@skill-map/cli 0.54.0 → 0.56.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 // cli/entry.ts
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3118bb11-aad2-50b2-b70d-ed15c2f72a97")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="49fdc2af-2694-5cd0-ac19-33f8d1dffa9e")}catch(e){}}();
 import { existsSync as existsSync33 } from "fs";
 import { Builtins, Cli as Cli2 } from "clipanion";
 
@@ -197,6 +197,10 @@ function matchesFilter(hook, event) {
 function buildHookContext(_hook, trigger, event) {
   const data = event.data ?? {};
   const ctx = {
+    // `settings` is always populated (possibly empty) so hooks can read
+    // `ctx.settings.<id>` without a presence check. The composer
+    // populated `resolvedSettings` on each composed hook.
+    settings: _hook.resolvedSettings ?? {},
     event: {
       type: trigger,
       timestamp: event.timestamp,
@@ -246,7 +250,7 @@ function bucketByKind(kind, instance, bag) {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.54.0",
+  version: "0.56.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -567,6 +571,41 @@ var ANTIGRAVITY_PLUGIN_ID = "antigravity";
 var AGENT_SKILLS_PLUGIN_ID = "agent-skills";
 
 // plugins/claude/providers/claude/index.ts
+var RESERVED_SLASH_NAMES = [
+  "help",
+  "clear",
+  "compact",
+  "cost",
+  "init",
+  "model",
+  "agents",
+  "login",
+  "logout",
+  "mcp",
+  "memory",
+  "config",
+  "doctor",
+  "permissions",
+  "add-dir",
+  "bug",
+  "pr-comments",
+  "release-notes",
+  "review",
+  "terminal-setup",
+  "vim",
+  "output-style",
+  "hooks",
+  "install-github-app",
+  "migrate-installer",
+  "upgrade",
+  "resume",
+  "exit",
+  "quit",
+  "security-review",
+  "statusline",
+  "usage",
+  "feedback"
+];
 var claudeProvider = {
   id: "claude",
   pluginId: CLAUDE_PLUGIN_ID,
@@ -718,53 +757,18 @@ var claudeProvider = {
   // declaring one of these (e.g. `.claude/commands/help.md`) is
   // silently shadowed: the runtime runs the built-in instead.
   //
-  // - `command`: canonical list of built-in slash commands documented
-  //   at https://docs.claude.com/en/docs/claude-code/slash-commands.
-  //   The list will drift as Anthropic adds / removes commands;
-  //   updates ship via a kernel patch + changeset (the catalog is
-  //   considered API surface that users rely on the analyzer to
-  //   reflect).
-  // - `agent`: built-in agents Anthropic ships with the CLI. Smaller
+  // - `command` / `skill`: both reserve `RESERVED_SLASH_NAMES` (defined
+  //   above). Per the resolution matrix they share the `/` invocation
+  //   namespace, so a built-in slash command shadows a user node of
+  //   EITHER kind that claims its name (a `skill` named `help` is as
+  //   unreachable as a `command` named `help`). The catalog is API
+  //   surface users rely on the analyzer to reflect.
+  // - `agent`: built-in agents Anthropic ships with the CLI, invoked
+  //   through the `@` / Task namespace (separate from `/`). Smaller
   //   surface than commands today.
-  // - `skill`: no built-in skills today (skills are user-defined and
-  //   discovered from disk); the key is omitted on purpose, defaulting
-  //   to no reserved names for the kind.
   reservedNames: {
-    command: [
-      "help",
-      "clear",
-      "compact",
-      "cost",
-      "init",
-      "model",
-      "agents",
-      "login",
-      "logout",
-      "mcp",
-      "memory",
-      "config",
-      "doctor",
-      "permissions",
-      "add-dir",
-      "bug",
-      "pr-comments",
-      "release-notes",
-      "review",
-      "terminal-setup",
-      "vim",
-      "output-style",
-      "hooks",
-      "install-github-app",
-      "migrate-installer",
-      "upgrade",
-      "resume",
-      "exit",
-      "quit",
-      "security-review",
-      "statusline",
-      "usage",
-      "feedback"
-    ],
+    command: RESERVED_SLASH_NAMES,
+    skill: RESERVED_SLASH_NAMES,
     agent: [
       "general-purpose",
       "output-style-setup",
@@ -883,7 +887,7 @@ var atDirectiveExtractor = {
   id: ID,
   pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
-  description: "Detects `@<token>` directives in a node's body using Claude Code rules. A bare handle (e.g. `@team`) becomes a `mentions` link; a file-flavoured token (e.g. `@docs/api.md`, `@./readme.md`) becomes a `references` link.",
+  description: "Detects `@<token>` directives in a node's body using Claude Code rules, choosing the link kind by token shape. Example: a bare handle `@team` becomes a `mentions` link, while a file-flavoured token `@docs/api.md` becomes a `references` link.",
   scope: "body",
   precondition: { provider: ["claude"] },
   // eslint-disable-next-line complexity
@@ -971,7 +975,7 @@ var slashCommandExtractor = {
   id: ID2,
   pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
-  description: "Turns `/command` invocations in a node's body into arrows that point at the resolved slash command or skill, using Claude Code routing rules.",
+  description: "Turns `/command` invocations in a node's body into arrows that point at the resolved slash command or skill, using Claude Code routing rules. Example: `/deploy` in the body draws an arrow to the `deploy` command.",
   scope: "body",
   precondition: { provider: ["claude"] },
   extract(ctx) {
@@ -1029,7 +1033,7 @@ var toolsCounterExtractor = {
   id: ID3,
   pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
-  description: "Counts the tools an agent declares in its frontmatter and shows the count on the agent card.",
+  description: "Counts the tools an agent declares in its frontmatter and shows the count on the agent card. Example: an agent with `tools: [Bash, Read, Grep]` shows a count of 3.",
   scope: "frontmatter",
   precondition: { kind: ["claude/agent"] },
   ui: { count },
@@ -1444,7 +1448,7 @@ var annotationsExtractor = {
   id: ID4,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  description: "Turns the `supersedes` and `supersededBy` entries from a node's `.sm` sidecar into arrows between nodes in the graph.",
+  description: "Turns the `supersedes` and `supersededBy` entries from a node's `.sm` sidecar into arrows between nodes in the graph. Example: `supersededBy: v1-skill.md` in a `.sm` sidecar draws an arrow to `v1-skill.md`.",
   scope: "frontmatter",
   extract(ctx) {
     const sourcePath = ctx.node.path;
@@ -1500,12 +1504,12 @@ function stringArray(value) {
 // plugins/core/extractors/backtick-path/index.ts
 import { posix as pathPosix2 } from "path";
 var ID5 = "backtick-path";
-var PATH_RE = /(?<![\w/:.-])(?:\.{1,2}\/)?[\w.-]+(?:\/[\w.-]+)+\.md\b(?![\w/])/g;
+var PATH_RE = /(?<![\w/:.-])(?:\.{1,2}\/)?[\w][\w.-]*(?:\/[\w.-]+)*\.md\b(?![\w/])/g;
 var backtickPathExtractor = {
   id: ID5,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  description: "Turns relative .md paths written inside code spans and fenced blocks into arrows between nodes in the graph.",
+  description: "Turns relative .md paths written inside code spans and fenced blocks into arrows between nodes in the graph. Example: a backticked `references/rules.md` path draws an arrow to that file.",
   scope: "body",
   extract(ctx) {
     const seen = /* @__PURE__ */ new Set();
@@ -1564,14 +1568,31 @@ var count2 = {
   emitWhenEmpty: false,
   priority: 30
 };
+var SETTING_IGNORED_DOMAINS = "ignored-domains";
+var settings = {
+  [SETTING_IGNORED_DOMAINS]: {
+    type: "string-list",
+    label: "Ignored domains",
+    description: "Hostnames to exclude from the external-URL count (e.g. internal mirrors, link shorteners).",
+    default: []
+  }
+};
 var URL_RE = /https?:\/\/[^\s<>"'`)\]]+/g;
 var TRAILING_PUNCT = /[.,;:!?]+$/;
 var externalUrlCounterExtractor = {
   id: ID6,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  description: "Counts the distinct external URLs in a node's body and shows the count on the card.",
+  description: "Counts the distinct external URLs in a node's body and shows the count on the card. Example: a body linking `https://example.com` and `https://docs.rs` shows a count of 2.",
   scope: "body",
+  /**
+   * Operator-configurable hostnames to exclude from the count. A URL
+   * whose normalized `hostname` is in this list is skipped entirely:
+   * no Signal, no contribution increment. Default empty (count every
+   * external URL). The operator sets it via
+   * `sm plugins config core/external-url-counter ignored-domains '["…"]'`.
+   */
+  settings,
   /**
    * Phase 6 / View contribution system, surface the distinct-URL
    * count as a card-footer-left chip alongside the in/out link
@@ -1591,6 +1612,7 @@ var externalUrlCounterExtractor = {
   ui: { count: count2 },
   extract(ctx) {
     const seen = /* @__PURE__ */ new Set();
+    const ignoredDomains = readIgnoredDomains(ctx.settings[SETTING_IGNORED_DOMAINS]);
     const body = stripCodeBlocks(ctx.body);
     const lineStarts = computeLineStarts(body);
     for (const match of body.matchAll(URL_RE)) {
@@ -1598,8 +1620,9 @@ var externalUrlCounterExtractor = {
       if (original.length === 0) continue;
       const normalized = normalizeUrl(original);
       if (normalized === null) continue;
-      if (seen.has(normalized)) continue;
-      seen.add(normalized);
+      if (ignoredDomains.has(normalized.host)) continue;
+      if (seen.has(normalized.href)) continue;
+      seen.add(normalized.href);
       const offset = match.index ?? 0;
       const line = lineFor(lineStarts, offset);
       ctx.emitSignal({
@@ -1611,12 +1634,12 @@ var externalUrlCounterExtractor = {
           {
             extractorId: ID6,
             kind: "references",
-            target: normalized,
+            target: normalized.href,
             confidence: 0.3,
             rationale: "external URL pseudo-link, counted then dropped",
             trigger: {
               originalTrigger: original,
-              normalizedTrigger: normalized
+              normalizedTrigger: normalized.href
             }
           }
         ]
@@ -1630,12 +1653,20 @@ var externalUrlCounterExtractor = {
 function stripTrailingPunctuation(raw) {
   return raw.replace(TRAILING_PUNCT, "");
 }
+function readIgnoredDomains(value) {
+  if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+  const out = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (typeof entry === "string" && entry.length > 0) out.add(entry.toLowerCase());
+  }
+  return out;
+}
 function normalizeUrl(raw) {
   try {
     const url = new URL(raw);
     url.hostname = url.hostname.toLowerCase();
     url.hash = "";
-    return url.href;
+    return { href: url.href, host: url.hostname };
   } catch {
     return null;
   }
@@ -1650,7 +1681,7 @@ var markdownLinkExtractor = {
   id: ID7,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  description: "Turns markdown links (`[text](path)`) in a node's body into arrows between nodes in the graph.",
+  description: "Turns markdown links (`[text](path)`) in a node's body into arrows between nodes in the graph. Example: `[the guide](docs/guide.md)` draws an arrow to `docs/guide.md`.",
   scope: "body",
   extract(ctx) {
     const seen = /* @__PURE__ */ new Set();
@@ -1675,13 +1706,15 @@ var markdownLinkExtractor = {
             extractorId: ID7,
             kind: "references",
             target: resolved,
-            // 1.0: the `[text](path)` syntax is unambiguous. Markdown
-            // explicitly designates an out-link via the brackets +
-            // parentheses pair; there is no inference left to discount.
-            // Whether the path resolves to a real node is a separate
-            // concern (the `core/reference-broken` analyzer flags unresolved
-            // targets), not a confidence question.
-            confidence: 1,
+            // 0.95: the `[text](path)` syntax is unambiguous (the spec's
+            // "unambiguous syntax" tier), but NOT 1.0. `1.0` is reserved
+            // for structured input and is earned post-walk by the
+            // confidence-lift transform when `target` resolves to a real
+            // node; an unresolved (broken) target is downgraded to the
+            // broken floor (0.5) by the same transform. Emitting 1.0 here
+            // would short-circuit the lift and make a broken link
+            // indistinguishable from a resolved one.
+            confidence: 0.95,
             rationale: "unambiguous markdown link syntax",
             trigger: {
               originalTrigger: original,
@@ -1711,7 +1744,7 @@ var mcpToolsExtractor = {
   id: ID8,
   pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
-  description: "Turns `tools: [mcp__<server>__<tool>]` entries in a node's frontmatter into an MCP node per unique server and an arrow from the source to each one.",
+  description: "Turns `tools: [mcp__<server>__<tool>]` entries in a node's frontmatter into an MCP node per unique server and an arrow from the source to each one. Example: `tools: [mcp__github__create_pr]` adds an `mcp://github` node and an arrow to it.",
   // Claude-convention pattern only; per-vendor flavours and the
   // config-side MCP declaration (Phase 5b) are still pending, so the
   // extractor ships flagged as experimental in list / show / Settings.
@@ -2004,11 +2037,7 @@ var ANNOTATION_STALE_TEXTS = {
   // a literal placeholder the operator substitutes.
   bodyTooltip: "Sidecar drift since last bump:\n  \u2022 body\nRun `sm bump <path>` to refresh.",
   frontmatterTooltip: "Sidecar drift since last bump:\n  \u2022 frontmatter\nRun `sm bump <path>` to refresh.",
-  bothTooltip: "Sidecar drift since last bump:\n  \u2022 body\n  \u2022 frontmatter\nRun `sm bump <path>` to refresh.",
-  /** Label of the inspector action button that dispatches a bump. */
-  bumpLabel: "Bump",
-  /** Tooltip shown when the bump button is disabled (the node is fresh, no drift). */
-  bumpDisabledReason: "No drift to bump."
+  bothTooltip: "Sidecar drift since last bump:\n  \u2022 body\n  \u2022 frontmatter\nRun `sm bump <path>` to refresh."
 };
 
 // plugins/core/analyzers/annotation-stale/index.ts
@@ -2024,10 +2053,6 @@ var staleBadge = {
   emitWhenEmpty: false,
   priority: 20
 };
-var bumpButton = {
-  slot: "inspector.action.button",
-  priority: 10
-};
 var annotationStaleAnalyzer = {
   id: ID11,
   pluginId: CORE_PLUGIN_ID,
@@ -2036,15 +2061,13 @@ var annotationStaleAnalyzer = {
   mode: "deterministic",
   // The natural fix is to bump the node: refreshes the sidecar hashes,
   // increments `annotations.version`, and stamps the audit block. The
-  // inspector surfaces `core/node-bump` as the `bumpButton` contribution.
-  ui: { staleIcon, staleBadge, bumpButton },
+  // inspector surfaces that affordance via the `core/node-bump` action's
+  // own scan-time `project()` self-projection, not from this analyzer.
+  ui: { staleIcon, staleBadge },
   evaluate(ctx) {
     const issues = [];
     for (const node of ctx.nodes) {
       const status = staleStatus(node.sidecar);
-      if (node.sidecar?.present === true) {
-        emitBumpButton(ctx, node.path, status !== null);
-      }
       if (status === null) continue;
       issues.push({
         analyzerId: ID11,
@@ -2080,15 +2103,6 @@ function messageFor(status, path) {
       return tx(ANNOTATION_STALE_TEXTS.bothDrift, { path });
   }
 }
-function emitBumpButton(ctx, nodePath, enabled) {
-  ctx.emitContribution(nodePath, bumpButton, {
-    actionId: "core/node-bump",
-    label: ANNOTATION_STALE_TEXTS.bumpLabel,
-    icon: "pi-arrow-up-right",
-    enabled,
-    ...enabled ? {} : { disabledReason: ANNOTATION_STALE_TEXTS.bumpDisabledReason }
-  });
-}
 function tooltipFor(status) {
   switch (status) {
     case "stale-body":
@@ -2239,7 +2253,7 @@ var ID15 = "link-conflict";
 var NON_CONFLICTING_KINDS = /* @__PURE__ */ new Set(["points"]);
 var linkConflictAnalyzer = {
   id: ID15,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   description: "Flags conflicting arrow meanings between extractors (e.g. `references` vs `invokes`).",
   mode: "deterministic",
@@ -2304,52 +2318,30 @@ function rankConfidence(c) {
   return c;
 }
 
-// kernel/util/trigger-resolve.ts
-function buildNameIndex(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  indexByCanonicalName(nodes, out);
-  fillIndexWithPathBasename(nodes, out);
-  return out;
-}
-function indexByCanonicalName(nodes, out) {
-  for (const node of nodes) {
-    const raw = canonicalName(node);
-    if (raw === null) continue;
-    const key = normalizeTrigger(raw);
-    if (!out.has(key)) out.set(key, node.path);
-  }
+// kernel/util/link-lines.ts
+function isSelfLoop(link) {
+  if (link.source === link.target) return true;
+  if (link.resolvedTarget && link.source === link.resolvedTarget) return true;
+  return false;
 }
-function fillIndexWithPathBasename(nodes, out) {
-  for (const node of nodes) {
-    if (canonicalName(node) !== null) continue;
-    const derived = pathBasenameForLink(node.path);
-    if (derived.length === 0) continue;
-    const key = normalizeTrigger(derived);
-    if (!out.has(key)) out.set(key, node.path);
+function linkLines(link) {
+  const lines = /* @__PURE__ */ new Set();
+  for (const occ of link.occurrences ?? []) {
+    const line = occ.location?.line;
+    if (typeof line === "number") lines.add(line);
   }
-}
-function canonicalName(node) {
-  const raw = node.frontmatter?.["name"];
-  if (typeof raw !== "string" || raw.length === 0) return null;
-  return raw;
-}
-function pathBasenameForLink(path) {
-  const segments = path.split("/").filter((s) => s.length > 0);
-  if (segments.length === 0) return path;
-  const last = segments[segments.length - 1];
-  if (last === "SKILL.md" && segments.length >= 2) {
-    return segments[segments.length - 2];
+  if (lines.size === 0) {
+    const line = link.location?.line;
+    if (typeof line === "number") lines.add(line);
   }
-  return last.replace(/\.md$/, "");
+  return [...lines].sort((a, b) => a - b);
 }
-function resolveLinkTargetToPath(link, nameIndex) {
-  const raw = link.target;
-  const sigil = raw.charAt(0);
-  if (sigil !== "/" && sigil !== "@") return raw;
-  const normalizedTrigger = link.trigger?.normalizedTrigger;
-  const normalized = typeof normalizedTrigger === "string" ? normalizedTrigger.replace(/^[/@]/, "").trim() : normalizeTrigger(raw.slice(1));
-  const resolved = nameIndex.get(normalized);
-  return resolved ?? raw;
+function linkWhere(link, texts) {
+  const lines = linkLines(link);
+  if (lines.length === 0) return "";
+  return tx(lines.length === 1 ? texts.single : texts.plural, {
+    lines: lines.join(", ")
+  });
 }
 
 // plugins/core/analyzers/link-counter/index.ts
@@ -2376,13 +2368,12 @@ var linkCounterAnalyzer = {
   mode: "deterministic",
   ui: { linksIn, linksOut },
   evaluate(ctx) {
-    const nameIndex = buildNameIndex(ctx.nodes);
     const perTarget = /* @__PURE__ */ new Map();
     const perSource = /* @__PURE__ */ new Map();
     for (const link of ctx.links) {
-      const resolvedTarget = resolveLinkTargetToPath(link, nameIndex);
-      if (link.source === link.target || link.source === resolvedTarget) continue;
-      bump(perTarget, resolvedTarget, link.kind);
+      if (isSelfLoop(link)) continue;
+      const target = link.resolvedTarget ?? link.target;
+      bump(perTarget, target, link.kind);
       bump(perSource, link.source, link.kind);
     }
     for (const node of ctx.nodes) {
@@ -2416,27 +2407,6 @@ function formatBreakdown(byKind, direction) {
   return [direction, ...lines].join("\n");
 }
 
-// kernel/util/link-lines.ts
-function linkLines(link) {
-  const lines = /* @__PURE__ */ new Set();
-  for (const occ of link.occurrences ?? []) {
-    const line = occ.location?.line;
-    if (typeof line === "number") lines.add(line);
-  }
-  if (lines.size === 0) {
-    const line = link.location?.line;
-    if (typeof line === "number") lines.add(line);
-  }
-  return [...lines].sort((a, b) => a - b);
-}
-function linkWhere(link, texts) {
-  const lines = linkLines(link);
-  if (lines.length === 0) return "";
-  return tx(lines.length === 1 ? texts.single : texts.plural, {
-    lines: lines.join(", ")
-  });
-}
-
 // plugins/core/analyzers/link-self-loop/text.ts
 var LINK_SELF_LOOP_TEXTS = {
   /**
@@ -2482,22 +2452,13 @@ var linkSelfLoopAnalyzer = {
         data: {
           target: link.target,
           resolvedTarget: link.resolvedTarget ?? link.target,
-          kind: link.kind,
-          // Mark explicitly so UI / downstream consumers can read this
-          // single field instead of re-computing the `source === target`
-          // predicate themselves.
-          selfLoop: true
+          kind: link.kind
         }
       });
     }
     return issues;
   }
 };
-function isSelfLoop(link) {
-  if (link.source === link.target) return true;
-  if (link.resolvedTarget && link.source === link.resolvedTarget) return true;
-  return false;
-}
 
 // kernel/orchestrator/node-identifiers.ts
 import { posix as pathPosix4 } from "path";
@@ -2539,16 +2500,34 @@ function readDirname(node) {
 
 // kernel/orchestrator/lift-resolved-link-confidence.ts
 var RESERVED_TARGET_CONFIDENCE = 0.1;
+var BROKEN_TARGET_CONFIDENCE = 0.5;
 function liftResolvedLinkConfidence(links, nodes, ctx) {
   if (!links.some((l) => l.confidence < 1)) return;
   const indexes = buildIndexes(nodes, ctx);
   for (const link of links) {
-    if (link.confidence >= 1) continue;
-    const resolution = resolve2(link, indexes, ctx);
-    if (resolution === "none") continue;
-    link.confidence = ctx.reservedNodePaths.has(resolution) ? RESERVED_TARGET_CONFIDENCE : 1;
-    link.resolvedTarget = resolution;
+    if (link.confidence < 1) applyResolution(link, indexes, ctx);
+  }
+}
+function collectBrokenLinks(links, nodes, ctx) {
+  const broken = /* @__PURE__ */ new Set();
+  if (links.length === 0) return broken;
+  const indexes = buildIndexes(nodes, ctx);
+  for (const link of links) {
+    if (isGenuinelyBroken(link, indexes)) broken.add(link);
+  }
+  return broken;
+}
+function applyResolution(link, indexes, ctx) {
+  const resolution = resolve2(link, indexes, ctx);
+  if (resolution === "none") {
+    if (isGenuinelyBroken(link, indexes)) {
+      link.confidence = Math.min(link.confidence, BROKEN_TARGET_CONFIDENCE);
+    }
+    return;
   }
+  link.resolvedTarget = resolution;
+  if (indexes.nodeByPath.get(resolution)?.virtual) return;
+  link.confidence = ctx.reservedNodePaths.has(resolution) ? RESERVED_TARGET_CONFIDENCE : 1;
 }
 function buildIndexes(nodes, ctx) {
   const byPath3 = /* @__PURE__ */ new Set();
@@ -2565,6 +2544,12 @@ function resolve2(link, indexes, ctx) {
   if (indexes.byPath.has(link.target)) return link.target;
   return resolveByName(link, indexes, ctx);
 }
+function isGenuinelyBroken(link, indexes) {
+  if (indexes.byPath.has(link.target)) return false;
+  const stripped = stripTriggerSigil(link.trigger?.normalizedTrigger);
+  if (stripped !== null && indexes.byName.has(stripped)) return false;
+  return true;
+}
 function resolveByName(link, indexes, ctx) {
   const stripped = stripTriggerSigil(link.trigger?.normalizedTrigger);
   if (stripped === null) return "none";
@@ -2608,7 +2593,7 @@ var NAME_RESERVED_TEXTS = {
    * a runtime built-in. Same wording skill-map shipped before the
    * source-side link finding landed.
    */
-  message: "Built-in {{provider}} {{kind}}:\nShadowed by this file; the runtime uses its built-in instead. Rename the file or its `frontmatter.name`.",
+  message: "Name collision: this {{kind}} name is already used by the {{provider}} runtime built-in, which shadows this file. Rename the file or its `frontmatter.name`.",
   /**
    * Source-side message: emitted on the node that AUTHORED a link
    * whose target resolves to a reserved name. Explains WHY the link's
@@ -2616,7 +2601,7 @@ var NAME_RESERVED_TEXTS = {
    * the kernel saw the target match a runtime built-in and downgraded
    * the edge so the operator notices.
    */
-  linkMessage: "{{target}}:\nResolves to a {{provider}} built-in ({{reservedKind}} `{{reservedPath}}`){{where}}; edge downgraded to confidence {{confidence}}. Rename the target file or its `frontmatter.name`.",
+  linkMessage: "{{target}}:\nName collision: resolves to a {{provider}} built-in ({{reservedKind}} `{{reservedPath}}`){{where}}; the built-in wins, so this edge drops to confidence {{confidence}}. Rename the target file or its `frontmatter.name`.",
   /** Location suffix after the built-in parens, one detection site. */
   whereSingle: " (line {{lines}})",
   /** Location suffix after the built-in parens, several detection sites. */
@@ -2655,7 +2640,9 @@ var nameReservedAnalyzer = {
     }
     for (const link of ctx.links) {
       if (link.confidence !== RESERVED_TARGET_CONFIDENCE) continue;
-      const reservedNode = findReservedNodeForLink(link, reserved, byPath3);
+      const reservedPath = link.resolvedTarget;
+      if (!reservedPath || !reserved.has(reservedPath)) continue;
+      const reservedNode = byPath3.get(reservedPath);
       if (!reservedNode) continue;
       issues.push({
         analyzerId: ID18,
@@ -2688,41 +2675,6 @@ function linkWhereSuffix(link) {
     plural: NAME_RESERVED_TEXTS.wherePlural
   });
 }
-function findReservedNodeForLink(link, reserved, byPath3) {
-  if (reserved.has(link.target)) {
-    const node = byPath3.get(link.target);
-    if (node) return node;
-  }
-  const trigger = link.trigger?.normalizedTrigger;
-  if (!trigger) return null;
-  const stripped = trigger.replace(/^[/@]/, "").trim();
-  if (stripped.length === 0) return null;
-  for (const path of reserved) {
-    const node = byPath3.get(path);
-    if (!node) continue;
-    if (matchesNodeIdentifier(node, stripped)) return node;
-  }
-  return null;
-}
-function matchesNodeIdentifier(node, stripped) {
-  const candidates = [];
-  const fmName = node.frontmatter?.["name"];
-  if (typeof fmName === "string" && fmName.length > 0) candidates.push(normaliseId(fmName));
-  const basename = node.path.split("/").pop() ?? "";
-  if (basename) {
-    const stem = basename.replace(/\.[^.]+$/, "");
-    if (stem) candidates.push(normaliseId(stem));
-  }
-  const segs = node.path.split("/");
-  if (segs.length >= 2) {
-    const dirBase = segs[segs.length - 2];
-    if (dirBase) candidates.push(normaliseId(dirBase));
-  }
-  return candidates.includes(stripped);
-}
-function normaliseId(raw) {
-  return raw.normalize("NFD").replace(new RegExp("\\p{Mn}+", "gu"), "").toLowerCase().replace(/[-_\s]+/g, " ").replace(/  +/g, " ").trim();
-}
 
 // plugins/core/analyzers/node-stability/text.ts
 var NODE_STABILITY_TEXTS = {
@@ -2856,6 +2808,12 @@ var nodeSupersededAnalyzer = {
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   description: "Marks nodes replaced by a newer one via `supersededBy`.",
+  // Part of the experimental supersession feature: ships disabled by
+  // default alongside the declarer (`core/supersede` button +
+  // `core/node-supersede` action). With the declarer off by default a
+  // user rarely produces `supersededBy` data, so surfacing it stays
+  // experimental too; the operator opts the whole family in together.
+  stability: "experimental",
   mode: "deterministic",
   evaluate(ctx) {
     const issues = [];
@@ -2887,7 +2845,7 @@ function pickSupersededBy(node) {
 }
 
 // plugins/core/analyzers/reference-broken/index.ts
-import { posix as pathPosix5, resolve as resolve3 } from "path";
+import { resolve as resolve3 } from "path";
 
 // plugins/core/analyzers/reference-broken/text.ts
 var REFERENCE_BROKEN_TEXTS = {
@@ -2918,13 +2876,7 @@ var REFERENCE_BROKEN_TEXTS = {
   // Tooltips for the per-node view-contribution badges. Singular vs
   // plural keeps the count grammar correct without a sub-template.
   alertTooltipSingle: "This node has a broken reference. Open the inspector for details.",
-  alertTooltipMany: "This node has {{count}} broken references. Open the inspector for details.",
-  // Fix-summary copy when the broken trigger has a same-named file on
-  // disk that does not advertise `name:` in its frontmatter. Two
-  // variants for single vs multiple candidates; same template family
-  // as the alert tooltips above.
-  hintSummarySingle: "Add `name: {{name}}` to the frontmatter of {{candidate}} so this reference resolves.",
-  hintSummaryMany: "Add `name: {{name}}` to the frontmatter of one of these files so this reference resolves: {{candidates}}."
+  alertTooltipMany: "This node has {{count}} broken references. Open the inspector for details."
 };
 
 // plugins/core/analyzers/reference-broken/index.ts
@@ -2940,33 +2892,31 @@ var referenceBrokenAnalyzer = {
   // aggregate severity counters now owned by `core/issue-counter`. The
   // detection logic stays intact, only the chip emission is gone.
   ui: {},
-  // The resolver, the reference-paths escape hatch, and the hint
-  // index all share the per-link loop, splitting would re-walk
-  // `ctx.links` once per concern. The per-source aggregation that
-  // historically lived alongside (driving the now-retired chip
-  // emission) moved into `core/issue-counter`.
+  // Pure projector of the orchestrator's genuinely-broken verdict
+  // (`ctx.brokenLinks`, computed once from the same name index the
+  // confidence lift uses), with the reference-paths escape hatch layered
+  // on top. The per-source aggregation that historically lived alongside
+  // (driving the now-retired chip emission) moved into
+  // `core/issue-counter`.
   evaluate(ctx) {
-    const byPath3 = new Set(ctx.nodes.map((n) => n.path));
-    const byNormalizedName = indexByNormalizedName(ctx.nodes);
-    const byBasenameWithoutName = indexByBasenameWithoutName(ctx.nodes);
-    const refIndex = ctx.referenceablePaths && ctx.referenceablePaths.size > 0 && ctx.cwd ? { paths: ctx.referenceablePaths, cwd: ctx.cwd } : null;
+    const broken = ctx.brokenLinks;
+    if (!broken || broken.size === 0) return [];
+    const refIndex = buildReferenceIndex(ctx);
     const issues = [];
     for (const link of ctx.links) {
-      if (isResolved(link, byPath3, byNormalizedName)) continue;
+      if (!broken.has(link)) continue;
       if (refIndex && resolvesViaReferencePaths(link, refIndex)) continue;
-      const candidates = findHintCandidates(link, byBasenameWithoutName);
-      issues.push(buildIssue(link, candidates));
+      issues.push(buildIssue(link));
     }
     return issues;
   }
 };
-function buildIssue(link, hintCandidates = []) {
-  const data = {
-    target: link.target,
-    kind: link.kind,
-    trigger: link.trigger?.normalizedTrigger ?? null
-  };
-  const issue = {
+function buildReferenceIndex(ctx) {
+  if (!ctx.referenceablePaths || ctx.referenceablePaths.size === 0 || !ctx.cwd) return null;
+  return { paths: ctx.referenceablePaths, cwd: ctx.cwd };
+}
+function buildIssue(link) {
+  return {
     analyzerId: ID21,
     // `error`, not `warn`: a link whose target is not in the scan is a
     // structural defect the operator must notice, and the card chip
@@ -2984,86 +2934,17 @@ function buildIssue(link, hintCandidates = []) {
         plural: REFERENCE_BROKEN_TEXTS.wherePlural
       })
     }),
-    data
-  };
-  if (hintCandidates.length > 0) attachHint(issue, data, link, hintCandidates);
-  return issue;
-}
-function attachHint(issue, data, link, hintCandidates) {
-  const suggestedName = (link.trigger?.normalizedTrigger ?? "").replace(/^[/@]/, "").trim();
-  const candidatePaths = hintCandidates.map((n) => n.path);
-  data["hint"] = {
-    kind: "missing-frontmatter-name",
-    suggestedName,
-    candidates: candidatePaths
-  };
-  issue.fix = {
-    summary: candidatePaths.length === 1 ? tx(REFERENCE_BROKEN_TEXTS.hintSummarySingle, {
-      name: suggestedName,
-      candidate: candidatePaths[0]
-    }) : tx(REFERENCE_BROKEN_TEXTS.hintSummaryMany, {
-      name: suggestedName,
-      candidates: candidatePaths.join(", ")
-    }),
-    autofixable: false
+    data: {
+      target: link.target,
+      kind: link.kind,
+      trigger: link.trigger?.normalizedTrigger ?? null
+    }
   };
 }
 function resolvesViaReferencePaths(link, refIndex) {
   if (!isPathStyleLink(link)) return false;
   return refIndex.paths.has(resolve3(refIndex.cwd, link.target));
 }
-function indexByNormalizedName(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    const raw = node.frontmatter?.["name"];
-    const name = typeof raw === "string" ? raw : "";
-    if (!name) continue;
-    const key = normalizeTrigger(name);
-    const bucket = out.get(key) ?? [];
-    bucket.push(node);
-    out.set(key, bucket);
-  }
-  return out;
-}
-function basenameWithoutExt(path) {
-  const base = pathPosix5.basename(path);
-  const ext = pathPosix5.extname(base);
-  return ext ? base.slice(0, -ext.length) : base;
-}
-function indexByBasenameWithoutName(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    const raw = node.frontmatter?.["name"];
-    const name = typeof raw === "string" ? raw : "";
-    if (name) continue;
-    const bare = basenameWithoutExt(node.path);
-    if (!bare) continue;
-    const key = normalizeTrigger(bare);
-    if (!key) continue;
-    const bucket = out.get(key) ?? [];
-    bucket.push(node);
-    out.set(key, bucket);
-  }
-  return out;
-}
-function findHintCandidates(link, idx) {
-  const normalized = link.trigger?.normalizedTrigger;
-  if (!normalized) return [];
-  const sigil = normalized.charAt(0);
-  if (sigil !== "/" && sigil !== "@") return [];
-  const withoutSigil = normalized.slice(1).trim();
-  if (!withoutSigil) return [];
-  return idx.get(withoutSigil) ?? [];
-}
-function isResolved(link, byPath3, byNormalizedName) {
-  const normalized = link.trigger?.normalizedTrigger;
-  if (normalized) {
-    const withoutSigil = normalized.replace(/^[/@]/, "").trim();
-    if (byNormalizedName.has(withoutSigil)) return true;
-  }
-  if (byPath3.has(link.target)) return true;
-  return false;
-}
 function isPathStyleLink(link) {
   const sigil = link.trigger?.normalizedTrigger?.charAt(0);
   if (sigil === "/" || sigil === "@") return false;
@@ -3102,12 +2983,9 @@ var referenceRedundantAnalyzer = {
   mode: "deterministic",
   evaluate(ctx) {
     if (ctx.links.length === 0) return [];
-    const byPath3 = /* @__PURE__ */ new Map();
-    for (const node of ctx.nodes) byPath3.set(node.path, node);
-    const byName = buildNameIndex2(ctx.nodes);
     const groups = /* @__PURE__ */ new Map();
     for (const link of ctx.links) {
-      const resolved = resolveTargetPath(link, byPath3, byName);
+      const resolved = link.resolvedTarget;
       if (!resolved) continue;
       const key = `${link.source}\0${resolved}`;
       const bucket = groups.get(key);
@@ -3188,45 +3066,6 @@ function formatGroupedOccurrences(occurrences) {
     })
   ).join(REFERENCE_REDUNDANT_TEXTS.occurrenceSeparator);
 }
-function buildNameIndex2(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    for (const candidate of collectIdentifiers(node)) {
-      const normalised = normalizeTrigger(candidate);
-      if (!normalised) continue;
-      const bucket = out.get(normalised);
-      if (bucket) bucket.push(node.path);
-      else out.set(normalised, [node.path]);
-    }
-  }
-  return out;
-}
-function collectIdentifiers(node) {
-  const out = [];
-  const fmName = node.frontmatter?.["name"];
-  if (typeof fmName === "string" && fmName.length > 0) out.push(fmName);
-  const segs = node.path.split("/");
-  const last = segs[segs.length - 1] ?? "";
-  if (last) {
-    const stem = last.replace(/\.[^.]+$/, "");
-    if (stem) out.push(stem);
-  }
-  if (segs.length >= 2) {
-    const dirBase = segs[segs.length - 2];
-    if (dirBase) out.push(dirBase);
-  }
-  return out;
-}
-function resolveTargetPath(link, byPath3, byName) {
-  if (byPath3.has(link.target)) return link.target;
-  const trigger = link.trigger?.normalizedTrigger;
-  if (!trigger) return null;
-  const stripped = trigger.replace(/^[/@]/, "").trim();
-  if (!stripped) return null;
-  const candidates = byName.get(stripped);
-  if (!candidates || candidates.length === 0) return null;
-  return candidates[0] ?? null;
-}
 
 // kernel/adapters/schema-validators.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -3760,198 +3599,82 @@ function makeIssue(signal) {
   return null;
 }
 
-// plugins/core/analyzers/supersede/text.ts
-var SUPERSEDE_TEXTS = {
-  /** Label of the inspector action button that declares supersession. */
-  supersedeLabel: "Supersede",
-  /** Tooltip shown when the supersede button is disabled (already superseded). */
-  supersedeDisabledReason: "Already superseded.",
-  /** Tooltip shown when there is no other node to supersede this one. */
-  supersedeNoTargetsReason: "No other node to supersede this one.",
-  /** Prompt label for the target node-picker (enum-pick over the live node set). */
-  supersedePromptLabel: "Superseded by"
+// plugins/core/analyzers/trigger-collision/text.ts
+var TRIGGER_COLLISION_TEXTS = {
+  /**
+   * Top-level message when `analyzeTriggerBucket` accumulated exactly one
+   * cause part. Used for the advertiser-ambiguous-only, invocation-
+   * ambiguous-only, and cross-kind-only branches.
+   */
+  messageOnePart: '"{{normalized}}":\nTrigger collision: {{part}}.',
+  /**
+   * Top-level message when `analyzeTriggerBucket` accumulated two cause
+   * parts (advertiser-ambiguous AND invocation-ambiguous fire together).
+   * The joiner lives inside the template so future locales can adapt it
+   * (e.g. `'; y '` in Spanish) without touching the rule code.
+   */
+  messageTwoParts: '"{{normalized}}":\nTrigger collision: {{first}}; and {{second}}.',
+  /** `<n> advertisers: <list>` part, fires on the advertiser-ambiguous branch. */
+  partAdvertisers: "{{count}} advertisers: {{paths}}",
+  /** `<n> invocation forms: <list>` part, fires on the invocation-ambiguous branch. */
+  partInvocations: "{{count}} invocation forms: {{forms}}",
+  /** Singular cross-kind cause: `non-canonical invocation <form> against advertiser <path>`. */
+  partNonCanonicalSingular: "non-canonical invocation {{forms}} against advertiser {{advertiser}}",
+  /** Plural cross-kind cause: `non-canonical invocations <forms> against advertiser <path>`. */
+  partNonCanonicalPlural: "non-canonical invocations {{forms}} against advertiser {{advertiser}}"
 };
 
-// plugins/core/analyzers/supersede/index.ts
-var ID25 = "supersede";
-var supersedeButton = {
-  slot: "inspector.action.button",
-  priority: 10
-};
-var supersedeAnalyzer = {
+// plugins/core/analyzers/trigger-collision/index.ts
+var ID25 = "trigger-collision";
+var ADVERTISING_KINDS = /* @__PURE__ */ new Set([
+  "command",
+  "skill",
+  "agent"
+]);
+var triggerCollisionAnalyzer = {
   id: ID25,
   pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
-  description: 'Projects the inspector "Supersede" button (declares a node replaced by another).',
   mode: "deterministic",
-  ui: { supersedeButton },
+  description: "Flags two or more nodes that claim the same `/command` or `@agent` name.",
+  // Two claim-collection passes (advertisement + invocation) feeding
+  // the bucket map. Per-bucket analysis lives in `analyzeTriggerBucket`.
+  // eslint-disable-next-line complexity
   evaluate(ctx) {
-    const candidates = ctx.nodes.filter((n) => n.virtual !== true).map((n) => n.path);
+    const buckets = /* @__PURE__ */ new Map();
+    const push = (key, claim) => {
+      const bucket = buckets.get(key) ?? [];
+      bucket.push(claim);
+      buckets.set(key, bucket);
+    };
     for (const node of ctx.nodes) {
-      if (node.virtual === true) continue;
-      const options = candidates.filter((p) => p !== node.path).map((p) => ({ value: p, label: p }));
-      emitSupersedeButton(ctx, node, options);
+      if (!ADVERTISING_KINDS.has(node.kind)) continue;
+      const raw = node.frontmatter?.["name"];
+      if (typeof raw !== "string" || raw.length === 0) continue;
+      const normalized = `/${normalizeTrigger(raw)}`;
+      if (normalized === "/") continue;
+      push(normalized, {
+        kind: "advertiser",
+        token: node.path,
+        nodeId: node.path,
+        canonicalForm: `/${raw}`
+      });
     }
-    return [];
-  }
-};
-function emitSupersedeButton(ctx, node, options) {
-  const disabledReason = resolveDisabledReason(node, options.length);
-  ctx.emitContribution(node.path, supersedeButton, {
-    actionId: "core/node-supersede",
-    label: SUPERSEDE_TEXTS.supersedeLabel,
-    icon: "pi-arrow-right-arrow-left",
-    enabled: disabledReason === void 0,
-    ...disabledReason === void 0 ? {} : { disabledReason },
-    prompt: {
-      inputType: "enum-pick",
-      paramKey: "supersededBy",
-      label: SUPERSEDE_TEXTS.supersedePromptLabel,
-      options
-    }
-  });
-}
-function resolveDisabledReason(node, optionCount) {
-  if (alreadySuperseded(node)) return SUPERSEDE_TEXTS.supersedeDisabledReason;
-  if (optionCount === 0) return SUPERSEDE_TEXTS.supersedeNoTargetsReason;
-  return void 0;
-}
-function alreadySuperseded(node) {
-  const sidecar = node.sidecar;
-  if (!sidecar || sidecar.present !== true) return false;
-  const ann = sidecar.annotations;
-  if (!ann || typeof ann !== "object" || Array.isArray(ann)) return false;
-  const value = ann["supersededBy"];
-  return typeof value === "string" && value.length > 0;
-}
-
-// plugins/core/analyzers/tags/text.ts
-var TAGS_TEXTS = {
-  /** Label of the inspector action button that edits the node's tags. */
-  editLabel: "Edit tags",
-  /** Prompt label for the string-list tags input. */
-  promptLabel: "Tags"
-};
-
-// plugins/core/analyzers/tags/index.ts
-var ID26 = "tags";
-var setTagsButton = {
-  slot: "inspector.action.button",
-  priority: 15
-};
-var tagsAnalyzer = {
-  id: ID26,
-  pluginId: CORE_PLUGIN_ID,
-  kind: "analyzer",
-  description: `Projects the inspector "Edit tags" button (edits a node's taxonomy tags).`,
-  mode: "deterministic",
-  ui: { setTagsButton },
-  evaluate(ctx) {
-    for (const node of ctx.nodes) {
-      if (node.sidecar?.present !== true) continue;
-      emitSetTagsButton(ctx, node);
-    }
-    return [];
-  }
-};
-function emitSetTagsButton(ctx, node) {
-  ctx.emitContribution(node.path, setTagsButton, {
-    actionId: "core/node-set-tags",
-    label: TAGS_TEXTS.editLabel,
-    icon: "pi-tags",
-    enabled: true,
-    prompt: {
-      inputType: "string-list",
-      paramKey: "tags",
-      label: TAGS_TEXTS.promptLabel,
-      defaultValue: currentTags(node)
-    }
-  });
-}
-function currentTags(node) {
-  const ann = node.sidecar?.annotations;
-  if (!ann || typeof ann !== "object" || Array.isArray(ann)) return [];
-  const value = ann["tags"];
-  if (!Array.isArray(value)) return [];
-  return value.filter((t) => typeof t === "string");
-}
-
-// plugins/core/analyzers/trigger-collision/text.ts
-var TRIGGER_COLLISION_TEXTS = {
-  /**
-   * Top-level message when `analyzeTriggerBucket` accumulated exactly one
-   * cause part. Used for the advertiser-ambiguous-only, invocation-
-   * ambiguous-only, and cross-kind-only branches.
-   */
-  messageOnePart: '"{{normalized}}":\nTrigger collision: {{part}}.',
-  /**
-   * Top-level message when `analyzeTriggerBucket` accumulated two cause
-   * parts (advertiser-ambiguous AND invocation-ambiguous fire together).
-   * The joiner lives inside the template so future locales can adapt it
-   * (e.g. `'; y '` in Spanish) without touching the rule code.
-   */
-  messageTwoParts: '"{{normalized}}":\nTrigger collision: {{first}}; and {{second}}.',
-  /** `<n> advertisers: <list>` part, fires on the advertiser-ambiguous branch. */
-  partAdvertisers: "{{count}} advertisers: {{paths}}",
-  /** `<n> invocation forms: <list>` part, fires on the invocation-ambiguous branch. */
-  partInvocations: "{{count}} invocation forms: {{forms}}",
-  /** Singular cross-kind cause: `non-canonical invocation <form> against advertiser <path>`. */
-  partNonCanonicalSingular: "non-canonical invocation {{forms}} against advertiser {{advertiser}}",
-  /** Plural cross-kind cause: `non-canonical invocations <forms> against advertiser <path>`. */
-  partNonCanonicalPlural: "non-canonical invocations {{forms}} against advertiser {{advertiser}}"
-};
-
-// plugins/core/analyzers/trigger-collision/index.ts
-var ID27 = "trigger-collision";
-var ADVERTISING_KINDS = /* @__PURE__ */ new Set([
-  "command",
-  "skill",
-  "agent"
-]);
-var triggerCollisionAnalyzer = {
-  id: ID27,
-  pluginId: CORE_PLUGIN_ID,
-  kind: "analyzer",
-  mode: "deterministic",
-  description: "Flags two or more nodes that claim the same `/command` or `@agent` name.",
-  // Two claim-collection passes (advertisement + invocation) feeding
-  // the bucket map. Per-bucket analysis lives in `analyzeTriggerBucket`.
-  // eslint-disable-next-line complexity
-  evaluate(ctx) {
-    const buckets = /* @__PURE__ */ new Map();
-    const push = (key, claim) => {
-      const bucket = buckets.get(key) ?? [];
-      bucket.push(claim);
-      buckets.set(key, bucket);
-    };
-    for (const node of ctx.nodes) {
-      if (!ADVERTISING_KINDS.has(node.kind)) continue;
-      const raw = node.frontmatter?.["name"];
-      if (typeof raw !== "string" || raw.length === 0) continue;
-      const normalized = `/${normalizeTrigger(raw)}`;
-      if (normalized === "/") continue;
-      push(normalized, {
-        kind: "advertiser",
-        token: node.path,
-        nodeId: node.path,
-        canonicalForm: `/${raw}`
-      });
-    }
-    for (const link of ctx.links) {
-      const normalized = link.trigger?.normalizedTrigger;
-      if (!normalized) continue;
-      push(normalized, {
-        kind: "invocation",
-        token: link.target,
-        nodeId: link.source
-      });
-    }
-    const issues = [];
-    for (const [normalized, claims] of buckets) {
-      const issue = analyzeTriggerBucket(normalized, claims);
-      if (issue) issues.push(issue);
-    }
-    return issues;
+    for (const link of ctx.links) {
+      const normalized = link.trigger?.normalizedTrigger;
+      if (!normalized) continue;
+      push(normalized, {
+        kind: "invocation",
+        token: link.target,
+        nodeId: link.source
+      });
+    }
+    const issues = [];
+    for (const [normalized, claims] of buckets) {
+      const issue = analyzeTriggerBucket(normalized, claims);
+      if (issue) issues.push(issue);
+    }
+    return issues;
   }
 };
 function analyzeTriggerBucket(normalized, claims) {
@@ -4007,7 +3730,7 @@ function analyzeTriggerBucket(normalized, claims) {
     part: parts[0]
   });
   return {
-    analyzerId: ID27,
+    analyzerId: ID25,
     severity: "error",
     nodeIds,
     message,
@@ -4047,13 +3770,13 @@ var ASCII_FORMATTER_TEXTS = {
 };
 
 // plugins/core/formatters/ascii/index.ts
-var ID28 = "ascii";
+var ID26 = "ascii";
 var KIND_ORDER = ["agent", "command", "skill", "markdown"];
 var asciiFormatter = {
-  id: ID28,
+  id: ID26,
   pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
-  formatId: ID28,
+  formatId: ID26,
   description: "Renders the scan as plain text in three sections: nodes (grouped by kind), arrows, and issues. Used by `sm scan --format ascii`.",
   // ASCII tree formatter, header + per-kind sections + per-issue
   // section. Each section iterates and renders; splitting per section
@@ -4147,13 +3870,13 @@ function renderSection(out, kind, group) {
 }
 
 // plugins/core/formatters/json/index.ts
-var ID29 = "json";
+var ID27 = "json";
 var jsonFormatter = {
-  id: ID29,
+  id: ID27,
   pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
   description: "Renders the persisted scan as JSON (conforms to `scan-result.schema.json`). Used by `sm graph --format json` and `GET /api/graph?format=json`.",
-  formatId: ID29,
+  formatId: ID27,
   format(ctx) {
     if (ctx.scanResult !== void 0) {
       return JSON.stringify(ctx.scanResult);
@@ -4291,14 +4014,33 @@ function resolveSpecRoot2() {
   }
 }
 
+// plugins/core/actions/node-bump/text.ts
+var BUMP_TEXTS = {
+  /** Label of the inspector action button that dispatches a bump. */
+  bumpLabel: "Bump",
+  /** Tooltip shown when the bump button is disabled (the node is fresh, no drift). */
+  bumpDisabledReason: "No drift to bump."
+};
+
 // plugins/core/actions/node-bump/index.ts
-var ID30 = "node-bump";
+var ID28 = "node-bump";
+var bumpButton = {
+  slot: "inspector.action.button",
+  priority: 10
+};
 var nodeBumpAction = {
-  id: ID30,
+  id: ID28,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
   description: "Marks a node as updated: bumps `annotations.version`, refreshes sidecar hashes, and records the timestamp.",
   mode: "deterministic",
+  ui: { bumpButton },
+  project(ctx) {
+    for (const node of ctx.nodes) {
+      if (node.sidecar?.present !== true) continue;
+      emitBumpButton(ctx, node.path, staleStatus2(node.sidecar) !== null);
+    }
+  },
   // The runtime contract uses generic <TInput, TReport>; bump narrows
   // both. The cast is the standard pattern for built-ins that want
   // typed local I/O while staying compatible with the open generic.
@@ -4307,6 +4049,20 @@ var nodeBumpAction = {
     return invokeBump(input, ctx);
   }
 };
+function emitBumpButton(ctx, nodePath, enabled) {
+  ctx.emitContribution(nodePath, bumpButton, {
+    actionId: "core/node-bump",
+    label: BUMP_TEXTS.bumpLabel,
+    icon: "pi-arrow-up-right",
+    enabled,
+    ...enabled ? {} : { disabledReason: BUMP_TEXTS.bumpDisabledReason }
+  });
+}
+function staleStatus2(overlay) {
+  const status = overlay?.status;
+  if (status === void 0 || status === null || status === "fresh") return null;
+  return status;
+}
 function invokeBump(input, ctx) {
   const overlay = ctx.node.sidecar ?? null;
   const isFresh = overlay?.present === true && overlay.status === "fresh";
@@ -4353,9 +4109,9 @@ function pickCurrentVersion(overlay) {
 
 // plugins/core/actions/node-set-stability/index.ts
 var STABILITY_VALUES = ["experimental", "stable", "deprecated"];
-var ID31 = "node-set-stability";
+var ID29 = "node-set-stability";
 var nodeSetStabilityAction = {
-  id: ID31,
+  id: ID29,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
   description: "Sets the lifecycle stage of the current node (writes `stability` to the sidecar).",
@@ -4394,14 +4150,33 @@ function invokeSetStability(input, ctx) {
   return { report, writes: [write] };
 }
 
+// plugins/core/actions/node-set-tags/text.ts
+var TAGS_TEXTS = {
+  /** Label of the inspector action button that edits the node's tags. */
+  editLabel: "Edit tags",
+  /** Prompt label for the string-list tags input. */
+  promptLabel: "Tags"
+};
+
 // plugins/core/actions/node-set-tags/index.ts
-var ID32 = "node-set-tags";
+var ID30 = "node-set-tags";
+var setTagsButton = {
+  slot: "inspector.action.button",
+  priority: 15
+};
 var nodeSetTagsAction = {
-  id: ID32,
+  id: ID30,
   pluginId: CORE_PLUGIN_ID,
   kind: "action",
   description: "Sets the taxonomy tags of the current node (writes `tags` to the sidecar; whole-array replace).",
   mode: "deterministic",
+  ui: { setTagsButton },
+  project(ctx) {
+    for (const node of ctx.nodes) {
+      if (node.sidecar?.present !== true) continue;
+      emitSetTagsButton(ctx, node);
+    }
+  },
   // The runtime contract uses generic <TInput, TReport>; this narrows
   // both. The cast is the standard pattern for built-ins that want
   // typed local I/O while staying compatible with the open generic.
@@ -4410,6 +4185,27 @@ var nodeSetTagsAction = {
     return invokeSetTags(input, ctx);
   }
 };
+function emitSetTagsButton(ctx, node) {
+  ctx.emitContribution(node.path, setTagsButton, {
+    actionId: "core/node-set-tags",
+    label: TAGS_TEXTS.editLabel,
+    icon: "pi-tags",
+    enabled: true,
+    prompt: {
+      inputType: "string-list",
+      paramKey: "tags",
+      label: TAGS_TEXTS.promptLabel,
+      defaultValue: currentTags(node)
+    }
+  });
+}
+function currentTags(node) {
+  const ann = node.sidecar?.annotations;
+  if (!ann || typeof ann !== "object" || Array.isArray(ann)) return [];
+  const value = ann["tags"];
+  if (!Array.isArray(value)) return [];
+  return value.filter((t) => typeof t === "string");
+}
 function invokeSetTags(input, ctx) {
   const tags = Array.isArray(input.tags) ? input.tags : [];
   const timestamp = ctx.now().toISOString();
@@ -4432,23 +4228,82 @@ function invokeSetTags(input, ctx) {
   const report = { ok: true, tags };
   return { report, writes: [write] };
 }
-
-// plugins/core/actions/node-supersede/index.ts
-var ID33 = "node-supersede";
-var nodeSupersedeAction = {
-  id: ID33,
-  pluginId: CORE_PLUGIN_ID,
-  kind: "action",
-  description: "Declares the current node as superseded by another (writes `supersededBy` to the sidecar).",
-  mode: "deterministic",
-  // The runtime contract uses generic <TInput, TReport>; supersede
-  // narrows both. The cast is the standard pattern for built-ins that
-  // want typed local I/O while staying compatible with the open generic.
-  invoke(rawInput, ctx) {
-    const input = rawInput ?? {};
-    return invokeSupersede(input, ctx);
-  }
-};
+
+// plugins/core/actions/node-supersede/text.ts
+var SUPERSEDE_TEXTS = {
+  /** Label of the inspector action button that declares supersession. */
+  supersedeLabel: "Supersede",
+  /** Tooltip shown when the supersede button is disabled (already superseded). */
+  supersedeDisabledReason: "Already superseded.",
+  /** Tooltip shown when there is no other node to supersede this one. */
+  supersedeNoTargetsReason: "No other node to supersede this one.",
+  /** Prompt label for the target node-picker (enum-pick over the live node set). */
+  supersedePromptLabel: "Superseded by"
+};
+
+// plugins/core/actions/node-supersede/index.ts
+var ID31 = "node-supersede";
+var supersedeButton = {
+  slot: "inspector.action.button",
+  priority: 10
+};
+var nodeSupersedeAction = {
+  id: ID31,
+  pluginId: CORE_PLUGIN_ID,
+  kind: "action",
+  description: "Declares the current node as superseded by another (writes `supersededBy` to the sidecar).",
+  // Ships disabled by default (the declarer feature is still settling its
+  // node-picker UX). The button self-projection gates as a unit with the
+  // invoke executor: an enabled button pointing at a disabled action
+  // would error on click, so the whole action stays experimental.
+  stability: "experimental",
+  mode: "deterministic",
+  ui: { supersedeButton },
+  project(ctx) {
+    const candidates = ctx.nodes.filter((n) => n.virtual !== true).map((n) => n.path);
+    for (const node of ctx.nodes) {
+      if (node.virtual === true) continue;
+      const options = candidates.filter((p) => p !== node.path).map((p) => ({ value: p, label: p }));
+      emitSupersedeButton(ctx, node, options);
+    }
+  },
+  // The runtime contract uses generic <TInput, TReport>; supersede
+  // narrows both. The cast is the standard pattern for built-ins that
+  // want typed local I/O while staying compatible with the open generic.
+  invoke(rawInput, ctx) {
+    const input = rawInput ?? {};
+    return invokeSupersede(input, ctx);
+  }
+};
+function emitSupersedeButton(ctx, node, options) {
+  const disabledReason = resolveDisabledReason(node, options.length);
+  ctx.emitContribution(node.path, supersedeButton, {
+    actionId: "core/node-supersede",
+    label: SUPERSEDE_TEXTS.supersedeLabel,
+    icon: "pi-arrow-right-arrow-left",
+    enabled: disabledReason === void 0,
+    ...disabledReason === void 0 ? {} : { disabledReason },
+    prompt: {
+      inputType: "enum-pick",
+      paramKey: "supersededBy",
+      label: SUPERSEDE_TEXTS.supersedePromptLabel,
+      options
+    }
+  });
+}
+function resolveDisabledReason(node, optionCount) {
+  if (alreadySuperseded(node)) return SUPERSEDE_TEXTS.supersedeDisabledReason;
+  if (optionCount === 0) return SUPERSEDE_TEXTS.supersedeNoTargetsReason;
+  return void 0;
+}
+function alreadySuperseded(node) {
+  const sidecar = node.sidecar;
+  if (!sidecar || sidecar.present !== true) return false;
+  const ann = sidecar.annotations;
+  if (!ann || typeof ann !== "object" || Array.isArray(ann)) return false;
+  const value = ann["supersededBy"];
+  return typeof value === "string" && value.length > 0;
+}
 function invokeSupersede(input, ctx) {
   const supersededBy = input.supersededBy;
   if (supersededBy === ctx.node.path) {
@@ -4769,11 +4624,11 @@ function validateOrDefault(parsed) {
   if (!result.ok) return defaultSettings();
   return result.data;
 }
-function backfillSubObjects(settings) {
+function backfillSubObjects(settings2) {
   return {
-    ...settings,
-    updateCheck: settings.updateCheck ?? {},
-    telemetry: settings.telemetry ?? {}
+    ...settings2,
+    updateCheck: settings2.updateCheck ?? {},
+    telemetry: settings2.telemetry ?? {}
   };
 }
 function writeUserSettings(patch) {
@@ -4793,24 +4648,24 @@ function writeUserSettings(patch) {
   }
 }
 function isUpdateCheckEnabled() {
-  const settings = readUserSettings();
-  return settings.updateCheck?.enabled !== false;
+  const settings2 = readUserSettings();
+  return settings2.updateCheck?.enabled !== false;
 }
 function isErrorTelemetryEnabled() {
-  const settings = readUserSettings();
-  return settings.telemetry?.errorsEnabled === true;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.errorsEnabled === true;
 }
 function isUsageCliTelemetryEnabled() {
-  const settings = readUserSettings();
-  return settings.telemetry?.usageCliEnabled === true;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.usageCliEnabled === true;
 }
 function isUsageUiTelemetryEnabled() {
-  const settings = readUserSettings();
-  return settings.telemetry?.usageUiEnabled === true;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.usageUiEnabled === true;
 }
 function readAnonymousId() {
-  const settings = readUserSettings();
-  return settings.telemetry?.anonymousId ?? null;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.anonymousId ?? null;
 }
 function ensureAnonymousId(generate = () => randomUUID()) {
   const existing = readAnonymousId();
@@ -4820,12 +4675,12 @@ function ensureAnonymousId(generate = () => randomUUID()) {
   return id;
 }
 function hasTelemetryPromptBeenShown() {
-  const settings = readUserSettings();
-  return typeof settings.telemetry?.promptedAt === "number";
+  const settings2 = readUserSettings();
+  return typeof settings2.telemetry?.promptedAt === "number";
 }
 function hasSeenFirstRun() {
-  const settings = readUserSettings();
-  return typeof settings.telemetry?.firstRunAt === "number";
+  const settings2 = readUserSettings();
+  return typeof settings2.telemetry?.firstRunAt === "number";
 }
 function mergeSettings(current, patch) {
   const merged = {
@@ -4980,8 +4835,6 @@ var referenceBrokenAnalyzer2 = { ...referenceBrokenAnalyzer, pluginId: "core", v
 var referenceRedundantAnalyzer2 = { ...referenceRedundantAnalyzer, pluginId: "core", version: VERSION };
 var schemaViolationAnalyzer2 = { ...schemaViolationAnalyzer, pluginId: "core", version: VERSION };
 var signalCollisionAnalyzer2 = { ...signalCollisionAnalyzer, pluginId: "core", version: VERSION };
-var supersedeAnalyzer2 = { ...supersedeAnalyzer, pluginId: "core", version: VERSION };
-var tagsAnalyzer2 = { ...tagsAnalyzer, pluginId: "core", version: VERSION };
 var triggerCollisionAnalyzer2 = { ...triggerCollisionAnalyzer, pluginId: "core", version: VERSION };
 var asciiFormatter2 = { ...asciiFormatter, pluginId: "core", version: VERSION };
 var jsonFormatter2 = { ...jsonFormatter, pluginId: "core", version: VERSION };
@@ -5048,8 +4901,6 @@ var builtInPlugins = [
       referenceRedundantAnalyzer2,
       schemaViolationAnalyzer2,
       signalCollisionAnalyzer2,
-      supersedeAnalyzer2,
-      tagsAnalyzer2,
       triggerCollisionAnalyzer2,
       asciiFormatter2,
       jsonFormatter2,
@@ -6239,6 +6090,10 @@ function removeConfigValue(key, opts) {
   writeJsonAtomic(path, merged);
   return true;
 }
+function getValueSource(key, opts) {
+  const loaded = loadConfigForScope(opts);
+  return loaded.sources.get(key);
+}
 function loadConfigForScope(opts) {
   return loadConfig({
     cwd: opts.cwd,
@@ -6458,7 +6313,7 @@ function resolveSpecRoot3() {
 }
 
 // cli/i18n/bump.texts.ts
-var BUMP_TEXTS = {
+var BUMP_TEXTS2 = {
   // --- argument validation --------------------------------------------------
   /**
    * §3.1b two-line block. Mutex between the positional <node.path> and
@@ -8149,6 +8004,7 @@ function rowToNode(row) {
     const parsed = JSON.parse(row.externalRefsJson);
     if (Array.isArray(parsed) && parsed.length > 0) node.externalRefs = parsed;
   }
+  if (row.modifiedAtMs !== null) node.modifiedAtMs = row.modifiedAtMs;
   return node;
 }
 function rowToLink(row) {
@@ -8665,7 +8521,10 @@ function nodeToRow(node, scannedAt) {
     // the column stays sparse for nodes whose bodies have no http(s)
     // URLs at all. Round-tripped by `rowToNode` on load.
     externalRefsJson: node.externalRefs && node.externalRefs.length > 0 ? JSON.stringify(node.externalRefs) : null,
-    scannedAt
+    scannedAt,
+    // File mtime (Unix ms) from the walker; NULL for virtual / derived
+    // nodes that carry no backing file. Round-tripped by `rowToNode`.
+    modifiedAtMs: node.modifiedAtMs ?? null
   };
 }
 function projectAnnotationColumns(node) {
@@ -9666,10 +9525,10 @@ var BumpCommand = class extends SmCommand {
     );
     if (!persisted) {
       this.printer.error(
-        tx(BUMP_TEXTS.nodeNotFound, {
+        tx(BUMP_TEXTS2.nodeNotFound, {
           glyph: ansi.red("\u2715"),
           nodePath: this.nodePath ?? "<pending>",
-          hint: ansi.dim(BUMP_TEXTS.nodeNotFoundHint)
+          hint: ansi.dim(BUMP_TEXTS2.nodeNotFoundHint)
         })
       );
       return ExitCode.NotFound;
@@ -9689,27 +9548,27 @@ var BumpCommand = class extends SmCommand {
     const errGlyph = ansi.red("\u2715");
     if (this.pending && this.nodePath !== void 0) {
       this.printer.error(
-        tx(BUMP_TEXTS.nodeAndPendingMutex, {
+        tx(BUMP_TEXTS2.nodeAndPendingMutex, {
           glyph: errGlyph,
-          hint: ansi.dim(BUMP_TEXTS.nodeAndPendingMutexHint)
+          hint: ansi.dim(BUMP_TEXTS2.nodeAndPendingMutexHint)
         })
       );
       return ExitCode.Error;
     }
     if (!this.pending && this.nodePath === void 0) {
       this.printer.error(
-        tx(BUMP_TEXTS.noTargetSpecified, {
+        tx(BUMP_TEXTS2.noTargetSpecified, {
           glyph: errGlyph,
-          hint: ansi.dim(BUMP_TEXTS.noTargetSpecifiedHint)
+          hint: ansi.dim(BUMP_TEXTS2.noTargetSpecifiedHint)
         })
       );
       return ExitCode.Error;
     }
     if (this.staged && !this.pending) {
       this.printer.error(
-        tx(BUMP_TEXTS.stagedRequiresPending, {
+        tx(BUMP_TEXTS2.stagedRequiresPending, {
           glyph: errGlyph,
-          hint: ansi.dim(BUMP_TEXTS.stagedRequiresPendingHint)
+          hint: ansi.dim(BUMP_TEXTS2.stagedRequiresPendingHint)
         })
       );
       return ExitCode.Error;
@@ -9768,10 +9627,10 @@ var BumpCommand = class extends SmCommand {
     const node = nodes.find((n) => n.path === this.nodePath);
     if (!node) {
       this.printer.error(
-        tx(BUMP_TEXTS.nodeNotFound, {
+        tx(BUMP_TEXTS2.nodeNotFound, {
           glyph: ansi.red("\u2715"),
           nodePath: this.nodePath,
-          hint: ansi.dim(BUMP_TEXTS.nodeNotFoundHint)
+          hint: ansi.dim(BUMP_TEXTS2.nodeNotFoundHint)
         })
       );
       return ExitCode.NotFound;
@@ -9793,9 +9652,9 @@ var BumpCommand = class extends SmCommand {
     const errGlyph = ansi.red("\u2715");
     if (item.status === "error") {
       this.printer.error(
-        tx(BUMP_TEXTS.bumpFailed, {
+        tx(BUMP_TEXTS2.bumpFailed, {
           glyph: errGlyph,
-          message: tx(BUMP_TEXTS.resolveAbsPathFailed, {
+          message: tx(BUMP_TEXTS2.resolveAbsPathFailed, {
             nodePath: node.path,
             message: item.message
           })
@@ -9805,10 +9664,10 @@ var BumpCommand = class extends SmCommand {
     }
     if (item.status === "refused") {
       this.printer.error(
-        tx(BUMP_TEXTS.refusedFresh, {
+        tx(BUMP_TEXTS2.refusedFresh, {
           glyph: errGlyph,
           nodePath: node.path,
-          hint: ansi.dim(BUMP_TEXTS.refusedFreshHint)
+          hint: ansi.dim(BUMP_TEXTS2.refusedFreshHint)
         })
       );
       return ExitCode.Error;
@@ -9835,9 +9694,9 @@ var BumpCommand = class extends SmCommand {
     if (applied.error !== void 0) {
       if (applied.error instanceof EConsentRequiredError) throw applied.error;
       this.printer.error(
-        tx(BUMP_TEXTS.bumpFailed, {
+        tx(BUMP_TEXTS2.bumpFailed, {
           glyph: ansi.red("\u2715"),
-          message: tx(BUMP_TEXTS.storeFailedDetail, {
+          message: tx(BUMP_TEXTS2.storeFailedDetail, {
             path: applied.sidecarPath ?? sidecarPathFor(item.absPath),
             message: formatErrorMessage(applied.error)
           })
@@ -9854,11 +9713,11 @@ var BumpCommand = class extends SmCommand {
     const version = item.report.version ?? 1;
     if (item.report.createdSidecar === true) {
       this.printer.data(
-        tx(BUMP_TEXTS.bumpedCreated, { glyph: okGlyph, sidecarPath, nodePath: node.path, version })
+        tx(BUMP_TEXTS2.bumpedCreated, { glyph: okGlyph, sidecarPath, nodePath: node.path, version })
       );
     } else {
       this.printer.data(
-        tx(BUMP_TEXTS.bumped, { glyph: okGlyph, nodePath: node.path, version })
+        tx(BUMP_TEXTS2.bumped, { glyph: okGlyph, nodePath: node.path, version })
       );
     }
     return ExitCode.Ok;
@@ -9870,7 +9729,7 @@ var BumpCommand = class extends SmCommand {
     const stale = nodes.filter((n) => n.sidecar?.present === true && n.sidecar.status !== null && n.sidecar.status !== "fresh").sort((a, b) => a.path.localeCompare(b.path));
     if (stale.length === 0) return this.#renderEmptyPending();
     if (!this.json) {
-      this.printer.info(tx(BUMP_TEXTS.pendingBanner, { count: stale.length }));
+      this.printer.info(tx(BUMP_TEXTS2.pendingBanner, { count: stale.length }));
     }
     const plan = computeBumpPlan(stale, { cwd, force: this.force });
     const outcomes = await this.#executePending(plan, cwd, ansi);
@@ -9888,19 +9747,19 @@ var BumpCommand = class extends SmCommand {
     const gitOk = ensureGitForStaged(cwd);
     if (gitOk === "no-repo") {
       this.printer.error(
-        tx(BUMP_TEXTS.notInGitRepo, {
+        tx(BUMP_TEXTS2.notInGitRepo, {
           glyph: errGlyph,
           cwd,
-          hint: ansi.dim(BUMP_TEXTS.notInGitRepoHint)
+          hint: ansi.dim(BUMP_TEXTS2.notInGitRepoHint)
         })
       );
       return ExitCode.NotFound;
     }
     if (gitOk === "no-binary") {
       this.printer.error(
-        tx(BUMP_TEXTS.gitBinaryMissing, {
+        tx(BUMP_TEXTS2.gitBinaryMissing, {
           glyph: errGlyph,
-          hint: ansi.dim(BUMP_TEXTS.gitBinaryMissingHint)
+          hint: ansi.dim(BUMP_TEXTS2.gitBinaryMissingHint)
         })
       );
       return ExitCode.Error;
@@ -9938,7 +9797,7 @@ var BumpCommand = class extends SmCommand {
       return {
         nodePath: item.nodePath,
         status: "error",
-        message: tx(BUMP_TEXTS.storeFailedDetail, {
+        message: tx(BUMP_TEXTS2.storeFailedDetail, {
           path: applied.sidecarPath ?? sidecarPathFor(item.absPath),
           message: formatErrorMessage(applied.error)
         })
@@ -9958,11 +9817,11 @@ var BumpCommand = class extends SmCommand {
     const addErr = stageSidecar(cwd, sidecarPath);
     if (addErr === null || this.json) return;
     this.printer.warn(
-      tx(BUMP_TEXTS.gitAddFailed, {
+      tx(BUMP_TEXTS2.gitAddFailed, {
         glyph: ansi.yellow("\u26A0"),
         path: sidecarPath,
         message: addErr,
-        hint: ansi.dim(tx(BUMP_TEXTS.gitAddFailedHint, { path: sidecarPath }))
+        hint: ansi.dim(tx(BUMP_TEXTS2.gitAddFailedHint, { path: sidecarPath }))
       })
     );
   }
@@ -9982,7 +9841,7 @@ var BumpCommand = class extends SmCommand {
       this.printer.data(JSON.stringify(empty) + "\n");
       return ExitCode.Ok;
     }
-    this.printer.data(BUMP_TEXTS.pendingNone);
+    this.printer.data(BUMP_TEXTS2.pendingNone);
     return ExitCode.Ok;
   }
   // Complexity is from per-status rendering (4 status values) plus
@@ -10013,24 +9872,24 @@ var BumpCommand = class extends SmCommand {
     for (const o of outcomes) {
       if (o.status === "bumped") {
         this.printer.data(
-          tx(BUMP_TEXTS.bumpedItem, {
+          tx(BUMP_TEXTS2.bumpedItem, {
             nodePath: o.nodePath,
             version: o.version ?? 0,
             createdSuffix: o.createdSidecar === true ? " (new sidecar)" : ""
           })
         );
       } else if (o.status === "refused") {
-        this.printer.data(tx(BUMP_TEXTS.refusedItem, { nodePath: o.nodePath }));
+        this.printer.data(tx(BUMP_TEXTS2.refusedItem, { nodePath: o.nodePath }));
       } else if (o.status === "skipped") {
         this.printer.data(
-          tx(BUMP_TEXTS.skippedItem, {
+          tx(BUMP_TEXTS2.skippedItem, {
             nodePath: o.nodePath,
             reason: o.reason ?? "unknown"
           })
         );
       } else {
         this.printer.data(
-          tx(BUMP_TEXTS.errorItem, {
+          tx(BUMP_TEXTS2.errorItem, {
             nodePath: o.nodePath,
             message: o.message ?? ""
           })
@@ -10038,7 +9897,7 @@ var BumpCommand = class extends SmCommand {
       }
     }
     this.printer.info(
-      tx(BUMP_TEXTS.pendingSummary, {
+      tx(BUMP_TEXTS2.pendingSummary, {
         bumped: counts.bumped,
         refused: counts.refused,
         skipped: counts.skipped,
@@ -11091,29 +10950,39 @@ function isPluginLocked(idOrQualified) {
 }
 
 // kernel/config/plugin-resolver.ts
-function resolvePluginEnabled(pluginId, cfg, dbOverrides) {
+var SHIPS_DISABLED = /* @__PURE__ */ new Set([
+  "experimental",
+  "deprecated"
+]);
+function installedDefaultEnabled(stability) {
+  return stability === void 0 || !SHIPS_DISABLED.has(stability);
+}
+function resolvePluginEnabled(pluginId, cfg, dbOverrides, installedDefault = true) {
   if (isPluginLocked(pluginId)) return true;
   if (dbOverrides.has(pluginId)) return dbOverrides.get(pluginId) === true;
   const settingsEntry = cfg.plugins[pluginId];
   if (settingsEntry?.enabled !== void 0) return settingsEntry.enabled;
-  return true;
+  return installedDefault;
 }
 function makeEnabledResolver(cfg, dbOverrides) {
-  return (pluginId) => resolvePluginEnabled(pluginId, cfg, dbOverrides);
+  return (pluginId, installedDefault) => resolvePluginEnabled(pluginId, cfg, dbOverrides, installedDefault);
 }
 
 // core/runtime/plugin-runtime/resolver.ts
-function defaultResolveEnabled(_id) {
-  return true;
+function defaultResolveEnabled(_id, installedDefault = true) {
+  return installedDefault;
 }
 function isBuiltInExtensionEnabled(plugin, ext, resolveEnabled) {
-  return isPluginEntryEnabled(plugin, ext.id, resolveEnabled);
+  return isPluginEntryEnabled(plugin, ext.id, resolveEnabled, ext.stability);
 }
-function isPluginEntryEnabled(plugin, extId, resolveEnabled) {
-  return resolveEnabled(qualifiedExtensionId(plugin.id, extId));
+function isPluginEntryEnabled(plugin, extId, resolveEnabled, stability) {
+  return resolveEnabled(qualifiedExtensionId(plugin.id, extId), installedDefaultEnabled(stability));
 }
 function isPluginExtensionEnabled(ext, resolveEnabled) {
-  return resolveEnabled(qualifiedExtensionId(ext.pluginId, ext.id));
+  return resolveEnabled(
+    qualifiedExtensionId(ext.pluginId, ext.id),
+    installedDefaultEnabled(ext.stability)
+  );
 }
 async function buildEnabledResolver(ctx) {
   const { effective: cfg } = loadConfig({ ...ctx });
@@ -11311,11 +11180,11 @@ async function* walkContent(roots, options) {
   const extensions = options.extensions;
   const sizeLimit = buildSizeLimit(options);
   for (const root of roots) {
-    for await (const file of walkRoot(root, root, filter, extensions, sizeLimit)) {
-      const relPath = relative2(root, file).split(sep3).join("/");
+    for await (const entry of walkRoot(root, root, filter, extensions, sizeLimit)) {
+      const relPath = relative2(root, entry.full).split(sep3).join("/");
       let raw;
       try {
-        raw = await readFile(file, "utf8");
+        raw = await readFile(entry.full, "utf8");
       } catch {
         continue;
       }
@@ -11325,6 +11194,9 @@ async function* walkContent(roots, options) {
         body: parsed.body,
         frontmatterRaw: parsed.frontmatterRaw,
         frontmatter: parsed.frontmatter,
+        // File mtime from the TOCTOU `lstat` (zero extra syscalls).
+        // Threaded onto the persisted `Node` as `modifiedAtMs`.
+        modifiedAtMs: entry.modifiedAtMs,
         // Audit L1: forward parser diagnostics (e.g. malformed YAML)
         // through the IRawNode surface so the orchestrator can
         // convert them into warn-level kernel `Issue` rows. Omitted
@@ -11365,7 +11237,7 @@ async function* walkRoot(root, current, filter, extensions, sizeLimit) {
           sizeLimit.onOversizedFile?.({ path: rel, bytes: s.size });
           continue;
         }
-        yield full;
+        yield { full, modifiedAtMs: Math.round(s.mtimeMs) };
       } catch {
       }
     }
@@ -11447,8 +11319,8 @@ function bucketLoaded(loaded, runtime, pluginOrder) {
       extractor: runtime.extensions.extractors,
       analyzer: runtime.extensions.analyzers,
       formatter: runtime.extensions.formatters,
-      hook: runtime.extensions.hooks
-      // `action` intentionally absent, see docstring.
+      hook: runtime.extensions.hooks,
+      action: runtime.extensions.actions
     });
     runtime.manifests.push({
       id: ext.id,
@@ -11563,7 +11435,7 @@ async function loadPluginRuntime(opts = {}) {
   const loader = createPluginLoader(loaderOpts);
   const discovered = await loader.discoverAndLoadAll();
   const runtime = {
-    extensions: { providers: [], extractors: [], analyzers: [], formatters: [], hooks: [] },
+    extensions: { providers: [], extractors: [], analyzers: [], formatters: [], hooks: [], actions: [] },
     annotationContributions: [],
     viewContributions: [],
     manifests: [],
@@ -11618,7 +11490,7 @@ function enforceRootExclusivity(catalog) {
 }
 function emptyPluginRuntime() {
   const runtime = {
-    extensions: { providers: [], extractors: [], analyzers: [], formatters: [], hooks: [] },
+    extensions: { providers: [], extractors: [], analyzers: [], formatters: [], hooks: [], actions: [] },
     annotationContributions: [],
     viewContributions: [],
     manifests: [],
@@ -11636,50 +11508,59 @@ function emptyPluginRuntime() {
 function collectRegisteredContributionKeys(composed) {
   const keys = /* @__PURE__ */ new Set();
   if (!composed) return keys;
-  for (const ext of [...composed.extractors, ...composed.analyzers]) {
-    const raw = ext.ui;
-    if (typeof raw !== "object" || raw === null) continue;
-    for (const [contributionId, value] of Object.entries(raw)) {
-      if (typeof value !== "object" || value === null) continue;
-      keys.add(`${ext.pluginId}/${ext.id}/${contributionId}`);
-    }
+  for (const ext of [...composed.extractors, ...composed.analyzers, ...composed.actions ?? []]) {
+    addContributionKeysForExtension(ext, keys);
   }
   return keys;
 }
+function addContributionKeysForExtension(ext, keys) {
+  const raw = ext.ui;
+  if (typeof raw !== "object" || raw === null) return;
+  for (const [contributionId, value] of Object.entries(raw)) {
+    if (typeof value !== "object" || value === null) continue;
+    keys.add(`${ext.pluginId}/${ext.id}/${contributionId}`);
+  }
+}
 function filterBuiltInManifests(manifests, resolveEnabled) {
   const pluginById = /* @__PURE__ */ new Map();
   for (const plugin of builtInPlugins) pluginById.set(plugin.id, plugin);
   return manifests.filter((m) => {
     const plugin = pluginById.get(m.pluginId);
     if (!plugin) return true;
-    return isPluginEntryEnabled(plugin, m.id, resolveEnabled);
+    return isPluginEntryEnabled(plugin, m.id, resolveEnabled, m.stability);
   });
 }
 
 // core/runtime/plugin-runtime/composer.ts
 function composeScanExtensions(opts) {
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
+  const resolveSettings = opts.resolveSettings;
   const providers = [];
   const extractors = [];
   const analyzers = [];
   const hooks = [];
+  const actions = [];
   if (!opts.noBuiltIns) {
     accumulateBuiltInScanExtensions(
-      { providers, extractors, analyzers, hooks },
-      resolveEnabled
+      { providers, extractors, analyzers, hooks, actions },
+      resolveEnabled,
+      resolveSettings
     );
   }
   for (const ext of opts.pluginRuntime.extensions.providers) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) providers.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) providers.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.extractors) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) extractors.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) extractors.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.analyzers) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) analyzers.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) analyzers.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.hooks) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) hooks.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) hooks.push(withResolvedSettings(ext, resolveSettings));
+  }
+  for (const ext of opts.pluginRuntime.extensions.actions) {
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) actions.push(ext);
   }
   const finalProviders = opts.killSwitches?.providers === true ? [] : providers;
   const finalExtractors = opts.killSwitches?.extractors === true ? [] : extractors;
@@ -11691,27 +11572,33 @@ function composeScanExtensions(opts) {
     providers: finalProviders,
     extractors: finalExtractors,
     analyzers: finalAnalyzers,
-    hooks
+    hooks,
+    actions
   };
 }
-function accumulateBuiltInScanExtensions(buckets, resolveEnabled) {
+function withResolvedSettings(ext, resolveSettings) {
+  if (!resolveSettings) return ext;
+  return { ...ext, resolvedSettings: resolveSettings(ext) };
+}
+function accumulateBuiltInScanExtensions(buckets, resolveEnabled, resolveSettings) {
   for (const plugin of builtInPlugins) {
     for (const ext of plugin.extensions) {
       if (!isBuiltInExtensionEnabled(plugin, ext, resolveEnabled)) continue;
       switch (ext.kind) {
         case "provider":
-          buckets.providers.push(ext);
+          buckets.providers.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "extractor":
-          buckets.extractors.push(ext);
+          buckets.extractors.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "analyzer":
-          buckets.analyzers.push(ext);
+          buckets.analyzers.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "hook":
-          buckets.hooks.push(ext);
+          buckets.hooks.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "action":
+          buckets.actions.push(ext);
           break;
         case "formatter":
           break;
@@ -11726,18 +11613,19 @@ function accumulateBuiltInScanExtensions(buckets, resolveEnabled) {
 function composeFormatters(opts) {
   const noBuiltIns = opts.noBuiltIns ?? false;
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
+  const resolveSettings = opts.resolveSettings;
   const out = [];
   if (!noBuiltIns) {
     for (const plugin of builtInPlugins) {
       for (const ext of plugin.extensions) {
         if (ext.kind !== "formatter") continue;
         if (!isBuiltInExtensionEnabled(plugin, ext, resolveEnabled)) continue;
-        out.push(ext);
+        out.push(withResolvedSettings(ext, resolveSettings));
       }
     }
   }
   for (const ext of opts.pluginRuntime.extensions.formatters) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) out.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) out.push(withResolvedSettings(ext, resolveSettings));
   }
   return out;
 }
@@ -14924,6 +14812,9 @@ var GraphCommand = class extends SmCommand {
         nodes: scan.nodes,
         links: scan.links,
         issues: scan.issues,
+        // Resolved settings of the formatter (empty when the formatter
+        // declares none, or when the composer did not populate them).
+        settings: formatter.resolvedSettings ?? {},
         // Pass the full persisted scan so format-specific renderers
         // that mirror a `ScanResult` envelope (today: built-in `json`)
         // can emit it verbatim without re-deriving fields like
@@ -15935,12 +15826,12 @@ function emitExtensionError(emitter, qualifiedId2, nodePath, data) {
 }
 function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enrichNode, emitContribution, emitSignal, emitNode, store) {
   const scope = extractor.scope ?? "both";
-  const settings = extractor.resolvedSettings ?? {};
+  const settings2 = extractor.resolvedSettings ?? {};
   return {
     node,
     body: scope === "frontmatter" ? "" : body,
     frontmatter: scope === "body" ? {} : frontmatter,
-    settings,
+    settings: settings2,
     emitLink,
     enrichNode,
     emitContribution,
@@ -16163,8 +16054,83 @@ function isExternalUrlLink(link) {
   return EXTERNAL_URL_SCHEME_RE.test(link.target);
 }
 
+// kernel/orchestrator/action-projections.ts
+function runActionProjections(actions, nodes, links, emitter) {
+  const contributions = [];
+  const contributionErrors = [];
+  const validators = loadSchemaValidators();
+  for (const action of actions) {
+    if (typeof action.project !== "function") continue;
+    const qualifiedId2 = qualifiedExtensionId(action.pluginId, action.id);
+    const declaredContributions = readDeclaredContributionRefs(action);
+    const emitContribution = (nodePath, ref, payload) => {
+      const declared = typeof ref === "object" && ref !== null ? declaredContributions.get(ref) : void 0;
+      if (!declared) {
+        const message = tx(ORCHESTRATOR_TEXTS.extensionErrorContributionUndeclaredRef, {
+          extractorId: qualifiedId2,
+          nodePath
+        });
+        emitExtensionError(emitter, qualifiedId2, nodePath, {
+          phase: "emitContribution",
+          reason: "undeclared-contribution-ref",
+          message
+        });
+        contributionErrors.push({
+          pluginId: action.pluginId,
+          extensionId: action.id,
+          nodePath,
+          reason: "undeclared-contribution-ref",
+          message,
+          emittedAt: Date.now()
+        });
+        return;
+      }
+      const result = validators.validateContributionPayload(declared.slot, payload);
+      if (!result.ok) {
+        const message = tx(ORCHESTRATOR_TEXTS.extensionErrorContributionPayloadInvalid, {
+          extractorId: qualifiedId2,
+          contributionId: declared.id,
+          nodePath,
+          slot: declared.slot,
+          errors: result.errors
+        });
+        emitExtensionError(emitter, qualifiedId2, nodePath, {
+          phase: "emitContribution",
+          contributionId: declared.id,
+          slot: declared.slot,
+          reason: result.errors,
+          message
+        });
+        contributionErrors.push({
+          pluginId: action.pluginId,
+          extensionId: action.id,
+          nodePath,
+          reason: result.errors,
+          message,
+          contributionId: declared.id,
+          slot: declared.slot,
+          emittedAt: Date.now()
+        });
+        return;
+      }
+      contributions.push({
+        pluginId: action.pluginId,
+        extensionId: action.id,
+        nodePath,
+        contributionId: declared.id,
+        slot: declared.slot,
+        payload,
+        emittedAt: Date.now()
+      });
+    };
+    const ctx = { nodes, links, emitContribution };
+    action.project(ctx);
+  }
+  return { contributions, contributionErrors };
+}
+
 // kernel/orchestrator/analyzers.ts
-async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, signals, seedIssues = []) {
+async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, brokenLinks, signals, seedIssues = []) {
   const issues = [...seedIssues];
   const contributions = [];
   const contributionErrors = [];
@@ -16241,6 +16207,10 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
     const emitted = await analyzer.evaluate({
       nodes,
       links: internalLinks,
+      // `settings` is always populated (possibly empty) so analyzers can
+      // read `ctx.settings.<id>` without a presence check. The composer
+      // populated `resolvedSettings` on each composed analyzer.
+      settings: analyzer.resolvedSettings ?? {},
       orphanSidecars: analyzerOrphans,
       sidecarRoots,
       annotationContributions,
@@ -16254,6 +16224,7 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
       ...referenceablePaths ? { referenceablePaths } : {},
       ...cwd ? { cwd } : {},
       ...reservedNodePaths ? { reservedNodePaths } : {},
+      ...brokenLinks ? { brokenLinks } : {},
       ...signals && signals.length > 0 ? { signals } : {},
       emitContribution
     });
@@ -16952,6 +16923,7 @@ function buildNode(args2) {
     externalRefsCount: 0,
     frontmatter: args2.frontmatter
   };
+  if (args2.modifiedAtMs !== void 0) node.modifiedAtMs = args2.modifiedAtMs;
   if (args2.encoder) {
     node.tokens = countTokens(args2.encoder, args2.frontmatterRaw, args2.body);
   }
@@ -17067,7 +17039,10 @@ function buildFreshNodeAndValidateFrontmatter(opts) {
     frontmatter: opts.raw.frontmatter,
     bodyHash: opts.bodyHash,
     frontmatterHash: opts.frontmatterHash,
-    encoder: opts.encoder
+    encoder: opts.encoder,
+    // Thread the walker's mtime through; `buildNode` only attaches it
+    // when present, so virtual / walk()-without-stat sources stay absent.
+    modifiedAtMs: opts.raw.modifiedAtMs
   });
   const frontmatterIssues = [];
   if (opts.raw.parseIssues && opts.raw.parseIssues.length > 0) {
@@ -17472,6 +17447,7 @@ async function runScanInternal(_kernel, options) {
   walked.signals = resolved.resolvedSignals;
   const postWalkCtx = buildPostWalkTransformCtx(exts.providers, walked.nodes, activeProviderId);
   walked.internalLinks = applyPostWalkTransforms(walked.internalLinks, walked.nodes, postWalkCtx);
+  const brokenLinks = collectBrokenLinks(walked.internalLinks, walked.nodes, postWalkCtx);
   recomputeLinkCounts(walked.nodes, walked.internalLinks);
   recomputeExternalRefsCount(walked.nodes, walked.externalLinks, walked.cachedPaths);
   await dispatchExtractorCompleted(exts.extractors, emitter, hookDispatcher);
@@ -17493,6 +17469,7 @@ async function runScanInternal(_kernel, options) {
     emitter,
     hookDispatcher,
     postWalkCtx.reservedNodePaths,
+    brokenLinks,
     walked.signals,
     // Seed the accumulator with orchestrator-emitted frontmatter
     // issues so the aggregate phase (`core/issue-counter`) counts
@@ -17501,6 +17478,13 @@ async function runScanInternal(_kernel, options) {
     walked.frontmatterIssues
   );
   mergeAnalyzerEmissions(walked, analyzerResult, exts.analyzers);
+  const projectionResult = runActionProjections(
+    exts.actions ?? [],
+    walked.nodes,
+    walked.internalLinks,
+    emitter
+  );
+  mergeActionProjections(walked, projectionResult, exts.actions);
   const issues = analyzerResult.issues;
   const silenced = options.ignoreFilter ? (path) => options.ignoreFilter.ignores(path) : void 0;
   const renameOps = prior ? detectRenamesAndOrphans(prior, walked.nodes, issues, silenced) : [];
@@ -17609,6 +17593,16 @@ function mergeAnalyzerEmissions(walked, analyzerResult, analyzers) {
     }
   }
 }
+function mergeActionProjections(walked, projectionResult, actions) {
+  for (const c of projectionResult.contributions) walked.contributions.push(c);
+  for (const e of projectionResult.contributionErrors) walked.contributionErrors.push(e);
+  for (const action of actions ?? []) {
+    if (action.ui === void 0 || typeof action.project !== "function") continue;
+    for (const node of walked.nodes) {
+      walked.freshlyRunTuples.add(`${action.pluginId}\0${action.id}\0${node.path}`);
+    }
+  }
+}
 function buildScanStats(walked, issues, start) {
   return {
     // `filesSkipped` is "files walked but not classified by any
@@ -17920,6 +17914,159 @@ function findOrphanJobFiles(jobsDir, referencedPaths) {
   return { orphanFilePaths: orphans, referencedCount: referencedPaths.size };
 }
 
+// core/config/plugin-settings.ts
+var defaultWarn = (message) => log.warn(message);
+function resolveExtensionSettings(manifest, config, onWarn = defaultWarn) {
+  const declarations = manifest.settings;
+  if (!declarations || Object.keys(declarations).length === 0) return {};
+  const overrides = readSettingsOverrides(config, manifest.pluginId, manifest.id);
+  const resolved = {};
+  for (const [settingId, declaration] of Object.entries(declarations)) {
+    const outcome = resolveOneSetting(manifest, settingId, declaration, overrides, onWarn);
+    if (outcome.hasValue) resolved[settingId] = outcome.value;
+  }
+  return resolved;
+}
+function resolveOneSetting(manifest, settingId, declaration, overrides, onWarn) {
+  const fallback = declarationDefault(declaration);
+  const toFallback = () => fallback !== void 0 ? { hasValue: true, value: fallback } : { hasValue: false };
+  if (!Object.prototype.hasOwnProperty.call(overrides, settingId)) return toFallback();
+  const candidate = overrides[settingId];
+  const check = validateSettingValue(declaration, candidate);
+  if (check.ok) return { hasValue: true, value: candidate };
+  onWarn(
+    `Setting '${settingId}' for extension '${manifest.pluginId}/${manifest.id}' is invalid (${check.reason}); falling back to the declared default.`
+  );
+  return toFallback();
+}
+function buildSettingsResolver(config, onWarn = defaultWarn) {
+  return (ext) => resolveExtensionSettings(ext, config, onWarn);
+}
+function declarationDefault(declaration) {
+  return "default" in declaration ? declaration.default : void 0;
+}
+function readSettingsOverrides(config, pluginId, extId) {
+  const entry = config.plugins?.[pluginId];
+  const ext = entry?.extensions?.[extId];
+  const settings2 = ext?.settings;
+  if (settings2 && typeof settings2 === "object" && !Array.isArray(settings2)) {
+    return settings2;
+  }
+  return {};
+}
+var OK = { ok: true, reason: "" };
+function fail2(reason) {
+  return { ok: false, reason };
+}
+function validateSettingValue(declaration, value) {
+  switch (declaration.type) {
+    case "string-list":
+      return validateStringList(value, declaration.min, declaration.max, declaration.itemMaxLength);
+    case "single-string":
+      return validateSingleString(value, declaration.minLength, declaration.maxLength, declaration.pattern);
+    case "boolean-flag":
+      return typeof value === "boolean" ? OK : fail2("expected a boolean");
+    case "integer":
+      return validateInteger(value, declaration.min, declaration.max);
+    case "number":
+      return validateNumber(value, declaration.min, declaration.max);
+    case "enum-pick":
+      return validateEnumPick(value, declaration.options.map((o) => o.value));
+    case "enum-multipick":
+      return validateEnumMultipick(value, declaration.options.map((o) => o.value), declaration.min, declaration.max);
+    case "path-glob":
+      return validatePathGlob(value, declaration.multiple === true);
+    case "regex":
+      return validateRegex(value, declaration.flags);
+    case "secret":
+      return typeof value === "string" ? OK : fail2("expected a string");
+    case "key-value-list":
+      return validateKeyValueList(value, declaration.min, declaration.max);
+    default: {
+      const _exhaustive = declaration;
+      return fail2(`unknown input-type: ${String(_exhaustive.type)}`);
+    }
+  }
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function validateStringList(value, min, max, itemMaxLength) {
+  if (!isStringArray(value)) return fail2("expected an array of strings");
+  if (min !== void 0 && value.length < min) return fail2(`expected at least ${min} item(s)`);
+  if (max !== void 0 && value.length > max) return fail2(`expected at most ${max} item(s)`);
+  const cap = itemMaxLength ?? 256;
+  if (value.some((item) => item.length > cap)) return fail2(`item exceeds ${cap} characters`);
+  return OK;
+}
+function validateSingleString(value, minLength, maxLength, pattern) {
+  if (typeof value !== "string") return fail2("expected a string");
+  if (minLength !== void 0 && value.length < minLength) return fail2(`expected at least ${minLength} characters`);
+  if (maxLength !== void 0 && value.length > maxLength) return fail2(`expected at most ${maxLength} characters`);
+  return matchesPattern(value, pattern);
+}
+function matchesPattern(value, pattern) {
+  if (pattern === void 0) return OK;
+  let re;
+  try {
+    re = new RegExp(pattern);
+  } catch {
+    return OK;
+  }
+  return re.test(value) ? OK : fail2(`does not match pattern ${pattern}`);
+}
+function validateInteger(value, min, max) {
+  if (typeof value !== "number" || !Number.isInteger(value)) return fail2("expected an integer");
+  if (!Number.isSafeInteger(value)) return fail2("integer out of safe range");
+  if (min !== void 0 && value < min) return fail2(`expected >= ${min}`);
+  if (max !== void 0 && value > max) return fail2(`expected <= ${max}`);
+  return OK;
+}
+function validateNumber(value, min, max) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return fail2("expected a finite number");
+  if (min !== void 0 && value < min) return fail2(`expected >= ${min}`);
+  if (max !== void 0 && value > max) return fail2(`expected <= ${max}`);
+  return OK;
+}
+function validateEnumPick(value, allowed) {
+  if (typeof value !== "string") return fail2("expected a string");
+  if (!allowed.includes(value)) return fail2(`expected one of: ${allowed.join(", ")}`);
+  return OK;
+}
+function validateEnumMultipick(value, allowed, min, max) {
+  if (!isStringArray(value)) return fail2("expected an array of strings");
+  const allowedSet = new Set(allowed);
+  if (value.some((v) => !allowedSet.has(v))) return fail2(`every entry must be one of: ${allowed.join(", ")}`);
+  if (min !== void 0 && value.length < min) return fail2(`expected at least ${min} selection(s)`);
+  if (max !== void 0 && value.length > max) return fail2(`expected at most ${max} selection(s)`);
+  return OK;
+}
+function validatePathGlob(value, multiple) {
+  if (multiple) {
+    return isStringArray(value) ? OK : fail2("expected an array of glob strings");
+  }
+  return typeof value === "string" ? OK : fail2("expected a glob string");
+}
+function validateRegex(value, flags) {
+  if (typeof value !== "string") return fail2("expected a string");
+  try {
+    new RegExp(value, flags ?? "");
+  } catch (err) {
+    return fail2(`is not a compilable regex (${err instanceof Error ? err.message : String(err)})`);
+  }
+  return OK;
+}
+function validateKeyValueList(value, min, max) {
+  if (!Array.isArray(value)) return fail2("expected an array of { key, value } entries");
+  const wellShaped = value.every(
+    (entry) => entry !== null && typeof entry === "object" && typeof entry.key === "string" && typeof entry.value === "string"
+  );
+  if (!wellShaped) return fail2("every entry must be { key: string, value: string }");
+  if (min !== void 0 && value.length < min) return fail2(`expected at least ${min} entr(y/ies)`);
+  if (max !== void 0 && value.length > max) return fail2(`expected at most ${max} entr(y/ies)`);
+  return OK;
+}
+
 // core/runtime/i18n/progress-emitter.texts.ts
 var PROGRESS_EMITTER_TEXTS = {
   /**
@@ -18420,10 +18567,10 @@ async function runScanForCommand(opts) {
   const dbPath = resolveDbPath({ db: void 0, ...ctx });
   const kernel = createKernel();
   const pluginRuntime = await preparePluginRuntime(opts, opts.printer);
-  const extensions = registerExtensions(kernel, pluginRuntime, opts);
   const scanInputs = loadScanInputs(opts, ctx);
   if ("kind" in scanInputs) return scanInputs;
   const { cfg, ignoreFilter, strict, effectiveRoots } = scanInputs;
+  const extensions = registerExtensions(kernel, pluginRuntime, opts, cfg);
   let referenceablePaths;
   if (cfg.scan.referencePaths.length > 0) {
     const walk3 = walkReferencePaths(cfg.scan.referencePaths, ctx.cwd);
@@ -18519,10 +18666,11 @@ async function preparePluginRuntime(opts, printer) {
   pluginRuntime.emitWarnings(printer);
   return pluginRuntime;
 }
-function registerExtensions(kernel, pluginRuntime, opts) {
+function registerExtensions(kernel, pluginRuntime, opts, cfg) {
   const composeOpts = {
     noBuiltIns: opts.noBuiltIns,
-    pluginRuntime
+    pluginRuntime,
+    resolveSettings: buildSettingsResolver(cfg)
   };
   if (opts.killSwitches) composeOpts.killSwitches = opts.killSwitches;
   if (opts.resolveEnabledOverride) composeOpts.resolveEnabled = opts.resolveEnabledOverride;
@@ -20066,7 +20214,7 @@ async function findActiveOrphanIssues(adapter, predicate) {
     (issue) => ORPHAN_RULE_IDS.includes(issue.analyzerId) && predicate(issue)
   );
 }
-function isStringArray(v) {
+function isStringArray2(v) {
   return Array.isArray(v) && v.every((s) => typeof s === "string");
 }
 var OrphansCommand = class extends SmCommand {
@@ -20437,7 +20585,7 @@ var OrphansUndoRenameCommand = class extends SmCommand {
       return { ok: false, exitCode: ExitCode.NotFound };
     }
     const dataCandidates = issue.data ? issue.data["candidates"] : void 0;
-    if (!isStringArray(dataCandidates) || !dataCandidates.includes(this.from)) {
+    if (!isStringArray2(dataCandidates) || !dataCandidates.includes(this.from)) {
       this.printer.error(
         tx(ORPHANS_TEXTS.undoAmbiguousNotInCandidates, { glyph: errGlyph, from: this.from })
       );
@@ -20513,6 +20661,17 @@ var PLUGINS_TEXTS = {
   qualifiedIdNotFoundHint: "Run `sm plugins list` to see what each plugin ships.",
   qualifiedIdUnknownPlugin: "{{glyph}}  Qualified extension id references unknown plugin: {{pluginId}}\n   {{hint}}\n",
   qualifiedIdUnknownPluginHint: "Run `sm plugins list` for known plugin ids.",
+  // --- verb-shape redirects (show is extension-only; list is plugin-only) ---
+  // `sm plugins show` takes a qualified `<plugin>/<ext>` id and renders a
+  // single extension. A bare plugin id is the wrong granularity, redirect
+  // to `sm plugins list <id>`, which renders the whole plugin.
+  showBareId: '{{glyph}}  `sm plugins show` needs a qualified `<plugin>/<ext>` id; "{{id}}" is a plugin.\n   {{hint}}\n',
+  showBareIdHint: "Run `sm plugins list {{id}}` for the plugin and its extensions, then `sm plugins show {{id}}/<ext>` for one.",
+  // `sm plugins list <id>` takes a bare plugin id. A qualified
+  // `<plugin>/<ext>` id targets a single extension, redirect to
+  // `sm plugins show`.
+  listQualifiedId: "{{glyph}}  `sm plugins list` takes a plugin id, not a qualified `<plugin>/<ext>` id: {{id}}\n   {{hint}}\n",
+  listQualifiedIdHint: "Run `sm plugins show {{id}}` for that extension, or `sm plugins list {{pluginId}}` for the whole plugin.",
   // Spec § A.10, `applicableKinds` filter on Extractors. When an extractor
   // declares a kind that no installed Provider emits, the load succeeds
   // (the Provider may arrive later) but `sm plugins doctor` surfaces a
@@ -20653,7 +20812,7 @@ var PLUGINS_TEXTS = {
    * (declared or defaulted) renders no tag.
    */
   stabilityTag: " ({{stability}})",
-  listTipShow: "\nTip: `sm plugins show <id>` for kinds, versions, and per-extension status.\n",
+  listTipShow: "\nTip: `sm plugins list <id>` for a plugin's extensions (kinds, versions, per-extension status), `sm plugins show <plugin>/<ext>` for one extension.\n",
   /** Show command, built-in header (no version row, no path). */
   detailHeaderBuiltIn: "  {{glyph}}  {{id}}   {{source}}   {{count}} extension{{plural}}\n",
   /**
@@ -20805,7 +20964,7 @@ function extensionRowFromBuiltIn(ext, plugin, resolveEnabled) {
     id: ext.id,
     kind: ext.kind,
     version: ext.version,
-    enabled: resolveEnabled(qualifiedExtensionId(plugin.id, ext.id)),
+    enabled: resolveEnabled(qualifiedExtensionId(plugin.id, ext.id), installedDefaultEnabled(ext.stability)),
     description: ext.description ?? ""
   };
   if (ext.stability !== void 0) row.stability = ext.stability;
@@ -20822,6 +20981,43 @@ function omitModule(key, value) {
   const tag = value[Symbol.toStringTag];
   return tag === "Module" ? void 0 : value;
 }
+function pluginCatalogue(plugins) {
+  const out = [];
+  for (const plugin of builtInPlugins) {
+    out.push({ id: plugin.id, extensionIds: plugin.extensions.map((e) => e.id) });
+  }
+  for (const p of plugins) {
+    out.push({ id: p.id, extensionIds: p.extensions?.map((e) => e.id) ?? [] });
+  }
+  return out;
+}
+function parseQualifiedExtensionId(id, catalogue) {
+  const [pluginId, extId, ...rest] = id.split("/");
+  if (!pluginId || !extId || rest.length > 0) return { ok: false, reason: "malformed" };
+  const plugin = catalogue.find((p) => p.id === pluginId);
+  if (!plugin) return { ok: false, reason: "unknown-plugin", pluginId };
+  if (!plugin.extensionIds.includes(extId)) {
+    return { ok: false, reason: "unknown-extension", pluginId, extId };
+  }
+  return { ok: true, pluginId, extId };
+}
+function renderQualifiedIdError(result, rawId, ansi) {
+  const glyph = ansi.red(PLUGINS_TEXTS.rowGlyphOff);
+  if (result.reason === "unknown-extension") {
+    return tx(PLUGINS_TEXTS.qualifiedIdNotFound, {
+      glyph,
+      id: sanitizeForTerminal(rawId),
+      pluginId: sanitizeForTerminal(result.pluginId ?? ""),
+      extId: sanitizeForTerminal(result.extId ?? ""),
+      hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdNotFoundHint)
+    });
+  }
+  return tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
+    glyph,
+    pluginId: sanitizeForTerminal(result.reason === "unknown-plugin" ? result.pluginId ?? rawId : rawId),
+    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
+  });
+}
 function wrapText(text, maxWidth) {
   const words = text.split(/\s+/).filter((w) => w.length > 0);
   if (words.length === 0) return [];
@@ -20845,14 +21041,24 @@ var PluginsListCommand = class extends SmCommand {
   static paths = [["plugins", "list"]];
   static usage = Command22.Usage({
     category: "Plugins",
-    description: "List discovered plugins and their load status.",
-    details: "Scans <cwd>/.skill-map/plugins (or --plugin-dir <path>). Built-in plugins (claude, core) are listed alongside user plugins."
+    description: "List discovered plugins, or one plugin's extensions.",
+    details: `
+      No id: scans <cwd>/.skill-map/plugins (or --plugin-dir <path>) and
+      lists every plugin (built-in + user) with status, one row each.
+      With a bare plugin id: renders that plugin's manifest and its
+      extensions (kind / version / per-extension status). A qualified
+      \`<plugin>/<ext>\` id is rejected with a redirect to \`sm plugins show\`.
+    `
   });
+  id = Option21.String({ required: false });
   pluginDir = Option21.String("--plugin-dir", { required: false });
   async run() {
     const plugins = await loadAll({ pluginDir: this.pluginDir });
     const resolveEnabled = await buildResolver();
     const builtIns2 = builtInRows(resolveEnabled);
+    if (this.id !== void 0) {
+      return this.renderPluginDetailById(this.id, builtIns2, plugins);
+    }
     if (this.json) {
       this.printer.data(
         JSON.stringify({ builtIns: builtIns2, plugins }, omitModule, 2) + "\n"
@@ -20864,134 +21070,45 @@ var PluginsListCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     const ansi = this.ansiFor("stdout");
-    this.printer.data(renderListHuman(builtIns2, plugins, resolveEnabled, ansi));
+    this.printer.data(renderIndexHuman(builtIns2, plugins, resolveEnabled, ansi));
     return ExitCode.Ok;
   }
-};
-function renderListHuman(builtIns2, plugins, resolveEnabled, ansi) {
-  const rows = [
-    ...builtIns2.map(builtInToListRow),
-    ...plugins.map((p) => pluginToListRow(p, resolveEnabled))
-  ];
-  const idWidth = Math.max(...rows.map((r) => r.id.length));
-  const countWidth = Math.max(
-    ...rows.map((r) => String(r.names.length).length)
-  );
-  const lines = [];
-  for (const row of rows) {
-    const glyph = row.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
-    const idCol = row.id.padEnd(idWidth);
-    const countCol = String(row.names.length).padStart(countWidth);
-    lines.push(
-      tx(PLUGINS_TEXTS.pluginRow, {
-        glyph,
-        id: idCol,
-        count: ` ${countCol}`,
-        source: ansi.dim(row.source)
-      })
-    );
-    const indent = PLUGINS_TEXTS.pluginSubIndent;
-    if (row.reason) {
-      lines.push(`${indent}${ansi.dim(row.reason)}`);
-    } else if (row.names.length > 0) {
-      for (const wrapped of wrapNames(row.names, indent, 76)) {
-        lines.push(`${indent}${ansi.dim(wrapped)}`);
-      }
-    }
-  }
-  return lines.join("\n") + "\n" + PLUGINS_TEXTS.listTipShow;
-}
-function builtInToListRow(b) {
-  const names = b.extensions.map((e) => {
-    const name = withStabilityTag(e.id, e.stability);
-    return e.enabled ? name : `${PLUGINS_TEXTS.rowGlyphOff} ${name}`;
-  });
-  return {
-    id: b.id,
-    enabled: b.enabled,
-    source: PLUGINS_TEXTS.sourceBuiltIn,
-    names
-  };
-}
-function pluginToListRow(p, resolveEnabled) {
-  const isLoaded = p.status === "enabled";
-  const extensions = p.extensions ?? [];
-  const enabled = isLoaded ? extensions.length === 0 || extensions.some((e) => resolveEnabled(qualifiedExtensionId(p.id, e.id))) : false;
-  const names = extensions.map((e) => {
-    const safeId = withStabilityTag(sanitizeForTerminal(e.id), e.stability);
-    return resolveEnabled(qualifiedExtensionId(p.id, e.id)) ? safeId : `${PLUGINS_TEXTS.rowGlyphOff} ${safeId}`;
-  });
-  const reason = p.status === "enabled" ? void 0 : sanitizeForTerminal(p.reason ?? "") || void 0;
-  return {
-    id: sanitizeForTerminal(p.id),
-    enabled,
-    source: PLUGINS_TEXTS.sourceUser,
-    names,
-    reason
-  };
-}
-function wrapNames(names, indent, maxWidth) {
-  const out = [];
-  const sep8 = ", ";
-  let current = "";
-  for (const name of names) {
-    const candidate = current === "" ? name : `${current}${sep8}${name}`;
-    if (indent.length + candidate.length > maxWidth && current !== "") {
-      out.push(`${current},`);
-      current = name;
-    } else {
-      current = candidate;
-    }
-  }
-  if (current !== "") out.push(current);
-  return out;
-}
-
-// cli/commands/plugins/show.ts
-import { Command as Command23, Option as Option22 } from "clipanion";
-var PluginsShowCommand = class extends SmCommand {
-  static paths = [["plugins", "show"]];
-  static usage = Command23.Usage({
-    category: "Plugins",
-    description: "Show a single plugin's manifest + loaded extensions.",
-    details: `
-      Accepts a plugin id (\`core\`, \`claude\`, \`my-plugin\`)
-      or a qualified extension id (\`core/<ext-id>\`,
-      \`<plugin>/<ext-id>\`). When given a qualified id, validates the
-      extension exists and renders a single-extension detail block.
-      The bare form renders the parent plugin's detail with per-extension
-      status. The same id shapes \`sm plugins enable\` and
-      \`sm plugins disable\` accept resolve cleanly here too.
-    `
-  });
-  id = Option22.String({ required: true });
-  pluginDir = Option22.String("--plugin-dir", { required: false });
-  async run() {
-    const plugins = await loadAll({ pluginDir: this.pluginDir });
-    const resolveEnabled = await buildResolver();
-    const builtIns2 = builtInRows(resolveEnabled);
+  /**
+   * `sm plugins list <id>`, render one plugin's full detail. A qualified
+   * `<plugin>/<ext>` id is the wrong granularity for `list` (it targets a
+   * single extension), redirect to `sm plugins show`. A bare id that
+   * matches no plugin is a NotFound.
+   */
+  renderPluginDetailById(id, builtIns2, plugins) {
     const stderrAnsi = this.ansiFor("stderr");
-    const lookupResult = resolveShowLookupId(this.id, builtIns2, plugins, stderrAnsi);
-    if ("error" in lookupResult) {
-      this.printer.error(lookupResult.error);
-      return ExitCode.NotFound;
+    if (id.includes("/")) {
+      const pluginId = id.split("/")[0] ?? id;
+      this.printer.error(
+        tx(PLUGINS_TEXTS.listQualifiedId, {
+          glyph: stderrAnsi.red(PLUGINS_TEXTS.rowGlyphOff),
+          id: sanitizeForTerminal(id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_TEXTS.listQualifiedIdHint, {
+              id: sanitizeForTerminal(id),
+              pluginId: sanitizeForTerminal(pluginId)
+            })
+          )
+        })
+      );
+      return ExitCode.Error;
     }
-    const { pluginId, extId } = lookupResult;
-    const builtIn = builtIns2.find((b) => b.id === pluginId);
-    const match = plugins.find((p) => p.id === pluginId);
+    const builtIn = builtIns2.find((b) => b.id === id);
+    const match = plugins.find((p) => p.id === id);
     if (!builtIn && !match) {
       this.printer.error(
         tx(PLUGINS_TEXTS.pluginNotFound, {
-          glyph: stderrAnsi.red("\u2715"),
-          id: sanitizeForTerminal(this.id),
+          glyph: stderrAnsi.red(PLUGINS_TEXTS.rowGlyphOff),
+          id: sanitizeForTerminal(id),
           hint: stderrAnsi.dim(PLUGINS_TEXTS.pluginNotFoundHint)
         })
       );
       return ExitCode.NotFound;
     }
-    if (extId !== void 0) {
-      return this.renderExtensionDetail({ extId, pluginId, builtIn, match });
-    }
     if (this.json) {
       const payload = builtIn ?? match;
       this.printer.data(JSON.stringify(payload, omitModule, 2) + "\n");
@@ -21002,83 +21119,54 @@ var PluginsShowCommand = class extends SmCommand {
     this.printer.data(text);
     return ExitCode.Ok;
   }
-  /**
-   * Render the single-extension detail block, the path taken when the
-   * user supplies a qualified `<plugin>/<ext>` id. `--json` emits the
-   * single extension row (no surrounding plugin envelope) so tooling
-   * can pipe straight into `jq`; human mode renders a focused header
-   * plus a Kind / Version / Stability / Description / Preconditions /
-   * Entry field block.
-   */
-  renderExtensionDetail(args2) {
-    const { extId, pluginId, builtIn, match } = args2;
-    const ansi = this.ansiFor("stdout");
-    if (builtIn) {
-      const ext = builtIn.extensions.find((e) => e.id === extId);
-      if (!ext) return ExitCode.NotFound;
-      if (this.json) {
-        this.printer.data(JSON.stringify({ pluginId, ...ext }, omitModule, 2) + "\n");
-        return ExitCode.Ok;
-      }
-      this.printer.data(renderBuiltInExtensionDetail(pluginId, ext, ansi));
-      return ExitCode.Ok;
-    }
-    const userExt = match?.extensions?.find((e) => e.id === extId);
-    if (!userExt) return ExitCode.NotFound;
-    if (this.json) {
-      this.printer.data(JSON.stringify(userExt, omitModule, 2) + "\n");
-      return ExitCode.Ok;
+};
+function renderIndexHuman(builtIns2, plugins, resolveEnabled, ansi) {
+  const rows = [
+    ...builtIns2.map(builtInToIndexRow),
+    ...plugins.map((p) => pluginToIndexRow(p, resolveEnabled))
+  ];
+  const idWidth = Math.max(...rows.map((r) => r.id.length));
+  const countWidth = Math.max(...rows.map((r) => String(r.extCount).length));
+  const lines = [];
+  for (const row of rows) {
+    const glyph = row.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
+    const idCol = row.id.padEnd(idWidth);
+    const countCol = String(row.extCount).padStart(countWidth);
+    lines.push(
+      tx(PLUGINS_TEXTS.pluginRow, {
+        glyph,
+        id: idCol,
+        count: ` ${countCol}`,
+        source: ansi.dim(row.source)
+      })
+    );
+    if (row.reason) {
+      lines.push(`${PLUGINS_TEXTS.pluginSubIndent}${ansi.dim(row.reason)}`);
     }
-    this.printer.data(renderUserExtensionDetail(pluginId, userExt, ansi));
-    return ExitCode.Ok;
   }
-};
-function resolveShowLookupId(id, builtIns2, plugins, ansi) {
-  if (!id.includes("/")) return { pluginId: id };
-  const parsed = parseQualifiedId(id);
-  if ("error" in parsed) return { error: malformedQualifiedError(id, ansi) };
-  const { pluginId, extId } = parsed;
-  const knownExts = collectKnownExtensions(pluginId, builtIns2, plugins);
-  if (knownExts === null) return { error: unknownPluginError(pluginId, ansi) };
-  if (!knownExts.includes(extId)) {
-    return { error: unknownExtensionError(id, pluginId, extId, ansi) };
-  }
-  return { pluginId, extId };
-}
-function parseQualifiedId(id) {
-  const [pluginId, extId, ...rest] = id.split("/");
-  if (!pluginId || !extId || rest.length > 0) return { error: true };
-  return { pluginId, extId };
-}
-function collectKnownExtensions(pluginId, builtIns2, plugins) {
-  const builtIn = builtIns2.find((b) => b.id === pluginId);
-  if (builtIn) return builtIn.extensions.map((e) => e.id);
-  const userPlugin = plugins.find((p) => p.id === pluginId);
-  if (userPlugin) return userPlugin.extensions?.map((e) => e.id) ?? [];
-  return null;
-}
-function malformedQualifiedError(id, ansi) {
-  return tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
-    glyph: ansi.red("\u2715"),
-    pluginId: sanitizeForTerminal(id),
-    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
-  });
+  return lines.join("\n") + "\n" + PLUGINS_TEXTS.listTipShow;
 }
-function unknownPluginError(pluginId, ansi) {
-  return tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
-    glyph: ansi.red("\u2715"),
-    pluginId: sanitizeForTerminal(pluginId),
-    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
-  });
+function builtInToIndexRow(b) {
+  return {
+    id: b.id,
+    enabled: b.enabled,
+    source: PLUGINS_TEXTS.sourceBuiltIn,
+    extCount: b.extensions.length
+  };
 }
-function unknownExtensionError(id, pluginId, extId, ansi) {
-  return tx(PLUGINS_TEXTS.qualifiedIdNotFound, {
-    glyph: ansi.red("\u2715"),
-    id: sanitizeForTerminal(id),
-    pluginId: sanitizeForTerminal(pluginId),
-    extId: sanitizeForTerminal(extId),
-    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdNotFoundHint)
-  });
+function pluginToIndexRow(p, resolveEnabled) {
+  const isLoaded = p.status === "enabled";
+  const extensions = p.extensions ?? [];
+  const extEnabled = (e) => resolveEnabled(qualifiedExtensionId(p.id, e.id), installedDefaultEnabled(e.stability));
+  const enabled = isLoaded ? extensions.length === 0 || extensions.some((e) => extEnabled(e)) : false;
+  const reason = p.status === "enabled" ? void 0 : sanitizeForTerminal(p.reason ?? "") || void 0;
+  return {
+    id: sanitizeForTerminal(p.id),
+    enabled,
+    source: PLUGINS_TEXTS.sourceUser,
+    extCount: extensions.length,
+    reason
+  };
 }
 function kindIndex(kind) {
   const idx = EXTENSION_KINDS.indexOf(kind);
@@ -21203,6 +21291,83 @@ function renderExtensionItems(items) {
   }
   return out.join("");
 }
+
+// cli/commands/plugins/show.ts
+import { Command as Command23, Option as Option22 } from "clipanion";
+var PluginsShowCommand = class extends SmCommand {
+  static paths = [["plugins", "show"]];
+  static usage = Command23.Usage({
+    category: "Plugins",
+    description: "Show a single extension's detail.",
+    details: `
+      Accepts a qualified extension id (\`core/<ext-id>\`,
+      \`<plugin>/<ext-id>\`) and renders a single-extension detail block
+      (Kind / Version / Stability / Description / Preconditions / Entry).
+      A bare plugin id is rejected with a redirect to
+      \`sm plugins list <id>\`, which renders the whole plugin. The same
+      qualified id shape \`sm plugins enable\` and \`sm plugins disable\`
+      accept resolves cleanly here too.
+    `
+  });
+  id = Option22.String({ required: true });
+  pluginDir = Option22.String("--plugin-dir", { required: false });
+  async run() {
+    const plugins = await loadAll({ pluginDir: this.pluginDir });
+    const resolveEnabled = await buildResolver();
+    const builtIns2 = builtInRows(resolveEnabled);
+    const stderrAnsi = this.ansiFor("stderr");
+    if (!this.id.includes("/")) {
+      this.printer.error(
+        tx(PLUGINS_TEXTS.showBareId, {
+          glyph: stderrAnsi.red(PLUGINS_TEXTS.rowGlyphOff),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_TEXTS.showBareIdHint, { id: sanitizeForTerminal(this.id) })
+          )
+        })
+      );
+      return ExitCode.Error;
+    }
+    const parsed = parseQualifiedExtensionId(this.id, pluginCatalogue(plugins));
+    if (!parsed.ok) {
+      this.printer.error(renderQualifiedIdError(parsed, this.id, stderrAnsi));
+      return ExitCode.NotFound;
+    }
+    const { pluginId, extId } = parsed;
+    const builtIn = builtIns2.find((b) => b.id === pluginId);
+    const match = plugins.find((p) => p.id === pluginId);
+    return this.renderExtensionDetail({ extId, pluginId, builtIn, match });
+  }
+  /**
+   * Render the single-extension detail block. `--json` emits the single
+   * extension row (no surrounding plugin envelope) so tooling can pipe
+   * straight into `jq`; human mode renders a focused header plus a
+   * Kind / Version / Stability / Description / Preconditions / Entry
+   * field block.
+   */
+  renderExtensionDetail(args2) {
+    const { extId, pluginId, builtIn, match } = args2;
+    const ansi = this.ansiFor("stdout");
+    if (builtIn) {
+      const ext = builtIn.extensions.find((e) => e.id === extId);
+      if (!ext) return ExitCode.NotFound;
+      if (this.json) {
+        this.printer.data(JSON.stringify({ pluginId, ...ext }, omitModule, 2) + "\n");
+        return ExitCode.Ok;
+      }
+      this.printer.data(renderBuiltInExtensionDetail(pluginId, ext, ansi));
+      return ExitCode.Ok;
+    }
+    const userExt = match?.extensions?.find((e) => e.id === extId);
+    if (!userExt) return ExitCode.NotFound;
+    if (this.json) {
+      this.printer.data(JSON.stringify(userExt, omitModule, 2) + "\n");
+      return ExitCode.Ok;
+    }
+    this.printer.data(renderUserExtensionDetail(pluginId, userExt, ansi));
+    return ExitCode.Ok;
+  }
+};
 function renderBuiltInExtensionDetail(pluginId, ext, ansi) {
   const glyph = ext.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
   const header = tx(PLUGINS_TEXTS.detailHeaderExtensionBuiltIn, {
@@ -22039,61 +22204,15 @@ var PluginsDisableCommand = class extends TogglePluginsBase {
     return this.toggle(false);
   }
 };
-function pluginCatalogue(plugins) {
-  const out = [];
-  for (const plugin of builtInPlugins) {
-    out.push({
-      id: plugin.id,
-      extensionIds: plugin.extensions.map((e) => e.id)
-    });
-  }
-  for (const p of plugins) {
-    out.push({
-      id: p.id,
-      extensionIds: p.extensions?.map((e) => e.id) ?? []
-    });
-  }
-  return out;
-}
 function resolveToggleTarget(id, catalogue, ansi) {
   return id.includes("/") ? resolveQualifiedToggle(id, catalogue, ansi) : resolveBareToggle(id, catalogue);
 }
 function resolveQualifiedToggle(id, catalogue, ansi) {
-  const errGlyph = ansi.red("\u2715");
-  const [pluginId, extId, ...rest] = id.split("/");
-  if (!pluginId || !extId || rest.length > 0) {
-    return {
-      error: tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
-        glyph: errGlyph,
-        pluginId: sanitizeForTerminal(id),
-        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
-      })
-    };
-  }
-  const plugin = catalogue.find((b) => b.id === pluginId);
-  if (!plugin) {
-    return {
-      error: tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
-        glyph: errGlyph,
-        pluginId: sanitizeForTerminal(pluginId),
-        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
-      })
-    };
-  }
-  if (!plugin.extensionIds.includes(extId)) {
-    return {
-      error: tx(PLUGINS_TEXTS.qualifiedIdNotFound, {
-        glyph: errGlyph,
-        id: sanitizeForTerminal(id),
-        pluginId: sanitizeForTerminal(pluginId),
-        extId: sanitizeForTerminal(extId),
-        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdNotFoundHint)
-      })
-    };
-  }
+  const parsed = parseQualifiedExtensionId(id, catalogue);
+  if (!parsed.ok) return { error: renderQualifiedIdError(parsed, id, ansi) };
   return {
     origin: "qualified",
-    keys: [qualifiedExtensionId(pluginId, extId)]
+    keys: [qualifiedExtensionId(parsed.pluginId, parsed.extId)]
   };
 }
 function resolveBareToggle(id, catalogue) {
@@ -22473,7 +22592,7 @@ Generated by \`sm plugins create ${kind} ${pluginId}\`. Edit \`${mainFileRel}\`
 
 ## Verbs
 
-- \`sm plugins show ${pluginId}\`: manifest + load status
+- \`sm plugins list ${pluginId}\`: manifest + extensions + load status
 - \`sm plugins doctor\`: full plugin diagnostic
 - \`sm scan\`: re-emit contributions / re-run analysis
 
@@ -22620,11 +22739,12 @@ var INPUT_TYPES_CATALOG = [
   { id: "single-string", summary: "Single text input." },
   { id: "boolean-flag", summary: "On/off toggle." },
   { id: "integer", summary: "Integer with optional bounds." },
+  { id: "number", summary: "Decimal number with optional bounds." },
   { id: "enum-pick", summary: "Pick one from a closed set." },
   { id: "enum-multipick", summary: "Pick zero or more from a closed set." },
   { id: "path-glob", summary: "Glob pattern (single or multiple)." },
   { id: "regex", summary: "ECMAScript regex pattern body." },
-  { id: "secret", summary: "Sensitive string (encrypted at rest)." },
+  { id: "secret", summary: "Sensitive string, forced into project-local storage (gitignored), not encrypted." },
   { id: "key-value-list", summary: "Editable mapping of strings to strings." }
 ];
 
@@ -22645,57 +22765,426 @@ var PluginsSlotsListCommand = class extends SmCommand {
           2
         ) + "\n"
       );
-      return ExitCode.Ok;
+      return ExitCode.Ok;
+    }
+    const ansi = this.ansiFor("stdout");
+    const idWidth = Math.max(
+      ...VIEW_SLOTS_CATALOG.map((c) => c.id.length),
+      ...INPUT_TYPES_CATALOG.map((t) => t.id.length)
+    );
+    this.printer.data(
+      tx(PLUGINS_TEXTS.slotsListHeaderViewSlots, { count: VIEW_SLOTS_CATALOG.length })
+    );
+    for (const c of VIEW_SLOTS_CATALOG) {
+      this.printer.data(
+        `    ${c.id.padEnd(idWidth)}  ${ansi.dim(c.summary)}
+`
+      );
+    }
+    this.printer.data(
+      tx(PLUGINS_TEXTS.slotsListHeaderInputTypes, { count: INPUT_TYPES_CATALOG.length })
+    );
+    for (const t of INPUT_TYPES_CATALOG) {
+      this.printer.data(
+        `    ${t.id.padEnd(idWidth)}  ${ansi.dim(t.summary)}
+`
+      );
+    }
+    this.printer.data(
+      tx(PLUGINS_TEXTS.slotsListTipFooter, {
+        tip: ansi.dim(PLUGINS_TEXTS.slotsListTipText)
+      })
+    );
+    return ExitCode.Ok;
+  }
+};
+
+// cli/commands/plugins/upgrade.ts
+import { Command as Command28, Option as Option26 } from "clipanion";
+var PluginsUpgradeCommand = class extends SmCommand {
+  static paths = [["plugins", "upgrade"]];
+  static usage = Command28.Usage({
+    category: "Plugins",
+    description: "Apply catalog migrations to plugin manifests.",
+    details: "No migrations registered against catalog v1.0.0 yet; this verb is a no-op today. The structure exists so future slot renames / deprecations land without spec churn."
+  });
+  pluginId = Option26.String({ required: false, name: "plugin-id" });
+  async run() {
+    this.printer.data(
+      "sm plugins upgrade: no migrations registered for catalog v1.0.0.\n  All loaded plugins are catalog-current.\n  Run `sm plugins doctor` to surface any incompatible-catalog status.\n"
+    );
+    return ExitCode.Ok;
+  }
+};
+
+// cli/commands/plugins/config.ts
+import { Command as Command29, Option as Option27 } from "clipanion";
+
+// cli/i18n/plugins-config.texts.ts
+var PLUGINS_CONFIG_TEXTS = {
+  // --- id-shape redirects ----------------------------------------------
+  // `sm plugins config` operates on one extension. A bare plugin id is
+  // the wrong granularity, redirect to `sm plugins list <id>`.
+  bareId: '{{glyph}}  `sm plugins config` needs a qualified `<plugin>/<ext>` id; "{{id}}" is a plugin.\n   {{hint}}\n',
+  bareIdHint: "Run `sm plugins list {{id}}` to see the extensions, then `sm plugins config {{id}}/<ext>`.",
+  // --- no declared settings --------------------------------------------
+  noSettings: '{{glyph}}  Extension "{{id}}" declares no configurable settings.\n   {{hint}}\n',
+  noSettingsHint: "Run `sm plugins show {{id}}` to inspect the extension.",
+  unknownSetting: '{{glyph}}  Unknown setting "{{settingId}}" for extension "{{id}}".\n   {{hint}}\n',
+  unknownSettingHint: "Declared settings: {{declared}}.",
+  // --- coercion / validation -------------------------------------------
+  coerceFailed: '{{glyph}}  Could not parse "{{value}}" as type {{type}} for setting "{{settingId}}".\n   {{hint}}\n',
+  coerceFailedHint: "{{detail}}",
+  validationFailed: '{{glyph}}  Invalid value for setting "{{settingId}}" ({{type}}): {{reason}}.\n',
+  writeFailed: '{{glyph}}  Failed to write setting "{{settingId}}": {{message}}\n',
+  // --- table view (no settingId) ---------------------------------------
+  /** Section header above the settings table. */
+  tableHeader: "  Settings for {{id}}\n",
+  /** One table row: setting id, effective value, source layer tag. */
+  tableRow: "  {{settingId}}  {{value}}{{sourceTag}}\n",
+  /** Dim suffix showing which layer set the effective value. */
+  tableSourceTag: " [{{source}}]",
+  /** Redaction placeholder for `secret`-typed values in any output. */
+  redacted: "<redacted>",
+  // --- write / reset receipts ------------------------------------------
+  setWritten: "{{glyph}}  Set {{settingId}} = {{value}} for {{id}}{{wroteTag}}\n",
+  setWroteTag: " (wrote {{path}})",
+  resetRemoved: "{{glyph}}  Cleared {{settingId}} for {{id}}; falls back to the declared default{{wroteTag}}\n",
+  resetNoOverride: "{{glyph}}  No override set for {{settingId}} on {{id}}; nothing to clear.\n",
+  // --- re-scan footer ---------------------------------------------------
+  rescanFooter: "{{hint}}\n",
+  rescanFooterText: "Settings are read once per scan; run `sm scan` to apply."
+};
+
+// cli/commands/plugins/config.ts
+var PluginsConfigCommand = class extends SmCommand {
+  static paths = [["plugins", "config"]];
+  static usage = Command29.Usage({
+    category: "Plugins",
+    description: "Read or write an extension's declared settings.",
+    details: `
+      Operates on a single extension by its qualified \`<plugin>/<ext>\`
+      id. With no settingId it prints a table of each declared setting,
+      its effective value, and the config layer that set it. With a
+      settingId + value it coerces the shell string to the declared
+      input-type, validates it, and writes
+      \`plugins.<plugin>.extensions.<ext>.settings.<settingId>\` to
+      settings.json (or settings.local.json for \`secret\` settings).
+      \`--reset\` removes the override so the manifest default applies.
+      Secret values are shown as <redacted>. Run \`sm scan\` to apply.
+    `
+  });
+  id = Option27.String({ required: true });
+  settingId = Option27.String({ required: false });
+  value = Option27.String({ required: false });
+  reset = Option27.Boolean("--reset", false, {
+    description: "Remove the override for <settingId> so the manifest default applies."
+  });
+  pluginDir = Option27.String("--plugin-dir", { required: false });
+  // Read-only when listing; the write / reset paths emit their own
+  // receipt. `sm config` exempts the config family from "done in <…>";
+  // mirror that here for the read path. The write path keeps the line.
+  emitElapsed = true;
+  // CLI orchestrator: each branch is one validation gate (bare id /
+  // unknown extension / no settings / unknown setting) or a mode
+  // dispatch (table vs set vs reset). Splitting per branch scatters the
+  // gate from the value it gates.
+  // eslint-disable-next-line complexity
+  async run() {
+    const ctx = defaultRuntimeContext();
+    const stderrAnsi = this.ansiFor("stderr");
+    if (!this.id.includes("/")) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.bareId, {
+          glyph: stderrAnsi.red("\u2715"),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_CONFIG_TEXTS.bareIdHint, { id: sanitizeForTerminal(this.id) })
+          )
+        })
+      );
+      return ExitCode.Error;
+    }
+    const plugins = await loadAll({ pluginDir: this.pluginDir });
+    const parsed = parseQualifiedExtensionId(this.id, pluginCatalogue(plugins));
+    if (!parsed.ok) {
+      this.printer.error(renderQualifiedIdError(parsed, this.id, stderrAnsi));
+      return ExitCode.NotFound;
+    }
+    const { pluginId, extId } = parsed;
+    const declarations = resolveDeclaredSettings(pluginId, extId, plugins);
+    if (!declarations || Object.keys(declarations).length === 0) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.noSettings, {
+          glyph: stderrAnsi.red("\u2715"),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_CONFIG_TEXTS.noSettingsHint, { id: sanitizeForTerminal(this.id) })
+          )
+        })
+      );
+      return ExitCode.NotFound;
+    }
+    if (this.settingId === void 0) {
+      return this.renderTable(pluginId, extId, declarations, ctx.cwd);
+    }
+    const declaration = declarations[this.settingId];
+    if (!declaration) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.unknownSetting, {
+          glyph: stderrAnsi.red("\u2715"),
+          settingId: sanitizeForTerminal(this.settingId),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_CONFIG_TEXTS.unknownSettingHint, {
+              declared: Object.keys(declarations).map((k) => `'${k}'`).join(", ")
+            })
+          )
+        })
+      );
+      return ExitCode.NotFound;
+    }
+    if (this.reset) {
+      return this.resetSetting(pluginId, extId, this.settingId, declaration, ctx.cwd);
+    }
+    if (this.value === void 0) {
+      return this.renderTable(pluginId, extId, { [this.settingId]: declaration }, ctx.cwd);
+    }
+    return this.writeSetting(pluginId, extId, this.settingId, declaration, this.value, ctx.cwd);
+  }
+  /**
+   * Render the settings table (human) or the resolved set (`--json`).
+   * Effective values come from the kernel settings resolver so the table
+   * shows exactly what `ctx.settings.<id>` would see at scan time
+   * (default overlaid by the config override, validated). Secret values
+   * are redacted.
+   */
+  renderTable(pluginId, extId, declarations, cwd) {
+    const { effective } = loadConfig({ cwd });
+    const resolved = resolveExtensionSettings({ pluginId, id: extId, settings: declarations }, effective, () => {
+    });
+    if (this.json) {
+      const payload = {};
+      for (const [settingId, declaration] of Object.entries(declarations)) {
+        payload[settingId] = declaration.type === "secret" ? PLUGINS_CONFIG_TEXTS.redacted : resolved[settingId] ?? null;
+      }
+      this.printer.data(JSON.stringify(payload) + "\n");
+      return ExitCode.Ok;
+    }
+    const ansi = this.ansiFor("stdout");
+    const lines = [tx(PLUGINS_CONFIG_TEXTS.tableHeader, { id: `${pluginId}/${extId}` })];
+    const idWidth = Math.max(...Object.keys(declarations).map((k) => k.length));
+    for (const [settingId, declaration] of Object.entries(declarations)) {
+      const display = declaration.type === "secret" ? PLUGINS_CONFIG_TEXTS.redacted : formatValue2(resolved[settingId]);
+      const dotKey = settingDotKey(pluginId, extId, settingId);
+      const source = getValueSource(dotKey, { cwd });
+      const sourceTag = source ? ansi.dim(tx(PLUGINS_CONFIG_TEXTS.tableSourceTag, { source: layerLabel(source) })) : "";
+      lines.push(
+        tx(PLUGINS_CONFIG_TEXTS.tableRow, {
+          settingId: settingId.padEnd(idWidth),
+          value: sanitizeForTerminal(display),
+          sourceTag
+        })
+      );
+    }
+    this.printer.data(lines.join(""));
+    return ExitCode.Ok;
+  }
+  writeSetting(pluginId, extId, settingId, declaration, raw, cwd) {
+    const stderrAnsi = this.ansiFor("stderr");
+    const errGlyph = stderrAnsi.red("\u2715");
+    const coerced = coerceCliValue(declaration, raw);
+    if (!coerced.ok) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.coerceFailed, {
+          glyph: errGlyph,
+          value: sanitizeForTerminal(raw),
+          type: declaration.type,
+          settingId: sanitizeForTerminal(settingId),
+          hint: stderrAnsi.dim(tx(PLUGINS_CONFIG_TEXTS.coerceFailedHint, { detail: coerced.reason }))
+        })
+      );
+      return ExitCode.Error;
+    }
+    let invalidReason = null;
+    resolveExtensionSettings(
+      { pluginId, id: extId, settings: { [settingId]: declaration } },
+      { plugins: { [pluginId]: { extensions: { [extId]: { settings: { [settingId]: coerced.value } } } } } },
+      (message) => {
+        invalidReason = message;
+      }
+    );
+    if (invalidReason !== null) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.validationFailed, {
+          glyph: errGlyph,
+          settingId: sanitizeForTerminal(settingId),
+          type: declaration.type,
+          reason: invalidReason
+        })
+      );
+      return ExitCode.Error;
+    }
+    const target = declaration.type === "secret" ? "project-local" : "project";
+    const dotKey = settingDotKey(pluginId, extId, settingId);
+    try {
+      writeConfigValue(dotKey, coerced.value, { target, cwd });
+    } catch (err) {
+      return this.renderWriteError(err, settingId);
     }
     const ansi = this.ansiFor("stdout");
-    const idWidth = Math.max(
-      ...VIEW_SLOTS_CATALOG.map((c) => c.id.length),
-      ...INPUT_TYPES_CATALOG.map((t) => t.id.length)
-    );
+    const display = declaration.type === "secret" ? PLUGINS_CONFIG_TEXTS.redacted : formatValue2(coerced.value);
+    const path = target === "project-local" ? defaultLocalSettingsPath(cwd) : defaultSettingsPath(cwd);
     this.printer.data(
-      tx(PLUGINS_TEXTS.slotsListHeaderViewSlots, { count: VIEW_SLOTS_CATALOG.length })
+      tx(PLUGINS_CONFIG_TEXTS.setWritten, {
+        glyph: ansi.green("\u2713"),
+        settingId,
+        value: sanitizeForTerminal(display),
+        id: `${pluginId}/${extId}`,
+        wroteTag: ansi.dim(tx(PLUGINS_CONFIG_TEXTS.setWroteTag, { path: relativeIfBelow(path, cwd) }))
+      })
     );
-    for (const c of VIEW_SLOTS_CATALOG) {
+    this.printRescanFooter();
+    return ExitCode.Ok;
+  }
+  resetSetting(pluginId, extId, settingId, declaration, cwd) {
+    const target = declaration.type === "secret" ? "project-local" : "project";
+    const dotKey = settingDotKey(pluginId, extId, settingId);
+    const ansi = this.ansiFor("stdout");
+    let removed;
+    try {
+      removed = removeConfigValue(dotKey, { target, cwd });
+    } catch (err) {
+      return this.renderWriteError(err, settingId);
+    }
+    if (!removed) {
       this.printer.data(
-        `    ${c.id.padEnd(idWidth)}  ${ansi.dim(c.summary)}
-`
+        tx(PLUGINS_CONFIG_TEXTS.resetNoOverride, {
+          glyph: ansi.green("\u2713"),
+          settingId,
+          id: `${pluginId}/${extId}`
+        })
       );
+      return ExitCode.Ok;
     }
+    const path = target === "project-local" ? defaultLocalSettingsPath(cwd) : defaultSettingsPath(cwd);
     this.printer.data(
-      tx(PLUGINS_TEXTS.slotsListHeaderInputTypes, { count: INPUT_TYPES_CATALOG.length })
+      tx(PLUGINS_CONFIG_TEXTS.resetRemoved, {
+        glyph: ansi.green("\u2713"),
+        settingId,
+        id: `${pluginId}/${extId}`,
+        wroteTag: ansi.dim(tx(PLUGINS_CONFIG_TEXTS.setWroteTag, { path: relativeIfBelow(path, cwd) }))
+      })
     );
-    for (const t of INPUT_TYPES_CATALOG) {
-      this.printer.data(
-        `    ${t.id.padEnd(idWidth)}  ${ansi.dim(t.summary)}
-`
+    this.printRescanFooter();
+    return ExitCode.Ok;
+  }
+  renderWriteError(err, settingId) {
+    const ansi = this.ansiFor("stderr");
+    const glyph = ansi.red("\u2715");
+    if (err instanceof ForbiddenSegmentError) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.writeFailed, { glyph, settingId, message: err.message })
+      );
+      return ExitCode.Error;
+    }
+    if (err instanceof ProjectLocalOnlyKeyError) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.writeFailed, { glyph, settingId, message: err.message })
+      );
+      return ExitCode.Error;
+    }
+    if (err instanceof ConfigValidationError) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.writeFailed, { glyph, settingId, message: err.errors })
       );
+      return ExitCode.Error;
     }
+    throw err;
+  }
+  printRescanFooter() {
+    if (this.json) return;
+    const ansi = this.ansiFor("stdout");
     this.printer.data(
-      tx(PLUGINS_TEXTS.slotsListTipFooter, {
-        tip: ansi.dim(PLUGINS_TEXTS.slotsListTipText)
+      tx(PLUGINS_CONFIG_TEXTS.rescanFooter, {
+        hint: ansi.dim(PLUGINS_CONFIG_TEXTS.rescanFooterText)
       })
     );
-    return ExitCode.Ok;
   }
 };
-
-// cli/commands/plugins/upgrade.ts
-import { Command as Command28, Option as Option26 } from "clipanion";
-var PluginsUpgradeCommand = class extends SmCommand {
-  static paths = [["plugins", "upgrade"]];
-  static usage = Command28.Usage({
-    category: "Plugins",
-    description: "Apply catalog migrations to plugin manifests.",
-    details: "No migrations registered against catalog v1.0.0 yet; this verb is a no-op today. The structure exists so future slot renames / deprecations land without spec churn."
-  });
-  pluginId = Option26.String({ required: false, name: "plugin-id" });
-  async run() {
-    this.printer.data(
-      "sm plugins upgrade: no migrations registered for catalog v1.0.0.\n  All loaded plugins are catalog-current.\n  Run `sm plugins doctor` to surface any incompatible-catalog status.\n"
-    );
-    return ExitCode.Ok;
+function resolveDeclaredSettings(pluginId, extId, plugins) {
+  for (const plugin of builtInPlugins) {
+    if (plugin.id !== pluginId) continue;
+    for (const ext of plugin.extensions) {
+      if (ext.id === extId) return ext.settings;
+    }
+  }
+  const match = plugins.find((p) => p.id === pluginId);
+  const userExt = match?.extensions?.find((e) => e.id === extId);
+  return readInstanceSettings(userExt?.instance);
+}
+function readInstanceSettings(instance) {
+  if (instance === null || typeof instance !== "object") return void 0;
+  const settings2 = instance.settings;
+  if (settings2 && typeof settings2 === "object" && !Array.isArray(settings2)) {
+    return settings2;
+  }
+  return void 0;
+}
+function coerceCliValue(declaration, raw) {
+  switch (declaration.type) {
+    case "integer":
+    case "number": {
+      const n = Number(raw);
+      if (raw.trim() === "" || Number.isNaN(n)) return { ok: false, reason: "expected a numeric value" };
+      return { ok: true, value: n };
+    }
+    case "boolean-flag": {
+      if (raw === "true") return { ok: true, value: true };
+      if (raw === "false") return { ok: true, value: false };
+      return { ok: false, reason: "expected `true` or `false`" };
+    }
+    case "string-list":
+    case "enum-multipick":
+    case "key-value-list":
+      return parseJsonValue(raw);
+    case "path-glob":
+      return declaration.multiple === true ? parseJsonValue(raw) : { ok: true, value: raw };
+    case "single-string":
+    case "enum-pick":
+    case "regex":
+    case "secret":
+      return { ok: true, value: raw };
+    default: {
+      const _exhaustive = declaration;
+      return { ok: false, reason: `unknown input-type: ${String(_exhaustive.type)}` };
+    }
+  }
+}
+function parseJsonValue(raw) {
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch {
+    return { ok: false, reason: 'expected a JSON value (e.g. ["a","b"])' };
   }
+}
+function settingDotKey(pluginId, extId, settingId) {
+  return `plugins.${pluginId}.extensions.${extId}.settings.${settingId}`;
+}
+function formatValue2(value) {
+  if (value === void 0 || value === null) return "null";
+  if (Array.isArray(value) || typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+var LAYER_LABEL = {
+  defaults: "default",
+  project: "settings.json",
+  "project-local": "settings.local.json",
+  override: "override"
 };
+function layerLabel(layer) {
+  return LAYER_LABEL[layer];
+}
 
 // cli/commands/plugins.ts
 var PLUGIN_COMMANDS = [
@@ -22706,13 +23195,14 @@ var PLUGIN_COMMANDS = [
   PluginsDisableCommand,
   PluginsCreateCommand,
   PluginsSlotsListCommand,
-  PluginsUpgradeCommand
+  PluginsUpgradeCommand,
+  PluginsConfigCommand
 ];
 
 // cli/commands/refresh.ts
 import { readFile as readFile4 } from "fs/promises";
 import { resolve as resolve34 } from "path";
-import { Command as Command29, Option as Option27 } from "clipanion";
+import { Command as Command30, Option as Option28 } from "clipanion";
 
 // cli/i18n/refresh.texts.ts
 var REFRESH_TEXTS = {
@@ -22768,7 +23258,7 @@ var REFRESH_TEXTS = {
 // cli/commands/refresh.ts
 var RefreshCommand = class extends SmCommand {
   static paths = [["refresh"]];
-  static usage = Command29.Usage({
+  static usage = Command30.Usage({
     category: "Scan",
     description: "Refresh enrichment rows: granular (single node) or batch (every stale row).",
     details: `
@@ -22790,11 +23280,11 @@ var RefreshCommand = class extends SmCommand {
       ["Refresh every node with stale enrichments", "$0 refresh --stale"]
     ]
   });
-  nodePath = Option27.String({ name: "node", required: false });
-  stale = Option27.Boolean("--stale", false, {
+  nodePath = Option28.String({ name: "node", required: false });
+  stale = Option28.Boolean("--stale", false, {
     description: "Refresh every node carrying a stale enrichment row (no-op in this revision; reserved for future Action-prob enrichments)."
   });
-  noPlugins = Option27.Boolean("--no-plugins", false, {
+  noPlugins = Option28.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery; use only the built-in extractor set."
   });
   // The remaining cyclomatic count comes from CLI ergonomics that don't
@@ -22828,9 +23318,11 @@ var RefreshCommand = class extends SmCommand {
     const pluginRuntime = this.noPlugins ? emptyPluginRuntime() : await loadPluginRuntime();
     pluginRuntime.emitWarnings(this.printer);
     listBuiltIns();
+    const refreshCfg = loadConfig({ cwd: ctx.cwd }).effective;
     const composed = composeScanExtensions({
       noBuiltIns: false,
       pluginRuntime,
+      resolveSettings: buildSettingsResolver(refreshCfg),
       killSwitches: readConformanceKillSwitches()
     });
     const allExtractors = composed?.extractors ?? [];
@@ -23096,7 +23588,7 @@ var IntentionalFailCommand = class extends SmCommand {
 };
 
 // cli/commands/scan.ts
-import { Command as Command31, Option as Option29 } from "clipanion";
+import { Command as Command32, Option as Option30 } from "clipanion";
 
 // kernel/util/format-bytes.ts
 var UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB"];
@@ -23248,7 +23740,7 @@ var SCAN_TEXTS = {
 };
 
 // cli/commands/watch.ts
-import { Command as Command30, Option as Option28 } from "clipanion";
+import { Command as Command31, Option as Option29 } from "clipanion";
 
 // core/watcher/runtime.ts
 import { dirname as dirname18 } from "path";
@@ -23370,7 +23862,8 @@ function createWatcherRuntime(opts) {
       const composeOpts = {
         noBuiltIns: opts.noBuiltIns,
         pluginRuntime,
-        resolveEnabled: resolveEnabledOverride
+        resolveEnabled: resolveEnabledOverride,
+        resolveSettings: buildSettingsResolver(cfg)
       };
       if (opts.killSwitches) composeOpts.killSwitches = opts.killSwitches;
       const composed = composeScanExtensions(composeOpts);
@@ -23787,7 +24280,7 @@ async function runWatchLoop(opts) {
 }
 var WatchCommand = class extends SmCommand {
   static paths = [["watch"]];
-  static usage = Command30.Usage({
+  static usage = Command31.Usage({
     category: "Scan",
     description: "Watch roots and run an incremental scan after each debounced batch of filesystem events.",
     details: `
@@ -23811,21 +24304,21 @@ var WatchCommand = class extends SmCommand {
       ["Stream ScanResult per batch as ndjson", "$0 watch --json"]
     ]
   });
-  roots = Option28.Rest({ name: "roots" });
-  noTokens = Option28.Boolean("--no-tokens", false, {
+  roots = Option29.Rest({ name: "roots" });
+  noTokens = Option29.Boolean("--no-tokens", false, {
     description: "Skip per-node token counts (cl100k_base BPE)."
   });
-  strict = Option28.Boolean("--strict", false, {
+  strict = Option29.Boolean("--strict", false, {
     description: "Promote frontmatter-validation findings from warn to error inside each batch. Does not change the watcher exit code."
   });
-  noPlugins = Option28.Boolean("--no-plugins", false, {
+  noPlugins = Option29.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery for the watcher session."
   });
-  maxConsecutiveFailures = Option28.String("--max-consecutive-failures", {
+  maxConsecutiveFailures = Option29.String("--max-consecutive-failures", {
     required: false,
     description: "Shut down with exit 2 after N consecutive batch failures (default 5; 0 disables the breaker)."
   });
-  maxNodes = Option28.String("--max-nodes", {
+  maxNodes = Option29.String("--max-nodes", {
     required: false,
     description: "Per-batch override of scan.maxNodes (default 256). Bidirectional: raises OR lowers the recommended cap on classified nodes. When a batch hits the cap, additional files are dropped and the UI surfaces the persistent oversized banner. Validation: integer >= 1."
   });
@@ -23892,7 +24385,7 @@ function parseMaxNodesLimit(raw, stderr, noColor) {
 // cli/commands/scan.ts
 var ScanCommand = class extends SmCommand {
   static paths = [["scan"]];
-  static usage = Command31.Usage({
+  static usage = Command32.Usage({
     category: "Scan",
     description: "Scan roots for markdown nodes, run extractors and analyzers.",
     details: `
@@ -23927,35 +24420,35 @@ var ScanCommand = class extends SmCommand {
       ["What would the next incremental scan persist?", "$0 scan --changed -n --json"]
     ]
   });
-  roots = Option29.Rest({ name: "roots" });
-  noBuiltIns = Option29.Boolean("--no-built-ins", false, {
+  roots = Option30.Rest({ name: "roots" });
+  noBuiltIns = Option30.Boolean("--no-built-ins", false, {
     description: "Skip the built-in extension set. Yields a zero-filled ScanResult (kernel-empty-boot parity); skips DB persistence."
   });
-  noPlugins = Option29.Boolean("--no-plugins", false, {
+  noPlugins = Option30.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery. Only the built-in set runs. Combine with --no-built-ins for a fully empty pipeline."
   });
-  noTokens = Option29.Boolean("--no-tokens", false, {
+  noTokens = Option30.Boolean("--no-tokens", false, {
     description: "Skip per-node token counts (cl100k_base BPE). Leaves node.tokens undefined; spec-valid since the field is optional."
   });
-  dryRun = Option29.Boolean("-n,--dry-run", false, {
+  dryRun = Option30.Boolean("-n,--dry-run", false, {
     description: "Run the scan in memory and skip every DB write. Combined with --changed, still opens the DB read-side to load the prior snapshot."
   });
-  changed = Option29.Boolean("--changed", false, {
+  changed = Option30.Boolean("--changed", false, {
     description: "Incremental scan: reuse unchanged nodes from the persisted prior snapshot. Degrades to a full scan if no prior snapshot exists."
   });
-  allowEmpty = Option29.Boolean("--allow-empty", false, {
+  allowEmpty = Option30.Boolean("--allow-empty", false, {
     description: "Allow a zero-result scan to wipe an already-populated DB (replace-all replace by zero rows). Off by default to avoid the typo-trap where an invalid root silently clears your data."
   });
-  strict = Option29.Boolean("--strict", false, {
+  strict = Option30.Boolean("--strict", false, {
     description: "Promote frontmatter-validation findings from warn to error (exit code 1 on any violation). Overrides scan.strict from config when both are set."
   });
-  watch = Option29.Boolean("--watch", false, {
+  watch = Option30.Boolean("--watch", false, {
     description: "Long-running mode: watch the roots and trigger an incremental scan after each debounced batch of filesystem events. Alias of `sm watch`."
   });
-  yes = Option29.Boolean("--yes", false, {
+  yes = Option30.Boolean("--yes", false, {
     description: "Non-interactive mode. For ambiguous activeProvider auto-detect, multiple provider markers (.claude/, .codex/, AGENTS.md, .cursor/) under the scan tree exit non-zero instead of prompting; set the lens manually via `sm config set activeProvider <id>` and re-run. Also auto-confirms the pre-1.0 schema-drift rebuild (when the DB was written by a different skill-map major.minor it is deleted and regenerated) instead of prompting."
   });
-  maxNodes = Option29.String("--max-nodes", {
+  maxNodes = Option30.String("--max-nodes", {
     required: false,
     description: "Per-invocation override of `scan.maxNodes` (default 256). Bidirectional: raises OR lowers the recommended cap on classified nodes. When the walker hits the cap, additional files are dropped and the scan is marked oversized in scan_meta (the UI raises a persistent banner pointing at the .skillmapignore editor in Settings \u2192 Project). Validation: integer >= 1."
   });
@@ -24296,10 +24789,10 @@ function countNoun(count3, singular, plural) {
 
 // cli/commands/scan-compare.ts
 import { access, readFile as readFile5 } from "fs/promises";
-import { Command as Command32, Option as Option30 } from "clipanion";
+import { Command as Command33, Option as Option31 } from "clipanion";
 var ScanCompareCommand = class extends SmCommand {
   static paths = [["scan", "compare-with"]];
-  static usage = Command32.Usage({
+  static usage = Command33.Usage({
     category: "Scan",
     description: "Run a fresh scan in memory and emit a delta against the saved ScanResult dump at <dump>. Read-only.",
     details: `
@@ -24327,15 +24820,15 @@ var ScanCompareCommand = class extends SmCommand {
       ["JSON output for tooling", "$0 scan compare-with baseline.json --json"]
     ]
   });
-  dump = Option30.String({ required: true });
-  roots = Option30.Rest({ name: "roots" });
-  noTokens = Option30.Boolean("--no-tokens", false, {
+  dump = Option31.String({ required: true });
+  roots = Option31.Rest({ name: "roots" });
+  noTokens = Option31.Boolean("--no-tokens", false, {
     description: "Skip per-node token counts during the fresh scan."
   });
-  strict = Option30.Boolean("--strict", false, {
+  strict = Option31.Boolean("--strict", false, {
     description: "Promote layered-config warnings and frontmatter-validation findings from warn to error."
   });
-  noPlugins = Option30.Boolean("--no-plugins", false, {
+  noPlugins = Option31.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery."
   });
   // Cyclomatic count comes from CLI ergonomics: 3 distinct try/catch
@@ -24377,6 +24870,7 @@ var ScanCompareCommand = class extends SmCommand {
     const composedExtensions = composeScanExtensions({
       noBuiltIns: false,
       pluginRuntime,
+      resolveSettings: buildSettingsResolver(cfg),
       killSwitches: readConformanceKillSwitches()
     });
     let current;
@@ -24540,7 +25034,7 @@ function renderDeltaIssues(issues) {
 // cli/commands/serve.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync31 } from "fs";
-import { Command as Command33, Option as Option31 } from "clipanion";
+import { Command as Command34, Option as Option32 } from "clipanion";
 
 // kernel/util/dev-mode.ts
 import { sep as sep6 } from "path";
@@ -24801,8 +25295,22 @@ var SERVER_TEXTS = {
   // The single-id variants above still apply for per-entry validation
   // (unknown id, granularity mismatch, lock); these cover the
   // body-shape level.
-  pluginsChangesRequired: "Request body must include a `changes` array of `{ id, enabled }` entries.",
-  pluginsChangeMalformed: "Each entry in `changes` must have a string `id` and a boolean `enabled`.",
+  pluginsChangesRequired: "Request body must include a `changes` array of `{ id, enabled?, settings? }` entries.",
+  pluginsChangeMalformed: "Each entry in `changes` must have a string `id` plus at least one of `enabled` (boolean) or `settings` (object).",
+  // 400, a bulk change carries `settings` against a bare plugin id.
+  // Settings are per-extension, so they require a qualified
+  // `<plugin>/<ext>` id; a bare plugin id is the wrong granularity.
+  pluginsSettingsRequireQualifiedId: 'Settings can only be written on a qualified `<plugin>/<ext>` id, not the bare plugin id "{{id}}".',
+  // 400, a bulk change carries `settings` for an extension that declares
+  // none in its manifest.
+  pluginsSettingsNoneDeclared: 'Extension "{{pluginId}}/{{extensionId}}" declares no configurable settings.',
+  // 400, a `settings` entry names a settingId the extension does not
+  // declare, or its value fails the declared input-type's rules. The
+  // `{{reason}}` is the resolver's per-type validation message.
+  pluginsSettingsInvalid: 'Invalid setting "{{settingId}}" for "{{pluginId}}/{{extensionId}}": {{reason}}.',
+  // 500, a settings write failed at persist time (AJV revalidation of
+  // the merged config file rejected the result).
+  pluginsSettingsPersistFailed: 'Failed to persist settings for "{{id}}": {{message}}.',
   // ---- preferences route (routes/preferences.ts) --------------------------
   //
   // GET / PATCH /api/preferences. The PATCH body is shaped
@@ -25316,13 +25824,15 @@ function registerGraphRoute(app, deps) {
 }
 function renderGraphPayload(formatter, loaded) {
   const scan = loaded ?? { nodes: [], links: [], issues: [] };
+  const settings2 = formatter.resolvedSettings ?? {};
   if (loaded === null) {
-    return formatter.format({ nodes: scan.nodes, links: scan.links, issues: scan.issues });
+    return formatter.format({ nodes: scan.nodes, links: scan.links, issues: scan.issues, settings: settings2 });
   }
   return formatter.format({
     nodes: scan.nodes,
     links: scan.links,
     issues: scan.issues,
+    settings: settings2,
     scanResult: loaded
   });
 }
@@ -25782,6 +26292,72 @@ function normalizeArrayIndices(path) {
   return path.replace(/\/\d+(?=\/|$)/g, "/*");
 }
 
+// server/routes/plugins-settings.ts
+function readManifestSettings(manifestLike) {
+  if (manifestLike === null || typeof manifestLike !== "object") return void 0;
+  const settings2 = manifestLike.settings;
+  if (settings2 && typeof settings2 === "object" && !Array.isArray(settings2)) {
+    return settings2;
+  }
+  return void 0;
+}
+function projectExtensionSettings(pluginId, extId, declarations, config) {
+  if (!declarations || Object.keys(declarations).length === 0) return {};
+  const settings2 = Object.entries(declarations).map(
+    ([id, declaration]) => ({ ...declaration, id })
+  );
+  const ref = { pluginId, id: extId, settings: declarations };
+  const resolved = resolveExtensionSettings(ref, config, () => {
+  });
+  const settingValues = {};
+  const secretSet = [];
+  for (const [id, declaration] of Object.entries(declarations)) {
+    if (declaration.type === "secret") {
+      if (Object.prototype.hasOwnProperty.call(resolved, id)) secretSet.push(id);
+      continue;
+    }
+    if (Object.prototype.hasOwnProperty.call(resolved, id)) {
+      settingValues[id] = resolved[id];
+    }
+  }
+  return {
+    settings: settings2,
+    settingValues,
+    ...secretSet.length > 0 ? { secretSettingsSet: secretSet } : {}
+  };
+}
+function validateSettingsPatch(pluginId, extId, declarations, patch) {
+  for (const [settingId, value] of Object.entries(patch)) {
+    const declaration = declarations?.[settingId];
+    if (!declaration) {
+      return {
+        settingId,
+        reason: `extension "${pluginId}/${extId}" declares no setting "${settingId}"`
+      };
+    }
+    let invalidReason = null;
+    resolveExtensionSettings(
+      { pluginId, id: extId, settings: { [settingId]: declaration } },
+      { plugins: { [pluginId]: { extensions: { [extId]: { settings: { [settingId]: value } } } } } },
+      (message) => {
+        invalidReason = message;
+      }
+    );
+    if (invalidReason !== null) {
+      return { settingId, reason: invalidReason };
+    }
+  }
+  return null;
+}
+function persistSettingsPatch(pluginId, extId, declarations, patch, cwd) {
+  for (const [settingId, value] of Object.entries(patch)) {
+    const declaration = declarations?.[settingId];
+    const target = declaration?.type === "secret" ? "project-local" : "project";
+    const dotKey = `plugins.${pluginId}.extensions.${extId}.settings.${settingId}`;
+    writeConfigValue(dotKey, value, { target, cwd });
+  }
+}
+
 // server/routes/plugins.ts
 var SINGLE_PATCH_BODY_SCHEMA = {
   type: "object",
@@ -25811,10 +26387,18 @@ var BULK_PATCH_BODY_SCHEMA = {
       items: {
         type: "object",
         additionalProperties: false,
-        required: ["id", "enabled"],
+        // `id` is the only mandatory field; a change carries `enabled`,
+        // `settings`, or both. `minProperties: 2` enforces at least one
+        // of the two beyond `id` (an `{ id }`-only entry is a no-op the
+        // client should not send). Per-setting type validation runs in
+        // code against the manifest, so `settings` is a permissive
+        // object here (the body schema only fixes its container shape).
+        required: ["id"],
+        minProperties: 2,
         properties: {
           id: { type: "string", minLength: 1 },
-          enabled: { type: "boolean" }
+          enabled: { type: "boolean" },
+          settings: { type: "object" }
         }
       }
     }
@@ -25826,7 +26410,13 @@ var parseBulkPatchBody = makeBodyValidator(BULK_PATCH_BODY_SCHEMA, {
   invalid: SERVER_TEXTS.pluginsChangeMalformed,
   mapping: {
     "/changes:required": SERVER_TEXTS.pluginsChangesRequired,
-    "/changes:type:array": SERVER_TEXTS.pluginsChangesRequired
+    "/changes:type:array": SERVER_TEXTS.pluginsChangesRequired,
+    // A change with neither `enabled` nor `settings` (just `id`) trips
+    // `minProperties`; surface the same "malformed entry" message.
+    "/changes/*:minProperties": SERVER_TEXTS.pluginsChangeMalformed,
+    "/changes/*:type:object": SERVER_TEXTS.pluginsChangeMalformed,
+    "/changes/*/settings:type:object": SERVER_TEXTS.pluginsChangeMalformed,
+    "/changes/*/enabled:type:boolean": SERVER_TEXTS.pluginsChangeMalformed
   }
 });
 function registerPluginsRoute(app, deps) {
@@ -25910,25 +26500,33 @@ function registerPluginsRoute(app, deps) {
   });
 }
 function listItems(deps, resolveEnabled) {
+  const config = deps.configService.effective();
   return [
-    ...deps.options.noBuiltIns ? [] : buildBuiltInItems(resolveEnabled),
-    ...buildDiscoveredItems(deps.pluginRuntime.discovered, deps, resolveEnabled)
+    ...deps.options.noBuiltIns ? [] : buildBuiltInItems(resolveEnabled, config),
+    ...buildDiscoveredItems(deps.pluginRuntime.discovered, deps, resolveEnabled, config)
   ];
 }
-function buildBuiltInItems(resolveEnabled) {
+function buildBuiltInItems(resolveEnabled, config) {
   return sortPluginsForPresentation(builtInPlugins).map((plugin) => {
     const pluginLocked = isPluginLocked(plugin.id);
     const extensions = plugin.extensions.map((ext) => {
       const qualified = qualifiedExtensionId(plugin.id, ext.id);
       const extLocked = pluginLocked || isPluginLocked(qualified);
+      const settings2 = projectExtensionSettings(
+        plugin.id,
+        ext.id,
+        readManifestSettings(ext),
+        config
+      );
       return {
         id: ext.id,
         kind: ext.kind,
         version: ext.version,
-        enabled: resolveEnabled(qualified),
+        enabled: resolveEnabled(qualified, installedDefaultEnabled(ext.stability)),
         ...ext.description ? { description: ext.description } : {},
         ...ext.stability ? { stability: ext.stability } : {},
-        ...extLocked ? { locked: true } : {}
+        ...extLocked ? { locked: true } : {},
+        ...settings2
       };
     });
     const pluginEnabled = extensions.some((e) => e.enabled);
@@ -25945,12 +26543,12 @@ function buildBuiltInItems(resolveEnabled) {
     };
   });
 }
-function buildDiscoveredItems(discovered, deps, resolveEnabled) {
-  return discovered.map((plugin) => buildDiscoveredItem(plugin, deps, resolveEnabled));
+function buildDiscoveredItems(discovered, deps, resolveEnabled, config) {
+  return discovered.map((plugin) => buildDiscoveredItem(plugin, deps, resolveEnabled, config));
 }
-function buildDiscoveredItem(plugin, deps, resolveEnabled) {
+function buildDiscoveredItem(plugin, deps, resolveEnabled, config) {
   const pluginLocked = isPluginLocked(plugin.id);
-  const extensions = projectExtensionRows(plugin, resolveEnabled, pluginLocked);
+  const extensions = projectExtensionRows(plugin, resolveEnabled, pluginLocked, config);
   const optional = optionalDiscoveredFields(plugin, extensions);
   return {
     id: plugin.id,
@@ -25971,20 +26569,27 @@ function optionalDiscoveredFields(plugin, extensions) {
   if (extensions) out.extensions = extensions;
   return out;
 }
-function projectExtensionRows(plugin, resolveEnabled, pluginLocked) {
+function projectExtensionRows(plugin, resolveEnabled, pluginLocked, config) {
   if (!plugin.extensions || plugin.extensions.length === 0) return void 0;
   return plugin.extensions.map((ext) => {
     const description = readInstanceDescription(ext.instance);
     const qualified = qualifiedExtensionId(plugin.id, ext.id);
     const extLocked = pluginLocked || isPluginLocked(qualified);
+    const settings2 = projectExtensionSettings(
+      plugin.id,
+      ext.id,
+      readManifestSettings(ext.instance),
+      config
+    );
     return {
       id: ext.id,
       kind: ext.kind,
       version: ext.version,
-      enabled: resolveEnabled(qualified),
+      enabled: resolveEnabled(qualified, installedDefaultEnabled(ext.stability)),
       ...description ? { description } : {},
       ...ext.stability ? { stability: ext.stability } : {},
-      ...extLocked ? { locked: true } : {}
+      ...extLocked ? { locked: true } : {},
+      ...settings2
     };
   });
 }
@@ -26102,25 +26707,35 @@ function projectListResponse(c, deps, overrides) {
   );
 }
 function validateBulkChange(change, deps) {
-  const slash = change.id.indexOf("/");
-  if (slash < 0) {
-    const handle2 = findHandle(change.id, deps);
-    if (!handle2) {
-      return {
-        status: 404,
-        code: "not-found",
-        message: tx(SERVER_TEXTS.pluginsUnknown, { id: change.id })
-      };
-    }
-    if (isPluginLocked(change.id)) {
-      return {
-        status: 403,
-        code: "locked",
-        message: tx(SERVER_TEXTS.pluginsLocked, { id: change.id })
-      };
-    }
-    return null;
+  return change.id.includes("/") ? validateQualifiedBulkChange(change, deps) : validateBareBulkChange(change, deps);
+}
+function validateBareBulkChange(change, deps) {
+  if (change.settings !== void 0) {
+    return {
+      status: 400,
+      code: "bad-query",
+      message: tx(SERVER_TEXTS.pluginsSettingsRequireQualifiedId, { id: change.id })
+    };
+  }
+  const handle = findHandle(change.id, deps);
+  if (!handle) {
+    return {
+      status: 404,
+      code: "not-found",
+      message: tx(SERVER_TEXTS.pluginsUnknown, { id: change.id })
+    };
+  }
+  if (isPluginLocked(change.id)) {
+    return {
+      status: 403,
+      code: "locked",
+      message: tx(SERVER_TEXTS.pluginsLocked, { id: change.id })
+    };
   }
+  return null;
+}
+function validateQualifiedBulkChange(change, deps) {
+  const slash = change.id.indexOf("/");
   const pluginId = change.id.slice(0, slash);
   const extensionId = change.id.slice(slash + 1);
   const handle = findHandle(pluginId, deps);
@@ -26145,13 +26760,49 @@ function validateBulkChange(change, deps) {
       message: tx(SERVER_TEXTS.pluginsExtensionLocked, { pluginId, extensionId })
     };
   }
+  if (change.settings !== void 0) {
+    return validateChangeSettings(handle, pluginId, extensionId, change.settings);
+  }
+  return null;
+}
+function validateChangeSettings(handle, pluginId, extensionId, patch) {
+  const declarations = handleExtensionSettings(handle, extensionId);
+  if (!declarations || Object.keys(declarations).length === 0) {
+    return {
+      status: 400,
+      code: "bad-query",
+      message: tx(SERVER_TEXTS.pluginsSettingsNoneDeclared, { pluginId, extensionId })
+    };
+  }
+  const failure = validateSettingsPatch(pluginId, extensionId, declarations, patch);
+  if (failure !== null) {
+    return {
+      status: 400,
+      code: "bad-query",
+      message: tx(SERVER_TEXTS.pluginsSettingsInvalid, {
+        settingId: failure.settingId,
+        pluginId,
+        extensionId,
+        reason: failure.reason
+      })
+    };
+  }
   return null;
 }
+function handleExtensionSettings(handle, extensionId) {
+  if (handle.kind === "built-in") {
+    const ext2 = handle.plugin.extensions.find((e) => e.id === extensionId);
+    return readManifestSettings(ext2);
+  }
+  const ext = (handle.plugin.extensions ?? []).find((e) => e.id === extensionId);
+  return readManifestSettings(ext?.instance);
+}
 async function persistBulkAndProject(c, deps, changes) {
   const overrides = await tryWithSqlite(
     { databasePath: deps.options.dbPath, autoBackup: false },
     async (adapter) => {
       for (const change of changes) {
+        if (change.enabled === void 0) continue;
         const writeKeys = expandBulkChangeKeys(change, deps);
         for (const key of writeKeys) {
           await applyChangeToAdapter(adapter, key, change.enabled);
@@ -26160,8 +26811,40 @@ async function persistBulkAndProject(c, deps, changes) {
       return await adapter.pluginConfig.loadOverrideMap();
     }
   );
+  if (overrides === null) {
+    throw new DbMissingError(
+      tx(SERVER_TEXTS.pluginsDbMissing, { path: deps.options.dbPath })
+    );
+  }
+  const settingsTouched = persistBulkSettings(deps, changes);
+  if (settingsTouched) deps.configService.reload();
   return projectListResponse(c, deps, overrides);
 }
+function persistBulkSettings(deps, changes) {
+  const cwd = deps.runtimeContext.cwd;
+  let touched = false;
+  for (const change of changes) {
+    if (change.settings === void 0) continue;
+    const slash = change.id.indexOf("/");
+    if (slash < 0) continue;
+    const pluginId = change.id.slice(0, slash);
+    const extensionId = change.id.slice(slash + 1);
+    const handle = findHandle(pluginId, deps);
+    const declarations = handle ? handleExtensionSettings(handle, extensionId) : void 0;
+    try {
+      persistSettingsPatch(pluginId, extensionId, declarations, change.settings, cwd);
+    } catch (err) {
+      throw new HTTPException9(500, {
+        message: tx(SERVER_TEXTS.pluginsSettingsPersistFailed, {
+          id: change.id,
+          message: err instanceof Error ? err.message : String(err)
+        })
+      });
+    }
+    if (Object.keys(change.settings).length > 0) touched = true;
+  }
+  return touched;
+}
 function expandBulkChangeKeys(change, deps) {
   if (change.id.includes("/")) return [change.id];
   const handle = findHandle(change.id, deps);
@@ -28513,7 +29196,7 @@ function formatCwdPath(cwd) {
 // cli/commands/serve.ts
 var ServeCommand = class extends SmCommand {
   static paths = [["serve"]];
-  static usage = Command33.Usage({
+  static usage = Command34.Usage({
     category: "Setup",
     description: "Start the Hono BFF (single-port: REST + WebSocket + SPA bundle).",
     details: `
@@ -28537,18 +29220,18 @@ var ServeCommand = class extends SmCommand {
       ["Point at a pre-built UI bundle", "$0 serve --ui-dist ./ui/dist/browser"]
     ]
   });
-  port = Option31.String("--port", {
+  port = Option32.String("--port", {
     required: false,
     description: "Listening port (default 4242). 0 = OS-assigned."
   });
-  host = Option31.String("--host", {
+  host = Option32.String("--host", {
     required: false,
     description: "Listening host (default 127.0.0.1). Loopback-only enforced when --dev-cors is set."
   });
-  noBuiltIns = Option31.Boolean("--no-built-ins", false, {
+  noBuiltIns = Option32.Boolean("--no-built-ins", false, {
     description: "Skip built-in plugin registration (parity with sm scan --no-built-ins)."
   });
-  noPlugins = Option31.Boolean("--no-plugins", false, {
+  noPlugins = Option32.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery."
   });
   // `Option.Boolean('--open', true)`, Clipanion's parser auto-derives
@@ -28558,31 +29241,31 @@ var ServeCommand = class extends SmCommand {
   // two registrations for the same flag and rejects the invocation
   // with "Ambiguous Syntax Error". Same convention shipped by every
   // other `--no-...` flag in the CLI tree.
-  open = Option31.Boolean("--open", true, {
+  open = Option32.Boolean("--open", true, {
     description: "Auto-open the SPA in the user's default browser after listen. --no-open opts out."
   });
-  devCors = Option31.Boolean("--dev-cors", false, {
+  devCors = Option32.Boolean("--dev-cors", false, {
     description: "Enable permissive CORS for the Angular dev-server proxy workflow."
   });
   // `--ui-dist` is intentionally undocumented in the Usage block above
   // (the demo build pipeline + tests rely on it; everyday users never
   // need it). Clipanion still exposes it on the parser; the Usage
   // omission is the "hidden" contract per the 14.1 brief.
-  uiDist = Option31.String("--ui-dist", { required: false, hidden: true });
-  noUi = Option31.Boolean("--no-ui", false, {
+  uiDist = Option32.String("--ui-dist", { required: false, hidden: true });
+  noUi = Option32.Boolean("--no-ui", false, {
     description: "Don't serve the Angular UI bundle. Use this when running the BFF alongside `ui:dev` (Angular dev server with HMR). The root `/` then renders an inline placeholder pointing the user at the dev server."
   });
-  noWatcher = Option31.Boolean("--no-watcher", false, {
+  noWatcher = Option32.Boolean("--no-watcher", false, {
     description: "Disable the chokidar-fed scan-and-broadcast loop. Use only for CI / read-only deployments."
   });
-  yes = Option31.Boolean("--yes", false, {
+  yes = Option32.Boolean("--yes", false, {
     description: "Skip the interactive prompt and rebuild the local cache when the on-disk DB has drifted (version skew or an inline schema change). Non-TTY invocations rebuild without asking regardless of this flag."
   });
   // `--watcher-debounce-ms` is undocumented sugar for advanced users
   // who want to tighten / relax the watcher's batching window without
   // editing settings.json. Hidden flag, the Usage block omits it.
-  watcherDebounceMs = Option31.String("--watcher-debounce-ms", { required: false, hidden: true });
-  maxNodes = Option31.String("--max-nodes", {
+  watcherDebounceMs = Option32.String("--watcher-debounce-ms", { required: false, hidden: true });
+  maxNodes = Option32.String("--max-nodes", {
     required: false,
     description: "Per-invocation override of scan.maxNodes (default 256). Bidirectional: raises OR lowers the recommended cap on classified nodes. Applies to every scan the server runs (initial watcher pass, debounced batches, POST /api/scan, GET /api/scan?fresh=1). Same flag is honoured on the bare `sm` invocation, which routes to `sm serve`."
   });
@@ -28926,7 +29609,7 @@ function tryOpenBrowser(url, stderr, warnGlyph) {
 }
 
 // cli/commands/show.ts
-import { Command as Command34, Option as Option32 } from "clipanion";
+import { Command as Command35, Option as Option33 } from "clipanion";
 
 // cli/i18n/show.texts.ts
 var SHOW_TEXTS = {
@@ -28977,7 +29660,7 @@ var SHOW_TEXTS = {
 // cli/commands/show.ts
 var ShowCommand = class extends SmCommand {
   static paths = [["show"]];
-  static usage = Command34.Usage({
+  static usage = Command35.Usage({
     category: "Browse",
     description: "Node detail: weight, frontmatter, links, issues.",
     details: `
@@ -28993,7 +29676,7 @@ var ShowCommand = class extends SmCommand {
       ["Machine-readable detail", "$0 show .claude/agents/architect.md --json"]
     ]
   });
-  nodePath = Option32.String({ required: true });
+  nodePath = Option33.String({ required: true });
   async run() {
     const dbPath = resolveDbPath({ db: this.db, ...defaultRuntimeContext() });
     const exit = requireDbOrExit(dbPath, this.context.stderr);
@@ -29235,7 +29918,7 @@ function rankConfidenceForGrouping(c) {
 // cli/commands/sidecar.ts
 import { unlink as unlink3 } from "fs/promises";
 import { resolve as resolve38 } from "path";
-import { Command as Command35, Option as Option33 } from "clipanion";
+import { Command as Command36, Option as Option34 } from "clipanion";
 
 // cli/i18n/sidecar.texts.ts
 var SIDECAR_TEXTS = {
@@ -29316,7 +29999,7 @@ async function runWithSidecarConsent(bag, ansi, dispatch) {
 }
 var SidecarRefreshCommand = class extends SmCommand {
   static paths = [["sidecar", "refresh"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Actions",
     description: "Refresh a sidecar's `for.{bodyHash, frontmatterHash}` to match the live node. Does NOT bump the version.",
     details: `
@@ -29333,8 +30016,8 @@ var SidecarRefreshCommand = class extends SmCommand {
       ["Refresh a node's sidecar hashes", "$0 sidecar refresh .claude/agents/architect.md"]
     ]
   });
-  nodePath = Option33.String({ required: true });
-  yes = Option33.Boolean("--yes", false, {
+  nodePath = Option34.String({ required: true });
+  yes = Option34.Boolean("--yes", false, {
     description: "Confirm writing .sm sidecar files in this project (sets allowEditSmFiles=true on first run)."
   });
   async run() {
@@ -29456,7 +30139,7 @@ var SidecarRefreshCommand = class extends SmCommand {
 };
 var SidecarPruneCommand = class extends SmCommand {
   static paths = [["sidecar", "prune"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Actions",
     description: "Delete orphan .sm files (sidecars whose accompanying .md no longer exists).",
     details: `
@@ -29478,8 +30161,8 @@ var SidecarPruneCommand = class extends SmCommand {
       ["Delete every orphan .sm file (non-interactive)", "$0 sidecar prune --yes"]
     ]
   });
-  dryRun = Option33.Boolean("-n,--dry-run", false);
-  yes = Option33.Boolean("--yes,--force", false, {
+  dryRun = Option34.Boolean("-n,--dry-run", false);
+  yes = Option34.Boolean("--yes,--force", false, {
     description: "Skip the interactive confirmation prompt. Required for non-interactive callers (CI, pre-commit hooks)."
   });
   // Complexity is from per-orphan handling, empty-set / dry-run /
@@ -29599,7 +30282,7 @@ var SidecarPruneCommand = class extends SmCommand {
 };
 var SidecarAnnotateCommand = class extends SmCommand {
   static paths = [["sidecar", "annotate"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Actions",
     description: "Scaffold an empty `<basename>.sm` next to a node ready for editing.",
     details: `
@@ -29617,9 +30300,9 @@ var SidecarAnnotateCommand = class extends SmCommand {
       ["Overwrite an existing one", "$0 sidecar annotate .claude/agents/architect.md --force"]
     ]
   });
-  nodePath = Option33.String({ required: true });
-  force = Option33.Boolean("--force", false);
-  yes = Option33.Boolean("--yes", false, {
+  nodePath = Option34.String({ required: true });
+  force = Option34.Boolean("--force", false);
+  yes = Option34.Boolean("--yes", false, {
     description: "Confirm writing .sm sidecar files in this project (sets allowEditSmFiles=true on first run)."
   });
   async run() {
@@ -29758,7 +30441,7 @@ var SIDECAR_COMMANDS = [
 ];
 
 // cli/commands/stubs.ts
-import { Command as Command36, Option as Option34 } from "clipanion";
+import { Command as Command37, Option as Option35 } from "clipanion";
 
 // cli/i18n/stubs.texts.ts
 var STUBS_TEXTS = {
@@ -29784,7 +30467,7 @@ var StubCommand = class extends SmCommand {
 };
 var DoctorCommand = class extends StubCommand {
   static paths = [["doctor"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Setup",
     description: planned("Diagnostic report: DB integrity, pending migrations, orphan rows, plugin status, runner availability.")
   });
@@ -29792,18 +30475,18 @@ var DoctorCommand = class extends StubCommand {
 };
 var FindingsCommand = class extends StubCommand {
   static paths = [["findings"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Browse",
     description: planned("Probabilistic findings: injection, stale summaries, low confidence.")
   });
-  kind = Option34.String("--kind", { required: false });
-  since = Option34.String("--since", { required: false });
-  threshold = Option34.String("--threshold", { required: false });
+  kind = Option35.String("--kind", { required: false });
+  since = Option35.String("--since", { required: false });
+  threshold = Option35.String("--threshold", { required: false });
   verbName = "findings";
 };
 var ActionsListCommand = class extends StubCommand {
   static paths = [["actions", "list"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Registered action types (manifest view).")
   });
@@ -29811,103 +30494,103 @@ var ActionsListCommand = class extends StubCommand {
 };
 var ActionsShowCommand = class extends StubCommand {
   static paths = [["actions", "show"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Full action manifest, including preconditions and expected duration.")
   });
-  id = Option34.String({ required: true });
+  id = Option35.String({ required: true });
   verbName = "actions show";
 };
 var JobSubmitCommand = class extends StubCommand {
   static paths = [["job", "submit"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Enqueue a single job or fan out to every matching node (--all).")
   });
-  action = Option34.String({ required: true });
-  node = Option34.String("-n", { required: false });
-  all = Option34.Boolean("--all", false);
+  action = Option35.String({ required: true });
+  node = Option35.String("-n", { required: false });
+  all = Option35.Boolean("--all", false);
   // CLI flag stays `--run`; field name is `runFlag` per the
   // shadow-avoidance convention documented on `SmCommand`.
-  runFlag = Option34.Boolean("--run", false);
-  force = Option34.Boolean("--force", false);
-  ttl = Option34.String("--ttl", { required: false });
-  priority = Option34.String("--priority", { required: false });
+  runFlag = Option35.Boolean("--run", false);
+  force = Option35.Boolean("--force", false);
+  ttl = Option35.String("--ttl", { required: false });
+  priority = Option35.String("--priority", { required: false });
   verbName = "job submit";
 };
 var JobListCommand = class extends StubCommand {
   static paths = [["job", "list"]];
-  static usage = Command36.Usage({ category: "Jobs", description: planned("List jobs.") });
-  status = Option34.String("--status", { required: false });
-  action = Option34.String("--action", { required: false });
-  node = Option34.String("--node", { required: false });
+  static usage = Command37.Usage({ category: "Jobs", description: planned("List jobs.") });
+  status = Option35.String("--status", { required: false });
+  action = Option35.String("--action", { required: false });
+  node = Option35.String("--node", { required: false });
   verbName = "job list";
 };
 var JobShowCommand = class extends StubCommand {
   static paths = [["job", "show"]];
-  static usage = Command36.Usage({ category: "Jobs", description: planned("Job detail: state, claim time, TTL, runner, content hash.") });
-  id = Option34.String({ required: true });
+  static usage = Command37.Usage({ category: "Jobs", description: planned("Job detail: state, claim time, TTL, runner, content hash.") });
+  id = Option35.String({ required: true });
   verbName = "job show";
 };
 var JobPreviewCommand = class extends StubCommand {
   static paths = [["job", "preview"]];
-  static usage = Command36.Usage({ category: "Jobs", description: planned("Render the job MD file without executing.") });
-  id = Option34.String({ required: true });
+  static usage = Command37.Usage({ category: "Jobs", description: planned("Render the job MD file without executing.") });
+  id = Option35.String({ required: true });
   verbName = "job preview";
 };
 var JobClaimCommand = class extends StubCommand {
   static paths = [["job", "claim"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Atomic primitive: return next queued job id, mark it running.")
   });
-  filter = Option34.String("--filter", { required: false });
+  filter = Option35.String("--filter", { required: false });
   verbName = "job claim";
 };
 var JobRunCommand = class extends StubCommand {
   static paths = [["job", "run"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Full CLI-runner loop: claim + spawn + record.")
   });
-  all = Option34.Boolean("--all", false);
-  max = Option34.String("--max", { required: false });
+  all = Option35.Boolean("--all", false);
+  max = Option35.String("--max", { required: false });
   verbName = "job run";
 };
 var JobStatusCommand = class extends StubCommand {
   static paths = [["job", "status"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Counts (per status) or single-job status.")
   });
-  id = Option34.String({ required: false });
+  id = Option35.String({ required: false });
   verbName = "job status";
 };
 var JobCancelCommand = class extends StubCommand {
   static paths = [["job", "cancel"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Force a running job to failed with reason user-cancelled.")
   });
-  id = Option34.String({ required: false });
-  all = Option34.Boolean("--all", false);
+  id = Option35.String({ required: false });
+  all = Option35.Boolean("--all", false);
   verbName = "job cancel";
 };
 var RecordCommand = class extends StubCommand {
   static paths = [["record"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Close a running job with success or failure. Nonce is the sole credential.")
   });
-  id = Option34.String("--id", { required: true });
-  nonce = Option34.String("--nonce", { required: true });
-  status = Option34.String("--status", { required: true });
-  report = Option34.String("--report", { required: false });
-  tokensIn = Option34.String("--tokens-in", { required: false });
-  tokensOut = Option34.String("--tokens-out", { required: false });
-  durationMs = Option34.String("--duration-ms", { required: false });
-  model = Option34.String("--model", { required: false });
-  error = Option34.String("--error", { required: false });
+  id = Option35.String("--id", { required: true });
+  nonce = Option35.String("--nonce", { required: true });
+  status = Option35.String("--status", { required: true });
+  report = Option35.String("--report", { required: false });
+  tokensIn = Option35.String("--tokens-in", { required: false });
+  tokensOut = Option35.String("--tokens-out", { required: false });
+  durationMs = Option35.String("--duration-ms", { required: false });
+  model = Option35.String("--model", { required: false });
+  error = Option35.String("--error", { required: false });
   verbName = "record";
 };
 var STUB_COMMANDS = [
@@ -29931,7 +30614,7 @@ import { cpSync as cpSync2, existsSync as existsSync32, mkdirSync as mkdirSync6,
 import { dirname as dirname20, join as join21, resolve as resolve39 } from "path";
 import { createInterface as createInterface5 } from "readline";
 import { fileURLToPath as fileURLToPath7 } from "url";
-import { Command as Command37, Option as Option35 } from "clipanion";
+import { Command as Command38, Option as Option36 } from "clipanion";
 
 // cli/i18n/tutorial.texts.ts
 var TUTORIAL_TEXTS = {
@@ -29993,7 +30676,7 @@ var TRIGGER_EN = "run the tutorial";
 var TRIGGER_ES = "ejecuta el tutorial";
 var TutorialCommand = class extends SmCommand {
   static paths = [["tutorial"]];
-  static usage = Command37.Usage({
+  static usage = Command38.Usage({
     category: "Setup",
     description: "Materialize an interactive tester tutorial as a Claude Code skill folder under `<cwd>/.claude/skills/`.",
     details: `
@@ -30016,15 +30699,15 @@ var TutorialCommand = class extends SmCommand {
   // more. Accept one so a stale `sm tutorial master` lands on a friendly
   // usage error (guarded in `run()`) instead of clipanion's generic
   // "extraneous argument" message.
-  legacyPositional = Option35.String({ required: false });
+  legacyPositional = Option36.String({ required: false });
   // Named `forProvider`, NOT `for` (reserved word). The CLI surface stays
   // `--for`; selects the destination Provider whose `scaffold.skillDir`
   // the skill is materialised under, skipping the interactive prompt.
-  forProvider = Option35.String("--for", {
+  forProvider = Option36.String("--for", {
     required: false,
     description: "Destination provider id (e.g. claude, agent-skills). Skips the prompt."
   });
-  force = Option35.Boolean("--force", false, {
+  force = Option36.Boolean("--force", false, {
     description: "Overwrite an existing target directory without prompting."
   });
   async run() {
@@ -30255,7 +30938,7 @@ function resolveSkillSourceDir() {
 }
 
 // cli/commands/version.ts
-import { Command as Command38 } from "clipanion";
+import { Command as Command39 } from "clipanion";
 
 // cli/i18n/version.texts.ts
 var VERSION_TEXTS = {
@@ -30270,7 +30953,7 @@ var VERSION_TEXTS = {
 // cli/commands/version.ts
 var VersionCommand = class extends SmCommand {
   static paths = [["version"]];
-  static usage = Command38.Usage({
+  static usage = Command39.Usage({
     category: "Introspection",
     description: "Print the CLI / kernel / spec / runtime / db-schema version matrix."
   });
@@ -30469,4 +31152,4 @@ function resolveBareDefault() {
   process.exit(ExitCode.Error);
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=3118bb11-aad2-50b2-b70d-ed15c2f72a97
+//# debugId=49fdc2af-2694-5cd0-ac19-33f8d1dffa9e