@probelabs/visor 0.1.129 → 0.1.130

package/dist/sdk/{chunk-DGZPPGJJ.mjs → chunk-EUUAQBTW.mjs}

@@ -1,7 +1,15 @@
+import {
+  getPromptStateManager,
+  init_prompt_state
+} from "./chunk-LG4AUKHB.mjs";
 import {
   generateHumanId,
   init_human_id
 } from "./chunk-KFKHU6CM.mjs";
+import {
+  init_tracer_init,
+  initializeTracer
+} from "./chunk-B7BVQM5K.mjs";
 import {
   SessionRegistry,
   init_session_registry,
@@ -10,21 +18,17 @@ import {
 import {
   commandExecutor,
   init_command_executor
-} from "./chunk-XDLQ3UNF.mjs";
+} from "./chunk-GEW6LS32.mjs";
 import {
   DependencyResolver,
   WorkflowRegistry,
   init_dependency_resolver,
   init_workflow_registry
-} from "./chunk-D5KI4YQ4.mjs";
+} from "./chunk-DIND4ZCV.mjs";
 import {
   config_exports,
   init_config
-} from "./chunk-7YSOINAQ.mjs";
-import {
-  getPromptStateManager,
-  init_prompt_state
-} from "./chunk-6W75IMDC.mjs";
+} from "./chunk-UCNT3PDT.mjs";
 import {
   ExecutionJournal,
   checkLoopBudget,
@@ -33,11 +37,11 @@ import {
   init_routing,
   init_snapshot_store,
   snapshot_store_exports
-} from "./chunk-SGS2VMEL.mjs";
+} from "./chunk-VMLORODQ.mjs";
 import {
   FailureConditionEvaluator,
   init_failure_condition_evaluator
-} from "./chunk-N7HO6KKC.mjs";
+} from "./chunk-HOKQOO3G.mjs";
 import {
   addEvent,
   emitNdjsonFallback,
@@ -48,15 +52,15 @@ import {
   setSpanAttributes,
   trace_helpers_exports,
   withActiveSpan
-} from "./chunk-J5RGJQ53.mjs";
+} from "./chunk-YJRBN3XS.mjs";
 import {
   addDiagramBlock,
   init_metrics
-} from "./chunk-XR7XXGL7.mjs";
+} from "./chunk-JL7JXCET.mjs";
 import {
   createExtendedLiquid,
   init_liquid_extensions
-} from "./chunk-R5Z7YWPB.mjs";
+} from "./chunk-V2IV3ILA.mjs";
 import {
   createPermissionHelpers,
   detectLocalMode,
@@ -72,21 +76,18 @@ import {
   MemoryStore,
   init_memory_store,
   memory_store_exports
-} from "./chunk-2KB35MB7.mjs";
+} from "./chunk-VPC3QSPW.mjs";
 import {
   init_logger,
-  logger
-} from "./chunk-PO7X5XI7.mjs";
+  logger,
+  logger_exports
+} from "./chunk-SZXICFQ3.mjs";
 import {
   context,
   init_lazy_otel,
   lazy_otel_exports,
   trace
-} from "./chunk-HEX3RL32.mjs";
-import {
-  init_tracer_init,
-  initializeTracer
-} from "./chunk-B7BVQM5K.mjs";
+} from "./chunk-UCMJJ3IM.mjs";
 import {
   __commonJS,
   __esm,
@@ -115,7 +116,7 @@ async function processDiffWithOutline(diffContent) {
   }
   try {
     const originalProbePath = process.env.PROBE_PATH;
-    const fs10 = __require("fs");
+    const fs11 = __require("fs");
     const possiblePaths = [
       // Relative to current working directory (most common in production)
       path.join(process.cwd(), "node_modules/@probelabs/probe/bin/probe-binary"),
@@ -126,7 +127,7 @@ async function processDiffWithOutline(diffContent) {
     ];
     let probeBinaryPath;
     for (const candidatePath of possiblePaths) {
-      if (fs10.existsSync(candidatePath)) {
+      if (fs11.existsSync(candidatePath)) {
         probeBinaryPath = candidatePath;
         break;
       }
@@ -1188,8 +1189,8 @@ ${schemaString}`);
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs10 = __require("fs");
-              const path12 = __require("path");
+              const fs11 = __require("fs");
+              const path14 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const provider = this.config.provider || "auto";
               const model = this.config.model || "default";
@@ -1303,20 +1304,20 @@ ${"=".repeat(60)}
 `;
               readableVersion += `${"=".repeat(60)}
 `;
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path12.join(process.cwd(), "debug-artifacts");
-              if (!fs10.existsSync(debugArtifactsDir)) {
-                fs10.mkdirSync(debugArtifactsDir, { recursive: true });
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
+              if (!fs11.existsSync(debugArtifactsDir)) {
+                fs11.mkdirSync(debugArtifactsDir, { recursive: true });
               }
-              const debugFile = path12.join(
+              const debugFile = path14.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.json`
               );
-              fs10.writeFileSync(debugFile, debugJson, "utf-8");
-              const readableFile = path12.join(
+              fs11.writeFileSync(debugFile, debugJson, "utf-8");
+              const readableFile = path14.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.txt`
               );
-              fs10.writeFileSync(readableFile, readableVersion, "utf-8");
+              fs11.writeFileSync(readableFile, readableVersion, "utf-8");
               log(`
 \u{1F4BE} Full debug info saved to:`);
               log(`   JSON: ${debugFile}`);
@@ -1349,8 +1350,8 @@ ${"=".repeat(60)}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs10 = __require("fs");
-              const path12 = __require("path");
+              const fs11 = __require("fs");
+              const path14 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny2 = agent;
               let fullHistory = [];
@@ -1361,8 +1362,8 @@ ${"=".repeat(60)}
               } else if (agentAny2._messages) {
                 fullHistory = agentAny2._messages;
               }
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path12.join(process.cwd(), "debug-artifacts");
-              const sessionBase = path12.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
+              const sessionBase = path14.join(
                 debugArtifactsDir,
                 `session-${_checkName || "unknown"}-${timestamp}`
               );
@@ -1374,7 +1375,7 @@ ${"=".repeat(60)}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs10.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs11.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -1401,7 +1402,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs10.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs11.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -1410,11 +1411,11 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs10 = __require("fs");
-              const path12 = __require("path");
+              const fs11 = __require("fs");
+              const path14 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path12.join(process.cwd(), "debug-artifacts");
-              const responseFile = path12.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
+              const responseFile = path14.join(
                 debugArtifactsDir,
                 `response-${_checkName || "unknown"}-${timestamp}.txt`
               );
@@ -1447,7 +1448,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs10.writeFileSync(responseFile, responseContent, "utf-8");
+              fs11.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -1463,9 +1464,9 @@ ${"=".repeat(60)}
                 await agentAny._telemetryConfig.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${agentAny._traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs10 = __require("fs");
-                  if (fs10.existsSync(agentAny._traceFilePath)) {
-                    const stats = fs10.statSync(agentAny._traceFilePath);
+                  const fs11 = __require("fs");
+                  if (fs11.existsSync(agentAny._traceFilePath)) {
+                    const stats = fs11.statSync(agentAny._traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::${agentAny._traceFilePath} (${stats.size} bytes)`
                     );
@@ -1660,8 +1661,8 @@ ${schemaString}`);
           const model = this.config.model || "default";
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs10 = __require("fs");
-              const path12 = __require("path");
+              const fs11 = __require("fs");
+              const path14 = __require("path");
               const os = __require("os");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugData = {
@@ -1735,18 +1736,18 @@ ${"=".repeat(60)}
               readableVersion += `${"=".repeat(60)}
 `;
               const tempDir = os.tmpdir();
-              const promptFile = path12.join(tempDir, `visor-prompt-${timestamp}.txt`);
-              fs10.writeFileSync(promptFile, prompt, "utf-8");
+              const promptFile = path14.join(tempDir, `visor-prompt-${timestamp}.txt`);
+              fs11.writeFileSync(promptFile, prompt, "utf-8");
               log(`
 \u{1F4BE} Prompt saved to: ${promptFile}`);
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path12.join(process.cwd(), "debug-artifacts");
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
               try {
-                const base = path12.join(
+                const base = path14.join(
                   debugArtifactsDir,
                   `prompt-${_checkName || "unknown"}-${timestamp}`
                 );
-                fs10.writeFileSync(base + ".json", debugJson, "utf-8");
-                fs10.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
+                fs11.writeFileSync(base + ".json", debugJson, "utf-8");
+                fs11.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
                 log(`
 \u{1F4BE} Full debug info saved to directory: ${debugArtifactsDir}`);
               } catch {
@@ -1791,8 +1792,8 @@ $ ${cliCommand}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs10 = __require("fs");
-              const path12 = __require("path");
+              const fs11 = __require("fs");
+              const path14 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny = agent;
               let fullHistory = [];
@@ -1803,8 +1804,8 @@ $ ${cliCommand}
               } else if (agentAny._messages) {
                 fullHistory = agentAny._messages;
               }
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path12.join(process.cwd(), "debug-artifacts");
-              const sessionBase = path12.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
+              const sessionBase = path14.join(
                 debugArtifactsDir,
                 `session-${_checkName || "unknown"}-${timestamp}`
               );
@@ -1816,7 +1817,7 @@ $ ${cliCommand}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs10.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs11.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -1843,7 +1844,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs10.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs11.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -1852,11 +1853,11 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs10 = __require("fs");
-              const path12 = __require("path");
+              const fs11 = __require("fs");
+              const path14 = __require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path12.join(process.cwd(), "debug-artifacts");
-              const responseFile = path12.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path14.join(process.cwd(), "debug-artifacts");
+              const responseFile = path14.join(
                 debugArtifactsDir,
                 `response-${_checkName || "unknown"}-${timestamp}.txt`
               );
@@ -1889,7 +1890,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs10.writeFileSync(responseFile, responseContent, "utf-8");
+              fs11.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -1907,9 +1908,9 @@ ${"=".repeat(60)}
                 await telemetry.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs10 = __require("fs");
-                  if (fs10.existsSync(traceFilePath)) {
-                    const stats = fs10.statSync(traceFilePath);
+                  const fs11 = __require("fs");
+                  if (fs11.existsSync(traceFilePath)) {
+                    const stats = fs11.statSync(traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::OpenTelemetry trace file size: ${stats.size} bytes`
                     );
@@ -1947,8 +1948,8 @@ ${"=".repeat(60)}
        * Load schema content from schema files or inline definitions
        */
       async loadSchemaContent(schema) {
-        const fs10 = __require("fs").promises;
-        const path12 = __require("path");
+        const fs11 = __require("fs").promises;
+        const path14 = __require("path");
         if (typeof schema === "object" && schema !== null) {
           log("\u{1F4CB} Using inline schema object from configuration");
           return JSON.stringify(schema);
@@ -1961,14 +1962,14 @@ ${"=".repeat(60)}
           }
         } catch {
         }
-        if ((schema.startsWith("./") || schema.includes(".json")) && !path12.isAbsolute(schema)) {
+        if ((schema.startsWith("./") || schema.includes(".json")) && !path14.isAbsolute(schema)) {
           if (schema.includes("..") || schema.includes("\0")) {
             throw new Error("Invalid schema path: path traversal not allowed");
           }
           try {
-            const schemaPath = path12.resolve(process.cwd(), schema);
+            const schemaPath = path14.resolve(process.cwd(), schema);
             log(`\u{1F4CB} Loading custom schema from file: ${schemaPath}`);
-            const schemaContent = await fs10.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs11.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch (error) {
             throw new Error(
@@ -1982,22 +1983,22 @@ ${"=".repeat(60)}
         }
         const candidatePaths = [
           // GitHub Action bundle location
-          path12.join(__dirname, "output", sanitizedSchemaName, "schema.json"),
+          path14.join(__dirname, "output", sanitizedSchemaName, "schema.json"),
           // Historical fallback when src/output was inadvertently bundled as output1/
-          path12.join(__dirname, "output1", sanitizedSchemaName, "schema.json"),
+          path14.join(__dirname, "output1", sanitizedSchemaName, "schema.json"),
           // Local dev (repo root)
-          path12.join(process.cwd(), "output", sanitizedSchemaName, "schema.json")
+          path14.join(process.cwd(), "output", sanitizedSchemaName, "schema.json")
         ];
         for (const schemaPath of candidatePaths) {
           try {
-            const schemaContent = await fs10.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs11.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch {
           }
         }
-        const distPath = path12.join(__dirname, "output", sanitizedSchemaName, "schema.json");
-        const distAltPath = path12.join(__dirname, "output1", sanitizedSchemaName, "schema.json");
-        const cwdPath = path12.join(process.cwd(), "output", sanitizedSchemaName, "schema.json");
+        const distPath = path14.join(__dirname, "output", sanitizedSchemaName, "schema.json");
+        const distAltPath = path14.join(__dirname, "output1", sanitizedSchemaName, "schema.json");
+        const cwdPath = path14.join(process.cwd(), "output", sanitizedSchemaName, "schema.json");
         throw new Error(
           `Failed to load schema '${sanitizedSchemaName}'. Tried: ${distPath}, ${distAltPath}, and ${cwdPath}. Ensure build copies 'output/' into dist (build:cli), or provide a custom schema file/path.`
         );
@@ -2188,7 +2189,7 @@ ${"=".repeat(60)}
        * Generate mock response for testing
        */
       async generateMockResponse(_prompt, _checkName, _schema) {
-        await new Promise((resolve5) => setTimeout(resolve5, 500));
+        await new Promise((resolve6) => setTimeout(resolve6, 500));
         const name = (_checkName || "").toLowerCase();
         if (name.includes("extract-facts")) {
           const arr = Array.from({ length: 6 }, (_, i) => ({
@@ -2996,7 +2997,7 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
     ...args,
     ...argsOverrides
   };
-  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-A44PBPG2.mjs");
+  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-2ET3SFZH.mjs");
   const provider = new WorkflowCheckProvider2();
   const checkConfig = {
     type: "workflow",
@@ -3054,38 +3055,569 @@ var init_workflow_tool_executor = __esm({
   }
 });
 
-// src/scheduler/schedule-store.ts
-import fs2 from "fs/promises";
+// src/scheduler/store/sqlite-store.ts
 import path3 from "path";
+import fs2 from "fs";
 import { v4 as uuidv4 } from "uuid";
+function toDbRow(schedule) {
+  return {
+    id: schedule.id,
+    creator_id: schedule.creatorId,
+    creator_context: schedule.creatorContext ?? null,
+    creator_name: schedule.creatorName ?? null,
+    timezone: schedule.timezone,
+    schedule_expr: schedule.schedule,
+    run_at: schedule.runAt ?? null,
+    is_recurring: schedule.isRecurring ? 1 : 0,
+    original_expression: schedule.originalExpression,
+    workflow: schedule.workflow ?? null,
+    workflow_inputs: schedule.workflowInputs ? JSON.stringify(schedule.workflowInputs) : null,
+    output_context: schedule.outputContext ? JSON.stringify(schedule.outputContext) : null,
+    status: schedule.status,
+    created_at: schedule.createdAt,
+    last_run_at: schedule.lastRunAt ?? null,
+    next_run_at: schedule.nextRunAt ?? null,
+    run_count: schedule.runCount,
+    failure_count: schedule.failureCount,
+    last_error: schedule.lastError ?? null,
+    previous_response: schedule.previousResponse ?? null
+  };
+}
+function safeJsonParse(value) {
+  if (!value) return void 0;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}
+function fromDbRow(row) {
+  return {
+    id: row.id,
+    creatorId: row.creator_id,
+    creatorContext: row.creator_context ?? void 0,
+    creatorName: row.creator_name ?? void 0,
+    timezone: row.timezone,
+    schedule: row.schedule_expr,
+    runAt: row.run_at ?? void 0,
+    isRecurring: row.is_recurring === 1,
+    originalExpression: row.original_expression,
+    workflow: row.workflow ?? void 0,
+    workflowInputs: safeJsonParse(row.workflow_inputs),
+    outputContext: safeJsonParse(row.output_context),
+    status: row.status,
+    createdAt: row.created_at,
+    lastRunAt: row.last_run_at ?? void 0,
+    nextRunAt: row.next_run_at ?? void 0,
+    runCount: row.run_count,
+    failureCount: row.failure_count,
+    lastError: row.last_error ?? void 0,
+    previousResponse: row.previous_response ?? void 0
+  };
+}
+var SqliteStoreBackend;
+var init_sqlite_store = __esm({
+  "src/scheduler/store/sqlite-store.ts"() {
+    "use strict";
+    init_logger();
+    SqliteStoreBackend = class {
+      db = null;
+      dbPath;
+      // In-memory locks (single-node only; SQLite doesn't support distributed locking)
+      locks = /* @__PURE__ */ new Map();
+      constructor(filename) {
+        this.dbPath = filename || ".visor/schedules.db";
+      }
+      async initialize() {
+        const resolvedPath = path3.resolve(process.cwd(), this.dbPath);
+        const dir = path3.dirname(resolvedPath);
+        fs2.mkdirSync(dir, { recursive: true });
+        const { createRequire } = __require("module");
+        const runtimeRequire = createRequire(__filename);
+        let Database;
+        try {
+          Database = runtimeRequire("better-sqlite3");
+        } catch (err) {
+          const code = err?.code;
+          if (code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND") {
+            throw new Error(
+              "better-sqlite3 is required for SQLite schedule storage. Install it with: npm install better-sqlite3"
+            );
+          }
+          throw err;
+        }
+        this.db = new Database(resolvedPath);
+        this.db.pragma("journal_mode = WAL");
+        this.migrateSchema();
+        logger.info(`[SqliteStore] Initialized at ${this.dbPath}`);
+      }
+      async shutdown() {
+        if (this.db) {
+          this.db.close();
+          this.db = null;
+        }
+        this.locks.clear();
+      }
+      // --- Schema Migration ---
+      migrateSchema() {
+        const db = this.getDb();
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS schedules (
+        id              VARCHAR(36)  PRIMARY KEY,
+        creator_id      VARCHAR(255) NOT NULL,
+        creator_context VARCHAR(255),
+        creator_name    VARCHAR(255),
+        timezone        VARCHAR(64)  NOT NULL DEFAULT 'UTC',
+        schedule_expr   VARCHAR(255),
+        run_at          BIGINT,
+        is_recurring    BOOLEAN      NOT NULL,
+        original_expression TEXT,
+        workflow        VARCHAR(255),
+        workflow_inputs TEXT,
+        output_context  TEXT,
+        status          VARCHAR(20)  NOT NULL,
+        created_at      BIGINT       NOT NULL,
+        last_run_at     BIGINT,
+        next_run_at     BIGINT,
+        run_count       INTEGER      NOT NULL DEFAULT 0,
+        failure_count   INTEGER      NOT NULL DEFAULT 0,
+        last_error      TEXT,
+        previous_response TEXT,
+        claimed_by      VARCHAR(255),
+        claimed_at      BIGINT,
+        lock_token      VARCHAR(36)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_schedules_creator_id
+        ON schedules(creator_id);
+
+      CREATE INDEX IF NOT EXISTS idx_schedules_status
+        ON schedules(status);
+
+      CREATE INDEX IF NOT EXISTS idx_schedules_status_next_run
+        ON schedules(status, next_run_at);
+
+      CREATE TABLE IF NOT EXISTS scheduler_locks (
+        lock_id     VARCHAR(255) PRIMARY KEY,
+        node_id     VARCHAR(255) NOT NULL,
+        lock_token  VARCHAR(36)  NOT NULL,
+        acquired_at BIGINT       NOT NULL,
+        expires_at  BIGINT       NOT NULL
+      );
+    `);
+      }
+      // --- Helpers ---
+      getDb() {
+        if (!this.db) {
+          throw new Error("[SqliteStore] Database not initialized. Call initialize() first.");
+        }
+        return this.db;
+      }
+      // --- CRUD ---
+      async create(schedule) {
+        const db = this.getDb();
+        const newSchedule = {
+          ...schedule,
+          id: uuidv4(),
+          createdAt: Date.now(),
+          runCount: 0,
+          failureCount: 0,
+          status: "active"
+        };
+        const row = toDbRow(newSchedule);
+        db.prepare(
+          `
+      INSERT INTO schedules (
+        id, creator_id, creator_context, creator_name, timezone,
+        schedule_expr, run_at, is_recurring, original_expression,
+        workflow, workflow_inputs, output_context,
+        status, created_at, last_run_at, next_run_at,
+        run_count, failure_count, last_error, previous_response
+      ) VALUES (
+        ?, ?, ?, ?, ?,
+        ?, ?, ?, ?,
+        ?, ?, ?,
+        ?, ?, ?, ?,
+        ?, ?, ?, ?
+      )
+    `
+        ).run(
+          row.id,
+          row.creator_id,
+          row.creator_context,
+          row.creator_name,
+          row.timezone,
+          row.schedule_expr,
+          row.run_at,
+          row.is_recurring,
+          row.original_expression,
+          row.workflow,
+          row.workflow_inputs,
+          row.output_context,
+          row.status,
+          row.created_at,
+          row.last_run_at,
+          row.next_run_at,
+          row.run_count,
+          row.failure_count,
+          row.last_error,
+          row.previous_response
+        );
+        logger.info(
+          `[SqliteStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}`
+        );
+        return newSchedule;
+      }
+      async importSchedule(schedule) {
+        const db = this.getDb();
+        const row = toDbRow(schedule);
+        db.prepare(
+          `
+      INSERT OR IGNORE INTO schedules (
+        id, creator_id, creator_context, creator_name, timezone,
+        schedule_expr, run_at, is_recurring, original_expression,
+        workflow, workflow_inputs, output_context,
+        status, created_at, last_run_at, next_run_at,
+        run_count, failure_count, last_error, previous_response
+      ) VALUES (
+        ?, ?, ?, ?, ?,
+        ?, ?, ?, ?,
+        ?, ?, ?,
+        ?, ?, ?, ?,
+        ?, ?, ?, ?
+      )
+    `
+        ).run(
+          row.id,
+          row.creator_id,
+          row.creator_context,
+          row.creator_name,
+          row.timezone,
+          row.schedule_expr,
+          row.run_at,
+          row.is_recurring,
+          row.original_expression,
+          row.workflow,
+          row.workflow_inputs,
+          row.output_context,
+          row.status,
+          row.created_at,
+          row.last_run_at,
+          row.next_run_at,
+          row.run_count,
+          row.failure_count,
+          row.last_error,
+          row.previous_response
+        );
+      }
+      async get(id) {
+        const db = this.getDb();
+        const row = db.prepare("SELECT * FROM schedules WHERE id = ?").get(id);
+        return row ? fromDbRow(row) : void 0;
+      }
+      async update(id, patch) {
+        const db = this.getDb();
+        const existing = db.prepare("SELECT * FROM schedules WHERE id = ?").get(id);
+        if (!existing) return void 0;
+        const current = fromDbRow(existing);
+        const updated = { ...current, ...patch, id: current.id };
+        const row = toDbRow(updated);
+        db.prepare(
+          `
+      UPDATE schedules SET
+        creator_id = ?, creator_context = ?, creator_name = ?, timezone = ?,
+        schedule_expr = ?, run_at = ?, is_recurring = ?, original_expression = ?,
+        workflow = ?, workflow_inputs = ?, output_context = ?,
+        status = ?, last_run_at = ?, next_run_at = ?,
+        run_count = ?, failure_count = ?, last_error = ?, previous_response = ?
+      WHERE id = ?
+    `
+        ).run(
+          row.creator_id,
+          row.creator_context,
+          row.creator_name,
+          row.timezone,
+          row.schedule_expr,
+          row.run_at,
+          row.is_recurring,
+          row.original_expression,
+          row.workflow,
+          row.workflow_inputs,
+          row.output_context,
+          row.status,
+          row.last_run_at,
+          row.next_run_at,
+          row.run_count,
+          row.failure_count,
+          row.last_error,
+          row.previous_response,
+          row.id
+        );
+        return updated;
+      }
+      async delete(id) {
+        const db = this.getDb();
+        const result = db.prepare("DELETE FROM schedules WHERE id = ?").run(id);
+        if (result.changes > 0) {
+          logger.info(`[SqliteStore] Deleted schedule ${id}`);
+          return true;
+        }
+        return false;
+      }
+      // --- Queries ---
+      async getByCreator(creatorId) {
+        const db = this.getDb();
+        const rows = db.prepare("SELECT * FROM schedules WHERE creator_id = ?").all(creatorId);
+        return rows.map(fromDbRow);
+      }
+      async getActiveSchedules() {
+        const db = this.getDb();
+        const rows = db.prepare("SELECT * FROM schedules WHERE status = 'active'").all();
+        return rows.map(fromDbRow);
+      }
+      async getDueSchedules(now) {
+        const ts = now ?? Date.now();
+        const db = this.getDb();
+        const rows = db.prepare(
+          `SELECT * FROM schedules
+         WHERE status = 'active'
+         AND (
+           (is_recurring = 0 AND run_at IS NOT NULL AND run_at <= ?)
+           OR
+           (is_recurring = 1 AND next_run_at IS NOT NULL AND next_run_at <= ?)
+         )`
+        ).all(ts, ts);
+        return rows.map(fromDbRow);
+      }
+      async findByWorkflow(creatorId, workflowName) {
+        const db = this.getDb();
+        const escaped = workflowName.toLowerCase().replace(/[%_\\]/g, "\\$&");
+        const pattern = `%${escaped}%`;
+        const rows = db.prepare(
+          `SELECT * FROM schedules
+         WHERE creator_id = ? AND status = 'active'
+         AND LOWER(workflow) LIKE ? ESCAPE '\\'`
+        ).all(creatorId, pattern);
+        return rows.map(fromDbRow);
+      }
+      async getAll() {
+        const db = this.getDb();
+        const rows = db.prepare("SELECT * FROM schedules").all();
+        return rows.map(fromDbRow);
+      }
+      async getStats() {
+        const db = this.getDb();
+        const row = db.prepare(
+          `SELECT
+          COUNT(*) as total,
+          SUM(CASE WHEN status = 'active' THEN 1 ELSE 0 END) as active,
+          SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END) as paused,
+          SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed,
+          SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as failed,
+          SUM(CASE WHEN is_recurring = 1 THEN 1 ELSE 0 END) as recurring,
+          SUM(CASE WHEN is_recurring = 0 THEN 1 ELSE 0 END) as one_time
+        FROM schedules`
+        ).get();
+        return {
+          total: row.total,
+          active: row.active,
+          paused: row.paused,
+          completed: row.completed,
+          failed: row.failed,
+          recurring: row.recurring,
+          oneTime: row.one_time
+        };
+      }
+      async validateLimits(creatorId, isRecurring, limits) {
+        const db = this.getDb();
+        if (limits.maxGlobal) {
+          const row = db.prepare("SELECT COUNT(*) as cnt FROM schedules").get();
+          if (row.cnt >= limits.maxGlobal) {
+            throw new Error(`Global schedule limit reached (${limits.maxGlobal})`);
+          }
+        }
+        if (limits.maxPerUser) {
+          const row = db.prepare("SELECT COUNT(*) as cnt FROM schedules WHERE creator_id = ?").get(creatorId);
+          if (row.cnt >= limits.maxPerUser) {
+            throw new Error(`You have reached the maximum number of schedules (${limits.maxPerUser})`);
+          }
+        }
+        if (isRecurring && limits.maxRecurringPerUser) {
+          const row = db.prepare("SELECT COUNT(*) as cnt FROM schedules WHERE creator_id = ? AND is_recurring = 1").get(creatorId);
+          if (row.cnt >= limits.maxRecurringPerUser) {
+            throw new Error(
+              `You have reached the maximum number of recurring schedules (${limits.maxRecurringPerUser})`
+            );
+          }
+        }
+      }
+      // --- HA Locking (in-memory for SQLite — single-node only) ---
+      async tryAcquireLock(scheduleId, nodeId, ttlSeconds) {
+        const now = Date.now();
+        const existing = this.locks.get(scheduleId);
+        if (existing && existing.expiresAt > now) {
+          if (existing.nodeId === nodeId) {
+            return existing.token;
+          }
+          return null;
+        }
+        const token = uuidv4();
+        this.locks.set(scheduleId, {
+          nodeId,
+          token,
+          expiresAt: now + ttlSeconds * 1e3
+        });
+        return token;
+      }
+      async releaseLock(scheduleId, lockToken) {
+        const existing = this.locks.get(scheduleId);
+        if (existing && existing.token === lockToken) {
+          this.locks.delete(scheduleId);
+        }
+      }
+      async renewLock(scheduleId, lockToken, ttlSeconds) {
+        const existing = this.locks.get(scheduleId);
+        if (!existing || existing.token !== lockToken) {
+          return false;
+        }
+        existing.expiresAt = Date.now() + ttlSeconds * 1e3;
+        return true;
+      }
+      async flush() {
+      }
+    };
+  }
+});
+
+// src/scheduler/store/index.ts
+async function createStoreBackend(storageConfig, haConfig) {
+  const driver = storageConfig?.driver || "sqlite";
+  switch (driver) {
+    case "sqlite": {
+      const conn = storageConfig?.connection;
+      return new SqliteStoreBackend(conn?.filename);
+    }
+    case "postgresql":
+    case "mysql":
+    case "mssql": {
+      try {
+        const loaderPath = "../../enterprise/loader";
+        const { loadEnterpriseStoreBackend } = await import(loaderPath);
+        return await loadEnterpriseStoreBackend(driver, storageConfig, haConfig);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error(`[StoreFactory] Failed to load enterprise ${driver} backend: ${msg}`);
+        throw new Error(
+          `The ${driver} schedule storage driver requires a Visor Enterprise license. Install the enterprise package or use driver: 'sqlite' (default). Original error: ${msg}`
+        );
+      }
+    }
+    default:
+      throw new Error(`Unknown schedule storage driver: ${driver}`);
+  }
+}
+var init_store = __esm({
+  "src/scheduler/store/index.ts"() {
+    "use strict";
+    init_logger();
+    init_sqlite_store();
+  }
+});
+
+// src/scheduler/store/json-migrator.ts
+import fs3 from "fs/promises";
+import path4 from "path";
+async function migrateJsonToBackend(jsonPath, backend) {
+  const resolvedPath = path4.resolve(process.cwd(), jsonPath);
+  let content;
+  try {
+    content = await fs3.readFile(resolvedPath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return 0;
+    }
+    throw err;
+  }
+  let data;
+  try {
+    data = JSON.parse(content);
+  } catch {
+    logger.warn(`[JsonMigrator] Failed to parse ${jsonPath}, skipping migration`);
+    return 0;
+  }
+  const schedules = data.schedules;
+  if (!Array.isArray(schedules) || schedules.length === 0) {
+    logger.debug("[JsonMigrator] No schedules to migrate");
+    await renameToMigrated(resolvedPath);
+    return 0;
+  }
+  let migrated = 0;
+  for (const schedule of schedules) {
+    if (!schedule.id) {
+      logger.warn("[JsonMigrator] Skipping schedule without ID");
+      continue;
+    }
+    const existing = await backend.get(schedule.id);
+    if (existing) {
+      logger.debug(`[JsonMigrator] Schedule ${schedule.id} already exists, skipping`);
+      continue;
+    }
+    try {
+      await backend.importSchedule(schedule);
+      migrated++;
+    } catch (err) {
+      logger.warn(
+        `[JsonMigrator] Failed to migrate schedule ${schedule.id}: ${err instanceof Error ? err.message : err}`
+      );
+    }
+  }
+  await renameToMigrated(resolvedPath);
+  logger.info(`[JsonMigrator] Migrated ${migrated}/${schedules.length} schedules from ${jsonPath}`);
+  return migrated;
+}
+async function renameToMigrated(resolvedPath) {
+  const migratedPath = `${resolvedPath}.migrated`;
+  try {
+    await fs3.rename(resolvedPath, migratedPath);
+    logger.info(`[JsonMigrator] Backed up ${resolvedPath} \u2192 ${migratedPath}`);
+  } catch (err) {
+    logger.warn(
+      `[JsonMigrator] Failed to rename ${resolvedPath}: ${err instanceof Error ? err.message : err}`
+    );
+  }
+}
+var init_json_migrator = __esm({
+  "src/scheduler/store/json-migrator.ts"() {
+    "use strict";
+    init_logger();
+  }
+});
+
+// src/scheduler/schedule-store.ts
 var ScheduleStore;
 var init_schedule_store = __esm({
   "src/scheduler/schedule-store.ts"() {
     "use strict";
     init_logger();
+    init_store();
+    init_json_migrator();
     ScheduleStore = class _ScheduleStore {
       static instance;
-      schedules = /* @__PURE__ */ new Map();
-      filePath;
-      autoSave;
-      saveDebounceMs;
+      backend = null;
       initialized = false;
-      saveTimeout = null;
       limits;
-      // Concurrency protection
-      saveLock = Promise.resolve();
-      pendingSave = false;
-      dirtyCount = 0;
-      // Track unsaved changes
-      constructor(config, limits) {
-        this.filePath = config?.path || ".visor/schedules.json";
-        this.autoSave = config?.autoSave !== false;
-        this.saveDebounceMs = config?.saveDebounceMs ?? 1e3;
+      config;
+      externalBackend = null;
+      constructor(config, limits, backend) {
+        this.config = config || {};
         this.limits = {
           maxPerUser: limits?.maxPerUser ?? 25,
           maxRecurringPerUser: limits?.maxRecurringPerUser ?? 10,
           maxGlobal: limits?.maxGlobal ?? 1e3
         };
+        if (backend) {
+          this.externalBackend = backend;
+        }
       }
       /**
        * Get singleton instance
@@ -3107,277 +3639,108 @@ var init_schedule_store = __esm({
       /**
        * Create a new isolated instance (for testing)
        */
-      static createIsolated(config, limits) {
-        return new _ScheduleStore(config, limits);
+      static createIsolated(config, limits, backend) {
+        return new _ScheduleStore(config, limits, backend);
       }
       /**
        * Reset singleton instance (for testing)
        */
       static resetInstance() {
         if (_ScheduleStore.instance) {
-          _ScheduleStore.instance.schedules.clear();
-          if (_ScheduleStore.instance.saveTimeout) {
-            clearTimeout(_ScheduleStore.instance.saveTimeout);
+          if (_ScheduleStore.instance.backend) {
+            _ScheduleStore.instance.backend.shutdown().catch(() => {
+            });
           }
         }
         _ScheduleStore.instance = void 0;
       }
       /**
-       * Initialize the store - load from file if it exists
+       * Initialize the store - creates backend and runs migrations
        */
       async initialize() {
         if (this.initialized) {
           return;
         }
-        try {
-          const resolvedPath = path3.resolve(process.cwd(), this.filePath);
-          const content = await fs2.readFile(resolvedPath, "utf-8");
-          const data = JSON.parse(content);
-          const scheduleList = data.schedules || [];
-          if (Array.isArray(scheduleList)) {
-            for (const schedule of scheduleList) {
-              this.schedules.set(schedule.id, schedule);
-            }
-            logger.info(
-              `[ScheduleStore] Loaded ${this.schedules.size} schedules from ${this.filePath}`
-            );
-          }
-        } catch (error) {
-          if (error.code !== "ENOENT") {
-            logger.warn(
-              `[ScheduleStore] Failed to load schedules: ${error instanceof Error ? error.message : "Unknown error"}`
-            );
-          } else {
-            logger.debug(`[ScheduleStore] No existing schedules file at ${this.filePath}`);
-          }
+        if (this.externalBackend) {
+          this.backend = this.externalBackend;
+        } else {
+          this.backend = await createStoreBackend(this.config.storage, this.config.ha);
         }
-        this.initialized = true;
-      }
-      /**
-       * Save schedules to file with atomic write and concurrency protection
-       */
-      async save() {
-        const previousLock = this.saveLock;
-        let releaseLock;
-        this.saveLock = new Promise((resolve5) => {
-          releaseLock = resolve5;
-        });
+        await this.backend.initialize();
+        const jsonPath = this.config.path || ".visor/schedules.json";
         try {
-          await previousLock;
-          const resolvedPath = path3.resolve(process.cwd(), this.filePath);
-          const dir = path3.dirname(resolvedPath);
-          await fs2.mkdir(dir, { recursive: true });
-          const savedDirtyCount = this.dirtyCount;
-          const data = {
-            version: "2.0",
-            // New version for schedule format
-            savedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            schedules: Array.from(this.schedules.values())
-          };
-          const tempPath = `${resolvedPath}.tmp.${Date.now()}`;
-          await fs2.writeFile(tempPath, JSON.stringify(data, null, 2), "utf-8");
-          await fs2.rename(tempPath, resolvedPath);
-          this.dirtyCount = Math.max(0, this.dirtyCount - savedDirtyCount);
-          this.pendingSave = false;
-          logger.debug(`[ScheduleStore] Saved ${this.schedules.size} schedules to ${this.filePath}`);
-        } finally {
-          releaseLock();
-        }
-      }
-      /**
-       * Schedule a debounced save operation with dirty tracking
-       */
-      scheduleSave() {
-        if (!this.autoSave) return;
-        this.dirtyCount++;
-        this.pendingSave = true;
-        if (this.saveTimeout) {
-          clearTimeout(this.saveTimeout);
-        }
-        this.saveTimeout = setTimeout(() => {
-          this.save().catch((error) => {
-            logger.error(
-              `[ScheduleStore] Auto-save failed: ${error instanceof Error ? error.message : "Unknown error"}`
-            );
-          });
-        }, this.saveDebounceMs);
-      }
-      /**
-       * Immediately save if there are pending changes (for critical operations)
-       */
-      async saveImmediate() {
-        if (!this.autoSave) return;
-        if (this.saveTimeout) {
-          clearTimeout(this.saveTimeout);
-          this.saveTimeout = null;
+          await migrateJsonToBackend(jsonPath, this.backend);
+        } catch (err) {
+          logger.warn(
+            `[ScheduleStore] JSON migration failed (non-fatal): ${err instanceof Error ? err.message : err}`
+          );
         }
-        await this.save();
+        this.initialized = true;
       }
       /**
-       * Create a new schedule (saves immediately to prevent data loss)
+       * Create a new schedule (async, persists immediately)
        */
       async createAsync(schedule) {
-        this.validateLimits(schedule.creatorId, schedule.isRecurring);
-        const newSchedule = {
-          ...schedule,
-          id: uuidv4(),
-          createdAt: Date.now(),
-          runCount: 0,
-          failureCount: 0,
-          status: "active"
-        };
-        this.schedules.set(newSchedule.id, newSchedule);
-        await this.saveImmediate();
-        logger.info(
-          `[ScheduleStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}: workflow="${newSchedule.workflow}"`
-        );
-        return newSchedule;
-      }
-      /**
-       * Create a new schedule (synchronous, uses debounced save)
-       * @deprecated Use createAsync for reliable persistence
-       */
-      create(schedule) {
-        this.validateLimits(schedule.creatorId, schedule.isRecurring);
-        const newSchedule = {
-          ...schedule,
-          id: uuidv4(),
-          createdAt: Date.now(),
-          runCount: 0,
-          failureCount: 0,
-          status: "active"
-        };
-        this.schedules.set(newSchedule.id, newSchedule);
-        this.scheduleSave();
-        logger.info(
-          `[ScheduleStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}: workflow="${newSchedule.workflow}"`
-        );
-        return newSchedule;
-      }
-      /**
-       * Validate schedule limits before creation
-       */
-      validateLimits(creatorId, isRecurring) {
-        if (this.limits.maxGlobal && this.schedules.size >= this.limits.maxGlobal) {
-          throw new Error(`Global schedule limit reached (${this.limits.maxGlobal})`);
-        }
-        const userSchedules = this.getByCreator(creatorId);
-        if (this.limits.maxPerUser && userSchedules.length >= this.limits.maxPerUser) {
-          throw new Error(
-            `You have reached the maximum number of schedules (${this.limits.maxPerUser})`
-          );
-        }
-        if (isRecurring && this.limits.maxRecurringPerUser) {
-          const recurringCount = userSchedules.filter((s) => s.isRecurring).length;
-          if (recurringCount >= this.limits.maxRecurringPerUser) {
-            throw new Error(
-              `You have reached the maximum number of recurring schedules (${this.limits.maxRecurringPerUser})`
-            );
-          }
-        }
+        const backend = this.getBackend();
+        await backend.validateLimits(schedule.creatorId, schedule.isRecurring, this.limits);
+        return backend.create(schedule);
       }
       /**
        * Get a schedule by ID
        */
-      get(id) {
-        return this.schedules.get(id);
+      async getAsync(id) {
+        return this.getBackend().get(id);
       }
       /**
        * Update a schedule
        */
-      update(id, patch) {
-        const schedule = this.schedules.get(id);
-        if (!schedule) {
-          return void 0;
-        }
-        const updated = { ...schedule, ...patch, id: schedule.id };
-        this.schedules.set(id, updated);
-        this.scheduleSave();
-        return updated;
+      async updateAsync(id, patch) {
+        return this.getBackend().update(id, patch);
       }
       /**
-       * Delete a schedule (saves immediately to prevent data loss)
+       * Delete a schedule
        */
       async deleteAsync(id) {
-        const deleted = this.schedules.delete(id);
-        if (deleted) {
-          await this.saveImmediate();
-          logger.info(`[ScheduleStore] Deleted schedule ${id}`);
-        }
-        return deleted;
-      }
-      /**
-       * Delete a schedule (synchronous, uses debounced save)
-       * @deprecated Use deleteAsync for reliable persistence
-       */
-      delete(id) {
-        const deleted = this.schedules.delete(id);
-        if (deleted) {
-          this.scheduleSave();
-          logger.info(`[ScheduleStore] Deleted schedule ${id}`);
-        }
-        return deleted;
+        return this.getBackend().delete(id);
       }
       /**
        * Get all schedules for a specific creator
        */
-      getByCreator(creatorId) {
-        return Array.from(this.schedules.values()).filter((s) => s.creatorId === creatorId);
+      async getByCreatorAsync(creatorId) {
+        return this.getBackend().getByCreator(creatorId);
       }
       /**
        * Get all active schedules
        */
-      getActiveSchedules() {
-        return Array.from(this.schedules.values()).filter((s) => s.status === "active");
+      async getActiveSchedulesAsync() {
+        return this.getBackend().getActiveSchedules();
       }
       /**
        * Get all schedules due for execution
        * @param now Current timestamp in milliseconds
        */
-      getDueSchedules(now = Date.now()) {
-        return this.getActiveSchedules().filter((s) => {
-          if (!s.isRecurring && s.runAt) {
-            return s.runAt <= now;
-          }
-          if (s.isRecurring && s.nextRunAt) {
-            return s.nextRunAt <= now;
-          }
-          return false;
-        });
+      async getDueSchedulesAsync(now = Date.now()) {
+        return this.getBackend().getDueSchedules(now);
       }
       /**
        * Find schedules by workflow name
        */
-      findByWorkflow(creatorId, workflowName) {
-        const lowerWorkflow = workflowName.toLowerCase();
-        return this.getByCreator(creatorId).filter(
-          (s) => s.status === "active" && s.workflow?.toLowerCase().includes(lowerWorkflow)
-        );
+      async findByWorkflowAsync(creatorId, workflowName) {
+        return this.getBackend().findByWorkflow(creatorId, workflowName);
       }
       /**
        * Get schedule count statistics
        */
-      getStats() {
-        const all = Array.from(this.schedules.values());
-        return {
-          total: all.length,
-          active: all.filter((s) => s.status === "active").length,
-          paused: all.filter((s) => s.status === "paused").length,
-          completed: all.filter((s) => s.status === "completed").length,
-          failed: all.filter((s) => s.status === "failed").length,
-          recurring: all.filter((s) => s.isRecurring).length,
-          oneTime: all.filter((s) => !s.isRecurring).length
-        };
+      async getStatsAsync() {
+        return this.getBackend().getStats();
       }
       /**
        * Force immediate save (useful for shutdown)
        */
       async flush() {
-        if (this.saveTimeout) {
-          clearTimeout(this.saveTimeout);
-          this.saveTimeout = null;
+        if (this.backend) {
+          await this.backend.flush();
         }
-        await this.save();
       }
       /**
        * Check if initialized
@@ -3389,13 +3752,32 @@ var init_schedule_store = __esm({
        * Check if there are unsaved changes
        */
       hasPendingChanges() {
-        return this.pendingSave || this.dirtyCount > 0;
+        return false;
       }
       /**
-       * Get all schedules (for iteration)
+       * Get all schedules
        */
-      getAll() {
-        return Array.from(this.schedules.values());
+      async getAllAsync() {
+        return this.getBackend().getAll();
+      }
+      /**
+       * Get the underlying backend (for HA lock operations)
+       */
+      getBackend() {
+        if (!this.backend) {
+          throw new Error("[ScheduleStore] Not initialized. Call initialize() first.");
+        }
+        return this.backend;
+      }
+      /**
+       * Shut down the backend cleanly
+       */
+      async shutdown() {
+        if (this.backend) {
+          await this.backend.shutdown();
+          this.backend = null;
+        }
+        this.initialized = false;
       }
     };
   }
@@ -3745,7 +4127,7 @@ async function handleCreate(args, context2, store) {
     } else if (runAtTimestamp) {
       nextRunAt = runAtTimestamp;
     }
-    const schedule = store.create({
+    const schedule = await store.createAsync({
       creatorId: context2.userId,
       creatorContext: context2.contextType,
       creatorName: context2.userName,
@@ -3780,7 +4162,8 @@ async function handleCreate(args, context2, store) {
   }
 }
 async function handleList(context2, store) {
-  const schedules = store.getByCreator(context2.userId).filter((s) => s.status !== "completed");
+  const allUserSchedules = await store.getByCreatorAsync(context2.userId);
+  const schedules = allUserSchedules.filter((s) => s.status !== "completed");
   let filteredSchedules = schedules;
   if (context2.allowedScheduleType) {
     filteredSchedules = schedules.filter((s) => {
@@ -3809,7 +4192,7 @@ async function handleList(context2, store) {
 async function handleCancel(args, context2, store) {
   let schedule;
   if (args.schedule_id) {
-    const userSchedules = store.getByCreator(context2.userId);
+    const userSchedules = await store.getByCreatorAsync(context2.userId);
     schedule = userSchedules.find((s) => s.id === args.schedule_id);
     if (!schedule) {
       schedule = userSchedules.find((s) => s.id.startsWith(args.schedule_id));
@@ -3832,7 +4215,7 @@ async function handleCancel(args, context2, store) {
       error: "You can only cancel your own schedules."
     };
   }
-  store.delete(schedule.id);
+  await store.deleteAsync(schedule.id);
   logger.info(`[ScheduleTool] Cancelled schedule ${schedule.id} for user ${context2.userId}`);
   return {
     success: true,
@@ -3849,7 +4232,7 @@ async function handlePauseResume(args, context2, store, newStatus) {
       error: "Please specify which schedule to pause/resume."
     };
   }
-  const userSchedules = store.getByCreator(context2.userId);
+  const userSchedules = await store.getByCreatorAsync(context2.userId);
   let schedule = userSchedules.find((s) => s.id === args.schedule_id);
   if (!schedule) {
     schedule = userSchedules.find((s) => s.id.startsWith(args.schedule_id));
@@ -3871,7 +4254,7 @@ async function handlePauseResume(args, context2, store, newStatus) {
       error: "You can only modify your own schedules."
     };
   }
-  const updated = store.update(schedule.id, { status: newStatus });
+  const updated = await store.updateAsync(schedule.id, { status: newStatus });
   const action = newStatus === "paused" ? "paused" : "resumed";
   logger.info(`[ScheduleTool] ${action} schedule ${schedule.id} for user ${context2.userId}`);
   return {
@@ -4583,6 +4966,18 @@ async function handleWavePlanning(context2, state, transition) {
         }
       } catch {
       }
+      try {
+        const args = request.args;
+        if (args && Object.keys(args).length > 0) {
+          if (!state.pendingRunArgs) state.pendingRunArgs = /* @__PURE__ */ new Map();
+          const existingArgs = state.pendingRunArgs.get(target) || {};
+          state.pendingRunArgs.set(target, { ...existingArgs, ...args });
+          if (context2.debug) {
+            logger.info(`[WavePlanning] Storing args for ${target}: ${JSON.stringify(args)}`);
+          }
+        }
+      } catch {
+      }
       if (gotoEvent) {
         eventOverrides.set(target, gotoEvent);
       }
@@ -4894,8 +5289,8 @@ var init_wave_planning = __esm({
 });
 
 // src/utils/mermaid-telemetry.ts
-import * as fs3 from "fs";
-import * as path4 from "path";
+import * as fs4 from "fs";
+import * as path5 from "path";
 function emitMermaidFromMarkdown(checkName, markdown, origin) {
   if (!markdown || typeof markdown !== "string") return 0;
   let m;
@@ -4908,16 +5303,16 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
         addEvent("diagram.block", { check: checkName, origin, code });
         addDiagramBlock(origin);
         if (process.env.VISOR_TRACE_REPORT === "true") {
-          const outDir = process.env.VISOR_TRACE_DIR || path4.join(process.cwd(), "output", "traces");
+          const outDir = process.env.VISOR_TRACE_DIR || path5.join(process.cwd(), "output", "traces");
           try {
-            if (!fs3.existsSync(outDir)) fs3.mkdirSync(outDir, { recursive: true });
+            if (!fs4.existsSync(outDir)) fs4.mkdirSync(outDir, { recursive: true });
             const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-            const jsonPath = path4.join(outDir, `${ts}.trace.json`);
-            const htmlPath = path4.join(outDir, `${ts}.report.html`);
+            const jsonPath = path5.join(outDir, `${ts}.trace.json`);
+            const htmlPath = path5.join(outDir, `${ts}.report.html`);
             let data = { spans: [] };
-            if (fs3.existsSync(jsonPath)) {
+            if (fs4.existsSync(jsonPath)) {
               try {
-                data = JSON.parse(fs3.readFileSync(jsonPath, "utf8"));
+                data = JSON.parse(fs4.readFileSync(jsonPath, "utf8"));
               } catch {
                 data = { spans: [] };
               }
@@ -4925,9 +5320,9 @@ function emitMermaidFromMarkdown(checkName, markdown, origin) {
             data.spans.push({
               events: [{ name: "diagram.block", attrs: { check: checkName, origin, code } }]
             });
-            fs3.writeFileSync(jsonPath, JSON.stringify(data, null, 2), "utf8");
-            if (!fs3.existsSync(htmlPath)) {
-              fs3.writeFileSync(
+            fs4.writeFileSync(jsonPath, JSON.stringify(data, null, 2), "utf8");
+            if (!fs4.existsSync(htmlPath)) {
+              fs4.writeFileSync(
                 htmlPath,
                 '<!doctype html><html><head><meta charset="utf-8"/><title>Visor Trace Report</title></head><body><h2>Visor Trace Report</h2></body></html>',
                 "utf8"
@@ -5377,6 +5772,42 @@ var init_sandbox_routing = __esm({
   }
 });
 
+// src/state-machine/dispatch/policy-gate.ts
+async function applyPolicyGate(checkId, checkConfig, policyEngine) {
+  let decision;
+  try {
+    decision = await policyEngine.evaluateCheckExecution(checkId, checkConfig);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logger.warn(`[PolicyEngine] Evaluation failed for check '${checkId}': ${msg}`);
+    decision = { allowed: false, reason: "policy evaluation error" };
+  }
+  const auditReason = decision.reason || "policy violation";
+  if (decision.warn) {
+    logger.warn(`[PolicyEngine] Audit: check '${checkId}' would be denied: ${auditReason}`);
+  }
+  if (!decision.allowed) {
+    logger.info(`\u26D4 Skipped (policy: ${decision.reason || "denied"})`);
+    return {
+      skip: true,
+      reason: decision.reason || "policy denied",
+      warn: !!decision.warn,
+      auditReason: decision.warn ? auditReason : void 0
+    };
+  }
+  return {
+    skip: false,
+    warn: !!decision.warn,
+    auditReason: decision.warn ? auditReason : void 0
+  };
+}
+var init_policy_gate = __esm({
+  "src/state-machine/dispatch/policy-gate.ts"() {
+    "use strict";
+    init_logger();
+  }
+});
+
 // src/state-machine/dispatch/history-snapshot.ts
 var history_snapshot_exports = {};
 __export(history_snapshot_exports, {
@@ -5547,9 +5978,9 @@ var init_dependency_gating = __esm({
 // src/state-machine/dispatch/template-renderer.ts
 async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
   try {
-    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-5IZLTFSZ.mjs");
-    const fs10 = await import("fs/promises");
-    const path12 = await import("path");
+    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-E4EUOCES.mjs");
+    const fs11 = await import("fs/promises");
+    const path14 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
     let templateContent;
@@ -5557,24 +5988,24 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
       templateContent = String(checkConfig.template.content);
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
-      const resolved = path12.resolve(process.cwd(), file);
-      templateContent = await fs10.readFile(resolved, "utf-8");
+      const resolved = path14.resolve(process.cwd(), file);
+      templateContent = await fs11.readFile(resolved, "utf-8");
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
         const candidatePaths = [
-          path12.join(__dirname, "output", sanitized, "template.liquid"),
+          path14.join(__dirname, "output", sanitized, "template.liquid"),
           // bundled: dist/output/
-          path12.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
+          path14.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
           // source: output/
-          path12.join(process.cwd(), "output", sanitized, "template.liquid"),
+          path14.join(process.cwd(), "output", sanitized, "template.liquid"),
           // fallback: cwd/output/
-          path12.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
+          path14.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
           // fallback: cwd/dist/output/
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs10.readFile(p, "utf-8");
+            templateContent = await fs11.readFile(p, "utf-8");
             if (templateContent) break;
           } catch {
           }
@@ -6612,6 +7043,48 @@ async function executeSingleCheck(checkId, context2, state, emitEvent, transitio
       return emptyResult;
     }
   }
+  if (context2.policyEngine && checkConfig) {
+    const gate = await applyPolicyGate(checkId, checkConfig, context2.policyEngine);
+    if (gate.skip) {
+      const emptyResult = { issues: [] };
+      try {
+        Object.defineProperty(emptyResult, "__skipped", {
+          value: "policy_denied",
+          enumerable: false
+        });
+      } catch {
+      }
+      state.completedChecks.add(checkId);
+      const stats = {
+        checkName: checkId,
+        totalRuns: 0,
+        successfulRuns: 0,
+        failedRuns: 0,
+        skippedRuns: 0,
+        skipped: true,
+        skipReason: "policy_denied",
+        skipCondition: gate.reason || "policy denied",
+        totalDuration: 0,
+        issuesFound: 0,
+        issuesBySeverity: { critical: 0, error: 0, warning: 0, info: 0 }
+      };
+      state.stats.set(checkId, stats);
+      logger.info(`[LevelDispatch] Recorded skip stats for ${checkId}: skipReason=policy_denied`);
+      try {
+        context2.journal.commitEntry({
+          sessionId: context2.sessionId,
+          checkId,
+          result: emptyResult,
+          event: context2.event || "manual",
+          scope: []
+        });
+      } catch (error) {
+        logger.warn(`[LevelDispatch] Failed to commit policy-skipped result to journal: ${error}`);
+      }
+      emitEvent({ type: "CheckCompleted", checkId, scope: [], result: emptyResult });
+      return emptyResult;
+    }
+  }
   const dependencies = checkConfig?.depends_on || [];
   const depList = Array.isArray(dependencies) ? dependencies : [dependencies];
   const failedChecks = state.failedChecks;
@@ -7126,11 +7599,39 @@ var init_execution_invoker = __esm({
     init_sandbox();
     init_workflow_inputs();
     init_sandbox_routing();
+    init_policy_gate();
     MAX_ON_INIT_ITEMS = 50;
   }
 });
 
 // src/state-machine/states/level-dispatch.ts
+async function renderTemplateArgs(args, dependencyResults, context2) {
+  if (!args || Object.keys(args).length === 0) {
+    return args;
+  }
+  const liquid = createExtendedLiquid();
+  const renderedArgs = {};
+  const templateContext = {
+    outputs: dependencyResults,
+    output: dependencyResults,
+    // Alias for convenience
+    env: process.env,
+    inputs: context2.executionContext?.workflowInputs || {}
+  };
+  for (const [key, value] of Object.entries(args)) {
+    if (typeof value === "string" && value.includes("{{")) {
+      try {
+        renderedArgs[key] = await liquid.parseAndRender(value, templateContext);
+      } catch (error) {
+        logger.warn(`[LevelDispatch] Failed to render template for arg ${key}: ${error}`);
+        renderedArgs[key] = value;
+      }
+    } else {
+      renderedArgs[key] = value;
+    }
+  }
+  return renderedArgs;
+}
 function mapCheckNameToFocus2(checkName) {
   const focusMap = {
     security: "security",
@@ -7422,6 +7923,7 @@ async function executeCheckGroup(checks, context2, state, maxParallelism, emitEv
         }
         try {
           state.pendingRunScopes?.delete(checkId);
+          state.pendingRunArgs?.delete(checkId);
         } catch {
         }
       } else {
@@ -7649,6 +8151,15 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
         }
       } catch {
       }
+      try {
+        if (!providerConfig.eventContext?.conversation && context2.executionContext?.conversation) {
+          providerConfig.eventContext = {
+            ...providerConfig.eventContext,
+            conversation: context2.executionContext.conversation
+          };
+        }
+      } catch {
+      }
       const dependencyResults = buildDependencyResultsWithScope2(
         checkId,
         checkConfig,
@@ -7717,11 +8228,20 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
         files: [],
         commits: []
       };
+      const rawPendingArgs = state.pendingRunArgs?.get(checkId);
+      const depResultsObj = {};
+      for (const [k, v] of dependencyResults.entries()) {
+        const summary = v;
+        depResultsObj[k] = summary.output !== void 0 ? summary.output : summary;
+      }
+      const renderedArgs = rawPendingArgs ? await renderTemplateArgs(rawPendingArgs, depResultsObj, context2) : void 0;
       const executionContext = {
         ...context2.executionContext,
         _engineMode: context2.mode,
         _parentContext: context2,
-        _parentState: state
+        _parentState: state,
+        // Inject args from on_success.run with directives (merged with existing args)
+        args: renderedArgs ? { ...context2.executionContext?.args || {}, ...renderedArgs } : context2.executionContext?.args
       };
       {
         const assumeExpr = checkConfig?.assume;
@@ -7730,10 +8250,12 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
           try {
             const evaluator = new FailureConditionEvaluator();
             const exprs = Array.isArray(assumeExpr) ? assumeExpr : [assumeExpr];
+            const conversation = context2.executionContext?.conversation || providerConfig?.eventContext?.conversation;
             for (const ex of exprs) {
               const res = await evaluator.evaluateIfCondition(checkId, ex, {
                 event: context2.event || "manual",
-                previousResults: dependencyResults
+                previousResults: dependencyResults,
+                conversation
               });
               if (!res) {
                 ok = false;
@@ -7830,7 +8352,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
         let schemaObj = (typeof checkConfig.schema === "object" ? checkConfig.schema : void 0) || checkConfig.output_schema;
         if (!schemaObj && typeof checkConfig.schema === "string") {
           try {
-            const { loadRendererSchema } = await import("./renderer-schema-CMXOLNIG.mjs");
+            const { loadRendererSchema } = await import("./renderer-schema-HXEW6BRJ.mjs");
             schemaObj = await loadRendererSchema(checkConfig.schema);
           } catch {
           }
@@ -8168,7 +8690,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
           }
         }
         try {
-          const { evaluateTransitions } = await import("./routing-S3Y7T2X3.mjs");
+          const { evaluateTransitions } = await import("./routing-OZQWAGAI.mjs");
           const transTarget = await evaluateTransitions(
             onFinish.transitions,
             forEachParent,
@@ -8228,7 +8750,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
             `[LevelDispatch] Error evaluating on_finish transitions for ${forEachParent}: ${e instanceof Error ? e.message : String(e)}`
           );
         }
-        const { evaluateGoto: evaluateGoto2 } = await import("./routing-S3Y7T2X3.mjs");
+        const { evaluateGoto: evaluateGoto2 } = await import("./routing-OZQWAGAI.mjs");
         if (context2.debug) {
           logger.info(
             `[LevelDispatch] Evaluating on_finish.goto_js for forEach parent: ${forEachParent}`
@@ -8395,6 +8917,59 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
       return emptyResult;
     }
   }
+  if (context2.policyEngine && checkConfig) {
+    const gate = await applyPolicyGate(checkId, checkConfig, context2.policyEngine);
+    if (gate.warn && gate.auditReason) {
+      if (state.stats.has(checkId)) {
+        const s = state.stats.get(checkId);
+        s.policyAuditWarning = gate.auditReason;
+      }
+    }
+    if (gate.skip) {
+      const emptyResult = { issues: [] };
+      try {
+        Object.defineProperty(emptyResult, "__skipped", {
+          value: "policy_denied",
+          enumerable: false
+        });
+      } catch {
+      }
+      state.completedChecks.add(checkId);
+      const stats = {
+        checkName: checkId,
+        totalRuns: 0,
+        successfulRuns: 0,
+        failedRuns: 0,
+        skippedRuns: 0,
+        skipped: true,
+        skipReason: "policy_denied",
+        skipCondition: gate.reason || "policy denied",
+        totalDuration: 0,
+        issuesFound: 0,
+        issuesBySeverity: { critical: 0, error: 0, warning: 0, info: 0 }
+      };
+      state.stats.set(checkId, stats);
+      logger.info(`[LevelDispatch] Recorded skip stats for ${checkId}: skipReason=policy_denied`);
+      try {
+        context2.journal.commitEntry({
+          sessionId: context2.sessionId,
+          checkId,
+          result: emptyResult,
+          event: context2.event || "manual",
+          scope: []
+        });
+      } catch (error) {
+        logger.warn(`[LevelDispatch] Failed to commit policy-denied result to journal: ${error}`);
+      }
+      emitEvent({
+        type: "CheckCompleted",
+        checkId,
+        scope: [],
+        result: emptyResult
+      });
+      return emptyResult;
+    }
+  }
   const dependencies = checkConfig?.depends_on || [];
   const depList = Array.isArray(dependencies) ? dependencies : [dependencies];
   const failedChecks = state.failedChecks;
@@ -8699,6 +9274,15 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
       }
     } catch {
     }
+    try {
+      if (!providerConfig.eventContext?.conversation && context2.executionContext?.conversation) {
+        providerConfig.eventContext = {
+          ...providerConfig.eventContext,
+          conversation: context2.executionContext.conversation
+        };
+      }
+    } catch {
+    }
     const dependencyResults = buildDependencyResults(checkId, checkConfig2, context2, state);
     const prInfo = context2.prInfo || {
       number: 1,
@@ -8709,13 +9293,22 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
       files: [],
       commits: []
     };
+    const rawPendingArgs = state.pendingRunArgs?.get(checkId);
+    const depResultsObj = {};
+    for (const [k, v] of dependencyResults.entries()) {
+      const summary = v;
+      depResultsObj[k] = summary.output !== void 0 ? summary.output : summary;
+    }
+    const renderedArgs = rawPendingArgs ? await renderTemplateArgs(rawPendingArgs, depResultsObj, context2) : void 0;
     const executionContext = {
       ...context2.executionContext,
       _engineMode: context2.mode,
       _parentContext: context2,
       _parentState: state,
       // Make checks metadata available to providers that want it
-      checksMeta
+      checksMeta,
+      // Inject args from on_success.run with directives (merged with existing args)
+      args: renderedArgs ? { ...context2.executionContext?.args || {}, ...renderedArgs } : context2.executionContext?.args
     };
     {
       const assumeExpr = checkConfig2?.assume;
@@ -8724,10 +9317,12 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
         try {
           const evaluator = new FailureConditionEvaluator();
           const exprs = Array.isArray(assumeExpr) ? assumeExpr : [assumeExpr];
+          const conversation = context2.executionContext?.conversation || providerConfig?.eventContext?.conversation;
           for (const ex of exprs) {
             const res = await evaluator.evaluateIfCondition(checkId, ex, {
               event: context2.event || "manual",
-              previousResults: dependencyResults
+              previousResults: dependencyResults,
+              conversation
             });
             if (!res) {
               ok = false;
@@ -8841,7 +9436,7 @@ async function executeSingleCheck2(checkId, context2, state, emitEvent, transiti
       let schemaObj = (typeof checkConfig2.schema === "object" ? checkConfig2.schema : void 0) || checkConfig2.output_schema;
       if (!schemaObj && typeof checkConfig2.schema === "string") {
         try {
-          const { loadRendererSchema } = await import("./renderer-schema-CMXOLNIG.mjs");
+          const { loadRendererSchema } = await import("./renderer-schema-HXEW6BRJ.mjs");
           schemaObj = await loadRendererSchema(checkConfig2.schema);
         } catch {
         }
@@ -9407,9 +10002,9 @@ function updateStats2(results, state, isForEachIteration = false) {
 }
 async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
   try {
-    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-5IZLTFSZ.mjs");
-    const fs10 = await import("fs/promises");
-    const path12 = await import("path");
+    const { createExtendedLiquid: createExtendedLiquid2 } = await import("./liquid-extensions-E4EUOCES.mjs");
+    const fs11 = await import("fs/promises");
+    const path14 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
     let templateContent;
@@ -9418,27 +10013,27 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
       logger.debug(`[LevelDispatch] Using inline template for ${checkId}`);
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
-      const resolved = path12.resolve(process.cwd(), file);
-      templateContent = await fs10.readFile(resolved, "utf-8");
+      const resolved = path14.resolve(process.cwd(), file);
+      templateContent = await fs11.readFile(resolved, "utf-8");
       logger.debug(`[LevelDispatch] Using template file for ${checkId}: ${resolved}`);
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
         const candidatePaths = [
-          path12.join(__dirname, "output", sanitized, "template.liquid"),
+          path14.join(__dirname, "output", sanitized, "template.liquid"),
           // bundled: dist/output/
-          path12.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
+          path14.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
           // source (from state-machine/states)
-          path12.join(__dirname, "..", "..", "..", "output", sanitized, "template.liquid"),
+          path14.join(__dirname, "..", "..", "..", "output", sanitized, "template.liquid"),
           // source (alternate)
-          path12.join(process.cwd(), "output", sanitized, "template.liquid"),
+          path14.join(process.cwd(), "output", sanitized, "template.liquid"),
           // fallback: cwd/output/
-          path12.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
+          path14.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
           // fallback: cwd/dist/output/
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs10.readFile(p, "utf-8");
+            templateContent = await fs11.readFile(p, "utf-8");
             if (templateContent) {
               logger.debug(`[LevelDispatch] Using schema template for ${checkId}: ${p}`);
               break;
@@ -9505,6 +10100,8 @@ var init_level_dispatch = __esm({
     init_failure_condition_evaluator();
     init_workflow_inputs();
     init_sandbox_routing();
+    init_policy_gate();
+    init_liquid_extensions();
   }
 });
 
@@ -10675,7 +11272,7 @@ var init_sandbox_manager = __esm({
 
 // src/utils/workspace-manager.ts
 import * as fsp from "fs/promises";
-import * as path5 from "path";
+import * as path6 from "path";
 function shellEscape(str) {
   return "'" + str.replace(/'/g, "'\\''") + "'";
 }
@@ -10719,7 +11316,7 @@ var init_workspace_manager = __esm({
         };
         this.basePath = this.config.basePath;
         const workspaceDirName = sanitizePathComponent(this.config.name || this.sessionId);
-        this.workspacePath = path5.join(this.basePath, workspaceDirName);
+        this.workspacePath = path6.join(this.basePath, workspaceDirName);
       }
       /**
        * Get or create a WorkspaceManager instance for a session
@@ -10766,8 +11363,8 @@ var init_workspace_manager = __esm({
         );
         if (this.cleanupRequested && this.activeOperations === 0) {
           logger.debug(`[Workspace] All references released, proceeding with deferred cleanup`);
-          for (const resolve5 of this.cleanupResolvers) {
-            resolve5();
+          for (const resolve6 of this.cleanupResolvers) {
+            resolve6();
           }
           this.cleanupResolvers = [];
         }
@@ -10814,7 +11411,7 @@ var init_workspace_manager = __esm({
           configuredMainProjectName || this.extractProjectName(this.originalPath)
         );
         this.usedNames.add(mainProjectName);
-        const mainProjectPath = path5.join(this.workspacePath, mainProjectName);
+        const mainProjectPath = path6.join(this.workspacePath, mainProjectName);
         const isGitRepo = await this.isGitRepository(this.originalPath);
         if (isGitRepo) {
           await this.createMainProjectWorktree(mainProjectPath);
@@ -10855,7 +11452,7 @@ var init_workspace_manager = __esm({
         let projectName = sanitizePathComponent(description || this.extractRepoName(repository));
         projectName = this.getUniqueName(projectName);
         this.usedNames.add(projectName);
-        const workspacePath = path5.join(this.workspacePath, projectName);
+        const workspacePath = path6.join(this.workspacePath, projectName);
         await fsp.rm(workspacePath, { recursive: true, force: true });
         try {
           await fsp.symlink(worktreePath, workspacePath);
@@ -10892,19 +11489,19 @@ var init_workspace_manager = __esm({
           );
           this.cleanupRequested = true;
           await Promise.race([
-            new Promise((resolve5) => {
+            new Promise((resolve6) => {
               if (this.activeOperations === 0) {
-                resolve5();
+                resolve6();
               } else {
-                this.cleanupResolvers.push(resolve5);
+                this.cleanupResolvers.push(resolve6);
               }
             }),
-            new Promise((resolve5) => {
+            new Promise((resolve6) => {
               setTimeout(() => {
                 logger.warn(
                   `[Workspace] Cleanup timeout after ${timeout}ms, proceeding anyway (${this.activeOperations} operations still active)`
                 );
-                resolve5();
+                resolve6();
               }, timeout);
             })
           ]);
@@ -10994,7 +11591,7 @@ var init_workspace_manager = __esm({
        * Extract project name from path
        */
       extractProjectName(dirPath) {
-        return path5.basename(dirPath);
+        return path6.basename(dirPath);
       }
       /**
        * Extract repository name from owner/repo format
@@ -11204,8 +11801,8 @@ var init_summary = __esm({
 });
 
 // src/state-machine-execution-engine.ts
-import * as path6 from "path";
-import * as fs4 from "fs";
+import * as path7 from "path";
+import * as fs5 from "fs";
 function serializeRunState(state) {
   return {
     ...state,
@@ -11253,9 +11850,14 @@ var init_state_machine_execution_engine = __esm({
       async executeChecks(options) {
         const startTime = Date.now();
         const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+        const optConversation = options?.conversation;
+        if (optConversation) {
+          const prev = this.executionContext || {};
+          this.executionContext = { ...prev, conversation: optConversation };
+        }
         try {
           if (options.config?.memory) {
-            const { MemoryStore: MemoryStore2 } = await import("./memory-store-3N4AZCYB.mjs");
+            const { MemoryStore: MemoryStore2 } = await import("./memory-store-AAPL2MTE.mjs");
             const memoryStore = MemoryStore2.getInstance(options.config.memory);
             await memoryStore.initialize();
             logger.debug("Memory store initialized");
@@ -11297,7 +11899,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const map = options?.webhookContext?.webhookData;
             if (map) {
-              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-VYHKFHK2.mjs");
+              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-M3Y6JMTW.mjs");
               const reg = CheckProviderRegistry2.getInstance();
               const p = reg.getProvider("http_input");
               if (p && typeof p.setWebhookContext === "function") p.setWebhookContext(map);
@@ -11410,7 +12012,7 @@ var init_state_machine_execution_engine = __esm({
           logger.info("[StateMachine] Using state machine engine");
         }
         if (!config) {
-          const { ConfigManager } = await import("./config-7VTT64SQ.mjs");
+          const { ConfigManager } = await import("./config-OGOS4ZU4.mjs");
           const configManager = new ConfigManager();
           config = await configManager.getDefaultConfig();
           logger.debug("[StateMachine] Using default configuration (no config provided)");
@@ -11447,13 +12049,64 @@ var init_state_machine_execution_engine = __esm({
         }
         const { initializeWorkspace: initializeWorkspace2 } = (init_build_engine_context(), __toCommonJS(build_engine_context_exports));
         await initializeWorkspace2(context2);
+        if (configWithTagFilter.policy?.engine && configWithTagFilter.policy.engine !== "disabled") {
+          try {
+            logger.debug(
+              `[PolicyEngine] Loading enterprise policy engine (engine=${configWithTagFilter.policy.engine})`
+            );
+            const { loadEnterprisePolicyEngine } = await import("./enterprise/loader");
+            context2.policyEngine = await loadEnterprisePolicyEngine(configWithTagFilter.policy);
+            logger.debug(
+              `[PolicyEngine] Initialized: ${context2.policyEngine?.constructor?.name || "unknown"}`
+            );
+          } catch (err) {
+            try {
+              logger.warn(
+                `[PolicyEngine] Enterprise policy engine init failed, using default: ${err instanceof Error ? err.message : err}`
+              );
+            } catch {
+            }
+          }
+        }
+        if (context2.policyEngine && "setActorContext" in context2.policyEngine) {
+          const actor = {
+            authorAssociation: prInfo?.authorAssociation || process.env.VISOR_AUTHOR_ASSOCIATION,
+            login: prInfo?.author || process.env.GITHUB_ACTOR,
+            isLocalMode: !process.env.GITHUB_ACTIONS
+          };
+          try {
+            const webhookData = this.executionContext?.webhookContext?.webhookData;
+            if (webhookData instanceof Map) {
+              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-IEB2VS7O.mjs");
+              const slackCtx = extractSlackContext2(webhookData);
+              if (slackCtx) {
+                const payload = Array.from(webhookData.values())[0];
+                const userInfo = payload?.slack_user_info;
+                actor.slack = {
+                  userId: slackCtx.userId,
+                  channelId: slackCtx.channel,
+                  channelType: slackCtx.channelType,
+                  email: userInfo?.email
+                };
+              }
+            }
+          } catch {
+          }
+          const pullRequest = prInfo ? {
+            number: prInfo.number,
+            labels: prInfo.labels,
+            draft: prInfo.draft,
+            changedFiles: prInfo.files?.length
+          } : void 0;
+          context2.policyEngine.setActorContext(actor, void 0, pullRequest);
+        }
         context2.executionContext = this.getExecutionContext();
         this._lastContext = context2;
         let frontendsHost;
         if (Array.isArray(configWithTagFilter.frontends) && configWithTagFilter.frontends.length > 0) {
           try {
             const { EventBus } = await import("./event-bus-5K3Y2FCS.mjs");
-            const { FrontendsHost } = await import("./host-ONVMEHAA.mjs");
+            const { FrontendsHost } = await import("./host-EE6EJ2FM.mjs");
             const bus = new EventBus();
             context2.eventBus = bus;
             frontendsHost = new FrontendsHost(bus, logger);
@@ -11503,6 +12156,13 @@ var init_state_machine_execution_engine = __esm({
               }
             } catch {
             }
+            let runTraceId;
+            try {
+              const { trace: lazyTrace, context: lazyCtx } = await import("./lazy-otel-5NH4ZJJM.mjs");
+              const activeSpan = lazyTrace.getSpan(lazyCtx.active());
+              runTraceId = activeSpan?.spanContext()?.traceId;
+            } catch {
+            }
             await frontendsHost.startAll(() => ({
               eventBus: bus,
               logger,
@@ -11513,6 +12173,7 @@ var init_state_machine_execution_engine = __esm({
                 repo: repoObj,
                 pr: prNum,
                 headSha,
+                traceId: runTraceId,
                 event: context2.event || prInfo?.eventType,
                 actor: prInfo?.eventContext?.sender?.login || (typeof process.env.GITHUB_ACTOR === "string" ? process.env.GITHUB_ACTOR : void 0)
               },
@@ -11546,9 +12207,9 @@ var init_state_machine_execution_engine = __esm({
                   }
                   const checkId = String(ev?.checkId || "unknown");
                   const threadKey = ev?.threadKey || (channel && threadTs ? `${channel}:${threadTs}` : "session");
-                  const baseDir = process.env.VISOR_SNAPSHOT_DIR || path6.resolve(process.cwd(), ".visor", "snapshots");
-                  fs4.mkdirSync(baseDir, { recursive: true });
-                  const filePath = path6.join(baseDir, `${threadKey}-${checkId}.json`);
+                  const baseDir = process.env.VISOR_SNAPSHOT_DIR || path7.resolve(process.cwd(), ".visor", "snapshots");
+                  fs5.mkdirSync(baseDir, { recursive: true });
+                  const filePath = path7.join(baseDir, `${threadKey}-${checkId}.json`);
                   await this.saveSnapshotToFile(filePath);
                   logger.info(`[Snapshot] Saved run snapshot: ${filePath}`);
                   try {
@@ -11596,6 +12257,13 @@ var init_state_machine_execution_engine = __esm({
           } catch (error) {
             logger.debug(`[StateMachine] Failed to cleanup sessions: ${error}`);
           }
+          if (context2.policyEngine) {
+            try {
+              await context2.policyEngine.shutdown();
+            } catch (error) {
+              logger.debug(`[StateMachine] Failed to cleanup policy engine: ${error}`);
+            }
+          }
           if (context2.workspace) {
             try {
               await context2.workspace.cleanup();
@@ -11682,7 +12350,7 @@ var init_state_machine_execution_engine = __esm({
        * Does not include secrets. Intended for debugging and future resume support.
        */
       async saveSnapshotToFile(filePath) {
-        const fs10 = await import("fs/promises");
+        const fs11 = await import("fs/promises");
         const ctx = this._lastContext;
         const runner = this._lastRunner;
         if (!ctx || !runner) {
@@ -11702,14 +12370,14 @@ var init_state_machine_execution_engine = __esm({
           journal: entries,
           requestedChecks: ctx.requestedChecks || []
         };
-        await fs10.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
+        await fs11.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
       }
       /**
        * Load a snapshot JSON from file and return it. Resume support can build on this.
        */
       async loadSnapshotFromFile(filePath) {
-        const fs10 = await import("fs/promises");
-        const raw = await fs10.readFile(filePath, "utf8");
+        const fs11 = await import("fs/promises");
+        const raw = await fs11.readFile(filePath, "utf8");
         return JSON.parse(raw);
       }
       /**
@@ -11788,10 +12456,10 @@ var init_state_machine_execution_engine = __esm({
        * @returns Array of failure condition evaluation results
        */
       async evaluateFailureConditions(checkName, reviewSummary, config, previousOutputs, authorAssociation) {
-        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-4WMDF4Q3.mjs");
+        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-HC3M5377.mjs");
         const evaluator = new FailureConditionEvaluator2();
-        const { addEvent: addEvent3 } = await import("./trace-helpers-YHNPC7MR.mjs");
-        const { addFailIfTriggered } = await import("./metrics-GXQ2EDXA.mjs");
+        const { addEvent: addEvent3 } = await import("./trace-helpers-PP3YHTAM.mjs");
+        const { addFailIfTriggered } = await import("./metrics-I6A7IHG4.mjs");
         const checkConfig = config.checks?.[checkName];
         if (!checkConfig) {
           return [];
@@ -12043,6 +12711,7 @@ var init_scheduler2 = __esm({
   "src/scheduler/index.ts"() {
     "use strict";
     init_schedule_store();
+    init_store();
     init_schedule_parser();
     init_scheduler();
     init_schedule_tool();
@@ -12088,11 +12757,99 @@ function extractSlackContext(webhookData) {
   }
   return null;
 }
+function createScheduleToolWithContext(slackContext, _slackClient) {
+  const baseDef = getScheduleToolDefinition();
+  return {
+    ...baseDef,
+    // Override the exec to handle the tool call with context
+    // This is a placeholder - the actual execution happens via executeScheduleTool
+    exec: JSON.stringify({
+      type: "schedule_tool",
+      context: slackContext
+    })
+  };
+}
+async function executeScheduleTool(args, slackContext, slackClient, availableWorkflows, permissions) {
+  let timezone = slackContext.timezone;
+  if (!timezone && slackClient && slackContext.userId) {
+    try {
+      const userInfo = await slackClient.getUserInfo(slackContext.userId);
+      if (userInfo.ok && userInfo.user?.tz) {
+        timezone = userInfo.user.tz;
+        slackContext.timezone = timezone;
+      }
+    } catch {
+    }
+  }
+  const toolContext = buildScheduleToolContext(
+    {
+      slackContext: {
+        userId: slackContext.userId,
+        userName: slackContext.userName,
+        timezone: timezone || "UTC",
+        channelType: slackContext.channelType
+      }
+    },
+    availableWorkflows,
+    permissions
+  );
+  const toolArgs = {
+    action: args.action,
+    // What to do
+    reminder_text: args.reminder_text,
+    workflow: args.workflow,
+    workflow_inputs: args.workflow_inputs,
+    // Where to send
+    target_type: args.target_type,
+    target_id: args.target_id,
+    thread_ts: args.thread_ts,
+    // When to run
+    is_recurring: args.is_recurring,
+    cron: args.cron,
+    run_at: args.run_at,
+    original_expression: args.original_expression,
+    // For cancel/pause/resume
+    schedule_id: args.schedule_id
+  };
+  if (!toolArgs.target_type && slackContext.channel) {
+    if (slackContext.threadTs) {
+      toolArgs.target_type = "thread";
+      toolArgs.target_id = slackContext.channel;
+      toolArgs.thread_ts = slackContext.threadTs;
+    } else {
+      toolArgs.target_type = slackContext.channelType === "channel" ? "channel" : "dm";
+      toolArgs.target_id = slackContext.channel;
+    }
+  }
+  try {
+    const result = await handleScheduleAction(toolArgs, toolContext);
+    if (result.success) {
+      return result.message;
+    } else {
+      return `Error: ${result.error || result.message}`;
+    }
+  } catch (error) {
+    const errorMsg = error instanceof Error ? error.message : "Unknown error";
+    logger.error(`[ScheduleToolHandler] Failed to execute schedule tool: ${errorMsg}`);
+    return `Error: ${errorMsg}`;
+  }
+}
+function isScheduleToolCall(toolName) {
+  return toolName === "schedule";
+}
+async function ensureScheduleStoreInitialized() {
+  const store = ScheduleStore.getInstance();
+  if (!store.isInitialized()) {
+    await store.initialize();
+  }
+  return store;
+}
+var ensureReminderStoreInitialized;
 var init_schedule_tool_handler = __esm({
   "src/slack/schedule-tool-handler.ts"() {
-    "use strict";
     init_scheduler2();
     init_logger();
+    ensureReminderStoreInitialized = ensureScheduleStoreInitialized;
   }
 });
 
@@ -12158,7 +12915,7 @@ var init_mcp_custom_sse_server = __esm({
        * Returns the actual bound port number
        */
       async start() {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           try {
             this.server = http.createServer((req, res) => {
               this.handleRequest(req, res).catch((error) => {
@@ -12192,7 +12949,7 @@ var init_mcp_custom_sse_server = __esm({
                 );
               }
               this.startKeepalive();
-              resolve5(this.port);
+              resolve6(this.port);
             });
           } catch (error) {
             reject(error);
@@ -12255,7 +13012,7 @@ var init_mcp_custom_sse_server = __esm({
             logger.debug(
               `[CustomToolsSSEServer:${this.sessionId}] Grace period before stop: ${waitMs}ms (activeToolCalls=${this.activeToolCalls})`
             );
-            await new Promise((resolve5) => setTimeout(resolve5, waitMs));
+            await new Promise((resolve6) => setTimeout(resolve6, waitMs));
           }
         }
         if (this.activeToolCalls > 0) {
@@ -12264,7 +13021,7 @@ var init_mcp_custom_sse_server = __esm({
             `[CustomToolsSSEServer:${this.sessionId}] Waiting for ${this.activeToolCalls} active tool call(s) before stop`
           );
           while (this.activeToolCalls > 0 && Date.now() - startedAt < effectiveDrainTimeoutMs) {
-            await new Promise((resolve5) => setTimeout(resolve5, 250));
+            await new Promise((resolve6) => setTimeout(resolve6, 250));
           }
           if (this.activeToolCalls > 0) {
             logger.warn(
@@ -12289,21 +13046,21 @@ var init_mcp_custom_sse_server = __esm({
         }
         this.connections.clear();
         if (this.server) {
-          await new Promise((resolve5, reject) => {
+          await new Promise((resolve6, reject) => {
             const timeout = setTimeout(() => {
               if (this.debug) {
                 logger.debug(
                   `[CustomToolsSSEServer:${this.sessionId}] Force closing server after timeout`
                 );
               }
-              this.server?.close(() => resolve5());
+              this.server?.close(() => resolve6());
             }, 5e3);
             this.server.close((error) => {
               clearTimeout(timeout);
               if (error) {
                 reject(error);
               } else {
-                resolve5();
+                resolve6();
               }
             });
           });
@@ -12477,10 +13234,10 @@ var init_mcp_custom_sse_server = __esm({
                 `[CustomToolsSSEServer:${this.sessionId}] Received message: ${JSON.stringify(message)}`
               );
             }
-            await this.handleMCPMessage(connection, message);
             this.handleCORS(res);
             res.writeHead(202, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ status: "accepted" }));
+            await this.handleMCPMessage(connection, message);
           } catch (error) {
             const errorMsg = error instanceof Error ? error.message : "Unknown error";
             if (this.debug) {
@@ -12489,8 +13246,10 @@ var init_mcp_custom_sse_server = __esm({
               );
             }
             this.sendErrorResponse(connection, null, -32700, "Parse error", { error: errorMsg });
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Parse error", details: errorMsg }));
+            if (!res.headersSent) {
+              res.writeHead(400, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ error: "Parse error", details: errorMsg }));
+            }
           }
         });
       }
@@ -12715,7 +13474,7 @@ var init_mcp_custom_sse_server = __esm({
               logger.warn(
                 `[CustomToolsSSEServer:${this.sessionId}] Tool ${toolName} failed (attempt ${attempt + 1}/${retryCount + 1}): ${errorMsg}. Retrying in ${delay}ms`
               );
-              await new Promise((resolve5) => setTimeout(resolve5, delay));
+              await new Promise((resolve6) => setTimeout(resolve6, delay));
               attempt++;
             }
           }
@@ -12794,8 +13553,8 @@ var init_mcp_custom_sse_server = __esm({
 });
 
 // src/providers/ai-check-provider.ts
-import fs5 from "fs/promises";
-import path7 from "path";
+import fs6 from "fs/promises";
+import path8 from "path";
 var AICheckProvider;
 var init_ai_check_provider = __esm({
   "src/providers/ai-check-provider.ts"() {
@@ -12968,7 +13727,7 @@ var init_ai_check_provider = __esm({
         const hasFileExtension = /\.[a-zA-Z0-9]{1,10}$/i.test(str);
         const hasPathSeparators = /[\/\\]/.test(str);
         const isRelativePath = /^\.{1,2}\//.test(str);
-        const isAbsolutePath = path7.isAbsolute(str);
+        const isAbsolutePath = path8.isAbsolute(str);
         const hasTypicalFileChars = /^[a-zA-Z0-9._\-\/\\:~]+$/.test(str);
         if (!(hasFileExtension || isRelativePath || isAbsolutePath || hasPathSeparators)) {
           return false;
@@ -12978,14 +13737,14 @@ var init_ai_check_provider = __esm({
         }
         try {
           let resolvedPath;
-          if (path7.isAbsolute(str)) {
-            resolvedPath = path7.normalize(str);
+          if (path8.isAbsolute(str)) {
+            resolvedPath = path8.normalize(str);
           } else {
-            resolvedPath = path7.resolve(process.cwd(), str);
+            resolvedPath = path8.resolve(process.cwd(), str);
           }
-          const fs10 = __require("fs").promises;
+          const fs11 = __require("fs").promises;
           try {
-            const stat = await fs10.stat(resolvedPath);
+            const stat = await fs11.stat(resolvedPath);
             return stat.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -13002,14 +13761,14 @@ var init_ai_check_provider = __esm({
           throw new Error("Prompt file must have .liquid extension");
         }
         let resolvedPath;
-        if (path7.isAbsolute(promptPath)) {
+        if (path8.isAbsolute(promptPath)) {
           resolvedPath = promptPath;
         } else {
-          resolvedPath = path7.resolve(process.cwd(), promptPath);
+          resolvedPath = path8.resolve(process.cwd(), promptPath);
         }
-        if (!path7.isAbsolute(promptPath)) {
-          const normalizedPath = path7.normalize(resolvedPath);
-          const currentDir = path7.resolve(process.cwd());
+        if (!path8.isAbsolute(promptPath)) {
+          const normalizedPath = path8.normalize(resolvedPath);
+          const currentDir = path8.resolve(process.cwd());
           if (!normalizedPath.startsWith(currentDir)) {
             throw new Error("Invalid prompt file path: path traversal detected");
           }
@@ -13018,7 +13777,7 @@ var init_ai_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await fs5.readFile(resolvedPath, "utf-8");
+          const promptContent = await fs6.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -13523,6 +14282,38 @@ ${preview}`);
         if (config.ai_max_iterations !== void 0 && aiConfig.maxIterations === void 0) {
           aiConfig.maxIterations = config.ai_max_iterations;
         }
+        const policyEngine = sessionInfo?._parentContext?.policyEngine;
+        if (policyEngine) {
+          try {
+            const checkName = config.checkName || "unknown";
+            const decision = await policyEngine.evaluateCapabilities(checkName, {
+              allowEdit: aiConfig.allowEdit,
+              allowBash: aiConfig.allowBash,
+              allowedTools: aiConfig.allowedTools
+            });
+            if (decision.capabilities) {
+              if (decision.capabilities.allowEdit === false) aiConfig.allowEdit = false;
+              if (decision.capabilities.allowBash === false) aiConfig.allowBash = false;
+              if (decision.capabilities.allowedTools) {
+                if (aiConfig.allowedTools) {
+                  aiConfig.allowedTools = aiConfig.allowedTools.filter(
+                    (t) => decision.capabilities.allowedTools.includes(t)
+                  );
+                } else {
+                  aiConfig.allowedTools = decision.capabilities.allowedTools;
+                }
+              }
+            }
+          } catch (err) {
+            try {
+              const { logger: logger2 } = (init_logger(), __toCommonJS(logger_exports));
+              logger2.warn(
+                `[PolicyEngine] Capability evaluation failed: ${err instanceof Error ? err.message : err}`
+              );
+            } catch {
+            }
+          }
+        }
         const customPrompt = config.prompt;
         if (!customPrompt) {
           throw new Error(
@@ -13541,6 +14332,9 @@ ${preview}`);
           Object.assign(mcpServers, config.ai.mcpServers);
         }
         const mcpServersJsExpr = config.ai_mcp_servers_js;
+        logger.info(
+          `[AICheckProvider] ai_mcp_servers_js check: hasExpr=${!!mcpServersJsExpr}, hasDeps=${!!_dependencyResults}, depsSize=${_dependencyResults?.size ?? 0}`
+        );
         if (mcpServersJsExpr && _dependencyResults) {
           try {
             const dynamicServers = this.evaluateMcpServersJs(
@@ -14119,6 +14913,10 @@ ${processedPrompt}` : processedPrompt;
           memory: config.__memoryAccessor || {}
         };
         try {
+          const buildConfigOutput = jsContext.outputs?.["build-config"];
+          logger.info(
+            `[AICheckProvider] ai_mcp_servers_js context: build-config output keys=${buildConfigOutput ? Object.keys(buildConfigOutput).join(",") : "N/A"}, mcp_servers keys=${buildConfigOutput?.mcp_servers ? Object.keys(buildConfigOutput.mcp_servers).join(",") : "N/A"}`
+          );
           const result = compileAndRun(this.sandbox, expression, jsContext, {
             injectLog: true,
             wrapFunction: true,
@@ -14749,8 +15547,8 @@ var init_template_context = __esm({
 });
 
 // src/providers/http-client-provider.ts
-import * as fs6 from "fs";
-import * as path8 from "path";
+import * as fs7 from "fs";
+import * as path9 from "path";
 var HttpClientProvider;
 var init_http_client_provider = __esm({
   "src/providers/http-client-provider.ts"() {
@@ -14855,14 +15653,14 @@ var init_http_client_provider = __esm({
             const parentContext = context2?._parentContext;
             const workingDirectory = parentContext?.workingDirectory;
             const workspaceEnabled = parentContext?.workspace?.isEnabled?.();
-            if (workspaceEnabled && workingDirectory && !path8.isAbsolute(resolvedOutputFile)) {
-              resolvedOutputFile = path8.join(workingDirectory, resolvedOutputFile);
+            if (workspaceEnabled && workingDirectory && !path9.isAbsolute(resolvedOutputFile)) {
+              resolvedOutputFile = path9.join(workingDirectory, resolvedOutputFile);
               logger.debug(
                 `[http_client] Resolved relative output_file to workspace: ${resolvedOutputFile}`
               );
             }
-            if (skipIfExists && fs6.existsSync(resolvedOutputFile)) {
-              const stats = fs6.statSync(resolvedOutputFile);
+            if (skipIfExists && fs7.existsSync(resolvedOutputFile)) {
+              const stats = fs7.statSync(resolvedOutputFile);
               logger.verbose(`[http_client] File cached: ${resolvedOutputFile} (${stats.size} bytes)`);
               return {
                 issues: [],
@@ -15073,13 +15871,13 @@ var init_http_client_provider = __esm({
               ]
             };
           }
-          const parentDir = path8.dirname(outputFile);
-          if (parentDir && !fs6.existsSync(parentDir)) {
-            fs6.mkdirSync(parentDir, { recursive: true });
+          const parentDir = path9.dirname(outputFile);
+          if (parentDir && !fs7.existsSync(parentDir)) {
+            fs7.mkdirSync(parentDir, { recursive: true });
           }
           const arrayBuffer = await response.arrayBuffer();
           const buffer = Buffer.from(arrayBuffer);
-          fs6.writeFileSync(outputFile, buffer);
+          fs7.writeFileSync(outputFile, buffer);
           const contentType = response.headers.get("content-type") || "application/octet-stream";
           logger.verbose(`[http_client] Downloaded: ${outputFile} (${buffer.length} bytes)`);
           return {
@@ -15835,8 +16633,8 @@ var init_claude_code_types = __esm({
 });
 
 // src/providers/claude-code-check-provider.ts
-import fs7 from "fs/promises";
-import path9 from "path";
+import fs8 from "fs/promises";
+import path10 from "path";
 function isClaudeCodeConstructor(value) {
   return typeof value === "function";
 }
@@ -15995,7 +16793,7 @@ var init_claude_code_check_provider = __esm({
         const hasFileExtension = /\.[a-zA-Z0-9]{1,10}$/i.test(str);
         const hasPathSeparators = /[\/\\]/.test(str);
         const isRelativePath = /^\.{1,2}\//.test(str);
-        const isAbsolutePath = path9.isAbsolute(str);
+        const isAbsolutePath = path10.isAbsolute(str);
         const hasTypicalFileChars = /^[a-zA-Z0-9._\-\/\\:~]+$/.test(str);
         if (!(hasFileExtension || isRelativePath || isAbsolutePath || hasPathSeparators)) {
           return false;
@@ -16005,13 +16803,13 @@ var init_claude_code_check_provider = __esm({
         }
         try {
           let resolvedPath;
-          if (path9.isAbsolute(str)) {
-            resolvedPath = path9.normalize(str);
+          if (path10.isAbsolute(str)) {
+            resolvedPath = path10.normalize(str);
           } else {
-            resolvedPath = path9.resolve(process.cwd(), str);
+            resolvedPath = path10.resolve(process.cwd(), str);
           }
           try {
-            const stat = await fs7.stat(resolvedPath);
+            const stat = await fs8.stat(resolvedPath);
             return stat.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -16028,14 +16826,14 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Prompt file must have .liquid extension");
         }
         let resolvedPath;
-        if (path9.isAbsolute(promptPath)) {
+        if (path10.isAbsolute(promptPath)) {
           resolvedPath = promptPath;
         } else {
-          resolvedPath = path9.resolve(process.cwd(), promptPath);
+          resolvedPath = path10.resolve(process.cwd(), promptPath);
         }
-        if (!path9.isAbsolute(promptPath)) {
-          const normalizedPath = path9.normalize(resolvedPath);
-          const currentDir = path9.resolve(process.cwd());
+        if (!path10.isAbsolute(promptPath)) {
+          const normalizedPath = path10.normalize(resolvedPath);
+          const currentDir = path10.resolve(process.cwd());
           if (!normalizedPath.startsWith(currentDir)) {
             throw new Error("Invalid prompt file path: path traversal detected");
           }
@@ -16044,7 +16842,7 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Invalid prompt file path: path traversal detected");
         }
         try {
-          const promptContent = await fs7.readFile(resolvedPath, "utf-8");
+          const promptContent = await fs8.readFile(resolvedPath, "utf-8");
           return promptContent;
         } catch (error) {
           throw new Error(
@@ -16198,7 +16996,36 @@ var init_claude_code_check_provider = __esm({
             query.tools = claudeCodeConfig.allowedTools.map((name) => ({ name }));
           }
           if (claudeCodeConfig.mcpServers && Object.keys(claudeCodeConfig.mcpServers).length > 0) {
-            query.mcpServers = claudeCodeConfig.mcpServers;
+            const policyEngine = sessionInfo?._parentContext?.policyEngine;
+            let filteredServers = claudeCodeConfig.mcpServers;
+            if (policyEngine) {
+              const allowed = {};
+              for (const [name, serverCfg] of Object.entries(claudeCodeConfig.mcpServers)) {
+                try {
+                  const decision = await policyEngine.evaluateToolInvocation(
+                    name,
+                    "*",
+                    serverCfg.transport
+                  );
+                  if (decision.allowed) {
+                    allowed[name] = serverCfg;
+                  }
+                } catch (err) {
+                  allowed[name] = serverCfg;
+                  try {
+                    const { logger: logger2 } = (init_logger(), __toCommonJS(logger_exports));
+                    logger2.warn(
+                      `[PolicyEngine] Tool invocation evaluation failed for server '${name}': ${err instanceof Error ? err.message : err}`
+                    );
+                  } catch {
+                  }
+                }
+              }
+              filteredServers = allowed;
+            }
+            if (Object.keys(filteredServers).length > 0) {
+              query.mcpServers = filteredServers;
+            }
           }
           let response;
           if (sessionInfo?.reuseSession && sessionInfo.parentSessionId) {
@@ -18596,14 +19423,14 @@ var require_util = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`;
-        let path12 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path14 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin.endsWith("/")) {
           origin = origin.substring(0, origin.length - 1);
         }
-        if (path12 && !path12.startsWith("/")) {
-          path12 = `/${path12}`;
+        if (path14 && !path14.startsWith("/")) {
+          path14 = `/${path14}`;
         }
-        url = new URL(origin + path12);
+        url = new URL(origin + path14);
       }
       return url;
     }
@@ -20217,20 +21044,20 @@ var require_parseParams = __commonJS({
 var require_basename = __commonJS({
   "node_modules/@fastify/busboy/lib/utils/basename.js"(exports, module) {
     "use strict";
-    module.exports = function basename2(path12) {
-      if (typeof path12 !== "string") {
+    module.exports = function basename2(path14) {
+      if (typeof path14 !== "string") {
         return "";
       }
-      for (var i = path12.length - 1; i >= 0; --i) {
-        switch (path12.charCodeAt(i)) {
+      for (var i = path14.length - 1; i >= 0; --i) {
+        switch (path14.charCodeAt(i)) {
           case 47:
           // '/'
           case 92:
-            path12 = path12.slice(i + 1);
-            return path12 === ".." || path12 === "." ? "" : path12;
+            path14 = path14.slice(i + 1);
+            return path14 === ".." || path14 === "." ? "" : path14;
         }
       }
-      return path12 === ".." || path12 === "." ? "" : path12;
+      return path14 === ".." || path14 === "." ? "" : path14;
     };
   }
 });
@@ -21623,8 +22450,8 @@ var require_util2 = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve5, reject) => {
-        res = resolve5;
+      const promise = new Promise((resolve6, reject) => {
+        res = resolve6;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -23129,8 +23956,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
                 });
               }
             });
-            const busboyResolve = new Promise((resolve5, reject) => {
-              busboy.on("finish", resolve5);
+            const busboyResolve = new Promise((resolve6, reject) => {
+              busboy.on("finish", resolve6);
               busboy.on("error", (err) => reject(new TypeError(err)));
             });
             if (this.body !== null) for await (const chunk of consumeBody(this[kState].body)) busboy.write(chunk);
@@ -23261,7 +24088,7 @@ var require_request = __commonJS({
     }
     var Request = class _Request {
       constructor(origin, {
-        path: path12,
+        path: path14,
         method,
         body,
         headers,
@@ -23275,11 +24102,11 @@ var require_request = __commonJS({
         throwOnError,
         expectContinue
       }, handler) {
-        if (typeof path12 !== "string") {
+        if (typeof path14 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path12[0] !== "/" && !(path12.startsWith("http://") || path12.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path14[0] !== "/" && !(path14.startsWith("http://") || path14.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.exec(path12) !== null) {
+        } else if (invalidPathRegex.exec(path14) !== null) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -23342,7 +24169,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? util.buildURL(path12, query) : path12;
+        this.path = query ? util.buildURL(path14, query) : path14;
         this.origin = origin;
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
         this.blocking = blocking == null ? false : blocking;
@@ -23664,9 +24491,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve5(data);
+              return err ? reject(err) : resolve6(data);
             });
           });
         }
@@ -23704,12 +24531,12 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             this.destroy(err, (err2, data) => {
               return err2 ? (
                 /* istanbul ignore next: should never error */
                 reject(err2)
-              ) : resolve5(data);
+              ) : resolve6(data);
             });
           });
         }
@@ -24350,9 +25177,9 @@ var require_RedirectHandler = __commonJS({
           return this.handler.onHeaders(statusCode, headers, resume, statusText);
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path12 = search ? `${pathname}${search}` : pathname;
+        const path14 = search ? `${pathname}${search}` : pathname;
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path12;
+        this.opts.path = path14;
         this.opts.origin = origin;
         this.opts.maxRedirections = 0;
         this.opts.query = null;
@@ -24771,16 +25598,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       async [kClose]() {
-        return new Promise((resolve5) => {
+        return new Promise((resolve6) => {
           if (!this[kSize]) {
-            resolve5(null);
+            resolve6(null);
           } else {
-            this[kClosedResolve] = resolve5;
+            this[kClosedResolve] = resolve6;
           }
         });
       }
       async [kDestroy](err) {
-        return new Promise((resolve5) => {
+        return new Promise((resolve6) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -24791,7 +25618,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve5();
+            resolve6();
           };
           if (this[kHTTP2Session] != null) {
             util.destroy(this[kHTTP2Session], err);
@@ -25371,7 +26198,7 @@ var require_client = __commonJS({
         });
       }
       try {
-        const socket = await new Promise((resolve5, reject) => {
+        const socket = await new Promise((resolve6, reject) => {
           client[kConnector]({
             host,
             hostname,
@@ -25383,7 +26210,7 @@ var require_client = __commonJS({
             if (err) {
               reject(err);
             } else {
-              resolve5(socket2);
+              resolve6(socket2);
             }
           });
         });
@@ -25594,7 +26421,7 @@ var require_client = __commonJS({
         writeH2(client, client[kHTTP2Session], request);
         return;
       }
-      const { body, method, path: path12, host, upgrade, headers, blocking, reset } = request;
+      const { body, method, path: path14, host, upgrade, headers, blocking, reset } = request;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -25644,7 +26471,7 @@ var require_client = __commonJS({
       if (blocking) {
         socket[kBlocking] = true;
       }
-      let header = `${method} ${path12} HTTP/1.1\r
+      let header = `${method} ${path14} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -25707,7 +26534,7 @@ upgrade: ${upgrade}\r
       return true;
     }
     function writeH2(client, session, request) {
-      const { body, method, path: path12, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
+      const { body, method, path: path14, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
       let headers;
       if (typeof reqHeaders === "string") headers = Request[kHTTP2CopyHeaders](reqHeaders.trim());
       else headers = reqHeaders;
@@ -25750,7 +26577,7 @@ upgrade: ${upgrade}\r
         });
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path12;
+      headers[HTTP2_HEADER_PATH] = path14;
       headers[HTTP2_HEADER_SCHEME] = "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -26007,12 +26834,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve5, reject) => {
+      const waitForDrain = () => new Promise((resolve6, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve5;
+          callback = resolve6;
         }
       });
       if (client[kHTTPConnVersion] === "h2") {
@@ -26358,8 +27185,8 @@ var require_pool_base = __commonJS({
         if (this[kQueue].isEmpty()) {
           return Promise.all(this[kClients].map((c) => c.close()));
         } else {
-          return new Promise((resolve5) => {
-            this[kClosedResolve] = resolve5;
+          return new Promise((resolve6) => {
+            this[kClosedResolve] = resolve6;
           });
         }
       }
@@ -26937,7 +27764,7 @@ var require_readable = __commonJS({
         if (this.closed) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const signalListenerCleanup = signal ? util.addAbortListener(signal, () => {
             this.destroy();
           }) : noop;
@@ -26946,7 +27773,7 @@ var require_readable = __commonJS({
             if (signal && signal.aborted) {
               reject(signal.reason || Object.assign(new Error("The operation was aborted"), { name: "AbortError" }));
             } else {
-              resolve5(null);
+              resolve6(null);
             }
           }).on("error", noop).on("data", function(chunk) {
             limit -= chunk.length;
@@ -26968,11 +27795,11 @@ var require_readable = __commonJS({
         throw new TypeError("unusable");
       }
       assert(!stream[kConsume]);
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         stream[kConsume] = {
           type,
           stream,
-          resolve: resolve5,
+          resolve: resolve6,
           reject,
           length: 0,
           body: []
@@ -27007,12 +27834,12 @@ var require_readable = __commonJS({
       }
     }
     function consumeEnd(consume2) {
-      const { type, body, resolve: resolve5, stream, length } = consume2;
+      const { type, body, resolve: resolve6, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve5(toUSVString(Buffer.concat(body)));
+          resolve6(toUSVString(Buffer.concat(body)));
         } else if (type === "json") {
-          resolve5(JSON.parse(Buffer.concat(body)));
+          resolve6(JSON.parse(Buffer.concat(body)));
         } else if (type === "arrayBuffer") {
           const dst = new Uint8Array(length);
           let pos = 0;
@@ -27020,12 +27847,12 @@ var require_readable = __commonJS({
             dst.set(buf, pos);
             pos += buf.byteLength;
           }
-          resolve5(dst.buffer);
+          resolve6(dst.buffer);
         } else if (type === "blob") {
           if (!Blob2) {
             Blob2 = __require("buffer").Blob;
           }
-          resolve5(new Blob2(body, { type: stream[kContentType] }));
+          resolve6(new Blob2(body, { type: stream[kContentType] }));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -27282,9 +28109,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve5(data);
+            return err ? reject(err) : resolve6(data);
           });
         });
       }
@@ -27457,9 +28284,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve5(data);
+            return err ? reject(err) : resolve6(data);
           });
         });
       }
@@ -27740,9 +28567,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve5(data);
+            return err ? reject(err) : resolve6(data);
           });
         });
       }
@@ -27831,9 +28658,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve5(data);
+            return err ? reject(err) : resolve6(data);
           });
         });
       }
@@ -27993,20 +28820,20 @@ var require_mock_utils = __commonJS({
       }
       return true;
     }
-    function safeUrl(path12) {
-      if (typeof path12 !== "string") {
-        return path12;
+    function safeUrl(path14) {
+      if (typeof path14 !== "string") {
+        return path14;
       }
-      const pathSegments = path12.split("?");
+      const pathSegments = path14.split("?");
       if (pathSegments.length !== 2) {
-        return path12;
+        return path14;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path12, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path12);
+    function matchKey(mockDispatch2, { path: path14, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path14);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -28024,7 +28851,7 @@ var require_mock_utils = __commonJS({
     function getMockDispatch(mockDispatches, key) {
       const basePath = key.query ? buildURL(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path12 }) => matchValue(safeUrl(path12), resolvedPath));
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path14 }) => matchValue(safeUrl(path14), resolvedPath));
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
       }
@@ -28061,9 +28888,9 @@ var require_mock_utils = __commonJS({
       }
     }
     function buildKey(opts) {
-      const { path: path12, method, body, headers, query } = opts;
+      const { path: path14, method, body, headers, query } = opts;
       return {
-        path: path12,
+        path: path14,
         method,
         body,
         headers,
@@ -28512,10 +29339,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path12, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path14, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path12,
+            Path: path14,
             "Status code": statusCode,
             Persistent: persist ? "\u2705" : "\u274C",
             Invocations: timesInvoked,
@@ -31456,7 +32283,7 @@ var require_fetch = __commonJS({
       async function dispatch({ body }) {
         const url = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve5, reject) => agent.dispatch(
+        return new Promise((resolve6, reject) => agent.dispatch(
           {
             path: url.pathname + url.search,
             origin: url.origin,
@@ -31532,7 +32359,7 @@ var require_fetch = __commonJS({
                   }
                 }
               }
-              resolve5({
+              resolve6({
                 status,
                 statusText,
                 headersList: headers[kHeadersList],
@@ -31575,7 +32402,7 @@ var require_fetch = __commonJS({
                 const val = headersList[n + 1].toString("latin1");
                 headers[kHeadersList].append(key, val);
               }
-              resolve5({
+              resolve6({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList: headers[kHeadersList],
@@ -33136,8 +33963,8 @@ var require_util6 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path12) {
-      for (const char of path12) {
+    function validateCookiePath(path14) {
+      for (const char of path14) {
         const code = char.charCodeAt(0);
         if (code < 33 || char === ";") {
           throw new Error("Invalid cookie path");
@@ -34817,11 +35644,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path12 = opts.path;
+          let path14 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path12 = `/${path12}`;
+            path14 = `/${path14}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path12);
+          url = new URL(util.parseOrigin(url).origin + path14);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -35070,6 +35897,39 @@ var init_mcp_check_provider = __esm({
       }
       async execute(prInfo, config, dependencyResults, sessionInfo) {
         const cfg = config;
+        const policyEngine = sessionInfo?._parentContext?.policyEngine;
+        if (policyEngine && cfg.method) {
+          try {
+            const serverName = config.checkName || cfg.server || "unknown";
+            const decision = await policyEngine.evaluateToolInvocation(
+              serverName,
+              cfg.method,
+              cfg.transport
+            );
+            if (!decision.allowed) {
+              return {
+                issues: [
+                  {
+                    file: "mcp",
+                    line: 0,
+                    ruleId: "policy/tool_denied",
+                    message: `MCP method '${cfg.method}' blocked by policy: ${decision.reason || "denied"}`,
+                    severity: "error",
+                    category: "security"
+                  }
+                ]
+              };
+            }
+          } catch (err) {
+            try {
+              const { logger: logger2 } = (init_logger(), __toCommonJS(logger_exports));
+              logger2.warn(
+                `[PolicyEngine] Tool invocation evaluation failed: ${err instanceof Error ? err.message : err}`
+              );
+            } catch {
+            }
+          }
+        }
         try {
           const templateContext = {
             pr: {
@@ -35315,7 +36175,7 @@ var init_mcp_check_provider = __esm({
             logger.warn(
               `MCP ${transportName} failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms: ${error instanceof Error ? error.message : String(error)}`
             );
-            await new Promise((resolve5) => setTimeout(resolve5, delay));
+            await new Promise((resolve6) => setTimeout(resolve6, delay));
             attempt += 1;
           } finally {
             try {
@@ -35335,7 +36195,9 @@ var init_mcp_check_provider = __esm({
             command: config.command,
             args: config.command_args,
             env: config.env,
-            cwd: config.workingDirectory
+            cwd: config.workingDirectory,
+            stderr: "pipe"
+            // Prevent child stderr from corrupting TUI
           }),
           config,
           methodArgs,
@@ -35583,7 +36445,7 @@ async function acquirePromptLock() {
     activePrompt = true;
     return;
   }
-  await new Promise((resolve5) => waiters.push(resolve5));
+  await new Promise((resolve6) => waiters.push(resolve6));
   activePrompt = true;
 }
 function releasePromptLock() {
@@ -35593,7 +36455,7 @@ function releasePromptLock() {
 }
 async function interactivePrompt(options) {
   await acquirePromptLock();
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const dbg = process.env.VISOR_DEBUG === "true";
     try {
       if (dbg) {
@@ -35680,12 +36542,12 @@ async function interactivePrompt(options) {
     };
     const finish = (value) => {
       cleanup();
-      resolve5(value);
+      resolve6(value);
     };
     if (options.timeout && options.timeout > 0) {
       timeoutId = setTimeout(() => {
         cleanup();
-        if (defaultValue !== void 0) return resolve5(defaultValue);
+        if (defaultValue !== void 0) return resolve6(defaultValue);
         return reject(new Error("Input timeout"));
       }, options.timeout);
     }
@@ -35817,7 +36679,7 @@ async function interactivePrompt(options) {
   });
 }
 async function simplePrompt(prompt) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const rl = readline.createInterface({
       input: process.stdin,
       output: process.stdout
@@ -35833,7 +36695,7 @@ async function simplePrompt(prompt) {
     rl.question(`${prompt}
 > `, (answer) => {
       rl.close();
-      resolve5(answer.trim());
+      resolve6(answer.trim());
     });
   });
 }
@@ -35851,7 +36713,7 @@ function isStdinAvailable() {
   return !process.stdin.isTTY;
 }
 async function readStdin(timeout, maxSize = 1024 * 1024) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let data = "";
     let timeoutId;
     if (timeout) {
@@ -35878,7 +36740,7 @@ async function readStdin(timeout, maxSize = 1024 * 1024) {
     };
     const onEnd = () => {
       cleanup();
-      resolve5(data.trim());
+      resolve6(data.trim());
     };
     const onError = (err) => {
       cleanup();
@@ -35908,8 +36770,8 @@ var init_stdin_reader = __esm({
 });
 
 // src/providers/human-input-check-provider.ts
-import * as fs8 from "fs";
-import * as path10 from "path";
+import * as fs9 from "fs";
+import * as path11 from "path";
 var HumanInputCheckProvider;
 var init_human_input_check_provider = __esm({
   "src/providers/human-input-check-provider.ts"() {
@@ -36092,19 +36954,19 @@ var init_human_input_check_provider = __esm({
        */
       async tryReadFile(filePath) {
         try {
-          const absolutePath = path10.isAbsolute(filePath) ? filePath : path10.resolve(process.cwd(), filePath);
-          const normalizedPath = path10.normalize(absolutePath);
+          const absolutePath = path11.isAbsolute(filePath) ? filePath : path11.resolve(process.cwd(), filePath);
+          const normalizedPath = path11.normalize(absolutePath);
           const cwd = process.cwd();
-          if (!normalizedPath.startsWith(cwd + path10.sep) && normalizedPath !== cwd) {
+          if (!normalizedPath.startsWith(cwd + path11.sep) && normalizedPath !== cwd) {
             return null;
           }
           try {
-            await fs8.promises.access(normalizedPath, fs8.constants.R_OK);
-            const stats = await fs8.promises.stat(normalizedPath);
+            await fs9.promises.access(normalizedPath, fs9.constants.R_OK);
+            const stats = await fs9.promises.stat(normalizedPath);
             if (!stats.isFile()) {
               return null;
             }
-            const content = await fs8.promises.readFile(normalizedPath, "utf-8");
+            const content = await fs9.promises.readFile(normalizedPath, "utf-8");
             return content.trim();
           } catch {
             return null;
@@ -36546,9 +37408,9 @@ var init_script_check_provider = __esm({
 });
 
 // src/utils/worktree-manager.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as fsp2 from "fs/promises";
-import * as path11 from "path";
+import * as path12 from "path";
 import * as crypto from "crypto";
 var WorktreeManager, worktreeManager;
 var init_worktree_manager = __esm({
@@ -36568,7 +37430,7 @@ var init_worktree_manager = __esm({
         } catch {
           cwd = "/tmp";
         }
-        const defaultBasePath = process.env.VISOR_WORKTREE_PATH || path11.join(cwd, ".visor", "worktrees");
+        const defaultBasePath = process.env.VISOR_WORKTREE_PATH || path12.join(cwd, ".visor", "worktrees");
         this.config = {
           enabled: true,
           base_path: defaultBasePath,
@@ -36605,20 +37467,20 @@ var init_worktree_manager = __esm({
         }
         const reposDir = this.getReposDir();
         const worktreesDir = this.getWorktreesDir();
-        if (!fs9.existsSync(reposDir)) {
-          fs9.mkdirSync(reposDir, { recursive: true });
+        if (!fs10.existsSync(reposDir)) {
+          fs10.mkdirSync(reposDir, { recursive: true });
           logger.debug(`Created repos directory: ${reposDir}`);
         }
-        if (!fs9.existsSync(worktreesDir)) {
-          fs9.mkdirSync(worktreesDir, { recursive: true });
+        if (!fs10.existsSync(worktreesDir)) {
+          fs10.mkdirSync(worktreesDir, { recursive: true });
           logger.debug(`Created worktrees directory: ${worktreesDir}`);
         }
       }
       getReposDir() {
-        return path11.join(this.config.base_path, "repos");
+        return path12.join(this.config.base_path, "repos");
       }
       getWorktreesDir() {
-        return path11.join(this.config.base_path, "worktrees");
+        return path12.join(this.config.base_path, "worktrees");
       }
       /**
        * Generate a deterministic worktree ID based on repository and ref.
@@ -36636,8 +37498,8 @@ var init_worktree_manager = __esm({
       async getOrCreateBareRepo(repository, repoUrl, token, fetchDepth, cloneTimeoutMs) {
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, "-");
-        const bareRepoPath = path11.join(reposDir, `${repoName}.git`);
-        if (fs9.existsSync(bareRepoPath)) {
+        const bareRepoPath = path12.join(reposDir, `${repoName}.git`);
+        if (fs10.existsSync(bareRepoPath)) {
           logger.debug(`Bare repository already exists: ${bareRepoPath}`);
           const verifyResult = await this.verifyBareRepoRemote(bareRepoPath, repoUrl);
           if (verifyResult === "timeout") {
@@ -36756,11 +37618,11 @@ var init_worktree_manager = __esm({
           options.cloneTimeoutMs
         );
         const worktreeId = this.generateWorktreeId(repository, ref);
-        let worktreePath = options.workingDirectory || path11.join(this.getWorktreesDir(), worktreeId);
+        let worktreePath = options.workingDirectory || path12.join(this.getWorktreesDir(), worktreeId);
         if (options.workingDirectory) {
           worktreePath = this.validatePath(options.workingDirectory);
         }
-        if (fs9.existsSync(worktreePath)) {
+        if (fs10.existsSync(worktreePath)) {
           logger.debug(`Worktree already exists: ${worktreePath}`);
           const metadata2 = await this.loadMetadata(worktreePath);
           if (metadata2) {
@@ -37001,9 +37863,9 @@ var init_worktree_manager = __esm({
         const result = await this.executeGitCommand(removeCmd, { timeout: 3e4 });
         if (result.exitCode !== 0) {
           logger.warn(`Failed to remove worktree via git: ${result.stderr}`);
-          if (fs9.existsSync(worktree_path)) {
+          if (fs10.existsSync(worktree_path)) {
             logger.debug(`Manually removing worktree directory`);
-            fs9.rmSync(worktree_path, { recursive: true, force: true });
+            fs10.rmSync(worktree_path, { recursive: true, force: true });
           }
         }
         this.activeWorktrees.delete(worktreeId);
@@ -37013,19 +37875,19 @@ var init_worktree_manager = __esm({
        * Save worktree metadata
        */
       async saveMetadata(worktreePath, metadata) {
-        const metadataPath = path11.join(worktreePath, ".visor-metadata.json");
-        fs9.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
+        const metadataPath = path12.join(worktreePath, ".visor-metadata.json");
+        fs10.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
       }
       /**
        * Load worktree metadata
        */
       async loadMetadata(worktreePath) {
-        const metadataPath = path11.join(worktreePath, ".visor-metadata.json");
-        if (!fs9.existsSync(metadataPath)) {
+        const metadataPath = path12.join(worktreePath, ".visor-metadata.json");
+        if (!fs10.existsSync(metadataPath)) {
           return null;
         }
         try {
-          const content = fs9.readFileSync(metadataPath, "utf8");
+          const content = fs10.readFileSync(metadataPath, "utf8");
           return JSON.parse(content);
         } catch (error) {
           logger.warn(`Failed to load metadata: ${error}`);
@@ -37037,14 +37899,14 @@ var init_worktree_manager = __esm({
        */
       async listWorktrees() {
         const worktreesDir = this.getWorktreesDir();
-        if (!fs9.existsSync(worktreesDir)) {
+        if (!fs10.existsSync(worktreesDir)) {
           return [];
         }
-        const entries = fs9.readdirSync(worktreesDir, { withFileTypes: true });
+        const entries = fs10.readdirSync(worktreesDir, { withFileTypes: true });
         const worktrees = [];
         for (const entry of entries) {
           if (!entry.isDirectory()) continue;
-          const worktreePath = path11.join(worktreesDir, entry.name);
+          const worktreePath = path12.join(worktreesDir, entry.name);
           const metadata = await this.loadMetadata(worktreePath);
           if (metadata) {
             worktrees.push({
@@ -37176,8 +38038,8 @@ var init_worktree_manager = __esm({
        * Validate path to prevent directory traversal
        */
       validatePath(userPath) {
-        const resolvedPath = path11.resolve(userPath);
-        if (!path11.isAbsolute(resolvedPath)) {
+        const resolvedPath = path12.resolve(userPath);
+        if (!path12.isAbsolute(resolvedPath)) {
           throw new Error("Path must be absolute");
         }
         const sensitivePatterns = [
@@ -37515,7 +38377,7 @@ var init_git_checkout_provider = __esm({
       }
       async isAvailable() {
         try {
-          const { commandExecutor: commandExecutor2 } = await import("./command-executor-DVVXERLR.mjs");
+          const { commandExecutor: commandExecutor2 } = await import("./command-executor-TOYBBE7S.mjs");
           const result = await commandExecutor2.execute("git --version", { timeout: 5e3 });
           return result.exitCode === 0;
         } catch (_error) {
@@ -38155,6 +39017,8 @@ var init_workflow_projection = __esm({
 });
 
 // src/providers/workflow-check-provider.ts
+import * as path13 from "path";
+import * as yaml from "js-yaml";
 var WorkflowCheckProvider;
 var init_workflow_check_provider = __esm({
   "src/providers/workflow-check-provider.ts"() {
@@ -38368,6 +39232,28 @@ var init_workflow_check_provider = __esm({
           }
         }
         const parentInputs = config.workflowInputs || {};
+        const basePath = config.basePath || config._parentContext?.originalWorkingDirectory || config._parentContext?.workingDirectory || process.cwd();
+        const loadConfigLiquid = createExtendedLiquid();
+        const loadConfig = (filePath) => {
+          try {
+            const normalizedBasePath = path13.normalize(basePath);
+            const resolvedPath = path13.isAbsolute(filePath) ? path13.normalize(filePath) : path13.normalize(path13.resolve(basePath, filePath));
+            const basePathWithSep = normalizedBasePath.endsWith(path13.sep) ? normalizedBasePath : normalizedBasePath + path13.sep;
+            if (!resolvedPath.startsWith(basePathWithSep) && resolvedPath !== normalizedBasePath) {
+              throw new Error(`Path '${filePath}' escapes base directory`);
+            }
+            const configDir = path13.dirname(resolvedPath);
+            const rawContent = __require("fs").readFileSync(resolvedPath, "utf-8");
+            const renderedContent = loadConfigLiquid.parseAndRenderSync(rawContent, {
+              basePath: configDir
+            });
+            return yaml.load(renderedContent, { schema: yaml.JSON_SCHEMA });
+          } catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            logger.error(`[WorkflowProvider] loadConfig failed for '${filePath}': ${msg}`);
+            throw new Error(`loadConfig('${filePath}') failed: ${msg}`);
+          }
+        };
         const templateContext = {
           pr: prInfo,
           outputs: outputsMap,
@@ -38376,7 +39262,9 @@ var init_workflow_check_provider = __esm({
           conversation,
           outputs_history,
           // Include parent workflow inputs for templates like {{ inputs.question }}
-          inputs: parentInputs
+          inputs: parentInputs,
+          // Helper to load external YAML/JSON config files
+          loadConfig
         };
         const userInputs = config.args || config.workflow_inputs;
         if (userInputs) {
@@ -38746,17 +39634,17 @@ var init_workflow_check_provider = __esm({
        * so it can be executed by the state machine as a nested workflow.
        */
       async loadWorkflowFromConfigPath(sourcePath, baseDir) {
-        const path12 = __require("path");
-        const fs10 = __require("fs");
-        const yaml = __require("js-yaml");
-        const resolved = path12.isAbsolute(sourcePath) ? sourcePath : path12.resolve(baseDir, sourcePath);
-        if (!fs10.existsSync(resolved)) {
+        const path14 = __require("path");
+        const fs11 = __require("fs");
+        const yaml2 = __require("js-yaml");
+        const resolved = path14.isAbsolute(sourcePath) ? sourcePath : path14.resolve(baseDir, sourcePath);
+        if (!fs11.existsSync(resolved)) {
           throw new Error(`Workflow config not found at: ${resolved}`);
         }
-        const rawContent = fs10.readFileSync(resolved, "utf8");
-        const rawData = yaml.load(rawContent);
+        const rawContent = fs11.readFileSync(resolved, "utf8");
+        const rawData = yaml2.load(rawContent);
         if (rawData.imports && Array.isArray(rawData.imports)) {
-          const configDir = path12.dirname(resolved);
+          const configDir = path14.dirname(resolved);
           for (const source of rawData.imports) {
             const results = await this.registry.import(source, {
               basePath: configDir,
@@ -38786,8 +39674,8 @@ ${errors}`);
         if (!steps || Object.keys(steps).length === 0) {
           throw new Error(`Config '${resolved}' does not contain any steps to execute as a workflow`);
         }
-        const id = path12.basename(resolved).replace(/\.(ya?ml)$/i, "");
-        const name = loaded.name || `Workflow from ${path12.basename(resolved)}`;
+        const id = path14.basename(resolved).replace(/\.(ya?ml)$/i, "");
+        const name = loaded.name || `Workflow from ${path14.basename(resolved)}`;
         const workflowDef = {
           id,
           name,
@@ -38809,6 +39697,13 @@ ${errors}`);
 export {
   WorkflowCheckProvider,
   init_workflow_check_provider,
+  extractSlackContext,
+  createScheduleToolWithContext,
+  executeScheduleTool,
+  isScheduleToolCall,
+  ensureScheduleStoreInitialized,
+  ensureReminderStoreInitialized,
+  init_schedule_tool_handler,
   CheckProviderRegistry,
   init_check_provider_registry,
   StateMachineExecutionEngine,
@@ -38822,4 +39717,4 @@ undici/lib/fetch/body.js:
 undici/lib/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-DGZPPGJJ.mjs.map
+//# sourceMappingURL=chunk-EUUAQBTW.mjs.map