@skill-map/cli 0.50.1 → 0.52.0

package/dist/index.js

@@ -1,6 +1,6 @@
 // kernel/i18n/registry.texts.ts
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="66c91062-e32c-5685-861d-a744103465f8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e78e8b63-f577-5c6a-9522-9187b69e1ed7")}catch(e){}}();
 var REGISTRY_TEXTS = {
   duplicateExtension: "Extension already registered: {{kind}}:{{qualifiedId}}",
   unknownKind: "Unknown extension kind: {{kind}}",
@@ -95,14 +95,14 @@ var Registry = class {
 };
 
 // kernel/orchestrator/index.ts
-import { existsSync as existsSync11, statSync as statSync4 } from "fs";
-import { isAbsolute as isAbsolute4, resolve as resolve11 } from "path";
+import { existsSync as existsSync10, statSync as statSync4 } from "fs";
+import { isAbsolute as isAbsolute3, resolve as resolve9 } from "path";
 import { Tiktoken as Tiktoken2 } from "js-tiktoken/lite";
 
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.50.1",
+  version: "0.52.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -698,364 +698,9 @@ var ORCHESTRATOR_TEXTS = {
   runScanRootMissing: "runScan: root path '{{root}}' does not exist or is not a directory"
 };
 
-// core/config/active-provider.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join6 } from "path";
-
-// core/config/helper.ts
-import { homedir as osHomedir } from "os";
-import { isAbsolute as isAbsolute2, join as join5, resolve as resolve6, sep } from "path";
-
-// kernel/config/loader.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
-
-// kernel/i18n/config-loader.texts.ts
-var CONFIG_LOADER_TEXTS = {
-  readFailure: "[config:{{layer}}] failed to read {{path}}: {{message}}",
-  invalidJson: "[config:{{layer}}] invalid JSON in {{path}}: {{message}}",
-  expectedObject: "[config:{{layer}}] expected a JSON object, got {{type}}; ignored",
-  unknownKey: "[config:{{layer}}] unknown key {{key}} ignored",
-  invalidValue: "[config:{{layer}}] invalid value at {{path}}: {{message}}",
-  projectLocalOnlyStripped: "[config:{{layer}}] key {{key}} is project-local only; stripped from the committed project layer. Move it to .skill-map/settings.local.json (gitignored, per-checkout)."
-};
-
-// kernel/util/skill-map-paths.ts
-import { join as join4 } from "path";
-
-// core/paths/db-path.ts
-import { join as join3, resolve as resolve5 } from "path";
-var SKILL_MAP_DIR = ".skill-map";
-var DB_FILENAME = "skill-map.db";
-var LOCAL_SETTINGS_FILENAME = "settings.local.json";
-var DEFAULT_DB_REL = `${SKILL_MAP_DIR}/${DB_FILENAME}`;
-var GITIGNORE_ENTRIES = [
-  `${SKILL_MAP_DIR}/${LOCAL_SETTINGS_FILENAME}`,
-  `${SKILL_MAP_DIR}/${DB_FILENAME}`
-];
-
-// kernel/util/skill-map-paths.ts
-var KERNEL_SKILL_MAP_DIR = SKILL_MAP_DIR;
-var SETTINGS_FILENAME = "settings.json";
-var LOCAL_SETTINGS_FILENAME2 = "settings.local.json";
-function kernelSettingsPath(scopeRoot) {
-  return join4(scopeRoot, KERNEL_SKILL_MAP_DIR, SETTINGS_FILENAME);
-}
-function kernelLocalSettingsPath(scopeRoot) {
-  return join4(scopeRoot, KERNEL_SKILL_MAP_DIR, LOCAL_SETTINGS_FILENAME2);
-}
-
-// kernel/util/strip-prototype-pollution.ts
-var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-function stripPrototypePollution(value) {
-  return strip(value);
-}
-function strip(value) {
-  if (value === null || value === void 0) return value;
-  if (typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map(strip);
-  const out = {};
-  for (const [k, v] of Object.entries(value)) {
-    if (FORBIDDEN_KEYS.has(k)) continue;
-    out[k] = strip(v);
-  }
-  return out;
-}
-
-// config/defaults.json
-var defaults_default = {
-  schemaVersion: 1,
-  allowEditSmFiles: false,
-  tokenizer: "cl100k_base",
-  roots: [],
-  ignore: [],
-  scan: {
-    tokenize: true,
-    strict: false,
-    maxFileSizeBytes: 1048576,
-    maxNodes: 256,
-    watch: {
-      debounceMs: 300
-    },
-    referencePaths: []
-  },
-  plugins: {},
-  jobs: {
-    ttlSeconds: 3600,
-    graceMultiplier: 3,
-    minimumTtlSeconds: 60,
-    perActionTtl: {},
-    perActionPriority: {},
-    retention: {
-      completed: 2592e3,
-      failed: null
-    }
-  }
-};
-
-// kernel/config/loader.ts
-var PROJECT_LOCAL_ONLY_KEYS = /* @__PURE__ */ new Set([
-  "allowEditSmFiles",
-  "scan.referencePaths"
-]);
-var DEFAULTS = defaults_default;
-function loadConfig(opts) {
-  const cwd = opts.cwd;
-  const strict = opts.strict ?? false;
-  const warnings = [];
-  const sources = /* @__PURE__ */ new Map();
-  const validators = loadSchemaValidators();
-  let effective = structuredClone(DEFAULTS);
-  recordSources("", effective, sources, "defaults");
-  const filePairs = [
-    { path: kernelSettingsPath(cwd), layer: "project" },
-    { path: kernelLocalSettingsPath(cwd), layer: "project-local" }
-  ];
-  for (const { path, layer } of filePairs) {
-    if (!existsSync3(path)) continue;
-    const partial = readJsonSafe(path, layer, warnings, strict);
-    if (partial === null) continue;
-    const cleaned = validateAndStrip(validators, partial, layer, warnings, strict);
-    if (layer !== "project-local") {
-      stripProjectLocalOnlyKeys(cleaned, layer, warnings, strict);
-    }
-    effective = deepMerge(effective, cleaned);
-    recordSources("", cleaned, sources, layer);
-  }
-  if (opts.overrides && Object.keys(opts.overrides).length > 0) {
-    const cleaned = validateAndStrip(validators, opts.overrides, "override", warnings, strict);
-    stripProjectLocalOnlyKeys(cleaned, "override", warnings, strict);
-    effective = deepMerge(effective, cleaned);
-    recordSources("", cleaned, sources, "override");
-  }
-  return { effective, sources, warnings };
-}
-function readJsonSafe(path, layer, warnings, strict) {
-  let text;
-  try {
-    text = readFileSync5(path, "utf8");
-  } catch (err) {
-    return reportAndSkip(
-      tx(CONFIG_LOADER_TEXTS.readFailure, { layer, path, message: formatErrorMessage(err) }),
-      warnings,
-      strict
-    );
-  }
-  try {
-    return JSON.parse(text);
-  } catch (err) {
-    return reportAndSkip(
-      tx(CONFIG_LOADER_TEXTS.invalidJson, { layer, path, message: formatErrorMessage(err) }),
-      warnings,
-      strict
-    );
-  }
-}
-function reportAndSkip(msg, warnings, strict) {
-  if (strict) throw new Error(msg);
-  warnings.push(msg);
-  return null;
-}
-function validateAndStrip(validators, raw, layer, warnings, strict) {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-    const msg = tx(CONFIG_LOADER_TEXTS.expectedObject, { layer, type: describeJsonType(raw) });
-    if (strict) throw new Error(msg);
-    warnings.push(msg);
-    return {};
-  }
-  const cloned = structuredClone(raw);
-  const validator = validators.getValidator("project-config");
-  if (validator(cloned)) return cloned;
-  for (const err of validator.errors ?? []) {
-    applyValidationError(cloned, err, layer, warnings, strict);
-  }
-  return cloned;
-}
-function applyValidationError(cloned, err, layer, warnings, strict) {
-  const path = err.instancePath ?? "";
-  if (err.keyword === "additionalProperties") {
-    const extra = err.params.additionalProperty;
-    deleteAtPath(cloned, path, extra);
-    const msg2 = tx(CONFIG_LOADER_TEXTS.unknownKey, { layer, key: joinSegments(path, extra) });
-    if (strict) throw new Error(msg2);
-    warnings.push(msg2);
-    return;
-  }
-  const segments = path.split("/").filter(Boolean);
-  if (segments.length > 0) {
-    const last = segments.pop();
-    deleteAtPath(cloned, "/" + segments.join("/"), last);
-  }
-  const msg = tx(CONFIG_LOADER_TEXTS.invalidValue, {
-    layer,
-    path: path || "(root)",
-    message: err.message ?? err.keyword
-  });
-  if (strict) throw new Error(msg);
-  warnings.push(msg);
-}
-function describeJsonType(v) {
-  if (v === null) return "null";
-  if (Array.isArray(v)) return "array";
-  return typeof v;
-}
-function deleteAtPath(root, parentPath, key) {
-  if (containsForbidden(parentPath, key)) return;
-  const segments = parentPath.split("/").filter(Boolean);
-  let cur = root;
-  for (const seg of segments) {
-    if (!isPlainObject(cur)) return;
-    cur = cur[seg];
-  }
-  if (isPlainObject(cur)) delete cur[key];
-}
-function stripProjectLocalOnlyKeys(cloned, layer, warnings, strict) {
-  for (const dotKey of PROJECT_LOCAL_ONLY_KEYS) {
-    const segments = dotKey.split(".").filter(Boolean);
-    if (segments.length === 0) continue;
-    const leaf = segments.pop();
-    if (!keyPresentAtPath(cloned, segments, leaf)) continue;
-    const parentPath = "/" + segments.join("/");
-    deleteAtPath(cloned, parentPath, leaf);
-    const msg = tx(CONFIG_LOADER_TEXTS.projectLocalOnlyStripped, {
-      layer,
-      key: dotKey
-    });
-    if (strict) throw new Error(msg);
-    warnings.push(msg);
-  }
-}
-function keyPresentAtPath(root, parentSegments, leaf) {
-  let cur = root;
-  for (const seg of parentSegments) {
-    if (!isPlainObject(cur)) return false;
-    cur = cur[seg];
-  }
-  return isPlainObject(cur) && Object.prototype.hasOwnProperty.call(cur, leaf);
-}
-function isPlainObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function containsForbidden(parentPath, leaf) {
-  if (FORBIDDEN_KEYS.has(leaf)) return true;
-  for (const seg of parentPath.split("/")) {
-    if (FORBIDDEN_KEYS.has(seg)) return true;
-  }
-  return false;
-}
-function joinSegments(instancePath, leaf) {
-  const segments = instancePath.split("/").filter(Boolean);
-  return [...segments, leaf].join(".");
-}
-function deepMerge(target, source) {
-  const out = { ...target };
-  for (const [k, v] of Object.entries(source)) {
-    if (FORBIDDEN_KEYS.has(k)) continue;
-    out[k] = mergeValue(out[k], v);
-  }
-  return out;
-}
-function mergeValue(target, source) {
-  if (source === null || typeof source !== "object" || Array.isArray(source)) {
-    return source;
-  }
-  const targetSlot = target !== null && typeof target === "object" && !Array.isArray(target) ? target : {};
-  return deepMerge(targetSlot, source);
-}
-function recordSources(prefix, value, map, layer) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    if (prefix) map.set(prefix, layer);
-    return;
-  }
-  const entries = Object.entries(value);
-  if (entries.length === 0 && prefix) {
-    map.set(prefix, layer);
-    return;
-  }
-  for (const [k, v] of entries) {
-    const next = prefix ? `${prefix}.${k}` : k;
-    recordSources(next, v, map, layer);
-  }
-}
-
-// core/config/dot-path.ts
-var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-var ForbiddenSegmentError = class extends Error {
-  constructor(segment, key) {
-    super(`forbidden config key segment "${segment}" in "${key}"`);
-    this.segment = segment;
-    this.key = key;
-  }
-  segment;
-  key;
-};
-function assertSafeSegments(segments, key) {
-  for (const seg of segments) {
-    if (FORBIDDEN_SEGMENTS.has(seg)) throw new ForbiddenSegmentError(seg, key);
-  }
-}
-function getAtPath(obj, dotPath) {
-  const segments = dotPath.split(".").filter(Boolean);
-  assertSafeSegments(segments, dotPath);
-  let cur = obj;
-  for (const seg of segments) {
-    if (cur && typeof cur === "object" && !Array.isArray(cur)) {
-      cur = cur[seg];
-      continue;
-    }
-    return void 0;
-  }
-  return cur;
-}
-
-// core/config/atomic-write.ts
-import {
-  closeSync,
-  constants as fsConstants,
-  existsSync as existsSync4,
-  mkdirSync,
-  openSync,
-  readFileSync as readFileSync6,
-  renameSync,
-  unlinkSync,
-  writeSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { dirname as dirname3 } from "path";
-
-// core/config/helper.ts
-function readConfigValue(key, opts) {
-  const loaded = loadConfigForScope(opts);
-  const value = getAtPath(loaded.effective, key);
-  if (value === void 0) return opts.default;
-  return value;
-}
-function loadConfigForScope(opts) {
-  return loadConfig({
-    cwd: opts.cwd,
-    ...opts.strict ? { strict: true } : {}
-  });
-}
-
-// core/config/active-provider.ts
-function resolveActiveProvider(cwd, providers = []) {
-  const detected = detectProvidersFromFilesystem(cwd, providers);
-  const fromConfig = readConfigValue("activeProvider", { cwd });
-  if (typeof fromConfig === "string" && fromConfig.length > 0) {
-    return { resolved: fromConfig, source: "config", detected };
-  }
-  if (detected.length > 0) {
-    return { resolved: detected[0], source: "autodetect", detected };
-  }
-  return { resolved: null, source: "none", detected };
-}
+// kernel/scan/detect-providers.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
 function detectProvidersFromFilesystem(cwd, providers) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -1063,7 +708,7 @@ function detectProvidersFromFilesystem(cwd, providers) {
     if (seen.has(provider.id)) continue;
     const markers = provider.detect?.markers;
     if (!markers || markers.length === 0) continue;
-    if (!markers.some((marker) => existsSync5(join6(cwd, marker)))) continue;
+    if (!markers.some((marker) => existsSync3(join3(cwd, marker)))) continue;
     seen.add(provider.id);
     out.push(provider.id);
   }
@@ -1801,7 +1446,7 @@ function liftResolvedLinkConfidence(links, nodes, ctx) {
   const indexes = buildIndexes(nodes, ctx);
   for (const link of links) {
     if (link.confidence >= 1) continue;
-    const resolution = resolve7(link, indexes, ctx);
+    const resolution = resolve5(link, indexes, ctx);
     if (resolution === "none") continue;
     link.confidence = ctx.reservedNodePaths.has(resolution) ? RESERVED_TARGET_CONFIDENCE : 1;
     link.resolvedTarget = resolution;
@@ -1818,7 +1463,7 @@ function buildIndexes(nodes, ctx) {
   }
   return { byPath: byPath2, byName, nodeByPath };
 }
-function resolve7(link, indexes, ctx) {
+function resolve5(link, indexes, ctx) {
   if (indexes.byPath.has(link.target)) return link.target;
   return resolveByName(link, indexes, ctx);
 }
@@ -2202,11 +1847,11 @@ function detectRenamesAndOrphans(prior, current, issues, silenced) {
 
 // kernel/scan/walk-content.ts
 import { readFile, readdir, lstat } from "fs/promises";
-import { join as join7, relative as relative2, sep as sep2 } from "path";
+import { join as join4, relative as relative2, sep } from "path";
 
 // kernel/scan/ignore.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname4, resolve as resolve8 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname3, resolve as resolve6 } from "path";
 import { fileURLToPath } from "url";
 import ignoreFactory from "ignore";
 function buildIgnoreFilter(opts = {}) {
@@ -2238,18 +1883,18 @@ function loadDefaultsText() {
   return cachedDefaults;
 }
 function readDefaultsFromDisk() {
-  const here = dirname4(fileURLToPath(import.meta.url));
+  const here = dirname3(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve8(here, "../../config/defaults/skillmapignore"),
+    resolve6(here, "../../config/defaults/skillmapignore"),
     // src/kernel/scan/ → src/config/defaults/
-    resolve8(here, "../config/defaults/skillmapignore"),
+    resolve6(here, "../config/defaults/skillmapignore"),
     // dist/cli.js → dist/config/defaults/ (siblings)
-    resolve8(here, "config/defaults/skillmapignore")
+    resolve6(here, "config/defaults/skillmapignore")
   ];
   for (const candidate of candidates) {
-    if (existsSync6(candidate)) {
+    if (existsSync4(candidate)) {
       try {
-        return readFileSync7(candidate, "utf8");
+        return readFileSync5(candidate, "utf8");
       } catch {
       }
     }
@@ -2259,6 +1904,29 @@ function readDefaultsFromDisk() {
 
 // plugins/core/parsers/frontmatter-yaml/index.ts
 import yaml from "js-yaml";
+
+// kernel/util/strip-prototype-pollution.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function stripPrototypePollution(value) {
+  return strip(value);
+}
+function strip(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(strip);
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (FORBIDDEN_KEYS.has(k)) continue;
+    out[k] = strip(v);
+  }
+  return out;
+}
+
+// plugins/core/parsers/frontmatter-yaml/index.ts
 var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
 var frontmatterYamlParser = {
   id: "frontmatter-yaml",
@@ -2360,7 +2028,7 @@ async function* walkContent(roots, options) {
   const sizeLimit = buildSizeLimit(options);
   for (const root of roots) {
     for await (const file of walkRoot(root, root, filter, extensions, sizeLimit)) {
-      const relPath = relative2(root, file).split(sep2).join("/");
+      const relPath = relative2(root, file).split(sep).join("/");
       let raw;
       try {
         raw = await readFile(file, "utf8");
@@ -2399,8 +2067,8 @@ async function* walkRoot(root, current, filter, extensions, sizeLimit) {
   }
   for (const entry of entries) {
     const name = entry.name;
-    const full = join7(current, name);
-    const rel = relative2(root, full).split(sep2).join("/");
+    const full = join4(current, name);
+    const rel = relative2(root, full).split(sep).join("/");
     if (filter.ignores(rel)) continue;
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
@@ -2452,19 +2120,19 @@ function resolveProviderWalk(provider) {
 }
 
 // kernel/sidecar/parse.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname5, resolve as resolve9 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { dirname as dirname4, resolve as resolve7 } from "path";
 import { createRequire as createRequire3 } from "module";
 import { Ajv2020 as Ajv20204 } from "ajv/dist/2020.js";
 import yaml2 from "js-yaml";
 function readSidecarFor(mdAbsolutePath) {
   const sidecarPath = sidecarPathFor(mdAbsolutePath);
-  if (!existsSync7(sidecarPath)) {
+  if (!existsSync5(sidecarPath)) {
     return { parsed: null, present: false, issues: [] };
   }
   let raw;
   try {
-    raw = readFileSync8(sidecarPath, "utf8");
+    raw = readFileSync6(sidecarPath, "utf8");
   } catch (err) {
     return {
       parsed: null,
@@ -2483,7 +2151,7 @@ function readSidecarFor(mdAbsolutePath) {
     };
   }
   parsedYaml = stripPrototypePollution(parsedYaml);
-  if (!isPlainObject2(parsedYaml)) {
+  if (!isPlainObject(parsedYaml)) {
     return {
       parsed: null,
       present: true,
@@ -2502,7 +2170,7 @@ function readSidecarFor(mdAbsolutePath) {
   const root = parsedYaml;
   const identityBlock = root["identity"];
   const annotationsRaw = root["annotations"];
-  const annotations = isPlainObject2(annotationsRaw) ? Object.keys(annotationsRaw).length === 0 ? null : annotationsRaw : null;
+  const annotations = isPlainObject(annotationsRaw) ? Object.keys(annotationsRaw).length === 0 ? null : annotationsRaw : null;
   return {
     parsed: {
       filePath: sidecarPath,
@@ -2522,7 +2190,7 @@ function sidecarPathFor(mdAbsolutePath) {
   }
   return `${mdAbsolutePath}.sm`;
 }
-function isPlainObject2(value) {
+function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 var cachedSidecarValidator = null;
@@ -2532,10 +2200,10 @@ function getSidecarValidator() {
   applyAjvFormats(ajv);
   const specRoot = resolveSpecRoot2();
   const annotationsSchema = JSON.parse(
-    readFileSync8(resolve9(specRoot, "schemas/annotations.schema.json"), "utf8")
+    readFileSync6(resolve7(specRoot, "schemas/annotations.schema.json"), "utf8")
   );
   const sidecarSchema = JSON.parse(
-    readFileSync8(resolve9(specRoot, "schemas/sidecar.schema.json"), "utf8")
+    readFileSync6(resolve7(specRoot, "schemas/sidecar.schema.json"), "utf8")
   );
   ajv.addSchema(annotationsSchema);
   cachedSidecarValidator = ajv.compile(sidecarSchema);
@@ -2545,7 +2213,7 @@ function resolveSpecRoot2() {
   const require2 = createRequire3(import.meta.url);
   try {
     const indexPath = require2.resolve("@skill-map/spec/index.json");
-    return dirname5(indexPath);
+    return dirname4(indexPath);
   } catch {
     throw new Error(
       "@skill-map/spec not resolvable: sidecar reader cannot load schemas."
@@ -2564,8 +2232,8 @@ function computeDriftStatus(args) {
 }
 
 // kernel/sidecar/discover-orphans.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { join as join8, relative as relative3, sep as sep3 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { join as join5, relative as relative3, sep as sep2 } from "path";
 function discoverOrphanSidecars(roots, shouldSkip) {
   const out = [];
   for (const root of roots) {
@@ -2581,8 +2249,8 @@ function walk(root, current, shouldSkip, out) {
     return;
   }
   for (const entry of entries) {
-    const full = join8(current, entry.name);
-    const rel = relative3(root, full).split(sep3).join("/");
+    const full = join5(current, entry.name);
+    const rel = relative3(root, full).split(sep2).join("/");
     if (shouldSkip(rel)) continue;
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
@@ -2592,7 +2260,7 @@ function walk(root, current, shouldSkip, out) {
     if (!entry.isFile()) continue;
     if (!entry.name.endsWith(".sm")) continue;
     const expectedMd = `${full.slice(0, -".sm".length)}.md`;
-    if (existsSync8(expectedMd) && safeIsFile(expectedMd)) continue;
+    if (existsSync6(expectedMd) && safeIsFile(expectedMd)) continue;
     out.push({ sidecarPath: full, relativePath: rel, expectedMdPath: expectedMd });
   }
 }
@@ -2605,16 +2273,31 @@ function safeIsFile(path) {
 }
 
 // kernel/sidecar/store.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname6, resolve as resolve10 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { dirname as dirname6, resolve as resolve8 } from "path";
 import { createRequire as createRequire4 } from "module";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 import yaml3 from "js-yaml";
 
+// kernel/util/atomic-write.ts
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync7,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync7,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { dirname as dirname5 } from "path";
+
 // kernel/orchestrator/node-build.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync10 } from "fs";
-import { isAbsolute as isAbsolute3, resolve as resolvePath } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { isAbsolute as isAbsolute2, resolve as resolvePath } from "path";
 import "js-tiktoken/lite";
 import yaml4 from "js-yaml";
 
@@ -2740,7 +2423,7 @@ function resolveSidecarOverlay(relativePath, nodePathForIssue, roots, liveBodyHa
     for (const parseIssue of result.issues) {
       issues.push({
         analyzerId: "invalid-sidecar",
-        severity: "warn",
+        severity: "error",
         nodeIds: [nodePathForIssue],
         message: parseIssue.message,
         data: { sidecarPath: relativePathFromRoots(mdAbs, roots) }
@@ -2776,12 +2459,12 @@ function resolveSidecarOverlay(relativePath, nodePathForIssue, roots, liveBodyHa
   };
 }
 function resolveAbsoluteMdPath(relativePath, roots) {
-  if (isAbsolute3(relativePath)) {
-    return existsSync10(relativePath) ? relativePath : null;
+  if (isAbsolute2(relativePath)) {
+    return existsSync9(relativePath) ? relativePath : null;
   }
   for (const root of roots) {
     const candidate = resolvePath(root, relativePath);
-    if (existsSync10(candidate)) return candidate;
+    if (existsSync9(candidate)) return candidate;
   }
   return null;
 }
@@ -3401,7 +3084,7 @@ function validateRoots(roots) {
     throw new Error(ORCHESTRATOR_TEXTS.runScanRootEmptyArray);
   }
   for (const root of roots) {
-    if (!existsSync11(root) || !statSync4(root).isDirectory()) {
+    if (!existsSync10(root) || !statSync4(root).isDirectory()) {
       throw new Error(tx(ORCHESTRATOR_TEXTS.runScanRootMissing, { root }));
     }
   }
@@ -3409,19 +3092,19 @@ function validateRoots(roots) {
 function resolveActiveProviderOption(optionValue, roots, providers) {
   if (optionValue !== void 0) return optionValue;
   for (const root of roots) {
-    const absRoot = isAbsolute4(root) ? root : resolve11(root);
-    if (!existsSync11(absRoot)) continue;
-    const detected = resolveActiveProvider(absRoot, providers).resolved;
+    const absRoot = isAbsolute3(root) ? root : resolve9(root);
+    if (!existsSync10(absRoot)) continue;
+    const detected = detectProvidersFromFilesystem(absRoot, providers)[0] ?? null;
     if (detected !== null) return detected;
   }
   return null;
 }
 
 // kernel/scan/watcher.ts
-import { resolve as resolve12, relative as relative4, sep as sep4 } from "path";
+import { resolve as resolve10, relative as relative4, sep as sep3 } from "path";
 import chokidar from "chokidar";
 function createChokidarWatcher(opts) {
-  const absRoots = opts.roots.map((r) => resolve12(opts.cwd, r));
+  const absRoots = opts.roots.map((r) => resolve10(opts.cwd, r));
   const ignoreFilterOpt = opts.ignoreFilter;
   const getFilter = ignoreFilterOpt === void 0 ? void 0 : typeof ignoreFilterOpt === "function" ? ignoreFilterOpt : () => ignoreFilterOpt;
   const ignored = getFilter ? (path) => {
@@ -3516,8 +3199,8 @@ function relativePathFromRoots2(absolute, absRoots) {
   for (const root of absRoots) {
     const rel = relative4(root, absolute);
     if (rel === "" || rel === ".") return "";
-    if (!rel.startsWith("..") && !rel.startsWith(`..${sep4}`)) {
-      return rel.split(sep4).join("/");
+    if (!rel.startsWith("..") && !rel.startsWith(`..${sep3}`)) {
+      return rel.split(sep3).join("/");
     }
   }
   return null;
@@ -3822,4 +3505,4 @@ export {
   runScanWithRenames
 };
 //# sourceMappingURL=index.js.map
-//# debugId=66c91062-e32c-5685-861d-a744103465f8
+//# debugId=e78e8b63-f577-5c6a-9522-9187b69e1ed7