@pikaa-ai/pikaa 0.3.27 → 0.3.28

package/dist/cli.js

@@ -3,7 +3,7 @@
 
 // src/cli/index.ts
 import { resolve as resolve22 } from "path";
-import { existsSync as existsSync24 } from "fs";
+import { existsSync as existsSync25 } from "fs";
 import { createInterface } from "readline";
 
 // src/auth/store.ts
@@ -1109,761 +1109,1335 @@ class EphemeralWorkspaceManager {
   }
 }
 var globalEphemeralWorkspace = new EphemeralWorkspaceManager;
+// src/verification/verifier.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 
-// src/session/turn.ts
-async function runTurn(session, turnContext, input) {
-  const { turnId, signal } = turnContext;
-  session.emitEvent({
-    type: "TurnStarted",
-    turnId
-  });
-  const currentHistory = session.getHistory();
-  const estimatedTokens = estimateTotalTokens(currentHistory);
-  const maxTokenLimit = DEFAULT_AUTO_COMPACT_THRESHOLD_TOKENS;
-  if (estimatedTokens > maxTokenLimit) {
-    const compacted = compactHistory(currentHistory);
-    session.setHistory(compacted);
-    session.emitEvent({
-      type: "Warning",
-      message: `Auto-compacted conversation history (${estimatedTokens} estimated tokens exceeded limit).`
-    });
+// src/init/project-analyzer.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
+import { join as join5, basename } from "path";
+
+class ProjectAnalyzer {
+  cwd;
+  constructor(cwd = process.cwd()) {
+    this.cwd = cwd;
   }
-  const userItem = {
-    id: `msg_user_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
-    type: "user_message",
-    content: typeof input === "string" ? input : input?.text ?? input?.prompt ?? "",
-    images: typeof input === "object" ? input?.images : undefined,
-    createdAt: Date.now()
-  };
-  session.addHistoryItem(userItem);
-  session.emitEvent({
-    type: "ItemCompleted",
-    turnId,
-    item: userItem
-  });
-  const cwd = turnContext.environment.cwd;
-  const worldState = await captureWorldState(cwd);
-  const memoriesPrompt = session.memoryStore?.formatMemoriesPrompt(cwd);
-  const skillsPrompt = session.skillsLoader?.formatSkillsPrompt(cwd);
-  const mcpPrompt = session.mcpManager?.formatMcpPrompt();
-  const effectiveSystemPrompt = buildSystemPrompt({
-    basePrompt: session.systemPrompt || undefined,
-    worldStatePrompt: formatWorldStatePrompt(worldState),
-    memoriesPrompt,
-    skillsPrompt,
-    mcpPrompt,
-    isOrchestrator: session.tools.has("spawn_agent"),
-    cwd
-  });
-  let iteration = 0;
-  let accumulatedInputTokens = 0;
-  let accumulatedOutputTokens = 0;
-  let accumulatedCachedTokens = 0;
-  const clientSession = session.modelClient.newSession();
-  try {
-    while (iteration < turnContext.maxIterations) {
-      if (signal.aborted) {
-        throw new TurnAbortedError;
-      }
-      iteration++;
-      let currentAgentText = "";
-      const toolCallRequests = [];
-      let iterInputTokens = Math.ceil((effectiveSystemPrompt.length + JSON.stringify(session.getHistory()).length) / 4);
-      let iterOutputTokens = 0;
-      const stream = clientSession.stream({
-        model: turnContext.model,
-        systemPrompt: effectiveSystemPrompt,
-        history: session.getHistory(),
-        tools: turnContext.tools,
-        signal,
-        enablePromptCache: true
-      });
-      for await (const chunk of stream) {
-        if (signal.aborted) {
-          throw new TurnAbortedError;
+  analyze() {
+    const readmeInfo = this.extractReadmeMetadata();
+    const projectName = readmeInfo.title || this.detectProjectName();
+    const languages = this.detectLanguages();
+    const packageManager = this.detectPackageManager();
+    const frameworks = [];
+    const infrastructure = [];
+    const commands = {};
+    const architectureNotes = [];
+    const codeConventions = [];
+    let description = readmeInfo.description;
+    const pkgPath = join5(this.cwd, "package.json");
+    if (existsSync6(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+        if (!description && pkg.description)
+          description = pkg.description;
+        const pm = packageManager || "npm";
+        const runPrefix = pm === "bun" || pm === "yarn" || pm === "pnpm" ? `${pm} run` : "npm run";
+        const testPrefix = pm === "bun" ? "bun test" : pm === "pnpm" ? "pnpm test" : pm === "yarn" ? "yarn test" : "npm test";
+        if (pkg.scripts) {
+          if (pkg.scripts.dev)
+            commands.dev = `${runPrefix} dev`;
+          else if (pkg.scripts.start)
+            commands.dev = `${runPrefix} start`;
+          if (pkg.scripts.build)
+            commands.build = `${runPrefix} build`;
+          if (pkg.scripts.test)
+            commands.test = pkg.scripts.test === "bun test" ? "bun test" : testPrefix;
+          if (pkg.scripts.typecheck)
+            commands.typecheck = `${runPrefix} typecheck`;
+          else if (pkg.scripts.check)
+            commands.typecheck = `${runPrefix} check`;
+          if (pkg.scripts.lint)
+            commands.lint = `${runPrefix} lint`;
+          if (pkg.scripts.format)
+            commands.format = `${runPrefix} format`;
         }
-        if (chunk.type === "reasoning_delta") {
-          session.emitEvent({
-            type: "ReasoningDelta",
-            turnId,
-            delta: chunk.delta
-          });
-        } else if (chunk.type === "text_delta") {
-          currentAgentText += chunk.delta;
-          session.emitEvent({
-            type: "AgentMessageDelta",
-            turnId,
-            delta: chunk.delta
-          });
-        } else if (chunk.type === "tool_call") {
-          toolCallRequests.push(chunk);
-        } else if (chunk.type === "done") {
-          if (chunk.inputTokens !== undefined)
-            iterInputTokens = chunk.inputTokens;
-          if (chunk.outputTokens !== undefined)
-            iterOutputTokens = chunk.outputTokens;
-          if (chunk.cachedTokens !== undefined)
-            accumulatedCachedTokens += chunk.cachedTokens;
-        } else if (chunk.type === "error") {
-          throw chunk.error;
+        const allDeps = {
+          ...pkg.dependencies || {},
+          ...pkg.devDependencies || {}
+        };
+        if (allDeps.next)
+          frameworks.push("Next.js");
+        if (allDeps.react)
+          frameworks.push("React");
+        if (allDeps.vue)
+          frameworks.push("Vue.js");
+        if (allDeps.svelte || allDeps["@sveltejs/kit"])
+          frameworks.push("Svelte");
+        if (allDeps.astro)
+          frameworks.push("Astro");
+        if (allDeps.vite)
+          frameworks.push("Vite");
+        if (allDeps.express)
+          frameworks.push("Express");
+        if (allDeps.hono)
+          frameworks.push("Hono");
+        if (allDeps.fastify)
+          frameworks.push("Fastify");
+        if (allDeps["@nestjs/core"])
+          frameworks.push("NestJS");
+        if (allDeps.tailwindcss)
+          frameworks.push("TailwindCSS");
+        if (allDeps["lucide-react"] || allDeps.lucide)
+          frameworks.push("Lucide Icons");
+        if (allDeps.zustand)
+          frameworks.push("Zustand");
+        if (allDeps["@tanstack/react-query"])
+          frameworks.push("TanStack Query");
+        if (allDeps.oxlint)
+          frameworks.push("Oxlint");
+        if (allDeps.eslint)
+          frameworks.push("ESLint");
+        if (allDeps.vitest)
+          frameworks.push("Vitest");
+        if (allDeps.jest)
+          frameworks.push("Jest");
+        if (allDeps.playwright || allDeps["@playwright/test"])
+          frameworks.push("Playwright");
+        if (pkg.type === "module") {
+          codeConventions.push("Use ES modules (`import/export`), not CommonJS (`require`).");
+        }
+      } catch {}
+    }
+    const tsconfigPath = join5(this.cwd, "tsconfig.json");
+    if (existsSync6(tsconfigPath)) {
+      try {
+        const tsconfig = JSON.parse(readFileSync4(tsconfigPath, "utf8"));
+        if (tsconfig.compilerOptions?.strict) {
+          codeConventions.push("TypeScript strict mode enabled.");
+        }
+        if (!commands.typecheck) {
+          commands.typecheck = "tsc --noEmit";
         }
+      } catch {}
+    }
+    const cargoPath = join5(this.cwd, "Cargo.toml");
+    if (existsSync6(cargoPath)) {
+      try {
+        commands.dev = commands.dev || "cargo run";
+        commands.build = commands.build || "cargo build";
+        commands.test = commands.test || "cargo test";
+        commands.lint = commands.lint || "cargo clippy";
+        frameworks.push("Rust Cargo");
+      } catch {}
+    }
+    const goModPath = join5(this.cwd, "go.mod");
+    if (existsSync6(goModPath)) {
+      try {
+        commands.dev = commands.dev || "go run .";
+        commands.build = commands.build || "go build ./...";
+        commands.test = commands.test || "go test ./...";
+        commands.lint = commands.lint || "golangci-lint run";
+        frameworks.push("Go Modules");
+      } catch {}
+    }
+    const pyprojectPath = join5(this.cwd, "pyproject.toml");
+    const requirementsPath = join5(this.cwd, "requirements.txt");
+    if (existsSync6(pyprojectPath) || existsSync6(requirementsPath)) {
+      commands.test = commands.test || "pytest";
+      commands.lint = commands.lint || "ruff check .";
+      if (existsSync6(join5(this.cwd, "uv.lock"))) {
+        frameworks.push("uv");
+        commands.test = "uv run pytest";
+      } else if (existsSync6(join5(this.cwd, "poetry.lock"))) {
+        frameworks.push("Poetry");
+        commands.test = "poetry run pytest";
       }
-      if (iterOutputTokens === 0) {
-        iterOutputTokens = Math.ceil((currentAgentText.length + JSON.stringify(toolCallRequests).length) / 4);
+    }
+    if (existsSync6(join5(this.cwd, "Dockerfile"))) {
+      infrastructure.push("Docker");
+      const sanitizedName = projectName.toLowerCase().replace(/[^a-z0-9_-]/g, "-").replace(/^-+|-+$/g, "");
+      commands.dockerBuild = `docker build -t ${sanitizedName || "app"} .`;
+    }
+    if (existsSync6(join5(this.cwd, "nginx.conf"))) {
+      infrastructure.push("Nginx");
+    }
+    if (existsSync6(join5(this.cwd, "src/api.ts")) || existsSync6(join5(this.cwd, "src/api"))) {
+      architectureNotes.push("Backend API endpoints and network client logic are centralized in `src/api`.");
+    }
+    if (existsSync6(join5(this.cwd, "src/components"))) {
+      architectureNotes.push("Reusable UI presentation components live in `src/components/`.");
+    }
+    if (existsSync6(join5(this.cwd, "src/types.ts")) || existsSync6(join5(this.cwd, "src/types"))) {
+      architectureNotes.push("Shared TypeScript data models and interfaces are defined in `src/types`.");
+    }
+    if (existsSync6(join5(this.cwd, ".env.example"))) {
+      architectureNotes.push("Environment configuration template is in `.env.example`.");
+    }
+    if (commands.typecheck || commands.lint || commands.test) {
+      const checks = [];
+      if (commands.typecheck)
+        checks.push(`typecheck (\`${commands.typecheck}\`)`);
+      if (commands.lint)
+        checks.push(`lint (\`${commands.lint}\`)`);
+      if (commands.test)
+        checks.push(`tests (\`${commands.test}\`)`);
+      codeConventions.push(`Run ${checks.join(" and ")} before concluding any major code edits.`);
+    }
+    const instructionFiles = ["AGENTS.md", "CLAUDE.md", ".agents.md", "AGENTS.override.md"];
+    let hasExistingInstructions = false;
+    let existingInstructionFile;
+    for (const f of instructionFiles) {
+      if (existsSync6(join5(this.cwd, f))) {
+        hasExistingInstructions = true;
+        existingInstructionFile = f;
+        break;
       }
-      accumulatedInputTokens += iterInputTokens;
-      accumulatedOutputTokens += iterOutputTokens;
-      if (currentAgentText.trim()) {
-        const agentItem = {
-          id: `msg_agent_${Date.now()}`,
-          type: "agent_message",
-          content: currentAgentText,
-          createdAt: Date.now()
-        };
-        session.addHistoryItem(agentItem);
-        session.emitEvent({
-          type: "ItemCompleted",
-          turnId,
-          item: agentItem
-        });
-      }
-      if (toolCallRequests.length > 0) {
-        for (const toolCall of toolCallRequests) {
-          if (!toolCall.name || !toolCall.name.trim())
-            continue;
-          const functionCallItem = {
-            id: `call_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
-            type: "function_call",
-            callId: toolCall.callId,
-            name: toolCall.name,
-            arguments: toolCall.arguments,
-            createdAt: Date.now()
-          };
-          session.addHistoryItem(functionCallItem);
-          session.emitEvent({
-            type: "ItemStarted",
-            turnId,
-            item: functionCallItem
-          });
-          session.emitEvent({
-            type: "ToolCallStarted",
-            turnId,
-            toolName: toolCall.name,
-            arguments: toolCall.arguments
-          });
-          const toolResult = await turnContext.tools.execute(toolCall.name, toolCall.arguments, {
-            cwd: turnContext.environment.cwd,
-            turnId,
-            signal,
-            execPolicy: session.execPolicy,
-            mode: session.collaborationMode,
-            permissionMode: session.permissionMode,
-            onPlanUpdate: (plan, explanation) => {
-              session.emitEvent({
-                type: "PlanUpdated",
-                turnId,
-                explanation,
-                plan
-              });
-            },
-            requestApproval: async (description, command, prefixRule) => {
-              const approvalId = `appr_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
-              return session.requestApproval({
-                approvalId,
-                turnId,
-                toolName: toolCall.name,
-                description,
-                command
-              });
-            },
-            requestInput: async (question, options) => {
-              const questionId = `quest_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
-              return session.requestUserQuestion({
-                questionId,
-                turnId,
-                question,
-                options
-              });
-            }
-          });
-          const functionOutputItem = {
-            id: `out_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
-            type: "function_call_output",
-            callId: toolCall.callId,
-            output: toolResult.output,
-            isError: toolResult.isError,
-            createdAt: Date.now()
-          };
-          session.addHistoryItem(functionOutputItem);
-          session.emitEvent({
-            type: "ToolCallFinished",
-            turnId,
-            toolName: toolCall.name,
-            output: toolResult.output,
-            isError: toolResult.isError
-          });
-          session.emitEvent({
-            type: "ItemCompleted",
-            turnId,
-            item: functionOutputItem
-          });
-        }
-        continue;
-      }
-      if (!currentAgentText.trim() && toolCallRequests.length === 0) {
-        if (iteration === 1 && iteration < turnContext.maxIterations) {
-          session.addHistoryItem({
-            id: `msg_nudge_${Date.now()}`,
-            type: "user_message",
-            content: `[Systematic ReAct Nudge]: No tool actions or answers were produced in this iteration.
-1. Review the user's objective and determine the immediate next action.
-2. If more context is required, invoke an exploration tool ('read_file', 'list_dir', 'grep_search', 'find_files').
-3. If ready to answer or implement, call the required mutating tool or deliver your full, concrete response now.`,
-            createdAt: Date.now()
-          });
-          continue;
-        }
-      }
-      break;
     }
-    const totalContextTokens = estimateTotalTokens(session.getHistory()) + Math.ceil(effectiveSystemPrompt.length / 4);
-    const maxContextTokens = DEFAULT_MAX_CONTEXT_TOKENS;
-    session.emitEvent({
-      type: "TurnCompleted",
-      turnId,
-      inputTokens: accumulatedInputTokens,
-      outputTokens: accumulatedOutputTokens,
-      totalTokens: accumulatedInputTokens + accumulatedOutputTokens,
-      cachedTokens: accumulatedCachedTokens > 0 ? accumulatedCachedTokens : undefined,
-      contextTokens: totalContextTokens,
-      maxContextTokens
-    });
-  } catch (error) {
-    const isAborted = error instanceof TurnAbortedError || signal.aborted;
-    const message = isAborted ? "Turn was interrupted" : error instanceof Error ? error.message : String(error);
-    session.emitEvent({
-      type: "Error",
-      turnId,
-      message,
-      code: isAborted ? "TURN_ABORTED" : "EXECUTION_ERROR"
-    });
-  } finally {
-    session.clearActiveTurn(turnId);
-    globalEphemeralWorkspace.cleanupTurn(turnId);
-    globalEphemeralWorkspace.cleanRootResidue(turnContext.environment.cwd);
-  }
-}
-
-// src/session/turn-input.ts
-async function handleTurnInput(session, request) {
-  const activeTurn = session.getActiveTurn();
-  if (!activeTurn) {
-    const turnId = `turn_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
-    const turnContext = new TurnContext(turnId, session.model, session.tools, { cwd: session.cwd });
-    session.setActiveTurn(turnContext);
-    runTurn(session, turnContext, request).catch((err) => {
-      session.emitEvent({
-        type: "Error",
-        turnId,
-        message: `Unhandled turn error: ${err instanceof Error ? err.message : String(err)}`
-      });
-    });
     return {
-      kind: "started",
-      turnId
+      projectName,
+      description,
+      languages,
+      packageManager,
+      frameworks,
+      infrastructure,
+      commands,
+      architectureNotes,
+      codeConventions,
+      hasExistingInstructions,
+      existingInstructionFile
     };
   }
-  session.addHistoryItem({
-    id: `steer_${Date.now()}`,
-    type: "user_message",
-    content: `[Steering Guidance]: ${request.text}`,
-    images: request.images,
-    createdAt: Date.now()
-  });
-  return {
-    kind: "steered",
-    turnId: activeTurn.turnId
-  };
-}
-
-// src/session/submission-loop.ts
-async function submissionLoop(session, queue) {
-  for await (const submission of queue) {
-    const { op } = submission;
-    switch (op.type) {
-      case "TurnInput": {
-        const text = op.request?.text ?? op.prompt ?? (typeof op.request === "string" ? op.request : "");
-        const images = op.request?.images ?? op.images;
-        await handleTurnInput(session, {
-          text,
-          images,
-          clientId: op.request?.clientId,
-          additionalContext: op.request?.additionalContext
-        });
-        break;
-      }
-      case "Interrupt": {
-        session.interrupt();
-        break;
-      }
-      case "ExecApproval": {
-        session.resolveApproval(op.approvalId, op.approved);
-        break;
-      }
-      case "Shutdown": {
-        session.interrupt();
-        session.emitEvent({
-          type: "StatusChanged",
-          status: "terminated"
-        });
-        return;
+  generateAgentsMarkdown(analysis) {
+    const lines = [];
+    lines.push(`# ${analysis.projectName}`);
+    lines.push("");
+    if (analysis.description) {
+      lines.push(`> ${analysis.description}`);
+      lines.push("");
+    }
+    lines.push("## Commands");
+    lines.push("");
+    if (Object.keys(analysis.commands).length > 0) {
+      if (analysis.commands.dev)
+        lines.push(`- **Dev Server**: \`${analysis.commands.dev}\``);
+      if (analysis.commands.build)
+        lines.push(`- **Build**: \`${analysis.commands.build}\``);
+      if (analysis.commands.test)
+        lines.push(`- **Test**: \`${analysis.commands.test}\``);
+      if (analysis.commands.typecheck)
+        lines.push(`- **Typecheck**: \`${analysis.commands.typecheck}\``);
+      if (analysis.commands.lint)
+        lines.push(`- **Lint**: \`${analysis.commands.lint}\``);
+      if (analysis.commands.format)
+        lines.push(`- **Format**: \`${analysis.commands.format}\``);
+      if (analysis.commands.dockerBuild)
+        lines.push(`- **Docker Build**: \`${analysis.commands.dockerBuild}\``);
+    } else {
+      lines.push("- *No standard build/test commands detected.*");
+    }
+    lines.push("");
+    lines.push("## Architecture & Stack");
+    lines.push("");
+    const stackItems = [];
+    if (analysis.languages.length > 0)
+      stackItems.push(analysis.languages.join(", "));
+    if (analysis.frameworks.length > 0)
+      stackItems.push(analysis.frameworks.join(", "));
+    if (analysis.infrastructure.length > 0)
+      stackItems.push(analysis.infrastructure.join(", "));
+    if (stackItems.length > 0) {
+      lines.push(`- **Core Stack**: ${stackItems.join(" \u2022 ")}`);
+    }
+    for (const note of analysis.architectureNotes) {
+      lines.push(`- ${note}`);
+    }
+    lines.push("");
+    lines.push("## Workflow & Code Guidelines");
+    lines.push("");
+    if (analysis.codeConventions.length > 0) {
+      for (const conv of analysis.codeConventions) {
+        lines.push(`- ${conv}`);
       }
     }
+    lines.push("- Prefer targeted edits over whole-file rewrites.");
+    lines.push("- When fixing errors, address the root cause rather than suppressing compiler warnings.");
+    lines.push("");
+    return lines.join(`
+`);
   }
-}
-
-// src/security/exec-policy.ts
-class ExecPolicy {
-  rules = [];
-  mode = "auto";
-  constructor(initialMode = "auto") {
-    this.mode = initialMode;
-    this.initDefaultRules();
-  }
-  getMode() {
-    return this.mode;
-  }
-  setMode(mode) {
-    this.mode = mode;
-  }
-  initDefaultRules() {
-    this.addRule(/^(git\s+(status|log|diff|branch|show|rev-parse))/i, "allow", "Safe git query");
-    this.addRule(/^(ls|dir|cat|type|grep|rg|find|pwd|echo|head|tail|wc|which|where)\b/i, "allow", "Safe read-only shell command");
-    this.addRule(/^(bun\s+(test|--version|-v)|npm\s+(test|--version|-v)|node\s+-v)\b/i, "allow", "Testing & runtime check");
-    this.addRule(/^(rm|del|rmdir|format|mkfs)\b/i, "prompt", "Destructive file removal");
-    this.addRule(/^(git\s+(push|reset\s+--hard|clean\s+-fd|rebase))\b/i, "prompt", "Destructive git operation");
-    this.addRule(/^(curl|wget|fetch|ssh|scp|ftp)\b/i, "prompt", "Network / remote transfer");
-  }
-  addRule(pattern, decision, description) {
-    this.rules.unshift({ pattern, decision, description });
+  extractReadmeMetadata() {
+    const readmeFiles = ["README.md", "readme.md", "README.MD"];
+    for (const file of readmeFiles) {
+      const fullPath = join5(this.cwd, file);
+      if (existsSync6(fullPath)) {
+        try {
+          const content = readFileSync4(fullPath, "utf8");
+          const lines = content.split(`
+`);
+          let title;
+          let description;
+          for (const line of lines) {
+            const trimmed = line.trim();
+            if (!title && trimmed.startsWith("# ")) {
+              title = trimmed.replace(/^#\s+/, "").trim();
+              continue;
+            }
+            if (title && !description && trimmed.length > 0 && !trimmed.startsWith("#") && !trimmed.startsWith("```") && !trimmed.startsWith("[")) {
+              description = trimmed;
+              break;
+            }
+          }
+          return { title, description };
+        } catch {}
+      }
+    }
+    return {};
   }
-  shouldPromptFileEdit(filePath) {
-    if (this.mode === "plan") {
-      return {
-        prompt: true,
-        isPlanBlocked: true,
-        reason: `[Plan Mode Gate] Approval required to mutate '${filePath || "file"}' and proceed with implementation.`
-      };
+  detectProjectName() {
+    const pkgPath = join5(this.cwd, "package.json");
+    if (existsSync6(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+        if (pkg.name && pkg.name !== "frontend" && pkg.name !== "backend" && pkg.name !== "app") {
+          return pkg.name.startsWith("@") ? pkg.name.split("/")[1] || pkg.name : pkg.name;
+        }
+      } catch {}
     }
-    if (this.mode === "manual") {
-      return {
-        prompt: true,
-        reason: `Manual mode requires approval to modify '${filePath || "file"}'`
-      };
+    const cargoPath = join5(this.cwd, "Cargo.toml");
+    if (existsSync6(cargoPath)) {
+      try {
+        const match = readFileSync4(cargoPath, "utf8").match(/name\s*=\s*"([^"]+)"/);
+        if (match?.[1])
+          return match[1];
+      } catch {}
     }
-    return { prompt: false };
+    const goModPath = join5(this.cwd, "go.mod");
+    if (existsSync6(goModPath)) {
+      try {
+        const match = readFileSync4(goModPath, "utf8").match(/module\s+([^\s]+)/);
+        if (match?.[1])
+          return basename(match[1]);
+      } catch {}
+    }
+    return basename(this.cwd);
   }
-  evaluate(command) {
-    const trimmed = command.trim();
-    if (this.mode === "plan") {
-      const isReadOnly = /^(git\s+(status|log|diff|branch|show|rev-parse)|ls|dir|cat|type|grep|rg|find|pwd|which|where)\b/i.test(trimmed);
-      if (isReadOnly) {
-        return { decision: "allow", reason: "Read-only inspection allowed in Plan mode" };
-      }
-      return {
-        decision: "prompt",
-        reason: `[Plan Mode Gate] Approval required to execute shell command '${trimmed}' in Plan Mode`
-      };
+  detectLanguages() {
+    const langs = new Set;
+    if (existsSync6(join5(this.cwd, "tsconfig.json")) || this.hasFileWithExtension(".ts", ".tsx")) {
+      langs.add("TypeScript");
     }
-    if (this.mode === "manual") {
-      return {
-        decision: "prompt",
-        reason: "Manual mode requires confirmation for all shell commands"
-      };
+    if (existsSync6(join5(this.cwd, "package.json")) || this.hasFileWithExtension(".js", ".jsx", ".mjs")) {
+      langs.add("JavaScript");
     }
-    if (this.mode === "accept-edits") {
-      const isReadOnly = /^(git\s+(status|log|diff|branch|show)|ls|dir|cat|type|grep|rg|find|pwd|bun\s+test|npm\s+test)\b/i.test(trimmed);
-      if (isReadOnly) {
-        return { decision: "allow", reason: "Safe read-only command in accept-edits mode" };
-      }
-      return {
-        decision: "prompt",
-        reason: "Accept-edits mode requires approval for active shell commands"
-      };
+    if (existsSync6(join5(this.cwd, "Cargo.toml")) || this.hasFileWithExtension(".rs")) {
+      langs.add("Rust");
     }
-    for (const rule of this.rules) {
-      if (rule.pattern.test(trimmed)) {
-        return {
-          decision: rule.decision,
-          reason: rule.description
-        };
-      }
+    if (existsSync6(join5(this.cwd, "go.mod")) || this.hasFileWithExtension(".go")) {
+      langs.add("Go");
+    }
+    if (existsSync6(join5(this.cwd, "pyproject.toml")) || existsSync6(join5(this.cwd, "requirements.txt")) || this.hasFileWithExtension(".py")) {
+      langs.add("Python");
+    }
+    if (existsSync6(join5(this.cwd, "pom.xml")) || existsSync6(join5(this.cwd, "build.gradle")) || this.hasFileWithExtension(".java")) {
+      langs.add("Java");
+    }
+    if (existsSync6(join5(this.cwd, "CMakeLists.txt")) || this.hasFileWithExtension(".cpp", ".c", ".h", ".hpp")) {
+      langs.add("C/C++");
+    }
+    return Array.from(langs);
+  }
+  detectPackageManager() {
+    if (existsSync6(join5(this.cwd, "bun.lockb")) || existsSync6(join5(this.cwd, "bun.lock")))
+      return "bun";
+    if (existsSync6(join5(this.cwd, "pnpm-lock.yaml")))
+      return "pnpm";
+    if (existsSync6(join5(this.cwd, "yarn.lock")))
+      return "yarn";
+    if (existsSync6(join5(this.cwd, "package-lock.json")))
+      return "npm";
+    if (existsSync6(join5(this.cwd, "Cargo.lock")) || existsSync6(join5(this.cwd, "Cargo.toml")))
+      return "cargo";
+    if (existsSync6(join5(this.cwd, "uv.lock")))
+      return "uv";
+    if (existsSync6(join5(this.cwd, "poetry.lock")))
+      return "poetry";
+    if (existsSync6(join5(this.cwd, "go.sum")) || existsSync6(join5(this.cwd, "go.mod")))
+      return "go";
+    if (existsSync6(join5(this.cwd, "package.json")))
+      return "npm";
+    return;
+  }
+  hasFileWithExtension(...exts) {
+    try {
+      const entries = readdirSync3(this.cwd);
+      return entries.some((e) => exts.some((ext) => e.endsWith(ext)));
+    } catch {
+      return false;
     }
-    return {
-      decision: "allow",
-      reason: "Auto mode allows execution"
-    };
   }
 }
 
-// src/session/session.ts
-class Session {
-  threadId;
-  model;
+// src/verification/verifier.ts
+class AutoVerifier {
   cwd;
-  systemPrompt;
-  modelClient;
-  tools;
-  skillsLoader;
-  memoryStore;
-  mcpManager;
-  execPolicy;
-  collaborationMode = "default";
-  get permissionMode() {
-    return this.execPolicy.getMode();
+  customCommand;
+  timeoutMs;
+  constructor(options) {
+    this.cwd = options.cwd;
+    this.customCommand = options.customCommand;
+    this.timeoutMs = options.timeoutMs ?? 30000;
   }
-  setPermissionMode(mode) {
-    this.execPolicy.setMode(mode);
-    if (mode === "plan") {
-      this.collaborationMode = "plan";
-    } else if (this.collaborationMode === "plan") {
-      this.collaborationMode = "default";
+  resolveVerificationCommand() {
+    if (this.customCommand && this.customCommand.trim()) {
+      return this.customCommand.trim();
     }
-  }
-  history = [];
-  activeTurn = null;
-  status = "idle";
-  eventListeners = [];
-  pendingApprovals = new Map;
-  pendingUserQuestions = new Map;
-  submissionResolvers = [];
-  submissionQueue = [];
-  isTerminated = false;
-  constructor(options = {}) {
-    this.threadId = options.threadId || `thread_${Date.now()}`;
-    this.model = options.model || "gpt-4o";
-    this.cwd = options.cwd || process.cwd();
-    this.systemPrompt = options.systemPrompt || "";
-    this.modelClient = options.modelClient || new ModelClient;
-    this.tools = options.tools || new ToolRouter;
-    this.skillsLoader = options.skillsLoader;
-    this.memoryStore = options.memoryStore;
-    this.mcpManager = options.mcpManager;
-    this.execPolicy = options.execPolicy || new ExecPolicy;
-    this.collaborationMode = options.collaborationMode || "default";
-    this.history = options.initialHistory ? [...options.initialHistory] : [];
-    if (options.onEvent) {
-      this.eventListeners.push(options.onEvent);
+    try {
+      const analyzer = new ProjectAnalyzer(this.cwd);
+      const analysis = analyzer.analyze();
+      if (analysis.commands.typecheck) {
+        return analysis.commands.typecheck;
+      }
+      if (analysis.commands.lint) {
+        return analysis.commands.lint;
+      }
+      if (analysis.commands.test) {
+        return analysis.commands.test;
+      }
+    } catch {}
+    const pkgPath = join6(this.cwd, "package.json");
+    if (existsSync7(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+        if (pkg.scripts) {
+          if (pkg.scripts.typecheck)
+            return "npm run typecheck";
+          if (pkg.scripts.check)
+            return "npm run check";
+          if (pkg.scripts.test)
+            return "npm test";
+        }
+      } catch {}
     }
-    this.startSubmissionLoop();
-    this.emitEvent({
-      type: "SessionConfigured",
-      threadId: this.threadId,
-      model: this.model
-    });
-  }
-  onEvent(listener) {
-    this.eventListeners.push(listener);
-    return () => {
-      this.eventListeners = this.eventListeners.filter((l) => l !== listener);
-    };
-  }
-  emitEvent(msg) {
-    if (msg.type === "StatusChanged") {
-      this.status = msg.status;
+    if (existsSync7(join6(this.cwd, "tsconfig.json"))) {
+      return "npx tsc --noEmit";
     }
-    const event = {
-      id: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
-      timestamp: Date.now(),
-      msg
-    };
-    for (const listener of this.eventListeners) {
-      try {
-        listener(event);
-      } catch (err) {
-        console.error("Error in event listener:", err);
+    if (existsSync7(join6(this.cwd, "Cargo.toml"))) {
+      return "cargo check";
+    }
+    if (existsSync7(join6(this.cwd, "go.mod"))) {
+      return "go vet ./...";
+    }
+    if (existsSync7(join6(this.cwd, "pyproject.toml")) || existsSync7(join6(this.cwd, "setup.py"))) {
+      if (existsSync7(join6(this.cwd, "mypy.ini")) || existsSync7(join6(this.cwd, ".mypy.ini"))) {
+        return "mypy .";
       }
     }
+    return null;
   }
-  getHistory() {
-    return [...this.history];
-  }
-  setHistory(items) {
-    this.history = [...items];
-  }
-  addHistoryItem(item) {
-    this.history.push(item);
-  }
-  getActiveTurn() {
-    return this.activeTurn;
-  }
-  setActiveTurn(turn) {
-    this.activeTurn = turn;
-    this.emitEvent({
-      type: "StatusChanged",
-      status: "running"
-    });
-  }
-  clearActiveTurn(turnId) {
-    if (!turnId || this.activeTurn?.turnId === turnId) {
-      this.activeTurn = null;
-      this.emitEvent({
-        type: "StatusChanged",
-        status: "idle"
-      });
-    }
-  }
-  interrupt() {
-    if (this.activeTurn) {
-      this.activeTurn.abort("Interrupted by user");
-      this.clearActiveTurn();
-      this.emitEvent({
-        type: "StatusChanged",
-        status: "interrupted"
-      });
-    }
-  }
-  requestApproval(params) {
-    this.emitEvent({
-      type: "ApprovalRequired",
-      approvalId: params.approvalId,
-      turnId: params.turnId,
-      toolName: params.toolName,
-      description: params.description,
-      command: params.command
-    });
-    this.emitEvent({
-      type: "StatusChanged",
-      status: "waiting_approval"
-    });
-    return new Promise((resolve) => {
-      this.pendingApprovals.set(params.approvalId, (approved) => {
-        this.emitEvent({
-          type: "StatusChanged",
-          status: "running"
-        });
-        resolve(approved);
-      });
-    });
-  }
-  resolveApproval(approvalId, approved) {
-    const resolver = this.pendingApprovals.get(approvalId);
-    if (resolver) {
-      this.pendingApprovals.delete(approvalId);
-      resolver(approved);
-    }
-  }
-  requestUserQuestion(params) {
-    this.emitEvent({
-      type: "UserQuestionRequired",
-      questionId: params.questionId,
-      turnId: params.turnId,
-      question: params.question,
-      options: params.options
-    });
-    this.emitEvent({
-      type: "StatusChanged",
-      status: "waiting_user_input"
-    });
-    return new Promise((resolve) => {
-      this.pendingUserQuestions.set(params.questionId, (answer) => {
-        this.emitEvent({
-          type: "StatusChanged",
-          status: "running"
-        });
-        resolve(answer);
-      });
-    });
-  }
-  resolveUserQuestion(questionId, answer) {
-    const resolver = this.pendingUserQuestions.get(questionId);
-    if (resolver) {
-      this.pendingUserQuestions.delete(questionId);
-      resolver(answer);
-    }
-  }
-  async submit(op) {
-    const subId = `sub_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
-    const submission = {
-      id: subId,
-      op,
-      createdAt: Date.now()
-    };
-    const resolver = this.submissionResolvers.shift();
-    if (resolver) {
-      resolver(submission);
-    } else {
-      this.submissionQueue.push(submission);
+  verify(modifiedFiles = []) {
+    const command = this.resolveVerificationCommand();
+    const startTime = performance.now();
+    if (!command) {
+      return {
+        command: "none",
+        success: true,
+        exitCode: 0,
+        output: "No automated verification command configured or detected for this workspace.",
+        durationMs: 0,
+        reason: "NO_VERIFIER_DETECTED"
+      };
     }
-    return subId;
-  }
-  async prompt(text, images) {
-    return handleTurnInput(this, { text, images });
-  }
-  async promptAndWait(text, images, timeoutMs = 30000) {
-    return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
-        unsub();
-        reject(new Error(`Turn timed out after ${timeoutMs}ms`));
-      }, timeoutMs);
-      const unsub = this.onEvent((event) => {
-        if (event.msg.type === "TurnCompleted") {
-          clearTimeout(timer);
-          unsub();
-          resolve();
-        } else if (event.msg.type === "Error") {
-          clearTimeout(timer);
-          unsub();
-          reject(new Error(event.msg.message));
+    try {
+      const isWindows = process.platform === "win32";
+      const proc = spawnSync(command, {
+        cwd: this.cwd,
+        shell: true,
+        encoding: "utf8",
+        timeout: this.timeoutMs,
+        maxBuffer: 10 * 1024 * 1024,
+        env: {
+          ...process.env,
+          CI: "true",
+          FORCE_COLOR: "0"
         }
       });
-      this.prompt(text, images).catch((err) => {
-        clearTimeout(timer);
-        unsub();
-        reject(err);
-      });
-    });
-  }
-  async* createSubmissionIterator() {
-    while (!this.isTerminated) {
-      if (this.submissionQueue.length > 0) {
-        yield this.submissionQueue.shift();
-      } else {
-        const nextSub = await new Promise((resolve) => {
-          this.submissionResolvers.push(resolve);
-        });
-        yield nextSub;
-      }
-    }
-  }
-  startSubmissionLoop() {
-    const iterator = this.createSubmissionIterator();
-    submissionLoop(this, iterator).catch((err) => {
-      console.error("Submission loop terminated with error:", err);
-    });
-  }
-}
-// src/tools/handlers/apply-patch.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve5, dirname as dirname3 } from "path";
-import { mkdirSync as mkdirSync4 } from "fs";
-var applyPatchTool = {
-  name: "apply_patch",
-  description: "Apply precise multi-line modifications to an existing file or create a new file. TargetContent must match the file content exactly.",
-  parameters: {
-    type: "object",
-    properties: {
-      path: {
-        type: "string",
-        description: "Relative or absolute path to the target file"
-      },
-      targetContent: {
-        type: "string",
-        description: "The exact block of code in the file to be replaced. For creating a new file, leave this empty."
-      },
-      replacementContent: {
-        type: "string",
-        description: "The new code content to replace the targetContent with."
-      }
-    },
-    required: ["path", "replacementContent"]
-  },
-  async execute(args, ctx) {
-    const rawPath = String(args.path || "");
-    if (!rawPath) {
-      return { output: "Error: 'path' parameter is required", isError: true };
-    }
-    const filePath = resolve5(ctx.cwd, rawPath);
-    const targetContent = typeof args.targetContent === "string" ? args.targetContent : "";
-    const replacementContent = String(args.replacementContent ?? "");
-    if (ctx.execPolicy) {
-      const evalResult = ctx.execPolicy.shouldPromptFileEdit(rawPath);
-      if (evalResult.prompt && ctx.requestApproval) {
-        const approval = await ctx.requestApproval(evalResult.reason || `Apply patch to: ${rawPath}`, `apply_patch ${rawPath}`);
-        const allowed = typeof approval === "object" ? approval.allowed : Boolean(approval);
-        if (!allowed) {
-          return {
-            output: `[Plan Mode Gate]: File modification declined by user for '${rawPath}'. Please refine your implementation plan or ask the user for guidance.`,
-            isError: true
-          };
+      const durationMs = Math.round(performance.now() - startTime);
+      const stdout = proc.stdout ? String(proc.stdout) : "";
+      const stderr = proc.stderr ? String(proc.stderr) : "";
+      let combined = (stdout + `
+` + stderr).trim();
+      if (combined.length > 3000) {
+        const lines = combined.split(`
+`);
+        if (lines.length > 60) {
+          const head = lines.slice(0, 30).join(`
+`);
+          const tail = lines.slice(-25).join(`
+`);
+          combined = `${head}
+
+... [${lines.length - 55} lines truncated for context efficiency] ...
+
+${tail}`;
         }
-      } else if (evalResult.isPlanBlocked || ctx.mode === "plan") {
-        return {
-          output: `[Plan Mode Gate]: Cannot mutate '${rawPath}' while in Plan Mode without user approval. Please present your implementation plan first.`,
-          isError: true
-        };
-      }
-    }
-    if (!existsSync6(filePath)) {
-      if (targetContent) {
-        return {
-          output: `Error: Target file '${rawPath}' does not exist, but targetContent was provided.
-[Systematic Error Recovery Checklist]:
-1. Root Cause: Trying to patch a non-existent file with targetContent.
-2. Fix: For creating new files, leave 'targetContent' empty and provide full contents in 'replacementContent'.
-3. Alternatively, check if the file path '${rawPath}' was mistyped.`,
-          isError: true
-        };
-      }
-      try {
-        mkdirSync4(dirname3(filePath), { recursive: true });
-        writeFileSync2(filePath, replacementContent, "utf8");
-        return { output: `Successfully created new file '${rawPath}'` };
-      } catch (err) {
-        return {
-          output: `Failed to create file '${rawPath}': ${err instanceof Error ? err.message : String(err)}`,
-          isError: true
-        };
-      }
-    }
-    try {
-      const originalFileContent = readFileSync4(filePath, "utf8");
-      if (!targetContent) {
-        return {
-          output: `Error: File '${rawPath}' already exists, but targetContent was empty.
-[Systematic Error Recovery Checklist]:
-1. Root Cause: An existing file requires targetContent to specify which lines to replace.
-2. Fix: Call 'read_file' on '${rawPath}', extract the exact target lines, and provide them in 'targetContent'.
-3. To overwrite the whole file, use the 'write_file' tool instead.`,
-          isError: true
-        };
-      }
-      const firstIndex = originalFileContent.indexOf(targetContent);
-      if (firstIndex === -1) {
-        return {
-          output: `Error: targetContent was not found in '${rawPath}'.
-[Systematic Error Recovery Checklist]:
-1. Root Cause: The snippet in targetContent does not match the actual file content (differences in whitespace, indentation, line endings, or prior edits).
-2. Action: Call 'read_file' on '${rawPath}' to inspect current exact lines and indentation.
-3. Fix: Provide the exact matching lines (including leading spaces) or wider context, then retry 'apply_patch'.`,
-          isError: true
-        };
-      }
-      const secondIndex = originalFileContent.indexOf(targetContent, firstIndex + 1);
-      if (secondIndex !== -1) {
-        return {
-          output: `Error: targetContent matched multiple locations in '${rawPath}'.
-[Systematic Error Recovery Checklist]:
-1. Root Cause: targetContent is ambiguous and occurs multiple times in the file.
-2. Action: Include 2-3 additional surrounding lines (before or after the target block) to make the target snippet uniquely identifiable.
-3. Fix: Re-run 'apply_patch' with the extended unique block.`,
-          isError: true
-        };
       }
-      const newFileContent = originalFileContent.slice(0, firstIndex) + replacementContent + originalFileContent.slice(firstIndex + targetContent.length);
-      writeFileSync2(filePath, newFileContent, "utf8");
+      const exitCode = proc.status ?? (proc.error ? 1 : 0);
+      const success = exitCode === 0;
       return {
-        output: `Successfully applied patch to '${rawPath}'`
+        command,
+        success,
+        exitCode,
+        output: combined || (success ? "Verification succeeded cleanly." : "Command failed with empty output."),
+        durationMs
       };
     } catch (err) {
+      const durationMs = Math.round(performance.now() - startTime);
       return {
-        output: `Failed to apply patch to '${rawPath}': ${err instanceof Error ? err.message : String(err)}`,
-        isError: true
+        command,
+        success: false,
+        exitCode: 1,
+        output: `Verification execution error: ${err.message || String(err)}`,
+        durationMs
       };
     }
   }
-};
-// src/security/kernel/windows.ts
+}
+// src/session/turn.ts
+async function runTurn(session, turnContext, input) {
+  const { turnId, signal } = turnContext;
+  session.emitEvent({
+    type: "TurnStarted",
+    turnId
+  });
+  const currentHistory = session.getHistory();
+  const estimatedTokens = estimateTotalTokens(currentHistory);
+  const maxTokenLimit = DEFAULT_AUTO_COMPACT_THRESHOLD_TOKENS;
+  if (estimatedTokens > maxTokenLimit) {
+    const compacted = compactHistory(currentHistory);
+    session.setHistory(compacted);
+    session.emitEvent({
+      type: "Warning",
+      message: `Auto-compacted conversation history (${estimatedTokens} estimated tokens exceeded limit).`
+    });
+  }
+  const userItem = {
+    id: `msg_user_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
+    type: "user_message",
+    content: typeof input === "string" ? input : input?.text ?? input?.prompt ?? "",
+    images: typeof input === "object" ? input?.images : undefined,
+    createdAt: Date.now()
+  };
+  session.addHistoryItem(userItem);
+  session.emitEvent({
+    type: "ItemCompleted",
+    turnId,
+    item: userItem
+  });
+  const cwd = turnContext.environment.cwd;
+  const worldState = await captureWorldState(cwd);
+  const memoriesPrompt = session.memoryStore?.formatMemoriesPrompt(cwd);
+  const skillsPrompt = session.skillsLoader?.formatSkillsPrompt(cwd);
+  const mcpPrompt = session.mcpManager?.formatMcpPrompt();
+  const effectiveSystemPrompt = buildSystemPrompt({
+    basePrompt: session.systemPrompt || undefined,
+    worldStatePrompt: formatWorldStatePrompt(worldState),
+    memoriesPrompt,
+    skillsPrompt,
+    mcpPrompt,
+    isOrchestrator: session.tools.has("spawn_agent"),
+    cwd
+  });
+  let iteration = 0;
+  let accumulatedInputTokens = 0;
+  let accumulatedOutputTokens = 0;
+  let accumulatedCachedTokens = 0;
+  const clientSession = session.modelClient.newSession();
+  const modifiedFiles = new Set;
+  let selfHealingAttempts = 0;
+  let hasRunVerification = false;
+  try {
+    while (iteration < turnContext.maxIterations) {
+      if (signal.aborted) {
+        throw new TurnAbortedError;
+      }
+      iteration++;
+      let currentAgentText = "";
+      const toolCallRequests = [];
+      let iterInputTokens = Math.ceil((effectiveSystemPrompt.length + JSON.stringify(session.getHistory()).length) / 4);
+      let iterOutputTokens = 0;
+      const stream = clientSession.stream({
+        model: turnContext.model,
+        systemPrompt: effectiveSystemPrompt,
+        history: session.getHistory(),
+        tools: turnContext.tools,
+        signal,
+        enablePromptCache: true
+      });
+      for await (const chunk of stream) {
+        if (signal.aborted) {
+          throw new TurnAbortedError;
+        }
+        if (chunk.type === "reasoning_delta") {
+          session.emitEvent({
+            type: "ReasoningDelta",
+            turnId,
+            delta: chunk.delta
+          });
+        } else if (chunk.type === "text_delta") {
+          currentAgentText += chunk.delta;
+          session.emitEvent({
+            type: "AgentMessageDelta",
+            turnId,
+            delta: chunk.delta
+          });
+        } else if (chunk.type === "tool_call") {
+          toolCallRequests.push(chunk);
+        } else if (chunk.type === "done") {
+          if (chunk.inputTokens !== undefined)
+            iterInputTokens = chunk.inputTokens;
+          if (chunk.outputTokens !== undefined)
+            iterOutputTokens = chunk.outputTokens;
+          if (chunk.cachedTokens !== undefined)
+            accumulatedCachedTokens += chunk.cachedTokens;
+        } else if (chunk.type === "error") {
+          throw chunk.error;
+        }
+      }
+      if (iterOutputTokens === 0) {
+        iterOutputTokens = Math.ceil((currentAgentText.length + JSON.stringify(toolCallRequests).length) / 4);
+      }
+      accumulatedInputTokens += iterInputTokens;
+      accumulatedOutputTokens += iterOutputTokens;
+      if (currentAgentText.trim()) {
+        const agentItem = {
+          id: `msg_agent_${Date.now()}`,
+          type: "agent_message",
+          content: currentAgentText,
+          createdAt: Date.now()
+        };
+        session.addHistoryItem(agentItem);
+        session.emitEvent({
+          type: "ItemCompleted",
+          turnId,
+          item: agentItem
+        });
+      }
+      if (toolCallRequests.length > 0) {
+        for (const toolCall of toolCallRequests) {
+          if (!toolCall.name || !toolCall.name.trim())
+            continue;
+          const functionCallItem = {
+            id: `call_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
+            type: "function_call",
+            callId: toolCall.callId,
+            name: toolCall.name,
+            arguments: toolCall.arguments,
+            createdAt: Date.now()
+          };
+          session.addHistoryItem(functionCallItem);
+          session.emitEvent({
+            type: "ItemStarted",
+            turnId,
+            item: functionCallItem
+          });
+          session.emitEvent({
+            type: "ToolCallStarted",
+            turnId,
+            toolName: toolCall.name,
+            arguments: toolCall.arguments
+          });
+          const toolResult = await turnContext.tools.execute(toolCall.name, toolCall.arguments, {
+            cwd: turnContext.environment.cwd,
+            turnId,
+            signal,
+            execPolicy: session.execPolicy,
+            mode: session.collaborationMode,
+            permissionMode: session.permissionMode,
+            onPlanUpdate: (plan, explanation) => {
+              session.emitEvent({
+                type: "PlanUpdated",
+                turnId,
+                explanation,
+                plan
+              });
+            },
+            requestApproval: async (description, command, prefixRule) => {
+              const approvalId = `appr_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
+              return session.requestApproval({
+                approvalId,
+                turnId,
+                toolName: toolCall.name,
+                description,
+                command
+              });
+            },
+            requestInput: async (question, options) => {
+              const questionId = `quest_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
+              return session.requestUserQuestion({
+                questionId,
+                turnId,
+                question,
+                options
+              });
+            }
+          });
+          const functionOutputItem = {
+            id: `out_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
+            type: "function_call_output",
+            callId: toolCall.callId,
+            output: toolResult.output,
+            isError: toolResult.isError,
+            createdAt: Date.now()
+          };
+          if (!toolResult.isError) {
+            if (toolCall.name === "apply_patch" || toolCall.name === "write_file") {
+              const p = String(toolCall.arguments?.path || "");
+              if (p) {
+                modifiedFiles.add(p);
+                hasRunVerification = false;
+              }
+            }
+          }
+          session.addHistoryItem(functionOutputItem);
+          session.emitEvent({
+            type: "ToolCallFinished",
+            turnId,
+            toolName: toolCall.name,
+            output: toolResult.output,
+            isError: toolResult.isError
+          });
+          session.emitEvent({
+            type: "ItemCompleted",
+            turnId,
+            item: functionOutputItem
+          });
+        }
+        continue;
+      }
+      if (session.autoVerification && modifiedFiles.size > 0 && !hasRunVerification && iteration < turnContext.maxIterations) {
+        const verifier = new AutoVerifier({
+          cwd,
+          customCommand: session.autoVerificationCommand
+        });
+        const command = verifier.resolveVerificationCommand();
+        if (command) {
+          session.emitEvent({
+            type: "VerificationStarted",
+            turnId,
+            command,
+            modifiedFiles: Array.from(modifiedFiles)
+          });
+          const vResult = verifier.verify(Array.from(modifiedFiles));
+          session.emitEvent({
+            type: "VerificationCompleted",
+            turnId,
+            command: vResult.command,
+            success: vResult.success,
+            output: vResult.output,
+            durationMs: vResult.durationMs
+          });
+          if (!vResult.success) {
+            if (selfHealingAttempts < session.maxSelfHealingAttempts) {
+              selfHealingAttempts++;
+              session.emitEvent({
+                type: "SelfHealingStarted",
+                turnId,
+                attempt: selfHealingAttempts,
+                maxAttempts: session.maxSelfHealingAttempts,
+                command: vResult.command,
+                error: vResult.output
+              });
+              const feedbackMsg = `[Automated Self-Verification Failure]
+Verification command '${vResult.command}' failed with exit code ${vResult.exitCode}.
+
+Error trace / compiler output:
+${vResult.output}
+
+Modified file(s) in this turn: ${Array.from(modifiedFiles).join(", ")}
+
+Self-Healing Directive (Attempt ${selfHealingAttempts} of ${session.maxSelfHealingAttempts}):
+1. Review the error trace above carefully and locate the exact root cause.
+2. Formulate and apply the necessary surgical fix using 'apply_patch' or 'write_file'.
+3. Do NOT conclude the turn or report to the user until this error is resolved and verification passes cleanly.`;
+              session.addHistoryItem({
+                id: `msg_heal_${Date.now()}`,
+                type: "user_message",
+                content: feedbackMsg,
+                createdAt: Date.now()
+              });
+              continue;
+            } else {
+              session.emitEvent({
+                type: "Warning",
+                message: `Auto-verification failed after ${selfHealingAttempts} self-healing attempts for command: ${vResult.command}`
+              });
+              hasRunVerification = true;
+            }
+          } else {
+            hasRunVerification = true;
+          }
+        }
+      }
+      if (!currentAgentText.trim() && toolCallRequests.length === 0) {
+        if (iteration === 1 && iteration < turnContext.maxIterations) {
+          session.addHistoryItem({
+            id: `msg_nudge_${Date.now()}`,
+            type: "user_message",
+            content: `[Systematic ReAct Nudge]: No tool actions or answers were produced in this iteration.
+1. Review the user's objective and determine the immediate next action.
+2. If more context is required, invoke an exploration tool ('read_file', 'list_dir', 'grep_search', 'find_files').
+3. If ready to answer or implement, call the required mutating tool or deliver your full, concrete response now.`,
+            createdAt: Date.now()
+          });
+          continue;
+        }
+      }
+      break;
+    }
+    const totalContextTokens = estimateTotalTokens(session.getHistory()) + Math.ceil(effectiveSystemPrompt.length / 4);
+    const maxContextTokens = DEFAULT_MAX_CONTEXT_TOKENS;
+    session.emitEvent({
+      type: "TurnCompleted",
+      turnId,
+      inputTokens: accumulatedInputTokens,
+      outputTokens: accumulatedOutputTokens,
+      totalTokens: accumulatedInputTokens + accumulatedOutputTokens,
+      cachedTokens: accumulatedCachedTokens > 0 ? accumulatedCachedTokens : undefined,
+      contextTokens: totalContextTokens,
+      maxContextTokens
+    });
+  } catch (error) {
+    const isAborted = error instanceof TurnAbortedError || signal.aborted;
+    const message = isAborted ? "Turn was interrupted" : error instanceof Error ? error.message : String(error);
+    session.emitEvent({
+      type: "Error",
+      turnId,
+      message,
+      code: isAborted ? "TURN_ABORTED" : "EXECUTION_ERROR"
+    });
+  } finally {
+    session.clearActiveTurn(turnId);
+    globalEphemeralWorkspace.cleanupTurn(turnId);
+    globalEphemeralWorkspace.cleanRootResidue(turnContext.environment.cwd);
+  }
+}
+
+// src/session/turn-input.ts
+async function handleTurnInput(session, request) {
+  const activeTurn = session.getActiveTurn();
+  if (!activeTurn) {
+    const turnId = `turn_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
+    const turnContext = new TurnContext(turnId, session.model, session.tools, { cwd: session.cwd });
+    session.setActiveTurn(turnContext);
+    runTurn(session, turnContext, request).catch((err) => {
+      session.emitEvent({
+        type: "Error",
+        turnId,
+        message: `Unhandled turn error: ${err instanceof Error ? err.message : String(err)}`
+      });
+    });
+    return {
+      kind: "started",
+      turnId
+    };
+  }
+  session.addHistoryItem({
+    id: `steer_${Date.now()}`,
+    type: "user_message",
+    content: `[Steering Guidance]: ${request.text}`,
+    images: request.images,
+    createdAt: Date.now()
+  });
+  return {
+    kind: "steered",
+    turnId: activeTurn.turnId
+  };
+}
+
+// src/session/submission-loop.ts
+async function submissionLoop(session, queue) {
+  for await (const submission of queue) {
+    const { op } = submission;
+    switch (op.type) {
+      case "TurnInput": {
+        const text = op.request?.text ?? op.prompt ?? (typeof op.request === "string" ? op.request : "");
+        const images = op.request?.images ?? op.images;
+        await handleTurnInput(session, {
+          text,
+          images,
+          clientId: op.request?.clientId,
+          additionalContext: op.request?.additionalContext
+        });
+        break;
+      }
+      case "Interrupt": {
+        session.interrupt();
+        break;
+      }
+      case "ExecApproval": {
+        session.resolveApproval(op.approvalId, op.approved);
+        break;
+      }
+      case "Shutdown": {
+        session.interrupt();
+        session.emitEvent({
+          type: "StatusChanged",
+          status: "terminated"
+        });
+        return;
+      }
+    }
+  }
+}
+
+// src/security/exec-policy.ts
+class ExecPolicy {
+  rules = [];
+  mode = "auto";
+  constructor(initialMode = "auto") {
+    this.mode = initialMode;
+    this.initDefaultRules();
+  }
+  getMode() {
+    return this.mode;
+  }
+  setMode(mode) {
+    this.mode = mode;
+  }
+  initDefaultRules() {
+    this.addRule(/^(git\s+(status|log|diff|branch|show|rev-parse))/i, "allow", "Safe git query");
+    this.addRule(/^(ls|dir|cat|type|grep|rg|find|pwd|echo|head|tail|wc|which|where)\b/i, "allow", "Safe read-only shell command");
+    this.addRule(/^(bun\s+(test|--version|-v)|npm\s+(test|--version|-v)|node\s+-v)\b/i, "allow", "Testing & runtime check");
+    this.addRule(/^(rm|del|rmdir|format|mkfs)\b/i, "prompt", "Destructive file removal");
+    this.addRule(/^(git\s+(push|reset\s+--hard|clean\s+-fd|rebase))\b/i, "prompt", "Destructive git operation");
+    this.addRule(/^(curl|wget|fetch|ssh|scp|ftp)\b/i, "prompt", "Network / remote transfer");
+  }
+  addRule(pattern, decision, description) {
+    this.rules.unshift({ pattern, decision, description });
+  }
+  shouldPromptFileEdit(filePath) {
+    if (this.mode === "plan") {
+      return {
+        prompt: true,
+        isPlanBlocked: true,
+        reason: `[Plan Mode Gate] Approval required to mutate '${filePath || "file"}' and proceed with implementation.`
+      };
+    }
+    if (this.mode === "manual") {
+      return {
+        prompt: true,
+        reason: `Manual mode requires approval to modify '${filePath || "file"}'`
+      };
+    }
+    return { prompt: false };
+  }
+  evaluate(command) {
+    const trimmed = command.trim();
+    if (this.mode === "plan") {
+      const isReadOnly = /^(git\s+(status|log|diff|branch|show|rev-parse)|ls|dir|cat|type|grep|rg|find|pwd|which|where)\b/i.test(trimmed);
+      if (isReadOnly) {
+        return { decision: "allow", reason: "Read-only inspection allowed in Plan mode" };
+      }
+      return {
+        decision: "prompt",
+        reason: `[Plan Mode Gate] Approval required to execute shell command '${trimmed}' in Plan Mode`
+      };
+    }
+    if (this.mode === "manual") {
+      return {
+        decision: "prompt",
+        reason: "Manual mode requires confirmation for all shell commands"
+      };
+    }
+    if (this.mode === "accept-edits") {
+      const isReadOnly = /^(git\s+(status|log|diff|branch|show)|ls|dir|cat|type|grep|rg|find|pwd|bun\s+test|npm\s+test)\b/i.test(trimmed);
+      if (isReadOnly) {
+        return { decision: "allow", reason: "Safe read-only command in accept-edits mode" };
+      }
+      return {
+        decision: "prompt",
+        reason: "Accept-edits mode requires approval for active shell commands"
+      };
+    }
+    for (const rule of this.rules) {
+      if (rule.pattern.test(trimmed)) {
+        return {
+          decision: rule.decision,
+          reason: rule.description
+        };
+      }
+    }
+    return {
+      decision: "allow",
+      reason: "Auto mode allows execution"
+    };
+  }
+}
+
+// src/session/session.ts
+class Session {
+  threadId;
+  model;
+  cwd;
+  systemPrompt;
+  modelClient;
+  tools;
+  skillsLoader;
+  memoryStore;
+  mcpManager;
+  execPolicy;
+  collaborationMode = "default";
+  autoVerification;
+  autoVerificationCommand;
+  maxSelfHealingAttempts;
+  get permissionMode() {
+    return this.execPolicy.getMode();
+  }
+  setPermissionMode(mode) {
+    this.execPolicy.setMode(mode);
+    if (mode === "plan") {
+      this.collaborationMode = "plan";
+    } else if (this.collaborationMode === "plan") {
+      this.collaborationMode = "default";
+    }
+  }
+  history = [];
+  activeTurn = null;
+  status = "idle";
+  eventListeners = [];
+  pendingApprovals = new Map;
+  pendingUserQuestions = new Map;
+  submissionResolvers = [];
+  submissionQueue = [];
+  isTerminated = false;
+  constructor(options = {}) {
+    this.threadId = options.threadId || `thread_${Date.now()}`;
+    this.model = options.model || "gpt-4o";
+    this.cwd = options.cwd || process.cwd();
+    this.systemPrompt = options.systemPrompt || "";
+    this.modelClient = options.modelClient || new ModelClient;
+    this.tools = options.tools || new ToolRouter;
+    this.skillsLoader = options.skillsLoader;
+    this.memoryStore = options.memoryStore;
+    this.mcpManager = options.mcpManager;
+    this.execPolicy = options.execPolicy || new ExecPolicy;
+    this.collaborationMode = options.collaborationMode || "default";
+    this.autoVerification = options.autoVerification ?? (process.env.PIKAA_AUTO_VERIFY !== "0" && process.env.PIKAA_AUTO_VERIFY !== "false");
+    this.autoVerificationCommand = options.autoVerificationCommand;
+    this.maxSelfHealingAttempts = options.maxSelfHealingAttempts ?? 3;
+    this.history = options.initialHistory ? [...options.initialHistory] : [];
+    if (options.onEvent) {
+      this.eventListeners.push(options.onEvent);
+    }
+    this.startSubmissionLoop();
+    this.emitEvent({
+      type: "SessionConfigured",
+      threadId: this.threadId,
+      model: this.model
+    });
+  }
+  onEvent(listener) {
+    this.eventListeners.push(listener);
+    return () => {
+      this.eventListeners = this.eventListeners.filter((l) => l !== listener);
+    };
+  }
+  emitEvent(msg) {
+    if (msg.type === "StatusChanged") {
+      this.status = msg.status;
+    }
+    const event = {
+      id: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
+      timestamp: Date.now(),
+      msg
+    };
+    for (const listener of this.eventListeners) {
+      try {
+        listener(event);
+      } catch (err) {
+        console.error("Error in event listener:", err);
+      }
+    }
+  }
+  getHistory() {
+    return [...this.history];
+  }
+  setHistory(items) {
+    this.history = [...items];
+  }
+  addHistoryItem(item) {
+    this.history.push(item);
+  }
+  getActiveTurn() {
+    return this.activeTurn;
+  }
+  setActiveTurn(turn) {
+    this.activeTurn = turn;
+    this.emitEvent({
+      type: "StatusChanged",
+      status: "running"
+    });
+  }
+  clearActiveTurn(turnId) {
+    if (!turnId || this.activeTurn?.turnId === turnId) {
+      this.activeTurn = null;
+      this.emitEvent({
+        type: "StatusChanged",
+        status: "idle"
+      });
+    }
+  }
+  interrupt() {
+    if (this.activeTurn) {
+      this.activeTurn.abort("Interrupted by user");
+      this.clearActiveTurn();
+      this.emitEvent({
+        type: "StatusChanged",
+        status: "interrupted"
+      });
+    }
+  }
+  requestApproval(params) {
+    this.emitEvent({
+      type: "ApprovalRequired",
+      approvalId: params.approvalId,
+      turnId: params.turnId,
+      toolName: params.toolName,
+      description: params.description,
+      command: params.command
+    });
+    this.emitEvent({
+      type: "StatusChanged",
+      status: "waiting_approval"
+    });
+    return new Promise((resolve) => {
+      this.pendingApprovals.set(params.approvalId, (approved) => {
+        this.emitEvent({
+          type: "StatusChanged",
+          status: "running"
+        });
+        resolve(approved);
+      });
+    });
+  }
+  resolveApproval(approvalId, approved) {
+    const resolver = this.pendingApprovals.get(approvalId);
+    if (resolver) {
+      this.pendingApprovals.delete(approvalId);
+      resolver(approved);
+    }
+  }
+  requestUserQuestion(params) {
+    this.emitEvent({
+      type: "UserQuestionRequired",
+      questionId: params.questionId,
+      turnId: params.turnId,
+      question: params.question,
+      options: params.options
+    });
+    this.emitEvent({
+      type: "StatusChanged",
+      status: "waiting_user_input"
+    });
+    return new Promise((resolve) => {
+      this.pendingUserQuestions.set(params.questionId, (answer) => {
+        this.emitEvent({
+          type: "StatusChanged",
+          status: "running"
+        });
+        resolve(answer);
+      });
+    });
+  }
+  resolveUserQuestion(questionId, answer) {
+    const resolver = this.pendingUserQuestions.get(questionId);
+    if (resolver) {
+      this.pendingUserQuestions.delete(questionId);
+      resolver(answer);
+    }
+  }
+  async submit(op) {
+    const subId = `sub_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
+    const submission = {
+      id: subId,
+      op,
+      createdAt: Date.now()
+    };
+    const resolver = this.submissionResolvers.shift();
+    if (resolver) {
+      resolver(submission);
+    } else {
+      this.submissionQueue.push(submission);
+    }
+    return subId;
+  }
+  async prompt(text, images) {
+    return handleTurnInput(this, { text, images });
+  }
+  async promptAndWait(text, images, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        unsub();
+        reject(new Error(`Turn timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+      const unsub = this.onEvent((event) => {
+        if (event.msg.type === "TurnCompleted") {
+          clearTimeout(timer);
+          unsub();
+          resolve();
+        } else if (event.msg.type === "Error") {
+          clearTimeout(timer);
+          unsub();
+          reject(new Error(event.msg.message));
+        }
+      });
+      this.prompt(text, images).catch((err) => {
+        clearTimeout(timer);
+        unsub();
+        reject(err);
+      });
+    });
+  }
+  async* createSubmissionIterator() {
+    while (!this.isTerminated) {
+      if (this.submissionQueue.length > 0) {
+        yield this.submissionQueue.shift();
+      } else {
+        const nextSub = await new Promise((resolve) => {
+          this.submissionResolvers.push(resolve);
+        });
+        yield nextSub;
+      }
+    }
+  }
+  startSubmissionLoop() {
+    const iterator = this.createSubmissionIterator();
+    submissionLoop(this, iterator).catch((err) => {
+      console.error("Submission loop terminated with error:", err);
+    });
+  }
+}
+// src/tools/handlers/apply-patch.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve5, dirname as dirname3 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+var applyPatchTool = {
+  name: "apply_patch",
+  description: "Apply precise multi-line modifications to an existing file or create a new file. TargetContent must match the file content exactly.",
+  parameters: {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "Relative or absolute path to the target file"
+      },
+      targetContent: {
+        type: "string",
+        description: "The exact block of code in the file to be replaced. For creating a new file, leave this empty."
+      },
+      replacementContent: {
+        type: "string",
+        description: "The new code content to replace the targetContent with."
+      }
+    },
+    required: ["path", "replacementContent"]
+  },
+  async execute(args, ctx) {
+    const rawPath = String(args.path || "");
+    if (!rawPath) {
+      return { output: "Error: 'path' parameter is required", isError: true };
+    }
+    const filePath = resolve5(ctx.cwd, rawPath);
+    const targetContent = typeof args.targetContent === "string" ? args.targetContent : "";
+    const replacementContent = String(args.replacementContent ?? "");
+    if (ctx.execPolicy) {
+      const evalResult = ctx.execPolicy.shouldPromptFileEdit(rawPath);
+      if (evalResult.prompt && ctx.requestApproval) {
+        const approval = await ctx.requestApproval(evalResult.reason || `Apply patch to: ${rawPath}`, `apply_patch ${rawPath}`);
+        const allowed = typeof approval === "object" ? approval.allowed : Boolean(approval);
+        if (!allowed) {
+          return {
+            output: `[Plan Mode Gate]: File modification declined by user for '${rawPath}'. Please refine your implementation plan or ask the user for guidance.`,
+            isError: true
+          };
+        }
+      } else if (evalResult.isPlanBlocked || ctx.mode === "plan") {
+        return {
+          output: `[Plan Mode Gate]: Cannot mutate '${rawPath}' while in Plan Mode without user approval. Please present your implementation plan first.`,
+          isError: true
+        };
+      }
+    }
+    if (!existsSync8(filePath)) {
+      if (targetContent) {
+        return {
+          output: `Error: Target file '${rawPath}' does not exist, but targetContent was provided.
+[Systematic Error Recovery Checklist]:
+1. Root Cause: Trying to patch a non-existent file with targetContent.
+2. Fix: For creating new files, leave 'targetContent' empty and provide full contents in 'replacementContent'.
+3. Alternatively, check if the file path '${rawPath}' was mistyped.`,
+          isError: true
+        };
+      }
+      try {
+        mkdirSync4(dirname3(filePath), { recursive: true });
+        writeFileSync2(filePath, replacementContent, "utf8");
+        return { output: `Successfully created new file '${rawPath}'` };
+      } catch (err) {
+        return {
+          output: `Failed to create file '${rawPath}': ${err instanceof Error ? err.message : String(err)}`,
+          isError: true
+        };
+      }
+    }
+    try {
+      const originalFileContent = readFileSync6(filePath, "utf8");
+      if (!targetContent) {
+        return {
+          output: `Error: File '${rawPath}' already exists, but targetContent was empty.
+[Systematic Error Recovery Checklist]:
+1. Root Cause: An existing file requires targetContent to specify which lines to replace.
+2. Fix: Call 'read_file' on '${rawPath}', extract the exact target lines, and provide them in 'targetContent'.
+3. To overwrite the whole file, use the 'write_file' tool instead.`,
+          isError: true
+        };
+      }
+      const firstIndex = originalFileContent.indexOf(targetContent);
+      if (firstIndex === -1) {
+        return {
+          output: `Error: targetContent was not found in '${rawPath}'.
+[Systematic Error Recovery Checklist]:
+1. Root Cause: The snippet in targetContent does not match the actual file content (differences in whitespace, indentation, line endings, or prior edits).
+2. Action: Call 'read_file' on '${rawPath}' to inspect current exact lines and indentation.
+3. Fix: Provide the exact matching lines (including leading spaces) or wider context, then retry 'apply_patch'.`,
+          isError: true
+        };
+      }
+      const secondIndex = originalFileContent.indexOf(targetContent, firstIndex + 1);
+      if (secondIndex !== -1) {
+        return {
+          output: `Error: targetContent matched multiple locations in '${rawPath}'.
+[Systematic Error Recovery Checklist]:
+1. Root Cause: targetContent is ambiguous and occurs multiple times in the file.
+2. Action: Include 2-3 additional surrounding lines (before or after the target block) to make the target snippet uniquely identifiable.
+3. Fix: Re-run 'apply_patch' with the extended unique block.`,
+          isError: true
+        };
+      }
+      const newFileContent = originalFileContent.slice(0, firstIndex) + replacementContent + originalFileContent.slice(firstIndex + targetContent.length);
+      writeFileSync2(filePath, newFileContent, "utf8");
+      return {
+        output: `Successfully applied patch to '${rawPath}'`
+      };
+    } catch (err) {
+      return {
+        output: `Failed to apply patch to '${rawPath}': ${err instanceof Error ? err.message : String(err)}`,
+        isError: true
+      };
+    }
+  }
+};
+// src/security/kernel/windows.ts
 import { dlopen, FFIType } from "bun:ffi";
 
 class WindowsSandbox {
@@ -1950,7 +2524,7 @@ class WindowsSandbox {
 }
 
 // src/security/kernel/linux.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 
 class LinuxSandbox {
   hasBwrap = false;
@@ -1961,7 +2535,7 @@ class LinuxSandbox {
     if (process.platform !== "linux") {
       return;
     }
-    this.hasBwrap = existsSync7("/usr/bin/bwrap") || existsSync7("/bin/bwrap") || existsSync7("/usr/local/bin/bwrap");
+    this.hasBwrap = existsSync9("/usr/bin/bwrap") || existsSync9("/bin/bwrap") || existsSync9("/usr/local/bin/bwrap");
   }
   wrapCommand(cmd, profile) {
     if (!this.hasBwrap || profile.kind === "danger-unrestricted") {
@@ -1995,7 +2569,7 @@ class LinuxSandbox {
 }
 
 // src/security/kernel/macos.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 
 class MacOSSandbox {
   hasSandboxExec = false;
@@ -2006,7 +2580,7 @@ class MacOSSandbox {
     if (process.platform !== "darwin") {
       return;
     }
-    this.hasSandboxExec = existsSync8("/usr/bin/sandbox-exec");
+    this.hasSandboxExec = existsSync10("/usr/bin/sandbox-exec");
   }
   generateProfile(profile) {
     const rules = [
@@ -2116,7 +2690,7 @@ var globalKernelSandbox = new KernelSandboxManager;
 
 // src/storage/prefix-rules-store.ts
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5 } from "fs";
 import { dirname as dirname4, resolve as resolve7 } from "path";
 class PrefixRulesStore {
   db;
@@ -2127,7 +2701,7 @@ class PrefixRulesStore {
       const effectivePath = dbOrPath || getPrefixRulesDbPath();
       if (effectivePath !== ":memory:") {
         const dir = dirname4(effectivePath);
-        if (!existsSync9(dir)) {
+        if (!existsSync11(dir)) {
           mkdirSync5(dir, { recursive: true });
         }
       }
@@ -2398,31 +2972,118 @@ ${result.stderr.trim()}`);
 }
 var shellTool = createShellTool();
 // src/tools/handlers/file-ops.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync10, statSync as statSync3, mkdirSync as mkdirSync6 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, existsSync as existsSync12, statSync as statSync4, mkdirSync as mkdirSync6 } from "fs";
 import { resolve as resolve8, dirname as dirname5 } from "path";
+var DEFAULT_MAX_UNPAGINATED_LINES = 250;
 var readFileTool = {
   name: "read_file",
-  description: "Read the full text content of a file.",
+  description: "Read file content with surgical line-range support. Supports start_line and end_line to inspect specific sections of large files without exhausting token context.",
   parameters: {
     type: "object",
     properties: {
-      path: { type: "string", description: "Relative or absolute path to the file." }
+      path: {
+        type: "string",
+        description: "Relative or absolute path to the file."
+      },
+      start_line: {
+        type: "number",
+        description: "Optional 1-indexed line number to start reading from (e.g. 120)."
+      },
+      end_line: {
+        type: "number",
+        description: "Optional 1-indexed line number to end reading at, inclusive (e.g. 180)."
+      },
+      offset: {
+        type: "number",
+        description: "Alias for start_line (1-indexed)."
+      },
+      limit: {
+        type: "number",
+        description: "Maximum number of lines to read."
+      },
+      line_numbers: {
+        type: "boolean",
+        description: "Whether to include line number prefixes ('<line>: <content>'). Defaults to true for range reads."
+      }
     },
     required: ["path"]
   },
   async execute(args, ctx) {
-    const filePath = resolve8(ctx.cwd, String(args.path || ""));
-    if (!existsSync10(filePath)) {
-      return { output: `Error: File not found: '${args.path}'`, isError: true };
+    const rawPath = String(args.path || "");
+    const filePath = resolve8(ctx.cwd, rawPath);
+    if (!existsSync12(filePath)) {
+      return { output: `Error: File not found: '${rawPath}'`, isError: true };
     }
     try {
-      const content = readFileSync5(filePath, "utf8");
-      return { output: content };
+      const content = readFileSync7(filePath, "utf8");
+      const lines = content.split(/\r?\n/);
+      const totalLines = lines.length;
+      const hasRange = args.start_line !== undefined || args.end_line !== undefined || args.startLine !== undefined || args.endLine !== undefined || args.offset !== undefined || args.limit !== undefined;
+      if (!hasRange) {
+        if (args.line_numbers === true) {
+          const formatted = lines.map((l, idx) => `${idx + 1}: ${l}`).join(`
+`);
+          return { output: formatted };
+        }
+        if (totalLines <= DEFAULT_MAX_UNPAGINATED_LINES) {
+          return { output: content };
+        }
+        const truncated = lines.slice(0, DEFAULT_MAX_UNPAGINATED_LINES);
+        const formatted = truncated.map((l, idx) => `${idx + 1}: ${l}`).join(`
+`);
+        return {
+          output: `[Showing lines 1 to ${DEFAULT_MAX_UNPAGINATED_LINES} of ${totalLines} in '${rawPath}']
+${formatted}
+
+[Truncated: ${totalLines - DEFAULT_MAX_UNPAGINATED_LINES} more lines. Use start_line=${DEFAULT_MAX_UNPAGINATED_LINES + 1} to continue reading.]`
+        };
+      }
+      const startArg = args.start_line ?? args.startLine ?? args.offset;
+      const start = Math.max(1, typeof startArg === "number" ? Math.floor(startArg) : 1);
+      let end;
+      const endArg = args.end_line ?? args.endLine;
+      if (typeof endArg === "number") {
+        end = Math.min(totalLines, Math.floor(endArg));
+      } else if (typeof args.limit === "number") {
+        end = Math.min(totalLines, start + Math.floor(args.limit) - 1);
+      } else {
+        end = Math.min(totalLines, start + DEFAULT_MAX_UNPAGINATED_LINES - 1);
+      }
+      if (start > totalLines) {
+        return {
+          output: `Error: start_line (${start}) exceeds total lines in file (${totalLines}).`,
+          isError: true
+        };
+      }
+      if (end < start) {
+        return {
+          output: `Error: end_line (${end}) cannot be less than start_line (${start}).`,
+          isError: true
+        };
+      }
+      const sliced = lines.slice(start - 1, end);
+      const withNums = args.line_numbers !== false;
+      const rendered = withNums ? sliced.map((l, idx) => `${start + idx}: ${l}`).join(`
+`) : sliced.join(`
+`);
+      let notice = `[Showing lines ${start} to ${end} of ${totalLines} in '${rawPath}']
+${rendered}`;
+      if (end < totalLines) {
+        notice += `
+
+[File has ${totalLines} lines. To read further, use start_line=${end + 1}.]`;
+      }
+      return { output: notice };
     } catch (err) {
       return { output: `Failed to read file: ${err instanceof Error ? err.message : String(err)}`, isError: true };
     }
   }
 };
+var viewFileTool = {
+  ...readFileTool,
+  name: "view_file",
+  description: "View file content with surgical line-range support. Alias for read_file matching Antigravity & Claude Code conventions."
+};
 var listDirTool = {
   name: "list_dir",
   description: "List contents of a directory with file names and types.",
@@ -2434,14 +3095,14 @@ var listDirTool = {
   },
   async execute(args, ctx) {
     const dirPath = resolve8(ctx.cwd, String(args.path || "."));
-    if (!existsSync10(dirPath)) {
+    if (!existsSync12(dirPath)) {
       return { output: `Error: Directory not found: '${args.path}'`, isError: true };
     }
     try {
-      const entries = readdirSync3(dirPath);
+      const entries = readdirSync4(dirPath);
       const formatted = entries.map((entry) => {
         const full = resolve8(dirPath, entry);
-        const isDir = statSync3(full).isDirectory();
+        const isDir = statSync4(full).isDirectory();
         return `${isDir ? "[DIR]" : "[FILE]"} ${entry}`;
       });
       return { output: formatted.join(`
@@ -2614,8 +3275,8 @@ var updatePlanTool = {
   }
 };
 // src/search/engine.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync4, existsSync as existsSync11 } from "fs";
-import { resolve as resolve9, relative, join as join5, extname } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync8, statSync as statSync5, existsSync as existsSync13 } from "fs";
+import { resolve as resolve9, relative, join as join7, extname } from "path";
 var DEFAULT_IGNORE_DIRS = new Set([
   ".git",
   "node_modules",
@@ -2661,7 +3322,7 @@ var BINARY_EXTENSIONS = new Set([
 class FileSearchEngine {
   grep(cwd, options) {
     const searchRoot = resolve9(cwd, options.path || ".");
-    if (!existsSync11(searchRoot)) {
+    if (!existsSync13(searchRoot)) {
       return { matches: [], totalMatches: 0, truncated: false };
     }
     const maxResults = options.maxResults || 50;
@@ -2686,7 +3347,7 @@ class FileSearchEngine {
       if (truncated)
         break;
       try {
-        const content = readFileSync6(filePath, "utf8");
+        const content = readFileSync8(filePath, "utf8");
         const lines = content.split(`
 `);
         for (let i = 0;i < lines.length; i++) {
@@ -2711,7 +3372,7 @@ class FileSearchEngine {
   }
   findFiles(cwd, options) {
     const searchRoot = resolve9(cwd, options.path || ".");
-    if (!existsSync11(searchRoot))
+    if (!existsSync13(searchRoot))
       return [];
     const maxResults = options.maxResults || 100;
     const gitignoreRules = this.loadGitignoreRules(searchRoot);
@@ -2750,10 +3411,10 @@ class FileSearchEngine {
   }
   loadGitignoreRules(root) {
     const rules = new Set;
-    const gitignorePath = join5(root, ".gitignore");
-    if (existsSync11(gitignorePath)) {
+    const gitignorePath = join7(root, ".gitignore");
+    if (existsSync13(gitignorePath)) {
       try {
-        const lines = readFileSync6(gitignorePath, "utf8").split(`
+        const lines = readFileSync8(gitignorePath, "utf8").split(`
 `);
         for (const line of lines) {
           const trimmed = line.trim();
@@ -2768,7 +3429,7 @@ class FileSearchEngine {
   collectFiles(dir, root, gitignoreRules, includePattern) {
     const results = [];
     try {
-      const stat = statSync4(dir);
+      const stat = statSync5(dir);
       if (!stat.isDirectory()) {
         if (!this.isBinary(dir)) {
           results.push(dir);
@@ -2782,9 +3443,9 @@ class FileSearchEngine {
     while (queue.length > 0) {
       const currentDir = queue.shift();
       try {
-        const entries = readdirSync4(currentDir, { withFileTypes: true });
+        const entries = readdirSync5(currentDir, { withFileTypes: true });
         for (const entry of entries) {
-          const fullPath = join5(currentDir, entry.name);
+          const fullPath = join7(currentDir, entry.name);
           const relToRoot = relative(root, fullPath).replace(/\\/g, "/");
           if (this.isIgnored(entry.name, relToRoot, gitignoreRules)) {
             continue;
@@ -2936,7 +3597,13 @@ function createFileSearchTools(engine = new FileSearchEngine) {
 `) };
     }
   };
-  return [grepSearchTool, findFilesTool];
+  const findByNameTool = {
+    name: "find_by_name",
+    description: "Search for files and directories across the workspace matching a name or glob pattern. Alias for find_files matching Antigravity & Claude Code conventions.",
+    parameters: findFilesTool.parameters,
+    execute: findFilesTool.execute
+  };
+  return [grepSearchTool, findFilesTool, findByNameTool];
 }
 
 // src/code-mode/tools-proxy.ts
@@ -3455,6 +4122,7 @@ function createDefaultTools(options = {}) {
   router2.register(applyPatchTool);
   router2.register(shellTool);
   router2.register(readFileTool);
+  router2.register(viewFileTool);
   router2.register(writeFileTool);
   router2.register(listDirTool);
   router2.register(requestUserInputTool);
@@ -3483,8 +4151,8 @@ function createDefaultTools(options = {}) {
 }
 
 // src/agents/roles.ts
-import { existsSync as existsSync12, readdirSync as readdirSync5, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve10, join as join6 } from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve10, join as join8 } from "path";
 
 class AgentRoleRegistry {
   roles = new Map;
@@ -3569,13 +4237,13 @@ class AgentRoleRegistry {
   }
   loadRolesFromDir(dirPath) {
     const fullPath = resolve10(dirPath);
-    if (!existsSync12(fullPath))
+    if (!existsSync14(fullPath))
       return;
-    const entries = readdirSync5(fullPath);
+    const entries = readdirSync6(fullPath);
     for (const entry of entries) {
       if (entry.endsWith(".json")) {
         try {
-          const content = readFileSync7(join6(fullPath, entry), "utf8");
+          const content = readFileSync9(join8(fullPath, entry), "utf8");
           const parsed = JSON.parse(content);
           if (parsed.name && parsed.systemPrompt) {
             this.registerRole(parsed);
@@ -3628,7 +4296,7 @@ function createAgentIdentity(parentId, harnessId = "groupy-harness-v1") {
 // src/agents/graph-store.ts
 import { Database as Database2 } from "bun:sqlite";
 import { resolve as resolve11 } from "path";
-import { existsSync as existsSync13, mkdirSync as mkdirSync7 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7 } from "fs";
 class AgentGraphStore {
   db;
   constructor(dbPathOrDb) {
@@ -3638,7 +4306,7 @@ class AgentGraphStore {
       const dbPath = dbPathOrDb || getAgentGraphDbPath();
       if (dbPath !== ":memory:") {
         const dir = resolve11(dbPath, "..");
-        if (!existsSync13(dir)) {
+        if (!existsSync15(dir)) {
           mkdirSync7(dir, { recursive: true });
         }
       }
@@ -4063,8 +4731,8 @@ function registerMultiAgentTools(router, spawner) {
 }
 
 // src/mcp/manager.ts
-import { existsSync as existsSync14, readFileSync as readFileSync8, writeFileSync as writeFileSync4, mkdirSync as mkdirSync8 } from "fs";
-import { resolve as resolve12, dirname as dirname6, join as join7 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync10, writeFileSync as writeFileSync4, mkdirSync as mkdirSync8 } from "fs";
+import { resolve as resolve12, dirname as dirname6, join as join9 } from "path";
 
 // src/mcp/client.ts
 class McpClient {
@@ -4262,7 +4930,7 @@ class McpClient {
 }
 
 // src/mcp/process-killer.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 
 class GlobalProcessRegistry {
   static trackedProcesses = new Map;
@@ -4272,7 +4940,7 @@ class GlobalProcessRegistry {
       return;
     if (process.platform === "win32") {
       try {
-        spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], {
+        spawnSync2("taskkill", ["/pid", String(pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -4680,11 +5348,11 @@ class McpManager {
   }
   async loadConfigFile(filePath) {
     const fullPath = resolve12(filePath);
-    if (!existsSync14(fullPath))
+    if (!existsSync16(fullPath))
       return;
     this.loadedConfigFiles.add(fullPath);
     try {
-      const content = readFileSync8(fullPath, "utf8");
+      const content = readFileSync10(fullPath, "utf8");
       const parsed = JSON.parse(content);
       if (parsed.mcpServers) {
         await this.loadConfig(parsed);
@@ -4935,13 +5603,13 @@ class McpManager {
   saveServerToConfigFile(filePath, name, config) {
     const fullPath = resolve12(filePath);
     const dir = dirname6(fullPath);
-    if (!existsSync14(dir)) {
+    if (!existsSync16(dir)) {
       mkdirSync8(dir, { recursive: true });
     }
     let existing = { mcpServers: {} };
-    if (existsSync14(fullPath)) {
+    if (existsSync16(fullPath)) {
       try {
-        const content = readFileSync8(fullPath, "utf8");
+        const content = readFileSync10(fullPath, "utf8");
         existing = JSON.parse(content);
         if (!existing.mcpServers)
           existing.mcpServers = {};
@@ -4954,10 +5622,10 @@ class McpManager {
   }
   removeServerFromConfigFile(filePath, name) {
     const fullPath = resolve12(filePath);
-    if (!existsSync14(fullPath))
+    if (!existsSync16(fullPath))
       return false;
     try {
-      const content = readFileSync8(fullPath, "utf8");
+      const content = readFileSync10(fullPath, "utf8");
       const existing = JSON.parse(content);
       if (existing.mcpServers && existing.mcpServers[name]) {
         delete existing.mcpServers[name];
@@ -4984,11 +5652,11 @@ class McpManager {
     }
   }
   getDefaultConfigFile(cwd = process.cwd()) {
-    const workspaceConfig = join7(cwd, ".mcp.json");
-    if (existsSync14(workspaceConfig))
+    const workspaceConfig = join9(cwd, ".mcp.json");
+    if (existsSync16(workspaceConfig))
       return workspaceConfig;
-    const altConfig = join7(cwd, "mcp_config.json");
-    if (existsSync14(altConfig))
+    const altConfig = join9(cwd, "mcp_config.json");
+    if (existsSync16(altConfig))
       return altConfig;
     return workspaceConfig;
   }
@@ -5009,7 +5677,7 @@ class McpManager {
 
 // src/storage/sqlite-store.ts
 import { Database as Database3 } from "bun:sqlite";
-import { existsSync as existsSync15, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9 } from "fs";
 import { dirname as dirname7 } from "path";
 class SqliteThreadStore {
   db;
@@ -5017,7 +5685,7 @@ class SqliteThreadStore {
     const effectivePath = dbPath || this.getDefaultDbPath();
     if (effectivePath !== ":memory:") {
       const dir = dirname7(effectivePath);
-      if (!existsSync15(dir)) {
+      if (!existsSync17(dir)) {
         mkdirSync9(dir, { recursive: true });
       }
     }
@@ -5273,8 +5941,8 @@ class SessionPersistenceManager {
 }
 
 // src/skills/loader.ts
-import { existsSync as existsSync16, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve13, join as join8 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync7, readFileSync as readFileSync11 } from "fs";
+import { resolve as resolve13, join as join10 } from "path";
 var __dirname = "/home/runner/work/agent-cli/agent-cli/src/skills";
 
 class SkillsLoader {
@@ -5344,7 +6012,7 @@ class SkillsLoader {
         resolve13(cwd, "skills")
       ];
       for (const cand of candidates) {
-        if (existsSync16(cand) && !roots.includes(cand)) {
+        if (existsSync18(cand) && !roots.includes(cand)) {
           roots.push(cand);
         }
       }
@@ -5353,7 +6021,7 @@ class SkillsLoader {
       roots.push(getGlobalSkillsDir());
     }
     roots.push(...this.customRoots.map((r) => resolve13(r)));
-    return roots.filter((r) => existsSync16(r));
+    return roots.filter((r) => existsSync18(r));
   }
   discoverSkills(cwd, options) {
     return this.listSkills(cwd, options);
@@ -5369,12 +6037,12 @@ class SkillsLoader {
     const discovered = new Map;
     for (const root of roots) {
       try {
-        const entries = readdirSync6(root, { withFileTypes: true });
+        const entries = readdirSync7(root, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isDirectory()) {
-            const skillDir = join8(root, entry.name);
-            const skillFilePath = join8(skillDir, "SKILL.md");
-            if (existsSync16(skillFilePath)) {
+            const skillDir = join10(root, entry.name);
+            const skillFilePath = join10(skillDir, "SKILL.md");
+            if (existsSync18(skillFilePath)) {
               const meta = this.parseSkillFrontmatter(skillFilePath, entry.name, root, cwd);
               if (meta && !discovered.has(meta.name)) {
                 meta.enabled = !this.isSkillDisabled(meta.name);
@@ -5403,7 +6071,7 @@ class SkillsLoader {
     if (!meta)
       return null;
     try {
-      const raw = readFileSync9(meta.path, "utf8");
+      const raw = readFileSync11(meta.path, "utf8");
       const { body } = this.extractFrontmatterAndBody(raw);
       return {
         ...meta,
@@ -5415,7 +6083,7 @@ class SkillsLoader {
   }
   parseSkillFrontmatter(filePath, dirName, root, cwd) {
     try {
-      const raw = readFileSync9(filePath, "utf8");
+      const raw = readFileSync11(filePath, "utf8");
       const { attributes } = this.extractFrontmatterAndBody(raw);
       let scope = "global";
       const normPath = filePath.toLowerCase().replace(/\\/g, "/");
@@ -5497,8 +6165,8 @@ When tackling complex specialized tasks that match any of these skills, autonomo
 }
 
 // src/skills/installer.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, writeFileSync as writeFileSync5, rmSync as rmSync2 } from "fs";
-import { resolve as resolve14, join as join9 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync5, rmSync as rmSync2 } from "fs";
+import { resolve as resolve14, join as join11 } from "path";
 async function installSkill(skillName, options) {
   const cleanName = skillName.trim().toLowerCase().replace(/^@/, "");
   if (!cleanName) {
@@ -5533,7 +6201,7 @@ async function installSkill(skillName, options) {
   const scope = options.global ? "global" : "workspace";
   const targetDir = options.global ? resolve14(getGlobalSkillsDir(), cleanName) : resolve14(options.cwd, ".agents", "skills", cleanName);
   mkdirSync10(targetDir, { recursive: true });
-  const targetFile = join9(targetDir, "SKILL.md");
+  const targetFile = join11(targetDir, "SKILL.md");
   let fileContent = skillData.content;
   if (!fileContent.startsWith("---")) {
     const desc = skillData.description ? `description: "${skillData.description.replace(/"/g, "\\\"")}"
@@ -5557,7 +6225,7 @@ ${fileContent}`;
 function removeSkill(skillName, options) {
   const cleanName = skillName.trim().toLowerCase().replace(/^@/, "");
   const targetDir = options.global ? resolve14(getGlobalSkillsDir(), cleanName) : resolve14(options.cwd, ".agents", "skills", cleanName);
-  if (!existsSync17(targetDir)) {
+  if (!existsSync19(targetDir)) {
     return { success: false, targetDir, removed: false };
   }
   rmSync2(targetDir, { recursive: true, force: true });
@@ -5565,8 +6233,8 @@ function removeSkill(skillName, options) {
 }
 
 // src/memories/store.ts
-import { existsSync as existsSync18, readFileSync as readFileSync10, writeFileSync as writeFileSync6, mkdirSync as mkdirSync11, readdirSync as readdirSync7 } from "fs";
-import { resolve as resolve15, join as join10, basename, dirname as dirname8 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync12, writeFileSync as writeFileSync6, mkdirSync as mkdirSync11, readdirSync as readdirSync8 } from "fs";
+import { resolve as resolve15, join as join12, basename as basename2, dirname as dirname8 } from "path";
 import { createHash } from "crypto";
 class MemoryStore {
   globalPath;
@@ -5578,7 +6246,7 @@ class MemoryStore {
   findProjectRoot(cwd) {
     let current = resolve15(cwd);
     while (true) {
-      if (existsSync18(join10(current, ".git"))) {
+      if (existsSync20(join12(current, ".git"))) {
         return current;
       }
       const parent = dirname8(current);
@@ -5590,14 +6258,14 @@ class MemoryStore {
   }
   getProjectSlug(cwd) {
     const root = this.findProjectRoot(cwd);
-    const folderName = basename(root).toLowerCase().replace(/[^a-z0-9_-]/g, "-") || "project";
+    const folderName = basename2(root).toLowerCase().replace(/[^a-z0-9_-]/g, "-") || "project";
     const hash = createHash("sha256").update(resolve15(root)).digest("hex").slice(0, 6);
     return `${folderName}-${hash}`;
   }
   getProjectMemoryDir(cwd) {
     if (this.customWorkspacePath) {
       const dir = resolve15(this.customWorkspacePath);
-      if (!existsSync18(dir)) {
+      if (!existsSync20(dir)) {
         try {
           mkdirSync11(dir, { recursive: true });
         } catch {}
@@ -5605,8 +6273,8 @@ class MemoryStore {
       return dir;
     }
     const slug = this.getProjectSlug(cwd);
-    const dir = join10(getProjectsDir(), slug, "memory");
-    if (!existsSync18(dir)) {
+    const dir = join12(getProjectsDir(), slug, "memory");
+    if (!existsSync20(dir)) {
       try {
         mkdirSync11(dir, { recursive: true });
       } catch {}
@@ -5614,7 +6282,7 @@ class MemoryStore {
     return dir;
   }
   getMemoryIndexPath(cwd) {
-    return join10(this.getProjectMemoryDir(cwd), "MEMORY.md");
+    return join12(this.getProjectMemoryDir(cwd), "MEMORY.md");
   }
   normalizeCategory(raw) {
     const cat = raw.toLowerCase().trim();
@@ -5633,7 +6301,7 @@ class MemoryStore {
     const sanitizedName = params.name.toLowerCase().trim().replace(/[^a-z0-9_-]/g, "_").replace(/^_+|_+$/g, "") || `note_${Date.now()}`;
     const memoryDir = this.getProjectMemoryDir(params.cwd);
     const fileName = `${type}_${sanitizedName}.md`;
-    const filePath = join10(memoryDir, fileName);
+    const filePath = join12(memoryDir, fileName);
     const nowIso = new Date().toISOString();
     const cleanContent = params.content.trim();
     const desc = (params.description || cleanContent.split(`
@@ -5668,23 +6336,23 @@ class MemoryStore {
   }
   readTopicMemory(topicNameOrFile, cwd) {
     const memoryDir = this.getProjectMemoryDir(cwd);
-    let targetPath = join10(memoryDir, topicNameOrFile);
-    if (!existsSync18(targetPath)) {
+    let targetPath = join12(memoryDir, topicNameOrFile);
+    if (!existsSync20(targetPath)) {
       if (!topicNameOrFile.endsWith(".md")) {
-        targetPath = join10(memoryDir, `${topicNameOrFile}.md`);
+        targetPath = join12(memoryDir, `${topicNameOrFile}.md`);
       }
     }
-    if (!existsSync18(targetPath)) {
-      const files = readdirSync7(memoryDir);
+    if (!existsSync20(targetPath)) {
+      const files = readdirSync8(memoryDir);
       const match = files.find((f) => f.includes(topicNameOrFile));
       if (match) {
-        targetPath = join10(memoryDir, match);
+        targetPath = join12(memoryDir, match);
       } else {
         return null;
       }
     }
     try {
-      const raw = readFileSync10(targetPath, "utf8");
+      const raw = readFileSync12(targetPath, "utf8");
       return this.parseTopicFile(raw, targetPath);
     } catch {
       return null;
@@ -5695,7 +6363,7 @@ class MemoryStore {
 `);
     let inFm = false;
     let type = "project";
-    let name = basename(filePath, ".md");
+    let name = basename2(filePath, ".md");
     let description;
     let modified = new Date().toISOString();
     const bodyLines = [];
@@ -5739,13 +6407,13 @@ class MemoryStore {
   }
   syncMemoryIndex(cwd) {
     const memoryDir = this.getProjectMemoryDir(cwd);
-    const indexPath = join10(memoryDir, "MEMORY.md");
-    const files = existsSync18(memoryDir) ? readdirSync7(memoryDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md") : [];
+    const indexPath = join12(memoryDir, "MEMORY.md");
+    const files = existsSync20(memoryDir) ? readdirSync8(memoryDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md") : [];
     const items = [];
     for (const f of files) {
       try {
-        const full = join10(memoryDir, f);
-        const parsed = this.parseTopicFile(readFileSync10(full, "utf8"), full);
+        const full = join12(memoryDir, f);
+        const parsed = this.parseTopicFile(readFileSync12(full, "utf8"), full);
         items.push({
           type: parsed.type,
           name: parsed.name,
@@ -5771,10 +6439,10 @@ class MemoryStore {
   }
   loadMemoryIndex(cwd) {
     const indexPath = this.getMemoryIndexPath(cwd);
-    if (!existsSync18(indexPath))
+    if (!existsSync20(indexPath))
       return "";
     try {
-      const raw = readFileSync10(indexPath, "utf8");
+      const raw = readFileSync12(indexPath, "utf8");
       const byteLimit = 25 * 1024;
       const sliced = raw.length > byteLimit ? raw.slice(0, byteLimit) : raw;
       const lines = sliced.split(`
@@ -5787,14 +6455,14 @@ class MemoryStore {
   }
   listProjectMemories(cwd) {
     const memoryDir = this.getProjectMemoryDir(cwd);
-    if (!existsSync18(memoryDir))
+    if (!existsSync20(memoryDir))
       return [];
-    const files = readdirSync7(memoryDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md");
+    const files = readdirSync8(memoryDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md");
     const list = [];
     for (const f of files) {
       try {
-        const full = join10(memoryDir, f);
-        list.push(this.parseTopicFile(readFileSync10(full, "utf8"), full));
+        const full = join12(memoryDir, f);
+        list.push(this.parseTopicFile(readFileSync12(full, "utf8"), full));
       } catch {}
     }
     return list;
@@ -5845,8 +6513,8 @@ class MemoryStore {
 }
 
 // src/worktree/manager.ts
-import { resolve as resolve17, join as join11 } from "path";
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, writeFileSync as writeFileSync7, readFileSync as readFileSync11 } from "fs";
+import { resolve as resolve17, join as join13 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync12, writeFileSync as writeFileSync7, readFileSync as readFileSync13 } from "fs";
 
 // src/worktree/git.ts
 import { resolve as resolve16 } from "path";
@@ -5996,7 +6664,7 @@ class WorktreeManager {
     const branchName = options.branch || `groupy/${taskId}`;
     const targetDir = options.worktreePath || (this.baseStorageDir ? resolve17(this.baseStorageDir, branchName.replace(/\//g, "_")) : resolve17(repoRoot, ".groupy", "worktrees", branchName.replace(/\//g, "_")));
     const worktreeParent = resolve17(targetDir, "..");
-    if (!existsSync19(worktreeParent)) {
+    if (!existsSync21(worktreeParent)) {
       mkdirSync12(worktreeParent, { recursive: true });
     }
     const baseBranch = options.baseBranch || await getCurrentBranch(repoRoot);
@@ -6004,7 +6672,7 @@ class WorktreeManager {
     if (!result.success) {
       throw new Error(`Failed to create git worktree: ${result.error}`);
     }
-    const metaPath = join11(targetDir, "groupy-thread.json");
+    const metaPath = join13(targetDir, "groupy-thread.json");
     try {
       writeFileSync7(metaPath, JSON.stringify({
         version: 1,
@@ -6030,10 +6698,10 @@ class WorktreeManager {
       return [];
     const worktrees = await listWorktreesGit(repoRoot);
     return worktrees.map((wt) => {
-      const metaPath = join11(wt.path, "groupy-thread.json");
-      if (existsSync19(metaPath)) {
+      const metaPath = join13(wt.path, "groupy-thread.json");
+      if (existsSync21(metaPath)) {
         try {
-          const raw = JSON.parse(readFileSync11(metaPath, "utf8"));
+          const raw = JSON.parse(readFileSync13(metaPath, "utf8"));
           return { ...wt, threadId: raw.ownerThreadId || raw.threadId };
         } catch {}
       }
@@ -6729,7 +7397,7 @@ function parsePatch(oldSrc, newSrc, contextLines = 3) {
 // package.json
 var package_default = {
   name: "@pikaa-ai/pikaa",
-  version: "0.3.27",
+  version: "0.3.28",
   description: "PIKAA CLI - AI coding agent that runs locally in your terminal.",
   main: "./dist/index.js",
   module: "./dist/index.js",
@@ -6761,14 +7429,14 @@ var package_default = {
     prepublishOnly: "bun run build:js"
   },
   optionalDependencies: {
-    "@pikaa-ai/pikaa-linux-x64": "0.3.27",
-    "@pikaa-ai/pikaa-linux-x64-musl": "0.3.27",
-    "@pikaa-ai/pikaa-linux-arm64": "0.3.27",
-    "@pikaa-ai/pikaa-linux-arm64-musl": "0.3.27",
-    "@pikaa-ai/pikaa-darwin-x64": "0.3.27",
-    "@pikaa-ai/pikaa-darwin-arm64": "0.3.27",
-    "@pikaa-ai/pikaa-windows-x64": "0.3.27",
-    "@pikaa-ai/pikaa-windows-arm64": "0.3.27"
+    "@pikaa-ai/pikaa-linux-x64": "0.3.28",
+    "@pikaa-ai/pikaa-linux-x64-musl": "0.3.28",
+    "@pikaa-ai/pikaa-linux-arm64": "0.3.28",
+    "@pikaa-ai/pikaa-linux-arm64-musl": "0.3.28",
+    "@pikaa-ai/pikaa-darwin-x64": "0.3.28",
+    "@pikaa-ai/pikaa-darwin-arm64": "0.3.28",
+    "@pikaa-ai/pikaa-windows-x64": "0.3.28",
+    "@pikaa-ai/pikaa-windows-arm64": "0.3.28"
   },
   keywords: [
     "ai",
@@ -7973,900 +8641,537 @@ async function promptToolApproval(params) {
         return;
       }
       if (_str?.toLowerCase() === "n") {
-        cleanup("no");
-        return;
-      }
-      if (_str?.toLowerCase() === "a") {
-        cleanup("always");
-        return;
-      }
-    };
-    unsubscribe = addGlobalKeypressListener(onKeypress);
-    render();
-  });
-}
-async function promptUserQuestion(params) {
-  const { question, options = [] } = params;
-  const boxWidth = Math.min(process.stdout.columns ?? 80, 75);
-  const border = "\u2500".repeat(Math.max(10, boxWidth - 20));
-  console.log(`
-  ${style.cyan("\u250C\u2500\u2500")} ${style.bold("AI Question")} ${style.cyan(border)}`);
-  const qLines = question.split(`
-`);
-  for (const line of qLines) {
-    console.log(`  ${style.cyan("\u2502")}  ${style.bold(line)}`);
-  }
-  if (options.length > 0) {
-    console.log(`  ${style.cyan("\u2502")}`);
-    options.forEach((opt, idx) => {
-      const numTag = style.cyan(`[${idx + 1}]`);
-      const isRec = opt.includes("(Recommended)") || opt.includes("(recommended)");
-      const optText = isRec ? opt.replace(/\(Recommended\)/i, style.green("(Recommended)")) : opt;
-      console.log(`  ${style.cyan("\u2502")}  ${numTag} ${optText}`);
-    });
-  }
-  console.log(`  ${style.cyan("\u2514" + "\u2500".repeat(Math.max(10, boxWidth - 4)))}
-`);
-  if (!process.stdin.isTTY || false || !process.stdin.readable) {
-    return options[0] || "yes";
-  }
-  return new Promise((resolve) => {
-    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
-    const promptLabel = options.length > 0 ? `Select [1-${options.length}] or type custom response: ` : `Your response: `;
-    rl.question(`  ${style.bold(promptLabel)}`, (answer) => {
-      rl.close();
-      const trimmed = answer.trim();
-      if (!trimmed) {
-        const fallback = options[0] || "";
-        console.log(style.dim(`  \u21B3 Default: ${fallback || "(empty)"}
-`));
-        resolve(fallback);
-        return;
-      }
-      const num = parseInt(trimmed, 10);
-      if (!isNaN(num) && num >= 1 && num <= options.length) {
-        const picked = options[num - 1];
-        console.log(style.green(`  \u2714 Selected: ${picked}
-`));
-        resolve(picked);
-        return;
-      }
-      if (options.length === 2) {
-        if (/^(y|yes)$/i.test(trimmed)) {
-          console.log(style.green(`  \u2714 Selected: ${options[0]}
-`));
-          resolve(options[0]);
-          return;
-        }
-        if (/^(n|no)$/i.test(trimmed)) {
-          console.log(style.green(`  \u2714 Selected: ${options[1]}
-`));
-          resolve(options[1]);
-          return;
-        }
-      }
-      console.log(style.green(`  \u2714 Answer: ${trimmed}
-`));
-      resolve(trimmed);
-    });
-  });
-}
-async function promptInteractiveList(config) {
-  const {
-    title,
-    items,
-    mode = "select",
-    defaultIndex = 0,
-    maxVisible = 8,
-    emptyMessage = "No items available.",
-    onToggle,
-    onAction,
-    customKeyHints
-  } = config;
-  if (!process.stdin.isTTY || false || !process.stdin.readable) {
-    return {
-      selectedIndex: defaultIndex,
-      selectedItem: items[defaultIndex] || items[0],
-      action: "select"
-    };
-  }
-  if (items.length === 0) {
-    console.log(`
-  ${style.dim(emptyMessage)}
-`);
-    return { selectedIndex: -1, action: "close" };
-  }
-  return new Promise((resolve) => {
-    let selectedIndex = Math.max(0, Math.min(defaultIndex, items.length - 1));
-    let scrollTop = 0;
-    let renderedLines = 0;
-    const wasRaw = process.stdin.isRaw ?? false;
-    ensureRawMode(true);
-    process.stdout.write("\x1B[?25l");
-    const BOX_WIDTH = Math.min(process.stdout.columns ?? 80, 76);
-    const ensureVisible = () => {
-      const visibleCount = Math.min(items.length, maxVisible);
-      if (selectedIndex < scrollTop) {
-        scrollTop = selectedIndex;
-      } else if (selectedIndex >= scrollTop + visibleCount) {
-        scrollTop = selectedIndex + 1 - visibleCount;
-      }
-      if (scrollTop < 0)
-        scrollTop = 0;
-      const maxScroll = Math.max(0, items.length - visibleCount);
-      if (scrollTop > maxScroll)
-        scrollTop = maxScroll;
-    };
-    const render = () => {
-      ensureVisible();
-      const visibleCount = Math.min(items.length, maxVisible);
-      const visibleItems = items.slice(scrollTop, scrollTop + visibleCount);
-      const lines = [];
-      const headerBorder = "\u2500".repeat(Math.max(10, BOX_WIDTH - title.length - 8));
-      lines.push(`  \x1B[38;2;140;140;150m\u250C\u2500\u2500\x1B[0m ${style.bold(title)} \x1B[38;2;140;140;150m${headerBorder}\u2510\x1B[0m`);
-      for (let i = 0;i < visibleItems.length; i++) {
-        const item = visibleItems[i];
-        const actualIdx = scrollTop + i;
-        const isCurrent = actualIdx === selectedIndex;
-        const marker = isCurrent ? "\x1B[38;2;217;119;87m\u276F\x1B[0m" : " ";
-        let checkSymbol = "";
-        if (mode === "toggle") {
-          checkSymbol = item.checked ? "\x1B[38;2;78;169;111m[\u2714 ENABLED]\x1B[0m " : "\x1B[38;2;120;120;125m[\u25CB DISABLED]\x1B[0m";
-        } else if (item.checked !== undefined) {
-          checkSymbol = item.checked ? "\x1B[38;2;78;169;111m(\u25CF)\x1B[0m " : "\x1B[38;2;120;120;125m(\u25CB)\x1B[0m ";
-        }
-        const badgeStr = item.badge ? ` ${style.dim(`(${item.badge})`)}` : "";
-        const labelStr = isCurrent ? style.bold(item.label) : item.label;
-        lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m ${marker} ${checkSymbol} ${labelStr}${badgeStr}`);
-        if (item.description) {
-          const descIndent = " ".repeat(mode === "toggle" ? 17 : 7);
-          const maxDescLen = BOX_WIDTH - descIndent.length - 6;
-          const trimmedDesc = item.description.length > maxDescLen ? item.description.slice(0, maxDescLen - 3) + "..." : item.description;
-          lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m ${descIndent}${style.dim(trimmedDesc)}`);
-        }
-      }
-      const moreAbove = scrollTop;
-      const moreBelow = Math.max(0, items.length - (scrollTop + visibleCount));
-      let scrollInfo = "";
-      if (moreAbove > 0 && moreBelow > 0) {
-        scrollInfo = `[\u2191 ${moreAbove} more \xB7 \u2193 ${moreBelow} more]`;
-      } else if (moreBelow > 0) {
-        scrollInfo = `[\u2193 ${moreBelow} more below]`;
-      } else if (moreAbove > 0) {
-        scrollInfo = `[\u2191 ${moreAbove} more above]`;
-      }
-      const defaultHints = mode === "toggle" ? "\u2191/\u2193: navigate \xB7 Space: toggle \xB7 a: all \xB7 d: none \xB7 Enter/Esc: done" : "\u2191/\u2193: navigate \xB7 Enter: select \xB7 Esc: cancel";
-      const hintText = customKeyHints || (scrollInfo ? `${scrollInfo} ${defaultHints}` : defaultHints);
-      lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m`);
-      lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m  ${style.dim(hintText)}`);
-      lines.push(`  \x1B[38;2;140;140;150m\u2514\u2500\u2500${"\u2500".repeat(Math.max(10, BOX_WIDTH - 6))}\u2518\x1B[0m`);
-      let buffer = "";
-      if (renderedLines > 0) {
-        buffer += `\x1B[${renderedLines}A\r`;
-      }
-      buffer += lines.map((l) => `\x1B[2K${l}`).join(`
-`) + `
-`;
-      if (renderedLines > lines.length) {
-        buffer += "\x1B[J";
-      }
-      process.stdout.write(buffer);
-      renderedLines = lines.length;
-    };
-    let unsubscribe = null;
-    const cleanup = (res) => {
-      if (renderedLines > 0) {
-        process.stdout.write(`\x1B[${renderedLines}A\r\x1B[J\x1B[?25h`);
-        renderedLines = 0;
-      } else {
-        process.stdout.write("\x1B[?25h");
-      }
-      if (unsubscribe) {
-        unsubscribe();
-        unsubscribe = null;
-      }
-      ensureRawMode(wasRaw);
-      resolve(res);
-    };
-    const onKeypress = async (_str, key) => {
-      if (!key)
-        return;
-      if (key.ctrl && key.name === "c" || key.name === "escape" || _str === "q" || _str === "Q") {
-        cleanup({
-          selectedIndex,
-          selectedItem: items[selectedIndex],
-          action: "close"
-        });
-        return;
-      }
-      if (key.name === "up" || _str === "k") {
-        selectedIndex = (selectedIndex - 1 + items.length) % items.length;
-        render();
-        return;
-      }
-      if (key.name === "down" || _str === "j") {
-        selectedIndex = (selectedIndex + 1) % items.length;
-        render();
-        return;
-      }
-      if (_str === " " || _str === "t" || _str === "T") {
-        const item = items[selectedIndex];
-        if (item) {
-          item.checked = !item.checked;
-          if (onToggle) {
-            await onToggle(item, selectedIndex);
-          }
-        }
-        render();
-        return;
-      }
-      if (key.name === "return" || key.name === "enter") {
-        if (mode === "toggle") {
-          cleanup({
-            selectedIndex,
-            selectedItem: items[selectedIndex],
-            action: "close"
-          });
-        } else {
-          cleanup({
-            selectedIndex,
-            selectedItem: items[selectedIndex],
-            action: "select"
-          });
-        }
-        return;
-      }
-      if (_str && onAction) {
-        const item = items[selectedIndex];
-        const shouldExit = await onAction(_str.toLowerCase(), item, selectedIndex);
-        if (shouldExit) {
-          cleanup({
-            selectedIndex,
-            selectedItem: item,
-            action: "custom",
-            keyName: _str.toLowerCase()
-          });
-          return;
-        }
-        render();
+        cleanup("no");
+        return;
+      }
+      if (_str?.toLowerCase() === "a") {
+        cleanup("always");
+        return;
       }
     };
     unsubscribe = addGlobalKeypressListener(onKeypress);
     render();
   });
 }
-
-// src/security/scanner.ts
-import { existsSync as existsSync20, readdirSync as readdirSync8, readFileSync as readFileSync12, statSync as statSync5 } from "fs";
-import { join as join12, relative as relative2, resolve as resolve18 } from "path";
-var SECURITY_RULES = [
-  {
-    id: "SEC-001",
-    category: "Secrets Leakage",
-    severity: "CRITICAL",
-    pattern: /sk-(?:proj-)?[A-Za-z0-9-_]{20,}/,
-    description: "Hardcoded OpenAI API key detected in source code.",
-    recommendation: "Store API keys in environment variables (e.g. process.env.OPENAI_API_KEY) or a secure vault."
-  },
-  {
-    id: "SEC-002",
-    category: "Secrets Leakage",
-    severity: "CRITICAL",
-    pattern: /AKIA[0-9A-Z]{16}/,
-    description: "Exposed AWS Access Key ID found in source code.",
-    recommendation: "Rotate the exposed key immediately and use IAM Roles or AWS environment credentials."
-  },
-  {
-    id: "SEC-003",
-    category: "Secrets Leakage",
-    severity: "CRITICAL",
-    pattern: /ghp_[0-9a-zA-Z]{36}/,
-    description: "Exposed GitHub Personal Access Token (PAT) detected.",
-    recommendation: "Revoke the token and inject credentials via GitHub Actions Secrets or environment variables."
-  },
-  {
-    id: "SEC-004",
-    category: "Secrets Leakage",
-    severity: "CRITICAL",
-    pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
-    description: "Unencrypted private cryptographic key committed to source repository.",
-    recommendation: "Remove private key from git history and manage certificates through a secret manager."
-  },
-  {
-    id: "SEC-005",
-    category: "Secrets Leakage",
-    severity: "HIGH",
-    pattern: /(?:postgres|mysql|mongodb(?:\+srv)?):\/\/[a-zA-Z0-9_.-]+:[^@\s"']+@[a-zA-Z0-9_.-]+/i,
-    description: "Hardcoded database connection string containing plaintext credentials.",
-    recommendation: "Extract connection URI into DATABASE_URL environment variable."
-  },
-  {
-    id: "SEC-010",
-    category: "Code Injection",
-    severity: "HIGH",
-    pattern: /\beval\s*\(/,
-    description: "Use of dangerous `eval()` function permits arbitrary code execution.",
-    recommendation: "Avoid eval(). Use structured JSON.parse() or dedicated domain-specific parsers.",
-    fileExtensions: [".js", ".ts", ".jsx", ".tsx", ".py"]
-  },
-  {
-    id: "SEC-011",
-    category: "Command Injection",
-    severity: "HIGH",
-    pattern: /(?:child_process|cp)\.exec\s*\([^,)]*\+/,
-    description: "Dynamic string concatenation in `child_process.exec()` creates command injection vectors.",
-    recommendation: "Use `execFile` or `spawn` with an array of arguments rather than executing raw shell strings.",
-    fileExtensions: [".js", ".ts"]
-  },
-  {
-    id: "SEC-020",
-    category: "Broken Authentication",
-    severity: "MEDIUM",
-    pattern: /jwt\.(?:sign|verify)\s*\([^,]+,\s*["'](?:secret|test|123456|dev|password)["']\s*\)/i,
-    description: "Weak or hardcoded JWT secret key used in token signing/verification.",
-    recommendation: "Use a high-entropy secret (at least 256 bits) loaded securely from environment variables.",
-    fileExtensions: [".js", ".ts", ".py"]
-  },
-  {
-    id: "SEC-021",
-    category: "Broken Authentication",
-    severity: "MEDIUM",
-    pattern: /jwt\.decode\s*\(/,
-    description: "`jwt.decode()` used without signature verification.",
-    recommendation: "Use `jwt.verify()` with explicit algorithm pinning to validate token authenticity.",
-    fileExtensions: [".js", ".ts"]
-  },
-  {
-    id: "SEC-030",
-    category: "SQL Injection",
-    severity: "HIGH",
-    pattern: /(?:SELECT|INSERT|UPDATE|DELETE)\s+.*(?:WHERE|VALUES)\s+.*["']\s*\+\s*[a-zA-Z0-9_.]+/i,
-    description: "Unparameterized raw SQL string concatenation detected.",
-    recommendation: "Use parameterized queries or ORM bindings (e.g. `$1`, `?`, or named parameters).",
-    fileExtensions: [".js", ".ts", ".py", ".go", ".rs"]
-  },
-  {
-    id: "SEC-040",
-    category: "SSRF",
-    severity: "HIGH",
-    pattern: /169\.254\.169\.254/,
-    description: "Direct reference to AWS/Cloud instance metadata IP address (169.254.169.254).",
-    recommendation: "Restrict outbound HTTP access to metadata endpoints and enforce egress IP filtering."
+async function promptUserQuestion(params) {
+  const { question, options = [] } = params;
+  const boxWidth = Math.min(process.stdout.columns ?? 80, 75);
+  const border = "\u2500".repeat(Math.max(10, boxWidth - 20));
+  console.log(`
+  ${style.cyan("\u250C\u2500\u2500")} ${style.bold("AI Question")} ${style.cyan(border)}`);
+  const qLines = question.split(`
+`);
+  for (const line of qLines) {
+    console.log(`  ${style.cyan("\u2502")}  ${style.bold(line)}`);
   }
-];
-var IGNORED_DIRS = new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "coverage",
-  ".next",
-  ".turbo",
-  "vendor",
-  "target",
-  "tests",
-  "__tests__"
-]);
-var IGNORED_EXTS = new Set([
-  ".md",
-  ".mdx",
-  ".txt",
-  ".log",
-  ".svg",
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".ico",
-  ".woff",
-  ".woff2"
-]);
-var IGNORED_FILES = new Set([
-  "package-lock.json",
-  "bun.lock",
-  "bun.lockb",
-  "yarn.lock",
-  "pnpm-lock.yaml",
-  "scanner.ts"
-]);
-async function runSecurityScan(targetDir, options = {}) {
-  const startTime = performance.now();
-  const root = resolve18(targetDir);
-  const isDirectTestDir = targetDir.includes("test") || Boolean(options.includeTests);
-  const maxFiles = options.maxFiles || 2000;
-  const findings = [];
-  let scannedCount = 0;
-  function walk(current) {
-    if (scannedCount >= maxFiles || !existsSync20(current))
-      return;
-    let entries;
-    try {
-      entries = readdirSync8(current);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (scannedCount >= maxFiles)
-        break;
-      const fullPath = join12(current, entry);
-      let stat;
-      try {
-        stat = statSync5(fullPath);
-      } catch {
-        continue;
-      }
-      if (stat.isDirectory()) {
-        if (!entry.startsWith(".agent-worktrees") && (!IGNORED_DIRS.has(entry) || isDirectTestDir && (entry === "tests" || entry === "__tests__"))) {
-          walk(fullPath);
-        }
-      } else if (stat.isFile()) {
-        if (IGNORED_FILES.has(entry) || stat.size > 2 * 1024 * 1024) {
-          continue;
-        }
-        const ext = entry.includes(".") ? `.${entry.split(".").pop().toLowerCase()}` : "";
-        if (IGNORED_EXTS.has(ext)) {
-          continue;
-        }
-        if (options.fileExtensions && options.fileExtensions.length > 0) {
-          if (!options.fileExtensions.includes(ext))
-            continue;
-        }
-        scannedCount++;
-        scanFile(fullPath, root, ext, findings);
-      }
-    }
+  if (options.length > 0) {
+    console.log(`  ${style.cyan("\u2502")}`);
+    options.forEach((opt, idx) => {
+      const numTag = style.cyan(`[${idx + 1}]`);
+      const isRec = opt.includes("(Recommended)") || opt.includes("(recommended)");
+      const optText = isRec ? opt.replace(/\(Recommended\)/i, style.green("(Recommended)")) : opt;
+      console.log(`  ${style.cyan("\u2502")}  ${numTag} ${optText}`);
+    });
   }
-  function scanFile(filePath, baseRoot, ext, out) {
-    let content;
-    try {
-      content = readFileSync12(filePath, "utf8");
-    } catch {
-      return;
-    }
-    const lines = content.split(`
+  console.log(`  ${style.cyan("\u2514" + "\u2500".repeat(Math.max(10, boxWidth - 4)))}
 `);
-    const relPath = relative2(baseRoot, filePath);
-    for (let lineIdx = 0;lineIdx < lines.length; lineIdx++) {
-      const line = lines[lineIdx];
-      if (line.includes("SECURITY_RULES") || line.includes("pattern: /"))
-        continue;
-      for (const rule of SECURITY_RULES) {
-        if (rule.fileExtensions && ext && !rule.fileExtensions.includes(ext)) {
-          continue;
+  if (!process.stdin.isTTY || false || !process.stdin.readable) {
+    return options[0] || "yes";
+  }
+  return new Promise((resolve) => {
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+    const promptLabel = options.length > 0 ? `Select [1-${options.length}] or type custom response: ` : `Your response: `;
+    rl.question(`  ${style.bold(promptLabel)}`, (answer) => {
+      rl.close();
+      const trimmed = answer.trim();
+      if (!trimmed) {
+        const fallback = options[0] || "";
+        console.log(style.dim(`  \u21B3 Default: ${fallback || "(empty)"}
+`));
+        resolve(fallback);
+        return;
+      }
+      const num = parseInt(trimmed, 10);
+      if (!isNaN(num) && num >= 1 && num <= options.length) {
+        const picked = options[num - 1];
+        console.log(style.green(`  \u2714 Selected: ${picked}
+`));
+        resolve(picked);
+        return;
+      }
+      if (options.length === 2) {
+        if (/^(y|yes)$/i.test(trimmed)) {
+          console.log(style.green(`  \u2714 Selected: ${options[0]}
+`));
+          resolve(options[0]);
+          return;
         }
-        if (rule.pattern.test(line)) {
-          out.push({
-            id: rule.id,
-            category: rule.category,
-            severity: rule.severity,
-            filePath: relPath,
-            lineNumber: lineIdx + 1,
-            snippet: line.trim().slice(0, 120),
-            description: rule.description,
-            recommendation: rule.recommendation
-          });
+        if (/^(n|no)$/i.test(trimmed)) {
+          console.log(style.green(`  \u2714 Selected: ${options[1]}
+`));
+          resolve(options[1]);
+          return;
         }
       }
-    }
-  }
-  walk(root);
-  const durationMs = performance.now() - startTime;
-  const summary = {
-    critical: findings.filter((f) => f.severity === "CRITICAL").length,
-    high: findings.filter((f) => f.severity === "HIGH").length,
-    medium: findings.filter((f) => f.severity === "MEDIUM").length,
-    low: findings.filter((f) => f.severity === "LOW").length
-  };
-  return {
-    scannedFiles: scannedCount,
-    findings,
-    durationMs,
-    summary
-  };
+      console.log(style.green(`  \u2714 Answer: ${trimmed}
+`));
+      resolve(trimmed);
+    });
+  });
 }
-
-// src/mcp/servers/chrome-devtools/index.ts
-import { resolve as resolve19 } from "path";
-
-// src/mcp/servers/chrome-devtools/server.ts
-if (false) {}
-
-// src/mcp/servers/chrome-devtools/index.ts
-var __dirname = "/home/runner/work/agent-cli/agent-cli/src/mcp/servers/chrome-devtools";
-var CHROME_DEVTOOLS_MCP_SERVER_PATH = resolve19(__dirname, "server.ts");
-
-// src/mcp/servers/web-search/index.ts
-import { resolve as resolve20 } from "path";
-
-// src/mcp/servers/web-search/server.ts
-if (false) {}
-
-// src/mcp/servers/web-search/index.ts
-var __dirname = "/home/runner/work/agent-cli/agent-cli/src/mcp/servers/web-search";
-var WEB_SEARCH_MCP_SERVER_PATH = resolve20(__dirname, "server.ts");
-
-// src/mcp/servers/sqlite/index.ts
-import { resolve as resolve21 } from "path";
-
-// src/mcp/servers/sqlite/server.ts
-if (false) {}
-
-// src/mcp/servers/sqlite/index.ts
-var __dirname = "/home/runner/work/agent-cli/agent-cli/src/mcp/servers/sqlite";
-var SQLITE_MCP_SERVER_PATH = resolve21(__dirname, "server.ts");
-
-// src/init/project-analyzer.ts
-import { existsSync as existsSync21, readFileSync as readFileSync13, readdirSync as readdirSync9 } from "fs";
-import { join as join13, basename as basename3 } from "path";
-
-class ProjectAnalyzer {
-  cwd;
-  constructor(cwd = process.cwd()) {
-    this.cwd = cwd;
+async function promptInteractiveList(config) {
+  const {
+    title,
+    items,
+    mode = "select",
+    defaultIndex = 0,
+    maxVisible = 8,
+    emptyMessage = "No items available.",
+    onToggle,
+    onAction,
+    customKeyHints
+  } = config;
+  if (!process.stdin.isTTY || false || !process.stdin.readable) {
+    return {
+      selectedIndex: defaultIndex,
+      selectedItem: items[defaultIndex] || items[0],
+      action: "select"
+    };
   }
-  analyze() {
-    const readmeInfo = this.extractReadmeMetadata();
-    const projectName = readmeInfo.title || this.detectProjectName();
-    const languages = this.detectLanguages();
-    const packageManager = this.detectPackageManager();
-    const frameworks = [];
-    const infrastructure = [];
-    const commands = {};
-    const architectureNotes = [];
-    const codeConventions = [];
-    let description = readmeInfo.description;
-    const pkgPath = join13(this.cwd, "package.json");
-    if (existsSync21(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
-        if (!description && pkg.description)
-          description = pkg.description;
-        const pm = packageManager || "npm";
-        const runPrefix = pm === "bun" || pm === "yarn" || pm === "pnpm" ? `${pm} run` : "npm run";
-        const testPrefix = pm === "bun" ? "bun test" : pm === "pnpm" ? "pnpm test" : pm === "yarn" ? "yarn test" : "npm test";
-        if (pkg.scripts) {
-          if (pkg.scripts.dev)
-            commands.dev = `${runPrefix} dev`;
-          else if (pkg.scripts.start)
-            commands.dev = `${runPrefix} start`;
-          if (pkg.scripts.build)
-            commands.build = `${runPrefix} build`;
-          if (pkg.scripts.test)
-            commands.test = pkg.scripts.test === "bun test" ? "bun test" : testPrefix;
-          if (pkg.scripts.typecheck)
-            commands.typecheck = `${runPrefix} typecheck`;
-          else if (pkg.scripts.check)
-            commands.typecheck = `${runPrefix} check`;
-          if (pkg.scripts.lint)
-            commands.lint = `${runPrefix} lint`;
-          if (pkg.scripts.format)
-            commands.format = `${runPrefix} format`;
+  if (items.length === 0) {
+    console.log(`
+  ${style.dim(emptyMessage)}
+`);
+    return { selectedIndex: -1, action: "close" };
+  }
+  return new Promise((resolve) => {
+    let selectedIndex = Math.max(0, Math.min(defaultIndex, items.length - 1));
+    let scrollTop = 0;
+    let renderedLines = 0;
+    const wasRaw = process.stdin.isRaw ?? false;
+    ensureRawMode(true);
+    process.stdout.write("\x1B[?25l");
+    const BOX_WIDTH = Math.min(process.stdout.columns ?? 80, 76);
+    const ensureVisible = () => {
+      const visibleCount = Math.min(items.length, maxVisible);
+      if (selectedIndex < scrollTop) {
+        scrollTop = selectedIndex;
+      } else if (selectedIndex >= scrollTop + visibleCount) {
+        scrollTop = selectedIndex + 1 - visibleCount;
+      }
+      if (scrollTop < 0)
+        scrollTop = 0;
+      const maxScroll = Math.max(0, items.length - visibleCount);
+      if (scrollTop > maxScroll)
+        scrollTop = maxScroll;
+    };
+    const render = () => {
+      ensureVisible();
+      const visibleCount = Math.min(items.length, maxVisible);
+      const visibleItems = items.slice(scrollTop, scrollTop + visibleCount);
+      const lines = [];
+      const headerBorder = "\u2500".repeat(Math.max(10, BOX_WIDTH - title.length - 8));
+      lines.push(`  \x1B[38;2;140;140;150m\u250C\u2500\u2500\x1B[0m ${style.bold(title)} \x1B[38;2;140;140;150m${headerBorder}\u2510\x1B[0m`);
+      for (let i = 0;i < visibleItems.length; i++) {
+        const item = visibleItems[i];
+        const actualIdx = scrollTop + i;
+        const isCurrent = actualIdx === selectedIndex;
+        const marker = isCurrent ? "\x1B[38;2;217;119;87m\u276F\x1B[0m" : " ";
+        let checkSymbol = "";
+        if (mode === "toggle") {
+          checkSymbol = item.checked ? "\x1B[38;2;78;169;111m[\u2714 ENABLED]\x1B[0m " : "\x1B[38;2;120;120;125m[\u25CB DISABLED]\x1B[0m";
+        } else if (item.checked !== undefined) {
+          checkSymbol = item.checked ? "\x1B[38;2;78;169;111m(\u25CF)\x1B[0m " : "\x1B[38;2;120;120;125m(\u25CB)\x1B[0m ";
         }
-        const allDeps = {
-          ...pkg.dependencies || {},
-          ...pkg.devDependencies || {}
-        };
-        if (allDeps.next)
-          frameworks.push("Next.js");
-        if (allDeps.react)
-          frameworks.push("React");
-        if (allDeps.vue)
-          frameworks.push("Vue.js");
-        if (allDeps.svelte || allDeps["@sveltejs/kit"])
-          frameworks.push("Svelte");
-        if (allDeps.astro)
-          frameworks.push("Astro");
-        if (allDeps.vite)
-          frameworks.push("Vite");
-        if (allDeps.express)
-          frameworks.push("Express");
-        if (allDeps.hono)
-          frameworks.push("Hono");
-        if (allDeps.fastify)
-          frameworks.push("Fastify");
-        if (allDeps["@nestjs/core"])
-          frameworks.push("NestJS");
-        if (allDeps.tailwindcss)
-          frameworks.push("TailwindCSS");
-        if (allDeps["lucide-react"] || allDeps.lucide)
-          frameworks.push("Lucide Icons");
-        if (allDeps.zustand)
-          frameworks.push("Zustand");
-        if (allDeps["@tanstack/react-query"])
-          frameworks.push("TanStack Query");
-        if (allDeps.oxlint)
-          frameworks.push("Oxlint");
-        if (allDeps.eslint)
-          frameworks.push("ESLint");
-        if (allDeps.vitest)
-          frameworks.push("Vitest");
-        if (allDeps.jest)
-          frameworks.push("Jest");
-        if (allDeps.playwright || allDeps["@playwright/test"])
-          frameworks.push("Playwright");
-        if (pkg.type === "module") {
-          codeConventions.push("Use ES modules (`import/export`), not CommonJS (`require`).");
+        const badgeStr = item.badge ? ` ${style.dim(`(${item.badge})`)}` : "";
+        const labelStr = isCurrent ? style.bold(item.label) : item.label;
+        lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m ${marker} ${checkSymbol} ${labelStr}${badgeStr}`);
+        if (item.description) {
+          const descIndent = " ".repeat(mode === "toggle" ? 17 : 7);
+          const maxDescLen = BOX_WIDTH - descIndent.length - 6;
+          const trimmedDesc = item.description.length > maxDescLen ? item.description.slice(0, maxDescLen - 3) + "..." : item.description;
+          lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m ${descIndent}${style.dim(trimmedDesc)}`);
         }
-      } catch {}
-    }
-    const tsconfigPath = join13(this.cwd, "tsconfig.json");
-    if (existsSync21(tsconfigPath)) {
-      try {
-        const tsconfig = JSON.parse(readFileSync13(tsconfigPath, "utf8"));
-        if (tsconfig.compilerOptions?.strict) {
-          codeConventions.push("TypeScript strict mode enabled.");
+      }
+      const moreAbove = scrollTop;
+      const moreBelow = Math.max(0, items.length - (scrollTop + visibleCount));
+      let scrollInfo = "";
+      if (moreAbove > 0 && moreBelow > 0) {
+        scrollInfo = `[\u2191 ${moreAbove} more \xB7 \u2193 ${moreBelow} more]`;
+      } else if (moreBelow > 0) {
+        scrollInfo = `[\u2193 ${moreBelow} more below]`;
+      } else if (moreAbove > 0) {
+        scrollInfo = `[\u2191 ${moreAbove} more above]`;
+      }
+      const defaultHints = mode === "toggle" ? "\u2191/\u2193: navigate \xB7 Space: toggle \xB7 a: all \xB7 d: none \xB7 Enter/Esc: done" : "\u2191/\u2193: navigate \xB7 Enter: select \xB7 Esc: cancel";
+      const hintText = customKeyHints || (scrollInfo ? `${scrollInfo} ${defaultHints}` : defaultHints);
+      lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m`);
+      lines.push(`  \x1B[38;2;140;140;150m\u2502\x1B[0m  ${style.dim(hintText)}`);
+      lines.push(`  \x1B[38;2;140;140;150m\u2514\u2500\u2500${"\u2500".repeat(Math.max(10, BOX_WIDTH - 6))}\u2518\x1B[0m`);
+      let buffer = "";
+      if (renderedLines > 0) {
+        buffer += `\x1B[${renderedLines}A\r`;
+      }
+      buffer += lines.map((l) => `\x1B[2K${l}`).join(`
+`) + `
+`;
+      if (renderedLines > lines.length) {
+        buffer += "\x1B[J";
+      }
+      process.stdout.write(buffer);
+      renderedLines = lines.length;
+    };
+    let unsubscribe = null;
+    const cleanup = (res) => {
+      if (renderedLines > 0) {
+        process.stdout.write(`\x1B[${renderedLines}A\r\x1B[J\x1B[?25h`);
+        renderedLines = 0;
+      } else {
+        process.stdout.write("\x1B[?25h");
+      }
+      if (unsubscribe) {
+        unsubscribe();
+        unsubscribe = null;
+      }
+      ensureRawMode(wasRaw);
+      resolve(res);
+    };
+    const onKeypress = async (_str, key) => {
+      if (!key)
+        return;
+      if (key.ctrl && key.name === "c" || key.name === "escape" || _str === "q" || _str === "Q") {
+        cleanup({
+          selectedIndex,
+          selectedItem: items[selectedIndex],
+          action: "close"
+        });
+        return;
+      }
+      if (key.name === "up" || _str === "k") {
+        selectedIndex = (selectedIndex - 1 + items.length) % items.length;
+        render();
+        return;
+      }
+      if (key.name === "down" || _str === "j") {
+        selectedIndex = (selectedIndex + 1) % items.length;
+        render();
+        return;
+      }
+      if (_str === " " || _str === "t" || _str === "T") {
+        const item = items[selectedIndex];
+        if (item) {
+          item.checked = !item.checked;
+          if (onToggle) {
+            await onToggle(item, selectedIndex);
+          }
         }
-        if (!commands.typecheck) {
-          commands.typecheck = "tsc --noEmit";
+        render();
+        return;
+      }
+      if (key.name === "return" || key.name === "enter") {
+        if (mode === "toggle") {
+          cleanup({
+            selectedIndex,
+            selectedItem: items[selectedIndex],
+            action: "close"
+          });
+        } else {
+          cleanup({
+            selectedIndex,
+            selectedItem: items[selectedIndex],
+            action: "select"
+          });
         }
-      } catch {}
-    }
-    const cargoPath = join13(this.cwd, "Cargo.toml");
-    if (existsSync21(cargoPath)) {
-      try {
-        commands.dev = commands.dev || "cargo run";
-        commands.build = commands.build || "cargo build";
-        commands.test = commands.test || "cargo test";
-        commands.lint = commands.lint || "cargo clippy";
-        frameworks.push("Rust Cargo");
-      } catch {}
-    }
-    const goModPath = join13(this.cwd, "go.mod");
-    if (existsSync21(goModPath)) {
-      try {
-        commands.dev = commands.dev || "go run .";
-        commands.build = commands.build || "go build ./...";
-        commands.test = commands.test || "go test ./...";
-        commands.lint = commands.lint || "golangci-lint run";
-        frameworks.push("Go Modules");
-      } catch {}
-    }
-    const pyprojectPath = join13(this.cwd, "pyproject.toml");
-    const requirementsPath = join13(this.cwd, "requirements.txt");
-    if (existsSync21(pyprojectPath) || existsSync21(requirementsPath)) {
-      commands.test = commands.test || "pytest";
-      commands.lint = commands.lint || "ruff check .";
-      if (existsSync21(join13(this.cwd, "uv.lock"))) {
-        frameworks.push("uv");
-        commands.test = "uv run pytest";
-      } else if (existsSync21(join13(this.cwd, "poetry.lock"))) {
-        frameworks.push("Poetry");
-        commands.test = "poetry run pytest";
+        return;
       }
-    }
-    if (existsSync21(join13(this.cwd, "Dockerfile"))) {
-      infrastructure.push("Docker");
-      const sanitizedName = projectName.toLowerCase().replace(/[^a-z0-9_-]/g, "-").replace(/^-+|-+$/g, "");
-      commands.dockerBuild = `docker build -t ${sanitizedName || "app"} .`;
-    }
-    if (existsSync21(join13(this.cwd, "nginx.conf"))) {
-      infrastructure.push("Nginx");
-    }
-    if (existsSync21(join13(this.cwd, "src/api.ts")) || existsSync21(join13(this.cwd, "src/api"))) {
-      architectureNotes.push("Backend API endpoints and network client logic are centralized in `src/api`.");
-    }
-    if (existsSync21(join13(this.cwd, "src/components"))) {
-      architectureNotes.push("Reusable UI presentation components live in `src/components/`.");
-    }
-    if (existsSync21(join13(this.cwd, "src/types.ts")) || existsSync21(join13(this.cwd, "src/types"))) {
-      architectureNotes.push("Shared TypeScript data models and interfaces are defined in `src/types`.");
-    }
-    if (existsSync21(join13(this.cwd, ".env.example"))) {
-      architectureNotes.push("Environment configuration template is in `.env.example`.");
-    }
-    if (commands.typecheck || commands.lint || commands.test) {
-      const checks = [];
-      if (commands.typecheck)
-        checks.push(`typecheck (\`${commands.typecheck}\`)`);
-      if (commands.lint)
-        checks.push(`lint (\`${commands.lint}\`)`);
-      if (commands.test)
-        checks.push(`tests (\`${commands.test}\`)`);
-      codeConventions.push(`Run ${checks.join(" and ")} before concluding any major code edits.`);
-    }
-    const instructionFiles = ["AGENTS.md", "CLAUDE.md", ".agents.md", "AGENTS.override.md"];
-    let hasExistingInstructions = false;
-    let existingInstructionFile;
-    for (const f of instructionFiles) {
-      if (existsSync21(join13(this.cwd, f))) {
-        hasExistingInstructions = true;
-        existingInstructionFile = f;
-        break;
+      if (_str && onAction) {
+        const item = items[selectedIndex];
+        const shouldExit = await onAction(_str.toLowerCase(), item, selectedIndex);
+        if (shouldExit) {
+          cleanup({
+            selectedIndex,
+            selectedItem: item,
+            action: "custom",
+            keyName: _str.toLowerCase()
+          });
+          return;
+        }
+        render();
       }
-    }
-    return {
-      projectName,
-      description,
-      languages,
-      packageManager,
-      frameworks,
-      infrastructure,
-      commands,
-      architectureNotes,
-      codeConventions,
-      hasExistingInstructions,
-      existingInstructionFile
     };
+    unsubscribe = addGlobalKeypressListener(onKeypress);
+    render();
+  });
+}
+
+// src/security/scanner.ts
+import { existsSync as existsSync22, readdirSync as readdirSync9, readFileSync as readFileSync14, statSync as statSync6 } from "fs";
+import { join as join14, relative as relative2, resolve as resolve18 } from "path";
+var SECURITY_RULES = [
+  {
+    id: "SEC-001",
+    category: "Secrets Leakage",
+    severity: "CRITICAL",
+    pattern: /sk-(?:proj-)?[A-Za-z0-9-_]{20,}/,
+    description: "Hardcoded OpenAI API key detected in source code.",
+    recommendation: "Store API keys in environment variables (e.g. process.env.OPENAI_API_KEY) or a secure vault."
+  },
+  {
+    id: "SEC-002",
+    category: "Secrets Leakage",
+    severity: "CRITICAL",
+    pattern: /AKIA[0-9A-Z]{16}/,
+    description: "Exposed AWS Access Key ID found in source code.",
+    recommendation: "Rotate the exposed key immediately and use IAM Roles or AWS environment credentials."
+  },
+  {
+    id: "SEC-003",
+    category: "Secrets Leakage",
+    severity: "CRITICAL",
+    pattern: /ghp_[0-9a-zA-Z]{36}/,
+    description: "Exposed GitHub Personal Access Token (PAT) detected.",
+    recommendation: "Revoke the token and inject credentials via GitHub Actions Secrets or environment variables."
+  },
+  {
+    id: "SEC-004",
+    category: "Secrets Leakage",
+    severity: "CRITICAL",
+    pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    description: "Unencrypted private cryptographic key committed to source repository.",
+    recommendation: "Remove private key from git history and manage certificates through a secret manager."
+  },
+  {
+    id: "SEC-005",
+    category: "Secrets Leakage",
+    severity: "HIGH",
+    pattern: /(?:postgres|mysql|mongodb(?:\+srv)?):\/\/[a-zA-Z0-9_.-]+:[^@\s"']+@[a-zA-Z0-9_.-]+/i,
+    description: "Hardcoded database connection string containing plaintext credentials.",
+    recommendation: "Extract connection URI into DATABASE_URL environment variable."
+  },
+  {
+    id: "SEC-010",
+    category: "Code Injection",
+    severity: "HIGH",
+    pattern: /\beval\s*\(/,
+    description: "Use of dangerous `eval()` function permits arbitrary code execution.",
+    recommendation: "Avoid eval(). Use structured JSON.parse() or dedicated domain-specific parsers.",
+    fileExtensions: [".js", ".ts", ".jsx", ".tsx", ".py"]
+  },
+  {
+    id: "SEC-011",
+    category: "Command Injection",
+    severity: "HIGH",
+    pattern: /(?:child_process|cp)\.exec\s*\([^,)]*\+/,
+    description: "Dynamic string concatenation in `child_process.exec()` creates command injection vectors.",
+    recommendation: "Use `execFile` or `spawn` with an array of arguments rather than executing raw shell strings.",
+    fileExtensions: [".js", ".ts"]
+  },
+  {
+    id: "SEC-020",
+    category: "Broken Authentication",
+    severity: "MEDIUM",
+    pattern: /jwt\.(?:sign|verify)\s*\([^,]+,\s*["'](?:secret|test|123456|dev|password)["']\s*\)/i,
+    description: "Weak or hardcoded JWT secret key used in token signing/verification.",
+    recommendation: "Use a high-entropy secret (at least 256 bits) loaded securely from environment variables.",
+    fileExtensions: [".js", ".ts", ".py"]
+  },
+  {
+    id: "SEC-021",
+    category: "Broken Authentication",
+    severity: "MEDIUM",
+    pattern: /jwt\.decode\s*\(/,
+    description: "`jwt.decode()` used without signature verification.",
+    recommendation: "Use `jwt.verify()` with explicit algorithm pinning to validate token authenticity.",
+    fileExtensions: [".js", ".ts"]
+  },
+  {
+    id: "SEC-030",
+    category: "SQL Injection",
+    severity: "HIGH",
+    pattern: /(?:SELECT|INSERT|UPDATE|DELETE)\s+.*(?:WHERE|VALUES)\s+.*["']\s*\+\s*[a-zA-Z0-9_.]+/i,
+    description: "Unparameterized raw SQL string concatenation detected.",
+    recommendation: "Use parameterized queries or ORM bindings (e.g. `$1`, `?`, or named parameters).",
+    fileExtensions: [".js", ".ts", ".py", ".go", ".rs"]
+  },
+  {
+    id: "SEC-040",
+    category: "SSRF",
+    severity: "HIGH",
+    pattern: /169\.254\.169\.254/,
+    description: "Direct reference to AWS/Cloud instance metadata IP address (169.254.169.254).",
+    recommendation: "Restrict outbound HTTP access to metadata endpoints and enforce egress IP filtering."
   }
-  generateAgentsMarkdown(analysis) {
-    const lines = [];
-    lines.push(`# ${analysis.projectName}`);
-    lines.push("");
-    if (analysis.description) {
-      lines.push(`> ${analysis.description}`);
-      lines.push("");
-    }
-    lines.push("## Commands");
-    lines.push("");
-    if (Object.keys(analysis.commands).length > 0) {
-      if (analysis.commands.dev)
-        lines.push(`- **Dev Server**: \`${analysis.commands.dev}\``);
-      if (analysis.commands.build)
-        lines.push(`- **Build**: \`${analysis.commands.build}\``);
-      if (analysis.commands.test)
-        lines.push(`- **Test**: \`${analysis.commands.test}\``);
-      if (analysis.commands.typecheck)
-        lines.push(`- **Typecheck**: \`${analysis.commands.typecheck}\``);
-      if (analysis.commands.lint)
-        lines.push(`- **Lint**: \`${analysis.commands.lint}\``);
-      if (analysis.commands.format)
-        lines.push(`- **Format**: \`${analysis.commands.format}\``);
-      if (analysis.commands.dockerBuild)
-        lines.push(`- **Docker Build**: \`${analysis.commands.dockerBuild}\``);
-    } else {
-      lines.push("- *No standard build/test commands detected.*");
-    }
-    lines.push("");
-    lines.push("## Architecture & Stack");
-    lines.push("");
-    const stackItems = [];
-    if (analysis.languages.length > 0)
-      stackItems.push(analysis.languages.join(", "));
-    if (analysis.frameworks.length > 0)
-      stackItems.push(analysis.frameworks.join(", "));
-    if (analysis.infrastructure.length > 0)
-      stackItems.push(analysis.infrastructure.join(", "));
-    if (stackItems.length > 0) {
-      lines.push(`- **Core Stack**: ${stackItems.join(" \u2022 ")}`);
-    }
-    for (const note of analysis.architectureNotes) {
-      lines.push(`- ${note}`);
-    }
-    lines.push("");
-    lines.push("## Workflow & Code Guidelines");
-    lines.push("");
-    if (analysis.codeConventions.length > 0) {
-      for (const conv of analysis.codeConventions) {
-        lines.push(`- ${conv}`);
-      }
-    }
-    lines.push("- Prefer targeted edits over whole-file rewrites.");
-    lines.push("- When fixing errors, address the root cause rather than suppressing compiler warnings.");
-    lines.push("");
-    return lines.join(`
-`);
-  }
-  extractReadmeMetadata() {
-    const readmeFiles = ["README.md", "readme.md", "README.MD"];
-    for (const file of readmeFiles) {
-      const fullPath = join13(this.cwd, file);
-      if (existsSync21(fullPath)) {
-        try {
-          const content = readFileSync13(fullPath, "utf8");
-          const lines = content.split(`
-`);
-          let title;
-          let description;
-          for (const line of lines) {
-            const trimmed = line.trim();
-            if (!title && trimmed.startsWith("# ")) {
-              title = trimmed.replace(/^#\s+/, "").trim();
-              continue;
-            }
-            if (title && !description && trimmed.length > 0 && !trimmed.startsWith("#") && !trimmed.startsWith("```") && !trimmed.startsWith("[")) {
-              description = trimmed;
-              break;
-            }
-          }
-          return { title, description };
-        } catch {}
-      }
+];
+var IGNORED_DIRS = new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  "vendor",
+  "target",
+  "tests",
+  "__tests__"
+]);
+var IGNORED_EXTS = new Set([
+  ".md",
+  ".mdx",
+  ".txt",
+  ".log",
+  ".svg",
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".ico",
+  ".woff",
+  ".woff2"
+]);
+var IGNORED_FILES = new Set([
+  "package-lock.json",
+  "bun.lock",
+  "bun.lockb",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "scanner.ts"
+]);
+async function runSecurityScan(targetDir, options = {}) {
+  const startTime = performance.now();
+  const root = resolve18(targetDir);
+  const isDirectTestDir = targetDir.includes("test") || Boolean(options.includeTests);
+  const maxFiles = options.maxFiles || 2000;
+  const findings = [];
+  let scannedCount = 0;
+  function walk(current) {
+    if (scannedCount >= maxFiles || !existsSync22(current))
+      return;
+    let entries;
+    try {
+      entries = readdirSync9(current);
+    } catch {
+      return;
     }
-    return {};
-  }
-  detectProjectName() {
-    const pkgPath = join13(this.cwd, "package.json");
-    if (existsSync21(pkgPath)) {
+    for (const entry of entries) {
+      if (scannedCount >= maxFiles)
+        break;
+      const fullPath = join14(current, entry);
+      let stat;
       try {
-        const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
-        if (pkg.name && pkg.name !== "frontend" && pkg.name !== "backend" && pkg.name !== "app") {
-          return pkg.name.startsWith("@") ? pkg.name.split("/")[1] || pkg.name : pkg.name;
+        stat = statSync6(fullPath);
+      } catch {
+        continue;
+      }
+      if (stat.isDirectory()) {
+        if (!entry.startsWith(".agent-worktrees") && (!IGNORED_DIRS.has(entry) || isDirectTestDir && (entry === "tests" || entry === "__tests__"))) {
+          walk(fullPath);
         }
-      } catch {}
-    }
-    const cargoPath = join13(this.cwd, "Cargo.toml");
-    if (existsSync21(cargoPath)) {
-      try {
-        const match = readFileSync13(cargoPath, "utf8").match(/name\s*=\s*"([^"]+)"/);
-        if (match?.[1])
-          return match[1];
-      } catch {}
-    }
-    const goModPath = join13(this.cwd, "go.mod");
-    if (existsSync21(goModPath)) {
-      try {
-        const match = readFileSync13(goModPath, "utf8").match(/module\s+([^\s]+)/);
-        if (match?.[1])
-          return basename3(match[1]);
-      } catch {}
-    }
-    return basename3(this.cwd);
-  }
-  detectLanguages() {
-    const langs = new Set;
-    if (existsSync21(join13(this.cwd, "tsconfig.json")) || this.hasFileWithExtension(".ts", ".tsx")) {
-      langs.add("TypeScript");
-    }
-    if (existsSync21(join13(this.cwd, "package.json")) || this.hasFileWithExtension(".js", ".jsx", ".mjs")) {
-      langs.add("JavaScript");
-    }
-    if (existsSync21(join13(this.cwd, "Cargo.toml")) || this.hasFileWithExtension(".rs")) {
-      langs.add("Rust");
-    }
-    if (existsSync21(join13(this.cwd, "go.mod")) || this.hasFileWithExtension(".go")) {
-      langs.add("Go");
-    }
-    if (existsSync21(join13(this.cwd, "pyproject.toml")) || existsSync21(join13(this.cwd, "requirements.txt")) || this.hasFileWithExtension(".py")) {
-      langs.add("Python");
-    }
-    if (existsSync21(join13(this.cwd, "pom.xml")) || existsSync21(join13(this.cwd, "build.gradle")) || this.hasFileWithExtension(".java")) {
-      langs.add("Java");
-    }
-    if (existsSync21(join13(this.cwd, "CMakeLists.txt")) || this.hasFileWithExtension(".cpp", ".c", ".h", ".hpp")) {
-      langs.add("C/C++");
+      } else if (stat.isFile()) {
+        if (IGNORED_FILES.has(entry) || stat.size > 2 * 1024 * 1024) {
+          continue;
+        }
+        const ext = entry.includes(".") ? `.${entry.split(".").pop().toLowerCase()}` : "";
+        if (IGNORED_EXTS.has(ext)) {
+          continue;
+        }
+        if (options.fileExtensions && options.fileExtensions.length > 0) {
+          if (!options.fileExtensions.includes(ext))
+            continue;
+        }
+        scannedCount++;
+        scanFile(fullPath, root, ext, findings);
+      }
     }
-    return Array.from(langs);
-  }
-  detectPackageManager() {
-    if (existsSync21(join13(this.cwd, "bun.lockb")) || existsSync21(join13(this.cwd, "bun.lock")))
-      return "bun";
-    if (existsSync21(join13(this.cwd, "pnpm-lock.yaml")))
-      return "pnpm";
-    if (existsSync21(join13(this.cwd, "yarn.lock")))
-      return "yarn";
-    if (existsSync21(join13(this.cwd, "package-lock.json")))
-      return "npm";
-    if (existsSync21(join13(this.cwd, "Cargo.lock")) || existsSync21(join13(this.cwd, "Cargo.toml")))
-      return "cargo";
-    if (existsSync21(join13(this.cwd, "uv.lock")))
-      return "uv";
-    if (existsSync21(join13(this.cwd, "poetry.lock")))
-      return "poetry";
-    if (existsSync21(join13(this.cwd, "go.sum")) || existsSync21(join13(this.cwd, "go.mod")))
-      return "go";
-    if (existsSync21(join13(this.cwd, "package.json")))
-      return "npm";
-    return;
   }
-  hasFileWithExtension(...exts) {
+  function scanFile(filePath, baseRoot, ext, out) {
+    let content;
     try {
-      const entries = readdirSync9(this.cwd);
-      return entries.some((e) => exts.some((ext) => e.endsWith(ext)));
+      content = readFileSync14(filePath, "utf8");
     } catch {
-      return false;
+      return;
+    }
+    const lines = content.split(`
+`);
+    const relPath = relative2(baseRoot, filePath);
+    for (let lineIdx = 0;lineIdx < lines.length; lineIdx++) {
+      const line = lines[lineIdx];
+      if (line.includes("SECURITY_RULES") || line.includes("pattern: /"))
+        continue;
+      for (const rule of SECURITY_RULES) {
+        if (rule.fileExtensions && ext && !rule.fileExtensions.includes(ext)) {
+          continue;
+        }
+        if (rule.pattern.test(line)) {
+          out.push({
+            id: rule.id,
+            category: rule.category,
+            severity: rule.severity,
+            filePath: relPath,
+            lineNumber: lineIdx + 1,
+            snippet: line.trim().slice(0, 120),
+            description: rule.description,
+            recommendation: rule.recommendation
+          });
+        }
+      }
     }
   }
+  walk(root);
+  const durationMs = performance.now() - startTime;
+  const summary = {
+    critical: findings.filter((f) => f.severity === "CRITICAL").length,
+    high: findings.filter((f) => f.severity === "HIGH").length,
+    medium: findings.filter((f) => f.severity === "MEDIUM").length,
+    low: findings.filter((f) => f.severity === "LOW").length
+  };
+  return {
+    scannedFiles: scannedCount,
+    findings,
+    durationMs,
+    summary
+  };
 }
+
+// src/mcp/servers/chrome-devtools/index.ts
+import { resolve as resolve19 } from "path";
+
+// src/mcp/servers/chrome-devtools/server.ts
+if (false) {}
+
+// src/mcp/servers/chrome-devtools/index.ts
+var __dirname = "/home/runner/work/agent-cli/agent-cli/src/mcp/servers/chrome-devtools";
+var CHROME_DEVTOOLS_MCP_SERVER_PATH = resolve19(__dirname, "server.ts");
+
+// src/mcp/servers/web-search/index.ts
+import { resolve as resolve20 } from "path";
+
+// src/mcp/servers/web-search/server.ts
+if (false) {}
+
+// src/mcp/servers/web-search/index.ts
+var __dirname = "/home/runner/work/agent-cli/agent-cli/src/mcp/servers/web-search";
+var WEB_SEARCH_MCP_SERVER_PATH = resolve20(__dirname, "server.ts");
+
+// src/mcp/servers/sqlite/index.ts
+import { resolve as resolve21 } from "path";
+
+// src/mcp/servers/sqlite/server.ts
+if (false) {}
+
+// src/mcp/servers/sqlite/index.ts
+var __dirname = "/home/runner/work/agent-cli/agent-cli/src/mcp/servers/sqlite";
+var SQLITE_MCP_SERVER_PATH = resolve21(__dirname, "server.ts");
 // src/init/init-command.ts
-import { existsSync as existsSync22, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync23, writeFileSync as writeFileSync8 } from "fs";
+import { join as join15 } from "path";
 function runProjectInit(options = {}) {
   const cwd = options.cwd || process.cwd();
   const filename = options.filename || "AGENTS.md";
-  const targetPath = join14(cwd, filename);
+  const targetPath = join15(cwd, filename);
   const analyzer = new ProjectAnalyzer(cwd);
   const analysis = analyzer.analyze();
   const content = analyzer.generateAgentsMarkdown(analysis);
-  const alreadyExists = existsSync22(targetPath);
+  const alreadyExists = existsSync23(targetPath);
   writeFileSync8(targetPath, content, "utf8");
   return {
     success: true,
@@ -10452,9 +10757,9 @@ class MarkdownHighlighter {
 }
 
 // src/cli/update-checker.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync24, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var CHECK_INTERVAL_MS = 12 * 60 * 60 * 1000;
 function parseSemver(v) {
   const clean = v.replace(/^v/, "").trim();
@@ -10475,8 +10780,8 @@ function isNewerVersion(current, remote) {
   return remPatch > curPatch;
 }
 function getUpdateCachePath() {
-  const baseDir = process.env.PIKAA_HOME || process.env.GROUPY_HOME || join15(homedir4(), ".pikaa");
-  return join15(baseDir, "update-cache.json");
+  const baseDir = process.env.PIKAA_HOME || process.env.GROUPY_HOME || join16(homedir4(), ".pikaa");
+  return join16(baseDir, "update-cache.json");
 }
 async function fetchLatestNpmVersion(packageName, timeoutMs = 1500) {
   const url = `https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`;
@@ -10509,9 +10814,9 @@ async function checkForUpdates(options = {}) {
   const cachePath = options.cachePath || getUpdateCachePath();
   const now = Date.now();
   let cached = null;
-  if (!options.force && existsSync23(cachePath)) {
+  if (!options.force && existsSync24(cachePath)) {
     try {
-      const raw = JSON.parse(readFileSync14(cachePath, "utf8"));
+      const raw = JSON.parse(readFileSync15(cachePath, "utf8"));
       if (raw && typeof raw.lastChecked === "number" && typeof raw.latestVersion === "string") {
         cached = raw;
         if (now - cached.lastChecked < CHECK_INTERVAL_MS) {
@@ -10539,8 +10844,8 @@ async function checkForUpdates(options = {}) {
     return null;
   }
   try {
-    const parentDir = join15(cachePath, "..");
-    if (!existsSync23(parentDir)) {
+    const parentDir = join16(cachePath, "..");
+    if (!existsSync24(parentDir)) {
       mkdirSync13(parentDir, { recursive: true });
     }
     const cacheData = {
@@ -10679,6 +10984,25 @@ class CliRepl {
           formatTaskProgressPlan(msg.plan, msg.explanation);
           this.spinner.start("Executing next step...", this.turnStartTime);
           break;
+        case "VerificationStarted":
+          this.spinner.stop();
+          console.log(style.cyan(`
+  \uD83D\uDD0D Auto-Verification: Running '${msg.command}'...`));
+          this.spinner.start(`Verifying changes with ${msg.command}...`, this.turnStartTime);
+          break;
+        case "VerificationCompleted":
+          this.spinner.stop();
+          if (msg.success) {
+            console.log(style.green(`  \u2713 Auto-Verification passed: ${msg.command} (${msg.durationMs ?? 0}ms)`));
+          } else {
+            console.log(style.red(`  \u2717 Auto-Verification failed: ${msg.command} (${msg.durationMs ?? 0}ms)`));
+          }
+          break;
+        case "SelfHealingStarted":
+          this.spinner.stop();
+          console.log(style.yellow(`  \uD83E\uDE79 Self-Healing Loop triggered (Attempt ${msg.attempt}/${msg.maxAttempts}): Auto-fixing detected errors...`));
+          this.spinner.start(`Self-healing [${msg.attempt}/${msg.maxAttempts}]...`, this.turnStartTime);
+          break;
         case "TurnCompleted":
           if (this.reasoningStarted) {
             console.log(style.dim(`
@@ -10983,7 +11307,7 @@ async function main() {
     resolve22(cwd, "mcp_config.json")
   ].filter(Boolean);
   for (const cfg of candidateConfigs) {
-    if (existsSync24(cfg)) {
+    if (existsSync25(cfg)) {
       try {
         await mcpManager.loadConfigFile(cfg);
         mcpManager.registerToolsIntoRouter(tools);