@wrongstack/core 0.299.0 → 0.301.0

package/dist/plugin/index.js

@@ -277,11 +277,11 @@ __export(review_finding_store_exports, {
   JsonlFindingStore: () => JsonlFindingStore,
   resolveFindingStorePath: () => resolveFindingStorePath
 });
-import { randomUUID as randomUUID3 } from "node:crypto";
-import * as fsp2 from "node:fs/promises";
-import * as path15 from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import * as fsp3 from "node:fs/promises";
+import * as path16 from "node:path";
 function resolveFindingStorePath(projectDir) {
-  return path15.join(projectDir, FINDING_STORE_FILE);
+  return path16.join(projectDir, FINDING_STORE_FILE);
 }
 var FINDING_RESOLVED_RETENTION_MS, FINDING_IGNORED_RETENTION_MS, FINDING_DEFAULT_PAGE_SIZE, NL, LINE_SEPARATOR, FINDING_STORE_FILE, JsonlFindingStore;
 var init_review_finding_store = __esm({
@@ -325,7 +325,7 @@ var init_review_finding_store = __esm({
                 match.finding.status = "active";
                 match.finding.resolution = void 0;
                 const updatedRecord = { __finding: 1, data: match.finding };
-                await fsp2.appendFile(
+                await fsp3.appendFile(
                   this.filePath,
                   JSON.stringify(updatedRecord) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: reopenEvent }) + LINE_SEPARATOR,
                   { encoding: "utf8", mode: SECRET_FILE_MODE }
@@ -339,7 +339,7 @@ var init_review_finding_store = __esm({
                   match.finding.status,
                   context
                 );
-                await fsp2.appendFile(
+                await fsp3.appendFile(
                   this.filePath,
                   JSON.stringify({ __findingEvent: 1, data: relinkEvent }) + LINE_SEPARATOR,
                   { encoding: "utf8", mode: SECRET_FILE_MODE }
@@ -350,7 +350,7 @@ var init_review_finding_store = __esm({
               const record = { __finding: 1, data: finding };
               const createdEvent = this._makeEvent(finding.id, "created", null, "active", context);
               const lines = JSON.stringify(record) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: createdEvent }) + LINE_SEPARATOR;
-              await fsp2.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
+              await fsp3.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
               result.created++;
             }
           }
@@ -366,7 +366,7 @@ var init_review_finding_store = __esm({
           validateTransition(from, to);
           validateResolution(to, opts?.outcome);
           const event = {
-            id: randomUUID3(),
+            id: randomUUID4(),
             findingId,
             eventType: to === "resolved" ? "resolved" : to === "ignored" ? "ignored" : this._eventTypeFor(to),
             fromStatus: from,
@@ -386,7 +386,7 @@ var init_review_finding_store = __esm({
             };
           }
           const updatedRecord = { __finding: 1, data: entry.finding };
-          await fsp2.appendFile(
+          await fsp3.appendFile(
             this.filePath,
             JSON.stringify(updatedRecord) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: event }) + LINE_SEPARATOR,
             { encoding: "utf8", mode: SECRET_FILE_MODE }
@@ -503,7 +503,7 @@ var init_review_finding_store = __esm({
       // ── Private helpers ──────────────────────────────────────────────
       async _readAllLines() {
         try {
-          const raw = await fsp2.readFile(this.filePath, "utf8");
+          const raw = await fsp3.readFile(this.filePath, "utf8");
           return raw.split(LINE_SEPARATOR).filter((l) => l.trim().length > 0);
         } catch (err) {
           if (err.code === "ENOENT") return [];
@@ -550,7 +550,7 @@ var init_review_finding_store = __esm({
       }
       _makeEvent(findingId, eventType, fromStatus, toStatus, context) {
         return {
-          id: randomUUID3(),
+          id: randomUUID4(),
           findingId,
           eventType,
           fromStatus,
@@ -634,11 +634,11 @@ __export(review_report_store_exports, {
   REPORT_STORE_FILE: () => REPORT_STORE_FILE,
   resolveReportStorePath: () => resolveReportStorePath
 });
-import { randomUUID as randomUUID5 } from "node:crypto";
-import * as fsp3 from "node:fs/promises";
-import * as path16 from "node:path";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import * as fsp4 from "node:fs/promises";
+import * as path17 from "node:path";
 function resolveReportStorePath(projectDir) {
-  return path16.join(projectDir, REPORT_STORE_FILE);
+  return path17.join(projectDir, REPORT_STORE_FILE);
 }
 var REPORT_RETENTION_MS, REPORT_DEFAULT_PAGE_SIZE, NL2, REPORT_STORE_FILE, JsonlReportStore;
 var init_review_report_store = __esm({
@@ -673,7 +673,7 @@ var init_review_report_store = __esm({
               rawText: input.rawText || existing.rawText,
               files: input.files.length > 0 ? input.files : existing.files
             };
-            await fsp3.appendFile(this.filePath, JSON.stringify({ __report: 1, data: updated }) + NL2, {
+            await fsp4.appendFile(this.filePath, JSON.stringify({ __report: 1, data: updated }) + NL2, {
               encoding: "utf8",
               mode: SECRET_FILE_MODE
             });
@@ -697,7 +697,7 @@ var init_review_report_store = __esm({
             ...input.cascadeDepth !== void 0 ? { cascadeDepth: input.cascadeDepth } : {}
           };
           const createdEvent = {
-            id: randomUUID5(),
+            id: randomUUID6(),
             reportId: report.id,
             eventType: "created",
             fromLifecycle: null,
@@ -707,7 +707,7 @@ var init_review_report_store = __esm({
             timestamp: report.reviewedAt
           };
           const lines = JSON.stringify({ __report: 1, data: report }) + NL2 + JSON.stringify({ __reportEvent: 1, data: createdEvent }) + NL2;
-          await fsp3.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
+          await fsp4.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
           return report;
         });
       }
@@ -720,7 +720,7 @@ var init_review_report_store = __esm({
           const from = this._materialize(entry).lifecycle;
           validateReportTransition(from, to);
           const event = {
-            id: randomUUID5(),
+            id: randomUUID6(),
             reportId,
             eventType: reportEventTypeFor(to),
             fromLifecycle: from,
@@ -731,7 +731,7 @@ var init_review_report_store = __esm({
             reason: opts?.reason
           };
           entry.report.lifecycle = to;
-          await fsp3.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL2, {
+          await fsp4.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL2, {
             encoding: "utf8",
             mode: SECRET_FILE_MODE
           });
@@ -745,7 +745,7 @@ var init_review_report_store = __esm({
           if (!entry) throw new Error(`Review report not found: ${reportId}`);
           const materialized = this._materialize(entry);
           const event = {
-            id: randomUUID5(),
+            id: randomUUID6(),
             reportId,
             eventType: "note_added",
             fromLifecycle: materialized.lifecycle,
@@ -755,7 +755,7 @@ var init_review_report_store = __esm({
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             reason: note
           };
-          await fsp3.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL2, {
+          await fsp4.appendFile(this.filePath, JSON.stringify({ __reportEvent: 1, data: event }) + NL2, {
             encoding: "utf8",
             mode: SECRET_FILE_MODE
           });
@@ -850,7 +850,7 @@ var init_review_report_store = __esm({
       // ── Private helpers ──────────────────────────────────────────────
       async _readAllLines() {
         try {
-          const raw = await fsp3.readFile(this.filePath, "utf8");
+          const raw = await fsp4.readFile(this.filePath, "utf8");
           return raw.split(NL2).filter((l) => l.trim().length > 0);
         } catch (err) {
           if (err.code === "ENOENT") return [];
@@ -1078,9 +1078,15 @@ var ExtensionRegistry = class {
    * Build a composed provider runner. Extensions with `wrapProviderRunner`
    * form a middleware-style chain: the innermost extension wraps the
    * default runner, each subsequent wrapper wraps the previous.
+   *
+   * Utility calls may exclude agent-loop-only middleware (notably
+   * `fallback-model`) while retaining request-safety wrappers such as the
+   * prompt firewall. One-shot orchestration owns its provider and fallback
+   * route, so an agent-loop fallback wrapper cannot safely run against it.
    */
-  wrapProviderRunner(inner) {
-    const wrappers = this.extensions.filter((e) => e.wrapProviderRunner).map((e) => ({ name: e.name, wrap: expectDefined(e.wrapProviderRunner) }));
+  wrapProviderRunner(inner, options) {
+    const excluded = new Set(options?.exclude);
+    const wrappers = this.extensions.filter((e) => e.wrapProviderRunner && !excluded.has(e.name)).map((e) => ({ name: e.name, wrap: expectDefined(e.wrapProviderRunner) }));
     if (wrappers.length === 0) return inner;
     let composed = inner;
     for (let i = wrappers.length - 1; i >= 0; i--) {
@@ -1135,10 +1141,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path29, errors, depth) {
+function walk(value, schema, path32, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path29 || "<root>",
+      path: path32 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -1146,7 +1152,7 @@ function walk(value, schema, path29, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path29 || "<root>",
+        path: path32 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -1155,7 +1161,7 @@ function walk(value, schema, path29, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path29 || "<root>",
+        path: path32 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -1167,7 +1173,7 @@ function walk(value, schema, path29, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path29, req),
+          path: joinPath(path32, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -1175,14 +1181,14 @@ function walk(value, schema, path29, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path29, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path32, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path29}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path32}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -1275,6 +1281,36 @@ function resolvePluginConfig(input) {
   merge(input.explicitOptions, "explicit-options");
   return { options, configured, sources };
 }
+function pluginEntryMatchesName(configuredName, name, aliases = []) {
+  for (const candidate of [name, ...aliases]) {
+    if (configuredName === candidate) return true;
+    if (configuredName === `@wrongstack/plugins/${candidate}`) return true;
+  }
+  return false;
+}
+function resolvePluginEnablement(input) {
+  if (input.config?.features?.plugins === false) {
+    return { enabled: false, source: "feature-flag" };
+  }
+  const names = [.../* @__PURE__ */ new Set([input.name, ...input.aliases ?? []])];
+  const matches2 = input.matches ?? ((configuredName) => pluginEntryMatchesName(configuredName, input.name, input.aliases ?? []));
+  const plugins = input.config?.plugins;
+  if (Array.isArray(plugins)) {
+    for (const candidate of plugins) {
+      if (typeof candidate === "string") {
+        if (matches2(candidate)) return { enabled: true, source: "plugin-entry" };
+        continue;
+      }
+      if (!isPluginEntry(candidate) || !matches2(candidate.name)) continue;
+      return { enabled: candidate.enabled !== false, source: "plugin-entry" };
+    }
+  }
+  for (const name of names) {
+    const enabled = input.config?.extensions?.[name]?.["enabled"];
+    if (typeof enabled === "boolean") return { enabled, source: "extension" };
+  }
+  return { enabled: input.defaultState === "active", source: "default" };
+}
 function resolvePluginManifestConfig(plugin, config, explicitOptions) {
   return resolvePluginConfig({
     name: plugin.name,
@@ -1740,11 +1776,12 @@ function wrapApiForCapabilityCheck(plugin, api, log, enforce = false) {
   });
   const wrappedLlm = caps.llm !== false || !api.llm ? api.llm : new Proxy(api.llm, {
     get(target, prop, receiver) {
-      if (prop === "complete") {
+      if (prop === "complete" || prop === "council") {
         return (prompt, options) => {
-          violate("llm", `complete(${prompt.length} chars)`);
-          const complete = target.complete;
-          return options === void 0 ? complete(prompt) : complete(prompt, options);
+          violate("llm", `${String(prop)}(${prompt.length} chars)`);
+          const method = target[prop];
+          if (!method) return void 0;
+          return options === void 0 ? method.call(target, prompt) : method.call(target, prompt, options);
         };
       }
       return Reflect.get(target, prop, receiver);
@@ -1973,6 +2010,8 @@ function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig,
   const currentModel = () => hostLLM.getModel?.() ?? hostLLM.model;
   const DEFAULT_MAX_TOKENS = 2048;
   const HARD_MAX_TOKENS = 32768;
+  const DEFAULT_TIMEOUT_MS = 3e4;
+  const HARD_TIMEOUT_MS = 12e4;
   const pluginDefaults = () => {
     const extensions = currentConfig().extensions;
     const raw = extensions?.[owner]?.["llm"];
@@ -1982,7 +2021,11 @@ function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig,
       ...typeof r["provider"] === "string" && r["provider"] ? { provider: r["provider"] } : {},
       ...typeof r["model"] === "string" && r["model"] ? { model: r["model"] } : {},
       ...typeof r["maxTokens"] === "number" ? { maxTokens: r["maxTokens"] } : {},
-      ...typeof r["temperature"] === "number" ? { temperature: r["temperature"] } : {}
+      ...typeof r["temperature"] === "number" ? { temperature: r["temperature"] } : {},
+      ...typeof r["role"] === "string" && r["role"] ? { role: r["role"] } : {},
+      ...Array.isArray(r["fallbackModels"]) && r["fallbackModels"].every((v) => typeof v === "string") ? { fallbackModels: [...r["fallbackModels"]] } : {},
+      ...typeof r["timeoutMs"] === "number" ? { timeoutMs: r["timeoutMs"] } : {},
+      ...typeof r["councilProfile"] === "string" && r["councilProfile"] ? { councilProfile: r["councilProfile"] } : {}
     };
   };
   const resolveProvider = (name, model) => {
@@ -2019,7 +2062,7 @@ function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig,
     providerCache.set(cacheKey, created);
     return { provider: created, providerName };
   };
-  return {
+  const pluginLlm = {
     defaults() {
       const d = pluginDefaults();
       return {
@@ -2030,12 +2073,49 @@ function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig,
     async complete(prompt, opts) {
       const defaults = pluginDefaults();
       const model = opts?.model ?? defaults.model ?? currentModel();
-      const { provider, providerName } = resolveProvider(opts?.provider, model);
+      const providerName = opts?.provider ?? defaults.provider ?? currentProvider().id;
       const maxTokens = Math.min(
         HARD_MAX_TOKENS,
         opts?.maxTokens ?? defaults.maxTokens ?? DEFAULT_MAX_TOKENS
       );
       const temperature = opts?.temperature ?? defaults.temperature;
+      const timeoutMs = Math.min(
+        HARD_TIMEOUT_MS,
+        Math.max(1, opts?.timeoutMs ?? defaults.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      );
+      if (hostLLM.oneShot) {
+        metrics.counter("llm.calls", 1, { provider: providerName, model, engine: "one-shot" });
+        const result = await hostLLM.oneShot({
+          userPrompt: prompt,
+          providerId: providerName,
+          model,
+          maxTokens,
+          timeoutMs,
+          ...temperature !== void 0 ? { temperature } : {},
+          ...opts?.system ? { system: opts.system } : {},
+          ...opts?.responseFormat === "json" ? { responseFormat: { type: "json_object" } } : {},
+          ...opts?.signal ? { signal: opts.signal } : {},
+          ...opts?.role ?? defaults.role ? { role: opts?.role ?? defaults.role } : {},
+          ...opts?.fallbackModels ?? defaults.fallbackModels ? { fallbackModels: [...opts?.fallbackModels ?? defaults.fallbackModels ?? []] } : {}
+        });
+        if (result.error) {
+          metrics.counter("llm.errors", 1, { provider: result.provider, model: result.model });
+          throw new Error(result.error);
+        }
+        metrics.counter("llm.tokens_in", result.tokens.input);
+        metrics.counter("llm.tokens_out", result.tokens.output);
+        return {
+          text: result.text,
+          model: result.model,
+          provider: result.provider,
+          usage: { input: result.tokens.input, output: result.tokens.output },
+          stopReason: result.stopReason ?? "end_turn",
+          fromFallback: result.fromFallback,
+          attempts: result.attempts,
+          durationMs: result.durationMs
+        };
+      }
+      const { provider } = resolveProvider(providerName, model);
       const request = {
         model,
         messages: [{ role: "user", content: [{ type: "text", text: prompt }] }],
@@ -2044,7 +2124,8 @@ function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig,
         ...opts?.system ? { system: [{ type: "text", text: opts.system }] } : {},
         ...opts?.responseFormat === "json" ? { responseFormat: { type: "json_object" } } : {}
       };
-      const signal = opts?.signal ?? new AbortController().signal;
+      const timeoutSignal = AbortSignal.timeout(timeoutMs);
+      const signal = opts?.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
       metrics.counter("llm.calls", 1, { provider: providerName, model });
       try {
         const response = await provider.complete(request, { signal });
@@ -2069,6 +2150,33 @@ function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig,
       }
     }
   };
+  const council = hostLLM.council;
+  if (council) {
+    pluginLlm.council = async (question, opts) => {
+      const trimmed = question.trim();
+      if (!trimmed) throw new Error("Plugin Council question must not be empty.");
+      if (trimmed.length > 2e4) {
+        throw new Error("Plugin Council question must not exceed 20000 characters.");
+      }
+      if ((opts?.context?.length ?? 0) > 8e4) {
+        throw new Error("Plugin Council context must not exceed 80000 characters.");
+      }
+      const defaults = pluginDefaults();
+      metrics.counter("llm.council.calls", 1, { plugin: owner });
+      const result = await council({
+        question: trimmed,
+        ...opts?.context ? { context: opts.context } : {},
+        ...opts?.options ? { options: opts.options } : {},
+        ...opts?.profile ?? defaults.councilProfile ? { profile: opts?.profile ?? defaults.councilProfile } : {},
+        ...opts?.signal ? { signal: opts.signal } : {}
+      });
+      metrics.counter("llm.tokens_in", result.usage.inputTokens);
+      metrics.counter("llm.tokens_out", result.usage.outputTokens);
+      if (result.status === "failed") metrics.counter("llm.errors", 1, { provider: "council" });
+      return result;
+    };
+  }
+  return pluginLlm;
 }
 function scopedMetrics(sink, pluginName) {
   const prefix = `plugin.${pluginName}.`;
@@ -2107,8 +2215,8 @@ function definePlugin(metadata, factory) {
 // src/plugins/auto-review-plugin.ts
 import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import * as fsp from "node:fs/promises";
-import * as path14 from "node:path";
+import * as fsp2 from "node:fs/promises";
+import * as path15 from "node:path";
 
 // src/core/model-availability-calendar.ts
 function logicalCalendarTarget(providerId, model) {
@@ -2470,14 +2578,327 @@ var FREEZER_EMPTY = Object.freeze([]);
 init_error();
 
 // src/plugins/review-claim-registry.ts
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import { hostname } from "node:os";
+import * as path from "node:path";
+
+// src/utils/pid.ts
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  if (pid === process.pid) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EPERM") return true;
+    return false;
+  }
+}
+
+// src/plugins/review-claim-registry.ts
+var CLAIMS_FILE = "review-claims.jsonl";
+var DEFAULT_CLAIM_TTL_MS = 30 * 60 * 1e3;
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MAX_MS = 50;
+var LOCK_STALE_MS = 3e4;
+var SAME_HOST_STALE_MS = 2 * LOCK_STALE_MS;
+var LOCK_RETRY_BUDGET_MS = SAME_HOST_STALE_MS + 5e3;
+var CLAIM_STORE_LOCK_TIMEOUT = "CLAIM_STORE_LOCK_TIMEOUT";
+var HOST_NAME = hostname();
+function lockOwnerStamp() {
+  return `${HOST_NAME}:${process.pid}`;
+}
+var lastFallbackWarnAt = 0;
+var FALLBACK_WARN_INTERVAL_MS = 6e4;
+function warnFallbackOnce(message) {
+  const now = Date.now();
+  if (now - lastFallbackWarnAt < FALLBACK_WARN_INTERVAL_MS) return;
+  lastFallbackWarnAt = now;
+  console.warn(message);
+}
+async function breakStaleLockVerified(lockPath, verify) {
+  if (!await verify()) return false;
+  return await breakLockAtomically(lockPath) === true;
+}
+async function breakStaleLock(lockPath) {
+  try {
+    const ownerRaw = await fsp.readFile(lockPath, "utf8").catch(() => null);
+    if (ownerRaw !== null) {
+      const [ownerHost, pidRaw] = ownerRaw.trim().split(":", 2);
+      const ownerPid = Number.parseInt(pidRaw ?? "", 10);
+      if (ownerHost === HOST_NAME && Number.isInteger(ownerPid) && ownerPid > 0) {
+        if (isPidAlive(ownerPid)) {
+          const st2 = await fsp.stat(lockPath);
+          if (Date.now() - st2.mtimeMs > SAME_HOST_STALE_MS) {
+            return await breakStaleLockVerified(lockPath, async () => {
+              const st22 = await fsp.stat(lockPath);
+              return Date.now() - st22.mtimeMs > SAME_HOST_STALE_MS;
+            });
+          }
+          return false;
+        }
+        return await breakStaleLockVerified(lockPath, async () => {
+          const content = await fsp.readFile(lockPath, "utf8").catch(() => "");
+          return content.trim() === ownerRaw.trim();
+        });
+      }
+    }
+    const st = await fsp.stat(lockPath);
+    if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+      return await breakStaleLockVerified(lockPath, async () => {
+        const st2 = await fsp.stat(lockPath);
+        return Date.now() - st2.mtimeMs > LOCK_STALE_MS;
+      });
+    }
+  } catch {
+  }
+  return false;
+}
+async function breakLockAtomically(lockPath) {
+  const tombstone = `${lockPath}.stale-${randomUUID()}.tmp`;
+  try {
+    await fsp.rename(lockPath, tombstone);
+  } catch {
+    return false;
+  }
+  void fsp.unlink(tombstone).catch(() => void 0);
+  return true;
+}
+async function withStoreLock(storeDir, fn, waitMs = LOCK_WAIT_MS) {
+  const lockPath = lockFilePath(storeDir);
+  await fsp.mkdir(storeDir, { recursive: true });
+  const deadline = Date.now() + waitMs;
+  let attempt = 0;
+  for (; ; ) {
+    let handle = await fsp.open(lockPath, "wx").catch(() => null);
+    if (!handle && await breakStaleLock(lockPath)) {
+      handle = await fsp.open(lockPath, "wx").catch(() => null);
+    }
+    if (handle) {
+      let stampFailed = false;
+      try {
+        let stamped = false;
+        for (let stampAttempt = 0; stampAttempt < 3 && !stamped; stampAttempt++) {
+          try {
+            await handle.writeFile(lockOwnerStamp());
+            stamped = true;
+          } catch {
+            if (stampAttempt < 2) await new Promise((resolve16) => setTimeout(resolve16, 5));
+          }
+        }
+        if (!stamped) {
+          stampFailed = true;
+          throw new Error("failed to stamp claim lock owner");
+        }
+        return await fn();
+      } finally {
+        await handle.close().catch(() => void 0);
+        if (stampFailed) {
+          await fsp.unlink(lockPath).catch(() => void 0);
+        } else {
+          const owner = await fsp.readFile(lockPath, "utf8").catch(() => null);
+          if (owner !== null && owner.trim() === lockOwnerStamp()) {
+            await fsp.unlink(lockPath).catch(() => void 0);
+          }
+        }
+      }
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      throw Object.assign(new Error("review claim store lock timeout"), {
+        code: CLAIM_STORE_LOCK_TIMEOUT
+      });
+    }
+    const delay2 = Math.min(LOCK_RETRY_MAX_MS * (attempt + 1), remaining);
+    await new Promise((resolve16) => setTimeout(resolve16, delay2));
+    attempt += 1;
+  }
+}
+var MAX_LEDGER_LINES = 1e4;
+var HOST_SID = randomUUID();
 var claimsByEventBus = /* @__PURE__ */ new WeakMap();
 var startedReviews = /* @__PURE__ */ new WeakMap();
+var pendingStartedReviews = /* @__PURE__ */ new WeakMap();
 function fingerprint(content) {
   return createHash("sha256").update(content).digest("hex");
 }
+function normalizeKeyPart(p) {
+  const forward = p.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? forward.toLowerCase() : forward;
+}
 function claimKey(cwd, filePath) {
-  return `${cwd}\0${filePath}`;
+  return `${normalizeKeyPart(cwd)}\0${normalizeKeyPart(filePath)}`;
+}
+function resolveStore(opts, cwd) {
+  return {
+    storeDir: opts?.storeDir ?? path.join(cwd, ".wrongstack"),
+    ttlMs: opts?.ttlMs ?? DEFAULT_CLAIM_TTL_MS,
+    maxLedgerLines: opts?.maxLedgerLines ?? MAX_LEDGER_LINES
+  };
+}
+function claimsFilePath(storeDir) {
+  return path.join(storeDir, CLAIMS_FILE);
+}
+function lockFilePath(storeDir) {
+  return path.join(storeDir, `${CLAIMS_FILE}.lock`);
+}
+async function readLedger(storeDir, now) {
+  const active = /* @__PURE__ */ new Map();
+  const raw = await fsp.readFile(claimsFilePath(storeDir), "utf8").catch((err) => {
+    const code = err.code;
+    if (code === "ENOENT") return "";
+    throw err;
+  });
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let entry;
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && typeof parsed === "object" && (parsed.op === "claim" || parsed.op === "release") && typeof parsed.key === "string" && typeof parsed.fp === "string" && typeof parsed.sid === "string" && typeof parsed.ts === "number" && (typeof parsed.exp === "undefined" || typeof parsed.exp === "number")) {
+        entry = parsed;
+      }
+    } catch {
+    }
+    if (!entry) continue;
+    let bucket = active.get(entry.key);
+    if (!bucket) {
+      bucket = /* @__PURE__ */ new Map();
+      active.set(entry.key, bucket);
+    }
+    if (entry.op === "claim") {
+      const exp = entry.exp ?? entry.ts + DEFAULT_CLAIM_TTL_MS;
+      if (now > exp) continue;
+      bucket.set(entry.fp, { sid: entry.sid, ts: entry.ts, exp });
+    } else {
+      const existing = bucket.get(entry.fp);
+      if (existing?.sid === entry.sid && existing.ts === entry.ts) bucket.delete(entry.fp);
+    }
+  }
+  return active;
+}
+async function ledgerLineCount(storeDir) {
+  const raw = await fsp.readFile(claimsFilePath(storeDir), "utf8").catch(() => "");
+  return raw.split("\n").filter((l) => l.trim()).length;
+}
+async function compactLedger(storeDir, active) {
+  const lines = [];
+  for (const [key, fps] of active) {
+    for (const [fp, claim] of fps) {
+      lines.push(
+        JSON.stringify({
+          op: "claim",
+          key,
+          fp,
+          sid: claim.sid,
+          ts: claim.ts,
+          exp: claim.exp
+        })
+      );
+    }
+  }
+  const tmp = `${claimsFilePath(storeDir)}.tmp-${randomUUID()}`;
+  await fsp.writeFile(tmp, lines.length > 0 ? `${lines.join("\n")}
+` : "", "utf8");
+  let replaced = false;
+  for (let attempt = 0; attempt < 3 && !replaced; attempt++) {
+    try {
+      await fsp.rename(tmp, claimsFilePath(storeDir));
+      replaced = true;
+    } catch {
+      if (attempt === 2) {
+        await fsp.copyFile(tmp, claimsFilePath(storeDir)).catch(async (copyErr) => {
+          throw copyErr;
+        });
+        await fsp.unlink(tmp).catch(() => void 0);
+        replaced = true;
+      } else {
+        await new Promise((resolve16) => setTimeout(resolve16, 10 * (attempt + 1)));
+      }
+    }
+  }
+}
+async function acquireClaims(storeDir, ttlMs, maxLedgerLines, cwd, files, waitMs = LOCK_WAIT_MS) {
+  return withStoreLock(
+    storeDir,
+    async () => {
+      const now = Date.now();
+      const active = await readLedger(storeDir, now);
+      const claims = [];
+      const lines = [];
+      for (const file of files) {
+        const key = claimKey(cwd, file.path);
+        const fp = fingerprint(file.content);
+        let bucket = active.get(key);
+        if (bucket?.has(fp)) continue;
+        if (!bucket) {
+          bucket = /* @__PURE__ */ new Map();
+          active.set(key, bucket);
+        }
+        bucket.set(fp, { sid: HOST_SID, ts: now, exp: now + ttlMs });
+        claims.push({ key, fingerprint: fp, sid: HOST_SID, ts: now });
+        lines.push(
+          JSON.stringify({
+            op: "claim",
+            key,
+            fp,
+            sid: HOST_SID,
+            ts: now,
+            exp: now + ttlMs
+          })
+        );
+      }
+      if (lines.length > 0) {
+        await fsp.appendFile(claimsFilePath(storeDir), `${lines.join("\n")}
+`, "utf8");
+        try {
+          if (await ledgerLineCount(storeDir) > maxLedgerLines) {
+            await compactLedger(storeDir, active);
+          }
+        } catch (err) {
+          warnFallbackOnce(
+            `[review-claim-registry] ledger compaction failed (${err instanceof Error ? err.message : String(err)}); will retry on a future acquire`
+          );
+        }
+      }
+      return claims;
+    },
+    waitMs
+  );
+}
+async function releaseSharedClaims(storeDir, claims, waitMs = LOCK_WAIT_MS) {
+  if (claims.length === 0) return;
+  await withStoreLock(
+    storeDir,
+    async () => {
+      const now = Date.now();
+      const active = await readLedger(storeDir, now);
+      const lines = [];
+      for (const claim of claims) {
+        const bucket = active.get(claim.key);
+        const live = bucket?.get(claim.fingerprint);
+        if (live && live.sid === claim.sid && live.ts === claim.ts) {
+          lines.push(
+            JSON.stringify({
+              op: "release",
+              key: claim.key,
+              fp: claim.fingerprint,
+              sid: claim.sid,
+              // Target the ORIGINAL claim time so a late release only ever
+              // removes the claim it owns (see readLedger release matching).
+              ts: claim.ts
+            })
+          );
+        }
+      }
+      if (lines.length > 0) {
+        await fsp.appendFile(claimsFilePath(storeDir), `${lines.join("\n")}
+`, "utf8");
+      }
+    },
+    waitMs
+  );
 }
 function ledgerFor(events) {
   let ledger = claimsByEventBus.get(events);
@@ -2487,68 +2908,162 @@ function ledgerFor(events) {
   }
   return ledger;
 }
-function claimFiles(events, cwd, files) {
+function claimFilesInMemory(events, cwd, files, ttlMs) {
   const ledger = ledgerFor(events);
+  const now = Date.now();
   const claims = [];
   for (const file of files) {
     const key = claimKey(cwd, file.path);
     const fileFingerprint = fingerprint(file.content);
     let activeFingerprints = ledger.get(key);
+    if (activeFingerprints) {
+      for (const [fp, entry] of activeFingerprints) {
+        if (now > entry.exp) activeFingerprints.delete(fp);
+      }
+      if (activeFingerprints.size === 0) {
+        ledger.delete(key);
+        activeFingerprints = void 0;
+      }
+    }
     if (!activeFingerprints) {
-      activeFingerprints = /* @__PURE__ */ new Set();
+      activeFingerprints = /* @__PURE__ */ new Map();
       ledger.set(key, activeFingerprints);
     }
     if (activeFingerprints.has(fileFingerprint)) continue;
-    activeFingerprints.add(fileFingerprint);
-    claims.push({ key, fingerprint: fileFingerprint });
+    activeFingerprints.set(fileFingerprint, { ts: now, exp: now + ttlMs });
+    claims.push({ key, fingerprint: fileFingerprint, sid: HOST_SID, ts: now });
   }
   return claims;
 }
-function releaseClaims(events, claims) {
+function releaseClaimsInMemory(events, claims) {
   const ledger = ledgerFor(events);
   for (const claim of claims) {
     const activeFingerprints = ledger.get(claim.key);
     if (!activeFingerprints) continue;
-    activeFingerprints.delete(claim.fingerprint);
+    if (activeFingerprints.get(claim.fingerprint)?.ts === claim.ts) {
+      activeFingerprints.delete(claim.fingerprint);
+    }
     if (activeFingerprints.size === 0) ledger.delete(claim.key);
   }
 }
-function recordStartedReview(events, payload) {
+async function claimFiles(events, cwd, files, opts) {
+  const { storeDir, ttlMs, maxLedgerLines } = resolveStore(opts, cwd);
+  try {
+    const claims = await acquireClaims(storeDir, ttlMs, maxLedgerLines, cwd, files);
+    return { claims, storeDir };
+  } catch (err) {
+    const code = err.code;
+    if (code === CLAIM_STORE_LOCK_TIMEOUT) {
+      try {
+        const claims = await acquireClaims(
+          storeDir,
+          ttlMs,
+          maxLedgerLines,
+          cwd,
+          files,
+          LOCK_RETRY_BUDGET_MS
+        );
+        return { claims, storeDir };
+      } catch (err2) {
+        warnFallbackOnce(
+          `[review-claim-registry] claim lock still contended after ${LOCK_WAIT_MS + LOCK_RETRY_BUDGET_MS}ms (${err2 instanceof Error ? err2.message : String(err2)}); falling back to in-memory dedup`
+        );
+        return { claims: claimFilesInMemory(events, cwd, files, ttlMs), storeDir: null };
+      }
+    }
+    warnFallbackOnce(
+      `[review-claim-registry] shared claim store unavailable (${err instanceof Error ? err.message : String(err)}); falling back to in-memory dedup`
+    );
+    return { claims: claimFilesInMemory(events, cwd, files, ttlMs), storeDir: null };
+  }
+}
+async function releaseClaims(events, claims, storeDir) {
+  if (storeDir === null) {
+    releaseClaimsInMemory(events, claims);
+    return;
+  }
+  try {
+    await releaseSharedClaims(storeDir, claims);
+  } catch (err) {
+    if (err.code === CLAIM_STORE_LOCK_TIMEOUT) {
+      try {
+        await releaseSharedClaims(storeDir, claims, LOCK_RETRY_BUDGET_MS);
+        return;
+      } catch {
+      }
+    }
+    warnFallbackOnce(
+      `[review-claim-registry] shared claim release failed (${err instanceof Error ? err.message : String(err)}); claim will expire via its stored TTL`
+    );
+  }
+}
+async function recordStartedReview(events, payload, opts) {
   if (!payload || typeof payload !== "object") return;
+  const bundle = payload;
+  if (startedReviews.has(bundle) || pendingStartedReviews.has(bundle)) return;
   const candidate = payload;
   if (typeof candidate.cwd !== "string" || !Array.isArray(candidate.files)) return;
+  const cwd = candidate.cwd;
   const files = candidate.files.filter(
     (file) => Boolean(file) && typeof file === "object" && typeof file.path === "string" && typeof file.content === "string"
   );
-  const claims = claimFiles(events, candidate.cwd, files);
-  if (claims.length > 0) {
-    startedReviews.set(payload, { events, claims });
+  const pending = (async () => {
+    try {
+      const { claims, storeDir } = await claimFiles(events, cwd, files, opts);
+      if (claims.length === 0) return null;
+      const entry = { events, storeDir, claims };
+      startedReviews.set(bundle, entry);
+      return entry;
+    } catch {
+      return null;
+    }
+  })();
+  pendingStartedReviews.set(bundle, pending);
+  try {
+    await pending;
+  } finally {
+    if (pendingStartedReviews.get(bundle) === pending) {
+      pendingStartedReviews.delete(bundle);
+    }
   }
 }
-function recordCompletedReview(events, payload) {
+async function recordCompletedReview(events, payload) {
   if (!payload || typeof payload !== "object") return;
   const bundle = payload.bundle;
   if (!bundle || typeof bundle !== "object") return;
-  const startedReview = startedReviews.get(bundle);
+  let startedReview = startedReviews.get(bundle);
+  if (!startedReview) {
+    const pending = pendingStartedReviews.get(bundle);
+    if (pending) startedReview = await pending ?? void 0;
+  }
   if (!startedReview || startedReview.events !== events) return;
-  releaseClaims(events, startedReview.claims);
+  await releaseClaims(events, startedReview.claims, startedReview.storeDir);
   startedReviews.delete(bundle);
 }
-function emitReviewIfChanged(api, bundle) {
-  const claims = claimFiles(api.events, bundle.cwd, bundle.files);
+async function emitReviewIfChanged(api, bundle, opts) {
+  const { claims, storeDir } = await claimFiles(api.events, bundle.cwd, bundle.files, opts);
   if (claims.length === 0) return null;
-  const claimedKeys = new Set(claims.map((claim) => claim.key));
+  const claimed = new Set(claims.map((claim) => `${claim.key}\0${claim.fingerprint}`));
   const claimedBundle = {
     ...bundle,
-    files: bundle.files.filter((file) => claimedKeys.has(claimKey(bundle.cwd, file.path)))
+    // Filter on key+FINGERPRINT pairs, not just key: two entries for the same
+    // path in one batch can differ in content, and a fingerprint claimed by
+    // another session must not ride along in the emitted bundle.
+    files: bundle.files.filter(
+      (file) => claimed.has(`${claimKey(bundle.cwd, file.path)}\0${fingerprint(file.content)}`)
+    )
   };
-  startedReviews.set(claimedBundle, { events: api.events, claims });
+  startedReviews.set(claimedBundle, {
+    events: api.events,
+    storeDir,
+    claims
+  });
   try {
     api.emitCustom("chimera.review_needed", claimedBundle);
     return claimedBundle;
   } catch (err) {
     startedReviews.delete(claimedBundle);
-    releaseClaims(api.events, claims);
+    await releaseClaims(api.events, claims, storeDir);
     throw err;
   }
 }
@@ -2559,27 +3074,30 @@ import { spawn as spawn2 } from "node:child_process";
 // src/chronicle/project-access.ts
 import * as fsPromises from "node:fs/promises";
 import * as os4 from "node:os";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 
 // src/utils/wstack-paths.ts
 import { createHash as createHash2 } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
-import * as path from "node:path";
+import * as path2 from "node:path";
 function canonicalProjectRoot(absRoot) {
-  const checkoutRoot = path.resolve(absRoot);
-  const dotGit = path.join(checkoutRoot, ".git");
+  const checkoutRoot = path2.resolve(absRoot);
+  const dotGit = path2.join(checkoutRoot, ".git");
   try {
     if (!fs.statSync(dotGit).isFile()) return checkoutRoot;
     const gitDirLine = fs.readFileSync(dotGit, "utf8").trim();
     const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);
     if (!match?.[1]) return checkoutRoot;
-    const gitDir = path.resolve(checkoutRoot, match[1].trim());
-    const commonDirFile = path.join(gitDir, "commondir");
+    const gitDir = path2.resolve(checkoutRoot, match[1].trim());
+    const commonDirFile = path2.join(gitDir, "commondir");
     if (!fs.statSync(commonDirFile).isFile()) return checkoutRoot;
-    const commonDir = path.resolve(gitDir, fs.readFileSync(commonDirFile, "utf8").trim());
-    if (path.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
-    return path.dirname(commonDir);
+    const commonDir = path2.resolve(gitDir, fs.readFileSync(commonDirFile, "utf8").trim());
+    const worktreesDir = path2.dirname(gitDir);
+    if (path2.basename(worktreesDir).toLowerCase() !== "worktrees") return checkoutRoot;
+    if (path2.resolve(worktreesDir, "..") !== commonDir) return checkoutRoot;
+    if (path2.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
+    return path2.dirname(commonDir);
   } catch {
     return checkoutRoot;
   }
@@ -2589,7 +3107,7 @@ function projectHash(absRoot) {
 }
 function projectSlug(absRoot) {
   const identityRoot = canonicalProjectRoot(absRoot);
-  const base = slugify(path.basename(identityRoot));
+  const base = slugify(path2.basename(identityRoot));
   const hash = createHash2("sha256").update(identityRoot).digest("hex").slice(0, 6);
   return `${base}-${hash}`;
 }
@@ -2600,9 +3118,9 @@ function safeProfileName(name) {
   const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
   return safe || "default";
 }
-function activeProfileName(globalRoot) {
+function bootstrapProfileName(globalRoot) {
   try {
-    const parsed = JSON.parse(fs.readFileSync(path.join(globalRoot, "config.json"), "utf8"));
+    const parsed = JSON.parse(fs.readFileSync(path2.join(globalRoot, "config.json"), "utf8"));
     return safeProfileName(
       typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0
     );
@@ -2612,17 +3130,17 @@ function activeProfileName(globalRoot) {
 }
 function wstackGlobalRoot() {
   const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path.resolve(fromEnv);
-  return path.join(os.homedir(), ".wrongstack");
+  if (fromEnv && fromEnv.trim().length > 0) return path2.resolve(fromEnv);
+  return path2.join(os.homedir(), ".wrongstack");
 }
 function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path2.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
   const homeDir = opts.userHome ?? os.homedir();
-  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
-  const profileDir = path.join(globalRoot, "profiles", profileName);
+  const profileName = safeProfileName(opts.profileName ?? bootstrapProfileName(globalRoot));
+  const profileDir = path2.join(globalRoot, "profiles", profileName);
   const hash = projectHash(opts.projectRoot);
   const slug = projectSlug(opts.projectRoot);
-  const projectDir = path.join(globalRoot, "projects", slug);
+  const projectDir = path2.join(globalRoot, "projects", slug);
   return {
     globalRoot,
     profileName,
@@ -2630,79 +3148,84 @@ function resolveWstackPaths(opts) {
     projectRoot: opts.projectRoot,
     homeDir,
     configDir: profileDir,
-    globalConfig: path.join(globalRoot, "config.json"),
-    profilesDir: path.join(globalRoot, "profiles"),
+    globalConfig: path2.join(globalRoot, "config.json"),
+    profilesDir: path2.join(globalRoot, "profiles"),
     profileConfig: (name) => {
-      return path.join(globalRoot, "profiles", safeProfileName(name), "config.json");
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "config.json");
     },
     profileStatuslineConfig: (name) => {
-      return path.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
     },
     profileModeConfig: (name) => {
-      return path.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
     },
     profileProviderStatus: (name) => {
-      return path.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
     },
     profileUpdateCache: (name) => {
-      return path.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
     },
-    secretsKey: path.join(globalRoot, ".key"),
-    globalMemory: path.join(profileDir, "memory.md"),
-    globalSkills: path.join(profileDir, "skills"),
-    globalClaudeSkills: path.join(homeDir, ".claude", "skills"),
-    globalDesignKits: path.join(profileDir, "design-kits"),
-    globalPrompts: path.join(profileDir, "prompts"),
-    globalInstructions: path.join(profileDir, "instructions"),
-    promptUsage: path.join(profileDir, "prompt-usage.json"),
-    cacheDir: path.join(globalRoot, "cache"),
-    modelsCache: path.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path.join(profileDir, "history"),
-    logFile: path.join(globalRoot, "logs", "wrongstack.log"),
+    secretsKey: path2.join(globalRoot, ".key"),
+    globalMemory: path2.join(profileDir, "memory.md"),
+    globalSkills: path2.join(profileDir, "skills"),
+    globalClaudeSkills: path2.join(homeDir, ".claude", "skills"),
+    globalDesignKits: path2.join(profileDir, "design-kits"),
+    globalPrompts: path2.join(profileDir, "prompts"),
+    globalInstructions: path2.join(profileDir, "instructions"),
+    promptUsage: path2.join(profileDir, "prompt-usage.json"),
+    cacheDir: path2.join(globalRoot, "cache"),
+    modelsCache: path2.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path2.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path2.join(profileDir, "history"),
+    logFile: path2.join(globalRoot, "logs", "wrongstack.log"),
     projectDir,
-    projectCodebaseIndex: path.join(projectDir, "codebase-index"),
-    projectMemory: path.join(projectDir, "memory.md"),
-    projectSessions: path.join(projectDir, "sessions"),
-    projectTrust: path.join(projectDir, "trust.json"),
-    projectMeta: path.join(projectDir, "meta.json"),
-    projectLocalConfig: path.join(projectDir, "config.local.json"),
-    inProjectConfig: path.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectClaudeSkills: path.join(opts.projectRoot, ".claude", "skills"),
-    inProjectPrompts: path.join(opts.projectRoot, ".wrongstack", "prompts"),
-    inProjectInstructions: path.join(opts.projectRoot, ".wrongstack", "instructions"),
-    inProjectDesignKits: path.join(opts.projectRoot, ".wrongstack", "design-kits"),
-    inProjectWorktrees: path.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectCodebaseIndex: path2.join(projectDir, "codebase-index"),
+    projectMemory: path2.join(projectDir, "memory.md"),
+    projectSessions: path2.join(projectDir, "sessions"),
+    projectTrust: path2.join(projectDir, "trust.json"),
+    projectMeta: path2.join(projectDir, "meta.json"),
+    projectLocalConfig: path2.join(projectDir, "config.local.json"),
+    inProjectConfig: path2.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path2.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path2.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectClaudeSkills: path2.join(opts.projectRoot, ".claude", "skills"),
+    inProjectPrompts: path2.join(opts.projectRoot, ".wrongstack", "prompts"),
+    inProjectInstructions: path2.join(opts.projectRoot, ".wrongstack", "instructions"),
+    inProjectDesignKits: path2.join(opts.projectRoot, ".wrongstack", "design-kits"),
+    inProjectWorktrees: path2.join(opts.projectRoot, ".wrongstack", "worktrees"),
     projectHash: hash,
     projectSlug: slug,
-    projectGoal: path.join(projectDir, "goal.json"),
-    projectInputHistory: path.join(projectDir, "input-history.json"),
-    projectSpecs: path.join(projectDir, "specs"),
-    projectTaskGraphs: path.join(projectDir, "task-graphs"),
-    projectSddSession: path.join(projectDir, "sdd-session.json"),
-    projectPlan: path.join(projectDir, "plan.json"),
-    projectAutophase: path.join(projectDir, "autophase"),
-    projectSddBoards: path.join(projectDir, "sdd-boards"),
-    projectRequirementIntakes: path.join(projectDir, "requirement-intakes"),
-    syncConfig: path.join(profileDir, "sync.json"),
-    configHistoryDir: path.join(globalRoot, "config-history"),
-    projectStatus: (projectHash2) => path.join(globalRoot, "projects", projectHash2, "status.json")
+    projectGoal: path2.join(projectDir, "goal.json"),
+    projectInputHistory: path2.join(projectDir, "input-history.json"),
+    projectSpecs: path2.join(projectDir, "specs"),
+    projectTaskGraphs: path2.join(projectDir, "task-graphs"),
+    projectSddSession: path2.join(projectDir, "sdd-session.json"),
+    projectPlan: path2.join(projectDir, "plan.json"),
+    projectAutophase: path2.join(projectDir, "autophase"),
+    projectSddBoards: path2.join(projectDir, "sdd-boards"),
+    projectRequirementIntakes: path2.join(projectDir, "requirement-intakes"),
+    syncConfig: path2.join(profileDir, "sync.json"),
+    configHistoryDir: path2.join(globalRoot, "config-history"),
+    projectStatus: (statusProjectSlug) => {
+      if (!/^[a-z0-9](?:[a-z0-9-]{0,39})-[a-f0-9]{6}$/.test(statusProjectSlug)) {
+        throw new Error(`Invalid project slug: ${statusProjectSlug}`);
+      }
+      return path2.join(globalRoot, "projects", statusProjectSlug, "status.json");
+    }
   };
 }
 
 // src/chronicle/identity.ts
 import { createHash as createHash3 } from "node:crypto";
 import * as os2 from "node:os";
-import * as path2 from "node:path";
+import * as path3 from "node:path";
 function resolveChronicleRuntimeLocation(input) {
   const day = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   return {
-    installationId: stableId("installation", path2.resolve(input.globalRoot)),
+    installationId: stableId("installation", path3.resolve(input.globalRoot)),
     machineId: stableId("machine", `${os2.hostname()}\0${os2.platform()}\0${os2.arch()}`),
     projectId: input.projectId,
-    chronicleDirectory: path2.join(input.projectDir, "chronicle"),
+    chronicleDirectory: path3.join(input.projectDir, "chronicle"),
     day
   };
 }
@@ -2713,10 +3236,10 @@ function stableId(prefix, value) {
 // src/chronicle/journal.ts
 init_file_permissions();
 init_atomic_write();
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import * as fs2 from "node:fs/promises";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 import { createInterface } from "node:readline";
 
 // src/chronicle/event-hash.ts
@@ -2739,14 +3262,14 @@ function chronicleEventHash(event) {
 }
 
 // src/chronicle/partition-filename.ts
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 var PARTITION_FILE_PATTERN = /^(.*\.events)(?:\.(\d{5}))?\.jsonl$/;
 function partitionFamily(filePath) {
-  const match = PARTITION_FILE_PATTERN.exec(path3.basename(filePath));
-  return path3.join(path3.dirname(filePath), match?.[1] ?? path3.basename(filePath));
+  const match = PARTITION_FILE_PATTERN.exec(path4.basename(filePath));
+  return path4.join(path4.dirname(filePath), match?.[1] ?? path4.basename(filePath));
 }
 function partitionSequence(filePath) {
-  const match = PARTITION_FILE_PATTERN.exec(path3.basename(filePath));
+  const match = PARTITION_FILE_PATTERN.exec(path4.basename(filePath));
   return Number(match?.[2] ?? 0);
 }
 function comparePartitionPaths(left, right) {
@@ -2795,10 +3318,10 @@ var ChronicleJournal = class {
   lastHash = GENESIS_HASH;
   lastAutoPurgeAt = 0;
   constructor(options) {
-    this.basePath = path4.resolve(options.filePath);
+    this.basePath = path5.resolve(options.filePath);
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.monotonicNow = options.monotonicNow ?? (() => process.hrtime.bigint());
-    this.idFactory = options.idFactory ?? randomUUID;
+    this.idFactory = options.idFactory ?? randomUUID2;
     this.maxPending = Math.max(1, options.maxPending ?? 1e5);
     this.batchWindowMs = Math.max(0, options.batchWindowMs ?? 5);
     this.maxPartitionSizeBytes = options.maxPartitionSizeBytes ?? DEFAULT_MAX_PARTITION_BYTES;
@@ -2868,14 +3391,14 @@ var ChronicleJournal = class {
     }
     await this.refreshStateFromDisk();
     const cutoff = Date.now() - options.retentionDays * 864e5;
-    const activePath = path4.resolve(this.path);
+    const activePath = path5.resolve(this.path);
     const errors = [];
     let dc = 0, db = 0, sc = 0;
     const suppliedFiles = options.files === void 0 ? await collectJournalPartitions(this.basePath) : [...options.files];
     const eligible = /* @__PURE__ */ new Set();
     for (const suppliedPath of new Set(suppliedFiles)) {
-      const file = path4.resolve(suppliedPath);
-      if (!isJournalPartition(file, path4.dirname(this.basePath), this.basePath)) {
+      const file = path5.resolve(suppliedPath);
+      if (!isJournalPartition(file, path5.dirname(this.basePath), this.basePath)) {
         errors.push({
           file: suppliedPath,
           reason: "not a Chronicle journal partition in this journal directory"
@@ -3096,34 +3619,34 @@ var ChronicleJournal = class {
   }
 };
 function rotatedPath(basePath, index) {
-  const dir = path4.dirname(basePath);
-  const ext = path4.extname(basePath);
-  const base = path4.basename(basePath, ext);
-  return path4.join(dir, `${base}.${String(index).padStart(5, "0")}${ext}`);
+  const dir = path5.dirname(basePath);
+  const ext = path5.extname(basePath);
+  const base = path5.basename(basePath, ext);
+  return path5.join(dir, `${base}.${String(index).padStart(5, "0")}${ext}`);
 }
 async function collectPartitions(basePath) {
-  const dir = path4.dirname(basePath);
-  const ext = path4.extname(basePath);
-  const base = path4.basename(basePath, ext);
+  const dir = path5.dirname(basePath);
+  const ext = path5.extname(basePath);
+  const base = path5.basename(basePath, ext);
   const pattern = new RegExp(`^${escapeRegex(base)}(?:\\.\\d{5})?${escapeRegex(ext)}$`);
   const result = [];
   try {
     const entries = await fs2.readdir(dir, { withFileTypes: true });
     for (const entry of entries)
-      if (entry.isFile() && pattern.test(entry.name)) result.push(path4.join(dir, entry.name));
+      if (entry.isFile() && pattern.test(entry.name)) result.push(path5.join(dir, entry.name));
   } catch {
   }
-  const baseFile = path4.join(dir, base + ext);
+  const baseFile = path5.join(dir, base + ext);
   const rotated = result.filter((file) => file !== baseFile).sort((left, right) => parseIndex(left, base, ext) - parseIndex(right, base, ext));
   return [baseFile, ...rotated];
 }
 async function collectJournalPartitions(basePath) {
-  const directory = path4.dirname(basePath);
+  const directory = path5.dirname(basePath);
   const result = [];
   try {
     const entries = await fs2.readdir(directory, { withFileTypes: true });
     for (const entry of entries) {
-      const file = path4.join(directory, entry.name);
+      const file = path5.join(directory, entry.name);
       if (entry.isFile() && isJournalPartition(file, directory, basePath)) result.push(file);
     }
   } catch {
@@ -3131,13 +3654,13 @@ async function collectJournalPartitions(basePath) {
   return result.sort(comparePartitionPaths);
 }
 function isJournalPartition(filePath, directory, basePath) {
-  if (path4.dirname(path4.resolve(filePath)) !== path4.resolve(directory)) return false;
-  const fileName = path4.basename(filePath);
+  if (path5.dirname(path5.resolve(filePath)) !== path5.resolve(directory)) return false;
+  const fileName = path5.basename(filePath);
   if (!basePath) return false;
-  const baseName = path4.basename(basePath);
+  const baseName = path5.basename(basePath);
   const dailyFamily = /^\d{4}-\d{2}-\d{2}\.events(?:\.\d{5})?\.jsonl$/;
   if (/^\d{4}-\d{2}-\d{2}\.events\.jsonl$/.test(baseName)) return dailyFamily.test(fileName);
-  return partitionFamilyBase(path4.resolve(filePath)) === partitionFamilyBase(path4.resolve(basePath));
+  return partitionFamilyBase(path5.resolve(filePath)) === partitionFamilyBase(path5.resolve(basePath));
 }
 function groupPartitionsByFamily(files) {
   const groups = /* @__PURE__ */ new Map();
@@ -3261,12 +3784,12 @@ function isHash(value) {
   return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 }
 function parseIndex(filePath, base, ext) {
-  const suffix = path4.basename(filePath).slice(base.length + 1, -ext.length);
+  const suffix = path5.basename(filePath).slice(base.length + 1, -ext.length);
   return suffix ? parseInt(suffix, 10) : 0;
 }
 function partitionIndex(filePath, basePath) {
-  const ext = path4.extname(basePath);
-  return parseIndex(filePath, path4.basename(basePath, ext), ext);
+  const ext = path5.extname(basePath);
+  return parseIndex(filePath, path5.basename(basePath, ext), ext);
 }
 function escapeRegex(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -3280,8 +3803,8 @@ async function readLastEntryState(filePath) {
     throw error;
   }
   try {
-    const stat7 = await handle.stat();
-    const size = stat7.size;
+    const stat8 = await handle.stat();
+    const size = stat8.size;
     let position = size, suffix = "";
     while (position > 0) {
       const length = Math.min(65536, position);
@@ -3298,14 +3821,14 @@ async function readLastEntryState(filePath) {
           return {
             entry: JSON.parse(trimmed),
             size,
-            birthtimeMs: stat7.birthtimeMs
+            birthtimeMs: stat8.birthtimeMs
           };
         } catch {
         }
       }
       suffix = lines[0] ?? "";
     }
-    return { size, birthtimeMs: stat7.birthtimeMs };
+    return { size, birthtimeMs: stat8.birthtimeMs };
   } finally {
     await handle.close();
   }
@@ -3323,7 +3846,7 @@ async function* streamEntriesStrict(filePath) {
       try {
         entry = JSON.parse(trimmed);
       } catch {
-        throw new Error(`invalid JSON at line ${lineNumber} in ${path4.basename(filePath)}`);
+        throw new Error(`invalid JSON at line ${lineNumber} in ${path5.basename(filePath)}`);
       }
       yield entry;
     }
@@ -3348,7 +3871,7 @@ function errorMessage(error) {
 init_atomic_write();
 import * as fs5 from "node:fs/promises";
 import { createRequire } from "node:module";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 
 // src/utils/sqlite-warning.ts
 var SQLITE_EXPERIMENTAL_WARNING_RE = /sqlite is an experimental feature/i;
@@ -3377,13 +3900,13 @@ function withSqliteExperimentalWarningSuppressed(run) {
 import { createHash as createHash5 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
 import * as fs4 from "node:fs/promises";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 
 // src/chronicle/partition-range-cache.ts
 init_atomic_write();
 import * as fs3 from "node:fs/promises";
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 var CACHE_VERSION = 1;
 function isRange(value) {
   if (!value || typeof value !== "object") return false;
@@ -3393,14 +3916,14 @@ function isRange(value) {
 var ChroniclePartitionRangeCache = class {
   constructor(directory) {
     this.directory = directory;
-    this.cachePath = path5.join(directory, "range-cache.json");
+    this.cachePath = path6.join(directory, "range-cache.json");
   }
   directory;
   cachePath;
   entries;
   dirty = false;
   toKey(filePath) {
-    return path5.relative(this.directory, filePath).split(path5.sep).join("/");
+    return path6.relative(this.directory, filePath).split(path6.sep).join("/");
   }
   async load() {
     if (this.entries) return this.entries;
@@ -3501,7 +4024,7 @@ var ChronicleQueryEngine = class _ChronicleQueryEngine {
   /** The one file (if any) that could still be actively appended to — never cache-checked or skipped. */
   activeFile;
   static async fromDirectory(directory, options) {
-    const resolved = path6.resolve(directory);
+    const resolved = path7.resolve(directory);
     const files = await findPartitions(resolved);
     const rangeCache = options?.rangeCache ?? new ChroniclePartitionRangeCache(resolved);
     return new _ChronicleQueryEngine(
@@ -3898,7 +4421,7 @@ async function findPartitions(root) {
       return;
     }
     for (const entry of entries) {
-      const full = path6.join(directory, entry.name);
+      const full = path7.join(directory, entry.name);
       if (entry.isDirectory()) await visit(full);
       else if (entry.isFile() && PARTITION_FILE_PATTERN.test(entry.name)) result.push(full);
     }
@@ -4085,7 +4608,7 @@ async function resolveSnapshotFiles(files, snapshot) {
   }));
 }
 function fileId(file) {
-  return createHash5("sha256").update(path6.resolve(file), "utf8").digest("base64url");
+  return createHash5("sha256").update(path7.resolve(file), "utf8").digest("base64url");
 }
 function stableStringify2(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -4197,8 +4720,8 @@ var ChronicleMetricsStore = class _ChronicleMetricsStore {
   directory;
   dbPath;
   constructor(directory) {
-    this.directory = path7.resolve(directory);
-    this.dbPath = path7.join(this.directory, "metrics.db");
+    this.directory = path8.resolve(directory);
+    this.dbPath = path8.join(this.directory, "metrics.db");
     const Database = loadDatabaseSync();
     this.db = new Database(this.dbPath);
     this.db.exec("PRAGMA journal_mode = WAL");
@@ -4223,7 +4746,7 @@ var ChronicleMetricsStore = class _ChronicleMetricsStore {
       const files = await findChroniclePartitions(this.directory);
       const offsets = this.loadOffsets();
       for (const file of files) {
-        const key = normalizeKey(path7.relative(this.directory, file));
+        const key = normalizeKey(path8.relative(this.directory, file));
         const consumed = offsets.get(key) ?? 0;
         const ingested = await this.ingestFile(file, key, consumed, result);
         if (ingested) result.sourceFiles++;
@@ -4593,7 +5116,7 @@ var ChronicleMetricsStore = class _ChronicleMetricsStore {
   }
   pruneOffsets(existingFiles) {
     const keep = new Set(
-      existingFiles.map((file) => normalizeKey(path7.relative(this.directory, file)))
+      existingFiles.map((file) => normalizeKey(path8.relative(this.directory, file)))
     );
     for (const row of this.db.prepare("SELECT file FROM ingest_state").all()) {
       if (!keep.has(row.file))
@@ -4890,7 +5413,7 @@ function normalizePathKey(value) {
 
 // src/chronicle/legacy-journal-import.ts
 import * as fs6 from "node:fs/promises";
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 var ChronicleImportError = class extends Error {
   constructor(message, day, sequence) {
     super(message);
@@ -4933,7 +5456,7 @@ async function importLegacyChronicleJournal(journal, directory) {
   let importedFamilies = 0;
   for (const familyBase of families) {
     const day = dayOfFamily(familyBase);
-    const basePath = path8.join(directory, `${familyBase}.jsonl`);
+    const basePath = path9.join(directory, `${familyBase}.jsonl`);
     let familyEvents = 0;
     if (journal.hasImportedDay(day)) continue;
     try {
@@ -4996,9 +5519,10 @@ async function importLegacyChronicleJournal(journal, directory) {
 }
 
 // src/chronicle/sqlite-journal.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import * as fs8 from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 
 // src/utils/index.ts
 init_atomic_write();
@@ -5027,7 +5551,7 @@ function envFlag(value) {
   return !/^(0|false|no|off)$/i.test(value.trim());
 }
 var COLOR = isColorTty();
-var wrap = (open4, close) => (s) => COLOR ? `\x1B[${open4}m${s}\x1B[${close}m` : s;
+var wrap = (open5, close) => (s) => COLOR ? `\x1B[${open5}m${s}\x1B[${close}m` : s;
 var color = {
   reset: wrap("0", "0"),
   bold: wrap("1", "22"),
@@ -5047,6 +5571,20 @@ var color = {
   bgGreen: wrap("42", "49")
 };
 
+// src/utils/config-json.ts
+import * as fs7 from "node:fs/promises";
+async function readJsonObjectFile(filePath) {
+  try {
+    const parsed = JSON.parse(await fs7.readFile(filePath, "utf8"));
+    return isJsonObject(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/skills/limits.ts
 var SKILL_LIMITS = {
   /**
@@ -5147,7 +5685,14 @@ var SKILL_LIMITS = {
 };
 
 // src/skills/frontmatter.ts
-var SCALAR_KEYS = /* @__PURE__ */ new Set(["name", "description", "trigger", "version", "license", "compatibility"]);
+var SCALAR_KEYS = /* @__PURE__ */ new Set([
+  "name",
+  "description",
+  "trigger",
+  "version",
+  "license",
+  "compatibility"
+]);
 function parseSkillFrontmatter(raw) {
   const text = normalizeLineEndings(raw);
   if (!text.startsWith("---")) return {};
@@ -5206,8 +5751,9 @@ function parseFrontmatterBlock(block) {
       out[normalizeKey2(key)] = collected.join("\n").trim();
       continue;
     }
-    if (key === "allowed-tools" || key === "allowedTools") {
-      out.allowedTools = rest.split(/[\s,]+/).filter(Boolean);
+    if (key === "allowed-tools" || key === "allowedTools" || key === "required-capabilities" || key === "requiredCapabilities" || key === "required-tools" || key === "requiredTools" || key === "optional-capabilities" || key === "optionalCapabilities") {
+      const values = rest.replace(/^\[/, "").replace(/\]$/, "").split(/[\s,]+/).map(unquote).filter(Boolean);
+      out[normalizeKey2(key)] = values;
       i++;
       continue;
     }
@@ -5221,7 +5767,11 @@ function parseFrontmatterBlock(block) {
   return out;
 }
 function normalizeKey2(key) {
-  return key === "allowed-tools" ? "allowedTools" : key;
+  if (key === "allowed-tools") return "allowedTools";
+  if (key === "required-capabilities") return "requiredCapabilities";
+  if (key === "required-tools") return "requiredTools";
+  if (key === "optional-capabilities") return "optionalCapabilities";
+  return key;
 }
 function unquote(s) {
   if (s.length >= 2 && (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'"))) {
@@ -5262,7 +5812,7 @@ function capSkillBody(body) {
 
 // src/utils/instruction-file.ts
 import { readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 import { fileURLToPath } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
@@ -5272,7 +5822,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync2(path9.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync2(path10.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -5288,11 +5838,11 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path9.dirname(fileURLToPath(import.meta.url));
+  const here = path10.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path9.resolve(here, "../../instructions"),
-    path9.resolve(here, "../instructions"),
-    path9.resolve(here, "instructions")
+    path10.resolve(here, "../../instructions"),
+    path10.resolve(here, "../instructions"),
+    path10.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   return rootCandidates;
@@ -5406,7 +5956,7 @@ var ChronicleSqliteQueryEngine = class {
     const comparison = order === "asc" ? ">" : "<";
     const keyset = cursor ? ` AND (day, sequence) ${comparison} (?, ?)` : "";
     const sql = `SELECT day, sequence, payload FROM events WHERE ${pushed.clause}${keyset} ORDER BY day ${direction}, sequence ${direction} LIMIT ? OFFSET ?`;
-    const summary = createSummaryAccumulator();
+    const summary2 = createSummaryAccumulator();
     const page = [];
     let total = 0;
     let scannedEvents = 0;
@@ -5430,7 +5980,7 @@ var ChronicleSqliteQueryEngine = class {
         }
         if (!matches(event, query)) continue;
         total++;
-        updateSummary(summary, event);
+        updateSummary(summary2, event);
         if (page.length < limit) {
           page.push(event);
           last = { day: row.day, sequence: row.sequence };
@@ -5445,7 +5995,7 @@ var ChronicleSqliteQueryEngine = class {
       scannedEvents,
       sourceFiles: this.diagnostics.sourceFiles,
       invalidLines: this.diagnostics.invalidLines,
-      summary: finalizeSummary(summary)
+      summary: finalizeSummary(summary2)
     };
     if (total > page.length && last) {
       return { ...result, nextCursor: encodeCursor2(last) };
@@ -5580,6 +6130,25 @@ var CHRONICLE_SQLITE_FILE = "chronicle.sqlite";
 var LEGACY_JSONL_MIGRATION_KEY = "legacy-jsonl-v1";
 var LEGACY_JSONL_QUARANTINE_KEY = "legacy-jsonl-v1:quarantine";
 var SCHEMA_VERSION2 = 1;
+var SQLITE_FIXED_OVERHEAD_BYTES = 16 * 1024 * 1024;
+var MIN_SQLITE_PAGE_BUDGET_BYTES = 64 * 1024;
+var MAX_ROLLBACK_JOURNAL_RESERVE_BYTES = 64 * 1024 * 1024;
+var ChronicleStorageQuotaError = class extends Error {
+  currentBytes;
+  batchBytes;
+  maxBytes;
+  path;
+  constructor(details) {
+    super(
+      `Chronicle SQLite quota exceeded at ${details.path}: ${details.currentBytes} live bytes + ${details.batchBytes} batch bytes exceeds ${details.maxBytes}; lower chronicle retentionDays/maxEvents to shed data (run chronicle compact to return the freed pages to the filesystem)`
+    );
+    this.name = "ChronicleStorageQuotaError";
+    this.currentBytes = details.currentBytes;
+    this.batchBytes = details.batchBytes;
+    this.maxBytes = details.maxBytes;
+    this.path = details.path;
+  }
+};
 var Ctor2;
 function loadDatabaseSync2() {
   if (Ctor2) return Ctor2;
@@ -5602,6 +6171,14 @@ var ChronicleSqliteJournal = class {
   now;
   monotonicNow;
   idFactory;
+  retentionDays;
+  maxEvents;
+  maxBytes;
+  retentionCheckIntervalMs;
+  nextRetentionCheckAt = 0;
+  retainedEventCount = 0;
+  /** Resolved lazily by `pageSizeBytes()`; constant for an open database. */
+  cachedPageSize;
   /**
    * Cached chain head per day. Cleared wholesale on any write failure so the
    * next append rebuilds from the database rather than trusting a counter that
@@ -5619,14 +6196,40 @@ var ChronicleSqliteJournal = class {
   };
   lastBatchDurationMs;
   constructor(options) {
-    this.dbPath = path10.join(path10.resolve(options.directory), CHRONICLE_SQLITE_FILE);
+    this.dbPath = path11.join(path11.resolve(options.directory), CHRONICLE_SQLITE_FILE);
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.monotonicNow = options.monotonicNow ?? (() => process.hrtime.bigint());
-    this.idFactory = options.idFactory ?? (() => randomUUID2());
+    this.idFactory = options.idFactory ?? (() => randomUUID3());
+    if (options.retentionDays !== void 0 && (!Number.isFinite(options.retentionDays) || options.retentionDays <= 0)) {
+      throw new RangeError("retentionDays must be a positive finite number");
+    }
+    if (options.retentionCheckIntervalMs !== void 0 && (!Number.isFinite(options.retentionCheckIntervalMs) || options.retentionCheckIntervalMs <= 0)) {
+      throw new RangeError("retentionCheckIntervalMs must be a positive finite number");
+    }
+    if (options.maxEvents !== void 0 && (!Number.isInteger(options.maxEvents) || options.maxEvents < 1)) {
+      throw new RangeError("maxEvents must be a positive integer");
+    }
+    if (options.maxBytes !== void 0 && (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1)) {
+      throw new RangeError("maxBytes must be a positive safe integer");
+    }
+    const minimumQuotaBytes = SQLITE_FIXED_OVERHEAD_BYTES + 2 * MIN_SQLITE_PAGE_BUDGET_BYTES;
+    if (options.maxBytes !== void 0 && options.maxBytes < minimumQuotaBytes) {
+      throw new RangeError(`maxBytes must be at least ${minimumQuotaBytes}`);
+    }
+    this.retentionDays = options.retentionDays;
+    this.maxEvents = options.maxEvents;
+    this.maxBytes = options.maxBytes;
+    this.retentionCheckIntervalMs = options.retentionCheckIntervalMs ?? 60 * 60 * 1e3;
     const Database = loadDatabaseSync2();
     this.db = new Database(this.dbPath);
-    this.db.exec("PRAGMA journal_mode = WAL");
+    this.db.exec(`PRAGMA journal_mode = ${this.maxBytes === void 0 ? "WAL" : "DELETE"}`);
     this.ensureSchema();
+    this.configureByteQuota();
+    if (this.maxEvents !== void 0) {
+      const row = this.db.prepare("SELECT COUNT(*) AS count FROM events").get();
+      this.retainedEventCount = row.count;
+      this.enforceEventLimitAtStartup();
+    }
   }
   close() {
     this.db.close();
@@ -5685,8 +6288,10 @@ var ChronicleSqliteJournal = class {
       events.push(event);
       previous = { sequence: event.sequence, hash: event.hash };
     }
+    let retainedCountAfterCommit = this.retainedEventCount;
     try {
       this.db.exec("BEGIN IMMEDIATE");
+      this.assertWithinByteQuota(events);
       const insert = this.db.prepare(
         `INSERT INTO events (
            day, sequence, event_id, hash, previous_hash, occurred_at, event_type, outcome,
@@ -5718,6 +6323,8 @@ var ChronicleSqliteJournal = class {
           JSON.stringify(event)
         );
       }
+      retainedCountAfterCommit = this.enforceEventLimitWithinTransaction();
+      this.assertActualAllocationWithinQuota();
       this.db.exec("COMMIT");
     } catch (error) {
       try {
@@ -5727,11 +6334,13 @@ var ChronicleSqliteJournal = class {
       this.anchors.clear();
       this.counters.failedEvents += inputs.length;
       this.lastBatchDurationMs = performance.now() - started;
-      throw error;
+      throw this.normalizeQuotaError(error);
     }
     this.anchors.set(day, previous);
     this.counters.persistedEvents += events.length;
+    this.retainedEventCount = retainedCountAfterCommit;
     this.lastBatchDurationMs = performance.now() - started;
+    await this.enforceRetentionIfDue();
     return events;
   }
   async readAll() {
@@ -5792,31 +6401,170 @@ var ChronicleSqliteJournal = class {
     }
     return { ok: true, entries, lastSequence, lastHash };
   }
+  async enforceRetentionIfDue() {
+    if (this.retentionDays === void 0) return;
+    const now = this.now();
+    if (now.getTime() < this.nextRetentionCheckAt) return;
+    this.nextRetentionCheckAt = now.getTime() + this.retentionCheckIntervalMs;
+    try {
+      await this.purge({ retentionDays: this.retentionDays });
+    } catch {
+    }
+  }
+  configureByteQuota() {
+    if (this.maxBytes === void 0) {
+      this.db.exec("PRAGMA max_page_count = 2147483646");
+      return;
+    }
+    const halfSplit = Math.floor((this.maxBytes - SQLITE_FIXED_OVERHEAD_BYTES) / 2);
+    const journalReserve = Math.min(MAX_ROLLBACK_JOURNAL_RESERVE_BYTES, halfSplit);
+    const mainBudget = this.maxBytes - SQLITE_FIXED_OVERHEAD_BYTES - journalReserve;
+    if (mainBudget < MIN_SQLITE_PAGE_BUDGET_BYTES) {
+      throw new Error(
+        `maxBytes must be at least ${SQLITE_FIXED_OVERHEAD_BYTES + 2 * MIN_SQLITE_PAGE_BUDGET_BYTES}`
+      );
+    }
+    const maxPages = Math.max(1, Math.floor(mainBudget / this.pageSizeBytes()));
+    this.db.exec(`PRAGMA max_page_count = ${maxPages}`);
+  }
   /**
-   * Drop events older than the retention window.
+   * Bytes the journal actually occupies: live pages in the main database plus
+   * whatever the rollback/WAL sidecars currently hold.
    *
-   * Retention is day-granular and chains are day-scoped, so a purge removes
-   * whole chains rather than truncating one. That is why nothing needs to be
-   * checkpointed here: there is no surviving suffix left dangling without an
-   * anchor. Any checkpoint imported from a partially-purged legacy day family
-   * is dropped alongside its events.
+   * The quota MUST be measured this way rather than by `statSync` on the main
+   * database file. SQLite never returns freed pages to the filesystem — it
+   * parks them on the freelist and reuses them — so a database that once grew
+   * large keeps that size forever, even after retention and `maxEvents` have
+   * evicted almost everything. Measuring the file instead wedged the journal
+   * permanently: a 3.9 GB file whose live data was 243 MB failed a 512 MB
+   * quota on EVERY append, and the only escape (`chronicle compact`) refuses
+   * to run while the daemon is up — and the daemon respawns on demand. Live
+   * pages shrink when retention deletes rows, so the quota can recover on its
+   * own; allocated size cannot.
+   *
+   * The sidecars keep their on-disk size: they are transient and genuinely
+   * bounded by `configureByteQuota`'s half-of-budget split.
    */
-  async purge(options) {
-    const empty = {
-      deletedCount: 0,
-      deletedBytes: 0,
-      skippedCount: 0,
-      errors: []
-    };
-    if (!Number.isFinite(options.retentionDays) || options.retentionDays <= 0) return empty;
-    const cutoff = new Date(this.now().getTime() - options.retentionDays * 864e5).toISOString().slice(0, 10);
-    const count = this.db.prepare("SELECT COUNT(*) AS n FROM events WHERE day < ?").get(cutoff).n;
-    if (count === 0) return empty;
-    if (options.dryRun) {
-      const days = this.db.prepare("SELECT DISTINCT day FROM events WHERE day < ? ORDER BY day").all(cutoff);
-      return { ...empty, deletedCount: count, candidates: days.map((row) => row.day) };
+  aggregateLiveBytes() {
+    let total = 0;
+    for (const file of [`${this.dbPath}-journal`, `${this.dbPath}-wal`, `${this.dbPath}-shm`]) {
+      try {
+        total += fs8.statSync(file).size;
+      } catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+      }
     }
-    try {
+    return total + this.mainDatabaseLiveBytes();
+  }
+  /** Live (non-freelist) pages of the main database, in bytes. */
+  mainDatabaseLiveBytes() {
+    const pageCount = Number(
+      this.db.prepare("PRAGMA page_count").get().page_count
+    );
+    const freelist = Number(
+      this.db.prepare("PRAGMA freelist_count").get().freelist_count
+    );
+    return Math.max(0, pageCount - freelist) * this.pageSizeBytes();
+  }
+  /** Page size never changes for an open database; resolve it once. */
+  pageSizeBytes() {
+    if (this.cachedPageSize === void 0) {
+      this.cachedPageSize = Number(
+        this.db.prepare("PRAGMA page_size").get().page_size
+      );
+    }
+    return this.cachedPageSize;
+  }
+  normalizeQuotaError(error) {
+    if (this.maxBytes === void 0 || !(error instanceof Error)) return error;
+    const sqliteError = error;
+    const quotaExhausted = sqliteError.code === "SQLITE_FULL" || sqliteError.code === 13 || sqliteError.errcode === 13 || /database or disk is full/i.test(sqliteError.message);
+    if (!quotaExhausted) return error;
+    return new ChronicleStorageQuotaError({
+      currentBytes: this.aggregateLiveBytes(),
+      batchBytes: 0,
+      maxBytes: this.maxBytes,
+      path: this.dbPath
+    });
+  }
+  assertActualAllocationWithinQuota() {
+    if (this.maxBytes === void 0) return;
+    const currentBytes = this.aggregateLiveBytes();
+    if (currentBytes <= this.maxBytes) return;
+    throw new ChronicleStorageQuotaError({
+      currentBytes,
+      batchBytes: 0,
+      maxBytes: this.maxBytes,
+      path: this.dbPath
+    });
+  }
+  assertWithinByteQuota(events) {
+    if (this.maxBytes === void 0) return;
+    const currentBytes = this.aggregateLiveBytes();
+    const batchBytes = Buffer.byteLength(JSON.stringify(events), "utf8");
+    if (currentBytes + batchBytes <= this.maxBytes) return;
+    throw new ChronicleStorageQuotaError({
+      currentBytes,
+      batchBytes,
+      maxBytes: this.maxBytes,
+      path: this.dbPath
+    });
+  }
+  enforceEventLimitWithinTransaction() {
+    const row = this.db.prepare("SELECT COUNT(*) AS count FROM events").get();
+    if (this.maxEvents === void 0 || row.count <= this.maxEvents) return row.count;
+    const excess = row.count - this.maxEvents;
+    const boundary = this.db.prepare("SELECT day, sequence, hash FROM events ORDER BY day, sequence LIMIT 1 OFFSET ?").get(excess - 1);
+    if (!boundary) return row.count;
+    this.db.prepare(
+      `INSERT INTO chain_checkpoint (day, sequence, hash) VALUES (?, ?, ?)
+         ON CONFLICT(day) DO UPDATE SET sequence = excluded.sequence, hash = excluded.hash`
+    ).run(boundary.day, boundary.sequence, boundary.hash);
+    this.db.prepare("DELETE FROM events WHERE day < ? OR (day = ? AND sequence <= ?)").run(boundary.day, boundary.day, boundary.sequence);
+    this.db.prepare("DELETE FROM chain_checkpoint WHERE day < ?").run(boundary.day);
+    this.anchors.clear();
+    return this.maxEvents;
+  }
+  enforceEventLimitAtStartup() {
+    if (this.maxEvents === void 0 || this.retainedEventCount <= this.maxEvents) return;
+    try {
+      this.db.exec("BEGIN IMMEDIATE");
+      const retainedCount = this.enforceEventLimitWithinTransaction();
+      this.db.exec("COMMIT");
+      this.retainedEventCount = retainedCount;
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  }
+  /**
+   * Drop events older than the retention window.
+   *
+   * Retention is day-granular and chains are day-scoped, so a purge removes
+   * whole chains rather than truncating one. That is why nothing needs to be
+   * checkpointed here: there is no surviving suffix left dangling without an
+   * anchor. Any checkpoint imported from a partially-purged legacy day family
+   * is dropped alongside its events.
+   */
+  async purge(options) {
+    const empty = {
+      deletedCount: 0,
+      deletedBytes: 0,
+      skippedCount: 0,
+      errors: []
+    };
+    if (!Number.isFinite(options.retentionDays) || options.retentionDays <= 0) return empty;
+    const cutoff = new Date(this.now().getTime() - options.retentionDays * 864e5).toISOString().slice(0, 10);
+    const count = this.db.prepare("SELECT COUNT(*) AS n FROM events WHERE day < ?").get(cutoff).n;
+    if (count === 0) return empty;
+    if (options.dryRun) {
+      const days = this.db.prepare("SELECT DISTINCT day FROM events WHERE day < ? ORDER BY day").all(cutoff);
+      return { ...empty, deletedCount: count, candidates: days.map((row) => row.day) };
+    }
+    try {
       this.db.exec("BEGIN IMMEDIATE");
       this.db.prepare("DELETE FROM events WHERE day < ?").run(cutoff);
       this.db.prepare("DELETE FROM chain_checkpoint WHERE day < ?").run(cutoff);
@@ -5837,6 +6585,7 @@ var ChronicleSqliteJournal = class {
       };
     }
     this.anchors.clear();
+    this.retainedEventCount = Math.max(0, this.retainedEventCount - count);
     return { ...empty, deletedCount: count };
   }
   /**
@@ -5868,7 +6617,9 @@ var ChronicleSqliteJournal = class {
          ON CONFLICT(day) DO UPDATE SET sequence = excluded.sequence, hash = excluded.hash`
     );
     this.db.exec("BEGIN IMMEDIATE");
+    let retainedCountAfterCommit = this.retainedEventCount;
     try {
+      this.assertWithinByteQuota([]);
       await load({
         insert: (day, event) => {
           const row = projectEvent(event);
@@ -5898,16 +6649,19 @@ var ChronicleSqliteJournal = class {
           checkpoint.run(day, sequence, hash);
         }
       });
+      retainedCountAfterCommit = this.enforceEventLimitWithinTransaction();
+      this.assertActualAllocationWithinQuota();
       this.db.exec("COMMIT");
     } catch (error) {
       try {
         this.db.exec("ROLLBACK");
       } catch {
       }
-      throw error;
+      throw this.normalizeQuotaError(error);
     } finally {
       this.anchors.clear();
     }
+    this.retainedEventCount = retainedCountAfterCommit;
   }
   /**
    * A read engine over this journal's own connection.
@@ -6063,15 +6817,15 @@ function projectEvent(event) {
 
 // src/chronicle/project-server-client.ts
 import { spawn } from "node:child_process";
-import * as fs7 from "node:fs";
+import * as fs9 from "node:fs";
 import * as net from "node:net";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/chronicle/project-server-endpoint.ts
 import { createHash as createHash6 } from "node:crypto";
 import * as os3 from "node:os";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 
 // src/chronicle/project-server-protocol.ts
 var CHRONICLE_PROJECT_SERVER_PROTOCOL_VERSION = 2;
@@ -6084,39 +6838,39 @@ function encodeChronicleProjectServerMessage(message) {
 // src/chronicle/project-server-endpoint.ts
 var CHRONICLE_PROJECT_SERVER_METADATA_FILE = "server.json";
 function normalizedPath(value) {
-  const resolved = path11.resolve(value);
+  const resolved = path12.resolve(value);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function chronicleProjectServerKey(projectDir) {
-  return createHash6("sha256").update(normalizedPath(path11.join(projectDir, "chronicle"))).digest("hex").slice(0, 24);
+  return createHash6("sha256").update(normalizedPath(path12.join(projectDir, "chronicle"))).digest("hex").slice(0, 24);
 }
 function chronicleProjectServerEndpoint(projectDir) {
   const key = chronicleProjectServerKey(projectDir);
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\wrongstack-chronicle-v${CHRONICLE_PROJECT_SERVER_PROTOCOL_VERSION}-${key}`;
   }
-  return path11.join(
+  return path12.join(
     os3.tmpdir(),
     `wsch-v${CHRONICLE_PROJECT_SERVER_PROTOCOL_VERSION}`,
     `${key}.sock`
   );
 }
 function chronicleProjectServerMetadataPath(projectDir) {
-  return path11.join(projectDir, "chronicle", CHRONICLE_PROJECT_SERVER_METADATA_FILE);
+  return path12.join(projectDir, "chronicle", CHRONICLE_PROJECT_SERVER_METADATA_FILE);
 }
 
 // src/chronicle/project-server-client.ts
 var CONNECT_ATTEMPT_TIMEOUT_MS = 750;
 var SERVER_START_TIMEOUT_MS = 1e4;
 var DEFAULT_CALL_TIMEOUT_MS = 3e4;
-function resolveChronicleDaemonAvailability(moduleUrl = import.meta.url, exists = fs7.existsSync) {
+function resolveChronicleDaemonAvailability(moduleUrl = import.meta.url, exists = fs9.existsSync) {
   if (process.env["WRONGSTACK_CHRONICLE_INLINE"] || process.env["WRONGSTACK_CHRONICLE_SERVER"] === "0") {
     return { kind: "inline-requested" };
   }
   const url = locateChronicleProjectServer(moduleUrl, exists);
   return url ? { kind: "available", url } : { kind: "missing-build" };
 }
-function resolveChronicleProjectServerUrl(moduleUrl = import.meta.url, exists = fs7.existsSync) {
+function resolveChronicleProjectServerUrl(moduleUrl = import.meta.url, exists = fs9.existsSync) {
   const availability = resolveChronicleDaemonAvailability(moduleUrl, exists);
   return availability.kind === "available" ? availability.url : null;
 }
@@ -6285,7 +7039,7 @@ var ChronicleProjectServerClient = class {
   currentAuthToken() {
     if (this.authToken === void 0) {
       try {
-        const raw = fs7.readFileSync(
+        const raw = fs9.readFileSync(
           chronicleProjectServerMetadataPath(this.options.projectDir),
           "utf8"
         );
@@ -6423,7 +7177,7 @@ var ChronicleProjectServerClient = class {
   }
 };
 function normalizePath(value) {
-  const resolved = path12.resolve(value);
+  const resolved = path13.resolve(value);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 
@@ -6431,7 +7185,7 @@ function normalizePath(value) {
 function resolveChronicleProjectServerOptions(options) {
   if (options.projectPaths) {
     return {
-      projectRoot: path13.resolve(options.projectRoot),
+      projectRoot: path14.resolve(options.projectRoot),
       ...options.projectPaths,
       ...options.retentionDays !== void 0 ? { retentionDays: options.retentionDays } : {}
     };
@@ -6441,7 +7195,7 @@ function resolveChronicleProjectServerOptions(options) {
     userHome: options.userHome ?? os4.homedir()
   });
   return {
-    projectRoot: path13.resolve(options.projectRoot),
+    projectRoot: path14.resolve(options.projectRoot),
     globalRoot: paths.globalRoot,
     projectId: paths.projectHash,
     projectDir: paths.projectDir,
@@ -6469,7 +7223,7 @@ function assertInlineWasRequested(caller) {
   );
 }
 function legacyPartitionPath(location) {
-  return path13.join(location.chronicleDirectory, `${location.day}.events.jsonl`);
+  return path14.join(location.chronicleDirectory, `${location.day}.events.jsonl`);
 }
 function useSqliteStore() {
   return process.env["WRONGSTACK_CHRONICLE_STORE"] !== "jsonl";
@@ -6575,7 +7329,7 @@ var InlineChronicleProjectAccess = class {
     }
   }
   get chronicleDirectory() {
-    return path13.join(this.options.projectDir, "chronicle");
+    return path14.join(this.options.projectDir, "chronicle");
   }
   journalForToday() {
     const now = /* @__PURE__ */ new Date();
@@ -6784,16 +7538,16 @@ async function findActiveKanbanCard(projectRoot) {
 }
 async function findFileProvenance(projectRoot, filePaths) {
   if (filePaths.length === 0) return [];
-  let access6;
+  let access7;
   try {
-    access6 = createChronicleProjectAccess({ projectRoot });
+    access7 = createChronicleProjectAccess({ projectRoot });
   } catch {
     return [];
   }
   const provenance = [];
   try {
     const uniquePaths = [...new Set(filePaths)];
-    const result = await access6.call("metrics", {
+    const result = await access7.call("metrics", {
       view: "files",
       refresh: false,
       files: {
@@ -6818,7 +7572,7 @@ async function findFileProvenance(projectRoot, filePaths) {
       });
     }
   } finally {
-    await access6.close();
+    await access7.close();
   }
   return provenance;
 }
@@ -6915,6 +7669,7 @@ function resolveAutoReviewConfig(cfg, sessionConfig) {
     provider: resolvedProvider,
     model: resolvedModel,
     fallbackModels,
+    modelSelection: cfg.modelSelection === "random" ? "random" : "round-robin",
     debounceMs: cfg.debounceMs ?? DEFAULT_DEBOUNCE_MS,
     maxFilesPerBatch: cfg.maxFilesPerBatch ?? DEFAULT_MAX_FILES_PER_BATCH,
     maxConcurrentReviews: cfg.maxConcurrentReviews ?? DEFAULT_MAX_CONCURRENT_REVIEWS,
@@ -7035,9 +7790,9 @@ async function snapshotChangedFiles(cwd) {
     if (file.path.startsWith(".wrongstack/")) continue;
     if (budget <= 0) break;
     try {
-      const stat7 = await fsp.stat(path14.join(cwd, file.path));
-      if (!stat7.isFile() || stat7.size > MAX_SNAPSHOT_FILE_BYTES) continue;
-      const content = await fsp.readFile(path14.join(cwd, file.path), "utf8");
+      const stat8 = await fsp2.stat(path15.join(cwd, file.path));
+      if (!stat8.isFile() || stat8.size > MAX_SNAPSHOT_FILE_BYTES) continue;
+      const content = await fsp2.readFile(path15.join(cwd, file.path), "utf8");
       budget -= content.length;
       snapshots.push({
         ...file,
@@ -7059,7 +7814,7 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "",
       "Continuous code review that fires on every change during a session.",
       "Detects git-tracked file edits and dispatches review subagents",
-      "with configurable provider/model/fallback.",
+      "with configurable provider/model/fallback and profile selection.",
       "",
       "Reports are persisted and shown as passive notifications.",
       "They never wake the leader or spawn mutating follow-up agents.",
@@ -7074,6 +7829,7 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "  provider             provider id for review agents",
       "  model                model id for review agents",
       "  fallbackProfile      named profile from config.fallbackProfiles",
+      "  modelSelection       round-robin | random (default round-robin)",
       "  debounceMs           debounce window (default 15000)",
       "  maxFilesPerBatch     max files per review (default 15)",
       "  maxConcurrentReviews max parallel reviews (default 2)",
@@ -7100,7 +7856,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
           "",
           `  Provider:       ${cfg.provider}`,
           `  Model:          ${cfg.model}`,
-          `  Fallback:       ${cfg.fallbackModels.length > 0 ? cfg.fallbackModels.join(", ") : "(none)"}`,
+          `  Fallback / RR:  ${cfg.fallbackModels.length > 0 ? cfg.fallbackModels.join(", ") : "(none)"}`,
+          `  Selection:      ${cfg.modelSelection}`,
           `  Debounce:       ${cfg.debounceMs} ms`,
           `  Max files:      ${cfg.maxFilesPerBatch}`,
           `  Max parallel:   ${cfg.maxConcurrentReviews}`,
@@ -7319,6 +8076,7 @@ function createAutoReviewPlugin() {
             maxCascadeDepth: cfg.maxCascadeDepth
           });
           bundle.reviewFallbackModels = [...cfg.fallbackModels];
+          bundle.reviewModelSelection = cfg.modelSelection;
           const trackedChangedPaths = new Set(
             snapshots.filter((file) => !file.path.startsWith(".wrongstack/")).map((file) => file.path)
           );
@@ -7329,7 +8087,7 @@ function createAutoReviewPlugin() {
           api.log.info(
             `[auto-review] #${reviewCounter} emitting review_needed (${filesWithContent.length} files, provider=${cfg.provider} model=${cfg.model})`
           );
-          const emittedBundle = emitReviewIfChanged(api, bundle);
+          const emittedBundle = await emitReviewIfChanged(api, bundle);
           if (!emittedBundle) {
             api.log.info(
               `[auto-review] #${reviewCounter} skipped \u2014 file content already has a review in progress`
@@ -7362,89 +8120,94 @@ function createAutoReviewPlugin() {
       api.onEvent("iteration.completed", async (payload) => {
         await handleIterationCompleted?.(payload);
       });
-      api.onEvent("session.ended", async () => {
-        sessionEnded = true;
-        const handedOffFiles = pendingFiles.size;
-        cancelPendingReviewTimer();
-        if (handedOffFiles > 0) {
-          api.log.info(
-            `[auto-review] session ended \u2014 handed ${handedOffFiles} pending mid-session file(s) to post-session review`
-          );
-        }
-        await pendingReviewWork;
-        try {
-          const cfg = resolved;
-          if (!cfg.enabled) return;
-          const cwd = api.config.cwd ?? process.cwd();
-          if (!await isGitRepo(cwd)) return;
-          const allChanged = await getChangedFiles(cwd);
-          const existing = [];
-          for (const f of allChanged) {
-            if (f.path.startsWith(".wrongstack/")) continue;
-            try {
-              await fsp.access(path14.join(cwd, f.path));
-              existing.push(f);
-            } catch {
-            }
-          }
-          if (existing.length === 0) return;
-          const toReview = existing.slice(0, cfg.maxFilesPerBatch);
-          const filesWithContent = [];
-          for (const f of toReview) {
-            try {
-              const absPath = path14.join(cwd, f.path);
-              const content = await fsp.readFile(absPath, "utf8");
-              filesWithContent.push({ path: f.path, status: f.status, content });
-            } catch {
-            }
-          }
-          if (filesWithContent.length === 0) return;
-          if (inFlight.length >= cfg.maxConcurrentReviews) {
+      api.onEvent("session.ended", (event) => {
+        const work = (async () => {
+          sessionEnded = true;
+          const handedOffFiles = pendingFiles.size;
+          cancelPendingReviewTimer();
+          if (handedOffFiles > 0) {
             api.log.info(
-              `[auto-review] session end \u2014 at max concurrent (${cfg.maxConcurrentReviews}), skipping final review`
+              `[auto-review] session ended \u2014 handed ${handedOffFiles} pending mid-session file(s) to post-session review`
             );
-            return;
           }
-          const bundle = await buildReviewContext({
-            cwd,
-            config: {
-              enabled: true,
-              provider: cfg.provider,
-              model: cfg.model,
-              maxFiles: cfg.maxFilesPerBatch,
-              autoFix: "off",
-              cascadeOn: "off",
-              maxCascadeDepth: 0
-            },
-            files: filesWithContent,
-            cascadeOn: cfg.cascadeOn,
-            maxCascadeDepth: cfg.maxCascadeDepth
-          });
-          bundle.reviewFallbackModels = [...cfg.fallbackModels];
-          const trackedChangedPaths = new Set(existing.map((file) => file.path));
-          bundle.allChangedFiles = bundle.allChangedFiles?.filter(
-            (file) => trackedChangedPaths.has(file.path)
-          );
-          const emittedBundle = emitReviewIfChanged(api, bundle);
-          if (!emittedBundle) {
+          await pendingReviewWork;
+          try {
+            const cfg = resolved;
+            if (!cfg.enabled) return;
+            const cwd = api.config.cwd ?? process.cwd();
+            if (!await isGitRepo(cwd)) return;
+            const allChanged = await getChangedFiles(cwd);
+            const existing = [];
+            for (const f of allChanged) {
+              if (f.path.startsWith(".wrongstack/")) continue;
+              try {
+                await fsp2.access(path15.join(cwd, f.path));
+                existing.push(f);
+              } catch {
+              }
+            }
+            if (existing.length === 0) return;
+            const toReview = existing.slice(0, cfg.maxFilesPerBatch);
+            const filesWithContent = [];
+            for (const f of toReview) {
+              try {
+                const absPath = path15.join(cwd, f.path);
+                const content = await fsp2.readFile(absPath, "utf8");
+                filesWithContent.push({ path: f.path, status: f.status, content });
+              } catch {
+              }
+            }
+            if (filesWithContent.length === 0) return;
+            if (inFlight.length >= cfg.maxConcurrentReviews) {
+              api.log.info(
+                `[auto-review] session end \u2014 at max concurrent (${cfg.maxConcurrentReviews}), skipping final review`
+              );
+              return;
+            }
+            const bundle = await buildReviewContext({
+              cwd,
+              config: {
+                enabled: true,
+                provider: cfg.provider,
+                model: cfg.model,
+                maxFiles: cfg.maxFilesPerBatch,
+                autoFix: "off",
+                cascadeOn: "off",
+                maxCascadeDepth: 0
+              },
+              files: filesWithContent,
+              cascadeOn: cfg.cascadeOn,
+              maxCascadeDepth: cfg.maxCascadeDepth
+            });
+            bundle.reviewFallbackModels = [...cfg.fallbackModels];
+            bundle.reviewModelSelection = cfg.modelSelection;
+            const trackedChangedPaths = new Set(existing.map((file) => file.path));
+            bundle.allChangedFiles = bundle.allChangedFiles?.filter(
+              (file) => trackedChangedPaths.has(file.path)
+            );
+            const emittedBundle = await emitReviewIfChanged(api, bundle);
+            if (!emittedBundle) {
+              api.log.info(
+                "[auto-review] session end \u2014 unchanged files already have reviews in progress"
+              );
+              return;
+            }
+            const inflightEntry = {
+              files: emittedBundle.files.map((file) => file.path),
+              startedAt: Date.now(),
+              subagentType: "review"
+            };
+            inFlight.push(inflightEntry);
+            expireInFlight(inflightEntry);
             api.log.info(
-              "[auto-review] session end \u2014 unchanged files already have reviews in progress"
+              `[auto-review] session end \u2014 final review (${emittedBundle.files.length} files)`
             );
-            return;
+          } catch (err) {
+            api.log.warn(`[auto-review] session.ended handler failed: ${toErrorMessage(err)}`);
           }
-          const inflightEntry = {
-            files: emittedBundle.files.map((file) => file.path),
-            startedAt: Date.now(),
-            subagentType: "review"
-          };
-          inFlight.push(inflightEntry);
-          expireInFlight(inflightEntry);
-          api.log.info(
-            `[auto-review] session end \u2014 final review (${emittedBundle.files.length} files)`
-          );
-        } catch (err) {
-          api.log.warn(`[auto-review] session.ended handler failed: ${toErrorMessage(err)}`);
-        }
+        })();
+        event?.waitUntil?.(work);
+        return work;
       });
       api.onPattern("chimera.review_complete", (_event, payload) => {
         try {
@@ -7490,16 +8253,16 @@ function createAutoReviewPlugin() {
 // src/plugins/chimera-plugin.ts
 init_error();
 import { spawn as spawn4 } from "node:child_process";
-import * as fsp4 from "node:fs/promises";
+import * as fsp5 from "node:fs/promises";
 import * as os5 from "node:os";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 
 // src/plugins/review-finding-commands.ts
 init_review_finding_store();
 
 // src/plugins/review-finding-parser.ts
 init_review_finding_types();
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var SUGGEST_LINE = /^\s*(?:→|->|=>)\s*(.+)$/;
 var DURATION_LINE = /^Duration:\s*(\d+)s\s*$/im;
 function parseChimeraReviewReport(reportText, context = {}) {
@@ -7507,7 +8270,7 @@ function parseChimeraReviewReport(reportText, context = {}) {
     return { findings: [], unparseableCount: 0 };
   }
   const findings = [];
-  const reportId = context.reportId ?? randomUUID4();
+  const reportId = context.reportId ?? randomUUID5();
   let unparseableCount = 0;
   let durationSeconds;
   let currentSeverity = null;
@@ -7608,7 +8371,7 @@ function parseFindingSegment(segment, severity, context) {
   const fullDesc = suggestions.length > 0 ? cleanDesc + "\n" + suggestions.map((s) => "  \u2192 " + s).join("\n") : cleanDesc;
   const suggestedFix = suggestions.length > 0 ? suggestions.join("\n") : void 0;
   return {
-    id: randomUUID4(),
+    id: randomUUID5(),
     fingerprint: computeFindingFingerprint(file ?? "", line ?? null, title),
     severity,
     source: normalizeFindingSource(context.reviewType),
@@ -7619,7 +8382,7 @@ function parseFindingSegment(segment, severity, context) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     status: "active",
     originReport: {
-      reportId: context.reportId ?? randomUUID4(),
+      reportId: context.reportId ?? randomUUID5(),
       sessionId: context.sessionId ?? "",
       agentId: context.agentId ?? "",
       reviewerModel: context.reviewerModel ?? ""
@@ -8273,7 +9036,10 @@ function buildChimeraCommand(getConfig, events) {
             ].join("\n")
           };
         }
-        events.emit("chimera.set_autofix", { mode });
+        events.emit(
+          "chimera.set_autofix",
+          { mode }
+        );
         return {
           message: `\u2705 Chimera autoFix set to "${mode}" for this session (config file unchanged).`
         };
@@ -8312,8 +9078,8 @@ function buildReviewCommand(_getConfig) {
     async run(args) {
       const cwd = process.cwd();
       const slug = projectSlug(cwd);
-      const globalRoot = path17.join(os5.homedir(), ".wrongstack");
-      const projectDir = path17.join(globalRoot, "projects", slug);
+      const globalRoot = path18.join(os5.homedir(), ".wrongstack");
+      const projectDir = path18.join(globalRoot, "projects", slug);
       const trimmed = (args ?? "").trim();
       const parts = trimmed.split(/\s+/).filter(Boolean);
       return {
@@ -8346,10 +9112,10 @@ function createChimeraPlugin() {
         }
       });
       api.onPattern("chimera.review_needed", (_event, payload) => {
-        recordStartedReview(api.events, payload);
+        void recordStartedReview(api.events, payload).catch(() => void 0);
       });
       api.onPattern("chimera.review_complete", (_event, payload) => {
-        recordCompletedReview(api.events, payload);
+        void recordCompletedReview(api.events, payload).catch(() => void 0);
       });
       if (!resolved.enabled) {
         api.log.info("[chimera] disabled by config");
@@ -8360,64 +9126,70 @@ function createChimeraPlugin() {
       );
       api.slashCommands.register(buildChimeraCommand(() => resolved, api.events));
       api.slashCommands.register(buildReviewCommand(() => resolved));
-      api.onEvent("session.ended", async () => {
-        try {
-          const cfg = resolved;
-          if (!cfg.enabled) return;
-          const cwd = api.config.cwd ?? process.cwd();
-          if (!await isGitRepo2(cwd)) {
-            api.log.info("[chimera] skipped \u2014 not a git repo");
-            return;
-          }
-          const allChanged = await getChangedFiles2(cwd);
-          const existing = [];
-          for (const f of allChanged) {
-            if (f.path.startsWith(".wrongstack/")) continue;
-            try {
-              await fsp4.access(path17.join(cwd, f.path));
-              existing.push(f);
-            } catch {
+      api.onEvent("session.ended", (event) => {
+        const work = (async () => {
+          try {
+            const cfg = resolved;
+            if (!cfg.enabled) return;
+            const cwd = api.config.cwd ?? process.cwd();
+            if (!await isGitRepo2(cwd)) {
+              api.log.info("[chimera] skipped \u2014 not a git repo");
+              return;
             }
-          }
-          if (existing.length === 0) {
-            api.log.info("[chimera] no changed files to review");
-            return;
-          }
-          const toReview = existing.slice(0, cfg.maxFiles);
-          if (existing.length > cfg.maxFiles) {
-            api.log.info(`[chimera] capping review at ${cfg.maxFiles} of ${existing.length} files`);
-          }
-          const filesWithContent = [];
-          for (const f of toReview) {
-            try {
-              const absPath = path17.join(cwd, f.path);
-              const content = await fsp4.readFile(absPath, "utf8");
-              filesWithContent.push({ path: f.path, status: f.status, content });
-            } catch {
+            const allChanged = await getChangedFiles2(cwd);
+            const existing = [];
+            for (const f of allChanged) {
+              if (f.path.startsWith(".wrongstack/")) continue;
+              try {
+                await fsp5.access(path18.join(cwd, f.path));
+                existing.push(f);
+              } catch {
+              }
             }
+            if (existing.length === 0) {
+              api.log.info("[chimera] no changed files to review");
+              return;
+            }
+            const toReview = existing.slice(0, cfg.maxFiles);
+            if (existing.length > cfg.maxFiles) {
+              api.log.info(
+                `[chimera] capping review at ${cfg.maxFiles} of ${existing.length} files`
+              );
+            }
+            const filesWithContent = [];
+            for (const f of toReview) {
+              try {
+                const absPath = path18.join(cwd, f.path);
+                const content = await fsp5.readFile(absPath, "utf8");
+                filesWithContent.push({ path: f.path, status: f.status, content });
+              } catch {
+              }
+            }
+            if (filesWithContent.length === 0) {
+              api.log.info("[chimera] could not read changed files");
+              return;
+            }
+            const bundle = await buildReviewContext({
+              cwd,
+              config: cfg,
+              files: filesWithContent,
+              cascadeOn: cfg.cascadeOn,
+              maxCascadeDepth: cfg.maxCascadeDepth
+            });
+            const emittedBundle = await emitReviewIfChanged(api, bundle);
+            if (!emittedBundle) {
+              api.log.info("[chimera] skipped \u2014 changed files already have reviews in progress");
+              return;
+            }
+            api.log.info(
+              `[chimera] emitted review_needed event (${emittedBundle.files.length} files)`
+            );
+          } catch (err) {
+            api.log.warn(`[chimera] session.ended handler failed: ${toErrorMessage(err)}`);
           }
-          if (filesWithContent.length === 0) {
-            api.log.info("[chimera] could not read changed files");
-            return;
-          }
-          const bundle = await buildReviewContext({
-            cwd,
-            config: cfg,
-            files: filesWithContent,
-            cascadeOn: cfg.cascadeOn,
-            maxCascadeDepth: cfg.maxCascadeDepth
-          });
-          const emittedBundle = emitReviewIfChanged(api, bundle);
-          if (!emittedBundle) {
-            api.log.info("[chimera] skipped \u2014 changed files already have reviews in progress");
-            return;
-          }
-          api.log.info(
-            `[chimera] emitted review_needed event (${emittedBundle.files.length} files)`
-          );
-        } catch (err) {
-          api.log.warn(`[chimera] session.ended handler failed: ${toErrorMessage(err)}`);
-        }
+        })();
+        event?.waitUntil?.(work);
+        return work;
       });
     },
     teardown(api) {
@@ -8432,17 +9204,17 @@ function createChimeraPlugin() {
 }
 
 // src/plugins/prompts-plugin.ts
-import * as fs11 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as fs13 from "node:fs/promises";
+import * as path21 from "node:path";
 
 // src/execution/prompt-loader.ts
-import * as fs9 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as fs11 from "node:fs/promises";
+import * as path20 from "node:path";
 
 // src/storage/prompt-store.ts
 init_atomic_write();
-import * as fs8 from "node:fs/promises";
-import * as path18 from "node:path";
+import * as fs10 from "node:fs/promises";
+import * as path19 from "node:path";
 var SCHEMA_VERSION3 = 2;
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -8503,12 +9275,12 @@ var DefaultPromptStore = class {
     await ensureDir(this.dir);
     const entries = [];
     try {
-      const files = await fs8.readdir(this.dir);
+      const files = await fs10.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fs8.readFile(path18.join(this.dir, file), "utf8")
+            await fs10.readFile(path19.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -8522,9 +9294,9 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path18.join(this.dir, `${id}.json`);
+    const file = path19.join(this.dir, `${id}.json`);
     try {
-      const raw = JSON.parse(await fs8.readFile(file, "utf8"));
+      const raw = JSON.parse(await fs10.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
     } catch {
       return null;
@@ -8532,14 +9304,14 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path18.join(this.dir, `${entry.id}.json`);
+    const file = path19.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION3, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path18.join(this.dir, `${id}.json`);
+    const file = path19.join(this.dir, `${id}.json`);
     try {
-      await fs8.unlink(file);
+      await fs10.unlink(file);
       return true;
     } catch {
       return false;
@@ -8626,7 +9398,7 @@ var DefaultPromptLoader = class {
   constructor(opts) {
     this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
     this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
-    this.builtinDir = opts.bundledDir ? path19.join(opts.bundledDir, "prompts") : void 0;
+    this.builtinDir = opts.bundledDir ? path20.join(opts.bundledDir, "prompts") : void 0;
   }
   async list() {
     if (this.cache) return this.cache;
@@ -8739,7 +9511,7 @@ var DefaultPromptLoader = class {
     const files = await walkJson(dir);
     for (const file of files) {
       try {
-        const parsed = JSON.parse(await fs9.readFile(file, "utf8"));
+        const parsed = JSON.parse(await fs11.readFile(file, "utf8"));
         const migrated = migratePromptEntry(parsed);
         if (migrated) out.push({ ...migrated, source: "builtin" });
       } catch {
@@ -8753,12 +9525,12 @@ async function walkJson(dir) {
   const out = [];
   let entries;
   try {
-    entries = await fs9.readdir(dir, { withFileTypes: true });
+    entries = await fs11.readdir(dir, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const e of entries) {
-    const full = path19.join(dir, e.name);
+    const full = path20.join(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkJson(full));
     } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
@@ -8833,7 +9605,7 @@ function escapeRegExp(s) {
 
 // src/storage/prompt-usage-store.ts
 init_atomic_write();
-import * as fs10 from "node:fs/promises";
+import * as fs12 from "node:fs/promises";
 var PromptUsageStore = class {
   constructor(file) {
     this.file = file;
@@ -8853,7 +9625,7 @@ var PromptUsageStore = class {
       return this.cachedUsage;
     }
     try {
-      const raw = JSON.parse(await fs10.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs12.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && raw.usage && typeof raw.usage === "object") {
         this.cachedUsage = raw.usage;
         this.cachedSignature = signature;
@@ -8933,8 +9705,8 @@ var PromptUsageStore = class {
   }
   async fileSignature() {
     try {
-      const stat7 = await fs10.stat(this.file);
-      return { size: stat7.size, mtimeMs: stat7.mtimeMs, ctimeMs: stat7.ctimeMs };
+      const stat8 = await fs12.stat(this.file);
+      return { size: stat8.size, mtimeMs: stat8.mtimeMs, ctimeMs: stat8.ctimeMs };
     } catch {
       return null;
     }
@@ -8958,7 +9730,7 @@ function createPromptsPlugin(opts) {
     version: "1.0.0",
     description: "Prompt library with 100+ builtin prompts, search, and AI authoring",
     apiVersion: "^0.1",
-    capabilities: { slashCommands: true },
+    capabilities: { slashCommands: true, llm: true },
     defaultConfig: {},
     setup(api) {
       const rawConfig = api.config;
@@ -8969,7 +9741,7 @@ function createPromptsPlugin(opts) {
         bundledDir: rawConfig["bundledPromptsDir"]
       }) : null);
       usage = opts?.usage ?? (paths ? new PromptUsageStore(paths.promptUsage) : null);
-      api.slashCommands.register(buildPromptsCommand(() => store, () => loader));
+      api.slashCommands.register(buildPromptsCommand(() => store, () => loader, () => api.llm));
       api.slashCommands.register(buildPromptSearchCommand(() => loader, () => usage));
       api.slashCommands.register(buildPromptGenCommand(() => loader));
       api.log.info("[prompts] loaded \u2014 /prompts, /prompt, /prompt-gen available");
@@ -8985,7 +9757,7 @@ function createPromptsPlugin(opts) {
     }
   };
 }
-function buildPromptsCommand(getStore, getLoader) {
+function buildPromptsCommand(getStore, getLoader, getLlm) {
   return {
     name: "prompts",
     description: "Manage your prompt library: /prompts [list|view|add|edit|delete|favorite|extend]",
@@ -9080,16 +9852,25 @@ ${lines.join("\n")}
           const matches2 = await store.find(parsed.title);
           if (matches2.length === 0) return { message: `No prompt matching "${parsed.title}".` };
           const exact = matches2.find((m) => m.title.toLowerCase() === parsed.title?.toLowerCase()) ?? expectDefined(matches2[0]);
-          const prov = ctx.provider;
-          if (!prov?.complete) return { message: "LLM not available. Configure a provider first." };
-          const enhanced = await prov.complete(
-            ctx.model,
-            renderInstructionTemplate(readBundledInstructionText("llm/prompt-extend.md"), {
-              existingPrompt: exact.content,
-              additionalInstructions: parsed.content
-            })
-          );
-          exact.content = enhanced.trim();
+          const llm = getLlm();
+          if (!llm) return { message: "LLM not available. Configure a provider first." };
+          let enhanced;
+          try {
+            enhanced = await llm.complete(
+              renderInstructionTemplate(readBundledInstructionText("llm/prompt-extend.md"), {
+                existingPrompt: exact.content,
+                additionalInstructions: parsed.content
+              }),
+              {
+                system: "You improve reusable prompts while preserving their intent and variables.",
+                role: "prompt-refiner",
+                maxTokens: 2048
+              }
+            );
+          } catch {
+            return { message: "LLM enhancement failed. The saved prompt was not changed." };
+          }
+          exact.content = enhanced.text.trim();
           exact.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
           await store.save(exact);
           getLoader()?.invalidateCache();
@@ -9111,7 +9892,7 @@ ${exact.content}` };
             2
           );
           try {
-            await fs11.writeFile(target, payload, "utf8");
+            await fs13.writeFile(target, payload, "utf8");
             return { message: `Exported ${own.length} prompt(s) \u2192 ${target}` };
           } catch (err) {
             return { message: `Export failed: ${err instanceof Error ? err.message : String(err)}` };
@@ -9123,7 +9904,7 @@ ${exact.content}` };
           const src = resolveIoPath(restJoined, ctx);
           let raw;
           try {
-            raw = JSON.parse(await fs11.readFile(src, "utf8"));
+            raw = JSON.parse(await fs13.readFile(src, "utf8"));
           } catch (err) {
             return { message: `Import failed: ${err instanceof Error ? err.message : String(err)}` };
           }
@@ -9329,9 +10110,9 @@ ${dim(`slug: ${entry.slug} | category: ${entry.category} | source: ${entry.sourc
 }
 function resolveIoPath(p, ctx) {
   const cleaned = p.trim().replace(/^["']|["']$/g, "");
-  if (path20.isAbsolute(cleaned)) return cleaned;
+  if (path21.isAbsolute(cleaned)) return cleaned;
   const base = ctx.projectRoot ?? process.cwd();
-  return path20.resolve(base, cleaned);
+  return path21.resolve(base, cleaned);
 }
 function sourceGlyph(e) {
   return e.source === "project" ? "\u{1F4C1}" : e.source === "user" ? "\u{1F464}" : e.source === "synced" ? "\u2601" : "\u{1F4E6}";
@@ -9455,8 +10236,8 @@ async function integrateFindings(payload, projectDir, reportId) {
 init_atomic_write();
 init_review_finding_store();
 init_review_report_store();
-import * as fsp5 from "node:fs/promises";
-import * as path21 from "node:path";
+import * as fsp6 from "node:fs/promises";
+import * as path22 from "node:path";
 var REVIEW_STORE_COMPACTION_THRESHOLD_BYTES = 8 * 1024 * 1024;
 var REVIEW_STORE_COMPACTION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var REVIEW_STORE_MAINTENANCE_FILE = ".review-store-maintenance.json";
@@ -9464,7 +10245,7 @@ async function maybeCompactReviewStores(projectDir, opts = {}) {
   const thresholdBytes = opts.thresholdBytes ?? REVIEW_STORE_COMPACTION_THRESHOLD_BYTES;
   const intervalMs = opts.intervalMs ?? REVIEW_STORE_COMPACTION_INTERVAL_MS;
   const now = opts.now ?? Date.now();
-  const maintenancePath = path21.join(projectDir, REVIEW_STORE_MAINTENANCE_FILE);
+  const maintenancePath = path22.join(projectDir, REVIEW_STORE_MAINTENANCE_FILE);
   return withFileLock(maintenancePath, async () => {
     const totalBytes = await fileSize(resolveReportStorePath(projectDir)) + await fileSize(resolveFindingStorePath(projectDir));
     if (totalBytes < thresholdBytes) {
@@ -9504,7 +10285,7 @@ function emptyResult(reason, totalBytes) {
 }
 async function fileSize(filePath) {
   try {
-    return (await fsp5.stat(filePath)).size;
+    return (await fsp6.stat(filePath)).size;
   } catch (error) {
     if (error.code === "ENOENT") return 0;
     throw error;
@@ -9512,7 +10293,7 @@ async function fileSize(filePath) {
 }
 async function readMaintenanceState(filePath) {
   try {
-    const parsed = JSON.parse(await fsp5.readFile(filePath, "utf8"));
+    const parsed = JSON.parse(await fsp6.readFile(filePath, "utf8"));
     return typeof parsed.compactedAt === "string" && Number.isFinite(parsed.totalBytesBefore) ? parsed : null;
   } catch (error) {
     if (error.code === "ENOENT" || error instanceof SyntaxError) {
@@ -9524,7 +10305,7 @@ async function readMaintenanceState(filePath) {
 
 // src/plugins/skills-plugin.ts
 import * as os7 from "node:os";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 
 // src/skills/foreign-sources.ts
 var FOREIGN_SKILL_TOOLS = [
@@ -9706,8 +10487,8 @@ function numField(rec, key) {
 // src/skills/skill-generator.ts
 init_errors();
 import { spawn as spawn5 } from "node:child_process";
-import * as fs12 from "node:fs/promises";
-import * as path22 from "node:path";
+import * as fs14 from "node:fs/promises";
+import * as path23 from "node:path";
 async function validateSkillNameAvailable(name, loader) {
   const formatViolations = validateSkillName(name);
   const conflicts = loader ? (await loader.listEntries()).filter((e) => e.name === name) : [];
@@ -9812,7 +10593,12 @@ async function openInEditor(filePath, env = process.env) {
   const child = spawn5(parts[0], [...parts.slice(1), filePath], {
     stdio: "ignore",
     detached: true,
-    shell
+    shell,
+    // `shell` routes through cmd.exe on win32, which flashes a console window
+    // before the editor appears. A GUI editor is unaffected by the flag; the
+    // shell wrapper is what it suppresses. Repo convention — see
+    // `core/tests/architecture/spawn-convention.test.ts`.
+    windowsHide: true
   });
   child.unref();
 }
@@ -9826,11 +10612,11 @@ async function writeSkeletonSkill(skillsDir, body, opts = {}) {
       subsystem: "general"
     });
   }
-  const skillDir = path22.join(skillsDir, name);
-  const skillFile = path22.join(skillDir, "SKILL.md");
+  const skillDir = path23.join(skillsDir, name);
+  const skillFile = path23.join(skillDir, "SKILL.md");
   if (!opts.overwrite) {
     try {
-      await fs12.access(skillFile);
+      await fs14.access(skillFile);
       throw new WrongStackError({
         message: `A skill already exists at ${skillFile}. Use --force to overwrite.`,
         code: ERROR_CODES.VALIDATION_ERROR,
@@ -9841,8 +10627,8 @@ async function writeSkeletonSkill(skillsDir, body, opts = {}) {
       if (err instanceof WrongStackError) throw err;
     }
   }
-  await fs12.mkdir(skillDir, { recursive: true });
-  await fs12.writeFile(skillFile, body, "utf8");
+  await fs14.mkdir(skillDir, { recursive: true });
+  await fs14.writeFile(skillFile, body, "utf8");
   return skillFile;
 }
 function bodyLineAdvisory(body) {
@@ -9885,15 +10671,15 @@ function defaultEditor() {
 // src/skills/skill-installer.ts
 init_errors();
 init_error();
-import * as fs15 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as fs17 from "node:fs/promises";
+import * as path26 from "node:path";
 
 // src/skills/github-fetcher.ts
 init_errors();
 import { createWriteStream } from "node:fs";
-import * as fs13 from "node:fs/promises";
+import * as fs15 from "node:fs/promises";
 import * as os6 from "node:os";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
@@ -10035,7 +10821,7 @@ async function downloadGitHubTarball(parsed) {
       }
     });
   }
-  const tempDir = await fs13.mkdtemp(path23.join(os6.tmpdir(), "wskill-"));
+  const tempDir = await fs15.mkdtemp(path24.join(os6.tmpdir(), "wskill-"));
   try {
     if (!response.body) {
       throw new WrongStackError({
@@ -10046,17 +10832,17 @@ async function downloadGitHubTarball(parsed) {
       });
     }
     const nodeStream = Readable.fromWeb(response.body);
-    const tarPath = path23.join(tempDir, ".wrongstack-download.tar");
+    const tarPath = path24.join(tempDir, ".wrongstack-download.tar");
     await writeBoundedGzipStream(nodeStream, tarPath, SKILL_LIMITS.MAX_UNCOMPRESSED_TARBALL_SIZE);
-    const tarBuf = await fs13.readFile(tarPath);
+    const tarBuf = await fs15.readFile(tarPath);
     try {
       await extractTar(tarBuf, tempDir);
     } finally {
-      await fs13.rm(tarPath, { force: true });
+      await fs15.rm(tarPath, { force: true });
     }
     return { tempDir };
   } catch (err) {
-    await fs13.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    await fs15.rm(tempDir, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
@@ -10111,25 +10897,25 @@ async function extractTar(buf, destDir) {
     const fullPath = prefix ? `${prefix}/${name}` : name;
     const relPath = stripTopDir(fullPath);
     if (relPath && relPath !== "." && relPath !== "..") {
-      const destPath = path23.join(destDir, relPath);
-      const resolvedDest = path23.resolve(destPath);
-      const resolvedRoot = path23.resolve(destDir);
-      if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + path23.sep)) {
+      const destPath = path24.join(destDir, relPath);
+      const resolvedDest = path24.resolve(destPath);
+      const resolvedRoot = path24.resolve(destDir);
+      if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + path24.sep)) {
         offset += 512 + Math.ceil(size / 512) * 512;
         continue;
       }
       if (typeflag === 53 || typeflag === 0) {
         if (relPath.endsWith("/") || typeflag === 53) {
-          await fs13.mkdir(destPath, { recursive: true });
+          await fs15.mkdir(destPath, { recursive: true });
         }
       }
       if ((typeflag === 48 || typeflag === 0 || typeflag === 0) && size > 0) {
-        const dir = path23.dirname(destPath);
-        await fs13.mkdir(dir, { recursive: true });
+        const dir = path24.dirname(destPath);
+        await fs15.mkdir(dir, { recursive: true });
         const dataStart = offset + 512;
         const dataEnd = dataStart + size;
         if (dataEnd > buf.length) break;
-        await fs13.writeFile(destPath, buf.subarray(dataStart, dataEnd));
+        await fs15.writeFile(destPath, buf.subarray(dataStart, dataEnd));
       }
     }
     offset += 512 + Math.ceil(size / 512) * 512;
@@ -10138,8 +10924,8 @@ async function extractTar(buf, destDir) {
 
 // src/skills/manifest-store.ts
 init_atomic_write();
-import * as fs14 from "node:fs/promises";
-import * as path24 from "node:path";
+import * as fs16 from "node:fs/promises";
+import * as path25 from "node:path";
 var SkillManifestStore = class {
   manifestPath;
   cache;
@@ -10149,7 +10935,7 @@ var SkillManifestStore = class {
   async read() {
     if (this.cache) return this.cache;
     try {
-      const raw = await fs14.readFile(this.manifestPath, "utf8");
+      const raw = await fs16.readFile(this.manifestPath, "utf8");
       const data = JSON.parse(raw);
       if (!Array.isArray(data.skills)) {
         this.cache = { skills: [] };
@@ -10162,8 +10948,8 @@ var SkillManifestStore = class {
     return this.cache;
   }
   async write(data) {
-    const dir = path24.dirname(this.manifestPath);
-    await fs14.mkdir(dir, { recursive: true });
+    const dir = path25.dirname(this.manifestPath);
+    await fs16.mkdir(dir, { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(data, null, 2) + "\n");
     this.cache = data;
   }
@@ -10201,8 +10987,8 @@ var SkillManifestStore = class {
 
 // src/skills/skill-installer.ts
 function isInside(resolved, destDir) {
-  const root = path25.resolve(destDir);
-  return resolved === root || resolved.startsWith(root + path25.sep);
+  const root = path26.resolve(destDir);
+  return resolved === root || resolved.startsWith(root + path26.sep);
 }
 var MAX_SKILL_FILE_SIZE = SKILL_LIMITS.MAX_SKILL_FILE_SIZE;
 var SkillInstaller = class {
@@ -10257,13 +11043,13 @@ var SkillInstaller = class {
           this.opts.log?.(`Overwriting existing skill "${skill.name}" (${scope})...`);
           await this.removeSkillFiles(skill.name, scope);
         }
-        const destDir = path25.join(targetDir, skill.name);
-        await fs15.mkdir(destDir, { recursive: true });
+        const destDir = path26.join(targetDir, skill.name);
+        await fs17.mkdir(destDir, { recursive: true });
         const copiedFiles = [];
         for (const file of skill.files) {
-          const srcPath = path25.join(skill.baseDir, file);
-          const destPath = path25.join(destDir, file);
-          const resolved2 = path25.resolve(destPath);
+          const srcPath = path26.join(skill.baseDir, file);
+          const destPath = path26.join(destDir, file);
+          const resolved2 = path26.resolve(destPath);
           if (!isInside(resolved2, destDir)) {
             throw new FsError({
               message: `Path traversal detected in skill file: ${file}`,
@@ -10272,17 +11058,17 @@ var SkillInstaller = class {
               context: { reason: "path_traversal", skillName: skill.name }
             });
           }
-          const stat7 = await fs15.stat(srcPath);
-          if (stat7.size > MAX_SKILL_FILE_SIZE) {
+          const stat8 = await fs17.stat(srcPath);
+          if (stat8.size > MAX_SKILL_FILE_SIZE) {
             throw new FsError({
-              message: `Skill file "${file}" is too large (${(stat7.size / 1024).toFixed(1)}KB). Max: ${MAX_SKILL_FILE_SIZE / 1024}KB`,
+              message: `Skill file "${file}" is too large (${(stat8.size / 1024).toFixed(1)}KB). Max: ${MAX_SKILL_FILE_SIZE / 1024}KB`,
               code: ERROR_CODES.FS_WRITE_FAILED,
               path: srcPath,
-              context: { skillName: skill.name, fileSize: stat7.size, maxSize: MAX_SKILL_FILE_SIZE }
+              context: { skillName: skill.name, fileSize: stat8.size, maxSize: MAX_SKILL_FILE_SIZE }
             });
           }
-          await fs15.mkdir(path25.dirname(destPath), { recursive: true });
-          await fs15.copyFile(srcPath, destPath);
+          await fs17.mkdir(path26.dirname(destPath), { recursive: true });
+          await fs17.copyFile(srcPath, destPath);
           copiedFiles.push(file);
         }
         const entry = {
@@ -10312,7 +11098,7 @@ var SkillInstaller = class {
       this.invalidateLoaderCache();
       return results;
     } finally {
-      await fs15.rm(tempDir, { recursive: true, force: true }).catch(() => {
+      await fs17.rm(tempDir, { recursive: true, force: true }).catch(() => {
       });
     }
   }
@@ -10327,7 +11113,7 @@ var SkillInstaller = class {
     const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
     let entries;
     try {
-      entries = await fs15.readdir(srcDir, { withFileTypes: true });
+      entries = await fs17.readdir(srcDir, { withFileTypes: true });
     } catch {
       throw new WrongStackError({
         message: `Source directory not found or not readable: ${srcDir}`,
@@ -10339,10 +11125,10 @@ var SkillInstaller = class {
     const results = [];
     for (const e of entries) {
       if (!await entryIsDirectory(srcDir, e)) continue;
-      const skillMdPath = path25.join(srcDir, e.name, "SKILL.md");
+      const skillMdPath = path26.join(srcDir, e.name, "SKILL.md");
       let content;
       try {
-        content = await fs15.readFile(skillMdPath, "utf8");
+        content = await fs17.readFile(skillMdPath, "utf8");
       } catch {
         continue;
       }
@@ -10352,15 +11138,15 @@ var SkillInstaller = class {
       if (existing.find((x) => x.scope === scope)) {
         await this.removeSkillFiles(fm.name, scope);
       }
-      const destDir = path25.join(targetDir, fm.name);
-      await fs15.mkdir(destDir, { recursive: true });
-      const srcSkillDir = path25.join(srcDir, e.name);
+      const destDir = path26.join(targetDir, fm.name);
+      await fs17.mkdir(destDir, { recursive: true });
+      const srcSkillDir = path26.join(srcDir, e.name);
       const files = await collectFiles(srcSkillDir, srcSkillDir);
       const copiedFiles = [];
       for (const file of files) {
-        const srcPath = path25.join(srcSkillDir, file);
-        const destPath = path25.join(destDir, file);
-        const resolved = path25.resolve(destPath);
+        const srcPath = path26.join(srcSkillDir, file);
+        const destPath = path26.join(destDir, file);
+        const resolved = path26.resolve(destPath);
         if (!isInside(resolved, destDir)) {
           throw new FsError({
             message: `Path traversal detected in skill file: ${file}`,
@@ -10369,16 +11155,16 @@ var SkillInstaller = class {
             context: { reason: "path_traversal", skillName: fm.name }
           });
         }
-        await fs15.mkdir(path25.dirname(destPath), { recursive: true });
+        await fs17.mkdir(path26.dirname(destPath), { recursive: true });
         if (opts?.link) {
           try {
-            await fs15.symlink(srcPath, destPath);
+            await fs17.symlink(srcPath, destPath);
           } catch (err) {
-            await fs15.copyFile(srcPath, destPath);
+            await fs17.copyFile(srcPath, destPath);
             this.opts.log?.(`symlink failed for ${file} (${toErrorMessage(err)}); copied instead`);
           }
         } else {
-          await fs15.copyFile(srcPath, destPath);
+          await fs17.copyFile(srcPath, destPath);
         }
         copiedFiles.push(file);
       }
@@ -10532,10 +11318,10 @@ var SkillInstaller = class {
    */
   async detectSkills(baseDir) {
     const results = [];
-    const rootSkillMd = path25.join(baseDir, "SKILL.md");
+    const rootSkillMd = path26.join(baseDir, "SKILL.md");
     try {
-      await fs15.access(rootSkillMd);
-      const content = await fs15.readFile(rootSkillMd, "utf8");
+      await fs17.access(rootSkillMd);
+      const content = await fs17.readFile(rootSkillMd, "utf8");
       const fm = parseSkillFrontmatter(content);
       if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
         results.push({
@@ -10547,17 +11333,17 @@ var SkillInstaller = class {
       }
     } catch {
     }
-    const skillsDir = path25.join(baseDir, "skills");
+    const skillsDir = path26.join(baseDir, "skills");
     try {
-      const entries = await fs15.readdir(skillsDir, { withFileTypes: true });
+      const entries = await fs17.readdir(skillsDir, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const skillFile = path25.join(skillsDir, entry.name, "SKILL.md");
+        const skillFile = path26.join(skillsDir, entry.name, "SKILL.md");
         try {
-          const content = await fs15.readFile(skillFile, "utf8");
+          const content = await fs17.readFile(skillFile, "utf8");
           const fm = parseSkillFrontmatter(content);
           if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
-            const skillDir = path25.join(skillsDir, entry.name);
+            const skillDir = path26.join(skillsDir, entry.name);
             const files = await collectFiles(skillDir, skillDir);
             results.push({
               name: fm.name,
@@ -10590,8 +11376,8 @@ var SkillInstaller = class {
    */
   async removeSkillFiles(name, scope) {
     const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
-    const root = path25.resolve(targetDir);
-    const skillDir = path25.resolve(path25.join(targetDir, name));
+    const root = path26.resolve(targetDir);
+    const skillDir = path26.resolve(path26.join(targetDir, name));
     if (skillDir === root || !isInside(skillDir, root)) {
       throw new FsError({
         message: `Refusing to delete skill files outside the skills directory: ${name}`,
@@ -10600,7 +11386,7 @@ var SkillInstaller = class {
         context: { reason: "path_traversal", skillName: name, scope }
       });
     }
-    await fs15.rm(skillDir, { recursive: true, force: true });
+    await fs17.rm(skillDir, { recursive: true, force: true });
   }
   /**
    * Invalidate the skill loader's cache so newly installed skills appear.
@@ -10635,7 +11421,7 @@ async function entryIsDirectory(dir, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return (await fs15.stat(path25.join(dir, entry.name))).isDirectory();
+      return (await fs17.stat(path26.join(dir, entry.name))).isDirectory();
     } catch {
       return false;
     }
@@ -10644,10 +11430,10 @@ async function entryIsDirectory(dir, entry) {
 }
 async function collectFiles(dir, baseDir) {
   const results = [];
-  const entries = await fs15.readdir(dir, { withFileTypes: true });
+  const entries = await fs17.readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path25.join(dir, entry.name);
-    const relPath = path25.relative(baseDir, fullPath);
+    const fullPath = path26.join(dir, entry.name);
+    const relPath = path26.relative(baseDir, fullPath);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
       results.push(...await collectFiles(fullPath, baseDir));
@@ -10726,7 +11512,7 @@ function createSkillsPlugin(opts) {
 function makeInstaller(skillLoader, projectRoot, registryAdapters) {
   const paths = resolveWstackPaths({ projectRoot });
   return new SkillInstaller({
-    manifestPath: path26.join(paths.configDir, "installed-skills.json"),
+    manifestPath: path27.join(paths.configDir, "installed-skills.json"),
     projectSkillsDir: paths.inProjectSkills,
     globalSkillsDir: paths.globalSkills,
     projectHash: paths.projectHash,
@@ -11105,7 +11891,7 @@ function resolveImportSourceDir(tool, opts) {
   const entry = IMPORT_SOURCE_TOOLS.find((t) => t.id === tool);
   if (!entry) return void 0;
   const base = opts.global ? opts.homeDir ?? os7.homedir() : opts.projectRoot;
-  return path26.join(base, "." + entry.id, entry.subdir);
+  return path27.join(base, "." + entry.id, entry.subdir);
 }
 function buildSkillImportCommand(skillLoader) {
   return {
@@ -11146,7 +11932,7 @@ function buildSkillImportCommand(skillLoader) {
           };
         }
       } else if (positional) {
-        srcDir = path26.resolve(ctx.projectRoot, positional);
+        srcDir = path27.resolve(ctx.projectRoot, positional);
       } else {
         return {
           message: "Usage: /skill-import <src-dir> | --from <tool> | --from-claude [--global] [--link]"
@@ -11273,14 +12059,14 @@ function truncate(s, max) {
 }
 
 // src/plugins/sync-plugin.ts
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 init_error();
 
 // src/storage/cloud-sync.ts
 init_atomic_write();
 init_errors();
-import * as fs16 from "node:fs/promises";
-import * as path27 from "node:path";
+import * as fs18 from "node:fs/promises";
+import * as path28 from "node:path";
 import { createHash as createHash9 } from "node:crypto";
 var ALL_SYNC_CATEGORIES = ["settings", "skills", "prompts", "memory", "history"];
 var CloudSync = class {
@@ -11288,8 +12074,8 @@ var CloudSync = class {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path27.join(paths.configDir, "sync-state.json");
-    this.getSettingsConfigPath = getSettingsConfigPath ?? (() => path27.join(this.paths.configDir, "config.json"));
+    this.statePath = path28.join(paths.configDir, "sync-state.json");
+    this.getSettingsConfigPath = getSettingsConfigPath ?? (() => path28.join(this.paths.configDir, "config.json"));
   }
   paths;
   getConfig;
@@ -11444,7 +12230,7 @@ var CloudSync = class {
   }
   async loadState() {
     try {
-      const raw = await fs16.readFile(this.statePath, "utf8");
+      const raw = await fs18.readFile(this.statePath, "utf8");
       this.state = JSON.parse(raw);
     } catch {
       this.state = null;
@@ -11569,18 +12355,18 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat7 = await fs16.lstat(localPath);
-        if (stat7.isSymbolicLink()) continue;
-        if (stat7.isDirectory()) {
+        const stat8 = await fs18.lstat(localPath);
+        if (stat8.isSymbolicLink()) continue;
+        if (stat8.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fs16.readFile(file, "utf8");
-            const rel = path27.relative(localPath, file).replace(/\\/g, "/");
+            const content = await fs18.readFile(file, "utf8");
+            const rel = path28.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(`${cat}/${rel}\0${content}`);
           }
         } else {
-          const content = await fs16.readFile(localPath, "utf8");
+          const content = await fs18.readFile(localPath, "utf8");
           entries.push({ path: `data/${cat}`, content, mode: "100644" });
           hashes.push(`${cat}\0${content}`);
         }
@@ -11596,17 +12382,17 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat7 = await fs16.lstat(localPath);
-        if (stat7.isSymbolicLink()) continue;
-        if (stat7.isDirectory()) {
+        const stat8 = await fs18.lstat(localPath);
+        if (stat8.isSymbolicLink()) continue;
+        if (stat8.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fs16.readFile(file, "utf8");
-            const rel = path27.relative(localPath, file).replace(/\\/g, "/");
+            const content = await fs18.readFile(file, "utf8");
+            const rel = path28.relative(localPath, file).replace(/\\/g, "/");
             hashes.push(`${cat}/${rel}\0${content}`);
           }
         } else {
-          const content = await fs16.readFile(localPath, "utf8");
+          const content = await fs18.readFile(localPath, "utf8");
           hashes.push(`${cat}\0${content}`);
         }
       } catch {
@@ -11633,10 +12419,10 @@ var CloudSync = class {
   }
   async walkDir(dir, base) {
     const results = [];
-    const entries = await fs16.readdir(dir, { withFileTypes: true });
+    const entries = await fs18.readdir(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const full = path27.join(dir, entry.name);
+      const full = path28.join(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
@@ -11649,29 +12435,29 @@ var CloudSync = class {
 };
 async function preparePulledDestination(cat, localPath, destPath, remotePath) {
   const directoryBacked = cat === "skills" || cat === "prompts";
-  const rootPath = directoryBacked ? localPath : path27.dirname(localPath);
+  const rootPath = directoryBacked ? localPath : path28.dirname(localPath);
   const rootStat = await lstatIfExists(rootPath);
   if (rootStat?.isSymbolicLink()) {
     throw unsafePulledSymlinkError(remotePath, rootPath);
   }
   if (directoryBacked) {
-    const relativeParent = path27.relative(rootPath, path27.dirname(destPath));
+    const relativeParent = path28.relative(rootPath, path28.dirname(destPath));
     let cursor = rootPath;
     if (relativeParent) {
-      for (const segment of relativeParent.split(path27.sep)) {
-        cursor = path27.join(cursor, segment);
-        const stat7 = await lstatIfExists(cursor);
-        if (stat7?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, cursor);
+      for (const segment of relativeParent.split(path28.sep)) {
+        cursor = path28.join(cursor, segment);
+        const stat8 = await lstatIfExists(cursor);
+        if (stat8?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, cursor);
       }
     }
   }
   const destStat = await lstatIfExists(destPath);
   if (destStat?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, destPath);
-  await fs16.mkdir(path27.dirname(destPath), { recursive: true });
+  await fs18.mkdir(path28.dirname(destPath), { recursive: true });
 }
 async function lstatIfExists(filePath) {
   try {
-    return await fs16.lstat(filePath);
+    return await fs18.lstat(filePath);
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -11697,9 +12483,9 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
     return localPath;
   }
   if (!rel) return localPath;
-  const normalizedRel = path27.normalize(rel);
-  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path27.sep}`);
-  if (path27.isAbsolute(normalizedRel) || traversesUp) {
+  const normalizedRel = path28.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path28.sep}`);
+  if (path28.isAbsolute(normalizedRel) || traversesUp) {
     throw new FsError({
       message: `Refusing CloudSync path traversal: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -11707,10 +12493,10 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
       context: { reason: "path_traversal", normalizedRel }
     });
   }
-  const dest = path27.resolve(localPath, normalizedRel);
-  const root = path27.resolve(localPath);
-  const relative5 = path27.relative(root, dest);
-  if (relative5.startsWith("..") || path27.isAbsolute(relative5)) {
+  const dest = path28.resolve(localPath, normalizedRel);
+  const root = path28.resolve(localPath);
+  const relative5 = path28.relative(root, dest);
+  if (relative5.startsWith("..") || path28.isAbsolute(relative5)) {
     throw new FsError({
       message: `Refusing CloudSync path outside category root: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -11753,7 +12539,7 @@ function createSyncPlugin(opts) {
         api.log.warn("[sync] paths, configStore, or configDir not available \u2014 /sync disabled");
         return;
       }
-      const syncConfigPath = paths.syncConfig ?? path28.join(paths.configDir, "sync.json");
+      const syncConfigPath = paths.syncConfig ?? path29.join(paths.configDir, "sync.json");
       cloud = new CloudSync(
         paths,
         () => {
@@ -11764,7 +12550,7 @@ function createSyncPlugin(opts) {
           await persistSyncConfig(syncConfigPath, cfg, vault);
           configStore?.update({ sync: cfg });
         },
-        () => path28.join(paths.configDir, "config.json")
+        () => path29.join(paths.configDir, "config.json")
       );
       void cloud.loadState();
       api.slashCommands.register(buildSyncCommand(cloud, configStore, vault, syncConfigPath));
@@ -11954,6 +12740,852 @@ Warning: sync completed, but metadata persistence failed: ${toErrorMessage(err)}
     }
   };
 }
+
+// src/plugins/cloud-config-sync-plugin.ts
+import * as path31 from "node:path";
+
+// src/security/config-secrets.ts
+function decryptConfigSecrets(cfg, vault, opts) {
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  return walk2(cfg, vault, (v, key) => {
+    try {
+      return vault.decrypt(v);
+    } catch (err) {
+      warn(
+        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
+      );
+      return "";
+    }
+  });
+}
+function encryptConfigSecrets(cfg, vault, _opts) {
+  return walk2(cfg, vault, (v) => vault.encrypt(v));
+}
+function walk2(node, vault, transform) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walk2(item, vault, transform));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k)) {
+      out[k] = transform(v, k);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walk2(v, vault, transform);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
+function isSecretField(name) {
+  const lc = name.toLowerCase();
+  if (NON_SECRET_OVERRIDES.has(lc)) return false;
+  return SECRET_KEY_PATTERN.test(lc);
+}
+
+// src/storage/cloud-config-sync.ts
+init_atomic_write();
+import { createHash as createHash10, randomUUID as nodeRandomUUID } from "node:crypto";
+import * as fs19 from "node:fs/promises";
+import * as path30 from "node:path";
+
+// src/storage/cloud-config-sync/sanitize.ts
+var SAGE_TREE = {
+  enabled: true,
+  storage: { projectLocal: true, directory: true },
+  inject: {
+    turnContext: true,
+    toolResults: true,
+    taskAware: true,
+    maxHintsPerTool: true,
+    maxCharsPerTool: true,
+    minScore: true,
+    repeatCooldownMs: true,
+    maxTurnMemories: true,
+    maxCharsPerTurn: true,
+    minImportance: true,
+    relationFloor: true
+  },
+  hygiene: {
+    autoAfterSession: true,
+    autoOnFileChange: true,
+    retentionDays: true,
+    archiveLowConfidenceAfterDays: true
+  },
+  embeddings: { enabled: true }
+};
+var CORE_RUNTIME_TREE = {
+  maxConcurrent: true,
+  context: {
+    mode: true,
+    autoCompact: true,
+    strategy: true,
+    warnThreshold: true,
+    softThreshold: true,
+    hardThreshold: true,
+    preserveK: true,
+    eliseThreshold: true,
+    targetLoad: true
+  },
+  tools: {
+    defaultExecutionStrategy: true,
+    maxIterations: true,
+    iterationTimeoutMs: true,
+    sessionTimeoutMs: true,
+    perIterationOutputCapBytes: true,
+    autoExtendLimit: true,
+    restrictToProjectRoot: true,
+    descriptionMode: true,
+    disabledTools: true,
+    maxToolTimeoutMs: true,
+    loopDetection: {
+      mode: true,
+      steerThreshold: true,
+      cutThreshold: true,
+      windowSize: true,
+      callRepeatThreshold: true
+    }
+  },
+  log: { level: true, format: true },
+  features: {
+    mcp: true,
+    plugins: true,
+    memory: true,
+    modelsRegistry: true,
+    skills: true,
+    prompts: true,
+    tokenSavingMode: true,
+    allowOutsideProjectRoot: true,
+    developerMode: true
+  },
+  session: { auditLevel: true, sampling: { toolProgress: { sampleRate: true } } },
+  indexing: { onSessionStart: true, onEdit: true, watchExternal: true, debounceMs: true },
+  circuitBreaker: { enabled: true, autoKillResetMs: true },
+  modelRuntime: {
+    reasoning: { mode: true, effort: true, preserve: true },
+    cache: { ttl: true }
+  },
+  systemPrompt: { variant: true },
+  skills: { readClaudeSkills: true },
+  Sage: SAGE_TREE,
+  fallbackAuto: true,
+  yolo: true,
+  nextPrediction: true,
+  hints: true,
+  debugStream: true
+};
+var UI_PREFERENCES_TREE = {
+  autonomy: {
+    defaultMode: true,
+    autoProceedDelayMs: true,
+    autoProceedMaxIterations: true,
+    autonomyNextPrompt: true,
+    terminalTitleAnimation: true,
+    yolo: true,
+    streamFleet: true,
+    chime: true,
+    confirmExit: true,
+    mouseMode: true,
+    enhance: true,
+    enhanceDelayMs: true,
+    enhanceCountdownMs: true,
+    enhanceLanguage: true,
+    statuslineMode: true,
+    thinkingWord: true,
+    midRunSendPicker: true,
+    animationStyle: true,
+    fleetChatVerbosity: true,
+    refinerFallbackProfile: true,
+    refinerProvider: true,
+    refinerModel: true,
+    showModelReasoning: true,
+    shellBangWarningDontShowAgain: true,
+    showAgentSwarmPanel: true,
+    showSageMemoryInject: true,
+    readAdvancedMode: true,
+    panelPositions: true
+  },
+  launch: { mode: true, autonomy: true },
+  uiLocale: true
+};
+var MODELS_ROUTING_TREE = {
+  provider: true,
+  model: true,
+  favoriteModels: true,
+  favoriteModelsOnly: true,
+  fallbackModels: true,
+  fallbackProfiles: true,
+  modelMatrix: { "*": { fallbackProfile: true } },
+  brain: {
+    mode: true,
+    maxAutoRisk: true,
+    models: true,
+    strategy: true,
+    decisionTimeoutMs: true,
+    humanTimeoutMs: true,
+    council: {
+      enabled: true,
+      minRisk: true,
+      voters: true
+    },
+    ledger: { enabled: true, autoDenyAfterFailures: true },
+    trace: { enabled: true }
+  }
+};
+var PROVIDERS_CATALOG_TREE = {
+  providers: {
+    "*": {
+      type: true,
+      family: true,
+      baseUrl: true,
+      envVars: true,
+      models: true,
+      activeKey: true
+    }
+  }
+};
+var MCP_SERVERS_TREE = {
+  mcpServers: {
+    "*": {
+      name: true,
+      transport: true,
+      command: true,
+      args: true,
+      url: true,
+      description: true,
+      permission: true,
+      enabled: true,
+      lazy: true,
+      envVars: true
+    }
+  }
+};
+var EXTENSIONS_PLUGINS_TREE = {
+  plugins: true,
+  extensions: true
+};
+var CLOUD_SYNC_CONTRACT = {
+  "core.runtime": CORE_RUNTIME_TREE,
+  "ui.preferences": UI_PREFERENCES_TREE,
+  "models.routing": MODELS_ROUTING_TREE,
+  "providers.catalog": PROVIDERS_CATALOG_TREE,
+  "mcp.servers": MCP_SERVERS_TREE,
+  "extensions.plugins": EXTENSIONS_PLUGINS_TREE
+};
+var CLOUD_SYNC_NAMESPACES = Object.keys(CLOUD_SYNC_CONTRACT);
+var NAMESPACE_SCHEMA_VERSIONS = {
+  "core.runtime": 1,
+  "ui.preferences": 1,
+  "models.routing": 1,
+  "providers.catalog": 1,
+  "mcp.servers": 2,
+  "extensions.plugins": 1
+};
+var ENCRYPTED_VALUE = /enc:v\d+:/;
+var SECRET_KEY = /^(api[-_]?key|apikeys|.*token|secret.*|.*secret|password|passwd|credential.*|private[-_]?key|authorization)$/i;
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stripSecretMaterial(value) {
+  if (typeof value === "string") {
+    return ENCRYPTED_VALUE.test(value) ? void 0 : value;
+  }
+  if (Array.isArray(value)) {
+    const cleaned = value.map((entry) => stripSecretMaterial(entry));
+    return cleaned.filter((entry) => entry !== void 0);
+  }
+  if (isPlainObject2(value)) {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (SECRET_KEY.test(key)) continue;
+      const cleaned = stripSecretMaterial(child);
+      if (cleaned !== void 0) out[key] = cleaned;
+    }
+    return out;
+  }
+  return value;
+}
+function project(value, tree) {
+  if (tree === true) return value;
+  if (!isPlainObject2(value)) return void 0;
+  const wildcard = tree["*"];
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const node = Object.hasOwn(tree, key) && key !== "*" ? tree[key] : wildcard;
+    if (node === void 0) continue;
+    const projected = project(child, node);
+    if (projected !== void 0) out[key] = projected;
+  }
+  return out;
+}
+function buildNamespacePayloads(config) {
+  const payloads = {};
+  for (const [namespace, tree] of Object.entries(CLOUD_SYNC_CONTRACT)) {
+    if (tree === true) continue;
+    const payload = {};
+    for (const [key, node] of Object.entries(tree)) {
+      if (!(key in config) || config[key] === void 0) continue;
+      const projected = project(config[key], node);
+      if (projected === void 0) continue;
+      const cleaned = stripSecretMaterial(projected);
+      if (cleaned === void 0) continue;
+      if (isPlainObject2(cleaned) && Object.keys(cleaned).length === 0 && node !== true) continue;
+      payload[key] = cleaned;
+    }
+    if (Object.keys(payload).length > 0) payloads[namespace] = payload;
+  }
+  return payloads;
+}
+function reinjectLocalSecrets(local, incoming) {
+  if (!isPlainObject2(local) || !isPlainObject2(incoming)) return incoming;
+  const out = { ...incoming };
+  for (const [key, value] of Object.entries(local)) {
+    const secretish = SECRET_KEY.test(key) || typeof value === "string" && ENCRYPTED_VALUE.test(value);
+    if (secretish && !(key in incoming)) {
+      out[key] = value;
+      continue;
+    }
+    if (isPlainObject2(value) && isPlainObject2(incoming[key])) {
+      out[key] = reinjectLocalSecrets(value, incoming[key]);
+    }
+  }
+  return out;
+}
+function mergeAtContract(local, incoming, tree) {
+  if (tree === true) return reinjectLocalSecrets(local, incoming);
+  if (!isPlainObject2(incoming)) return local;
+  const base = isPlainObject2(local) ? { ...local } : {};
+  const wildcard = tree["*"];
+  for (const [key, child] of Object.entries(incoming)) {
+    const node = Object.hasOwn(tree, key) && key !== "*" ? tree[key] : wildcard;
+    if (node === void 0) continue;
+    base[key] = mergeAtContract(base[key], child, node);
+  }
+  return base;
+}
+function applyNamespacePayload(config, namespace, payload) {
+  const tree = CLOUD_SYNC_CONTRACT[namespace];
+  if (!tree || tree === true) return config;
+  const next = { ...config };
+  for (const [key, incoming] of Object.entries(payload)) {
+    const node = Object.hasOwn(tree, key) ? tree[key] : void 0;
+    if (node === void 0) continue;
+    next[key] = mergeAtContract(next[key], incoming, node);
+  }
+  return next;
+}
+
+// src/storage/cloud-config-sync.ts
+var EMPTY_STATE = {
+  version: 1,
+  cursor: 0,
+  namespaceRevisions: {},
+  syncedHashes: {},
+  syncedPayloads: {},
+  pendingMutations: {},
+  rejectedHashes: {}
+};
+function stableStringify3(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => stableStringify3(entry)).join(",")}]`;
+  }
+  if (typeof value === "object" && value !== null) {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify3(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function hashPayload(payload) {
+  return createHash10("sha256").update(stableStringify3(payload)).digest("hex");
+}
+function deepEquals(a, b) {
+  return stableStringify3(a) === stableStringify3(b);
+}
+var CloudConfigSync = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.uuid = deps.randomUUID ?? (() => nodeRandomUUID());
+    this.timeoutMs = deps.requestTimeoutMs ?? 15e3;
+  }
+  deps;
+  state = null;
+  fetchImpl;
+  uuid;
+  timeoutMs;
+  /** One full pull-then-push-then-heartbeat pass. Never throws; failures are summarized. */
+  async syncOnce() {
+    const settings = this.deps.getSettings();
+    if (!settings?.enabled || !settings.url || !settings.token) {
+      return summary({ skipped: true, message: "Cloud sync is not configured." });
+    }
+    const state = await this.loadState();
+    const pulled = [];
+    const pushed = [];
+    const conflicted = [];
+    const rejected = [];
+    try {
+      await this.pullChanges(settings, state, pulled);
+      await this.pushDirty(settings, state, { pushed, conflicted, rejected });
+      await this.heartbeat(settings, state);
+      state.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.saveState(state);
+      return summary({
+        ok: true,
+        pulled,
+        pushed,
+        conflicted,
+        rejected,
+        message: pulled.length + pushed.length === 0 ? "Already in sync." : `Pulled ${pulled.length}, pushed ${pushed.length} namespace(s).`
+      });
+    } catch (error) {
+      await this.saveState(state).catch(() => {
+      });
+      const message = error instanceof Error ? error.message : String(error);
+      this.deps.logger?.warn(`cloud-config-sync: pass failed: ${message}`);
+      return summary({ pulled, pushed, conflicted, rejected, message });
+    }
+  }
+  /** Human-readable status for the slash command. */
+  async statusText() {
+    const settings = this.deps.getSettings();
+    if (!settings?.enabled) {
+      return "Cloud config sync: disabled. Run `/cloudsync on` after setting url + token.";
+    }
+    const state = await this.loadState();
+    const dirty = await this.dirtyNamespaces(state);
+    const rejectedList = Object.keys(state.rejectedHashes);
+    const lines = [
+      "Cloud config sync: enabled",
+      `  url:        ${settings.url}`,
+      `  cursor:     ${state.cursor}`,
+      `  last sync:  ${state.lastSyncedAt ?? "never"}`,
+      `  dirty:      ${dirty.length > 0 ? dirty.join(", ") : "none"}`
+    ];
+    if (rejectedList.length > 0) {
+      lines.push(`  rejected:   ${rejectedList.join(", ")} (kept local; edit to retry)`);
+    }
+    return lines.join("\n");
+  }
+  // ── Pull ────────────────────────────────────────────────────────────────
+  async pullChanges(settings, state, pulled) {
+    const delta = (await this.request(settings, "GET", `/api/sync/v1/config?since=${state.cursor}`)).json;
+    const toRead = delta.full ? CLOUD_SYNC_NAMESPACES.map((namespace) => ({ namespace })) : delta.changed.filter(
+      (entry) => CLOUD_SYNC_NAMESPACES.includes(entry.namespace) && entry.revision > (state.namespaceRevisions[entry.namespace] ?? 0)
+    );
+    const dirtyBefore = new Set(await this.dirtyNamespaces(state));
+    for (const entry of toRead) {
+      const snapshot = (await this.request(
+        settings,
+        "GET",
+        `/api/sync/v1/config/${encodeURIComponent(entry.namespace)}`
+      )).json;
+      if ((state.namespaceRevisions[entry.namespace] ?? 0) >= snapshot.revision) continue;
+      if (snapshot.revision === 0) {
+        state.namespaceRevisions[entry.namespace] = 0;
+        continue;
+      }
+      if (dirtyBefore.has(entry.namespace)) {
+        const local = await this.deps.readLocalConfig();
+        const localPayload = buildNamespacePayloads(local)[entry.namespace] ?? {};
+        const base = state.syncedPayloads[entry.namespace] ?? {};
+        const merged = { ...snapshot.payload };
+        for (const [key, localValue] of Object.entries(localPayload)) {
+          if (!deepEquals(localValue, base[key])) merged[key] = localValue;
+        }
+        await this.deps.writeLocalConfig(
+          (config) => applyNamespacePayload(config, entry.namespace, merged)
+        );
+        state.namespaceRevisions[entry.namespace] = snapshot.revision;
+        state.syncedPayloads[entry.namespace] = snapshot.payload;
+      } else {
+        await this.applySnapshot(entry.namespace, snapshot, state);
+      }
+      pulled.push(entry.namespace);
+    }
+    state.cursor = Math.max(state.cursor, delta.cursor);
+  }
+  async applySnapshot(namespace, snapshot, state) {
+    await this.deps.writeLocalConfig(
+      (config) => applyNamespacePayload(config, namespace, snapshot.payload)
+    );
+    state.namespaceRevisions[namespace] = snapshot.revision;
+    state.syncedPayloads[namespace] = snapshot.payload;
+    const local = await this.deps.readLocalConfig();
+    const projected = buildNamespacePayloads(local)[namespace] ?? {};
+    state.syncedHashes[namespace] = hashPayload(projected);
+    delete state.pendingMutations[namespace];
+    delete state.rejectedHashes[namespace];
+  }
+  // ── Push ────────────────────────────────────────────────────────────────
+  async dirtyNamespaces(state) {
+    const local = await this.deps.readLocalConfig();
+    const payloads = buildNamespacePayloads(local);
+    return Object.entries(payloads).filter(([namespace, payload]) => hashPayload(payload) !== state.syncedHashes[namespace]).map(([namespace]) => namespace);
+  }
+  async pushDirty(settings, state, out) {
+    const local = await this.deps.readLocalConfig();
+    const payloads = buildNamespacePayloads(local);
+    for (const [namespace, payload] of Object.entries(payloads)) {
+      const hash = hashPayload(payload);
+      if (hash === state.syncedHashes[namespace]) continue;
+      if (state.rejectedHashes[namespace] === hash) continue;
+      const pending = state.pendingMutations[namespace];
+      const mutationId = pending?.hash === hash ? pending.mutationId : this.uuid();
+      state.pendingMutations[namespace] = { mutationId, hash };
+      await this.saveState(state);
+      const result = await this.putNamespace(settings, state, namespace, payload, mutationId);
+      if (result.kind === "applied") {
+        out.pushed.push(namespace);
+      } else if (result.kind === "conflict") {
+        out.conflicted.push(namespace);
+        await this.resolveConflict(settings, state, namespace, payload, result.server, out);
+      } else {
+        state.rejectedHashes[namespace] = hash;
+        delete state.pendingMutations[namespace];
+        out.rejected.push(namespace);
+        this.deps.logger?.warn(
+          `cloud-config-sync: server rejected ${namespace} (${result.code}); keeping it local until the config changes.`
+        );
+      }
+    }
+  }
+  async putNamespace(settings, state, namespace, payload, mutationId) {
+    const response = await this.request(
+      settings,
+      "PUT",
+      `/api/sync/v1/config/${encodeURIComponent(namespace)}`,
+      {
+        baseRevision: state.namespaceRevisions[namespace] ?? 0,
+        mutationId,
+        schemaVersion: NAMESPACE_SCHEMA_VERSIONS[namespace] ?? 1,
+        payload
+      },
+      // 409 (conflict) and 422 (contract mismatch) are protocol answers, not failures.
+      [409, 422]
+    );
+    if (response.status === 422) {
+      const code = response.json.error?.code;
+      return { kind: "rejected", code: code ?? "invalid_payload" };
+    }
+    const body = response.json;
+    if (response.status === 409) {
+      return { kind: "conflict", server: body };
+    }
+    state.namespaceRevisions[namespace] = body.revision;
+    state.syncedHashes[namespace] = hashPayload(payload);
+    state.syncedPayloads[namespace] = payload;
+    if (typeof body.cursor === "number") state.cursor = Math.max(state.cursor, body.cursor);
+    delete state.pendingMutations[namespace];
+    delete state.rejectedHashes[namespace];
+    return { kind: "applied" };
+  }
+  /**
+   * Three-way merge at owned-top-level-key granularity: keys unchanged locally since the
+   * last sync adopt the server value; locally-changed keys win and are re-pushed on top
+   * of the server revision with a fresh mutation id.
+   */
+  async resolveConflict(settings, state, namespace, localPayload, server, out) {
+    const base = state.syncedPayloads[namespace] ?? {};
+    const merged = { ...server.payload };
+    for (const [key, localValue] of Object.entries(localPayload)) {
+      if (!deepEquals(localValue, base[key])) merged[key] = localValue;
+    }
+    await this.deps.writeLocalConfig((config) => applyNamespacePayload(config, namespace, merged));
+    state.namespaceRevisions[namespace] = server.revision;
+    const mutationId = this.uuid();
+    const hash = hashPayload(merged);
+    state.pendingMutations[namespace] = { mutationId, hash };
+    await this.saveState(state);
+    const result = await this.putNamespace(settings, state, namespace, merged, mutationId);
+    if (result.kind === "applied") {
+      out.pushed.push(namespace);
+    } else {
+      this.deps.logger?.warn(
+        `cloud-config-sync: conflict resolution for ${namespace} did not converge (${result.kind}); will retry next pass.`
+      );
+    }
+  }
+  // ── Heartbeat ───────────────────────────────────────────────────────────
+  async heartbeat(settings, state) {
+    await this.request(settings, "POST", "/api/sync/v1/heartbeat", {
+      transport: "poll",
+      syncCursor: state.cursor,
+      namespaceRevisions: state.namespaceRevisions
+    }).catch((error) => {
+      const message = error instanceof Error ? error.message : String(error);
+      this.deps.logger?.warn(`cloud-config-sync: heartbeat failed: ${message}`);
+    });
+  }
+  // ── HTTP + state plumbing ───────────────────────────────────────────────
+  async request(settings, method, pathname, body, acceptStatuses = []) {
+    const url = `${settings.url.replace(/\/+$/, "")}${pathname}`;
+    const headers = {
+      Authorization: `Bearer ${settings.token}`,
+      "X-WrongStack-Version": this.deps.appVersion ?? "unknown"
+    };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const init = {
+      method,
+      headers,
+      signal: AbortSignal.timeout(this.timeoutMs)
+    };
+    if (body !== void 0) init.body = JSON.stringify(body);
+    const response = await this.fetchImpl(url, init);
+    const ok = response.ok || acceptStatuses.includes(response.status);
+    if (!ok) {
+      if (response.status === 401) {
+        throw new Error("unauthorized: the machine token is invalid, expired, or revoked.");
+      }
+      if (response.status === 429) {
+        throw new Error("rate limited by the portal; backing off until the next pass.");
+      }
+      throw new Error(`${method} ${pathname} failed with HTTP ${response.status}.`);
+    }
+    const json = response.status === 204 ? null : await response.json().catch(() => null);
+    return { status: response.status, json };
+  }
+  async loadState() {
+    if (this.state) return this.state;
+    try {
+      const raw = await fs19.readFile(this.deps.statePath, "utf8");
+      const parsed = JSON.parse(raw);
+      this.state = {
+        ...structuredClone(EMPTY_STATE),
+        ...parsed,
+        version: 1
+      };
+    } catch {
+      this.state = structuredClone(EMPTY_STATE);
+    }
+    return this.state;
+  }
+  async saveState(state) {
+    this.state = state;
+    await fs19.mkdir(path30.dirname(this.deps.statePath), { recursive: true });
+    await atomicWrite(this.deps.statePath, `${JSON.stringify(state, null, 2)}
+`, {
+      mode: 384
+    });
+  }
+};
+function summary(partial) {
+  return {
+    ok: partial.ok ?? false,
+    skipped: partial.skipped ?? false,
+    pulled: partial.pulled ?? [],
+    pushed: partial.pushed ?? [],
+    conflicted: partial.conflicted ?? [],
+    rejected: partial.rejected ?? [],
+    message: partial.message
+  };
+}
+
+// src/plugins/cloud-config-sync-plugin.ts
+init_atomic_write();
+init_error();
+var DEFAULT_INTERVAL_SECONDS = 300;
+var MIN_INTERVAL_SECONDS = 60;
+function createCloudConfigSyncPlugin(opts) {
+  let engine = null;
+  let timer = null;
+  let passRunning = false;
+  return {
+    name: "wstack-cloud-config-sync",
+    version: "1.0.0",
+    description: "my.wrongstack.com config synchronization (namespaced sync API v1)",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true },
+    defaultConfig: {},
+    setup(api) {
+      const rawConfig = api.config;
+      const paths = opts?.paths ?? rawConfig.paths;
+      const configStore = opts?.configStore ?? rawConfig.configStore;
+      const vault = opts?.vault ?? rawConfig.vault;
+      const appVersion = opts?.appVersion ?? rawConfig.appVersion;
+      if (!paths?.configDir || !configStore || !vault) {
+        api.log.warn(
+          "[cloud-config-sync] paths, configStore, or vault not available \u2014 /cloudsync disabled"
+        );
+        return;
+      }
+      const profileConfigPath = path31.join(paths.configDir, "config.json");
+      const statePath = path31.join(paths.configDir, "cloud-sync-state.json");
+      const warn = (msg) => api.log.warn(msg);
+      const readLocalConfig = async () => {
+        const raw = await readJsonObjectFile(profileConfigPath).catch(() => ({}));
+        return decryptConfigSecrets(raw, vault, { warn });
+      };
+      const writeLocalConfig = async (mutator) => {
+        const current = await readLocalConfig();
+        const next = mutator(current);
+        const encrypted = encryptConfigSecrets(next, vault);
+        await atomicWrite(profileConfigPath, `${JSON.stringify(encrypted, null, 2)}
+`, {
+          mode: 384
+        });
+        configStore.update({ cloudSync: next.cloudSync });
+      };
+      const getSettings = () => {
+        const cfg = configStore.get().cloudSync;
+        if (!cfg?.enabled || !cfg.url || !cfg.token) return null;
+        const token = cfg.token.startsWith("enc:") && vault.decrypt ? vault.decrypt(cfg.token) : cfg.token;
+        return { enabled: true, url: cfg.url, token };
+      };
+      engine = new CloudConfigSync({
+        statePath,
+        readLocalConfig,
+        writeLocalConfig,
+        getSettings,
+        appVersion,
+        logger: { info: (m) => api.log.info(m), warn }
+      });
+      const runPass = async () => {
+        if (!engine) return "Cloud config sync is not initialized.";
+        if (passRunning) return "A sync pass is already running.";
+        passRunning = true;
+        try {
+          const result = await engine.syncOnce();
+          return result.message;
+        } finally {
+          passRunning = false;
+        }
+      };
+      const scheduleLoop = () => {
+        if (timer) {
+          clearInterval(timer);
+          timer = null;
+        }
+        const cfg = configStore.get().cloudSync;
+        if (!cfg?.enabled) return;
+        const seconds = Math.max(
+          MIN_INTERVAL_SECONDS,
+          cfg.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS
+        );
+        timer = setInterval(() => {
+          void runPass().catch((err) => warn(`[cloud-config-sync] ${toErrorMessage(err)}`));
+        }, seconds * 1e3);
+        timer.unref?.();
+      };
+      const setCloudSyncConfig = async (patch) => {
+        await writeLocalConfig((config) => ({
+          ...config,
+          cloudSync: { ...config.cloudSync, ...patch }
+        }));
+        scheduleLoop();
+      };
+      api.slashCommands.register(
+        buildCloudSyncCommand(engine, configStore, setCloudSyncConfig, runPass)
+      );
+      scheduleLoop();
+      api.log.info("[cloud-config-sync] loaded \u2014 /cloudsync available.");
+    },
+    teardown(api) {
+      if (timer) {
+        clearInterval(timer);
+        timer = null;
+      }
+      api.slashCommands.unregister("cloudsync");
+      api.log.info("[cloud-config-sync] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "CloudConfigSync ready" };
+    }
+  };
+}
+function buildCloudSyncCommand(engine, configStore, setCloudSyncConfig, runPass) {
+  return {
+    name: "cloudsync",
+    description: "Portal config sync: /cloudsync [status|on|off|now|set url|set token]",
+    async run(args, _ctx) {
+      const [verb, ...rest] = args.trim().split(/\s+/);
+      const restJoined = rest.join(" ").trim();
+      switch (verb) {
+        case "":
+        case "status":
+          return { message: await engine.statusText() };
+        case "on": {
+          const cfg = configStore.get().cloudSync;
+          if (!cfg?.url || !cfg.token) {
+            return {
+              message: [
+                "Set the portal first:",
+                "  /cloudsync set url https://my.wrongstack.com",
+                '  /cloudsync set token wst_\u2026   (from the dashboard "Connect client" flow)'
+              ].join("\n")
+            };
+          }
+          await setCloudSyncConfig({ enabled: true });
+          const first = await runPass();
+          return { message: `Cloud config sync enabled.
+${first}` };
+        }
+        case "off": {
+          await setCloudSyncConfig({ enabled: false });
+          return { message: "Cloud config sync disabled. Local config kept as-is." };
+        }
+        case "now": {
+          try {
+            return { message: await runPass() };
+          } catch (err) {
+            return { message: `Sync failed: ${toErrorMessage(err)}` };
+          }
+        }
+        case "set": {
+          const [field, ...valueParts] = restJoined.split(/\s+/);
+          const value = valueParts.join(" ").trim();
+          if (field === "url") {
+            if (!/^https?:\/\//.test(value)) {
+              return { message: "Usage: /cloudsync set url https://my.wrongstack.com" };
+            }
+            await setCloudSyncConfig({ url: value.replace(/\/+$/, "") });
+            return { message: `Portal URL set to ${value}.` };
+          }
+          if (field === "token") {
+            if (!/^wst_[A-Za-z0-9_-]{43}$/.test(value)) {
+              return {
+                message: 'That does not look like a machine token (wst_ + 43 chars). Create one in the dashboard "Connect client" flow.'
+              };
+            }
+            await setCloudSyncConfig({ token: value });
+            return { message: "Machine token stored (encrypted at rest)." };
+          }
+          if (field === "interval") {
+            const seconds = Number.parseInt(value, 10);
+            if (!Number.isFinite(seconds) || seconds < MIN_INTERVAL_SECONDS) {
+              return {
+                message: `Usage: /cloudsync set interval <seconds \u2265 ${MIN_INTERVAL_SECONDS}>`
+              };
+            }
+            await setCloudSyncConfig({ intervalSeconds: seconds });
+            return { message: `Sync interval set to ${seconds}s.` };
+          }
+          return { message: "Usage: /cloudsync set url|token|interval <value>" };
+        }
+        default:
+          return {
+            message: [
+              "/cloudsync \u2014 my.wrongstack.com config sync",
+              "",
+              "  /cloudsync status              Show sync state",
+              "  /cloudsync set url <url>       Set the portal URL",
+              "  /cloudsync set token <wst_\u2026>   Store the machine token (encrypted)",
+              "  /cloudsync set interval <sec>  Background pass interval",
+              "  /cloudsync on                  Enable + run the first pass",
+              "  /cloudsync off                 Disable background sync",
+              "  /cloudsync now                 Run one pass immediately",
+              "",
+              "Secrets never sync: providers keys, hq binding, and bot tokens stay local."
+            ].join("\n")
+          };
+      }
+    }
+  };
+}
 export {
   CHIMERA_REVIEW_PROMPT,
   DefaultPluginAPI,
@@ -11961,6 +13593,7 @@ export {
   buildReviewerModelPool,
   createAutoReviewPlugin,
   createChimeraPlugin,
+  createCloudConfigSyncPlugin,
   createPromptsPlugin,
   createSkillsPlugin,
   createSyncPlugin,
@@ -11973,10 +13606,12 @@ export {
   parseChimeraReviewReport,
   parseReviewSeverity,
   persistReviewReport,
+  pluginEntryMatchesName,
   recordCompletedReview,
   recordStartedReview,
   redactPluginConfig,
   resolvePluginConfig,
+  resolvePluginEnablement,
   resolvePluginManifestConfig,
   selectRoundRobinReviewerAssignment,
   unloadPlugins,