@skill-map/cli 0.55.0 → 0.56.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 // cli/entry.ts
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e21852cd-d92e-5bdf-abc7-02fffaa89502")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="49fdc2af-2694-5cd0-ac19-33f8d1dffa9e")}catch(e){}}();
 import { existsSync as existsSync33 } from "fs";
 import { Builtins, Cli as Cli2 } from "clipanion";
 
@@ -197,6 +197,10 @@ function matchesFilter(hook, event) {
 function buildHookContext(_hook, trigger, event) {
   const data = event.data ?? {};
   const ctx = {
+    // `settings` is always populated (possibly empty) so hooks can read
+    // `ctx.settings.<id>` without a presence check. The composer
+    // populated `resolvedSettings` on each composed hook.
+    settings: _hook.resolvedSettings ?? {},
     event: {
       type: trigger,
       timestamp: event.timestamp,
@@ -246,7 +250,7 @@ function bucketByKind(kind, instance, bag) {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.55.0",
+  version: "0.56.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -567,6 +571,41 @@ var ANTIGRAVITY_PLUGIN_ID = "antigravity";
 var AGENT_SKILLS_PLUGIN_ID = "agent-skills";
 
 // plugins/claude/providers/claude/index.ts
+var RESERVED_SLASH_NAMES = [
+  "help",
+  "clear",
+  "compact",
+  "cost",
+  "init",
+  "model",
+  "agents",
+  "login",
+  "logout",
+  "mcp",
+  "memory",
+  "config",
+  "doctor",
+  "permissions",
+  "add-dir",
+  "bug",
+  "pr-comments",
+  "release-notes",
+  "review",
+  "terminal-setup",
+  "vim",
+  "output-style",
+  "hooks",
+  "install-github-app",
+  "migrate-installer",
+  "upgrade",
+  "resume",
+  "exit",
+  "quit",
+  "security-review",
+  "statusline",
+  "usage",
+  "feedback"
+];
 var claudeProvider = {
   id: "claude",
   pluginId: CLAUDE_PLUGIN_ID,
@@ -718,53 +757,18 @@ var claudeProvider = {
   // declaring one of these (e.g. `.claude/commands/help.md`) is
   // silently shadowed: the runtime runs the built-in instead.
   //
-  // - `command`: canonical list of built-in slash commands documented
-  //   at https://docs.claude.com/en/docs/claude-code/slash-commands.
-  //   The list will drift as Anthropic adds / removes commands;
-  //   updates ship via a kernel patch + changeset (the catalog is
-  //   considered API surface that users rely on the analyzer to
-  //   reflect).
-  // - `agent`: built-in agents Anthropic ships with the CLI. Smaller
+  // - `command` / `skill`: both reserve `RESERVED_SLASH_NAMES` (defined
+  //   above). Per the resolution matrix they share the `/` invocation
+  //   namespace, so a built-in slash command shadows a user node of
+  //   EITHER kind that claims its name (a `skill` named `help` is as
+  //   unreachable as a `command` named `help`). The catalog is API
+  //   surface users rely on the analyzer to reflect.
+  // - `agent`: built-in agents Anthropic ships with the CLI, invoked
+  //   through the `@` / Task namespace (separate from `/`). Smaller
   //   surface than commands today.
-  // - `skill`: no built-in skills today (skills are user-defined and
-  //   discovered from disk); the key is omitted on purpose, defaulting
-  //   to no reserved names for the kind.
   reservedNames: {
-    command: [
-      "help",
-      "clear",
-      "compact",
-      "cost",
-      "init",
-      "model",
-      "agents",
-      "login",
-      "logout",
-      "mcp",
-      "memory",
-      "config",
-      "doctor",
-      "permissions",
-      "add-dir",
-      "bug",
-      "pr-comments",
-      "release-notes",
-      "review",
-      "terminal-setup",
-      "vim",
-      "output-style",
-      "hooks",
-      "install-github-app",
-      "migrate-installer",
-      "upgrade",
-      "resume",
-      "exit",
-      "quit",
-      "security-review",
-      "statusline",
-      "usage",
-      "feedback"
-    ],
+    command: RESERVED_SLASH_NAMES,
+    skill: RESERVED_SLASH_NAMES,
     agent: [
       "general-purpose",
       "output-style-setup",
@@ -1564,6 +1568,15 @@ var count2 = {
   emitWhenEmpty: false,
   priority: 30
 };
+var SETTING_IGNORED_DOMAINS = "ignored-domains";
+var settings = {
+  [SETTING_IGNORED_DOMAINS]: {
+    type: "string-list",
+    label: "Ignored domains",
+    description: "Hostnames to exclude from the external-URL count (e.g. internal mirrors, link shorteners).",
+    default: []
+  }
+};
 var URL_RE = /https?:\/\/[^\s<>"'`)\]]+/g;
 var TRAILING_PUNCT = /[.,;:!?]+$/;
 var externalUrlCounterExtractor = {
@@ -1572,6 +1585,14 @@ var externalUrlCounterExtractor = {
   kind: "extractor",
   description: "Counts the distinct external URLs in a node's body and shows the count on the card. Example: a body linking `https://example.com` and `https://docs.rs` shows a count of 2.",
   scope: "body",
+  /**
+   * Operator-configurable hostnames to exclude from the count. A URL
+   * whose normalized `hostname` is in this list is skipped entirely:
+   * no Signal, no contribution increment. Default empty (count every
+   * external URL). The operator sets it via
+   * `sm plugins config core/external-url-counter ignored-domains '["…"]'`.
+   */
+  settings,
   /**
    * Phase 6 / View contribution system, surface the distinct-URL
    * count as a card-footer-left chip alongside the in/out link
@@ -1591,6 +1612,7 @@ var externalUrlCounterExtractor = {
   ui: { count: count2 },
   extract(ctx) {
     const seen = /* @__PURE__ */ new Set();
+    const ignoredDomains = readIgnoredDomains(ctx.settings[SETTING_IGNORED_DOMAINS]);
     const body = stripCodeBlocks(ctx.body);
     const lineStarts = computeLineStarts(body);
     for (const match of body.matchAll(URL_RE)) {
@@ -1598,8 +1620,9 @@ var externalUrlCounterExtractor = {
       if (original.length === 0) continue;
       const normalized = normalizeUrl(original);
       if (normalized === null) continue;
-      if (seen.has(normalized)) continue;
-      seen.add(normalized);
+      if (ignoredDomains.has(normalized.host)) continue;
+      if (seen.has(normalized.href)) continue;
+      seen.add(normalized.href);
       const offset = match.index ?? 0;
       const line = lineFor(lineStarts, offset);
       ctx.emitSignal({
@@ -1611,12 +1634,12 @@ var externalUrlCounterExtractor = {
           {
             extractorId: ID6,
             kind: "references",
-            target: normalized,
+            target: normalized.href,
             confidence: 0.3,
             rationale: "external URL pseudo-link, counted then dropped",
             trigger: {
               originalTrigger: original,
-              normalizedTrigger: normalized
+              normalizedTrigger: normalized.href
             }
           }
         ]
@@ -1630,12 +1653,20 @@ var externalUrlCounterExtractor = {
 function stripTrailingPunctuation(raw) {
   return raw.replace(TRAILING_PUNCT, "");
 }
+function readIgnoredDomains(value) {
+  if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+  const out = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (typeof entry === "string" && entry.length > 0) out.add(entry.toLowerCase());
+  }
+  return out;
+}
 function normalizeUrl(raw) {
   try {
     const url = new URL(raw);
     url.hostname = url.hostname.toLowerCase();
     url.hash = "";
-    return url.href;
+    return { href: url.href, host: url.hostname };
   } catch {
     return null;
   }
@@ -2222,7 +2253,7 @@ var ID15 = "link-conflict";
 var NON_CONFLICTING_KINDS = /* @__PURE__ */ new Set(["points"]);
 var linkConflictAnalyzer = {
   id: ID15,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   description: "Flags conflicting arrow meanings between extractors (e.g. `references` vs `invokes`).",
   mode: "deterministic",
@@ -2287,52 +2318,30 @@ function rankConfidence(c) {
   return c;
 }
 
-// kernel/util/trigger-resolve.ts
-function buildNameIndex(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  indexByCanonicalName(nodes, out);
-  fillIndexWithPathBasename(nodes, out);
-  return out;
-}
-function indexByCanonicalName(nodes, out) {
-  for (const node of nodes) {
-    const raw = canonicalName(node);
-    if (raw === null) continue;
-    const key = normalizeTrigger(raw);
-    if (!out.has(key)) out.set(key, node.path);
-  }
+// kernel/util/link-lines.ts
+function isSelfLoop(link) {
+  if (link.source === link.target) return true;
+  if (link.resolvedTarget && link.source === link.resolvedTarget) return true;
+  return false;
 }
-function fillIndexWithPathBasename(nodes, out) {
-  for (const node of nodes) {
-    if (canonicalName(node) !== null) continue;
-    const derived = pathBasenameForLink(node.path);
-    if (derived.length === 0) continue;
-    const key = normalizeTrigger(derived);
-    if (!out.has(key)) out.set(key, node.path);
+function linkLines(link) {
+  const lines = /* @__PURE__ */ new Set();
+  for (const occ of link.occurrences ?? []) {
+    const line = occ.location?.line;
+    if (typeof line === "number") lines.add(line);
   }
-}
-function canonicalName(node) {
-  const raw = node.frontmatter?.["name"];
-  if (typeof raw !== "string" || raw.length === 0) return null;
-  return raw;
-}
-function pathBasenameForLink(path) {
-  const segments = path.split("/").filter((s) => s.length > 0);
-  if (segments.length === 0) return path;
-  const last = segments[segments.length - 1];
-  if (last === "SKILL.md" && segments.length >= 2) {
-    return segments[segments.length - 2];
+  if (lines.size === 0) {
+    const line = link.location?.line;
+    if (typeof line === "number") lines.add(line);
   }
-  return last.replace(/\.md$/, "");
+  return [...lines].sort((a, b) => a - b);
 }
-function resolveLinkTargetToPath(link, nameIndex) {
-  const raw = link.target;
-  const sigil = raw.charAt(0);
-  if (sigil !== "/" && sigil !== "@") return raw;
-  const normalizedTrigger = link.trigger?.normalizedTrigger;
-  const normalized = typeof normalizedTrigger === "string" ? normalizedTrigger.replace(/^[/@]/, "").trim() : normalizeTrigger(raw.slice(1));
-  const resolved = nameIndex.get(normalized);
-  return resolved ?? raw;
+function linkWhere(link, texts) {
+  const lines = linkLines(link);
+  if (lines.length === 0) return "";
+  return tx(lines.length === 1 ? texts.single : texts.plural, {
+    lines: lines.join(", ")
+  });
 }
 
 // plugins/core/analyzers/link-counter/index.ts
@@ -2359,13 +2368,12 @@ var linkCounterAnalyzer = {
   mode: "deterministic",
   ui: { linksIn, linksOut },
   evaluate(ctx) {
-    const nameIndex = buildNameIndex(ctx.nodes);
     const perTarget = /* @__PURE__ */ new Map();
     const perSource = /* @__PURE__ */ new Map();
     for (const link of ctx.links) {
-      const resolvedTarget = resolveLinkTargetToPath(link, nameIndex);
-      if (link.source === link.target || link.source === resolvedTarget) continue;
-      bump(perTarget, resolvedTarget, link.kind);
+      if (isSelfLoop(link)) continue;
+      const target = link.resolvedTarget ?? link.target;
+      bump(perTarget, target, link.kind);
       bump(perSource, link.source, link.kind);
     }
     for (const node of ctx.nodes) {
@@ -2399,27 +2407,6 @@ function formatBreakdown(byKind, direction) {
   return [direction, ...lines].join("\n");
 }
 
-// kernel/util/link-lines.ts
-function linkLines(link) {
-  const lines = /* @__PURE__ */ new Set();
-  for (const occ of link.occurrences ?? []) {
-    const line = occ.location?.line;
-    if (typeof line === "number") lines.add(line);
-  }
-  if (lines.size === 0) {
-    const line = link.location?.line;
-    if (typeof line === "number") lines.add(line);
-  }
-  return [...lines].sort((a, b) => a - b);
-}
-function linkWhere(link, texts) {
-  const lines = linkLines(link);
-  if (lines.length === 0) return "";
-  return tx(lines.length === 1 ? texts.single : texts.plural, {
-    lines: lines.join(", ")
-  });
-}
-
 // plugins/core/analyzers/link-self-loop/text.ts
 var LINK_SELF_LOOP_TEXTS = {
   /**
@@ -2465,22 +2452,13 @@ var linkSelfLoopAnalyzer = {
         data: {
           target: link.target,
           resolvedTarget: link.resolvedTarget ?? link.target,
-          kind: link.kind,
-          // Mark explicitly so UI / downstream consumers can read this
-          // single field instead of re-computing the `source === target`
-          // predicate themselves.
-          selfLoop: true
+          kind: link.kind
         }
       });
     }
     return issues;
   }
 };
-function isSelfLoop(link) {
-  if (link.source === link.target) return true;
-  if (link.resolvedTarget && link.source === link.resolvedTarget) return true;
-  return false;
-}
 
 // kernel/orchestrator/node-identifiers.ts
 import { posix as pathPosix4 } from "path";
@@ -2530,6 +2508,15 @@ function liftResolvedLinkConfidence(links, nodes, ctx) {
     if (link.confidence < 1) applyResolution(link, indexes, ctx);
   }
 }
+function collectBrokenLinks(links, nodes, ctx) {
+  const broken = /* @__PURE__ */ new Set();
+  if (links.length === 0) return broken;
+  const indexes = buildIndexes(nodes, ctx);
+  for (const link of links) {
+    if (isGenuinelyBroken(link, indexes)) broken.add(link);
+  }
+  return broken;
+}
 function applyResolution(link, indexes, ctx) {
   const resolution = resolve2(link, indexes, ctx);
   if (resolution === "none") {
@@ -2606,7 +2593,7 @@ var NAME_RESERVED_TEXTS = {
    * a runtime built-in. Same wording skill-map shipped before the
    * source-side link finding landed.
    */
-  message: "Built-in {{provider}} {{kind}}:\nShadowed by this file; the runtime uses its built-in instead. Rename the file or its `frontmatter.name`.",
+  message: "Name collision: this {{kind}} name is already used by the {{provider}} runtime built-in, which shadows this file. Rename the file or its `frontmatter.name`.",
   /**
    * Source-side message: emitted on the node that AUTHORED a link
    * whose target resolves to a reserved name. Explains WHY the link's
@@ -2614,7 +2601,7 @@ var NAME_RESERVED_TEXTS = {
    * the kernel saw the target match a runtime built-in and downgraded
    * the edge so the operator notices.
    */
-  linkMessage: "{{target}}:\nResolves to a {{provider}} built-in ({{reservedKind}} `{{reservedPath}}`){{where}}; edge downgraded to confidence {{confidence}}. Rename the target file or its `frontmatter.name`.",
+  linkMessage: "{{target}}:\nName collision: resolves to a {{provider}} built-in ({{reservedKind}} `{{reservedPath}}`){{where}}; the built-in wins, so this edge drops to confidence {{confidence}}. Rename the target file or its `frontmatter.name`.",
   /** Location suffix after the built-in parens, one detection site. */
   whereSingle: " (line {{lines}})",
   /** Location suffix after the built-in parens, several detection sites. */
@@ -2653,7 +2640,9 @@ var nameReservedAnalyzer = {
     }
     for (const link of ctx.links) {
       if (link.confidence !== RESERVED_TARGET_CONFIDENCE) continue;
-      const reservedNode = findReservedNodeForLink(link, reserved, byPath3);
+      const reservedPath = link.resolvedTarget;
+      if (!reservedPath || !reserved.has(reservedPath)) continue;
+      const reservedNode = byPath3.get(reservedPath);
       if (!reservedNode) continue;
       issues.push({
         analyzerId: ID18,
@@ -2686,41 +2675,6 @@ function linkWhereSuffix(link) {
     plural: NAME_RESERVED_TEXTS.wherePlural
   });
 }
-function findReservedNodeForLink(link, reserved, byPath3) {
-  if (reserved.has(link.target)) {
-    const node = byPath3.get(link.target);
-    if (node) return node;
-  }
-  const trigger = link.trigger?.normalizedTrigger;
-  if (!trigger) return null;
-  const stripped = trigger.replace(/^[/@]/, "").trim();
-  if (stripped.length === 0) return null;
-  for (const path of reserved) {
-    const node = byPath3.get(path);
-    if (!node) continue;
-    if (matchesNodeIdentifier(node, stripped)) return node;
-  }
-  return null;
-}
-function matchesNodeIdentifier(node, stripped) {
-  const candidates = [];
-  const fmName = node.frontmatter?.["name"];
-  if (typeof fmName === "string" && fmName.length > 0) candidates.push(normaliseId(fmName));
-  const basename = node.path.split("/").pop() ?? "";
-  if (basename) {
-    const stem = basename.replace(/\.[^.]+$/, "");
-    if (stem) candidates.push(normaliseId(stem));
-  }
-  const segs = node.path.split("/");
-  if (segs.length >= 2) {
-    const dirBase = segs[segs.length - 2];
-    if (dirBase) candidates.push(normaliseId(dirBase));
-  }
-  return candidates.includes(stripped);
-}
-function normaliseId(raw) {
-  return raw.normalize("NFD").replace(new RegExp("\\p{Mn}+", "gu"), "").toLowerCase().replace(/[-_\s]+/g, " ").replace(/  +/g, " ").trim();
-}
 
 // plugins/core/analyzers/node-stability/text.ts
 var NODE_STABILITY_TEXTS = {
@@ -2891,7 +2845,7 @@ function pickSupersededBy(node) {
 }
 
 // plugins/core/analyzers/reference-broken/index.ts
-import { posix as pathPosix5, resolve as resolve3 } from "path";
+import { resolve as resolve3 } from "path";
 
 // plugins/core/analyzers/reference-broken/text.ts
 var REFERENCE_BROKEN_TEXTS = {
@@ -2922,13 +2876,7 @@ var REFERENCE_BROKEN_TEXTS = {
   // Tooltips for the per-node view-contribution badges. Singular vs
   // plural keeps the count grammar correct without a sub-template.
   alertTooltipSingle: "This node has a broken reference. Open the inspector for details.",
-  alertTooltipMany: "This node has {{count}} broken references. Open the inspector for details.",
-  // Fix-summary copy when the broken trigger has a same-named file on
-  // disk that does not advertise `name:` in its frontmatter. Two
-  // variants for single vs multiple candidates; same template family
-  // as the alert tooltips above.
-  hintSummarySingle: "Add `name: {{name}}` to the frontmatter of {{candidate}} so this reference resolves.",
-  hintSummaryMany: "Add `name: {{name}}` to the frontmatter of one of these files so this reference resolves: {{candidates}}."
+  alertTooltipMany: "This node has {{count}} broken references. Open the inspector for details."
 };
 
 // plugins/core/analyzers/reference-broken/index.ts
@@ -2944,33 +2892,31 @@ var referenceBrokenAnalyzer = {
   // aggregate severity counters now owned by `core/issue-counter`. The
   // detection logic stays intact, only the chip emission is gone.
   ui: {},
-  // The resolver, the reference-paths escape hatch, and the hint
-  // index all share the per-link loop, splitting would re-walk
-  // `ctx.links` once per concern. The per-source aggregation that
-  // historically lived alongside (driving the now-retired chip
-  // emission) moved into `core/issue-counter`.
+  // Pure projector of the orchestrator's genuinely-broken verdict
+  // (`ctx.brokenLinks`, computed once from the same name index the
+  // confidence lift uses), with the reference-paths escape hatch layered
+  // on top. The per-source aggregation that historically lived alongside
+  // (driving the now-retired chip emission) moved into
+  // `core/issue-counter`.
   evaluate(ctx) {
-    const byPath3 = new Set(ctx.nodes.map((n) => n.path));
-    const byNormalizedName = indexByNormalizedName(ctx.nodes);
-    const byBasenameWithoutName = indexByBasenameWithoutName(ctx.nodes);
-    const refIndex = ctx.referenceablePaths && ctx.referenceablePaths.size > 0 && ctx.cwd ? { paths: ctx.referenceablePaths, cwd: ctx.cwd } : null;
+    const broken = ctx.brokenLinks;
+    if (!broken || broken.size === 0) return [];
+    const refIndex = buildReferenceIndex(ctx);
     const issues = [];
     for (const link of ctx.links) {
-      if (isResolved(link, byPath3, byNormalizedName)) continue;
+      if (!broken.has(link)) continue;
       if (refIndex && resolvesViaReferencePaths(link, refIndex)) continue;
-      const candidates = findHintCandidates(link, byBasenameWithoutName);
-      issues.push(buildIssue(link, candidates));
+      issues.push(buildIssue(link));
     }
     return issues;
   }
 };
-function buildIssue(link, hintCandidates = []) {
-  const data = {
-    target: link.target,
-    kind: link.kind,
-    trigger: link.trigger?.normalizedTrigger ?? null
-  };
-  const issue = {
+function buildReferenceIndex(ctx) {
+  if (!ctx.referenceablePaths || ctx.referenceablePaths.size === 0 || !ctx.cwd) return null;
+  return { paths: ctx.referenceablePaths, cwd: ctx.cwd };
+}
+function buildIssue(link) {
+  return {
     analyzerId: ID21,
     // `error`, not `warn`: a link whose target is not in the scan is a
     // structural defect the operator must notice, and the card chip
@@ -2988,86 +2934,17 @@ function buildIssue(link, hintCandidates = []) {
         plural: REFERENCE_BROKEN_TEXTS.wherePlural
       })
     }),
-    data
-  };
-  if (hintCandidates.length > 0) attachHint(issue, data, link, hintCandidates);
-  return issue;
-}
-function attachHint(issue, data, link, hintCandidates) {
-  const suggestedName = (link.trigger?.normalizedTrigger ?? "").replace(/^[/@]/, "").trim();
-  const candidatePaths = hintCandidates.map((n) => n.path);
-  data["hint"] = {
-    kind: "missing-frontmatter-name",
-    suggestedName,
-    candidates: candidatePaths
-  };
-  issue.fix = {
-    summary: candidatePaths.length === 1 ? tx(REFERENCE_BROKEN_TEXTS.hintSummarySingle, {
-      name: suggestedName,
-      candidate: candidatePaths[0]
-    }) : tx(REFERENCE_BROKEN_TEXTS.hintSummaryMany, {
-      name: suggestedName,
-      candidates: candidatePaths.join(", ")
-    }),
-    autofixable: false
+    data: {
+      target: link.target,
+      kind: link.kind,
+      trigger: link.trigger?.normalizedTrigger ?? null
+    }
   };
 }
 function resolvesViaReferencePaths(link, refIndex) {
   if (!isPathStyleLink(link)) return false;
   return refIndex.paths.has(resolve3(refIndex.cwd, link.target));
 }
-function indexByNormalizedName(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    const raw = node.frontmatter?.["name"];
-    const name = typeof raw === "string" ? raw : "";
-    if (!name) continue;
-    const key = normalizeTrigger(name);
-    const bucket = out.get(key) ?? [];
-    bucket.push(node);
-    out.set(key, bucket);
-  }
-  return out;
-}
-function basenameWithoutExt(path) {
-  const base = pathPosix5.basename(path);
-  const ext = pathPosix5.extname(base);
-  return ext ? base.slice(0, -ext.length) : base;
-}
-function indexByBasenameWithoutName(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    const raw = node.frontmatter?.["name"];
-    const name = typeof raw === "string" ? raw : "";
-    if (name) continue;
-    const bare = basenameWithoutExt(node.path);
-    if (!bare) continue;
-    const key = normalizeTrigger(bare);
-    if (!key) continue;
-    const bucket = out.get(key) ?? [];
-    bucket.push(node);
-    out.set(key, bucket);
-  }
-  return out;
-}
-function findHintCandidates(link, idx) {
-  const normalized = link.trigger?.normalizedTrigger;
-  if (!normalized) return [];
-  const sigil = normalized.charAt(0);
-  if (sigil !== "/" && sigil !== "@") return [];
-  const withoutSigil = normalized.slice(1).trim();
-  if (!withoutSigil) return [];
-  return idx.get(withoutSigil) ?? [];
-}
-function isResolved(link, byPath3, byNormalizedName) {
-  const normalized = link.trigger?.normalizedTrigger;
-  if (normalized) {
-    const withoutSigil = normalized.replace(/^[/@]/, "").trim();
-    if (byNormalizedName.has(withoutSigil)) return true;
-  }
-  if (byPath3.has(link.target)) return true;
-  return false;
-}
 function isPathStyleLink(link) {
   const sigil = link.trigger?.normalizedTrigger?.charAt(0);
   if (sigil === "/" || sigil === "@") return false;
@@ -3106,12 +2983,9 @@ var referenceRedundantAnalyzer = {
   mode: "deterministic",
   evaluate(ctx) {
     if (ctx.links.length === 0) return [];
-    const byPath3 = /* @__PURE__ */ new Map();
-    for (const node of ctx.nodes) byPath3.set(node.path, node);
-    const byName = buildNameIndex2(ctx.nodes);
     const groups = /* @__PURE__ */ new Map();
     for (const link of ctx.links) {
-      const resolved = resolveTargetPath(link, byPath3, byName);
+      const resolved = link.resolvedTarget;
       if (!resolved) continue;
       const key = `${link.source}\0${resolved}`;
       const bucket = groups.get(key);
@@ -3192,45 +3066,6 @@ function formatGroupedOccurrences(occurrences) {
     })
   ).join(REFERENCE_REDUNDANT_TEXTS.occurrenceSeparator);
 }
-function buildNameIndex2(nodes) {
-  const out = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    for (const candidate of collectIdentifiers(node)) {
-      const normalised = normalizeTrigger(candidate);
-      if (!normalised) continue;
-      const bucket = out.get(normalised);
-      if (bucket) bucket.push(node.path);
-      else out.set(normalised, [node.path]);
-    }
-  }
-  return out;
-}
-function collectIdentifiers(node) {
-  const out = [];
-  const fmName = node.frontmatter?.["name"];
-  if (typeof fmName === "string" && fmName.length > 0) out.push(fmName);
-  const segs = node.path.split("/");
-  const last = segs[segs.length - 1] ?? "";
-  if (last) {
-    const stem = last.replace(/\.[^.]+$/, "");
-    if (stem) out.push(stem);
-  }
-  if (segs.length >= 2) {
-    const dirBase = segs[segs.length - 2];
-    if (dirBase) out.push(dirBase);
-  }
-  return out;
-}
-function resolveTargetPath(link, byPath3, byName) {
-  if (byPath3.has(link.target)) return link.target;
-  const trigger = link.trigger?.normalizedTrigger;
-  if (!trigger) return null;
-  const stripped = trigger.replace(/^[/@]/, "").trim();
-  if (!stripped) return null;
-  const candidates = byName.get(stripped);
-  if (!candidates || candidates.length === 0) return null;
-  return candidates[0] ?? null;
-}
 
 // kernel/adapters/schema-validators.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -4789,11 +4624,11 @@ function validateOrDefault(parsed) {
   if (!result.ok) return defaultSettings();
   return result.data;
 }
-function backfillSubObjects(settings) {
+function backfillSubObjects(settings2) {
   return {
-    ...settings,
-    updateCheck: settings.updateCheck ?? {},
-    telemetry: settings.telemetry ?? {}
+    ...settings2,
+    updateCheck: settings2.updateCheck ?? {},
+    telemetry: settings2.telemetry ?? {}
   };
 }
 function writeUserSettings(patch) {
@@ -4813,24 +4648,24 @@ function writeUserSettings(patch) {
   }
 }
 function isUpdateCheckEnabled() {
-  const settings = readUserSettings();
-  return settings.updateCheck?.enabled !== false;
+  const settings2 = readUserSettings();
+  return settings2.updateCheck?.enabled !== false;
 }
 function isErrorTelemetryEnabled() {
-  const settings = readUserSettings();
-  return settings.telemetry?.errorsEnabled === true;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.errorsEnabled === true;
 }
 function isUsageCliTelemetryEnabled() {
-  const settings = readUserSettings();
-  return settings.telemetry?.usageCliEnabled === true;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.usageCliEnabled === true;
 }
 function isUsageUiTelemetryEnabled() {
-  const settings = readUserSettings();
-  return settings.telemetry?.usageUiEnabled === true;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.usageUiEnabled === true;
 }
 function readAnonymousId() {
-  const settings = readUserSettings();
-  return settings.telemetry?.anonymousId ?? null;
+  const settings2 = readUserSettings();
+  return settings2.telemetry?.anonymousId ?? null;
 }
 function ensureAnonymousId(generate = () => randomUUID()) {
   const existing = readAnonymousId();
@@ -4840,12 +4675,12 @@ function ensureAnonymousId(generate = () => randomUUID()) {
   return id;
 }
 function hasTelemetryPromptBeenShown() {
-  const settings = readUserSettings();
-  return typeof settings.telemetry?.promptedAt === "number";
+  const settings2 = readUserSettings();
+  return typeof settings2.telemetry?.promptedAt === "number";
 }
 function hasSeenFirstRun() {
-  const settings = readUserSettings();
-  return typeof settings.telemetry?.firstRunAt === "number";
+  const settings2 = readUserSettings();
+  return typeof settings2.telemetry?.firstRunAt === "number";
 }
 function mergeSettings(current, patch) {
   const merged = {
@@ -6255,6 +6090,10 @@ function removeConfigValue(key, opts) {
   writeJsonAtomic(path, merged);
   return true;
 }
+function getValueSource(key, opts) {
+  const loaded = loadConfigForScope(opts);
+  return loaded.sources.get(key);
+}
 function loadConfigForScope(opts) {
   return loadConfig({
     cwd: opts.cwd,
@@ -11695,6 +11534,7 @@ function filterBuiltInManifests(manifests, resolveEnabled) {
 // core/runtime/plugin-runtime/composer.ts
 function composeScanExtensions(opts) {
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
+  const resolveSettings = opts.resolveSettings;
   const providers = [];
   const extractors = [];
   const analyzers = [];
@@ -11703,20 +11543,21 @@ function composeScanExtensions(opts) {
   if (!opts.noBuiltIns) {
     accumulateBuiltInScanExtensions(
       { providers, extractors, analyzers, hooks, actions },
-      resolveEnabled
+      resolveEnabled,
+      resolveSettings
     );
   }
   for (const ext of opts.pluginRuntime.extensions.providers) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) providers.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) providers.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.extractors) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) extractors.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) extractors.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.analyzers) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) analyzers.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) analyzers.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.hooks) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) hooks.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) hooks.push(withResolvedSettings(ext, resolveSettings));
   }
   for (const ext of opts.pluginRuntime.extensions.actions) {
     if (isPluginExtensionEnabled(ext, resolveEnabled)) actions.push(ext);
@@ -11735,22 +11576,26 @@ function composeScanExtensions(opts) {
     actions
   };
 }
-function accumulateBuiltInScanExtensions(buckets, resolveEnabled) {
+function withResolvedSettings(ext, resolveSettings) {
+  if (!resolveSettings) return ext;
+  return { ...ext, resolvedSettings: resolveSettings(ext) };
+}
+function accumulateBuiltInScanExtensions(buckets, resolveEnabled, resolveSettings) {
   for (const plugin of builtInPlugins) {
     for (const ext of plugin.extensions) {
       if (!isBuiltInExtensionEnabled(plugin, ext, resolveEnabled)) continue;
       switch (ext.kind) {
         case "provider":
-          buckets.providers.push(ext);
+          buckets.providers.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "extractor":
-          buckets.extractors.push(ext);
+          buckets.extractors.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "analyzer":
-          buckets.analyzers.push(ext);
+          buckets.analyzers.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "hook":
-          buckets.hooks.push(ext);
+          buckets.hooks.push(withResolvedSettings(ext, resolveSettings));
           break;
         case "action":
           buckets.actions.push(ext);
@@ -11768,18 +11613,19 @@ function accumulateBuiltInScanExtensions(buckets, resolveEnabled) {
 function composeFormatters(opts) {
   const noBuiltIns = opts.noBuiltIns ?? false;
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
+  const resolveSettings = opts.resolveSettings;
   const out = [];
   if (!noBuiltIns) {
     for (const plugin of builtInPlugins) {
       for (const ext of plugin.extensions) {
         if (ext.kind !== "formatter") continue;
         if (!isBuiltInExtensionEnabled(plugin, ext, resolveEnabled)) continue;
-        out.push(ext);
+        out.push(withResolvedSettings(ext, resolveSettings));
       }
     }
   }
   for (const ext of opts.pluginRuntime.extensions.formatters) {
-    if (isPluginExtensionEnabled(ext, resolveEnabled)) out.push(ext);
+    if (isPluginExtensionEnabled(ext, resolveEnabled)) out.push(withResolvedSettings(ext, resolveSettings));
   }
   return out;
 }
@@ -14966,6 +14812,9 @@ var GraphCommand = class extends SmCommand {
         nodes: scan.nodes,
         links: scan.links,
         issues: scan.issues,
+        // Resolved settings of the formatter (empty when the formatter
+        // declares none, or when the composer did not populate them).
+        settings: formatter.resolvedSettings ?? {},
         // Pass the full persisted scan so format-specific renderers
         // that mirror a `ScanResult` envelope (today: built-in `json`)
         // can emit it verbatim without re-deriving fields like
@@ -15977,12 +15826,12 @@ function emitExtensionError(emitter, qualifiedId2, nodePath, data) {
 }
 function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enrichNode, emitContribution, emitSignal, emitNode, store) {
   const scope = extractor.scope ?? "both";
-  const settings = extractor.resolvedSettings ?? {};
+  const settings2 = extractor.resolvedSettings ?? {};
   return {
     node,
     body: scope === "frontmatter" ? "" : body,
     frontmatter: scope === "body" ? {} : frontmatter,
-    settings,
+    settings: settings2,
     emitLink,
     enrichNode,
     emitContribution,
@@ -16281,7 +16130,7 @@ function runActionProjections(actions, nodes, links, emitter) {
 }
 
 // kernel/orchestrator/analyzers.ts
-async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, signals, seedIssues = []) {
+async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, brokenLinks, signals, seedIssues = []) {
   const issues = [...seedIssues];
   const contributions = [];
   const contributionErrors = [];
@@ -16358,6 +16207,10 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
     const emitted = await analyzer.evaluate({
       nodes,
       links: internalLinks,
+      // `settings` is always populated (possibly empty) so analyzers can
+      // read `ctx.settings.<id>` without a presence check. The composer
+      // populated `resolvedSettings` on each composed analyzer.
+      settings: analyzer.resolvedSettings ?? {},
       orphanSidecars: analyzerOrphans,
       sidecarRoots,
       annotationContributions,
@@ -16371,6 +16224,7 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
       ...referenceablePaths ? { referenceablePaths } : {},
       ...cwd ? { cwd } : {},
       ...reservedNodePaths ? { reservedNodePaths } : {},
+      ...brokenLinks ? { brokenLinks } : {},
       ...signals && signals.length > 0 ? { signals } : {},
       emitContribution
     });
@@ -17593,6 +17447,7 @@ async function runScanInternal(_kernel, options) {
   walked.signals = resolved.resolvedSignals;
   const postWalkCtx = buildPostWalkTransformCtx(exts.providers, walked.nodes, activeProviderId);
   walked.internalLinks = applyPostWalkTransforms(walked.internalLinks, walked.nodes, postWalkCtx);
+  const brokenLinks = collectBrokenLinks(walked.internalLinks, walked.nodes, postWalkCtx);
   recomputeLinkCounts(walked.nodes, walked.internalLinks);
   recomputeExternalRefsCount(walked.nodes, walked.externalLinks, walked.cachedPaths);
   await dispatchExtractorCompleted(exts.extractors, emitter, hookDispatcher);
@@ -17614,6 +17469,7 @@ async function runScanInternal(_kernel, options) {
     emitter,
     hookDispatcher,
     postWalkCtx.reservedNodePaths,
+    brokenLinks,
     walked.signals,
     // Seed the accumulator with orchestrator-emitted frontmatter
     // issues so the aggregate phase (`core/issue-counter`) counts
@@ -18058,6 +17914,159 @@ function findOrphanJobFiles(jobsDir, referencedPaths) {
   return { orphanFilePaths: orphans, referencedCount: referencedPaths.size };
 }
 
+// core/config/plugin-settings.ts
+var defaultWarn = (message) => log.warn(message);
+function resolveExtensionSettings(manifest, config, onWarn = defaultWarn) {
+  const declarations = manifest.settings;
+  if (!declarations || Object.keys(declarations).length === 0) return {};
+  const overrides = readSettingsOverrides(config, manifest.pluginId, manifest.id);
+  const resolved = {};
+  for (const [settingId, declaration] of Object.entries(declarations)) {
+    const outcome = resolveOneSetting(manifest, settingId, declaration, overrides, onWarn);
+    if (outcome.hasValue) resolved[settingId] = outcome.value;
+  }
+  return resolved;
+}
+function resolveOneSetting(manifest, settingId, declaration, overrides, onWarn) {
+  const fallback = declarationDefault(declaration);
+  const toFallback = () => fallback !== void 0 ? { hasValue: true, value: fallback } : { hasValue: false };
+  if (!Object.prototype.hasOwnProperty.call(overrides, settingId)) return toFallback();
+  const candidate = overrides[settingId];
+  const check = validateSettingValue(declaration, candidate);
+  if (check.ok) return { hasValue: true, value: candidate };
+  onWarn(
+    `Setting '${settingId}' for extension '${manifest.pluginId}/${manifest.id}' is invalid (${check.reason}); falling back to the declared default.`
+  );
+  return toFallback();
+}
+function buildSettingsResolver(config, onWarn = defaultWarn) {
+  return (ext) => resolveExtensionSettings(ext, config, onWarn);
+}
+function declarationDefault(declaration) {
+  return "default" in declaration ? declaration.default : void 0;
+}
+function readSettingsOverrides(config, pluginId, extId) {
+  const entry = config.plugins?.[pluginId];
+  const ext = entry?.extensions?.[extId];
+  const settings2 = ext?.settings;
+  if (settings2 && typeof settings2 === "object" && !Array.isArray(settings2)) {
+    return settings2;
+  }
+  return {};
+}
+var OK = { ok: true, reason: "" };
+function fail2(reason) {
+  return { ok: false, reason };
+}
+function validateSettingValue(declaration, value) {
+  switch (declaration.type) {
+    case "string-list":
+      return validateStringList(value, declaration.min, declaration.max, declaration.itemMaxLength);
+    case "single-string":
+      return validateSingleString(value, declaration.minLength, declaration.maxLength, declaration.pattern);
+    case "boolean-flag":
+      return typeof value === "boolean" ? OK : fail2("expected a boolean");
+    case "integer":
+      return validateInteger(value, declaration.min, declaration.max);
+    case "number":
+      return validateNumber(value, declaration.min, declaration.max);
+    case "enum-pick":
+      return validateEnumPick(value, declaration.options.map((o) => o.value));
+    case "enum-multipick":
+      return validateEnumMultipick(value, declaration.options.map((o) => o.value), declaration.min, declaration.max);
+    case "path-glob":
+      return validatePathGlob(value, declaration.multiple === true);
+    case "regex":
+      return validateRegex(value, declaration.flags);
+    case "secret":
+      return typeof value === "string" ? OK : fail2("expected a string");
+    case "key-value-list":
+      return validateKeyValueList(value, declaration.min, declaration.max);
+    default: {
+      const _exhaustive = declaration;
+      return fail2(`unknown input-type: ${String(_exhaustive.type)}`);
+    }
+  }
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function validateStringList(value, min, max, itemMaxLength) {
+  if (!isStringArray(value)) return fail2("expected an array of strings");
+  if (min !== void 0 && value.length < min) return fail2(`expected at least ${min} item(s)`);
+  if (max !== void 0 && value.length > max) return fail2(`expected at most ${max} item(s)`);
+  const cap = itemMaxLength ?? 256;
+  if (value.some((item) => item.length > cap)) return fail2(`item exceeds ${cap} characters`);
+  return OK;
+}
+function validateSingleString(value, minLength, maxLength, pattern) {
+  if (typeof value !== "string") return fail2("expected a string");
+  if (minLength !== void 0 && value.length < minLength) return fail2(`expected at least ${minLength} characters`);
+  if (maxLength !== void 0 && value.length > maxLength) return fail2(`expected at most ${maxLength} characters`);
+  return matchesPattern(value, pattern);
+}
+function matchesPattern(value, pattern) {
+  if (pattern === void 0) return OK;
+  let re;
+  try {
+    re = new RegExp(pattern);
+  } catch {
+    return OK;
+  }
+  return re.test(value) ? OK : fail2(`does not match pattern ${pattern}`);
+}
+function validateInteger(value, min, max) {
+  if (typeof value !== "number" || !Number.isInteger(value)) return fail2("expected an integer");
+  if (!Number.isSafeInteger(value)) return fail2("integer out of safe range");
+  if (min !== void 0 && value < min) return fail2(`expected >= ${min}`);
+  if (max !== void 0 && value > max) return fail2(`expected <= ${max}`);
+  return OK;
+}
+function validateNumber(value, min, max) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return fail2("expected a finite number");
+  if (min !== void 0 && value < min) return fail2(`expected >= ${min}`);
+  if (max !== void 0 && value > max) return fail2(`expected <= ${max}`);
+  return OK;
+}
+function validateEnumPick(value, allowed) {
+  if (typeof value !== "string") return fail2("expected a string");
+  if (!allowed.includes(value)) return fail2(`expected one of: ${allowed.join(", ")}`);
+  return OK;
+}
+function validateEnumMultipick(value, allowed, min, max) {
+  if (!isStringArray(value)) return fail2("expected an array of strings");
+  const allowedSet = new Set(allowed);
+  if (value.some((v) => !allowedSet.has(v))) return fail2(`every entry must be one of: ${allowed.join(", ")}`);
+  if (min !== void 0 && value.length < min) return fail2(`expected at least ${min} selection(s)`);
+  if (max !== void 0 && value.length > max) return fail2(`expected at most ${max} selection(s)`);
+  return OK;
+}
+function validatePathGlob(value, multiple) {
+  if (multiple) {
+    return isStringArray(value) ? OK : fail2("expected an array of glob strings");
+  }
+  return typeof value === "string" ? OK : fail2("expected a glob string");
+}
+function validateRegex(value, flags) {
+  if (typeof value !== "string") return fail2("expected a string");
+  try {
+    new RegExp(value, flags ?? "");
+  } catch (err) {
+    return fail2(`is not a compilable regex (${err instanceof Error ? err.message : String(err)})`);
+  }
+  return OK;
+}
+function validateKeyValueList(value, min, max) {
+  if (!Array.isArray(value)) return fail2("expected an array of { key, value } entries");
+  const wellShaped = value.every(
+    (entry) => entry !== null && typeof entry === "object" && typeof entry.key === "string" && typeof entry.value === "string"
+  );
+  if (!wellShaped) return fail2("every entry must be { key: string, value: string }");
+  if (min !== void 0 && value.length < min) return fail2(`expected at least ${min} entr(y/ies)`);
+  if (max !== void 0 && value.length > max) return fail2(`expected at most ${max} entr(y/ies)`);
+  return OK;
+}
+
 // core/runtime/i18n/progress-emitter.texts.ts
 var PROGRESS_EMITTER_TEXTS = {
   /**
@@ -18558,10 +18567,10 @@ async function runScanForCommand(opts) {
   const dbPath = resolveDbPath({ db: void 0, ...ctx });
   const kernel = createKernel();
   const pluginRuntime = await preparePluginRuntime(opts, opts.printer);
-  const extensions = registerExtensions(kernel, pluginRuntime, opts);
   const scanInputs = loadScanInputs(opts, ctx);
   if ("kind" in scanInputs) return scanInputs;
   const { cfg, ignoreFilter, strict, effectiveRoots } = scanInputs;
+  const extensions = registerExtensions(kernel, pluginRuntime, opts, cfg);
   let referenceablePaths;
   if (cfg.scan.referencePaths.length > 0) {
     const walk3 = walkReferencePaths(cfg.scan.referencePaths, ctx.cwd);
@@ -18657,10 +18666,11 @@ async function preparePluginRuntime(opts, printer) {
   pluginRuntime.emitWarnings(printer);
   return pluginRuntime;
 }
-function registerExtensions(kernel, pluginRuntime, opts) {
+function registerExtensions(kernel, pluginRuntime, opts, cfg) {
   const composeOpts = {
     noBuiltIns: opts.noBuiltIns,
-    pluginRuntime
+    pluginRuntime,
+    resolveSettings: buildSettingsResolver(cfg)
   };
   if (opts.killSwitches) composeOpts.killSwitches = opts.killSwitches;
   if (opts.resolveEnabledOverride) composeOpts.resolveEnabled = opts.resolveEnabledOverride;
@@ -20204,7 +20214,7 @@ async function findActiveOrphanIssues(adapter, predicate) {
     (issue) => ORPHAN_RULE_IDS.includes(issue.analyzerId) && predicate(issue)
   );
 }
-function isStringArray(v) {
+function isStringArray2(v) {
   return Array.isArray(v) && v.every((s) => typeof s === "string");
 }
 var OrphansCommand = class extends SmCommand {
@@ -20575,7 +20585,7 @@ var OrphansUndoRenameCommand = class extends SmCommand {
       return { ok: false, exitCode: ExitCode.NotFound };
     }
     const dataCandidates = issue.data ? issue.data["candidates"] : void 0;
-    if (!isStringArray(dataCandidates) || !dataCandidates.includes(this.from)) {
+    if (!isStringArray2(dataCandidates) || !dataCandidates.includes(this.from)) {
       this.printer.error(
         tx(ORPHANS_TEXTS.undoAmbiguousNotInCandidates, { glyph: errGlyph, from: this.from })
       );
@@ -22729,11 +22739,12 @@ var INPUT_TYPES_CATALOG = [
   { id: "single-string", summary: "Single text input." },
   { id: "boolean-flag", summary: "On/off toggle." },
   { id: "integer", summary: "Integer with optional bounds." },
+  { id: "number", summary: "Decimal number with optional bounds." },
   { id: "enum-pick", summary: "Pick one from a closed set." },
   { id: "enum-multipick", summary: "Pick zero or more from a closed set." },
   { id: "path-glob", summary: "Glob pattern (single or multiple)." },
   { id: "regex", summary: "ECMAScript regex pattern body." },
-  { id: "secret", summary: "Sensitive string (encrypted at rest)." },
+  { id: "secret", summary: "Sensitive string, forced into project-local storage (gitignored), not encrypted." },
   { id: "key-value-list", summary: "Editable mapping of strings to strings." }
 ];
 
@@ -22806,6 +22817,375 @@ var PluginsUpgradeCommand = class extends SmCommand {
   }
 };
 
+// cli/commands/plugins/config.ts
+import { Command as Command29, Option as Option27 } from "clipanion";
+
+// cli/i18n/plugins-config.texts.ts
+var PLUGINS_CONFIG_TEXTS = {
+  // --- id-shape redirects ----------------------------------------------
+  // `sm plugins config` operates on one extension. A bare plugin id is
+  // the wrong granularity, redirect to `sm plugins list <id>`.
+  bareId: '{{glyph}}  `sm plugins config` needs a qualified `<plugin>/<ext>` id; "{{id}}" is a plugin.\n   {{hint}}\n',
+  bareIdHint: "Run `sm plugins list {{id}}` to see the extensions, then `sm plugins config {{id}}/<ext>`.",
+  // --- no declared settings --------------------------------------------
+  noSettings: '{{glyph}}  Extension "{{id}}" declares no configurable settings.\n   {{hint}}\n',
+  noSettingsHint: "Run `sm plugins show {{id}}` to inspect the extension.",
+  unknownSetting: '{{glyph}}  Unknown setting "{{settingId}}" for extension "{{id}}".\n   {{hint}}\n',
+  unknownSettingHint: "Declared settings: {{declared}}.",
+  // --- coercion / validation -------------------------------------------
+  coerceFailed: '{{glyph}}  Could not parse "{{value}}" as type {{type}} for setting "{{settingId}}".\n   {{hint}}\n',
+  coerceFailedHint: "{{detail}}",
+  validationFailed: '{{glyph}}  Invalid value for setting "{{settingId}}" ({{type}}): {{reason}}.\n',
+  writeFailed: '{{glyph}}  Failed to write setting "{{settingId}}": {{message}}\n',
+  // --- table view (no settingId) ---------------------------------------
+  /** Section header above the settings table. */
+  tableHeader: "  Settings for {{id}}\n",
+  /** One table row: setting id, effective value, source layer tag. */
+  tableRow: "  {{settingId}}  {{value}}{{sourceTag}}\n",
+  /** Dim suffix showing which layer set the effective value. */
+  tableSourceTag: " [{{source}}]",
+  /** Redaction placeholder for `secret`-typed values in any output. */
+  redacted: "<redacted>",
+  // --- write / reset receipts ------------------------------------------
+  setWritten: "{{glyph}}  Set {{settingId}} = {{value}} for {{id}}{{wroteTag}}\n",
+  setWroteTag: " (wrote {{path}})",
+  resetRemoved: "{{glyph}}  Cleared {{settingId}} for {{id}}; falls back to the declared default{{wroteTag}}\n",
+  resetNoOverride: "{{glyph}}  No override set for {{settingId}} on {{id}}; nothing to clear.\n",
+  // --- re-scan footer ---------------------------------------------------
+  rescanFooter: "{{hint}}\n",
+  rescanFooterText: "Settings are read once per scan; run `sm scan` to apply."
+};
+
+// cli/commands/plugins/config.ts
+var PluginsConfigCommand = class extends SmCommand {
+  static paths = [["plugins", "config"]];
+  static usage = Command29.Usage({
+    category: "Plugins",
+    description: "Read or write an extension's declared settings.",
+    details: `
+      Operates on a single extension by its qualified \`<plugin>/<ext>\`
+      id. With no settingId it prints a table of each declared setting,
+      its effective value, and the config layer that set it. With a
+      settingId + value it coerces the shell string to the declared
+      input-type, validates it, and writes
+      \`plugins.<plugin>.extensions.<ext>.settings.<settingId>\` to
+      settings.json (or settings.local.json for \`secret\` settings).
+      \`--reset\` removes the override so the manifest default applies.
+      Secret values are shown as <redacted>. Run \`sm scan\` to apply.
+    `
+  });
+  id = Option27.String({ required: true });
+  settingId = Option27.String({ required: false });
+  value = Option27.String({ required: false });
+  reset = Option27.Boolean("--reset", false, {
+    description: "Remove the override for <settingId> so the manifest default applies."
+  });
+  pluginDir = Option27.String("--plugin-dir", { required: false });
+  // Read-only when listing; the write / reset paths emit their own
+  // receipt. `sm config` exempts the config family from "done in <…>";
+  // mirror that here for the read path. The write path keeps the line.
+  emitElapsed = true;
+  // CLI orchestrator: each branch is one validation gate (bare id /
+  // unknown extension / no settings / unknown setting) or a mode
+  // dispatch (table vs set vs reset). Splitting per branch scatters the
+  // gate from the value it gates.
+  // eslint-disable-next-line complexity
+  async run() {
+    const ctx = defaultRuntimeContext();
+    const stderrAnsi = this.ansiFor("stderr");
+    if (!this.id.includes("/")) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.bareId, {
+          glyph: stderrAnsi.red("\u2715"),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_CONFIG_TEXTS.bareIdHint, { id: sanitizeForTerminal(this.id) })
+          )
+        })
+      );
+      return ExitCode.Error;
+    }
+    const plugins = await loadAll({ pluginDir: this.pluginDir });
+    const parsed = parseQualifiedExtensionId(this.id, pluginCatalogue(plugins));
+    if (!parsed.ok) {
+      this.printer.error(renderQualifiedIdError(parsed, this.id, stderrAnsi));
+      return ExitCode.NotFound;
+    }
+    const { pluginId, extId } = parsed;
+    const declarations = resolveDeclaredSettings(pluginId, extId, plugins);
+    if (!declarations || Object.keys(declarations).length === 0) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.noSettings, {
+          glyph: stderrAnsi.red("\u2715"),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_CONFIG_TEXTS.noSettingsHint, { id: sanitizeForTerminal(this.id) })
+          )
+        })
+      );
+      return ExitCode.NotFound;
+    }
+    if (this.settingId === void 0) {
+      return this.renderTable(pluginId, extId, declarations, ctx.cwd);
+    }
+    const declaration = declarations[this.settingId];
+    if (!declaration) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.unknownSetting, {
+          glyph: stderrAnsi.red("\u2715"),
+          settingId: sanitizeForTerminal(this.settingId),
+          id: sanitizeForTerminal(this.id),
+          hint: stderrAnsi.dim(
+            tx(PLUGINS_CONFIG_TEXTS.unknownSettingHint, {
+              declared: Object.keys(declarations).map((k) => `'${k}'`).join(", ")
+            })
+          )
+        })
+      );
+      return ExitCode.NotFound;
+    }
+    if (this.reset) {
+      return this.resetSetting(pluginId, extId, this.settingId, declaration, ctx.cwd);
+    }
+    if (this.value === void 0) {
+      return this.renderTable(pluginId, extId, { [this.settingId]: declaration }, ctx.cwd);
+    }
+    return this.writeSetting(pluginId, extId, this.settingId, declaration, this.value, ctx.cwd);
+  }
+  /**
+   * Render the settings table (human) or the resolved set (`--json`).
+   * Effective values come from the kernel settings resolver so the table
+   * shows exactly what `ctx.settings.<id>` would see at scan time
+   * (default overlaid by the config override, validated). Secret values
+   * are redacted.
+   */
+  renderTable(pluginId, extId, declarations, cwd) {
+    const { effective } = loadConfig({ cwd });
+    const resolved = resolveExtensionSettings({ pluginId, id: extId, settings: declarations }, effective, () => {
+    });
+    if (this.json) {
+      const payload = {};
+      for (const [settingId, declaration] of Object.entries(declarations)) {
+        payload[settingId] = declaration.type === "secret" ? PLUGINS_CONFIG_TEXTS.redacted : resolved[settingId] ?? null;
+      }
+      this.printer.data(JSON.stringify(payload) + "\n");
+      return ExitCode.Ok;
+    }
+    const ansi = this.ansiFor("stdout");
+    const lines = [tx(PLUGINS_CONFIG_TEXTS.tableHeader, { id: `${pluginId}/${extId}` })];
+    const idWidth = Math.max(...Object.keys(declarations).map((k) => k.length));
+    for (const [settingId, declaration] of Object.entries(declarations)) {
+      const display = declaration.type === "secret" ? PLUGINS_CONFIG_TEXTS.redacted : formatValue2(resolved[settingId]);
+      const dotKey = settingDotKey(pluginId, extId, settingId);
+      const source = getValueSource(dotKey, { cwd });
+      const sourceTag = source ? ansi.dim(tx(PLUGINS_CONFIG_TEXTS.tableSourceTag, { source: layerLabel(source) })) : "";
+      lines.push(
+        tx(PLUGINS_CONFIG_TEXTS.tableRow, {
+          settingId: settingId.padEnd(idWidth),
+          value: sanitizeForTerminal(display),
+          sourceTag
+        })
+      );
+    }
+    this.printer.data(lines.join(""));
+    return ExitCode.Ok;
+  }
+  writeSetting(pluginId, extId, settingId, declaration, raw, cwd) {
+    const stderrAnsi = this.ansiFor("stderr");
+    const errGlyph = stderrAnsi.red("\u2715");
+    const coerced = coerceCliValue(declaration, raw);
+    if (!coerced.ok) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.coerceFailed, {
+          glyph: errGlyph,
+          value: sanitizeForTerminal(raw),
+          type: declaration.type,
+          settingId: sanitizeForTerminal(settingId),
+          hint: stderrAnsi.dim(tx(PLUGINS_CONFIG_TEXTS.coerceFailedHint, { detail: coerced.reason }))
+        })
+      );
+      return ExitCode.Error;
+    }
+    let invalidReason = null;
+    resolveExtensionSettings(
+      { pluginId, id: extId, settings: { [settingId]: declaration } },
+      { plugins: { [pluginId]: { extensions: { [extId]: { settings: { [settingId]: coerced.value } } } } } },
+      (message) => {
+        invalidReason = message;
+      }
+    );
+    if (invalidReason !== null) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.validationFailed, {
+          glyph: errGlyph,
+          settingId: sanitizeForTerminal(settingId),
+          type: declaration.type,
+          reason: invalidReason
+        })
+      );
+      return ExitCode.Error;
+    }
+    const target = declaration.type === "secret" ? "project-local" : "project";
+    const dotKey = settingDotKey(pluginId, extId, settingId);
+    try {
+      writeConfigValue(dotKey, coerced.value, { target, cwd });
+    } catch (err) {
+      return this.renderWriteError(err, settingId);
+    }
+    const ansi = this.ansiFor("stdout");
+    const display = declaration.type === "secret" ? PLUGINS_CONFIG_TEXTS.redacted : formatValue2(coerced.value);
+    const path = target === "project-local" ? defaultLocalSettingsPath(cwd) : defaultSettingsPath(cwd);
+    this.printer.data(
+      tx(PLUGINS_CONFIG_TEXTS.setWritten, {
+        glyph: ansi.green("\u2713"),
+        settingId,
+        value: sanitizeForTerminal(display),
+        id: `${pluginId}/${extId}`,
+        wroteTag: ansi.dim(tx(PLUGINS_CONFIG_TEXTS.setWroteTag, { path: relativeIfBelow(path, cwd) }))
+      })
+    );
+    this.printRescanFooter();
+    return ExitCode.Ok;
+  }
+  resetSetting(pluginId, extId, settingId, declaration, cwd) {
+    const target = declaration.type === "secret" ? "project-local" : "project";
+    const dotKey = settingDotKey(pluginId, extId, settingId);
+    const ansi = this.ansiFor("stdout");
+    let removed;
+    try {
+      removed = removeConfigValue(dotKey, { target, cwd });
+    } catch (err) {
+      return this.renderWriteError(err, settingId);
+    }
+    if (!removed) {
+      this.printer.data(
+        tx(PLUGINS_CONFIG_TEXTS.resetNoOverride, {
+          glyph: ansi.green("\u2713"),
+          settingId,
+          id: `${pluginId}/${extId}`
+        })
+      );
+      return ExitCode.Ok;
+    }
+    const path = target === "project-local" ? defaultLocalSettingsPath(cwd) : defaultSettingsPath(cwd);
+    this.printer.data(
+      tx(PLUGINS_CONFIG_TEXTS.resetRemoved, {
+        glyph: ansi.green("\u2713"),
+        settingId,
+        id: `${pluginId}/${extId}`,
+        wroteTag: ansi.dim(tx(PLUGINS_CONFIG_TEXTS.setWroteTag, { path: relativeIfBelow(path, cwd) }))
+      })
+    );
+    this.printRescanFooter();
+    return ExitCode.Ok;
+  }
+  renderWriteError(err, settingId) {
+    const ansi = this.ansiFor("stderr");
+    const glyph = ansi.red("\u2715");
+    if (err instanceof ForbiddenSegmentError) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.writeFailed, { glyph, settingId, message: err.message })
+      );
+      return ExitCode.Error;
+    }
+    if (err instanceof ProjectLocalOnlyKeyError) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.writeFailed, { glyph, settingId, message: err.message })
+      );
+      return ExitCode.Error;
+    }
+    if (err instanceof ConfigValidationError) {
+      this.printer.error(
+        tx(PLUGINS_CONFIG_TEXTS.writeFailed, { glyph, settingId, message: err.errors })
+      );
+      return ExitCode.Error;
+    }
+    throw err;
+  }
+  printRescanFooter() {
+    if (this.json) return;
+    const ansi = this.ansiFor("stdout");
+    this.printer.data(
+      tx(PLUGINS_CONFIG_TEXTS.rescanFooter, {
+        hint: ansi.dim(PLUGINS_CONFIG_TEXTS.rescanFooterText)
+      })
+    );
+  }
+};
+function resolveDeclaredSettings(pluginId, extId, plugins) {
+  for (const plugin of builtInPlugins) {
+    if (plugin.id !== pluginId) continue;
+    for (const ext of plugin.extensions) {
+      if (ext.id === extId) return ext.settings;
+    }
+  }
+  const match = plugins.find((p) => p.id === pluginId);
+  const userExt = match?.extensions?.find((e) => e.id === extId);
+  return readInstanceSettings(userExt?.instance);
+}
+function readInstanceSettings(instance) {
+  if (instance === null || typeof instance !== "object") return void 0;
+  const settings2 = instance.settings;
+  if (settings2 && typeof settings2 === "object" && !Array.isArray(settings2)) {
+    return settings2;
+  }
+  return void 0;
+}
+function coerceCliValue(declaration, raw) {
+  switch (declaration.type) {
+    case "integer":
+    case "number": {
+      const n = Number(raw);
+      if (raw.trim() === "" || Number.isNaN(n)) return { ok: false, reason: "expected a numeric value" };
+      return { ok: true, value: n };
+    }
+    case "boolean-flag": {
+      if (raw === "true") return { ok: true, value: true };
+      if (raw === "false") return { ok: true, value: false };
+      return { ok: false, reason: "expected `true` or `false`" };
+    }
+    case "string-list":
+    case "enum-multipick":
+    case "key-value-list":
+      return parseJsonValue(raw);
+    case "path-glob":
+      return declaration.multiple === true ? parseJsonValue(raw) : { ok: true, value: raw };
+    case "single-string":
+    case "enum-pick":
+    case "regex":
+    case "secret":
+      return { ok: true, value: raw };
+    default: {
+      const _exhaustive = declaration;
+      return { ok: false, reason: `unknown input-type: ${String(_exhaustive.type)}` };
+    }
+  }
+}
+function parseJsonValue(raw) {
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch {
+    return { ok: false, reason: 'expected a JSON value (e.g. ["a","b"])' };
+  }
+}
+function settingDotKey(pluginId, extId, settingId) {
+  return `plugins.${pluginId}.extensions.${extId}.settings.${settingId}`;
+}
+function formatValue2(value) {
+  if (value === void 0 || value === null) return "null";
+  if (Array.isArray(value) || typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+var LAYER_LABEL = {
+  defaults: "default",
+  project: "settings.json",
+  "project-local": "settings.local.json",
+  override: "override"
+};
+function layerLabel(layer) {
+  return LAYER_LABEL[layer];
+}
+
 // cli/commands/plugins.ts
 var PLUGIN_COMMANDS = [
   PluginsListCommand,
@@ -22815,13 +23195,14 @@ var PLUGIN_COMMANDS = [
   PluginsDisableCommand,
   PluginsCreateCommand,
   PluginsSlotsListCommand,
-  PluginsUpgradeCommand
+  PluginsUpgradeCommand,
+  PluginsConfigCommand
 ];
 
 // cli/commands/refresh.ts
 import { readFile as readFile4 } from "fs/promises";
 import { resolve as resolve34 } from "path";
-import { Command as Command29, Option as Option27 } from "clipanion";
+import { Command as Command30, Option as Option28 } from "clipanion";
 
 // cli/i18n/refresh.texts.ts
 var REFRESH_TEXTS = {
@@ -22877,7 +23258,7 @@ var REFRESH_TEXTS = {
 // cli/commands/refresh.ts
 var RefreshCommand = class extends SmCommand {
   static paths = [["refresh"]];
-  static usage = Command29.Usage({
+  static usage = Command30.Usage({
     category: "Scan",
     description: "Refresh enrichment rows: granular (single node) or batch (every stale row).",
     details: `
@@ -22899,11 +23280,11 @@ var RefreshCommand = class extends SmCommand {
       ["Refresh every node with stale enrichments", "$0 refresh --stale"]
     ]
   });
-  nodePath = Option27.String({ name: "node", required: false });
-  stale = Option27.Boolean("--stale", false, {
+  nodePath = Option28.String({ name: "node", required: false });
+  stale = Option28.Boolean("--stale", false, {
     description: "Refresh every node carrying a stale enrichment row (no-op in this revision; reserved for future Action-prob enrichments)."
   });
-  noPlugins = Option27.Boolean("--no-plugins", false, {
+  noPlugins = Option28.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery; use only the built-in extractor set."
   });
   // The remaining cyclomatic count comes from CLI ergonomics that don't
@@ -22937,9 +23318,11 @@ var RefreshCommand = class extends SmCommand {
     const pluginRuntime = this.noPlugins ? emptyPluginRuntime() : await loadPluginRuntime();
     pluginRuntime.emitWarnings(this.printer);
     listBuiltIns();
+    const refreshCfg = loadConfig({ cwd: ctx.cwd }).effective;
     const composed = composeScanExtensions({
       noBuiltIns: false,
       pluginRuntime,
+      resolveSettings: buildSettingsResolver(refreshCfg),
       killSwitches: readConformanceKillSwitches()
     });
     const allExtractors = composed?.extractors ?? [];
@@ -23205,7 +23588,7 @@ var IntentionalFailCommand = class extends SmCommand {
 };
 
 // cli/commands/scan.ts
-import { Command as Command31, Option as Option29 } from "clipanion";
+import { Command as Command32, Option as Option30 } from "clipanion";
 
 // kernel/util/format-bytes.ts
 var UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB"];
@@ -23357,7 +23740,7 @@ var SCAN_TEXTS = {
 };
 
 // cli/commands/watch.ts
-import { Command as Command30, Option as Option28 } from "clipanion";
+import { Command as Command31, Option as Option29 } from "clipanion";
 
 // core/watcher/runtime.ts
 import { dirname as dirname18 } from "path";
@@ -23479,7 +23862,8 @@ function createWatcherRuntime(opts) {
       const composeOpts = {
         noBuiltIns: opts.noBuiltIns,
         pluginRuntime,
-        resolveEnabled: resolveEnabledOverride
+        resolveEnabled: resolveEnabledOverride,
+        resolveSettings: buildSettingsResolver(cfg)
       };
       if (opts.killSwitches) composeOpts.killSwitches = opts.killSwitches;
       const composed = composeScanExtensions(composeOpts);
@@ -23896,7 +24280,7 @@ async function runWatchLoop(opts) {
 }
 var WatchCommand = class extends SmCommand {
   static paths = [["watch"]];
-  static usage = Command30.Usage({
+  static usage = Command31.Usage({
     category: "Scan",
     description: "Watch roots and run an incremental scan after each debounced batch of filesystem events.",
     details: `
@@ -23920,21 +24304,21 @@ var WatchCommand = class extends SmCommand {
       ["Stream ScanResult per batch as ndjson", "$0 watch --json"]
     ]
   });
-  roots = Option28.Rest({ name: "roots" });
-  noTokens = Option28.Boolean("--no-tokens", false, {
+  roots = Option29.Rest({ name: "roots" });
+  noTokens = Option29.Boolean("--no-tokens", false, {
     description: "Skip per-node token counts (cl100k_base BPE)."
   });
-  strict = Option28.Boolean("--strict", false, {
+  strict = Option29.Boolean("--strict", false, {
     description: "Promote frontmatter-validation findings from warn to error inside each batch. Does not change the watcher exit code."
   });
-  noPlugins = Option28.Boolean("--no-plugins", false, {
+  noPlugins = Option29.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery for the watcher session."
   });
-  maxConsecutiveFailures = Option28.String("--max-consecutive-failures", {
+  maxConsecutiveFailures = Option29.String("--max-consecutive-failures", {
     required: false,
     description: "Shut down with exit 2 after N consecutive batch failures (default 5; 0 disables the breaker)."
   });
-  maxNodes = Option28.String("--max-nodes", {
+  maxNodes = Option29.String("--max-nodes", {
     required: false,
     description: "Per-batch override of scan.maxNodes (default 256). Bidirectional: raises OR lowers the recommended cap on classified nodes. When a batch hits the cap, additional files are dropped and the UI surfaces the persistent oversized banner. Validation: integer >= 1."
   });
@@ -24001,7 +24385,7 @@ function parseMaxNodesLimit(raw, stderr, noColor) {
 // cli/commands/scan.ts
 var ScanCommand = class extends SmCommand {
   static paths = [["scan"]];
-  static usage = Command31.Usage({
+  static usage = Command32.Usage({
     category: "Scan",
     description: "Scan roots for markdown nodes, run extractors and analyzers.",
     details: `
@@ -24036,35 +24420,35 @@ var ScanCommand = class extends SmCommand {
       ["What would the next incremental scan persist?", "$0 scan --changed -n --json"]
     ]
   });
-  roots = Option29.Rest({ name: "roots" });
-  noBuiltIns = Option29.Boolean("--no-built-ins", false, {
+  roots = Option30.Rest({ name: "roots" });
+  noBuiltIns = Option30.Boolean("--no-built-ins", false, {
     description: "Skip the built-in extension set. Yields a zero-filled ScanResult (kernel-empty-boot parity); skips DB persistence."
   });
-  noPlugins = Option29.Boolean("--no-plugins", false, {
+  noPlugins = Option30.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery. Only the built-in set runs. Combine with --no-built-ins for a fully empty pipeline."
   });
-  noTokens = Option29.Boolean("--no-tokens", false, {
+  noTokens = Option30.Boolean("--no-tokens", false, {
     description: "Skip per-node token counts (cl100k_base BPE). Leaves node.tokens undefined; spec-valid since the field is optional."
   });
-  dryRun = Option29.Boolean("-n,--dry-run", false, {
+  dryRun = Option30.Boolean("-n,--dry-run", false, {
     description: "Run the scan in memory and skip every DB write. Combined with --changed, still opens the DB read-side to load the prior snapshot."
   });
-  changed = Option29.Boolean("--changed", false, {
+  changed = Option30.Boolean("--changed", false, {
     description: "Incremental scan: reuse unchanged nodes from the persisted prior snapshot. Degrades to a full scan if no prior snapshot exists."
   });
-  allowEmpty = Option29.Boolean("--allow-empty", false, {
+  allowEmpty = Option30.Boolean("--allow-empty", false, {
     description: "Allow a zero-result scan to wipe an already-populated DB (replace-all replace by zero rows). Off by default to avoid the typo-trap where an invalid root silently clears your data."
   });
-  strict = Option29.Boolean("--strict", false, {
+  strict = Option30.Boolean("--strict", false, {
     description: "Promote frontmatter-validation findings from warn to error (exit code 1 on any violation). Overrides scan.strict from config when both are set."
   });
-  watch = Option29.Boolean("--watch", false, {
+  watch = Option30.Boolean("--watch", false, {
     description: "Long-running mode: watch the roots and trigger an incremental scan after each debounced batch of filesystem events. Alias of `sm watch`."
   });
-  yes = Option29.Boolean("--yes", false, {
+  yes = Option30.Boolean("--yes", false, {
     description: "Non-interactive mode. For ambiguous activeProvider auto-detect, multiple provider markers (.claude/, .codex/, AGENTS.md, .cursor/) under the scan tree exit non-zero instead of prompting; set the lens manually via `sm config set activeProvider <id>` and re-run. Also auto-confirms the pre-1.0 schema-drift rebuild (when the DB was written by a different skill-map major.minor it is deleted and regenerated) instead of prompting."
   });
-  maxNodes = Option29.String("--max-nodes", {
+  maxNodes = Option30.String("--max-nodes", {
     required: false,
     description: "Per-invocation override of `scan.maxNodes` (default 256). Bidirectional: raises OR lowers the recommended cap on classified nodes. When the walker hits the cap, additional files are dropped and the scan is marked oversized in scan_meta (the UI raises a persistent banner pointing at the .skillmapignore editor in Settings \u2192 Project). Validation: integer >= 1."
   });
@@ -24405,10 +24789,10 @@ function countNoun(count3, singular, plural) {
 
 // cli/commands/scan-compare.ts
 import { access, readFile as readFile5 } from "fs/promises";
-import { Command as Command32, Option as Option30 } from "clipanion";
+import { Command as Command33, Option as Option31 } from "clipanion";
 var ScanCompareCommand = class extends SmCommand {
   static paths = [["scan", "compare-with"]];
-  static usage = Command32.Usage({
+  static usage = Command33.Usage({
     category: "Scan",
     description: "Run a fresh scan in memory and emit a delta against the saved ScanResult dump at <dump>. Read-only.",
     details: `
@@ -24436,15 +24820,15 @@ var ScanCompareCommand = class extends SmCommand {
       ["JSON output for tooling", "$0 scan compare-with baseline.json --json"]
     ]
   });
-  dump = Option30.String({ required: true });
-  roots = Option30.Rest({ name: "roots" });
-  noTokens = Option30.Boolean("--no-tokens", false, {
+  dump = Option31.String({ required: true });
+  roots = Option31.Rest({ name: "roots" });
+  noTokens = Option31.Boolean("--no-tokens", false, {
     description: "Skip per-node token counts during the fresh scan."
   });
-  strict = Option30.Boolean("--strict", false, {
+  strict = Option31.Boolean("--strict", false, {
     description: "Promote layered-config warnings and frontmatter-validation findings from warn to error."
   });
-  noPlugins = Option30.Boolean("--no-plugins", false, {
+  noPlugins = Option31.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery."
   });
   // Cyclomatic count comes from CLI ergonomics: 3 distinct try/catch
@@ -24486,6 +24870,7 @@ var ScanCompareCommand = class extends SmCommand {
     const composedExtensions = composeScanExtensions({
       noBuiltIns: false,
       pluginRuntime,
+      resolveSettings: buildSettingsResolver(cfg),
       killSwitches: readConformanceKillSwitches()
     });
     let current;
@@ -24649,7 +25034,7 @@ function renderDeltaIssues(issues) {
 // cli/commands/serve.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync31 } from "fs";
-import { Command as Command33, Option as Option31 } from "clipanion";
+import { Command as Command34, Option as Option32 } from "clipanion";
 
 // kernel/util/dev-mode.ts
 import { sep as sep6 } from "path";
@@ -24910,8 +25295,22 @@ var SERVER_TEXTS = {
   // The single-id variants above still apply for per-entry validation
   // (unknown id, granularity mismatch, lock); these cover the
   // body-shape level.
-  pluginsChangesRequired: "Request body must include a `changes` array of `{ id, enabled }` entries.",
-  pluginsChangeMalformed: "Each entry in `changes` must have a string `id` and a boolean `enabled`.",
+  pluginsChangesRequired: "Request body must include a `changes` array of `{ id, enabled?, settings? }` entries.",
+  pluginsChangeMalformed: "Each entry in `changes` must have a string `id` plus at least one of `enabled` (boolean) or `settings` (object).",
+  // 400, a bulk change carries `settings` against a bare plugin id.
+  // Settings are per-extension, so they require a qualified
+  // `<plugin>/<ext>` id; a bare plugin id is the wrong granularity.
+  pluginsSettingsRequireQualifiedId: 'Settings can only be written on a qualified `<plugin>/<ext>` id, not the bare plugin id "{{id}}".',
+  // 400, a bulk change carries `settings` for an extension that declares
+  // none in its manifest.
+  pluginsSettingsNoneDeclared: 'Extension "{{pluginId}}/{{extensionId}}" declares no configurable settings.',
+  // 400, a `settings` entry names a settingId the extension does not
+  // declare, or its value fails the declared input-type's rules. The
+  // `{{reason}}` is the resolver's per-type validation message.
+  pluginsSettingsInvalid: 'Invalid setting "{{settingId}}" for "{{pluginId}}/{{extensionId}}": {{reason}}.',
+  // 500, a settings write failed at persist time (AJV revalidation of
+  // the merged config file rejected the result).
+  pluginsSettingsPersistFailed: 'Failed to persist settings for "{{id}}": {{message}}.',
   // ---- preferences route (routes/preferences.ts) --------------------------
   //
   // GET / PATCH /api/preferences. The PATCH body is shaped
@@ -25425,13 +25824,15 @@ function registerGraphRoute(app, deps) {
 }
 function renderGraphPayload(formatter, loaded) {
   const scan = loaded ?? { nodes: [], links: [], issues: [] };
+  const settings2 = formatter.resolvedSettings ?? {};
   if (loaded === null) {
-    return formatter.format({ nodes: scan.nodes, links: scan.links, issues: scan.issues });
+    return formatter.format({ nodes: scan.nodes, links: scan.links, issues: scan.issues, settings: settings2 });
   }
   return formatter.format({
     nodes: scan.nodes,
     links: scan.links,
     issues: scan.issues,
+    settings: settings2,
     scanResult: loaded
   });
 }
@@ -25891,6 +26292,72 @@ function normalizeArrayIndices(path) {
   return path.replace(/\/\d+(?=\/|$)/g, "/*");
 }
 
+// server/routes/plugins-settings.ts
+function readManifestSettings(manifestLike) {
+  if (manifestLike === null || typeof manifestLike !== "object") return void 0;
+  const settings2 = manifestLike.settings;
+  if (settings2 && typeof settings2 === "object" && !Array.isArray(settings2)) {
+    return settings2;
+  }
+  return void 0;
+}
+function projectExtensionSettings(pluginId, extId, declarations, config) {
+  if (!declarations || Object.keys(declarations).length === 0) return {};
+  const settings2 = Object.entries(declarations).map(
+    ([id, declaration]) => ({ ...declaration, id })
+  );
+  const ref = { pluginId, id: extId, settings: declarations };
+  const resolved = resolveExtensionSettings(ref, config, () => {
+  });
+  const settingValues = {};
+  const secretSet = [];
+  for (const [id, declaration] of Object.entries(declarations)) {
+    if (declaration.type === "secret") {
+      if (Object.prototype.hasOwnProperty.call(resolved, id)) secretSet.push(id);
+      continue;
+    }
+    if (Object.prototype.hasOwnProperty.call(resolved, id)) {
+      settingValues[id] = resolved[id];
+    }
+  }
+  return {
+    settings: settings2,
+    settingValues,
+    ...secretSet.length > 0 ? { secretSettingsSet: secretSet } : {}
+  };
+}
+function validateSettingsPatch(pluginId, extId, declarations, patch) {
+  for (const [settingId, value] of Object.entries(patch)) {
+    const declaration = declarations?.[settingId];
+    if (!declaration) {
+      return {
+        settingId,
+        reason: `extension "${pluginId}/${extId}" declares no setting "${settingId}"`
+      };
+    }
+    let invalidReason = null;
+    resolveExtensionSettings(
+      { pluginId, id: extId, settings: { [settingId]: declaration } },
+      { plugins: { [pluginId]: { extensions: { [extId]: { settings: { [settingId]: value } } } } } },
+      (message) => {
+        invalidReason = message;
+      }
+    );
+    if (invalidReason !== null) {
+      return { settingId, reason: invalidReason };
+    }
+  }
+  return null;
+}
+function persistSettingsPatch(pluginId, extId, declarations, patch, cwd) {
+  for (const [settingId, value] of Object.entries(patch)) {
+    const declaration = declarations?.[settingId];
+    const target = declaration?.type === "secret" ? "project-local" : "project";
+    const dotKey = `plugins.${pluginId}.extensions.${extId}.settings.${settingId}`;
+    writeConfigValue(dotKey, value, { target, cwd });
+  }
+}
+
 // server/routes/plugins.ts
 var SINGLE_PATCH_BODY_SCHEMA = {
   type: "object",
@@ -25920,10 +26387,18 @@ var BULK_PATCH_BODY_SCHEMA = {
       items: {
         type: "object",
         additionalProperties: false,
-        required: ["id", "enabled"],
+        // `id` is the only mandatory field; a change carries `enabled`,
+        // `settings`, or both. `minProperties: 2` enforces at least one
+        // of the two beyond `id` (an `{ id }`-only entry is a no-op the
+        // client should not send). Per-setting type validation runs in
+        // code against the manifest, so `settings` is a permissive
+        // object here (the body schema only fixes its container shape).
+        required: ["id"],
+        minProperties: 2,
         properties: {
           id: { type: "string", minLength: 1 },
-          enabled: { type: "boolean" }
+          enabled: { type: "boolean" },
+          settings: { type: "object" }
         }
       }
     }
@@ -25935,7 +26410,13 @@ var parseBulkPatchBody = makeBodyValidator(BULK_PATCH_BODY_SCHEMA, {
   invalid: SERVER_TEXTS.pluginsChangeMalformed,
   mapping: {
     "/changes:required": SERVER_TEXTS.pluginsChangesRequired,
-    "/changes:type:array": SERVER_TEXTS.pluginsChangesRequired
+    "/changes:type:array": SERVER_TEXTS.pluginsChangesRequired,
+    // A change with neither `enabled` nor `settings` (just `id`) trips
+    // `minProperties`; surface the same "malformed entry" message.
+    "/changes/*:minProperties": SERVER_TEXTS.pluginsChangeMalformed,
+    "/changes/*:type:object": SERVER_TEXTS.pluginsChangeMalformed,
+    "/changes/*/settings:type:object": SERVER_TEXTS.pluginsChangeMalformed,
+    "/changes/*/enabled:type:boolean": SERVER_TEXTS.pluginsChangeMalformed
   }
 });
 function registerPluginsRoute(app, deps) {
@@ -26019,17 +26500,24 @@ function registerPluginsRoute(app, deps) {
   });
 }
 function listItems(deps, resolveEnabled) {
+  const config = deps.configService.effective();
   return [
-    ...deps.options.noBuiltIns ? [] : buildBuiltInItems(resolveEnabled),
-    ...buildDiscoveredItems(deps.pluginRuntime.discovered, deps, resolveEnabled)
+    ...deps.options.noBuiltIns ? [] : buildBuiltInItems(resolveEnabled, config),
+    ...buildDiscoveredItems(deps.pluginRuntime.discovered, deps, resolveEnabled, config)
   ];
 }
-function buildBuiltInItems(resolveEnabled) {
+function buildBuiltInItems(resolveEnabled, config) {
   return sortPluginsForPresentation(builtInPlugins).map((plugin) => {
     const pluginLocked = isPluginLocked(plugin.id);
     const extensions = plugin.extensions.map((ext) => {
       const qualified = qualifiedExtensionId(plugin.id, ext.id);
       const extLocked = pluginLocked || isPluginLocked(qualified);
+      const settings2 = projectExtensionSettings(
+        plugin.id,
+        ext.id,
+        readManifestSettings(ext),
+        config
+      );
       return {
         id: ext.id,
         kind: ext.kind,
@@ -26037,7 +26525,8 @@ function buildBuiltInItems(resolveEnabled) {
         enabled: resolveEnabled(qualified, installedDefaultEnabled(ext.stability)),
         ...ext.description ? { description: ext.description } : {},
         ...ext.stability ? { stability: ext.stability } : {},
-        ...extLocked ? { locked: true } : {}
+        ...extLocked ? { locked: true } : {},
+        ...settings2
       };
     });
     const pluginEnabled = extensions.some((e) => e.enabled);
@@ -26054,12 +26543,12 @@ function buildBuiltInItems(resolveEnabled) {
     };
   });
 }
-function buildDiscoveredItems(discovered, deps, resolveEnabled) {
-  return discovered.map((plugin) => buildDiscoveredItem(plugin, deps, resolveEnabled));
+function buildDiscoveredItems(discovered, deps, resolveEnabled, config) {
+  return discovered.map((plugin) => buildDiscoveredItem(plugin, deps, resolveEnabled, config));
 }
-function buildDiscoveredItem(plugin, deps, resolveEnabled) {
+function buildDiscoveredItem(plugin, deps, resolveEnabled, config) {
   const pluginLocked = isPluginLocked(plugin.id);
-  const extensions = projectExtensionRows(plugin, resolveEnabled, pluginLocked);
+  const extensions = projectExtensionRows(plugin, resolveEnabled, pluginLocked, config);
   const optional = optionalDiscoveredFields(plugin, extensions);
   return {
     id: plugin.id,
@@ -26080,12 +26569,18 @@ function optionalDiscoveredFields(plugin, extensions) {
   if (extensions) out.extensions = extensions;
   return out;
 }
-function projectExtensionRows(plugin, resolveEnabled, pluginLocked) {
+function projectExtensionRows(plugin, resolveEnabled, pluginLocked, config) {
   if (!plugin.extensions || plugin.extensions.length === 0) return void 0;
   return plugin.extensions.map((ext) => {
     const description = readInstanceDescription(ext.instance);
     const qualified = qualifiedExtensionId(plugin.id, ext.id);
     const extLocked = pluginLocked || isPluginLocked(qualified);
+    const settings2 = projectExtensionSettings(
+      plugin.id,
+      ext.id,
+      readManifestSettings(ext.instance),
+      config
+    );
     return {
       id: ext.id,
       kind: ext.kind,
@@ -26093,7 +26588,8 @@ function projectExtensionRows(plugin, resolveEnabled, pluginLocked) {
       enabled: resolveEnabled(qualified, installedDefaultEnabled(ext.stability)),
       ...description ? { description } : {},
       ...ext.stability ? { stability: ext.stability } : {},
-      ...extLocked ? { locked: true } : {}
+      ...extLocked ? { locked: true } : {},
+      ...settings2
     };
   });
 }
@@ -26211,25 +26707,35 @@ function projectListResponse(c, deps, overrides) {
   );
 }
 function validateBulkChange(change, deps) {
-  const slash = change.id.indexOf("/");
-  if (slash < 0) {
-    const handle2 = findHandle(change.id, deps);
-    if (!handle2) {
-      return {
-        status: 404,
-        code: "not-found",
-        message: tx(SERVER_TEXTS.pluginsUnknown, { id: change.id })
-      };
-    }
-    if (isPluginLocked(change.id)) {
-      return {
-        status: 403,
-        code: "locked",
-        message: tx(SERVER_TEXTS.pluginsLocked, { id: change.id })
-      };
-    }
-    return null;
+  return change.id.includes("/") ? validateQualifiedBulkChange(change, deps) : validateBareBulkChange(change, deps);
+}
+function validateBareBulkChange(change, deps) {
+  if (change.settings !== void 0) {
+    return {
+      status: 400,
+      code: "bad-query",
+      message: tx(SERVER_TEXTS.pluginsSettingsRequireQualifiedId, { id: change.id })
+    };
+  }
+  const handle = findHandle(change.id, deps);
+  if (!handle) {
+    return {
+      status: 404,
+      code: "not-found",
+      message: tx(SERVER_TEXTS.pluginsUnknown, { id: change.id })
+    };
+  }
+  if (isPluginLocked(change.id)) {
+    return {
+      status: 403,
+      code: "locked",
+      message: tx(SERVER_TEXTS.pluginsLocked, { id: change.id })
+    };
   }
+  return null;
+}
+function validateQualifiedBulkChange(change, deps) {
+  const slash = change.id.indexOf("/");
   const pluginId = change.id.slice(0, slash);
   const extensionId = change.id.slice(slash + 1);
   const handle = findHandle(pluginId, deps);
@@ -26254,13 +26760,49 @@ function validateBulkChange(change, deps) {
       message: tx(SERVER_TEXTS.pluginsExtensionLocked, { pluginId, extensionId })
     };
   }
+  if (change.settings !== void 0) {
+    return validateChangeSettings(handle, pluginId, extensionId, change.settings);
+  }
   return null;
 }
+function validateChangeSettings(handle, pluginId, extensionId, patch) {
+  const declarations = handleExtensionSettings(handle, extensionId);
+  if (!declarations || Object.keys(declarations).length === 0) {
+    return {
+      status: 400,
+      code: "bad-query",
+      message: tx(SERVER_TEXTS.pluginsSettingsNoneDeclared, { pluginId, extensionId })
+    };
+  }
+  const failure = validateSettingsPatch(pluginId, extensionId, declarations, patch);
+  if (failure !== null) {
+    return {
+      status: 400,
+      code: "bad-query",
+      message: tx(SERVER_TEXTS.pluginsSettingsInvalid, {
+        settingId: failure.settingId,
+        pluginId,
+        extensionId,
+        reason: failure.reason
+      })
+    };
+  }
+  return null;
+}
+function handleExtensionSettings(handle, extensionId) {
+  if (handle.kind === "built-in") {
+    const ext2 = handle.plugin.extensions.find((e) => e.id === extensionId);
+    return readManifestSettings(ext2);
+  }
+  const ext = (handle.plugin.extensions ?? []).find((e) => e.id === extensionId);
+  return readManifestSettings(ext?.instance);
+}
 async function persistBulkAndProject(c, deps, changes) {
   const overrides = await tryWithSqlite(
     { databasePath: deps.options.dbPath, autoBackup: false },
     async (adapter) => {
       for (const change of changes) {
+        if (change.enabled === void 0) continue;
         const writeKeys = expandBulkChangeKeys(change, deps);
         for (const key of writeKeys) {
           await applyChangeToAdapter(adapter, key, change.enabled);
@@ -26269,8 +26811,40 @@ async function persistBulkAndProject(c, deps, changes) {
       return await adapter.pluginConfig.loadOverrideMap();
     }
   );
+  if (overrides === null) {
+    throw new DbMissingError(
+      tx(SERVER_TEXTS.pluginsDbMissing, { path: deps.options.dbPath })
+    );
+  }
+  const settingsTouched = persistBulkSettings(deps, changes);
+  if (settingsTouched) deps.configService.reload();
   return projectListResponse(c, deps, overrides);
 }
+function persistBulkSettings(deps, changes) {
+  const cwd = deps.runtimeContext.cwd;
+  let touched = false;
+  for (const change of changes) {
+    if (change.settings === void 0) continue;
+    const slash = change.id.indexOf("/");
+    if (slash < 0) continue;
+    const pluginId = change.id.slice(0, slash);
+    const extensionId = change.id.slice(slash + 1);
+    const handle = findHandle(pluginId, deps);
+    const declarations = handle ? handleExtensionSettings(handle, extensionId) : void 0;
+    try {
+      persistSettingsPatch(pluginId, extensionId, declarations, change.settings, cwd);
+    } catch (err) {
+      throw new HTTPException9(500, {
+        message: tx(SERVER_TEXTS.pluginsSettingsPersistFailed, {
+          id: change.id,
+          message: err instanceof Error ? err.message : String(err)
+        })
+      });
+    }
+    if (Object.keys(change.settings).length > 0) touched = true;
+  }
+  return touched;
+}
 function expandBulkChangeKeys(change, deps) {
   if (change.id.includes("/")) return [change.id];
   const handle = findHandle(change.id, deps);
@@ -28622,7 +29196,7 @@ function formatCwdPath(cwd) {
 // cli/commands/serve.ts
 var ServeCommand = class extends SmCommand {
   static paths = [["serve"]];
-  static usage = Command33.Usage({
+  static usage = Command34.Usage({
     category: "Setup",
     description: "Start the Hono BFF (single-port: REST + WebSocket + SPA bundle).",
     details: `
@@ -28646,18 +29220,18 @@ var ServeCommand = class extends SmCommand {
       ["Point at a pre-built UI bundle", "$0 serve --ui-dist ./ui/dist/browser"]
     ]
   });
-  port = Option31.String("--port", {
+  port = Option32.String("--port", {
     required: false,
     description: "Listening port (default 4242). 0 = OS-assigned."
   });
-  host = Option31.String("--host", {
+  host = Option32.String("--host", {
     required: false,
     description: "Listening host (default 127.0.0.1). Loopback-only enforced when --dev-cors is set."
   });
-  noBuiltIns = Option31.Boolean("--no-built-ins", false, {
+  noBuiltIns = Option32.Boolean("--no-built-ins", false, {
     description: "Skip built-in plugin registration (parity with sm scan --no-built-ins)."
   });
-  noPlugins = Option31.Boolean("--no-plugins", false, {
+  noPlugins = Option32.Boolean("--no-plugins", false, {
     description: "Skip drop-in plugin discovery."
   });
   // `Option.Boolean('--open', true)`, Clipanion's parser auto-derives
@@ -28667,31 +29241,31 @@ var ServeCommand = class extends SmCommand {
   // two registrations for the same flag and rejects the invocation
   // with "Ambiguous Syntax Error". Same convention shipped by every
   // other `--no-...` flag in the CLI tree.
-  open = Option31.Boolean("--open", true, {
+  open = Option32.Boolean("--open", true, {
     description: "Auto-open the SPA in the user's default browser after listen. --no-open opts out."
   });
-  devCors = Option31.Boolean("--dev-cors", false, {
+  devCors = Option32.Boolean("--dev-cors", false, {
     description: "Enable permissive CORS for the Angular dev-server proxy workflow."
   });
   // `--ui-dist` is intentionally undocumented in the Usage block above
   // (the demo build pipeline + tests rely on it; everyday users never
   // need it). Clipanion still exposes it on the parser; the Usage
   // omission is the "hidden" contract per the 14.1 brief.
-  uiDist = Option31.String("--ui-dist", { required: false, hidden: true });
-  noUi = Option31.Boolean("--no-ui", false, {
+  uiDist = Option32.String("--ui-dist", { required: false, hidden: true });
+  noUi = Option32.Boolean("--no-ui", false, {
     description: "Don't serve the Angular UI bundle. Use this when running the BFF alongside `ui:dev` (Angular dev server with HMR). The root `/` then renders an inline placeholder pointing the user at the dev server."
   });
-  noWatcher = Option31.Boolean("--no-watcher", false, {
+  noWatcher = Option32.Boolean("--no-watcher", false, {
     description: "Disable the chokidar-fed scan-and-broadcast loop. Use only for CI / read-only deployments."
   });
-  yes = Option31.Boolean("--yes", false, {
+  yes = Option32.Boolean("--yes", false, {
     description: "Skip the interactive prompt and rebuild the local cache when the on-disk DB has drifted (version skew or an inline schema change). Non-TTY invocations rebuild without asking regardless of this flag."
   });
   // `--watcher-debounce-ms` is undocumented sugar for advanced users
   // who want to tighten / relax the watcher's batching window without
   // editing settings.json. Hidden flag, the Usage block omits it.
-  watcherDebounceMs = Option31.String("--watcher-debounce-ms", { required: false, hidden: true });
-  maxNodes = Option31.String("--max-nodes", {
+  watcherDebounceMs = Option32.String("--watcher-debounce-ms", { required: false, hidden: true });
+  maxNodes = Option32.String("--max-nodes", {
     required: false,
     description: "Per-invocation override of scan.maxNodes (default 256). Bidirectional: raises OR lowers the recommended cap on classified nodes. Applies to every scan the server runs (initial watcher pass, debounced batches, POST /api/scan, GET /api/scan?fresh=1). Same flag is honoured on the bare `sm` invocation, which routes to `sm serve`."
   });
@@ -29035,7 +29609,7 @@ function tryOpenBrowser(url, stderr, warnGlyph) {
 }
 
 // cli/commands/show.ts
-import { Command as Command34, Option as Option32 } from "clipanion";
+import { Command as Command35, Option as Option33 } from "clipanion";
 
 // cli/i18n/show.texts.ts
 var SHOW_TEXTS = {
@@ -29086,7 +29660,7 @@ var SHOW_TEXTS = {
 // cli/commands/show.ts
 var ShowCommand = class extends SmCommand {
   static paths = [["show"]];
-  static usage = Command34.Usage({
+  static usage = Command35.Usage({
     category: "Browse",
     description: "Node detail: weight, frontmatter, links, issues.",
     details: `
@@ -29102,7 +29676,7 @@ var ShowCommand = class extends SmCommand {
       ["Machine-readable detail", "$0 show .claude/agents/architect.md --json"]
     ]
   });
-  nodePath = Option32.String({ required: true });
+  nodePath = Option33.String({ required: true });
   async run() {
     const dbPath = resolveDbPath({ db: this.db, ...defaultRuntimeContext() });
     const exit = requireDbOrExit(dbPath, this.context.stderr);
@@ -29344,7 +29918,7 @@ function rankConfidenceForGrouping(c) {
 // cli/commands/sidecar.ts
 import { unlink as unlink3 } from "fs/promises";
 import { resolve as resolve38 } from "path";
-import { Command as Command35, Option as Option33 } from "clipanion";
+import { Command as Command36, Option as Option34 } from "clipanion";
 
 // cli/i18n/sidecar.texts.ts
 var SIDECAR_TEXTS = {
@@ -29425,7 +29999,7 @@ async function runWithSidecarConsent(bag, ansi, dispatch) {
 }
 var SidecarRefreshCommand = class extends SmCommand {
   static paths = [["sidecar", "refresh"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Actions",
     description: "Refresh a sidecar's `for.{bodyHash, frontmatterHash}` to match the live node. Does NOT bump the version.",
     details: `
@@ -29442,8 +30016,8 @@ var SidecarRefreshCommand = class extends SmCommand {
       ["Refresh a node's sidecar hashes", "$0 sidecar refresh .claude/agents/architect.md"]
     ]
   });
-  nodePath = Option33.String({ required: true });
-  yes = Option33.Boolean("--yes", false, {
+  nodePath = Option34.String({ required: true });
+  yes = Option34.Boolean("--yes", false, {
     description: "Confirm writing .sm sidecar files in this project (sets allowEditSmFiles=true on first run)."
   });
   async run() {
@@ -29565,7 +30139,7 @@ var SidecarRefreshCommand = class extends SmCommand {
 };
 var SidecarPruneCommand = class extends SmCommand {
   static paths = [["sidecar", "prune"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Actions",
     description: "Delete orphan .sm files (sidecars whose accompanying .md no longer exists).",
     details: `
@@ -29587,8 +30161,8 @@ var SidecarPruneCommand = class extends SmCommand {
       ["Delete every orphan .sm file (non-interactive)", "$0 sidecar prune --yes"]
     ]
   });
-  dryRun = Option33.Boolean("-n,--dry-run", false);
-  yes = Option33.Boolean("--yes,--force", false, {
+  dryRun = Option34.Boolean("-n,--dry-run", false);
+  yes = Option34.Boolean("--yes,--force", false, {
     description: "Skip the interactive confirmation prompt. Required for non-interactive callers (CI, pre-commit hooks)."
   });
   // Complexity is from per-orphan handling, empty-set / dry-run /
@@ -29708,7 +30282,7 @@ var SidecarPruneCommand = class extends SmCommand {
 };
 var SidecarAnnotateCommand = class extends SmCommand {
   static paths = [["sidecar", "annotate"]];
-  static usage = Command35.Usage({
+  static usage = Command36.Usage({
     category: "Actions",
     description: "Scaffold an empty `<basename>.sm` next to a node ready for editing.",
     details: `
@@ -29726,9 +30300,9 @@ var SidecarAnnotateCommand = class extends SmCommand {
       ["Overwrite an existing one", "$0 sidecar annotate .claude/agents/architect.md --force"]
     ]
   });
-  nodePath = Option33.String({ required: true });
-  force = Option33.Boolean("--force", false);
-  yes = Option33.Boolean("--yes", false, {
+  nodePath = Option34.String({ required: true });
+  force = Option34.Boolean("--force", false);
+  yes = Option34.Boolean("--yes", false, {
     description: "Confirm writing .sm sidecar files in this project (sets allowEditSmFiles=true on first run)."
   });
   async run() {
@@ -29867,7 +30441,7 @@ var SIDECAR_COMMANDS = [
 ];
 
 // cli/commands/stubs.ts
-import { Command as Command36, Option as Option34 } from "clipanion";
+import { Command as Command37, Option as Option35 } from "clipanion";
 
 // cli/i18n/stubs.texts.ts
 var STUBS_TEXTS = {
@@ -29893,7 +30467,7 @@ var StubCommand = class extends SmCommand {
 };
 var DoctorCommand = class extends StubCommand {
   static paths = [["doctor"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Setup",
     description: planned("Diagnostic report: DB integrity, pending migrations, orphan rows, plugin status, runner availability.")
   });
@@ -29901,18 +30475,18 @@ var DoctorCommand = class extends StubCommand {
 };
 var FindingsCommand = class extends StubCommand {
   static paths = [["findings"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Browse",
     description: planned("Probabilistic findings: injection, stale summaries, low confidence.")
   });
-  kind = Option34.String("--kind", { required: false });
-  since = Option34.String("--since", { required: false });
-  threshold = Option34.String("--threshold", { required: false });
+  kind = Option35.String("--kind", { required: false });
+  since = Option35.String("--since", { required: false });
+  threshold = Option35.String("--threshold", { required: false });
   verbName = "findings";
 };
 var ActionsListCommand = class extends StubCommand {
   static paths = [["actions", "list"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Registered action types (manifest view).")
   });
@@ -29920,103 +30494,103 @@ var ActionsListCommand = class extends StubCommand {
 };
 var ActionsShowCommand = class extends StubCommand {
   static paths = [["actions", "show"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Full action manifest, including preconditions and expected duration.")
   });
-  id = Option34.String({ required: true });
+  id = Option35.String({ required: true });
   verbName = "actions show";
 };
 var JobSubmitCommand = class extends StubCommand {
   static paths = [["job", "submit"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Enqueue a single job or fan out to every matching node (--all).")
   });
-  action = Option34.String({ required: true });
-  node = Option34.String("-n", { required: false });
-  all = Option34.Boolean("--all", false);
+  action = Option35.String({ required: true });
+  node = Option35.String("-n", { required: false });
+  all = Option35.Boolean("--all", false);
   // CLI flag stays `--run`; field name is `runFlag` per the
   // shadow-avoidance convention documented on `SmCommand`.
-  runFlag = Option34.Boolean("--run", false);
-  force = Option34.Boolean("--force", false);
-  ttl = Option34.String("--ttl", { required: false });
-  priority = Option34.String("--priority", { required: false });
+  runFlag = Option35.Boolean("--run", false);
+  force = Option35.Boolean("--force", false);
+  ttl = Option35.String("--ttl", { required: false });
+  priority = Option35.String("--priority", { required: false });
   verbName = "job submit";
 };
 var JobListCommand = class extends StubCommand {
   static paths = [["job", "list"]];
-  static usage = Command36.Usage({ category: "Jobs", description: planned("List jobs.") });
-  status = Option34.String("--status", { required: false });
-  action = Option34.String("--action", { required: false });
-  node = Option34.String("--node", { required: false });
+  static usage = Command37.Usage({ category: "Jobs", description: planned("List jobs.") });
+  status = Option35.String("--status", { required: false });
+  action = Option35.String("--action", { required: false });
+  node = Option35.String("--node", { required: false });
   verbName = "job list";
 };
 var JobShowCommand = class extends StubCommand {
   static paths = [["job", "show"]];
-  static usage = Command36.Usage({ category: "Jobs", description: planned("Job detail: state, claim time, TTL, runner, content hash.") });
-  id = Option34.String({ required: true });
+  static usage = Command37.Usage({ category: "Jobs", description: planned("Job detail: state, claim time, TTL, runner, content hash.") });
+  id = Option35.String({ required: true });
   verbName = "job show";
 };
 var JobPreviewCommand = class extends StubCommand {
   static paths = [["job", "preview"]];
-  static usage = Command36.Usage({ category: "Jobs", description: planned("Render the job MD file without executing.") });
-  id = Option34.String({ required: true });
+  static usage = Command37.Usage({ category: "Jobs", description: planned("Render the job MD file without executing.") });
+  id = Option35.String({ required: true });
   verbName = "job preview";
 };
 var JobClaimCommand = class extends StubCommand {
   static paths = [["job", "claim"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Atomic primitive: return next queued job id, mark it running.")
   });
-  filter = Option34.String("--filter", { required: false });
+  filter = Option35.String("--filter", { required: false });
   verbName = "job claim";
 };
 var JobRunCommand = class extends StubCommand {
   static paths = [["job", "run"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Full CLI-runner loop: claim + spawn + record.")
   });
-  all = Option34.Boolean("--all", false);
-  max = Option34.String("--max", { required: false });
+  all = Option35.Boolean("--all", false);
+  max = Option35.String("--max", { required: false });
   verbName = "job run";
 };
 var JobStatusCommand = class extends StubCommand {
   static paths = [["job", "status"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Counts (per status) or single-job status.")
   });
-  id = Option34.String({ required: false });
+  id = Option35.String({ required: false });
   verbName = "job status";
 };
 var JobCancelCommand = class extends StubCommand {
   static paths = [["job", "cancel"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Force a running job to failed with reason user-cancelled.")
   });
-  id = Option34.String({ required: false });
-  all = Option34.Boolean("--all", false);
+  id = Option35.String({ required: false });
+  all = Option35.Boolean("--all", false);
   verbName = "job cancel";
 };
 var RecordCommand = class extends StubCommand {
   static paths = [["record"]];
-  static usage = Command36.Usage({
+  static usage = Command37.Usage({
     category: "Jobs",
     description: planned("Close a running job with success or failure. Nonce is the sole credential.")
   });
-  id = Option34.String("--id", { required: true });
-  nonce = Option34.String("--nonce", { required: true });
-  status = Option34.String("--status", { required: true });
-  report = Option34.String("--report", { required: false });
-  tokensIn = Option34.String("--tokens-in", { required: false });
-  tokensOut = Option34.String("--tokens-out", { required: false });
-  durationMs = Option34.String("--duration-ms", { required: false });
-  model = Option34.String("--model", { required: false });
-  error = Option34.String("--error", { required: false });
+  id = Option35.String("--id", { required: true });
+  nonce = Option35.String("--nonce", { required: true });
+  status = Option35.String("--status", { required: true });
+  report = Option35.String("--report", { required: false });
+  tokensIn = Option35.String("--tokens-in", { required: false });
+  tokensOut = Option35.String("--tokens-out", { required: false });
+  durationMs = Option35.String("--duration-ms", { required: false });
+  model = Option35.String("--model", { required: false });
+  error = Option35.String("--error", { required: false });
   verbName = "record";
 };
 var STUB_COMMANDS = [
@@ -30040,7 +30614,7 @@ import { cpSync as cpSync2, existsSync as existsSync32, mkdirSync as mkdirSync6,
 import { dirname as dirname20, join as join21, resolve as resolve39 } from "path";
 import { createInterface as createInterface5 } from "readline";
 import { fileURLToPath as fileURLToPath7 } from "url";
-import { Command as Command37, Option as Option35 } from "clipanion";
+import { Command as Command38, Option as Option36 } from "clipanion";
 
 // cli/i18n/tutorial.texts.ts
 var TUTORIAL_TEXTS = {
@@ -30102,7 +30676,7 @@ var TRIGGER_EN = "run the tutorial";
 var TRIGGER_ES = "ejecuta el tutorial";
 var TutorialCommand = class extends SmCommand {
   static paths = [["tutorial"]];
-  static usage = Command37.Usage({
+  static usage = Command38.Usage({
     category: "Setup",
     description: "Materialize an interactive tester tutorial as a Claude Code skill folder under `<cwd>/.claude/skills/`.",
     details: `
@@ -30125,15 +30699,15 @@ var TutorialCommand = class extends SmCommand {
   // more. Accept one so a stale `sm tutorial master` lands on a friendly
   // usage error (guarded in `run()`) instead of clipanion's generic
   // "extraneous argument" message.
-  legacyPositional = Option35.String({ required: false });
+  legacyPositional = Option36.String({ required: false });
   // Named `forProvider`, NOT `for` (reserved word). The CLI surface stays
   // `--for`; selects the destination Provider whose `scaffold.skillDir`
   // the skill is materialised under, skipping the interactive prompt.
-  forProvider = Option35.String("--for", {
+  forProvider = Option36.String("--for", {
     required: false,
     description: "Destination provider id (e.g. claude, agent-skills). Skips the prompt."
   });
-  force = Option35.Boolean("--force", false, {
+  force = Option36.Boolean("--force", false, {
     description: "Overwrite an existing target directory without prompting."
   });
   async run() {
@@ -30364,7 +30938,7 @@ function resolveSkillSourceDir() {
 }
 
 // cli/commands/version.ts
-import { Command as Command38 } from "clipanion";
+import { Command as Command39 } from "clipanion";
 
 // cli/i18n/version.texts.ts
 var VERSION_TEXTS = {
@@ -30379,7 +30953,7 @@ var VERSION_TEXTS = {
 // cli/commands/version.ts
 var VersionCommand = class extends SmCommand {
   static paths = [["version"]];
-  static usage = Command38.Usage({
+  static usage = Command39.Usage({
     category: "Introspection",
     description: "Print the CLI / kernel / spec / runtime / db-schema version matrix."
   });
@@ -30578,4 +31152,4 @@ function resolveBareDefault() {
   process.exit(ExitCode.Error);
 }
 //# sourceMappingURL=cli.js.map
-//# debugId=e21852cd-d92e-5bdf-abc7-02fffaa89502
+//# debugId=49fdc2af-2694-5cd0-ac19-33f8d1dffa9e