@papi-ai/server 0.7.19 → 0.7.21

package/dist/index.js

@@ -2364,9 +2364,9 @@ var init_query = __esm({
     CLOSE = {};
     Query = class extends Promise {
       constructor(strings, args, handler, canceller, options = {}) {
-        let resolve, reject;
+        let resolve2, reject;
         super((a, b2) => {
-          resolve = a;
+          resolve2 = a;
           reject = b2;
         });
         this.tagged = Array.isArray(strings.raw);
@@ -2377,7 +2377,7 @@ var init_query = __esm({
         this.options = options;
         this.state = null;
         this.statement = null;
-        this.resolve = (x) => (this.active = false, resolve(x));
+        this.resolve = (x) => (this.active = false, resolve2(x));
         this.reject = (x) => (this.active = false, reject(x));
         this.active = false;
         this.cancelled = null;
@@ -2425,12 +2425,12 @@ var init_query = __esm({
               if (this.executed && !this.active)
                 return { done: true };
               prev && prev();
-              const promise = new Promise((resolve, reject) => {
+              const promise = new Promise((resolve2, reject) => {
                 this.cursorFn = (value) => {
-                  resolve({ value, done: false });
+                  resolve2({ value, done: false });
                   return new Promise((r) => prev = r);
                 };
-                this.resolve = () => (this.active = false, resolve({ done: true }));
+                this.resolve = () => (this.active = false, resolve2({ done: true }));
                 this.reject = (x) => (this.active = false, reject(x));
               });
               this.execute();
@@ -3028,12 +3028,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x.on("drain", drain);
     return x;
   }
-  async function cancel({ pid, secret }, resolve, reject) {
+  async function cancel({ pid, secret }, resolve2, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect();
       socket.once("error", reject);
-      socket.once("close", resolve);
+      socket.once("close", resolve2);
     } catch (error2) {
       reject(error2);
     }
@@ -4050,7 +4050,7 @@ var init_subscribe = __esm({
 // ../../node_modules/postgres/src/large.js
 import Stream2 from "stream";
 function largeObject(sql, oid, mode = 131072 | 262144) {
-  return new Promise(async (resolve, reject) => {
+  return new Promise(async (resolve2, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -4076,7 +4076,7 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
           ) seek
         `
       };
-      resolve(lo);
+      resolve2(lo);
       return new Promise(async (r) => finish = r);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -4237,8 +4237,8 @@ function Postgres(a, b2) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open.length ? open.shift() : await new Promise((resolve, reject) => {
-      const query = { reserve: resolve, reject };
+    const c = open.length ? open.shift() : await new Promise((resolve2, reject) => {
+      const query = { reserve: resolve2, reject };
       queries.push(query);
       closed.length && connect(closed.shift(), query);
     });
@@ -4275,9 +4275,9 @@ function Postgres(a, b2) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve, reject) => {
+        result = await new Promise((resolve2, reject) => {
           const x = fn2(sql2);
-          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve, reject);
+          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve2, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -4334,8 +4334,8 @@ function Postgres(a, b2) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve, reject) : query.cancelled = { resolve, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve());
+    return new Promise((resolve2, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve2, reject) : query.cancelled = { resolve: resolve2, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve2());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -4354,11 +4354,11 @@ function Postgres(a, b2) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve) {
+  async function destroy(resolve2) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve();
+    resolve2();
   }
   function connect(c, query) {
     move(c, connecting);
@@ -5757,6 +5757,38 @@ CREATE TABLE IF NOT EXISTS cost_snapshots (
   UNIQUE (project_id, cycle)
 );
 
+-- task-1896: per-project harness inventory (skills / sub-agents / hooks / MCP tools).
+-- Scanned from the local filesystem by the MCP server and persisted so the
+-- dashboard (no filesystem access) can surface what harness a project runs.
+CREATE TABLE IF NOT EXISTS project_harness_inventory (
+  id UUID DEFAULT gen_random_uuid() NOT NULL,
+  project_id UUID NOT NULL REFERENCES projects(id),
+  user_id UUID,
+  kind TEXT NOT NULL CHECK (kind IN ('skill', 'agent', 'hook', 'mcp_tool')),
+  name TEXT NOT NULL,
+  description TEXT,
+  version TEXT,
+  checksum TEXT,
+  status TEXT DEFAULT 'ok'::text NOT NULL CHECK (status IN ('ok', 'stale_fork', 'missing')),
+  path TEXT,
+  synced_at TIMESTAMPTZ DEFAULT now() NOT NULL,
+  created_at TIMESTAMPTZ DEFAULT now() NOT NULL,
+  updated_at TIMESTAMPTZ DEFAULT now() NOT NULL,
+  PRIMARY KEY (id),
+  UNIQUE (project_id, kind, name)
+);
+CREATE INDEX IF NOT EXISTS idx_project_harness_inventory_project_kind
+  ON project_harness_inventory (project_id, kind);
+
+-- task-1896: cheap change-detection marker. The sync writer only does the full
+-- scan + DB write when this fingerprint changes, so DB writes stay rare.
+CREATE TABLE IF NOT EXISTS project_harness_state (
+  project_id UUID NOT NULL REFERENCES projects(id),
+  fingerprint TEXT,
+  synced_at TIMESTAMPTZ DEFAULT now() NOT NULL,
+  PRIMARY KEY (project_id)
+);
+
 CREATE TABLE IF NOT EXISTS cycle_metrics_snapshots (
   id UUID DEFAULT gen_random_uuid() NOT NULL,
   project_id UUID NOT NULL REFERENCES projects(id),
@@ -6846,6 +6878,63 @@ EXCEPTION WHEN duplicate_object THEN NULL; END $$;
           createdAt: r.created_at
         }));
       }
+      // --- Harness inventory (task-1896) ---
+      async getHarnessInventory() {
+        const rows = await this.sql`
+      SELECT id, project_id, kind, name, description, version, checksum, status, path, synced_at
+      FROM project_harness_inventory
+      WHERE project_id = ${this.projectId}
+      ORDER BY kind, name
+    `;
+        return rows.map((r) => ({
+          id: r.id,
+          projectId: r.project_id,
+          kind: r.kind,
+          name: r.name,
+          description: r.description ?? void 0,
+          version: r.version ?? void 0,
+          checksum: r.checksum ?? void 0,
+          status: r.status,
+          path: r.path ?? void 0,
+          syncedAt: r.synced_at
+        }));
+      }
+      async replaceHarnessInventory(entries) {
+        const userId = await this.ownerUserId();
+        await this.sql.begin(async (_tx) => {
+          const sql = _tx;
+          await sql`DELETE FROM project_harness_inventory WHERE project_id = ${this.projectId}`;
+          if (entries.length === 0) return;
+          const values2 = entries.map((e) => ({
+            project_id: this.projectId,
+            user_id: userId,
+            kind: e.kind,
+            name: e.name,
+            description: e.description ?? null,
+            version: e.version ?? null,
+            checksum: e.checksum ?? null,
+            status: e.status,
+            path: e.path ?? null
+          }));
+          await sql`INSERT INTO project_harness_inventory ${sql(values2)}`;
+        });
+      }
+      async getHarnessState() {
+        const rows = await this.sql`
+      SELECT fingerprint, synced_at FROM project_harness_state
+      WHERE project_id = ${this.projectId}
+      LIMIT 1
+    `;
+        if (rows.length === 0 || rows[0].fingerprint === null) return null;
+        return { fingerprint: rows[0].fingerprint, syncedAt: rows[0].synced_at };
+      }
+      async setHarnessState(fingerprint) {
+        await this.sql`
+      INSERT INTO project_harness_state (project_id, fingerprint, synced_at)
+      VALUES (${this.projectId}, ${fingerprint}, now())
+      ON CONFLICT (project_id) DO UPDATE SET fingerprint = ${fingerprint}, synced_at = now()
+    `;
+      }
       async getUnactionedDogfoodEntries(limit = 20) {
         const rows = await this.sql`
       SELECT id, project_id, cycle_number, category, content, source_tool, source_ref, created_at
@@ -9068,6 +9157,19 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       updateDogfoodEntryStatus(id, status, linkedTaskId) {
         return this.invoke("updateDogfoodEntryStatus", [id, status, linkedTaskId]);
       }
+      // --- Harness inventory (task-1896) ---
+      getHarnessInventory() {
+        return this.invoke("getHarnessInventory");
+      }
+      replaceHarnessInventory(entries) {
+        return this.invoke("replaceHarnessInventory", [entries]);
+      }
+      getHarnessState() {
+        return this.invoke("getHarnessState");
+      }
+      setHarnessState(fingerprint) {
+        return this.invoke("setHarnessState", [fingerprint]);
+      }
       // --- North Star ---
       getCurrentNorthStar() {
         return this.invoke("getCurrentNorthStar");
@@ -9227,6 +9329,7 @@ __export(git_exports, {
   detectBoardMismatches: () => detectBoardMismatches,
   detectUnrecordedCommits: () => detectUnrecordedCommits,
   ensureLatestDevelop: () => ensureLatestDevelop,
+  getBranchDiff: () => getBranchDiff,
   getCommitsSinceTag: () => getCommitsSinceTag,
   getCurrentBranch: () => getCurrentBranch,
   getDocPathsTouchedOnBranch: () => getDocPathsTouchedOnBranch,
@@ -9370,6 +9473,26 @@ function getModifiedFiles(cwd) {
     return [];
   }
 }
+function getBranchDiff(cwd, base = "origin/main", maxBytes = 2e5) {
+  const refs = [`${base}...HEAD`, "main...HEAD"];
+  for (const ref of refs) {
+    try {
+      const out = execFileSync("git", ["diff", ref], {
+        cwd,
+        encoding: "utf-8",
+        maxBuffer: 32 * 1024 * 1024
+      });
+      if (out) {
+        return out.length > maxBytes ? `${out.slice(0, maxBytes)}
+
+... [diff truncated at ${Math.round(maxBytes / 1024)} KB]` : out;
+      }
+      return "";
+    } catch {
+    }
+  }
+  return "";
+}
 function getHeadCommitSubject(cwd) {
   try {
     const out = execFileSync("git", ["log", "-1", "--format=%s"], {
@@ -10002,9 +10125,9 @@ __export(doctor_exports, {
   __testing: () => __testing,
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join15 } from "path";
+import { join as join18 } from "path";
 function redact(name, value) {
   if (!value) return "(empty)";
   if (SECRET_VARS.has(name)) {
@@ -10015,14 +10138,14 @@ function redact(name, value) {
 }
 function findMcpJson() {
   const candidates = [
-    join15(process.cwd(), ".mcp.json"),
-    join15(homedir4(), ".claude", ".mcp.json"),
-    join15(homedir4(), ".mcp.json")
+    join18(process.cwd(), ".mcp.json"),
+    join18(homedir4(), ".claude", ".mcp.json"),
+    join18(homedir4(), ".mcp.json")
   ];
   for (const path7 of candidates) {
-    if (!existsSync8(path7)) continue;
+    if (!existsSync9(path7)) continue;
     try {
-      const raw = readFileSync8(path7, "utf-8");
+      const raw = readFileSync10(path7, "utf-8");
       const parsed = JSON.parse(raw);
       const papiEntry = parsed.papi ?? parsed.mcpServers?.papi;
       if (!papiEntry) continue;
@@ -10180,17 +10303,17 @@ __export(reset_exports, {
   removePapiEntry: () => removePapiEntry,
   runReset: () => runReset
 });
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join16 } from "path";
+import { join as join19 } from "path";
 import { createInterface } from "readline/promises";
 function findResetTarget() {
   for (const path7 of CANDIDATE_PATHS()) {
-    if (!existsSync9(path7)) continue;
+    if (!existsSync10(path7)) continue;
     let raw;
     let parsed;
     try {
-      raw = readFileSync9(path7, "utf-8");
+      raw = readFileSync11(path7, "utf-8");
       parsed = JSON.parse(raw);
     } catch {
       continue;
@@ -10278,17 +10401,17 @@ var init_reset = __esm({
   "src/cli/reset.ts"() {
     "use strict";
     CANDIDATE_PATHS = () => [
-      join16(process.cwd(), ".mcp.json"),
-      join16(homedir5(), ".claude", ".mcp.json"),
-      join16(homedir5(), ".mcp.json")
+      join19(process.cwd(), ".mcp.json"),
+      join19(homedir5(), ".claude", ".mcp.json"),
+      join19(homedir5(), ".mcp.json")
     ];
   }
 });
 
 // src/index.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname3, join as join17 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname5, join as join20 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
 import {
@@ -10758,10 +10881,10 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
 }
 
 // src/server.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { access as access4, readdir as readdir2, readFile as readFile7 } from "fs/promises";
-import { join as join14, dirname as dirname2 } from "path";
-import { fileURLToPath } from "url";
+import { readFileSync as readFileSync9 } from "fs";
+import { access as access4, readdir as readdir4, readFile as readFile9 } from "fs/promises";
+import { join as join17, dirname as dirname4 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import {
   CallToolRequestSchema,
@@ -15083,34 +15206,60 @@ function buildSubagentDispatchPrompt(input) {
   const {
     tool,
     applyMode,
-    cycleNumber,
+    cycleNumber = 0,
     strategyReviewWarning = "",
+    taskId,
     systemPrompt,
     userMessage,
     contextBytes
   } = input;
   const sizeNote = contextBytes !== void 0 ? ` (~${Math.round(contextBytes / 1024)} KB context)` : "";
-  const applyNote = tool === "plan" ? `\`plan\` again with mode="apply", llm_response=<sub-agent output>, plan_mode="${applyMode ?? "full"}", cycle_number=${cycleNumber + 1}, strategy_review_warning=${JSON.stringify(strategyReviewWarning)}` : `\`strategy_review\` again with mode="apply", llm_response=<sub-agent output>, cycle_number=${cycleNumber}`;
-  const subagentInstructions = `
-You are a one-shot sub-agent dispatched by Claude Code to execute a PAPI ${tool} call.
-
-CONTRACT:
-- Read the system prompt and context exactly as the main agent would.
+  const isReview = tool === "review_submit";
+  let applyNote;
+  if (tool === "plan") {
+    applyNote = `\`plan\` again with mode="apply", llm_response=<sub-agent output>, plan_mode="${applyMode ?? "full"}", cycle_number=${cycleNumber + 1}, strategy_review_warning=${JSON.stringify(strategyReviewWarning)}`;
+  } else if (tool === "strategy_review") {
+    applyNote = `\`strategy_review\` again with mode="apply", llm_response=<sub-agent output>, cycle_number=${cycleNumber}`;
+  } else {
+    applyNote = `\`review_submit\` with task_id="${taskId ?? "<task-id>"}", stage="build-acceptance", verdict=<your decision: accept / request-changes / reject>, comments=<your reasoning>, and auto_review set to the sub-agent's JSON object verbatim. The sub-agent's verdict is a RECOMMENDATION \u2014 you make the final call`;
+  }
+  const contractBody = isReview ? `- Review the completed build below. The build report says what was intended; the diff is what actually changed. Check correctness, scope adherence (did it match the handoff?), security, and quality.
+- Return ONLY a single JSON object \u2014 no preamble, no commentary, no fences \u2014 in exactly this shape:
+  {"verdict":"pass|warn|fail","summary":"<one-line overall assessment>","findings":[{"severity":"error|warning|info","file":"<path>","line":<number>,"message":"<specific issue>"}]}
+- "pass" = no blocking issues; "warn" = minor/non-blocking nits; "fail" = blocking issues that should send the build back. \`file\`/\`line\` are optional per finding. Empty \`findings\` is valid when clean.` : `- Read the system prompt and context exactly as the main agent would.
 - Produce the full structured output the system prompt requires (Part 1 markdown + Part 2 JSON after \`<!-- PAPI_STRUCTURED_OUTPUT -->\`, or whatever the system prompt specifies).
-- Return ONLY that output \u2014 no preamble, no commentary, no closing summary. The dispatching agent will pass your reply verbatim to the apply call.
+- Return ONLY that output \u2014 no preamble, no commentary, no closing summary. The dispatching agent will pass your reply verbatim to the apply call.`;
+  const contextBlock = isReview ? `<review_rubric>
+${systemPrompt}
+</review_rubric>
 
-<system_prompt>
+<build_under_review>
+${userMessage}
+</build_under_review>` : `<system_prompt>
 ${systemPrompt}
 </system_prompt>
 
 <context>
 ${userMessage}
-</context>
+</context>`;
+  const purpose = isReview ? "perform a PAPI build-acceptance code review" : `execute a PAPI ${tool} call`;
+  const subagentInstructions = `
+You are a one-shot sub-agent dispatched by Claude Code to ${purpose}.
+
+CONTRACT:
+${contractBody}
+
+${contextBlock}
 `.trim();
+  const headerLabel = isReview ? `## PAPI review_submit \u2014 Sub-Agent Dispatch (${taskId ?? "build review"}${sizeNote})` : `## PAPI ${tool} \u2014 Sub-Agent Dispatch (Cycle ${cycleNumber + (tool === "plan" ? 1 : 0)}${sizeNote})`;
+  const intro = isReview ? "This build review carries a large diff/report \u2014 enough to crowd the main session context. Dispatch the analysis via `Task()` to a fresh sub-agent, then act on its structured findings." : `The reasoning for this ${tool} call is heavy enough to crowd the main session context. Dispatch it via \`Task()\` to a fresh sub-agent and pass its reply through to the apply call.`;
+  const step2Note = isReview ? `When the sub-agent returns its JSON, surface the findings, decide your verdict, then call ${applyNote}.` : `When the sub-agent returns, call ${applyNote}.
+
+Do NOT post-process the sub-agent reply. The apply path expects the full structured output exactly as the sub-agent emits it.`;
   return [
-    `## PAPI ${tool} \u2014 Sub-Agent Dispatch (Cycle ${cycleNumber + (tool === "plan" ? 1 : 0)}${sizeNote})`,
+    headerLabel,
     "",
-    `The reasoning for this ${tool} call is heavy enough to crowd the main session context. Dispatch it via \`Task()\` to a fresh sub-agent and pass its reply through to the apply call.`,
+    intro,
     "",
     "---",
     "",
@@ -15118,18 +15267,16 @@ ${userMessage}
     "",
     "Use the `Task` tool with:",
     `- \`subagent_type\`: \`general-purpose\``,
-    `- \`description\`: \`Run PAPI ${tool}\``,
+    `- \`description\`: \`${isReview ? "Review PAPI build" : `Run PAPI ${tool}`}\``,
     `- \`prompt\`: the full prompt block below (everything between the BEGIN/END markers, trimmed of the markers themselves).`,
     "",
     "<<<BEGIN_SUBAGENT_PROMPT>>>",
     subagentInstructions,
     "<<<END_SUBAGENT_PROMPT>>>",
     "",
-    "### Step 2 \u2014 Pass the sub-agent reply to apply",
-    "",
-    `When the sub-agent returns, call ${applyNote}.`,
+    `### Step 2 \u2014 ${isReview ? "Act on the review" : "Pass the sub-agent reply to apply"}`,
     "",
-    "Do NOT post-process the sub-agent reply. The apply path expects the full structured output exactly as the sub-agent emits it."
+    step2Note
   ].join("\n");
 }
 
@@ -15975,8 +16122,8 @@ ${lines.join("\n")}`;
       const lastReviewDate = previousStrategyReviews?.[0]?.createdAt ? new Date(previousStrategyReviews[0].createdAt) : /* @__PURE__ */ new Date(0);
       const planFiles = readdirSync(plansDir).filter((f) => f.endsWith(".md")).map((f) => {
         const fullPath = join2(plansDir, f);
-        const stat3 = statSync(fullPath);
-        return { name: f, modified: stat3.mtime, size: stat3.size };
+        const stat4 = statSync(fullPath);
+        return { name: f, modified: stat4.mtime, size: stat4.size };
       }).filter((f) => f.modified > lastReviewDate).sort((a, b2) => b2.modified.getTime() - a.modified.getTime()).slice(0, 15);
       if (planFiles.length > 0) {
         const lines = planFiles.map((f) => {
@@ -17933,7 +18080,7 @@ ${existing}` : entry;
 // src/services/setup.ts
 init_dist2();
 import { mkdir, writeFile as writeFile2, readFile as readFile4, readdir, access as access2, stat as stat2 } from "fs/promises";
-import { join as join4, basename, extname } from "path";
+import { join as join5, basename, extname, dirname as dirname2 } from "path";
 import { execFileSync as execFileSync3 } from "child_process";
 
 // src/lib/detect-codebase.ts
@@ -17974,6 +18121,50 @@ function detectCodebaseType(projectRoot) {
   return "new_project";
 }
 
+// src/lib/agents-bundle.ts
+import { readFileSync, existsSync as existsSync3, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { dirname, join as join4, resolve } from "path";
+import { fileURLToPath } from "url";
+var PROJECT_BUNDLE_REL = join4(".agents", "skills", "papi-cycle");
+function bundleDestRel(rel) {
+  return rel === "AGENTS.md" ? "AGENTS.md" : join4(PROJECT_BUNDLE_REL, rel);
+}
+function resolveBundleDir() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 5; i++) {
+    const candidate = join4(dir, "skills", "papi-cycle");
+    if (existsSync3(join4(candidate, "AGENTS.md"))) return candidate;
+    const parent = resolve(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
+function readBundleFiles(bundleDir = resolveBundleDir()) {
+  if (!bundleDir || !existsSync3(bundleDir)) return [];
+  const files = [];
+  const walk = (abs, rel) => {
+    for (const entry of readdirSync3(abs, { withFileTypes: true })) {
+      const childAbs = join4(abs, entry.name);
+      const childRel = rel ? join4(rel, entry.name) : entry.name;
+      if (entry.isDirectory()) walk(childAbs, childRel);
+      else if (entry.isFile()) files.push({ rel: childRel, content: readFileSync(childAbs, "utf8") });
+    }
+  };
+  walk(bundleDir, "");
+  return files;
+}
+function planBundleInstall(projectRoot, projectName, opts = {}) {
+  const out = {};
+  for (const f of readBundleFiles()) {
+    const dest = join4(projectRoot, bundleDestRel(f.rel));
+    if (opts.skipExisting && existsSync3(dest) && statSync3(dest).isFile()) continue;
+    const content = f.rel === "AGENTS.md" ? f.content.replace(/\{\{project_name\}\}/g, projectName) : f.content;
+    out[dest] = content;
+  }
+  return out;
+}
+
 // src/templates.ts
 var PLANNING_LOG_TEMPLATE = `# PAPI Planning Log
 
@@ -18100,283 +18291,17 @@ var CYCLES_TEMPLATE = `# Cycles
 cycles: []
 <!-- PAPI-YAML-END -->
 `;
-var CLAUDE_MD_TEMPLATE = `# {{project_name}}
-
-## Project Identity \u2014 Verify Before Editing
-
-On the first \`orient\` of any session, surface the connected project name to the user (e.g. "Connected to: <project_name>") and confirm it matches what they expect before making any code changes. PAPI projects are scoped by ID; if the wrong PAPI_PROJECT_ID is configured, edits land in the wrong project's history \u2014 a hard-to-undo class of mistake.
-
-If the user doesn't recognise the project, stop. To fix it from this chat \u2014 no file editing \u2014 use the project tools: \`project_list\` to see their projects, \`project_create\` to make an empty one for this folder, or \`project_switch\` to point at the right one. Or pass \`project=<id>\` on a single call to override for that call only.
-
-## Documentation Maintenance
-
-Before creating a new doc, check \`docs/INDEX.md\` \u2014 it may already exist. When creating or archiving docs, update the index.
-
-After implementing any code change, check if the change affects any documentation in \`docs/\`. If a doc describes behaviour, architecture, or file interactions that your change modified, update the doc to stay accurate.
-
-When updating a doc, add or update a review header immediately below the title:
-
-\`\`\`
-# Document Title
-> Last reviewed: task-NNN \u2014 DD-MM-YYYY
-\`\`\`
-
-Replace \`task-NNN\` with the task ID that triggered the update, and \`DD-MM-YYYY\` with today's date.
-
-## Session Start
-
-When a conversation starts \u2014 fresh window, new session, or after context compression \u2014 orient before doing anything else:
-
-1. **Run \`orient\`** \u2014 single call that returns cycle number, task counts, in-progress/in-review tasks, strategy review cadence, trends, and recommended next action.
-2. **Fix orphaned tasks silently** \u2014 check for feat/task-XXX branches that don't match board status. Fix and report after.
-3. **Summarise:** "You're on Cycle N. X tasks to build, Y builds pending review." or "Cycle N is complete \u2014 ready for the next plan."
-4. **Run \`build_list\` when picking a task** \u2014 \`orient\` shows counts only. \`build_list\` shows the full task list with handoffs.
-
-**CRITICAL: Check task statuses before acting.**
-- **In Review** = already built. Suggest \`review_list\` \u2192 \`review_submit\`. **NEVER re-build an In Review task.**
-- **In Progress** = build started but not completed. Check the branch and existing changes before writing new code.
-- **Backlog** = not started. But first check if a \`feat/task-XXX\` branch already exists with commits \u2014 fix it, don't rebuild.
-- If all cycle tasks are Done, suggest \`release\` or next \`plan\`.
-
-## Workflow Sequences
-
-PAPI tools follow structured flows. The agent manages the cycle workflow automatically \u2014 the user should never need to type tool names or remember the flow. Handle the plumbing, surface the summaries.
-
-### Cycle Workflow (auto-managed)
-
-- **Run tools automatically** \u2014 don't ask the user to invoke MCP tools manually
-- Before implementing: silently run \`build_execute <task_id>\` (start phase)
-- After implementing: run \`build_execute <task_id>\` (complete phase) with report fields
-- After build_execute completes: audit the branch changes for bugs, convention violations, and doc drift (see Post-Build Audit below)
-- After audit with findings: *MUST* automatically run \`review_submit\` with verdict \`request-changes\` and a concise summary of the audit findings as the changes requested \u2014 the builder fixes these before the task goes to human review
-- After audit clean: present for human review \u2014 "Ready for your review \u2014 approve or request changes?"
-- User approves/requests changes \u2192 run \`review_submit\` behind the scenes
-
-### The Cycle (main flow)
-
-\`\`\`
-plan \u2192 build_list \u2192 build_execute \u2192 audit \u2192 review_list \u2192 review_submit \u2192 build_list
-\`\`\`
-
-1. **plan** \u2014 Run at the start of each cycle to generate the cycle plan and populate the board.
-   Next: \`build_list\` to see prioritised tasks.
-2. **build_list** \u2014 View tasks ready for execution, ordered by priority.
-   Next: \`build_execute <task_id>\` to start a task.
-3. **build_execute** (start) \u2014 Creates a feature branch and marks the task In Progress. Returns the build handoff.
-   Next: Implement the task, then \`build_execute <task_id>\` again with report fields to complete.
-4. **build_execute** (complete) \u2014 Submits the build report, commits, and marks the task In Review.
-   Next: Run the post-build audit automatically.
-5. **Post-build audit** \u2014 Review branch changes for bugs, convention violations, and doc drift (see Post-Build Audit section below).
-   Next: If findings exist, run \`review_submit\` with \`request-changes\` and the audit findings. If clean, proceed to \`review_list\`.
-6. **review_list** \u2014 Shows tasks pending human review (handoff-review or build-acceptance).
-   Next: \`review_submit\` to approve, accept, or request changes.
-7. **review_submit** \u2014 Records the review verdict and updates task status.
-   Next: \`build_list\` to view next build
-
-   **DO NOT** use \`review_submit\` as a substitute for \`review_list\`. If you need to see what is pending review, always call \`review_list\` first. If \`review_list\` is unavailable in your tool set (e.g. your MCP client filters parameterless tools), STOP and tell the human their MCP integration is incomplete \u2014 never guess at the next pending task. To submit an accept verdict on a build-acceptance review, either pass \`reviewer_confirmed: true\` or ensure \`review_list\` has run in the same session within the last 15 minutes. (SUP-2026-010.)
-
-### Strategy Review
-
-\`\`\`
-strategy_review \u2192 strategy_change
-\`\`\`
-
-- **strategy_review** \u2014 Analyses project health, velocity, and estimation accuracy.
-  Next: \`strategy_change\` if the review recommends adjustments.
-- **strategy_change** \u2014 Updates active decisions, north star, or project direction based on review findings.
-
-### Detect Strategic Decisions in Conversation
-
-Watch for: direction changes, architecture shifts, deprioritisation with reasoning, new principles, competitive positioning decisions.
-
-When detected:
-1. Flag it: "That sounds like a strategic direction change \u2014 should I run \`strategy_change\`?"
-2. If confirmed, run \`strategy_change\` immediately.
-3. If mid-build, finish the current task first.
-
-### Idea Capture
-
-\`\`\`
-idea \u2192 (picked up by next plan)
-\`\`\`
-
-- **idea** \u2014 Captures a new task idea and writes it to the backlog.
-  Next: The next \`plan\` run will prioritise and schedule it.
-
-### Project Bootstrap
-
-\`\`\`
-setup \u2192 plan
-\`\`\`
-
-- **setup** \u2014 {{setup_description}}
-  Next: \`plan\` to run the first cycle planning session.
-
-### Board Management
-
-- **board_view** \u2014 Read-only view of all tasks on the board.
-- **board_archive** \u2014 Removes completed/cancelled tasks from the board to an archive.
-- **board_deprioritise** \u2014 Moves a task to a later phase.
-
-### Quick Reference: Tool \u2192 Next Step
-
-| Tool | Next Step |
-|------|-----------|
-| \`setup\` | \`plan\` |
-| \`plan\` | \`build_list\` |
-| \`build_list\` | \`build_execute <task_id>\` |
-| \`build_execute\` (start) | Implement, then \`build_execute\` (complete) |
-| \`build_execute\` (complete) | Post-build audit (automatic) |
-| Audit (findings) | \`review_submit\` with \`request-changes\` |
-| Audit (clean) | \`review_list\` |
-| \`review_list\` | \`review_submit\` |
-| \`review_submit\` (approve/accept) | \`build_list\` |
-| \`review_submit\` (request-changes) | \`build_execute\` (redo) or \`build_list\` |
-| \`strategy_review\` | \`strategy_change\` (if needed) |
-| \`idea\` | Next \`plan\` picks it up |
-
-## Post-Build Audit
-
-After every \`build_execute\` (complete), audit the branch before presenting for human review. This catches bugs and convention violations early.
-
-1. **Identify changed files:** Run \`git diff origin/main --name-only\` to find modified files. If no changes, report "No changes to audit" and skip.
-2. **Review each changed file** for:
-   - Logic errors, off-by-one mistakes, incorrect conditions
-   - Unhandled edge cases (null, undefined, empty inputs)
-   - Convention violations defined in this CLAUDE.md
-   - Incorrect type narrowing or unsafe casts
-3. **Documentation check:** If any \`docs/\` files describe behaviour that the change modified, flag as "Doc drift".
-4. **Report:** For each issue: file path, severity (Bug/Convention/Doc drift), what's wrong, how to fix.
-5. **If findings exist:** Run \`review_submit\` with \`request-changes\` and the findings. Fix before human review.
-6. **If clean:** Present for human review \u2014 "Ready for your review \u2014 approve or request changes?"
-
-## When to Start a New Conversation
-
-Start a fresh window when:
-- **After a release** \u2014 cycle is done, context is heavy. New window orients in seconds via \`orient\`.
-- **After 3+ tasks built** \u2014 accumulated file reads, diffs, and discussions bloat context. Quality degrades.
-- **Switching modes** \u2014 going from building to planning, or from strategy review to building. Each mode benefits from clean context.
-- **After context compression fires** \u2014 if you notice earlier messages are missing, the window is getting stale. Open fresh.
-
-Stay in the same window when:
-- Building sequential tasks in a batch (especially XS/S tasks)
-- Mid-task and not yet complete
-- Having a strategic discussion that informs the next action
-
-**Rule of thumb:** If you've been in the same window for 30+ minutes or 3+ tasks, it's time for a fresh one.
-
-## Housekeeping \u2014 Opt-In Deep Sweep
-
-\`orient\` runs a fast cheap-checks-only path by default. The deep sweep \u2014 orphaned branches, In Review tasks with no PR, stale In Progress branches, unrecorded commits, unregistered docs \u2014 is opt-in via \`deep_housekeeping: true\`.
-
-When to run with \`deep_housekeeping: true\`:
-1. Before \`release\` \u2014 catch board/branch drift.
-2. After a long break (>1 day since last session) \u2014 surface anything that fell off.
-3. When you suspect drift \u2014 odd cycle counts, missing PRs.
-
-**Don't run deep on every session start.** It pollutes early context with cross-reference output that's noise 80% of the time. The default fast path tells you what cycle you're on, what's in flight, and what to do next; that's the daily-driver shape.
-
-If the deep sweep surfaces something fixable (orphaned branches, missing PRs), fix it silently and report after \u2014 same autonomous-plumbing rule as before.
-
-## Plumbing Is Autonomous
-
-Board status updates, branch cleanup, orphaned task fixes, commit/PR/merge for housekeeping \u2014 these are mechanical plumbing. **Do them end-to-end without stopping to ask.** Report after the fact.
-
-## Context Compression Recovery
-
-When the system compresses prior messages, immediately:
-1. **Run \`orient\`** \u2014 single call for cycle state
-2. Check your todo list for in-progress work
-3. Run housekeeping checks
-4. **NEVER re-build a task that is already In Review or Done.**
-5. Continue where you left off \u2014 don't restart or re-plan
-
-## Branching & PR Convention
-
-- **All in-cycle, in-module tasks share \`feat/cycle-N-<module>\`** regardless of complexity. One branch per module per cycle, merged together. Module-less tasks fall back to a per-task branch.
-- **Dependent tasks (any size):** When a task's BUILD HANDOFF lists a \`DEPENDS ON\` task from the same cycle, \`build_execute\` automatically reuses the upstream task's branch so commits stack for a single PR. Do not create a separate branch manually.
-- **Commit per task within grouped branches** \u2014 traceable git history.
-- **Never use \`build_execute\` with \`light=true\` on shared branches.** Light mode commits directly to the current branch without creating a PR. When a shared branch is squash-merged, those commits are collapsed \u2014 any CLAUDE.md or documentation changes are stripped. Use light mode only on isolated single-task branches where no squash-merge will occur.
-
-## Quick Work vs PAPI Work
-
-PAPI is for planned work. Quick fixes \u2014 just do them. No need for plan or build_execute.
-
-**After completing quick/ad-hoc work** (bug fixes, config changes, small improvements done outside the cycle), call \`ad_hoc\` to record it. This creates a Done task + build report so the work appears in cycle history and metrics. Don't skip this \u2014 unrecorded work is invisible work.
-
-## Data Integrity
-
-- **Use MCP tools for all project data operations.** DB is the source of truth when using the pg adapter.
-- Do NOT read \`.papi/\` files for context \u2014 use MCP tools.
-- \`.papi/\` files may be stale when using pg adapter. This is expected.
-- **\`board_edit\` handles cycle membership automatically.** Pass \`cycle: <n>\` to assign, \`cycle: null\` to clear (also flips status to Backlog), or \`status: "In Cycle"\` to auto-assign the active cycle. No manual SQL needed.
-
-## Code Before Claims \u2014 No Assumptions
-
-**Before making any claim about how the codebase works, read the relevant file first.**
-
-This includes:
-- How a feature is implemented ("it works like X") \u2192 read the source
-- Whether something exists ("there's no baseline migration") \u2192 check the directory
-- Whether a flow is broken or working \u2192 trace it in code
-- What a user would experience \u2192 check the actual page/component
-
-Do NOT rely on memory, prior conversation, or inference. Read first, then answer.
-If the answer requires checking 2-3 files, check them all before responding.
-
-## Tool Use Discipline
-
-Most tool errors are habit issues, not capability issues. Avoid them up front:
-
-- **Ranged reads for large files.** Before \`Read\`-ing a file you haven't already touched this session, check its size. For files over ~1000 lines, or known-large surfaces (generated SQL, lockfiles, HTML reports, large templates), use \`offset\` + \`limit\` from the start instead of hitting the token ceiling.
-- **Search-before-read for unverified paths.** If a path comes from memory or inference rather than a file you've read this session, run \`Glob\` or list the parent directory first. Don't \`Read\` paths you haven't confirmed exist.
-- **Prefer Read/Glob/Grep over Bash for file operations.** Bash \`cat\`/\`grep\`/\`find\`/\`ls\` is the most common source of failed commands and produces unstructured output. Reserve Bash for genuinely shell-only operations (git, gh, package managers, SQL, real pipelines).
-- **Verify-before-recommend.** Before suggesting a new task, hook, or skill, check whether it already exists: \`board_view\` for tasks, \`doc_search\` for docs, \`ls .claude/hooks/\` for hooks. Recommending duplicates of already-shipped work wastes a build slot.
-
-## User-Facing Replies \u2014 Default Brief
-
-When drafting any external user-facing copy (Discord post, support reply, email, release note, marketing blurb): default to \u22644 sentences, friendly tone, no hidden questions buried in prose. Offer to expand if the user wants more depth. Verbose drafts that need trimming are a recurring friction.
-
-This applies to *output for users*, not internal commit messages, build reports, or technical explanations \u2014 those follow normal conventions.
-
-## Process Rules
-
-These rules come from 80+ cycles of dogfooding. They prevent the most common sources of wasted time and rework.
-
-### Building
-- **Verify before claiming done.** Hit the endpoint, check the rendered output, confirm the data round-trips. Never say "should work" \u2014 prove it works.
-- **Preview frontend changes.** After any UI/styling build, provide the localhost URL so the user can visually review. Don't make them ask for it.
-- **Debug one change at a time.** When fixing issues, make one change, verify it, then move on. Don't stack multiple untested fixes.
-- **Test the write-read roundtrip.** Every data write path must have a verified read path. If you write to DB, confirm the read query returns what was written. This is the #1 source of silent failures.
-- **Test after every build.** Run the project's test suite after implementing. Suggest follow-up tasks from learnings when meaningful.
-- **Build patiently.** Validate each phase against the last. Don't rush through implementation \u2014 test through the UI, not just the API.
-
-### Security
-- **Audit before widening access.** Before any build that adds endpoints, modifies auth/RLS, introduces new user types, or changes access controls \u2014 review the security implications first. Fix findings before shipping.
-- **Flag access-widening changes.** If a build touches auth, RLS policies, API keys, or user-facing access, note "Security surface reviewed" in the build report's \`discovered_issues\` or \`architecture_notes\`.
-- **Never ship secrets.** Do not commit .env files, API keys, or credentials. Check \`.gitignore\` covers sensitive files before pushing.
-- **Telemetry opt-out.** PAPI collects anonymous usage data (tool name, duration, project ID). To disable, add \`"PAPI_TELEMETRY": "off"\` to the \`env\` block in your \`.mcp.json\`.
+var CLAUDE_MD_ENRICHMENT_SENTINEL_T1 = "<!-- PAPI_ENRICHMENT_TIER_1 -->";
+var CLAUDE_MD_ENRICHMENT_SENTINEL_T2 = "<!-- PAPI_ENRICHMENT_TIER_2 -->";
+var CLAUDE_MD_STUB = `# {{project_name}}
 
-### Planning & Scope
-- **NEVER run \`plan\` more than once per cycle.** Adjust the cycle with \`board_deprioritise\` or \`idea\` instead.
-- **NEVER skip cycles.** Complete and release the current cycle before running the next \`plan\`.
-- **Large plan/handoff outputs:** If the prepare-phase output is too large to pass inline (>50 KB), write it to a file and pass the absolute path via \`llm_response_file\` instead of \`llm_response\`. The \`plan\`, \`strategy_review\`, and \`handoff_generate\` apply modes all accept \`llm_response_file\`. The two parameters are mutually exclusive.
-- **Only build tasks assigned to the current cycle.** Use \`build_list\` \u2014 it filters to current-cycle tasks with handoffs.
-- **Don't ask premature questions.** If the project is in early cycles, don't ask about deployment accounts, hosting providers, OAuth setup, or commercial features. Focus on building core functionality first.
-- **Split large ideas.** If an idea has 3+ concerns, submit it as 2-3 separate ideas so the planner creates properly scoped tasks \u2014 not kitchen-sink handoffs.
-- **Auto-release completed cycles.** When all cycle tasks are Done and reviews accepted, run \`release\` immediately. Forgetting causes cycle number drift and merge conflicts in the next session.
-- **Verify cycle readiness before releasing.** Before calling \`release\`, run \`board_view\` to confirm every task in the current cycle has status Done or Cancelled. The review queue is NOT sufficient evidence \u2014 \`review_list\` only shows built-and-pending-review tasks; it does not show Backlog or In Progress tasks. If any task is Backlog or In Progress: (a) build it, (b) move it to the next cycle via \`board_edit({ task_id, cycle: N+1 })\`, or (c) cancel it via \`board_edit\`. Do not call \`release\` until the cycle has no pending work. The \`release\` tool enforces this server-side and will block with a task list if the check fails.
+This project is managed with **PAPI**. The agent harness \u2014 session workflow, the plan \u2192 build \u2192 review cycle, branching, and conventions \u2014 lives in **\`AGENTS.md\`** (always loaded) plus lazy-loaded phase skills under \`.agents/skills/papi-cycle/\`.
 
-### Communication
-- **Show task names, not just IDs.** When summarising board state or reconciliation, include task names \u2014 e.g. "task-42: Add supplier form" not just "task-42".
-- **Surface the next command.** After each step, tell the user what comes next. Commands should be surfaced, not memorised.
+**At session start: read \`AGENTS.md\`, then run \`orient\`.** Phase mechanics (planning, building, strategy, ideas) load on demand from the skills bundle. Add project-specific notes below this line \u2014 they will not be overwritten.
 
-### Stage Readiness
-- **Access-widening stages require auth/security phases.** Before declaring a stage complete, check if it widens who can access the product (e.g. Alpha Distribution, Alpha Cohort). If so, auth hardening and security review must be completed first \u2014 not discovered after the fact.
-- **Pattern:** Audit access surface \u2192 fix vulnerabilities \u2192 then widen access. Never ship access-widening without a security phase.
+${CLAUDE_MD_ENRICHMENT_SENTINEL_T1}
+${CLAUDE_MD_ENRICHMENT_SENTINEL_T2}
 `;
-var CLAUDE_MD_ENRICHMENT_SENTINEL_T1 = "<!-- PAPI_ENRICHMENT_TIER_1 -->";
-var CLAUDE_MD_ENRICHMENT_SENTINEL_T2 = "<!-- PAPI_ENRICHMENT_TIER_2 -->";
 var CLAUDE_MD_TIER_1 = `
 ${CLAUDE_MD_ENRICHMENT_SENTINEL_T1}
 
@@ -18605,7 +18530,7 @@ async function scaffoldPapiDir(adapter2, config2, input) {
       await mkdir(config2.papiDir, { recursive: true });
       for (const [filename, template] of Object.entries(FILE_TEMPLATES)) {
         const content = substitute(template, vars);
-        await writeFile2(join4(config2.papiDir, filename), content, "utf-8");
+        await writeFile2(join5(config2.papiDir, filename), content, "utf-8");
       }
     }
   } else {
@@ -18620,18 +18545,18 @@ async function scaffoldPapiDir(adapter2, config2, input) {
     } catch {
     }
   }
-  const commandsDir = join4(config2.projectRoot, ".claude", "commands");
-  const docsDir = join4(config2.projectRoot, "docs");
+  const commandsDir = join5(config2.projectRoot, ".claude", "commands");
+  const docsDir = join5(config2.projectRoot, "docs");
   await mkdir(commandsDir, { recursive: true });
   await mkdir(docsDir, { recursive: true });
-  const claudeMdPath = join4(config2.projectRoot, "CLAUDE.md");
+  const claudeMdPath = join5(config2.projectRoot, "CLAUDE.md");
   let claudeMdExists = false;
   try {
     await access2(claudeMdPath);
     claudeMdExists = true;
   } catch {
   }
-  const docsIndexPath = join4(docsDir, "INDEX.md");
+  const docsIndexPath = join5(docsDir, "INDEX.md");
   let docsIndexExists = false;
   try {
     await access2(docsIndexPath);
@@ -18639,26 +18564,30 @@ async function scaffoldPapiDir(adapter2, config2, input) {
   } catch {
   }
   const scaffoldFiles = {
-    [join4(commandsDir, "papi-audit.md")]: PAPI_AUDIT_COMMAND_TEMPLATE,
-    [join4(commandsDir, "test.md")]: TEST_COMMAND_TEMPLATE,
-    [join4(docsDir, "README.md")]: substitute(DOCS_README_TEMPLATE, vars)
+    [join5(commandsDir, "papi-audit.md")]: PAPI_AUDIT_COMMAND_TEMPLATE,
+    [join5(commandsDir, "test.md")]: TEST_COMMAND_TEMPLATE,
+    [join5(docsDir, "README.md")]: substitute(DOCS_README_TEMPLATE, vars)
   };
   if (!docsIndexExists) {
     scaffoldFiles[docsIndexPath] = substitute(DOCS_INDEX_TEMPLATE, vars);
   }
   if (!claudeMdExists) {
-    scaffoldFiles[claudeMdPath] = substitute(CLAUDE_MD_TEMPLATE, vars);
+    scaffoldFiles[claudeMdPath] = substitute(CLAUDE_MD_STUB, vars);
   } else {
     try {
       const existing = await readFile4(claudeMdPath, "utf-8");
-      if (!existing.includes("## Workflow Sequences") && !existing.includes("### The Cycle (main flow)")) {
-        const papiSection = "\n\n" + substitute(CLAUDE_MD_TEMPLATE, vars).split("\n").slice(1).join("\n");
-        scaffoldFiles[claudeMdPath] = existing + papiSection;
+      if (!existing.includes("AGENTS.md")) {
+        const pointer = "> This project uses PAPI. The agent harness lives in `AGENTS.md` + `.agents/skills/papi-cycle/`. Read `AGENTS.md` at session start, then run `orient`.\n\n";
+        scaffoldFiles[claudeMdPath] = pointer + existing;
       }
     } catch {
     }
   }
-  const cursorDir = join4(config2.projectRoot, ".cursor");
+  for (const [dest, content] of Object.entries(planBundleInstall(config2.projectRoot, input.projectName, { skipExisting: true }))) {
+    await mkdir(dirname2(dest), { recursive: true });
+    scaffoldFiles[dest] = content;
+  }
+  const cursorDir = join5(config2.projectRoot, ".cursor");
   let cursorDetected = false;
   try {
     await access2(cursorDir);
@@ -18666,8 +18595,8 @@ async function scaffoldPapiDir(adapter2, config2, input) {
   } catch {
   }
   if (cursorDetected) {
-    const cursorRulesDir = join4(cursorDir, "rules");
-    const cursorRulesPath = join4(cursorRulesDir, "papi.mdc");
+    const cursorRulesDir = join5(cursorDir, "rules");
+    const cursorRulesPath = join5(cursorRulesDir, "papi.mdc");
     await mkdir(cursorRulesDir, { recursive: true });
     try {
       await access2(cursorRulesPath);
@@ -18693,7 +18622,7 @@ async function scaffoldPapiDir(adapter2, config2, input) {
 }
 var PAPI_PERMISSION = "mcp__papi__*";
 async function ensurePapiPermission(projectRoot) {
-  const settingsPath = join4(projectRoot, ".claude", "settings.json");
+  const settingsPath = join5(projectRoot, ".claude", "settings.json");
   try {
     let settings = {};
     try {
@@ -18712,7 +18641,7 @@ async function ensurePapiPermission(projectRoot) {
     if (!allow.includes(PAPI_PERMISSION)) {
       allow.push(PAPI_PERMISSION);
     }
-    await mkdir(join4(projectRoot, ".claude"), { recursive: true });
+    await mkdir(join5(projectRoot, ".claude"), { recursive: true });
     await writeFile2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   } catch {
   }
@@ -18720,7 +18649,7 @@ async function ensurePapiPermission(projectRoot) {
 async function applySetupOutputs(adapter2, config2, input, briefText, adSeedText, conventionsText) {
   const warnings = [];
   if (config2.adapterType !== "pg") {
-    await writeFile2(join4(config2.papiDir, "PRODUCT_BRIEF.md"), briefText, "utf-8");
+    await writeFile2(join5(config2.papiDir, "PRODUCT_BRIEF.md"), briefText, "utf-8");
   }
   await adapter2.updateProductBrief(briefText);
   const briefPhases = parsePhases(briefText);
@@ -18785,7 +18714,7 @@ async function applySetupOutputs(adapter2, config2, input, briefText, adSeedText
   }
   if (conventionsText?.trim()) {
     try {
-      const claudeMdPath = join4(config2.projectRoot, "CLAUDE.md");
+      const claudeMdPath = join5(config2.projectRoot, "CLAUDE.md");
       const existing = await readFile4(claudeMdPath, "utf-8");
       await writeFile2(claudeMdPath, existing + "\n" + conventionsText.trim() + "\n", "utf-8");
     } catch {
@@ -18865,13 +18794,13 @@ async function scanCodebase(projectRoot) {
   }
   let packageJson;
   try {
-    const content = await readFile4(join4(projectRoot, "package.json"), "utf-8");
+    const content = await readFile4(join5(projectRoot, "package.json"), "utf-8");
     packageJson = JSON.parse(content);
   } catch {
   }
   let readme;
   for (const name of ["README.md", "readme.md", "README.txt", "README"]) {
-    const content = await safeReadFile(join4(projectRoot, name), 5e3);
+    const content = await safeReadFile(join5(projectRoot, name), 5e3);
     if (content) {
       readme = content;
       break;
@@ -18881,7 +18810,7 @@ async function scanCodebase(projectRoot) {
   let totalFiles = topLevelFiles.length;
   for (const dir of topLevelDirs) {
     try {
-      const entries = await readdir(join4(projectRoot, dir), { withFileTypes: true });
+      const entries = await readdir(join5(projectRoot, dir), { withFileTypes: true });
       const files = entries.filter((e) => e.isFile());
       const extensions = [...new Set(files.map((f) => extname(f.name).toLowerCase()).filter(Boolean))];
       totalFiles += files.length;
@@ -19145,7 +19074,7 @@ async function applySetup(adapter2, config2, input, briefText, adSeedText, conve
     }
   }
   try {
-    const claudeMdPath = join4(config2.projectRoot, "CLAUDE.md");
+    const claudeMdPath = join5(config2.projectRoot, "CLAUDE.md");
     const existing = await readFile4(claudeMdPath, "utf-8");
     if (!existing.includes("Dogfood Logging")) {
       const dogfoodSection = [
@@ -19190,7 +19119,7 @@ async function applySetup(adapter2, config2, input, briefText, adSeedText, conve
   const gitignoreNote = await ensureMcpJsonGitignored(config2.projectRoot);
   let cursorScaffolded = false;
   try {
-    await access2(join4(config2.projectRoot, ".cursor", "rules", "papi.mdc"));
+    await access2(join5(config2.projectRoot, ".cursor", "rules", "papi.mdc"));
     cursorScaffolded = true;
   } catch {
   }
@@ -19208,11 +19137,11 @@ async function applySetup(adapter2, config2, input, briefText, adSeedText, conve
 }
 async function ensureMcpJsonGitignored(projectRoot) {
   try {
-    await access2(join4(projectRoot, ".git"));
+    await access2(join5(projectRoot, ".git"));
   } catch {
     return void 0;
   }
-  const gitignorePath = join4(projectRoot, ".gitignore");
+  const gitignorePath = join5(projectRoot, ".gitignore");
   let existing = "";
   try {
     existing = await readFile4(gitignorePath, "utf-8");
@@ -19551,8 +19480,8 @@ init_dist2();
 init_git();
 init_git();
 import { randomUUID as randomUUID9 } from "crypto";
-import { readdirSync as readdirSync3, existsSync as existsSync3, readFileSync, writeFileSync, unlinkSync, mkdirSync } from "fs";
-import { join as join5 } from "path";
+import { readdirSync as readdirSync4, existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync, unlinkSync, mkdirSync } from "fs";
+import { join as join6 } from "path";
 var buildStartTimes = /* @__PURE__ */ new Map();
 var taskBranchMap = /* @__PURE__ */ new Map();
 var taskStartShaMap = /* @__PURE__ */ new Map();
@@ -19953,17 +19882,17 @@ async function startBuild(adapter2, config2, taskId, options = {}) {
   return { task, branchLines, phaseChanges };
 }
 function writeActiveTaskScope(projectRoot, taskId, filesLikelyTouched) {
-  const papiDir = join5(projectRoot, ".papi");
-  if (!existsSync3(papiDir)) {
+  const papiDir = join6(projectRoot, ".papi");
+  if (!existsSync4(papiDir)) {
     mkdirSync(papiDir, { recursive: true });
   }
-  const scopePath = join5(papiDir, "active-task-scope.txt");
+  const scopePath = join6(papiDir, "active-task-scope.txt");
   const lines = [taskId, ...filesLikelyTouched ?? []];
   writeFileSync(scopePath, lines.join("\n") + "\n", "utf-8");
 }
 function clearActiveTaskScope(projectRoot) {
-  const scopePath = join5(projectRoot, ".papi", "active-task-scope.txt");
-  if (existsSync3(scopePath)) {
+  const scopePath = join6(projectRoot, ".papi", "active-task-scope.txt");
+  if (existsSync4(scopePath)) {
     unlinkSync(scopePath);
   }
 }
@@ -19977,7 +19906,7 @@ function extractDocMeta(absolutePath, relativePath, cycleNumber) {
   else if (relativePath.startsWith("docs/architecture/")) type = "architecture";
   else if (relativePath.startsWith("docs/audits/")) type = "audit";
   try {
-    const content = readFileSync(absolutePath, "utf-8").slice(0, 2e3);
+    const content = readFileSync2(absolutePath, "utf-8").slice(0, 2e3);
     const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
     if (fmMatch) {
       const fm = fmMatch[1];
@@ -20283,14 +20212,14 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}) {
   let docWarning;
   try {
     if (adapter2.searchDocs) {
-      const docsDir = join5(config2.projectRoot, "docs");
-      if (existsSync3(docsDir)) {
+      const docsDir = join6(config2.projectRoot, "docs");
+      if (existsSync4(docsDir)) {
         const scanDir = (dir, depth = 0) => {
           if (depth > 8) return [];
-          const entries = readdirSync3(dir, { withFileTypes: true });
+          const entries = readdirSync4(dir, { withFileTypes: true });
           const files = [];
           for (const e of entries) {
-            const full = join5(dir, e.name);
+            const full = join6(dir, e.name);
             if (e.isDirectory() && !e.isSymbolicLink()) files.push(...scanDir(full, depth + 1));
             else if (e.name.endsWith(".md")) files.push(full.replace(config2.projectRoot + "/", ""));
           }
@@ -20305,7 +20234,7 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}) {
           const failed = [];
           for (const docPath of unregistered) {
             try {
-              const meta = extractDocMeta(join5(config2.projectRoot, docPath), docPath, cycleNumber);
+              const meta = extractDocMeta(join6(config2.projectRoot, docPath), docPath, cycleNumber);
               await adapter2.registerDoc({
                 title: meta.title,
                 type: meta.type,
@@ -21938,12 +21867,12 @@ _To correct: board_edit ${result.task.id} with updated fields._`
 init_git();
 
 // src/services/reconcile.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join7 } from "path";
 function loadDocsIndex(projectRoot) {
   try {
-    const indexPath = join6(projectRoot, "docs", "INDEX.md");
-    const raw = readFileSync2(indexPath, "utf8");
+    const indexPath = join7(projectRoot, "docs", "INDEX.md");
+    const raw = readFileSync3(indexPath, "utf8");
     const rows = raw.split("\n").filter((l) => l.startsWith("| ["));
     if (rows.length === 0) return "";
     const entries = rows.map((row) => {
@@ -22519,16 +22448,16 @@ Produce your analysis and structured output above. Present Part 1 to the user an
 
 // src/services/release.ts
 import { writeFile as writeFile3, readFile as readFile5 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { execFileSync as execFileSync4 } from "child_process";
 
 // src/lib/install-id.ts
 import { randomUUID as randomUUID13 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, chmodSync } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, chmodSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
-var PAPI_HOME_DIR = join7(homedir2(), ".papi");
-var INSTALL_ID_FILE = join7(PAPI_HOME_DIR, "install-id.json");
+import { join as join8 } from "path";
+var PAPI_HOME_DIR = join8(homedir2(), ".papi");
+var INSTALL_ID_FILE = join8(PAPI_HOME_DIR, "install-id.json");
 var cachedInstallId = null;
 function isValidUuid(s) {
   return typeof s === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);
@@ -22536,7 +22465,7 @@ function isValidUuid(s) {
 function getInstallId() {
   if (cachedInstallId) return cachedInstallId;
   try {
-    const raw = readFileSync3(INSTALL_ID_FILE, "utf-8");
+    const raw = readFileSync4(INSTALL_ID_FILE, "utf-8");
     const parsed = JSON.parse(raw);
     if (isValidUuid(parsed.install_id)) {
       cachedInstallId = parsed.install_id;
@@ -22912,7 +22841,7 @@ To override, pass force=true (emits a telemetry warning).`
     throw new Error(`tag "${version}" already exists. Use a different version.`);
   }
   const latestTag = getLatestTag(config2.projectRoot);
-  const changelogPath = join8(config2.projectRoot, "CHANGELOG.md");
+  const changelogPath = join9(config2.projectRoot, "CHANGELOG.md");
   if (!latestTag) {
     const initialContent = INITIAL_RELEASE_NOTES.replace("v0.1.0-alpha", version);
     await writeFile3(changelogPath, initialContent, "utf-8");
@@ -23092,8 +23021,8 @@ async function handleRelease(adapter2, config2, args) {
 }
 
 // src/tools/review.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join10 } from "path";
 init_git();
 
 // src/services/review.ts
@@ -23312,6 +23241,57 @@ async function buildSessionGuidance() {
 }
 
 // src/tools/review.ts
+var REVIEW_DISPATCH_THRESHOLD = 50 * 1024;
+var REVIEW_RUBRIC = [
+  "You are reviewing a completed PAPI build for acceptance. Judge:",
+  "- Correctness: does the change do what the build report claims, without obvious bugs?",
+  "- Scope adherence: does the diff match the BUILD HANDOFF scope (no unrelated changes, no skipped acceptance criteria)?",
+  "- Security: any auth/data/secret/injection risk introduced?",
+  "- Quality: tests present and meaningful, no obvious debt or dead code.",
+  "Be specific and cite file/line where you can. Recommend fail only for blocking issues."
+].join("\n");
+async function buildReviewDispatch(adapter2, config2, taskId) {
+  const task = await adapter2.getTask(taskId);
+  if (!task) {
+    return { ok: false, error: `Task ${taskId} not found \u2014 cannot assemble review context.` };
+  }
+  const handoff = task.buildHandoff ? `### BUILD HANDOFF (scope to check against)
+${JSON.stringify(task.buildHandoff, null, 2)}` : "### BUILD HANDOFF\n(none recorded)";
+  const report = task.buildReport ? `### Build Report
+${task.buildReport}` : "### Build Report\n(none recorded)";
+  const diff = getBranchDiff(config2.projectRoot);
+  const diffBlock = diff ? `### Branch diff vs base
+\`\`\`diff
+${diff}
+\`\`\`` : "### Branch diff vs base\n(no diff resolved \u2014 not a git repo, no base ref, or no committed changes)";
+  let projectContext = "";
+  const ctxPath = join10(config2.projectRoot, ".agents", "papi-context.md");
+  if (existsSync5(ctxPath)) {
+    try {
+      projectContext = `### Project context (.agents/papi-context.md)
+${readFileSync5(ctxPath, "utf-8")}
+
+`;
+    } catch {
+    }
+  }
+  const userMessage = `## Task ${task.id}: ${task.title}
+
+${projectContext}${handoff}
+
+${report}
+
+${diffBlock}`;
+  const contextBytes = Buffer.byteLength(userMessage, "utf-8");
+  const prompt2 = buildSubagentDispatchPrompt({
+    tool: "review_submit",
+    taskId,
+    systemPrompt: REVIEW_RUBRIC,
+    userMessage,
+    contextBytes
+  });
+  return { ok: true, prompt: prompt2, contextBytes };
+}
 var reviewListTool = {
   name: "review_list",
   description: "List tasks ready for your sign-off \u2014 shows completed builds waiting for approval or feedback. Does not call the Anthropic API.",
@@ -23356,6 +23336,11 @@ var reviewSubmitTool = {
         type: "string",
         description: 'Reviewer name (default: "human").'
       },
+      dispatch: {
+        type: "string",
+        enum: ["inline", "subagent"],
+        description: `task-1864: set "subagent" (build-acceptance only) to offload code review to a fresh sub-agent. Returns a Task() invocation prompt that feeds the build report + branch diff to the sub-agent, which returns structured auto_review findings. Verdict is NOT required on this call \u2014 you call review_submit again with the human verdict + the sub-agent's auto_review. Default "inline" (record the verdict directly).`
+      },
       reviewer_confirmed: {
         type: "boolean",
         description: "Set to true to confirm you have reviewed the build (read the build report or the pending list via review_list) before submitting an accept verdict. Required to accept a build-acceptance review unless review_list was called in the same session within the last 15 minutes. Defense-in-depth against SUP-2026-010 (Codex prematurely accepted a task because review_list was missing from its tool surface)."
@@ -23434,8 +23419,8 @@ function mergeAfterAccept(config2, taskId) {
     };
   }
   const details = [];
-  const papiDir = join9(config2.projectRoot, ".papi");
-  if (existsSync4(papiDir)) {
+  const papiDir = join10(config2.projectRoot, ".papi");
+  if (existsSync5(papiDir)) {
     try {
       const commitResult = stageDirAndCommit(
         config2.projectRoot,
@@ -23553,6 +23538,19 @@ async function handleReviewSubmit(adapter2, config2, args) {
   if (!stage) {
     return errorResponse('stage is required. Use "handoff-review" or "build-acceptance".');
   }
+  const explicitDispatch = args.dispatch === "subagent";
+  const autoDispatchEligible = !verdict && args.dispatch !== "inline" && process.env.PAPI_AUTO_DISPATCH !== "false";
+  if ((explicitDispatch || autoDispatchEligible) && stage === "build-acceptance" && taskId) {
+    const dispatch = await buildReviewDispatch(adapter2, config2, taskId);
+    if (!dispatch.ok) {
+      if (explicitDispatch) return errorResponse(dispatch.error);
+    } else if (explicitDispatch || dispatch.contextBytes > REVIEW_DISPATCH_THRESHOLD) {
+      return textResponse(dispatch.prompt);
+    }
+  }
+  if (explicitDispatch && stage !== "build-acceptance") {
+    return errorResponse('dispatch:"subagent" is only supported for stage "build-acceptance".');
+  }
   if (!verdict) {
     return errorResponse('verdict is required. Use "approve", "accept", "request-changes", or "reject".');
   }
@@ -24567,13 +24565,13 @@ function formatUnblockSection(candidates) {
 }
 
 // src/lib/skill-detection.ts
-import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync5, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { join as join11 } from "path";
 function readPackageJson(projectRoot) {
-  const path7 = join10(projectRoot, "package.json");
-  if (!existsSync5(path7)) return null;
+  const path7 = join11(projectRoot, "package.json");
+  if (!existsSync6(path7)) return null;
   try {
-    const raw = readFileSync4(path7, "utf-8");
+    const raw = readFileSync6(path7, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -24590,31 +24588,31 @@ function hasDependencyMatching(deps, pattern) {
   return false;
 }
 function hasGitHubWorkflows(projectRoot) {
-  const dir = join10(projectRoot, ".github", "workflows");
-  if (!existsSync5(dir)) return false;
+  const dir = join11(projectRoot, ".github", "workflows");
+  if (!existsSync6(dir)) return false;
   try {
-    const entries = readdirSync4(dir);
+    const entries = readdirSync5(dir);
     return entries.some((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
   } catch {
     return false;
   }
 }
 function envExampleMentionsStaging(projectRoot) {
-  const path7 = join10(projectRoot, ".env.example");
-  if (!existsSync5(path7)) return false;
+  const path7 = join11(projectRoot, ".env.example");
+  if (!existsSync6(path7)) return false;
   try {
-    const raw = readFileSync4(path7, "utf-8");
+    const raw = readFileSync6(path7, "utf-8");
     return /\b(STAGING_URL|STAGING_API|STAGING_HOST|NEXT_PUBLIC_STAGING)/i.test(raw);
   } catch {
     return false;
   }
 }
 function hasVercelConfig(projectRoot) {
-  if (existsSync5(join10(projectRoot, "vercel.json"))) return true;
-  const vercelDir = join10(projectRoot, ".vercel");
-  if (!existsSync5(vercelDir)) return false;
+  if (existsSync6(join11(projectRoot, "vercel.json"))) return true;
+  const vercelDir = join11(projectRoot, ".vercel");
+  if (!existsSync6(vercelDir)) return false;
   try {
-    return statSync3(vercelDir).isDirectory();
+    return statSync4(vercelDir).isDirectory();
   } catch {
     return false;
   }
@@ -24672,9 +24670,82 @@ function formatSkillProposals(proposals) {
   return "\n" + lines.join("\n");
 }
 
+// src/tools/agent-list.ts
+import { readdir as readdir2, readFile as readFile7 } from "fs/promises";
+import { join as join12 } from "path";
+var NO_AGENTS_HINT = "No project sub-agents found in `.claude/agents/`. Add a `*.md` file with `name` + `description` frontmatter \u2014 see the 1926-Census marketing sub-agent for a reference implementation.";
+function parseAgentFrontmatter(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return null;
+  const fm = match[1];
+  const nameMatch = fm.match(/^name:\s*(.+)$/m);
+  const descMatch = fm.match(/^description:\s*[>|]?\n?([\s\S]*?)(?=\n\w|\n---|$)/m);
+  const description = descMatch ? descMatch[1].replace(/^\s{2}/gm, "").replace(/\n+$/, "").replace(/\n/g, " ").trim() : "";
+  return { name: nameMatch?.[1].trim(), description };
+}
+async function listAgents(projectRoot) {
+  const agentsDir = join12(projectRoot, ".claude", "agents");
+  let files;
+  try {
+    files = await readdir2(agentsDir);
+  } catch {
+    return [];
+  }
+  const agents = [];
+  for (const file of files.filter((f) => f.endsWith(".md"))) {
+    let content;
+    try {
+      content = await readFile7(join12(agentsDir, file), "utf-8");
+    } catch {
+      continue;
+    }
+    const meta = parseAgentFrontmatter(content);
+    agents.push({
+      name: meta?.name ?? file.replace(/\.md$/, ""),
+      description: meta?.description ?? "",
+      path: join12(".claude", "agents", file)
+    });
+  }
+  agents.sort((a, b2) => a.name.localeCompare(b2.name));
+  return agents;
+}
+var agentListTool = {
+  name: "agent_list",
+  description: "List the sub-agents discovered in the project's `.claude/agents/*.md` files (read-only). Returns each agent's name and description so you can see which specialised sub-agents are available before dispatching one via the Task/Agent tool. Discovery only \u2014 does not invoke or manage agents.",
+  annotations: { readOnlyHint: true, destructiveHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      include_path: {
+        type: "boolean",
+        description: "Include each agent's project-relative file path in the output. Default false."
+      }
+    },
+    required: []
+  }
+};
+async function handleAgentList(config2, args) {
+  const includePath = args.include_path === true;
+  const agents = await listAgents(config2.projectRoot);
+  if (agents.length === 0) {
+    return textResponse(`# Sub-agents
+
+${NO_AGENTS_HINT}`);
+  }
+  const formatted = agents.map((a) => {
+    const desc = a.description ? ` \u2014 ${a.description}` : "";
+    const pathSuffix = includePath ? `
+  \`${a.path}\`` : "";
+    return `- **${a.name}**${desc}${pathSuffix}`;
+  }).join("\n");
+  return textResponse(`# Sub-agents (${agents.length})
+
+${formatted}`);
+}
+
 // src/tools/doc-registry.ts
-import { readdirSync as readdirSync5, existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { join as join11, relative } from "path";
+import { readdirSync as readdirSync6, existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { join as join13, relative } from "path";
 import { homedir as homedir3 } from "os";
 import { randomUUID as randomUUID16 } from "crypto";
 var docRegisterTool = {
@@ -24819,12 +24890,12 @@ ${d.summary}
 ${lines.join("\n---\n\n")}`);
 }
 function scanMdFiles(dir, rootDir) {
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   const files = [];
   try {
-    const entries = readdirSync5(dir, { withFileTypes: true });
+    const entries = readdirSync6(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join11(dir, entry.name);
+      const full = join13(dir, entry.name);
       if (entry.isDirectory()) {
         files.push(...scanMdFiles(full, rootDir));
       } else if (entry.name.endsWith(".md")) {
@@ -24837,7 +24908,7 @@ function scanMdFiles(dir, rootDir) {
 }
 function extractTitle(filePath) {
   try {
-    const content = readFileSync5(filePath, "utf-8").slice(0, 1e3);
+    const content = readFileSync7(filePath, "utf-8").slice(0, 1e3);
     const fmMatch = content.match(/^---[\s\S]*?title:\s*(.+?)$/m);
     if (fmMatch) return fmMatch[1].trim().replace(/^["']|["']$/g, "");
     const headingMatch = content.match(/^#+\s+(.+)$/m);
@@ -24853,17 +24924,17 @@ async function handleDocScan(adapter2, config2, args) {
   const includePlans = args.include_plans ?? false;
   const registered = await adapter2.searchDocs({ limit: 500, status: "all" });
   const registeredPaths = new Set(registered.map((d) => d.path));
-  const docsDir = join11(config2.projectRoot, "docs");
+  const docsDir = join13(config2.projectRoot, "docs");
   const docsFiles = scanMdFiles(docsDir, config2.projectRoot);
   const unregisteredDocs = docsFiles.filter((f) => !registeredPaths.has(f));
   let unregisteredPlans = [];
   if (includePlans) {
-    const plansDir = join11(homedir3(), ".claude", "plans");
-    if (existsSync6(plansDir)) {
+    const plansDir = join13(homedir3(), ".claude", "plans");
+    if (existsSync7(plansDir)) {
       const planFiles = scanMdFiles(plansDir, plansDir);
       unregisteredPlans = planFiles.map((f) => `plans/${f}`).filter((f) => !registeredPaths.has(f)).map((f) => ({
         path: f,
-        title: extractTitle(join11(plansDir, f.replace("plans/", "")))
+        title: extractTitle(join13(plansDir, f.replace("plans/", "")))
       }));
     }
   }
@@ -24874,7 +24945,7 @@ async function handleDocScan(adapter2, config2, args) {
   if (unregisteredDocs.length > 0) {
     lines.push(`## Unregistered Docs (${unregisteredDocs.length})`);
     for (const f of unregisteredDocs) {
-      const title = extractTitle(join11(config2.projectRoot, f));
+      const title = extractTitle(join13(config2.projectRoot, f));
       lines.push(`- \`${f}\`${title ? ` \u2014 ${title}` : ""}`);
     }
   }
@@ -25038,8 +25109,8 @@ function dedupeEnrichmentBlob(existing, blob) {
 // src/tools/orient.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync3, existsSync as existsSync8 } from "fs";
+import { join as join14 } from "path";
 var execFileAsync = promisify(execFile);
 var GIT_DEPENDENT_ENVS = /* @__PURE__ */ new Set(["hosted", "api"]);
 var VALID_ENVS = /* @__PURE__ */ new Set(["local-cli", "hosted", "api", "unknown"]);
@@ -25102,7 +25173,7 @@ var orientTool = {
     required: []
   }
 };
-function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoot, environment = "unknown") {
+function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoot, environment = "unknown", subAgents = []) {
   const lines = [];
   const cycleIsComplete = health.latestCycleStatus === "complete";
   const tagSuffix = latestTag ? ` \u2014 ${latestTag}` : "";
@@ -25159,6 +25230,16 @@ function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoo
   lines.push("## Board");
   lines.push(health.boardSummary);
   lines.push("");
+  if (subAgents.length > 0) {
+    lines.push(`**Sub-agents (${subAgents.length}):** ` + subAgents.map((a) => {
+      const desc = a.description ? ` (${a.description.slice(0, 60)})` : "";
+      return `\`${a.name}\`${desc}`;
+    }).join(", "));
+    lines.push("");
+  } else {
+    lines.push(`_${NO_AGENTS_HINT}_`);
+    lines.push("");
+  }
   if (buildInfo.cycleTasks.total > 0) {
     const parts = [];
     if (buildInfo.cycleTasks.inProgress > 0) parts.push(`${buildInfo.cycleTasks.inProgress} in progress`);
@@ -25281,8 +25362,8 @@ async function getLatestGitTag(projectRoot) {
 }
 async function checkNpmVersionDrift() {
   try {
-    const pkgPath = join12(new URL(".", import.meta.url).pathname, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
+    const pkgPath = join14(new URL(".", import.meta.url).pathname, "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
     const localVersion = pkg.version;
     const packageName = pkg.name;
     const { stdout } = await execFileAsync("npm", ["view", packageName, "version"], {
@@ -25570,8 +25651,9 @@ async function handleOrient(adapter2, config2, args = {}) {
         return "\n\n> **Early-cycle tip:** No delivery-shape AD found. Consider whether this project is a *service* (manual delivery, human-in-the-loop) or a *platform* (self-serve). The distinction shapes task priorities. Log it with `idea` to mint an AD.";
       }),
       // task-1652: deep housekeeping — opt-in sweep (board, unrecorded commits, unregistered docs)
+      // task-1865: also detects stale skill forks vs the @papi-ai/skills registry.
       tracked("deep-housekeeping", async () => {
-        if (!deepHousekeeping) return { reconciliationNote: "", unrecordedNote: "", unregisteredDocsNote: "" };
+        if (!deepHousekeeping) return { reconciliationNote: "", unrecordedNote: "", unregisteredDocsNote: "", staleSkillsNote: "" };
         let reconciliationNote2 = "";
         try {
           const mismatches = detectBoardMismatches(config2.projectRoot, allTasks);
@@ -25607,7 +25689,7 @@ async function handleOrient(adapter2, config2, args = {}) {
         let unregisteredDocsNote2 = "";
         try {
           if (adapter2.searchDocs) {
-            const docsDir = join12(config2.projectRoot, "docs");
+            const docsDir = join14(config2.projectRoot, "docs");
             const docsFiles = scanMdFiles(docsDir, config2.projectRoot);
             if (docsFiles.length > 0) {
               const registered = await adapter2.searchDocs({ limit: 500, status: "all" });
@@ -25619,7 +25701,22 @@ async function handleOrient(adapter2, config2, args = {}) {
           }
         } catch {
         }
-        return { reconciliationNote: reconciliationNote2, unrecordedNote: unrecordedNote2, unregisteredDocsNote: unregisteredDocsNote2 };
+        let staleSkillsNote2 = "";
+        try {
+          const { detectStaleForks, loadManifest } = await import("@papi-ai/skills/manifest");
+          const stale = detectStaleForks(config2.projectRoot);
+          if (stale.length > 0) {
+            const version = loadManifest().packageVersion;
+            const lines = [`
+
+## Stale Skill Forks (${stale.length})`];
+            lines.push(`These skills differ from the pinned \`@papi-ai/skills@${version}\` registry. Re-run \`npx @papi-ai/skills install .\` to refresh, or move a skill to \`.claude/skills.local/\` to keep your fork. Replacement is offered, never forced.`);
+            for (const f of stale) lines.push(`- \u26A0\uFE0F **${f.name}** \u2014 local copy diverged from registry`);
+            staleSkillsNote2 = lines.join("\n");
+          }
+        } catch {
+        }
+        return { reconciliationNote: reconciliationNote2, unrecordedNote: unrecordedNote2, unregisteredDocsNote: unregisteredDocsNote2, staleSkillsNote: staleSkillsNote2 };
       })
     ]);
     const proxyWarning = proxyVersionOutcome.status === "fulfilled" ? proxyVersionOutcome.value : void 0;
@@ -25640,7 +25737,7 @@ ${versionDrift}` : "";
     const projectBannerNote = projectBannerOutcome.status === "fulfilled" ? projectBannerOutcome.value : "";
     const sessionGuidanceNote = sessionGuidanceOutcome.status === "fulfilled" ? sessionGuidanceOutcome.value : "";
     const deliveryShapeNote = deliveryShapeOutcome.status === "fulfilled" ? deliveryShapeOutcome.value : "";
-    const { reconciliationNote, unrecordedNote, unregisteredDocsNote } = deepHousekeepingOutcome.status === "fulfilled" ? deepHousekeepingOutcome.value : { reconciliationNote: "", unrecordedNote: "", unregisteredDocsNote: "" };
+    const { reconciliationNote, unrecordedNote, unregisteredDocsNote, staleSkillsNote } = deepHousekeepingOutcome.status === "fulfilled" ? deepHousekeepingOutcome.value : { reconciliationNote: "", unrecordedNote: "", unregisteredDocsNote: "", staleSkillsNote: "" };
     let enrichmentNote = "";
     try {
       enrichmentNote = enrichClaudeMd(config2.projectRoot, healthResult.cycleNumber);
@@ -25679,8 +25776,9 @@ ${section}`;
     } catch {
     }
     tracker.mark("format-summary");
-    const deepHint = deepHousekeeping ? "" : "\n\n*Tip: pass `deep_housekeeping: true` to also check orphaned branches, unrecorded commits, and unregistered docs.*";
-    return textResponse(projectBannerNote + formatOrientSummary(healthResult, buildInfo, hierarchy, latestTag, config2.projectRoot, environment) + unblockNote + alertsNote + ttfvNote + reconciliationNote + unrecordedNote + unregisteredDocsNote + researchSignalsNote + recsNote + pendingReviewNote + patternsNote + unactionedIssuesNote + skillProposalsNote + sessionGuidanceNote + versionNote + enrichmentNote + deliveryShapeNote + preBuildCheckNote + deepHint);
+    const subAgents = await listAgents(config2.projectRoot);
+    const deepHint = deepHousekeeping ? "" : "\n\n*Tip: pass `deep_housekeeping: true` to also check orphaned branches, unrecorded commits, unregistered docs, and stale skill forks.*";
+    return textResponse(projectBannerNote + formatOrientSummary(healthResult, buildInfo, hierarchy, latestTag, config2.projectRoot, environment, subAgents) + unblockNote + alertsNote + ttfvNote + reconciliationNote + unrecordedNote + unregisteredDocsNote + staleSkillsNote + researchSignalsNote + recsNote + pendingReviewNote + patternsNote + unactionedIssuesNote + skillProposalsNote + sessionGuidanceNote + versionNote + enrichmentNote + deliveryShapeNote + preBuildCheckNote + deepHint);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     const isKnownFriendly = /^(Orient failed|Project not found|No project|Setup required)/i.test(message);
@@ -25698,9 +25796,9 @@ ${section}`;
   }
 }
 function enrichClaudeMd(projectRoot, cycleNumber) {
-  const claudeMdPath = join12(projectRoot, "CLAUDE.md");
-  if (!existsSync7(claudeMdPath)) return "";
-  const content = readFileSync6(claudeMdPath, "utf-8");
+  const claudeMdPath = join14(projectRoot, "CLAUDE.md");
+  if (!existsSync8(claudeMdPath)) return "";
+  const content = readFileSync8(claudeMdPath, "utf-8");
   const additions = [];
   if (cycleNumber >= 6 && !content.includes(CLAUDE_MD_ENRICHMENT_SENTINEL_T1)) {
     additions.push(dedupeEnrichmentBlob(content, CLAUDE_MD_TIER_1));
@@ -26386,7 +26484,7 @@ ${result.userMessage}
 
 // src/services/scope-brief.ts
 import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync3 } from "fs";
-import { join as join13, dirname } from "path";
+import { join as join15, dirname as dirname3 } from "path";
 import Anthropic from "@anthropic-ai/sdk";
 var SCOPE_BRIEF_SYSTEM = `You are a technical scoping tool. You receive a brief-class task (too large to build directly) and decompose it into a structured scope document.
 
@@ -26441,8 +26539,8 @@ async function runScopeBrief(adapter2, input) {
   }
   const slug = input.taskId.replace(/[^a-z0-9-]/g, "-").toLowerCase();
   const relPath = `docs/scopes/${slug}.md`;
-  const absPath = join13(input.projectRoot, relPath);
-  mkdirSync3(dirname(absPath), { recursive: true });
+  const absPath = join15(input.projectRoot, relPath);
+  mkdirSync3(dirname3(absPath), { recursive: true });
   writeFileSync4(absPath, addFrontmatter(docContent, task, input.cycleNumber), "utf-8");
   const taskCount = countSubTasks(docContent);
   const summary = buildSummary(task, taskCount);
@@ -26818,6 +26916,166 @@ Update PAPI_PROJECT_ID (local) or x-papi-project-id (remote) to \`${result.proje
   );
 }
 
+// src/services/harness-inventory.ts
+import { readdir as readdir3, readFile as readFile8, stat as stat3 } from "fs/promises";
+import { join as join16 } from "path";
+import { createHash as createHash3 } from "crypto";
+var RECOMMENDED_HOOKS = ["stop-release-check.sh", "claude-md-size-guard.sh"];
+async function computeFingerprint(root) {
+  const parts = [];
+  for (const sub of [".claude/skills", ".claude/agents", ".claude/hooks"]) {
+    const dir = join16(root, sub);
+    try {
+      const names = (await readdir3(dir)).sort((a, b2) => a.localeCompare(b2));
+      for (const name of names) {
+        let mtime = "";
+        try {
+          mtime = String(Math.floor((await stat3(join16(dir, name))).mtimeMs));
+        } catch {
+        }
+        parts.push(`${sub}/${name}:${mtime}`);
+      }
+    } catch {
+      parts.push(`${sub}:absent`);
+    }
+  }
+  try {
+    const { loadManifest } = await import("@papi-ai/skills/manifest");
+    parts.push(`manifest:${loadManifest().packageVersion}`);
+  } catch {
+    parts.push("manifest:none");
+  }
+  return createHash3("sha256").update(parts.join("|")).digest("hex").slice(0, 16);
+}
+async function readSkillDescription(skillDir) {
+  try {
+    const content = await readFile8(join16(skillDir, "SKILL.md"), "utf-8");
+    const fm = content.match(/^---\n([\s\S]*?)\n---/);
+    if (!fm) return void 0;
+    const desc = fm[1].match(/^description:\s*[>|]?\s*\n?([\s\S]*?)(?=\n\w+:|\n---|$)/m);
+    if (!desc) return void 0;
+    return desc[1].replace(/^\s+/gm, "").replace(/\n+/g, " ").trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function scanInventory(root, toolDefs) {
+  const entries = [];
+  const stale = /* @__PURE__ */ new Set();
+  let version;
+  try {
+    const { detectStaleForks, loadManifest } = await import("@papi-ai/skills/manifest");
+    for (const fork of detectStaleForks(root)) stale.add(fork.name);
+    version = loadManifest().packageVersion;
+  } catch {
+  }
+  const skillsDir = join16(root, ".claude", "skills");
+  try {
+    const dirents = await readdir3(skillsDir, { withFileTypes: true });
+    for (const d of dirents.filter((e) => e.isDirectory())) {
+      entries.push({
+        kind: "skill",
+        name: d.name,
+        description: await readSkillDescription(join16(skillsDir, d.name)),
+        version,
+        status: stale.has(d.name) ? "stale_fork" : "ok",
+        path: join16(".claude", "skills", d.name)
+      });
+    }
+  } catch {
+  }
+  for (const a of await listAgents(root)) {
+    entries.push({
+      kind: "agent",
+      name: a.name,
+      description: a.description || void 0,
+      status: "ok",
+      path: a.path
+    });
+  }
+  const present = /* @__PURE__ */ new Set();
+  try {
+    for (const f of (await readdir3(join16(root, ".claude", "hooks"))).filter((n) => n.endsWith(".sh"))) {
+      present.add(f);
+      entries.push({ kind: "hook", name: f, status: "ok", path: join16(".claude", "hooks", f) });
+    }
+  } catch {
+  }
+  for (const rec of RECOMMENDED_HOOKS) {
+    if (!present.has(rec)) {
+      entries.push({ kind: "hook", name: rec, description: "Recommended hook \u2014 not installed", status: "missing" });
+    }
+  }
+  for (const t of toolDefs ?? []) {
+    entries.push({ kind: "mcp_tool", name: t.name, description: t.description, status: "ok" });
+  }
+  return entries;
+}
+async function syncHarnessInventory(adapter2, config2, opts) {
+  if (!adapter2.getHarnessState || !adapter2.setHarnessState || !adapter2.replaceHarnessInventory) {
+    return { changed: false, skipped: true };
+  }
+  const fingerprint = await computeFingerprint(config2.projectRoot);
+  if (!opts?.force) {
+    const state2 = await adapter2.getHarnessState();
+    if (state2 && state2.fingerprint === fingerprint) return { changed: false };
+  }
+  const entries = await scanInventory(config2.projectRoot, opts?.toolDefs);
+  await adapter2.replaceHarnessInventory(entries);
+  await adapter2.setHarnessState(fingerprint);
+  const counts = { skill: 0, agent: 0, hook: 0, mcp_tool: 0 };
+  let staleForks = 0;
+  let missingHooks = 0;
+  for (const e of entries) {
+    counts[e.kind]++;
+    if (e.status === "stale_fork") staleForks++;
+    if (e.status === "missing") missingHooks++;
+  }
+  return { changed: true, counts, staleForks, missingHooks };
+}
+
+// src/tools/inventory-sync.ts
+var inventorySyncTool = {
+  name: "inventory_sync",
+  description: "Sync this project's harness inventory \u2014 skills, sub-agents, hooks, and MCP tools \u2014 to the database so the dashboard can surface it. Gated by a cheap change-fingerprint: a no-op when the harness hasn't changed since the last sync. Set force=true to re-scan and write regardless. Runs automatically at setup and release; use this for an explicit refresh after editing your harness.",
+  annotations: { readOnlyHint: false, destructiveHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      force: {
+        type: "boolean",
+        description: "Re-scan and write even if the change-fingerprint is unchanged. Default false."
+      }
+    },
+    required: []
+  }
+};
+async function handleInventorySync(adapter2, config2, args, toolDefs) {
+  const force = args.force === true;
+  const result = await syncHarnessInventory(adapter2, config2, { force, toolDefs });
+  if (result.skipped) {
+    return textResponse(
+      "# Harness inventory\n\nNo database adapter available \u2014 harness inventory is only persisted when running against the hosted database (pg/proxy adapter). Nothing to sync."
+    );
+  }
+  if (!result.changed) {
+    return textResponse(
+      "# Harness inventory\n\n\u2713 Already up to date \u2014 the harness has not changed since the last sync (no write needed)."
+    );
+  }
+  const c = result.counts;
+  const lines = [
+    "# Harness inventory synced",
+    "",
+    `Wrote **${c.skill}** skills, **${c.agent}** sub-agents, **${c.hook}** hooks, **${c.mcp_tool}** MCP tools to the dashboard.`
+  ];
+  if (result.staleForks) lines.push(`
+\u26A0\uFE0F **${result.staleForks}** skill(s) flagged as stale forks (drifted from the pinned registry).`);
+  if (result.missingHooks) lines.push(`
+\u26A0\uFE0F **${result.missingHooks}** recommended hook(s) not installed.`);
+  return textResponse(lines.join("\n"));
+}
+
 // src/server.ts
 var DEFAULT_TOOL_TIMEOUT_MS = parseInt(process.env.PAPI_TOOL_TIMEOUT_MS ?? "30000", 10);
 var LONG_TOOL_TIMEOUT_MS = parseInt(process.env.PAPI_LONG_TOOL_TIMEOUT_MS ?? "180000", 10);
@@ -26925,14 +27183,19 @@ var PAPI_TOOLS = [
   learningActionTool,
   projectCreateTool,
   projectListTool,
-  projectSwitchTool
+  projectSwitchTool,
+  agentListTool,
+  inventorySyncTool
 ];
+function getToolMetadata() {
+  return PAPI_TOOLS.map((t) => ({ name: t.name, description: t.description }));
+}
 function createServer(adapter2, config2) {
-  const __pkgFilename = fileURLToPath(import.meta.url);
-  const __pkgDir = dirname2(__pkgFilename);
+  const __pkgFilename = fileURLToPath2(import.meta.url);
+  const __pkgDir = dirname4(__pkgFilename);
   let serverVersion = "unknown";
   try {
-    const pkg = JSON.parse(readFileSync7(join14(__pkgDir, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(join17(__pkgDir, "..", "package.json"), "utf-8"));
     serverVersion = pkg.version ?? "unknown";
   } catch {
   }
@@ -26945,9 +27208,9 @@ function createServer(adapter2, config2) {
       "\n\u26A0 PAPI is running in md mode \u2014 your cycles are not visible on the hosted dashboard.\n  Configure DATABASE_URL or sign up at https://getpapi.ai/setup to enable observability.\n\n"
     );
   }
-  const __filename = fileURLToPath(import.meta.url);
-  const __dirname2 = dirname2(__filename);
-  const skillsDir = join14(__dirname2, "..", "skills");
+  const __filename = fileURLToPath2(import.meta.url);
+  const __dirname2 = dirname4(__filename);
+  const skillsDir = join17(__dirname2, "..", "skills");
   function parseSkillFrontmatter(content) {
     const match = content.match(/^---\n([\s\S]*?)\n---/);
     if (!match) return null;
@@ -26961,11 +27224,11 @@ function createServer(adapter2, config2) {
   }
   server2.setRequestHandler(ListPromptsRequestSchema, async () => {
     try {
-      const files = await readdir2(skillsDir);
+      const files = await readdir4(skillsDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       const prompts = [];
       for (const file of mdFiles) {
-        const content = await readFile7(join14(skillsDir, file), "utf-8");
+        const content = await readFile9(join17(skillsDir, file), "utf-8");
         const meta = parseSkillFrontmatter(content);
         if (meta) {
           prompts.push({ name: meta.name, description: meta.description });
@@ -26979,9 +27242,9 @@ function createServer(adapter2, config2) {
   server2.setRequestHandler(GetPromptRequestSchema, async (request) => {
     const { name } = request.params;
     try {
-      const files = await readdir2(skillsDir);
+      const files = await readdir4(skillsDir);
       for (const file of files.filter((f) => f.endsWith(".md"))) {
-        const content = await readFile7(join14(skillsDir, file), "utf-8");
+        const content = await readFile9(join17(skillsDir, file), "utf-8");
         const meta = parseSkillFrontmatter(content);
         if (meta?.name === name) {
           const body = content.replace(/^---\n[\s\S]*?\n---\n*/, "");
@@ -27100,6 +27363,10 @@ function createServer(adapter2, config2) {
           return handleProjectList(adapter2, config2, safeArgs);
         case "project_switch":
           return handleProjectSwitch(adapter2, config2, safeArgs);
+        case "agent_list":
+          return handleAgentList(config2, safeArgs);
+        case "inventory_sync":
+          return handleInventorySync(adapter2, config2, safeArgs, getToolMetadata());
         default:
           return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
       }
@@ -27153,6 +27420,11 @@ function createServer(adapter2, config2) {
         }
       }
     }
+    if (!isError && (name === "setup" || name === "release")) {
+      const force = name === "setup";
+      void syncHarnessInventory(adapter2, config2, { force, toolDefs: getToolMetadata() }).catch(() => {
+      });
+    }
     const footer = formatMetricsFooter(elapsed, usage, contextBytes);
     result.content.push({ type: "text", text: footer });
     return result;
@@ -27456,10 +27728,10 @@ async function dispatchRequest(args) {
 }
 
 // src/index.ts
-var __dirname = dirname3(fileURLToPath2(import.meta.url));
+var __dirname = dirname5(fileURLToPath3(import.meta.url));
 var pkgVersion = "unknown";
 try {
-  const pkg = JSON.parse(readFileSync10(join17(__dirname, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync12(join20(__dirname, "..", "package.json"), "utf-8"));
   pkgVersion = pkg.version;
 } catch {
 }