npm - @scheduler-systems/gal-run - Versions diffs - 0.0.668 → 0.0.674 - Mend

@scheduler-systems/gal-run 0.0.668 → 0.0.674

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.cjs +1480 -569
package/package.json +1 -1

package/dist/index.cjs CHANGED Viewed

@@ -3881,7 +3881,7 @@ var cliVersion, defaultApiUrl, BUILD_CONSTANTS, constants_default;
 var init_constants = __esm({
   "module_6"() {
     "use strict";
-    cliVersion = true ? "0.0.668" : "0.0.0-dev";
+    cliVersion = true ? "0.0.674" : "0.0.0-dev";
     defaultApiUrl = true ? "https://api.gal.run" : "http://localhost:3000";
     BUILD_CONSTANTS = Object.freeze([cliVersion, defaultApiUrl]);
     constants_default = BUILD_CONSTANTS;
@@ -11930,7 +11930,7 @@ function detectEnvironment() {
     return "dev";
   }
   try {
-    const version2 = true ? "0.0.668" : void 0;
+    const version2 = true ? "0.0.674" : void 0;
     if (version2 && version2.includes("-local")) {
       return "dev";
     }
@@ -14611,7 +14611,7 @@ function getId() {
 }
 function getCliVersion() {
   try {
-    return true ? "0.0.668" : "0.0.0-dev";
+    return true ? "0.0.674" : "0.0.0-dev";
   } catch {
     return "0.0.0-dev";
   }
@@ -15066,7 +15066,8 @@ var init_feature_flags = __esm({
       "enforcement-system",
       "browser-profiles",
       "governance-playground",
-      "token-spend"
+      "token-spend",
+      "policies"
     ];
   }
 });
@@ -16166,6 +16167,205 @@ var init_rate_card = __esm({
   }
 });
+function createDefaultDistributionPolicy(orgName) {
+  return {
+    orgName,
+    name: "distribution-first-v1",
+    description: "Enforces product discipline by requiring distribution/market validation before feature expansion work.",
+    type: "distribution-first",
+    status: "draft",
+    rules: DEFAULT_POLICY_RULES,
+    enforcement: {
+      enabled: true,
+      mode: "warn",
+      scope: "org"
+    },
+    createdBy: "system",
+    version: 1
+  };
+}
+function evaluatePolicyRule(rule, context2) {
+  const { condition } = rule;
+  let matches = false;
+  switch (condition.type) {
+    case "work_type": {
+      const workType = context2.workType;
+      if (!workType)
+        break;
+      matches = evaluateCondition(workType, condition.operator, condition.value);
+      break;
+    }
+    case "repo_pattern": {
+      const repo = context2.repo;
+      if (!repo)
+        break;
+      matches = evaluateCondition(repo, condition.operator, condition.value);
+      break;
+    }
+    case "label": {
+      const labels = context2.issueLabels || [];
+      if (labels.length === 0)
+        break;
+      if (condition.operator === "equals") {
+        matches = labels.includes(String(condition.value));
+      } else if (condition.operator === "in" && Array.isArray(condition.value)) {
+        matches = labels.some((l) => condition.value.includes(l));
+      } else if (condition.operator === "contains") {
+        matches = labels.some((l) => l.includes(String(condition.value)));
+      }
+      break;
+    }
+    case "issue_title": {
+      const title = context2.issueTitle;
+      if (!title)
+        break;
+      matches = evaluateCondition(title, condition.operator, condition.value);
+      break;
+    }
+    case "custom": {
+      matches = false;
+      break;
+    }
+  }
+  if (matches) {
+    return {
+      matches: true,
+      reason: {
+        ruleId: rule.id,
+        ruleName: rule.name,
+        message: rule.message,
+        severity: rule.severity || "warning",
+        evidenceRequired: rule.evidenceRequired
+      }
+    };
+  }
+  return { matches: false };
+}
+function evaluateCondition(actual, operator, expected) {
+  switch (operator) {
+    case "equals":
+      return actual === expected;
+    case "contains":
+      return actual.includes(String(expected));
+    case "matches":
+      try {
+        return new RegExp(String(expected)).test(actual);
+      } catch {
+        return false;
+      }
+    case "in":
+      return Array.isArray(expected) && expected.includes(actual);
+    case "not_in":
+      return Array.isArray(expected) && !expected.includes(actual);
+    default:
+      return false;
+  }
+}
+function checkPolicy(policy, context2) {
+  const reasons = [];
+  const evidenceRequired = [];
+  if (!policy.enforcement.enabled || policy.enforcement.mode === "off") {
+    return {
+      allowed: true,
+      mode: "off",
+      policyId: policy.id,
+      policyName: policy.name,
+      policyVersion: policy.version,
+      reasons: [],
+      evidenceRequired: [],
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  if (policy.enforcement.scope === "repo" && policy.enforcement.repoScope) {
+    if (context2.repo && !policy.enforcement.repoScope.includes(context2.repo)) {
+      return {
+        allowed: true,
+        mode: "off",
+        policyId: policy.id,
+        policyName: policy.name,
+        policyVersion: policy.version,
+        reasons: [],
+        evidenceRequired: [],
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  }
+  for (const rule of policy.rules) {
+    const result = evaluatePolicyRule(rule, context2);
+    if (result.matches && result.reason) {
+      reasons.push(result.reason);
+      if (result.reason.evidenceRequired) {
+        evidenceRequired.push(...result.reason.evidenceRequired);
+      }
+    }
+  }
+  const hasBlock = reasons.some((r2) => r2.severity === "error");
+  const hasWarn = reasons.some((r2) => r2.severity === "warning");
+  let allowed = true;
+  let mode = policy.enforcement.mode;
+  if (hasBlock) {
+    if (mode === "block") {
+      allowed = false;
+    } else if (mode === "warn") {
+      allowed = true;
+    }
+  } else if (hasWarn) {
+    allowed = true;
+  }
+  return {
+    allowed,
+    mode,
+    policyId: policy.id,
+    policyName: policy.name,
+    policyVersion: policy.version,
+    reasons,
+    evidenceRequired: [...new Set(evidenceRequired)],
+    overridePath: allowed ? void 0 : `/api/policies/${policy.id}/override`,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var DEFAULT_POLICY_RULES;
+var init_policy = __esm({
+  "module_93"() {
+    "use strict";
+    DEFAULT_POLICY_RULES = [
+      {
+        id: "check-distribution-status",
+        name: "Distribution Status Check",
+        description: "Requires distribution/market validation before feature work",
+        condition: {
+          type: "work_type",
+          operator: "in",
+          value: [
+            "feature",
+            "migration",
+            "isolation",
+            "agentization",
+            "platformization"
+          ]
+        },
+        action: "warn",
+        message: "This work type requires distribution status documentation. Ensure product-market research, early-adopter waitlist, or focused release planning is documented before proceeding.",
+        severity: "warning",
+        evidenceRequired: ["distribution-status-doc", "market-research-summary"]
+      },
+      {
+        id: "block-without-distribution",
+        name: "Block Without Distribution Review",
+        description: "Blocks work that has been flagged for distribution review",
+        condition: {
+          type: "label",
+          operator: "equals",
+          value: "needs-distribution-review"
+        },
+        action: "block",
+        message: "Work blocked pending distribution review. Complete distribution status documentation before proceeding.",
+        severity: "error"
+      }
+    ];
+  }
+});
 var dist_exports = {};
 __export(dist_exports, {
   AB_ROUTING_MODES: () => AB_ROUTING_MODES,
@@ -16202,6 +16402,7 @@ __export(dist_exports, {
   DEFAULT_OSS_EVAL_THRESHOLDS: () => DEFAULT_OSS_EVAL_THRESHOLDS,
   DEFAULT_OSS_EVAL_WEIGHTS: () => DEFAULT_OSS_EVAL_WEIGHTS,
   DEFAULT_OSS_EVAL_WIN_CRITERIA: () => DEFAULT_OSS_EVAL_WIN_CRITERIA,
+  DEFAULT_POLICY_RULES: () => DEFAULT_POLICY_RULES,
   DEFAULT_PROVIDER_PRECEDENCE: () => DEFAULT_PROVIDER_PRECEDENCE,
   DEFAULT_RUNNER_LABEL: () => DEFAULT_RUNNER_LABEL,
   DEFAULT_SESSION_AGENT: () => DEFAULT_SESSION_AGENT,
@@ -16241,7 +16442,10 @@ __export(dist_exports, {
   calculateHealthState: () => calculateHealthState,
   calculateUsagePercent: () => calculateUsagePercent,
   checkEnforcement: () => checkEnforcement,
+  checkPolicy: () => checkPolicy,
+  createDefaultDistributionPolicy: () => createDefaultDistributionPolicy,
   determineFallbackReason: () => determineFallbackReason,
+  evaluatePolicyRule: () => evaluatePolicyRule,
   formatProviderSelection: () => formatProviderSelection,
   getCredentialProviderConfig: () => getCredentialProviderConfig,
   isActiveBackgroundAgentRunnerLabel: () => isActiveBackgroundAgentRunnerLabel,
@@ -16263,7 +16467,7 @@ __export(dist_exports, {
 });
 var GAL_TERMS_URL, GAL_PRIVACY_URL, PLATFORM_DIRECTORIES, PLATFORM_PATTERNS, DEFAULT_ENFORCEMENT_SETTINGS, DEFAULT_DISPATCH_CATEGORIES;
 var init_dist2 = __esm({
-  "module_93"() {
+  "module_94"() {
     "use strict";
     init_platform_registry();
     init_platform_registry();
@@ -16331,6 +16535,7 @@ var init_dist2 = __esm({
     init_user_settings();
     init_token_budget();
     init_rate_card();
+    init_policy();
     GAL_TERMS_URL = "https://scheduler-systems.com/legal/en/gal-terms.pdf";
     GAL_PRIVACY_URL = "https://scheduler-systems.com/legal/en/gal-privacy.pdf";
     PLATFORM_DIRECTORIES = PLATFORM_DIRECTORY_MAP;
@@ -16637,7 +16842,7 @@ async function checkTermsAcceptance() {
 }
 var import_fs10, import_path10, import_os9, readline3, GAL_DIR3, CONFIG_FILE, TERMS_URL, PRIVACY_URL, TERMS_VERSION;
 var init_terms_acceptance = __esm({
-  "module_94"() {
+  "module_95"() {
     "use strict";
     import_fs10 = require("fs");
     import_path10 = require("path");
@@ -16720,7 +16925,7 @@ function showPeriodicReminder() {
 }
 var import_fs11, import_path11, import_os10, GAL_DIR4, PREVIEW_STATE_FILE, ONE_DAY_MS, FEEDBACK_URL;
 var init_research_preview = __esm({
-  "module_95"() {
+  "module_96"() {
     "use strict";
     import_fs11 = require("fs");
     import_path11 = require("path");
@@ -16736,7 +16941,7 @@ var init_research_preview = __esm({
 var Organization;
 var init_organization = __esm({
-  "module_96"() {
+  "module_97"() {
     "use strict";
     Organization = class {
       constructor(id, name, installationId3, accountType, totalRepos, totalConfigs, totalCommands, totalHooks, settings, commands, hooks, platforms, hookSettings, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, configRepoEnabled, configRepoUrl, configRepoCreatedAt, lastConfigSyncAt, lastScanAt, audienceTierRef, audienceTierSource, entitledFeatures, installedByGithubId, installedByLogin, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date(), memberCount) {
@@ -16835,20 +17040,20 @@ var init_organization = __esm({
 });
 var init_user2 = __esm({
-  "module_97"() {
+  "module_98"() {
     "use strict";
   }
 });
 var init_scan_result = __esm({
-  "module_98"() {
+  "module_99"() {
     "use strict";
   }
 });
 var TeamMember;
 var init_team_member = __esm({
-  "module_99"() {
+  "module_100"() {
     "use strict";
     TeamMember = class {
       constructor(userId, githubLogin, githubId, name, email, avatarUrl, githubOrgRole, galRole, roleAssignedBy, roleAssignedAt, lastActiveAt, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
@@ -16945,146 +17150,146 @@ var init_team_member = __esm({
 });
 var init_subscription = __esm({
-  "module_100"() {
+  "module_101"() {
     "use strict";
   }
 });
 var init_workspace2 = __esm({
-  "module_101"() {
+  "module_102"() {
     "use strict";
   }
 });
 var init_workspace_membership = __esm({
-  "module_102"() {
+  "module_103"() {
     "use strict";
   }
 });
 var init_IOrganizationRepository = __esm({
-  "module_103"() {
+  "module_104"() {
     "use strict";
   }
 });
 var init_IUserRepository = __esm({
-  "module_104"() {
+  "module_105"() {
     "use strict";
   }
 });
 var init_IScanResultRepository = __esm({
-  "module_105"() {
+  "module_106"() {
     "use strict";
   }
 });
 var init_ISubscriptionRepository = __esm({
-  "module_106"() {
+  "module_107"() {
     "use strict";
   }
 });
 var init_IPersonalGitHubRepository = __esm({
-  "module_107"() {
+  "module_108"() {
     "use strict";
   }
 });
 var init_IWorkspacePreferenceRepository = __esm({
-  "module_108"() {
+  "module_109"() {
     "use strict";
   }
 });
 var init_IWorkItemRepository = __esm({
-  "module_109"() {
+  "module_110"() {
     "use strict";
   }
 });
 var init_IAuthRepository = __esm({
-  "module_110"() {
+  "module_111"() {
     "use strict";
   }
 });
 var init_IWorkspaceRepository = __esm({
-  "module_111"() {
+  "module_112"() {
     "use strict";
   }
 });
 var init_ISessionRepository = __esm({
-  "module_112"() {
+  "module_113"() {
     "use strict";
   }
 });
 var init_IConfigRepository = __esm({
-  "module_113"() {
+  "module_114"() {
     "use strict";
   }
 });
 var init_IProposalRepository = __esm({
-  "module_114"() {
+  "module_115"() {
     "use strict";
   }
 });
 var init_ITrackedRepoRepository = __esm({
-  "module_115"() {
+  "module_116"() {
     "use strict";
   }
 });
 var init_ISdlcRepository = __esm({
-  "module_116"() {
+  "module_117"() {
     "use strict";
   }
 });
 var init_ICredentialRepository = __esm({
-  "module_117"() {
+  "module_118"() {
     "use strict";
   }
 });
 var init_IInviteRepository = __esm({
-  "module_118"() {
+  "module_119"() {
     "use strict";
   }
 });
 var init_IBillingRepository = __esm({
-  "module_119"() {
+  "module_120"() {
     "use strict";
   }
 });
 var init_IFleetRepository = __esm({
-  "module_120"() {
+  "module_121"() {
     "use strict";
   }
 });
 var init_ITelemetryRepository = __esm({
-  "module_121"() {
+  "module_122"() {
     "use strict";
   }
 });
 var init_RedirectValidator = __esm({
-  "module_122"() {
+  "module_123"() {
     "use strict";
   }
 });
 var DomainError;
 var init_DomainError = __esm({
-  "module_123"() {
+  "module_124"() {
     "use strict";
     DomainError = class _DomainError extends Error {
       constructor(message, code) {
@@ -17099,7 +17304,7 @@ var init_DomainError = __esm({
 var OrganizationService;
 var init_OrganizationService = __esm({
-  "module_124"() {
+  "module_125"() {
     "use strict";
     init_organization();
     init_DomainError();
@@ -17300,7 +17505,7 @@ var init_OrganizationService = __esm({
 var ValidationError;
 var init_ValidationError = __esm({
-  "module_125"() {
+  "module_126"() {
     "use strict";
     init_DomainError();
     ValidationError = class _ValidationError extends DomainError {
@@ -17334,7 +17539,7 @@ var init_ValidationError = __esm({
 var TeamService;
 var init_TeamService = __esm({
-  "module_126"() {
+  "module_127"() {
     "use strict";
     init_team_member();
     init_ValidationError();
@@ -17481,13 +17686,13 @@ var init_TeamService = __esm({
 });
 var init_TeamSyncService = __esm({
-  "module_127"() {
+  "module_128"() {
     "use strict";
   }
 });
 var init_organizations = __esm({
-  "module_128"() {
+  "module_129"() {
     "use strict";
     init_OrganizationService();
     init_TeamService();
@@ -17497,7 +17702,7 @@ var init_organizations = __esm({
 var SubscriptionService;
 var init_SubscriptionService = __esm({
-  "module_129"() {
+  "module_130"() {
     "use strict";
     SubscriptionService = class {
       constructor(subscriptionRepository) {
@@ -17520,14 +17725,14 @@ var init_SubscriptionService = __esm({
 });
 var init_subscriptions = __esm({
-  "module_130"() {
+  "module_131"() {
     "use strict";
     init_SubscriptionService();
   }
 });
 var init_WorkspaceService = __esm({
-  "module_131"() {
+  "module_132"() {
     "use strict";
     init_workspace2();
     init_workspace_membership();
@@ -17535,20 +17740,20 @@ var init_WorkspaceService = __esm({
 });
 var init_workspace3 = __esm({
-  "module_132"() {
+  "module_133"() {
     "use strict";
     init_WorkspaceService();
   }
 });
 var init_IEnvironmentConfig = __esm({
-  "module_133"() {
+  "module_134"() {
     "use strict";
   }
 });
 var init_admin_orgs = __esm({
-  "module_134"() {
+  "module_135"() {
     "use strict";
   }
 });
@@ -17558,7 +17763,7 @@ function meetsAudience(userTier, required = "public") {
 }
 var TIER_RANK;
 var init_audience_tier = __esm({
-  "module_135"() {
+  "module_136"() {
     "use strict";
     TIER_RANK = {
       public: 0,
@@ -17569,7 +17774,7 @@ var init_audience_tier = __esm({
 });
 var init_browser_profile_storage_state = __esm({
-  "module_136"() {
+  "module_137"() {
     "use strict";
   }
 });
@@ -17754,28 +17959,28 @@ function compileApprovedConfigEnforcementManifest(config) {
   };
 }
 var init_approved_config_enforcement = __esm({
-  "module_137"() {
+  "module_138"() {
     "use strict";
     init_dist2();
   }
 });
 var init_AuthError = __esm({
-  "module_138"() {
+  "module_139"() {
     "use strict";
     init_DomainError();
   }
 });
 var init_convenience_model_telemetry = __esm({
-  "module_139"() {
+  "module_140"() {
     "use strict";
   }
 });
 var VALID_CONFIG_CLASSES, VALID_RISK_TAGS, VALID_SEVERITIES, VALID_COMPLEXITIES, VALID_SOURCES, CURRENT_SCHEMA_VERSION, MAX_BULLET_POINTS, MIN_BULLET_POINTS, MAX_ONE_LINER_LENGTH, MAX_RISK_DESCRIPTION_LENGTH, MAX_RISKS, DiscoveryInsightValidator, discoveryInsightValidator;
 var init_DiscoveryInsightValidator = __esm({
-  "module_140"() {
+  "module_141"() {
     "use strict";
     VALID_CONFIG_CLASSES = [
       "security",
@@ -18008,19 +18213,19 @@ var init_DiscoveryInsightValidator = __esm({
 });
 var init_MigrationRegistry = __esm({
-  "module_141"() {
+  "module_142"() {
     "use strict";
   }
 });
 var init_register_all_migrations = __esm({
-  "module_142"() {
+  "module_143"() {
     "use strict";
   }
 });
 var init_src = __esm({
-  "module_143"() {
+  "module_144"() {
     "use strict";
     init_organization();
     init_user2();
@@ -18270,7 +18475,7 @@ function getAllInternalFlags() {
 }
 var COMMAND_CATEGORIES, PREVIEW_COMMANDS, COMMAND_FLAGS, INTERNAL_OPTIONS, INTERNAL_SUBCOMMANDS;
 var init_feature_flags2 = __esm({
-  "module_144"() {
+  "module_145"() {
     "use strict";
     init_src();
     init_gal_home();
@@ -18368,7 +18573,7 @@ function mimicFunction(to, from, { ignoreNonConfigurable = false } = {}) {
 }
 var copyProperty, canCopyProperty, changePrototype, wrappedToString, toStringDescriptor, toStringName, changeToString;
 var init_mimic_function = __esm({
-  "module_145"() {
+  "module_146"() {
     copyProperty = (to, from, property, ignoreNonConfigurable) => {
       if (property === "length" || property === "prototype") {
         return;
@@ -18409,7 +18614,7 @@ ${fromBody}`;
 var calledFunctions, onetime, onetime_default;
 var init_onetime = __esm({
-  "module_146"() {
+  "module_147"() {
     init_mimic_function();
     calledFunctions = /* @__PURE__ */ new WeakMap();
     onetime = (function_, options = {}) => {
@@ -18445,7 +18650,7 @@ var init_onetime = __esm({
 var signals;
 var init_signals = __esm({
-  "module_147"() {
+  "module_148"() {
     signals = [];
     signals.push("SIGHUP", "SIGINT", "SIGTERM");
     if (process.platform !== "win32") {
@@ -18473,7 +18678,7 @@ var init_signals = __esm({
 var processOk, kExitEmitter, global2, ObjectDefineProperty, Emitter, SignalExitBase, signalExitWrap, SignalExitFallback, SignalExit, process3, onExit, load, unload;
 var init_mjs = __esm({
-  "module_148"() {
+  "module_149"() {
     init_signals();
     processOk = (process9) => !!process9 && typeof process9 === "object" && typeof process9.removeListener === "function" && typeof process9.emit === "function" && typeof process9.reallyExit === "function" && typeof process9.listeners === "function" && typeof process9.kill === "function" && typeof process9.pid === "number" && typeof process9.on === "function";
     kExitEmitter = /* @__PURE__ */ Symbol.for("signal-exit emitter");
@@ -18711,7 +18916,7 @@ var init_mjs = __esm({
 var import_node_process2, terminal, restoreCursor, restore_cursor_default;
 var init_restore_cursor = __esm({
-  "module_149"() {
+  "module_150"() {
     import_node_process2 = __toESM(require("node:process"), 1);
     init_onetime();
     init_mjs();
@@ -18728,7 +18933,7 @@ var init_restore_cursor = __esm({
 var import_node_process3, isHidden, cliCursor, cli_cursor_default;
 var init_cli_cursor = __esm({
-  "module_150"() {
+  "module_151"() {
     import_node_process3 = __toESM(require("node:process"), 1);
     init_restore_cursor();
     isHidden = false;
@@ -18764,7 +18969,7 @@ var init_cli_cursor = __esm({
 var spinners_default;
 var init_spinners = __esm({
-  "module_151"() {
+  "module_152"() {
     spinners_default = {
       dots: {
         interval: 80,
@@ -20467,7 +20672,7 @@ var init_spinners = __esm({
 var cli_spinners_default, spinnersList;
 var init_cli_spinners = __esm({
-  "module_152"() {
+  "module_153"() {
     init_spinners();
     cli_spinners_default = spinners_default;
     spinnersList = Object.keys(spinners_default);
@@ -20476,7 +20681,7 @@ var init_cli_spinners = __esm({
 var import_node_tty2, hasColors, format, reset, bold, dim, italic, underline, overline, inverse, hidden, strikethrough, black, red, green, yellow, blue, magenta, cyan, white, gray, bgBlack, bgRed, bgGreen, bgYellow, bgBlue, bgMagenta, bgCyan, bgWhite, bgGray, redBright, greenBright, yellowBright, blueBright, magentaBright, cyanBright, whiteBright, bgRedBright, bgGreenBright, bgYellowBright, bgBlueBright, bgMagentaBright, bgCyanBright, bgWhiteBright;
 var init_base = __esm({
-  "module_153"() {
+  "module_154"() {
     import_node_tty2 = __toESM(require("node:tty"), 1);
     hasColors = import_node_tty2.default?.WriteStream?.prototype?.hasColors?.() ?? false;
     format = (open, close) => {
@@ -20549,7 +20754,7 @@ var init_base = __esm({
 });
 var init_yoctocolors = __esm({
-  "module_154"() {
+  "module_155"() {
     init_base();
     init_base();
   }
@@ -20565,7 +20770,7 @@ function isUnicodeSupported() {
 }
 var import_node_process4;
 var init_is_unicode_supported = __esm({
-  "module_155"() {
+  "module_156"() {
     import_node_process4 = __toESM(require("node:process"), 1);
   }
 });
@@ -20579,7 +20784,7 @@ __export(symbols_exports, {
 });
 var _isUnicodeSupported, info, success, warning, error;
 var init_symbols = __esm({
-  "module_156"() {
+  "module_157"() {
     init_yoctocolors();
     init_is_unicode_supported();
     _isUnicodeSupported = isUnicodeSupported();
@@ -20591,7 +20796,7 @@ var init_symbols = __esm({
 });
 var init_log_symbols = __esm({
-  "module_157"() {
+  "module_158"() {
     init_symbols();
   }
 });
@@ -20604,7 +20809,7 @@ function ansiRegex({ onlyFirst = false } = {}) {
   return new RegExp(pattern, onlyFirst ? void 0 : "g");
 }
 var init_ansi_regex = __esm({
-  "module_158"() {
+  "module_159"() {
   }
 });
@@ -20619,7 +20824,7 @@ function stripAnsi(string) {
 }
 var regex;
 var init_strip_ansi = __esm({
-  "module_159"() {
+  "module_160"() {
     init_ansi_regex();
     regex = ansiRegex();
   }
@@ -20627,7 +20832,7 @@ var init_strip_ansi = __esm({
 var ambiguousRanges, fullwidthRanges, halfwidthRanges, narrowRanges, wideRanges;
 var init_lookup_data = __esm({
-  "module_160"() {
+  "module_161"() {
     ambiguousRanges = [161, 161, 164, 164, 167, 168, 170, 170, 173, 174, 176, 180, 182, 186, 188, 191, 198, 198, 208, 208, 215, 216, 222, 225, 230, 230, 232, 234, 236, 237, 240, 240, 242, 243, 247, 250, 252, 252, 254, 254, 257, 257, 273, 273, 275, 275, 283, 283, 294, 295, 299, 299, 305, 307, 312, 312, 319, 322, 324, 324, 328, 331, 333, 333, 338, 339, 358, 359, 363, 363, 462, 462, 464, 464, 466, 466, 468, 468, 470, 470, 472, 472, 474, 474, 476, 476, 593, 593, 609, 609, 708, 708, 711, 711, 713, 715, 717, 717, 720, 720, 728, 731, 733, 733, 735, 735, 768, 879, 913, 929, 931, 937, 945, 961, 963, 969, 1025, 1025, 1040, 1103, 1105, 1105, 8208, 8208, 8211, 8214, 8216, 8217, 8220, 8221, 8224, 8226, 8228, 8231, 8240, 8240, 8242, 8243, 8245, 8245, 8251, 8251, 8254, 8254, 8308, 8308, 8319, 8319, 8321, 8324, 8364, 8364, 8451, 8451, 8453, 8453, 8457, 8457, 8467, 8467, 8470, 8470, 8481, 8482, 8486, 8486, 8491, 8491, 8531, 8532, 8539, 8542, 8544, 8555, 8560, 8569, 8585, 8585, 8592, 8601, 8632, 8633, 8658, 8658, 8660, 8660, 8679, 8679, 8704, 8704, 8706, 8707, 8711, 8712, 8715, 8715, 8719, 8719, 8721, 8721, 8725, 8725, 8730, 8730, 8733, 8736, 8739, 8739, 8741, 8741, 8743, 8748, 8750, 8750, 8756, 8759, 8764, 8765, 8776, 8776, 8780, 8780, 8786, 8786, 8800, 8801, 8804, 8807, 8810, 8811, 8814, 8815, 8834, 8835, 8838, 8839, 8853, 8853, 8857, 8857, 8869, 8869, 8895, 8895, 8978, 8978, 9312, 9449, 9451, 9547, 9552, 9587, 9600, 9615, 9618, 9621, 9632, 9633, 9635, 9641, 9650, 9651, 9654, 9655, 9660, 9661, 9664, 9665, 9670, 9672, 9675, 9675, 9678, 9681, 9698, 9701, 9711, 9711, 9733, 9734, 9737, 9737, 9742, 9743, 9756, 9756, 9758, 9758, 9792, 9792, 9794, 9794, 9824, 9825, 9827, 9829, 9831, 9834, 9836, 9837, 9839, 9839, 9886, 9887, 9919, 9919, 9926, 9933, 9935, 9939, 9941, 9953, 9955, 9955, 9960, 9961, 9963, 9969, 9972, 9972, 9974, 9977, 9979, 9980, 9982, 9983, 10045, 10045, 10102, 10111, 11094, 11097, 12872, 12879, 57344, 63743, 65024, 65039, 65533, 65533, 127232, 127242, 127248, 127277, 127280, 127337, 127344, 127373, 127375, 127376, 127387, 127404, 917760, 917999, 983040, 1048573, 1048576, 1114109];
     fullwidthRanges = [12288, 12288, 65281, 65376, 65504, 65510];
     halfwidthRanges = [8361, 8361, 65377, 65470, 65474, 65479, 65482, 65487, 65490, 65495, 65498, 65500, 65512, 65518];
@@ -20638,7 +20843,7 @@ var init_lookup_data = __esm({
 var isInRange;
 var init_utilities2 = __esm({
-  "module_161"() {
+  "module_162"() {
     isInRange = (ranges, codePoint) => {
       let low = 0;
       let high = Math.floor(ranges.length / 2) - 1;
@@ -20676,7 +20881,7 @@ function findWideFastPathRange(ranges) {
 }
 var minimumAmbiguousCodePoint, maximumAmbiguousCodePoint, minimumFullWidthCodePoint, maximumFullWidthCodePoint, minimumHalfWidthCodePoint, maximumHalfWidthCodePoint, minimumNarrowCodePoint, maximumNarrowCodePoint, minimumWideCodePoint, maximumWideCodePoint, commonCjkCodePoint, wideFastPathStart, wideFastPathEnd, isAmbiguous, isFullWidth, isWide;
 var init_lookup = __esm({
-  "module_162"() {
+  "module_163"() {
     init_lookup_data();
     init_utilities2();
     minimumAmbiguousCodePoint = ambiguousRanges[0];
@@ -20728,7 +20933,7 @@ function eastAsianWidth(codePoint, { ambiguousAsWide = false } = {}) {
   return 1;
 }
 var init_get_east_asian_width = __esm({
-  "module_163"() {
+  "module_164"() {
     init_lookup();
   }
 });
@@ -20852,7 +21057,7 @@ function stringWidth(input, options = {}) {
 }
 var segmenter, zeroWidthClusterRegex, leadingNonPrintingRegex, rgiEmojiRegex, unqualifiedKeycapRegex, extendedPictographicRegex;
 var init_string_width = __esm({
-  "module_164"() {
+  "module_165"() {
     init_strip_ansi();
     init_get_east_asian_width();
     segmenter = new Intl.Segmenter();
@@ -20870,13 +21075,13 @@ function isInteractive({ stream = process.stdout } = {}) {
   );
 }
 var init_is_interactive = __esm({
-  "module_165"() {
+  "module_166"() {
   }
 });
 var import_node_process5, ASCII_ETX_CODE, StdinDiscarder, stdinDiscarder, stdin_discarder_default;
 var init_stdin_discarder = __esm({
-  "module_166"() {
+  "module_167"() {
     import_node_process5 = __toESM(require("node:process"), 1);
     ASCII_ETX_CODE = 3;
     StdinDiscarder = class {
@@ -20949,7 +21154,7 @@ function ora(options) {
 }
 var import_node_process6, import_node_util, RENDER_DEFERRAL_TIMEOUT, SYNCHRONIZED_OUTPUT_ENABLE, SYNCHRONIZED_OUTPUT_DISABLE, activeHooksPerStream, validColors, Ora;
 var init_ora = __esm({
-  "module_167"() {
+  "module_168"() {
     import_node_process6 = __toESM(require("node:process"), 1);
     import_node_util = require("node:util");
     init_source();
@@ -21421,7 +21626,7 @@ var init_ora = __esm({
 var DEFAULT_TIMEOUT_MS, DEFAULT_CREDENTIALS, normalizeHeaders, createHttpFetch;
 var init_http_client = __esm({
-  "module_168"() {
+  "module_169"() {
     "use strict";
     DEFAULT_TIMEOUT_MS = 1e4;
     DEFAULT_CREDENTIALS = "include";
@@ -21493,7 +21698,7 @@ var init_http_client = __esm({
 var HttpClient;
 var init_HttpClient = __esm({
-  "module_169"() {
+  "module_170"() {
     "use strict";
     HttpClient = class {
       constructor(config) {
@@ -21559,7 +21764,7 @@ var init_HttpClient = __esm({
 var HttpConfigRepository;
 var init_HttpConfigRepository = __esm({
-  "module_170"() {
+  "module_171"() {
     "use strict";
     init_HttpClient();
     HttpConfigRepository = class extends HttpClient {
@@ -21835,7 +22040,7 @@ var init_HttpConfigRepository = __esm({
 var HttpFleetRepository;
 var init_HttpFleetRepository = __esm({
-  "module_171"() {
+  "module_172"() {
     "use strict";
     init_HttpClient();
     HttpFleetRepository = class extends HttpClient {
@@ -21959,7 +22164,7 @@ var init_HttpFleetRepository = __esm({
 var HttpInviteRepository;
 var init_HttpInviteRepository = __esm({
-  "module_172"() {
+  "module_173"() {
     "use strict";
     init_HttpClient();
     HttpInviteRepository = class extends HttpClient {
@@ -22019,7 +22224,7 @@ var init_HttpInviteRepository = __esm({
 var HttpProposalRepository;
 var init_HttpProposalRepository = __esm({
-  "module_173"() {
+  "module_174"() {
     "use strict";
     init_HttpClient();
     HttpProposalRepository = class extends HttpClient {
@@ -22115,7 +22320,7 @@ var init_HttpProposalRepository = __esm({
 var HttpAuthRepository;
 var init_HttpAuthRepository = __esm({
-  "module_174"() {
+  "module_175"() {
     "use strict";
     init_HttpClient();
     HttpAuthRepository = class extends HttpClient {
@@ -22268,7 +22473,7 @@ var init_HttpAuthRepository = __esm({
 var HttpTelemetryRepository;
 var init_HttpTelemetryRepository = __esm({
-  "module_175"() {
+  "module_176"() {
     "use strict";
     init_HttpClient();
     HttpTelemetryRepository = class extends HttpClient {
@@ -22322,7 +22527,7 @@ var init_HttpTelemetryRepository = __esm({
 var Organization2;
 var init_organization2 = __esm({
-  "module_176"() {
+  "module_177"() {
     "use strict";
     Organization2 = class {
       constructor(id, name, installationId3, accountType, totalRepos, totalConfigs, totalCommands, totalHooks, settings, commands, hooks, platforms, hookSettings, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, configRepoEnabled, configRepoUrl, configRepoCreatedAt, lastConfigSyncAt, lastScanAt, audienceTierRef, audienceTierSource, entitledFeatures, installedByGithubId, installedByLogin, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date(), memberCount) {
@@ -22423,7 +22628,7 @@ var init_organization2 = __esm({
 var User;
 var init_user3 = __esm({
-  "module_177"() {
+  "module_178"() {
     "use strict";
     User = class {
       constructor(githubId, login, email, name, avatarUrl, organizations, adminOrganizations, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date(), providers = []) {
@@ -22577,7 +22782,7 @@ var init_user3 = __esm({
 var ScanResult;
 var init_scan_result2 = __esm({
-  "module_178"() {
+  "module_179"() {
     "use strict";
     ScanResult = class {
       constructor(platform5, owner, repo, scannedAt, settings, rules = [], commands = [], hooks = [], agents = [], instructions, cursorRules, agentsMd, geminiMd, windsurfRules, copilotInstructions, mcpConfig) {
@@ -22677,7 +22882,7 @@ var init_scan_result2 = __esm({
 var TeamMember2;
 var init_team_member2 = __esm({
-  "module_179"() {
+  "module_180"() {
     "use strict";
     TeamMember2 = class {
       constructor(userId, githubLogin, githubId, name, email, avatarUrl, githubOrgRole, galRole, roleAssignedBy, roleAssignedAt, lastActiveAt, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
@@ -22776,7 +22981,7 @@ var init_team_member2 = __esm({
 var Subscription, TIER_LEVELS, FEATURE_REQUIREMENTS;
 var init_subscription2 = __esm({
-  "module_180"() {
+  "module_181"() {
     "use strict";
     Subscription = class {
       constructor(organizationName, planTier, seatLimit, stripeCustomerId, stripeSubscriptionId, manualGrant, createdAt = /* @__PURE__ */ new Date(), updatedAt = /* @__PURE__ */ new Date()) {
@@ -22907,145 +23112,145 @@ var init_subscription2 = __esm({
 });
 var init_workspace4 = __esm({
-  "module_181"() {
+  "module_182"() {
     "use strict";
   }
 });
 var init_workspace_membership2 = __esm({
-  "module_182"() {
+  "module_183"() {
     "use strict";
   }
 });
 var init_IOrganizationRepository2 = __esm({
-  "module_183"() {
+  "module_184"() {
     "use strict";
   }
 });
 var init_IUserRepository2 = __esm({
-  "module_184"() {
+  "module_185"() {
     "use strict";
   }
 });
 var init_IScanResultRepository2 = __esm({
-  "module_185"() {
+  "module_186"() {
     "use strict";
   }
 });
 var init_ISubscriptionRepository2 = __esm({
-  "module_186"() {
+  "module_187"() {
     "use strict";
   }
 });
 var init_IPersonalGitHubRepository2 = __esm({
-  "module_187"() {
+  "module_188"() {
     "use strict";
   }
 });
 var init_IWorkspacePreferenceRepository2 = __esm({
-  "module_188"() {
+  "module_189"() {
     "use strict";
   }
 });
 var init_IWorkItemRepository2 = __esm({
-  "module_189"() {
+  "module_190"() {
     "use strict";
   }
 });
 var init_IAuthRepository2 = __esm({
-  "module_190"() {
+  "module_191"() {
     "use strict";
   }
 });
 var init_IWorkspaceRepository2 = __esm({
-  "module_191"() {
+  "module_192"() {
     "use strict";
   }
 });
 var init_ISessionRepository2 = __esm({
-  "module_192"() {
+  "module_193"() {
     "use strict";
   }
 });
 var init_IConfigRepository2 = __esm({
-  "module_193"() {
+  "module_194"() {
     "use strict";
   }
 });
 var init_IProposalRepository2 = __esm({
-  "module_194"() {
+  "module_195"() {
     "use strict";
   }
 });
 var init_ITrackedRepoRepository2 = __esm({
-  "module_195"() {
+  "module_196"() {
     "use strict";
   }
 });
 var init_ISdlcRepository2 = __esm({
-  "module_196"() {
+  "module_197"() {
     "use strict";
   }
 });
 var init_ICredentialRepository2 = __esm({
-  "module_197"() {
+  "module_198"() {
     "use strict";
   }
 });
 var init_IInviteRepository2 = __esm({
-  "module_198"() {
+  "module_199"() {
     "use strict";
   }
 });
 var init_IBillingRepository2 = __esm({
-  "module_199"() {
+  "module_200"() {
     "use strict";
   }
 });
 var init_IFleetRepository2 = __esm({
-  "module_200"() {
+  "module_201"() {
     "use strict";
   }
 });
 var init_ITelemetryRepository2 = __esm({
-  "module_201"() {
+  "module_202"() {
     "use strict";
   }
 });
 var init_RedirectValidator2 = __esm({
-  "module_202"() {
+  "module_203"() {
     "use strict";
   }
 });
 var init_DomainError2 = __esm({
-  "module_203"() {
+  "module_204"() {
     "use strict";
   }
 });
 var init_OrganizationService2 = __esm({
-  "module_204"() {
+  "module_205"() {
     "use strict";
     init_organization2();
     init_DomainError2();
@@ -23053,14 +23258,14 @@ var init_OrganizationService2 = __esm({
 });
 var init_ValidationError2 = __esm({
-  "module_205"() {
+  "module_206"() {
     "use strict";
     init_DomainError2();
   }
 });
 var init_TeamService2 = __esm({
-  "module_206"() {
+  "module_207"() {
     "use strict";
     init_team_member2();
     init_ValidationError2();
@@ -23069,13 +23274,13 @@ var init_TeamService2 = __esm({
 });
 var init_TeamSyncService2 = __esm({
-  "module_207"() {
+  "module_208"() {
     "use strict";
   }
 });
 var init_organizations2 = __esm({
-  "module_208"() {
+  "module_209"() {
     "use strict";
     init_OrganizationService2();
     init_TeamService2();
@@ -23084,20 +23289,20 @@ var init_organizations2 = __esm({
 });
 var init_SubscriptionService2 = __esm({
-  "module_209"() {
+  "module_210"() {
     "use strict";
   }
 });
 var init_subscriptions2 = __esm({
-  "module_210"() {
+  "module_211"() {
     "use strict";
     init_SubscriptionService2();
   }
 });
 var init_WorkspaceService2 = __esm({
-  "module_211"() {
+  "module_212"() {
     "use strict";
     init_workspace4();
     init_workspace_membership2();
@@ -23105,59 +23310,59 @@ var init_WorkspaceService2 = __esm({
 });
 var init_workspace5 = __esm({
-  "module_212"() {
+  "module_213"() {
     "use strict";
     init_WorkspaceService2();
   }
 });
 var init_IEnvironmentConfig2 = __esm({
-  "module_213"() {
+  "module_214"() {
     "use strict";
   }
 });
 var init_admin_orgs2 = __esm({
-  "module_214"() {
+  "module_215"() {
     "use strict";
   }
 });
 var init_audience_tier2 = __esm({
-  "module_215"() {
+  "module_216"() {
     "use strict";
   }
 });
 var init_browser_profile_storage_state2 = __esm({
-  "module_216"() {
+  "module_217"() {
     "use strict";
   }
 });
 var init_approved_config_enforcement2 = __esm({
-  "module_217"() {
+  "module_218"() {
     "use strict";
     init_dist2();
   }
 });
 var init_AuthError2 = __esm({
-  "module_218"() {
+  "module_219"() {
     "use strict";
     init_DomainError2();
   }
 });
 var init_convenience_model_telemetry2 = __esm({
-  "module_219"() {
+  "module_220"() {
     "use strict";
   }
 });
 var VALID_CONFIG_CLASSES2, VALID_RISK_TAGS2, VALID_SEVERITIES2, VALID_COMPLEXITIES2, VALID_SOURCES2, CURRENT_SCHEMA_VERSION2, MAX_BULLET_POINTS2, MIN_BULLET_POINTS2, MAX_ONE_LINER_LENGTH2, MAX_RISK_DESCRIPTION_LENGTH2, MAX_RISKS2, DiscoveryInsightValidator2, discoveryInsightValidator2;
 var init_DiscoveryInsightValidator2 = __esm({
-  "module_220"() {
+  "module_221"() {
     "use strict";
     VALID_CONFIG_CLASSES2 = [
       "security",
@@ -23369,19 +23574,19 @@ var init_DiscoveryInsightValidator2 = __esm({
 });
 var init_MigrationRegistry2 = __esm({
-  "module_221"() {
+  "module_222"() {
     "use strict";
   }
 });
 var init_register_all_migrations2 = __esm({
-  "module_222"() {
+  "module_223"() {
     "use strict";
   }
 });
 var init_dist3 = __esm({
-  "module_223"() {
+  "module_224"() {
     "use strict";
     init_organization2();
     init_user3();
@@ -23430,7 +23635,7 @@ var init_dist3 = __esm({
 var HttpOrganizationRepository;
 var init_HttpOrganizationRepository = __esm({
-  "module_224"() {
+  "module_225"() {
     "use strict";
     init_dist3();
     init_HttpClient();
@@ -23716,7 +23921,7 @@ var init_HttpOrganizationRepository = __esm({
 var HttpUserRepository;
 var init_HttpUserRepository = __esm({
-  "module_225"() {
+  "module_226"() {
     "use strict";
     init_dist3();
     init_HttpClient();
@@ -23844,7 +24049,7 @@ var init_HttpUserRepository = __esm({
 var HttpScanResultRepository;
 var init_HttpScanResultRepository = __esm({
-  "module_226"() {
+  "module_227"() {
     "use strict";
     init_dist3();
     init_http_client();
@@ -24028,7 +24233,7 @@ var init_HttpScanResultRepository = __esm({
 var HttpSubscriptionRepository;
 var init_HttpSubscriptionRepository = __esm({
-  "module_227"() {
+  "module_228"() {
     "use strict";
     init_dist3();
     init_HttpClient();
@@ -24201,7 +24406,7 @@ var init_HttpSubscriptionRepository = __esm({
 var HttpWorkItemRepository;
 var init_HttpWorkItemRepository = __esm({
-  "module_228"() {
+  "module_229"() {
     "use strict";
     init_HttpClient();
     HttpWorkItemRepository = class extends HttpClient {
@@ -24364,7 +24569,7 @@ var init_HttpWorkItemRepository = __esm({
 var HttpWorkflowTestRepository;
 var init_HttpWorkflowTestRepository = __esm({
-  "module_229"() {
+  "module_230"() {
     "use strict";
     init_HttpClient();
     HttpWorkflowTestRepository = class extends HttpClient {
@@ -24397,7 +24602,7 @@ var init_HttpWorkflowTestRepository = __esm({
 var HttpAdminRepository;
 var init_HttpAdminRepository = __esm({
-  "module_230"() {
+  "module_231"() {
     "use strict";
     init_HttpClient();
     HttpAdminRepository = class extends HttpClient {
@@ -24422,7 +24627,7 @@ var init_HttpAdminRepository = __esm({
 var HttpRunnerRepository;
 var init_HttpRunnerRepository = __esm({
-  "module_231"() {
+  "module_232"() {
     "use strict";
     init_HttpClient();
     HttpRunnerRepository = class extends HttpClient {
@@ -24440,7 +24645,7 @@ var init_HttpRunnerRepository = __esm({
 var HttpSessionRepository;
 var init_HttpSessionRepository = __esm({
-  "module_232"() {
+  "module_233"() {
     "use strict";
     init_HttpClient();
     HttpSessionRepository = class extends HttpClient {
@@ -24523,7 +24728,7 @@ var init_HttpSessionRepository = __esm({
 });
 var init_client = __esm({
-  "module_233"() {
+  "module_234"() {
     "use strict";
     init_http_client();
     init_HttpClient();
@@ -24636,7 +24841,7 @@ Organizations (${total}):
 }
 var defaultApiUrl2;
 var init_admin = __esm({
-  "module_234"() {
+  "module_235"() {
     "use strict";
     init_esm();
     init_source();
@@ -24694,7 +24899,7 @@ function buildSummary(warnings, capabilities) {
 }
 var RULES;
 var init_capability_analyzer = __esm({
-  "module_235"() {
+  "module_236"() {
     "use strict";
     RULES = [
       // 1. GitHub Actions / workflow files
@@ -25009,7 +25214,7 @@ async function fetchClaudeTokenExpiryStatus(params) {
 }
 var CLAUDE_TOKEN_WARNING_THRESHOLD_MS;
 var init_claude_token_expiry = __esm({
-  "module_236"() {
+  "module_237"() {
     "use strict";
     CLAUDE_TOKEN_WARNING_THRESHOLD_MS = 2 * 60 * 60 * 1e3;
   }
@@ -25553,7 +25758,7 @@ Examples:
 }
 var import_fs12, import_path12, SEVERITY_COLOR, SEVERITY_ICON;
 var init_agent_session = __esm({
-  "module_237"() {
+  "module_238"() {
     "use strict";
     init_esm();
     init_source();
@@ -25580,7 +25785,7 @@ var init_agent_session = __esm({
 var import_fs13, import_os11, import_path13, DEFAULT_WORKFLOW_REPOSITORY, CONFIG_DIR, CONFIG_FILE2, PID_FILE, LEGACY_DIR, LEGACY_CONFIG_FILE, LEGACY_PID_FILE, AgentQueueConfigManager;
 var init_AgentQueueConfigManager = __esm({
-  "module_238"() {
+  "module_239"() {
     "use strict";
     import_fs13 = require("fs");
     import_os11 = require("os");
@@ -30107,7 +30312,7 @@ function detectSeaRuntime() {
 }
 var import_pino, import_fs14, isProduction, isSea, isBundledCli, baseLogger;
 var init_agent_queue_logger = __esm({
-  "module_239"() {
+  "module_240"() {
     "use strict";
     import_pino = __toESM(require_pino(), 1);
     import_fs14 = require("fs");
@@ -30172,7 +30377,7 @@ function isInsideWindow(currentMinutes, startMinutes, endMinutes) {
 }
 var logger, SteadyModeController;
 var init_SteadyModeController = __esm({
-  "module_240"() {
+  "module_241"() {
     "use strict";
     init_agent_queue_logger();
     logger = createLogger("steady-mode");
@@ -30397,7 +30602,7 @@ function createGalAgent(config) {
 }
 var import_os12, import_child_process5, logger2, cliVersion3, DEFAULT_WORKFLOW_REPOSITORY2, GalAgent;
 var init_AgentQueueService = __esm({
-  "module_241"() {
+  "module_242"() {
     "use strict";
     import_os12 = require("os");
     import_child_process5 = require("child_process");
@@ -31559,7 +31764,7 @@ function createAgentQueueCommand() {
 }
 var import_os13, import_fs15, import_path14, import_os14;
 var init_queue = __esm({
-  "module_242"() {
+  "module_243"() {
     "use strict";
     init_esm();
     init_source();
@@ -31581,7 +31786,7 @@ function createAgentCommand() {
   return cmd;
 }
 var init_agent = __esm({
-  "module_243"() {
+  "module_244"() {
     "use strict";
     init_esm();
     init_agent_session();
@@ -31591,7 +31796,7 @@ var init_agent = __esm({
 var CoreServiceProvider;
 var init_CoreServiceProvider = __esm({
-  "module_244"() {
+  "module_245"() {
     "use strict";
     init_src();
     init_client();
@@ -32272,7 +32477,7 @@ function injectGalBrowserServer(directory, projectPath2, profileDir, disabledSer
 }
 var import_fs16, import_path15, import_os15, GAL_MCP_URL, GAL_BROWSER_MCP_ENV, MANAGED_CODEX_MCP_SECTIONS, CODEX_MEMORY_HOOK_MARKER, CODEX_MEMORY_HOOK_ENV, injectGalAutomationServers;
 var init_mcp_config_writer = __esm({
-  "module_245"() {
+  "module_246"() {
     "use strict";
     import_fs16 = require("fs");
     import_path15 = require("path");
@@ -32438,7 +32643,7 @@ function mergeStorageStateFiles(filePaths, outputPath) {
 }
 var import_fs17, import_path16, MERGED_FILENAME;
 var init_browser_profile_sync = __esm({
-  "module_246"() {
+  "module_247"() {
     "use strict";
     import_fs17 = require("fs");
     import_path16 = require("path");
@@ -32495,7 +32700,7 @@ async function pushProfileStorageState(config, profileName, storageStateJson) {
 }
 var import_fs18;
 var init_profile_sync = __esm({
-  "module_247"() {
+  "module_248"() {
     "use strict";
     import_fs18 = require("fs");
   }
@@ -68882,7 +69087,7 @@ function rng() {
 }
 var import_crypto3, rnds8Pool, poolPtr;
 var init_rng = __esm({
-  "module_248"() {
+  "module_249"() {
     import_crypto3 = __toESM(require("crypto"));
     rnds8Pool = new Uint8Array(256);
     poolPtr = rnds8Pool.length;
@@ -68891,7 +69096,7 @@ var init_rng = __esm({
 var regex_default;
 var init_regex = __esm({
-  "module_249"() {
+  "module_250"() {
     regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
   }
 });
@@ -68901,7 +69106,7 @@ function validate2(uuid) {
 }
 var validate_default;
 var init_validate = __esm({
-  "module_250"() {
+  "module_251"() {
     init_regex();
     validate_default = validate2;
   }
@@ -68919,7 +69124,7 @@ function stringify(arr, offset = 0) {
 }
 var byteToHex, stringify_default;
 var init_stringify = __esm({
-  "module_251"() {
+  "module_252"() {
     init_validate();
     byteToHex = [];
     for (let i2 = 0; i2 < 256; ++i2) {
@@ -68979,7 +69184,7 @@ function v1(options, buf, offset) {
 }
 var _nodeId, _clockseq, _lastMSecs, _lastNSecs, v1_default;
 var init_v1 = __esm({
-  "module_252"() {
+  "module_253"() {
     init_rng();
     init_stringify();
     _lastMSecs = 0;
@@ -69014,7 +69219,7 @@ function parse(uuid) {
 }
 var parse_default;
 var init_parse = __esm({
-  "module_253"() {
+  "module_254"() {
     init_validate();
     parse_default = parse;
   }
@@ -69065,7 +69270,7 @@ function v35(name, version2, hashfunc) {
 }
 var DNS, URL2;
 var init_v35 = __esm({
-  "module_254"() {
+  "module_255"() {
     init_stringify();
     init_parse();
     DNS = "6ba7b810-9dad-11d1-80b4-00c04fd430c8";
@@ -69083,7 +69288,7 @@ function md5(bytes) {
 }
 var import_crypto4, md5_default;
 var init_md5 = __esm({
-  "module_255"() {
+  "module_256"() {
     import_crypto4 = __toESM(require("crypto"));
     md5_default = md5;
   }
@@ -69091,7 +69296,7 @@ var init_md5 = __esm({
 var v3, v3_default;
 var init_v3 = __esm({
-  "module_256"() {
+  "module_257"() {
     init_v35();
     init_md5();
     v3 = v35("v3", 48, md5_default);
@@ -69101,7 +69306,7 @@ var init_v3 = __esm({
 var import_crypto5, native_default;
 var init_native = __esm({
-  "module_257"() {
+  "module_258"() {
     import_crypto5 = __toESM(require("crypto"));
     native_default = {
       randomUUID: import_crypto5.default.randomUUID
@@ -69128,7 +69333,7 @@ function v4(options, buf, offset) {
 }
 var v4_default;
 var init_v4 = __esm({
-  "module_258"() {
+  "module_259"() {
     init_native();
     init_rng();
     init_stringify();
@@ -69146,7 +69351,7 @@ function sha1(bytes) {
 }
 var import_crypto6, sha1_default;
 var init_sha1 = __esm({
-  "module_259"() {
+  "module_260"() {
     import_crypto6 = __toESM(require("crypto"));
     sha1_default = sha1;
   }
@@ -69154,7 +69359,7 @@ var init_sha1 = __esm({
 var v5, v5_default;
 var init_v5 = __esm({
-  "module_260"() {
+  "module_261"() {
     init_v35();
     init_sha1();
     v5 = v35("v5", 80, sha1_default);
@@ -69164,7 +69369,7 @@ var init_v5 = __esm({
 var nil_default;
 var init_nil = __esm({
-  "module_261"() {
+  "module_262"() {
     nil_default = "00000000-0000-0000-0000-000000000000";
   }
 });
@@ -69177,7 +69382,7 @@ function version(uuid) {
 }
 var version_default;
 var init_version = __esm({
-  "module_262"() {
+  "module_263"() {
     init_validate();
     version_default = version;
   }
@@ -69196,7 +69401,7 @@ __export(esm_node_exports, {
   version: () => version_default
 });
 var init_esm_node = __esm({
-  "module_263"() {
+  "module_264"() {
     init_v1();
     init_v3();
     init_v4();
@@ -151684,7 +151889,7 @@ var require_app = __commonJS({
 var import_app, AppErrorCodes, FirebaseAppError, SDK_VERSION, applicationDefault, cert, deleteApp, getApp, getApps, initializeApp, refreshToken;
 var init_app = __esm({
-  "module_264"() {
+  "module_265"() {
     import_app = __toESM(require_app(), 1);
     AppErrorCodes = import_app.default.AppErrorCodes;
     FirebaseAppError = import_app.default.FirebaseAppError;
@@ -168328,7 +168533,7 @@ var require_disabled_trace_util = __commonJS({
 var VERSION;
 var init_version2 = __esm({
-  "module_265"() {
+  "module_266"() {
     VERSION = "1.9.1";
   }
 });
@@ -168396,7 +168601,7 @@ function _makeCompatibilityCheck(ownVersion) {
 }
 var re, isCompatible;
 var init_semver = __esm({
-  "module_266"() {
+  "module_267"() {
     init_version2();
     re = /^(\d+)\.(\d+)\.(\d+)(-(.+))?$/;
     isCompatible = _makeCompatibilityCheck(VERSION);
@@ -168439,7 +168644,7 @@ function unregisterGlobal(type, diag3) {
 }
 var major, GLOBAL_OPENTELEMETRY_API_KEY, _global;
 var init_global_utils = __esm({
-  "module_267"() {
+  "module_268"() {
     init_version2();
     init_semver();
     major = VERSION.split(".")[0];
@@ -168457,7 +168662,7 @@ function logProxy(funcName, namespace, args2) {
 }
 var DiagComponentLogger;
 var init_ComponentLogger = __esm({
-  "module_268"() {
+  "module_269"() {
     init_global_utils();
     DiagComponentLogger = class {
       constructor(props) {
@@ -168484,7 +168689,7 @@ var init_ComponentLogger = __esm({
 var DiagLogLevel;
 var init_types = __esm({
-  "module_269"() {
+  "module_270"() {
     (function(DiagLogLevel2) {
       DiagLogLevel2[DiagLogLevel2["NONE"] = 0] = "NONE";
       DiagLogLevel2[DiagLogLevel2["ERROR"] = 30] = "ERROR";
@@ -168521,14 +168726,14 @@ function createLogLevelDiagLogger(maxLevel, logger3) {
   };
 }
 var init_logLevelLogger = __esm({
-  "module_270"() {
+  "module_271"() {
     init_types();
   }
 });
 var API_NAME, DiagAPI;
 var init_diag = __esm({
-  "module_271"() {
+  "module_272"() {
     init_ComponentLogger();
     init_logLevelLogger();
     init_types();
@@ -168596,7 +168801,7 @@ var init_diag = __esm({
 var BaggageImpl;
 var init_baggage_impl = __esm({
-  "module_272"() {
+  "module_273"() {
     BaggageImpl = class _BaggageImpl {
       constructor(entries) {
         this._entries = entries ? new Map(entries) : /* @__PURE__ */ new Map();
@@ -168637,7 +168842,7 @@ var init_baggage_impl = __esm({
 var baggageEntryMetadataSymbol;
 var init_symbol = __esm({
-  "module_273"() {
+  "module_274"() {
     baggageEntryMetadataSymbol = /* @__PURE__ */ Symbol("BaggageEntryMetadata");
   }
 });
@@ -168659,7 +168864,7 @@ function baggageEntryMetadataFromString(str) {
 }
 var diag;
 var init_utils = __esm({
-  "module_274"() {
+  "module_275"() {
     init_diag();
     init_baggage_impl();
     init_symbol();
@@ -168672,7 +168877,7 @@ function createContextKey(description) {
 }
 var BaseContext, ROOT_CONTEXT;
 var init_context = __esm({
-  "module_275"() {
+  "module_276"() {
     BaseContext = class _BaseContext {
       /**
        * Construct a new context which inherits values from an optional parent context.
@@ -168701,7 +168906,7 @@ var init_context = __esm({
 var consoleMap, _originalConsoleMethods, DiagConsoleLogger;
 var init_consoleLogger = __esm({
-  "module_276"() {
+  "module_277"() {
     consoleMap = [
       { n: "error", c: "error" },
       { n: "warn", c: "warn" },
@@ -168757,7 +168962,7 @@ function createNoopMeter() {
 }
 var NoopMeter, NoopMetric, NoopCounterMetric, NoopUpDownCounterMetric, NoopGaugeMetric, NoopHistogramMetric, NoopObservableMetric, NoopObservableCounterMetric, NoopObservableGaugeMetric, NoopObservableUpDownCounterMetric, NOOP_METER, NOOP_COUNTER_METRIC, NOOP_GAUGE_METRIC, NOOP_HISTOGRAM_METRIC, NOOP_UP_DOWN_COUNTER_METRIC, NOOP_OBSERVABLE_COUNTER_METRIC, NOOP_OBSERVABLE_GAUGE_METRIC, NOOP_OBSERVABLE_UP_DOWN_COUNTER_METRIC;
 var init_NoopMeter = __esm({
-  "module_277"() {
+  "module_278"() {
     NoopMeter = class {
       constructor() {
       }
@@ -168857,7 +169062,7 @@ var init_NoopMeter = __esm({
 var ValueType;
 var init_Metric = __esm({
-  "module_278"() {
+  "module_279"() {
     (function(ValueType2) {
       ValueType2[ValueType2["INT"] = 0] = "INT";
       ValueType2[ValueType2["DOUBLE"] = 1] = "DOUBLE";
@@ -168867,7 +169072,7 @@ var init_Metric = __esm({
 var defaultTextMapGetter, defaultTextMapSetter;
 var init_TextMapPropagator = __esm({
-  "module_279"() {
+  "module_280"() {
     defaultTextMapGetter = {
       get(carrier, key) {
         if (carrier == null) {
@@ -168895,7 +169100,7 @@ var init_TextMapPropagator = __esm({
 var NoopContextManager;
 var init_NoopContextManager = __esm({
-  "module_280"() {
+  "module_281"() {
     init_context();
     NoopContextManager = class {
       active() {
@@ -168919,7 +169124,7 @@ var init_NoopContextManager = __esm({
 var API_NAME2, NOOP_CONTEXT_MANAGER, ContextAPI;
 var init_context2 = __esm({
-  "module_281"() {
+  "module_282"() {
     init_NoopContextManager();
     init_global_utils();
     init_diag();
@@ -168984,7 +169189,7 @@ var init_context2 = __esm({
 var TraceFlags;
 var init_trace_flags = __esm({
-  "module_282"() {
+  "module_283"() {
     (function(TraceFlags2) {
       TraceFlags2[TraceFlags2["NONE"] = 0] = "NONE";
       TraceFlags2[TraceFlags2["SAMPLED"] = 1] = "SAMPLED";
@@ -168994,7 +169199,7 @@ var init_trace_flags = __esm({
 var INVALID_SPANID, INVALID_TRACEID, INVALID_SPAN_CONTEXT;
 var init_invalid_span_constants = __esm({
-  "module_283"() {
+  "module_284"() {
     init_trace_flags();
     INVALID_SPANID = "0000000000000000";
     INVALID_TRACEID = "00000000000000000000000000000000";
@@ -169008,7 +169213,7 @@ var init_invalid_span_constants = __esm({
 var NonRecordingSpan;
 var init_NonRecordingSpan = __esm({
-  "module_284"() {
+  "module_285"() {
     init_invalid_span_constants();
     NonRecordingSpan = class {
       constructor(spanContext = INVALID_SPAN_CONTEXT) {
@@ -169079,7 +169284,7 @@ function getSpanContext(context2) {
 }
 var SPAN_KEY;
 var init_context_utils = __esm({
-  "module_285"() {
+  "module_286"() {
     init_context();
     init_NonRecordingSpan();
     init_context2();
@@ -169110,7 +169315,7 @@ function wrapSpanContext(spanContext) {
 }
 var isHex;
 var init_spancontext_utils = __esm({
-  "module_286"() {
+  "module_287"() {
     init_invalid_span_constants();
     init_NonRecordingSpan();
     isHex = new Uint8Array([
@@ -169226,7 +169431,7 @@ function isSpanContext(spanContext) {
 }
 var contextApi, NoopTracer;
 var init_NoopTracer = __esm({
-  "module_287"() {
+  "module_288"() {
     init_context2();
     init_context_utils();
     init_NonRecordingSpan();
@@ -169273,7 +169478,7 @@ var init_NoopTracer = __esm({
 var NOOP_TRACER, ProxyTracer;
 var init_ProxyTracer = __esm({
-  "module_288"() {
+  "module_289"() {
     init_NoopTracer();
     NOOP_TRACER = new NoopTracer();
     ProxyTracer = class {
@@ -169311,7 +169516,7 @@ var init_ProxyTracer = __esm({
 var NoopTracerProvider;
 var init_NoopTracerProvider = __esm({
-  "module_289"() {
+  "module_290"() {
     init_NoopTracer();
     NoopTracerProvider = class {
       getTracer(_name, _version, _options) {
@@ -169323,7 +169528,7 @@ var init_NoopTracerProvider = __esm({
 var NOOP_TRACER_PROVIDER, ProxyTracerProvider;
 var init_ProxyTracerProvider = __esm({
-  "module_290"() {
+  "module_291"() {
     init_ProxyTracer();
     init_NoopTracerProvider();
     NOOP_TRACER_PROVIDER = new NoopTracerProvider();
@@ -169355,7 +169560,7 @@ var init_ProxyTracerProvider = __esm({
 var SamplingDecision;
 var init_SamplingResult = __esm({
-  "module_291"() {
+  "module_292"() {
     (function(SamplingDecision2) {
       SamplingDecision2[SamplingDecision2["NOT_RECORD"] = 0] = "NOT_RECORD";
       SamplingDecision2[SamplingDecision2["RECORD"] = 1] = "RECORD";
@@ -169366,7 +169571,7 @@ var init_SamplingResult = __esm({
 var SpanKind;
 var init_span_kind = __esm({
-  "module_292"() {
+  "module_293"() {
     (function(SpanKind2) {
       SpanKind2[SpanKind2["INTERNAL"] = 0] = "INTERNAL";
       SpanKind2[SpanKind2["SERVER"] = 1] = "SERVER";
@@ -169379,7 +169584,7 @@ var init_span_kind = __esm({
 var SpanStatusCode;
 var init_status = __esm({
-  "module_293"() {
+  "module_294"() {
     (function(SpanStatusCode2) {
       SpanStatusCode2[SpanStatusCode2["UNSET"] = 0] = "UNSET";
       SpanStatusCode2[SpanStatusCode2["OK"] = 1] = "OK";
@@ -169396,7 +169601,7 @@ function validateValue(value) {
 }
 var VALID_KEY_CHAR_RANGE, VALID_KEY, VALID_VENDOR_KEY, VALID_KEY_REGEX, VALID_VALUE_BASE_REGEX, INVALID_VALUE_COMMA_EQUAL_REGEX;
 var init_tracestate_validators = __esm({
-  "module_294"() {
+  "module_295"() {
     VALID_KEY_CHAR_RANGE = "[_0-9a-z-*/]";
     VALID_KEY = `[a-z]${VALID_KEY_CHAR_RANGE}{0,255}`;
     VALID_VENDOR_KEY = `[a-z0-9]${VALID_KEY_CHAR_RANGE}{0,240}@[a-z]${VALID_KEY_CHAR_RANGE}{0,13}`;
@@ -169408,7 +169613,7 @@ var init_tracestate_validators = __esm({
 var MAX_TRACE_STATE_ITEMS, MAX_TRACE_STATE_LEN, LIST_MEMBERS_SEPARATOR, LIST_MEMBER_KEY_VALUE_SPLITTER, TraceStateImpl;
 var init_tracestate_impl = __esm({
-  "module_295"() {
+  "module_296"() {
     init_tracestate_validators();
     MAX_TRACE_STATE_ITEMS = 32;
     MAX_TRACE_STATE_LEN = 512;
@@ -169479,14 +169684,14 @@ function createTraceState(rawTraceState) {
   return new TraceStateImpl(rawTraceState);
 }
 var init_utils2 = __esm({
-  "module_296"() {
+  "module_297"() {
     init_tracestate_impl();
   }
 });
 var context;
 var init_context_api = __esm({
-  "module_297"() {
+  "module_298"() {
     init_context2();
     context = ContextAPI.getInstance();
   }
@@ -169494,7 +169699,7 @@ var init_context_api = __esm({
 var diag2;
 var init_diag_api = __esm({
-  "module_298"() {
+  "module_299"() {
     init_diag();
     diag2 = DiagAPI.instance();
   }
@@ -169502,7 +169707,7 @@ var init_diag_api = __esm({
 var NoopMeterProvider, NOOP_METER_PROVIDER;
 var init_NoopMeterProvider = __esm({
-  "module_299"() {
+  "module_300"() {
     init_NoopMeter();
     NoopMeterProvider = class {
       getMeter(_name, _version, _options) {
@@ -169515,7 +169720,7 @@ var init_NoopMeterProvider = __esm({
 var API_NAME3, MetricsAPI;
 var init_metrics = __esm({
-  "module_300"() {
+  "module_301"() {
     init_NoopMeterProvider();
     init_global_utils();
     init_diag();
@@ -169560,7 +169765,7 @@ var init_metrics = __esm({
 var metrics;
 var init_metrics_api = __esm({
-  "module_301"() {
+  "module_302"() {
     init_metrics();
     metrics = MetricsAPI.getInstance();
   }
@@ -169568,7 +169773,7 @@ var init_metrics_api = __esm({
 var NoopTextMapPropagator;
 var init_NoopTextMapPropagator = __esm({
-  "module_302"() {
+  "module_303"() {
     NoopTextMapPropagator = class {
       /** Noop inject function does nothing */
       inject(_context, _carrier) {
@@ -169598,7 +169803,7 @@ function deleteBaggage(context2) {
 }
 var BAGGAGE_KEY;
 var init_context_helpers = __esm({
-  "module_303"() {
+  "module_304"() {
     init_context2();
     init_context();
     BAGGAGE_KEY = createContextKey("OpenTelemetry Baggage Key");
@@ -169607,7 +169812,7 @@ var init_context_helpers = __esm({
 var API_NAME4, NOOP_TEXT_MAP_PROPAGATOR, PropagationAPI;
 var init_propagation = __esm({
-  "module_304"() {
+  "module_305"() {
     init_global_utils();
     init_NoopTextMapPropagator();
     init_TextMapPropagator();
@@ -169679,7 +169884,7 @@ var init_propagation = __esm({
 var propagation;
 var init_propagation_api = __esm({
-  "module_305"() {
+  "module_306"() {
     init_propagation();
     propagation = PropagationAPI.getInstance();
   }
@@ -169687,7 +169892,7 @@ var init_propagation_api = __esm({
 var API_NAME5, TraceAPI;
 var init_trace = __esm({
-  "module_306"() {
+  "module_307"() {
     init_global_utils();
     init_ProxyTracerProvider();
     init_spancontext_utils();
@@ -169749,7 +169954,7 @@ var init_trace = __esm({
 var trace;
 var init_trace_api = __esm({
-  "module_307"() {
+  "module_308"() {
     init_trace();
     trace = TraceAPI.getInstance();
   }
@@ -169788,7 +169993,7 @@ __export(esm_exports, {
 });
 var esm_default;
 var init_esm2 = __esm({
-  "module_308"() {
+  "module_309"() {
     init_utils();
     init_context();
     init_consoleLogger();
@@ -175512,7 +175717,7 @@ var require_firestore = __commonJS({
 var import_firestore, AggregateField, AggregateQuery, AggregateQuerySnapshot, BulkWriter, BundleBuilder, CollectionGroup, CollectionReference, DocumentReference, DocumentSnapshot, FieldPath, FieldValue, Filter, FirebaseFirestoreError, Firestore, GeoPoint, GrpcStatus, Query, QueryDocumentSnapshot, QueryPartition, QuerySnapshot, Timestamp, Transaction, WriteBatch, WriteResult, getFirestore, initializeFirestore, setLogFunction, v12;
 var init_firestore = __esm({
-  "module_309"() {
+  "module_310"() {
     import_firestore = __toESM(require_firestore(), 1);
     AggregateField = import_firestore.default.AggregateField;
     AggregateQuery = import_firestore.default.AggregateQuery;
@@ -175750,7 +175955,7 @@ function getBrowserProfilePath(profileName) {
 }
 var import_secret_manager, import_fs19, import_os16, import_path17, secretClient, firestoreDb, FIRESTORE_COLLECTION, FIRESTORE_DOC, GROWTH_CONSOLE_URL;
 var init_credential_resolver = __esm({
-  "module_310"() {
+  "module_311"() {
     "use strict";
     import_secret_manager = __toESM(require_src13(), 1);
     init_app();
@@ -176510,7 +176715,7 @@ async function startGalBrowserServer(config = {}) {
 }
 var import_child_process6, import_server, import_stdio, import_types11, import_fs20, import_path18, MERGED_STORAGE_STATE_FILENAME, GAL_BROWSER_TOOLS;
 var init_browser_server = __esm({
-  "module_311"() {
+  "module_312"() {
     "use strict";
     import_child_process6 = require("child_process");
     import_server = require("@modelcontextprotocol/sdk/server/index.js");
@@ -177037,7 +177242,7 @@ __export(dist_exports2, {
   validateCredential: () => validateCredential
 });
 var init_dist4 = __esm({
-  "module_312"() {
+  "module_313"() {
     "use strict";
     init_browser_server();
     init_profile_sync();
@@ -177430,7 +177635,7 @@ function createBrowserCommand() {
 }
 var import_fs21, import_child_process7, import_path19, GAL_BINARY, BROWSER_SERVER_SUBCMD, PID_FILE_NAME;
 var init_browser = __esm({
-  "module_313"() {
+  "module_314"() {
     "use strict";
     init_esm();
     init_source();
@@ -177807,7 +178012,7 @@ async function startChromeExtensionGalServer(config = {}) {
 }
 var import_fs22, import_path20, import_os17, import_server2, import_stdio2, import_types12, CHROME_EXTENSION_GAL_TOOLS;
 var init_chrome_extension_gal_server = __esm({
-  "module_314"() {
+  "module_315"() {
     "use strict";
     import_fs22 = require("fs");
     import_path20 = require("path");
@@ -177942,7 +178147,7 @@ function createChromeExtensionCommand() {
 }
 var import_path21;
 var init_chrome_extension = __esm({
-  "module_315"() {
+  "module_316"() {
     "use strict";
     init_esm();
     import_path21 = require("path");
@@ -178260,7 +178465,7 @@ function createApprovedConfigCommand() {
   return command;
 }
 var init_approved_config = __esm({
-  "module_316"() {
+  "module_317"() {
     "use strict";
     init_esm();
     init_source();
@@ -178313,7 +178518,7 @@ Your role in ${orgName}: ${source_default.white(org.githubRole)}`));
   }
 }
 var init_capability_checker = __esm({
-  "module_317"() {
+  "module_318"() {
     "use strict";
     init_source();
   }
@@ -178321,7 +178526,7 @@ var init_capability_checker = __esm({
 var import_fs23, import_path22, import_crypto7, import_os18, import_yaml2, PLATFORM_DIRS, PLATFORM_INSTRUCTION_FILES, GalConfigService;
 var init_gal_config_service = __esm({
-  "module_318"() {
+  "module_319"() {
     "use strict";
     import_fs23 = require("fs");
     import_path22 = require("path");
@@ -179757,7 +179962,7 @@ Content hash: ${hash}`));
 }
 var import_crypto8, import_fs24, import_path23;
 var init_approve = __esm({
-  "module_319"() {
+  "module_320"() {
     "use strict";
     init_esm();
     init_source();
@@ -180135,7 +180340,7 @@ Generated by GAL Token Security Audit
 }
 var import_child_process8, import_fs25, import_path24, import_readline2, defaultApiUrl3, TokenAuditor;
 var init_audit = __esm({
-  "module_320"() {
+  "module_321"() {
     "use strict";
     init_esm();
     init_source();
@@ -180501,7 +180706,7 @@ function findProjectRoot(startPath = process.cwd()) {
 }
 var import_fs26, import_path25, cachedProjectRoot, cachedStartPath, DEBUG;
 var init_project_detection = __esm({
-  "module_321"() {
+  "module_322"() {
     "use strict";
     import_fs26 = require("fs");
     import_path25 = require("path");
@@ -180513,7 +180718,7 @@ var init_project_detection = __esm({
 var SYNC_STATE_SCHEMA_VERSION;
 var init_types2 = __esm({
-  "module_322"() {
+  "module_323"() {
     "use strict";
     SYNC_STATE_SCHEMA_VERSION = 2;
   }
@@ -180715,7 +180920,7 @@ function writeCopilotConfig(directory, configData, syncedFiles, syncedItems) {
 }
 var import_fs27, import_path26;
 var init_copilot_writer = __esm({
-  "module_323"() {
+  "module_324"() {
     "use strict";
     import_fs27 = require("fs");
     import_path26 = require("path");
@@ -180736,7 +180941,7 @@ function getValidDispatchCategories(categories) {
   return categories.filter(isDispatchCategory);
 }
 var init_dispatch_categories = __esm({
-  "module_324"() {
+  "module_325"() {
     "use strict";
   }
 });
@@ -180807,7 +181012,7 @@ function generateDispatchSection(config) {
   return lines.join("\n");
 }
 var init_agents_md_generator = __esm({
-  "module_325"() {
+  "module_326"() {
     "use strict";
     init_dispatch_categories();
   }
@@ -180840,7 +181045,7 @@ function getPatternsByCategory(category) {
 }
 var DANGEROUS_PATTERNS;
 var init_dangerous_patterns = __esm({
-  "module_326"() {
+  "module_327"() {
     "use strict";
     DANGEROUS_PATTERNS = [
       // Critical - Destructive file system operations
@@ -181060,7 +181265,7 @@ function seccompProfileToJson(profile) {
 }
 var DANGEROUS_SYSCALLS, ALLOWED_SYSCALLS;
 var init_seccomp_generator = __esm({
-  "module_327"() {
+  "module_328"() {
     "use strict";
     DANGEROUS_SYSCALLS = [
       "ptrace",
@@ -181280,13 +181485,13 @@ function macOSSandboxToSchemeLisp(profile) {
   return lines.join("\n");
 }
 var init_macos_sandbox_generator = __esm({
-  "module_328"() {
+  "module_329"() {
     "use strict";
   }
 });
 var init_types3 = __esm({
-  "module_329"() {
+  "module_330"() {
     "use strict";
   }
 });
@@ -181407,7 +181612,7 @@ function getDockerRunFlags(config) {
 }
 var import_node_os2;
 var init_kernel = __esm({
-  "module_330"() {
+  "module_331"() {
     "use strict";
     import_node_os2 = require("node:os");
     init_seccomp_generator();
@@ -182061,7 +182266,7 @@ if __name__ == "__main__":
 `;
 }
 var init_hook_generator = __esm({
-  "module_331"() {
+  "module_332"() {
     "use strict";
     init_dangerous_patterns();
     init_kernel();
@@ -182180,7 +182385,7 @@ async function autoInstallSdlcHooksIfNeeded(basePath, apiUrl, orgName, policyNam
 }
 var import_node_fs, import_promises, import_node_path, BUILTIN_SDLC_POLICY_NAME, GAL_SDLC_PREPUSH_MARKER;
 var init_sdlc_enforcement_install = __esm({
-  "module_332"() {
+  "module_333"() {
     "use strict";
     init_source();
     init_ora();
@@ -182233,7 +182438,7 @@ function quoteIfNeeded(path11) {
 }
 var import_promises2, import_node_path2;
 var init_compiler = __esm({
-  "module_333"() {
+  "module_334"() {
     "use strict";
     import_promises2 = require("node:fs/promises");
     import_node_path2 = require("node:path");
@@ -182248,7 +182453,7 @@ function stripRegexSlashes(pattern) {
 }
 var import_yaml3;
 var init_parser = __esm({
-  "module_334"() {
+  "module_335"() {
     "use strict";
     import_yaml3 = __toESM(require_dist(), 1);
   }
@@ -182265,20 +182470,20 @@ function findMatchingCommandRule(rules, command) {
   return rules.find((rule) => matchesCommand(rule, command));
 }
 var init_match = __esm({
-  "module_335"() {
+  "module_336"() {
     "use strict";
     init_parser();
   }
 });
 var init_merge = __esm({
-  "module_336"() {
+  "module_337"() {
     "use strict";
   }
 });
 var init_dist5 = __esm({
-  "module_337"() {
+  "module_338"() {
     "use strict";
     init_parser();
     init_match();
@@ -182314,7 +182519,7 @@ function isRecord(value) {
 }
 var MAPPING;
 var init_tool_mapping = __esm({
-  "module_338"() {
+  "module_339"() {
     "use strict";
     MAPPING = {
       Bash: "command",
@@ -182431,7 +182636,7 @@ function globToRegex(pattern) {
   return new RegExp("^" + out + "$");
 }
 var init_handler = __esm({
-  "module_339"() {
+  "module_340"() {
     "use strict";
     init_dist5();
     init_tool_mapping();
@@ -182439,7 +182644,7 @@ var init_handler = __esm({
 });
 var init_src2 = __esm({
-  "module_340"() {
+  "module_341"() {
     "use strict";
     init_compiler();
     init_handler();
@@ -182511,7 +182716,7 @@ function errMsg(err) {
 }
 var import_promises3, import_meta2, cached, invokedDirectly;
 var init_handler_bin = __esm({
-  "module_341"() {
+  "module_342"() {
     "use strict";
     import_promises3 = require("node:fs/promises");
     init_handler();
@@ -182582,7 +182787,7 @@ function stableUnique(values) {
 }
 var import_promises4, import_node_path3;
 var init_compiler2 = __esm({
-  "module_342"() {
+  "module_343"() {
     "use strict";
     import_promises4 = require("node:fs/promises");
     import_node_path3 = require("node:path");
@@ -182590,7 +182795,7 @@ var init_compiler2 = __esm({
 });
 var init_src3 = __esm({
-  "module_343"() {
+  "module_344"() {
     "use strict";
     init_compiler2();
   }
@@ -182601,27 +182806,27 @@ function emptyRuleSet2() {
 }
 var import_yaml4;
 var init_parser2 = __esm({
-  "module_344"() {
+  "module_345"() {
     "use strict";
     import_yaml4 = __toESM(require_dist(), 1);
   }
 });
 var init_match2 = __esm({
-  "module_345"() {
+  "module_346"() {
     "use strict";
     init_parser2();
   }
 });
 var init_merge2 = __esm({
-  "module_346"() {
+  "module_347"() {
     "use strict";
   }
 });
 var init_src4 = __esm({
-  "module_347"() {
+  "module_348"() {
     "use strict";
     init_parser2();
     init_match2();
@@ -182834,7 +183039,7 @@ function shellQuote(value) {
 }
 var import_promises5, import_node_fs2, import_node_child_process, import_node_os3, import_node_path4, SRT_PACKAGE_NAME, SRT_PACKAGE_VERSION, PRE_TOOL_USE_HANDLER_FILENAME;
 var init_unified_runtime = __esm({
-  "module_348"() {
+  "module_349"() {
     "use strict";
     import_promises5 = require("node:fs/promises");
     import_node_fs2 = require("node:fs");
@@ -182986,7 +183191,7 @@ function removeInitializedDirectory(directory) {
 }
 var import_fs28, import_os19, import_path27, REGISTRY_SCHEMA_VERSION, DEFAULT_REGISTRY_PATH;
 var init_sync_initialization = __esm({
-  "module_349"() {
+  "module_350"() {
     "use strict";
     import_fs28 = require("fs");
     import_os19 = require("os");
@@ -183049,7 +183254,7 @@ function checkGitConflict(filePath, repoRoot) {
 }
 var import_child_process9, import_fs29, import_path28, cachedGitInstalled;
 var init_git_utils = __esm({
-  "module_350"() {
+  "module_351"() {
     "use strict";
     import_child_process9 = require("child_process");
     import_fs29 = require("fs");
@@ -183170,7 +183375,7 @@ async function runSessionDriftCheck(projectRoot) {
 }
 var import_fs30, import_path29, import_os20, import_crypto9;
 var init_drift_check = __esm({
-  "module_351"() {
+  "module_352"() {
     "use strict";
     import_fs30 = require("fs");
     import_path29 = require("path");
@@ -185858,7 +186063,7 @@ async function checkApprovedConfig(configRepo, orgName, directory, platformFilte
 }
 var import_fs31, import_path30, import_os21, import_crypto10, cliVersion4, defaultApiUrl4, GAL_CLI_CURSOR_RULES_VERSION, GAL_CLI_CURSOR_RULES, CODEX_PROMPT_PREFIX, GEMINI_COMMANDS_DIR, GEMINI_SKILLS_DIR;
 var init_sync = __esm({
-  "module_352"() {
+  "module_353"() {
     "use strict";
     init_esm();
     init_source();
@@ -187093,7 +187298,7 @@ Source: ${credentialSource}`));
 }
 var import_http, import_child_process10, import_os22, import_fs32, import_path31, import_readline3, CLI_CALLBACK_PORT, CLI_CALLBACK_PATH, cliVersion5, defaultApiUrl5;
 var init_auth2 = __esm({
-  "module_353"() {
+  "module_354"() {
     "use strict";
     init_esm();
     init_source();
@@ -187151,7 +187356,7 @@ Error: Path is not a directory: ${options.path}
 }
 var import_fs33, import_path32, import_child_process11, SECRET_PATTERNS, DANGEROUS_PATTERNS2, FORBIDDEN_FILES, PreEnforcementChecker;
 var init_check = __esm({
-  "module_354"() {
+  "module_355"() {
     "use strict";
     init_esm();
     init_source();
@@ -187701,7 +187906,7 @@ function runGalCode(binaryPath, args2, childEnv, spawnImpl = import_child_proces
 }
 var import_child_process12;
 var init_code_process = __esm({
-  "module_355"() {
+  "module_356"() {
     "use strict";
     import_child_process12 = require("child_process");
   }
@@ -187721,7 +187926,7 @@ function buildToolsetEnv(toolset, baseEnv) {
 }
 var TOOLSET_PRESETS;
 var init_toolset = __esm({
-  "module_356"() {
+  "module_357"() {
     "use strict";
     TOOLSET_PRESETS = {
       research: {
@@ -187768,7 +187973,7 @@ function buildProfileEnv(profile, baseEnv) {
 }
 var import_node_os4, import_node_path5;
 var init_code_profile = __esm({
-  "module_357"() {
+  "module_358"() {
     "use strict";
     import_node_os4 = require("node:os");
     import_node_path5 = require("node:path");
@@ -187860,7 +188065,7 @@ function isComputerUseBinaryAvailable(projectPath2, env2 = process.env, cwd = pr
 }
 var import_node_fs3, import_node_path6, GAL_COMPUTER_USE_BINARY_ENV_KEY, COMPUTER_USE_BINARY_NAME;
 var init_computer_use_binary = __esm({
-  "module_358"() {
+  "module_359"() {
     "use strict";
     import_node_fs3 = require("node:fs");
     import_node_path6 = require("node:path");
@@ -187870,7 +188075,7 @@ var init_computer_use_binary = __esm({
 });
 function resolveCliVersion() {
-  return true ? "0.0.668" : "0.0.0-dev";
+  return true ? "0.0.674" : "0.0.0-dev";
 }
 function resolveGalCodeRunnerAsset(version2) {
   const platformMap = {
@@ -187979,7 +188184,7 @@ async function ensureManagedGalCodeRunner(childEnv) {
 }
 var import_node_os5, import_node_path7, import_node_fs4, import_node_child_process2, import_node_https, import_promises6, GAL_CODE_RUNNER_ENV_KEY, GAL_CODE_ALLOW_EXTERNAL_RUNNER_ENV_KEY, GAL_CODE_DISABLE_AUTO_INSTALL_ENV_KEY, GAL_CODE_RELEASE_BASE_URL_ENV_KEY, GAL_CODE_RUNNER_URL_ENV_KEY, GAL_CODE_MANAGED_RUNNER_DIR;
 var init_gal_code_runner_install = __esm({
-  "module_359"() {
+  "module_360"() {
     "use strict";
     import_node_os5 = __toESM(require("node:os"), 1);
     import_node_path7 = __toESM(require("node:path"), 1);
@@ -187998,7 +188203,7 @@ var init_gal_code_runner_install = __esm({
 });
 function resolveCliVersion2() {
-  return true ? "0.0.668" : "0.0.0-dev";
+  return true ? "0.0.674" : "0.0.0-dev";
 }
 function resolveComputerUseHelperAsset(version2 = resolveCliVersion2(), platform5 = process.platform, arch3 = process.arch) {
   if (platform5 !== "darwin") {
@@ -188096,7 +188301,7 @@ async function ensureManagedComputerUseBinary(childEnv) {
 }
 var import_node_os6, import_node_path8, import_node_fs5, import_node_child_process3, import_node_https2, import_promises7, COMPUTER_USE_RELEASE_BASE_URL_ENV_KEY, COMPUTER_USE_BINARY_URL_ENV_KEY, COMPUTER_USE_DISABLE_AUTO_INSTALL_ENV_KEY;
 var init_computer_use_runner_install = __esm({
-  "module_360"() {
+  "module_361"() {
     "use strict";
     import_node_os6 = __toESM(require("node:os"), 1);
     import_node_path8 = __toESM(require("node:path"), 1);
@@ -188201,7 +188406,7 @@ async function uploadGalCodeSessionArchive(context2, fetchImpl = fetch) {
 }
 var import_fs34, import_path33, SESSION_DIR, SETTINGS_TIMEOUT_MS, UPLOAD_TIMEOUT_MS;
 var init_gal_code_session_collection = __esm({
-  "module_361"() {
+  "module_362"() {
     "use strict";
     import_fs34 = require("fs");
     import_path33 = require("path");
@@ -188594,7 +188799,7 @@ async function uploadSessionArchive(config, cwd, commandArgs, startedAt, exitCod
       return;
     }
     const endedAt = /* @__PURE__ */ new Date();
-    const wrapperVersion = true ? "0.0.668" : "0.0.0-dev";
+    const wrapperVersion = true ? "0.0.674" : "0.0.0-dev";
     const model = childEnv.GAL_CODE_MODEL ?? "glm-vertex/glm-5";
     await uploadGalCodeSessionArchive(
       {
@@ -188677,7 +188882,7 @@ function createCodeCommand(runVariant = runCodeVariant) {
 }
 var import_node_os7, import_node_path9, import_node_fs6, import_node_url, GAL_CODE_DESCRIPTION, GAL_CODE_CONFIG_PATH, GAL_CODE_RUNTIME_PLUGIN_DIR, GAL_CODE_BRANDING_PLUGIN_FILENAME, GAL_CODE_DEV_RUNNER_PATH, OFFICIAL_VARIANT_BINARIES, GLM_5_CONTEXT_LIMIT, GLM_5_OUTPUT_LIMIT, GLM_5_COMPACTION_RESERVE, GLM_4_7_CONTEXT_LIMIT, GLM_4_7_OUTPUT_LIMIT, GAL_VISION_ENV_KEYS, GAL_CODE_BRANDING_PLUGIN_CONTENT;
 var init_code = __esm({
-  "module_362"() {
+  "module_363"() {
     "use strict";
     import_node_os7 = __toESM(require("node:os"), 1);
     import_node_path9 = __toESM(require("node:path"), 1);
@@ -188735,7 +188940,7 @@ export default plugin
 });
 var init_types4 = __esm({
-  "module_363"() {
+  "module_364"() {
     "use strict";
   }
 });
@@ -188745,7 +188950,7 @@ function getRequirementsByFramework(framework) {
 }
 var COMPLIANCE_REQUIREMENTS;
 var init_requirements = __esm({
-  "module_364"() {
+  "module_365"() {
     "use strict";
     COMPLIANCE_REQUIREMENTS = [
       // SOC 2 - Security
@@ -188974,7 +189179,7 @@ var init_requirements = __esm({
 var ComplianceScoringEngine;
 var init_scoring_engine = __esm({
-  "module_365"() {
+  "module_366"() {
     "use strict";
     init_requirements();
     ComplianceScoringEngine = class {
@@ -189402,7 +189607,7 @@ var init_scoring_engine = __esm({
 });
 var init_compliance = __esm({
-  "module_366"() {
+  "module_367"() {
     "use strict";
     init_types4();
     init_requirements();
@@ -189411,14 +189616,14 @@ var init_compliance = __esm({
 });
 var init_types5 = __esm({
-  "module_367"() {
+  "module_368"() {
     "use strict";
   }
 });
 var PolicyEngine, defaultPolicyEngine;
 var init_policy_engine = __esm({
-  "module_368"() {
+  "module_369"() {
     "use strict";
     init_dangerous_patterns();
     PolicyEngine = class {
@@ -189716,7 +189921,7 @@ async function validateLocalConfigs(basePath) {
 }
 var import_promises8, import_node_path10, PLATFORM_DIRS2, ConfigValidator;
 var init_config_validator = __esm({
-  "module_369"() {
+  "module_370"() {
     "use strict";
     import_promises8 = require("node:fs/promises");
     import_node_path10 = require("node:path");
@@ -189935,7 +190140,7 @@ async function createSystemEnforcer(config = {}) {
 }
 var import_node_fs7, import_promises9, import_node_path11, import_node_events, import_node_os8, ViolationBlockedError, SystemEnforcer;
 var init_system_enforcer = __esm({
-  "module_370"() {
+  "module_371"() {
     "use strict";
     import_node_fs7 = require("node:fs");
     import_promises9 = require("node:fs/promises");
@@ -190701,14 +190906,14 @@ rl.on('close', async () => {
   };
 }
 var init_workflow_enforcement_hook = __esm({
-  "module_371"() {
+  "module_372"() {
     "use strict";
     init_dist2();
   }
 });
 var init_enforcement = __esm({
-  "module_372"() {
+  "module_373"() {
     "use strict";
     init_types5();
     init_dangerous_patterns();
@@ -191156,7 +191361,7 @@ function groupBy(array, key) {
 }
 var import_promises10, defaultApiUrl6;
 var init_compliance2 = __esm({
-  "module_373"() {
+  "module_374"() {
     "use strict";
     init_esm();
     init_source();
@@ -191192,7 +191397,7 @@ function setTheme(theme) {
 }
 var subtleTheme, vividTheme, currentTheme, themeLoaded;
 var init_theme = __esm({
-  "module_374"() {
+  "module_375"() {
     "use strict";
     init_source();
     init_config_manager();
@@ -191379,7 +191584,7 @@ function createConfigCommand2() {
   return command;
 }
 var init_config = __esm({
-  "module_375"() {
+  "module_376"() {
     "use strict";
     init_esm();
     init_source();
@@ -191581,7 +191786,7 @@ Config: ${repo}/${path11}
 }
 var VALID_PLATFORMS, POLL_INTERVAL, SCAN_TIMEOUT;
 var init_discover = __esm({
-  "module_376"() {
+  "module_377"() {
     "use strict";
     init_esm();
     init_source();
@@ -191636,7 +191841,7 @@ function createDispatchCommand() {
 }
 var DEFAULT_DISPATCH_RUNNER_LABEL;
 var init_dispatch = __esm({
-  "module_377"() {
+  "module_378"() {
     "use strict";
     init_esm();
     DEFAULT_DISPATCH_RUNNER_LABEL = "agents-standard-runc-x64";
@@ -191688,7 +191893,7 @@ function createSyncAllCommand() {
   });
 }
 var init_distribute = __esm({
-  "module_378"() {
+  "module_379"() {
     "use strict";
     init_esm();
     init_source();
@@ -192470,7 +192675,7 @@ function discoverEvalCases(evalsDir) {
 }
 var fs, path4, DOCS_BASE_URL, DASHBOARD_URL;
 var init_docs = __esm({
-  "module_379"() {
+  "module_380"() {
     "use strict";
     init_esm();
     init_source();
@@ -193955,7 +194160,7 @@ async function removeGitPrecommitHook(basePath) {
 }
 var import_promises11, import_node_child_process4, import_node_os9, import_node_fs8, import_node_path12, import_node_crypto, defaultApiUrl7, PLATFORM_DIRS3, SCAN_PLATFORM_DIRS, ENFORCEMENT_HOOK_SUPPORT, GAL_PRECOMMIT_MARKER, GAL_PRECOMMIT_CONTENT;
 var init_enforce = __esm({
-  "module_380"() {
+  "module_381"() {
     "use strict";
     init_esm();
     init_source();
@@ -194169,7 +194374,7 @@ function createFeedbackCommand() {
 }
 var import_readline4, VALID_RATINGS, VALID_REASONS, REASON_LABELS;
 var init_feedback2 = __esm({
-  "module_381"() {
+  "module_382"() {
     "use strict";
     init_esm();
     init_source();
@@ -194343,7 +194548,7 @@ Files written to ${outputDir}`));
 }
 var import_fs35, import_path34, PLATFORM_DIRS4, CATEGORY_DIRS, FILE_EXTENSIONS;
 var init_fetch = __esm({
-  "module_382"() {
+  "module_383"() {
     "use strict";
     init_esm();
     init_source();
@@ -194479,7 +194684,7 @@ function createFlagsCommand() {
   return cmd;
 }
 var init_flags = __esm({
-  "module_383"() {
+  "module_384"() {
     "use strict";
     init_esm();
     init_source();
@@ -194571,7 +194776,7 @@ function createGovernanceCommand() {
 }
 var VALID_PROCESS_TYPES;
 var init_governance = __esm({
-  "module_384"() {
+  "module_385"() {
     "use strict";
     init_esm();
     init_source();
@@ -194987,7 +195192,7 @@ Fleet Status: ${orgName}
 }
 var import_node_os10, import_node_child_process5, import_node_crypto2, import_promises12, import_meta3, defaultApiUrl8;
 var init_fleet = __esm({
-  "module_385"() {
+  "module_386"() {
     "use strict";
     init_esm();
     init_source();
@@ -195094,7 +195299,7 @@ Task not running: ${taskId}
 }
 var import_child_process13, import_fs36, import_path35, DEFAULT_CONFIG, TASK_TEMPLATES, HeadlessRunner;
 var init_headless = __esm({
-  "module_386"() {
+  "module_387"() {
     "use strict";
     init_esm();
     init_source();
@@ -195501,7 +195706,7 @@ function createInitCommand() {
 }
 var import_path36;
 var init_init = __esm({
-  "module_387"() {
+  "module_388"() {
     "use strict";
     init_esm();
     init_source();
@@ -195836,7 +196041,7 @@ function createInstallCommand() {
 }
 var import_fs37, import_path37, import_os23, INSTALL_METHODS, CLAUDE_DIR2, SETTINGS_PATH2, MEMORY_HOOK_VERSION, MEMORY_HOOK_MARKER, CLAUDE_MD_MARKER_START, CLAUDE_MD_MARKER_END, CLAUDE_MD_TEMPLATE, AGENTS_MD_MARKER_START, AGENTS_MD_MARKER_END, AGENTS_MD_TEMPLATE;
 var init_install2 = __esm({
-  "module_388"() {
+  "module_389"() {
     "use strict";
     init_esm();
     init_source();
@@ -196168,7 +196373,7 @@ Error: ${useResult.error || "Unknown error"}`));
 }
 var import_node_os11, import_node_child_process6, import_node_crypto3, import_promises13, import_node_path13, defaultApiUrl9;
 var init_join = __esm({
-  "module_389"() {
+  "module_390"() {
     "use strict";
     init_esm();
     init_source();
@@ -196391,7 +196596,7 @@ function formatBytes(bytes) {
 }
 var MaintenanceHooks;
 var init_maintain = __esm({
-  "module_390"() {
+  "module_391"() {
     "use strict";
     init_esm();
     init_source();
@@ -196783,7 +196988,7 @@ function createSyncMemoryCommand() {
 }
 var import_child_process14, import_fs38, import_os24, import_path38, SYNC_TIMEOUT_MS, GAL_SYNC_MARKER, SYNC_STATE_DIR, SYNC_STATE_FILE, defaultApiUrl10;
 var init_sync_memory = __esm({
-  "module_391"() {
+  "module_392"() {
     "use strict";
     import_child_process14 = require("child_process");
     init_esm();
@@ -196804,7 +197009,7 @@ var init_sync_memory = __esm({
 var GalApiClient;
 var init_api_client = __esm({
-  "module_392"() {
+  "module_393"() {
     "use strict";
     GalApiClient = class {
       baseUrl;
@@ -196817,7 +197022,7 @@ var init_api_client = __esm({
         const url = `${this.baseUrl}${path11}`;
         const headers = {
           "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.authToken}`
+          Authorization: `Bearer ${this.authToken}`
         };
         const response = await fetch(url, {
           method,
@@ -197204,13 +197409,43 @@ var init_api_client = __esm({
       getSessionStreamUrl(sessionId) {
         return `${this.baseUrl}/api/sessions/${encodeURIComponent(sessionId)}/stream`;
       }
+      // =========================================================================
+      // Policy Agent Service (#6878)
+      // =========================================================================
+      async createPolicy(orgName, data) {
+        return this.request("POST", `/api/orgs/${encodeURIComponent(orgName)}/policies`, data);
+      }
+      async listPolicies(orgName, opts) {
+        const qs = new URLSearchParams();
+        if (opts?.status)
+          qs.append("status", opts.status);
+        if (opts?.type)
+          qs.append("type", opts.type);
+        const query = qs.toString() ? `?${qs.toString()}` : "";
+        return this.request("GET", `/api/orgs/${encodeURIComponent(orgName)}/policies${query}`);
+      }
+      async getPolicy(orgName, policyId) {
+        return this.request("GET", `/api/policies/${encodeURIComponent(policyId)}?orgName=${encodeURIComponent(orgName)}`);
+      }
+      async reviewPolicy(orgName, policyId, data) {
+        return this.request("PATCH", `/api/policies/${encodeURIComponent(policyId)}/review?orgName=${encodeURIComponent(orgName)}`, data);
+      }
+      async updatePolicyEnforcement(orgName, policyId, data) {
+        return this.request("PATCH", `/api/policies/${encodeURIComponent(policyId)}/enforcement?orgName=${encodeURIComponent(orgName)}`, data);
+      }
+      async checkOrgPolicy(orgName, context2) {
+        return this.request("POST", `/api/orgs/${encodeURIComponent(orgName)}/policies/check`, { context: context2 });
+      }
+      async checkSpecificPolicy(orgName, policyId, context2) {
+        return this.request("POST", `/api/policies/${encodeURIComponent(policyId)}/check?orgName=${encodeURIComponent(orgName)}`, { context: context2 });
+      }
     };
   }
 });
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
-  "module_393"() {
+  "module_394"() {
     (function(util2) {
       util2.assertEqual = (_) => {
       };
@@ -197346,7 +197581,7 @@ var init_util = __esm({
 var ZodIssueCode, quotelessJson, ZodError;
 var init_ZodError = __esm({
-  "module_394"() {
+  "module_395"() {
     init_util();
     ZodIssueCode = util.arrayToEnum([
       "invalid_type",
@@ -197469,7 +197704,7 @@ var init_ZodError = __esm({
 var errorMap, en_default;
 var init_en = __esm({
-  "module_395"() {
+  "module_396"() {
     init_ZodError();
     init_util();
     errorMap = (issue, _ctx) => {
@@ -197584,7 +197819,7 @@ function getErrorMap() {
 }
 var overrideErrorMap;
 var init_errors = __esm({
-  "module_396"() {
+  "module_397"() {
     init_en();
     overrideErrorMap = en_default;
   }
@@ -197611,7 +197846,7 @@ function addIssueToContext(ctx, issueData) {
 }
 var makeIssue, EMPTY_PATH, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync;
 var init_parseUtil = __esm({
-  "module_397"() {
+  "module_398"() {
     init_errors();
     init_en();
     makeIssue = (params) => {
@@ -197707,13 +197942,13 @@ var init_parseUtil = __esm({
 });
 var init_typeAliases = __esm({
-  "module_398"() {
+  "module_399"() {
   }
 });
 var errorUtil;
 var init_errorUtil = __esm({
-  "module_399"() {
+  "module_400"() {
     (function(errorUtil2) {
       errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
       errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
@@ -197914,7 +198149,7 @@ function custom(check, _params = {}, fatal) {
 }
 var ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, BRAND, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, instanceOfType, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, ostring, onumber, oboolean, coerce, NEVER;
 var init_types6 = __esm({
-  "module_400"() {
+  "module_401"() {
     init_ZodError();
     init_errors();
     init_errorUtil();
@@ -201287,7 +201522,7 @@ __export(external_exports, {
   void: () => voidType
 });
 var init_external = __esm({
-  "module_401"() {
+  "module_402"() {
     init_errors();
     init_parseUtil();
     init_typeAliases();
@@ -201298,7 +201533,7 @@ var init_external = __esm({
 });
 var init_zod = __esm({
-  "module_402"() {
+  "module_403"() {
     init_external();
     init_external();
   }
@@ -201325,7 +201560,7 @@ function resolveWorkspace(orgName) {
 }
 var ACTIVE_WORKSPACE_DESCRIPTION, activeWorkspace;
 var init_workspace_context = __esm({
-  "module_403"() {
+  "module_404"() {
     "use strict";
     init_zod();
     ACTIVE_WORKSPACE_DESCRIPTION = "Workspace name (GitHub organization or personal account). If omitted, the active workspace set by gal_set_active_workspace is used.";
@@ -201442,7 +201677,7 @@ function registerOrganizationTools(server, apiClient) {
   });
 }
 var init_organization_tools = __esm({
-  "module_404"() {
+  "module_405"() {
     "use strict";
     init_workspace_context();
   }
@@ -201517,7 +201752,7 @@ function registerDiscoveryTools(server, apiClient) {
   });
 }
 var init_discovery_tools = __esm({
-  "module_405"() {
+  "module_406"() {
     "use strict";
     init_zod();
     init_workspace_context();
@@ -201562,7 +201797,7 @@ function registerConfigTools(server, apiClient) {
   });
 }
 var init_config_tools = __esm({
-  "module_406"() {
+  "module_407"() {
     "use strict";
     init_zod();
     init_workspace_context();
@@ -201757,7 +201992,7 @@ function registerGovernanceTools(server, apiClient, options) {
   });
 }
 var init_governance_tools = __esm({
-  "module_407"() {
+  "module_408"() {
     "use strict";
     init_zod();
     init_workspace_context();
@@ -201817,7 +202052,7 @@ function registerTeamTools(server, apiClient) {
   });
 }
 var init_team_tools = __esm({
-  "module_408"() {
+  "module_409"() {
     "use strict";
     init_zod();
     init_workspace_context();
@@ -201943,7 +202178,7 @@ function registerComplianceTools(server, apiClient) {
   });
 }
 var init_compliance_tools = __esm({
-  "module_409"() {
+  "module_410"() {
     "use strict";
     init_zod();
     init_workspace_context();
@@ -202056,7 +202291,7 @@ function detectProcesses(entries) {
 }
 var DETECTION_PATTERNS;
 var init_process_detection = __esm({
-  "module_410"() {
+  "module_411"() {
     "use strict";
     DETECTION_PATTERNS = [
       // CI/CD patterns
@@ -203307,7 +203542,7 @@ function registerSessionTools(server, apiClient) {
 }
 var HUMAN_REQUIRED_KEYWORDS, HUMAN_REQUIRED_LABELS, CAPABILITY_RULES, storedSessionId, installationId2, MAX_TOTAL_RESPONSE_CHARS;
 var init_session_tools = __esm({
-  "module_411"() {
+  "module_412"() {
     "use strict";
     init_zod();
     init_workspace_context();
@@ -203491,28 +203726,278 @@ function registerMemoryTools(server, apiClient) {
   });
 }
 var init_memory_tools = __esm({
-  "module_412"() {
+  "module_413"() {
     "use strict";
     init_zod();
     init_session_tools();
   }
 });
+function registerPolicyTools(server, apiClient) {
+  server.tool("gal_policy_propose", "Create a policy proposal for the workspace. Policies define governance rules that can be approved and enforced. Requires admin to approve.", {
+    orgName: createWorkspaceParamSchema(),
+    name: external_exports.string().describe("Policy name"),
+    description: external_exports.string().describe("Policy description"),
+    type: external_exports.enum(["distribution-first", "security", "custom"]).describe("Policy type"),
+    rationale: external_exports.string().describe("Why this policy is needed"),
+    rules: external_exports.array(external_exports.object({
+      id: external_exports.string().describe("Unique rule identifier"),
+      name: external_exports.string().describe("Rule name"),
+      description: external_exports.string().optional().describe("Rule description"),
+      condition: external_exports.object({
+        type: external_exports.enum([
+          "work_type",
+          "repo_pattern",
+          "label",
+          "issue_title",
+          "custom"
+        ]),
+        operator: external_exports.enum([
+          "equals",
+          "contains",
+          "matches",
+          "in",
+          "not_in"
+        ]),
+        value: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())])
+      }).describe("When this rule applies"),
+      action: external_exports.enum(["allow", "warn", "block"]).describe("What action to take"),
+      message: external_exports.string().describe("Message to show when rule triggers"),
+      severity: external_exports.enum(["info", "warning", "error"]).optional(),
+      evidenceRequired: external_exports.array(external_exports.string()).optional().describe("Evidence needed to proceed")
+    })).describe("Policy rules"),
+    enforcement: external_exports.object({
+      enabled: external_exports.boolean().describe("Whether enforcement is active"),
+      mode: external_exports.enum(["off", "warn", "block"]).describe("Enforcement mode"),
+      scope: external_exports.enum(["org", "repo"]).describe("Scope of enforcement"),
+      repoScope: external_exports.array(external_exports.string()).optional().describe("Repos if scope is repo")
+    }).describe("Enforcement settings")
+  }, async ({ orgName, name, description, type, rationale, rules, enforcement }) => {
+    try {
+      const result = await apiClient.createPolicy(resolveWorkspace(orgName), {
+        name,
+        description,
+        type,
+        rationale,
+        rules,
+        enforcement
+      });
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error creating policy: ${message}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  server.tool("gal_policy_list", "List policies for a workspace. Optionally filter by status or type. If orgName is omitted, the active workspace set by gal_set_active_workspace is used.", {
+    orgName: createWorkspaceParamSchema(),
+    status: external_exports.enum(["draft", "pending", "approved", "rejected", "deprecated"]).optional().describe("Filter by status"),
+    type: external_exports.enum(["distribution-first", "security", "custom"]).optional().describe("Filter by type")
+  }, async ({ orgName, status, type }) => {
+    try {
+      const opts = status || type ? { status, type } : void 0;
+      const result = await apiClient.listPolicies(resolveWorkspace(orgName), opts);
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error listing policies: ${message}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  server.tool("gal_policy_get", "Get details of a specific policy by ID.", {
+    policyId: external_exports.string().describe("Policy ID"),
+    orgName: createWorkspaceParamSchema()
+  }, async ({ policyId, orgName }) => {
+    try {
+      const result = await apiClient.getPolicy(resolveWorkspace(orgName), policyId);
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          { type: "text", text: `Error getting policy: ${message}` }
+        ],
+        isError: true
+      };
+    }
+  });
+  server.tool("gal_policy_approve", "Approve a policy proposal (admin only). Once approved, the policy can be enabled for enforcement.", {
+    policyId: external_exports.string().describe("Policy ID to approve"),
+    orgName: createWorkspaceParamSchema(),
+    comment: external_exports.string().optional().describe("Optional approval comment")
+  }, async ({ policyId, orgName, comment }) => {
+    try {
+      const result = await apiClient.reviewPolicy(resolveWorkspace(orgName), policyId, {
+        action: "approve",
+        comment
+      });
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error approving policy: ${message}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  server.tool("gal_policy_reject", "Reject a policy proposal (admin only). The policy will be marked as rejected and cannot be enabled.", {
+    policyId: external_exports.string().describe("Policy ID to reject"),
+    orgName: createWorkspaceParamSchema(),
+    comment: external_exports.string().describe("Reason for rejection")
+  }, async ({ policyId, orgName, comment }) => {
+    try {
+      const result = await apiClient.reviewPolicy(resolveWorkspace(orgName), policyId, {
+        action: "reject",
+        comment
+      });
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error rejecting policy: ${message}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  server.tool("gal_policy_check", "Check if work context is allowed by policy. Returns enforcement decision with reasons and evidence requirements.", {
+    orgName: createWorkspaceParamSchema(),
+    policyId: external_exports.string().optional().describe("Specific policy ID to check (optional, checks all org policies if omitted)"),
+    context: external_exports.object({
+      workType: external_exports.string().optional().describe("Type of work (feature, bugfix, migration, etc.)"),
+      repo: external_exports.string().optional().describe("Repository name (owner/repo)"),
+      issueNumber: external_exports.number().optional().describe("Issue number"),
+      issueLabels: external_exports.array(external_exports.string()).optional().describe("Issue labels"),
+      issueTitle: external_exports.string().optional().describe("Issue title"),
+      issueBody: external_exports.string().optional().describe("Issue body"),
+      userLogin: external_exports.string().optional().describe("User login"),
+      branch: external_exports.string().optional().describe("Branch name"),
+      customContext: external_exports.record(external_exports.unknown()).optional().describe("Additional context")
+    }).describe("Work context to check against policy")
+  }, async ({ orgName, policyId, context: context2 }) => {
+    try {
+      const result = policyId ? await apiClient.checkSpecificPolicy(resolveWorkspace(orgName), policyId, context2) : await apiClient.checkOrgPolicy(resolveWorkspace(orgName), context2);
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error checking policy: ${message}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+  server.tool("gal_policy_set_enforcement", "Update policy enforcement settings (admin only). Can toggle enforcement on/off, change mode, or update scope.", {
+    policyId: external_exports.string().describe("Policy ID to update"),
+    orgName: createWorkspaceParamSchema(),
+    enabled: external_exports.boolean().optional().describe("Enable or disable enforcement"),
+    mode: external_exports.enum(["off", "warn", "block"]).optional().describe("Enforcement mode"),
+    scope: external_exports.enum(["org", "repo"]).optional().describe("Enforcement scope"),
+    repoScope: external_exports.array(external_exports.string()).optional().describe("Repos if scope is repo")
+  }, async ({ policyId, orgName, enabled, mode, scope, repoScope }) => {
+    try {
+      const result = await apiClient.updatePolicyEnforcement(resolveWorkspace(orgName), policyId, {
+        enabled,
+        mode,
+        scope,
+        repoScope
+      });
+      return {
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
+      };
+    } catch (error2) {
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Error updating enforcement: ${message}`
+          }
+        ],
+        isError: true
+      };
+    }
+  });
+}
+var init_policy_tools = __esm({
+  "module_414"() {
+    "use strict";
+    init_zod();
+    init_workspace_context();
+  }
+});
 function registerTools(server, apiClient, options) {
   const enableAgentTools = options?.internalOnly ?? false;
   registerOrganizationTools(server, apiClient);
   registerDiscoveryTools(server, apiClient);
   registerConfigTools(server, apiClient);
-  registerGovernanceTools(server, apiClient, { enableProposals: enableAgentTools });
+  registerGovernanceTools(server, apiClient, {
+    enableProposals: enableAgentTools
+  });
   registerTeamTools(server, apiClient);
   registerComplianceTools(server, apiClient);
   registerMemoryTools(server, apiClient);
+  registerPolicyTools(server, apiClient);
   if (enableAgentTools) {
     registerSessionTools(server, apiClient);
   }
 }
 var init_tools = __esm({
-  "module_413"() {
+  "module_415"() {
     "use strict";
     init_organization_tools();
     init_discovery_tools();
@@ -203522,6 +204007,7 @@ var init_tools = __esm({
     init_compliance_tools();
     init_session_tools();
     init_memory_tools();
+    init_policy_tools();
   }
 });
@@ -203652,7 +204138,7 @@ async function startGalMcpServer() {
 }
 var import_node_fs9, import_node_path14, import_node_os12, import_mcp, import_stdio3, SERVER_NAME, SERVER_VERSION, DEFAULT_GAL_API_URL;
 var init_server = __esm({
-  "module_414"() {
+  "module_416"() {
     "use strict";
     import_node_fs9 = require("node:fs");
     import_node_path14 = require("node:path");
@@ -204033,7 +204519,7 @@ function createMcpCommand() {
 }
 var import_fs39, import_path39, DEFAULT_SERVER_NAME, defaultApiUrl11;
 var init_mcp = __esm({
-  "module_415"() {
+  "module_417"() {
     "use strict";
     init_esm();
     init_source();
@@ -204337,7 +204823,7 @@ Notes:
 }
 var import_fs40, import_path40, import_os25;
 var init_memory2 = __esm({
-  "module_416"() {
+  "module_418"() {
     "use strict";
     init_esm();
     init_source();
@@ -204492,7 +204978,7 @@ function parseAgentOutput(output, options = {}) {
 }
 var draftIssueSchema, draftIssueArraySchema, DEFAULT_CHUNK_SIZE, DEFAULT_CHUNK_OVERLAP;
 var init_transcript_processor = __esm({
-  "module_417"() {
+  "module_419"() {
     "use strict";
     init_zod();
     draftIssueSchema = external_exports.object({
@@ -204639,7 +205125,7 @@ async function readLocalTranscriptFile(filePath) {
 }
 var import_promises14, import_node_os13, import_node_path15, GoogleDriveService;
 var init_google_drive = __esm({
-  "module_418"() {
+  "module_420"() {
     "use strict";
     import_promises14 = require("node:fs/promises");
     import_node_os13 = require("node:os");
@@ -204769,7 +205255,7 @@ async function collectSessionOutput(options) {
   }
 }
 var init_session_output_stream = __esm({
-  "module_419"() {
+  "module_421"() {
     "use strict";
   }
 });
@@ -204854,7 +205340,7 @@ async function createIssues(drafts, context2, onProgress) {
 }
 var import_node_child_process7, import_promises15, import_node_os14, import_node_path16, import_node_util2, execFile;
 var init_issue_creator = __esm({
-  "module_420"() {
+  "module_422"() {
     "use strict";
     import_node_child_process7 = require("node:child_process");
     import_promises15 = require("node:fs/promises");
@@ -204948,7 +205434,7 @@ async function reviewDraftIssues(transcript, drafts, options = {}) {
 }
 var import_node_readline, import_node_child_process8, import_promises16, import_node_os15, import_node_path17;
 var init_transcript_review = __esm({
-  "module_421"() {
+  "module_423"() {
     "use strict";
     import_node_readline = require("node:readline");
     import_node_child_process8 = require("node:child_process");
@@ -205174,7 +205660,7 @@ function createOpsCommand() {
 }
 var import_node_child_process9, import_promises17, DEFAULT_TRANSCRIPT_REPO;
 var init_ops = __esm({
-  "module_422"() {
+  "module_424"() {
     "use strict";
     import_node_child_process9 = require("node:child_process");
     import_promises17 = require("node:fs/promises");
@@ -205233,7 +205719,11 @@ async function fetchBusinessOpsDecision(options) {
     });
     const body = await res.json().catch(() => ({}));
     if (!res.ok) {
-      throw new Error(String(body.error || `Business Ops Admin agent returned HTTP ${res.status}`));
+      throw new Error(
+        String(
+          body.error || `Business Ops Admin agent returned HTTP ${res.status}`
+        )
+      );
     }
     return body;
   } finally {
@@ -205256,7 +205746,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205276,15 +205768,25 @@ function createPolicyCommand() {
         console.log(JSON.stringify(data, null, 2));
       } else {
         if (data.policies.length === 0) {
-          console.log(source_default.dim("No active policies found for this organization."));
+          console.log(
+            source_default.dim("No active policies found for this organization.")
+          );
         } else {
-          console.log(source_default.green(`Pulled ${data.policies.length} active policies:`));
+          console.log(
+            source_default.green(`Pulled ${data.policies.length} active policies:`)
+          );
           console.log();
           for (const p of data.policies) {
-            console.log(`  ${source_default.bold(p.name)} ${source_default.dim(`(${p.type})`)}`);
-            console.log(`    Version: ${p.version}  Status: ${source_default.green(p.status)}`);
+            console.log(
+              `  ${source_default.bold(p.name)} ${source_default.dim(`(${p.type})`)}`
+            );
+            console.log(
+              `    Version: ${p.version}  Status: ${source_default.green(p.status)}`
+            );
             if (p.distributedAt) {
-              console.log(`    Distributed: ${new Date(p.distributedAt).toLocaleString()}`);
+              console.log(
+                `    Distributed: ${new Date(p.distributedAt).toLocaleString()}`
+              );
             }
             console.log();
           }
@@ -205310,7 +205812,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205339,7 +205843,9 @@ function createPolicyCommand() {
             console.log(
               `  ${source_default.bold(p.name)} ${source_default.dim(`(${p.type})`)} ${statusColor(p.status)}`
             );
-            console.log(`    Version: ${p.version}  Created by: ${p.createdBy}`);
+            console.log(
+              `    Version: ${p.version}  Created by: ${p.createdBy}`
+            );
             console.log();
           }
         }
@@ -205355,7 +205861,23 @@ function createPolicyCommand() {
       process.exit(1);
     }
   });
-  command.command("create").description("Create a new agent security policy (admin only)").requiredOption("--name <name>", "Policy name").requiredOption("--description <desc>", "Policy description").option("--allowed-tools <tools>", "Comma-separated allowed tools", "").option("--blocked-tools <tools>", "Comma-separated blocked tools", "").option("--allowed-file-patterns <patterns>", "Comma-separated allowed file patterns", "").option("--blocked-file-patterns <patterns>", "Comma-separated blocked file patterns", "").option("--allowed-domains <domains>", "Comma-separated allowed domains", "").option("--blocked-domains <domains>", "Comma-separated blocked domains", "").option("--priority <n>", "Policy priority (higher overrides lower)", "0").option("--disabled", "Create policy in disabled state").option("--json", "Output as JSON").action(async (options) => {
+  command.command("create").description("Create a new agent security policy (admin only)").requiredOption("--name <name>", "Policy name").requiredOption("--description <desc>", "Policy description").option("--allowed-tools <tools>", "Comma-separated allowed tools", "").option("--blocked-tools <tools>", "Comma-separated blocked tools", "").option(
+    "--allowed-file-patterns <patterns>",
+    "Comma-separated allowed file patterns",
+    ""
+  ).option(
+    "--blocked-file-patterns <patterns>",
+    "Comma-separated blocked file patterns",
+    ""
+  ).option(
+    "--allowed-domains <domains>",
+    "Comma-separated allowed domains",
+    ""
+  ).option(
+    "--blocked-domains <domains>",
+    "Comma-separated blocked domains",
+    ""
+  ).option("--priority <n>", "Policy priority (higher overrides lower)", "0").option("--disabled", "Create policy in disabled state").option("--json", "Output as JSON").action(async (options) => {
     const config = ConfigManager.load();
     const authToken = config.authToken || config.apiKey;
     if (!authToken) {
@@ -205364,7 +205886,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205405,7 +205929,9 @@ function createPolicyCommand() {
       } else {
         console.log(`  ID: ${source_default.bold(data.policy.id)}`);
         console.log(`  Name: ${data.policy.name}`);
-        console.log(`  Enabled: ${data.policy.enabled ? source_default.green("yes") : source_default.yellow("no")}`);
+        console.log(
+          `  Enabled: ${data.policy.enabled ? source_default.green("yes") : source_default.yellow("no")}`
+        );
       }
     } catch (error2) {
       spinner?.stop();
@@ -205418,69 +205944,89 @@ function createPolicyCommand() {
       process.exit(1);
     }
   });
-  command.command("update <id>").description("Update an agent security policy (admin only)").requiredOption("--name <name>", "Policy name").requiredOption("--description <desc>", "Policy description").option("--allowed-tools <tools>", "Comma-separated allowed tools", "").option("--blocked-tools <tools>", "Comma-separated blocked tools", "").option("--allowed-file-patterns <patterns>", "Comma-separated allowed file patterns", "").option("--blocked-file-patterns <patterns>", "Comma-separated blocked file patterns", "").option("--allowed-domains <domains>", "Comma-separated allowed domains", "").option("--blocked-domains <domains>", "Comma-separated blocked domains", "").option("--priority <n>", "Policy priority", "0").option("--enabled", "Enable policy").option("--disabled", "Disable policy").option("--json", "Output as JSON").action(async (id, options) => {
-    const config = ConfigManager.load();
-    const authToken = config.authToken || config.apiKey;
-    if (!authToken) {
-      console.error(source_default.red("Not authenticated. Run: gal auth login"));
-      process.exit(1);
-    }
-    const orgName = config.defaultOrg;
-    if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
-      process.exit(1);
-    }
-    const apiUrl = config.apiUrl || defaultApiUrl12;
-    const spinner = options.json ? null : ora("Updating policy...").start();
-    const splitCsv = (val) => {
-      if (!val || typeof val !== "string") return [];
-      return val.split(",").map((s2) => s2.trim()).filter(Boolean);
-    };
-    try {
-      const enabled = options.disabled ? false : options.enabled ? true : void 0;
-      const body = {
-        name: options.name,
-        description: options.description,
-        allowedTools: splitCsv(options.allowedTools),
-        blockedTools: splitCsv(options.blockedTools),
-        allowedFilePatterns: splitCsv(options.allowedFilePatterns),
-        blockedFilePatterns: splitCsv(options.blockedFilePatterns),
-        networkRestrictions: {
-          allowedDomains: splitCsv(options.allowedDomains),
-          blockedDomains: splitCsv(options.blockedDomains)
-        },
-        priority: parseInt(String(options.priority || "0"), 10),
-        ...enabled !== void 0 ? { enabled } : {}
-      };
-      const res = await fetchWithAuth2(
-        `${apiUrl}/organizations/${encodeURIComponent(orgName)}/agent-security-policies/${encodeURIComponent(id)}`,
-        authToken,
-        "PUT",
-        body
-      );
-      if (!res.ok) {
-        const data2 = await res.json().catch(() => ({}));
-        throw new Error(data2.error || `HTTP ${res.status}`);
+  command.command("update <id>").description("Update an agent security policy (admin only)").requiredOption("--name <name>", "Policy name").requiredOption("--description <desc>", "Policy description").option("--allowed-tools <tools>", "Comma-separated allowed tools", "").option("--blocked-tools <tools>", "Comma-separated blocked tools", "").option(
+    "--allowed-file-patterns <patterns>",
+    "Comma-separated allowed file patterns",
+    ""
+  ).option(
+    "--blocked-file-patterns <patterns>",
+    "Comma-separated blocked file patterns",
+    ""
+  ).option(
+    "--allowed-domains <domains>",
+    "Comma-separated allowed domains",
+    ""
+  ).option(
+    "--blocked-domains <domains>",
+    "Comma-separated blocked domains",
+    ""
+  ).option("--priority <n>", "Policy priority", "0").option("--enabled", "Enable policy").option("--disabled", "Disable policy").option("--json", "Output as JSON").action(
+    async (id, options) => {
+      const config = ConfigManager.load();
+      const authToken = config.authToken || config.apiKey;
+      if (!authToken) {
+        console.error(source_default.red("Not authenticated. Run: gal auth login"));
+        process.exit(1);
       }
-      const data = await res.json();
-      spinner?.succeed("Policy updated");
-      if (options.json) {
-        console.log(JSON.stringify(data, null, 2));
-      } else {
-        console.log(`  ID: ${source_default.bold(data.policy.id)}`);
-        console.log(`  Name: ${data.policy.name}`);
+      const orgName = config.defaultOrg;
+      if (!orgName) {
+        console.error(
+          source_default.red("No default organization set. Run: gal auth login")
+        );
+        process.exit(1);
       }
-    } catch (error2) {
-      spinner?.stop();
-      const msg = error2 instanceof Error ? error2.message : String(error2);
-      if (options.json) {
-        console.log(JSON.stringify({ error: msg }));
-      } else {
-        console.error(source_default.red("Error updating policy:"), msg);
+      const apiUrl = config.apiUrl || defaultApiUrl12;
+      const spinner = options.json ? null : ora("Updating policy...").start();
+      const splitCsv = (val) => {
+        if (!val || typeof val !== "string") return [];
+        return val.split(",").map((s2) => s2.trim()).filter(Boolean);
+      };
+      try {
+        const enabled = options.disabled ? false : options.enabled ? true : void 0;
+        const body = {
+          name: options.name,
+          description: options.description,
+          allowedTools: splitCsv(options.allowedTools),
+          blockedTools: splitCsv(options.blockedTools),
+          allowedFilePatterns: splitCsv(options.allowedFilePatterns),
+          blockedFilePatterns: splitCsv(options.blockedFilePatterns),
+          networkRestrictions: {
+            allowedDomains: splitCsv(options.allowedDomains),
+            blockedDomains: splitCsv(options.blockedDomains)
+          },
+          priority: parseInt(String(options.priority || "0"), 10),
+          ...enabled !== void 0 ? { enabled } : {}
+        };
+        const res = await fetchWithAuth2(
+          `${apiUrl}/organizations/${encodeURIComponent(orgName)}/agent-security-policies/${encodeURIComponent(id)}`,
+          authToken,
+          "PUT",
+          body
+        );
+        if (!res.ok) {
+          const data2 = await res.json().catch(() => ({}));
+          throw new Error(data2.error || `HTTP ${res.status}`);
+        }
+        const data = await res.json();
+        spinner?.succeed("Policy updated");
+        if (options.json) {
+          console.log(JSON.stringify(data, null, 2));
+        } else {
+          console.log(`  ID: ${source_default.bold(data.policy.id)}`);
+          console.log(`  Name: ${data.policy.name}`);
+        }
+      } catch (error2) {
+        spinner?.stop();
+        const msg = error2 instanceof Error ? error2.message : String(error2);
+        if (options.json) {
+          console.log(JSON.stringify({ error: msg }));
+        } else {
+          console.error(source_default.red("Error updating policy:"), msg);
+        }
+        process.exit(1);
       }
-      process.exit(1);
     }
-  });
+  );
   command.command("delete <id>").description("Delete an agent security policy (admin only)").option("--json", "Output as JSON").action(async (id, options) => {
     const config = ConfigManager.load();
     const authToken = config.authToken || config.apiKey;
@@ -205490,7 +206036,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205532,7 +206080,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205553,10 +206103,14 @@ function createPolicyCommand() {
       } else {
         const p = data.policy || data;
         console.log();
-        console.log(`  ${source_default.bold(p.name)} ${source_default.dim(`(${p.type || "policy"})`)}`);
+        console.log(
+          `  ${source_default.bold(p.name)} ${source_default.dim(`(${p.type || "policy"})`)}`
+        );
         console.log(`  ID:          ${source_default.bold(p.id)}`);
         console.log(`  Description: ${p.description || ""}`);
-        console.log(`  Enabled:     ${p.enabled ? source_default.green("yes") : source_default.yellow("no")}`);
+        console.log(
+          `  Enabled:     ${p.enabled ? source_default.green("yes") : source_default.yellow("no")}`
+        );
         console.log(`  Version:     ${p.version || "N/A"}`);
         console.log(`  Created by:  ${p.createdBy || "unknown"}`);
         if (p.allowedTools?.length > 0) {
@@ -205587,7 +206141,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205608,7 +206164,9 @@ function createPolicyCommand() {
       if (options.json) {
         console.log(JSON.stringify(data, null, 2));
       } else {
-        console.log(`  Policy ${source_default.bold(id)} is now ${source_default.green("enabled")}.`);
+        console.log(
+          `  Policy ${source_default.bold(id)} is now ${source_default.green("enabled")}.`
+        );
       }
     } catch (error2) {
       spinner?.stop();
@@ -205630,7 +206188,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205650,7 +206210,9 @@ function createPolicyCommand() {
       if (options.json) {
         console.log(JSON.stringify(data, null, 2));
       } else {
-        console.log(`  Policy ${source_default.bold(id)} distributed at ${data.distributedAt}`);
+        console.log(
+          `  Policy ${source_default.bold(id)} distributed at ${data.distributedAt}`
+        );
       }
     } catch (error2) {
       spinner?.stop();
@@ -205663,86 +206225,116 @@ function createPolicyCommand() {
       process.exit(1);
     }
   });
-  command.command("check").description("Check a product/work-class decision through the Business Ops Admin agent").requiredOption("--product <id>", "Product id, e.g. gal or stratus").requiredOption("--work-class <class>", "Requested work class, e.g. feature_depth or release_integrity").option("--agent-url <url>", "Business Ops Admin agent URL (defaults to GAL_BUSINESS_OPS_AGENT_URL or localhost)").option("--agent-token <token>", "Bearer token for the Business Ops Admin agent").option("--enforcement-mode <mode>", "off, warn, or block (default: GAL_POLICY_ENFORCEMENT_MODE or warn)").option("--json", "Output as JSON").action(async (options) => {
-    const enforcementMode = resolveEnforcementMode(options.enforcementMode);
-    const agentUrl = resolveBusinessOpsAgentUrl(options.agentUrl);
-    const agentToken = options.agentToken || process.env.GAL_BUSINESS_OPS_AGENT_TOKEN || process.env.BUSINESS_OPS_AGENT_TOKEN;
-    if (enforcementMode === "off") {
-      const payload = {
-        schema_version: "gal-policy-check.v1",
-        source: "gal-cli",
-        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
-        enforcement_mode: enforcementMode,
-        product_id: options.product,
-        requested_work_class: options.workClass,
-        decision: "allow",
-        decision_reason: "enforcement_off"
-      };
-      if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-      } else {
-        console.log(source_default.yellow("Policy enforcement is off."));
+  command.command("check").description(
+    "Check a product/work-class decision through the Business Ops Admin agent"
+  ).requiredOption("--product <id>", "Product id, e.g. gal or stratus").requiredOption(
+    "--work-class <class>",
+    "Requested work class, e.g. feature_depth or release_integrity"
+  ).option(
+    "--agent-url <url>",
+    "Business Ops Admin agent URL (defaults to GAL_BUSINESS_OPS_AGENT_URL or localhost)"
+  ).option(
+    "--agent-token <token>",
+    "Bearer token for the Business Ops Admin agent"
+  ).option(
+    "--enforcement-mode <mode>",
+    "off, warn, or block (default: GAL_POLICY_ENFORCEMENT_MODE or warn)"
+  ).option("--json", "Output as JSON").action(
+    async (options) => {
+      const enforcementMode = resolveEnforcementMode(options.enforcementMode);
+      const agentUrl = resolveBusinessOpsAgentUrl(options.agentUrl);
+      const agentToken = options.agentToken || process.env.GAL_BUSINESS_OPS_AGENT_TOKEN || process.env.BUSINESS_OPS_AGENT_TOKEN;
+      if (enforcementMode === "off") {
+        const payload = {
+          schema_version: "gal-policy-check.v1",
+          source: "gal-cli",
+          checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+          enforcement_mode: enforcementMode,
+          product_id: options.product,
+          requested_work_class: options.workClass,
+          decision: "allow",
+          decision_reason: "enforcement_off"
+        };
+        if (options.json) {
+          console.log(JSON.stringify(payload, null, 2));
+        } else {
+          console.log(source_default.yellow("Policy enforcement is off."));
+        }
+        return;
       }
-      return;
-    }
-    const spinner = options.json ? null : ora("Checking product policy...").start();
-    try {
-      const decision = await fetchBusinessOpsDecision({
-        agentUrl,
-        agentToken,
-        product: options.product,
-        workClass: options.workClass
-      });
-      const payload = {
-        schema_version: "gal-policy-check.v1",
-        source: "gal-cli",
-        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
-        enforcement_mode: enforcementMode,
-        business_ops_agent_url: agentUrl,
-        decision
-      };
-      spinner?.stop();
-      if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-      } else {
-        const decisionText = String(decision.decision || "warn").toUpperCase();
-        const color = decision.decision === "block" ? source_default.red : decision.decision === "allow" ? source_default.green : source_default.yellow;
-        console.log(`${color(decisionText)} ${decision.product_id || options.product}`);
-        console.log(`Reason: ${decision.decision_reason || "unknown"}`);
-        console.log(`Requested work: ${decision.requested_work_class || options.workClass}`);
-        console.log(`Recommended work: ${decision.recommended_work_class || "(none)"}`);
-        if (decision.priority_class) {
-          console.log(`Priority: ${decision.priority_class} ${decision.priority_score ?? ""}`.trim());
+      const spinner = options.json ? null : ora("Checking product policy...").start();
+      try {
+        const decision = await fetchBusinessOpsDecision({
+          agentUrl,
+          agentToken,
+          product: options.product,
+          workClass: options.workClass
+        });
+        const payload = {
+          schema_version: "gal-policy-check.v1",
+          source: "gal-cli",
+          checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+          enforcement_mode: enforcementMode,
+          business_ops_agent_url: agentUrl,
+          decision
+        };
+        spinner?.stop();
+        if (options.json) {
+          console.log(JSON.stringify(payload, null, 2));
+        } else {
+          const decisionText = String(
+            decision.decision || "warn"
+          ).toUpperCase();
+          const color = decision.decision === "block" ? source_default.red : decision.decision === "allow" ? source_default.green : source_default.yellow;
+          console.log(
+            `${color(decisionText)} ${decision.product_id || options.product}`
+          );
+          console.log(`Reason: ${decision.decision_reason || "unknown"}`);
+          console.log(
+            `Requested work: ${decision.requested_work_class || options.workClass}`
+          );
+          console.log(
+            `Recommended work: ${decision.recommended_work_class || "(none)"}`
+          );
+          if (decision.priority_class) {
+            console.log(
+              `Priority: ${decision.priority_class} ${decision.priority_score ?? ""}`.trim()
+            );
+          }
+          const gates = activeGateNames(decision.gates);
+          console.log(`Gates: ${gates.length ? gates.join(",") : "none"}`);
+          if (decision.required_actions?.length) {
+            console.log("Required actions:");
+            for (const action of decision.required_actions)
+              console.log(`- ${action}`);
+          }
         }
-        const gates = activeGateNames(decision.gates);
-        console.log(`Gates: ${gates.length ? gates.join(",") : "none"}`);
-        if (decision.required_actions?.length) {
-          console.log("Required actions:");
-          for (const action of decision.required_actions) console.log(`- ${action}`);
+        if (decision.decision === "block" && enforcementMode === "block") {
+          process.exit(2);
         }
+      } catch (error2) {
+        spinner?.stop();
+        const msg = error2 instanceof Error ? error2.message : String(error2);
+        const payload = {
+          schema_version: "gal-policy-check.v1",
+          source: "gal-cli",
+          checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+          enforcement_mode: enforcementMode,
+          business_ops_agent_url: agentUrl,
+          error: msg
+        };
+        if (options.json) {
+          console.log(JSON.stringify(payload, null, 2));
+        } else {
+          console.error(
+            source_default.yellow("Could not reach Business Ops Admin agent:"),
+            msg
+          );
+        }
+        if (enforcementMode === "block") process.exit(2);
       }
-      if (decision.decision === "block" && enforcementMode === "block") {
-        process.exit(2);
-      }
-    } catch (error2) {
-      spinner?.stop();
-      const msg = error2 instanceof Error ? error2.message : String(error2);
-      const payload = {
-        schema_version: "gal-policy-check.v1",
-        source: "gal-cli",
-        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
-        enforcement_mode: enforcementMode,
-        business_ops_agent_url: agentUrl,
-        error: msg
-      };
-      if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-      } else {
-        console.error(source_default.yellow("Could not reach Business Ops Admin agent:"), msg);
-      }
-      if (enforcementMode === "block") process.exit(2);
     }
-  });
+  );
   command.command("status").description("Show merged effective policy for the organization").option("--json", "Output as JSON").action(async (options) => {
     const config = ConfigManager.load();
     const authToken = config.authToken || config.apiKey;
@@ -205752,7 +206344,9 @@ function createPolicyCommand() {
     }
     const orgName = config.defaultOrg;
     if (!orgName) {
-      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      console.error(
+        source_default.red("No default organization set. Run: gal auth login")
+      );
       process.exit(1);
     }
     const apiUrl = config.apiUrl || defaultApiUrl12;
@@ -205769,12 +206363,16 @@ function createPolicyCommand() {
       const data = await res.json();
       spinner?.stop();
       if (options.json) {
-        console.log(JSON.stringify({ organization: orgName, ...data }, null, 2));
+        console.log(
+          JSON.stringify({ organization: orgName, ...data }, null, 2)
+        );
       } else {
         const p = data.policy;
         console.log();
         console.log(`  Organization: ${source_default.bold(orgName)}`);
-        console.log(`  Source policies: ${source_default.cyan(String(p.sourcePolicyIds?.length || 0))}`);
+        console.log(
+          `  Source policies: ${source_default.cyan(String(p.sourcePolicyIds?.length || 0))}`
+        );
         console.log(`  Merged at: ${p.mergedAt || "N/A"}`);
         console.log();
         if (p.blockedTools?.length > 0) {
@@ -205784,10 +206382,14 @@ function createPolicyCommand() {
           console.log(`  Allowed tools: ${p.allowedTools.join(", ")}`);
         }
         if (p.networkRestrictions?.blockedDomains?.length > 0) {
-          console.log(`  Blocked domains: ${p.networkRestrictions.blockedDomains.join(", ")}`);
+          console.log(
+            `  Blocked domains: ${p.networkRestrictions.blockedDomains.join(", ")}`
+          );
         }
         if (p.networkRestrictions?.allowedDomains?.length > 0) {
-          console.log(`  Allowed domains: ${p.networkRestrictions.allowedDomains.join(", ")}`);
+          console.log(
+            `  Allowed domains: ${p.networkRestrictions.allowedDomains.join(", ")}`
+          );
         }
         if (!p.blockedTools?.length && !p.allowedTools?.length && !p.networkRestrictions?.blockedDomains?.length) {
           console.log(source_default.dim("  No restrictions configured."));
@@ -205805,11 +206407,320 @@ function createPolicyCommand() {
       process.exit(1);
     }
   });
+  command.command("propose").description("Create a policy proposal from a YAML file").requiredOption("--org <org>", "Organization name").requiredOption("--file <path>", "Path to policy YAML file").option("--json", "Output as JSON").action(async (options) => {
+    const config = ConfigManager.load();
+    const authToken = config.authToken || config.apiKey;
+    if (!authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const apiUrl = config.apiUrl || defaultApiUrl12;
+    const spinner = options.json ? null : ora("Reading policy file...").start();
+    try {
+      const fs9 = await import("fs");
+      const path11 = await import("path");
+      if (!fs9.existsSync(options.file)) {
+        spinner?.fail(source_default.red(`File not found: ${options.file}`));
+        process.exit(1);
+      }
+      const yaml = await Promise.resolve().then(() => __toESM(require_dist(), 1));
+      const content = fs9.readFileSync(options.file, "utf-8");
+      const policyData = yaml.parse(content);
+      if (spinner) spinner.text = "Creating policy proposal...";
+      const body = {
+        name: policyData.name,
+        description: policyData.description || "",
+        config: policyData.config || {},
+        isActive: false
+      };
+      if (!body.name) {
+        spinner?.fail(source_default.red("Policy name is required in YAML file"));
+        process.exit(1);
+      }
+      const res = await fetchWithAuth2(
+        `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies`,
+        authToken,
+        "POST",
+        body
+      );
+      if (!res.ok) {
+        const data2 = await res.json().catch(() => ({}));
+        throw new Error(data2.error || `HTTP ${res.status}`);
+      }
+      const data = await res.json();
+      spinner?.succeed("Policy proposal created");
+      if (options.json) {
+        console.log(JSON.stringify(data, null, 2));
+      } else {
+        console.log(`  ID: ${source_default.bold(data.policy.id)}`);
+        console.log(`  Name: ${data.policy.name}`);
+        console.log(`  Status: ${source_default.yellow("pending approval")}`);
+        console.log();
+        console.log(
+          source_default.dim(
+            "  An admin must approve this policy before it becomes active."
+          )
+        );
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red("Error creating policy proposal:"), msg);
+      }
+      process.exit(1);
+    }
+  });
+  command.command("reject <id>").description("Reject/delete a policy proposal (admin only)").requiredOption("--org <org>", "Organization name").requiredOption("--reason <reason>", "Reason for rejection").option("--json", "Output as JSON").action(
+    async (id, options) => {
+      const config = ConfigManager.load();
+      const authToken = config.authToken || config.apiKey;
+      if (!authToken) {
+        console.error(source_default.red("Not authenticated. Run: gal auth login"));
+        process.exit(1);
+      }
+      const apiUrl = config.apiUrl || defaultApiUrl12;
+      const spinner = options.json ? null : ora(`Rejecting policy "${id}"...`).start();
+      try {
+        const res = await fetchWithAuth2(
+          `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies/${encodeURIComponent(id)}`,
+          authToken,
+          "DELETE"
+        );
+        if (!res.ok) {
+          const data2 = await res.json().catch(() => ({}));
+          throw new Error(data2.error || `HTTP ${res.status}`);
+        }
+        const data = await res.json();
+        spinner?.succeed(`Policy "${id}" rejected`);
+        if (options.json) {
+          console.log(
+            JSON.stringify({ ...data, reason: options.reason }, null, 2)
+          );
+        } else {
+          console.log(
+            `  Policy ${source_default.bold(id)} has been ${source_default.red("rejected")}.`
+          );
+          console.log(`  Reason: ${options.reason}`);
+        }
+      } catch (error2) {
+        spinner?.stop();
+        const msg = error2 instanceof Error ? error2.message : String(error2);
+        if (options.json) {
+          console.log(JSON.stringify({ error: msg }));
+        } else {
+          console.error(source_default.red("Error rejecting policy:"), msg);
+        }
+        process.exit(1);
+      }
+    }
+  );
+  command.command("enforcement <id>").description("Update policy enforcement mode (admin only)").requiredOption("--org <org>", "Organization name").requiredOption("--mode <mode>", "Enforcement mode: off, warn, or block").option("--json", "Output as JSON").action(
+    async (id, options) => {
+      const mode = options.mode.toLowerCase();
+      if (!["off", "warn", "block"].includes(mode)) {
+        console.error(
+          source_default.red("Invalid mode. Must be: off, warn, or block")
+        );
+        process.exit(1);
+      }
+      const config = ConfigManager.load();
+      const authToken = config.authToken || config.apiKey;
+      if (!authToken) {
+        console.error(source_default.red("Not authenticated. Run: gal auth login"));
+        process.exit(1);
+      }
+      const apiUrl = config.apiUrl || defaultApiUrl12;
+      const spinner = options.json ? null : ora(`Updating enforcement mode...`).start();
+      try {
+        if (mode === "off") {
+          const res = await fetchWithAuth2(
+            `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies/${encodeURIComponent(id)}`,
+            authToken,
+            "PUT",
+            { enabled: false }
+          );
+          if (!res.ok) {
+            const data2 = await res.json().catch(() => ({}));
+            throw new Error(data2.error || `HTTP ${res.status}`);
+          }
+          const data = await res.json();
+          spinner?.succeed(`Enforcement mode set to ${source_default.gray("off")}`);
+          if (options.json) {
+            console.log(
+              JSON.stringify(
+                { policyId: id, mode: "off", enabled: false },
+                null,
+                2
+              )
+            );
+          } else {
+            console.log(
+              `  Policy ${source_default.bold(id)} enforcement is now ${source_default.gray("off")}.`
+            );
+            console.log(source_default.dim("  The policy will not be enforced."));
+          }
+        } else if (mode === "block") {
+          const res = await fetchWithAuth2(
+            `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies/${encodeURIComponent(id)}/activate`,
+            authToken,
+            "POST"
+          );
+          if (!res.ok) {
+            const data = await res.json().catch(() => ({}));
+            throw new Error(data.error || `HTTP ${res.status}`);
+          }
+          spinner?.succeed(`Enforcement mode set to ${source_default.red("block")}`);
+          if (options.json) {
+            console.log(
+              JSON.stringify(
+                { policyId: id, mode: "block", enabled: true },
+                null,
+                2
+              )
+            );
+          } else {
+            console.log(
+              `  Policy ${source_default.bold(id)} enforcement is now ${source_default.red("block")}.`
+            );
+            console.log(source_default.dim("  Violations will be blocked."));
+          }
+        } else {
+          const res = await fetchWithAuth2(
+            `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies/${encodeURIComponent(id)}`,
+            authToken,
+            "PUT",
+            { enabled: true }
+          );
+          if (!res.ok) {
+            const data = await res.json().catch(() => ({}));
+            throw new Error(data.error || `HTTP ${res.status}`);
+          }
+          spinner?.succeed(`Enforcement mode set to ${source_default.yellow("warn")}`);
+          if (options.json) {
+            console.log(
+              JSON.stringify(
+                { policyId: id, mode: "warn", enabled: true },
+                null,
+                2
+              )
+            );
+          } else {
+            console.log(
+              `  Policy ${source_default.bold(id)} enforcement is now ${source_default.yellow("warn")}.`
+            );
+            console.log(
+              source_default.dim("  Violations will be logged but not blocked.")
+            );
+          }
+        }
+      } catch (error2) {
+        spinner?.stop();
+        const msg = error2 instanceof Error ? error2.message : String(error2);
+        if (options.json) {
+          console.log(JSON.stringify({ error: msg }));
+        } else {
+          console.error(source_default.red("Error updating enforcement mode:"), msg);
+        }
+        process.exit(1);
+      }
+    }
+  );
+  command.command("get <id>").description("Get policy details").requiredOption("--org <org>", "Organization name").option("--json", "Output as JSON").action(async (id, options) => {
+    const config = ConfigManager.load();
+    const authToken = config.authToken || config.apiKey;
+    if (!authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const apiUrl = config.apiUrl || defaultApiUrl12;
+    const spinner = options.json ? null : ora(`Fetching policy "${id}"...`).start();
+    try {
+      const res = await fetchWithAuth2(
+        `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies/${encodeURIComponent(id)}`,
+        authToken
+      );
+      if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(body.error || `HTTP ${res.status}`);
+      }
+      const data = await res.json();
+      spinner?.stop();
+      if (options.json) {
+        console.log(JSON.stringify(data, null, 2));
+      } else {
+        const p = data.policy || data;
+        console.log();
+        console.log(`  ${source_default.bold(p.name)}`);
+        console.log(`  ID:          ${source_default.bold(p.id)}`);
+        console.log(`  Description: ${p.description || "(none)"}`);
+        console.log(
+          `  Active:      ${p.isActive ? source_default.green("yes") : source_default.yellow("no")}`
+        );
+        console.log(
+          `  Built-in:    ${p.isBuiltin ? source_default.cyan("yes") : "no"}`
+        );
+        console.log(`  Created by:  ${p.createdBy || "unknown"}`);
+        console.log(`  Created at:  ${p.createdAt || "N/A"}`);
+        console.log();
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red("Error fetching policy:"), msg);
+      }
+      process.exit(1);
+    }
+  });
+  command.command("approve <id>").description("Approve and activate a policy (admin only)").requiredOption("--org <org>", "Organization name").option("--json", "Output as JSON").action(async (id, options) => {
+    const config = ConfigManager.load();
+    const authToken = config.authToken || config.apiKey;
+    if (!authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const apiUrl = config.apiUrl || defaultApiUrl12;
+    const spinner = options.json ? null : ora(`Approving policy "${id}"...`).start();
+    try {
+      const res = await fetchWithAuth2(
+        `${apiUrl}/organizations/${encodeURIComponent(options.org)}/policies/${encodeURIComponent(id)}/activate`,
+        authToken,
+        "POST"
+      );
+      if (!res.ok) {
+        const data2 = await res.json().catch(() => ({}));
+        throw new Error(data2.error || `HTTP ${res.status}`);
+      }
+      const data = await res.json();
+      spinner?.succeed(`Policy "${id}" approved and activated`);
+      if (options.json) {
+        console.log(JSON.stringify(data, null, 2));
+      } else {
+        console.log(
+          `  Policy ${source_default.bold(id)} has been ${source_default.green("approved and activated")}.`
+        );
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red("Error approving policy:"), msg);
+      }
+      process.exit(1);
+    }
+  });
   return command;
 }
 var defaultApiUrl12, defaultBusinessOpsAgentUrl;
-var init_policy = __esm({
-  "module_423"() {
+var init_policy2 = __esm({
+  "module_425"() {
     "use strict";
     init_esm();
     init_source();
@@ -205975,7 +206886,7 @@ function readDirRecursive(dir, extension) {
 }
 var import_fs41, import_path41, import_os26, import_yaml5;
 var init_config_reader = __esm({
-  "module_424"() {
+  "module_426"() {
     "use strict";
     import_fs41 = require("fs");
     import_path41 = require("path");
@@ -206124,7 +207035,7 @@ function createProposeCommand() {
 }
 var import_fs42, import_path42, import_child_process15;
 var init_propose = __esm({
-  "module_425"() {
+  "module_427"() {
     "use strict";
     init_esm();
     init_source();
@@ -206314,7 +207225,7 @@ function formatWatchStatus(status) {
 }
 var RecursionGuard;
 var init_protect = __esm({
-  "module_426"() {
+  "module_428"() {
     "use strict";
     init_esm();
     init_source();
@@ -206750,7 +207661,7 @@ function formatMinutes(minutes) {
 }
 var fs2, path5, DEFAULT_CONFIG2;
 var init_quality = __esm({
-  "module_427"() {
+  "module_429"() {
     "use strict";
     init_esm();
     init_source();
@@ -207065,7 +207976,7 @@ function createCancelCommand() {
 }
 var import_fs43, defaultApiUrl13, PRIORITY_LABELS, PRIORITY_COLORS, STATUS_COLORS;
 var init_queue_mgmt = __esm({
-  "module_428"() {
+  "module_430"() {
     "use strict";
     init_esm();
     init_source();
@@ -207506,7 +208417,7 @@ function createQueueCommand() {
 }
 var import_fs44, defaultApiUrl14, GH_API_BASE, DEFAULT_TEMPLATE_BY_LABEL, DEFAULT_TEMPLATE;
 var init_queue_seed = __esm({
-  "module_429"() {
+  "module_431"() {
     "use strict";
     init_esm();
     init_source();
@@ -207650,7 +208561,7 @@ function createReportUsageCommand() {
 }
 var defaultApiUrl15, MAX_USAGE_CHUNK_SECONDS;
 var init_report_usage = __esm({
-  "module_430"() {
+  "module_432"() {
     "use strict";
     init_esm();
     init_source();
@@ -207796,7 +208707,7 @@ function substituteArguments(commandBody, args2) {
 }
 var import_fs45, import_path43;
 var init_command_parser = __esm({
-  "module_431"() {
+  "module_433"() {
     "use strict";
     import_fs45 = require("fs");
     import_path43 = require("path");
@@ -208031,7 +208942,7 @@ function parseCommandArguments(args2) {
   return { positional, flags, combined };
 }
 var init_headless_executor = __esm({
-  "module_432"() {
+  "module_434"() {
     "use strict";
     init_command_parser();
   }
@@ -208215,7 +209126,7 @@ Executing command: ${command.name}`));
 }
 var import_os27, import_path44, import_fs46;
 var init_run = __esm({
-  "module_433"() {
+  "module_435"() {
     "use strict";
     init_esm();
     init_source();
@@ -208561,7 +209472,7 @@ function createRunDesignCommand() {
 }
 var import_os28, import_path45, import_fs47, DESIGN_PROJECTS_DIR, ACTIVE_FILE, IMAGE_STATUS_ICON, VIDEO_STATUS_ICON;
 var init_run_design = __esm({
-  "module_434"() {
+  "module_436"() {
     "use strict";
     init_esm();
     init_source();
@@ -208910,7 +209821,7 @@ function createScanCommand() {
 }
 var import_fs48, import_path46, import_os29, GLOBAL_MEMORY_LOCATIONS, PLATFORM_LABELS, PLATFORM_COLORS;
 var init_scan = __esm({
-  "module_435"() {
+  "module_437"() {
     "use strict";
     init_esm();
     init_source();
@@ -209060,7 +209971,7 @@ function listApprovedConfigItems(config, type) {
 }
 var import_node_os16, import_node_path18;
 var init_approved_config_enforcement3 = __esm({
-  "module_436"() {
+  "module_438"() {
     "use strict";
     import_node_os16 = require("node:os");
     import_node_path18 = require("node:path");
@@ -209178,7 +210089,7 @@ function createSandboxProfilesCommand() {
 }
 var import_promises18, import_node_path19;
 var init_sandbox_profiles = __esm({
-  "module_437"() {
+  "module_439"() {
     "use strict";
     init_esm();
     init_source();
@@ -209208,7 +210119,7 @@ function createSandboxService(config) {
 }
 var import_node_module2, import_meta4, sandboxClass, E2BSandboxService;
 var init_e2b_sandbox = __esm({
-  "module_438"() {
+  "module_440"() {
     "use strict";
     import_node_module2 = require("node:module");
     init_source();
@@ -209873,7 +210784,7 @@ async function startInteractiveSession(sandbox) {
 }
 var import_promises19, import_path47;
 var init_sandbox = __esm({
-  "module_439"() {
+  "module_441"() {
     "use strict";
     init_esm();
     init_source();
@@ -210550,7 +211461,7 @@ function createSdlcCommand() {
 }
 var import_fs49, import_path48, import_child_process16, IMPL_EXTENSIONS, IGNORE_DIRS, IGNORE_FILES;
 var init_sdlc = __esm({
-  "module_440"() {
+  "module_442"() {
     "use strict";
     init_esm();
     init_source();
@@ -210661,7 +211572,7 @@ function createSecurityCommand() {
 }
 var defaultApiUrl16;
 var init_security = __esm({
-  "module_441"() {
+  "module_443"() {
     "use strict";
     init_esm();
     init_source();
@@ -210719,7 +211630,7 @@ function removeScrollRegion(write, rows) {
 }
 var ESC, CSI;
 var init_session_status_bar = __esm({
-  "module_442"() {
+  "module_444"() {
     "use strict";
     init_source();
     ESC = "\x1B";
@@ -210780,7 +211691,7 @@ function clearOverlay(write, rows, cols) {
   write(output);
 }
 var init_session_overlay = __esm({
-  "module_443"() {
+  "module_445"() {
     "use strict";
     init_source();
     init_session_status_bar();
@@ -210936,7 +211847,7 @@ async function runSession(cli, args2) {
 }
 var import_fs50, import_path49, CTRL_G;
 var init_session2 = __esm({
-  "module_444"() {
+  "module_446"() {
     "use strict";
     init_esm();
     init_source();
@@ -211324,7 +212235,7 @@ function createStatusCommand3() {
 }
 var import_path50, import_os30, import_fs51, cliVersion6, defaultApiUrl17, PLATFORM_LABELS2, RATE_LIMIT_MS, DRIFT_REPORT_CACHE_PATH;
 var init_status2 = __esm({
-  "module_445"() {
+  "module_447"() {
     "use strict";
     init_esm();
     init_source();
@@ -211500,7 +212411,7 @@ Extracted ${files.length} configuration files.`);
 }
 var fs4, path7, DevEnvironmentTemplates;
 var init_template = __esm({
-  "module_446"() {
+  "module_448"() {
     "use strict";
     init_esm();
     init_source();
@@ -211983,7 +212894,7 @@ async function startComputerUseServer(config = {}) {
 }
 var import_node_child_process10, import_node_path20, import_mcp2, import_stdio4, SERVER_NAME2, SERVER_VERSION2;
 var init_computer_use_server = __esm({
-  "module_447"() {
+  "module_449"() {
     "use strict";
     import_node_child_process10 = require("node:child_process");
     import_node_path20 = require("node:path");
@@ -212018,7 +212929,7 @@ function createComputerUseCommand() {
 }
 var import_path51;
 var init_computer_use = __esm({
-  "module_448"() {
+  "module_450"() {
     "use strict";
     init_esm();
     import_path51 = require("path");
@@ -212454,7 +213365,7 @@ async function startTerminalGalServer(config = {}) {
 }
 var import_child_process17, import_crypto11, import_server3, import_stdio5, import_types26, SpawnBasedProcess, TERMINAL_GAL_TOOLS;
 var init_terminal_gal_server = __esm({
-  "module_449"() {
+  "module_451"() {
     "use strict";
     import_child_process17 = require("child_process");
     import_crypto11 = require("crypto");
@@ -212676,7 +213587,7 @@ function createTerminalCommand() {
 }
 var import_path52;
 var init_terminal = __esm({
-  "module_450"() {
+  "module_452"() {
     "use strict";
     init_esm();
     import_path52 = require("path");
@@ -212807,7 +213718,7 @@ function formatTestResult(result) {
 }
 var GovernanceTestFramework;
 var init_test = __esm({
-  "module_451"() {
+  "module_453"() {
     "use strict";
     init_esm();
     init_source();
@@ -213138,7 +214049,7 @@ function parseDuration(input) {
 }
 var fs5, path8, os5, SESSION_FILE, TimeTracker, WorkflowRulesEngine, ComplianceTracker;
 var init_time = __esm({
-  "module_452"() {
+  "module_454"() {
     "use strict";
     init_esm();
     init_source();
@@ -213259,7 +214170,7 @@ var init_time = __esm({
 });
 var init_types7 = __esm({
-  "module_453"() {
+  "module_455"() {
     "use strict";
   }
 });
@@ -213272,7 +214183,7 @@ function getDefaultRegistry() {
 }
 var import_events, import_crypto12, DEFAULT_CONFIG3, TriggerRegistry, defaultRegistry;
 var init_triggers = __esm({
-  "module_454"() {
+  "module_456"() {
     "use strict";
     import_events = require("events");
     import_crypto12 = require("crypto");
@@ -213624,7 +214535,7 @@ function getGitHookManager() {
 }
 var import_child_process18, import_fs52, import_path53, DEFAULT_GIT_HOOK_CONFIG, GitHookManager, defaultManager;
 var init_git_hooks = __esm({
-  "module_455"() {
+  "module_457"() {
     "use strict";
     import_child_process18 = require("child_process");
     import_fs52 = require("fs");
@@ -213996,7 +214907,7 @@ function getFileWatcher() {
 }
 var import_fs53, import_path54, DEFAULT_FILE_WATCHER_CONFIG, AGENT_CONFIG_PATTERNS, FileWatcher, defaultWatcher;
 var init_file_watcher = __esm({
-  "module_456"() {
+  "module_458"() {
     "use strict";
     import_fs53 = require("fs");
     import_path54 = require("path");
@@ -214598,7 +215509,7 @@ Recent Events (${events.length}):
   return command;
 }
 var init_trigger = __esm({
-  "module_457"() {
+  "module_459"() {
     "use strict";
     init_esm();
     init_source();
@@ -215061,7 +215972,7 @@ function createUninstallCommand() {
 }
 var import_fs54, import_path55, import_os31, import_readline5;
 var init_uninstall = __esm({
-  "module_458"() {
+  "module_460"() {
     "use strict";
     init_esm();
     init_source();
@@ -215286,7 +216197,7 @@ function detectPlatforms2(projectPath2) {
 }
 var fs6, path9, SUPPORTED_PLATFORMS, UNIVERSAL_COMMANDS;
 var init_universal = __esm({
-  "module_459"() {
+  "module_461"() {
     "use strict";
     init_esm();
     init_source();
@@ -215708,7 +216619,7 @@ Retry manually with: ${source_default.cyan(installCommand)}`);
 }
 var import_https, import_child_process19, import_fs55, import_path56, import_os32, UPDATE_LOCK_FILE, cliVersion7, REGISTRY_URL;
 var init_update = __esm({
-  "module_460"() {
+  "module_462"() {
     "use strict";
     init_esm();
     init_source();
@@ -216316,7 +217227,7 @@ async function batchEmbedContents(apiKey, model, params, requestOptions) {
 }
 var SchemaType, ExecutableCodeLanguage, Outcome, POSSIBLE_ROLES, HarmCategory, HarmBlockThreshold, HarmProbability, BlockReason, FinishReason, TaskType, FunctionCallingMode, DynamicRetrievalMode, GoogleGenerativeAIError, GoogleGenerativeAIResponseError, GoogleGenerativeAIFetchError, GoogleGenerativeAIRequestInputError, GoogleGenerativeAIAbortError, DEFAULT_BASE_URL, DEFAULT_API_VERSION, PACKAGE_VERSION, PACKAGE_LOG_HEADER, Task, RequestUrl, badFinishReasons, responseLineRE, VALID_PART_FIELDS, VALID_PARTS_PER_ROLE, SILENT_ERROR, ChatSession, GenerativeModel, GoogleGenerativeAI;
 var init_dist6 = __esm({
-  "module_461"() {
+  "module_463"() {
     (function(SchemaType2) {
       SchemaType2["STRING"] = "string";
       SchemaType2["NUMBER"] = "number";
@@ -217544,7 +218455,7 @@ function dataUriToBuffer(uri) {
 }
 var dist_default;
 var init_dist7 = __esm({
-  "module_462"() {
+  "module_464"() {
     dist_default = dataUriToBuffer;
   }
 });
@@ -221824,7 +222735,7 @@ var require_ponyfill_es2018 = __commonJS({
 });
 var require_streams2 = __commonJS({
-  "module_463"() {
+  "module_465"() {
     var POOL_SIZE2 = 65536;
     if (!globalThis.ReadableStream) {
       try {
@@ -221904,7 +222815,7 @@ async function* toIterator(parts, clone2 = true) {
 }
 var import_streams, POOL_SIZE, _Blob, Blob3, fetch_blob_default;
 var init_fetch_blob = __esm({
-  "module_464"() {
+  "module_466"() {
     import_streams = __toESM(require_streams2(), 1);
     POOL_SIZE = 65536;
     _Blob = class Blob2 {
@@ -222073,7 +222984,7 @@ var init_fetch_blob = __esm({
 var _File, File3, file_default;
 var init_file = __esm({
-  "module_465"() {
+  "module_467"() {
     init_fetch_blob();
     _File = class File2 extends fetch_blob_default {
       #lastModified = 0;
@@ -222129,7 +223040,7 @@ Content-Type: ${v.type || "application/octet-stream"}\r
 }
 var t, i, h, r, m, f, e, x, FormData2;
 var init_esm_min = __esm({
-  "module_466"() {
+  "module_468"() {
     init_fetch_blob();
     init_file();
     ({ toStringTag: t, iterator: i, hasInstance: h } = Symbol);
@@ -222212,7 +223123,7 @@ var init_esm_min = __esm({
 var FetchBaseError;
 var init_base2 = __esm({
-  "module_467"() {
+  "module_469"() {
     FetchBaseError = class extends Error {
       constructor(message, type) {
         super(message);
@@ -222231,7 +223142,7 @@ var init_base2 = __esm({
 var FetchError;
 var init_fetch_error = __esm({
-  "module_468"() {
+  "module_470"() {
     init_base2();
     FetchError = class extends FetchBaseError {
       /**
@@ -222252,7 +223163,7 @@ var init_fetch_error = __esm({
 var NAME, isURLSearchParameters, isBlob, isAbortSignal, isDomainOrSubdomain, isSameProtocol;
 var init_is = __esm({
-  "module_469"() {
+  "module_471"() {
     NAME = Symbol.toStringTag;
     isURLSearchParameters = (object) => {
       return typeof object === "object" && typeof object.append === "function" && typeof object.delete === "function" && typeof object.get === "function" && typeof object.getAll === "function" && typeof object.has === "function" && typeof object.set === "function" && typeof object.sort === "function" && object[NAME] === "URLSearchParams";
@@ -222292,7 +223203,7 @@ var require_node_domexception = __commonJS({
 var import_node_fs10, import_node_path21, import_node_domexception, stat6, blobFromSync, blobFrom, fileFrom, fileFromSync, fromBlob, fromFile, BlobDataItem;
 var init_from = __esm({
-  "module_470"() {
+  "module_472"() {
     import_node_fs10 = require("node:fs");
     import_node_path21 = require("node:path");
     import_node_domexception = __toESM(require_node_domexception(), 1);
@@ -222446,7 +223357,7 @@ async function toFormData(Body2, ct) {
 }
 var s, S, f2, F, LF, CR, SPACE, HYPHEN, COLON, A, Z, lower, noop, MultipartParser;
 var init_multipart_parser = __esm({
-  "module_471"() {
+  "module_473"() {
     init_from();
     init_esm_min();
     s = 0;
@@ -222760,7 +223671,7 @@ async function consumeBody(data) {
 }
 var import_node_stream, import_node_util3, import_node_buffer, pipeline3, INTERNALS, Body, clone, getNonSpecFormDataBoundary, extractContentType, getTotalBytes, writeToStream;
 var init_body = __esm({
-  "module_472"() {
+  "module_474"() {
     import_node_stream = __toESM(require("node:stream"), 1);
     import_node_util3 = require("node:util");
     import_node_buffer = require("node:buffer");
@@ -222991,7 +223902,7 @@ function fromRawHeaders(headers = []) {
 }
 var import_node_util4, import_node_http, validateHeaderName, validateHeaderValue, Headers2;
 var init_headers = __esm({
-  "module_473"() {
+  "module_475"() {
     import_node_util4 = require("node:util");
     import_node_http = __toESM(require("node:http"), 1);
     validateHeaderName = typeof import_node_http.default.validateHeaderName === "function" ? import_node_http.default.validateHeaderName : (name) => {
@@ -223163,7 +224074,7 @@ var init_headers = __esm({
 var redirectStatus, isRedirect;
 var init_is_redirect = __esm({
-  "module_474"() {
+  "module_476"() {
     redirectStatus = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
     isRedirect = (code) => {
       return redirectStatus.has(code);
@@ -223173,7 +224084,7 @@ var init_is_redirect = __esm({
 var INTERNALS2, Response2;
 var init_response = __esm({
-  "module_475"() {
+  "module_477"() {
     init_headers();
     init_body();
     init_is_redirect();
@@ -223298,7 +224209,7 @@ var init_response = __esm({
 var getSearch;
 var init_get_search = __esm({
-  "module_476"() {
+  "module_478"() {
     getSearch = (parsedURL) => {
       if (parsedURL.search) {
         return parsedURL.search;
@@ -223437,7 +224348,7 @@ function parseReferrerPolicyFromHeader(headers) {
 }
 var import_node_net, ReferrerPolicy, DEFAULT_REFERRER_POLICY;
 var init_referrer = __esm({
-  "module_477"() {
+  "module_479"() {
     import_node_net = require("node:net");
     ReferrerPolicy = /* @__PURE__ */ new Set([
       "",
@@ -223456,7 +224367,7 @@ var init_referrer = __esm({
 var import_node_url2, import_node_util5, INTERNALS3, isRequest, doBadDataWarn, Request, getNodeRequestOptions;
 var init_request = __esm({
-  "module_478"() {
+  "module_480"() {
     import_node_url2 = require("node:url");
     import_node_util5 = require("node:util");
     init_headers();
@@ -223660,7 +224571,7 @@ var init_request = __esm({
 var AbortError;
 var init_abort_error = __esm({
-  "module_479"() {
+  "module_481"() {
     init_base2();
     AbortError = class extends FetchBaseError {
       constructor(message, type = "aborted") {
@@ -223950,7 +224861,7 @@ function fixResponseChunkedTransferBadEnding(request, errorCallback) {
 }
 var import_node_http2, import_node_https3, import_node_zlib, import_node_stream2, import_node_buffer2, supportedSchemas;
 var init_src5 = __esm({
-  "module_480"() {
+  "module_482"() {
     import_node_http2 = __toESM(require("node:http"), 1);
     import_node_https3 = __toESM(require("node:https"), 1);
     import_node_zlib = __toESM(require("node:zlib"), 1);
@@ -238471,7 +239382,7 @@ async function startVisionGalServer(options = {}) {
 }
 var import_node_fs11, import_node_path22, import_vertexai, import_mcp3, import_stdio6, SERVER_NAME3, SERVER_VERSION3, MAX_VIDEO_SIZE_MB;
 var init_vision_gal_server = __esm({
-  "module_481"() {
+  "module_483"() {
     "use strict";
     import_node_fs11 = require("node:fs");
     import_node_path22 = require("node:path");
@@ -238502,7 +239413,7 @@ function createVisionCommand() {
 }
 var import_path57;
 var init_vision = __esm({
-  "module_482"() {
+  "module_484"() {
     "use strict";
     init_esm();
     import_path57 = require("path");
@@ -238881,7 +239792,7 @@ async function startVscodeGalServer(config = {}) {
 }
 var import_child_process20, import_fs56, import_path58, import_os33, import_server4, import_stdio7, import_types27, VSCODE_GAL_TOOLS;
 var init_vscode_gal_server = __esm({
-  "module_483"() {
+  "module_485"() {
     "use strict";
     import_child_process20 = require("child_process");
     import_fs56 = require("fs");
@@ -238999,7 +239910,7 @@ function createVscodeCommand() {
 }
 var import_path59;
 var init_vscode = __esm({
-  "module_484"() {
+  "module_486"() {
     "use strict";
     init_esm();
     import_path59 = require("path");
@@ -239475,7 +240386,7 @@ ${source_default.dim(`Claim: gal work claim ${item.id.slice(0, 8)}`)}`);
 }
 var defaultApiUrl18, PRIORITY_COLORS2, STATUS_COLORS2;
 var init_work = __esm({
-  "module_485"() {
+  "module_487"() {
     "use strict";
     init_esm();
     init_source();
@@ -239676,7 +240587,7 @@ function displayTestResult(result) {
 }
 var import_promises20, import_path60, defaultApiUrl19;
 var init_workflow2 = __esm({
-  "module_486"() {
+  "module_488"() {
     "use strict";
     init_esm();
     init_source();
@@ -239863,7 +240774,7 @@ function createWorkspaceCommand() {
   return command;
 }
 var init_workspace6 = __esm({
-  "module_487"() {
+  "module_489"() {
     "use strict";
     init_esm();
     init_source();
@@ -239873,7 +240784,7 @@ var init_workspace6 = __esm({
 var COMMAND_FACTORIES;
 var init_command_registry = __esm({
-  "module_488"() {
+  "module_490"() {
     "use strict";
     init_admin();
     init_agent();
@@ -239906,7 +240817,7 @@ var init_command_registry = __esm({
     init_mcp();
     init_memory2();
     init_ops();
-    init_policy();
+    init_policy2();
     init_propose();
     init_protect();
     init_quality();
@@ -240013,7 +240924,7 @@ function printBranding() {
 }
 var cliVersion8;
 var init_branding = __esm({
-  "module_489"() {
+  "module_491"() {
     "use strict";
     init_source();
     init_constants();
@@ -240422,7 +241333,7 @@ function getRequestedCommand(argv) {
 }
 var import_dotenv, import_https2, import_readline6, import_child_process21, import_fs57, import_path61, import_os34, originalEmit, cliVersion9, isHiddenMcpEntrypoint, isHookEntrypoint, isMachineReadableEntrypoint, fatalErrorHandled, UPDATE_CACHE_DIR, UPDATE_CACHE_FILE, ONE_DAY, REGISTRY_URL2, REGISTRY_HOST, sessionStartTime, isReadOnlyStatusCommand, isMachineMode, exitHooksRan, featureFlags, knownCommands, isKnownCommand, program2, allInternalFlags;
 var init_index = __esm({
-  "module_490"() {
+  "module_492"() {
     "use strict";
     init_esm();
     import_dotenv = __toESM(require_main(), 1);
@@ -240649,7 +241560,7 @@ var init_index = __esm({
   }
 });
-var cliVersion10 = true ? "0.0.668" : "0.0.0-dev";
+var cliVersion10 = true ? "0.0.674" : "0.0.0-dev";
 var args = process.argv.slice(2);
 var requestedGlobalHelp = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
 var requestedVersion = args.length === 1 && (args[0] === "--version" || args[0] === "-V");