@wrongstack/core 0.284.0 → 0.285.0

package/dist/storage/index.js

@@ -1,15 +1,14 @@
-import { randomUUID, createHash, randomBytes } from 'crypto';
-import * as syncFs from 'fs';
-import { createReadStream, openSync, writeSync, fsyncSync, closeSync, readFileSync, statSync } from 'fs';
-import * as fsp4 from 'fs/promises';
-import * as path2 from 'path';
-import { createInterface } from 'readline';
-import * as os from 'os';
-import { hostname } from 'os';
-import { spawn } from 'child_process';
-import { fileURLToPath } from 'url';
-
 // src/storage/session-store.ts
+import { createHash as createHash4 } from "node:crypto";
+import { createReadStream } from "node:fs";
+import * as fsp4 from "node:fs/promises";
+import * as path7 from "node:path";
+import { createInterface } from "node:readline";
+
+// src/utils/atomic-write.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path3 from "node:path";
 
 // src/utils/child-env.ts
 var ALLOWED_KEYS = /* @__PURE__ */ new Set([
@@ -85,8 +84,9 @@ function sanitizeNodeOptions(value) {
   }
   return kept.join(" ");
 }
+var gitIdentity = null;
 function buildChildEnv(optsOrSessionId) {
-  const opts = {};
+  const opts = typeof optsOrSessionId === "string" ? { sessionId: optsOrSessionId } : optsOrSessionId ?? {};
   const hasOwn = Object.hasOwn(process.env, "WRONGSTACK_CHILD_ENV_PASSTHROUGH");
   const legacyHasOwn = Object.hasOwn(process.env, "WRONGSTACK_BASH_ENV_PASSTHROUGH");
   const passthrough = hasOwn && process.env["WRONGSTACK_CHILD_ENV_PASSTHROUGH"] === "1" || legacyHasOwn && process.env["WRONGSTACK_BASH_ENV_PASSTHROUGH"] === "1";
@@ -124,6 +124,16 @@ function buildChildEnv(optsOrSessionId) {
       out[k] = v;
     }
   }
+  if (gitIdentity) {
+    if (gitIdentity.name) {
+      out["GIT_AUTHOR_NAME"] = gitIdentity.name;
+      out["GIT_COMMITTER_NAME"] = gitIdentity.name;
+    }
+    if (gitIdentity.email) {
+      out["GIT_AUTHOR_EMAIL"] = gitIdentity.email;
+      out["GIT_COMMITTER_EMAIL"] = gitIdentity.email;
+    }
+  }
   if (opts.extra) {
     Object.assign(out, opts.extra);
   }
@@ -236,7 +246,7 @@ function toErrorMessage(err) {
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
+    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
     err.name = "ExpectDefinedError";
     throw err;
   }
@@ -385,13 +395,16 @@ function safeParse(input, maxBytes = 5e6) {
     };
   }
 }
+
+// src/utils/session-scoped-path.ts
+import * as path from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path2.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path2.relative(path2.resolve(dir), resolved);
-  if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+  const resolved = path.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path.relative(path.resolve(dir), resolved);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -409,6 +422,9 @@ function invalid(sessionId) {
 function slugify(name, fallback = "prompt", maxLen = 64) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLen).replace(/-+$/g, "") || fallback;
 }
+
+// src/utils/ulid.ts
+import { randomBytes } from "node:crypto";
 var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var ENCODING_LEN = ENCODING.length;
 var TIME_LEN = 10;
@@ -434,6 +450,11 @@ function encodeRandom(len) {
 function ulid(seedTime = Date.now()) {
   return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN);
 }
+
+// src/utils/wstack-paths.ts
+import { createHash } from "node:crypto";
+import * as os from "node:os";
+import * as path2 from "node:path";
 function projectHash(absRoot) {
   return createHash("sha256").update(path2.resolve(absRoot)).digest("hex").slice(0, 12);
 }
@@ -507,18 +528,59 @@ function resolveWstackPaths(opts) {
 
 // src/types/errors.ts
 var ERROR_CODES = {
+  // Provider
+  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+  // Tool
+  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+  TOOL_TIMEOUT: "TOOL_TIMEOUT",
+  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
   // Config
   CONFIG_INVALID: "CONFIG_INVALID",
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+  // Plugin
+  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+  // Agent
+  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+  AGENT_ABORTED: "AGENT_ABORTED",
+  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
   // Session
   SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
   SESSION_CORRUPTED: "SESSION_CORRUPTED",
   SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+  // Container / Registry
+  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
   // File system
   FS_READ_FAILED: "FS_READ_FAILED",
+  FS_WRITE_FAILED: "FS_WRITE_FAILED",
+  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
   FS_DELETE_FAILED: "FS_DELETE_FAILED",
   FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+  // SDD (Spec-Driven Development)
+  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+  SDD_INVALID_STATE: "SDD_INVALID_STATE",
+  SDD_NOT_READY: "SDD_NOT_READY",
   // General
   VALIDATION_ERROR: "VALIDATION_ERROR",
+  PARSE_FAILED: "PARSE_FAILED",
   UNKNOWN: "UNKNOWN"
 };
 var WrongStackError = class extends Error {
@@ -598,17 +660,17 @@ var FsError = class extends WrongStackError {
 
 // src/utils/atomic-write.ts
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path2.dirname(targetPath);
-  await fsp4.mkdir(dir, { recursive: true });
-  const tmp = path2.join(dir, `.${path2.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const dir = path3.dirname(targetPath);
+  await fs.mkdir(dir, { recursive: true });
+  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes2(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
-      await fsp4.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+      await fs.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
     } else {
-      await fsp4.writeFile(tmp, content, { flag: "wx" });
+      await fs.writeFile(tmp, content, { flag: "wx" });
     }
     try {
-      const fh = await fsp4.open(tmp, "r+");
+      const fh = await fs.open(tmp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -618,56 +680,56 @@ async function atomicWrite(targetPath, content, opts = {}) {
     }
     let mode;
     try {
-      const stat13 = await fsp4.stat(targetPath);
+      const stat13 = await fs.stat(targetPath);
       mode = stat13.mode & 511;
     } catch {
       mode = opts.mode;
     }
     if (mode !== void 0) {
-      await fsp4.chmod(tmp, mode);
+      await fs.chmod(tmp, mode);
     }
     await renameWithRetry(tmp, targetPath);
     if (mode !== void 0 && process.platform === "win32") {
       try {
-        await fsp4.chmod(targetPath, mode);
+        await fs.chmod(targetPath, mode);
       } catch {
       }
     }
   } catch (err) {
     try {
-      await fsp4.unlink(tmp);
+      await fs.unlink(tmp);
     } catch {
     }
     throw err;
   }
 }
 async function ensureDir(dir) {
-  await fsp4.mkdir(dir, { recursive: true });
+  await fs.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path2.dirname(targetPath);
-  await fsp4.mkdir(dir, { recursive: true });
-  const lockPath = path2.join(dir, `.${path2.basename(targetPath)}.lock`);
+  const dir = path3.dirname(targetPath);
+  await fs.mkdir(dir, { recursive: true });
+  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
   let handle;
   for (; ; ) {
     try {
-      handle = await fsp4.open(lockPath, "wx");
+      handle = await fs.open(lockPath, "wx");
       await handle.writeFile(`${process.pid}:${Date.now()}`);
       break;
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
-        await fsp4.mkdir(dir, { recursive: true });
+        await fs.mkdir(dir, { recursive: true });
         continue;
       }
       if (code !== "EEXIST") throw err;
       try {
-        const stat13 = await fsp4.stat(lockPath);
+        const stat13 = await fs.stat(lockPath);
         if (Date.now() - stat13.mtimeMs > staleMs) {
-          await fsp4.unlink(lockPath);
+          await fs.unlink(lockPath);
           continue;
         }
       } catch {
@@ -692,7 +754,7 @@ async function withFileLock(targetPath, fn, opts = {}) {
     } catch {
     }
     try {
-      await fsp4.unlink(lockPath);
+      await fs.unlink(lockPath);
     } catch {
     }
   }
@@ -700,14 +762,14 @@ async function withFileLock(targetPath, fn, opts = {}) {
 var TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
 async function renameWithRetry(from, to) {
   if (process.platform !== "win32") {
-    await fsp4.rename(from, to);
+    await fs.rename(from, to);
     return;
   }
   const delays = [10, 25, 60, 120, 250];
   let lastErr;
   for (let i = 0; i <= delays.length; i++) {
     try {
-      await fsp4.rename(from, to);
+      await fs.rename(from, to);
       return;
     } catch (err) {
       lastErr = err;
@@ -721,6 +783,11 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
+// src/storage/file-session-writer.ts
+import { closeSync, fsyncSync, openSync, writeSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path4 from "node:path";
+
 // src/storage/session-helpers.ts
 function userInputTitle(content) {
   const text = typeof content === "string" ? content : content.filter((b) => b.type === "text").map((b) => b.text).join(" ");
@@ -736,7 +803,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path2.join(opts.dir, `${path2.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.checkpointCas = opts.checkpointCas;
@@ -1276,7 +1343,7 @@ var FileSessionWriter = class _FileSessionWriter {
     let removedCount = 0;
     let targetCheckpointSeen = false;
     try {
-      fd = await fsp4.open(this.filePath, "r", 384);
+      fd = await fsp.open(this.filePath, "r", 384);
       while (true) {
         const buf = Buffer.alloc(CHUNK_SIZE);
         const { bytesRead } = await fd.read(buf, 0, CHUNK_SIZE, fileOffset);
@@ -1331,7 +1398,7 @@ var FileSessionWriter = class _FileSessionWriter {
     await this.writeChain;
     await this.handle.close();
     const tmpPath = `${this.filePath}.rewind.tmp`;
-    const src = await fsp4.open(this.filePath, "r", 384);
+    const src = await fsp.open(this.filePath, "r", 384);
     try {
       const statResult = await src.stat();
       const totalSize = statResult.size;
@@ -1347,7 +1414,7 @@ var FileSessionWriter = class _FileSessionWriter {
       } else {
         newlineAfterCheckpoint = totalSize;
       }
-      const writeFd = await fsp4.open(tmpPath, "w", 384);
+      const writeFd = await fsp.open(tmpPath, "w", 384);
       try {
         let readOffset = 0;
         while (readOffset < newlineAfterCheckpoint) {
@@ -1395,11 +1462,11 @@ var FileSessionWriter = class _FileSessionWriter {
         await writeFd.close();
       }
       await src.close();
-      await fsp4.rename(tmpPath, this.filePath);
-      this.handle = await fsp4.open(this.filePath, "a", 384);
+      await fsp.rename(tmpPath, this.filePath);
+      this.handle = await fsp.open(this.filePath, "a", 384);
     } catch (err) {
-      await fsp4.unlink(tmpPath).catch(() => void 0);
-      this.handle = await fsp4.open(this.filePath, "a", 384).catch(() => this.handle);
+      await fsp.unlink(tmpPath).catch(() => void 0);
+      this.handle = await fsp.open(this.filePath, "a", 384).catch(() => this.handle);
       throw err;
     }
     await this.append({
@@ -1434,7 +1501,7 @@ var FileSessionWriter = class _FileSessionWriter {
       provider: this.meta.provider ?? "unknown"
     })}
 `;
-    await fsp4.writeFile(this.filePath, record, "utf8");
+    await fsp.writeFile(this.filePath, record, "utf8");
     this.activePromptIndex = null;
     this.pendingFileSnapshots = [];
   }
@@ -1479,6 +1546,12 @@ var FileSessionWriter = class _FileSessionWriter {
   }
 };
 
+// src/storage/session-checkpoint-cas.ts
+import { spawn } from "node:child_process";
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import * as fsp2 from "node:fs/promises";
+import * as path5 from "node:path";
+
 // src/storage/storage-concurrency.ts
 async function mapWithConcurrency(items, concurrency, mapper) {
   if (items.length === 0) return [];
@@ -1505,16 +1578,16 @@ var MAX_GIT_OUTPUT = 16 * 1024 * 1024;
 var MAX_BLOB_BYTES = 64 * 1024 * 1024;
 var MAX_CHECKPOINT_BYTES = 512 * 1024 * 1024;
 function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
+  return createHash2("sha256").update(content).digest("hex");
 }
 function isInside(root, target) {
-  const relative6 = path2.relative(root, target);
-  return relative6 === "" || !relative6.startsWith("..") && !path2.isAbsolute(relative6);
+  const relative6 = path5.relative(root, target);
+  return relative6 === "" || !relative6.startsWith("..") && !path5.isAbsolute(relative6);
 }
 function normalizeRelative(input) {
-  if (!input || path2.isAbsolute(input)) return null;
+  if (!input || path5.isAbsolute(input)) return null;
   const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
-  const resolved = path2.posix.normalize(normalized);
+  const resolved = path5.posix.normalize(normalized);
   if (!resolved || resolved === "." || resolved === ".." || resolved.startsWith("../")) return null;
   return resolved;
 }
@@ -1529,8 +1602,8 @@ var SessionCheckpointCas = class {
   projectRoot;
   runGit;
   constructor(opts) {
-    this.rootDir = path2.resolve(opts.rootDir);
-    this.projectRoot = path2.resolve(opts.projectRoot);
+    this.rootDir = path5.resolve(opts.rootDir);
+    this.projectRoot = path5.resolve(opts.projectRoot);
     this.runGit = opts.runGit ?? defaultRunGit;
   }
   async capture(_sessionId, _promptIndex) {
@@ -1555,17 +1628,17 @@ var SessionCheckpointCas = class {
       relativePaths,
       CAPTURE_CONCURRENCY,
       async (relative6) => {
-        const absolute = path2.resolve(this.projectRoot, ...relative6.split("/"));
+        const absolute = path5.resolve(this.projectRoot, ...relative6.split("/"));
         if (!isInside(this.projectRoot, absolute)) {
           unresolved.push({ path: relative6, reason: "path escapes project root" });
           return null;
         }
         try {
-          const stat13 = await fsp4.lstat(absolute);
+          const stat13 = await fsp2.lstat(absolute);
           if (stat13.isSymbolicLink()) {
-            const linkTarget = await fsp4.readlink(absolute);
-            const resolvedLink = path2.resolve(path2.dirname(absolute), linkTarget);
-            if (path2.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
+            const linkTarget = await fsp2.readlink(absolute);
+            const resolvedLink = path5.resolve(path5.dirname(absolute), linkTarget);
+            if (path5.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
               unresolved.push({
                 path: relative6,
                 reason: "symlink target escapes project root"
@@ -1593,7 +1666,7 @@ var SessionCheckpointCas = class {
             return null;
           }
           scheduledBytes += stat13.size;
-          const content = await fsp4.readFile(absolute);
+          const content = await fsp2.readFile(absolute);
           const blobHash = sha256(content);
           await this.putBlob(blobHash, content);
           return { path: relative6, state: "file", blobHash, mode: stat13.mode & 511 };
@@ -1627,11 +1700,11 @@ var SessionCheckpointCas = class {
     };
   }
   async materialize(checkpoint, targetRoot) {
-    const target = path2.resolve(targetRoot);
+    const target = path5.resolve(targetRoot);
     if (target === this.projectRoot) {
       throw new Error("Refusing to materialize a workspace checkpoint over the parent project root");
     }
-    const targetStat = await fsp4.stat(target);
+    const targetStat = await fsp2.stat(target);
     if (!targetStat.isDirectory()) throw new Error(`Checkpoint target is not a directory: ${target}`);
     const manifest = await this.loadManifest(checkpoint.manifestHash);
     if (manifest.baseHead !== checkpoint.baseHead.toLowerCase() || manifest.coverage !== checkpoint.coverage || manifest.entries.length !== checkpoint.entryCount || manifest.unresolved.length !== checkpoint.unresolvedCount) {
@@ -1658,7 +1731,7 @@ var SessionCheckpointCas = class {
     if (targetStatus.stdout.length > 0) {
       throw new Error("Checkpoint target must be a clean checkout before materialization");
     }
-    const realTarget = await fsp4.realpath(target);
+    const realTarget = await fsp2.realpath(target);
     const writtenFiles = [];
     const deletedFiles = [];
     const errors = [];
@@ -1667,10 +1740,10 @@ var SessionCheckpointCas = class {
       try {
         const output = await this.safeOutputPath(target, realTarget, entry.path);
         if (entry.state === "symlink") {
-          if (path2.isAbsolute(entry.linkTarget)) {
+          if (path5.isAbsolute(entry.linkTarget)) {
             throw new Error("absolute symlink target refused");
           }
-          const resolvedLink = path2.resolve(path2.dirname(output), entry.linkTarget);
+          const resolvedLink = path5.resolve(path5.dirname(output), entry.linkTarget);
           if (!isInside(target, resolvedLink)) throw new Error("symlink target escapes checkpoint root");
         }
         prepared.push({
@@ -1688,24 +1761,24 @@ var SessionCheckpointCas = class {
     for (const { entry, output, content } of prepared) {
       try {
         if (entry.state === "absent") {
-          await fsp4.unlink(output).catch((err) => {
+          await fsp2.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
           deletedFiles.push(entry.path);
           continue;
         }
         if (entry.state === "symlink") {
-          await fsp4.unlink(output).catch((err) => {
+          await fsp2.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
-          await fsp4.mkdir(path2.dirname(output), { recursive: true });
-          await fsp4.symlink(entry.linkTarget, output);
+          await fsp2.mkdir(path5.dirname(output), { recursive: true });
+          await fsp2.symlink(entry.linkTarget, output);
           writtenFiles.push(entry.path);
           continue;
         }
         if (!content) throw new Error("CAS blob was not prepared");
         await atomicWrite(output, content, { mode: entry.mode });
-        await fsp4.chmod(output, entry.mode).catch(() => void 0);
+        await fsp2.chmod(output, entry.mode).catch(() => void 0);
         writtenFiles.push(entry.path);
       } catch (err) {
         errors.push(`${entry.path}: ${toErrorMessage(err)}`);
@@ -1715,48 +1788,48 @@ var SessionCheckpointCas = class {
   }
   objectPath(hash) {
     if (!HASH_RE.test(hash)) throw new Error(`Invalid CAS object hash: ${hash}`);
-    return path2.join(this.rootDir, "objects", hash.slice(0, 2), hash.slice(2));
+    return path5.join(this.rootDir, "objects", hash.slice(0, 2), hash.slice(2));
   }
   manifestPath(hash) {
     if (!HASH_RE.test(hash)) throw new Error(`Invalid checkpoint manifest hash: ${hash}`);
-    return path2.join(this.rootDir, "manifests", `${hash}.json`);
+    return path5.join(this.rootDir, "manifests", `${hash}.json`);
   }
   async putBlob(hash, content) {
     const target = this.objectPath(hash);
-    await fsp4.mkdir(path2.dirname(target), { recursive: true });
+    await fsp2.mkdir(path5.dirname(target), { recursive: true });
     try {
-      const existing = await fsp4.readFile(target);
+      const existing = await fsp2.readFile(target);
       if (sha256(existing) !== hash) throw new Error(`Corrupt CAS object collision: ${hash}`);
       return;
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    const temp = path2.join(
-      path2.dirname(target),
-      `.${path2.basename(target)}.${process.pid}.${randomUUID()}.tmp`
+    const temp = path5.join(
+      path5.dirname(target),
+      `.${path5.basename(target)}.${process.pid}.${randomUUID()}.tmp`
     );
     let handle;
     try {
-      handle = await fsp4.open(temp, "wx", 384);
+      handle = await fsp2.open(temp, "wx", 384);
       await handle.writeFile(content);
       await handle.sync();
       await handle.close();
       handle = void 0;
       try {
-        await fsp4.link(temp, target);
+        await fsp2.link(temp, target);
       } catch (err) {
         if (err.code !== "EEXIST") throw err;
-        const existing = await fsp4.readFile(target);
+        const existing = await fsp2.readFile(target);
         if (sha256(existing) !== hash) throw new Error(`Corrupt CAS object collision: ${hash}`);
       }
     } finally {
       await handle?.close().catch(() => void 0);
-      await fsp4.unlink(temp).catch(() => void 0);
+      await fsp2.unlink(temp).catch(() => void 0);
     }
   }
   async putManifest(hash, encoded) {
     const target = this.manifestPath(hash);
-    const existing = await fsp4.readFile(target).catch(() => null);
+    const existing = await fsp2.readFile(target).catch(() => null);
     if (existing) {
       if (sha256(existing) !== hash) throw new Error(`Corrupt checkpoint manifest collision: ${hash}`);
       return;
@@ -1764,12 +1837,12 @@ var SessionCheckpointCas = class {
     await atomicWrite(target, encoded, { mode: 384 });
   }
   async readBlob(hash) {
-    const content = await fsp4.readFile(this.objectPath(hash));
+    const content = await fsp2.readFile(this.objectPath(hash));
     if (sha256(content) !== hash) throw new Error(`CAS blob integrity check failed: ${hash}`);
     return content;
   }
   async loadManifest(hash) {
-    const raw = await fsp4.readFile(this.manifestPath(hash));
+    const raw = await fsp2.readFile(this.manifestPath(hash));
     if (sha256(raw) !== hash) throw new Error(`Checkpoint manifest integrity check failed: ${hash}`);
     const parsed = JSON.parse(raw.toString("utf8"));
     if (parsed.version !== 1 || typeof parsed.baseHead !== "string" || parsed.coverage !== "git-head-plus-dirty" || !Array.isArray(parsed.entries) || !Array.isArray(parsed.unresolved)) {
@@ -1794,17 +1867,17 @@ var SessionCheckpointCas = class {
   async safeOutputPath(target, realTarget, relative6) {
     const normalized = normalizeRelative(relative6);
     if (!normalized) throw new Error("invalid relative path");
-    const output = path2.resolve(target, ...normalized.split("/"));
+    const output = path5.resolve(target, ...normalized.split("/"));
     if (!isInside(target, output)) throw new Error("path escapes checkpoint target");
     let probe = output;
     for (; ; ) {
       try {
-        const real = await fsp4.realpath(probe);
+        const real = await fsp2.realpath(probe);
         if (!isInside(realTarget, real)) throw new Error("path resolves through a symlink outside checkpoint target");
         return output;
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
-        const parent = path2.dirname(probe);
+        const parent = path5.dirname(probe);
         if (parent === probe) throw err;
         probe = parent;
       }
@@ -1859,12 +1932,17 @@ function defaultRunGit(args, cwd) {
     child.on("close", (code) => resolve11(result(code ?? 1)));
   });
 }
+
+// src/storage/session-resume-validation.ts
+import { createHash as createHash3 } from "node:crypto";
+import * as fsp3 from "node:fs/promises";
+import * as path6 from "node:path";
 var MAX_REVALIDATE_BYTES = 5 * 1024 * 1024;
 var VALIDATION_CONCURRENCY = 8;
 var NOTICE_PATH_LIMIT = 20;
 function isInside2(root, target) {
-  const relative6 = path2.relative(root, target);
-  return relative6 === "" || !relative6.startsWith("..") && !path2.isAbsolute(relative6);
+  const relative6 = path6.relative(root, target);
+  return relative6 === "" || !relative6.startsWith("..") && !path6.isAbsolute(relative6);
 }
 function errno(err) {
   return err && typeof err === "object" && "code" in err ? String(err.code) : void 0;
@@ -1875,7 +1953,7 @@ function latestObservations(events, projectRoot) {
     if (event.type !== "file_observation" || typeof event.path !== "string" || event.path.length === 0 || typeof event.hash !== "string" || !/^[a-f\d]{64}$/i.test(event.hash)) {
       continue;
     }
-    const normalized = path2.resolve(projectRoot, event.path);
+    const normalized = path6.resolve(projectRoot, event.path);
     latest.set(normalized, {
       path: normalized,
       hash: event.hash.toLowerCase(),
@@ -1899,7 +1977,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
   let realFile;
   try {
-    realFile = await fsp4.realpath(observation.path);
+    realFile = await fsp3.realpath(observation.path);
   } catch (err) {
     if (errno(err) === "ENOENT") return { ...base, status: "deleted" };
     return { ...base, status: "unreadable", detail: toErrorMessage(err) };
@@ -1912,7 +1990,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
     };
   }
   try {
-    const stat13 = await fsp4.stat(realFile);
+    const stat13 = await fsp3.stat(realFile);
     if (!stat13.isFile()) {
       return { ...base, status: "unreadable", detail: "Path is no longer a regular file." };
     }
@@ -1923,8 +2001,8 @@ async function validateOne(observation, lexicalRoot, realRoot) {
         detail: `File now exceeds the ${MAX_REVALIDATE_BYTES}-byte validation limit.`
       };
     }
-    const content = await fsp4.readFile(realFile, "utf8");
-    const actualHash = createHash("sha256").update(content, "utf8").digest("hex");
+    const content = await fsp3.readFile(realFile, "utf8");
+    const actualHash = createHash3("sha256").update(content, "utf8").digest("hex");
     if (actualHash === observation.hash) return null;
     return { ...base, status: "modified", actualHash };
   } catch (err) {
@@ -1933,8 +2011,8 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
 }
 async function validateResumeFileObservations(events, projectRoot) {
-  const lexicalRoot = path2.resolve(projectRoot);
-  const realRoot = await fsp4.realpath(lexicalRoot).catch(() => lexicalRoot);
+  const lexicalRoot = path6.resolve(projectRoot);
+  const realRoot = await fsp3.realpath(lexicalRoot).catch(() => lexicalRoot);
   const observations = latestObservations(events, lexicalRoot);
   const results = await mapWithConcurrency(
     observations,
@@ -1949,9 +2027,9 @@ async function validateResumeFileObservations(events, projectRoot) {
 }
 function formatResumeValidationNotice(validation, projectRoot) {
   if (validation.staleFiles.length === 0) return null;
-  const root = path2.resolve(projectRoot);
+  const root = path6.resolve(projectRoot);
   const shown = validation.staleFiles.slice(0, NOTICE_PATH_LIMIT).map((entry) => {
-    const relative6 = path2.relative(root, entry.path);
+    const relative6 = path6.relative(root, entry.path);
     const display = isInside2(root, entry.path) ? relative6 || "." : entry.path;
     return `- ${JSON.stringify(display)} [${entry.status}]`;
   });
@@ -2076,9 +2154,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   static LIST_SCAN_CONCURRENCY = 32;
   constructor(opts) {
     this.dir = opts.dir;
-    this.projectRoot = opts.projectRoot ? path2.resolve(opts.projectRoot) : void 0;
+    this.projectRoot = opts.projectRoot ? path7.resolve(opts.projectRoot) : void 0;
     this.checkpointCas = this.projectRoot ? new SessionCheckpointCas({
-      rootDir: path2.join(this.dir, "_cas"),
+      rootDir: path7.join(this.dir, "_cas"),
       projectRoot: this.projectRoot
     }) : void 0;
     this.events = opts.events;
@@ -2132,17 +2210,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path2.join(this.dir, "_index.jsonl");
+    return path7.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
     return sessionScopedPath(this.dir, id, ext);
   }
   shardManifestPath(shardKey) {
-    return shardKey ? path2.join(this.dir, shardKey, "_manifest.json") : path2.join(this.dir, "_manifest.json");
+    return shardKey ? path7.join(this.dir, shardKey, "_manifest.json") : path7.join(this.dir, "_manifest.json");
   }
   shardKeyForSessionId(id) {
-    const dirName = path2.dirname(id);
+    const dirName = path7.dirname(id);
     return dirName === "." ? "" : dirName;
   }
   invalidateShardManifestBySessionId(id) {
@@ -2154,7 +2232,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path2.dirname(sessionScopedPath(this.dir, id, ""));
+    const dirPath = path7.dirname(sessionScopedPath(this.dir, id, ""));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -2216,7 +2294,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     const parentPrefix = parent.events.slice(0, boundary + 1);
     const workspaceCheckpoint = targetCheckpoint?.workspaceCheckpoint;
-    const checkpointHash = createHash("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
+    const checkpointHash = createHash4("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
     const inherited = parentPrefix.filter(inheritsIntoFork);
     const writer = await this.create({
       id: "",
@@ -2311,7 +2389,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path2.dirname(file),
+          dir: path7.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           checkpointCas: this.checkpointCas,
@@ -2866,7 +2944,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return entry;
   }
   async collectSessionFilesInShard(shardKey) {
-    const dir = shardKey ? path2.join(this.dir, shardKey) : this.dir;
+    const dir = shardKey ? path7.join(this.dir, shardKey) : this.dir;
     const entries = await this.collectSessionFiles(dir, shardKey);
     return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
@@ -2889,13 +2967,13 @@ var DefaultSessionStore = class _DefaultSessionStore {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
         const id = prefix ? `${prefix}/${base}` : base;
-        files.push({ id, filePath: path2.join(dir, entry.name) });
+        files.push({ id, filePath: path7.join(dir, entry.name) });
       }
     }
     const childFileArrays = await Promise.all(
       dirEntries.map((entry) => {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionFiles(path2.join(dir, entry.name), childPrefix, depth + 1);
+        return this.collectSessionFiles(path7.join(dir, entry.name), childPrefix, depth + 1);
       })
     );
     return [...childFileArrays.flat(), ...files];
@@ -2928,7 +3006,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const childIdArrays = await Promise.all(
       dirEntries.map((entry) => {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionIds(path2.join(dir, entry.name), childPrefix, depth + 1);
+        return this.collectSessionIds(path7.join(dir, entry.name), childPrefix, depth + 1);
       })
     );
     return [...childIdArrays.flat(), ...fileIds];
@@ -3045,9 +3123,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path2.dirname(jsonlPath);
-    const base = path2.basename(id);
-    const sessDir = path2.join(shardDir, base);
+    const shardDir = path7.dirname(jsonlPath);
+    const base = path7.basename(id);
+    const sessDir = path7.join(shardDir, base);
     const deletions = [
       fsp4.unlink(jsonlPath),
       fsp4.unlink(summaryPath),
@@ -3088,7 +3166,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    */
   async readActiveSessionId() {
     try {
-      const raw = await fsp4.readFile(path2.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp4.readFile(path7.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       return active.sessionId ?? null;
     } catch {
@@ -3151,7 +3229,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const activeSessionId = await this.readActiveSessionId();
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path2.join(dir, name);
+      const jsonlPath = path7.join(dir, name);
       try {
         const stat13 = await fsp4.stat(jsonlPath);
         if (stat13.mtimeMs >= cutoff) return;
@@ -3171,7 +3249,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path2.join(this.dir, entry.name);
+      const dateDir = path7.join(this.dir, entry.name);
       const files = await fsp4.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
@@ -3183,7 +3261,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path2.join(this.dir, entry.name);
+      const dateDir = path7.join(this.dir, entry.name);
       try {
         const remaining = await fsp4.readdir(dateDir);
         if (remaining.length === 0) {
@@ -3305,6 +3383,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
   }
 };
+
+// src/storage/queue-store.ts
+import * as fsp5 from "node:fs/promises";
+import * as path8 from "node:path";
 var QueueStore = class {
   file;
   // Use `| undefined` (not `?`) so exactOptionalPropertyTypes doesn't
@@ -3312,7 +3394,7 @@ var QueueStore = class {
   events;
   traceId;
   constructor(opts) {
-    this.file = path2.join(opts.dir, "queue.json");
+    this.file = path8.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
   }
@@ -3357,7 +3439,7 @@ var QueueStore = class {
     const t0 = Date.now();
     let raw;
     try {
-      raw = await fsp4.readFile(this.file, "utf8");
+      raw = await fsp5.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -3438,7 +3520,7 @@ var QueueStore = class {
   async clear() {
     const t0 = Date.now();
     try {
-      await fsp4.unlink(this.file);
+      await fsp5.unlink(this.file);
       this.events?.emit("storage.write", {
         sessionId: this.traceId ?? "~boot~",
         store: "queue",
@@ -3476,6 +3558,11 @@ function isPersistedQueueItem(v) {
   const o = v;
   return typeof o["displayText"] === "string" && Array.isArray(o["blocks"]);
 }
+
+// src/storage/attachment-store.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import * as fsp6 from "node:fs/promises";
+import * as path9 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -3490,13 +3577,13 @@ var DefaultAttachmentStore = class {
   }
   async add(input) {
     const seq = ++this.nextSeq[input.kind];
-    const id = `${kindPrefix(input.kind)}-${seq}-${randomBytes(3).toString("hex")}`;
+    const id = `${kindPrefix(input.kind)}-${seq}-${randomBytes3(3).toString("hex")}`;
     const bytes = Buffer.byteLength(input.data, input.kind === "image" ? "base64" : "utf8");
     let spooledPath;
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
-      await fsp4.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path2.join(this.spoolDir, `${id}.bin`);
+      await fsp6.mkdir(this.spoolDir, { recursive: true });
+      spooledPath = path9.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -3558,7 +3645,7 @@ var DefaultAttachmentStore = class {
       for (const att of this.items.values()) {
         if (att.path) toDelete.push(att.path);
       }
-      await Promise.all(toDelete.map((p) => fsp4.unlink(p).catch(() => void 0)));
+      await Promise.all(toDelete.map((p) => fsp6.unlink(p).catch(() => void 0)));
     }
     this.items.clear();
     this.refs.length = 0;
@@ -3566,7 +3653,7 @@ var DefaultAttachmentStore = class {
   }
   async toBlock(att) {
     if (att.kind === "image") {
-      const data = att.data ?? (att.path ? await fsp4.readFile(att.path, { encoding: "base64" }) : "");
+      const data = att.data ?? (att.path ? await fsp6.readFile(att.path, { encoding: "base64" }) : "");
       return {
         type: "image",
         source: {
@@ -3576,7 +3663,7 @@ var DefaultAttachmentStore = class {
         }
       };
     }
-    const raw = att.data ?? (att.path ? await fsp4.readFile(att.path, "utf8") : "");
+    const raw = att.data ?? (att.path ? await fsp6.readFile(att.path, "utf8") : "");
     const label = att.meta.filename ? `<file path="${att.meta.filename}">` : "<pasted>";
     const close = att.meta.filename ? "</file>" : "</pasted>";
     return { type: "text", text: `${label}
@@ -3614,6 +3701,11 @@ function mergeAdjacentText(blocks) {
   return out;
 }
 
+// src/storage/memory-backend.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path10 from "node:path";
+
 // src/types/memory.ts
 var MEMORY_TYPE_LABELS = {
   fact: "Fact",
@@ -3779,7 +3871,7 @@ var FileMemoryBackend = class {
   }
   async getMtime(file) {
     try {
-      const stat13 = await fsp4.stat(file);
+      const stat13 = await fs2.stat(file);
       return stat13.mtimeMs;
     } catch {
       return 0;
@@ -3826,13 +3918,13 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path2.dirname(file));
+    await ensureDir(path10.dirname(file));
     let existing = "";
     try {
-      existing = await fsp4.readFile(file, "utf8");
+      existing = await fs2.readFile(file, "utf8");
     } catch {
     }
-    const id = `mem_${Date.now()}_${randomUUID().slice(0, 8)}`;
+    const id = `mem_${Date.now()}_${randomUUID2().slice(0, 8)}`;
     const meta = formatMetadata(entry);
     const line = `
 - [${entry.ts}] ${id}${meta} ${entry.text.replace(/\n/g, " ")}
@@ -3847,7 +3939,7 @@ ${line}`;
     return withFileLock(file, async () => {
       let existing;
       try {
-        existing = await fsp4.readFile(file, "utf8");
+        existing = await fs2.readFile(file, "utf8");
       } catch {
         return 0;
       }
@@ -3884,7 +3976,7 @@ ${line}`;
   async readAll(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
     try {
-      return await fsp4.readFile(file, "utf8");
+      return await fs2.readFile(file, "utf8");
     } catch {
       return "";
     }
@@ -3908,7 +4000,7 @@ ${line}`;
     const file = this.resolveFile(filePath, scope);
     let existing;
     try {
-      existing = await fsp4.readFile(file, "utf8");
+      existing = await fs2.readFile(file, "utf8");
     } catch {
       return 0;
     }
@@ -3928,7 +4020,7 @@ ${line}`;
     const next = lines.join("\n");
     const backup = `${file}.bak.${Date.now()}`;
     try {
-      await fsp4.copyFile(file, backup);
+      await fs2.copyFile(file, backup);
       await pruneConsolidateBackups(file);
     } catch {
     }
@@ -3942,14 +4034,14 @@ ${line}`;
   }
 };
 async function pruneConsolidateBackups(file) {
-  const dir = path2.dirname(file);
-  const base = path2.basename(file);
+  const dir = path10.dirname(file);
+  const base = path10.basename(file);
   const prefix = `${base}.bak.`;
-  const backups = (await fsp4.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
+  const backups = (await fs2.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
   await Promise.all(
     backups.slice(MAX_MEMORY_CONSOLIDATE_BACKUPS).map(async (name) => {
       try {
-        await fsp4.unlink(path2.join(dir, name));
+        await fs2.unlink(path10.join(dir, name));
       } catch {
       }
     })
@@ -4309,6 +4401,10 @@ ${body.trim()}`);
           score += 1;
           reasons.push("preference");
           break;
+        case "reference":
+          break;
+        case "fact":
+          break;
       }
       const ageDays = (now - new Date(entry.ts).getTime()) / (1e3 * 60 * 60 * 24);
       if (ageDays < 1) score += 1;
@@ -4516,9 +4612,9 @@ ${body.trim()}`);
     if (!this.persistBackup || scope === "project-agents") return;
     try {
       const content = await this.backend.readAll(scope, this.files[scope]);
-      const { writeFile: writeFile8, mkdir: mkdir8 } = await import('fs/promises');
-      await mkdir8(this.backupDir, { recursive: true });
-      await writeFile8(`${this.backupDir}/${scope}.md`, content, "utf8");
+      const { writeFile: writeFile7, mkdir: mkdir7 } = await import("node:fs/promises");
+      await mkdir7(this.backupDir, { recursive: true });
+      await writeFile7(`${this.backupDir}/${scope}.md`, content, "utf8");
     } catch {
     }
   }
@@ -4533,6 +4629,9 @@ function labelOf(scope) {
       return "User memory";
   }
 }
+
+// src/storage/memory-graph-backend.ts
+import * as fs3 from "node:fs/promises";
 var GraphMemoryBackend = class _GraphMemoryBackend {
   kind = "graph";
   file;
@@ -4584,7 +4683,8 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
         priority: entry.priority
       });
       this.indexNode(nodeId, entry);
-      const recentNodes = [...this.nodes.values()].slice(-100);
+      const SIMILARITY_WINDOW = 100;
+      const recentNodes = [...this.nodes.values()].slice(-SIMILARITY_WINDOW);
       for (const other of recentNodes) {
         if (other.id === nodeId) continue;
         const sim = wordOverlap(entry.text, other.entry.text);
@@ -4699,7 +4799,7 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
     this.loadedScope = scope;
     this.loaded = true;
     try {
-      await fsp4.unlink(this.graphFile);
+      await fs3.unlink(this.graphFile);
     } catch {
     }
   }
@@ -4739,7 +4839,7 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
   async loadGraph(scope) {
     if (this.loaded && this.loadedScope === scope) return;
     try {
-      const raw = await fsp4.readFile(this.graphFile, "utf8");
+      const raw = await fs3.readFile(this.graphFile, "utf8");
       const data = JSON.parse(raw);
       this.nodes = new Map(data.nodes);
       this.edges = data.edges;
@@ -4761,10 +4861,10 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
         edges: this.edges
       };
       const dir = this.graphFile.substring(0, this.graphFile.lastIndexOf("/"));
-      await fsp4.mkdir(dir, { recursive: true });
+      await fs3.mkdir(dir, { recursive: true });
       const tmp = `${this.graphFile}.tmp`;
-      await fsp4.writeFile(tmp, JSON.stringify(data));
-      await fsp4.rename(tmp, this.graphFile);
+      await fs3.writeFile(tmp, JSON.stringify(data));
+      await fs3.rename(tmp, this.graphFile);
     } catch {
     }
   }
@@ -4880,6 +4980,11 @@ function simpleHash(s) {
   }
   return Math.abs(h).toString(36);
 }
+
+// src/utils/instruction-file.ts
+import { readFileSync, statSync } from "node:fs";
+import * as path11 from "node:path";
+import { fileURLToPath } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
 function readBundledInstructionText(relativePath) {
@@ -4888,7 +4993,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync(path2.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync(path11.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -4904,11 +5009,11 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path2.dirname(fileURLToPath(import.meta.url));
+  const here = path11.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path2.resolve(here, "../../instructions"),
-    path2.resolve(here, "../instructions"),
-    path2.resolve(here, "instructions")
+    path11.resolve(here, "../../instructions"),
+    path11.resolve(here, "../instructions"),
+    path11.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   return rootCandidates;
@@ -5104,14 +5209,13 @@ function deepFreeze(obj) {
   }
   return Object.freeze(obj);
 }
-var KEY_BYTES = 32;
-var IV_BYTES = 12;
-var TAG_BYTES = 16;
-var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
-KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
-var KEK_MAGIC = Buffer.from("WSKW", "ascii");
-var KEK_SALT_BYTES = 16;
-KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
+
+// src/storage/provider-config-watcher.ts
+import * as syncFs from "node:fs";
+import * as fs4 from "node:fs/promises";
+import * as path12 from "node:path";
+
+// src/security/config-secrets.ts
 function decryptConfigSecrets(cfg, vault, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   return walk(cfg, vault, (v, key) => {
@@ -5155,7 +5259,7 @@ function isSecretField(name) {
 async function readProviderSnapshot(configPath, vault, warn) {
   let raw;
   try {
-    raw = await fsp4.readFile(configPath, "utf8");
+    raw = await fs4.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       warn?.(`Could not read ${configPath}: ${err.message}`);
@@ -5190,7 +5294,7 @@ function serializeSnapshot(s) {
 function watchProviderConfig(configPath, vault, onChange, opts = {}) {
   const debounceMs = opts.debounceMs ?? 200;
   const warn = opts.warn;
-  const base = path2.basename(configPath);
+  const base = path12.basename(configPath);
   let timer;
   let closed = false;
   let lastSerialized;
@@ -5201,7 +5305,7 @@ function watchProviderConfig(configPath, vault, onChange, opts = {}) {
   });
   let watcher;
   try {
-    watcher = syncFs.watch(path2.dirname(configPath), { recursive: false });
+    watcher = syncFs.watch(path12.dirname(configPath), { recursive: false });
   } catch (err) {
     warn?.(`Provider config watcher could not start: ${err.message}`);
     return { close: () => {
@@ -5243,6 +5347,10 @@ function watchProviderConfig(configPath, vault, onChange, opts = {}) {
   };
 }
 
+// src/storage/config-loader.ts
+import * as fs5 from "node:fs/promises";
+import * as path13 from "node:path";
+
 // src/types/config.ts
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 
@@ -5381,12 +5489,38 @@ var BEHAVIOR_DEFAULTS = {
     tokenSavingMode: "off",
     allowOutsideProjectRoot: true
   },
+  superMemory: {
+    enabled: true,
+    storage: {
+      projectLocal: true,
+      directory: ".wrongstack/memories"
+    },
+    inject: {
+      turnContext: true,
+      toolResults: true,
+      maxHintsPerTool: 4,
+      maxCharsPerTool: 1200,
+      maxTurnMemories: 8,
+      maxCharsPerTurn: 2400,
+      minScore: 0.65,
+      repeatCooldownMs: 30 * 6e4
+    },
+    hygiene: {
+      autoAfterSession: true,
+      autoOnFileChange: true,
+      retentionDays: 90,
+      archiveLowConfidenceAfterDays: 30
+    },
+    embeddings: {
+      enabled: false
+    }
+  },
   skills: { readClaudeSkills: true },
   mcpServers: {},
   fallbackAuto: true,
   maxConcurrent: 4,
-  // YOLO on by default: auto-approve normal project work without a per-call
-  // prompt. Destructive operations still gate through a confirmation. Users
+  // YOLO on by default: auto-approve non-denied tool calls without a per-call
+  // prompt. Users
   // who want the per-call prompts set `yolo: false`. Existing installs whose
   // config lacks this key pick it up via fillMissingDefaults; an explicit
   // `false` is preserved by the deep-merge (opt-out respected).
@@ -5405,8 +5539,8 @@ var BEHAVIOR_DEFAULTS = {
   autonomy: {
     // 'auto' by default: the agent self-drives (picks the top next-step after
     // each turn). This is a startup default, not a runtime flip — the
-    // autoProceedMaxIterations cap + autoProceedDelayMs cooldown + destructive
-    // gate + Ctrl+C / [GOAL_COMPLETE] stops remain in force. Explicit 'off'
+    // autoProceedMaxIterations cap + autoProceedDelayMs cooldown + Ctrl+C /
+    // [GOAL_COMPLETE] stops remain in force. Explicit 'off'
     // in a config file is preserved (opt-out respected).
     defaultMode: "auto",
     autoProceedDelayMs: DEFAULT_AUTONOMY_CONFIG.autoProceedDelayMs,
@@ -5521,6 +5655,7 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "context",
   "tools",
   "features",
+  "superMemory",
   "skills",
   "autonomy",
   "indexing",
@@ -5560,6 +5695,10 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "fleet",
     reason: "Fleet supervision knobs: a repo-committed config could enable autonomous subagent spawning/steering/termination and mailbox traffic on the victim machine."
+  },
+  {
+    key: "git",
+    reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -5585,6 +5724,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "plugins",
   "log",
   "features",
+  "superMemory",
   "skills",
   "yolo",
   "nextPrediction",
@@ -5603,7 +5743,8 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "sync",
   "extensions",
   "acp",
-  "fleet"
+  "fleet",
+  "git"
 ]);
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];
@@ -5696,6 +5837,19 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
       out["skills"] = clonedSkills;
     }
   }
+  const outSuperMemory = out["superMemory"];
+  if (outSuperMemory && typeof outSuperMemory === "object") {
+    const storage = outSuperMemory["storage"];
+    if (storage && typeof storage === "object" && "directory" in storage) {
+      const clonedStorage = { ...storage };
+      delete clonedStorage["directory"];
+      out["superMemory"] = {
+        ...outSuperMemory,
+        storage: clonedStorage
+      };
+      stripped.push("superMemory.storage.directory");
+    }
+  }
   if (stripped.length > 0) {
     warn(
       JSON.stringify({
@@ -5711,8 +5865,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
   return out;
 }
 function samePath(a, b) {
-  let ra = path2.resolve(a);
-  let rb = path2.resolve(b);
+  let ra = path13.resolve(a);
+  let rb = path13.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -5814,7 +5968,7 @@ var DefaultConfigLoader = class {
       }
     }
     this.validateBehavior(cfg);
-    if (this.strict) {
+    if (this.strict && !opts.skipIdentityValidation) {
       this.validateIdentity(cfg);
     }
     return Object.freeze(cfg);
@@ -5826,7 +5980,7 @@ var DefaultConfigLoader = class {
       await withFileLock(fp, async () => {
         let parsed;
         try {
-          const raw = await fsp4.readFile(fp, "utf8");
+          const raw = await fs5.readFile(fp, "utf8");
           const result = safeParse(raw);
           if (!result.ok || !isPlainRecord(result.value)) {
             return;
@@ -5945,7 +6099,7 @@ var DefaultConfigLoader = class {
     const fp = this.paths.syncConfig;
     const t0 = Date.now();
     try {
-      const raw = await fsp4.readFile(fp, "utf8");
+      const raw = await fs5.readFile(fp, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok || !parsed.value) {
         this.events?.emit("storage.read", {
@@ -6011,7 +6165,7 @@ var DefaultConfigLoader = class {
     const t0 = Date.now();
     let mtimeMs = null;
     try {
-      const stat13 = await fsp4.stat(file);
+      const stat13 = await fs5.stat(file);
       mtimeMs = stat13.mtimeMs;
       const cached = this.jsonCache.get(file);
       if (cached && cached.mtimeMs === mtimeMs) {
@@ -6045,7 +6199,7 @@ var DefaultConfigLoader = class {
     }
     let raw;
     try {
-      raw = await fsp4.readFile(file, "utf8");
+      raw = await fs5.readFile(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         this.events?.emit("storage.read", {
@@ -6212,6 +6366,11 @@ function runConfigMigrations(input, targetVersion, migrations) {
   return { config: current, applied, shouldPersist };
 }
 var DEFAULT_CONFIG_MIGRATIONS = [];
+
+// src/storage/recovery-lock.ts
+import * as fsp7 from "node:fs/promises";
+import * as os2 from "node:os";
+import * as path14 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -6222,9 +6381,9 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path2.join(opts.dir, LOCK_FILE);
+    this.file = path14.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
-    this.hostname = opts.hostname ?? os.hostname();
+    this.hostname = opts.hostname ?? os2.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
     this.sessionStore = opts.sessionStore;
     this.probe = opts.isPidAlive ?? defaultIsPidAlive;
@@ -6283,7 +6442,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path14.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -6292,7 +6451,7 @@ var RecoveryLock = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await fsp4.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
+      await fsp7.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
     } catch (err) {
       const code = err.code;
       if (code === "EEXIST") {
@@ -6308,7 +6467,7 @@ var RecoveryLock = class {
    */
   async clear() {
     try {
-      await fsp4.unlink(this.file);
+      await fsp7.unlink(this.file);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return;
@@ -6318,7 +6477,7 @@ var RecoveryLock = class {
   async readLock() {
     let raw;
     try {
-      raw = await fsp4.readFile(this.file, "utf8");
+      raw = await fsp7.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return null;
@@ -6349,6 +6508,9 @@ function defaultIsPidAlive(pid) {
     return false;
   }
 }
+
+// src/storage/session-reader.ts
+import * as fs6 from "node:fs/promises";
 var DefaultSessionReader = class _DefaultSessionReader {
   store;
   eventCache = /* @__PURE__ */ new Map();
@@ -6366,7 +6528,7 @@ var DefaultSessionReader = class _DefaultSessionReader {
     const sessionPath = sessionScopedPath(rootDir, sessionId, ".jsonl");
     let mtimeMs = null;
     try {
-      const stat13 = await fsp4.stat(sessionPath);
+      const stat13 = await fs6.stat(sessionPath);
       mtimeMs = stat13.mtimeMs;
     } catch {
       this.eventCache.delete(sessionId);
@@ -6686,6 +6848,8 @@ function renderMarkdown(meta, events) {
         lines.push("");
         break;
       }
+      default:
+        break;
     }
   }
   return lines.join("\n");
@@ -6719,10 +6883,16 @@ function renderPlainText(meta, events) {
       case "error":
         lines.push(`[${e.ts}] ERROR (${e.phase}): ${e.message}`);
         break;
+      default:
+        break;
     }
   }
   return lines.join("\n");
 }
+
+// src/storage/annotations-store.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import * as fs7 from "node:fs/promises";
 var FILE_VERSION = 1;
 var MAX_TEXT_LENGTH = 2e3;
 var MAX_ANNOTATIONS = 1e3;
@@ -6730,12 +6900,14 @@ var AnnotationsStore = class {
   dir;
   events;
   traceId;
+  maxAnnotations;
   /** Per-session write queue. Created lazily on first add. */
   writeChains = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.dir = opts.dir;
     this.events = opts.events;
     this.traceId = opts.traceId;
+    this.maxAnnotations = opts.maxAnnotations ?? MAX_ANNOTATIONS;
   }
   // ── Reads ──────────────────────────────────────────────────────────────
   /**
@@ -6817,7 +6989,7 @@ var AnnotationsStore = class {
       });
     }
     const annotation = {
-      id: randomUUID(),
+      id: randomUUID3(),
       sessionId: input.sessionId,
       atEventIndex: input.atEventIndex,
       authorId: input.authorId,
@@ -6833,12 +7005,12 @@ var AnnotationsStore = class {
         await withFileLock(fp, async () => {
           const all = await this.list(input.sessionId);
           all.push(annotation);
-          if (all.length > MAX_ANNOTATIONS) {
+          if (all.length > this.maxAnnotations) {
             const sorted = all.map((a, i) => ({ a, i })).sort((x, y) => {
               if (x.a.resolved !== y.a.resolved) return x.a.resolved ? 1 : -1;
               return x.a.createdAt.localeCompare(y.a.createdAt);
             });
-            const evictCount = all.length - MAX_ANNOTATIONS;
+            const evictCount = all.length - this.maxAnnotations;
             const toEvict = new Set(sorted.slice(0, evictCount).map((s) => s.a.id));
             const kept = all.filter((a) => !toEvict.has(a.id));
             await this.writeFile(input.sessionId, { version: FILE_VERSION, annotations: kept });
@@ -6947,7 +7119,7 @@ var AnnotationsStore = class {
     const fp = this.filePath(sessionId);
     let raw;
     try {
-      raw = await fsp4.readFile(fp, "utf8");
+      raw = await fs7.readFile(fp, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err;
@@ -6982,6 +7154,13 @@ var AnnotationsStore = class {
     return next;
   }
 };
+
+// src/storage/replay-log-store.ts
+import * as fs8 from "node:fs/promises";
+import * as path15 from "node:path";
+
+// src/replay/hash.ts
+import { createHash as createHash5 } from "node:crypto";
 function stableStringify(value) {
   return JSON.stringify(sortKeys(value));
 }
@@ -7010,7 +7189,7 @@ function hashRequest(request) {
     toolChoice: request.toolChoice
   };
   const json = stableStringify(payload);
-  const digest = createHash("sha256").update(json, "utf8").digest("hex");
+  const digest = createHash5("sha256").update(json, "utf8").digest("hex");
   return `sha256:${digest}`;
 }
 
@@ -7022,6 +7201,7 @@ function storageErrorString2(err) {
   }
   return String(err);
 }
+var FILE_VERSION2 = 1;
 var DEFAULT_MAX_ENTRIES = 1e3;
 var ReplayLogStore = class {
   dir;
@@ -7066,12 +7246,12 @@ var ReplayLogStore = class {
             const line = JSON.stringify(entry) + "\n";
             let offset2 = 0;
             try {
-              const stat13 = await fsp4.stat(fp);
+              const stat13 = await fs8.stat(fp);
               offset2 = stat13.size;
             } catch (err) {
               if (err.code !== "ENOENT") throw err;
             }
-            await fsp4.appendFile(fp, line, "utf8");
+            await fs8.appendFile(fp, line, "utf8");
             cache.set(hash, { entry, offset: offset2, length: Buffer.byteLength(line, "utf8") });
             this.diskCount.set(input.sessionId, currentCount + 1);
             this.events?.emit("storage.write", {
@@ -7199,7 +7379,7 @@ var ReplayLogStore = class {
     const scan = async (dir, prefix, depth) => {
       let entries;
       try {
-        entries = await fsp4.readdir(dir, { withFileTypes: true });
+        entries = await fs8.readdir(dir, { withFileTypes: true });
       } catch (err) {
         if (depth === 0 && err.code !== "ENOENT") {
           console.warn(JSON.stringify({
@@ -7215,13 +7395,13 @@ var ReplayLogStore = class {
       for (const entry of entries) {
         if (entry.name.startsWith(".")) continue;
         if (entry.isDirectory()) {
-          if (depth === 0) await scan(path2.join(dir, entry.name), entry.name, depth + 1);
+          if (depth === 0) await scan(path15.join(dir, entry.name), entry.name, depth + 1);
           continue;
         }
         if (!entry.isFile() || !entry.name.endsWith(".replay.jsonl")) continue;
         const base = entry.name.slice(0, -".replay.jsonl".length);
         const sessionId = prefix ? `${prefix}/${base}` : base;
-        const fp = path2.join(dir, entry.name);
+        const fp = path15.join(dir, entry.name);
         out.push({
           sessionId,
           entryCount: await this.countEntries(fp),
@@ -7237,7 +7417,7 @@ var ReplayLogStore = class {
     return sessionScopedPath(this.dir, sessionId, ".replay.jsonl");
   }
   async countEntries(filePath) {
-    const handle = await fsp4.open(filePath, "r");
+    const handle = await fs8.open(filePath, "r");
     const buffer = Buffer.allocUnsafe(64 * 1024);
     let count = 0;
     let hasNonWhitespace2 = false;
@@ -7278,7 +7458,7 @@ var ReplayLogStore = class {
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
     try {
-      const raw = await fsp4.readFile(fp, "utf8");
+      const raw = await fs8.readFile(fp, "utf8");
       const out = [];
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
@@ -7306,6 +7486,7 @@ var ReplayLogStore = class {
       durationMs,
       ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
     });
+    void FILE_VERSION2;
   }
   async ensureCache(sessionId) {
     let cache = this.cache.get(sessionId);
@@ -7313,7 +7494,7 @@ var ReplayLogStore = class {
     const fp = this.filePath(sessionId);
     cache = /* @__PURE__ */ new Map();
     try {
-      const handle = await fsp4.open(fp, "r");
+      const handle = await fs8.open(fp, "r");
       const CHUNK = 64 * 1024;
       const buffer = Buffer.alloc(CHUNK);
       let leftover = "";
@@ -7364,7 +7545,7 @@ var ReplayLogStore = class {
   async hydrateEntry(sessionId, hash, location) {
     if (location.entry) return location.entry;
     const fp = this.filePath(sessionId);
-    const handle = await fsp4.open(fp, "r");
+    const handle = await fs8.open(fp, "r");
     try {
       const buffer = Buffer.alloc(location.length);
       const { bytesRead } = await handle.read(buffer, 0, location.length, location.offset);
@@ -7389,6 +7570,10 @@ var ReplayLogStore = class {
     return next;
   }
 };
+
+// src/storage/session-recovery.ts
+import * as fs9 from "node:fs/promises";
+import * as path16 from "node:path";
 var SessionRecovery = class {
   constructor(dir) {
     this.dir = dir;
@@ -7414,7 +7599,7 @@ var SessionRecovery = class {
     const fp = this.filePath(sessionId);
     let stat13;
     try {
-      stat13 = await fsp4.stat(fp);
+      stat13 = await fs9.stat(fp);
     } catch (err) {
       if (err.code === "ENOENT") return null;
       return null;
@@ -7448,7 +7633,7 @@ var SessionRecovery = class {
     const fp = this.filePath(sessionId);
     let raw;
     try {
-      raw = await fsp4.readFile(fp, "utf8");
+      raw = await fs9.readFile(fp, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       return null;
@@ -7493,7 +7678,7 @@ var SessionRecovery = class {
     const collect = async (dir, prefix, depth) => {
       let entries;
       try {
-        entries = await fsp4.readdir(dir, { withFileTypes: true });
+        entries = await fs9.readdir(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -7503,7 +7688,7 @@ var SessionRecovery = class {
           continue;
         if (entry.isDirectory()) {
           if (depth === 0) {
-            await collect(path2.join(dir, entry.name), entry.name, depth + 1);
+            await collect(path16.join(dir, entry.name), entry.name, depth + 1);
           }
           continue;
         }
@@ -7544,7 +7729,7 @@ function hasNonWhitespace(line) {
 }
 async function scanLatestLifecycleBoundary(filePath, size) {
   const CHUNK_SIZE = 64 * 1024;
-  const handle = await fsp4.open(filePath, "r");
+  const handle = await fs9.open(filePath, "r");
   let position = size;
   let laterLineFragment = Buffer.alloc(0);
   let latestBoundary = null;
@@ -7580,6 +7765,10 @@ async function scanLatestLifecycleBoundary(filePath, size) {
     await handle.close();
   }
 }
+
+// src/storage/tool-audit-log.ts
+import { createHash as createHash6, randomUUID as randomUUID4 } from "node:crypto";
+import * as fs10 from "node:fs/promises";
 var GENESIS_PREV = "0".repeat(64);
 var DEFAULT_FSYNC_EVERY = 100;
 var ToolAuditLog = class {
@@ -7623,7 +7812,7 @@ var ToolAuditLog = class {
           const tip = await this._resolveChainTip(input.sessionId, fp);
           const prevHash = tip.prevHash;
           const index = tip.nextIndex;
-          const id = randomUUID();
+          const id = randomUUID4();
           const ts = (/* @__PURE__ */ new Date()).toISOString();
           const content = {
             id,
@@ -7636,7 +7825,7 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          const hash = createHash("sha256").update(stableStringify2(content), "utf8").digest("hex");
+          const hash = createHash6("sha256").update(stableStringify2(content), "utf8").digest("hex");
           entry = {
             id,
             ts,
@@ -7649,9 +7838,9 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          await fsp4.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
+          await fs10.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
           try {
-            const st = await fsp4.stat(fp);
+            const st = await fs10.stat(fp);
             this.tailStat.set(input.sessionId, { mtimeMs: st.mtimeMs, size: st.size });
           } catch {
           }
@@ -7698,7 +7887,7 @@ var ToolAuditLog = class {
     const cachedStat = this.tailStat.get(sessionId);
     if (cachedHash !== void 0 && cachedIndex !== void 0 && cachedStat) {
       try {
-        const st = await fsp4.stat(fp);
+        const st = await fs10.stat(fp);
         if (st.mtimeMs === cachedStat.mtimeMs && st.size === cachedStat.size) {
           return { prevHash: cachedHash, nextIndex: cachedIndex };
         }
@@ -7719,7 +7908,7 @@ var ToolAuditLog = class {
     this.tailHash.set(sessionId, prevHash);
     this.tailIndex.set(sessionId, nextIndex);
     try {
-      const st = await fsp4.stat(fp);
+      const st = await fs10.stat(fp);
       this.tailStat.set(sessionId, { mtimeMs: st.mtimeMs, size: st.size });
     } catch {
     }
@@ -7778,7 +7967,7 @@ var ToolAuditLog = class {
           isError: e.isError,
           index: e.index
         };
-        const expectedHash = createHash("sha256").update(stableStringify2(content), "utf8").digest("hex");
+        const expectedHash = createHash6("sha256").update(stableStringify2(content), "utf8").digest("hex");
         if (expectedHash !== e.hash) {
           return {
             ok: false,
@@ -7840,7 +8029,7 @@ var ToolAuditLog = class {
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
     try {
-      const raw = await fsp4.readFile(fp, "utf8");
+      const raw = await fs10.readFile(fp, "utf8");
       const out = [];
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
@@ -7878,7 +8067,7 @@ var ToolAuditLog = class {
   }
   async sync(sessionId, fp) {
     try {
-      const fh = await fsp4.open(fp, "r+");
+      const fh = await fs10.open(fp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -8014,10 +8203,16 @@ var SessionAnalyzer = class {
     return last - first;
   }
 };
+
+// src/session-registry.ts
+import * as fs11 from "node:fs/promises";
+import * as path17 from "node:path";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var REGISTRY_FILE = "session-registry.json";
 var HEARTBEAT_INTERVAL_MS = 5e3;
 var STALE_TIMEOUT_MS = 3e4;
 var CLOSING_GRACE_MS = 15e3;
+var LOST_GRACE_MS = 3e5;
 var STALE_LOCK_MS = 1e4;
 var STALE_TMP_MS = 6e4;
 var MAX_STALE_TMP_FILES = 20;
@@ -8029,6 +8224,16 @@ function pidAlive(pid) {
     return false;
   }
 }
+function parseRegistry(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
 var SessionRegistry = class {
   filePath;
   heartbeatTimer = null;
@@ -8040,7 +8245,7 @@ var SessionRegistry = class {
    */
   lastEntry = null;
   constructor(globalRoot) {
-    this.filePath = path2.join(globalRoot, REGISTRY_FILE);
+    this.filePath = path17.join(globalRoot, REGISTRY_FILE);
   }
   // ── Public API ──────────────────────────────────────────────────────────
   /**
@@ -8196,8 +8401,8 @@ var SessionRegistry = class {
   }
   async readAndPrune() {
     try {
-      const raw = await fsp4.readFile(this.filePath, "utf8");
-      const registry = JSON.parse(raw);
+      const raw = await fs11.readFile(this.filePath, "utf8");
+      const registry = parseRegistry(raw);
       const now = Date.now();
       let pruned = false;
       for (const [id, entry] of Object.entries(registry)) {
@@ -8207,12 +8412,24 @@ var SessionRegistry = class {
           pruned = true;
           continue;
         }
-        if (heartbeatAge > STALE_TIMEOUT_MS && !pidAlive(entry.pid)) {
-          entry.status = "stale";
-          const startedAge = now - new Date(entry.startedAt).getTime();
-          if (startedAge > 5 * 6e4) {
-            delete registry[id];
-            pruned = true;
+        if (heartbeatAge > STALE_TIMEOUT_MS) {
+          const alive = pidAlive(entry.pid);
+          if (alive) {
+            if (entry.status !== "lost" && entry.status !== "closing" && entry.status !== "stale") {
+              entry.status = "lost";
+              pruned = true;
+            }
+            if (entry.status === "lost" && heartbeatAge > STALE_TIMEOUT_MS + LOST_GRACE_MS) {
+              delete registry[id];
+              pruned = true;
+            }
+          } else {
+            entry.status = "stale";
+            const startedAge = now - new Date(entry.startedAt).getTime();
+            if (startedAge > 5 * 6e4) {
+              delete registry[id];
+              pruned = true;
+            }
           }
         }
       }
@@ -8230,11 +8447,11 @@ var SessionRegistry = class {
     const retryDelayMs = 20;
     for (let attempt = 0; attempt < maxRetries; attempt++) {
       try {
-        await fsp4.mkdir(path2.dirname(this.filePath), { recursive: true });
-        let lockHandle = await fsp4.open(lockPath, "wx").catch(() => null);
+        await fs11.mkdir(path17.dirname(this.filePath), { recursive: true });
+        let lockHandle = await fs11.open(lockPath, "wx").catch(() => null);
         if (!lockHandle) {
           if (await this.breakStaleLock(lockPath)) {
-            lockHandle = await fsp4.open(lockPath, "wx").catch(() => null);
+            lockHandle = await fs11.open(lockPath, "wx").catch(() => null);
           }
           if (!lockHandle) {
             await new Promise((r) => setTimeout(r, retryDelayMs * (attempt + 1)));
@@ -8243,14 +8460,14 @@ var SessionRegistry = class {
         }
         try {
           await lockHandle.writeFile(String(process.pid)).catch(() => void 0);
-          const raw = await fsp4.readFile(this.filePath, "utf8").catch(() => "{}");
-          const registry = JSON.parse(raw);
+          const raw = await fs11.readFile(this.filePath, "utf8").catch(() => "{}");
+          const registry = parseRegistry(raw);
           fn(registry);
           await this.writeAtomicLocked(registry);
           return;
         } finally {
           await lockHandle.close();
-          await fsp4.unlink(lockPath).catch(() => void 0);
+          await fs11.unlink(lockPath).catch(() => void 0);
         }
       } catch {
         return;
@@ -8267,16 +8484,16 @@ var SessionRegistry = class {
   async breakStaleLock(lockPath) {
     try {
       const [stat13, content] = await Promise.all([
-        fsp4.stat(lockPath),
+        fs11.stat(lockPath),
         /* v8 ignore start -- best-effort lock-content read; .catch only fires if the lock vanished */
-        fsp4.readFile(lockPath, "utf8").catch(() => "")
+        fs11.readFile(lockPath, "utf8").catch(() => "")
         /* v8 ignore stop */
       ]);
       const ageMs = Date.now() - stat13.mtimeMs;
       const ownerPid = Number.parseInt(content.trim(), 10);
       const ownerDead = Number.isInteger(ownerPid) && ownerPid > 0 && ownerPid !== process.pid && !pidAlive(ownerPid);
       if (ownerDead || ageMs > STALE_LOCK_MS) {
-        await fsp4.unlink(lockPath).catch(() => void 0);
+        await fs11.unlink(lockPath).catch(() => void 0);
         return true;
       }
       return false;
@@ -8294,35 +8511,41 @@ var SessionRegistry = class {
     await this.writeAtomicFile(registry);
   }
   async writeAtomicFile(registry) {
-    const tmp = path2.join(
-      path2.dirname(this.filePath),
-      `.${path2.basename(this.filePath)}.${randomUUID().slice(0, 8)}.tmp`
+    const tmp = path17.join(
+      path17.dirname(this.filePath),
+      `.${path17.basename(this.filePath)}.${randomUUID5().slice(0, 8)}.tmp`
     );
     try {
-      await fsp4.writeFile(tmp, JSON.stringify(registry, null, 2), "utf8");
-      await fsp4.rename(tmp, this.filePath);
+      const handle = await fs11.open(tmp, "w");
+      try {
+        await handle.writeFile(JSON.stringify(registry, null, 2), "utf8");
+        await handle.sync().catch(() => void 0);
+      } finally {
+        await handle.close();
+      }
+      await fs11.rename(tmp, this.filePath);
     } catch (err) {
-      await fsp4.unlink(tmp).catch(() => void 0);
+      await fs11.unlink(tmp).catch(() => void 0);
       throw err;
     }
   }
   async pruneStaleTempFiles() {
     try {
-      const dir = path2.dirname(this.filePath);
-      const base = path2.basename(this.filePath);
+      const dir = path17.dirname(this.filePath);
+      const base = path17.basename(this.filePath);
       const now = Date.now();
       const stale = [];
-      for (const name of await fsp4.readdir(dir)) {
+      for (const name of await fs11.readdir(dir)) {
         const isTemp = (name.startsWith(`${base}.`) || name.startsWith(`.${base}.`)) && name.endsWith(".tmp");
         if (!isTemp) continue;
-        const stat13 = await fsp4.stat(path2.join(dir, name)).catch(() => null);
+        const stat13 = await fs11.stat(path17.join(dir, name)).catch(() => null);
         if (!stat13) continue;
         if (now - stat13.mtimeMs > STALE_TMP_MS) stale.push({ name, mtimeMs: stat13.mtimeMs });
       }
       stale.sort((a, b) => b.mtimeMs - a.mtimeMs);
       await Promise.all(
         stale.slice(MAX_STALE_TMP_FILES).map(async ({ name }) => {
-          await fsp4.unlink(path2.join(dir, name)).catch(() => void 0);
+          await fs11.unlink(path17.join(dir, name)).catch(() => void 0);
         })
       );
     } catch {
@@ -8617,6 +8840,13 @@ var AgentStatusTracker = class {
         if (this.agents.delete(p.subagentId)) this.flush();
       })
     );
+    this.unsubscribers.push(
+      on("subagent.removed", (_e, payload) => {
+        const p = payload;
+        if (!p?.subagentId) return;
+        if (this.agents.delete(p.subagentId)) this.flush();
+      })
+    );
     this.sweepTimer = setInterval(() => this.sweep(), AGENT_SWEEP_INTERVAL_MS);
     if (typeof this.sweepTimer.unref === "function") this.sweepTimer.unref();
   }
@@ -8729,6 +8959,10 @@ var AgentStatusTracker = class {
     }
   }
 };
+
+// src/fleet-notifier.ts
+import * as fs12 from "node:fs/promises";
+import * as path18 from "node:path";
 var INSTANCES_FILE = "webui-instances.json";
 var DISCOVERY_TTL_MS = 2500;
 var COALESCE_MS = 50;
@@ -8743,7 +8977,7 @@ function pidAlive2(pid) {
   }
 }
 function normRoot(root) {
-  const resolved = path2.resolve(root);
+  const resolved = path18.resolve(root);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 var FleetNotifier = class {
@@ -8790,7 +9024,7 @@ var FleetNotifier = class {
   }
   async discover() {
     try {
-      const raw = await fsp4.readFile(path2.join(this.baseDir, INSTANCES_FILE), "utf8");
+      const raw = await fs12.readFile(path18.join(this.baseDir, INSTANCES_FILE), "utf8");
       const data = JSON.parse(raw);
       const list = Array.isArray(data?.instances) ? data.instances : [];
       return list.filter((i) => i && typeof i.httpPort === "number").filter((i) => i.pid !== this.selfPid).filter((i) => normRoot(i.projectRoot) === this.projectRoot).filter((i) => pidAlive2(i.pid)).map((i) => {
@@ -8808,6 +9042,10 @@ async function defaultPost(url) {
     signal: AbortSignal.timeout(POST_TIMEOUT_MS)
   });
 }
+
+// src/storage/session-rewinder.ts
+import * as fsp8 from "node:fs/promises";
+import * as path19 from "node:path";
 var DefaultSessionRewinder = class {
   constructor(sessionsDir, projectRoot) {
     this.sessionsDir = sessionsDir;
@@ -8820,7 +9058,7 @@ var DefaultSessionRewinder = class {
   }
   async listCheckpoints(sessionId) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     const fileCountMap = /* @__PURE__ */ new Map();
     for (const event of events) {
@@ -8845,7 +9083,7 @@ var DefaultSessionRewinder = class {
   }
   async rewindToCheckpoint(sessionId, checkpointIndex) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     let targetIdx = -1;
     for (let i = 0; i < events.length; i++) {
@@ -8884,7 +9122,7 @@ var DefaultSessionRewinder = class {
   }
   async rewindLastN(sessionId, n) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     const checkpoints = [];
     for (const event of events) {
@@ -8913,7 +9151,7 @@ var DefaultSessionRewinder = class {
   }
   async rewindToStart(sessionId) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     const allSnapshots = [];
     for (const event of events) {
@@ -8948,10 +9186,10 @@ async function revertSnapshots(snapshots, projectRoot) {
   for (const snapshot of [...snapshots].reverse()) {
     for (const file of [...snapshot.files].reverse()) {
       try {
-        const absPath = path2.resolve(file.path);
-        const root = path2.resolve(projectRoot);
-        const rel = path2.relative(root, absPath);
-        if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+        const absPath = path19.resolve(file.path);
+        const root = path19.resolve(projectRoot);
+        const rel = path19.relative(root, absPath);
+        if (rel.startsWith("..") || path19.isAbsolute(rel)) {
           errors.push(`${file.path}: path resolves outside project root \u2014 skipping`);
           continue;
         }
@@ -8961,7 +9199,7 @@ async function revertSnapshots(snapshots, projectRoot) {
             revertedFiles.push(file.path);
           }
         } else if (file.action === "created") {
-          await fsp4.unlink(file.path);
+          await fsp8.unlink(file.path);
           revertedFiles.push(file.path);
         } else if (file.action === "modified") {
           if (file.before !== null) {
@@ -8976,11 +9214,14 @@ async function revertSnapshots(snapshots, projectRoot) {
   }
   return { revertedFiles, errors };
 }
+
+// src/storage/todos-checkpoint.ts
+import * as fsp9 from "node:fs/promises";
 async function loadTodosCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp9.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -9115,11 +9356,14 @@ function attachTodosCheckpoint(state, filePath, sessionId, events, traceId) {
     }
   };
 }
+
+// src/storage/completed-work-checkpoint.ts
+import * as fsp10 from "node:fs/promises";
 async function loadCompletedWorkCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp10.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -9213,11 +9457,15 @@ function isCompletedWorkEvidence(value) {
   const item = value;
   return typeof item.key === "string" && typeof item.source === "string" && ["todo", "plan", "task", "verification", "manual"].includes(item.source) && typeof item.summary === "string" && typeof item.completedAt === "number" && (item.evidence === void 0 || typeof item.evidence === "string");
 }
+
+// src/storage/plan-store.ts
+import * as fsp11 from "node:fs/promises";
+import { randomUUID as randomUUID6 } from "node:crypto";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp11.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: "~boot~",
@@ -9306,7 +9554,7 @@ function emptyPlan(sessionId, title) {
 function addPlanItem(plan, title, details) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const item = {
-    id: `plan_${Date.now()}_${randomUUID().slice(0, 6)}`,
+    id: `plan_${Date.now()}_${randomUUID6().slice(0, 6)}`,
     title,
     details,
     status: "open",
@@ -9380,7 +9628,7 @@ function deriveTodosFromPlanItem(plan, idOrIndex, subtasks) {
   if (subtasks && subtasks.length > 0) {
     for (const st of subtasks) {
       todos.push({
-        id: `todo_${Date.now()}_${randomUUID().slice(0, 6)}`,
+        id: `todo_${Date.now()}_${randomUUID6().slice(0, 6)}`,
         content: st,
         status: "pending",
         promotedFromPlan: item.id
@@ -9521,6 +9769,9 @@ ${cat}:`);
   }
   return lines.join("\n");
 }
+
+// src/storage/task-store.ts
+import * as fsp12 from "node:fs/promises";
 function emptyTaskFile(sessionId) {
   return {
     version: 1,
@@ -9533,7 +9784,7 @@ async function loadTasks(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp12.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -9634,10 +9885,14 @@ async function mutateTasks(filePath, sessionId, fn, events, traceId) {
     return updated;
   });
 }
+
+// src/storage/director-state.ts
+import * as fsp13 from "node:fs/promises";
+import { hostname as hostname2 } from "node:os";
 async function loadDirectorState(filePath) {
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp13.readFile(filePath, "utf8");
   } catch {
     return null;
   }
@@ -9652,7 +9907,7 @@ async function loadDirectorState(filePath) {
 async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   let existing;
   try {
-    existing = await fsp4.readFile(lockPath, "utf8");
+    existing = await fsp13.readFile(lockPath, "utf8");
   } catch {
   }
   if (existing) {
@@ -9668,7 +9923,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   }
   const lock = {
     pid: processId,
-    hostname: hostname(),
+    hostname: hostname2(),
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await atomicWrite(lockPath, JSON.stringify(lock), { mode: 384 });
@@ -9676,7 +9931,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
 }
 async function releaseDirectorStateLock(lockPath) {
   try {
-    await fsp4.unlink(lockPath);
+    await fsp13.unlink(lockPath);
   } catch {
   }
 }
@@ -9831,6 +10086,9 @@ var DirectorStateCheckpoint = class {
     }
   }
 };
+
+// src/storage/goal-store.ts
+import * as fsp14 from "node:fs/promises";
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
   return resolveWstackPaths({ projectRoot }).projectGoal;
@@ -9839,7 +10097,7 @@ async function loadGoal(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp14.readFile(filePath, "utf8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -10083,9 +10341,14 @@ function computeTrend(history) {
   if (avgDelta < -1) return "stalling";
   return "steady";
 }
+
+// src/storage/prompt-store.ts
+import { createHash as createHash7 } from "node:crypto";
+import * as fs13 from "node:fs/promises";
+import * as path20 from "node:path";
 var SCHEMA_VERSION = 2;
 function promptChecksum(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
+  return createHash7("sha256").update(content, "utf8").digest("hex");
 }
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -10146,12 +10409,12 @@ var DefaultPromptStore = class {
     await ensureDir(this.dir);
     const entries = [];
     try {
-      const files = await fsp4.readdir(this.dir);
+      const files = await fs13.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp4.readFile(path2.join(this.dir, file), "utf8")
+            await fs13.readFile(path20.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -10165,9 +10428,9 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path2.join(this.dir, `${id}.json`);
+    const file = path20.join(this.dir, `${id}.json`);
     try {
-      const raw = JSON.parse(await fsp4.readFile(file, "utf8"));
+      const raw = JSON.parse(await fs13.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
     } catch {
       return null;
@@ -10175,14 +10438,14 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path2.join(this.dir, `${entry.id}.json`);
+    const file = path20.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path2.join(this.dir, `${id}.json`);
+    const file = path20.join(this.dir, `${id}.json`);
     try {
-      await fsp4.unlink(file);
+      await fs13.unlink(file);
       return true;
     } catch {
       return false;
@@ -10219,6 +10482,10 @@ var DefaultPromptStore = class {
     };
   }
 };
+
+// src/storage/prompt-usage-store.ts
+import * as fs14 from "node:fs/promises";
+import * as path21 from "node:path";
 var PromptUsageStore = class {
   constructor(file) {
     this.file = file;
@@ -10226,7 +10493,7 @@ var PromptUsageStore = class {
   file;
   async load() {
     try {
-      const raw = JSON.parse(await fsp4.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs14.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && raw.usage && typeof raw.usage === "object") {
         return raw.usage;
       }
@@ -10239,7 +10506,7 @@ var PromptUsageStore = class {
     const prev = usage[slug];
     const next = { count: (prev?.count ?? 0) + 1, lastUsedAt: at };
     usage[slug] = next;
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path21.dirname(this.file));
     await atomicWrite(this.file, JSON.stringify({ version: 1, usage }, null, 2));
     return next;
   }
@@ -10261,6 +10528,10 @@ var PromptUsageStore = class {
     ).slice(0, limit);
   }
 };
+
+// src/storage/input-history-store.ts
+import * as fs15 from "node:fs/promises";
+import * as path22 from "node:path";
 var INPUT_HISTORY_DEFAULT_MAX = 100;
 var InputHistoryStore = class {
   /**
@@ -10282,7 +10553,7 @@ var InputHistoryStore = class {
    */
   async load() {
     try {
-      const raw = JSON.parse(await fsp4.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs15.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && Array.isArray(raw.entries) && raw.entries.every((e) => typeof e === "string")) {
         return raw.entries.slice(0, this.maxEntries);
       }
@@ -10299,7 +10570,7 @@ var InputHistoryStore = class {
    */
   async save(entries) {
     const cleaned = this.scrubAndFilter(entries);
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path22.dirname(this.file));
     const payload = {
       version: 1,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -10309,7 +10580,7 @@ var InputHistoryStore = class {
   }
   /** Truncate the file to an empty entry list (used by /clear). */
   async clear() {
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path22.dirname(this.file));
     const payload = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: [] };
     await atomicWrite(this.file, JSON.stringify(payload, null, 2));
   }
@@ -10337,13 +10608,18 @@ var InputHistoryStore = class {
     return text.includes("***REDACTED***");
   }
 };
+
+// src/storage/cloud-sync.ts
+import * as fs16 from "node:fs/promises";
+import * as path23 from "node:path";
+import { createHash as createHash8 } from "node:crypto";
 var ALL_SYNC_CATEGORIES = ["settings", "skills", "prompts", "memory", "history"];
 var CloudSync = class {
   constructor(paths, getConfig, setConfig) {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path2.join(paths.globalRoot, "sync-state.json");
+    this.statePath = path23.join(paths.globalRoot, "sync-state.json");
   }
   paths;
   getConfig;
@@ -10418,7 +10694,7 @@ var CloudSync = class {
       lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
       localRev: rev
     };
-    await fsp4.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
+    await fs16.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
     this.state = syncState;
     return {
       ok: true,
@@ -10450,8 +10726,8 @@ var CloudSync = class {
       const rel = segments.slice(2).join("/");
       const destPath = resolvePulledCategoryPath(cat, localPath, rel, entry.path);
       const blobData = await this.getBlob(token, owner, repoName, entry.sha);
-      await fsp4.mkdir(path2.dirname(destPath), { recursive: true });
-      await fsp4.writeFile(destPath, Buffer.from(blobData, "base64"));
+      await fs16.mkdir(path23.dirname(destPath), { recursive: true });
+      await fs16.writeFile(destPath, Buffer.from(blobData, "base64"));
     }
     const localRev = await this.hashLocalCategories(cfg.categories);
     const syncState = {
@@ -10460,7 +10736,7 @@ var CloudSync = class {
       lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
       localRev
     };
-    await fsp4.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
+    await fs16.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
     this.state = syncState;
     return {
       ok: true,
@@ -10479,7 +10755,7 @@ var CloudSync = class {
   }
   async loadState() {
     try {
-      const raw = await fsp4.readFile(this.statePath, "utf8");
+      const raw = await fs16.readFile(this.statePath, "utf8");
       this.state = JSON.parse(raw);
     } catch {
       this.state = null;
@@ -10557,24 +10833,24 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat13 = await fsp4.stat(localPath);
+        const stat13 = await fs16.stat(localPath);
         if (stat13.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fsp4.readFile(file, "utf8");
-            const rel = path2.relative(localPath, file).replace(/\\/g, "/");
+            const content = await fs16.readFile(file, "utf8");
+            const rel = path23.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(content);
           }
         } else {
-          const content = await fsp4.readFile(localPath, "utf8");
+          const content = await fs16.readFile(localPath, "utf8");
           entries.push({ path: `data/${cat}`, content, mode: "100644" });
           hashes.push(content);
         }
       } catch {
       }
     }
-    const rev = createHash("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
+    const rev = createHash8("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
     return { treeEntries: entries, rev };
   }
   async hashLocalCategories(categories) {
@@ -10583,21 +10859,21 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat13 = await fsp4.stat(localPath);
+        const stat13 = await fs16.stat(localPath);
         if (stat13.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fsp4.readFile(file);
+            const content = await fs16.readFile(file);
             hashes.push(content.toString("base64") + file);
           }
         } else {
-          const content = await fsp4.readFile(localPath);
+          const content = await fs16.readFile(localPath);
           hashes.push(content.toString("base64") + localPath);
         }
       } catch {
       }
     }
-    return createHash("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
+    return createHash8("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
   }
   categoryToPath(cat) {
     switch (cat) {
@@ -10618,9 +10894,9 @@ var CloudSync = class {
   }
   async walkDir(dir, base) {
     const results = [];
-    const entries = await fsp4.readdir(dir, { withFileTypes: true });
+    const entries = await fs16.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path2.join(dir, entry.name);
+      const full = path23.join(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
       } else {
@@ -10642,9 +10918,9 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
     return localPath;
   }
   if (!rel) return localPath;
-  const normalizedRel = path2.normalize(rel);
-  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path2.sep}`);
-  if (path2.isAbsolute(normalizedRel) || traversesUp) {
+  const normalizedRel = path23.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path23.sep}`);
+  if (path23.isAbsolute(normalizedRel) || traversesUp) {
     throw new FsError({
       message: `Refusing CloudSync path traversal: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -10652,10 +10928,10 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
       context: { reason: "path_traversal", normalizedRel }
     });
   }
-  const dest = path2.resolve(localPath, normalizedRel);
-  const root = path2.resolve(localPath);
-  const relative6 = path2.relative(root, dest);
-  if (relative6.startsWith("..") || path2.isAbsolute(relative6)) {
+  const dest = path23.resolve(localPath, normalizedRel);
+  const root = path23.resolve(localPath);
+  const relative6 = path23.relative(root, dest);
+  if (relative6.startsWith("..") || path23.isAbsolute(relative6)) {
     throw new FsError({
       message: `Refusing CloudSync path outside category root: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -10794,7 +11070,86 @@ function resolveSessionLoggingConfig(cfg) {
     }
   };
 }
-
-export { ALL_SYNC_CATEGORIES, AgentStatusTracker, AnnotationsStore, CORE_RECONSTRUCT_EVENTS, CloudSync, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultMemoryStore, DefaultPromptStore, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DirectorStateCheckpoint, FileMemoryBackend, FleetNotifier, GraphMemoryBackend, INPUT_HISTORY_DEFAULT_MAX, InputHistoryStore, MAX_JOURNAL_ENTRIES, MAX_PROGRESS_HISTORY, PromptUsageStore, QueueStore, RecoveryLock, ReplayLogStore, STANDARD_AUDIT_EVENTS, SessionAnalyzer, SessionCheckpointCas, SessionMemoryConsolidator, SessionRecovery, SessionRegistry, ToolAuditLog, addPlanItem, appendJournal, attachPlanCheckpoint, attachTodosCheckpoint, clearPlan, createSessionEventBridge, deriveTodosFromPlanItem, emptyGoal, emptyPlan, emptyTaskFile, formatGoal, formatPlan, formatPlanTemplates, generateSessionId, getPlanTemplate, getSessionRegistry, goalFilePath, hasSessionRegistry, listPlanTemplates, loadCompletedWorkCheckpoint, loadDirectorState, loadGoal, loadPlan, loadTasks, loadTodosCheckpoint, migratePromptEntry, mutatePlan, mutateTasks, parseEntries, parseProgressFromText, promptChecksum, recordProgress, removePlanItem, resolveAuditLevel, resolveSessionLoggingConfig, runConfigMigrations, sanitizeModel, saveCompletedWorkCheckpoint, saveGoal, savePlan, saveTasks, saveTodosCheckpoint, setPlanItemStatus, setProgress, summarizeUsage, watchProviderConfig };
+export {
+  ALL_SYNC_CATEGORIES,
+  AgentStatusTracker,
+  AnnotationsStore,
+  CORE_RECONSTRUCT_EVENTS,
+  CloudSync,
+  ConfigMigrationError,
+  DEFAULT_CONFIG_MIGRATIONS,
+  DefaultAttachmentStore,
+  DefaultConfigLoader,
+  DefaultConfigStore,
+  DefaultMemoryStore,
+  DefaultPromptStore,
+  DefaultSessionReader,
+  DefaultSessionRewinder,
+  DefaultSessionStore,
+  DirectorStateCheckpoint,
+  FileMemoryBackend,
+  FleetNotifier,
+  GraphMemoryBackend,
+  INPUT_HISTORY_DEFAULT_MAX,
+  InputHistoryStore,
+  MAX_JOURNAL_ENTRIES,
+  MAX_PROGRESS_HISTORY,
+  PromptUsageStore,
+  QueueStore,
+  RecoveryLock,
+  ReplayLogStore,
+  STANDARD_AUDIT_EVENTS,
+  SessionAnalyzer,
+  SessionCheckpointCas,
+  SessionMemoryConsolidator,
+  SessionRecovery,
+  SessionRegistry,
+  ToolAuditLog,
+  addPlanItem,
+  appendJournal,
+  attachPlanCheckpoint,
+  attachTodosCheckpoint,
+  clearPlan,
+  createSessionEventBridge,
+  deriveTodosFromPlanItem,
+  emptyGoal,
+  emptyPlan,
+  emptyTaskFile,
+  formatGoal,
+  formatPlan,
+  formatPlanTemplates,
+  generateSessionId,
+  getPlanTemplate,
+  getSessionRegistry,
+  goalFilePath,
+  hasSessionRegistry,
+  listPlanTemplates,
+  loadCompletedWorkCheckpoint,
+  loadDirectorState,
+  loadGoal,
+  loadPlan,
+  loadTasks,
+  loadTodosCheckpoint,
+  migratePromptEntry,
+  mutatePlan,
+  mutateTasks,
+  parseEntries,
+  parseProgressFromText,
+  promptChecksum,
+  recordProgress,
+  removePlanItem,
+  resolveAuditLevel,
+  resolveSessionLoggingConfig,
+  runConfigMigrations,
+  sanitizeModel,
+  saveCompletedWorkCheckpoint,
+  saveGoal,
+  savePlan,
+  saveTasks,
+  saveTodosCheckpoint,
+  setPlanItemStatus,
+  setProgress,
+  summarizeUsage,
+  watchProviderConfig
+};
 //# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map