@wrongstack/core 0.302.2 → 0.303.0

package/dist/defaults/index.js

@@ -1277,8 +1277,8 @@ function defaultFormatTaskInput(task) {
 }
 
 // src/coordination/agents/agent-prompts.ts
-import { readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
-import * as path5 from "node:path";
+import { readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import * as path6 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/utils/wstack-paths.ts
@@ -1421,8 +1421,8 @@ function resolveWstackPaths(opts) {
 }
 
 // src/coordination/agents/project-agent-identity.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "node:fs";
-import * as path4 from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "node:fs";
+import * as path5 from "node:path";
 
 // src/types/runtime-capability-manifest.ts
 var PLAYWRIGHT_ALIASES = {
@@ -1680,22 +1680,6 @@ function inferRuntimeCapabilities(toolNames) {
   return [...ids];
 }
 
-// src/coordination/agents/project-agent-consolidation.ts
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync as readFileSync2,
-  rmSync
-} from "node:fs";
-import * as path3 from "node:path";
-
-// src/coordination/agents/project-agent-learning-entries.ts
-function splitLearnedEntries(body) {
-  return body.split(/\n---\n+/).map((entry) => entry.trim()).map(
-    (entry) => entry.replace(/^# Learned wisdom for .+$/im, "").replace(/<!--[\s\S]*?-->/g, "").trim()
-  ).filter(Boolean);
-}
-
 // src/coordination/agents/project-agent-paths.ts
 import * as path2 from "node:path";
 var AGENT_ROLE_PATTERN = /^[a-z0-9][a-z0-9._-]{0,95}$/i;
@@ -1717,6 +1701,190 @@ function learningPolicyPath(role, projectRoot) {
   return path2.join(roleDir(role, projectRoot), "learning.json");
 }
 
+// src/coordination/agents/project-agent-consolidation.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync } from "node:fs";
+import * as path3 from "node:path";
+
+// src/coordination/agents/project-agent-learning-entries.ts
+function splitLearnedEntries(body) {
+  return body.split(/\n---\n+/).map((entry) => entry.trim()).map(
+    (entry) => entry.replace(/^#\s+Learned (?:wisdom|instructions) for .+$/im, "").replace(/^>\s*Project-specific learning data for[\s\S]*?$/im, "").replace(/^_No learned entries yet\._$/im, "").replace(/^\*Last capture:[^\n]*\*$/im, "").replace(/<!--[\s\S]*?-->/g, "").trim()
+  ).filter(Boolean);
+}
+
+// src/coordination/agents/project-agent-learning-normalize.ts
+var MIN_INSTRUCTIVE_LENGTH = 30;
+function classifyLearnedEntry(text) {
+  const lower = text.toLowerCase();
+  if (/\b(?:avoid|never|don'?t|do not|must not|prevent|watch out|beware|pitfall|gotcha|hazard|risk)\b/.test(
+    lower
+  ))
+    return "warning";
+  if (/\b(?:use|prefer|choose|adopt|leverage|apply|switch to|migrate to)\b/.test(lower) || /\b(?:pattern|approach|strategy|technique|idiom)\b/.test(lower))
+    return "pattern";
+  if (/\b(?:always|must|should|require|ensure|verify|check|run|execute|before|after|when)\b/.test(
+    lower
+  ))
+    return "convention";
+  return "fact";
+}
+function normalizeForComparison(text) {
+  return text.toLowerCase().replace(/[^\w\s]/g, " ").replace(/\s+/g, " ").trim().split(/\s+/).sort().join(" ");
+}
+
+// src/coordination/agents/project-agent-learning-structured.ts
+function parseLearnedEntryStamp(entry) {
+  const structuredMatch = entry.match(
+    /<!--\s*learned-stamp:\s*category=([\w-]+);\s*capturedAt=([^;]+?)\s*-->/
+  );
+  if (structuredMatch) {
+    const rawCategory = structuredMatch[1];
+    const candidate = parseLearnedCategory(rawCategory);
+    return {
+      capturedAt: typeof structuredMatch[2] === "string" ? structuredMatch[2].trim() : "",
+      category: candidate ?? null
+    };
+  }
+  const stampMatch = entry.match(/^>\s*(?:\[\s*([\w-]+)\s*\]\s+)?(?:Captured|Taught)\s+(\S+)/m);
+  if (!stampMatch) {
+    return { capturedAt: "", category: null };
+  }
+  return {
+    capturedAt: typeof stampMatch[2] === "string" ? stampMatch[2] : "",
+    category: parseLearnedCategory(stampMatch[1]) ?? null
+  };
+}
+function parseLearnedCategory(value) {
+  return value === "convention" || value === "pattern" || value === "warning" || value === "fact" ? value : void 0;
+}
+function stripStamp(entry) {
+  return entry.replace(/<!--\s*learned-stamp:[\s\S]*?-->/g, "").replace(/^>\s*(?:\[[\w-]+\]\s+)?(?:Captured|Taught)\s+.+$/m, "").replace(/\n{3,}/g, "\n\n").trim();
+}
+function directiveKey(text) {
+  return normalizeForComparison(text);
+}
+function decomposeLearnedEntry(text, category) {
+  const what = text;
+  const why = deriveWhy(category, text);
+  const how = extractHow(text);
+  return { what, why, how };
+}
+var WHY_BY_CATEGORY = {
+  convention: "Established convention for this codebase \u2014 skipping it risks regressions, merge friction, or out-of-sync state with peers.",
+  pattern: "This project's chosen approach \u2014 alternatives were considered and either conflict with existing architecture or were rejected for known reasons.",
+  warning: "Known failure mode \u2014 skipping this has caused real defects in this codebase. The cost of getting it wrong outweighs the cost of the check.",
+  fact: "Current state of the project \u2014 assumed by other conventions, build steps, or peers, so acting on a stale assumption wastes a cycle."
+};
+function deriveWhy(category, text) {
+  const base = WHY_BY_CATEGORY[category];
+  const signals = [];
+  const lower = text.toLowerCase();
+  if (/\bbefore\s+(?:merge|commit|deploy|release|shipping|publishing)\b/.test(lower))
+    signals.push("guard before shipping");
+  if (/\bto\s+avoid\b/.test(lower)) {
+    const m = text.match(/to avoid ([^.!?]+)/i);
+    if (m?.[1]) signals.push(`avoid ${m[1].trim()}`);
+  }
+  if (/\bso\s+(?:that|we|the project)\b/.test(lower)) {
+    const m = text.match(/so (?:that |we |the project )?([^.!?]+)/i);
+    if (m?.[1]) signals.push(`so ${m[1].trim()}`);
+  }
+  if (signals.length === 0) return base;
+  return `${base} Project signals: ${signals.join("; ")}.`;
+}
+function extractHow(text) {
+  const anchors = /* @__PURE__ */ new Set();
+  const backticked = text.match(/`([^`]+)`/g) ?? [];
+  for (const raw of backticked) {
+    const inner = raw.replace(/`/g, "").trim();
+    if (inner.length > 0 && inner.length <= 120) anchors.add(inner);
+  }
+  const pathMatches = text.match(
+    /(?:[a-zA-Z0-9_.-]+\/)+[a-zA-Z0-9_.-]+\.(?:tsx|jsonc|json|jsx|yaml|mjs|cjs|yml|ts|js|md)\b/g
+  ) ?? [];
+  for (const p of pathMatches) anchors.add(p);
+  const scoped = text.match(/@[a-z0-9][\w.-]*\/[a-z0-9][\w.-]*/gi) ?? [];
+  for (const p of scoped) anchors.add(p);
+  if (anchors.size === 0) return "";
+  return [...anchors].map((anchor) => `\`${anchor}\``).join("\n");
+}
+function cleanHowLine(line) {
+  let value = line.trim();
+  let previous;
+  do {
+    previous = value;
+    value = value.replace(/^[-*]\s+/, "").replace(/^\*How:\*\s*/i, "").trim();
+  } while (value !== previous);
+  return value;
+}
+function parseStampAttributes(body) {
+  const attributes = {};
+  for (const part of body.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key) attributes[key] = value;
+  }
+  return attributes;
+}
+function parseEntryBody(body) {
+  const lines = [];
+  for (const line of body.split("\n")) {
+    if (/^##\s/.test(line) || /^---\s*$/.test(line) || /^<!--/.test(line)) break;
+    lines.push(line);
+  }
+  const text = lines.join("\n");
+  const what = /^-\s+\*\*([\s\S]+?)\*\*\s*$/m.exec(text)?.[1]?.replace(/\s+/g, " ").trim() ?? "";
+  if (!what) return void 0;
+  const why = /^\s+-\s+\*Why:\*\s+(.+)$/m.exec(text)?.[1]?.trim() ?? "";
+  const how = lines.filter((line) => /^\s+-\s+\*How:\*/i.test(line)).map((line) => cleanHowLine(line)).filter(Boolean).join("\n");
+  return { what, why, how };
+}
+function parseStructuredLearnedEntriesFromContent(raw, legacyEntries = splitLearnedEntries(raw)) {
+  if (!raw) return [];
+  const structured = [];
+  const stampPattern = /<!--\s*learned-stamp:\s*([^>]*?)\s*-->/g;
+  const stamps = [...raw.matchAll(stampPattern)];
+  for (const [index, stamp] of stamps.entries()) {
+    const attributes = parseStampAttributes(stamp[1] ?? "");
+    const category = parseLearnedCategory(attributes["category"]) ?? "fact";
+    const capturedAt = attributes["capturedAt"] ?? "";
+    const skill = attributes["skill"];
+    const start = (stamp.index ?? 0) + stamp[0].length;
+    const end = stamps[index + 1]?.index ?? raw.length;
+    const parsed = parseEntryBody(raw.slice(start, end));
+    if (!parsed || parsed.what.length < MIN_INSTRUCTIVE_LENGTH) continue;
+    structured.push({
+      key: directiveKey(parsed.what),
+      category,
+      what: parsed.what,
+      why: parsed.why || WHY_BY_CATEGORY[category],
+      how: parsed.how,
+      capturedAt,
+      ...skill ? { skill } : {}
+    });
+  }
+  if (structured.length === 0) {
+    for (const chunk of legacyEntries) {
+      const stamp = parseLearnedEntryStamp(chunk);
+      const directive = stamp.capturedAt || stamp.category ? stripStamp(chunk) : chunk;
+      if (directive.length < MIN_INSTRUCTIVE_LENGTH) continue;
+      const category = stamp.category ?? classifyLearnedEntry(directive);
+      const { what, why, how } = decomposeLearnedEntry(directive, category);
+      structured.push({
+        key: directiveKey(directive),
+        category,
+        what,
+        why,
+        how,
+        capturedAt: stamp.capturedAt
+      });
+    }
+  }
+  return structured;
+}
+
 // src/coordination/agents/project-agent-consolidation.ts
 function consolidationPath(role, projectRoot) {
   return path3.join(roleDir(role, projectRoot), "consolidated.md");
@@ -1831,27 +1999,317 @@ function loadProjectAgentLearningPolicy(role, projectRoot) {
   }
 }
 
+// src/coordination/agents/project-agent-skill-layer.ts
+import { readdirSync, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
+import * as path4 from "node:path";
+
+// src/coordination/agents/role-skills.ts
+var skillSet = (...names) => names;
+var ROLE_SKILL_SETS = {
+  explore: skillSet("research-web", "node-modern", "typescript-strict"),
+  search: skillSet("bug-hunter", "typescript-strict", "research-web"),
+  research: skillSet("research-web", "tech-stack", "security-scanner", "api-design"),
+  analyst: skillSet("sdd", "api-design", "testing", "security-scanner"),
+  planner: skillSet("sdd", "multi-agent", "refactor-planner", "testing"),
+  architect: skillSet("sdd", "api-design", "refactor-planner", "security-scanner", "observability"),
+  critic: skillSet("chimera", "bug-hunter", "security-scanner", "refactor-planner"),
+  "refactor-planner": skillSet(
+    "refactor-planner",
+    "sdd",
+    "typescript-strict",
+    "testing",
+    "bug-hunter"
+  ),
+  executor: skillSet("sdd", "typescript-strict", "node-modern", "testing", "git-flow"),
+  refactor: skillSet("refactor-planner", "typescript-strict", "testing", "bug-hunter"),
+  simplifier: skillSet("bug-hunter", "typescript-strict", "testing", "refactor-planner"),
+  migration: skillSet("tech-stack", "node-modern", "typescript-strict", "testing", "git-flow"),
+  vision: skillSet("react-modern", "testing", "typescript-strict", "security-scanner"),
+  debugger: skillSet("bug-hunter", "testing", "typescript-strict", "observability", "audit-log"),
+  tracer: skillSet("observability", "audit-log", "bug-hunter", "testing"),
+  verifier: skillSet("testing", "typescript-strict", "security-scanner", "chimera"),
+  test: skillSet("testing", "typescript-strict", "bug-hunter", "security-scanner"),
+  e2e: skillSet("testing", "react-modern", "api-design", "security-scanner"),
+  browser: skillSet("testing", "react-modern", "security-scanner", "research-web"),
+  performance: skillSet("observability", "testing", "node-modern", "audit-log"),
+  chaos: skillSet("testing", "observability", "security-scanner", "audit-log"),
+  "security-scanner": skillSet("security-scanner", "bug-hunter", "api-design", "tech-stack"),
+  "bug-hunter": skillSet("bug-hunter", "typescript-strict", "testing", "security-scanner"),
+  "audit-log": skillSet("audit-log", "observability", "bug-hunter", "output-standards"),
+  reviewer: skillSet("chimera", "bug-hunter", "security-scanner", "testing"),
+  "code-reviewer": skillSet("chimera", "bug-hunter", "typescript-strict", "testing"),
+  "security-reviewer": skillSet("security-scanner", "chimera", "api-design", "tech-stack"),
+  accessibility: skillSet("react-modern", "testing", "chimera", "security-scanner"),
+  compliance: skillSet("security-scanner", "audit-log", "tech-stack", "chimera"),
+  database: skillSet("api-design", "testing", "security-scanner", "observability"),
+  api: skillSet("api-design", "typescript-strict", "node-modern", "testing", "security-scanner"),
+  auth: skillSet("security-scanner", "api-design", "testing", "typescript-strict", "audit-log"),
+  data: skillSet("typescript-strict", "testing", "observability", "security-scanner"),
+  frontend: skillSet("react-modern", "typescript-strict", "testing", "security-scanner"),
+  backend: skillSet("node-modern", "typescript-strict", "api-design", "testing", "observability"),
+  designer: skillSet("react-modern", "prompt-engineering", "research-web", "output-standards"),
+  ios: skillSet("sdd", "testing", "security-scanner", "research-web"),
+  document: skillSet("output-standards", "research-web", "api-design", "prompt-engineering"),
+  uml: skillSet("sdd", "refactor-planner", "api-design", "output-standards"),
+  i18n: skillSet("react-modern", "testing", "typescript-strict", "output-standards"),
+  prompt: skillSet("prompt-engineering", "skill-creator", "output-standards", "testing"),
+  git: skillSet("git-flow", "chimera", "testing", "security-scanner"),
+  release: skillSet("git-flow", "tech-stack", "chimera", "security-scanner"),
+  devops: skillSet("docker-deploy", "observability", "security-scanner", "git-flow", "tech-stack"),
+  observability: skillSet("observability", "node-modern", "testing", "audit-log"),
+  dependency: skillSet("tech-stack", "security-scanner", "node-modern", "git-flow"),
+  "skill-manage": skillSet(
+    "skill-creator",
+    "prompt-engineering",
+    "security-scanner",
+    "output-standards"
+  ),
+  "self-improving": skillSet(
+    "audit-log",
+    "mnemosyne",
+    "prompt-engineering",
+    "bug-hunter",
+    "observability"
+  ),
+  context: skillSet("mnemosyne", "output-standards", "prompt-engineering", "audit-log"),
+  cost: skillSet("audit-log", "tech-stack", "observability", "research-web"),
+  "tech-stack": skillSet("tech-stack", "research-web", "security-scanner", "node-modern"),
+  // ── Wave 1: Platform and systems engineering ──────────────────────────
+  android: skillSet(
+    "react-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  desktop: skillSet(
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  realtime: skillSet(
+    "api-design",
+    "observability",
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "tech-stack"
+  ),
+  "distributed-systems": skillSet(
+    "api-design",
+    "observability",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  concurrency: skillSet(
+    "bug-hunter",
+    "typescript-strict",
+    "testing",
+    "observability",
+    "node-modern",
+    "tech-stack"
+  ),
+  "platform-engineer": skillSet(
+    "node-modern",
+    "typescript-strict",
+    "git-flow",
+    "docker-deploy",
+    "tech-stack"
+  ),
+  // ── Wave 3: Product and data specialists ──────────────────────────────
+  payments: skillSet(
+    "api-design",
+    "security-scanner",
+    "audit-log",
+    "testing",
+    "typescript-strict",
+    "tech-stack"
+  ),
+  messaging: skillSet(
+    "api-design",
+    "observability",
+    "node-modern",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "search-relevance": skillSet(
+    "api-design",
+    "observability",
+    "testing",
+    "typescript-strict",
+    "data-governance",
+    "tech-stack"
+  ),
+  storage: skillSet(
+    "api-design",
+    "security-scanner",
+    "testing",
+    "observability",
+    "node-modern",
+    "tech-stack"
+  ),
+  "ml-engineer": skillSet(
+    "observability",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "data-governance",
+    "tech-stack"
+  ),
+  "data-governance": skillSet(
+    "audit-log",
+    "security-scanner",
+    "observability",
+    "testing",
+    "output-standards",
+    "tech-stack"
+  ),
+  // ── Wave 4: Agent platform and quality ───────────────────────────────
+  "plugin-author": skillSet(
+    "plugin-author",
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "tool-author": skillSet(
+    "typescript-strict",
+    "security-scanner",
+    "testing",
+    "output-standards",
+    "tech-stack"
+  ),
+  "prompt-evaluator": skillSet(
+    "prompt-engineering",
+    "testing",
+    "output-standards",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "benchmark-engineer": skillSet("observability", "testing", "output-standards", "tech-stack"),
+  "memory-curator": skillSet("mnemosyne", "audit-log", "testing", "output-standards", "tech-stack"),
+  "fleet-coordinator": skillSet("multi-agent", "sdd", "output-standards", "testing", "tech-stack"),
+  // ── Wave 2: Security, resilience, governance and agent platform ────────
+  "threat-modeler": skillSet(
+    "security-scanner",
+    "api-design",
+    "tech-stack",
+    "audit-log",
+    "testing"
+  ),
+  "secure-coding-coach": skillSet(
+    "security-scanner",
+    "testing",
+    "typescript-strict",
+    "api-design",
+    "tech-stack"
+  ),
+  "resilience-engineer": skillSet(
+    "observability",
+    "testing",
+    "typescript-strict",
+    "api-design",
+    "tech-stack"
+  ),
+  "chaos-engineer": skillSet(
+    "observability",
+    "testing",
+    "security-scanner",
+    "git-flow",
+    "tech-stack"
+  ),
+  "compliance-auditor": skillSet(
+    "audit-log",
+    "security-scanner",
+    "output-standards",
+    "testing",
+    "tech-stack"
+  ),
+  "privacy-engineer": skillSet(
+    "security-scanner",
+    "audit-log",
+    "api-design",
+    "data-governance",
+    "tech-stack"
+  )
+};
+var SHADOW_AGENT_SKILLS = skillSet(
+  "wrongstack-mailbox",
+  "multi-agent",
+  "audit-log",
+  "observability",
+  "security-scanner"
+);
+var MAX_EAGER_ROSTER_SKILLS = 3;
+function assignSkillsToAgents(definitions) {
+  return definitions.map((definition) => {
+    const role = definition.config.role;
+    if (!role || !Object.hasOwn(ROLE_SKILL_SETS, role)) {
+      throw new Error(
+        `Missing curated skill set for roster role: "${role ?? definition.config.name}"`
+      );
+    }
+    const skills = ROLE_SKILL_SETS[role];
+    return {
+      ...definition,
+      config: {
+        ...definition.config,
+        capabilities: inferRuntimeCapabilities(definition.config.tools ?? []),
+        skillNames: skills.slice(0, MAX_EAGER_ROSTER_SKILLS),
+        skillPool: [...skills]
+      }
+    };
+  });
+}
+
+// src/coordination/agents/project-agent-skill-layer.ts
+var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function isProjectSkillName(name) {
+  return SKILL_NAME_PATTERN.test(name);
+}
+function projectSkillsDir(role, projectRoot) {
+  return path4.join(roleDir(role, projectRoot), "skills");
+}
+function listProjectSkillAugmentations(role, projectRoot) {
+  try {
+    return readdirSync(projectSkillsDir(role, projectRoot)).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -3)).filter(isProjectSkillName).sort();
+  } catch {
+    return [];
+  }
+}
+
+// src/types/blocks.ts
+function isTextBlock(b) {
+  return b.type === "text";
+}
+
 // src/coordination/agents/project-agent-identity.ts
 function loadProjectAgentIdentity(role, projectRoot) {
-  const identityPath = path4.join(roleDir(role, projectRoot), "identity.md");
+  const identityPath = path5.join(roleDir(role, projectRoot), "identity.md");
   try {
-    return readFileSync4(identityPath, "utf8").trim();
+    return readFileSync5(identityPath, "utf8").trim();
   } catch {
     return "";
   }
 }
 function loadProjectAgentLearned(role, projectRoot) {
-  const learnedPath = path4.join(roleDir(role, projectRoot), "learned.md");
+  const learnedPath = path5.join(roleDir(role, projectRoot), "learned.md");
   try {
-    return readFileSync4(learnedPath, "utf8").trim();
+    return readFileSync5(learnedPath, "utf8").trim();
   } catch {
     return "";
   }
 }
 function loadRoleKnowledgeManifest(role, projectRoot) {
-  const projectPath = path4.join(roleDir(role, projectRoot), "knowledge.json");
+  const projectPath = path5.join(roleDir(role, projectRoot), "knowledge.json");
   try {
-    const raw = readFileSync4(projectPath, "utf8");
+    const raw = readFileSync5(projectPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return BUILT_IN_KNOWLEDGE_MANIFESTS[role];
@@ -1879,31 +2337,35 @@ ${identity}`);
   let learnedLabel = "";
   if (learningPolicy.enabled) {
     const consolidated = loadProjectAgentConsolidated(role, projectRoot);
+    const rawLearned = loadProjectAgentLearned(role, projectRoot);
     if (consolidated) {
       const meta = loadConsolidationMetadata(role, projectRoot);
-      const rawLearned = loadProjectAgentLearned(role, projectRoot);
-      const rawEntries = splitLearnedEntries(rawLearned);
+      const rawEntries = parseStructuredLearnedEntriesFromContent(
+        rawLearned,
+        splitLearnedEntries(rawLearned)
+      );
       const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const stale = meta === void 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
-      if (stale) {
-        if (meta !== void 0 && meta.sourceEntryCount < rawEntries.length) {
-          const deltaEntries = rawEntries.slice(meta.sourceEntryCount);
-          learnedContent = `${consolidated}
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
+      if (!stale) {
+        learnedContent = consolidated;
+        learnedLabel = "Consolidated knowledge for this project";
+      } else if (freshEntries.length > 0) {
+        const delta = freshEntries.map((entry) => `- **${entry.what}**`).join("\n");
+        learnedContent = `${consolidated}
 
 ---
 
 ## Recently captured (pending next optimization)
 
-${deltaEntries.join("\n\n---\n\n")}`;
-        } else {
-          learnedContent = rawLearned;
-        }
+${delta}`;
+        learnedLabel = "Consolidated knowledge for this project";
       } else {
-        learnedContent = consolidated;
+        learnedContent = rawLearned;
+        learnedLabel = "Learned instructions for this project (structured: what / why / how)";
       }
-      learnedLabel = "Consolidated knowledge for this project";
     } else {
-      learnedContent = loadProjectAgentLearned(role, projectRoot);
+      learnedContent = rawLearned;
       learnedLabel = "Learned instructions for this project (structured: what / why / how)";
     }
   }
@@ -1918,7 +2380,7 @@ ${learnedContent}`);
     }
   }
   const effectiveProjectRoot = projectRoot || process.cwd();
-  const learnedFilePath = path4.join(
+  const learnedFilePath = path5.join(
     effectiveProjectRoot,
     ".wrongstack",
     "agents",
@@ -1945,6 +2407,8 @@ The file below stores **learning data for this project's "${role}" agent** \u201
 - **Self-contained** \u2014 understandable without the surrounding session context.
 - **Front-load concrete anchors** \u2014 commands in backticks, package names like \`@wrongstack/core\`, file paths like \`packages/core/src/.../foo.ts\`. The structured-list renderer extracts these as the "how" for the entry.
 
+**Tag the skill you are developing.** When a directive refines one of your skills, mark it: \`## LEARNED [skill: testing]\`. Tagged directives are distilled into that skill's project addendum, so the lesson arrives as part of the skill itself on every future run instead of as a loose fact. Untagged directives are routed automatically when the wording makes the target obvious, and stay role-level otherwise.
+
 **Bad** (session log \u2014 rejected at capture time):
 
 \`\`\`
@@ -1963,15 +2427,40 @@ Capture only durable, cross-session knowledge \u2014 never ephemeral task detail
     );
   }
   const knowledge = loadRoleKnowledgeManifest(role, projectRoot);
-  if (knowledge && knowledge.checklist.length > 0) {
-    const checklist = knowledge.checklist.map((item) => `- ${item}`).join("\n");
+  if (knowledge) {
+    const knowledgeSections = [];
+    if (knowledge.checklist.length > 0) {
+      knowledgeSections.push(
+        `Verify these before answering:
+${knowledge.checklist.map((item) => `- ${item}`).join("\n")}`
+      );
+    }
+    const liveQueries = Object.entries(knowledge.liveQueries ?? {});
+    if (liveQueries.length > 0) {
+      const threshold = Number.isFinite(knowledge.verifyThreshold) ? knowledge.verifyThreshold : 0.5;
+      knowledgeSections.push(
+        `When your confidence in any of the following is below ${threshold}, fetch the live value rather than recalling it:
+` + liveQueries.map(
+          ([topic, query]) => `- **${topic}** \u2014 ${query.description}: \`${query.registry}\` \u2192 field \`${query.key}\``
+        ).join("\n")
+      );
+    }
+    if (knowledgeSections.length > 0) {
+      parts.push(`
+
+## Current knowledge requirements
+
+${knowledgeSections.join("\n\n")}`);
+    }
+  }
+  const developedSkills = listProjectSkillAugmentations(role, projectRoot);
+  if (developedSkills.length > 0) {
     parts.push(
       `
 
-## Current knowledge requirements
+## Project-developed skills
 
-Verify these before answering:
-${checklist}`
+These skills have been extended with practice learned in this project: ${developedSkills.map((skill) => `\`${skill}\``).join(", ")}. Their project addendum is attached to the skill body \u2014 follow it over the generic method when the two differ.`
     );
   }
   const additions = parts.slice(1).join("\n\n").trim();
@@ -2060,38 +2549,38 @@ function loadTechVersionPolicy() {
   return techVersionPolicyBody;
 }
 function policyCandidateDirs() {
-  const here = path5.dirname(fileURLToPath(import.meta.url));
+  const here = path6.dirname(fileURLToPath(import.meta.url));
   const profileInstructions = resolveWstackPaths({ projectRoot: process.cwd() }).globalInstructions;
   return [
-    path5.resolve(here, "../../../../instructions/agents"),
-    path5.resolve(here, "../../../instructions/agents"),
-    path5.resolve(here, "../../instructions/agents"),
-    path5.resolve(here, "../instructions/agents"),
-    path5.resolve(here, "instructions/agents"),
-    path5.join(profileInstructions, "agents"),
+    path6.resolve(here, "../../../../instructions/agents"),
+    path6.resolve(here, "../../../instructions/agents"),
+    path6.resolve(here, "../../instructions/agents"),
+    path6.resolve(here, "../instructions/agents"),
+    path6.resolve(here, "instructions/agents"),
+    path6.join(profileInstructions, "agents"),
     profileInstructions
   ].filter((dir, index, all) => all.indexOf(dir) === index);
 }
 function policyBody() {
-  const here = path5.dirname(fileURLToPath(import.meta.url));
+  const here = path6.dirname(fileURLToPath(import.meta.url));
   const roots = [
-    path5.resolve(here, "_policy/tech-version.md"),
-    path5.resolve(here, "../_policy/tech-version.md"),
-    path5.resolve(here, "../../../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "../../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "../../../../instructions/agents/_policy/tech-version.md"),
-    path5.resolve(here, "instructions/agents/_policy/tech-version.md")
+    path6.resolve(here, "_policy/tech-version.md"),
+    path6.resolve(here, "../_policy/tech-version.md"),
+    path6.resolve(here, "../../../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "../../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "../../../../instructions/agents/_policy/tech-version.md"),
+    path6.resolve(here, "instructions/agents/_policy/tech-version.md")
   ];
   for (const file of roots) {
     try {
-      return readFileSync5(file, "utf8").trim();
+      return readFileSync6(file, "utf8").trim();
     } catch {
     }
   }
   for (const dir of policyCandidateDirs()) {
     try {
-      return readFileSync5(path5.join(dir, "_policy", "tech-version.md"), "utf8").trim();
+      return readFileSync6(path6.join(dir, "_policy", "tech-version.md"), "utf8").trim();
     } catch {
     }
   }
@@ -2102,14 +2591,15 @@ function agentPrompt(id) {
   const envDir = process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"] ?? "";
   const policyOn = process.env["WRONGSTACK_AGENT_POLICY"] === "on";
   const cacheBypass = globalThis.__WS_DISABLE_PROMPT_CACHE__ === true;
-  const cacheKey = `${envDir}\0${policyOn ? 1 : 0}\0${id}`;
+  const promptProjectRoot = process.env["WRONGSTACK_PROJECT_ROOT"] || process.cwd();
+  const cacheKey = `${envDir}\0${policyOn ? 1 : 0}\0${promptProjectRoot}\0${id}`;
   const cached = cacheBypass ? void 0 : promptCache.get(cacheKey);
   if (cached !== void 0) return cached;
   const fileName = `${id}.md`;
   let resolved = "";
   for (const dir of agentPromptDirCandidates(envDir)) {
     try {
-      resolved = readFileSync5(path5.join(dir, fileName), "utf8").trim();
+      resolved = readFileSync6(path6.join(dir, fileName), "utf8").trim();
       break;
     } catch {
     }
@@ -2126,8 +2616,7 @@ function agentPrompt(id) {
 ${policy}`;
     }
   }
-  const projectRoot = process.env["WRONGSTACK_PROJECT_ROOT"] || process.cwd();
-  resolved = buildProjectContextualizedPrompt(resolved, id, projectRoot);
+  resolved = buildProjectContextualizedPrompt(resolved, id, promptProjectRoot);
   if (!cacheBypass) promptCache.set(cacheKey, resolved);
   return resolved;
 }
@@ -2136,16 +2625,16 @@ function agentPromptDirCandidates(envDir) {
   const candKey = `${envDir}\0${profileInstructions}`;
   const cached = candidateCache.get(candKey);
   if (cached !== void 0) return cached;
-  const here = path5.dirname(fileURLToPath(import.meta.url));
+  const here = path6.dirname(fileURLToPath(import.meta.url));
   const explicitDir = envDir || void 0;
   const candidates = [
-    ...explicitDir ? [path5.resolve(explicitDir)] : [],
-    path5.join(profileInstructions, "agents"),
-    path5.resolve(here, "../../../../instructions/agents"),
-    path5.resolve(here, "../../../instructions/agents"),
-    path5.resolve(here, "../../instructions/agents"),
-    path5.resolve(here, "../instructions/agents"),
-    path5.resolve(here, "instructions/agents")
+    ...explicitDir ? [path6.resolve(explicitDir)] : [],
+    path6.join(profileInstructions, "agents"),
+    path6.resolve(here, "../../../../instructions/agents"),
+    path6.resolve(here, "../../../instructions/agents"),
+    path6.resolve(here, "../../instructions/agents"),
+    path6.resolve(here, "../instructions/agents"),
+    path6.resolve(here, "instructions/agents")
   ];
   const ordered = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   candidateCache.set(candKey, ordered);
@@ -4641,270 +5130,6 @@ var WAVE4_ROLE_METAS = {
 };
 var WAVE4_ROLES = new Set(Object.keys(WAVE4_ROLE_METAS));
 
-// src/coordination/agents/role-skills.ts
-var skillSet = (...names) => names;
-var ROLE_SKILL_SETS = {
-  explore: skillSet("research-web", "node-modern", "typescript-strict"),
-  search: skillSet("bug-hunter", "typescript-strict", "research-web"),
-  research: skillSet("research-web", "tech-stack", "security-scanner", "api-design"),
-  analyst: skillSet("sdd", "api-design", "testing", "security-scanner"),
-  planner: skillSet("sdd", "multi-agent", "refactor-planner", "testing"),
-  architect: skillSet("sdd", "api-design", "refactor-planner", "security-scanner", "observability"),
-  critic: skillSet("chimera", "bug-hunter", "security-scanner", "refactor-planner"),
-  "refactor-planner": skillSet(
-    "refactor-planner",
-    "sdd",
-    "typescript-strict",
-    "testing",
-    "bug-hunter"
-  ),
-  executor: skillSet("sdd", "typescript-strict", "node-modern", "testing", "git-flow"),
-  refactor: skillSet("refactor-planner", "typescript-strict", "testing", "bug-hunter"),
-  simplifier: skillSet("bug-hunter", "typescript-strict", "testing", "refactor-planner"),
-  migration: skillSet("tech-stack", "node-modern", "typescript-strict", "testing", "git-flow"),
-  vision: skillSet("react-modern", "testing", "typescript-strict", "security-scanner"),
-  debugger: skillSet("bug-hunter", "testing", "typescript-strict", "observability", "audit-log"),
-  tracer: skillSet("observability", "audit-log", "bug-hunter", "testing"),
-  verifier: skillSet("testing", "typescript-strict", "security-scanner", "chimera"),
-  test: skillSet("testing", "typescript-strict", "bug-hunter", "security-scanner"),
-  e2e: skillSet("testing", "react-modern", "api-design", "security-scanner"),
-  browser: skillSet("testing", "react-modern", "security-scanner", "research-web"),
-  performance: skillSet("observability", "testing", "node-modern", "audit-log"),
-  chaos: skillSet("testing", "observability", "security-scanner", "audit-log"),
-  "security-scanner": skillSet("security-scanner", "bug-hunter", "api-design", "tech-stack"),
-  "bug-hunter": skillSet("bug-hunter", "typescript-strict", "testing", "security-scanner"),
-  "audit-log": skillSet("audit-log", "observability", "bug-hunter", "output-standards"),
-  reviewer: skillSet("chimera", "bug-hunter", "security-scanner", "testing"),
-  "code-reviewer": skillSet("chimera", "bug-hunter", "typescript-strict", "testing"),
-  "security-reviewer": skillSet("security-scanner", "chimera", "api-design", "tech-stack"),
-  accessibility: skillSet("react-modern", "testing", "chimera", "security-scanner"),
-  compliance: skillSet("security-scanner", "audit-log", "tech-stack", "chimera"),
-  database: skillSet("api-design", "testing", "security-scanner", "observability"),
-  api: skillSet("api-design", "typescript-strict", "node-modern", "testing", "security-scanner"),
-  auth: skillSet("security-scanner", "api-design", "testing", "typescript-strict", "audit-log"),
-  data: skillSet("typescript-strict", "testing", "observability", "security-scanner"),
-  frontend: skillSet("react-modern", "typescript-strict", "testing", "security-scanner"),
-  backend: skillSet("node-modern", "typescript-strict", "api-design", "testing", "observability"),
-  designer: skillSet("react-modern", "prompt-engineering", "research-web", "output-standards"),
-  ios: skillSet("sdd", "testing", "security-scanner", "research-web"),
-  document: skillSet("output-standards", "research-web", "api-design", "prompt-engineering"),
-  uml: skillSet("sdd", "refactor-planner", "api-design", "output-standards"),
-  i18n: skillSet("react-modern", "testing", "typescript-strict", "output-standards"),
-  prompt: skillSet("prompt-engineering", "skill-creator", "output-standards", "testing"),
-  git: skillSet("git-flow", "chimera", "testing", "security-scanner"),
-  release: skillSet("git-flow", "tech-stack", "chimera", "security-scanner"),
-  devops: skillSet("docker-deploy", "observability", "security-scanner", "git-flow", "tech-stack"),
-  observability: skillSet("observability", "node-modern", "testing", "audit-log"),
-  dependency: skillSet("tech-stack", "security-scanner", "node-modern", "git-flow"),
-  "skill-manage": skillSet(
-    "skill-creator",
-    "prompt-engineering",
-    "security-scanner",
-    "output-standards"
-  ),
-  "self-improving": skillSet(
-    "audit-log",
-    "mnemosyne",
-    "prompt-engineering",
-    "bug-hunter",
-    "observability"
-  ),
-  context: skillSet("mnemosyne", "output-standards", "prompt-engineering", "audit-log"),
-  cost: skillSet("audit-log", "tech-stack", "observability", "research-web"),
-  "tech-stack": skillSet("tech-stack", "research-web", "security-scanner", "node-modern"),
-  // ── Wave 1: Platform and systems engineering ──────────────────────────
-  android: skillSet(
-    "react-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  desktop: skillSet(
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  realtime: skillSet(
-    "api-design",
-    "observability",
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "tech-stack"
-  ),
-  "distributed-systems": skillSet(
-    "api-design",
-    "observability",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  concurrency: skillSet(
-    "bug-hunter",
-    "typescript-strict",
-    "testing",
-    "observability",
-    "node-modern",
-    "tech-stack"
-  ),
-  "platform-engineer": skillSet(
-    "node-modern",
-    "typescript-strict",
-    "git-flow",
-    "docker-deploy",
-    "tech-stack"
-  ),
-  // ── Wave 3: Product and data specialists ──────────────────────────────
-  payments: skillSet(
-    "api-design",
-    "security-scanner",
-    "audit-log",
-    "testing",
-    "typescript-strict",
-    "tech-stack"
-  ),
-  messaging: skillSet(
-    "api-design",
-    "observability",
-    "node-modern",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "search-relevance": skillSet(
-    "api-design",
-    "observability",
-    "testing",
-    "typescript-strict",
-    "data-governance",
-    "tech-stack"
-  ),
-  storage: skillSet(
-    "api-design",
-    "security-scanner",
-    "testing",
-    "observability",
-    "node-modern",
-    "tech-stack"
-  ),
-  "ml-engineer": skillSet(
-    "observability",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "data-governance",
-    "tech-stack"
-  ),
-  "data-governance": skillSet(
-    "audit-log",
-    "security-scanner",
-    "observability",
-    "testing",
-    "output-standards",
-    "tech-stack"
-  ),
-  // ── Wave 4: Agent platform and quality ───────────────────────────────
-  "plugin-author": skillSet(
-    "plugin-author",
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "tool-author": skillSet(
-    "typescript-strict",
-    "security-scanner",
-    "testing",
-    "output-standards",
-    "tech-stack"
-  ),
-  "prompt-evaluator": skillSet(
-    "prompt-engineering",
-    "testing",
-    "output-standards",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "benchmark-engineer": skillSet("observability", "testing", "output-standards", "tech-stack"),
-  "memory-curator": skillSet("mnemosyne", "audit-log", "testing", "output-standards", "tech-stack"),
-  "fleet-coordinator": skillSet("multi-agent", "sdd", "output-standards", "testing", "tech-stack"),
-  // ── Wave 2: Security, resilience, governance and agent platform ────────
-  "threat-modeler": skillSet(
-    "security-scanner",
-    "api-design",
-    "tech-stack",
-    "audit-log",
-    "testing"
-  ),
-  "secure-coding-coach": skillSet(
-    "security-scanner",
-    "testing",
-    "typescript-strict",
-    "api-design",
-    "tech-stack"
-  ),
-  "resilience-engineer": skillSet(
-    "observability",
-    "testing",
-    "typescript-strict",
-    "api-design",
-    "tech-stack"
-  ),
-  "chaos-engineer": skillSet(
-    "observability",
-    "testing",
-    "security-scanner",
-    "git-flow",
-    "tech-stack"
-  ),
-  "compliance-auditor": skillSet(
-    "audit-log",
-    "security-scanner",
-    "output-standards",
-    "testing",
-    "tech-stack"
-  ),
-  "privacy-engineer": skillSet(
-    "security-scanner",
-    "audit-log",
-    "api-design",
-    "data-governance",
-    "tech-stack"
-  )
-};
-var SHADOW_AGENT_SKILLS = skillSet(
-  "wrongstack-mailbox",
-  "multi-agent",
-  "audit-log",
-  "observability",
-  "security-scanner"
-);
-var MAX_EAGER_ROSTER_SKILLS = 3;
-function assignSkillsToAgents(definitions) {
-  return definitions.map((definition) => {
-    const role = definition.config.role;
-    if (!role || !Object.hasOwn(ROLE_SKILL_SETS, role)) {
-      throw new Error(
-        `Missing curated skill set for roster role: "${role ?? definition.config.name}"`
-      );
-    }
-    const skills = ROLE_SKILL_SETS[role];
-    return {
-      ...definition,
-      config: {
-        ...definition.config,
-        capabilities: inferRuntimeCapabilities(definition.config.tools ?? []),
-        skillNames: skills.slice(0, MAX_EAGER_ROSTER_SKILLS)
-      }
-    };
-  });
-}
-
 // src/coordination/agents/index.ts
 var ALL_AGENT_DEFINITIONS = assignSkillsToAgents([
   ...DISCOVERY_AGENTS,
@@ -5020,7 +5245,7 @@ function attachAutoExtend(events, policy = {}) {
 // src/coordination/delegate-tool.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import * as fsp from "node:fs/promises";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
@@ -5683,13 +5908,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path6.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path7.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
       const entries = await fsp.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path6.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path7.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -6116,7 +6341,7 @@ var DirectorStateCheckpoint = class {
 
 // src/coordination/checkpoint-wiring.ts
 import * as fsp3 from "node:fs/promises";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 async function appendSessionEvent(host, event) {
   if (!host.sessionWriter) return;
   try {
@@ -6164,7 +6389,7 @@ async function writeManifest(host) {
     }),
     usage: host.usage.snapshot()
   };
-  await fsp3.mkdir(path7.dirname(host.manifestPath), { recursive: true });
+  await fsp3.mkdir(path8.dirname(host.manifestPath), { recursive: true });
   await atomicWrite(host.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
   return host.manifestPath;
 }
@@ -7918,8 +8143,8 @@ function ensureKanbanTool(tools) {
 }
 
 // src/utils/instruction-file.ts
-import { readFileSync as readFileSync6, statSync as statSync3 } from "node:fs";
-import * as path8 from "node:path";
+import { readFileSync as readFileSync7, statSync as statSync3 } from "node:fs";
+import * as path9 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
@@ -7929,7 +8154,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync6(path8.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync7(path9.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -7945,11 +8170,11 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path8.dirname(fileURLToPath2(import.meta.url));
+  const here = path9.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path8.resolve(here, "../../instructions"),
-    path8.resolve(here, "../instructions"),
-    path8.resolve(here, "instructions")
+    path9.resolve(here, "../../instructions"),
+    path9.resolve(here, "../instructions"),
+    path9.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory2(a)) - Number(!isDirectory2(b)));
   return rootCandidates;
@@ -9547,12 +9772,12 @@ function rosterSummaryFromConfigs(roster) {
 
 // src/coordination/director-session.ts
 import * as fsp18 from "node:fs/promises";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 
 // src/storage/session-store.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
 import * as fsp17 from "node:fs/promises";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 
 // src/security/file-permissions.ts
 import { chmod } from "node:fs/promises";
@@ -9886,13 +10111,13 @@ var DefaultSecretScrubber = class {
 import { spawn } from "node:child_process";
 import * as fs2 from "node:fs";
 import * as net from "node:net";
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/session-catalog/endpoint.ts
 import { createHash as createHash2 } from "node:crypto";
 import * as os2 from "node:os";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 
 // src/session-catalog/protocol.ts
 var SESSION_CATALOG_PROTOCOL_VERSION = 1;
@@ -9905,7 +10130,7 @@ function encodeSessionCatalogMessage(message) {
 // src/session-catalog/endpoint.ts
 var SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
 function normalizedPath(value) {
-  const resolved = path9.resolve(value);
+  const resolved = path10.resolve(value);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function sessionCatalogProjectServerKey(projectDir) {
@@ -9916,10 +10141,10 @@ function sessionCatalogProjectServerEndpoint(projectDir) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\wrongstack-session-catalog-v${SESSION_CATALOG_PROTOCOL_VERSION}-${key}`;
   }
-  return path9.join(os2.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
+  return path10.join(os2.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
 }
 function sessionCatalogProjectServerMetadataPath(projectDir) {
-  return path9.join(projectDir, SESSION_CATALOG_METADATA_FILE);
+  return path10.join(projectDir, SESSION_CATALOG_METADATA_FILE);
 }
 
 // src/session-catalog/client.ts
@@ -9954,7 +10179,7 @@ function resolveSessionCatalogProjectServerUrl(moduleUrl = import.meta.url, exis
   return availability.kind === "available" ? availability.url : null;
 }
 function normalize2(value) {
-  const resolved = path10.resolve(value);
+  const resolved = path11.resolve(value);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function delay(ms) {
@@ -10471,12 +10696,12 @@ var color = {
 
 // src/utils/config-backup.ts
 import * as fs3 from "node:fs/promises";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 function configHistoryDir(globalRoot) {
-  return path11.join(globalRoot, "config-history");
+  return path12.join(globalRoot, "config-history");
 }
 function configSlug(absolutePath, globalRoot) {
-  const rel = path11.relative(globalRoot, absolutePath);
+  const rel = path12.relative(globalRoot, absolutePath);
   const normalized = rel.replace(/\\/g, "/").replace(/\.json$/i, "");
   return normalized.replace(/\//g, "-");
 }
@@ -10492,7 +10717,7 @@ async function backupConfigFile(filePath, paths) {
   const ts = now.toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
   const slug = configSlug(filePath, paths.globalRoot);
   const backupDir = configHistoryDir(paths.globalRoot);
-  const backupFile = path11.join(backupDir, `${slug}-${ts}.json`);
+  const backupFile = path12.join(backupDir, `${slug}-${ts}.json`);
   try {
     await fs3.mkdir(backupDir, { recursive: true });
     await fs3.writeFile(backupFile, currentContent, { mode: 384, encoding: "utf8" });
@@ -10559,11 +10784,6 @@ function deepMerge(base, patch, options = {}) {
   return out;
 }
 
-// src/types/blocks.ts
-function isTextBlock(b) {
-  return b.type === "text";
-}
-
 // src/utils/context-evidence.ts
 var MAX_DIGEST_CHARS = 4e3;
 function createContextEvidenceState() {
@@ -10790,7 +11010,7 @@ function isEmptyMessage(msg) {
 }
 
 // src/core/context.ts
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 
 // src/utils/tool-wire-compact.ts
 var TOOL_DESCRIPTION_MAX_CHARS = 400;
@@ -11893,6 +12113,12 @@ var Context = class _Context {
   setCurrentKanbanTask(taskId, boardId) {
     this.currentKanbanTaskId = taskId;
     this.currentKanbanBoardId = boardId;
+    const existing = this.meta["kanban"] && typeof this.meta["kanban"] === "object" ? this.meta["kanban"] : {};
+    this.state.setMeta("kanban", {
+      ...existing,
+      ...taskId ? { taskId } : { taskId: void 0 },
+      ...boardId ? { boardId } : { boardId: void 0 }
+    });
   }
   /**
    * Record a comprehensive file event for the audit trail.
@@ -11986,11 +12212,11 @@ var Context = class _Context {
    * Returns the resolved absolute path.
    */
   setWorkingDir(dir) {
-    const resolved = path12.isAbsolute(dir) ? path12.resolve(dir) : path12.resolve(this.projectRoot, dir);
+    const resolved = path13.isAbsolute(dir) ? path13.resolve(dir) : path13.resolve(this.projectRoot, dir);
     if (!this.allowOutsideProjectRoot) {
-      const root = path12.resolve(this.projectRoot);
-      const rel = path12.relative(root, resolved);
-      if (rel.startsWith("..") || path12.isAbsolute(rel)) {
+      const root = path13.resolve(this.projectRoot);
+      const rel = path13.relative(root, resolved);
+      if (rel.startsWith("..") || path13.isAbsolute(rel)) {
         throw new Error(`Working directory "${resolved}" is outside project root "${root}"`);
       }
     }
@@ -12419,10 +12645,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path44, errors, depth) {
+function walk(value, schema, path45, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path44 || "<root>",
+      path: path45 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -12430,7 +12656,7 @@ function walk(value, schema, path44, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path44 || "<root>",
+        path: path45 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -12439,7 +12665,7 @@ function walk(value, schema, path44, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path44 || "<root>",
+        path: path45 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -12451,7 +12677,7 @@ function walk(value, schema, path44, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path44, req),
+          path: joinPath(path45, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -12459,14 +12685,14 @@ function walk(value, schema, path44, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path44, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path45, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path44}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path45}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -12826,14 +13052,14 @@ function compileUserRegex(pattern, flags) {
 var MAX_SUBJECT_LEN = 64 * 1024;
 
 // src/utils/session-scoped-path.ts
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path13.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path13.relative(path13.resolve(dir), resolved);
-  if (rel.startsWith("..") || path13.isAbsolute(rel)) {
+  const resolved = path14.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path14.relative(path14.resolve(dir), resolved);
+  if (rel.startsWith("..") || path14.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -13588,6 +13814,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
   const obj = input;
   if (subjectKey) {
     const value = obj[subjectKey];
+    if (Array.isArray(value)) {
+      return escapeGlobSubject(JSON.stringify(value));
+    }
     if (typeof value === "string") {
       if (isPathSubjectKey(subjectKey)) {
         const normalized = normalizePathSubject(value);
@@ -13632,7 +13861,7 @@ function subjectForToolInput(toolName, input, subjectKey) {
 // src/storage/file-session-writer.ts
 import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
 import * as fsp7 from "node:fs/promises";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 import { createInterface } from "node:readline";
 
 // src/storage/session-workspace-checkpoints.ts
@@ -13898,7 +14127,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path14.join(opts.dir, `${path14.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path15.join(opts.dir, `${path15.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.checkpointCas = opts.checkpointCas;
@@ -14790,7 +15019,7 @@ var FileSessionWriter = class _FileSessionWriter {
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash3, randomUUID as randomUUID9 } from "node:crypto";
 import * as fsp8 from "node:fs/promises";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 
 // src/storage/storage-concurrency.ts
 async function mapWithConcurrency(items, concurrency, mapper) {
@@ -14821,13 +15050,13 @@ function sha256(content) {
   return createHash3("sha256").update(content).digest("hex");
 }
 function isInside(root, target) {
-  const relative8 = path15.relative(root, target);
-  return relative8 === "" || !relative8.startsWith("..") && !path15.isAbsolute(relative8);
+  const relative8 = path16.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path16.isAbsolute(relative8);
 }
 function normalizeRelative(input) {
-  if (!input || path15.isAbsolute(input)) return null;
+  if (!input || path16.isAbsolute(input)) return null;
   const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
-  const resolved = path15.posix.normalize(normalized);
+  const resolved = path16.posix.normalize(normalized);
   if (!resolved || resolved === "." || resolved === ".." || resolved.startsWith("../")) return null;
   return resolved;
 }
@@ -14842,8 +15071,8 @@ var SessionCheckpointCas = class {
   projectRoot;
   runGit;
   constructor(opts) {
-    this.rootDir = path15.resolve(opts.rootDir);
-    this.projectRoot = path15.resolve(opts.projectRoot);
+    this.rootDir = path16.resolve(opts.rootDir);
+    this.projectRoot = path16.resolve(opts.projectRoot);
     this.runGit = opts.runGit ?? defaultRunGit;
   }
   async capture(_sessionId, _promptIndex) {
@@ -14868,7 +15097,7 @@ var SessionCheckpointCas = class {
       relativePaths,
       CAPTURE_CONCURRENCY,
       async (relative8) => {
-        const absolute = path15.resolve(this.projectRoot, ...relative8.split("/"));
+        const absolute = path16.resolve(this.projectRoot, ...relative8.split("/"));
         if (!isInside(this.projectRoot, absolute)) {
           unresolved.push({ path: relative8, reason: "path escapes project root" });
           return null;
@@ -14877,8 +15106,8 @@ var SessionCheckpointCas = class {
           const stat15 = await fsp8.lstat(absolute);
           if (stat15.isSymbolicLink()) {
             const linkTarget = await fsp8.readlink(absolute);
-            const resolvedLink = path15.resolve(path15.dirname(absolute), linkTarget);
-            if (path15.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
+            const resolvedLink = path16.resolve(path16.dirname(absolute), linkTarget);
+            if (path16.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
               unresolved.push({
                 path: relative8,
                 reason: "symlink target escapes project root"
@@ -14940,7 +15169,7 @@ var SessionCheckpointCas = class {
     };
   }
   async materialize(checkpoint, targetRoot) {
-    const target = path15.resolve(targetRoot);
+    const target = path16.resolve(targetRoot);
     if (target === this.projectRoot) {
       throw new Error("Refusing to materialize a workspace checkpoint over the parent project root");
     }
@@ -14980,10 +15209,10 @@ var SessionCheckpointCas = class {
       try {
         const output = await this.safeOutputPath(target, realTarget, entry.path);
         if (entry.state === "symlink") {
-          if (path15.isAbsolute(entry.linkTarget)) {
+          if (path16.isAbsolute(entry.linkTarget)) {
             throw new Error("absolute symlink target refused");
           }
-          const resolvedLink = path15.resolve(path15.dirname(output), entry.linkTarget);
+          const resolvedLink = path16.resolve(path16.dirname(output), entry.linkTarget);
           if (!isInside(target, resolvedLink)) throw new Error("symlink target escapes checkpoint root");
         }
         prepared.push({
@@ -15011,7 +15240,7 @@ var SessionCheckpointCas = class {
           await fsp8.unlink(output).catch((err) => {
             if (err.code !== "ENOENT") throw err;
           });
-          await fsp8.mkdir(path15.dirname(output), { recursive: true });
+          await fsp8.mkdir(path16.dirname(output), { recursive: true });
           await fsp8.symlink(entry.linkTarget, output);
           writtenFiles.push(entry.path);
           continue;
@@ -15028,15 +15257,15 @@ var SessionCheckpointCas = class {
   }
   objectPath(hash2) {
     if (!HASH_RE.test(hash2)) throw new Error(`Invalid CAS object hash: ${hash2}`);
-    return path15.join(this.rootDir, "objects", hash2.slice(0, 2), hash2.slice(2));
+    return path16.join(this.rootDir, "objects", hash2.slice(0, 2), hash2.slice(2));
   }
   manifestPath(hash2) {
     if (!HASH_RE.test(hash2)) throw new Error(`Invalid checkpoint manifest hash: ${hash2}`);
-    return path15.join(this.rootDir, "manifests", `${hash2}.json`);
+    return path16.join(this.rootDir, "manifests", `${hash2}.json`);
   }
   async putBlob(hash2, content) {
     const target = this.objectPath(hash2);
-    await fsp8.mkdir(path15.dirname(target), { recursive: true });
+    await fsp8.mkdir(path16.dirname(target), { recursive: true });
     try {
       const existing = await fsp8.readFile(target);
       if (sha256(existing) !== hash2) throw new Error(`Corrupt CAS object collision: ${hash2}`);
@@ -15044,9 +15273,9 @@ var SessionCheckpointCas = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    const temp = path15.join(
-      path15.dirname(target),
-      `.${path15.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
+    const temp = path16.join(
+      path16.dirname(target),
+      `.${path16.basename(target)}.${process.pid}.${randomUUID9()}.tmp`
     );
     let handle;
     try {
@@ -15107,7 +15336,7 @@ var SessionCheckpointCas = class {
   async safeOutputPath(target, realTarget, relative8) {
     const normalized = normalizeRelative(relative8);
     if (!normalized) throw new Error("invalid relative path");
-    const output = path15.resolve(target, ...normalized.split("/"));
+    const output = path16.resolve(target, ...normalized.split("/"));
     if (!isInside(target, output)) throw new Error("path escapes checkpoint target");
     let probe = output;
     for (; ; ) {
@@ -15117,7 +15346,7 @@ var SessionCheckpointCas = class {
         return output;
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
-        const parent = path15.dirname(probe);
+        const parent = path16.dirname(probe);
         if (parent === probe) throw err;
         probe = parent;
       }
@@ -15181,13 +15410,13 @@ function generateSessionId(startedAt, _model) {
 }
 
 // src/storage/session-id-resolver.ts
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 function resolveSessionId(query, candidateIds) {
   const normalized = query.trim();
   if (!normalized) return { status: "missing", query: normalized };
   const uniqueIds = [...new Set(candidateIds)];
   if (uniqueIds.includes(normalized)) return { status: "resolved", id: normalized };
-  const leaf = (id) => path16.posix.basename(id.replace(/\\/g, "/"));
+  const leaf = (id) => path17.posix.basename(id.replace(/\\/g, "/"));
   const exactLeafMatches = uniqueIds.filter((id) => leaf(id) === normalized);
   if (exactLeafMatches.length === 1) {
     return { status: "resolved", id: exactLeafMatches[0] };
@@ -15241,13 +15470,13 @@ function scrubPersistedSessionSummary(summary, scrubber2) {
 // src/storage/session-resume-validation.ts
 import { createHash as createHash4 } from "node:crypto";
 import * as fsp9 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 var MAX_REVALIDATE_BYTES = 5 * 1024 * 1024;
 var VALIDATION_CONCURRENCY = 8;
 var NOTICE_PATH_LIMIT = 20;
 function isInside2(root, target) {
-  const relative8 = path17.relative(root, target);
-  return relative8 === "" || !relative8.startsWith("..") && !path17.isAbsolute(relative8);
+  const relative8 = path18.relative(root, target);
+  return relative8 === "" || !relative8.startsWith("..") && !path18.isAbsolute(relative8);
 }
 function errno(err) {
   return err && typeof err === "object" && "code" in err ? String(err.code) : void 0;
@@ -15258,7 +15487,7 @@ function latestObservations(events, projectRoot) {
     if (event.type !== "file_observation" || typeof event.path !== "string" || event.path.length === 0 || typeof event.hash !== "string" || !/^[a-f\d]{64}$/i.test(event.hash)) {
       continue;
     }
-    const normalized = path17.resolve(projectRoot, event.path);
+    const normalized = path18.resolve(projectRoot, event.path);
     latest.set(normalized, {
       path: normalized,
       hash: event.hash.toLowerCase(),
@@ -15316,7 +15545,7 @@ async function validateOne(observation, lexicalRoot, realRoot) {
   }
 }
 async function validateResumeFileObservations(events, projectRoot) {
-  const lexicalRoot = path17.resolve(projectRoot);
+  const lexicalRoot = path18.resolve(projectRoot);
   const realRoot = await fsp9.realpath(lexicalRoot).catch(() => lexicalRoot);
   const observations = latestObservations(events, lexicalRoot);
   const results = await mapWithConcurrency(
@@ -15332,9 +15561,9 @@ async function validateResumeFileObservations(events, projectRoot) {
 }
 function formatResumeValidationNotice(validation, projectRoot) {
   if (validation.staleFiles.length === 0) return null;
-  const root = path17.resolve(projectRoot);
+  const root = path18.resolve(projectRoot);
   const shown = validation.staleFiles.slice(0, NOTICE_PATH_LIMIT).map((entry) => {
-    const relative8 = path17.relative(root, entry.path);
+    const relative8 = path18.relative(root, entry.path);
     const display = isInside2(root, entry.path) ? relative8 || "." : entry.path;
     return `- ${JSON.stringify(display)} [${entry.status}]`;
   });
@@ -15359,22 +15588,22 @@ function formatInterruptedToolNotice(pendingToolUseCount) {
 
 // src/storage/session-store/delete-session-artifacts.ts
 import * as fsp10 from "node:fs/promises";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 
 // src/storage/session-store/paths.ts
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 function sessionPath(storeDir, id, ext) {
   return sessionScopedPath(storeDir, id, ext);
 }
 function shardManifestPath(storeDir, shardKey) {
-  return shardKey ? path18.join(storeDir, shardKey, "_manifest.json") : path18.join(storeDir, "_manifest.json");
+  return shardKey ? path19.join(storeDir, shardKey, "_manifest.json") : path19.join(storeDir, "_manifest.json");
 }
 function shardKeyForSessionId(id) {
-  const dirName = path18.dirname(id);
+  const dirName = path19.dirname(id);
   return dirName === "." ? "" : dirName;
 }
 async function ensureShardDir(storeDir, id) {
-  const dirPath = path18.dirname(sessionScopedPath(storeDir, id, ""));
+  const dirPath = path19.dirname(sessionScopedPath(storeDir, id, ""));
   await ensureDir(dirPath);
   return dirPath;
 }
@@ -15385,9 +15614,9 @@ async function deleteSessionArtifacts({
   id,
   jsonlPath
 }) {
-  const shardDir = path19.dirname(jsonlPath);
-  const base = path19.basename(id);
-  const sessDir = path19.join(shardDir, base);
+  const shardDir = path20.dirname(jsonlPath);
+  const base = path20.basename(id);
+  const sessDir = path20.join(shardDir, base);
   const deletions = [
     fsp10.unlink(jsonlPath),
     fsp10.unlink(sessionPath(rootDir, id, ".summary.json")),
@@ -15446,7 +15675,7 @@ function isSessionJsonlFileName(name) {
 
 // src/storage/session-store/directory-session-files.ts
 import * as fsp11 from "node:fs/promises";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function sessionIdForFile(prefix, name) {
   const base = name.replace(/\.jsonl$/, "");
   return prefix ? `${prefix}/${base}` : base;
@@ -15468,12 +15697,12 @@ async function collectSessionFiles(dir, prefix = "", depth = 0) {
     if (entry.isDirectory()) {
       dirEntries.push(entry);
     } else if (entry.isFile() && isSessionJsonlFileName(entry.name)) {
-      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path20.join(dir, entry.name) });
+      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path21.join(dir, entry.name) });
     }
   }
   const childFileArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionFiles(path20.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionFiles(path21.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childFileArrays.flat(), ...files];
@@ -15497,7 +15726,7 @@ async function collectSessionIds(dir, prefix = "", depth = 0) {
   }
   const childIdArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionIds(path20.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionIds(path21.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childIdArrays.flat(), ...fileIds];
@@ -16018,7 +16247,7 @@ function emitDamaged(params, detail) {
 
 // src/storage/session-store/prune-helpers.ts
 import * as fsp13 from "node:fs/promises";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function isPrunableSessionJsonl(name) {
   return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
 }
@@ -16026,7 +16255,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
   const cutoff = Date.now() - maxAgeDays * 864e5;
   let deleted = 0;
   const pruneFile = async (dir, name, prefix) => {
-    const jsonlPath = path21.join(dir, name);
+    const jsonlPath = path22.join(dir, name);
     try {
       const stat15 = await fsp13.stat(jsonlPath);
       if (stat15.mtimeMs >= cutoff) return;
@@ -16045,7 +16274,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
       continue;
     }
     if (!entry.isDirectory()) continue;
-    const dateDir = path21.join(storeDir, entry.name);
+    const dateDir = path22.join(storeDir, entry.name);
     const files = await fsp13.readdir(dateDir, { withFileTypes: true }).catch(() => []);
     for (const file of files) {
       if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
@@ -16054,7 +16283,7 @@ async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dateDir = path21.join(storeDir, entry.name);
+    const dateDir = path22.join(storeDir, entry.name);
     try {
       const remaining = await fsp13.readdir(dateDir);
       if (remaining.length === 0) {
@@ -16407,9 +16636,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
   static LIST_SCAN_CONCURRENCY = 32;
   constructor(opts) {
     this.dir = opts.dir;
-    this.projectRoot = opts.projectRoot ? path22.resolve(opts.projectRoot) : void 0;
+    this.projectRoot = opts.projectRoot ? path23.resolve(opts.projectRoot) : void 0;
     this.checkpointCas = this.projectRoot ? new SessionCheckpointCas({
-      rootDir: path22.join(this.dir, "_cas"),
+      rootDir: path23.join(this.dir, "_cas"),
       projectRoot: this.projectRoot
     }) : void 0;
     this.events = opts.events;
@@ -16420,7 +16649,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     this.onAppendBatch = opts.onAppendBatch;
     const builtRuntime = import.meta.url.includes("/dist/");
     this.catalogClient = this.projectRoot && (builtRuntime || process.env["WRONGSTACK_SESSION_CATALOG_FORCE"] === "1") && resolveSessionCatalogProjectServerUrl() ? new SessionCatalogProjectClient({
-      projectDir: path22.dirname(this.dir),
+      projectDir: path23.dirname(this.dir),
       projectRoot: this.projectRoot
     }) : void 0;
   }
@@ -16452,7 +16681,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
   // ── Storage event helpers ───────────────────────────────────────────────────
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path22.join(this.dir, "_index.jsonl");
+    return path23.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
@@ -16665,7 +16894,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path22.dirname(file),
+          dir: path23.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           checkpointCas: this.checkpointCas,
@@ -17065,7 +17294,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     });
   }
   async collectSessionFilesInShard(shardKey) {
-    const dir = shardKey ? path22.join(this.dir, shardKey) : this.dir;
+    const dir = shardKey ? path23.join(this.dir, shardKey) : this.dir;
     const entries = await this.collectSessionFiles(dir, shardKey);
     return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
@@ -17258,7 +17487,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const maintenance = this.catalogClient ? await this.catalogClient.call("acquire_maintenance", {
       sessionId: canonical,
       operation: "clear",
-      holderId: this.maintenanceHolderId
+      holderId: this.maintenanceHolderId,
+      // The catalog store runs inside the detached project daemon; without
+      // our pid it cannot tell "this TUI clearing its own session" from
+      // "another running wstack" and refuses every /clear as `is live`.
+      holderPid: process.pid
     }) : void 0;
     await this.ensureShardDir(canonical);
     const file = this.sessionPath(canonical, ".jsonl");
@@ -17348,9 +17581,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path23.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path24.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path23.join(opts.sessionsRoot, runId);
+    dir = path24.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -17374,7 +17607,7 @@ function makeDirectorSessionFactory(opts) {
 }
 async function readDirectorSubagentSession(args) {
   if (!args.sessionsRoot) return null;
-  const filePath = path23.join(args.sessionsRoot, args.directorRunId, `${args.subagentId}.jsonl`);
+  const filePath = path24.join(args.sessionsRoot, args.directorRunId, `${args.subagentId}.jsonl`);
   let raw;
   try {
     raw = await fsp18.readFile(filePath, "utf8");
@@ -21688,7 +21921,7 @@ function resolveContextWindowPolicy(config = {}, overrideMode) {
 
 // src/infrastructure/logger.ts
 import * as fsp20 from "node:fs/promises";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 var LEVEL_RANK2 = {
   error: 0,
   warn: 1,
@@ -21759,7 +21992,7 @@ var DefaultLogger = class _DefaultLogger {
     this.stderr = opts.stderr !== false;
     this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
     if (this.file) {
-      const dir = path24.dirname(this.file);
+      const dir = path25.dirname(this.file);
       this._tail = this._tail.then(async () => {
         await fsp20.mkdir(dir, { recursive: true });
       }).catch(() => void 0);
@@ -22519,7 +22752,7 @@ var KNOWN_TOKEN_NAMES = Object.values(KNOWN_TOKEN_GROUPS).flat();
 // src/execution/design-kit-loader.ts
 import { existsSync as existsSync4 } from "node:fs";
 import * as fs4 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var KIT_FILE = "KIT.md";
 var TOKENS_FILE = "tokens.json";
@@ -22625,7 +22858,7 @@ var DefaultDesignKitLoader = class {
       }
       for (const e of entries) {
         if (!e.isDirectory()) continue;
-        const kitFile = path25.join(dir, e.name, KIT_FILE);
+        const kitFile = path26.join(dir, e.name, KIT_FILE);
         try {
           const raw = await fs4.readFile(kitFile, "utf8");
           const fm = parseKitFrontmatter(raw);
@@ -22700,7 +22933,7 @@ var DefaultDesignKitLoader = class {
     const m = await this.find(id);
     let tokens;
     if (m) {
-      const tokensPath = path25.join(path25.dirname(m.path), TOKENS_FILE);
+      const tokensPath = path26.join(path26.dirname(m.path), TOKENS_FILE);
       try {
         const raw = await fs4.readFile(tokensPath, "utf8");
         tokens = JSON.parse(raw);
@@ -22762,12 +22995,12 @@ function mergeKitTokens(base, own) {
 }
 function resolveBundledDesignKitsDir() {
   try {
-    const here = path25.dirname(fileURLToPath4(import.meta.url));
+    const here = path26.dirname(fileURLToPath4(import.meta.url));
     const candidates = [
-      path25.join(here, "design-kits"),
-      path25.join(here, "..", "design-kits"),
-      path25.join(here, "..", "..", "design-kits"),
-      path25.join(here, "..", "..", "..", "design-kits")
+      path26.join(here, "design-kits"),
+      path26.join(here, "..", "design-kits"),
+      path26.join(here, "..", "..", "design-kits"),
+      path26.join(here, "..", "..", "..", "design-kits")
     ];
     for (const c of candidates) {
       if (existsSync4(c)) return c;
@@ -22806,10 +23039,10 @@ function _resetDesignKitLoaderMemo() {
 // src/execution/design-project-store.ts
 import { existsSync as existsSync5 } from "node:fs";
 import * as fs5 from "node:fs/promises";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 var DESIGN_DIR = ".design";
 function designProjectDir(projectRoot) {
-  return path26.join(projectRoot, DESIGN_DIR);
+  return path27.join(projectRoot, DESIGN_DIR);
 }
 var RULE_FILES = ["rules.md", "RULES.md", "design.md"];
 var rulesCache = /* @__PURE__ */ new Map();
@@ -22824,7 +23057,7 @@ async function loadProjectDesignRules(projectRoot) {
   let rules;
   for (const name of RULE_FILES) {
     try {
-      const txt = await fs5.readFile(path26.join(designProjectDir(projectRoot), name), "utf8");
+      const txt = await fs5.readFile(path27.join(designProjectDir(projectRoot), name), "utf8");
       if (txt.trim()) {
         rules = txt.trim();
         break;
@@ -22850,7 +23083,7 @@ function parseOverrides(value) {
 }
 async function loadActiveKit(projectRoot) {
   try {
-    const raw = await fs5.readFile(path26.join(designProjectDir(projectRoot), "active.json"), "utf8");
+    const raw = await fs5.readFile(path27.join(designProjectDir(projectRoot), "active.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed.kit === "string") {
       return {
@@ -22884,7 +23117,7 @@ function applyTokenOverrides(tokens, overrides) {
 async function ensureDesignDir(projectRoot) {
   const dir = designProjectDir(projectRoot);
   await fs5.mkdir(dir, { recursive: true });
-  const gi = path26.join(dir, ".gitignore");
+  const gi = path27.join(dir, ".gitignore");
   if (!existsSync5(gi)) {
     try {
       await fs5.writeFile(gi, "*\n");
@@ -22898,11 +23131,11 @@ async function recordKitChoice(projectRoot, kit, stack, source, isoTime, overrid
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit, stack: stack ?? null };
     if (overrides && Object.keys(overrides).length > 0) record.overrides = overrides;
-    await fs5.writeFile(path26.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs5.writeFile(path27.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const line = `- ${isoTime} \xB7 kit=${kit}${stack ? ` stack=${stack}` : ""} \xB7 via=${source}
 `;
-    await fs5.appendFile(path26.join(dir, "decisions.md"), line);
+    await fs5.appendFile(path27.join(dir, "decisions.md"), line);
   } catch {
   }
 }
@@ -22918,11 +23151,11 @@ async function recordOverrides(projectRoot, patch, isoTime) {
     const dir = await ensureDesignDir(projectRoot);
     const record = { kit: active.kit, stack: active.stack ?? null };
     if (Object.keys(merged).length > 0) record.overrides = merged;
-    await fs5.writeFile(path26.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
+    await fs5.writeFile(path27.join(dir, "active.json"), `${JSON.stringify(record, null, 2)}
 `);
     const keys = Object.keys(patch).join(",");
     await fs5.appendFile(
-      path26.join(dir, "decisions.md"),
+      path27.join(dir, "decisions.md"),
       `- ${isoTime} \xB7 kit=${active.kit} \xB7 override=${keys} \xB7 via=set
 `
     );
@@ -22932,7 +23165,7 @@ async function recordOverrides(projectRoot, patch, isoTime) {
 }
 async function clearPersistedActiveKit(projectRoot) {
   try {
-    await fs5.rm(path26.join(designProjectDir(projectRoot), "active.json"), { force: true });
+    await fs5.rm(path27.join(designProjectDir(projectRoot), "active.json"), { force: true });
   } catch {
   }
 }
@@ -23072,12 +23305,12 @@ function verifyFiles(tokens, files) {
   const violations = [];
   let onPalette = 0;
   let offPalette = 0;
-  for (const { path: path44, text } of files) {
+  for (const { path: path45, text } of files) {
     const lines = text.split("\n");
     lines.forEach((lineText, i) => {
       const lineNo = i + 1;
       const flag = (snippet, reason, axis = "color") => {
-        violations.push({ file: path44, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
+        violations.push({ file: path45, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
       };
       for (const re of [HEX_RE, FUNC_COLOR_RE]) {
         re.lastIndex = 0;
@@ -26960,7 +27193,7 @@ Summarize the following message range:`;
 
 // src/execution/skill-loader.ts
 import * as fs6 from "node:fs/promises";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 
 // src/skills/foreign-sources.ts
 var FOREIGN_SKILL_TOOLS = [
@@ -27024,7 +27257,7 @@ async function entryIsDirectory(dir, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return (await fs6.stat(path27.join(dir, entry.name))).isDirectory();
+      return (await fs6.stat(path28.join(dir, entry.name))).isDirectory();
     } catch {
       return false;
     }
@@ -27048,7 +27281,7 @@ var DefaultSkillLoader = class {
       for (const tool of FOREIGN_SKILL_TOOLS) {
         if (!foreignIds.includes(tool.id)) continue;
         dirs.push({
-          dir: path27.join(root, "." + tool.id, tool.subdir),
+          dir: path28.join(root, "." + tool.id, tool.subdir),
           source: "foreign",
           originTool: tool.id
         });
@@ -27078,7 +27311,7 @@ var DefaultSkillLoader = class {
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
-          const skillFile = path27.join(dir, e.name, "SKILL.md");
+          const skillFile = path28.join(dir, e.name, "SKILL.md");
           let raw;
           try {
             raw = await fs6.readFile(skillFile, "utf8");
@@ -27210,7 +27443,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const savePath = path27.join(path27.dirname(m.path), "SKILL.save.md");
+    const savePath = path28.join(path28.dirname(m.path), "SKILL.save.md");
     let result;
     try {
       result = await fs6.readFile(savePath, "utf8");
@@ -27244,11 +27477,11 @@ function parseDescriptionFromText(desc) {
 
 // src/execution/prompt-loader.ts
 import * as fs8 from "node:fs/promises";
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 
 // src/storage/prompt-store.ts
 import * as fs7 from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 var SCHEMA_VERSION = 2;
 function migratePromptEntry(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -27314,7 +27547,7 @@ var DefaultPromptStore = class {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fs7.readFile(path28.join(this.dir, file), "utf8")
+            await fs7.readFile(path29.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -27328,7 +27561,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path28.join(this.dir, `${id}.json`);
+    const file = path29.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fs7.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
@@ -27338,12 +27571,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path28.join(this.dir, `${entry.id}.json`);
+    const file = path29.join(this.dir, `${entry.id}.json`);
     const raw = { version: SCHEMA_VERSION, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path28.join(this.dir, `${id}.json`);
+    const file = path29.join(this.dir, `${id}.json`);
     try {
       await fs7.unlink(file);
       return true;
@@ -27432,7 +27665,7 @@ var DefaultPromptLoader = class {
   constructor(opts) {
     this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
     this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
-    this.builtinDir = opts.bundledDir ? path29.join(opts.bundledDir, "prompts") : void 0;
+    this.builtinDir = opts.bundledDir ? path30.join(opts.bundledDir, "prompts") : void 0;
   }
   async list() {
     if (this.cache) return this.cache;
@@ -27564,7 +27797,7 @@ async function walkJson(dir) {
     return out;
   }
   for (const e of entries) {
-    const full = path29.join(dir, e.name);
+    const full = path30.join(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkJson(full));
     } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
@@ -27753,7 +27986,7 @@ function readPolicy(ctx) {
 // src/execution/tool-executor.ts
 import { randomUUID as randomUUID17 } from "node:crypto";
 import * as fs10 from "node:fs/promises";
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // src/observability/process-telemetry.ts
@@ -27765,13 +27998,15 @@ function runWithProcessTelemetry(context, run) {
 
 // src/security/kanban-boundary.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 import {
+  evaluateContractGraphReadiness,
   evaluateKanbanBoundaryOpaque,
   evaluateKanbanBoundaryPath,
   readBoard,
   resolveKanbanBoundaryLayers
 } from "@wrongstack/kanban";
+var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo"]);
 var PATH_KEYS = /* @__PURE__ */ new Set([
   "path",
   "paths",
@@ -27796,12 +28031,60 @@ var TOOL_PATH_KEYS = {
   // filesystem target in language_info. Keep ambiguous names tool-specific.
   language_info: ["target"]
 };
-async function evaluateToolKanbanBoundary(tool, input, ctx) {
+async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
+  if (tool.name === "kanban") return { decision: "allow" };
   const identity = resolveKanbanIdentity(ctx);
-  if (!identity.boardId) return { decision: "allow" };
+  const governanceRequired = options.requireGovernance && isGovernedMutation(tool, input);
+  if (!identity.boardId) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: "Kanban governance is mandatory before product mutation. Create a managed card, add its required details and executable acceptance criteria, then call kanban start_task to bind it to this run."
+    } : { decision: "allow" };
+  }
   const board = await readBoard(identity.policyRoot ?? ctx.projectRoot, identity.boardId);
-  if (!board) return { decision: "allow" };
+  if (!board) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: `Active Kanban board not found: ${identity.boardId}. Recreate or select a valid managed card before mutation.`,
+      boardId: identity.boardId,
+      ...identity.taskId ? { taskId: identity.taskId } : {}
+    } : { decision: "allow" };
+  }
   const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
+  if (governanceRequired) {
+    if (!identity.taskId) {
+      return {
+        decision: "block",
+        reason: "Kanban governance requires an active task, not only a board. Complete the card details and call kanban start_task before mutation.",
+        boardId: board.id
+      };
+    }
+    if (!task) {
+      return {
+        decision: "block",
+        reason: `Active Kanban task not found: ${identity.taskId}. Call kanban start_task with a valid card.`,
+        boardId: board.id,
+        taskId: identity.taskId
+      };
+    }
+    const readiness = evaluateContractGraphReadiness(board, task.id);
+    if (!readiness.ready) {
+      return {
+        decision: "block",
+        reason: "Active card is not implementation-ready: " + readiness.issues.map((issue) => issue.message).join(" | "),
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+    if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {
+      return {
+        decision: "block",
+        reason: "Active card must be in Running with a live assignment before product mutation. Call kanban start_task after completing the required card details.",
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+  }
   if (identity.leaseId && task?.assignment) {
     const caps2 = tool.capabilities ?? [];
     const isWrite = caps2.includes("fs.write") || caps2.includes("fs.write.outside-project") || caps2.some((c) => c.startsWith("shell."));
@@ -27837,6 +28120,19 @@ async function evaluateToolKanbanBoundary(tool, input, ctx) {
     ...task ? { taskId: task.id } : {}
   };
 }
+function isGovernedMutation(tool, input) {
+  if (!tool.mutating || GOVERNANCE_CONTROL_TOOLS.has(tool.name)) return false;
+  if (tool.capabilities?.includes("tool.meta")) return false;
+  if (tool.name === "git") {
+    const command = input["command"];
+    if (command === "status" || command === "log" || command === "diff") return false;
+    if (command === "worktree" && input["worktreeAction"] === "list") return false;
+  }
+  const capabilities = tool.capabilities ?? [];
+  return capabilities.some(
+    (capability) => capability === "fs.write" || capability === "fs.write.outside-project" || capability === "package.install" || capability === "tool.mutate.any" || capability.startsWith("shell.") || capability === "net.outbound"
+  );
+}
 function resolveKanbanIdentity(ctx) {
   const metaKanban = ctx.meta["kanban"];
   const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
@@ -27854,10 +28150,10 @@ function resolveKanbanIdentity(ctx) {
 async function extractCandidatePaths(toolName, input, ctx) {
   if (toolName === "patch" && typeof input["patch"] === "string") {
     const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
-    const directory = path30.isAbsolute(directoryInput) ? directoryInput : path30.resolve(ctx.workingDir, directoryInput);
+    const directory = path31.isAbsolute(directoryInput) ? directoryInput : path31.resolve(ctx.workingDir, directoryInput);
     const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
     const targets = extractPatchTargets(input["patch"], strip).map(
-      (target) => relativeToProject(path30.resolve(directory, target), ctx.projectRoot)
+      (target) => relativeToProject(path31.resolve(directory, target), ctx.projectRoot)
     );
     return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
   }
@@ -27867,7 +28163,7 @@ async function extractCandidatePaths(toolName, input, ctx) {
   collectPathValues(input, values, pathKeys);
   if (toolName === "scaffold" && typeof input["name"] === "string") {
     const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
-    values.push(path30.join(cwd, input["name"]));
+    values.push(path31.join(cwd, input["name"]));
   }
   const candidates = [
     ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
@@ -27875,21 +28171,21 @@ async function extractCandidatePaths(toolName, input, ctx) {
   return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
 }
 async function canonicalizeCandidatePath(candidate, ctx) {
-  if (path30.isAbsolute(candidate)) return candidate;
-  const absolute = path30.resolve(ctx.projectRoot, candidate);
+  if (path31.isAbsolute(candidate)) return candidate;
+  const absolute = path31.resolve(ctx.projectRoot, candidate);
   const canonicalRoot = await realpath3(ctx.projectRoot).catch(() => ctx.projectRoot);
   let probe = absolute;
   const missingSegments = [];
   while (true) {
     try {
-      const canonical = path30.join(await realpath3(probe), ...missingSegments);
+      const canonical = path31.join(await realpath3(probe), ...missingSegments);
       return relativeToProject(canonical, canonicalRoot);
     } catch (cause) {
       const code = cause.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
-      const parent = path30.dirname(probe);
+      const parent = path31.dirname(probe);
       if (parent === probe) return absolute;
-      missingSegments.unshift(path30.basename(probe));
+      missingSegments.unshift(path31.basename(probe));
       probe = parent;
     }
   }
@@ -27912,12 +28208,12 @@ function splitPathList(value) {
   return value.split(",").map((item) => item.trim()).filter(Boolean);
 }
 function resolveInputPath(value, ctx) {
-  const absolute = path30.isAbsolute(value) ? value : path30.resolve(ctx.workingDir, value);
+  const absolute = path31.isAbsolute(value) ? value : path31.resolve(ctx.workingDir, value);
   return relativeToProject(absolute, ctx.projectRoot);
 }
 function relativeToProject(absolute, projectRoot) {
-  const relative8 = path30.relative(projectRoot, absolute).replace(/\\/g, "/");
-  return relative8.startsWith("../") || path30.isAbsolute(relative8) ? absolute : relative8 || ".";
+  const relative8 = path31.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative8.startsWith("../") || path31.isAbsolute(relative8) ? absolute : relative8 || ".";
 }
 function extractPatchTargets(patchText, strip) {
   const targets = [];
@@ -27942,7 +28238,7 @@ var GOVERNED_TOOL_EXECUTOR_META_KEY = "toolExecutor.executeGoverned";
 // src/execution/tool-executor-support.ts
 import { createHash as createHash8, randomUUID as randomUUID16 } from "node:crypto";
 import * as fs9 from "node:fs/promises";
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 
 // src/types/tool-markers.ts
 var MALFORMED_ARG_MARKERS = ["__raw", "__raw_arguments", "_raw"];
@@ -28067,11 +28363,11 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
     return content;
   }
   try {
-    const dir = path31.join(wstackGlobalRoot(), "tool-output");
+    const dir = path32.join(wstackGlobalRoot(), "tool-output");
     await fs9.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const filePath = path31.join(dir, `${stamp}-${safeTool}-${randomUUID16()}.log`);
+    const filePath = path32.join(dir, `${stamp}-${safeTool}-${randomUUID16()}.log`);
     await fs9.writeFile(filePath, content, "utf8");
     const marker = `[full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
     const fixedBytes = Buffer.byteLength(marker + TOOL_OUTPUT_ARTIFACT_OMISSION, "utf8");
@@ -28130,6 +28426,41 @@ function sliceUtf8Suffix(text, maxBytes) {
   return text.slice(start);
 }
 
+// src/execution/tool-error-taxonomy.ts
+function toolErrorResult(use, err, opts = {}) {
+  const { category, retryable, detail } = classifyToolError(err);
+  const rawMessage = err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error";
+  const userMessage = opts.scrubber ? opts.scrubber(rawMessage) : rawMessage;
+  const info = {
+    category,
+    retryable,
+    userMessage,
+    ...detail !== void 0 ? { detail } : {}
+  };
+  const prefix = formatErrorPrefix(category, retryable);
+  const detailSuffix = detail ? ` [${detail}]` : "";
+  return {
+    type: "tool_result",
+    tool_use_id: use.id,
+    content: `${prefix}: ${userMessage}${detailSuffix}`,
+    is_error: true,
+    // Attach structured info for programmatic consumers (retry logic,
+    // audit log, observability).
+    _toolErrorInfo: info
+  };
+}
+function formatErrorPrefix(category, retryable) {
+  const label = CATEGORY_LABELS[category] ?? "Error";
+  return retryable ? `${label} (retryable)` : label;
+}
+var CATEGORY_LABELS = {
+  ["transient" /* TRANSIENT */]: "Transient error",
+  ["not_found" /* NOT_FOUND */]: "Not found",
+  ["permission" /* PERMISSION */]: "Permission denied",
+  ["validation" /* VALIDATION */]: "Validation error",
+  ["fatal" /* FATAL */]: "Error"
+};
+
 // src/execution/tool-executor-logging.ts
 function toolLogBase(ctx, use, toolName, durationMs) {
   return {
@@ -28235,41 +28566,6 @@ function blockedByHookResult(use, reason) {
   };
 }
 
-// src/execution/tool-error-taxonomy.ts
-function toolErrorResult(use, err, opts = {}) {
-  const { category, retryable, detail } = classifyToolError(err);
-  const rawMessage = err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error";
-  const userMessage = opts.scrubber ? opts.scrubber(rawMessage) : rawMessage;
-  const info = {
-    category,
-    retryable,
-    userMessage,
-    ...detail !== void 0 ? { detail } : {}
-  };
-  const prefix = formatErrorPrefix(category, retryable);
-  const detailSuffix = detail ? ` [${detail}]` : "";
-  return {
-    type: "tool_result",
-    tool_use_id: use.id,
-    content: `${prefix}: ${userMessage}${detailSuffix}`,
-    is_error: true,
-    // Attach structured info for programmatic consumers (retry logic,
-    // audit log, observability).
-    _toolErrorInfo: info
-  };
-}
-function formatErrorPrefix(category, retryable) {
-  const label = CATEGORY_LABELS[category] ?? "Error";
-  return retryable ? `${label} (retryable)` : label;
-}
-var CATEGORY_LABELS = {
-  ["transient" /* TRANSIENT */]: "Transient error",
-  ["not_found" /* NOT_FOUND */]: "Not found",
-  ["permission" /* PERMISSION */]: "Permission denied",
-  ["validation" /* VALIDATION */]: "Validation error",
-  ["fatal" /* FATAL */]: "Error"
-};
-
 // src/execution/tool-executor-stream.ts
 async function executeStreamedTool({
   tool,
@@ -28558,7 +28854,9 @@ ${errorDetails}`,
           return { result, tool, durationMs: Date.now() - start };
         }
       }
-      const boundary = await evaluateToolKanbanBoundary(tool, use.input, ctx);
+      const boundary = await evaluateToolKanbanBoundary(tool, use.input, ctx, {
+        requireGovernance: this.opts.requireKanbanGovernance
+      });
       if (boundary.decision === "block") {
         const result = {
           type: "tool_result",
@@ -28669,7 +28967,7 @@ ${errorDetails}`,
         const inputPath = use.input && typeof use.input === "object" ? use.input.path : void 0;
         const caps = tool.capabilities ?? [];
         const hasFileCapability = caps.includes("fs.read") || caps.includes("fs.write");
-        const absPath = hasFileCapability && typeof inputPath === "string" ? path32.isAbsolute(inputPath) ? inputPath : path32.resolve(ctx.projectRoot, inputPath) : void 0;
+        const absPath = hasFileCapability && typeof inputPath === "string" ? path33.isAbsolute(inputPath) ? inputPath : path33.resolve(ctx.projectRoot, inputPath) : void 0;
         let writeTargetExisted;
         if (tool.name === "write" && caps.includes("fs.write") && absPath) {
           writeTargetExisted = await fs10.stat(absPath).then(
@@ -29545,27 +29843,27 @@ function codexModelMeta(id) {
 
 // src/models/mode-store.ts
 import * as fs11 from "node:fs/promises";
-import * as path34 from "node:path";
+import * as path35 from "node:path";
 
 // src/types/mode-prompts.ts
-import { readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
-import * as path33 from "node:path";
+import { readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
+import * as path34 from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function modePrompt(id) {
   for (const dir of modePromptDirCandidates()) {
     try {
-      return readFileSync8(path33.join(dir, `${id}.md`), "utf8").trimEnd();
+      return readFileSync9(path34.join(dir, `${id}.md`), "utf8").trimEnd();
     } catch {
     }
   }
   return "";
 }
 function modePromptDirCandidates() {
-  const here = path33.dirname(fileURLToPath5(import.meta.url));
+  const here = path34.dirname(fileURLToPath5(import.meta.url));
   const candidates = [
-    path33.resolve(here, "../../instructions/modes"),
-    path33.resolve(here, "../instructions/modes"),
-    path33.resolve(here, "instructions/modes")
+    path34.resolve(here, "../../instructions/modes"),
+    path34.resolve(here, "../instructions/modes"),
+    path34.resolve(here, "instructions/modes")
   ];
   return candidates.sort((a, b) => Number(!isDirectory3(a)) - Number(!isDirectory3(b)));
 }
@@ -29797,7 +30095,7 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path34.join(this.configDir, "mode.json");
+      const configPath = path35.join(this.configDir, "mode.json");
       const content = await fs11.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
@@ -29808,7 +30106,7 @@ var DefaultModeStore = class {
   async saveActiveMode() {
     try {
       await fs11.mkdir(this.configDir, { recursive: true });
-      const configPath = path34.join(this.configDir, "mode.json");
+      const configPath = path35.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -29823,11 +30121,11 @@ async function loadProjectModes(modesDir) {
     const entries = await fs11.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path34.join(modesDir, entry);
+      const filePath = path35.join(modesDir, entry);
       const stat15 = await fs11.stat(filePath);
       if (!stat15.isFile()) continue;
       const content = await fs11.readFile(filePath, "utf8");
-      const id = path34.basename(entry, path34.extname(entry));
+      const id = path35.basename(entry, path35.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -29843,7 +30141,7 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path34.join(modesDir, "modes.json");
+    const manifestPath = path35.join(modesDir, "modes.json");
     const content = await fs11.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
@@ -29856,7 +30154,7 @@ async function loadUserModes(modesDir) {
 
 // src/models/models-registry.ts
 import * as fs12 from "node:fs/promises";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 var DEFAULT_URL = "https://models.dev/api.json";
 var ENV_URL_KEY = "WRONGSTACK_MODELS_DEV_URL";
 var DEFAULT_TTL_SECONDS = 3 * 3600;
@@ -29933,7 +30231,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path35.join(path35.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path36.join(path36.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
     this.logger = opts.logger ?? noOpLogger;
   }
   async load(opts = {}) {
@@ -30208,7 +30506,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path35.resolve(this.cacheFile);
+    return path36.resolve(this.cacheFile);
   }
 };
 var REASONING_EFFORTS = /* @__PURE__ */ new Set([
@@ -30759,7 +31057,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path44 = opts.path ?? "/metrics";
+  const path45 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const token = opts.token;
@@ -30782,7 +31080,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path44) {
+    if (url === path45) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -30819,9 +31117,9 @@ async function startMetricsServer(opts) {
   let server;
   if (useHttps && tls) {
     const { createServer } = await import("node:https");
-    const { readFileSync: readFileSync10 } = await import("node:fs");
+    const { readFileSync: readFileSync11 } = await import("node:fs");
     server = createServer(
-      { cert: readFileSync10(tls.cert), key: readFileSync10(tls.key) },
+      { cert: readFileSync11(tls.cert), key: readFileSync11(tls.key) },
       listener
     );
   } else {
@@ -30846,7 +31144,7 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path44}`,
+    url: `${protocol}://${host}:${boundPort}${path45}`,
     close: () => new Promise((resolve21, reject) => {
       server.close((err) => err ? reject(err) : resolve21());
     })
@@ -31119,7 +31417,7 @@ function startOtlpTraceExporter(opts) {
 
 // src/security/permission-policy.ts
 import * as fs13 from "node:fs/promises";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 
 // src/security/permission-policy-schema.ts
 var TRUST_POLICY_LIMITS = Object.freeze({
@@ -31164,19 +31462,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path44, message) {
-  diagnostics.push({ severity: "error", code, path: path44, message });
+function error(diagnostics, code, path45, message) {
+  diagnostics.push({ severity: "error", code, path: path45, message });
 }
-function validatePatterns(value, path44, diagnostics) {
+function validatePatterns(value, path45, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path44, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path45, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path44,
+      path45,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -31184,7 +31482,7 @@ function validatePatterns(value, path44, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path44}[${index}]`;
+    const itemPath = `${path45}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -31288,7 +31586,7 @@ function validateTrustPolicy(value) {
 }
 
 // src/security/yolo-risk.ts
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 var CATASTROPHIC_PATTERNS = [
   /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
   // make a filesystem — wipes a partition
@@ -31348,9 +31646,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path36.resolve(projectRoot, rawPath);
-  const relative8 = path36.relative(projectRoot, resolved);
-  return !!relative8 && !relative8.startsWith("..") && !path36.isAbsolute(relative8);
+  const resolved = path37.resolve(projectRoot, rawPath);
+  const relative8 = path37.relative(projectRoot, resolved);
+  return !!relative8 && !relative8.startsWith("..") && !path37.isAbsolute(relative8);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -31600,7 +31898,7 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 
 // src/security/permission-helpers.ts
 import { realpathSync } from "node:fs";
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
@@ -31684,24 +31982,24 @@ function realpathOfNearestExisting(p) {
   const tail = [];
   for (; ; ) {
     try {
-      return tail.length === 0 ? realpathSync(probe) : path37.join(realpathSync(probe), ...tail);
+      return tail.length === 0 ? realpathSync(probe) : path38.join(realpathSync(probe), ...tail);
     } catch {
-      const parent = path37.dirname(probe);
+      const parent = path38.dirname(probe);
       if (parent === probe) return p;
-      tail.unshift(path37.basename(probe));
+      tail.unshift(path38.basename(probe));
       probe = parent;
     }
   }
 }
 var agentStateRootRealCache = /* @__PURE__ */ new Map();
 function isInsideAgentStateRoot(absPath) {
-  const lexicalRoot = normalizeForCompare(path37.resolve(wstackGlobalRoot()));
+  const lexicalRoot = normalizeForCompare(path38.resolve(wstackGlobalRoot()));
   if (!lexicalRoot) return false;
   const target = normalizeForCompare(absPath);
   if (target === lexicalRoot || target.startsWith(`${lexicalRoot}/`)) return true;
   let realRoot = agentStateRootRealCache.get(lexicalRoot);
   if (realRoot === void 0) {
-    realRoot = normalizeForCompare(realpathOfNearestExisting(path37.resolve(wstackGlobalRoot())));
+    realRoot = normalizeForCompare(realpathOfNearestExisting(path38.resolve(wstackGlobalRoot())));
     agentStateRootRealCache.set(lexicalRoot, realRoot);
   }
   if (!realRoot || realRoot === lexicalRoot) return false;
@@ -31710,7 +32008,7 @@ function isInsideAgentStateRoot(absPath) {
 }
 function isProtectedAgentStatePath(absPath) {
   if (!isInsideAgentStateRoot(absPath)) return false;
-  return AGENT_STATE_SENSITIVE_BASENAMES.test(path37.basename(normalizeForCompare(absPath)));
+  return AGENT_STATE_SENSITIVE_BASENAMES.test(path38.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
   const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
@@ -31871,7 +32169,7 @@ var DefaultPermissionPolicy = class {
     if (!hasCapability(tool, ToolCapabilities.FS_WRITE)) return false;
     for (const targetPath of fsWriteTargetPaths(input)) {
       const base = ctx.workingDir ?? ctx.cwd;
-      const resolved = base ? path38.resolve(base, targetPath) : path38.resolve(targetPath);
+      const resolved = base ? path39.resolve(base, targetPath) : path39.resolve(targetPath);
       if (isInsideAgentStateRoot(resolved)) return true;
     }
     return false;
@@ -32540,7 +32838,7 @@ var DefaultPermissionPolicy = class {
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, scryptSync } from "node:crypto";
 import * as fs14 from "node:fs";
 import * as fsp22 from "node:fs/promises";
-import * as path39 from "node:path";
+import * as path40 from "node:path";
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
@@ -32833,7 +33131,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs14.mkdirSync(path39.dirname(this.keyFile), { recursive: true });
+    fs14.mkdirSync(path40.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -32920,7 +33218,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs14.mkdirSync(path39.dirname(this.keyFile), { recursive: true });
+    fs14.mkdirSync(path40.dirname(this.keyFile), { recursive: true });
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -32980,7 +33278,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp22.mkdir(path39.dirname(configPath), { recursive: true });
+  await fsp22.mkdir(path40.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions2(configPath);
   await vault.flushHardening?.();
@@ -33035,7 +33333,7 @@ function walkCount(node, vault, counter) {
 // src/storage/attachment-store.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import * as fsp23 from "node:fs/promises";
-import * as path40 from "node:path";
+import * as path41 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE2 = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -33056,7 +33354,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp23.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path40.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path41.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -33594,8 +33892,8 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "The other half of the filesystem confinement switch."
   }
 ];
-function deleteNestedPath(target, path44) {
-  const segments = path44.split(".");
+function deleteNestedPath(target, path45) {
+  const segments = path45.split(".");
   const last = segments[segments.length - 1];
   if (last === void 0) return false;
   let cursor = target;
@@ -33652,16 +33950,16 @@ function assertInProjectAllowListComplete() {
     );
   }
   const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path44 }) => !IN_PROJECT_ALLOWED_KEYS.has(path44.split(".")[0] ?? "")
-  ).map(({ path: path44 }) => path44);
+    ({ path: path45 }) => !IN_PROJECT_ALLOWED_KEYS.has(path45.split(".")[0] ?? "")
+  ).map(({ path: path45 }) => path45);
   if (orphanedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
     );
   }
   const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path44 }) => path44.split(".").length < 2 || path44.split(".").some((s) => s.length === 0)
-  ).map(({ path: path44 }) => path44);
+    ({ path: path45 }) => path45.split(".").length < 2 || path45.split(".").some((s) => s.length === 0)
+  ).map(({ path: path45 }) => path45);
   if (malformedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
@@ -33689,8 +33987,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  for (const { path: path44 } of IN_PROJECT_DENIED_PATHS) {
-    if (deleteNestedPath(out, path44)) stripped.push(path44);
+  for (const { path: path45 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path45)) stripped.push(path45);
   }
   if (stripped.length > 0) {
     warn(
@@ -33879,10 +34177,10 @@ function removeLegacySageEngine(config) {
 }
 
 // src/storage/config-loader/path-identity.ts
-import * as path41 from "node:path";
+import * as path42 from "node:path";
 function samePath(a, b) {
-  let ra = path41.resolve(a);
-  let rb = path41.resolve(b);
+  let ra = path42.resolve(a);
+  let rb = path42.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -34564,8 +34862,8 @@ function deepFreeze(obj) {
 }
 
 // src/storage/plan-store.ts
-import * as fsp24 from "node:fs/promises";
 import { randomUUID as randomUUID18 } from "node:crypto";
+import * as fsp24 from "node:fs/promises";
 async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
@@ -34863,7 +35161,7 @@ ${cat}:`);
 
 // src/storage/queue-store.ts
 import * as fsp25 from "node:fs/promises";
-import * as path42 from "node:path";
+import * as path43 from "node:path";
 var QUEUE_MAX_ITEMS = 100;
 var QUEUE_MAX_BYTES = 16 * 1024 * 1024;
 var QUEUE_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -34896,7 +35194,7 @@ var QueueStore = class {
   traceId;
   logger;
   constructor(opts) {
-    this.file = path42.join(opts.dir, "queue.json");
+    this.file = path43.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
     this.logger = opts.logger;
@@ -35112,7 +35410,7 @@ function isPersistedQueueItem(v) {
 // src/storage/recovery-lock.ts
 import * as fsp26 from "node:fs/promises";
 import * as os3 from "node:os";
-import * as path43 from "node:path";
+import * as path44 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -35123,7 +35421,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path43.join(opts.dir, LOCK_FILE);
+    this.file = path44.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os3.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -35197,7 +35495,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path43.dirname(this.file));
+    await ensureDir(path44.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,