@wrongstack/core 0.310.1 → 0.313.1

package/dist/infrastructure/index.js

@@ -1,1269 +1,57 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res, err) => function __init() {
-  if (err) throw err[0];
-  try {
-    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-  } catch (e) {
-    throw err = [e], e;
-  }
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/session-catalog/protocol.ts
-function encodeSessionCatalogMessage(message) {
-  return `${JSON.stringify(message)}
-`;
-}
-var SESSION_CATALOG_PROTOCOL_VERSION, SESSION_CATALOG_MAX_FRAME_CHARS;
-var init_protocol = __esm({
-  "src/session-catalog/protocol.ts"() {
-    "use strict";
-    SESSION_CATALOG_PROTOCOL_VERSION = 1;
-    SESSION_CATALOG_MAX_FRAME_CHARS = 4 * 1024 * 1024;
-  }
-});
-
-// src/session-catalog/endpoint.ts
-import { createHash as createHash2 } from "node:crypto";
-import * as os3 from "node:os";
-import * as path9 from "node:path";
-function normalizedPath(value) {
-  const resolved = path9.resolve(value);
-  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-function sessionCatalogProjectServerKey(projectDir) {
-  return createHash2("sha256").update(normalizedPath(projectDir)).digest("hex").slice(0, 24);
-}
-function sessionCatalogProjectServerEndpoint(projectDir) {
-  const key = sessionCatalogProjectServerKey(projectDir);
-  if (process.platform === "win32") {
-    return `\\\\.\\pipe\\wrongstack-session-catalog-v${SESSION_CATALOG_PROTOCOL_VERSION}-${key}`;
-  }
-  return path9.join(os3.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
-}
-function sessionCatalogProjectServerMetadataPath(projectDir) {
-  return path9.join(projectDir, SESSION_CATALOG_METADATA_FILE);
-}
-var SESSION_CATALOG_METADATA_FILE;
-var init_endpoint = __esm({
-  "src/session-catalog/endpoint.ts"() {
-    "use strict";
-    init_protocol();
-    SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
-  }
-});
-
-// src/session-catalog/client.ts
-import { spawn } from "node:child_process";
-import * as fs7 from "node:fs";
-import * as net from "node:net";
-import * as path10 from "node:path";
-import { fileURLToPath } from "node:url";
-function locateServer(moduleUrl, exists) {
-  for (const candidate of [
-    "./project-server.js",
-    "../session-catalog/project-server.js",
-    "./session-catalog/project-server.js",
-    "../../dist/session-catalog/project-server.js"
-  ]) {
-    try {
-      const url = new URL(candidate, moduleUrl);
-      if (url.protocol === "file:" && exists(fileURLToPath(url))) return url;
-    } catch {
-    }
-  }
-  return null;
-}
-function resolveSessionCatalogDaemonAvailability(moduleUrl = import.meta.url, exists = fs7.existsSync) {
-  if (process.env["WRONGSTACK_SESSION_CATALOG_INLINE"] || process.env["WRONGSTACK_SESSION_CATALOG_SERVER"] === "0")
-    return { kind: "inline-requested" };
-  const url = locateServer(moduleUrl, exists);
-  return url ? { kind: "available", url } : { kind: "missing-build" };
-}
-function resolveSessionCatalogProjectServerUrl(moduleUrl = import.meta.url, exists = fs7.existsSync) {
-  const availability = resolveSessionCatalogDaemonAvailability(moduleUrl, exists);
-  return availability.kind === "available" ? availability.url : null;
-}
-function normalize2(value) {
-  const resolved = path10.resolve(value);
-  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-function delay(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
-}
-var CONNECT_TIMEOUT_MS, START_TIMEOUT_MS, CALL_TIMEOUT_MS, MAX_PENDING_REQUESTS, MAX_EVENT_LISTENERS, SessionCatalogProjectClient;
-var init_client = __esm({
-  "src/session-catalog/client.ts"() {
-    "use strict";
-    init_endpoint();
-    init_protocol();
-    CONNECT_TIMEOUT_MS = 750;
-    START_TIMEOUT_MS = 1e4;
-    CALL_TIMEOUT_MS = 3e4;
-    MAX_PENDING_REQUESTS = 1024;
-    MAX_EVENT_LISTENERS = 64;
-    SessionCatalogProjectClient = class {
-      constructor(options) {
-        this.options = options;
-        this.endpoint = sessionCatalogProjectServerEndpoint(options.projectDir);
-      }
-      options;
-      endpoint;
-      socket = null;
-      info = null;
-      buffer = "";
-      connecting = null;
-      connectResolve = null;
-      connectReject = null;
-      authToken;
-      nextId = 1;
-      pending = /* @__PURE__ */ new Map();
-      eventListeners = /* @__PURE__ */ new Set();
-      reconnectTimer;
-      explicitlyClosed = false;
-      async call(op, args, options = {}) {
-        await this.ensureConnected(true);
-        return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
-      }
-      /**
-       * Call an already-running project daemon without starting one.
-       *
-       * Cross-project discovery must use this path: observing another project is
-       * never sufficient authority to wake that project's IPC owner.
-       */
-      async callExisting(op, args, options = {}) {
-        await this.ensureConnected(false);
-        return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
-      }
-      ping() {
-        return this.call("ping", {}, { timeoutMs: 3e3 });
-      }
-      async subscribe(listener) {
-        if (!this.eventListeners.has(listener) && this.eventListeners.size >= MAX_EVENT_LISTENERS) {
-          throw new Error(`Session Catalog listener limit reached (${MAX_EVENT_LISTENERS})`);
-        }
-        this.explicitlyClosed = false;
-        this.eventListeners.add(listener);
-        try {
-          await this.call("subscribe", {});
-        } catch (error) {
-          this.eventListeners.delete(listener);
-          throw error;
-        }
-        return async () => {
-          this.eventListeners.delete(listener);
-          if (this.eventListeners.size === 0)
-            await this.callExisting("unsubscribe", {}).catch(() => void 0);
-        };
-      }
-      async shutdown(reason) {
-        try {
-          await this.ensureConnected(false);
-        } catch {
-          return { stopped: false };
-        }
-        const result = await this.request({ type: "shutdown", ...reason !== void 0 ? { reason } : {} }, 5e3).catch(
-          () => ({ stopped: false })
-        );
-        if (result.stopped) {
-          const metadataPath = sessionCatalogProjectServerMetadataPath(this.options.projectDir);
-          const deadline = Date.now() + 5e3;
-          while (fs7.existsSync(metadataPath) && Date.now() < deadline) await delay(20);
-          if (result.pid && result.pid !== process.pid) {
-            while (Date.now() < deadline) {
-              try {
-                process.kill(result.pid, 0);
-                await delay(20);
-              } catch {
-                break;
-              }
-            }
-          }
-        }
-        return result;
-      }
-      async close() {
-        this.explicitlyClosed = true;
-        if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-        this.reconnectTimer = void 0;
-        const socket = this.socket;
-        this.socket = null;
-        this.info = null;
-        if (socket && !socket.destroyed)
-          await new Promise((resolve9) => {
-            socket.once("close", resolve9);
-            socket.end();
-          });
-      }
-      async ensureConnected(spawnIfMissing) {
-        if (this.socket && !this.socket.destroyed && this.info) return;
-        if (this.connecting) return this.connecting;
-        this.connecting = this.connectWithElection(spawnIfMissing).finally(() => {
-          this.connecting = null;
-        });
-        return this.connecting;
-      }
-      async connectWithElection(spawnIfMissing) {
-        const deadline = Date.now() + (spawnIfMissing ? START_TIMEOUT_MS : CONNECT_TIMEOUT_MS);
-        let spawned = false;
-        let lastError = new Error("Session Catalog project server unavailable");
-        while (Date.now() < deadline) {
-          try {
-            await this.connectOnce();
-            return;
-          } catch (error) {
-            lastError = error;
-          }
-          if (!spawnIfMissing) break;
-          if (!spawned) {
-            this.spawnDetached();
-            spawned = true;
-          }
-          await delay(75);
-        }
-        throw lastError;
-      }
-      connectOnce() {
-        this.socket?.destroy();
-        this.socket = null;
-        this.info = null;
-        this.authToken = void 0;
-        this.buffer = "";
-        return new Promise((resolve9, reject) => {
-          const socket = net.createConnection(this.endpoint);
-          this.socket = socket;
-          socket.setEncoding("utf8");
-          const timer = setTimeout(() => {
-            reject(new Error("Session Catalog handshake timed out"));
-            socket.destroy();
-          }, CONNECT_TIMEOUT_MS);
-          timer.unref?.();
-          this.connectResolve = () => {
-            clearTimeout(timer);
-            this.connectResolve = null;
-            this.connectReject = null;
-            resolve9();
-          };
-          this.connectReject = (error) => {
-            clearTimeout(timer);
-            this.connectResolve = null;
-            this.connectReject = null;
-            reject(error);
-          };
-          socket.on("data", (chunk) => this.onData(socket, chunk));
-          socket.on("error", (error) => {
-            if (!this.info) this.connectReject?.(error);
-          });
-          socket.on("close", () => this.onClose(socket));
-        });
-      }
-      currentAuthToken() {
-        if (this.authToken === void 0) {
-          try {
-            const parsed = JSON.parse(
-              fs7.readFileSync(sessionCatalogProjectServerMetadataPath(this.options.projectDir), "utf8")
-            );
-            if (typeof parsed.authToken === "string" && parsed.authToken)
-              this.authToken = parsed.authToken;
-          } catch {
-          }
-        }
-        return this.authToken;
-      }
-      request(message, timeoutMs) {
-        const socket = this.socket;
-        if (!socket || socket.destroyed)
-          return Promise.reject(new Error("Session Catalog connection is unavailable"));
-        const id = this.nextId++;
-        if (this.pending.size >= MAX_PENDING_REQUESTS) {
-          return Promise.reject(
-            new Error(`Session Catalog pending request limit reached (${MAX_PENDING_REQUESTS})`)
-          );
-        }
-        const encoded = encodeSessionCatalogMessage({
-          ...message,
-          id,
-          authToken: this.currentAuthToken()
-        });
-        if (encoded.length > SESSION_CATALOG_MAX_FRAME_CHARS)
-          return Promise.reject(new Error("Session Catalog request exceeded frame limit"));
-        return new Promise((resolve9, reject) => {
-          const timer = setTimeout(() => {
-            const pending = this.pending.get(id);
-            if (!pending) return;
-            this.pending.delete(id);
-            pending.reject(
-              new Error(
-                `Session Catalog ${message.type === "request" ? message.op : message.type} timed out`
-              )
-            );
-          }, timeoutMs);
-          timer.unref?.();
-          this.pending.set(id, { resolve: resolve9, reject, timer });
-          socket.write(encoded);
-        });
-      }
-      onData(socket, chunk) {
-        if (socket !== this.socket) return;
-        this.buffer += chunk;
-        if (this.buffer.length > SESSION_CATALOG_MAX_FRAME_CHARS) {
-          socket.destroy(new Error("Session Catalog response exceeded frame limit"));
-          return;
-        }
-        while (true) {
-          const newline = this.buffer.indexOf("\n");
-          if (newline < 0) return;
-          const line = this.buffer.slice(0, newline);
-          this.buffer = this.buffer.slice(newline + 1);
-          if (!line) continue;
-          try {
-            this.onMessage(JSON.parse(line));
-          } catch {
-            socket.destroy(new Error("Invalid Session Catalog response"));
-            return;
-          }
-        }
-      }
-      onMessage(message) {
-        if (message.type === "hello") {
-          if (message.protocolVersion !== SESSION_CATALOG_PROTOCOL_VERSION) {
-            this.connectReject?.(
-              new Error(
-                `Session Catalog protocol mismatch: client=${SESSION_CATALOG_PROTOCOL_VERSION}, server=${message.protocolVersion}`
-              )
-            );
-            this.socket?.destroy();
-            return;
-          }
-          if (normalize2(message.projectDir) !== normalize2(this.options.projectDir) || normalize2(message.projectRoot) !== normalize2(this.options.projectRoot)) {
-            this.connectReject?.(new Error("Session Catalog project identity mismatch"));
-            this.socket?.destroy();
-            return;
-          }
-          this.info = message;
-          this.connectResolve?.();
-          return;
-        }
-        if (message.type === "event") {
-          for (const listener of this.eventListeners) {
-            try {
-              listener(message.event);
-            } catch {
-            }
-          }
-          return;
-        }
-        const pending = this.pending.get(message.id);
-        if (!pending) return;
-        this.pending.delete(message.id);
-        clearTimeout(pending.timer);
-        if (message.ok) pending.resolve(message.result);
-        else {
-          const error = new Error(message.error);
-          if (message.errorName) error.name = message.errorName;
-          pending.reject(error);
-        }
-      }
-      onClose(socket) {
-        if (socket !== this.socket) return;
-        this.socket = null;
-        this.info = null;
-        this.authToken = void 0;
-        const error = new Error("Session Catalog connection closed");
-        this.connectReject?.(error);
-        this.connectResolve = null;
-        this.connectReject = null;
-        for (const pending of this.pending.values()) {
-          clearTimeout(pending.timer);
-          pending.reject(error);
-        }
-        this.pending.clear();
-        this.scheduleSubscriptionReconnect();
-      }
-      scheduleSubscriptionReconnect() {
-        if (this.explicitlyClosed || this.eventListeners.size === 0 || this.reconnectTimer) return;
-        this.reconnectTimer = setTimeout(() => {
-          this.reconnectTimer = void 0;
-          void this.call("subscribe", {}).catch(() => this.scheduleSubscriptionReconnect());
-        }, 250);
-        this.reconnectTimer.unref?.();
-      }
-      spawnDetached() {
-        const url = resolveSessionCatalogProjectServerUrl();
-        if (!url) throw new Error("Built Session Catalog project server is unavailable");
-        const child = spawn(
-          process.execPath,
-          [
-            fileURLToPath(url),
-            "--project-dir",
-            this.options.projectDir,
-            "--project-root",
-            this.options.projectRoot
-          ],
-          { detached: true, stdio: "ignore", windowsHide: true, env: process.env }
-        );
-        child.unref();
-      }
-    };
-  }
-});
-
-// src/session-catalog/registry.ts
-var registry_exports = {};
-__export(registry_exports, {
-  ProjectSessionRegistry: () => ProjectSessionRegistry,
-  getProjectSessionRegistry: () => getProjectSessionRegistry,
-  hasProjectSessionRegistry: () => hasProjectSessionRegistry
-});
-import { randomUUID } from "node:crypto";
-import * as fs8 from "node:fs/promises";
-import * as path11 from "node:path";
-function getProjectSessionRegistry(globalRoot) {
-  const key = globalRoot !== void 0 ? path11.resolve(globalRoot) : lastRegistryKey;
-  if (!key)
-    throw new Error("SessionRegistry not initialized. Call getSessionRegistry(globalRoot) first.");
-  let registry = registries.get(key);
-  if (!registry) {
-    if (registries.size >= MAX_GLOBAL_ROOTS) {
-      const idle = [...registries.entries()].find(([, candidate]) => !candidate.ownsSession());
-      if (!idle)
-        throw new Error(`Session Registry global-root limit reached (${MAX_GLOBAL_ROOTS})`);
-      registries.delete(idle[0]);
-      void idle[1].dispose();
-    }
-    registry = new ProjectSessionRegistry(key);
-    registries.set(key, registry);
-  } else {
-    registries.delete(key);
-    registries.set(key, registry);
-  }
-  lastRegistryKey = key;
-  return registry;
-}
-function hasProjectSessionRegistry(globalRoot) {
-  if (globalRoot === void 0) return registries.size > 0;
-  return registries.has(path11.resolve(globalRoot));
-}
-var HEARTBEAT_INTERVAL_MS, AGENT_WRITE_THROTTLE_MS, MAX_PROJECT_CLIENTS, MAX_GLOBAL_ROOTS, ProjectSessionRegistry, registries, lastRegistryKey;
-var init_registry = __esm({
-  "src/session-catalog/registry.ts"() {
-    "use strict";
-    init_client();
-    init_endpoint();
-    HEARTBEAT_INTERVAL_MS = 5e3;
-    AGENT_WRITE_THROTTLE_MS = 300;
-    MAX_PROJECT_CLIENTS = 128;
-    MAX_GLOBAL_ROOTS = 16;
-    ProjectSessionRegistry = class {
-      constructor(globalRoot) {
-        this.globalRoot = globalRoot;
-      }
-      globalRoot;
-      instanceId = randomUUID();
-      clients = /* @__PURE__ */ new Map();
-      current;
-      heartbeatTimer;
-      agentRevision = 0;
-      pendingAgents;
-      agentTimer;
-      lastAgentWriteAt = 0;
-      bindingKey(projectDir) {
-        const resolved = path11.resolve(projectDir);
-        return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-      }
-      async closeBinding(binding) {
-        if (this.current?.binding === binding) return;
-        const key = this.bindingKey(binding.projectDir);
-        if (this.clients.get(key) === binding) this.clients.delete(key);
-        await binding.client.close();
-      }
-      binding(projectSlug2, projectRoot) {
-        const projectDir = path11.join(this.globalRoot, "projects", projectSlug2);
-        const key = this.bindingKey(projectDir);
-        let binding = this.clients.get(key);
-        if (!binding) {
-          if (this.clients.size >= MAX_PROJECT_CLIENTS) {
-            const oldest = [...this.clients.entries()].find(
-              ([, candidate]) => candidate !== this.current?.binding
-            );
-            if (oldest) {
-              this.clients.delete(oldest[0]);
-              void oldest[1].client.close();
-            }
-          }
-          binding = {
-            projectDir,
-            projectRoot: path11.resolve(projectRoot),
-            client: new SessionCatalogProjectClient({ projectDir, projectRoot })
-          };
-          this.clients.set(key, binding);
-        } else {
-          this.clients.delete(key);
-          this.clients.set(key, binding);
-        }
-        return binding;
-      }
-      fullEntry(entry) {
-        const agents = entry.agents ?? [];
-        return {
-          ...entry,
-          status: agents.some((agent) => agent.status !== "idle") ? "active" : "idle",
-          lastHeartbeatAt: (/* @__PURE__ */ new Date()).toISOString(),
-          agentCount: agents.length,
-          agents
-        };
-      }
-      async register(entry) {
-        const full = this.fullEntry(entry);
-        if (this.current?.entry.sessionId === full.sessionId && this.current.entry.pid === full.pid) {
-          this.current.entry = full;
-          this.current.credential = await this.current.binding.client.call("heartbeat", {
-            credential: this.current.credential,
-            status: full.status
-          });
-          return;
-        }
-        const nextBinding = this.binding(full.projectSlug, full.projectRoot);
-        let nextCredential;
-        try {
-          nextCredential = await nextBinding.client.call("claim_new", {
-            entry: full,
-            ownerInstanceId: this.instanceId
-          });
-        } catch (error) {
-          await this.closeBinding(nextBinding).catch(() => void 0);
-          throw error;
-        }
-        const previous = this.current;
-        this.current = { binding: nextBinding, credential: nextCredential, entry: full };
-        this.agentRevision = 0;
-        this.cancelAgentTimer();
-        this.startHeartbeat();
-        if (previous) {
-          await previous.binding.client.call("release", { credential: previous.credential }).catch(() => void 0);
-          if (previous.binding !== nextBinding) await this.closeBinding(previous.binding);
-        }
-      }
-      /** Reserve before transcript hydration; activation swaps ownership only after the writer opened. */
-      async reserveResume(target) {
-        const binding = this.binding(target.projectSlug, target.projectRoot);
-        let reservation;
-        try {
-          reservation = await binding.client.call("reserve_resume", {
-            targetSessionId: target.sessionId,
-            requesterInstanceId: this.instanceId,
-            ...this.current ? { currentSessionId: this.current.entry.sessionId } : {}
-          });
-        } catch (error) {
-          await this.closeBinding(binding).catch(() => void 0);
-          throw error;
-        }
-        let settled = false;
-        return {
-          reservation,
-          activate: async (registration) => {
-            if (settled) throw new Error("Resume reservation is already settled");
-            const entry = this.fullEntry(registration);
-            const credential = await binding.client.call("activate_reservation", {
-              reservation,
-              entry
-            });
-            const previous = this.current;
-            this.current = { binding, credential, entry };
-            settled = true;
-            this.agentRevision = 0;
-            this.cancelAgentTimer();
-            this.startHeartbeat();
-            if (previous) {
-              await previous.binding.client.call("release", { credential: previous.credential }).catch(() => void 0);
-              if (previous.binding !== binding) await this.closeBinding(previous.binding);
-            }
-          },
-          cancel: async () => {
-            if (settled) return;
-            settled = true;
-            try {
-              await binding.client.call("cancel_reservation", {
-                reservationId: reservation.reservationId,
-                requesterInstanceId: this.instanceId
-              }).catch(() => void 0);
-            } finally {
-              await this.closeBinding(binding).catch(() => void 0);
-            }
-          }
-        };
-      }
-      async updateAgents(agents) {
-        if (!this.current) return;
-        this.pendingAgents = agents;
-        this.current.entry = {
-          ...this.current.entry,
-          agents,
-          agentCount: agents.length,
-          status: agents.some((agent) => agent.status !== "idle") ? "active" : "idle",
-          lastHeartbeatAt: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        const elapsed = Date.now() - this.lastAgentWriteAt;
-        if (!this.agentTimer && elapsed >= AGENT_WRITE_THROTTLE_MS) {
-          await this.flushAgents();
-          return;
-        }
-        if (!this.agentTimer) {
-          this.agentTimer = setTimeout(
-            () => {
-              this.agentTimer = void 0;
-              void this.flushAgents();
-            },
-            Math.max(0, AGENT_WRITE_THROTTLE_MS - elapsed)
-          );
-          this.agentTimer.unref?.();
-        }
-      }
-      async flushAgents() {
-        const agents = this.pendingAgents;
-        const current = this.current;
-        if (!agents || !current) return;
-        this.pendingAgents = void 0;
-        this.lastAgentWriteAt = Date.now();
-        const revision = ++this.agentRevision;
-        await current.binding.client.call("publish_agents", {
-          credential: current.credential,
-          revision,
-          agents
-        });
-      }
-      async markClosing() {
-        this.stopHeartbeat();
-        this.cancelAgentTimer();
-        if (this.current)
-          await this.current.binding.client.call("mark_closing", {
-            credential: this.current.credential
-          });
-      }
-      async unregister() {
-        this.stopHeartbeat();
-        this.cancelAgentTimer();
-        const current = this.current;
-        this.current = void 0;
-        if (current) {
-          try {
-            await current.binding.client.call("release", { credential: current.credential });
-          } finally {
-            await this.closeBinding(current.binding);
-          }
-        }
-      }
-      async list() {
-        const projectsDir = path11.join(this.globalRoot, "projects");
-        let directories = [];
-        try {
-          directories = (await fs8.readdir(projectsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).slice(0, 1e3).map((entry) => entry.name);
-        } catch {
-          return [];
-        }
-        const snapshots = await Promise.all(
-          directories.map(async (slug) => {
-            const projectDir = path11.join(projectsDir, slug);
-            let client;
-            try {
-              const metadata = JSON.parse(
-                await fs8.readFile(sessionCatalogProjectServerMetadataPath(projectDir), "utf8")
-              );
-              if (typeof metadata.projectRoot !== "string" || !metadata.projectRoot) return [];
-              client = new SessionCatalogProjectClient({
-                projectDir,
-                projectRoot: metadata.projectRoot
-              });
-              return await client.callExisting("list_live", {});
-            } catch {
-              return [];
-            } finally {
-              await client?.close().catch(() => void 0);
-            }
-          })
-        );
-        return snapshots.flat();
-      }
-      async listByProject(projectSlug2) {
-        const current = this.current;
-        if (current && path11.basename(current.binding.projectDir) === projectSlug2) {
-          return current.binding.client.call("list_live", {}).catch(() => []);
-        }
-        const projectDir = path11.join(this.globalRoot, "projects", projectSlug2);
-        let client;
-        try {
-          const metadata = JSON.parse(
-            await fs8.readFile(sessionCatalogProjectServerMetadataPath(projectDir), "utf8")
-          );
-          if (typeof metadata.projectRoot !== "string") return [];
-          client = new SessionCatalogProjectClient({ projectDir, projectRoot: metadata.projectRoot });
-          return await client.callExisting("list_live", {}).catch(() => []);
-        } catch {
-          return [];
-        } finally {
-          await client?.close().catch(() => void 0);
-        }
-      }
-      async get(sessionId) {
-        return (await this.list()).find((entry) => entry.sessionId === sessionId);
-      }
-      subscribeProject(projectSlug2, projectRoot, listener) {
-        const binding = this.binding(projectSlug2, projectRoot);
-        return binding.client.subscribe(listener).then((unsubscribe) => async () => {
-          await unsubscribe();
-          await this.closeBinding(binding);
-        });
-      }
-      get registryPath() {
-        return path11.join(this.globalRoot, "projects");
-      }
-      async dispose() {
-        await this.unregister().catch(() => void 0);
-        await Promise.all([...this.clients.values()].map((binding) => binding.client.close()));
-        this.clients.clear();
-      }
-      /** Whether this facade currently owns a live session lease. */
-      ownsSession() {
-        return this.current !== void 0;
-      }
-      startHeartbeat() {
-        this.stopHeartbeat();
-        this.heartbeatTimer = setInterval(() => {
-          void this.heartbeat();
-        }, HEARTBEAT_INTERVAL_MS);
-        this.heartbeatTimer.unref?.();
-      }
-      stopHeartbeat() {
-        if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-        this.heartbeatTimer = void 0;
-      }
-      cancelAgentTimer() {
-        if (this.agentTimer) clearTimeout(this.agentTimer);
-        this.agentTimer = void 0;
-        this.pendingAgents = void 0;
-      }
-      async heartbeat() {
-        const current = this.current;
-        if (!current) return;
-        try {
-          const credential = await current.binding.client.call("heartbeat", {
-            credential: current.credential,
-            status: current.entry.status
-          });
-          if (this.current === current) current.credential = credential;
-        } catch {
-        }
-      }
-    };
-    registries = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/infrastructure/logger.ts
-import * as fsp from "node:fs/promises";
-import * as path from "node:path";
-
-// src/utils/term.ts
-var hasStdout = () => typeof process !== "undefined" && !!process.stdout;
-function isStdoutTTY() {
-  return hasStdout() && Boolean(process.stdout.isTTY);
-}
-var activeOutputGuard = null;
-function writeTo(s, stream) {
-  if (!stream || typeof stream.write !== "function") return false;
-  const guard = activeOutputGuard;
-  if (!guard) {
-    stream.write(s);
-    return true;
-  }
-  guard.suspend();
-  stream.write(s);
-  guard.resume();
-  return true;
-}
-function writeErr(s, stream = process.stderr) {
-  return writeTo(s, stream);
-}
-var ESCAPE_TERMINATOR = Object.freeze({
-  BEL: "\x07",
-  // OSC 0 / OSC 2 (title)
-  ST: "\x1B\\"
-  // DCS / strict OSC
-});
-
-// src/utils/color.ts
-var isColorTty = () => {
-  if (envFlag(process.env.NO_COLOR)) return false;
-  if (envFlag(process.env.FORCE_COLOR)) return true;
-  return isStdoutTTY();
-};
-function envFlag(value) {
-  if (value === void 0) return false;
-  if (value.trim() === "") return false;
-  return !/^(0|false|no|off)$/i.test(value.trim());
-}
-var COLOR = isColorTty();
-var wrap = (open, close) => (s) => COLOR ? `\x1B[${open}m${s}\x1B[${close}m` : s;
-var color = {
-  reset: wrap("0", "0"),
-  bold: wrap("1", "22"),
-  dim: wrap("2", "22"),
-  italic: wrap("3", "23"),
-  underline: wrap("4", "24"),
-  red: wrap("31", "39"),
-  green: wrap("32", "39"),
-  yellow: wrap("33", "39"),
-  blue: wrap("34", "39"),
-  magenta: wrap("35", "39"),
-  cyan: wrap("36", "39"),
-  gray: wrap("90", "39"),
-  amber: wrap("38;5;214", "39"),
-  pink: wrap("38;5;205", "39"),
-  bgRed: wrap("41", "49"),
-  bgGreen: wrap("42", "49")
-};
-
-// src/infrastructure/logger.ts
-var LEVEL_RANK = {
-  error: 0,
-  warn: 1,
-  info: 2,
-  debug: 3,
-  trace: 4
-};
-var COLORS = {
-  error: color.red,
-  warn: color.yellow,
-  info: color.cyan,
-  debug: color.gray,
-  trace: color.dim
-};
-var LOG_LEVELS = /* @__PURE__ */ new Set(["error", "warn", "info", "debug", "trace"]);
-var LOG_FORMATS = /* @__PURE__ */ new Set(["pretty", "json"]);
-var DefaultLogger = class _DefaultLogger {
-  /** How many file writes between rotation size checks (statSync is not free). */
-  static ROTATE_CHECK_EVERY = 100;
-  static MAX_PENDING_FILE_WRITES = 2e3;
-  static MAX_PENDING_FILE_BYTES = 8 * 1024 * 1024;
-  level;
-  file;
-  bindings;
-  format;
-  stderr;
-  maxFileBytes;
-  writesSinceRotateCheck = 0;
-  /**
-   * Serialized async tail for file writes. Every appendFile (and any
-   * chained rotation) is awaited through this promise so file I/O
-   * never overlaps itself — preserving the per-line ordering the
-   * sync version had, but without blocking the caller thread. Any
-   * rejection is swallowed (`catch(() => {})`) because logging must
-   * never crash the host.
-   *
-   * Children share the parent's tail: `child.tail === parent.tail`
-   * for the lifetime of the chain. Read/write access goes through
-   * `_tail` so that, when a child has been wired to a parent, both
-   * `enqueueRotate` and `log` always observe the parent's current tail
-   * rather than a stale snapshot taken at `child()` time.
-   */
-  tail = Promise.resolve();
-  parent = null;
-  pendingFileWrites = 0;
-  pendingFileBytes = 0;
-  get root() {
-    return this.parent ? this.parent.root : this;
-  }
-  /**
-   * Resolve the current tail. For the root logger this is the field;
-   * for a child logger we always read through the parent so that a
-   * child's appends land on the parent's most recent tail, and a
-   * parent's `flush()` waits for everything the child chained.
-   */
-  get _tail() {
-    return this.parent ? this.parent._tail : this.tail;
-  }
-  set _tail(next) {
-    if (this.parent) this.parent.tail = next;
-    else this.tail = next;
-  }
-  constructor(opts = {}) {
-    this.level = opts.level ?? parseLogLevel(process.env.WRONGSTACK_LOG_LEVEL);
-    this.file = opts.file;
-    this.bindings = opts.bindings ?? {};
-    this.format = opts.format ?? parseLogFormat(process.env.WRONGSTACK_LOG_FORMAT);
-    this.stderr = opts.stderr !== false;
-    this.maxFileBytes = opts.maxFileBytes ?? 10 * 1024 * 1024;
-    if (this.file) {
-      const dir = path.dirname(this.file);
-      this._tail = this._tail.then(async () => {
-        await fsp.mkdir(dir, { recursive: true });
-      }).catch(() => void 0);
-    }
-  }
-  error(msg, ctx) {
-    this.log("error", msg, ctx);
-  }
-  warn(msg, ctx) {
-    this.log("warn", msg, ctx);
-  }
-  info(msg, ctx) {
-    this.log("info", msg, ctx);
-  }
-  debug(msg, ctx) {
-    this.log("debug", msg, ctx);
-  }
-  trace(msg, ctx) {
-    this.log("trace", msg, ctx);
-  }
-  child(bindings) {
-    const child = Object.create(_DefaultLogger.prototype);
-    child.level = this.level;
-    child.file = this.file;
-    child.bindings = { ...this.bindings, ...bindings };
-    child.format = this.format;
-    child.stderr = this.stderr;
-    child.maxFileBytes = this.maxFileBytes;
-    child.parent = this;
-    child.writesSinceRotateCheck = this.writesSinceRotateCheck;
-    return child;
-  }
-  /**
-   * Wait until all queued file writes (and any pending rotation) have
-   * completed. `log()` is fire-and-forget by design — the caller never
-   * blocks on disk — so tests, shutdown handlers, and processes that
-   * need a deterministic "everything is on disk now" guarantee should
-   * `await logger.flush()` before reading the file or exiting.
-   */
-  flush() {
-    return this._tail;
-  }
-  /**
-   * Size-based rotation: when the file outgrows `maxFileBytes`, rename it to
-   * `<file>.1` (dropping the previous `.1`) so the live file restarts empty.
-   * Checked on the first write and every ROTATE_CHECK_EVERY writes after.
-   * Best-effort: a rename can fail on Windows while another process holds
-   * the file — the next check retries. Multiple processes appending to the
-   * same log all run this check; whoever crosses the threshold first wins.
-   *
-   * Async: the rotation runs on the file-write tail (so its writes don't
-   * interleave with the next append), and the caller never blocks on a
-   * statSync / renameSync syscall on the hot log path.
-   */
-  enqueueRotate(file) {
-    if (this.writesSinceRotateCheck++ % _DefaultLogger.ROTATE_CHECK_EVERY !== 0) return;
-    this._tail = this._tail.then(async () => {
-      let st;
-      try {
-        st = await fsp.stat(file);
-      } catch {
-        return;
-      }
-      if (st.size < this.maxFileBytes) return;
-      try {
-        await fsp.rm(`${file}.1`, { force: true });
-        await fsp.rename(file, `${file}.1`);
-      } catch {
-      }
-    }).catch(() => void 0);
-  }
-  log(level, msg, ctx) {
-    const r = LEVEL_RANK[level];
-    const allowed = LEVEL_RANK[this.level];
-    if (r > allowed) return;
-    const ts = (/* @__PURE__ */ new Date()).toISOString();
-    const entry = { ts, level, msg, ...this.bindings };
-    if (ctx !== void 0) {
-      entry.ctx = ctx instanceof Error ? { message: ctx.message, stack: ctx.stack } : ctx;
-    }
-    if (this.file) {
-      const line = `${JSON.stringify(entry)}
-`;
-      const bytes = Buffer.byteLength(line, "utf8");
-      const root = this.root;
-      if (root.pendingFileWrites < _DefaultLogger.MAX_PENDING_FILE_WRITES && bytes <= _DefaultLogger.MAX_PENDING_FILE_BYTES && root.pendingFileBytes + bytes <= _DefaultLogger.MAX_PENDING_FILE_BYTES) {
-        root.pendingFileWrites += 1;
-        root.pendingFileBytes += bytes;
-        this.enqueueRotate(this.file);
-        this._tail = this._tail.then(() => fsp.appendFile(this.file, line, { mode: 384 })).catch(() => void 0).finally(() => {
-          root.pendingFileWrites = Math.max(0, root.pendingFileWrites - 1);
-          root.pendingFileBytes = Math.max(0, root.pendingFileBytes - bytes);
-        });
-      }
-    }
-    if (!this.stderr) return;
-    if (this.format === "json") {
-      writeErr(`${JSON.stringify(entry)}
-`);
-    } else {
-      const head = `${color.dim(ts)} ${COLORS[level](level.toUpperCase().padEnd(5))} ${msg}`;
-      if (ctx !== void 0) {
-        writeErr(`${head} ${formatCtx(ctx)}
-`);
-      } else {
-        writeErr(`${head}
-`);
-      }
-    }
-  }
-};
-function parseLogLevel(raw) {
-  return raw && LOG_LEVELS.has(raw) ? raw : "info";
-}
-function parseLogFormat(raw) {
-  return raw && LOG_FORMATS.has(raw) ? raw : "pretty";
-}
-function formatCtx(ctx) {
-  if (ctx instanceof Error) return color.dim(ctx.message);
-  if (typeof ctx === "string") return color.dim(ctx);
-  try {
-    return color.dim(JSON.stringify(ctx));
-  } catch {
-    return color.dim(String(ctx));
-  }
-}
-var noOpLogger = {
-  // 'error' is the quietest level the Logger contract offers; the methods
-  // discard everything regardless, this only matters to level checks.
-  level: "error",
-  error: () => {
-  },
-  warn: () => {
-  },
-  info: () => {
-  },
-  debug: () => {
-  },
-  trace: () => {
-  },
-  child: () => noOpLogger
-};
-
-// src/infrastructure/path-resolver.ts
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path2 from "node:path";
-var PROJECT_MARKERS = [
-  ".git",
-  "package.json",
-  "pnpm-workspace.yaml",
-  "go.mod",
-  "Cargo.toml",
-  "pyproject.toml",
-  // Use AGENTS.md, not the bare .wrongstack directory.  A bare .wrongstack/
-  // directory can be the global config directory (~/.wrongstack), which is
-  // NOT a project marker.  Only .wrongstack/AGENTS.md signals a real
-  // WrongStack project.
-  ".wrongstack/AGENTS.md"
-];
-var DefaultPathResolver = class {
-  projectRoot;
-  cwd;
-  constructor(cwd = process.cwd()) {
-    this.cwd = path2.resolve(cwd);
-    this.projectRoot = this.detectProjectRoot(this.cwd);
-  }
-  detectProjectRoot(start) {
-    let dir = path2.resolve(start);
-    const root = path2.parse(dir).root;
-    const home = path2.resolve(os.homedir());
-    const startPath = path2.resolve(start);
-    while (dir !== root) {
-      if (dir === home && dir !== startPath) {
-        break;
-      }
-      for (const marker of PROJECT_MARKERS) {
-        try {
-          fs.accessSync(path2.join(dir, marker));
-          return dir;
-        } catch {
-        }
-      }
-      const parent = path2.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-    return startPath;
-  }
-  resolve(input) {
-    const abs = path2.isAbsolute(input) ? input : path2.resolve(this.cwd, input);
-    let real;
-    try {
-      real = fs.realpathSync(abs);
-    } catch {
-      real = path2.normalize(abs);
-    }
-    return real;
-  }
-  isInsideRoot(absPath) {
-    const normalized = path2.normalize(absPath);
-    const root = path2.normalize(this.projectRoot);
-    if (normalized === root) return true;
-    const rel = path2.relative(root, normalized);
-    return !rel.startsWith("..") && !path2.isAbsolute(rel);
-  }
-  ensureInsideRoot(absPath) {
-    const resolved = this.resolve(absPath);
-    if (!this.isInsideRoot(resolved)) {
-      const display = path2.isAbsolute(absPath) ? path2.basename(absPath) : absPath;
-      const err = new Error(`Path "${display}" resolves outside the project root`);
-      err.fullPath = absPath;
-      err.projectRoot = this.projectRoot;
-      throw err;
-    }
-    return resolved;
-  }
-};
-
-// src/utils/error.ts
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var ConfigError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "config",
-      severity: "fatal",
-      recoverable: false,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "ConfigError";
-  }
-};
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-
-// src/types/provider.ts
-function effectiveInputTokens(usage) {
-  return usage.input + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
-}
-function promptCacheHitRatio(usage) {
-  const total = effectiveInputTokens(usage);
-  if (!Number.isFinite(total) || total <= 0) return 0;
-  const cached = Number.isFinite(usage.cacheRead) ? Math.max(0, usage.cacheRead ?? 0) : 0;
-  return Math.min(1, cached / total);
-}
-var MAX_RESET_HINT_MS = 7 * 24 * 60 * 60 * 1e3;
-var KIND_TO_CODE = {
-  network: ERROR_CODES.PROVIDER_NETWORK_ERROR,
-  timeout: ERROR_CODES.PROVIDER_NETWORK_ERROR,
-  rate_limit: ERROR_CODES.PROVIDER_RATE_LIMITED,
-  quota_exhausted: ERROR_CODES.PROVIDER_RATE_LIMITED,
-  auth: ERROR_CODES.PROVIDER_AUTH_FAILED,
-  overloaded: ERROR_CODES.PROVIDER_OVERLOADED,
-  context_overflow: ERROR_CODES.PROVIDER_CONTEXT_OVERFLOW,
-  server: ERROR_CODES.PROVIDER_SERVER_ERROR,
-  stream_hang: ERROR_CODES.PROVIDER_SERVER_ERROR,
-  content_filter: ERROR_CODES.PROVIDER_INVALID_REQUEST,
-  invalid_request: ERROR_CODES.PROVIDER_INVALID_REQUEST,
-  unknown: ERROR_CODES.PROVIDER_INVALID_REQUEST
-};
+import {
+  DefaultPathResolver,
+  ProviderCacheLedger,
+  assertProjectRootOutsideStateDir,
+  bootConfig,
+  flagsToConfigPatch
+} from "../chunk-JTHKOYWU.js";
+import "../chunk-IQ35HMQL.js";
+import "../chunk-6AKOTGLM.js";
+import {
+  allServers,
+  awsServer,
+  blockServer,
+  braveSearchServer,
+  context7Server,
+  everArtServer,
+  filesystemServer,
+  githubServer,
+  googleMapsServer,
+  miniMaxVisionServer,
+  playwrightServer,
+  sentinelServer,
+  slackServer,
+  sshManagerServer,
+  zaiVisionServer
+} from "../chunk-FXQLIX3K.js";
+import "../chunk-YY6APYUM.js";
+import {
+  DefaultLogger
+} from "../chunk-WBPVKEEE.js";
+import "../chunk-H5E77KUJ.js";
+import "../chunk-ZZ4V3WIZ.js";
+import {
+  promptCacheHitRatio
+} from "../chunk-NFAYHPRH.js";
+import "../chunk-CQQL4ZOQ.js";
+import "../chunk-RPOA7IAE.js";
+import "../chunk-DEIQMBD2.js";
+import {
+  repairToolUseAdjacency
+} from "../chunk-M2WF6AXG.js";
+import "../chunk-4XV6IR37.js";
+import "../chunk-4VWO3ZXL.js";
+import {
+  estimateMessageTokens,
+  estimateRequestTokens
+} from "../chunk-FSWCWSTS.js";
+import "../chunk-7ZHZE5EO.js";
+import "../chunk-YNCVSFGF.js";
+import "../chunk-KJ2ZTQSL.js";
+import "../chunk-B4AMLZPB.js";
+import "../chunk-WOEZV3Q4.js";
+import "../chunk-TBRL2RCC.js";
+import "../chunk-PFZO3C6H.js";
 
 // src/infrastructure/token-counter.ts
 var PRICE_CACHE_MAX_SIZE = 100;
@@ -1507,640 +295,17 @@ function round4(n) {
   return Math.round(n * 1e4) / 1e4;
 }
 
-// src/infrastructure/provider-cache-ledger.ts
-var ProviderCacheLedger = class {
-  byProvider = /* @__PURE__ */ new Map();
-  last = { input: 0, cacheRead: 0, cacheWrite: 0 };
-  off;
-  constructor(events) {
-    this.off = events.on(
-      "token.accounted",
-      (p) => {
-        this.record(p.usage, p.provider, p.deltaUsage);
-      }
-    );
-  }
-  record(usage, provider, deltaUsage) {
-    const cur = {
-      input: usage.input,
-      cacheRead: usage.cacheRead ?? 0,
-      cacheWrite: usage.cacheWrite ?? 0
-    };
-    const delta = deltaUsage ? {
-      input: deltaUsage.input,
-      cacheRead: deltaUsage.cacheRead ?? 0,
-      cacheWrite: deltaUsage.cacheWrite ?? 0
-    } : {
-      input: Math.max(0, cur.input - this.last.input),
-      cacheRead: Math.max(0, cur.cacheRead - this.last.cacheRead),
-      cacheWrite: Math.max(0, cur.cacheWrite - this.last.cacheWrite)
-    };
-    this.last = cur;
-    const key = provider ?? "unknown";
-    const acc = this.byProvider.get(key) ?? { input: 0, cacheRead: 0, cacheWrite: 0 };
-    acc.input += delta.input;
-    acc.cacheRead += delta.cacheRead;
-    acc.cacheWrite += delta.cacheWrite;
-    this.byProvider.set(key, acc);
-  }
-  /** Distinct providers seen this session. */
-  providers() {
-    return [...this.byProvider.keys()];
-  }
-  /** Per-provider cache stats, most-cached first. */
-  perProvider() {
-    const out = [];
-    for (const [provider, a] of this.byProvider) {
-      out.push({
-        provider,
-        input: a.input,
-        cacheRead: a.cacheRead,
-        cacheWrite: a.cacheWrite,
-        hitRatio: promptCacheHitRatio({
-          input: a.input,
-          output: 0,
-          cacheRead: a.cacheRead,
-          cacheWrite: a.cacheWrite
-        })
-      });
-    }
-    return out.sort((x, y) => y.cacheRead - x.cacheRead);
-  }
-  /**
-   * Unsubscribe from the event bus and release the per-session listener.
-   *
-   * **The caller MUST invoke `dispose()` on session teardown** — see the
-   * constructor's lifecycle warning. Failure to call this method leaves a
-   * permanent `token.accounted` listener on the shared EventBus that
-   * accumulates unboundedly across session restarts/resumes.
-   */
-  dispose() {
-    this.off();
-  }
-};
-
-// src/infrastructure/mcp-servers.ts
-var filesystemServer = () => ({
-  name: "filesystem",
-  description: "Read, write, and navigate the local filesystem (read-heavy tools)",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-filesystem", "."],
-  permission: "confirm"
-});
-var githubServer = () => ({
-  name: "github",
-  description: "GitHub API \u2014 issues, PRs, repos, search, file ops (requires GITHUB_PERSONAL_ACCESS_TOKEN)",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-github"],
-  passthroughEnv: ["GITHUB_PERSONAL_ACCESS_TOKEN", "GITHUB_TOKEN"],
-  permission: "confirm"
-});
-var context7Server = () => ({
-  name: "context7",
-  description: "Codebase-aware documentation and Q&A (context7.ai)",
-  transport: "streamable-http",
-  url: "https://mcp.context7.com/mcp",
-  permission: "confirm"
-});
-var braveSearchServer = () => ({
-  name: "brave-search",
-  description: "Web search (Brave). Requires BRAVE_SEARCH_API_KEY \u2014 free tier 2k queries/month",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-brave-search"],
-  passthroughEnv: ["BRAVE_SEARCH_API_KEY"],
-  permission: "confirm"
-});
-var blockServer = () => ({
-  name: "block",
-  description: "Postgres database access via SQL (Block MCP server)",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-block"],
-  permission: "confirm"
-});
-var everArtServer = () => ({
-  name: "everart",
-  description: "AI image generation (EverArt). Requires EVERART_API_KEY",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-everart"],
-  passthroughEnv: ["EVERART_API_KEY"],
-  permission: "confirm"
-});
-var slackServer = () => ({
-  name: "slack",
-  description: "Slack \u2014 messaging, channels, search. Requires SLACK_BOT_TOKEN + SLACK_TEAM_ID",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-slack"],
-  passthroughEnv: ["SLACK_BOT_TOKEN", "SLACK_TEAM_ID"],
-  permission: "confirm"
-});
-var awsServer = () => ({
-  name: "aws",
-  description: "AWS \u2014 EC2, S3, Lambda, IAM, CloudFormation, costs. Requires AWS credentials",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-aws"],
-  passthroughEnv: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION", "AWS_SESSION_TOKEN"],
-  permission: "confirm"
-});
-var googleMapsServer = () => ({
-  name: "google-maps",
-  description: "Google Maps \u2014 directions, geocoding, places. Requires GOOGLE_MAPS_API_KEY",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-google-maps"],
-  passthroughEnv: ["GOOGLE_MAPS_API_KEY"],
-  permission: "confirm"
-});
-var sentinelServer = () => ({
-  name: "sentinel",
-  description: "Security vulnerability scanning (Sentinel)",
-  transport: "streamable-http",
-  url: "https://mcp.sentinel.ai",
-  permission: "deny"
-  // security tool — require explicit confirmation
-});
-var zaiVisionServer = () => ({
-  name: "zai-vision",
-  description: "Z.AI Vision MCP \u2014 image analysis and screenshot understanding",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@z_ai/mcp-server@latest"],
-  env: { Z_AI_MODE: "ZAI" },
-  passthroughEnv: ["Z_AI_API_KEY"],
-  allowedTools: [
-    "image_analysis",
-    "extract_text_from_screenshot",
-    "diagnose_error_screenshot",
-    "understand_technical_diagram",
-    "analyze_data_visualization",
-    "ui_diff_check"
-  ],
-  permission: "auto"
-});
-var playwrightServer = () => ({
-  name: "playwright",
-  description: "Browser automation \u2014 navigate, screenshot, click, type, evaluate JS (headless Chromium)",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "@modelcontextprotocol/server-playwright"],
-  permission: "confirm"
-});
-var miniMaxVisionServer = () => ({
-  name: "minimax-vision",
-  description: "MiniMax MCP \u2014 image understanding via understand_image",
-  transport: "stdio",
-  command: "uvx",
-  args: ["minimax-coding-plan-mcp", "-y"],
-  env: {
-    MINIMAX_MCP_BASE_PATH: "./.wrongstack/minimax-output",
-    MINIMAX_API_HOST: "https://api.minimax.io",
-    MINIMAX_API_RESOURCE_MODE: "url"
-  },
-  passthroughEnv: ["MINIMAX_API_KEY"],
-  allowedTools: ["understand_image"],
-  permission: "auto"
-});
-var sshManagerServer = () => ({
-  name: "ssh",
-  description: "Remote SSH management \u2014 execute commands, transfer files, tunnels, health checks (mcp-ssh-manager)",
-  transport: "stdio",
-  command: "npx",
-  args: ["-y", "mcp-ssh-manager"],
-  env: {
-    MCP_SSH_COMPACT_JSON: "true",
-    MCP_SSH_DEFAULT_TIMEOUT: "120000"
-  },
-  permission: "confirm",
-  requestTimeoutMs: 18e4
-});
-var requirementIntakeServer = () => ({
-  name: "requirement-intake",
-  description: "WrongStack Requirements Intake \u2014 list intake records and file new ones (project-scoped, --writable)",
-  transport: "stdio",
-  command: "wstack-requirement-intake-mcp",
-  args: ["--project-root", ".", "--writable"],
-  permission: "auto"
-});
-var kanbanServer = () => ({
-  name: "kanban",
-  description: "WrongStack Kanban \u2014 inspect and manage project work boards (project-scoped, manage tier, no destructive ops)",
-  transport: "stdio",
-  command: "wstack-kanban-mcp",
-  args: ["--project-root", ".", "--writable"],
-  permission: "confirm"
-});
-var mailboxServer = () => ({
-  name: "mailbox",
-  description: "WrongStack Mailbox \u2014 read and send project agent mail (project-scoped, no admin/credentials)",
-  transport: "stdio",
-  command: "wstack-mailbox-mcp",
-  args: ["--project-root", ".", "--actor", "external-agent", "--writable"],
-  permission: "auto"
-});
-var codebaseIndexServer = () => ({
-  name: "codebase-index",
-  description: "WrongStack Codebase Index \u2014 symbol search and dependency graphs (project-scoped, --writable)",
-  transport: "stdio",
-  command: "wstack-codebase-index-mcp",
-  args: ["--project-root", ".", "--writable"],
-  permission: "auto"
-});
-var allServers = () => ({
-  filesystem: { ...filesystemServer(), enabled: false },
-  github: { ...githubServer(), enabled: false },
-  context7: { ...context7Server(), enabled: false },
-  "brave-search": { ...braveSearchServer(), enabled: false },
-  block: { ...blockServer(), enabled: false },
-  everart: { ...everArtServer(), enabled: false },
-  slack: { ...slackServer(), enabled: false },
-  aws: { ...awsServer(), enabled: false },
-  "google-maps": { ...googleMapsServer(), enabled: false },
-  sentinel: { ...sentinelServer(), enabled: false },
-  "zai-vision": { ...zaiVisionServer(), enabled: false },
-  "minimax-vision": { ...miniMaxVisionServer(), enabled: false },
-  playwright: { ...playwrightServer(), enabled: false },
-  ssh: { ...sshManagerServer(), enabled: false },
-  kanban: { ...kanbanServer(), enabled: false },
-  mailbox: { ...mailboxServer(), enabled: false },
-  "codebase-index": { ...codebaseIndexServer(), enabled: false },
-  "requirement-intake": { ...requirementIntakeServer(), enabled: false }
-});
-
-// src/utils/expect-defined.ts
-function expectDefined(value, label) {
-  if (value === null || value === void 0) {
-    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
-    err.name = "ExpectDefinedError";
-    throw err;
-  }
-  return value;
+// src/infrastructure/context-manager.ts
+var CONTEXT_MANAGER_TOOL_NAME = "context_manager";
+function roughEstimate(messages) {
+  return estimateMessageTokens(messages);
 }
-
-// src/utils/message-invariants.ts
-function repairToolUseAdjacency(messages) {
-  const removedToolUses = [];
-  const removedToolResults = [];
-  let removedMessages = 0;
-  let changed = false;
-  const out = [];
-  for (let i = 0; i < messages.length; i++) {
-    const original = expectDefined(messages[i]);
-    let msg = original;
-    if (hasToolUse(msg)) {
-      const nextIds = toolResultIds(messages[i + 1]);
-      const filtered = mapContent(msg, (blocks) => {
-        const next = [];
-        for (const block of blocks) {
-          if (block.type === "tool_use" && !nextIds.has(block.id)) {
-            removedToolUses.push(block.id);
-            changed = true;
-            continue;
-          }
-          next.push(block);
-        }
-        return next;
-      });
-      msg = filtered ?? msg;
-    }
-    if (hasToolResult(msg)) {
-      const allowed = toolUseIds(out[out.length - 1]);
-      const filtered = mapContent(msg, (blocks) => {
-        const next = [];
-        for (const block of blocks) {
-          if (block.type === "tool_result" && !allowed.has(block.tool_use_id)) {
-            removedToolResults.push(block.tool_use_id);
-            changed = true;
-            continue;
-          }
-          next.push(block);
-        }
-        return next;
-      });
-      msg = filtered ?? msg;
-    }
-    if (isEmptyMessage(msg)) {
-      removedMessages++;
-      changed = true;
-      continue;
-    }
-    out.push(msg);
-  }
-  return {
-    messages: changed ? out : messages,
-    report: { changed, removedToolUses, removedToolResults, removedMessages }
-  };
-}
-function hasToolUse(msg) {
-  return contentBlocks(msg).some((b) => b.type === "tool_use");
-}
-function hasToolResult(msg) {
-  return contentBlocks(msg).some((b) => b.type === "tool_result");
-}
-function toolUseIds(msg) {
-  const ids = /* @__PURE__ */ new Set();
-  if (msg?.role !== "assistant") return ids;
-  for (const block of contentBlocks(msg)) {
-    if (block.type === "tool_use") ids.add(block.id);
-  }
-  return ids;
-}
-function toolResultIds(msg) {
-  const ids = /* @__PURE__ */ new Set();
-  if (msg?.role !== "user") return ids;
-  for (const block of contentBlocks(msg)) {
-    if (block.type === "tool_result") ids.add(block.tool_use_id);
-  }
-  return ids;
-}
-function contentBlocks(msg) {
-  return msg && Array.isArray(msg.content) ? msg.content : [];
-}
-function mapContent(msg, fn) {
-  if (!Array.isArray(msg.content)) return msg;
-  const next = fn(msg.content);
-  if (next.length === msg.content.length && next.every((b, idx) => b === msg.content[idx])) {
-    return msg;
-  }
-  return { ...msg, content: next };
-}
-function hasMeaningfulContent(content) {
-  if (typeof content === "string") return content.trim().length > 0;
-  for (const block of content) {
-    if (block.type === "text") {
-      if (block.text.trim().length > 0) return true;
-      continue;
-    }
-    if (block.type === "thinking") {
-      if (block.thinking.trim().length > 0 || block.signature) return true;
-      continue;
-    }
-    return true;
-  }
-  return false;
-}
-function isEmptyMessage(msg) {
-  return !hasMeaningfulContent(msg.content);
-}
-
-// src/utils/tool-wire-compact.ts
-var TOOL_DESCRIPTION_MAX_CHARS = 400;
-var SCHEMA_DESCRIPTION_MAX_CHARS = 120;
-var compactCache = /* @__PURE__ */ new WeakMap();
-function compactToolDefinitionForWire(tool, opts = {}) {
-  const useDefaultOptions = opts.descriptionMaxChars === void 0 && opts.schemaDescriptionMaxChars === void 0;
-  if (useDefaultOptions && typeof tool === "object" && tool !== null) {
-    const cached = compactCache.get(tool);
-    if (cached) return cached;
-  }
-  const compact = {
-    name: tool.name,
-    description: compactDescription(
-      tool.description ?? "",
-      opts.descriptionMaxChars ?? TOOL_DESCRIPTION_MAX_CHARS
-    ),
-    inputSchema: normalizeTopLevelToolSchema(
-      compactSchemaDescriptions(
-        tool.inputSchema,
-        opts.schemaDescriptionMaxChars ?? SCHEMA_DESCRIPTION_MAX_CHARS
-      )
-    )
-  };
-  if (useDefaultOptions && typeof tool === "object" && tool !== null) {
-    compactCache.set(tool, compact);
-  }
-  return compact;
-}
-function normalizeTopLevelToolSchema(schema) {
-  const combinators = ["oneOf", "anyOf", "allOf"].map((keyword) => ({ keyword, branches: schema[keyword] })).filter(
-    (entry) => Array.isArray(entry.branches)
-  );
-  if (combinators.length === 0) return schema;
-  const out = { ...schema, type: "object" };
-  delete out["oneOf"];
-  delete out["anyOf"];
-  delete out["allOf"];
-  const properties = isRecord(schema["properties"]) ? { ...schema["properties"] } : {};
-  let required = stringSet(schema["required"]);
-  for (const { keyword, branches } of combinators) {
-    const objectBranches = branches.filter(isRecord);
-    for (const branch of objectBranches) {
-      if (isRecord(branch["properties"])) Object.assign(properties, branch["properties"]);
-    }
-    const branchRequired = objectBranches.map((branch) => stringSet(branch["required"]));
-    if (keyword === "allOf") {
-      for (const fields of branchRequired) for (const field of fields) required.add(field);
-    } else if (branchRequired.length > 0) {
-      const common = new Set(
-        [...branchRequired[0]].filter(
-          (field) => branchRequired.slice(1).every((fields) => fields.has(field))
-        )
-      );
-      required = /* @__PURE__ */ new Set([...required, ...common]);
-    }
-  }
-  out["properties"] = properties;
-  if (required.size > 0) out["required"] = [...required];
-  else delete out["required"];
-  return out;
-}
-function stringSet(value) {
-  return new Set(
-    Array.isArray(value) ? value.filter((item) => typeof item === "string") : []
-  );
-}
-function compactSchemaDescriptions(schema, maxDescriptionChars = SCHEMA_DESCRIPTION_MAX_CHARS) {
-  const compact = compactSchemaNode(schema, maxDescriptionChars);
-  return isRecord(compact) ? compact : { type: "object", properties: {} };
-}
-function compactSchemaNode(node, maxDescriptionChars) {
-  if (Array.isArray(node)) {
-    return node.map((item) => compactSchemaNode(item, maxDescriptionChars));
-  }
-  if (!isRecord(node)) return node;
-  const out = {};
-  for (const [key, value] of Object.entries(node)) {
-    if (key === "description" && typeof value === "string") {
-      out[key] = compactDescription(value, maxDescriptionChars);
-    } else {
-      out[key] = compactSchemaNode(value, maxDescriptionChars);
-    }
-  }
-  return out;
-}
-function compactDescription(text, maxChars) {
-  const normalized = text.replace(/\s+/g, " ").trim();
-  if (normalized.length <= maxChars) return normalized;
-  if (maxChars <= 20) return normalized.slice(0, maxChars);
-  const hardLimit = maxChars - 12;
-  const boundary = findSemanticBoundary(normalized, hardLimit);
-  const head = normalized.slice(0, boundary > 0 ? boundary : hardLimit).trimEnd();
-  return `${head} ...`;
-}
-function findSemanticBoundary(text, limit) {
-  const punctuation = Math.max(
-    text.lastIndexOf(". ", limit),
-    text.lastIndexOf("; ", limit),
-    text.lastIndexOf(": ", limit)
-  );
-  if (punctuation >= Math.floor(limit * 0.45)) return punctuation + 1;
-  const comma = text.lastIndexOf(", ", limit);
-  if (comma >= Math.floor(limit * 0.6)) return comma + 1;
-  const space = text.lastIndexOf(" ", limit);
-  return space >= Math.floor(limit * 0.6) ? space : limit;
-}
-function isRecord(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-
-// src/utils/token-estimate.ts
-var RoughTokenEstimate = (text, charsPerToken = 3.5) => Math.max(1, Math.ceil(text.length / charsPerToken));
-var CALIBRATION_GLOBAL_KEY = "__global__";
-var _cals = /* @__PURE__ */ new Map();
-function calState(key) {
-  let state = _cals.get(key);
-  if (!state) {
-    state = { ratio: 1, count: 0, prevEst: 0 };
-    _cals.set(key, state);
-  }
-  return state;
-}
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var _estimateCacheOrder = [];
-var ESTIMATE_CACHE_MAX_SIZE = 5e4;
-function estimateCacheKey(source) {
-  let h = 5381;
-  for (let i = 0; i < source.length; i++) {
-    h = (h << 5) + h + source.charCodeAt(i) | 0;
-  }
-  return `${source.length}:${h >>> 0}`;
-}
-function getCachedEstimate(source, compute) {
-  const key = estimateCacheKey(source);
-  const existing = ESTIMATE_CACHE.get(key);
-  if (existing !== void 0) return existing;
-  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    while (ESTIMATE_CACHE.size > Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) {
-      const oldest = _estimateCacheOrder.shift();
-      if (oldest !== void 0) ESTIMATE_CACHE.delete(oldest);
-    }
-  }
-  const estimate = compute(source);
-  ESTIMATE_CACHE.set(key, estimate);
-  _estimateCacheOrder.push(key);
-  return estimate;
-}
-function estimateToolInputTokens(input) {
-  if (typeof input === "string") return RoughTokenEstimate(input);
-  if (input === null || typeof input !== "object") {
-    return RoughTokenEstimate(String(input));
-  }
-  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
-}
-function estimateToolResultTokens(content) {
-  if (typeof content === "string") return RoughTokenEstimate(content);
-  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
-}
-function estimateTextTokens(text) {
-  return RoughTokenEstimate(text);
-}
-function computeMessageTokens(msg) {
-  if (typeof msg.content === "string") return estimateTextTokens(msg.content);
-  let total = 0;
-  for (const b of msg.content) {
-    if (b.type === "text") total += estimateTextTokens(b.text);
-    else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
-    else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
-    else total += RoughTokenEstimate(JSON.stringify(b));
-  }
-  return total;
-}
-function estimateMessageTokens(messages) {
-  let total = 0;
-  for (const m of messages) {
-    if (typeof m._estTokens === "number" && m._estTokens > 0) {
-      total += m._estTokens;
-      continue;
-    }
-    total += computeMessageTokens(m);
-  }
-  return total;
-}
-function estimateToolDefTokens(tool) {
-  const cached = tool._estDefTokens;
-  if (typeof cached === "number" && cached > 0) return cached;
-  const compact = compactToolDefinitionForWire(tool);
-  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(compact.description) + RoughTokenEstimate(JSON.stringify(compact.inputSchema));
-}
-function estimateRequestTokens(messages, systemPrompt, tools, calibrationKey = CALIBRATION_GLOBAL_KEY) {
-  let messagesTokens = 0;
-  if (typeof messages === "string") {
-    messagesTokens = RoughTokenEstimate(messages);
-  } else if (Array.isArray(messages)) {
-    for (const m of messages) {
-      if (typeof m === "object" && m !== null && "content" in m) {
-        const cached = m._estTokens;
-        if (typeof cached === "number" && cached > 0) {
-          messagesTokens += cached;
-          continue;
-        }
-        const content = m.content;
-        if (typeof content === "string") {
-          messagesTokens += RoughTokenEstimate(content);
-        } else if (Array.isArray(content)) {
-          for (const b of content) {
-            if (typeof b === "object" && b !== null) {
-              if (b.type === "text") {
-                messagesTokens += RoughTokenEstimate(b.text);
-              } else {
-                messagesTokens += RoughTokenEstimate(JSON.stringify(b));
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-  let systemTokens = 0;
-  if (typeof systemPrompt === "string") {
-    systemTokens = RoughTokenEstimate(systemPrompt);
-  } else if (Array.isArray(systemPrompt)) {
-    for (const b of systemPrompt) {
-      if (typeof b === "object" && b !== null && b.type === "text") {
-        systemTokens += RoughTokenEstimate(b.text);
-      }
-    }
-  }
-  let toolsTokens = 0;
-  for (const t of tools) {
-    toolsTokens += estimateToolDefTokens(t);
-  }
-  const total = messagesTokens + systemTokens + toolsTokens;
-  calState(calibrationKey).prevEst = total;
-  return {
-    messages: messagesTokens,
-    systemPrompt: systemTokens,
-    tools: toolsTokens,
-    total
-  };
-}
-
-// src/infrastructure/context-manager.ts
-var CONTEXT_MANAGER_TOOL_NAME = "context_manager";
-function roughEstimate(messages) {
-  return estimateMessageTokens(messages);
-}
-function createContextManagerTool(opts = {}) {
-  const minCompactThreshold = opts.minCompactThreshold ?? 0;
-  const noopRetryDeltaTokens = opts.noopRetryDeltaTokens ?? 1e3;
-  const configuredMaxContext = opts.maxContext;
-  const compactThresholdFraction = opts.compactThresholdFraction ?? 0.4;
-  let lastNoopTokens = 0;
+function createContextManagerTool(opts = {}) {
+  const minCompactThreshold = opts.minCompactThreshold ?? 0;
+  const noopRetryDeltaTokens = opts.noopRetryDeltaTokens ?? 1e3;
+  const configuredMaxContext = opts.maxContext;
+  const compactThresholdFraction = opts.compactThresholdFraction ?? 0.4;
+  let lastNoopTokens = 0;
   return {
     name: CONTEXT_MANAGER_TOOL_NAME,
     description: 'Inspect or reorganize the conversation context window. Use "check" to see token budget. Use "summary" to collapse a message range into a concise note (provide "text" for custom summary). Use "prune" to remove specific messages by index. Use "add_note" to inject a summary note. Use "compact" to run aggressive compaction. Use "repair" to remove orphan tool_use/tool_result blocks after manual context surgery.',
@@ -2389,2918 +554,6 @@ function createContextManagerTool(opts = {}) {
   };
 }
 var contextManagerTool = createContextManagerTool();
-
-// src/boot.ts
-import * as fs9 from "node:fs/promises";
-import * as os4 from "node:os";
-import * as path12 from "node:path";
-
-// src/security/secret-vault.ts
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
-import * as fs2 from "node:fs";
-import * as fsp2 from "node:fs/promises";
-import * as path3 from "node:path";
-
-// src/types/secret-vault.ts
-var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
-function encryptedPrefixForVersion(version) {
-  return `enc:v${version}:`;
-}
-
-// src/utils/atomic-write.ts
-import {
-  createPersistencePrimitives
-} from "@wrongstack/persistence";
-var primitives = createPersistencePrimitives({
-  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
-    message: `Timed out waiting for file lock: ${targetPath}`,
-    code: "FS_ATOMIC_WRITE_FAILED",
-    path: targetPath,
-    context: { timeoutMs }
-  })
-});
-var atomicWrite = primitives.atomicWrite;
-var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
-var ensureDir = primitives.ensureDir;
-var withFileLock = primitives.withFileLock;
-
-// src/security/config-secrets.ts
-function decryptConfigSecrets(cfg, vault, opts) {
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  return walk(cfg, vault, (v, key) => {
-    try {
-      return vault.decrypt(v);
-    } catch (err) {
-      warn(
-        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
-      );
-      return "";
-    }
-  });
-}
-function walk(node, vault, transform) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walk(item, vault, transform));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k)) {
-      out[k] = transform(v, k);
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walk(v, vault, transform);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
-var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
-function isSecretField(name) {
-  const lc = name.toLowerCase();
-  if (NON_SECRET_OVERRIDES.has(lc)) return false;
-  return SECRET_KEY_PATTERN.test(lc);
-}
-
-// src/security/file-permissions.ts
-import {
-  restrictDirPermissions,
-  restrictFilePermissions,
-  SECRET_DIR_MODE,
-  SECRET_FILE_MODE
-} from "@wrongstack/persistence";
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
-  }
-  return out;
-}
-
-// src/security/secret-vault.ts
-var KEY_BYTES = 32;
-var IV_BYTES = 12;
-var TAG_BYTES = 16;
-var ALGO = "aes-256-gcm";
-var KEY_FILE_MODE = 384;
-var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
-var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
-var KEK_MAGIC = Buffer.from("WSKW", "ascii");
-var KEK_SALT_BYTES = 16;
-var WRAPPED_KEY_FILE_SIZE = KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
-var SCRYPT_N = 1 << 15;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SCRYPT_MAXMEM = 64 * 1024 * 1024;
-function getVaultPassphrase() {
-  const v = process.env["WRONGSTACK_VAULT_PASSPHRASE"];
-  return v && v.length > 0 ? v : void 0;
-}
-function isWrappedKeyFile(buf) {
-  return buf.length === WRAPPED_KEY_FILE_SIZE && buf.subarray(0, KEK_MAGIC.length).equals(KEK_MAGIC);
-}
-function deriveKEK(passphrase, salt) {
-  return scryptSync(passphrase, salt, KEY_BYTES, {
-    N: SCRYPT_N,
-    r: SCRYPT_R,
-    p: SCRYPT_P,
-    maxmem: SCRYPT_MAXMEM
-  });
-}
-function wrapDataKey(dataKey, keyVersion, passphrase) {
-  const salt = randomBytes(KEK_SALT_BYTES);
-  const iv = randomBytes(IV_BYTES);
-  const kek = deriveKEK(passphrase, salt);
-  const cipher = createCipheriv(ALGO, kek, iv);
-  const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const out = Buffer.alloc(WRAPPED_KEY_FILE_SIZE);
-  let off = 0;
-  KEK_MAGIC.copy(out, off);
-  off += KEK_MAGIC.length;
-  out[off] = keyVersion & 255;
-  off += 1;
-  salt.copy(out, off);
-  off += KEK_SALT_BYTES;
-  iv.copy(out, off);
-  off += IV_BYTES;
-  tag.copy(out, off);
-  off += TAG_BYTES;
-  ct.copy(out, off);
-  return out;
-}
-function unwrapDataKey(buf, keyFile) {
-  const passphrase = getVaultPassphrase();
-  if (!passphrase) {
-    throw new ConfigError({
-      message: `SecretVault: key file ${keyFile} is passphrase-protected \u2014 set the WRONGSTACK_VAULT_PASSPHRASE environment variable to unlock it.`,
-      code: ERROR_CODES.CONFIG_INVALID,
-      context: { keyFile }
-    });
-  }
-  let off = KEK_MAGIC.length;
-  const version = buf[off];
-  off += 1;
-  const salt = buf.subarray(off, off + KEK_SALT_BYTES);
-  off += KEK_SALT_BYTES;
-  const iv = buf.subarray(off, off + IV_BYTES);
-  off += IV_BYTES;
-  const tag = buf.subarray(off, off + TAG_BYTES);
-  off += TAG_BYTES;
-  const ct = buf.subarray(off, off + KEY_BYTES);
-  const kek = deriveKEK(passphrase, salt);
-  const decipher = createDecipheriv(ALGO, kek, iv);
-  decipher.setAuthTag(tag);
-  try {
-    const key = Buffer.concat([decipher.update(ct), decipher.final()]);
-    return { key: Buffer.from(key), version };
-  } catch {
-    throw new ConfigError({
-      message: `SecretVault: failed to unlock key file ${keyFile} \u2014 wrong WRONGSTACK_VAULT_PASSPHRASE (key unwrap authentication failed).`,
-      code: ERROR_CODES.CONFIG_INVALID,
-      context: { keyFile }
-    });
-  }
-}
-function keyFileNeedsHardening(keyFile, opts) {
-  if (process.platform === "win32") return false;
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  try {
-    const stat5 = fs2.statSync(keyFile);
-    const actualMode = stat5.mode & 511;
-    if (actualMode !== KEY_FILE_MODE) {
-      warn(
-        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Hardening\u2026`
-      );
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-function mkdirSecretDirSync(dir) {
-  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  if (process.platform === "win32") return;
-  try {
-    fs2.chmodSync(dir, 448);
-  } catch {
-  }
-}
-function writeKeyFileAtomicSync(keyFile, content) {
-  const tmp = `${keyFile}.${randomBytes(4).toString("hex")}.tmp`;
-  const fd = fs2.openSync(tmp, "w", 384);
-  try {
-    fs2.writeFileSync(fd, content);
-    try {
-      fs2.fsyncSync(fd);
-    } catch {
-    }
-  } finally {
-    fs2.closeSync(fd);
-  }
-  try {
-    fs2.renameSync(tmp, keyFile);
-  } catch (err) {
-    try {
-      fs2.unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
-  }
-}
-var DefaultSecretVault = class {
-  keyFile;
-  logger;
-  key;
-  _keyVersion = 1;
-  /**
-   * Pending key-file hardening promises (Windows ACL restrictions via icacls).
-   * Tracked so async callers can `flushHardening()` before returning, ensuring
-   * a short-lived CLI process does not exit before the hardening resolves.
-   * Sync-only callers (encrypt/decrypt lazy-load) leave these pending —
-   * hardening remains best-effort in that case.
-   */
-  pendingHardening = [];
-  constructor(opts) {
-    this.keyFile = opts.keyFile;
-    this.logger = opts.logger;
-  }
-  /**
-   * Emit a structured warning. Uses the configured Logger when available;
-   * falls back to console.warn(JSON) so warnings are never silently dropped
-   * during early boot.
-   */
-  logWarn(msg, ctx) {
-    if (this.logger) {
-      this.logger.warn(msg, ctx);
-    } else {
-      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
-    }
-  }
-  /**
-   * Schedule best-effort key-file hardening and track the promise so async
-   * callers can await it via `flushHardening()` before returning. Rejections
-   * are swallowed here (the helper already warns on failure) so a rejection
-   * can never become an unhandled one.
-   */
-  scheduleKeyHardening() {
-    const p = restrictFilePermissions(this.keyFile, {
-      label: "secret-vault-key",
-      warn: (msg) => this.logWarn(msg)
-    }).catch(() => void 0);
-    this.pendingHardening.push(p);
-  }
-  /** Detect and schedule repair of a pre-existing POSIX key with loose mode bits. */
-  checkKeyFilePermissions() {
-    if (keyFileNeedsHardening(this.keyFile, {
-      warn: (msg) => this.logWarn(msg)
-    })) {
-      this.scheduleKeyHardening();
-    }
-  }
-  /** Flush all pending key-file hardening promises. */
-  flushHardening() {
-    if (this.pendingHardening.length === 0) return Promise.resolve();
-    const all = Promise.all(this.pendingHardening).then(() => void 0);
-    this.pendingHardening = [];
-    return all;
-  }
-  /** Current key version. Starts at 1; incremented by rotateKey(). */
-  get keyVersion() {
-    if (!this.key) this.loadOrCreateKey();
-    return this._keyVersion;
-  }
-  isEncrypted(value) {
-    return typeof value === "string" && ENCRYPTED_PREFIX_PATTERN.test(value);
-  }
-  encrypt(plaintext) {
-    if (this.isEncrypted(plaintext)) return plaintext;
-    const key = this.loadOrCreateKey();
-    const iv = randomBytes(IV_BYTES);
-    const cipher = createCipheriv(ALGO, key, iv);
-    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    const prefix = encryptedPrefixForVersion(this._keyVersion);
-    return `${prefix}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
-  }
-  decrypt(value) {
-    if (!this.isEncrypted(value)) return value;
-    const prefixMatch = value.match(ENCRYPTED_PREFIX_PATTERN);
-    if (!prefixMatch) {
-      throw new ConfigError({
-        message: "SecretVault: malformed encrypted value",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { field: "encrypted_value" }
-      });
-    }
-    const rest = value.slice(prefixMatch[0].length);
-    const parts = rest.split(":");
-    if (parts.length !== 3) {
-      throw new ConfigError({
-        message: "SecretVault: malformed encrypted value",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { field: "encrypted_value" }
-      });
-    }
-    const [ivB64, tagB64, ctB64] = parts;
-    const iv = Buffer.from(ivB64, "base64");
-    const tag = Buffer.from(tagB64, "base64");
-    const ct = Buffer.from(ctB64, "base64");
-    if (iv.length !== IV_BYTES)
-      throw new ConfigError({
-        message: "SecretVault: bad IV length",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { expected: IV_BYTES, actual: iv.length }
-      });
-    if (tag.length !== TAG_BYTES)
-      throw new ConfigError({
-        message: "SecretVault: bad tag length",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { expected: TAG_BYTES, actual: tag.length }
-      });
-    const key = this.loadOrCreateKey();
-    const decipher = createDecipheriv(ALGO, key, iv);
-    decipher.setAuthTag(tag);
-    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
-    return pt.toString("utf8");
-  }
-  /**
-   * Generate a new encryption key, write it to disk, and increment the key version.
-   * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
-   * The caller must re-encrypt existing config values (see rotateConfigKeys()).
-   */
-  rotateKey() {
-    const oldVersion = this._keyVersion;
-    const newKey = randomBytes(KEY_BYTES);
-    const newVersion = oldVersion + 1;
-    mkdirSecretDirSync(path3.dirname(this.keyFile));
-    const passphrase = getVaultPassphrase();
-    if (passphrase) {
-      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
-    } else {
-      const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
-      KEY_FILE_MAGIC.copy(keyFileBuf, 0);
-      keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
-      newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
-      writeKeyFileAtomicSync(this.keyFile, keyFileBuf);
-    }
-    this.scheduleKeyHardening();
-    this.checkKeyFilePermissions();
-    this.key = newKey;
-    this._keyVersion = newVersion;
-    return { oldVersion, newVersion };
-  }
-  /**
-   * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
-   * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
-   * form. The data key is preserved, so all existing ciphertext keeps
-   * decrypting. Best-effort: a write failure leaves the working unwrapped file
-   * in place and is not fatal to load.
-   */
-  migrateToWrappedIfPassphrase() {
-    const passphrase = getVaultPassphrase();
-    if (!passphrase || !this.key) return;
-    try {
-      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase));
-      this.scheduleKeyHardening();
-      this.checkKeyFilePermissions();
-    } catch {
-    }
-  }
-  loadOrCreateKey() {
-    if (this.key) return this.key;
-    try {
-      const buf = fs2.readFileSync(this.keyFile);
-      if (isWrappedKeyFile(buf)) {
-        const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
-        this.key = key2;
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      if (buf.length === KEY_BYTES) {
-        this.key = buf;
-        this._keyVersion = 1;
-        this.checkKeyFilePermissions();
-        this.migrateToWrappedIfPassphrase();
-        return this.key;
-      }
-      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
-        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
-        if (!magic.equals(KEY_FILE_MAGIC)) {
-          throw new ConfigError({
-            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
-            code: ERROR_CODES.CONFIG_INVALID,
-            context: { keyFile: this.keyFile }
-          });
-        }
-        const version = buf[KEY_FILE_MAGIC.length];
-        const key2 = buf.subarray(KEY_FILE_MAGIC.length + 1);
-        if (key2.length !== KEY_BYTES) {
-          throw new ConfigError({
-            message: `SecretVault: key file ${this.keyFile} has wrong key size (${key2.length} bytes, expected ${KEY_BYTES})`,
-            code: ERROR_CODES.CONFIG_INVALID,
-            context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: key2.length }
-          });
-        }
-        this.key = Buffer.from(key2);
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        this.migrateToWrappedIfPassphrase();
-        return this.key;
-      }
-      throw new ConfigError({
-        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-      });
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
-    }
-    mkdirSecretDirSync(path3.dirname(this.keyFile));
-    const key = randomBytes(KEY_BYTES);
-    const passphrase = getVaultPassphrase();
-    const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
-    try {
-      fs2.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
-      this.scheduleKeyHardening();
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      this.scheduleKeyHardening();
-      const buf = fs2.readFileSync(this.keyFile);
-      if (isWrappedKeyFile(buf)) {
-        const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
-        this.key = winnerKey;
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      if (buf.length === KEY_BYTES) {
-        this.key = buf;
-        this._keyVersion = 1;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
-        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
-        if (!magic.equals(KEY_FILE_MAGIC)) {
-          throw new ConfigError({
-            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
-            code: ERROR_CODES.CONFIG_INVALID,
-            context: { keyFile: this.keyFile }
-          });
-        }
-        const version = buf[KEY_FILE_MAGIC.length];
-        const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
-        this.key = Buffer.from(winnerKey);
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      throw new ConfigError({
-        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-      });
-    }
-    this.key = key;
-    this._keyVersion = 1;
-    return key;
-  }
-};
-async function migratePlaintextSecrets(configPath, vault, logger) {
-  let raw;
-  try {
-    raw = await fsp2.readFile(configPath, "utf8");
-  } catch {
-    return { migrated: 0, file: configPath };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { migrated: 0, file: configPath };
-  }
-  const counter = { n: 0 };
-  const migrated = walkCount(parsed, vault, counter);
-  if (counter.n === 0) return { migrated: 0, file: configPath };
-  await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  await restrictFilePermissions2(
-    configPath,
-    logger ? { warn: (msg) => logger.warn(msg) } : void 0
-  );
-  await vault.flushHardening?.();
-  return { migrated: counter.n, file: configPath };
-}
-async function restrictFilePermissions2(filePath, opts) {
-  await restrictFilePermissions(filePath, { label: "secret-vault", warn: opts?.warn });
-}
-function walkCount(node, vault, counter) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walkCount(item, vault, counter));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
-      out[k] = vault.encrypt(v);
-      counter.n++;
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walkCount(v, vault, counter);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-
-// src/storage/config-loader.ts
-import * as fs5 from "node:fs/promises";
-
-// src/types/context-window.ts
-var DEFAULT_CONTEXT_WINDOW_MODE_ID = "balanced";
-var DEPRECATED_CONTEXT_WINDOW_MODE_ALIASES = Object.freeze({
-  archival: "balanced"
-});
-var CONTEXT_WINDOW_MODES = Object.freeze([
-  {
-    id: "balanced",
-    name: "Balanced",
-    description: "Default rolling compaction: recent work stays verbatim, old tool output is trimmed. Windows of 1M+ tokens default to Deep.",
-    thresholds: { warn: 0.55, soft: 0.7, hard: 0.85 },
-    aggressiveOn: "soft",
-    preserveK: 8,
-    eliseThreshold: 1200,
-    targetLoad: 0.65
-  },
-  {
-    id: "frugal",
-    name: "Frugal",
-    description: "Token-saver mode: compacts early and keeps a tight verbatim tail.",
-    thresholds: { warn: 0.4, soft: 0.55, hard: 0.7 },
-    aggressiveOn: "warn",
-    preserveK: 4,
-    eliseThreshold: 500,
-    targetLoad: 0.45
-  },
-  {
-    id: "deep",
-    name: "Deep",
-    description: "Long-reasoning mode: delays compaction and keeps more recent turns intact.",
-    thresholds: { warn: 0.72, soft: 0.86, hard: 0.96 },
-    aggressiveOn: "hard",
-    preserveK: 18,
-    eliseThreshold: 5e3,
-    targetLoad: 0.82
-  }
-]);
-function listContextWindowModes() {
-  return CONTEXT_WINDOW_MODES.map((m) => ({ ...m, thresholds: { ...m.thresholds } }));
-}
-function normalizeContextWindowModeId(id) {
-  if (!id) return null;
-  if (isContextWindowModeId(id)) return id;
-  return DEPRECATED_CONTEXT_WINDOW_MODE_ALIASES[id] ?? null;
-}
-function isDeprecatedContextWindowModeId(id) {
-  return Object.hasOwn(DEPRECATED_CONTEXT_WINDOW_MODE_ALIASES, id);
-}
-function isContextWindowModeSelectionId(id) {
-  return isContextWindowModeId(id) || isDeprecatedContextWindowModeId(id);
-}
-function isContextWindowModeId(id) {
-  return CONTEXT_WINDOW_MODES.some((m) => m.id === id);
-}
-
-// src/utils/config-backup.ts
-import * as fs3 from "node:fs/promises";
-import * as path4 from "node:path";
-function configHistoryDir(globalRoot) {
-  return path4.join(globalRoot, "config-history");
-}
-function configSlug(absolutePath, globalRoot) {
-  const rel = path4.relative(globalRoot, absolutePath);
-  const normalized = rel.replace(/\\/g, "/").replace(/\.json$/i, "");
-  return normalized.replace(/\//g, "-");
-}
-async function backupConfigFile(filePath, paths) {
-  let currentContent;
-  try {
-    currentContent = await fs3.readFile(filePath, "utf8");
-    if (!currentContent.trim()) return;
-  } catch {
-    return;
-  }
-  const now = /* @__PURE__ */ new Date();
-  const ts = now.toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
-  const slug = configSlug(filePath, paths.globalRoot);
-  const backupDir = configHistoryDir(paths.globalRoot);
-  const backupFile = path4.join(backupDir, `${slug}-${ts}.json`);
-  try {
-    await fs3.mkdir(backupDir, { recursive: true });
-    await fs3.writeFile(backupFile, currentContent, { mode: 384, encoding: "utf8" });
-  } catch {
-  }
-}
-
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (Buffer.byteLength(input, "utf8") > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
-  }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: toErrorMessage(err)
-    };
-  }
-}
-
-// src/utils/wstack-paths.ts
-import { createHash } from "node:crypto";
-import * as fs4 from "node:fs";
-import * as os2 from "node:os";
-import * as path5 from "node:path";
-function canonicalProjectRoot(absRoot) {
-  const checkoutRoot = path5.resolve(absRoot);
-  const dotGit = path5.join(checkoutRoot, ".git");
-  try {
-    if (!fs4.statSync(dotGit).isFile()) return checkoutRoot;
-    const gitDirLine = fs4.readFileSync(dotGit, "utf8").trim();
-    const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);
-    if (!match?.[1]) return checkoutRoot;
-    const gitDir = path5.resolve(checkoutRoot, match[1].trim());
-    const commonDirFile = path5.join(gitDir, "commondir");
-    if (!fs4.statSync(commonDirFile).isFile()) return checkoutRoot;
-    const commonDir = path5.resolve(gitDir, fs4.readFileSync(commonDirFile, "utf8").trim());
-    const worktreesDir = path5.dirname(gitDir);
-    if (path5.basename(worktreesDir).toLowerCase() !== "worktrees") return checkoutRoot;
-    if (path5.resolve(worktreesDir, "..") !== commonDir) return checkoutRoot;
-    if (path5.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
-    return path5.dirname(commonDir);
-  } catch {
-    return checkoutRoot;
-  }
-}
-function projectHash(absRoot) {
-  return createHash("sha256").update(canonicalProjectRoot(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const identityRoot = canonicalProjectRoot(absRoot);
-  const base = slugify(path5.basename(identityRoot));
-  const hash = createHash("sha256").update(identityRoot).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
-}
-function safeProfileName(name) {
-  const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
-  return safe || "default";
-}
-function bootstrapProfileName(globalRoot) {
-  try {
-    const parsed = JSON.parse(fs4.readFileSync(path5.join(globalRoot, "config.json"), "utf8"));
-    return safeProfileName(
-      typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0
-    );
-  } catch {
-    return "default";
-  }
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path5.resolve(fromEnv);
-  return path5.join(os2.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path5.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const homeDir = opts.userHome ?? os2.homedir();
-  const profileName = safeProfileName(opts.profileName ?? bootstrapProfileName(globalRoot));
-  const profileDir = path5.join(globalRoot, "profiles", profileName);
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path5.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    profileName,
-    profileDir,
-    projectRoot: opts.projectRoot,
-    homeDir,
-    configDir: profileDir,
-    globalConfig: path5.join(globalRoot, "config.json"),
-    profilesDir: path5.join(globalRoot, "profiles"),
-    profileConfig: (name) => {
-      return path5.join(globalRoot, "profiles", safeProfileName(name), "config.json");
-    },
-    profileStatuslineConfig: (name) => {
-      return path5.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
-    },
-    profileModeConfig: (name) => {
-      return path5.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
-    },
-    profileProviderStatus: (name) => {
-      return path5.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
-    },
-    profileUpdateCache: (name) => {
-      return path5.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
-    },
-    secretsKey: path5.join(globalRoot, ".key"),
-    globalMemory: path5.join(profileDir, "memory.md"),
-    globalSkills: path5.join(profileDir, "skills"),
-    globalClaudeSkills: path5.join(homeDir, ".claude", "skills"),
-    globalDesignKits: path5.join(profileDir, "design-kits"),
-    globalPrompts: path5.join(profileDir, "prompts"),
-    globalInstructions: path5.join(profileDir, "instructions"),
-    promptUsage: path5.join(profileDir, "prompt-usage.json"),
-    cacheDir: path5.join(globalRoot, "cache"),
-    modelsCache: path5.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path5.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path5.join(profileDir, "history"),
-    logFile: path5.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path5.join(projectDir, "codebase-index"),
-    projectMemory: path5.join(projectDir, "memory.md"),
-    projectSessions: path5.join(projectDir, "sessions"),
-    projectTrust: path5.join(projectDir, "trust.json"),
-    projectMeta: path5.join(projectDir, "meta.json"),
-    projectLocalConfig: path5.join(projectDir, "config.local.json"),
-    inProjectConfig: path5.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path5.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path5.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectClaudeSkills: path5.join(opts.projectRoot, ".claude", "skills"),
-    inProjectPrompts: path5.join(opts.projectRoot, ".wrongstack", "prompts"),
-    inProjectInstructions: path5.join(opts.projectRoot, ".wrongstack", "instructions"),
-    inProjectDesignKits: path5.join(opts.projectRoot, ".wrongstack", "design-kits"),
-    inProjectWorktrees: path5.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path5.join(projectDir, "goal.json"),
-    projectInputHistory: path5.join(projectDir, "input-history.json"),
-    projectSpecs: path5.join(projectDir, "specs"),
-    projectTaskGraphs: path5.join(projectDir, "task-graphs"),
-    projectSddSession: path5.join(projectDir, "sdd-session.json"),
-    projectPlan: path5.join(projectDir, "plan.json"),
-    projectAutophase: path5.join(projectDir, "autophase"),
-    projectSddBoards: path5.join(projectDir, "sdd-boards"),
-    projectRequirementIntakes: path5.join(projectDir, "requirement-intakes"),
-    syncConfig: path5.join(profileDir, "sync.json"),
-    configHistoryDir: path5.join(globalRoot, "config-history"),
-    projectStatus: (statusProjectSlug) => {
-      if (!/^[a-z0-9](?:[a-z0-9-]{0,39})-[a-f0-9]{6}$/.test(statusProjectSlug)) {
-        throw new Error(`Invalid project slug: ${statusProjectSlug}`);
-      }
-      return path5.join(globalRoot, "projects", statusProjectSlug, "status.json");
-    }
-  };
-}
-
-// src/storage/config-loader/bootstrap.ts
-var BOOTSTRAP_KEYS = /* @__PURE__ */ new Set(["version", "activeProfile"]);
-function isBootstrapOnly(config) {
-  return Object.keys(config).every((k) => BOOTSTRAP_KEYS.has(k));
-}
-
-// src/types/config/runtime.ts
-function normalizeTokenSavingTier(val) {
-  if (val === void 0) return "off";
-  if (typeof val === "boolean") return val ? "medium" : "off";
-  if (val === "auto") return "medium";
-  const validTiers = /* @__PURE__ */ new Set([
-    "off",
-    "minimal",
-    "light",
-    "medium",
-    "aggressive"
-  ]);
-  return validTiers.has(val) ? val : "off";
-}
-var DEFAULT_TUI_THINKING_WORD = "thinking";
-
-// src/types/default-config.ts
-var DEFAULT_TOOLS_CONFIG = Object.freeze({
-  defaultExecutionStrategy: "smart",
-  maxIterations: 100,
-  iterationTimeoutMs: 3e5,
-  maxToolTimeoutMs: 3e5,
-  sessionTimeoutMs: 18e5,
-  perIterationOutputCapBytes: 1e5,
-  descriptionMode: Object.freeze({}),
-  disabledTools: Object.freeze([]),
-  // Extension requires an explicit host/user policy. Without that boundary a
-  // nominal maxIterations cap can grow forever in autonomous sessions.
-  autoExtendLimit: false,
-  restrictToProjectRoot: true,
-  // Off by default: the board is a record of the work, not a permit for it.
-  // See ToolsConfig.kanbanGovernance for what turning it on costs and gates.
-  kanbanGovernance: false,
-  loopDetection: Object.freeze({
-    mode: "steer-then-cut",
-    steerThreshold: 3,
-    cutThreshold: 5,
-    windowSize: 12,
-    callRepeatThreshold: 4
-  })
-});
-var DEFAULT_CONTEXT_CONFIG = Object.freeze({
-  warnThreshold: 0.55,
-  softThreshold: 0.7,
-  hardThreshold: 0.85,
-  targetLoad: 0.65,
-  preserveK: 8,
-  eliseThreshold: 1200
-});
-var DEFAULT_AUTONOMY_CONFIG = Object.freeze({
-  autoProceedDelayMs: 45e3
-});
-var DEFAULT_CIRCUIT_BREAKER_CONFIG = Object.freeze({
-  enabled: false,
-  autoKillResetMs: 6e4
-});
-var DEFAULT_SESSION_LOGGING_CONFIG = Object.freeze({
-  auditLevel: "standard",
-  sampling: {
-    toolProgress: {
-      sampleRate: 8
-    }
-  }
-});
-
-// src/storage/config-loader/defaults.ts
-var CONFIG_BEHAVIOR_DEFAULTS = {
-  version: 1,
-  context: {
-    mode: DEFAULT_CONTEXT_WINDOW_MODE_ID,
-    warnThreshold: DEFAULT_CONTEXT_CONFIG.warnThreshold,
-    softThreshold: DEFAULT_CONTEXT_CONFIG.softThreshold,
-    hardThreshold: DEFAULT_CONTEXT_CONFIG.hardThreshold,
-    targetLoad: DEFAULT_CONTEXT_CONFIG.targetLoad,
-    autoCompact: true,
-    preserveK: DEFAULT_CONTEXT_CONFIG.preserveK,
-    eliseThreshold: DEFAULT_CONTEXT_CONFIG.eliseThreshold,
-    strategy: "hybrid"
-  },
-  tools: {
-    defaultExecutionStrategy: DEFAULT_TOOLS_CONFIG.defaultExecutionStrategy,
-    maxIterations: DEFAULT_TOOLS_CONFIG.maxIterations,
-    iterationTimeoutMs: DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
-    maxToolTimeoutMs: DEFAULT_TOOLS_CONFIG.maxToolTimeoutMs,
-    sessionTimeoutMs: DEFAULT_TOOLS_CONFIG.sessionTimeoutMs,
-    perIterationOutputCapBytes: DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
-    descriptionMode: DEFAULT_TOOLS_CONFIG.descriptionMode,
-    disabledTools: DEFAULT_TOOLS_CONFIG.disabledTools,
-    autoExtendLimit: DEFAULT_TOOLS_CONFIG.autoExtendLimit,
-    restrictToProjectRoot: DEFAULT_TOOLS_CONFIG.restrictToProjectRoot,
-    kanbanGovernance: DEFAULT_TOOLS_CONFIG.kanbanGovernance,
-    loopDetection: DEFAULT_TOOLS_CONFIG.loopDetection
-  },
-  log: { level: "info" },
-  features: {
-    mcp: true,
-    plugins: true,
-    memory: true,
-    modelsRegistry: true,
-    skills: true,
-    prompts: true,
-    // 'auto' → resolveTokenSavingTier picks a concrete tier from the model's
-    // context window ONCE per session (cache-safe): lean prompt on small
-    // windows (<32k medium, <128k light) where the fixed identity+tool prose
-    // is a big fraction; minimal trimming on >=128k so modern large-window
-    // models still get cost savings without capability loss. Explicit tiers
-    // are respected verbatim.
-    tokenSavingMode: "auto",
-    // Derived, never written by hand: this and `tools.restrictToProjectRoot`
-    // (line 41) are the two halves of one switch, and they used to be declared
-    // independently in this same object — one `true`, one `true` — with
-    // session.ts resolving the contradiction via `??` in favour of the
-    // permissive half. The confinement guard therefore shipped disabled on a
-    // fresh install even though the other half asked for it (WS-075).
-    allowOutsideProjectRoot: !DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
-  },
-  Sage: {
-    enabled: true,
-    storage: {
-      projectLocal: true,
-      directory: ".wrongstack/memories"
-    },
-    inject: {
-      // Keep the ordinary turn prompt clean. Project memory is surfaced
-      // on-demand beside relevant tool results, where the path/query that
-      // caused retrieval is known and the hint can be independently capped.
-      turnContext: false,
-      toolResults: true,
-      // Off: task text searches for what the operator is doing, not for the
-      // file the tool touched, and every match it adds is unrelated to the
-      // result it lands on.
-      taskAware: false,
-      maxHintsPerTool: 8,
-      maxCharsPerTool: 2800,
-      maxTurnMemories: 8,
-      maxCharsPerTurn: 2400,
-      minScore: 0.72,
-      minImportance: 0.5,
-      // 0 = once per session. Re-showing a memory the model has already been
-      // given spends context and adds nothing.
-      repeatCooldownMs: 0
-    },
-    hygiene: {
-      autoAfterSession: true,
-      autoOnFileChange: true,
-      retentionDays: 90,
-      archiveLowConfidenceAfterDays: 30
-    },
-    embeddings: {
-      enabled: false
-    }
-  },
-  skills: { readClaudeSkills: true, mode: "progressive" },
-  mcpServers: {},
-  fallbackAuto: true,
-  maxConcurrent: 4,
-  // YOLO opt-in: users who want auto-approve behaviour set `yolo: true`.
-  // Off by default so prompt injection in repository content, fetched
-  // content, or mailbox messages cannot induce arbitrary shell calls or
-  // write operations without human confirmation.
-  yolo: false,
-  nextPrediction: false,
-  hints: true,
-  debugStream: false,
-  configScope: "global",
-  indexing: {
-    onSessionStart: true,
-    onEdit: true,
-    watchExternal: true,
-    debounceMs: 400
-  },
-  session: { ...DEFAULT_SESSION_LOGGING_CONFIG },
-  autonomy: {
-    // 'auto' by default: the agent self-drives (picks the top next-step after
-    // each turn). This is a startup default, not a runtime flip — the
-    // autoProceedMaxIterations cap + autoProceedDelayMs cooldown + Ctrl+C /
-    // [GOAL_COMPLETE] stops remain in force. Explicit 'off'
-    // in a config file is preserved (opt-out respected).
-    defaultMode: "auto",
-    autoProceedDelayMs: DEFAULT_AUTONOMY_CONFIG.autoProceedDelayMs,
-    autoProceedMaxIterations: 50,
-    autonomyNextPrompt: "auto {{suggestion}}",
-    terminalTitleAnimation: true,
-    // Mirrored from the top-level yolo default so the autonomy subsystem
-    // (which reads autonomy.yolo) stays consistent with config.yolo.
-    yolo: false,
-    fleetChatVerbosity: "off",
-    chime: false,
-    confirmExit: true,
-    mouseMode: false,
-    enhance: true,
-    enhanceDelayMs: 6e4,
-    enhanceLanguage: "original",
-    // Product-wide statusline density default. Mirrored by the TUI's
-    // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
-    statuslineMode: "minimum",
-    thinkingWord: DEFAULT_TUI_THINKING_WORD,
-    showAgentSwarmPanel: "bottom"
-  },
-  circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
-  modelRuntime: {
-    // `effort` is intentionally undefined by default. Leaving it unset lets
-    // each model use its provider-recommended reasoning effort (or none at
-    // all) instead of forcing an opinionated value that may be unsupported,
-    // silently omitted, and surfaced as a per-request warning. Users who
-    // want a specific effort can opt in via `/settings` or the WebUI panel.
-    reasoning: { mode: "auto" },
-    cache: { ttl: "1h" }
-  },
-  systemPrompt: { variant: "default" }
-};
-
-// src/storage/config-loader/default-repair.ts
-function isPlainRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
-}
-function cloneJsonValue(value) {
-  return structuredClone(value);
-}
-function fillMissingDefaults(target, defaults) {
-  const value = cloneJsonValue(target);
-  const changed = fillMissingDefaultsInPlace(value, defaults);
-  return { value, changed };
-}
-function fillMissingDefaultsInPlace(target, defaults) {
-  let changed = false;
-  for (const [key, defaultValue] of Object.entries(defaults)) {
-    if (!Object.hasOwn(target, key)) {
-      target[key] = cloneJsonValue(defaultValue);
-      changed = true;
-      continue;
-    }
-    const current = target[key];
-    if (isPlainRecord(current) && isPlainRecord(defaultValue)) {
-      changed = fillMissingDefaultsInPlace(current, defaultValue) || changed;
-    }
-  }
-  return changed;
-}
-
-// src/storage/config-loader/diagnostics.ts
-function storageErrorString(err) {
-  if (err instanceof Error) {
-    const code = err.code;
-    return code ? `${code}: ${err.message}` : err.message;
-  }
-  return String(err);
-}
-
-// src/storage/config-loader/env-overrides.ts
-function envBool(v) {
-  return !/^(0|false|no|off)$/i.test(v.trim());
-}
-function envBoolOptional(v) {
-  return v !== void 0 && envBool(v);
-}
-var LOG_LEVELS2 = /* @__PURE__ */ new Set(["error", "warn", "info", "debug", "trace"]);
-function envLogLevel(v) {
-  return LOG_LEVELS2.has(v) ? v : "info";
-}
-var defaultIndexing = {
-  onSessionStart: true,
-  onEdit: true,
-  watchExternal: true,
-  debounceMs: 400
-};
-var ENV_MAP = {
-  WRONGSTACK_PROVIDER: (c, v) => {
-    c.provider = v;
-    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
-    c._envSource.add("provider");
-  },
-  WRONGSTACK_MODEL: (c, v) => {
-    c.model = v;
-    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
-    c._envSource.add("model");
-  },
-  WRONGSTACK_API_KEY: (c, v) => {
-    c.apiKey = v;
-    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
-    c._envSource.add("apiKey");
-  },
-  WRONGSTACK_BASE_URL: (c, v) => {
-    c.baseUrl = v;
-    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
-    c._envSource.add("baseUrl");
-  },
-  WRONGSTACK_LOG_LEVEL: (c, v) => {
-    if (!c.log) c.log = { level: "info" };
-    c.log.level = envLogLevel(v);
-  },
-  WRONGSTACK_INDEX_ON_START: (c, v) => {
-    c.indexing = { ...defaultIndexing, ...c.indexing, onSessionStart: envBool(v) };
-  },
-  WRONGSTACK_INDEX_ON_EDIT: (c, v) => {
-    c.indexing = { ...defaultIndexing, ...c.indexing, onEdit: envBool(v) };
-  },
-  WRONGSTACK_INDEX_WATCH: (c, v) => {
-    c.indexing = { ...defaultIndexing, ...c.indexing, watchExternal: envBool(v) };
-  }
-};
-
-// src/storage/config-loader/in-project-policy.ts
-var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
-  "version",
-  "model",
-  "cwd",
-  "context",
-  "tools",
-  "features",
-  "Sage",
-  "skills",
-  "autonomy",
-  "indexing",
-  "session",
-  "log",
-  "launch",
-  "nextPrediction",
-  "hints",
-  "debugStream",
-  "configScope",
-  "maxConcurrent",
-  "uiLocale",
-  "fallbackModels",
-  "fallbackBridge",
-  "fallbackProfiles",
-  // The profile SELECTOR. No broader than its siblings: a repo that can write
-  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
-  // and this one can only name a profile the user already defined.
-  "fallbackProfile",
-  "favoriteModels",
-  "favoriteModelsOnly",
-  "modelAvailabilitySchedule",
-  "fallbackAuto",
-  "fallbackStickiness",
-  "models",
-  "modelMatrix",
-  "circuitBreaker",
-  "adaptiveConcurrency",
-  "modelRuntime"
-]);
-var KNOWN_DENIED_IN_PROJECT = [
-  {
-    key: "activeProfile",
-    reason: "Only the trusted root bootstrap may select the active profile."
-  },
-  { key: "provider", reason: "Provider id override; can intercept prompts/responses." },
-  { key: "apiKey", reason: "Overrides user API key; exfiltrates prompts." },
-  { key: "baseUrl", reason: "Redirects provider endpoint; leaks real API key." },
-  { key: "providers", reason: "Per-provider apiKey/baseUrl/oauthConfig; same redirect/exfil." },
-  { key: "mcpServers", reason: "Arbitrary command/args/env spawned at boot (RCE)." },
-  { key: "hooks", reason: "Shell command arrays on lifecycle events (RCE)." },
-  { key: "plugins", reason: "Dynamic npm package load at boot (RCE)." },
-  {
-    key: "pluginManager",
-    reason: "Controls which plugin boot states the LLM may mutate; user-owned trust policy."
-  },
-  { key: "sync", reason: "Carries githubToken credential and target repo." },
-  {
-    key: "cloudSync",
-    reason: "Carries the my.wrongstack.com machine token credential and endpoint URL."
-  },
-  { key: "yolo", reason: "Disables all permission confirmation prompts." },
-  { key: "extensions", reason: "Per-plugin config can carry command/credential fields." },
-  { key: "hq", reason: "Carries HQ client token credential and endpoint URL." },
-  { key: "acp", reason: "Per-agent ACP command/args/env override \u2192 arbitrary command exec (RCE)." },
-  {
-    key: "fleet",
-    reason: "Fleet supervision knobs: a repo-committed config could enable autonomous subagent spawning/steering/termination and mailbox traffic on the victim machine."
-  },
-  {
-    key: "brain",
-    reason: "Brain decision-layer knobs: a repo-committed config could raise the autonomy risk ceiling, switch the Brain to headless (removing the human tier), or reroute Brain decisions to an attacker-chosen provider/model."
-  },
-  {
-    key: "git",
-    reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
-  },
-  {
-    key: "fallbackMaxLastResortCandidates",
-    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
-  }
-];
-var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
-  "version",
-  "activeProfile",
-  "provider",
-  "model",
-  "apiKey",
-  "baseUrl",
-  "maxConcurrent",
-  "uiLocale",
-  "providers",
-  "models",
-  "modelMatrix",
-  "context",
-  "tools",
-  "mcpServers",
-  "fallbackModels",
-  "fallbackBridge",
-  "fallbackProfiles",
-  "fallbackProfile",
-  "favoriteModels",
-  "favoriteModelsOnly",
-  "modelAvailabilitySchedule",
-  "fallbackAuto",
-  "fallbackStickiness",
-  "fallbackMaxLastResortCandidates",
-  "hooks",
-  "plugins",
-  "pluginManager",
-  "log",
-  "features",
-  "Sage",
-  "skills",
-  "yolo",
-  "nextPrediction",
-  "cwd",
-  "autonomy",
-  "hints",
-  "debugStream",
-  "configScope",
-  "indexing",
-  "circuitBreaker",
-  "adaptiveConcurrency",
-  "launch",
-  "session",
-  "modelRuntime",
-  "hq",
-  "sync",
-  "cloudSync",
-  "extensions",
-  "acp",
-  "fleet",
-  "brain",
-  "git"
-]);
-var IN_PROJECT_DENIED_PATHS = [
-  {
-    path: "tools.exec.allow",
-    reason: "Extends the exec allow-list; a repo could authorise its own binaries."
-  },
-  { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
-  {
-    // The whole subtree, not just the dangerous leaves: a persona's
-    // `instruction` is rendered into the voter SYSTEM prompt, a profile seat
-    // may pin providerId/model, and `defaultProfile` selects which of those
-    // runs when the agent names no profile. Denying the parent leaves no leaf
-    // to reclassify wrongly later.
-    path: "tools.council",
-    reason: "Council tool panel definitions: persona instructions are injected into the voter SYSTEM prompt and profile seats can pin an attacker-chosen providerId/model."
-  },
-  { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
-  { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
-  // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
-  // suggested stripping both, but config-loader-extra.test.ts classifies `mode`
-  // as a safe preference with a stated rationale, and a repo can only use these
-  // to move injection volume in either direction — the trust problem was that
-  // repo-supplied skill bodies were indistinguishable from the user's own, which
-  // the provenance tag in system-prompt-skill-bodies.ts now fixes. Re-classifying
-  // them is a product call.
-  { path: "Sage.storage.directory", reason: "Redirects memory storage outside the profile." },
-  {
-    path: "autonomy.yolo",
-    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting \u2014 a repo-committed config could disable every permission prompt."
-  },
-  {
-    path: "autonomy.defaultMode",
-    reason: "Sets the startup autonomy mode; autonomy is user-owned, never repo-owned."
-  },
-  // Deliberately NOT denied: autonomy.autoProceedDelayMs and
-  // autoProceedMaxIterations. They tune a mode the user has already switched on
-  // rather than granting it, and config-loader-extra.test.ts classifies the
-  // delay as a benign project preference. Re-classifying them is a product call.
-  {
-    path: "launch.autonomy",
-    reason: "Launch-time autonomy mode; same user-owned boundary as autonomy.defaultMode."
-  },
-  {
-    path: "features.allowOutsideProjectRoot",
-    reason: "Short-circuits both the project-root containment check and the symlink realpath check in the file tools."
-  },
-  {
-    path: "tools.restrictToProjectRoot",
-    reason: "The other half of the filesystem confinement switch."
-  },
-  {
-    // Denied for the direction that loosens: the flag defaults to false, so a
-    // repo can only ever use it to turn OFF a gate the user deliberately
-    // enabled. Same class as `tools.restrictToProjectRoot` — a control the
-    // operator owns, not the checked-out repository.
-    path: "tools.kanbanGovernance",
-    reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
-  },
-  {
-    // The bridge spawn path resolves the CLI entry by walking UP from the
-    // project root, so a repo that ships its own `packages/cli/dist/index.js`
-    // gets that file spawned with `process.execPath` on WebUI boot — no
-    // prompt, no banner. Turning the feature on is therefore equivalent to
-    // arbitrary code execution for a hostile checkout, which makes this an
-    // operator-owned switch and never a repo-owned one.
-    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
-    path: "features.mailboxBridge",
-    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
-  },
-  {
-    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
-    // closes the other half: a repo could previously ship
-    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
-    // for plugins the user had ALREADY installed globally — disarming the
-    // trust-on-first-use pin that exists to catch a supply-chain update
-    // rewriting a plugin's entry file. Same operator-owned class as the
-    // switches above.
-    path: "features.pluginsTrust",
-    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
-  }
-];
-function deleteNestedPath(target, path13) {
-  const segments = path13.split(".");
-  const last = segments[segments.length - 1];
-  if (last === void 0) return false;
-  let cursor = target;
-  const chain = [];
-  for (const segment of segments.slice(0, -1)) {
-    const next = cursor[segment];
-    if (!next || typeof next !== "object" || Array.isArray(next)) return false;
-    chain.push({ parent: cursor, key: segment });
-    cursor = next;
-  }
-  if (!(last in cursor)) return false;
-  const clonedLeaf = { ...cursor };
-  delete clonedLeaf[last];
-  let replacement = clonedLeaf;
-  for (let i = chain.length - 1; i >= 0; i--) {
-    const link = chain[i];
-    if (!link) continue;
-    replacement = { ...link.parent, [link.key]: replacement };
-    if (i === 0) {
-      for (const [k, v] of Object.entries(replacement)) target[k] = v;
-      return true;
-    }
-  }
-  for (const [k, v] of Object.entries(replacement)) target[k] = v;
-  return true;
-}
-function assertInProjectAllowListComplete() {
-  const missingFromBoth = [];
-  for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
-    if (IN_PROJECT_ALLOWED_KEYS.has(key)) continue;
-    const denied = KNOWN_DENIED_IN_PROJECT.find((d) => d.key === key);
-    if (!denied) missingFromBoth.push(key);
-  }
-  const staleDenials = KNOWN_DENIED_IN_PROJECT.filter(
-    (d) => !KNOWN_CONFIG_TOP_LEVEL_KEYS.has(d.key)
-  ).map((d) => d.key);
-  const duplicate = KNOWN_DENIED_IN_PROJECT.filter((d) => IN_PROJECT_ALLOWED_KEYS.has(d.key)).map(
-    (d) => d.key
-  );
-  const problems = [];
-  if (missingFromBoth.length > 0) {
-    problems.push(
-      `new Config field(s) not classified as allowed or denied for in-project config: ` + missingFromBoth.join(", ") + ". Add each to IN_PROJECT_ALLOWED_KEYS (if safe) or KNOWN_DENIED_IN_PROJECT (with a reason)."
-    );
-  }
-  if (staleDenials.length > 0) {
-    problems.push(
-      `KNOWN_DENIED_IN_PROJECT references keys that no longer exist on Config: ` + staleDenials.join(", ") + ". Remove them or restore the field on Config."
-    );
-  }
-  if (duplicate.length > 0) {
-    problems.push(
-      `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
-    );
-  }
-  const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path13 }) => !IN_PROJECT_ALLOWED_KEYS.has(path13.split(".")[0] ?? "")
-  ).map(({ path: path13 }) => path13);
-  if (orphanedPaths.length > 0) {
-    problems.push(
-      `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
-    );
-  }
-  const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path13 }) => path13.split(".").length < 2 || path13.split(".").some((s) => s.length === 0)
-  ).map(({ path: path13 }) => path13);
-  if (malformedPaths.length > 0) {
-    problems.push(
-      `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
-    );
-  }
-  if (problems.length > 0) {
-    throw new Error(
-      `stripUnsafeInProjectFields drift check failed:
-  - ${problems.join("\n  - ")}`
-    );
-  }
-}
-var driftChecked = false;
-function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => console.warn(msg)) {
-  if (!driftChecked) {
-    assertInProjectAllowListComplete();
-    driftChecked = true;
-  }
-  const stripped = [];
-  const out = {};
-  for (const [k, v] of Object.entries(inProject)) {
-    if (IN_PROJECT_ALLOWED_KEYS.has(k)) {
-      out[k] = v;
-      continue;
-    }
-    stripped.push(k);
-  }
-  for (const { path: path13 } of IN_PROJECT_DENIED_PATHS) {
-    if (deleteNestedPath(out, path13)) stripped.push(path13);
-  }
-  if (stripped.length > 0) {
-    warn(
-      JSON.stringify({
-        level: "warn",
-        event: "config.in_project_unsafe_fields_ignored",
-        path: sourcePath,
-        ignoredKeys: stripped,
-        message: `Ignored ${stripped.length} field(s) from the repo-committed config "${sourcePath}": ${stripped.join(", ")}. Only a small allow-list of benign preferences (model, context, tools limits, features, \u2026) may be set by <project>/.wrongstack/config.json. Everything else must live in your active profile config.`,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  }
-  return out;
-}
-
-// src/storage/config-loader/inline-provider-models.ts
-var BOOLEAN_CAPABILITIES = [
-  "tools",
-  "parallelTools",
-  "vision",
-  "streaming",
-  "promptCache",
-  "systemPrompt",
-  "jsonMode",
-  "reasoning",
-  "topK",
-  "frequencyPenalty",
-  "presencePenalty",
-  "seed",
-  "structuredOutput",
-  "logprobs",
-  "audio",
-  "multipleCompletions"
-];
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function positiveNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
-}
-function readCapabilities(model) {
-  const raw = isRecord2(model["capabilities"]) ? model["capabilities"] : void 0;
-  const capabilities = {};
-  if (raw) {
-    for (const key of BOOLEAN_CAPABILITIES) {
-      const value = raw[key];
-      if (typeof value === "boolean") capabilities[key] = value;
-    }
-    const cacheControl = raw["cacheControl"];
-    if (cacheControl === "native" || cacheControl === "auto" || cacheControl === "none") {
-      capabilities.cacheControl = cacheControl;
-    }
-  }
-  const limit = isRecord2(model["limit"]) ? model["limit"] : void 0;
-  const maxContext = positiveNumber(raw?.["maxContext"]) ?? positiveNumber(model["maxContext"]) ?? positiveNumber(model["contextWindow"]) ?? positiveNumber(limit?.["context"]);
-  if (maxContext !== void 0) capabilities.maxContext = maxContext;
-  const capabilityMaxOutput = positiveNumber(raw?.["maxOutput"]);
-  if (capabilityMaxOutput !== void 0) capabilities.maxOutput = capabilityMaxOutput;
-  if (typeof model["tool_call"] === "boolean" && capabilities.tools === void 0) {
-    capabilities.tools = model["tool_call"];
-  }
-  if (typeof model["reasoning"] === "boolean" && capabilities.reasoning === void 0) {
-    capabilities.reasoning = model["reasoning"];
-  }
-  const modalities = isRecord2(model["modalities"]) ? model["modalities"] : void 0;
-  const inputModalities = modalities?.["input"];
-  if (Array.isArray(inputModalities) && capabilities.vision === void 0) {
-    capabilities.vision = inputModalities.includes("image");
-  }
-  return Object.keys(capabilities).length > 0 ? capabilities : void 0;
-}
-function inlineDefinition(model) {
-  const definition = {};
-  const name = model["name"];
-  if (typeof name === "string" && name.trim().length > 0) definition.name = name;
-  const provider = model["provider"];
-  if (typeof provider === "string" && provider.trim().length > 0) {
-    definition.provider = provider;
-  }
-  const limit = isRecord2(model["limit"]) ? model["limit"] : void 0;
-  const maxOutput = positiveNumber(model["maxOutput"]) ?? positiveNumber(limit?.["output"]) ?? positiveNumber(
-    isRecord2(model["capabilities"]) ? model["capabilities"]["maxOutput"] : void 0
-  );
-  if (maxOutput !== void 0) definition.maxOutput = maxOutput;
-  const capabilities = readCapabilities(model);
-  if (capabilities) definition.capabilities = capabilities;
-  const { id: _id, ...rest } = model;
-  if (Object.keys(rest).length > 0) {
-    definition.modelsDev = rest;
-  }
-  return definition;
-}
-function mergeDefinitions(base, patch) {
-  const mergedModelsDev = (() => {
-    if (!base?.modelsDev && !patch.modelsDev) return void 0;
-    const baseMd = base?.modelsDev ?? {};
-    const patchMd = patch.modelsDev ?? {};
-    const result = { ...baseMd, ...patchMd };
-    for (const nestedKey of ["limit", "cost", "modalities"]) {
-      const bn = baseMd?.[nestedKey];
-      const pn = patchMd?.[nestedKey];
-      if (bn || pn) {
-        result[nestedKey] = { ...bn ?? {}, ...pn ?? {} };
-      }
-    }
-    return result;
-  })();
-  return {
-    ...base,
-    ...patch,
-    ...base?.capabilities || patch.capabilities ? { capabilities: { ...base?.capabilities, ...patch.capabilities } } : {},
-    ...mergedModelsDev ? { modelsDev: mergedModelsDev } : {}
-  };
-}
-function normalizeInlineProviderModels(config, warn) {
-  const providers = config["providers"];
-  if (!isRecord2(providers)) return;
-  for (const [providerId, rawProvider] of Object.entries(providers)) {
-    if (!isRecord2(rawProvider) || !Array.isArray(rawProvider["models"])) continue;
-    const ids = [];
-    const seen = /* @__PURE__ */ new Set();
-    const derived = /* @__PURE__ */ new Map();
-    for (const [index, entry] of rawProvider["models"].entries()) {
-      let id;
-      let definition;
-      if (typeof entry === "string" && entry.length > 0) {
-        id = entry;
-      } else if (isRecord2(entry)) {
-        const rawId = entry["id"];
-        if (typeof rawId === "string" && rawId.trim().length > 0) {
-          id = rawId.trim();
-          if (!FORBIDDEN_PROTO_KEYS.has(id)) definition = inlineDefinition(entry);
-        }
-      }
-      if (!id || FORBIDDEN_PROTO_KEYS.has(id)) {
-        warn?.("Ignoring invalid inline provider model entry", {
-          event: "config.invalid_inline_provider_model",
-          provider: providerId,
-          index
-        });
-        continue;
-      }
-      if (!seen.has(id)) {
-        seen.add(id);
-        ids.push(id);
-      }
-      if (definition) derived.set(id, mergeDefinitions(derived.get(id), definition));
-    }
-    rawProvider["models"] = ids;
-    if (derived.size === 0) continue;
-    const explicit = isRecord2(rawProvider["customModels"]) ? rawProvider["customModels"] : void 0;
-    const normalized = /* @__PURE__ */ Object.create(null);
-    for (const [id, definition] of derived) normalized[id] = definition;
-    if (explicit) {
-      for (const [id, value] of Object.entries(explicit)) {
-        if (FORBIDDEN_PROTO_KEYS.has(id) || !isRecord2(value)) continue;
-        normalized[id] = mergeDefinitions(normalized[id], value);
-      }
-    }
-    rawProvider["customModels"] = normalized;
-  }
-}
-
-// src/storage/config-loader/legacy-sage-migration.ts
-function migrateLegacySuperMemoryKey(config) {
-  const legacy = config["superMemory"];
-  if (legacy === void 0) return false;
-  if (isPlainRecord(legacy)) {
-    const current = config["Sage"];
-    config["Sage"] = isPlainRecord(current) ? { ...legacy, ...current } : { ...legacy };
-  }
-  delete config["superMemory"];
-  return true;
-}
-function removeLegacySageEngine(config) {
-  const migratedKey = migrateLegacySuperMemoryKey(config);
-  const Sage = config["Sage"];
-  if (!isPlainRecord(Sage)) return migratedKey;
-  const storage = Sage["storage"];
-  if (!isPlainRecord(storage) || !Object.hasOwn(storage, "engine")) {
-    return migratedKey;
-  }
-  delete storage["engine"];
-  return true;
-}
-
-// src/storage/config-loader/path-identity.ts
-import * as path6 from "node:path";
-function samePath(a, b) {
-  let ra = path6.resolve(a);
-  let rb = path6.resolve(b);
-  if (process.platform === "win32" || process.platform === "darwin") {
-    ra = ra.toLowerCase();
-    rb = rb.toLowerCase();
-  }
-  return ra === rb;
-}
-
-// src/storage/config-loader.ts
-function deepMerge2(base, patch) {
-  const opts = { arrayMode: "concat-primitives" };
-  if (envBoolOptional(process.env.WRONGSTACK_DEBUG_CONFIG)) {
-    opts.onNonPrimitiveArrayReplace = (key, existingLen, patchLen) => {
-      console.warn(
-        `[config] Non-primitive array for "${key}" replaced (global + local config merge). Global entries: ${existingLen}, local entries: ${patchLen}.`
-      );
-    };
-  }
-  return deepMerge(
-    base,
-    patch,
-    opts
-  );
-}
-var DefaultConfigLoader = class _DefaultConfigLoader {
-  paths;
-  strict;
-  vault;
-  extraSources;
-  events;
-  traceId;
-  logger;
-  jsonCache = /* @__PURE__ */ new Map();
-  constructor(opts) {
-    this.paths = opts.paths;
-    this.strict = opts.strict ?? false;
-    this.vault = opts.vault;
-    this.extraSources = opts.sources ?? [];
-    this.events = opts.events;
-    this.traceId = opts.traceId;
-    this.logger = opts.logger;
-  }
-  /**
-   * Emit a structured warning. Uses the configured Logger when available;
-   * falls back to console.warn(JSON) so warnings are never silently dropped
-   * during early boot (before a Logger is constructed).
-   */
-  logWarn(msg, ctx) {
-    if (this.logger) {
-      this.logger.warn(msg, ctx);
-    } else {
-      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
-    }
-  }
-  async load(opts = {}) {
-    let cfg = { ...CONFIG_BEHAVIOR_DEFAULTS };
-    await this.ensureGlobalDefaults();
-    const inProjectCollides = samePath(this.paths.inProjectConfig, this.paths.globalConfig) || samePath(this.paths.inProjectConfig, this.paths.projectLocalConfig);
-    const [bootstrap, local, inProject] = await Promise.all([
-      this.readJson(this.paths.globalConfig),
-      this.readJson(this.paths.projectLocalConfig),
-      inProjectCollides ? Promise.resolve({}) : this.readJson(this.paths.inProjectConfig)
-    ]);
-    const bootstrapMetadata = {
-      ...typeof bootstrap.version === "number" ? { version: bootstrap.version } : {},
-      ...typeof bootstrap.activeProfile === "string" ? { activeProfile: safeProfileName(bootstrap.activeProfile) } : {}
-    };
-    cfg = deepMerge2(cfg, bootstrapMetadata);
-    const profileName = safeProfileName(
-      bootstrap.activeProfile
-    );
-    const profileCfg = await this.readJson(this.paths.profileConfig(profileName));
-    if (Object.keys(profileCfg).length > 0) {
-      const profileSettings = { ...profileCfg };
-      delete profileSettings["version"];
-      delete profileSettings["activeProfile"];
-      cfg = deepMerge2(cfg, profileSettings);
-    }
-    const localSettings = { ...local };
-    delete localSettings["version"];
-    delete localSettings["activeProfile"];
-    cfg = deepMerge2(cfg, localSettings);
-    cfg = deepMerge2(
-      cfg,
-      stripUnsafeInProjectFields(
-        inProject,
-        this.paths.inProjectConfig,
-        this.logger ? (msg) => this.logger.warn(msg) : void 0
-      )
-    );
-    for (const [key, fn] of Object.entries(ENV_MAP)) {
-      const v = process.env[key];
-      if (v) fn(cfg, v);
-    }
-    const sorted = [...this.extraSources].sort((a, b) => {
-      const pd = (a.priority ?? 50) - (b.priority ?? 50);
-      if (pd !== 0) return pd;
-      return a.name.localeCompare(b.name);
-    });
-    for (const src of sorted) {
-      try {
-        const patch = await src.read();
-        if (patch && Object.keys(patch).length > 0) {
-          cfg = deepMerge2(cfg, patch);
-        }
-      } catch (err) {
-        this.logWarn("Config source load failed", {
-          event: "config.source_load_failed",
-          source: src.name,
-          message: toErrorMessage(err)
-        });
-      }
-    }
-    if (opts.cliFlags) {
-      cfg = deepMerge2(cfg, opts.cliFlags);
-    }
-    normalizeInlineProviderModels(
-      cfg,
-      (message, context) => this.logWarn(message, context)
-    );
-    if (this.vault) {
-      cfg = decryptConfigSecrets(cfg, this.vault);
-    }
-    if (cfg.providers) {
-      for (const pcfg of Object.values(cfg.providers)) {
-        if (!pcfg || typeof pcfg !== "object") continue;
-        const rawKeys = pcfg.apiKeys;
-        if (!Array.isArray(rawKeys) || rawKeys.length === 0) continue;
-        const keys = rawKeys.filter(
-          (k) => !!k && typeof k === "object" && typeof k.label === "string" && typeof k.apiKey === "string"
-        );
-        if (keys.length === 0) continue;
-        const existing = pcfg.apiKey;
-        if (existing && existing.length > 0) continue;
-        const activeLabel = pcfg.activeKey;
-        const chosen = activeLabel ? keys.find((k) => k.label === activeLabel) ?? keys[0] : keys[0];
-        if (chosen?.apiKey) {
-          pcfg.apiKey = chosen.apiKey;
-        }
-      }
-    }
-    removeLegacySageEngine(cfg);
-    this.validateBehavior(cfg);
-    if (this.strict && !opts.skipIdentityValidation) {
-      this.validateIdentity(cfg);
-    }
-    return Object.freeze(cfg);
-  }
-  /** Check whether a config object contains only the two bootstrap keys. */
-  static isBootstrapOnly(config) {
-    return isBootstrapOnly(config);
-  }
-  async ensureGlobalDefaults() {
-    const fp = this.paths.globalConfig;
-    const t0 = Date.now();
-    try {
-      await withFileLock(fp, async () => {
-        let parsed;
-        let fileExisted = true;
-        try {
-          const raw = await fs5.readFile(fp, "utf8");
-          const result = safeParse(raw);
-          if (!result.ok || !isPlainRecord(result.value)) {
-            return;
-          }
-          parsed = result.value;
-        } catch (err) {
-          if (err.code !== "ENOENT") {
-            this.events?.emit("storage.error", {
-              sessionId: "~config~",
-              store: "config",
-              filePath: fp,
-              operation: "ensure_defaults",
-              outcome: "failure",
-              error: storageErrorString(err),
-              recoverable: false,
-              durationMs: Date.now() - t0,
-              ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-            });
-            this.logWarn("Config defaults read failed", {
-              event: "config.defaults_read_failed",
-              path: fp,
-              message: toErrorMessage(err)
-            });
-            return;
-          }
-          fileExisted = false;
-          parsed = {};
-        }
-        if (parsed["version"] !== void 0 && parsed["version"] !== 1) return;
-        const rawProfileName = parsed.activeProfile;
-        const profileName = safeProfileName(rawProfileName);
-        const profileFp = this.paths.profileConfig(profileName);
-        await this.ensureProfileConfig(profileFp, parsed, fileExisted);
-        const bootstrap = {
-          version: 1,
-          activeProfile: profileName
-        };
-        let needsBootstrapWrite = false;
-        if (parsed.version !== 1) {
-          needsBootstrapWrite = true;
-        }
-        if (parsed.activeProfile === void 0 || parsed.activeProfile !== profileName) {
-          needsBootstrapWrite = true;
-        }
-        if (!_DefaultConfigLoader.isBootstrapOnly(parsed)) {
-          needsBootstrapWrite = true;
-        }
-        if (needsBootstrapWrite) {
-          await backupConfigFile(fp, this.paths);
-          await atomicWrite(fp, JSON.stringify(bootstrap, null, 2), { mode: 384 });
-          this.events?.emit("storage.write", {
-            sessionId: "~config~",
-            store: "config",
-            filePath: fp,
-            operation: "ensure_defaults",
-            outcome: "success",
-            durationMs: Date.now() - t0,
-            ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-          });
-        }
-      });
-    } catch (err) {
-      this.events?.emit("storage.error", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: fp,
-        operation: "ensure_defaults",
-        outcome: "failure",
-        error: storageErrorString(err),
-        recoverable: false,
-        durationMs: Date.now() - t0,
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-      this.logWarn("Config defaults write failed", {
-        event: "config.defaults_write_failed",
-        path: fp,
-        message: toErrorMessage(err)
-      });
-    }
-  }
-  /**
-   * Ensure a profile config file exists at the given path.
-   * On first boot: migrate content from the old flat global config, or seed
-   * with behavior defaults. Subsequent boots: fill any missing keys from
-   * CONFIG_BEHAVIOR_DEFAULTS (keeping user settings intact).
-   *
-   * Once a profile file exists, settings found in the root bootstrap are
-   * ignored. This prevents stale or accidentally-written root values from
-   * becoming a hidden settings source alongside profiles.
-   */
-  async ensureProfileConfig(profileFp, oldGlobalParsed, oldFileExisted) {
-    const t0 = Date.now();
-    let parsed;
-    let existed = true;
-    try {
-      const raw = await fs5.readFile(profileFp, "utf8");
-      const result = safeParse(raw);
-      if (!result.ok || !isPlainRecord(result.value)) {
-        this.logWarn("Profile config parse failed \u2014 falling back to defaults", {
-          event: "config.profile_parse_failed",
-          path: profileFp
-        });
-        parsed = {};
-      } else {
-        parsed = result.value;
-      }
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        this.logWarn("Profile config read failed", {
-          event: "config.profile_read_failed",
-          path: profileFp,
-          message: toErrorMessage(err)
-        });
-        return;
-      }
-      existed = false;
-      parsed = {};
-    }
-    const removedLegacyEngine = removeLegacySageEngine(parsed);
-    let seed;
-    if (!existed && oldFileExisted && Object.keys(oldGlobalParsed).length >= 1) {
-      seed = { ...oldGlobalParsed };
-      delete seed["activeProfile"];
-      removeLegacySageEngine(seed);
-      const filled = fillMissingDefaults(seed, CONFIG_BEHAVIOR_DEFAULTS);
-      seed = filled.value;
-    } else {
-      const filled = fillMissingDefaults(
-        parsed,
-        CONFIG_BEHAVIOR_DEFAULTS
-      );
-      if (!filled.changed && !removedLegacyEngine) return;
-      seed = filled.value;
-    }
-    await backupConfigFile(profileFp, this.paths);
-    await atomicWrite(profileFp, JSON.stringify(seed, null, 2), { mode: 384 });
-    this.events?.emit("storage.write", {
-      sessionId: "~config~",
-      store: "config",
-      filePath: profileFp,
-      operation: "ensure_profile_defaults",
-      outcome: "success",
-      durationMs: Date.now() - t0,
-      ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-    });
-  }
-  /**
-   * Persist sync config to the active profile's sync.json, with the token encrypted
-   * by the vault (if provided). The file is isolated from the main config
-   * hierarchy to prevent accidental commits.
-   */
-  async persistSyncConfig(cfg) {
-    let toWrite = { ...cfg };
-    if (this.vault && toWrite.githubToken && !toWrite.githubToken.startsWith("enc:")) {
-      toWrite = { ...toWrite, githubToken: this.vault.encrypt(toWrite.githubToken) };
-    }
-    const fp = this.paths.syncConfig;
-    const t0 = Date.now();
-    try {
-      await atomicWrite(fp, JSON.stringify(toWrite, null, 2), { mode: 384 });
-      this.events?.emit("storage.write", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: fp,
-        operation: "persist_sync",
-        outcome: "success",
-        durationMs: Date.now() - t0,
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-    } catch (err) {
-      this.events?.emit("storage.error", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: fp,
-        operation: "persist_sync",
-        outcome: "failure",
-        error: storageErrorString(err),
-        recoverable: false,
-        durationMs: Date.now() - t0,
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-      throw err;
-    }
-  }
-  /**
-   * Read the active profile's sync.json (encrypted GitHub token storage) and decrypt
-   * the token if a vault is available. Returns null if the file doesn't exist.
-   * This is separate from main config loading because sync.json is intentionally
-   * isolated — it should never be part of project-local or env-driven config.
-   */
-  async loadSyncConfig() {
-    const fp = this.paths.syncConfig;
-    const t0 = Date.now();
-    try {
-      const raw = await fs5.readFile(fp, "utf8");
-      const parsed = safeParse(raw);
-      if (!parsed.ok || !parsed.value) {
-        this.events?.emit("storage.read", {
-          sessionId: "~config~",
-          store: "config",
-          filePath: fp,
-          operation: "load_sync",
-          outcome: "failure",
-          durationMs: Date.now() - t0,
-          error: "parse error or empty file",
-          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-        });
-        return null;
-      }
-      if (this.vault) {
-        const decrypted = decryptConfigSecrets({ sync: parsed.value }, this.vault);
-        const result = decrypted.sync ?? null;
-        this.events?.emit("storage.read", {
-          sessionId: "~config~",
-          store: "config",
-          filePath: fp,
-          operation: "load_sync",
-          outcome: "success",
-          durationMs: Date.now() - t0,
-          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-        });
-        return result;
-      }
-      this.events?.emit("storage.read", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: fp,
-        operation: "load_sync",
-        outcome: "success",
-        durationMs: Date.now() - t0,
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-      return parsed.value;
-    } catch (err) {
-      if (err.code === "ENOENT") return null;
-      this.events?.emit("storage.read", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: fp,
-        operation: "load_sync",
-        outcome: "failure",
-        durationMs: Date.now() - t0,
-        error: storageErrorString(err),
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-      this.logWarn("Config sync load failed", {
-        event: "config.sync_load_failed",
-        message: toErrorMessage(err)
-      });
-      return null;
-    }
-  }
-  async readJson(file) {
-    const t0 = Date.now();
-    let mtimeMs = null;
-    try {
-      const stat5 = await fs5.stat(file);
-      mtimeMs = stat5.mtimeMs;
-      const cached = this.jsonCache.get(file);
-      if (cached && cached.mtimeMs === mtimeMs) {
-        return structuredClone(cached.value);
-      }
-    } catch (err) {
-      if (err.code === "ENOENT") {
-        this.jsonCache.set(file, { mtimeMs: null, value: {} });
-        return {};
-      }
-      this.events?.emit("storage.read", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: file,
-        operation: "read_json",
-        outcome: "failure",
-        durationMs: Date.now() - t0,
-        error: storageErrorString(err),
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-      this.logWarn("Config read failed (stat)", {
-        event: "config.read_failed",
-        path: file,
-        message: toErrorMessage(err)
-      });
-      return {};
-    }
-    let raw;
-    try {
-      raw = await fs5.readFile(file, "utf8");
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        this.events?.emit("storage.read", {
-          sessionId: "~config~",
-          store: "config",
-          filePath: file,
-          operation: "read_json",
-          outcome: "failure",
-          durationMs: Date.now() - t0,
-          error: storageErrorString(err),
-          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-        });
-        this.logWarn("Config read failed (read)", {
-          event: "config.read_failed",
-          path: file,
-          message: toErrorMessage(err)
-        });
-      }
-      this.jsonCache.set(file, { mtimeMs: null, value: {} });
-      return {};
-    }
-    const parsed = safeParse(raw);
-    if (!parsed.ok || !parsed.value) {
-      this.events?.emit("storage.read", {
-        sessionId: "~config~",
-        store: "config",
-        filePath: file,
-        operation: "read_json",
-        outcome: "failure",
-        durationMs: Date.now() - t0,
-        error: "parse error or empty file",
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-      this.logWarn("Config parse failed \u2014 falling back to defaults", {
-        event: "config.parse_failed",
-        path: file
-      });
-      return {};
-    }
-    migrateLegacySuperMemoryKey(parsed.value);
-    this.jsonCache.set(file, { mtimeMs, value: structuredClone(parsed.value) });
-    return parsed.value;
-  }
-  validateBehavior(cfg) {
-    if (cfg.version === void 0)
-      throw new ConfigError({
-        message: "Config: missing version field",
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { field: "version" }
-      });
-    if (cfg.version !== 1)
-      throw new ConfigError({
-        message: `Config: unsupported version ${cfg.version}`,
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { field: "version", actual: cfg.version }
-      });
-    const c = cfg.context;
-    if (!c)
-      throw new ConfigError({
-        message: "Config: missing context section",
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { field: "context" }
-      });
-    const fields = ["warnThreshold", "softThreshold", "hardThreshold"];
-    for (const f of fields) {
-      const v = c[f];
-      if (typeof v !== "number" || !Number.isFinite(v)) {
-        throw new ConfigError({
-          message: `Config: context.${String(f)} must be a finite number (got ${typeof v})`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { field: `context.${String(f)}`, actualType: typeof v }
-        });
-      }
-    }
-    if (c.warnThreshold >= c.softThreshold || c.softThreshold >= c.hardThreshold) {
-      throw new ConfigError({
-        message: "Config: context thresholds must satisfy warn < soft < hard",
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { warn: c.warnThreshold, soft: c.softThreshold, hard: c.hardThreshold }
-      });
-    }
-    if (c.mode !== void 0 && !isContextWindowModeSelectionId(c.mode)) {
-      const known = listContextWindowModes().map((m) => m.id).join(", ");
-      this.logWarn(
-        `Ignoring unknown context.mode "${c.mode}" \u2014 falling back to "${DEFAULT_CONTEXT_WINDOW_MODE_ID}"`,
-        { event: "config.unknown_context_mode", mode: c.mode, known }
-      );
-      c.mode = DEFAULT_CONTEXT_WINDOW_MODE_ID;
-    } else if (c.mode !== void 0) {
-      c.mode = normalizeContextWindowModeId(c.mode) ?? DEFAULT_CONTEXT_WINDOW_MODE_ID;
-    }
-  }
-  validateIdentity(cfg) {
-    if (!cfg.provider) {
-      throw new ConfigError({
-        message: "Config: no provider configured. Run `wstack init` or set WRONGSTACK_PROVIDER.",
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { field: "provider" }
-      });
-    }
-    if (!cfg.model) {
-      throw new ConfigError({
-        message: "Config: no model configured. Run `wstack init` or set WRONGSTACK_MODEL.",
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { field: "model" }
-      });
-    }
-  }
-};
-
-// src/utils/project-identity.ts
-import * as fsPromises from "node:fs/promises";
-import * as path7 from "node:path";
-
-// src/utils/ulid.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-var ENCODING_LEN = ENCODING.length;
-var TIME_LEN = 10;
-var RANDOM_LEN = 16;
-function encodeTime(now, len) {
-  let mod;
-  let str = "";
-  for (let i = len - 1; i >= 0; i--) {
-    mod = now % ENCODING_LEN;
-    str = ENCODING[mod] + str;
-    now = (now - mod) / ENCODING_LEN;
-  }
-  return str;
-}
-function encodeRandom(len) {
-  const bytes = randomBytes2(len);
-  let str = "";
-  for (let i = 0; i < len; i++) {
-    str += ENCODING[bytes[i] % ENCODING_LEN];
-  }
-  return str;
-}
-function ulid(seedTime = Date.now()) {
-  return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN);
-}
-function isUlid(value) {
-  if (value.length !== TIME_LEN + RANDOM_LEN) return false;
-  for (const ch of value) {
-    if (!ENCODING.includes(ch)) return false;
-  }
-  return true;
-}
-
-// src/utils/project-identity.ts
-var PROJECT_IDENTITY_VERSION = 1;
-var PROJECT_ID_PREFIX = "proj_";
-var PROJECT_IDENTITY_RELATIVE_PATH = path7.join(".wrongstack", "project.json");
-var PROJECT_GITIGNORE_RULES = [
-  ".wrongstack/",
-  "!/.wrongstack/",
-  "/.wrongstack/*",
-  "!/.wrongstack/project.json"
-];
-function projectIdentityPath(projectRoot) {
-  return path7.join(projectRoot, PROJECT_IDENTITY_RELATIVE_PATH);
-}
-function createProjectId(seedTime = Date.now()) {
-  return `${PROJECT_ID_PREFIX}${ulid(seedTime)}`;
-}
-function isProjectId(value) {
-  return value.startsWith(PROJECT_ID_PREFIX) && isUlid(value.slice(PROJECT_ID_PREFIX.length));
-}
-async function readProjectIdentity(projectRoot) {
-  const filePath = projectIdentityPath(projectRoot);
-  try {
-    return parseProjectIdentity(await fsPromises.readFile(filePath, "utf8"), filePath);
-  } catch (error) {
-    if (isMissingFileError(error)) return void 0;
-    throw error;
-  }
-}
-async function ensureProjectIdentity(projectRoot, idFactory = createProjectId) {
-  const existing = await readProjectIdentity(projectRoot);
-  if (existing) return { identity: existing, created: false };
-  const filePath = projectIdentityPath(projectRoot);
-  const identity = makeIdentity(idFactory());
-  await fsPromises.mkdir(path7.dirname(filePath), { recursive: true });
-  try {
-    await fsPromises.writeFile(filePath, serializeProjectIdentity(identity), {
-      encoding: "utf8",
-      flag: "wx"
-    });
-    return { identity, created: true };
-  } catch (error) {
-    if (!isAlreadyExistsError(error)) throw error;
-    const winner = await readProjectIdentity(projectRoot);
-    if (!winner) throw error;
-    return { identity: winner, created: false };
-  }
-}
-async function ensureProjectGitignore(projectRoot) {
-  const filePath = path7.join(projectRoot, ".gitignore");
-  let content = "";
-  try {
-    content = await fsPromises.readFile(filePath, "utf8");
-  } catch (error) {
-    if (!isMissingFileError(error)) throw error;
-  }
-  const hadTrailingNewline = content.endsWith("\n");
-  const lines = content.length === 0 ? [] : content.split(/\r?\n/);
-  if (hadTrailingNewline) lines.pop();
-  let changed = false;
-  for (let index = 0; index < lines.length; index++) {
-    if (lines[index]?.trim() === ".wrongstack/*") {
-      lines[index] = ".wrongstack/";
-      changed = true;
-    }
-  }
-  for (const entry of PROJECT_GITIGNORE_RULES) {
-    if (!lines.some((line) => line.trim() === entry)) {
-      if (entry === ".wrongstack/" && lines.length > 0 && lines.at(-1) !== "") lines.push("");
-      lines.push(entry);
-      changed = true;
-    }
-  }
-  if (!changed) return;
-  await fsPromises.writeFile(filePath, `${lines.join("\n")}
-`, "utf8");
-}
-function makeIdentity(projectId) {
-  if (!isProjectId(projectId)) {
-    throw new Error(`Invalid WrongStack project id: ${projectId}`);
-  }
-  return { version: PROJECT_IDENTITY_VERSION, projectId };
-}
-function parseProjectIdentity(raw, filePath) {
-  let value;
-  try {
-    value = JSON.parse(raw);
-  } catch {
-    throw new Error(`Invalid JSON in WrongStack project identity file: ${filePath}`);
-  }
-  if (typeof value !== "object" || value === null) {
-    throw new Error(`Invalid WrongStack project identity file: ${filePath}`);
-  }
-  const record = value;
-  if (record["version"] !== PROJECT_IDENTITY_VERSION) {
-    throw new Error(`Unsupported WrongStack project identity version in ${filePath}`);
-  }
-  if (typeof record["projectId"] !== "string" || !isProjectId(record["projectId"])) {
-    throw new Error(`Invalid projectId in WrongStack project identity file: ${filePath}`);
-  }
-  return { version: PROJECT_IDENTITY_VERSION, projectId: record["projectId"] };
-}
-function serializeProjectIdentity(identity) {
-  return `${JSON.stringify(identity, null, 2)}
-`;
-}
-function isMissingFileError(error) {
-  return error?.code === "ENOENT";
-}
-function isAlreadyExistsError(error) {
-  return error?.code === "EEXIST";
-}
-
-// src/utils/project-state-guard.ts
-import * as fs6 from "node:fs";
-import * as fsp3 from "node:fs/promises";
-import * as path8 from "node:path";
-var PROJECT_STATE_DIRECTORY = ".wrongstack";
-var DEFAULT_POLL_INTERVAL_MS = 1e3;
-var REPAIR_DEBOUNCE_MS = 25;
-var ACTIVE_GUARD_KEY = /* @__PURE__ */ Symbol.for("wrongstack.activeProjectStateGuard");
-var globalScope = globalThis;
-globalScope[ACTIVE_GUARD_KEY] ??= {};
-var activeGuard = globalScope[ACTIVE_GUARD_KEY];
-function normalizedRoot(root) {
-  const resolved = path8.resolve(root);
-  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-function concernsProjectState(filename) {
-  if (filename === null) return true;
-  const firstSegment = String(filename).replaceAll("\\", "/").split("/")[0];
-  return firstSegment?.toLowerCase() === PROJECT_STATE_DIRECTORY;
-}
-async function startProjectStateGuard(projectRoot, options = {}) {
-  const root = path8.resolve(projectRoot);
-  const directory = path8.join(root, PROJECT_STATE_DIRECTORY);
-  const pollIntervalMs = Math.max(25, options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
-  let closed = false;
-  let repairPending = false;
-  let repairInFlight;
-  let repairTimer;
-  const ensureDirectory = async () => {
-    await fsp3.mkdir(directory, { recursive: true });
-  };
-  const ensureInvariant = async () => {
-    await ensureDirectory();
-    try {
-      await ensureProjectGitignore(root);
-    } catch (error) {
-      options.onError?.(error);
-    }
-  };
-  const scheduleRepair = () => {
-    if (closed) return;
-    repairPending = true;
-    if (repairInFlight || repairTimer) return;
-    repairTimer = setTimeout(() => {
-      repairTimer = void 0;
-      repairInFlight = (async () => {
-        while (!closed && repairPending) {
-          repairPending = false;
-          try {
-            const rootState = await fsp3.stat(root).catch(() => void 0);
-            if (!rootState?.isDirectory()) return;
-            await ensureInvariant();
-          } catch (error) {
-            options.onError?.(error);
-          }
-        }
-      })().finally(() => {
-        repairInFlight = void 0;
-        if (repairPending && !closed) scheduleRepair();
-      });
-    }, REPAIR_DEBOUNCE_MS);
-    repairTimer.unref?.();
-  };
-  await ensureDirectory();
-  await ensureProjectGitignore(root).catch((error) => options.onError?.(error));
-  let watcher;
-  try {
-    watcher = fs6.watch(root, { persistent: false }, (_eventType, filename) => {
-      if (concernsProjectState(filename) || String(filename).toLowerCase() === ".gitignore") {
-        scheduleRepair();
-      }
-    });
-    watcher.on("error", (error) => {
-      options.onError?.(error);
-      watcher = void 0;
-      scheduleRepair();
-    });
-  } catch (error) {
-    options.onError?.(error);
-  }
-  const poll = setInterval(scheduleRepair, pollIntervalMs);
-  poll.unref?.();
-  return {
-    directory,
-    close() {
-      if (closed) return;
-      closed = true;
-      clearInterval(poll);
-      if (repairTimer) clearTimeout(repairTimer);
-      repairTimer = void 0;
-      try {
-        watcher?.close();
-      } catch {
-      }
-      watcher = void 0;
-    }
-  };
-}
-async function activateProjectStateGuard(projectRoot, options = {}) {
-  const root = normalizedRoot(projectRoot);
-  if (activeGuard.root === root && activeGuard.guard) return activeGuard.guard;
-  const next = await startProjectStateGuard(projectRoot, options);
-  const previous = activeGuard.guard;
-  activeGuard.root = root;
-  activeGuard.guard = next;
-  previous?.close();
-  return next;
-}
-
-// src/boot.ts
-async function bootConfig(options = {}) {
-  const {
-    flags = {},
-    appLabel = "wstack",
-    loadSyncConfig = true,
-    skipIdentityValidation = false
-  } = options;
-  const cwd = typeof flags["cwd"] === "string" ? path12.resolve(flags["cwd"]) : process.cwd();
-  const pathResolver = new DefaultPathResolver(cwd);
-  const projectRoot = pathResolver.projectRoot;
-  const projectIdentityRoot = canonicalProjectRoot(projectRoot);
-  const userHome = os4.homedir();
-  const wpaths = resolveWstackPaths({ projectRoot });
-  assertProjectRootOutsideStateDir(projectRoot, wpaths.globalRoot);
-  await activateProjectStateGuard(projectRoot);
-  await fs9.mkdir(wpaths.globalRoot, { recursive: true });
-  await fs9.mkdir(wpaths.profilesDir, { recursive: true });
-  await fs9.mkdir(wpaths.projectDir, { recursive: true });
-  await fs9.mkdir(wpaths.projectSessions, { recursive: true });
-  let registeredProjectId;
-  try {
-    registeredProjectId = (await readProjectIdentity(projectRoot))?.projectId;
-  } catch {
-  }
-  await writeProjectMeta(wpaths, projectIdentityRoot, registeredProjectId);
-  await registerProjectInManifest(
-    wpaths,
-    projectIdentityRoot,
-    void 0,
-    cwd !== projectIdentityRoot ? cwd : void 0,
-    registeredProjectId
-  );
-  await ensureProjectGitignore(projectRoot).catch(() => void 0);
-  await migrateLegacyConfig(wpaths);
-  await migrateProfileFiles(wpaths);
-  cleanupStaleProjects(wpaths).catch((err) => {
-    noOpLogger.debug("cleanupStaleProjects failed", { err });
-  });
-  const bootLogger = new DefaultLogger({ stderr: true });
-  const vault = new DefaultSecretVault({ keyFile: wpaths.secretsKey, logger: bootLogger });
-  const bootstrapProfilePath = typeof wpaths.profileConfig === "function" ? wpaths.profileConfig(wpaths.profileName) : null;
-  const secretFiles = [wpaths.projectLocalConfig].filter(Boolean);
-  if (bootstrapProfilePath) secretFiles.push(bootstrapProfilePath);
-  for (const file of secretFiles) {
-    try {
-      const { migrated } = await migratePlaintextSecrets(file, vault, noOpLogger);
-      if (migrated > 0) {
-        writeErr(`[${appLabel}] Encrypted ${migrated} plaintext secret(s) in ${file}
-`);
-      }
-    } catch {
-    }
-  }
-  const configLoader = new DefaultConfigLoader({ paths: wpaths, vault, logger: bootLogger });
-  let config;
-  try {
-    config = await configLoader.load({ cliFlags: flagsToConfigPatch(flags) });
-  } catch (err) {
-    if (skipIdentityValidation && err instanceof Error && err.message.includes("no provider configured")) {
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "boot.no_provider_configured",
-          app: appLabel,
-          message: "No provider configured \u2014 setup screen will be shown",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-      try {
-        config = await configLoader.load({
-          cliFlags: flagsToConfigPatch(flags),
-          skipIdentityValidation: true
-        });
-      } catch (fallbackErr) {
-        console.warn(
-          JSON.stringify({
-            level: "warn",
-            event: "boot.config_fallback",
-            message: `Config load fallback triggered: ${toErrorMessage(fallbackErr)}`,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-        config = Object.freeze({});
-      }
-    } else {
-      throw err;
-    }
-  }
-  if (loadSyncConfig) {
-    const syncConfig = await configLoader.loadSyncConfig();
-    if (syncConfig) {
-      config = Object.freeze({ ...config, sync: syncConfig });
-    }
-  }
-  if (!config.hq?.projectAlias) {
-    try {
-      await ensureProjectIdentity(projectRoot);
-    } catch (error) {
-      bootLogger.warn?.("Could not initialize .wrongstack/project.json", {
-        event: "project.identity_init_failed",
-        error: toErrorMessage(error)
-      });
-    }
-  }
-  let committedProjectId;
-  try {
-    committedProjectId = (await readProjectIdentity(projectRoot))?.projectId;
-  } catch {
-  }
-  if (committedProjectId !== registeredProjectId) {
-    await writeProjectMeta(wpaths, projectIdentityRoot, committedProjectId);
-    await registerProjectInManifest(
-      wpaths,
-      projectIdentityRoot,
-      void 0,
-      cwd !== projectIdentityRoot ? cwd : void 0,
-      committedProjectId
-    );
-  }
-  const logger = new DefaultLogger({ level: config.log?.level ?? "info", file: wpaths.logFile });
-  try {
-    const { getProjectSessionRegistry: getProjectSessionRegistry2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
-    getProjectSessionRegistry2(wpaths.globalRoot);
-  } catch {
-  }
-  return {
-    cwd,
-    projectRoot,
-    userHome,
-    wpaths,
-    pathResolver,
-    config,
-    vault,
-    logger,
-    globalConfigPath: wpaths.globalConfig
-  };
-}
-function isEnabledFlag(value) {
-  if (value === true) return true;
-  if (typeof value !== "string") return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on";
-}
-function flagsToConfigPatch(flags) {
-  const patch = {};
-  if (typeof flags["provider"] === "string") patch.provider = flags["provider"];
-  if (typeof flags["model"] === "string") patch.model = flags["model"];
-  if (typeof flags["fallback-model"] === "string") {
-    const list = flags["fallback-model"].split(",").map((s) => s.trim()).filter(Boolean);
-    if (list.length > 0) patch.fallbackModels = list;
-  }
-  if (typeof flags["cwd"] === "string") patch.cwd = flags["cwd"];
-  if (typeof flags["log-level"] === "string") {
-    patch.log = { level: flags["log-level"] };
-  } else if (flags["verbose"]) {
-    patch.log = { level: "debug" };
-  } else if (flags["trace"]) {
-    patch.log = { level: "trace" };
-  }
-  if (flags["no-yolo"] === true) patch.yolo = false;
-  else if (flags["yolo"]) patch.yolo = true;
-  if (flags["no-features"]) {
-    patch.features = {
-      mcp: false,
-      plugins: false,
-      memory: false,
-      modelsRegistry: false,
-      skills: false
-    };
-  }
-  if (flags["token-saving-mode"]) {
-    patch.features ??= {};
-    patch.features.tokenSavingMode = true;
-  }
-  if (isEnabledFlag(flags["system-pro"]) || flags["system-prompt"] === "pro") {
-    patch.systemPrompt = { variant: "pro" };
-  } else if (isEnabledFlag(flags["system-lite"]) || flags["system-prompt"] === "lite") {
-    patch.systemPrompt = { variant: "lite" };
-  } else if (flags["system-prompt"] === "default") {
-    patch.systemPrompt = { variant: "default" };
-  }
-  if (typeof flags["token-saving-tier"] === "string") {
-    patch.features ??= {};
-    patch.features.tokenSavingMode = normalizeTokenSavingTier(
-      flags["token-saving-tier"]
-    );
-  }
-  return patch;
-}
-async function migrateLegacyConfig(wpaths) {
-  const rootFp = wpaths.globalConfig;
-  let legacyRaw;
-  try {
-    legacyRaw = await fs9.readFile(rootFp, "utf8");
-  } catch {
-    return;
-  }
-  const result = safeParse(legacyRaw);
-  if (!result.ok || !result.value || typeof result.value !== "object" || Array.isArray(result.value)) {
-    return;
-  }
-  const activeProfile = safeProfileName(
-    typeof result.value["activeProfile"] === "string" ? result.value["activeProfile"] : void 0
-  );
-  const profileFp = wpaths.profileConfig(activeProfile);
-  try {
-    await fs9.access(profileFp);
-    return;
-  } catch (err) {
-    if (err.code !== "ENOENT") return;
-  }
-  await fs9.mkdir(path12.dirname(profileFp), { recursive: true });
-  const profileContent = { ...result.value };
-  delete profileContent["activeProfile"];
-  await atomicWrite(profileFp, JSON.stringify(profileContent, null, 2), { mode: 384 });
-  const bootstrap = { version: 1, activeProfile };
-  try {
-    await atomicWrite(rootFp, JSON.stringify(bootstrap, null, 2), { mode: 384 });
-  } catch {
-  }
-}
-var PROFILE_STATE_PAIRS = [
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "statusline.json"),
-    profileDst: (w, n) => w.profileStatuslineConfig(n)
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "mode.json"),
-    profileDst: (w, n) => w.profileModeConfig(n)
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "provider-status.json"),
-    profileDst: (w, n) => w.profileProviderStatus(n)
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "update-cache.json"),
-    profileDst: (w, n) => w.profileUpdateCache(n)
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "memory.md"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "memory.md")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "history"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "history")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "sync.json"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "sync.json")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "sync-state.json"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "sync-state.json")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "prompt-usage.json"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "prompt-usage.json")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "custom-context-modes.json"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "custom-context-modes.json")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "desktop.json"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "desktop.json")
-  },
-  {
-    globalSrc: (w) => path12.join(w.globalRoot, "installed-skills.json"),
-    profileDst: (w, n) => path12.join(w.profilesDir, n, "installed-skills.json")
-  },
-  ...["skills", "prompts", "instructions", "design-kits", "desktop", "settings"].map(
-    (directory) => ({
-      globalSrc: (w) => path12.join(w.globalRoot, directory),
-      profileDst: (w, n) => path12.join(w.profilesDir, n, directory)
-    })
-  )
-];
-async function migrateProfileFiles(wpaths) {
-  let profileName = wpaths.profileName;
-  try {
-    const raw = await fs9.readFile(wpaths.globalConfig, "utf8");
-    const parsed = safeParse(raw);
-    if (parsed.ok && parsed.value && typeof parsed.value.activeProfile === "string") {
-      profileName = safeProfileName(parsed.value.activeProfile);
-    }
-  } catch {
-  }
-  try {
-    await fs9.mkdir(path12.join(wpaths.profilesDir, profileName), { recursive: true });
-  } catch {
-    return;
-  }
-  for (const pair of PROFILE_STATE_PAIRS) {
-    const src = pair.globalSrc(wpaths);
-    const dst = pair.profileDst(wpaths, profileName);
-    let srcIsDir;
-    try {
-      srcIsDir = (await fs9.stat(src)).isDirectory();
-    } catch {
-      continue;
-    }
-    try {
-      const dstStat = await fs9.stat(dst);
-      if (dstStat.isDirectory() === srcIsDir) {
-        continue;
-      }
-      await fs9.rm(dst, { recursive: true, force: true });
-    } catch (err) {
-      const code = err.code;
-      if (code !== "ENOENT") {
-        writeErr(`migrateProfileFiles: skipping ${dst} (stat error: ${code ?? "unknown"})
-`);
-        continue;
-      }
-    }
-    try {
-      if (srcIsDir) {
-        await fs9.cp(src, dst, { recursive: true, errorOnExist: false, force: false });
-      } else {
-        const content = await fs9.readFile(src);
-        await fs9.writeFile(dst, content, { mode: 384 });
-      }
-    } catch {
-    }
-  }
-}
-function assertProjectRootOutsideStateDir(projectRoot, globalRoot) {
-  const stateNamespace = path12.resolve(globalRoot, "projects");
-  const rel = path12.relative(stateNamespace, path12.resolve(projectRoot));
-  if (rel.startsWith("..") || path12.isAbsolute(rel)) return;
-  throw new Error(
-    `Refusing to start: the resolved project root is inside WrongStack's per-project state directory.
-  project root: ${projectRoot}
-  state dir:    ${stateNamespace}
-This usually means a WrongStack process was spawned with a state path as its working directory. Start from a real project directory, or pass --cwd <path>.`
-  );
-}
-async function writeProjectMeta(paths, projectRoot, projectId) {
-  try {
-    await fs9.mkdir(paths.projectDir, { recursive: true });
-    const meta = {
-      hash: paths.projectHash,
-      slug: paths.projectSlug,
-      root: projectRoot,
-      ...projectId ? { projectId } : {},
-      lastSeen: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await atomicWrite(paths.projectMeta, JSON.stringify(meta, null, 2));
-  } catch {
-  }
-}
-async function registerProjectInManifest(paths, projectRoot, events, workingDir, projectId) {
-  const manifestPath = path12.join(paths.globalRoot, "projects.json");
-  try {
-    const t0 = Date.now();
-    const raw = await fs9.readFile(manifestPath, "utf8");
-    events?.emit("storage.read", {
-      sessionId: "~boot~",
-      store: "project",
-      filePath: manifestPath,
-      operation: "manifest_read",
-      outcome: "success",
-      durationMs: Date.now() - t0
-    });
-    try {
-      JSON.parse(raw);
-    } catch {
-    }
-  } catch (err) {
-    events?.emit("storage.error", {
-      sessionId: "~boot~",
-      store: "project",
-      filePath: manifestPath,
-      operation: "manifest_read",
-      error: toErrorMessage(err),
-      recoverable: true
-    });
-  }
-  try {
-    let manifest;
-    try {
-      const raw = await fs9.readFile(manifestPath, "utf8");
-      manifest = JSON.parse(raw);
-    } catch {
-      manifest = { projects: [] };
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = manifest.projects.find((p) => p.root === projectRoot);
-    if (existing) {
-      existing.lastSeen = now;
-      if (projectId) existing.projectId = projectId;
-      if (workingDir) existing.lastWorkingDir = workingDir;
-    } else {
-      const slug = paths.projectSlug;
-      const name = path12.basename(projectRoot);
-      const entry = {
-        name,
-        root: projectRoot,
-        slug,
-        projectId,
-        lastSeen: now,
-        createdAt: now
-      };
-      if (workingDir) entry.lastWorkingDir = workingDir;
-      manifest.projects.push(entry);
-    }
-    const writeT0 = Date.now();
-    await atomicWrite(manifestPath, JSON.stringify(manifest, null, 2));
-    events?.emit("storage.write", {
-      sessionId: "~boot~",
-      store: "project",
-      filePath: manifestPath,
-      operation: "manifest_write",
-      outcome: "success",
-      durationMs: Date.now() - writeT0
-    });
-  } catch (err) {
-    events?.emit("storage.error", {
-      sessionId: "~boot~",
-      store: "project",
-      filePath: manifestPath,
-      operation: "manifest_write",
-      error: toErrorMessage(err),
-      recoverable: false
-    });
-  }
-}
-async function cleanupStaleProjects(wpaths) {
-  const projectsRoot = path12.dirname(wpaths.projectDir);
-  let entries;
-  try {
-    entries = await fs9.readdir(projectsRoot, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  const stateNamespace = path12.resolve(projectsRoot);
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const projectPath = path12.join(projectsRoot, entry.name);
-    const metaPath = path12.join(projectPath, "meta.json");
-    try {
-      const raw = await fs9.readFile(metaPath, "utf8");
-      const meta = JSON.parse(raw);
-      if (typeof meta.root !== "string") continue;
-      const rel = path12.relative(stateNamespace, path12.resolve(meta.root));
-      const nested = rel !== "" && !rel.startsWith("..") && !path12.isAbsolute(rel);
-      if (nested) {
-        await fs9.rm(projectPath, { recursive: true, force: true });
-        continue;
-      }
-      try {
-        await fs9.access(meta.root);
-      } catch {
-        await fs9.rm(projectPath, { recursive: true, force: true });
-      }
-    } catch {
-    }
-  }
-}
 export {
   DefaultLogger,
   DefaultPathResolver,