@wrongstack/core 0.4.0 → 0.5.0

package/dist/defaults/index.js

@@ -1167,7 +1167,15 @@ var ENV_MAP = {
 function isPrimitiveArray(a) {
   return a.every((v) => v === null || typeof v !== "object");
 }
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
 function deepMerge(base, patch) {
   if (typeof base !== "object" || base === null) return patch ?? base;
   if (typeof patch !== "object" || patch === null) return base;
@@ -2197,12 +2205,15 @@ var PATTERNS = [
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
   {
     type: "bearer_token",
-    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,}=*(?![A-Za-z0-9_.~+/-])/g
+    // Bounded at 512 chars to prevent catastrophic backtracking on adversarial input.
+    // Negative lookahead is a simple single-char check — no backtracking risk.
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,512}=*(?![A-Za-z0-9_.~+/-])/g
   },
   {
     type: "high_entropy_env",
-    // Value-side word boundary + length gate to avoid matching short random strings
-    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,})['"]?(?!\s*[A-Za-z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))/g
+    // Value bounded at 512 chars; negative lookahead simplified to avoid
+    // nested quantifier backtracking on adversarial input.
+    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?/g
   }
 ];
 var SCRUB_CHUNK_BYTES = 64 * 1024;
@@ -2415,7 +2426,7 @@ function walkCount(node, vault, counter) {
   if (Array.isArray(node)) {
     return node.map((item) => walkCount(item, vault, counter));
   }
-  const out = {};
+  const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
     if (typeof v === "string" && isSecretField2(k) && !vault.isEncrypted(v) && v.length > 0) {
       out[k] = vault.encrypt(v);
@@ -2428,7 +2439,15 @@ function walkCount(node, vault, counter) {
   }
   return out;
 }
-var FORBIDDEN_PROTO_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_PROTO_KEYS2 = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
 function deepMerge2(a, b) {
   const out = { ...a };
   for (const [k, v] of Object.entries(b)) {
@@ -2568,6 +2587,14 @@ var DefaultPermissionPolicy = class {
   setPromptDelegate(delegate) {
     this.promptDelegate = delegate;
   }
+  /** Toggle YOLO (auto-approve) mode at runtime. */
+  setYolo(enabled) {
+    this.yolo = enabled;
+  }
+  /** Check whether YOLO mode is currently active. */
+  getYolo() {
+    return this.yolo;
+  }
   async reload() {
     try {
       const raw = await fsp.readFile(this.trustFile, "utf8");
@@ -3032,6 +3059,9 @@ var DefaultSkillLoader = class {
     }
     return entries;
   }
+  invalidateCache() {
+    this.cache = void 0;
+  }
   async readBody(name) {
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
@@ -3417,6 +3447,54 @@ function estimateToolResultTokens(content) {
 function estimateTextTokens(text) {
   return RoughTokenEstimate(text);
 }
+function estimateToolDefTokens(tool) {
+  return RoughTokenEstimate(tool.name) + RoughTokenEstimate(tool.description ?? "") + RoughTokenEstimate(JSON.stringify(tool.inputSchema));
+}
+function estimateRequestTokens(messages, systemPrompt, tools) {
+  let messagesTokens = 0;
+  if (typeof messages === "string") {
+    messagesTokens = RoughTokenEstimate(messages);
+  } else if (Array.isArray(messages)) {
+    for (const m of messages) {
+      if (typeof m === "object" && m !== null && "content" in m) {
+        const content = m.content;
+        if (typeof content === "string") {
+          messagesTokens += RoughTokenEstimate(content);
+        } else if (Array.isArray(content)) {
+          for (const b of content) {
+            if (typeof b === "object" && b !== null) {
+              if (b.type === "text") {
+                messagesTokens += RoughTokenEstimate(b.text);
+              } else {
+                messagesTokens += RoughTokenEstimate(JSON.stringify(b));
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  let systemTokens = 0;
+  if (typeof systemPrompt === "string") {
+    systemTokens = RoughTokenEstimate(systemPrompt);
+  } else if (Array.isArray(systemPrompt)) {
+    for (const b of systemPrompt) {
+      if (typeof b === "object" && b !== null && b.type === "text") {
+        systemTokens += RoughTokenEstimate(b.text);
+      }
+    }
+  }
+  let toolsTokens = 0;
+  for (const t of tools) {
+    toolsTokens += estimateToolDefTokens(t);
+  }
+  return {
+    messages: messagesTokens,
+    systemPrompt: systemTokens,
+    tools: toolsTokens,
+    total: messagesTokens + systemTokens + toolsTokens
+  };
+}
 
 // src/execution/compactor.ts
 var HybridCompactor = class {
@@ -4164,11 +4242,12 @@ Summarize the following message range:`;
 var AutoCompactionMiddleware = class {
   name = "AutoCompaction";
   compactor;
+  estimator;
   warnThreshold;
   softThreshold;
   hardThreshold;
-  maxContext;
-  estimator;
+  /** Writable so model-switch can update the denominator without re-registering the middleware. */
+  _maxContext;
   aggressiveOn;
   events;
   failureMode;
@@ -4187,7 +4266,7 @@ var AutoCompactionMiddleware = class {
   constructor(compactor, maxContext, estimator, thresholds, optsOrAggressiveOn = {}, events) {
     const opts = typeof optsOrAggressiveOn === "string" ? { aggressiveOn: optsOrAggressiveOn, events } : optsOrAggressiveOn;
     this.compactor = compactor;
-    this.maxContext = maxContext;
+    this._maxContext = maxContext;
     this.estimator = estimator;
     this.warnThreshold = thresholds.warn;
     this.softThreshold = thresholds.soft;
@@ -4197,10 +4276,15 @@ var AutoCompactionMiddleware = class {
     this.failureMode = opts.failureMode ?? "throw_on_hard";
     this.policyProvider = opts.policyProvider;
   }
+  /** Allow callers (e.g. model-switch in WebUI) to update the context window
+   *  denominator when the active model changes. */
+  setMaxContext(maxContext) {
+    this._maxContext = maxContext;
+  }
   handler() {
     return async (ctx, next) => {
       const tokens = this.estimator(ctx);
-      const load = tokens / this.maxContext;
+      const load = tokens / this._maxContext;
       const policy = this.policyProvider?.(ctx);
       const thresholds = policy?.thresholds ?? {
         warn: this.warnThreshold,
@@ -4229,7 +4313,7 @@ var AutoCompactionMiddleware = class {
         aggressive,
         level: pressure.level,
         tokens: pressure.tokens,
-        maxContext: this.maxContext,
+        maxContext: this._maxContext,
         load: pressure.load,
         fatal
       });
@@ -4241,7 +4325,7 @@ var AutoCompactionMiddleware = class {
           context: {
             level: pressure.level,
             tokens: pressure.tokens,
-            maxContext: this.maxContext
+            maxContext: this._maxContext
           },
           cause: err
         });
@@ -4989,7 +5073,9 @@ var FleetBus = class {
       "session.damaged",
       "compaction.fired",
       "compaction.failed",
-      "token.threshold"
+      "token.threshold",
+      // Subagent hit a soft budget limit — coordinator can extend or stop.
+      "budget.threshold_reached"
     ];
     const offs = [];
     for (const t of FORWARDED_TYPES) {
@@ -5150,6 +5236,21 @@ var BudgetExceededError = class extends Error {
     this.observed = observed;
   }
 };
+var BudgetThresholdSignal = class extends Error {
+  kind;
+  limit;
+  used;
+  /** Resolves to 'extend' (with optional new limits) or 'stop' */
+  decision;
+  constructor(kind, limit, used, decision) {
+    super(`Budget soft limit: ${kind} (limit=${limit}, used=${used})`);
+    this.name = "BudgetThresholdSignal";
+    this.kind = kind;
+    this.limit = limit;
+    this.used = used;
+    this.decision = decision;
+  }
+};
 var SubagentBudget = class {
   limits;
   iterations = 0;
@@ -5158,22 +5259,111 @@ var SubagentBudget = class {
   tokenOutput = 0;
   costUsd = 0;
   startTime = null;
+  _onThreshold;
+  /**
+   * Injected by the runner when wiring the budget to its EventBus.
+   * Used by `checkLimitAsync` to emit `budget.threshold_reached` events.
+   */
+  _events;
+  /**
+   * Optional callback for soft-limit handling. When set, the budget will
+   * call this instead of throwing when a limit is first reached. The
+   * handler decides whether to throw, continue, or ask the coordinator.
+   */
+  get onThreshold() {
+    return this._onThreshold;
+  }
+  set onThreshold(fn) {
+    this._onThreshold = fn;
+  }
   constructor(limits = {}) {
     this.limits = Object.freeze({ ...limits });
   }
   start() {
     this.startTime = Date.now();
   }
+  /** Returns true if we're within 10% of any limit — useful for pre-flight checks. */
+  isNearLimit() {
+    const { maxIterations, maxToolCalls, maxTokens, maxCostUsd } = this.limits;
+    if (maxIterations && this.iterations >= maxIterations * 0.9) return true;
+    if (maxToolCalls && this.toolCalls >= maxToolCalls * 0.9) return true;
+    if (maxTokens && this.tokenInput + this.tokenOutput >= maxTokens * 0.9) return true;
+    if (maxCostUsd && this.costUsd >= maxCostUsd * 0.9) return true;
+    return false;
+  }
+  /**
+   * Synchronous budget check — always throws synchronously so callers
+   * (especially test event handlers using `expect().toThrow()`) get an
+   * unhandled rejection when the budget is exceeded without a handler.
+   * When `onThreshold` IS configured, the actual async threshold-handling
+   * is dispatched as a fire-and-forget promise.
+   */
+  checkLimit(kind, used, limit) {
+    if (kind === "timeout" || !this._onThreshold) {
+      throw new BudgetExceededError(kind, limit, used);
+    }
+    void this.checkLimitAsync(kind, used, limit);
+  }
+  /**
+   * Async threshold negotiation with the coordinator. Fire-and-forget —
+   * any error thrown here becomes an unhandled rejection in the test environment
+   * because the runner's catch only handles the synchronous throw from `checkLimit`.
+   */
+  async checkLimitAsync(kind, used, limit) {
+    const result = this._onThreshold({
+      kind,
+      used,
+      limit,
+      // Inject a requestDecision helper the handler can call to emit the
+      // budget.threshold_reached event and wait for the coordinator's verdict.
+      // The runner wires this by injecting its EventBus into ctx.budget._events.
+      requestDecision: () => {
+        return new Promise((resolve2) => {
+          this._events?.emit("budget.threshold_reached", {
+            kind,
+            used,
+            limit,
+            timeoutMs: 3e4,
+            extend: (extra) => resolve2({ extend: extra }),
+            deny: () => resolve2("stop")
+          });
+        });
+      }
+    });
+    if (result === "throw") {
+      throw new BudgetExceededError(kind, limit, used);
+    }
+    if (result === "continue") {
+      return;
+    }
+    const decision = await result;
+    if (decision === "stop") {
+      throw new BudgetExceededError(kind, limit, used);
+    }
+    const ext = decision.extend;
+    if (ext.maxIterations !== void 0) {
+      this.limits.maxIterations = ext.maxIterations;
+    }
+    if (ext.maxToolCalls !== void 0) {
+      this.limits.maxToolCalls = ext.maxToolCalls;
+    }
+    if (ext.maxTokens !== void 0) {
+      this.limits.maxTokens = ext.maxTokens;
+    }
+    if (ext.maxCostUsd !== void 0) {
+      this.limits.maxCostUsd = ext.maxCostUsd;
+    }
+  }
   recordIteration() {
     this.iterations++;
     if (this.limits.maxIterations !== void 0 && this.iterations > this.limits.maxIterations) {
-      throw new BudgetExceededError("iterations", this.limits.maxIterations, this.iterations);
+      void this.checkLimit("iterations", this.iterations, this.limits.maxIterations);
     }
   }
   recordToolCall() {
     this.toolCalls++;
     if (this.limits.maxToolCalls !== void 0 && this.toolCalls > this.limits.maxToolCalls) {
-      throw new BudgetExceededError("tool_calls", this.limits.maxToolCalls, this.toolCalls);
+      void this.checkLimit("tool_calls", this.toolCalls, this.limits.maxToolCalls);
     }
   }
   recordUsage(usage, costUsd = 0) {
@@ -5182,10 +5372,10 @@ var SubagentBudget = class {
     this.costUsd += costUsd;
     const totalTokens = this.tokenInput + this.tokenOutput;
     if (this.limits.maxTokens !== void 0 && totalTokens > this.limits.maxTokens) {
-      throw new BudgetExceededError("tokens", this.limits.maxTokens, totalTokens);
+      void this.checkLimit("tokens", totalTokens, this.limits.maxTokens);
     }
     if (this.limits.maxCostUsd !== void 0 && this.costUsd > this.limits.maxCostUsd) {
-      throw new BudgetExceededError("cost", this.limits.maxCostUsd, this.costUsd);
+      void this.checkLimit("cost", this.costUsd, this.limits.maxCostUsd);
     }
   }
   /**
@@ -5219,6 +5409,198 @@ var SubagentBudget = class {
   }
 };
 
+// src/coordination/fleet.ts
+var AUDIT_LOG_AGENT = {
+  id: "audit-log",
+  name: "Audit Log",
+  role: "audit-log",
+  prompt: `You are the Audit Log agent. Your job is to analyze structured JSONL
+session logs and produce actionable markdown reports.
+
+Scope:
+- Parse session logs (iteration counts, tool calls, errors, usage)
+- Detect repeated failure patterns across multiple runs
+- Identify tool usage anomalies (over-use, failures, unexpected chains)
+- Track token consumption trends
+- Generate structured audit reports with severity ratings
+
+Input format you accept:
+{ "task": "analyze | report | trends", "sessionPath": "<path>", "focus": "errors | tools | usage | all" }
+
+Output: Markdown audit report with sections:
+- ## Summary (totals, error rate)
+- ## Top Errors (count + context)
+- ## Tool Usage (table with calls, failures, avg duration)
+- ## Anomalies (pattern \u2192 severity)
+
+Working rules:
+- Never fabricate numbers \u2014 read the actual logs first
+- Always include file:line references for errors
+- If sessionPath is missing, ask the director to provide it
+- Report confidence level: high (>90% accuracy), medium, low`
+  // No hardcoded budgets — the orchestrator (delegate tool or
+  // spawn_subagent) decides per-task how much room a subagent gets.
+  // A monorepo audit needs hours; a single-file lint check needs
+  // seconds. Pinning a number here forces the orchestrator to fight
+  // the role's default instead of just asking for what it needs.
+};
+var BUG_HUNTER_AGENT = {
+  id: "bug-hunter",
+  name: "Bug Hunter",
+  role: "bug-hunter",
+  prompt: `You are the Bug Hunter agent. Your job is to systematically scan
+source code for bugs, anti-patterns, and code smells using pattern matching
+and heuristics. Output a prioritized hit list with file:line references.
+
+Scope:
+- Detect common bug patterns (uncaught errors, resource leaks, race conditions)
+- Identify anti-patterns (callback hell, God objects, circular deps)
+- Find TypeScript-specific issues (unsafe any, missing null checks, branded types)
+- Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
+- Rank findings: critical > high > medium > low
+
+Input format you accept:
+{ "task": "scan | hunt | check", "paths": ["src/**/*.ts"], "focus": "bugs | patterns | security | all", "severityThreshold": "medium" }
+
+Output: Markdown bug hunt report:
+- ## Critical (must fix first)
+- ## High (should fix)
+- ## Medium
+- ## Low (consider)
+Each entry: **[TYPE]** \`file:line\` \u2014 description + suggested fix
+
+Bug pattern reference you know:
+| Pattern | Regex hint | Severity |
+|---------|------------|----------|
+| Uncaught promise | /.then\\(.*\\)/ without catch | high |
+| Event leak | on\\( without off/removeListener | high |
+| Hardcoded secret | [a-zA-Z0-9/_-]{20,} in config files | critical |
+| unsafe any | : any\\b or <any> | medium |
+| innerHTML | innerHTML\\s*= | high |
+
+Working rules:
+- Never scan node_modules \u2014 it's noise
+- Always include file:line for every finding
+- If >30% of findings are false positives, note the confidence level
+- Ask director for clarification if paths are ambiguous`
+  // Budgets are set by the orchestrator per task — see fleet.ts header.
+};
+var REFACTOR_PLANNER_AGENT = {
+  id: "refactor-planner",
+  name: "Refactor Planner",
+  role: "refactor-planner",
+  prompt: `You are the Refactor Planner agent. Your job is to analyze code
+structure and produce a concrete, phased refactoring plan with risk
+assessment, dependency ordering, and rollback strategy.
+
+Scope:
+- Map module-level dependencies (import graph)
+- Identify coupling hotspots (high fan-in/out modules)
+- Assess refactoring risk by complexity and test coverage
+- Generate phased plans with checkpoint milestones
+- Produce diff-friendly task lists (one task = one concern)
+
+Input format you accept:
+{ "task": "plan | assess | roadmap", "target": "src/core", "constraint": "no-breaking-changes | minimal-downtime | full-rewrite", "focus": "architecture | performance | maintainability" }
+
+Output: Markdown refactor plan:
+- ## Phase 1: Low Risk / High Payoff (do first)
+  Table: | # | Task | Module | Risk | Est. Time |
+- ## Phase 2: Medium Risk
+- ## Phase 3: High Risk (requires full regression)
+- ## Dependency Graph (abbreviated ASCII)
+- ## Rollback Strategy
+- ## Exit Criteria (checkbox list)
+
+Risk scoring criteria:
+| Factor | Low | Medium | High |
+|--------|-----|--------|------|
+| Cyclomatic complexity | <10 | 10-20 | >20 |
+| Test coverage | >80% | 50-80% | <50% |
+| Fan-out (imports) | <5 | 5-15 | >15 |
+
+Working rules:
+- Always include rollback strategy \u2014 every refactor can fail
+- Merge tasks that take <1h into a single phase
+- Respect team constraints (reviewer availability, parallelization)
+- Never plan without analyzing the actual code first`
+  // Budgets are set by the orchestrator per task — see fleet.ts header.
+};
+var SECURITY_SCANNER_AGENT = {
+  id: "security-scanner",
+  name: "Security Scanner",
+  role: "security-scanner",
+  prompt: `You are the Security Scanner agent. Your job is to scan code,
+configs, and dependencies for security issues from hardcoded secrets to
+supply chain risks.
+
+Scope:
+- Detect hardcoded secrets: API keys, tokens, passwords, private keys
+- Find injection vectors: eval, innerHTML, SQL concat, shell injection
+- Identify insecure patterns: weak crypto, hardcoded IVs, disabled TLS
+- Scan dependencies for known CVEs (via npm/pnpm audit)
+- Flag supply chain risks: postinstall hooks, unverified scripts, .npmrc
+
+Input format you accept:
+{ "task": "scan | audit | secrets | dependencies", "paths": ["src", "config"], "depth": "quick | normal | deep" }
+
+Output: Markdown security report:
+- ## CRITICAL: Secrets Found (with code snippets)
+- ## HIGH: Injection Vectors
+- ## MEDIUM: Insecure Patterns
+- ## Dependency Issues (CVE list)
+- ## Summary table (severity \u2192 count)
+- ## Remediation Checklist (with checkboxes)
+
+Secret patterns you detect:
+| Pattern | Example | Severity |
+|---------|---------|----------|
+| AWS Access Key | AKIAIOSFODNN7EXAMPLE | critical |
+| AWS Secret Key | [a-zA-Z0-9/+=]{40} base64 | critical |
+| GitHub Token | ghp_[a-zA-Z0-9]{36} | critical |
+| Private Key PEM | -----BEGIN.*PRIVATE KEY----- | critical |
+| JWT | eyJ[a-zA-Z0-9_-]+ | high |
+
+Injection patterns:
+| Construct | Safe alternative |
+|-----------|-----------------|
+| eval(str) | new Function() or parse |
+| innerHTML = x | textContent or sanitize |
+| exec(\`cmd \${x}\`) | execFile with args array |
+
+Working rules:
+- Never scan node_modules \u2014 use npm audit instead
+- Always provide remediation steps, not just findings
+- Verify regex-based secrets before flagging (false positive risk)
+- When in doubt, flag as medium rather than ignoring potential issues`
+  // Budgets are set by the orchestrator per task — see fleet.ts header.
+};
+var FLEET_ROSTER = {
+  "audit-log": AUDIT_LOG_AGENT,
+  "bug-hunter": BUG_HUNTER_AGENT,
+  "refactor-planner": REFACTOR_PLANNER_AGENT,
+  "security-scanner": SECURITY_SCANNER_AGENT
+};
+var FLEET_ROSTER_BUDGETS = {
+  "audit-log": { timeoutMs: 5 * 60 * 1e3, maxIterations: 80, maxToolCalls: 300 },
+  "bug-hunter": { timeoutMs: 10 * 60 * 1e3, maxIterations: 120, maxToolCalls: 400 },
+  "refactor-planner": { timeoutMs: 8 * 60 * 1e3, maxIterations: 100, maxToolCalls: 350 },
+  "security-scanner": { timeoutMs: 10 * 60 * 1e3, maxIterations: 120, maxToolCalls: 400 }
+};
+function applyRosterBudget(cfg) {
+  const defaultBudget = FLEET_ROSTER_BUDGETS[cfg.role ?? ""];
+  if (!defaultBudget) return cfg;
+  return {
+    ...cfg,
+    timeoutMs: cfg.timeoutMs ?? defaultBudget.timeoutMs,
+    maxIterations: cfg.maxIterations ?? defaultBudget.maxIterations,
+    maxToolCalls: cfg.maxToolCalls ?? defaultBudget.maxToolCalls,
+    maxTokens: cfg.maxTokens ?? defaultBudget.maxTokens,
+    maxCostUsd: cfg.maxCostUsd ?? defaultBudget.maxCostUsd
+  };
+}
+var ALL_FLEET_AGENTS = Object.values(FLEET_ROSTER);
+
 // src/coordination/multi-agent-coordinator.ts
 var DefaultMultiAgentCoordinator = class extends EventEmitter {
   coordinatorId;
@@ -5459,12 +5841,13 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
     task.subagentId = subagentId;
     subagent.context.tasks.push(task);
     this.emit("task.assigned", { task, subagentId });
+    const configWithRosterDefaults = applyRosterBudget(subagent.config);
     const budget = new SubagentBudget({
-      maxIterations: subagent.config.maxIterations ?? this.config.defaultBudget?.maxIterations,
-      maxToolCalls: task.maxToolCalls ?? subagent.config.maxToolCalls ?? this.config.defaultBudget?.maxToolCalls,
-      maxTokens: subagent.config.maxTokens ?? this.config.defaultBudget?.maxTokens,
-      maxCostUsd: subagent.config.maxCostUsd ?? this.config.defaultBudget?.maxCostUsd,
-      timeoutMs: task.timeoutMs ?? subagent.config.timeoutMs ?? this.config.defaultBudget?.timeoutMs
+      maxIterations: configWithRosterDefaults.maxIterations ?? this.config.defaultBudget?.maxIterations,
+      maxToolCalls: task.maxToolCalls ?? configWithRosterDefaults.maxToolCalls ?? this.config.defaultBudget?.maxToolCalls,
+      maxTokens: configWithRosterDefaults.maxTokens ?? this.config.defaultBudget?.maxTokens,
+      maxCostUsd: configWithRosterDefaults.maxCostUsd ?? this.config.defaultBudget?.maxCostUsd,
+      timeoutMs: task.timeoutMs ?? configWithRosterDefaults.timeoutMs ?? this.config.defaultBudget?.timeoutMs
     });
     subagent.activeBudget = budget;
     if (!this.runner) {
@@ -6002,6 +6385,36 @@ var Director = class {
       this.scheduleManifest();
     };
     this.coordinator.on("task.completed", this.taskCompletedListener);
+    const extendCounts = /* @__PURE__ */ new Map();
+    this.fleet.filter("budget.threshold_reached", (e) => {
+      const payload = e.payload;
+      const guardKey = `${e.subagentId}:${payload.kind}`;
+      const prior = extendCounts.get(guardKey) ?? 0;
+      if (prior >= 2) {
+        payload.deny();
+        extendCounts.delete(guardKey);
+        return;
+      }
+      extendCounts.set(guardKey, prior + 1);
+      setTimeout(() => {
+        const extra = {};
+        switch (payload.kind) {
+          case "iterations":
+            extra.maxIterations = Math.min(payload.used + 50, 500);
+            break;
+          case "tool_calls":
+            extra.maxToolCalls = Math.min(Math.ceil(payload.limit * 1.5), 1e3);
+            break;
+          case "tokens":
+            extra.maxTokens = Math.min(Math.ceil(payload.limit * 1.5), 5e5);
+            break;
+          case "cost":
+            extra.maxCostUsd = Math.min(payload.limit * 1.5, 10);
+            break;
+        }
+        payload.extend(extra);
+      }, Math.min(payload.timeoutMs, 3e4));
+    });
   }
   /** Best-effort session-writer append. Swallows failures — the director
    *  must not break a fleet run because the session JSONL handle closed. */
@@ -6461,65 +6874,68 @@ function createDelegateTool(opts) {
       if (typeof i.task !== "string" || !i.task.trim()) {
         return { ok: false, error: "`task` is required." };
       }
-      let director = await opts.host.ensureDirector();
-      if (!director) {
-        director = await opts.host.promoteToDirector();
-      }
-      if (!director) {
-        const reason = opts.host.getPromotionBlockReason?.();
-        return {
-          ok: false,
-          error: reason ?? "Director could not be activated \u2014 multi-agent host already running in legacy non-director mode. Restart with `--director` for fleet support."
-        };
-      }
-      const timeoutMs = i.timeoutMs ?? defaultTimeoutMs;
-      let cfg;
-      if (i.role) {
-        const base = opts.roster?.[i.role];
-        if (!base) {
-          return {
-            ok: false,
-            error: `Unknown role "${i.role}". Available: ${rosterIds.join(", ") || "(no roster configured)"}.`
-          };
+      try {
+        let director = await opts.host.ensureDirector();
+        if (!director) {
+          director = await opts.host.promoteToDirector();
         }
-        cfg = instantiateRosterConfig2(i.role, base);
-        if (i.systemPromptOverride) cfg.systemPromptOverride = i.systemPromptOverride;
-        if (i.provider) cfg.provider = i.provider;
-        if (i.model) cfg.model = i.model;
-      } else {
-        if (!i.name) {
+        if (!director) {
+          const reason = opts.host.getPromotionBlockReason?.();
           return {
             ok: false,
-            error: "Either `role` (from the roster) or `name` is required."
+            error: reason ?? "Director could not be activated \u2014 multi-agent host already running in legacy non-director mode. Restart with `--director` for fleet support."
           };
         }
-        cfg = {
-          name: i.name,
-          provider: i.provider,
-          model: i.model,
-          systemPromptOverride: i.systemPromptOverride
-        };
-      }
-      if (typeof i.maxIterations === "number" && i.maxIterations > 0) {
-        cfg.maxIterations = i.maxIterations;
-      }
-      if (typeof i.maxToolCalls === "number" && i.maxToolCalls > 0) {
-        cfg.maxToolCalls = i.maxToolCalls;
-      }
-      const SUBAGENT_TIMEOUT_BUFFER_MS = 3e4;
-      const desiredSubTimeout = Math.max(3e4, timeoutMs - SUBAGENT_TIMEOUT_BUFFER_MS);
-      if (!cfg.timeoutMs || cfg.timeoutMs > desiredSubTimeout) {
-        cfg.timeoutMs = desiredSubTimeout;
-      }
-      try {
+        const timeoutMs = i.timeoutMs ?? defaultTimeoutMs;
+        let cfg;
+        if (i.role) {
+          const base = opts.roster?.[i.role];
+          if (!base) {
+            return {
+              ok: false,
+              error: `Unknown role "${i.role}". Available: ${rosterIds.join(", ") || "(no roster configured)"}.`
+            };
+          }
+          cfg = instantiateRosterConfig2(i.role, base);
+          if (i.systemPromptOverride) cfg.systemPromptOverride = i.systemPromptOverride;
+          if (i.provider) cfg.provider = i.provider;
+          if (i.model) cfg.model = i.model;
+        } else {
+          if (!i.name) {
+            return {
+              ok: false,
+              error: "Either `role` (from the roster) or `name` is required."
+            };
+          }
+          cfg = {
+            name: i.name,
+            provider: i.provider,
+            model: i.model,
+            systemPromptOverride: i.systemPromptOverride
+          };
+        }
+        if (typeof i.maxIterations === "number" && i.maxIterations > 0) {
+          cfg.maxIterations = i.maxIterations;
+        }
+        if (typeof i.maxToolCalls === "number" && i.maxToolCalls > 0) {
+          cfg.maxToolCalls = i.maxToolCalls;
+        }
+        const SUBAGENT_TIMEOUT_BUFFER_MS = 3e4;
+        const desiredSubTimeout = Math.max(3e4, timeoutMs - SUBAGENT_TIMEOUT_BUFFER_MS);
+        if (!cfg.timeoutMs || cfg.timeoutMs > desiredSubTimeout) {
+          cfg.timeoutMs = desiredSubTimeout;
+        }
         const subagentId = await director.spawn(cfg);
         const taskId = await director.assign({
-          id: "",
+          id: `${randomUUID()}`,
           description: i.task,
           subagentId
         });
         const result = await Promise.race([
-          director.awaitTasks([taskId]).then((r) => r[0]),
+          director.awaitTasks([taskId]).then((r) => {
+            if (!r[0]) throw new Error(`Task "${taskId}" not found in completed results`);
+            return r[0];
+          }),
           new Promise(
             (resolve2) => setTimeout(() => resolve2({ __timeout: true }), timeoutMs)
           )
@@ -6593,7 +7009,7 @@ function hintForKind(kind, retryable, backoffMs) {
     case "budget_tool_calls":
     case "budget_tokens":
     case "budget_cost":
-      return "Subagent exhausted its budget. Raise the matching `max*` field on the next delegate or narrow task scope.";
+      return "Subagent exhausted its budget. The coordinator may auto-extend; otherwise raise the matching `max*` field (e.g. maxToolCalls: 600) on the next delegate, or split the task.";
     case "budget_timeout":
       return "Subagent hit its wall-clock budget. Raise `timeoutMs` on the next delegate or split the task.";
     case "aborted_by_parent":
@@ -6666,8 +7082,21 @@ function makeAgentSubagentRunner(opts) {
     const { agent, events } = factoryResult;
     const detachFleet = opts.fleetBus?.attach(ctx.subagentId, events, task.id);
     const aborter = new AbortController();
+    ctx.budget._events = events;
     let budgetError = null;
     const onBudgetError = (err) => {
+      if (err instanceof BudgetThresholdSignal) {
+        err.decision.then((decision) => {
+          if (decision === "stop") {
+            budgetError = new BudgetExceededError(err.kind, err.limit, err.used);
+            aborter.abort();
+          }
+        }).catch(() => {
+          budgetError = new BudgetExceededError(err.kind, err.limit, err.used);
+          aborter.abort();
+        });
+        return;
+      }
       aborter.abort();
       budgetError = err instanceof BudgetExceededError ? err : new BudgetExceededError(
         "tool_calls",
@@ -6697,7 +7126,7 @@ function makeAgentSubagentRunner(opts) {
         try {
           ctx.budget.recordUsage(e.usage);
         } catch (e2) {
-          onBudgetError(e2);
+          void onBudgetError(e2);
         }
       }),
       events.on("iteration.started", () => {
@@ -6705,7 +7134,7 @@ function makeAgentSubagentRunner(opts) {
           ctx.budget.recordIteration();
           ctx.budget.checkTimeout();
         } catch (e) {
-          onBudgetError(e);
+          void onBudgetError(e);
         }
       }),
       // D3: cooperative timeout enforcement DURING a long tool call.
@@ -6725,7 +7154,7 @@ function makeAgentSubagentRunner(opts) {
         try {
           ctx.budget.checkTimeout();
         } catch (e) {
-          onBudgetError(e);
+          void onBudgetError(e);
         }
       })
     );
@@ -6799,180 +7228,6 @@ function makeDirectorSessionFactory(opts) {
     }
   };
 }
-
-// src/coordination/fleet.ts
-var AUDIT_LOG_AGENT = {
-  id: "audit-log",
-  name: "Audit Log",
-  role: "audit-log",
-  prompt: `You are the Audit Log agent. Your job is to analyze structured JSONL
-session logs and produce actionable markdown reports.
-
-Scope:
-- Parse session logs (iteration counts, tool calls, errors, usage)
-- Detect repeated failure patterns across multiple runs
-- Identify tool usage anomalies (over-use, failures, unexpected chains)
-- Track token consumption trends
-- Generate structured audit reports with severity ratings
-
-Input format you accept:
-{ "task": "analyze | report | trends", "sessionPath": "<path>", "focus": "errors | tools | usage | all" }
-
-Output: Markdown audit report with sections:
-- ## Summary (totals, error rate)
-- ## Top Errors (count + context)
-- ## Tool Usage (table with calls, failures, avg duration)
-- ## Anomalies (pattern \u2192 severity)
-
-Working rules:
-- Never fabricate numbers \u2014 read the actual logs first
-- Always include file:line references for errors
-- If sessionPath is missing, ask the director to provide it
-- Report confidence level: high (>90% accuracy), medium, low`
-  // No hardcoded budgets — the orchestrator (delegate tool or
-  // spawn_subagent) decides per-task how much room a subagent gets.
-  // A monorepo audit needs hours; a single-file lint check needs
-  // seconds. Pinning a number here forces the orchestrator to fight
-  // the role's default instead of just asking for what it needs.
-};
-var BUG_HUNTER_AGENT = {
-  id: "bug-hunter",
-  name: "Bug Hunter",
-  role: "bug-hunter",
-  prompt: `You are the Bug Hunter agent. Your job is to systematically scan
-source code for bugs, anti-patterns, and code smells using pattern matching
-and heuristics. Output a prioritized hit list with file:line references.
-
-Scope:
-- Detect common bug patterns (uncaught errors, resource leaks, race conditions)
-- Identify anti-patterns (callback hell, God objects, circular deps)
-- Find TypeScript-specific issues (unsafe any, missing null checks, branded types)
-- Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
-- Rank findings: critical > high > medium > low
-
-Input format you accept:
-{ "task": "scan | hunt | check", "paths": ["src/**/*.ts"], "focus": "bugs | patterns | security | all", "severityThreshold": "medium" }
-
-Output: Markdown bug hunt report:
-- ## Critical (must fix first)
-- ## High (should fix)
-- ## Medium
-- ## Low (consider)
-Each entry: **[TYPE]** \`file:line\` \u2014 description + suggested fix
-
-Bug pattern reference you know:
-| Pattern | Regex hint | Severity |
-|---------|------------|----------|
-| Uncaught promise | /.then\\(.*\\)/ without catch | high |
-| Event leak | on\\( without off/removeListener | high |
-| Hardcoded secret | [a-zA-Z0-9/_-]{20,} in config files | critical |
-| unsafe any | : any\\b or <any> | medium |
-| innerHTML | innerHTML\\s*= | high |
-
-Working rules:
-- Never scan node_modules \u2014 it's noise
-- Always include file:line for every finding
-- If >30% of findings are false positives, note the confidence level
-- Ask director for clarification if paths are ambiguous`
-  // Budgets are set by the orchestrator per task — see fleet.ts header.
-};
-var REFACTOR_PLANNER_AGENT = {
-  id: "refactor-planner",
-  name: "Refactor Planner",
-  role: "refactor-planner",
-  prompt: `You are the Refactor Planner agent. Your job is to analyze code
-structure and produce a concrete, phased refactoring plan with risk
-assessment, dependency ordering, and rollback strategy.
-
-Scope:
-- Map module-level dependencies (import graph)
-- Identify coupling hotspots (high fan-in/out modules)
-- Assess refactoring risk by complexity and test coverage
-- Generate phased plans with checkpoint milestones
-- Produce diff-friendly task lists (one task = one concern)
-
-Input format you accept:
-{ "task": "plan | assess | roadmap", "target": "src/core", "constraint": "no-breaking-changes | minimal-downtime | full-rewrite", "focus": "architecture | performance | maintainability" }
-
-Output: Markdown refactor plan:
-- ## Phase 1: Low Risk / High Payoff (do first)
-  Table: | # | Task | Module | Risk | Est. Time |
-- ## Phase 2: Medium Risk
-- ## Phase 3: High Risk (requires full regression)
-- ## Dependency Graph (abbreviated ASCII)
-- ## Rollback Strategy
-- ## Exit Criteria (checkbox list)
-
-Risk scoring criteria:
-| Factor | Low | Medium | High |
-|--------|-----|--------|------|
-| Cyclomatic complexity | <10 | 10-20 | >20 |
-| Test coverage | >80% | 50-80% | <50% |
-| Fan-out (imports) | <5 | 5-15 | >15 |
-
-Working rules:
-- Always include rollback strategy \u2014 every refactor can fail
-- Merge tasks that take <1h into a single phase
-- Respect team constraints (reviewer availability, parallelization)
-- Never plan without analyzing the actual code first`
-  // Budgets are set by the orchestrator per task — see fleet.ts header.
-};
-var SECURITY_SCANNER_AGENT = {
-  id: "security-scanner",
-  name: "Security Scanner",
-  role: "security-scanner",
-  prompt: `You are the Security Scanner agent. Your job is to scan code,
-configs, and dependencies for security issues from hardcoded secrets to
-supply chain risks.
-
-Scope:
-- Detect hardcoded secrets: API keys, tokens, passwords, private keys
-- Find injection vectors: eval, innerHTML, SQL concat, shell injection
-- Identify insecure patterns: weak crypto, hardcoded IVs, disabled TLS
-- Scan dependencies for known CVEs (via npm/pnpm audit)
-- Flag supply chain risks: postinstall hooks, unverified scripts, .npmrc
-
-Input format you accept:
-{ "task": "scan | audit | secrets | dependencies", "paths": ["src", "config"], "depth": "quick | normal | deep" }
-
-Output: Markdown security report:
-- ## CRITICAL: Secrets Found (with code snippets)
-- ## HIGH: Injection Vectors
-- ## MEDIUM: Insecure Patterns
-- ## Dependency Issues (CVE list)
-- ## Summary table (severity \u2192 count)
-- ## Remediation Checklist (with checkboxes)
-
-Secret patterns you detect:
-| Pattern | Example | Severity |
-|---------|---------|----------|
-| AWS Access Key | AKIAIOSFODNN7EXAMPLE | critical |
-| AWS Secret Key | [a-zA-Z0-9/+=]{40} base64 | critical |
-| GitHub Token | ghp_[a-zA-Z0-9]{36} | critical |
-| Private Key PEM | -----BEGIN.*PRIVATE KEY----- | critical |
-| JWT | eyJ[a-zA-Z0-9_-]+ | high |
-
-Injection patterns:
-| Construct | Safe alternative |
-|-----------|-----------------|
-| eval(str) | new Function() or parse |
-| innerHTML = x | textContent or sanitize |
-| exec(\`cmd \${x}\`) | execFile with args array |
-
-Working rules:
-- Never scan node_modules \u2014 use npm audit instead
-- Always provide remediation steps, not just findings
-- Verify regex-based secrets before flagging (false positive risk)
-- When in doubt, flag as medium rather than ignoring potential issues`
-  // Budgets are set by the orchestrator per task — see fleet.ts header.
-};
-var FLEET_ROSTER = {
-  "audit-log": AUDIT_LOG_AGENT,
-  "bug-hunter": BUG_HUNTER_AGENT,
-  "refactor-planner": REFACTOR_PLANNER_AGENT,
-  "security-scanner": SECURITY_SCANNER_AGENT
-};
-var ALL_FLEET_AGENTS = Object.values(FLEET_ROSTER);
 var DEFAULT_URL = "https://models.dev/api.json";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var FAMILY_BY_NPM = {
@@ -7273,6 +7528,112 @@ When refactoring code:
 - Keep performance in mind \u2014 don't regress`,
     tags: ["refactor", "modernization", "improvement"],
     toolPreferences: ["read", "edit", "test", "git", "grep"]
+  },
+  {
+    id: "brief",
+    name: "Brief",
+    description: "Fast, no-nonsense \u2014 get to the point",
+    prompt: `## Brief Mode
+
+You are WrongStack, a fast, no-nonsense AI coding agent.
+
+You operate inside the user's terminal. Read files, run commands, make changes \u2014 get to the point.
+
+### Operating rules
+
+1. **Read first.** Inspect relevant files before touching anything.
+2. **Edit surgically.** Use edit tool for existing files, write only for new ones.
+3. **One sentence before action.** State what you're doing, then do it. No preambles.
+4. **Say what happened.** After tool calls, one line: success, failure, or what's next.
+5. **Be honest.** Admit when you don't know or something failed. No fake progress.
+6. **Keep moving.** Task done? Stop. More work needed? State it and continue.
+
+### Decision rules
+
+- **Ambiguous task?** Ask. One question, get clarity, proceed.
+- **Clear task, unknown approach?** Pick one reasonable path, execute, report.
+- **Tool fails?** Retry once with adjusted params, then report.
+- **Permission denied?** Stop. Acknowledge. Ask what they want instead.
+- **Context filling up?** Compact proactively, don't wait.
+
+### Output style
+
+- Prose paragraphs (no bullet points unless unavoidable)
+- Code blocks for code, backticks for paths/commands
+- One-liner sufficient? One liner.
+- No "Great question!", "Here's what I did:", or similar filler.
+- Max 3 sentences per paragraph.
+
+### Focus
+
+Stay on task. Fix only what's asked. Don't refactor surrounding code unless explicitly requested. Own your output \u2014 don't call it "done" or "production-ready"; the user decides that.`,
+    tags: ["fast", "concise", "direct"],
+    toolPreferences: ["read", "edit", "bash"]
+  },
+  {
+    id: "teach",
+    name: "Teach",
+    description: "Mentor mode \u2014 explains why, not just what",
+    prompt: `## Teach Mode
+
+You are WrongStack, an expert AI coding mentor.
+
+You operate inside the user's terminal with full access to their codebase. You help developers learn and understand \u2014 not just execute tasks, but build mental models.
+
+### Teaching philosophy
+
+1. **Explain the why.** When you make a change, explain why it works that way \u2014 not just what you did.
+2. **Build mental models.** Use analogies, highlight patterns, connect new concepts to things the user already knows.
+3. **Read before teaching.** Always inspect relevant files so your explanations are accurate and specific to the actual code.
+4. **Surgical edits with context.** When editing code, explain the approach before doing it, and what trade-offs were considered.
+5. **Be thorough but not verbose.** A 2-paragraph explanation beats a 5-paragraph one. Depth without padding.
+6. **Admit knowledge gaps.** If you're unsure, say so. Speculating teaches bad patterns.
+
+### Teaching style
+
+- **Before action:** Briefly explain what you're going to do and why.
+- **After action:** Summarize what happened and what the user should take away from this.
+- **With code:** Show concrete examples, explain syntax choices, point out gotchas.
+- **With errors:** Explain why the error occurred, what it's actually complaining about, and how to avoid it in the future.
+- **General principles:** Offer them when the user's question suggests a deeper concept they'd benefit from understanding.
+
+### Decision heuristics
+
+- **Task is ambiguous?** Ask \u2014 but frame the question as "what would you like to learn from this?"
+- **Task is clear, approach is unknown?** Execute, then teach the approach as you go.
+- **Tool fails?** Explain what failed, why it failed, and how to avoid the failure.
+- **User asks "how do I...?"** Don't just give the answer \u2014 explain the underlying mechanism.
+- **Context window filling up?** Compact, but summarize what was lost so the teaching continuity isn't broken.
+
+### Output format
+
+- Use headings to structure multi-concept explanations.
+- Code blocks with brief annotations for code examples.
+- **Bold** key terms and concepts worth remembering.
+- Callouts like "Key takeaway:" or "Pattern:" to anchor learning.
+- Max 3 sentences per paragraph \u2014 readability over completeness.
+
+### Don'ts
+
+- Don't lecture condescendingly \u2014 the user is a developer, not a beginner.
+- Don't pad explanations with obvious things.
+- Don't skip the "why" \u2014 even quick tasks deserve one sentence of context.
+- Don't just say "do X" \u2014 say "do X because Y."
+- Don't leave the user hanging after a complex operation \u2014 explain what just happened.
+
+### Core principles
+
+You follow these principles, but always with explanation:
+- Read before write
+- Surgical edits over rewrites
+- Show your work (explain your reasoning, not just mechanical steps)
+- Be honest about limits
+- Format for scanability
+- Recover explicitly from failures
+
+Remember: your job is to make the user a better developer, not just to complete tasks faster.`,
+    tags: ["teaching", "mentor", "learning"],
+    toolPreferences: ["read", "edit", "explain"]
   }
 ];
 
@@ -7843,6 +8204,27 @@ function computeTaskProgress(graph) {
     actualHours
   };
 }
+function topologicalSort(graph) {
+  const visited = /* @__PURE__ */ new Set();
+  const inStack = /* @__PURE__ */ new Set();
+  const result = [];
+  function visit(id) {
+    if (inStack.has(id)) return;
+    if (visited.has(id)) return;
+    if (!graph.nodes.has(id)) return;
+    visited.add(id);
+    inStack.add(id);
+    for (const edge of graph.edges) {
+      if (edge.from === id) visit(edge.to);
+    }
+    inStack.delete(id);
+    result.push(id);
+  }
+  for (const rootId of graph.rootNodes) {
+    visit(rootId);
+  }
+  return result;
+}
 
 // src/sdd/task-tracker.ts
 var TaskTracker = class {
@@ -8241,39 +8623,1527 @@ var SpecDrivenDev = class {
     }));
   }
 };
-
-// src/observability/metrics.ts
-var RESERVOIR_SIZE = 1024;
-function labelKey(labels) {
-  if (!labels) return "";
-  const keys = Object.keys(labels).sort();
-  return keys.map((k) => `${k}=${labels[k]}`).join(",");
-}
-function quantile(sorted, q) {
-  if (sorted.length === 0) return 0;
-  const idx = Math.min(sorted.length - 1, Math.floor(q * sorted.length));
-  return sorted[idx] ?? 0;
-}
-var InMemoryMetricsSink = class {
-  counters = /* @__PURE__ */ new Map();
-  gauges = /* @__PURE__ */ new Map();
-  histograms = /* @__PURE__ */ new Map();
-  counter(name, value = 1, labels) {
-    const series = this.getOrCreate(this.counters, name);
-    const key = labelKey(labels);
-    const state = series.get(key) ?? { value: 0 };
-    state.value += value;
-    series.set(key, state);
+var SpecStore = class {
+  baseDir;
+  indexPath;
+  constructor(opts) {
+    this.baseDir = opts.baseDir;
+    this.indexPath = path3.join(this.baseDir, "_index.json");
   }
-  gauge(name, value, labels) {
-    const series = this.getOrCreate(this.gauges, name);
-    series.set(labelKey(labels), { value });
+  async save(spec) {
+    await ensureDir(this.baseDir);
+    const filePath = this.filePath(spec.id);
+    await atomicWrite(filePath, JSON.stringify(spec, null, 2), { mode: 384 });
+    await this.updateIndex(spec);
   }
-  histogram(name, value, labels) {
-    const series = this.getOrCreate(this.histograms, name);
-    const key = labelKey(labels);
-    let state = series.get(key);
-    if (!state) {
+  async load(id) {
+    try {
+      const raw = await fsp.readFile(this.filePath(id), "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  async list() {
+    const index = await this.readIndex();
+    return index.entries.sort((a, b) => b.updatedAt - a.updatedAt);
+  }
+  async delete(id) {
+    try {
+      await fsp.unlink(this.filePath(id));
+      await this.removeFromIndex(id);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async exists(id) {
+    try {
+      await fsp.access(this.filePath(id));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /** Create a new spec with defaults, assign ID, and persist. */
+  async createDraft(title, overview) {
+    const now = Date.now();
+    const spec = {
+      id: randomUUID(),
+      title,
+      version: "0.1.0",
+      status: "draft",
+      overview: overview ?? "",
+      sections: [],
+      requirements: [],
+      createdAt: now,
+      updatedAt: now
+    };
+    await this.save(spec);
+    return spec;
+  }
+  /** Update spec fields and persist. */
+  async update(id, patch) {
+    const spec = await this.load(id);
+    if (!spec) return null;
+    const updated = {
+      ...spec,
+      ...patch,
+      id: spec.id,
+      createdAt: spec.createdAt,
+      updatedAt: Date.now()
+    };
+    await this.save(updated);
+    return updated;
+  }
+  filePath(id) {
+    return path3.join(this.baseDir, `${id}.json`);
+  }
+  async readIndex() {
+    try {
+      const raw = await fsp.readFile(this.indexPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed?.version === 1) return parsed;
+    } catch {
+    }
+    return { version: 1, entries: [] };
+  }
+  async updateIndex(spec) {
+    const index = await this.readIndex();
+    const entry = {
+      id: spec.id,
+      title: spec.title,
+      version: spec.version,
+      status: spec.status,
+      updatedAt: spec.updatedAt,
+      filePath: this.filePath(spec.id)
+    };
+    const idx = index.entries.findIndex((e) => e.id === spec.id);
+    if (idx >= 0) {
+      index.entries[idx] = entry;
+    } else {
+      index.entries.push(entry);
+    }
+    await atomicWrite(this.indexPath, JSON.stringify(index, null, 2), { mode: 384 });
+  }
+  async removeFromIndex(id) {
+    const index = await this.readIndex();
+    index.entries = index.entries.filter((e) => e.id !== id);
+    await atomicWrite(this.indexPath, JSON.stringify(index, null, 2), { mode: 384 });
+  }
+};
+function graphToJSON(graph) {
+  const serialisable = {
+    ...graph,
+    nodes: Array.from(graph.nodes.entries())
+  };
+  return JSON.stringify(serialisable, null, 2);
+}
+function graphFromJSON(raw) {
+  const parsed = JSON.parse(raw);
+  return {
+    ...parsed,
+    nodes: new Map(parsed.nodes)
+  };
+}
+var TaskGraphStore = class {
+  baseDir;
+  indexPath;
+  constructor(opts) {
+    this.baseDir = opts.baseDir;
+    this.indexPath = path3.join(this.baseDir, "_index.json");
+  }
+  async save(graph) {
+    await ensureDir(this.baseDir);
+    const filePath = this.filePath(graph.id);
+    await atomicWrite(filePath, graphToJSON(graph), { mode: 384 });
+    await this.updateIndex(graph);
+  }
+  async load(id) {
+    try {
+      const raw = await fsp.readFile(this.filePath(id), "utf8");
+      return graphFromJSON(raw);
+    } catch {
+      return null;
+    }
+  }
+  async list() {
+    const index = await this.readIndex();
+    return index.entries.sort((a, b) => b.updatedAt - a.updatedAt);
+  }
+  async delete(id) {
+    try {
+      await fsp.unlink(this.filePath(id));
+      await this.removeFromIndex(id);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async exists(id) {
+    try {
+      await fsp.access(this.filePath(id));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  filePath(id) {
+    return path3.join(this.baseDir, `${id}.json`);
+  }
+  async readIndex() {
+    try {
+      const raw = await fsp.readFile(this.indexPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed?.version === 1) return parsed;
+    } catch {
+    }
+    return { version: 1, entries: [] };
+  }
+  async updateIndex(graph) {
+    const index = await this.readIndex();
+    const completedCount = Array.from(graph.nodes.values()).filter(
+      (n) => n.status === "completed"
+    ).length;
+    const entry = {
+      id: graph.id,
+      specId: graph.specId,
+      title: graph.title,
+      nodeCount: graph.nodes.size,
+      completedCount,
+      updatedAt: graph.updatedAt,
+      filePath: this.filePath(graph.id)
+    };
+    const idx = index.entries.findIndex((e) => e.id === graph.id);
+    if (idx >= 0) {
+      index.entries[idx] = entry;
+    } else {
+      index.entries.push(entry);
+    }
+    await atomicWrite(this.indexPath, JSON.stringify(index, null, 2), { mode: 384 });
+  }
+  async removeFromIndex(id) {
+    const index = await this.readIndex();
+    index.entries = index.entries.filter((e) => e.id !== id);
+    await atomicWrite(this.indexPath, JSON.stringify(index, null, 2), { mode: 384 });
+  }
+};
+
+// src/sdd/spec-builder.ts
+function buildQuestioningPrompt(session, min, max) {
+  const answered = session.answers.length;
+  const remaining = Math.max(0, min - answered);
+  const budget = max - answered;
+  const lines = [
+    `\u2550\u2550\u2550 SDD Spec Builder \u2550\u2550\u2550`,
+    `Feature: "${session.title}"`,
+    session.userIntent ? `Intent: ${session.userIntent}` : "",
+    `Phase: Questioning (${answered} answered, ${budget} remaining budget)`,
+    "",
+    "**Instructions for AI:**",
+    "",
+    "You are conducting a specification interview. Your job is to ask the user",
+    "intelligent, contextual questions to understand what they want to build.",
+    "",
+    `You have asked ${answered} questions so far.`
+  ];
+  if (remaining > 0) {
+    lines.push(`You MUST ask at least ${remaining} more question(s) before generating the spec.`);
+  } else if (budget <= 0) {
+    lines.push("You have reached the maximum question budget. Generate the spec NOW.");
+  } else {
+    lines.push(
+      "You may ask more questions if needed, or generate the spec if you have enough information.",
+      "Ask a question ONLY if it reveals something you genuinely need to know."
+    );
+  }
+  lines.push(
+    "",
+    "**Rules:**",
+    "- Ask ONE question at a time",
+    "- Questions must be specific and contextual \u2014 never generic",
+    "- Adapt based on previous answers",
+    "- Cover: scope, constraints, edge cases, integrations, security, performance as relevant",
+    "- When you have enough info, respond with the full specification in JSON format",
+    "",
+    `**Question budget:** ${budget}/${max} remaining`,
+    `**Minimum required:** ${remaining > 0 ? remaining : "met"}`
+  );
+  if (session.projectContext) {
+    lines.push("", "**Project Context:**", "```", session.projectContext, "```");
+  }
+  if (answered > 0) {
+    lines.push("", "**Conversation so far:**");
+    for (let i = 0; i < answered; i++) {
+      const a = session.answers[i];
+      lines.push(``, `Q${i + 1}: ${a.question}`, `A${i + 1}: ${a.answer}`);
+    }
+  }
+  lines.push(
+    "",
+    "---",
+    "Now either:",
+    `1. Ask your next question (if you need more info)`,
+    `2. Generate the complete specification as JSON (if ready)`,
+    "",
+    "If generating spec, output JSON inside ```json code block with this structure:",
+    "```json",
+    "{",
+    '  "title": "...",',
+    '  "overview": "...",',
+    '  "sections": [{ "type": "overview|requirements|architecture|api|data|security|acceptance", "title": "...", "content": "...", "level": 1 }],',
+    '  "requirements": [{ "id": "REQ-1", "type": "functional|non-functional|security|performance|ux", "priority": "critical|high|medium|low", "description": "...", "acceptanceCriteria": ["..."] }]',
+    "}",
+    "```"
+  );
+  return lines.filter(Boolean).join("\n");
+}
+function buildSpecReviewPrompt(session) {
+  const spec = session.spec;
+  if (!spec) return "No spec generated yet.";
+  const reqSummary = spec.requirements.map((r) => `  [${r.priority}] ${r.description}`).join("\n");
+  return [
+    `\u2550\u2550\u2550 Spec Review \u2550\u2550\u2550`,
+    `Feature: "${spec.title}"`,
+    `Requirements: ${spec.requirements.length}`,
+    "",
+    "**Specification:**",
+    spec.overview,
+    "",
+    "**Requirements:**",
+    reqSummary,
+    "",
+    "---",
+    "Approve this spec? The AI will then generate an implementation plan and tasks.",
+    'Say "approve" to proceed, or describe what needs to change.'
+  ].join("\n");
+}
+function buildImplementationPrompt(session) {
+  const spec = session.spec;
+  if (!spec) return "No spec to implement.";
+  const reqList = spec.requirements.map((r) => `  - [${r.priority}] ${r.description}`).join("\n");
+  return [
+    `\u2550\u2550\u2550 Implementation Planning \u2550\u2550\u2550`,
+    `Feature: "${spec.title}"`,
+    `Requirements: ${spec.requirements.length}`,
+    "",
+    "**Requirements to implement:**",
+    reqList,
+    "",
+    "**Instructions for AI:**",
+    "Generate a detailed implementation plan for this specification.",
+    "Include:",
+    "1. Architecture decisions",
+    "2. File structure changes",
+    "3. Key implementation details",
+    "4. Dependency requirements",
+    "5. Testing strategy",
+    "",
+    "**IMPORTANT:** After the plan, you MUST generate executable tasks as a JSON array.",
+    "Each task should be a concrete, actionable step. Output the JSON inside a ```json code block:",
+    "```json",
+    "[",
+    "  {",
+    '    "title": "Create auth middleware",',
+    '    "description": "Implement JWT verification middleware for protected routes",',
+    '    "type": "feature",',
+    '    "priority": "critical",',
+    '    "estimateHours": 3,',
+    '    "tags": ["auth", "middleware"]',
+    "  },",
+    "  {",
+    '    "title": "Write auth tests",',
+    '    "description": "Unit and integration tests for authentication flow",',
+    '    "type": "test",',
+    '    "priority": "high",',
+    '    "estimateHours": 2,',
+    '    "tags": ["test", "auth"]',
+    "  }",
+    "]",
+    "```",
+    "",
+    "Rules:",
+    "- Each task must be independently executable",
+    "- Order tasks by dependency (things that block others come first)",
+    '- Use type: "feature" for code, "test" for tests, "docs" for documentation, "chore" for config',
+    '- Use priority: "critical" for blockers, "high" for core features, "medium" for nice-to-haves, "low" for polish'
+  ].join("\n");
+}
+function buildTaskReviewPrompt(session) {
+  return [
+    `\u2550\u2550\u2550 Task Review \u2550\u2550\u2550`,
+    `Feature: "${session.spec?.title ?? session.title}"`,
+    "",
+    session.implementation ?? "No implementation plan yet.",
+    "",
+    "---",
+    'Ready to execute these tasks? Say "execute" to begin, or describe changes needed.'
+  ].join("\n");
+}
+function buildExecutingPrompt(session) {
+  return [
+    `\u2550\u2550\u2550 Task Execution \u2550\u2550\u2550`,
+    `Feature: "${session.spec?.title ?? session.title}"`,
+    "",
+    "**Instructions for AI:**",
+    "Execute the tasks one by one in the order shown in the task list above.",
+    "",
+    "For each task:",
+    "1. Implement the code (create/modify files)",
+    "2. Write tests if applicable",
+    "3. After completing a task, tell the user to run: /sdd done <task number or title>",
+    "4. Then move to the next task",
+    "",
+    "**Important:**",
+    "- Focus on ONE task at a time",
+    "- After completing each task, explicitly state what you did",
+    '- Tell the user: "Run /sdd done <N> to mark this task complete"',
+    "- Then proceed to the next task automatically",
+    "- When ALL tasks are done, provide a summary of everything implemented",
+    "",
+    "Start executing the first pending task now."
+  ].join("\n");
+}
+var AISpecBuilder = class {
+  session;
+  store;
+  minQuestions;
+  maxQuestions;
+  sessionPath;
+  constructor(opts) {
+    this.store = opts.store;
+    this.minQuestions = opts.minQuestions ?? 2;
+    this.maxQuestions = opts.maxQuestions ?? 10;
+    this.sessionPath = opts.sessionPath;
+    this.session = {
+      id: crypto.randomUUID(),
+      phase: "questioning",
+      title: "",
+      userIntent: "",
+      projectContext: opts.projectContext ?? "",
+      answers: [],
+      questionCount: 0,
+      approved: false,
+      createdAt: Date.now(),
+      updatedAt: Date.now()
+    };
+  }
+  // ── Session Persistence ──────────────────────────────────────────────────
+  /** Save session state to disk. */
+  async saveSession() {
+    if (!this.sessionPath) return;
+    try {
+      const fsp13 = await import('fs/promises');
+      const path17 = await import('path');
+      await fsp13.mkdir(path17.dirname(this.sessionPath), { recursive: true });
+      await fsp13.writeFile(this.sessionPath, JSON.stringify(this.session, null, 2), "utf8");
+    } catch {
+    }
+  }
+  /** Load session state from disk. Returns true if a session was loaded. */
+  async loadSession() {
+    if (!this.sessionPath) return false;
+    try {
+      const fsp13 = await import('fs/promises');
+      const raw = await fsp13.readFile(this.sessionPath, "utf8");
+      const loaded = JSON.parse(raw);
+      if (loaded?.id && loaded?.phase && loaded?.title) {
+        this.session = loaded;
+        return true;
+      }
+    } catch {
+    }
+    return false;
+  }
+  /** Delete saved session from disk. */
+  async deleteSession() {
+    if (!this.sessionPath) return;
+    try {
+      const fsp13 = await import('fs/promises');
+      await fsp13.unlink(this.sessionPath);
+    } catch {
+    }
+  }
+  /** Auto-save helper — calls saveSession() but never throws. */
+  autoSave() {
+    this.saveSession().catch(() => {
+    });
+  }
+  // ── Session Lifecycle ─────────────────────────────────────────────────────
+  /** Start a new session with a title and optional intent. */
+  startSession(title, intent) {
+    this.session.title = title;
+    this.session.userIntent = intent ?? "";
+    this.session.phase = "questioning";
+    this.session.updatedAt = Date.now();
+    this.autoSave();
+  }
+  /** Get current session state (readonly). */
+  getSession() {
+    return { ...this.session };
+  }
+  /** Get the current phase. */
+  getPhase() {
+    return this.session.phase;
+  }
+  // ── AI Prompt Generation ──────────────────────────────────────────────────
+  /**
+   * Get the AI prompt for the current phase.
+   * This prompt is injected into the conversation so the AI agent knows
+   * what to do next (ask a question, generate a spec, etc.).
+   */
+  getAIPrompt() {
+    switch (this.session.phase) {
+      case "questioning":
+        return buildQuestioningPrompt(this.session, this.minQuestions, this.maxQuestions);
+      case "spec_review":
+        return buildSpecReviewPrompt(this.session);
+      case "implementation":
+        return buildImplementationPrompt(this.session);
+      case "task_review":
+        return buildTaskReviewPrompt(this.session);
+      case "executing":
+        return buildExecutingPrompt(this.session);
+      case "done":
+        return "All tasks completed. Specification is fully implemented.";
+    }
+  }
+  // ── Answer Processing ─────────────────────────────────────────────────────
+  /**
+   * Record a question/answer pair from the AI conversation.
+   * Call this when the AI asks a question and the user responds.
+   */
+  addAnswer(question, answer) {
+    this.session.answers.push({ question, answer, timestamp: Date.now() });
+    this.session.questionCount++;
+    this.session.updatedAt = Date.now();
+    this.autoSave();
+  }
+  /**
+   * Check if more questions should be asked.
+   * Returns false if max reached or if the AI has signaled it has enough info.
+   */
+  shouldContinueQuestioning() {
+    return this.session.questionCount < this.maxQuestions;
+  }
+  /**
+   * Check if minimum questions have been asked.
+   */
+  hasMetMinimumQuestions() {
+    return this.session.questionCount >= this.minQuestions;
+  }
+  // ── Phase Transitions ─────────────────────────────────────────────────────
+  /**
+   * Set the generated specification and move to spec_review phase.
+   */
+  setSpec(spec) {
+    this.session.spec = spec;
+    this.session.phase = "spec_review";
+    this.session.updatedAt = Date.now();
+    this.autoSave();
+  }
+  /**
+   * Approve the current phase and advance to the next.
+   * questioning → spec_review (requires spec to be set)
+   * spec_review → implementation
+   * implementation → task_review (requires implementation to be set)
+   * task_review → executing
+   * executing → done
+   */
+  approve() {
+    switch (this.session.phase) {
+      case "questioning":
+        if (!this.session.spec) {
+          throw new Error("Cannot approve: no spec generated yet.");
+        }
+        this.session.phase = "spec_review";
+        break;
+      case "spec_review":
+        this.session.phase = "implementation";
+        break;
+      case "implementation":
+        this.session.phase = "task_review";
+        break;
+      case "task_review":
+        this.session.phase = "executing";
+        break;
+      case "executing":
+        this.session.phase = "done";
+        break;
+    }
+    this.session.approved = true;
+    this.session.updatedAt = Date.now();
+    this.autoSave();
+    return this.session.phase;
+  }
+  /**
+   * Set the implementation plan text.
+   */
+  setImplementation(plan) {
+    this.session.implementation = plan;
+    this.session.phase = "task_review";
+    this.session.updatedAt = Date.now();
+    this.autoSave();
+  }
+  /**
+   * Mark session as done.
+   */
+  markDone() {
+    this.session.phase = "done";
+    this.session.updatedAt = Date.now();
+    this.autoSave();
+  }
+  /**
+   * Set the task graph ID for this session.
+   */
+  setTaskGraphId(graphId) {
+    this.session.taskGraphId = graphId;
+    this.autoSave();
+  }
+  /**
+   * Get the task graph ID for this session.
+   */
+  getTaskGraphId() {
+    return this.session.taskGraphId;
+  }
+  // ── Spec Persistence ──────────────────────────────────────────────────────
+  /**
+   * Save the current spec to the store.
+   */
+  async saveSpec() {
+    if (!this.session.spec) {
+      throw new Error("No spec to save.");
+    }
+    await this.store.save(this.session.spec);
+    return this.session.spec;
+  }
+  // ── Spec Generation Helpers ───────────────────────────────────────────────
+  /**
+   * Parse a spec from a JSON string (from AI output).
+   * Validates and normalizes the structure.
+   */
+  parseSpecFromJSON(jsonStr) {
+    let parsed;
+    try {
+      parsed = JSON.parse(jsonStr);
+    } catch (e) {
+      throw new Error(`Invalid JSON for spec: ${e instanceof Error ? e.message : "parse error"}`);
+    }
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("Spec JSON must be an object.");
+    }
+    const raw = parsed;
+    const now = Date.now();
+    const title = String(raw.title ?? this.session.title ?? "Untitled");
+    const overview = String(raw.overview ?? "");
+    if (!overview || overview === "undefined") {
+      throw new Error("Spec must have an overview.");
+    }
+    const rawSections = Array.isArray(raw.sections) ? raw.sections : [];
+    const sections = rawSections.filter((s) => s && typeof s === "object").map((s) => ({
+      type: ["overview", "requirements", "architecture", "api", "data", "security", "acceptance"].includes(String(s.type)) ? String(s.type) : "overview",
+      title: String(s.title ?? ""),
+      content: String(s.content ?? ""),
+      level: Number(s.level) || 1
+    }));
+    const rawReqs = Array.isArray(raw.requirements) ? raw.requirements : [];
+    const requirements = rawReqs.filter((r) => r && typeof r === "object").map((r, i) => ({
+      id: String(r.id ?? `REQ-${i + 1}`),
+      type: ["functional", "non-functional", "security", "performance", "ux"].includes(String(r.type)) ? String(r.type) : "functional",
+      priority: ["critical", "high", "medium", "low"].includes(String(r.priority)) ? String(r.priority) : "medium",
+      description: String(r.description ?? ""),
+      acceptanceCriteria: Array.isArray(r.acceptanceCriteria) ? r.acceptanceCriteria.map(String) : []
+    }));
+    const spec = {
+      id: crypto.randomUUID(),
+      title,
+      version: "0.1.0",
+      status: "draft",
+      overview,
+      sections,
+      requirements,
+      createdAt: now,
+      updatedAt: now,
+      metadata: {
+        generatedBy: "AISpecBuilder",
+        sessionId: this.session.id
+      }
+    };
+    return spec;
+  }
+  /**
+   * Extract JSON from AI output (handles ```json blocks and raw JSON).
+   */
+  extractJSON(text) {
+    const codeBlockMatch = text.match(/```json\s*([\s\S]*?)```/);
+    if (codeBlockMatch?.[1]) {
+      return codeBlockMatch[1].trim();
+    }
+    const genericBlockMatch = text.match(/```\s*([\s\S]*?)```/);
+    if (genericBlockMatch?.[1]) {
+      const trimmed = genericBlockMatch[1].trim();
+      if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+        return trimmed;
+      }
+    }
+    const jsonMatch = text.match(/(\{[\s\S]*\})/);
+    if (jsonMatch?.[1]) {
+      try {
+        JSON.parse(jsonMatch[1]);
+        return jsonMatch[1];
+      } catch {
+      }
+    }
+    return null;
+  }
+  /**
+   * Detect if AI output contains a spec (JSON block).
+   */
+  hasSpecInOutput(text) {
+    return this.extractJSON(text) !== null;
+  }
+  /**
+   * Try to parse a spec from AI output text.
+   * Returns null if no valid spec found.
+   */
+  tryParseSpecFromOutput(text) {
+    const json = this.extractJSON(text);
+    if (!json) return null;
+    try {
+      return this.parseSpecFromJSON(json);
+    } catch {
+      return null;
+    }
+  }
+  // ── JSON Array Extraction (for tasks) ─────────────────────────────────────
+  /**
+   * Extract a JSON array from AI output (for task lists).
+   */
+  extractJSONArray(text) {
+    const codeBlockMatch = text.match(/```json\s*([\s\S]*?)```/);
+    if (codeBlockMatch?.[1]) {
+      const trimmed = codeBlockMatch[1].trim();
+      if (trimmed.startsWith("[")) return trimmed;
+    }
+    const arrayMatch = text.match(/(\[[\s\S]*\])/);
+    if (arrayMatch?.[1]) {
+      try {
+        const parsed = JSON.parse(arrayMatch[1]);
+        if (Array.isArray(parsed)) return arrayMatch[1];
+      } catch {
+      }
+    }
+    return null;
+  }
+};
+
+// src/sdd/spec-templates.ts
+var SPEC_TEMPLATES = [
+  {
+    id: "feature",
+    name: "New Feature",
+    description: "Template for new feature development",
+    sections: [
+      { type: "overview", title: "Overview", level: 2 },
+      { type: "requirements", title: "Requirements", level: 2 },
+      { type: "architecture", title: "Architecture", level: 2 },
+      { type: "api", title: "API Design", level: 2 },
+      { type: "data", title: "Data Model", level: 2 },
+      { type: "security", title: "Security", level: 2 },
+      { type: "acceptance", title: "Acceptance Criteria", level: 2 }
+    ],
+    defaultRequirements: [
+      { type: "functional", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] },
+      { type: "non-functional", priority: "medium", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    ]
+  },
+  {
+    id: "bugfix",
+    name: "Bug Fix",
+    description: "Template for bug fix specifications",
+    sections: [
+      { type: "overview", title: "Bug Description", level: 2 },
+      { type: "requirements", title: "Root Cause Analysis", level: 2 },
+      { type: "acceptance", title: "Fix Verification", level: 2 }
+    ],
+    defaultRequirements: [
+      { type: "functional", priority: "critical", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    ]
+  },
+  {
+    id: "refactor",
+    name: "Refactor",
+    description: "Template for code refactoring",
+    sections: [
+      { type: "overview", title: "Current State", level: 2 },
+      { type: "requirements", title: "Refactoring Goals", level: 2 },
+      { type: "architecture", title: "Target Architecture", level: 2 },
+      { type: "acceptance", title: "Verification", level: 2 }
+    ],
+    defaultRequirements: [
+      { type: "non-functional", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    ]
+  },
+  {
+    id: "infra",
+    name: "Infrastructure",
+    description: "Template for infrastructure/tooling changes",
+    sections: [
+      { type: "overview", title: "What and Why", level: 2 },
+      { type: "requirements", title: "Requirements", level: 2 },
+      { type: "architecture", title: "Design", level: 2 },
+      { type: "security", title: "Security Impact", level: 2 },
+      { type: "acceptance", title: "Rollout Plan", level: 2 }
+    ],
+    defaultRequirements: [
+      { type: "functional", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] },
+      { type: "security", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    ]
+  },
+  {
+    id: "integration",
+    name: "Integration",
+    description: "Template for integrating external services or APIs",
+    sections: [
+      { type: "overview", title: "Integration Overview", level: 2 },
+      { type: "requirements", title: "Integration Requirements", level: 2 },
+      { type: "api", title: "API Contract", level: 2 },
+      { type: "architecture", title: "Architecture", level: 2 },
+      { type: "security", title: "Auth & Security", level: 2 },
+      { type: "acceptance", title: "Testing Strategy", level: 2 }
+    ],
+    defaultRequirements: [
+      { type: "functional", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] },
+      { type: "security", priority: "critical", acceptanceCriteria: [], blockedBy: [], implements: [] },
+      { type: "performance", priority: "medium", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    ]
+  },
+  {
+    id: "cli-command",
+    name: "CLI Command",
+    description: "Template for new CLI commands/slash commands",
+    sections: [
+      { type: "overview", title: "Command Overview", level: 2 },
+      { type: "requirements", title: "Command Requirements", level: 2 },
+      { type: "api", title: "Command Interface", level: 2 },
+      { type: "acceptance", title: "Usage Examples", level: 2 }
+    ],
+    defaultRequirements: [
+      { type: "ux", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] },
+      { type: "functional", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    ]
+  }
+];
+function getTemplate(id) {
+  return SPEC_TEMPLATES.find((t) => t.id === id);
+}
+function listTemplates() {
+  return SPEC_TEMPLATES.map((t) => ({ id: t.id, name: t.name, description: t.description }));
+}
+function templateToMarkdown(template, title) {
+  const lines = [];
+  lines.push(`# ${title ?? "Untitled Specification"}`);
+  lines.push("Version: 0.1.0");
+  lines.push("");
+  for (const section of template.sections) {
+    lines.push(`${"#".repeat(section.level + 1)} ${section.title}`);
+    lines.push(`_<!-- ${section.type} section content -->_`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// src/sdd/task-visualizer.ts
+var STATUS_ICON = {
+  pending: "\u25CB",
+  in_progress: "\u25D0",
+  blocked: "\u2298",
+  failed: "\u2717",
+  review: "\u25D1",
+  completed: "\u25CF"
+};
+var PRIORITY_ICON = {
+  critical: "\u{1F534}",
+  high: "\u{1F7E0}",
+  medium: "\u{1F7E1}",
+  low: "\u{1F7E2}"
+};
+var TYPE_ICON = {
+  feature: "\u26A1",
+  bugfix: "\u{1F41B}",
+  refactor: "\u267B\uFE0F",
+  docs: "\u{1F4DD}",
+  test: "\u{1F9EA}",
+  chore: "\u{1F527}"
+};
+function renderTaskGraph(graph, opts) {
+  const lines = [];
+  const compact = opts?.compact ?? false;
+  lines.push(`\u256D\u2500 Task Graph: ${graph.title} \u2500\u256E`);
+  lines.push(`\u2502 Spec: ${graph.specId.slice(0, 8)}... \u2502 Nodes: ${graph.nodes.size} \u2502 Edges: ${graph.edges.length} \u2502`);
+  lines.push("\u2570" + "\u2500".repeat(Math.max(50, graph.title.length + 30)) + "\u256F");
+  lines.push("");
+  const progress = computeTaskProgress(graph);
+  lines.push(renderProgress(progress));
+  lines.push("");
+  const childrenMap = /* @__PURE__ */ new Map();
+  for (const edge of graph.edges) {
+    if (edge.type === "depends_on") {
+      const deps = childrenMap.get(edge.from) ?? [];
+      deps.push(edge.to);
+      childrenMap.set(edge.from, deps);
+    }
+  }
+  const rendered = /* @__PURE__ */ new Set();
+  const rootNodes = graph.rootNodes.filter((id) => graph.nodes.has(id));
+  const startNodes = rootNodes.length > 0 ? rootNodes : Array.from(graph.nodes.keys()).filter((id) => {
+    const deps = childrenMap.get(id);
+    return !deps || deps.length === 0;
+  });
+  for (const rootId of startNodes) {
+    renderNode(graph, rootId, lines, rendered, childrenMap, compact, "");
+  }
+  for (const [id] of graph.nodes) {
+    if (!rendered.has(id)) {
+      renderNode(graph, id, lines, rendered, childrenMap, compact, "");
+    }
+  }
+  lines.push("");
+  lines.push("Legend: \u25CF done \u25D0 in-progress \u25CB pending \u2297 blocked \u2717 failed \u25D2 review");
+  return lines.join("\n");
+}
+function renderNode(graph, nodeId, lines, rendered, childrenMap, compact, prefix) {
+  if (rendered.has(nodeId)) return;
+  rendered.add(nodeId);
+  const node = graph.nodes.get(nodeId);
+  if (!node) return;
+  const icon = STATUS_ICON[node.status];
+  const prioIcon = PRIORITY_ICON[node.priority];
+  const typeIcon = TYPE_ICON[node.type];
+  const title = compact ? truncate2(node.title, 40) : node.title;
+  const blockedBy = childrenMap.get(nodeId) ?? [];
+  const depsStr = blockedBy.length > 0 ? ` \u2190 [${blockedBy.map((d) => graph.nodes.get(d)?.title?.slice(0, 12) ?? "?").join(", ")}]` : "";
+  lines.push(`${prefix}${icon} ${typeIcon} ${prioIcon} ${title}${depsStr}`);
+  if (!compact && node.description) {
+    const descLines = node.description.split("\n").slice(0, 3);
+    for (const dl of descLines) {
+      lines.push(`${prefix}  \u2514 ${truncate2(dl, 60)}`);
+    }
+  }
+  const dependents = graph.edges.filter((e) => e.type === "depends_on" && e.to === nodeId).map((e) => e.from).filter((id) => graph.nodes.has(id));
+  for (const depId of dependents) {
+    renderNode(graph, depId, lines, rendered, childrenMap, compact, prefix + "  ");
+  }
+}
+function renderProgress(progress) {
+  const barWidth = 30;
+  const filled = Math.round(progress.percentComplete / 100 * barWidth);
+  const empty = barWidth - filled;
+  const bar = "\u2588".repeat(filled) + "\u2591".repeat(empty);
+  return [
+    `Progress: [${bar}] ${progress.percentComplete}%`,
+    `  ${progress.completed} done \u2502 ${progress.inProgress} active \u2502 ${progress.pending} pending \u2502 ${progress.blocked} blocked \u2502 ${progress.failed} failed`
+  ].join("\n");
+}
+function renderTaskList(graph) {
+  const lines = [];
+  const nodes = Array.from(graph.nodes.values());
+  const groups = {
+    in_progress: [],
+    pending: [],
+    blocked: [],
+    review: [],
+    failed: [],
+    completed: []
+  };
+  for (const node of nodes) {
+    groups[node.status]?.push(node);
+  }
+  for (const [status, group] of Object.entries(groups)) {
+    if (group.length === 0) continue;
+    const icon = STATUS_ICON[status];
+    lines.push(`${icon} ${status.toUpperCase()} (${group.length})`);
+    for (const node of group) {
+      const prio = PRIORITY_ICON[node.priority];
+      const type = TYPE_ICON[node.type];
+      lines.push(`  ${type} ${prio} ${node.title}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function renderSpecAnalysis(spec, analysis) {
+  const lines = [];
+  lines.push(`\u256D\u2500 Spec Analysis: ${spec.title} \u2500\u256E`);
+  lines.push("");
+  const barWidth = 20;
+  const filled = Math.round(analysis.completeness / 100 * barWidth);
+  const bar = "\u2588".repeat(filled) + "\u2591".repeat(barWidth - filled);
+  lines.push(`Completeness: [${bar}] ${analysis.completeness}%`);
+  lines.push("");
+  if (analysis.gaps.length > 0) {
+    lines.push("\u26A0 Gaps:");
+    for (const gap of analysis.gaps) {
+      lines.push(`  \u2022 ${gap}`);
+    }
+    lines.push("");
+  }
+  if (analysis.risks.length > 0) {
+    lines.push("\u{1F534} Risks:");
+    for (const risk of analysis.risks) {
+      lines.push(`  \u2022 ${risk}`);
+    }
+    lines.push("");
+  }
+  if (analysis.suggestions.length > 0) {
+    lines.push("\u{1F4A1} Suggestions:");
+    for (const sug of analysis.suggestions) {
+      lines.push(`  \u2022 ${sug}`);
+    }
+  }
+  return lines.join("\n");
+}
+function truncate2(str, maxLen) {
+  if (str.length <= maxLen) return str;
+  return str.slice(0, maxLen - 1) + "\u2026";
+}
+
+// src/sdd/critical-path.ts
+function analyzeCriticalPath(graph) {
+  const nodes = Array.from(graph.nodes.values());
+  const topoOrder = topologicalSort(graph);
+  const blockedByMap = /* @__PURE__ */ new Map();
+  const blocksMap = /* @__PURE__ */ new Map();
+  for (const edge of graph.edges) {
+    if (edge.type === "depends_on") {
+      if (!blockedByMap.has(edge.from)) blockedByMap.set(edge.from, /* @__PURE__ */ new Set());
+      blockedByMap.get(edge.from).add(edge.to);
+      if (!blocksMap.has(edge.to)) blocksMap.set(edge.to, /* @__PURE__ */ new Set());
+      blocksMap.get(edge.to).add(edge.from);
+    }
+  }
+  const readyTasks = [];
+  const blockedTasks = [];
+  for (const node of nodes) {
+    if (node.status === "completed") continue;
+    const blockers = blockedByMap.get(node.id);
+    if (!blockers || blockers.size === 0) {
+      readyTasks.push(node.id);
+    } else {
+      const allCompleted = Array.from(blockers).every((id) => {
+        const n = graph.nodes.get(id);
+        return n?.status === "completed";
+      });
+      if (allCompleted) {
+        readyTasks.push(node.id);
+      } else {
+        blockedTasks.push(node.id);
+      }
+    }
+  }
+  const bottlenecks = [];
+  for (const node of nodes) {
+    if (node.status === "completed") continue;
+    const downstream = getTransitiveBlocked(graph, node.id, blocksMap);
+    if (downstream.size > 0) {
+      const blockedHours = Array.from(downstream).reduce((sum, id) => {
+        const n = graph.nodes.get(id);
+        return sum + (n?.estimateHours ?? 0);
+      }, 0);
+      bottlenecks.push({
+        taskId: node.id,
+        title: node.title,
+        blockedCount: downstream.size,
+        blockedHours,
+        severity: Math.min(100, Math.round(downstream.size / nodes.length * 100))
+      });
+    }
+  }
+  bottlenecks.sort((a, b) => b.severity - a.severity);
+  const criticalPath = computeCriticalPath(graph, topoOrder, blockedByMap);
+  const totalHours = criticalPath.reduce((sum, id) => {
+    const n = graph.nodes.get(id);
+    return sum + (n?.estimateHours ?? 0);
+  }, 0);
+  const parallelGroups = computeParallelGroups(graph, blockedByMap);
+  const executionOrder = topoOrder.filter((id) => {
+    const n = graph.nodes.get(id);
+    return n && n.status !== "completed";
+  });
+  return {
+    criticalPath,
+    totalHours,
+    bottlenecks,
+    parallelGroups,
+    executionOrder,
+    readyTasks,
+    blockedTasks
+  };
+}
+function getTransitiveBlocked(graph, taskId, blocksMap) {
+  const visited = /* @__PURE__ */ new Set();
+  const queue = [taskId];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    const blocked = blocksMap.get(current);
+    if (!blocked) continue;
+    for (const id of blocked) {
+      if (!visited.has(id) && id !== taskId) {
+        visited.add(id);
+        queue.push(id);
+      }
+    }
+  }
+  return visited;
+}
+function computeCriticalPath(graph, topoOrder, blockedByMap) {
+  const allIds = Array.from(graph.nodes.keys());
+  if (allIds.length === 0) return [];
+  const dist = /* @__PURE__ */ new Map();
+  const prev = /* @__PURE__ */ new Map();
+  for (const id of allIds) {
+    dist.set(id, graph.nodes.get(id)?.estimateHours ?? 1);
+    prev.set(id, null);
+  }
+  const blocksMap = /* @__PURE__ */ new Map();
+  for (const [taskId, blockers] of blockedByMap) {
+    for (const blockerId of blockers) {
+      if (!blocksMap.has(blockerId)) blocksMap.set(blockerId, /* @__PURE__ */ new Set());
+      blocksMap.get(blockerId).add(taskId);
+    }
+  }
+  const n = allIds.length;
+  for (let i = 0; i < n - 1; i++) {
+    let changed = false;
+    for (const id of allIds) {
+      const blocked = blocksMap.get(id);
+      if (!blocked) continue;
+      for (const blockedId of blocked) {
+        const candidateDist = (dist.get(id) ?? 0) + (graph.nodes.get(blockedId)?.estimateHours ?? 1);
+        if (candidateDist > (dist.get(blockedId) ?? 0)) {
+          dist.set(blockedId, candidateDist);
+          prev.set(blockedId, id);
+          changed = true;
+        }
+      }
+    }
+    if (!changed) break;
+  }
+  let maxDist = 0;
+  let maxId = allIds[0];
+  for (const id of allIds) {
+    const d = dist.get(id) ?? 0;
+    if (d > maxDist) {
+      maxDist = d;
+      maxId = id;
+    }
+  }
+  const path17 = [];
+  let current = maxId;
+  const visited = /* @__PURE__ */ new Set();
+  while (current && !visited.has(current)) {
+    visited.add(current);
+    path17.unshift(current);
+    current = prev.get(current) ?? null;
+  }
+  return path17;
+}
+function computeParallelGroups(graph, blockedByMap) {
+  const groups = [];
+  const assigned = /* @__PURE__ */ new Set();
+  const nodes = Array.from(graph.nodes.values()).filter((n) => n.status !== "completed");
+  const remaining = new Set(nodes.map((n) => n.id));
+  while (remaining.size > 0) {
+    const group = [];
+    for (const id of remaining) {
+      const blockers = blockedByMap.get(id);
+      if (!blockers || blockers.size === 0) {
+        group.push(id);
+      } else {
+        const allAssigned = Array.from(blockers).every((b) => assigned.has(b));
+        if (allAssigned) {
+          group.push(id);
+        }
+      }
+    }
+    if (group.length === 0) {
+      const first = Array.from(remaining)[0];
+      if (first) group.push(first);
+    }
+    for (const id of group) {
+      assigned.add(id);
+      remaining.delete(id);
+    }
+    groups.push(group);
+  }
+  return groups;
+}
+
+// src/sdd/spec-versioning.ts
+var SpecVersioning = class {
+  versions = /* @__PURE__ */ new Map();
+  /** Record a new version of a spec. */
+  recordVersion(spec, changeDescription) {
+    const version = {
+      version: spec.version,
+      spec: { ...spec },
+      timestamp: Date.now(),
+      changeDescription
+    };
+    const history = this.versions.get(spec.id) ?? [];
+    history.push(version);
+    this.versions.set(spec.id, history);
+    return version;
+  }
+  /** Get version history for a spec. */
+  getHistory(specId) {
+    return this.versions.get(specId) ?? [];
+  }
+  /** Get a specific version of a spec. */
+  getVersion(specId, version) {
+    const history = this.versions.get(specId) ?? [];
+    return history.find((v) => v.version === version);
+  }
+  /** Get the latest version of a spec. */
+  getLatest(specId) {
+    const history = this.versions.get(specId) ?? [];
+    return history[history.length - 1];
+  }
+  /** Compute diff between two versions of a spec. */
+  diff(oldSpec, newSpec) {
+    const oldReqs = new Map(oldSpec.requirements.map((r) => [r.id, r]));
+    const newReqs = new Map(newSpec.requirements.map((r) => [r.id, r]));
+    const added = [];
+    const removed = [];
+    const modified = [];
+    for (const [id, newReq] of newReqs) {
+      const oldReq = oldReqs.get(id);
+      if (!oldReq) {
+        added.push(newReq);
+      } else {
+        const changes = this.compareRequirements(oldReq, newReq);
+        if (changes.length > 0) {
+          modified.push({
+            requirement: newReq,
+            previousVersion: oldReq,
+            changes
+          });
+        }
+      }
+    }
+    for (const [id, oldReq] of oldReqs) {
+      if (!newReqs.has(id)) {
+        removed.push(oldReq);
+      }
+    }
+    const parts = [];
+    if (added.length > 0) parts.push(`${added.length} added`);
+    if (removed.length > 0) parts.push(`${removed.length} removed`);
+    if (modified.length > 0) parts.push(`${modified.length} modified`);
+    return {
+      added,
+      removed,
+      modified,
+      summary: parts.length > 0 ? parts.join(", ") : "No changes"
+    };
+  }
+  /**
+   * Update a task graph incrementally based on spec changes.
+   * - Added requirements → new tasks
+   * - Removed requirements → remove tasks
+   * - Modified requirements → update task descriptions
+   * Returns the updated graph and list of changes made.
+   */
+  updateTaskGraph(graph, oldSpec, newSpec) {
+    const specDiff = this.diff(oldSpec, newSpec);
+    const changes = [];
+    const reqToTask = /* @__PURE__ */ new Map();
+    for (const node of graph.nodes.values()) {
+      if (node.specRequirementId) {
+        reqToTask.set(node.specRequirementId, node);
+      }
+    }
+    for (const req of specDiff.removed) {
+      const task = reqToTask.get(req.id);
+      if (task) {
+        graph.nodes.delete(task.id);
+        graph.edges = graph.edges.filter((e) => e.from !== task.id && e.to !== task.id);
+        changes.push(`Removed task: ${task.title}`);
+      }
+    }
+    for (const mod of specDiff.modified) {
+      const task = reqToTask.get(mod.requirement.id);
+      if (task) {
+        task.title = mod.requirement.description;
+        task.description = this.buildTaskDescription(mod.requirement);
+        task.priority = mod.requirement.priority;
+        task.updatedAt = Date.now();
+        changes.push(`Updated task: ${task.title} (${mod.changes.join(", ")})`);
+      }
+    }
+    for (const req of specDiff.added) {
+      const now = Date.now();
+      const newTask = {
+        id: crypto.randomUUID(),
+        title: req.description,
+        description: this.buildTaskDescription(req),
+        type: this.mapReqType(req.type),
+        priority: req.priority,
+        status: "pending",
+        specRequirementId: req.id,
+        tags: [req.type, req.priority],
+        createdAt: now,
+        updatedAt: now
+      };
+      graph.nodes.set(newTask.id, newTask);
+      graph.rootNodes.push(newTask.id);
+      changes.push(`Added task: ${newTask.title}`);
+    }
+    graph.updatedAt = Date.now();
+    return { graph, changes };
+  }
+  compareRequirements(old, current) {
+    const changes = [];
+    if (old.description !== current.description) changes.push("description");
+    if (old.priority !== current.priority) changes.push("priority");
+    if (old.type !== current.type) changes.push("type");
+    if (JSON.stringify(old.acceptanceCriteria) !== JSON.stringify(current.acceptanceCriteria)) {
+      changes.push("acceptance criteria");
+    }
+    if (JSON.stringify(old.blockedBy) !== JSON.stringify(current.blockedBy)) {
+      changes.push("dependencies");
+    }
+    return changes;
+  }
+  buildTaskDescription(req) {
+    const lines = [req.description, "", `**Type:** ${req.type}`, `**Priority:** ${req.priority}`];
+    if (req.acceptanceCriteria.length > 0) {
+      lines.push("", "**Acceptance Criteria:**");
+      for (const ac of req.acceptanceCriteria) {
+        lines.push(`- ${ac}`);
+      }
+    }
+    return lines.join("\n");
+  }
+  mapReqType(type) {
+    switch (type) {
+      case "functional":
+        return "feature";
+      case "security":
+        return "feature";
+      case "performance":
+        return "feature";
+      case "ux":
+        return "feature";
+      default:
+        return "feature";
+    }
+  }
+};
+
+// src/sdd/auto-executor.ts
+var AutoExecutor = class {
+  opts;
+  stopped = false;
+  retryMap = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.opts = opts;
+  }
+  /**
+   * Execute all tasks in the graph, respecting dependencies.
+   */
+  async execute(graph, spec) {
+    this.stopped = false;
+    this.retryMap.clear();
+    const startTime = Date.now();
+    const critical = analyzeCriticalPath(graph);
+    let completed = 0;
+    let failed = 0;
+    const skipped = 0;
+    let retried = 0;
+    while (!this.stopped) {
+      const readyTasks = this.getReadyTasks(graph);
+      if (readyTasks.length === 0) {
+        const allDone = Array.from(graph.nodes.values()).every(
+          (n) => n.status === "completed" || n.status === "failed"
+        );
+        if (allDone) break;
+        const hasDeadlock = this.detectDeadlock(graph);
+        if (hasDeadlock) break;
+        break;
+      }
+      const batch = readyTasks.slice(0, this.opts.maxConcurrent ?? 1);
+      const results = await Promise.allSettled(
+        batch.map((task) => this.executeTaskWithRetry(task, graph, spec))
+      );
+      for (let i = 0; i < results.length; i++) {
+        const result = results[i];
+        const task = batch[i];
+        if (!result || !task) continue;
+        if (result.status === "fulfilled") {
+          const { result: execResult, retries } = result.value;
+          if (execResult.success) {
+            this.opts.tracker.updateNodeStatus(task.id, "completed");
+            completed++;
+            if (retries > 0) retried++;
+            this.opts.onTaskComplete?.(task, execResult);
+          } else if (execResult.retry) {
+            retried++;
+          } else {
+            this.opts.tracker.updateNodeStatus(task.id, "failed", execResult.error);
+            failed++;
+          }
+        } else {
+          this.opts.tracker.updateNodeStatus(task.id, "failed", String(result.reason));
+          failed++;
+          this.opts.onTaskFail?.(task, result.reason, 0);
+        }
+      }
+    }
+    const duration = Date.now() - startTime;
+    const summary = {
+      total: graph.nodes.size,
+      completed,
+      failed,
+      skipped,
+      retried,
+      duration,
+      criticalPath: critical.criticalPath
+    };
+    this.opts.onDone?.(summary);
+    return summary;
+  }
+  /** Stop execution. */
+  stop() {
+    this.stopped = true;
+  }
+  /** Get tasks that are ready to execute (all dependencies completed). */
+  getReadyTasks(graph) {
+    const ready = [];
+    for (const node of graph.nodes.values()) {
+      if (node.status !== "pending") continue;
+      const blockers = graph.edges.filter((e) => e.type === "depends_on" && e.from === node.id).map((e) => graph.nodes.get(e.to)).filter(Boolean);
+      const allBlockersDone = blockers.every((b) => b.status === "completed");
+      if (allBlockersDone) {
+        ready.push(node);
+      }
+    }
+    const priorityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
+    ready.sort((a, b) => (priorityOrder[a.priority] ?? 4) - (priorityOrder[b.priority] ?? 4));
+    return ready;
+  }
+  /** Execute a single task with retry logic. */
+  async executeTaskWithRetry(task, graph, spec) {
+    const maxRetries = this.opts.maxRetries ?? 2;
+    let retryCount = this.retryMap.get(task.id) ?? 0;
+    while (retryCount <= maxRetries) {
+      this.opts.tracker.updateNodeStatus(task.id, "in_progress");
+      this.opts.onTaskStart?.(task);
+      const dependencies = this.getTaskDependencies(task.id, graph);
+      const dependents = this.getTaskDependents(task.id, graph);
+      const context = {
+        spec,
+        graph,
+        task,
+        dependencies,
+        dependents,
+        retryCount
+      };
+      try {
+        const result = await this.opts.executeTask(task, context);
+        if (result.success) {
+          const retriesForTask = this.retryMap.get(task.id) ?? 0;
+          this.retryMap.delete(task.id);
+          return { result, retries: retriesForTask };
+        }
+        if (result.retry && retryCount < maxRetries) {
+          retryCount++;
+          this.retryMap.set(task.id, retryCount);
+          this.opts.tracker.updateNodeStatus(task.id, "pending");
+          continue;
+        }
+        return { result, retries: retryCount };
+      } catch (error) {
+        if (retryCount < maxRetries) {
+          retryCount++;
+          this.retryMap.set(task.id, retryCount);
+          this.opts.tracker.updateNodeStatus(task.id, "pending");
+          this.opts.onTaskFail?.(task, error, retryCount);
+          continue;
+        }
+        return {
+          result: {
+            success: false,
+            error: error instanceof Error ? error.message : String(error)
+          },
+          retries: retryCount
+        };
+      }
+    }
+    return { result: { success: false, error: "Max retries exceeded" }, retries: retryCount };
+  }
+  /** Get tasks that this task depends on. */
+  getTaskDependencies(taskId, graph) {
+    return graph.edges.filter((e) => e.type === "depends_on" && e.from === taskId).map((e) => graph.nodes.get(e.to)).filter(Boolean);
+  }
+  /** Get tasks that depend on this task. */
+  getTaskDependents(taskId, graph) {
+    return graph.edges.filter((e) => e.type === "depends_on" && e.to === taskId).map((e) => graph.nodes.get(e.from)).filter(Boolean);
+  }
+  /** Detect deadlock: all remaining tasks are blocked by failed tasks. */
+  detectDeadlock(graph) {
+    const remaining = Array.from(graph.nodes.values()).filter(
+      (n) => n.status === "pending" || n.status === "blocked"
+    );
+    if (remaining.length === 0) return false;
+    return remaining.every((node) => {
+      const blockers = graph.edges.filter((e) => e.type === "depends_on" && e.from === node.id).map((e) => graph.nodes.get(e.to)).filter(Boolean);
+      return blockers.some((b) => b.status === "failed");
+    });
+  }
+};
+function createAutoExecutor(opts) {
+  return new AutoExecutor({
+    tracker: opts.tracker,
+    events: opts.events,
+    executeTask: opts.executeTask,
+    maxConcurrent: opts.maxConcurrent,
+    maxRetries: opts.maxRetries
+  });
+}
+
+// src/observability/metrics.ts
+var RESERVOIR_SIZE = 1024;
+function labelKey(labels) {
+  if (!labels) return "";
+  const keys = Object.keys(labels).sort();
+  return keys.map((k) => `${k}=${labels[k]}`).join(",");
+}
+function quantile(sorted, q) {
+  if (sorted.length === 0) return 0;
+  const idx = Math.min(sorted.length - 1, Math.floor(q * sorted.length));
+  return sorted[idx] ?? 0;
+}
+var InMemoryMetricsSink = class {
+  counters = /* @__PURE__ */ new Map();
+  gauges = /* @__PURE__ */ new Map();
+  histograms = /* @__PURE__ */ new Map();
+  counter(name, value = 1, labels) {
+    const series = this.getOrCreate(this.counters, name);
+    const key = labelKey(labels);
+    const state = series.get(key) ?? { value: 0 };
+    state.value += value;
+    series.set(key, state);
+  }
+  gauge(name, value, labels) {
+    const series = this.getOrCreate(this.gauges, name);
+    series.set(labelKey(labels), { value });
+  }
+  histogram(name, value, labels) {
+    const series = this.getOrCreate(this.histograms, name);
+    const key = labelKey(labels);
+    let state = series.get(key);
+    if (!state) {
       state = { count: 0, sum: 0, min: value, max: value, samples: [] };
       series.set(key, state);
     }
@@ -8586,7 +10456,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path15 = opts.path ?? "/metrics";
+  const path17 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const listener = (req, res) => {
@@ -8596,7 +10466,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path15) {
+    if (url === path17) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -8660,7 +10530,7 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path15}`,
+    url: `${protocol}://${host}:${boundPort}${path17}`,
     close: () => new Promise((resolve2, reject) => {
       server.close((err) => err ? reject(err) : resolve2());
     })
@@ -8995,13 +10865,17 @@ function createContextManagerTool(opts = {}) {
       };
       switch (input.action) {
         case "check": {
+          const estimate = input.systemPrompt != null && Array.isArray(input.tools) ? estimateRequestTokens(messages, input.systemPrompt, input.tools) : { total: beforeTokens, messages: beforeTokens, systemPrompt: 0, tools: 0 };
           return {
             action: "check",
-            beforeTokens,
+            beforeTokens: estimate.total,
             messageCount: messages.length,
             notes: JSON.stringify({
               messages: messages.length,
-              tokens: beforeTokens,
+              tokens: estimate.total,
+              msgTokens: estimate.messages,
+              sysTokens: estimate.systemPrompt,
+              toolTokens: estimate.tools,
               readFiles: ctx.readFiles.size,
               todos: ctx.todos.length,
               inProgress: ctx.todos.filter((t) => t.status === "in_progress").length
@@ -9162,7 +11036,6 @@ var githubServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-github"],
-  env: { GITHUB_PERSONAL_ACCESS_TOKEN: process.env.GITHUB_PERSONAL_ACCESS_TOKEN ?? "" },
   permission: "confirm"
 });
 var context7Server = () => ({
@@ -9178,7 +11051,6 @@ var braveSearchServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-brave-search"],
-  env: { BRAVE_SEARCH_API_KEY: process.env.BRAVE_SEARCH_API_KEY ?? "" },
   permission: "confirm"
 });
 var blockServer = () => ({
@@ -9195,7 +11067,6 @@ var everArtServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-everart"],
-  env: { EVERART_API_KEY: process.env.EVERART_API_KEY ?? "" },
   permission: "confirm"
 });
 var slackServer = () => ({
@@ -9204,10 +11075,6 @@ var slackServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-slack"],
-  env: {
-    SLACK_BOT_TOKEN: process.env.SLACK_BOT_TOKEN ?? "",
-    SLACK_TEAM_ID: process.env.SLACK_TEAM_ID ?? ""
-  },
   permission: "confirm"
 });
 var awsServer = () => ({
@@ -9224,7 +11091,6 @@ var googleMapsServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@modelcontextprotocol/server-google-maps"],
-  env: { GOOGLE_MAPS_API_KEY: process.env.GOOGLE_MAPS_API_KEY ?? "" },
   permission: "confirm"
 });
 var sentinelServer = () => ({
@@ -9241,10 +11107,7 @@ var zaiVisionServer = () => ({
   transport: "stdio",
   command: "npx",
   args: ["-y", "@z_ai/mcp-server@latest"],
-  env: {
-    Z_AI_API_KEY: process.env.Z_AI_API_KEY ?? "",
-    Z_AI_MODE: process.env.Z_AI_MODE ?? "ZAI"
-  },
+  env: { Z_AI_MODE: "ZAI" },
   allowedTools: [
     "image_analysis",
     "extract_text_from_screenshot",
@@ -9262,10 +11125,9 @@ var miniMaxVisionServer = () => ({
   command: "uvx",
   args: ["minimax-coding-plan-mcp", "-y"],
   env: {
-    MINIMAX_API_KEY: process.env.MINIMAX_API_KEY ?? "",
-    MINIMAX_MCP_BASE_PATH: process.env.MINIMAX_MCP_BASE_PATH ?? "./.wrongstack/minimax-output",
-    MINIMAX_API_HOST: process.env.MINIMAX_API_HOST ?? "https://api.minimax.io",
-    MINIMAX_API_RESOURCE_MODE: process.env.MINIMAX_API_RESOURCE_MODE ?? "url"
+    MINIMAX_MCP_BASE_PATH: "./.wrongstack/minimax-output",
+    MINIMAX_API_HOST: "https://api.minimax.io",
+    MINIMAX_API_RESOURCE_MODE: "url"
   },
   allowedTools: ["understand_image"],
   permission: "auto"
@@ -9285,6 +11147,6 @@ var allServers = () => ({
   "minimax-vision": { ...miniMaxVisionServer(), enabled: false }
 });
 
-export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorBudgetError, DirectorStateCheckpoint, DoneConditionChecker, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SubagentBudget, TaskFlow, TaskGenerator, TaskTracker, ToolExecutor, addPlanItem, allServers, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createContextManagerTool, createDelegateTool, createMessage, decryptConfigSecrets2 as decryptConfigSecrets, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, githubServer, googleMapsServer, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderPrometheus, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents, zaiVisionServer };
+export { AISpecBuilder, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorBudgetError, DirectorStateCheckpoint, DoneConditionChecker, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, decryptConfigSecrets2 as decryptConfigSecrets, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, getTemplate, githubServer, googleMapsServer, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map