@rafiqui987/markode 0.2.7 → 0.3.1

package/dist/cli.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 
 // src/cli/index.ts
-import fs17 from "fs";
-import path17 from "path";
+import fs20 from "fs";
+import path20 from "path";
 
-// src/core/check.ts
-import fs8 from "fs";
-import path8 from "path";
+// src/core/changes.ts
+import crypto from "crypto";
+import fs2 from "fs";
+import path2 from "path";
 
 // src/core/config.ts
 import fs from "fs";
@@ -53,7 +54,10 @@ function missingMainDoc(dir) {
 }
 function linkMainDoc(dir) {
   const missing = missingMainDoc(dir);
-  if (missing) fs.writeFileSync(path.join(dir, missing), POINTERS[missing]);
+  if (missing) {
+    assertInside(path.join(dir, missing));
+    fs.writeFileSync(path.join(dir, missing), POINTERS[missing]);
+  }
   return missing;
 }
 var linkAgentsDoc = (dir) => missingMainDoc(dir) === "CLAUDE.md" && !!linkMainDoc(dir);
@@ -71,18 +75,57 @@ function readConfig(root2) {
   try {
     const raw = JSON.parse(fs.readFileSync(configFile(root2), "utf8"));
     const langs = Array.isArray(raw.langs) ? raw.langs : raw.lang ? [raw.lang] : [];
-    return { mainDoc: raw.mainDoc ?? null, langs: langs.filter(isLangCode), langNames: raw.langNames, workflow: raw.workflow, proposals: raw.proposals, skipLink: raw.skipLink === true || void 0, initializedAt: raw.initializedAt };
+    const mainDoc = MAIN_DOCS.includes(raw.mainDoc) ? raw.mainDoc : null;
+    const workflow = ["none", "markode", "openspec", "speckit"].includes(raw.workflow) ? raw.workflow : void 0;
+    const proposals = raw.proposals === "general" || raw.proposals === "structured" ? raw.proposals : void 0;
+    const langNames = raw.langNames && typeof raw.langNames === "object" ? Object.fromEntries(Object.entries(raw.langNames).filter(([k, v]) => isLangCode(k) && typeof v === "string").map(([k, v]) => [k, v.slice(0, 40)])) : void 0;
+    const flags = raw.features && typeof raw.features === "object" ? Object.fromEntries(["rules", "translations", "dashboard", "skills"].filter((k) => typeof raw.features[k] === "boolean").map((k) => [k, raw.features[k]])) : void 0;
+    const savedRules = Array.isArray(raw.savedRules) ? raw.savedRules.filter((id) => typeof id === "string" && /^[\w-]+$/.test(id)) : void 0;
+    return { mainDoc, langs: langs.filter(isLangCode), langNames, workflow, proposals, skipLink: raw.skipLink === true || void 0, features: flags, savedRules, savedSourceLang: isLang(raw.savedSourceLang) ? raw.savedSourceLang : void 0, initializedAt: typeof raw.initializedAt === "string" ? raw.initializedAt : void 0 };
   } catch {
     return null;
   }
 }
 function writeConfig(root2, config) {
+  assertInside(configFile(root2));
   fs.mkdirSync(stateDir(root2), { recursive: true });
   fs.writeFileSync(configFile(root2), JSON.stringify(config, null, 2) + "\n");
 }
+var isInside = (abs, base) => abs === base || abs.startsWith(base + path.sep);
+function realOf(abs) {
+  let probe = abs;
+  const rest = [];
+  for (; ; ) {
+    try {
+      fs.lstatSync(probe);
+      break;
+    } catch {
+      const up = path.dirname(probe);
+      if (up === probe) return null;
+      rest.unshift(path.basename(probe));
+      probe = up;
+    }
+  }
+  try {
+    return path.join(fs.realpathSync(probe), ...rest);
+  } catch {
+    return null;
+  }
+}
+var projectRoot = null;
+function setProjectRoot(root2) {
+  projectRoot = fs.realpathSync(root2);
+}
+function assertInside(abs, root2 = projectRoot) {
+  if (!root2) return;
+  const base = fs.realpathSync(root2);
+  const real = realOf(abs);
+  if (!real || !isInside(real, base)) throw new Error(`Refusing to write outside the project (symlink?): ${abs}`);
+}
 function safeResolve(root2, rel) {
   const abs = path.resolve(root2, rel);
-  if (abs !== root2 && !abs.startsWith(root2 + path.sep)) throw new Error(`Path outside project: ${rel}`);
+  if (!isInside(abs, root2)) throw new Error(`Path outside project: ${rel}`);
+  assertInside(abs, root2);
   return abs;
 }
 var toPosix = (p3) => p3.split(path.sep).join("/");
@@ -102,28 +145,183 @@ function writeSettings(patch) {
   return next;
 }
 
+// src/core/changes.ts
+var logDir = (root2) => path2.join(GLOBAL_DIR, "projects", crypto.createHash("sha256").update(fs2.realpathSync(root2)).digest("hex").slice(0, 16));
+var logFile = (root2) => path2.join(logDir(root2), "activity.jsonl");
+var cursorFile = (root2) => path2.join(logDir(root2), "activity-cursor.json");
+var MAX_LINES = 1e3;
+var ENTRY_HEAD = /^<!-- (comment|reply) by ([^,\n]+), (\d{4}-\d{2}-\d{2})(?:, on "((?:[^"\\\n]|\\.)*)")?:\s?/;
+var HEADING = /^#{1,6}\s+(.*?)\s*#*\s*$/;
+var MAX_ENTRY = 2e4;
+function allEntries(text3) {
+  const out = [];
+  for (let i = 0; ; ) {
+    const s = text3.indexOf("<!--", i);
+    const e = s < 0 ? -1 : text3.indexOf("-->", s + 4);
+    if (e < 0) return out;
+    i = e + 3;
+    if (e - s > MAX_ENTRY) continue;
+    const raw = text3.slice(s, i);
+    const m = ENTRY_HEAD.exec(raw);
+    if (m) out.push({ raw, index: s, author: m[2], quote: m[4] ?? "", text: raw.slice(m[0].length, -3).trim() });
+  }
+}
+var entries = (text3) => allEntries(text3).filter((e) => e.author !== "AI" && e.text);
+function stripEntries(text3) {
+  let out = "";
+  let from = 0;
+  for (const e of allEntries(text3)) {
+    const end = e.index + e.raw.length;
+    const lineStart = text3.lastIndexOf("\n", e.index - 1) + 1;
+    const nl = text3.indexOf("\n", end);
+    const lineEnd = nl < 0 ? text3.length : nl;
+    const alone = !text3.slice(Math.max(lineStart, from), e.index).trim() && !text3.slice(end, lineEnd).trim();
+    if (alone && lineStart >= from) {
+      out += text3.slice(from, lineStart);
+      from = nl < 0 ? text3.length : nl + 1;
+    } else {
+      out += text3.slice(from, e.index);
+      from = end;
+    }
+  }
+  return out + text3.slice(from);
+}
+function headings(text3) {
+  const out = [];
+  let index = 0;
+  for (const line of text3.split("\n")) {
+    const h = HEADING.exec(line);
+    if (h) out.push({ index, title: h[1] });
+    index += line.length + 1;
+  }
+  return out;
+}
+function sectionAt(list, index) {
+  let lo = 0;
+  let hi = list.length - 1;
+  let found;
+  while (lo <= hi) {
+    const mid = lo + hi >> 1;
+    if (list[mid].index <= index) found = list[mid].title, lo = mid + 1;
+    else hi = mid - 1;
+  }
+  return found;
+}
+var isProposal = (text3) => /^type:\s*proposal\s*$/m.test(/^---\r?\n([\s\S]*?)\r?\n---/.exec(text3)?.[1] ?? "");
+function logSave(root2, rel, before, after) {
+  if (before === after || isProposal(after)) return;
+  const at = (/* @__PURE__ */ new Date()).toISOString();
+  const old = new Set(entries(before).map((e) => e.raw));
+  const sections = headings(after);
+  const out = entries(after).filter((e) => !old.has(e.raw)).map((e) => ({ at, path: rel, kind: "comment", section: sectionAt(sections, e.index), author: e.author, quote: e.quote || void 0, text: e.text }));
+  const a = stripEntries(before).split("\n");
+  const b = stripEntries(after).split("\n");
+  if (a.join("\n") !== b.join("\n")) {
+    let i = 0;
+    while (i < a.length && i < b.length && a[i] === b[i]) i++;
+    out.push({ at, path: rel, kind: "edit", section: sectionAt(headings(b.join("\n")), b.slice(0, i + 1).join("\n").length) });
+  }
+  if (!out.length) return;
+  const file = logFile(root2);
+  fs2.mkdirSync(logDir(root2), { recursive: true });
+  fs2.appendFileSync(file, out.map((e) => JSON.stringify(e)).join("\n") + "\n");
+  const text3 = fs2.readFileSync(file, "utf8");
+  const lines = text3.split("\n").filter(Boolean);
+  if (lines.length > MAX_LINES) {
+    const kept = lines.slice(-MAX_LINES / 2).join("\n") + "\n";
+    fs2.writeFileSync(file, kept);
+    const removed = Buffer.byteLength(text3) - Buffer.byteLength(kept);
+    const cursor = readCursor(root2);
+    if (cursor) writeCursor(root2, { reported: Math.max(0, cursor.reported - removed) });
+  }
+}
+function readCursor(root2) {
+  try {
+    const c = JSON.parse(fs2.readFileSync(cursorFile(root2), "utf8"));
+    return Number.isSafeInteger(c?.reported) && c.reported >= 0 ? { reported: c.reported } : null;
+  } catch {
+    return null;
+  }
+}
+function writeCursor(root2, c) {
+  fs2.mkdirSync(logDir(root2), { recursive: true });
+  fs2.writeFileSync(cursorFile(root2), JSON.stringify(c) + "\n");
+}
+var logSize = (root2) => fs2.existsSync(logFile(root2)) ? fs2.statSync(logFile(root2)).size : 0;
+function startSession(root2) {
+  writeCursor(root2, { reported: logSize(root2) });
+}
+function takeChanges(root2) {
+  const size = logSize(root2);
+  const cursor = readCursor(root2);
+  const from = cursor && cursor.reported <= size ? cursor.reported : size;
+  if (from === size) {
+    if (!cursor) writeCursor(root2, { reported: size });
+    return [];
+  }
+  const fd = fs2.openSync(logFile(root2), "r");
+  const buf = Buffer.alloc(size - from);
+  fs2.readSync(fd, buf, 0, buf.length, from);
+  fs2.closeSync(fd);
+  writeCursor(root2, { reported: size });
+  return buf.toString("utf8").split("\n").filter(Boolean).flatMap((l) => {
+    try {
+      const e = JSON.parse(l);
+      const str = (v) => typeof v === "string" ? v.slice(0, 2e3) : void 0;
+      if (e.kind !== "edit" && e.kind !== "comment" || typeof e.path !== "string") return [];
+      return [{ at: str(e.at) ?? "", path: e.path.slice(0, 500), kind: e.kind, section: str(e.section), author: str(e.author), quote: str(e.quote), text: str(e.text) }];
+    } catch {
+      return [];
+    }
+  });
+}
+function formatChanges(list) {
+  if (!list.length) return "";
+  const edits = /* @__PURE__ */ new Map();
+  for (const e of list.filter((e2) => e2.kind === "edit")) {
+    const sections = edits.get(e.path) ?? /* @__PURE__ */ new Set();
+    if (e.section) sections.add(e.section);
+    edits.set(e.path, sections);
+  }
+  const comments = list.filter((e) => e.kind === "comment");
+  const lines = ['markode: the user changed docs while you worked (see "While you work" in the markode skill).'];
+  if (edits.size) {
+    lines.push("", "Edited (re-read before working on that part; nothing to do otherwise):");
+    for (const [p3, s] of edits) lines.push(`- ${p3}${s.size ? ` (${[...s].map((x) => `"${x}"`).join(", ")})` : ""}`);
+  }
+  if (comments.length) {
+    lines.push("", "New comments (about your current work: reply below it and apply it; otherwise ask the user in one line whether to take it now):");
+    for (const c of comments) lines.push(`- ${c.path}${c.section ? ` \u203A "${c.section}"` : ""}${c.quote ? `, on "${c.quote}"` : ""}: ${c.text} (${c.author})`);
+  }
+  return lines.join("\n");
+}
+
+// src/core/check.ts
+import fs10 from "fs";
+import path10 from "path";
+
 // src/core/dashboard.ts
-import fs3 from "fs";
-import path3 from "path";
+import fs4 from "fs";
+import path4 from "path";
 import YAML from "yaml";
 
 // src/core/scan.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs3 from "fs";
+import path3 from "path";
 import ignore from "ignore";
 var ALWAYS_SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", ".markode", "dist", "build", ".next", ".turbo", "coverage", ".venv"]);
 var IGNORE_FILE = ".markodeignore";
 function loadIgnore(root2, file) {
   const ig = ignore();
   try {
-    ig.add(fs2.readFileSync(path2.join(root2, file), "utf8"));
+    ig.add(fs3.readFileSync(path3.join(root2, file), "utf8"));
   } catch {
   }
   return ig;
 }
 function readIgnoreList(root2) {
   try {
-    return fs2.readFileSync(path2.join(root2, IGNORE_FILE), "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+    return fs3.readFileSync(path3.join(root2, IGNORE_FILE), "utf8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
   } catch {
     return [];
   }
@@ -132,7 +330,8 @@ function setIgnored(root2, rel, kind, ignored) {
   const entry = kind === "dir" ? `${rel}/` : rel;
   const lines = readIgnoreList(root2).filter((l) => l !== entry && l !== rel);
   if (ignored) lines.push(entry);
-  fs2.writeFileSync(path2.join(root2, IGNORE_FILE), lines.length ? lines.join("\n") + "\n" : "");
+  assertInside(path3.join(root2, IGNORE_FILE));
+  fs3.writeFileSync(path3.join(root2, IGNORE_FILE), lines.length ? lines.join("\n") + "\n" : "");
 }
 function watchSkips(root2) {
   const gitIgnore = loadIgnore(root2, ".gitignore");
@@ -143,41 +342,46 @@ function watchSkips(root2) {
     return isDir2 !== true && gitIgnore.ignores(rel);
   };
 }
+var isArchive = (rel) => {
+  const parts = rel.split("/");
+  return parts[parts.length - 1] === "applied" && parts.slice(0, -1).includes("proposals");
+};
 function scanTree(root2) {
   const gitIgnore = loadIgnore(root2, ".gitignore");
   const mdIgnore = loadIgnore(root2, IGNORE_FILE);
-  function walk(dirAbs, parentIgnored) {
-    let entries;
+  function walk(dirAbs, parentIgnored, parentArchived) {
+    let entries2;
     try {
-      entries = fs2.readdirSync(dirAbs, { withFileTypes: true });
+      entries2 = fs3.readdirSync(dirAbs, { withFileTypes: true });
     } catch {
       return [];
     }
     const nodes = [];
-    for (const e of entries) {
+    for (const e of entries2) {
       if (ALWAYS_SKIP.has(e.name)) continue;
-      const abs = path2.join(dirAbs, e.name);
-      const rel = toPosix(path2.relative(root2, abs));
+      const abs = path3.join(dirAbs, e.name);
+      const rel = toPosix(path3.relative(root2, abs));
       if (e.isDirectory()) {
         if (gitIgnore.ignores(rel + "/")) continue;
-        const ignored = parentIgnored || mdIgnore.ignores(rel + "/");
-        const children = walk(abs, ignored);
+        const archived = parentArchived || isArchive(rel);
+        const ignored = parentIgnored || archived || mdIgnore.ignores(rel + "/");
+        const children = walk(abs, ignored, archived);
         if (!children.length && !isEmptyDir(abs)) continue;
         const project = MAIN_DOCS.some((d) => children.some((c) => c.kind === "file" && c.name === d));
-        nodes.push({ name: e.name, path: rel, kind: "dir", project: project || void 0, ignored: ignored || void 0, children });
+        nodes.push({ name: e.name, path: rel, kind: "dir", project: project || void 0, ignored: ignored || void 0, archived: archived || void 0, children });
       } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
         if (gitIgnore.ignores(rel)) continue;
         const ignored = parentIgnored || mdIgnore.ignores(rel);
-        nodes.push({ name: e.name, path: rel, kind: "file", ignored: ignored || void 0 });
+        nodes.push({ name: e.name, path: rel, kind: "file", ignored: ignored || void 0, archived: parentArchived || void 0 });
       }
     }
     return nodes.sort(compareNodes);
   }
-  return walk(root2, false);
+  return walk(root2, false, false);
 }
 function isEmptyDir(abs) {
   try {
-    return fs2.readdirSync(abs).length === 0;
+    return fs3.readdirSync(abs).length === 0;
   } catch {
     return false;
   }
@@ -219,12 +423,12 @@ var asText = (v) => v instanceof Date ? v.toISOString().slice(0, 10) : v == null
 function summarize(root2) {
   return flattenFiles(scanTree(root2)).flatMap((f) => {
     if (f.path.split("/").some((part) => part.startsWith("."))) return [];
-    const text3 = fs3.readFileSync(path3.join(root2, f.path), "utf8");
+    const text3 = fs4.readFileSync(path4.join(root2, f.path), "utf8");
     const meta = parseFrontmatter(text3);
     if (meta.type === "task" && f.name.startsWith("_")) return [];
     const id = asText(meta.id);
-    const total = text3.match(/^\s*[-*+] \[[ xX]\]/gm)?.length ?? 0;
-    const done = text3.match(/^\s*[-*+] \[[xX]\]/gm)?.length ?? 0;
+    const total = text3.match(/^[ \t]*[-*+] \[[ xX]\]/gm)?.length ?? 0;
+    const done = text3.match(/^[ \t]*[-*+] \[[xX]\]/gm)?.length ?? 0;
     const heading2 = text3.match(/^#\s+(.+)$/m)?.[1];
     const title = asText(meta.title) ?? (heading2 && id ? heading2.replace(new RegExp(`^${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*[\xB7:-]\\s*`), "") : heading2);
     return {
@@ -242,13 +446,13 @@ function summarize(root2) {
 }
 
 // src/core/method.ts
-import fs7 from "fs";
-import path7 from "path";
-import YAML2 from "yaml";
+import fs9 from "fs";
+import path9 from "path";
+import YAML3 from "yaml";
 
 // src/core/profile.ts
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path5 from "path";
 var KIND_LABEL = { app: "App", library: "Library", mobile: "Mobile", data: "Data / ML", infra: "Infrastructure" };
 var KIND_HINT = {
   app: "web, API, CLI, desktop",
@@ -266,16 +470,16 @@ var EXPERIMENTS_LABEL = {
 var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "coverage", "vendor", "target", ".git", ".venv", "venv"]);
 var names = (abs) => {
   try {
-    return fs4.readdirSync(abs, { withFileTypes: true });
+    return fs5.readdirSync(abs, { withFileTypes: true });
   } catch {
     return [];
   }
 };
 function find(abs, re, depth) {
   for (const e of names(abs)) {
-    if (re.test(e.name)) return path4.join(abs, e.name);
+    if (re.test(e.name)) return path5.join(abs, e.name);
     if (e.isDirectory() && depth > 0 && !SKIP.has(e.name) && !e.name.startsWith(".")) {
-      const hit = find(path4.join(abs, e.name), re, depth - 1);
+      const hit = find(path5.join(abs, e.name), re, depth - 1);
       if (hit) return hit;
     }
   }
@@ -283,14 +487,14 @@ function find(abs, re, depth) {
 }
 var read = (abs) => {
   try {
-    return fs4.readFileSync(abs, "utf8");
+    return fs5.readFileSync(abs, "utf8");
   } catch {
     return "";
   }
 };
 var readJson = (abs) => {
   try {
-    return JSON.parse(fs4.readFileSync(abs, "utf8"));
+    return JSON.parse(fs5.readFileSync(abs, "utf8"));
   } catch {
     return null;
   }
@@ -299,8 +503,8 @@ var APP_DEPS = ["next", "nuxt", "vite", "react-scripts", "@angular/core", "@svel
 function guessKind(dir) {
   const found = {};
   const add = (kind, why) => (found[kind] ??= []).push(why);
-  const has2 = (name) => fs4.existsSync(path4.join(dir, name));
-  const pkg = readJson(path4.join(dir, "package.json"));
+  const has2 = (name) => fs5.existsSync(path5.join(dir, name));
+  const pkg = readJson(path5.join(dir, "package.json"));
   const deps = { ...pkg?.dependencies, ...pkg?.devDependencies };
   if (has2("pubspec.yaml")) add("mobile", "Flutter (pubspec.yaml)");
   if (deps["react-native"] || deps.expo) add("mobile", "React Native");
@@ -312,7 +516,7 @@ function guessKind(dir) {
   if (has2("Pulumi.yaml")) add("infra", "Pulumi");
   if (find(dir, /^(Chart|kustomization)\.ya?ml$/, 2)) add("infra", "Helm / Kustomize");
   if (pkg && !pkg.private && !pkg.bin && (pkg.main || pkg.exports || pkg.module)) add("library", "package.json exports");
-  if (/^\[lib\]/m.test(read(path4.join(dir, "Cargo.toml")))) add("library", "Cargo [lib]");
+  if (/^\[lib\]/m.test(read(path5.join(dir, "Cargo.toml")))) add("library", "Cargo [lib]");
   if (pkg?.bin) add("app", "CLI (bin)");
   const framework = APP_DEPS.find((d) => deps[d]);
   if (framework) add("app", framework);
@@ -330,13 +534,13 @@ function guessKind(dir) {
 function findContracts(root2) {
   const hit = find(root2, /(\.proto|^openapi.*\.ya?ml|^openapi.*\.json|^asyncapi.*\.ya?ml)$/i, 3);
   if (!hit) return null;
-  const dir = path4.relative(root2, path4.dirname(hit)).split(path4.sep).join("/");
-  return dir ? `${dir}/` : path4.basename(hit);
+  const dir = path5.relative(root2, path5.dirname(hit)).split(path5.sep).join("/");
+  return dir ? `${dir}/` : path5.basename(hit);
 }
 var looksLikeMicroservices = (root2, projects) => projects >= 2 && (!!findContracts(root2) || !!find(root2, /^(docker-)?compose(\.[\w-]+)?\.ya?ml$/, 0));
 function detectProfile(dir, kind) {
-  const has2 = (name) => fs4.existsSync(path4.join(dir, name));
-  const pkg = readJson(path4.join(dir, "package.json"));
+  const has2 = (name) => fs5.existsSync(path5.join(dir, name));
+  const pkg = readJson(path5.join(dir, "package.json"));
   if (kind === "library") return { kind, published: !!pkg?.publishConfig || !!pkg?.name && !pkg.private };
   if (kind === "mobile") {
     const platforms = ["ios", "android", "web"].filter((p3) => has2(p3));
@@ -349,7 +553,7 @@ function detectProfile(dir, kind) {
   }
   if (kind === "infra") {
     const envDir = ["envs", "environments", "env"].find((d) => has2(d));
-    const envs = envDir ? names(path4.join(dir, envDir)).filter((e) => e.isDirectory()).map((e) => e.name) : [];
+    const envs = envDir ? names(path5.join(dir, envDir)).filter((e) => e.isDirectory()).map((e) => e.name) : [];
     return { kind, environments: envs.length ? envs.join(", ") : "dev, staging, prod" };
   }
   return { kind };
@@ -370,83 +574,88 @@ function kindGuidance(p3) {
 }
 var contractsGuidance = (contracts) => `Microservices: contracts (APIs, events) live in \`${contracts}\`. Changing one is a shared decision (\`docs/architecture/contracts.md\`) and every consumer gets a task.`;
 function existingDocs(root2) {
-  const docs = path4.join(root2, "docs");
+  const docs = path5.join(root2, "docs");
   const out = [];
   for (const e of names(docs)) {
     if (e.name.startsWith(".") || e.name === "tasks" || e.name === "proposals") continue;
     if (e.isFile() && e.name.toLowerCase().endsWith(".md")) out.push(`docs/${e.name}`);
-    else if (e.isDirectory() && find(path4.join(docs, e.name), /\.md$/i, 2)) out.push(`docs/${e.name}/`);
+    else if (e.isDirectory() && find(path5.join(docs, e.name), /\.md$/i, 2)) out.push(`docs/${e.name}/`);
   }
-  for (const adr of ["adr", "decisions"]) if (find(path4.join(root2, adr), /\.md$/i, 1)) out.push(`${adr}/`);
+  for (const adr of ["adr", "decisions"]) if (find(path5.join(root2, adr), /\.md$/i, 1)) out.push(`${adr}/`);
   return out.sort();
 }
 
 // src/core/scaffold.ts
-import fs5 from "fs";
-import path5 from "path";
+import fs6 from "fs";
+import path6 from "path";
 var today = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 function fill(text3, vars) {
   return text3.replace(/\{\{(\w+)\}\}/g, (_, k) => vars[k] ?? "");
 }
 function copyTree(src, dest, vars, created, root2) {
-  for (const e of fs5.readdirSync(src, { withFileTypes: true })) {
-    const from = path5.join(src, e.name);
-    const to = path5.join(dest, fill(e.name, vars));
+  for (const e of fs6.readdirSync(src, { withFileTypes: true })) {
+    const from = path6.join(src, e.name);
+    const to = path6.join(dest, fill(e.name, vars));
+    assertInside(to);
     if (e.isDirectory()) {
-      fs5.mkdirSync(to, { recursive: true });
+      fs6.mkdirSync(to, { recursive: true });
       copyTree(from, to, vars, created, root2);
-    } else if (!fs5.existsSync(to)) {
-      fs5.writeFileSync(to, fill(fs5.readFileSync(from, "utf8"), vars));
-      created.push(toPosix(path5.relative(root2, to)));
+    } else if (!fs6.existsSync(to)) {
+      fs6.writeFileSync(to, fill(fs6.readFileSync(from, "utf8"), vars));
+      created.push(toPosix(path6.relative(root2, to)));
     }
   }
 }
 function createMainDoc(root2, name) {
-  const file = path5.join(root2, name);
-  if (fs5.existsSync(file)) return;
-  const text3 = fs5.readFileSync(path5.join(TEMPLATES_DIR, "main.md"), "utf8");
-  fs5.writeFileSync(file, fill(text3, { name: path5.basename(root2), date: today() }));
-}
-function installSkill(root2) {
-  const dir = path5.join(root2, ".claude", "skills", "markode");
-  fs5.mkdirSync(dir, { recursive: true });
-  fs5.copyFileSync(path5.join(TEMPLATES_DIR, "skill", "SKILL.md"), path5.join(dir, "SKILL.md"));
-}
-function ensureGitignore(root2) {
-  const file = path5.join(root2, ".gitignore");
-  const text3 = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "";
-  if (text3.split("\n").some((l) => [".markode", ".markode/", "/.markode", "/.markode/"].includes(l.trim()))) return;
-  fs5.writeFileSync(file, text3 + (text3 && !text3.endsWith("\n") ? "\n" : "") + ".markode/\n");
+  const file = path6.join(root2, name);
+  if (fs6.existsSync(file)) return;
+  assertInside(file);
+  const text3 = fs6.readFileSync(path6.join(TEMPLATES_DIR, "main.md"), "utf8");
+  fs6.writeFileSync(file, fill(text3, { name: path6.basename(root2), date: today() }));
+}
+var vsCodeFile = (root2) => path6.join(root2, ".vscode", "settings.json");
+var HIDDEN = "**/.markode";
+function readVsCode(root2) {
+  if (!fs6.existsSync(vsCodeFile(root2))) return {};
+  try {
+    return JSON.parse(fs6.readFileSync(vsCodeFile(root2), "utf8"));
+  } catch {
+    return null;
+  }
 }
+var isHiddenInVsCode = (root2) => readVsCode(root2)?.["files.exclude"]?.[HIDDEN] === true;
 function hideInVsCode(root2) {
-  const file = path5.join(root2, ".vscode", "settings.json");
-  let settings = {};
-  if (fs5.existsSync(file)) {
-    try {
-      settings = JSON.parse(fs5.readFileSync(file, "utf8"));
-    } catch {
-      return false;
-    }
-  }
-  settings["files.exclude"] = { ...settings["files.exclude"] ?? {}, "**/.markode": true };
-  fs5.mkdirSync(path5.dirname(file), { recursive: true });
-  fs5.writeFileSync(file, JSON.stringify(settings, null, 2) + "\n");
+  const settings = readVsCode(root2);
+  if (!settings) return false;
+  assertInside(vsCodeFile(root2));
+  settings["files.exclude"] = { ...settings["files.exclude"] ?? {}, [HIDDEN]: true };
+  fs6.mkdirSync(path6.dirname(vsCodeFile(root2)), { recursive: true });
+  fs6.writeFileSync(vsCodeFile(root2), JSON.stringify(settings, null, 2) + "\n");
   return true;
 }
+function showInVsCode(root2) {
+  const settings = readVsCode(root2);
+  if (!settings?.["files.exclude"]?.[HIDDEN]) return;
+  delete settings["files.exclude"][HIDDEN];
+  if (!Object.keys(settings["files.exclude"]).length) delete settings["files.exclude"];
+  assertInside(vsCodeFile(root2));
+  fs6.writeFileSync(vsCodeFile(root2), JSON.stringify(settings, null, 2) + "\n");
+}
 function missingMainDocs(root2) {
   return ["", ...findSubprojects(scanTree(root2))].flatMap((dir) => {
-    const doc = missingMainDoc(path5.join(root2, dir));
-    return doc ? [{ path: path5.posix.join(dir, doc), pointsTo: doc === "CLAUDE.md" ? "AGENTS.md" : "CLAUDE.md" }] : [];
+    const doc = missingMainDoc(path6.join(root2, dir));
+    return doc ? [{ path: path6.posix.join(dir, doc), pointsTo: doc === "CLAUDE.md" ? "AGENTS.md" : "CLAUDE.md" }] : [];
   });
 }
 function linkMainDocs(root2) {
-  return missingMainDocs(root2).flatMap((m) => linkMainDoc(path5.join(root2, path5.posix.dirname(m.path))) ? [m.path] : []);
+  return missingMainDocs(root2).flatMap((m) => linkMainDoc(path6.join(root2, path6.posix.dirname(m.path))) ? [m.path] : []);
 }
 
 // src/core/sdd.ts
 import { spawnSync } from "child_process";
-import fs6 from "fs";
-import path6 from "path";
+import fs7 from "fs";
+import os2 from "os";
+import path7 from "path";
 var SDD_AGENTS = {
   claude: { label: "Claude Code", openspec: "claude", speckit: "claude" },
   codex: { label: "Codex", openspec: "codex", speckit: "codex" },
@@ -457,11 +666,11 @@ var SDD_AGENTS = {
 var OPENSPEC_PKG = "@fission-ai/openspec@latest";
 var SPECKIT_SRC = "git+https://github.com/github/spec-kit.git";
 function detectWorkflow(root2) {
-  if (fs6.existsSync(path6.join(root2, "openspec"))) return "openspec";
-  if (fs6.existsSync(path6.join(root2, ".specify"))) return "speckit";
+  if (fs7.existsSync(path7.join(root2, "openspec"))) return "openspec";
+  if (fs7.existsSync(path7.join(root2, ".specify"))) return "speckit";
   return null;
 }
-var has = (cmd) => spawnSync(cmd, ["--version"], { stdio: "ignore", shell: process.platform === "win32" }).status === 0;
+var has = (cmd) => spawnSync(cmd, ["--version"], { cwd: os2.homedir(), stdio: "ignore", shell: process.platform === "win32" }).status === 0;
 var hasUv = () => has("uvx");
 function installCommand(workflow, agents) {
   if (workflow === "openspec") {
@@ -482,11 +691,11 @@ function installWorkflow(root2, workflow, agents, official) {
     else result.error = (run.error?.message ?? `${run.stderr ?? ""}
 ${run.stdout ?? ""}`).trim().split("\n").slice(-6).join("\n");
   }
-  copyTree(path6.join(TEMPLATES_DIR, "sdd", workflow), root2, { date: today2() }, result.created, root2);
+  copyTree(path7.join(TEMPLATES_DIR, "sdd", workflow), root2, { date: today2() }, result.created, root2);
   const dirs2 = /* @__PURE__ */ new Set();
   for (const f of flattenFiles(scanTree(root2), true)) {
     if (before.has(f.path) || !f.path.startsWith(".") || f.path.startsWith(".specify/memory/")) continue;
-    dirs2.add(path6.posix.dirname(f.path));
+    dirs2.add(path7.posix.dirname(f.path));
   }
   for (const dir of dirs2) setIgnored(root2, dir, "dir", true);
   result.ignored = [...dirs2].sort();
@@ -520,87 +729,89 @@ function applyWorkflowToFile(file, workflow, text3) {
 function writeManagedBlock(file, body, top = false, name = "workflow") {
   const START2 = `<!-- markode:${name}:start -->`;
   const END2 = `<!-- markode:${name}:end -->`;
-  const text3 = fs6.readFileSync(file, "utf8");
+  assertInside(file);
+  const text3 = fs7.readFileSync(file, "utf8");
   const s = text3.indexOf(START2);
   const e = text3.indexOf(END2);
   const existing = s >= 0 && e > s ? text3.slice(s, e + END2.length) : null;
   if (body === null) {
-    if (existing) fs6.writeFileSync(file, text3.replace(new RegExp(`\\n*${escapeRe(existing)}\\n?`), "\n"));
+    if (existing) fs7.writeFileSync(file, text3.replace(new RegExp(`\\n*${escapeRe(existing)}\\n?`), "\n"));
     return;
   }
   const section2 = `${START2}
 ${body}
 ${END2}`;
-  if (existing) return fs6.writeFileSync(file, text3.replace(existing, () => section2));
+  if (existing === section2) return;
+  if (existing) return fs7.writeFileSync(file, text3.replace(existing, () => section2));
   const title = top ? /^# .*\n/m.exec(text3) : null;
-  if (title) return fs6.writeFileSync(file, text3.slice(0, title.index + title[0].length) + "\n" + section2 + "\n" + text3.slice(title.index + title[0].length));
-  fs6.writeFileSync(file, text3.replace(/\s*$/, "") + "\n\n" + section2 + "\n");
+  if (title) return fs7.writeFileSync(file, text3.slice(0, title.index + title[0].length) + "\n" + section2 + "\n" + text3.slice(title.index + title[0].length));
+  fs7.writeFileSync(file, text3.replace(/\s*$/, "") + "\n\n" + section2 + "\n");
 }
 var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var dirs = (abs) => {
   try {
-    return fs6.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort();
+    return fs7.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort();
   } catch {
     return [];
   }
 };
 var read2 = (abs) => {
   try {
-    return fs6.readFileSync(abs, "utf8");
+    return fs7.readFileSync(abs, "utf8");
   } catch {
     return null;
   }
 };
-var progress = (text3) => ({ done: text3?.match(/^\s*[-*+] \[[xX]\]/gm)?.length ?? 0, total: text3?.match(/^\s*[-*+] \[[ xX]\]/gm)?.length ?? 0 });
+var progress = (text3) => ({ done: text3?.match(/^[ \t]*[-*+] \[[xX]\]/gm)?.length ?? 0, total: text3?.match(/^[ \t]*[-*+] \[[ xX]\]/gm)?.length ?? 0 });
 var heading = (text3) => text3?.match(/^#\s+(.+)$/m)?.[1].trim() ?? null;
 var countSpecs = (abs) => {
   try {
-    return fs6.readdirSync(abs, { recursive: true }).filter((f) => String(f).endsWith("spec.md")).length;
+    return fs7.readdirSync(abs, { recursive: true }).filter((f) => String(f).endsWith("spec.md")).length;
   } catch {
     return 0;
   }
 };
 function summarizeSdd(root2) {
   const out = {};
-  const os3 = path6.join(root2, "openspec");
-  if (fs6.existsSync(os3)) {
-    const rel = (...p3) => toPosix(path6.join("openspec", ...p3));
+  const os5 = path7.join(root2, "openspec");
+  if (fs7.existsSync(os5)) {
+    const rel = (...p3) => toPosix(path7.join("openspec", ...p3));
     out.openspec = {
-      changes: dirs(path6.join(os3, "changes")).filter((id) => id !== "archive").map((id) => {
-        const dir = path6.join(os3, "changes", id);
-        const proposal = read2(path6.join(dir, "proposal.md"));
-        const tasks = read2(path6.join(dir, "tasks.md"));
+      changes: dirs(path7.join(os5, "changes")).filter((id) => id !== "archive").map((id) => {
+        const dir = path7.join(os5, "changes", id);
+        const proposal = read2(path7.join(dir, "proposal.md"));
+        const tasks = read2(path7.join(dir, "tasks.md"));
         return {
           id,
           // "Proposal: Add login" → "Add login"
           title: heading(proposal)?.replace(/^(change\s+)?proposal:\s*/i, "") ?? id,
           path: rel("changes", id, proposal !== null ? "proposal.md" : "tasks.md"),
-          artifacts: { proposal: proposal !== null, design: fs6.existsSync(path6.join(dir, "design.md")), tasks: tasks !== null, specs: countSpecs(path6.join(dir, "specs")) },
+          artifacts: { proposal: proposal !== null, design: fs7.existsSync(path7.join(dir, "design.md")), tasks: tasks !== null, specs: countSpecs(path7.join(dir, "specs")) },
           tasks: progress(tasks)
         };
       }),
-      specs: dirs(path6.join(os3, "specs")).filter((id) => fs6.existsSync(path6.join(os3, "specs", id, "spec.md"))).map((id) => ({ id, path: rel("specs", id, "spec.md") })),
-      archived: dirs(path6.join(os3, "changes", "archive")).reverse().slice(0, 12).map((id) => {
-        const file = ["proposal.md", "tasks.md"].find((f) => fs6.existsSync(path6.join(os3, "changes", "archive", id, f)));
+      specs: dirs(path7.join(os5, "specs")).filter((id) => fs7.existsSync(path7.join(os5, "specs", id, "spec.md"))).map((id) => ({ id, path: rel("specs", id, "spec.md") })),
+      archived: dirs(path7.join(os5, "changes", "archive")).reverse().slice(0, 12).map((id) => {
+        const file = ["proposal.md", "tasks.md"].find((f) => fs7.existsSync(path7.join(os5, "changes", "archive", id, f)));
         return { id, path: file ? rel("changes", "archive", id, file) : "" };
       })
     };
   }
-  if (fs6.existsSync(path6.join(root2, ".specify"))) {
-    const constitution = read2(path6.join(root2, ".specify", "memory", "constitution.md"));
+  if (fs7.existsSync(path7.join(root2, ".specify"))) {
+    const constitution = read2(path7.join(root2, ".specify", "memory", "constitution.md"));
     out.speckit = {
       // The template is full of [PLACEHOLDERS] until /speckit-constitution fills it.
       constitution: constitution === null ? null : { path: ".specify/memory/constitution.md", filled: !/\[[A-Z_0-9]+\]/.test(constitution) },
-      features: dirs(path6.join(root2, "specs")).map((id) => {
-        const dir = path6.join(root2, "specs", id);
-        const spec = read2(path6.join(dir, "spec.md"));
-        const tasks = read2(path6.join(dir, "tasks.md"));
+      features: dirs(path7.join(root2, "specs")).map((id) => {
+        const dir = path7.join(root2, "specs", id);
+        const spec = read2(path7.join(dir, "spec.md"));
+        const tasks = read2(path7.join(dir, "tasks.md"));
         return {
           id,
           // "Feature Specification: Login" → "Login"
           title: heading(spec)?.replace(/^feature specification:\s*/i, "") ?? id,
-          path: toPosix(path6.join("specs", id, spec !== null ? "spec.md" : "plan.md")),
-          artifacts: { spec: spec !== null, plan: fs6.existsSync(path6.join(dir, "plan.md")), tasks: tasks !== null },
+          path: toPosix(path7.join("specs", id, spec !== null ? "spec.md" : "plan.md")),
+          artifacts: { spec: spec !== null, plan: fs7.existsSync(path7.join(dir, "plan.md")), tasks: tasks !== null },
           tasks: progress(tasks)
         };
       })
@@ -612,27 +823,181 @@ function sddPrefixes(summary) {
   return [...summary.openspec ? ["openspec/"] : [], ...summary.speckit ? ["specs/", ".specify/"] : []];
 }
 
+// src/core/skills.ts
+import fs8 from "fs";
+import os3 from "os";
+import path8 from "path";
+import YAML2 from "yaml";
+var SOURCE_DIRS = {
+  claude: [".claude", "skills"],
+  // Shared folder read by Codex, Copilot and Gemini CLI, and where `npx skills` installs.
+  agents: [".agents", "skills"],
+  codex: [".codex", "skills"],
+  gemini: [".gemini", "skills"],
+  copilot: [".copilot", "skills"],
+  cursor: [".cursor", "skills"]
+};
+var PROJECT_TARGETS = { claude: ".claude/skills", agents: ".agents/skills" };
+var READS = { claude: ["claude"], agents: ["agents", "codex", "gemini", "copilot", "cursor"] };
+var sourceDir = (source) => path8.join(os3.homedir(), ...SOURCE_DIRS[source]);
+var display = (p3) => p3.startsWith(os3.homedir() + path8.sep) ? "~" + p3.slice(os3.homedir().length) : p3;
+function skillSources() {
+  return Object.keys(SOURCE_DIRS).map((id) => ({ id, path: display(sourceDir(id)), exists: fs8.existsSync(sourceDir(id)) }));
+}
+var tagsFile = () => path8.join(GLOBAL_DIR, "skills.json");
+function readTags() {
+  try {
+    return JSON.parse(fs8.readFileSync(tagsFile(), "utf8")).tags ?? {};
+  } catch {
+    return {};
+  }
+}
+function setSkillTags(name, tags) {
+  const all = readTags();
+  const clean = [...new Set(tags.map((t) => t.trim().toLowerCase()).filter(Boolean))];
+  if (clean.length) all[name] = clean;
+  else delete all[name];
+  fs8.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs8.writeFileSync(tagsFile(), JSON.stringify({ tags: all }, null, 2) + "\n");
+  return clean;
+}
+function findSkills(dir, source, managed, depth = 0) {
+  let entries2;
+  try {
+    entries2 = fs8.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries2.flatMap((e) => {
+    const abs = path8.join(dir, e.name);
+    let real;
+    try {
+      if (!fs8.statSync(abs).isDirectory()) return [];
+      real = fs8.realpathSync(abs);
+    } catch {
+      return [];
+    }
+    if (fs8.existsSync(path8.join(abs, "SKILL.md"))) return [{ dir: abs, real, source, managed }];
+    return depth < 2 ? findSkills(abs, source, managed || e.name === "synced" || e.name.startsWith("."), depth + 1) : [];
+  });
+}
+function frontmatter(text3) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text3);
+  if (!m) return null;
+  try {
+    const data = YAML2.parse(m[1], { logLevel: "error" });
+    return data && typeof data === "object" ? data : null;
+  } catch {
+    return null;
+  }
+}
+function listFiles(dir) {
+  try {
+    return fs8.readdirSync(dir, { recursive: true, withFileTypes: true }).map((e) => ({ e, rel: path8.relative(dir, path8.join(e.parentPath ?? e.path ?? dir, e.name)).split(path8.sep).join("/") })).filter(({ e, rel }) => e.isFile() && rel !== "SKILL.md").map(({ rel }) => rel).sort().slice(0, 100);
+  } catch {
+    return [];
+  }
+}
+function listSkills(root2) {
+  const byReal = /* @__PURE__ */ new Map();
+  for (const source of Object.keys(SOURCE_DIRS)) {
+    for (const f of findSkills(sourceDir(source), source, false)) byReal.set(f.real, [...byReal.get(f.real) ?? [], f]);
+  }
+  const userTags = readTags();
+  const used = projectTargets(root2);
+  const skills = [];
+  for (const [real, found] of byReal) {
+    const text3 = fs8.readFileSync(path8.join(real, "SKILL.md"), "utf8");
+    const fm = frontmatter(text3);
+    const folder = path8.basename(found[0].dir);
+    const name = typeof fm?.name === "string" ? fm.name : folder;
+    const description = typeof fm?.description === "string" ? fm.description.trim() : "";
+    const issues = [];
+    if (!fm) issues.push("frontmatter");
+    else {
+      if (typeof fm.name !== "string" || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(fm.name) || fm.name.length > 64) issues.push("name");
+      else if (fm.name !== folder) issues.push("name-dir");
+      if (!description) issues.push("description");
+      else if (description.length > 1024) issues.push("description-long");
+    }
+    const installed = Object.keys(PROJECT_TARGETS).filter((t) => fs8.existsSync(path8.join(root2, PROJECT_TARGETS[t], folder, "SKILL.md")));
+    const declared = fm?.metadata?.tags;
+    const metaTags = Array.isArray(declared) ? declared.map(String) : typeof declared === "string" ? declared.split(",") : [];
+    skills.push({
+      key: real,
+      name,
+      folder,
+      description,
+      locations: found.map((f) => ({ source: f.source, path: display(f.dir) })),
+      managed: found.every((f) => f.managed),
+      files: listFiles(real),
+      tags: [.../* @__PURE__ */ new Set([...userTags[name] ?? [], ...metaTags.map((t) => t.trim().toLowerCase()).filter(Boolean)])],
+      issues,
+      installed,
+      status: Object.fromEntries(
+        used.map((t) => {
+          const global = found.some((f) => READS[t].includes(f.source));
+          const local = installed.includes(t);
+          return [t, global && local ? "both" : global ? "global" : local ? "project" : "missing"];
+        })
+      ),
+      differs: installed.filter((t) => {
+        try {
+          return fs8.readFileSync(path8.join(root2, PROJECT_TARGETS[t], folder, "SKILL.md"), "utf8") !== text3;
+        } catch {
+          return false;
+        }
+      })
+    });
+  }
+  return skills.sort((a, b) => a.name.localeCompare(b.name));
+}
+function getSkill(root2, key) {
+  const skill = typeof key === "string" ? listSkills(root2).find((s) => s.key === key) : void 0;
+  if (!skill) throw Object.assign(new Error("Skill not found"), { code: "ENOENT" });
+  return skill;
+}
+function projectTargets(root2) {
+  const has2 = (p3) => fs8.existsSync(path8.join(root2, p3));
+  const out = [];
+  if (has2(".claude") || has2("CLAUDE.md")) out.push("claude");
+  if (has2(".agents") || has2("AGENTS.md") || has2(".codex") || has2(".gemini") || has2(".github/skills")) out.push("agents");
+  return out.length ? out : ["claude"];
+}
+function installSkill(root2, skill, targets, overwrite) {
+  const dests = targets.map((t) => path8.join(root2, PROJECT_TARGETS[t], skill.folder));
+  const existing = dests.filter((d) => fs8.existsSync(d));
+  if (existing.length && !overwrite) return { conflict: existing.map((d) => path8.relative(root2, d).split(path8.sep).join("/")) };
+  for (const dest of dests) {
+    assertInside(dest, root2);
+    fs8.rmSync(dest, { recursive: true, force: true });
+    fs8.mkdirSync(path8.dirname(dest), { recursive: true });
+    fs8.cpSync(skill.key, dest, { recursive: true, dereference: true });
+  }
+  return { ok: true };
+}
+
 // src/core/method.ts
 var SKIP2 = /* @__PURE__ */ new Set(["docs", "node_modules", "dist", "build", "coverage", "tmp", "vendor", "target"]);
 var MANIFESTS = ["package.json", "pyproject.toml", "go.mod", "Cargo.toml", "pom.xml", "build.gradle", "build.gradle.kts", "composer.json", "Gemfile", "deno.json", ".git"];
-var isDir = (abs) => !!fs7.statSync(abs, { throwIfNoEntry: false })?.isDirectory();
+var isDir = (abs) => !!fs9.statSync(abs, { throwIfNoEntry: false })?.isDirectory();
 var subdirs = (abs) => {
   try {
-    return fs7.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !SKIP2.has(e.name)).map((e) => e.name);
+    return fs9.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !SKIP2.has(e.name)).map((e) => e.name);
   } catch {
     return [];
   }
 };
-var isProject = (abs) => MANIFESTS.some((m) => fs7.existsSync(path7.join(abs, m)));
+var isProject = (abs) => MANIFESTS.some((m) => fs9.existsSync(path9.join(abs, m)));
 function detectAreas(root2) {
   const globs = [];
   try {
-    const ws = YAML2.parse(fs7.readFileSync(path7.join(root2, "pnpm-workspace.yaml"), "utf8"), { logLevel: "error" });
+    const ws = YAML3.parse(fs9.readFileSync(path9.join(root2, "pnpm-workspace.yaml"), "utf8"), { logLevel: "error" });
     if (Array.isArray(ws?.packages)) globs.push(...ws.packages);
   } catch {
   }
   try {
-    const ws = JSON.parse(fs7.readFileSync(path7.join(root2, "package.json"), "utf8")).workspaces;
+    const ws = JSON.parse(fs9.readFileSync(path9.join(root2, "package.json"), "utf8")).workspaces;
     globs.push(...Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : []);
   } catch {
   }
@@ -643,25 +1008,25 @@ function detectAreas(root2) {
     const base = g.replace(/\/\*\*?$/, "");
     if (base.includes("*")) continue;
     if (base === g) found.add(g);
-    else for (const name of subdirs(path7.join(root2, base))) found.add(`${base}/${name}`);
+    else for (const name of subdirs(path9.join(root2, base))) found.add(`${base}/${name}`);
   }
   if (!isProject(root2)) {
     for (const top of subdirs(root2)) {
-      if (isProject(path7.join(root2, top))) found.add(top);
-      else for (const name of subdirs(path7.join(root2, top))) if (isProject(path7.join(root2, top, name))) found.add(`${top}/${name}`);
+      if (isProject(path9.join(root2, top))) found.add(top);
+      else for (const name of subdirs(path9.join(root2, top))) if (isProject(path9.join(root2, top, name))) found.add(`${top}/${name}`);
     }
   }
   let unsure = false;
   if (!globs.length && isProject(root2)) {
-    const tops = subdirs(root2).filter((top) => isProject(path7.join(root2, top)));
+    const tops = subdirs(root2).filter((top) => isProject(path9.join(root2, top)));
     if (tops.length >= 2 && tops.some((t) => !found.has(t))) tops.forEach((t) => found.add(t)), unsure = true;
   }
-  const dirs2 = [...found].filter((d) => d && !d.split("/").some((part) => part.startsWith(".") || SKIP2.has(part)) && isDir(path7.join(root2, d)));
+  const dirs2 = [...found].filter((d) => d && !d.split("/").some((part) => part.startsWith(".") || SKIP2.has(part)) && isDir(path9.join(root2, d)));
   return { dirs: dirs2.filter((d) => !dirs2.some((o) => o.startsWith(d + "/"))).sort(), unsure };
 }
 function areaDescription(root2, dir) {
   try {
-    return String(JSON.parse(fs7.readFileSync(path7.join(root2, dir, "package.json"), "utf8")).description ?? "").trim();
+    return String(JSON.parse(fs9.readFileSync(path9.join(root2, dir, "package.json"), "utf8")).description ?? "").trim();
   } catch {
     return "";
   }
@@ -686,7 +1051,7 @@ var KNOWN_PREFIXES = {
   scripts: "SCR"
 };
 function suggestPrefix(dir, used) {
-  dir = path7.posix.basename(dir);
+  dir = path9.posix.basename(dir);
   const base = KNOWN_PREFIXES[dir.toLowerCase()] ?? (dir.replace(/[^a-z0-9]/gi, "").slice(0, 3).toUpperCase() || "AREA");
   let prefix = base;
   for (let i = 2; used.has(prefix) || prefix === "CORE"; i++) prefix = `${base}${i}`;
@@ -696,24 +1061,25 @@ function suggestPrefix(dir, used) {
 var rootPrefix = (areas) => areas.length ? "CORE" : "T";
 function scaffoldMethod(root2, mainDoc, areas) {
   const created = [];
-  const name = path7.basename(root2);
-  copyTree(path7.join(TEMPLATES_DIR, "method", "root"), root2, { date: today(), name, prefix: rootPrefix(areas), area: areas.length ? "core" : name }, created, root2);
+  const name = path9.basename(root2);
+  copyTree(path9.join(TEMPLATES_DIR, "method", "root"), root2, { date: today(), name, prefix: rootPrefix(areas), area: areas.length ? "core" : name }, created, root2);
   for (const a of areas) {
     const vars = { date: today(), name, prefix: a.prefix, area: a.dir, up: "../".repeat(a.dir.split("/").length) };
-    const dir = path7.join(root2, a.dir);
-    copyTree(path7.join(TEMPLATES_DIR, "method", "area"), dir, vars, created, root2);
+    const dir = path9.join(root2, a.dir);
+    copyTree(path9.join(TEMPLATES_DIR, "method", "area"), dir, vars, created, root2);
     let doc = contentDoc(dir);
     if (!doc) {
-      doc = path7.join(dir, mainDoc);
-      fs7.writeFileSync(doc, fill(fs7.readFileSync(path7.join(TEMPLATES_DIR, "method", "area-main.md"), "utf8"), vars));
-      created.push(path7.posix.join(a.dir, mainDoc));
+      doc = path9.join(dir, mainDoc);
+      assertInside(doc);
+      fs9.writeFileSync(doc, fill(fs9.readFileSync(path9.join(TEMPLATES_DIR, "method", "area-main.md"), "utf8"), vars));
+      created.push(path9.posix.join(a.dir, mainDoc));
     }
-    if (claudeUsed(root2, mainDoc) && linkAgentsDoc(dir)) created.push(path7.posix.join(a.dir, "CLAUDE.md"));
+    if (claudeUsed(root2, mainDoc) && linkAgentsDoc(dir)) created.push(path9.posix.join(a.dir, "CLAUDE.md"));
     writeManagedBlock(doc, areaBlock(a, vars.up, mainDoc), true);
   }
   return created;
 }
-var claudeUsed = (root2, mainDoc) => mainDoc === "CLAUDE.md" || fs7.existsSync(path7.join(root2, "CLAUDE.md"));
+var claudeUsed = (root2, mainDoc) => mainDoc === "CLAUDE.md" || fs9.existsSync(path9.join(root2, "CLAUDE.md"));
 function areaBlock(a, up, mainDoc) {
   const guidance = a.profile && kindGuidance(a.profile);
   return [
@@ -778,8 +1144,25 @@ function methodSection(areas, root2, ctx = {}) {
   ].join("\n");
 }
 function installMethodSkills(root2) {
-  const src = path7.join(TEMPLATES_DIR, "method", "skills");
-  for (const name of fs7.readdirSync(src)) fs7.cpSync(path7.join(src, name), path7.join(root2, ".claude", "skills", name), { recursive: true });
+  const src = path9.join(TEMPLATES_DIR, "method", "skills");
+  for (const target of projectTargets(root2))
+    for (const name of fs9.readdirSync(src)) {
+      const dest = path9.join(root2, PROJECT_TARGETS[target], name);
+      assertInside(dest);
+      fs9.cpSync(path9.join(src, name), dest, { recursive: true });
+    }
+}
+function setupMethod(root2, mainDoc, monorepo) {
+  const used = /* @__PURE__ */ new Set();
+  const areas = monorepo === "single" ? [] : detectAreas(root2).dirs.map((dir) => ({ dir, prefix: suggestPrefix(dir, used) }));
+  for (const a of areas) a.profile = detectProfile(path9.join(root2, a.dir), guessKind(path9.join(root2, a.dir)).kind);
+  const contracts = looksLikeMicroservices(root2, areas.length) ? findContracts(root2) : null;
+  const profile = areas.length ? void 0 : detectProfile(root2, guessKind(root2).kind);
+  const existing = existingDocs(root2);
+  const created = scaffoldMethod(root2, mainDoc, areas);
+  installMethodSkills(root2);
+  applyWorkflowToFile(path9.join(root2, mainDoc), "markode", methodSection(areas, root2, { profile, contracts, existing }));
+  return { created, areas };
 }
 
 // src/core/check.ts
@@ -788,13 +1171,13 @@ var LINK = /!?\[[^\]]*\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g;
 function checkDocs(root2) {
   const docs = summarize(root2);
   const status = new Map(docs.map((d) => [d.path, d.status ?? ""]));
-  const read3 = (rel) => fs8.readFileSync(path8.join(root2, rel), "utf8");
+  const read3 = (rel) => fs10.readFileSync(path10.join(root2, rel), "utf8");
   const phases = [];
   for (const phase of docs.filter((d) => d.type === "phase")) {
     for (const line of read3(phase.path).split("\n")) {
       const m = TASK_LINE.exec(line);
       if (!m) continue;
-      const task = path8.posix.normalize(path8.posix.join(path8.posix.dirname(phase.path), m[2].split("#")[0]));
+      const task = path10.posix.normalize(path10.posix.join(path10.posix.dirname(phase.path), m[2].split("#")[0]));
       const s = status.get(task);
       if (s === void 0) continue;
       const ticked = m[1] !== " ";
@@ -811,7 +1194,7 @@ function checkDocs(root2) {
         const target = m[1];
         if (/^[a-z][\w+.-]*:|^#|^\/|[<{]/i.test(target)) continue;
         const file = decodeURIComponent(target.split(/[#?]/)[0]);
-        if (file && !fs8.existsSync(path8.join(root2, path8.dirname(doc.path), file))) links.push({ file: doc.path, line: i + 1, target });
+        if (file && !fs10.existsSync(path10.join(root2, path10.dirname(doc.path), file))) links.push({ file: doc.path, line: i + 1, target });
       }
     });
   }
@@ -820,49 +1203,83 @@ function checkDocs(root2) {
 function projectsTable(root2) {
   const doc = mainDocOf(root2);
   if (!doc) return null;
-  const text3 = fs8.readFileSync(path8.join(root2, doc), "utf8");
+  const text3 = fs10.readFileSync(path10.join(root2, doc), "utf8");
   const section2 = /^### Projects\n([\s\S]*?)(?=^#{1,3} |<!-- markode:workflow:end -->)/m.exec(text3)?.[1];
   if (!section2) return null;
   const listed = [...section2.matchAll(/^\|\s*`([^`]+?)\/?`\s*\|/gm)].map((m) => m[1]).filter((d) => d !== "docs");
   const found = detectAreas(root2).dirs;
-  return { missing: found.filter((d) => !listed.includes(d)), gone: listed.filter((d) => !fs8.existsSync(path8.join(root2, d))) };
+  return { missing: found.filter((d) => !listed.includes(d)), gone: listed.filter((d) => !fs10.existsSync(path10.join(root2, d))) };
 }
 
 // src/core/defaults.ts
-import fs9 from "fs";
-import path9 from "path";
-var BASE_DEFAULTS = {
-  mode: "ask",
-  mainDoc: "CLAUDE.md",
-  workflow: "none",
-  agents: ["claude"],
-  monorepo: "per-project",
-  sourceLang: "en",
-  rules: [],
-  rulesInSubprojects: false,
-  hideInVsCode: true
+import fs15 from "fs";
+import path15 from "path";
+
+// src/core/features.ts
+import fs14 from "fs";
+import path14 from "path";
+
+// src/core/hooks.ts
+import fs11 from "fs";
+import path11 from "path";
+var EVENTS = {
+  SessionStart: "changes --start",
+  UserPromptSubmit: "changes --hook UserPromptSubmit",
+  PostToolUse: "changes --hook PostToolUse"
 };
-var defaultsFile = () => path9.join(GLOBAL_DIR, "defaults.json");
-function readDefaults() {
+var LOCAL = "settings.local.json";
+var SHARED = "settings.json";
+var settingsFile2 = (root2, name = LOCAL) => path11.join(root2, ".claude", name);
+function cli() {
+  const dirs2 = (process.env.PATH ?? "").split(path11.delimiter).filter(Boolean);
+  if (dirs2.some((d) => ["markode", "markode.cmd"].some((f) => fs11.existsSync(path11.join(d, f))))) return "markode";
+  const name = JSON.parse(fs11.readFileSync(path11.join(PKG_ROOT, "package.json"), "utf8")).name;
+  return `npx -y --prefer-offline ${name}`;
+}
+var isOurs = (entry) => Array.isArray(entry?.hooks) && entry.hooks.some((h) => typeof h?.command === "string" && / changes --(start|hook)\b/.test(h.command));
+function readSettings2(root2, name = LOCAL) {
+  const file = settingsFile2(root2, name);
+  if (!fs11.existsSync(file)) return {};
   try {
-    const saved = { ...BASE_DEFAULTS, ...JSON.parse(fs9.readFileSync(defaultsFile(), "utf8")) };
-    if (!isLang(saved.sourceLang)) saved.sourceLang = BASE_DEFAULTS.sourceLang;
-    if (!MAIN_DOCS.includes(saved.mainDoc)) saved.mainDoc = BASE_DEFAULTS.mainDoc;
-    if (saved.monorepo !== "single") saved.monorepo = "per-project";
-    return saved;
+    return JSON.parse(fs11.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
-function writeDefaults(defaults2) {
-  fs9.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs9.writeFileSync(defaultsFile(), JSON.stringify(defaults2, null, 2) + "\n");
+function hasClaudeHooks(root2) {
+  return [LOCAL, SHARED].some((name) => {
+    const hooks = readSettings2(root2, name)?.hooks ?? {};
+    return Object.keys(EVENTS).every((e) => (hooks[e] ?? []).some(isOurs));
+  });
+}
+function writeHooks(root2, name, add) {
+  const settings = readSettings2(root2, name);
+  if (!settings) return false;
+  if (!add && !fs11.existsSync(settingsFile2(root2, name))) return true;
+  const base = cli();
+  settings.hooks ??= {};
+  for (const [event, args2] of Object.entries(EVENTS)) {
+    const list = (settings.hooks[event] ?? []).filter((e) => !isOurs(e));
+    if (add) list.push({ hooks: [{ type: "command", command: `${base} ${args2}` }] });
+    if (list.length) settings.hooks[event] = list;
+    else delete settings.hooks[event];
+  }
+  if (!Object.keys(settings.hooks).length) delete settings.hooks;
+  assertInside(settingsFile2(root2, name));
+  if (!Object.keys(settings).length) return fs11.rmSync(settingsFile2(root2, name), { force: true }), true;
+  fs11.mkdirSync(path11.dirname(settingsFile2(root2, name)), { recursive: true });
+  fs11.writeFileSync(settingsFile2(root2, name), JSON.stringify(settings, null, 2) + "\n");
+  return true;
+}
+function installClaudeHooks(root2) {
+  if (!writeHooks(root2, LOCAL, true)) return false;
+  writeHooks(root2, SHARED, false);
+  return true;
+}
+function removeClaudeHooks(root2) {
+  writeHooks(root2, LOCAL, false);
+  writeHooks(root2, SHARED, false);
 }
-
-// src/core/i18n.ts
-import crypto from "crypto";
-import fs11 from "fs";
-import path11 from "path";
 
 // src/core/langdetect.ts
 var STOPWORDS = {
@@ -874,8 +1291,20 @@ var STOPWORDS = {
   it: ["il", "lo", "la", "gli", "le", "di", "del", "della", "che", "e", "\xE8", "un", "una", "per", "con", "non", "sono", "si", "come", "al", "alla", "pi\xF9", "ma", "suo", "questo", "questa", "quando", "ogni", "deve", "anche"]
 };
 var SETS = Object.fromEntries(Object.entries(STOPWORDS).map(([l, w]) => [l, new Set(w)]));
+function cut(text3, open2, close) {
+  let out = "";
+  let i = 0;
+  for (; ; ) {
+    const s = text3.indexOf(open2, i);
+    const e = s < 0 ? -1 : text3.indexOf(close, s + open2.length);
+    if (e < 0) return out + text3.slice(i);
+    out += text3.slice(i, s) + " ";
+    i = e + close.length;
+  }
+}
+var SAMPLE = 2e5;
 function prose(md) {
-  return md.replace(/^---\r?\n[\s\S]*?\r?\n---/, " ").replace(/```[\s\S]*?```/g, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/`[^`]*`/g, " ").replace(/\]\([^)]*\)/g, " ").replace(/https?:\/\/\S+/g, " ").replace(/[|#>*_\-[\]()]/g, " ");
+  return cut(cut(md.slice(0, SAMPLE).replace(/^---\r?\n[\s\S]*?\r?\n---/, " "), "```", "```"), "<!--", "-->").replace(/`[^`]*`/g, " ").replace(/\]\([^)]*\)/g, " ").replace(/https?:\/\/\S+/g, " ").replace(/[|#>*_\-[\]()]/g, " ");
 }
 function detectLang(md) {
   const words = prose(md).toLowerCase().match(/[\p{L}]+/gu) ?? [];
@@ -887,43 +1316,146 @@ function detectLang(md) {
   return best.lang;
 }
 
+// src/core/proposals.ts
+import fs12 from "fs";
+import path12 from "path";
+
+// src/core/git.ts
+import { execFileSync } from "child_process";
+import os4 from "os";
+function runGit(root2, args2) {
+  return execFileSync("git", ["-C", root2, "-c", "core.fsmonitor=false", "-c", "core.quotepath=off", ...args2], {
+    cwd: os4.homedir(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    maxBuffer: 32 * 1024 * 1024
+  });
+}
+function git(root2, args2) {
+  try {
+    return runGit(root2, args2);
+  } catch (err) {
+    return typeof err?.stdout === "string" && err.stdout ? err.stdout : null;
+  }
+}
+var isGitRepo = (root2) => git(root2, ["rev-parse", "--is-inside-work-tree"])?.trim() === "true";
+function gitStatuses(root2) {
+  const prefix = git(root2, ["rev-parse", "--show-prefix"])?.trim() ?? "";
+  const out = git(root2, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."]);
+  const result = {};
+  if (!out) return result;
+  const parts = out.split("\0");
+  for (let i = 0; i < parts.length; i++) {
+    const entry = parts[i];
+    if (entry.length < 4) continue;
+    const code = entry.slice(0, 2);
+    let file = entry.slice(3);
+    if (code[0] === "R" || code[0] === "C") i++;
+    if (!file.toLowerCase().endsWith(".md")) continue;
+    if (prefix && file.startsWith(prefix)) file = file.slice(prefix.length);
+    if (file.startsWith(".markode/")) continue;
+    result[file] = code === "??" ? "U" : code.includes("D") ? "D" : code.includes("A") ? "A" : "M";
+  }
+  return result;
+}
+function gitDiff(root2, rel) {
+  const status = gitStatuses(root2)[rel];
+  const diff = ["diff", "--no-ext-diff", "--no-textconv"];
+  if (status === "U") return git(root2, [...diff, "--no-index", "--", "/dev/null", rel]) ?? "";
+  const hasHead = git(root2, ["rev-parse", "--verify", "HEAD"]) !== null;
+  return git(root2, hasHead ? [...diff, "HEAD", "--", rel] : [...diff, "--cached", "--", rel]) ?? "";
+}
+
+// src/core/proposals.ts
+var SKILL = "markode-proposals";
+var skillDirs = (root2) => Object.values(PROJECT_TARGETS).map((t) => path12.join(root2, t, SKILL));
+function proposalsState(root2) {
+  return { active: skillDirs(root2).some((d) => fs12.existsSync(path12.join(d, "SKILL.md"))), layout: readConfig(root2)?.proposals ?? "general" };
+}
+var WHERE = {
+  general: "`docs/proposals/NNN-short-name.md` (NNN: the next number in that folder, counting `applied/`)",
+  structured: "`docs/proposals/<topic>/NNN-short-name.md`, one folder per topic (e.g. `sidebar`, `auth`; NNN: the next number in it, counting its `applied/`); in a monorepo, a proposal for a single project goes in `<project>/docs/proposals/<topic>/` (e.g. `apps/web/docs/proposals/auth/`). Reuse an existing topic folder; ask the user before creating a new one"
+};
+function section(layout) {
+  return [
+    "## Proposals",
+    "",
+    "When an answer would be long, has options or a design to validate, or the user asks for one, write a",
+    "temporary proposal the user answers in markode instead of a chat answer (skill: `markode-proposals`).",
+    "",
+    `- Where: ${WHERE[layout]}.`,
+    "- After writing one, run `markode wait <path>` in the background: it returns when the user answers in markode.",
+    "- The user ticks options and comments (`<!-- comment by \u2026 -->`). When it is answered, reply to the comments,",
+    "  update every doc that depends on the decision (tasks, phases, architecture\u2026), then archive the proposal:",
+    "  `status: applied`, moved to the `applied/` folder next to it. Never read or search archived proposals",
+    "  unless the user asks about a past one."
+  ].join("\n");
+}
+function mainDocs(root2, mainDoc) {
+  const doc = mainDoc ?? mainDocOf(root2);
+  return doc ? [path12.join(root2, doc)] : [];
+}
+function activateProposals(root2, layout, mainDoc) {
+  const text3 = fill(fs12.readFileSync(path12.join(TEMPLATES_DIR, "proposals", "SKILL.md"), "utf8"), { where: WHERE[layout] });
+  for (const target of projectTargets(root2)) {
+    const file = path12.join(root2, PROJECT_TARGETS[target], SKILL, "SKILL.md");
+    assertInside(file);
+    fs12.mkdirSync(path12.dirname(file), { recursive: true });
+    if (!fs12.existsSync(file) || fs12.readFileSync(file, "utf8") !== text3) fs12.writeFileSync(file, text3);
+  }
+  fs12.mkdirSync(path12.join(root2, "docs", "proposals"), { recursive: true });
+  for (const file of mainDocs(root2, mainDoc)) writeManagedBlock(file, section(layout), false, "proposals");
+  writeConfig(root2, { ...readConfig(root2) ?? { mainDoc, langs: [] }, proposals: layout });
+}
+function deactivateProposals(root2, mainDoc) {
+  for (const dir of skillDirs(root2)) if (fs12.existsSync(dir)) assertInside(dir), fs12.rmSync(dir, { recursive: true, force: true });
+  for (const file of mainDocs(root2, mainDoc)) writeManagedBlock(file, null, false, "proposals");
+}
+function authorName(root2) {
+  try {
+    return runGit(root2, ["config", "user.name"]).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
 // src/core/rules.ts
-import fs10 from "fs";
-import path10 from "path";
-import YAML3 from "yaml";
-var rulesDir = () => path10.join(GLOBAL_DIR, "rules");
+import fs13 from "fs";
+import path13 from "path";
+import YAML4 from "yaml";
+var rulesDir = () => path13.join(GLOBAL_DIR, "rules");
 var START = "<!-- markode:rules:start -->";
 var END = "<!-- markode:rules:end -->";
 var slugify = (s) => s.toLowerCase().normalize("NFD").replace(/[̀-ͯ]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 function seedRules() {
-  if (fs10.existsSync(rulesDir())) return;
-  fs10.mkdirSync(rulesDir(), { recursive: true });
-  const src = path10.join(TEMPLATES_DIR, "rules");
-  for (const f of fs10.readdirSync(src)) fs10.copyFileSync(path10.join(src, f), path10.join(rulesDir(), f));
+  if (fs13.existsSync(rulesDir())) return;
+  fs13.mkdirSync(rulesDir(), { recursive: true });
+  const src = path13.join(TEMPLATES_DIR, "rules");
+  for (const f of fs13.readdirSync(src)) fs13.copyFileSync(path13.join(src, f), path13.join(rulesDir(), f));
 }
 function parseRule(id, text3) {
   const m = text3.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-  const meta = m ? YAML3.parse(m[1], { logLevel: "error" }) ?? {} : {};
+  const meta = m ? YAML4.parse(m[1], { logLevel: "error" }) ?? {} : {};
   return { id, title: meta.title ?? id, body: (m ? m[2] : text3).trim() };
 }
 function listRules() {
   seedRules();
-  return fs10.readdirSync(rulesDir()).filter((f) => f.endsWith(".md")).map((f) => parseRule(f.slice(0, -3), fs10.readFileSync(path10.join(rulesDir(), f), "utf8"))).sort((a, b) => a.title.localeCompare(b.title));
+  return fs13.readdirSync(rulesDir()).filter((f) => f.endsWith(".md")).map((f) => parseRule(f.slice(0, -3), fs13.readFileSync(path13.join(rulesDir(), f), "utf8"))).sort((a, b) => a.title.localeCompare(b.title));
 }
 function saveRule(rule) {
   seedRules();
   const id = rule.id || slugify(rule.title) || `rule-${Date.now()}`;
   if (!/^[\w-]+$/.test(id)) throw new Error(`Invalid rule id: ${id}`);
   const text3 = `---
-${YAML3.stringify({ title: rule.title }).trim()}
+${YAML4.stringify({ title: rule.title }).trim()}
 ---
 ${rule.body.trim()}
 `;
-  fs10.writeFileSync(path10.join(rulesDir(), `${id}.md`), text3);
+  fs13.writeFileSync(path13.join(rulesDir(), `${id}.md`), text3);
   return { id, title: rule.title, body: rule.body.trim() };
 }
 function deleteRule(id) {
-  fs10.rmSync(path10.join(rulesDir(), `${path10.basename(id)}.md`), { force: true });
+  fs13.rmSync(path13.join(rulesDir(), `${path13.basename(id)}.md`), { force: true });
 }
 function appliedRuleIds(docText) {
   const section2 = extractSection(docText);
@@ -949,54 +1481,282 @@ function projectSourceLang(root2, mainDoc) {
   const doc = mainDoc ?? mainDocOf(root2);
   if (!doc) return DEFAULT_SOURCE;
   try {
-    return sourceLangOf(fs10.readFileSync(path10.join(root2, doc), "utf8"));
+    return sourceLangOf(fs13.readFileSync(path13.join(root2, doc), "utf8"));
+  } catch {
+    return DEFAULT_SOURCE;
+  }
+}
+function renderSection(rules, sourceLang) {
+  const body = rules.map((r) => `<!-- rule:${r.id} -->
+${r.body}`).join("\n\n");
+  return [
+    START,
+    "## Working rules",
+    "",
+    "This project uses markode: follow its `markode` skill (`.claude/skills/markode/` or `.agents/skills/markode/`) when editing any `.md` file.",
+    "",
+    `<!-- markode:source-lang:${sourceLang} -->`,
+    `- Source language of every \`.md\` file: **${LANG_NAMES[sourceLang]}** (\`${sourceLang}\`).`,
+    ...body ? ["", body] : [],
+    END
+  ].join("\n");
+}
+function applyRules(docText, rules, sourceLang = sourceLangOf(docText)) {
+  const section2 = renderSection(rules, sourceLang);
+  const existing = extractSection(docText);
+  if (existing) return docText.replace(existing, () => section2);
+  return docText.replace(/\s*$/, "") + "\n\n" + section2 + "\n";
+}
+function applyRulesToFile(file, ids, sourceLang) {
+  const text3 = fs13.existsSync(file) ? fs13.readFileSync(file, "utf8") : "";
+  const all = listRules();
+  const written = writtenRules(text3);
+  const rules = (ids ?? appliedRuleIds(text3)).map((id) => all.find((r) => r.id === id) ?? written[id]).filter((r) => !!r);
+  assertInside(file);
+  fs13.writeFileSync(file, applyRules(text3, rules, sourceLang ?? sourceLangOf(text3)));
+}
+
+// src/core/features.ts
+var FEATURES = ["agent", "rules", "proposals", "live", "translations", "dashboard", "skills", "vscode"];
+var REQUIRES = { rules: "agent", proposals: "agent", live: "agent", translations: "agent" };
+var FEATURE_INFO = {
+  agent: { label: "AI agent", hint: "teaches your agent (Claude Code, Codex, Cursor\u2026) to work with markode docs; you can comment on any text for it" },
+  rules: { label: "Working rules", hint: "rules the agent follows (ask before committing, protect secrets\u2026), chosen in the Rules tab and written in CLAUDE.md/AGENTS.md" },
+  proposals: { label: "Proposals", hint: "the agent answers big questions with a doc you answer by ticking options and commenting" },
+  live: { label: "Live changes", hint: "Claude Code hears about your edits and comments while it works (personal hooks in .claude/settings.local.json)" },
+  translations: { label: "Translations", hint: "read and edit the docs in other languages; the agent translates them" },
+  dashboard: { label: "Dashboard and tasks", hint: "a panel with the state of docs, phases and tasks; with the AI agent it also creates the task structure" },
+  skills: { label: "Skills", hint: "a tab to browse, edit and add to the project the skills installed for your agents" },
+  vscode: { label: "Hide in VS Code", hint: "hides markode's .markode/ folder (translations, state) from the VS Code explorer" }
+};
+var AGENT_SET = ["agent", "rules", "proposals", "live", "translations", "skills", "vscode"];
+var PROFILE_FEATURES = {
+  viewer: [],
+  agent: AGENT_SET,
+  full: [...AGENT_SET, "dashboard"]
+};
+var PROFILE_INFO = {
+  viewer: { label: "Viewer only", hint: "see and edit the .md files; nothing is written to the project" },
+  agent: { label: "Viewer + AI agent", hint: "adds the agent skill, rules, proposals, comments, live changes and translations" },
+  full: { label: "Complete", hint: "all of the above plus the dashboard and a docs structure for vision, phases and tasks" }
+};
+var isProfile = (v) => typeof v === "string" && v in PROFILE_FEATURES;
+var isFeature = (v) => FEATURES.includes(v);
+function withRequired(list) {
+  const out = /* @__PURE__ */ new Set();
+  for (const f of list) {
+    const need = REQUIRES[f];
+    if (need) out.add(need);
+    out.add(f);
+  }
+  return FEATURES.filter((f) => out.has(f));
+}
+var UI_ONLY = ["rules", "translations", "dashboard", "skills"];
+var SKILL2 = "markode";
+var skillDirs2 = (root2) => Object.values(PROJECT_TARGETS).map((t) => path14.join(root2, t, SKILL2));
+var hasAgentSkill = (root2) => skillDirs2(root2).some((d) => fs14.existsSync(path14.join(d, "SKILL.md")));
+function featureState(root2) {
+  const flags = readConfig(root2)?.features ?? {};
+  const agent = hasAgentSkill(root2);
+  return {
+    agent,
+    rules: agent && flags.rules !== false,
+    proposals: agent && proposalsState(root2).active,
+    live: agent && hasClaudeHooks(root2),
+    translations: agent && flags.translations !== false,
+    dashboard: flags.dashboard !== false,
+    skills: flags.skills !== false,
+    vscode: isHiddenInVsCode(root2)
+  };
+}
+function setFlags(root2, patch) {
+  const c = readConfig(root2) ?? { mainDoc: mainDocOf(root2), langs: [] };
+  const { savedRules, ...flags } = patch;
+  writeConfig(root2, { ...c, features: { ...c.features, ...flags }, ..."savedRules" in patch ? { savedRules } : {} });
+}
+function detectSourceLang(root2, fallback) {
+  const votes = /* @__PURE__ */ new Map();
+  for (const f of flattenFiles(scanTree(root2)).slice(0, 200)) {
+    try {
+      const lang = detectLang(fs14.readFileSync(path14.join(root2, f.path), "utf8"));
+      if (lang) votes.set(lang, (votes.get(lang) ?? 0) + 1);
+    } catch {
+    }
+  }
+  return [...votes].sort((a, b) => b[1] - a[1])[0]?.[0] ?? fallback;
+}
+function ensureMainDoc(root2, preferred) {
+  const existing = mainDocOf(root2);
+  if (existing) return existing;
+  const doc = preferred ?? (projectTargets(root2).includes("claude") ? "CLAUDE.md" : "AGENTS.md");
+  createMainDoc(root2, doc);
+  return doc;
+}
+function installAgentSkill(root2) {
+  const src = path14.join(TEMPLATES_DIR, "skill", "SKILL.md");
+  for (const target of projectTargets(root2)) {
+    const dir = path14.join(root2, PROJECT_TARGETS[target], SKILL2);
+    fs14.mkdirSync(dir, { recursive: true });
+    const dest = path14.join(dir, "SKILL.md");
+    assertInside(dest);
+    const text3 = fs14.readFileSync(src, "utf8");
+    if (!fs14.existsSync(dest) || fs14.readFileSync(dest, "utf8") !== text3) fs14.writeFileSync(dest, text3);
+  }
+}
+function allMainDocs(root2) {
+  return ["", ...findSubprojects(scanTree(root2))].map((d) => contentDoc(path14.join(root2, d))).filter((f) => !!f);
+}
+var METHOD_SKILLS = () => fs14.readdirSync(path14.join(TEMPLATES_DIR, "method", "skills"));
+function setFeature(root2, feature, on, opts = {}) {
+  const state = featureState(root2);
+  const changed = {};
+  if (on) {
+    const need = REQUIRES[feature];
+    if (need && !state[need]) Object.assign(changed, setFeature(root2, need, true, opts));
+  } else if (feature === "agent") {
+    for (const f of FEATURES) if (REQUIRES[f] === "agent" && state[f]) Object.assign(changed, setFeature(root2, f, false, opts));
+  }
+  if (state[feature] === on && !UI_ONLY.includes(feature)) return changed;
+  apply(root2, feature, on, opts);
+  changed[feature] = on;
+  return changed;
+}
+function apply(root2, feature, on, opts) {
+  switch (feature) {
+    case "agent": {
+      if (on) {
+        const lang = readConfig(root2)?.savedSourceLang ?? detectSourceLang(root2, opts.sourceLang ?? "en");
+        const doc = path14.join(root2, ensureMainDoc(root2, opts.mainDoc));
+        installAgentSkill(root2);
+        const text3 = fs14.readFileSync(doc, "utf8");
+        const declared = /<!-- markode:source-lang:\w+ -->/.test(text3);
+        applyRulesToFile(doc, appliedRuleIds(text3), declared ? sourceLangOf(text3) : lang);
+      } else {
+        const doc = mainDocOf(root2);
+        const c = readConfig(root2);
+        if (doc && c) writeConfig(root2, { ...c, savedSourceLang: sourceLangOf(fs14.readFileSync(path14.join(root2, doc), "utf8")) });
+        for (const d of skillDirs2(root2)) if (fs14.existsSync(d)) assertInside(d), fs14.rmSync(d, { recursive: true, force: true });
+        for (const doc2 of allMainDocs(root2)) writeManagedBlock(doc2, null, false, "rules");
+      }
+      return;
+    }
+    case "rules": {
+      const doc = mainDocOf(root2);
+      const file = doc && path14.join(root2, doc);
+      if (on) {
+        const saved = readConfig(root2)?.savedRules ?? [];
+        const current = file ? appliedRuleIds(fs14.readFileSync(file, "utf8")) : [];
+        const ids = current.length ? current : saved.length ? saved : opts.rules ?? [];
+        if (file && ids.length) applyRulesToFile(file, ids);
+        setFlags(root2, { rules: true, savedRules: void 0 });
+      } else {
+        const ids = file ? appliedRuleIds(fs14.readFileSync(file, "utf8")) : [];
+        if (file) applyRulesToFile(file, []);
+        setFlags(root2, { rules: false, savedRules: ids.length ? ids : void 0 });
+      }
+      return;
+    }
+    case "proposals":
+      if (on) activateProposals(root2, readConfig(root2)?.proposals ?? (findSubprojects(scanTree(root2)).length ? "structured" : "general"), mainDocOf(root2));
+      else deactivateProposals(root2, mainDocOf(root2));
+      return;
+    case "live":
+      if (on) installClaudeHooks(root2);
+      else removeClaudeHooks(root2);
+      return;
+    case "translations":
+      setFlags(root2, { translations: on });
+      return;
+    case "dashboard": {
+      setFlags(root2, { dashboard: on });
+      if (on && hasAgentSkill(root2) && !detectWorkflow(root2) && (readConfig(root2)?.workflow ?? "none") === "none") {
+        const mainDoc = ensureMainDoc(root2, opts.mainDoc);
+        setupMethod(root2, mainDoc, opts.monorepo ?? "per-project");
+        const c = readConfig(root2);
+        writeConfig(root2, { ...c, workflow: "markode" });
+      }
+      if (!on && readConfig(root2)?.workflow === "markode") {
+        for (const name of METHOD_SKILLS())
+          for (const t of Object.values(PROJECT_TARGETS)) {
+            const dir = path14.join(root2, t, name);
+            if (fs14.existsSync(dir)) assertInside(dir), fs14.rmSync(dir, { recursive: true, force: true });
+          }
+        for (const doc of allMainDocs(root2)) writeManagedBlock(doc, null, false, "workflow");
+        const c = readConfig(root2);
+        writeConfig(root2, { ...c, workflow: "none" });
+      }
+      return;
+    }
+    case "skills":
+      setFlags(root2, { skills: on });
+      return;
+    case "vscode":
+      if (on) hideInVsCode(root2);
+      else showInVsCode(root2);
+      return;
+  }
+}
+function refreshInstalled(root2) {
+  if (!hasAgentSkill(root2)) return;
+  installAgentSkill(root2);
+  const proposals = proposalsState(root2);
+  if (proposals.active) activateProposals(root2, proposals.layout, mainDocOf(root2));
+  if (readConfig(root2)?.workflow === "markode") installMethodSkills(root2);
+}
+function ignoreStateDir(root2) {
+  const file = path14.join(stateDir(root2), ".gitignore");
+  if (fs14.existsSync(file)) return;
+  assertInside(file);
+  fs14.mkdirSync(stateDir(root2), { recursive: true });
+  fs14.writeFileSync(file, "# markode's personal state: never committed\n*\n");
+}
+
+// src/core/defaults.ts
+var BASE_DEFAULTS = {
+  mode: "ask",
+  features: PROFILE_FEATURES.agent,
+  mainDoc: "CLAUDE.md",
+  monorepo: "per-project",
+  sourceLang: "en",
+  rules: [],
+  rulesInSubprojects: false
+};
+var defaultsFile = () => path15.join(GLOBAL_DIR, "defaults.json");
+function readDefaults() {
+  try {
+    const raw = JSON.parse(fs15.readFileSync(defaultsFile(), "utf8"));
+    const saved = { ...BASE_DEFAULTS, ...raw };
+    if (!isLang(saved.sourceLang)) saved.sourceLang = BASE_DEFAULTS.sourceLang;
+    if (!MAIN_DOCS.includes(saved.mainDoc)) saved.mainDoc = BASE_DEFAULTS.mainDoc;
+    if (saved.monorepo !== "single") saved.monorepo = "per-project";
+    saved.features = Array.isArray(raw.features) ? raw.features.filter(isFeature) : PROFILE_FEATURES.agent.filter((f) => (f !== "live" || raw.claudeHooks !== false) && (f !== "vscode" || raw.hideInVsCode !== false)).concat(raw.workflow === "markode" ? ["dashboard"] : []);
+    return saved;
   } catch {
-    return DEFAULT_SOURCE;
+    return null;
   }
 }
-function renderSection(rules, sourceLang) {
-  const body = rules.map((r) => `<!-- rule:${r.id} -->
-${r.body}`).join("\n\n");
-  return [
-    START,
-    "## Working rules",
-    "",
-    "This project uses markode: follow `.claude/skills/markode/SKILL.md` when editing any `.md` file.",
-    "",
-    `<!-- markode:source-lang:${sourceLang} -->`,
-    `- Source language of every \`.md\` file: **${LANG_NAMES[sourceLang]}** (\`${sourceLang}\`).`,
-    ...body ? ["", body] : [],
-    END
-  ].join("\n");
-}
-function applyRules(docText, rules, sourceLang = sourceLangOf(docText)) {
-  const section2 = renderSection(rules, sourceLang);
-  const existing = extractSection(docText);
-  if (existing) return docText.replace(existing, () => section2);
-  return docText.replace(/\s*$/, "") + "\n\n" + section2 + "\n";
-}
-function applyRulesToFile(file, ids, sourceLang) {
-  const text3 = fs10.existsSync(file) ? fs10.readFileSync(file, "utf8") : "";
-  const all = listRules();
-  const written = writtenRules(text3);
-  const rules = (ids ?? appliedRuleIds(text3)).map((id) => all.find((r) => r.id === id) ?? written[id]).filter((r) => !!r);
-  fs10.writeFileSync(file, applyRules(text3, rules, sourceLang ?? sourceLangOf(text3)));
+function writeDefaults(defaults) {
+  fs15.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs15.writeFileSync(defaultsFile(), JSON.stringify(defaults, null, 2) + "\n");
 }
 
 // src/core/i18n.ts
-var stateFile = (root2) => path11.join(stateDir(root2), "state.json");
-var translationPath = (root2, lang, rel) => path11.join(stateDir(root2), "i18n", lang, rel);
-var hash = (text3) => crypto.createHash("sha1").update(text3).digest("hex").slice(0, 12);
+import crypto2 from "crypto";
+import fs16 from "fs";
+import path16 from "path";
+var stateFile = (root2) => path16.join(stateDir(root2), "state.json");
+var translationPath = (root2, lang, rel) => path16.join(stateDir(root2), "i18n", lang, rel);
+var hash = (text3) => crypto2.createHash("sha1").update(text3).digest("hex").slice(0, 12);
 var readText2 = (abs) => {
   try {
-    return fs11.readFileSync(abs, "utf8");
+    return fs16.readFileSync(abs, "utf8");
   } catch {
     return null;
   }
 };
 function readState(root2) {
   try {
-    const raw = JSON.parse(fs11.readFileSync(stateFile(root2), "utf8"));
+    const raw = JSON.parse(fs16.readFileSync(stateFile(root2), "utf8"));
     if (!raw.translations) return { translations: raw, keepLanguage: {} };
     return { translations: raw.translations ?? {}, keepLanguage: raw.keepLanguage ?? {} };
   } catch {
@@ -1004,11 +1764,12 @@ function readState(root2) {
   }
 }
 function writeState(root2, state) {
-  fs11.mkdirSync(stateDir(root2), { recursive: true });
-  fs11.writeFileSync(stateFile(root2), JSON.stringify(state, null, 2) + "\n");
+  fs16.mkdirSync(stateDir(root2), { recursive: true });
+  assertInside(stateFile(root2));
+  fs16.writeFileSync(stateFile(root2), JSON.stringify(state, null, 2) + "\n");
 }
 function fileStatus(root2, lang, rel) {
-  const source = readText2(path11.join(root2, rel));
+  const source = readText2(path16.join(root2, rel));
   const translation = readText2(translationPath(root2, lang, rel));
   if (translation === null || source === null) return "missing";
   const recorded = readState(root2).translations[lang]?.[rel];
@@ -1025,14 +1786,14 @@ function allStatuses(root2, lang) {
     path: f.path,
     lang,
     status: fileStatus(root2, lang, f.path),
-    translation: path11.relative(root2, translationPath(root2, lang, f.path))
+    translation: path16.relative(root2, translationPath(root2, lang, f.path))
   }));
 }
 function foreignFiles(root2, sourceLang) {
   const { keepLanguage: keepLanguage2 } = readState(root2);
   const out = [];
   for (const f of flattenFiles(scanTree(root2))) {
-    const text3 = readText2(path11.join(root2, f.path));
+    const text3 = readText2(path16.join(root2, f.path));
     const detected = text3 ? detectLang(text3) : null;
     if (detected && detected !== sourceLang && keepLanguage2[f.path] !== detected) out.push({ path: f.path, detected });
   }
@@ -1052,17 +1813,17 @@ function syncReport(root2) {
   };
 }
 function markSynced(root2, lang, rel) {
-  const source = readText2(path11.join(root2, rel));
+  const source = readText2(path16.join(root2, rel));
   const translation = readText2(translationPath(root2, lang, rel));
   if (source === null) throw new Error(`Source not found: ${rel}`);
-  if (translation === null) throw new Error(`Translation not found: ${path11.relative(root2, translationPath(root2, lang, rel))}`);
+  if (translation === null) throw new Error(`Translation not found: ${path16.relative(root2, translationPath(root2, lang, rel))}`);
   const state = readState(root2);
   state.translations[lang] ??= {};
   state.translations[lang][rel] = { source: hash(source), translation: hash(translation) };
   writeState(root2, state);
 }
 function keepLanguage(root2, rel) {
-  const text3 = readText2(path11.join(root2, rel));
+  const text3 = readText2(path16.join(root2, rel));
   const detected = text3 ? detectLang(text3) : null;
   if (!detected) throw new Error(`Could not detect the language of ${rel}`);
   const state = readState(root2);
@@ -1072,14 +1833,14 @@ function keepLanguage(root2, rel) {
 }
 
 // src/core/wait.ts
-import fs12 from "fs";
-import path12 from "path";
-import YAML4 from "yaml";
-var waitsDir = (root2) => path12.join(stateDir(root2), "waits");
-var pidFile = (root2, rel) => path12.join(waitsDir(root2), `${encodeURIComponent(rel)}.pid`);
-var frontmatter = (text3) => {
+import fs17 from "fs";
+import path17 from "path";
+import YAML5 from "yaml";
+var waitsDir = (root2) => path17.join(stateDir(root2), "waits");
+var pidFile = (root2, rel) => path17.join(waitsDir(root2), `${encodeURIComponent(rel)}.pid`);
+var frontmatter2 = (text3) => {
   try {
-    return YAML4.parse(/^---\r?\n([\s\S]*?)\r?\n---/.exec(text3)?.[1] ?? "", { logLevel: "error" }) ?? {};
+    return YAML5.parse(/^---\r?\n([\s\S]*?)\r?\n---/.exec(text3)?.[1] ?? "", { logLevel: "error" }) ?? {};
   } catch {
     return {};
   }
@@ -1095,30 +1856,31 @@ var isAlive = (pid) => {
 function waitingOn(root2) {
   let names2 = [];
   try {
-    names2 = fs12.readdirSync(waitsDir(root2)).filter((f) => f.endsWith(".pid"));
+    names2 = fs17.readdirSync(waitsDir(root2)).filter((f) => f.endsWith(".pid"));
   } catch {
   }
   return names2.flatMap((f) => {
-    const pid = Number(fs12.readFileSync(path12.join(waitsDir(root2), f), "utf8"));
+    const pid = Number(fs17.readFileSync(path17.join(waitsDir(root2), f), "utf8"));
     return isAlive(pid) ? [decodeURIComponent(f.slice(0, -4))] : [];
   });
 }
 function waitForAnswer(root2, rel) {
-  const abs = path12.join(root2, rel);
-  fs12.mkdirSync(waitsDir(root2), { recursive: true });
-  fs12.writeFileSync(pidFile(root2, rel), String(process.pid));
-  const cleanup = () => fs12.rmSync(pidFile(root2, rel), { force: true });
+  const abs = path17.join(root2, rel);
+  fs17.mkdirSync(waitsDir(root2), { recursive: true });
+  assertInside(pidFile(root2, rel));
+  fs17.writeFileSync(pidFile(root2, rel), String(process.pid));
+  const cleanup = () => fs17.rmSync(pidFile(root2, rel), { force: true });
   process.once("exit", cleanup);
   for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) process.once(sig, () => process.exit(130));
   return new Promise((resolve) => {
     const poll = () => {
       let text3;
       try {
-        text3 = fs12.readFileSync(abs, "utf8");
+        text3 = fs17.readFileSync(abs, "utf8");
       } catch {
         return resolve("gone");
       }
-      const fm = frontmatter(text3);
+      const fm = frontmatter2(text3);
       if (fm.type !== "proposal") return resolve("gone");
       if (fm.status === "answered") return resolve("answered");
       setTimeout(poll, 1500);
@@ -1128,8 +1890,8 @@ function waitForAnswer(root2, rel) {
 }
 var COMMENT = /^\s*<!-- (comment|reply) by (.+?), (\d{4}-\d{2}-\d{2})(?:, on "((?:[^"\\]|\\.)*)")?:\s?([\s\S]*?)\s*-->\s*$/;
 function answerSummary(root2, rel) {
-  const text3 = fs12.readFileSync(path12.join(root2, rel), "utf8");
-  const fm = frontmatter(text3);
+  const text3 = fs17.readFileSync(path17.join(root2, rel), "utf8");
+  const fm = frontmatter2(text3);
   const body = text3.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
   const lines = body.split("\n");
   const chosen = [];
@@ -1202,236 +1964,13 @@ function answerSummary(root2, rel) {
 }
 
 // src/server/index.ts
-import fs15 from "fs";
+import fs18 from "fs";
 import http from "http";
-import path15 from "path";
+import path18 from "path";
 import { watch } from "chokidar";
 import open from "open";
 import pc from "picocolors";
 import { WebSocketServer } from "ws";
-
-// src/core/git.ts
-import { execFileSync } from "child_process";
-function git(root2, args2) {
-  try {
-    return execFileSync("git", ["-c", "core.quotepath=off", ...args2], { cwd: root2, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 32 * 1024 * 1024 });
-  } catch (err) {
-    return typeof err?.stdout === "string" && err.stdout ? err.stdout : null;
-  }
-}
-var isGitRepo = (root2) => git(root2, ["rev-parse", "--is-inside-work-tree"])?.trim() === "true";
-function gitStatuses(root2) {
-  const prefix = git(root2, ["rev-parse", "--show-prefix"])?.trim() ?? "";
-  const out = git(root2, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."]);
-  const result = {};
-  if (!out) return result;
-  const parts = out.split("\0");
-  for (let i = 0; i < parts.length; i++) {
-    const entry = parts[i];
-    if (entry.length < 4) continue;
-    const code = entry.slice(0, 2);
-    let file = entry.slice(3);
-    if (code[0] === "R" || code[0] === "C") i++;
-    if (!file.toLowerCase().endsWith(".md")) continue;
-    if (prefix && file.startsWith(prefix)) file = file.slice(prefix.length);
-    if (file.startsWith(".markode/")) continue;
-    result[file] = code === "??" ? "U" : code.includes("D") ? "D" : code.includes("A") ? "A" : "M";
-  }
-  return result;
-}
-function gitDiff(root2, rel) {
-  const status = gitStatuses(root2)[rel];
-  if (status === "U") return git(root2, ["diff", "--no-index", "--", "/dev/null", rel]) ?? "";
-  const hasHead = git(root2, ["rev-parse", "--verify", "HEAD"]) !== null;
-  return git(root2, hasHead ? ["diff", "HEAD", "--", rel] : ["diff", "--cached", "--", rel]) ?? "";
-}
-
-// src/core/proposals.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import fs13 from "fs";
-import path13 from "path";
-var SKILL = path13.join(".claude", "skills", "markode-proposals");
-function proposalsState(root2) {
-  return { active: fs13.existsSync(path13.join(root2, SKILL, "SKILL.md")), layout: readConfig(root2)?.proposals ?? "general" };
-}
-var WHERE = {
-  general: "`docs/proposals/NNN-short-name.md` (NNN: the next number in that folder)",
-  structured: "`docs/proposals/<topic>/NNN-short-name.md`, one folder per topic (e.g. `sidebar`, `auth`); in a monorepo, a proposal for a single project goes in `<project>/docs/proposals/<topic>/` (e.g. `apps/web/docs/proposals/auth/`). Reuse an existing topic folder; ask the user before creating a new one"
-};
-function section(layout) {
-  return [
-    "## Proposals",
-    "",
-    "When an answer would be long, has options or a design to validate, or the user asks for one, write a",
-    "temporary proposal the user answers in markode instead of a chat answer (skill: `markode-proposals`).",
-    "",
-    `- Where: ${WHERE[layout]}.`,
-    "- After writing one, run `markode wait <path>` in the background: it returns when the user answers in markode.",
-    "- The user ticks options and comments (`<!-- comment by \u2026 -->`). When it is answered, reply to the comments,",
-    "  update every doc that depends on the decision (tasks, phases, architecture\u2026), then delete the proposal."
-  ].join("\n");
-}
-function mainDocs(root2, mainDoc) {
-  const doc = mainDoc ?? mainDocOf(root2);
-  return doc ? [path13.join(root2, doc)] : [];
-}
-function activateProposals(root2, layout, mainDoc) {
-  const dir = path13.join(root2, SKILL);
-  fs13.mkdirSync(dir, { recursive: true });
-  fs13.writeFileSync(path13.join(dir, "SKILL.md"), fill(fs13.readFileSync(path13.join(TEMPLATES_DIR, "proposals", "SKILL.md"), "utf8"), { where: WHERE[layout] }));
-  fs13.mkdirSync(path13.join(root2, "docs", "proposals"), { recursive: true });
-  for (const file of mainDocs(root2, mainDoc)) writeManagedBlock(file, section(layout), false, "proposals");
-  writeConfig(root2, { ...readConfig(root2) ?? { mainDoc, langs: [] }, proposals: layout });
-}
-function deactivateProposals(root2, mainDoc) {
-  fs13.rmSync(path13.join(root2, SKILL), { recursive: true, force: true });
-  for (const file of mainDocs(root2, mainDoc)) writeManagedBlock(file, null, false, "proposals");
-}
-function authorName(root2) {
-  try {
-    return execFileSync2("git", ["config", "user.name"], { cwd: root2, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-// src/core/skills.ts
-import fs14 from "fs";
-import os2 from "os";
-import path14 from "path";
-import YAML5 from "yaml";
-var SOURCE_DIRS = {
-  claude: [".claude", "skills"],
-  // Shared folder read by Codex, Copilot and Gemini CLI, and where `npx skills` installs.
-  agents: [".agents", "skills"],
-  codex: [".codex", "skills"],
-  gemini: [".gemini", "skills"],
-  copilot: [".copilot", "skills"],
-  cursor: [".cursor", "skills"]
-};
-var PROJECT_TARGETS = { claude: ".claude/skills", agents: ".agents/skills" };
-var sourceDir = (source) => path14.join(os2.homedir(), ...SOURCE_DIRS[source]);
-var display = (p3) => p3.startsWith(os2.homedir() + path14.sep) ? "~" + p3.slice(os2.homedir().length) : p3;
-function skillSources() {
-  return Object.keys(SOURCE_DIRS).map((id) => ({ id, path: display(sourceDir(id)), exists: fs14.existsSync(sourceDir(id)) }));
-}
-var tagsFile = () => path14.join(GLOBAL_DIR, "skills.json");
-function readTags() {
-  try {
-    return JSON.parse(fs14.readFileSync(tagsFile(), "utf8")).tags ?? {};
-  } catch {
-    return {};
-  }
-}
-function setSkillTags(name, tags) {
-  const all = readTags();
-  const clean = [...new Set(tags.map((t) => t.trim().toLowerCase()).filter(Boolean))];
-  if (clean.length) all[name] = clean;
-  else delete all[name];
-  fs14.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs14.writeFileSync(tagsFile(), JSON.stringify({ tags: all }, null, 2) + "\n");
-  return clean;
-}
-function findSkills(dir, source, managed, depth = 0) {
-  let entries;
-  try {
-    entries = fs14.readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  return entries.flatMap((e) => {
-    const abs = path14.join(dir, e.name);
-    let real;
-    try {
-      if (!fs14.statSync(abs).isDirectory()) return [];
-      real = fs14.realpathSync(abs);
-    } catch {
-      return [];
-    }
-    if (fs14.existsSync(path14.join(abs, "SKILL.md"))) return [{ dir: abs, real, source, managed }];
-    return depth < 2 ? findSkills(abs, source, managed || e.name === "synced" || e.name.startsWith("."), depth + 1) : [];
-  });
-}
-function frontmatter2(text3) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text3);
-  if (!m) return null;
-  try {
-    const data = YAML5.parse(m[1], { logLevel: "error" });
-    return data && typeof data === "object" ? data : null;
-  } catch {
-    return null;
-  }
-}
-function listFiles(dir) {
-  try {
-    return fs14.readdirSync(dir, { recursive: true, withFileTypes: true }).map((e) => ({ e, rel: path14.relative(dir, path14.join(e.parentPath ?? e.path ?? dir, e.name)).split(path14.sep).join("/") })).filter(({ e, rel }) => e.isFile() && rel !== "SKILL.md").map(({ rel }) => rel).sort().slice(0, 100);
-  } catch {
-    return [];
-  }
-}
-function listSkills(root2) {
-  const byReal = /* @__PURE__ */ new Map();
-  for (const source of Object.keys(SOURCE_DIRS)) {
-    for (const f of findSkills(sourceDir(source), source, false)) byReal.set(f.real, [...byReal.get(f.real) ?? [], f]);
-  }
-  const userTags = readTags();
-  const skills = [];
-  for (const [real, found] of byReal) {
-    const text3 = fs14.readFileSync(path14.join(real, "SKILL.md"), "utf8");
-    const fm = frontmatter2(text3);
-    const folder = path14.basename(found[0].dir);
-    const name = typeof fm?.name === "string" ? fm.name : folder;
-    const description = typeof fm?.description === "string" ? fm.description.trim() : "";
-    const issues = [];
-    if (!fm) issues.push("frontmatter");
-    else {
-      if (typeof fm.name !== "string" || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(fm.name) || fm.name.length > 64) issues.push("name");
-      else if (fm.name !== folder) issues.push("name-dir");
-      if (!description) issues.push("description");
-      else if (description.length > 1024) issues.push("description-long");
-    }
-    const declared = fm?.metadata?.tags;
-    const metaTags = Array.isArray(declared) ? declared.map(String) : typeof declared === "string" ? declared.split(",") : [];
-    skills.push({
-      key: real,
-      name,
-      folder,
-      description,
-      locations: found.map((f) => ({ source: f.source, path: display(f.dir) })),
-      managed: found.every((f) => f.managed),
-      files: listFiles(real),
-      tags: [.../* @__PURE__ */ new Set([...userTags[name] ?? [], ...metaTags.map((t) => t.trim().toLowerCase()).filter(Boolean)])],
-      issues,
-      installed: Object.keys(PROJECT_TARGETS).filter((t) => fs14.existsSync(path14.join(root2, PROJECT_TARGETS[t], folder, "SKILL.md")))
-    });
-  }
-  return skills.sort((a, b) => a.name.localeCompare(b.name));
-}
-function getSkill(root2, key) {
-  const skill = typeof key === "string" ? listSkills(root2).find((s) => s.key === key) : void 0;
-  if (!skill) throw Object.assign(new Error("Skill not found"), { code: "ENOENT" });
-  return skill;
-}
-function projectTargets(root2) {
-  const has2 = (p3) => fs14.existsSync(path14.join(root2, p3));
-  const out = [];
-  if (has2(".claude") || has2("CLAUDE.md")) out.push("claude");
-  if (has2(".agents") || has2("AGENTS.md") || has2(".codex") || has2(".gemini") || has2(".github/skills")) out.push("agents");
-  return out.length ? out : ["claude"];
-}
-function installSkill2(root2, skill, targets, overwrite) {
-  const dests = targets.map((t) => path14.join(root2, PROJECT_TARGETS[t], skill.folder));
-  const existing = dests.filter((d) => fs14.existsSync(d));
-  if (existing.length && !overwrite) return { conflict: existing.map((d) => path14.relative(root2, d).split(path14.sep).join("/")) };
-  for (const dest of dests) {
-    fs14.rmSync(dest, { recursive: true, force: true });
-    fs14.mkdirSync(path14.dirname(dest), { recursive: true });
-    fs14.cpSync(skill.key, dest, { recursive: true, dereference: true });
-  }
-  return { ok: true };
-}
-
-// src/server/index.ts
 var IMAGE_MIME = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -1458,9 +1997,13 @@ var HttpError = class extends Error {
   }
   status;
 };
+var MAX_BODY = 20 * 1024 * 1024;
 async function readBody(req) {
   let data = "";
-  for await (const chunk of req) data += chunk;
+  for await (const chunk of req) {
+    data += chunk;
+    if (data.length > MAX_BODY) throw new HttpError(413, "Request too large");
+  }
   if (!data) return {};
   if (!req.headers["content-type"]?.startsWith("application/json")) throw new HttpError(415, "Expected application/json");
   return JSON.parse(data);
@@ -1470,6 +2013,8 @@ function isLocalRequest(req) {
   const host = req.headers.host ?? "";
   try {
     if (!LOCAL_HOSTS.has(new URL(`http://${host}`).hostname)) return false;
+    const site = req.headers["sec-fetch-site"];
+    if (site && site !== "same-origin" && site !== "none") return false;
     return !req.headers.origin || new URL(req.headers.origin).host === host;
   } catch {
     return false;
@@ -1477,8 +2022,9 @@ function isLocalRequest(req) {
 }
 async function startServer({ root: root2, port, open: openBrowser }) {
   const config = () => readConfig(root2) ?? { mainDoc: null, langs: [] };
+  const langs = () => featureState(root2).translations ? config().langs : [];
   const sourceLang = () => projectSourceLang(root2, readConfig(root2)?.mainDoc);
-  const viewLang = (value) => isLangCode(value) && value !== sourceLang() && config().langs.includes(value) ? value : null;
+  const viewLang = (value) => isLangCode(value) && value !== sourceLang() && langs().includes(value) ? value : null;
   const mdPath = (rel) => {
     if (typeof rel !== "string" || !rel.toLowerCase().endsWith(".md")) throw new HttpError(400, "Expected a .md path");
     safeResolve(root2, rel);
@@ -1488,24 +2034,36 @@ async function startServer({ root: root2, port, open: openBrowser }) {
     if (typeof rel !== "string" || !rel.trim()) throw new HttpError(400, "Expected a path");
     const abs = safeResolve(root2, rel);
     if (abs === root2) throw new HttpError(400, "Refusing to delete the project root");
-    if (!fs15.existsSync(abs)) throw new HttpError(404, "Not found");
+    if (!fs18.existsSync(abs)) throw new HttpError(404, "Not found");
     return abs;
   };
+  const translationFile = (lang, rel) => {
+    const file = translationPath(root2, lang, rel);
+    assertInside(file, root2);
+    return file;
+  };
   const routes = {
     "GET /api/info": () => {
       const c = config();
       return {
-        name: path15.basename(root2),
+        name: path18.basename(root2),
         mainDoc: c.mainDoc ?? null,
         sourceLang: sourceLang(),
-        langs: c.langs.filter((l) => l !== sourceLang()),
+        langs: langs().filter((l) => l !== sourceLang()),
         langNames: Object.fromEntries(c.langs.map((l) => [l, langName(l, c)])),
         git: isGitRepo(root2),
         proposals: proposalsState(root2),
         author: authorName(root2),
-        unlinked: c.skipLink ? [] : missingMainDocs(root2)
+        unlinked: c.skipLink ? [] : missingMainDocs(root2),
+        features: featureState(root2)
       };
     },
+    /** Turn a module on or off (with the ones it needs or that need it); returns every module's state. */
+    "PUT /api/features": (_, body) => {
+      if (!isFeature(body.feature)) throw new HttpError(400, `Expected one of ${FEATURES.join(", ")}`);
+      setFeature(root2, body.feature, !!body.on, readDefaults() ?? BASE_DEFAULTS);
+      return featureState(root2);
+    },
     "PUT /api/config": (_, body) => {
       const c = config();
       if (Array.isArray(body.langs)) c.langs = body.langs.filter(isLangCode);
@@ -1515,7 +2073,7 @@ async function startServer({ root: root2, port, open: openBrowser }) {
       }
       if (isLang(body.sourceLang) && body.sourceLang !== sourceLang()) {
         if (!c.mainDoc) throw new HttpError(400, "No main document configured; run `markode init`");
-        applyRulesToFile(path15.join(root2, c.mainDoc), void 0, body.sourceLang);
+        applyRulesToFile(path18.join(root2, c.mainDoc), void 0, body.sourceLang);
       }
       writeConfig(root2, c);
       return { ...c, langs: c.langs.filter((l) => l !== sourceLang()) };
@@ -1539,17 +2097,17 @@ async function startServer({ root: root2, port, open: openBrowser }) {
     "GET /api/tree": (url2) => {
       const l = viewLang(url2.searchParams.get("lang"));
       const sync2 = l ? Object.fromEntries(allStatuses(root2, l).map((e) => [e.path, e.status])) : {};
-      const foreign = Object.fromEntries(foreignFiles(root2, sourceLang()).map((f) => [f.path, f.detected]));
+      const foreign = featureState(root2).translations ? Object.fromEntries(foreignFiles(root2, sourceLang()).map((f) => [f.path, f.detected])) : {};
       return { tree: scanTree(root2), git: gitStatuses(root2), sync: sync2, foreign };
     },
     "POST /api/keep-language": (_, body) => ({ lang: keepLanguage(root2, mdPath(body.path)) }),
     "GET /api/file": (url2) => {
       const rel = mdPath(url2.searchParams.get("path"));
       const l = viewLang(url2.searchParams.get("lang"));
-      const source = fs15.readFileSync(safeResolve(root2, rel), "utf8");
+      const source = fs18.readFileSync(safeResolve(root2, rel), "utf8");
       if (l) {
-        const tPath = translationPath(root2, l, rel);
-        if (fs15.existsSync(tPath)) return { path: rel, content: fs15.readFileSync(tPath, "utf8"), target: "translation", status: fileStatus(root2, l, rel) };
+        const tPath = translationFile(l, rel);
+        if (fs18.existsSync(tPath)) return { path: rel, content: fs18.readFileSync(tPath, "utf8"), target: "translation", status: fileStatus(root2, l, rel) };
         return { path: rel, content: source, target: "source", status: "missing" };
       }
       return { path: rel, content: source, target: "source", status: null };
@@ -1557,18 +2115,20 @@ async function startServer({ root: root2, port, open: openBrowser }) {
     "PUT /api/file": (_, body) => {
       const rel = mdPath(body.path);
       const l = viewLang(body.lang);
-      const file = body.target === "translation" && l ? translationPath(root2, l, rel) : safeResolve(root2, rel);
-      fs15.mkdirSync(path15.dirname(file), { recursive: true });
-      fs15.writeFileSync(file, String(body.content ?? ""));
+      const file = body.target === "translation" && l ? translationFile(l, rel) : safeResolve(root2, rel);
+      fs18.mkdirSync(path18.dirname(file), { recursive: true });
+      const content = String(body.content ?? "");
+      if (!l && featureState(root2).agent) logSave(root2, rel, fs18.existsSync(file) ? fs18.readFileSync(file, "utf8") : "", content);
+      fs18.writeFileSync(file, content);
       return { ok: true, status: l ? fileStatus(root2, l, rel) : null };
     },
     "POST /api/file": (_, body) => {
       const rel = mdPath(body.path);
       const file = safeResolve(root2, rel);
-      if (fs15.existsSync(file)) throw new HttpError(409, "File already exists");
-      fs15.mkdirSync(path15.dirname(file), { recursive: true });
-      const title = path15.basename(rel, ".md").replace(/^\d+[-_]/, "").replace(/[-_]/g, " ");
-      fs15.writeFileSync(file, `# ${title.charAt(0).toUpperCase() + title.slice(1)}
+      if (fs18.existsSync(file)) throw new HttpError(409, "File already exists");
+      fs18.mkdirSync(path18.dirname(file), { recursive: true });
+      const title = path18.basename(rel, ".md").replace(/^\d+[-_]/, "").replace(/[-_]/g, " ");
+      fs18.writeFileSync(file, `# ${title.charAt(0).toUpperCase() + title.slice(1)}
 
 `);
       return { ok: true, path: rel };
@@ -1578,23 +2138,24 @@ async function startServer({ root: root2, port, open: openBrowser }) {
       if (typeof body.path !== "string" || !body.path.trim()) throw new HttpError(400, "Expected a path");
       const dir = safeResolve(root2, body.path);
       if (dir === root2) throw new HttpError(400, "Expected a path");
-      if (fs15.existsSync(dir)) throw new HttpError(409, "A file or folder with that name already exists");
-      fs15.mkdirSync(dir, { recursive: true });
-      return { ok: true, path: toPosix(path15.relative(root2, dir)) };
+      if (fs18.existsSync(dir)) throw new HttpError(409, "A file or folder with that name already exists");
+      fs18.mkdirSync(dir, { recursive: true });
+      return { ok: true, path: toPosix(path18.relative(root2, dir)) };
     },
     "GET /api/delete-preview": (url2) => {
       const abs = deletable(url2.searchParams.get("path"));
-      if (!fs15.statSync(abs).isDirectory()) return { kind: "file", files: 1, md: 1 };
-      const files = fs15.readdirSync(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile());
+      if (!fs18.statSync(abs).isDirectory()) return { kind: "file", files: 1, md: 1 };
+      const files = fs18.readdirSync(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile());
       return { kind: "dir", files: files.length, md: files.filter((e) => e.name.toLowerCase().endsWith(".md")).length };
     },
     "DELETE /api/path": (url2) => {
-      const rel = toPosix(path15.relative(root2, deletable(url2.searchParams.get("path"))));
-      fs15.rmSync(safeResolve(root2, rel), { recursive: true });
-      for (const l of config().langs) fs15.rmSync(translationPath(root2, l, rel), { recursive: true, force: true });
+      const rel = toPosix(path18.relative(root2, deletable(url2.searchParams.get("path"))));
+      fs18.rmSync(safeResolve(root2, rel), { recursive: true });
+      for (const l of config().langs) fs18.rmSync(translationFile(l, rel), { recursive: true, force: true });
       return { ok: true };
     },
     "POST /api/ignore": (_, body) => {
+      if (typeof body.path !== "string" || /[\r\n]/.test(body.path)) throw new HttpError(400, "Expected a path");
       safeResolve(root2, body.path);
       setIgnored(root2, body.path, body.kind === "dir" ? "dir" : "file", !!body.ignored);
       return { ok: true };
@@ -1607,7 +2168,7 @@ async function startServer({ root: root2, port, open: openBrowser }) {
     },
     "GET /api/rules": () => {
       const mainDoc = readConfig(root2)?.mainDoc;
-      const text3 = mainDoc && fs15.existsSync(path15.join(root2, mainDoc)) ? fs15.readFileSync(path15.join(root2, mainDoc), "utf8") : "";
+      const text3 = mainDoc && fs18.existsSync(path18.join(root2, mainDoc)) ? fs18.readFileSync(path18.join(root2, mainDoc), "utf8") : "";
       return { rules: listRules(), applied: appliedRuleIds(text3), mainDoc: mainDoc ?? null };
     },
     "PUT /api/rules": (_, body) => saveRule(body),
@@ -1623,29 +2184,31 @@ async function startServer({ root: root2, port, open: openBrowser }) {
     },
     "GET /api/skills/file": (url2) => {
       const skill = getSkill(root2, url2.searchParams.get("key"));
-      return { path: skill.key, content: fs15.readFileSync(path15.join(skill.key, "SKILL.md"), "utf8"), target: "source", status: null };
+      return { path: skill.key, content: fs18.readFileSync(path18.join(skill.key, "SKILL.md"), "utf8"), target: "source", status: null };
     },
     "PUT /api/skills/file": (_, body) => {
       const skill = getSkill(root2, body.key);
       if (skill.managed) throw new HttpError(403, "This skill is managed by the app that installed it");
-      fs15.writeFileSync(path15.join(skill.key, "SKILL.md"), String(body.content ?? ""));
+      fs18.writeFileSync(path18.join(skill.key, "SKILL.md"), String(body.content ?? ""));
       return { ok: true, status: null };
     },
     "POST /api/skills/install": (_, body) => {
       const targets = (Array.isArray(body.targets) ? body.targets : []).filter((t) => typeof t === "string" && t in PROJECT_TARGETS);
       if (!targets.length) throw new HttpError(400, "Expected at least one target");
-      const result = installSkill2(root2, getSkill(root2, body.key), targets, !!body.overwrite);
+      const result = installSkill(root2, getSkill(root2, body.key), targets, !!body.overwrite);
       if (result.conflict) throw new HttpError(409, result.conflict.join(", "));
       return result;
     },
     "POST /api/rules/apply": (_, body) => {
       const mainDoc = readConfig(root2)?.mainDoc;
       if (!mainDoc) throw new HttpError(400, "No main document configured; run `markode init`");
-      applyRulesToFile(path15.join(root2, mainDoc), body.ids ?? []);
+      applyRulesToFile(path18.join(root2, mainDoc), body.ids ?? []);
       return { ok: true };
     }
   };
   const server = http.createServer(async (req, res) => {
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("X-Content-Type-Options", "nosniff");
     if (!isLocalRequest(req)) {
       res.writeHead(403).end("Forbidden");
       return;
@@ -1673,13 +2236,13 @@ async function startServer({ root: root2, port, open: openBrowser }) {
       res.writeHead(404).end();
       return;
     }
-    const type = IMAGE_MIME[path15.extname(file).toLowerCase()];
-    if (!type || !fs15.existsSync(file) || !fs15.statSync(file).isFile()) {
+    const type = IMAGE_MIME[path18.extname(file).toLowerCase()];
+    if (!type || !fs18.existsSync(file) || !fs18.statSync(file).isFile()) {
       res.writeHead(404).end();
       return;
     }
-    res.writeHead(200, { "content-type": type, "cache-control": "no-cache", "content-security-policy": "sandbox", "x-content-type-options": "nosniff" });
-    fs15.createReadStream(file).pipe(res);
+    res.writeHead(200, { "content-type": type, "cache-control": "no-cache", "content-security-policy": "sandbox; frame-ancestors 'none'" });
+    fs18.createReadStream(file).pipe(res);
   }
   const actualPort = await listen(server, port);
   const wss = new WebSocketServer({ server, path: "/ws", verifyClient: ({ req }) => isLocalRequest(req) });
@@ -1693,16 +2256,16 @@ async function startServer({ root: root2, port, open: openBrowser }) {
     // Unreadable folders (e.g. caches owned by another user) are skipped instead of failing.
     ignorePermissionErrors: true,
     ignored: (p3, stats) => {
-      const rel = toPosix(path15.relative(root2, p3));
+      const rel = toPosix(path18.relative(root2, p3));
       if (rel === ".markode") return false;
       if (rel.startsWith(".markode/")) return !rel.startsWith(".markode/i18n") && rel !== ".markode/state.json" && rel !== ".markode/config.json";
       return skips(rel, stats ? stats.isDirectory() : void 0);
     }
   }).on("error", (err) => console.warn(pc.yellow(`  file watcher: ${err.message}`))).on("all", (event, file) => {
-    const abs = path15.resolve(file);
+    const abs = path18.resolve(file);
     if (!abs.endsWith(".md") && !abs.endsWith(".json") && !abs.endsWith(".markodeignore") && event !== "addDir" && event !== "unlinkDir") return;
-    let rel = toPosix(path15.relative(root2, abs));
-    const i18n = toPosix(path15.relative(root2, path15.join(stateDir(root2), "i18n")));
+    let rel = toPosix(path18.relative(root2, abs));
+    const i18n = toPosix(path18.relative(root2, path18.join(stateDir(root2), "i18n")));
     if (rel.startsWith(i18n + "/")) rel = rel.split("/").slice(3).join("/");
     broadcast({ type: "fs", event, path: rel });
   });
@@ -1710,7 +2273,7 @@ async function startServer({ root: root2, port, open: openBrowser }) {
   console.log(`
   ${pc.bold("markode")} ${pc.dim("\u2192")} ${pc.cyan(url)}  ${pc.dim(root2)}
 `);
-  if (!fs15.existsSync(WEB_DIR)) console.log(pc.yellow("  Web UI not built: run `pnpm build`, or `pnpm dev` and open http://localhost:4320\n"));
+  if (!fs18.existsSync(WEB_DIR)) console.log(pc.yellow("  Web UI not built: run `pnpm build`, or `pnpm dev` and open http://localhost:4320\n"));
   else if (openBrowser) open(url).catch(() => {
   });
 }
@@ -1724,19 +2287,19 @@ function listen(server, port) {
   });
 }
 function serveStatic(pathname, res) {
-  let file = path15.join(WEB_DIR, path15.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
-  if (!file.startsWith(WEB_DIR) || !fs15.existsSync(file) || fs15.statSync(file).isDirectory()) file = path15.join(WEB_DIR, "index.html");
-  if (!fs15.existsSync(file)) {
+  let file = path18.join(WEB_DIR, path18.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
+  if (!file.startsWith(WEB_DIR) || !fs18.existsSync(file) || fs18.statSync(file).isDirectory()) file = path18.join(WEB_DIR, "index.html");
+  if (!fs18.existsSync(file)) {
     res.writeHead(404).end("Web UI not built. Run `pnpm build`.");
     return;
   }
-  res.writeHead(200, { "content-type": MIME[path15.extname(file)] ?? "application/octet-stream" });
-  fs15.createReadStream(file).pipe(res);
+  res.writeHead(200, { "content-type": MIME[path18.extname(file)] ?? "application/octet-stream", "content-security-policy": "frame-ancestors 'none'" });
+  fs18.createReadStream(file).pipe(res);
 }
 
 // src/cli/init.ts
-import fs16 from "fs";
-import path16 from "path";
+import fs19 from "fs";
+import path19 from "path";
 import * as p from "@clack/prompts";
 import pc2 from "picocolors";
 function check(value) {
@@ -1747,12 +2310,12 @@ function check(value) {
   return value;
 }
 async function offerClaudeLink(root2, d) {
-  if (fs16.existsSync(path16.join(root2, "CLAUDE.md"))) return;
+  if (fs19.existsSync(path19.join(root2, "CLAUDE.md"))) return;
   const link2 = d ? d.mainDoc === "CLAUDE.md" : check(await p.confirm({ message: "Claude Code reads CLAUDE.md, not AGENTS.md. Add a CLAUDE.md that imports AGENTS.md?", initialValue: true }));
   if (link2 && linkAgentsDoc(root2)) p.log.success("Created CLAUDE.md (imports AGENTS.md)");
 }
 async function chooseMainDoc(root2, d) {
-  const existing = MAIN_DOCS.filter((d2) => fs16.existsSync(path16.join(root2, d2)) && !isPointer(fs16.readFileSync(path16.join(root2, d2), "utf8"), d2));
+  const existing = MAIN_DOCS.filter((d2) => fs19.existsSync(path19.join(root2, d2)) && !isPointer(fs19.readFileSync(path19.join(root2, d2), "utf8"), d2));
   if (d) {
     if (existing.length === 1 && existing[0] === "AGENTS.md") await offerClaudeLink(root2, d);
     if (existing.length) return existing.includes(d.mainDoc) ? d.mainDoc : existing[0];
@@ -1798,7 +2361,7 @@ var WORKFLOW_OPTIONS = [
   { value: "openspec", label: "OpenSpec", hint: "specs + proposed changes, good for existing projects" },
   { value: "speckit", label: "GitHub Spec Kit", hint: "constitution \u2192 spec \u2192 plan \u2192 tasks, per feature" }
 ];
-var PROPOSALS_QUESTION = "The AI can write proposals you answer by ticking options and commenting. How should they be organized?";
+var PROPOSALS_QUESTION = "The agent can write proposals you answer by ticking options and commenting. How should they be organized?";
 var PROPOSAL_OPTIONS = [
   { value: "structured", label: "By topic and area", hint: "docs/proposals/auth/\u2026, services/docs/proposals/\u2026" },
   { value: "general", label: "One folder", hint: "docs/proposals/" }
@@ -1811,7 +2374,6 @@ var MONOREPO_OPTIONS = [
 var SOURCE_LANG_QUESTION = "Language you work in (every .md file is written in it)";
 var SOURCE_LANG_MARK = /<!-- markode:source-lang:\w+ -->/;
 var LANG_OPTIONS = LANGS.map((l) => ({ value: l, label: LANG_NAMES[l], hint: l === "en" ? "default" : void 0 }));
-var HIDE_QUESTION = "Hide the .markode/ folder in VS Code?";
 var ruleOptions = (rules) => rules.map((r) => ({ value: r.id, label: r.title, hint: r.body.split("\n")[0].replace(/^- /, "") }));
 async function chooseRules(message, rules, initial) {
   const pick = check(
@@ -1830,11 +2392,10 @@ async function chooseRules(message, rules, initial) {
 var agentOptions = () => Object.keys(SDD_AGENTS).map((a) => ({ value: a, label: SDD_AGENTS[a].label }));
 var WORKFLOW_LABEL = { none: "None", markode: "markode", openspec: "OpenSpec", speckit: "GitHub Spec Kit" };
 var WORKFLOW_GUIDE = { none: "", markode: ".claude/skills/markode-method/SKILL.md", openspec: "openspec/README.md", speckit: "specs/README.md" };
-var canAsk = () => !!process.stdin.isTTY;
-async function chooseAreas(root2, d) {
+async function chooseAreas(root2) {
   const { dirs: candidates, unsure } = detectAreas(root2);
   if (!candidates.length) return [];
-  if (unsure && canAsk()) {
+  if (unsure) {
     const separate = check(
       await p.confirm({
         message: `${candidates.map((c) => `${c}/`).join(", ")} each have their own manifest. Are they separate projects (e.g. a front end and a back end)?`,
@@ -1843,17 +2404,13 @@ async function chooseAreas(root2, d) {
     );
     if (!separate) return [];
   }
-  if (d) {
-    const used2 = /* @__PURE__ */ new Set();
-    return d.monorepo === "single" ? [] : candidates.map((dir) => ({ dir, prefix: suggestPrefix(dir, used2) }));
-  }
   p.log.info(`Monorepo detected: ${candidates.map((c) => `${c}/`).join(", ")}`);
   const layout = check(await p.select({ message: MONOREPO_QUESTION, options: MONOREPO_OPTIONS }));
   if (layout === "single") return [];
   const dirs2 = check(
     await p.multiselect({
       message: "Which projects get their own docs?",
-      options: candidates.map((d2) => ({ value: d2, label: `${d2}/` })),
+      options: candidates.map((d) => ({ value: d, label: `${d}/` })),
       initialValues: candidates,
       required: false
     })
@@ -1875,8 +2432,8 @@ async function chooseAreas(root2, d) {
   return areas;
 }
 async function chooseKind(root2, dir) {
-  const guess = guessKind(path16.join(root2, dir));
-  if (!guess.unclear || !canAsk()) return guess.kind;
+  const guess = guessKind(path19.join(root2, dir));
+  if (!guess.unclear) return guess.kind;
   const where = dir ? `${dir}/` : "this project";
   const seen = guess.signals.length ? `found: ${guess.signals.join(", ")}` : "no code yet";
   return check(
@@ -1887,9 +2444,9 @@ async function chooseKind(root2, dir) {
     })
   );
 }
-async function askProfile(root2, dir, kind, d) {
-  const base = detectProfile(path16.join(root2, dir), kind);
-  if (d || kind === "app") return base;
+async function askProfile(root2, dir, kind) {
+  const base = detectProfile(path19.join(root2, dir), kind);
+  if (kind === "app") return base;
   const where = dir ? ` (${dir}/)` : "";
   if (kind === "library") return { kind, published: check(await p.confirm({ message: `Is the library${where} published (npm, PyPI\u2026)?`, initialValue: base.published })) };
   if (kind === "mobile") {
@@ -1917,10 +2474,9 @@ async function askProfile(root2, dir, kind, d) {
   const environments = check(await p.text({ message: `Environments${where}`, initialValue: base.environments, defaultValue: base.environments }));
   return { kind, environments: environments.trim() };
 }
-async function chooseContracts(root2, areas, d) {
+async function chooseContracts(root2, areas) {
   if (!looksLikeMicroservices(root2, areas.length)) return null;
   const found = findContracts(root2);
-  if (d && found || !canAsk()) return found;
   const answer = check(
     await p.text({
       message: "Several services: where do their contracts (APIs, events) live? (e.g. proto/, an OpenAPI file; empty if none)",
@@ -1930,9 +2486,9 @@ async function chooseContracts(root2, areas, d) {
   );
   return answer.trim() || null;
 }
-async function chooseExisting(root2, d) {
+async function chooseExisting(root2) {
   const found = existingDocs(root2);
-  if (!found.length || d) return found;
+  if (!found.length) return found;
   return check(
     await p.multiselect({
       message: "These docs already exist. Which are the official ones? (the agent updates them instead of creating new ones)",
@@ -1942,38 +2498,43 @@ async function chooseExisting(root2, d) {
     })
   );
 }
-async function chooseWorkflow(root2, mainDoc, previous, d) {
+async function chooseWorkflow(root2, mainDoc, previous, quiet) {
   const detected = detectWorkflow(root2);
   if (detected) {
     p.log.info(`${WORKFLOW_LABEL[detected]} found: markode shows it in the dashboard.`);
-    return { workflow: detected };
+    return detected;
+  }
+  if (previous === "markode") return previous;
+  if (quiet) {
+    const { created, areas } = setupMethod(root2, mainDoc, quiet.monorepo);
+    activateProposals(root2, areas.length ? "structured" : "general", mainDoc);
+    if (created.length) p.log.success(`Tasks structure: ${created.length} files (${created.slice(0, 5).join(", ")}${created.length > 5 ? "\u2026" : ""})`);
+    return "markode";
   }
   for (; ; ) {
-    const choice = d ? d.workflow : check(await p.select({ message: "Create a base structure for specs and planning?", options: WORKFLOW_OPTIONS, initialValue: previous ?? "none" }));
-    if (choice === "none") return { workflow: choice };
+    const choice = check(await p.select({ message: "Create a base structure for specs and planning?", options: WORKFLOW_OPTIONS, initialValue: previous ?? "markode" }));
+    if (choice === "none") return choice;
     if (choice === "markode") {
-      const existing = await chooseExisting(root2, d);
-      const areas = await chooseAreas(root2, d);
-      for (const a of areas) a.profile = await askProfile(root2, a.dir, await chooseKind(root2, a.dir), d);
-      const contracts = await chooseContracts(root2, areas, d);
-      const profile = areas.length ? void 0 : await askProfile(root2, "", await chooseKind(root2, ""), d);
+      const existing = await chooseExisting(root2);
+      const areas = await chooseAreas(root2);
+      for (const a of areas) a.profile = await askProfile(root2, a.dir, await chooseKind(root2, a.dir));
+      const contracts = await chooseContracts(root2, areas);
+      const profile = areas.length ? void 0 : await askProfile(root2, "", await chooseKind(root2, ""));
       const created = scaffoldMethod(root2, mainDoc, areas);
       installMethodSkills(root2);
+      applyWorkflowToFile(path19.join(root2, mainDoc), "markode", methodSection(areas, root2, { profile, contracts, existing }));
       const big = !areas.length && flattenFiles(scanTree(root2)).length > 40;
-      const layout = areas.length ? "structured" : !big || d ? "general" : check(await p.select({ message: PROPOSALS_QUESTION, options: PROPOSAL_OPTIONS }));
+      const layout = areas.length ? "structured" : !big ? "general" : check(await p.select({ message: PROPOSALS_QUESTION, options: PROPOSAL_OPTIONS }));
       activateProposals(root2, layout, mainDoc);
       if (created.length) p.log.success(`Created ${created.length} files: ${created.slice(0, 8).join(", ")}${created.length > 8 ? "\u2026" : ""}`);
       p.log.info(`Docs grow when there is something to write. Skills: /markode-status, /markode-new-task, /markode-close-session.`);
-      return { workflow: choice, section: methodSection(areas, root2, { profile, contracts, existing }) };
+      return choice;
     }
     let official = true;
-    if (choice === "speckit" && !hasUv() && d) {
-      p.log.warn("Spec Kit needs uv (Python) to install its AI commands, and uv was not found: creating the structure only.");
-      official = false;
-    } else if (choice === "speckit" && !hasUv()) {
+    if (choice === "speckit" && !hasUv()) {
       const next = check(
         await p.select({
-          message: "Spec Kit needs uv (Python) to install its AI commands, and uv was not found.",
+          message: "Spec Kit needs uv (Python) to install its agent commands, and uv was not found.",
           options: [
             { value: "back", label: "Choose another option" },
             { value: "skeleton", label: "Create the structure only", hint: "the guide explains how to install Spec Kit later" }
@@ -1984,7 +2545,7 @@ async function chooseWorkflow(root2, mainDoc, previous, d) {
       official = false;
     }
     const initial = mainDoc === "AGENTS.md" ? "codex" : "claude";
-    const agents = !official ? [initial] : d ? choice === "speckit" ? [d.agents[0] ?? initial] : d.agents : choice === "openspec" ? check(await p.multiselect({ message: "Install the OpenSpec commands for which agents?", options: agentOptions(), initialValues: [initial], required: false })) : [check(await p.select({ message: "Install the Spec Kit commands for which agent?", options: agentOptions(), initialValue: initial }))];
+    const agents = !official ? [initial] : choice === "openspec" ? check(await p.multiselect({ message: "Install the OpenSpec commands for which agents?", options: agentOptions(), initialValues: [initial], required: false })) : [check(await p.select({ message: "Install the Spec Kit commands for which agent?", options: agentOptions(), initialValue: initial }))];
     const spin = p.spinner();
     spin.start(official ? `Installing ${WORKFLOW_LABEL[choice]}\u2026` : "Creating the structure\u2026");
     const res = installWorkflow(root2, choice, agents, official);
@@ -1992,51 +2553,86 @@ async function chooseWorkflow(root2, mainDoc, previous, d) {
     if (official && !res.official) p.log.warn(`Couldn't run the ${WORKFLOW_LABEL[choice]} installer:
 ${pc2.dim(res.error ?? "")}
 Created the structure only.`);
-    if (!res.official) p.log.info(`To add the AI commands later, see ${pc2.cyan(WORKFLOW_GUIDE[choice])}.`);
+    if (!res.official) p.log.info(`To add the agent commands later, see ${pc2.cyan(WORKFLOW_GUIDE[choice])}.`);
     if (res.ignored.length) p.log.info(`Agent commands hidden in markode (${res.ignored.length} folders); the eye button in the sidebar shows them.`);
-    return { workflow: choice };
+    return choice;
   }
 }
-async function runInit(root2, d = null) {
+var featureOptions = () => FEATURES.map((f) => ({ value: f, label: FEATURE_INFO[f].label, hint: FEATURE_INFO[f].hint + (REQUIRES[f] ? ` (needs ${FEATURE_INFO[REQUIRES[f]].label})` : "") }));
+async function askFeatures(message = "What should markode install in this project? (the viewer is always included)", initial = PROFILE_FEATURES.agent) {
+  const same = (a, b) => a.length === b.length && a.every((f) => b.includes(f));
+  const current = Object.keys(PROFILE_FEATURES).find((k) => same(PROFILE_FEATURES[k], initial)) ?? "custom";
+  const choice = check(
+    await p.select({
+      message,
+      options: [
+        ...Object.keys(PROFILE_INFO).map((k) => ({ value: k, label: PROFILE_INFO[k].label + (k === "agent" ? " (recommended)" : ""), hint: PROFILE_INFO[k].hint })),
+        { value: "custom", label: "Choose the modules", hint: "pick each one; any of them can be turned on or off later in Settings" }
+      ],
+      initialValue: current
+    })
+  );
+  if (choice !== "custom") return PROFILE_FEATURES[choice];
+  return withRequired(check(await p.multiselect({ message: "Modules (space to toggle)", options: featureOptions(), initialValues: initial, required: false })));
+}
+async function runInit(root2, plan2) {
   p.intro(pc2.bgCyan(pc2.black(" markode ")));
-  if (d) p.log.info(`Using your defaults (${pc2.cyan(defaultsFile())}). To choose differently for this project: ${pc2.cyan("markode init --custom")}`);
+  const d = plan2.defaults;
   const previous = readConfig(root2);
-  const mainDoc = await chooseMainDoc(root2, d);
-  const mainFile = path16.join(root2, mainDoc);
-  const { workflow, section: section2 } = await chooseWorkflow(root2, mainDoc, previous?.workflow, d);
-  applyWorkflowToFile(mainFile, workflow, section2);
-  const mainText = fs16.readFileSync(mainFile, "utf8");
-  const sourceLang = d ? SOURCE_LANG_MARK.test(mainText) ? sourceLangOf(mainText) : d.sourceLang : check(await p.select({ message: SOURCE_LANG_QUESTION, options: LANG_OPTIONS, initialValue: sourceLangOf(mainText) }));
-  const langs = (previous?.langs ?? []).filter((l) => l !== sourceLang);
-  const rules = listRules();
-  const applied = appliedRuleIds(mainText);
-  const selected = d ? [.../* @__PURE__ */ new Set([...applied, ...d.rules.filter((id) => rules.some((r) => r.id === id))])] : await chooseRules("Working rules for this project", rules, applied);
-  applyRulesToFile(mainFile, selected, sourceLang);
-  const subprojects = findSubprojects(scanTree(root2));
-  if (subprojects.length && selected.length) {
-    const targets = d ? d.rulesInSubprojects ? subprojects : [] : check(
-      await p.multiselect({
-        message: "Monorepo detected. Apply the same rules to these projects too?",
-        options: subprojects.map((s) => ({ value: s, label: s })),
-        required: false
-      })
-    );
-    for (const dir of targets) {
-      applyRulesToFile(contentDoc(path16.join(root2, dir)), selected, sourceLang);
+  const features2 = withRequired(plan2.features);
+  const has2 = (f) => features2.includes(f);
+  const detectedLang = detectSourceLang(root2, d?.sourceLang ?? "en");
+  ignoreStateDir(root2);
+  let mainDoc = previous?.mainDoc ?? mainDocOf(root2);
+  let workflow = previous?.workflow ?? "none";
+  if (has2("agent")) {
+    mainDoc = await chooseMainDoc(root2, d);
+    const mainFile = path19.join(root2, mainDoc);
+    if (has2("dashboard")) workflow = await chooseWorkflow(root2, mainDoc, previous?.workflow, d);
+    if (workflow === "openspec" || workflow === "speckit") applyWorkflowToFile(mainFile, workflow);
+    const mainText = fs19.readFileSync(mainFile, "utf8");
+    const sourceLang = d ? SOURCE_LANG_MARK.test(mainText) ? sourceLangOf(mainText) : detectedLang : check(await p.select({ message: SOURCE_LANG_QUESTION, options: LANG_OPTIONS, initialValue: SOURCE_LANG_MARK.test(mainText) ? sourceLangOf(mainText) : detectedLang }));
+    const rules = listRules();
+    const applied = appliedRuleIds(mainText);
+    const selected = !has2("rules") ? applied : d ? [.../* @__PURE__ */ new Set([...applied, ...d.rules.filter((id) => rules.some((r) => r.id === id))])] : await chooseRules("Working rules for this project", rules, applied);
+    applyRulesToFile(mainFile, selected, sourceLang);
+    const subprojects = findSubprojects(scanTree(root2));
+    if (subprojects.length && selected.length) {
+      const targets = d ? d.rulesInSubprojects ? subprojects : [] : check(
+        await p.multiselect({
+          message: "Monorepo detected. Apply the same rules to these projects too?",
+          options: subprojects.map((s) => ({ value: s, label: s })),
+          required: false
+        })
+      );
+      for (const dir of targets) applyRulesToFile(contentDoc(path19.join(root2, dir)), selected, sourceLang);
     }
-  }
-  ensureGitignore(root2);
-  if (!previous?.initializedAt) {
-    const hide = d ? d.hideInVsCode : check(await p.confirm({ message: HIDE_QUESTION, initialValue: true }));
-    if (hide && !hideInVsCode(root2)) p.log.warn('.vscode/settings.json has comments; add "**/.markode": true to files.exclude by hand.');
-  }
-  installSkill(root2);
-  const config = { mainDoc, langs, langNames: previous?.langNames, workflow, proposals: readConfig(root2)?.proposals, skipLink: previous?.skipLink, initializedAt: previous?.initializedAt ?? (/* @__PURE__ */ new Date()).toISOString() };
+    installAgentSkill(root2);
+    const proposals = proposalsState(root2);
+    if (has2("proposals") || proposals.active) activateProposals(root2, proposals.active ? proposals.layout : subprojects.length ? "structured" : "general", mainDoc);
+    if (has2("live") && projectTargets(root2).includes("claude") && !hasClaudeHooks(root2) && !installClaudeHooks(root2))
+      p.log.warn('.claude/settings.local.json could not be read; add the markode hooks by hand (README: "Claude Code hooks").');
+  }
+  if (has2("vscode") && !isHiddenInVsCode(root2) && !hideInVsCode(root2)) p.log.warn('.vscode/settings.json has comments; add "**/.markode": true to files.exclude by hand.');
+  const flags = { ...previous?.features };
+  for (const f of ["rules", "translations", "dashboard", "skills"]) flags[f] = has2(f) || (previous?.initializedAt ? flags[f] !== false : false);
+  const config = {
+    ...previous,
+    mainDoc,
+    langs: previous?.langs ?? [],
+    workflow,
+    proposals: readConfig(root2)?.proposals,
+    features: flags,
+    initializedAt: previous?.initializedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
   writeConfig(root2, config);
-  p.outro(`Ready. Skill installed in ${pc2.cyan(".claude/skills/markode")}. To review the docs in another language: ${pc2.cyan("markode translate")}`);
+  const on = featureState(root2);
+  const lines = FEATURES.filter((f) => on[f]).map((f) => `${pc2.green("\u25CF")} ${FEATURE_INFO[f].label} ${pc2.dim("\u2014 " + FEATURE_INFO[f].hint)}`);
+  p.note([`${pc2.green("\u25CF")} Viewer ${pc2.dim("\u2014 see and edit every .md file of the project")}`, ...lines].join("\n"), "Installed");
+  p.outro(`Ready. Turn modules on or off in ${pc2.cyan("Settings \u2192 Features")}, or with ${pc2.cyan("markode features")}.`);
   return config;
 }
-async function runSetup(quick = false) {
+async function runSetup(quick = false, custom = false) {
   const previous = readDefaults() ?? BASE_DEFAULTS;
   if (quick) {
     const d2 = { ...previous, mode: "ask" };
@@ -2044,42 +2640,39 @@ async function runSetup(quick = false) {
     return d2;
   }
   p.intro(pc2.bgCyan(pc2.black(" markode setup ")));
-  const mode = check(
+  const ask = check(
     await p.select({
       message: "How should markode set up your projects?",
       options: [
-        { value: "defaults", label: "With my answers", hint: "asked now, once; every project uses them" },
-        { value: "ask", label: "Ask in each project" }
+        { value: "defaults", label: "Always the same way", hint: "choose the modules now; every new project gets them without questions" },
+        { value: "ask", label: "Ask in each project", hint: "one question per project: which modules" }
       ],
       initialValue: previous.mode === "ask" && !readDefaults() ? "defaults" : previous.mode
     })
   );
-  if (mode === "ask") {
-    const d2 = { ...previous, mode };
+  if (ask === "ask") {
+    const d2 = { ...previous, mode: "ask" };
     writeDefaults(d2);
-    p.outro(`Saved. Each project will ask its own questions. Change it with ${pc2.cyan("markode setup")}`);
+    p.outro(`Saved. Each project will ask which modules to install. Change it with ${pc2.cyan("markode setup")}`);
     return d2;
   }
-  const mainDoc = check(
-    await p.select({
-      message: "Main document to create when a project has none",
-      options: MAIN_DOCS.map((d2) => ({ value: d2, label: d2, hint: d2 === "CLAUDE.md" ? "Claude Code" : "other agents" })),
-      initialValue: previous.mainDoc
-    })
-  );
-  const workflow = check(await p.select({ message: "Base structure for specs and planning", options: WORKFLOW_OPTIONS, initialValue: previous.workflow }));
-  let agents = previous.agents;
-  let monorepo = previous.monorepo;
-  if (workflow === "openspec")
-    agents = check(await p.multiselect({ message: "Install the OpenSpec commands for which agents?", options: agentOptions(), initialValues: previous.agents, required: false }));
-  if (workflow === "speckit") agents = [check(await p.select({ message: "Install the Spec Kit commands for which agent?", options: agentOptions(), initialValue: previous.agents[0] }))];
-  if (workflow === "markode") monorepo = check(await p.select({ message: MONOREPO_QUESTION, options: MONOREPO_OPTIONS, initialValue: previous.monorepo }));
-  const sourceLang = check(await p.select({ message: `${SOURCE_LANG_QUESTION}; projects that already declare one keep it`, options: LANG_OPTIONS, initialValue: previous.sourceLang }));
-  const rules = listRules();
-  const selected = await chooseRules("Working rules for your projects", rules, previous.rules.filter((id) => rules.some((r) => r.id === id)));
-  const rulesInSubprojects = selected.length ? check(await p.confirm({ message: "In monorepos, apply the rules to the subprojects too?", initialValue: previous.rulesInSubprojects })) : false;
-  const hideInVsCode2 = check(await p.confirm({ message: HIDE_QUESTION, initialValue: previous.hideInVsCode }));
-  const d = { mode, mainDoc, workflow, agents, monorepo, sourceLang, rules: selected, rulesInSubprojects, hideInVsCode: hideInVsCode2 };
+  const features2 = await askFeatures("What should every new project get? (the viewer is always included)", previous.features);
+  let d = { ...previous, mode: "defaults", features: features2 };
+  if (custom) {
+    const mainDoc = check(
+      await p.select({
+        message: "Main document to create when a project has none",
+        options: MAIN_DOCS.map((m) => ({ value: m, label: m, hint: m === "CLAUDE.md" ? "Claude Code" : "other agents" })),
+        initialValue: previous.mainDoc
+      })
+    );
+    const sourceLang = check(await p.select({ message: `${SOURCE_LANG_QUESTION}, when a project's docs don't show it`, options: LANG_OPTIONS, initialValue: previous.sourceLang }));
+    const rules = listRules();
+    const selected = features2.includes("rules") ? await chooseRules("Working rules for your projects", rules, previous.rules.filter((id) => rules.some((r) => r.id === id))) : previous.rules;
+    const rulesInSubprojects = selected.length ? check(await p.confirm({ message: "In monorepos, apply the rules to the subprojects too?", initialValue: previous.rulesInSubprojects })) : false;
+    const monorepo = features2.includes("dashboard") ? check(await p.select({ message: MONOREPO_QUESTION, options: MONOREPO_OPTIONS, initialValue: previous.monorepo })) : previous.monorepo;
+    d = { ...d, mainDoc, sourceLang, rules: selected, rulesInSubprojects, monorepo };
+  }
   writeDefaults(d);
   p.outro(`Saved in ${pc2.cyan(defaultsFile())}. Change them with ${pc2.cyan("markode setup")}; for a single project: ${pc2.cyan("markode init --custom")}`);
   return d;
@@ -2153,15 +2746,20 @@ async function runTranslate(root2) {
 var HELP = `markode \u2014 visual editor for your project's Markdown
 
 Usage
-  markode                 init if needed, then open the editor
-  markode init            (re)run the project setup: main doc, specs structure, rules, languages
-  markode setup           choose how projects are set up: with your saved answers, or asking each time
+  markode                 set the project up if needed, then open the editor
+  markode init            (re)run the project setup: choose the modules to install (or use your defaults)
+  markode setup           choose how projects are set up: always the same modules, or asking each time
+  markode features        list the modules and whether they are on in this project
+  markode features <module> on|off   turn a module on or off (same as Settings \u2192 Features)
   markode serve           open the editor without running init
   markode translate       choose languages to review the docs in (or: markode --translate)
   markode check [--json]  what /markode sync fixes: answered proposals, phases vs tasks, projects table, broken links
   markode wait <proposal> wait until the user answers a proposal in markode, then print the answer
   markode link [--dry-run] where there is only CLAUDE.md or only AGENTS.md, add the other one pointing to it
   markode link --skip     don't offer it again in this project
+  markode changes [--json] what the user edited or commented in markode since the agent was last told
+  markode changes --start  a new agent session: what happened before is old news
+  markode changes --hook <event>  the same, as Claude Code hook output (silent when nothing changed)
 
 For the agent's /markode translate:
   markode translate --status [--json]                    translations + files not in the source language
@@ -2170,8 +2768,11 @@ For the agent's /markode translate:
 
 Options
   -v, --version  print the version
-  -D           first run: skip saving defaults; every project asks its own questions
-  --custom     init: ask every question for this project, ignoring your defaults
+  -D           first run: don't save your choice as the default for new projects
+  --profile <viewer|agent|full>  init: install this set of modules, without questions
+  --yes        init: no questions; your defaults, or the recommended modules (viewer + AI agent)
+  --custom     init: choose each module and answer every question for this project
+               setup: also choose the main doc, language, rules and monorepo layout
   --port <n>   server port (default 4319)
   --no-open    do not open the browser
 `;
@@ -2184,26 +2785,32 @@ var option = (name) => {
 var command = args[0] && !args[0].startsWith("-") ? args[0] : "start";
 var root = process.env.MARKODE_ROOT ?? process.cwd();
 async function main() {
+  if (fs20.existsSync(root)) setProjectRoot(root);
   if (flag("--help") || flag("-h")) return console.log(HELP);
-  if (flag("--version") || flag("-v")) return console.log(JSON.parse(fs17.readFileSync(path17.join(PKG_ROOT, "package.json"), "utf8")).version);
+  if (flag("--version") || flag("-v")) return console.log(JSON.parse(fs20.readFileSync(path20.join(PKG_ROOT, "package.json"), "utf8")).version);
   const translation = flag("--status") || flag("--mark") || flag("--keep");
   if ((command === "sync" || command === "translate") && translation) return sync();
   if (command === "translate" || flag("--translate")) return runTranslate(root);
   if (command === "check") return check3();
   if (command === "wait") return wait();
   if (command === "link") return link();
+  if (command === "changes") return changes();
+  if (command === "features") return features();
   if (command === "setup") {
-    await runSetup(flag("-D"));
+    await runSetup(false, flag("--custom"));
     return;
   }
   if (command === "init") {
-    await runInit(root, flag("--custom") ? null : await defaults());
+    const p3 = await plan();
+    if (p3) await runInit(root, p3);
+    else console.log("No terminal to ask in: run `markode init --yes` or `--profile <viewer|agent|full>`.");
     return;
   }
   if (command === "start" && !readConfig(root)?.initializedAt) {
-    if (process.stdin.isTTY) await runInit(root, flag("--custom") ? null : await defaults());
-    else if (readDefaults()?.mode === "defaults") await runInit(root, readDefaults());
+    const p3 = await plan();
+    if (p3) await runInit(root, p3);
   }
+  if (command === "start" || command === "serve") refreshInstalled(root);
   const unlinked = command === "start" && process.stdout.isTTY && !readConfig(root)?.skipLink ? missingMainDocs(root) : [];
   if (unlinked.length)
     console.log(`Tip: Claude Code reads CLAUDE.md and other agents read AGENTS.md; ${unlinked.map((m) => m.path).join(", ")} missing. Run \`markode link\` (or \`markode link --skip\`).`);
@@ -2214,9 +2821,40 @@ async function main() {
   console.log(HELP);
   process.exitCode = 1;
 }
-async function defaults() {
-  const d = readDefaults() ?? (process.stdin.isTTY ? await runSetup(flag("-D")) : null);
-  return d?.mode === "defaults" ? d : null;
+async function plan() {
+  const saved = readDefaults();
+  const d = saved ?? BASE_DEFAULTS;
+  const profile = option("--profile");
+  if (flag("--custom")) return { features: await askFeatures(), defaults: null };
+  if (profile) {
+    if (!isProfile(profile)) throw new Error(`Unknown profile "${profile}": use viewer, agent or full`);
+    return { features: PROFILE_FEATURES[profile], defaults: d };
+  }
+  if (saved?.mode === "defaults" || flag("--yes")) return { features: d.features, defaults: d };
+  if (!process.stdin.isTTY) return null;
+  const features2 = await askFeatures();
+  if (!saved && !flag("-D")) {
+    writeDefaults({ ...d, mode: "defaults", features: features2 });
+    console.log(`  Saved as your default for new projects (they won't ask again). Change it with \`markode setup\`.`);
+  }
+  return { features: features2, defaults: d };
+}
+function features() {
+  const [id, value] = [args[1], args[2]];
+  if (id) {
+    if (!isFeature(id) || value !== "on" && value !== "off") {
+      console.error(`Usage: markode features <${FEATURES.join("|")}> on|off`);
+      process.exitCode = 1;
+      return;
+    }
+    const changed = setFeature(root, id, value === "on", readDefaults() ?? BASE_DEFAULTS);
+    for (const [f, on] of Object.entries(changed)) console.log(`${on ? "on " : "off"}  ${FEATURE_INFO[f].label}`);
+    if (!Object.keys(changed).length) console.log(`${FEATURE_INFO[id].label} was already ${value}.`);
+    return;
+  }
+  const state = featureState(root);
+  console.log("on   Viewer \u2014 see and edit every .md file of the project (always on)");
+  for (const f of FEATURES) console.log(`${state[f] ? "on " : "off"}  ${FEATURE_INFO[f].label} \u2014 ${FEATURE_INFO[f].hint}${REQUIRES[f] ? ` (needs ${FEATURE_INFO[REQUIRES[f]].label})` : ""}`);
 }
 function check3() {
   const report = checkDocs(root);
@@ -2242,9 +2880,21 @@ function link() {
   if (flag("--dry-run")) return console.log(missing.map((m) => `would create ${m.path} \u2192 ${m.pointsTo}`).join("\n"));
   for (const p3 of linkMainDocs(root)) console.log(`created ${p3}`);
 }
+function changes() {
+  if (flag("--start")) return startSession(root);
+  const list = takeChanges(root);
+  const event = option("--hook");
+  if (event) {
+    const text3 = formatChanges(list);
+    if (text3) console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: event, additionalContext: text3 } }));
+    return;
+  }
+  if (flag("--json")) return console.log(JSON.stringify(list, null, 2));
+  console.log(formatChanges(list) || "No edits or comments from the user since you were last told.");
+}
 async function wait() {
   const rel = args[1];
-  if (!rel || !fs17.existsSync(path17.join(root, rel))) {
+  if (!rel || !fs20.existsSync(path20.join(root, rel))) {
     console.error(`Usage: markode wait <proposal.md> (relative to ${root})`);
     process.exitCode = 1;
     return;