@wrongstack/core 0.284.1 → 0.286.0

package/dist/storage/index.js

@@ -1,15 +1,14 @@
-import { randomUUID, createHash, randomBytes } from 'crypto';
-import * as syncFs from 'fs';
-import { createReadStream, openSync, writeSync, fsyncSync, closeSync, readFileSync, statSync } from 'fs';
-import * as fsp4 from 'fs/promises';
-import * as path2 from 'path';
-import { createInterface } from 'readline';
-import * as os from 'os';
-import { hostname } from 'os';
-import { spawn } from 'child_process';
-import { fileURLToPath } from 'url';
-
 // src/storage/session-store.ts
+import { createHash as createHash4 } from "node:crypto";
+import { createReadStream } from "node:fs";
+import * as fsp4 from "node:fs/promises";
+import * as path7 from "node:path";
+import { createInterface } from "node:readline";
+
+// src/utils/atomic-write.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path3 from "node:path";
 
 // src/utils/child-env.ts
 var ALLOWED_KEYS = /* @__PURE__ */ new Set([
@@ -85,8 +84,9 @@ function sanitizeNodeOptions(value) {
   }
   return kept.join(" ");
 }
+var gitIdentity = null;
 function buildChildEnv(optsOrSessionId) {
-  const opts = {};
+  const opts = typeof optsOrSessionId === "string" ? { sessionId: optsOrSessionId } : optsOrSessionId ?? {};
   const hasOwn = Object.hasOwn(process.env, "WRONGSTACK_CHILD_ENV_PASSTHROUGH");
   const legacyHasOwn = Object.hasOwn(process.env, "WRONGSTACK_BASH_ENV_PASSTHROUGH");
   const passthrough = hasOwn && process.env["WRONGSTACK_CHILD_ENV_PASSTHROUGH"] === "1" || legacyHasOwn && process.env["WRONGSTACK_BASH_ENV_PASSTHROUGH"] === "1";
@@ -124,6 +124,16 @@ function buildChildEnv(optsOrSessionId) {
       out[k] = v;
     }
   }
+  if (gitIdentity) {
+    if (gitIdentity.name) {
+      out["GIT_AUTHOR_NAME"] = gitIdentity.name;
+      out["GIT_COMMITTER_NAME"] = gitIdentity.name;
+    }
+    if (gitIdentity.email) {
+      out["GIT_AUTHOR_EMAIL"] = gitIdentity.email;
+      out["GIT_COMMITTER_EMAIL"] = gitIdentity.email;
+    }
+  }
   if (opts.extra) {
     Object.assign(out, opts.extra);
   }
@@ -236,7 +246,7 @@ function toErrorMessage(err) {
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
+    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
     err.name = "ExpectDefinedError";
     throw err;
   }
@@ -385,13 +395,16 @@ function safeParse(input, maxBytes = 5e6) {
     };
   }
 }
+
+// src/utils/session-scoped-path.ts
+import * as path from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path2.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path2.relative(path2.resolve(dir), resolved);
-  if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+  const resolved = path.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path.relative(path.resolve(dir), resolved);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -409,6 +422,9 @@ function invalid(sessionId) {
 function slugify(name, fallback = "prompt", maxLen = 64) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLen).replace(/-+$/g, "") || fallback;
 }
+
+// src/utils/ulid.ts
+import { randomBytes } from "node:crypto";
 var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var ENCODING_LEN = ENCODING.length;
 var TIME_LEN = 10;
@@ -434,6 +450,11 @@ function encodeRandom(len) {
 function ulid(seedTime = Date.now()) {
   return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN);
 }
+
+// src/utils/wstack-paths.ts
+import { createHash } from "node:crypto";
+import * as os from "node:os";
+import * as path2 from "node:path";
 function projectHash(absRoot) {
   return createHash("sha256").update(path2.resolve(absRoot)).digest("hex").slice(0, 12);
 }
@@ -507,18 +528,59 @@ function resolveWstackPaths(opts) {
 
 // src/types/errors.ts
 var ERROR_CODES = {
+  // Provider
+  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+  // Tool
+  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+  TOOL_TIMEOUT: "TOOL_TIMEOUT",
+  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
   // Config
   CONFIG_INVALID: "CONFIG_INVALID",
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+  // Plugin
+  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+  // Agent
+  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+  AGENT_ABORTED: "AGENT_ABORTED",
+  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
   // Session
   SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
   SESSION_CORRUPTED: "SESSION_CORRUPTED",
   SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+  // Container / Registry
+  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
   // File system
   FS_READ_FAILED: "FS_READ_FAILED",
+  FS_WRITE_FAILED: "FS_WRITE_FAILED",
+  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
   FS_DELETE_FAILED: "FS_DELETE_FAILED",
   FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+  // SDD (Spec-Driven Development)
+  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+  SDD_INVALID_STATE: "SDD_INVALID_STATE",
+  SDD_NOT_READY: "SDD_NOT_READY",
   // General
   VALIDATION_ERROR: "VALIDATION_ERROR",
+  PARSE_FAILED: "PARSE_FAILED",
   UNKNOWN: "UNKNOWN"
 };
 var WrongStackError = class extends Error {
@@ -598,17 +660,17 @@ var FsError = class extends WrongStackError {
 
 // src/utils/atomic-write.ts
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path2.dirname(targetPath);
-  await fsp4.mkdir(dir, { recursive: true });
-  const tmp = path2.join(dir, `.${path2.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const dir = path3.dirname(targetPath);
+  await fs.mkdir(dir, { recursive: true });
+  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes2(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
-      await fsp4.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+      await fs.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
     } else {
-      await fsp4.writeFile(tmp, content, { flag: "wx" });
+      await fs.writeFile(tmp, content, { flag: "wx" });
     }
     try {
-      const fh = await fsp4.open(tmp, "r+");
+      const fh = await fs.open(tmp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -618,56 +680,56 @@ async function atomicWrite(targetPath, content, opts = {}) {
     }
     let mode;
     try {
-      const stat13 = await fsp4.stat(targetPath);
+      const stat13 = await fs.stat(targetPath);
       mode = stat13.mode & 511;
     } catch {
       mode = opts.mode;
     }
     if (mode !== void 0) {
-      await fsp4.chmod(tmp, mode);
+      await fs.chmod(tmp, mode);
     }
     await renameWithRetry(tmp, targetPath);
     if (mode !== void 0 && process.platform === "win32") {
       try {
-        await fsp4.chmod(targetPath, mode);
+        await fs.chmod(targetPath, mode);
       } catch {
       }
     }
   } catch (err) {
     try {
-      await fsp4.unlink(tmp);
+      await fs.unlink(tmp);
     } catch {
     }
     throw err;
   }
 }
 async function ensureDir(dir) {
-  await fsp4.mkdir(dir, { recursive: true });
+  await fs.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path2.dirname(targetPath);
-  await fsp4.mkdir(dir, { recursive: true });
-  const lockPath = path2.join(dir, `.${path2.basename(targetPath)}.lock`);
+  const dir = path3.dirname(targetPath);
+  await fs.mkdir(dir, { recursive: true });
+  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
   let handle;
   for (; ; ) {
     try {
-      handle = await fsp4.open(lockPath, "wx");
+      handle = await fs.open(lockPath, "wx");
       await handle.writeFile(`${process.pid}:${Date.now()}`);
       break;
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
-        await fsp4.mkdir(dir, { recursive: true });
+        await fs.mkdir(dir, { recursive: true });
         continue;
       }
       if (code !== "EEXIST") throw err;
       try {
-        const stat13 = await fsp4.stat(lockPath);
+        const stat13 = await fs.stat(lockPath);
         if (Date.now() - stat13.mtimeMs > staleMs) {
-          await fsp4.unlink(lockPath);
+          await fs.unlink(lockPath);
           continue;
         }
       } catch {
@@ -692,7 +754,7 @@ async function withFileLock(targetPath, fn, opts = {}) {
     } catch {
     }
     try {
-      await fsp4.unlink(lockPath);
+      await fs.unlink(lockPath);
     } catch {
     }
   }
@@ -700,14 +762,14 @@ async function withFileLock(targetPath, fn, opts = {}) {
 var TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
 async function renameWithRetry(from, to) {
   if (process.platform !== "win32") {
-    await fsp4.rename(from, to);
+    await fs.rename(from, to);
     return;
   }
   const delays = [10, 25, 60, 120, 250];
   let lastErr;
   for (let i = 0; i <= delays.length; i++) {
     try {
-      await fsp4.rename(from, to);
+      await fs.rename(from, to);
       return;
     } catch (err) {
       lastErr = err;
@@ -721,6 +783,11 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
+// src/storage/file-session-writer.ts
+import { closeSync, fsyncSync, openSync, writeSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path4 from "node:path";
+
 // src/storage/session-helpers.ts
 function userInputTitle(content) {
   const text = typeof content === "string" ? content : content.filter((b) => b.type === "text").map((b) => b.text).join(" ");
@@ -736,7 +803,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path2.join(opts.dir, `${path2.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.checkpointCas = opts.checkpointCas;
@@ -1276,7 +1343,7 @@ var FileSessionWriter = class _FileSessionWriter {
     let removedCount = 0;
     let targetCheckpointSeen = false;
     try {
-      fd = await fsp4.open(this.filePath, "r", 384);
+      fd = await fsp.open(this.filePath, "r", 384);
       while (true) {
         const buf = Buffer.alloc(CHUNK_SIZE);
         const { bytesRead } = await fd.read(buf, 0, CHUNK_SIZE, fileOffset);
@@ -1331,7 +1398,7 @@ var FileSessionWriter = class _FileSessionWriter {
     await this.writeChain;
     await this.handle.close();
     const tmpPath = `${this.filePath}.rewind.tmp`;
-    const src = await fsp4.open(this.filePath, "r", 384);
+    const src = await fsp.open(this.filePath, "r", 384);
     try {
       const statResult = await src.stat();
       const totalSize = statResult.size;
@@ -1347,7 +1414,7 @@ var FileSessionWriter = class _FileSessionWriter {
       } else {
         newlineAfterCheckpoint = totalSize;
       }
-      const writeFd = await fsp4.open(tmpPath, "w", 384);
+      const writeFd = await fsp.open(tmpPath, "w", 384);
       try {
         let readOffset = 0;
         while (readOffset < newlineAfterCheckpoint) {
@@ -1395,11 +1462,11 @@ var FileSessionWriter = class _FileSessionWriter {
         await writeFd.close();
       }
       await src.close();
-      await fsp4.rename(tmpPath, this.filePath);
-      this.handle = await fsp4.open(this.filePath, "a", 384);
+      await fsp.rename(tmpPath, this.filePath);
+      this.handle = await fsp.open(this.filePath, "a", 384);
     } catch (err) {
-      await fsp4.unlink(tmpPath).catch(() => void 0);
-      this.handle = await fsp4.open(this.filePath, "a", 384).catch(() => this.handle);
+      await fsp.unlink(tmpPath).catch(() => void 0);
+      this.handle = await fsp.open(this.filePath, "a", 384).catch(() => this.handle);
       throw err;
     }
     await this.append({
@@ -1434,7 +1501,7 @@ var FileSessionWriter = class _FileSessionWriter {
       provider: this.meta.provider ?? "unknown"
     })}
 `;
-    await fsp4.writeFile(this.filePath, record, "utf8");
+    await fsp.writeFile(this.filePath, record, "utf8");
     this.activePromptIndex = null;
     this.pendingFileSnapshots = [];
   }
@@ -1479,6 +1546,12 @@ var FileSessionWriter = class _FileSessionWriter {
   }
 };
 
+// src/storage/session-checkpoint-cas.ts
+import { spawn } from "node:child_process";
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import * as fsp2 from "node:fs/promises";
+import * as path5 from "node:path";
+
 // src/storage/storage-concurrency.ts
 async function mapWithConcurrency(items, concurrency, mapper) {
   if (items.length === 0) return [];
@@ -1505,16 +1578,16 @@ var MAX_GIT_OUTPUT = 16 * 1024 * 1024;
 var MAX_BLOB_BYTES = 64 * 1024 * 1024;
 var MAX_CHECKPOINT_BYTES = 512 * 1024 * 1024;
 function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
+  return createHash2("sha256").update(content).digest("hex");
 }
 function isInside(root, target) {
-  const relative6 = path2.relative(root, target);
-  return relative6 === "" || !relative6.startsWith("..") && !path2.isAbsolute(relative6);
+  const relative6 = path5.relative(root, target);
+  return relative6 === "" || !relative6.startsWith("..") && !path5.isAbsolute(relative6);
 }
 function normalizeRelative(input) {
-  if (!input || path2.isAbsolute(input)) return null;
+  if (!input || path5.isAbsolute(input)) return null;
   const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
-  const resolved = path2.posix.normalize(normalized);
+  const resolved = path5.posix.normalize(normalized);
   if (!resolved || resolved === "." || resolved === ".." || resolved.startsWith("../")) return null;
   return resolved;
 }
@@ -1529,8 +1602,8 @@ var SessionCheckpointCas = class {
   projectRoot;
   runGit;
   constructor(opts) {
-    this.rootDir = path2.resolve(opts.rootDir);
-    this.projectRoot = path2.resolve(opts.projectRoot);
+    this.rootDir = path5.resolve(opts.rootDir);
+    this.projectRoot = path5.resolve(opts.projectRoot);
     this.runGit = opts.runGit ?? defaultRunGit;
   }
   async capture(_sessionId, _promptIndex) {
@@ -1555,17 +1628,17 @@ var SessionCheckpointCas = class {
       relativePaths,
       CAPTURE_CONCURRENCY,
       async (relative6) => {
-        const absolute = path2.resolve(this.projectRoot, ...relative6.split("/"));
+        const absolute = path5.resolve(this.projectRoot, ...relative6.split("/"));
         if (!isInside(this.projectRoot, absolute)) {
           unresolved.push({ path: relative6, reason: "path escapes project root" });
           return null;
         }
         try {
-          const stat13 = await fsp4.lstat(absolute);
+          const stat13 = await fsp2.lstat(absolute);
           if (stat13.isSymbolicLink()) {
-            const linkTarget = await fsp4.readlink(absolute);
-            const resolvedLink = path2.resolve(path2.dirname(absolute), linkTarget);
-            if (path2.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
+            const linkTarget = await fsp2.readlink(absolute);
+            const resolvedLink = path5.resolve(path5.dirname(absolute), linkTarget);
+            if (path5.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
               unresolved.push({
                 path: relative6,
                 reason: "symlink target escapes project root"
@@ -1593,7 +1666,7 @@ var SessionCheckpointCas = class {
             return null;
           }
           scheduledBytes += stat13.size;
-          const content = await fsp4.readFile(absolute);
+          const content = await fsp2.readFile(absolute);
           const blobHash = sha256(content);
           await this.putBlob(blobHash, content);
           return { path: relative6, state: "file", blobHash, mode: stat13.mode & 511 };
@@ -1627,11 +1700,11 @@ var SessionCheckpointCas = class {
     };
   }
   async materialize(checkpoint, targetRoot) {
-    const target = path2.resolve(targetRoot);
+    const target = path5.resolve(targetRoot);
     if (target === this.projectRoot) {
       throw new Error("Refusing to materialize a workspace checkpoint over the parent project root");
     }
-    const targetStat = await fsp4.stat(target);
+    const targetStat = await fsp2.stat(target);
     if (!targetStat.isDirectory()) throw new Error(`Checkpoint target is not a directory: ${target}`);
     const manifest = await this.loadManifest(checkpoint.manifestHash);
     if (manifest.baseHead !== checkpoint.baseHead.toLowerCase() || manifest.coverage !== checkpoint.coverage || manifest.entries.length !== checkpoint.entryCount || manifest.unresolved.length !== checkpoint.unresolvedCount) {
@@ -1658,7 +1731,7 @@ var SessionCheckpointCas = class {
     if (targetStatus.stdout.length > 0) {
       throw new Error("Checkpoint target must be a clean checkout before materialization");
     }
-    const realTarget = await fsp4.realpath(target);
+    const realTarget = await fsp2.realpath(target);
     const writtenFiles = [];
     const deletedFiles = [];
     const errors = [];
@@ -1667,10 +1740,10 @@ var SessionCheckpointCas = class {
       try {
         const output = await this.safeOutputPath(target, realTarget, entry.path);
         if (entry.state === "symlink") {
-          if (path2.isAbsolute(entry.linkTarget)) {
+          if (path5.isAbsolute(entry.linkTarget)) {
             throw new Error("absolute symlink target refused");
           }
-          const resolvedLink = path2.resolve(path2.dirname(output), entry.linkTarget);
+          const resolvedLink = path5.resolve(path5.dirname(output), entry.linkTarget);
           if (!isInside(target, resolvedLink)) throw new Error("symlink target escapes checkpoint root");
         }
         prepared.push({
@@ -1688,24 +1761,24 @@ var SessionCheckpointCas = class {
     for (const { entry, output, content } of prepared) {
       try {
         if (entry.state === "absent") {
-          await fsp4.unlink(output).catch((err) => {
+          await fsp2.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
           deletedFiles.push(entry.path);
           continue;
         }
         if (entry.state === "symlink") {
-          await fsp4.unlink(output).catch((err) => {
+          await fsp2.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
-          await fsp4.mkdir(path2.dirname(output), { recursive: true });
-          await fsp4.symlink(entry.linkTarget, output);
+          await fsp2.mkdir(path5.dirname(output), { recursive: true });
+          await fsp2.symlink(entry.linkTarget, output);
           writtenFiles.push(entry.path);
           continue;
         }
         if (!content) throw new Error("CAS blob was not prepared");
         await atomicWrite(output, content, { mode: entry.mode });
-        await fsp4.chmod(output, entry.mode).catch(() => void 0);
+        await fsp2.chmod(output, entry.mode).catch(() => void 0);
         writtenFiles.push(entry.path);
       } catch (err) {
         errors.push(`${entry.path}: ${toErrorMessage(err)}`);
@@ -1715,48 +1788,48 @@ var SessionCheckpointCas = class {
   }
   objectPath(hash) {
     if (!HASH_RE.test(hash)) throw new Error(`Invalid CAS object hash: ${hash}`);
-    return path2.join(this.rootDir, "objects", hash.slice(0, 2), hash.slice(2));
+    return path5.join(this.rootDir, "objects", hash.slice(0, 2), hash.slice(2));
   }
   manifestPath(hash) {
     if (!HASH_RE.test(hash)) throw new Error(`Invalid checkpoint manifest hash: ${hash}`);
-    return path2.join(this.rootDir, "manifests", `${hash}.json`);
+    return path5.join(this.rootDir, "manifests", `${hash}.json`);
   }
   async putBlob(hash, content) {
     const target = this.objectPath(hash);
-    await fsp4.mkdir(path2.dirname(target), { recursive: true });
+    await fsp2.mkdir(path5.dirname(target), { recursive: true });
     try {
-      const existing = await fsp4.readFile(target);
+      const existing = await fsp2.readFile(target);
       if (sha256(existing) !== hash) throw new Error(`Corrupt CAS object collision: ${hash}`);
       return;
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    const temp = path2.join(
-      path2.dirname(target),
-      `.${path2.basename(target)}.${process.pid}.${randomUUID()}.tmp`
+    const temp = path5.join(
+      path5.dirname(target),
+      `.${path5.basename(target)}.${process.pid}.${randomUUID()}.tmp`
     );
     let handle;
     try {
-      handle = await fsp4.open(temp, "wx", 384);
+      handle = await fsp2.open(temp, "wx", 384);
       await handle.writeFile(content);
       await handle.sync();
       await handle.close();
       handle = void 0;
       try {
-        await fsp4.link(temp, target);
+        await fsp2.link(temp, target);
       } catch (err) {
         if (err.code !== "EEXIST") throw err;
-        const existing = await fsp4.readFile(target);
+        const existing = await fsp2.readFile(target);
         if (sha256(existing) !== hash) throw new Error(`Corrupt CAS object collision: ${hash}`);
       }
     } finally {
       await handle?.close().catch(() => void 0);
-      await fsp4.unlink(temp).catch(() => void 0);
+      await fsp2.unlink(temp).catch(() => void 0);
     }
   }
   async putManifest(hash, encoded) {
     const target = this.manifestPath(hash);
-    const existing = await fsp4.readFile(target).catch(() => null);
+    const existing = await fsp2.readFile(target).catch(() => null);
     if (existing) {
       if (sha256(existing) !== hash) throw new Error(`Corrupt checkpoint manifest collision: ${hash}`);
       return;
@@ -1764,12 +1837,12 @@ var SessionCheckpointCas = class {
     await atomicWrite(target, encoded, { mode: 384 });
   }
   async readBlob(hash) {
-    const content = await fsp4.readFile(this.objectPath(hash));
+    const content = await fsp2.readFile(this.objectPath(hash));
     if (sha256(content) !== hash) throw new Error(`CAS blob integrity check failed: ${hash}`);
     return content;
   }
   async loadManifest(hash) {
-    const raw = await fsp4.readFile(this.manifestPath(hash));
+    const raw = await fsp2.readFile(this.manifestPath(hash));
     if (sha256(raw) !== hash) throw new Error(`Checkpoint manifest integrity check failed: ${hash}`);
     const parsed = JSON.parse(raw.toString("utf8"));
     if (parsed.version !== 1 || typeof parsed.baseHead !== "string" || parsed.coverage !== "git-head-plus-dirty" || !Array.isArray(parsed.entries) || !Array.isArray(parsed.unresolved)) {
@@ -1794,17 +1867,17 @@ var SessionCheckpointCas = class {
   async safeOutputPath(target, realTarget, relative6) {
     const normalized = normalizeRelative(relative6);
     if (!normalized) throw new Error("invalid relative path");
-    const output = path2.resolve(target, ...normalized.split("/"));
+    const output = path5.resolve(target, ...normalized.split("/"));
     if (!isInside(target, output)) throw new Error("path escapes checkpoint target");
     let probe = output;
     for (; ; ) {
       try {
-        const real = await fsp4.realpath(probe);
+        const real = await fsp2.realpath(probe);
         if (!isInside(realTarget, real)) throw new Error("path resolves through a symlink outside checkpoint target");
         return output;
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
-        const parent = path2.dirname(probe);
+        const parent = path5.dirname(probe);
         if (parent === probe) throw err;
         probe = parent;
       }
@@ -1859,12 +1932,17 @@ function defaultRunGit(args, cwd) {
     child.on("close", (code) => resolve11(result(code ?? 1)));
   });
 }
+
+// src/storage/session-resume-validation.ts
+import { createHash as createHash3 } from "node:crypto";
+import * as fsp3 from "node:fs/promises";
+import * as path6 from "node:path";
 var MAX_REVALIDATE_BYTES = 5 * 1024 * 1024;
 var VALIDATION_CONCURRENCY = 8;
 var NOTICE_PATH_LIMIT = 20;
 function isInside2(root, target) {
-  const relative6 = path2.relative(root, target);
-  return relative6 === "" || !relative6.startsWith("..") && !path2.isAbsolute(relative6);
+  const relative6 = path6.relative(root, target);
+  return relative6 === "" || !relative6.startsWith("..") && !path6.isAbsolute(relative6);
 }
 function errno(err) {
   return err && typeof err === "object" && "code" in err ? String(err.code) : void 0;
@@ -1875,7 +1953,7 @@ function latestObservations(events, projectRoot) {
     if (event.type !== "file_observation" || typeof event.path !== "string" || event.path.length === 0 || typeof event.hash !== "string" || !/^[a-f\d]{64}$/i.test(event.hash)) {
       continue;
     }
-    const normalized = path2.resolve(projectRoot, event.path);
+    const normalized = path6.resolve(projectRoot, event.path);
     latest.set(normalized, {
       path: normalized,
       hash: event.hash.toLowerCase(),
@@ -1899,7 +1977,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
   let realFile;
   try {
-    realFile = await fsp4.realpath(observation.path);
+    realFile = await fsp3.realpath(observation.path);
   } catch (err) {
     if (errno(err) === "ENOENT") return { ...base, status: "deleted" };
     return { ...base, status: "unreadable", detail: toErrorMessage(err) };
@@ -1912,7 +1990,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
     };
   }
   try {
-    const stat13 = await fsp4.stat(realFile);
+    const stat13 = await fsp3.stat(realFile);
     if (!stat13.isFile()) {
       return { ...base, status: "unreadable", detail: "Path is no longer a regular file." };
     }
@@ -1923,8 +2001,8 @@ async function validateOne(observation, lexicalRoot, realRoot) {
         detail: `File now exceeds the ${MAX_REVALIDATE_BYTES}-byte validation limit.`
       };
     }
-    const content = await fsp4.readFile(realFile, "utf8");
-    const actualHash = createHash("sha256").update(content, "utf8").digest("hex");
+    const content = await fsp3.readFile(realFile, "utf8");
+    const actualHash = createHash3("sha256").update(content, "utf8").digest("hex");
     if (actualHash === observation.hash) return null;
     return { ...base, status: "modified", actualHash };
   } catch (err) {
@@ -1933,8 +2011,8 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
 }
 async function validateResumeFileObservations(events, projectRoot) {
-  const lexicalRoot = path2.resolve(projectRoot);
-  const realRoot = await fsp4.realpath(lexicalRoot).catch(() => lexicalRoot);
+  const lexicalRoot = path6.resolve(projectRoot);
+  const realRoot = await fsp3.realpath(lexicalRoot).catch(() => lexicalRoot);
   const observations = latestObservations(events, lexicalRoot);
   const results = await mapWithConcurrency(
     observations,
@@ -1949,9 +2027,9 @@ async function validateResumeFileObservations(events, projectRoot) {
 }
 function formatResumeValidationNotice(validation, projectRoot) {
   if (validation.staleFiles.length === 0) return null;
-  const root = path2.resolve(projectRoot);
+  const root = path6.resolve(projectRoot);
   const shown = validation.staleFiles.slice(0, NOTICE_PATH_LIMIT).map((entry) => {
-    const relative6 = path2.relative(root, entry.path);
+    const relative6 = path6.relative(root, entry.path);
     const display = isInside2(root, entry.path) ? relative6 || "." : entry.path;
     return `- ${JSON.stringify(display)} [${entry.status}]`;
   });
@@ -2059,6 +2137,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
   projectRoot;
   checkpointCas;
   isSessionInUse;
+  logger;
   /**
    * In-memory cache for load() results, keyed by session ID. The cache is
    * invalidated when the file's mtimeMs or size changes (indicating the
@@ -2076,14 +2155,26 @@ var DefaultSessionStore = class _DefaultSessionStore {
   static LIST_SCAN_CONCURRENCY = 32;
   constructor(opts) {
     this.dir = opts.dir;
-    this.projectRoot = opts.projectRoot ? path2.resolve(opts.projectRoot) : void 0;
+    this.projectRoot = opts.projectRoot ? path7.resolve(opts.projectRoot) : void 0;
     this.checkpointCas = this.projectRoot ? new SessionCheckpointCas({
-      rootDir: path2.join(this.dir, "_cas"),
+      rootDir: path7.join(this.dir, "_cas"),
       projectRoot: this.projectRoot
     }) : void 0;
     this.events = opts.events;
     this.secretScrubber = opts.secretScrubber;
     this.isSessionInUse = opts.isSessionInUse;
+    this.logger = opts.logger;
+  }
+  /**
+   * Emit a structured warning. Uses the configured Logger when available;
+   * falls back to console.warn(JSON) so warnings are never silently dropped.
+   */
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
   }
   /**
    * Clear the load() cache. Useful for testing or when the caller knows
@@ -2132,17 +2223,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path2.join(this.dir, "_index.jsonl");
+    return path7.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
     return sessionScopedPath(this.dir, id, ext);
   }
   shardManifestPath(shardKey) {
-    return shardKey ? path2.join(this.dir, shardKey, "_manifest.json") : path2.join(this.dir, "_manifest.json");
+    return shardKey ? path7.join(this.dir, shardKey, "_manifest.json") : path7.join(this.dir, "_manifest.json");
   }
   shardKeyForSessionId(id) {
-    const dirName = path2.dirname(id);
+    const dirName = path7.dirname(id);
     return dirName === "." ? "" : dirName;
   }
   invalidateShardManifestBySessionId(id) {
@@ -2154,7 +2245,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path2.dirname(sessionScopedPath(this.dir, id, ""));
+    const dirPath = path7.dirname(sessionScopedPath(this.dir, id, ""));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -2185,12 +2276,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
       this.emitWrite(id, file, "create", "success", Date.now() - t0);
       return writer;
     } catch (err) {
-      await handle.close().catch((e) => console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.handle_close_failed",
-        message: e instanceof Error ? e.message : String(e),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })));
+      await handle.close().catch((e) => this.logWarn(
+        "Session handle close failed",
+        { event: "session_store.handle_close_failed", message: e instanceof Error ? e.message : String(e) }
+      ));
       this.emitError(id, file, "create", toErrorMessage(err), true);
       throw err;
     }
@@ -2216,7 +2305,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     const parentPrefix = parent.events.slice(0, boundary + 1);
     const workspaceCheckpoint = targetCheckpoint?.workspaceCheckpoint;
-    const checkpointHash = createHash("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
+    const checkpointHash = createHash4("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
     const inherited = parentPrefix.filter(inheritsIntoFork);
     const writer = await this.create({
       id: "",
@@ -2311,7 +2400,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path2.dirname(file),
+          dir: path7.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           checkpointCas: this.checkpointCas,
@@ -2321,12 +2410,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
       this.emitWrite(id, file, "resume", "success", Date.now() - t0);
       return { writer, data: resumedData };
     } catch (err) {
-      await handle.close().catch((e) => console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.handle_close_failed",
-        message: e instanceof Error ? e.message : String(e),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })));
+      await handle.close().catch((e) => this.logWarn(
+        "Session handle close failed",
+        { event: "session_store.handle_close_failed", message: e instanceof Error ? e.message : String(e) }
+      ));
       this.emitError(id, file, "resume", toErrorMessage(err), true);
       throw err;
     }
@@ -2866,7 +2953,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return entry;
   }
   async collectSessionFilesInShard(shardKey) {
-    const dir = shardKey ? path2.join(this.dir, shardKey) : this.dir;
+    const dir = shardKey ? path7.join(this.dir, shardKey) : this.dir;
     const entries = await this.collectSessionFiles(dir, shardKey);
     return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
@@ -2889,13 +2976,13 @@ var DefaultSessionStore = class _DefaultSessionStore {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
         const id = prefix ? `${prefix}/${base}` : base;
-        files.push({ id, filePath: path2.join(dir, entry.name) });
+        files.push({ id, filePath: path7.join(dir, entry.name) });
       }
     }
     const childFileArrays = await Promise.all(
       dirEntries.map((entry) => {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionFiles(path2.join(dir, entry.name), childPrefix, depth + 1);
+        return this.collectSessionFiles(path7.join(dir, entry.name), childPrefix, depth + 1);
       })
     );
     return [...childFileArrays.flat(), ...files];
@@ -2928,7 +3015,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const childIdArrays = await Promise.all(
       dirEntries.map((entry) => {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionIds(path2.join(dir, entry.name), childPrefix, depth + 1);
+        return this.collectSessionIds(path7.join(dir, entry.name), childPrefix, depth + 1);
       })
     );
     return [...childIdArrays.flat(), ...fileIds];
@@ -2947,13 +3034,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
       await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
         const msg = toErrorMessage(err);
         this.emitError(id, manifest, "summary_fallback", msg, true);
-        console.warn(JSON.stringify({
-          level: "warn",
-          event: "session_store.manifest_write_failed",
-          sessionId: id,
-          message: msg,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        }));
+        this.logWarn(
+          "Session manifest write failed",
+          { event: "session_store.manifest_write_failed", sessionId: id, message: msg }
+        );
       });
       outcome = "failure";
       errorMsg = "summary fallback \xE2\u20AC\u201D manifest rebuilt";
@@ -3045,9 +3129,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path2.dirname(jsonlPath);
-    const base = path2.basename(id);
-    const sessDir = path2.join(shardDir, base);
+    const shardDir = path7.dirname(jsonlPath);
+    const base = path7.basename(id);
+    const sessDir = path7.join(shardDir, base);
     const deletions = [
       fsp4.unlink(jsonlPath),
       fsp4.unlink(summaryPath),
@@ -3088,7 +3172,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    */
   async readActiveSessionId() {
     try {
-      const raw = await fsp4.readFile(path2.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp4.readFile(path7.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       return active.sessionId ?? null;
     } catch {
@@ -3151,7 +3235,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const activeSessionId = await this.readActiveSessionId();
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path2.join(dir, name);
+      const jsonlPath = path7.join(dir, name);
       try {
         const stat13 = await fsp4.stat(jsonlPath);
         if (stat13.mtimeMs >= cutoff) return;
@@ -3171,7 +3255,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path2.join(this.dir, entry.name);
+      const dateDir = path7.join(this.dir, entry.name);
       const files = await fsp4.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
@@ -3183,7 +3267,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path2.join(this.dir, entry.name);
+      const dateDir = path7.join(this.dir, entry.name);
       try {
         const remaining = await fsp4.readdir(dateDir);
         if (remaining.length === 0) {
@@ -3305,16 +3389,29 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
   }
 };
+
+// src/storage/queue-store.ts
+import * as fsp5 from "node:fs/promises";
+import * as path8 from "node:path";
 var QueueStore = class {
   file;
   // Use `| undefined` (not `?`) so exactOptionalPropertyTypes doesn't
   // reject assigning an optional constructor parameter to these fields.
   events;
   traceId;
+  logger;
   constructor(opts) {
-    this.file = path2.join(opts.dir, "queue.json");
+    this.file = path8.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
+    this.logger = opts.logger;
+  }
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
   }
   async write(items) {
     const t0 = Date.now();
@@ -3344,20 +3441,14 @@ var QueueStore = class {
         recoverable: false,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "queue_store.write_failed",
-        path: this.file,
-        message: toErrorMessage(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      this.logWarn("Queue store write failed", { event: "queue_store.write_failed", path: this.file, message: toErrorMessage(err) });
     }
   }
   async read() {
     const t0 = Date.now();
     let raw;
     try {
-      raw = await fsp4.readFile(this.file, "utf8");
+      raw = await fsp5.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -3382,13 +3473,7 @@ var QueueStore = class {
         recoverable: true,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "queue_store.read_failed",
-        path: this.file,
-        message: toErrorMessage(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      this.logWarn("Queue store read failed", { event: "queue_store.read_failed", path: this.file, message: toErrorMessage(err) });
       return [];
     }
     let parsed;
@@ -3438,7 +3523,7 @@ var QueueStore = class {
   async clear() {
     const t0 = Date.now();
     try {
-      await fsp4.unlink(this.file);
+      await fsp5.unlink(this.file);
       this.events?.emit("storage.write", {
         sessionId: this.traceId ?? "~boot~",
         store: "queue",
@@ -3461,13 +3546,7 @@ var QueueStore = class {
         recoverable: true,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "queue_store.clear_failed",
-        path: this.file,
-        message: err.message,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      this.logWarn("Queue store clear failed", { event: "queue_store.clear_failed", path: this.file, message: err.message });
     }
   }
 };
@@ -3476,6 +3555,11 @@ function isPersistedQueueItem(v) {
   const o = v;
   return typeof o["displayText"] === "string" && Array.isArray(o["blocks"]);
 }
+
+// src/storage/attachment-store.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import * as fsp6 from "node:fs/promises";
+import * as path9 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -3490,13 +3574,13 @@ var DefaultAttachmentStore = class {
   }
   async add(input) {
     const seq = ++this.nextSeq[input.kind];
-    const id = `${kindPrefix(input.kind)}-${seq}-${randomBytes(3).toString("hex")}`;
+    const id = `${kindPrefix(input.kind)}-${seq}-${randomBytes3(3).toString("hex")}`;
     const bytes = Buffer.byteLength(input.data, input.kind === "image" ? "base64" : "utf8");
     let spooledPath;
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
-      await fsp4.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path2.join(this.spoolDir, `${id}.bin`);
+      await fsp6.mkdir(this.spoolDir, { recursive: true });
+      spooledPath = path9.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -3558,7 +3642,7 @@ var DefaultAttachmentStore = class {
       for (const att of this.items.values()) {
         if (att.path) toDelete.push(att.path);
       }
-      await Promise.all(toDelete.map((p) => fsp4.unlink(p).catch(() => void 0)));
+      await Promise.all(toDelete.map((p) => fsp6.unlink(p).catch(() => void 0)));
     }
     this.items.clear();
     this.refs.length = 0;
@@ -3566,7 +3650,7 @@ var DefaultAttachmentStore = class {
   }
   async toBlock(att) {
     if (att.kind === "image") {
-      const data = att.data ?? (att.path ? await fsp4.readFile(att.path, { encoding: "base64" }) : "");
+      const data = att.data ?? (att.path ? await fsp6.readFile(att.path, { encoding: "base64" }) : "");
       return {
         type: "image",
         source: {
@@ -3576,7 +3660,7 @@ var DefaultAttachmentStore = class {
         }
       };
     }
-    const raw = att.data ?? (att.path ? await fsp4.readFile(att.path, "utf8") : "");
+    const raw = att.data ?? (att.path ? await fsp6.readFile(att.path, "utf8") : "");
     const label = att.meta.filename ? `<file path="${att.meta.filename}">` : "<pasted>";
     const close = att.meta.filename ? "</file>" : "</pasted>";
     return { type: "text", text: `${label}
@@ -3614,6 +3698,11 @@ function mergeAdjacentText(blocks) {
   return out;
 }
 
+// src/storage/memory-backend.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path10 from "node:path";
+
 // src/types/memory.ts
 var MEMORY_TYPE_LABELS = {
   fact: "Fact",
@@ -3779,7 +3868,7 @@ var FileMemoryBackend = class {
   }
   async getMtime(file) {
     try {
-      const stat13 = await fsp4.stat(file);
+      const stat13 = await fs2.stat(file);
       return stat13.mtimeMs;
     } catch {
       return 0;
@@ -3826,13 +3915,13 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path2.dirname(file));
+    await ensureDir(path10.dirname(file));
     let existing = "";
     try {
-      existing = await fsp4.readFile(file, "utf8");
+      existing = await fs2.readFile(file, "utf8");
     } catch {
     }
-    const id = `mem_${Date.now()}_${randomUUID().slice(0, 8)}`;
+    const id = `mem_${Date.now()}_${randomUUID2().slice(0, 8)}`;
     const meta = formatMetadata(entry);
     const line = `
 - [${entry.ts}] ${id}${meta} ${entry.text.replace(/\n/g, " ")}
@@ -3847,7 +3936,7 @@ ${line}`;
     return withFileLock(file, async () => {
       let existing;
       try {
-        existing = await fsp4.readFile(file, "utf8");
+        existing = await fs2.readFile(file, "utf8");
       } catch {
         return 0;
       }
@@ -3884,7 +3973,7 @@ ${line}`;
   async readAll(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
     try {
-      return await fsp4.readFile(file, "utf8");
+      return await fs2.readFile(file, "utf8");
     } catch {
       return "";
     }
@@ -3908,7 +3997,7 @@ ${line}`;
     const file = this.resolveFile(filePath, scope);
     let existing;
     try {
-      existing = await fsp4.readFile(file, "utf8");
+      existing = await fs2.readFile(file, "utf8");
     } catch {
       return 0;
     }
@@ -3928,7 +4017,7 @@ ${line}`;
     const next = lines.join("\n");
     const backup = `${file}.bak.${Date.now()}`;
     try {
-      await fsp4.copyFile(file, backup);
+      await fs2.copyFile(file, backup);
       await pruneConsolidateBackups(file);
     } catch {
     }
@@ -3942,14 +4031,14 @@ ${line}`;
   }
 };
 async function pruneConsolidateBackups(file) {
-  const dir = path2.dirname(file);
-  const base = path2.basename(file);
+  const dir = path10.dirname(file);
+  const base = path10.basename(file);
   const prefix = `${base}.bak.`;
-  const backups = (await fsp4.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
+  const backups = (await fs2.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
   await Promise.all(
     backups.slice(MAX_MEMORY_CONSOLIDATE_BACKUPS).map(async (name) => {
       try {
-        await fsp4.unlink(path2.join(dir, name));
+        await fs2.unlink(path10.join(dir, name));
       } catch {
       }
     })
@@ -4309,6 +4398,10 @@ ${body.trim()}`);
           score += 1;
           reasons.push("preference");
           break;
+        case "reference":
+          break;
+        case "fact":
+          break;
       }
       const ageDays = (now - new Date(entry.ts).getTime()) / (1e3 * 60 * 60 * 24);
       if (ageDays < 1) score += 1;
@@ -4516,9 +4609,9 @@ ${body.trim()}`);
     if (!this.persistBackup || scope === "project-agents") return;
     try {
       const content = await this.backend.readAll(scope, this.files[scope]);
-      const { writeFile: writeFile8, mkdir: mkdir8 } = await import('fs/promises');
-      await mkdir8(this.backupDir, { recursive: true });
-      await writeFile8(`${this.backupDir}/${scope}.md`, content, "utf8");
+      const { writeFile: writeFile7, mkdir: mkdir7 } = await import("node:fs/promises");
+      await mkdir7(this.backupDir, { recursive: true });
+      await writeFile7(`${this.backupDir}/${scope}.md`, content, "utf8");
     } catch {
     }
   }
@@ -4533,6 +4626,9 @@ function labelOf(scope) {
       return "User memory";
   }
 }
+
+// src/storage/memory-graph-backend.ts
+import * as fs3 from "node:fs/promises";
 var GraphMemoryBackend = class _GraphMemoryBackend {
   kind = "graph";
   file;
@@ -4584,7 +4680,8 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
         priority: entry.priority
       });
       this.indexNode(nodeId, entry);
-      const recentNodes = [...this.nodes.values()].slice(-100);
+      const SIMILARITY_WINDOW = 100;
+      const recentNodes = [...this.nodes.values()].slice(-SIMILARITY_WINDOW);
       for (const other of recentNodes) {
         if (other.id === nodeId) continue;
         const sim = wordOverlap(entry.text, other.entry.text);
@@ -4699,7 +4796,7 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
     this.loadedScope = scope;
     this.loaded = true;
     try {
-      await fsp4.unlink(this.graphFile);
+      await fs3.unlink(this.graphFile);
     } catch {
     }
   }
@@ -4739,7 +4836,7 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
   async loadGraph(scope) {
     if (this.loaded && this.loadedScope === scope) return;
     try {
-      const raw = await fsp4.readFile(this.graphFile, "utf8");
+      const raw = await fs3.readFile(this.graphFile, "utf8");
       const data = JSON.parse(raw);
       this.nodes = new Map(data.nodes);
       this.edges = data.edges;
@@ -4761,10 +4858,10 @@ var GraphMemoryBackend = class _GraphMemoryBackend {
         edges: this.edges
       };
       const dir = this.graphFile.substring(0, this.graphFile.lastIndexOf("/"));
-      await fsp4.mkdir(dir, { recursive: true });
+      await fs3.mkdir(dir, { recursive: true });
       const tmp = `${this.graphFile}.tmp`;
-      await fsp4.writeFile(tmp, JSON.stringify(data));
-      await fsp4.rename(tmp, this.graphFile);
+      await fs3.writeFile(tmp, JSON.stringify(data));
+      await fs3.rename(tmp, this.graphFile);
     } catch {
     }
   }
@@ -4880,6 +4977,11 @@ function simpleHash(s) {
   }
   return Math.abs(h).toString(36);
 }
+
+// src/utils/instruction-file.ts
+import { readFileSync, statSync } from "node:fs";
+import * as path11 from "node:path";
+import { fileURLToPath } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
 function readBundledInstructionText(relativePath) {
@@ -4888,7 +4990,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync(path2.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync(path11.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -4904,11 +5006,11 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path2.dirname(fileURLToPath(import.meta.url));
+  const here = path11.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path2.resolve(here, "../../instructions"),
-    path2.resolve(here, "../instructions"),
-    path2.resolve(here, "instructions")
+    path11.resolve(here, "../../instructions"),
+    path11.resolve(here, "../instructions"),
+    path11.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   return rootCandidates;
@@ -5104,14 +5206,13 @@ function deepFreeze(obj) {
   }
   return Object.freeze(obj);
 }
-var KEY_BYTES = 32;
-var IV_BYTES = 12;
-var TAG_BYTES = 16;
-var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
-KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
-var KEK_MAGIC = Buffer.from("WSKW", "ascii");
-var KEK_SALT_BYTES = 16;
-KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
+
+// src/storage/provider-config-watcher.ts
+import * as syncFs from "node:fs";
+import * as fs4 from "node:fs/promises";
+import * as path12 from "node:path";
+
+// src/security/config-secrets.ts
 function decryptConfigSecrets(cfg, vault, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   return walk(cfg, vault, (v, key) => {
@@ -5155,7 +5256,7 @@ function isSecretField(name) {
 async function readProviderSnapshot(configPath, vault, warn) {
   let raw;
   try {
-    raw = await fsp4.readFile(configPath, "utf8");
+    raw = await fs4.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       warn?.(`Could not read ${configPath}: ${err.message}`);
@@ -5190,7 +5291,7 @@ function serializeSnapshot(s) {
 function watchProviderConfig(configPath, vault, onChange, opts = {}) {
   const debounceMs = opts.debounceMs ?? 200;
   const warn = opts.warn;
-  const base = path2.basename(configPath);
+  const base = path12.basename(configPath);
   let timer;
   let closed = false;
   let lastSerialized;
@@ -5201,7 +5302,7 @@ function watchProviderConfig(configPath, vault, onChange, opts = {}) {
   });
   let watcher;
   try {
-    watcher = syncFs.watch(path2.dirname(configPath), { recursive: false });
+    watcher = syncFs.watch(path12.dirname(configPath), { recursive: false });
   } catch (err) {
     warn?.(`Provider config watcher could not start: ${err.message}`);
     return { close: () => {
@@ -5243,6 +5344,10 @@ function watchProviderConfig(configPath, vault, onChange, opts = {}) {
   };
 }
 
+// src/storage/config-loader.ts
+import * as fs5 from "node:fs/promises";
+import * as path13 from "node:path";
+
 // src/types/config.ts
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 
@@ -5381,12 +5486,38 @@ var BEHAVIOR_DEFAULTS = {
     tokenSavingMode: "off",
     allowOutsideProjectRoot: true
   },
+  superMemory: {
+    enabled: true,
+    storage: {
+      projectLocal: true,
+      directory: ".wrongstack/memories"
+    },
+    inject: {
+      turnContext: true,
+      toolResults: true,
+      maxHintsPerTool: 4,
+      maxCharsPerTool: 1200,
+      maxTurnMemories: 8,
+      maxCharsPerTurn: 2400,
+      minScore: 0.65,
+      repeatCooldownMs: 30 * 6e4
+    },
+    hygiene: {
+      autoAfterSession: true,
+      autoOnFileChange: true,
+      retentionDays: 90,
+      archiveLowConfidenceAfterDays: 30
+    },
+    embeddings: {
+      enabled: false
+    }
+  },
   skills: { readClaudeSkills: true },
   mcpServers: {},
   fallbackAuto: true,
   maxConcurrent: 4,
-  // YOLO on by default: auto-approve normal project work without a per-call
-  // prompt. Destructive operations still gate through a confirmation. Users
+  // YOLO on by default: auto-approve non-denied tool calls without a per-call
+  // prompt. Users
   // who want the per-call prompts set `yolo: false`. Existing installs whose
   // config lacks this key pick it up via fillMissingDefaults; an explicit
   // `false` is preserved by the deep-merge (opt-out respected).
@@ -5405,8 +5536,8 @@ var BEHAVIOR_DEFAULTS = {
   autonomy: {
     // 'auto' by default: the agent self-drives (picks the top next-step after
     // each turn). This is a startup default, not a runtime flip — the
-    // autoProceedMaxIterations cap + autoProceedDelayMs cooldown + destructive
-    // gate + Ctrl+C / [GOAL_COMPLETE] stops remain in force. Explicit 'off'
+    // autoProceedMaxIterations cap + autoProceedDelayMs cooldown + Ctrl+C /
+    // [GOAL_COMPLETE] stops remain in force. Explicit 'off'
     // in a config file is preserved (opt-out respected).
     defaultMode: "auto",
     autoProceedDelayMs: DEFAULT_AUTONOMY_CONFIG.autoProceedDelayMs,
@@ -5521,6 +5652,7 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "context",
   "tools",
   "features",
+  "superMemory",
   "skills",
   "autonomy",
   "indexing",
@@ -5560,6 +5692,14 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "fleet",
     reason: "Fleet supervision knobs: a repo-committed config could enable autonomous subagent spawning/steering/termination and mailbox traffic on the victim machine."
+  },
+  {
+    key: "brain",
+    reason: "Brain decision-layer knobs: a repo-committed config could raise the autonomy risk ceiling, switch the Brain to headless (removing the human tier), or reroute Brain decisions to an attacker-chosen provider/model."
+  },
+  {
+    key: "git",
+    reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -5585,6 +5725,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "plugins",
   "log",
   "features",
+  "superMemory",
   "skills",
   "yolo",
   "nextPrediction",
@@ -5603,7 +5744,9 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "sync",
   "extensions",
   "acp",
-  "fleet"
+  "fleet",
+  "brain",
+  "git"
 ]);
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];
@@ -5696,6 +5839,19 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
       out["skills"] = clonedSkills;
     }
   }
+  const outSuperMemory = out["superMemory"];
+  if (outSuperMemory && typeof outSuperMemory === "object") {
+    const storage = outSuperMemory["storage"];
+    if (storage && typeof storage === "object" && "directory" in storage) {
+      const clonedStorage = { ...storage };
+      delete clonedStorage["directory"];
+      out["superMemory"] = {
+        ...outSuperMemory,
+        storage: clonedStorage
+      };
+      stripped.push("superMemory.storage.directory");
+    }
+  }
   if (stripped.length > 0) {
     warn(
       JSON.stringify({
@@ -5711,8 +5867,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
   return out;
 }
 function samePath(a, b) {
-  let ra = path2.resolve(a);
-  let rb = path2.resolve(b);
+  let ra = path13.resolve(a);
+  let rb = path13.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -5741,6 +5897,7 @@ var DefaultConfigLoader = class {
   extraSources;
   events;
   traceId;
+  logger;
   jsonCache = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.paths = opts.paths;
@@ -5749,6 +5906,19 @@ var DefaultConfigLoader = class {
     this.extraSources = opts.sources ?? [];
     this.events = opts.events;
     this.traceId = opts.traceId;
+    this.logger = opts.logger;
+  }
+  /**
+   * Emit a structured warning. Uses the configured Logger when available;
+   * falls back to console.warn(JSON) so warnings are never silently dropped
+   * during early boot (before a Logger is constructed).
+   */
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
   }
   async load(opts = {}) {
     let cfg = { ...BEHAVIOR_DEFAULTS };
@@ -5761,7 +5931,14 @@ var DefaultConfigLoader = class {
     ]);
     cfg = deepMerge2(cfg, global);
     cfg = deepMerge2(cfg, local);
-    cfg = deepMerge2(cfg, stripUnsafeInProjectFields(inProject, this.paths.inProjectConfig));
+    cfg = deepMerge2(
+      cfg,
+      stripUnsafeInProjectFields(
+        inProject,
+        this.paths.inProjectConfig,
+        this.logger ? (msg) => this.logger.warn(msg) : void 0
+      )
+    );
     for (const [key, fn] of Object.entries(ENV_MAP)) {
       const v = process.env[key];
       if (v) fn(cfg, v);
@@ -5778,14 +5955,9 @@ var DefaultConfigLoader = class {
           cfg = deepMerge2(cfg, patch);
         }
       } catch (err) {
-        console.warn(
-          JSON.stringify({
-            level: "warn",
-            event: "config.source_load_failed",
-            source: src.name,
-            message: toErrorMessage(err),
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
+        this.logWarn(
+          "Config source load failed",
+          { event: "config.source_load_failed", source: src.name, message: toErrorMessage(err) }
         );
       }
     }
@@ -5814,7 +5986,7 @@ var DefaultConfigLoader = class {
       }
     }
     this.validateBehavior(cfg);
-    if (this.strict) {
+    if (this.strict && !opts.skipIdentityValidation) {
       this.validateIdentity(cfg);
     }
     return Object.freeze(cfg);
@@ -5826,7 +5998,7 @@ var DefaultConfigLoader = class {
       await withFileLock(fp, async () => {
         let parsed;
         try {
-          const raw = await fsp4.readFile(fp, "utf8");
+          const raw = await fs5.readFile(fp, "utf8");
           const result = safeParse(raw);
           if (!result.ok || !isPlainRecord(result.value)) {
             return;
@@ -5845,14 +6017,9 @@ var DefaultConfigLoader = class {
               durationMs: Date.now() - t0,
               ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
             });
-            console.warn(
-              JSON.stringify({
-                level: "warn",
-                event: "config.defaults_read_failed",
-                path: fp,
-                message: toErrorMessage(err),
-                timestamp: (/* @__PURE__ */ new Date()).toISOString()
-              })
+            this.logWarn(
+              "Config defaults read failed",
+              { event: "config.defaults_read_failed", path: fp, message: toErrorMessage(err) }
             );
             return;
           }
@@ -5886,14 +6053,9 @@ var DefaultConfigLoader = class {
         durationMs: Date.now() - t0,
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "config.defaults_write_failed",
-          path: fp,
-          message: toErrorMessage(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
+      this.logWarn(
+        "Config defaults write failed",
+        { event: "config.defaults_write_failed", path: fp, message: toErrorMessage(err) }
       );
     }
   }
@@ -5945,7 +6107,7 @@ var DefaultConfigLoader = class {
     const fp = this.paths.syncConfig;
     const t0 = Date.now();
     try {
-      const raw = await fsp4.readFile(fp, "utf8");
+      const raw = await fs5.readFile(fp, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok || !parsed.value) {
         this.events?.emit("storage.read", {
@@ -5996,13 +6158,9 @@ var DefaultConfigLoader = class {
         error: storageErrorString(err),
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "config.sync_load_failed",
-          message: toErrorMessage(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
+      this.logWarn(
+        "Config sync load failed",
+        { event: "config.sync_load_failed", message: toErrorMessage(err) }
       );
       return null;
     }
@@ -6011,7 +6169,7 @@ var DefaultConfigLoader = class {
     const t0 = Date.now();
     let mtimeMs = null;
     try {
-      const stat13 = await fsp4.stat(file);
+      const stat13 = await fs5.stat(file);
       mtimeMs = stat13.mtimeMs;
       const cached = this.jsonCache.get(file);
       if (cached && cached.mtimeMs === mtimeMs) {
@@ -6032,20 +6190,15 @@ var DefaultConfigLoader = class {
         error: storageErrorString(err),
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "config.read_failed",
-          path: file,
-          message: toErrorMessage(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
+      this.logWarn(
+        "Config read failed (stat)",
+        { event: "config.read_failed", path: file, message: toErrorMessage(err) }
       );
       return {};
     }
     let raw;
     try {
-      raw = await fsp4.readFile(file, "utf8");
+      raw = await fs5.readFile(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         this.events?.emit("storage.read", {
@@ -6058,14 +6211,9 @@ var DefaultConfigLoader = class {
           error: storageErrorString(err),
           ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
         });
-        console.warn(
-          JSON.stringify({
-            level: "warn",
-            event: "config.read_failed",
-            path: file,
-            message: toErrorMessage(err),
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
+        this.logWarn(
+          "Config read failed (read)",
+          { event: "config.read_failed", path: file, message: toErrorMessage(err) }
         );
       }
       this.jsonCache.set(file, { mtimeMs: null, value: {} });
@@ -6083,14 +6231,9 @@ var DefaultConfigLoader = class {
         error: "parse error or empty file",
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "config.parse_failed",
-          path: file,
-          message: "invalid JSON \u2014 falling back to defaults for this layer",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
+      this.logWarn(
+        "Config parse failed \u2014 falling back to defaults",
+        { event: "config.parse_failed", path: file }
       );
       return {};
     }
@@ -6137,8 +6280,9 @@ var DefaultConfigLoader = class {
     }
     if (c.mode !== void 0 && !isContextWindowModeId(c.mode)) {
       const known = listContextWindowModes().map((m) => m.id).join(", ");
-      console.warn(
-        `[config] Ignoring unknown context.mode "${c.mode}" (expected one of: ${known}); falling back to "${DEFAULT_CONTEXT_WINDOW_MODE_ID}".`
+      this.logWarn(
+        `Ignoring unknown context.mode "${c.mode}" \u2014 falling back to "${DEFAULT_CONTEXT_WINDOW_MODE_ID}"`,
+        { event: "config.unknown_context_mode", mode: c.mode, known }
       );
       c.mode = DEFAULT_CONTEXT_WINDOW_MODE_ID;
     }
@@ -6212,6 +6356,11 @@ function runConfigMigrations(input, targetVersion, migrations) {
   return { config: current, applied, shouldPersist };
 }
 var DEFAULT_CONFIG_MIGRATIONS = [];
+
+// src/storage/recovery-lock.ts
+import * as fsp7 from "node:fs/promises";
+import * as os2 from "node:os";
+import * as path14 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -6222,9 +6371,9 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path2.join(opts.dir, LOCK_FILE);
+    this.file = path14.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
-    this.hostname = opts.hostname ?? os.hostname();
+    this.hostname = opts.hostname ?? os2.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
     this.sessionStore = opts.sessionStore;
     this.probe = opts.isPidAlive ?? defaultIsPidAlive;
@@ -6283,7 +6432,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path14.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -6292,7 +6441,7 @@ var RecoveryLock = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await fsp4.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
+      await fsp7.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
     } catch (err) {
       const code = err.code;
       if (code === "EEXIST") {
@@ -6308,7 +6457,7 @@ var RecoveryLock = class {
    */
   async clear() {
     try {
-      await fsp4.unlink(this.file);
+      await fsp7.unlink(this.file);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return;
@@ -6318,7 +6467,7 @@ var RecoveryLock = class {
   async readLock() {
     let raw;
     try {
-      raw = await fsp4.readFile(this.file, "utf8");
+      raw = await fsp7.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return null;
@@ -6349,6 +6498,9 @@ function defaultIsPidAlive(pid) {
     return false;
   }
 }
+
+// src/storage/session-reader.ts
+import * as fs6 from "node:fs/promises";
 var DefaultSessionReader = class _DefaultSessionReader {
   store;
   eventCache = /* @__PURE__ */ new Map();
@@ -6366,7 +6518,7 @@ var DefaultSessionReader = class _DefaultSessionReader {
     const sessionPath = sessionScopedPath(rootDir, sessionId, ".jsonl");
     let mtimeMs = null;
     try {
-      const stat13 = await fsp4.stat(sessionPath);
+      const stat13 = await fs6.stat(sessionPath);
       mtimeMs = stat13.mtimeMs;
     } catch {
       this.eventCache.delete(sessionId);
@@ -6686,6 +6838,8 @@ function renderMarkdown(meta, events) {
         lines.push("");
         break;
       }
+      default:
+        break;
     }
   }
   return lines.join("\n");
@@ -6719,10 +6873,16 @@ function renderPlainText(meta, events) {
       case "error":
         lines.push(`[${e.ts}] ERROR (${e.phase}): ${e.message}`);
         break;
+      default:
+        break;
     }
   }
   return lines.join("\n");
 }
+
+// src/storage/annotations-store.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import * as fs7 from "node:fs/promises";
 var FILE_VERSION = 1;
 var MAX_TEXT_LENGTH = 2e3;
 var MAX_ANNOTATIONS = 1e3;
@@ -6730,12 +6890,14 @@ var AnnotationsStore = class {
   dir;
   events;
   traceId;
+  maxAnnotations;
   /** Per-session write queue. Created lazily on first add. */
   writeChains = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.dir = opts.dir;
     this.events = opts.events;
     this.traceId = opts.traceId;
+    this.maxAnnotations = opts.maxAnnotations ?? MAX_ANNOTATIONS;
   }
   // ── Reads ──────────────────────────────────────────────────────────────
   /**
@@ -6817,7 +6979,7 @@ var AnnotationsStore = class {
       });
     }
     const annotation = {
-      id: randomUUID(),
+      id: randomUUID3(),
       sessionId: input.sessionId,
       atEventIndex: input.atEventIndex,
       authorId: input.authorId,
@@ -6833,12 +6995,12 @@ var AnnotationsStore = class {
         await withFileLock(fp, async () => {
           const all = await this.list(input.sessionId);
           all.push(annotation);
-          if (all.length > MAX_ANNOTATIONS) {
+          if (all.length > this.maxAnnotations) {
             const sorted = all.map((a, i) => ({ a, i })).sort((x, y) => {
               if (x.a.resolved !== y.a.resolved) return x.a.resolved ? 1 : -1;
               return x.a.createdAt.localeCompare(y.a.createdAt);
             });
-            const evictCount = all.length - MAX_ANNOTATIONS;
+            const evictCount = all.length - this.maxAnnotations;
             const toEvict = new Set(sorted.slice(0, evictCount).map((s) => s.a.id));
             const kept = all.filter((a) => !toEvict.has(a.id));
             await this.writeFile(input.sessionId, { version: FILE_VERSION, annotations: kept });
@@ -6947,7 +7109,7 @@ var AnnotationsStore = class {
     const fp = this.filePath(sessionId);
     let raw;
     try {
-      raw = await fsp4.readFile(fp, "utf8");
+      raw = await fs7.readFile(fp, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err;
@@ -6982,6 +7144,13 @@ var AnnotationsStore = class {
     return next;
   }
 };
+
+// src/storage/replay-log-store.ts
+import * as fs8 from "node:fs/promises";
+import * as path15 from "node:path";
+
+// src/replay/hash.ts
+import { createHash as createHash5 } from "node:crypto";
 function stableStringify(value) {
   return JSON.stringify(sortKeys(value));
 }
@@ -7010,7 +7179,7 @@ function hashRequest(request) {
     toolChoice: request.toolChoice
   };
   const json = stableStringify(payload);
-  const digest = createHash("sha256").update(json, "utf8").digest("hex");
+  const digest = createHash5("sha256").update(json, "utf8").digest("hex");
   return `sha256:${digest}`;
 }
 
@@ -7022,6 +7191,7 @@ function storageErrorString2(err) {
   }
   return String(err);
 }
+var FILE_VERSION2 = 1;
 var DEFAULT_MAX_ENTRIES = 1e3;
 var ReplayLogStore = class {
   dir;
@@ -7066,12 +7236,12 @@ var ReplayLogStore = class {
             const line = JSON.stringify(entry) + "\n";
             let offset2 = 0;
             try {
-              const stat13 = await fsp4.stat(fp);
+              const stat13 = await fs8.stat(fp);
               offset2 = stat13.size;
             } catch (err) {
               if (err.code !== "ENOENT") throw err;
             }
-            await fsp4.appendFile(fp, line, "utf8");
+            await fs8.appendFile(fp, line, "utf8");
             cache.set(hash, { entry, offset: offset2, length: Buffer.byteLength(line, "utf8") });
             this.diskCount.set(input.sessionId, currentCount + 1);
             this.events?.emit("storage.write", {
@@ -7199,7 +7369,7 @@ var ReplayLogStore = class {
     const scan = async (dir, prefix, depth) => {
       let entries;
       try {
-        entries = await fsp4.readdir(dir, { withFileTypes: true });
+        entries = await fs8.readdir(dir, { withFileTypes: true });
       } catch (err) {
         if (depth === 0 && err.code !== "ENOENT") {
           console.warn(JSON.stringify({
@@ -7215,13 +7385,13 @@ var ReplayLogStore = class {
       for (const entry of entries) {
         if (entry.name.startsWith(".")) continue;
         if (entry.isDirectory()) {
-          if (depth === 0) await scan(path2.join(dir, entry.name), entry.name, depth + 1);
+          if (depth === 0) await scan(path15.join(dir, entry.name), entry.name, depth + 1);
           continue;
         }
         if (!entry.isFile() || !entry.name.endsWith(".replay.jsonl")) continue;
         const base = entry.name.slice(0, -".replay.jsonl".length);
         const sessionId = prefix ? `${prefix}/${base}` : base;
-        const fp = path2.join(dir, entry.name);
+        const fp = path15.join(dir, entry.name);
         out.push({
           sessionId,
           entryCount: await this.countEntries(fp),
@@ -7237,7 +7407,7 @@ var ReplayLogStore = class {
     return sessionScopedPath(this.dir, sessionId, ".replay.jsonl");
   }
   async countEntries(filePath) {
-    const handle = await fsp4.open(filePath, "r");
+    const handle = await fs8.open(filePath, "r");
     const buffer = Buffer.allocUnsafe(64 * 1024);
     let count = 0;
     let hasNonWhitespace2 = false;
@@ -7278,7 +7448,7 @@ var ReplayLogStore = class {
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
     try {
-      const raw = await fsp4.readFile(fp, "utf8");
+      const raw = await fs8.readFile(fp, "utf8");
       const out = [];
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
@@ -7306,6 +7476,7 @@ var ReplayLogStore = class {
       durationMs,
       ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
     });
+    void FILE_VERSION2;
   }
   async ensureCache(sessionId) {
     let cache = this.cache.get(sessionId);
@@ -7313,7 +7484,7 @@ var ReplayLogStore = class {
     const fp = this.filePath(sessionId);
     cache = /* @__PURE__ */ new Map();
     try {
-      const handle = await fsp4.open(fp, "r");
+      const handle = await fs8.open(fp, "r");
       const CHUNK = 64 * 1024;
       const buffer = Buffer.alloc(CHUNK);
       let leftover = "";
@@ -7364,7 +7535,7 @@ var ReplayLogStore = class {
   async hydrateEntry(sessionId, hash, location) {
     if (location.entry) return location.entry;
     const fp = this.filePath(sessionId);
-    const handle = await fsp4.open(fp, "r");
+    const handle = await fs8.open(fp, "r");
     try {
       const buffer = Buffer.alloc(location.length);
       const { bytesRead } = await handle.read(buffer, 0, location.length, location.offset);
@@ -7389,6 +7560,10 @@ var ReplayLogStore = class {
     return next;
   }
 };
+
+// src/storage/session-recovery.ts
+import * as fs9 from "node:fs/promises";
+import * as path16 from "node:path";
 var SessionRecovery = class {
   constructor(dir) {
     this.dir = dir;
@@ -7414,7 +7589,7 @@ var SessionRecovery = class {
     const fp = this.filePath(sessionId);
     let stat13;
     try {
-      stat13 = await fsp4.stat(fp);
+      stat13 = await fs9.stat(fp);
     } catch (err) {
       if (err.code === "ENOENT") return null;
       return null;
@@ -7448,7 +7623,7 @@ var SessionRecovery = class {
     const fp = this.filePath(sessionId);
     let raw;
     try {
-      raw = await fsp4.readFile(fp, "utf8");
+      raw = await fs9.readFile(fp, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       return null;
@@ -7493,7 +7668,7 @@ var SessionRecovery = class {
     const collect = async (dir, prefix, depth) => {
       let entries;
       try {
-        entries = await fsp4.readdir(dir, { withFileTypes: true });
+        entries = await fs9.readdir(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -7503,7 +7678,7 @@ var SessionRecovery = class {
           continue;
         if (entry.isDirectory()) {
           if (depth === 0) {
-            await collect(path2.join(dir, entry.name), entry.name, depth + 1);
+            await collect(path16.join(dir, entry.name), entry.name, depth + 1);
           }
           continue;
         }
@@ -7544,7 +7719,7 @@ function hasNonWhitespace(line) {
 }
 async function scanLatestLifecycleBoundary(filePath, size) {
   const CHUNK_SIZE = 64 * 1024;
-  const handle = await fsp4.open(filePath, "r");
+  const handle = await fs9.open(filePath, "r");
   let position = size;
   let laterLineFragment = Buffer.alloc(0);
   let latestBoundary = null;
@@ -7580,6 +7755,10 @@ async function scanLatestLifecycleBoundary(filePath, size) {
     await handle.close();
   }
 }
+
+// src/storage/tool-audit-log.ts
+import { createHash as createHash6, randomUUID as randomUUID4 } from "node:crypto";
+import * as fs10 from "node:fs/promises";
 var GENESIS_PREV = "0".repeat(64);
 var DEFAULT_FSYNC_EVERY = 100;
 var ToolAuditLog = class {
@@ -7623,7 +7802,7 @@ var ToolAuditLog = class {
           const tip = await this._resolveChainTip(input.sessionId, fp);
           const prevHash = tip.prevHash;
           const index = tip.nextIndex;
-          const id = randomUUID();
+          const id = randomUUID4();
           const ts = (/* @__PURE__ */ new Date()).toISOString();
           const content = {
             id,
@@ -7636,7 +7815,7 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          const hash = createHash("sha256").update(stableStringify2(content), "utf8").digest("hex");
+          const hash = createHash6("sha256").update(stableStringify2(content), "utf8").digest("hex");
           entry = {
             id,
             ts,
@@ -7649,9 +7828,9 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          await fsp4.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
+          await fs10.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
           try {
-            const st = await fsp4.stat(fp);
+            const st = await fs10.stat(fp);
             this.tailStat.set(input.sessionId, { mtimeMs: st.mtimeMs, size: st.size });
           } catch {
           }
@@ -7698,7 +7877,7 @@ var ToolAuditLog = class {
     const cachedStat = this.tailStat.get(sessionId);
     if (cachedHash !== void 0 && cachedIndex !== void 0 && cachedStat) {
       try {
-        const st = await fsp4.stat(fp);
+        const st = await fs10.stat(fp);
         if (st.mtimeMs === cachedStat.mtimeMs && st.size === cachedStat.size) {
           return { prevHash: cachedHash, nextIndex: cachedIndex };
         }
@@ -7719,7 +7898,7 @@ var ToolAuditLog = class {
     this.tailHash.set(sessionId, prevHash);
     this.tailIndex.set(sessionId, nextIndex);
     try {
-      const st = await fsp4.stat(fp);
+      const st = await fs10.stat(fp);
       this.tailStat.set(sessionId, { mtimeMs: st.mtimeMs, size: st.size });
     } catch {
     }
@@ -7778,7 +7957,7 @@ var ToolAuditLog = class {
           isError: e.isError,
           index: e.index
         };
-        const expectedHash = createHash("sha256").update(stableStringify2(content), "utf8").digest("hex");
+        const expectedHash = createHash6("sha256").update(stableStringify2(content), "utf8").digest("hex");
         if (expectedHash !== e.hash) {
           return {
             ok: false,
@@ -7840,7 +8019,7 @@ var ToolAuditLog = class {
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
     try {
-      const raw = await fsp4.readFile(fp, "utf8");
+      const raw = await fs10.readFile(fp, "utf8");
       const out = [];
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
@@ -7878,7 +8057,7 @@ var ToolAuditLog = class {
   }
   async sync(sessionId, fp) {
     try {
-      const fh = await fsp4.open(fp, "r+");
+      const fh = await fs10.open(fp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -8014,10 +8193,17 @@ var SessionAnalyzer = class {
     return last - first;
   }
 };
+
+// src/session-registry.ts
+import * as fs11 from "node:fs/promises";
+import * as path17 from "node:path";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var REGISTRY_FILE = "session-registry.json";
 var HEARTBEAT_INTERVAL_MS = 5e3;
 var STALE_TIMEOUT_MS = 3e4;
 var CLOSING_GRACE_MS = 15e3;
+var LOST_GRACE_MS = 3e4;
+var AGENT_STALE_MS = 5 * 6e4;
 var STALE_LOCK_MS = 1e4;
 var STALE_TMP_MS = 6e4;
 var MAX_STALE_TMP_FILES = 20;
@@ -8029,6 +8215,16 @@ function pidAlive(pid) {
     return false;
   }
 }
+function parseRegistry(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
 var SessionRegistry = class {
   filePath;
   heartbeatTimer = null;
@@ -8040,7 +8236,7 @@ var SessionRegistry = class {
    */
   lastEntry = null;
   constructor(globalRoot) {
-    this.filePath = path2.join(globalRoot, REGISTRY_FILE);
+    this.filePath = path17.join(globalRoot, REGISTRY_FILE);
   }
   // ── Public API ──────────────────────────────────────────────────────────
   /**
@@ -8196,24 +8392,43 @@ var SessionRegistry = class {
   }
   async readAndPrune() {
     try {
-      const raw = await fsp4.readFile(this.filePath, "utf8");
-      const registry = JSON.parse(raw);
+      const raw = await fs11.readFile(this.filePath, "utf8");
+      const registry = parseRegistry(raw);
       const now = Date.now();
       let pruned = false;
       for (const [id, entry] of Object.entries(registry)) {
-        const heartbeatAge = now - new Date(entry.lastHeartbeatAt).getTime();
+        const heartbeatAt = Date.parse(entry.lastHeartbeatAt);
+        if (!Number.isFinite(heartbeatAt)) {
+          delete registry[id];
+          pruned = true;
+          continue;
+        }
+        const heartbeatAge = now - heartbeatAt;
+        const agents = Array.isArray(entry.agents) ? entry.agents : [];
+        const liveAgents = agents.filter((agent) => {
+          if (agent.id === "leader") return true;
+          const lastActivityAt = Date.parse(agent.lastActivityAt);
+          return Number.isFinite(lastActivityAt) && now - lastActivityAt <= AGENT_STALE_MS;
+        });
+        if (liveAgents.length !== agents.length || entry.agentCount !== liveAgents.length) {
+          entry.agents = liveAgents;
+          entry.agentCount = liveAgents.length;
+          pruned = true;
+        }
         if (entry.status === "closing" && heartbeatAge > CLOSING_GRACE_MS) {
           delete registry[id];
           pruned = true;
           continue;
         }
-        if (heartbeatAge > STALE_TIMEOUT_MS && !pidAlive(entry.pid)) {
-          entry.status = "stale";
-          const startedAge = now - new Date(entry.startedAt).getTime();
-          if (startedAge > 5 * 6e4) {
-            delete registry[id];
-            pruned = true;
-          }
+        if (heartbeatAge <= STALE_TIMEOUT_MS) continue;
+        if (!pidAlive(entry.pid) || heartbeatAge > STALE_TIMEOUT_MS + LOST_GRACE_MS) {
+          delete registry[id];
+          pruned = true;
+          continue;
+        }
+        if (entry.status !== "lost") {
+          entry.status = "lost";
+          pruned = true;
         }
       }
       if (pruned) {
@@ -8230,11 +8445,11 @@ var SessionRegistry = class {
     const retryDelayMs = 20;
     for (let attempt = 0; attempt < maxRetries; attempt++) {
       try {
-        await fsp4.mkdir(path2.dirname(this.filePath), { recursive: true });
-        let lockHandle = await fsp4.open(lockPath, "wx").catch(() => null);
+        await fs11.mkdir(path17.dirname(this.filePath), { recursive: true });
+        let lockHandle = await fs11.open(lockPath, "wx").catch(() => null);
         if (!lockHandle) {
           if (await this.breakStaleLock(lockPath)) {
-            lockHandle = await fsp4.open(lockPath, "wx").catch(() => null);
+            lockHandle = await fs11.open(lockPath, "wx").catch(() => null);
           }
           if (!lockHandle) {
             await new Promise((r) => setTimeout(r, retryDelayMs * (attempt + 1)));
@@ -8243,14 +8458,14 @@ var SessionRegistry = class {
         }
         try {
           await lockHandle.writeFile(String(process.pid)).catch(() => void 0);
-          const raw = await fsp4.readFile(this.filePath, "utf8").catch(() => "{}");
-          const registry = JSON.parse(raw);
+          const raw = await fs11.readFile(this.filePath, "utf8").catch(() => "{}");
+          const registry = parseRegistry(raw);
           fn(registry);
           await this.writeAtomicLocked(registry);
           return;
         } finally {
           await lockHandle.close();
-          await fsp4.unlink(lockPath).catch(() => void 0);
+          await fs11.unlink(lockPath).catch(() => void 0);
         }
       } catch {
         return;
@@ -8267,16 +8482,16 @@ var SessionRegistry = class {
   async breakStaleLock(lockPath) {
     try {
       const [stat13, content] = await Promise.all([
-        fsp4.stat(lockPath),
+        fs11.stat(lockPath),
         /* v8 ignore start -- best-effort lock-content read; .catch only fires if the lock vanished */
-        fsp4.readFile(lockPath, "utf8").catch(() => "")
+        fs11.readFile(lockPath, "utf8").catch(() => "")
         /* v8 ignore stop */
       ]);
       const ageMs = Date.now() - stat13.mtimeMs;
       const ownerPid = Number.parseInt(content.trim(), 10);
       const ownerDead = Number.isInteger(ownerPid) && ownerPid > 0 && ownerPid !== process.pid && !pidAlive(ownerPid);
       if (ownerDead || ageMs > STALE_LOCK_MS) {
-        await fsp4.unlink(lockPath).catch(() => void 0);
+        await fs11.unlink(lockPath).catch(() => void 0);
         return true;
       }
       return false;
@@ -8294,35 +8509,41 @@ var SessionRegistry = class {
     await this.writeAtomicFile(registry);
   }
   async writeAtomicFile(registry) {
-    const tmp = path2.join(
-      path2.dirname(this.filePath),
-      `.${path2.basename(this.filePath)}.${randomUUID().slice(0, 8)}.tmp`
+    const tmp = path17.join(
+      path17.dirname(this.filePath),
+      `.${path17.basename(this.filePath)}.${randomUUID5().slice(0, 8)}.tmp`
     );
     try {
-      await fsp4.writeFile(tmp, JSON.stringify(registry, null, 2), "utf8");
-      await fsp4.rename(tmp, this.filePath);
+      const handle = await fs11.open(tmp, "w");
+      try {
+        await handle.writeFile(JSON.stringify(registry, null, 2), "utf8");
+        await handle.sync().catch(() => void 0);
+      } finally {
+        await handle.close();
+      }
+      await fs11.rename(tmp, this.filePath);
     } catch (err) {
-      await fsp4.unlink(tmp).catch(() => void 0);
+      await fs11.unlink(tmp).catch(() => void 0);
       throw err;
     }
   }
   async pruneStaleTempFiles() {
     try {
-      const dir = path2.dirname(this.filePath);
-      const base = path2.basename(this.filePath);
+      const dir = path17.dirname(this.filePath);
+      const base = path17.basename(this.filePath);
       const now = Date.now();
       const stale = [];
-      for (const name of await fsp4.readdir(dir)) {
+      for (const name of await fs11.readdir(dir)) {
         const isTemp = (name.startsWith(`${base}.`) || name.startsWith(`.${base}.`)) && name.endsWith(".tmp");
         if (!isTemp) continue;
-        const stat13 = await fsp4.stat(path2.join(dir, name)).catch(() => null);
+        const stat13 = await fs11.stat(path17.join(dir, name)).catch(() => null);
         if (!stat13) continue;
         if (now - stat13.mtimeMs > STALE_TMP_MS) stale.push({ name, mtimeMs: stat13.mtimeMs });
       }
       stale.sort((a, b) => b.mtimeMs - a.mtimeMs);
       await Promise.all(
         stale.slice(MAX_STALE_TMP_FILES).map(async ({ name }) => {
-          await fsp4.unlink(path2.join(dir, name)).catch(() => void 0);
+          await fs11.unlink(path17.join(dir, name)).catch(() => void 0);
         })
       );
     } catch {
@@ -8617,6 +8838,13 @@ var AgentStatusTracker = class {
         if (this.agents.delete(p.subagentId)) this.flush();
       })
     );
+    this.unsubscribers.push(
+      on("subagent.removed", (_e, payload) => {
+        const p = payload;
+        if (!p?.subagentId) return;
+        if (this.agents.delete(p.subagentId)) this.flush();
+      })
+    );
     this.sweepTimer = setInterval(() => this.sweep(), AGENT_SWEEP_INTERVAL_MS);
     if (typeof this.sweepTimer.unref === "function") this.sweepTimer.unref();
   }
@@ -8729,6 +8957,10 @@ var AgentStatusTracker = class {
     }
   }
 };
+
+// src/fleet-notifier.ts
+import * as fs12 from "node:fs/promises";
+import * as path18 from "node:path";
 var INSTANCES_FILE = "webui-instances.json";
 var DISCOVERY_TTL_MS = 2500;
 var COALESCE_MS = 50;
@@ -8743,7 +8975,7 @@ function pidAlive2(pid) {
   }
 }
 function normRoot(root) {
-  const resolved = path2.resolve(root);
+  const resolved = path18.resolve(root);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 var FleetNotifier = class {
@@ -8790,7 +9022,7 @@ var FleetNotifier = class {
   }
   async discover() {
     try {
-      const raw = await fsp4.readFile(path2.join(this.baseDir, INSTANCES_FILE), "utf8");
+      const raw = await fs12.readFile(path18.join(this.baseDir, INSTANCES_FILE), "utf8");
       const data = JSON.parse(raw);
       const list = Array.isArray(data?.instances) ? data.instances : [];
       return list.filter((i) => i && typeof i.httpPort === "number").filter((i) => i.pid !== this.selfPid).filter((i) => normRoot(i.projectRoot) === this.projectRoot).filter((i) => pidAlive2(i.pid)).map((i) => {
@@ -8808,6 +9040,10 @@ async function defaultPost(url) {
     signal: AbortSignal.timeout(POST_TIMEOUT_MS)
   });
 }
+
+// src/storage/session-rewinder.ts
+import * as fsp8 from "node:fs/promises";
+import * as path19 from "node:path";
 var DefaultSessionRewinder = class {
   constructor(sessionsDir, projectRoot) {
     this.sessionsDir = sessionsDir;
@@ -8820,7 +9056,7 @@ var DefaultSessionRewinder = class {
   }
   async listCheckpoints(sessionId) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     const fileCountMap = /* @__PURE__ */ new Map();
     for (const event of events) {
@@ -8845,7 +9081,7 @@ var DefaultSessionRewinder = class {
   }
   async rewindToCheckpoint(sessionId, checkpointIndex) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     let targetIdx = -1;
     for (let i = 0; i < events.length; i++) {
@@ -8884,7 +9120,7 @@ var DefaultSessionRewinder = class {
   }
   async rewindLastN(sessionId, n) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     const checkpoints = [];
     for (const event of events) {
@@ -8913,7 +9149,7 @@ var DefaultSessionRewinder = class {
   }
   async rewindToStart(sessionId) {
     const file = this.sessionFile(sessionId);
-    const raw = await fsp4.readFile(file, "utf8");
+    const raw = await fsp8.readFile(file, "utf8");
     const events = parseEvents(raw);
     const allSnapshots = [];
     for (const event of events) {
@@ -8948,10 +9184,10 @@ async function revertSnapshots(snapshots, projectRoot) {
   for (const snapshot of [...snapshots].reverse()) {
     for (const file of [...snapshot.files].reverse()) {
       try {
-        const absPath = path2.resolve(file.path);
-        const root = path2.resolve(projectRoot);
-        const rel = path2.relative(root, absPath);
-        if (rel.startsWith("..") || path2.isAbsolute(rel)) {
+        const absPath = path19.resolve(file.path);
+        const root = path19.resolve(projectRoot);
+        const rel = path19.relative(root, absPath);
+        if (rel.startsWith("..") || path19.isAbsolute(rel)) {
           errors.push(`${file.path}: path resolves outside project root \u2014 skipping`);
           continue;
         }
@@ -8961,7 +9197,7 @@ async function revertSnapshots(snapshots, projectRoot) {
             revertedFiles.push(file.path);
           }
         } else if (file.action === "created") {
-          await fsp4.unlink(file.path);
+          await fsp8.unlink(file.path);
           revertedFiles.push(file.path);
         } else if (file.action === "modified") {
           if (file.before !== null) {
@@ -8976,11 +9212,14 @@ async function revertSnapshots(snapshots, projectRoot) {
   }
   return { revertedFiles, errors };
 }
+
+// src/storage/todos-checkpoint.ts
+import * as fsp9 from "node:fs/promises";
 async function loadTodosCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp9.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -9034,7 +9273,7 @@ async function loadTodosCheckpoint(filePath, events, traceId) {
     return null;
   }
 }
-async function saveTodosCheckpoint(filePath, sessionId, todos, events, traceId) {
+async function saveTodosCheckpoint(filePath, sessionId, todos, events, traceId, warn) {
   const t0 = Date.now();
   const payload = {
     version: 1,
@@ -9063,28 +9302,17 @@ async function saveTodosCheckpoint(filePath, sessionId, todos, events, traceId)
       error: toErrorMessage(err),
       recoverable: false
     });
-    console.warn(JSON.stringify({
-      level: "warn",
-      event: "todos_checkpoint.save_failed",
-      message: toErrorMessage(err),
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }));
+    (warn ?? ((m) => console.warn(JSON.stringify({ level: "warn", event: "todos_checkpoint.save_failed", message: m, timestamp: (/* @__PURE__ */ new Date()).toISOString() }))))(toErrorMessage(err));
   }
 }
-function attachTodosCheckpoint(state, filePath, sessionId, events, traceId) {
+function attachTodosCheckpoint(state, filePath, sessionId, events, traceId, warn) {
   let timer = null;
   let pending = null;
   let writeChain = Promise.resolve();
   const enqueueWrite = (todos) => {
     writeChain = writeChain.then(() => saveTodosCheckpoint(filePath, sessionId, todos, events, traceId)).catch((err) => {
       const msg = toErrorMessage(err);
-      console.error(JSON.stringify({
-        level: "error",
-        event: "todos_checkpoint.write_chain_failed",
-        sessionId,
-        message: msg,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      (warn ?? ((m) => console.error(JSON.stringify({ level: "error", event: "todos_checkpoint.write_chain_failed", sessionId, message: m, timestamp: (/* @__PURE__ */ new Date()).toISOString() }))))(msg);
     });
     return writeChain;
   };
@@ -9115,11 +9343,14 @@ function attachTodosCheckpoint(state, filePath, sessionId, events, traceId) {
     }
   };
 }
+
+// src/storage/completed-work-checkpoint.ts
+import * as fsp10 from "node:fs/promises";
 async function loadCompletedWorkCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp10.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -9213,11 +9444,15 @@ function isCompletedWorkEvidence(value) {
   const item = value;
   return typeof item.key === "string" && typeof item.source === "string" && ["todo", "plan", "task", "verification", "manual"].includes(item.source) && typeof item.summary === "string" && typeof item.completedAt === "number" && (item.evidence === void 0 || typeof item.evidence === "string");
 }
+
+// src/storage/plan-store.ts
+import * as fsp11 from "node:fs/promises";
+import { randomUUID as randomUUID6 } from "node:crypto";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp11.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: "~boot~",
@@ -9265,7 +9500,7 @@ async function loadPlan(filePath, events) {
     return null;
   }
 }
-async function savePlan(filePath, plan, events) {
+async function savePlan(filePath, plan, events, warn) {
   const t0 = Date.now();
   try {
     await atomicWrite(filePath, JSON.stringify(plan, null, 2), { mode: 384 });
@@ -9287,10 +9522,14 @@ async function savePlan(filePath, plan, events) {
       error: toErrorMessage(err),
       recoverable: false
     });
-    console.warn(
-      "[plan-store] save failed:",
-      toErrorMessage(err)
-    );
+    (warn ?? ((m) => console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "plan_store.save_failed",
+        message: m,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    )))(toErrorMessage(err));
     return false;
   }
 }
@@ -9306,7 +9545,7 @@ function emptyPlan(sessionId, title) {
 function addPlanItem(plan, title, details) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const item = {
-    id: `plan_${Date.now()}_${randomUUID().slice(0, 6)}`,
+    id: `plan_${Date.now()}_${randomUUID6().slice(0, 6)}`,
     title,
     details,
     status: "open",
@@ -9331,9 +9570,7 @@ function setPlanItemStatus(plan, idOrIndex, status) {
   const idx = matchIndex(plan, idOrIndex);
   if (idx === -1) return plan;
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const items = plan.items.map(
-    (it, i) => i === idx ? { ...it, status, updatedAt: now } : it
-  );
+  const items = plan.items.map((it, i) => i === idx ? { ...it, status, updatedAt: now } : it);
   return { ...plan, items, updatedAt: now };
 }
 function clearPlan(plan) {
@@ -9380,7 +9617,7 @@ function deriveTodosFromPlanItem(plan, idOrIndex, subtasks) {
   if (subtasks && subtasks.length > 0) {
     for (const st of subtasks) {
       todos.push({
-        id: `todo_${Date.now()}_${randomUUID().slice(0, 6)}`,
+        id: `todo_${Date.now()}_${randomUUID6().slice(0, 6)}`,
         content: st,
         status: "pending",
         promotedFromPlan: item.id
@@ -9521,6 +9758,9 @@ ${cat}:`);
   }
   return lines.join("\n");
 }
+
+// src/storage/task-store.ts
+import * as fsp12 from "node:fs/promises";
 function emptyTaskFile(sessionId) {
   return {
     version: 1,
@@ -9533,7 +9773,7 @@ async function loadTasks(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp12.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -9585,7 +9825,7 @@ async function loadTasks(filePath, events, traceId) {
     return null;
   }
 }
-async function saveTasks(filePath, tasks, events, traceId) {
+async function saveTasks(filePath, tasks, events, traceId, warn) {
   const t0 = Date.now();
   try {
     tasks.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -9611,10 +9851,14 @@ async function saveTasks(filePath, tasks, events, traceId) {
       recoverable: false,
       ...traceId !== void 0 && { traceId }
     });
-    console.warn(
-      "[task-store] save failed:",
-      toErrorMessage(err)
-    );
+    (warn ?? ((m) => console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "task_store.save_failed",
+        message: m,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    )))(toErrorMessage(err));
     return false;
   }
 }
@@ -9634,10 +9878,14 @@ async function mutateTasks(filePath, sessionId, fn, events, traceId) {
     return updated;
   });
 }
+
+// src/storage/director-state.ts
+import * as fsp13 from "node:fs/promises";
+import { hostname as hostname2 } from "node:os";
 async function loadDirectorState(filePath) {
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp13.readFile(filePath, "utf8");
   } catch {
     return null;
   }
@@ -9652,7 +9900,7 @@ async function loadDirectorState(filePath) {
 async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   let existing;
   try {
-    existing = await fsp4.readFile(lockPath, "utf8");
+    existing = await fsp13.readFile(lockPath, "utf8");
   } catch {
   }
   if (existing) {
@@ -9668,7 +9916,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   }
   const lock = {
     pid: processId,
-    hostname: hostname(),
+    hostname: hostname2(),
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await atomicWrite(lockPath, JSON.stringify(lock), { mode: 384 });
@@ -9676,7 +9924,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
 }
 async function releaseDirectorStateLock(lockPath) {
   try {
-    await fsp4.unlink(lockPath);
+    await fsp13.unlink(lockPath);
   } catch {
   }
 }
@@ -9831,15 +10079,18 @@ var DirectorStateCheckpoint = class {
     }
   }
 };
+
+// src/storage/goal-store.ts
+import * as fsp14 from "node:fs/promises";
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
   return resolveWstackPaths({ projectRoot }).projectGoal;
 }
-async function loadGoal(filePath, events) {
+async function loadGoal(filePath, events, warn) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp4.readFile(filePath, "utf8");
+    raw = await fsp14.readFile(filePath, "utf8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -9866,13 +10117,9 @@ async function loadGoal(filePath, events) {
   try {
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || typeof parsed.goal !== "string" || !Array.isArray(parsed.journal)) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "goal_store.invalid_schema",
-        path: filePath,
-        message: "invalid schema \u2014 consider deleting and re-creating",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      (warn ?? ((msg) => console.warn(JSON.stringify({ level: "warn", event: "goal_store.invalid_schema", path: filePath, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }))))(
+        "invalid schema \u2014 consider deleting and re-creating"
+      );
       events?.emit("storage.read", {
         sessionId: "~boot~",
         store: "goal",
@@ -9894,13 +10141,9 @@ async function loadGoal(filePath, events) {
     });
     return parsed;
   } catch {
-    console.warn(JSON.stringify({
-      level: "warn",
-      event: "goal_store.parse_failed",
-      path: filePath,
-      message: "JSON parse failed \u2014 consider deleting and re-creating",
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }));
+    (warn ?? ((msg) => console.warn(JSON.stringify({ level: "warn", event: "goal_store.parse_failed", path: filePath, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }))))(
+      "JSON parse failed \u2014 consider deleting and re-creating"
+    );
     events?.emit("storage.read", {
       sessionId: "~boot~",
       store: "goal",
@@ -10083,9 +10326,14 @@ function computeTrend(history) {
   if (avgDelta < -1) return "stalling";
   return "steady";
 }
+
+// src/storage/prompt-store.ts
+import { createHash as createHash7 } from "node:crypto";
+import * as fs13 from "node:fs/promises";
+import * as path20 from "node:path";
 var SCHEMA_VERSION = 2;
 function promptChecksum(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
+  return createHash7("sha256").update(content, "utf8").digest("hex");
 }
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -10146,12 +10394,12 @@ var DefaultPromptStore = class {
     await ensureDir(this.dir);
     const entries = [];
     try {
-      const files = await fsp4.readdir(this.dir);
+      const files = await fs13.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp4.readFile(path2.join(this.dir, file), "utf8")
+            await fs13.readFile(path20.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -10165,9 +10413,9 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path2.join(this.dir, `${id}.json`);
+    const file = path20.join(this.dir, `${id}.json`);
     try {
-      const raw = JSON.parse(await fsp4.readFile(file, "utf8"));
+      const raw = JSON.parse(await fs13.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
     } catch {
       return null;
@@ -10175,14 +10423,14 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path2.join(this.dir, `${entry.id}.json`);
+    const file = path20.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path2.join(this.dir, `${id}.json`);
+    const file = path20.join(this.dir, `${id}.json`);
     try {
-      await fsp4.unlink(file);
+      await fs13.unlink(file);
       return true;
     } catch {
       return false;
@@ -10219,6 +10467,10 @@ var DefaultPromptStore = class {
     };
   }
 };
+
+// src/storage/prompt-usage-store.ts
+import * as fs14 from "node:fs/promises";
+import * as path21 from "node:path";
 var PromptUsageStore = class {
   constructor(file) {
     this.file = file;
@@ -10226,7 +10478,7 @@ var PromptUsageStore = class {
   file;
   async load() {
     try {
-      const raw = JSON.parse(await fsp4.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs14.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && raw.usage && typeof raw.usage === "object") {
         return raw.usage;
       }
@@ -10239,7 +10491,7 @@ var PromptUsageStore = class {
     const prev = usage[slug];
     const next = { count: (prev?.count ?? 0) + 1, lastUsedAt: at };
     usage[slug] = next;
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path21.dirname(this.file));
     await atomicWrite(this.file, JSON.stringify({ version: 1, usage }, null, 2));
     return next;
   }
@@ -10261,6 +10513,10 @@ var PromptUsageStore = class {
     ).slice(0, limit);
   }
 };
+
+// src/storage/input-history-store.ts
+import * as fs15 from "node:fs/promises";
+import * as path22 from "node:path";
 var INPUT_HISTORY_DEFAULT_MAX = 100;
 var InputHistoryStore = class {
   /**
@@ -10282,7 +10538,7 @@ var InputHistoryStore = class {
    */
   async load() {
     try {
-      const raw = JSON.parse(await fsp4.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs15.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && Array.isArray(raw.entries) && raw.entries.every((e) => typeof e === "string")) {
         return raw.entries.slice(0, this.maxEntries);
       }
@@ -10299,7 +10555,7 @@ var InputHistoryStore = class {
    */
   async save(entries) {
     const cleaned = this.scrubAndFilter(entries);
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path22.dirname(this.file));
     const payload = {
       version: 1,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -10309,7 +10565,7 @@ var InputHistoryStore = class {
   }
   /** Truncate the file to an empty entry list (used by /clear). */
   async clear() {
-    await ensureDir(path2.dirname(this.file));
+    await ensureDir(path22.dirname(this.file));
     const payload = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: [] };
     await atomicWrite(this.file, JSON.stringify(payload, null, 2));
   }
@@ -10337,13 +10593,18 @@ var InputHistoryStore = class {
     return text.includes("***REDACTED***");
   }
 };
+
+// src/storage/cloud-sync.ts
+import * as fs16 from "node:fs/promises";
+import * as path23 from "node:path";
+import { createHash as createHash8 } from "node:crypto";
 var ALL_SYNC_CATEGORIES = ["settings", "skills", "prompts", "memory", "history"];
 var CloudSync = class {
   constructor(paths, getConfig, setConfig) {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path2.join(paths.globalRoot, "sync-state.json");
+    this.statePath = path23.join(paths.globalRoot, "sync-state.json");
   }
   paths;
   getConfig;
@@ -10418,7 +10679,7 @@ var CloudSync = class {
       lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
       localRev: rev
     };
-    await fsp4.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
+    await fs16.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
     this.state = syncState;
     return {
       ok: true,
@@ -10450,8 +10711,8 @@ var CloudSync = class {
       const rel = segments.slice(2).join("/");
       const destPath = resolvePulledCategoryPath(cat, localPath, rel, entry.path);
       const blobData = await this.getBlob(token, owner, repoName, entry.sha);
-      await fsp4.mkdir(path2.dirname(destPath), { recursive: true });
-      await fsp4.writeFile(destPath, Buffer.from(blobData, "base64"));
+      await fs16.mkdir(path23.dirname(destPath), { recursive: true });
+      await fs16.writeFile(destPath, Buffer.from(blobData, "base64"));
     }
     const localRev = await this.hashLocalCategories(cfg.categories);
     const syncState = {
@@ -10460,7 +10721,7 @@ var CloudSync = class {
       lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
       localRev
     };
-    await fsp4.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
+    await fs16.writeFile(this.statePath, JSON.stringify(syncState, null, 2), "utf8");
     this.state = syncState;
     return {
       ok: true,
@@ -10479,7 +10740,7 @@ var CloudSync = class {
   }
   async loadState() {
     try {
-      const raw = await fsp4.readFile(this.statePath, "utf8");
+      const raw = await fs16.readFile(this.statePath, "utf8");
       this.state = JSON.parse(raw);
     } catch {
       this.state = null;
@@ -10557,24 +10818,24 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat13 = await fsp4.stat(localPath);
+        const stat13 = await fs16.stat(localPath);
         if (stat13.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fsp4.readFile(file, "utf8");
-            const rel = path2.relative(localPath, file).replace(/\\/g, "/");
+            const content = await fs16.readFile(file, "utf8");
+            const rel = path23.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(content);
           }
         } else {
-          const content = await fsp4.readFile(localPath, "utf8");
+          const content = await fs16.readFile(localPath, "utf8");
           entries.push({ path: `data/${cat}`, content, mode: "100644" });
           hashes.push(content);
         }
       } catch {
       }
     }
-    const rev = createHash("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
+    const rev = createHash8("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
     return { treeEntries: entries, rev };
   }
   async hashLocalCategories(categories) {
@@ -10583,21 +10844,21 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat13 = await fsp4.stat(localPath);
+        const stat13 = await fs16.stat(localPath);
         if (stat13.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fsp4.readFile(file);
+            const content = await fs16.readFile(file);
             hashes.push(content.toString("base64") + file);
           }
         } else {
-          const content = await fsp4.readFile(localPath);
+          const content = await fs16.readFile(localPath);
           hashes.push(content.toString("base64") + localPath);
         }
       } catch {
       }
     }
-    return createHash("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
+    return createHash8("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
   }
   categoryToPath(cat) {
     switch (cat) {
@@ -10618,9 +10879,9 @@ var CloudSync = class {
   }
   async walkDir(dir, base) {
     const results = [];
-    const entries = await fsp4.readdir(dir, { withFileTypes: true });
+    const entries = await fs16.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path2.join(dir, entry.name);
+      const full = path23.join(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
       } else {
@@ -10642,9 +10903,9 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
     return localPath;
   }
   if (!rel) return localPath;
-  const normalizedRel = path2.normalize(rel);
-  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path2.sep}`);
-  if (path2.isAbsolute(normalizedRel) || traversesUp) {
+  const normalizedRel = path23.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path23.sep}`);
+  if (path23.isAbsolute(normalizedRel) || traversesUp) {
     throw new FsError({
       message: `Refusing CloudSync path traversal: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -10652,10 +10913,10 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
       context: { reason: "path_traversal", normalizedRel }
     });
   }
-  const dest = path2.resolve(localPath, normalizedRel);
-  const root = path2.resolve(localPath);
-  const relative6 = path2.relative(root, dest);
-  if (relative6.startsWith("..") || path2.isAbsolute(relative6)) {
+  const dest = path23.resolve(localPath, normalizedRel);
+  const root = path23.resolve(localPath);
+  const relative6 = path23.relative(root, dest);
+  if (relative6.startsWith("..") || path23.isAbsolute(relative6)) {
     throw new FsError({
       message: `Refusing CloudSync path outside category root: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -10794,7 +11055,86 @@ function resolveSessionLoggingConfig(cfg) {
     }
   };
 }
-
-export { ALL_SYNC_CATEGORIES, AgentStatusTracker, AnnotationsStore, CORE_RECONSTRUCT_EVENTS, CloudSync, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultMemoryStore, DefaultPromptStore, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DirectorStateCheckpoint, FileMemoryBackend, FleetNotifier, GraphMemoryBackend, INPUT_HISTORY_DEFAULT_MAX, InputHistoryStore, MAX_JOURNAL_ENTRIES, MAX_PROGRESS_HISTORY, PromptUsageStore, QueueStore, RecoveryLock, ReplayLogStore, STANDARD_AUDIT_EVENTS, SessionAnalyzer, SessionCheckpointCas, SessionMemoryConsolidator, SessionRecovery, SessionRegistry, ToolAuditLog, addPlanItem, appendJournal, attachPlanCheckpoint, attachTodosCheckpoint, clearPlan, createSessionEventBridge, deriveTodosFromPlanItem, emptyGoal, emptyPlan, emptyTaskFile, formatGoal, formatPlan, formatPlanTemplates, generateSessionId, getPlanTemplate, getSessionRegistry, goalFilePath, hasSessionRegistry, listPlanTemplates, loadCompletedWorkCheckpoint, loadDirectorState, loadGoal, loadPlan, loadTasks, loadTodosCheckpoint, migratePromptEntry, mutatePlan, mutateTasks, parseEntries, parseProgressFromText, promptChecksum, recordProgress, removePlanItem, resolveAuditLevel, resolveSessionLoggingConfig, runConfigMigrations, sanitizeModel, saveCompletedWorkCheckpoint, saveGoal, savePlan, saveTasks, saveTodosCheckpoint, setPlanItemStatus, setProgress, summarizeUsage, watchProviderConfig };
+export {
+  ALL_SYNC_CATEGORIES,
+  AgentStatusTracker,
+  AnnotationsStore,
+  CORE_RECONSTRUCT_EVENTS,
+  CloudSync,
+  ConfigMigrationError,
+  DEFAULT_CONFIG_MIGRATIONS,
+  DefaultAttachmentStore,
+  DefaultConfigLoader,
+  DefaultConfigStore,
+  DefaultMemoryStore,
+  DefaultPromptStore,
+  DefaultSessionReader,
+  DefaultSessionRewinder,
+  DefaultSessionStore,
+  DirectorStateCheckpoint,
+  FileMemoryBackend,
+  FleetNotifier,
+  GraphMemoryBackend,
+  INPUT_HISTORY_DEFAULT_MAX,
+  InputHistoryStore,
+  MAX_JOURNAL_ENTRIES,
+  MAX_PROGRESS_HISTORY,
+  PromptUsageStore,
+  QueueStore,
+  RecoveryLock,
+  ReplayLogStore,
+  STANDARD_AUDIT_EVENTS,
+  SessionAnalyzer,
+  SessionCheckpointCas,
+  SessionMemoryConsolidator,
+  SessionRecovery,
+  SessionRegistry,
+  ToolAuditLog,
+  addPlanItem,
+  appendJournal,
+  attachPlanCheckpoint,
+  attachTodosCheckpoint,
+  clearPlan,
+  createSessionEventBridge,
+  deriveTodosFromPlanItem,
+  emptyGoal,
+  emptyPlan,
+  emptyTaskFile,
+  formatGoal,
+  formatPlan,
+  formatPlanTemplates,
+  generateSessionId,
+  getPlanTemplate,
+  getSessionRegistry,
+  goalFilePath,
+  hasSessionRegistry,
+  listPlanTemplates,
+  loadCompletedWorkCheckpoint,
+  loadDirectorState,
+  loadGoal,
+  loadPlan,
+  loadTasks,
+  loadTodosCheckpoint,
+  migratePromptEntry,
+  mutatePlan,
+  mutateTasks,
+  parseEntries,
+  parseProgressFromText,
+  promptChecksum,
+  recordProgress,
+  removePlanItem,
+  resolveAuditLevel,
+  resolveSessionLoggingConfig,
+  runConfigMigrations,
+  sanitizeModel,
+  saveCompletedWorkCheckpoint,
+  saveGoal,
+  savePlan,
+  saveTasks,
+  saveTodosCheckpoint,
+  setPlanItemStatus,
+  setProgress,
+  summarizeUsage,
+  watchProviderConfig
+};
 //# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map