init_scratch_neutralizer();
   _sessionScratchDeps = {
     fileExists: (path2) => Bun.file(path2).exists(),
-    readFile: (path2) => Bun.file(path2).text()
+    readFile: (path2) => readJsonlTail(path2)
   };
 });
 
@@ -33976,9 +34215,7 @@ async function autoDetectContextFiles(options) {
     "-I",
     "-E",
     "-e",
-    grepPattern,
-    "--",
-    "src/"
+    grepPattern
   ];
   try {
     const proc = Bun.spawn(grepCommand, {
@@ -34001,6 +34238,9 @@ async function autoDetectContextFiles(options) {
 `).map((line) => line.trim()).filter((line) => line.length > 0);
     const filtered = allFiles.filter((filePath) => {
       const lower = filePath.toLowerCase();
+      if (lower.includes("node_modules/") || lower.startsWith(".git/") || lower.includes("/.git/") || lower.startsWith(".nax/") || lower.includes("/.nax/")) {
+        return false;
+      }
       if (isTestFileByPatterns(filePath, testFilePatterns)) {
         return false;
       }
@@ -34201,6 +34441,7 @@ var init_parent_context = __esm(() => {
 });
 
 // src/context/test-scanner.ts
+import { stat as stat3 } from "fs/promises";
 import path2 from "path";
 var {Glob: Glob2 } = globalThis.Bun;
 function extractTestStructure(source) {
@@ -34248,8 +34489,8 @@ function deriveTestPatterns(contextFiles, resolvedGlobs) {
   const suffixes = resolvedGlobs ? extractGlobSuffixes(resolvedGlobs) : DEFAULT_TS_DERIVE_SUFFIXES;
   const effectiveSuffixes = suffixes.length > 0 ? suffixes : DEFAULT_TS_DERIVE_SUFFIXES;
   for (const filePath of contextFiles) {
-    const basename7 = path2.basename(filePath);
-    const basenameNoExt = basename7.replace(/\.[^.]+$/, "");
+    const basename8 = path2.basename(filePath);
+    const basenameNoExt = basename8.replace(/\.[^.]+$/, "");
     for (const suffix of effectiveSuffixes) {
       patterns.add(`${basenameNoExt}${suffix}`);
     }
@@ -34311,8 +34552,8 @@ async function scanTestFiles(options) {
   const files = [];
   for await (const filePath of glob.scan({ cwd: scanDir, absolute: false })) {
     if (allowedBasenames !== null) {
-      const basename7 = path2.basename(filePath);
-      if (!allowedBasenames.has(basename7)) {
+      const basename8 = path2.basename(filePath);
+      if (!allowedBasenames.has(basename8)) {
         continue;
       }
     }
@@ -34325,6 +34566,24 @@ async function scanTestFiles(options) {
     }
     const fullPath = path2.join(scanDir, filePath);
     try {
+      try {
+        const fileStat = await stat3(fullPath);
+        if (fileStat.size > MAX_TEST_FILE_SIZE_BYTES) {
+          getLogger().debug("test-scanner", "File exceeds size cap \u2014 skipped without read", {
+            path: fullPath,
+            sizeBytes: fileStat.size,
+            capBytes: MAX_TEST_FILE_SIZE_BYTES
+          });
+          continue;
+        }
+      } catch (statErr) {
+        if (statErr.code !== "ENOENT") {
+          getLogger().debug("test-scanner", "stat failed \u2014 falling through to read", {
+            path: fullPath,
+            error: errorMessage(statErr)
+          });
+        }
+      }
       const source = await Bun.file(fullPath).text();
       const { describes, testCount } = extractTestStructure(source);
       if (testCount > 0 || describes.length > 0) {
@@ -34424,10 +34683,11 @@ async function generateTestCoverageSummary(options) {
   const tokens = estimateTokens2(summary);
   return { files, totalTests, summary, tokens };
 }
-var DEFAULT_MAX_SCAN_FILES = 200;
+var DEFAULT_MAX_SCAN_FILES = 200, MAX_TEST_FILE_SIZE_BYTES;
 var init_test_scanner = __esm(() => {
   init_logger2();
   init_conventions();
+  MAX_TEST_FILE_SIZE_BYTES = 1 * 1024 * 1024;
 });
 
 // src/context/formatter.ts
@@ -34990,6 +35250,25 @@ var init_context = __esm(() => {
   init_fragments();
 });
 
+// src/context/engine/providers/canonical-rules-cache.ts
+function memoizedLoadCanonicalRules(workdir, options) {
+  const cached2 = canonicalRulesCache.get(workdir);
+  if (cached2)
+    return cached2;
+  const loaded = loadCanonicalRules(workdir, options);
+  canonicalRulesCache.set(workdir, loaded);
+  loaded.catch(() => canonicalRulesCache.delete(workdir));
+  return loaded;
+}
+function _resetCanonicalRulesCache() {
+  canonicalRulesCache.clear();
+}
+var canonicalRulesCache;
+var init_canonical_rules_cache = __esm(() => {
+  init_canonical_loader();
+  canonicalRulesCache = new Map;
+});
+
 // src/context/engine/providers/static-rules.ts
 import { createHash as createHash10 } from "crypto";
 import { join as join20, relative as relative7 } from "path";
@@ -35018,7 +35297,7 @@ function globToRegex3(pattern) {
         const beforeSlash = i > 0 && pattern[i - 1] === "/";
         const afterSlash = pattern[i + 2] === "/";
         if (beforeSlash && afterSlash) {
-          regex = `${regex.slice(0, -1)}(?:.*\\/)?`;
+          regex = `${regex}(?:.*\\/)?`;
           i += 3;
         } else if (afterSlash) {
           regex += "(?:.*\\/)?";
@@ -35125,7 +35404,14 @@ class StaticRulesProvider {
           mergedRules = [...merged.values()];
         }
       }
-      mergedRules.sort((a, b) => canonicalRulePriority(a) - canonicalRulePriority(b) || canonicalRuleId(a).localeCompare(canonicalRuleId(b)));
+      mergedRules.sort((a, b) => {
+        const priorityDiff = canonicalRulePriority(a) - canonicalRulePriority(b);
+        if (priorityDiff !== 0)
+          return priorityDiff;
+        const idA = canonicalRuleId(a);
+        const idB = canonicalRuleId(b);
+        return idA < idB ? -1 : idA > idB ? 1 : 0;
+      });
       if (mergedRules.length === 0 && (repoRulesAll.length > 0 || packageRulesCount > 0)) {
         logger.warn("static-rules", "Canonical rules found but none apply to this package context", {
           storyId: request.storyId,
@@ -35377,6 +35663,8 @@ var init_static_rules = __esm(() => {
   init_logger2();
   init_optimizer();
   init_canonical_loader();
+  init_canonical_rules_cache();
+  init_canonical_rules_cache();
   _staticRulesDeps = {
     readFile: async (path4) => Bun.file(path4).text(),
     fileExists: async (path4) => Bun.file(path4).exists(),
@@ -35387,7 +35675,7 @@ var init_static_rules = __esm(() => {
         return [];
       }
     },
-    loadCanonicalRules,
+    loadCanonicalRules: memoizedLoadCanonicalRules,
     splitRuleIntoSections,
     applySectionBudget
   };
@@ -35527,12 +35815,15 @@ async function readDiagnosticsDir(scratchDir) {
   } catch {
     return null;
   }
-  const entries = parseToolDiagnosticsJsonl(raw);
-  if (entries.length === 0)
+  const parsedEntries = parseToolDiagnosticsJsonl(raw);
+  if (parsedEntries.length === 0)
     return null;
-  const content = renderEntries(entries);
+  const entries = parsedEntries.slice(-MAX_ENTRIES_PER_DIR2);
+  let content = renderEntries(entries);
   if (!content)
     return null;
+  if (content.length > MAX_CHUNK_CHARS)
+    content = content.slice(0, MAX_CHUNK_CHARS);
   const hash2 = contentHash89(content);
   const tokens = Math.ceil(content.length / 4);
   return {
@@ -35563,13 +35854,14 @@ class ToolDiagnosticsProvider {
     return { chunks, pullTools: [] };
   }
 }
-var _toolDiagnosticsDeps;
+var _toolDiagnosticsDeps, MAX_ENTRIES_PER_DIR2 = 20, MAX_CHUNK_TOKENS4 = 500, MAX_CHUNK_CHARS;
 var init_tool_diagnostics = __esm(() => {
   init_session();
   _toolDiagnosticsDeps = {
     fileExists: (path4) => Bun.file(path4).exists(),
-    readFile: (path4) => Bun.file(path4).text()
+    readFile: (path4) => readJsonlTail(path4)
   };
+  MAX_CHUNK_CHARS = MAX_CHUNK_TOKENS4 * 4;
 });
 
 // src/context/engine/orchestrator-factory.ts
@@ -35760,17 +36052,19 @@ class PluginProviderCache {
     const hit = this.cache.get(key);
     if (hit)
       return hit;
-    const providers = await _pluginCacheDeps.loadProviders(enabled, workdir);
-    this.cache.set(key, providers);
-    return providers;
+    const loading = _pluginCacheDeps.loadProviders(enabled, workdir);
+    this.cache.set(key, loading);
+    loading.catch(() => this.cache.delete(key));
+    return loading;
   }
   async disposeAll() {
     if (this.disposed)
       return;
     this.disposed = true;
     const logger = getLogger();
+    const allProviders = await Promise.all([...this.cache.values()].map((loading) => loading.catch(() => [])));
     const disposals = [];
-    for (const providers of this.cache.values()) {
+    for (const providers of allProviders) {
       for (const provider of providers) {
         const initialisable = provider;
         if (typeof initialisable.dispose !== "function")
@@ -35862,17 +36156,22 @@ var init_provider_weights = __esm(() => {
 // src/context/engine/provider-weights-cache.ts
 class ProviderWeightsCache {
   cache = new Map;
+  generations = new Map;
   async loadOrGet(featureId, projectDir) {
     const cached2 = this.cache.get(featureId);
     if (cached2)
       return cached2;
+    const startGeneration = this.generations.get(featureId) ?? 0;
     const stored = await _providerWeightsCacheDeps.loadFeatureManifests({ featureId, projectDir });
     const weights = _providerWeightsCacheDeps.deriveProviderWeights(stored.map((s) => s.manifest));
-    this.cache.set(featureId, weights);
+    if ((this.generations.get(featureId) ?? 0) === startGeneration) {
+      this.cache.set(featureId, weights);
+    }
     return weights;
   }
   invalidate(featureId) {
     this.cache.delete(featureId);
+    this.generations.set(featureId, (this.generations.get(featureId) ?? 0) + 1);
   }
 }
 var _providerWeightsCacheDeps;
@@ -36003,7 +36302,7 @@ var init_query_scratch = __esm(() => {
 });
 
 // src/context/engine/stage-assembler.ts
-import { readdir } from "fs/promises";
+import { readdir as readdir2 } from "fs/promises";
 import { isAbsolute as isAbsolute8, join as join22, resolve as resolve10 } from "path";
 function dedupeScratchDirs(dirs) {
   return [...new Set(dirs.filter((dir) => Boolean(dir)))];
@@ -36137,7 +36436,7 @@ var init_stage_assembler = __esm(() => {
   init_stage_config();
   DISK_DISCOVERY_TTL_MS = 4 * 60 * 60 * 1000;
   _stageAssemblerDeps = {
-    readdir: (path4) => readdir(path4),
+    readdir: (path4) => readdir2(path4),
     readDescriptor: async (path4) => {
       const f = Bun.file(path4);
       if (!await f.exists())
@@ -36534,7 +36833,7 @@ var init_effectiveness = __esm(() => {
 });
 
 // src/context/engine/manifest-purge.ts
-import { dirname as dirname8, resolve as resolve11 } from "path";
+import { dirname as dirname9, resolve as resolve11 } from "path";
 async function purgeStaleManifests(projectDir, retentionDays) {
   const allEntries = await _manifestPurgeDeps.scan(MANIFEST_PATTERN, projectDir, MAX_MANIFEST_SCAN);
   if (allEntries.length >= MAX_MANIFEST_SCAN) {
@@ -36557,7 +36856,7 @@ async function purgeStaleManifests(projectDir, retentionDays) {
     try {
       await _manifestPurgeDeps.unlink(absPath);
       deleted++;
-      touchedDirs.add(dirname8(absPath));
+      touchedDirs.add(dirname9(absPath));
     } catch {}
   }
   for (const storyDir of touchedDirs) {
@@ -36586,8 +36885,8 @@ var init_manifest_purge = __esm(() => {
       const file3 = Bun.file(path4);
       if (!await file3.exists())
         throw new Error(`stat: file not found: ${path4}`);
-      const stat2 = await file3.stat();
-      return stat2.mtimeMs;
+      const stat4 = await file3.stat();
+      return stat4.mtimeMs;
     },
     unlink: async (path4) => {
       const { unlink: nodeUnlink } = await import("fs/promises");
@@ -38067,7 +38366,7 @@ if none of the proposals are acceptable and none can be reasonably synthesized i
 }
 function buildDebateDiffSection(ctx) {
   if (ctx.mode === "ref") {
-    const stat2 = ctx.stat ?? "(no stat available)";
+    const stat4 = ctx.stat ?? "(no stat available)";
     const ref = ctx.storyGitRef;
     const excludes = [
       ...new Set([...ctx.productionExcludePatterns ?? [], ":!.nax/", ":!**/.nax/", ":!.nax-pids", ":!**/.nax-pids"])
@@ -38076,7 +38375,7 @@ function buildDebateDiffSection(ctx) {
     return [
       "## Changed Files",
       "```",
-      stat2,
+      stat4,
       "```",
       "",
       `## Git Baseline: \`${ref}\``,
@@ -38209,7 +38508,7 @@ ${diff}\`\`\`
 
 `;
 }
-function buildRefDiffSection(storyGitRef, stat2, excludePatterns) {
+function buildRefDiffSection(storyGitRef, stat4, excludePatterns) {
   const merged = [...new Set([...excludePatterns, ":!.nax/", ":!.nax-pids"])];
   const excludeArgs = merged.map((p) => `'${p}'`).join(" ");
   const productionDiffCmd = `git diff --unified=3 ${storyGitRef}..HEAD -- . ${excludeArgs}`;
@@ -38217,7 +38516,7 @@ function buildRefDiffSection(storyGitRef, stat2, excludePatterns) {
   const logCmd = `git log --oneline ${storyGitRef}..HEAD`;
   return `## Changed Files
 \`\`\`
-${stat2}
+${stat4}
 \`\`\`
 
 ## Git Baseline: \`${storyGitRef}\`
@@ -38439,17 +38738,17 @@ The configured blocking threshold is \`"${threshold}"\`. Findings with severity
 
 `;
 }
-function buildAdversarialRefDiffSection(storyGitRef, stat2, excludePatterns = [], testGlobs = [], refExcludePatterns = []) {
+function buildAdversarialRefDiffSection(storyGitRef, stat4, excludePatterns = [], testGlobs = [], refExcludePatterns = []) {
   const merged = [...new Set([...excludePatterns, ":!.nax/", ":!**/.nax/", ":!.nax-pids", ":!**/.nax-pids"])];
   const excludeArgs = merged.map((p) => `'${p}'`).join(" ");
   const productionExcludes = [
     ...new Set([...refExcludePatterns, ":!.nax/", ":!**/.nax/", ":!.nax-pids", ":!**/.nax-pids"])
   ];
   const productionExcludeArgs = productionExcludes.map((p) => `'${p}'`).join(" ");
-  const statBlock = stat2 ? `## Changed Files Summary
+  const statBlock = stat4 ? `## Changed Files Summary
 
 \`\`\`
-${stat2}
+${stat4}
 \`\`\`
 
 ` : "";
@@ -38662,7 +38961,7 @@ var init_adversarial_review_builder = __esm(() => {
         mode,
         diff,
         storyGitRef,
-        stat: stat2,
+        stat: stat4,
         testInventory,
         excludePatterns,
         testGlobs,
@@ -38690,7 +38989,7 @@ ${config2.rules.map((r) => `- ${r}`).join(`
 ` : "";
       let diffBlock;
       if (mode === "ref" && storyGitRef) {
-        diffBlock = buildAdversarialRefDiffSection(storyGitRef, stat2, excludePatterns ?? [], testGlobs ?? [], refExcludePatterns ?? []);
+        diffBlock = buildAdversarialRefDiffSection(storyGitRef, stat4, excludePatterns ?? [], testGlobs ?? [], refExcludePatterns ?? []);
       } else if (mode === "embedded" && diff) {
         diffBlock = buildAdversarialEmbeddedDiffSection(diff, testInventory);
       } else {
@@ -39150,8 +39449,8 @@ function stripMarkdownInline(s) {
 function extractLocusKeywords(finding) {
   const keywords = [];
   if (finding.file) {
-    const basename7 = finding.file.split("/").pop() ?? "";
-    const stem = basename7.replace(/\.[^.]+$/, "");
+    const basename8 = finding.file.split("/").pop() ?? "";
+    const stem = basename8.replace(/\.[^.]+$/, "");
     for (const part of stem.split(/[-_]/)) {
       if (part.length >= 3)
         keywords.push(part.toLowerCase());
@@ -40669,58 +40968,58 @@ function proposeAdjustments(bandStats, mapping, thresholds = {}) {
   const adjustments = [];
   const skipped = [];
   const hints = [];
-  for (const stat2 of bandStats) {
-    const currentTier = mapping[stat2.complexity];
+  for (const stat4 of bandStats) {
+    const currentTier = mapping[stat4.complexity];
     if (currentTier === undefined) {
       skipped.push({
-        complexity: stat2.complexity,
+        complexity: stat4.complexity,
         reason: "missing-mapping"
       });
       continue;
     }
-    if (stat2.sampleCount < t.minSamples) {
+    if (stat4.sampleCount < t.minSamples) {
       skipped.push({
-        complexity: stat2.complexity,
+        complexity: stat4.complexity,
         reason: "insufficient-samples",
-        sampleCount: stat2.sampleCount,
+        sampleCount: stat4.sampleCount,
         minSamples: t.minSamples
       });
       continue;
     }
-    const upgraded = stat2.escalationRate >= t.upgradeEscalationRate && stat2.mismatchRate >= t.upgradeMismatchRate;
-    const downgraded = stat2.firstPassRate >= t.downgradeFirstPassRate && stat2.escalationRate <= t.downgradeEscalationRate && stat2.mismatchRate > 0;
+    const upgraded = stat4.escalationRate >= t.upgradeEscalationRate && stat4.mismatchRate >= t.upgradeMismatchRate;
+    const downgraded = stat4.firstPassRate >= t.downgradeFirstPassRate && stat4.escalationRate <= t.downgradeEscalationRate && stat4.mismatchRate > 0;
     if (upgraded) {
       const to = nextTier(currentTier, "upgrade");
       if (to !== null) {
         adjustments.push({
-          band: stat2.complexity,
-          complexity: stat2.complexity,
+          band: stat4.complexity,
+          complexity: stat4.complexity,
           from: currentTier,
           to,
           fromTier: currentTier,
           toTier: to,
           direction: "upgrade",
-          rationale: `escalationRate=${stat2.escalationRate} \u2265 ${t.upgradeEscalationRate}, mismatchRate=${stat2.mismatchRate} \u2265 ${t.upgradeMismatchRate}`
+          rationale: `escalationRate=${stat4.escalationRate} \u2265 ${t.upgradeEscalationRate}, mismatchRate=${stat4.mismatchRate} \u2265 ${t.upgradeMismatchRate}`
         });
       }
     } else if (downgraded) {
       const to = nextTier(currentTier, "downgrade");
       if (to !== null) {
         adjustments.push({
-          band: stat2.complexity,
-          complexity: stat2.complexity,
+          band: stat4.complexity,
+          complexity: stat4.complexity,
           from: currentTier,
           to,
           fromTier: currentTier,
           toTier: to,
           direction: "downgrade",
-          rationale: `firstPassRate=${stat2.firstPassRate} \u2265 ${t.downgradeFirstPassRate} and escalationRate=${stat2.escalationRate} \u2264 ${t.downgradeEscalationRate}`
+          rationale: `firstPassRate=${stat4.firstPassRate} \u2265 ${t.downgradeFirstPassRate} and escalationRate=${stat4.escalationRate} \u2264 ${t.downgradeEscalationRate}`
         });
       }
     }
-    if (stat2.mismatchRate >= t.upgradeMismatchRate) {
+    if (stat4.mismatchRate >= t.upgradeMismatchRate) {
       hints.push({
-        message: `classify.ts: high mismatch for band "${stat2.complexity}" (mismatchRate=${stat2.mismatchRate}) \u2014 review keyword classification.`
+        message: `classify.ts: high mismatch for band "${stat4.complexity}" (mismatchRate=${stat4.mismatchRate}) \u2014 review keyword classification.`
       });
     }
   }
@@ -43799,7 +44098,7 @@ var init_implement = __esm(() => {
 });
 
 // src/tdd/verdict-reader.ts
-import { unlink as unlink2 } from "fs/promises";
+import { unlink as unlink3 } from "fs/promises";
 import path5 from "path";
 function isValidTestFailureDiagnosis(value) {
   if (!value || typeof value !== "object")
@@ -44019,7 +44318,7 @@ async function readVerdict(workdir) {
 async function cleanupVerdict(workdir) {
   const verdictPath = path5.join(workdir, VERDICT_FILE);
   try {
-    await unlink2(verdictPath);
+    await unlink3(verdictPath);
   } catch {}
 }
 var VERDICT_FILE = ".nax-verifier-verdict.json";
@@ -45075,11 +45374,11 @@ async function executeWithTimeout(command, timeoutSeconds, env2, options) {
     if (!exitedDuringGrace) {
       killProcessGroup(pid, "SIGKILL");
     }
-    const [out, err] = await Promise.all([
+    const [out2, err2] = await Promise.all([
       raceWithDeadline(stdoutPromise, drainTimeoutMs),
       raceWithDeadline(stderrPromise, drainTimeoutMs)
     ]);
-    const parts = [out !== DRAIN_TIMEOUT ? out : "", err !== DRAIN_TIMEOUT ? err : ""].filter(Boolean);
+    const parts = [out2 !== DRAIN_TIMEOUT ? out2 : "", err2 !== DRAIN_TIMEOUT ? err2 : ""].filter(Boolean);
     const partialOutput = parts.join(`
 `) || undefined;
     return {
@@ -45093,7 +45392,12 @@ async function executeWithTimeout(command, timeoutSeconds, env2, options) {
     };
   }
   const exitCode = typeof raceResult === "number" ? raceResult : 0;
-  const [stdout, stderr] = await Promise.all([stdoutPromise, stderrPromise]);
+  const [out, err] = await Promise.all([
+    raceWithDeadline(stdoutPromise, drainTimeoutMs),
+    raceWithDeadline(stderrPromise, drainTimeoutMs)
+  ]);
+  const stdout = out !== DRAIN_TIMEOUT ? out : "";
+  const stderr = err !== DRAIN_TIMEOUT ? err : "";
   const output = `${stdout}
 ${stderr}`;
   return {
@@ -45121,9 +45425,31 @@ function appendForceExitFlag(command) {
   return appendFlag(command, "--forceExit");
 }
 function appendFlag(command, flag) {
-  const pipeIndex = command.search(/[|>]/);
-  if (pipeIndex > 0) {
-    return `${command.slice(0, pipeIndex).trimEnd()} ${flag} ${command.slice(pipeIndex)}`;
+  let quote = null;
+  for (let i = 0;i < command.length; i++) {
+    const char = command[i];
+    if (quote) {
+      if (char === quote)
+        quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (char === "|" || char === ">") {
+      let splitIndex = i;
+      if (char === ">") {
+        let digitStart = splitIndex;
+        while (digitStart > 0 && /[0-9]/.test(command[digitStart - 1] ?? ""))
+          digitStart--;
+        const charBeforeDigits = command[digitStart - 1];
+        const isStandaloneFdToken = digitStart < splitIndex && (digitStart === 0 || /[\s|;&]/.test(charBeforeDigits ?? ""));
+        if (isStandaloneFdToken)
+          splitIndex = digitStart;
+      }
+      return `${command.slice(0, splitIndex).trimEnd()} ${flag} ${command.slice(splitIndex)}`;
+    }
   }
   return `${command} ${flag}`;
 }
@@ -45933,7 +46259,7 @@ function createDrainDeadline(deadlineMs) {
   };
 }
 async function runQualityCommand(opts) {
-  const { commandName, command, workdir, storyId, timeoutMs = DEFAULT_TIMEOUT_MS, env: env2, stripEnvVars } = opts;
+  const { commandName, command, workdir, storyId, timeoutMs = DEFAULT_TIMEOUT_MS2, env: env2, stripEnvVars } = opts;
   if (!command || command.trim() === "") {
     return {
       commandName,
@@ -46046,7 +46372,7 @@ async function runQualityCommand(opts) {
     };
   }
 }
-var DEFAULT_TIMEOUT_MS = 120000, SIGKILL_GRACE_PERIOD_MS = 5000, STREAM_DRAIN_TIMEOUT_MS = 2000, _qualityRunnerDeps;
+var DEFAULT_TIMEOUT_MS2 = 120000, SIGKILL_GRACE_PERIOD_MS = 5000, STREAM_DRAIN_TIMEOUT_MS = 2000, _qualityRunnerDeps;
 var init_runner = __esm(() => {
   init_logger2();
   _qualityRunnerDeps = {
@@ -47512,12 +47838,12 @@ function journalPathFor(repoRoot, storyId) {
   return join31(journalDir(repoRoot), journalFileName(storyId));
 }
 async function mayHaveJournal(candidateRoots) {
-  const { stat: stat2 } = await import("fs/promises");
+  const { stat: stat4 } = await import("fs/promises");
   for (const root of candidateRoots) {
     if (!root)
       continue;
     try {
-      if ((await stat2(journalDir(root))).isDirectory())
+      if ((await stat4(journalDir(root))).isDirectory())
         return true;
     } catch {}
   }
@@ -47529,8 +47855,8 @@ async function recordInFlight(repoRoot, entry) {
   await Bun.write(journalPathFor(repoRoot, entry.storyId), JSON.stringify(entry));
 }
 async function clearInFlight(repoRoot, storyId) {
-  const { unlink: unlink3 } = await import("fs/promises");
-  await unlink3(journalPathFor(repoRoot, storyId)).catch(() => {});
+  const { unlink: unlink4 } = await import("fs/promises");
+  await unlink4(journalPathFor(repoRoot, storyId)).catch(() => {});
 }
 async function readEntry(path7) {
   try {
@@ -47544,11 +47870,11 @@ async function readEntry(path7) {
   }
 }
 async function restoreInFlight(repoRoot) {
-  const { readdir: readdir2, unlink: unlink3 } = await import("fs/promises");
+  const { readdir: readdir3, unlink: unlink4 } = await import("fs/promises");
   const dir = journalDir(repoRoot);
   let names;
   try {
-    names = await readdir2(dir);
+    names = await readdir3(dir);
   } catch {
     return [];
   }
@@ -47559,13 +47885,13 @@ async function restoreInFlight(repoRoot) {
     const path7 = join31(dir, name);
     const entry = await readEntry(path7);
     if (!entry) {
-      await unlink3(path7).catch(() => {});
+      await unlink4(path7).catch(() => {});
       continue;
     }
     if (!isInside(repoRoot, entry.file))
       continue;
     results.push(await restoreEntry(entry));
-    await unlink3(path7).catch(() => {});
+    await unlink4(path7).catch(() => {});
   }
   return results;
 }
@@ -48486,8 +48812,12 @@ function recordReviewIteration(store, storyId, roundFindings) {
     startedAt: now,
     finishedAt: now
   };
-  store.set(storyId, [...prior, iteration]);
+  const merged = [...prior, iteration];
+  const trimmed = merged.length > MAX_ITERATIONS_PER_STORY ? merged.slice(-MAX_ITERATIONS_PER_STORY) : merged;
+  const renumbered = trimmed.map((it, i) => ({ ...it, iterationNum: i + 1 }));
+  store.set(storyId, renumbered);
 }
+var MAX_ITERATIONS_PER_STORY = 10;
 var init_review_iteration_store = __esm(() => {
   init_findings();
 });
@@ -48602,15 +48932,15 @@ async function collectDiffStat(workdir, storyGitRef, options) {
   ]);
   return exitCode === 0 ? stdout.trim() : "";
 }
-function truncateDiff(diff, stat2) {
+function truncateDiff(diff, stat4) {
   if (diff.length <= DIFF_CAP_BYTES) {
     return diff;
   }
   const truncated = diff.slice(0, DIFF_CAP_BYTES);
   const visibleFiles = (truncated.match(/^diff --git/gm) ?? []).length;
   const totalFiles = (diff.match(/^diff --git/gm) ?? []).length;
-  const statPreamble = stat2 ? `## File Summary (all changed files)
-${stat2}
+  const statPreamble = stat4 ? `## File Summary (all changed files)
+${stat4}
 
 ## Diff (truncated \u2014 ${visibleFiles}/${totalFiles} files shown)
 ` : "";
@@ -48831,25 +49161,25 @@ async function prepareSemanticReviewInput(args) {
     };
   }
   const { packageDir, packageDirRelative } = derivePackageDirs(workdir, projectDir);
-  const stat2 = await collectDiffStat(workdir, effectiveRef, { naxIgnoreIndex, packageDir });
+  const stat4 = await collectDiffStat(workdir, effectiveRef, { naxIgnoreIndex, packageDir });
   const resolved = args.resolvedTestPatterns ?? await resolveTestFilePatterns(config2 ?? reviewConfigSelector.select(DEFAULT_CONFIG), projectDir ?? workdir, packageDirRelative);
   const excludePatterns = [...resolveReviewExcludePatterns(semanticConfig.excludePatterns, resolved)];
   const diffMode = semanticConfig.diffMode ?? "ref";
   if (diffMode === "ref") {
-    if (!stat2) {
+    if (!stat4) {
       return { effectiveRef, stat: "", diff: undefined, excludePatterns, skipReason: "no changes detected" };
     }
-    return { effectiveRef, stat: stat2, diff: undefined, excludePatterns };
+    return { effectiveRef, stat: stat4, diff: undefined, excludePatterns };
   }
   const rawDiff = await collectDiff(workdir, effectiveRef, excludePatterns, { naxIgnoreIndex, packageDir });
   if (rawDiff === null) {
-    return { effectiveRef, stat: stat2, diff: undefined, excludePatterns, skipReason: "git diff failed" };
+    return { effectiveRef, stat: stat4, diff: undefined, excludePatterns, skipReason: "git diff failed" };
   }
-  const diff = truncateDiff(rawDiff, rawDiff.length > DIFF_CAP_BYTES ? stat2 : undefined);
+  const diff = truncateDiff(rawDiff, rawDiff.length > DIFF_CAP_BYTES ? stat4 : undefined);
   if (!diff) {
-    return { effectiveRef, stat: stat2, diff: undefined, excludePatterns, skipReason: "no production code changes" };
+    return { effectiveRef, stat: stat4, diff: undefined, excludePatterns, skipReason: "no production code changes" };
   }
-  return { effectiveRef, stat: stat2, diff, excludePatterns };
+  return { effectiveRef, stat: stat4, diff, excludePatterns };
 }
 async function prepareAdversarialReviewInput(args) {
   const { workdir, projectDir, storyId, storyGitRef, config: config2, naxIgnoreIndex, adversarialConfig } = args;
@@ -48867,9 +49197,9 @@ async function prepareAdversarialReviewInput(args) {
     };
   }
   const { packageDir, packageDirRelative } = derivePackageDirs(workdir, projectDir);
-  const stat2 = await collectDiffStat(workdir, effectiveRef, { naxIgnoreIndex, packageDir });
+  const stat4 = await collectDiffStat(workdir, effectiveRef, { naxIgnoreIndex, packageDir });
   const diffMode = adversarialConfig.diffMode ?? "ref";
-  if (diffMode === "ref" && !stat2) {
+  if (diffMode === "ref" && !stat4) {
     return {
       effectiveRef,
       stat: "",
@@ -48890,7 +49220,7 @@ async function prepareAdversarialReviewInput(args) {
   if (diffMode === "ref") {
     return {
       effectiveRef,
-      stat: stat2,
+      stat: stat4,
       diff: undefined,
       testInventory: undefined,
       excludePatterns,
@@ -48902,7 +49232,7 @@ async function prepareAdversarialReviewInput(args) {
   if (!diff) {
     return {
       effectiveRef,
-      stat: stat2,
+      stat: stat4,
       diff: undefined,
       testInventory: undefined,
       excludePatterns,
@@ -48915,7 +49245,7 @@ async function prepareAdversarialReviewInput(args) {
     naxIgnoreIndex,
     packageDir
   });
-  return { effectiveRef, stat: stat2, diff, testInventory, excludePatterns, testGlobs, refExcludePatterns };
+  return { effectiveRef, stat: stat4, diff, testInventory, excludePatterns, testGlobs, refExcludePatterns };
 }
 var init_prepare_inputs = __esm(() => {
   init_config();
@@ -48924,14 +49254,14 @@ var init_prepare_inputs = __esm(() => {
 });
 
 // src/utils/nax-project-root.ts
-import { dirname as dirname9, join as join33, resolve as resolve13 } from "path";
+import { dirname as dirname10, join as join33, resolve as resolve13 } from "path";
 async function findNaxProjectRoot(startDir) {
   let dir = resolve13(startDir);
   for (let depth = 0;depth < MAX_NAX_WALK_DEPTH; depth++) {
     if (await _naxProjectRootDeps.exists(join33(dir, ".nax", "config.json"))) {
       return dir;
     }
-    const parent = dirname9(dir);
+    const parent = dirname10(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -48952,7 +49282,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.80.0-canary.4",
+    version: "0.80.0",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -49067,8 +49397,8 @@ var init_version = __esm(() => {
   NAX_VERSION = package_default.version;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("3c02dbe9"))
-        return "3c02dbe9";
+      if (/^[0-9a-f]{6,10}$/.test("b4df507e"))
+        return "b4df507e";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -49309,7 +49639,7 @@ async function runAdversarialReview(opts) {
     };
   }
   const effectiveRef = prepared.effectiveRef;
-  const stat2 = prepared.stat;
+  const stat4 = prepared.stat;
   const diff = prepared.diff;
   const testInventory = prepared.testInventory;
   const effectiveRefExcludePatterns = prepared.refExcludePatterns;
@@ -49370,7 +49700,7 @@ async function runAdversarialReview(opts) {
       mode: diffMode,
       diff,
       storyGitRef: effectiveRef,
-      stat: stat2,
+      stat: stat4,
       testInventory,
       excludePatterns: adversarialConfig.excludePatterns,
       testGlobs,
@@ -50162,7 +50492,7 @@ async function runSemanticDebate(opts) {
     story,
     diffMode,
     diff,
-    stat: stat2,
+    stat: stat4,
     semanticConfig,
     effectiveRef,
     startTime,
@@ -50428,7 +50758,7 @@ async function runSemanticReview(opts) {
     };
   }
   const effectiveRef = prepared.effectiveRef;
-  const stat2 = prepared.stat;
+  const stat4 = prepared.stat;
   const diff = prepared.diff;
   const excludePatterns = prepared.excludePatterns;
   const effectiveAgentManager = runtime?.agentManager ?? agentManager;
@@ -50468,7 +50798,7 @@ async function runSemanticReview(opts) {
     mode: diffMode,
     diff,
     storyGitRef: effectiveRef,
-    stat: stat2,
+    stat: stat4,
     priorSemanticIterations,
     excludePatterns: semanticConfig.excludePatterns
   });
@@ -50501,7 +50831,7 @@ async function runSemanticReview(opts) {
       story,
       diffMode,
       diff,
-      stat: stat2,
+      stat: stat4,
       semanticConfig,
       effectiveRef,
       startTime,
@@ -50535,7 +50865,7 @@ async function runSemanticReview(opts) {
       mode: diffMode,
       diff,
       storyGitRef: effectiveRef,
-      stat: stat2,
+      stat: stat4,
       priorSemanticIterations,
       excludePatterns,
       featureCtxBlock,
@@ -50841,18 +51171,11 @@ function normalizeMechanicalFindings(checkName, result, workdir) {
 }
 async function getUncommittedFilesImpl(workdir) {
   try {
-    const proc = Bun.spawn({
-      cmd: ["git", "diff", "--name-only", "HEAD"],
-      cwd: workdir,
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const exitCode = await proc.exited;
+    const { stdout, exitCode } = await gitWithTimeout(["diff", "--name-only", "HEAD"], workdir);
     if (exitCode !== 0) {
       return [];
     }
-    const output = await new Response(proc.stdout).text();
-    return output.trim().split(`
+    return stdout.trim().split(`
 `).filter(Boolean);
   } catch {
     return [];
@@ -53127,6 +53450,7 @@ function buildHopCallback(ctx, sessionId, _initialOptions) {
           role: resolvedRunOptions.sessionRole ?? "implementer",
           workdir,
           pipelineStage: stage,
+          config: config2,
           modelDef,
           ...resolvedRunOptions.modelDef !== undefined ? {} : { modelTier: effectiveTier },
           timeoutSeconds: resolvedRunOptions.timeoutSeconds ?? config2.execution?.sessionTimeoutSeconds ?? DEFAULT_CONFIG.execution.sessionTimeoutSeconds,
@@ -53143,6 +53467,7 @@ function buildHopCallback(ctx, sessionId, _initialOptions) {
         role: resolvedRunOptions.sessionRole ?? "implementer",
         workdir,
         pipelineStage: stage,
+        config: config2,
         modelDef,
         ...pinned ? {} : { modelTier: effectiveTier },
         timeoutSeconds: resolvedRunOptions.timeoutSeconds ?? config2.execution?.sessionTimeoutSeconds ?? DEFAULT_CONFIG.execution.sessionTimeoutSeconds,
@@ -53159,6 +53484,7 @@ function buildHopCallback(ctx, sessionId, _initialOptions) {
         workdir,
         projectDir,
         pipelineStage: stage,
+        config: config2,
         sessionRole: resolvedRunOptions.sessionRole,
         signal: resolvedRunOptions.abortSignal,
         contextPullTools,
@@ -55285,8 +55611,8 @@ async function triageFlakyFindings(input) {
       result.push({ ...f });
     return { findings: result, quarantineReport: { keys, reasons } };
   }
-  const changedTestSet = new Set(diff.changedTestFiles.map(basename7));
-  const mappedTestSet = new Set(diff.mappedTestFiles.map(basename7));
+  const changedTestSet = new Set(diff.changedTestFiles.map(basename8));
+  const mappedTestSet = new Set(diff.mappedTestFiles.map(basename8));
   const candidates = findings.filter((f) => isProbeCandidate(f, changedTestSet, mappedTestSet));
   if (candidates.length > flakeDetection.maxProbesPerGate) {
     logger?.info("flake-triage", `Skipping flake triage \u2014 ${candidates.length} candidates exceed maxProbesPerGate=${flakeDetection.maxProbesPerGate}`);
@@ -55356,7 +55682,7 @@ async function triageFlakyFindings(input) {
   }
   return { findings: result, quarantineReport: { keys, reasons } };
 }
-function basename7(path8) {
+function basename8(path8) {
   const i = path8.lastIndexOf("/");
   return i === -1 ? path8 : path8.slice(i + 1);
 }
@@ -55367,7 +55693,7 @@ function isProbeCandidate(finding, changedTestSet, mappedTestSet) {
     return false;
   if (!finding.rule)
     return false;
-  const base = basename7(finding.file);
+  const base = basename8(finding.file);
   if (changedTestSet.has(base) || changedTestSet.has(finding.file))
     return false;
   if (mappedTestSet.has(base) || mappedTestSet.has(finding.file))
@@ -55404,6 +55730,7 @@ function createSessionRunHop(sessionManager, getAgentManager) {
       role: options.sessionRole,
       workdir: options.workdir,
       pipelineStage: options.pipelineStage ?? "run",
+      config: options.config,
       modelDef: options.modelDef,
       timeoutSeconds: options.timeoutSeconds,
       featureName: options.featureName,
@@ -55422,6 +55749,7 @@ function createSessionRunHop(sessionManager, getAgentManager) {
         workdir: options.workdir,
         projectDir: options.projectDir,
         pipelineStage: options.pipelineStage ?? "run",
+        config: options.config,
         sessionRole: options.sessionRole,
         signal: options.abortSignal,
         interactionHandler,
@@ -55513,7 +55841,7 @@ __export(exports_runtime, {
   CostAggregator: () => CostAggregator,
   AgentStreamEventBus: () => AgentStreamEventBus
 });
-import { basename as basename8, join as join38 } from "path";
+import { basename as basename9, join as join38 } from "path";
 function createRuntime(config2, workdir, opts) {
   const runId = crypto.randomUUID();
   const controller = new AbortController;
@@ -55525,7 +55853,7 @@ function createRuntime(config2, workdir, opts) {
   const configLoader = createConfigLoader(config2);
   const dispatchEvents = new DispatchEventBus;
   const agentStreamEvents = opts?.agentStreamEvents ?? new AgentStreamEventBus;
-  const projectKey = config2.name?.trim() || basename8(workdir);
+  const projectKey = config2.name?.trim() || basename9(workdir);
   const outputDir = projectOutputDir(projectKey, config2.outputDir);
   const globalDir = globalOutputDir();
   const curatorRollupPathValue = curatorRollupPath(globalDir, config2.curator?.rollupPath);
@@ -58000,11 +58328,28 @@ class InteractionChain {
     return this.plugins[0]?.plugin ?? null;
   }
   async send(request) {
-    const plugin = this.getPrimary();
-    if (!plugin) {
-      throw new NaxError("No interaction plugin registered", "INTERACTION_ERROR", { stage: "run" });
+    if (this.plugins.length === 0) {
+      throw new NaxError("No interaction plugin registered", "INTERACTION_ERROR", {
+        stage: "run",
+        requestId: request.id
+      });
+    }
+    const errors3 = [];
+    for (const entry of this.plugins) {
+      try {
+        await entry.plugin.send(request);
+        return;
+      } catch (err) {
+        const error48 = err instanceof Error ? err : new Error(String(err));
+        errors3.push(error48);
+      }
     }
-    await plugin.send(request);
+    const errorMessages = errors3.map((e) => e.message).join("; ");
+    throw new NaxError(`All interaction plugins failed: ${errorMessages}`, "INTERACTION_ERROR", {
+      stage: "run",
+      requestId: request.id,
+      pluginCount: this.plugins.length
+    });
   }
   async receive(requestId, timeout) {
     if (this.plugins.length === 0) {
@@ -58393,10 +58738,10 @@ function buildHeader(request) {
   const emoji3 = getStageEmoji(request.stage);
   let text = `${emoji3} *${request.stage.toUpperCase()}*
 `;
-  text += `*Feature:* ${request.featureName}
+  text += `*Feature:* ${sanitizeMarkdown(request.featureName)}
 `;
   if (request.storyId) {
-    text += `*Story:* ${request.storyId}
+    text += `*Story:* ${sanitizeMarkdown(request.storyId)}
 `;
   }
   text += `
@@ -58603,16 +58948,24 @@ var init_telegram = __esm(() => {
           const partLabel = chunks.length > 1 ? `[${i + 1}/${chunks.length}] ` : "";
           const text = `${header}
 ${partLabel}${chunks[i]}`;
-          const response = await _telegramPluginDeps.fetch(`https://api.telegram.org/bot${this.botToken}/sendMessage`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              chat_id: this.chatId,
-              text,
-              reply_markup: isLast && keyboard ? { inline_keyboard: keyboard } : undefined,
-              parse_mode: "Markdown"
-            })
-          });
+          const controller = new AbortController;
+          const timer = setTimeout(() => controller.abort(), 5000);
+          let response;
+          try {
+            response = await _telegramPluginDeps.fetch(`https://api.telegram.org/bot${this.botToken}/sendMessage`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({
+                chat_id: this.chatId,
+                text,
+                reply_markup: isLast && keyboard ? { inline_keyboard: keyboard } : undefined,
+                parse_mode: "Markdown"
+              }),
+              signal: controller.signal
+            });
+          } finally {
+            clearTimeout(timer);
+          }
           if (!response.ok) {
             const errorBody = await response.text().catch(() => "");
             throw new Error(`Telegram API error (${response.status}): ${errorBody || response.statusText}`);
@@ -58648,8 +59001,9 @@ ${partLabel}${chunks[i]}`;
       });
     }
     async cancel(requestId) {
-      await this.sendTimeoutMessage(requestId);
+      const pending = this.pendingMessages.get(requestId);
       this.resolveReceiver(requestId, "skip", "timeout");
+      this.sendTimeoutMessage(requestId, pending);
     }
     ensurePoller() {
       if (this.poller)
@@ -58709,8 +59063,9 @@ ${partLabel}${chunks[i]}`;
       });
     }
     async expireReceiver(requestId) {
-      await this.sendTimeoutMessage(requestId);
+      const pending = this.pendingMessages.get(requestId);
       this.resolveReceiver(requestId, "skip", "timeout");
+      this.sendTimeoutMessage(requestId, pending);
     }
     resolveReceiver(requestId, action, respondedBy) {
       this.resolveReceiverWithResponse(requestId, { requestId, action, respondedBy, respondedAt: Date.now() });
@@ -58862,24 +59217,31 @@ ${partLabel}${chunks[i]}`;
         }
       } catch {}
     }
-    async sendTimeoutMessage(requestId) {
-      const pending = this.pendingMessages.get(requestId);
+    async sendTimeoutMessage(requestId, pendingArg) {
+      const pending = pendingArg ?? this.pendingMessages.get(requestId);
       if (!pending || !this.botToken || !this.chatId) {
         this.pendingMessages.delete(requestId);
         return;
       }
       const lastId = pending.ids[pending.ids.length - 1];
       try {
-        await _telegramPluginDeps.fetch(`https://api.telegram.org/bot${this.botToken}/editMessageText`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            chat_id: this.chatId,
-            message_id: lastId,
-            text: "\u23F1 EXPIRED \u2014 Interaction timed out",
-            reply_markup: { inline_keyboard: [] }
-          })
-        });
+        const controller = new AbortController;
+        const timer = setTimeout(() => controller.abort(), CALLBACK_API_TIMEOUT_MS);
+        try {
+          await _telegramPluginDeps.fetch(`https://api.telegram.org/bot${this.botToken}/editMessageText`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              chat_id: this.chatId,
+              message_id: lastId,
+              text: "\u23F1 EXPIRED \u2014 Interaction timed out",
+              reply_markup: { inline_keyboard: [] }
+            }),
+            signal: controller.signal
+          });
+        } finally {
+          clearTimeout(timer);
+        }
       } catch {} finally {
         this.pendingMessages.delete(requestId);
       }
@@ -58974,7 +59336,7 @@ function installServePortZeroCompat() {
     const request = input instanceof Request ? input : new Request(input instanceof URL ? input.toString() : input, init);
     const url2 = new URL(request.url);
     const port = Number.parseInt(url2.port, 10);
-    if ((url2.hostname === "localhost" || url2.hostname === "127.0.0.1") && inMemoryServers.has(port)) {
+    if ((url2.hostname === "localhost" || url2.hostname === "127.0.0.1") && url2.pathname.startsWith(CALLBACK_PATH_PREFIX) && inMemoryServers.has(port)) {
       const server = inMemoryServers.get(port);
       if (!server) {
         return new Response("Not Found", { status: 404 });
@@ -58985,7 +59347,7 @@ function installServePortZeroCompat() {
   };
   servePortZeroCompatInstalled = true;
 }
-var PORT_ZERO_COMPAT_BASE = 40000, PORT_ZERO_COMPAT_SPAN = 20000, servePortZeroCompatInstalled = false, servePortZeroCounter = 0, inMemoryServers;
+var PORT_ZERO_COMPAT_BASE = 40000, PORT_ZERO_COMPAT_SPAN = 20000, CALLBACK_PATH_PREFIX = "/nax/interact/", servePortZeroCompatInstalled = false, servePortZeroCounter = 0, inMemoryServers;
 var init_webhook_serve_compat = __esm(() => {
   init_errors();
   inMemoryServers = new Map;
@@ -59575,10 +59937,10 @@ function validateFeatureName(feature) {
 
 // src/plan/critic.ts
 import { mkdir as mkdir7 } from "fs/promises";
-import { dirname as dirname10, join as join47 } from "path";
+import { dirname as dirname11, join as join47 } from "path";
 async function writeSpecDeltas(findings, workdir, runId, storyId, manifest) {
   const path8 = join47(workdir, ".nax", "runs", runId, "plan", storyId, "spec-deltas.md");
-  await mkdir7(dirname10(path8), { recursive: true });
+  await mkdir7(dirname11(path8), { recursive: true });
   await Bun.write(path8, formatSpecDeltas(findings, manifest));
   return path8;
 }
@@ -59806,8 +60168,8 @@ async function checkStaleLock(workdir) {
     } else if (lockData.startedAt) {
       lockTimeMs = new Date(lockData.startedAt).getTime();
     } else {
-      const stat2 = statSync3(lockPath);
-      lockTimeMs = stat2.mtimeMs;
+      const stat4 = statSync3(lockPath);
+      lockTimeMs = stat4.mtimeMs;
     }
     const holderAlive = typeof lockData.pid === "number" && isProcessAlive(lockData.pid);
     const ageMs = Date.now() - lockTimeMs;
@@ -61075,10 +61437,10 @@ __export(exports_status_cost, {
   displayCostMetrics: () => displayCostMetrics,
   _costReportEmitDeps: () => _costReportEmitDeps
 });
-import { basename as basename9 } from "path";
+import { basename as basename10 } from "path";
 async function resolveProject(workdir) {
   const config2 = await loadConfig(workdir).catch(() => null);
-  const project = config2?.name?.trim() || basename9(workdir);
+  const project = config2?.name?.trim() || basename10(workdir);
   const outputDir = projectOutputDir(project, config2?.outputDir);
   return { project, outputDir };
 }
@@ -61359,7 +61721,7 @@ __export(exports_status_features, {
   _statusFeaturesDeps: () => _statusFeaturesDeps
 });
 import { existsSync as existsSync17, readdirSync as readdirSync3 } from "fs";
-import { basename as basename10, join as join51, resolve as resolve15 } from "path";
+import { basename as basename11, join as join51, resolve as resolve15 } from "path";
 async function loadStatusFile(featureDir2) {
   const statusPath = join51(featureDir2, "status.json");
   if (!existsSync17(statusPath)) {
@@ -61374,7 +61736,7 @@ async function loadStatusFile(featureDir2) {
 }
 async function loadProjectStatusFile(projectDir) {
   const config2 = await _statusFeaturesDeps.loadConfig(projectDir).catch(() => null);
-  const projectKey = config2?.name?.trim() || basename10(projectDir);
+  const projectKey = config2?.name?.trim() || basename11(projectDir);
   const outputDir = _statusFeaturesDeps.projectOutputDir(projectKey, config2?.outputDir);
   const statusPath = join51(outputDir, "status.json");
   if (!existsSync17(statusPath)) {
@@ -61448,7 +61810,7 @@ async function getFeatureSummary(featureName, featureDir2) {
 }
 async function displayAllFeatures(projectDir) {
   const config2 = await _statusFeaturesDeps.loadConfig(projectDir).catch(() => null);
-  const projectKey = config2?.name?.trim() || basename10(projectDir);
+  const projectKey = config2?.name?.trim() || basename11(projectDir);
   const outputDir = _statusFeaturesDeps.projectOutputDir(projectKey, config2?.outputDir);
   const featuresDir2 = join51(outputDir, "features");
   if (!existsSync17(featuresDir2)) {
@@ -61643,7 +62005,7 @@ async function displayFeatureStatus(options = {}) {
     if (options.dir) {
       const projectDir = resolve15(options.dir);
       const config2 = await _statusFeaturesDeps.loadConfig(projectDir).catch(() => null);
-      const projectKey = config2?.name?.trim() || basename10(projectDir);
+      const projectKey = config2?.name?.trim() || basename11(projectDir);
       const outputDir = _statusFeaturesDeps.projectOutputDir(projectKey, config2?.outputDir);
       featureDir2 = join51(outputDir, "features", options.feature);
     } else {
@@ -62025,8 +62387,8 @@ var init_semantic_verdict = __esm(() => {
       await Bun.write(filePath, content);
     },
     readdir: async (dir) => {
-      const { readdir: readdir2 } = await import("fs/promises");
-      return readdir2(dir);
+      const { readdir: readdir3 } = await import("fs/promises");
+      return readdir3(dir);
     },
     readFile: async (filePath) => {
       return Bun.file(filePath).text();
@@ -62944,9 +63306,9 @@ var init_acceptance_setup = __esm(() => {
       await Bun.write(dest, content);
     },
     deleteFile: async (filePath) => {
-      const { unlink: unlink3 } = await import("fs/promises");
+      const { unlink: unlink4 } = await import("fs/promises");
       try {
-        await unlink3(filePath);
+        await unlink4(filePath);
       } catch (err) {
         if (err.code !== "ENOENT")
           throw err;
@@ -62954,17 +63316,17 @@ var init_acceptance_setup = __esm(() => {
     },
     deleteSemanticVerdicts: async (featureDir2) => {
       const dir = `${featureDir2}/semantic-verdicts`;
-      const { readdir: readdir2, unlink: unlink3 } = await import("fs/promises");
+      const { readdir: readdir3, unlink: unlink4 } = await import("fs/promises");
       let files;
       try {
-        files = await readdir2(dir);
+        files = await readdir3(dir);
       } catch (err) {
         if (err.code === "ENOENT")
           return;
         throw err;
       }
       for (const file3 of files) {
-        await unlink3(`${dir}/${file3}`);
+        await unlink4(`${dir}/${file3}`);
       }
     },
     readMeta: async (metaPath) => {
@@ -63405,7 +63767,7 @@ var init_constitution = __esm(() => {
 });
 
 // src/pipeline/stages/constitution.ts
-import { dirname as dirname11 } from "path";
+import { dirname as dirname12 } from "path";
 var constitutionStage;
 var init_constitution2 = __esm(() => {
   init_constitution();
@@ -63415,7 +63777,7 @@ var init_constitution2 = __esm(() => {
     enabled: (ctx) => ctx.config.constitution.enabled,
     async execute(ctx) {
       const logger = getLogger();
-      const ngentDir = ctx.featureDir ? dirname11(dirname11(ctx.featureDir)) : `${ctx.workdir}/nax`;
+      const ngentDir = ctx.featureDir ? dirname12(dirname12(ctx.featureDir)) : `${ctx.workdir}/nax`;
       const result = await loadConstitution(ngentDir, ctx.config.constitution);
       if (result) {
         ctx.constitution = result;
@@ -63594,7 +63956,7 @@ var init_story_context = __esm(() => {
 });
 
 // src/execution/lock.ts
-import { rename as rename2, unlink as unlink3 } from "fs/promises";
+import { rename as rename2, unlink as unlink4 } from "fs/promises";
 import path13 from "path";
 function getSafeLogger4() {
   try {
@@ -63658,7 +64020,7 @@ async function acquireLock(workdir) {
         }
         if (claimedPid !== lockPid) {
           const restored = claimedContent !== null && await tryExclusiveCreate(lockPath, claimedContent);
-          await unlink3(tombstonePath).catch(() => {});
+          await unlink4(tombstonePath).catch(() => {});
           if (!restored) {
             const logger2 = getSafeLogger4();
             logger2?.warn("execution", "Stolen lock could not be restored \u2014 a newer lock already exists", {
@@ -63671,7 +64033,7 @@ async function acquireLock(workdir) {
         logger?.warn("execution", "Removing stale lock", {
           pid: lockPid
         });
-        await unlink3(tombstonePath).catch(() => {});
+        await unlink4(tombstonePath).catch(() => {});
       }
     }
     const lockData = {
@@ -63697,7 +64059,7 @@ async function acquireLock(workdir) {
 async function releaseLock(workdir) {
   const lockPath = path13.join(workdir, "nax.lock");
   try {
-    await unlink3(lockPath);
+    await unlink4(lockPath);
   } catch (error48) {
     if (error48.code !== "ENOENT") {
       const logger = getSafeLogger4();
@@ -63718,7 +64080,7 @@ var init_helpers = __esm(() => {
 });
 
 // src/pipeline/stages/context.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import { join as join57 } from "path";
 async function runV2Path(ctx) {
   const logger = getLogger();
@@ -63957,7 +64319,7 @@ var init_context2 = __esm(() => {
     createOrchestrator: createDefaultOrchestrator,
     loadPlugins: loadPluginProviders,
     v1FeatureProvider: () => new FeatureContextProvider,
-    uuid: () => randomUUID5(),
+    uuid: () => randomUUID6(),
     readDigest: readDigestFile,
     writeDigest: writeDigestFile,
     loadFeatureManifests,
@@ -63986,23 +64348,30 @@ function spawnGit(deps, args, workdir) {
   });
 }
 async function spawnWithTimeout(proc, timeoutMs) {
-  const result = await Promise.race([
-    (async () => {
-      const [exitCode, stdout] = await Promise.all([
-        proc.exited,
-        new Response(proc.stdout).text(),
-        new Response(proc.stderr).text()
-      ]);
-      return { stdout, exitCode };
-    })(),
-    new Promise((resolve16) => setTimeout(() => {
-      try {
-        proc.kill("SIGKILL");
-      } catch {}
-      resolve16({ stdout: "", exitCode: 1 });
-    }, timeoutMs))
-  ]);
-  return result;
+  let timer;
+  try {
+    const result = await Promise.race([
+      (async () => {
+        const [exitCode, stdout] = await Promise.all([
+          proc.exited,
+          new Response(proc.stdout).text(),
+          new Response(proc.stderr).text()
+        ]);
+        return { stdout, exitCode };
+      })(),
+      new Promise((resolve16) => {
+        timer = setTimeout(() => {
+          try {
+            proc.kill("SIGKILL");
+          } catch {}
+          resolve16({ stdout: "", exitCode: 1 });
+        }, timeoutMs);
+      })
+    ]);
+    return result;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function captureFailureSentinel() {
   return `__capture_failed__:${Date.now()}:${Math.random().toString(36).slice(2)}`;
@@ -64076,7 +64445,7 @@ function buildCheckpointLogData(meta3) {
   const { storyId, ...rest } = meta3;
   return { storyId, ...rest };
 }
-var TREE_CAPTURE_TIMEOUT_MS = 75, MAX_UNTRACKED_HASHED = 500, UNTRACKED_HASH_TIMEOUT_MS = 250;
+var TREE_CAPTURE_TIMEOUT_MS = 1000, MAX_UNTRACKED_HASHED = 500, UNTRACKED_HASH_TIMEOUT_MS = 250;
 
 // src/tdd/rollback.ts
 import { rm as rm2 } from "fs/promises";
@@ -65605,7 +65974,19 @@ class ExecutionPlan {
         });
       } else {
         const currentTree = await _storyOrchestratorDeps.captureTreeState(this.ctx.packageDir);
-        await _storyOrchestratorDeps.recordGreen(this.ctx.storyId, name, currentTree);
+        try {
+          await _storyOrchestratorDeps.recordGreen(this.ctx.storyId, name, currentTree);
+        } catch (error48) {
+          if (error48 instanceof NaxError && error48.code === "CHECKPOINT_WRITE_FAILED") {
+            logger?.warn("story-orchestrator", "recordGreen failed \u2014 resume checkpoint lost, story verdict unaffected", {
+              storyId: this.ctx.storyId,
+              phase: name,
+              error: errorMessage(error48)
+            });
+          } else {
+            throw error48;
+          }
+        }
       }
     }
     const gateName = this.state.fullSuiteGate?.slot.op.name;
@@ -65789,6 +66170,7 @@ class ExecutionPlan {
   }
 }
 var init_execution_plan = __esm(() => {
+  init_errors();
   init_logger2();
   init_non_blocking_fix();
   init_phase_eval();
@@ -68221,12 +68603,12 @@ async function regenerateAcceptanceTest(testPath, acceptanceContext) {
   const content = await Bun.file(testPath).text();
   await Bun.write(bakPath, content);
   logger?.info("acceptance", `Backed up acceptance test -> ${bakPath}`);
-  const { unlink: unlink4 } = await import("fs/promises");
-  await unlink4(testPath);
+  const { unlink: unlink5 } = await import("fs/promises");
+  await unlink5(testPath);
   if (acceptanceContext.featureDir) {
     const metaPath = path14.join(acceptanceContext.featureDir, "acceptance-meta.json");
     try {
-      await unlink4(metaPath);
+      await unlink5(metaPath);
     } catch {}
   }
   let implementationContext;
@@ -68694,7 +69076,7 @@ var init_acceptance_loop = __esm(() => {
 
 // src/session/scratch-purge.ts
 import { mkdir as mkdir9, rename as rename3, rm as rm3 } from "fs/promises";
-import { dirname as dirname12, join as join63 } from "path";
+import { dirname as dirname13, join as join63 } from "path";
 async function purgeStaleScratch(projectDir, featureName, retentionDays, archiveInsteadOfDelete = false) {
   const sessionsDir = join63(featureDir(projectDir, featureName), "sessions");
   const sessionIds = await _scratchPurgeDeps.listSessionDirs(sessionsDir);
@@ -68746,7 +69128,7 @@ var init_scratch_purge = __esm(() => {
     readFile: (path15) => Bun.file(path15).text(),
     remove: (path15) => rm3(path15, { recursive: true, force: true }),
     move: async (src, dest) => {
-      await mkdir9(dirname12(dest), { recursive: true });
+      await mkdir9(dirname13(dest), { recursive: true });
       await rename3(src, dest);
     },
     now: () => Date.now()
@@ -69433,6 +69815,7 @@ async function handleRunCompletion(options) {
   clearLanguageCache();
   clearWorkspaceCache();
   clearGitRootCache();
+  _resetCanonicalRulesCache();
   const finalCounts = countStories(prd);
   const fallbackAggregate = deriveRunFallbackAggregates(allStoryMetrics);
   pipelineEventBus.emit({
@@ -69525,7 +69908,7 @@ async function handleRunCompletion(options) {
   });
   statusWriter.setPrd(prd);
   statusWriter.setCurrentStory(null);
-  statusWriter.setRunStatus(regressionGateFailed ? "failed" : exitReason === "cost-limit" ? "cost-limit" : isComplete(prd) ? "completed" : isStalled(prd, config2.execution.rectification?.maxAttemptsTotal) ? "stalled" : "running");
+  statusWriter.setRunStatus(regressionGateFailed ? "failed" : exitReason === "cost-limit" ? "cost-limit" : isComplete(prd) ? "completed" : isStalled(prd, config2.execution.rectification?.maxAttemptsTotal) ? "stalled" : "aborted");
   await statusWriter.update(reportedTotal, iterations);
   return {
     durationMs,
@@ -69978,9 +70361,9 @@ var init_ensure_package_dirs = __esm(() => {
   init_logger2();
   _ensurePackageDirsDeps = {
     exists: async (p) => {
-      const { stat: stat2 } = await import("fs/promises");
+      const { stat: stat4 } = await import("fs/promises");
       try {
-        return (await stat2(p)).isDirectory();
+        return (await stat4(p)).isDirectory();
       } catch {
         return false;
       }
@@ -69994,10 +70377,10 @@ var init_ensure_package_dirs = __esm(() => {
 
 // src/pipeline/subscribers/events-writer.ts
 import { appendFile as appendFile4, mkdir as mkdir10 } from "fs/promises";
-import { basename as basename12, join as join64 } from "path";
+import { basename as basename13, join as join64 } from "path";
 function wireEventsWriter(bus, feature, runId, workdir) {
   const logger = getSafeLogger();
-  const project = basename12(workdir);
+  const project = basename13(workdir);
   const eventsDir = join64(getEventsRootDir(), project);
   const eventsFile = join64(eventsDir, "events.jsonl");
   let dirReady = false;
@@ -70180,10 +70563,10 @@ var init_interaction2 = __esm(() => {
 
 // src/pipeline/subscribers/registry.ts
 import { mkdir as mkdir11, writeFile } from "fs/promises";
-import { basename as basename13, join as join65 } from "path";
+import { basename as basename14, join as join65 } from "path";
 function wireRegistry(bus, feature, runId, workdir, outputDir) {
   const logger = getSafeLogger();
-  const project = basename13(workdir);
+  const project = basename14(workdir);
   const runDir = join65(getRunsDir(), `${project}-${feature}-${runId}`);
   const metaFile = join65(runDir, "meta.json");
   const unsub = bus.on("run:started", (_ev) => {
@@ -71188,12 +71571,7 @@ ${missing.join(`
   }
   async hasWorktreeRecord(projectRoot, branchName) {
     try {
-      const proc = _managerDeps.spawn(["git", "worktree", "list", "--porcelain"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stdout] = await Promise.all([proc.exited, new Response(proc.stdout).text()]);
+      const { stdout, exitCode } = await gitWithTimeout(["worktree", "list", "--porcelain"], projectRoot);
       if (exitCode !== 0)
         return false;
       const targetBranch = `refs/heads/${branchName}`;
@@ -71209,12 +71587,7 @@ ${missing.join(`
     const branchName = `nax/${storyId}`;
     const hadWorktreeRecord = await this.hasWorktreeRecord(projectRoot, branchName);
     try {
-      const pruneProc = _managerDeps.spawn(["git", "worktree", "prune"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      await pruneProc.exited;
+      await gitWithTimeout(["worktree", "prune"], projectRoot);
     } catch {}
     let removedLiveWorktree = false;
     try {
@@ -71223,21 +71596,11 @@ ${missing.join(`
     } catch {}
     if (!removedLiveWorktree && hadWorktreeRecord) {
       try {
-        const branchProc = _managerDeps.spawn(["git", "branch", "-D", branchName], {
-          cwd: projectRoot,
-          stdout: "pipe",
-          stderr: "pipe"
-        });
-        await branchProc.exited;
+        await gitWithTimeout(["branch", "-D", branchName], projectRoot);
       } catch {}
     }
     try {
-      const proc = _managerDeps.spawn(["git", "worktree", "add", worktreePath, "-b", branchName], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
+      const { exitCode, stderr } = await gitWithTimeout(["worktree", "add", worktreePath, "-b", branchName], projectRoot);
       if (exitCode !== 0) {
         throw new NaxError(`Failed to create worktree: ${stderr || "unknown error"}`, "WORKTREE_ERROR", {
           stage: "worktree",
@@ -71292,12 +71655,7 @@ ${missing.join(`
     const worktreePath = join67(projectRoot, ".nax-wt", storyId);
     const branchName = `nax/${storyId}`;
     try {
-      const proc = _managerDeps.spawn(["git", "worktree", "remove", worktreePath, "--force"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
+      const { exitCode, stderr } = await gitWithTimeout(["worktree", "remove", worktreePath, "--force"], projectRoot);
       if (exitCode !== 0) {
         if (stderr.includes("not found") || stderr.includes("does not exist") || stderr.includes("no such worktree") || stderr.includes("is not a working tree")) {
           throw new NaxError(`Worktree not found: ${worktreePath}`, "WORKTREE_ERROR", {
@@ -71325,12 +71683,7 @@ ${missing.join(`
       });
     }
     try {
-      const proc = _managerDeps.spawn(["git", "branch", "-D", branchName], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
+      const { exitCode, stderr } = await gitWithTimeout(["branch", "-D", branchName], projectRoot);
       if (exitCode !== 0) {
         if (!stderr.includes("not found")) {
           const logger = getSafeLogger();
@@ -71346,16 +71699,7 @@ ${missing.join(`
   }
   async list(projectRoot) {
     try {
-      const proc = _managerDeps.spawn(["git", "worktree", "list", "--porcelain"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stderr, stdout] = await Promise.all([
-        proc.exited,
-        new Response(proc.stderr).text(),
-        new Response(proc.stdout).text()
-      ]);
+      const { stdout, stderr, exitCode } = await gitWithTimeout(["worktree", "list", "--porcelain"], projectRoot);
       if (exitCode !== 0) {
         throw new NaxError(`Failed to list worktrees: ${stderr || "unknown error"}`, "WORKTREE_ERROR", {
           stage: "worktree",
@@ -71398,16 +71742,12 @@ ${missing.join(`
     return worktrees;
   }
 }
-var _managerDeps;
 var init_manager3 = __esm(() => {
   init_errors();
   init_logger2();
   init_validate();
-  init_bun_deps();
+  init_git();
   init_gitignore();
-  _managerDeps = {
-    spawn
-  };
 });
 
 // src/execution/dry-run.ts
@@ -71467,12 +71807,8 @@ class MergeEngine {
     this.worktreeManager = worktreeManager;
   }
   async isMidMerge(projectRoot) {
-    const proc = _mergeDeps.spawn(["git", "rev-parse", "-q", "--verify", "MERGE_HEAD"], {
-      cwd: projectRoot,
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    return await proc.exited === 0;
+    const { exitCode } = await gitWithTimeout(["rev-parse", "-q", "--verify", "MERGE_HEAD"], projectRoot);
+    return exitCode === 0;
   }
   async merge(projectRoot, storyId) {
     const branchName = `nax/${storyId}`;
@@ -71485,16 +71821,7 @@ class MergeEngine {
         });
         return { success: false, failureKind: "error", error: error48 };
       }
-      const mergeProc = _mergeDeps.spawn(["git", "merge", "--no-ff", branchName, "-m", `Merge branch '${branchName}'`], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stderr, stdout] = await Promise.all([
-        mergeProc.exited,
-        new Response(mergeProc.stderr).text(),
-        new Response(mergeProc.stdout).text()
-      ]);
+      const { exitCode, stderr, stdout } = await gitWithTimeout(["merge", "--no-ff", branchName, "-m", `Merge branch '${branchName}'`], projectRoot);
       if (exitCode === 0) {
         try {
           await this.worktreeManager.remove(projectRoot, storyId);
@@ -71650,36 +71977,15 @@ ${stderr}`);
   async rebaseWorktree(projectRoot, storyId) {
     const worktreePath = `${projectRoot}/.nax-wt/${storyId}`;
     try {
-      const currentBranchProc = _mergeDeps.spawn(["git", "rev-parse", "--abbrev-ref", "HEAD"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, currentBranchRaw] = await Promise.all([
-        currentBranchProc.exited,
-        new Response(currentBranchProc.stdout).text()
-      ]);
+      const { exitCode, stdout: currentBranchRaw } = await gitWithTimeout(["rev-parse", "--abbrev-ref", "HEAD"], projectRoot);
       if (exitCode !== 0) {
         throw new Error("Failed to get current branch");
       }
       const currentBranch = currentBranchRaw.trim();
-      const rebaseProc = _mergeDeps.spawn(["git", "rebase", currentBranch], {
-        cwd: worktreePath,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [rebaseExitCode, rebaseStderr] = await Promise.all([
-        rebaseProc.exited,
-        new Response(rebaseProc.stderr).text()
-      ]);
+      const { exitCode: rebaseExitCode, stderr: rebaseStderr } = await gitWithTimeout(["rebase", currentBranch], worktreePath);
       if (rebaseExitCode !== 0) {
         const stderr = rebaseStderr;
-        const abortProc = _mergeDeps.spawn(["git", "rebase", "--abort"], {
-          cwd: worktreePath,
-          stdout: "pipe",
-          stderr: "pipe"
-        });
-        await abortProc.exited;
+        await gitWithTimeout(["rebase", "--abort"], worktreePath);
         throw new Error(`Rebase failed: ${stderr || "unknown error"}`);
       }
     } catch (error48) {
@@ -71691,12 +71997,7 @@ ${stderr}`);
   }
   async getConflictFiles(projectRoot) {
     try {
-      const proc = _mergeDeps.spawn(["git", "diff", "--name-only", "--diff-filter=U"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stdout] = await Promise.all([proc.exited, new Response(proc.stdout).text()]);
+      const { stdout, exitCode } = await gitWithTimeout(["diff", "--name-only", "--diff-filter=U"], projectRoot);
       if (exitCode !== 0) {
         return [];
       }
@@ -71708,12 +72009,7 @@ ${stderr}`);
   }
   async abortMerge(projectRoot) {
     try {
-      const proc = _mergeDeps.spawn(["git", "merge", "--abort"], {
-        cwd: projectRoot,
-        stdout: "pipe",
-        stderr: "pipe"
-      });
-      const [exitCode, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
+      const { exitCode, stderr } = await gitWithTimeout(["merge", "--abort"], projectRoot);
       if (exitCode !== 0) {
         getSafeLogger()?.error("worktree", "Failed to abort merge", {
           exitCode,
@@ -71730,20 +72026,15 @@ ${stderr}`);
     }
   }
 }
-var _mergeDeps;
 var init_merge = __esm(() => {
   init_logger2();
-  init_bun_deps();
-  _mergeDeps = {
-    spawn
-  };
+  init_git();
 });
 
 // src/worktree/index.ts
 var exports_worktree = {};
 __export(exports_worktree, {
   prepareWorktreeDependencies: () => prepareWorktreeDependencies,
-  _mergeDeps: () => _mergeDeps,
   WorktreeManager: () => WorktreeManager,
   WorktreeDependencyPreparationError: () => WorktreeDependencyPreparationError,
   MergeEngine: () => MergeEngine
@@ -72018,7 +72309,7 @@ async function removeWorktreeDirectory(projectRoot, storyId) {
       stdout: "pipe",
       stderr: "pipe"
     });
-    const [exitCode, stderr] = await Promise.all([
+    const [exitCode, stdout, stderr] = await Promise.all([
       proc.exited,
       new Response(proc.stdout).text().catch(() => ""),
       new Response(proc.stderr).text().catch(() => "")
@@ -73541,8 +73832,9 @@ function detectForge(remoteUrl) {
 async function hasOpenPr(forge, branch, deps, cwd) {
   const cmd = forge === "github" ? ["gh", "pr", "list", "--head", branch, "--state", "open", "--json", "number"] : ["glab", "mr", "list", "--source-branch", branch, "--state", "opened", "--output", "json"];
   const result = await deps.run(cmd, { cwd });
-  if (result.exitCode !== 0)
-    return false;
+  if (result.exitCode !== 0) {
+    throw new Error(`hasOpenPr: forge CLI exited with code ${result.exitCode}: ${result.stderr.trim()}`);
+  }
   try {
     const parsed = JSON.parse(result.stdout);
     return Array.isArray(parsed) && parsed.length > 0;
@@ -73790,12 +74082,27 @@ var init_template = __esm(() => {
 import * as path20 from "path";
 async function defaultRun(cmd, opts) {
   const proc = Bun.spawn(cmd, { cwd: opts.cwd, stdout: "pipe", stderr: "pipe" });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
-  return { exitCode, stdout, stderr };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SUBPROCESS_TIMEOUT_MS;
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    proc.kill();
+  }, timeoutMs);
+  try {
+    const [exitCode, stdout, stderr] = await Promise.all([
+      proc.exited,
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text()
+    ]);
+    return timedOut ? {
+      exitCode: exitCode === 0 ? 124 : exitCode,
+      stdout,
+      stderr: `${stderr}
+[auto-pr] command killed after ${timeoutMs}ms timeout`
+    } : { exitCode, stdout, stderr };
+  } finally {
+    clearTimeout(timer);
+  }
 }
 async function defaultReadText(path21) {
   const file3 = Bun.file(path21);
@@ -73845,7 +74152,7 @@ function toPrBodyContext(context) {
     stories: context.stories
   };
 }
-var PLUGIN_NAME = "nax-auto-pr", PLUGIN_VERSION = "0.1.0", GIT_REMOTE_CMD, _autoPrDeps, autoPrAction, autoPrPlugin;
+var PLUGIN_NAME = "nax-auto-pr", PLUGIN_VERSION = "0.1.0", GIT_REMOTE_CMD, DEFAULT_SUBPROCESS_TIMEOUT_MS = 30000, _autoPrDeps, autoPrAction, autoPrPlugin;
 var init_auto_pr = __esm(() => {
   init_forge();
   init_pr_body();
@@ -73911,6 +74218,23 @@ var init_auto_pr = __esm(() => {
           const message = pushResult.stderr.trim() || `git push exited with code ${pushResult.exitCode}`;
           return { success: false, message: `Failed to push branch "${context.branch}" to origin: ${message}` };
         }
+        let existsAfterPush = false;
+        try {
+          existsAfterPush = await _autoPrDeps.hasOpenPr(forge, context.branch, { run: _autoPrDeps.run, readText: _autoPrDeps.readText }, context.workdir);
+        } catch (checkErr) {
+          context.logger.warn("Auto-PR re-check inconclusive \u2014 skipping to avoid duplicate PR", {
+            branch: context.branch,
+            error: String(checkErr)
+          });
+          return { success: false, message: `Auto-PR skipped: re-check inconclusive (${String(checkErr)})` };
+        }
+        if (existsAfterPush) {
+          context.logger.warn("Auto-PR skipped \u2014 open PR/MR appeared during push (concurrent run?)", {
+            branch: context.branch,
+            forge
+          });
+          return { success: false, message: `Open PR/MR already exists for branch "${context.branch}"` };
+        }
         const template = await _autoPrDeps.findPrTemplate(context.workdir, forge, {
           run: _autoPrDeps.run,
           readText: _autoPrDeps.readText
@@ -74157,8 +74481,8 @@ async function writtenThisRun(filePath, runStartedAt) {
   if (runStartedAt === undefined)
     return true;
   try {
-    const stat2 = await Bun.file(filePath).stat();
-    return stat2.mtimeMs >= runStartedAt;
+    const stat4 = await Bun.file(filePath).stat();
+    return stat4.mtimeMs >= runStartedAt;
   } catch {
     return true;
   }
@@ -75168,14 +75492,23 @@ function buildEscalationMessage(feature, reason, findings) {
 \u2026and ${omitted} more` : ""}`;
 }
 async function sendTelegramNotify(cfg, text) {
-  const res = await _telegramDeps.fetch(`https://api.telegram.org/bot${cfg.token}/sendMessage`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ chat_id: cfg.chatId, text })
-  });
-  return res.ok;
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), NOTIFY_FETCH_TIMEOUT_MS);
+  try {
+    const res = await _telegramDeps.fetch(`https://api.telegram.org/bot${cfg.token}/sendMessage`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ chat_id: cfg.chatId, text }),
+      signal: controller.signal
+    });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
 }
-var TELEGRAM_MAX_MESSAGE_CHARS = 4096, MAX_FINDING_TITLE_CHARS = 120, _telegramDeps;
+var TELEGRAM_MAX_MESSAGE_CHARS = 4096, MAX_FINDING_TITLE_CHARS = 120, _telegramDeps, NOTIFY_FETCH_TIMEOUT_MS = 5000;
 var init_telegram2 = __esm(() => {
   _telegramDeps = { fetch: (...a) => fetch(...a) };
 });
@@ -75410,6 +75743,8 @@ var PLUGIN_NAME4 = "nax-finish", PLUGIN_VERSION4 = "0.1.0", PACKAGE_ROOT_SEARCH_
 var init_nax_finish = __esm(() => {
   init_config2();
   init_telegram2();
+  init_telegram2();
+  init_telegram2();
   _naxFinishDeps = {
     run: defaultRun2,
     readResult: defaultReadResult,
@@ -75511,6 +75846,7 @@ function createBatchQueue(opts) {
   let overflowing = false;
   let tornDown = false;
   let timer;
+  const inFlightSends = new Set;
   const armTimer = () => {
     timer = setTimeout(() => {
       doFlush();
@@ -75534,7 +75870,8 @@ function createBatchQueue(opts) {
       return Promise.resolve();
     const batch = queue;
     queue = [];
-    sendWithRetry(batch);
+    const sendPromise = sendWithRetry(batch).finally(() => inFlightSends.delete(sendPromise));
+    inFlightSends.add(sendPromise);
     return Promise.resolve();
   };
   const enqueue = (item) => {
@@ -75556,7 +75893,10 @@ function createBatchQueue(opts) {
   armTimer();
   return {
     enqueue,
-    flushNow: () => doFlush(),
+    flushNow: async () => {
+      await doFlush();
+      await Promise.all(inFlightSends);
+    },
     teardown: () => {
       tornDown = true;
       if (timer !== undefined)
@@ -76812,11 +77152,11 @@ function getSafeLogger6() {
   return getSafeLogger();
 }
 function extractPluginName(pluginPath) {
-  const basename15 = path25.basename(pluginPath);
-  if (basename15 === "index.ts" || basename15 === "index.js" || basename15 === "index.mjs") {
+  const basename16 = path25.basename(pluginPath);
+  if (basename16 === "index.ts" || basename16 === "index.js" || basename16 === "index.mjs") {
     return path25.basename(path25.dirname(pluginPath));
   }
-  return basename15.replace(/\.(ts|js|mjs)$/, "");
+  return basename16.replace(/\.(ts|js|mjs)$/, "");
 }
 async function loadPlugins(globalDir, projectDir, configPlugins, projectRoot, disabledPlugins, isTestFileFn, reporters) {
   const loadedPlugins = [];
@@ -77087,7 +77427,7 @@ var init_loader4 = __esm(() => {
 });
 
 // src/execution/status-file.ts
-import { rename as rename4, unlink as unlink4 } from "fs/promises";
+import { rename as rename4, unlink as unlink5 } from "fs/promises";
 import { resolve as resolve20 } from "path";
 function countProgress(prd) {
   const stories = prd.userStories;
@@ -77139,7 +77479,7 @@ async function writeStatusFile(filePath, status) {
   }
   const tmpPath = `${resolvedPath}.tmp`;
   try {
-    await unlink4(tmpPath);
+    await unlink5(tmpPath);
   } catch {}
   await Bun.write(tmpPath, JSON.stringify(status, null, 2));
   await rename4(tmpPath, resolvedPath);
@@ -77300,7 +77640,7 @@ __export(exports_init_context, {
   generatePackageContextTemplate: () => generatePackageContextTemplate,
   generateContextTemplate: () => generateContextTemplate
 });
-import { basename as basename15, join as join78 } from "path";
+import { basename as basename16, join as join78 } from "path";
 async function bunFileExists(path26) {
   return Bun.file(path26).exists();
 }
@@ -77395,7 +77735,7 @@ async function scanProject(projectRoot) {
   const readmeSnippet = await readReadmeSnippet(projectRoot);
   const entryPoints = await detectEntryPoints(projectRoot);
   const configFiles = await detectConfigFiles(projectRoot);
-  const projectName = packageManifest?.name || basename15(projectRoot);
+  const projectName = packageManifest?.name || basename16(projectRoot);
   return {
     projectName,
     fileTree,
@@ -78059,7 +78399,7 @@ __export(exports_migrate, {
   detectGeneratedContent: () => detectGeneratedContent
 });
 import { existsSync as existsSync25 } from "fs";
-import { mkdir as mkdir16, readdir as readdir3, rename as rename5 } from "fs/promises";
+import { mkdir as mkdir16, readdir as readdir4, rename as rename5 } from "fs/promises";
 import path26 from "path";
 async function detectGeneratedContent(naxDir) {
   if (!existsSync25(naxDir))
@@ -78067,7 +78407,7 @@ async function detectGeneratedContent(naxDir) {
   const candidates = [];
   let entries = [];
   try {
-    entries = await readdir3(naxDir);
+    entries = await readdir4(naxDir);
   } catch {
     return [];
   }
@@ -78080,13 +78420,13 @@ async function detectGeneratedContent(naxDir) {
   if (existsSync25(featuresDir2)) {
     let featureDirs = [];
     try {
-      featureDirs = await readdir3(featuresDir2);
+      featureDirs = await readdir4(featuresDir2);
     } catch {}
     for (const fid of featureDirs) {
       const featureDir2 = path26.join(featuresDir2, fid);
       let subEntries = [];
       try {
-        subEntries = await readdir3(featureDir2);
+        subEntries = await readdir4(featureDir2);
       } catch {
         continue;
       }
@@ -78101,7 +78441,7 @@ async function detectGeneratedContent(naxDir) {
           const storiesDir = path26.join(featureDir2, "stories");
           let storyDirs = [];
           try {
-            storyDirs = await readdir3(storiesDir);
+            storyDirs = await readdir4(storiesDir);
           } catch {
             continue;
           }
@@ -78109,7 +78449,7 @@ async function detectGeneratedContent(naxDir) {
             const storyDir = path26.join(storiesDir, sid);
             let storyEntries = [];
             try {
-              storyEntries = await readdir3(storyDir);
+              storyEntries = await readdir4(storyDir);
             } catch {
               continue;
             }
@@ -78877,6 +79217,7 @@ async function setupRun(options) {
   if (!lockAcquired) {
     logger?.error("execution", "Another nax process is already running in this directory");
     logger?.error("execution", "If you believe this is an error, remove nax.lock manually");
+    cleanupCrashHandlers();
     throw new LockAcquisitionError(workdir);
   }
   try {
@@ -79477,19 +79818,19 @@ function parseQueueFile(content) {
 var init_queue = () => {};
 
 // src/utils/queue-file-lock.ts
-import { randomUUID as randomUUID6 } from "crypto";
-import { open, readdir as readdir4, stat as stat2, unlink as unlink5 } from "fs/promises";
-import { basename as basename16, dirname as dirname17 } from "path";
-function buildCandidatePath(queuePath) {
-  const time3 = _queueLockDeps.now().toString().padStart(LOCK_TIME_WIDTH, "0");
+import { randomUUID as randomUUID7 } from "crypto";
+import { open as open2, readdir as readdir5, stat as stat4, unlink as unlink6 } from "fs/promises";
+import { basename as basename17, dirname as dirname18 } from "path";
+function buildCandidatePath2(queuePath) {
+  const time3 = _queueLockDeps.now().toString().padStart(LOCK_TIME_WIDTH2, "0");
   return `${queuePath}.lock.${time3}.${process.pid}.${_queueLockDeps.randomUUID()}`;
 }
-function candidatePid(fileName) {
+function candidatePid2(fileName) {
   const segments = fileName.split(".");
   const pid = Number(segments.at(-2));
   return Number.isInteger(pid) && pid > 0 ? pid : null;
 }
-function candidateTime(fileName) {
+function candidateTime2(fileName) {
   const segments = fileName.split(".");
   try {
     const timestamp = Number(segments.at(-3));
@@ -79505,14 +79846,14 @@ function isLiveCandidate(pid, createdAt) {
     return false;
   return _queueLockDeps.isPidAlive(pid);
 }
-async function listLiveCandidates(queuePath) {
-  const directory = dirname17(queuePath);
-  const prefix = `${basename16(queuePath)}.lock.`;
+async function listLiveCandidates2(queuePath) {
+  const directory = dirname18(queuePath);
+  const prefix = `${basename17(queuePath)}.lock.`;
   const candidates = (await _queueLockDeps.readdir(directory)).filter((name) => name.startsWith(prefix));
   const live = [];
   for (const candidate of candidates) {
-    const pid = candidatePid(candidate);
-    const createdAt = candidateTime(candidate);
+    const pid = candidatePid2(candidate);
+    const createdAt = candidateTime2(candidate);
     const candidatePath = `${directory}/${candidate}`;
     if (isLiveCandidate(pid, createdAt)) {
       const stats = await _queueLockDeps.stat(candidatePath).catch(() => null);
@@ -79523,14 +79864,14 @@ async function listLiveCandidates(queuePath) {
   }
   return live.sort((a, b) => a.createdAt - b.createdAt || a.name.localeCompare(b.name)).map(({ name }) => name);
 }
-async function acquire(queuePath) {
-  const candidatePath = buildCandidatePath(queuePath);
+async function acquire2(queuePath) {
+  const candidatePath = buildCandidatePath2(queuePath);
   const handle = await _queueLockDeps.open(candidatePath, "wx");
   await handle.close();
   const deadline = Date.now() + LOCK_TIMEOUT_MS;
   while (Date.now() < deadline) {
-    const candidates = await listLiveCandidates(queuePath);
-    if (candidates[0] === basename16(candidatePath)) {
+    const candidates = await listLiveCandidates2(queuePath);
+    if (candidates[0] === basename17(candidatePath)) {
       return () => _queueLockDeps.unlink(candidatePath).catch(() => {});
     }
     await _queueLockDeps.sleep(LOCK_RETRY_MS);
@@ -79539,21 +79880,21 @@ async function acquire(queuePath) {
   throw new Error(`[queue] Timed out acquiring queue lock: ${queuePath}`);
 }
 async function withQueueFileLock(queuePath, operation) {
-  const release = await acquire(queuePath);
+  const release = await acquire2(queuePath);
   try {
     return await operation();
   } finally {
     await release();
   }
 }
-var LOCK_RETRY_MS = 10, LOCK_TIMEOUT_MS = 5000, LOCK_TIME_WIDTH = 13, _queueLockDeps;
+var LOCK_RETRY_MS = 10, LOCK_TIMEOUT_MS = 5000, LOCK_TIME_WIDTH2 = 13, _queueLockDeps;
 var init_queue_file_lock = __esm(() => {
   _queueLockDeps = {
-    open,
-    readdir: readdir4,
-    stat: stat2,
-    unlink: unlink5,
-    randomUUID: randomUUID6,
+    open: open2,
+    readdir: readdir5,
+    stat: stat4,
+    unlink: unlink6,
+    randomUUID: randomUUID7,
     now: () => Date.now(),
     sleep: (ms) => new Promise((resolve21) => setTimeout(resolve21, ms)),
     isPidAlive: isProcessAlive
@@ -79561,7 +79902,7 @@ var init_queue_file_lock = __esm(() => {
 });
 
 // src/execution/queue-handler.ts
-import { rename as rename6, unlink as unlink6 } from "fs/promises";
+import { rename as rename6, unlink as unlink7 } from "fs/promises";
 import path29 from "path";
 function getSafeLogger7() {
   try {
@@ -79619,7 +79960,12 @@ async function processQueueFile(workdir, processor) {
       if (commands === null)
         return;
       const result = await processor(commands);
-      await unlink6(processingPath).catch(() => {});
+      await unlink7(processingPath).catch((error48) => {
+        logger?.warn("queue", "Failed to clear processed queue file \u2014 next run may re-apply this batch", {
+          error: error48.message,
+          processingPath
+        });
+      });
       return result;
     });
   } catch (error48) {
@@ -79638,7 +79984,7 @@ async function clearQueueFile(workdir) {
     await withQueueFileLock(queuePath, async () => {
       const file3 = Bun.file(processingPath);
       if (await file3.exists())
-        await unlink6(processingPath);
+        await unlink7(processingPath);
     });
   } catch (error48) {
     logger?.warn("queue", "Failed to clear queue file", {
@@ -80652,18 +80998,17 @@ async function runSetupGate(workdir, config2) {
     return 0;
   }
   logger.info("setup-verify", "Running verification gate", { storyId: "setup", cmd: testCmd });
-  const parts = testCmd.trim().split(/\s+/).filter(Boolean);
-  if (parts.length === 0)
-    return 0;
-  const proc = _setupVerifyDeps.spawn(parts, { cwd: workdir });
-  return await proc.exited;
+  const result = await runQualityCommand({
+    commandName: "setup-verify",
+    command: testCmd,
+    workdir,
+    storyId: "setup"
+  });
+  return result.exitCode;
 }
-var _setupVerifyDeps;
 var init_setup_verify = __esm(() => {
   init_logger2();
-  _setupVerifyDeps = {
-    spawn: Bun.spawn.bind(Bun)
-  };
+  init_runner();
 });
 
 // src/cli/setup-write.ts
@@ -110155,7 +110500,7 @@ var MAX_WORKTREE_ID_LENGTH = 64, HASH_SUFFIX_LENGTH = 8;
 var init_worktree_id = () => {};
 
 // src/bakeoff/contestant.ts
-import { basename as basename21, join as join111 } from "path";
+import { basename as basename22, join as join111 } from "path";
 function aggregateTotals(metrics) {
   let costUsd = 0;
   let wallTimeMs = 0;
@@ -110185,7 +110530,7 @@ async function runContestant(agent, options, deps) {
     }
   };
   const worktree = join111(options.projectRoot, ".nax-wt", storyId);
-  const projectKey = options.config.name?.trim() || basename21(options.projectRoot);
+  const projectKey = options.config.name?.trim() || basename22(options.projectRoot);
   const outputDir = join111(projectOutputDir(projectKey, options.outputDir), "bakeoff", feature, agent);
   const context = {
     profile: agent,
@@ -110512,7 +110857,7 @@ var init_bakeoff = __esm(() => {
 });
 
 // src/plugins/builtin/curator/rollup-prune.ts
-import { rename as rename7, unlink as unlink8, writeFile as writeFile3 } from "fs/promises";
+import { rename as rename7, unlink as unlink9, writeFile as writeFile3 } from "fs/promises";
 import { appendFile as appendFile7 } from "fs/promises";
 async function scanProjectRunIds(rollupPath, projectKey) {
   const maxTsByRunId = new Map;
@@ -110583,7 +110928,7 @@ async function pruneRollup(input) {
     await flush();
     await rename7(tmpPath, rollupPath);
   } catch (err) {
-    await unlink8(tmpPath).catch(() => {});
+    await unlink9(tmpPath).catch(() => {});
     throw err;
   }
   return result2;
@@ -110604,7 +110949,7 @@ __export(exports_curator, {
   _curatorCmdDeps: () => _curatorCmdDeps
 });
 import { readdirSync as readdirSync9 } from "fs";
-import { unlink as unlink9 } from "fs/promises";
+import { unlink as unlink10 } from "fs/promises";
 import { join as join114, resolve as resolve23, sep as sep9 } from "path";
 function listRunIds(runsDir) {
   try {
@@ -110969,7 +111314,7 @@ var init_curator2 = __esm(() => {
     },
     removeFile: async (p) => {
       try {
-        await unlink9(p);
+        await unlink10(p);
       } catch {}
     },
     openInEditor: async (filePath) => {
@@ -110988,7 +111333,7 @@ var init_curator2 = __esm(() => {
 init_source();
 import { existsSync as existsSync41, mkdirSync as mkdirSync8 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename23, join as join115 } from "path";
+import { basename as basename24, join as join115 } from "path";
 
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
@@ -111666,12 +112011,12 @@ init_errors();
 init_logger2();
 init_runtime();
 import { existsSync as existsSync18, readdirSync as readdirSync4 } from "fs";
-import { basename as basename11, join as join52 } from "path";
+import { basename as basename12, join as join52 } from "path";
 async function resolveOutputDir(workdir, override) {
   if (override)
     return override;
   const config2 = await loadConfig(workdir).catch(() => null);
-  const projectKey = config2?.name?.trim() || basename11(workdir);
+  const projectKey = config2?.name?.trim() || basename12(workdir);
   return projectOutputDir(projectKey, config2?.outputDir);
 }
 async function parseRunLog(logPath) {
@@ -113379,7 +113724,7 @@ async function rulesLintCommand(options, deps = _rulesLintDeps) {
 // src/cli/rules-migrate.ts
 init_canonical_loader();
 init_errors();
-import { basename as basename18, join as join96 } from "path";
+import { basename as basename19, join as join96 } from "path";
 
 // src/cli/rules-migrate-plan.ts
 init_errors();
@@ -113458,7 +113803,7 @@ async function collectMigrationSources(workdir) {
     try {
       const content = await _rulesCLIDeps.readFile(filePath);
       if (content.trim()) {
-        sources.push({ sourcePath: filePath, targetFileName: basename18(filePath), content });
+        sources.push({ sourcePath: filePath, targetFileName: basename19(filePath), content });
       }
     } catch {}
   }
@@ -113959,7 +114304,7 @@ init_runtime();
 init_json_file();
 init_routing();
 import { mkdirSync as mkdirSync7 } from "fs";
-import { basename as basename19, join as join100 } from "path";
+import { basename as basename20, join as join100 } from "path";
 var _routingCalibrateDeps = {
   loadRunMetrics: (outputDir) => loadRunMetrics(outputDir),
   readConfig: (workdir) => loadConfig(workdir),
@@ -114017,7 +114362,7 @@ async function runRoutingCalibrateCli(options, deps = _routingCalibrateDeps) {
 function resolveOutputDir2(workdir, override, prior) {
   if (override)
     return override;
-  const key = prior?.name?.trim() || basename19(workdir);
+  const key = prior?.name?.trim() || basename20(workdir);
   return projectOutputDir(key, prior?.outputDir);
 }
 function mergeComplexityRouting(prior, adjustments) {
@@ -114291,7 +114636,7 @@ import { join as join103 } from "path";
 // src/commands/logs-reader.ts
 init_paths3();
 import { existsSync as existsSync35, readdirSync as readdirSync7 } from "fs";
-import { readdir as readdir5 } from "fs/promises";
+import { readdir as readdir6 } from "fs/promises";
 import { join as join102 } from "path";
 var _logsReaderDeps = {
   getRunsDir
@@ -114300,7 +114645,7 @@ async function resolveRunFileFromRegistry(runId) {
   const runsDir = _logsReaderDeps.getRunsDir();
   let entries;
   try {
-    entries = await readdir5(runsDir);
+    entries = await readdir6(runsDir);
   } catch {
     throw new Error(`Run not found in registry: ${runId}`);
   }
@@ -114622,12 +114967,12 @@ async function precheckCommand(options) {
 init_errors();
 init_metrics();
 import { existsSync as existsSync38 } from "fs";
-import { dirname as dirname18 } from "path";
+import { dirname as dirname19 } from "path";
 
 // src/replay/discovery.ts
 init_errors();
 init_paths3();
-import { readdir as readdir6 } from "fs/promises";
+import { readdir as readdir7 } from "fs/promises";
 import { join as join106 } from "path";
 var _discoveryDeps = {
   getRunsDir
@@ -114635,7 +114980,7 @@ var _discoveryDeps = {
 async function loadMetas(runsDir) {
   let entries;
   try {
-    entries = await readdir6(runsDir);
+    entries = await readdir7(runsDir);
   } catch {
     return [];
   }
@@ -114935,7 +115280,7 @@ async function readJsonOrUndefined(path32) {
 }
 async function readMetricsFromProject(meta3) {
   const { loadRunMetrics: loadRunMetrics2 } = await Promise.resolve().then(() => (init_tracker(), exports_tracker));
-  const outputDir = dirname18(dirname18(dirname18(meta3.eventsDir)));
+  const outputDir = dirname19(dirname19(dirname19(meta3.eventsDir)));
   const all = await loadRunMetrics2(outputDir);
   return all.find((m) => m.runId === meta3.runId);
 }
@@ -115018,7 +115363,7 @@ init_errors();
 init_checkpoint();
 init_runtime();
 import { existsSync as existsSync39 } from "fs";
-import { basename as basename20, join as join107 } from "path";
+import { basename as basename21, join as join107 } from "path";
 async function defaultCheckpointExists(featureDir2) {
   if (!featureDir2 || !existsSync39(featureDir2))
     return false;
@@ -115098,7 +115443,7 @@ function registerResumeCommand(program2) {
         const globalNaxDir = globalConfigDir();
         const hooks = await loadHooksConfig2(naxDir, globalNaxDir);
         applyResumeModeDeps2(opts.featureDir ?? "", "auto");
-        const projectKey = config2.name?.trim() || basename20(cmdOpts.dir);
+        const projectKey = config2.name?.trim() || basename21(cmdOpts.dir);
         const outputDir = projectOutputDir(projectKey, config2.outputDir);
         const statusFilePath = join107(outputDir, "status.json");
         const runsDir = join107(outputDir, "features", feature, "runs");
@@ -115139,7 +115484,7 @@ function registerResumeCommand(program2) {
 // src/commands/runs.ts
 init_source();
 init_paths3();
-import { readdir as readdir7 } from "fs/promises";
+import { readdir as readdir8 } from "fs/promises";
 import { join as join108 } from "path";
 var DEFAULT_LIMIT = 20;
 var _runsCmdDeps = {
@@ -115190,7 +115535,7 @@ async function runsCommand(options = {}) {
   const runsDir = _runsCmdDeps.getRunsDir();
   let entries;
   try {
-    entries = await readdir7(runsDir);
+    entries = await readdir8(runsDir);
   } catch {
     console.log("No runs found.");
     return;
@@ -115274,7 +115619,7 @@ async function runsCommand(options = {}) {
 
 // src/commands/unlock.ts
 init_source();
-import { unlink as unlink7 } from "fs/promises";
+import { unlink as unlink8 } from "fs/promises";
 import { join as join109 } from "path";
 function formatLockAge(ageMs) {
   const minutes = Math.round(ageMs / (60 * 1000));
@@ -115321,7 +115666,7 @@ async function unlockCommand(options) {
     }
   }
   try {
-    await unlink7(lockPath);
+    await unlink8(lockPath);
   } catch (error48) {
     console.error(source_default.red(`Failed to remove lock: ${error48 instanceof Error ? error48.message : String(error48)}`));
     process.exit(1);
@@ -123561,7 +123906,7 @@ program2.command("run").description("Run the orchestration loop for a feature").
     process.exit(1);
   }
   resetLogger();
-  const projectKey = config2.name?.trim() || basename23(workdir);
+  const projectKey = config2.name?.trim() || basename24(workdir);
   const outputDir = projectOutputDir(projectKey, config2.outputDir);
   const runsDir = join115(outputDir, "features", options.feature, "runs");
   mkdirSync8(runsDir, { recursive: true });