@nathapp/nax 0.83.6 → 0.84.0

package/dist/nax.js

@@ -322,6 +322,31 @@ var init_approval_audit = __esm(() => {
   init_secret_spans();
 });
 
+// ../nax-agent/src/internal/atomic-write.ts
+import { randomUUID } from "crypto";
+import { rename, rm, writeFile } from "fs/promises";
+async function writeFileAtomic(path, content, options = {}) {
+  const staged = `${path}.${randomUUID()}.tmp`;
+  try {
+    await _atomicWriteDeps.writeFile(staged, content, {
+      encoding: "utf8",
+      ...options.mode !== undefined ? { mode: options.mode } : {}
+    });
+    await _atomicWriteDeps.rename(staged, path);
+  } catch (error) {
+    await _atomicWriteDeps.rm(staged, { force: true });
+    throw error;
+  }
+}
+var _atomicWriteDeps;
+var init_atomic_write = __esm(() => {
+  _atomicWriteDeps = {
+    writeFile: (path, content, options) => writeFile(path, content, options),
+    rename,
+    rm
+  };
+});
+
 // ../nax-agent/src/internal/process-alive.ts
 function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0)
@@ -335,7 +360,7 @@ function isProcessAlive(pid) {
 }
 
 // ../nax-agent/src/internal/file-lock.ts
-import { readFile, stat, unlink, writeFile } from "fs/promises";
+import { readFile, stat, unlink, writeFile as writeFile2 } from "fs/promises";
 function unlinkQuiet(path) {
   return _fileLockDeps.unlink(path).catch(() => {});
 }
@@ -428,7 +453,7 @@ var DEFAULT_RETRY_MS = 10, DEFAULT_TIMEOUT_MS = 5000, EMPTY_LOCK_EVICT_AGE_MS =
 var init_file_lock = __esm(() => {
   init_infra();
   _fileLockDeps = {
-    writeFile,
+    writeFile: writeFile2,
     readFile,
     stat,
     unlink,
@@ -453,7 +478,7 @@ var init_path_file_lock = __esm(() => {
 
 // ../nax-agent/src/permissions/approvals-store.ts
 import { createHash } from "crypto";
-import { mkdir as mkdir2, readFile as readFile2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile2, stat as stat2 } from "fs/promises";
 import { dirname, isAbsolute, join as join2, relative, resolve } from "path";
 function approvalsPath(outputDir) {
   return join2(outputDir, "approvals.json");
@@ -529,14 +554,20 @@ async function readApprovals(path) {
 async function writeApprovalsFile(path, file) {
   const body = file.taint === undefined ? { entries: file.entries } : { taint: file.taint, entries: file.entries };
   await mkdir2(dirname(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(body, null, 2)}
-`, "utf8");
+  await writeFileAtomic(path, `${JSON.stringify(body, null, 2)}
+`);
 }
 async function appendApproval(path, entry) {
   await mkdir2(dirname(path), { recursive: true });
   await withPathFileLock(path, async () => {
-    const existing = await readApprovalsFile(path);
-    await writeApprovalsFile(path, { taint: existing.taint, entries: [...existing.entries, entry] });
+    const read = await readApprovalsFileDetailed(path);
+    if (read.state === "unparseable") {
+      throw new NaxError("approvals.json could not be parsed; not rewriting it", "APPROVALS_STORE_UNPARSEABLE", {
+        stage: "permissions",
+        path
+      });
+    }
+    await writeApprovalsFile(path, { taint: read.file.taint, entries: [...read.file.entries, entry] });
   });
 }
 async function applyRemoval(path, decide) {
@@ -587,6 +618,8 @@ function isWithin(projectRoot, root) {
 }
 var EMPTY_FILE;
 var init_approvals_store = __esm(() => {
+  init_infra();
+  init_atomic_write();
   init_path_file_lock();
   EMPTY_FILE = { entries: [], taint: undefined };
 });
@@ -2165,6 +2198,266 @@ function killProcessGroup(pid, signal) {
   }
 }
 
+// ../nax-agent/src/terminal-auth/open-url.ts
+import { spawn } from "child_process";
+function spawnDetached(command) {
+  const [file, ...args] = command;
+  const child = spawn(file ?? "", args, { stdio: "ignore", detached: true, windowsHide: true });
+  child.on("error", () => {});
+  child.unref();
+  return child;
+}
+function openerFor(platform, url) {
+  if (platform === "darwin")
+    return ["open", url];
+  if (platform === "win32")
+    return ["cmd", "/c", "start", "", url];
+  return ["xdg-open", url];
+}
+function openUrl(url) {
+  try {
+    _openUrlDeps.spawn(openerFor(_openUrlDeps.platform(), url));
+  } catch {}
+}
+var _openUrlDeps;
+var init_open_url = __esm(() => {
+  _openUrlDeps = {
+    spawn: (command) => {
+      spawnDetached(command);
+    },
+    platform: () => process.platform
+  };
+});
+
+// ../nax-agent/src/terminal-auth/prompt.ts
+function stdinOf() {
+  return _terminalPromptDeps.stdin ?? process.stdin;
+}
+function keyAction(char, bufferEmpty, hasEmptyHook) {
+  if (char === ETX || char === EOT)
+    return { kind: "cancel" };
+  if (char === CR || char === LF) {
+    return bufferEmpty && hasEmptyHook ? { kind: "empty-submit" } : { kind: "submit" };
+  }
+  if (char === BACKSPACE)
+    return { kind: "erase" };
+  return { kind: "append" };
+}
+function applyEdit(action, char, buffer, echo, onEmptySubmit) {
+  if (action.kind === "empty-submit") {
+    onEmptySubmit?.();
+    return buffer;
+  }
+  if (action.kind === "erase") {
+    if (echo)
+      _terminalPromptDeps.write("\b \b");
+    return buffer.slice(0, -1);
+  }
+  if (echo)
+    _terminalPromptDeps.write(char);
+  return buffer + char;
+}
+function read(message, echo, onEmptySubmit, style) {
+  const stdin = stdinOf();
+  if (stdin.isTTY !== true)
+    return Promise.reject(new PromptCancelledError);
+  _terminalPromptDeps.write(`${style.accent("?")} ${message} `);
+  return new Promise((resolve3, reject) => {
+    let buffer = "";
+    let settled = false;
+    const cleanup = () => {
+      if (settled)
+        return;
+      settled = true;
+      stdin.removeListener("data", onData);
+      stdin.removeListener("end", onEnd);
+      stdin.removeListener("error", onEnd);
+      stdin.setRawMode(false);
+      stdin.pause();
+      _terminalPromptDeps.write(`
+`);
+    };
+    const onEnd = () => {
+      cleanup();
+      reject(new PromptCancelledError);
+    };
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        const action = keyAction(char, buffer.length === 0, onEmptySubmit !== undefined);
+        if (action.kind === "cancel") {
+          onEnd();
+          return;
+        }
+        if (action.kind === "submit") {
+          cleanup();
+          resolve3(buffer);
+          return;
+        }
+        buffer = applyEdit(action, char, buffer, echo, onEmptySubmit);
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+    stdin.once("end", onEnd);
+    stdin.once("error", onEnd);
+  });
+}
+function promptForSecret(message, style = PLAIN_STYLE) {
+  return read(message, false, undefined, style);
+}
+function promptForLine(message, onEmptySubmit, style = PLAIN_STYLE) {
+  return read(message, true, onEmptySubmit, style);
+}
+function promptForSelect(message, choices, style = PLAIN_STYLE) {
+  const stdin = stdinOf();
+  if (stdin.isTTY !== true)
+    return Promise.reject(new PromptCancelledError);
+  if (choices.length === 0)
+    return Promise.reject(new PromptCancelledError);
+  _terminalPromptDeps.write(`${style.accent("?")} ${message}
+`);
+  return new Promise((resolve3, reject) => {
+    let index = 0;
+    let settled = false;
+    let drawn = false;
+    const render = () => {
+      if (drawn)
+        _terminalPromptDeps.write(`\x1B[${choices.length}A`);
+      drawn = true;
+      for (const [i, choice] of choices.entries()) {
+        const active = i === index;
+        const marker = active ? style.accent(">") : " ";
+        const label = active ? style.accent(choice.label) : choice.label;
+        _terminalPromptDeps.write(`\r\x1B[2K${marker} ${label}
+`);
+      }
+    };
+    const cleanup = () => {
+      if (settled)
+        return;
+      settled = true;
+      stdin.removeListener("data", onData);
+      stdin.removeListener("end", onEnd);
+      stdin.removeListener("error", onEnd);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+    const onEnd = () => {
+      cleanup();
+      reject(new PromptCancelledError);
+    };
+    const onData = (chunk) => {
+      if (chunk.includes(ETX) || chunk.includes(EOT)) {
+        onEnd();
+        return;
+      }
+      if (chunk.includes(ARROW_UP)) {
+        index = (index - 1 + choices.length) % choices.length;
+        render();
+        return;
+      }
+      if (chunk.includes(ARROW_DOWN)) {
+        index = (index + 1) % choices.length;
+        render();
+        return;
+      }
+      if (chunk.includes(CR) || chunk.includes(LF)) {
+        const chosen = choices[index];
+        cleanup();
+        resolve3(chosen.id);
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+    stdin.once("end", onEnd);
+    stdin.once("error", onEnd);
+    render();
+  });
+}
+var ETX = "\x03", EOT = "\x04", CR = "\r", LF = `
+`, BACKSPACE = "\x7F", ARROW_UP = "\x1B[A", ARROW_DOWN = "\x1B[B", identity = (text) => text, PLAIN_STYLE, PromptCancelledError, _terminalPromptDeps;
+var init_prompt = __esm(() => {
+  PLAIN_STYLE = { accent: identity, dim: identity, bold: identity };
+  PromptCancelledError = class PromptCancelledError extends Error {
+    constructor() {
+      super("Prompt cancelled");
+      this.name = "PromptCancelledError";
+    }
+  };
+  _terminalPromptDeps = {
+    stdin: undefined,
+    write: (text) => process.stdout.write(text)
+  };
+});
+
+// ../nax-agent/src/terminal-auth/interaction.ts
+function createTerminalAuthInteraction(options) {
+  const style = options.style ?? PLAIN_STYLE;
+  const open = options.openUrl ?? openUrl;
+  let pendingUrl;
+  const manualCode = (message) => {
+    const url = pendingUrl;
+    if (url === undefined)
+      return promptForLine(message, undefined, style);
+    pendingUrl = undefined;
+    options.log(style.dim("Press Enter to open it in your browser."));
+    return promptForLine(message, () => {
+      options.log(style.dim("Opening your browser..."));
+      open(url);
+    }, style);
+  };
+  return {
+    prompt: async (prompt) => {
+      if (prompt.type === "manual-code")
+        return manualCode(prompt.message);
+      if (prompt.type === "text")
+        return promptForLine(prompt.message, undefined, style);
+      if (prompt.type === "select") {
+        return promptForSelect(prompt.message, prompt.options.map((option) => ({ id: option.id, label: option.label })), style);
+      }
+      return promptForSecret(prompt.message, style);
+    },
+    notify: (event) => {
+      switch (event.type) {
+        case "auth-url":
+          options.log(`
+${style.bold("Open this URL to continue:")}
+  ${event.url}`);
+          pendingUrl = event.url;
+          return;
+        case "device-code":
+          options.log(`
+Go to ${event.verificationUri} and enter code ${style.bold(event.userCode)}`);
+          return;
+        case "info":
+          options.log(event.message);
+          for (const link of event.links ?? [])
+            options.log(`  ${link.label ?? "Link"}: ${link.url}`);
+          return;
+        case "progress":
+          options.log(style.dim(event.message));
+          return;
+        default:
+      }
+    }
+  };
+}
+var init_interaction = __esm(() => {
+  init_open_url();
+  init_prompt();
+});
+
+// ../nax-agent/src/terminal-auth/index.ts
+var init_terminal_auth = __esm(() => {
+  init_interaction();
+  init_open_url();
+  init_prompt();
+});
+
 // ../nax-agent/src/native/credentials/chained-store.ts
 function createChainedCredentialStore(options) {
   const served = new Map;
@@ -2212,8 +2505,8 @@ var init_chained_store = __esm(() => {
 });
 
 // ../nax-agent/src/native/credentials/fingerprint.ts
-import { createHmac, randomBytes, randomUUID } from "crypto";
-import { link, mkdir as mkdir4, readFile as readFile3, rm, writeFile as writeFile3 } from "fs/promises";
+import { createHmac, randomBytes, randomUUID as randomUUID2 } from "crypto";
+import { link, mkdir as mkdir4, readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname2, join as join5 } from "path";
 function _resetFingerprintSalt() {
   memoPath = undefined;
@@ -2235,7 +2528,7 @@ async function readSaltFile(path) {
 async function createSaltFile(path) {
   await mkdir4(dirname2(path), { recursive: true });
   const candidate = randomBytes(SALT_BYTES);
-  const staged = `${path}.${randomUUID()}.staged`;
+  const staged = `${path}.${randomUUID2()}.staged`;
   try {
     await writeFile3(staged, candidate, { mode: 384 });
     try {
@@ -2247,7 +2540,7 @@ async function createSaltFile(path) {
     }
     return candidate;
   } finally {
-    await rm(staged, { force: true });
+    await rm2(staged, { force: true });
   }
 }
 async function loadSalt(path) {
@@ -2315,37 +2608,37 @@ function classify2(previous, next) {
     return "renewed";
   return "changed";
 }
-function identityData(providerId, identity) {
+function identityData(providerId, identity2) {
   return {
     providerId,
-    kind: identity.kind,
-    source: identity.source,
-    fingerprint: identity.fingerprint,
-    ...identity.account !== undefined ? { account: identity.account } : {}
+    kind: identity2.kind,
+    source: identity2.source,
+    fingerprint: identity2.fingerprint,
+    ...identity2.account !== undefined ? { account: identity2.account } : {}
   };
 }
-function replacementData(providerId, identity, previous) {
+function replacementData(providerId, identity2, previous) {
   return {
-    ...identityData(providerId, identity),
+    ...identityData(providerId, identity2),
     previousFingerprint: previous.fingerprint,
     ...previous.account !== undefined ? { previousAccount: previous.account } : {}
   };
 }
-function toStamp(identity) {
+function toStamp(identity2) {
   return {
-    fingerprint: identity.fingerprint,
-    source: identity.source,
-    ...identity.account !== undefined ? { account: identity.account } : {}
+    fingerprint: identity2.fingerprint,
+    source: identity2.source,
+    ...identity2.account !== undefined ? { account: identity2.account } : {}
   };
 }
 function createChangeGuard(inner, options) {
   const identities = new Map;
-  async function read(providerId) {
+  async function read2(providerId) {
     const credential = await inner.read(providerId);
     if (credential === undefined)
       return;
     const described = options.describe(providerId);
-    const identity = {
+    const identity2 = {
       kind: credential.kind,
       fingerprint: await fingerprintCredential(credential, options.salt),
       source: described?.source ?? "file",
@@ -2353,39 +2646,39 @@ function createChangeGuard(inner, options) {
     };
     const previous = identities.get(providerId);
     if (previous === undefined) {
-      getSafeLogger()?.info("credentials", "credential.resolved", identityData(providerId, identity));
-      identities.set(providerId, identity);
+      getSafeLogger()?.info("credentials", "credential.resolved", identityData(providerId, identity2));
+      identities.set(providerId, identity2);
       return credential;
     }
-    const verdict = classify2(previous, identity);
+    const verdict = classify2(previous, identity2);
     if (verdict === "renewed") {
-      getSafeLogger()?.info("credentials", "credential.renewed", replacementData(providerId, identity, previous));
+      getSafeLogger()?.info("credentials", "credential.renewed", replacementData(providerId, identity2, previous));
     } else if (verdict === "changed") {
       getSafeLogger()?.warn("credentials", "credential.changed", {
-        ...replacementData(providerId, identity, previous),
+        ...replacementData(providerId, identity2, previous),
         onChange: options.onChange
       });
       if (options.onChange === "refuse") {
-        throw new NaxError(`[credentials] Credential for ${providerId} changed from ${previous.fingerprint} to ${identity.fingerprint}`, "CREDENTIAL_CHANGED", {
+        throw new NaxError(`[credentials] Credential for ${providerId} changed from ${previous.fingerprint} to ${identity2.fingerprint}`, "CREDENTIAL_CHANGED", {
           stage: "credentials",
           providerId,
-          kind: identity.kind,
-          source: identity.source,
-          fingerprint: identity.fingerprint,
+          kind: identity2.kind,
+          source: identity2.source,
+          fingerprint: identity2.fingerprint,
           previousFingerprint: previous.fingerprint
         });
       }
     }
-    identities.set(providerId, identity);
+    identities.set(providerId, identity2);
     return credential;
   }
   return {
-    read,
+    read: read2,
     modify: (providerId, fn) => inner.modify(providerId, fn),
     delete: (providerId) => inner.delete(providerId),
     servedAuth: (providerId) => {
-      const identity = identities.get(providerId);
-      return identity === undefined ? undefined : toStamp(identity);
+      const identity2 = identities.get(providerId);
+      return identity2 === undefined ? undefined : toStamp(identity2);
     }
   };
 }
@@ -2947,7 +3240,7 @@ function createExecCredentialSource(options) {
   async function callHelper(providerId) {
     return applyOutcome(providerId, outcomeOf(await runHelper(options.command, providerId, timeoutMs)));
   }
-  async function read(providerId) {
+  async function read2(providerId) {
     if (declined.has(providerId))
       return;
     const lease = leases.get(providerId);
@@ -2969,7 +3262,7 @@ function createExecCredentialSource(options) {
     return new NaxError(`[credentials] Cannot ${operation} the credential for ${providerId}: the exec helper owns it.`, "CREDENTIAL_MANAGED_BY_HELPER", { stage: "credentials", providerId, operation });
   }
   return {
-    read,
+    read: read2,
     modify(providerId) {
       throw managedByHelper(providerId, "modify");
     },
@@ -3170,11 +3463,16 @@ async function importPiCredentials(options) {
       cause: error
     });
   }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new NaxError(`The file at ${path} is not a provider credential map.`, "AUTH_IMPORT_SOURCE_UNREADABLE", {
+      path
+    });
+  }
   const store = naxCredentialStore();
   const outcomes = [];
   for (const providerId of Object.keys(parsed).sort()) {
     const entry = parsed[providerId];
-    const credential = entry === undefined ? undefined : fromPiEntry(entry);
+    const credential = typeof entry === "object" && entry !== null ? fromPiEntry(entry) : undefined;
     if (credential === undefined) {
       outcomes.push({ providerId, status: "unsupported" });
       continue;
@@ -3194,6 +3492,9 @@ async function importPiCredentials(options) {
 async function listStoredProviders() {
   return readStoredEntries();
 }
+async function loginProviderIds() {
+  return _authDeps.providerIds();
+}
 async function removeStoredProvider(providerId) {
   await naxCredentialStore().delete(providerId);
 }
@@ -3543,12 +3844,12 @@ var init_errors = __esm(() => {
 });
 
 // ../nax-agent/src/native/session-affinity.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
 function nativeSessionId(sessionKey) {
   return createHash3("sha256").update(sessionKey).digest("hex").slice(0, ID_LENGTH);
 }
 function newSessionKey() {
-  return randomUUID2();
+  return randomUUID3();
 }
 var ID_LENGTH = 32;
 var init_session_affinity = () => {};
@@ -3666,8 +3967,8 @@ function createMemoryTranscriptStore() {
 function transcriptModelIdentity(rawModel) {
   return rawModel === undefined ? undefined : parseModelSpec(rawModel).model;
 }
-function isForeignTranscript(doc, identity, sessionName) {
-  const { owner, model } = identity;
+function isForeignTranscript(doc, identity2, sessionName) {
+  const { owner, model } = identity2;
   if (owner !== undefined && doc.owner !== owner) {
     getLogger().debug("native-session", "Ignoring a transcript owned by another invocation", {
       sessionName,
@@ -3676,7 +3977,7 @@ function isForeignTranscript(doc, identity, sessionName) {
     });
     return true;
   }
-  if (model !== undefined && doc.model !== undefined && doc.model !== model) {
+  if (identity2.carryAcrossModels !== true && model !== undefined && doc.model !== undefined && doc.model !== model) {
     getLogger().debug("native-session", "Ignoring a transcript written by another model", {
       sessionName,
       storedModel: doc.model,
@@ -3686,7 +3987,7 @@ function isForeignTranscript(doc, identity, sessionName) {
   }
   return false;
 }
-function historyFromTranscript(doc, identity, sessionName) {
+function historyFromTranscript(doc, identity2, sessionName) {
   if (doc === null)
     return [];
   const version = doc.schemaVersion;
@@ -3696,14 +3997,14 @@ function historyFromTranscript(doc, identity, sessionName) {
   if (!Array.isArray(doc.messages)) {
     throw new NaxError(`transcript for session "${sessionName}" is unreadable: messages is not an array`, "TRANSCRIPT_CORRUPT", { stage: "native-session" });
   }
-  if (isForeignTranscript(doc, identity, sessionName))
+  if (isForeignTranscript(doc, identity2, sessionName))
     return [];
   return doc.messages;
 }
-function transcriptDocFor(messages, identity) {
+function transcriptDocFor(messages, identity2) {
   return {
-    ...identity.owner !== undefined ? { owner: identity.owner } : {},
-    ...identity.model !== undefined ? { model: identity.model } : {},
+    ...identity2.owner !== undefined ? { owner: identity2.owner } : {},
+    ...identity2.model !== undefined ? { model: identity2.model } : {},
     savedAt: new Date().toISOString(),
     messages: [...messages]
   };
@@ -3728,7 +4029,7 @@ __export(exports_transcript_store, {
   transcriptModelIdentity: () => transcriptModelIdentity,
   transcriptPath: () => transcriptPath
 });
-import { mkdir as mkdir5, readdir, readFile as readFile6, rename, rm as rm2, stat as stat3, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readdir, readFile as readFile6, rename as rename2, rm as rm3, stat as stat3 } from "fs/promises";
 import { join as join9 } from "path";
 function transcriptPath(dir, sessionName) {
   return join9(dir, `${sessionName}.transcript.json`);
@@ -3762,7 +4063,7 @@ async function readTranscriptDoc(dir, sessionName) {
 }
 async function writeTranscriptDoc(dir, sessionName, doc) {
   await mkdir5(dir, { recursive: true });
-  await writeFile4(transcriptPath(dir, sessionName), JSON.stringify(doc, null, 2), "utf8");
+  await writeFileAtomic(transcriptPath(dir, sessionName), JSON.stringify(doc, null, 2));
 }
 function createFileTranscriptStore(dir) {
   return {
@@ -3780,16 +4081,16 @@ function createFileTranscriptStore(dir) {
     }
   };
 }
-async function loadTranscript(dir, sessionName, identity = {}) {
-  return [...historyFromTranscript(await readTranscriptDoc(dir, sessionName), identity, sessionName)];
+async function loadTranscript(dir, sessionName, identity2 = {}) {
+  return [...historyFromTranscript(await readTranscriptDoc(dir, sessionName), identity2, sessionName)];
 }
-async function saveTranscript(dir, sessionName, messages, identity = {}) {
-  await writeTranscriptDoc(dir, sessionName, transcriptDocFor(messages, identity));
+async function saveTranscript(dir, sessionName, messages, identity2 = {}) {
+  await writeTranscriptDoc(dir, sessionName, transcriptDocFor(messages, identity2));
 }
 async function retainTranscript(dir, sessionName) {
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
   try {
-    await rename(transcriptPath(dir, sessionName), join9(dir, `${sessionName}.transcript.failed-${stamp}.json`));
+    await rename2(transcriptPath(dir, sessionName), join9(dir, `${sessionName}.transcript.failed-${stamp}.json`));
   } catch (err) {
     if (err.code === "ENOENT")
       return;
@@ -3797,7 +4098,7 @@ async function retainTranscript(dir, sessionName) {
   }
 }
 async function deleteTranscript(dir, sessionName) {
-  await rm2(transcriptPath(dir, sessionName), { force: true });
+  await rm3(transcriptPath(dir, sessionName), { force: true });
 }
 function _resetTranscriptTruncationWarningForTests() {
   hasWarnedAboutTranscriptTruncation = false;
@@ -3821,7 +4122,7 @@ async function pruneRetainedTranscripts(dir, maxRetained = MAX_RETAINED_TRANSCRI
   }));
   withMtimes.sort((a, b) => a.mtimeMs - b.mtimeMs);
   const toDelete = withMtimes.slice(0, withMtimes.length - maxRetained);
-  await Promise.all(toDelete.map((f) => rm2(f.path, { force: true })));
+  await Promise.all(toDelete.map((f) => rm3(f.path, { force: true })));
   if (!hasWarnedAboutTranscriptTruncation) {
     hasWarnedAboutTranscriptTruncation = true;
     getLogger().warn("native-session", "Transcript retention cap reached \u2014 oldest kept-on-failure transcripts pruned", {
@@ -3835,6 +4136,7 @@ async function pruneRetainedTranscripts(dir, maxRetained = MAX_RETAINED_TRANSCRI
 var LEGACY_SAVED_AT, MAX_RETAINED_TRANSCRIPTS = 50, hasWarnedAboutTranscriptTruncation = false;
 var init_transcript_store = __esm(() => {
   init_infra();
+  init_atomic_write();
   init_transcript_identity();
   init_transcript_identity();
   LEGACY_SAVED_AT = new Date(0).toISOString();
@@ -4504,7 +4806,7 @@ async function openRepositoryInstructions(name, opts, store) {
   if (doc === null || doc.schemaVersion !== undefined && doc.schemaVersion !== 1 || !Array.isArray(doc.messages))
     return instructions;
   const ownerMatches = opts.transcriptOwner === undefined || doc?.owner === opts.transcriptOwner;
-  const modelMatches = doc?.model === undefined || doc.model === transcriptModelIdentity(opts.modelDef?.model);
+  const modelMatches = opts.carryHistoryAcrossModels === true || doc?.model === undefined || doc.model === transcriptModelIdentity(opts.modelDef?.model);
   if (ownerMatches && modelMatches) {
     const directories = doc?.instructionDirectories;
     if (Array.isArray(directories)) {
@@ -4557,6 +4859,7 @@ function createNativeSessionState() {
     streamHooks: new Map,
     failed: new Set,
     transcriptOwners: new Map,
+    carryHistoryAcrossModels: new Set,
     compaction: new Map,
     transportRetry: new Map,
     spinBreakers: new Map,
@@ -4627,6 +4930,10 @@ async function openNativeSession(state, name, opts) {
     state.transcriptOwners.set(name, opts.transcriptOwner);
   else
     state.transcriptOwners.delete(name);
+  if (opts.carryHistoryAcrossModels === true)
+    state.carryHistoryAcrossModels.add(name);
+  else
+    state.carryHistoryAcrossModels.delete(name);
   recordSystemPrompt(state, name, opts.systemPrompt);
   const instructions = await openRepositoryInstructions(name, opts, store);
   state.repositoryInstructions.set(name, instructions);
@@ -4663,6 +4970,7 @@ function clearNativeSessionState(state, sessionName) {
   state.timeouts.delete(sessionName);
   state.scratchpadRoots.delete(sessionName);
   state.transcriptOwners.delete(sessionName);
+  state.carryHistoryAcrossModels.delete(sessionName);
   state.streamHooks.delete(sessionName);
   state.failed.delete(sessionName);
   state.compaction.delete(sessionName);
@@ -4966,7 +5274,8 @@ function rewriteToolCallInput(messages, callId, input) {
       role: "assistant",
       content: lastAssistant.content,
       toolCalls,
-      ...lastAssistant.thinking !== undefined ? { thinking: lastAssistant.thinking } : {}
+      ...lastAssistant.thinking !== undefined ? { thinking: lastAssistant.thinking } : {},
+      ...lastAssistant.origin !== undefined ? { origin: lastAssistant.origin } : {}
     },
     ...messages.slice(lastAssistantIndex + 1)
   ];
@@ -19554,7 +19863,7 @@ var init_schemas_sandbox = __esm(() => {
 });
 
 // ../nax-agent/src/sandbox/git-guards.ts
-import { lstat, readdir as readdir2, readFile as readFile7, rm as rm3 } from "fs/promises";
+import { lstat, readdir as readdir2, readFile as readFile7, rm as rm4 } from "fs/promises";
 import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute3, join as join11, resolve as resolve8 } from "path";
 function commonDirOf(git) {
   if (git.kind === "none")
@@ -19640,7 +19949,7 @@ var init_git_guards = __esm(() => {
       }
     },
     readText: (p) => readFile7(p, "utf8"),
-    remove: (p) => rm3(p, { recursive: true, force: true })
+    remove: (p) => rm4(p, { recursive: true, force: true })
   };
 });
 
@@ -19671,7 +19980,7 @@ var init_messages = __esm(() => {
 });
 
 // ../nax-agent/src/sandbox/launcher.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { mkdir as mkdir6 } from "fs/promises";
 function logicalArgv(req) {
   return req.spec.kind === "shell" ? [req.spec.shell, "-c", req.spec.command] : req.spec.argv;
@@ -19800,7 +20109,7 @@ var init_launcher = __esm(() => {
   DISABLED_SANDBOX_STATE = { kind: "disabled" };
   _launcherDeps = {
     runArgv,
-    newCommandId: () => randomUUID3(),
+    newCommandId: () => randomUUID4(),
     mkdir: (path) => mkdir6(path, { recursive: true }).then(() => {
       return;
     })
@@ -19937,9 +20246,12 @@ function hardenedGitEnv(base) {
 function gitSpawnEnv(overlay) {
   return hardenedGitEnv(overlay === undefined ? process.env : { ...process.env, ...overlay });
 }
+function isGitProgram(token) {
+  return token === "git" || (token?.endsWith("/git") ?? false);
+}
 function hardenedGitArgv(argv) {
   const out = [...argv];
-  let i = 1;
+  let i = !isGitProgram(out[0]) && isGitProgram(out[1]) ? 2 : 1;
   while (i < out.length && out[i].startsWith("-")) {
     i += GLOBAL_OPTIONS_WITH_VALUE.has(out[i]) ? 2 : 1;
   }
@@ -20282,6 +20594,8 @@ function isUsableSharedParent() {
     const stats = _sessionTmpDeps.lstat(SHARED_TMP_PARENT);
     if (!stats.isDirectory() || stats.isSymbolicLink())
       return false;
+    if (stats.uid !== _sessionTmpDeps.uid())
+      return false;
   } catch (err) {
     return err.code === "ENOENT";
   }
@@ -20735,7 +21049,7 @@ var init_edit_region = __esm(() => {
 });
 
 // ../nax-agent/src/tools/edit.ts
-import { readFile as readFile8, stat as stat5, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile8, stat as stat5, writeFile as writeFile4 } from "fs/promises";
 function countOccurrences(haystack, needle) {
   if (needle === "")
     return 0;
@@ -20753,7 +21067,7 @@ var init_edit = __esm(() => {
   _editDeps = {
     stat: (path) => stat5(path),
     readFile: (path, encoding) => readFile8(path, encoding),
-    writeFile: (path, data, encoding) => writeFile5(path, data, encoding)
+    writeFile: (path, data, encoding) => writeFile4(path, data, encoding)
   };
   editTool = {
     name: "Edit",
@@ -23713,7 +24027,7 @@ var init_denial_redirect = __esm(() => {
 });
 
 // ../nax-agent/src/tools/runtime-calltool.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 function resolvePolicyIdentity(name, tool, input) {
   const argvField = tool.scope.argvField;
   const hasArgv = argvField !== undefined && input[argvField] !== undefined;
@@ -23724,7 +24038,7 @@ function openCallShadowTap(p) {
   if (p.shadow === undefined)
     return;
   return openShadowTap(p.shadow, {
-    key: randomUUID4(),
+    key: randomUUID5(),
     identity: p.identity,
     command: p.tool.scope.commandField === undefined ? undefined : p.input[p.tool.scope.commandField],
     argv: p.hasArgv && p.argvField !== undefined ? p.input[p.argvField] : undefined,
@@ -23855,7 +24169,7 @@ var init_runtime_calltool = __esm(() => {
 
 // ../nax-agent/src/tools/scratchpad.ts
 import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir8, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir8, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname8, join as join18, sep as sep10 } from "path";
 var SCRATCHPAD_DIR = ".nax/scratchpad", MAX_MATCHES2 = 500, scratchpadWriteTool, scratchpadReadTool, scratchpadListTool;
 var init_scratchpad = __esm(() => {
@@ -23893,7 +24207,7 @@ var init_scratchpad = __esm(() => {
       }
       try {
         await mkdir8(dirname8(target), { recursive: true });
-        await writeFile6(target, content, "utf8");
+        await writeFile5(target, content, "utf8");
         return { content: `wrote ${size} bytes` };
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
@@ -23985,7 +24299,7 @@ ${content}`, resultBytesPreTruncation: fullBytes };
 });
 
 // ../nax-agent/src/tools/spill.ts
-import { mkdir as mkdir9, writeFile as writeFile7 } from "fs/promises";
+import { mkdir as mkdir9, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname9, join as join19 } from "path";
 function fileSafe(value) {
   return value.replace(/[^A-Za-z0-9_-]/g, "_");
@@ -24111,14 +24425,14 @@ var init_spill = __esm(() => {
   _spillDeps = {
     mkdir: (path) => mkdir9(path, { recursive: true }),
     writeFile: async (path, data) => {
-      await writeFile7(path, data, "utf8");
+      await writeFile6(path, data, "utf8");
       return Buffer.byteLength(data);
     }
   };
 });
 
 // ../nax-agent/src/tools/tool-audit.ts
-import { mkdir as mkdir10, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir10, writeFile as writeFile7 } from "fs/promises";
 import { join as join20 } from "path";
 function registerToolAuditSink(runId, sink) {
   const sinks = openToolAuditSinks.get(runId);
@@ -24173,7 +24487,7 @@ function createToolAuditSink(opts) {
       calls: redactRowStrings(calls)
     }, null, 2);
     const prefix = runId !== undefined ? `${runId}-` : "";
-    await writeFile8(join20(opts.dir, `${prefix}${nextFileStamp()}-${opts.sessionName}.json`), body);
+    await writeFile7(join20(opts.dir, `${prefix}${nextFileStamp()}-${opts.sessionName}.json`), body);
   };
   const sink = {
     record(entry) {
@@ -24214,7 +24528,7 @@ var init_tool_audit = __esm(() => {
 });
 
 // ../nax-agent/src/tools/write.ts
-import { mkdir as mkdir11, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir11, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname10 } from "path";
 var writeTool;
 var init_write = __esm(() => {
@@ -24246,7 +24560,7 @@ var init_write = __esm(() => {
       }
       try {
         await mkdir11(dirname10(target), { recursive: true });
-        await writeFile9(target, content, "utf8");
+        await writeFile8(target, content, "utf8");
         return { content: `wrote ${Buffer.byteLength(content, "utf8")} bytes` };
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
@@ -24256,7 +24570,7 @@ var init_write = __esm(() => {
 });
 
 // ../nax-agent/src/tools/runtime.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function registerBuiltinCodingTools() {
   if (builtinsRegistered)
     return;
@@ -24340,7 +24654,7 @@ function createCodingToolRuntime(opts) {
       return body;
     return applyModelTruncationPolicy(body, {
       toolName,
-      callId: context?.toolCallId ?? randomUUID5(),
+      callId: context?.toolCallId ?? randomUUID6(),
       root: opts.policy.root,
       maxBytes
     });
@@ -24802,7 +25116,7 @@ function usageEvent(round, usage, costUsd) {
     costUsd
   };
 }
-function cappedInput(input) {
+function displayToolInput(input) {
   const redacted = redactSecrets(capStrings(input, REDACTION_SCAN_BYTES));
   let json2;
   try {
@@ -24814,7 +25128,7 @@ function cappedInput(input) {
     return redacted;
   return { truncated: true, preview: cutToByteCap(json2, TOOL_CALL_INPUT_BYTES) };
 }
-function previewOf(content) {
+function toolResultPreview(content) {
   return cutToByteCap(redactSecrets(cutToByteCap(content, REDACTION_SCAN_BYTES)), TOOL_RESULT_PREVIEW_BYTES);
 }
 function createTurnEventEmitter(sink) {
@@ -24846,7 +25160,7 @@ function createTurnEventEmitter(sink) {
     emit,
     deltaSink: (round) => (delta) => emit({ ...delta, round }),
     toolCall(call, recordedInput) {
-      const input = cappedInput(recordedInput ?? call.input);
+      const input = displayToolInput(recordedInput ?? call.input);
       outstanding.set(call.id, (outstanding.get(call.id) ?? 0) + 1);
       emit({ type: "tool_call", callId: call.id, name: call.name, input });
     },
@@ -24862,7 +25176,7 @@ function createTurnEventEmitter(sink) {
         type: "tool_result",
         callId: result.toolCallId,
         isError: result.isError === true,
-        preview: previewOf(result.content)
+        preview: toolResultPreview(result.content)
       });
     },
     flushUnanswered() {
@@ -25491,6 +25805,15 @@ async function maybeCompact(state, params) {
   }
   return { summarizeFailed: step.summarizeFailed };
 }
+function originOf(raw) {
+  if (raw === undefined)
+    return;
+  const spec = parseModelSpec(raw).model;
+  const slash = spec.indexOf("/");
+  if (slash <= 0 || slash === spec.length - 1)
+    return;
+  return { provider: spec.slice(0, slash), model: spec.slice(slash + 1) };
+}
 async function runModelRoundTrip(state, params, summarizeFailed) {
   const { handle, opts, deps, tools, loopEvents } = params;
   const step = await completeWithRecovery({
@@ -25516,7 +25839,6 @@ async function runModelRoundTrip(state, params, summarizeFailed) {
   }
   state.roundTrips += 1;
   params.usage.add(res.usage, res.costUsd, res.rates);
-  state.output = res.text;
   const promptTokens = inputClassTokens(res.usage);
   state.lastUsage = { promptTokens };
   state.anchorIndex = state.messages.length - 1;
@@ -25544,13 +25866,16 @@ async function runModelRoundTrip(state, params, summarizeFailed) {
     roundTrip: state.roundTrips
   });
   const assistantText = afterResponse.text ?? res.text;
+  state.output = assistantText;
   const assistantToolCalls = afterResponse.toolCalls ?? res.toolCalls;
   const assistantThinking = afterResponse.thinking ?? res.thinking;
+  const origin = originOf(handle.modelDef?.model);
   state.messages.push({
     role: "assistant",
     content: assistantText,
     ...assistantToolCalls !== undefined ? { toolCalls: assistantToolCalls } : {},
-    ...assistantThinking !== undefined ? { thinking: assistantThinking } : {}
+    ...assistantThinking !== undefined ? { thinking: assistantThinking } : {},
+    ...origin !== undefined ? { origin } : {}
   });
   if (assistantToolCalls === undefined || assistantToolCalls.length === 0) {
     state.completedNormally = true;
@@ -25639,6 +25964,7 @@ var MAX_FOLLOW_UPS_PER_TURN = 3;
 var init_turn_loop_round_trip = __esm(() => {
   init_core();
   init_infra();
+  init_models();
   init_turn_accumulator();
   init_turn_compaction_step();
   init_turn_complete_step();
@@ -25728,7 +26054,8 @@ async function runNativeTurn(handle, prompt, opts, deps) {
   const { store } = transcript;
   const transcriptIdentity = {
     owner: deps.sessionState.transcriptOwners.get(handle.id),
-    model: transcriptModelIdentity(handle.modelDef?.model)
+    model: transcriptModelIdentity(handle.modelDef?.model),
+    ...deps.sessionState.carryHistoryAcrossModels.has(handle.id) ? { carryAcrossModels: true } : {}
   };
   let messages = [
     ...historyFromTranscript(await store.load(handle.id), transcriptIdentity, handle.id)
@@ -25910,7 +26237,7 @@ async function streamComplete(client, model, req, onDelta) {
 var init_stream_complete = () => {};
 
 // ../nax-agent/src/native/session-adapter.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 function summaryPrompt(previousSummary) {
   const base = "Summarize the conversation above so it can be dropped from context. " + "Record what was attempted, what was rejected and why, any decisions that still bind, " + "and list the files read and the files modified. Be specific: this summary is the only " + "memory of this work that survives.";
   if (previousSummary === undefined)
@@ -25998,7 +26325,7 @@ class NativeSessionAdapter {
     const instructionInteraction = createInstructionInteraction(this.state.repositoryInstructions.get(handle.id), opts.interactionHandler);
     const deadline = createTurnDeadline(timeoutSeconds);
     const hooks = this.state.streamHooks.get(handle.id);
-    const callId = randomUUID6();
+    const callId = randomUUID7();
     const owner = this.state.transcriptOwners.get(handle.id);
     const eventBase = {
       callId,
@@ -26194,8 +26521,8 @@ var init_native = __esm(() => {
 });
 
 // ../nax-agent/src/session/agent-session-deps.ts
-import { randomUUID as randomUUID7 } from "crypto";
-import { mkdtemp, rm as rm4, stat as stat6 } from "fs/promises";
+import { randomUUID as randomUUID8 } from "crypto";
+import { mkdtemp, rm as rm5, stat as stat6 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join21 } from "path";
 var MAX_UNDELIVERED_CONTROL_EVENTS = 1000, _agentSessionDeps;
@@ -26204,7 +26531,7 @@ var init_agent_session_deps = __esm(() => {
     now: () => Date.now(),
     setTimeout: (fn, ms) => setTimeout(fn, ms),
     clearTimeout: (handle) => clearTimeout(handle),
-    randomUUID: () => randomUUID7(),
+    randomUUID: () => randomUUID8(),
     isDirectory: async (path) => {
       try {
         return (await stat6(path)).isDirectory();
@@ -26213,7 +26540,7 @@ var init_agent_session_deps = __esm(() => {
       }
     },
     makeScratchRoot: () => mkdtemp(join21(tmpdir4(), "nax-agent-session-")),
-    removeScratchRoot: (dir) => rm4(dir, { recursive: true, force: true }),
+    removeScratchRoot: (dir) => rm5(dir, { recursive: true, force: true }),
     controlEventCap: MAX_UNDELIVERED_CONTROL_EVENTS
   };
 });
@@ -26365,7 +26692,8 @@ var init_native_backend_options = __esm(() => {
       commandInterceptor: exports_external.custom(hasMethods2(["intercept"]), "must implement intercept").optional()
     }).optional(),
     bashApproval: exports_external.enum(["raw", "gated", "escalate"]).optional(),
-    allowUnsandboxed: exports_external.boolean().optional()
+    allowUnsandboxed: exports_external.boolean().optional(),
+    carryHistoryAcrossModels: exports_external.boolean().optional()
   });
 });
 
@@ -26710,6 +27038,7 @@ var init_src = __esm(() => {
   init_stderr_tail();
   init_redact();
   init_nax_error();
+  init_terminal_auth();
   init_native();
   init_turn_event_emitter();
   init_permissions();
@@ -29273,7 +29602,7 @@ function commandSpecIncludes(spec, fragment) {
   return normalizeCommandSpec(spec).some((entry) => entry.includes(fragment));
 }
 function replaceInCommandSpec(spec, searchValue, replacement) {
-  const replace = (command) => command.replaceAll(searchValue, replacement);
+  const replace = (command) => command.replaceAll(searchValue, () => replacement);
   return typeof spec === "string" ? replace(spec) : spec.map(replace);
 }
 function renderCommandSpec(spec) {
@@ -29335,7 +29664,9 @@ __export(exports_internal, {
   NATIVE_AGENT_NAME: () => NATIVE_AGENT_NAME,
   NativeSessionUnsupportedError: () => NativeSessionUnsupportedError,
   NaxError: () => NaxError,
+  PLAIN_STYLE: () => PLAIN_STYLE,
   PROVIDER_ID_RE: () => PROVIDER_ID_RE,
+  PromptCancelledError: () => PromptCancelledError,
   READ_CEILING: () => READ_CEILING,
   RESERVED_TOOL_NAMES: () => RESERVED_TOOL_NAMES,
   SANDBOX_GLOB_CHARS: () => SANDBOX_GLOB_CHARS,
@@ -29352,6 +29683,7 @@ __export(exports_internal, {
   _agentSessionDeps: () => _agentSessionDeps,
   _approvalsTaintDeps: () => _approvalsTaintDeps,
   _argvExecDeps: () => _argvExecDeps,
+  _atomicWriteDeps: () => _atomicWriteDeps,
   _authDeps: () => _authDeps,
   _bashToolDeps: () => _bashToolDeps,
   _clientDeps: () => _clientDeps,
@@ -29366,6 +29698,7 @@ __export(exports_internal, {
   _grepDeps: () => _grepDeps,
   _instructionAccessDeps: () => _instructionAccessDeps,
   _launcherDeps: () => _launcherDeps,
+  _openUrlDeps: () => _openUrlDeps,
   _policyInputDeps: () => _policyInputDeps,
   _probeDeps: () => _probeDeps,
   _repositoryInstructionDeps: () => _repositoryInstructionDeps,
@@ -29383,6 +29716,7 @@ __export(exports_internal, {
   _spillDeps: () => _spillDeps,
   _srtBackendDeps: () => _srtBackendDeps,
   _systemOneClientDeps: () => _systemOneClientDeps,
+  _terminalPromptDeps: () => _terminalPromptDeps,
   abortableSleep: () => abortableSleep,
   adaptProviderTool: () => adaptProviderTool,
   advertisedSchemaBytes: () => advertisedSchemaBytes,
@@ -29443,6 +29777,7 @@ __export(exports_internal, {
   createRunCommandTool: () => createRunCommandTool,
   createSpinBreaker: () => createSpinBreaker,
   createSrtBackend: () => createSrtBackend,
+  createTerminalAuthInteraction: () => createTerminalAuthInteraction,
   createToolAuditSink: () => createToolAuditSink,
   createTurnAccumulator: () => createTurnAccumulator,
   credentialFaultCode: () => credentialFaultCode,
@@ -29508,6 +29843,7 @@ __export(exports_internal, {
   listNaxEntries: () => listNaxEntries,
   listStoredProviders: () => listStoredProviders,
   loadTranscript: () => loadTranscript,
+  loginProviderIds: () => loginProviderIds,
   markNativeTurnOutcome: () => markNativeTurnOutcome,
   maskForPrompt: () => maskForPrompt,
   mcpRuleAdmits: () => mcpRuleAdmits,
@@ -29521,6 +29857,7 @@ __export(exports_internal, {
   normalizeExec: () => normalizeExec,
   normalizeManagerBinary: () => normalizeManagerBinary,
   openNativeSession: () => openNativeSession,
+  openUrl: () => openUrl,
   parseGitlinks: () => parseGitlinks,
   parseModelSpec: () => parseModelSpec,
   parseNativeModel: () => parseNativeModel,
@@ -29533,6 +29870,9 @@ __export(exports_internal, {
   prepareCompaction: () => prepareCompaction,
   probeSandbox: () => probeSandbox,
   probeSandboxOnce: () => probeSandboxOnce,
+  promptForLine: () => promptForLine,
+  promptForSecret: () => promptForSecret,
+  promptForSelect: () => promptForSelect,
   providerAttachesTo: () => providerAttachesTo,
   providersWithoutCredentials: () => providersWithoutCredentials,
   pruneRetainedTranscripts: () => pruneRetainedTranscripts,
@@ -29598,6 +29938,7 @@ __export(exports_internal, {
   setAgentLogger: () => setAgentLogger,
   shellQuoteArg: () => shellQuoteArg,
   shouldCompact: () => shouldCompact,
+  spawnDetached: () => spawnDetached,
   spillRelativePath: () => spillRelativePath,
   spinTerminalNotice: () => spinTerminalNotice,
   strayCommonDirTripwire: () => strayCommonDirTripwire,
@@ -29632,6 +29973,7 @@ __export(exports_internal, {
   withPathFileLock: () => withPathFileLock,
   wrapExternalHandler: () => wrapExternalHandler,
   writeApprovalsFile: () => writeApprovalsFile,
+  writeFileAtomic: () => writeFileAtomic,
   writeSpill: () => writeSpill,
   writeTool: () => writeTool
 });
@@ -29662,6 +30004,7 @@ var init_internal = __esm(() => {
   init_spin_breaker();
   init_agent_output_env();
   init_argv_exec();
+  init_atomic_write();
   init_file_lock();
   init_git_env();
   init_git_exec();
@@ -29694,6 +30037,7 @@ var init_internal = __esm(() => {
   init_permissions();
   init_sandbox();
   init_agent_session_deps();
+  init_terminal_auth();
   init_credential_read_deny();
   init_git();
   init_git_commit();
@@ -30348,9 +30692,9 @@ ${c.gray(JSON.stringify(filtered, null, 2))}`;
 }
 function buildDefaultMeta(data, mode, level) {
   const meta3 = [];
-  const identity = [data.agentName, data.model].filter((v) => typeof v === "string" && v.length > 0);
-  if (identity.length > 0)
-    meta3.push(`${EMOJI.agent} ${identity.join("\xB7")}`);
+  const identity2 = [data.agentName, data.model].filter((v) => typeof v === "string" && v.length > 0);
+  if (identity2.length > 0)
+    meta3.push(`${EMOJI.agent} ${identity2.join("\xB7")}`);
   if (typeof data.phaseIndex === "number" && typeof data.totalPhases === "number") {
     meta3.push(`${data.phaseIndex}/${data.totalPhases}`);
   }
@@ -31022,7 +31366,7 @@ var init_inert_bash_stages = __esm(() => {
 
 // src/utils/json-file.ts
 import { existsSync as existsSync5 } from "fs";
-import { rename as rename2, unlink as unlink3 } from "fs/promises";
+import { rename as rename3, unlink as unlink3 } from "fs/promises";
 async function loadJsonFile(path, context = "json-file") {
   if (!existsSync5(path)) {
     return null;
@@ -31057,7 +31401,7 @@ async function atomicWriteText(path, content, context = "json-file") {
   const tmpPath = `${path}.tmp-${crypto.randomUUID()}`;
   try {
     await Bun.write(tmpPath, content);
-    await rename2(tmpPath, path);
+    await rename3(tmpPath, path);
   } catch (err) {
     await unlink3(tmpPath).catch(() => {});
     const logger = getLogger2();
@@ -31370,6 +31714,12 @@ function _applyFinishAutoFlowShim(conf, warn = defaultConfigWarn) {
   }
   return { ...conf, finish: { ...lifted, ...explicitFinish } };
 }
+function _applyTddStrategyAliasShim(conf) {
+  const tdd = conf.tdd;
+  if (!tdd || typeof tdd !== "object" || tdd.strategy !== "tdd-simple")
+    return conf;
+  return { ...conf, tdd: { ...tdd, strategy: "simple" } };
+}
 function applyConfigCompatShims(conf, logger, dedupe) {
   const log = dedupe.wrapLogger(logger);
   const warn = dedupe.warn;
@@ -31386,6 +31736,7 @@ function applyConfigCompatShims(conf, logger, dedupe) {
   out = _applyFinishAutoFlowShim(out, warn);
   out = _applyRemovedOptimizerKeysShim(out, warn);
   out = _applyRemovedCrossPackageDepthShim(out, warn);
+  out = _applyTddStrategyAliasShim(out);
   return out;
 }
 var SECURITY_SENSITIVE_KEY_PATHS, REMOVED_FINISH_KEYS;
@@ -32913,7 +33264,7 @@ var init_schemas_execution = __esm(() => {
   });
   TddConfigSchema = exports_external.object({
     maxRetries: exports_external.number().int().nonnegative(),
-    strategy: exports_external.enum(["auto", "strict", "lite", "off"]).default("auto"),
+    strategy: exports_external.enum(["auto", "strict", "lite", "simple", "off"]).default("auto"),
     sessionTiers: exports_external.object({
       testWriter: ConfiguredModelSchema.default("fast"),
       verifier: ConfiguredModelSchema.default("fast"),
@@ -36201,18 +36552,20 @@ var init_spec_structure_grammar = __esm(() => {
 function declaredStoryIds(lines) {
   const ids = new Set;
   let inScope = false;
-  let inSkippedSubsection = false;
+  let skipLevel = 0;
   for (const line of lines) {
     if (/^##\s/.test(line)) {
       inScope = /^##\s+(Stories|Acceptance Criteria)\b/i.test(line);
-      inSkippedSubsection = false;
+      skipLevel = 0;
       continue;
     }
     if (!inScope)
       continue;
-    if (/^#{3,6}\s/.test(line))
-      inSkippedSubsection = GROUPED_PATH_SUBSECTION.test(line);
-    if (inSkippedSubsection)
+    const level = /^(#{3,6})\s/.exec(line)?.[1]?.length;
+    if (level !== undefined && (skipLevel === 0 || level <= skipLevel)) {
+      skipLevel = GROUPED_PATH_SUBSECTION.test(line) ? level : 0;
+    }
+    if (skipLevel > 0)
       continue;
     const heading = /^#{1,6}\s+(US-\d+)\b/i.exec(line);
     if (heading?.[1]) {
@@ -36259,9 +36612,9 @@ function extractSpecStructure(specContent) {
   const stories = [];
   const warnings = [];
   for (const declarations of collectStoryDeclarations(specContent)) {
-    const read = readDeclarations(declarations);
-    stories.push(read.story);
-    warnings.push(...read.warnings);
+    const read2 = readDeclarations(declarations);
+    stories.push(read2.story);
+    warnings.push(...read2.warnings);
   }
   return { stories, warnings };
 }
@@ -38089,11 +38442,15 @@ import path2 from "path";
 async function acceptCommand(options) {
   const logger = getLogger2();
   const { feature, override, reason } = options;
-  if (!override.match(/^AC-\d+$/i)) {
-    logger.error("cli", "Invalid AC ID format", { override, expected: "AC-1, AC-2, etc." });
-    throw new NaxError("Invalid AC ID format", "INVALID_AC_ID", { override, expected: "AC-1, AC-2, etc." });
-  }
-  const acId = override.toUpperCase();
+  const expected = "AC-1, or <package>::AC-1 (package path relative to the repo root)";
+  const match = /^(?:(.+)::)?(AC-\d+)$/i.exec(override);
+  const pkg = match?.[1];
+  const ac = match?.[2];
+  if (!ac || pkg === "") {
+    logger.error("cli", "Invalid AC ID format", { override, expected });
+    throw new NaxError("Invalid AC ID format", "INVALID_AC_ID", { override, expected });
+  }
+  const acId = pkg === undefined ? ac.toUpperCase() : `${pkg}::${ac.toUpperCase()}`;
   const projectDirResult = findProjectDir(process.cwd());
   if (!projectDirResult) {
     logger.error("cli", "Not in a nax project directory", { hint: "Run 'nax init' first" });
@@ -38494,7 +38851,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.83.6",
+    version: "0.84.0",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -38506,7 +38863,7 @@ var init_package = __esm(() => {
       typecheck: "bun x tsc --noEmit && bun x tsc --noEmit -p tsconfig.test.json",
       lint: "bun run lint:biome && bun run lint:checks",
       "lint:biome": "bun scripts/quiet-run.ts bun x biome check --error-on-warnings --diagnostic-level=warn src/ bin/ test/ scripts/",
-      "lint:checks": "bun run check:no-real-global-nax && bun run check:feature-dir-ssot && bun run check:alias-internals && bun run check:import-cycles && bun run check:nax-error && bun run check:logger-storyid && bun run check:log-format-layering && bun run check:file-sizes && bun run check:complexity && bun run check:no-control-bytes && bun run check:review-prompts && bun run check:nax-ai-imports && bun run check:sandbox-imports && bun run check:git-spawn-env && bun run check:bundle-externals && bun run check:op-tool-capability && bun run check:nax-artifacts-untracked && bun run check:story-workdir-access && bun run check:package-frame-derivation && bun run check:config-profile-threading && bun run check:dispatch-field-forwarding && bun run check:bash-dispatch-ask && bun run check:test-satellites && bun run check:nax-ai-pin && bun run check:package-boundaries && bun run check:usage-vocabulary",
+      "lint:checks": "bun run check:no-real-global-nax && bun run check:feature-dir-ssot && bun run check:alias-internals && bun run check:import-cycles && bun run check:nax-error && bun run check:logger-storyid && bun run check:log-format-layering && bun run check:file-sizes && bun run check:complexity && bun run check:no-control-bytes && bun run check:review-prompts && bun run check:nax-ai-imports && bun run check:sandbox-imports && bun run check:git-spawn-env && bun run check:bundle-externals && bun run check:op-tool-capability && bun run check:nax-artifacts-untracked && bun run check:story-workdir-access && bun run check:package-frame-derivation && bun run check:config-profile-threading && bun run check:dispatch-field-forwarding && bun run check:bash-dispatch-ask && bun run check:test-satellites && bun run check:lockstep && bun run check:package-boundaries && bun run check:usage-vocabulary",
       "lint:json": "bun x biome check --error-on-warnings src/ bin/ test/ scripts/ --reporter json && bun run check:nax-error 1>&2 && bun run check:logger-storyid 1>&2",
       "lint:fix": "bun x biome check --write src/ bin/ test/ scripts/",
       "check:no-real-global-nax": "bun run ../repo-tooling/scripts/check-no-real-global-nax.ts",
@@ -38528,7 +38885,7 @@ var init_package = __esm(() => {
       "check:no-control-bytes": "bun run ../repo-tooling/scripts/check-no-control-bytes.ts",
       "check:review-prompts": "bun run scripts/check-review-prompts-generated.ts",
       "check:nax-ai-imports": "bun run ../repo-tooling/scripts/check-nax-ai-imports.ts",
-      "check:nax-ai-pin": "bun run scripts/check-nax-ai-pin.ts",
+      "check:lockstep": "bun run ../repo-tooling/scripts/check-lockstep.ts",
       "check:sandbox-imports": "bun run ../repo-tooling/scripts/check-sandbox-imports.ts",
       "check:git-spawn-env": "bun run ../repo-tooling/scripts/check-git-spawn-env.ts",
       "check:bundle-externals": "bun run scripts/check-bundle-externals.ts",
@@ -38542,7 +38899,6 @@ var init_package = __esm(() => {
       "check:bash-dispatch-ask": "bun run scripts/check-bash-dispatch-ask.ts",
       "check:rules-drift": "bun scripts/quiet-run.ts bun run scripts/check-rules-drift.ts",
       "gen:review-prompts": "bun run scripts/generate-review-prompts.ts",
-      release: "bun scripts/release.ts",
       test: "AGENT=1 bun run scripts/run-tests.ts",
       "test:verbose": "bun run scripts/run-tests.ts",
       "test:bail": "AGENT=1 bun run scripts/run-tests.ts --bail",
@@ -38552,7 +38908,7 @@ var init_package = __esm(() => {
       "test:unit": "bun test ./test/unit/ --timeout=60000",
       "test:integration": "bun test ./test/integration/ --timeout=60000",
       "test:ui": "bun test ./test/ui/ --timeout=60000",
-      "test:e2e": "timeout -k 5s 180s bun test test/e2e/ --timeout=60000",
+      "test:e2e": "bun run scripts/run-tests.ts --e2e",
       "test:coverage": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files",
       "test:coverage:report": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files --report",
       "test:coverage:update": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files --update-baseline",
@@ -38582,7 +38938,7 @@ var init_package = __esm(() => {
       "@agentclientprotocol/sdk": "~1.7.0",
       "@anthropic-ai/sandbox-runtime": "0.0.77",
       "@modelcontextprotocol/sdk": "^1.30.0",
-      "@nathapp/nax-ai": "0.1.16",
+      "@nathapp/nax-ai": "0.84.0",
       chalk: "^5.6.2",
       commander: "^13.1.0",
       ink: "^6.7.0",
@@ -38812,9 +39168,9 @@ function cancellableDelay(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
-var spawn;
+var spawn2;
 var init_bun_deps = __esm(() => {
-  spawn = Bun.spawn;
+  spawn2 = Bun.spawn;
 });
 
 // src/agents/retry/failure-policy.ts
@@ -39781,19 +40137,24 @@ function isTestFileByPatterns(filePath2, patterns) {
 }
 function globsToPathspec(patterns) {
   const result = [];
-  const seen = new Set;
+  const add = (pathspec) => {
+    if (!result.includes(pathspec))
+      result.push(pathspec);
+  };
   for (const pattern of patterns) {
-    const lastStar = pattern.lastIndexOf("*");
-    if (lastStar === -1)
+    const segment = pattern.slice(pattern.lastIndexOf("/") + 1);
+    const firstStar = segment.indexOf("*");
+    if (firstStar === -1)
       continue;
-    const suffix = pattern.slice(lastStar + 1);
-    if (suffix.length === 0)
+    if (firstStar > 0) {
+      add(`:!${segment}`);
+      add(`:!*/${segment}`);
       continue;
-    const pathspec = `:!*${suffix}`;
-    if (!seen.has(pathspec)) {
-      result.push(pathspec);
-      seen.add(pathspec);
     }
+    const suffix = segment.slice(segment.lastIndexOf("*") + 1);
+    if (suffix.length === 0 || BARE_EXTENSION.test(suffix))
+      continue;
+    add(`:!*${suffix}`);
   }
   return result;
 }
@@ -39807,9 +40168,24 @@ function extractTestDirs(globs) {
   }
   return [...dirs];
 }
-var DEFAULT_TEST_FILE_PATTERNS, DEFAULT_SCAN_TEST_DIRS, DEFAULT_TS_DERIVE_SUFFIXES, DEFAULT_SEPARATED_TEST_DIRS;
+function extractWholeTestDirs(globs) {
+  const dirs = new Set;
+  for (const glob2 of globs) {
+    const segments = glob2.split("/");
+    const first = segments[0];
+    if (!first || first.includes("*") || segments.length < 2)
+      continue;
+    const filename = segments[segments.length - 1] ?? "";
+    const coversEverything = filename === "*" || filename === "**" || filename.startsWith("*") && BARE_EXTENSION.test(filename.slice(1));
+    if (coversEverything)
+      dirs.add(first);
+  }
+  return [...dirs];
+}
+var DEFAULT_TEST_FILE_PATTERNS, BARE_EXTENSION, DEFAULT_SCAN_TEST_DIRS, DEFAULT_TS_DERIVE_SUFFIXES, DEFAULT_SEPARATED_TEST_DIRS;
 var init_conventions = __esm(() => {
   DEFAULT_TEST_FILE_PATTERNS = Object.freeze(["test/**/*.test.ts"]);
+  BARE_EXTENSION = /^\.[A-Za-z0-9]+$/;
   DEFAULT_SCAN_TEST_DIRS = Object.freeze([
     "test",
     "tests",
@@ -40292,29 +40668,11 @@ async function detectFromFileScan(workdir) {
   const filtered = files.filter((f) => !isExcluded(f));
   if (filtered.length === 0)
     return null;
-  const counts = {};
-  for (const suffix of CANDIDATE_SUFFIXES) {
-    counts[suffix] = 0;
-  }
-  for (const file2 of filtered) {
-    for (const suffix of CANDIDATE_SUFFIXES) {
-      if (file2.endsWith(suffix)) {
-        counts[suffix] = (counts[suffix] ?? 0) + 1;
-      }
-    }
-  }
   const totalFiles = filtered.length;
-  const patterns = [];
-  for (const suffix of CANDIDATE_SUFFIXES) {
-    const count = counts[suffix] ?? 0;
-    if (count === 0)
-      continue;
-    if (count >= MIN_COUNT_THRESHOLD || count / totalFiles >= MIN_FRACTION_THRESHOLD) {
-      const glob2 = SUFFIX_TO_GLOB[suffix];
-      if (glob2)
-        patterns.push(glob2);
-    }
-  }
+  const patterns = CANDIDATES.filter((candidate) => {
+    const count = filtered.filter((file2) => candidate.matches(file2)).length;
+    return count > 0 && (count >= MIN_COUNT_THRESHOLD || count / totalFiles >= MIN_FRACTION_THRESHOLD);
+  }).map((candidate) => candidate.glob);
   if (patterns.length === 0)
     return null;
   return {
@@ -40323,41 +40681,35 @@ async function detectFromFileScan(workdir) {
     patterns
   };
 }
-var DRAIN_TIMEOUT2, EXCLUDED_DIR_PREFIXES, MIN_COUNT_THRESHOLD = 5, MIN_FRACTION_THRESHOLD = 0.1, FILE_SCAN_GIT_TIMEOUT_MS = 4000, FILE_SCAN_DRAIN_TIMEOUT_MS = 2000, CANDIDATE_SUFFIXES, SUFFIX_TO_GLOB, _fileScanDeps;
+var DRAIN_TIMEOUT2, EXCLUDED_DIR_PREFIXES, MIN_COUNT_THRESHOLD = 5, MIN_FRACTION_THRESHOLD = 0.1, FILE_SCAN_GIT_TIMEOUT_MS = 4000, FILE_SCAN_DRAIN_TIMEOUT_MS = 2000, bySuffix = (suffix) => ({
+  glob: `**/*${suffix}`,
+  matches: (path3) => path3.endsWith(suffix)
+}), byBasenamePrefix = (prefix, extension) => ({
+  glob: `**/${prefix}*${extension}`,
+  matches: (path3) => {
+    const base = path3.slice(path3.lastIndexOf("/") + 1);
+    return base.startsWith(prefix) && base.endsWith(extension) && base.length > prefix.length + extension.length;
+  }
+}), CANDIDATES, _fileScanDeps;
 var init_file_scan = __esm(() => {
   init_internal();
   DRAIN_TIMEOUT2 = Symbol("drain-timeout");
   EXCLUDED_DIR_PREFIXES = ["node_modules/", "dist/", "build/", ".nax/", "coverage/", ".git/"];
-  CANDIDATE_SUFFIXES = [
-    ".test.ts",
-    ".test.tsx",
-    ".test.js",
-    ".test.jsx",
-    ".spec.ts",
-    ".spec.tsx",
-    ".spec.js",
-    ".spec.jsx",
-    ".e2e-spec.ts",
-    ".e2e-spec.js",
-    "_test.go",
-    "_test.py",
-    "test_.py"
+  CANDIDATES = [
+    bySuffix(".test.ts"),
+    bySuffix(".test.tsx"),
+    bySuffix(".test.js"),
+    bySuffix(".test.jsx"),
+    bySuffix(".spec.ts"),
+    bySuffix(".spec.tsx"),
+    bySuffix(".spec.js"),
+    bySuffix(".spec.jsx"),
+    bySuffix(".e2e-spec.ts"),
+    bySuffix(".e2e-spec.js"),
+    bySuffix("_test.go"),
+    bySuffix("_test.py"),
+    byBasenamePrefix("test_", ".py")
   ];
-  SUFFIX_TO_GLOB = {
-    ".test.ts": "**/*.test.ts",
-    ".test.tsx": "**/*.test.tsx",
-    ".test.js": "**/*.test.js",
-    ".test.jsx": "**/*.test.jsx",
-    ".spec.ts": "**/*.spec.ts",
-    ".spec.tsx": "**/*.spec.tsx",
-    ".spec.js": "**/*.spec.js",
-    ".spec.jsx": "**/*.spec.jsx",
-    ".e2e-spec.ts": "**/*.e2e-spec.ts",
-    ".e2e-spec.js": "**/*.e2e-spec.js",
-    "_test.go": "**/*_test.go",
-    "_test.py": "**/*_test.py",
-    "test_.py": "**/test_*.py"
-  };
   _fileScanDeps = {
     spawn: Bun.spawn,
     killProcessGroup,
@@ -40839,7 +41191,7 @@ async function detectFromCargoToml(workdir) {
   const path3 = `${workdir}/Cargo.toml`;
   if (!await _frameworkDefaultsDeps.fileExists(path3))
     return null;
-  return { type: "manifest", framework: "rust", path: path3, patterns: ["tests/**/*.rs", "src/**/*.rs"] };
+  return { type: "manifest", framework: "rust", path: path3, patterns: ["tests/**/*.rs"] };
 }
 async function detectFromPyprojectDeps(workdir) {
   const path3 = `${workdir}/pyproject.toml`;
@@ -41751,7 +42103,7 @@ function resolveReviewExcludePatterns(userExplicit, resolved) {
   const result = new Set;
   for (const p of resolved.pathspec)
     result.add(p);
-  for (const d of resolved.testDirs)
+  for (const d of extractWholeTestDirs(resolved.globs))
     result.add(`:!${d}/`);
   for (const d of WELL_KNOWN_TEST_DIRS2)
     result.add(`:!${d}/`);
@@ -42371,6 +42723,7 @@ __export(exports_test_runners, {
   detectTestFilePatterns: () => detectTestFilePatterns,
   discoverWorkspacePackages: () => discoverWorkspacePackages,
   extractTestDirs: () => extractTestDirs,
+  extractWholeTestDirs: () => extractWholeTestDirs,
   findPackageDir: () => findPackageDir,
   formatFailureSummary: () => formatFailureSummary,
   globsToPathspec: () => globsToPathspec,
@@ -42422,7 +42775,7 @@ var init_nax_owned_paths = __esm(() => {
 });
 
 // src/review/diff-utils.ts
-var {spawn: spawn2 } = globalThis.Bun;
+var {spawn: spawn3 } = globalThis.Bun;
 async function resolveNaxIgnorePathspecExcludes(workdir, options) {
   if (options?.naxIgnoreIndex)
     return options.naxIgnoreIndex.toPathspecExcludes(options.packageDir);
@@ -42575,7 +42928,7 @@ var init_diff_utils = __esm(() => {
   init_path_filters();
   ALWAYS_EXCLUDED = [...NAX_OWNED_REVIEW_EXCLUDE_PATHSPECS];
   _diffUtilsDeps = {
-    spawn: spawn2,
+    spawn: spawn3,
     isGitRefValid,
     getMergeBase,
     timeoutMs: GIT_TIMEOUT_MS
@@ -44648,7 +45001,7 @@ var init_hermetic = __esm(() => {
 });
 
 // src/prompts/sections/protocol-region.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 function call(tool, input) {
   return `${tool} ${JSON.stringify(input)}`;
 }
@@ -44765,7 +45118,7 @@ var KIND_PATTERN, NONCE, PROTOCOL_REGION_MARKER_PREFIX = "<!--nax:", REGION, OWN
 var init_protocol_region = __esm(() => {
   init_errors4();
   KIND_PATTERN = /^[a-z][a-z-]*$/;
-  NONCE = randomUUID8().slice(0, 8);
+  NONCE = randomUUID9().slice(0, 8);
   REGION = new RegExp(`<!--nax:([a-z][a-z-]*):([a-f0-9]+) (\\{.*?\\})-->\\n` + `((?:(?!<!--nax:[a-z][a-z-]*:[a-f0-9]+ )[\\s\\S])*?)` + `<!--\\/nax:\\1-->\\n?`, "g");
   OWN_OPEN = new RegExp(`<!--nax:[a-z][a-z-]*:${NONCE} `, "g");
   REGISTRY = {
@@ -47324,7 +47677,7 @@ ${section}`);
     const failingFiles = Array.from(new Set(findings.map((f) => f.file).filter((f) => !!f)));
     if (failingFiles.length > 0) {
       const perFileLines = failingFiles.map((file2) => {
-        const scopedCmd = opts.testScopedTemplate ? opts.testScopedTemplate.replace("{{files}}", file2) : `${opts.testCommand} ${file2}`;
+        const scopedCmd = opts.testScopedTemplate ? opts.testScopedTemplate.replaceAll("{{files}}", () => file2) : `${opts.testCommand} ${file2}`;
         if (opts.testScopedTemplate && opts.fileScopeCommandName) {
           return `  ${wrapAffordance("run-test", { command: opts.fileScopeCommandName, files: file2 }, scopedCmd)}`;
         }
@@ -47754,7 +48107,7 @@ ${output}
     const cmd = testCommand ?? "";
     const failingFiles = Array.from(new Set(failures.map((f) => f.file)));
     const testCommands = failingFiles.map((file2) => {
-      const scopedCmd = testScopedTemplate ? testScopedTemplate.replace("{{files}}", file2) : cmd ? `${cmd} ${file2}` : file2;
+      const scopedCmd = testScopedTemplate ? testScopedTemplate.replaceAll("{{files}}", () => file2) : cmd ? `${cmd} ${file2}` : file2;
       return `  ${scopedCmd}`;
     }).join(`
 `);
@@ -49845,7 +50198,7 @@ async function loadCanonicalRules(workdir, options = {}) {
   if (allViolations.length > 0) {
     throw new NeutralityLintError(allViolations);
   }
-  rules.sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || (a.id ?? a.fileName).localeCompare(b.id ?? b.fileName));
+  rules.sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || byCodePoint(a.id ?? a.fileName, b.id ?? b.fileName));
   logger.debug("canonical-loader", "Scanned canonical rules store", {
     fileCount: rules.length,
     files: rules.map((r) => r.path)
@@ -49879,6 +50232,7 @@ async function loadCanonicalRules(workdir, options = {}) {
 }
 var CANONICAL_RULES_DIR = ".nax/rules", _canonicalLoaderDeps, NEUTRALITY_RULES, DEFAULT_CANONICAL_RULES_BUDGET_TOKENS = 8192, RULES_BUDGET_WARNING_RATIO = 0.75, RULE_ALLOW_MARKER, NeutralityLintError, RulesFrontmatterLintError;
 var init_canonical_loader = __esm(() => {
+  init_internal();
   init_errors4();
   init_logger2();
   init_rules_frontmatter();
@@ -50557,7 +50911,7 @@ function applySectionBudget(sections2, budgetTokens) {
       overageTokens: totalTokens
     };
   }
-  const sorted = [...sections2].sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || ownerIdentifier(a).localeCompare(ownerIdentifier(b)) || a.ordinal - b.ordinal);
+  const sorted = [...sections2].sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || byCodePoint(ownerIdentifier(a), ownerIdentifier(b)) || a.ordinal - b.ordinal);
   const kept = [];
   const droppedIds = [];
   const closedOwners = new Set;
@@ -50589,6 +50943,7 @@ function applySectionBudget(sections2, budgetTokens) {
   };
 }
 var init_rule_budget = __esm(() => {
+  init_internal();
   init_rules_frontmatter();
 });
 
@@ -51687,7 +52042,7 @@ var init_loop_handler_forwarding = __esm(() => {
 });
 
 // src/session/manager-deps.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { mkdir as mkdir14 } from "fs/promises";
 import { isAbsolute as isAbsolute13, join as join39, relative as relative18, sep as sep13 } from "path";
 function resolveProjectDirFromScratchDir(scratchDir) {
@@ -51729,7 +52084,7 @@ var init_manager_deps = __esm(() => {
   _sessionManagerDeps = {
     now: () => new Date().toISOString(),
     nowMs: () => Date.now(),
-    uuid: () => randomUUID9(),
+    uuid: () => randomUUID10(),
     sessionScratchDir: (projectDir, featureName, sessionId) => join39(featureDir(projectDir, featureName), "sessions", sessionId),
     writeDescriptor: async (scratchDir, descriptor, projectDir) => {
       await mkdir14(scratchDir, { recursive: true });
@@ -52220,10 +52575,9 @@ class SessionManager {
     const reuse = decideReuse(liveHandle, this._findByName(name), opts);
     if (liveHandle && reuse === "reuse")
       return liveHandle;
-    if (liveHandle && reuse === "close-then-reopen") {
-      await this.closeSession(liveHandle);
-      this._busySessions.add(name);
-    } else if (liveHandle)
+    if (liveHandle && reuse === "close-then-reopen")
+      await this.closeSession(liveHandle, true);
+    else if (liveHandle)
       this._liveHandles.delete(name);
     const adapter = this._getAdapter(opts.agentName);
     if (!adapter) {
@@ -52252,6 +52606,7 @@ class SessionManager {
     this._liveHandles.set(name, handle);
     const protocolIds = handle.protocolIds ?? NULL_PROTOCOL_IDS;
     if (!existingDescriptor) {
+      this._cancelledSessions.delete(name);
       const created = this.create({
         role: opts.role ?? "main",
         agent: opts.agentName,
@@ -52287,7 +52642,7 @@ class SessionManager {
     });
     return handle;
   }
-  async closeSession(handle) {
+  async closeSession(handle, keepOpenGuard = false) {
     const desc = this._findByName(handle.id);
     const adapter = this._getAdapter(handle.agentName);
     this._liveHandles.delete(handle.id);
@@ -52305,7 +52660,8 @@ class SessionManager {
     if (desc && desc.state === "RUNNING") {
       this.transition(desc.id, "COMPLETED");
     }
-    this._busySessions.delete(handle.id);
+    if (!keepOpenGuard)
+      this._busySessions.delete(handle.id);
     this._cancelledSessions.delete(handle.id);
     this._watchdogCancels.clear(handle.id);
   }
@@ -52414,7 +52770,7 @@ function recordAgentHandoff(sessionManager, sessionName, newAgent, reason) {
 }
 
 // src/session/scratch-purge.ts
-import { mkdir as mkdir15, rename as rename3, rm as rm5 } from "fs/promises";
+import { mkdir as mkdir15, rename as rename4, rm as rm6 } from "fs/promises";
 import { dirname as dirname15, join as join40 } from "path";
 async function purgeStaleScratch(projectDir, featureName, retentionDays, archiveInsteadOfDelete = false) {
   const sessionsDir = join40(featureDir(projectDir, featureName), "sessions");
@@ -52466,10 +52822,10 @@ var init_scratch_purge = __esm(() => {
     },
     fileExists: (path5) => Bun.file(path5).exists(),
     readFile: (path5) => Bun.file(path5).text(),
-    remove: (path5) => rm5(path5, { recursive: true, force: true }),
+    remove: (path5) => rm6(path5, { recursive: true, force: true }),
     move: async (src, dest) => {
       await mkdir15(dirname15(dest), { recursive: true });
-      await rename3(src, dest);
+      await rename4(src, dest);
     },
     now: () => Date.now()
   };
@@ -52557,7 +52913,7 @@ var init_session2 = __esm(() => {
 var DEFAULT_MAX_TOKENS_PER_CALL = 2048;
 
 // src/context/fragments/store.ts
-import { mkdir as mkdir17, rm as rm6, stat as stat7 } from "fs/promises";
+import { mkdir as mkdir17, rm as rm7, stat as stat7 } from "fs/promises";
 import { dirname as dirname17, join as join41 } from "path";
 function fragmentPath(projectDir, featureId, storyId) {
   validatePathSegment(storyId, "storyId");
@@ -52671,7 +53027,7 @@ var init_store = __esm(() => {
       return files.sort(byCodePoint);
     },
     removeFile: async (path5) => {
-      await rm6(path5, { force: true });
+      await rm7(path5, { force: true });
     }
   };
 });
@@ -54335,6 +54691,27 @@ var init_manifest_purge = __esm(() => {
   };
 });
 
+// src/context/engine/digest-carrier.ts
+function boostedDigestChunk(request) {
+  const digest = request.priorStageDigest?.trim();
+  return digest && (request.planDigestBoost ?? 1) > 1 ? request.priorStageDigest : undefined;
+}
+function resolveDigestCarrier(request, boostedDigest, packed) {
+  if (boostedDigest === undefined) {
+    return { digestAsChunk: false, renderPriorDigest: request.priorStageDigest, manifestRequest: request };
+  }
+  const landed = packed.some((c) => c.providerId === PLAN_DIGEST_PROVIDER_ID);
+  if (landed) {
+    return {
+      digestAsChunk: true,
+      renderPriorDigest: undefined,
+      manifestRequest: { ...request, priorStageDigest: undefined }
+    };
+  }
+  return { digestAsChunk: false, renderPriorDigest: request.priorStageDigest, manifestRequest: request };
+}
+var PLAN_DIGEST_PROVIDER_ID = "plan-digest";
+
 // src/context/engine/orchestrator-rebuild-helpers.ts
 function toContextChunk(packed) {
   const providerId = packed.providerId ?? packed.id.split(":")[0] ?? "unknown";
@@ -54538,7 +54915,7 @@ var init_render = __esm(() => {
 });
 
 // src/context/engine/rebuild.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function toPackedChunks(prior, newAgentId, targetAgentId) {
   const priorAgentForNeutralize = prior.agentId ?? "";
   return prior.chunks.map((c) => {
@@ -54665,7 +55042,7 @@ var init_rebuild = __esm(() => {
   init_render();
   init_scratch_neutralizer();
   DEFAULT_REBUILD_DEPS = {
-    uuid: () => randomUUID10(),
+    uuid: () => randomUUID11(),
     getLogger: () => getLogger2()
   };
 });
@@ -54679,13 +55056,13 @@ function roleMultiplier(chunkRoles, callerRole) {
   return ROLE_MISMATCH_WEIGHT;
 }
 function scoreChunk(chunk, callerRole, minScore = MIN_SCORE, stale = false, providerWeights) {
-  const rm7 = roleMultiplier(chunk.role, callerRole);
-  const roleFiltered = rm7 === 0;
+  const rm8 = roleMultiplier(chunk.role, callerRole);
+  const roleFiltered = rm8 === 0;
   const kindWeight = KIND_WEIGHTS[chunk.kind] ?? 0.5;
   const isStale = chunk.staleCandidate === true || stale;
   const freshnessMultiplier = isStale ? chunk.scoreMultiplier ?? STALENESS_PENALTY : 1;
   const effectivenessMultiplier = chunk.providerId !== undefined ? providerWeights?.[chunk.providerId] ?? 1 : 1;
-  const score = chunk.rawScore * rm7 * kindWeight * freshnessMultiplier * effectivenessMultiplier;
+  const score = chunk.rawScore * rm8 * kindWeight * freshnessMultiplier * effectivenessMultiplier;
   const belowMinScore = !roleFiltered && score < minScore;
   return { ...chunk, score, roleFiltered, belowMinScore };
 }
@@ -54711,7 +55088,7 @@ var init_scoring = __esm(() => {
 });
 
 // src/context/engine/orchestrator.ts
-import { createHash as createHash10, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID12 } from "crypto";
 function buildPullToolDescriptors(stageToolNames, pullConfig) {
   if (!pullConfig?.enabled || stageToolNames.length === 0)
     return [];
@@ -54720,6 +55097,28 @@ function buildPullToolDescriptors(stageToolNames, pullConfig) {
   const override = configured2 !== undefined && configured2 !== DEFAULT_MAX_CALLS_PER_SESSION ? configured2 : undefined;
   return stageToolNames.filter((name) => allowed.length === 0 || allowed.includes(name)).map((name) => PULL_TOOL_REGISTRY[name]).filter((d) => d !== undefined).map((d) => ({ ...d, maxCallsPerSession: override ?? d.maxCallsPerSession }));
 }
+function appendPlanDigestChunk(raw, results, digest, boost) {
+  const hash2 = createHash10("sha256").update(digest).digest("hex").slice(0, 8);
+  const tokens = Math.ceil(digest.length / 4);
+  raw.push({
+    id: `${PLAN_DIGEST_PROVIDER_ID}:${hash2}`,
+    providerId: PLAN_DIGEST_PROVIDER_ID,
+    kind: "session",
+    scope: "session",
+    role: ["all"],
+    content: digest,
+    tokens,
+    rawScore: 0.9 * boost
+  });
+  results.push({
+    providerId: PLAN_DIGEST_PROVIDER_ID,
+    status: "ok",
+    source: undefined,
+    chunkCount: 1,
+    durationMs: 0,
+    tokensProduced: tokens
+  });
+}
 async function fetchWithTimeout(provider, request, timeoutMs = PROVIDER_FETCH_TIMEOUT_MS) {
   const controller = new AbortController;
   let handle;
@@ -54731,7 +55130,7 @@ async function fetchWithTimeout(provider, request, timeoutMs = PROVIDER_FETCH_TI
       reject(new Error(`Provider "${provider.id}" timed out`));
     }, timeoutMs);
   });
-  const fetchPromise = provider.fetch(request, controller.signal).then((result) => result, (err) => {
+  const fetchPromise = (async () => provider.fetch(request, controller.signal))().then((result) => result, (err) => {
     if (timedOut) {
       return new Promise(() => {});
     }
@@ -54797,8 +55196,9 @@ class ContextOrchestrator {
     }
     const profileBudget = agentProfile.caps.preferredPromptTokens;
     const stageCeiling = Math.min(request.budgetTokens, profileBudget, request.availableBudgetTokens ?? Number.POSITIVE_INFINITY);
+    const boostedDigest = boostedDigestChunk(request);
     const trimmedPriorDigest = request.priorStageDigest?.trim();
-    const priorDigestTokens = trimmedPriorDigest ? Math.ceil(trimmedPriorDigest.length / 4) : 0;
+    const priorDigestTokens = boostedDigest === undefined && trimmedPriorDigest ? Math.ceil(trimmedPriorDigest.length / 4) : 0;
     let effectiveBudgetTokens = Math.max(0, stageCeiling - DIGEST_RESERVE_TOKENS - priorDigestTokens - FIXED_RENDER_OVERHEAD_TOKENS);
     const providerSourceMap = request.providerIds === undefined ? buildProviderSourceMap(stageConfig.providerIds, request.extraProviderIds ?? []) : new Map;
     const allowedIds = request.providerIds ?? [...providerSourceMap.keys()];
@@ -54876,28 +55276,8 @@ class ContextOrchestrator {
     }));
     const allRaw = fetchResults.flatMap(({ provider, result }) => result.chunks.map((c) => enrichRaw(c, provider.id)));
     const providerResults = fetchResults.map(({ providerStatus }) => providerStatus);
-    if (request.priorStageDigest && (request.planDigestBoost ?? 1) > 1) {
-      const boost = request.planDigestBoost ?? 1;
-      const hash2 = createHash10("sha256").update(request.priorStageDigest).digest("hex").slice(0, 8);
-      const tokens = Math.ceil(request.priorStageDigest.length / 4);
-      allRaw.push({
-        id: `plan-digest:${hash2}`,
-        providerId: "plan-digest",
-        kind: "session",
-        scope: "session",
-        role: ["all"],
-        content: request.priorStageDigest,
-        tokens,
-        rawScore: 0.9 * boost
-      });
-      providerResults.push({
-        providerId: "plan-digest",
-        status: "ok",
-        source: undefined,
-        chunkCount: 1,
-        durationMs: 0,
-        tokensProduced: tokens
-      });
+    if (boostedDigest !== undefined) {
+      appendPlanDigestChunk(allRaw, providerResults, boostedDigest, request.planDigestBoost ?? 1);
     }
     assertUniqueChunkIds(allRaw, request);
     const allPullTools = agentProfile.caps.supportsToolCalls ? buildPullToolDescriptors(stageConfig.pullToolNames ?? [], request.pullConfig) : [];
@@ -54929,7 +55309,10 @@ class ContextOrchestrator {
         excludedNonFloorChunkCount: budgetExcludedIds.length
       });
     }
-    const renderOptions = { priorStageDigest: request.priorStageDigest };
+    const digestCarrier = resolveDigestCarrier(request, boostedDigest, packed);
+    const renderOptions = {
+      priorStageDigest: digestCarrier.renderPriorDigest
+    };
     const pushMarkdown = request.agentId !== undefined ? renderForAgent(packed, request.agentId, renderOptions) : renderChunks(packed, renderOptions);
     const digest = buildDigest(packed);
     const dTokens = digestTokens(digest);
@@ -54939,7 +55322,7 @@ class ContextOrchestrator {
     const staleIds = new Set(scored.filter((c) => c.staleCandidate === true).map((c) => c.id));
     const manifest = buildManifest({
       requestId,
-      request,
+      request: digestCarrier.manifestRequest,
       packed,
       usedTokens,
       digestTokens: dTokens,
@@ -55014,7 +55397,7 @@ var init_orchestrator = __esm(() => {
   init_stage_config();
   _orchestratorDeps = {
     now: () => Date.now(),
-    uuid: () => randomUUID11(),
+    uuid: () => randomUUID12(),
     getLogger: getLogger2,
     rebuild
   };
@@ -55607,7 +55990,7 @@ __export(exports_tracker, {
   saveRunMetrics: () => saveRunMetrics,
   toFallbackHops: () => toFallbackHops
 });
-import { rename as rename4 } from "fs/promises";
+import { rename as rename5 } from "fs/promises";
 import path5 from "path";
 function tokensFromSnapshot(snapshot, divisor = 1) {
   if (!snapshot || snapshot.tokenUsageCount !== snapshot.callCount)
@@ -55829,7 +56212,7 @@ async function loadExistingMetricsOrQuarantine(metricsPath) {
   } catch (err) {
     const quarantinePath = `${metricsPath}.corrupt-${new Date().toISOString().replace(/[:.]/g, "-")}`;
     try {
-      await rename4(metricsPath, quarantinePath);
+      await rename5(metricsPath, quarantinePath);
     } catch (renameErr) {
       getLogger2().warn("metrics", "Failed to quarantine corrupt metrics.json \u2014 leaving in place", {
         metricsPath,
@@ -56558,7 +56941,7 @@ function stripCarriageReturn(line) {
   return line.endsWith("\r") ? line.slice(0, -1) : line;
 }
 var CONSEQUENCE = "? nax will run this project's plugins, hooks, MCP servers and test commands.", _trustPromptDeps;
-var init_prompt = __esm(() => {
+var init_prompt2 = __esm(() => {
   _trustPromptDeps = {
     ask: async (question) => {
       process.stderr.write(question);
@@ -56597,8 +56980,8 @@ var init_registry4 = __esm(() => {
 });
 
 // src/trust/store.ts
-import { randomUUID as randomUUID12 } from "crypto";
-import { mkdir as mkdir18, rename as rename5, stat as stat8, unlink as unlink4, writeFile as writeFile10 } from "fs/promises";
+import { randomUUID as randomUUID13 } from "crypto";
+import { mkdir as mkdir18, rename as rename6, stat as stat8, unlink as unlink4, writeFile as writeFile9 } from "fs/promises";
 import { dirname as dirname20, isAbsolute as isAbsolute15, join as join48 } from "path";
 function trustStorePath() {
   return join48(globalConfigDir(), "trust.json");
@@ -56663,18 +57046,18 @@ async function removeFromStore(storePath, normalized) {
   return { outcome: "removed", entry };
 }
 async function readFoldersForWrite(storePath) {
-  const read = await readTrustStore();
-  if (read.state === "unparseable") {
-    throw trustStoreUnreadableError(storePath, read.reason);
+  const read2 = await readTrustStore();
+  if (read2.state === "unparseable") {
+    throw trustStoreUnreadableError(storePath, read2.reason);
   }
-  return read.state === "ok" ? read.file.folders : [];
+  return read2.state === "ok" ? read2.file.folders : [];
 }
 async function writeTrustStore(storePath, file2) {
-  const tempPath = `${storePath}.${process.pid}.${randomUUID12()}.tmp`;
+  const tempPath = `${storePath}.${process.pid}.${randomUUID13()}.tmp`;
   try {
-    await writeFile10(tempPath, `${JSON.stringify(file2, null, 2)}
+    await writeFile9(tempPath, `${JSON.stringify(file2, null, 2)}
 `, { mode: 384 });
-    await rename5(tempPath, storePath);
+    await rename6(tempPath, storePath);
   } finally {
     await unlink4(tempPath).catch(() => {});
   }
@@ -56746,7 +57129,7 @@ var _trustGateDeps;
 var init_gate = __esm(() => {
   init_errors4();
   init_match();
-  init_prompt();
+  init_prompt2();
   init_registry4();
   init_store2();
   _trustGateDeps = {
@@ -56759,7 +57142,7 @@ var init_gate = __esm(() => {
 var init_trust = __esm(() => {
   init_gate();
   init_match();
-  init_prompt();
+  init_prompt2();
   init_registry4();
   init_store2();
 });
@@ -56970,8 +57353,8 @@ var init_version = __esm(() => {
   NAX_AI_VERSION = CATALOG_VERSION;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("eab634ebe"))
-        return "eab634ebe";
+      if (/^[0-9a-f]{6,10}$/.test("eeb09eb"))
+        return "eeb09eb";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -58178,9 +58561,9 @@ async function readProjectIdentity(projectKey) {
     return null;
   }
 }
-async function writeProjectIdentity(projectKey, identity) {
+async function writeProjectIdentity(projectKey, identity2) {
   const p = identityPath(projectKey);
-  await Bun.write(p, JSON.stringify(identity, null, 2));
+  await Bun.write(p, JSON.stringify(identity2, null, 2));
 }
 async function claimProjectIdentity(projectKey, workdir, remoteUrl) {
   const existing2 = await readProjectIdentity(projectKey);
@@ -68748,7 +69131,7 @@ var require_cross_spawn = __commonJS(function(exports, module) {
   var cp = __require("child_process");
   var parse6 = require_parse();
   var enoent = require_enoent();
-  function spawn3(command, args, options) {
+  function spawn4(command, args, options) {
     const parsed = parse6(command, args, options);
     const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
     enoent.hookChildProcess(spawned, parsed);
@@ -68760,8 +69143,8 @@ var require_cross_spawn = __commonJS(function(exports, module) {
     result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
     return result;
   }
-  module.exports = spawn3;
-  module.exports.spawn = spawn3;
+  module.exports = spawn4;
+  module.exports.spawn = spawn4;
   module.exports.sync = spawnSync;
   module.exports._parse = parse6;
   module.exports._enoent = enoent;
@@ -69061,7 +69444,7 @@ var init_client4 = __esm(() => {
 
 // src/mcp/lock.ts
 import { createHash as createHash17 } from "crypto";
-import { mkdir as mkdir22, readFile as readFile9, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir22, readFile as readFile9, writeFile as writeFile10 } from "fs/promises";
 import { join as join55 } from "path";
 function mcpLockPath(projectRoot) {
   return join55(projectRoot, PROJECT_NAX_DIR, MCP_LOCK_FILENAME);
@@ -69093,7 +69476,7 @@ async function writeMcpLock(projectRoot, lock) {
     Object.fromEntries(Object.entries(tools2).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))
   ]));
   await mkdir22(join55(projectRoot, PROJECT_NAX_DIR), { recursive: true });
-  await writeFile11(mcpLockPath(projectRoot), `${JSON.stringify({ version: 1, servers }, null, 2)}
+  await writeFile10(mcpLockPath(projectRoot), `${JSON.stringify({ version: 1, servers }, null, 2)}
 `);
 }
 function applyLock(locked, discovered) {
@@ -69262,9 +69645,9 @@ function createMcpProviders(args) {
     return [];
   for (const [id] of servers)
     validateProviderId(id);
-  const read = args.readLock ?? readMcpLock;
+  const read2 = args.readLock ?? readMcpLock;
   let lockPromise;
-  const lock = () => lockPromise ??= read(args.projectRoot);
+  const lock = () => lockPromise ??= read2(args.projectRoot);
   return servers.map(([serverId, server]) => {
     return {
       id: serverId,
@@ -69314,7 +69697,7 @@ var init_provider = __esm(() => {
 });
 
 // src/mcp/rollup.ts
-import { mkdir as mkdir23, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir23, writeFile as writeFile11 } from "fs/promises";
 import { join as join56 } from "path";
 function buildMcpRollup(args) {
   const byServer = new Map;
@@ -69347,7 +69730,7 @@ async function writeMcpRollup(outputDir, rollup) {
     return;
   const dir = join56(outputDir, "mcp");
   await mkdir23(dir, { recursive: true });
-  await writeFile12(join56(dir, `${rollup.runId}-servers.json`), `${JSON.stringify(rollup, null, 2)}
+  await writeFile11(join56(dir, `${rollup.runId}-servers.json`), `${JSON.stringify(rollup, null, 2)}
 `);
 }
 var init_rollup = () => {};
@@ -69510,7 +69893,7 @@ var init_executor = __esm(() => {
   init_bun_deps();
   init_trust();
   init_internal();
-  _executorDeps = { spawn };
+  _executorDeps = { spawn: spawn2 };
   DRAIN_TIMEOUT3 = Symbol("drain-timeout");
   DEFAULT_STRIP_ENV_VARS = [];
 });
@@ -70576,7 +70959,7 @@ ${r.output}`).join(""),
 }
 
 // src/quality/runner.ts
-var {spawn: spawn4 } = globalThis.Bun;
+var {spawn: spawn5 } = globalThis.Bun;
 function createDrainDeadline(deadlineMs) {
   let timeoutId;
   const promise3 = new Promise((resolve31) => {
@@ -70750,7 +71133,7 @@ var init_runner = __esm(() => {
   init_trust();
   init_executor();
   _qualityRunnerDeps = {
-    spawn: spawn4
+    spawn: spawn5
   };
 });
 
@@ -73076,7 +73459,7 @@ var init_runners = __esm(() => {
 
 // src/verification/test-baseline.ts
 import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir24, readdir as readdir6, rm as rm7 } from "fs/promises";
+import { mkdir as mkdir24, readdir as readdir6, rm as rm8 } from "fs/promises";
 import { join as join65 } from "path";
 function runBaselinePath(root, featureId) {
   return join65(featureDir(root, featureId), RUN_BASELINE_FILENAME);
@@ -73106,7 +73489,7 @@ async function clearStoryBaselines(root, featureId) {
       return [];
     throw err;
   });
-  await Promise.all(entries.filter((entry) => entry.isDirectory()).map((entry) => rm7(join65(storiesDir, entry.name, STORY_BASELINE_FILENAME), { force: true })));
+  await Promise.all(entries.filter((entry) => entry.isDirectory()).map((entry) => rm8(join65(storiesDir, entry.name, STORY_BASELINE_FILENAME), { force: true })));
 }
 async function resolveStoryBaseline(root, featureId, storyId, executionMode) {
   if (executionMode === "parallel") {
@@ -74378,12 +74761,13 @@ async function performAdversarialReground(turn, firstParsed, drops, ctx) {
   const secondParsed = validateAdversarialShape(tryParseLLMJson(secondTurn.output));
   const costUsd = (turn.estimatedCostUsd ?? 0) + (secondTurn.estimatedCostUsd ?? 0);
   const dropCount = drops.length;
-  if (!secondParsed) {
-    return {
-      ...turn,
-      output: withRepromptMarker(turn.output, { dropCount, outcome: "parse-failed", costUsd })
-    };
-  }
+  const keepFirstTurn = (outcome) => ({
+    ...turn,
+    output: withRepromptMarker(turn.output, { dropCount, outcome, costUsd }),
+    estimatedCostUsd: costUsd
+  });
+  if (!secondParsed)
+    return keepFirstTurn("parse-failed");
   const { accepted: secondAccepted } = filterByAcQuote(secondParsed.findings, acceptanceCriteria);
   const secondBlocking = secondAccepted.filter((f) => isBlockingSeverity(f.severity, threshold));
   if (secondBlocking.length > 0) {
@@ -74411,10 +74795,7 @@ async function performAdversarialReground(turn, firstParsed, drops, ctx) {
       estimatedCostUsd: costUsd
     };
   }
-  return {
-    ...turn,
-    output: withRepromptMarker(turn.output, { dropCount, outcome: "still-dropped", costUsd })
-  };
+  return keepFirstTurn("still-dropped");
 }
 async function maybeRepromptForInspection(turn, parsed, rawObject, ctx) {
   if (ctx.input.adversarialConfig.demandInspectionTrail === false)
@@ -77560,7 +77941,7 @@ ${detail}`,
 `);
 }
 var CLASSIFIER;
-var init_prompt2 = __esm(() => {
+var init_prompt3 = __esm(() => {
   CLASSIFIER = [
     "Mark a finding for human judgment \u2014 and only such a finding \u2014 by adding a",
     "`Judgment: yes \u2014 <why>` line to its block. Use it when the finding is a spec",
@@ -77575,7 +77956,7 @@ var init_prompt2 = __esm(() => {
 var init_review = __esm(() => {
   init_audit_gaps();
   init_parse6();
-  init_prompt2();
+  init_prompt3();
 });
 
 // src/operations/finish-fix.ts
@@ -77943,7 +78324,7 @@ var init_scope = __esm(() => {
 });
 
 // src/review/fix-review/tree-snapshot/index.ts
-import { mkdtemp as mkdtemp2, rm as rm8 } from "fs/promises";
+import { mkdtemp as mkdtemp2, rm as rm9 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join69 } from "path";
 async function runGit(args, cwd, indexOverlay, timeoutMs = _treeSnapshotDeps.gitTimeoutMs) {
@@ -78030,7 +78411,7 @@ var init_tree_snapshot = __esm(() => {
     spawn: typedSpawn,
     gitTimeoutMs: TREE_SNAPSHOT_GIT_TIMEOUT_MS,
     mkdtemp: mkdtemp2,
-    rm: rm8,
+    rm: rm9,
     tmpdir: tmpdir6
   };
 });
@@ -78266,7 +78647,7 @@ var init_new_package_setup = __esm(() => {
   init_trust();
   init_command_argv();
   registry4 = new WeakMap;
-  _newPackageSetupDeps = { spawn };
+  _newPackageSetupDeps = { spawn: spawn2 };
 });
 
 // src/operations/gate-cwd.ts
@@ -78707,7 +79088,7 @@ var init_isolation2 = __esm(() => {
   init_errors4();
   init_logger2();
   init_test_runners();
-  _isolationDeps = { spawn, timeoutMs: GIT_TIMEOUT_MS3 };
+  _isolationDeps = { spawn: spawn2, timeoutMs: GIT_TIMEOUT_MS3 };
   SRC_PATTERNS = [/^src\//, /^lib\//, /^packages\//];
 });
 
@@ -79147,33 +79528,62 @@ function parseHeaderPath(rawLine, precededByMinusHeader) {
 function isMinusHeader(rawLine) {
   return rawLine.startsWith("--- ");
 }
-function extractDiffLineRanges(diff) {
-  const ranges = new Map;
-  if (!diff)
-    return ranges;
-  let currentPath = null;
+function bodyLineCost(line) {
+  if (line === "" || line.startsWith(" "))
+    return { old: 1, new: 1 };
+  if (line.startsWith("-"))
+    return { old: 1, new: 0 };
+  if (line.startsWith("+"))
+    return { old: 0, new: 1 };
+  if (line.startsWith("\\"))
+    return { old: 0, new: 0 };
+  return null;
+}
+function* scanDiff(diff) {
+  let oldLeft = 0;
+  let newLeft = 0;
   let prevWasMinusHeader = false;
   for (const rawLine of diff.split(/\r?\n/)) {
+    if (oldLeft > 0 || newLeft > 0) {
+      const cost = bodyLineCost(rawLine);
+      if (cost !== null) {
+        oldLeft = Math.max(0, oldLeft - cost.old);
+        newLeft = Math.max(0, newLeft - cost.new);
+        continue;
+      }
+      oldLeft = 0;
+      newLeft = 0;
+    }
     const wasMinusHeader = prevWasMinusHeader;
     prevWasMinusHeader = isMinusHeader(rawLine);
     if (rawLine.startsWith(HEADER_PREFIX_NOPREFIX)) {
       const path9 = parseHeaderPath(rawLine, wasMinusHeader);
       if (path9 !== null || rawLine.startsWith(HEADER_PREFIX) || wasMinusHeader)
-        currentPath = path9;
+        yield { kind: "header", path: path9 };
       continue;
     }
-    if (!currentPath)
-      continue;
     const match = HUNK_REGEX.exec(rawLine);
     if (!match)
       continue;
-    const newStart = Number(match[3]);
-    const newCount = match[4] === undefined ? 1 : Number(match[4]);
-    if (newCount <= 0)
+    oldLeft = match[2] === undefined ? 1 : Number(match[2]);
+    newLeft = match[4] === undefined ? 1 : Number(match[4]);
+    yield { kind: "hunk", start: Number(match[3]), count: newLeft };
+  }
+}
+function extractDiffLineRanges(diff) {
+  const ranges = new Map;
+  if (!diff)
+    return ranges;
+  let currentPath = null;
+  for (const event of scanDiff(diff)) {
+    if (event.kind === "header") {
+      currentPath = event.path;
+      continue;
+    }
+    if (!currentPath || event.count <= 0)
       continue;
     const entry = ranges.get(currentPath) ?? [];
-    entry.push({ start: newStart, end: newStart + newCount - 1 });
-    ranges.set(currentPath, entry);
+    ranges.set(currentPath, [...entry, { start: event.start, end: event.start + event.count - 1 }]);
   }
   return ranges;
 }
@@ -80108,12 +80518,13 @@ async function performSemanticReground(turn, firstParsed, drops, ctx) {
   const secondParsed = validateLLMShape(tryParseLLMJson(secondTurn.output));
   const costUsd = (turn.estimatedCostUsd ?? 0) + (secondTurn.estimatedCostUsd ?? 0);
   const dropCount = drops.length;
-  if (!secondParsed) {
-    return {
-      ...turn,
-      output: withRepromptMarker2(turn.output, { dropCount, outcome: "parse-failed", costUsd })
-    };
-  }
+  const keepFirstTurn = (outcome) => ({
+    ...turn,
+    output: withRepromptMarker2(turn.output, { dropCount, outcome, costUsd }),
+    estimatedCostUsd: costUsd
+  });
+  if (!secondParsed)
+    return keepFirstTurn("parse-failed");
   const { accepted: secondAccepted } = filterByAcGroundingMinimal(secondParsed.findings, acceptanceCriteria);
   const secondBlocking = secondAccepted.filter((f) => isBlockingSeverity(f.severity, threshold));
   if (secondBlocking.length > 0) {
@@ -80141,10 +80552,7 @@ async function performSemanticReground(turn, firstParsed, drops, ctx) {
       estimatedCostUsd: costUsd
     };
   }
-  return {
-    ...turn,
-    output: withRepromptMarker2(turn.output, { dropCount, outcome: "still-dropped", costUsd })
-  };
+  return keepFirstTurn("still-dropped");
 }
 async function requoteBlockingFindings(findings, ctx) {
   const threshold = ctx.input.blockingThreshold ?? "error";
@@ -82313,9 +82721,10 @@ function resolveHopCompleteOptions(options, currentAgent, primaryAgent, tier, mo
     return { ...options, modelDef: resolveModel(model) };
   return { ...options, modelDef: options.modelDefFor?.(currentAgent, tier) ?? options.modelDef };
 }
-function resolveFinalDispatch(options, primaryAgent, fallbacks, finalTier) {
+function resolveFinalDispatch(options, primaryAgent, outcome) {
+  const { fallbacks, finalTier, finalTarget } = outcome;
   const agentName = fallbacks.at(-1)?.newAgent ?? primaryAgent;
-  const hopOptions = resolveHopCompleteOptions(options, agentName, primaryAgent, finalTier);
+  const hopOptions = resolveHopCompleteOptions(options, agentName, primaryAgent, finalTier, finalTarget?.model);
   return { agentName, options: finalTier !== undefined ? { ...hopOptions, modelTier: finalTier } : hopOptions };
 }
 function buildFallbackRecord(input) {
@@ -83102,8 +83511,15 @@ function parseForm(request) {
   const fields = entries.map(([key, property]) => fieldOf(key, property, required2.has(key)));
   return fields.every((field) => field !== undefined) ? { ok: true, fields: withCompanions(fields) } : REFUSED;
 }
+function ownAnswerHint(field) {
+  if (field.companion === undefined)
+    return "";
+  if (!field.required)
+    return ", or type your own answer";
+  return field.kind === "multi" ? "; you may add your own after at least one choice" : "";
+}
 function instruction(field) {
-  const own = field.companion === undefined ? "" : ", or type your own answer";
+  const own = ownAnswerHint(field);
   const skip = field.required ? "" : " Leave empty to skip.";
   if (field.kind === "single")
     return `Reply with one number or choice${own}.${skip}`;
@@ -87893,7 +88309,7 @@ function contentText(content) {
   return content.map(contentPart).filter((part) => part !== "").join(`
 `);
 }
-function previewOf2(call2, secrets) {
+function previewOf(call2, secrets) {
   const fromContent = contentText(call2.content);
   let raw = fromContent;
   if (raw === "" && typeof call2.rawOutput === "string")
@@ -87968,7 +88384,7 @@ function createToolEvents(emit, secrets, now = Date.now) {
         running.add(state.id);
       const shown2 = announce(state);
       if (status !== "in_progress")
-        resolve35(shown2, status === "failed", previewOf2(shown2, secrets), resultBytesOf(shown2));
+        resolve35(shown2, status === "failed", previewOf(shown2, secrets), resultBytesOf(shown2));
     },
     announce(toolCall) {
       const state = merge2(toolCall);
@@ -88383,7 +88799,7 @@ function race(promise3, opts) {
 }
 
 // ../nax-agent-acp/src/client/launch.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { accessSync as accessSync3, constants as constants3, statSync as statSync8 } from "fs";
 import { delimiter as delimiter2, isAbsolute as isAbsolute25, join as join73 } from "path";
 import { Readable as Readable2, Writable } from "stream";
@@ -88428,7 +88844,7 @@ function failedLaunch(stderr, error48) {
 }
 function trySpawn(request) {
   try {
-    return spawn5(request.command, [...request.args], {
+    return spawn6(request.command, [...request.args], {
       cwd: request.cwd,
       env: { ...request.env },
       stdio: "pipe",
@@ -92293,7 +92709,7 @@ var init_turn_interactions = __esm(() => {
 });
 
 // src/agents/interaction/index.ts
-var init_interaction = __esm(() => {
+var init_interaction2 = __esm(() => {
   init_output_parsing();
   init_turn_interactions();
 });
@@ -92350,7 +92766,7 @@ function createAskPort(slot, beatMs = AWAITING_HUMAN_BEAT_MS, audit) {
 var STAGE = "acp", AWAITING_HUMAN_BEAT_MS = 30000;
 var init_ask_port = __esm(() => {
   init_logger2();
-  init_interaction();
+  init_interaction2();
 });
 
 // src/agents/acp/profile-map.ts
@@ -92762,7 +93178,7 @@ var init_prompt_retry = __esm(() => {
 });
 
 // src/agents/acp/stream-bridge.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function toolUpdate(toolName) {
   return toolName === undefined ? { kind: "agent.tool_call_update" } : { kind: "agent.tool_call_update", toolName };
 }
@@ -92815,7 +93231,7 @@ function sender(ctx) {
   };
 }
 function startCall(ctx, now = Date.now) {
-  const callId = randomUUID13();
+  const callId = randomUUID14();
   const send = sender(ctx);
   const base = {
     callId,
@@ -92864,7 +93280,7 @@ var init_stream_bridge = __esm(() => {
 });
 
 // src/agents/acp/turn-loop.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 function used(state) {
   return state.turnCount + state.asked;
 }
@@ -92955,7 +93371,7 @@ async function runIteration(loop) {
   }
   const timer = armDeadline(controller, loop.deadline.remainingMs());
   const call2 = startCall(session2.stream);
-  const turnId = opts.turnId ?? randomUUID14();
+  const turnId = opts.turnId ?? randomUUID15();
   try {
     session2.opts.onActiveCall?.(call2.callId, async () => controller.abort(new WatchdogCancel));
     session2.slot.set({
@@ -93088,7 +93504,7 @@ var init_turn_loop2 = __esm(() => {
   init_src();
   init_errors4();
   init_logger2();
-  init_interaction();
+  init_interaction2();
   init_turn();
   init_failure_map();
   init_pricing();
@@ -93908,7 +94324,7 @@ class AgentManager {
         sessionName,
         prompt,
         response: outcome.result.output,
-        ...resolveFinalDispatch(augmented, agentName, outcome.fallbacks, outcome.finalTier),
+        ...resolveFinalDispatch(augmented, agentName, outcome),
         stage,
         resolvedPermissions,
         tokenUsage: outcome.result.tokenUsage,
@@ -94239,17 +94655,17 @@ function formatEntryBlock(entry2) {
   const commandLines = lines2.map((line, index) => index === 0 ? `${ENTRY_INDENT}$ ${line}` : `${COMMAND_CONTINUATION_INDENT}${line}`);
   return [header, rootLine, ...commandLines];
 }
-function toListJson(path10, read) {
-  const taint = read.file.taint === undefined ? null : read.file.taint;
-  const entries = read.file.entries.map((entry2) => ({
+function toListJson(path10, read2) {
+  const taint = read2.file.taint === undefined ? null : read2.file.taint;
+  const entries = read2.file.entries.map((entry2) => ({
     ...entry2,
     id: approvalId(entry2)
   }));
   return {
     path: path10,
-    state: read.state,
+    state: read2.state,
     taint,
-    droppedMalformed: read.droppedMalformed,
+    droppedMalformed: read2.droppedMalformed,
     entries
   };
 }
@@ -94293,12 +94709,12 @@ async function promptForConfirmation(question) {
       resolve36(answer);
     };
     const onData = (char) => {
-      if (char === ETX) {
+      if (char === ETX2) {
         finish(false);
         _confirmDeps.exit(SIGINT_EXIT_CODE);
         return;
       }
-      if (char === EOT) {
+      if (char === EOT2) {
         finish(false);
         return;
       }
@@ -94310,7 +94726,7 @@ async function promptForConfirmation(question) {
     stdin.once("error", onClosed);
   });
 }
-var ETX = "\x03", EOT = "\x04", SIGINT_EXIT_CODE = 130, _confirmDeps;
+var ETX2 = "\x03", EOT2 = "\x04", SIGINT_EXIT_CODE = 130, _confirmDeps;
 var init_confirm = __esm(() => {
   init_source();
   _confirmDeps = {
@@ -94331,26 +94747,26 @@ async function resolveApprovalsFile(workdir) {
 async function approvalsListCommand(opts, deps = _approvalsCliDeps) {
   try {
     const path10 = await resolveApprovalsFile(opts.workdir);
-    const read = await deps.readApprovalsFileDetailed(path10);
+    const read2 = await deps.readApprovalsFileDetailed(path10);
     if (opts.json) {
-      deps.log(JSON.stringify(toListJson(path10, read)));
-      if (read.state === "unparseable")
+      deps.log(JSON.stringify(toListJson(path10, read2)));
+      if (read2.state === "unparseable")
         deps.logErr(PARSE_WARNING);
       return 0;
     }
-    if (read.state === "missing") {
+    if (read2.state === "missing") {
       deps.log(missingNotice(path10));
       return 0;
     }
-    if (read.state === "unparseable") {
+    if (read2.state === "unparseable") {
       deps.logErr(PARSE_WARNING);
       deps.log(missingNotice(path10));
       return 0;
     }
-    const entries = read.file.entries;
-    const taint = read.file.taint;
-    if (read.droppedMalformed > 0)
-      deps.logErr(malformedEntriesWarning(read.droppedMalformed));
+    const entries = read2.file.entries;
+    const taint = read2.file.taint;
+    if (read2.droppedMalformed > 0)
+      deps.logErr(malformedEntriesWarning(read2.droppedMalformed));
     deps.log(`Approvals store: ${path10}`);
     deps.log(formatTrustLine(taint, deps.isProcessAlive));
     deps.log(`${entries.length} remembered approvals`);
@@ -94372,12 +94788,12 @@ async function runPrecheck(opts, deps) {
   try {
     const path10 = await resolveApprovalsFile(opts.workdir);
     if (opts.all) {
-      const read = await deps.readApprovalsFileDetailed(path10);
-      if (read.state === "missing" || read.state === "ok" && read.file.entries.length === 0) {
+      const read2 = await deps.readApprovalsFileDetailed(path10);
+      if (read2.state === "missing" || read2.state === "ok" && read2.file.entries.length === 0) {
         deps.log(missingNotice(path10));
         return { kind: "empty", path: path10 };
       }
-      if (read.state === "unparseable") {
+      if (read2.state === "unparseable") {
         deps.logErr("approvals.json could not be parsed; not rewriting it");
         return { kind: "unparseable", path: path10 };
       }
@@ -94672,227 +95088,9 @@ var init_auth_list = __esm(() => {
   init_config();
 });
 
-// src/cli/auth-prompt.ts
-function read(message, echo, onEmptySubmit) {
-  const { stdin } = _authPromptDeps;
-  if (stdin.isTTY !== true)
-    return Promise.reject(new PromptCancelledError);
-  _authPromptDeps.write(`${source_default.cyan("?")} ${message} `);
-  return new Promise((resolve36, reject) => {
-    let buffer = "";
-    let settled2 = false;
-    const cleanup = () => {
-      if (settled2)
-        return;
-      settled2 = true;
-      stdin.removeListener("data", onData);
-      stdin.removeListener("end", onEnd);
-      stdin.removeListener("error", onEnd);
-      stdin.setRawMode(false);
-      stdin.pause();
-      _authPromptDeps.write(`
-`);
-    };
-    const onEnd = () => {
-      cleanup();
-      reject(new PromptCancelledError);
-    };
-    const onData = (chunk) => {
-      for (const char of chunk) {
-        if (char === ETX2 || char === EOT2) {
-          cleanup();
-          reject(new PromptCancelledError);
-          return;
-        }
-        if (char === CR || char === LF) {
-          if (buffer.length === 0 && onEmptySubmit !== undefined) {
-            onEmptySubmit();
-            continue;
-          }
-          cleanup();
-          resolve36(buffer);
-          return;
-        }
-        if (char === BACKSPACE) {
-          buffer = buffer.slice(0, -1);
-          if (echo)
-            _authPromptDeps.write("\b \b");
-          continue;
-        }
-        buffer += char;
-        if (echo)
-          _authPromptDeps.write(char);
-      }
-    };
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding("utf8");
-    stdin.on("data", onData);
-    stdin.once("end", onEnd);
-    stdin.once("error", onEnd);
-  });
-}
-function promptForSecret(message) {
-  return read(message, false);
-}
-function promptForLine(message, onEmptySubmit) {
-  return read(message, true, onEmptySubmit);
-}
-function promptForSelect(message, choices) {
-  const { stdin } = _authPromptDeps;
-  if (stdin.isTTY !== true)
-    return Promise.reject(new PromptCancelledError);
-  if (choices.length === 0)
-    return Promise.reject(new PromptCancelledError);
-  _authPromptDeps.write(`${source_default.cyan("?")} ${message}
-`);
-  return new Promise((resolve36, reject) => {
-    let index = 0;
-    let settled2 = false;
-    let drawn = false;
-    const render3 = () => {
-      if (drawn)
-        _authPromptDeps.write(`\x1B[${choices.length}A`);
-      drawn = true;
-      for (const [i, choice] of choices.entries()) {
-        const active = i === index;
-        const marker = active ? source_default.cyan(">") : " ";
-        const label2 = active ? source_default.cyan(choice.label) : choice.label;
-        _authPromptDeps.write(`\r\x1B[2K${marker} ${label2}
-`);
-      }
-    };
-    const cleanup = () => {
-      if (settled2)
-        return;
-      settled2 = true;
-      stdin.removeListener("data", onData);
-      stdin.removeListener("end", onEnd);
-      stdin.removeListener("error", onEnd);
-      stdin.setRawMode(false);
-      stdin.pause();
-    };
-    const onEnd = () => {
-      cleanup();
-      reject(new PromptCancelledError);
-    };
-    const onData = (chunk) => {
-      if (chunk.includes(ETX2) || chunk.includes(EOT2)) {
-        cleanup();
-        reject(new PromptCancelledError);
-        return;
-      }
-      if (chunk.includes(ARROW_UP)) {
-        index = (index - 1 + choices.length) % choices.length;
-        render3();
-        return;
-      }
-      if (chunk.includes(ARROW_DOWN)) {
-        index = (index + 1) % choices.length;
-        render3();
-        return;
-      }
-      if (chunk.includes(CR) || chunk.includes(LF)) {
-        const chosen = choices[index];
-        cleanup();
-        resolve36(chosen.id);
-      }
-    };
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding("utf8");
-    stdin.on("data", onData);
-    stdin.once("end", onEnd);
-    stdin.once("error", onEnd);
-    render3();
-  });
-}
-var ETX2 = "\x03", EOT2 = "\x04", CR = "\r", LF = `
-`, BACKSPACE = "\x7F", ARROW_UP = "\x1B[A", ARROW_DOWN = "\x1B[B", PromptCancelledError, _authPromptDeps;
-var init_auth_prompt = __esm(() => {
-  init_source();
-  PromptCancelledError = class PromptCancelledError extends Error {
-    constructor() {
-      super("Prompt cancelled");
-      this.name = "PromptCancelledError";
-    }
-  };
-  _authPromptDeps = {
-    stdin: process.stdin,
-    write: (text) => process.stdout.write(text)
-  };
-});
-
-// src/cli/open-url.ts
-function openerFor(platform, url2) {
-  if (platform === "darwin")
-    return ["open", url2];
-  if (platform === "win32")
-    return ["cmd", "/c", "start", "", url2];
-  return ["xdg-open", url2];
-}
-function openUrl(url2) {
-  try {
-    _openUrlDeps.spawn(openerFor(_openUrlDeps.platform(), url2));
-  } catch {}
-}
-var _openUrlDeps;
-var init_open_url = __esm(() => {
-  _openUrlDeps = {
-    spawn: (command2) => {
-      Bun.spawn([...command2], { stdin: "ignore", stdout: "ignore", stderr: "ignore" });
-    },
-    platform: () => process.platform
-  };
-});
-
 // src/cli/auth.ts
 function terminalInteraction() {
-  let pendingUrl;
-  return {
-    prompt: async (prompt) => {
-      if (prompt.type === "manual-code") {
-        const url2 = pendingUrl;
-        if (url2 === undefined)
-          return promptForLine(prompt.message);
-        pendingUrl = undefined;
-        _cliAuthDeps.log(source_default.dim("Press Enter to open it in your browser."));
-        return promptForLine(prompt.message, () => {
-          _cliAuthDeps.log(source_default.dim("Opening your browser..."));
-          openUrl(url2);
-        });
-      }
-      if (prompt.type === "text")
-        return promptForLine(prompt.message);
-      if (prompt.type === "select") {
-        return promptForSelect(prompt.message, prompt.options.map((option) => ({ id: option.id, label: option.label })));
-      }
-      return promptForSecret(prompt.message);
-    },
-    notify: (event) => {
-      switch (event.type) {
-        case "auth-url":
-          _cliAuthDeps.log(`
-${source_default.bold("Open this URL to continue:")}
-  ${event.url}`);
-          pendingUrl = event.url;
-          return;
-        case "device-code":
-          _cliAuthDeps.log(`
-Go to ${event.verificationUri} and enter code ${source_default.bold(event.userCode)}`);
-          return;
-        case "info":
-          _cliAuthDeps.log(event.message);
-          for (const link2 of event.links ?? [])
-            _cliAuthDeps.log(`  ${link2.label ?? "Link"}: ${link2.url}`);
-          return;
-        case "progress":
-          _cliAuthDeps.log(source_default.dim(event.message));
-          return;
-        default:
-      }
-    }
-  };
+  return createTerminalAuthInteraction({ log: (text) => _cliAuthDeps.log(text), style: CHALK_STYLE });
 }
 async function authLoginCommand(providerId, method) {
   if (!_cliAuthDeps.isTTY()) {
@@ -94989,19 +95187,18 @@ async function authRmCommand(providerId) {
     return 1;
   }
 }
-var _cliAuthDeps;
+var _cliAuthDeps, CHALK_STYLE;
 var init_auth3 = __esm(() => {
   init_src();
   init_source();
   init_config();
   init_auth_list();
-  init_auth_prompt();
-  init_open_url();
   _cliAuthDeps = {
     log: (text) => console.log(text),
     isTTY: () => process.stdin.isTTY === true,
     collectAuthList
   };
+  CHALK_STYLE = { accent: source_default.cyan, dim: source_default.dim, bold: source_default.bold };
 });
 
 // src/cli/config-diff.ts
@@ -95168,7 +95365,7 @@ var init_config_descriptions = __esm(() => {
     "quality.stripEnvVars": "Environment variables to strip during verification",
     tdd: "Test-driven development configuration",
     "tdd.maxRetries": "Max retries per TDD session before escalating",
-    "tdd.strategy": "TDD strategy: auto | strict | lite | off",
+    "tdd.strategy": 'TDD strategy: auto | strict | lite | off | simple ("tdd-simple" is accepted for simple)',
     "tdd.sessionTiers": "Per-session model tier overrides",
     "tdd.sessionTiers.testWriter": "Model tier for test-writer session",
     "tdd.sessionTiers.implementer": "Ignored by design \u2014 implementer follows story.routing.modelTier + escalation, not this field. Kept optional so legacy configs still parse.",
@@ -97921,7 +98118,7 @@ var init_triggers = __esm(() => {
 });
 
 // src/interaction/index.ts
-var init_interaction2 = __esm(() => {
+var init_interaction3 = __esm(() => {
   init_ask_link();
   init_bridge_builder();
   init_chain();
@@ -97997,7 +98194,7 @@ var _configJsonDeps;
 var init_config_json = __esm(() => {
   init_internal();
   init_config();
-  init_interaction2();
+  init_interaction3();
   init_config_display();
   init_config_profile();
   init_config_requirements();
@@ -98902,8 +99099,41 @@ var init_fix_diagnosis = __esm(() => {
   init_import_resolution();
 });
 
+// src/utils/drain-within.ts
+async function drainWithin(drain, deadlineMs) {
+  let timer;
+  const expired = new Promise((resolve37) => {
+    timer = setTimeout(() => resolve37(""), deadlineMs);
+  });
+  try {
+    return await Promise.race([drain, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/acceptance/hardening.ts
 import path12 from "path";
+async function awaitExitAndDrain(proc, timers) {
+  const stdoutDrain = new Response(proc.stdout).text().catch(() => "");
+  const stderrDrain = new Response(proc.stderr).text().catch(() => "");
+  let exitCode;
+  let output;
+  try {
+    exitCode = await proc.exited;
+    const [stdout, stderr] = await Promise.all([
+      drainWithin(stdoutDrain, _hardeningDeps.drainTimeoutMs),
+      drainWithin(stderrDrain, _hardeningDeps.drainTimeoutMs)
+    ]);
+    output = `${stdout}
+${stderr}`;
+  } finally {
+    clearTimeout(timers.killTimer);
+    if (timers.sigkillTimer)
+      clearTimeout(timers.sigkillTimer);
+  }
+  return { exitCode, output };
+}
 async function processPackageGroup(ctx, packageDir, groupStories, language, result) {
   await assertTrusted(packageDir, "acceptance-command");
   const logger = getSafeLogger2();
@@ -98986,30 +99216,23 @@ async function processPackageGroup(ctx, packageDir, groupStories, language, resu
     detached: true
   });
   let exitedBeforeSigkill = false;
-  let sigkillTimer;
   proc.exited.then(() => {
     exitedBeforeSigkill = true;
   }).catch(() => {});
   const timeoutMs = config2.acceptance?.timeoutMs ?? DEFAULT_HARDENING_TIMEOUT_MS;
-  const killTimer = setTimeout(() => {
-    killProcessGroup(proc.pid, "SIGTERM");
-    sigkillTimer = setTimeout(() => {
-      sigkillTimer = undefined;
-      if (!exitedBeforeSigkill) {
-        killProcessGroup(proc.pid, "SIGKILL");
-      }
-    }, HARDENING_SIGKILL_GRACE_PERIOD_MS);
-  }, timeoutMs);
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text().catch(() => ""),
-    new Response(proc.stderr).text().catch(() => "")
-  ]);
-  clearTimeout(killTimer);
-  if (sigkillTimer)
-    clearTimeout(sigkillTimer);
-  const output = `${stdout}
-${stderr}`;
+  const timers = {
+    killTimer: setTimeout(() => {
+      killProcessGroup(proc.pid, "SIGTERM");
+      timers.sigkillTimer = setTimeout(() => {
+        timers.sigkillTimer = undefined;
+        if (!exitedBeforeSigkill) {
+          killProcessGroup(proc.pid, "SIGKILL");
+        }
+      }, HARDENING_SIGKILL_GRACE_PERIOD_MS);
+    }, timeoutMs),
+    sigkillTimer: undefined
+  };
+  const { exitCode, output } = await awaitExitAndDrain(proc, timers);
   const failedACs = parseTestFailures(output);
   const failedSet = new Set(failedACs.map((ac) => ac.toUpperCase()));
   if (exitCode !== 0 && failedACs.length === 0) {
@@ -99114,19 +99337,59 @@ var init_hardening = __esm(() => {
     writeFile: async (p, c) => {
       await Bun.write(p, c);
     },
-    detectLanguage
+    detectLanguage,
+    drainTimeoutMs: 2000
   };
 });
 
+// src/acceptance/override-keys.ts
+import { relative as relative26 } from "path";
+function scopedOverrideKey(workdir, packageDir, acId) {
+  return `${relative26(workdir, packageDir) || "."}${OVERRIDE_SCOPE_SEPARATOR}${acId}`;
+}
+function definingPackageCount(acId, counts) {
+  const n = Number(NUMBERED_AC.exec(acId)?.[1] ?? 0);
+  if (n < 1)
+    return 0;
+  return [...counts.values()].filter((count2) => count2 >= n).length;
+}
+function createOverrideLookup(opts) {
+  const table = opts.overrides ?? {};
+  const reported = new Set;
+  return {
+    reasonFor(packageDir, acId) {
+      const scoped2 = table[scopedOverrideKey(opts.workdir, packageDir, acId)];
+      if (scoped2 !== undefined)
+        return scoped2;
+      const bare = table[acId];
+      if (bare === undefined || !opts.multiPackage)
+        return bare;
+      if (definingPackageCount(acId, opts.acCountByPackageDir) === 1)
+        return bare;
+      if (!reported.has(acId)) {
+        reported.add(acId);
+        opts.onIgnoredBareKey(acId);
+      }
+      return;
+    }
+  };
+}
+var OVERRIDE_SCOPE_SEPARATOR = "::", NUMBERED_AC;
+var init_override_keys = __esm(() => {
+  NUMBERED_AC = /^AC-(\d+)$/;
+});
+
 // src/acceptance/index.ts
 var exports_acceptance = {};
 __export(exports_acceptance, {
+  OVERRIDE_SCOPE_SEPARATOR: () => OVERRIDE_SCOPE_SEPARATOR,
   _acceptanceExecutionDeps: () => _acceptanceExecutionDeps,
   _groupDeps: () => _groupDeps,
   acceptanceTestFilename: () => acceptanceTestFilename2,
   buildAcceptanceRunCommand: () => buildAcceptanceRunCommand,
   buildAcceptanceTestPrompt: () => buildAcceptanceTestPrompt,
   checkAcceptanceCoverage: () => checkAcceptanceCoverage,
+  createOverrideLookup: () => createOverrideLookup,
   effectiveAcceptanceFramework: () => effectiveAcceptanceFramework,
   findExistingAcceptanceTestPath: () => findExistingAcceptanceTestPath,
   findMissingAcceptanceTestPaths: () => findMissingAcceptanceTestPaths,
@@ -99144,6 +99407,7 @@ __export(exports_acceptance, {
   resolveSuggestedPackageFeatureTestPath: () => resolveSuggestedPackageFeatureTestPath,
   resolveSuggestedTestFile: () => resolveSuggestedTestFile,
   runHardeningPass: () => runHardeningPass,
+  scopedOverrideKey: () => scopedOverrideKey,
   substituteAcceptanceTestPath: () => substituteAcceptanceTestPath,
   suggestedTestFilename: () => suggestedTestFilename,
   warnMissingAcceptanceTests: () => warnMissingAcceptanceTests
@@ -99154,13 +99418,14 @@ var init_acceptance2 = __esm(() => {
   init_fix_diagnosis();
   init_generator();
   init_hardening();
+  init_override_keys();
   init_refinement();
   init_test_path();
 });
 
 // src/cli/features-acceptance.ts
 import { existsSync as existsSync16 } from "fs";
-import { join as join79, relative as relative26 } from "path";
+import { join as join79, relative as relative27 } from "path";
 async function resolveFeatureAcceptance(featureName, workdir) {
   let enabled = true;
   try {
@@ -99181,11 +99446,11 @@ async function resolveFeatureAcceptance(featureName, workdir) {
     const prd = await loadPRD(prdPath);
     const testGroups = await groupStoriesByPackage(prd, repoRoot, featureName, config2.acceptance?.testPath, config2.project?.language);
     const groups = await Promise.all(testGroups.map(async (g) => {
-      const packageDir = relative26(repoRoot, g.packageDir);
+      const packageDir = relative27(repoRoot, g.packageDir);
       const command2 = await resolveGroupCommand(repoRoot, packageDir, config2.acceptance?.command);
       return {
         packageDir,
-        testPath: relative26(repoRoot, g.testPath),
+        testPath: relative27(repoRoot, g.testPath),
         exists: await Bun.file(g.testPath).exists(),
         command: command2,
         cwd: packageDir,
@@ -99240,7 +99505,7 @@ var init_feature_name = __esm(() => {
 
 // src/cli/features-resolve.ts
 import { existsSync as existsSync17, readdirSync as readdirSync3 } from "fs";
-import { join as join80, relative as relative27 } from "path";
+import { join as join80, relative as relative28 } from "path";
 async function resolveTestPatterns(workdir) {
   try {
     const config2 = await loadConfig(workdir);
@@ -99263,17 +99528,17 @@ async function searchSpecSource(naxDir, repoRoot, name) {
   ];
   const docsSpecExact = join80(repoRoot, "docs", "specs", `SPEC-${name}.md`);
   candidates.push({ abs: docsSpecExact, kind: "markdown" });
-  const checked = candidates.map((c) => relative27(repoRoot, c.abs));
+  const checked = candidates.map((c) => relative28(repoRoot, c.abs));
   for (const { abs, kind } of candidates.slice(0, 2)) {
     if (kind === "markdown") {
       const nonEmpty2 = await isNonEmptyFile(abs);
       if (nonEmpty2) {
-        return { source: { kind, path: relative27(repoRoot, abs) }, checked };
+        return { source: { kind, path: relative28(repoRoot, abs) }, checked };
       }
     }
   }
   if (await isNonEmptyFile(docsSpecExact)) {
-    return { source: { kind: "markdown", path: relative27(repoRoot, docsSpecExact) }, checked };
+    return { source: { kind: "markdown", path: relative28(repoRoot, docsSpecExact) }, checked };
   }
   const docsSpecsDir = join80(repoRoot, "docs", "specs");
   if (existsSync17(docsSpecsDir)) {
@@ -99281,7 +99546,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     for (const match of glob2.scanSync({ cwd: docsSpecsDir, absolute: false })) {
       const abs = join80(docsSpecsDir, match);
       if (await isNonEmptyFile(abs)) {
-        const relPath = relative27(repoRoot, abs);
+        const relPath = relative28(repoRoot, abs);
         if (!checked.includes(relPath))
           checked.push(relPath);
         return { source: { kind: "markdown", path: relPath }, checked };
@@ -99289,7 +99554,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     }
   }
   const prdAbs = join80(naxDir, "features", name, "prd.json");
-  const prdRel = relative27(repoRoot, prdAbs);
+  const prdRel = relative28(repoRoot, prdAbs);
   if (!checked.includes(prdRel))
     checked.push(prdRel);
   if (existsSync17(prdAbs)) {
@@ -99341,8 +99606,8 @@ async function resolveFeatureSpec(name, workdir) {
     return {
       status: "ok",
       featureName: null,
-      specSource: { kind: "markdown", path: relative27(repoRoot, abs) },
-      message: `resolved spec: ${relative27(repoRoot, abs)}`
+      specSource: { kind: "markdown", path: relative28(repoRoot, abs) },
+      message: `resolved spec: ${relative28(repoRoot, abs)}`
     };
   }
   if (name !== undefined && name.trim() !== "") {
@@ -99791,7 +100056,7 @@ var init_windsurf = __esm(() => {
 
 // src/context/generator/index.ts
 import { existsSync as existsSync19 } from "fs";
-import { join as join82, relative as relative28 } from "path";
+import { join as join82, relative as relative29 } from "path";
 async function loadContextContent(options, config2) {
   if (!_generatorDeps.existsSync(options.contextPath)) {
     throw new NaxError(`Context file not found: ${options.contextPath}`, "CONTEXT_FILE_NOT_FOUND", {
@@ -99922,7 +100187,7 @@ async function discoverWorkspacePackages2(repoRoot) {
 }
 async function generateForPackage(packageDir, config2, dryRun = false, repoRoot) {
   const resolvedRepoRoot = repoRoot ?? packageDir;
-  const relativePkgPath = relative28(resolvedRepoRoot, packageDir);
+  const relativePkgPath = relative29(resolvedRepoRoot, packageDir);
   const contextPath = join82(resolvedRepoRoot, ".nax", "mono", relativePkgPath, "context.md");
   if (!_generatorDeps.existsSync(contextPath)) {
     return [
@@ -100206,7 +100471,7 @@ var init_generate = __esm(() => {
 
 // src/cli/init-context.ts
 import { mkdir as mkdir25, readdir as readdir7 } from "fs/promises";
-import { basename as basename11, join as join84, relative as relative29, sep as sep18 } from "path";
+import { basename as basename11, join as join84, relative as relative30, sep as sep18 } from "path";
 async function bunFileExists(path13) {
   return Bun.file(path13).exists();
 }
@@ -100233,7 +100498,7 @@ async function walkDir(root, current, out, maxFiles) {
         continue;
       await walkDir(root, join84(current, entry2.name), out, maxFiles);
     } else if (entry2.isFile()) {
-      out.push(relative29(root, join84(current, entry2.name)).replaceAll(sep18, "/"));
+      out.push(relative30(root, join84(current, entry2.name)).replaceAll(sep18, "/"));
     }
   }
 }
@@ -100717,19 +100982,19 @@ function validateProjectName(name) {
   return { valid: true };
 }
 async function checkInitCollision(name, currentWorkdir, currentRemote) {
-  const identity = await readProjectIdentity(name);
-  if (!identity)
+  const identity2 = await readProjectIdentity(name);
+  if (!identity2)
     return { collision: false };
-  const sameRemote = isSameProject(currentRemote, identity.remoteUrl);
-  const sameWorkdir = !currentRemote && !identity.remoteUrl && currentWorkdir === identity.workdir;
+  const sameRemote = isSameProject(currentRemote, identity2.remoteUrl);
+  const sameWorkdir = !currentRemote && !identity2.remoteUrl && currentWorkdir === identity2.workdir;
   if (sameRemote || sameWorkdir)
     return { collision: false };
   return {
     collision: true,
     existing: {
-      workdir: identity.workdir,
-      remoteUrl: identity.remoteUrl,
-      lastSeen: identity.lastSeen
+      workdir: identity2.workdir,
+      remoteUrl: identity2.remoteUrl,
+      lastSeen: identity2.lastSeen
     }
   };
 }
@@ -101244,7 +101509,7 @@ var init_checks_cli = __esm(() => {
   init_bun_deps();
   init_agents();
   _checkCliDeps = {
-    spawn
+    spawn: spawn2
   };
 });
 
@@ -101437,7 +101702,7 @@ var init_resume_hydrate = __esm(() => {
 });
 
 // src/tdd/rollback.ts
-import { rm as rm9 } from "fs/promises";
+import { rm as rm10 } from "fs/promises";
 import { join as join88 } from "path";
 async function runGitBounded2(args, workdir) {
   if (!workdir) {
@@ -101558,18 +101823,18 @@ var init_rollback = __esm(() => {
     autoCommitIfDirty,
     getUntrackedPaths,
     getGitRoot,
-    rm: rm9,
+    rm: rm10,
     timeoutMs: ROLLBACK_GIT_TIMEOUT_MS,
     drainTimeoutMs: ROLLBACK_DRAIN_TIMEOUT_MS
   };
 });
 
 // src/utils/paths.ts
-import { join as join89, relative as relative30, sep as sep19 } from "path";
+import { join as join89, relative as relative31, sep as sep19 } from "path";
 function packageDirRelative(projectDir, workdir) {
   if (!projectDir || !workdir || workdir === projectDir)
     return;
-  const rel = relative30(projectDir, workdir);
+  const rel = relative31(projectDir, workdir);
   if (rel === ".." || rel.startsWith(`..${sep19}`))
     return;
   return rel && rel !== "." ? rel : undefined;
@@ -102923,7 +103188,7 @@ var init_cleanup = __esm(() => {
   init_bun_deps();
   init_logger2();
   _cleanupDeps = {
-    spawn,
+    spawn: spawn2,
     sleep,
     kill: process.kill.bind(process),
     killProcessGroupFn: (pid, signal) => killProcessGroup(pid, signal)
@@ -106166,8 +106431,8 @@ var init_escalation = __esm(() => {
 });
 
 // src/execution/lock.ts
-import { randomUUID as randomUUID15 } from "crypto";
-import { rename as rename6, unlink as unlink6 } from "fs/promises";
+import { randomUUID as randomUUID16 } from "crypto";
+import { rename as rename7, unlink as unlink6 } from "fs/promises";
 import { hostname as hostname3 } from "os";
 import path14 from "path";
 async function serializeLockOperation(workdir, operation) {
@@ -106210,7 +106475,7 @@ function parseHolder(raw) {
   }
 }
 async function publishFileAtomically(targetPath, content) {
-  const tempPath = `${targetPath}.${randomUUID15()}.tmp`;
+  const tempPath = `${targetPath}.${randomUUID16()}.tmp`;
   try {
     await Bun.write(tempPath, content);
     const fs = await import("fs");
@@ -106383,14 +106648,14 @@ var init_lock2 = __esm(() => {
   init_logger2();
   pendingLockOperations = new Map;
   _lockDeps = {
-    rename: rename6,
+    rename: rename7,
     host: () => hostname3(),
     readLockText: (lockPath) => Bun.file(lockPath).text()
   };
 });
 
 // src/execution/feature-lock.ts
-import { mkdir as mkdir28, rename as rename7, unlink as unlink7 } from "fs/promises";
+import { mkdir as mkdir28, rename as rename8, unlink as unlink7 } from "fs/promises";
 import { hostname as hostname4 } from "os";
 import path15 from "path";
 function validateFeatureId2(featureId) {
@@ -106629,7 +106894,7 @@ var init_feature_lock = __esm(() => {
     featureLockPath,
     host: () => hostname4(),
     isProcessAlive,
-    rename: rename7,
+    rename: rename8,
     tryExclusiveCreate,
     unlink: unlink7
   };
@@ -107799,6 +108064,17 @@ var init_acceptance3 = __esm(() => {
         storiesByPackageDir.set(pkgDir, (storiesByPackageDir.get(pkgDir) ?? 0) + 1);
         acsByPackageDir.set(pkgDir, (acsByPackageDir.get(pkgDir) ?? 0) + s.acceptanceCriteria.length);
       }
+      const overrideLookup = createOverrideLookup({
+        overrides: ctx.prd.acceptanceOverrides,
+        workdir: ctx.workdir,
+        acCountByPackageDir: acsByPackageDir,
+        multiPackage: testGroups.length > 1,
+        onIgnoredBareKey: (acId) => logger.warn("acceptance", "Bare acceptance override ignored: several packages define this AC id", {
+          storyId: ctx.story.id,
+          acId,
+          hint: `scope it to one package: "<package>::${acId}"`
+        })
+      });
       const allFailedACs = [];
       const seenAcKeys = new Set;
       const allFindings = [];
@@ -107856,14 +108132,14 @@ var init_acceptance3 = __esm(() => {
         const output = execution.output ?? "";
         allOutputParts.push(output);
         const { failedACs, taggedFailureCount } = parseTestFailuresDetailed(output);
-        const overrides = ctx.prd.acceptanceOverrides ?? {};
-        const actualFailures = failedACs.filter((acId) => !overrides[acId]);
-        const overriddenFailures = failedACs.filter((acId) => overrides[acId]);
+        const reasonFor = (acId) => overrideLookup.reasonFor(packageDir, acId);
+        const actualFailures = failedACs.filter((acId) => !reasonFor(acId));
+        const overriddenFailures = failedACs.filter((acId) => reasonFor(acId));
         if (overriddenFailures.length > 0) {
           logger.warn("acceptance", "Skipped failures (overridden)", {
             storyId: ctx.story.id,
             overriddenFailures,
-            overrides: overriddenFailures.map((acId) => ({ acId, reason: overrides[acId] }))
+            overrides: overriddenFailures.map((acId) => ({ acId, reason: reasonFor(acId) }))
           });
         }
         if (failedACs.length === 0 && exitCode !== 0) {
@@ -108687,7 +108963,7 @@ var init_completion = __esm(() => {
   init_engine();
   init_fragments();
   init_execution2();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_metrics();
   init_prd();
@@ -108973,7 +109249,7 @@ var init_scope_files = __esm(() => {
 });
 
 // src/pipeline/stages/context.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { join as join99 } from "path";
 async function runV2Path(ctx) {
   const logger = getLogger2();
@@ -109214,7 +109490,7 @@ var init_context3 = __esm(() => {
     createOrchestrator: createDefaultOrchestrator,
     loadPlugins: loadPluginProviders,
     v1FeatureProvider: () => new FeatureContextProvider,
-    uuid: () => randomUUID16(),
+    uuid: () => randomUUID17(),
     readDigest: readDigestFile,
     writeDigest: writeDigestFile,
     loadFeatureManifests,
@@ -109298,12 +109574,12 @@ var init_execution = __esm(() => {
   init_engine();
   init_errors4();
   init_execution2();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_git2();
   init_path_frame();
   init_scope_files();
-  init_interaction2();
+  init_interaction3();
   init_execution_helpers();
   init_execution_helpers();
   RUNTIME_CRASH_CODES = new Set(["CALL_OP_NO_OUTPUT", "CALL_OP_MAX_RETRIES"]);
@@ -109500,7 +109776,7 @@ var init_optimizer2 = __esm(() => {
 
 // src/pipeline/stages/prompt.ts
 var _promptStageDeps, promptStage;
-var init_prompt3 = __esm(() => {
+var init_prompt4 = __esm(() => {
   init_acceptance2();
   init_engine();
   init_logger2();
@@ -109858,7 +110134,7 @@ var init_stages = __esm(() => {
   init_context3();
   init_execution();
   init_optimizer2();
-  init_prompt3();
+  init_prompt4();
   init_queue_check();
   init_routing2();
   init_acceptance3();
@@ -109868,7 +110144,7 @@ var init_stages = __esm(() => {
   init_context3();
   init_execution();
   init_optimizer2();
-  init_prompt3();
+  init_prompt4();
   init_queue_check();
   init_routing2();
   defaultPipeline = new Proxy([], {
@@ -110495,7 +110771,7 @@ var init_pipeline_result_handler = __esm(() => {
   init_escalation();
   init_progress();
   _resultHandlerDeps = {
-    spawn,
+    spawn: spawn2,
     existsSync: existsSync25,
     worktreeManager: new WorktreeManager,
     mergeEngine: new MergeEngine(new WorktreeManager),
@@ -110856,7 +111132,8 @@ async function executeHook(hookDef, ctx, workdir) {
     stdin: new Response(contextJson),
     stdout: "pipe",
     stderr: "pipe",
-    env: buildAllowedEnv({ env: env2 })
+    env: buildAllowedEnv({ env: env2 }),
+    detached: true
   });
   let timedOut = false;
   let killTimeoutId;
@@ -111245,7 +111522,7 @@ async function openAcceptanceFixScope(ctx, runtime2, storyId, packageDir) {
 }
 var _acceptanceFixScopeDeps;
 var init_acceptance_fix_scope = __esm(() => {
-  init_interaction2();
+  init_interaction3();
   init_path_frame();
   _acceptanceFixScopeDeps = {
     buildRunDispatchAskWiring
@@ -111759,7 +112036,7 @@ var init_headless_formatter = __esm(() => {
 
 // src/execution/lifecycle/run-tmp-wipe.ts
 import { lstatSync as lstatSync4 } from "fs";
-import { rm as rm10 } from "fs/promises";
+import { rm as rm11 } from "fs/promises";
 function inspect(path19) {
   try {
     return _runTmpWipeDeps.exists(path19) ? { state: "present" } : { state: "absent" };
@@ -111799,7 +112076,7 @@ var init_run_tmp_wipe = __esm(() => {
   init_internal();
   init_logger2();
   _runTmpWipeDeps = {
-    remove: (path19) => rm10(path19, { recursive: true, force: true }),
+    remove: (path19) => rm11(path19, { recursive: true, force: true }),
     exists: (path19) => {
       try {
         lstatSync4(path19);
@@ -111814,7 +112091,7 @@ var init_run_tmp_wipe = __esm(() => {
 });
 
 // src/execution/lifecycle/scratchpad-wipe.ts
-import { rm as rm11 } from "fs/promises";
+import { rm as rm12 } from "fs/promises";
 import { join as join102 } from "path";
 async function wipeScratchpad(workdir, opts = {}) {
   if (opts.dryRun)
@@ -111837,7 +112114,7 @@ var init_scratchpad_wipe = __esm(() => {
   init_internal();
   init_logger2();
   _scratchpadWipeDeps = {
-    remove: (path19) => rm11(path19, { recursive: true, force: true })
+    remove: (path19) => rm12(path19, { recursive: true, force: true })
   };
 });
 
@@ -112992,7 +113269,7 @@ async function runDeferredRegression(options) {
 var _regressionDeps;
 var init_run_regression = __esm(() => {
   init_findings();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_operations();
   init_event_bus();
@@ -113220,7 +113497,7 @@ var init_rtk = __esm(() => {
 });
 
 // src/execution/status-file.ts
-import { rename as rename8, unlink as unlink8 } from "fs/promises";
+import { rename as rename9, unlink as unlink8 } from "fs/promises";
 import { resolve as resolve39 } from "path";
 function countProgress(prd) {
   const stories = prd.userStories;
@@ -113284,7 +113561,7 @@ async function writeStatusFile(filePath2, status) {
     await unlink8(tmpPath);
   } catch {}
   await Bun.write(tmpPath, JSON.stringify(status, null, 2));
-  await rename8(tmpPath, resolvedPath);
+  await rename9(tmpPath, resolvedPath);
 }
 var init_status_file = __esm(() => {
   init_errors4();
@@ -114287,15 +114564,15 @@ function createOtelReporterPlugin(cfg, deps, workdir) {
     send: makeSendLogsBatch(resource)
   });
   const buildOrphanState = (startMs) => {
-    const identity = rootSpanIdentity();
+    const identity2 = rootSpanIdentity();
     const orphanAttrs = buildResourceAttributes({ serviceName: cfg.serviceName, runId: "orphan" });
     return {
-      ...identity,
+      ...identity2,
       startMs,
       feature: "",
       project: "",
       events: [],
-      spanTree: createSpanTree(identity.traceId, identity.spanId),
+      spanTree: createSpanTree(identity2.traceId, identity2.spanId),
       spanQueue: makeSpanQueue(orphanAttrs),
       metrics: createPhaseMetricsAggregator(),
       storyBounds: new Map,
@@ -114373,7 +114650,7 @@ function createOtelReporterPlugin(cfg, deps, workdir) {
   const reporter = {
     name: STAGE8,
     async onRunStart(event) {
-      const identity = rootSpanIdentity();
+      const identity2 = rootSpanIdentity();
       const runId = event.runId;
       let gitBranch;
       let gitSha;
@@ -114401,14 +114678,14 @@ function createOtelReporterPlugin(cfg, deps, workdir) {
         git: { branch: gitBranch, sha: gitSha }
       });
       const state = {
-        ...identity,
+        ...identity2,
         startMs: Date.parse(event.startTime),
         feature: event.feature,
         project: event.project ?? "",
         gitBranch,
         gitSha,
         events: [],
-        spanTree: createSpanTree(identity.traceId, identity.spanId),
+        spanTree: createSpanTree(identity2.traceId, identity2.spanId),
         spanQueue: makeSpanQueue(resourceAttrs),
         metrics: createPhaseMetricsAggregator(),
         storyBounds: new Map,
@@ -115160,7 +115437,7 @@ async function* streamJsonlLines(file2) {
 }
 
 // src/plugins/builtin/curator/rollup-prune.ts
-import { appendFile as appendFile6, rename as rename9, unlink as unlink9, writeFile as writeFile13 } from "fs/promises";
+import { appendFile as appendFile6, rename as rename10, unlink as unlink9, writeFile as writeFile12 } from "fs/promises";
 async function scanProjectRunIds(rollupPath, projectKey) {
   const maxTsByRunId = new Map;
   for await (const line of streamJsonlLines(Bun.file(rollupPath))) {
@@ -115205,7 +115482,7 @@ async function pruneRollupUnlocked(input) {
     buffer = "";
   };
   try {
-    await writeFile13(tmpPath, "");
+    await writeFile12(tmpPath, "");
     for await (const line of streamJsonlLines(Bun.file(rollupPath))) {
       if (!line.trim())
         continue;
@@ -115241,7 +115518,7 @@ async function pruneRollupUnlocked(input) {
         await flush();
     }
     await flush();
-    await rename9(tmpPath, rollupPath);
+    await rename10(tmpPath, rollupPath);
   } catch (err) {
     await unlink9(tmpPath).catch(() => {});
     throw err;
@@ -115640,8 +115917,8 @@ function collectRectify(context, entry2, data) {
     ts: stringValue(entry2.timestamp ?? entry2.ts, now()),
     kind: "rectify-cycle",
     payload: {
-      iteration: numberValue(data.attempt ?? data.rectifyAttempt ?? data.iteration, 1),
-      status: stringValue(data.status, "started")
+      iteration: numberValue(data.iterationCount, 1),
+      status: data.exitReason === "resolved" ? "passed" : "failed"
     }
   };
 }
@@ -115733,7 +116010,7 @@ async function collectFromRunJsonl(context) {
         observations.push(collectPullCall(context, entry2, data));
       } else if (stage === "acceptance" && message === "verdict") {
         observations.push(collectAcceptanceVerdict(context, entry2, data));
-      } else if (stage === "rectify" && message === "Starting rectification loop") {
+      } else if (stage === "story-orchestrator" && typeof data.iterationCount === "number") {
         observations.push(collectRectify(context, entry2, data));
       } else if (stage === "escalation" && message.includes("Escalating")) {
         observations.push(collectEscalation(context, entry2, data));
@@ -116098,7 +116375,7 @@ function renderProposals(proposals, runId, observationCount, provenance) {
 }
 
 // src/plugins/builtin/curator/rollup.ts
-import { appendFile as appendFile7, mkdir as mkdir30, writeFile as writeFile14 } from "fs/promises";
+import { appendFile as appendFile7, mkdir as mkdir30, writeFile as writeFile13 } from "fs/promises";
 import * as path22 from "path";
 async function appendToRollup(observations, rollupPath) {
   const dir = path22.dirname(rollupPath);
@@ -116111,7 +116388,7 @@ async function appendToRollupUnlocked(observations, rollupPath) {
     if (observations.length === 0) {
       const f = Bun.file(rollupPath);
       if (!await f.exists()) {
-        await writeFile14(rollupPath, "");
+        await writeFile13(rollupPath, "");
       }
       return;
     }
@@ -117183,7 +117460,7 @@ var init_language_commands = __esm(() => {
 });
 
 // src/review/scoped-lint.ts
-import { join as join109, relative as relative32 } from "path";
+import { join as join109, relative as relative33 } from "path";
 function normalizePath3(path25) {
   return path25.replaceAll("\\", "/").replace(/^\.\//, "");
 }
@@ -117209,7 +117486,7 @@ async function listChangedFiles(workdir, baseRef) {
 function inferActivePackageDir(workdir, projectDir) {
   if (!projectDir)
     return;
-  const rel = normalizePath3(relative32(projectDir, workdir));
+  const rel = normalizePath3(relative33(projectDir, workdir));
   if (!rel || rel === "." || rel.startsWith(".."))
     return;
   return rel;
@@ -117816,7 +118093,7 @@ var init_run_initialization = __esm(() => {
     },
     hasCommitsForStory: (workdir, storyId) => hasCommitsForStory(workdir, storyId),
     runReview: (reviewConfig, workdir, executionConfig) => runReview({ config: reviewConfig, workdir, executionConfig }),
-    spawn
+    spawn: spawn2
   };
 });
 
@@ -118085,9 +118362,9 @@ async function resolveProjectAsync(options = {}) {
     const identityFile = Bun.file(registryIdentityPath);
     if (await identityFile.exists()) {
       try {
-        const identity = await identityFile.json();
-        if (typeof identity.workdir === "string") {
-          return resolveProject({ ...options, dir: identity.workdir });
+        const identity2 = await identityFile.json();
+        if (typeof identity2.workdir === "string") {
+          return resolveProject({ ...options, dir: identity2.workdir });
         }
       } catch {}
     }
@@ -118294,8 +118571,8 @@ function resolveCanonicalTargetPath(projectDir, canonicalFile) {
   const root = resolve42(projectDir);
   if (target !== root && !target.startsWith(root + sep21))
     return null;
-  const relative33 = target.slice(root.length + 1).replaceAll(sep21, "/");
-  return CURATOR_TARGET_SHAPES.some((shape) => shape.test(relative33)) ? target : null;
+  const relative34 = target.slice(root.length + 1).replaceAll(sep21, "/");
+  return CURATOR_TARGET_SHAPES.some((shape) => shape.test(relative34)) ? target : null;
 }
 function isWithinCanonicalRulesDir(projectDir, targetPath) {
   const rulesRoot = resolve42(projectDir, CANONICAL_RULES_DIR);
@@ -118881,7 +119158,7 @@ __export(exports_migrate, {
   partitionTrackedCandidates: () => partitionTrackedCandidates
 });
 import { existsSync as existsSync30 } from "fs";
-import { mkdir as mkdir32, readdir as readdir10, rename as rename10 } from "fs/promises";
+import { mkdir as mkdir32, readdir as readdir10, rename as rename11 } from "fs/promises";
 import path26 from "path";
 async function detectGeneratedContent(naxDir) {
   if (!existsSync30(naxDir))
@@ -119066,7 +119343,7 @@ async function migrateCommand(options) {
     const archiveBase = path26.join(globalConfigDir(), "_archive");
     const archiveDest = path26.join(archiveBase, `${options.reclaim}-${Date.now()}`);
     await mkdir32(archiveBase, { recursive: true });
-    await rename10(src, archiveDest);
+    await rename11(src, archiveDest);
     logger.info("migrate", `Reclaimed: archived to ${archiveDest}`, { storyId: "_migrate" });
     return;
   }
@@ -119165,7 +119442,7 @@ async function migrateCommand(options) {
   Remove the destination or run nax migrate --dry-run to inspect.`, "MIGRATE_CONFLICT", { stage: "migrate", src: candidate.srcPath, dest });
     }
     try {
-      await rename10(candidate.srcPath, dest);
+      await rename11(candidate.srcPath, dest);
     } catch (err) {
       const isXdev = err instanceof Error && "code" in err && err.code === "EXDEV";
       if (isXdev) {
@@ -120653,7 +120930,7 @@ var init_run_setup = __esm(() => {
   init_internal();
   init_errors4();
   init_rtk();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_event_bus();
   init_prd();
@@ -121096,7 +121373,7 @@ async function cleanupSessionOnFailure(ctx, failAndClose2) {
 }
 
 // src/execution/deferred-review.ts
-var {spawn: spawn6 } = globalThis.Bun;
+var {spawn: spawn7 } = globalThis.Bun;
 async function spawnGitWithDeadline(args, workdir) {
   const proc = _deferredReviewDeps.spawn({
     cmd: hardenedGitArgv(["git", ...args]),
@@ -121176,7 +121453,7 @@ var init_deferred_review = __esm(() => {
   init_internal();
   init_git2();
   init_path_filters();
-  _deferredReviewDeps = { spawn: spawn6 };
+  _deferredReviewDeps = { spawn: spawn7 };
 });
 
 // src/execution/lifecycle/test-baseline-capture.ts
@@ -122019,7 +122296,7 @@ var init_queue_file_lock = __esm(() => {
 });
 
 // src/execution/queue-handler.ts
-import { rename as rename11, unlink as unlink12 } from "fs/promises";
+import { rename as rename12, unlink as unlink12 } from "fs/promises";
 import path29 from "path";
 function getSafeLogger9() {
   try {
@@ -122039,7 +122316,7 @@ async function claimCommandsLocked(queuePath, processingPath, logger) {
     return null;
   }
   try {
-    await rename11(queuePath, processingPath);
+    await rename12(queuePath, processingPath);
   } catch (error48) {
     logger?.warn("queue", "Failed to rename queue file for processing", {
       error: error48.message
@@ -122215,7 +122492,7 @@ var init_run_cost_reconcile = __esm(() => {
 });
 
 // src/finish/audit.ts
-import { appendFile as appendFile8, mkdir as mkdir34, readFile as readFile10, writeFile as writeFile15 } from "fs/promises";
+import { appendFile as appendFile8, mkdir as mkdir34, readFile as readFile10, writeFile as writeFile14 } from "fs/promises";
 import { join as join120 } from "path";
 function roundsPath(t) {
   return join120(t.auditDir, `${t.runId}.jsonl`);
@@ -122243,7 +122520,7 @@ async function updateLedger(t, result) {
   };
   try {
     await mkdir34(t.auditDir, { recursive: true });
-    await writeFile15(ledgerPath(t.auditDir), `${JSON.stringify(entry2, null, 2)}
+    await writeFile14(ledgerPath(t.auditDir), `${JSON.stringify(entry2, null, 2)}
 `, "utf8");
   } catch {}
 }
@@ -122293,7 +122570,7 @@ async function writeResult(t, result, options = {}) {
   const rounds = await readRounds(t);
   const withRounds = rounds.length > 0 ? { ...result, rounds } : result;
   await mkdir34(t.auditDir, { recursive: true });
-  await writeFile15(resultPath(t), `${JSON.stringify(withRounds, null, 2)}
+  await writeFile14(resultPath(t), `${JSON.stringify(withRounds, null, 2)}
 `, "utf8");
   if (options.ledger === false)
     return;
@@ -122826,7 +123103,7 @@ function languageRunner(language) {
 function buildAcceptanceCommand(repoRoot, group) {
   const absFile = shellQuote(`${repoRoot}/${group.testPath}`);
   const template = group.command ?? `${languageRunner(group.language)} {{FILE}}`;
-  return template.replace(/\{\{FILE\}\}|\{\{file\}\}|\{\{files\}\}/g, absFile);
+  return template.replace(/\{\{FILE\}\}|\{\{file\}\}|\{\{files\}\}/g, () => absFile);
 }
 async function runAcceptanceGate(repoRoot, groups, opts = {}) {
   const chunks = [];
@@ -124465,7 +124742,7 @@ var _finishPhaseDeps;
 var init_phase = __esm(() => {
   init_internal();
   init_forge();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_pipeline2();
   init_runtime3();
@@ -125054,13 +125331,13 @@ function wireInteraction(bus, interactionChain, config2) {
       u();
   };
 }
-var init_interaction3 = __esm(() => {
-  init_interaction2();
+var init_interaction4 = __esm(() => {
+  init_interaction3();
   init_logger2();
 });
 
 // src/pipeline/subscribers/registry.ts
-import { mkdir as mkdir36, writeFile as writeFile16 } from "fs/promises";
+import { mkdir as mkdir36, writeFile as writeFile15 } from "fs/promises";
 import { basename as basename16, join as join124 } from "path";
 function wireRegistry(bus, feature, runId, workdir, outputDir) {
   const logger = getSafeLogger2();
@@ -125080,7 +125357,7 @@ function wireRegistry(bus, feature, runId, workdir, outputDir) {
           eventsDir: join124(outputDir, "features", feature, "runs"),
           registeredAt: new Date().toISOString()
         };
-        await writeFile16(metaFile, JSON.stringify(meta3, null, 2));
+        await writeFile15(metaFile, JSON.stringify(meta3, null, 2));
       } catch (err) {
         logger?.warn("registry-writer", "Failed to write meta.json (non-fatal)", {
           path: metaFile,
@@ -126356,7 +126633,7 @@ var init_unified_executor = __esm(() => {
   init_runner2();
   init_events_writer();
   init_hooks2();
-  init_interaction3();
+  init_interaction4();
   init_registry8();
   init_reporters();
   init_prd();
@@ -128014,7 +128291,7 @@ __export(exports_story_size_gate, {
 function countBulletPoints(text) {
   const lines2 = text.split(`
 `);
-  const bulletPattern = /^\s*[-*\u2022]|\d+\./;
+  const bulletPattern = /^\s*(?:[-*\u2022]|\d+\.)\s/;
   return lines2.filter((line) => bulletPattern.test(line)).length;
 }
 function analyzeStory(story, config2) {
@@ -128661,7 +128938,7 @@ var init_plan_runtime = __esm(() => {
   init_analyze();
   init_config();
   init_generator2();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_runtime3();
   init_plan_helpers();
@@ -128817,7 +129094,7 @@ var init_context_builder = __esm(() => {
   init_plan_runtime();
   init_config();
   init_errors4();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_feature_name();
   init_spec_lint_gate();
@@ -131834,9 +132111,7 @@ __export(exports_cli, {
   MAX_CANONICAL_RULE_GLOB_FILES: () => MAX_CANONICAL_RULE_GLOB_FILES,
   MAX_DEAD_GLOB_SCAN_FILES: () => MAX_DEAD_GLOB_SCAN_FILES,
   MAX_DEAD_GLOB_SCAN_TOTAL_ENTRIES: () => MAX_DEAD_GLOB_SCAN_TOTAL_ENTRIES,
-  PromptCancelledError: () => PromptCancelledError,
   _approvalsCliDeps: () => _approvalsCliDeps,
-  _authPromptDeps: () => _authPromptDeps,
   _cliAuthDeps: () => _cliAuthDeps,
   _cliTrustDeps: () => _cliTrustDeps,
   _confirmDeps: () => _confirmDeps,
@@ -131896,8 +132171,6 @@ __export(exports_cli, {
   planMigration: () => planMigration,
   pluginsListCommand: () => pluginsListCommand,
   promptForConfirmation: () => promptForConfirmation,
-  promptForLine: () => promptForLine,
-  promptForSecret: () => promptForSecret,
   promptsCommand: () => promptsCommand,
   promptsInitCommand: () => promptsInitCommand,
   registerApprovalsCommand: () => registerApprovalsCommand,
@@ -131937,7 +132210,6 @@ var init_cli2 = __esm(() => {
   init_approvals();
   init_approvals_format();
   init_auth3();
-  init_auth_prompt();
   init_config2();
   init_config_descriptions();
   init_confirm();
@@ -153098,9 +153370,9 @@ function parseSchedule(input, now3) {
   const trimmed = input.trim();
   if (trimmed === "")
     return { ok: false, error: `Empty schedule value. ${ACCEPTED}` };
-  const relative33 = parseRelative(trimmed, now3);
-  if (relative33)
-    return relative33;
+  const relative34 = parseRelative(trimmed, now3);
+  if (relative34)
+    return relative34;
   const timeOfDay = parseTimeOfDay(trimmed, now3);
   if (timeOfDay)
     return timeOfDay;