@osfactory/har 0.56.1 → 0.58.0

package/dist/index.js

@@ -553,8 +553,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path62, errorMaps, issueData } = params;
-      const fullPath = [...path62, ...issueData.path || []];
+      const { data, path: path66, errorMaps, issueData } = params;
+      const fullPath = [...path66, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -862,11 +862,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path62, key) {
+      constructor(parent, value, path66, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path62;
+        this._path = path66;
         this._key = key;
       }
       get path() {
@@ -4248,7 +4248,7 @@ var init_zod = __esm({
 });
 
 // packages/schemas/src/schema.ts
-var HAR_STAGE_KINDS, HAR_AGENT_SLOT_MIN, AgentSkillTargetSchema, ScaffoldedAgentFileSchema, HarnessManifestSchema, HarnessStageKindSchema, HarnessArtifactKindSchema, HarnessArtifactSchema, HarnessStageIdSchema, HarnessStageSchema, HarnessAgentSlotsSchema, CommitGateConfigSchema, OnboardingPreferencesSchema, HarnessStageRegistrySchema, HarnessVerificationStepSchema, ShellRunOutputSchema, HarnessVerificationResultSchema, HarnessStageRunStatusSchema, HarnessStageLogSchema, HarnessStageUrlSchema, HarnessStageRunResultSchema, StageKindSchema, VerificationResultSchema, StageResultSchema, RunRecordTriggerSchema, WorkUnitIdSchema, WorkAttemptIdSchema, WorkUnitMetadataSchema, WorkUnitOutcomeSchema, WorkUnitRecordSchema, WorkAttemptRecordSchema, RunRecordSchema, SlotRegistryEntrySchema, AgentSlotHarnessUsageSchema, PreflightBlockerSchema, SlotReadinessSchema, AgentSlotStatusSchema, EnvironmentStatusSchema, RegisterRepoInputSchema, UnregisterRepoInputSchema, UnregisterWorktreeResultSchema, UnregisterRepoResultSchema, ResetMissionControlInputSchema, HarnessScrubResultSchema, ResetMissionControlResultSchema, DeleteWorktreesInputSchema, DeleteWorktreeResultSchema, DeleteWorktreesResultSchema, SyncRunsInputSchema, SyncSlotsInputSchema, SyncWorkUnitsInputSchema, ChangedFileStatusSchema, ChangedFileSchema, ValidationRecordSchema, SyncValidationsInputSchema, ValidationBindingRecordSchema, SyncValidationBindingsInputSchema, AgentToolSchema, UsageSourceSchema, AgentTrajectorySourceSchema, AgentTrajectoryContentDisclosureSchema, AgentTrajectoryRecordV1Schema, AgentSessionUsageSchema, SyncUsageInputSchema, AgentSessionEventSchema, SyncSessionEventsInputSchema;
+var HAR_STAGE_KINDS, HAR_AGENT_SLOT_MIN, AgentSkillTargetSchema, ScaffoldedAgentFileSchema, HarnessManifestSchema, HarnessStageKindSchema, HarnessArtifactKindSchema, HarnessArtifactSchema, HarnessStageIdSchema, HarnessStageSchema, HarnessAgentSlotsSchema, CommitGateConfigSchema, OnboardingPreferencesSchema, HarnessStageRegistrySchema, HarnessVerificationStepSchema, ShellRunOutputSchema, HarnessVerificationResultSchema, HarnessStageRunStatusSchema, HarnessStageLogSchema, HarnessStageUrlSchema, HarnessStageRunResultSchema, StageKindSchema, VerificationResultSchema, StageResultSchema, RunRecordTriggerSchema, WorkUnitIdSchema, WorkAttemptIdSchema, WorkUnitRelatedLinkSchema, WorkUnitMetadataSchema, WorkUnitOutcomeSchema, WorkUnitRecordSchema, WorkAttemptRecordSchema, RunRecordSchema, SlotRegistryEntrySchema, AgentSlotHarnessUsageSchema, PreflightBlockerSchema, SlotReadinessSchema, AgentSlotStatusSchema, EnvironmentStatusSchema, RegisterRepoInputSchema, UnregisterRepoInputSchema, UnregisterWorktreeResultSchema, UnregisterRepoResultSchema, ResetMissionControlInputSchema, HarnessScrubResultSchema, ResetMissionControlResultSchema, DeleteWorktreesInputSchema, DeleteWorktreeResultSchema, DeleteWorktreesResultSchema, SyncRunsInputSchema, SyncSlotsInputSchema, SyncWorkUnitsInputSchema, ChangedFileStatusSchema, ChangedFileSchema, ValidationRecordSchema, SyncValidationsInputSchema, ValidationBindingRecordSchema, SyncValidationBindingsInputSchema, AgentToolSchema, UsageSourceSchema, AgentTrajectorySourceSchema, AgentTrajectoryContentDisclosureSchema, AgentTrajectoryRecordV1Schema, AgentSessionUsageSchema, SyncUsageInputSchema, AgentSessionEventSchema, SyncSessionEventsInputSchema;
 var init_schema = __esm({
   "packages/schemas/src/schema.ts"() {
     "use strict";
@@ -4413,12 +4413,18 @@ var init_schema = __esm({
       "work unit id must start with an alphanumeric character and contain only stable identifier characters"
     );
     WorkAttemptIdSchema = external_exports.string().uuid();
+    WorkUnitRelatedLinkSchema = external_exports.object({
+      source: external_exports.string().min(1).max(64),
+      url: external_exports.string().url(),
+      label: external_exports.string().min(1).max(128).optional()
+    });
     WorkUnitMetadataSchema = external_exports.object({
       workUnitId: WorkUnitIdSchema,
       source: external_exports.string().min(1).max(64).optional(),
       sourceUrl: external_exports.string().url().optional(),
       title: external_exports.string().min(1).max(256).optional(),
-      parentWorkUnitId: WorkUnitIdSchema.optional()
+      parentWorkUnitId: WorkUnitIdSchema.optional(),
+      relatedLinks: external_exports.array(WorkUnitRelatedLinkSchema).optional()
     });
     WorkUnitOutcomeSchema = external_exports.object({
       decision: external_exports.enum(["completed", "abandoned"]),
@@ -28353,6 +28359,7 @@ var init_manifest = __esm({
     DEFAULT_HAR_DIR = ".har";
     CHECKSUM_SKIP = /* @__PURE__ */ new Set([
       "manifest.json",
+      "plugins.json",
       "AGENTS.md.proposed",
       "AGENTS.md.proposed.meta.json",
       "AGENT.md.proposed",
@@ -28757,7 +28764,7 @@ function runScript(scriptPath, args = [], options = {}) {
 function runScriptCapture(scriptPath, args = [], options = {}) {
   const stream = options.stream ?? false;
   const { stream: _stream, ...spawnOptions } = options;
-  return new Promise((resolve47) => {
+  return new Promise((resolve50) => {
     const proc = (0, import_child_process.spawn)("bash", [scriptPath, ...args], {
       ...spawnOptions,
       stdio: ["inherit", "pipe", "pipe"]
@@ -28772,13 +28779,13 @@ function runScriptCapture(scriptPath, args = [], options = {}) {
       stderr += d;
       if (stream) process.stderr.write(d);
     });
-    proc.on("close", (code) => resolve47({ stdout, stderr, code: code ?? 0 }));
+    proc.on("close", (code) => resolve50({ stdout, stderr, code: code ?? 0 }));
   });
 }
 function runShellCommand(command2, options = {}) {
   const stream = options.stream ?? false;
   const { stream: _stream, ...spawnOptions } = options;
-  return new Promise((resolve47) => {
+  return new Promise((resolve50) => {
     const proc = (0, import_child_process.spawn)("bash", ["-lc", command2], {
       ...spawnOptions,
       stdio: ["inherit", "pipe", "pipe"]
@@ -28793,7 +28800,7 @@ function runShellCommand(command2, options = {}) {
       stderr += d;
       if (stream) process.stderr.write(d);
     });
-    proc.on("close", (code) => resolve47({ stdout, stderr, code: code ?? 0 }));
+    proc.on("close", (code) => resolve50({ stdout, stderr, code: code ?? 0 }));
   });
 }
 var import_child_process;
@@ -29495,6 +29502,22 @@ var init_runs = __esm({
   }
 });
 
+// src/harness/capabilities.ts
+function harnessUsesPm2(repoPath) {
+  const harnessRoot = resolveHarnessRoot(repoPath);
+  return fs13.existsSync(path13.join(harnessRoot, ".har", "ecosystem.agent.template.cjs"));
+}
+var fs13, path13;
+var init_capabilities = __esm({
+  "src/harness/capabilities.ts"() {
+    "use strict";
+    fs13 = __toESM(require("fs"));
+    path13 = __toESM(require("path"));
+    init_manifest();
+    init_env();
+  }
+});
+
 // src/core/slot-ports.ts
 function portStep(env3) {
   return Number(env3.HARNESS_PORT_STEP ?? 10);
@@ -29549,19 +29572,14 @@ function allocateAppPorts(repoPath, agentId) {
     allocated: frontend !== feDefault || api !== apiDefault || debug !== debugDefault
   };
 }
-function harnessUsesPm2(repoPath) {
-  const harnessRoot = resolveHarnessRoot(repoPath);
-  return fs13.existsSync(path13.join(harnessRoot, ".har", "ecosystem.agent.template.cjs"));
-}
-var import_child_process3, fs13, path13;
+var import_child_process3;
 var init_slot_ports = __esm({
   "src/core/slot-ports.ts"() {
     "use strict";
     import_child_process3 = require("child_process");
-    fs13 = __toESM(require("fs"));
-    path13 = __toESM(require("path"));
     init_env();
     init_manifest();
+    init_capabilities();
   }
 });
 
@@ -30628,6 +30646,7 @@ var init_slot_preflight = __esm({
     init_control_port();
     init_slot_launch_guard_occupied();
     init_slot_ports();
+    init_capabilities();
     init_slot_registry();
     init_worktree_untracked();
     import_child_process8 = require("child_process");
@@ -30891,6 +30910,29 @@ function listRecords(harnessRoot, dir, parse4) {
   }
   return records;
 }
+function parseWorkLinkSpec(spec) {
+  const parts = spec.split("|");
+  if (parts.length < 2) {
+    throw new Error(
+      `Invalid work link "${spec}" \u2014 use source|url or source|url|label (example: github|https://github.com/org/repo/pull/42|PR #42)`
+    );
+  }
+  const [source, url, ...labelParts] = parts;
+  const label = labelParts.length > 0 ? labelParts.join("|") : void 0;
+  return WorkUnitRelatedLinkSchema.parse({ source, url, label });
+}
+function mergeRelatedLinks(existing, incoming, primaryUrl) {
+  if (!incoming?.length) return existing?.length ? existing : void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [];
+  for (const link of [...existing ?? [], ...incoming]) {
+    if (primaryUrl && link.url === primaryUrl) continue;
+    if (seen.has(link.url)) continue;
+    seen.add(link.url);
+    merged.push(link);
+  }
+  return merged.length > 0 ? merged : void 0;
+}
 function findWorkUnit(harnessRoot, workUnitId) {
   const metadata = WorkUnitMetadataSchema.parse({ workUnitId });
   const file = hashedRecordPath(harnessRoot, WORK_UNITS_DIR, metadata.workUnitId);
@@ -30920,13 +30962,19 @@ function upsertWorkUnit(harnessRoot, input) {
     }
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
+  const sourceUrl = existing?.sourceUrl ?? metadata.sourceUrl;
   const record2 = WorkUnitRecordSchema.parse({
     ...existing,
     workUnitId: metadata.workUnitId,
     source: existing?.source ?? metadata.source,
-    sourceUrl: existing?.sourceUrl ?? metadata.sourceUrl,
+    sourceUrl,
     title: existing?.title ?? metadata.title,
     parentWorkUnitId: existing?.parentWorkUnitId ?? metadata.parentWorkUnitId,
+    relatedLinks: mergeRelatedLinks(
+      existing?.relatedLinks,
+      metadata.relatedLinks,
+      sourceUrl
+    ),
     version: 1,
     createdAt: existing?.createdAt ?? now,
     updatedAt: now,
@@ -30939,6 +30987,23 @@ function upsertWorkUnit(harnessRoot, input) {
   markDirty(harnessRoot);
   return record2;
 }
+function addWorkUnitLinks(harnessRoot, workUnitId, links) {
+  const existing = findWorkUnit(harnessRoot, workUnitId);
+  if (!existing) throw new Error(`Unknown work unit: ${workUnitId}`);
+  const parsed = links.map((link) => WorkUnitRelatedLinkSchema.parse(link));
+  const relatedLinks = mergeRelatedLinks(existing.relatedLinks, parsed, existing.sourceUrl);
+  const record2 = WorkUnitRecordSchema.parse({
+    ...existing,
+    relatedLinks,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  writeRecord2(
+    hashedRecordPath(harnessRoot, WORK_UNITS_DIR, workUnitId),
+    record2
+  );
+  markDirty(harnessRoot);
+  return record2;
+}
 function listWorkUnits(harnessRoot) {
   return listRecords(
     harnessRoot,
@@ -32418,7 +32483,7 @@ async function postForResponse(url, headers, payload) {
     } catch (err) {
       lastErr = err;
       if (attempt < MAX_FETCH_ATTEMPTS) {
-        await new Promise((resolve47) => setTimeout(resolve47, attempt * 100));
+        await new Promise((resolve50) => setTimeout(resolve50, attempt * 100));
       }
     }
   }
@@ -32618,7 +32683,7 @@ async function waitForControlApi(apiUrl = getControlApiUrl(), timeoutMs = 6e4, i
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (await isControlApiReachable(apiUrl)) return true;
-    await new Promise((resolve47) => setTimeout(resolve47, intervalMs));
+    await new Promise((resolve50) => setTimeout(resolve50, intervalMs));
   }
   return false;
 }
@@ -34115,15 +34180,15 @@ var require_route = __commonJS({
       };
     }
     function wrapConversion(toModel, graph) {
-      const path62 = [graph[toModel].parent, toModel];
+      const path66 = [graph[toModel].parent, toModel];
       let fn = conversions[graph[toModel].parent][toModel];
       let cur = graph[toModel].parent;
       while (graph[cur].parent) {
-        path62.unshift(graph[cur].parent);
+        path66.unshift(graph[cur].parent);
         fn = link(conversions[graph[cur].parent][cur], fn);
         cur = graph[cur].parent;
       }
-      fn.conversion = path62;
+      fn.conversion = path66;
       return fn;
     }
     module2.exports = function(fromModel) {
@@ -40053,7 +40118,7 @@ var require_iso2022 = __commonJS({
 // node_modules/chardet/index.js
 var require_chardet = __commonJS({
   "node_modules/chardet/index.js"(exports2, module2) {
-    var fs48 = require("fs");
+    var fs52 = require("fs");
     var utf8 = require_utf8();
     var unicode = require_unicode();
     var mbcs = require_mbcs();
@@ -40127,28 +40192,28 @@ var require_chardet = __commonJS({
       var fd;
       var handler = function(err, buffer) {
         if (fd) {
-          fs48.closeSync(fd);
+          fs52.closeSync(fd);
         }
         if (err) return cb(err, null);
         cb(null, self.detect(buffer, opts));
       };
       if (opts && opts.sampleSize) {
-        fd = fs48.openSync(filepath, "r"), sample = Buffer.allocUnsafe(opts.sampleSize);
-        fs48.read(fd, sample, 0, opts.sampleSize, null, function(err) {
+        fd = fs52.openSync(filepath, "r"), sample = Buffer.allocUnsafe(opts.sampleSize);
+        fs52.read(fd, sample, 0, opts.sampleSize, null, function(err) {
           handler(err, sample);
         });
         return;
       }
-      fs48.readFile(filepath, handler);
+      fs52.readFile(filepath, handler);
     };
     module2.exports.detectFileSync = function(filepath, opts) {
       if (opts && opts.sampleSize) {
-        var fd = fs48.openSync(filepath, "r"), sample2 = Buffer.allocUnsafe(opts.sampleSize);
-        fs48.readSync(fd, sample2, 0, opts.sampleSize);
-        fs48.closeSync(fd);
+        var fd = fs52.openSync(filepath, "r"), sample2 = Buffer.allocUnsafe(opts.sampleSize);
+        fs52.readSync(fd, sample2, 0, opts.sampleSize);
+        fs52.closeSync(fd);
         return self.detect(sample2, opts);
       }
-      return self.detect(fs48.readFileSync(filepath), opts);
+      return self.detect(fs52.readFileSync(filepath), opts);
     };
     module2.exports.detectAll = function(buffer, opts) {
       if (typeof opts !== "object") {
@@ -43613,16 +43678,16 @@ var require_os_tmpdir = __commonJS({
     var isWindows = process.platform === "win32";
     var trailingSlashRe = isWindows ? /[^:]\\$/ : /.\/$/;
     module2.exports = function() {
-      var path62;
+      var path66;
       if (isWindows) {
-        path62 = process.env.TEMP || process.env.TMP || (process.env.SystemRoot || process.env.windir) + "\\temp";
+        path66 = process.env.TEMP || process.env.TMP || (process.env.SystemRoot || process.env.windir) + "\\temp";
       } else {
-        path62 = process.env.TMPDIR || process.env.TMP || process.env.TEMP || "/tmp";
+        path66 = process.env.TMPDIR || process.env.TMP || process.env.TEMP || "/tmp";
       }
-      if (trailingSlashRe.test(path62)) {
-        path62 = path62.slice(0, -1);
+      if (trailingSlashRe.test(path66)) {
+        path66 = path66.slice(0, -1);
       }
-      return path62;
+      return path66;
     };
   }
 });
@@ -43630,8 +43695,8 @@ var require_os_tmpdir = __commonJS({
 // node_modules/tmp/lib/tmp.js
 var require_tmp = __commonJS({
   "node_modules/tmp/lib/tmp.js"(exports2, module2) {
-    var fs48 = require("fs");
-    var path62 = require("path");
+    var fs52 = require("fs");
+    var path66 = require("path");
     var crypto6 = require("crypto");
     var osTmpDir = require_os_tmpdir();
     var _c2 = process.binding("constants");
@@ -43673,7 +43738,7 @@ var require_tmp = __commonJS({
     }
     function _generateTmpName(opts) {
       if (opts.name) {
-        return path62.join(opts.dir || tmpDir, opts.name);
+        return path66.join(opts.dir || tmpDir, opts.name);
       }
       if (opts.template) {
         return opts.template.replace(TEMPLATE_PATTERN, _randomChars(6));
@@ -43684,7 +43749,7 @@ var require_tmp = __commonJS({
         _randomChars(12),
         opts.postfix || ""
       ].join("");
-      return path62.join(opts.dir || tmpDir, name);
+      return path66.join(opts.dir || tmpDir, name);
     }
     function tmpName(options, callback) {
       var args = _parseArguments(options, callback), opts = args[0], cb = args[1], tries = opts.name ? 1 : opts.tries || DEFAULT_TRIES;
@@ -43694,7 +43759,7 @@ var require_tmp = __commonJS({
         return cb(new Error("Invalid template provided"));
       (function _getUniqueName() {
         const name = _generateTmpName(opts);
-        fs48.stat(name, function(err) {
+        fs52.stat(name, function(err) {
           if (!err) {
             if (tries-- > 0) return _getUniqueName();
             return cb(new Error("Could not get a unique tmp filename, max tries reached " + name));
@@ -43712,7 +43777,7 @@ var require_tmp = __commonJS({
       do {
         const name = _generateTmpName(opts);
         try {
-          fs48.statSync(name);
+          fs52.statSync(name);
         } catch (e) {
           return name;
         }
@@ -43724,13 +43789,13 @@ var require_tmp = __commonJS({
       opts.postfix = _isUndefined(opts.postfix) ? ".tmp" : opts.postfix;
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs48.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
+        fs52.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
           if (err2) return cb(err2);
           if (opts.discardDescriptor) {
-            return fs48.close(fd, function _discardCallback(err3) {
+            return fs52.close(fd, function _discardCallback(err3) {
               if (err3) {
                 try {
-                  fs48.unlinkSync(name);
+                  fs52.unlinkSync(name);
                 } catch (e) {
                   if (!isENOENT(e)) {
                     err3 = e;
@@ -43753,9 +43818,9 @@ var require_tmp = __commonJS({
       opts.postfix = opts.postfix || ".tmp";
       const discardOrDetachDescriptor = opts.discardDescriptor || opts.detachDescriptor;
       const name = tmpNameSync(opts);
-      var fd = fs48.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
+      var fd = fs52.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
       if (opts.discardDescriptor) {
-        fs48.closeSync(fd);
+        fs52.closeSync(fd);
         fd = void 0;
       }
       return {
@@ -43767,9 +43832,9 @@ var require_tmp = __commonJS({
     function _rmdirRecursiveSync(root) {
       const dirs = [root];
       do {
-        var dir2 = dirs.pop(), deferred = false, files = fs48.readdirSync(dir2);
+        var dir2 = dirs.pop(), deferred = false, files = fs52.readdirSync(dir2);
         for (var i = 0, length = files.length; i < length; i++) {
-          var file2 = path62.join(dir2, files[i]), stat = fs48.lstatSync(file2);
+          var file2 = path66.join(dir2, files[i]), stat = fs52.lstatSync(file2);
           if (stat.isDirectory()) {
             if (!deferred) {
               deferred = true;
@@ -43777,11 +43842,11 @@ var require_tmp = __commonJS({
             }
             dirs.push(file2);
           } else {
-            fs48.unlinkSync(file2);
+            fs52.unlinkSync(file2);
           }
         }
         if (!deferred) {
-          fs48.rmdirSync(dir2);
+          fs52.rmdirSync(dir2);
         }
       } while (dirs.length !== 0);
     }
@@ -43789,7 +43854,7 @@ var require_tmp = __commonJS({
       var args = _parseArguments(options, callback), opts = args[0], cb = args[1];
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs48.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
+        fs52.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
           if (err2) return cb(err2);
           cb(null, name, _prepareTmpDirRemoveCallback(name, opts));
         });
@@ -43798,7 +43863,7 @@ var require_tmp = __commonJS({
     function dirSync(options) {
       var args = _parseArguments(options), opts = args[0];
       const name = tmpNameSync(opts);
-      fs48.mkdirSync(name, opts.mode || DIR_MODE);
+      fs52.mkdirSync(name, opts.mode || DIR_MODE);
       return {
         name,
         removeCallback: _prepareTmpDirRemoveCallback(name, opts)
@@ -43808,7 +43873,7 @@ var require_tmp = __commonJS({
       const removeCallback = _prepareRemoveCallback(function _removeCallback(fdPath) {
         try {
           if (0 <= fdPath[0]) {
-            fs48.closeSync(fdPath[0]);
+            fs52.closeSync(fdPath[0]);
           }
         } catch (e) {
           if (!isEBADF(e) && !isENOENT(e)) {
@@ -43816,7 +43881,7 @@ var require_tmp = __commonJS({
           }
         }
         try {
-          fs48.unlinkSync(fdPath[1]);
+          fs52.unlinkSync(fdPath[1]);
         } catch (e) {
           if (!isENOENT(e)) {
             throw e;
@@ -43829,7 +43894,7 @@ var require_tmp = __commonJS({
       return removeCallback;
     }
     function _prepareTmpDirRemoveCallback(name, opts) {
-      const removeFunction = opts.unsafeCleanup ? _rmdirRecursiveSync : fs48.rmdirSync.bind(fs48);
+      const removeFunction = opts.unsafeCleanup ? _rmdirRecursiveSync : fs52.rmdirSync.bind(fs52);
       const removeCallback = _prepareRemoveCallback(removeFunction, name);
       if (!opts.keep) {
         _removeObjects.unshift(removeCallback);
@@ -44980,7 +45045,7 @@ var require_Observable = __commonJS({
       Observable2.prototype.forEach = function(next, promiseCtor) {
         var _this = this;
         promiseCtor = getPromiseCtor(promiseCtor);
-        return new promiseCtor(function(resolve47, reject) {
+        return new promiseCtor(function(resolve50, reject) {
           var subscriber = new Subscriber_1.SafeSubscriber({
             next: function(value) {
               try {
@@ -44991,7 +45056,7 @@ var require_Observable = __commonJS({
               }
             },
             error: reject,
-            complete: resolve47
+            complete: resolve50
           });
           _this.subscribe(subscriber);
         });
@@ -45013,14 +45078,14 @@ var require_Observable = __commonJS({
       Observable2.prototype.toPromise = function(promiseCtor) {
         var _this = this;
         promiseCtor = getPromiseCtor(promiseCtor);
-        return new promiseCtor(function(resolve47, reject) {
+        return new promiseCtor(function(resolve50, reject) {
           var value;
           _this.subscribe(function(x) {
             return value = x;
           }, function(err) {
             return reject(err);
           }, function() {
-            return resolve47(value);
+            return resolve50(value);
           });
         });
       };
@@ -47116,11 +47181,11 @@ var require_innerFrom = __commonJS({
     "use strict";
     var __awaiter = exports2 && exports2.__awaiter || function(thisArg, _arguments, P2, generator) {
       function adopt(value) {
-        return value instanceof P2 ? value : new P2(function(resolve47) {
-          resolve47(value);
+        return value instanceof P2 ? value : new P2(function(resolve50) {
+          resolve50(value);
         });
       }
-      return new (P2 || (P2 = Promise))(function(resolve47, reject) {
+      return new (P2 || (P2 = Promise))(function(resolve50, reject) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
@@ -47136,7 +47201,7 @@ var require_innerFrom = __commonJS({
           }
         }
         function step(result) {
-          result.done ? resolve47(result.value) : adopt(result.value).then(fulfilled, rejected);
+          result.done ? resolve50(result.value) : adopt(result.value).then(fulfilled, rejected);
         }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
       });
@@ -47218,14 +47283,14 @@ var require_innerFrom = __commonJS({
       }, i);
       function verb(n) {
         i[n] = o[n] && function(v2) {
-          return new Promise(function(resolve47, reject) {
-            v2 = o[n](v2), settle(resolve47, reject, v2.done, v2.value);
+          return new Promise(function(resolve50, reject) {
+            v2 = o[n](v2), settle(resolve50, reject, v2.done, v2.value);
           });
         };
       }
-      function settle(resolve47, reject, d, v2) {
+      function settle(resolve50, reject, d, v2) {
         Promise.resolve(v2).then(function(v3) {
-          resolve47({ value: v3, done: d });
+          resolve50({ value: v3, done: d });
         }, reject);
       }
     };
@@ -47844,7 +47909,7 @@ var require_lastValueFrom = __commonJS({
     var EmptyError_1 = require_EmptyError();
     function lastValueFrom2(source, config2) {
       var hasConfig = typeof config2 === "object";
-      return new Promise(function(resolve47, reject) {
+      return new Promise(function(resolve50, reject) {
         var _hasValue = false;
         var _value;
         source.subscribe({
@@ -47855,9 +47920,9 @@ var require_lastValueFrom = __commonJS({
           error: reject,
           complete: function() {
             if (_hasValue) {
-              resolve47(_value);
+              resolve50(_value);
             } else if (hasConfig) {
-              resolve47(config2.defaultValue);
+              resolve50(config2.defaultValue);
             } else {
               reject(new EmptyError_1.EmptyError());
             }
@@ -47879,16 +47944,16 @@ var require_firstValueFrom = __commonJS({
     var Subscriber_1 = require_Subscriber();
     function firstValueFrom(source, config2) {
       var hasConfig = typeof config2 === "object";
-      return new Promise(function(resolve47, reject) {
+      return new Promise(function(resolve50, reject) {
         var subscriber = new Subscriber_1.SafeSubscriber({
           next: function(value) {
-            resolve47(value);
+            resolve50(value);
             subscriber.unsubscribe();
           },
           error: reject,
           complete: function() {
             if (hasConfig) {
-              resolve47(config2.defaultValue);
+              resolve50(config2.defaultValue);
             } else {
               reject(new EmptyError_1.EmptyError());
             }
@@ -53681,14 +53746,14 @@ var require_run_async = __commonJS({
       return function() {
         var args = arguments;
         var originalThis = this;
-        var promise = new Promise(function(resolve47, reject) {
+        var promise = new Promise(function(resolve50, reject) {
           var resolved = false;
           const wrappedResolve = function(value) {
             if (resolved) {
               console.warn("Run-async promise already resolved.");
             }
             resolved = true;
-            resolve47(value);
+            resolve50(value);
           };
           var rejected = false;
           const wrappedReject = function(value) {
@@ -53788,32 +53853,32 @@ __export(otel_hooks_exports, {
 });
 function getOtelHooksHome() {
   if (process.env.HAR_OTEL_HOOKS_HOME) {
-    return path48.resolve(process.env.HAR_OTEL_HOOKS_HOME);
+    return path51.resolve(process.env.HAR_OTEL_HOOKS_HOME);
   }
-  return path48.join(os16.homedir(), ".har", "otel-hooks");
+  return path51.join(os17.homedir(), ".har", "otel-hooks");
 }
 function getOtelHooksConfigPath(hooksHome = getOtelHooksHome()) {
-  return path48.join(hooksHome, "otel_config.json");
+  return path51.join(hooksHome, "otel_config.json");
 }
 function getOtelHooksWrapperPath(hooksHome = getOtelHooksHome()) {
-  return path48.join(hooksHome, "run-otel-hook.sh");
+  return path51.join(hooksHome, "run-otel-hook.sh");
 }
 function getOtelHooksStateDir(hooksHome = getOtelHooksHome()) {
-  return path48.join(hooksHome, "state");
+  return path51.join(hooksHome, "state");
 }
 function localOtelHookBin(hooksHome) {
-  return path48.join(hooksHome, "node_modules", ".bin", "otel-hook");
+  return path51.join(hooksHome, "node_modules", ".bin", "otel-hook");
 }
 function installedPackageVersion(hooksHome) {
   try {
-    const pkgPath = path48.join(
+    const pkgPath = path51.join(
       hooksHome,
       "node_modules",
       "@osfactory",
       "otel-hook",
       "package.json"
     );
-    const pkg = JSON.parse(fs42.readFileSync(pkgPath, "utf8"));
+    const pkg = JSON.parse(fs45.readFileSync(pkgPath, "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -53864,15 +53929,15 @@ function buildOtelHooksConfig(options) {
   };
 }
 function writeOtelHooksConfig(config2, hooksHome = getOtelHooksHome()) {
-  fs42.mkdirSync(hooksHome, { recursive: true });
+  fs45.mkdirSync(hooksHome, { recursive: true });
   const configPath = getOtelHooksConfigPath(hooksHome);
-  fs42.writeFileSync(configPath, `${JSON.stringify(config2, null, 2)}
+  fs45.writeFileSync(configPath, `${JSON.stringify(config2, null, 2)}
 `);
   return configPath;
 }
 function writeOtelHooksWrapper(otelHookCommand, hooksHome = getOtelHooksHome()) {
-  fs42.mkdirSync(hooksHome, { recursive: true });
-  fs42.mkdirSync(getOtelHooksStateDir(hooksHome), { recursive: true });
+  fs45.mkdirSync(hooksHome, { recursive: true });
+  fs45.mkdirSync(getOtelHooksStateDir(hooksHome), { recursive: true });
   const wrapperPath = getOtelHooksWrapperPath(hooksHome);
   const configPath = getOtelHooksConfigPath(hooksHome);
   const stateDir = getOtelHooksStateDir(hooksHome);
@@ -53884,22 +53949,22 @@ exec "${otelHookCommand}" run \\
   --state-dir "${stateDir}" \\
   "$@"
 `;
-  fs42.writeFileSync(wrapperPath, script, { mode: 493 });
+  fs45.writeFileSync(wrapperPath, script, { mode: 493 });
   try {
-    fs42.chmodSync(wrapperPath, 493);
+    fs45.chmodSync(wrapperPath, 493);
   } catch {
   }
   return wrapperPath;
 }
 function commandExists3(command2) {
-  const result = (0, import_child_process12.spawnSync)("sh", ["-c", `command -v ${JSON.stringify(command2)}`], {
+  const result = (0, import_child_process13.spawnSync)("sh", ["-c", `command -v ${JSON.stringify(command2)}`], {
     encoding: "utf8"
   });
   return result.status === 0 && Boolean(result.stdout?.trim());
 }
 function resolveOtelHookCommand(hooksHome) {
   const local = localOtelHookBin(hooksHome);
-  if (fs42.existsSync(local)) return local;
+  if (fs45.existsSync(local)) return local;
   return null;
 }
 function resolveHooksInstaller(hooksHome) {
@@ -53914,7 +53979,7 @@ function resolveHooksInstaller(hooksHome) {
   return candidates.find((candidate) => commandExists3(candidate.command)) ?? null;
 }
 function tryInstallPackage(hooksHome) {
-  fs42.mkdirSync(hooksHome, { recursive: true });
+  fs45.mkdirSync(hooksHome, { recursive: true });
   const installer = resolveHooksInstaller(hooksHome);
   if (!installer) {
     return {
@@ -53923,11 +53988,11 @@ function tryInstallPackage(hooksHome) {
     };
   }
   const described = `${installer.command} ${installer.args.join(" ")}`;
-  const result = (0, import_child_process12.spawnSync)(installer.command, installer.args, {
+  const result = (0, import_child_process13.spawnSync)(installer.command, installer.args, {
     encoding: "utf8",
     timeout: 18e4
   });
-  if (result.status === 0 && fs42.existsSync(localOtelHookBin(hooksHome))) {
+  if (result.status === 0 && fs45.existsSync(localOtelHookBin(hooksHome))) {
     return { ok: true, detail: described };
   }
   return {
@@ -53945,7 +54010,7 @@ function uninstallLegacyPythonHooks(hooksHome) {
   for (const [cmd, args] of attempts) {
     if (!commandExists3(cmd)) continue;
     try {
-      (0, import_child_process12.spawnSync)(cmd, args, { encoding: "utf8", timeout: 6e4 });
+      (0, import_child_process13.spawnSync)(cmd, args, { encoding: "utf8", timeout: 6e4 });
     } catch {
     }
   }
@@ -53953,14 +54018,14 @@ function uninstallLegacyPythonHooks(hooksHome) {
 }
 function removeLegacyPythonArtifacts(hooksHome) {
   const legacyPaths = [
-    path48.join(hooksHome, ".venv"),
-    path48.join(hooksHome, "otel_config.yaml"),
-    path48.join(hooksHome, "venv")
+    path51.join(hooksHome, ".venv"),
+    path51.join(hooksHome, "otel_config.yaml"),
+    path51.join(hooksHome, "venv")
   ];
   for (const target of legacyPaths) {
     try {
-      if (fs42.existsSync(target)) {
-        fs42.rmSync(target, { recursive: true, force: true });
+      if (fs45.existsSync(target)) {
+        fs45.rmSync(target, { recursive: true, force: true });
       }
     } catch {
     }
@@ -53977,7 +54042,7 @@ function normalizeLegacyProviderFlagsInCommand(command2) {
 }
 function runSetupProvider(providerId, otelHookCommand, wrapperPath) {
   const hookCommand = `${wrapperPath} --provider ${providerId}`;
-  const result = (0, import_child_process12.spawnSync)(
+  const result = (0, import_child_process13.spawnSync)(
     otelHookCommand,
     [
       "setup",
@@ -54001,10 +54066,10 @@ function runSetupProvider(providerId, otelHookCommand, wrapperPath) {
   };
 }
 function rewriteHookCommandsToWrapper(filePath, wrapperPath) {
-  if (!fs42.existsSync(filePath)) return false;
+  if (!fs45.existsSync(filePath)) return false;
   let raw;
   try {
-    raw = fs42.readFileSync(filePath, "utf8");
+    raw = fs45.readFileSync(filePath, "utf8");
   } catch {
     return false;
   }
@@ -54051,15 +54116,15 @@ function rewriteHookCommandsToWrapper(filePath, wrapperPath) {
     return changed;
   };
   if (!walk(parsed)) return false;
-  fs42.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
+  fs45.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
 `);
   return true;
 }
 function pruneLegacyCursorHookEvents(filePath, wrapperPath) {
-  if (!fs42.existsSync(filePath)) return false;
+  if (!fs45.existsSync(filePath)) return false;
   let raw;
   try {
-    raw = fs42.readFileSync(filePath, "utf8");
+    raw = fs45.readFileSync(filePath, "utf8");
   } catch {
     return false;
   }
@@ -54094,21 +54159,21 @@ function pruneLegacyCursorHookEvents(filePath, wrapperPath) {
     }
   }
   if (!changed) return false;
-  fs42.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
+  fs45.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
 `);
   return true;
 }
 function rewriteKnownHookRegistrations(wrapperPath) {
-  const home = os16.homedir();
+  const home = os17.homedir();
   const candidates = [
-    path48.join(home, ".cursor", "hooks.json"),
-    path48.join(home, ".claude", "settings.json"),
-    path48.join(home, ".codex", "hooks.json")
+    path51.join(home, ".cursor", "hooks.json"),
+    path51.join(home, ".claude", "settings.json"),
+    path51.join(home, ".codex", "hooks.json")
   ];
   for (const filePath of candidates) {
     try {
       rewriteHookCommandsToWrapper(filePath, wrapperPath);
-      if (filePath.endsWith(`${path48.sep}.cursor${path48.sep}hooks.json`)) {
+      if (filePath.endsWith(`${path51.sep}.cursor${path51.sep}hooks.json`)) {
         pruneLegacyCursorHookEvents(filePath, wrapperPath);
       }
     } catch {
@@ -54124,7 +54189,7 @@ function ensureOtelHooks(options) {
   const hooksHome = getOtelHooksHome();
   const errors = [];
   const providersSetup = [];
-  fs42.mkdirSync(hooksHome, { recursive: true });
+  fs45.mkdirSync(hooksHome, { recursive: true });
   let otelHookCommand = resolveOtelHookCommand(hooksHome);
   const needsInstall = !otelHookCommand || installedPackageVersion(hooksHome) !== pinnedVersion();
   if (needsInstall) {
@@ -54218,14 +54283,14 @@ function ensureOtelHooks(options) {
 function disableOtelHooksExport() {
   return writeOtelHooksConfig(buildOtelHooksConfig({ enabled: false }));
 }
-var import_child_process12, fs42, os16, path48, OTEL_HOOKS_PACKAGE, OTEL_HOOKS_PROVIDERS, OTEL_HOOKS_AGENTS, LEGACY_CURSOR_ONLY_HOOK_EVENTS;
+var import_child_process13, fs45, os17, path51, OTEL_HOOKS_PACKAGE, OTEL_HOOKS_PROVIDERS, OTEL_HOOKS_AGENTS, LEGACY_CURSOR_ONLY_HOOK_EVENTS;
 var init_otel_hooks = __esm({
   "src/core/otel-hooks.ts"() {
     "use strict";
-    import_child_process12 = require("child_process");
-    fs42 = __toESM(require("fs"));
-    os16 = __toESM(require("os"));
-    path48 = __toESM(require("path"));
+    import_child_process13 = require("child_process");
+    fs45 = __toESM(require("fs"));
+    os17 = __toESM(require("os"));
+    path51 = __toESM(require("path"));
     init_control_config();
     init_telemetry_config();
     OTEL_HOOKS_PACKAGE = "@osfactory/otel-hook@0.2.0";
@@ -57200,7 +57265,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve47.call(this, root, ref);
+      let _sch = resolve50.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a2 = root.localRefs) === null || _a2 === void 0 ? void 0 : _a2[ref];
         const { schemaId } = this.opts;
@@ -57227,7 +57292,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve47(root, ref) {
+    function resolve50(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -57445,8 +57510,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path62) {
-      let input = path62;
+    function removeDotSegments(path66) {
+      let input = path66;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -57698,8 +57763,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path62, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path62 && path62 !== "/" ? path62 : void 0;
+        const [path66, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path66 && path66 !== "/" ? path66 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -57858,7 +57923,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve47(baseURI, relativeURI, options) {
+    function resolve50(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -58116,7 +58181,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize3,
-      resolve: resolve47,
+      resolve: resolve50,
       resolveComponent,
       equal,
       serialize,
@@ -61092,12 +61157,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs48, exportName) {
+    function addFormats(ajv, list, fs52, exportName) {
       var _a2;
       var _b2;
       (_a2 = (_b2 = ajv.opts.code).formats) !== null && _a2 !== void 0 ? _a2 : _b2.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs48[f]);
+        ajv.addFormat(f, fs52[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -62381,11 +62446,11 @@ var parser = new YargsParser({
   resolve: import_path2.resolve,
   // TODO: figure  out a  way to combine ESM and CJS coverage, such  that
   // we can exercise all the lines below:
-  require: (path62) => {
+  require: (path66) => {
     if (typeof require !== "undefined") {
-      return require(path62);
-    } else if (path62.match(/\.json$/)) {
-      return JSON.parse((0, import_fs2.readFileSync)(path62, "utf8"));
+      return require(path66);
+    } else if (path66.match(/\.json$/)) {
+      return JSON.parse((0, import_fs2.readFileSync)(path66, "utf8"));
     } else {
       throw Error("only .json config files are supported in ESM");
     }
@@ -64911,12 +64976,12 @@ var YargsInstance = class {
   async getCompletion(args, done) {
     argsert("<array> [function]", [args, done], arguments.length);
     if (!done) {
-      return new Promise((resolve47, reject) => {
+      return new Promise((resolve50, reject) => {
         __classPrivateFieldGet(this, _YargsInstance_completion, "f").getCompletion(args, (err, completions) => {
           if (err)
             reject(err);
           else
-            resolve47(completions);
+            resolve50(completions);
         });
       });
     } else {
@@ -66205,16 +66270,16 @@ async function handleAgentSkills(options) {
 }
 async function askYesNo(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve47) => {
+  return new Promise((resolve50) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
       if (trimmed === "") {
-        resolve47(true);
+        resolve50(true);
         return;
       }
-      resolve47(/^y(es)?$/i.test(trimmed));
+      resolve50(/^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -66294,7 +66359,7 @@ function handleRemove(argv) {
 }
 
 // src/cli/commands/env.ts
-var path51 = __toESM(require("path"));
+var path55 = __toESM(require("path"));
 
 // src/cli/finish-command.ts
 init_sync_context();
@@ -66304,12 +66369,12 @@ async function finishCommand(code) {
 }
 
 // src/core/harness.ts
-var fs38 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var fs41 = __toESM(require("fs"));
+var path46 = __toESM(require("path"));
 
 // src/harness/generator.ts
-var fs29 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var fs31 = __toESM(require("fs"));
+var path37 = __toESM(require("path"));
 init_file_ops();
 init_logging();
 
@@ -66363,12 +66428,163 @@ function isExpectedHarnessOnlyFile(harnessFile, templateFiles) {
 
 // src/harness/generator.ts
 init_manifest();
-init_stages();
+
+// src/harness/plugin-ledger.ts
+var fs29 = __toESM(require("fs"));
+var path35 = __toESM(require("path"));
+init_zod();
+init_file_ops();
+init_manifest();
+var PluginLedgerEntrySchema = external_exports.object({
+  id: external_exports.string().min(1),
+  source: external_exports.enum(["bundled", "path", "npm", "git"]),
+  /** Original install spec (id, path, package, or git URL). */
+  spec: external_exports.string().min(1),
+  /** Package/plugin version when known. */
+  version: external_exports.string().optional(),
+  stageIds: external_exports.array(external_exports.string().min(1)).min(1),
+  installedAt: external_exports.string()
+});
+var PluginLedgerSchema = external_exports.object({
+  version: external_exports.literal("1"),
+  /** Profile used at init, when known. */
+  profile: external_exports.enum(["default", "cli", "ios"]).optional(),
+  /** Ordered runtime bundles that composed the harness scaffold. */
+  bundles: external_exports.array(external_exports.string().min(1)).optional(),
+  plugins: external_exports.array(PluginLedgerEntrySchema).default([])
+});
+function getPluginLedgerPath(repoPath) {
+  return path35.join(path35.resolve(repoPath), DEFAULT_HAR_DIR, "plugins.json");
+}
+function readPluginLedger(repoPath) {
+  const ledgerPath = getPluginLedgerPath(repoPath);
+  if (!fs29.existsSync(ledgerPath)) return null;
+  try {
+    const raw = JSON.parse(fs29.readFileSync(ledgerPath, "utf8"));
+    const parsed = PluginLedgerSchema.safeParse(raw);
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function writePluginLedger(repoPath, ledger) {
+  const ledgerPath = getPluginLedgerPath(repoPath);
+  const harnessDir = path35.dirname(ledgerPath);
+  if (!fs29.existsSync(harnessDir)) {
+    fs29.mkdirSync(harnessDir, { recursive: true });
+  }
+  writeFileSafe(ledgerPath, `${JSON.stringify(ledger, null, 2)}
+`);
+}
+function upsertPluginLedgerEntry(repoPath, entry, extras) {
+  const existing = readPluginLedger(repoPath) ?? {
+    version: "1",
+    plugins: []
+  };
+  const plugins = existing.plugins.filter((p) => p.id !== entry.id);
+  plugins.push(entry);
+  plugins.sort((a, b2) => a.id.localeCompare(b2.id));
+  const ledger = {
+    version: "1",
+    profile: extras?.profile ?? existing.profile,
+    bundles: extras?.bundles ?? existing.bundles,
+    plugins
+  };
+  writePluginLedger(repoPath, ledger);
+  return ledger;
+}
+function ensurePluginLedgerScaffold(repoPath, options) {
+  const existing = readPluginLedger(repoPath);
+  const ledger = {
+    version: "1",
+    profile: options.profile ?? existing?.profile,
+    bundles: options.bundles ?? existing?.bundles,
+    plugins: existing?.plugins ?? []
+  };
+  writePluginLedger(repoPath, ledger);
+  return ledger;
+}
+
+// src/harness/profiles.ts
+var fs30 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
+init_zod();
+var HARNESS_PROFILES = ["default", "cli", "ios"];
+var ProfileBundleRefSchema = external_exports.object({
+  /** Stable bundle id recorded in .har/plugins.json */
+  id: external_exports.string().min(1),
+  /**
+   * Directory under src/templates/ (e.g. "runtime-bundles/shared-kernel"
+   * or "har-boilerplate").
+   */
+  path: external_exports.string().min(1)
+});
+var ProfileManifestSchema = external_exports.object({
+  id: external_exports.enum(HARNESS_PROFILES),
+  description: external_exports.string().min(1),
+  /** Ordered runtime bundles — later bundles overwrite earlier files on conflict. */
+  bundles: external_exports.array(ProfileBundleRefSchema).min(1)
+});
+var PROFILE_COMPOSITIONS = {
+  default: {
+    id: "default",
+    description: "Web app \u2014 shared kernel + PM2 runtime + Docker infra",
+    bundles: [
+      { id: "shared-kernel", path: "runtime-bundles/shared-kernel" },
+      { id: "pm2-runtime", path: "runtime-bundles/pm2-runtime" },
+      { id: "runtime-default", path: "har-boilerplate" }
+    ]
+  },
+  cli: {
+    id: "cli",
+    description: "CLI/library \u2014 shared kernel + CLI overlay (no PM2)",
+    bundles: [
+      { id: "shared-kernel", path: "runtime-bundles/shared-kernel" },
+      { id: "runtime-cli", path: "har-boilerplate-cli" }
+    ]
+  },
+  ios: {
+    id: "ios",
+    description: "iOS \u2014 shared kernel + Xcode/Simulator overlay",
+    bundles: [
+      { id: "shared-kernel", path: "runtime-bundles/shared-kernel" },
+      { id: "xcode-sim", path: "runtime-bundles/xcode-sim" },
+      { id: "runtime-ios", path: "har-boilerplate-ios" }
+    ]
+  }
+};
 var PROFILE_DIRS = {
   default: "har-boilerplate",
   cli: "har-boilerplate-cli",
   ios: "har-boilerplate-ios"
 };
+function readProfileManifest(profile) {
+  const templates = resolveTemplatesDir();
+  const manifestPath = path36.join(templates, "profiles", profile, "profile.manifest.json");
+  if (fs30.existsSync(manifestPath)) {
+    const parsed = ProfileManifestSchema.safeParse(
+      JSON.parse(fs30.readFileSync(manifestPath, "utf8"))
+    );
+    if (!parsed.success) {
+      throw new Error(`Invalid profile manifest for ${profile}: ${parsed.error.message}`);
+    }
+    if (parsed.data.id !== profile) {
+      throw new Error(`Profile manifest id mismatch: expected ${profile}, got ${parsed.data.id}`);
+    }
+    return parsed.data;
+  }
+  return PROFILE_COMPOSITIONS[profile];
+}
+function resolveProfileBundleDir(bundle) {
+  const dir = path36.join(resolveTemplatesDir(), bundle.path);
+  if (!fs30.existsSync(dir)) {
+    throw new Error(`Profile bundle not found: ${bundle.id} (${bundle.path}). Run npm run build.`);
+  }
+  return dir;
+}
+
+// src/harness/generator.ts
+init_stages();
 var CLI_PRUNE_FILES = [
   "ecosystem.agent.template.cjs",
   "env.template",
@@ -66376,39 +66592,46 @@ var CLI_PRUNE_FILES = [
 ];
 function pruneCliProfile(harnessDir) {
   for (const file of CLI_PRUNE_FILES) {
-    const filePath = path35.join(harnessDir, file);
-    if (fs29.existsSync(filePath)) {
-      fs29.unlinkSync(filePath);
+    const filePath = path37.join(harnessDir, file);
+    if (fs31.existsSync(filePath)) {
+      fs31.unlinkSync(filePath);
     }
   }
 }
 function scaffoldHarnessBoilerplate(repoPath, options = {}) {
-  const harnessDir = path35.join(repoPath, DEFAULT_HAR_DIR);
-  const projectName = path35.basename(repoPath).toLowerCase().replace(/[^a-z0-9]/g, "_");
+  const harnessDir = path37.join(repoPath, DEFAULT_HAR_DIR);
+  const projectName = path37.basename(repoPath).toLowerCase().replace(/[^a-z0-9]/g, "_");
   const profile = options.profile ?? "default";
-  const boilerplateDir = path35.join(resolveTemplatesDir(), PROFILE_DIRS[profile]);
-  if (fs29.existsSync(harnessDir) && !options.force) {
+  const profileManifest = readProfileManifest(profile);
+  const bundleIds = profileManifest.bundles.map((b2) => b2.id);
+  const primaryOverlay = PROFILE_DIRS[profile];
+  const boilerplateDir = path37.join(resolveTemplatesDir(), primaryOverlay);
+  if (fs31.existsSync(harnessDir) && !options.force) {
     throw new Error(
       '.har/ already exists. Use --force to overwrite or run "har env maintain" to update in place.'
     );
   }
-  if (!fs29.existsSync(boilerplateDir)) {
+  if (!fs31.existsSync(boilerplateDir)) {
     throw new Error(`Boilerplate template not found at ${boilerplateDir}`);
   }
-  if (options.force && fs29.existsSync(harnessDir)) {
-    fs29.rmSync(harnessDir, { recursive: true, force: true });
+  if (options.force && fs31.existsSync(harnessDir)) {
+    fs31.rmSync(harnessDir, { recursive: true, force: true });
+  }
+  fs31.mkdirSync(harnessDir, { recursive: true });
+  for (const bundle of profileManifest.bundles) {
+    const bundleDir = resolveProfileBundleDir(bundle);
+    copyDirRecursive(bundleDir, harnessDir);
   }
-  copyDirRecursive(boilerplateDir, harnessDir);
   writeHarnessGitignore(harnessDir, boilerplateDir);
   if (profile === "cli") {
     pruneCliProfile(harnessDir);
   }
   syncAgentSlotsToHarnessEnv(repoPath);
-  const harnessEnvPath = path35.join(harnessDir, "harness.env");
-  if (fs29.existsSync(harnessEnvPath)) {
-    let content = fs29.readFileSync(harnessEnvPath, "utf8");
+  const harnessEnvPath = path37.join(harnessDir, "harness.env");
+  if (fs31.existsSync(harnessEnvPath)) {
+    let content = fs31.readFileSync(harnessEnvPath, "utf8");
     content = content.replace(/__PROJECT_NAME__/g, projectName).replace(/template___PROJECT_NAME__/g, `template_${projectName}`);
-    fs29.writeFileSync(harnessEnvPath, content);
+    fs31.writeFileSync(harnessEnvPath, content);
   }
   const manifest = createManifest(
     repoPath,
@@ -66417,10 +66640,12 @@ function scaffoldHarnessBoilerplate(repoPath, options = {}) {
     profile
   );
   writeManifest(repoPath, manifest);
+  ensurePluginLedgerScaffold(repoPath, { profile, bundles: bundleIds });
   ensureRootGitignorePatterns(repoPath);
   success(`Copied harness boilerplate to .har/ (profile: ${profile})`);
   info(`Project name: ${projectName}`);
-  return { harnessDir, projectName };
+  info(`Bundles: ${bundleIds.join(" \u2192 ")}`);
+  return { harnessDir, projectName, bundles: bundleIds };
 }
 function finalizeHarness(repoPath, adaptationSummary, stack) {
   const existing = readManifest(repoPath);
@@ -66430,16 +66655,16 @@ function finalizeHarness(repoPath, adaptationSummary, stack) {
 }
 
 // src/harness/agent-md.ts
-var fs31 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var path39 = __toESM(require("path"));
 init_file_ops();
 init_logging();
 init_manifest();
 
 // src/harness/instruction-files.ts
-var fs30 = __toESM(require("fs"));
+var fs32 = __toESM(require("fs"));
 var os14 = __toESM(require("os"));
-var path36 = __toESM(require("path"));
+var path38 = __toESM(require("path"));
 
 // node_modules/@inquirer/core/dist/esm/lib/key.mjs
 var isUpKey = (key) => (
@@ -67459,13 +67684,13 @@ var PromisePolyfill = class extends Promise {
   // Available starting from Node 22
   // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/withResolvers
   static withResolver() {
-    let resolve47;
+    let resolve50;
     let reject;
     const promise = new Promise((res, rej) => {
-      resolve47 = res;
+      resolve50 = res;
       reject = rej;
     });
-    return { promise, resolve: resolve47, reject };
+    return { promise, resolve: resolve50, reject };
   }
 };
 
@@ -67482,7 +67707,7 @@ function createPrompt(view) {
       output
     });
     const screen = new ScreenManager(rl);
-    const { promise, resolve: resolve47, reject } = PromisePolyfill.withResolver();
+    const { promise, resolve: resolve50, reject } = PromisePolyfill.withResolver();
     const cancel = () => reject(new CancelPromptError());
     if (signal) {
       const abort = () => reject(new AbortPromptError({ cause: signal.reason }));
@@ -67506,7 +67731,7 @@ function createPrompt(view) {
       cycle(() => {
         try {
           const nextView = view(config2, (value) => {
-            setImmediate(() => resolve47(value));
+            setImmediate(() => resolve50(value));
           });
           const [content, bottomContent] = typeof nextView === "string" ? [nextView] : nextView;
           screen.render(content, bottomContent);
@@ -68493,9 +68718,9 @@ var import_run_async = __toESM(require_run_async(), 1);
 var import_mute_stream2 = __toESM(require_lib(), 1);
 var import_ansi_escapes5 = __toESM(require_ansi_escapes(), 1);
 var _ = {
-  set: (obj, path62 = "", value) => {
+  set: (obj, path66 = "", value) => {
     let pointer = obj;
-    path62.split(".").forEach((key, index, arr) => {
+    path66.split(".").forEach((key, index, arr) => {
       if (key === "__proto__" || key === "constructor")
         return;
       if (index === arr.length - 1) {
@@ -68506,8 +68731,8 @@ var _ = {
       pointer = pointer[key];
     });
   },
-  get: (obj, path62 = "", defaultValue) => {
-    const travel = (regexp) => String.prototype.split.call(path62, regexp).filter(Boolean).reduce(
+  get: (obj, path66 = "", defaultValue) => {
+    const travel = (regexp) => String.prototype.split.call(path66, regexp).filter(Boolean).reduce(
       // @ts-expect-error implicit any on res[key]
       (res, key) => res !== null && res !== void 0 ? res[key] : res,
       obj
@@ -68621,7 +68846,7 @@ var PromptsRunner = class {
       throw new Error(`Prompt for type ${question.type} not found`);
     }
     let cleanupSignal;
-    const promptFn = isPromptConstructor(prompt2) ? (q, { signal: signal2 } = {}) => new Promise((resolve47, reject) => {
+    const promptFn = isPromptConstructor(prompt2) ? (q, { signal: signal2 } = {}) => new Promise((resolve50, reject) => {
       const rl = import_node_readline.default.createInterface(setupReadlineOptions(this.opt));
       rl.resume();
       const onClose = () => {
@@ -68657,7 +68882,7 @@ var PromptsRunner = class {
           cleanupSignal = void 0;
         };
       }
-      activePrompt.run().then(resolve47, reject).finally(cleanup);
+      activePrompt.run().then(resolve50, reject).finally(cleanup);
     }) : prompt2;
     const { signal: moduleSignal } = this.opt;
     if (moduleSignal?.aborted) {
@@ -68833,12 +69058,12 @@ function outsideContentShrinkMessage(beforeLines, afterLines) {
 }
 function detectInstructionFiles(repoPath) {
   return {
-    agentsMd: fs30.existsSync(path36.join(repoPath, AGENTS_MD)),
-    agentMd: fs30.existsSync(path36.join(repoPath, LEGACY_AGENT_MD)),
-    claudeMd: fs30.existsSync(path36.join(repoPath, CLAUDE_MD)),
-    cursorDir: fs30.existsSync(path36.join(repoPath, ".cursor")),
-    claudeDir: fs30.existsSync(path36.join(repoPath, ".claude")),
-    codexHome: fs30.existsSync(path36.join(os14.homedir(), ".codex"))
+    agentsMd: fs32.existsSync(path38.join(repoPath, AGENTS_MD)),
+    agentMd: fs32.existsSync(path38.join(repoPath, LEGACY_AGENT_MD)),
+    claudeMd: fs32.existsSync(path38.join(repoPath, CLAUDE_MD)),
+    cursorDir: fs32.existsSync(path38.join(repoPath, ".cursor")),
+    claudeDir: fs32.existsSync(path38.join(repoPath, ".claude")),
+    codexHome: fs32.existsSync(path38.join(os14.homedir(), ".codex"))
   };
 }
 function formatDetectionReport(detection) {
@@ -68893,7 +69118,7 @@ function loadHarAgentsSectionFromTemplate() {
   if (!templatePath) {
     throw new Error("AGENTS.md.template not found. Run npm run build.");
   }
-  const content = fs30.readFileSync(templatePath, "utf8");
+  const content = fs32.readFileSync(templatePath, "utf8");
   const start = content.indexOf(HAR_SECTION_START);
   const end = content.indexOf(HAR_SECTION_END);
   if (start === -1 || end === -1 || end < start) {
@@ -68906,7 +69131,7 @@ function loadAgentsMdTemplate() {
   if (!templatePath) {
     throw new Error("AGENTS.md.template not found. Run npm run build.");
   }
-  return fs30.readFileSync(templatePath, "utf8");
+  return fs32.readFileSync(templatePath, "utf8");
 }
 function upsertMarkedBlock2(content, block, startMarker, endMarker) {
   const existingBlock = findLastCompleteMarkedBlock(content, startMarker, endMarker);
@@ -68939,13 +69164,13 @@ function mergeAgentsMdContent(existing, incoming) {
   return content;
 }
 function upsertAgentsMdHarSection(repoPath, options = {}) {
-  const dest = path36.join(repoPath, AGENTS_MD);
+  const dest = path38.join(repoPath, AGENTS_MD);
   const section = loadHarAgentsSectionFromTemplate();
-  if (!fs30.existsSync(dest)) {
+  if (!fs32.existsSync(dest)) {
     writeFileSafe(dest, loadAgentsMdTemplate());
     return "created";
   }
-  const existing = fs30.readFileSync(dest, "utf8");
+  const existing = fs32.readFileSync(dest, "utf8");
   const sanitized = stripClaudePointerFromAgentsMd(existing);
   const { content, action } = upsertMarkedBlock2(
     sanitized,
@@ -68970,15 +69195,15 @@ function upsertAgentsMdHarSection(repoPath, options = {}) {
   return action;
 }
 function migrateLegacyAgentMd(repoPath) {
-  const legacyPath = path36.join(repoPath, LEGACY_AGENT_MD);
-  const agentsPath = path36.join(repoPath, AGENTS_MD);
-  if (!fs30.existsSync(legacyPath)) return false;
-  const legacy = fs30.readFileSync(legacyPath, "utf8");
-  if (!fs30.existsSync(agentsPath)) {
+  const legacyPath = path38.join(repoPath, LEGACY_AGENT_MD);
+  const agentsPath = path38.join(repoPath, AGENTS_MD);
+  if (!fs32.existsSync(legacyPath)) return false;
+  const legacy = fs32.readFileSync(legacyPath, "utf8");
+  if (!fs32.existsSync(agentsPath)) {
     writeFileSafe(agentsPath, legacy);
     upsertAgentsMdHarSection(repoPath);
   } else {
-    const agents = fs30.readFileSync(agentsPath, "utf8");
+    const agents = fs32.readFileSync(agentsPath, "utf8");
     const legacyTrimmed = legacy.trim();
     if (legacyTrimmed.length > 0 && !agents.includes(legacyTrimmed)) {
       const suffix = agents.endsWith("\n") ? "" : "\n";
@@ -68988,7 +69213,7 @@ ${legacyTrimmed}
     }
     upsertAgentsMdHarSection(repoPath);
   }
-  fs30.unlinkSync(legacyPath);
+  fs32.unlinkSync(legacyPath);
   info(`Migrated ${LEGACY_AGENT_MD} \u2192 ${AGENTS_MD} (removed legacy file)`);
   return true;
 }
@@ -68998,7 +69223,7 @@ function loadClaudeMdTemplate(projectName) {
     throw new Error("CLAUDE.md.template not found. Run npm run build.");
   }
   const displayName = projectName.replace(/_/g, " ");
-  return fs30.readFileSync(templatePath, "utf8").replace(/__PROJECT_DISPLAY_NAME__/g, displayName);
+  return fs32.readFileSync(templatePath, "utf8").replace(/__PROJECT_DISPLAY_NAME__/g, displayName);
 }
 function isThinClaudePointer(content) {
   const trimmed = content.trim();
@@ -69012,14 +69237,14 @@ This repository uses a \`.har/\` harness. Read [AGENTS.md](./AGENTS.md) and
 [\`.har/README.md\`](./.har/README.md) before making changes.
 ${CLAUDE_HAR_SECTION_END}`;
 function ensureClaudeMdPointer(repoPath, options = {}) {
-  const dest = path36.join(repoPath, CLAUDE_MD);
-  const projectName = path36.basename(repoPath).toLowerCase().replace(/[^a-z0-9]/g, "_");
+  const dest = path38.join(repoPath, CLAUDE_MD);
+  const projectName = path38.basename(repoPath).toLowerCase().replace(/[^a-z0-9]/g, "_");
   const thin = loadClaudeMdTemplate(projectName);
-  if (!fs30.existsSync(dest)) {
+  if (!fs32.existsSync(dest)) {
     writeFileSafe(dest, thin);
     return "created";
   }
-  const existing = fs30.readFileSync(dest, "utf8");
+  const existing = fs32.readFileSync(dest, "utf8");
   if (isThinClaudePointer(existing) || options.force) {
     writeFileSafe(dest, thin);
     return "updated";
@@ -69168,19 +69393,19 @@ var AGENT_MD_PROPOSAL = "AGENT.md.proposed";
 var AGENT_MD_PROPOSAL_META = "AGENT.md.proposed.meta.json";
 function readAgentMdProposal(repoPath) {
   const harnessDir = getHarnessDir(repoPath);
-  const proposalPath = path37.join(harnessDir, AGENTS_MD_PROPOSAL);
-  const metaPath = path37.join(harnessDir, AGENTS_MD_PROPOSAL_META);
-  const legacyProposalPath = path37.join(harnessDir, AGENT_MD_PROPOSAL);
-  const legacyMetaPath = path37.join(harnessDir, AGENT_MD_PROPOSAL_META);
-  const resolvedProposal = fs31.existsSync(proposalPath) ? proposalPath : fs31.existsSync(legacyProposalPath) ? legacyProposalPath : null;
+  const proposalPath = path39.join(harnessDir, AGENTS_MD_PROPOSAL);
+  const metaPath = path39.join(harnessDir, AGENTS_MD_PROPOSAL_META);
+  const legacyProposalPath = path39.join(harnessDir, AGENT_MD_PROPOSAL);
+  const legacyMetaPath = path39.join(harnessDir, AGENT_MD_PROPOSAL_META);
+  const resolvedProposal = fs33.existsSync(proposalPath) ? proposalPath : fs33.existsSync(legacyProposalPath) ? legacyProposalPath : null;
   if (!resolvedProposal) return null;
   const resolvedMeta = resolvedProposal === proposalPath ? metaPath : legacyMetaPath;
-  const content = fs31.readFileSync(resolvedProposal, "utf8");
+  const content = fs33.readFileSync(resolvedProposal, "utf8");
   let rationale = "";
   let createdAt = (/* @__PURE__ */ new Date()).toISOString();
-  if (fs31.existsSync(resolvedMeta)) {
+  if (fs33.existsSync(resolvedMeta)) {
     try {
-      const meta = JSON.parse(fs31.readFileSync(resolvedMeta, "utf8"));
+      const meta = JSON.parse(fs33.readFileSync(resolvedMeta, "utf8"));
       rationale = meta.rationale ?? "";
       createdAt = meta.createdAt ?? createdAt;
     } catch {
@@ -69197,8 +69422,8 @@ function clearAgentMdProposal(repoPath) {
     AGENT_MD_PROPOSAL,
     AGENT_MD_PROPOSAL_META
   ]) {
-    const p = path37.join(harnessDir, file);
-    if (fs31.existsSync(p)) fs31.unlinkSync(p);
+    const p = path39.join(harnessDir, file);
+    if (fs33.existsSync(p)) fs33.unlinkSync(p);
   }
 }
 function wouldProposalShrinkExisting(existing, proposal) {
@@ -69211,9 +69436,9 @@ function wouldProposalShrinkExisting(existing, proposal) {
 function applyAgentMdProposalMerge(repoPath, options = {}) {
   const proposal = readAgentMdProposal(repoPath);
   if (!proposal) return false;
-  const agentsMdPath = path37.join(repoPath, AGENTS_MD);
-  if (fs31.existsSync(agentsMdPath)) {
-    const existing = fs31.readFileSync(agentsMdPath, "utf8");
+  const agentsMdPath = path39.join(repoPath, AGENTS_MD);
+  if (fs33.existsSync(agentsMdPath)) {
+    const existing = fs33.readFileSync(agentsMdPath, "utf8");
     if (wouldProposalShrinkExisting(existing, proposal.content)) {
       const message = `${AGENTS_MD} proposal would drop project-specific content outside har:agent-environment markers \u2014 merge custom sections from .har/${AGENTS_MD_PROPOSAL} manually, then delete the proposal.`;
       if (options.rejectSignificantShrink) {
@@ -69236,8 +69461,8 @@ function finalizeAgentsMdInstructionFiles(repoPath) {
 }
 
 // src/harness/validator.ts
-var fs32 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var path40 = __toESM(require("path"));
 init_shell();
 init_manifest();
 init_stages();
@@ -69292,22 +69517,22 @@ var SHELL_SCRIPTS = [
 function validateHarness(repoPath) {
   const harnessDir = getHarnessDir(repoPath);
   const issues = [];
-  if (!fs32.existsSync(harnessDir)) {
+  if (!fs34.existsSync(harnessDir)) {
     return {
       pass: false,
       issues: [{ file: ".har", message: "Harness directory not found", severity: "error" }]
     };
   }
   for (const file of getRequiredFiles(repoPath)) {
-    const filePath = path38.join(harnessDir, file);
-    if (!fs32.existsSync(filePath)) {
+    const filePath = path40.join(harnessDir, file);
+    if (!fs34.existsSync(filePath)) {
       issues.push({ file, message: "Required file missing", severity: "error" });
     }
   }
   for (const script of SHELL_SCRIPTS) {
-    const scriptPath = path38.join(harnessDir, script);
-    if (!fs32.existsSync(scriptPath)) continue;
-    const stat = fs32.statSync(scriptPath);
+    const scriptPath = path40.join(harnessDir, script);
+    if (!fs34.existsSync(scriptPath)) continue;
+    const stat = fs34.statSync(scriptPath);
     if (!(stat.mode & 73)) {
       issues.push({ file: script, message: "Script is not executable", severity: "warning" });
     }
@@ -69322,9 +69547,9 @@ function validateHarness(repoPath) {
   }
   const manifest = readManifest(repoPath);
   const profile = manifest?.profile ?? "default";
-  const ecosystemPath = path38.join(harnessDir, "ecosystem.agent.template.cjs");
-  if (profile !== "cli" && fs32.existsSync(ecosystemPath)) {
-    const content = fs32.readFileSync(ecosystemPath, "utf8");
+  const ecosystemPath = path40.join(harnessDir, "ecosystem.agent.template.cjs");
+  if (profile !== "cli" && fs34.existsSync(ecosystemPath)) {
+    const content = fs34.readFileSync(ecosystemPath, "utf8");
     if (!content.includes("module.exports")) {
       issues.push({
         file: "ecosystem.agent.template.cjs",
@@ -69333,9 +69558,9 @@ function validateHarness(repoPath) {
       });
     }
   }
-  const harnessEnvPath = path38.join(harnessDir, "harness.env");
-  if (fs32.existsSync(harnessEnvPath)) {
-    const content = fs32.readFileSync(harnessEnvPath, "utf8");
+  const harnessEnvPath = path40.join(harnessDir, "harness.env");
+  if (fs34.existsSync(harnessEnvPath)) {
+    const content = fs34.readFileSync(harnessEnvPath, "utf8");
     if (content.includes("TODO: set migrate command")) {
       issues.push({ file: "harness.env", message: "Migrate command still has TODO", severity: "warning" });
     }
@@ -69343,17 +69568,17 @@ function validateHarness(repoPath) {
       issues.push({ file: "harness.env", message: "Seed command still has TODO", severity: "warning" });
     }
   }
-  const verifyPath = path38.join(harnessDir, "verify.sh");
-  if (fs32.existsSync(verifyPath)) {
-    const content = fs32.readFileSync(verifyPath, "utf8");
+  const verifyPath = path40.join(harnessDir, "verify.sh");
+  if (fs34.existsSync(verifyPath)) {
+    const content = fs34.readFileSync(verifyPath, "utf8");
     if (content.includes("echo 'TODO:")) {
       issues.push({ file: "verify.sh", message: "Verification steps still have TODO placeholders", severity: "warning" });
     }
   }
-  const stagesPath = path38.join(harnessDir, "stages.json");
-  if (fs32.existsSync(stagesPath)) {
+  const stagesPath = path40.join(harnessDir, "stages.json");
+  if (fs34.existsSync(stagesPath)) {
     try {
-      JSON.parse(fs32.readFileSync(stagesPath, "utf8"));
+      JSON.parse(fs34.readFileSync(stagesPath, "utf8"));
       const registry2 = readStageRegistry(repoPath);
       if (registry2.stages.length === 0) {
         issues.push({ file: "stages.json", message: "No harness stages declared", severity: "warning" });
@@ -69368,9 +69593,9 @@ function validateHarness(repoPath) {
   } else {
     issues.push({ file: "stages.json", message: "Stage registry missing", severity: "warning" });
   }
-  const readmePath = path38.join(harnessDir, "README.md");
-  if (fs32.existsSync(readmePath)) {
-    const content = fs32.readFileSync(readmePath, "utf8");
+  const readmePath = path40.join(harnessDir, "README.md");
+  if (fs34.existsSync(readmePath)) {
+    const content = fs34.readFileSync(readmePath, "utf8");
     if (!content.includes(".har")) {
       issues.push({ file: "README.md", message: "README should document .har/ paths", severity: "warning" });
     }
@@ -69384,8 +69609,8 @@ function validateHarness(repoPath) {
 async function smokeTestHarness(repoPath) {
   const harnessDir = getHarnessDir(repoPath);
   const issues = [];
-  const setupScript = path38.join(harnessDir, "setup-infra.sh");
-  if (fs32.existsSync(setupScript)) {
+  const setupScript = path40.join(harnessDir, "setup-infra.sh");
+  if (fs34.existsSync(setupScript)) {
     const result = run(`bash "${setupScript}"`, { cwd: repoPath });
     if (result.code !== 0) {
       issues.push({
@@ -69400,16 +69625,11 @@ async function smokeTestHarness(repoPath) {
 }
 
 // src/harness/drift.ts
-var fs33 = __toESM(require("fs"));
-var path39 = __toESM(require("path"));
+var fs35 = __toESM(require("fs"));
+var path41 = __toESM(require("path"));
 init_env();
 init_manifest();
 init_stages();
-var PROFILE_DIRS2 = {
-  default: "har-boilerplate",
-  cli: "har-boilerplate-cli",
-  ios: "har-boilerplate-ios"
-};
 var CLI_EXPECTED_ABSENT = /* @__PURE__ */ new Set([
   "ecosystem.agent.template.cjs",
   "env.template",
@@ -69472,16 +69692,16 @@ function substituteProjectName(content, projectName) {
   return content.replace(/__PROJECT_NAME__/g, projectName).replace(/template___PROJECT_NAME__/g, `template_${projectName}`);
 }
 function listBoilerplateFiles(boilerplateDir) {
-  if (!fs33.existsSync(boilerplateDir)) return [];
-  return fs33.readdirSync(boilerplateDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
+  if (!fs35.existsSync(boilerplateDir)) return [];
+  return fs35.readdirSync(boilerplateDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
 }
 function compareHarnessToTemplate(repoPath) {
-  const resolved = path39.resolve(repoPath);
+  const resolved = path41.resolve(repoPath);
   const manifest = readManifest(resolved);
   const profile = manifest?.profile ?? "default";
   const harnessDir = getHarnessDir(resolved);
-  const projectName = path39.basename(resolved).toLowerCase().replace(/[^a-z0-9]/g, "_");
-  const boilerplateDir = path39.join(resolveTemplatesDir(), PROFILE_DIRS2[profile]);
+  const projectName = path41.basename(resolved).toLowerCase().replace(/[^a-z0-9]/g, "_");
+  const boilerplateDir = path41.join(resolveTemplatesDir(), PROFILE_DIRS[profile]);
   const templateFiles = listBoilerplateFiles(boilerplateDir);
   const missing = [];
   const checksumMismatch = [];
@@ -69489,17 +69709,17 @@ function compareHarnessToTemplate(repoPath) {
   const unchanged = [];
   for (const file of templateFiles) {
     const harnessFile = harnessFileForTemplate(file);
-    const templatePath = path39.join(boilerplateDir, file);
-    const harnessPath = path39.join(harnessDir, harnessFile);
-    let templateContent = fs33.readFileSync(templatePath, "utf8");
+    const templatePath = path41.join(boilerplateDir, file);
+    const harnessPath = path41.join(harnessDir, harnessFile);
+    let templateContent = fs35.readFileSync(templatePath, "utf8");
     if (file === "harness.env") {
       templateContent = substituteProjectName(templateContent, projectName);
     }
-    if (!fs33.existsSync(harnessPath)) {
+    if (!fs35.existsSync(harnessPath)) {
       missing.push(harnessFile);
       continue;
     }
-    const harnessChecksum = computeFileChecksum(fs33.readFileSync(harnessPath, "utf8"));
+    const harnessChecksum = computeFileChecksum(fs35.readFileSync(harnessPath, "utf8"));
     const templateChecksum = computeFileChecksum(templateContent);
     if (harnessChecksum === templateChecksum) {
       unchanged.push(harnessFile);
@@ -69507,11 +69727,13 @@ function compareHarnessToTemplate(repoPath) {
       checksumMismatch.push(harnessFile);
     }
   }
-  if (fs33.existsSync(harnessDir)) {
-    for (const file of fs33.readdirSync(harnessDir)) {
-      const full = path39.join(harnessDir, file);
-      if (!fs33.statSync(full).isFile()) continue;
-      if (file === "manifest.json" || file.startsWith("ADAPT-PROMPT")) continue;
+  if (fs35.existsSync(harnessDir)) {
+    for (const file of fs35.readdirSync(harnessDir)) {
+      const full = path41.join(harnessDir, file);
+      if (!fs35.statSync(full).isFile()) continue;
+      if (file === "manifest.json" || file === "plugins.json" || file.startsWith("ADAPT-PROMPT")) {
+        continue;
+      }
       if (profile === "cli" && CLI_EXPECTED_ABSENT.has(file)) {
         extra.push(file);
       } else if (isExpectedHarnessOnlyFile(file, templateFiles)) {
@@ -69541,107 +69763,356 @@ function compareHarnessToTemplate(repoPath) {
 }
 
 // src/harness/maintain-bundle.ts
-var fs37 = __toESM(require("fs"));
-var os15 = __toESM(require("os"));
-var path42 = __toESM(require("path"));
+var fs40 = __toESM(require("fs"));
+var os16 = __toESM(require("os"));
+var path45 = __toESM(require("path"));
 init_file_ops();
 init_shell();
 init_manifest();
 
 // src/harness/plugin-drift.ts
-var fs36 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var fs39 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
 init_manifest();
 
 // src/harness/plugins.ts
-var fs35 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
+var fs38 = __toESM(require("fs"));
+var path43 = __toESM(require("path"));
 init_zod();
 init_logging();
 
 // src/harness/parser.ts
-var fs34 = __toESM(require("fs"));
+var fs36 = __toESM(require("fs"));
 init_manifest();
 function harnessExists(repoPath) {
-  return fs34.existsSync(`${repoPath}/.har/setup-infra.sh`);
+  return fs36.existsSync(`${repoPath}/.har/setup-infra.sh`);
+}
+
+// src/harness/plugin-resolve.ts
+var import_child_process10 = require("child_process");
+var fs37 = __toESM(require("fs"));
+var os15 = __toESM(require("os"));
+var path42 = __toESM(require("path"));
+function hasManifest(dir) {
+  return fs37.existsSync(path42.join(dir, "template.manifest.json"));
+}
+function readPackageVersion(dir) {
+  const pkgPath = path42.join(dir, "package.json");
+  if (!fs37.existsSync(pkgPath)) return void 0;
+  try {
+    const pkg = JSON.parse(fs37.readFileSync(pkgPath, "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readManifestId(dir) {
+  const manifestPath = path42.join(dir, "template.manifest.json");
+  if (!fs37.existsSync(manifestPath)) return void 0;
+  try {
+    const raw = JSON.parse(fs37.readFileSync(manifestPath, "utf8"));
+    return typeof raw.id === "string" ? raw.id : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function looksLikePath(spec) {
+  return spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("~") || spec.startsWith("file:");
+}
+function looksLikeGit(spec) {
+  return spec.startsWith("git+") || spec.startsWith("github:") || spec.startsWith("gitlab:") || spec.startsWith("bitbucket:") || /^https?:\/\/.+\.git$/i.test(spec) || /^git@/.test(spec);
+}
+function looksLikeNpm(spec) {
+  if (looksLikePath(spec) || looksLikeGit(spec)) return false;
+  if (spec.includes("/") && !spec.startsWith("@")) return false;
+  return /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@.+)?$/i.test(spec);
+}
+function resolveBundledDir(pluginId) {
+  const dir = path42.join(resolveTemplatesDir(), "plugins", pluginId);
+  return hasManifest(dir) ? dir : null;
+}
+function expandHome(p) {
+  if (p.startsWith("~/")) return path42.join(os15.homedir(), p.slice(2));
+  if (p === "~") return os15.homedir();
+  return p;
+}
+function resolvePathSpec(spec) {
+  const raw = spec.startsWith("file:") ? spec.slice("file:".length) : spec;
+  const dir = path42.resolve(expandHome(raw));
+  if (!fs37.existsSync(dir) || !fs37.statSync(dir).isDirectory()) {
+    throw new Error(`Plugin path not found: ${spec}`);
+  }
+  if (!hasManifest(dir)) {
+    throw new Error(`No template.manifest.json in ${dir}`);
+  }
+  const id = readManifestId(dir) ?? path42.basename(dir);
+  return {
+    id,
+    kind: "path",
+    dir,
+    spec,
+    version: readPackageVersion(dir),
+    cleanupDirs: []
+  };
+}
+function makeTempDir(prefix) {
+  return fs37.mkdtempSync(path42.join(os15.tmpdir(), prefix));
+}
+function resolveNpmSpec(spec) {
+  const tmp = makeTempDir("har-plugin-npm-");
+  const cleanupDirs = [tmp];
+  try {
+    (0, import_child_process10.execFileSync)("npm", ["pack", spec, "--pack-destination", tmp], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 12e4
+    });
+    const tarballs = fs37.readdirSync(tmp).filter((f) => f.endsWith(".tgz"));
+    if (tarballs.length === 0) {
+      throw new Error(`npm pack produced no tarball for ${spec}`);
+    }
+    const extractDir = path42.join(tmp, "extract");
+    fs37.mkdirSync(extractDir);
+    (0, import_child_process10.execFileSync)("tar", ["-xzf", path42.join(tmp, tarballs[0]), "-C", extractDir], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const packageDir = path42.join(extractDir, "package");
+    let dir = packageDir;
+    if (!hasManifest(dir)) {
+      const nested = fs37.readdirSync(extractDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path42.join(extractDir, e.name)).find((d) => hasManifest(d));
+      if (!nested) {
+        throw new Error(
+          `npm package ${spec} has no template.manifest.json (not a HAR plugin bundle)`
+        );
+      }
+      dir = nested;
+    }
+    const id = readManifestId(dir) ?? spec.replace(/^@/, "").replace(/[/:].*/g, "");
+    return {
+      id,
+      kind: "npm",
+      dir,
+      spec,
+      version: readPackageVersion(dir),
+      cleanupDirs
+    };
+  } catch (err) {
+    for (const d of cleanupDirs) {
+      fs37.rmSync(d, { recursive: true, force: true });
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to install plugin from npm (${spec}): ${message}`);
+  }
+}
+function resolveGitSpec(spec) {
+  const tmp = makeTempDir("har-plugin-git-");
+  const cleanupDirs = [tmp];
+  const cloneDir = path42.join(tmp, "repo");
+  try {
+    let url = spec;
+    if (spec.startsWith("github:")) {
+      url = `https://github.com/${spec.slice("github:".length)}.git`;
+    } else if (spec.startsWith("gitlab:")) {
+      url = `https://gitlab.com/${spec.slice("gitlab:".length)}.git`;
+    } else if (spec.startsWith("bitbucket:")) {
+      url = `https://bitbucket.org/${spec.slice("bitbucket:".length)}.git`;
+    } else if (spec.startsWith("git+")) {
+      url = spec.slice("git+".length);
+    }
+    (0, import_child_process10.execFileSync)("git", ["clone", "--depth", "1", url, cloneDir], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 18e4
+    });
+    let dir = cloneDir;
+    if (!hasManifest(dir)) {
+      const pluginsRoot = path42.join(cloneDir, "plugins");
+      if (fs37.existsSync(pluginsRoot)) {
+        const child = fs37.readdirSync(pluginsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path42.join(pluginsRoot, e.name)).find((d) => hasManifest(d));
+        if (child) dir = child;
+      }
+    }
+    if (!hasManifest(dir)) {
+      throw new Error(`Git repo ${spec} has no template.manifest.json (not a HAR plugin bundle)`);
+    }
+    const id = readManifestId(dir) ?? path42.basename(url.replace(/\.git$/, ""));
+    return {
+      id,
+      kind: "git",
+      dir,
+      spec,
+      version: readPackageVersion(dir),
+      cleanupDirs
+    };
+  } catch (err) {
+    for (const d of cleanupDirs) {
+      fs37.rmSync(d, { recursive: true, force: true });
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to install plugin from git (${spec}): ${message}`);
+  }
+}
+function resolvePluginSource(spec) {
+  const trimmed = spec.trim();
+  if (!trimmed) {
+    throw new Error("Plugin spec is empty");
+  }
+  if (looksLikePath(trimmed)) {
+    return resolvePathSpec(trimmed);
+  }
+  if (looksLikeGit(trimmed)) {
+    return resolveGitSpec(trimmed);
+  }
+  const bundled = resolveBundledDir(trimmed);
+  if (bundled) {
+    return {
+      id: trimmed,
+      kind: "bundled",
+      dir: bundled,
+      spec: trimmed,
+      version: readPackageVersion(bundled),
+      cleanupDirs: []
+    };
+  }
+  if (looksLikeNpm(trimmed) && (trimmed.includes("@") || trimmed.includes("/"))) {
+    return resolveNpmSpec(trimmed);
+  }
+  if (looksLikeNpm(trimmed)) {
+    try {
+      return resolveNpmSpec(trimmed);
+    } catch (npmErr) {
+      const available2 = listBundledPluginIds();
+      const npmMessage = npmErr instanceof Error ? npmErr.message : String(npmErr);
+      throw new Error(
+        `Unknown plugin: ${trimmed}. Bundled: ${available2.join(", ") || "(none)"}. Or pass a path, npm package, or git URL. (${npmMessage})`
+      );
+    }
+  }
+  const available = listBundledPluginIds();
+  throw new Error(
+    `Unknown plugin: ${trimmed}. Bundled: ${available.join(", ") || "(none)"}. Or pass a path (./plugin), npm package (@org/pkg), or git URL (github:org/repo).`
+  );
+}
+function listBundledPluginIds() {
+  const root = path42.join(resolveTemplatesDir(), "plugins");
+  if (!fs37.existsSync(root)) return [];
+  return fs37.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => hasManifest(path42.join(root, name))).sort();
+}
+function cleanupResolvedPlugin(source) {
+  for (const dir of source.cleanupDirs) {
+    fs37.rmSync(dir, { recursive: true, force: true });
+  }
 }
 
 // src/harness/plugins.ts
 init_schema2();
 init_stages();
-var PLUGIN_IDS = ["playwright", "rocketsim", "kerno", "gitleaks", "trivy", "semgrep"];
 var PluginManifestFileSchema = external_exports.object({
   src: external_exports.string().min(1),
   dest: external_exports.string().min(1),
   executable: external_exports.boolean().optional(),
   skipFlag: external_exports.string().optional()
 });
+var PluginIdSchema = external_exports.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/i, "Plugin id must be a slug (letters, digits, ._-)");
 var PluginManifestSchema = external_exports.object({
-  id: external_exports.enum(PLUGIN_IDS),
-  stageId: external_exports.string().min(1),
+  id: PluginIdSchema,
+  /** @deprecated Prefer `stages` — primary stage id for single-stage plugins. */
+  stageId: external_exports.string().min(1).optional(),
   verificationStages: external_exports.array(external_exports.string().min(1)).min(1),
-  stage: external_exports.record(external_exports.unknown()),
+  /** @deprecated Prefer `stages` — single stage object. */
+  stage: external_exports.record(external_exports.unknown()).optional(),
+  /** One or more stages registered by this plugin. */
+  stages: external_exports.array(external_exports.record(external_exports.unknown())).optional(),
   files: external_exports.array(PluginManifestFileSchema).min(1),
   optionalFiles: external_exports.array(PluginManifestFileSchema).optional(),
   merge: external_exports.record(external_exports.string()).optional(),
   nextSteps: external_exports.array(external_exports.string().min(1)).min(1),
   docsPath: external_exports.string().min(1)
+}).superRefine((data, ctx) => {
+  const hasStages = Array.isArray(data.stages) && data.stages.length > 0;
+  const hasLegacy = data.stage !== void 0 && data.stageId !== void 0;
+  if (!hasStages && !hasLegacy) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Plugin manifest requires `stages` (preferred) or legacy `stage` + `stageId`"
+    });
+  }
 });
-function resolvePluginDir(pluginId) {
-  const dir = path40.join(resolveTemplatesDir(), "plugins", pluginId);
-  if (!fs35.existsSync(dir)) {
+function normalizePluginStages(manifest) {
+  if (manifest.stages && manifest.stages.length > 0) {
+    return manifest.stages.map((s) => HarnessStageSchema.parse(s));
+  }
+  if (manifest.stage) {
+    return [HarnessStageSchema.parse(manifest.stage)];
+  }
+  throw new Error(`Plugin ${manifest.id} has no stages`);
+}
+function primaryStageId(manifest) {
+  const stages = normalizePluginStages(manifest);
+  return manifest.stageId ?? stages[0].id;
+}
+function resolveBundledPluginDir(pluginId) {
+  const dir = path43.join(resolveTemplatesDir(), "plugins", pluginId);
+  if (!fs38.existsSync(dir)) {
     throw new Error(`Plugin not found: ${pluginId}. Run npm run build.`);
   }
   return dir;
 }
-function readPluginManifest(pluginId) {
-  const manifestPath = path40.join(resolvePluginDir(pluginId), "template.manifest.json");
+function readPluginManifestFromDir(pluginDir, expectedId) {
+  const manifestPath = path43.join(pluginDir, "template.manifest.json");
+  if (!fs38.existsSync(manifestPath)) {
+    throw new Error(`No template.manifest.json in ${pluginDir}`);
+  }
   const parsed = PluginManifestSchema.safeParse(
-    JSON.parse(fs35.readFileSync(manifestPath, "utf8"))
+    JSON.parse(fs38.readFileSync(manifestPath, "utf8"))
   );
   if (!parsed.success) {
-    throw new Error(`Invalid plugin manifest for ${pluginId}: ${parsed.error.message}`);
+    throw new Error(`Invalid plugin manifest: ${parsed.error.message}`);
   }
-  if (parsed.data.id !== pluginId) {
-    throw new Error(`Plugin manifest id mismatch: expected ${pluginId}, got ${parsed.data.id}`);
+  if (expectedId && parsed.data.id !== expectedId) {
+    throw new Error(`Plugin manifest id mismatch: expected ${expectedId}, got ${parsed.data.id}`);
   }
   return parsed.data;
 }
+function readPluginManifest(pluginId) {
+  return readPluginManifestFromDir(resolveBundledPluginDir(pluginId), pluginId);
+}
 function ensureParentDir(filePath) {
-  const parent = path40.dirname(filePath);
-  if (!fs35.existsSync(parent)) {
-    fs35.mkdirSync(parent, { recursive: true });
+  const parent = path43.dirname(filePath);
+  if (!fs38.existsSync(parent)) {
+    fs38.mkdirSync(parent, { recursive: true });
   }
 }
 function copyPluginFile(pluginDir, file, repoPath, force) {
-  const srcPath = path40.join(pluginDir, file.src);
-  const destPath = path40.join(repoPath, file.dest);
-  if (!fs35.existsSync(srcPath)) {
+  const srcPath = path43.join(pluginDir, file.src);
+  const destPath = path43.join(repoPath, file.dest);
+  if (!fs38.existsSync(srcPath)) {
     throw new Error(`Plugin file missing: ${file.src}`);
   }
-  if (fs35.existsSync(destPath) && !force) {
+  if (fs38.existsSync(destPath) && !force) {
     throw new Error(
       `File already exists: ${file.dest}. Use --force to overwrite or remove it first.`
     );
   }
   ensureParentDir(destPath);
-  fs35.copyFileSync(srcPath, destPath);
+  fs38.copyFileSync(srcPath, destPath);
   if (file.executable) {
-    fs35.chmodSync(destPath, 493);
+    fs38.chmodSync(destPath, 493);
   }
   return { written: true, path: file.dest };
 }
 function mergePackageJson(repoPath, pluginDir, fragmentRelPath, warnings) {
-  const packagePath = path40.join(repoPath, "package.json");
-  if (!fs35.existsSync(packagePath)) {
+  const packagePath = path43.join(repoPath, "package.json");
+  if (!fs38.existsSync(packagePath)) {
     throw new Error("No package.json in repo root. Add one before applying this plugin.");
   }
-  const fragmentPath = path40.join(pluginDir, fragmentRelPath);
-  if (!fs35.existsSync(fragmentPath)) {
+  const fragmentPath = path43.join(pluginDir, fragmentRelPath);
+  if (!fs38.existsSync(fragmentPath)) {
     throw new Error(`Package fragment missing: ${fragmentRelPath}`);
   }
-  const pkg = JSON.parse(fs35.readFileSync(packagePath, "utf8"));
-  const fragment = JSON.parse(fs35.readFileSync(fragmentPath, "utf8"));
+  const pkg = JSON.parse(fs38.readFileSync(packagePath, "utf8"));
+  const fragment = JSON.parse(fs38.readFileSync(fragmentPath, "utf8"));
   for (const section of ["scripts", "devDependencies"]) {
     const existing = pkg[section] ?? {};
     const incoming = fragment[section] ?? {};
@@ -69654,35 +70125,37 @@ function mergePackageJson(repoPath, pluginDir, fragmentRelPath, warnings) {
     }
     pkg[section] = existing;
   }
-  fs35.writeFileSync(packagePath, JSON.stringify(pkg, null, 2) + "\n");
+  fs38.writeFileSync(packagePath, JSON.stringify(pkg, null, 2) + "\n");
 }
-function patchStageRegistry(repoPath, manifest, force) {
+function patchStageRegistry(repoPath, stages, verificationStageIds, force) {
   const registry2 = readStageRegistry(repoPath);
-  const stage = HarnessStageSchema.parse(manifest.stage);
-  const existing = registry2.stages.find((s) => s.id === stage.id);
-  if (existing && !force) {
-    throw new Error(
-      `Stage "${stage.id}" already registered in .har/stages.json. Use --force to replace.`
-    );
+  let nextStages = [...registry2.stages];
+  for (const stage of stages) {
+    const existing = nextStages.find((s) => s.id === stage.id);
+    if (existing && !force) {
+      throw new Error(
+        `Stage "${stage.id}" already registered in .har/stages.json. Use --force to replace.`
+      );
+    }
+    nextStages = existing ? nextStages.map((s) => s.id === stage.id ? stage : s) : [...nextStages, stage];
   }
-  const stages = existing ? registry2.stages.map((s) => s.id === stage.id ? stage : s) : [...registry2.stages, stage];
   const verificationStages = [...registry2.verificationStages ?? []];
-  for (const id of manifest.verificationStages) {
+  for (const id of verificationStageIds) {
     if (!verificationStages.includes(id)) {
       verificationStages.push(id);
     }
   }
-  const verifyIdx = stages.findIndex((s) => s.id === "verify");
+  const verifyIdx = nextStages.findIndex((s) => s.id === "verify");
   if (verifyIdx >= 0) {
-    stages[verifyIdx] = {
-      ...stages[verifyIdx],
+    nextStages[verifyIdx] = {
+      ...nextStages[verifyIdx],
       description: `Verification pipeline (quick smoke by default; --full runs the registry's verificationStages: ${verificationStages.join(", ")})`,
       acceptsArgs: ["--full"]
     };
   }
   const updated = {
     ...registry2,
-    stages,
+    stages: nextStages,
     verificationStages
   };
   writeStageRegistry(repoPath, updated);
@@ -69692,30 +70165,33 @@ function assertHarnessPresent(repoPath) {
     throw new Error('No .har/ harness found. Run "har env init" first.');
   }
 }
-function assertStageNotPresent(repoPath, stageId, force) {
+function assertStagesNotPresent(repoPath, stageIds, force) {
   if (force) return;
-  const scriptPath = path40.join(repoPath, ".har", "stages", `${stageId}.sh`);
-  if (fs35.existsSync(scriptPath)) {
-    throw new Error(
-      `Stage script already exists: .har/stages/${stageId}.sh. Use --force to overwrite.`
-    );
-  }
   const registry2 = readStageRegistry(repoPath);
-  if (registry2.stages.some((s) => s.id === stageId)) {
-    throw new Error(
-      `Stage "${stageId}" already registered in .har/stages.json. Use --force to replace.`
-    );
+  for (const stageId of stageIds) {
+    const scriptPath = path43.join(repoPath, ".har", "stages", `${stageId}.sh`);
+    if (fs38.existsSync(scriptPath)) {
+      throw new Error(
+        `Stage script already exists: .har/stages/${stageId}.sh. Use --force to overwrite.`
+      );
+    }
+    if (registry2.stages.some((s) => s.id === stageId)) {
+      throw new Error(
+        `Stage "${stageId}" already registered in .har/stages.json. Use --force to replace.`
+      );
+    }
   }
 }
-function applyPlugin(repoPath, pluginId, options = {}) {
-  const resolved = path40.resolve(repoPath);
+function applyPluginFromDir(repoPath, pluginDir, options, meta) {
+  const resolved = path43.resolve(repoPath);
   const force = options.force ?? false;
   const warnings = [];
   const filesWritten = [];
   assertHarnessPresent(resolved);
-  const manifest = readPluginManifest(pluginId);
-  assertStageNotPresent(resolved, manifest.stageId, force);
-  const pluginDir = resolvePluginDir(pluginId);
+  const manifest = readPluginManifestFromDir(pluginDir);
+  const stages = normalizePluginStages(manifest);
+  const stageIds = stages.map((s) => s.id);
+  assertStagesNotPresent(resolved, stageIds, force);
   for (const file of manifest.files) {
     const result = copyPluginFile(pluginDir, file, resolved, force);
     if (result.written) {
@@ -69727,7 +70203,7 @@ function applyPlugin(repoPath, pluginId, options = {}) {
       if (file.skipFlag === "skipCi" && options.skipCi) {
         continue;
       }
-      if (fs35.existsSync(path40.join(resolved, file.dest)) && !force) {
+      if (fs38.existsSync(path43.join(resolved, file.dest)) && !force) {
         warnings.push(`Skipped optional file (exists): ${file.dest}`);
         continue;
       }
@@ -69743,9 +70219,18 @@ function applyPlugin(repoPath, pluginId, options = {}) {
       filesWritten.push("package.json");
     }
   }
-  patchStageRegistry(resolved, manifest, force);
-  success(`Applied plugin: ${pluginId}`);
-  info(`Registered stage: ${manifest.stageId}`);
+  patchStageRegistry(resolved, stages, manifest.verificationStages, force);
+  upsertPluginLedgerEntry(resolved, {
+    id: manifest.id,
+    source: meta.source,
+    spec: meta.spec,
+    version: meta.version,
+    stageIds,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  const primary = primaryStageId(manifest);
+  success(`Applied plugin: ${manifest.id}`);
+  info(`Registered stage(s): ${stageIds.join(", ")}`);
   for (const file of filesWritten) {
     info(`  + ${file}`);
   }
@@ -69753,50 +70238,88 @@ function applyPlugin(repoPath, pluginId, options = {}) {
     warn(`  \u26A0 ${warning}`);
   }
   return {
-    pluginId,
-    stageId: manifest.stageId,
+    pluginId: manifest.id,
+    stageId: primary,
+    stageIds,
     filesWritten,
     warnings,
     nextSteps: manifest.nextSteps,
-    docsPath: manifest.docsPath
+    docsPath: manifest.docsPath,
+    source: meta.source
   };
 }
+function applyPlugin(repoPath, pluginSpec, options = {}) {
+  const spec = options.spec ?? pluginSpec;
+  const source = resolvePluginSource(spec);
+  try {
+    return applyPluginFromDir(repoPath, source.dir, options, {
+      source: source.kind,
+      spec: source.spec,
+      version: source.version
+    });
+  } finally {
+    cleanupResolvedPlugin(source);
+  }
+}
 function listPluginIds() {
-  const root = path40.join(resolveTemplatesDir(), "plugins");
-  if (!fs35.existsSync(root)) return [...PLUGIN_IDS];
-  return fs35.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => PLUGIN_IDS.includes(name));
+  return listBundledPluginIds();
 }
 
 // src/harness/plugin-drift.ts
 init_stages();
 var PACKAGE_SECTIONS = ["scripts", "devDependencies"];
 function detectInstalledPlugins(repoPath) {
-  const resolved = path41.resolve(repoPath);
-  const registryPath = path41.join(resolved, ".har", "stages.json");
-  if (!fs36.existsSync(registryPath)) return [];
+  const resolved = path44.resolve(repoPath);
+  const ledger = readPluginLedger(resolved);
+  if (ledger && ledger.plugins.length > 0) {
+    return ledger.plugins.map((p) => p.id).sort();
+  }
+  const registryPath = path44.join(resolved, ".har", "stages.json");
+  if (!fs39.existsSync(registryPath)) return [];
   const registry2 = readStageRegistry(resolved);
   const stageIds = new Set(registry2.stages.map((stage) => stage.id));
   const installed = [];
-  for (const pluginId of PLUGIN_IDS) {
-    const manifest = readPluginManifest(pluginId);
-    if (stageIds.has(manifest.stageId)) {
-      installed.push(pluginId);
+  for (const pluginId of listPluginIds()) {
+    try {
+      const manifest = readPluginManifest(pluginId);
+      const primary = primaryStageId(manifest);
+      if (stageIds.has(primary)) {
+        installed.push(pluginId);
+      }
+    } catch {
     }
   }
-  return installed;
+  return installed.sort();
 }
 function pluginTemplatePath(pluginId, srcRel) {
-  return path41.join(resolveTemplatesDir(), "plugins", pluginId, srcRel);
+  return path44.join(resolveTemplatesDir(), "plugins", pluginId, srcRel);
+}
+function resolvePluginTemplateDir(repoPath, pluginId) {
+  const ledger = readPluginLedger(repoPath);
+  const entry = ledger?.plugins.find((p) => p.id === pluginId);
+  if (entry && entry.source !== "bundled") {
+    try {
+      const source = resolvePluginSource(entry.spec);
+      cleanupResolvedPlugin(source);
+    } catch {
+    }
+  }
+  const bundled = path44.join(resolveTemplatesDir(), "plugins", pluginId);
+  if (fs39.existsSync(path44.join(bundled, "template.manifest.json"))) {
+    return bundled;
+  }
+  return null;
 }
 function readBundledPluginFile(pluginId, srcRel) {
-  return fs36.readFileSync(pluginTemplatePath(pluginId, srcRel), "utf8");
+  return fs39.readFileSync(pluginTemplatePath(pluginId, srcRel), "utf8");
 }
 function listPluginDestPaths(pluginId, repoPath) {
-  const manifest = readPluginManifest(pluginId);
+  const templateDir = resolvePluginTemplateDir(repoPath, pluginId);
+  const manifest = templateDir ? readPluginManifestFromDir(templateDir) : readPluginManifest(pluginId);
   const paths = manifest.files.map((file) => file.dest);
   if (manifest.optionalFiles) {
     for (const file of manifest.optionalFiles) {
-      if (fs36.existsSync(path41.join(repoPath, file.dest))) {
+      if (fs39.existsSync(path44.join(repoPath, file.dest))) {
         paths.push(file.dest);
       }
     }
@@ -69855,9 +70378,9 @@ function readTemplatePluginFile(pluginId, dest) {
   return null;
 }
 function readInstalledPluginFile(repoPath, pluginId, dest) {
-  const installedPath = path41.join(path41.resolve(repoPath), dest);
-  if (!fs36.existsSync(installedPath)) return null;
-  const content = fs36.readFileSync(installedPath, "utf8");
+  const installedPath = path44.join(path44.resolve(repoPath), dest);
+  if (!fs39.existsSync(installedPath)) return null;
+  const content = fs39.readFileSync(installedPath, "utf8");
   const manifest = readPluginManifest(pluginId);
   const fragmentRel = manifest.merge?.[dest];
   if (fragmentRel) {
@@ -69876,7 +70399,7 @@ function pluginActionHint(pluginId, dest, kind) {
 }
 function comparePluginToTemplate(repoPath, pluginId) {
   const manifest = readPluginManifest(pluginId);
-  const resolved = path41.resolve(repoPath);
+  const resolved = path44.resolve(repoPath);
   const destPaths = listPluginDestPaths(pluginId, resolved);
   const missing = [];
   const checksumMismatch = [];
@@ -69891,8 +70414,8 @@ function comparePluginToTemplate(repoPath, pluginId) {
     }
     if (dest === "package.json") {
       const fragmentRel = manifest.merge?.[dest];
-      const installedPath = path41.join(resolved, dest);
-      const installedRaw = fs36.readFileSync(installedPath, "utf8");
+      const installedPath = path44.join(resolved, dest);
+      const installedRaw = fs39.readFileSync(installedPath, "utf8");
       if (fragmentRel && pluginKeysMatch(installedRaw, readBundledPluginFile(pluginId, fragmentRel))) {
         unchanged.push(dest);
       } else if (computeFileChecksum(installedContent) === computeFileChecksum(templateContent)) {
@@ -69910,16 +70433,17 @@ function comparePluginToTemplate(repoPath, pluginId) {
   }
   return {
     pluginId,
-    stageId: manifest.stageId,
+    stageId: primaryStageId(manifest),
     missing,
     checksumMismatch,
     unchanged
   };
 }
 function compareInstalledPluginsToTemplate(repoPath) {
-  return detectInstalledPlugins(repoPath).map(
-    (pluginId) => comparePluginToTemplate(repoPath, pluginId)
-  );
+  return detectInstalledPlugins(repoPath).filter((pluginId) => {
+    const bundled = path44.join(resolveTemplatesDir(), "plugins", pluginId, "template.manifest.json");
+    return fs39.existsSync(bundled);
+  }).map((pluginId) => comparePluginToTemplate(repoPath, pluginId));
 }
 function buildPluginDriftActions(repoPath, pluginDrift) {
   const actions = [];
@@ -69952,23 +70476,18 @@ function buildPluginDriftActions(repoPath, pluginDrift) {
 
 // src/harness/maintain-bundle.ts
 var MAINTAIN_DIR = "maintain";
-var PROFILE_DIRS3 = {
-  default: "har-boilerplate",
-  cli: "har-boilerplate-cli",
-  ios: "har-boilerplate-ios"
-};
 function substituteProjectName2(content, projectName) {
   return content.replace(/__PROJECT_NAME__/g, projectName).replace(/template___PROJECT_NAME__/g, `template_${projectName}`);
 }
 function projectNameFromRepo(repoPath) {
-  return path42.basename(repoPath).toLowerCase().replace(/[^a-z0-9]/g, "_");
+  return path45.basename(repoPath).toLowerCase().replace(/[^a-z0-9]/g, "_");
 }
 function boilerplateDirForProfile(profile) {
-  return path42.join(resolveTemplatesDir(), PROFILE_DIRS3[profile]);
+  return path45.join(resolveTemplatesDir(), PROFILE_DIRS[profile]);
 }
 function readBundledTemplateContent(repoPath, profile, file) {
-  const templatePath = path42.join(boilerplateDirForProfile(profile), templateFileForHarness(file));
-  let content = fs37.readFileSync(templatePath, "utf8");
+  const templatePath = path45.join(boilerplateDirForProfile(profile), templateFileForHarness(file));
+  let content = fs40.readFileSync(templatePath, "utf8");
   if (file === "harness.env") {
     content = substituteProjectName2(content, projectNameFromRepo(repoPath));
   }
@@ -69999,12 +70518,12 @@ function actionHint(file, kind) {
   return `Read maintain/diffs/${file}.diff and merge into .har/${file}.`;
 }
 function createUnifiedDiff(installedContent, templateContent, installedLabel, templateLabel) {
-  const tmpDir = fs37.mkdtempSync(path42.join(os15.tmpdir(), "har-maintain-diff-"));
+  const tmpDir = fs40.mkdtempSync(path45.join(os16.tmpdir(), "har-maintain-diff-"));
   try {
-    const installedPath = path42.join(tmpDir, "installed");
-    const templatePath = path42.join(tmpDir, "template");
-    fs37.writeFileSync(installedPath, installedContent);
-    fs37.writeFileSync(templatePath, templateContent);
+    const installedPath = path45.join(tmpDir, "installed");
+    const templatePath = path45.join(tmpDir, "template");
+    fs40.writeFileSync(installedPath, installedContent);
+    fs40.writeFileSync(templatePath, templateContent);
     const result = run(`diff -u "${installedPath}" "${templatePath}"`);
     const body = result.stdout.trim();
     if (!body) return "";
@@ -70013,7 +70532,7 @@ function createUnifiedDiff(installedContent, templateContent, installedLabel, te
 ${body.split("\n").slice(2).join("\n")}
 `;
   } finally {
-    fs37.rmSync(tmpDir, { recursive: true, force: true });
+    fs40.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
 function buildActions(repoPath, profile, drift) {
@@ -70028,7 +70547,7 @@ function buildActions(repoPath, profile, drift) {
     });
   }
   for (const file of drift.checksumMismatch) {
-    const installedPath = path42.join(harnessDir, file);
+    const installedPath = path45.join(harnessDir, file);
     const installedRel = `maintain/installed/${file}`;
     const templateRel = `maintain/templates/${file}`;
     const diffRel = `maintain/diffs/${file}.diff`;
@@ -70036,7 +70555,7 @@ function buildActions(repoPath, profile, drift) {
       file,
       kind: "drift",
       template: templateRel,
-      installed: fs37.existsSync(installedPath) ? installedRel : void 0,
+      installed: fs40.existsSync(installedPath) ? installedRel : void 0,
       diff: diffRel,
       hint: actionHint(file, "drift")
     });
@@ -70188,28 +70707,28 @@ function buildReadme(report) {
 }
 function writeBundleArtifacts(repoPath, profile, drift, report) {
   const harnessDir = getHarnessDir(repoPath);
-  const bundleDir = path42.join(harnessDir, MAINTAIN_DIR);
-  if (fs37.existsSync(bundleDir)) {
-    fs37.rmSync(bundleDir, { recursive: true, force: true });
+  const bundleDir = path45.join(harnessDir, MAINTAIN_DIR);
+  if (fs40.existsSync(bundleDir)) {
+    fs40.rmSync(bundleDir, { recursive: true, force: true });
   }
   const dirs = [
     bundleDir,
-    path42.join(bundleDir, "templates"),
-    path42.join(bundleDir, "installed"),
-    path42.join(bundleDir, "diffs"),
-    path42.join(bundleDir, "stale")
+    path45.join(bundleDir, "templates"),
+    path45.join(bundleDir, "installed"),
+    path45.join(bundleDir, "diffs"),
+    path45.join(bundleDir, "stale")
   ];
   for (const dir of dirs) {
-    fs37.mkdirSync(dir, { recursive: true });
+    fs40.mkdirSync(dir, { recursive: true });
   }
   const affectedFiles = [...drift.missing, ...drift.checksumMismatch];
   for (const file of affectedFiles) {
     const templateContent = readBundledTemplateContent(repoPath, profile, file);
-    writeFileSafe(path42.join(bundleDir, "templates", file), templateContent);
-    const harnessPath = path42.join(harnessDir, file);
-    if (fs37.existsSync(harnessPath)) {
-      const installedContent = fs37.readFileSync(harnessPath, "utf8");
-      writeFileSafe(path42.join(bundleDir, "installed", file), installedContent);
+    writeFileSafe(path45.join(bundleDir, "templates", file), templateContent);
+    const harnessPath = path45.join(harnessDir, file);
+    if (fs40.existsSync(harnessPath)) {
+      const installedContent = fs40.readFileSync(harnessPath, "utf8");
+      writeFileSafe(path45.join(bundleDir, "installed", file), installedContent);
       const diff = createUnifiedDiff(
         installedContent,
         templateContent,
@@ -70217,14 +70736,14 @@ function writeBundleArtifacts(repoPath, profile, drift, report) {
         `templates/${file}`
       );
       if (diff) {
-        writeFileSafe(path42.join(bundleDir, "diffs", `${file}.diff`), diff);
+        writeFileSafe(path45.join(bundleDir, "diffs", `${file}.diff`), diff);
       }
     }
   }
-  writeFileSafe(path42.join(bundleDir, "README.md"), buildReadme(report));
-  writeFileSafe(path42.join(bundleDir, "drift-report.json"), JSON.stringify(report, null, 2) + "\n");
+  writeFileSafe(path45.join(bundleDir, "README.md"), buildReadme(report));
+  writeFileSafe(path45.join(bundleDir, "drift-report.json"), JSON.stringify(report, null, 2) + "\n");
   writeFileSafe(
-    path42.join(bundleDir, "validation.json"),
+    path45.join(bundleDir, "validation.json"),
     JSON.stringify(report.validation, null, 2) + "\n"
   );
   if (report.stale.length > 0) {
@@ -70236,34 +70755,34 @@ function writeBundleArtifacts(repoPath, profile, drift, report) {
       ...report.stale.map((s) => `- **${s.file}** \u2014 ${s.hint}`),
       ""
     ];
-    writeFileSafe(path42.join(bundleDir, "stale", "MANIFEST.md"), staleLines.join("\n"));
+    writeFileSafe(path45.join(bundleDir, "stale", "MANIFEST.md"), staleLines.join("\n"));
   }
   return bundleDir;
 }
 function ensureParentDir2(filePath) {
-  const parent = path42.dirname(filePath);
-  if (!fs37.existsSync(parent)) {
-    fs37.mkdirSync(parent, { recursive: true });
+  const parent = path45.dirname(filePath);
+  if (!fs40.existsSync(parent)) {
+    fs40.mkdirSync(parent, { recursive: true });
   }
 }
 function writePluginBundleArtifacts(repoPath, bundleDir, report) {
   if (report.pluginActions.length === 0) return;
   for (const action of report.pluginActions) {
-    const pluginRoot = path42.join(bundleDir, "plugins", action.pluginId);
-    const templatesDir = path42.join(pluginRoot, "templates");
-    const installedDir = path42.join(pluginRoot, "installed");
-    const diffsDir = path42.join(pluginRoot, "diffs");
+    const pluginRoot = path45.join(bundleDir, "plugins", action.pluginId);
+    const templatesDir = path45.join(pluginRoot, "templates");
+    const installedDir = path45.join(pluginRoot, "installed");
+    const diffsDir = path45.join(pluginRoot, "diffs");
     for (const dir of [templatesDir, installedDir, diffsDir]) {
-      fs37.mkdirSync(dir, { recursive: true });
+      fs40.mkdirSync(dir, { recursive: true });
     }
     const templateContent = readTemplatePluginFile(action.pluginId, action.file);
     if (templateContent === null) continue;
-    const templatePath = path42.join(templatesDir, action.file);
+    const templatePath = path45.join(templatesDir, action.file);
     ensureParentDir2(templatePath);
     writeFileSafe(templatePath, templateContent);
     const installedContent = readInstalledPluginFile(repoPath, action.pluginId, action.file);
     if (installedContent !== null) {
-      const installedPath = path42.join(installedDir, action.file);
+      const installedPath = path45.join(installedDir, action.file);
       ensureParentDir2(installedPath);
       writeFileSafe(installedPath, installedContent);
       const diff = createUnifiedDiff(
@@ -70273,7 +70792,7 @@ function writePluginBundleArtifacts(repoPath, bundleDir, report) {
         `templates/${action.file}`
       );
       if (diff) {
-        const diffPath = path42.join(diffsDir, `${action.file}.diff`);
+        const diffPath = path45.join(diffsDir, `${action.file}.diff`);
         ensureParentDir2(diffPath);
         writeFileSafe(diffPath, diff);
       }
@@ -70309,9 +70828,9 @@ function buildMaintainBundle(repoPath, validation2, drift) {
   return { bundleDir, report };
 }
 function removeMaintainBundle(repoPath) {
-  const bundleDir = path42.join(getHarnessDir(repoPath), MAINTAIN_DIR);
-  if (fs37.existsSync(bundleDir)) {
-    fs37.rmSync(bundleDir, { recursive: true, force: true });
+  const bundleDir = path45.join(getHarnessDir(repoPath), MAINTAIN_DIR);
+  if (fs40.existsSync(bundleDir)) {
+    fs40.rmSync(bundleDir, { recursive: true, force: true });
   }
 }
 function formatMaintainBundlePromptSection(report) {
@@ -70400,11 +70919,11 @@ init_manifest();
 init_stages();
 function listHarnessScripts(repoPath) {
   const harnessDir = getHarnessDir(repoPath);
-  if (!fs38.existsSync(harnessDir)) return [];
-  return fs38.readdirSync(harnessDir).filter((name) => name.endsWith(".sh")).sort();
+  if (!fs41.existsSync(harnessDir)) return [];
+  return fs41.readdirSync(harnessDir).filter((name) => name.endsWith(".sh")).sort();
 }
 function describeProject(repoPath) {
-  const resolved = path43.resolve(repoPath);
+  const resolved = path46.resolve(repoPath);
   const manifest = readManifest(resolved);
   const present = harnessExists(resolved);
   return {
@@ -70424,8 +70943,8 @@ function describeProject(repoPath) {
   };
 }
 async function initHarness(options) {
-  const repoPath = path43.resolve(options.repoPath);
-  if (!fs38.existsSync(repoPath)) {
+  const repoPath = path46.resolve(options.repoPath);
+  if (!fs41.existsSync(repoPath)) {
     throw new Error(`Path not found: ${repoPath}`);
   }
   const scaffold = scaffoldHarnessBoilerplate(repoPath, {
@@ -70445,9 +70964,9 @@ async function initHarness(options) {
   };
 }
 async function maintainHarness(options) {
-  const repoPath = path43.resolve(options.repoPath);
+  const repoPath = path46.resolve(options.repoPath);
   const harnessDir = getHarnessDir(repoPath);
-  if (!fs38.existsSync(harnessDir)) {
+  if (!fs41.existsSync(harnessDir)) {
     throw new Error('No .har/ found. Run "har env init" first.');
   }
   const drift = compareHarnessToTemplate(repoPath);
@@ -70482,13 +71001,13 @@ function addPlugin(repoPath, pluginId, options = {}) {
 }
 
 // src/harness/custom-stage.ts
-var fs39 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var fs42 = __toESM(require("fs"));
+var path47 = __toESM(require("path"));
 init_schema2();
 init_stages();
 var STAGE_ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 function addCustomStage(repoPath, options) {
-  const resolved = path44.resolve(repoPath);
+  const resolved = path47.resolve(repoPath);
   if (!harnessExists(resolved)) {
     throw new Error('No .har/ harness found. Run "har env init" first.');
   }
@@ -70525,20 +71044,20 @@ function addCustomStage(repoPath, options) {
   if (options.command) {
     stage.command = options.command;
   } else {
-    const scriptRel = path44.join("stages", `${id}.sh`);
-    const scriptAbs = path44.join(resolved, ".har", scriptRel);
-    if (fs39.existsSync(scriptAbs) && !options.force) {
+    const scriptRel = path47.join("stages", `${id}.sh`);
+    const scriptAbs = path47.join(resolved, ".har", scriptRel);
+    if (fs42.existsSync(scriptAbs) && !options.force) {
       throw new Error(`Stage script already exists: .har/${scriptRel}. Use --force to overwrite.`);
     }
-    const skeletonPath = path44.join(
+    const skeletonPath = path47.join(
       resolveTemplatesDir(),
       "plugins",
       "custom-stage-skeleton.sh"
     );
-    const skeleton = fs39.readFileSync(skeletonPath, "utf8").replace(/__STAGE_ID__/g, id).replace(/__STAGE_KIND__/g, kind).replace(/__STAGE_DESCRIPTION__/g, stage.description);
-    fs39.mkdirSync(path44.dirname(scriptAbs), { recursive: true });
-    fs39.writeFileSync(scriptAbs, skeleton);
-    fs39.chmodSync(scriptAbs, 493);
+    const skeleton = fs42.readFileSync(skeletonPath, "utf8").replace(/__STAGE_ID__/g, id).replace(/__STAGE_KIND__/g, kind).replace(/__STAGE_DESCRIPTION__/g, stage.description);
+    fs42.mkdirSync(path47.dirname(scriptAbs), { recursive: true });
+    fs42.writeFileSync(scriptAbs, skeleton);
+    fs42.chmodSync(scriptAbs, 493);
     filesWritten.push(`.har/${scriptRel}`);
     stage.script = scriptRel;
     stage.artifacts = [
@@ -70586,18 +71105,18 @@ function addCustomStage(repoPath, options) {
 }
 
 // src/harness/adaptation-prompt.ts
-var fs40 = __toESM(require("fs"));
-var path45 = __toESM(require("path"));
+var fs43 = __toESM(require("fs"));
+var path48 = __toESM(require("path"));
 var readline5 = __toESM(require("readline"));
 
 // src/utils/clipboard.ts
-var import_child_process10 = require("child_process");
+var import_child_process11 = require("child_process");
 function commandExists2(command2) {
-  const probe = process.platform === "win32" ? (0, import_child_process10.spawnSync)("where", [command2], { encoding: "utf8", stdio: ["ignore", "ignore", "ignore"] }) : (0, import_child_process10.spawnSync)("which", [command2], { encoding: "utf8", stdio: ["ignore", "ignore", "ignore"] });
+  const probe = process.platform === "win32" ? (0, import_child_process11.spawnSync)("where", [command2], { encoding: "utf8", stdio: ["ignore", "ignore", "ignore"] }) : (0, import_child_process11.spawnSync)("which", [command2], { encoding: "utf8", stdio: ["ignore", "ignore", "ignore"] });
   return probe.status === 0;
 }
 function tryPipeCommand(command2, args, text) {
-  const result = (0, import_child_process10.spawnSync)(command2, args, {
+  const result = (0, import_child_process11.spawnSync)(command2, args, {
     input: text,
     encoding: "utf8",
     stdio: ["pipe", "ignore", "ignore"]
@@ -70617,7 +71136,7 @@ function copyViaPlatformTools(text) {
   }
   if (process.platform === "win32") {
     if (commandExists2("powershell")) {
-      const result = (0, import_child_process10.spawnSync)(
+      const result = (0, import_child_process11.spawnSync)(
         "powershell",
         [
           "-NoProfile",
@@ -70677,7 +71196,7 @@ function loadTemplate(name) {
   if (!filePath) {
     throw new Error(`Adaptation prompt template not found: ${name}. Run npm run build.`);
   }
-  return fs40.readFileSync(filePath, "utf8");
+  return fs43.readFileSync(filePath, "utf8");
 }
 function applyProfilePlaceholders(content, profile) {
   return content.replace(/\{\{PROFILE\}\}/g, profile).replace(/\{\{PROFILE_HINT\}\}/g, PROFILE_HINTS[profile]);
@@ -70699,7 +71218,7 @@ function buildMaintainAdaptationPrompt(_repoPath, bundleReport) {
 }
 function writeAdaptationPrompt(repoPath, content) {
   const harnessDir = getHarnessDir(repoPath);
-  const filePath = path45.join(harnessDir, ADAPTATION_PROMPT_FILE);
+  const filePath = path48.join(harnessDir, ADAPTATION_PROMPT_FILE);
   writeFileSafe(filePath, content);
   return filePath;
 }
@@ -70718,12 +71237,12 @@ function printAdaptationPrompt(content) {
 }
 function askYesNo2(question) {
   const rl = readline5.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve47) => {
+  return new Promise((resolve50) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
-      resolve47(trimmed === "" || /^y(es)?$/i.test(trimmed));
+      resolve50(trimmed === "" || /^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -70754,27 +71273,27 @@ async function offerAdaptationPromptClipboard(content, options = {}) {
 }
 
 // src/harness/cursor-rule.ts
-var fs41 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path49 = __toESM(require("path"));
 var readline6 = __toESM(require("readline"));
 init_file_ops();
 init_logging();
 var CURSOR_RULE_RELATIVE_PATH = ".cursor/rules/har-workflow.mdc";
 function getCursorRulePath(repoPath) {
-  return path46.join(repoPath, CURSOR_RULE_RELATIVE_PATH);
+  return path49.join(repoPath, CURSOR_RULE_RELATIVE_PATH);
 }
 function isCursorWorkspace(repoPath) {
-  return fs41.existsSync(path46.join(repoPath, ".cursor"));
+  return fs44.existsSync(path49.join(repoPath, ".cursor"));
 }
 function cursorRuleExists(repoPath) {
-  return fs41.existsSync(getCursorRulePath(repoPath));
+  return fs44.existsSync(getCursorRulePath(repoPath));
 }
 function scaffoldCursorRule(repoPath) {
   const templatePath = resolveTemplateFile("cursor-rule.mdc.template");
   if (!templatePath) {
     throw new Error("Cursor rule template not found (cursor-rule.mdc.template). Run npm run build.");
   }
-  const content = fs41.readFileSync(templatePath, "utf8");
+  const content = fs44.readFileSync(templatePath, "utf8");
   writeFileSafe(getCursorRulePath(repoPath), content);
 }
 async function handleCursorRule(options) {
@@ -70812,16 +71331,16 @@ async function promptScaffoldCursorRule(exists) {
 }
 async function askYesNo3(question) {
   const rl = readline6.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve47) => {
+  return new Promise((resolve50) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
       if (trimmed === "") {
-        resolve47(true);
+        resolve50(true);
         return;
       }
-      resolve47(/^y(es)?$/i.test(trimmed));
+      resolve50(/^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -70863,8 +71382,8 @@ init_validation();
 init_control_config();
 
 // src/core/control-lifecycle.ts
-var import_child_process11 = require("child_process");
-var path47 = __toESM(require("path"));
+var import_child_process12 = require("child_process");
+var path50 = __toESM(require("path"));
 
 // src/core/control-image.ts
 var DEFAULT_CONTROL_IMAGE = "theosfactory/har-control";
@@ -70890,10 +71409,10 @@ var CONTROL_DATA_VOLUME = "har_control_data";
 var CONTROL_CONTAINER_PORT = 3847;
 var CONTROL_DATA_DB_URL = "file:/data/har_control.db";
 function resolveControlDir() {
-  return path47.resolve(__dirname, "..", "control");
+  return path50.resolve(__dirname, "..", "control");
 }
 function resolveControlBuildContext() {
-  return path47.resolve(resolveControlDir(), "..");
+  return path50.resolve(resolveControlDir(), "..");
 }
 function buildDockerRunArgs(options) {
   const name = options.containerName ?? CONTROL_CONTAINER_NAME;
@@ -70916,7 +71435,7 @@ function buildDockerRunArgs(options) {
   return args;
 }
 function runDocker(args) {
-  const result = (0, import_child_process11.spawnSync)("docker", args, {
+  const result = (0, import_child_process12.spawnSync)("docker", args, {
     stdio: "inherit",
     env: process.env
   });
@@ -70926,7 +71445,7 @@ function runDocker(args) {
   return result.status ?? 1;
 }
 function controlContainerExists(name = CONTROL_CONTAINER_NAME) {
-  const result = (0, import_child_process11.spawnSync)("docker", ["ps", "-aq", "-f", `name=^${name}$`], {
+  const result = (0, import_child_process12.spawnSync)("docker", ["ps", "-aq", "-f", `name=^${name}$`], {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "ignore"]
   });
@@ -70949,7 +71468,7 @@ async function startMissionControl(options) {
       "-t",
       imageRef,
       "-f",
-      path47.join(resolveControlDir(), "Dockerfile"),
+      path50.join(resolveControlDir(), "Dockerfile"),
       resolveControlBuildContext()
     ]);
     if (buildCode !== 0) {
@@ -71096,7 +71615,7 @@ async function ensureTelemetryInfrastructure(options) {
 // src/core/run-service.ts
 init_telemetry_config();
 init_telemetry_env();
-var path49 = __toESM(require("path"));
+var path52 = __toESM(require("path"));
 init_local_executor();
 function extractShellOutput(result) {
   const stdout = result.logs?.find((log) => log.stream === "stdout")?.content ?? result.logs?.find((log) => !log.stream)?.content ?? "";
@@ -71261,7 +71780,8 @@ Usage from Cursor / Claude / Codex (@osfactory/otel-hook) will appear under Work
         source: options.source,
         sourceUrl: options.sourceUrl,
         title: options.title,
-        parentWorkUnitId: options.parentWorkUnitId
+        parentWorkUnitId: options.parentWorkUnitId,
+        relatedLinks: options.relatedLinks
       });
       createWorkAttempt(harnessRoot, {
         attemptId,
@@ -71301,12 +71821,12 @@ Usage from Cursor / Claude / Codex (@osfactory/otel-hook) will appear under Work
           suffix: session.suffix,
           createdAt: session.createdAt
         });
-        const envFile = path49.join(session.workDir, `.env.agent.${options.agentId}`);
+        const envFile = path52.join(session.workDir, `.env.agent.${options.agentId}`);
         try {
           appendTelemetryEnvToFile(envFile, {
             sessionKey,
             agentId: options.agentId,
-            repoPath: path49.resolve(options.repoPath),
+            repoPath: path52.resolve(options.repoPath),
             workDir: session.workDir,
             branch: session.branch,
             suffix: session.suffix,
@@ -71538,21 +72058,319 @@ var getEnvironmentLogs = defaultRunService.getEnvironmentLogs.bind(defaultRunSer
 
 // src/cli/commands/env.ts
 init_runs();
+init_work_units();
+init_manifest();
 init_slot_status();
 
+// src/core/cleanup-service.ts
+var fs46 = __toESM(require("fs"));
+var os18 = __toESM(require("os"));
+var path53 = __toESM(require("path"));
+var import_child_process14 = require("child_process");
+init_control_sync();
+init_control_repo_path();
+init_slot_status();
+init_manifest();
+var DEFAULT_STALE_DAYS = 7;
+function getWorktreesRoot() {
+  if (process.env.HAR_WORKTREES_ROOT) {
+    return path53.resolve(process.env.HAR_WORKTREES_ROOT);
+  }
+  return path53.join(process.env.HOME || os18.homedir(), "worktrees");
+}
+function runGit3(cwd, args) {
+  try {
+    return (0, import_child_process14.execSync)(`git ${args}`, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function basenameRepo(repoPath) {
+  return path53.basename(canonicalizeControlRepoPath(repoPath));
+}
+function ageDaysFrom(iso) {
+  if (!iso) return void 0;
+  const created = Date.parse(iso);
+  if (Number.isNaN(created)) return void 0;
+  return Math.floor((Date.now() - created) / (24 * 60 * 60 * 1e3));
+}
+function matchesKeep(candidate, keep) {
+  if (!keep?.length) return false;
+  for (const pin of keep) {
+    if (pin.worktreePath && candidate.worktreePath) {
+      if (path53.resolve(pin.worktreePath) === path53.resolve(candidate.worktreePath)) return true;
+    }
+    if (pin.repoPath && pin.agentId !== void 0 && candidate.agentId !== void 0) {
+      const repo = canonicalizeControlRepoPath(pin.repoPath);
+      const candidateRepo = path53.resolve(candidate.repoPath);
+      if ((repo === candidateRepo || path53.resolve(pin.repoPath) === candidateRepo) && pin.agentId === candidate.agentId) {
+        return true;
+      }
+    }
+    if (pin.repoPath && pin.agentId === void 0 && !pin.worktreePath) {
+      if (canonicalizeControlRepoPath(pin.repoPath) === candidate.repoPath) return true;
+    }
+  }
+  return false;
+}
+function classifySlotCandidate(repoPath, projectName, slot, options) {
+  if (!slot.active && !slot.worktreePath) return void 0;
+  const candidate = {
+    kind: "active_slot",
+    repoPath,
+    projectName,
+    agentId: slot.agentId,
+    worktreePath: slot.worktreePath ?? slot.workDir,
+    branch: slot.branch,
+    active: slot.active,
+    dirty: slot.dirty,
+    ageDays: ageDaysFrom(slot.sessionCreatedAt),
+    sessionCreatedAt: slot.sessionCreatedAt,
+    recommendation: "review",
+    reason: "active session"
+  };
+  if (matchesKeep(candidate, options?.keep)) {
+    candidate.recommendation = "keep";
+    candidate.reason = "pinned with --keep";
+    return candidate;
+  }
+  if (slot.dirty) {
+    candidate.recommendation = "review";
+    candidate.reason = "uncommitted changes \u2014 review before teardown";
+    return candidate;
+  }
+  if (slot.sessionStatus === "failed" || slot.sessionStatus === "starting") {
+    candidate.recommendation = "review";
+    candidate.reason = "failed or resumable session \u2014 recover or teardown manually";
+    return candidate;
+  }
+  const staleDays = options?.staleDays ?? DEFAULT_STALE_DAYS;
+  const age = candidate.ageDays;
+  if (age !== void 0 && age >= staleDays) {
+    candidate.recommendation = "teardown";
+    candidate.reason = `idle ${age}d, clean`;
+    return candidate;
+  }
+  if (slot.active) {
+    candidate.recommendation = "review";
+    candidate.reason = age !== void 0 ? `active session (${age}d) \u2014 keep unless finished` : "active session \u2014 keep unless finished";
+  }
+  return candidate;
+}
+function resolveRepoForWorktree(worktreePath) {
+  if (!fs46.existsSync(worktreePath)) return void 0;
+  const commonDir = runGit3(worktreePath, "rev-parse --git-common-dir");
+  if (!commonDir) return void 0;
+  const gitRoot = path53.resolve(worktreePath, commonDir, "..");
+  if (!readManifest(gitRoot)) return void 0;
+  return canonicalizeControlRepoPath(gitRoot);
+}
+function discoverOrphanWorktrees(knownPaths) {
+  const worktreesRoot = getWorktreesRoot();
+  if (!fs46.existsSync(worktreesRoot)) return [];
+  const orphans = [];
+  for (const entry of fs46.readdirSync(worktreesRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !entry.name.includes("-har-agent-")) continue;
+    const worktreePath = path53.resolve(path53.join(worktreesRoot, entry.name));
+    if (knownPaths.has(worktreePath)) continue;
+    const repoPath = resolveRepoForWorktree(worktreePath) ?? worktreesRoot;
+    const porcelain = runGit3(worktreePath, "status --porcelain");
+    const dirty = porcelain !== void 0 ? porcelain.length > 0 : void 0;
+    const branch = runGit3(worktreePath, "rev-parse --abbrev-ref HEAD");
+    orphans.push({
+      kind: "orphan_worktree",
+      repoPath,
+      projectName: basenameRepo(repoPath),
+      worktreePath,
+      branch: branch && branch !== "HEAD" ? branch : void 0,
+      active: false,
+      dirty,
+      recommendation: dirty ? "review" : "remove_orphan",
+      reason: dirty ? "orphan worktree with uncommitted changes" : "orphan worktree \u2014 no slot registry"
+    });
+  }
+  return orphans.sort((a, b2) => (a.worktreePath ?? "").localeCompare(b2.worktreePath ?? ""));
+}
+async function discoverCleanupCandidates(options = {}) {
+  const repoPaths = options.repoPaths ?? await discoverHarRepos({ cwd: options.cwd ?? process.cwd() });
+  const candidates = [];
+  const knownWorktreePaths = /* @__PURE__ */ new Set();
+  for (const repoPath of repoPaths) {
+    if (!fs46.existsSync(repoPath) || !readManifest(repoPath)) continue;
+    const harnessRoot = resolveHarnessRoot(repoPath);
+    const canonicalRepo = canonicalizeControlRepoPath(harnessRoot);
+    const status = collectEnvironmentStatus(harnessRoot);
+    const projectName = basenameRepo(harnessRoot);
+    for (const slot of status.slots) {
+      if (slot.worktreePath) knownWorktreePaths.add(path53.resolve(slot.worktreePath));
+      if (slot.workDir) knownWorktreePaths.add(path53.resolve(slot.workDir));
+      const candidate = classifySlotCandidate(canonicalRepo, projectName, slot, {
+        staleDays: options.staleDays,
+        keep: options.keep
+      });
+      if (!candidate) continue;
+      if (candidate.recommendation === "review" && !options.includeReview) {
+      }
+      candidates.push(candidate);
+    }
+  }
+  if (options.orphans !== false) {
+    for (const orphan of discoverOrphanWorktrees(knownWorktreePaths)) {
+      if (matchesKeep(orphan, options.keep)) {
+        orphan.recommendation = "keep";
+        orphan.reason = "pinned with --keep";
+      }
+      candidates.push(orphan);
+    }
+  }
+  return {
+    candidates: candidates.sort((a, b2) => {
+      const repo = a.repoPath.localeCompare(b2.repoPath);
+      if (repo !== 0) return repo;
+      return (a.agentId ?? 0) - (b2.agentId ?? 0);
+    }),
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function selectAutoApprovedCandidates(plan, options) {
+  return plan.candidates.filter((candidate) => {
+    if (candidate.recommendation === "keep") return false;
+    if (candidate.recommendation === "review") return options?.includeReview === true;
+    return candidate.recommendation === "teardown" || candidate.recommendation === "remove_orphan";
+  });
+}
+function formatCleanupPlan(plan) {
+  if (plan.candidates.length === 0) {
+    return "No session worktrees or orphans found.";
+  }
+  const lines2 = [];
+  lines2.push(
+    `${"REC".padEnd(8)} ${"REPO".padEnd(18)} ${"SLOT".padEnd(6)} ${"AGE".padEnd(5)} WORKTREE / REASON`
+  );
+  lines2.push("-".repeat(100));
+  for (const candidate of plan.candidates) {
+    const slot = candidate.agentId !== void 0 ? String(candidate.agentId) : "-";
+    const age = candidate.ageDays !== void 0 ? `${candidate.ageDays}d` : "-";
+    const target = candidate.worktreePath ?? candidate.repoPath;
+    lines2.push(
+      `${candidate.recommendation.padEnd(8)} ${candidate.projectName.padEnd(18)} ${slot.padEnd(6)} ${age.padEnd(5)} ${target}`
+    );
+    lines2.push(`         ${candidate.reason}`);
+  }
+  return lines2.join("\n");
+}
+async function askYesNo4(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const readline8 = await import("readline");
+  const rl = readline8.createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve50) => {
+    rl.question(question, resolve50);
+  });
+  rl.close();
+  return /^[Yy]$/.test(answer.trim());
+}
+async function confirmCleanupSelection(candidates) {
+  if (candidates.length === 0) return [];
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("Non-interactive terminal \u2014 pass --yes (and optionally --include-review)");
+  }
+  const approved = [];
+  for (const candidate of candidates) {
+    if (candidate.recommendation === "keep") continue;
+    const label = candidate.kind === "orphan_worktree" ? `orphan ${candidate.worktreePath}` : `${candidate.projectName} agent ${candidate.agentId}`;
+    const action = candidate.recommendation === "remove_orphan" ? "remove" : "teardown";
+    const ok = await askYesNo4(`${action} ${label}? [${candidate.recommendation === "teardown" || candidate.recommendation === "remove_orphan" ? "Y" : "y"}/n] `);
+    if (ok) approved.push(candidate);
+  }
+  return approved;
+}
+async function executeCleanupCandidates(candidates, options = {}) {
+  const service = createRunService();
+  const outcomes = [];
+  for (const candidate of candidates) {
+    if (candidate.recommendation === "keep") continue;
+    if (options.dryRun) {
+      outcomes.push({ candidate, ok: true });
+      continue;
+    }
+    try {
+      if (candidate.kind === "active_slot" && candidate.agentId !== void 0) {
+        const result = await service.teardownEnvironment({
+          repoPath: candidate.repoPath,
+          agentId: candidate.agentId,
+          capture: false,
+          trigger: "cli"
+        });
+        outcomes.push({
+          candidate,
+          ok: result.code === 0,
+          error: result.code === 0 ? void 0 : result.stderr?.trim() || `exit ${result.code}`
+        });
+        continue;
+      }
+      if (candidate.kind === "orphan_worktree" && candidate.worktreePath) {
+        if (fs46.existsSync(candidate.worktreePath)) {
+          const repoRoot = candidate.repoPath !== getWorktreesRoot() ? candidate.repoPath : resolveRepoForWorktree(candidate.worktreePath);
+          if (repoRoot) {
+            try {
+              (0, import_child_process14.execSync)(`git worktree remove --force ${JSON.stringify(candidate.worktreePath)}`, {
+                cwd: repoRoot,
+                stdio: ["pipe", "pipe", "ignore"]
+              });
+            } catch {
+            }
+          }
+          if (fs46.existsSync(candidate.worktreePath)) {
+            fs46.rmSync(candidate.worktreePath, { recursive: true, force: true });
+          }
+        }
+        outcomes.push({ candidate, ok: true });
+        continue;
+      }
+      outcomes.push({ candidate, ok: false, error: "unsupported candidate" });
+    } catch (err) {
+      outcomes.push({
+        candidate,
+        ok: false,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return outcomes;
+}
+function parseCleanupKeepPins(values) {
+  if (!values?.length) return [];
+  return values.map((raw) => {
+    const agentMatch = raw.match(/^(.+):(\d+)$/);
+    if (agentMatch) {
+      return { repoPath: agentMatch[1], agentId: Number(agentMatch[2]) };
+    }
+    if (raw.startsWith("/") || raw.startsWith("~")) {
+      return {
+        worktreePath: raw.startsWith("~") ? path53.join(process.env.HOME || os18.homedir(), raw.slice(2)) : path53.resolve(raw)
+      };
+    }
+    return { repoPath: raw };
+  });
+}
+
 // src/core/commit-gate-onboarding.ts
 var readline7 = __toESM(require("readline"));
 init_hooks();
 init_stages();
 init_logging();
-function askYesNo4(question) {
+function askYesNo5(question) {
   const rl = readline7.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve47) => {
+  return new Promise((resolve50) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
-      resolve47(trimmed === "" || /^y(es)?$/i.test(trimmed));
+      resolve50(trimmed === "" || /^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -71577,7 +72395,7 @@ async function handleCommitGateOnboarding(options) {
   const status = getHooksStatus(options.repoPath);
   let shouldInstall = status.preCommitInstalled || status.postCommitInstalled || options.install === "always" || options.autoYes === true;
   if (!shouldInstall && options.install === "prompt" && process.stdin.isTTY && process.stdout.isTTY) {
-    shouldInstall = await askYesNo4("Install the HAR commit gate for this repository? [Y/n]");
+    shouldInstall = await askYesNo5("Install the HAR commit gate for this repository? [Y/n]");
   }
   if (!shouldInstall) {
     info("Commit gate is not installed; run `har hooks install` when ready.");
@@ -71594,21 +72412,21 @@ async function handleCommitGateOnboarding(options) {
 }
 
 // src/core/onboarding-preferences.ts
-var fs43 = __toESM(require("fs"));
-var os17 = __toESM(require("os"));
-var path50 = __toESM(require("path"));
+var fs47 = __toESM(require("fs"));
+var os19 = __toESM(require("os"));
+var path54 = __toESM(require("path"));
 init_schema2();
 function getOnboardingPreferencesPath() {
   if (process.env.HAR_PREFERENCES_PATH) {
-    return path50.resolve(process.env.HAR_PREFERENCES_PATH);
+    return path54.resolve(process.env.HAR_PREFERENCES_PATH);
   }
-  return path50.join(os17.homedir(), ".har", "preferences.json");
+  return path54.join(os19.homedir(), ".har", "preferences.json");
 }
 function readOnboardingPreferences() {
   const preferencePath = getOnboardingPreferencesPath();
   try {
-    if (!fs43.existsSync(preferencePath)) return OnboardingPreferencesSchema.parse({});
-    return OnboardingPreferencesSchema.parse(JSON.parse(fs43.readFileSync(preferencePath, "utf8")));
+    if (!fs47.existsSync(preferencePath)) return OnboardingPreferencesSchema.parse({});
+    return OnboardingPreferencesSchema.parse(JSON.parse(fs47.readFileSync(preferencePath, "utf8")));
   } catch {
     return OnboardingPreferencesSchema.parse({});
   }
@@ -71633,8 +72451,8 @@ function writeOnboardingPreferences(overrides) {
   };
   const parsed = OnboardingPreferencesSchema.parse(preference);
   const preferencePath = getOnboardingPreferencesPath();
-  fs43.mkdirSync(path50.dirname(preferencePath), { recursive: true });
-  fs43.writeFileSync(preferencePath, `${JSON.stringify(parsed, null, 2)}
+  fs47.mkdirSync(path54.dirname(preferencePath), { recursive: true });
+  fs47.writeFileSync(preferencePath, `${JSON.stringify(parsed, null, 2)}
 `);
   return parsed;
 }
@@ -71698,6 +72516,14 @@ feature branch.
   Failed launch: har env recover 1    # or: har env launch 1 --resume`;
 
 // src/cli/commands/env.ts
+var workLinkOptions = (y) => y.option("repo", { type: "string", default: ".", describe: "Path to the repository" }).option("work-id", {
+  type: "string",
+  demandOption: true,
+  describe: "Repo-scoped work unit id (same as --work-id at launch)"
+}).option("link", {
+  type: "string",
+  describe: "Link as source|url or source|url|label"
+}).option("source", { type: "string", describe: "Tracker provider (e.g. github, jira)" }).option("url", { type: "string", describe: "Canonical URL for the link" }).option("label", { type: "string", describe: "Optional display label" });
 var envCommand = {
   command: "env <subcommand>",
   describe: "Manage agent environments (launch \u2192 verify \u2192 complete)",
@@ -71768,14 +72594,14 @@ var envCommand = {
     handleMaintain
   ).command(
     "add-plugin [plugin]",
-    `Install a verification plugin (${PLUGIN_IDS.join(", ")}) that registers stages`,
+    "Install a verification plugin (bundled id, path, npm package, or git URL) that registers stages",
     (y) => y.positional("plugin", {
       type: "string",
-      describe: `Plugin id (${PLUGIN_IDS.join(", ")})`
+      describe: "Bundled plugin id, local path (./plugin), npm package (@org/pkg), or git URL (github:org/repo)"
     }).option("list", {
       type: "boolean",
       default: false,
-      describe: "List available plugins and exit"
+      describe: "List bundled plugins and exit"
     }).option("repo", { type: "string", default: ".", describe: "Path to the repository" }).option("force", {
       type: "boolean",
       default: false,
@@ -71791,7 +72617,7 @@ var envCommand = {
     `Register a custom stage (--custom), or install a plugin (deprecated alias for add-plugin)`,
     (y) => y.positional("template", {
       type: "string",
-      describe: `Custom stage id with --custom, or a plugin id (${PLUGIN_IDS.join(", ")}) as a deprecated alias`
+      describe: "Custom stage id with --custom, or a plugin id / path / npm / git spec as a deprecated alias"
     }).option("list", {
       type: "boolean",
       default: false,
@@ -71857,8 +72683,17 @@ var envCommand = {
     }).option("parent-work-id", {
       type: "string",
       describe: "Optional parent work unit identifier"
+    }).option("work-link", {
+      type: "array",
+      string: true,
+      describe: "Additional tracker link: source|url or source|url|label (repeatable)"
     }).epilog(LAUNCH_EPILOG),
     handleLaunch
+  ).command(
+    "work-link",
+    "Append a related external link to an existing work unit",
+    workLinkOptions,
+    handleWorkLink
   ).command(
     "recover <id>",
     "Resume a failed or partial launch (alias for launch --resume)",
@@ -71897,6 +72732,38 @@ var envCommand = {
     "Show status of all running agents",
     (y) => y.option("repo", { type: "string", default: "." }).option("json", { type: "boolean", default: false, describe: "Structured JSON output" }),
     handleStatus
+  ).command(
+    "cleanup",
+    "Discover stale session worktrees across registered repos and tear them down",
+    (y) => y.option("repo", {
+      type: "string",
+      describe: "Limit cleanup scan to one repository path"
+    }).option("dry-run", {
+      type: "boolean",
+      default: false,
+      describe: "Show the cleanup plan without executing"
+    }).option("yes", {
+      alias: "y",
+      type: "boolean",
+      default: false,
+      describe: "Approve teardown/remove for recommended rows without prompting"
+    }).option("keep", {
+      type: "string",
+      describe: "Pin sessions to keep (comma-separated repoPath:agentId or worktree paths)"
+    }).option("stale", {
+      type: "number",
+      default: 7,
+      describe: "Age in days before a clean idle session is recommended for teardown"
+    }).option("orphans", {
+      type: "boolean",
+      default: true,
+      describe: "Include orphan worktree directories under ~/worktrees"
+    }).option("include-review", {
+      type: "boolean",
+      default: false,
+      describe: "With --yes, also teardown/remove rows marked review (dirty or recent active)"
+    }).option("json", { type: "boolean", default: false, describe: "Structured JSON output" }),
+    handleCleanup
   ).command(
     "runs",
     "Inspect harness run history",
@@ -71919,13 +72786,13 @@ var envCommand = {
     }
   ).demandCommand(
     1,
-    "Please specify a subcommand: init, maintain, add-stage, launch, recover, verify, complete, teardown, status, runs"
+    "Please specify a subcommand: init, maintain, add-stage, launch, recover, verify, complete, teardown, status, cleanup, runs"
   ).epilog(HAR_ENV_EPILOG),
   handler: () => {
   }
 };
 async function handleInit(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path55.resolve(argv.repo);
   const onboarding = resolveOnboardingOptions(argv);
   header("har env init");
   info(`Repository: ${repoPath}`);
@@ -71971,7 +72838,7 @@ async function handleInit(argv) {
   }
 }
 async function handleMaintain(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path55.resolve(argv.repo);
   const onboarding = resolveOnboardingOptions(argv);
   header("har env maintain");
   info(`Repository: ${repoPath}`);
@@ -72102,7 +72969,7 @@ async function applyAgentIntegrations(options) {
   }
 }
 async function handleAddPlugin(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path55.resolve(argv.repo);
   const available = listPluginIds();
   if (argv.list) {
     for (const id of available) {
@@ -72110,9 +72977,9 @@ async function handleAddPlugin(argv) {
     }
     return;
   }
-  if (!argv.plugin || !available.includes(argv.plugin)) {
+  if (!argv.plugin) {
     error(
-      `Unknown plugin: ${argv.plugin ?? "(missing)"}. Available: ${available.join(", ")}. For a project-specific stage, use: har env add-stage <id> --custom`
+      `Missing plugin. Bundled: ${available.join(", ") || "(none)"}. Or pass a path, npm package, or git URL. For a project-specific stage, use: har env add-stage <id> --custom`
     );
     return finishCommand(1);
   }
@@ -72122,10 +72989,12 @@ async function handleAddPlugin(argv) {
   try {
     const result = addPlugin(repoPath, argv.plugin, {
       force: argv.force,
-      skipCi: argv.skipCi
+      skipCi: argv.skipCi,
+      spec: argv.plugin
     });
     divider();
-    success(`Plugin applied \u2014 registered stage: ${result.stageId}`);
+    const stageLabel = result.stageIds.length > 1 ? `stages: ${result.stageIds.join(", ")}` : `stage: ${result.stageId}`;
+    success(`Plugin applied \u2014 registered ${stageLabel} (source: ${result.source})`);
     console.error("");
     console.error("  Next steps:");
     for (const step of result.nextSteps) {
@@ -72140,7 +73009,7 @@ async function handleAddPlugin(argv) {
   }
 }
 async function handleAddStage(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path55.resolve(argv.repo);
   const available = listPluginIds();
   if (argv.list) {
     warn("har env add-stage --list is deprecated; prefer: har env add-plugin --list");
@@ -72188,9 +73057,9 @@ async function handleAddStage(argv) {
     }
     return;
   }
-  if (!argv.template || !available.includes(argv.template)) {
+  if (!argv.template) {
     error(
-      `Unknown plugin: ${argv.template ?? "(missing)"}. Available: ${available.join(", ")}. Prefer: har env add-plugin <id>. For a project-specific stage, use: har env add-stage <id> --custom`
+      `Unknown plugin: (missing). Available: ${available.join(", ")}. Prefer: har env add-plugin <id>. For a project-specific stage, use: har env add-stage <id> --custom`
     );
     return finishCommand(1);
   }
@@ -72206,7 +73075,7 @@ async function handleAddStage(argv) {
   });
 }
 async function handlePreflight(argv) {
-  const repo = path51.resolve(argv.repo);
+  const repo = path55.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await preflightEnvironment({
     repoPath: repo,
@@ -72222,7 +73091,7 @@ async function handlePreflight(argv) {
   return finishCommand(result.code);
 }
 async function handleLaunch(argv) {
-  const repo = path51.resolve(argv.repo);
+  const repo = path55.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   if (!argv.resume) {
     const guard = checkLaunchGuard2(repo, agentId, { worktree: argv.worktree });
@@ -72245,6 +73114,7 @@ async function handleLaunch(argv) {
     sourceUrl: argv.workUrl,
     title: argv.workTitle,
     parentWorkUnitId: argv.parentWorkId,
+    relatedLinks: argv.workLink?.map(parseWorkLinkSpec),
     capture: false
   });
   if (result.blocked) {
@@ -72265,6 +73135,22 @@ async function handleLaunch(argv) {
   }
   return finishCommand(result.code);
 }
+async function handleWorkLink(argv) {
+  if (!argv.link && !(argv.source && argv.url)) {
+    error("Provide --link or both --source and --url");
+    return finishCommand(1);
+  }
+  const harnessRoot = resolveHarnessRoot(path55.resolve(argv.repo));
+  const links = argv.link ? [parseWorkLinkSpec(argv.link)] : [{ source: argv.source, url: argv.url, label: argv.label }];
+  try {
+    const record2 = addWorkUnitLinks(harnessRoot, argv.workId, links);
+    success(`Added link to work unit ${record2.workUnitId}`);
+    return finishCommand(0);
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+    return finishCommand(1);
+  }
+}
 async function handleRecover(argv) {
   return handleLaunch({
     id: argv.id,
@@ -72280,7 +73166,7 @@ async function handleRecover(argv) {
   });
 }
 async function handleVerify(argv) {
-  const repo = path51.resolve(argv.repo);
+  const repo = path55.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await runVerification({
     repoPath: repo,
@@ -72292,7 +73178,7 @@ async function handleVerify(argv) {
   return finishCommand(result.code);
 }
 async function handleTeardown(argv) {
-  const repo = path51.resolve(argv.repo);
+  const repo = path55.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await teardownEnvironment({
     repoPath: repo,
@@ -72303,7 +73189,7 @@ async function handleTeardown(argv) {
   return finishCommand(result.code);
 }
 async function handleComplete(argv) {
-  const repo = path51.resolve(argv.repo);
+  const repo = path55.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await completeEnvironment({
     repoPath: repo,
@@ -72324,7 +73210,7 @@ async function handleComplete(argv) {
   return finishCommand(result.code);
 }
 async function handleStatus(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path55.resolve(argv.repo);
   if (argv.json) {
     const status = collectEnvironmentStatus(repoPath);
     const output = EnvironmentStatusSchema.parse(status);
@@ -72336,8 +73222,59 @@ async function handleStatus(argv) {
     capture: false
   });
 }
+async function handleCleanup(argv) {
+  const keepValues = argv.keep?.split(",").map((value) => value.trim()).filter(Boolean);
+  const keep = parseCleanupKeepPins(keepValues);
+  const repoPaths = argv.repo ? [path55.resolve(argv.repo)] : void 0;
+  const plan = await discoverCleanupCandidates({
+    cwd: process.cwd(),
+    repoPaths,
+    keep,
+    staleDays: argv.stale,
+    orphans: argv.orphans
+  });
+  if (argv.json) {
+    process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
+    if (argv.dryRun) return;
+  } else {
+    header("har env cleanup");
+    process.stdout.write(`${formatCleanupPlan(plan)}
+
+`);
+    if (argv.dryRun) {
+      info("Dry run \u2014 no changes made.");
+      return;
+    }
+  }
+  let selected = selectAutoApprovedCandidates(plan, { includeReview: argv.includeReview });
+  if (!argv.yes) {
+    try {
+      const interactive = await confirmCleanupSelection(plan.candidates);
+      selected = interactive;
+    } catch (err) {
+      error(err instanceof Error ? err.message : String(err));
+      return finishCommand(1);
+    }
+  }
+  if (selected.length === 0) {
+    info("Nothing selected for cleanup.");
+    return;
+  }
+  const outcomes = await executeCleanupCandidates(selected, { dryRun: false });
+  let failed = 0;
+  for (const outcome of outcomes) {
+    const label = outcome.candidate.kind === "orphan_worktree" ? outcome.candidate.worktreePath : `${outcome.candidate.projectName} agent ${outcome.candidate.agentId}`;
+    if (outcome.ok) {
+      success(`Cleaned ${label}`);
+    } else {
+      failed++;
+      error(`${label}: ${outcome.error ?? "failed"}`);
+    }
+  }
+  return finishCommand(failed > 0 ? 1 : 0);
+}
 async function handleRunsList(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path55.resolve(argv.repo);
   const runs = listRuns(repoPath, { stageId: argv.stage, limit: argv.limit });
   if (argv.json) {
     process.stdout.write(JSON.stringify({ runs }, null, 2) + "\n");
@@ -72354,7 +73291,7 @@ async function handleRunsList(argv) {
   }
 }
 async function handleRunsGet(argv) {
-  const run2 = getRun(path51.resolve(argv.repo), argv.runId);
+  const run2 = getRun(path55.resolve(argv.repo), argv.runId);
   if (!run2) {
     error(`Run not found: ${argv.runId}`);
     return finishCommand(1);
@@ -72436,27 +73373,27 @@ function printNextSteps() {
 }
 
 // src/cli/commands/control.ts
-var path55 = __toESM(require("path"));
+var path59 = __toESM(require("path"));
 init_control_config();
 init_control_port();
 init_control_sync();
 
 // src/core/control-sync-selection.ts
-var fs44 = __toESM(require("fs"));
-var os18 = __toESM(require("os"));
-var path52 = __toESM(require("path"));
+var fs48 = __toESM(require("fs"));
+var os20 = __toESM(require("os"));
+var path56 = __toESM(require("path"));
 init_control_repo_path();
 function getSelectionPath() {
   if (process.env.HAR_CONTROL_SYNC_SELECTION_PATH) {
-    return path52.resolve(process.env.HAR_CONTROL_SYNC_SELECTION_PATH);
+    return path56.resolve(process.env.HAR_CONTROL_SYNC_SELECTION_PATH);
   }
-  return path52.join(os18.homedir(), ".har", "sync-selection.json");
+  return path56.join(os20.homedir(), ".har", "sync-selection.json");
 }
 function readSyncSelection() {
   const selectionPath = getSelectionPath();
   try {
-    if (!fs44.existsSync(selectionPath)) return null;
-    const parsed = JSON.parse(fs44.readFileSync(selectionPath, "utf8"));
+    if (!fs48.existsSync(selectionPath)) return null;
+    const parsed = JSON.parse(fs48.readFileSync(selectionPath, "utf8"));
     if (!Array.isArray(parsed.repos)) return null;
     return parsed.repos.map((repoPath) => canonicalizeControlRepoPath(repoPath));
   } catch {
@@ -72466,8 +73403,8 @@ function readSyncSelection() {
 function writeSyncSelection(repos) {
   const selectionPath = getSelectionPath();
   const canonical = Array.from(new Set(repos.map((repoPath) => canonicalizeControlRepoPath(repoPath))));
-  fs44.mkdirSync(path52.dirname(selectionPath), { recursive: true });
-  fs44.writeFileSync(selectionPath, JSON.stringify({ repos: canonical }, null, 2) + "\n");
+  fs48.mkdirSync(path56.dirname(selectionPath), { recursive: true });
+  fs48.writeFileSync(selectionPath, JSON.stringify({ repos: canonical }, null, 2) + "\n");
 }
 function resolveSyncSelection(input) {
   const { discovered, stored, forceSelect, isTTY } = input;
@@ -72499,13 +73436,13 @@ init_portal_credentials();
 // src/core/portal-login.ts
 var http = __toESM(require("http"));
 var import_crypto = require("crypto");
-var import_child_process13 = require("child_process");
+var import_child_process15 = require("child_process");
 var CALLBACK_PATH = "/callback";
 var LOGIN_TIMEOUT_MS = 3 * 6e4;
 function openBrowser(url) {
   const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    const child = (0, import_child_process13.spawn)(cmd, args, { stdio: "ignore", detached: true });
+    const child = (0, import_child_process15.spawn)(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -72514,7 +73451,7 @@ function openBrowser(url) {
 }
 async function loginViaBrowser(portalUrl, openUrl = openBrowser) {
   const state = (0, import_crypto.randomUUID)();
-  return new Promise((resolve47, reject) => {
+  return new Promise((resolve50, reject) => {
     let timer;
     const server = http.createServer((req, res) => {
       const requestUrl = new URL(req.url ?? "", "http://127.0.0.1");
@@ -72539,7 +73476,7 @@ async function loginViaBrowser(portalUrl, openUrl = openBrowser) {
       res.writeHead(200, { "Content-Type": "text/html" });
       res.end("<h1>Logged in</h1><p>You can close this tab and return to the terminal.</p>");
       cleanup();
-      resolve47({
+      resolve50({
         portalUrl,
         token,
         workspace,
@@ -72574,8 +73511,8 @@ If your browser did not open, paste that URL.
 }
 
 // src/core/control-unregister.ts
-var fs45 = __toESM(require("fs"));
-var path53 = __toESM(require("path"));
+var fs49 = __toESM(require("fs"));
+var path57 = __toESM(require("path"));
 init_control_repo_path();
 init_control_registry();
 init_control_config();
@@ -72585,9 +73522,9 @@ function listUnregisterWorktreeCandidates(repoPath) {
   const harnessRoot = canonicalizeControlRepoPath(repoPath);
   const byPath = /* @__PURE__ */ new Map();
   const add = (partial2) => {
-    const resolved = path53.resolve(partial2.worktreePath);
+    const resolved = path57.resolve(partial2.worktreePath);
     if (!resolved || resolved === harnessRoot) return;
-    const exists = partial2.exists ?? fs45.existsSync(resolved);
+    const exists = partial2.exists ?? fs49.existsSync(resolved);
     const prev = byPath.get(resolved);
     if (prev) {
       byPath.set(resolved, {
@@ -72634,12 +73571,12 @@ function listUnregisterWorktreeCandidates(repoPath) {
   }
   return [...byPath.values()].sort((a, b2) => a.agentId - b2.agentId);
 }
-async function askYesNo5(question) {
+async function askYesNo6(question) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
   const readline8 = await import("readline");
   const rl = readline8.createInterface({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve47) => {
-    rl.question(question, resolve47);
+  const answer = await new Promise((resolve50) => {
+    rl.question(question, resolve50);
   });
   rl.close();
   return /^[Yy]$/.test(answer.trim());
@@ -72651,7 +73588,7 @@ async function confirmUnregister(options) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new Error("Non-interactive terminal \u2014 pass --yes (and optionally --delete-worktrees)");
   }
-  const proceed = await askYesNo5("Unregister this repository from Mission Control? [y/N] ");
+  const proceed = await askYesNo6("Unregister this repository from Mission Control? [y/N] ");
   if (!proceed) return { proceed: false, deleteWorktrees: false };
   const existing = options.worktrees.filter((w2) => w2.exists);
   if (existing.length === 0) {
@@ -72663,7 +73600,7 @@ async function confirmUnregister(options) {
     process.stderr.write(`  agent-${wt.agentId}: ${wt.worktreePath}${dirty}
 `);
   }
-  const deleteWorktrees = await askYesNo5(
+  const deleteWorktrees = await askYesNo6(
     `Also delete ${existing.length} session worktree(s) on disk? [y/N] `
   );
   return { proceed: true, deleteWorktrees };
@@ -72701,28 +73638,28 @@ async function teardownWorktrees(repoPath, candidates, dryRun) {
         trigger: "cli"
       });
       if (result.code !== 0) {
-        if (fs45.existsSync(candidate.worktreePath)) {
-          fs45.rmSync(candidate.worktreePath, { recursive: true, force: true });
+        if (fs49.existsSync(candidate.worktreePath)) {
+          fs49.rmSync(candidate.worktreePath, { recursive: true, force: true });
         }
       }
       outcomes.push({
         path: candidate.worktreePath,
         agentId: candidate.agentId,
-        deleted: !fs45.existsSync(candidate.worktreePath),
-        error: result.code !== 0 && fs45.existsSync(candidate.worktreePath) ? result.stderr : void 0
+        deleted: !fs49.existsSync(candidate.worktreePath),
+        error: result.code !== 0 && fs49.existsSync(candidate.worktreePath) ? result.stderr : void 0
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       try {
-        if (fs45.existsSync(candidate.worktreePath)) {
-          fs45.rmSync(candidate.worktreePath, { recursive: true, force: true });
+        if (fs49.existsSync(candidate.worktreePath)) {
+          fs49.rmSync(candidate.worktreePath, { recursive: true, force: true });
         }
       } catch {
       }
       outcomes.push({
         path: candidate.worktreePath,
         agentId: candidate.agentId,
-        deleted: !fs45.existsSync(candidate.worktreePath),
+        deleted: !fs49.existsSync(candidate.worktreePath),
         error: message
       });
     }
@@ -72785,16 +73722,16 @@ init_control_config();
 init_control_registry();
 
 // src/core/harness-scrub.ts
-var fs46 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
+var fs50 = __toESM(require("fs"));
+var path58 = __toESM(require("path"));
 var HARNESS_SCRUB_DIRS = ["runs", "validations", "state", "slots"];
 function scrubLocalHarnessDirs(repoPath) {
   const results = [];
-  const resolved = path54.resolve(repoPath);
-  if (!fs46.existsSync(resolved)) {
+  const resolved = path58.resolve(repoPath);
+  if (!fs50.existsSync(resolved)) {
     for (const directory of HARNESS_SCRUB_DIRS) {
       results.push({
-        path: path54.join(resolved, ".har", directory),
+        path: path58.join(resolved, ".har", directory),
         directory,
         deleted: false,
         error: "repository path does not exist"
@@ -72803,24 +73740,24 @@ function scrubLocalHarnessDirs(repoPath) {
     return results;
   }
   for (const directory of HARNESS_SCRUB_DIRS) {
-    const target = path54.join(resolved, ".har", directory);
-    if (!fs46.existsSync(target)) {
+    const target = path58.join(resolved, ".har", directory);
+    if (!fs50.existsSync(target)) {
       results.push({ path: target, directory, deleted: true });
       continue;
     }
     try {
-      fs46.rmSync(target, { recursive: true, force: true });
+      fs50.rmSync(target, { recursive: true, force: true });
       results.push({
         path: target,
         directory,
-        deleted: !fs46.existsSync(target),
-        error: fs46.existsSync(target) ? "failed to remove directory" : void 0
+        deleted: !fs50.existsSync(target),
+        error: fs50.existsSync(target) ? "failed to remove directory" : void 0
       });
     } catch (err) {
       results.push({
         path: target,
         directory,
-        deleted: !fs46.existsSync(target),
+        deleted: !fs50.existsSync(target),
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -72831,7 +73768,7 @@ function scrubLocalHarnessForRepos(repoPaths) {
   const results = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoPath of repoPaths) {
-    const key = path54.resolve(repoPath);
+    const key = path58.resolve(repoPath);
     if (seen.has(key)) continue;
     seen.add(key);
     results.push(...scrubLocalHarnessDirs(key));
@@ -72840,12 +73777,12 @@ function scrubLocalHarnessForRepos(repoPaths) {
 }
 
 // src/core/control-reset.ts
-async function askYesNo6(question) {
+async function askYesNo7(question) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
   const readline8 = await import("readline");
   const rl = readline8.createInterface({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve47) => {
-    rl.question(question, resolve47);
+  const answer = await new Promise((resolve50) => {
+    rl.question(question, resolve50);
   });
   rl.close();
   return /^[Yy]$/.test(answer.trim());
@@ -72855,7 +73792,7 @@ async function confirmControlReset(options) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new Error("Non-interactive terminal \u2014 pass --yes");
   }
-  return askYesNo6(
+  return askYesNo7(
     `Clear Mission Control data for ${options.repoCount} registered repositor${options.repoCount === 1 ? "y" : "ies"} (and scrub local .har history)? [y/N] `
   );
 }
@@ -73090,7 +74027,7 @@ async function handleDown() {
   return finishCommand(code);
 }
 async function handleRegister(argv) {
-  const repoPath = path55.resolve(argv.repo);
+  const repoPath = path59.resolve(argv.repo);
   header("har control register");
   info(`Repository: ${repoPath}`);
   try {
@@ -73182,7 +74119,7 @@ async function handleReset(argv) {
   }
 }
 async function handleUnregister(argv) {
-  const repoPath = path55.resolve(argv.repo);
+  const repoPath = path59.resolve(argv.repo);
   const worktrees = listUnregisterWorktreeCandidates(repoPath);
   try {
     let deleteWorktrees = argv.deleteWorktrees;
@@ -73364,12 +74301,12 @@ async function handleLogin(argv) {
 }
 
 // src/cli/commands/hooks.ts
-var path57 = __toESM(require("path"));
+var path61 = __toESM(require("path"));
 init_hooks();
 
 // src/core/claude-hooks.ts
-var fs47 = __toESM(require("fs"));
-var path56 = __toESM(require("path"));
+var fs51 = __toESM(require("fs"));
+var path60 = __toESM(require("path"));
 var CLAUDE_GUARD_RELATIVE_PATH = ".har/hooks/claude-worktree-guard.sh";
 var CLAUDE_SETTINGS_RELATIVE_PATH = ".claude/settings.json";
 var GUARD_MATCHER = "Edit|Write|MultiEdit|NotebookEdit";
@@ -73380,8 +74317,8 @@ function isHarGuardEntry(entry) {
   );
 }
 function readSettings(settingsPath) {
-  if (!fs47.existsSync(settingsPath)) return {};
-  const raw = fs47.readFileSync(settingsPath, "utf8").trim();
+  if (!fs51.existsSync(settingsPath)) return {};
+  const raw = fs51.readFileSync(settingsPath, "utf8").trim();
   if (raw === "") return {};
   const parsed = JSON.parse(raw);
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -73390,19 +74327,19 @@ function readSettings(settingsPath) {
   return parsed;
 }
 function writeSettings(settingsPath, settings) {
-  fs47.mkdirSync(path56.dirname(settingsPath), { recursive: true });
-  fs47.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs51.mkdirSync(path60.dirname(settingsPath), { recursive: true });
+  fs51.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
 }
 function installClaudeGuard(repoPath) {
   const templatePath = resolveTemplateFile("claude-worktree-guard.sh.template");
   if (!templatePath) {
     throw new Error("Guard template not found (claude-worktree-guard.sh.template). Run npm run build.");
   }
-  const guardScript = path56.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
-  fs47.mkdirSync(path56.dirname(guardScript), { recursive: true });
-  fs47.copyFileSync(templatePath, guardScript);
-  fs47.chmodSync(guardScript, 493);
-  const settingsPath = path56.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
+  const guardScript = path60.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
+  fs51.mkdirSync(path60.dirname(guardScript), { recursive: true });
+  fs51.copyFileSync(templatePath, guardScript);
+  fs51.chmodSync(guardScript, 493);
+  const settingsPath = path60.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
   const settings = readSettings(settingsPath);
   const hooks = settings.hooks ?? {};
   const preToolUse = (hooks.PreToolUse ?? []).filter((entry) => !isHarGuardEntry(entry));
@@ -73416,15 +74353,15 @@ function installClaudeGuard(repoPath) {
 }
 function uninstallClaudeGuard(repoPath) {
   let removed = false;
-  const guardScript = path56.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
-  if (fs47.existsSync(guardScript)) {
-    fs47.rmSync(guardScript);
+  const guardScript = path60.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
+  if (fs51.existsSync(guardScript)) {
+    fs51.rmSync(guardScript);
     removed = true;
-    const parent = path56.dirname(guardScript);
-    if (fs47.existsSync(parent) && fs47.readdirSync(parent).length === 0) fs47.rmdirSync(parent);
+    const parent = path60.dirname(guardScript);
+    if (fs51.existsSync(parent) && fs51.readdirSync(parent).length === 0) fs51.rmdirSync(parent);
   }
-  const settingsPath = path56.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
-  if (fs47.existsSync(settingsPath)) {
+  const settingsPath = path60.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
+  if (fs51.existsSync(settingsPath)) {
     const settings = readSettings(settingsPath);
     const preToolUse = settings.hooks?.PreToolUse;
     if (preToolUse) {
@@ -73449,8 +74386,8 @@ function uninstallClaudeGuard(repoPath) {
   return { removed };
 }
 function claudeGuardInstalled(repoPath) {
-  const settingsPath = path56.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
-  if (!fs47.existsSync(settingsPath)) return false;
+  const settingsPath = path60.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
+  if (!fs51.existsSync(settingsPath)) return false;
   try {
     const settings = readSettings(settingsPath);
     return (settings.hooks?.PreToolUse ?? []).some(isHarGuardEntry);
@@ -73467,7 +74404,7 @@ function repoOption(y) {
 function handleInstall2(argv) {
   try {
     if (argv.claude) {
-      const result2 = installClaudeGuard(path57.resolve(argv.repo));
+      const result2 = installClaudeGuard(path61.resolve(argv.repo));
       success("Claude Code worktree guard installed.");
       info(`Guard script:  ${result2.guardScript}`);
       info(`Settings:      ${result2.settingsPath} (PreToolUse: Edit|Write|MultiEdit|NotebookEdit)`);
@@ -73475,7 +74412,7 @@ function handleInstall2(argv) {
       info("Commit both files so the guard travels with the repo.");
       return;
     }
-    const result = installHooks({ repoPath: path57.resolve(argv.repo), force: argv.force });
+    const result = installHooks({ repoPath: path61.resolve(argv.repo), force: argv.force });
     success(`Commit gate installed in ${result.hooksDir}`);
     info(`pre-commit: ${result.preCommit}, post-commit: ${result.postCommit}`);
     info("Commits of unverified change batches will be blocked in agent worktrees.");
@@ -73488,7 +74425,7 @@ function handleInstall2(argv) {
 function handleUninstall(argv) {
   try {
     if (argv.claude) {
-      const result2 = uninstallClaudeGuard(path57.resolve(argv.repo));
+      const result2 = uninstallClaudeGuard(path61.resolve(argv.repo));
       if (result2.removed) {
         success("Claude Code worktree guard removed.");
       } else {
@@ -73496,7 +74433,7 @@ function handleUninstall(argv) {
       }
       return;
     }
-    const result = uninstallHooks(path57.resolve(argv.repo));
+    const result = uninstallHooks(path61.resolve(argv.repo));
     if (result.removed) {
       success(`Commit gate removed from ${result.hooksDir}`);
     } else {
@@ -73509,7 +74446,7 @@ function handleUninstall(argv) {
 }
 function handleStatus2(argv) {
   try {
-    const status = getHooksStatus(path57.resolve(argv.repo));
+    const status = getHooksStatus(path61.resolve(argv.repo));
     if (argv.json) {
       process.stdout.write(`${JSON.stringify(status, null, 2)}
 `);
@@ -73527,7 +74464,7 @@ function handleStatus2(argv) {
     );
     info(`Effective:     ${status.effectiveMode} (in this checkout)`);
     info(
-      `Claude guard:  ${claudeGuardInstalled(path57.resolve(argv.repo)) ? `installed (${CLAUDE_GUARD_RELATIVE_PATH})` : "not installed"}`
+      `Claude guard:  ${claudeGuardInstalled(path61.resolve(argv.repo)) ? `installed (${CLAUDE_GUARD_RELATIVE_PATH})` : "not installed"}`
     );
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -73788,10 +74725,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path62) {
-  if (!path62)
+function getElementAtPath(obj, path66) {
+  if (!path66)
     return obj;
-  return path62.reduce((acc, key) => acc?.[key], obj);
+  return path66.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -74111,11 +75048,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path62, issues) {
+function prefixIssues(path66, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path62);
+    iss.path.unshift(path66);
     return iss;
   });
 }
@@ -79438,7 +80375,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve47) => setTimeout(resolve47, pollInterval));
+        await new Promise((resolve50) => setTimeout(resolve50, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error3) {
@@ -79455,7 +80392,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve47, reject) => {
+    return new Promise((resolve50, reject) => {
       const earlyReject = (error3) => {
         reject(error3);
       };
@@ -79533,7 +80470,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve47(parseResult.data);
+            resolve50(parseResult.data);
           }
         } catch (error3) {
           reject(error3);
@@ -79794,12 +80731,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve47, reject) => {
+    return new Promise((resolve50, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve47, interval);
+      const timeoutId = setTimeout(resolve50, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -80589,7 +81526,7 @@ var Server = class extends Protocol {
 };
 
 // src/mcp/server.ts
-var path58 = __toESM(require("path"));
+var path62 = __toESM(require("path"));
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var import_node_process3 = __toESM(require("node:process"), 1);
@@ -80672,12 +81609,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve47) => {
+    return new Promise((resolve50) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve47();
+        resolve50();
       } else {
-        this._stdout.once("drain", resolve47);
+        this._stdout.once("drain", resolve50);
       }
     });
   }
@@ -80686,6 +81623,8 @@ var StdioServerTransport = class {
 // src/mcp/server.ts
 init_telemetry_config();
 init_runs();
+init_work_units();
+init_manifest();
 
 // src/mcp/schema-tools.ts
 init_schema2();
@@ -80770,7 +81709,21 @@ var LaunchEnvironmentInputSchema = external_exports.object({
   source: external_exports.string().min(1).max(64).optional(),
   sourceUrl: external_exports.string().url().optional(),
   title: external_exports.string().min(1).max(256).optional(),
-  parentWorkUnitId: external_exports.string().min(1).max(128).optional()
+  parentWorkUnitId: external_exports.string().min(1).max(128).optional(),
+  relatedLinks: external_exports.array(
+    external_exports.object({
+      source: external_exports.string().min(1).max(64),
+      url: external_exports.string().url(),
+      label: external_exports.string().min(1).max(128).optional()
+    })
+  ).optional()
+});
+var AddWorkUnitLinkInputSchema = external_exports.object({
+  repo: external_exports.string().default("."),
+  workUnitId: external_exports.string().min(1).max(128),
+  source: external_exports.string().min(1).max(64),
+  url: external_exports.string().url(),
+  label: external_exports.string().min(1).max(128).optional()
 });
 var LaunchEnvironmentOutputSchema = ShellRunOutputSchema.extend({
   previewUrls: external_exports.record(external_exports.string()).optional(),
@@ -80917,11 +81870,41 @@ var HAR_MCP_TOOLS = [
         parentWorkUnitId: {
           type: "string",
           description: "Optional parent work unit identifier."
+        },
+        relatedLinks: {
+          type: "array",
+          description: "Additional tracker links (append-only). Each item: source, url, optional label.",
+          items: {
+            type: "object",
+            properties: {
+              source: { type: "string" },
+              url: { type: "string" },
+              label: { type: "string" }
+            },
+            required: ["source", "url"]
+          }
         }
       },
       ["agentId"]
     )
   },
+  {
+    name: "har_add_work_unit_link",
+    description: "Append a related external link (PR, mirrored issue, alternate tracker) to an existing work unit.",
+    inputSchema: objectJsonSchema(
+      {
+        repo: repoJsonProperty,
+        workUnitId: {
+          type: "string",
+          description: "Repo-scoped work unit id bound at launch."
+        },
+        source: { type: "string", description: "Tracker provider (e.g. github, jira)." },
+        url: { type: "string", description: "Canonical URL for the link." },
+        label: { type: "string", description: "Optional display label." }
+      },
+      ["workUnitId", "source", "url"]
+    )
+  },
   {
     name: "har_recover_environment",
     description: "Resume a failed or partial agent launch without replacing the worktree. Alias for har_launch_environment with resume=true.",
@@ -81092,6 +82075,7 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
         sourceUrl: input.sourceUrl,
         title: input.title,
         parentWorkUnitId: input.parentWorkUnitId,
+        relatedLinks: input.relatedLinks,
         capture: true
       });
       const parsed = LaunchEnvironmentOutputSchema.parse(result);
@@ -81114,6 +82098,7 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
         sourceUrl: input.sourceUrl,
         title: input.title,
         parentWorkUnitId: input.parentWorkUnitId,
+        relatedLinks: input.relatedLinks,
         capture: true
       });
       const parsed = LaunchEnvironmentOutputSchema.parse(result);
@@ -81122,6 +82107,28 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
         ...result.blocked ? { isError: true } : {}
       };
     }
+    case "har_add_work_unit_link": {
+      const input = AddWorkUnitLinkInputSchema.parse({ ...args, repo });
+      const harnessRoot = resolveHarnessRoot(repo);
+      try {
+        const record2 = addWorkUnitLinks(harnessRoot, input.workUnitId, [
+          { source: input.source, url: input.url, label: input.label }
+        ]);
+        return jsonContent({
+          ok: true,
+          workUnitId: record2.workUnitId,
+          relatedLinks: record2.relatedLinks
+        });
+      } catch (err) {
+        return {
+          ...jsonContent({
+            ok: false,
+            error: err instanceof Error ? err.message : String(err)
+          }),
+          isError: true
+        };
+      }
+    }
     case "har_preflight_environment": {
       const input = PreflightEnvironmentInputSchema.parse({ ...args, repo });
       const agentId = validateAgentId(input.agentId, repo);
@@ -81232,7 +82239,7 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
       const input = ControlUpInputSchema.parse({ ...args, repo });
       const result = await startControlAndSync({
         detach: input.detach,
-        cwd: path58.resolve(input.repo)
+        cwd: path62.resolve(input.repo)
       });
       if (result.code !== 0) {
         return {
@@ -81296,11 +82303,11 @@ var mcpCommand = {
 };
 
 // src/cli/commands/onboard.ts
-var path60 = __toESM(require("path"));
+var path64 = __toESM(require("path"));
 init_stages();
 
 // src/core/onboarding.ts
-var path59 = __toESM(require("path"));
+var path63 = __toESM(require("path"));
 init_control_config();
 init_control_sync();
 init_otel_hooks();
@@ -81345,7 +82352,8 @@ function listPluginChoices() {
   return listPluginIds().map((id) => {
     try {
       const manifest = readPluginManifest(id);
-      const description = typeof manifest.stage.description === "string" ? manifest.stage.description : `Adds stage ${manifest.stageId}`;
+      const stages = normalizePluginStages(manifest);
+      const description = typeof stages[0]?.description === "string" ? stages[0].description : `Adds stage ${primaryStageId(manifest)}`;
       return {
         id,
         label: `${id} \u2014 ${description}`,
@@ -81435,7 +82443,7 @@ async function defaultEnsureControl(options) {
   return { started: true, apiUrl: result.apiUrl };
 }
 async function runOnboarding(options, deps = {}) {
-  const repoPath = path59.resolve(options.repoPath);
+  const repoPath = path63.resolve(options.repoPath);
   const applyTelemetry = deps.applyTelemetry ?? applyOnboardingTelemetry;
   const ensureControl = deps.ensureControl ?? defaultEnsureControl;
   const init = deps.initHarness ?? initHarness;
@@ -81623,7 +82631,7 @@ async function promptChoices(args) {
     };
   }
   const pluginChoices = listPluginChoices();
-  const repoPath = path60.resolve(args.repo);
+  const repoPath = path64.resolve(args.repo);
   const alreadyPresent = harnessExists(repoPath);
   const needProfile = !alreadyPresent && !args.skipInit && args.profile === void 0;
   const needAgentSlots = shouldConfigureSlots && flaggedSlots === void 0;
@@ -81740,7 +82748,7 @@ function printSummary(result) {
   console.error("");
 }
 async function handleOnboard(argv) {
-  const repoPath = path60.resolve(argv.repo);
+  const repoPath = path64.resolve(argv.repo);
   header("har onboard");
   info(`Repository: ${repoPath}`);
   try {
@@ -81971,7 +82979,7 @@ var preferencesCommand = {
 };
 
 // src/cli/commands/telemetry.ts
-var path61 = __toESM(require("path"));
+var path65 = __toESM(require("path"));
 init_control_config();
 init_control_sync();
 init_manifest();
@@ -82064,7 +83072,7 @@ async function handleOff() {
   info("Mission Control will not auto-start. Existing usage rows are kept.");
 }
 async function handleWriteEnv(argv) {
-  const repoPath = path61.resolve(argv.repo);
+  const repoPath = path65.resolve(argv.repo);
   const harnessRoot = resolveHarnessRoot(repoPath);
   const session = readSlotRegistry(harnessRoot, argv.agentId);
   const workDir = argv.workDir ?? session?.workDir ?? repoPath;
@@ -82076,7 +83084,7 @@ async function handleWriteEnv(argv) {
     suffix,
     createdAt: session?.createdAt
   });
-  const envFile = argv.envFile ?? path61.join(workDir, `.env.agent.${argv.agentId}`);
+  const envFile = argv.envFile ?? path65.join(workDir, `.env.agent.${argv.agentId}`);
   const attrs = {
     sessionKey,
     agentId: argv.agentId,
@@ -82092,7 +83100,7 @@ async function handleWriteEnv(argv) {
   success(`Wrote session attribution to ${envFile}`);
 }
 function handlePrintEnv(argv) {
-  const repoPath = path61.resolve(argv.repo);
+  const repoPath = path65.resolve(argv.repo);
   const workDir = argv.workDir ?? repoPath;
   const sessionKey = buildSessionKey({
     branch: argv.branch,