@wrongstack/core 0.313.0 → 0.316.1

package/dist/chunk-3AGWVSS7.js

@@ -0,0 +1,4608 @@
+import {
+  SkillInstaller,
+  bodyLineAdvisory,
+  createSkillsShAdapter,
+  extractSkillFromPrompt,
+  generateSkillSkeleton,
+  githubDirectAdapter,
+  openInEditor,
+  validateSkillNameAvailable,
+  writeSkeletonSkill
+} from "./chunk-RXKSDUAU.js";
+import {
+  ALL_SYNC_CATEGORIES,
+  CloudConfigSync,
+  CloudSync,
+  PromptUsageStore
+} from "./chunk-GJJGJB2R.js";
+import {
+  decryptConfigSecrets,
+  encryptConfigSecrets
+} from "./chunk-YY6APYUM.js";
+import {
+  resolvePluginManifestConfig,
+  validatePluginConfigMetadata
+} from "./chunk-3XPVB7BA.js";
+import {
+  createChronicleProjectAccess
+} from "./chunk-LXWCMQNJ.js";
+import {
+  syncReportCompletion,
+  syncReportReopen
+} from "./chunk-YWXT3JNM.js";
+import {
+  FINDING_DEFAULT_PAGE_SIZE
+} from "./chunk-4LCZVJVF.js";
+import {
+  DefaultPromptLoader,
+  renderPrompt
+} from "./chunk-XF4VUMKW.js";
+import {
+  FOREIGN_SKILL_TOOLS,
+  securityScoreToTier
+} from "./chunk-JVKB2TBL.js";
+import {
+  DefaultPromptStore,
+  migratePromptEntry
+} from "./chunk-PGRVXIMY.js";
+import {
+  readJsonObjectFile,
+  validateAgainstSchema
+} from "./chunk-YPT4A46F.js";
+import {
+  readBundledInstructionText,
+  renderInstructionTemplate
+} from "./chunk-5S437PRC.js";
+import {
+  ExtensionRegistry
+} from "./chunk-MTL4O5YR.js";
+import {
+  FallbackProfileManager
+} from "./chunk-WQQON3SV.js";
+import {
+  capSkillBody
+} from "./chunk-M27LIEKV.js";
+import {
+  color
+} from "./chunk-4VWO3ZXL.js";
+import {
+  isPidAlive
+} from "./chunk-TRT2HRWZ.js";
+import {
+  atomicWrite
+} from "./chunk-OSGLYW5J.js";
+import {
+  stripFrontmatter
+} from "./chunk-FC2ZGRF3.js";
+import {
+  projectSlug,
+  resolveWstackPaths
+} from "./chunk-SAFHACFA.js";
+import {
+  parseModelRef
+} from "./chunk-RJIZEJ42.js";
+import {
+  expectDefined
+} from "./chunk-PFZO3C6H.js";
+import {
+  ERROR_CODES,
+  PluginError
+} from "./chunk-25LSLC3G.js";
+import {
+  toErrorMessage
+} from "./chunk-TBRL2RCC.js";
+
+// src/plugin/loader.ts
+var legacyRegistrations = /* @__PURE__ */ new WeakMap();
+var PluginLifecycleTimeoutError = class extends Error {
+  constructor(pluginName, phase, timeoutMs) {
+    super(`Plugin "${pluginName}" ${phase} exceeded ${timeoutMs} ms`);
+    this.pluginName = pluginName;
+    this.phase = phase;
+    this.timeoutMs = timeoutMs;
+    this.name = "PluginLifecycleTimeoutError";
+  }
+  pluginName;
+  phase;
+  timeoutMs;
+};
+var KERNEL_API_VERSION = "0.1.10";
+function parseSemver(v) {
+  const parts = v.replace(/^[^0-9]*/, "").split(".").map((s) => Number.parseInt(s, 10) || 0);
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function satisfies(range, version) {
+  const [vMaj, vMin, vPatch] = parseSemver(version);
+  const trimmed = range.trim();
+  const op = trimmed.startsWith("^") ? "^" : trimmed.startsWith("~") ? "~" : "=";
+  const ver = trimmed.replace(/^[\^~=]/, "");
+  const [rMaj, rMin, rPatch] = parseSemver(ver);
+  if (op === "^") {
+    if (rMaj === 0) return vMaj === 0 && vMin === rMin && vPatch >= rPatch;
+    return vMaj === rMaj && (vMin > rMin || vMin === rMin && vPatch >= rPatch);
+  }
+  if (op === "~") {
+    return vMaj === rMaj && vMin === rMin && vPatch >= rPatch;
+  }
+  return vMaj === rMaj && vMin === rMin && vPatch === rPatch;
+}
+function normalizeDep(d) {
+  return typeof d === "string" ? { name: d } : d;
+}
+function topoSort(plugins) {
+  const map = /* @__PURE__ */ new Map();
+  for (const p of plugins) map.set(p.name, p);
+  const visited = /* @__PURE__ */ new Set();
+  const visiting = /* @__PURE__ */ new Set();
+  const order = [];
+  const visit = (p, stack) => {
+    if (visited.has(p.name)) return;
+    if (visiting.has(p.name)) {
+      throw new PluginError({
+        message: `Plugin dependency cycle: ${[...stack, p.name].join(" -> ")}`,
+        code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+        pluginName: p.name
+      });
+    }
+    visiting.add(p.name);
+    for (const raw of p.dependsOn ?? []) {
+      const dep = normalizeDep(raw);
+      const d = map.get(dep.name);
+      if (!d) {
+        throw new PluginError({
+          message: `Plugin "${p.name}" depends on missing plugin "${dep.name}"`,
+          code: ERROR_CODES.PLUGIN_MISSING_DEPENDENCY,
+          pluginName: p.name,
+          context: { dependency: dep.name }
+        });
+      }
+      if (dep.version && d.version && !satisfies(dep.version, d.version)) {
+        throw new PluginError({
+          message: `Plugin "${p.name}" requires "${dep.name}@${dep.version}", found ${d.version}`,
+          code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+          pluginName: p.name,
+          context: { dependency: dep.name, required: dep.version, found: d.version }
+        });
+      }
+      visit(d, [...stack, p.name]);
+    }
+    for (const raw of p.optionalDeps ?? []) {
+      const dep = normalizeDep(raw);
+      const d = map.get(dep.name);
+      if (d) {
+        if (dep.version && d.version && !satisfies(dep.version, d.version)) {
+          throw new PluginError({
+            message: `Plugin "${p.name}" optional dep "${dep.name}@${dep.version}" found ${d.version}`,
+            code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+            pluginName: p.name,
+            context: { dependency: dep.name, required: dep.version, found: d.version }
+          });
+        }
+        visit(d, [...stack, p.name]);
+      }
+    }
+    visiting.delete(p.name);
+    visited.add(p.name);
+    order.push(p);
+  };
+  for (const p of plugins) visit(p, []);
+  return order;
+}
+function lifecycleTimeoutMs(configured, fallback, phase) {
+  const value = configured ?? fallback;
+  if (!Number.isFinite(value) || value < 0) {
+    throw new RangeError(`Plugin ${phase} timeout must be a finite non-negative number`);
+  }
+  return value;
+}
+async function runWithDeadline(plugin, phase, timeoutMs, operation) {
+  const controller = new AbortController();
+  let timer;
+  const timeoutError = new PluginLifecycleTimeoutError(plugin.name, phase, timeoutMs);
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort(timeoutError);
+      reject(timeoutError);
+    }, timeoutMs);
+  });
+  const work = Promise.resolve().then(() => operation(controller.signal));
+  try {
+    await Promise.race([work, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function registerLegacy(registration) {
+  const registrations = legacyRegistrations.get(registration.plugin) ?? [];
+  registrations.push(registration);
+  legacyRegistrations.set(registration.plugin, registrations);
+}
+function unregisterLegacy(registration) {
+  const registrations = legacyRegistrations.get(registration.plugin);
+  if (!registrations) return;
+  const index = registrations.indexOf(registration);
+  if (index >= 0) registrations.splice(index, 1);
+  if (registrations.length === 0) legacyRegistrations.delete(registration.plugin);
+}
+function drainCleanup(registration, log) {
+  if (registration.cleanupDrained) return;
+  registration.cleanupDrained = true;
+  try {
+    registration.cleanupApi.drainCleanup?.call(registration.cleanupApi);
+  } catch (err) {
+    log.error(`Plugin "${registration.plugin.name}" cleanup drain failed`, { err });
+  }
+}
+async function disposeRegistration(registration, opts, context) {
+  if (registration.disposed) return;
+  registration.disposed = true;
+  const { plugin, api } = registration;
+  try {
+    if (typeof plugin.teardown === "function") {
+      const timeoutMs = lifecycleTimeoutMs(opts.teardownTimeoutMs, 1e4, "teardown");
+      await runWithDeadline(
+        plugin,
+        "teardown",
+        timeoutMs,
+        (signal) => plugin.teardown(api, { signal })
+      );
+    }
+    opts.log.info(`Plugin "${plugin.name}" disposed (${context})`);
+  } catch (err) {
+    opts.log.error(`Plugin "${plugin.name}" teardown failed during ${context}`, {
+      err,
+      reason: err instanceof PluginLifecycleTimeoutError ? "teardown deadline exceeded" : void 0
+    });
+  } finally {
+    drainCleanup(registration, opts.log);
+    unregisterLegacy(registration);
+  }
+}
+async function disposeRegistrations(registrations, opts) {
+  for (const registration of [...registrations].reverse()) {
+    await disposeRegistration(registration, opts, "shutdown");
+  }
+}
+async function loadPlugins(plugins, opts) {
+  const kernelVersion = opts.kernelApiVersion ?? KERNEL_API_VERSION;
+  const loaded = [];
+  const failed = [];
+  const registrations = [];
+  const names = new Set(plugins.map((p) => p.name));
+  for (const p of plugins) {
+    for (const c of p.conflictsWith ?? []) {
+      if (names.has(c)) {
+        throw new PluginError({
+          message: `Plugin "${p.name}" conflicts with loaded plugin "${c}"`,
+          code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+          pluginName: p.name,
+          context: { conflictsWith: c }
+        });
+      }
+    }
+  }
+  let sorted;
+  try {
+    sorted = topoSort(plugins);
+  } catch (err) {
+    const message = toErrorMessage(err);
+    opts.log.error("Plugin dependency sort failed", message);
+    throw new PluginError({
+      message: `Plugin dependency sort failed: ${message}`,
+      code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+      pluginName: "(topological sort)",
+      context: { pluginCount: plugins.length },
+      cause: err
+    });
+  }
+  for (const plugin of sorted) {
+    if (!satisfies(plugin.apiVersion, kernelVersion)) {
+      const err = new PluginError({
+        message: `Plugin "${plugin.name}" requires apiVersion ${plugin.apiVersion}; kernel is ${kernelVersion}`,
+        code: ERROR_CODES.PLUGIN_API_MISMATCH,
+        pluginName: plugin.name,
+        context: { required: plugin.apiVersion, kernel: kernelVersion }
+      });
+      opts.log.error(err.message);
+      failed.push({ plugin, err });
+      continue;
+    }
+    const metadataIssues = validatePluginConfigMetadata(plugin);
+    if (metadataIssues.length > 0) {
+      const err = new PluginError({
+        message: `Plugin "${plugin.name}" config metadata invalid \u2014 ${metadataIssues.join("; ")}`,
+        code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+        pluginName: plugin.name,
+        context: { issues: metadataIssues }
+      });
+      opts.log.error(err.message);
+      failed.push({ plugin, err });
+      continue;
+    }
+    const resolution = resolvePluginManifestConfig(
+      plugin,
+      void 0,
+      opts.pluginOptions?.[plugin.name]
+    );
+    const hasResolvedOptions = plugin.defaultConfig !== void 0 || resolution.configured;
+    if (opts.pluginOptions && hasResolvedOptions) {
+      opts.pluginOptions[plugin.name] = resolution.options;
+    }
+    if (plugin.configSchema && hasResolvedOptions) {
+      const result = validateAgainstSchema(resolution.options, plugin.configSchema);
+      if (!result.ok) {
+        const firstErr = result.errors[0];
+        const detail = firstErr ? `${firstErr.path}: ${firstErr.message}` : "config invalid";
+        const err = new PluginError({
+          message: `Plugin "${plugin.name}" config invalid \u2014 ${detail}`,
+          code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+          pluginName: plugin.name,
+          context: { errors: result.errors }
+        });
+        opts.log.error(err.message);
+        failed.push({ plugin, err });
+        continue;
+      }
+    }
+    let registration;
+    try {
+      const rawApi = opts.apiFactory(
+        plugin,
+        resolution.options
+      );
+      const enforceForPlugin = typeof opts.enforceCapabilities === "function" ? opts.enforceCapabilities(plugin) : opts.enforceCapabilities ?? false;
+      const api = plugin.capabilities ? wrapApiForCapabilityCheck(plugin, rawApi, opts.log, enforceForPlugin) : rawApi;
+      registration = {
+        plugin,
+        api,
+        cleanupApi: rawApi,
+        cleanupDrained: false,
+        disposed: false
+      };
+      const setupTimeoutMs = lifecycleTimeoutMs(opts.setupTimeoutMs, 3e4, "setup");
+      await runWithDeadline(
+        plugin,
+        "setup",
+        setupTimeoutMs,
+        (signal) => plugin.setup(api, { signal })
+      );
+      registrations.push(registration);
+      registerLegacy(registration);
+      loaded.push(plugin);
+      opts.log.info(`Plugin "${plugin.name}" loaded`);
+    } catch (err) {
+      opts.log.error(`Plugin "${plugin.name}" setup failed`, {
+        err,
+        reason: err instanceof PluginLifecycleTimeoutError ? "setup deadline exceeded" : void 0
+      });
+      failed.push({ plugin, err });
+      if (registration) await disposeRegistration(registration, opts, "setup rollback");
+    }
+  }
+  let disposed = false;
+  let disposePromise;
+  return {
+    loaded,
+    failed,
+    get disposed() {
+      return disposed;
+    },
+    dispose() {
+      if (!disposePromise) {
+        disposed = true;
+        disposePromise = disposeRegistrations(registrations, opts);
+      }
+      return disposePromise;
+    }
+  };
+}
+async function unloadPlugins(loadedPlugins, opts) {
+  const ordered = [...loadedPlugins].reverse();
+  for (const plugin of ordered) {
+    const candidates = legacyRegistrations.get(plugin);
+    let registration;
+    if (candidates) {
+      for (let index = candidates.length - 1; index >= 0; index -= 1) {
+        if (!candidates[index].disposed) {
+          registration = candidates[index];
+          break;
+        }
+      }
+    }
+    if (!registration) {
+      opts.log.error(`Plugin "${plugin.name}" has no active loader registration`);
+      continue;
+    }
+    await disposeRegistration(registration, opts, "shutdown");
+  }
+}
+function wrapApiForCapabilityCheck(plugin, api, log, enforce = false) {
+  const caps = plugin.capabilities ?? {};
+  const violate = (subsystem, detail) => {
+    const msg = `Plugin "${plugin.name}" used ${subsystem} without declaring capabilities.${subsystem} \u2014 ${detail}`;
+    if (enforce) {
+      throw new PluginError({
+        message: msg,
+        code: ERROR_CODES.PLUGIN_LOAD_FAILED,
+        pluginName: plugin.name,
+        context: { subsystem, detail }
+      });
+    }
+    if (typeof log.warn === "function") log.warn(msg);
+    else log.error(msg);
+  };
+  const wrappedTools = caps.tools !== false ? api.tools : new Proxy(api.tools, {
+    get(target, prop, receiver) {
+      if (prop === "register") {
+        return (t) => {
+          violate(
+            "tools",
+            `register(${t?.name ?? "<unknown>"})`
+          );
+          return target.register(t);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+  const wrappedProviders = caps.providers !== false ? api.providers : new Proxy(api.providers, {
+    get(target, prop, receiver) {
+      if (prop === "register") {
+        return (f) => {
+          violate(
+            "providers",
+            `register(${f?.type ?? "<unknown>"})`
+          );
+          return target.register(f);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+  const wrappedSlash = caps.slashCommands !== false ? api.slashCommands : new Proxy(api.slashCommands, {
+    get(target, prop, receiver) {
+      if (prop === "register") {
+        return (c) => {
+          violate(
+            "slashCommands",
+            `register(${c?.name ?? "<unknown>"})`
+          );
+          return target.register(c);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+  const wrappedMcp = caps.mcp !== false ? api.mcp : new Proxy(api.mcp, {
+    get(target, prop, receiver) {
+      if (prop === "start") {
+        return (cfg) => {
+          violate(
+            "mcp",
+            `start(${cfg?.name ?? "<unknown>"})`
+          );
+          return target.start(cfg);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+  const wrappedLlm = caps.llm !== false || !api.llm ? api.llm : new Proxy(api.llm, {
+    get(target, prop, receiver) {
+      if (prop === "complete" || prop === "council") {
+        return (prompt, options) => {
+          violate("llm", `${String(prop)}(${prompt.length} chars)`);
+          const method = target[prop];
+          if (!method) return void 0;
+          return options === void 0 ? method.call(target, prompt) : method.call(target, prompt, options);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+  const wrappedHooks = caps.hooks !== false ? api : new Proxy(api, {
+    get(target, prop, receiver) {
+      if (prop === "registerHook") {
+        return (event, matcher, hook, options) => {
+          const ev = typeof event === "string" ? event : "<unknown>";
+          const m = typeof matcher === "string" ? matcher : "*";
+          violate("hooks", `registerHook(${ev}, ${m})`);
+          const register = target.registerHook;
+          return options === void 0 ? register(event, matcher, hook) : register(event, matcher, hook, options);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+  return new Proxy(api, {
+    get(target, prop, receiver) {
+      switch (prop) {
+        case "tools":
+          return wrappedTools;
+        case "providers":
+          return wrappedProviders;
+        case "slashCommands":
+          return wrappedSlash;
+        case "mcp":
+          return wrappedMcp;
+        case "llm":
+          return wrappedLlm;
+        case "registerHook":
+          return wrappedHooks[prop];
+        default:
+          return Reflect.get(target, prop, receiver);
+      }
+    }
+  });
+}
+
+// src/plugin/api.ts
+var DefaultPluginAPI = class {
+  container;
+  events;
+  pipelines;
+  tools;
+  providers;
+  mcp;
+  slashCommands;
+  extensions;
+  session;
+  metrics;
+  config;
+  log;
+  modelsRegistry;
+  mailbox;
+  notifier;
+  llm;
+  configStore;
+  hookRegistry;
+  ownerName;
+  pluginCleanupFns = [];
+  constructor(init) {
+    const owner = init.ownerName;
+    this.ownerName = owner;
+    this.hookRegistry = init.hookRegistry;
+    this.container = init.container;
+    this.events = init.events;
+    this.config = init.config;
+    this.configStore = init.configStore;
+    this.log = init.log.child({ plugin: owner });
+    this.extensions = init.extensions ?? new ExtensionRegistry();
+    this.session = init.sessionWriter ?? noopSession;
+    this.metrics = init.metricsSink ? scopedMetrics(init.metricsSink, owner) : noopMetrics;
+    this.modelsRegistry = init.modelsRegistry;
+    this.mailbox = init.mailbox;
+    this.notifier = init.notifier;
+    let liveConfig;
+    if (init.configStore) {
+      const off = init.configStore.watch((next) => {
+        const n = next;
+        if (n && typeof n === "object") liveConfig = n;
+      });
+      this.pluginCleanupFns.push(off);
+    }
+    this.llm = init.llm ? makePluginLLM(
+      owner,
+      init.llm,
+      init.providerRegistry,
+      init.config,
+      () => liveConfig,
+      this.metrics,
+      this.log
+    ) : void 0;
+    const pipelines = init.pipelines;
+    const readonlyPipelines = {};
+    for (const [key, pipeline] of Object.entries(pipelines)) {
+      readonlyPipelines[key] = pipeline.asReadonly();
+    }
+    this.pipelines = readonlyPipelines;
+    const tr = init.toolRegistry;
+    const isOfficial = init.official === true;
+    const capabilities = init.capabilities;
+    const assertCanMutateTool = (name, op) => {
+      if (isOfficial) return;
+      const currentOwner = tr.ownerOf(name);
+      if (currentOwner === void 0) return;
+      const ownedSolelyByMe = currentOwner.split("+").every((seg) => seg === owner);
+      if (ownedSolelyByMe) return;
+      const toolCaps = tr.get(name)?.capabilities ?? [];
+      const pluginMutateCaps = capabilities?.toolMutateCapabilities ?? [];
+      const hasRequiredCap = toolCaps.some((c) => pluginMutateCaps.includes(c));
+      if (!hasRequiredCap) {
+        throw new Error(
+          `Plugin "${owner}" may not ${op} tool "${name}" \u2014 it is owned by "${currentOwner}". Tool capabilities: [${toolCaps.join(", ") || "none"}]. Plugin toolMutateCapabilities: [${pluginMutateCaps.join(", ") || "none"}]. Missing required capability to mutate this tool.`
+        );
+      }
+    };
+    this.tools = {
+      register: (t) => {
+        tr.register(t, owner);
+        tr.exposeToProvider(t.name);
+      },
+      unregister: (name) => {
+        assertCanMutateTool(name, "unregister");
+        return tr.unregister(name);
+      },
+      wrap: (name, wrapper) => {
+        assertCanMutateTool(name, "wrap");
+        tr.wrap(name, wrapper, owner);
+      },
+      get: (name) => tr.get(name),
+      list: () => tr.list()
+    };
+    const pr = init.providerRegistry;
+    const providerTypesIOwn = /* @__PURE__ */ new Set();
+    const assertCanMutateProvider = (type, op) => {
+      if (isOfficial) return;
+      if (providerTypesIOwn.has(type)) return;
+      if (!pr.has(type)) return;
+      throw new Error(
+        `Plugin "${owner}" may not ${op} provider "${type}" \u2014 it was not registered by this plugin. Replacing an existing provider would route prompts and credentials through plugin code.`
+      );
+    };
+    this.providers = {
+      register: (f) => {
+        assertCanMutateProvider(f.type, "replace");
+        pr.register(f);
+        providerTypesIOwn.add(f.type);
+      },
+      unregister: (type) => {
+        assertCanMutateProvider(type, "unregister");
+        providerTypesIOwn.delete(type);
+        return pr.unregister(type);
+      },
+      create: (cfg) => pr.create(cfg),
+      list: () => pr.list()
+    };
+    const mcpRegistry = init.mcpRegistry;
+    if (!mcpRegistry) {
+      this.mcp = noopMcp;
+    } else {
+      const mcpServersIStarted = /* @__PURE__ */ new Set();
+      const assertOwnsMcpServer = (name, op) => {
+        if (isOfficial) return;
+        if (mcpServersIStarted.has(name)) return;
+        if (!mcpRegistry.list().some((s) => s.name === name)) return;
+        throw new Error(
+          `Plugin "${owner}" may not ${op} MCP server "${name}" \u2014 it was not started by this plugin.`
+        );
+      };
+      this.mcp = {
+        start: async (cfg) => {
+          const name = cfg?.name;
+          if (typeof name === "string" && mcpRegistry.list().some((s) => s.name === name)) {
+            assertOwnsMcpServer(name, "start");
+          }
+          await mcpRegistry.start(cfg);
+          if (typeof name === "string") mcpServersIStarted.add(name);
+        },
+        stop: async (name) => {
+          assertOwnsMcpServer(name, "stop");
+          await mcpRegistry.stop(name);
+        },
+        restart: async (name) => {
+          assertOwnsMcpServer(name, "restart");
+          await mcpRegistry.restart(name);
+        },
+        list: () => mcpRegistry.list()
+      };
+    }
+    const scr = init.slashCommandRegistry;
+    const official = init.official === true;
+    const commandsIOwn = /* @__PURE__ */ new Set();
+    this.slashCommands = scr ? {
+      register: (cmd) => {
+        scr.register(cmd, owner, { official });
+        for (const key of [cmd.name, ...cmd.aliases ?? []]) {
+          commandsIOwn.add(key);
+          commandsIOwn.add(`${owner}:${key}`);
+        }
+      },
+      unregister: (name) => {
+        if (!official && !commandsIOwn.has(name) && scr.get(name) !== void 0) {
+          throw new Error(
+            `Plugin "${owner}" may not unregister slash command "${name}" \u2014 it was not registered by this plugin.`
+          );
+        }
+        for (const key of [
+          name,
+          `${owner}:${name}`,
+          name.startsWith(`${owner}:`) ? name.slice(owner.length + 1) : name
+        ]) {
+          commandsIOwn.delete(key);
+        }
+        return scr.unregister(name);
+      },
+      get: (name) => scr.get(name),
+      list: () => scr.list()
+    } : noopSlashCommands;
+  }
+  onEvent(event, handler) {
+    const off = this.events.on(event, handler);
+    this.pluginCleanupFns.push(off);
+    return off;
+  }
+  onPattern(pattern, handler) {
+    const off = this.events.onPattern(pattern, handler);
+    this.pluginCleanupFns.push(off);
+    return off;
+  }
+  emitCustom(event, payload) {
+    this.events.emitCustom(event, payload);
+  }
+  onConfigChange(handler) {
+    if (!this.configStore) return () => {
+    };
+    return this.configStore.watch(handler);
+  }
+  /** Called by the plugin loader when uninstalling the plugin. */
+  drainCleanup() {
+    for (const fn of this.pluginCleanupFns.splice(0)) {
+      try {
+        fn();
+      } catch {
+      }
+    }
+    if (this.hookRegistry) this.hookRegistry.drainByOwner(this.ownerName);
+  }
+  registerSystemPromptContributor(c) {
+    return this.extensions.registerSystemPromptContributor(c);
+  }
+  registerHook(event, matcher, hook, options) {
+    if (!this.hookRegistry) return () => {
+    };
+    const off = this.hookRegistry.registerInProcess(event, matcher, hook, this.ownerName, options);
+    this.pluginCleanupFns.push(off);
+    return off;
+  }
+};
+var noopMcp = {
+  start: async () => void 0,
+  stop: async () => void 0,
+  restart: async () => void 0,
+  list: () => []
+};
+var noopSlashCommands = {
+  register() {
+  },
+  unregister() {
+    return false;
+  },
+  get() {
+    return void 0;
+  },
+  list() {
+    return [];
+  }
+};
+var noopSession = {
+  append: async () => {
+  }
+};
+var noopMetrics = {
+  counter() {
+  },
+  histogram() {
+  },
+  gauge() {
+  }
+};
+function makePluginLLM(owner, hostLLM, providerRegistry, config, getLiveConfig, metrics, log) {
+  const providerCache = /* @__PURE__ */ new Map();
+  const PROVIDER_CACHE_MAX = 32;
+  let providerCacheConfigRef = config;
+  const currentConfig = () => getLiveConfig() ?? config;
+  const currentProvider = () => hostLLM.getProvider?.() ?? hostLLM.provider;
+  const currentModel = () => hostLLM.getModel?.() ?? hostLLM.model;
+  const DEFAULT_MAX_TOKENS = 2048;
+  const HARD_MAX_TOKENS = 32768;
+  const DEFAULT_TIMEOUT_MS = 3e4;
+  const HARD_TIMEOUT_MS = 12e4;
+  const pluginDefaults = () => {
+    const extensions = currentConfig().extensions;
+    const raw = extensions?.[owner]?.["llm"];
+    if (!raw || typeof raw !== "object") return {};
+    const r = raw;
+    return {
+      ...typeof r["provider"] === "string" && r["provider"] ? { provider: r["provider"] } : {},
+      ...typeof r["model"] === "string" && r["model"] ? { model: r["model"] } : {},
+      ...typeof r["maxTokens"] === "number" ? { maxTokens: r["maxTokens"] } : {},
+      ...typeof r["temperature"] === "number" ? { temperature: r["temperature"] } : {},
+      ...typeof r["role"] === "string" && r["role"] ? { role: r["role"] } : {},
+      ...Array.isArray(r["fallbackModels"]) && r["fallbackModels"].every((v) => typeof v === "string") ? { fallbackModels: [...r["fallbackModels"]] } : {},
+      ...typeof r["timeoutMs"] === "number" ? { timeoutMs: r["timeoutMs"] } : {},
+      ...typeof r["councilProfile"] === "string" && r["councilProfile"] ? { councilProfile: r["councilProfile"] } : {}
+    };
+  };
+  const resolveProvider = (name, model) => {
+    const defaults = pluginDefaults();
+    const liveProvider = currentProvider();
+    const liveConfig = currentConfig();
+    if (liveConfig !== providerCacheConfigRef) {
+      providerCache.clear();
+      providerCacheConfigRef = liveConfig;
+    }
+    const providerName = name ?? defaults.provider ?? liveProvider.id;
+    if (providerName === liveProvider.id) {
+      return { provider: liveProvider, providerName };
+    }
+    const cacheKey = `${providerName}|${model}`;
+    const cached = providerCache.get(cacheKey);
+    if (cached) return { provider: cached, providerName };
+    let created;
+    if (hostLLM.createProvider) {
+      created = hostLLM.createProvider(providerName, model);
+    } else {
+      const savedCfg = liveConfig.providers?.[providerName];
+      const factoryType = savedCfg?.type ?? providerName;
+      created = providerRegistry.create(
+        { ...savedCfg ?? {}, type: providerName, model },
+        factoryType
+      );
+    }
+    while (providerCache.size >= PROVIDER_CACHE_MAX) {
+      const oldest = providerCache.keys().next().value;
+      if (oldest === void 0) break;
+      providerCache.delete(oldest);
+    }
+    providerCache.set(cacheKey, created);
+    return { provider: created, providerName };
+  };
+  const pluginLlm = {
+    defaults() {
+      const d = pluginDefaults();
+      return {
+        provider: d.provider ?? currentProvider().id,
+        model: d.model ?? currentModel()
+      };
+    },
+    async complete(prompt, opts) {
+      const defaults = pluginDefaults();
+      const model = opts?.model ?? defaults.model ?? currentModel();
+      const providerName = opts?.provider ?? defaults.provider ?? currentProvider().id;
+      const maxTokens = Math.min(
+        HARD_MAX_TOKENS,
+        opts?.maxTokens ?? defaults.maxTokens ?? DEFAULT_MAX_TOKENS
+      );
+      const temperature = opts?.temperature ?? defaults.temperature;
+      const timeoutMs = Math.min(
+        HARD_TIMEOUT_MS,
+        Math.max(1, opts?.timeoutMs ?? defaults.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      );
+      if (hostLLM.oneShot) {
+        metrics.counter("llm.calls", 1, { provider: providerName, model, engine: "one-shot" });
+        const result = await hostLLM.oneShot({
+          userPrompt: prompt,
+          providerId: providerName,
+          model,
+          maxTokens,
+          timeoutMs,
+          ...temperature !== void 0 ? { temperature } : {},
+          ...opts?.system ? { system: opts.system } : {},
+          ...opts?.responseFormat === "json" ? { responseFormat: { type: "json_object" } } : {},
+          ...opts?.signal ? { signal: opts.signal } : {},
+          ...opts?.role ?? defaults.role ? { role: opts?.role ?? defaults.role } : {},
+          ...opts?.fallbackModels ?? defaults.fallbackModels ? { fallbackModels: [...opts?.fallbackModels ?? defaults.fallbackModels ?? []] } : {}
+        });
+        if (result.error) {
+          metrics.counter("llm.errors", 1, { provider: result.provider, model: result.model });
+          throw new Error(result.error);
+        }
+        metrics.counter("llm.tokens_in", result.tokens.input);
+        metrics.counter("llm.tokens_out", result.tokens.output);
+        return {
+          text: result.text,
+          model: result.model,
+          provider: result.provider,
+          usage: { input: result.tokens.input, output: result.tokens.output },
+          stopReason: result.stopReason ?? "end_turn",
+          fromFallback: result.fromFallback,
+          attempts: result.attempts,
+          durationMs: result.durationMs
+        };
+      }
+      const { provider } = resolveProvider(providerName, model);
+      const request = {
+        model,
+        messages: [{ role: "user", content: [{ type: "text", text: prompt }] }],
+        maxTokens,
+        ...temperature !== void 0 ? { temperature } : {},
+        ...opts?.system ? { system: [{ type: "text", text: opts.system }] } : {},
+        ...opts?.responseFormat === "json" ? { responseFormat: { type: "json_object" } } : {}
+      };
+      const timeoutSignal = AbortSignal.timeout(timeoutMs);
+      const signal = opts?.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
+      metrics.counter("llm.calls", 1, { provider: providerName, model });
+      try {
+        const response = await provider.complete(request, { signal });
+        const text = response.content.filter((b) => b.type === "text").map((b) => b.text).join("");
+        metrics.counter("llm.tokens_in", response.usage.input);
+        metrics.counter("llm.tokens_out", response.usage.output);
+        return {
+          text,
+          model: response.model,
+          provider: providerName,
+          usage: { input: response.usage.input, output: response.usage.output },
+          stopReason: response.stopReason
+        };
+      } catch (err) {
+        metrics.counter("llm.errors", 1, { provider: providerName, model });
+        log.warn(`plugin "${owner}" llm.complete failed`, {
+          provider: providerName,
+          model,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        throw err;
+      }
+    }
+  };
+  const council = hostLLM.council;
+  if (council) {
+    pluginLlm.council = async (question, opts) => {
+      const trimmed = question.trim();
+      if (!trimmed) throw new Error("Plugin Council question must not be empty.");
+      if (trimmed.length > 2e4) {
+        throw new Error("Plugin Council question must not exceed 20000 characters.");
+      }
+      if ((opts?.context?.length ?? 0) > 8e4) {
+        throw new Error("Plugin Council context must not exceed 80000 characters.");
+      }
+      const defaults = pluginDefaults();
+      metrics.counter("llm.council.calls", 1, { plugin: owner });
+      const result = await council({
+        question: trimmed,
+        ...opts?.context ? { context: opts.context } : {},
+        ...opts?.options ? { options: opts.options } : {},
+        ...opts?.profile ?? defaults.councilProfile ? { profile: opts?.profile ?? defaults.councilProfile } : {},
+        ...opts?.signal ? { signal: opts.signal } : {}
+      });
+      metrics.counter("llm.tokens_in", result.usage.inputTokens);
+      metrics.counter("llm.tokens_out", result.usage.outputTokens);
+      if (result.status === "failed") metrics.counter("llm.errors", 1, { provider: "council" });
+      return result;
+    };
+  }
+  return pluginLlm;
+}
+function scopedMetrics(sink, pluginName) {
+  const prefix = `plugin.${pluginName}.`;
+  return {
+    counter(name, value, labels) {
+      sink.counter(`${prefix}${name}`, value, labels);
+    },
+    histogram(name, value, labels) {
+      sink.histogram(`${prefix}${name}`, value, labels);
+    },
+    gauge(name, value, labels) {
+      sink.gauge(`${prefix}${name}`, value, labels);
+    }
+  };
+}
+function definePlugin(metadata, factory) {
+  return {
+    name: metadata.name,
+    version: metadata.version,
+    description: metadata.description,
+    capabilities: metadata.capabilities,
+    configSchema: metadata.configSchema,
+    defaultConfig: metadata.defaultConfig,
+    dependsOn: metadata.dependsOn,
+    optionalDeps: metadata.optionalDeps,
+    conflictsWith: metadata.conflictsWith,
+    apiVersion: KERNEL_API_VERSION,
+    // Cast the factory to match the Plugin.setup signature.
+    // The opts parameter ({ signal }) is accepted by Plugin.setup but the
+    // definePlugin factory doesn't need to declare it — the host always passes
+    // it at the call site; the factory just doesn't have to care about it.
+    setup: (api) => factory(api, metadata.defaultConfig)
+  };
+}
+
+// src/plugins/auto-review-config.ts
+var DEFAULT_DEBOUNCE_MS = 15e3;
+var DEFAULT_MAX_FILES_PER_BATCH = 15;
+var DEFAULT_MAX_CONCURRENT_REVIEWS = 2;
+var DEFAULT_MAX_CASCADE_DEPTH = 2;
+var MAX_KNOWN_FINGERPRINTS = 5e3;
+function trimKnownFingerprints(map, max) {
+  while (map.size > max) {
+    const oldest = map.keys().next().value;
+    if (oldest === void 0) break;
+    map.delete(oldest);
+  }
+}
+function buildReviewerModelPool(provider, model, fallbackModels = [], statusTracker) {
+  const primaryProvider = provider.trim();
+  const primaryModel = model.trim();
+  const primaryRef = primaryProvider && primaryModel ? `${primaryProvider}/${primaryModel}` : "";
+  const seen = /* @__PURE__ */ new Set();
+  const pool = [];
+  for (const raw of [primaryRef, ...fallbackModels]) {
+    const ref = raw.trim();
+    if (!ref || seen.has(ref)) continue;
+    const parsed = parseModelRef(ref);
+    if (!parsed.provider?.trim() || !parsed.model.trim()) continue;
+    const normalized = `${parsed.provider.trim()}/${parsed.model.trim()}`;
+    if (seen.has(normalized)) continue;
+    seen.add(ref);
+    seen.add(normalized);
+    if (statusTracker && !statusTracker.isAvailable(parsed.provider.trim(), parsed.model.trim())) {
+      continue;
+    }
+    pool.push(normalized);
+  }
+  return pool;
+}
+function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "", fallbackModel = "", statusTracker) {
+  const filteredPool = statusTracker ? pool.filter((ref) => {
+    const parsed2 = parseModelRef(ref);
+    if (!parsed2.provider?.trim() || !parsed2.model.trim()) return false;
+    return statusTracker.isAvailable(parsed2.provider.trim(), parsed2.model.trim());
+  }) : pool;
+  if (filteredPool.length === 0) {
+    return {
+      provider: fallbackProvider,
+      model: fallbackModel,
+      fallbackModels: [],
+      nextCursor: cursor + 1
+    };
+  }
+  const len = filteredPool.length;
+  const idx = (cursor % len + len) % len;
+  const primaryRef = filteredPool[idx];
+  const parsed = parseModelRef(primaryRef);
+  const provider = parsed.provider?.trim() || fallbackProvider;
+  const model = parsed.model.trim() || fallbackModel;
+  const fallbackModels = [...filteredPool.slice(idx + 1), ...filteredPool.slice(0, idx)];
+  return {
+    provider,
+    model,
+    fallbackModels,
+    nextCursor: (idx + 1) % len
+  };
+}
+function resolveAutoReviewConfig(cfg, sessionConfig) {
+  const mgr = new FallbackProfileManager(sessionConfig);
+  const chain = mgr.resolveEffective({
+    ...cfg.fallbackProfile ? { fallbackProfile: cfg.fallbackProfile, fallbackAuto: false } : {
+      fallbackModels: sessionConfig.fallbackModels,
+      fallbackAuto: sessionConfig.fallbackAuto
+    }
+  });
+  const rawProvider = cfg.provider?.trim();
+  const rawModel = cfg.model?.trim();
+  const resolvedProvider = rawProvider || (chain.length > 0 ? chain[0].providerId : sessionConfig.provider);
+  const resolvedModel = rawModel || (chain.length > 0 ? chain[0].model : sessionConfig.model);
+  const profileFallbackModels = chain.filter((entry) => entry.providerId !== resolvedProvider || entry.model !== resolvedModel).map((entry) => `${entry.providerId}/${entry.model}`);
+  const sessionRef = `${sessionConfig.provider}/${sessionConfig.model}`;
+  const fallbackModels = [
+    ...profileFallbackModels.filter((ref) => ref !== sessionRef),
+    sessionRef
+  ].filter((ref) => ref !== `${resolvedProvider}/${resolvedModel}`);
+  return {
+    enabled: cfg.enabled === true,
+    provider: resolvedProvider,
+    model: resolvedModel,
+    fallbackModels,
+    modelSelection: cfg.modelSelection === "random" ? "random" : "round-robin",
+    debounceMs: cfg.debounceMs ?? DEFAULT_DEBOUNCE_MS,
+    maxFilesPerBatch: cfg.maxFilesPerBatch ?? DEFAULT_MAX_FILES_PER_BATCH,
+    maxConcurrentReviews: cfg.maxConcurrentReviews ?? DEFAULT_MAX_CONCURRENT_REVIEWS,
+    cascadeOn: cfg.cascadeOn ?? "off",
+    maxCascadeDepth: cfg.maxCascadeDepth ?? DEFAULT_MAX_CASCADE_DEPTH
+  };
+}
+function severitiesFromFindings(findings) {
+  const severities = { critical: 0, high: 0, medium: 0 };
+  for (const finding of findings) {
+    if (finding.severity === "critical") severities.critical++;
+    else if (finding.severity === "high") severities.high++;
+    else if (finding.severity === "medium") severities.medium++;
+  }
+  return severities;
+}
+function parseReviewSeverity(text) {
+  const result = { critical: 0, high: 0, medium: 0 };
+  if (!text) return result;
+  for (const level of ["critical", "high", "medium"]) {
+    const countMatch = text.match(new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i"));
+    if (countMatch?.[1]) {
+      result[level] = Number.parseInt(countMatch[1], 10);
+      continue;
+    }
+    const section = text.match(
+      new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i")
+    )?.[1];
+    result[level] = section?.match(/^\s*\d+\.\s/gm)?.length ?? 0;
+  }
+  return result;
+}
+function decideCascadeAgents(text, severities, findings) {
+  const agents = /* @__PURE__ */ new Set();
+  if (severities.critical > 0 || severities.high > 0) agents.add("bug-hunter");
+  if (findings && findings.length > 0) {
+    const highPlus = findings.filter(
+      (finding) => finding.severity === "critical" || finding.severity === "high"
+    );
+    if (highPlus.some((finding) => finding.category === "security")) {
+      agents.add("security-scanner");
+    }
+    if (highPlus.every((finding) => finding.category !== void 0)) {
+      return [...agents];
+    }
+  }
+  const securityKeywords = [
+    "injection",
+    "xss",
+    "csrf",
+    "ssrf",
+    "sql",
+    "secret",
+    "credential",
+    "password",
+    "api key",
+    "token",
+    "auth",
+    "shell injection",
+    "command injection",
+    "innerhtml",
+    "deserialization",
+    "path traversal",
+    "hardcoded",
+    "privilege",
+    "owasp"
+  ];
+  const criticalHighSections = text.toLowerCase().matchAll(/###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi);
+  for (const section of criticalHighSections) {
+    const body = section[1] ?? "";
+    if (securityKeywords.some((keyword) => body.includes(keyword))) {
+      agents.add("security-scanner");
+      break;
+    }
+  }
+  return [...agents];
+}
+function shouldCascade(cascadeOn, severities) {
+  if (cascadeOn === "off") return null;
+  if (severities.critical > 0) return "critical";
+  if (cascadeOn === "high" && severities.high > 0) return "high";
+  return null;
+}
+
+// src/plugins/review-claim-registry.ts
+import { createHash, randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import { hostname } from "node:os";
+import * as path from "node:path";
+var CLAIMS_FILE = "review-claims.jsonl";
+var DEFAULT_CLAIM_TTL_MS = 30 * 60 * 1e3;
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MAX_MS = 50;
+var LOCK_STALE_MS = 3e4;
+var SAME_HOST_STALE_MS = 2 * LOCK_STALE_MS;
+var LOCK_RETRY_BUDGET_MS = SAME_HOST_STALE_MS + 5e3;
+var CLAIM_STORE_LOCK_TIMEOUT = "CLAIM_STORE_LOCK_TIMEOUT";
+var HOST_NAME = hostname();
+function lockOwnerStamp() {
+  return `${HOST_NAME}:${process.pid}`;
+}
+var lastFallbackWarnAt = 0;
+var FALLBACK_WARN_INTERVAL_MS = 6e4;
+function warnFallbackOnce(message) {
+  const now = Date.now();
+  if (now - lastFallbackWarnAt < FALLBACK_WARN_INTERVAL_MS) return;
+  lastFallbackWarnAt = now;
+  console.warn(message);
+}
+async function breakStaleLockVerified(lockPath, verify) {
+  if (!await verify()) return false;
+  return await breakLockAtomically(lockPath) === true;
+}
+async function breakStaleLock(lockPath) {
+  try {
+    const ownerRaw = await fsp.readFile(lockPath, "utf8").catch(() => null);
+    if (ownerRaw !== null) {
+      const [ownerHost, pidRaw] = ownerRaw.trim().split(":", 2);
+      const ownerPid = Number.parseInt(pidRaw ?? "", 10);
+      if (ownerHost === HOST_NAME && Number.isInteger(ownerPid) && ownerPid > 0) {
+        if (isPidAlive(ownerPid)) {
+          const st2 = await fsp.stat(lockPath);
+          if (Date.now() - st2.mtimeMs > SAME_HOST_STALE_MS) {
+            return await breakStaleLockVerified(lockPath, async () => {
+              const st22 = await fsp.stat(lockPath);
+              return Date.now() - st22.mtimeMs > SAME_HOST_STALE_MS;
+            });
+          }
+          return false;
+        }
+        return await breakStaleLockVerified(lockPath, async () => {
+          const content = await fsp.readFile(lockPath, "utf8").catch(() => "");
+          return content.trim() === ownerRaw.trim();
+        });
+      }
+    }
+    const st = await fsp.stat(lockPath);
+    if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+      return await breakStaleLockVerified(lockPath, async () => {
+        const st2 = await fsp.stat(lockPath);
+        return Date.now() - st2.mtimeMs > LOCK_STALE_MS;
+      });
+    }
+  } catch {
+  }
+  return false;
+}
+async function breakLockAtomically(lockPath) {
+  const tombstone = `${lockPath}.stale-${randomUUID()}.tmp`;
+  try {
+    await fsp.rename(lockPath, tombstone);
+  } catch {
+    return false;
+  }
+  void fsp.unlink(tombstone).catch(() => void 0);
+  return true;
+}
+async function withStoreLock(storeDir, fn, waitMs = LOCK_WAIT_MS) {
+  const lockPath = lockFilePath(storeDir);
+  await fsp.mkdir(storeDir, { recursive: true });
+  const deadline = Date.now() + waitMs;
+  let attempt = 0;
+  for (; ; ) {
+    let handle = await fsp.open(lockPath, "wx").catch(() => null);
+    if (!handle && await breakStaleLock(lockPath)) {
+      handle = await fsp.open(lockPath, "wx").catch(() => null);
+    }
+    if (handle) {
+      let stampFailed = false;
+      try {
+        let stamped = false;
+        for (let stampAttempt = 0; stampAttempt < 3 && !stamped; stampAttempt++) {
+          try {
+            await handle.writeFile(lockOwnerStamp());
+            stamped = true;
+          } catch {
+            if (stampAttempt < 2) await new Promise((resolve3) => setTimeout(resolve3, 5));
+          }
+        }
+        if (!stamped) {
+          stampFailed = true;
+          throw new Error("failed to stamp claim lock owner");
+        }
+        return await fn();
+      } finally {
+        await handle.close().catch(() => void 0);
+        if (stampFailed) {
+          await fsp.unlink(lockPath).catch(() => void 0);
+        } else {
+          const owner = await fsp.readFile(lockPath, "utf8").catch(() => null);
+          if (owner !== null && owner.trim() === lockOwnerStamp()) {
+            await fsp.unlink(lockPath).catch(() => void 0);
+          }
+        }
+      }
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      throw Object.assign(new Error("review claim store lock timeout"), {
+        code: CLAIM_STORE_LOCK_TIMEOUT
+      });
+    }
+    const delay = Math.min(LOCK_RETRY_MAX_MS * (attempt + 1), remaining);
+    await new Promise((resolve3) => setTimeout(resolve3, delay));
+    attempt += 1;
+  }
+}
+var MAX_LEDGER_LINES = 1e4;
+var HOST_SID = randomUUID();
+var claimsByEventBus = /* @__PURE__ */ new WeakMap();
+var startedReviews = /* @__PURE__ */ new WeakMap();
+var pendingStartedReviews = /* @__PURE__ */ new WeakMap();
+function fingerprint(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function normalizeKeyPart(p) {
+  const forward = p.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? forward.toLowerCase() : forward;
+}
+function claimKey(cwd, filePath) {
+  return `${normalizeKeyPart(cwd)}\0${normalizeKeyPart(filePath)}`;
+}
+function resolveStore(opts, cwd) {
+  return {
+    storeDir: opts?.storeDir ?? path.join(cwd, ".wrongstack"),
+    ttlMs: opts?.ttlMs ?? DEFAULT_CLAIM_TTL_MS,
+    maxLedgerLines: opts?.maxLedgerLines ?? MAX_LEDGER_LINES
+  };
+}
+function claimsFilePath(storeDir) {
+  return path.join(storeDir, CLAIMS_FILE);
+}
+function lockFilePath(storeDir) {
+  return path.join(storeDir, `${CLAIMS_FILE}.lock`);
+}
+async function readLedger(storeDir, now) {
+  const active = /* @__PURE__ */ new Map();
+  const raw = await fsp.readFile(claimsFilePath(storeDir), "utf8").catch((err) => {
+    const code = err.code;
+    if (code === "ENOENT") return "";
+    throw err;
+  });
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let entry;
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && typeof parsed === "object" && (parsed.op === "claim" || parsed.op === "release") && typeof parsed.key === "string" && typeof parsed.fp === "string" && typeof parsed.sid === "string" && typeof parsed.ts === "number" && (typeof parsed.exp === "undefined" || typeof parsed.exp === "number")) {
+        entry = parsed;
+      }
+    } catch {
+    }
+    if (!entry) continue;
+    let bucket = active.get(entry.key);
+    if (!bucket) {
+      bucket = /* @__PURE__ */ new Map();
+      active.set(entry.key, bucket);
+    }
+    if (entry.op === "claim") {
+      const exp = entry.exp ?? entry.ts + DEFAULT_CLAIM_TTL_MS;
+      if (now > exp) continue;
+      bucket.set(entry.fp, { sid: entry.sid, ts: entry.ts, exp });
+    } else {
+      const existing = bucket.get(entry.fp);
+      if (existing?.sid === entry.sid && existing.ts === entry.ts) bucket.delete(entry.fp);
+    }
+  }
+  return active;
+}
+async function ledgerLineCount(storeDir) {
+  const raw = await fsp.readFile(claimsFilePath(storeDir), "utf8").catch(() => "");
+  return raw.split("\n").filter((l) => l.trim()).length;
+}
+async function compactLedger(storeDir, active) {
+  const lines = [];
+  for (const [key, fps] of active) {
+    for (const [fp, claim] of fps) {
+      lines.push(
+        JSON.stringify({
+          op: "claim",
+          key,
+          fp,
+          sid: claim.sid,
+          ts: claim.ts,
+          exp: claim.exp
+        })
+      );
+    }
+  }
+  const tmp = `${claimsFilePath(storeDir)}.tmp-${randomUUID()}`;
+  await fsp.writeFile(tmp, lines.length > 0 ? `${lines.join("\n")}
+` : "", "utf8");
+  let replaced = false;
+  for (let attempt = 0; attempt < 3 && !replaced; attempt++) {
+    try {
+      await fsp.rename(tmp, claimsFilePath(storeDir));
+      replaced = true;
+    } catch {
+      if (attempt === 2) {
+        await fsp.copyFile(tmp, claimsFilePath(storeDir)).catch(async (copyErr) => {
+          throw copyErr;
+        });
+        await fsp.unlink(tmp).catch(() => void 0);
+        replaced = true;
+      } else {
+        await new Promise((resolve3) => setTimeout(resolve3, 10 * (attempt + 1)));
+      }
+    }
+  }
+}
+async function acquireClaims(storeDir, ttlMs, maxLedgerLines, cwd, files, waitMs = LOCK_WAIT_MS) {
+  return withStoreLock(
+    storeDir,
+    async () => {
+      const now = Date.now();
+      const active = await readLedger(storeDir, now);
+      const claims = [];
+      const lines = [];
+      for (const file of files) {
+        const key = claimKey(cwd, file.path);
+        const fp = fingerprint(file.content);
+        let bucket = active.get(key);
+        if (bucket?.has(fp)) continue;
+        if (!bucket) {
+          bucket = /* @__PURE__ */ new Map();
+          active.set(key, bucket);
+        }
+        bucket.set(fp, { sid: HOST_SID, ts: now, exp: now + ttlMs });
+        claims.push({ key, fingerprint: fp, sid: HOST_SID, ts: now });
+        lines.push(
+          JSON.stringify({
+            op: "claim",
+            key,
+            fp,
+            sid: HOST_SID,
+            ts: now,
+            exp: now + ttlMs
+          })
+        );
+      }
+      if (lines.length > 0) {
+        await fsp.appendFile(claimsFilePath(storeDir), `${lines.join("\n")}
+`, "utf8");
+        try {
+          if (await ledgerLineCount(storeDir) > maxLedgerLines) {
+            await compactLedger(storeDir, active);
+          }
+        } catch (err) {
+          warnFallbackOnce(
+            `[review-claim-registry] ledger compaction failed (${err instanceof Error ? err.message : String(err)}); will retry on a future acquire`
+          );
+        }
+      }
+      return claims;
+    },
+    waitMs
+  );
+}
+async function releaseSharedClaims(storeDir, claims, waitMs = LOCK_WAIT_MS) {
+  if (claims.length === 0) return;
+  await withStoreLock(
+    storeDir,
+    async () => {
+      const now = Date.now();
+      const active = await readLedger(storeDir, now);
+      const lines = [];
+      for (const claim of claims) {
+        const bucket = active.get(claim.key);
+        const live = bucket?.get(claim.fingerprint);
+        if (live && live.sid === claim.sid && live.ts === claim.ts) {
+          lines.push(
+            JSON.stringify({
+              op: "release",
+              key: claim.key,
+              fp: claim.fingerprint,
+              sid: claim.sid,
+              // Target the ORIGINAL claim time so a late release only ever
+              // removes the claim it owns (see readLedger release matching).
+              ts: claim.ts
+            })
+          );
+        }
+      }
+      if (lines.length > 0) {
+        await fsp.appendFile(claimsFilePath(storeDir), `${lines.join("\n")}
+`, "utf8");
+      }
+    },
+    waitMs
+  );
+}
+function ledgerFor(events) {
+  let ledger = claimsByEventBus.get(events);
+  if (!ledger) {
+    ledger = /* @__PURE__ */ new Map();
+    claimsByEventBus.set(events, ledger);
+  }
+  return ledger;
+}
+function claimFilesInMemory(events, cwd, files, ttlMs) {
+  const ledger = ledgerFor(events);
+  const now = Date.now();
+  const claims = [];
+  for (const file of files) {
+    const key = claimKey(cwd, file.path);
+    const fileFingerprint = fingerprint(file.content);
+    let activeFingerprints = ledger.get(key);
+    if (activeFingerprints) {
+      for (const [fp, entry] of activeFingerprints) {
+        if (now > entry.exp) activeFingerprints.delete(fp);
+      }
+      if (activeFingerprints.size === 0) {
+        ledger.delete(key);
+        activeFingerprints = void 0;
+      }
+    }
+    if (!activeFingerprints) {
+      activeFingerprints = /* @__PURE__ */ new Map();
+      ledger.set(key, activeFingerprints);
+    }
+    if (activeFingerprints.has(fileFingerprint)) continue;
+    activeFingerprints.set(fileFingerprint, { ts: now, exp: now + ttlMs });
+    claims.push({ key, fingerprint: fileFingerprint, sid: HOST_SID, ts: now });
+  }
+  return claims;
+}
+function releaseClaimsInMemory(events, claims) {
+  const ledger = ledgerFor(events);
+  for (const claim of claims) {
+    const activeFingerprints = ledger.get(claim.key);
+    if (!activeFingerprints) continue;
+    if (activeFingerprints.get(claim.fingerprint)?.ts === claim.ts) {
+      activeFingerprints.delete(claim.fingerprint);
+    }
+    if (activeFingerprints.size === 0) ledger.delete(claim.key);
+  }
+}
+async function claimFiles(events, cwd, files, opts) {
+  const { storeDir, ttlMs, maxLedgerLines } = resolveStore(opts, cwd);
+  try {
+    const claims = await acquireClaims(storeDir, ttlMs, maxLedgerLines, cwd, files);
+    return { claims, storeDir };
+  } catch (err) {
+    const code = err.code;
+    if (code === CLAIM_STORE_LOCK_TIMEOUT) {
+      try {
+        const claims = await acquireClaims(
+          storeDir,
+          ttlMs,
+          maxLedgerLines,
+          cwd,
+          files,
+          LOCK_RETRY_BUDGET_MS
+        );
+        return { claims, storeDir };
+      } catch (err2) {
+        warnFallbackOnce(
+          `[review-claim-registry] claim lock still contended after ${LOCK_WAIT_MS + LOCK_RETRY_BUDGET_MS}ms (${err2 instanceof Error ? err2.message : String(err2)}); falling back to in-memory dedup`
+        );
+        return { claims: claimFilesInMemory(events, cwd, files, ttlMs), storeDir: null };
+      }
+    }
+    warnFallbackOnce(
+      `[review-claim-registry] shared claim store unavailable (${err instanceof Error ? err.message : String(err)}); falling back to in-memory dedup`
+    );
+    return { claims: claimFilesInMemory(events, cwd, files, ttlMs), storeDir: null };
+  }
+}
+async function releaseClaims(events, claims, storeDir) {
+  if (storeDir === null) {
+    releaseClaimsInMemory(events, claims);
+    return;
+  }
+  try {
+    await releaseSharedClaims(storeDir, claims);
+  } catch (err) {
+    if (err.code === CLAIM_STORE_LOCK_TIMEOUT) {
+      try {
+        await releaseSharedClaims(storeDir, claims, LOCK_RETRY_BUDGET_MS);
+        return;
+      } catch {
+      }
+    }
+    warnFallbackOnce(
+      `[review-claim-registry] shared claim release failed (${err instanceof Error ? err.message : String(err)}); claim will expire via its stored TTL`
+    );
+  }
+}
+async function recordStartedReview(events, payload, opts) {
+  if (!payload || typeof payload !== "object") return;
+  const bundle = payload;
+  if (startedReviews.has(bundle) || pendingStartedReviews.has(bundle)) return;
+  const candidate = payload;
+  if (typeof candidate.cwd !== "string" || !Array.isArray(candidate.files)) return;
+  const cwd = candidate.cwd;
+  const files = candidate.files.filter(
+    (file) => Boolean(file) && typeof file === "object" && typeof file.path === "string" && typeof file.content === "string"
+  );
+  const pending = (async () => {
+    try {
+      const { claims, storeDir } = await claimFiles(events, cwd, files, opts);
+      if (claims.length === 0) return null;
+      const entry = { events, storeDir, claims };
+      startedReviews.set(bundle, entry);
+      return entry;
+    } catch {
+      return null;
+    }
+  })();
+  pendingStartedReviews.set(bundle, pending);
+  try {
+    await pending;
+  } finally {
+    if (pendingStartedReviews.get(bundle) === pending) {
+      pendingStartedReviews.delete(bundle);
+    }
+  }
+}
+async function recordCompletedReview(events, payload) {
+  if (!payload || typeof payload !== "object") return;
+  const bundle = payload.bundle;
+  if (!bundle || typeof bundle !== "object") return;
+  let startedReview = startedReviews.get(bundle);
+  if (!startedReview) {
+    const pending = pendingStartedReviews.get(bundle);
+    if (pending) startedReview = await pending ?? void 0;
+  }
+  if (!startedReview || startedReview.events !== events) return;
+  await releaseClaims(events, startedReview.claims, startedReview.storeDir);
+  startedReviews.delete(bundle);
+}
+async function emitReviewIfChanged(api, bundle, opts) {
+  const { claims, storeDir } = await claimFiles(api.events, bundle.cwd, bundle.files, opts);
+  if (claims.length === 0) return null;
+  const claimed = new Set(claims.map((claim) => `${claim.key}\0${claim.fingerprint}`));
+  const claimedBundle = {
+    ...bundle,
+    // Filter on key+FINGERPRINT pairs, not just key: two entries for the same
+    // path in one batch can differ in content, and a fingerprint claimed by
+    // another session must not ride along in the emitted bundle.
+    files: bundle.files.filter(
+      (file) => claimed.has(`${claimKey(bundle.cwd, file.path)}\0${fingerprint(file.content)}`)
+    )
+  };
+  startedReviews.set(claimedBundle, {
+    events: api.events,
+    storeDir,
+    claims
+  });
+  try {
+    api.emitCustom("chimera.review_needed", claimedBundle);
+    return claimedBundle;
+  } catch (err) {
+    startedReviews.delete(claimedBundle);
+    await releaseClaims(api.events, claims, storeDir);
+    throw err;
+  }
+}
+
+// src/plugins/auto-review-plugin.ts
+import * as fsp3 from "node:fs/promises";
+import * as path3 from "node:path";
+
+// src/plugins/auto-review-git.ts
+import { spawn } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
+import * as fsp2 from "node:fs/promises";
+import * as path2 from "node:path";
+var MAX_SNAPSHOT_FILE_BYTES = 256 * 1024;
+var MAX_SNAPSHOT_TOTAL_BYTES = 8 * 1024 * 1024;
+async function runGit(args, cwd) {
+  return new Promise((resolve3, reject) => {
+    let child;
+    try {
+      child = spawn("git", args, {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        signal: AbortSignal.timeout(15e3),
+        windowsHide: true
+      });
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => {
+      stdout += d;
+    });
+    child.stderr?.on("data", (d) => {
+      stderr += d;
+    });
+    child.on("error", () => resolve3({ stdout, stderr, code: 1 }));
+    child.on("close", (code) => resolve3({ stdout, stderr, code: code ?? 0 }));
+  });
+}
+async function isGitRepo(cwd) {
+  const r = await runGit(["rev-parse", "--git-dir"], cwd);
+  return r.code === 0;
+}
+async function getChangedFiles(cwd) {
+  const r = await runGit(["status", "--porcelain", "--untracked-files=no"], cwd);
+  if (r.code !== 0) return [];
+  const files = [];
+  for (const line of r.stdout.split("\n")) {
+    if (!line.trim()) continue;
+    const x = line[0] ?? " ";
+    const y = line[1] ?? " ";
+    const rawPath = line.slice(3).trim();
+    const filePath = x === "R" || x === "C" ? rawPath.split(" -> ").pop()?.trim() ?? rawPath : rawPath;
+    if (x === "A" || y === "A") {
+      files.push({ path: filePath, status: "added" });
+    } else if (x === "M" || y === "M" || x === "R" || x === "C") {
+      files.push({ path: filePath, status: "modified" });
+    }
+  }
+  return files;
+}
+async function snapshotChangedFiles(cwd) {
+  const snapshots = [];
+  let budget = MAX_SNAPSHOT_TOTAL_BYTES;
+  for (const file of await getChangedFiles(cwd)) {
+    if (file.path.startsWith(".wrongstack/")) continue;
+    if (budget <= 0) break;
+    try {
+      const stat3 = await fsp2.stat(path2.join(cwd, file.path));
+      if (!stat3.isFile() || stat3.size > MAX_SNAPSHOT_FILE_BYTES) continue;
+      const content = await fsp2.readFile(path2.join(cwd, file.path), "utf8");
+      budget -= content.length;
+      snapshots.push({
+        ...file,
+        content,
+        fingerprint: createHash2("sha256").update(content).digest("hex")
+      });
+    } catch {
+    }
+  }
+  return snapshots;
+}
+
+// src/plugins/review-context-builder.ts
+import { spawn as spawn2 } from "node:child_process";
+var GIT_TIMEOUT_MS = 15e3;
+var MAX_DIFF_BYTES = 1e5;
+var MAX_RECENT_COMMITS = 10;
+async function runGit2(args, cwd) {
+  return new Promise((resolve3, reject) => {
+    let child;
+    try {
+      child = spawn2("git", args, {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        signal: AbortSignal.timeout(GIT_TIMEOUT_MS),
+        windowsHide: true
+      });
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => {
+      stdout += d;
+    });
+    child.stderr?.on("data", (d) => {
+      stderr += d;
+    });
+    child.on("error", () => resolve3({ stdout, stderr, code: 1 }));
+    child.on("close", (code) => resolve3({ stdout, stderr, code: code ?? 0 }));
+  });
+}
+async function getFileDiff(cwd, filePath) {
+  const r = await runGit2(["diff", "HEAD", "--", filePath], cwd);
+  if (r.code !== 0 || !r.stdout.trim()) return void 0;
+  return r.stdout.length > MAX_DIFF_BYTES ? `${r.stdout.slice(0, MAX_DIFF_BYTES)}
+... (diff truncated at ${MAX_DIFF_BYTES} bytes \u2014 please use the read tool to view full file content)` : r.stdout;
+}
+function parsePorcelainStatusZ(stdout) {
+  const records = stdout.split("\0");
+  const out = [];
+  for (let index = 0; index < records.length; index++) {
+    const record = records[index];
+    if (!record || record.length < 3) continue;
+    const statusCode = record.slice(0, 2).trim();
+    const filePath = record.slice(3);
+    if (filePath) out.push({ path: filePath, status: statusCode });
+    if (statusCode.includes("R") || statusCode.includes("C")) index++;
+  }
+  return out;
+}
+async function getAllChangedFiles(cwd) {
+  const r = await runGit2(["status", "--porcelain", "-z"], cwd);
+  return r.code === 0 ? parsePorcelainStatusZ(r.stdout) : [];
+}
+async function getRecentCommits(cwd) {
+  const r = await runGit2(["log", `-${MAX_RECENT_COMMITS}`, "--oneline", "--format=%s"], cwd);
+  if (r.code !== 0) return [];
+  return r.stdout.split("\n").filter(Boolean);
+}
+async function buildReviewContext(opts) {
+  const { cwd, config } = opts;
+  const filesWithDiffs = [];
+  for (const f of opts.files) {
+    const entry = {
+      path: f.path,
+      status: f.status,
+      content: f.content
+    };
+    if (f.status === "modified") {
+      try {
+        entry.diff = await getFileDiff(cwd, f.path);
+      } catch {
+      }
+    }
+    filesWithDiffs.push(entry);
+  }
+  let allChangedFiles;
+  try {
+    allChangedFiles = await getAllChangedFiles(cwd);
+  } catch {
+  }
+  let recentCommits;
+  try {
+    recentCommits = await getRecentCommits(cwd);
+    if (recentCommits.length === 0) recentCommits = void 0;
+  } catch {
+  }
+  const activeTodos = opts.activeTodos && opts.activeTodos.length > 0 ? opts.activeTodos : void 0;
+  const cascadeOn = opts.cascadeOn ?? void 0;
+  const cascadeDepth = opts.cascadeDepth ?? void 0;
+  const maxCascadeDepth = opts.maxCascadeDepth ?? void 0;
+  let kanbanCard;
+  try {
+    kanbanCard = await findActiveKanbanCard(cwd);
+  } catch {
+  }
+  let fileProvenance;
+  try {
+    const paths = opts.files.map((f) => f.path);
+    fileProvenance = await findFileProvenance(cwd, paths);
+    if (fileProvenance.length === 0) fileProvenance = void 0;
+  } catch {
+  }
+  return {
+    config,
+    cwd,
+    files: filesWithDiffs,
+    allChangedFiles,
+    recentCommits,
+    activeTodos,
+    cascadeOn,
+    cascadeDepth,
+    maxCascadeDepth,
+    kanbanCard,
+    fileProvenance
+  };
+}
+async function findActiveKanbanCard(projectRoot) {
+  let kanbanApi;
+  try {
+    kanbanApi = await import("@wrongstack/kanban");
+  } catch {
+    return void 0;
+  }
+  const activeTasks = [];
+  const boards = await kanbanApi.listBoards(projectRoot);
+  for (const board of boards) {
+    const data = await kanbanApi.getBoard(projectRoot, board.id);
+    if (!data?.tasks) continue;
+    activeTasks.push(
+      ...data.tasks.filter(
+        (task2) => task2.status === "in_progress" || task2.status === "review" || task2.lifecycle?.currentStage === "running" || task2.lifecycle?.currentStage === "review"
+      )
+    );
+  }
+  if (activeTasks.length !== 1) return void 0;
+  const task = activeTasks[0];
+  if (!task) return void 0;
+  return {
+    id: task.id,
+    title: task.title,
+    description: task.description,
+    successCriteria: task.successCriteria?.map((criterion) => criterion.description)
+  };
+}
+async function findFileProvenance(projectRoot, filePaths) {
+  if (filePaths.length === 0) return [];
+  let access3;
+  try {
+    access3 = createChronicleProjectAccess({ projectRoot });
+  } catch {
+    return [];
+  }
+  const provenance = [];
+  try {
+    const uniquePaths = [...new Set(filePaths)];
+    const result = await access3.call("metrics", {
+      view: "files",
+      refresh: false,
+      files: {
+        paths: uniquePaths,
+        latestPerPath: true,
+        limit: Math.min(1e4, uniquePaths.length)
+      }
+    });
+    const rows = result.data;
+    const byPath = new Map(rows.map((row) => [normalizeReviewPath(row.path), row]));
+    for (const filePath of uniquePaths) {
+      const row = byPath.get(normalizeReviewPath(filePath));
+      if (!row) continue;
+      provenance.push({
+        path: filePath,
+        agentId: row.agentId || void 0,
+        taskId: row.taskId || void 0,
+        eventType: lineageEventType(row),
+        observedAt: row.occurredAt
+      });
+    }
+  } finally {
+    await access3.close();
+  }
+  return provenance;
+}
+function normalizeReviewPath(filePath) {
+  return filePath.replaceAll("\\", "/").toLocaleLowerCase();
+}
+function lineageEventType(row) {
+  return row.source === "external" ? `file.external.${row.operation || "modified"}` : "file.event";
+}
+
+// src/plugins/auto-review-plugin.ts
+function buildAutoReviewCommand(getConfig, getInFlightCount) {
+  return {
+    name: "auto-review",
+    category: "Session",
+    description: "Show continuous auto-review status and configuration.",
+    help: [
+      "\u2554\u2550\u2550\u2550 Auto Review \u2550\u2550\u2550\u2557",
+      "",
+      "Continuous code review that fires on every change during a session.",
+      "Detects git-tracked file edits and dispatches review subagents",
+      "with configurable provider/model/fallback and profile selection.",
+      "",
+      "Reports are persisted and shown as passive notifications.",
+      "They never wake the leader or spawn mutating follow-up agents.",
+      "",
+      "Commands:",
+      "  /auto-review           Show current status and config",
+      "  /auto-review on        Enable auto-review",
+      "  /auto-review off       Disable auto-review",
+      "",
+      "Configuration (edit config.json extensions.wstack-auto-review):",
+      "  enabled              true | false",
+      "  provider             provider id for review agents",
+      "  model                model id for review agents",
+      "  fallbackProfile      named profile from config.fallbackProfiles",
+      "  modelSelection       round-robin | random (default round-robin)",
+      "  debounceMs           debounce window (default 15000)",
+      "  maxFilesPerBatch     max files per review (default 15)",
+      "  maxConcurrentReviews max parallel reviews (default 2)",
+      "  cascadeOn            off | critical | high (default off)",
+      "  maxCascadeDepth      max fix+re-review cycles (default 2)"
+    ].join("\n"),
+    async run(args) {
+      const cfg = getConfig();
+      const trimmed = (args ?? "").trim().toLowerCase();
+      if (trimmed === "on" || trimmed === "enable") {
+        return {
+          message: "Auto-review enable/disable via config.json extensions.wstack-auto-review.enabled"
+        };
+      }
+      if (trimmed === "off" || trimmed === "disable") {
+        return {
+          message: "Auto-review enable/disable via config.json extensions.wstack-auto-review.enabled"
+        };
+      }
+      const inFlight = getInFlightCount();
+      return {
+        message: [
+          `\u{1F4CB} Auto Review \u2014 ${cfg.enabled ? "\u2705 enabled" : "\u23F8\uFE0F  disabled"}`,
+          "",
+          `  Provider:       ${cfg.provider}`,
+          `  Model:          ${cfg.model}`,
+          `  Fallback / RR:  ${cfg.fallbackModels.length > 0 ? cfg.fallbackModels.join(", ") : "(none)"}`,
+          `  Selection:      ${cfg.modelSelection}`,
+          `  Debounce:       ${cfg.debounceMs} ms`,
+          `  Max files:      ${cfg.maxFilesPerBatch}`,
+          `  Max parallel:   ${cfg.maxConcurrentReviews}`,
+          `  Cascade:        ${cfg.cascadeOn === "off" ? "off" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`}`,
+          `  Max depth:      ${cfg.maxCascadeDepth} re-review cycle(s)`,
+          `  In-flight:      ${inFlight} review(s)`,
+          "",
+          "Fires on every git-tracked file change during the session.",
+          "Disabled by default. Enable via config.json."
+        ].join("\n")
+      };
+    }
+  };
+}
+function createAutoReviewPlugin() {
+  return {
+    name: "wstack-auto-review",
+    version: "1.0.0",
+    description: "Continuous auto-review that fires on every code change during a session.",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true },
+    defaultConfig: {},
+    setup(api) {
+      const recompute = () => {
+        const raw = api.config.extensions?.["wstack-auto-review"] ?? {};
+        return resolveAutoReviewConfig(raw, api.config);
+      };
+      let resolved = recompute();
+      const inFlight = [];
+      const expireInFlight = (entry) => {
+        const timer = setTimeout(
+          () => {
+            const idx = inFlight.indexOf(entry);
+            if (idx !== -1) inFlight.splice(idx, 1);
+          },
+          5 * 60 * 1e3
+        );
+        timer.unref();
+      };
+      api.onConfigChange(() => {
+        const old = resolved;
+        resolved = recompute();
+        if (old.enabled !== resolved.enabled || old.provider !== resolved.provider || old.model !== resolved.model) {
+          api.log.info(
+            `[auto-review] config changed \u2014 enabled=${resolved.enabled} provider=${resolved.provider} model=${resolved.model}`
+          );
+        }
+      });
+      if (!resolved.enabled) {
+        api.log.info("[auto-review] disabled by config");
+        return;
+      }
+      api.log.info(
+        `[auto-review] loaded \u2014 provider=${resolved.provider} model=${resolved.model} debounce=${resolved.debounceMs}ms cascade=${resolved.cascadeOn}`
+      );
+      const knownFingerprints = /* @__PURE__ */ new Map();
+      const pendingFiles = /* @__PURE__ */ new Map();
+      let reviewCounter = 0;
+      let pendingReviewTimer;
+      let pendingReviewWork;
+      let sessionEnded = false;
+      let latestIterationPayload;
+      const rememberKnownFingerprint = (filePath, fingerprint2) => {
+        if (knownFingerprints.has(filePath)) knownFingerprints.delete(filePath);
+        knownFingerprints.set(filePath, fingerprint2);
+        trimKnownFingerprints(knownFingerprints, MAX_KNOWN_FINGERPRINTS);
+      };
+      let snapshotInFlight = false;
+      const withSnapshotLock = async (fn) => {
+        if (snapshotInFlight) {
+          api.log.info("[auto-review] snapshot pass already in flight, skipping");
+          return void 0;
+        }
+        snapshotInFlight = true;
+        try {
+          return await fn();
+        } finally {
+          snapshotInFlight = false;
+        }
+      };
+      api.onEvent("agent.run.started", async () => {
+        try {
+          const cwd = api.config.cwd ?? process.cwd();
+          if (!await isGitRepo(cwd)) return;
+          const snapshots = await withSnapshotLock(() => snapshotChangedFiles(cwd));
+          if (!snapshots) return;
+          for (const file of snapshots) {
+            rememberKnownFingerprint(file.path, file.fingerprint);
+          }
+          api.log.info(`[auto-review] seeded ${knownFingerprints.size} known file snapshot(s)`);
+        } catch {
+        }
+      });
+      api.slashCommands.register(
+        buildAutoReviewCommand(
+          () => resolved,
+          () => inFlight.length
+        )
+      );
+      const cancelPendingReviewTimer = () => {
+        if (!pendingReviewTimer) return;
+        clearTimeout(pendingReviewTimer);
+        pendingReviewTimer = void 0;
+      };
+      let handleIterationCompleted;
+      const schedulePendingReview = (delayMs) => {
+        cancelPendingReviewTimer();
+        if (sessionEnded || pendingFiles.size === 0) return;
+        const timer = setTimeout(
+          async () => {
+            if (pendingReviewTimer === timer) pendingReviewTimer = void 0;
+            if (sessionEnded) return;
+            const work = handleIterationCompleted?.(latestIterationPayload, true);
+            if (!work) return;
+            pendingReviewWork = work;
+            try {
+              await work;
+            } finally {
+              if (pendingReviewWork === work) pendingReviewWork = void 0;
+            }
+          },
+          Math.max(0, delayMs)
+        );
+        pendingReviewTimer = timer;
+        timer.unref();
+      };
+      const refreshPendingFiles = (snapshots) => {
+        let pendingChanged = false;
+        const observedPaths = /* @__PURE__ */ new Set();
+        for (const file of snapshots) {
+          if (file.path.startsWith(".wrongstack/")) continue;
+          observedPaths.add(file.path);
+          if (knownFingerprints.get(file.path) !== file.fingerprint) {
+            if (pendingFiles.get(file.path)?.fingerprint !== file.fingerprint) {
+              pendingChanged = true;
+            }
+            pendingFiles.set(file.path, file);
+          } else if (pendingFiles.delete(file.path)) {
+            pendingChanged = true;
+          }
+        }
+        for (const pendingPath of pendingFiles.keys()) {
+          if (!observedPaths.has(pendingPath)) {
+            pendingFiles.delete(pendingPath);
+            pendingChanged = true;
+          }
+        }
+        return pendingChanged;
+      };
+      handleIterationCompleted = async (payload, fromQuietTimer = false) => {
+        try {
+          const cfg = resolved;
+          if (!cfg.enabled || sessionEnded) return;
+          if (payload) latestIterationPayload = payload;
+          const cwd = api.config.cwd ?? process.cwd();
+          if (!await isGitRepo(cwd)) return;
+          const ctxTodos = payload?.ctx?.todos;
+          const snapshots = await withSnapshotLock(() => snapshotChangedFiles(cwd));
+          if (!snapshots) {
+            if (fromQuietTimer) schedulePendingReview(cfg.debounceMs);
+            return;
+          }
+          if (sessionEnded) return;
+          const now = Date.now();
+          const pendingChanged = refreshPendingFiles(snapshots);
+          if (pendingFiles.size === 0) {
+            cancelPendingReviewTimer();
+            return;
+          }
+          if (cfg.debounceMs > 0) {
+            if (!fromQuietTimer) {
+              if (pendingChanged || !pendingReviewTimer) {
+                schedulePendingReview(cfg.debounceMs);
+                api.log.info(
+                  `[auto-review] waiting ${cfg.debounceMs}ms for ${pendingFiles.size} pending file(s) to settle`
+                );
+              }
+              return;
+            }
+            if (pendingChanged) {
+              schedulePendingReview(cfg.debounceMs);
+              api.log.info(
+                `[auto-review] file activity continued, restarting ${cfg.debounceMs}ms quiet window for ${pendingFiles.size} pending file(s)`
+              );
+              return;
+            }
+          }
+          if (inFlight.length >= cfg.maxConcurrentReviews) {
+            api.log.info(
+              `[auto-review] at max concurrent (${cfg.maxConcurrentReviews}), retaining ${pendingFiles.size} pending file(s)`
+            );
+            return;
+          }
+          const toReview = [...pendingFiles.values()].slice(0, cfg.maxFilesPerBatch);
+          if (toReview.length === 0) return;
+          const filesWithContent = toReview.map((file) => ({
+            path: file.path,
+            status: file.status,
+            content: file.content
+          }));
+          reviewCounter++;
+          const bundle = await buildReviewContext({
+            cwd,
+            config: {
+              enabled: true,
+              provider: cfg.provider,
+              model: cfg.model,
+              maxFiles: cfg.maxFilesPerBatch,
+              autoFix: "off",
+              cascadeOn: "off",
+              maxCascadeDepth: 0,
+              fallbackModels: [...cfg.fallbackModels],
+              fallbackProfile: void 0
+            },
+            files: filesWithContent,
+            activeTodos: ctxTodos,
+            cascadeOn: cfg.cascadeOn,
+            maxCascadeDepth: cfg.maxCascadeDepth
+          });
+          bundle.reviewFallbackModels = [...cfg.fallbackModels];
+          bundle.reviewModelSelection = cfg.modelSelection;
+          const trackedChangedPaths = new Set(
+            snapshots.filter((file) => !file.path.startsWith(".wrongstack/")).map((file) => file.path)
+          );
+          bundle.allChangedFiles = bundle.allChangedFiles?.filter(
+            (file) => trackedChangedPaths.has(file.path)
+          );
+          if (sessionEnded) return;
+          api.log.info(
+            `[auto-review] #${reviewCounter} emitting review_needed (${filesWithContent.length} files, provider=${cfg.provider} model=${cfg.model})`
+          );
+          const emittedBundle = await emitReviewIfChanged(api, bundle);
+          if (!emittedBundle) {
+            api.log.info(
+              `[auto-review] #${reviewCounter} skipped \u2014 file content already has a review in progress`
+            );
+            return;
+          }
+          const emittedPaths = new Set(emittedBundle.files.map((file) => file.path));
+          const inflightEntry = {
+            files: [...emittedPaths],
+            startedAt: now,
+            subagentType: "review"
+          };
+          inFlight.push(inflightEntry);
+          for (const file of toReview) {
+            if (!emittedPaths.has(file.path)) continue;
+            rememberKnownFingerprint(file.path, file.fingerprint);
+            pendingFiles.delete(file.path);
+          }
+          api.log.info(
+            `[auto-review] #${reviewCounter} event emitted \u2014 ${emittedBundle.files.length}/${filesWithContent.length} files; requires Director (--director) for subagent spawning`
+          );
+          expireInFlight(inflightEntry);
+          if (pendingFiles.size > 0 && cfg.debounceMs > 0) {
+            schedulePendingReview(cfg.debounceMs);
+          }
+        } catch (err) {
+          api.log.warn(`[auto-review] iteration.completed handler failed: ${toErrorMessage(err)}`);
+        }
+      };
+      api.onEvent("iteration.completed", async (payload) => {
+        await handleIterationCompleted?.(payload);
+      });
+      api.onEvent("session.ended", (event) => {
+        const work = (async () => {
+          sessionEnded = true;
+          const handedOffFiles = pendingFiles.size;
+          cancelPendingReviewTimer();
+          if (handedOffFiles > 0) {
+            api.log.info(
+              `[auto-review] session ended \u2014 handed ${handedOffFiles} pending mid-session file(s) to post-session review`
+            );
+          }
+          await pendingReviewWork;
+          try {
+            const cfg = resolved;
+            if (!cfg.enabled) return;
+            const cwd = api.config.cwd ?? process.cwd();
+            if (!await isGitRepo(cwd)) return;
+            const allChanged = await getChangedFiles(cwd);
+            const existing = [];
+            for (const f of allChanged) {
+              if (f.path.startsWith(".wrongstack/")) continue;
+              try {
+                await fsp3.access(path3.join(cwd, f.path));
+                existing.push(f);
+              } catch {
+              }
+            }
+            if (existing.length === 0) return;
+            const toReview = existing.slice(0, cfg.maxFilesPerBatch);
+            const filesWithContent = [];
+            for (const f of toReview) {
+              try {
+                const absPath = path3.join(cwd, f.path);
+                const content = await fsp3.readFile(absPath, "utf8");
+                filesWithContent.push({ path: f.path, status: f.status, content });
+              } catch {
+              }
+            }
+            if (filesWithContent.length === 0) return;
+            if (inFlight.length >= cfg.maxConcurrentReviews) {
+              api.log.info(
+                `[auto-review] session end \u2014 at max concurrent (${cfg.maxConcurrentReviews}), skipping final review`
+              );
+              return;
+            }
+            const bundle = await buildReviewContext({
+              cwd,
+              config: {
+                enabled: true,
+                provider: cfg.provider,
+                model: cfg.model,
+                maxFiles: cfg.maxFilesPerBatch,
+                autoFix: "off",
+                cascadeOn: "off",
+                maxCascadeDepth: 0,
+                fallbackModels: [...cfg.fallbackModels],
+                fallbackProfile: void 0
+              },
+              files: filesWithContent,
+              cascadeOn: cfg.cascadeOn,
+              maxCascadeDepth: cfg.maxCascadeDepth
+            });
+            bundle.reviewFallbackModels = [...cfg.fallbackModels];
+            bundle.reviewModelSelection = cfg.modelSelection;
+            const trackedChangedPaths = new Set(existing.map((file) => file.path));
+            bundle.allChangedFiles = bundle.allChangedFiles?.filter(
+              (file) => trackedChangedPaths.has(file.path)
+            );
+            const emittedBundle = await emitReviewIfChanged(api, bundle);
+            if (!emittedBundle) {
+              api.log.info(
+                "[auto-review] session end \u2014 unchanged files already have reviews in progress"
+              );
+              return;
+            }
+            const inflightEntry = {
+              files: emittedBundle.files.map((file) => file.path),
+              startedAt: Date.now(),
+              subagentType: "review"
+            };
+            inFlight.push(inflightEntry);
+            expireInFlight(inflightEntry);
+            api.log.info(
+              `[auto-review] session end \u2014 final review (${emittedBundle.files.length} files)`
+            );
+          } catch (err) {
+            api.log.warn(`[auto-review] session.ended handler failed: ${toErrorMessage(err)}`);
+          }
+        })();
+        event?.waitUntil?.(work);
+        return work;
+      });
+      api.onPattern("chimera.review_complete", (_event, payload) => {
+        try {
+          const p = payload;
+          if (!p.reviewText) return;
+          const cascadeOn = p.bundle.cascadeOn ?? "off";
+          if (cascadeOn === "off") return;
+          const parsed = p.parsedReport;
+          const verifiedFindings = parsed?.findings.filter((f) => f.verification?.status === "verified") ?? [];
+          const severities = parsed ? severitiesFromFindings(verifiedFindings) : parseReviewSeverity(p.reviewText);
+          const threshold = shouldCascade(cascadeOn, severities);
+          if (!threshold) return;
+          const agents = decideCascadeAgents(
+            p.reviewText,
+            severities,
+            parsed ? verifiedFindings : void 0
+          );
+          if (agents.length === 0) return;
+          const cascadePayload = {
+            bundle: p.bundle,
+            ...p.reportId ? { reportId: p.reportId } : {},
+            reviewText: p.reviewText,
+            severities,
+            threshold,
+            agents,
+            ...parsed ? { verifiedFindings } : {}
+          };
+          api.emitCustom("chimera.cascade_needed", cascadePayload);
+          api.log.info(
+            `[auto-review] cascade_needed emitted \u2014 ${severities.critical} critical, ${severities.high} high, ${severities.medium} medium; agents: ${agents.join(", ")}${parsed ? ` (gated on ${verifiedFindings.length} verified finding(s))` : ""}`
+          );
+        } catch (err) {
+          api.log.warn(
+            `[auto-review] review_complete cascade handler failed: ${toErrorMessage(err)}`
+          );
+        }
+      });
+    },
+    teardown(api) {
+      api.slashCommands.unregister("auto-review");
+      api.log.info("[auto-review] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "auto-review ready" };
+    }
+  };
+}
+
+// src/plugins/review-finding-commands.ts
+async function executeFindingCommand(args, ctx) {
+  if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+    return helpText();
+  }
+  const subcommand = args[0];
+  if (subcommand === "findings" || subcommand === "list") {
+    return listFindings(args.slice(1), ctx);
+  }
+  if (subcommand === "finding") {
+    const id = args[1];
+    if (!id) return "Usage: /review finding <id> [resolve|ignore|reopen|triage|start]";
+    const action = args[2];
+    if (action === "resolve" || action === "ignore" || action === "reopen" || action === "triage" || action === "start") {
+      return transitionFinding(id, action, args.slice(3), ctx);
+    }
+    return showFinding(id, ctx);
+  }
+  if (subcommand === "reports") {
+    return listReports(args.slice(1), ctx);
+  }
+  if (subcommand === "report") {
+    const id = args[1];
+    if (!id) return "Usage: /review report <id> [complete|skip|action|note]";
+    const action = args[2];
+    if (action === "complete" || action === "skip" || action === "action") {
+      return transitionReport(id, action, args.slice(3), ctx);
+    }
+    if (action === "note") {
+      return addReportNote(id, args.slice(3), ctx);
+    }
+    return showReport(id, ctx);
+  }
+  if (subcommand === "status") {
+    return showStatus(ctx);
+  }
+  return `Unknown subcommand: ${subcommand}. Use /review findings --help for usage.`;
+}
+function helpText() {
+  return [
+    "## /review \u2014 Chimera Review Store",
+    "",
+    "| Command | Description |",
+    "|---|---|",
+    "| `/review findings` | List all active findings grouped by severity |",
+    "| `/review findings --status <s>` | Filter by status (active, triaged, in_progress, resolved, ignored) |",
+    "| `/review findings --severity <s>` | Filter by severity (critical, high, medium, low) |",
+    "| `/review findings --limit <n>` | Max results (default 20) |",
+    "| `/review finding <id>` | Show a single finding with full lifecycle |",
+    '| `/review finding <id> resolve --outcome <fixed|wontfix|duplicate|false_positive|stale> [--reason "..."]` | Mark a finding resolved |',
+    '| `/review finding <id> ignore [--reason "..."]` | Ignore a finding (wontfix) |',
+    '| `/review finding <id> reopen [--reason "..."]` | Reopen a resolved/ignored finding back to active |',
+    '| `/review finding <id> triage [--reason "..."]` | Acknowledge a finding (active \u2192 triaged) |',
+    '| `/review finding <id> start [--reason "..."]` | Start work on a finding (triaged \u2192 in_progress) |',
+    "| `/review reports` | List recent review reports |",
+    "| `/review reports --status <s>` | Filter reports by lifecycle (open, actioned, completed, skipped) |",
+    "| `/review report <id>` | Show a report with raw text, counts, and lifecycle events |",
+    '| `/review report <id> complete [--reason "..."]` | Mark a report completed |',
+    '| `/review report <id> skip [--reason "..."]` | Skip a report (wontfix) |',
+    '| `/review report <id> action [--reason "..."]` | Mark a report as being actioned |',
+    "| `/review report <id> note <message>` | Add an annotation without changing lifecycle |",
+    "| `/review status` | Show store statistics |",
+    "",
+    "Findings: `~/.wrongstack/projects/<slug>/review-findings.jsonl`",
+    "Reports: `~/.wrongstack/projects/<slug>/review-reports.jsonl`"
+  ].join("\n");
+}
+async function loadStore(ctx) {
+  const { JsonlFindingStore } = await import("./plugins/review-finding-store.js");
+  const store = new JsonlFindingStore(ctx.projectDir);
+  return store;
+}
+async function listFindings(args, ctx) {
+  let severityFilter;
+  let statusFilter;
+  let limit = 20;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--severity" && i + 1 < args.length) {
+      severityFilter = args[++i];
+    } else if (args[i] === "--status" && i + 1 < args.length) {
+      statusFilter = args[++i];
+    } else if (args[i] === "--limit" && i + 1 < args.length) {
+      limit = Number.parseInt(args[++i], 10) || 20;
+    }
+  }
+  const store = await loadStore(ctx);
+  const all = await store.list({
+    ...severityFilter ? { severities: [severityFilter] } : {},
+    ...statusFilter ? { statuses: [statusFilter] } : {},
+    limit
+  });
+  if (all.length === 0) {
+    const filters = [severityFilter && `severity=${severityFilter}`, statusFilter && `status=${statusFilter}`].filter(Boolean).join(", ");
+    return `No findings found${filters ? ` (${filters})` : ""}.`;
+  }
+  const lines = [
+    "| Severity | Status | File | Title |",
+    "|---|---|---|---|"
+  ];
+  for (const f of all) {
+    const location = f.location?.file ?? "unknown";
+    const file = location.substring(location.lastIndexOf("/") + 1).substring(location.lastIndexOf("\\") + 1) || location;
+    const severityEmoji = f.severity === "critical" ? "\u{1F534}" : f.severity === "high" ? "\u{1F7E0}" : f.severity === "medium" ? "\u{1F7E1}" : "\u26AA";
+    const title = f.title.length > 60 ? f.title.substring(0, 57) + "..." : f.title;
+    lines.push(`| ${severityEmoji} ${f.severity} | ${f.status} | \`${file}\` | ${title} |`);
+  }
+  lines.push("", `_${all.length} finding(s) shown. Use \`/review finding <id>\` for details._`);
+  return lines.join("\n");
+}
+async function showFinding(id, ctx) {
+  const store = await loadStore(ctx);
+  const finding = await store.get(id);
+  if (!finding) return `Finding not found: ${id}`;
+  const lines = [
+    `## ${finding.severity.toUpperCase()}: ${finding.title}`,
+    "",
+    `**ID:** \`${finding.id}\``,
+    `**File:** \`${finding.location?.file ?? "unknown"}\`${finding.location?.line ? `:${finding.location.line}` : ""}`,
+    `**Severity:** ${finding.severity}`,
+    `**Status:** ${finding.status}`,
+    `**Source:** ${finding.source}`,
+    `**Created:** ${finding.createdAt}`,
+    "",
+    finding.description
+  ];
+  if (finding.suggestedFix) {
+    lines.push("", "**Suggested fix:**", finding.suggestedFix);
+  }
+  const events = await store.getEvents(id);
+  if (events.length > 0) {
+    lines.push("", "**Lifecycle:**", "");
+    for (const ev of events) {
+      const eventLine = `- \`${ev.timestamp}\` ${ev.fromStatus ?? "none"} \u2192 ${ev.toStatus} (${ev.eventType}) by ${ev.actorId}`;
+      lines.push(eventLine);
+      if (ev.reason) lines.push(`  _${ev.reason}_`);
+    }
+  }
+  lines.push("", `_Fingerprint: \`${finding.fingerprint.substring(0, 16)}\u2026\`_`);
+  return lines.join("\n");
+}
+var VALID_RESOLUTION_OUTCOMES = ["fixed", "wontfix", "duplicate", "false_positive", "stale"];
+async function transitionFinding(id, action, extraArgs, ctx) {
+  let reason;
+  let outcome;
+  for (let i = 0; i < extraArgs.length; i++) {
+    if (extraArgs[i] === "--reason" && i + 1 < extraArgs.length) {
+      reason = extraArgs[++i];
+    } else if (extraArgs[i] === "--outcome" && i + 1 < extraArgs.length) {
+      outcome = extraArgs[++i];
+    }
+  }
+  const store = await loadStore(ctx);
+  const finding = await store.get(id);
+  if (!finding) return `Finding not found: ${id}`;
+  const cleanReason = reason && reason.trim().length > 0 ? reason : void 0;
+  const cleanOutcome = outcome && outcome.trim().length > 0 ? outcome : void 0;
+  if (action === "reopen") {
+    if (cleanOutcome) {
+      return `\u26A0\uFE0F \`--outcome\` only applies to \`resolve\`. Usage: \`/review finding ${id} reopen --reason "..."\``;
+    }
+    try {
+      await store.transition(finding.id, "active", { id: "operator", kind: "operator" }, {
+        ...cleanReason !== void 0 ? { reason: cleanReason } : {}
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return `Could not reopen finding ${id}: ${msg}`;
+    }
+    const lines2 = [
+      `\u2705 Finding \`${id}\` reopened as **active**.`
+    ];
+    const reportId2 = finding.originReport?.reportId;
+    if (reportId2) {
+      try {
+        const reopenResult = await syncReportReopen(reportId2, ctx.projectDir, {
+          id: "operator",
+          kind: "operator"
+        }, cleanReason);
+        if (reopenResult.reopened) {
+          lines2.push("", `\u{1F535} Report \`${reportId2}\` auto-reopened \u2014 was ${reopenResult.previousLifecycle}.`);
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(JSON.stringify({ level: "warn", event: "review_auto_reopen_failed", reportId: reportId2, message: msg }));
+      }
+    }
+    return lines2.join("\n");
+  }
+  if (action === "triage") {
+    if (cleanOutcome) {
+      return `\u26A0\uFE0F \`--outcome\` only applies to \`resolve\`. Usage: \`/review finding ${id} triage --reason "..."\``;
+    }
+    try {
+      await store.transition(finding.id, "triaged", { id: "operator", kind: "operator" }, {
+        ...cleanReason !== void 0 ? { reason: cleanReason } : {}
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return `Could not triage finding ${id}: ${msg}`;
+    }
+    return `\u2705 Finding \`${id}\` marked as **triaged**.`;
+  }
+  if (action === "start") {
+    if (cleanOutcome) {
+      return `\u26A0\uFE0F \`--outcome\` only applies to \`resolve\`. Usage: \`/review finding ${id} start --reason "..."\``;
+    }
+    try {
+      await store.transition(finding.id, "in_progress", { id: "operator", kind: "operator" }, {
+        ...cleanReason !== void 0 ? { reason: cleanReason } : {}
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return `Could not start finding ${id}: ${msg}`;
+    }
+    return `\u2705 Finding \`${id}\` marked as **in_progress**.`;
+  }
+  const targetStatus = action === "resolve" ? "resolved" : "ignored";
+  if (action === "ignore" && cleanOutcome) {
+    return `\u26A0\uFE0F \`--outcome\` only applies to \`resolve\`. Usage: \`/review finding ${id} ignore --reason "..."\``;
+  }
+  if (action === "resolve" && cleanOutcome && !VALID_RESOLUTION_OUTCOMES.includes(cleanOutcome)) {
+    return `Invalid outcome "${cleanOutcome}". Valid values: ${VALID_RESOLUTION_OUTCOMES.join(", ")}`;
+  }
+  const resolvedOutcome = action === "resolve" ? cleanOutcome ?? "fixed" : void 0;
+  try {
+    await store.transition(finding.id, targetStatus, { id: "operator", kind: "operator" }, {
+      ...cleanReason !== void 0 ? { reason: cleanReason } : {},
+      ...resolvedOutcome ? { outcome: resolvedOutcome } : {}
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `Could not transition finding ${id} to ${targetStatus}: ${msg}`;
+  }
+  const lines = [
+    `\u2705 Finding \`${id}\` marked as **${targetStatus}**.`
+  ];
+  const reportId = finding.originReport?.reportId;
+  if (reportId) {
+    try {
+      const syncResult = await syncReportCompletion(reportId, ctx.projectDir, {
+        id: "operator",
+        kind: "operator"
+      });
+      if (syncResult.completed) {
+        lines.push("", `\u{1F7E2} Report \`${reportId}\` auto-completed \u2014 all ${syncResult.totalFindings} finding(s) resolved or ignored.`);
+      } else if (syncResult.totalFindings > 0 && syncResult.remaining > 0) {
+        lines.push(`_Report \`${reportId}\`: ${syncResult.remaining} of ${syncResult.totalFindings} finding(s) still open._`);
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(JSON.stringify({ level: "warn", event: "review_auto_completion_failed", reportId, message: msg }));
+    }
+  }
+  return lines.join("\n");
+}
+async function loadReportStore(ctx) {
+  const { JsonlReportStore } = await import("./plugins/review-report-store.js");
+  return new JsonlReportStore(ctx.projectDir);
+}
+var LIFECYCLE_EMOJI = {
+  open: "\u{1F535}",
+  actioned: "\u{1F7E1}",
+  completed: "\u{1F7E2}",
+  skipped: "\u26AA"
+};
+async function listReports(args, ctx) {
+  let statusFilter;
+  let limit = 15;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--status" && i + 1 < args.length) {
+      statusFilter = args[++i];
+    } else if (args[i] === "--limit" && i + 1 < args.length) {
+      limit = Number.parseInt(args[++i], 10) || 15;
+    }
+  }
+  const store = await loadReportStore(ctx);
+  const reports = await store.list({
+    ...statusFilter ? { statuses: [statusFilter] } : {},
+    limit
+  });
+  if (reports.length === 0) {
+    return `No reports found${statusFilter ? ` (status=${statusFilter})` : ""}.`;
+  }
+  const lines = [
+    "| Lifecycle | Source | Findings | Reviewed | Report |",
+    "|---|---|---|---|---|"
+  ];
+  for (const r of reports) {
+    const emoji = LIFECYCLE_EMOJI[r.lifecycle] ?? "\u26AA";
+    const total = r.counts.critical + r.counts.high + r.counts.medium + r.counts.low;
+    const sevSummary = total === 0 ? "clean" : [
+      r.counts.critical > 0 && `${r.counts.critical}\u{1F534}`,
+      r.counts.high > 0 && `${r.counts.high}\u{1F7E0}`,
+      r.counts.medium > 0 && `${r.counts.medium}\u{1F7E1}`,
+      r.counts.low > 0 && `${r.counts.low}\u26AA`
+    ].filter(Boolean).join(" ");
+    const date = r.reviewedAt.substring(0, 10);
+    const id = r.id.substring(0, 8);
+    lines.push(`| ${emoji} ${r.lifecycle} | ${r.source} | ${sevSummary} | ${date} | \`${id}\` |`);
+  }
+  lines.push("", `_${reports.length} report(s). Use \`/review report <id>\` for details._`);
+  return lines.join("\n");
+}
+async function resolveReportId(store, id) {
+  const report = await store.get(id);
+  if (report) return report;
+  if (id.length >= 8) {
+    const all = await store.list({ limit: 9999 });
+    const match = all.find((r) => r.id.startsWith(id));
+    if (match) return match;
+  }
+  return null;
+}
+async function showReport(id, ctx) {
+  const store = await loadReportStore(ctx);
+  const report = await resolveReportId(store, id);
+  if (!report) return `Report not found: ${id}`;
+  const emoji = LIFECYCLE_EMOJI[report.lifecycle] ?? "\u26AA";
+  const lines = [
+    `## ${emoji} Review Report \u2014 ${report.lifecycle}`,
+    "",
+    `**ID:** \`${report.id}\``,
+    `**Reviewed:** ${report.reviewedAt}`,
+    `**Source:** ${report.source}`,
+    `**Reviewer model:** ${report.reviewerModel}`,
+    `**Review status:** ${report.reviewStatus}`,
+    ...report.cascadeDepth !== void 0 ? [`**Cascade depth:** ${report.cascadeDepth}`] : [],
+    ...report.durationSeconds !== void 0 ? [`**Duration:** ${report.durationSeconds}s`] : [],
+    ...report.evidenceStatus !== void 0 ? [
+      `**Evidence:** ${report.evidenceStatus === "verified" ? "\u2705 verified" : report.evidenceStatus === "failed" ? "\u274C failed" : "\u26A0\uFE0F missing"}`,
+      ...report.evidenceChecks && report.evidenceChecks.length > 0 ? [
+        "",
+        ...report.evidenceChecks.map((check) => {
+          const mark = check.ok ? "\u2713" : "\u2717";
+          const claimed = check.claimedExitCode ?? "\u2014";
+          const actual = check.actualExitCode ?? "\u2014";
+          return `  ${mark} \`${check.name}\` \u2014 \`${check.command}\` (claimed ${claimed}, observed ${actual})`;
+        })
+      ] : []
+    ] : [],
+    "",
+    "**Severity counts:**",
+    `  \u{1F534} Critical: ${report.counts.critical}`,
+    `  \u{1F7E0} High: ${report.counts.high}`,
+    `  \u{1F7E1} Medium: ${report.counts.medium}`,
+    `  \u26AA Low: ${report.counts.low}`,
+    `  **Total findings:** ${report.totalFindings}`,
+    ...report.unparseableCount > 0 ? [`  _${report.unparseableCount} unparseable_`] : []
+  ];
+  if (report.files.length > 0) {
+    lines.push("", "**Files reviewed:**");
+    for (const f of report.files.slice(0, 20)) {
+      lines.push(`  - \`${f.path}\` (${f.status})`);
+    }
+    if (report.files.length > 20) {
+      lines.push(`  _...and ${report.files.length - 20} more_`);
+    }
+  }
+  const events = await store.getEvents(report.id);
+  if (events.length > 0) {
+    lines.push("", "**Lifecycle events:**", "");
+    for (const ev of events) {
+      const transition = ev.fromLifecycle ? `${ev.fromLifecycle} \u2192 ${ev.toLifecycle}` : `\u2192 ${ev.toLifecycle}`;
+      lines.push(`- \`${ev.timestamp}\` ${transition} (${ev.eventType}) by ${ev.actorId}`);
+      if (ev.reason) lines.push(`  _${ev.reason}_`);
+    }
+  }
+  if (report.rawText?.trim()) {
+    lines.push("", "<details><summary>Raw report text</summary>", "", report.rawText, "", "</details>");
+  }
+  return lines.join("\n");
+}
+async function transitionReport(id, action, extraArgs, ctx) {
+  let reason;
+  for (let i = 0; i < extraArgs.length; i++) {
+    if (extraArgs[i] === "--reason" && i + 1 < extraArgs.length) {
+      reason = extraArgs[++i];
+    }
+  }
+  const cleanReason = reason && reason.trim().length > 0 ? reason : void 0;
+  const targetMap = { complete: "completed", skip: "skipped", action: "actioned" };
+  const targetStatus = targetMap[action];
+  const store = await loadReportStore(ctx);
+  const report = await resolveReportId(store, id);
+  if (!report) return `Report not found: ${id}`;
+  try {
+    await store.transition(report.id, targetStatus, { id: "operator", kind: "operator" }, {
+      ...cleanReason !== void 0 ? { reason: cleanReason } : {}
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `Could not transition report \`${report.id}\` to ${targetStatus}: ${msg}`;
+  }
+  const emoji = LIFECYCLE_EMOJI[targetStatus] ?? "\u26AA";
+  return `${emoji} Report \`${report.id}\` marked as **${targetStatus}**.`;
+}
+async function addReportNote(id, extraArgs, ctx) {
+  const note = extraArgs.join(" ").trim();
+  if (!note) {
+    return "Usage: /review report <id> note <message>";
+  }
+  const store = await loadReportStore(ctx);
+  const report = await resolveReportId(store, id);
+  if (!report) return `Report not found: ${id}`;
+  try {
+    await store.addNote(report.id, { id: "operator", kind: "operator" }, note);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `Could not add note to report ${id}: ${msg}`;
+  }
+  return `\u{1F4DD} Note added to report \`${report.id}\`.`;
+}
+async function showStatus(ctx) {
+  const store = await loadStore(ctx);
+  const all = await store.list({ limit: 9999 });
+  const counts = {};
+  const severityCounts = {};
+  for (const f of all) {
+    counts[f.status] = (counts[f.status] || 0) + 1;
+    severityCounts[f.severity] = (severityCounts[f.severity] || 0) + 1;
+  }
+  return [
+    "## Finding Store Status",
+    "",
+    `**Total findings:** ${all.length}`,
+    "",
+    "**By status:**",
+    ...Object.entries(counts).map(([k, v]) => `  - ${k}: ${v}`),
+    "",
+    "**By severity:**",
+    ...Object.entries(severityCounts).map(([k, v]) => `  - ${k}: ${v}`),
+    "",
+    `_Page size: ${FINDING_DEFAULT_PAGE_SIZE}_`
+  ].join("\n");
+}
+
+// src/plugins/chimera-plugin.ts
+import { spawn as spawn3 } from "node:child_process";
+import * as fsp4 from "node:fs/promises";
+import * as os from "node:os";
+import * as path4 from "node:path";
+var DEFAULT_MAX_FILES = 15;
+var DEFAULT_CASCADE_ON = "off";
+var DEFAULT_MAX_CASCADE_DEPTH2 = 2;
+function resolveChimeraConfig(cfg, sessionProvider, sessionModel) {
+  return {
+    enabled: cfg.enabled !== false,
+    provider: cfg.provider ?? sessionProvider,
+    model: cfg.model ?? sessionModel,
+    maxFiles: cfg.maxFiles ?? DEFAULT_MAX_FILES,
+    autoFix: cfg.autoFix ?? "off",
+    cascadeOn: cfg.cascadeOn ?? DEFAULT_CASCADE_ON,
+    maxCascadeDepth: cfg.maxCascadeDepth ?? DEFAULT_MAX_CASCADE_DEPTH2,
+    fallbackModels: cfg.fallbackModels ? [...cfg.fallbackModels] : [],
+    fallbackProfile: cfg.fallbackProfile
+  };
+}
+var CHIMERA_REVIEW_PROMPT = readBundledInstructionText("llm/chimera-review.md");
+async function runGit3(args, cwd) {
+  return new Promise((resolve3, reject) => {
+    let child;
+    try {
+      child = spawn3("git", args, {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        signal: AbortSignal.timeout(15e3),
+        windowsHide: true
+      });
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => {
+      stdout += d;
+    });
+    child.stderr?.on("data", (d) => {
+      stderr += d;
+    });
+    child.on("error", () => resolve3({ stdout, stderr, code: 1 }));
+    child.on("close", (code) => resolve3({ stdout, stderr, code: code ?? 0 }));
+  });
+}
+async function isGitRepo2(cwd) {
+  const r = await runGit3(["rev-parse", "--git-dir"], cwd);
+  return r.code === 0;
+}
+async function getChangedFiles2(cwd) {
+  const r = await runGit3(["status", "--porcelain"], cwd);
+  if (r.code !== 0) return [];
+  const files = [];
+  for (const line of r.stdout.split("\n")) {
+    if (!line.trim()) continue;
+    const statusCode = line.slice(0, 2).trim();
+    const filePath = line.slice(3).trim();
+    if (statusCode === "A" || statusCode === "A " || statusCode === " A" || statusCode === "??") {
+      files.push({ path: filePath, status: "added" });
+    } else if (statusCode.includes("M")) {
+      files.push({ path: filePath, status: "modified" });
+    }
+  }
+  return files;
+}
+function buildChimeraCommand(getConfig, events) {
+  return {
+    name: "chimera",
+    category: "Session",
+    description: "Show Chimera post-session review agent status and configuration.",
+    help: [
+      "\u2554\u2550\u2550\u2550 Chimera \u2550\u2550\u2550\u2557",
+      "",
+      "Post-session code quality guardian. Reviews files changed during",
+      "each session using a dedicated read-only subagent.",
+      "",
+      "Commands:",
+      "  /chimera          Show current status",
+      "  /review           Manually review changed files now",
+      "",
+      "Configuration (edit config.json):",
+      "  extensions.wstack-chimera.enabled    true | false",
+      "  extensions.wstack-chimera.provider   provider id",
+      "  extensions.wstack-chimera.model      model id",
+      "  extensions.wstack-chimera.maxFiles   max files (default 15)",
+      "  extensions.wstack-chimera.autoFix    off | ask | auto (default off)",
+      "  extensions.wstack-chimera.cascadeOn  off | critical | high (default off)",
+      "  extensions.wstack-chimera.maxCascadeDepth  max fix+re-review cycles (default 2)",
+      "",
+      "Output cap: the subagent runs up to the provider's model-native",
+      "output ceiling (Anthropic 64K, OpenAI 16K, Gemini 8K). No manual cap."
+    ].join("\n"),
+    async run(args) {
+      const cfg = getConfig();
+      const trimmed = (args ?? "").trim();
+      if (trimmed.startsWith("autoFix") || trimmed.startsWith("autofix")) {
+        const mode = trimmed.split(/\s+/)[1]?.toLowerCase();
+        if (!mode || !["off", "ask", "auto"].includes(mode)) {
+          return {
+            message: [
+              `Usage: /chimera autoFix <off|ask|auto>`,
+              `Current: ${cfg.autoFix}`,
+              "",
+              "  off  \u2014 send review result to mailbox; leader waits for your command.",
+              "  ask  \u2014 send review as an ask; leader prompts you for permission.",
+              "  auto \u2014 send review result AND spawn a fix subagent automatically."
+            ].join("\n")
+          };
+        }
+        events.emit(
+          "chimera.set_autofix",
+          { mode }
+        );
+        return {
+          message: `\u2705 Chimera autoFix set to "${mode}" for this session (config file unchanged).`
+        };
+      }
+      return {
+        message: [
+          `\u{1F982} Chimera \u2014 ${cfg.enabled ? "enabled" : "disabled"}`,
+          "",
+          `  Provider:   ${cfg.provider}`,
+          `  Model:      ${cfg.model}`,
+          `  Max files:  ${cfg.maxFiles}`,
+          `  Auto-fix:   ${cfg.autoFix}`,
+          `  Cascade:    ${cfg.cascadeOn === "off" ? "disabled" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`}`,
+          `  Max depth:  ${cfg.maxCascadeDepth} re-review cycle(s)`,
+          `  Max output: model-native (no cap)`,
+          "",
+          cfg.enabled ? "Auto-review runs after each session. /review triggers manually." : "Set extensions.wstack-chimera.enabled = true to enable."
+        ].join("\n")
+      };
+    }
+  };
+}
+function buildReviewCommand(_getConfig) {
+  return {
+    name: "review",
+    category: "Session",
+    description: "Query the Chimera Finding Store.",
+    help: [
+      "Usage: /review findings [--severity <s>] [--status <s>] [--limit <n>]",
+      "       /review finding <id>",
+      "       /review status",
+      "",
+      "The finding store persists structured findings from every Chimera review.",
+      "Use this to track what issues were found, their lifecycle, and outcomes."
+    ].join("\n"),
+    async run(args) {
+      const cwd = process.cwd();
+      const slug = projectSlug(cwd);
+      const globalRoot = path4.join(os.homedir(), ".wrongstack");
+      const projectDir = path4.join(globalRoot, "projects", slug);
+      const trimmed = (args ?? "").trim();
+      const parts = trimmed.split(/\s+/).filter(Boolean);
+      return {
+        message: await executeFindingCommand(parts, { projectDir })
+      };
+    }
+  };
+}
+function createChimeraPlugin() {
+  return {
+    name: "wstack-chimera",
+    version: "1.0.0",
+    description: "Post-session code quality guardian with subagent review.",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true },
+    defaultConfig: {},
+    setup(api) {
+      const recompute = () => {
+        const raw = api.config.extensions?.["wstack-chimera"] ?? {};
+        return resolveChimeraConfig(raw, api.config.provider, api.config.model);
+      };
+      let resolved = recompute();
+      api.onConfigChange(() => {
+        const old = resolved;
+        resolved = recompute();
+        if (old.enabled !== resolved.enabled || old.provider !== resolved.provider || old.model !== resolved.model) {
+          api.log.info(
+            `[chimera] config changed \u2014 enabled=${resolved.enabled} provider=${resolved.provider} model=${resolved.model}`
+          );
+        }
+      });
+      api.onPattern("chimera.review_needed", (_event, payload) => {
+        void recordStartedReview(api.events, payload).catch(() => void 0);
+      });
+      api.onPattern("chimera.review_complete", (_event, payload) => {
+        void recordCompletedReview(api.events, payload).catch(() => void 0);
+      });
+      if (!resolved.enabled) {
+        api.log.info("[chimera] disabled by config");
+        return;
+      }
+      api.log.info(
+        `[chimera] loaded \u2014 provider=${resolved.provider} model=${resolved.model} maxFiles=${resolved.maxFiles}`
+      );
+      api.slashCommands.register(buildChimeraCommand(() => resolved, api.events));
+      api.slashCommands.register(buildReviewCommand(() => resolved));
+      api.onEvent("session.ended", (event) => {
+        const work = (async () => {
+          try {
+            const cfg = resolved;
+            if (!cfg.enabled) return;
+            const cwd = api.config.cwd ?? process.cwd();
+            if (!await isGitRepo2(cwd)) {
+              api.log.info("[chimera] skipped \u2014 not a git repo");
+              return;
+            }
+            const allChanged = await getChangedFiles2(cwd);
+            const existing = [];
+            for (const f of allChanged) {
+              if (f.path.startsWith(".wrongstack/")) continue;
+              try {
+                await fsp4.access(path4.join(cwd, f.path));
+                existing.push(f);
+              } catch {
+              }
+            }
+            if (existing.length === 0) {
+              api.log.info("[chimera] no changed files to review");
+              return;
+            }
+            const toReview = existing.slice(0, cfg.maxFiles);
+            if (existing.length > cfg.maxFiles) {
+              api.log.info(
+                `[chimera] capping review at ${cfg.maxFiles} of ${existing.length} files`
+              );
+            }
+            const filesWithContent = [];
+            for (const f of toReview) {
+              try {
+                const absPath = path4.join(cwd, f.path);
+                const content = await fsp4.readFile(absPath, "utf8");
+                filesWithContent.push({ path: f.path, status: f.status, content });
+              } catch {
+              }
+            }
+            if (filesWithContent.length === 0) {
+              api.log.info("[chimera] could not read changed files");
+              return;
+            }
+            const bundle = await buildReviewContext({
+              cwd,
+              config: cfg,
+              files: filesWithContent,
+              cascadeOn: cfg.cascadeOn,
+              maxCascadeDepth: cfg.maxCascadeDepth
+            });
+            const emittedBundle = await emitReviewIfChanged(api, bundle);
+            if (!emittedBundle) {
+              api.log.info("[chimera] skipped \u2014 changed files already have reviews in progress");
+              return;
+            }
+            api.log.info(
+              `[chimera] emitted review_needed event (${emittedBundle.files.length} files)`
+            );
+          } catch (err) {
+            api.log.warn(`[chimera] session.ended handler failed: ${toErrorMessage(err)}`);
+          }
+        })();
+        event?.waitUntil?.(work);
+        return work;
+      });
+    },
+    teardown(api) {
+      api.slashCommands.unregister("chimera");
+      api.slashCommands.unregister("review");
+      api.log.info("[chimera] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "chimera ready" };
+    }
+  };
+}
+
+// src/plugins/cloud-config-sync-plugin.ts
+import * as path5 from "node:path";
+var DEFAULT_INTERVAL_SECONDS = 300;
+var MIN_INTERVAL_SECONDS = 60;
+function createCloudConfigSyncPlugin(opts) {
+  let engine = null;
+  let timer = null;
+  let passRunning = false;
+  return {
+    name: "wstack-cloud-config-sync",
+    version: "1.0.0",
+    description: "my.wrongstack.com config synchronization (namespaced sync API v1)",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true },
+    defaultConfig: {},
+    setup(api) {
+      const rawConfig = api.config;
+      const paths = opts?.paths ?? rawConfig.paths;
+      const configStore = opts?.configStore ?? rawConfig.configStore;
+      const vault = opts?.vault ?? rawConfig.vault;
+      const appVersion = opts?.appVersion ?? rawConfig.appVersion;
+      if (!paths?.configDir || !configStore || !vault) {
+        api.log.warn(
+          "[cloud-config-sync] paths, configStore, or vault not available \u2014 /cloudsync disabled"
+        );
+        return;
+      }
+      const profileConfigPath = path5.join(paths.configDir, "config.json");
+      const statePath = path5.join(paths.configDir, "cloud-sync-state.json");
+      const warn = (msg) => api.log.warn(msg);
+      const readLocalConfig = async () => {
+        const raw = await readJsonObjectFile(profileConfigPath).catch(() => ({}));
+        return decryptConfigSecrets(raw, vault, { warn });
+      };
+      const writeLocalConfig = async (mutator) => {
+        const current = await readLocalConfig();
+        const next = mutator(current);
+        const encrypted = encryptConfigSecrets(next, vault);
+        await atomicWrite(profileConfigPath, `${JSON.stringify(encrypted, null, 2)}
+`, {
+          mode: 384
+        });
+        configStore.update({ cloudSync: next.cloudSync });
+      };
+      const getSettings = () => {
+        const cfg = configStore.get().cloudSync;
+        if (!cfg?.enabled || !cfg.url || !cfg.token) return null;
+        const token = cfg.token.startsWith("enc:") && vault.decrypt ? vault.decrypt(cfg.token) : cfg.token;
+        return { enabled: true, url: cfg.url, token };
+      };
+      engine = new CloudConfigSync({
+        statePath,
+        readLocalConfig,
+        writeLocalConfig,
+        getSettings,
+        appVersion,
+        logger: { info: (m) => api.log.info(m), warn }
+      });
+      const runPass = async () => {
+        if (!engine) return "Cloud config sync is not initialized.";
+        if (passRunning) return "A sync pass is already running.";
+        passRunning = true;
+        try {
+          const result = await engine.syncOnce();
+          return result.message;
+        } finally {
+          passRunning = false;
+        }
+      };
+      const scheduleLoop = () => {
+        if (timer) {
+          clearInterval(timer);
+          timer = null;
+        }
+        const cfg = configStore.get().cloudSync;
+        if (!cfg?.enabled) return;
+        const seconds = Math.max(
+          MIN_INTERVAL_SECONDS,
+          cfg.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS
+        );
+        timer = setInterval(() => {
+          void runPass().catch((err) => warn(`[cloud-config-sync] ${toErrorMessage(err)}`));
+        }, seconds * 1e3);
+        timer.unref?.();
+      };
+      const setCloudSyncConfig = async (patch) => {
+        await writeLocalConfig((config) => ({
+          ...config,
+          cloudSync: { ...config.cloudSync, ...patch }
+        }));
+        scheduleLoop();
+      };
+      api.slashCommands.register(
+        buildCloudSyncCommand(engine, configStore, setCloudSyncConfig, runPass)
+      );
+      scheduleLoop();
+      api.log.info("[cloud-config-sync] loaded \u2014 /cloudsync available.");
+    },
+    teardown(api) {
+      if (timer) {
+        clearInterval(timer);
+        timer = null;
+      }
+      api.slashCommands.unregister("cloudsync");
+      api.log.info("[cloud-config-sync] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "CloudConfigSync ready" };
+    }
+  };
+}
+function buildCloudSyncCommand(engine, configStore, setCloudSyncConfig, runPass) {
+  return {
+    name: "cloudsync",
+    description: "Portal config sync: /cloudsync [status|on|off|now|set url|set token]",
+    async run(args, _ctx) {
+      const [verb, ...rest] = args.trim().split(/\s+/);
+      const restJoined = rest.join(" ").trim();
+      switch (verb) {
+        case "":
+        case "status":
+          return { message: await engine.statusText() };
+        case "on": {
+          const cfg = configStore.get().cloudSync;
+          if (!cfg?.url || !cfg.token) {
+            return {
+              message: [
+                "Set the portal first:",
+                "  /cloudsync set url https://my.wrongstack.com",
+                '  /cloudsync set token wst_\u2026   (from the dashboard "Connect client" flow)'
+              ].join("\n")
+            };
+          }
+          await setCloudSyncConfig({ enabled: true });
+          const first = await runPass();
+          return { message: `Cloud config sync enabled.
+${first}` };
+        }
+        case "off": {
+          await setCloudSyncConfig({ enabled: false });
+          return { message: "Cloud config sync disabled. Local config kept as-is." };
+        }
+        case "now": {
+          try {
+            return { message: await runPass() };
+          } catch (err) {
+            return { message: `Sync failed: ${toErrorMessage(err)}` };
+          }
+        }
+        case "set": {
+          const [field, ...valueParts] = restJoined.split(/\s+/);
+          const value = valueParts.join(" ").trim();
+          if (field === "url") {
+            if (!/^https?:\/\//.test(value)) {
+              return { message: "Usage: /cloudsync set url https://my.wrongstack.com" };
+            }
+            await setCloudSyncConfig({ url: value.replace(/\/+$/, "") });
+            return { message: `Portal URL set to ${value}.` };
+          }
+          if (field === "token") {
+            if (!/^wst_[A-Za-z0-9_-]{43}$/.test(value)) {
+              return {
+                message: 'That does not look like a machine token (wst_ + 43 chars). Create one in the dashboard "Connect client" flow.'
+              };
+            }
+            await setCloudSyncConfig({ token: value });
+            return { message: "Machine token stored (encrypted at rest)." };
+          }
+          if (field === "interval") {
+            const seconds = Number.parseInt(value, 10);
+            if (!Number.isFinite(seconds) || seconds < MIN_INTERVAL_SECONDS) {
+              return {
+                message: `Usage: /cloudsync set interval <seconds \u2265 ${MIN_INTERVAL_SECONDS}>`
+              };
+            }
+            await setCloudSyncConfig({ intervalSeconds: seconds });
+            return { message: `Sync interval set to ${seconds}s.` };
+          }
+          return { message: "Usage: /cloudsync set url|token|interval <value>" };
+        }
+        default:
+          return {
+            message: [
+              "/cloudsync \u2014 my.wrongstack.com config sync",
+              "",
+              "  /cloudsync status              Show sync state",
+              "  /cloudsync set url <url>       Set the portal URL",
+              "  /cloudsync set token <wst_\u2026>   Store the machine token (encrypted)",
+              "  /cloudsync set interval <sec>  Background pass interval",
+              "  /cloudsync on                  Enable + run the first pass",
+              "  /cloudsync off                 Disable background sync",
+              "  /cloudsync now                 Run one pass immediately",
+              "",
+              "Secrets never sync: providers keys, hq binding, and bot tokens stay local."
+            ].join("\n")
+          };
+      }
+    }
+  };
+}
+
+// src/plugins/prompts-plugin.ts
+import * as fs from "node:fs/promises";
+import * as path6 from "node:path";
+function createPromptsPlugin(opts) {
+  let store = null;
+  let loader = null;
+  let usage = null;
+  return {
+    name: "wstack-prompts",
+    version: "1.0.0",
+    description: "Prompt library with 100+ builtin prompts, search, and AI authoring",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true, llm: true },
+    defaultConfig: {},
+    setup(api) {
+      const rawConfig = api.config;
+      const paths = opts?.paths ?? rawConfig["paths"];
+      store = opts?.store ?? (paths ? new DefaultPromptStore(paths) : null);
+      loader = opts?.loader ?? rawConfig["promptLoader"] ?? (paths ? new DefaultPromptLoader({
+        paths,
+        bundledDir: rawConfig["bundledPromptsDir"]
+      }) : null);
+      usage = opts?.usage ?? (paths ? new PromptUsageStore(paths.promptUsage) : null);
+      api.slashCommands.register(buildPromptsCommand(() => store, () => loader, () => api.llm));
+      api.slashCommands.register(buildPromptSearchCommand(() => loader, () => usage));
+      api.slashCommands.register(buildPromptGenCommand(() => loader));
+      api.log.info("[prompts] loaded \u2014 /prompts, /prompt, /prompt-gen available");
+    },
+    teardown(api) {
+      api.slashCommands.unregister("prompts");
+      api.slashCommands.unregister("prompt");
+      api.slashCommands.unregister("prompt-gen");
+      api.log.info("[prompts] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "Prompt store accessible" };
+    }
+  };
+}
+function buildPromptsCommand(getStore, getLoader, getLlm) {
+  return {
+    name: "prompts",
+    description: "Manage your prompt library: /prompts [list|view|add|edit|delete|favorite|extend]",
+    async run(args, ctx) {
+      const store = getStore();
+      const loader = getLoader();
+      if (!store) return { message: "Prompt store not available." };
+      const [verb, ...rest] = args.trim().split(/\s+/);
+      const restJoined = rest.join(" ");
+      switch (verb) {
+        case "":
+        case "list":
+        case "ls": {
+          const entries = await store.list();
+          if (entries.length === 0) {
+            return { message: 'Prompt library empty. Add: /prompts add "title" "content"' };
+          }
+          const lines = entries.map(
+            (e) => `  ${e.favorite ? "\u2605 " : ""}${e.title}  ${dim(e.id)}  ${e.tags.join(", ") || ""}`
+          );
+          return { message: `Prompt library (${entries.length}):
+${lines.join("\n")}
+` };
+        }
+        case "view":
+        case "show": {
+          if (!restJoined) return { message: "Usage: /prompts view <title>" };
+          const matches = await store.find(restJoined);
+          if (matches.length === 0) return { message: `No prompt matching "${restJoined}".` };
+          const entry = matches.find((m) => m.title.toLowerCase() === restJoined.toLowerCase()) ?? expectDefined(matches[0]);
+          return { message: formatPrompt(entry) };
+        }
+        case "add":
+        case "new": {
+          const { flags, positional } = parseFlags(restJoined);
+          const parsed = parseTitleContent(positional);
+          if (!parsed.title) return { message: 'Usage: /prompts add "title" "prompt content"' };
+          const category = flags["category"] ?? flags["cat"];
+          const variables = parseVarFlags(flags["var"]);
+          const entry = store.createNew(parsed.title, parsed.content, parseTags(flags["tags"]), {
+            description: flags["description"] ?? flags["desc"] ?? "",
+            ...category ? { category } : {},
+            ...variables ? { variables } : {}
+          });
+          await store.save(entry);
+          getLoader()?.invalidateCache();
+          return { message: `Added prompt "${entry.title}" (${entry.slug}).` };
+        }
+        case "delete":
+        case "rm": {
+          if (!restJoined) return { message: "Usage: /prompts delete <title>" };
+          const matches = await store.find(restJoined);
+          if (matches.length === 0) return { message: `No prompt matching "${restJoined}".` };
+          const exact = matches.find((m) => m.title.toLowerCase() === restJoined.toLowerCase()) ?? expectDefined(matches[0]);
+          const deleted = await store.delete(exact.id);
+          getLoader()?.invalidateCache();
+          return { message: deleted ? `Deleted "${exact.title}".` : "Delete failed." };
+        }
+        case "edit":
+        case "update": {
+          const parsed = parseTitleContent(restJoined);
+          if (!parsed.title) return { message: 'Usage: /prompts edit "title" "new content"' };
+          const matches = await store.find(parsed.title);
+          if (matches.length === 0) return { message: `No prompt matching "${parsed.title}".` };
+          const exact = matches.find((m) => m.title.toLowerCase() === parsed.title?.toLowerCase()) ?? expectDefined(matches[0]);
+          exact.content = parsed.content;
+          exact.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await store.save(exact);
+          getLoader()?.invalidateCache();
+          return { message: `Updated "${exact.title}".` };
+        }
+        case "favorite":
+        case "star": {
+          if (!restJoined) return { message: "Usage: /prompts favorite <slug-or-title>" };
+          if (loader) {
+            const updated = await loader.setFavorite(restJoined, true);
+            if (!updated) return { message: `No prompt matching "${restJoined}".` };
+            return { message: `\u2605 Favorited "${updated.title}" (${updated.slug}).` };
+          }
+          const matches = await store.find(restJoined);
+          if (matches.length === 0) return { message: `No prompt matching "${restJoined}".` };
+          const exact = expectDefined(matches[0]);
+          exact.favorite = true;
+          exact.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await store.save(exact);
+          return { message: `\u2605 Favorited "${exact.title}".` };
+        }
+        case "extend": {
+          if (!restJoined) return { message: 'Usage: /prompts extend "title" <instructions>' };
+          const parsed = parseTitleContent(restJoined);
+          if (!parsed.title) return { message: 'Usage: /prompts extend "title" <instructions>' };
+          const matches = await store.find(parsed.title);
+          if (matches.length === 0) return { message: `No prompt matching "${parsed.title}".` };
+          const exact = matches.find((m) => m.title.toLowerCase() === parsed.title?.toLowerCase()) ?? expectDefined(matches[0]);
+          const llm = getLlm();
+          if (!llm) return { message: "LLM not available. Configure a provider first." };
+          let enhanced;
+          try {
+            enhanced = await llm.complete(
+              renderInstructionTemplate(readBundledInstructionText("llm/prompt-extend.md"), {
+                existingPrompt: exact.content,
+                additionalInstructions: parsed.content
+              }),
+              {
+                system: "You improve reusable prompts while preserving their intent and variables.",
+                role: "prompt-refiner",
+                maxTokens: 2048
+              }
+            );
+          } catch {
+            return { message: "LLM enhancement failed. The saved prompt was not changed." };
+          }
+          exact.content = enhanced.text.trim();
+          exact.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await store.save(exact);
+          getLoader()?.invalidateCache();
+          return { message: `Extended "${exact.title}".
+
+${dim("New content:")}
+${exact.content}` };
+        }
+        case "export": {
+          if (!loader) return { message: "Prompt library not available." };
+          const own = (await loader.list()).filter((e) => e.source !== "builtin");
+          if (own.length === 0) {
+            return { message: "No user prompts to export. (Builtin prompts ship with WrongStack.)" };
+          }
+          const target = resolveIoPath(restJoined || "wrongstack-prompts.json", ctx);
+          const payload = JSON.stringify(
+            { version: 2, exportedAt: (/* @__PURE__ */ new Date()).toISOString(), prompts: own },
+            null,
+            2
+          );
+          try {
+            await fs.writeFile(target, payload, "utf8");
+            return { message: `Exported ${own.length} prompt(s) \u2192 ${target}` };
+          } catch (err) {
+            return { message: `Export failed: ${err instanceof Error ? err.message : String(err)}` };
+          }
+        }
+        case "import": {
+          if (!loader) return { message: "Prompt library not available." };
+          if (!restJoined) return { message: "Usage: /prompts import <path-to.json>" };
+          const src = resolveIoPath(restJoined, ctx);
+          let raw;
+          try {
+            raw = JSON.parse(await fs.readFile(src, "utf8"));
+          } catch (err) {
+            return { message: `Import failed: ${err instanceof Error ? err.message : String(err)}` };
+          }
+          const list = Array.isArray(raw) ? raw : Array.isArray(raw.prompts) ? raw.prompts : null;
+          if (!list) return { message: "Import failed: expected a JSON array or { prompts: [...] }." };
+          let imported = 0;
+          let skipped = 0;
+          for (const item of list) {
+            const entry = migratePromptEntry(item);
+            if (!entry) {
+              skipped++;
+              continue;
+            }
+            entry.source = "user";
+            entry.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+            const existing = await loader.find(entry.slug);
+            if (existing && existing.source !== "builtin") entry.id = existing.id;
+            await loader.save(entry);
+            imported++;
+          }
+          return {
+            message: `Imported ${imported} prompt(s)${skipped ? ` (${skipped} skipped \u2014 invalid)` : ""} from ${src}.`
+          };
+        }
+        default:
+          return {
+            message: `Unknown subcommand "${verb}". Try: list | view | add | edit | delete | favorite | export | import | extend`
+          };
+      }
+    }
+  };
+}
+function buildPromptSearchCommand(getLoader, getUsage) {
+  return {
+    name: "prompt",
+    description: "Search the prompt library and insert one: /prompt <query> | /prompt insert <slug>",
+    argsHint: "<query> | insert <slug> [var=value \u2026] | recent | favorites",
+    async run(args) {
+      const loader = getLoader();
+      if (!loader) return { message: "Prompt library not available." };
+      const trimmed = args.trim();
+      if (trimmed.startsWith("insert ") || trimmed.startsWith("use ")) {
+        const rest = trimmed.slice(trimmed.indexOf(" ") + 1).trim();
+        const [slug, ...kvs] = rest.split(/\s+/);
+        if (!slug) return { message: "Usage: /prompt insert <slug> [var=value \u2026]" };
+        const entry = await loader.find(slug);
+        if (!entry) return { message: `No prompt with slug/id "${slug}". Try /prompt ${slug}` };
+        const values = parseKeyValues(kvs);
+        const { text, missing, invalid } = renderPrompt(entry, values);
+        if (invalid.length > 0) {
+          const hint = (entry.variables ?? []).filter((v) => invalid.includes(v.name)).map((v) => `  ${v.name}: one of ${(v.enum ?? []).join(" | ")}`).join("\n");
+          return {
+            message: `"${entry.title}" got an out-of-range value for: ${invalid.join(", ")}
+${hint}`
+          };
+        }
+        if (missing.length > 0) {
+          const hint = (entry.variables ?? []).filter((v) => missing.includes(v.name)).map((v) => {
+            const opts = v.enum && v.enum.length > 0 ? `  [${v.enum.join(" | ")}]` : "";
+            return `  ${v.name}=\u2026${v.description ? `  (${v.description})` : ""}${opts}`;
+          }).join("\n");
+          return {
+            message: `"${entry.title}" needs values for: ${missing.join(", ")}
+${hint}
+
+Re-run: /prompt insert ${entry.slug} ${missing.map((m) => `${m}=\u2026`).join(" ")}`
+          };
+        }
+        try {
+          await getUsage()?.record(entry.slug);
+        } catch {
+        }
+        return { message: `Inserted "${entry.title}".`, runText: text };
+      }
+      if (trimmed === "recent" || trimmed === "popular") {
+        const u = getUsage();
+        if (!u) return { message: "Usage tracking not available." };
+        const top = trimmed === "popular" ? await u.top(15) : await u.recent(15);
+        if (top.length === 0) {
+          return { message: "No prompt usage yet. Insert one with /prompt insert <slug>." };
+        }
+        const lines2 = [];
+        for (const { slug, usage } of top) {
+          const e = await loader.find(slug);
+          const title = e?.title ?? slug;
+          lines2.push(`  ${e ? sourceGlyph(e) : "\u2022"} ${title}  ${dim(slug)}  ${dim(`\xD7${usage.count}`)}`);
+        }
+        return {
+          message: `${trimmed === "popular" ? "Most-used" : "Recent"} prompts:
+${lines2.join("\n")}
+
+Insert: /prompt insert <slug>`
+        };
+      }
+      if (trimmed === "favorites" || trimmed === "fav" || trimmed === "starred") {
+        const favs = (await loader.list()).filter((e) => e.favorite);
+        if (favs.length === 0) {
+          return { message: "No favorites yet. Star one with /prompts favorite <slug>." };
+        }
+        const lines2 = favs.map(
+          (e) => `  ${sourceGlyph(e)} \u2605 ${e.title}  ${dim(e.slug)}  ${dim(`[${e.category}]`)}`
+        );
+        return { message: `Favorites (${favs.length}):
+${lines2.join("\n")}
+
+Insert: /prompt insert <slug>` };
+      }
+      if (!trimmed) {
+        const cats = await loader.categories();
+        const total = cats.reduce((n, c) => n + c.count, 0);
+        const catLine = cats.map((c) => `${c.label} (${c.count})`).join(" \xB7 ");
+        return {
+          message: [
+            `Prompt library: ${total} prompts.`,
+            catLine,
+            "",
+            "Search: /prompt <query>   \xB7   Recent: /prompt recent   \xB7   Favorites: /prompt favorites   \xB7   Insert: /prompt insert <slug>"
+          ].join("\n")
+        };
+      }
+      const results = await loader.search(trimmed, { limit: 15 });
+      if (results.length === 0) return { message: `No prompts matching "${trimmed}".` };
+      const lines = results.map(
+        (e) => `  ${sourceGlyph(e)} ${e.favorite ? "\u2605 " : ""}${e.title}  ${dim(e.slug)}  ${dim(`[${e.category}]`)}
+     ${e.description}`
+      );
+      return {
+        message: `${results.length} match(es) for "${trimmed}":
+${lines.join("\n")}
+
+Insert: /prompt insert <slug>`
+      };
+    }
+  };
+}
+function buildPromptGenCommand(getLoader) {
+  return {
+    name: "prompt-gen",
+    description: "Create a new reusable prompt with AI guidance. The AI will interview you.",
+    help: [
+      "\u2554\u2550\u2550\u2550 Prompt Generator \u2550\u2550\u2550\u2557",
+      "",
+      "Create a high-quality, reusable prompt with AI guidance.",
+      "",
+      "Usage:",
+      "  /prompt-gen              Start AI-guided authoring",
+      "  /prompt-gen list         List prompts in your library",
+      "  /prompt-gen edit <slug>  View an existing prompt",
+      "",
+      "The AI asks about purpose, task and variables, drafts a strong",
+      "prompt, then saves it via /prompts add."
+    ].join("\n"),
+    async run(args) {
+      const loader = getLoader();
+      const trimmed = args.trim();
+      if (trimmed === "list" || trimmed === "ls") {
+        if (!loader) return { message: "Prompt library not available." };
+        const all = await loader.list();
+        if (all.length === 0) return { message: "No prompts found." };
+        const lines = all.slice(0, 50).map((e) => `  ${sourceGlyph(e)} ${e.title}  ${dim(e.slug)}`);
+        return { message: `Prompts (${all.length}):
+${lines.join("\n")}` };
+      }
+      if (trimmed.startsWith("edit ") || trimmed.startsWith("view ")) {
+        if (!loader) return { message: "Prompt library not available." };
+        const slug = trimmed.slice(trimmed.indexOf(" ") + 1).trim();
+        const entry = await loader.find(slug);
+        if (!entry) return { message: `Prompt "${slug}" not found.` };
+        return { message: formatPrompt(entry) };
+      }
+      return {
+        message: "\u2554\u2550\u2550\u2550 Prompt Generator \u2550\u2550\u2550\u2557\n\nThe AI will guide you through creating a new prompt.\nAnswer its questions naturally.",
+        runText: [
+          "I want to create a new reusable prompt for my prompt library.",
+          "Read the `prompt-engineering` skill and use it as your playbook.",
+          "Interview me ONE question at a time to elicit:",
+          "  1. the purpose and the exact task the prompt should accomplish,",
+          "  2. the inputs that change each time (these become {{variables}}),",
+          "  3. the desired output format and tone.",
+          "Then draft a high-quality prompt that uses {{double-brace}} placeholders for the variables.",
+          "Show me the draft for approval, then SAVE it by calling:",
+          '  /prompts add --category <category> --description "<one-line summary>" --tags <comma,separated> --var <name:description> "<Title>" "<prompt content>"',
+          "Pick the best-fitting category from: coding, debugging, refactoring, testing, code-review, architecture, devops, documentation, data-analysis, writing, research, product, agentic-workflows, meta-prompting."
+        ].join("\n")
+      };
+    }
+  };
+}
+function formatPrompt(entry) {
+  const tags = entry.tags.length > 0 ? ` [${entry.tags.join(", ")}]` : "";
+  const vars = entry.variables && entry.variables.length > 0 ? `
+
+Variables: ${entry.variables.map((v) => `{{${v.name}}}${v.required ? "*" : ""}`).join(", ")}` : "";
+  return [
+    `# ${entry.title}${tags}`,
+    entry.description ? `
+${entry.description}` : "",
+    `
+${entry.content}${vars}`,
+    `
+${dim(`slug: ${entry.slug} | category: ${entry.category} | source: ${entry.source}`)}`
+  ].join("\n");
+}
+function resolveIoPath(p, ctx) {
+  const cleaned = p.trim().replace(/^["']|["']$/g, "");
+  if (path6.isAbsolute(cleaned)) return cleaned;
+  const base = ctx.projectRoot ?? process.cwd();
+  return path6.resolve(base, cleaned);
+}
+function sourceGlyph(e) {
+  return e.source === "project" ? "\u{1F4C1}" : e.source === "user" ? "\u{1F464}" : e.source === "synced" ? "\u2601" : "\u{1F4E6}";
+}
+function parseFlags(input) {
+  const flags = {};
+  let s = input.trim();
+  const flagRe = /^--([a-zA-Z][\w-]*)(?:=("[^"]*"|'[^']*'|\S+)|\s+("[^"]*"|'[^']*'|\S+))?\s*/;
+  let m;
+  while (s.startsWith("--") && (m = flagRe.exec(s))) {
+    const name = expectDefined(m[1]);
+    const rawVal = m[2] ?? m[3] ?? "true";
+    flags[name] = unquote(rawVal);
+    s = s.slice(m[0].length);
+  }
+  return { flags, positional: s.trim() };
+}
+function unquote(v) {
+  if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+    return v.slice(1, -1);
+  }
+  return v;
+}
+function parseTags(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((t) => t.trim()).filter(Boolean);
+}
+function parseVarFlags(raw) {
+  if (!raw) return void 0;
+  const out = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const metaAt = trimmed.indexOf("::");
+    const head = metaAt === -1 ? trimmed : trimmed.slice(0, metaAt).trim();
+    const meta = metaAt === -1 ? "" : trimmed.slice(metaAt + 2).trim();
+    const colon = head.indexOf(":");
+    const name = colon === -1 ? head : head.slice(0, colon).trim();
+    const description = colon === -1 ? void 0 : head.slice(colon + 1).trim();
+    if (!name) continue;
+    const v = { name, description, required: true };
+    for (const token of meta.split("::").map((t) => t.trim()).filter(Boolean)) {
+      if (token === "multiline") v.multiline = true;
+      else if (token.startsWith("enum=")) {
+        const opts = token.slice(5).split("|").map((o) => o.trim()).filter(Boolean);
+        if (opts.length > 0) v.enum = opts;
+      }
+    }
+    out.push(v);
+  }
+  return out.length > 0 ? out : void 0;
+}
+function parseKeyValues(kvs) {
+  const out = {};
+  for (const kv of kvs) {
+    const eq = kv.indexOf("=");
+    if (eq > 0) out[kv.slice(0, eq)] = unquote(kv.slice(eq + 1));
+  }
+  return out;
+}
+function parseTitleContent(args) {
+  const trimmed = args.trim();
+  if (!trimmed) return { title: "", content: "" };
+  const doubleMatch = /^"([^"]+)"\s+"([^"]+)"$/.exec(trimmed) || /^'([^']+)'\s+'([^']+)'$/.exec(trimmed);
+  if (doubleMatch)
+    return { title: expectDefined(doubleMatch[1]), content: expectDefined(doubleMatch[2]) };
+  const quotedTitleMatch = /^"([^"]+)"\s+(.+)$/.exec(trimmed) || /^'([^']+)'\s+(.+)$/.exec(trimmed);
+  if (quotedTitleMatch)
+    return { title: expectDefined(quotedTitleMatch[1]), content: expectDefined(quotedTitleMatch[2]) };
+  const firstSpace = trimmed.indexOf(" ");
+  if (firstSpace === -1) return { title: trimmed, content: "" };
+  return { title: trimmed.slice(0, firstSpace), content: trimmed.slice(firstSpace + 1) };
+}
+function dim(s) {
+  return `\x1B[2m${s}\x1B[0m`;
+}
+
+// src/plugins/skills-plugin.ts
+import * as os2 from "node:os";
+import * as path7 from "node:path";
+function createSkillsPlugin(opts) {
+  return {
+    name: "wstack-skills",
+    version: "1.1.0",
+    description: "Skill library, registry search, installer and authoring toolkit: /skill, /skill-gen, /skill-search, /skill-install, ...",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true },
+    defaultConfig: {},
+    setup(api) {
+      const rawConfig = api.config;
+      const skillLoader = opts?.skillLoader ?? rawConfig.skillLoader;
+      const registryUrl = rawConfig.skills?.registryUrl?.trim() || void 0;
+      const registryAdapters = opts?.registryAdapters ?? [
+        githubDirectAdapter,
+        createSkillsShAdapter(registryUrl ? { baseUrl: registryUrl } : {})
+      ];
+      api.slashCommands.register(buildSkillCommand(skillLoader));
+      api.slashCommands.register(buildSkillGeneratorCommand(skillLoader));
+      api.slashCommands.register(buildSkillSearchCommand(skillLoader, registryAdapters));
+      api.slashCommands.register(buildSkillInstallCommand(skillLoader, registryAdapters));
+      api.slashCommands.register(buildSkillImportCommand(skillLoader));
+      api.slashCommands.register(buildSkillUpdateCommand(skillLoader, registryAdapters));
+      api.slashCommands.register(buildSkillUninstallCommand(skillLoader));
+      api.log.info(
+        "[skills] loaded \u2014 /skill, /skill-gen, /skill-search, /skill-install, /skill-import, /skill-update/uninstall available"
+      );
+    },
+    teardown(api) {
+      for (const name of [
+        "skill",
+        "skill-gen",
+        "skill-search",
+        "skill-install",
+        "skill-import",
+        "skill-update",
+        "skill-uninstall"
+      ]) {
+        api.slashCommands.unregister(name);
+      }
+      api.log.info("[skills] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "skills ready" };
+    }
+  };
+}
+function makeInstaller(skillLoader, projectRoot, registryAdapters) {
+  const paths = resolveWstackPaths({ projectRoot });
+  return new SkillInstaller({
+    manifestPath: path7.join(paths.configDir, "installed-skills.json"),
+    projectSkillsDir: paths.inProjectSkills,
+    globalSkillsDir: paths.globalSkills,
+    projectHash: paths.projectHash,
+    skillLoader,
+    ...registryAdapters ? { registryAdapters } : {}
+  });
+}
+function buildSkillCommand(skillLoader) {
+  return {
+    name: "skill",
+    description: "Show skill details or list available skills. Use /skill-gen to create new skills.",
+    async run(args) {
+      if (!skillLoader) return { message: "No skill loader configured." };
+      if (!args.trim()) {
+        const entries = await skillLoader.listEntries();
+        if (entries.length === 0) return { message: "No skills found." };
+        const lines = entries.map((e) => {
+          const scopeTag = e.scope.length > 0 ? `  ${color.dim(`(${e.scope.slice(0, 3).join(", ")})`)}` : "";
+          return `  ${color.bold(e.name)}${scopeTag}
+    Use when: ${e.trigger}`;
+        });
+        return { message: `Available skills:
+${lines.join("\n\n")}
+` };
+      }
+      const skill = await skillLoader.find(args.trim());
+      if (!skill) return { message: `Skill "${args.trim()}" not found.` };
+      const body = capSkillBody(stripFrontmatter(await skillLoader.readBody(skill.name)));
+      return { message: body };
+    }
+  };
+}
+function buildSkillGeneratorCommand(skillLoader) {
+  return {
+    name: "skill-gen",
+    description: "Create or validate skills. /skill-gen (wizard) | validate <name> | skeleton <name> | from-prompt <text> | view <name> | edit <name> | list",
+    help: [
+      "\u2554\u2550\u2550\u2550 Skill Generator \u2550\u2550\u2550\u2557",
+      "",
+      "Create and validate AI skills.",
+      "",
+      "Usage:",
+      "  /skill-gen                        Start the interactive AI-guided wizard",
+      "  /skill-gen list                   List existing skills (with source)",
+      "  /skill-gen validate <name>        Validate a skill name (format + collisions)",
+      "  /skill-gen skeleton <name>        Generate a SKILL.md skeleton to draft",
+      '         [--desc "..."] [--trigger a,b,c] [--global] [--force]',
+      "  /skill-gen from-prompt <text>     Turn a prompt into a skill draft",
+      "         [--global] [--force]",
+      "  /skill-gen view <name>            Show a skill's body (read-only)",
+      "  /skill-gen edit <name>            Open a skill in $EDITOR/$VISUAL",
+      "",
+      "Skeletons are written to .wrongstack/skills/<name>/SKILL.md (--global: active profile/skills/).",
+      "The interactive wizard reads the bundled `skill-creator` skill and guides you step by step."
+    ].join("\n"),
+    async run(args, ctx) {
+      const trimmed = args.trim();
+      const [sub, ...rest] = trimmed.split(/\s+/);
+      if (sub === "list" || sub === "ls") {
+        if (!skillLoader) return { message: "No skill loader configured." };
+        const entries = await skillLoader.listEntries();
+        if (entries.length === 0) return { message: "No skills found." };
+        const lines = entries.map((e) => {
+          const src = e.source === "project" ? "\u{1F4C1}" : e.source === "user" ? "\u{1F464}" : e.source === "claude-project" || e.source === "claude-user" ? "\u{1F310}" : e.source === "foreign" ? `\u{1F310}(${e.originTool ?? "?"})` : e.source === "extra" ? "\u2795" : "\u{1F4E6}";
+          return `  ${src} ${e.name}
+     ${e.trigger}`;
+        });
+        let message = `Available Skills:
+${lines.join("\n\n")}
+`;
+        const diag = skillLoader.diagnostics?.();
+        if (diag && (diag.shadowed.length > 0 || diag.skipped.length > 0)) {
+          const notes = [];
+          if (diag.shadowed.length > 0) {
+            notes.push(color.dim("Shadowed (hidden by a higher-priority layer):"));
+            for (const s of diag.shadowed) {
+              notes.push(
+                color.dim(`  \u26A0 ${s.name} (${s.source}) \u2190 overridden by ${s.shadowedBy}`)
+              );
+            }
+          }
+          if (diag.skipped.length > 0) {
+            notes.push(color.dim("Skipped (malformed SKILL.md):"));
+            for (const k of diag.skipped) {
+              const name = k.name ? ` "${k.name}"` : "";
+              notes.push(color.dim(`  \u2717 ${k.entry}${name} \u2014 ${k.reason}`));
+            }
+          }
+          message += `
+${notes.join("\n")}
+`;
+        }
+        return { message };
+      }
+      if (sub === "validate") {
+        const name = rest[0];
+        if (!name) return { message: "Usage: /skill-gen validate <name>" };
+        const result = await validateSkillNameAvailable(name, skillLoader);
+        const lines = [`Validating "${name}":`];
+        if (result.formatViolations.length > 0) {
+          lines.push(`  \u2717 Format issues:`);
+          for (const v of result.formatViolations) lines.push(`    - ${v}`);
+        } else {
+          lines.push(`  \u2713 Format: valid kebab-case`);
+        }
+        if (result.conflicts.length > 0) {
+          const sameLayer = result.conflicts.filter(
+            (c) => c.source === "project" || c.source === "user"
+          );
+          const shadowing = result.conflicts.filter(
+            (c) => c.source !== "project" && c.source !== "user"
+          );
+          if (sameLayer.length > 0) {
+            lines.push(`  \u2717 Collisions (same layer \u2014 would overwrite):`);
+            for (const c of sameLayer) lines.push(`    - ${c.name} (${c.source})`);
+          }
+          if (shadowing.length > 0) {
+            lines.push(`  \u26A0 Shadows lower-priority skills (intentional override):`);
+            for (const c of shadowing) lines.push(`    - ${c.name} (${c.source})`);
+          }
+        } else {
+          lines.push(`  \u2713 No collisions`);
+        }
+        lines.push(result.ok ? `  \u2192 Ready to use.` : `  \u2192 Fix the issues above first.`);
+        return { message: lines.join("\n") };
+      }
+      if (sub === "skeleton") {
+        return runSkeleton(rest, ctx, skillLoader);
+      }
+      if (sub === "from-prompt") {
+        return runFromPrompt(rest, ctx, skillLoader);
+      }
+      if (sub === "view") {
+        const skillName = rest[0];
+        if (!skillName) return { message: "Usage: /skill-gen view <name>" };
+        if (!skillLoader) return { message: "No skill loader configured." };
+        const skill = await skillLoader.find(skillName);
+        if (!skill) return { message: `Skill "${skillName}" not found.` };
+        const body = await skillLoader.readBody(skillName);
+        return { message: [`Skill: ${skillName}`, `Path: ${skill.path}`, "", body].join("\n") };
+      }
+      if (sub === "edit") {
+        const skillName = rest[0];
+        if (!skillName) return { message: "Usage: /skill-gen edit <name>" };
+        if (!skillLoader) return { message: "No skill loader configured." };
+        const skill = await skillLoader.find(skillName);
+        if (!skill) return { message: `Skill "${skillName}" not found.` };
+        try {
+          await openInEditor(skill.path);
+          skillLoader.invalidateCache();
+          return {
+            message: `Opening ${skill.path} in your editor\u2026 (skill cache cleared \u2014 changes load on next use)`
+          };
+        } catch (err) {
+          return { message: `\u2717 ${toErrorMessage(err)}` };
+        }
+      }
+      if (trimmed.startsWith("edit ")) {
+        return buildSkillGeneratorCommand(skillLoader).run(`view ${rest.join(" ")}`, ctx);
+      }
+      return {
+        message: "\u2554\u2550\u2550\u2550 Skill Generator \u2550\u2550\u2550\u2557\n\nThe AI will guide you through creating a new skill.\nAnswer its questions naturally. (Or use /skill-gen skeleton <name> for a quick scaffold.)",
+        runText: "I want to create a new AI skill. Read the skill-creator skill and guide me through the process. Ask me questions one at a time \u2014 name, description, what to cover \u2014 then create the SKILL.md file. After writing it, run /skill-gen validate <name> to confirm."
+      };
+    }
+  };
+}
+async function runSkeleton(rest, ctx, skillLoader) {
+  const name = rest.find((p) => !p.startsWith("--"));
+  if (!name) {
+    return {
+      message: 'Usage: /skill-gen skeleton <name> [--desc "..."] [--trigger a,b,c] [--global] [--force]'
+    };
+  }
+  const desc = parseFlagValue(rest, "--desc");
+  const triggers = parseFlagValue(rest, "--trigger")?.split(",").map((t) => t.trim()).filter(Boolean);
+  const isGlobal = rest.includes("--global");
+  const force = rest.includes("--force");
+  const validation = await validateSkillNameAvailable(name, skillLoader);
+  if (!validation.ok) {
+    const issues = [...validation.formatViolations];
+    for (const c of validation.conflicts) {
+      if (c.source === "project" || c.source === "user") {
+        issues.push(
+          `collides with existing ${c.source} skill "${c.name}" (use --force to overwrite)`
+        );
+      }
+    }
+    return { message: `\u2717 Cannot scaffold "${name}":
+  - ${issues.join("\n  - ")}` };
+  }
+  const body = generateSkillSkeleton({ name, description: desc ?? "", triggerKeywords: triggers });
+  const paths = resolveWstackPaths({ projectRoot: ctx.projectRoot });
+  const skillsDir = isGlobal ? paths.globalSkills : paths.inProjectSkills;
+  try {
+    const written = await writeSkeletonSkill(skillsDir, body, { overwrite: force });
+    const advisory = bodyLineAdvisory(body);
+    return {
+      message: [
+        `\u2713 Scaffolded ${name} \u2192 ${written}`,
+        advisory.over ? `  \u26A0 Body is ${advisory.lines} lines (skill-creator recommends \u2264500).` : "",
+        `  Next: edit the body, then /skill-gen validate ${name}.`
+      ].filter(Boolean).join("\n")
+    };
+  } catch (err) {
+    return { message: `\u2717 ${toErrorMessage(err)}` };
+  }
+}
+async function runFromPrompt(rest, ctx, skillLoader) {
+  const promptText = rest.filter((p) => !p.startsWith("--")).join(" ").trim();
+  if (!promptText) {
+    return { message: "Usage: /skill-gen from-prompt <text> [--global] [--force]" };
+  }
+  const isGlobal = rest.includes("--global");
+  const force = rest.includes("--force");
+  const draft = extractSkillFromPrompt(promptText);
+  if (!draft.suggestedName) {
+    return { message: "\u2717 Could not derive a skill name from the prompt. Provide a # heading." };
+  }
+  const validation = await validateSkillNameAvailable(draft.suggestedName, skillLoader);
+  if (!validation.ok) {
+    return {
+      message: `\u2717 Derived name "${draft.suggestedName}" has issues:
+  - ` + [
+        ...validation.formatViolations,
+        ...validation.conflicts.map((c) => `collides with ${c.name}`)
+      ].join("\n  - ")
+    };
+  }
+  const body = generateSkillSkeleton({
+    name: draft.suggestedName,
+    description: draft.description,
+    triggerKeywords: draft.triggerKeywords
+  });
+  const withBody = draft.body ? body.replace("## Overview\n", `## Overview
+
+${draft.body}
+`) : body;
+  const paths = resolveWstackPaths({ projectRoot: ctx.projectRoot });
+  const skillsDir = isGlobal ? paths.globalSkills : paths.inProjectSkills;
+  try {
+    const written = await writeSkeletonSkill(skillsDir, withBody, { overwrite: force });
+    return {
+      message: `\u2713 Drafted ${draft.suggestedName} from prompt \u2192 ${written}
+  Triggers: ${draft.triggerKeywords.join(", ") || "(none detected)"}
+  Next: review and edit the body, then /skill-gen validate ${draft.suggestedName}.`
+    };
+  } catch (err) {
+    return { message: `\u2717 ${toErrorMessage(err)}` };
+  }
+}
+function parseFlagValue(tokens, flag) {
+  const idx = tokens.indexOf(flag);
+  if (idx === -1) return void 0;
+  const next = tokens[idx + 1];
+  return next && !next.startsWith("--") ? next : void 0;
+}
+function buildSkillSearchCommand(_skillLoader, registryAdapters) {
+  return {
+    name: "skill-search",
+    description: "Search the skill registry (skills.sh) for installable skills.",
+    argsHint: "<query> [--page N] [--pageSize N]",
+    help: [
+      "\u2554\u2550\u2550\u2550 Skill Search \u2550\u2550\u2550\u2557",
+      "",
+      "Search the skill registry for installable skills.",
+      "Results show name, author, installs, security score, and the install ref.",
+      "",
+      "Usage:",
+      '  /skill-search react                 Search for "react" skills',
+      '  /skill-search "code review" --page 2  Second page of results',
+      "",
+      `Registries: ${registryAdapters.map((a) => a.id).join(", ")}.`,
+      "To install a hit: /skill-install <owner/repo> (or the full install ref shown)."
+    ].join("\n"),
+    async run(args) {
+      const parts = args.trim().split(/\s+/).filter(Boolean);
+      const query = parts.filter((p) => !p.startsWith("--")).join(" ").trim();
+      if (!query) return { message: "Usage: /skill-search <query> [--page N]" };
+      const page = parseFlagValue(parts, "--page");
+      const pageSize = parseFlagValue(parts, "--pageSize");
+      const tmpInstaller = new SkillInstaller({
+        manifestPath: ":memory:",
+        // never written — search() is read-only
+        projectSkillsDir: "/dev/null",
+        globalSkillsDir: "/dev/null",
+        projectHash: "search",
+        registryAdapters
+      });
+      try {
+        const perAdapter = await tmpInstaller.search(query, {
+          ...page ? { page: Number(page) } : {},
+          ...pageSize ? { pageSize: Number(pageSize) } : {}
+        });
+        const total = perAdapter.reduce((n, b) => n + b.results.length, 0);
+        if (total === 0) {
+          return {
+            message: `No skills found for "${query}" in ${registryAdapters.map((a) => a.id).join(", ")}.`
+          };
+        }
+        const lines = [`Found ${total} skill(s) for "${query}":`];
+        for (const block of perAdapter) {
+          if (block.results.length === 0) continue;
+          lines.push(`
+${color.bold(block.adapterId)}:`);
+          for (const r of block.results) {
+            const tier = r.securityScore != null ? securityScoreToTier(r.securityScore) : void 0;
+            const scoreMark = tier === "low" ? ` \u26A0${r.securityScore}` : r.securityScore != null ? ` \u2713${r.securityScore}` : "";
+            const installs = r.installs != null ? ` \xB7 ${formatCount(r.installs)} installs` : "";
+            const author = r.author ? ` ${color.dim(r.author)}` : "";
+            lines.push(`  ${color.bold(r.name)}${author}${scoreMark}${installs}`);
+            if (r.description) lines.push(`    ${truncate(r.description, 90)}`);
+            lines.push(`    ${color.dim("\u2192 /skill-install " + r.installRef)}`);
+          }
+        }
+        return { message: lines.join("\n") };
+      } catch (err) {
+        return { message: `\u2717 Search failed: ${toErrorMessage(err)}` };
+      }
+    }
+  };
+}
+function buildSkillInstallCommand(skillLoader, registryAdapters) {
+  return {
+    name: "skill-install",
+    description: "Install skills from a GitHub repository or a registry hit (skills.sh:<id>).",
+    argsHint: "<user/repo[@ref] | skills.sh:<owner/repo> | registry:<id>> [--global]",
+    help: [
+      "\u2554\u2550\u2550\u2550 Skill Install \u2550\u2550\u2550\u2557",
+      "",
+      "Install skills from GitHub (direct) or a registry (resolved to GitHub).",
+      "",
+      "Usage:",
+      "  /skill-install <user/repo>              Install from default branch (main)",
+      "  /skill-install <user/repo@ref>          Install specific tag/branch/commit",
+      "  /skill-install <user/repo> --global     Install to user-global skills",
+      "  /skill-install skills.sh:<owner/repo>   Resolve a skills.sh hit and install",
+      "",
+      "Supports single-skill repos (SKILL.md at root) and multi-skill repos (skills/).",
+      "Use /skill-search to find skills, then install with the shown install ref.",
+      "",
+      "Private repos: set GITHUB_TOKEN (or GH_TOKEN) in your environment."
+    ].join("\n"),
+    async run(args, ctx) {
+      const parts = args.trim().split(/\s+/);
+      const ref = parts.find((p) => !p.startsWith("--"));
+      const isGlobal = parts.includes("--global");
+      if (!ref) {
+        return {
+          message: "Usage: /skill-install <user/repo[@ref] | skills.sh:<owner/repo>> [--global]\nUse /skill-search to find skills."
+        };
+      }
+      const installer = makeInstaller(skillLoader, ctx.projectRoot, registryAdapters);
+      try {
+        const results = await installer.install(ref, { global: isGlobal });
+        if (results.length === 0) return { message: "No skills found in the repository." };
+        const scope = isGlobal ? "user-global" : "project";
+        const lines = [`Installed ${results.length} skill(s) [${scope}]:`];
+        for (const r of results) {
+          lines.push(`  \u2713 ${r.name} (${r.source}@${r.ref})`);
+          lines.push(`    \u2192 ${r.path}`);
+        }
+        return { message: lines.join("\n") };
+      } catch (err) {
+        const msg = toErrorMessage(err);
+        return { message: `\u2717 Install failed: ${msg}` };
+      }
+    }
+  };
+}
+var IMPORT_SOURCE_TOOLS = [
+  { id: "claude", subdir: "skills" },
+  ...FOREIGN_SKILL_TOOLS
+];
+function resolveImportSourceDir(tool, opts) {
+  const entry = IMPORT_SOURCE_TOOLS.find((t) => t.id === tool);
+  if (!entry) return void 0;
+  const base = opts.global ? opts.homeDir ?? os2.homedir() : opts.projectRoot;
+  return path7.join(base, "." + entry.id, entry.subdir);
+}
+function buildSkillImportCommand(skillLoader) {
+  return {
+    name: "skill-import",
+    description: "Import skills from a local directory or another agent into .wrongstack/skills.",
+    argsHint: "[<src-dir> | --from <tool> | --from-claude] [--global] [--link]",
+    help: [
+      "\u2554\u2550\u2550\u2550 Skill Import \u2550\u2550\u2550\u2557",
+      "",
+      "Copy (or symlink) skills into .wrongstack/skills so you can edit and commit",
+      "them. Foreign skills are already readable without importing \u2014 this takes ownership.",
+      "",
+      "Usage:",
+      "  /skill-import --from cursor              Import project .cursor/skills",
+      "  /skill-import --from codex --global      Import ~/.codex/skills",
+      "  /skill-import --from claude              Import project .claude/skills (--from-claude alias)",
+      "  /skill-import /path/to/skills            Import from any directory",
+      "  /skill-import --from trae --link         Symlink instead of copy",
+      "",
+      `Known tools: ${IMPORT_SOURCE_TOOLS.map((t) => t.id).join(", ")}.`,
+      "Each subdirectory with a valid SKILL.md is imported."
+    ].join("\n"),
+    async run(args, ctx) {
+      const parts = args.trim().split(/\s+/).filter(Boolean);
+      const isGlobal = parts.includes("--global");
+      const link = parts.includes("--link");
+      const fromIdx = parts.indexOf("--from");
+      let tool;
+      if (fromIdx !== -1) tool = parts[fromIdx + 1];
+      else if (parts.includes("--from-claude")) tool = "claude";
+      const positional = parts.find((p) => !p.startsWith("--") && p !== tool);
+      let srcDir;
+      if (tool) {
+        srcDir = resolveImportSourceDir(tool, { global: isGlobal, projectRoot: ctx.projectRoot });
+        if (!srcDir) {
+          return {
+            message: `Unknown tool "${tool}". Known: ${IMPORT_SOURCE_TOOLS.map((t) => t.id).join(", ")}`
+          };
+        }
+      } else if (positional) {
+        srcDir = path7.resolve(ctx.projectRoot, positional);
+      } else {
+        return {
+          message: "Usage: /skill-import <src-dir> | --from <tool> | --from-claude [--global] [--link]"
+        };
+      }
+      const installer = makeInstaller(skillLoader, ctx.projectRoot);
+      try {
+        const results = await installer.importFromDir(srcDir, { global: isGlobal, link });
+        if (results.length === 0) {
+          return { message: `No valid skills found in ${srcDir}.` };
+        }
+        const scope = isGlobal ? "user-global" : "project";
+        const lines = [
+          `Imported ${results.length} skill(s) [${scope}]${link ? " (symlinked)" : ""}:`
+        ];
+        for (const r of results) {
+          lines.push(`  \u2713 ${r.name}`);
+          lines.push(`    \u2192 ${r.path}`);
+        }
+        return { message: lines.join("\n") };
+      } catch (err) {
+        return { message: `\u2717 Import failed: ${toErrorMessage(err)}` };
+      }
+    }
+  };
+}
+function buildSkillUpdateCommand(skillLoader, registryAdapters) {
+  return {
+    name: "skill-update",
+    description: "Update installed skills from their GitHub source.",
+    argsHint: "[name|ref] [--global]",
+    help: [
+      "\u2554\u2550\u2550\u2550 Skill Update \u2550\u2550\u2550\u2557",
+      "",
+      "Update installed skills from their GitHub source.",
+      "",
+      "Usage:",
+      "  /skill-update                  Update all installed skills",
+      "  /skill-update <name>           Update a specific skill",
+      "  /skill-update <user/repo@ref>  Update to a different ref",
+      "  /skill-update <name> --global  Update a global skill"
+    ].join("\n"),
+    async run(args, ctx) {
+      const parts = args.trim().split(/\s+/);
+      const nameOrRef = parts.find((p) => !p.startsWith("--"));
+      const isGlobal = parts.includes("--global");
+      const installer = makeInstaller(skillLoader, ctx.projectRoot, registryAdapters);
+      try {
+        const result = await installer.update(nameOrRef, { global: isGlobal });
+        const lines = [];
+        if (result.updated.length > 0) {
+          lines.push(`Updated ${result.updated.length} skill(s):`);
+          for (const u of result.updated) {
+            lines.push(
+              u.oldRef !== u.newRef ? `  \u2713 ${u.name} (${u.oldRef} \u2192 ${u.newRef})` : `  \u2713 ${u.name} (refreshed)`
+            );
+          }
+        }
+        if (result.unchanged.length > 0) lines.push(`Up to date: ${result.unchanged.join(", ")}`);
+        if (result.errors.length > 0) {
+          for (const e of result.errors) lines.push(`  \u2717 ${e.name}: ${e.error}`);
+        }
+        if (lines.length === 0) return { message: "No installed skills to update." };
+        return { message: lines.join("\n") };
+      } catch (err) {
+        const msg = toErrorMessage(err);
+        return { message: `\u2717 Update failed: ${msg}` };
+      }
+    }
+  };
+}
+function buildSkillUninstallCommand(skillLoader) {
+  return {
+    name: "skill-uninstall",
+    description: "Remove an installed skill.",
+    argsHint: "<name> [--global]",
+    help: [
+      "\u2554\u2550\u2550\u2550 Skill Uninstall \u2550\u2550\u2550\u2557",
+      "",
+      "Remove an installed skill and its files.",
+      "",
+      "Usage:",
+      "  /skill-uninstall <name>             Remove from project skills",
+      "  /skill-uninstall <name> --global    Remove from user-global skills"
+    ].join("\n"),
+    async run(args, ctx) {
+      const parts = args.trim().split(/\s+/);
+      const name = parts.find((p) => !p.startsWith("--"));
+      const isGlobal = parts.includes("--global");
+      if (!name) {
+        const installer2 = makeInstaller(skillLoader, ctx.projectRoot);
+        const installed = await installer2.listInstalled();
+        if (installed.length === 0) return { message: "No installed skills found." };
+        const scope = isGlobal ? "user" : "project";
+        const filtered = installed.filter((s) => s.scope === scope);
+        if (filtered.length === 0) {
+          return { message: `No installed skills found (${scope} scope).` };
+        }
+        const lines = [`Installed skills (${scope}):`];
+        for (const s of filtered) {
+          lines.push(`  ${s.name}  ${s.source}@${s.ref}  (${s.installedAt.slice(0, 10)})`);
+        }
+        lines.push("", "Use /skill-uninstall <name> to remove.");
+        return { message: lines.join("\n") };
+      }
+      const installer = makeInstaller(skillLoader, ctx.projectRoot);
+      try {
+        await installer.uninstall(name, { global: isGlobal });
+        return { message: `\u2713 Skill "${name}" uninstalled.` };
+      } catch (err) {
+        const msg = toErrorMessage(err);
+        return { message: `\u2717 Uninstall failed: ${msg}` };
+      }
+    }
+  };
+}
+function formatCount(n) {
+  if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
+  if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
+  return String(n);
+}
+function truncate(s, max) {
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+
+// src/plugins/sync-plugin.ts
+import * as path8 from "node:path";
+function createSyncPlugin(opts) {
+  let cloud = null;
+  let configStore;
+  let vault;
+  return {
+    name: "wstack-sync",
+    version: "1.0.0",
+    description: "GitHub cloud sync for prompts, skills, settings, memory and history",
+    apiVersion: "^0.1",
+    capabilities: { slashCommands: true },
+    defaultConfig: {},
+    setup(api) {
+      const rawConfig = api.config;
+      const paths = opts?.paths ?? rawConfig.paths;
+      configStore = opts?.configStore ?? rawConfig.configStore;
+      vault = opts?.vault ?? rawConfig.vault;
+      if (!paths || !configStore || !paths.configDir) {
+        api.log.warn("[sync] paths, configStore, or configDir not available \u2014 /sync disabled");
+        return;
+      }
+      const syncConfigPath = paths.syncConfig ?? path8.join(paths.configDir, "sync.json");
+      cloud = new CloudSync(
+        paths,
+        () => {
+          const cfg = configStore?.get();
+          return cfg.sync;
+        },
+        async (cfg) => {
+          await persistSyncConfig(syncConfigPath, cfg, vault);
+          configStore?.update({ sync: cfg });
+        },
+        () => path8.join(paths.configDir, "config.json")
+      );
+      void cloud.loadState();
+      api.slashCommands.register(buildSyncCommand(cloud, configStore, vault, syncConfigPath));
+      api.log.info("[sync] loaded \u2014 /sync available. Run /sync to get started.");
+    },
+    teardown(api) {
+      api.slashCommands.unregister("sync");
+      api.log.info("[sync] unloaded");
+    },
+    async health() {
+      return { ok: true, message: "CloudSync ready" };
+    }
+  };
+}
+async function persistSyncConfig(syncConfigPath, cfg, vault) {
+  let githubToken = cfg.githubToken;
+  if (githubToken && !githubToken.startsWith("enc:")) {
+    if (!vault) {
+      throw new Error("Secure token storage is unavailable; refusing to persist a plaintext token.");
+    }
+    const encryptedToken = vault.encrypt(githubToken);
+    if (encryptedToken === githubToken || !encryptedToken.startsWith("enc:")) {
+      throw new Error("Secure token storage failed; refusing to persist a plaintext token.");
+    }
+    githubToken = encryptedToken;
+  }
+  await atomicWrite(syncConfigPath, JSON.stringify({ ...cfg, githubToken }, null, 2), { mode: 384 });
+}
+function buildSyncCommand(cloud, configStore, vault, syncConfigPath) {
+  const setSyncConfig = async (cfg) => {
+    await persistSyncConfig(syncConfigPath, cfg, vault);
+    configStore.update({ sync: cfg });
+  };
+  return {
+    name: "sync",
+    description: "Cloud sync: /sync [status|enable|disable|push|pull|categories]",
+    async run(args, _ctx) {
+      const [verb, ...rest] = args.trim().split(/\s+/);
+      const restJoined = rest.join(" ");
+      switch (verb) {
+        case "":
+        case "status": {
+          const msg = await cloud.status();
+          return { message: msg };
+        }
+        case "enable": {
+          const parts = restJoined.trim().split(/\s+/);
+          if (parts.length < 2) {
+            return {
+              message: [
+                "Usage: /sync enable owner/repo TOKEN [cat1 cat2 ...]",
+                "  e.g. /sync enable myname/wrongstack-data ghp_xxx",
+                `  Categories (default: all): ${ALL_SYNC_CATEGORIES.join(", ")}`
+              ].join("\n")
+            };
+          }
+          const [repo, token, ...cats] = parts;
+          if (!repo?.includes("/")) {
+            return { message: 'Invalid repo format. Expected "owner/repo".' };
+          }
+          if (!vault) {
+            return { message: "Secure token storage is unavailable; refusing to enable CloudSync." };
+          }
+          const invalidCategories = cats.filter(
+            (cat) => !ALL_SYNC_CATEGORIES.includes(cat)
+          );
+          if (invalidCategories.length > 0) {
+            return {
+              message: `Unknown categories: ${invalidCategories.join(", ")}. Available: ${ALL_SYNC_CATEGORIES.join(", ")}`
+            };
+          }
+          const syncConfig = {
+            enabled: true,
+            repo,
+            githubToken: expectDefined(token),
+            categories: cats.length > 0 ? cats : ALL_SYNC_CATEGORIES,
+            lastSyncedAt: void 0
+          };
+          await setSyncConfig(syncConfig);
+          await cloud.loadState();
+          return {
+            message: [
+              `CloudSync enabled for ${repo}`,
+              `  categories: ${syncConfig.categories.join(", ")}`,
+              "",
+              "Run `/sync push` to upload your data to GitHub."
+            ].join("\n")
+          };
+        }
+        case "disable": {
+          const msg = await cloud.disable();
+          return { message: msg };
+        }
+        case "push": {
+          const cfg = configStore.get().sync;
+          if (!cfg?.enabled) return { message: "CloudSync not enabled. Run `/sync enable`." };
+          if (!cfg?.githubToken) return { message: "No GitHub token found. Run `/sync enable owner/repo TOKEN`." };
+          let result;
+          try {
+            result = await cloud.push(cfg.githubToken);
+          } catch (err) {
+            return { message: `Push failed: ${toErrorMessage(err)}` };
+          }
+          if (result.ok) {
+            try {
+              await setSyncConfig({ ...cfg, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
+            } catch (err) {
+              return {
+                message: `${result.message}
+Warning: sync completed, but metadata persistence failed: ${toErrorMessage(err)}`
+              };
+            }
+          }
+          return { message: result.message };
+        }
+        case "pull": {
+          const cfg = configStore.get().sync;
+          if (!cfg?.enabled) return { message: "CloudSync not enabled. Run `/sync enable`." };
+          if (!cfg?.githubToken) return { message: "No GitHub token. Run `/sync enable owner/repo TOKEN`." };
+          let result;
+          try {
+            result = await cloud.pull(cfg.githubToken);
+          } catch (err) {
+            return { message: `Pull failed: ${toErrorMessage(err)}` };
+          }
+          if (result.ok) {
+            try {
+              await setSyncConfig({ ...cfg, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
+            } catch (err) {
+              return {
+                message: `${result.message}
+Warning: sync completed, but metadata persistence failed: ${toErrorMessage(err)}`
+              };
+            }
+          }
+          return { message: result.message };
+        }
+        case "categories": {
+          const [action, ...catRest] = restJoined.trim().split(/\s+/);
+          const cfg = configStore.get().sync;
+          if (!cfg?.enabled) return { message: "CloudSync not enabled. Run `/sync enable`." };
+          if (action === "list" || !action) {
+            return {
+              message: [
+                `Synced categories: ${cfg.categories.join(", ")}`,
+                `Available: ${ALL_SYNC_CATEGORIES.join(", ")}`,
+                "Update: /sync categories add <name> | remove <name>"
+              ].join("\n")
+            };
+          }
+          if (action === "add") {
+            const catName = catRest[0];
+            if (!ALL_SYNC_CATEGORIES.includes(catName)) {
+              return { message: `Unknown. Available: ${ALL_SYNC_CATEGORIES.join(", ")}` };
+            }
+            if (cfg.categories.includes(catName)) return { message: `"${catName}" already synced.` };
+            await setSyncConfig({ ...cfg, categories: [...cfg.categories, catName] });
+            return { message: `Added "${catName}" to sync categories.` };
+          }
+          if (action === "remove") {
+            const catName = catRest[0];
+            if (!cfg.categories.includes(catName)) return { message: `"${catName}" not in sync categories.` };
+            await setSyncConfig({
+              ...cfg,
+              categories: cfg.categories.filter((c) => c !== catName)
+            });
+            return { message: `Removed "${catName}" from sync categories.` };
+          }
+          return { message: "Usage: /sync categories list | add <name> | remove <name>" };
+        }
+        default:
+          return {
+            message: [
+              "/sync \u2014 Cloud Sync",
+              "",
+              "  /sync status                    Show current sync status",
+              "  /sync enable owner/repo TOKEN    Enable for a repo (TOKEN = fine-grained PAT)",
+              "  /sync disable                   Disable sync (keeps local data)",
+              "  /sync push                      Upload selected categories",
+              "  /sync pull                      Download from repo",
+              "  /sync categories list|add|remove  Manage synced categories",
+              "",
+              `Categories: ${ALL_SYNC_CATEGORIES.join(", ")}`
+            ].join("\n")
+          };
+      }
+    }
+  };
+}
+
+export {
+  KERNEL_API_VERSION,
+  loadPlugins,
+  unloadPlugins,
+  DefaultPluginAPI,
+  definePlugin,
+  buildReviewerModelPool,
+  selectRoundRobinReviewerAssignment,
+  parseReviewSeverity,
+  recordStartedReview,
+  recordCompletedReview,
+  emitReviewIfChanged,
+  createAutoReviewPlugin,
+  executeFindingCommand,
+  transitionReport,
+  resolveChimeraConfig,
+  CHIMERA_REVIEW_PROMPT,
+  createChimeraPlugin,
+  createCloudConfigSyncPlugin,
+  createPromptsPlugin,
+  createSkillsPlugin,
+  createSyncPlugin
+};
+//# sourceMappingURL=chunk-3AGWVSS7.js.map