@wrongstack/core 0.302.0 → 0.302.2

package/dist/defaults/index.js

@@ -295,7 +295,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve21, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -314,7 +314,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve19,
+        resolve: resolve21,
         reject,
         timer
       });
@@ -663,13 +663,13 @@ var SubagentBudget = class _SubagentBudget {
     if (!bus?.hasListenerFor("budget.threshold_reached")) {
       return Promise.resolve("stop");
     }
-    return new Promise((resolve19) => {
+    return new Promise((resolve21) => {
       let resolved = false;
       const respond = (d) => {
         if (resolved) return;
         resolved = true;
         clearTimeout(fallback);
-        resolve19(d);
+        resolve21(d);
       };
       const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
       const sessionId = this.currentSessionId();
@@ -5510,7 +5510,7 @@ function createDelegateTool(opts) {
   };
 }
 async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abortSignal) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve21) => {
     let settled = false;
     let timer;
     let offAbort = () => {
@@ -5523,7 +5523,7 @@ async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abo
       offIter();
       offProgress();
       offAbort();
-      resolve19(value);
+      resolve21(value);
     };
     const arm = () => {
       if (timer) clearTimeout(timer);
@@ -5734,7 +5734,7 @@ async function readSubagentPartial(opts, subagentId) {
 }
 
 // src/coordination/director.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 import * as fsp19 from "node:fs/promises";
 
 // src/core/instruction-template.ts
@@ -7524,10 +7524,10 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
         pending: taskIds.filter((id) => !done.has(id))
       });
     }
-    return new Promise((resolve19) => {
+    return new Promise((resolve21) => {
       const entry = {
         ids: new Set(taskIds),
-        resolve: (result) => resolve19({
+        resolve: (result) => resolve21({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         })
@@ -7535,7 +7535,7 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
       if (opts?.timeoutMs !== void 0) {
         entry.timer = setTimeout(() => {
           this.anyWaiters.delete(entry);
-          resolve19({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve21({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.anyWaiters.add(entry);
@@ -7653,11 +7653,11 @@ ${JSON.stringify(result.result, null, 2)}
         this.makeStoppedResult(taskId, "director", `Unknown task id "${taskId}" \u2014 never assigned`)
       );
     }
-    let resolve19;
+    let resolve21;
     const promise = new Promise((done) => {
-      resolve19 = done;
+      resolve21 = done;
     });
-    this.taskWaiters.set(taskId, { promise, resolve: resolve19 });
+    this.taskWaiters.set(taskId, { promise, resolve: resolve21 });
     return promise;
   }
   recordAssignment(task) {
@@ -9547,11 +9547,12 @@ function rosterSummaryFromConfigs(roster) {
 
 // src/coordination/director-session.ts
 import * as fsp18 from "node:fs/promises";
-import * as path21 from "node:path";
+import * as path23 from "node:path";
 
 // src/storage/session-store.ts
+import { randomUUID as randomUUID10 } from "node:crypto";
 import * as fsp17 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as path22 from "node:path";
 
 // src/security/file-permissions.ts
 import { chmod } from "node:fs/promises";
@@ -9881,6 +9882,388 @@ var DefaultSecretScrubber = class {
   }
 };
 
+// src/session-catalog/client.ts
+import { spawn } from "node:child_process";
+import * as fs2 from "node:fs";
+import * as net from "node:net";
+import * as path10 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/session-catalog/endpoint.ts
+import { createHash as createHash2 } from "node:crypto";
+import * as os2 from "node:os";
+import * as path9 from "node:path";
+
+// src/session-catalog/protocol.ts
+var SESSION_CATALOG_PROTOCOL_VERSION = 1;
+var SESSION_CATALOG_MAX_FRAME_CHARS = 4 * 1024 * 1024;
+function encodeSessionCatalogMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+
+// src/session-catalog/endpoint.ts
+var SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
+function normalizedPath(value) {
+  const resolved = path9.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function sessionCatalogProjectServerKey(projectDir) {
+  return createHash2("sha256").update(normalizedPath(projectDir)).digest("hex").slice(0, 24);
+}
+function sessionCatalogProjectServerEndpoint(projectDir) {
+  const key = sessionCatalogProjectServerKey(projectDir);
+  if (process.platform === "win32") {
+    return `\\\\.\\pipe\\wrongstack-session-catalog-v${SESSION_CATALOG_PROTOCOL_VERSION}-${key}`;
+  }
+  return path9.join(os2.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
+}
+function sessionCatalogProjectServerMetadataPath(projectDir) {
+  return path9.join(projectDir, SESSION_CATALOG_METADATA_FILE);
+}
+
+// src/session-catalog/client.ts
+var CONNECT_TIMEOUT_MS = 750;
+var START_TIMEOUT_MS = 1e4;
+var CALL_TIMEOUT_MS = 3e4;
+var MAX_PENDING_REQUESTS = 1024;
+var MAX_EVENT_LISTENERS = 64;
+function locateServer(moduleUrl, exists) {
+  for (const candidate of [
+    "./project-server.js",
+    "../session-catalog/project-server.js",
+    "./session-catalog/project-server.js",
+    "../../dist/session-catalog/project-server.js"
+  ]) {
+    try {
+      const url = new URL(candidate, moduleUrl);
+      if (url.protocol === "file:" && exists(fileURLToPath3(url))) return url;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveSessionCatalogDaemonAvailability(moduleUrl = import.meta.url, exists = fs2.existsSync) {
+  if (process.env["WRONGSTACK_SESSION_CATALOG_INLINE"] || process.env["WRONGSTACK_SESSION_CATALOG_SERVER"] === "0")
+    return { kind: "inline-requested" };
+  const url = locateServer(moduleUrl, exists);
+  return url ? { kind: "available", url } : { kind: "missing-build" };
+}
+function resolveSessionCatalogProjectServerUrl(moduleUrl = import.meta.url, exists = fs2.existsSync) {
+  const availability = resolveSessionCatalogDaemonAvailability(moduleUrl, exists);
+  return availability.kind === "available" ? availability.url : null;
+}
+function normalize2(value) {
+  const resolved = path10.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function delay(ms) {
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
+}
+var SessionCatalogProjectClient = class {
+  constructor(options) {
+    this.options = options;
+    this.endpoint = sessionCatalogProjectServerEndpoint(options.projectDir);
+  }
+  options;
+  endpoint;
+  socket = null;
+  info = null;
+  buffer = "";
+  connecting = null;
+  connectResolve = null;
+  connectReject = null;
+  authToken;
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  eventListeners = /* @__PURE__ */ new Set();
+  reconnectTimer;
+  explicitlyClosed = false;
+  async call(op, args, options = {}) {
+    await this.ensureConnected(true);
+    return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
+  }
+  /**
+   * Call an already-running project daemon without starting one.
+   *
+   * Cross-project discovery must use this path: observing another project is
+   * never sufficient authority to wake that project's IPC owner.
+   */
+  async callExisting(op, args, options = {}) {
+    await this.ensureConnected(false);
+    return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
+  }
+  ping() {
+    return this.call("ping", {}, { timeoutMs: 3e3 });
+  }
+  async subscribe(listener) {
+    if (!this.eventListeners.has(listener) && this.eventListeners.size >= MAX_EVENT_LISTENERS) {
+      throw new Error(`Session Catalog listener limit reached (${MAX_EVENT_LISTENERS})`);
+    }
+    this.explicitlyClosed = false;
+    this.eventListeners.add(listener);
+    try {
+      await this.call("subscribe", {});
+    } catch (error2) {
+      this.eventListeners.delete(listener);
+      throw error2;
+    }
+    return async () => {
+      this.eventListeners.delete(listener);
+      if (this.eventListeners.size === 0)
+        await this.callExisting("unsubscribe", {}).catch(() => void 0);
+    };
+  }
+  async shutdown(reason) {
+    try {
+      await this.ensureConnected(false);
+    } catch {
+      return { stopped: false };
+    }
+    const result = await this.request({ type: "shutdown", ...reason !== void 0 ? { reason } : {} }, 5e3).catch(
+      () => ({ stopped: false })
+    );
+    if (result.stopped) {
+      const metadataPath = sessionCatalogProjectServerMetadataPath(this.options.projectDir);
+      const deadline = Date.now() + 5e3;
+      while (fs2.existsSync(metadataPath) && Date.now() < deadline) await delay(20);
+      if (result.pid && result.pid !== process.pid) {
+        while (Date.now() < deadline) {
+          try {
+            process.kill(result.pid, 0);
+            await delay(20);
+          } catch {
+            break;
+          }
+        }
+      }
+    }
+    return result;
+  }
+  async close() {
+    this.explicitlyClosed = true;
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = void 0;
+    const socket = this.socket;
+    this.socket = null;
+    this.info = null;
+    if (socket && !socket.destroyed)
+      await new Promise((resolve21) => {
+        socket.once("close", resolve21);
+        socket.end();
+      });
+  }
+  async ensureConnected(spawnIfMissing) {
+    if (this.socket && !this.socket.destroyed && this.info) return;
+    if (this.connecting) return this.connecting;
+    this.connecting = this.connectWithElection(spawnIfMissing).finally(() => {
+      this.connecting = null;
+    });
+    return this.connecting;
+  }
+  async connectWithElection(spawnIfMissing) {
+    const deadline = Date.now() + (spawnIfMissing ? START_TIMEOUT_MS : CONNECT_TIMEOUT_MS);
+    let spawned = false;
+    let lastError = new Error("Session Catalog project server unavailable");
+    while (Date.now() < deadline) {
+      try {
+        await this.connectOnce();
+        return;
+      } catch (error2) {
+        lastError = error2;
+      }
+      if (!spawnIfMissing) break;
+      if (!spawned) {
+        this.spawnDetached();
+        spawned = true;
+      }
+      await delay(75);
+    }
+    throw lastError;
+  }
+  connectOnce() {
+    this.socket?.destroy();
+    this.socket = null;
+    this.info = null;
+    this.authToken = void 0;
+    this.buffer = "";
+    return new Promise((resolve21, reject) => {
+      const socket = net.createConnection(this.endpoint);
+      this.socket = socket;
+      socket.setEncoding("utf8");
+      const timer = setTimeout(() => {
+        reject(new Error("Session Catalog handshake timed out"));
+        socket.destroy();
+      }, CONNECT_TIMEOUT_MS);
+      timer.unref?.();
+      this.connectResolve = () => {
+        clearTimeout(timer);
+        this.connectResolve = null;
+        this.connectReject = null;
+        resolve21();
+      };
+      this.connectReject = (error2) => {
+        clearTimeout(timer);
+        this.connectResolve = null;
+        this.connectReject = null;
+        reject(error2);
+      };
+      socket.on("data", (chunk) => this.onData(socket, chunk));
+      socket.on("error", (error2) => {
+        if (!this.info) this.connectReject?.(error2);
+      });
+      socket.on("close", () => this.onClose(socket));
+    });
+  }
+  currentAuthToken() {
+    if (this.authToken === void 0) {
+      try {
+        const parsed = JSON.parse(
+          fs2.readFileSync(sessionCatalogProjectServerMetadataPath(this.options.projectDir), "utf8")
+        );
+        if (typeof parsed.authToken === "string" && parsed.authToken)
+          this.authToken = parsed.authToken;
+      } catch {
+      }
+    }
+    return this.authToken;
+  }
+  request(message, timeoutMs) {
+    const socket = this.socket;
+    if (!socket || socket.destroyed)
+      return Promise.reject(new Error("Session Catalog connection is unavailable"));
+    const id = this.nextId++;
+    if (this.pending.size >= MAX_PENDING_REQUESTS) {
+      return Promise.reject(
+        new Error(`Session Catalog pending request limit reached (${MAX_PENDING_REQUESTS})`)
+      );
+    }
+    const encoded = encodeSessionCatalogMessage({
+      ...message,
+      id,
+      authToken: this.currentAuthToken()
+    });
+    if (encoded.length > SESSION_CATALOG_MAX_FRAME_CHARS)
+      return Promise.reject(new Error("Session Catalog request exceeded frame limit"));
+    return new Promise((resolve21, reject) => {
+      const timer = setTimeout(() => {
+        const pending = this.pending.get(id);
+        if (!pending) return;
+        this.pending.delete(id);
+        pending.reject(
+          new Error(
+            `Session Catalog ${message.type === "request" ? message.op : message.type} timed out`
+          )
+        );
+      }, timeoutMs);
+      timer.unref?.();
+      this.pending.set(id, { resolve: resolve21, reject, timer });
+      socket.write(encoded);
+    });
+  }
+  onData(socket, chunk) {
+    if (socket !== this.socket) return;
+    this.buffer += chunk;
+    if (this.buffer.length > SESSION_CATALOG_MAX_FRAME_CHARS) {
+      socket.destroy(new Error("Session Catalog response exceeded frame limit"));
+      return;
+    }
+    while (true) {
+      const newline = this.buffer.indexOf("\n");
+      if (newline < 0) return;
+      const line = this.buffer.slice(0, newline);
+      this.buffer = this.buffer.slice(newline + 1);
+      if (!line) continue;
+      try {
+        this.onMessage(JSON.parse(line));
+      } catch {
+        socket.destroy(new Error("Invalid Session Catalog response"));
+        return;
+      }
+    }
+  }
+  onMessage(message) {
+    if (message.type === "hello") {
+      if (message.protocolVersion !== SESSION_CATALOG_PROTOCOL_VERSION) {
+        this.connectReject?.(
+          new Error(
+            `Session Catalog protocol mismatch: client=${SESSION_CATALOG_PROTOCOL_VERSION}, server=${message.protocolVersion}`
+          )
+        );
+        this.socket?.destroy();
+        return;
+      }
+      if (normalize2(message.projectDir) !== normalize2(this.options.projectDir) || normalize2(message.projectRoot) !== normalize2(this.options.projectRoot)) {
+        this.connectReject?.(new Error("Session Catalog project identity mismatch"));
+        this.socket?.destroy();
+        return;
+      }
+      this.info = message;
+      this.connectResolve?.();
+      return;
+    }
+    if (message.type === "event") {
+      for (const listener of this.eventListeners) {
+        try {
+          listener(message.event);
+        } catch {
+        }
+      }
+      return;
+    }
+    const pending = this.pending.get(message.id);
+    if (!pending) return;
+    this.pending.delete(message.id);
+    clearTimeout(pending.timer);
+    if (message.ok) pending.resolve(message.result);
+    else {
+      const error2 = new Error(message.error);
+      if (message.errorName) error2.name = message.errorName;
+      pending.reject(error2);
+    }
+  }
+  onClose(socket) {
+    if (socket !== this.socket) return;
+    this.socket = null;
+    this.info = null;
+    this.authToken = void 0;
+    const error2 = new Error("Session Catalog connection closed");
+    this.connectReject?.(error2);
+    this.connectResolve = null;
+    this.connectReject = null;
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error2);
+    }
+    this.pending.clear();
+    this.scheduleSubscriptionReconnect();
+  }
+  scheduleSubscriptionReconnect() {
+    if (this.explicitlyClosed || this.eventListeners.size === 0 || this.reconnectTimer) return;
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = void 0;
+      void this.call("subscribe", {}).catch(() => this.scheduleSubscriptionReconnect());
+    }, 250);
+    this.reconnectTimer.unref?.();
+  }
+  spawnDetached() {
+    const url = resolveSessionCatalogProjectServerUrl();
+    if (!url) throw new Error("Built Session Catalog project server is unavailable");
+    const child = spawn(
+      process.execPath,
+      [
+        fileURLToPath3(url),
+        "--project-dir",
+        this.options.projectDir,
+        "--project-root",
+        this.options.projectRoot
+      ],
+      { detached: true, stdio: "ignore", windowsHide: true, env: process.env }
+    );
+    child.unref();
+  }
+};
+
 // src/utils/assert-never.ts
 function assertNever(x, message) {
   const err = new Error(
@@ -10087,20 +10470,20 @@ var color = {
 };
 
 // src/utils/config-backup.ts
-import * as fs2 from "node:fs/promises";
-import * as path9 from "node:path";
+import * as fs3 from "node:fs/promises";
+import * as path11 from "node:path";
 function configHistoryDir(globalRoot) {
-  return path9.join(globalRoot, "config-history");
+  return path11.join(globalRoot, "config-history");
 }
 function configSlug(absolutePath, globalRoot) {
-  const rel = path9.relative(globalRoot, absolutePath);
+  const rel = path11.relative(globalRoot, absolutePath);
   const normalized = rel.replace(/\\/g, "/").replace(/\.json$/i, "");
   return normalized.replace(/\//g, "-");
 }
 async function backupConfigFile(filePath, paths) {
   let currentContent;
   try {
-    currentContent = await fs2.readFile(filePath, "utf8");
+    currentContent = await fs3.readFile(filePath, "utf8");
     if (!currentContent.trim()) return;
   } catch {
     return;
@@ -10109,10 +10492,10 @@ async function backupConfigFile(filePath, paths) {
   const ts = now.toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
   const slug = configSlug(filePath, paths.globalRoot);
   const backupDir = configHistoryDir(paths.globalRoot);
-  const backupFile = path9.join(backupDir, `${slug}-${ts}.json`);
+  const backupFile = path11.join(backupDir, `${slug}-${ts}.json`);
   try {
-    await fs2.mkdir(backupDir, { recursive: true });
-    await fs2.writeFile(backupFile, currentContent, { mode: 384, encoding: "utf8" });
+    await fs3.mkdir(backupDir, { recursive: true });
+    await fs3.writeFile(backupFile, currentContent, { mode: 384, encoding: "utf8" });
   } catch {
   }
 }
@@ -10185,6 +10568,7 @@ function isTextBlock(b) {
 var MAX_DIGEST_CHARS = 4e3;
 function createContextEvidenceState() {
   return {
+    recentUserTurns: [],
     sessionGoals: [],
     implicitFacts: [],
     activeErrors: [],
@@ -10201,6 +10585,11 @@ function buildContextEvidenceDigest(ctx) {
   if (state.currentIntent?.text) {
     lines.push(`intent: ${state.currentIntent.text}`);
   }
+  const priorTurns = (state.recentUserTurns ?? []).slice(-6, -1);
+  if (priorTurns.length > 0) {
+    lines.push("recent_human_instructions:");
+    for (const turn of priorTurns) lines.push(`- ${turn.text}`);
+  }
   const goals = state.sessionGoals.slice(-3);
   if (goals.length > 0) {
     lines.push("session_goals:");
@@ -10290,6 +10679,7 @@ function ensureEvidence(ctx) {
     ctx.contextEvidence = createContextEvidenceState();
   }
   ctx.contextEvidence.completedWork ??= [];
+  ctx.contextEvidence.recentUserTurns ??= [];
   return ctx.contextEvidence;
 }
 
@@ -10400,7 +10790,7 @@ function isEmptyMessage(msg) {
 }
 
 // src/core/context.ts
-import * as path10 from "node:path";
+import * as path12 from "node:path";
 
 // src/utils/tool-wire-compact.ts
 var TOOL_DESCRIPTION_MAX_CHARS = 400;
@@ -10804,12 +11194,11 @@ var ConversationState = class {
     }
     this.ctx.messages.splice(this.ctx.messages.length, 0, message);
     const overflow = this.overflowCount(this.ctx.messages);
+    this.emit({ kind: "message_appended", message });
     if (overflow > 0) {
       this.ctx.messages.splice(0, overflow);
       this.ctx.toolAdjacencyDirty = true;
-      this.emit({ kind: "messages_replaced", messages: [...this.ctx.messages] });
-    } else {
-      this.emit({ kind: "message_appended", message });
+      this.emit({ kind: "messages_dropped", count: overflow });
     }
   }
   /**
@@ -11307,6 +11696,11 @@ var Context = class _Context {
           ts,
           version: 1,
           messages: [...change.messages]
+        } : change.kind === "messages_dropped" ? {
+          type: "messages_dropped",
+          ts,
+          version: 1,
+          count: change.count
         } : null;
         if (!event) return;
         this.enqueueConversationJournal(event, this.session);
@@ -11592,11 +11986,11 @@ var Context = class _Context {
    * Returns the resolved absolute path.
    */
   setWorkingDir(dir) {
-    const resolved = path10.isAbsolute(dir) ? path10.resolve(dir) : path10.resolve(this.projectRoot, dir);
+    const resolved = path12.isAbsolute(dir) ? path12.resolve(dir) : path12.resolve(this.projectRoot, dir);
     if (!this.allowOutsideProjectRoot) {
-      const root = path10.resolve(this.projectRoot);
-      const rel = path10.relative(root, resolved);
-      if (rel.startsWith("..") || path10.isAbsolute(rel)) {
+      const root = path12.resolve(this.projectRoot);
+      const rel = path12.relative(root, resolved);
+      if (rel.startsWith("..") || path12.isAbsolute(rel)) {
         throw new Error(`Working directory "${resolved}" is outside project root "${root}"`);
       }
     }
@@ -12025,10 +12419,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path42, errors, depth) {
+function walk(value, schema, path44, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path42 || "<root>",
+      path: path44 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -12036,7 +12430,7 @@ function walk(value, schema, path42, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path42 || "<root>",
+        path: path44 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -12045,7 +12439,7 @@ function walk(value, schema, path42, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path42 || "<root>",
+        path: path44 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -12057,7 +12451,7 @@ function walk(value, schema, path42, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path42, req),
+          path: joinPath(path44, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -12065,14 +12459,14 @@ function walk(value, schema, path42, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path42, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path44, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path42}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path44}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -12432,14 +12826,14 @@ function compileUserRegex(pattern, flags) {
 var MAX_SUBJECT_LEN = 64 * 1024;
 
 // src/utils/session-scoped-path.ts
-import * as path11 from "node:path";
+import * as path13 from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path11.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path11.relative(path11.resolve(dir), resolved);
-  if (rel.startsWith("..") || path11.isAbsolute(rel)) {
+  const resolved = path13.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path13.relative(path13.resolve(dir), resolved);
+  if (rel.startsWith("..") || path13.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -12455,7 +12849,7 @@ function invalid(sessionId) {
 
 // src/utils/sleep.ts
 function sleep(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 
 // src/utils/slug.ts
@@ -13238,7 +13632,7 @@ function subjectForToolInput(toolName, input, subjectKey) {
 // src/storage/file-session-writer.ts
 import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
 import * as fsp7 from "node:fs/promises";
-import * as path12 from "node:path";
+import * as path14 from "node:path";
 import { createInterface } from "node:readline";
 
 // src/storage/session-workspace-checkpoints.ts
@@ -13504,7 +13898,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path12.join(opts.dir, `${path12.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path14.join(opts.dir, `${path14.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.checkpointCas = opts.checkpointCas;
@@ -14393,10 +14787,10 @@ var FileSessionWriter = class _FileSessionWriter {
 };
 
 // src/storage/session-checkpoint-cas.ts
-import { spawn } from "node:child_process";
-import { createHash as createHash2, randomUUID as randomUUID9 } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { createHash as createHash3, randomUUID as randomUUID9 } from "node:crypto";
 import * as fsp8 from "node:fs/promises";
-import * as path13 from "node:path";
+import * as path15 from "node:path";
 
 // src/storage/storage-concurrency.ts
 async function mapWithConcurrency(items, concurrency, mapper) {
@@ -14424,16 +14818,16 @@ var MAX_GIT_OUTPUT = 16 * 1024 * 1024;
 var MAX_BLOB_BYTES = 64 * 1024 * 1024;
 var MAX_CHECKPOINT_BYTES = 512 * 1024 * 1024;
 function sha256(content) {
-  return createHash2("sha256").update(content).digest("hex");
+  return createHash3("sha256").update(content).digest("hex");
 }
 function isInside(root, target) {
-  const relative8 = path13.relative(root, target);
-  return relative8 === "" || !relative8.startsWith("..") && !path13.isAbsolute(relative8);
+  const relative8 = path15.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path15.isAbsolute(relative8);
 }
 function normalizeRelative(input) {
-  if (!input || path13.isAbsolute(input)) return null;
+  if (!input || path15.isAbsolute(input)) return null;
   const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
-  const resolved = path13.posix.normalize(normalized);
+  const resolved = path15.posix.normalize(normalized);
   if (!resolved || resolved === "." || resolved === ".." || resolved.startsWith("../")) return null;
   return resolved;
 }
@@ -14448,8 +14842,8 @@ var SessionCheckpointCas = class {
   projectRoot;
   runGit;
   constructor(opts) {
-    this.rootDir = path13.resolve(opts.rootDir);
-    this.projectRoot = path13.resolve(opts.projectRoot);
+    this.rootDir = path15.resolve(opts.rootDir);
+    this.projectRoot = path15.resolve(opts.projectRoot);
     this.runGit = opts.runGit ?? defaultRunGit;
   }
   async capture(_sessionId, _promptIndex) {
@@ -14474,7 +14868,7 @@ var SessionCheckpointCas = class {
       relativePaths,
       CAPTURE_CONCURRENCY,
       async (relative8) => {
-        const absolute = path13.resolve(this.projectRoot, ...relative8.split("/"));
+        const absolute = path15.resolve(this.projectRoot, ...relative8.split("/"));
         if (!isInside(this.projectRoot, absolute)) {
           unresolved.push({ path: relative8, reason: "path escapes project root" });
           return null;
@@ -14483,8 +14877,8 @@ var SessionCheckpointCas = class {
           const stat15 = await fsp8.lstat(absolute);
           if (stat15.isSymbolicLink()) {
             const linkTarget = await fsp8.readlink(absolute);
-            const resolvedLink = path13.resolve(path13.dirname(absolute), linkTarget);
-            if (path13.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
+            const resolvedLink = path15.resolve(path15.dirname(absolute), linkTarget);
+            if (path15.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
               unresolved.push({
                 path: relative8,
                 reason: "symlink target escapes project root"
@@ -14546,7 +14940,7 @@ var SessionCheckpointCas = class {
     };
   }
   async materialize(checkpoint, targetRoot) {
-    const target = path13.resolve(targetRoot);
+    const target = path15.resolve(targetRoot);
     if (target === this.projectRoot) {
       throw new Error("Refusing to materialize a workspace checkpoint over the parent project root");
     }
@@ -14586,10 +14980,10 @@ var SessionCheckpointCas = class {
       try {
         const output = await this.safeOutputPath(target, realTarget, entry.path);
         if (entry.state === "symlink") {
-          if (path13.isAbsolute(entry.linkTarget)) {
+          if (path15.isAbsolute(entry.linkTarget)) {
             throw new Error("absolute symlink target refused");
           }
-          const resolvedLink = path13.resolve(path13.dirname(output), entry.linkTarget);
+          const resolvedLink = path15.resolve(path15.dirname(output), entry.linkTarget);
           if (!isInside(target, resolvedLink)) throw new Error("symlink target escapes checkpoint root");
         }
         prepared.push({
@@ -14617,7 +15011,7 @@ var SessionCheckpointCas = class {
           await fsp8.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
-          await fsp8.mkdir(path13.dirname(output), { recursive: true });
+          await fsp8.mkdir(path15.dirname(output), { recursive: true });
           await fsp8.symlink(entry.linkTarget, output);
           writtenFiles.push(entry.path);
           continue;
@@ -14634,15 +15028,15 @@ var SessionCheckpointCas = class {
   }
   objectPath(hash2) {
     if (!HASH_RE.test(hash2)) throw new Error(`Invalid CAS object hash: ${hash2}`);
-    return path13.join(this.rootDir, "objects", hash2.slice(0, 2), hash2.slice(2));
+    return path15.join(this.rootDir, "objects", hash2.slice(0, 2), hash2.slice(2));
   }
   manifestPath(hash2) {
     if (!HASH_RE.test(hash2)) throw new Error(`Invalid checkpoint manifest hash: ${hash2}`);
-    return path13.join(this.rootDir, "manifests", `${hash2}.json`);
+    return path15.join(this.rootDir, "manifests", `${hash2}.json`);
   }
   async putBlob(hash2, content) {
     const target = this.objectPath(hash2);
-    await fsp8.mkdir(path13.dirname(target), { recursive: true });
+    await fsp8.mkdir(path15.dirname(target), { recursive: true });
     try {
       const existing = await fsp8.readFile(target);
       if (sha256(existing) !== hash2) throw new Error(`Corrupt CAS object collision: ${hash2}`);
@@ -14650,9 +15044,9 @@ var SessionCheckpointCas = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    const temp = path13.join(
-      path13.dirname(target),
-      `.${path13.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
+    const temp = path15.join(
+      path15.dirname(target),
+      `.${path15.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
     );
     let handle;
     try {
@@ -14713,7 +15107,7 @@ var SessionCheckpointCas = class {
   async safeOutputPath(target, realTarget, relative8) {
     const normalized = normalizeRelative(relative8);
     if (!normalized) throw new Error("invalid relative path");
-    const output = path13.resolve(target, ...normalized.split("/"));
+    const output = path15.resolve(target, ...normalized.split("/"));
     if (!isInside(target, output)) throw new Error("path escapes checkpoint target");
     let probe = output;
     for (; ; ) {
@@ -14723,7 +15117,7 @@ var SessionCheckpointCas = class {
         return output;
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
-        const parent = path13.dirname(probe);
+        const parent = path15.dirname(probe);
         if (parent === probe) throw err;
         probe = parent;
       }
@@ -14731,14 +15125,14 @@ var SessionCheckpointCas = class {
   }
 };
 function defaultRunGit(args, cwd) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve21) => {
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
     let stderrBytes = 0;
     let stdoutTruncated = false;
     let stderrTruncated = false;
-    const child = spawn("git", args, {
+    const child = spawn2("git", args, {
       cwd,
       env: buildChildEnv(),
       stdio: ["ignore", "pipe", "pipe"],
@@ -14774,8 +15168,8 @@ function defaultRunGit(args, cwd) {
       stdoutTruncated,
       stderrTruncated
     });
-    child.on("error", (err) => resolve19(result(1, err.message)));
-    child.on("close", (code) => resolve19(result(code ?? 1)));
+    child.on("error", (err) => resolve21(result(1, err.message)));
+    child.on("close", (code) => resolve21(result(code ?? 1)));
   });
 }
 
@@ -14787,13 +15181,13 @@ function generateSessionId(startedAt, _model) {
 }
 
 // src/storage/session-id-resolver.ts
-import * as path14 from "node:path";
+import * as path16 from "node:path";
 function resolveSessionId(query, candidateIds) {
   const normalized = query.trim();
   if (!normalized) return { status: "missing", query: normalized };
   const uniqueIds = [...new Set(candidateIds)];
   if (uniqueIds.includes(normalized)) return { status: "resolved", id: normalized };
-  const leaf = (id) => path14.posix.basename(id.replace(/\\/g, "/"));
+  const leaf = (id) => path16.posix.basename(id.replace(/\\/g, "/"));
   const exactLeafMatches = uniqueIds.filter((id) => leaf(id) === normalized);
   if (exactLeafMatches.length === 1) {
     return { status: "resolved", id: exactLeafMatches[0] };
@@ -14845,15 +15239,15 @@ function scrubPersistedSessionSummary(summary, scrubber2) {
 }
 
 // src/storage/session-resume-validation.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import * as fsp9 from "node:fs/promises";
-import * as path15 from "node:path";
+import * as path17 from "node:path";
 var MAX_REVALIDATE_BYTES = 5 * 1024 * 1024;
 var VALIDATION_CONCURRENCY = 8;
 var NOTICE_PATH_LIMIT = 20;
 function isInside2(root, target) {
-  const relative8 = path15.relative(root, target);
-  return relative8 === "" || !relative8.startsWith("..") && !path15.isAbsolute(relative8);
+  const relative8 = path17.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path17.isAbsolute(relative8);
 }
 function errno(err) {
   return err && typeof err === "object" && "code" in err ? String(err.code) : void 0;
@@ -14864,7 +15258,7 @@ function latestObservations(events, projectRoot) {
     if (event.type !== "file_observation" || typeof event.path !== "string" || event.path.length === 0 || typeof event.hash !== "string" || !/^[a-f\d]{64}$/i.test(event.hash)) {
       continue;
     }
-    const normalized = path15.resolve(projectRoot, event.path);
+    const normalized = path17.resolve(projectRoot, event.path);
     latest.set(normalized, {
       path: normalized,
       hash: event.hash.toLowerCase(),
@@ -14913,7 +15307,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
       };
     }
     const content = await fsp9.readFile(realFile, "utf8");
-    const actualHash = createHash3("sha256").update(content, "utf8").digest("hex");
+    const actualHash = createHash4("sha256").update(content, "utf8").digest("hex");
     if (actualHash === observation.hash) return null;
     return { ...base, status: "modified", actualHash };
   } catch (err) {
@@ -14922,7 +15316,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
 }
 async function validateResumeFileObservations(events, projectRoot) {
-  const lexicalRoot = path15.resolve(projectRoot);
+  const lexicalRoot = path17.resolve(projectRoot);
   const realRoot = await fsp9.realpath(lexicalRoot).catch(() => lexicalRoot);
   const observations = latestObservations(events, lexicalRoot);
   const results = await mapWithConcurrency(
@@ -14938,9 +15332,9 @@ async function validateResumeFileObservations(events, projectRoot) {
 }
 function formatResumeValidationNotice(validation, projectRoot) {
   if (validation.staleFiles.length === 0) return null;
-  const root = path15.resolve(projectRoot);
+  const root = path17.resolve(projectRoot);
   const shown = validation.staleFiles.slice(0, NOTICE_PATH_LIMIT).map((entry) => {
-    const relative8 = path15.relative(root, entry.path);
+    const relative8 = path17.relative(root, entry.path);
     const display = isInside2(root, entry.path) ? relative8 || "." : entry.path;
     return `- ${JSON.stringify(display)} [${entry.status}]`;
   });
@@ -14965,22 +15359,22 @@ function formatInterruptedToolNotice(pendingToolUseCount) {
 
 // src/storage/session-store/delete-session-artifacts.ts
 import * as fsp10 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as path19 from "node:path";
 
 // src/storage/session-store/paths.ts
-import * as path16 from "node:path";
+import * as path18 from "node:path";
 function sessionPath(storeDir, id, ext) {
   return sessionScopedPath(storeDir, id, ext);
 }
 function shardManifestPath(storeDir, shardKey) {
-  return shardKey ? path16.join(storeDir, shardKey, "_manifest.json") : path16.join(storeDir, "_manifest.json");
+  return shardKey ? path18.join(storeDir, shardKey, "_manifest.json") : path18.join(storeDir, "_manifest.json");
 }
 function shardKeyForSessionId(id) {
-  const dirName = path16.dirname(id);
+  const dirName = path18.dirname(id);
   return dirName === "." ? "" : dirName;
 }
 async function ensureShardDir(storeDir, id) {
-  const dirPath = path16.dirname(sessionScopedPath(storeDir, id, ""));
+  const dirPath = path18.dirname(sessionScopedPath(storeDir, id, ""));
   await ensureDir(dirPath);
   return dirPath;
 }
@@ -14991,9 +15385,9 @@ async function deleteSessionArtifacts({
   id,
   jsonlPath
 }) {
-  const shardDir = path17.dirname(jsonlPath);
-  const base = path17.basename(id);
-  const sessDir = path17.join(shardDir, base);
+  const shardDir = path19.dirname(jsonlPath);
+  const base = path19.basename(id);
+  const sessDir = path19.join(shardDir, base);
   const deletions = [
     fsp10.unlink(jsonlPath),
     fsp10.unlink(sessionPath(rootDir, id, ".summary.json")),
@@ -15052,7 +15446,7 @@ function isSessionJsonlFileName(name) {
 
 // src/storage/session-store/directory-session-files.ts
 import * as fsp11 from "node:fs/promises";
-import * as path18 from "node:path";
+import * as path20 from "node:path";
 function sessionIdForFile(prefix, name) {
   const base = name.replace(/\.jsonl$/, "");
   return prefix ? `${prefix}/${base}` : base;
@@ -15074,12 +15468,12 @@ async function collectSessionFiles(dir, prefix = "", depth = 0) {
     if (entry.isDirectory()) {
       dirEntries.push(entry);
     } else if (entry.isFile() && isSessionJsonlFileName(entry.name)) {
-      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path18.join(dir, entry.name) });
+      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path20.join(dir, entry.name) });
     }
   }
   const childFileArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionFiles(path18.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionFiles(path20.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childFileArrays.flat(), ...files];
@@ -15103,7 +15497,7 @@ async function collectSessionIds(dir, prefix = "", depth = 0) {
   }
   const childIdArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionIds(path18.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionIds(path20.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childIdArrays.flat(), ...fileIds];
@@ -15145,7 +15539,7 @@ function emitSessionStoreError(events, sessionId, filePath, operation, error2, r
 }
 
 // src/storage/session-store/fork-session.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 
 // src/storage/session-store/replay.ts
 function isReplayableMessage(value) {
@@ -15217,7 +15611,7 @@ async function forkSession(host, id, opts = {}) {
   }
   const parentPrefix = parent.events.slice(0, boundary + 1);
   const workspaceCheckpoint = targetCheckpoint?.workspaceCheckpoint;
-  const checkpointHash = createHash4("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
+  const checkpointHash = createHash5("sha256").update(parentPrefix.map((event) => JSON.stringify(event)).join("\n") + "\n", "utf8").digest("hex");
   const inherited = parentPrefix.filter(inheritsIntoFork);
   const writer = await host.create({
     id: "",
@@ -15560,6 +15954,16 @@ function replaySessionEvent(params) {
     } else {
       emitDamaged(params, "Ignored malformed messages_replaced event");
     }
+  } else if (ev.type === "messages_dropped" && ev.version === 1) {
+    if (exactJournalActive && Number.isInteger(ev.count) && ev.count > 0) {
+      messages.splice(0, Math.min(ev.count, messages.length));
+      openToolUses.clear();
+      for (const current of messages) trackMessageToolState(current, openToolUses);
+    } else if (!exactJournalActive) {
+      emitDamaged(params, "Ignored messages_dropped event outside the exact journal");
+    } else {
+      emitDamaged(params, `Ignored malformed messages_dropped event (count ${String(ev.count)})`);
+    }
   } else if (ev.type === "context_snapshot") {
     if (!applyContextSnapshot(messages, openToolUses, ev.messages)) {
       emitDamaged(params, "Ignored malformed context_snapshot event");
@@ -15614,7 +16018,7 @@ function emitDamaged(params, detail) {
 
 // src/storage/session-store/prune-helpers.ts
 import * as fsp13 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as path21 from "node:path";
 function isPrunableSessionJsonl(name) {
   return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
 }
@@ -15622,7 +16026,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
   const cutoff = Date.now() - maxAgeDays * 864e5;
   let deleted = 0;
   const pruneFile = async (dir, name, prefix) => {
-    const jsonlPath = path19.join(dir, name);
+    const jsonlPath = path21.join(dir, name);
     try {
       const stat15 = await fsp13.stat(jsonlPath);
       if (stat15.mtimeMs >= cutoff) return;
@@ -15641,7 +16045,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
       continue;
     }
     if (!entry.isDirectory()) continue;
-    const dateDir = path19.join(storeDir, entry.name);
+    const dateDir = path21.join(storeDir, entry.name);
     const files = await fsp13.readdir(dateDir, { withFileTypes: true }).catch(() => []);
     for (const file of files) {
       if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
@@ -15650,7 +16054,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dateDir = path19.join(storeDir, entry.name);
+    const dateDir = path21.join(storeDir, entry.name);
     try {
       const remaining = await fsp13.readdir(dateDir);
       if (remaining.length === 0) {
@@ -15983,6 +16387,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   logger;
   onAppend;
   onAppendBatch;
+  /** Present in built production output; source-only tests retain the local compatibility path. */
+  catalogClient;
+  maintenanceHolderId = randomUUID10();
   /**
    * In-memory cache for load() results, keyed by session ID. The cache is
    * invalidated when the file's mtimeMs or size changes (indicating the
@@ -16000,9 +16407,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   static LIST_SCAN_CONCURRENCY = 32;
   constructor(opts) {
     this.dir = opts.dir;
-    this.projectRoot = opts.projectRoot ? path20.resolve(opts.projectRoot) : void 0;
+    this.projectRoot = opts.projectRoot ? path22.resolve(opts.projectRoot) : void 0;
     this.checkpointCas = this.projectRoot ? new SessionCheckpointCas({
-      rootDir: path20.join(this.dir, "_cas"),
+      rootDir: path22.join(this.dir, "_cas"),
       projectRoot: this.projectRoot
     }) : void 0;
     this.events = opts.events;
@@ -16011,6 +16418,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     this.logger = opts.logger;
     this.onAppend = opts.onAppend;
     this.onAppendBatch = opts.onAppendBatch;
+    const builtRuntime = import.meta.url.includes("/dist/");
+    this.catalogClient = this.projectRoot && (builtRuntime || process.env["WRONGSTACK_SESSION_CATALOG_FORCE"] === "1") && resolveSessionCatalogProjectServerUrl() ? new SessionCatalogProjectClient({
+      projectDir: path22.dirname(this.dir),
+      projectRoot: this.projectRoot
+    }) : void 0;
   }
   /**
    * Emit a structured warning. Uses the configured Logger when available;
@@ -16033,10 +16445,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
   clearLoadCache(sessionId) {
     this.loadCache.clear(sessionId);
   }
+  async dispose() {
+    await this.catalogClient?.close();
+    this.clearLoadCache();
+  }
   // ── Storage event helpers ───────────────────────────────────────────────────
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path20.join(this.dir, "_index.jsonl");
+    return path22.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
@@ -16094,8 +16510,23 @@ var DefaultSessionStore = class _DefaultSessionStore {
           if (!current) return null;
           return current.name === void 0 ? {} : { name: sessionContentText(this.secretScrubber.scrub(current.name)) };
         },
-        onClose: (s) => this.appendToIndex(s)
+        onClose: (s) => this.persistCatalogSummary(s)
       });
+      if (this.catalogClient) {
+        await this.catalogClient.call("upsert_summary", {
+          summary: {
+            id,
+            title: meta.title ?? "",
+            startedAt,
+            model: meta.model ?? "",
+            provider: meta.provider ?? "",
+            tokenTotal: 0,
+            lastActivityAt: startedAt
+          },
+          transcriptRelativePath: `${id}.jsonl`,
+          summaryRelativePath: `${id}.summary.json`
+        });
+      }
       emitSessionStoreWrite(this.events, id, file, "create", "success", Date.now() - t0);
       return writer;
     } catch (err) {
@@ -16125,6 +16556,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return materializeCheckpoint(this.checkpointCas, checkpoint, targetRoot);
   }
   async resolveId(query) {
+    if (this.catalogClient) {
+      return this.catalogClient.call("resolve_id", { query });
+    }
     const normalized = query.trim();
     if (!normalized) throw new Error("Session not found: (empty query)");
     if (normalized) {
@@ -16231,7 +16665,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path20.dirname(file),
+          dir: path22.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           checkpointCas: this.checkpointCas,
@@ -16242,7 +16676,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
             if (!current) return null;
             return current.name === void 0 ? {} : { name: sessionContentText(this.secretScrubber.scrub(current.name)) };
           },
-          onClose: (s) => this.appendToIndex(s)
+          onClose: (s) => this.persistCatalogSummary(s)
         }
       );
       emitSessionStoreWrite(this.events, canonicalId, file, "resume", "success", Date.now() - t0);
@@ -16355,6 +16789,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
     });
   }
   async list(limit = 20) {
+    if (this.catalogClient) {
+      const records = await this.catalogClient.call("list_catalog", { limit });
+      return this.scrubSummaries(records);
+    }
     try {
       const indexed = await this.readIndex();
       if (indexed.length > 0) {
@@ -16377,6 +16815,13 @@ var DefaultSessionStore = class _DefaultSessionStore {
    */
   async listFiltered(criteria) {
     const limit = criteria.limit ?? 100;
+    if (this.catalogClient) {
+      const records = await this.catalogClient.call("list_catalog", {
+        limit: Math.min(1e3, Math.max(limit, 100)),
+        ...criteria.titleContains ? { search: criteria.titleContains } : {}
+      });
+      return this.scrubSummaries(records).filter((summary) => matchesSessionFilter(summary, criteria)).slice(0, limit);
+    }
     try {
       const indexed = await this.readIndex();
       if (indexed.length === 0) {
@@ -16426,6 +16871,18 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await this.appendToIndexStrict(summary).catch(() => {
     });
   }
+  /** Final summary boundary: daemon is authoritative when available. */
+  async persistCatalogSummary(summary) {
+    if (!this.catalogClient) {
+      await this.appendToIndex(summary);
+      return;
+    }
+    await this.catalogClient.call("upsert_summary", {
+      summary,
+      transcriptRelativePath: `${summary.id}.jsonl`,
+      summaryRelativePath: `${summary.id}.summary.json`
+    });
+  }
   /** Append a tombstone entry for a deleted session. */
   async writeTombstone(id) {
     try {
@@ -16535,6 +16992,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * fresh _index.jsonl. Useful after manual cleanup or index corruption.
    */
   async rebuildIndex() {
+    if (this.catalogClient) {
+      const result = await this.catalogClient.call("rebuild_catalog", {}, { timeoutMs: 12e4 });
+      return result.indexed;
+    }
     const ids = await this.collectSessionIds(this.dir);
     const summaries = await Promise.all(
       ids.map((id) => this.summaryFor(id).catch(() => null))
@@ -16604,7 +17065,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     });
   }
   async collectSessionFilesInShard(shardKey) {
-    const dir = shardKey ? path20.join(this.dir, shardKey) : this.dir;
+    const dir = shardKey ? path22.join(this.dir, shardKey) : this.dir;
     const entries = await this.collectSessionFiles(dir, shardKey);
     return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
@@ -16700,10 +17161,35 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await this.writeTombstone(id);
   }
   async delete(id) {
+    if (this.catalogClient) {
+      const canonical = await this.resolveId(id);
+      const lease = await this.catalogClient.call("acquire_maintenance", {
+        sessionId: canonical,
+        operation: "delete",
+        holderId: this.maintenanceHolderId
+      });
+      try {
+        await this.catalogClient.call("delete", { sessionId: canonical, lease });
+      } catch (error2) {
+        await this.catalogClient.call("release_maintenance", { lease }).catch(() => void 0);
+        throw error2;
+      }
+      this.clearLoadCache(canonical);
+      return;
+    }
     await assertSessionCanBeDeleted(id, this.isSessionInUse);
     await this.deleteSession(id);
   }
   async rename(id, name) {
+    if (this.catalogClient) {
+      const canonical = await this.resolveId(id);
+      const summary = await this.catalogClient.call("rename", {
+        sessionId: canonical,
+        name: sessionContentText(this.secretScrubber.scrub(name))
+      });
+      this.clearLoadCache(canonical);
+      return summary;
+    }
     const trimmed = sessionContentText(this.secretScrubber.scrub(name));
     const manifest = this.sessionPath(id, ".summary.json");
     const jsonlPath = this.sessionPath(id, ".jsonl");
@@ -16755,6 +17241,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return updated;
   }
   async prune(maxAgeDays = 30) {
+    if (this.catalogClient) {
+      return this.catalogClient.call("prune", {
+        maxAgeDays,
+        holderId: this.maintenanceHolderId
+      });
+    }
     const deleted = await pruneSessionFiles(this.dir, maxAgeDays, (id) => this.deleteSession(id));
     if (deleted > 0) {
       await this.compactIndex().catch(() => void 0);
@@ -16762,20 +17254,81 @@ var DefaultSessionStore = class _DefaultSessionStore {
     return deleted;
   }
   async clearHistory(id) {
-    await this.ensureShardDir(id);
-    const file = this.sessionPath(id, ".jsonl");
-    const meta = this.sessionPath(id, ".summary.json");
+    const canonical = this.catalogClient ? await this.resolveId(id) : id;
+    const maintenance = this.catalogClient ? await this.catalogClient.call("acquire_maintenance", {
+      sessionId: canonical,
+      operation: "clear",
+      holderId: this.maintenanceHolderId
+    }) : void 0;
+    await this.ensureShardDir(canonical);
+    const file = this.sessionPath(canonical, ".jsonl");
+    const meta = this.sessionPath(canonical, ".summary.json");
+    const backupSuffix = maintenance ? `.${maintenance.leaseId}.clear-backup` : void 0;
+    const fileBackup = backupSuffix ? `${file}${backupSuffix}` : void 0;
+    const metaBackup = backupSuffix ? `${meta}${backupSuffix}` : void 0;
+    let fileStaged = false;
+    let metaStaged = false;
     const record = `${JSON.stringify({
       type: "session_start",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
-      id,
+      id: canonical,
       model: "unknown",
       provider: "unknown"
     })}
 `;
-    await atomicWrite(file, record);
-    await fsp17.unlink(meta).catch(() => void 0);
-    this.clearLoadCache(id);
+    try {
+      if (fileBackup) {
+        try {
+          await fsp17.rename(file, fileBackup);
+          fileStaged = true;
+        } catch (error2) {
+          if (error2.code !== "ENOENT") throw error2;
+        }
+      }
+      if (metaBackup) {
+        try {
+          await fsp17.rename(meta, metaBackup);
+          metaStaged = true;
+        } catch (error2) {
+          if (error2.code !== "ENOENT") throw error2;
+        }
+      }
+      await atomicWrite(file, record);
+      if (!metaBackup) await fsp17.unlink(meta).catch(() => void 0);
+      if (this.catalogClient) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        await this.catalogClient.call("upsert_summary", {
+          summary: {
+            id: canonical,
+            title: "",
+            startedAt: now,
+            model: "unknown",
+            provider: "unknown",
+            tokenTotal: 0,
+            lastActivityAt: now
+          },
+          transcriptRelativePath: `${canonical}.jsonl`,
+          summaryRelativePath: `${canonical}.summary.json`
+        });
+      }
+      if (fileStaged && fileBackup) await fsp17.unlink(fileBackup).catch(() => void 0);
+      if (metaStaged && metaBackup) await fsp17.unlink(metaBackup).catch(() => void 0);
+    } catch (error2) {
+      if (fileStaged && fileBackup) {
+        await fsp17.unlink(file).catch(() => void 0);
+        await fsp17.rename(fileBackup, file).catch(() => void 0);
+      }
+      if (metaStaged && metaBackup) {
+        await fsp17.unlink(meta).catch(() => void 0);
+        await fsp17.rename(metaBackup, meta).catch(() => void 0);
+      }
+      throw error2;
+    } finally {
+      if (maintenance && this.catalogClient) {
+        await this.catalogClient.call("release_maintenance", { lease: maintenance }).catch(() => void 0);
+      }
+    }
+    this.clearLoadCache(canonical);
   }
   async summarize(id, mtime) {
     return summarizeSessionFile({
@@ -16795,9 +17348,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path21.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path23.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path21.join(opts.sessionsRoot, runId);
+    dir = path23.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -16821,7 +17374,7 @@ function makeDirectorSessionFactory(opts) {
 }
 async function readDirectorSubagentSession(args) {
   if (!args.sessionsRoot) return null;
-  const filePath = path21.join(args.sessionsRoot, args.directorRunId, `${args.subagentId}.jsonl`);
+  const filePath = path23.join(args.sessionsRoot, args.directorRunId, `${args.subagentId}.jsonl`);
   let raw;
   try {
     raw = await fsp18.readFile(filePath, "utf8");
@@ -17393,7 +17946,7 @@ function formatRole(role) {
 }
 
 // src/coordination/fleet-spawn.ts
-async function spawn2(host, config, priceLookup) {
+async function spawn3(host, config, priceLookup) {
   if (host.workCompleteFlag) {
     throw new FleetSpawnBudgetError(
       "max_spawns",
@@ -17677,7 +18230,7 @@ function hashStr(s) {
 }
 
 // src/coordination/multi-agent-coordinator.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import { EventEmitter as EventEmitter2 } from "node:events";
 
 // src/coordination/coordinator/error-classifier.ts
@@ -17816,12 +18369,12 @@ async function executeSubagentWithTimeout({
           }
           return new Promise((resolveDecision) => {
             let settled = false;
-            const resolve19 = (d) => {
+            const resolve21 = (d) => {
               if (settled) return;
               settled = true;
               resolveDecision(d);
             };
-            const fallback = setTimeout(() => resolve19("stop"), DECISION_TIMEOUT_MS);
+            const fallback = setTimeout(() => resolve21("stop"), DECISION_TIMEOUT_MS);
             const sessionId = currentSessionId();
             budget._events?.emit("budget.threshold_reached", {
               ...sessionId ? { sessionId } : {},
@@ -17831,11 +18384,11 @@ async function executeSubagentWithTimeout({
               timeoutMs: DECISION_TIMEOUT_MS,
               extend: (extra) => {
                 clearTimeout(fallback);
-                queueMicrotask(() => resolve19({ extend: extra }));
+                queueMicrotask(() => resolve21({ extend: extra }));
               },
               deny: () => {
                 clearTimeout(fallback);
-                resolve19("stop");
+                resolve21("stop");
               }
             });
           });
@@ -18047,7 +18600,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     return { ...subagent, name: display };
   }
   async spawn(subagent) {
-    const id = subagent.id || randomUUID10();
+    const id = subagent.id || randomUUID11();
     const cfg = this.withNickname(subagent, id);
     if (this.subagents.has(id)) {
       throw new Error(`Subagent id "${id}" already exists \u2014 refusing to overwrite`);
@@ -18222,7 +18775,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve19, reject) => {
+        return new Promise((resolve21, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -18231,7 +18784,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve19(result);
+              resolve21(result);
             }
           };
           this.on("task.completed", handler);
@@ -18256,13 +18809,13 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       const done = new Set(completed.map((r) => r.taskId));
       return { completed, pending: taskIds.filter((id) => !done.has(id)) };
     }
-    return new Promise((resolve19) => {
+    return new Promise((resolve21) => {
       let timer;
       const handler = ({ result }) => {
         if (!ids.has(result.taskId)) return;
         if (timer) clearTimeout(timer);
         this.off("task.completed", handler);
-        resolve19({
+        resolve21({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         });
@@ -18270,7 +18823,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       if (opts?.timeoutMs !== void 0) {
         timer = setTimeout(() => {
           this.off("task.completed", handler);
-          resolve19({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve21({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.on("task.completed", handler);
@@ -18932,7 +19485,7 @@ var Director = class _Director {
   sessionProvider;
   sessionModel;
   constructor(opts) {
-    this.id = opts.config.coordinatorId || randomUUID11();
+    this.id = opts.config.coordinatorId || randomUUID12();
     this.manifestPath = opts.manifestPath;
     this.roster = opts.roster;
     this.directorPreamble = opts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
@@ -19194,7 +19747,7 @@ var Director = class _Director {
     }
     const config = { ...callerConfig };
     this.resolveSpawnModel(config);
-    const subagentId = await spawn2(this, config, priceLookup);
+    const subagentId = await spawn3(this, config, priceLookup);
     const perSubagentIdleMs = typeof config.idleTimeoutMs === "number" && Number.isFinite(config.idleTimeoutMs) && config.idleTimeoutMs >= 0 ? config.idleTimeoutMs : this.subagentIdleTimeoutMs;
     this.armSubagentIdleRetirement(subagentId, perSubagentIdleMs);
     return subagentId;
@@ -19215,7 +19768,7 @@ var Director = class _Director {
       );
     }
     const msg = {
-      id: randomUUID11(),
+      id: randomUUID12(),
       type: "task",
       from: this.id,
       to: subagentId,
@@ -21135,7 +21688,7 @@ function resolveContextWindowPolicy(config = {}, overrideMode) {
 
 // src/infrastructure/logger.ts
 import * as fsp20 from "node:fs/promises";
-import * as path22 from "node:path";
+import * as path24 from "node:path";
 var LEVEL_RANK2 = {
   error: 0,
   warn: 1,
@@ -21206,7 +21759,7 @@ var DefaultLogger = class _DefaultLogger {
     this.stderr = opts.stderr !== false;
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
-      const dir = path22.dirname(this.file);
+      const dir = path24.dirname(this.file);
       this._tail = this._tail.then(async () => {
         await fsp20.mkdir(dir, { recursive: true });
       }).catch(() => void 0);
@@ -21964,10 +22517,10 @@ var KNOWN_TOKEN_GROUPS = {
 var KNOWN_TOKEN_NAMES = Object.values(KNOWN_TOKEN_GROUPS).flat();
 
 // src/execution/design-kit-loader.ts
-import { existsSync as existsSync3 } from "node:fs";
-import * as fs3 from "node:fs/promises";
-import * as path23 from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { existsSync as existsSync4 } from "node:fs";
+import * as fs4 from "node:fs/promises";
+import * as path25 from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 var KIT_FILE = "KIT.md";
 var TOKENS_FILE = "tokens.json";
 var FOUNDATIONS_ID = "_foundations";
@@ -22066,15 +22619,15 @@ var DefaultDesignKitLoader = class {
     for (const { dir, source } of this.dirs) {
       let entries;
       try {
-        entries = await fs3.readdir(dir, { withFileTypes: true });
+        entries = await fs4.readdir(dir, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const e of entries) {
         if (!e.isDirectory()) continue;
-        const kitFile = path23.join(dir, e.name, KIT_FILE);
+        const kitFile = path25.join(dir, e.name, KIT_FILE);
         try {
-          const raw = await fs3.readFile(kitFile, "utf8");
+          const raw = await fs4.readFile(kitFile, "utf8");
           const fm = parseKitFrontmatter(raw);
           const id = fm.id ?? e.name;
           if (!fm.name) continue;
@@ -22135,7 +22688,7 @@ var DefaultDesignKitLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(id);
     if (!m) throw new Error(`Design kit "${id}" not found`);
-    const raw = await fs3.readFile(m.path, "utf8");
+    const raw = await fs4.readFile(m.path, "utf8");
     const body = narrowStackSections(stripFrontmatter(raw), stack);
     this.bodyCache.set(key, body);
     return body;
@@ -22147,9 +22700,9 @@ var DefaultDesignKitLoader = class {
     const m = await this.find(id);
     let tokens;
     if (m) {
-      const tokensPath = path23.join(path23.dirname(m.path), TOKENS_FILE);
+      const tokensPath = path25.join(path25.dirname(m.path), TOKENS_FILE);
       try {
-        const raw = await fs3.readFile(tokensPath, "utf8");
+        const raw = await fs4.readFile(tokensPath, "utf8");
         tokens = JSON.parse(raw);
       } catch {
         tokens = void 0;
@@ -22209,15 +22762,15 @@ function mergeKitTokens(base, own) {
 }
 function resolveBundledDesignKitsDir() {
   try {
-    const here = path23.dirname(fileURLToPath3(import.meta.url));
+    const here = path25.dirname(fileURLToPath4(import.meta.url));
     const candidates = [
-      path23.join(here, "design-kits"),
-      path23.join(here, "..", "design-kits"),
-      path23.join(here, "..", "..", "design-kits"),
-      path23.join(here, "..", "..", "..", "design-kits")
+      path25.join(here, "design-kits"),
+      path25.join(here, "..", "design-kits"),
+      path25.join(here, "..", "..", "design-kits"),
+      path25.join(here, "..", "..", "..", "design-kits")
     ];
     for (const c of candidates) {
-      if (existsSync3(c)) return c;
+      if (existsSync4(c)) return c;
     }
   } catch {
   }
@@ -22251,12 +22804,12 @@ function _resetDesignKitLoaderMemo() {
 }
 
 // src/execution/design-project-store.ts
-import { existsSync as existsSync4 } from "node:fs";
-import * as fs4 from "node:fs/promises";
-import * as path24 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import * as fs5 from "node:fs/promises";
+import * as path26 from "node:path";
 var DESIGN_DIR = ".design";
 function designProjectDir(projectRoot) {
-  return path24.join(projectRoot, DESIGN_DIR);
+  return path26.join(projectRoot, DESIGN_DIR);
 }
 var RULE_FILES = ["rules.md", "RULES.md", "design.md"];
 var rulesCache = /* @__PURE__ */ new Map();
@@ -22271,7 +22824,7 @@ async function loadProjectDesignRules(projectRoot) {
   let rules;
   for (const name of RULE_FILES) {
     try {
-      const txt = await fs4.readFile(path24.join(designProjectDir(projectRoot), name), "utf8");
+      const txt = await fs5.readFile(path26.join(designProjectDir(projectRoot), name), "utf8");
       if (txt.trim()) {
         rules = txt.trim();
         break;
@@ -22297,7 +22850,7 @@ function parseOverrides(value) {
 }
 async function loadActiveKit(projectRoot) {
   try {
-    const raw = await fs4.readFile(path24.join(designProjectDir(projectRoot), "active.json"), "utf8");
+    const raw = await fs5.readFile(path26.join(designProjectDir(projectRoot), "active.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed.kit === "string") {
       return {
@@ -22330,11 +22883,11 @@ function applyTokenOverrides(tokens, overrides) {
 }
 async function ensureDesignDir(projectRoot) {
   const dir = designProjectDir(projectRoot);
-  await fs4.mkdir(dir, { recursive: true });
-  const gi = path24.join(dir, ".gitignore");
-  if (!existsSync4(gi)) {
+  await fs5.mkdir(dir, { recursive: true });
+  const gi = path26.join(dir, ".gitignore");
+  if (!existsSync5(gi)) {
     try {
-      await fs4.writeFile(gi, "*\n");
+      await fs5.writeFile(gi, "*\n");
     } catch {
     }
   }
@@ -22345,11 +22898,11 @@ async function recordKitChoice(projectRoot, kit, stack, source, isoTime, overrid
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit, stack: stack ?? null };
     if (overrides && Object.keys(overrides).length > 0) record.overrides = overrides;
-    await fs4.writeFile(path24.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs5.writeFile(path26.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const line = `- ${isoTime} \xB7 kit=${kit}${stack ? ` stack=${stack}` : ""} \xB7 via=${source}
 `;
-    await fs4.appendFile(path24.join(dir, "decisions.md"), line);
+    await fs5.appendFile(path26.join(dir, "decisions.md"), line);
   } catch {
   }
 }
@@ -22365,11 +22918,11 @@ async function recordOverrides(projectRoot, patch, isoTime) {
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit: active.kit, stack: active.stack ?? null };
     if (Object.keys(merged).length > 0) record.overrides = merged;
-    await fs4.writeFile(path24.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs5.writeFile(path26.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const keys = Object.keys(patch).join(",");
-    await fs4.appendFile(
-      path24.join(dir, "decisions.md"),
+    await fs5.appendFile(
+      path26.join(dir, "decisions.md"),
       `- ${isoTime} \xB7 kit=${active.kit} \xB7 override=${keys} \xB7 via=set
 `
     );
@@ -22379,7 +22932,7 @@ async function recordOverrides(projectRoot, patch, isoTime) {
 }
 async function clearPersistedActiveKit(projectRoot) {
   try {
-    await fs4.rm(path24.join(designProjectDir(projectRoot), "active.json"), { force: true });
+    await fs5.rm(path26.join(designProjectDir(projectRoot), "active.json"), { force: true });
   } catch {
   }
 }
@@ -22519,12 +23072,12 @@ function verifyFiles(tokens, files) {
   const violations = [];
   let onPalette = 0;
   let offPalette = 0;
-  for (const { path: path42, text } of files) {
+  for (const { path: path44, text } of files) {
     const lines = text.split("\n");
     lines.forEach((lineText, i) => {
       const lineNo = i + 1;
       const flag = (snippet, reason, axis = "color") => {
-        violations.push({ file: path42, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
+        violations.push({ file: path44, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
       };
       for (const re of [HEX_RE, FUNC_COLOR_RE]) {
         re.lastIndex = 0;
@@ -22591,14 +23144,14 @@ var SKIP_DIR = /* @__PURE__ */ new Set([
   ".design"
 ]);
 async function walkUiFiles(root, max = 200) {
-  const { default: fs15 } = await import("node:fs/promises");
+  const { default: fs16 } = await import("node:fs/promises");
   const { default: nodePath } = await import("node:path");
   const found = [];
   async function rec(dir, depth) {
     if (found.length >= max || depth > 8) return;
     let entries;
     try {
-      entries = await fs15.readdir(dir, { withFileTypes: true });
+      entries = await fs16.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -22616,13 +23169,13 @@ async function walkUiFiles(root, max = 200) {
   return found;
 }
 async function runDesignVerify(projectRoot, tokens, explicitFiles) {
-  const { default: fs15 } = await import("node:fs/promises");
+  const { default: fs16 } = await import("node:fs/promises");
   const { default: nodePath } = await import("node:path");
   const abs = explicitFiles && explicitFiles.length > 0 ? explicitFiles.map((f) => nodePath.isAbsolute(f) ? f : nodePath.join(projectRoot, f)) : await walkUiFiles(projectRoot);
   const files = [];
   for (const a of abs) {
     try {
-      files.push({ path: nodePath.relative(projectRoot, a), text: await fs15.readFile(a, "utf8") });
+      files.push({ path: nodePath.relative(projectRoot, a), text: await fs16.readFile(a, "utf8") });
     } catch {
     }
   }
@@ -22753,10 +23306,10 @@ function makeDesignVerifyToolCallMiddleware() {
         const p = typeof input?.path === "string" ? input.path : "";
         if (!p || !detectFrontendFile(p)) return out;
         const ctx = out.ctx;
-        const { default: fs15 } = await import("node:fs/promises");
+        const { default: fs16 } = await import("node:fs/promises");
         const { default: nodePath } = await import("node:path");
         const abs = nodePath.isAbsolute(p) ? p : nodePath.join(ctx.projectRoot, p);
-        const text = await fs15.readFile(abs, "utf8").catch(() => "");
+        const text = await fs16.readFile(abs, "utf8").catch(() => "");
         if (!text) return out;
         const loader = getDesignKitLoader(ctx.projectRoot);
         const rawTokens = await loader.readTokens(state.activeKit);
@@ -23205,11 +23758,11 @@ function buildRecoveryStrategies(opts) {
       async attempt(err, ctx) {
         if (!(err instanceof ProviderError) || err.kind !== "rate_limit") return null;
         const delayMs = err.body?.retryAfterMs ?? 5e3;
-        const delay = Math.min(6e4, Math.max(1e3, delayMs));
+        const delay2 = Math.min(6e4, Math.max(1e3, delayMs));
         if (ctx?.signal) {
-          await new Promise((resolve19) => {
+          await new Promise((resolve21) => {
             if (ctx.signal.aborted) {
-              resolve19();
+              resolve21();
               return;
             }
             let settled = false;
@@ -23220,13 +23773,13 @@ function buildRecoveryStrategies(opts) {
               settled = true;
               if (timer !== void 0) clearTimeout(timer);
               ctx.signal.removeEventListener("abort", onAbort);
-              resolve19();
+              resolve21();
             };
-            timer = setTimeout(finish, delay);
+            timer = setTimeout(finish, delay2);
             ctx.signal.addEventListener("abort", onAbort, { once: true });
           });
         } else {
-          await new Promise((r) => setTimeout(r, delay));
+          await new Promise((r) => setTimeout(r, delay2));
         }
         return { action: "retry", reason: "rate_limit_backoff" };
       }
@@ -23856,10 +24409,10 @@ var EternalAutonomyEngine = class {
     if (status === "failure") {
       if (isTransientFailure) {
         this.consecutiveTransientRetries++;
-        const delay = this.computeTransientBackoffMs();
-        if (delay > 0) {
-          emit2({ phase: "sleep", ms: delay });
-          await this.sleepInterruptible(delay);
+        const delay2 = this.computeTransientBackoffMs();
+        if (delay2 > 0) {
+          emit2({ phase: "sleep", ms: delay2 });
+          await this.sleepInterruptible(delay2);
         }
         return false;
       }
@@ -24361,7 +24914,7 @@ function buildGoalPreamble(goal, deliverables) {
 }
 
 // src/execution/compaction-summary-cache.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 
 // src/utils/lru-cache.ts
 var LruCache = class {
@@ -24499,7 +25052,7 @@ function semanticBlock(block) {
   }
 }
 function compactionSummaryKey(model, prompt, messages) {
-  const hash2 = createHash5("sha256");
+  const hash2 = createHash6("sha256");
   hash2.update("wrongstack-compaction-summary-v2\0").update(model).update("\0").update(prompt);
   for (const message of messages) {
     hash2.update("\0").update(message.role).update("\0");
@@ -24713,7 +25266,7 @@ ${summaryText}` : summaryText;
 };
 
 // src/execution/parallel-eternal-engine.ts
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { randomUUID as randomUUID13 } from "node:crypto";
 var GOAL_COMPLETE_MARKER2 = /^\s*\[goal[_\s-]?complete\]\s*$/im;
 var ParallelEternalEngine = class {
   constructor(opts) {
@@ -24790,7 +25343,7 @@ var ParallelEternalEngine = class {
     this.state = "running";
     await this.persistState("running");
     const config = {
-      coordinatorId: `parallel-${randomUUID12().slice(0, 8)}`,
+      coordinatorId: `parallel-${randomUUID13().slice(0, 8)}`,
       maxConcurrent: this.slots,
       doneCondition: { type: "all_tasks_done" }
     };
@@ -24844,7 +25397,7 @@ var ParallelEternalEngine = class {
     }
     if (!this.coordinator) {
       const config = {
-        coordinatorId: `parallel-${randomUUID12().slice(0, 8)}`,
+        coordinatorId: `parallel-${randomUUID13().slice(0, 8)}`,
         maxConcurrent: this.slots,
         doneCondition: { type: "all_tasks_done" }
       };
@@ -24930,7 +25483,7 @@ ${recentJournal}` : "No prior iterations.",
       const task = expectDefined(tasks[i]);
       const route = routes[i] ?? null;
       const subagentId = `parallel-${this.iterations}-${i}`;
-      const taskId = randomUUID12();
+      const taskId = randomUUID13();
       const personaLine = route ? `Acting agent: ${route.definition.config.name} \u2014 ${route.definition.capability.summary}
 ` : "";
       const spec = {
@@ -25145,7 +25698,7 @@ ${lastFew}` : "No prior iterations.",
 };
 
 // src/core/streaming-response-builder.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 var STREAM_DRAIN_TIMEOUT_MS = 500;
 function buildResponse(state) {
   const content = [];
@@ -25205,7 +25758,7 @@ function handleContentBlockStart(state, ev) {
     state.textBuffers.push("");
     state.blockOrder.push({ kind: "text", idx: state.currentTextIndex });
   } else if (kind === "tool_use") {
-    const id = ev.id ?? randomUUID13();
+    const id = ev.id ?? randomUUID14();
     state.tools.set(id, { name: ev.name ?? "unknown", partial: "" });
     state.blockOrder.push({ kind: "tool", id });
     state.currentTextIndex = -1;
@@ -25414,8 +25967,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve19) => {
-            drainTimer = setTimeout(resolve19, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve21) => {
+            drainTimer = setTimeout(resolve21, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -25439,7 +25992,7 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
 }
 
 // src/chronicle/prompt-manifest.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 function createChroniclePromptManifest(request) {
   const roleCounts = {}, blockCounts = {};
   const messages = request.messages.map((message, index) => messageSummary(message, index, roleCounts, blockCounts));
@@ -25526,11 +26079,11 @@ function countBlocks(blocks) {
   return counts;
 }
 function hash(value) {
-  return createHash6("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 function contentIdentity(content) {
   if (typeof content === "string") return { hash: hash(content), bytes: Buffer.byteLength(content) };
-  const digest = createHash6("sha256");
+  const digest = createHash7("sha256");
   let bytes = 0;
   const add = (value) => {
     if (!value) return;
@@ -25612,7 +26165,7 @@ function replaceAllCaseInsensitive(haystack, needle, replacement) {
 }
 
 // src/core/provider-runner.ts
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 function scrubProviderBody(body) {
   if (!body) return void 0;
   return {
@@ -25634,11 +26187,11 @@ function providerLogCtx(p, r) {
 }
 async function runProviderWithRetry(opts) {
   const { provider, request, signal, ctx, events, retry, logger, tracer } = opts;
-  const logicalRequestId = randomUUID14();
+  const logicalRequestId = randomUUID15();
   const promptManifest = createChroniclePromptManifest(request);
   let attempt = 0;
   for (; ; ) {
-    const attemptId = randomUUID14();
+    const attemptId = randomUUID15();
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const startedNs = process.hrtime.bigint();
     const correlation = {
@@ -25711,7 +26264,7 @@ async function runProviderWithRetry(opts) {
       const description = scrubErrorText(
         isProviderErr ? err.describe() : errAsErr.message
       );
-      const delay = canRetry ? Math.round(retry.delayMs(attempt, isProviderErr ? err : errAsErr)) : void 0;
+      const delay2 = canRetry ? Math.round(retry.delayMs(attempt, isProviderErr ? err : errAsErr)) : void 0;
       events.emit("provider.attempt.failed", {
         ...correlation,
         startedAt,
@@ -25722,7 +26275,7 @@ async function runProviderWithRetry(opts) {
         description,
         retryable: canRetry,
         retryScheduled: canRetry,
-        ...delay !== void 0 ? { retryDelayMs: delay } : {},
+        ...delay2 !== void 0 ? { retryDelayMs: delay2 } : {},
         ...providerErrorBody?.requestId ? { providerRequestId: providerErrorBody.requestId } : {},
         ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
@@ -25748,11 +26301,11 @@ async function runProviderWithRetry(opts) {
       }
       const attemptNum = attempt + 1;
       const maxAttempts = retry.maxAttempts(isProviderErr ? err : errAsErr);
-      logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay}ms \u2014 ${description}`, {
+      logger.warn(`Provider retry ${attemptNum}/${maxAttempts} in ${delay2}ms \u2014 ${description}`, {
         ...providerLogCtx(provider, request),
         attempt: attemptNum,
         maxAttempts,
-        delayMs: delay,
+        delayMs: delay2,
         errorDescription: description,
         status: isProviderErr ? err.status : void 0,
         errorBody: providerErrorBody
@@ -25761,12 +26314,12 @@ async function runProviderWithRetry(opts) {
         sessionId: resolveEventSessionId(ctx),
         providerId: isProviderErr ? err.providerId : provider.id,
         attempt: attemptNum,
-        delayMs: delay,
+        delayMs: delay2,
         status: isProviderErr ? err.status : 0,
         description,
         ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
-      await new Promise((resolve19, reject) => {
+      await new Promise((resolve21, reject) => {
         let settled = false;
         const cleanup = () => {
           clearTimeout(t);
@@ -25782,8 +26335,8 @@ async function runProviderWithRetry(opts) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve19();
-        }, delay);
+          resolve21();
+        }, delay2);
         if (signal.aborted) {
           onAbort();
           return;
@@ -26406,8 +26959,8 @@ Summarize the following message range:`;
 };
 
 // src/execution/skill-loader.ts
-import * as fs5 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as fs6 from "node:fs/promises";
+import * as path27 from "node:path";
 
 // src/skills/foreign-sources.ts
 var FOREIGN_SKILL_TOOLS = [
@@ -26471,7 +27024,7 @@ async function entryIsDirectory(dir, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return (await fs5.stat(path25.join(dir, entry.name))).isDirectory();
+      return (await fs6.stat(path27.join(dir, entry.name))).isDirectory();
     } catch {
       return false;
     }
@@ -26495,7 +27048,7 @@ var DefaultSkillLoader = class {
       for (const tool of FOREIGN_SKILL_TOOLS) {
         if (!foreignIds.includes(tool.id)) continue;
         dirs.push({
-          dir: path25.join(root, "." + tool.id, tool.subdir),
+          dir: path27.join(root, "." + tool.id, tool.subdir),
           source: "foreign",
           originTool: tool.id
         });
@@ -26520,15 +27073,15 @@ var DefaultSkillLoader = class {
     this.shadowed = [];
     for (const { dir, source, originTool } of this.dirs) {
       try {
-        const entries = (await fs5.readdir(dir, { withFileTypes: true })).sort(
+        const entries = (await fs6.readdir(dir, { withFileTypes: true })).sort(
           (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
-          const skillFile = path25.join(dir, e.name, "SKILL.md");
+          const skillFile = path27.join(dir, e.name, "SKILL.md");
           let raw;
           try {
-            raw = await fs5.readFile(skillFile, "utf8");
+            raw = await fs6.readFile(skillFile, "utf8");
           } catch {
             continue;
           }
@@ -26647,7 +27200,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const body = await fs5.readFile(m.path, "utf8");
+    const body = await fs6.readFile(m.path, "utf8");
     this.bodyCache.set(key, body);
     return body;
   }
@@ -26657,12 +27210,12 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path25.join(path25.dirname(m.path), "SKILL.save.md");
+    const savePath = path27.join(path27.dirname(m.path), "SKILL.save.md");
     let result;
     try {
-      result = await fs5.readFile(savePath, "utf8");
+      result = await fs6.readFile(savePath, "utf8");
     } catch {
-      const full = await fs5.readFile(m.path, "utf8");
+      const full = await fs6.readFile(m.path, "utf8");
       const body = stripFrontmatter(full);
       const compact = compactSkillBody(body);
       if (compact) {
@@ -26690,12 +27243,12 @@ function parseDescriptionFromText(desc) {
 }
 
 // src/execution/prompt-loader.ts
-import * as fs7 from "node:fs/promises";
-import * as path27 from "node:path";
+import * as fs8 from "node:fs/promises";
+import * as path29 from "node:path";
 
 // src/storage/prompt-store.ts
-import * as fs6 from "node:fs/promises";
-import * as path26 from "node:path";
+import * as fs7 from "node:fs/promises";
+import * as path28 from "node:path";
 var SCHEMA_VERSION = 2;
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -26756,12 +27309,12 @@ var DefaultPromptStore = class {
     await ensureDir(this.dir);
     const entries = [];
     try {
-      const files = await fs6.readdir(this.dir);
+      const files = await fs7.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fs6.readFile(path26.join(this.dir, file), "utf8")
+            await fs7.readFile(path28.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -26775,9 +27328,9 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path26.join(this.dir, `${id}.json`);
+    const file = path28.join(this.dir, `${id}.json`);
     try {
-      const raw = JSON.parse(await fs6.readFile(file, "utf8"));
+      const raw = JSON.parse(await fs7.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
     } catch {
       return null;
@@ -26785,14 +27338,14 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path26.join(this.dir, `${entry.id}.json`);
+    const file = path28.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path26.join(this.dir, `${id}.json`);
+    const file = path28.join(this.dir, `${id}.json`);
     try {
-      await fs6.unlink(file);
+      await fs7.unlink(file);
       return true;
     } catch {
       return false;
@@ -26879,7 +27432,7 @@ var DefaultPromptLoader = class {
   constructor(opts) {
     this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
     this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
-    this.builtinDir = opts.bundledDir ? path27.join(opts.bundledDir, "prompts") : void 0;
+    this.builtinDir = opts.bundledDir ? path29.join(opts.bundledDir, "prompts") : void 0;
   }
   async list() {
     if (this.cache) return this.cache;
@@ -26992,7 +27545,7 @@ var DefaultPromptLoader = class {
     const files = await walkJson(dir);
     for (const file of files) {
       try {
-        const parsed = JSON.parse(await fs7.readFile(file, "utf8"));
+        const parsed = JSON.parse(await fs8.readFile(file, "utf8"));
         const migrated = migratePromptEntry(parsed);
         if (migrated) out.push({ ...migrated, source: "builtin" });
       } catch {
@@ -27006,12 +27559,12 @@ async function walkJson(dir) {
   const out = [];
   let entries;
   try {
-    entries = await fs7.readdir(dir, { withFileTypes: true });
+    entries = await fs8.readdir(dir, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const e of entries) {
-    const full = path27.join(dir, e.name);
+    const full = path29.join(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkJson(full));
     } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
@@ -27198,9 +27751,9 @@ function readPolicy(ctx) {
 }
 
 // src/execution/tool-executor.ts
-import { randomUUID as randomUUID16 } from "node:crypto";
-import * as fs9 from "node:fs/promises";
-import * as path30 from "node:path";
+import { randomUUID as randomUUID17 } from "node:crypto";
+import * as fs10 from "node:fs/promises";
+import * as path32 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // src/observability/process-telemetry.ts
@@ -27212,7 +27765,7 @@ function runWithProcessTelemetry(context, run) {
 
 // src/security/kanban-boundary.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path30 from "node:path";
 import {
   evaluateKanbanBoundaryOpaque,
   evaluateKanbanBoundaryPath,
@@ -27301,10 +27854,10 @@ function resolveKanbanIdentity(ctx) {
 async function extractCandidatePaths(toolName, input, ctx) {
   if (toolName === "patch" && typeof input["patch"] === "string") {
     const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
-    const directory = path28.isAbsolute(directoryInput) ? directoryInput : path28.resolve(ctx.workingDir, directoryInput);
+    const directory = path30.isAbsolute(directoryInput) ? directoryInput : path30.resolve(ctx.workingDir, directoryInput);
     const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
     const targets = extractPatchTargets(input["patch"], strip).map(
-      (target) => relativeToProject(path28.resolve(directory, target), ctx.projectRoot)
+      (target) => relativeToProject(path30.resolve(directory, target), ctx.projectRoot)
     );
     return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
   }
@@ -27314,7 +27867,7 @@ async function extractCandidatePaths(toolName, input, ctx) {
   collectPathValues(input, values, pathKeys);
   if (toolName === "scaffold" && typeof input["name"] === "string") {
     const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
-    values.push(path28.join(cwd, input["name"]));
+    values.push(path30.join(cwd, input["name"]));
   }
   const candidates = [
     ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
@@ -27322,21 +27875,21 @@ async function extractCandidatePaths(toolName, input, ctx) {
   return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
 }
 async function canonicalizeCandidatePath(candidate, ctx) {
-  if (path28.isAbsolute(candidate)) return candidate;
-  const absolute = path28.resolve(ctx.projectRoot, candidate);
+  if (path30.isAbsolute(candidate)) return candidate;
+  const absolute = path30.resolve(ctx.projectRoot, candidate);
   const canonicalRoot = await realpath3(ctx.projectRoot).catch(() => ctx.projectRoot);
   let probe = absolute;
   const missingSegments = [];
   while (true) {
     try {
-      const canonical = path28.join(await realpath3(probe), ...missingSegments);
+      const canonical = path30.join(await realpath3(probe), ...missingSegments);
       return relativeToProject(canonical, canonicalRoot);
     } catch (cause) {
       const code = cause.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
-      const parent = path28.dirname(probe);
+      const parent = path30.dirname(probe);
       if (parent === probe) return absolute;
-      missingSegments.unshift(path28.basename(probe));
+      missingSegments.unshift(path30.basename(probe));
       probe = parent;
     }
   }
@@ -27359,12 +27912,12 @@ function splitPathList(value) {
   return value.split(",").map((item) => item.trim()).filter(Boolean);
 }
 function resolveInputPath(value, ctx) {
-  const absolute = path28.isAbsolute(value) ? value : path28.resolve(ctx.workingDir, value);
+  const absolute = path30.isAbsolute(value) ? value : path30.resolve(ctx.workingDir, value);
   return relativeToProject(absolute, ctx.projectRoot);
 }
 function relativeToProject(absolute, projectRoot) {
-  const relative8 = path28.relative(projectRoot, absolute).replace(/\\/g, "/");
-  return relative8.startsWith("../") || path28.isAbsolute(relative8) ? absolute : relative8 || ".";
+  const relative8 = path30.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative8.startsWith("../") || path30.isAbsolute(relative8) ? absolute : relative8 || ".";
 }
 function extractPatchTargets(patchText, strip) {
   const targets = [];
@@ -27387,9 +27940,9 @@ function numericValue(value) {
 var GOVERNED_TOOL_EXECUTOR_META_KEY = "toolExecutor.executeGoverned";
 
 // src/execution/tool-executor-support.ts
-import { createHash as createHash7, randomUUID as randomUUID15 } from "node:crypto";
-import * as fs8 from "node:fs/promises";
-import * as path29 from "node:path";
+import { createHash as createHash8, randomUUID as randomUUID16 } from "node:crypto";
+import * as fs9 from "node:fs/promises";
+import * as path31 from "node:path";
 
 // src/types/tool-markers.ts
 var MALFORMED_ARG_MARKERS = ["__raw", "__raw_arguments", "_raw"];
@@ -27514,12 +28067,12 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
     return content;
   }
   try {
-    const dir = path29.join(wstackGlobalRoot(), "tool-output");
-    await fs8.mkdir(dir, { recursive: true });
+    const dir = path31.join(wstackGlobalRoot(), "tool-output");
+    await fs9.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = path29.join(dir, `${stamp}-${safeTool}-${randomUUID15()}.log`);
-    await fs8.writeFile(filePath, content, "utf8");
+    const filePath = path31.join(dir, `${stamp}-${safeTool}-${randomUUID16()}.log`);
+    await fs9.writeFile(filePath, content, "utf8");
     const marker = `[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
     const fixedBytes = Buffer.byteLength(marker + TOOL_OUTPUT_ARTIFACT_OMISSION, "utf8");
     const previewBytes = Math.min(
@@ -27544,7 +28097,7 @@ function hashPermissionInput(input, scrubber2) {
   } catch {
     serialized = String(input);
   }
-  return createHash7("sha256").update(scrubber2.scrub(serialized), "utf8").digest("hex");
+  return createHash8("sha256").update(scrubber2.scrub(serialized), "utf8").digest("hex");
 }
 function sliceUtf8Prefix(text, maxBytes) {
   if (maxBytes <= 0) return "";
@@ -28059,18 +28612,18 @@ ${errorDetails}`,
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
-            (resolve19, reject) => {
+            (resolve21, reject) => {
               const signal = ctx.signal;
-              const onAbort = () => resolve19("abort");
+              const onAbort = () => resolve21("abort");
               if (signal.aborted) {
-                resolve19("abort");
+                resolve21("abort");
                 return;
               }
               signal.addEventListener("abort", onAbort, { once: true });
               awaiter(tool, use.input, use.id, suggestedPattern).then(
                 (c) => {
                   signal.removeEventListener("abort", onAbort);
-                  resolve19(c);
+                  resolve21(c);
                 },
                 (e) => {
                   signal.removeEventListener("abort", onAbort);
@@ -28116,10 +28669,10 @@ ${errorDetails}`,
         const inputPath = use.input && typeof use.input === "object" ? use.input.path : void 0;
         const caps = tool.capabilities ?? [];
         const hasFileCapability = caps.includes("fs.read") || caps.includes("fs.write");
-        const absPath = hasFileCapability && typeof inputPath === "string" ? path30.isAbsolute(inputPath) ? inputPath : path30.resolve(ctx.projectRoot, inputPath) : void 0;
+        const absPath = hasFileCapability && typeof inputPath === "string" ? path32.isAbsolute(inputPath) ? inputPath : path32.resolve(ctx.projectRoot, inputPath) : void 0;
         let writeTargetExisted;
         if (tool.name === "write" && caps.includes("fs.write") && absPath) {
-          writeTargetExisted = await fs9.stat(absPath).then(
+          writeTargetExisted = await fs10.stat(absPath).then(
             (stat15) => stat15.isFile(),
             (error2) => error2.code === "ENOENT" ? false : void 0
           );
@@ -28281,7 +28834,7 @@ ${post.additionalContext}`;
     const bridge = async (toolName, input) => {
       const nestedUse = {
         type: "tool_use",
-        id: `nested-${randomUUID16()}`,
+        id: `nested-${randomUUID17()}`,
         name: toolName,
         input
       };
@@ -28404,7 +28957,7 @@ ${preToolContext.text}` : preToolContext.text;
     ]);
     let output;
     const execute = () => typeof tool.executeStream === "function" ? this.runStreamedTool(tool, input, ctx, combined, toolUseId) : (async () => tool.execute(input, ctx, { signal: combined }))();
-    const telemetryToolCallId = toolUseId ?? `nested-${randomUUID16()}`;
+    const telemetryToolCallId = toolUseId ?? `nested-${randomUUID17()}`;
     const toolPromise = this.opts.events ? runWithNetworkTelemetry(
       {
         events: this.opts.events,
@@ -28430,7 +28983,7 @@ ${preToolContext.text}` : preToolContext.text;
     toolPromise.catch(() => {
     });
     try {
-      output = await new Promise((resolve19, reject) => {
+      output = await new Promise((resolve21, reject) => {
         const onAbort = () => {
           setTimeout(() => reject(abortReasonToError(combined.reason)), 0);
         };
@@ -28438,7 +28991,7 @@ ${preToolContext.text}` : preToolContext.text;
         toolPromise.then(
           (v) => {
             combined.removeEventListener("abort", onAbort);
-            resolve19(v);
+            resolve21(v);
           },
           (e) => {
             combined.removeEventListener("abort", onAbort);
@@ -28991,28 +29544,28 @@ function codexModelMeta(id) {
 }
 
 // src/models/mode-store.ts
-import * as fs10 from "node:fs/promises";
-import * as path32 from "node:path";
+import * as fs11 from "node:fs/promises";
+import * as path34 from "node:path";
 
 // src/types/mode-prompts.ts
-import { readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import * as path31 from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import * as path33 from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function modePrompt(id) {
   for (const dir of modePromptDirCandidates()) {
     try {
-      return readFileSync7(path31.join(dir, `${id}.md`), "utf8").trimEnd();
+      return readFileSync8(path33.join(dir, `${id}.md`), "utf8").trimEnd();
     } catch {
     }
   }
   return "";
 }
 function modePromptDirCandidates() {
-  const here = path31.dirname(fileURLToPath4(import.meta.url));
+  const here = path33.dirname(fileURLToPath5(import.meta.url));
   const candidates = [
-    path31.resolve(here, "../../instructions/modes"),
-    path31.resolve(here, "../instructions/modes"),
-    path31.resolve(here, "instructions/modes")
+    path33.resolve(here, "../../instructions/modes"),
+    path33.resolve(here, "../instructions/modes"),
+    path33.resolve(here, "instructions/modes")
   ];
   return candidates.sort((a, b) => Number(!isDirectory3(a)) - Number(!isDirectory3(b)));
 }
@@ -29244,8 +29797,8 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path32.join(this.configDir, "mode.json");
-      const content = await fs10.readFile(configPath, "utf8");
+      const configPath = path34.join(this.configDir, "mode.json");
+      const content = await fs11.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
     } catch {
@@ -29254,8 +29807,8 @@ var DefaultModeStore = class {
   }
   async saveActiveMode() {
     try {
-      await fs10.mkdir(this.configDir, { recursive: true });
-      const configPath = path32.join(this.configDir, "mode.json");
+      await fs11.mkdir(this.configDir, { recursive: true });
+      const configPath = path34.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -29267,14 +29820,14 @@ var DefaultModeStore = class {
 async function loadProjectModes(modesDir) {
   const modes = [];
   try {
-    const entries = await fs10.readdir(modesDir);
+    const entries = await fs11.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path32.join(modesDir, entry);
-      const stat15 = await fs10.stat(filePath);
+      const filePath = path34.join(modesDir, entry);
+      const stat15 = await fs11.stat(filePath);
       if (!stat15.isFile()) continue;
-      const content = await fs10.readFile(filePath, "utf8");
-      const id = path32.basename(entry, path32.extname(entry));
+      const content = await fs11.readFile(filePath, "utf8");
+      const id = path34.basename(entry, path34.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -29290,8 +29843,8 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path32.join(modesDir, "modes.json");
-    const content = await fs10.readFile(manifestPath, "utf8");
+    const manifestPath = path34.join(modesDir, "modes.json");
+    const content = await fs11.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
       modes.push(mode);
@@ -29302,8 +29855,8 @@ async function loadUserModes(modesDir) {
 }
 
 // src/models/models-registry.ts
-import * as fs11 from "node:fs/promises";
-import * as path33 from "node:path";
+import * as fs12 from "node:fs/promises";
+import * as path35 from "node:path";
 var DEFAULT_URL = "https://models.dev/api.json";
 var ENV_URL_KEY = "WRONGSTACK_MODELS_DEV_URL";
 var DEFAULT_TTL_SECONDS = 3 * 3600;
@@ -29380,7 +29933,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path33.join(path33.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path35.join(path35.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
     this.logger = opts.logger ?? noOpLogger;
   }
   async load(opts = {}) {
@@ -29568,7 +30121,7 @@ var DefaultModelsRegistry = class {
   async readOverlayFile() {
     if (!this.overlayFile) return void 0;
     try {
-      const raw = await fs11.readFile(this.overlayFile, "utf8");
+      const raw = await fs12.readFile(this.overlayFile, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -29647,7 +30200,7 @@ var DefaultModelsRegistry = class {
   }
   async readCacheAt(file) {
     try {
-      const raw = await fs11.readFile(file, "utf8");
+      const raw = await fs12.readFile(file, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -29655,7 +30208,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path33.resolve(this.cacheFile);
+    return path35.resolve(this.cacheFile);
   }
 };
 var REASONING_EFFORTS = /* @__PURE__ */ new Set([
@@ -30006,9 +30559,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve19) => {
+    const timeout = new Promise((resolve21) => {
       timer = setTimeout(
-        () => resolve19({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve21({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -30206,7 +30759,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path42 = opts.path ?? "/metrics";
+  const path44 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const token = opts.token;
@@ -30229,7 +30782,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path42) {
+    if (url === path44) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -30266,23 +30819,23 @@ async function startMetricsServer(opts) {
   let server;
   if (useHttps && tls) {
     const { createServer } = await import("node:https");
-    const { readFileSync: readFileSync9 } = await import("node:fs");
+    const { readFileSync: readFileSync10 } = await import("node:fs");
     server = createServer(
-      { cert: readFileSync9(tls.cert), key: readFileSync9(tls.key) },
+      { cert: readFileSync10(tls.cert), key: readFileSync10(tls.key) },
       listener
     );
   } else {
     const { createServer } = await import("node:http");
     server = createServer(listener);
   }
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve21, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve19();
+      resolve21();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -30293,9 +30846,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path42}`,
-    close: () => new Promise((resolve19, reject) => {
-      server.close((err) => err ? reject(err) : resolve19());
+    url: `${protocol}://${host}:${boundPort}${path44}`,
+    close: () => new Promise((resolve21, reject) => {
+      server.close((err) => err ? reject(err) : resolve21());
     })
   };
 }
@@ -30565,8 +31118,8 @@ function startOtlpTraceExporter(opts) {
 }
 
 // src/security/permission-policy.ts
-import * as fs12 from "node:fs/promises";
-import * as path36 from "node:path";
+import * as fs13 from "node:fs/promises";
+import * as path38 from "node:path";
 
 // src/security/permission-policy-schema.ts
 var TRUST_POLICY_LIMITS = Object.freeze({
@@ -30611,19 +31164,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path42, message) {
-  diagnostics.push({ severity: "error", code, path: path42, message });
+function error(diagnostics, code, path44, message) {
+  diagnostics.push({ severity: "error", code, path: path44, message });
 }
-function validatePatterns(value, path42, diagnostics) {
+function validatePatterns(value, path44, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path42, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path44, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path42,
+      path44,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -30631,7 +31184,7 @@ function validatePatterns(value, path42, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path42}[${index}]`;
+    const itemPath = `${path44}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -30735,7 +31288,7 @@ function validateTrustPolicy(value) {
 }
 
 // src/security/yolo-risk.ts
-import * as path34 from "node:path";
+import * as path36 from "node:path";
 var CATASTROPHIC_PATTERNS = [
   /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
   // make a filesystem — wipes a partition
@@ -30795,9 +31348,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path34.resolve(projectRoot, rawPath);
-  const relative8 = path34.relative(projectRoot, resolved);
-  return !!relative8 && !relative8.startsWith("..") && !path34.isAbsolute(relative8);
+  const resolved = path36.resolve(projectRoot, rawPath);
+  const relative8 = path36.relative(projectRoot, resolved);
+  return !!relative8 && !relative8.startsWith("..") && !path36.isAbsolute(relative8);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -31047,7 +31600,7 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 
 // src/security/permission-helpers.ts
 import { realpathSync } from "node:fs";
-import * as path35 from "node:path";
+import * as path37 from "node:path";
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
@@ -31131,24 +31684,24 @@ function realpathOfNearestExisting(p) {
   const tail = [];
   for (; ; ) {
     try {
-      return tail.length === 0 ? realpathSync(probe) : path35.join(realpathSync(probe), ...tail);
+      return tail.length === 0 ? realpathSync(probe) : path37.join(realpathSync(probe), ...tail);
     } catch {
-      const parent = path35.dirname(probe);
+      const parent = path37.dirname(probe);
       if (parent === probe) return p;
-      tail.unshift(path35.basename(probe));
+      tail.unshift(path37.basename(probe));
       probe = parent;
     }
   }
 }
 var agentStateRootRealCache = /* @__PURE__ */ new Map();
 function isInsideAgentStateRoot(absPath) {
-  const lexicalRoot = normalizeForCompare(path35.resolve(wstackGlobalRoot()));
+  const lexicalRoot = normalizeForCompare(path37.resolve(wstackGlobalRoot()));
   if (!lexicalRoot) return false;
   const target = normalizeForCompare(absPath);
   if (target === lexicalRoot || target.startsWith(`${lexicalRoot}/`)) return true;
   let realRoot = agentStateRootRealCache.get(lexicalRoot);
   if (realRoot === void 0) {
-    realRoot = normalizeForCompare(realpathOfNearestExisting(path35.resolve(wstackGlobalRoot())));
+    realRoot = normalizeForCompare(realpathOfNearestExisting(path37.resolve(wstackGlobalRoot())));
     agentStateRootRealCache.set(lexicalRoot, realRoot);
   }
   if (!realRoot || realRoot === lexicalRoot) return false;
@@ -31157,7 +31710,7 @@ function isInsideAgentStateRoot(absPath) {
 }
 function isProtectedAgentStatePath(absPath) {
   if (!isInsideAgentStateRoot(absPath)) return false;
-  return AGENT_STATE_SENSITIVE_BASENAMES.test(path35.basename(normalizeForCompare(absPath)));
+  return AGENT_STATE_SENSITIVE_BASENAMES.test(path37.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
   const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
@@ -31318,7 +31871,7 @@ var DefaultPermissionPolicy = class {
     if (!hasCapability(tool, ToolCapabilities.FS_WRITE)) return false;
     for (const targetPath of fsWriteTargetPaths(input)) {
       const base = ctx.workingDir ?? ctx.cwd;
-      const resolved = base ? path36.resolve(base, targetPath) : path36.resolve(targetPath);
+      const resolved = base ? path38.resolve(base, targetPath) : path38.resolve(targetPath);
       if (isInsideAgentStateRoot(resolved)) return true;
     }
     return false;
@@ -31363,7 +31916,7 @@ var DefaultPermissionPolicy = class {
     this.policyDiagnostics = [];
     this.policyInvalid = false;
     try {
-      const raw = await fs12.readFile(this.trustFile, "utf8");
+      const raw = await fs13.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok) {
         this.policy = {};
@@ -31985,9 +32538,9 @@ var DefaultPermissionPolicy = class {
 
 // src/security/secret-vault.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, scryptSync } from "node:crypto";
-import * as fs13 from "node:fs";
+import * as fs14 from "node:fs";
 import * as fsp22 from "node:fs/promises";
-import * as path37 from "node:path";
+import * as path39 from "node:path";
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
@@ -32127,7 +32680,7 @@ function checkKeyFilePermissions(keyFile, opts) {
   if (process.platform === "win32") return;
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   try {
-    const stat15 = fs13.statSync(keyFile);
+    const stat15 = fs14.statSync(keyFile);
     const actualMode = stat15.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
       void restrictFilePermissions(keyFile, {
@@ -32143,21 +32696,21 @@ function checkKeyFilePermissions(keyFile, opts) {
 }
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes3(4).toString("hex")}.tmp`;
-  const fd = fs13.openSync(tmp, "w", 384);
+  const fd = fs14.openSync(tmp, "w", 384);
   try {
-    fs13.writeFileSync(fd, content);
+    fs14.writeFileSync(fd, content);
     try {
-      fs13.fsyncSync(fd);
+      fs14.fsyncSync(fd);
     } catch {
     }
   } finally {
-    fs13.closeSync(fd);
+    fs14.closeSync(fd);
   }
   try {
-    fs13.renameSync(tmp, keyFile);
+    fs14.renameSync(tmp, keyFile);
   } catch (err) {
     try {
-      fs13.unlinkSync(tmp);
+      fs14.unlinkSync(tmp);
     } catch {
     }
     throw err;
@@ -32280,7 +32833,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs13.mkdirSync(path37.dirname(this.keyFile), { recursive: true });
+    fs14.mkdirSync(path39.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -32320,7 +32873,7 @@ var DefaultSecretVault = class {
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
-      const buf = fs13.readFileSync(this.keyFile);
+      const buf = fs14.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
         this.key = key2;
@@ -32367,17 +32920,17 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs13.mkdirSync(path37.dirname(this.keyFile), { recursive: true });
+    fs14.mkdirSync(path39.dirname(this.keyFile), { recursive: true });
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
-      fs13.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
+      fs14.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
       this.scheduleKeyHardening();
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       this.scheduleKeyHardening();
-      const buf = fs13.readFileSync(this.keyFile);
+      const buf = fs14.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
         this.key = winnerKey;
@@ -32427,7 +32980,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp22.mkdir(path37.dirname(configPath), { recursive: true });
+  await fsp22.mkdir(path39.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions2(configPath);
   await vault.flushHardening?.();
@@ -32482,7 +33035,7 @@ function walkCount(node, vault, counter) {
 // src/storage/attachment-store.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import * as fsp23 from "node:fs/promises";
-import * as path38 from "node:path";
+import * as path40 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE2 = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -32503,7 +33056,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp23.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path38.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path40.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -32622,7 +33175,7 @@ function mergeAdjacentText(blocks) {
 }
 
 // src/storage/config-loader.ts
-import * as fs14 from "node:fs/promises";
+import * as fs15 from "node:fs/promises";
 
 // src/storage/config-loader/bootstrap.ts
 var BOOTSTRAP_KEYS = /* @__PURE__ */ new Set(["version", "activeProfile"]);
@@ -33041,8 +33594,8 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "The other half of the filesystem confinement switch."
   }
 ];
-function deleteNestedPath(target, path42) {
-  const segments = path42.split(".");
+function deleteNestedPath(target, path44) {
+  const segments = path44.split(".");
   const last = segments[segments.length - 1];
   if (last === void 0) return false;
   let cursor = target;
@@ -33099,16 +33652,16 @@ function assertInProjectAllowListComplete() {
     );
   }
   const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path42 }) => !IN_PROJECT_ALLOWED_KEYS.has(path42.split(".")[0] ?? "")
-  ).map(({ path: path42 }) => path42);
+    ({ path: path44 }) => !IN_PROJECT_ALLOWED_KEYS.has(path44.split(".")[0] ?? "")
+  ).map(({ path: path44 }) => path44);
   if (orphanedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
     );
   }
   const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path42 }) => path42.split(".").length < 2 || path42.split(".").some((s) => s.length === 0)
-  ).map(({ path: path42 }) => path42);
+    ({ path: path44 }) => path44.split(".").length < 2 || path44.split(".").some((s) => s.length === 0)
+  ).map(({ path: path44 }) => path44);
   if (malformedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
@@ -33136,8 +33689,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  for (const { path: path42 } of IN_PROJECT_DENIED_PATHS) {
-    if (deleteNestedPath(out, path42)) stripped.push(path42);
+  for (const { path: path44 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path44)) stripped.push(path44);
   }
   if (stripped.length > 0) {
     warn(
@@ -33326,10 +33879,10 @@ function removeLegacySageEngine(config) {
 }
 
 // src/storage/config-loader/path-identity.ts
-import * as path39 from "node:path";
+import * as path41 from "node:path";
 function samePath(a, b) {
-  let ra = path39.resolve(a);
-  let rb = path39.resolve(b);
+  let ra = path41.resolve(a);
+  let rb = path41.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -33489,7 +34042,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
         let parsed;
         let fileExisted = true;
         try {
-          const raw = await fs14.readFile(fp, "utf8");
+          const raw = await fs15.readFile(fp, "utf8");
           const result = safeParse(raw);
           if (!result.ok || !isPlainRecord(result.value)) {
             return;
@@ -33585,7 +34138,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     let parsed;
     let existed = true;
     try {
-      const raw = await fs14.readFile(profileFp, "utf8");
+      const raw = await fs15.readFile(profileFp, "utf8");
       const result = safeParse(raw);
       if (!result.ok || !isPlainRecord(result.value)) {
         this.logWarn("Profile config parse failed \u2014 falling back to defaults", {
@@ -33684,7 +34237,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     const fp = this.paths.syncConfig;
     const t0 = Date.now();
     try {
-      const raw = await fs14.readFile(fp, "utf8");
+      const raw = await fs15.readFile(fp, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok || !parsed.value) {
         this.events?.emit("storage.read", {
@@ -33746,7 +34299,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     const t0 = Date.now();
     let mtimeMs = null;
     try {
-      const stat15 = await fs14.stat(file);
+      const stat15 = await fs15.stat(file);
       mtimeMs = stat15.mtimeMs;
       const cached = this.jsonCache.get(file);
       if (cached && cached.mtimeMs === mtimeMs) {
@@ -33776,7 +34329,7 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     }
     let raw;
     try {
-      raw = await fs14.readFile(file, "utf8");
+      raw = await fs15.readFile(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         this.events?.emit("storage.read", {
@@ -34012,7 +34565,7 @@ function deepFreeze(obj) {
 
 // src/storage/plan-store.ts
 import * as fsp24 from "node:fs/promises";
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
@@ -34110,7 +34663,7 @@ function emptyPlan(sessionId, title) {
 function addPlanItem(plan, title, details) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const item = {
-    id: `plan_${Date.now()}_${randomUUID17().slice(0, 6)}`,
+    id: `plan_${Date.now()}_${randomUUID18().slice(0, 6)}`,
     title,
     details,
     status: "open",
@@ -34182,7 +34735,7 @@ function deriveTodosFromPlanItem(plan, idOrIndex, subtasks) {
   if (subtasks && subtasks.length > 0) {
     for (const st of subtasks) {
       todos.push({
-        id: `todo_${Date.now()}_${randomUUID17().slice(0, 6)}`,
+        id: `todo_${Date.now()}_${randomUUID18().slice(0, 6)}`,
         content: st,
         status: "pending",
         promotedFromPlan: item.id
@@ -34310,7 +34863,7 @@ ${cat}:`);
 
 // src/storage/queue-store.ts
 import * as fsp25 from "node:fs/promises";
-import * as path40 from "node:path";
+import * as path42 from "node:path";
 var QUEUE_MAX_ITEMS = 100;
 var QUEUE_MAX_BYTES = 16 * 1024 * 1024;
 var QUEUE_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -34343,7 +34896,7 @@ var QueueStore = class {
   traceId;
   logger;
   constructor(opts) {
-    this.file = path40.join(opts.dir, "queue.json");
+    this.file = path42.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
     this.logger = opts.logger;
@@ -34558,8 +35111,8 @@ function isPersistedQueueItem(v) {
 
 // src/storage/recovery-lock.ts
 import * as fsp26 from "node:fs/promises";
-import * as os2 from "node:os";
-import * as path41 from "node:path";
+import * as os3 from "node:os";
+import * as path43 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -34570,9 +35123,9 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path41.join(opts.dir, LOCK_FILE);
+    this.file = path43.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
-    this.hostname = opts.hostname ?? os2.hostname();
+    this.hostname = opts.hostname ?? os3.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
     this.sessionStore = opts.sessionStore;
     this.probe = opts.isPidAlive ?? defaultIsPidAlive;
@@ -34644,7 +35197,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path41.dirname(this.file));
+    await ensureDir(path43.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -34812,6 +35365,7 @@ var CORE_RECONSTRUCT_EVENTS = /* @__PURE__ */ new Set([
   "message_appended",
   "message_updated",
   "messages_replaced",
+  "messages_dropped",
   "context_snapshot",
   "checkpoint",
   "file_snapshot",