@probelabs/visor 0.1.170 → 0.1.171-ee

package/dist/sdk/sdk.js

@@ -570,6 +570,21 @@ var init_logger = __esm({
   }
 });
 
+// src/utils/instance-id.ts
+function getInstanceId() {
+  if (!_instanceId) {
+    _instanceId = generateHumanId();
+  }
+  return _instanceId;
+}
+var _instanceId;
+var init_instance_id = __esm({
+  "src/utils/instance-id.ts"() {
+    "use strict";
+    init_human_id();
+  }
+});
+
 // src/telemetry/fallback-ndjson.ts
 var fallback_ndjson_exports = {};
 __export(fallback_ndjson_exports, {
@@ -646,7 +661,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@probelabs/visor",
-      version: "0.1.170",
+      version: "0.1.42",
       main: "dist/index.js",
       bin: {
         visor: "./dist/index.js"
@@ -760,7 +775,7 @@ var require_package = __commonJS({
         "@opentelemetry/sdk-node": "^0.203.0",
         "@opentelemetry/sdk-trace-base": "^1.30.1",
         "@opentelemetry/semantic-conventions": "^1.30.1",
-        "@probelabs/probe": "^0.6.0-rc286",
+        "@probelabs/probe": "^0.6.0-rc290",
         "@types/commander": "^2.12.0",
         "@types/uuid": "^10.0.0",
         acorn: "^8.16.0",
@@ -864,11 +879,11 @@ function getTracer() {
 }
 async function withActiveSpan(name, attrs, fn) {
   const tracer = getTracer();
-  return await new Promise((resolve15, reject) => {
+  return await new Promise((resolve19, reject) => {
     const callback = async (span) => {
       try {
         const res = await fn(span);
-        resolve15(res);
+        resolve19(res);
       } catch (err) {
         try {
           if (err instanceof Error) span.recordException(err);
@@ -939,25 +954,26 @@ function getVisorRunAttributes() {
   if (commitFull) {
     attrs["visor.commit.sha"] = commitFull;
   }
+  attrs["visor.instance_id"] = getInstanceId();
   return attrs;
 }
 function __getOrCreateNdjsonPath() {
   try {
     if (process.env.VISOR_TELEMETRY_SINK && process.env.VISOR_TELEMETRY_SINK !== "file")
       return null;
-    const path28 = require("path");
-    const fs25 = require("fs");
+    const path33 = require("path");
+    const fs29 = require("fs");
     if (process.env.VISOR_FALLBACK_TRACE_FILE) {
       __ndjsonPath = process.env.VISOR_FALLBACK_TRACE_FILE;
-      const dir = path28.dirname(__ndjsonPath);
-      if (!fs25.existsSync(dir)) fs25.mkdirSync(dir, { recursive: true });
+      const dir = path33.dirname(__ndjsonPath);
+      if (!fs29.existsSync(dir)) fs29.mkdirSync(dir, { recursive: true });
       return __ndjsonPath;
     }
-    const outDir = process.env.VISOR_TRACE_DIR || path28.join(process.cwd(), "output", "traces");
-    if (!fs25.existsSync(outDir)) fs25.mkdirSync(outDir, { recursive: true });
+    const outDir = process.env.VISOR_TRACE_DIR || path33.join(process.cwd(), "output", "traces");
+    if (!fs29.existsSync(outDir)) fs29.mkdirSync(outDir, { recursive: true });
     if (!__ndjsonPath) {
       const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      __ndjsonPath = path28.join(outDir, `${ts}.ndjson`);
+      __ndjsonPath = path33.join(outDir, `${ts}.ndjson`);
     }
     return __ndjsonPath;
   } catch {
@@ -966,11 +982,11 @@ function __getOrCreateNdjsonPath() {
 }
 function _appendRunMarker() {
   try {
-    const fs25 = require("fs");
+    const fs29 = require("fs");
     const p = __getOrCreateNdjsonPath();
     if (!p) return;
     const line = { name: "visor.run", attributes: { started: true } };
-    fs25.appendFileSync(p, JSON.stringify(line) + "\n", "utf8");
+    fs29.appendFileSync(p, JSON.stringify(line) + "\n", "utf8");
   } catch {
   }
 }
@@ -979,6 +995,7 @@ var init_trace_helpers = __esm({
   "src/telemetry/trace-helpers.ts"() {
     "use strict";
     init_lazy_otel();
+    init_instance_id();
     __ndjsonPath = null;
   }
 });
@@ -3193,7 +3210,7 @@ var init_failure_condition_evaluator = __esm({
        */
       evaluateExpression(condition, context2) {
         try {
-          const normalize4 = (expr) => {
+          const normalize8 = (expr) => {
             const trimmed = expr.trim();
             if (!/[\n;]/.test(trimmed)) return trimmed;
             const parts = trimmed.split(/[\n;]+/).map((s) => s.trim()).filter((s) => s.length > 0 && !s.startsWith("//"));
@@ -3351,7 +3368,7 @@ var init_failure_condition_evaluator = __esm({
           try {
             exec2 = this.sandbox.compile(`return (${raw});`);
           } catch {
-            const normalizedExpr = normalize4(condition);
+            const normalizedExpr = normalize8(condition);
             exec2 = this.sandbox.compile(`return (${normalizedExpr});`);
           }
           const result = exec2(scope).run();
@@ -3734,9 +3751,9 @@ function configureLiquidWithExtensions(liquid) {
   });
   liquid.registerFilter("get", (obj, pathExpr) => {
     if (obj == null) return void 0;
-    const path28 = typeof pathExpr === "string" ? pathExpr : String(pathExpr || "");
-    if (!path28) return obj;
-    const parts = path28.split(".");
+    const path33 = typeof pathExpr === "string" ? pathExpr : String(pathExpr || "");
+    if (!path33) return obj;
+    const parts = path33.split(".");
     let cur = obj;
     for (const p of parts) {
       if (cur == null) return void 0;
@@ -3855,9 +3872,9 @@ function configureLiquidWithExtensions(liquid) {
           }
         }
         const defaultRole = typeof rolesCfg.default === "string" && rolesCfg.default.trim() ? rolesCfg.default.trim() : void 0;
-        const getNested = (obj, path28) => {
-          if (!obj || !path28) return void 0;
-          const parts = path28.split(".");
+        const getNested = (obj, path33) => {
+          if (!obj || !path33) return void 0;
+          const parts = path33.split(".");
           let cur = obj;
           for (const p of parts) {
             if (cur == null) return void 0;
@@ -6409,8 +6426,8 @@ var init_dependency_gating = __esm({
 async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
   try {
     const { createExtendedLiquid: createExtendedLiquid2 } = await Promise.resolve().then(() => (init_liquid_extensions(), liquid_extensions_exports));
-    const fs25 = await import("fs/promises");
-    const path28 = await import("path");
+    const fs29 = await import("fs/promises");
+    const path33 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
     let templateContent;
@@ -6418,24 +6435,24 @@ async function renderTemplateContent(checkId, checkConfig, reviewSummary) {
       templateContent = String(checkConfig.template.content);
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
-      const resolved = path28.resolve(process.cwd(), file);
-      templateContent = await fs25.readFile(resolved, "utf-8");
+      const resolved = path33.resolve(process.cwd(), file);
+      templateContent = await fs29.readFile(resolved, "utf-8");
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
         const candidatePaths = [
-          path28.join(__dirname, "output", sanitized, "template.liquid"),
+          path33.join(__dirname, "output", sanitized, "template.liquid"),
           // bundled: dist/output/
-          path28.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
+          path33.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
           // source: output/
-          path28.join(process.cwd(), "output", sanitized, "template.liquid"),
+          path33.join(process.cwd(), "output", sanitized, "template.liquid"),
           // fallback: cwd/output/
-          path28.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
+          path33.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
           // fallback: cwd/dist/output/
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs25.readFile(p, "utf-8");
+            templateContent = await fs29.readFile(p, "utf-8");
             if (templateContent) break;
           } catch {
           }
@@ -6840,7 +6857,7 @@ async function processDiffWithOutline(diffContent) {
   }
   try {
     const originalProbePath = process.env.PROBE_PATH;
-    const fs25 = require("fs");
+    const fs29 = require("fs");
     const possiblePaths = [
       // Relative to current working directory (most common in production)
       path6.join(process.cwd(), "node_modules/@probelabs/probe/bin/probe-binary"),
@@ -6851,7 +6868,7 @@ async function processDiffWithOutline(diffContent) {
     ];
     let probeBinaryPath;
     for (const candidatePath of possiblePaths) {
-      if (fs25.existsSync(candidatePath)) {
+      if (fs29.existsSync(candidatePath)) {
         probeBinaryPath = candidatePath;
         break;
       }
@@ -6958,7 +6975,7 @@ async function renderMermaidToPng(mermaidCode) {
     if (chromiumPath) {
       env.PUPPETEER_EXECUTABLE_PATH = chromiumPath;
     }
-    const result = await new Promise((resolve15) => {
+    const result = await new Promise((resolve19) => {
       const proc = (0, import_child_process.spawn)(
         "npx",
         [
@@ -6988,13 +7005,13 @@ async function renderMermaidToPng(mermaidCode) {
       });
       proc.on("close", (code) => {
         if (code === 0) {
-          resolve15({ success: true });
+          resolve19({ success: true });
         } else {
-          resolve15({ success: false, error: stderr || `Exit code ${code}` });
+          resolve19({ success: false, error: stderr || `Exit code ${code}` });
         }
       });
       proc.on("error", (err) => {
-        resolve15({ success: false, error: err.message });
+        resolve19({ success: false, error: err.message });
       });
     });
     if (!result.success) {
@@ -8156,8 +8173,8 @@ ${schemaString}`);
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs25 = require("fs");
-              const path28 = require("path");
+              const fs29 = require("fs");
+              const path33 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const provider = this.config.provider || "auto";
               const model = this.config.model || "default";
@@ -8271,20 +8288,20 @@ ${"=".repeat(60)}
 `;
               readableVersion += `${"=".repeat(60)}
 `;
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path28.join(process.cwd(), "debug-artifacts");
-              if (!fs25.existsSync(debugArtifactsDir)) {
-                fs25.mkdirSync(debugArtifactsDir, { recursive: true });
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path33.join(process.cwd(), "debug-artifacts");
+              if (!fs29.existsSync(debugArtifactsDir)) {
+                fs29.mkdirSync(debugArtifactsDir, { recursive: true });
               }
-              const debugFile = path28.join(
+              const debugFile = path33.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.json`
               );
-              fs25.writeFileSync(debugFile, debugJson, "utf-8");
-              const readableFile = path28.join(
+              fs29.writeFileSync(debugFile, debugJson, "utf-8");
+              const readableFile = path33.join(
                 debugArtifactsDir,
                 `prompt-${_checkName || "unknown"}-${timestamp}.txt`
               );
-              fs25.writeFileSync(readableFile, readableVersion, "utf-8");
+              fs29.writeFileSync(readableFile, readableVersion, "utf-8");
               log(`
 \u{1F4BE} Full debug info saved to:`);
               log(`   JSON: ${debugFile}`);
@@ -8317,8 +8334,8 @@ ${"=".repeat(60)}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs25 = require("fs");
-              const path28 = require("path");
+              const fs29 = require("fs");
+              const path33 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny2 = agent;
               let fullHistory = [];
@@ -8329,8 +8346,8 @@ ${"=".repeat(60)}
               } else if (agentAny2._messages) {
                 fullHistory = agentAny2._messages;
               }
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path28.join(process.cwd(), "debug-artifacts");
-              const sessionBase = path28.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path33.join(process.cwd(), "debug-artifacts");
+              const sessionBase = path33.join(
                 debugArtifactsDir,
                 `session-${_checkName || "unknown"}-${timestamp}`
               );
@@ -8342,7 +8359,7 @@ ${"=".repeat(60)}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs25.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs29.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -8369,7 +8386,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs25.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs29.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -8378,11 +8395,11 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs25 = require("fs");
-              const path28 = require("path");
+              const fs29 = require("fs");
+              const path33 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path28.join(process.cwd(), "debug-artifacts");
-              const responseFile = path28.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path33.join(process.cwd(), "debug-artifacts");
+              const responseFile = path33.join(
                 debugArtifactsDir,
                 `response-${_checkName || "unknown"}-${timestamp}.txt`
               );
@@ -8415,7 +8432,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs25.writeFileSync(responseFile, responseContent, "utf-8");
+              fs29.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -8431,9 +8448,9 @@ ${"=".repeat(60)}
                 await agentAny._telemetryConfig.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${agentAny._traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs25 = require("fs");
-                  if (fs25.existsSync(agentAny._traceFilePath)) {
-                    const stats = fs25.statSync(agentAny._traceFilePath);
+                  const fs29 = require("fs");
+                  if (fs29.existsSync(agentAny._traceFilePath)) {
+                    const stats = fs29.statSync(agentAny._traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::${agentAny._traceFilePath} (${stats.size} bytes)`
                     );
@@ -8646,9 +8663,9 @@ ${schemaString}`);
           const model = this.config.model || "default";
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs25 = require("fs");
-              const path28 = require("path");
-              const os2 = require("os");
+              const fs29 = require("fs");
+              const path33 = require("path");
+              const os3 = require("os");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const debugData = {
                 timestamp,
@@ -8720,19 +8737,19 @@ ${"=".repeat(60)}
 `;
               readableVersion += `${"=".repeat(60)}
 `;
-              const tempDir = os2.tmpdir();
-              const promptFile = path28.join(tempDir, `visor-prompt-${timestamp}.txt`);
-              fs25.writeFileSync(promptFile, prompt, "utf-8");
+              const tempDir = os3.tmpdir();
+              const promptFile = path33.join(tempDir, `visor-prompt-${timestamp}.txt`);
+              fs29.writeFileSync(promptFile, prompt, "utf-8");
               log(`
 \u{1F4BE} Prompt saved to: ${promptFile}`);
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path28.join(process.cwd(), "debug-artifacts");
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path33.join(process.cwd(), "debug-artifacts");
               try {
-                const base = path28.join(
+                const base = path33.join(
                   debugArtifactsDir,
                   `prompt-${_checkName || "unknown"}-${timestamp}`
                 );
-                fs25.writeFileSync(base + ".json", debugJson, "utf-8");
-                fs25.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
+                fs29.writeFileSync(base + ".json", debugJson, "utf-8");
+                fs29.writeFileSync(base + ".summary.txt", readableVersion, "utf-8");
                 log(`
 \u{1F4BE} Full debug info saved to directory: ${debugArtifactsDir}`);
               } catch {
@@ -8777,8 +8794,8 @@ $ ${cliCommand}
           log(`\u{1F4E4} Response length: ${response.length} characters`);
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs25 = require("fs");
-              const path28 = require("path");
+              const fs29 = require("fs");
+              const path33 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
               const agentAny = agent;
               let fullHistory = [];
@@ -8789,8 +8806,8 @@ $ ${cliCommand}
               } else if (agentAny._messages) {
                 fullHistory = agentAny._messages;
               }
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path28.join(process.cwd(), "debug-artifacts");
-              const sessionBase = path28.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path33.join(process.cwd(), "debug-artifacts");
+              const sessionBase = path33.join(
                 debugArtifactsDir,
                 `session-${_checkName || "unknown"}-${timestamp}`
               );
@@ -8802,7 +8819,7 @@ $ ${cliCommand}
                 schema: effectiveSchema,
                 totalMessages: fullHistory.length
               };
-              fs25.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
+              fs29.writeFileSync(sessionBase + ".json", JSON.stringify(sessionData, null, 2), "utf-8");
               let readable = `=============================================================
 `;
               readable += `COMPLETE AI SESSION HISTORY (AFTER RESPONSE)
@@ -8829,7 +8846,7 @@ ${"=".repeat(60)}
 `;
                 readable += content + "\n";
               });
-              fs25.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
+              fs29.writeFileSync(sessionBase + ".summary.txt", readable, "utf-8");
               log(`\u{1F4BE} Complete session history saved:`);
               log(`   - Contains ALL ${fullHistory.length} messages (prompts + responses)`);
             } catch (error) {
@@ -8838,11 +8855,11 @@ ${"=".repeat(60)}
           }
           if (process.env.VISOR_DEBUG_AI_SESSIONS === "true") {
             try {
-              const fs25 = require("fs");
-              const path28 = require("path");
+              const fs29 = require("fs");
+              const path33 = require("path");
               const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path28.join(process.cwd(), "debug-artifacts");
-              const responseFile = path28.join(
+              const debugArtifactsDir = process.env.VISOR_DEBUG_ARTIFACTS || path33.join(process.cwd(), "debug-artifacts");
+              const responseFile = path33.join(
                 debugArtifactsDir,
                 `response-${_checkName || "unknown"}-${timestamp}.txt`
               );
@@ -8875,7 +8892,7 @@ ${"=".repeat(60)}
 `;
               responseContent += `${"=".repeat(60)}
 `;
-              fs25.writeFileSync(responseFile, responseContent, "utf-8");
+              fs29.writeFileSync(responseFile, responseContent, "utf-8");
               log(`\u{1F4BE} Response saved to: ${responseFile}`);
             } catch (error) {
               log(`\u26A0\uFE0F Could not save response file: ${error}`);
@@ -8893,9 +8910,9 @@ ${"=".repeat(60)}
                 await telemetry.shutdown();
                 log(`\u{1F4CA} OpenTelemetry trace saved to: ${traceFilePath}`);
                 if (process.env.GITHUB_ACTIONS) {
-                  const fs25 = require("fs");
-                  if (fs25.existsSync(traceFilePath)) {
-                    const stats = fs25.statSync(traceFilePath);
+                  const fs29 = require("fs");
+                  if (fs29.existsSync(traceFilePath)) {
+                    const stats = fs29.statSync(traceFilePath);
                     console.log(
                       `::notice title=AI Trace Saved::OpenTelemetry trace file size: ${stats.size} bytes`
                     );
@@ -8933,8 +8950,8 @@ ${"=".repeat(60)}
        * Load schema content from schema files or inline definitions
        */
       async loadSchemaContent(schema) {
-        const fs25 = require("fs").promises;
-        const path28 = require("path");
+        const fs29 = require("fs").promises;
+        const path33 = require("path");
         if (typeof schema === "object" && schema !== null) {
           log("\u{1F4CB} Using inline schema object from configuration");
           return JSON.stringify(schema);
@@ -8947,14 +8964,14 @@ ${"=".repeat(60)}
           }
         } catch {
         }
-        if ((schema.startsWith("./") || schema.includes(".json")) && !path28.isAbsolute(schema)) {
+        if ((schema.startsWith("./") || schema.includes(".json")) && !path33.isAbsolute(schema)) {
           if (schema.includes("..") || schema.includes("\0")) {
             throw new Error("Invalid schema path: path traversal not allowed");
           }
           try {
-            const schemaPath = path28.resolve(process.cwd(), schema);
+            const schemaPath = path33.resolve(process.cwd(), schema);
             log(`\u{1F4CB} Loading custom schema from file: ${schemaPath}`);
-            const schemaContent = await fs25.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs29.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch (error) {
             throw new Error(
@@ -8968,22 +8985,22 @@ ${"=".repeat(60)}
         }
         const candidatePaths = [
           // GitHub Action bundle location
-          path28.join(__dirname, "output", sanitizedSchemaName, "schema.json"),
+          path33.join(__dirname, "output", sanitizedSchemaName, "schema.json"),
           // Historical fallback when src/output was inadvertently bundled as output1/
-          path28.join(__dirname, "output1", sanitizedSchemaName, "schema.json"),
+          path33.join(__dirname, "output1", sanitizedSchemaName, "schema.json"),
           // Local dev (repo root)
-          path28.join(process.cwd(), "output", sanitizedSchemaName, "schema.json")
+          path33.join(process.cwd(), "output", sanitizedSchemaName, "schema.json")
         ];
         for (const schemaPath of candidatePaths) {
           try {
-            const schemaContent = await fs25.readFile(schemaPath, "utf-8");
+            const schemaContent = await fs29.readFile(schemaPath, "utf-8");
             return schemaContent.trim();
           } catch {
           }
         }
-        const distPath = path28.join(__dirname, "output", sanitizedSchemaName, "schema.json");
-        const distAltPath = path28.join(__dirname, "output1", sanitizedSchemaName, "schema.json");
-        const cwdPath = path28.join(process.cwd(), "output", sanitizedSchemaName, "schema.json");
+        const distPath = path33.join(__dirname, "output", sanitizedSchemaName, "schema.json");
+        const distAltPath = path33.join(__dirname, "output1", sanitizedSchemaName, "schema.json");
+        const cwdPath = path33.join(process.cwd(), "output", sanitizedSchemaName, "schema.json");
         throw new Error(
           `Failed to load schema '${sanitizedSchemaName}'. Tried: ${distPath}, ${distAltPath}, and ${cwdPath}. Ensure build copies 'output/' into dist (build:cli), or provide a custom schema file/path.`
         );
@@ -9228,7 +9245,7 @@ ${"=".repeat(60)}
        * Generate mock response for testing
        */
       async generateMockResponse(_prompt, _checkName, _schema) {
-        await new Promise((resolve15) => setTimeout(resolve15, 500));
+        await new Promise((resolve19) => setTimeout(resolve19, 500));
         const name = (_checkName || "").toLowerCase();
         if (name.includes("extract-facts")) {
           const arr = Array.from({ length: 6 }, (_, i) => ({
@@ -9589,7 +9606,7 @@ var init_command_executor = __esm({
        * Execute command with stdin input
        */
       executeWithStdin(command, options) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           const childProcess = (0, import_child_process2.exec)(
             command,
             {
@@ -9601,7 +9618,7 @@ var init_command_executor = __esm({
               if (error && error.killed && (error.code === "ETIMEDOUT" || error.signal === "SIGTERM")) {
                 reject(new Error(`Command timed out after ${options.timeout || 3e4}ms`));
               } else {
-                resolve15({
+                resolve19({
                   stdout: stdout || "",
                   stderr: stderr || "",
                   exitCode: error ? error.code || 1 : 0
@@ -12432,6 +12449,10 @@ var init_config_schema = __esm({
             agent_protocol: {
               $ref: "#/definitions/AgentProtocolConfig",
               description: "Agent protocol (A2A) server configuration"
+            },
+            task_tracking: {
+              type: "boolean",
+              description: "Enable cross-frontend task tracking (default: false). When true, all workflow executions (CLI, Slack, TUI, Scheduler) are recorded in a shared SQLite TaskStore visible via `visor tasks`."
             }
           },
           required: ["version"],
@@ -13168,7 +13189,7 @@ var init_config_schema = __esm({
               description: "Arguments/inputs for the workflow"
             },
             overrides: {
-              $ref: "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55681%3E%3E",
+              $ref: "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55916%3E%3E",
               description: "Override specific step configurations in the workflow"
             },
             output_mapping: {
@@ -13184,7 +13205,7 @@ var init_config_schema = __esm({
               description: "Config file path - alternative to workflow ID (loads a Visor config file as workflow)"
             },
             workflow_overrides: {
-              $ref: "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55681%3E%3E",
+              $ref: "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55916%3E%3E",
               description: "Alias for overrides - workflow step overrides (backward compatibility)"
             },
             ref: {
@@ -13882,7 +13903,7 @@ var init_config_schema = __esm({
               description: "Custom output name (defaults to workflow name)"
             },
             overrides: {
-              $ref: "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55681%3E%3E",
+              $ref: "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55916%3E%3E",
               description: "Step overrides"
             },
             output_mapping: {
@@ -13897,13 +13918,13 @@ var init_config_schema = __esm({
             "^x-": {}
           }
         },
-        "Record<string,Partial<interface-src_types_config.ts-13844-28438-src_types_config.ts-0-55681>>": {
+        "Record<string,Partial<interface-src_types_config.ts-13844-28438-src_types_config.ts-0-55916>>": {
           type: "object",
           additionalProperties: {
-            $ref: "#/definitions/Partial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55681%3E"
+            $ref: "#/definitions/Partial%3Cinterface-src_types_config.ts-13844-28438-src_types_config.ts-0-55916%3E"
           }
         },
-        "Partial<interface-src_types_config.ts-13844-28438-src_types_config.ts-0-55681>": {
+        "Partial<interface-src_types_config.ts-13844-28438-src_types_config.ts-0-55916>": {
           type: "object",
           additionalProperties: false
         },
@@ -17977,17 +17998,17 @@ var init_workflow_check_provider = __esm({
        * so it can be executed by the state machine as a nested workflow.
        */
       async loadWorkflowFromConfigPath(sourcePath, baseDir) {
-        const path28 = require("path");
-        const fs25 = require("fs");
+        const path33 = require("path");
+        const fs29 = require("fs");
         const yaml5 = require("js-yaml");
-        const resolved = path28.isAbsolute(sourcePath) ? sourcePath : path28.resolve(baseDir, sourcePath);
-        if (!fs25.existsSync(resolved)) {
+        const resolved = path33.isAbsolute(sourcePath) ? sourcePath : path33.resolve(baseDir, sourcePath);
+        if (!fs29.existsSync(resolved)) {
           throw new Error(`Workflow config not found at: ${resolved}`);
         }
-        const rawContent = fs25.readFileSync(resolved, "utf8");
+        const rawContent = fs29.readFileSync(resolved, "utf8");
         const rawData = yaml5.load(rawContent);
         if (rawData.imports && Array.isArray(rawData.imports)) {
-          const configDir = path28.dirname(resolved);
+          const configDir = path33.dirname(resolved);
           for (const source of rawData.imports) {
             const results = await this.registry.import(source, {
               basePath: configDir,
@@ -18017,8 +18038,8 @@ ${errors}`);
         if (!steps || Object.keys(steps).length === 0) {
           throw new Error(`Config '${resolved}' does not contain any steps to execute as a workflow`);
         }
-        const id = path28.basename(resolved).replace(/\.(ya?ml)$/i, "");
-        const name = loaded.name || `Workflow from ${path28.basename(resolved)}`;
+        const id = path33.basename(resolved).replace(/\.(ya?ml)$/i, "");
+        const name = loaded.name || `Workflow from ${path33.basename(resolved)}`;
         const workflowDef = {
           id,
           name,
@@ -18824,8 +18845,8 @@ async function createStoreBackend(storageConfig, haConfig) {
     case "mssql": {
       try {
         const loaderPath = "../../enterprise/loader";
-        const { loadEnterpriseStoreBackend } = await import(loaderPath);
-        return await loadEnterpriseStoreBackend(driver, storageConfig, haConfig);
+        const { loadEnterpriseStoreBackend: loadEnterpriseStoreBackend2 } = await import(loaderPath);
+        return await loadEnterpriseStoreBackend2(driver, storageConfig, haConfig);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         logger.error(`[StoreFactory] Failed to load enterprise ${driver} backend: ${msg}`);
@@ -19431,6 +19452,74 @@ var init_github_auth = __esm({
   }
 });
 
+// src/agent-protocol/track-execution.ts
+var track_execution_exports = {};
+__export(track_execution_exports, {
+  trackExecution: () => trackExecution
+});
+async function trackExecution(opts, executor) {
+  const { taskStore, source, configPath, metadata, messageText } = opts;
+  const configName = configPath ? import_path7.default.basename(configPath, import_path7.default.extname(configPath)) : void 0;
+  const workflowId = configName && opts.workflowId ? `${configName}#${opts.workflowId}` : opts.workflowId;
+  const requestMessage = {
+    message_id: import_crypto2.default.randomUUID(),
+    role: "user",
+    parts: [{ text: messageText }]
+  };
+  const task = taskStore.createTask({
+    contextId: import_crypto2.default.randomUUID(),
+    requestMessage,
+    workflowId,
+    requestMetadata: {
+      source,
+      instance_id: getInstanceId(),
+      trace_id: trace.getActiveSpan()?.spanContext().traceId || void 0,
+      ...metadata
+    }
+  });
+  const instanceId = getInstanceId();
+  taskStore.updateTaskState(task.id, "working");
+  taskStore.claimTask(task.id, instanceId);
+  logger.info(
+    `[TaskTracking] Task ${task.id} started (source=${source}, workflow=${workflowId || "-"}, instance=${instanceId})`
+  );
+  try {
+    const result = await executor();
+    const completedMsg = {
+      message_id: import_crypto2.default.randomUUID(),
+      role: "agent",
+      parts: [{ text: "Execution completed" }]
+    };
+    taskStore.updateTaskState(task.id, "completed", completedMsg);
+    logger.info(`[TaskTracking] Task ${task.id} completed`);
+    return { task, result };
+  } catch (err) {
+    const errorText = err instanceof Error ? err.message : String(err);
+    const failMessage = {
+      message_id: import_crypto2.default.randomUUID(),
+      role: "agent",
+      parts: [{ text: errorText }]
+    };
+    try {
+      taskStore.updateTaskState(task.id, "failed", failMessage);
+      logger.info(`[TaskTracking] Task ${task.id} failed: ${errorText}`);
+    } catch {
+    }
+    throw err;
+  }
+}
+var import_crypto2, import_path7;
+var init_track_execution = __esm({
+  "src/agent-protocol/track-execution.ts"() {
+    "use strict";
+    import_crypto2 = __toESM(require("crypto"));
+    import_path7 = __toESM(require("path"));
+    init_logger();
+    init_lazy_otel();
+    init_instance_id();
+  }
+});
+
 // src/scheduler/scheduler.ts
 function getScheduler(visorConfig, config) {
   if (!schedulerInstance && visorConfig) {
@@ -19460,6 +19549,8 @@ var init_scheduler = __esm({
       outputAdapters = /* @__PURE__ */ new Map();
       executionContext = {};
       contextEnricher;
+      taskStore;
+      configPath;
       // HA fields
       haConfig;
       nodeId;
@@ -19485,6 +19576,11 @@ var init_scheduler = __esm({
       setEngine(engine) {
         this.engine = engine;
       }
+      /** Set shared task store for execution tracking. */
+      setTaskStore(store, configPath) {
+        this.taskStore = store;
+        this.configPath = configPath;
+      }
       /**
        * Set the execution context (e.g., Slack client) for workflow executions
        */
@@ -20026,7 +20122,7 @@ var init_scheduler = __esm({
         } catch {
         }
         const { engine: runEngine, config: cfgForRun } = this.prepareExecution(schedule);
-        await runEngine.executeChecks({
+        const schedExecFn = () => runEngine.executeChecks({
           checks: checksToRun,
           showDetails: true,
           outputFormat: "json",
@@ -20035,6 +20131,22 @@ var init_scheduler = __esm({
           debug: process.env.VISOR_DEBUG === "true",
           inputs: schedule.workflowInputs
         });
+        if (this.taskStore) {
+          const { trackExecution: trackExecution2 } = await Promise.resolve().then(() => (init_track_execution(), track_execution_exports));
+          await trackExecution2(
+            {
+              taskStore: this.taskStore,
+              source: "scheduler",
+              workflowId: schedule.workflow,
+              configPath: this.configPath,
+              messageText: `Scheduled: ${schedule.workflow} (${schedule.id})`,
+              metadata: { schedule_id: schedule.id, is_recurring: schedule.isRecurring }
+            },
+            schedExecFn
+          );
+        } else {
+          await schedExecFn();
+        }
         return { message: "Workflow completed", workflow: schedule.workflow };
       }
       /**
@@ -20140,7 +20252,7 @@ Please provide an updated response based on the reminder above. You may referenc
           responseRef
         } = this.prepareExecution(schedule, reminderText);
         try {
-          await runEngine.executeChecks({
+          const reminderExecFn = () => runEngine.executeChecks({
             checks: allChecks,
             showDetails: true,
             outputFormat: "json",
@@ -20148,6 +20260,22 @@ Please provide an updated response based on the reminder above. You may referenc
             webhookContext: { webhookData, eventType: "schedule" },
             debug: process.env.VISOR_DEBUG === "true"
           });
+          if (this.taskStore) {
+            const { trackExecution: trackExecution2 } = await Promise.resolve().then(() => (init_track_execution(), track_execution_exports));
+            await trackExecution2(
+              {
+                taskStore: this.taskStore,
+                source: "scheduler",
+                workflowId: schedule.workflow,
+                configPath: this.configPath,
+                messageText: reminderText || `Reminder: ${schedule.id}`,
+                metadata: { schedule_id: schedule.id, is_recurring: schedule.isRecurring }
+              },
+              reminderExecFn
+            );
+          } else {
+            await reminderExecFn();
+          }
           if (schedule.isRecurring && responseRef.captured) {
             await this.store.updateAsync(schedule.id, { previousResponse: responseRef.captured });
             logger.info(
@@ -21396,7 +21524,7 @@ var init_mcp_custom_sse_server = __esm({
        * Returns the actual bound port number
        */
       async start() {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           try {
             this.server = import_http.default.createServer((req, res) => {
               this.handleRequest(req, res).catch((error) => {
@@ -21430,7 +21558,7 @@ var init_mcp_custom_sse_server = __esm({
                 );
               }
               this.startKeepalive();
-              resolve15(this.port);
+              resolve19(this.port);
             });
           } catch (error) {
             reject(error);
@@ -21493,7 +21621,7 @@ var init_mcp_custom_sse_server = __esm({
             logger.debug(
               `[CustomToolsSSEServer:${this.sessionId}] Grace period before stop: ${waitMs}ms (activeToolCalls=${this.activeToolCalls})`
             );
-            await new Promise((resolve15) => setTimeout(resolve15, waitMs));
+            await new Promise((resolve19) => setTimeout(resolve19, waitMs));
           }
         }
         if (this.activeToolCalls > 0) {
@@ -21502,7 +21630,7 @@ var init_mcp_custom_sse_server = __esm({
             `[CustomToolsSSEServer:${this.sessionId}] Waiting for ${this.activeToolCalls} active tool call(s) before stop`
           );
           while (this.activeToolCalls > 0 && Date.now() - startedAt < effectiveDrainTimeoutMs) {
-            await new Promise((resolve15) => setTimeout(resolve15, 250));
+            await new Promise((resolve19) => setTimeout(resolve19, 250));
           }
           if (this.activeToolCalls > 0) {
             logger.warn(
@@ -21527,21 +21655,21 @@ var init_mcp_custom_sse_server = __esm({
         }
         this.connections.clear();
         if (this.server) {
-          await new Promise((resolve15, reject) => {
+          await new Promise((resolve19, reject) => {
             const timeout = setTimeout(() => {
               if (this.debug) {
                 logger.debug(
                   `[CustomToolsSSEServer:${this.sessionId}] Force closing server after timeout`
                 );
               }
-              this.server?.close(() => resolve15());
+              this.server?.close(() => resolve19());
             }, 5e3);
             this.server.close((error) => {
               clearTimeout(timeout);
               if (error) {
                 reject(error);
               } else {
-                resolve15();
+                resolve19();
               }
             });
           });
@@ -21976,7 +22104,7 @@ var init_mcp_custom_sse_server = __esm({
               logger.warn(
                 `[CustomToolsSSEServer:${this.sessionId}] Tool ${toolName} failed (attempt ${attempt + 1}/${retryCount + 1}): ${errorMsg}. Retrying in ${delay}ms`
               );
-              await new Promise((resolve15) => setTimeout(resolve15, delay));
+              await new Promise((resolve19) => setTimeout(resolve19, delay));
               attempt++;
             }
           }
@@ -22099,7 +22227,7 @@ var init_tool_resolver = __esm({
 });
 
 // src/providers/ai-check-provider.ts
-var import_promises4, import_path7, AICheckProvider;
+var import_promises4, import_path8, AICheckProvider;
 var init_ai_check_provider = __esm({
   "src/providers/ai-check-provider.ts"() {
     "use strict";
@@ -22109,7 +22237,7 @@ var init_ai_check_provider = __esm({
     init_issue_filter();
     init_liquid_extensions();
     import_promises4 = __toESM(require("fs/promises"));
-    import_path7 = __toESM(require("path"));
+    import_path8 = __toESM(require("path"));
     init_lazy_otel();
     init_state_capture();
     init_mcp_custom_sse_server();
@@ -22274,7 +22402,7 @@ var init_ai_check_provider = __esm({
         const hasFileExtension = /\.[a-zA-Z0-9]{1,10}$/i.test(str);
         const hasPathSeparators = /[\/\\]/.test(str);
         const isRelativePath = /^\.{1,2}\//.test(str);
-        const isAbsolutePath = import_path7.default.isAbsolute(str);
+        const isAbsolutePath = import_path8.default.isAbsolute(str);
         const hasTypicalFileChars = /^[a-zA-Z0-9._\-\/\\:~]+$/.test(str);
         if (!(hasFileExtension || isRelativePath || isAbsolutePath || hasPathSeparators)) {
           return false;
@@ -22284,14 +22412,14 @@ var init_ai_check_provider = __esm({
         }
         try {
           let resolvedPath;
-          if (import_path7.default.isAbsolute(str)) {
-            resolvedPath = import_path7.default.normalize(str);
+          if (import_path8.default.isAbsolute(str)) {
+            resolvedPath = import_path8.default.normalize(str);
           } else {
-            resolvedPath = import_path7.default.resolve(process.cwd(), str);
+            resolvedPath = import_path8.default.resolve(process.cwd(), str);
           }
-          const fs25 = require("fs").promises;
+          const fs29 = require("fs").promises;
           try {
-            const stat2 = await fs25.stat(resolvedPath);
+            const stat2 = await fs29.stat(resolvedPath);
             return stat2.isFile();
           } catch {
             return hasFileExtension && (isRelativePath || isAbsolutePath || hasPathSeparators);
@@ -22308,14 +22436,14 @@ var init_ai_check_provider = __esm({
           throw new Error("Prompt file must have .liquid extension");
         }
         let resolvedPath;
-        if (import_path7.default.isAbsolute(promptPath)) {
+        if (import_path8.default.isAbsolute(promptPath)) {
           resolvedPath = promptPath;
         } else {
-          resolvedPath = import_path7.default.resolve(process.cwd(), promptPath);
+          resolvedPath = import_path8.default.resolve(process.cwd(), promptPath);
         }
-        if (!import_path7.default.isAbsolute(promptPath)) {
-          const normalizedPath = import_path7.default.normalize(resolvedPath);
-          const currentDir = import_path7.default.resolve(process.cwd());
+        if (!import_path8.default.isAbsolute(promptPath)) {
+          const normalizedPath = import_path8.default.normalize(resolvedPath);
+          const currentDir = import_path8.default.resolve(process.cwd());
           if (!normalizedPath.startsWith(currentDir)) {
             throw new Error("Invalid prompt file path: path traversal detected");
           }
@@ -24494,7 +24622,7 @@ var init_oauth2_token_cache = __esm({
 });
 
 // src/providers/http-client-provider.ts
-var fs15, path18, HttpClientProvider;
+var fs15, path19, HttpClientProvider;
 var init_http_client_provider = __esm({
   "src/providers/http-client-provider.ts"() {
     "use strict";
@@ -24506,7 +24634,7 @@ var init_http_client_provider = __esm({
     init_oauth2_token_cache();
     init_logger();
     fs15 = __toESM(require("fs"));
-    path18 = __toESM(require("path"));
+    path19 = __toESM(require("path"));
     HttpClientProvider = class extends CheckProvider {
       liquid;
       sandbox;
@@ -24629,8 +24757,8 @@ var init_http_client_provider = __esm({
             const parentContext = context2?._parentContext;
             const workingDirectory = parentContext?.workingDirectory;
             const workspaceEnabled = parentContext?.workspace?.isEnabled?.();
-            if (workspaceEnabled && workingDirectory && !path18.isAbsolute(resolvedOutputFile)) {
-              resolvedOutputFile = path18.join(workingDirectory, resolvedOutputFile);
+            if (workspaceEnabled && workingDirectory && !path19.isAbsolute(resolvedOutputFile)) {
+              resolvedOutputFile = path19.join(workingDirectory, resolvedOutputFile);
               logger.debug(
                 `[http_client] Resolved relative output_file to workspace: ${resolvedOutputFile}`
               );
@@ -24847,7 +24975,7 @@ var init_http_client_provider = __esm({
               ]
             };
           }
-          const parentDir = path18.dirname(outputFile);
+          const parentDir = path19.dirname(outputFile);
           if (parentDir && !fs15.existsSync(parentDir)) {
             fs15.mkdirSync(parentDir, { recursive: true });
           }
@@ -25617,7 +25745,7 @@ var init_claude_code_types = __esm({
 function isClaudeCodeConstructor(value) {
   return typeof value === "function";
 }
-var import_promises5, import_path8, ClaudeCodeSDKNotInstalledError, ClaudeCodeAPIKeyMissingError, ClaudeCodeCheckProvider;
+var import_promises5, import_path9, ClaudeCodeSDKNotInstalledError, ClaudeCodeAPIKeyMissingError, ClaudeCodeCheckProvider;
 var init_claude_code_check_provider = __esm({
   "src/providers/claude-code-check-provider.ts"() {
     "use strict";
@@ -25626,7 +25754,7 @@ var init_claude_code_check_provider = __esm({
     init_issue_filter();
     init_liquid_extensions();
     import_promises5 = __toESM(require("fs/promises"));
-    import_path8 = __toESM(require("path"));
+    import_path9 = __toESM(require("path"));
     init_claude_code_types();
     ClaudeCodeSDKNotInstalledError = class extends Error {
       constructor() {
@@ -25774,7 +25902,7 @@ var init_claude_code_check_provider = __esm({
         const hasFileExtension = /\.[a-zA-Z0-9]{1,10}$/i.test(str);
         const hasPathSeparators = /[\/\\]/.test(str);
         const isRelativePath = /^\.{1,2}\//.test(str);
-        const isAbsolutePath = import_path8.default.isAbsolute(str);
+        const isAbsolutePath = import_path9.default.isAbsolute(str);
         const hasTypicalFileChars = /^[a-zA-Z0-9._\-\/\\:~]+$/.test(str);
         if (!(hasFileExtension || isRelativePath || isAbsolutePath || hasPathSeparators)) {
           return false;
@@ -25784,10 +25912,10 @@ var init_claude_code_check_provider = __esm({
         }
         try {
           let resolvedPath;
-          if (import_path8.default.isAbsolute(str)) {
-            resolvedPath = import_path8.default.normalize(str);
+          if (import_path9.default.isAbsolute(str)) {
+            resolvedPath = import_path9.default.normalize(str);
           } else {
-            resolvedPath = import_path8.default.resolve(process.cwd(), str);
+            resolvedPath = import_path9.default.resolve(process.cwd(), str);
           }
           try {
             const stat2 = await import_promises5.default.stat(resolvedPath);
@@ -25807,14 +25935,14 @@ var init_claude_code_check_provider = __esm({
           throw new Error("Prompt file must have .liquid extension");
         }
         let resolvedPath;
-        if (import_path8.default.isAbsolute(promptPath)) {
+        if (import_path9.default.isAbsolute(promptPath)) {
           resolvedPath = promptPath;
         } else {
-          resolvedPath = import_path8.default.resolve(process.cwd(), promptPath);
+          resolvedPath = import_path9.default.resolve(process.cwd(), promptPath);
         }
-        if (!import_path8.default.isAbsolute(promptPath)) {
-          const normalizedPath = import_path8.default.normalize(resolvedPath);
-          const currentDir = import_path8.default.resolve(process.cwd());
+        if (!import_path9.default.isAbsolute(promptPath)) {
+          const normalizedPath = import_path9.default.normalize(resolvedPath);
+          const currentDir = import_path9.default.resolve(process.cwd());
           if (!normalizedPath.startsWith(currentDir)) {
             throw new Error("Invalid prompt file path: path traversal detected");
           }
@@ -28393,14 +28521,14 @@ var require_util = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`;
-        let path28 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path33 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin.endsWith("/")) {
           origin = origin.substring(0, origin.length - 1);
         }
-        if (path28 && !path28.startsWith("/")) {
-          path28 = `/${path28}`;
+        if (path33 && !path33.startsWith("/")) {
+          path33 = `/${path33}`;
         }
-        url = new URL(origin + path28);
+        url = new URL(origin + path33);
       }
       return url;
     }
@@ -30014,20 +30142,20 @@ var require_parseParams = __commonJS({
 var require_basename = __commonJS({
   "node_modules/@fastify/busboy/lib/utils/basename.js"(exports2, module2) {
     "use strict";
-    module2.exports = function basename4(path28) {
-      if (typeof path28 !== "string") {
+    module2.exports = function basename4(path33) {
+      if (typeof path33 !== "string") {
         return "";
       }
-      for (var i = path28.length - 1; i >= 0; --i) {
-        switch (path28.charCodeAt(i)) {
+      for (var i = path33.length - 1; i >= 0; --i) {
+        switch (path33.charCodeAt(i)) {
           case 47:
           // '/'
           case 92:
-            path28 = path28.slice(i + 1);
-            return path28 === ".." || path28 === "." ? "" : path28;
+            path33 = path33.slice(i + 1);
+            return path33 === ".." || path33 === "." ? "" : path33;
         }
       }
-      return path28 === ".." || path28 === "." ? "" : path28;
+      return path33 === ".." || path33 === "." ? "" : path33;
     };
   }
 });
@@ -31031,11 +31159,11 @@ var require_util2 = __commonJS({
     var assert = require("assert");
     var { isUint8Array } = require("util/types");
     var supportedHashes = [];
-    var crypto6;
+    var crypto9;
     try {
-      crypto6 = require("crypto");
+      crypto9 = require("crypto");
       const possibleRelevantHashes = ["sha256", "sha384", "sha512"];
-      supportedHashes = crypto6.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
+      supportedHashes = crypto9.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
     } catch {
     }
     function responseURL(response) {
@@ -31312,7 +31440,7 @@ var require_util2 = __commonJS({
       }
     }
     function bytesMatch(bytes, metadataList) {
-      if (crypto6 === void 0) {
+      if (crypto9 === void 0) {
         return true;
       }
       const parsedMetadata = parseMetadata(metadataList);
@@ -31327,7 +31455,7 @@ var require_util2 = __commonJS({
       for (const item of metadata) {
         const algorithm = item.algo;
         const expectedValue = item.hash;
-        let actualValue = crypto6.createHash(algorithm).update(bytes).digest("base64");
+        let actualValue = crypto9.createHash(algorithm).update(bytes).digest("base64");
         if (actualValue[actualValue.length - 1] === "=") {
           if (actualValue[actualValue.length - 2] === "=") {
             actualValue = actualValue.slice(0, -2);
@@ -31420,8 +31548,8 @@ var require_util2 = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve15, reject) => {
-        res = resolve15;
+      const promise = new Promise((resolve19, reject) => {
+        res = resolve19;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -32674,8 +32802,8 @@ var require_body = __commonJS({
     var { parseMIMEType, serializeAMimeType } = require_dataURL();
     var random;
     try {
-      const crypto6 = require("crypto");
-      random = (max) => crypto6.randomInt(0, max);
+      const crypto9 = require("crypto");
+      random = (max) => crypto9.randomInt(0, max);
     } catch {
       random = (max) => Math.floor(Math.random(max));
     }
@@ -32926,8 +33054,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
                 });
               }
             });
-            const busboyResolve = new Promise((resolve15, reject) => {
-              busboy.on("finish", resolve15);
+            const busboyResolve = new Promise((resolve19, reject) => {
+              busboy.on("finish", resolve19);
               busboy.on("error", (err) => reject(new TypeError(err)));
             });
             if (this.body !== null) for await (const chunk of consumeBody(this[kState].body)) busboy.write(chunk);
@@ -33058,7 +33186,7 @@ var require_request = __commonJS({
     }
     var Request = class _Request {
       constructor(origin, {
-        path: path28,
+        path: path33,
         method,
         body,
         headers,
@@ -33072,11 +33200,11 @@ var require_request = __commonJS({
         throwOnError,
         expectContinue
       }, handler) {
-        if (typeof path28 !== "string") {
+        if (typeof path33 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path28[0] !== "/" && !(path28.startsWith("http://") || path28.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path33[0] !== "/" && !(path33.startsWith("http://") || path33.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.exec(path28) !== null) {
+        } else if (invalidPathRegex.exec(path33) !== null) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -33139,7 +33267,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? util.buildURL(path28, query) : path28;
+        this.path = query ? util.buildURL(path33, query) : path33;
         this.origin = origin;
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
         this.blocking = blocking == null ? false : blocking;
@@ -33461,9 +33589,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve15, reject) => {
+          return new Promise((resolve19, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve15(data);
+              return err ? reject(err) : resolve19(data);
             });
           });
         }
@@ -33501,12 +33629,12 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve15, reject) => {
+          return new Promise((resolve19, reject) => {
             this.destroy(err, (err2, data) => {
               return err2 ? (
                 /* istanbul ignore next: should never error */
                 reject(err2)
-              ) : resolve15(data);
+              ) : resolve19(data);
             });
           });
         }
@@ -34147,9 +34275,9 @@ var require_RedirectHandler = __commonJS({
           return this.handler.onHeaders(statusCode, headers, resume, statusText);
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path28 = search ? `${pathname}${search}` : pathname;
+        const path33 = search ? `${pathname}${search}` : pathname;
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path28;
+        this.opts.path = path33;
         this.opts.origin = origin;
         this.opts.maxRedirections = 0;
         this.opts.query = null;
@@ -34568,16 +34696,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       async [kClose]() {
-        return new Promise((resolve15) => {
+        return new Promise((resolve19) => {
           if (!this[kSize]) {
-            resolve15(null);
+            resolve19(null);
           } else {
-            this[kClosedResolve] = resolve15;
+            this[kClosedResolve] = resolve19;
           }
         });
       }
       async [kDestroy](err) {
-        return new Promise((resolve15) => {
+        return new Promise((resolve19) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -34588,7 +34716,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve15();
+            resolve19();
           };
           if (this[kHTTP2Session] != null) {
             util.destroy(this[kHTTP2Session], err);
@@ -35168,7 +35296,7 @@ var require_client = __commonJS({
         });
       }
       try {
-        const socket = await new Promise((resolve15, reject) => {
+        const socket = await new Promise((resolve19, reject) => {
           client[kConnector]({
             host,
             hostname,
@@ -35180,7 +35308,7 @@ var require_client = __commonJS({
             if (err) {
               reject(err);
             } else {
-              resolve15(socket2);
+              resolve19(socket2);
             }
           });
         });
@@ -35391,7 +35519,7 @@ var require_client = __commonJS({
         writeH2(client, client[kHTTP2Session], request);
         return;
       }
-      const { body, method, path: path28, host, upgrade, headers, blocking, reset } = request;
+      const { body, method, path: path33, host, upgrade, headers, blocking, reset } = request;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -35441,7 +35569,7 @@ var require_client = __commonJS({
       if (blocking) {
         socket[kBlocking] = true;
       }
-      let header = `${method} ${path28} HTTP/1.1\r
+      let header = `${method} ${path33} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -35504,7 +35632,7 @@ upgrade: ${upgrade}\r
       return true;
     }
     function writeH2(client, session, request) {
-      const { body, method, path: path28, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
+      const { body, method, path: path33, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
       let headers;
       if (typeof reqHeaders === "string") headers = Request[kHTTP2CopyHeaders](reqHeaders.trim());
       else headers = reqHeaders;
@@ -35547,7 +35675,7 @@ upgrade: ${upgrade}\r
         });
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path28;
+      headers[HTTP2_HEADER_PATH] = path33;
       headers[HTTP2_HEADER_SCHEME] = "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -35804,12 +35932,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve15, reject) => {
+      const waitForDrain = () => new Promise((resolve19, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve15;
+          callback = resolve19;
         }
       });
       if (client[kHTTPConnVersion] === "h2") {
@@ -36155,8 +36283,8 @@ var require_pool_base = __commonJS({
         if (this[kQueue].isEmpty()) {
           return Promise.all(this[kClients].map((c) => c.close()));
         } else {
-          return new Promise((resolve15) => {
-            this[kClosedResolve] = resolve15;
+          return new Promise((resolve19) => {
+            this[kClosedResolve] = resolve19;
           });
         }
       }
@@ -36734,7 +36862,7 @@ var require_readable = __commonJS({
         if (this.closed) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           const signalListenerCleanup = signal ? util.addAbortListener(signal, () => {
             this.destroy();
           }) : noop;
@@ -36743,7 +36871,7 @@ var require_readable = __commonJS({
             if (signal && signal.aborted) {
               reject(signal.reason || Object.assign(new Error("The operation was aborted"), { name: "AbortError" }));
             } else {
-              resolve15(null);
+              resolve19(null);
             }
           }).on("error", noop).on("data", function(chunk) {
             limit -= chunk.length;
@@ -36765,11 +36893,11 @@ var require_readable = __commonJS({
         throw new TypeError("unusable");
       }
       assert(!stream[kConsume]);
-      return new Promise((resolve15, reject) => {
+      return new Promise((resolve19, reject) => {
         stream[kConsume] = {
           type,
           stream,
-          resolve: resolve15,
+          resolve: resolve19,
           reject,
           length: 0,
           body: []
@@ -36804,12 +36932,12 @@ var require_readable = __commonJS({
       }
     }
     function consumeEnd(consume2) {
-      const { type, body, resolve: resolve15, stream, length } = consume2;
+      const { type, body, resolve: resolve19, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve15(toUSVString(Buffer.concat(body)));
+          resolve19(toUSVString(Buffer.concat(body)));
         } else if (type === "json") {
-          resolve15(JSON.parse(Buffer.concat(body)));
+          resolve19(JSON.parse(Buffer.concat(body)));
         } else if (type === "arrayBuffer") {
           const dst = new Uint8Array(length);
           let pos = 0;
@@ -36817,12 +36945,12 @@ var require_readable = __commonJS({
             dst.set(buf, pos);
             pos += buf.byteLength;
           }
-          resolve15(dst.buffer);
+          resolve19(dst.buffer);
         } else if (type === "blob") {
           if (!Blob2) {
             Blob2 = require("buffer").Blob;
           }
-          resolve15(new Blob2(body, { type: stream[kContentType] }));
+          resolve19(new Blob2(body, { type: stream[kContentType] }));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -37079,9 +37207,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -37254,9 +37382,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -37537,9 +37665,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -37628,9 +37756,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve19, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -37790,20 +37918,20 @@ var require_mock_utils = __commonJS({
       }
       return true;
     }
-    function safeUrl(path28) {
-      if (typeof path28 !== "string") {
-        return path28;
+    function safeUrl(path33) {
+      if (typeof path33 !== "string") {
+        return path33;
       }
-      const pathSegments = path28.split("?");
+      const pathSegments = path33.split("?");
       if (pathSegments.length !== 2) {
-        return path28;
+        return path33;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path28, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path28);
+    function matchKey(mockDispatch2, { path: path33, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path33);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -37821,7 +37949,7 @@ var require_mock_utils = __commonJS({
     function getMockDispatch(mockDispatches, key) {
       const basePath = key.query ? buildURL(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path28 }) => matchValue(safeUrl(path28), resolvedPath));
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path33 }) => matchValue(safeUrl(path33), resolvedPath));
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
       }
@@ -37858,9 +37986,9 @@ var require_mock_utils = __commonJS({
       }
     }
     function buildKey(opts) {
-      const { path: path28, method, body, headers, query } = opts;
+      const { path: path33, method, body, headers, query } = opts;
       return {
-        path: path28,
+        path: path33,
         method,
         body,
         headers,
@@ -38309,10 +38437,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path28, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path33, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path28,
+            Path: path33,
             "Status code": statusCode,
             Persistent: persist ? "\u2705" : "\u274C",
             Invocations: timesInvoked,
@@ -41253,7 +41381,7 @@ var require_fetch = __commonJS({
       async function dispatch({ body }) {
         const url = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve15, reject) => agent.dispatch(
+        return new Promise((resolve19, reject) => agent.dispatch(
           {
             path: url.pathname + url.search,
             origin: url.origin,
@@ -41329,7 +41457,7 @@ var require_fetch = __commonJS({
                   }
                 }
               }
-              resolve15({
+              resolve19({
                 status,
                 statusText,
                 headersList: headers[kHeadersList],
@@ -41372,7 +41500,7 @@ var require_fetch = __commonJS({
                 const val = headersList[n + 1].toString("latin1");
                 headers[kHeadersList].append(key, val);
               }
-              resolve15({
+              resolve19({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList: headers[kHeadersList],
@@ -42933,8 +43061,8 @@ var require_util6 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path28) {
-      for (const char of path28) {
+    function validateCookiePath(path33) {
+      for (const char of path33) {
         const code = char.charCodeAt(0);
         if (code < 33 || char === ";") {
           throw new Error("Invalid cookie path");
@@ -43731,9 +43859,9 @@ var require_connection = __commonJS({
     channels.open = diagnosticsChannel.channel("undici:websocket:open");
     channels.close = diagnosticsChannel.channel("undici:websocket:close");
     channels.socketError = diagnosticsChannel.channel("undici:websocket:socket_error");
-    var crypto6;
+    var crypto9;
     try {
-      crypto6 = require("crypto");
+      crypto9 = require("crypto");
     } catch {
     }
     function establishWebSocketConnection(url, protocols, ws, onEstablish, options) {
@@ -43752,7 +43880,7 @@ var require_connection = __commonJS({
         const headersList = new Headers(options.headers)[kHeadersList];
         request.headersList = headersList;
       }
-      const keyValue = crypto6.randomBytes(16).toString("base64");
+      const keyValue = crypto9.randomBytes(16).toString("base64");
       request.headersList.append("sec-websocket-key", keyValue);
       request.headersList.append("sec-websocket-version", "13");
       for (const protocol of protocols) {
@@ -43781,7 +43909,7 @@ var require_connection = __commonJS({
             return;
           }
           const secWSAccept = response.headersList.get("Sec-WebSocket-Accept");
-          const digest = crypto6.createHash("sha1").update(keyValue + uid).digest("base64");
+          const digest = crypto9.createHash("sha1").update(keyValue + uid).digest("base64");
           if (secWSAccept !== digest) {
             failWebsocketConnection(ws, "Incorrect hash received in Sec-WebSocket-Accept header.");
             return;
@@ -43861,9 +43989,9 @@ var require_frame = __commonJS({
   "node_modules/undici/lib/websocket/frame.js"(exports2, module2) {
     "use strict";
     var { maxUnsigned16Bit } = require_constants5();
-    var crypto6;
+    var crypto9;
     try {
-      crypto6 = require("crypto");
+      crypto9 = require("crypto");
     } catch {
     }
     var WebsocketFrameSend = class {
@@ -43872,7 +44000,7 @@ var require_frame = __commonJS({
        */
       constructor(data) {
         this.frameData = data;
-        this.maskKey = crypto6.randomBytes(4);
+        this.maskKey = crypto9.randomBytes(4);
       }
       createFrame(opcode) {
         const bodyLength = this.frameData?.byteLength ?? 0;
@@ -44614,11 +44742,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path28 = opts.path;
+          let path33 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path28 = `/${path28}`;
+            path33 = `/${path33}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path28);
+          url = new URL(util.parseOrigin(url).origin + path33);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -45167,7 +45295,7 @@ var init_mcp_check_provider = __esm({
             logger.warn(
               `MCP ${transportName} failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms: ${error instanceof Error ? error.message : String(error)}`
             );
-            await new Promise((resolve15) => setTimeout(resolve15, delay));
+            await new Promise((resolve19) => setTimeout(resolve19, delay));
             attempt += 1;
           } finally {
             try {
@@ -45460,7 +45588,7 @@ async function acquirePromptLock() {
     );
   }, 1e4);
   try {
-    await new Promise((resolve15) => waiters.push(resolve15));
+    await new Promise((resolve19) => waiters.push(resolve19));
   } finally {
     clearInterval(reminder);
     const waitedMs = Date.now() - queuedAt;
@@ -45479,7 +45607,7 @@ function releasePromptLock() {
 }
 async function interactivePrompt(options) {
   await acquirePromptLock();
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve19, reject) => {
     const dbg = process.env.VISOR_DEBUG === "true";
     try {
       if (dbg) {
@@ -45566,12 +45694,12 @@ async function interactivePrompt(options) {
     };
     const finish = (value) => {
       cleanup();
-      resolve15(value);
+      resolve19(value);
     };
     if (options.timeout && options.timeout > 0) {
       timeoutId = setTimeout(() => {
         cleanup();
-        if (defaultValue !== void 0) return resolve15(defaultValue);
+        if (defaultValue !== void 0) return resolve19(defaultValue);
         return reject(new Error("Input timeout"));
       }, options.timeout);
     }
@@ -45703,7 +45831,7 @@ async function interactivePrompt(options) {
   });
 }
 async function simplePrompt(prompt) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve19) => {
     const rl = readline.createInterface({
       input: process.stdin,
       output: process.stdout
@@ -45719,7 +45847,7 @@ async function simplePrompt(prompt) {
     rl.question(`${prompt}
 > `, (answer) => {
       rl.close();
-      resolve15(answer.trim());
+      resolve19(answer.trim());
     });
   });
 }
@@ -45887,7 +46015,7 @@ function isStdinAvailable() {
   return !process.stdin.isTTY;
 }
 async function readStdin(timeout, maxSize = 1024 * 1024) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve19, reject) => {
     let data = "";
     let timeoutId;
     if (timeout) {
@@ -45914,7 +46042,7 @@ async function readStdin(timeout, maxSize = 1024 * 1024) {
     };
     const onEnd = () => {
       cleanup();
-      resolve15(data.trim());
+      resolve19(data.trim());
     };
     const onError = (err) => {
       cleanup();
@@ -45944,7 +46072,7 @@ var init_stdin_reader = __esm({
 });
 
 // src/providers/human-input-check-provider.ts
-var fs17, path20, HumanInputCheckProvider;
+var fs17, path21, HumanInputCheckProvider;
 var init_human_input_check_provider = __esm({
   "src/providers/human-input-check-provider.ts"() {
     "use strict";
@@ -45954,7 +46082,7 @@ var init_human_input_check_provider = __esm({
     init_liquid_extensions();
     init_stdin_reader();
     fs17 = __toESM(require("fs"));
-    path20 = __toESM(require("path"));
+    path21 = __toESM(require("path"));
     HumanInputCheckProvider = class _HumanInputCheckProvider extends CheckProvider {
       liquid;
       /**
@@ -46128,10 +46256,10 @@ var init_human_input_check_provider = __esm({
        */
       async tryReadFile(filePath) {
         try {
-          const absolutePath = path20.isAbsolute(filePath) ? filePath : path20.resolve(process.cwd(), filePath);
-          const normalizedPath = path20.normalize(absolutePath);
+          const absolutePath = path21.isAbsolute(filePath) ? filePath : path21.resolve(process.cwd(), filePath);
+          const normalizedPath = path21.normalize(absolutePath);
           const cwd = process.cwd();
-          if (!normalizedPath.startsWith(cwd + path20.sep) && normalizedPath !== cwd) {
+          if (!normalizedPath.startsWith(cwd + path21.sep) && normalizedPath !== cwd) {
             return null;
           }
           try {
@@ -47286,14 +47414,14 @@ var init_script_check_provider = __esm({
 });
 
 // src/utils/worktree-manager.ts
-var fs18, fsp, path21, crypto, WorktreeManager, worktreeManager;
+var fs18, fsp, path22, crypto2, WorktreeManager, worktreeManager;
 var init_worktree_manager = __esm({
   "src/utils/worktree-manager.ts"() {
     "use strict";
     fs18 = __toESM(require("fs"));
     fsp = __toESM(require("fs/promises"));
-    path21 = __toESM(require("path"));
-    crypto = __toESM(require("crypto"));
+    path22 = __toESM(require("path"));
+    crypto2 = __toESM(require("crypto"));
     init_command_executor();
     init_logger();
     WorktreeManager = class _WorktreeManager {
@@ -47308,7 +47436,7 @@ var init_worktree_manager = __esm({
         } catch {
           cwd = "/tmp";
         }
-        const defaultBasePath = process.env.VISOR_WORKTREE_PATH || path21.join(cwd, ".visor", "worktrees");
+        const defaultBasePath = process.env.VISOR_WORKTREE_PATH || path22.join(cwd, ".visor", "worktrees");
         this.config = {
           enabled: true,
           base_path: defaultBasePath,
@@ -47355,10 +47483,10 @@ var init_worktree_manager = __esm({
         }
       }
       getReposDir() {
-        return path21.join(this.config.base_path, "repos");
+        return path22.join(this.config.base_path, "repos");
       }
       getWorktreesDir() {
-        return path21.join(this.config.base_path, "worktrees");
+        return path22.join(this.config.base_path, "worktrees");
       }
       /**
        * Generate a worktree ID based on repository, ref, and session.
@@ -47374,7 +47502,7 @@ var init_worktree_manager = __esm({
         const sanitizedRepo = repository.replace(/[^a-zA-Z0-9-]/g, "-");
         const sanitizedRef = ref.replace(/[^a-zA-Z0-9-]/g, "-");
         const hashInput = sessionId ? `${repository}:${ref}:${sessionId}` : `${repository}:${ref}`;
-        const hash = crypto.createHash("md5").update(hashInput).digest("hex").substring(0, 8);
+        const hash = crypto2.createHash("md5").update(hashInput).digest("hex").substring(0, 8);
         return `${sanitizedRepo}-${sanitizedRef}-${hash}`;
       }
       /**
@@ -47383,7 +47511,7 @@ var init_worktree_manager = __esm({
       async getOrCreateBareRepo(repository, repoUrl, _token, fetchDepth, cloneTimeoutMs) {
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, "-");
-        const bareRepoPath = path21.join(reposDir, `${repoName}.git`);
+        const bareRepoPath = path22.join(reposDir, `${repoName}.git`);
         if (fs18.existsSync(bareRepoPath)) {
           logger.debug(`Bare repository already exists: ${bareRepoPath}`);
           const verifyResult = await this.verifyBareRepoRemote(bareRepoPath, repoUrl);
@@ -47531,7 +47659,7 @@ var init_worktree_manager = __esm({
           options.cloneTimeoutMs
         );
         const worktreeId = this.generateWorktreeId(repository, ref, options.sessionId);
-        let worktreePath = options.workingDirectory || path21.join(this.getWorktreesDir(), worktreeId);
+        let worktreePath = options.workingDirectory || path22.join(this.getWorktreesDir(), worktreeId);
         if (options.workingDirectory) {
           worktreePath = this.validatePath(options.workingDirectory);
         }
@@ -47852,7 +47980,7 @@ var init_worktree_manager = __esm({
        */
       async loadMetadata(worktreePath) {
         const metadataPath = this.getMetadataPath(worktreePath);
-        const legacyPath = path21.join(worktreePath, ".visor-metadata.json");
+        const legacyPath = path22.join(worktreePath, ".visor-metadata.json");
         const pathToRead = fs18.existsSync(metadataPath) ? metadataPath : fs18.existsSync(legacyPath) ? legacyPath : null;
         if (!pathToRead) {
           return null;
@@ -47877,7 +48005,7 @@ var init_worktree_manager = __esm({
         const worktrees = [];
         for (const entry of entries) {
           if (!entry.isDirectory()) continue;
-          const worktreePath = path21.join(worktreesDir, entry.name);
+          const worktreePath = path22.join(worktreesDir, entry.name);
           const metadata = await this.loadMetadata(worktreePath);
           if (metadata) {
             worktrees.push({
@@ -48009,8 +48137,8 @@ var init_worktree_manager = __esm({
        * Validate path to prevent directory traversal
        */
       validatePath(userPath) {
-        const resolvedPath = path21.resolve(userPath);
-        if (!path21.isAbsolute(resolvedPath)) {
+        const resolvedPath = path22.resolve(userPath);
+        if (!path22.isAbsolute(resolvedPath)) {
           throw new Error("Path must be absolute");
         }
         const sensitivePatterns = [
@@ -50605,23 +50733,23 @@ __export(renderer_schema_exports, {
 });
 async function loadRendererSchema(name) {
   try {
-    const fs25 = await import("fs/promises");
-    const path28 = await import("path");
+    const fs29 = await import("fs/promises");
+    const path33 = await import("path");
     const sanitized = String(name).replace(/[^a-zA-Z0-9-]/g, "");
     if (!sanitized) return void 0;
     const candidates = [
       // When bundled with ncc, __dirname is dist/ and output/ is at dist/output/
-      path28.join(__dirname, "output", sanitized, "schema.json"),
+      path33.join(__dirname, "output", sanitized, "schema.json"),
       // When running from source, __dirname is src/state-machine/dispatch/ and output/ is at output/
-      path28.join(__dirname, "..", "..", "output", sanitized, "schema.json"),
+      path33.join(__dirname, "..", "..", "output", sanitized, "schema.json"),
       // When running from a checkout with output/ folder copied to CWD
-      path28.join(process.cwd(), "output", sanitized, "schema.json"),
+      path33.join(process.cwd(), "output", sanitized, "schema.json"),
       // Fallback: cwd/dist/output/
-      path28.join(process.cwd(), "dist", "output", sanitized, "schema.json")
+      path33.join(process.cwd(), "dist", "output", sanitized, "schema.json")
     ];
     for (const p of candidates) {
       try {
-        const raw = await fs25.readFile(p, "utf-8");
+        const raw = await fs29.readFile(p, "utf-8");
         return JSON.parse(raw);
       } catch {
       }
@@ -53062,8 +53190,8 @@ function updateStats2(results, state, isForEachIteration = false) {
 async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
   try {
     const { createExtendedLiquid: createExtendedLiquid2 } = await Promise.resolve().then(() => (init_liquid_extensions(), liquid_extensions_exports));
-    const fs25 = await import("fs/promises");
-    const path28 = await import("path");
+    const fs29 = await import("fs/promises");
+    const path33 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
     const schema = typeof schemaRaw === "string" && !schemaRaw.includes("{{") && !schemaRaw.includes("{%") ? schemaRaw : typeof schemaRaw === "object" ? "code-review" : "plain";
     let templateContent;
@@ -53072,27 +53200,27 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
       logger.debug(`[LevelDispatch] Using inline template for ${checkId}`);
     } else if (checkConfig.template && checkConfig.template.file) {
       const file = String(checkConfig.template.file);
-      const resolved = path28.resolve(process.cwd(), file);
-      templateContent = await fs25.readFile(resolved, "utf-8");
+      const resolved = path33.resolve(process.cwd(), file);
+      templateContent = await fs29.readFile(resolved, "utf-8");
       logger.debug(`[LevelDispatch] Using template file for ${checkId}: ${resolved}`);
     } else if (schema && schema !== "plain") {
       const sanitized = String(schema).replace(/[^a-zA-Z0-9-]/g, "");
       if (sanitized) {
         const candidatePaths = [
-          path28.join(__dirname, "output", sanitized, "template.liquid"),
+          path33.join(__dirname, "output", sanitized, "template.liquid"),
           // bundled: dist/output/
-          path28.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
+          path33.join(__dirname, "..", "..", "output", sanitized, "template.liquid"),
           // source (from state-machine/states)
-          path28.join(__dirname, "..", "..", "..", "output", sanitized, "template.liquid"),
+          path33.join(__dirname, "..", "..", "..", "output", sanitized, "template.liquid"),
           // source (alternate)
-          path28.join(process.cwd(), "output", sanitized, "template.liquid"),
+          path33.join(process.cwd(), "output", sanitized, "template.liquid"),
           // fallback: cwd/output/
-          path28.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
+          path33.join(process.cwd(), "dist", "output", sanitized, "template.liquid")
           // fallback: cwd/dist/output/
         ];
         for (const p of candidatePaths) {
           try {
-            templateContent = await fs25.readFile(p, "utf-8");
+            templateContent = await fs29.readFile(p, "utf-8");
             if (templateContent) {
               logger.debug(`[LevelDispatch] Using schema template for ${checkId}: ${p}`);
               break;
@@ -53699,16 +53827,16 @@ var init_runner = __esm({
 });
 
 // src/sandbox/docker-image-sandbox.ts
-var import_util2, import_child_process3, import_fs5, import_path9, import_os, import_crypto2, execFileAsync, EXEC_MAX_BUFFER, DockerImageSandbox;
+var import_util2, import_child_process3, import_fs5, import_path10, import_os, import_crypto3, execFileAsync, EXEC_MAX_BUFFER, DockerImageSandbox;
 var init_docker_image_sandbox = __esm({
   "src/sandbox/docker-image-sandbox.ts"() {
     "use strict";
     import_util2 = require("util");
     import_child_process3 = require("child_process");
     import_fs5 = require("fs");
-    import_path9 = require("path");
+    import_path10 = require("path");
     import_os = require("os");
-    import_crypto2 = require("crypto");
+    import_crypto3 = require("crypto");
     init_logger();
     init_sandbox_telemetry();
     execFileAsync = (0, import_util2.promisify)(import_child_process3.execFile);
@@ -53726,7 +53854,7 @@ var init_docker_image_sandbox = __esm({
         this.config = config;
         this.repoPath = repoPath;
         this.visorDistPath = visorDistPath;
-        this.containerName = `visor-${name}-${(0, import_crypto2.randomUUID)().slice(0, 8)}`;
+        this.containerName = `visor-${name}-${(0, import_crypto3.randomUUID)().slice(0, 8)}`;
         this.cacheVolumeMounts = cacheVolumeMounts;
       }
       /**
@@ -53751,8 +53879,8 @@ var init_docker_image_sandbox = __esm({
                   `Sandbox '${this.name}' has invalid dockerfile_inline: must contain a FROM instruction`
                 );
               }
-              const tmpDir = (0, import_fs5.mkdtempSync)((0, import_path9.join)((0, import_os.tmpdir)(), "visor-build-"));
-              const dockerfilePath = (0, import_path9.join)(tmpDir, "Dockerfile");
+              const tmpDir = (0, import_fs5.mkdtempSync)((0, import_path10.join)((0, import_os.tmpdir)(), "visor-build-"));
+              const dockerfilePath = (0, import_path10.join)(tmpDir, "Dockerfile");
               (0, import_fs5.writeFileSync)(dockerfilePath, this.config.dockerfile_inline, "utf8");
               try {
                 logger.info(`Building sandbox image '${imageName}' from inline Dockerfile`);
@@ -53820,7 +53948,7 @@ var init_docker_image_sandbox = __esm({
         }
         if (this.config.bind_paths) {
           for (const bp of this.config.bind_paths) {
-            const hostPath = bp.host.startsWith("~") ? (0, import_path9.resolve)((process.env.HOME || "/root") + bp.host.slice(1)) : (0, import_path9.resolve)(bp.host);
+            const hostPath = bp.host.startsWith("~") ? (0, import_path10.resolve)((process.env.HOME || "/root") + bp.host.slice(1)) : (0, import_path10.resolve)(bp.host);
             const containerPath = bp.container || hostPath;
             const readOnly = bp.read_only !== false;
             args.push("-v", `${hostPath}:${containerPath}${readOnly ? ":ro" : ""}`);
@@ -53891,13 +54019,13 @@ var init_docker_image_sandbox = __esm({
 });
 
 // src/sandbox/docker-compose-sandbox.ts
-var import_util3, import_child_process4, import_crypto3, execFileAsync2, EXEC_MAX_BUFFER2, DockerComposeSandbox;
+var import_util3, import_child_process4, import_crypto4, execFileAsync2, EXEC_MAX_BUFFER2, DockerComposeSandbox;
 var init_docker_compose_sandbox = __esm({
   "src/sandbox/docker-compose-sandbox.ts"() {
     "use strict";
     import_util3 = require("util");
     import_child_process4 = require("child_process");
-    import_crypto3 = require("crypto");
+    import_crypto4 = require("crypto");
     init_logger();
     execFileAsync2 = (0, import_util3.promisify)(import_child_process4.execFile);
     EXEC_MAX_BUFFER2 = 50 * 1024 * 1024;
@@ -53909,7 +54037,7 @@ var init_docker_compose_sandbox = __esm({
       constructor(name, config) {
         this.name = name;
         this.config = config;
-        this.projectName = `visor-${name}-${(0, import_crypto3.randomUUID)().slice(0, 8)}`;
+        this.projectName = `visor-${name}-${(0, import_crypto4.randomUUID)().slice(0, 8)}`;
       }
       /**
        * Start the compose services
@@ -54001,7 +54129,7 @@ var init_docker_compose_sandbox = __esm({
 
 // src/sandbox/cache-volume-manager.ts
 function pathHash(containerPath) {
-  return (0, import_crypto4.createHash)("sha256").update(containerPath).digest("hex").slice(0, 8);
+  return (0, import_crypto5.createHash)("sha256").update(containerPath).digest("hex").slice(0, 8);
 }
 function parseTtl(ttl) {
   let ms = 0;
@@ -54013,13 +54141,13 @@ function parseTtl(ttl) {
   if (minMatch) ms += parseInt(minMatch[1], 10) * 6e4;
   return ms || 6048e5;
 }
-var import_util4, import_child_process5, import_crypto4, execFileAsync3, EXEC_MAX_BUFFER3, CacheVolumeManager;
+var import_util4, import_child_process5, import_crypto5, execFileAsync3, EXEC_MAX_BUFFER3, CacheVolumeManager;
 var init_cache_volume_manager = __esm({
   "src/sandbox/cache-volume-manager.ts"() {
     "use strict";
     import_util4 = require("util");
     import_child_process5 = require("child_process");
-    import_crypto4 = require("crypto");
+    import_crypto5 = require("crypto");
     init_logger();
     execFileAsync3 = (0, import_util4.promisify)(import_child_process5.execFile);
     EXEC_MAX_BUFFER3 = 10 * 1024 * 1024;
@@ -54201,14 +54329,14 @@ var bubblewrap_sandbox_exports = {};
 __export(bubblewrap_sandbox_exports, {
   BubblewrapSandbox: () => BubblewrapSandbox
 });
-var import_util5, import_child_process6, import_fs6, import_path10, execFileAsync4, EXEC_MAX_BUFFER4, BubblewrapSandbox;
+var import_util5, import_child_process6, import_fs6, import_path11, execFileAsync4, EXEC_MAX_BUFFER4, BubblewrapSandbox;
 var init_bubblewrap_sandbox = __esm({
   "src/sandbox/bubblewrap-sandbox.ts"() {
     "use strict";
     import_util5 = require("util");
     import_child_process6 = require("child_process");
     import_fs6 = require("fs");
-    import_path10 = require("path");
+    import_path11 = require("path");
     init_logger();
     init_sandbox_telemetry();
     execFileAsync4 = (0, import_util5.promisify)(import_child_process6.execFile);
@@ -54221,8 +54349,8 @@ var init_bubblewrap_sandbox = __esm({
       constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
-        this.repoPath = (0, import_path10.resolve)(repoPath);
-        this.visorDistPath = (0, import_path10.resolve)(visorDistPath);
+        this.repoPath = (0, import_path11.resolve)(repoPath);
+        this.visorDistPath = (0, import_path11.resolve)(visorDistPath);
       }
       /**
        * Check if bwrap binary is available on the system.
@@ -54307,7 +54435,7 @@ var init_bubblewrap_sandbox = __esm({
         args.push("--ro-bind", this.visorDistPath, visorPath);
         if (this.config.bind_paths) {
           for (const bp of this.config.bind_paths) {
-            const hostPath = bp.host.startsWith("~") ? (0, import_path10.resolve)((process.env.HOME || "/root") + bp.host.slice(1)) : (0, import_path10.resolve)(bp.host);
+            const hostPath = bp.host.startsWith("~") ? (0, import_path11.resolve)((process.env.HOME || "/root") + bp.host.slice(1)) : (0, import_path11.resolve)(bp.host);
             const containerPath = bp.container || hostPath;
             const readOnly = bp.read_only !== false;
             args.push(readOnly ? "--ro-bind" : "--bind", hostPath, containerPath);
@@ -54338,13 +54466,13 @@ var seatbelt_sandbox_exports = {};
 __export(seatbelt_sandbox_exports, {
   SeatbeltSandbox: () => SeatbeltSandbox
 });
-var import_util6, import_child_process7, import_path11, import_fs7, execFileAsync5, EXEC_MAX_BUFFER5, SeatbeltSandbox;
+var import_util6, import_child_process7, import_path12, import_fs7, execFileAsync5, EXEC_MAX_BUFFER5, SeatbeltSandbox;
 var init_seatbelt_sandbox = __esm({
   "src/sandbox/seatbelt-sandbox.ts"() {
     "use strict";
     import_util6 = require("util");
     import_child_process7 = require("child_process");
-    import_path11 = require("path");
+    import_path12 = require("path");
     import_fs7 = require("fs");
     init_logger();
     init_sandbox_telemetry();
@@ -54358,8 +54486,8 @@ var init_seatbelt_sandbox = __esm({
       constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
-        this.repoPath = (0, import_fs7.realpathSync)((0, import_path11.resolve)(repoPath));
-        this.visorDistPath = (0, import_fs7.realpathSync)((0, import_path11.resolve)(visorDistPath));
+        this.repoPath = (0, import_fs7.realpathSync)((0, import_path12.resolve)(repoPath));
+        this.visorDistPath = (0, import_fs7.realpathSync)((0, import_path12.resolve)(visorDistPath));
       }
       /**
        * Check if sandbox-exec binary is available on the system.
@@ -54464,7 +54592,7 @@ var init_seatbelt_sandbox = __esm({
         lines.push(`(allow file-read* (subpath "${visorDistPath}"))`);
         if (this.config.bind_paths) {
           for (const bp of this.config.bind_paths) {
-            const hostPath = bp.host.startsWith("~") ? (0, import_path11.resolve)((process.env.HOME || "/root") + bp.host.slice(1)) : (0, import_path11.resolve)(bp.host);
+            const hostPath = bp.host.startsWith("~") ? (0, import_path12.resolve)((process.env.HOME || "/root") + bp.host.slice(1)) : (0, import_path12.resolve)(bp.host);
             const escapedPath = this.escapePath(hostPath);
             lines.push(`(allow file-read* (subpath "${escapedPath}"))`);
             if (bp.read_only === false) {
@@ -54485,11 +54613,11 @@ var init_seatbelt_sandbox = __esm({
 });
 
 // src/sandbox/sandbox-manager.ts
-var import_path12, import_fs8, SandboxManager;
+var import_path13, import_fs8, SandboxManager;
 var init_sandbox_manager = __esm({
   "src/sandbox/sandbox-manager.ts"() {
     "use strict";
-    import_path12 = require("path");
+    import_path13 = require("path");
     import_fs8 = require("fs");
     init_docker_image_sandbox();
     init_docker_compose_sandbox();
@@ -54509,10 +54637,10 @@ var init_sandbox_manager = __esm({
       }
       constructor(sandboxDefs, repoPath, gitBranch) {
         this.sandboxDefs = sandboxDefs;
-        this.repoPath = (0, import_path12.resolve)(repoPath);
+        this.repoPath = (0, import_path13.resolve)(repoPath);
         this.gitBranch = gitBranch;
         this.cacheManager = new CacheVolumeManager();
-        this.visorDistPath = (0, import_fs8.existsSync)((0, import_path12.join)(__dirname, "index.js")) ? __dirname : (0, import_path12.resolve)((0, import_path12.dirname)(__dirname));
+        this.visorDistPath = (0, import_fs8.existsSync)((0, import_path13.join)(__dirname, "index.js")) ? __dirname : (0, import_path13.resolve)((0, import_path13.dirname)(__dirname));
       }
       /**
        * Resolve which sandbox a check should use.
@@ -54641,13 +54769,13 @@ var init_sandbox_manager = __esm({
 });
 
 // src/utils/file-exclusion.ts
-var import_ignore, fs19, path22, DEFAULT_EXCLUSION_PATTERNS, FileExclusionHelper;
+var import_ignore, fs19, path23, DEFAULT_EXCLUSION_PATTERNS, FileExclusionHelper;
 var init_file_exclusion = __esm({
   "src/utils/file-exclusion.ts"() {
     "use strict";
     import_ignore = __toESM(require("ignore"));
     fs19 = __toESM(require("fs"));
-    path22 = __toESM(require("path"));
+    path23 = __toESM(require("path"));
     DEFAULT_EXCLUSION_PATTERNS = [
       "dist/",
       "build/",
@@ -54666,7 +54794,7 @@ var init_file_exclusion = __esm({
        * @param additionalPatterns - Additional patterns to include (optional, defaults to common build artifacts)
        */
       constructor(workingDirectory = process.cwd(), additionalPatterns = DEFAULT_EXCLUSION_PATTERNS) {
-        const normalizedPath = path22.resolve(workingDirectory);
+        const normalizedPath = path23.resolve(workingDirectory);
         if (normalizedPath.includes("\0")) {
           throw new Error("Invalid workingDirectory: contains null bytes");
         }
@@ -54678,11 +54806,11 @@ var init_file_exclusion = __esm({
        * @param additionalPatterns - Additional patterns to add to gitignore rules
        */
       loadGitignore(additionalPatterns) {
-        const gitignorePath = path22.resolve(this.workingDirectory, ".gitignore");
-        const resolvedWorkingDir = path22.resolve(this.workingDirectory);
+        const gitignorePath = path23.resolve(this.workingDirectory, ".gitignore");
+        const resolvedWorkingDir = path23.resolve(this.workingDirectory);
         try {
-          const relativePath = path22.relative(resolvedWorkingDir, gitignorePath);
-          if (relativePath.startsWith("..") || path22.isAbsolute(relativePath)) {
+          const relativePath = path23.relative(resolvedWorkingDir, gitignorePath);
+          if (relativePath.startsWith("..") || path23.isAbsolute(relativePath)) {
             throw new Error("Invalid gitignore path: path traversal detected");
           }
           if (relativePath !== ".gitignore") {
@@ -54725,12 +54853,12 @@ var git_repository_analyzer_exports = {};
 __export(git_repository_analyzer_exports, {
   GitRepositoryAnalyzer: () => GitRepositoryAnalyzer
 });
-var import_simple_git2, path23, fs20, MAX_PATCH_SIZE, GitRepositoryAnalyzer;
+var import_simple_git2, path24, fs20, MAX_PATCH_SIZE, GitRepositoryAnalyzer;
 var init_git_repository_analyzer = __esm({
   "src/git-repository-analyzer.ts"() {
     "use strict";
     import_simple_git2 = require("simple-git");
-    path23 = __toESM(require("path"));
+    path24 = __toESM(require("path"));
     fs20 = __toESM(require("fs"));
     init_file_exclusion();
     MAX_PATCH_SIZE = 50 * 1024;
@@ -54920,7 +55048,7 @@ ${file.patch}`).join("\n\n");
               console.error(`\u23ED\uFE0F  Skipping excluded file: ${file}`);
               continue;
             }
-            const filePath = path23.join(this.cwd, file);
+            const filePath = path24.join(this.cwd, file);
             const fileChange = await this.analyzeFileChange(file, status2, filePath, includeContext);
             changes.push(fileChange);
           }
@@ -55146,12 +55274,12 @@ function shellEscape(str) {
 function sanitizePathComponent(name) {
   return name.replace(/\.\./g, "").replace(/[\/\\]/g, "-").replace(/^\.+/, "").trim() || "unnamed";
 }
-var fsp2, path24, WorkspaceManager;
+var fsp2, path25, WorkspaceManager;
 var init_workspace_manager = __esm({
   "src/utils/workspace-manager.ts"() {
     "use strict";
     fsp2 = __toESM(require("fs/promises"));
-    path24 = __toESM(require("path"));
+    path25 = __toESM(require("path"));
     init_command_executor();
     init_logger();
     WorkspaceManager = class _WorkspaceManager {
@@ -55185,7 +55313,7 @@ var init_workspace_manager = __esm({
         };
         this.basePath = this.config.basePath;
         const workspaceDirName = sanitizePathComponent(this.config.name || this.sessionId);
-        this.workspacePath = path24.join(this.basePath, workspaceDirName);
+        this.workspacePath = path25.join(this.basePath, workspaceDirName);
       }
       /**
        * Get or create a WorkspaceManager instance for a session
@@ -55232,8 +55360,8 @@ var init_workspace_manager = __esm({
         );
         if (this.cleanupRequested && this.activeOperations === 0) {
           logger.debug(`[Workspace] All references released, proceeding with deferred cleanup`);
-          for (const resolve15 of this.cleanupResolvers) {
-            resolve15();
+          for (const resolve19 of this.cleanupResolvers) {
+            resolve19();
           }
           this.cleanupResolvers = [];
         }
@@ -55280,7 +55408,7 @@ var init_workspace_manager = __esm({
           configuredMainProjectName || this.extractProjectName(this.originalPath)
         );
         this.usedNames.add(mainProjectName);
-        const mainProjectPath = path24.join(this.workspacePath, mainProjectName);
+        const mainProjectPath = path25.join(this.workspacePath, mainProjectName);
         const isGitRepo = await this.isGitRepository(this.originalPath);
         if (isGitRepo) {
           const exists = await this.pathExists(mainProjectPath);
@@ -55366,7 +55494,7 @@ var init_workspace_manager = __esm({
         let projectName = sanitizePathComponent(description || this.extractRepoName(repository));
         projectName = this.getUniqueName(projectName);
         this.usedNames.add(projectName);
-        const workspacePath = path24.join(this.workspacePath, projectName);
+        const workspacePath = path25.join(this.workspacePath, projectName);
         await fsp2.rm(workspacePath, { recursive: true, force: true });
         try {
           await fsp2.symlink(worktreePath, workspacePath);
@@ -55412,19 +55540,19 @@ var init_workspace_manager = __esm({
           );
           this.cleanupRequested = true;
           await Promise.race([
-            new Promise((resolve15) => {
+            new Promise((resolve19) => {
               if (this.activeOperations === 0) {
-                resolve15();
+                resolve19();
               } else {
-                this.cleanupResolvers.push(resolve15);
+                this.cleanupResolvers.push(resolve19);
               }
             }),
-            new Promise((resolve15) => {
+            new Promise((resolve19) => {
               setTimeout(() => {
                 logger.warn(
                   `[Workspace] Cleanup timeout after ${timeout}ms, proceeding anyway (${this.activeOperations} operations still active)`
                 );
-                resolve15();
+                resolve19();
               }, timeout);
             })
           ]);
@@ -55476,7 +55604,7 @@ var init_workspace_manager = __esm({
           const now = Date.now();
           for (const entry of entries) {
             if (!entry.isDirectory()) continue;
-            const dirPath = path24.join(basePath, entry.name);
+            const dirPath = path25.join(basePath, entry.name);
             try {
               const stat2 = await fsp2.stat(dirPath);
               if (now - stat2.mtimeMs > maxAgeMs) {
@@ -55484,8 +55612,8 @@ var init_workspace_manager = __esm({
                   const subdirs = await fsp2.readdir(dirPath, { withFileTypes: true });
                   for (const sub of subdirs) {
                     if (!sub.isDirectory()) continue;
-                    const subPath = path24.join(dirPath, sub.name);
-                    const gitFilePath = path24.join(subPath, ".git");
+                    const subPath = path25.join(dirPath, sub.name);
+                    const gitFilePath = path25.join(subPath, ".git");
                     try {
                       const gitContent = await fsp2.readFile(gitFilePath, "utf-8");
                       const match = gitContent.match(/gitdir:\s*(.+)/);
@@ -55710,7 +55838,7 @@ var init_workspace_manager = __esm({
        * Extract project name from path
        */
       extractProjectName(dirPath) {
-        return path24.basename(dirPath);
+        return path25.basename(dirPath);
       }
       /**
        * Extract repository name from owner/repo format
@@ -55818,8 +55946,8 @@ var init_fair_concurrency_limiter = __esm({
         );
         const queuedAt = Date.now();
         const effectiveTimeout = queueTimeout ?? 12e4;
-        return new Promise((resolve15, reject) => {
-          const entry = { resolve: resolve15, reject, queuedAt };
+        return new Promise((resolve19, reject) => {
+          const entry = { resolve: resolve19, reject, queuedAt };
           entry.reminder = setInterval(() => {
             const waited = Math.round((Date.now() - queuedAt) / 1e3);
             const curQueued = this._totalQueued();
@@ -56126,6 +56254,1380 @@ var init_build_engine_context = __esm({
   }
 });
 
+// src/policy/default-engine.ts
+var DefaultPolicyEngine;
+var init_default_engine = __esm({
+  "src/policy/default-engine.ts"() {
+    "use strict";
+    DefaultPolicyEngine = class {
+      async initialize(_config) {
+      }
+      async evaluateCheckExecution(_checkId, _checkConfig) {
+        return { allowed: true };
+      }
+      async evaluateToolInvocation(_serverName, _methodName, _transport) {
+        return { allowed: true };
+      }
+      async evaluateCapabilities(_checkId, _capabilities) {
+        return { allowed: true };
+      }
+      async shutdown() {
+      }
+    };
+  }
+});
+
+// src/enterprise/license/validator.ts
+var validator_exports = {};
+__export(validator_exports, {
+  LicenseValidator: () => LicenseValidator
+});
+var crypto3, fs21, path26, LicenseValidator;
+var init_validator = __esm({
+  "src/enterprise/license/validator.ts"() {
+    "use strict";
+    crypto3 = __toESM(require("crypto"));
+    fs21 = __toESM(require("fs"));
+    path26 = __toESM(require("path"));
+    LicenseValidator = class _LicenseValidator {
+      /** Ed25519 public key for license verification (PEM format). */
+      static PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAI/Zd08EFmgIdrDm/HXd0l3/5GBt7R1PrdvhdmEXhJlU=\n-----END PUBLIC KEY-----\n";
+      cache = null;
+      static CACHE_TTL = 5 * 60 * 1e3;
+      // 5 minutes
+      static GRACE_PERIOD = 72 * 3600 * 1e3;
+      // 72 hours after expiry
+      /**
+       * Load and validate license from environment or file.
+       *
+       * Resolution order:
+       * 1. VISOR_LICENSE env var (JWT string)
+       * 2. VISOR_LICENSE_FILE env var (path to file)
+       * 3. .visor-license in project root (cwd)
+       * 4. .visor-license in ~/.config/visor/
+       */
+      async loadAndValidate() {
+        if (this.cache && Date.now() - this.cache.validatedAt < _LicenseValidator.CACHE_TTL) {
+          return this.cache.payload;
+        }
+        const token = this.resolveToken();
+        if (!token) return null;
+        const payload = this.verifyAndDecode(token);
+        if (!payload) return null;
+        this.cache = { payload, validatedAt: Date.now() };
+        return payload;
+      }
+      /** Check if a specific feature is licensed */
+      hasFeature(feature) {
+        if (!this.cache) return false;
+        return this.cache.payload.features.includes(feature);
+      }
+      /** Check if license is valid (with grace period) */
+      isValid() {
+        if (!this.cache) return false;
+        const now = Date.now();
+        const expiryMs = this.cache.payload.exp * 1e3;
+        return now < expiryMs + _LicenseValidator.GRACE_PERIOD;
+      }
+      /** Check if the license is within its grace period (expired but still valid) */
+      isInGracePeriod() {
+        if (!this.cache) return false;
+        const now = Date.now();
+        const expiryMs = this.cache.payload.exp * 1e3;
+        return now >= expiryMs && now < expiryMs + _LicenseValidator.GRACE_PERIOD;
+      }
+      resolveToken() {
+        if (process.env.VISOR_LICENSE) {
+          return process.env.VISOR_LICENSE.trim();
+        }
+        if (process.env.VISOR_LICENSE_FILE) {
+          const resolved = path26.resolve(process.env.VISOR_LICENSE_FILE);
+          const home2 = process.env.HOME || process.env.USERPROFILE || "";
+          const allowedPrefixes = [path26.normalize(process.cwd())];
+          if (home2) allowedPrefixes.push(path26.normalize(path26.join(home2, ".config", "visor")));
+          let realPath;
+          try {
+            realPath = fs21.realpathSync(resolved);
+          } catch {
+            return null;
+          }
+          const isSafe = allowedPrefixes.some(
+            (prefix) => realPath === prefix || realPath.startsWith(prefix + path26.sep)
+          );
+          if (!isSafe) return null;
+          return this.readFile(realPath);
+        }
+        const cwdPath = path26.join(process.cwd(), ".visor-license");
+        const cwdToken = this.readFile(cwdPath);
+        if (cwdToken) return cwdToken;
+        const home = process.env.HOME || process.env.USERPROFILE || "";
+        if (home) {
+          const configPath = path26.join(home, ".config", "visor", ".visor-license");
+          const configToken = this.readFile(configPath);
+          if (configToken) return configToken;
+        }
+        return null;
+      }
+      readFile(filePath) {
+        try {
+          return fs21.readFileSync(filePath, "utf-8").trim();
+        } catch {
+          return null;
+        }
+      }
+      verifyAndDecode(token) {
+        try {
+          const parts = token.split(".");
+          if (parts.length !== 3) return null;
+          const [headerB64, payloadB64, signatureB64] = parts;
+          const header = JSON.parse(Buffer.from(headerB64, "base64url").toString());
+          if (header.alg !== "EdDSA") return null;
+          const data = `${headerB64}.${payloadB64}`;
+          const signature = Buffer.from(signatureB64, "base64url");
+          const publicKey = crypto3.createPublicKey(_LicenseValidator.PUBLIC_KEY);
+          if (publicKey.asymmetricKeyType !== "ed25519") {
+            return null;
+          }
+          const isValid = crypto3.verify(null, Buffer.from(data), publicKey, signature);
+          if (!isValid) return null;
+          const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+          if (!payload.org || !Array.isArray(payload.features) || typeof payload.exp !== "number" || typeof payload.iat !== "number" || !payload.sub) {
+            return null;
+          }
+          const now = Date.now();
+          const expiryMs = payload.exp * 1e3;
+          if (now >= expiryMs + _LicenseValidator.GRACE_PERIOD) {
+            return null;
+          }
+          return payload;
+        } catch {
+          return null;
+        }
+      }
+    };
+  }
+});
+
+// src/enterprise/policy/opa-compiler.ts
+var fs22, path27, os2, crypto4, import_child_process8, OpaCompiler;
+var init_opa_compiler = __esm({
+  "src/enterprise/policy/opa-compiler.ts"() {
+    "use strict";
+    fs22 = __toESM(require("fs"));
+    path27 = __toESM(require("path"));
+    os2 = __toESM(require("os"));
+    crypto4 = __toESM(require("crypto"));
+    import_child_process8 = require("child_process");
+    OpaCompiler = class _OpaCompiler {
+      static CACHE_DIR = path27.join(os2.tmpdir(), "visor-opa-cache");
+      /**
+       * Resolve the input paths to WASM bytes.
+       *
+       * Strategy:
+       * 1. If any path is a .wasm file, read it directly
+       * 2. If a directory contains policy.wasm, read it
+       * 3. Otherwise, collect all .rego files and auto-compile via `opa build`
+       */
+      async resolveWasmBytes(paths) {
+        const regoFiles = [];
+        for (const p of paths) {
+          const resolved = path27.resolve(p);
+          if (path27.normalize(resolved).includes("..")) {
+            throw new Error(`Policy path contains traversal sequences: ${p}`);
+          }
+          if (resolved.endsWith(".wasm") && fs22.existsSync(resolved)) {
+            return fs22.readFileSync(resolved);
+          }
+          if (!fs22.existsSync(resolved)) continue;
+          const stat2 = fs22.statSync(resolved);
+          if (stat2.isDirectory()) {
+            const wasmCandidate = path27.join(resolved, "policy.wasm");
+            if (fs22.existsSync(wasmCandidate)) {
+              return fs22.readFileSync(wasmCandidate);
+            }
+            const files = fs22.readdirSync(resolved);
+            for (const f of files) {
+              if (f.endsWith(".rego")) {
+                regoFiles.push(path27.join(resolved, f));
+              }
+            }
+          } else if (resolved.endsWith(".rego")) {
+            regoFiles.push(resolved);
+          }
+        }
+        if (regoFiles.length === 0) {
+          throw new Error(
+            `OPA WASM evaluator: no .wasm bundle or .rego files found in: ${paths.join(", ")}`
+          );
+        }
+        return this.compileRego(regoFiles);
+      }
+      /**
+       * Auto-compile .rego files to a WASM bundle using the `opa` CLI.
+       *
+       * Caches the compiled bundle based on a content hash of all input .rego files
+       * so subsequent runs skip compilation if policies haven't changed.
+       */
+      compileRego(regoFiles) {
+        try {
+          (0, import_child_process8.execFileSync)("opa", ["version"], { stdio: "pipe" });
+        } catch {
+          throw new Error(
+            "OPA CLI (`opa`) not found on PATH. Install it from https://www.openpolicyagent.org/docs/latest/#running-opa\nOr pre-compile your .rego files: opa build -t wasm -e visor -o bundle.tar.gz " + regoFiles.join(" ")
+          );
+        }
+        const hash = crypto4.createHash("sha256");
+        for (const f of regoFiles.sort()) {
+          hash.update(fs22.readFileSync(f));
+          hash.update(f);
+        }
+        const cacheKey = hash.digest("hex").slice(0, 16);
+        const cacheDir = _OpaCompiler.CACHE_DIR;
+        const cachedWasm = path27.join(cacheDir, `${cacheKey}.wasm`);
+        if (fs22.existsSync(cachedWasm)) {
+          return fs22.readFileSync(cachedWasm);
+        }
+        fs22.mkdirSync(cacheDir, { recursive: true });
+        const bundleTar = path27.join(cacheDir, `${cacheKey}-bundle.tar.gz`);
+        try {
+          const args = [
+            "build",
+            "-t",
+            "wasm",
+            "-e",
+            "visor",
+            // entrypoint: the visor package tree
+            "-o",
+            bundleTar,
+            ...regoFiles
+          ];
+          (0, import_child_process8.execFileSync)("opa", args, {
+            stdio: "pipe",
+            timeout: 3e4
+          });
+        } catch (err) {
+          const stderr = err?.stderr?.toString() || "";
+          throw new Error(
+            `Failed to compile .rego files to WASM:
+${stderr}
+Ensure your .rego files are valid and the \`opa\` CLI is installed.`
+          );
+        }
+        try {
+          (0, import_child_process8.execFileSync)("tar", ["-xzf", bundleTar, "-C", cacheDir, "/policy.wasm"], {
+            stdio: "pipe"
+          });
+          const extractedWasm = path27.join(cacheDir, "policy.wasm");
+          if (fs22.existsSync(extractedWasm)) {
+            fs22.renameSync(extractedWasm, cachedWasm);
+          }
+        } catch {
+          try {
+            (0, import_child_process8.execFileSync)("tar", ["-xzf", bundleTar, "-C", cacheDir, "policy.wasm"], {
+              stdio: "pipe"
+            });
+            const extractedWasm = path27.join(cacheDir, "policy.wasm");
+            if (fs22.existsSync(extractedWasm)) {
+              fs22.renameSync(extractedWasm, cachedWasm);
+            }
+          } catch (err2) {
+            throw new Error(`Failed to extract policy.wasm from OPA bundle: ${err2?.message || err2}`);
+          }
+        }
+        try {
+          fs22.unlinkSync(bundleTar);
+        } catch {
+        }
+        if (!fs22.existsSync(cachedWasm)) {
+          throw new Error("OPA build succeeded but policy.wasm was not found in the bundle");
+        }
+        return fs22.readFileSync(cachedWasm);
+      }
+    };
+  }
+});
+
+// src/enterprise/policy/opa-wasm-evaluator.ts
+var fs23, path28, OpaWasmEvaluator;
+var init_opa_wasm_evaluator = __esm({
+  "src/enterprise/policy/opa-wasm-evaluator.ts"() {
+    "use strict";
+    fs23 = __toESM(require("fs"));
+    path28 = __toESM(require("path"));
+    init_opa_compiler();
+    OpaWasmEvaluator = class {
+      policy = null;
+      dataDocument = {};
+      compiler = new OpaCompiler();
+      async initialize(rulesPath) {
+        const paths = Array.isArray(rulesPath) ? rulesPath : [rulesPath];
+        const wasmBytes = await this.compiler.resolveWasmBytes(paths);
+        try {
+          const { createRequire } = require("module");
+          const runtimeRequire = createRequire(__filename);
+          const opaWasm = runtimeRequire("@open-policy-agent/opa-wasm");
+          const loadPolicy = opaWasm.loadPolicy || opaWasm.default?.loadPolicy;
+          if (!loadPolicy) {
+            throw new Error("loadPolicy not found in @open-policy-agent/opa-wasm");
+          }
+          this.policy = await loadPolicy(wasmBytes);
+        } catch (err) {
+          if (err?.code === "MODULE_NOT_FOUND" || err?.code === "ERR_MODULE_NOT_FOUND") {
+            throw new Error(
+              "OPA WASM evaluator requires @open-policy-agent/opa-wasm. Install it with: npm install @open-policy-agent/opa-wasm"
+            );
+          }
+          throw err;
+        }
+      }
+      /**
+       * Load external data from a JSON file to use as the OPA data document.
+       * The loaded data will be passed to `policy.setData()` during evaluation,
+       * making it available in Rego via `data.<key>`.
+       */
+      loadData(dataPath) {
+        const resolved = path28.resolve(dataPath);
+        if (path28.normalize(resolved).includes("..")) {
+          throw new Error(`Data path contains traversal sequences: ${dataPath}`);
+        }
+        if (!fs23.existsSync(resolved)) {
+          throw new Error(`OPA data file not found: ${resolved}`);
+        }
+        const stat2 = fs23.statSync(resolved);
+        if (stat2.size > 10 * 1024 * 1024) {
+          throw new Error(`OPA data file exceeds 10MB limit: ${resolved} (${stat2.size} bytes)`);
+        }
+        const raw = fs23.readFileSync(resolved, "utf-8");
+        try {
+          const parsed = JSON.parse(raw);
+          if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("OPA data file must contain a JSON object (not an array or primitive)");
+          }
+          this.dataDocument = parsed;
+        } catch (err) {
+          if (err.message.startsWith("OPA data file must")) {
+            throw err;
+          }
+          throw new Error(`Failed to parse OPA data file ${resolved}: ${err.message}`);
+        }
+      }
+      async evaluate(input) {
+        if (!this.policy) {
+          throw new Error("OPA WASM evaluator not initialized");
+        }
+        this.policy.setData(this.dataDocument);
+        const resultSet = this.policy.evaluate(input);
+        if (Array.isArray(resultSet) && resultSet.length > 0) {
+          return resultSet[0].result;
+        }
+        return void 0;
+      }
+      async shutdown() {
+        if (this.policy) {
+          if (typeof this.policy.close === "function") {
+            try {
+              this.policy.close();
+            } catch {
+            }
+          } else if (typeof this.policy.free === "function") {
+            try {
+              this.policy.free();
+            } catch {
+            }
+          }
+        }
+        this.policy = null;
+      }
+    };
+  }
+});
+
+// src/enterprise/policy/opa-http-evaluator.ts
+var OpaHttpEvaluator;
+var init_opa_http_evaluator = __esm({
+  "src/enterprise/policy/opa-http-evaluator.ts"() {
+    "use strict";
+    OpaHttpEvaluator = class {
+      baseUrl;
+      timeout;
+      constructor(baseUrl, timeout = 5e3) {
+        let parsed;
+        try {
+          parsed = new URL(baseUrl);
+        } catch {
+          throw new Error(`OPA HTTP evaluator: invalid URL: ${baseUrl}`);
+        }
+        if (!["http:", "https:"].includes(parsed.protocol)) {
+          throw new Error(
+            `OPA HTTP evaluator: url must use http:// or https:// protocol, got: ${baseUrl}`
+          );
+        }
+        const hostname = parsed.hostname;
+        if (this.isBlockedHostname(hostname)) {
+          throw new Error(
+            `OPA HTTP evaluator: url must not point to internal, loopback, or private network addresses`
+          );
+        }
+        this.baseUrl = baseUrl.replace(/\/+$/, "");
+        this.timeout = timeout;
+      }
+      /**
+       * Check if a hostname is blocked due to SSRF concerns.
+       *
+       * Blocks:
+       * - Loopback addresses (127.x.x.x, localhost, 0.0.0.0, ::1)
+       * - Link-local addresses (169.254.x.x)
+       * - Private networks (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
+       * - IPv6 unique local addresses (fd00::/8)
+       * - Cloud metadata services (*.internal)
+       */
+      isBlockedHostname(hostname) {
+        if (!hostname) return true;
+        const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        if (normalized === "metadata.google.internal" || normalized.endsWith(".internal")) {
+          return true;
+        }
+        if (normalized === "localhost" || normalized === "localhost.localdomain") {
+          return true;
+        }
+        if (normalized === "::1" || normalized === "0:0:0:0:0:0:0:1") {
+          return true;
+        }
+        const ipv4Pattern = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+        const ipv4Match = normalized.match(ipv4Pattern);
+        if (ipv4Match) {
+          const octets = ipv4Match.slice(1, 5).map(Number);
+          if (octets.some((octet) => octet > 255)) {
+            return false;
+          }
+          const [a, b] = octets;
+          if (a === 127) {
+            return true;
+          }
+          if (a === 0) {
+            return true;
+          }
+          if (a === 169 && b === 254) {
+            return true;
+          }
+          if (a === 10) {
+            return true;
+          }
+          if (a === 172 && b >= 16 && b <= 31) {
+            return true;
+          }
+          if (a === 192 && b === 168) {
+            return true;
+          }
+        }
+        if (normalized.startsWith("fd") || normalized.startsWith("fc")) {
+          return true;
+        }
+        if (normalized.startsWith("fe80:")) {
+          return true;
+        }
+        return false;
+      }
+      /**
+       * Evaluate a policy rule against an input document via OPA REST API.
+       *
+       * @param input - The input document to evaluate
+       * @param rulePath - OPA rule path (e.g., 'visor/check/execute')
+       * @returns The result object from OPA, or undefined on error
+       */
+      async evaluate(input, rulePath) {
+        const encodedPath = rulePath.split("/").map((s) => encodeURIComponent(s)).join("/");
+        const url = `${this.baseUrl}/v1/data/${encodedPath}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        try {
+          const response = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ input }),
+            signal: controller.signal
+          });
+          if (!response.ok) {
+            throw new Error(`OPA HTTP ${response.status}: ${response.statusText}`);
+          }
+          let body;
+          try {
+            body = await response.json();
+          } catch (jsonErr) {
+            throw new Error(
+              `OPA HTTP evaluator: failed to parse JSON response: ${jsonErr instanceof Error ? jsonErr.message : String(jsonErr)}`
+            );
+          }
+          return body?.result;
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      async shutdown() {
+      }
+    };
+  }
+});
+
+// src/enterprise/policy/policy-input-builder.ts
+var PolicyInputBuilder;
+var init_policy_input_builder = __esm({
+  "src/enterprise/policy/policy-input-builder.ts"() {
+    "use strict";
+    PolicyInputBuilder = class {
+      roles;
+      actor;
+      repository;
+      pullRequest;
+      constructor(policyConfig, actor, repository, pullRequest) {
+        this.roles = policyConfig.roles || {};
+        this.actor = actor;
+        this.repository = repository;
+        this.pullRequest = pullRequest;
+      }
+      /** Resolve which roles apply to the current actor. */
+      resolveRoles() {
+        const matched = [];
+        for (const [roleName, roleConfig] of Object.entries(this.roles)) {
+          let identityMatch = false;
+          if (roleConfig.author_association && this.actor.authorAssociation && roleConfig.author_association.includes(this.actor.authorAssociation)) {
+            identityMatch = true;
+          }
+          if (!identityMatch && roleConfig.users && this.actor.login && roleConfig.users.includes(this.actor.login)) {
+            identityMatch = true;
+          }
+          if (!identityMatch && roleConfig.slack_users && this.actor.slack?.userId && roleConfig.slack_users.includes(this.actor.slack.userId)) {
+            identityMatch = true;
+          }
+          if (!identityMatch && roleConfig.emails && this.actor.slack?.email) {
+            const actorEmail = this.actor.slack.email.toLowerCase();
+            if (roleConfig.emails.some((e) => e.toLowerCase() === actorEmail)) {
+              identityMatch = true;
+            }
+          }
+          if (!identityMatch) continue;
+          if (roleConfig.slack_channels && roleConfig.slack_channels.length > 0) {
+            if (!this.actor.slack?.channelId || !roleConfig.slack_channels.includes(this.actor.slack.channelId)) {
+              continue;
+            }
+          }
+          matched.push(roleName);
+        }
+        return matched;
+      }
+      buildActor() {
+        return {
+          authorAssociation: this.actor.authorAssociation,
+          login: this.actor.login,
+          roles: this.resolveRoles(),
+          isLocalMode: this.actor.isLocalMode,
+          ...this.actor.slack && { slack: this.actor.slack }
+        };
+      }
+      forCheckExecution(check) {
+        return {
+          scope: "check.execute",
+          check: {
+            id: check.id,
+            type: check.type,
+            group: check.group,
+            tags: check.tags,
+            criticality: check.criticality,
+            sandbox: check.sandbox,
+            policy: check.policy
+          },
+          actor: this.buildActor(),
+          repository: this.repository,
+          pullRequest: this.pullRequest
+        };
+      }
+      forToolInvocation(serverName, methodName, transport) {
+        return {
+          scope: "tool.invoke",
+          tool: { serverName, methodName, transport },
+          actor: this.buildActor(),
+          repository: this.repository,
+          pullRequest: this.pullRequest
+        };
+      }
+      forCapabilityResolve(checkId, capabilities) {
+        return {
+          scope: "capability.resolve",
+          check: { id: checkId, type: "ai" },
+          capability: capabilities,
+          actor: this.buildActor(),
+          repository: this.repository,
+          pullRequest: this.pullRequest
+        };
+      }
+    };
+  }
+});
+
+// src/enterprise/policy/opa-policy-engine.ts
+var opa_policy_engine_exports = {};
+__export(opa_policy_engine_exports, {
+  OpaPolicyEngine: () => OpaPolicyEngine
+});
+var OpaPolicyEngine;
+var init_opa_policy_engine = __esm({
+  "src/enterprise/policy/opa-policy-engine.ts"() {
+    "use strict";
+    init_opa_wasm_evaluator();
+    init_opa_http_evaluator();
+    init_policy_input_builder();
+    OpaPolicyEngine = class {
+      evaluator = null;
+      fallback;
+      timeout;
+      config;
+      inputBuilder = null;
+      logger = null;
+      constructor(config) {
+        this.config = config;
+        this.fallback = config.fallback || "deny";
+        this.timeout = config.timeout || 5e3;
+      }
+      async initialize(config) {
+        try {
+          this.logger = (init_logger(), __toCommonJS(logger_exports)).logger;
+        } catch {
+        }
+        const actor = {
+          authorAssociation: process.env.VISOR_AUTHOR_ASSOCIATION,
+          login: process.env.VISOR_AUTHOR_LOGIN || process.env.GITHUB_ACTOR,
+          isLocalMode: !process.env.GITHUB_ACTIONS
+        };
+        const repo = {
+          owner: process.env.GITHUB_REPOSITORY_OWNER,
+          name: process.env.GITHUB_REPOSITORY?.split("/")[1],
+          branch: process.env.GITHUB_HEAD_REF,
+          baseBranch: process.env.GITHUB_BASE_REF,
+          event: process.env.GITHUB_EVENT_NAME
+        };
+        const prNum = process.env.GITHUB_PR_NUMBER ? parseInt(process.env.GITHUB_PR_NUMBER, 10) : void 0;
+        const pullRequest = {
+          number: prNum !== void 0 && Number.isFinite(prNum) ? prNum : void 0
+        };
+        this.inputBuilder = new PolicyInputBuilder(config, actor, repo, pullRequest);
+        if (config.engine === "local") {
+          if (!config.rules) {
+            throw new Error("OPA local mode requires `policy.rules` path to .wasm or .rego files");
+          }
+          const wasm = new OpaWasmEvaluator();
+          await wasm.initialize(config.rules);
+          if (config.data) {
+            wasm.loadData(config.data);
+          }
+          this.evaluator = wasm;
+        } else if (config.engine === "remote") {
+          if (!config.url) {
+            throw new Error("OPA remote mode requires `policy.url` pointing to OPA server");
+          }
+          this.evaluator = new OpaHttpEvaluator(config.url, this.timeout);
+        } else {
+          this.evaluator = null;
+        }
+      }
+      /**
+       * Update actor/repo/PR context (e.g., after PR info becomes available).
+       * Called by the enterprise loader when engine context is enriched.
+       */
+      setActorContext(actor, repo, pullRequest) {
+        this.inputBuilder = new PolicyInputBuilder(this.config, actor, repo, pullRequest);
+      }
+      async evaluateCheckExecution(checkId, checkConfig) {
+        if (!this.evaluator || !this.inputBuilder) return { allowed: true };
+        const cfg = checkConfig && typeof checkConfig === "object" ? checkConfig : {};
+        const policyOverride = cfg.policy;
+        const input = this.inputBuilder.forCheckExecution({
+          id: checkId,
+          type: cfg.type || "ai",
+          group: cfg.group,
+          tags: cfg.tags,
+          criticality: cfg.criticality,
+          sandbox: cfg.sandbox,
+          policy: policyOverride
+        });
+        return this.doEvaluate(input, this.resolveRulePath("check.execute", policyOverride?.rule));
+      }
+      async evaluateToolInvocation(serverName, methodName, transport) {
+        if (!this.evaluator || !this.inputBuilder) return { allowed: true };
+        const input = this.inputBuilder.forToolInvocation(serverName, methodName, transport);
+        return this.doEvaluate(input, "visor/tool/invoke");
+      }
+      async evaluateCapabilities(checkId, capabilities) {
+        if (!this.evaluator || !this.inputBuilder) return { allowed: true };
+        const input = this.inputBuilder.forCapabilityResolve(checkId, capabilities);
+        return this.doEvaluate(input, "visor/capability/resolve");
+      }
+      async shutdown() {
+        if (this.evaluator && "shutdown" in this.evaluator) {
+          await this.evaluator.shutdown();
+        }
+        this.evaluator = null;
+        this.inputBuilder = null;
+      }
+      resolveRulePath(defaultScope, override) {
+        if (override) {
+          return override.startsWith("visor/") ? override : `visor/${override}`;
+        }
+        return `visor/${defaultScope.replace(/\./g, "/")}`;
+      }
+      async doEvaluate(input, rulePath) {
+        try {
+          this.logger?.debug(`[PolicyEngine] Evaluating ${rulePath}`, JSON.stringify(input));
+          let timer;
+          const timeoutPromise = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => reject(new Error("policy evaluation timeout")), this.timeout);
+          });
+          try {
+            const result = await Promise.race([this.rawEvaluate(input, rulePath), timeoutPromise]);
+            const decision = this.parseDecision(result);
+            if (!decision.allowed && this.fallback === "warn") {
+              decision.allowed = true;
+              decision.warn = true;
+              decision.reason = `audit: ${decision.reason || "policy denied"}`;
+            }
+            this.logger?.debug(
+              `[PolicyEngine] Decision for ${rulePath}: allowed=${decision.allowed}, warn=${decision.warn || false}, reason=${decision.reason || "none"}`
+            );
+            return decision;
+          } finally {
+            if (timer) clearTimeout(timer);
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          this.logger?.warn(`[PolicyEngine] Evaluation failed for ${rulePath}: ${msg}`);
+          return {
+            allowed: this.fallback === "allow" || this.fallback === "warn",
+            warn: this.fallback === "warn" ? true : void 0,
+            reason: `policy evaluation failed, fallback=${this.fallback}`
+          };
+        }
+      }
+      async rawEvaluate(input, rulePath) {
+        if (this.evaluator instanceof OpaWasmEvaluator) {
+          const result = await this.evaluator.evaluate(input);
+          return this.navigateWasmResult(result, rulePath);
+        }
+        return this.evaluator.evaluate(input, rulePath);
+      }
+      /**
+       * Navigate nested OPA WASM result tree to reach the specific rule's output.
+       * The WASM entrypoint `-e visor` means the result root IS the visor package,
+       * so we strip the `visor/` prefix and walk the remaining segments.
+       */
+      navigateWasmResult(result, rulePath) {
+        if (!result || typeof result !== "object") return result;
+        const segments = rulePath.replace(/^visor\//, "").split("/");
+        let current = result;
+        for (const seg of segments) {
+          if (current && typeof current === "object" && seg in current) {
+            current = current[seg];
+          } else {
+            return void 0;
+          }
+        }
+        return current;
+      }
+      parseDecision(result) {
+        if (result === void 0 || result === null) {
+          return {
+            allowed: this.fallback === "allow" || this.fallback === "warn",
+            warn: this.fallback === "warn" ? true : void 0,
+            reason: this.fallback === "warn" ? "audit: no policy result" : "no policy result"
+          };
+        }
+        const allowed = result.allowed !== false;
+        const decision = {
+          allowed,
+          reason: result.reason
+        };
+        if (result.capabilities) {
+          decision.capabilities = result.capabilities;
+        }
+        return decision;
+      }
+    };
+  }
+});
+
+// src/enterprise/scheduler/knex-store.ts
+var knex_store_exports = {};
+__export(knex_store_exports, {
+  KnexStoreBackend: () => KnexStoreBackend
+});
+function toNum(val) {
+  if (val === null || val === void 0) return void 0;
+  return typeof val === "string" ? parseInt(val, 10) : val;
+}
+function safeJsonParse2(value) {
+  if (!value) return void 0;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}
+function fromTriggerRow2(row) {
+  return {
+    id: row.id,
+    creatorId: row.creator_id,
+    creatorContext: row.creator_context ?? void 0,
+    creatorName: row.creator_name ?? void 0,
+    description: row.description ?? void 0,
+    channels: safeJsonParse2(row.channels),
+    fromUsers: safeJsonParse2(row.from_users),
+    fromBots: row.from_bots === true || row.from_bots === 1,
+    contains: safeJsonParse2(row.contains),
+    matchPattern: row.match_pattern ?? void 0,
+    threads: row.threads,
+    workflow: row.workflow,
+    inputs: safeJsonParse2(row.inputs),
+    outputContext: safeJsonParse2(row.output_context),
+    status: row.status,
+    enabled: row.enabled === true || row.enabled === 1,
+    createdAt: toNum(row.created_at)
+  };
+}
+function toTriggerInsertRow(trigger) {
+  return {
+    id: trigger.id,
+    creator_id: trigger.creatorId,
+    creator_context: trigger.creatorContext ?? null,
+    creator_name: trigger.creatorName ?? null,
+    description: trigger.description ?? null,
+    channels: trigger.channels ? JSON.stringify(trigger.channels) : null,
+    from_users: trigger.fromUsers ? JSON.stringify(trigger.fromUsers) : null,
+    from_bots: trigger.fromBots,
+    contains: trigger.contains ? JSON.stringify(trigger.contains) : null,
+    match_pattern: trigger.matchPattern ?? null,
+    threads: trigger.threads,
+    workflow: trigger.workflow,
+    inputs: trigger.inputs ? JSON.stringify(trigger.inputs) : null,
+    output_context: trigger.outputContext ? JSON.stringify(trigger.outputContext) : null,
+    status: trigger.status,
+    enabled: trigger.enabled,
+    created_at: trigger.createdAt
+  };
+}
+function fromDbRow2(row) {
+  return {
+    id: row.id,
+    creatorId: row.creator_id,
+    creatorContext: row.creator_context ?? void 0,
+    creatorName: row.creator_name ?? void 0,
+    timezone: row.timezone,
+    schedule: row.schedule_expr,
+    runAt: toNum(row.run_at),
+    isRecurring: row.is_recurring === true || row.is_recurring === 1,
+    originalExpression: row.original_expression,
+    workflow: row.workflow ?? void 0,
+    workflowInputs: safeJsonParse2(row.workflow_inputs),
+    outputContext: safeJsonParse2(row.output_context),
+    status: row.status,
+    createdAt: toNum(row.created_at),
+    lastRunAt: toNum(row.last_run_at),
+    nextRunAt: toNum(row.next_run_at),
+    runCount: row.run_count,
+    failureCount: row.failure_count,
+    lastError: row.last_error ?? void 0,
+    previousResponse: row.previous_response ?? void 0
+  };
+}
+function toInsertRow(schedule) {
+  return {
+    id: schedule.id,
+    creator_id: schedule.creatorId,
+    creator_context: schedule.creatorContext ?? null,
+    creator_name: schedule.creatorName ?? null,
+    timezone: schedule.timezone,
+    schedule_expr: schedule.schedule,
+    run_at: schedule.runAt ?? null,
+    is_recurring: schedule.isRecurring,
+    original_expression: schedule.originalExpression,
+    workflow: schedule.workflow ?? null,
+    workflow_inputs: schedule.workflowInputs ? JSON.stringify(schedule.workflowInputs) : null,
+    output_context: schedule.outputContext ? JSON.stringify(schedule.outputContext) : null,
+    status: schedule.status,
+    created_at: schedule.createdAt,
+    last_run_at: schedule.lastRunAt ?? null,
+    next_run_at: schedule.nextRunAt ?? null,
+    run_count: schedule.runCount,
+    failure_count: schedule.failureCount,
+    last_error: schedule.lastError ?? null,
+    previous_response: schedule.previousResponse ?? null
+  };
+}
+var fs24, path29, import_uuid2, KnexStoreBackend;
+var init_knex_store = __esm({
+  "src/enterprise/scheduler/knex-store.ts"() {
+    "use strict";
+    fs24 = __toESM(require("fs"));
+    path29 = __toESM(require("path"));
+    import_uuid2 = require("uuid");
+    init_logger();
+    KnexStoreBackend = class {
+      knex = null;
+      driver;
+      connection;
+      constructor(driver, storageConfig, _haConfig) {
+        this.driver = driver;
+        this.connection = storageConfig.connection || {};
+      }
+      async initialize() {
+        const { createRequire } = require("module");
+        const runtimeRequire = createRequire(__filename);
+        let knexFactory;
+        try {
+          knexFactory = runtimeRequire("knex");
+        } catch (err) {
+          const code = err?.code;
+          if (code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND") {
+            throw new Error(
+              "knex is required for PostgreSQL/MySQL/MSSQL schedule storage. Install it with: npm install knex"
+            );
+          }
+          throw err;
+        }
+        const clientMap = {
+          postgresql: "pg",
+          mysql: "mysql2",
+          mssql: "tedious"
+        };
+        const client = clientMap[this.driver];
+        let connection;
+        if (this.connection.connection_string) {
+          connection = this.connection.connection_string;
+        } else if (this.driver === "mssql") {
+          connection = this.buildMssqlConnection();
+        } else {
+          connection = this.buildStandardConnection();
+        }
+        this.knex = knexFactory({
+          client,
+          connection,
+          pool: {
+            min: this.connection.pool?.min ?? 0,
+            max: this.connection.pool?.max ?? 10
+          }
+        });
+        await this.migrateSchema();
+        logger.info(`[KnexStore] Initialized (${this.driver})`);
+      }
+      buildStandardConnection() {
+        return {
+          host: this.connection.host || "localhost",
+          port: this.connection.port,
+          database: this.connection.database || "visor",
+          user: this.connection.user,
+          password: this.connection.password,
+          ssl: this.resolveSslConfig()
+        };
+      }
+      buildMssqlConnection() {
+        const ssl = this.connection.ssl;
+        const sslEnabled = ssl === true || typeof ssl === "object" && ssl.enabled !== false;
+        return {
+          server: this.connection.host || "localhost",
+          port: this.connection.port,
+          database: this.connection.database || "visor",
+          user: this.connection.user,
+          password: this.connection.password,
+          options: {
+            encrypt: sslEnabled,
+            trustServerCertificate: typeof ssl === "object" ? ssl.reject_unauthorized === false : !sslEnabled
+          }
+        };
+      }
+      resolveSslConfig() {
+        const ssl = this.connection.ssl;
+        if (ssl === false || ssl === void 0) return false;
+        if (ssl === true) return { rejectUnauthorized: true };
+        if (ssl.enabled === false) return false;
+        const result = {
+          rejectUnauthorized: ssl.reject_unauthorized !== false
+        };
+        if (ssl.ca) {
+          const caPath = this.validateSslPath(ssl.ca, "CA certificate");
+          result.ca = fs24.readFileSync(caPath, "utf8");
+        }
+        if (ssl.cert) {
+          const certPath = this.validateSslPath(ssl.cert, "client certificate");
+          result.cert = fs24.readFileSync(certPath, "utf8");
+        }
+        if (ssl.key) {
+          const keyPath = this.validateSslPath(ssl.key, "client key");
+          result.key = fs24.readFileSync(keyPath, "utf8");
+        }
+        return result;
+      }
+      validateSslPath(filePath, label) {
+        const resolved = path29.resolve(filePath);
+        if (resolved !== path29.normalize(resolved)) {
+          throw new Error(`SSL ${label} path contains invalid sequences: ${filePath}`);
+        }
+        if (!fs24.existsSync(resolved)) {
+          throw new Error(`SSL ${label} not found: ${filePath}`);
+        }
+        return resolved;
+      }
+      async shutdown() {
+        if (this.knex) {
+          await this.knex.destroy();
+          this.knex = null;
+        }
+      }
+      async migrateSchema() {
+        const knex = this.getKnex();
+        const exists = await knex.schema.hasTable("schedules");
+        if (!exists) {
+          await knex.schema.createTable("schedules", (table) => {
+            table.string("id", 36).primary();
+            table.string("creator_id", 255).notNullable().index();
+            table.string("creator_context", 255);
+            table.string("creator_name", 255);
+            table.string("timezone", 64).notNullable().defaultTo("UTC");
+            table.string("schedule_expr", 255);
+            table.bigInteger("run_at");
+            table.boolean("is_recurring").notNullable();
+            table.text("original_expression");
+            table.string("workflow", 255);
+            table.text("workflow_inputs");
+            table.text("output_context");
+            table.string("status", 20).notNullable().index();
+            table.bigInteger("created_at").notNullable();
+            table.bigInteger("last_run_at");
+            table.bigInteger("next_run_at");
+            table.integer("run_count").notNullable().defaultTo(0);
+            table.integer("failure_count").notNullable().defaultTo(0);
+            table.text("last_error");
+            table.text("previous_response");
+            table.index(["status", "next_run_at"]);
+          });
+        }
+        const triggersExist = await knex.schema.hasTable("message_triggers");
+        if (!triggersExist) {
+          await knex.schema.createTable("message_triggers", (table) => {
+            table.string("id", 36).primary();
+            table.string("creator_id", 255).notNullable().index();
+            table.string("creator_context", 255);
+            table.string("creator_name", 255);
+            table.text("description");
+            table.text("channels");
+            table.text("from_users");
+            table.boolean("from_bots").notNullable().defaultTo(false);
+            table.text("contains");
+            table.text("match_pattern");
+            table.string("threads", 20).notNullable().defaultTo("any");
+            table.string("workflow", 255).notNullable();
+            table.text("inputs");
+            table.text("output_context");
+            table.string("status", 20).notNullable().defaultTo("active").index();
+            table.boolean("enabled").notNullable().defaultTo(true);
+            table.bigInteger("created_at").notNullable();
+          });
+        }
+        const locksExist = await knex.schema.hasTable("scheduler_locks");
+        if (!locksExist) {
+          await knex.schema.createTable("scheduler_locks", (table) => {
+            table.string("lock_id", 255).primary();
+            table.string("node_id", 255).notNullable();
+            table.string("lock_token", 36).notNullable();
+            table.bigInteger("acquired_at").notNullable();
+            table.bigInteger("expires_at").notNullable();
+          });
+        }
+      }
+      getKnex() {
+        if (!this.knex) {
+          throw new Error("[KnexStore] Not initialized. Call initialize() first.");
+        }
+        return this.knex;
+      }
+      // --- CRUD ---
+      async create(schedule) {
+        const knex = this.getKnex();
+        const newSchedule = {
+          ...schedule,
+          id: (0, import_uuid2.v4)(),
+          createdAt: Date.now(),
+          runCount: 0,
+          failureCount: 0,
+          status: "active"
+        };
+        await knex("schedules").insert(toInsertRow(newSchedule));
+        logger.info(`[KnexStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}`);
+        return newSchedule;
+      }
+      async importSchedule(schedule) {
+        const knex = this.getKnex();
+        const existing = await knex("schedules").where("id", schedule.id).first();
+        if (existing) return;
+        await knex("schedules").insert(toInsertRow(schedule));
+      }
+      async get(id) {
+        const knex = this.getKnex();
+        const row = await knex("schedules").where("id", id).first();
+        return row ? fromDbRow2(row) : void 0;
+      }
+      async update(id, patch) {
+        const knex = this.getKnex();
+        const existing = await knex("schedules").where("id", id).first();
+        if (!existing) return void 0;
+        const current = fromDbRow2(existing);
+        const updated = { ...current, ...patch, id: current.id };
+        const row = toInsertRow(updated);
+        delete row.id;
+        await knex("schedules").where("id", id).update(row);
+        return updated;
+      }
+      async delete(id) {
+        const knex = this.getKnex();
+        const deleted = await knex("schedules").where("id", id).del();
+        if (deleted > 0) {
+          logger.info(`[KnexStore] Deleted schedule ${id}`);
+          return true;
+        }
+        return false;
+      }
+      // --- Queries ---
+      async getByCreator(creatorId) {
+        const knex = this.getKnex();
+        const rows = await knex("schedules").where("creator_id", creatorId);
+        return rows.map((r) => fromDbRow2(r));
+      }
+      async getActiveSchedules() {
+        const knex = this.getKnex();
+        const rows = await knex("schedules").where("status", "active");
+        return rows.map((r) => fromDbRow2(r));
+      }
+      async getDueSchedules(now) {
+        const ts = now ?? Date.now();
+        const knex = this.getKnex();
+        const bFalse = this.driver === "mssql" ? 0 : false;
+        const bTrue = this.driver === "mssql" ? 1 : true;
+        const rows = await knex("schedules").where("status", "active").andWhere(function() {
+          this.where(function() {
+            this.where("is_recurring", bFalse).whereNotNull("run_at").where("run_at", "<=", ts);
+          }).orWhere(function() {
+            this.where("is_recurring", bTrue).whereNotNull("next_run_at").where("next_run_at", "<=", ts);
+          });
+        });
+        return rows.map((r) => fromDbRow2(r));
+      }
+      async findByWorkflow(creatorId, workflowName) {
+        const knex = this.getKnex();
+        const escaped = workflowName.toLowerCase().replace(/[%_\\]/g, "\\$&");
+        const pattern = `%${escaped}%`;
+        const rows = await knex("schedules").where("creator_id", creatorId).where("status", "active").whereRaw("LOWER(workflow) LIKE ? ESCAPE '\\'", [pattern]);
+        return rows.map((r) => fromDbRow2(r));
+      }
+      async getAll() {
+        const knex = this.getKnex();
+        const rows = await knex("schedules");
+        return rows.map((r) => fromDbRow2(r));
+      }
+      async getStats() {
+        const knex = this.getKnex();
+        const boolTrue = this.driver === "mssql" ? "1" : "true";
+        const boolFalse = this.driver === "mssql" ? "0" : "false";
+        const result = await knex("schedules").select(
+          knex.raw("COUNT(*) as total"),
+          knex.raw("SUM(CASE WHEN status = 'active' THEN 1 ELSE 0 END) as active"),
+          knex.raw("SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END) as paused"),
+          knex.raw("SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed"),
+          knex.raw("SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as failed"),
+          knex.raw(`SUM(CASE WHEN is_recurring = ${boolTrue} THEN 1 ELSE 0 END) as recurring`),
+          knex.raw(`SUM(CASE WHEN is_recurring = ${boolFalse} THEN 1 ELSE 0 END) as one_time`)
+        ).first();
+        return {
+          total: Number(result.total) || 0,
+          active: Number(result.active) || 0,
+          paused: Number(result.paused) || 0,
+          completed: Number(result.completed) || 0,
+          failed: Number(result.failed) || 0,
+          recurring: Number(result.recurring) || 0,
+          oneTime: Number(result.one_time) || 0
+        };
+      }
+      async validateLimits(creatorId, isRecurring, limits) {
+        const knex = this.getKnex();
+        if (limits.maxGlobal) {
+          const result = await knex("schedules").count("* as cnt").first();
+          if (Number(result?.cnt) >= limits.maxGlobal) {
+            throw new Error(`Global schedule limit reached (${limits.maxGlobal})`);
+          }
+        }
+        if (limits.maxPerUser) {
+          const result = await knex("schedules").where("creator_id", creatorId).count("* as cnt").first();
+          if (Number(result?.cnt) >= limits.maxPerUser) {
+            throw new Error(`You have reached the maximum number of schedules (${limits.maxPerUser})`);
+          }
+        }
+        if (isRecurring && limits.maxRecurringPerUser) {
+          const bTrue = this.driver === "mssql" ? 1 : true;
+          const result = await knex("schedules").where("creator_id", creatorId).where("is_recurring", bTrue).count("* as cnt").first();
+          if (Number(result?.cnt) >= limits.maxRecurringPerUser) {
+            throw new Error(
+              `You have reached the maximum number of recurring schedules (${limits.maxRecurringPerUser})`
+            );
+          }
+        }
+      }
+      // --- HA Distributed Locking (via scheduler_locks table) ---
+      async tryAcquireLock(lockId, nodeId, ttlSeconds) {
+        const knex = this.getKnex();
+        const now = Date.now();
+        const expiresAt = now + ttlSeconds * 1e3;
+        const token = (0, import_uuid2.v4)();
+        const updated = await knex("scheduler_locks").where("lock_id", lockId).where("expires_at", "<", now).update({
+          node_id: nodeId,
+          lock_token: token,
+          acquired_at: now,
+          expires_at: expiresAt
+        });
+        if (updated > 0) return token;
+        try {
+          await knex("scheduler_locks").insert({
+            lock_id: lockId,
+            node_id: nodeId,
+            lock_token: token,
+            acquired_at: now,
+            expires_at: expiresAt
+          });
+          return token;
+        } catch {
+          return null;
+        }
+      }
+      async releaseLock(lockId, lockToken) {
+        const knex = this.getKnex();
+        await knex("scheduler_locks").where("lock_id", lockId).where("lock_token", lockToken).del();
+      }
+      async renewLock(lockId, lockToken, ttlSeconds) {
+        const knex = this.getKnex();
+        const now = Date.now();
+        const expiresAt = now + ttlSeconds * 1e3;
+        const updated = await knex("scheduler_locks").where("lock_id", lockId).where("lock_token", lockToken).update({ acquired_at: now, expires_at: expiresAt });
+        return updated > 0;
+      }
+      async flush() {
+      }
+      // --- Message Trigger CRUD ---
+      async createTrigger(trigger) {
+        const knex = this.getKnex();
+        const newTrigger = {
+          ...trigger,
+          id: (0, import_uuid2.v4)(),
+          createdAt: Date.now()
+        };
+        await knex("message_triggers").insert(toTriggerInsertRow(newTrigger));
+        logger.info(`[KnexStore] Created trigger ${newTrigger.id} for user ${newTrigger.creatorId}`);
+        return newTrigger;
+      }
+      async getTrigger(id) {
+        const knex = this.getKnex();
+        const row = await knex("message_triggers").where("id", id).first();
+        return row ? fromTriggerRow2(row) : void 0;
+      }
+      async updateTrigger(id, patch) {
+        const knex = this.getKnex();
+        const existing = await knex("message_triggers").where("id", id).first();
+        if (!existing) return void 0;
+        const current = fromTriggerRow2(existing);
+        const updated = {
+          ...current,
+          ...patch,
+          id: current.id,
+          createdAt: current.createdAt
+        };
+        const row = toTriggerInsertRow(updated);
+        delete row.id;
+        await knex("message_triggers").where("id", id).update(row);
+        return updated;
+      }
+      async deleteTrigger(id) {
+        const knex = this.getKnex();
+        const deleted = await knex("message_triggers").where("id", id).del();
+        if (deleted > 0) {
+          logger.info(`[KnexStore] Deleted trigger ${id}`);
+          return true;
+        }
+        return false;
+      }
+      async getTriggersByCreator(creatorId) {
+        const knex = this.getKnex();
+        const rows = await knex("message_triggers").where("creator_id", creatorId);
+        return rows.map((r) => fromTriggerRow2(r));
+      }
+      async getActiveTriggers() {
+        const knex = this.getKnex();
+        const rows = await knex("message_triggers").where("status", "active").where("enabled", this.driver === "mssql" ? 1 : true);
+        return rows.map((r) => fromTriggerRow2(r));
+      }
+    };
+  }
+});
+
+// src/enterprise/loader.ts
+var loader_exports = {};
+__export(loader_exports, {
+  loadEnterprisePolicyEngine: () => loadEnterprisePolicyEngine,
+  loadEnterpriseStoreBackend: () => loadEnterpriseStoreBackend
+});
+async function loadEnterprisePolicyEngine(config) {
+  try {
+    const { LicenseValidator: LicenseValidator2 } = await Promise.resolve().then(() => (init_validator(), validator_exports));
+    const validator = new LicenseValidator2();
+    const license = await validator.loadAndValidate();
+    if (!license || !validator.hasFeature("policy")) {
+      return new DefaultPolicyEngine();
+    }
+    if (validator.isInGracePeriod()) {
+      console.warn(
+        "[visor:enterprise] License has expired but is within the 72-hour grace period. Please renew your license."
+      );
+    }
+    const { OpaPolicyEngine: OpaPolicyEngine2 } = await Promise.resolve().then(() => (init_opa_policy_engine(), opa_policy_engine_exports));
+    const engine = new OpaPolicyEngine2(config);
+    await engine.initialize(config);
+    return engine;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    try {
+      const { logger: logger2 } = (init_logger(), __toCommonJS(logger_exports));
+      logger2.warn(`[PolicyEngine] Enterprise policy init failed, falling back to default: ${msg}`);
+    } catch {
+    }
+    return new DefaultPolicyEngine();
+  }
+}
+async function loadEnterpriseStoreBackend(driver, storageConfig, haConfig) {
+  const { LicenseValidator: LicenseValidator2 } = await Promise.resolve().then(() => (init_validator(), validator_exports));
+  const validator = new LicenseValidator2();
+  const license = await validator.loadAndValidate();
+  if (!license || !validator.hasFeature("scheduler-sql")) {
+    throw new Error(
+      `The ${driver} schedule storage driver requires a Visor Enterprise license with the 'scheduler-sql' feature. Please upgrade or use driver: 'sqlite' (default).`
+    );
+  }
+  if (validator.isInGracePeriod()) {
+    console.warn(
+      "[visor:enterprise] License has expired but is within the 72-hour grace period. Please renew your license."
+    );
+  }
+  const { KnexStoreBackend: KnexStoreBackend2 } = await Promise.resolve().then(() => (init_knex_store(), knex_store_exports));
+  return new KnexStoreBackend2(driver, storageConfig, haConfig);
+}
+var init_loader = __esm({
+  "src/enterprise/loader.ts"() {
+    "use strict";
+    init_default_engine();
+  }
+});
+
 // src/event-bus/event-bus.ts
 var event_bus_exports = {};
 __export(event_bus_exports, {
@@ -56171,12 +57673,12 @@ var ndjson_sink_exports = {};
 __export(ndjson_sink_exports, {
   NdjsonSink: () => NdjsonSink
 });
-var import_fs9, import_path13, NdjsonSink;
+var import_fs9, import_path14, NdjsonSink;
 var init_ndjson_sink = __esm({
   "src/frontends/ndjson-sink.ts"() {
     "use strict";
     import_fs9 = __toESM(require("fs"));
-    import_path13 = __toESM(require("path"));
+    import_path14 = __toESM(require("path"));
     NdjsonSink = class {
       name = "ndjson-sink";
       cfg;
@@ -56208,8 +57710,8 @@ var init_ndjson_sink = __esm({
         this.unsub = void 0;
       }
       resolveFile(p) {
-        if (import_path13.default.isAbsolute(p)) return p;
-        return import_path13.default.join(process.cwd(), p);
+        if (import_path14.default.isAbsolute(p)) return p;
+        return import_path14.default.join(process.cwd(), p);
       }
     };
   }
@@ -57032,8 +58534,8 @@ ${content}
        * Sleep utility
        */
       sleep(ms) {
-        return new Promise((resolve15) => {
-          const t = setTimeout(resolve15, ms);
+        return new Promise((resolve19) => {
+          const t = setTimeout(resolve19, ms);
           if (typeof t.unref === "function") {
             try {
               t.unref();
@@ -57318,8 +58820,8 @@ ${end}`);
       async updateGroupedComment(ctx, comments, group, changedIds) {
         const existingLock = this.updateLocks.get(group);
         let resolveLock;
-        const ourLock = new Promise((resolve15) => {
-          resolveLock = resolve15;
+        const ourLock = new Promise((resolve19) => {
+          resolveLock = resolve19;
         });
         this.updateLocks.set(group, ourLock);
         try {
@@ -57650,7 +59152,7 @@ ${blocks}
        * Sleep utility for enforcing delays
        */
       sleep(ms) {
-        return new Promise((resolve15) => setTimeout(resolve15, ms));
+        return new Promise((resolve19) => setTimeout(resolve19, ms));
       }
     };
   }
@@ -58819,7 +60321,7 @@ var init_tui_frontend = __esm({
 });
 
 // src/agent-protocol/task-store.ts
-function safeJsonParse2(value) {
+function safeJsonParse3(value) {
   if (!value) return void 0;
   try {
     return JSON.parse(value);
@@ -58836,22 +60338,22 @@ function taskRowToAgentTask(row) {
     context_id: row.context_id,
     status: {
       state: row.state,
-      message: safeJsonParse2(row.status_message),
+      message: safeJsonParse3(row.status_message),
       timestamp: row.updated_at
     },
-    artifacts: safeJsonParse2(row.artifacts) ?? [],
-    history: safeJsonParse2(row.history) ?? [],
-    metadata: safeJsonParse2(row.request_metadata),
+    artifacts: safeJsonParse3(row.artifacts) ?? [],
+    history: safeJsonParse3(row.history) ?? [],
+    metadata: safeJsonParse3(row.request_metadata),
     workflow_id: row.workflow_id ?? void 0
   };
 }
-var import_path14, import_fs10, import_crypto5, SqliteTaskStore;
+var import_path15, import_fs10, import_crypto6, SqliteTaskStore;
 var init_task_store = __esm({
   "src/agent-protocol/task-store.ts"() {
     "use strict";
-    import_path14 = __toESM(require("path"));
+    import_path15 = __toESM(require("path"));
     import_fs10 = __toESM(require("fs"));
-    import_crypto5 = __toESM(require("crypto"));
+    import_crypto6 = __toESM(require("crypto"));
     init_logger();
     init_types();
     init_state_transitions();
@@ -58862,8 +60364,8 @@ var init_task_store = __esm({
         this.dbPath = filename || ".visor/agent-tasks.db";
       }
       async initialize() {
-        const resolvedPath = import_path14.default.resolve(process.cwd(), this.dbPath);
-        const dir = import_path14.default.dirname(resolvedPath);
+        const resolvedPath = import_path15.default.resolve(process.cwd(), this.dbPath);
+        const dir = import_path15.default.dirname(resolvedPath);
         import_fs10.default.mkdirSync(dir, { recursive: true });
         const { createRequire } = require("module");
         const runtimeRequire = createRequire(__filename);
@@ -58932,7 +60434,7 @@ var init_task_store = __esm({
       // -------------------------------------------------------------------------
       createTask(params) {
         const db = this.getDb();
-        const id = import_crypto5.default.randomUUID();
+        const id = import_crypto6.default.randomUUID();
         const now = nowISO();
         const contextId = this.resolveContextId(params.requestMessage, params.contextId);
         const expiresAt = params.expiresAt ?? null;
@@ -59019,6 +60521,13 @@ var init_task_store = __esm({
             messageText = textPart?.text ?? "";
           } catch {
           }
+          let source = "-";
+          let metadata = {};
+          try {
+            metadata = JSON.parse(r.request_metadata || "{}");
+            source = metadata.source || "-";
+          } catch {
+          }
           return {
             id: r.id,
             context_id: r.context_id,
@@ -59029,7 +60538,9 @@ var init_task_store = __esm({
             claimed_at: r.claimed_at,
             workflow_id: r.workflow_id,
             run_id: r.run_id,
-            request_message: messageText
+            request_message: messageText,
+            source,
+            metadata
           };
         });
         return { rows, total };
@@ -59049,11 +60560,18 @@ var init_task_store = __esm({
        WHERE id = ?`
         ).run(newState, now, statusMessage ? JSON.stringify(statusMessage) : null, taskId);
       }
+      claimTask(taskId, workerId) {
+        const db = this.getDb();
+        const now = nowISO();
+        db.prepare(
+          `UPDATE agent_tasks SET claimed_by = ?, claimed_at = ?, updated_at = ? WHERE id = ?`
+        ).run(workerId, now, now, taskId);
+      }
       addArtifact(taskId, artifact) {
         const db = this.getDb();
         const row = db.prepare("SELECT artifacts FROM agent_tasks WHERE id = ?").get(taskId);
         if (!row) throw new TaskNotFoundError(taskId);
-        const artifacts = safeJsonParse2(row.artifacts) ?? [];
+        const artifacts = safeJsonParse3(row.artifacts) ?? [];
         artifacts.push(artifact);
         db.prepare("UPDATE agent_tasks SET artifacts = ?, updated_at = ? WHERE id = ?").run(
           JSON.stringify(artifacts),
@@ -59065,7 +60583,7 @@ var init_task_store = __esm({
         const db = this.getDb();
         const row = db.prepare("SELECT history FROM agent_tasks WHERE id = ?").get(taskId);
         if (!row) throw new TaskNotFoundError(taskId);
-        const history = safeJsonParse2(row.history) ?? [];
+        const history = safeJsonParse3(row.history) ?? [];
         history.push(message);
         db.prepare("UPDATE agent_tasks SET history = ?, updated_at = ? WHERE id = ?").run(
           JSON.stringify(history),
@@ -59270,11 +60788,11 @@ var init_task_stream_manager = __esm({
 });
 
 // src/agent-protocol/push-notification-manager.ts
-var import_crypto6, PushNotificationManager;
+var import_crypto7, PushNotificationManager;
 var init_push_notification_manager = __esm({
   "src/agent-protocol/push-notification-manager.ts"() {
     "use strict";
-    import_crypto6 = __toESM(require("crypto"));
+    import_crypto7 = __toESM(require("crypto"));
     init_logger();
     PushNotificationManager = class {
       db = null;
@@ -59319,7 +60837,7 @@ var init_push_notification_manager = __esm({
       // -------------------------------------------------------------------------
       create(config) {
         const db = this.getDb();
-        const id = config.id ?? import_crypto6.default.randomUUID();
+        const id = config.id ?? import_crypto7.default.randomUUID();
         const now = (/* @__PURE__ */ new Date()).toISOString();
         db.prepare(
           `INSERT INTO agent_push_configs (id, task_id, url, token, auth_scheme, auth_credentials, created_at)
@@ -59417,11 +60935,11 @@ var init_push_notification_manager = __esm({
 });
 
 // src/agent-protocol/task-queue.ts
-var import_crypto7, DEFAULT_CONFIG, TaskQueue;
+var import_crypto8, DEFAULT_CONFIG, TaskQueue;
 var init_task_queue = __esm({
   "src/agent-protocol/task-queue.ts"() {
     "use strict";
-    import_crypto7 = __toESM(require("crypto"));
+    import_crypto8 = __toESM(require("crypto"));
     init_logger();
     init_trace_helpers();
     DEFAULT_CONFIG = {
@@ -59434,7 +60952,7 @@ var init_task_queue = __esm({
         this.taskStore = taskStore;
         this.executor = executor;
         this.config = { ...DEFAULT_CONFIG, ...config };
-        this.workerId = workerId ?? import_crypto7.default.randomUUID();
+        this.workerId = workerId ?? import_crypto8.default.randomUUID();
       }
       running = false;
       timer = null;
@@ -59508,7 +61026,7 @@ var init_task_queue = __esm({
           }
           if (result.success) {
             const completedMsg = {
-              message_id: import_crypto7.default.randomUUID(),
+              message_id: import_crypto8.default.randomUUID(),
               role: "agent",
               parts: [
                 {
@@ -59520,7 +61038,7 @@ var init_task_queue = __esm({
             this.taskStore.updateTaskState(task.id, "completed", completedMsg);
           } else {
             this.taskStore.updateTaskState(task.id, "failed", {
-              message_id: import_crypto7.default.randomUUID(),
+              message_id: import_crypto8.default.randomUUID(),
               role: "agent",
               parts: [{ text: result.error ?? "Task execution failed" }]
             });
@@ -59531,7 +61049,7 @@ var init_task_queue = __esm({
           );
           try {
             this.taskStore.updateTaskState(task.id, "failed", {
-              message_id: import_crypto7.default.randomUUID(),
+              message_id: import_crypto8.default.randomUUID(),
               role: "agent",
               parts: [{ text: err instanceof Error ? err.message : "Unknown error" }]
             });
@@ -59551,13 +61069,13 @@ __export(a2a_frontend_exports, {
   resultToArtifacts: () => resultToArtifacts
 });
 function readJsonBody(req) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve19, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(chunk));
     req.on("end", () => {
       try {
         const body = Buffer.concat(chunks).toString("utf8");
-        resolve15(body ? JSON.parse(body) : {});
+        resolve19(body ? JSON.parse(body) : {});
       } catch {
         reject(new ParseError("Malformed JSON body"));
       }
@@ -59585,7 +61103,7 @@ function timingSafeEqual(a, b) {
   if (!a || !b) return false;
   if (a.length !== b.length) return false;
   try {
-    return import_crypto8.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    return import_crypto9.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
   } catch {
     return false;
   }
@@ -59659,7 +61177,7 @@ function resultToArtifacts(checkResults) {
     }
     if (parts.length > 0) {
       artifacts.push({
-        artifact_id: import_crypto8.default.randomUUID(),
+        artifact_id: import_crypto9.default.randomUUID(),
         name: checkId,
         description: `Output from check: ${checkId}`,
         parts
@@ -59668,14 +61186,14 @@ function resultToArtifacts(checkResults) {
   }
   return artifacts;
 }
-var import_http2, import_https, import_fs11, import_crypto8, A2AFrontend;
+var import_http2, import_https, import_fs11, import_crypto9, A2AFrontend;
 var init_a2a_frontend = __esm({
   "src/agent-protocol/a2a-frontend.ts"() {
     "use strict";
     import_http2 = __toESM(require("http"));
     import_https = __toESM(require("https"));
     import_fs11 = __toESM(require("fs"));
-    import_crypto8 = __toESM(require("crypto"));
+    import_crypto9 = __toESM(require("crypto"));
     init_logger();
     init_task_store();
     init_types();
@@ -59769,7 +61287,7 @@ var init_a2a_frontend = __esm({
           if (!taskId) return;
           try {
             const statusMessage = {
-              message_id: import_crypto8.default.randomUUID(),
+              message_id: import_crypto9.default.randomUUID(),
               role: "agent",
               parts: [{ text: envelope.payload?.prompt ?? "Agent requires input" }]
             };
@@ -59800,12 +61318,12 @@ var init_a2a_frontend = __esm({
         }
         const port = this.config.port ?? 9e3;
         const host = this.config.host ?? "0.0.0.0";
-        await new Promise((resolve15) => {
+        await new Promise((resolve19) => {
           this.server.listen(port, host, () => {
             const addr = this.server.address();
             this._boundPort = typeof addr === "object" && addr ? addr.port : port;
             logger.info(`A2A server listening on ${host}:${this._boundPort}`);
-            resolve15();
+            resolve19();
           });
         });
         if (this.agentCard) {
@@ -59829,8 +61347,8 @@ var init_a2a_frontend = __esm({
         }
         this.streamManager.shutdown();
         if (this.server) {
-          await new Promise((resolve15, reject) => {
-            this.server.close((err) => err ? reject(err) : resolve15());
+          await new Promise((resolve19, reject) => {
+            this.server.close((err) => err ? reject(err) : resolve19());
           });
           this.server = null;
         }
@@ -59941,7 +61459,7 @@ var init_a2a_frontend = __esm({
           const response = await this.handleFollowUpMessage(existingTaskId, body);
           return sendJson(res, 200, response);
         }
-        const contextId = body.message.context_id ?? import_crypto8.default.randomUUID();
+        const contextId = body.message.context_id ?? import_crypto9.default.randomUUID();
         const workflowId = resolveWorkflow(body, this.config);
         const blocking = body.configuration?.blocking ?? false;
         await withActiveSpan(
@@ -60054,7 +61572,7 @@ var init_a2a_frontend = __esm({
         if (!body.message?.parts?.length) {
           throw new InvalidRequestError("Message must contain at least one part");
         }
-        const contextId = body.message.context_id ?? import_crypto8.default.randomUUID();
+        const contextId = body.message.context_id ?? import_crypto9.default.randomUUID();
         const workflowId = resolveWorkflow(body, this.config);
         const task = this.taskStore.createTask({
           contextId,
@@ -60188,7 +61706,7 @@ var init_a2a_frontend = __esm({
             await this.executeTaskViaEngine(task, message);
           } else {
             const agentResponse = {
-              message_id: import_crypto8.default.randomUUID(),
+              message_id: import_crypto9.default.randomUUID(),
               role: "agent",
               parts: [{ text: `Task ${task.id} received and processed.`, media_type: "text/markdown" }]
             };
@@ -60200,7 +61718,7 @@ var init_a2a_frontend = __esm({
           logger.error(`[A2A] Task ${task.id} execution failed: ${errorMsg}`);
           try {
             const failMessage = {
-              message_id: import_crypto8.default.randomUUID(),
+              message_id: import_crypto9.default.randomUUID(),
               role: "agent",
               parts: [{ text: errorMsg }]
             };
@@ -60243,7 +61761,7 @@ ${issueText}`, media_type: "text/markdown" });
           }
           if (summaryParts.length > 0) {
             artifacts.push({
-              artifact_id: import_crypto8.default.randomUUID(),
+              artifact_id: import_crypto9.default.randomUUID(),
               name: "review-summary",
               description: "Review summary with issues found",
               parts: summaryParts
@@ -60263,7 +61781,7 @@ ${issueText}`, media_type: "text/markdown" });
               }
               if (parts.length > 0) {
                 artifacts.push({
-                  artifact_id: import_crypto8.default.randomUUID(),
+                  artifact_id: import_crypto9.default.randomUUID(),
                   name: cr.checkName ?? groupName,
                   description: `Output from check: ${cr.checkName ?? groupName}`,
                   parts
@@ -60274,7 +61792,7 @@ ${issueText}`, media_type: "text/markdown" });
         }
         if (artifacts.length === 0) {
           artifacts.push({
-            artifact_id: import_crypto8.default.randomUUID(),
+            artifact_id: import_crypto9.default.randomUUID(),
             name: "result",
             description: "Execution result",
             parts: [
@@ -60296,7 +61814,7 @@ ${issueText}`, media_type: "text/markdown" });
           );
         }
         const agentResponse = {
-          message_id: import_crypto8.default.randomUUID(),
+          message_id: import_crypto9.default.randomUUID(),
           role: "agent",
           parts: [
             {
@@ -60349,7 +61867,7 @@ ${issueText}`, media_type: "text/markdown" });
         }
         if (parts.length === 0) return null;
         return {
-          artifact_id: import_crypto8.default.randomUUID(),
+          artifact_id: import_crypto9.default.randomUUID(),
           name: p.checkId ?? "check-result",
           parts
         };
@@ -60535,15 +62053,15 @@ function serializeRunState(state) {
     ])
   };
 }
-var path27, fs24, StateMachineExecutionEngine;
+var path32, fs28, StateMachineExecutionEngine;
 var init_state_machine_execution_engine = __esm({
   "src/state-machine-execution-engine.ts"() {
     "use strict";
     init_runner();
     init_logger();
     init_sandbox_manager();
-    path27 = __toESM(require("path"));
-    fs24 = __toESM(require("fs"));
+    path32 = __toESM(require("path"));
+    fs28 = __toESM(require("fs"));
     StateMachineExecutionEngine = class _StateMachineExecutionEngine {
       workingDirectory;
       executionContext;
@@ -60775,8 +62293,8 @@ var init_state_machine_execution_engine = __esm({
             logger.debug(
               `[PolicyEngine] Loading enterprise policy engine (engine=${configWithTagFilter.policy.engine})`
             );
-            const { loadEnterprisePolicyEngine } = await import("./enterprise/loader");
-            context2.policyEngine = await loadEnterprisePolicyEngine(configWithTagFilter.policy);
+            const { loadEnterprisePolicyEngine: loadEnterprisePolicyEngine2 } = await Promise.resolve().then(() => (init_loader(), loader_exports));
+            context2.policyEngine = await loadEnterprisePolicyEngine2(configWithTagFilter.policy);
             logger.debug(
               `[PolicyEngine] Initialized: ${context2.policyEngine?.constructor?.name || "unknown"}`
             );
@@ -60930,9 +62448,9 @@ var init_state_machine_execution_engine = __esm({
                   }
                   const checkId = String(ev?.checkId || "unknown");
                   const threadKey = ev?.threadKey || (channel && threadTs ? `${channel}:${threadTs}` : "session");
-                  const baseDir = process.env.VISOR_SNAPSHOT_DIR || path27.resolve(process.cwd(), ".visor", "snapshots");
-                  fs24.mkdirSync(baseDir, { recursive: true });
-                  const filePath = path27.join(baseDir, `${threadKey}-${checkId}.json`);
+                  const baseDir = process.env.VISOR_SNAPSHOT_DIR || path32.resolve(process.cwd(), ".visor", "snapshots");
+                  fs28.mkdirSync(baseDir, { recursive: true });
+                  const filePath = path32.join(baseDir, `${threadKey}-${checkId}.json`);
                   await this.saveSnapshotToFile(filePath);
                   logger.info(`[Snapshot] Saved run snapshot: ${filePath}`);
                   try {
@@ -61073,7 +62591,7 @@ var init_state_machine_execution_engine = __esm({
        * Does not include secrets. Intended for debugging and future resume support.
        */
       async saveSnapshotToFile(filePath) {
-        const fs25 = await import("fs/promises");
+        const fs29 = await import("fs/promises");
         const ctx = this._lastContext;
         const runner = this._lastRunner;
         if (!ctx || !runner) {
@@ -61093,14 +62611,14 @@ var init_state_machine_execution_engine = __esm({
           journal: entries,
           requestedChecks: ctx.requestedChecks || []
         };
-        await fs25.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
+        await fs29.writeFile(filePath, JSON.stringify(payload, null, 2), "utf8");
       }
       /**
        * Load a snapshot JSON from file and return it. Resume support can build on this.
        */
       async loadSnapshotFromFile(filePath) {
-        const fs25 = await import("fs/promises");
-        const raw = await fs25.readFile(filePath, "utf8");
+        const fs29 = await import("fs/promises");
+        const raw = await fs29.readFile(filePath, "utf8");
         return JSON.parse(raw);
       }
       /**