cc-claw 0.16.3 → 0.17.0

package/dist/cli.js

@@ -33,7 +33,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = true ? "0.16.3" : (() => {
+    VERSION = true ? "0.17.0" : (() => {
       try {
         return JSON.parse(readFileSync(join(process.cwd(), "package.json"), "utf-8")).version ?? "unknown";
       } catch {
@@ -1729,6 +1729,12 @@ function initSchema(db3) {
       mode TEXT NOT NULL DEFAULT 'auto'
     );
   `);
+  db3.exec(`
+    CREATE TABLE IF NOT EXISTS chat_exec_mode (
+      chat_id TEXT PRIMARY KEY,
+      mode TEXT NOT NULL DEFAULT 'approved'
+    );
+  `);
   db3.exec(`
     CREATE TABLE IF NOT EXISTS backend_credentials (
       id                 INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -2643,6 +2649,22 @@ function setAgentMode(chatId, mode) {
 function clearAgentMode(chatId) {
   getDb().prepare("DELETE FROM chat_agent_mode WHERE chat_id = ?").run(chatId);
 }
+function getExecMode(chatId) {
+  const row = getDb().prepare(
+    "SELECT mode FROM chat_exec_mode WHERE chat_id = ?"
+  ).get(chatId);
+  return row?.mode ?? "approved";
+}
+function setExecMode(chatId, mode) {
+  getDb().prepare(`
+    INSERT INTO chat_exec_mode (chat_id, mode)
+    VALUES (?, ?)
+    ON CONFLICT(chat_id) DO UPDATE SET mode = excluded.mode
+  `).run(chatId, mode);
+}
+function clearExecMode(chatId) {
+  getDb().prepare("DELETE FROM chat_exec_mode WHERE chat_id = ?").run(chatId);
+}
 var pendingEscalations, ESCALATION_TTL_MS, ALL_TOOLS;
 var init_chat_settings = __esm({
   "src/memory/chat-settings.ts"() {
@@ -3450,6 +3472,7 @@ __export(store_exports5, {
   clearChatBackendSlot: () => clearChatBackendSlot,
   clearChatGeminiSlot: () => clearChatGeminiSlot,
   clearCwd: () => clearCwd,
+  clearExecMode: () => clearExecMode,
   clearMessageLog: () => clearMessageLog,
   clearModel: () => clearModel,
   clearSession: () => clearSession,
@@ -3487,6 +3510,7 @@ __export(store_exports5, {
   getEligibleBackendSlots: () => getEligibleBackendSlots,
   getEligibleGeminiSlots: () => getEligibleGeminiSlots,
   getEnabledTools: () => getEnabledTools,
+  getExecMode: () => getExecMode,
   getGeminiRotationMode: () => getGeminiRotationMode,
   getGeminiSlots: () => getGeminiSlots,
   getHeartbeatConfig: () => getHeartbeatConfig,
@@ -3557,6 +3581,7 @@ __export(store_exports5, {
   setBootTime: () => setBootTime,
   setChatAlias: () => setChatAlias,
   setCwd: () => setCwd,
+  setExecMode: () => setExecMode,
   setGeminiRotationMode: () => setGeminiRotationMode,
   setGeminiSlotEnabled: () => setGeminiSlotEnabled,
   setHeartbeatConfig: () => setHeartbeatConfig,
@@ -3944,10 +3969,199 @@ var init_claude = __esm({
   }
 });
 
+// src/slots/symlink-manager.ts
+var symlink_manager_exports = {};
+__export(symlink_manager_exports, {
+  SYMLINK_LAYOUTS: () => SYMLINK_LAYOUTS,
+  getPrimaryDir: () => getPrimaryDir,
+  migrateAllSlots: () => migrateAllSlots,
+  migrateExistingSlots: () => migrateExistingSlots,
+  setupSlotSymlinks: () => setupSlotSymlinks,
+  validateSlotSymlinks: () => validateSlotSymlinks
+});
+import { existsSync as existsSync3, lstatSync, mkdirSync, readlinkSync, readdirSync as readdirSync2, symlinkSync, rmSync, copyFileSync, statSync as statSync2 } from "fs";
+import { join as join5, dirname } from "path";
+function setupSlotSymlinks(backend2, slotDir, primaryDir) {
+  const layout = SYMLINK_LAYOUTS[backend2];
+  if (!layout) {
+    log(`[symlink] No layout defined for backend "${backend2}", skipping`);
+    return;
+  }
+  for (const entry of layout.symlinks) {
+    const slotPath = join5(slotDir, entry.slotSubpath);
+    const primaryTarget = join5(primaryDir, entry.primarySubpath);
+    if (!existsSync3(primaryTarget)) {
+      mkdirSync(primaryTarget, { recursive: true });
+    }
+    if (existsSync3(slotPath) || isSymlink(slotPath)) {
+      if (isSymlink(slotPath)) {
+        const currentTarget = readlinkSync(slotPath);
+        if (currentTarget === primaryTarget) {
+          continue;
+        }
+        rmSync(slotPath);
+      } else {
+        migrateDirectoryContents(slotPath, primaryTarget);
+        rmSync(slotPath, { recursive: true });
+      }
+    }
+    const parentDir = dirname(slotPath);
+    if (!existsSync3(parentDir)) {
+      mkdirSync(parentDir, { recursive: true });
+    }
+    symlinkSync(primaryTarget, slotPath);
+    log(`[symlink] ${backend2}: ${slotPath} \u2192 ${primaryTarget}`);
+  }
+}
+function validateSlotSymlinks(backend2, slotDir, primaryDir) {
+  const layout = SYMLINK_LAYOUTS[backend2];
+  if (!layout) return { valid: true, broken: [] };
+  const broken = [];
+  for (const entry of layout.symlinks) {
+    const slotPath = join5(slotDir, entry.slotSubpath);
+    const primaryTarget = join5(primaryDir, entry.primarySubpath);
+    if (!isSymlink(slotPath)) {
+      if (existsSync3(slotPath)) {
+        broken.push({ path: slotPath, issue: "real directory instead of symlink" });
+      } else {
+        broken.push({ path: slotPath, issue: "symlink missing" });
+      }
+      continue;
+    }
+    const currentTarget = readlinkSync(slotPath);
+    if (currentTarget !== primaryTarget) {
+      broken.push({ path: slotPath, issue: `symlink points to ${currentTarget}, expected ${primaryTarget}` });
+      continue;
+    }
+    if (!existsSync3(primaryTarget)) {
+      broken.push({ path: slotPath, issue: `symlink target ${primaryTarget} does not exist` });
+    }
+  }
+  return { valid: broken.length === 0, broken };
+}
+function migrateExistingSlots(backend2, slotsDir, primaryDir) {
+  if (!existsSync3(slotsDir)) {
+    return { migrated: 0, skipped: 0, errors: [] };
+  }
+  const layout = SYMLINK_LAYOUTS[backend2];
+  if (!layout) return { migrated: 0, skipped: 0, errors: [] };
+  const entries = readdirSync2(slotsDir, { withFileTypes: true });
+  let migrated = 0;
+  let skipped = 0;
+  const errors = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const slotDir = join5(slotsDir, entry.name);
+    const validation = validateSlotSymlinks(backend2, slotDir, primaryDir);
+    if (validation.valid) {
+      skipped++;
+      continue;
+    }
+    try {
+      setupSlotSymlinks(backend2, slotDir, primaryDir);
+      migrated++;
+      log(`[symlink] Migrated slot: ${entry.name}`);
+    } catch (err) {
+      const msg = `Failed to migrate ${entry.name}: ${err instanceof Error ? err.message : String(err)}`;
+      errors.push(msg);
+      log(`[symlink] ERROR: ${msg}`);
+    }
+  }
+  return { migrated, skipped, errors };
+}
+function getPrimaryDir(backend2) {
+  const resolver = PRIMARY_DIR_MAP[backend2];
+  return resolver ? resolver() : null;
+}
+function migrateAllSlots(ccClawHome) {
+  const backends = [
+    { id: "claude", slotsSubdir: "claude-slots" },
+    { id: "codex", slotsSubdir: "codex-slots" },
+    { id: "gemini", slotsSubdir: "gemini-slots" }
+  ];
+  for (const { id, slotsSubdir } of backends) {
+    const slotsDir = join5(ccClawHome, slotsSubdir);
+    const primaryDir = getPrimaryDir(id);
+    if (!primaryDir || !existsSync3(slotsDir)) continue;
+    const result = migrateExistingSlots(id, slotsDir, primaryDir);
+    if (result.migrated > 0) {
+      log(`[symlink] ${id}: migrated ${result.migrated} slot(s), skipped ${result.skipped}`);
+    }
+    if (result.errors.length > 0) {
+      for (const err of result.errors) log(`[symlink] ${id}: ${err}`);
+    }
+  }
+}
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function migrateDirectoryContents(src, dest) {
+  if (!existsSync3(src) || !statSync2(src).isDirectory()) return;
+  const entries = readdirSync2(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = join5(src, entry.name);
+    const destPath = join5(dest, entry.name);
+    if (entry.isDirectory()) {
+      if (!existsSync3(destPath)) {
+        mkdirSync(destPath, { recursive: true });
+      }
+      migrateDirectoryContents(srcPath, destPath);
+    } else if (entry.isFile()) {
+      if (!existsSync3(destPath)) {
+        copyFileSync(srcPath, destPath);
+      }
+    }
+  }
+}
+var SYMLINK_LAYOUTS, PRIMARY_DIR_MAP;
+var init_symlink_manager = __esm({
+  "src/slots/symlink-manager.ts"() {
+    "use strict";
+    init_log();
+    SYMLINK_LAYOUTS = {
+      claude: {
+        symlinks: [
+          { slotSubpath: ".claude/projects", primarySubpath: "projects" },
+          { slotSubpath: ".claude/plans", primarySubpath: "plans" }
+        ]
+      },
+      codex: {
+        symlinks: [
+          { slotSubpath: "memories", primarySubpath: "memories" }
+        ]
+      },
+      gemini: {
+        symlinks: [
+          { slotSubpath: ".gemini/history", primarySubpath: "history" },
+          { slotSubpath: ".gemini/tmp", primarySubpath: "tmp" }
+        ]
+      }
+    };
+    PRIMARY_DIR_MAP = {
+      claude: () => {
+        const home = process.env.HOME ?? `/Users/${process.env.USER ?? "unknown"}`;
+        return join5(home, ".claude");
+      },
+      codex: () => {
+        const home = process.env.HOME ?? `/Users/${process.env.USER ?? "unknown"}`;
+        return process.env.CODEX_HOME ?? join5(home, ".codex");
+      },
+      gemini: () => {
+        const home = process.env.HOME ?? `/Users/${process.env.USER ?? "unknown"}`;
+        return process.env.GEMINI_CLI_HOME ?? join5(home, ".gemini");
+      }
+    };
+  }
+});
+
 // src/backends/gemini.ts
-import { existsSync as existsSync3, mkdirSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var GeminiAdapter;
 var init_gemini = __esm({
   "src/backends/gemini.ts"() {
@@ -4015,14 +4229,14 @@ var init_gemini = __esm({
             `${home}/.local/bin/gemini`,
             `${home}/.npm-global/bin/gemini`
           ];
-          this._resolvedPath = candidates.find((p) => existsSync3(p)) ?? "gemini";
+          this._resolvedPath = candidates.find((p) => existsSync4(p)) ?? "gemini";
         }
         return this._resolvedPath;
       }
       getEnv(thinkingOverrides) {
         const env = buildBaseEnv(thinkingOverrides);
-        const identityFile = join5(IDENTITY_PATH, "CC-CLAW.md");
-        if (existsSync3(identityFile)) {
+        const identityFile = join6(IDENTITY_PATH, "CC-CLAW.md");
+        if (existsSync4(identityFile)) {
           env.GEMINI_SYSTEM_MD = identityFile;
         }
         return env;
@@ -4112,11 +4326,17 @@ var init_gemini = __esm({
         if (!slot) return { env, slot: null };
         if (slot.slotType === "api_key" && slot.apiKey) {
           env.GEMINI_API_KEY = slot.apiKey;
-          const isolatedHome = join5(CC_CLAW_HOME, "gemini-slots", `apikey-${slot.id}`);
-          if (!existsSync3(isolatedHome)) mkdirSync(isolatedHome, { recursive: true });
+          const isolatedHome = join6(CC_CLAW_HOME, "gemini-slots", `apikey-${slot.id}`);
+          if (!existsSync4(isolatedHome)) mkdirSync2(isolatedHome, { recursive: true });
           log(`[gemini] api_key slot ${slot.id}: isolated home \u2192 ${isolatedHome}`);
           env.GEMINI_CLI_HOME = isolatedHome;
           delete env.GOOGLE_API_KEY;
+          try {
+            const { setupSlotSymlinks: setupSlotSymlinks2, getPrimaryDir: getPrimaryDir2 } = (init_symlink_manager(), __toCommonJS(symlink_manager_exports));
+            const primaryDir = getPrimaryDir2("gemini");
+            if (primaryDir) setupSlotSymlinks2("gemini", isolatedHome, primaryDir);
+          } catch {
+          }
         } else if (slot.slotType === "oauth" && slot.configHome) {
           env.GEMINI_CLI_HOME = slot.configHome;
           delete env.GEMINI_API_KEY;
@@ -4135,7 +4355,7 @@ var init_gemini = __esm({
 });
 
 // src/backends/codex.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { execSync as execSync2 } from "child_process";
 var CodexAdapter;
 var init_codex = __esm({
@@ -4210,7 +4430,7 @@ var init_codex = __esm({
             `${home}/.local/bin/codex`,
             `${home}/.npm-global/bin/codex`
           ];
-          this._resolvedPath = candidates.find((p) => existsSync4(p)) ?? "codex";
+          this._resolvedPath = candidates.find((p) => existsSync5(p)) ?? "codex";
         }
         return this._resolvedPath;
       }
@@ -4321,7 +4541,7 @@ var init_codex = __esm({
 });
 
 // src/backends/cursor.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { execSync as execSync3 } from "child_process";
 function extractToolInfo(tc) {
   if (tc.readToolCall) {
@@ -4470,7 +4690,7 @@ var init_cursor = __esm({
             `${home}/.local/bin/agent`,
             "/usr/local/bin/agent"
           ];
-          this._resolvedPath = candidates.find((p) => existsSync5(p)) ?? "agent";
+          this._resolvedPath = candidates.find((p) => existsSync6(p)) ?? "agent";
         }
         return this._resolvedPath;
       }
@@ -4634,14 +4854,14 @@ __export(backends_exports, {
   isBackendAvailable: () => isBackendAvailable,
   probeBackendAvailability: () => probeBackendAvailability
 });
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { execSync as execSync4 } from "child_process";
 function probeBackendAvailability() {
   availableSet.clear();
   for (const [id, adapter] of Object.entries(adapters)) {
     try {
       const exe = adapter.getExecutablePath();
-      if (existsSync6(exe) || resolveOnPath(exe)) {
+      if (existsSync7(exe) || resolveOnPath(exe)) {
         availableSet.add(id);
       }
     } catch {
@@ -4650,7 +4870,7 @@ function probeBackendAvailability() {
   log(`[backends] Available: ${[...availableSet].join(", ") || "none"}`);
 }
 function resolveOnPath(name) {
-  if (name.includes("/")) return existsSync6(name);
+  if (name.includes("/")) return existsSync7(name);
   try {
     execSync4(`which ${name}`, { encoding: "utf-8", timeout: 3e3 });
     return true;
@@ -5073,19 +5293,19 @@ If the user asks *how* to do something with CC-Claw, use this expertise to sugge
 
 // src/bootstrap/init.ts
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   writeFileSync,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync2,
-  statSync as statSync2,
-  copyFileSync,
+  statSync as statSync3,
+  copyFileSync as copyFileSync2,
   unlinkSync as unlinkSync2
 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 function migrateFile(legacyPath, newPath, label2) {
-  if (existsSync7(newPath)) return false;
-  if (existsSync7(legacyPath)) {
-    copyFileSync(legacyPath, newPath);
+  if (existsSync8(newPath)) return false;
+  if (existsSync8(legacyPath)) {
+    copyFileSync2(legacyPath, newPath);
     const copied = readFileSync2(newPath, "utf-8");
     if (copied.length > 0) {
       unlinkSync2(legacyPath);
@@ -5098,28 +5318,28 @@ function migrateFile(legacyPath, newPath, label2) {
   return false;
 }
 function bootstrapWorkspaceFiles() {
-  if (!existsSync7(IDENTITY_PATH)) {
-    mkdirSync2(IDENTITY_PATH, { recursive: true });
+  if (!existsSync8(IDENTITY_PATH)) {
+    mkdirSync3(IDENTITY_PATH, { recursive: true });
     log("[bootstrap] Created identity/ directory");
   }
-  if (!existsSync7(WORKSPACE_PATH)) {
-    mkdirSync2(WORKSPACE_PATH, { recursive: true });
+  if (!existsSync8(WORKSPACE_PATH)) {
+    mkdirSync3(WORKSPACE_PATH, { recursive: true });
   }
   migrateFile(LEGACY_SOUL_PATH, SOUL_PATH, "SOUL.md");
   migrateFile(LEGACY_USER_PATH, USER_PATH, "USER.md");
-  if (existsSync7(LEGACY_CLAUDE_MD)) {
+  if (existsSync8(LEGACY_CLAUDE_MD)) {
     unlinkSync2(LEGACY_CLAUDE_MD);
     log("[bootstrap] Removed legacy workspace/CLAUDE.md (replaced by identity/CC-CLAW.md)");
   }
-  if (existsSync7(LEGACY_GEMINI_MD)) {
+  if (existsSync8(LEGACY_GEMINI_MD)) {
     unlinkSync2(LEGACY_GEMINI_MD);
     log("[bootstrap] Removed legacy workspace/GEMINI.md (replaced by identity/CC-CLAW.md)");
   }
-  if (!existsSync7(SOUL_PATH)) {
+  if (!existsSync8(SOUL_PATH)) {
     writeFileSync(SOUL_PATH, DEFAULT_SOUL, "utf-8");
     log("[bootstrap] Created default SOUL.md");
   }
-  if (!existsSync7(USER_PATH)) {
+  if (!existsSync8(USER_PATH)) {
     let tz = "UTC";
     try {
       tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
@@ -5129,16 +5349,16 @@ function bootstrapWorkspaceFiles() {
     writeFileSync(USER_PATH, userContent, "utf-8");
     log(`[bootstrap] Created default USER.md (timezone: ${tz})`);
   }
-  if (!existsSync7(CONTEXT_DIR)) {
-    mkdirSync2(CONTEXT_DIR, { recursive: true });
+  if (!existsSync8(CONTEXT_DIR)) {
+    mkdirSync3(CONTEXT_DIR, { recursive: true });
     log("[bootstrap] Created context/ directory");
   }
-  if (!existsSync7(MEDIA_PATH)) {
-    mkdirSync2(MEDIA_PATH, { recursive: true });
+  if (!existsSync8(MEDIA_PATH)) {
+    mkdirSync3(MEDIA_PATH, { recursive: true });
     log("[bootstrap] Created media/ directory");
   }
-  const expertisePath = join6(CONTEXT_DIR, "cc-claw-expertise.md");
-  if (!existsSync7(expertisePath)) {
+  const expertisePath = join7(CONTEXT_DIR, "cc-claw-expertise.md");
+  if (!existsSync8(expertisePath)) {
     writeFileSync(expertisePath, DEFAULT_EXPERTISE, "utf-8");
     log("[bootstrap] Created default context/cc-claw-expertise.md");
   }
@@ -5153,13 +5373,13 @@ function bootstrapWorkspaceFiles() {
     "!context/**",
     ""
   ].join("\n");
-  const gitignorePath = join6(WORKSPACE_PATH, ".gitignore");
-  if (!existsSync7(gitignorePath)) {
+  const gitignorePath = join7(WORKSPACE_PATH, ".gitignore");
+  if (!existsSync8(gitignorePath)) {
     writeFileSync(gitignorePath, IGNORE_CONTENT, "utf-8");
     log("[bootstrap] Created .gitignore (workspace allowlist)");
   }
-  const geminiignorePath = join6(WORKSPACE_PATH, ".geminiignore");
-  if (!existsSync7(geminiignorePath)) {
+  const geminiignorePath = join7(WORKSPACE_PATH, ".geminiignore");
+  if (!existsSync8(geminiignorePath)) {
     writeFileSync(geminiignorePath, IGNORE_CONTENT, "utf-8");
     log("[bootstrap] Created .geminiignore (workspace allowlist)");
   }
@@ -5185,8 +5405,8 @@ function syncNativeCliFiles() {
     }
   }
   try {
-    const soulMtime = existsSync7(SOUL_PATH) ? statSync2(SOUL_PATH).mtimeMs : 0;
-    const userMtime = existsSync7(USER_PATH) ? statSync2(USER_PATH).mtimeMs : 0;
+    const soulMtime = existsSync8(SOUL_PATH) ? statSync3(SOUL_PATH).mtimeMs : 0;
+    const userMtime = existsSync8(USER_PATH) ? statSync3(USER_PATH).mtimeMs : 0;
     if (soulMtime > 0 && soulMtime === lastSoulMtime && userMtime === lastUserMtime) {
       return;
     }
@@ -5223,15 +5443,38 @@ function syncNativeCliFiles() {
     "## CRITICAL: Tool Usage Rules",
     "",
     "- Do NOT use native CLI memory/storage tools (save_memory, etc.) \u2014 they are backend-local and invisible to other backends",
-    "- Do NOT modify the database directly with SQL (no INSERT/UPDATE/DELETE) \u2014 use CC-Claw commands only",
     "- To save a memory: use /remember in Telegram, or tell the user to use it",
     "- To learn your full CLI: run `cc-claw --ai`",
     "- All state changes must go through the CC-Claw API layer for cross-backend persistence",
+    "",
+    "## \u26D4 DATABASE SAFETY BOUNDARY \u2014 ABSOLUTE PROHIBITION",
+    "",
+    "**NEVER access ~/.cc-claw/data/cc-claw.db directly. No exceptions. No excuses.**",
+    "",
+    "This means ALL of the following are FORBIDDEN:",
+    "- `sqlite3 ~/.cc-claw/data/cc-claw.db` \u2014 FORBIDDEN",
+    "- `sqlite3` with any path containing `cc-claw` \u2014 FORBIDDEN",
+    "- `.schema`, `.tables`, `.dump`, or any SQLite dot-command \u2014 FORBIDDEN",
+    "- `SELECT`, `INSERT`, `UPDATE`, `DELETE` queries \u2014 ALL FORBIDDEN",
+    "- Reading the database file with `cat`, `hexdump`, `xxd`, `strings` \u2014 FORBIDDEN",
+    "- ANY tool or command that opens, reads, queries, or inspects this database \u2014 FORBIDDEN",
+    "",
+    "**Why:** The database is a live, WAL-mode SQLite file shared with the running daemon. Direct access risks corruption, lock contention, and data inconsistency. You are an agent RUNNING INSIDE CC-Claw \u2014 never touch the infrastructure that runs you.",
+    "",
+    "**What to use instead:**",
+    "- `cc-claw status` \u2014 system status",
+    "- `cc-claw --json status` \u2014 machine-readable status",
+    "- `cc-claw cron list` \u2014 scheduled jobs",
+    "- `cc-claw claude list` / `cc-claw codex list` / `cc-claw gemini list` \u2014 credential slots",
+    "- `cc-claw --ai` \u2014 full CLI reference",
+    "- Ask the user to check via Telegram commands if needed",
+    "",
+    "**Violation of this rule is a critical safety failure.**",
     ""
   ].join("\n");
-  const ccClawPath = join6(IDENTITY_PATH, "CC-CLAW.md");
+  const ccClawPath = join7(IDENTITY_PATH, "CC-CLAW.md");
   writeFileSync(ccClawPath, nativeContent, "utf-8");
-  const agentsPath = join6(WORKSPACE_PATH, "AGENTS.md");
+  const agentsPath = join7(WORKSPACE_PATH, "AGENTS.md");
   writeFileSync(agentsPath, nativeContent, "utf-8");
   log("[bootstrap] Synced SOUL.md + USER.md \u2192 identity/CC-CLAW.md, workspace/AGENTS.md");
 }
@@ -5242,32 +5485,32 @@ var init_init = __esm({
     init_paths();
     init_defaults();
     init_log();
-    SOUL_PATH = join6(IDENTITY_PATH, "SOUL.md");
-    USER_PATH = join6(IDENTITY_PATH, "USER.md");
-    CONTEXT_DIR = join6(WORKSPACE_PATH, "context");
-    LEGACY_SOUL_PATH = join6(WORKSPACE_PATH, "SOUL.md");
-    LEGACY_USER_PATH = join6(WORKSPACE_PATH, "USER.md");
-    LEGACY_CLAUDE_MD = join6(WORKSPACE_PATH, "CLAUDE.md");
-    LEGACY_GEMINI_MD = join6(WORKSPACE_PATH, "GEMINI.md");
+    SOUL_PATH = join7(IDENTITY_PATH, "SOUL.md");
+    USER_PATH = join7(IDENTITY_PATH, "USER.md");
+    CONTEXT_DIR = join7(WORKSPACE_PATH, "context");
+    LEGACY_SOUL_PATH = join7(WORKSPACE_PATH, "SOUL.md");
+    LEGACY_USER_PATH = join7(WORKSPACE_PATH, "USER.md");
+    LEGACY_CLAUDE_MD = join7(WORKSPACE_PATH, "CLAUDE.md");
+    LEGACY_GEMINI_MD = join7(WORKSPACE_PATH, "GEMINI.md");
     lastSoulMtime = 0;
     lastUserMtime = 0;
   }
 });
 
 // src/bootstrap/loader.ts
-import { readFileSync as readFileSync3, existsSync as existsSync8, readdirSync as readdirSync2 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync9, readdirSync as readdirSync3 } from "fs";
+import { join as join8 } from "path";
 function searchContext(userMessage) {
-  if (!existsSync8(CONTEXT_DIR2)) return null;
+  if (!existsSync9(CONTEXT_DIR2)) return null;
   const msgWords = new Set(
     userMessage.toLowerCase().replace(/[^\w\s]/g, " ").split(/\s+/).filter((w) => w.length > 3)
   );
   if (msgWords.size === 0) return null;
   let bestMatch = null;
   try {
-    const files = readdirSync2(CONTEXT_DIR2).filter((f) => f.endsWith(".md"));
+    const files = readdirSync3(CONTEXT_DIR2).filter((f) => f.endsWith(".md"));
     for (const file of files) {
-      const filePath = join7(CONTEXT_DIR2, file);
+      const filePath = join8(CONTEXT_DIR2, file);
       try {
         const content = readFileSync3(filePath, "utf-8").trim();
         if (!content) continue;
@@ -5295,8 +5538,11 @@ function searchContext(userMessage) {
   }
   return null;
 }
-async function assembleBootstrapPrompt(userMessage, tier = "full", chatId, permMode, responseStyle, agentMode, sideQuestContext) {
+async function assembleBootstrapPrompt(userMessage, tier = "full", chatId, permMode, responseStyle, agentMode, sideQuestContext, planningDirective) {
   const sections = [];
+  if (planningDirective) {
+    sections.push(planningDirective);
+  }
   if (Date.now() - lastSyncMs >= 5e3) {
     syncNativeCliFiles();
     lastSyncMs = Date.now();
@@ -5492,7 +5738,7 @@ var init_loader = __esm({
     init_store();
     init_backends();
     lastSyncMs = 0;
-    CONTEXT_DIR2 = join7(WORKSPACE_PATH, "context");
+    CONTEXT_DIR2 = join8(WORKSPACE_PATH, "context");
     MAX_CONTEXT_CHARS = 4e3;
     ACTIVITY_TOKEN_BUDGET = 1500;
     INBOX_TOKEN_BUDGET = 2e3;
@@ -5984,13 +6230,13 @@ var init_quota = __esm({
 
 // src/dashboard/middleware.ts
 import { randomBytes } from "crypto";
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync4 } from "fs";
 function getDashboardToken() {
   return DASHBOARD_TOKEN;
 }
 function persistToken() {
   try {
-    mkdirSync3(DATA_PATH, { recursive: true });
+    mkdirSync4(DATA_PATH, { recursive: true });
     const tokenPath = `${DATA_PATH}/api-token`;
     writeFileSync2(tokenPath, DASHBOARD_TOKEN, { mode: 384 });
   } catch (err) {
@@ -6677,14 +6923,14 @@ var init_propagate = __esm({
 });
 
 // src/agents/mcp-config.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, existsSync as existsSync9, readdirSync as readdirSync3, unlinkSync as unlinkSync3 } from "fs";
-import { join as join8, dirname } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, existsSync as existsSync10, readdirSync as readdirSync4, unlinkSync as unlinkSync3 } from "fs";
+import { join as join9, dirname as dirname2 } from "path";
 import { fileURLToPath } from "url";
 function generateOrchestratorMcpConfig(opts) {
   const port = opts.port ?? process.env.DASHBOARD_PORT ?? "3141";
-  const distPath = join8(__dirname, "agents", "mcp-server.js");
-  const tsxPath = join8(__dirname, "..", "src", "agents", "mcp-server.ts");
-  const useTs = !existsSync9(distPath);
+  const distPath = join9(__dirname, "agents", "mcp-server.js");
+  const tsxPath = join9(__dirname, "..", "src", "agents", "mcp-server.ts");
+  const useTs = !existsSync10(distPath);
   return {
     name: opts.agentId === "main" ? "cc-claw" : `cc-claw-${opts.agentId.slice(0, 8)}`,
     transport: "stdio",
@@ -6699,7 +6945,7 @@ function generateOrchestratorMcpConfig(opts) {
   };
 }
 function writeMcpConfigFile(config2) {
-  mkdirSync4(MCP_CONFIG_DIR, { recursive: true, mode: 448 });
+  mkdirSync5(MCP_CONFIG_DIR, { recursive: true, mode: 448 });
   const jsonConfig = {
     mcpServers: {
       [config2.name]: {
@@ -6710,13 +6956,13 @@ function writeMcpConfigFile(config2) {
     }
   };
   const safeName = config2.name.replace(/[^a-zA-Z0-9-]/g, "_");
-  const configPath = join8(MCP_CONFIG_DIR, `mcp-${safeName}.json`);
+  const configPath = join9(MCP_CONFIG_DIR, `mcp-${safeName}.json`);
   writeFileSync3(configPath, JSON.stringify(jsonConfig, null, 2), { mode: 384 });
   return configPath;
 }
 function deleteMcpConfigFile(mcpName) {
   const safeName = mcpName.replace(/[^a-zA-Z0-9-]/g, "_");
-  const configPath = join8(MCP_CONFIG_DIR, `mcp-${safeName}.json`);
+  const configPath = join9(MCP_CONFIG_DIR, `mcp-${safeName}.json`);
   try {
     unlinkSync3(configPath);
   } catch {
@@ -6724,12 +6970,12 @@ function deleteMcpConfigFile(mcpName) {
 }
 function cleanupOrphanedMcpConfigs() {
   try {
-    if (!existsSync9(MCP_CONFIG_DIR)) return;
-    const files = readdirSync3(MCP_CONFIG_DIR);
+    if (!existsSync10(MCP_CONFIG_DIR)) return;
+    const files = readdirSync4(MCP_CONFIG_DIR);
     for (const file of files) {
       if (file.startsWith("mcp-cc-claw-") && file.endsWith(".json")) {
         try {
-          unlinkSync3(join8(MCP_CONFIG_DIR, file));
+          unlinkSync3(join9(MCP_CONFIG_DIR, file));
         } catch {
         }
       }
@@ -6743,8 +6989,8 @@ var init_mcp_config = __esm({
     "use strict";
     init_paths();
     __filename = fileURLToPath(import.meta.url);
-    __dirname = dirname(__filename);
-    MCP_CONFIG_DIR = join8(CC_CLAW_HOME, "mcp-configs");
+    __dirname = dirname2(__filename);
+    MCP_CONFIG_DIR = join9(CC_CLAW_HOME, "mcp-configs");
   }
 });
 
@@ -6754,8 +7000,8 @@ __export(loader_exports, {
   getTemplate: () => getTemplate,
   listTemplates: () => listTemplates
 });
-import { readdirSync as readdirSync4, readFileSync as readFileSync5 } from "fs";
-import { join as join9 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join10 } from "path";
 function parseFrontmatter(content) {
   const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/m);
   if (!match || match.index !== 0) return { meta: {}, body: content.trim() };
@@ -6788,12 +7034,12 @@ function scanTemplates() {
   templateCache.clear();
   let files;
   try {
-    files = readdirSync4(AGENTS_PATH).filter((f) => f.endsWith(".md"));
+    files = readdirSync5(AGENTS_PATH).filter((f) => f.endsWith(".md"));
   } catch {
     return;
   }
   for (const file of files) {
-    const filePath = join9(AGENTS_PATH, file);
+    const filePath = join10(AGENTS_PATH, file);
     try {
       const raw = readFileSync5(filePath, "utf-8");
       const { meta, body } = parseFrontmatter(raw);
@@ -6842,8 +7088,8 @@ var init_loader2 = __esm({
 });
 
 // src/agents/agent-log.ts
-import { writeFileSync as writeFileSync4, readdirSync as readdirSync5, statSync as statSync3, unlinkSync as unlinkSync4, mkdirSync as mkdirSync5 } from "fs";
-import { join as join10 } from "path";
+import { writeFileSync as writeFileSync4, readdirSync as readdirSync6, statSync as statSync4, unlinkSync as unlinkSync4, mkdirSync as mkdirSync6 } from "fs";
+import { join as join11 } from "path";
 function truncate(text, maxBytes) {
   if (Buffer.byteLength(text, "utf-8") <= maxBytes) return text;
   let lo = 0, hi = text.length;
@@ -6858,7 +7104,7 @@ function truncate(text, maxBytes) {
 [...truncated ${droppedBytes} bytes...]`;
 }
 function writeAgentLog(data) {
-  const logPath = join10(AGENTS_PATH, `${data.agentId}.log`);
+  const logPath = join11(AGENTS_PATH, `${data.agentId}.log`);
   const exitDisplay = data.exitCodeForced ? `${data.exitCode} (forced \u2014 no output from original exit code 0)` : String(data.exitCode ?? "null");
   const stderrContent = truncate(data.stderr || "(empty)", MAX_STDERR_BYTES);
   const stdoutContent = truncate(data.rawStdoutLines.join("\n") || "(empty)", MAX_STDOUT_BYTES);
@@ -6882,7 +7128,7 @@ function writeAgentLog(data) {
     ""
   ];
   try {
-    mkdirSync5(AGENTS_PATH, { recursive: true });
+    mkdirSync6(AGENTS_PATH, { recursive: true });
     writeFileSync4(logPath, lines.join("\n"), "utf-8");
   } catch (err) {
     log(`[agent-log] Failed to write log for ${data.agentId}: ${err}`);
@@ -6891,10 +7137,10 @@ function writeAgentLog(data) {
 }
 function pruneAgentLogs() {
   try {
-    mkdirSync5(AGENTS_PATH, { recursive: true });
-    const files = readdirSync5(AGENTS_PATH).filter((f) => f.endsWith(".log")).map((f) => {
-      const fullPath = join10(AGENTS_PATH, f);
-      const stat4 = statSync3(fullPath);
+    mkdirSync6(AGENTS_PATH, { recursive: true });
+    const files = readdirSync6(AGENTS_PATH).filter((f) => f.endsWith(".log")).map((f) => {
+      const fullPath = join11(AGENTS_PATH, f);
+      const stat4 = statSync4(fullPath);
       return { path: fullPath, mtime: stat4.mtimeMs, size: stat4.size };
     });
     const now = Date.now();
@@ -6939,7 +7185,7 @@ var init_agent_log = __esm({
 });
 
 // src/agents/orchestrator.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 async function withRunnerLock(runnerId, fn) {
   const prev = runnerLocks.get(runnerId) ?? Promise.resolve();
   const next = prev.then(fn, () => fn());
@@ -7057,7 +7303,7 @@ async function spawnSubAgent(chatId, opts) {
 async function startAgent(agentId, chatId, opts) {
   const db3 = getDb();
   const runner = getRunner(opts.runner);
-  if (opts.cwd && !existsSync10(opts.cwd)) {
+  if (opts.cwd && !existsSync11(opts.cwd)) {
     const msg = `Directory not found: ${opts.cwd}`;
     error(`[orchestrator] Agent ${agentId}: ${msg}`);
     updateAgentStatus(db3, agentId, "failed");
@@ -7079,7 +7325,7 @@ async function startAgent(agentId, chatId, opts) {
     return;
   }
   const exePath = runner.getExecutablePath();
-  if (exePath.startsWith("/") && !existsSync10(exePath)) {
+  if (exePath.startsWith("/") && !existsSync11(exePath)) {
     const msg = `Executable not found: ${exePath}`;
     error(`[orchestrator] Agent ${agentId}: ${msg}`);
     updateAgentStatus(db3, agentId, "failed");
@@ -7349,10 +7595,10 @@ async function startAgent(agentId, chatId, opts) {
 function diagnoseSpawnError(err, exePath, cwd) {
   const nodeErr = err;
   if (nodeErr.code === "ENOENT") {
-    if (cwd && !existsSync10(cwd)) {
+    if (cwd && !existsSync11(cwd)) {
       return `Directory not found: ${cwd}`;
     }
-    if (exePath.startsWith("/") && !existsSync10(exePath)) {
+    if (exePath.startsWith("/") && !existsSync11(exePath)) {
       return `Executable not found: ${exePath}`;
     }
     return `ENOENT spawning ${exePath} (cwd: ${cwd ?? "inherited"}) \u2014 check that both the binary and directory exist`;
@@ -7741,7 +7987,7 @@ var init_registry2 = __esm({
 });
 
 // src/dashboard/routes/orchestrator.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 var handleSpawn, handleCancel, handleCancelAll, handleCreateTask, handleUpdateTask, handleSendMessage, handleReadInbox, handleSetState, handleGetState, handleListState, handleBroadcast, handleListRunners, handleListMcps, handleListTemplates, handleCheckAgent;
 var init_orchestrator2 = __esm({
   "src/dashboard/routes/orchestrator.ts"() {
@@ -7757,7 +8003,7 @@ var init_orchestrator2 = __esm({
     handleSpawn = async (req, res) => {
       try {
         const body = JSON.parse(await readBody(req));
-        if (body.cwd && !existsSync11(body.cwd)) {
+        if (body.cwd && !existsSync12(body.cwd)) {
           return jsonResponse(res, { error: `Directory not found: ${body.cwd}` }, 400);
         }
         if (!body.permMode || body.permMode === "inherit") {
@@ -9024,8 +9270,8 @@ __export(analyze_exports, {
 });
 import { spawn as spawn4 } from "child_process";
 import { createInterface as createInterface3 } from "readline";
-import { readFileSync as readFileSync6, existsSync as existsSync12, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync13, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
+import { join as join12 } from "path";
 import { homedir as homedir4 } from "os";
 function applySignalDecay(confidence, createdAt) {
   const ageMs = Date.now() - (/* @__PURE__ */ new Date(createdAt + (createdAt.endsWith("Z") ? "" : "Z"))).getTime();
@@ -9034,16 +9280,16 @@ function applySignalDecay(confidence, createdAt) {
   return decayed >= SIGNAL_DECAY_MIN_CONFIDENCE ? Math.round(decayed * 100) / 100 : 0;
 }
 function discoverReflectionTargets() {
-  const ccClawHome = join11(homedir4(), ".cc-claw");
+  const ccClawHome = join12(homedir4(), ".cc-claw");
   const targets = [];
   try {
-    const skillsDir = join11(ccClawHome, "workspace", "skills");
-    if (existsSync12(skillsDir)) {
-      for (const entry of readdirSync6(skillsDir)) {
-        const entryPath = join11(skillsDir, entry);
-        if (!statSync4(entryPath).isDirectory()) continue;
-        const skillFile = join11(entryPath, "SKILL.md");
-        if (!existsSync12(skillFile)) continue;
+    const skillsDir = join12(ccClawHome, "workspace", "skills");
+    if (existsSync13(skillsDir)) {
+      for (const entry of readdirSync7(skillsDir)) {
+        const entryPath = join12(skillsDir, entry);
+        if (!statSync5(entryPath).isDirectory()) continue;
+        const skillFile = join12(entryPath, "SKILL.md");
+        if (!existsSync13(skillFile)) continue;
         let desc = "skill";
         try {
           const content = readFileSync6(skillFile, "utf-8");
@@ -9057,9 +9303,9 @@ function discoverReflectionTargets() {
   } catch {
   }
   try {
-    const contextDir = join11(ccClawHome, "workspace", "context");
-    if (existsSync12(contextDir)) {
-      for (const entry of readdirSync6(contextDir)) {
+    const contextDir = join12(ccClawHome, "workspace", "context");
+    if (existsSync13(contextDir)) {
+      for (const entry of readdirSync7(contextDir)) {
         if (!entry.endsWith(".md")) continue;
         const name = entry.replace(/\.md$/, "");
         targets.push({ path: `workspace/context/${entry}`, description: `context file: ${name}` });
@@ -9247,7 +9493,7 @@ function resolveReflectionAdapter(chatId) {
 }
 function readIdentityFile(filename) {
   try {
-    return readFileSync6(join11(IDENTITY_PATH, filename), "utf-8");
+    return readFileSync6(join12(IDENTITY_PATH, filename), "utf-8");
   } catch {
     return "";
   }
@@ -9395,7 +9641,7 @@ async function runAnalysisImpl(chatId, opts) {
   const availableTargets = discoverReflectionTargets();
   const SKILL_CONTENT_CAP = 15e3;
   const skillContents = [];
-  const ccClawHome = join11(homedir4(), ".cc-claw");
+  const ccClawHome = join12(homedir4(), ".cc-claw");
   const signalCorpus = signals.map((s) => s.trigger).join(" ").toLowerCase();
   const convCorpus = (conversations ?? "").toLowerCase();
   const searchCorpus = signalCorpus + " " + convCorpus;
@@ -9408,8 +9654,8 @@ async function runAnalysisImpl(chatId, opts) {
     const isRelevant = searchCorpus.includes(skillNameNorm) || searchCorpus.includes(skillName.toLowerCase()) || descNorm.split(/\s+/).some((word) => word.length > 4 && searchCorpus.includes(word));
     if (!isRelevant) continue;
     try {
-      const fullPath = join11(ccClawHome, target.path);
-      if (existsSync12(fullPath)) {
+      const fullPath = join12(ccClawHome, target.path);
+      if (existsSync13(fullPath)) {
         const content = readFileSync6(fullPath, "utf-8");
         if (totalSkillChars + content.length > SKILL_CONTENT_CAP) break;
         skillContents.push({ path: target.path, content });
@@ -9615,8 +9861,8 @@ __export(apply_exports, {
   isTargetAllowed: () => isTargetAllowed,
   rollbackInsight: () => rollbackInsight
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync13, mkdirSync as mkdirSync6, readdirSync as readdirSync7, unlinkSync as unlinkSync5 } from "fs";
-import { join as join12, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync8, unlinkSync as unlinkSync5 } from "fs";
+import { join as join13, dirname as dirname3 } from "path";
 function isTargetAllowed(relativePath) {
   if (relativePath.includes("..")) return false;
   if (!relativePath.endsWith(".md")) return false;
@@ -9667,10 +9913,10 @@ function applyDiff(original, diff, action) {
   return original;
 }
 function pruneBackups(absolutePath) {
-  const dir = dirname2(absolutePath);
+  const dir = dirname3(absolutePath);
   const baseName = absolutePath.split("/").pop() ?? "";
   try {
-    const backups = readdirSync7(dir).filter((f) => f.startsWith(baseName + ".bak.")).sort().map((f) => join12(dir, f));
+    const backups = readdirSync8(dir).filter((f) => f.startsWith(baseName + ".bak.")).sort().map((f) => join13(dir, f));
     while (backups.length > MAX_BACKUPS_PER_FILE) {
       const oldest = backups.shift();
       try {
@@ -9696,9 +9942,9 @@ async function applyInsight(insightId) {
   if (!isTargetAllowed(insight.targetFile)) {
     return { success: false, message: `Target file "${insight.targetFile}" is not in the allowed list` };
   }
-  const absolutePath = join12(CC_CLAW_HOME, insight.targetFile);
+  const absolutePath = join13(CC_CLAW_HOME, insight.targetFile);
   if (insight.proposedAction === "append" && insight.targetFile === "identity/SOUL.md") {
-    if (existsSync13(absolutePath)) {
+    if (existsSync14(absolutePath)) {
       const currentContent = readFileSync7(absolutePath, "utf-8");
       const lineCount = currentContent.split("\n").length;
       if (lineCount >= SOUL_LINE_CAP) {
@@ -9720,7 +9966,7 @@ async function applyInsight(insightId) {
     };
   }
   let original = "";
-  if (existsSync13(absolutePath)) {
+  if (existsSync14(absolutePath)) {
     original = readFileSync7(absolutePath, "utf-8");
   } else if (insight.proposedAction !== "create") {
     return { success: false, message: `Target file "${insight.targetFile}" does not exist` };
@@ -9728,9 +9974,9 @@ async function applyInsight(insightId) {
   const timestamp = Date.now();
   const backupPath = absolutePath + `.bak.${timestamp}`;
   try {
-    const parentDir = dirname2(absolutePath);
-    if (!existsSync13(parentDir)) {
-      mkdirSync6(parentDir, { recursive: true });
+    const parentDir = dirname3(absolutePath);
+    if (!existsSync14(parentDir)) {
+      mkdirSync7(parentDir, { recursive: true });
     }
     if (original) {
       writeFileSync5(backupPath, original, "utf-8");
@@ -9793,7 +10039,7 @@ async function rollbackInsight(insightId) {
   } catch {
     return { success: false, message: `Insight #${insightId} has malformed rollback data` };
   }
-  const absolutePath = join12(CC_CLAW_HOME, insight.targetFile);
+  const absolutePath = join13(CC_CLAW_HOME, insight.targetFile);
   try {
     writeFileSync5(absolutePath, rollback.original, "utf-8");
     updateInsightStatus(db3, insightId, "rolled_back");
@@ -9826,8 +10072,8 @@ function calculateDrift(chatId) {
   if (!row || !row.baselineSoulMd && !row.baselineUserMd) {
     return null;
   }
-  const soulPath = join12(CC_CLAW_HOME, "identity/SOUL.md");
-  const userPath = join12(CC_CLAW_HOME, "identity/USER.md");
+  const soulPath = join13(CC_CLAW_HOME, "identity/SOUL.md");
+  const userPath = join13(CC_CLAW_HOME, "identity/USER.md");
   const soulDrift = computeLineDrift(row.baselineSoulMd, soulPath);
   const userDrift = computeLineDrift(row.baselineUserMd, userPath);
   return { soulDrift, userDrift };
@@ -9836,7 +10082,7 @@ function computeLineDrift(baseline, absolutePath) {
   if (!baseline) return 0;
   let current = "";
   try {
-    if (existsSync13(absolutePath)) {
+    if (existsSync14(absolutePath)) {
       current = readFileSync7(absolutePath, "utf-8");
     }
   } catch {
@@ -9932,11 +10178,11 @@ var init_evolve = __esm({
         const body = JSON.parse(await readBody(req));
         const { setReflectionStatus: setReflectionStatus2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
         const { existsSync: fileExists, readFileSync: fileRead } = await import("fs");
-        const { join: join29 } = await import("path");
+        const { join: join30 } = await import("path");
         const { CC_CLAW_HOME: home } = await Promise.resolve().then(() => (init_paths(), paths_exports));
         const chatId = body.chatId || (process.env.ALLOWED_CHAT_ID ?? "").split(",")[0]?.trim() || "default";
-        const soulPath = join29(home, "identity/SOUL.md");
-        const userPath = join29(home, "identity/USER.md");
+        const soulPath = join30(home, "identity/SOUL.md");
+        const userPath = join30(home, "identity/USER.md");
         const soul = fileExists(soulPath) ? fileRead(soulPath, "utf-8") : "";
         const user = fileExists(userPath) ? fileRead(userPath, "utf-8") : "";
         setReflectionStatus2(getDb(), chatId, "active", soul, user);
@@ -10882,7 +11128,7 @@ function askAgent(chatId, userMessage, opts) {
   return withChatLock(chatId, () => askAgentImpl(chatId, userMessage, opts));
 }
 async function askAgentImpl(chatId, userMessage, opts) {
-  const { cwd, onStream, model: model2, backend: backend2, permMode, onToolAction, bootstrapTier, timeoutMs, maxTurns, onSlotRotation, onModelDowngrade, agentMode: optsAgentMode, onSubagentActivity, settingsSourceChatId } = opts ?? {};
+  const { cwd, onStream, model: model2, backend: backend2, permMode, onToolAction, bootstrapTier, timeoutMs, maxTurns, onSlotRotation, onModelDowngrade, agentMode: optsAgentMode, onSubagentActivity, settingsSourceChatId, planningDirective } = opts ?? {};
   const settingsChat = settingsSourceChatId ?? chatId;
   const adapter = backend2 ? getAdapter(backend2) : getAdapterForChat(settingsChat);
   const mode = permMode ?? getMode(settingsChat);
@@ -10892,7 +11138,7 @@ async function askAgentImpl(chatId, userMessage, opts) {
   const tier = bootstrapTier ?? "full";
   const effectiveAgentMode = optsAgentMode ?? getAgentMode(settingsChat);
   const sideQuestCtx = settingsSourceChatId ? { parentChatId: settingsSourceChatId, actualChatId: chatId } : void 0;
-  const fullPrompt = await assembleBootstrapPrompt(userMessage, tier, settingsChat, mode, responseStyle, effectiveAgentMode, sideQuestCtx);
+  const fullPrompt = await assembleBootstrapPrompt(userMessage, tier, settingsChat, mode, responseStyle, effectiveAgentMode, sideQuestCtx, planningDirective);
   const existingSessionId = settingsSourceChatId ? null : getSessionId(settingsChat);
   const allowedTools = getEnabledTools(settingsChat);
   const mcpConfigPath = tier !== "slim" && effectiveAgentMode !== "native" && MCP_CONFIG_FLAG[adapter.id] ? getMcpConfigPath(chatId) : null;
@@ -11494,9 +11740,9 @@ function buildReviewCompleteMessage(results) {
 
 Skipped proposals will appear in your next review.`;
 }
-function formatNightlySummary(insights) {
-  const count = insights.length;
-  const header2 = `Nightly Reflection \u2014 ${count} proposal${count === 1 ? "" : "s"} ready`;
+function formatNightlySummary(insights, totalPending) {
+  const displayCount = totalPending ?? insights.length;
+  const header2 = `Nightly Reflection \u2014 ${displayCount} proposal${displayCount === 1 ? "" : "s"} ready`;
   const list = insights.map((ins, i) => `${i + 1}. [${ins.category}] ${ins.insight}`).join("\n");
   return `${header2}
 
@@ -11607,8 +11853,8 @@ var init_propose = __esm({
 });
 
 // src/bootstrap/profile.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync14 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync15 } from "fs";
+import { join as join14 } from "path";
 function hasActiveProfile(chatId) {
   return activeProfiles.has(chatId);
 }
@@ -11737,7 +11983,7 @@ function extractUserUpdates(text) {
   return { cleanText, updates };
 }
 function appendToUserProfile(key, value) {
-  if (!existsSync14(USER_PATH2)) return;
+  if (!existsSync15(USER_PATH2)) return;
   const content = readFileSync8(USER_PATH2, "utf-8");
   const line = `- **${key}**: ${value}`;
   if (content.includes(line)) return;
@@ -11753,7 +11999,7 @@ var init_profile = __esm({
     "use strict";
     init_paths();
     init_log();
-    USER_PATH2 = join13(IDENTITY_PATH, "USER.md");
+    USER_PATH2 = join14(IDENTITY_PATH, "USER.md");
     activeProfiles = /* @__PURE__ */ new Map();
   }
 });
@@ -12584,6 +12830,88 @@ var init_classify2 = __esm({
   }
 });
 
+// src/execution/gate.ts
+function shouldRequireApproval(input) {
+  if (input.execMode !== "approved") return false;
+  if (input.intent !== "agentic") return false;
+  if (input.isResuming) return false;
+  if (input.messageText.startsWith(">>")) return false;
+  if (EXEMPT_TIERS.has(input.bootstrapTier)) return false;
+  if (input.isSideQuest) return false;
+  return true;
+}
+function buildPlanningDirective() {
+  return [
+    "## PLANNING MODE \u2014 Read-Only",
+    "",
+    "You are in PLANNING mode. Your goal is to research and present a plan.",
+    "",
+    "**ALLOWED:**",
+    "- Read files, directories, and code",
+    "- Load and read skills",
+    "- Search the codebase (grep, glob, find)",
+    "- Search the web for documentation or solutions",
+    "- Analyze and reason about architecture",
+    "",
+    "**NOT ALLOWED:**",
+    "- Do NOT create, modify, or delete any files",
+    "- Do NOT run shell commands that mutate state",
+    "- Do NOT write code or make edits",
+    "- Do NOT install packages or dependencies",
+    "",
+    "**YOUR TASK:**",
+    "Research the request thoroughly, then present a clear, concise plan",
+    "of what you will do. The user will review and approve before you execute.",
+    "Structure your plan with numbered steps and be specific about which",
+    "files you will modify and what changes you will make."
+  ].join("\n");
+}
+function storePendingPlan(chatId, plan, originalMessage) {
+  pendingPlans.set(chatId, {
+    plan,
+    originalMessage,
+    createdAt: Date.now()
+  });
+}
+function getPendingPlan(chatId) {
+  const entry = pendingPlans.get(chatId);
+  if (!entry) return void 0;
+  if (Date.now() - entry.createdAt > PLAN_TTL_MS) {
+    pendingPlans.delete(chatId);
+    return void 0;
+  }
+  return entry;
+}
+function removePendingPlan(chatId) {
+  pendingPlans.delete(chatId);
+}
+function setRejectionMode(chatId) {
+  rejectionModes.set(chatId, Date.now());
+}
+function getRejectionMode(chatId) {
+  const createdAt = rejectionModes.get(chatId);
+  if (createdAt === void 0) return false;
+  if (Date.now() - createdAt > REJECTION_TTL_MS) {
+    rejectionModes.delete(chatId);
+    return false;
+  }
+  return true;
+}
+function clearRejectionMode(chatId) {
+  rejectionModes.delete(chatId);
+}
+var EXEMPT_TIERS, PLAN_TTL_MS, pendingPlans, REJECTION_TTL_MS, rejectionModes;
+var init_gate = __esm({
+  "src/execution/gate.ts"() {
+    "use strict";
+    EXEMPT_TIERS = /* @__PURE__ */ new Set(["slim", "heartbeat", "chat"]);
+    PLAN_TTL_MS = 5 * 60 * 1e3;
+    pendingPlans = /* @__PURE__ */ new Map();
+    REJECTION_TTL_MS = 5 * 60 * 1e3;
+    rejectionModes = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/router/helpers.ts
 import { resolve as resolvePath } from "path";
 function parseMcpListOutput(output2) {
@@ -13284,9 +13612,9 @@ var init_stt = __esm({
 });
 
 // src/media/image-gen.ts
-import { mkdirSync as mkdirSync7, existsSync as existsSync15, unlink as unlink2, readdir, stat } from "fs";
+import { mkdirSync as mkdirSync8, existsSync as existsSync16, unlink as unlink2, readdir, stat } from "fs";
 import { writeFile } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 async function generateImage(prompt) {
   const apiKey = process.env.GEMINI_API_KEY;
   if (!apiKey) {
@@ -13333,12 +13661,12 @@ async function generateImage(prompt) {
   if (!imageData) {
     throw new Error(textResponse ?? "Gemini did not generate an image. The prompt may have been filtered.");
   }
-  if (!existsSync15(IMAGE_OUTPUT_DIR)) {
-    mkdirSync7(IMAGE_OUTPUT_DIR, { recursive: true });
+  if (!existsSync16(IMAGE_OUTPUT_DIR)) {
+    mkdirSync8(IMAGE_OUTPUT_DIR, { recursive: true });
   }
   const ext = mimeType.includes("jpeg") || mimeType.includes("jpg") ? "jpg" : "png";
   const filename = `img_${Date.now()}.${ext}`;
-  const filePath = join14(IMAGE_OUTPUT_DIR, filename);
+  const filePath = join15(IMAGE_OUTPUT_DIR, filename);
   const buffer = Buffer.from(imageData, "base64");
   await writeFile(filePath, buffer);
   log(`[image-gen] Saved ${buffer.length} bytes to ${filePath}`);
@@ -13356,7 +13684,7 @@ function cleanupGeneratedImage(filePath) {
 function pruneImageCache() {
   readdir(IMAGE_OUTPUT_DIR, (err, files) => {
     if (err || !files) return;
-    const imageFiles = files.filter((f) => /\.(png|jpg)$/.test(f)).map((f) => join14(IMAGE_OUTPUT_DIR, f));
+    const imageFiles = files.filter((f) => /\.(png|jpg)$/.test(f)).map((f) => join15(IMAGE_OUTPUT_DIR, f));
     if (imageFiles.length === 0) return;
     const now = Date.now();
     let statsPending = imageFiles.length;
@@ -13388,8 +13716,8 @@ var init_image_gen = __esm({
     MAX_GENERATED_IMAGES = 20;
     IMAGE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
     IMAGE_MODEL = "gemini-3.1-flash-image-preview";
-    IMAGE_OUTPUT_DIR = join14(
-      process.env.CC_CLAW_HOME ?? join14(process.env.HOME ?? "/tmp", ".cc-claw"),
+    IMAGE_OUTPUT_DIR = join15(
+      process.env.CC_CLAW_HOME ?? join15(process.env.HOME ?? "/tmp", ".cc-claw"),
       "data",
       "images"
     );
@@ -13862,7 +14190,7 @@ var init_video = __esm({
 });
 
 // src/router/media.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { mkdir, writeFile as writeFile2, readdir as readdir2, stat as stat2, unlink as unlink3 } from "fs/promises";
 function getMediaRetentionMs() {
   const hours = parseInt(process.env.MEDIA_RETENTION_HOURS ?? "24", 10);
@@ -13871,7 +14199,7 @@ function getMediaRetentionMs() {
 async function saveMedia(buffer, prefix, ext) {
   await mkdir(MEDIA_INCOMING_PATH, { recursive: true });
   const filename = `${prefix}-${Date.now()}.${ext}`;
-  const fullPath = join15(MEDIA_INCOMING_PATH, filename);
+  const fullPath = join16(MEDIA_INCOMING_PATH, filename);
   await writeFile2(fullPath, buffer);
   return fullPath;
 }
@@ -13885,7 +14213,7 @@ async function cleanupOldMedia() {
     let removed = 0;
     for (const file of files) {
       try {
-        const filePath = join15(MEDIA_INCOMING_PATH, file);
+        const filePath = join16(MEDIA_INCOMING_PATH, file);
         const s = await stat2(filePath);
         if (now - s.mtimeMs > retentionMs) {
           await unlink3(filePath);
@@ -14068,7 +14396,7 @@ var init_media = __esm({
     init_store5();
     init_helpers();
     init_response();
-    MEDIA_INCOMING_PATH = join15(MEDIA_PATH, "incoming");
+    MEDIA_INCOMING_PATH = join16(MEDIA_PATH, "incoming");
   }
 });
 
@@ -14204,7 +14532,7 @@ __export(discover_exports, {
 import { readdir as readdir3, readFile as readFile4 } from "fs/promises";
 import { createHash } from "crypto";
 import { homedir as homedir5 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function invalidateSkillCache() {
   cachedSkills = null;
   cacheTimestamp = 0;
@@ -14222,7 +14550,7 @@ async function discoverAllSkills() {
       const rawSkills = [];
       rawSkills.push(...await scanSkillDir(SKILLS_PATH, "cc-claw"));
       for (const backendId of getAllBackendIds()) {
-        const dirs = BACKEND_SKILL_DIRS[backendId] ?? [join16(homedir5(), `.${backendId}`, "skills")];
+        const dirs = BACKEND_SKILL_DIRS[backendId] ?? [join17(homedir5(), `.${backendId}`, "skills")];
         for (const dir of dirs) {
           rawSkills.push(...await scanSkillDir(dir, backendId));
         }
@@ -14250,7 +14578,7 @@ async function scanSkillDir(skillsDir, source) {
     let content;
     let resolvedPath;
     for (const candidate of SKILL_FILE_CANDIDATES) {
-      const p = join16(skillsDir, entry.name, candidate);
+      const p = join17(skillsDir, entry.name, candidate);
       try {
         content = await readFile4(p, "utf-8");
         resolvedPath = p;
@@ -14354,15 +14682,15 @@ var init_discover = __esm({
     init_backends();
     SKILL_FILE_CANDIDATES = ["SKILL.md", "skill.md"];
     BACKEND_SKILL_DIRS = {
-      claude: [join16(homedir5(), ".claude", "skills")],
-      gemini: [join16(homedir5(), ".gemini", "skills")],
+      claude: [join17(homedir5(), ".claude", "skills")],
+      gemini: [join17(homedir5(), ".gemini", "skills")],
       codex: [
-        join16(homedir5(), ".agents", "skills"),
-        join16(homedir5(), ".codex", "skills")
+        join17(homedir5(), ".agents", "skills"),
+        join17(homedir5(), ".codex", "skills")
       ],
       cursor: [
-        join16(homedir5(), ".cursor", "skills"),
-        join16(homedir5(), ".cursor", "skills-cursor")
+        join17(homedir5(), ".cursor", "skills"),
+        join17(homedir5(), ".cursor", "skills-cursor")
       ]
     };
     CACHE_TTL_MS2 = 3e5;
@@ -14378,8 +14706,8 @@ __export(install_exports, {
   installSkillFromGitHub: () => installSkillFromGitHub
 });
 import { mkdir as mkdir2, readdir as readdir4, readFile as readFile5, cp } from "fs/promises";
-import { existsSync as existsSync16 } from "fs";
-import { join as join17, basename } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { join as join18, basename } from "path";
 import { execSync as execSync5 } from "child_process";
 async function installSkillFromGitHub(urlOrShorthand) {
   let repoUrl;
@@ -14390,36 +14718,36 @@ async function installSkillFromGitHub(urlOrShorthand) {
   }
   repoUrl = parsed.cloneUrl;
   subPath = parsed.subPath;
-  const tmpDir = join17("/tmp", `cc-claw-skill-${Date.now()}`);
+  const tmpDir = join18("/tmp", `cc-claw-skill-${Date.now()}`);
   try {
     log(`[skill-install] Cloning ${repoUrl} to ${tmpDir}`);
     execSync5(`git clone --depth 1 ${repoUrl} ${tmpDir}`, {
       stdio: "pipe",
       timeout: 3e4
     });
-    if (!existsSync16(join17(tmpDir, ".git"))) {
+    if (!existsSync17(join18(tmpDir, ".git"))) {
       return { success: false, error: "Git clone failed: no .git directory produced" };
     }
-    const searchRoot = subPath ? join17(tmpDir, subPath) : tmpDir;
+    const searchRoot = subPath ? join18(tmpDir, subPath) : tmpDir;
     const skillDir = await findSkillDir(searchRoot);
     if (!skillDir) {
       return { success: false, error: "No SKILL.md found in the repository." };
     }
     const skillFolderName = basename(skillDir);
-    const destDir = join17(SKILLS_PATH, skillFolderName);
-    if (existsSync16(destDir)) {
+    const destDir = join18(SKILLS_PATH, skillFolderName);
+    if (existsSync17(destDir)) {
       log(`[skill-install] Overwriting existing skill at ${destDir}`);
     }
     await mkdir2(destDir, { recursive: true });
     await cp(skillDir, destDir, { recursive: true });
     let skillName = skillFolderName;
     try {
-      const content = await readFile5(join17(destDir, "SKILL.md"), "utf-8");
+      const content = await readFile5(join18(destDir, "SKILL.md"), "utf-8");
       const nameMatch = content.match(/^name:\s*(.+)$/m);
       if (nameMatch) skillName = nameMatch[1].trim().replace(/^["']|["']$/g, "");
     } catch {
       try {
-        const content = await readFile5(join17(destDir, "skill.md"), "utf-8");
+        const content = await readFile5(join18(destDir, "skill.md"), "utf-8");
         const nameMatch = content.match(/^name:\s*(.+)$/m);
         if (nameMatch) skillName = nameMatch[1].trim().replace(/^["']|["']$/g, "");
       } catch {
@@ -14454,15 +14782,15 @@ function parseGitHubUrl(input) {
 async function findSkillDir(root) {
   const candidates = ["SKILL.md", "skill.md"];
   for (const c of candidates) {
-    if (existsSync16(join17(root, c))) return root;
+    if (existsSync17(join18(root, c))) return root;
   }
   try {
     const entries = await readdir4(root, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
       for (const c of candidates) {
-        if (existsSync16(join17(root, entry.name, c))) {
-          return join17(root, entry.name);
+        if (existsSync17(join18(root, entry.name, c))) {
+          return join18(root, entry.name);
         }
       }
     }
@@ -14474,15 +14802,15 @@ async function findSkillDir(root) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
       let subEntries;
       try {
-        subEntries = await readdir4(join17(root, entry.name), { withFileTypes: true });
+        subEntries = await readdir4(join18(root, entry.name), { withFileTypes: true });
       } catch {
         continue;
       }
       for (const sub of subEntries) {
         if (!sub.isDirectory() || sub.name.startsWith(".")) continue;
         for (const c of candidates) {
-          if (existsSync16(join17(root, entry.name, sub.name, c))) {
-            return join17(root, entry.name, sub.name);
+          if (existsSync17(join18(root, entry.name, sub.name, c))) {
+            return join18(root, entry.name, sub.name);
           }
         }
       }
@@ -14500,8 +14828,8 @@ var init_install = __esm({
 });
 
 // src/bootstrap/heartbeat.ts
-import { readFileSync as readFileSync9, existsSync as existsSync17 } from "fs";
-import { join as join18 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync18 } from "fs";
+import { join as join19 } from "path";
 function initHeartbeat(channelReg) {
   registry2 = channelReg;
 }
@@ -14639,7 +14967,7 @@ ${healthLines.join("\n")}`);
     sections.push(`[Active watches]
 ${watchLines.join("\n")}`);
   }
-  if (existsSync17(HEARTBEAT_MD_PATH)) {
+  if (existsSync18(HEARTBEAT_MD_PATH)) {
     try {
       const custom = readFileSync9(HEARTBEAT_MD_PATH, "utf-8").trim();
       if (custom) {
@@ -14687,7 +15015,7 @@ var init_heartbeat2 = __esm({
     init_backends();
     init_health2();
     init_log();
-    HEARTBEAT_MD_PATH = join18(WORKSPACE_PATH, "HEARTBEAT.md");
+    HEARTBEAT_MD_PATH = join19(WORKSPACE_PATH, "HEARTBEAT.md");
     HEARTBEAT_OK = "HEARTBEAT_OK";
     registry2 = null;
     activeTimers = /* @__PURE__ */ new Map();
@@ -15744,9 +16072,9 @@ async function handleEvolveCallback(chatId, data, channel) {
         await channel.sendText(chatId, "No pending proposals.", { parseMode: "plain" });
       } else {
         const insightIds = pending.slice(0, 5).map((p) => p.id);
-        createReviewSession2(getDb(), reflChatId, insightIds);
+        createReviewSession2(getDb(), chatId, insightIds);
         await channel.sendText(chatId, `${pending.length} proposal(s) ready. Let's review them one by one.`, { parseMode: "plain" });
-        await sendCurrentProposal(reflChatId, channel);
+        await sendCurrentProposal(chatId, channel);
       }
       break;
     }
@@ -15904,13 +16232,13 @@ async function handleEvolveCallback(chatId, data, channel) {
       const { getReflectionStatus: getReflectionStatus2, setReflectionStatus: setReflectionStatus2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
       const current = getReflectionStatus2(getDb(), chatId);
       if (current === "frozen") {
-        const { readFileSync: readFileSync22, existsSync: existsSync49 } = await import("fs");
-        const { join: join29 } = await import("path");
+        const { readFileSync: readFileSync22, existsSync: existsSync50 } = await import("fs");
+        const { join: join30 } = await import("path");
         const { CC_CLAW_HOME: CC_CLAW_HOME3 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
-        const soulPath = join29(CC_CLAW_HOME3, "identity/SOUL.md");
-        const userPath = join29(CC_CLAW_HOME3, "identity/USER.md");
-        const soul = existsSync49(soulPath) ? readFileSync22(soulPath, "utf-8") : "";
-        const user = existsSync49(userPath) ? readFileSync22(userPath, "utf-8") : "";
+        const soulPath = join30(CC_CLAW_HOME3, "identity/SOUL.md");
+        const userPath = join30(CC_CLAW_HOME3, "identity/USER.md");
+        const soul = existsSync50(soulPath) ? readFileSync22(soulPath, "utf-8") : "";
+        const user = existsSync50(userPath) ? readFileSync22(userPath, "utf-8") : "";
         setReflectionStatus2(getDb(), chatId, "active", soul, user);
         const { logActivity: logActivity2 } = await Promise.resolve().then(() => (init_store3(), store_exports3));
         logActivity2(getDb(), { chatId, source: "telegram", eventType: "reflection_unfrozen", summary: "Reflection enabled" });
@@ -16063,6 +16391,29 @@ ${cmds.map((c) => `  ${c.cmd} \u2014 ${c.desc}`).join("\n")}`
       }
       break;
     }
+    case "mode":
+    case "execmode": {
+      const currentExecMode = getExecMode(chatId);
+      const EXEC_MODES = {
+        approved: "\u2705 Approved \u2014 AI shows a plan before acting",
+        yolo: "\u26A1 YOLO \u2014 AI executes immediately"
+      };
+      if (typeof channel.sendKeyboard === "function") {
+        const buttons = Object.entries(EXEC_MODES).map(([id, label2]) => [{
+          label: `${id === currentExecMode ? "\u2713 " : ""}${label2}`,
+          data: `execmode:${id}`,
+          ...id === currentExecMode ? { style: "primary" } : {}
+        }]);
+        await channel.sendKeyboard(chatId, `Execution mode (current: <b>${currentExecMode}</b>):`, buttons);
+      } else {
+        const lines = ["Execution modes:", ""];
+        for (const [id, label2] of Object.entries(EXEC_MODES)) {
+          lines.push(`${id === currentExecMode ? "\u2713 " : "  "}/mode ${id} \u2014 ${label2}`);
+        }
+        await channel.sendText(chatId, lines.join("\n"), { parseMode: "plain" });
+      }
+      break;
+    }
     case "verbose": {
       const currentVerbose = getVerboseLevel(chatId);
       const buttons = Object.entries(VERBOSE_LEVELS).map(([id, label2]) => [{
@@ -17771,6 +18122,54 @@ ${PERM_MODES[chosen]}`,
       await channel.sendText(chatId, `Agent mode set to <b>${mode}</b>. Session cleared.`, { parseMode: "html" });
     }
     return;
+  } else if (data === "exec:approve") {
+    const plan = getPendingPlan(chatId);
+    if (!plan) {
+      await channel.sendText(chatId, "\u26A0\uFE0F Plan expired or already processed.", { parseMode: "plain" });
+      return;
+    }
+    removePendingPlan(chatId);
+    await channel.sendText(chatId, "\u2705 Approved. Executing...", { parseMode: "plain" });
+    const { handleMessage: handleMessage2 } = await Promise.resolve().then(() => (init_router(), router_exports));
+    await handleMessage2(
+      { text: `>>${plan.originalMessage}`, chatId, source: "telegram", type: "text", senderName: "", messageId: "" },
+      channel
+    );
+    return;
+  } else if (data === "exec:reject") {
+    const plan = getPendingPlan(chatId);
+    if (!plan) {
+      await channel.sendText(chatId, "\u26A0\uFE0F Plan expired or already processed.", { parseMode: "plain" });
+      return;
+    }
+    removePendingPlan(chatId);
+    setRejectionMode(chatId);
+    await channel.sendText(chatId, "\u270F\uFE0F Plan rejected. Send your feedback and I'll revise the plan.", { parseMode: "plain" });
+    return;
+  } else if (data === "exec:yolo") {
+    const plan = getPendingPlan(chatId);
+    if (!plan) {
+      await channel.sendText(chatId, "\u26A0\uFE0F Plan expired or already processed.", { parseMode: "plain" });
+      return;
+    }
+    removePendingPlan(chatId);
+    setExecMode(chatId, "yolo");
+    await channel.sendText(chatId, "\u26A1 Switched to YOLO mode. Executing without approval gate...", { parseMode: "plain" });
+    const { handleMessage: handleMessage2 } = await Promise.resolve().then(() => (init_router(), router_exports));
+    await handleMessage2(
+      { text: `>>${plan.originalMessage}`, chatId, source: "telegram", type: "text", senderName: "", messageId: "" },
+      channel
+    );
+    return;
+  } else if (data.startsWith("execmode:")) {
+    const mode = data.split(":")[1];
+    if (mode === "approved" || mode === "yolo") {
+      setExecMode(chatId, mode);
+      const desc = mode === "approved" ? "AI will show a plan for approval before acting." : "AI will execute immediately without showing a plan.";
+      await channel.sendText(chatId, `Execution mode set to <b>${mode}</b>.
+${desc}`, { parseMode: "html" });
+    }
+    return;
   } else if (data.startsWith("model_sig:")) {
     const value = data.slice(10);
     setModelSignature(chatId, value);
@@ -18530,6 +18929,7 @@ var init_callbacks = __esm({
     init_guard();
     init_pagination();
     init_stt();
+    init_gate();
     init_helpers();
     init_response();
     init_shell();
@@ -18689,6 +19089,33 @@ async function handleText(msg, channel) {
   if (hasSqPrefix) {
     text = sqCleanText;
   }
+  if (getRejectionMode(chatId)) {
+    clearRejectionMode(chatId);
+    await channel.sendTyping?.(chatId);
+    const response = await askAgent(chatId, `Plan rejected. Feedback: "${text}". Revise your plan.`, {
+      cwd: getCwd(chatId),
+      model: model2,
+      permMode: "yolo",
+      agentMode: effectiveAgentMode
+    });
+    if (response.text) {
+      storePendingPlan(chatId, response.text, text);
+      if (typeof channel.sendKeyboard === "function") {
+        await channel.sendKeyboard(chatId, `\u{1F50D} ${response.text}`, [
+          [
+            { label: "\u2705 Approve", data: "exec:approve", style: "success" },
+            { label: "\u274C Reject", data: "exec:reject", style: "danger" }
+          ],
+          [
+            { label: "\u26A1 Skip & YOLO", data: "exec:yolo" }
+          ]
+        ]);
+      } else {
+        await sendResponse(chatId, channel, response.text, void 0);
+      }
+    }
+    return;
+  }
   {
     const { getDiscussionMode: getDiscussionMode2, clearDiscussionMode: clearDiscussionMode2, setDiscussionMode: reenterDiscussion, getInsightById: getInsightById2, updateInsightProposal: updateInsightProposal2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
     const discussInsightId = getDiscussionMode2(chatId);
@@ -18765,6 +19192,64 @@ You're still in discussion mode \u2014 try again or click a button to exit.`, {
       return;
     }
   }
+  const execMode = getExecMode(chatId);
+  const sessionId = getSessionId(chatId);
+  const isResuming = !!sessionId;
+  if (shouldRequireApproval({
+    execMode,
+    intent,
+    bootstrapTier: bootstrapTier ?? "full",
+    messageText: text,
+    isResuming,
+    isSideQuest: hasSqPrefix
+  })) {
+    const planDirective = buildPlanningDirective();
+    let typingActive2 = true;
+    const typingLoop2 = async () => {
+      while (typingActive2) {
+        try {
+          await channel.sendTyping?.(chatId);
+        } catch {
+        }
+        await new Promise((r) => setTimeout(r, 4e3));
+      }
+    };
+    typingLoop2().catch(() => {
+    });
+    try {
+      const planResponse = await askAgent(chatId, cleanText || text, {
+        cwd: getCwd(chatId),
+        model: model2,
+        permMode: "yolo",
+        bootstrapTier: bootstrapTier ?? "full",
+        agentMode: effectiveAgentMode,
+        planningDirective: planDirective
+      });
+      typingActive2 = false;
+      if (planResponse.text) {
+        storePendingPlan(chatId, planResponse.text, cleanText || text);
+        if (typeof channel.sendKeyboard === "function") {
+          await channel.sendKeyboard(chatId, `\u{1F50D} ${planResponse.text}`, [
+            [
+              { label: "\u2705 Approve", data: "exec:approve", style: "success" },
+              { label: "\u274C Reject", data: "exec:reject", style: "danger" }
+            ],
+            [
+              { label: "\u26A1 Skip & YOLO", data: "exec:yolo" }
+            ]
+          ]);
+        } else {
+          await sendResponse(chatId, channel, planResponse.text, void 0);
+        }
+      } else {
+        await channel.sendText(chatId, "(No plan generated \u2014 proceeding normally)", { parseMode: "plain" });
+      }
+    } catch (err) {
+      typingActive2 = false;
+      await channel.sendText(chatId, `\u26A0\uFE0F Planning error: ${err.message}`, { parseMode: "plain" });
+    }
+    return;
+  }
   let typingActive = true;
   const typingLoop = async () => {
     while (typingActive) {
@@ -18945,6 +19430,7 @@ var init_router = __esm({
     init_wizard();
     init_classify2();
     init_store3();
+    init_gate();
     init_helpers();
     init_response();
     init_shell();
@@ -19205,6 +19691,8 @@ async function runWithRetry(job, model2, runId, t0) {
   if (job.jobType === "reflection") {
     const { runNightlyReflection: runNightlyReflection2 } = await Promise.resolve().then(() => (init_analyze(), analyze_exports));
     const { formatNightlySummary: formatNightlySummary2 } = await Promise.resolve().then(() => (init_propose(), propose_exports));
+    const { getPendingInsightCount: getPendingInsightCount2, getActiveReflectionChatIds: getActiveReflectionChatIds2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
+    const { getDb: getDb2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
     const timeoutMs2 = job.timeout ? job.timeout * 1e3 : void 0;
     const { results } = await runNightlyReflection2({
       timeoutMs: timeoutMs2,
@@ -19217,7 +19705,13 @@ async function runWithRetry(job, model2, runId, t0) {
     const allInsights = results.flatMap(
       (r) => r.insights.map((ins) => ({ id: ++seq, ...ins }))
     );
-    return { text: formatNightlySummary2(allInsights) };
+    const db3 = getDb2();
+    const activeChats2 = getActiveReflectionChatIds2(db3);
+    let totalPending = 0;
+    for (const cid of activeChats2) {
+      totalPending += getPendingInsightCount2(db3, cid);
+    }
+    return { text: formatNightlySummary2(allInsights, totalPending) };
   }
   if (job.thinking && job.thinking !== "auto") {
     setThinkingLevel(chatId, job.thinking);
@@ -19323,7 +19817,7 @@ var init_cron = __esm({
 });
 
 // src/agents/runners/wrap-backend.ts
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function buildMcpCommands(backendId) {
   const exe = backendId === "cursor" ? "agent" : backendId;
   return {
@@ -19417,7 +19911,7 @@ function wrapBackendAdapter(adapter) {
       const configPath = writeMcpConfigFile(server);
       return ["--mcp-config", configPath];
     },
-    getSkillPath: () => join19(SKILLS_PATH, `agent-${adapter.id}.md`)
+    getSkillPath: () => join20(SKILLS_PATH, `agent-${adapter.id}.md`)
   };
 }
 var BACKEND_CAPABILITIES;
@@ -19468,18 +19962,18 @@ var init_wrap_backend = __esm({
 });
 
 // src/agents/runners/config-loader.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync18, mkdirSync as mkdirSync8, watchFile, unwatchFile } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync10, readdirSync as readdirSync9, existsSync as existsSync19, mkdirSync as mkdirSync9, watchFile, unwatchFile } from "fs";
+import { join as join21 } from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 function resolveExecutable(config2) {
-  if (existsSync18(config2.executable)) return config2.executable;
+  if (existsSync19(config2.executable)) return config2.executable;
   try {
     return execFileSync2("which", [config2.executable], { encoding: "utf-8" }).trim();
   } catch {
   }
   for (const fallback of config2.executableFallbacks ?? []) {
     const resolved = fallback.replace(/^~/, process.env.HOME ?? "");
-    if (existsSync18(resolved)) return resolved;
+    if (existsSync19(resolved)) return resolved;
   }
   return config2.executable;
 }
@@ -19605,7 +20099,7 @@ function configToRunner(config2) {
     prepareMcpInjection() {
       return [];
     },
-    getSkillPath: () => join20(SKILLS_PATH, `agent-${config2.id}.md`)
+    getSkillPath: () => join21(SKILLS_PATH, `agent-${config2.id}.md`)
   };
 }
 function loadRunnerConfig(filePath) {
@@ -19618,14 +20112,14 @@ function loadRunnerConfig(filePath) {
   }
 }
 function loadAllRunnerConfigs() {
-  if (!existsSync18(RUNNERS_PATH)) {
-    mkdirSync8(RUNNERS_PATH, { recursive: true });
+  if (!existsSync19(RUNNERS_PATH)) {
+    mkdirSync9(RUNNERS_PATH, { recursive: true });
     return [];
   }
-  const files = readdirSync8(RUNNERS_PATH).filter((f) => f.endsWith(".json"));
+  const files = readdirSync9(RUNNERS_PATH).filter((f) => f.endsWith(".json"));
   const configs = [];
   for (const file of files) {
-    const config2 = loadRunnerConfig(join20(RUNNERS_PATH, file));
+    const config2 = loadRunnerConfig(join21(RUNNERS_PATH, file));
     if (config2) configs.push(config2);
   }
   return configs;
@@ -19646,16 +20140,16 @@ function registerConfigRunners() {
   return count;
 }
 function watchRunnerConfigs(onChange) {
-  if (!existsSync18(RUNNERS_PATH)) return;
+  if (!existsSync19(RUNNERS_PATH)) return;
   for (const prev of watchedFiles) {
-    if (!existsSync18(prev)) {
+    if (!existsSync19(prev)) {
       unwatchFile(prev);
       watchedFiles.delete(prev);
     }
   }
-  const files = readdirSync8(RUNNERS_PATH).filter((f) => f.endsWith(".json"));
+  const files = readdirSync9(RUNNERS_PATH).filter((f) => f.endsWith(".json"));
   for (const file of files) {
-    const fullPath = join20(RUNNERS_PATH, file);
+    const fullPath = join21(RUNNERS_PATH, file);
     if (watchedFiles.has(fullPath)) continue;
     watchedFiles.add(fullPath);
     watchFile(fullPath, { interval: 5e3 }, () => {
@@ -20053,6 +20547,7 @@ var init_telegram2 = __esm({
           { command: "summarizer", description: "Configure session summarization model" },
           // Permissions & tools
           { command: "permissions", description: "Permission mode (yolo/safe/readonly/plan)" },
+          { command: "mode", description: "Execution gate (approved/yolo)" },
           { command: "tools", description: "Configure which tools the agent can use" },
           { command: "verbose", description: "Tool visibility (off/normal/verbose)" },
           { command: "cwd", description: "Set or show working directory" },
@@ -20489,19 +20984,19 @@ var init_telegram2 = __esm({
 });
 
 // src/skills/bootstrap.ts
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { readdir as readdir6, readFile as readFile8, writeFile as writeFile5, copyFile } from "fs/promises";
-import { join as join21, dirname as dirname3 } from "path";
+import { join as join22, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 async function copyAgentManifestSkills() {
-  if (!existsSync19(PKG_SKILLS)) return;
+  if (!existsSync20(PKG_SKILLS)) return;
   try {
     const entries = await readdir6(PKG_SKILLS, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.startsWith("agent-") || !entry.name.endsWith(".md")) continue;
-      const src = join21(PKG_SKILLS, entry.name);
-      const dest = join21(SKILLS_PATH, entry.name);
-      if (existsSync19(dest)) continue;
+      const src = join22(PKG_SKILLS, entry.name);
+      const dest = join22(SKILLS_PATH, entry.name);
+      if (existsSync20(dest)) continue;
       await copyFile(src, dest);
       log(`[skills] Bootstrapped ${entry.name} to ${SKILLS_PATH}`);
     }
@@ -20511,8 +21006,8 @@ async function copyAgentManifestSkills() {
 }
 async function bootstrapSkills() {
   await copyAgentManifestSkills();
-  const usmDir = join21(SKILLS_PATH, USM_DIR_NAME);
-  if (existsSync19(usmDir)) return;
+  const usmDir = join22(SKILLS_PATH, USM_DIR_NAME);
+  if (existsSync20(usmDir)) return;
   try {
     const entries = await readdir6(SKILLS_PATH);
     const dirs = entries.filter((e) => !e.startsWith("."));
@@ -20534,8 +21029,8 @@ async function bootstrapSkills() {
   }
 }
 async function patchUsmForCcClaw(usmDir) {
-  const skillPath = join21(usmDir, "SKILL.md");
-  if (!existsSync19(skillPath)) return;
+  const skillPath = join22(usmDir, "SKILL.md");
+  if (!existsSync20(skillPath)) return;
   try {
     let content = await readFile8(skillPath, "utf-8");
     let patched = false;
@@ -20580,8 +21075,8 @@ var init_bootstrap = __esm({
     USM_REPO = "jacob-bd/universal-skills-manager";
     USM_DIR_NAME = "universal-skills-manager";
     CC_CLAW_ECOSYSTEM_PATCH = `| **CC-Claw** | \`~/.cc-claw/workspace/skills/\` | N/A (daemon, no project scope) |`;
-    PKG_ROOT = join21(dirname3(fileURLToPath2(import.meta.url)), "..", "..");
-    PKG_SKILLS = join21(PKG_ROOT, "skills");
+    PKG_ROOT = join22(dirname4(fileURLToPath2(import.meta.url)), "..", "..");
+    PKG_SKILLS = join22(PKG_ROOT, "skills");
   }
 });
 
@@ -20803,13 +21298,13 @@ __export(ai_skill_exports, {
   generateAiSkill: () => generateAiSkill,
   installAiSkill: () => installAiSkill
 });
-import { existsSync as existsSync20, writeFileSync as writeFileSync7, mkdirSync as mkdirSync9 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, writeFileSync as writeFileSync7, mkdirSync as mkdirSync10 } from "fs";
+import { join as join23 } from "path";
 import { homedir as homedir7 } from "os";
 function generateAiSkill() {
   const version = VERSION;
   let systemState = "";
-  if (existsSync20(DB_PATH)) {
+  if (existsSync21(DB_PATH)) {
     try {
       const { openDatabaseReadOnly: openDatabaseReadOnly2 } = (init_store5(), __toCommonJS(store_exports5));
       const readDb = openDatabaseReadOnly2();
@@ -21213,10 +21708,10 @@ function installAiSkill() {
   const failed = [];
   for (const [backend2, dirs] of Object.entries(BACKEND_SKILL_DIRS2)) {
     for (const dir of dirs) {
-      const skillDir = join22(dir, "cc-claw-cli");
-      const skillPath = join22(skillDir, "SKILL.md");
+      const skillDir = join23(dir, "cc-claw-cli");
+      const skillPath = join23(skillDir, "SKILL.md");
       try {
-        mkdirSync9(skillDir, { recursive: true });
+        mkdirSync10(skillDir, { recursive: true });
         writeFileSync7(skillPath, skill, "utf-8");
         installed.push(skillPath);
       } catch {
@@ -21233,11 +21728,11 @@ var init_ai_skill = __esm({
     init_paths();
     init_version();
     BACKEND_SKILL_DIRS2 = {
-      "cc-claw": [join22(homedir7(), ".cc-claw", "workspace", "skills")],
-      claude: [join22(homedir7(), ".claude", "skills")],
-      gemini: [join22(homedir7(), ".gemini", "skills")],
-      codex: [join22(homedir7(), ".agents", "skills")],
-      cursor: [join22(homedir7(), ".cursor", "skills"), join22(homedir7(), ".cursor", "skills-cursor")]
+      "cc-claw": [join23(homedir7(), ".cc-claw", "workspace", "skills")],
+      claude: [join23(homedir7(), ".claude", "skills")],
+      gemini: [join23(homedir7(), ".gemini", "skills")],
+      codex: [join23(homedir7(), ".agents", "skills")],
+      cursor: [join23(homedir7(), ".cursor", "skills"), join23(homedir7(), ".cursor", "skills-cursor")]
     };
   }
 });
@@ -21247,23 +21742,23 @@ var index_exports = {};
 __export(index_exports, {
   main: () => main
 });
-import { mkdirSync as mkdirSync10, existsSync as existsSync21, renameSync, statSync as statSync5, readFileSync as readFileSync12 } from "fs";
-import { join as join23 } from "path";
+import { mkdirSync as mkdirSync11, existsSync as existsSync22, renameSync as renameSync2, statSync as statSync6, readFileSync as readFileSync12 } from "fs";
+import { join as join24 } from "path";
 import dotenv from "dotenv";
 function migrateLayout() {
   const moves = [
-    [join23(CC_CLAW_HOME, "cc-claw.db"), join23(DATA_PATH, "cc-claw.db")],
-    [join23(CC_CLAW_HOME, "cc-claw.db-shm"), join23(DATA_PATH, "cc-claw.db-shm")],
-    [join23(CC_CLAW_HOME, "cc-claw.db-wal"), join23(DATA_PATH, "cc-claw.db-wal")],
-    [join23(CC_CLAW_HOME, "cc-claw.log"), join23(LOGS_PATH, "cc-claw.log")],
-    [join23(CC_CLAW_HOME, "cc-claw.log.1"), join23(LOGS_PATH, "cc-claw.log.1")],
-    [join23(CC_CLAW_HOME, "cc-claw.error.log"), join23(LOGS_PATH, "cc-claw.error.log")],
-    [join23(CC_CLAW_HOME, "cc-claw.error.log.1"), join23(LOGS_PATH, "cc-claw.error.log.1")]
+    [join24(CC_CLAW_HOME, "cc-claw.db"), join24(DATA_PATH, "cc-claw.db")],
+    [join24(CC_CLAW_HOME, "cc-claw.db-shm"), join24(DATA_PATH, "cc-claw.db-shm")],
+    [join24(CC_CLAW_HOME, "cc-claw.db-wal"), join24(DATA_PATH, "cc-claw.db-wal")],
+    [join24(CC_CLAW_HOME, "cc-claw.log"), join24(LOGS_PATH, "cc-claw.log")],
+    [join24(CC_CLAW_HOME, "cc-claw.log.1"), join24(LOGS_PATH, "cc-claw.log.1")],
+    [join24(CC_CLAW_HOME, "cc-claw.error.log"), join24(LOGS_PATH, "cc-claw.error.log")],
+    [join24(CC_CLAW_HOME, "cc-claw.error.log.1"), join24(LOGS_PATH, "cc-claw.error.log.1")]
   ];
   for (const [from, to] of moves) {
-    if (existsSync21(from) && !existsSync21(to)) {
+    if (existsSync22(from) && !existsSync22(to)) {
       try {
-        renameSync(from, to);
+        renameSync2(from, to);
       } catch {
       }
     }
@@ -21272,11 +21767,11 @@ function migrateLayout() {
 function rotateLogs() {
   for (const file of [LOG_PATH, ERROR_LOG_PATH]) {
     try {
-      const { size } = statSync5(file);
+      const { size } = statSync6(file);
       if (size > LOG_MAX_BYTES) {
         const archivePath = `${file}.1`;
         try {
-          renameSync(file, archivePath);
+          renameSync2(file, archivePath);
         } catch {
         }
         log(`[cc-claw] Rotated ${file} (was ${(size / 1024 / 1024).toFixed(1)}MB)`);
@@ -21324,6 +21819,12 @@ async function main() {
   }
   setBootTime();
   log("[cc-claw] Database initialized (sessions preserved for resume)");
+  try {
+    const { migrateAllSlots: migrateAllSlots2 } = await Promise.resolve().then(() => (init_symlink_manager(), symlink_manager_exports));
+    migrateAllSlots2(CC_CLAW_HOME);
+  } catch (err) {
+    warn(`[cc-claw] Slot symlink migration failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   if (process.env.TELEGRAM_BOT_TOKEN) {
     channelRegistry.register(new TelegramChannel());
   }
@@ -21400,11 +21901,11 @@ async function main() {
   bootstrapSkills().catch((err) => error("[cc-claw] Skill bootstrap failed:", err));
   try {
     const { generateAiSkill: generateAiSkill2 } = await Promise.resolve().then(() => (init_ai_skill(), ai_skill_exports));
-    const { writeFileSync: writeFileSync12, mkdirSync: mkdirSync17 } = await import("fs");
-    const { join: join29 } = await import("path");
-    const skillDir = join29(SKILLS_PATH, "cc-claw-cli");
-    mkdirSync17(skillDir, { recursive: true });
-    writeFileSync12(join29(skillDir, "SKILL.md"), generateAiSkill2(), "utf-8");
+    const { writeFileSync: writeFileSync12, mkdirSync: mkdirSync18 } = await import("fs");
+    const { join: join30 } = await import("path");
+    const skillDir = join30(SKILLS_PATH, "cc-claw-cli");
+    mkdirSync18(skillDir, { recursive: true });
+    writeFileSync12(join30(skillDir, "SKILL.md"), generateAiSkill2(), "utf-8");
     log("[cc-claw] AI skill updated");
   } catch {
   }
@@ -21477,10 +21978,10 @@ var init_index = __esm({
     init_health3();
     init_image_gen();
     for (const dir of [CC_CLAW_HOME, DATA_PATH, LOGS_PATH, SKILLS_PATH, RUNNERS_PATH, AGENTS_PATH]) {
-      if (!existsSync21(dir)) mkdirSync10(dir, { recursive: true });
+      if (!existsSync22(dir)) mkdirSync11(dir, { recursive: true });
     }
     migrateLayout();
-    if (existsSync21(ENV_PATH)) {
+    if (existsSync22(ENV_PATH)) {
       dotenv.config({ path: ENV_PATH });
     } else {
       console.error(`[cc-claw] Config not found at ${ENV_PATH} \u2014 run 'cc-claw setup' first`);
@@ -21501,12 +22002,12 @@ __export(api_client_exports, {
   apiPost: () => apiPost,
   isDaemonRunning: () => isDaemonRunning
 });
-import { readFileSync as readFileSync13, existsSync as existsSync22 } from "fs";
+import { readFileSync as readFileSync13, existsSync as existsSync23 } from "fs";
 import { request as httpRequest, Agent } from "http";
 function getToken() {
   if (process.env.CC_CLAW_API_TOKEN) return process.env.CC_CLAW_API_TOKEN;
   try {
-    if (existsSync22(TOKEN_PATH)) return readFileSync13(TOKEN_PATH, "utf-8").trim();
+    if (existsSync23(TOKEN_PATH)) return readFileSync13(TOKEN_PATH, "utf-8").trim();
   } catch {
   }
   return null;
@@ -21605,10 +22106,10 @@ __export(service_exports, {
   serviceStatus: () => serviceStatus,
   uninstallService: () => uninstallService
 });
-import { existsSync as existsSync23, mkdirSync as mkdirSync11, writeFileSync as writeFileSync8, unlinkSync as unlinkSync6 } from "fs";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, writeFileSync as writeFileSync8, unlinkSync as unlinkSync6 } from "fs";
 import { execFileSync as execFileSync3, execSync as execSync6 } from "child_process";
 import { homedir as homedir8, platform } from "os";
-import { join as join24, dirname as dirname4 } from "path";
+import { join as join25, dirname as dirname5 } from "path";
 function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
@@ -21617,23 +22118,23 @@ function resolveExecutable2(name) {
     return execFileSync3("which", [name], { encoding: "utf-8" }).trim();
   } catch {
     const fallback = process.argv[1];
-    if (fallback && existsSync23(fallback)) return fallback;
+    if (fallback && existsSync24(fallback)) return fallback;
     throw new Error(`Cannot find '${name}' executable. Install globally: npm install -g cc-claw`);
   }
 }
 function getPathDirs() {
-  const nodeBin = dirname4(process.execPath);
+  const nodeBin = dirname5(process.execPath);
   const home = homedir8();
   const dirs = /* @__PURE__ */ new Set([
     nodeBin,
-    join24(home, ".local", "bin"),
+    join25(home, ".local", "bin"),
     "/usr/local/bin",
     "/usr/bin",
     "/bin"
   ]);
   try {
     const prefix = execSync6("npm config get prefix", { encoding: "utf-8" }).trim();
-    if (prefix) dirs.add(join24(prefix, "bin"));
+    if (prefix) dirs.add(join25(prefix, "bin"));
   } catch {
   }
   return [...dirs].join(":");
@@ -21691,10 +22192,10 @@ function generatePlist() {
 </plist>`;
 }
 function installMacOS() {
-  const agentsDir = dirname4(PLIST_PATH);
-  if (!existsSync23(agentsDir)) mkdirSync11(agentsDir, { recursive: true });
-  if (!existsSync23(LOGS_PATH)) mkdirSync11(LOGS_PATH, { recursive: true });
-  if (existsSync23(PLIST_PATH)) {
+  const agentsDir = dirname5(PLIST_PATH);
+  if (!existsSync24(agentsDir)) mkdirSync12(agentsDir, { recursive: true });
+  if (!existsSync24(LOGS_PATH)) mkdirSync12(LOGS_PATH, { recursive: true });
+  if (existsSync24(PLIST_PATH)) {
     try {
       execFileSync3("launchctl", ["unload", PLIST_PATH]);
     } catch {
@@ -21706,7 +22207,7 @@ function installMacOS() {
   console.log("  Service loaded and starting.");
 }
 function uninstallMacOS() {
-  if (!existsSync23(PLIST_PATH)) {
+  if (!existsSync24(PLIST_PATH)) {
     console.log("  No service found to uninstall.");
     return;
   }
@@ -21781,8 +22282,8 @@ WantedBy=default.target
 `;
 }
 function installLinux() {
-  if (!existsSync23(SYSTEMD_DIR)) mkdirSync11(SYSTEMD_DIR, { recursive: true });
-  if (!existsSync23(LOGS_PATH)) mkdirSync11(LOGS_PATH, { recursive: true });
+  if (!existsSync24(SYSTEMD_DIR)) mkdirSync12(SYSTEMD_DIR, { recursive: true });
+  if (!existsSync24(LOGS_PATH)) mkdirSync12(LOGS_PATH, { recursive: true });
   writeFileSync8(UNIT_PATH, generateUnit());
   console.log(`  Installed: ${UNIT_PATH}`);
   execFileSync3("systemctl", ["--user", "daemon-reload"]);
@@ -21791,7 +22292,7 @@ function installLinux() {
   console.log("  Service enabled and started.");
 }
 function uninstallLinux() {
-  if (!existsSync23(UNIT_PATH)) {
+  if (!existsSync24(UNIT_PATH)) {
     console.log("  No service found to uninstall.");
     return;
   }
@@ -21816,7 +22317,7 @@ function statusLinux() {
   }
 }
 function installService() {
-  if (!existsSync23(join24(CC_CLAW_HOME, ".env"))) {
+  if (!existsSync24(join25(CC_CLAW_HOME, ".env"))) {
     console.error(`  Config not found at ${CC_CLAW_HOME}/.env`);
     console.error("  Run 'cc-claw setup' before installing the service.");
     process.exitCode = 1;
@@ -21845,9 +22346,9 @@ var init_service = __esm({
     "use strict";
     init_paths();
     PLIST_LABEL = "com.cc-claw";
-    PLIST_PATH = join24(homedir8(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
-    SYSTEMD_DIR = join24(homedir8(), ".config", "systemd", "user");
-    UNIT_PATH = join24(SYSTEMD_DIR, "cc-claw.service");
+    PLIST_PATH = join25(homedir8(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+    SYSTEMD_DIR = join25(homedir8(), ".config", "systemd", "user");
+    UNIT_PATH = join25(SYSTEMD_DIR, "cc-claw.service");
   }
 });
 
@@ -22044,7 +22545,7 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync24, statSync as statSync6 } from "fs";
+import { existsSync as existsSync25, statSync as statSync7 } from "fs";
 async function statusCommand(globalOpts, localOpts) {
   try {
     const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
@@ -22084,7 +22585,7 @@ async function statusCommand(globalOpts, localOpts) {
     const cwdRow = readDb.prepare("SELECT cwd FROM chat_cwd WHERE chat_id = ?").get(chatId);
     const voiceRow = readDb.prepare("SELECT enabled FROM chat_voice WHERE chat_id = ?").get(chatId);
     const usageRow = readDb.prepare("SELECT * FROM chat_usage WHERE chat_id = ?").get(chatId);
-    const dbStat = existsSync24(DB_PATH) ? statSync6(DB_PATH) : null;
+    const dbStat = existsSync25(DB_PATH) ? statSync7(DB_PATH) : null;
     let daemonRunning = false;
     let daemonInfo = {};
     try {
@@ -22173,12 +22674,12 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctorCommand: () => doctorCommand
 });
-import { existsSync as existsSync25, statSync as statSync7, accessSync, constants } from "fs";
+import { existsSync as existsSync26, statSync as statSync8, accessSync, constants } from "fs";
 import { execFileSync as execFileSync4 } from "child_process";
 async function doctorCommand(globalOpts, localOpts) {
   const checks = [];
-  if (existsSync25(DB_PATH)) {
-    const size = statSync7(DB_PATH).size;
+  if (existsSync26(DB_PATH)) {
+    const size = statSync8(DB_PATH).size;
     checks.push({ name: "Database", status: "ok", message: `${DB_PATH} (${(size / 1024).toFixed(0)}KB)` });
     try {
       const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
@@ -22207,7 +22708,7 @@ async function doctorCommand(globalOpts, localOpts) {
   } else {
     checks.push({ name: "Database", status: "error", message: `Not found at ${DB_PATH}`, fix: "cc-claw setup" });
   }
-  if (existsSync25(ENV_PATH)) {
+  if (existsSync26(ENV_PATH)) {
     checks.push({ name: "Environment", status: "ok", message: `.env loaded` });
   } else {
     checks.push({ name: "Environment", status: "error", message: "No .env found", fix: "cc-claw setup" });
@@ -22262,7 +22763,7 @@ async function doctorCommand(globalOpts, localOpts) {
   } catch {
   }
   const tokenPath = `${DATA_PATH}/api-token`;
-  if (existsSync25(tokenPath)) {
+  if (existsSync26(tokenPath)) {
     try {
       accessSync(tokenPath, constants.R_OK);
       checks.push({ name: "API token", status: "ok", message: "token file readable" });
@@ -22287,7 +22788,7 @@ async function doctorCommand(globalOpts, localOpts) {
     }
   } catch {
   }
-  if (existsSync25(ERROR_LOG_PATH)) {
+  if (existsSync26(ERROR_LOG_PATH)) {
     try {
       const { readFileSync: readFileSync22 } = await import("fs");
       const logContent = readFileSync22(ERROR_LOG_PATH, "utf-8");
@@ -22413,10 +22914,10 @@ var logs_exports = {};
 __export(logs_exports, {
   logsCommand: () => logsCommand
 });
-import { existsSync as existsSync26, readFileSync as readFileSync16, watchFile as watchFile2, unwatchFile as unwatchFile2 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync16, watchFile as watchFile2, unwatchFile as unwatchFile2 } from "fs";
 async function logsCommand(opts) {
   const logFile = opts.error ? ERROR_LOG_PATH : LOG_PATH;
-  if (!existsSync26(logFile)) {
+  if (!existsSync27(logFile)) {
     outputError("LOG_NOT_FOUND", `Log file not found: ${logFile}`);
     process.exit(1);
   }
@@ -22468,11 +22969,11 @@ __export(gemini_exports, {
   geminiReorder: () => geminiReorder,
   geminiRotation: () => geminiRotation
 });
-import { existsSync as existsSync27, mkdirSync as mkdirSync12, writeFileSync as writeFileSync9, readFileSync as readFileSync17, chmodSync } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync13, writeFileSync as writeFileSync9, readFileSync as readFileSync17, chmodSync } from "fs";
+import { join as join26 } from "path";
 import { createInterface as createInterface5 } from "readline";
 function requireDb() {
-  if (!existsSync27(DB_PATH)) {
+  if (!existsSync28(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -22497,8 +22998,8 @@ async function resolveSlotId(idOrLabel) {
 function resolveOAuthEmail(configHome) {
   if (!configHome) return null;
   try {
-    const accountsPath = join25(configHome, ".gemini", "google_accounts.json");
-    if (!existsSync27(accountsPath)) return null;
+    const accountsPath = join26(configHome, ".gemini", "google_accounts.json");
+    if (!existsSync28(accountsPath)) return null;
     const accounts = JSON.parse(readFileSync17(accountsPath, "utf-8"));
     return accounts.active || null;
   } catch {
@@ -22581,14 +23082,14 @@ async function geminiAddKey(globalOpts, opts) {
 }
 async function geminiAddAccount(globalOpts, opts) {
   await requireWriteDb();
-  const slotsDir = join25(CC_CLAW_HOME, "gemini-slots");
-  if (!existsSync27(slotsDir)) mkdirSync12(slotsDir, { recursive: true });
+  const slotsDir = join26(CC_CLAW_HOME, "gemini-slots");
+  if (!existsSync28(slotsDir)) mkdirSync13(slotsDir, { recursive: true });
   const { addGeminiSlot: addGeminiSlot2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const tempId = Date.now();
-  const slotDir = join25(slotsDir, `slot-${tempId}`);
-  mkdirSync12(slotDir, { recursive: true, mode: 448 });
-  mkdirSync12(join25(slotDir, ".gemini"), { recursive: true });
-  writeFileSync9(join25(slotDir, ".gemini", "settings.json"), JSON.stringify({
+  const slotDir = join26(slotsDir, `slot-${tempId}`);
+  mkdirSync13(slotDir, { recursive: true, mode: 448 });
+  mkdirSync13(join26(slotDir, ".gemini"), { recursive: true });
+  writeFileSync9(join26(slotDir, ".gemini", "settings.json"), JSON.stringify({
     security: { auth: { selectedType: "oauth-personal" } }
   }, null, 2));
   console.log("");
@@ -22605,8 +23106,8 @@ async function geminiAddAccount(globalOpts, opts) {
     });
   } catch {
   }
-  const oauthPath = join25(slotDir, ".gemini", "oauth_creds.json");
-  if (!existsSync27(oauthPath)) {
+  const oauthPath = join26(slotDir, ".gemini", "oauth_creds.json");
+  if (!existsSync28(oauthPath)) {
     console.log(error2("\n  No OAuth credentials found. Sign-in may have failed."));
     console.log("  The slot directory is preserved at: " + slotDir);
     console.log("  Re-run: cc-claw gemini add-account\n");
@@ -22614,7 +23115,7 @@ async function geminiAddAccount(globalOpts, opts) {
   }
   let accountEmail = "unknown";
   try {
-    const accounts = JSON.parse(__require("fs").readFileSync(join25(slotDir, ".gemini", "google_accounts.json"), "utf-8"));
+    const accounts = JSON.parse(__require("fs").readFileSync(join26(slotDir, ".gemini", "google_accounts.json"), "utf-8"));
     accountEmail = accounts.active || accountEmail;
   } catch {
   }
@@ -22625,6 +23126,13 @@ async function geminiAddAccount(globalOpts, opts) {
     configHome: slotDir,
     priority: opts.priority ? parseInt(opts.priority, 10) : 0
   });
+  try {
+    const { setupSlotSymlinks: setupSlotSymlinks2, getPrimaryDir: getPrimaryDir2 } = await Promise.resolve().then(() => (init_symlink_manager(), symlink_manager_exports));
+    const primaryDir = getPrimaryDir2("gemini");
+    if (primaryDir) setupSlotSymlinks2("gemini", slotDir, primaryDir);
+  } catch (err) {
+    console.log(warning(`  Warning: could not set up state symlinks \u2014 ${err instanceof Error ? err.message : String(err)}`));
+  }
   output(
     { id, type: "oauth", label: opts.label || accountEmail, configHome: slotDir },
     () => success(`
@@ -22726,11 +23234,11 @@ __export(backend_cmd_factory_exports, {
   makeReorder: () => makeReorder,
   registerBackendSlotCommands: () => registerBackendSlotCommands
 });
-import { existsSync as existsSync28, mkdirSync as mkdirSync13, readFileSync as readFileSync18 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync14, readFileSync as readFileSync18 } from "fs";
+import { join as join27 } from "path";
 import { createInterface as createInterface6 } from "readline";
 function requireDb2() {
-  if (!existsSync28(DB_PATH)) {
+  if (!existsSync29(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -22819,11 +23327,11 @@ function makeAddAccount(backend2, displayName) {
       process.exit(1);
     }
     await requireWriteDb2();
-    const slotsDir = join26(CC_CLAW_HOME, config2.slotsSubdir);
-    if (!existsSync28(slotsDir)) mkdirSync13(slotsDir, { recursive: true });
+    const slotsDir = join27(CC_CLAW_HOME, config2.slotsSubdir);
+    if (!existsSync29(slotsDir)) mkdirSync14(slotsDir, { recursive: true });
     const tempId = Date.now();
-    const slotDir = join26(slotsDir, `slot-${tempId}`);
-    mkdirSync13(slotDir, { recursive: true, mode: 448 });
+    const slotDir = join27(slotsDir, `slot-${tempId}`);
+    mkdirSync14(slotDir, { recursive: true, mode: 448 });
     if (config2.preSetup) config2.preSetup(slotDir);
     console.log("");
     console.log(`  Opening ${displayName} CLI for sign-in...`);
@@ -22861,6 +23369,13 @@ function makeAddAccount(backend2, displayName) {
       configHome: slotDir,
       priority: opts.priority ? parseInt(opts.priority, 10) : 0
     });
+    try {
+      const { setupSlotSymlinks: setupSlotSymlinks2, getPrimaryDir: getPrimaryDir2 } = await Promise.resolve().then(() => (init_symlink_manager(), symlink_manager_exports));
+      const primaryDir = getPrimaryDir2(backend2);
+      if (primaryDir) setupSlotSymlinks2(backend2, slotDir, primaryDir);
+    } catch (err) {
+      console.log(warning(`  Warning: could not set up state symlinks \u2014 ${err instanceof Error ? err.message : String(err)}`));
+    }
     output(
       { id, type: "oauth", backend: backend2, label: accountLabel, configHome: slotDir },
       () => success(`Added ${displayName} subscription slot #${id} (${accountLabel})`)
@@ -22984,12 +23499,12 @@ var init_backend_cmd_factory = __esm({
         envValue: (slotDir) => slotDir,
         envOverrides: { ANTHROPIC_API_KEY: void 0 },
         preSetup: (slotDir) => {
-          mkdirSync13(join26(slotDir, ".claude"), { recursive: true });
+          mkdirSync14(join27(slotDir, ".claude"), { recursive: true });
         },
         verifyCredentials: (slotDir) => {
-          const claudeJson = join26(slotDir, ".claude.json");
-          const claudeJsonNested = join26(slotDir, ".claude", ".claude.json");
-          if (existsSync28(claudeJson)) {
+          const claudeJson = join27(slotDir, ".claude.json");
+          const claudeJsonNested = join27(slotDir, ".claude", ".claude.json");
+          if (existsSync29(claudeJson)) {
             try {
               const data = JSON.parse(readFileSync18(claudeJson, "utf-8"));
               return Boolean(data.oauthAccount);
@@ -22997,7 +23512,7 @@ var init_backend_cmd_factory = __esm({
               return false;
             }
           }
-          if (existsSync28(claudeJsonNested)) {
+          if (existsSync29(claudeJsonNested)) {
             try {
               const data = JSON.parse(readFileSync18(claudeJsonNested, "utf-8"));
               return Boolean(data.oauthAccount);
@@ -23020,8 +23535,8 @@ var init_backend_cmd_factory = __esm({
           } catch {
           }
           try {
-            const claudeJson = join26(slotDir, ".claude.json");
-            if (existsSync28(claudeJson)) {
+            const claudeJson = join27(slotDir, ".claude.json");
+            if (existsSync29(claudeJson)) {
               const data = JSON.parse(readFileSync18(claudeJson, "utf-8"));
               if (data.oauthAccount?.emailAddress) return data.oauthAccount.emailAddress;
             }
@@ -23037,11 +23552,11 @@ var init_backend_cmd_factory = __esm({
         envValue: (slotDir) => slotDir,
         envOverrides: { OPENAI_API_KEY: void 0 },
         verifyCredentials: (slotDir) => {
-          return existsSync28(join26(slotDir, "auth.json"));
+          return existsSync29(join27(slotDir, "auth.json"));
         },
         extractLabel: (slotDir) => {
           try {
-            const authData = JSON.parse(readFileSync18(join26(slotDir, "auth.json"), "utf-8"));
+            const authData = JSON.parse(readFileSync18(join27(slotDir, "auth.json"), "utf-8"));
             if (authData.email) return authData.email;
             if (authData.account_name) return authData.account_name;
             if (authData.user?.email) return authData.user.email;
@@ -23061,12 +23576,12 @@ __export(backend_exports, {
   backendList: () => backendList,
   backendSet: () => backendSet
 });
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 async function backendList(globalOpts) {
   const { getAvailableAdapters: getAvailableAdapters3 } = await Promise.resolve().then(() => (init_backends(), backends_exports));
   const chatId = resolveChatId(globalOpts);
   let activeBackend = null;
-  if (existsSync29(DB_PATH)) {
+  if (existsSync30(DB_PATH)) {
     const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
     const readDb = openDatabaseReadOnly2();
     try {
@@ -23097,7 +23612,7 @@ async function backendList(globalOpts) {
 }
 async function backendGet(globalOpts) {
   const chatId = resolveChatId(globalOpts);
-  if (!existsSync29(DB_PATH)) {
+  if (!existsSync30(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -23141,13 +23656,13 @@ __export(model_exports, {
   modelList: () => modelList,
   modelSet: () => modelSet
 });
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 async function modelList(globalOpts) {
   const chatId = resolveChatId(globalOpts);
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const { getAdapter: getAdapter4, getAllAdapters: getAllAdapters5 } = await Promise.resolve().then(() => (init_backends(), backends_exports));
   let backendId = "claude";
-  if (existsSync30(DB_PATH)) {
+  if (existsSync31(DB_PATH)) {
     const readDb = openDatabaseReadOnly2();
     try {
       const row = readDb.prepare("SELECT backend FROM chat_backend WHERE chat_id = ?").get(chatId);
@@ -23180,7 +23695,7 @@ async function modelList(globalOpts) {
 }
 async function modelGet(globalOpts) {
   const chatId = resolveChatId(globalOpts);
-  if (!existsSync30(DB_PATH)) {
+  if (!existsSync31(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23224,9 +23739,9 @@ __export(memory_exports2, {
   memoryList: () => memoryList,
   memorySearch: () => memorySearch
 });
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 async function memoryList(globalOpts) {
-  if (!existsSync31(DB_PATH)) {
+  if (!existsSync32(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -23250,7 +23765,7 @@ async function memoryList(globalOpts) {
   });
 }
 async function memorySearch(globalOpts, query) {
-  if (!existsSync31(DB_PATH)) {
+  if (!existsSync32(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23272,7 +23787,7 @@ async function memorySearch(globalOpts, query) {
   });
 }
 async function memoryHistory(globalOpts, opts) {
-  if (!existsSync31(DB_PATH)) {
+  if (!existsSync32(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23320,7 +23835,7 @@ __export(cron_exports2, {
   cronList: () => cronList,
   cronRuns: () => cronRuns
 });
-import { existsSync as existsSync32 } from "fs";
+import { existsSync as existsSync33 } from "fs";
 function parseFallbacks(raw) {
   return raw.slice(0, 3).map((f) => {
     const [backend2, ...rest] = f.split(":");
@@ -23341,7 +23856,7 @@ function parseAndValidateTimeout(raw) {
   return val;
 }
 async function cronList(globalOpts) {
-  if (!existsSync32(DB_PATH)) {
+  if (!existsSync33(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23379,7 +23894,7 @@ async function cronList(globalOpts) {
   });
 }
 async function cronHealth(globalOpts) {
-  if (!existsSync32(DB_PATH)) {
+  if (!existsSync33(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23538,7 +24053,7 @@ async function cronEdit(globalOpts, id, opts) {
   }
 }
 async function cronRuns(globalOpts, jobId, opts) {
-  if (!existsSync32(DB_PATH)) {
+  if (!existsSync33(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23585,9 +24100,9 @@ __export(agents_exports, {
   runnersList: () => runnersList,
   tasksList: () => tasksList
 });
-import { existsSync as existsSync33 } from "fs";
+import { existsSync as existsSync34 } from "fs";
 async function agentsList(globalOpts) {
-  if (!existsSync33(DB_PATH)) {
+  if (!existsSync34(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23618,7 +24133,7 @@ async function agentsList(globalOpts) {
   });
 }
 async function tasksList(globalOpts) {
-  if (!existsSync33(DB_PATH)) {
+  if (!existsSync34(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -23746,18 +24261,18 @@ __export(db_exports, {
   dbPath: () => dbPath,
   dbStats: () => dbStats
 });
-import { existsSync as existsSync34, statSync as statSync8, copyFileSync as copyFileSync2, mkdirSync as mkdirSync14 } from "fs";
-import { dirname as dirname5 } from "path";
+import { existsSync as existsSync35, statSync as statSync9, copyFileSync as copyFileSync3, mkdirSync as mkdirSync15 } from "fs";
+import { dirname as dirname6 } from "path";
 async function dbStats(globalOpts) {
-  if (!existsSync34(DB_PATH)) {
+  if (!existsSync35(DB_PATH)) {
     outputError("DB_NOT_FOUND", `Database not found at ${DB_PATH}`);
     process.exit(1);
   }
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const readDb = openDatabaseReadOnly2();
-  const mainSize = statSync8(DB_PATH).size;
+  const mainSize = statSync9(DB_PATH).size;
   const walPath = DB_PATH + "-wal";
-  const walSize = existsSync34(walPath) ? statSync8(walPath).size : 0;
+  const walSize = existsSync35(walPath) ? statSync9(walPath).size : 0;
   const tableNames = readDb.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '%_fts%' ORDER BY name"
   ).all();
@@ -23791,17 +24306,17 @@ async function dbPath(globalOpts) {
   output({ path: DB_PATH }, (d) => d.path);
 }
 async function dbBackup(globalOpts, destPath) {
-  if (!existsSync34(DB_PATH)) {
+  if (!existsSync35(DB_PATH)) {
     outputError("DB_NOT_FOUND", `Database not found at ${DB_PATH}`);
     process.exit(1);
   }
   const dest = destPath ?? `${DB_PATH}.backup-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
   try {
-    mkdirSync14(dirname5(dest), { recursive: true });
-    copyFileSync2(DB_PATH, dest);
+    mkdirSync15(dirname6(dest), { recursive: true });
+    copyFileSync3(DB_PATH, dest);
     const walPath = DB_PATH + "-wal";
-    if (existsSync34(walPath)) copyFileSync2(walPath, dest + "-wal");
-    output({ path: dest, sizeBytes: statSync8(dest).size }, (d) => {
+    if (existsSync35(walPath)) copyFileSync3(walPath, dest + "-wal");
+    output({ path: dest, sizeBytes: statSync9(dest).size }, (d) => {
       const b = d;
       return `
   ${success("Backup created:")} ${b.path} (${(b.sizeBytes / 1024).toFixed(0)}KB)
@@ -23829,9 +24344,9 @@ __export(usage_exports, {
   usageCost: () => usageCost,
   usageTokens: () => usageTokens
 });
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 function ensureDb() {
-  if (!existsSync35(DB_PATH)) {
+  if (!existsSync36(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -24021,9 +24536,9 @@ __export(config_exports2, {
   configList: () => configList,
   configSet: () => configSet
 });
-import { existsSync as existsSync36, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync19 } from "fs";
 async function configList(globalOpts) {
-  if (!existsSync36(DB_PATH)) {
+  if (!existsSync37(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24057,7 +24572,7 @@ async function configGet(globalOpts, key) {
     outputError("INVALID_KEY", `Unknown config key "${key}". Valid keys: ${RUNTIME_KEYS.join(", ")}`);
     process.exit(1);
   }
-  if (!existsSync36(DB_PATH)) {
+  if (!existsSync37(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24103,7 +24618,7 @@ async function configSet(globalOpts, key, value) {
   }
 }
 async function configEnv(_globalOpts) {
-  if (!existsSync36(ENV_PATH)) {
+  if (!existsSync37(ENV_PATH)) {
     outputError("ENV_NOT_FOUND", `No .env file at ${ENV_PATH}. Run cc-claw setup.`);
     process.exit(1);
   }
@@ -24157,9 +24672,9 @@ __export(session_exports, {
   sessionGet: () => sessionGet,
   sessionNew: () => sessionNew
 });
-import { existsSync as existsSync37 } from "fs";
+import { existsSync as existsSync38 } from "fs";
 async function sessionGet(globalOpts) {
-  if (!existsSync37(DB_PATH)) {
+  if (!existsSync38(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24220,9 +24735,9 @@ __export(permissions_exports, {
   verboseGet: () => verboseGet,
   verboseSet: () => verboseSet
 });
-import { existsSync as existsSync38 } from "fs";
+import { existsSync as existsSync39 } from "fs";
 function ensureDb2() {
-  if (!existsSync38(DB_PATH)) {
+  if (!existsSync39(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24369,9 +24884,9 @@ __export(cwd_exports, {
   cwdGet: () => cwdGet,
   cwdSet: () => cwdSet
 });
-import { existsSync as existsSync39 } from "fs";
+import { existsSync as existsSync40 } from "fs";
 async function cwdGet(globalOpts) {
-  if (!existsSync39(DB_PATH)) {
+  if (!existsSync40(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24433,9 +24948,9 @@ __export(voice_exports, {
   voiceGet: () => voiceGet,
   voiceSet: () => voiceSet
 });
-import { existsSync as existsSync40 } from "fs";
+import { existsSync as existsSync41 } from "fs";
 async function voiceGet(globalOpts) {
-  if (!existsSync40(DB_PATH)) {
+  if (!existsSync41(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24484,9 +24999,9 @@ __export(heartbeat_exports, {
   heartbeatGet: () => heartbeatGet,
   heartbeatSet: () => heartbeatSet
 });
-import { existsSync as existsSync41 } from "fs";
+import { existsSync as existsSync42 } from "fs";
 async function heartbeatGet(globalOpts) {
-  if (!existsSync41(DB_PATH)) {
+  if (!existsSync42(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24595,9 +25110,9 @@ __export(summarizer_exports, {
   summarizerGet: () => summarizerGet,
   summarizerSet: () => summarizerSet
 });
-import { existsSync as existsSync42 } from "fs";
+import { existsSync as existsSync43 } from "fs";
 async function summarizerGet(globalOpts) {
-  if (!existsSync42(DB_PATH)) {
+  if (!existsSync43(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24641,9 +25156,9 @@ __export(thinking_exports, {
   thinkingGet: () => thinkingGet,
   thinkingSet: () => thinkingSet
 });
-import { existsSync as existsSync43 } from "fs";
+import { existsSync as existsSync44 } from "fs";
 async function thinkingGet(globalOpts) {
-  if (!existsSync43(DB_PATH)) {
+  if (!existsSync44(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24687,9 +25202,9 @@ __export(chats_exports, {
   chatsList: () => chatsList,
   chatsRemoveAlias: () => chatsRemoveAlias
 });
-import { existsSync as existsSync44 } from "fs";
+import { existsSync as existsSync45 } from "fs";
 async function chatsList(_globalOpts) {
-  if (!existsSync44(DB_PATH)) {
+  if (!existsSync45(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24817,9 +25332,9 @@ var mcps_exports2 = {};
 __export(mcps_exports2, {
   mcpsList: () => mcpsList
 });
-import { existsSync as existsSync45 } from "fs";
+import { existsSync as existsSync46 } from "fs";
 async function mcpsList(_globalOpts) {
-  if (!existsSync45(DB_PATH)) {
+  if (!existsSync46(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -24856,11 +25371,11 @@ __export(chat_exports2, {
   chatSend: () => chatSend
 });
 import { request as httpRequest2 } from "http";
-import { readFileSync as readFileSync20, existsSync as existsSync46 } from "fs";
+import { readFileSync as readFileSync20, existsSync as existsSync47 } from "fs";
 function getToken2() {
   if (process.env.CC_CLAW_API_TOKEN) return process.env.CC_CLAW_API_TOKEN;
   try {
-    if (existsSync46(TOKEN_PATH2)) return readFileSync20(TOKEN_PATH2, "utf-8").trim();
+    if (existsSync47(TOKEN_PATH2)) return readFileSync20(TOKEN_PATH2, "utf-8").trim();
   } catch {
   }
   return null;
@@ -25139,8 +25654,8 @@ var completion_exports = {};
 __export(completion_exports, {
   completionCommand: () => completionCommand
 });
-import { writeFileSync as writeFileSync10, mkdirSync as mkdirSync15 } from "fs";
-import { join as join27 } from "path";
+import { writeFileSync as writeFileSync10, mkdirSync as mkdirSync16 } from "fs";
+import { join as join28 } from "path";
 import { homedir as homedir9 } from "os";
 async function completionCommand(opts) {
   const shell = opts.shell ?? detectShell();
@@ -25156,10 +25671,10 @@ async function completionCommand(opts) {
     process.exit(1);
   }
   if (opts.install) {
-    const dir = join27(homedir9(), ".config", "cc-claw", "completions");
-    mkdirSync15(dir, { recursive: true });
+    const dir = join28(homedir9(), ".config", "cc-claw", "completions");
+    mkdirSync16(dir, { recursive: true });
     const filename = shell === "zsh" ? "_cc-claw" : shell === "fish" ? "cc-claw.fish" : "cc-claw.bash";
-    const filepath = join27(dir, filename);
+    const filepath = join28(dir, filename);
     writeFileSync10(filepath, script, "utf-8");
     console.log(`\u2713 Completion script written to ${filepath}
 `);
@@ -25330,9 +25845,9 @@ __export(evolve_exports2, {
   evolveStatus: () => evolveStatus,
   evolveUndo: () => evolveUndo
 });
-import { existsSync as existsSync47 } from "fs";
+import { existsSync as existsSync48 } from "fs";
 function ensureDb3() {
-  if (!existsSync47(DB_PATH)) {
+  if (!existsSync48(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -25748,10 +26263,10 @@ var init_evolve3 = __esm({
 
 // src/setup.ts
 var setup_exports = {};
-import { existsSync as existsSync48, writeFileSync as writeFileSync11, readFileSync as readFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync16, statSync as statSync9 } from "fs";
+import { existsSync as existsSync49, writeFileSync as writeFileSync11, readFileSync as readFileSync21, copyFileSync as copyFileSync4, mkdirSync as mkdirSync17, statSync as statSync10 } from "fs";
 import { execFileSync as execFileSync5 } from "child_process";
 import { createInterface as createInterface8 } from "readline";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function divider2() {
   console.log(dim("\u2500".repeat(55)));
 }
@@ -25826,10 +26341,10 @@ async function setup() {
   }
   console.log("");
   for (const dir of [CC_CLAW_HOME, DATA_PATH, LOGS_PATH, SKILLS_PATH, RUNNERS_PATH, AGENTS_PATH]) {
-    if (!existsSync48(dir)) mkdirSync16(dir, { recursive: true });
+    if (!existsSync49(dir)) mkdirSync17(dir, { recursive: true });
   }
   const env = {};
-  const envSource = existsSync48(ENV_PATH) ? ENV_PATH : existsSync48(".env") ? ".env" : null;
+  const envSource = existsSync49(ENV_PATH) ? ENV_PATH : existsSync49(".env") ? ".env" : null;
   if (envSource) {
     console.log(yellow(`  Found existing config at ${envSource} \u2014 your values will be preserved`));
     console.log(yellow("  unless you enter new ones. Just press Enter to keep existing values.\n"));
@@ -25839,13 +26354,13 @@ async function setup() {
       if (match) env[match[1].trim()] = match[2].trim();
     }
   }
-  const cwdDb = join28(process.cwd(), "cc-claw.db");
-  if (existsSync48(cwdDb) && !existsSync48(DB_PATH)) {
-    const { size } = statSync9(cwdDb);
+  const cwdDb = join29(process.cwd(), "cc-claw.db");
+  if (existsSync49(cwdDb) && !existsSync49(DB_PATH)) {
+    const { size } = statSync10(cwdDb);
     console.log(yellow(`  Found existing database at ${cwdDb} (${(size / 1024).toFixed(0)}KB)`));
     const migrate = await confirm("Copy database to ~/.cc-claw/? (preserves memories & history)", true);
     if (migrate) {
-      copyFileSync3(cwdDb, DB_PATH);
+      copyFileSync4(cwdDb, DB_PATH);
       console.log(green(`  Database copied to ${DB_PATH}`));
     }
     console.log("");