farai 0.2.7 → 0.2.8

package/dist/cli/index.js

@@ -5147,6 +5147,7 @@ function normalizeConfig(raw) {
   const context = contextConfig(raw.context);
   const lsp = lspConfig(raw.lsp);
   const web = webConfig(raw.web);
+  const updates = updatesConfig(raw.updates);
   return {
     ...positiveInteger(raw.config_version ?? raw.configVersion) !== undefined ? {
       configVersion: positiveInteger(raw.config_version ?? raw.configVersion)
@@ -5206,8 +5207,29 @@ function normalizeConfig(raw) {
     } : {},
     ...web ? {
       web
+    } : {},
+    ...updates ? {
+      updates
+    } : {}
+  };
+}
+function updatesConfig(value) {
+  if (!isRecord2(value))
+    return;
+  const rawContentEnabled = value.content_enabled ?? value.contentEnabled;
+  const contentManifestUrl = typeof (value.content_manifest_url ?? value.contentManifestUrl) === "string" ? String(value.content_manifest_url ?? value.contentManifestUrl).trim() : undefined;
+  const config = {
+    ...typeof rawContentEnabled === "boolean" ? {
+      contentEnabled: rawContentEnabled
+    } : {},
+    ...contentManifestUrl ? {
+      contentManifestUrl
+    } : {},
+    ...typeof value.prompt === "boolean" ? {
+      prompt: value.prompt
     } : {}
   };
+  return Object.keys(config).length ? config : undefined;
 }
 function webConfig(value) {
   if (!isRecord2(value))
@@ -5389,6 +5411,12 @@ function mergeConfig(base, over) {
         ...base.web,
         ...over.web
       }
+    } : {},
+    ...base.updates || over.updates ? {
+      updates: {
+        ...base.updates,
+        ...over.updates
+      }
     } : {}
   };
 }
@@ -5444,6 +5472,18 @@ function serializeConfigToml(config) {
         searxng_url: config.web.searxngUrl
       } : {}
     });
+  if (config.updates && Object.keys(config.updates).length)
+    emitTable(lines, ["updates"], {
+      ...config.updates.contentEnabled === undefined ? {} : {
+        content_enabled: config.updates.contentEnabled
+      },
+      ...config.updates.contentManifestUrl ? {
+        content_manifest_url: config.updates.contentManifestUrl
+      } : {},
+      ...config.updates.prompt === undefined ? {} : {
+        prompt: config.updates.prompt
+      }
+    });
   for (const [selection, limit] of Object.entries(config.modelLimits ?? {})) {
     emitTable(lines, ["model_limits", selection], {
       ...limit.contextWindow ? {
@@ -5606,6 +5646,10 @@ model = "big-pickle"
 mode = "explicit"
 tls = "relaxed"
 
+[updates]
+content_enabled = true
+prompt = true
+
 [mcp_servers.mitmproxy-mcp]
 command = "mitmproxy-mcp"
 args = []
@@ -7419,8 +7463,8 @@ var init_process_output = __esm(() => {
 
 // src/version.ts
 function resolveFaraiVersion() {
-  if ("0.2.7")
-    return "0.2.7";
+  if ("0.2.8")
+    return "0.2.8";
   try {
     const parsed = JSON.parse(readBoundedFileTextSync(new URL("../package.json", import.meta.url), 1024 * 1024, "package metadata"));
     if (typeof parsed.version === "string" && parsed.version)
@@ -17293,11 +17337,112 @@ var init_memory_mark_failed = __esm(() => {
   };
 });
 
+// src/agent-content/paths.ts
+import { existsSync as existsSync8 } from "fs";
+import { isAbsolute as isAbsolute4, join as join13, resolve as resolve7 } from "path";
+function contentRoot() {
+  const configured = process.env.FARAI_CONTENT_DIR?.trim();
+  if (!configured)
+    return join13(globalDataDir(), "content");
+  if (!isAbsolute4(configured))
+    throw new Error("farai_content_dir must be an absolute path");
+  return resolve7(configured);
+}
+function contentVersionsDir() {
+  return join13(contentRoot(), "versions");
+}
+function contentActivePath() {
+  return join13(contentRoot(), "active.json");
+}
+function contentManifestCachePath() {
+  return join13(contentRoot(), "manifest-cache.json");
+}
+function contentPreferencesPath() {
+  return join13(contentRoot(), "preferences.json");
+}
+function contentLockPath() {
+  return join13(contentRoot(), "update.lock");
+}
+function contentVersionDir(version) {
+  if (!VERSION_PATTERN.test(version))
+    throw new Error(`invalid content version: ${version}`);
+  return join13(contentVersionsDir(), version);
+}
+function readActiveContent() {
+  const path = contentActivePath();
+  try {
+    if (!existsSync8(path))
+      return;
+    ensurePrivateRegularFileIfExists(path, "active content pointer");
+    const parsed = JSON.parse(readBoundedFileTextSyncNoFollow(path, POINTER_MAX_BYTES, "active content pointer"));
+    return parseActiveContent(parsed);
+  } catch {
+    return;
+  }
+}
+function activeContentKnowledgePath() {
+  const active = readActiveContent();
+  if (!active?.knowledge)
+    return;
+  const path = join13(contentVersionDir(active.version), "knowledge.db");
+  return existsSync8(path) ? path : undefined;
+}
+function activeContentSkillsDir() {
+  const active = readActiveContent();
+  if (!active?.skills)
+    return;
+  const path = join13(contentVersionDir(active.version), "skills");
+  return existsSync8(path) ? path : undefined;
+}
+function ensureContentDirectories() {
+  ensurePrivateDirectory(contentRoot(), "farai content directory");
+  ensurePrivateDirectory(contentVersionsDir(), "farai content versions directory");
+}
+function parseActiveContent(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  const record2 = value;
+  if (record2.schemaVersion !== 1)
+    return;
+  if (typeof record2.version !== "string" || !VERSION_PATTERN.test(record2.version))
+    return;
+  if (!validDate(record2.generatedAt) || !validDate(record2.activatedAt))
+    return;
+  if (typeof record2.manifestUrl !== "string" || !record2.manifestUrl)
+    return;
+  if (typeof record2.knowledge !== "boolean" || typeof record2.skills !== "boolean")
+    return;
+  const previousVersion = typeof record2.previousVersion === "string" && VERSION_PATTERN.test(record2.previousVersion) ? record2.previousVersion : undefined;
+  return {
+    schemaVersion: 1,
+    version: record2.version,
+    generatedAt: record2.generatedAt,
+    activatedAt: record2.activatedAt,
+    manifestUrl: record2.manifestUrl,
+    ...previousVersion ? {
+      previousVersion
+    } : {},
+    knowledge: record2.knowledge,
+    skills: record2.skills
+  };
+}
+function validDate(value) {
+  return typeof value === "string" && value.length > 0 && Number.isFinite(Date.parse(value));
+}
+var POINTER_MAX_BYTES, VERSION_PATTERN;
+var init_paths2 = __esm(() => {
+  init_paths();
+  init_private_path();
+  init_file_read();
+  POINTER_MAX_BYTES = 64 * 1024;
+  VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+});
+
 // src/agent-skills/registry.ts
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync8, readdirSync as readdirSync3, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { existsSync as existsSync9, readdirSync as readdirSync3, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { delimiter, isAbsolute as isAbsolute4, join as join13, relative as relative4, resolve as resolve7, sep as sep2 } from "path";
+import { delimiter, isAbsolute as isAbsolute5, join as join14, relative as relative4, resolve as resolve8, sep as sep2 } from "path";
 function discoverSkills(options = {}) {
   const diagnostics = [];
   const selected = new Map;
@@ -17352,7 +17497,7 @@ function loadSkill(name, options = {}) {
   const resourcePath = normalizeResourcePath(options.resource);
   if (!resourcePath || !skill.resources.includes(resourcePath))
     return;
-  const absolute = resolve7(skill.directory, resourcePath);
+  const absolute = resolve8(skill.directory, resourcePath);
   const canonical = realpathSync2(absolute);
   if (!inside(skill.directory, canonical))
     return;
@@ -17393,28 +17538,35 @@ function skillRoots(options) {
     source: "builtin",
     priority: 0
   }];
+  const content = activeContentSkillsDir();
+  if (content)
+    roots.push({
+      path: content,
+      source: "content",
+      priority: 5
+    });
   if (options.includeUser !== false)
     roots.push({
-      path: join13(homedir4(), ".agents", "skills"),
+      path: join14(homedir4(), ".agents", "skills"),
       source: "user",
       priority: 10
     });
   const environmentRoots = [...process.env.FARAI_SKILLS_DIR?.split(delimiter) ?? [], ...options.extraRoots ?? []].map((path) => path.trim()).filter(Boolean);
   for (const path of environmentRoots)
     roots.push({
-      path: resolve7(path),
+      path: resolve8(path),
       source: "environment",
       priority: 20
     });
   if (options.workspace)
     roots.push({
-      path: join13(resolve7(options.workspace), ".agents", "skills"),
+      path: join14(resolve8(options.workspace), ".agents", "skills"),
       source: "project",
       priority: 30
     });
   const seen = new Set;
   return roots.filter((root) => {
-    const key = resolve7(root.path);
+    const key = resolve8(root.path);
     if (seen.has(key))
       return false;
     seen.add(key);
@@ -17422,7 +17574,7 @@ function skillRoots(options) {
   });
 }
 function scanRoot(root, diagnostics) {
-  if (!existsSync8(root.path))
+  if (!existsSync9(root.path))
     return [];
   let entries;
   try {
@@ -17442,9 +17594,9 @@ function scanRoot(root, diagnostics) {
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const directory = join13(root.path, entry.name);
-    const file = join13(directory, "SKILL.md");
-    if (!existsSync8(file))
+    const directory = join14(root.path, entry.name);
+    const file = join14(directory, "SKILL.md");
+    if (!existsSync9(file))
       continue;
     const parsed = parseSkill(file, directory, entry.name, root, diagnostics);
     if (parsed)
@@ -17453,8 +17605,8 @@ function scanRoot(root, diagnostics) {
   return skills;
 }
 function resolveBuiltinSkillDir() {
-  const candidates = [join13(import.meta.dir, "library"), join13(import.meta.dir, "..", "..", "src", "agent-skills", "library")];
-  return candidates.find((candidate) => existsSync8(candidate)) ?? candidates[0];
+  const candidates = [join14(import.meta.dir, "library"), join14(import.meta.dir, "..", "..", "src", "agent-skills", "library")];
+  return candidates.find((candidate) => existsSync9(candidate)) ?? candidates[0];
 }
 function parseSkill(file, directory, directoryName, root, diagnostics) {
   let raw;
@@ -17589,7 +17741,7 @@ function listResources(directory, diagnostics) {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (resources.length >= MAX_RESOURCES || entry.name.startsWith("."))
         continue;
-      const path = join13(current, entry.name);
+      const path = join14(current, entry.name);
       let canonical;
       try {
         canonical = realpathSync2(path);
@@ -17600,7 +17752,7 @@ function listResources(directory, diagnostics) {
         continue;
       if (entry.isDirectory())
         visit(canonical);
-      else if ((entry.isFile() || entry.isSymbolicLink()) && canonical !== join13(directory, "SKILL.md")) {
+      else if ((entry.isFile() || entry.isSymbolicLink()) && canonical !== join14(directory, "SKILL.md")) {
         resources.push(relative4(directory, canonical).split(sep2).join("/"));
       }
     }
@@ -17642,7 +17794,7 @@ function optionalScalar(value) {
 }
 function normalizeResourcePath(path) {
   const trimmed = path.trim().replaceAll("\\", "/");
-  if (!trimmed || isAbsolute4(trimmed) || trimmed.includes("\x00"))
+  if (!trimmed || isAbsolute5(trimmed) || trimmed.includes("\x00"))
     return;
   const normalized = trimmed.split("/").filter((part) => part && part !== ".").join("/");
   if (!normalized || normalized.split("/").includes(".."))
@@ -17651,7 +17803,7 @@ function normalizeResourcePath(path) {
 }
 function inside(directory, path) {
   const rel = relative4(realpathSync2(directory), path);
-  return rel === "" || !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute4(rel);
+  return rel === "" || !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute5(rel);
 }
 function compactText(value, max) {
   const compact = value.replace(/\s+/g, " ").trim();
@@ -17663,6 +17815,7 @@ function errorMessage(error) {
 var BUILTIN_DIR, MAX_SKILL_BYTES, RECOMMENDED_SKILL_BYTES, MAX_RESOURCE_BYTES, MAX_RESOURCES = 256, NAME_PATTERN;
 var init_registry2 = __esm(() => {
   init_file_read();
+  init_paths2();
   BUILTIN_DIR = resolveBuiltinSkillDir();
   MAX_SKILL_BYTES = 64 * 1024;
   RECOMMENDED_SKILL_BYTES = 20 * 1024;
@@ -17798,8 +17951,8 @@ var init_global_config = __esm(() => {
 
 // src/agent-core/context-builder.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync9, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
-import { isAbsolute as isAbsolute5, join as join14, normalize as normalize2, relative as relative5 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { isAbsolute as isAbsolute6, join as join15, normalize as normalize2, relative as relative5 } from "path";
 
 class ContextBuilderCache {
   workspaceFiles = new Map;
@@ -17831,7 +17984,7 @@ class ContextBuilderCache {
   loadInstructionFragments(workspace, referencedPaths = []) {
     const dirs = instructionCandidateDirs(workspace, referencedPaths);
     const key = `${workspace}\x00${dirs.join("\x00")}`;
-    const fingerprint = dirs.flatMap((dir) => INSTRUCTION_FILENAMES.map((filename) => statFingerprint(join14(dir, filename)))).join("|");
+    const fingerprint = dirs.flatMap((dir) => INSTRUCTION_FILENAMES.map((filename) => statFingerprint(join15(dir, filename)))).join("|");
     const cached = this.instructions.get(key);
     if (cached?.fingerprint === fingerprint)
       return cached.fragments;
@@ -17852,7 +18005,7 @@ class ContextBuilderCache {
   extractSymbols(workspace, file) {
     if (!/\.(?:[cm]?[jt]sx?|py|go|rs)$/i.test(file))
       return [];
-    const path = join14(workspace, file);
+    const path = join15(workspace, file);
     const fingerprint = statFingerprint(path);
     const cached = this.symbols.get(path);
     if (cached?.fingerprint === fingerprint)
@@ -17913,7 +18066,7 @@ function collectWorkspaceFilesFromFs(workspace) {
         break;
       if (entry.name.startsWith(".") || FALLBACK_IGNORED_DIRECTORIES.has(entry.name))
         continue;
-      const absolute = join14(directory, entry.name);
+      const absolute = join15(directory, entry.name);
       if (entry.isDirectory())
         pending.push(absolute);
       else if (entry.isFile())
@@ -18006,8 +18159,8 @@ function fragment(input) {
 }
 function readFirstInstructionFile(dir) {
   for (const filename of INSTRUCTION_FILENAMES) {
-    const path = join14(dir, filename);
-    if (!existsSync9(path))
+    const path = join15(dir, filename);
+    if (!existsSync10(path))
       continue;
     try {
       const body = readFileTextPrefixSync(path, PROJECT_INSTRUCTIONS_MAX_BYTES, "project instructions").text.trim();
@@ -18035,7 +18188,7 @@ function referencedInstructionDirs(workspace, referencedPaths) {
     parts.pop();
     let current = workspace;
     for (const part of parts) {
-      current = join14(current, part);
+      current = join15(current, part);
       if (seen.has(current))
         continue;
       seen.add(current);
@@ -18048,7 +18201,7 @@ function instructionCandidateDirs(workspace, referencedPaths) {
   return [...new Set([...globalInstructionDirs(), workspace, ...referencedInstructionDirs(workspace, referencedPaths)])];
 }
 function workspaceFileFingerprint(workspace) {
-  return `${statFingerprint(workspace)}|${statFingerprint(join14(workspace, ".git", "index"))}`;
+  return `${statFingerprint(workspace)}|${statFingerprint(join15(workspace, ".git", "index"))}`;
 }
 function statFingerprint(path) {
   try {
@@ -18064,7 +18217,7 @@ function validWorkspaceFiles(workspace, paths) {
     const rel = workspaceRelativeReference(workspace, value);
     if (!rel)
       continue;
-    const absolute = join14(workspace, rel);
+    const absolute = join15(workspace, rel);
     try {
       if (statSync4(absolute).isFile())
         files.push(rel);
@@ -18078,9 +18231,9 @@ function workspaceRelativeReference(workspace, value) {
     return;
   const containerPrefix = `${normalize2("/workspace")}/`;
   const worktreeMatch = normalized.match(/^[/\\]worktrees[/\\][^/\\]+[/\\](.+)$/);
-  const absolute = normalized.startsWith(containerPrefix) ? normalize2(join14(workspace, normalized.slice(containerPrefix.length))) : worktreeMatch ? normalize2(join14(workspace, worktreeMatch[1])) : isAbsolute5(normalized) ? normalized : normalize2(join14(workspace, normalized.replace(/^\/+/, "")));
+  const absolute = normalized.startsWith(containerPrefix) ? normalize2(join15(workspace, normalized.slice(containerPrefix.length))) : worktreeMatch ? normalize2(join15(workspace, worktreeMatch[1])) : isAbsolute6(normalized) ? normalized : normalize2(join15(workspace, normalized.replace(/^\/+/, "")));
   const rel = relative5(workspace, absolute);
-  if (!rel || rel.startsWith("..") || isAbsolute5(rel))
+  if (!rel || rel.startsWith("..") || isAbsolute6(rel))
     return;
   return rel;
 }
@@ -18822,7 +18975,7 @@ class HostProcessBackend {
   }
   async runOnce(command, opts) {
     const started = Date.now();
-    return await new Promise((resolve8) => {
+    return await new Promise((resolve9) => {
       const child = spawn4("bash", ["-lc", command], {
         cwd: this.cwd,
         stdio: ["pipe", "pipe", "pipe"],
@@ -18842,7 +18995,7 @@ class HostProcessBackend {
         const {
           sessionId
         } = sessions.register(child);
-        resolve8({
+        resolve9({
           exitCode: null,
           stdout: stdout.text(),
           stderr: stderr.text(),
@@ -18882,7 +19035,7 @@ class HostProcessBackend {
           return;
         settled = true;
         stderr.push(error.message);
-        resolve8({
+        resolve9({
           exitCode: 127,
           stdout: stdout.text(),
           stderr: stderr.text(),
@@ -18897,7 +19050,7 @@ class HostProcessBackend {
         if (converted || settled)
           return;
         settled = true;
-        resolve8({
+        resolve9({
           exitCode,
           stdout: stdout.text(),
           stderr: stderr.text(),
@@ -19868,17 +20021,17 @@ var init_next_action = __esm(() => {
 });
 
 // src/agent-core/subagents/lanes.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join16 } from "path";
 function laneConfigPaths(workspace) {
   if (false)
     ;
-  return [join15(localFaraiDir(), "agents.json"), join15(workspace, ".farai", "agents.json")];
+  return [join16(localFaraiDir(), "agents.json"), join16(workspace, ".farai", "agents.json")];
 }
 function loadLanes(workspace) {
   const merged = new Map(BUILTIN_LANES.map((lane) => [lane.id, structuredClone(lane)]));
   for (const path of laneConfigPaths(workspace)) {
-    if (!existsSync10(path))
+    if (!existsSync11(path))
       continue;
     try {
       const parsed = JSON.parse(readBoundedFileTextSync(path, LANE_CONFIG_MAX_BYTES, "agent lane config"));
@@ -20593,8 +20746,8 @@ class BrowserContextManager {
     const config = isolatedBrowserConfig(base, contextId);
     let resolveReady = () => {};
     let rejectReady = (_error) => {};
-    const ready = new Promise((resolve8, reject) => {
-      resolveReady = resolve8;
+    const ready = new Promise((resolve9, reject) => {
+      resolveReady = resolve9;
       rejectReady = reject;
     });
     ready.catch(() => {});
@@ -20787,9 +20940,9 @@ class AsyncMutex {
       this.locked = true;
       return Promise.resolve();
     }
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const waiter = {
-        resolve: resolve8,
+        resolve: resolve9,
         reject,
         ...signal ? {
           signal
@@ -20825,7 +20978,7 @@ async function waitForSignal(promise, signal) {
     return await promise;
   if (signal.aborted)
     throw signal.reason ?? new Error("Browser context operation cancelled");
-  return await new Promise((resolve8, reject) => {
+  return await new Promise((resolve9, reject) => {
     const abort = () => {
       cleanup();
       reject(signal.reason ?? new Error("Browser context operation cancelled"));
@@ -20836,7 +20989,7 @@ async function waitForSignal(promise, signal) {
     });
     promise.then((value) => {
       cleanup();
-      resolve8(value);
+      resolve9(value);
     }, (error) => {
       cleanup();
       reject(error);
@@ -22247,14 +22400,14 @@ var init_shared2 = __esm(() => {
 // src/agent-tools/web/web-fetch.ts
 import { mkdirSync as mkdirSync5, unlinkSync as unlinkSync4 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 async function extractPdf(context, bytes) {
-  const directory = join16(context.workspace, ".farai", "tmp");
+  const directory = join17(context.workspace, ".farai", "tmp");
   mkdirSync5(directory, {
     recursive: true
   });
   const name = `web-fetch-${randomUUID3()}.pdf`;
-  const path = join16(directory, name);
+  const path = join17(directory, name);
   atomicWriteFile(path, bytes, 384);
   try {
     const backendPath = context.executionBackend?.kind === "host" ? path : `/workspace/.farai/tmp/${name}`;
@@ -23276,10 +23429,10 @@ var init_worktree = __esm(() => {
 });
 
 // src/agent-tools/services/mitmproxy/flows.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { isIP as isIP2 } from "net";
 async function readProxyFlows(file, query = {}) {
-  if (!existsSync11(file))
+  if (!existsSync12(file))
     return [];
   const limit = proxyFlowLimit(query.limit);
   const flows = [];
@@ -23311,7 +23464,7 @@ async function readProxyFlows(file, query = {}) {
   return flows;
 }
 async function readProxyFlowDetail(file, id2) {
-  if (!existsSync11(file))
+  if (!existsSync12(file))
     return;
   let found;
   await forEachFileLine(file, {
@@ -24947,7 +25100,7 @@ function detailMatches(detail, options) {
   return !options.body || detail.text.toLowerCase().includes(options.body.toLowerCase());
 }
 async function waitForMailboxChange(client, timeoutMs, signal) {
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     let settled = false;
     const finish = (error) => {
       if (settled)
@@ -24959,7 +25112,7 @@ async function waitForMailboxChange(client, timeoutMs, signal) {
       if (error)
         reject(error);
       else
-        resolve8();
+        resolve9();
     };
     const onAbort = () => finish(signal?.reason ?? new Error("email wait cancelled"));
     const onExists = () => finish();
@@ -24976,8 +25129,8 @@ async function waitForMailboxChange(client, timeoutMs, signal) {
 async function closeImap(client) {
   let timer;
   try {
-    const closed = await Promise.race([client.logout().then(() => true, () => false), new Promise((resolve8) => {
-      timer = setTimeout(() => resolve8(false), IMAP_LOGOUT_TIMEOUT_MS);
+    const closed = await Promise.race([client.logout().then(() => true, () => false), new Promise((resolve9) => {
+      timer = setTimeout(() => resolve9(false), IMAP_LOGOUT_TIMEOUT_MS);
       timer.unref?.();
     })]);
     if (!closed)
@@ -25001,7 +25154,7 @@ async function withAbort(promise, signal) {
   signal?.throwIfAborted();
   if (!signal)
     return await promise;
-  return await new Promise((resolve8, reject) => {
+  return await new Promise((resolve9, reject) => {
     const onAbort = () => {
       signal.removeEventListener("abort", onAbort);
       reject(signal.reason ?? new Error("operation cancelled"));
@@ -25011,7 +25164,7 @@ async function withAbort(promise, signal) {
     });
     promise.then((value) => {
       signal.removeEventListener("abort", onAbort);
-      resolve8(value);
+      resolve9(value);
     }, (error) => {
       signal.removeEventListener("abort", onAbort);
       reject(error);
@@ -25994,7 +26147,7 @@ function toActivity2(entry) {
   };
 }
 function delay2(ms, signal) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     const finish = (error) => {
       if (settled)
@@ -26005,7 +26158,7 @@ function delay2(ms, signal) {
       if (error)
         reject(error);
       else
-        resolve8();
+        resolve9();
     };
     const abort = () => finish(signal?.reason ?? new Error("email wait cancelled"));
     const timer = setTimeout(() => finish(), ms);
@@ -27541,8 +27694,8 @@ var init_model_profiles = __esm(() => {
 });
 
 // src/agent-core/model-catalog.ts
-import { existsSync as existsSync12 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname7, join as join18 } from "path";
 async function buildModelCatalog(workspace, profiles = loadModelProfiles(workspace)) {
   const providers = [];
   const models = [];
@@ -28118,7 +28271,7 @@ async function fetchModelsDevCatalog(fetchImpl = globalThis.fetch, timeoutMs = M
 function readCachedModelsDevCatalog() {
   try {
     const path = modelsDevCachePath();
-    if (!existsSync12(path))
+    if (!existsSync13(path))
       return;
     ensurePrivateDirectory(dirname7(path), "model cache directory");
     ensurePrivateRegularFileIfExists(path, "models.dev cache");
@@ -28170,7 +28323,7 @@ function ensureConcrete(resolved) {
   return resolved;
 }
 function modelsDevCachePath() {
-  return join17(globalDataDir(), "cache", "models-dev.json");
+  return join18(globalDataDir(), "cache", "models-dev.json");
 }
 var DEFAULT_PROVIDER_ID = "default", OPENCODE_PROVIDER_ID, OPENCODE_DEFAULT_MODEL_ID, OPENCODE_PUBLIC_API_KEY, MODELS_DEV_URL = "https://models.dev/api.json", MODELS_DEV_CACHE_TTL_MS, MODELS_DEV_STALE_TTL_MS, MODELS_DEV_FETCH_TIMEOUT_MS = 4000, MODELS_DEV_MAX_BYTES, RECENT_MODEL_LIMIT = 12, modelsDevRefreshes;
 var init_model_catalog = __esm(() => {
@@ -30505,17 +30658,17 @@ var init_compaction = __esm(() => {
 });
 
 // src/agent-core/hooks/host.ts
-import { existsSync as existsSync13 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join19 } from "path";
 function hookConfigPaths(workspace) {
   if (false)
     ;
-  return [join18(localFaraiDir(), "hooks.json"), join18(workspace, ".farai", "hooks.json")];
+  return [join19(localFaraiDir(), "hooks.json"), join19(workspace, ".farai", "hooks.json")];
 }
 function loadHooks(workspace) {
   const hooks = [];
   for (const path of hookConfigPaths(workspace)) {
-    if (!existsSync13(path))
+    if (!existsSync14(path))
       continue;
     try {
       const parsed = JSON.parse(readBoundedFileTextSync(path, HOOK_CONFIG_MAX_BYTES, "hook config"));
@@ -30639,7 +30792,7 @@ class SubagentGate {
   idle() {
     if (this.active === 0 && this.queue.length === 0)
       return Promise.resolve();
-    return new Promise((resolve8) => this.idleResolvers.add(resolve8));
+    return new Promise((resolve9) => this.idleResolvers.add(resolve9));
   }
   async run(work, signal) {
     const release = await this.acquire(signal);
@@ -30651,13 +30804,13 @@ class SubagentGate {
     }
   }
   acquire(signal) {
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("subagent task cancelled before start"));
         return;
       }
       const waiter = {
-        resolve: resolve8,
+        resolve: resolve9,
         reject,
         ...signal ? {
           signal
@@ -30704,8 +30857,8 @@ class SubagentGate {
   notifyIdle() {
     if (this.active !== 0 || this.queue.length !== 0)
       return;
-    for (const resolve8 of this.idleResolvers)
-      resolve8();
+    for (const resolve9 of this.idleResolvers)
+      resolve9();
     this.idleResolvers.clear();
   }
 }
@@ -30719,10 +30872,10 @@ class SessionActor {
   run(work) {
     if (this.closed)
       return Promise.reject(new Error("Session actor is closed"));
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       this.queue.push({
         work,
-        resolve: (value) => resolve8(value),
+        resolve: (value) => resolve9(value),
         reject
       });
       this.drain();
@@ -30734,7 +30887,7 @@ class SessionActor {
   idle() {
     if (!this.running && this.queue.length === 0)
       return Promise.resolve();
-    return new Promise((resolve8) => this.idleResolvers.add(resolve8));
+    return new Promise((resolve9) => this.idleResolvers.add(resolve9));
   }
   close() {
     if (this.closed)
@@ -30767,8 +30920,8 @@ class SessionActor {
   resolveIdle() {
     if (this.running || this.queue.length > 0)
       return;
-    for (const resolve8 of this.idleResolvers)
-      resolve8();
+    for (const resolve9 of this.idleResolvers)
+      resolve9();
     this.idleResolvers.clear();
   }
 }
@@ -32882,7 +33035,7 @@ function rebuildFtsIndexes(db) {
 var KNOWLEDGE_SCHEMA_VERSION = 2;
 
 // src/agent-knowledge/store.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { Database as Database3 } from "bun:sqlite";
 
 class KnowledgeStore {
@@ -32891,7 +33044,7 @@ class KnowledgeStore {
     this.create = create;
   }
   static openIfExists(path) {
-    if (!existsSync14(path))
+    if (!existsSync15(path))
       return;
     const store = new KnowledgeStore(path);
     try {
@@ -33466,24 +33619,28 @@ var init_store = __esm(() => {
 });
 
 // src/agent-knowledge/paths.ts
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function knowledgeDbPath() {
-  return join19(localFaraiDir(), "knowledge.db");
+  return activeContentKnowledgePath() ?? legacyKnowledgeDbPath();
+}
+function legacyKnowledgeDbPath() {
+  return join20(localFaraiDir(), "knowledge.db");
 }
 function knowledgeRoot() {
-  return process.env.FARAI_KNOWLEDGE_DIR ?? join19(localFaraiDir(), "knowledge");
+  return process.env.FARAI_KNOWLEDGE_DIR ?? join20(localFaraiDir(), "knowledge");
 }
 function packsDir() {
-  return join19(knowledgeRoot(), "packs");
+  return join20(knowledgeRoot(), "packs");
 }
 function taxonomyDir() {
-  return join19(knowledgeRoot(), "taxonomy");
+  return join20(knowledgeRoot(), "taxonomy");
 }
 function cacheDir() {
-  return join19(localFaraiDir(), "knowledge-cache");
+  return join20(localFaraiDir(), "knowledge-cache");
 }
-var init_paths2 = __esm(() => {
+var init_paths3 = __esm(() => {
   init_config();
+  init_paths2();
 });
 
 // src/agent-core/model-pricing.ts
@@ -33517,14 +33674,14 @@ function nonNegative(value) {
 }
 
 // src/session-catalog.ts
-import { existsSync as existsSync15, readdirSync as readdirSync5, rmSync as rmSync2 } from "fs";
-import { join as join20, resolve as resolve8 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync5, rmSync as rmSync2 } from "fs";
+import { join as join21, resolve as resolve9 } from "path";
 function recordSessionLocation(session) {
   const directory = catalogDirectory();
   ensurePrivateDirectory(directory, "session catalog directory");
   const entry = {
     id: session.id,
-    workspace: resolve8(session.workspace),
+    workspace: resolve9(session.workspace),
     ...session.title ? {
       title: session.title
     } : {},
@@ -33533,13 +33690,13 @@ function recordSessionLocation(session) {
     } : {},
     updatedAt: session.updatedAt
   };
-  const path = join20(directory, `${session.id}.json`);
+  const path = join21(directory, `${session.id}.json`);
   ensurePrivateRegularFileIfExists(path, "session catalog entry");
   atomicWriteFile(path, `${JSON.stringify(entry)}
 `, 384);
 }
 function removeSessionLocation(sessionId) {
-  rmSync2(join20(catalogDirectory(), `${sessionId}.json`), {
+  rmSync2(join21(catalogDirectory(), `${sessionId}.json`), {
     force: true
   });
 }
@@ -33559,7 +33716,7 @@ function resolveSessionLocation(query) {
 }
 function listSessionLocations() {
   const directory = catalogDirectory();
-  if (!existsSync15(directory))
+  if (!existsSync16(directory))
     return [];
   try {
     ensurePrivateDirectory(directory, "session catalog directory");
@@ -33568,7 +33725,7 @@ function listSessionLocations() {
   }
   return readdirSync5(directory).filter((name) => name.endsWith(".json")).flatMap((name) => {
     try {
-      const path = join20(directory, name);
+      const path = join21(directory, name);
       ensurePrivateRegularFileIfExists(path, "session catalog entry");
       const value = JSON.parse(readBoundedFileTextSyncNoFollow(path, SESSION_CATALOG_ENTRY_MAX_BYTES, "session catalog entry"));
       if (typeof value.id !== "string" || typeof value.workspace !== "string" || typeof value.updatedAt !== "string")
@@ -33590,10 +33747,10 @@ function listSessionLocations() {
   }).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
 }
 function catalogDirectory() {
-  return join20(localFaraiDir(), "sessions");
+  return join21(localFaraiDir(), "sessions");
 }
 function sessionDatabaseExists(workspace) {
-  return existsSync15(join20(workspace, ".farai", "farai.db"));
+  return existsSync16(join21(workspace, ".farai", "farai.db"));
 }
 var SESSION_CATALOG_ENTRY_MAX_BYTES;
 var init_session_catalog = __esm(() => {
@@ -33629,7 +33786,7 @@ class SessionUserInputCoordinator {
         expiresAt
       } : {}
     };
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const detach = () => signal?.removeEventListener("abort", abort);
       const abort = () => {
         if (this.pending.get(sessionId)?.request.id !== request.id)
@@ -33646,7 +33803,7 @@ class SessionUserInputCoordinator {
         request,
         resolve: (answer) => {
           detach();
-          resolve9(answer);
+          resolve10(answer);
         },
         reject: (error) => {
           detach();
@@ -33979,7 +34136,7 @@ class ToolExecutionGate {
   idle() {
     if (this.states.size === 0)
       return Promise.resolve();
-    return new Promise((resolve9) => this.idleResolvers.add(resolve9));
+    return new Promise((resolve10) => this.idleResolvers.add(resolve10));
   }
   async run(key, parallel, fn, signal) {
     const release = await this.acquire(key, parallel ? "read" : "write", signal);
@@ -33991,7 +34148,7 @@ class ToolExecutionGate {
     }
   }
   acquire(key, mode, signal) {
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("tool gate acquisition cancelled"));
         return;
@@ -34004,7 +34161,7 @@ class ToolExecutionGate {
       this.states.set(key, state);
       const waiter = {
         mode,
-        resolve: resolve9,
+        resolve: resolve10,
         reject,
         ...signal ? {
           signal
@@ -34061,8 +34218,8 @@ class ToolExecutionGate {
     if (state.activeReaders === 0 && !state.activeWriter && state.queue.length === 0 && this.states.get(key) === state) {
       this.states.delete(key);
       if (this.states.size === 0) {
-        for (const resolve9 of this.idleResolvers)
-          resolve9();
+        for (const resolve10 of this.idleResolvers)
+          resolve10();
         this.idleResolvers.clear();
       }
     }
@@ -34109,7 +34266,7 @@ function abortablePromise(promise, signal) {
     return promise;
   if (signal.aborted)
     return Promise.reject(abortReason(signal));
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const cleanup = () => signal.removeEventListener("abort", onAbort);
     const onAbort = () => {
       cleanup();
@@ -34120,7 +34277,7 @@ function abortablePromise(promise, signal) {
     });
     promise.then((value) => {
       cleanup();
-      resolve9(value);
+      resolve10(value);
     }, (error) => {
       cleanup();
       reject(error);
@@ -34505,8 +34662,8 @@ var init_tool_call_journal = () => {};
 
 // src/agent-core/runtime.ts
 import { createHash as createHash9 } from "crypto";
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, realpathSync as realpathSync3 } from "fs";
-import { isAbsolute as isAbsolute6, join as join21, relative as relative7 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync6, realpathSync as realpathSync3 } from "fs";
+import { isAbsolute as isAbsolute7, join as join22, relative as relative7 } from "path";
 function assertProviderToolIndex2(index, max) {
   if (!Number.isInteger(index) || index < 0 || index >= max)
     throw new Error(`provider tool call index must be between 0 and ${max - 1}`);
@@ -34552,7 +34709,7 @@ class AgentRuntime {
     this.workspace = workspace;
     this.inheritConfig = options.inheritConfig !== false;
     const config = this.inheritConfig ? loadConfig(workspace) : {};
-    this.store = new SqliteStore(join21(workspace, ".farai"));
+    this.store = new SqliteStore(join22(workspace, ".farai"));
     this.toolCalls = new ToolCallJournal(this.store, (sessionId, type, payload) => this.event(sessionId, type, payload));
     this.knowledgeEnabled = options.enableKnowledge !== false;
     this.hooksEnabled = options.enableHooks !== false;
@@ -35374,16 +35531,16 @@ class AgentRuntime {
   }
   waitForSteering(sessionId) {
     let settled = false;
-    let resolve9;
+    let resolve10;
     const promise = new Promise((done) => {
-      resolve9 = done;
+      resolve10 = done;
     });
     const wake = () => {
       if (settled)
         return;
       settled = true;
       this.steeringWaiters.get(sessionId)?.delete(wake);
-      resolve9();
+      resolve10();
     };
     const waiters = this.steeringWaiters.get(sessionId) ?? new Set;
     waiters.add(wake);
@@ -35731,12 +35888,12 @@ class AgentRuntime {
       return {
         markdown
       };
-    const dir = join21(this.workspace, ".farai", "reports");
+    const dir = join22(this.workspace, ".farai", "reports");
     mkdirSync6(dir, {
       recursive: true
     });
     const stamp = new Date().toISOString().slice(0, 10);
-    const path = join21(dir, `${sessionId}-${stamp}.md`);
+    const path = join22(dir, `${sessionId}-${stamp}.md`);
     atomicWriteFile(path, markdown, 384);
     return {
       markdown,
@@ -37836,7 +37993,7 @@ This completion is already terminal and was delivered automatically. Do not call
             }
             if (entries.length === 0 || entries.some((entry) => !entry.running) || Date.now() - started >= timeoutMs)
               return entries;
-            await new Promise((resolve9) => setTimeout(resolve9, 200));
+            await new Promise((resolve10) => setTimeout(resolve10, 200));
           }
         },
         message: (childSessionId, text2) => {
@@ -37896,15 +38053,15 @@ This completion is already terminal and was delivered automatically. Do not call
           const root = (await runHostGit(this.workspace, ["rev-parse", "--show-toplevel"])).trim();
           if (realpathSync3(root) !== realpathSync3(this.workspace))
             throw new Error(`Farai workspace is not the Git repository root: ${root}`);
-          const worktreesRoot = join21(this.workspace, ".farai", "worktrees");
+          const worktreesRoot = join22(this.workspace, ".farai", "worktrees");
           mkdirSync6(worktreesRoot, {
             recursive: true
           });
-          const path = join21(worktreesRoot, safeName);
+          const path = join22(worktreesRoot, safeName);
           const registered = await registeredWorktree(this.workspace, path);
-          if (existsSync16(path) && !registered)
+          if (existsSync17(path) && !registered)
             throw new Error(`worktree path already exists but is not a registered Git worktree: ${path}`);
-          if (!existsSync16(path) && registered)
+          if (!existsSync17(path) && registered)
             throw new Error(`worktree registration exists but its directory is missing: ${path}; repair or prune it before re-entry`);
           if (registered) {
             if (ref || branch)
@@ -37954,9 +38111,9 @@ This completion is already terminal and was delivered automatically. Do not call
           if (current.workspace === this.workspace)
             throw new Error("session is not inside an isolated worktree");
           this.assertWorkspaceTransitionIdle(session.id);
-          const worktreesRoot = join21(this.workspace, ".farai", "worktrees");
+          const worktreesRoot = join22(this.workspace, ".farai", "worktrees");
           const managedPath = relative7(worktreesRoot, current.workspace);
-          if (!managedPath || managedPath.startsWith("..") || isAbsolute6(managedPath)) {
+          if (!managedPath || managedPath.startsWith("..") || isAbsolute7(managedPath)) {
             throw new Error(`refusing to leave an unmanaged worktree: ${current.workspace}`);
           }
           if (remove) {
@@ -38838,16 +38995,16 @@ function plannerRetryState(error, attempt, safeToReplay) {
 function abortableSleep(ms, signal) {
   if (signal?.aborted)
     return Promise.resolve();
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const cleanup = () => signal?.removeEventListener("abort", onAbort);
     const onAbort = () => {
       clearTimeout(timer);
       cleanup();
-      resolve9();
+      resolve10();
     };
     const timer = setTimeout(() => {
       cleanup();
-      resolve9();
+      resolve10();
     }, ms);
     signal?.addEventListener("abort", onAbort, {
       once: true
@@ -38897,18 +39054,18 @@ function shutdownGracePeriod(value) {
   return Math.max(0, value);
 }
 function waitForShutdownFinalization(finalization, gracePeriodMs) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       settled = true;
-      resolve9(false);
+      resolve10(false);
     }, gracePeriodMs);
     finalization.then(() => {
       if (settled)
         return;
       settled = true;
       clearTimeout(timer);
-      resolve9(true);
+      resolve10(true);
     }, (error) => {
       if (settled)
         return;
@@ -39035,7 +39192,7 @@ var init_runtime = __esm(() => {
   init_retry();
   init_reasoning_summary();
   init_store();
-  init_paths2();
+  init_paths3();
   init_session_catalog();
   init_session_user_input();
   init_tool_execution_control();
@@ -39086,37 +39243,796 @@ var init_branding = __esm(() => {
 `);
 });
 
-// src/agent-knowledge/pack.ts
-import { closeSync as closeSync4, existsSync as existsSync17, fsyncSync as fsyncSync2, lstatSync as lstatSync4, mkdirSync as mkdirSync7, openSync as openSync4, readdirSync as readdirSync6, renameSync as renameSync3, rmSync as rmSync3, writeSync } from "fs";
+// src/agent-core/semver.ts
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b)
+    return 0;
+  for (let index = 0;index < 3; index += 1) {
+    const delta = a.core[index] - b.core[index];
+    if (delta !== 0)
+      return delta < 0 ? -1 : 1;
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    if (a.prerelease.length === b.prerelease.length)
+      return 0;
+    return a.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0;index < length; index += 1) {
+    const aPart = a.prerelease[index];
+    const bPart = b.prerelease[index];
+    if (aPart === undefined || bPart === undefined)
+      return aPart === undefined ? -1 : 1;
+    if (aPart === bPart)
+      continue;
+    const aNumber = numericIdentifier(aPart);
+    const bNumber = numericIdentifier(bPart);
+    if (aNumber !== undefined && bNumber !== undefined)
+      return aNumber < bNumber ? -1 : 1;
+    if (aNumber !== undefined || bNumber !== undefined)
+      return aNumber !== undefined ? -1 : 1;
+    return aPart < bPart ? -1 : 1;
+  }
+  return 0;
+}
+function isSemver(value) {
+  return parseSemver(value) !== undefined;
+}
+function parseSemver(value) {
+  const match = value.trim().match(/^(?:v)?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/);
+  if (!match)
+    return;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split(".") ?? []
+  };
+}
+function numericIdentifier(value) {
+  if (!/^(0|[1-9]\d*)$/.test(value))
+    return;
+  return Number(value);
+}
+
+// src/agent-content/manifest.ts
+async function fetchContentManifest(manifestUrl, options = {}) {
+  const resolved = new URL(manifestUrl);
+  let parsed;
+  if (resolved.protocol === "file:") {
+    parsed = JSON.parse(await readBoundedFileText(resolved, CONTENT_MANIFEST_MAX_BYTES, "content manifest"));
+  } else {
+    if (resolved.protocol !== "https:")
+      throw new Error("content manifest must use https or file");
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), Math.max(1, options.timeoutMs ?? 5000));
+    timer.unref?.();
+    try {
+      const response = await (options.fetcher ?? fetch)(resolved, {
+        headers: {
+          accept: "application/json"
+        },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        await discardResponseBody(response);
+        throw new Error(`content manifest returned ${response.status}`);
+      }
+      parsed = await readBoundedResponseJson(response, CONTENT_MANIFEST_MAX_BYTES, "content manifest");
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return parseContentManifest(parsed, resolved);
+}
+function parseContentManifest(value, baseUrl) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("content manifest must be an object");
+  const record3 = value;
+  if (record3.schemaVersion !== CONTENT_MANIFEST_SCHEMA_VERSION)
+    throw new Error(`unsupported content manifest schema: ${String(record3.schemaVersion)}`);
+  if (typeof record3.contentVersion !== "string" || !CONTENT_VERSION_PATTERN.test(record3.contentVersion))
+    throw new Error("invalid content version");
+  if (typeof record3.generatedAt !== "string" || !Number.isFinite(Date.parse(record3.generatedAt)))
+    throw new Error("invalid content generatedAt");
+  const minFaraiVersion = optionalString2(record3.minFaraiVersion, 128, "minFaraiVersion");
+  if (minFaraiVersion && !isSemver(minFaraiVersion))
+    throw new Error("invalid content minFaraiVersion");
+  const releaseNotes = optionalString2(record3.releaseNotes, 4096, "releaseNotes");
+  const knowledge = artifact(record3.knowledge, baseUrl, "knowledge");
+  const skills = artifact(record3.skills, baseUrl, "skills");
+  return {
+    schemaVersion: 1,
+    contentVersion: record3.contentVersion,
+    generatedAt: new Date(record3.generatedAt).toISOString(),
+    ...minFaraiVersion ? {
+      minFaraiVersion
+    } : {},
+    ...releaseNotes ? {
+      releaseNotes
+    } : {},
+    ...knowledge ? {
+      knowledge
+    } : {},
+    ...skills ? {
+      skills
+    } : {}
+  };
+}
+function artifact(value, baseUrl, label) {
+  if (value === undefined)
+    return;
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} artifact must be an object`);
+  const record3 = value;
+  if (typeof record3.url !== "string" || !record3.url || record3.url.length > 2048)
+    throw new Error(`${label} artifact has an invalid url`);
+  const url = new URL(record3.url, baseUrl);
+  if (baseUrl.protocol === "https:" && url.protocol !== "https:")
+    throw new Error(`${label} artifact must use https when the manifest is remote`);
+  if (url.protocol !== "https:" && url.protocol !== "file:")
+    throw new Error(`${label} artifact must use https or file`);
+  if (typeof record3.sha256 !== "string" || !SHA256_PATTERN.test(record3.sha256))
+    throw new Error(`${label} artifact has an invalid sha256`);
+  if (!Number.isSafeInteger(record3.size) || Number(record3.size) < 1 || Number(record3.size) > 2147483648)
+    throw new Error(`${label} artifact has an invalid size`);
+  const schemaVersion = record3.schemaVersion === undefined ? undefined : Number.isSafeInteger(record3.schemaVersion) && Number(record3.schemaVersion) > 0 ? Number(record3.schemaVersion) : undefined;
+  if (record3.schemaVersion !== undefined && schemaVersion === undefined)
+    throw new Error(`${label} artifact has an invalid schemaVersion`);
+  return {
+    url: url.href,
+    sha256: record3.sha256,
+    size: Number(record3.size),
+    ...schemaVersion ? {
+      schemaVersion
+    } : {}
+  };
+}
+function optionalString2(value, maxLength, label) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string" || !value.trim() || value.length > maxLength)
+    throw new Error(`invalid content ${label}`);
+  return value.trim();
+}
+var CONTENT_MANIFEST_SCHEMA_VERSION = 1, CONTENT_MANIFEST_MAX_BYTES, DEFAULT_CONTENT_MANIFEST_URL = "https://github.com/pajarori/farai-data/releases/latest/download/manifest.json", CONTENT_VERSION_PATTERN, SHA256_PATTERN;
+var init_manifest = __esm(() => {
+  init_http_response();
+  init_file_read();
+  CONTENT_MANIFEST_MAX_BYTES = 256 * 1024;
+  CONTENT_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+  SHA256_PATTERN = /^[a-f0-9]{64}$/;
+});
+
+// src/agent-content/updater.ts
+var exports_updater = {};
+__export(exports_updater, {
+  rollbackContentUpdate: () => rollbackContentUpdate,
+  isContentVersionDismissed: () => isContentVersionDismissed,
+  dismissContentVersion: () => dismissContentVersion,
+  contentStatus: () => contentStatus,
+  checkContentUpdate: () => checkContentUpdate,
+  applyContentUpdate: () => applyContentUpdate,
+  CONTENT_UPDATE_TIMEOUT_MS: () => CONTENT_UPDATE_TIMEOUT_MS,
+  CONTENT_MANIFEST_CACHE_TTL_MS: () => CONTENT_MANIFEST_CACHE_TTL_MS
+});
 import { createHash as createHash10, randomUUID as randomUUID4 } from "crypto";
-import { join as join22 } from "path";
+import { closeSync as closeSync4, existsSync as existsSync18, lstatSync as lstatSync4, mkdirSync as mkdirSync7, openSync as openSync4, readSync as readSync2, readdirSync as readdirSync6, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync6, unlinkSync as unlinkSync6, writeSync } from "fs";
+import { dirname as dirname9, join as join23 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+async function checkContentUpdate(options = {}) {
+  const config = loadConfig(options.workspace);
+  const manifestUrl = options.manifestUrl ?? process.env.FARAI_CONTENT_MANIFEST_URL ?? config.updates?.contentManifestUrl ?? DEFAULT_CONTENT_MANIFEST_URL;
+  if (contentUpdateDisabled(config.updates?.contentEnabled))
+    return {
+      state: "disabled",
+      manifestUrl,
+      fromCache: false
+    };
+  const now = options.now ?? Date.now();
+  const cached = readManifestCache();
+  const cacheMatches = cached?.manifestUrl === manifestUrl;
+  let manifest;
+  let fromCache = false;
+  if (!options.force && cacheMatches && cached && isFresh(cached.checkedAt, now)) {
+    if (!cached.manifest)
+      return {
+        state: "error",
+        manifestUrl,
+        fromCache: true,
+        ...cached.error ? {
+          error: cached.error
+        } : {}
+      };
+    manifest = cached.manifest;
+    fromCache = true;
+  } else {
+    try {
+      manifest = await fetchContentManifest(manifestUrl, {
+        ...options.fetcher ? {
+          fetcher: options.fetcher
+        } : {},
+        timeoutMs: options.timeoutMs ?? CONTENT_UPDATE_TIMEOUT_MS
+      });
+      writeManifestCache({
+        checkedAt: now,
+        manifestUrl,
+        manifest
+      });
+    } catch (error) {
+      const message = errorMessage6(error);
+      if (cacheMatches && cached?.manifest) {
+        manifest = cached.manifest;
+        fromCache = true;
+        writeManifestCache({
+          checkedAt: now,
+          manifestUrl,
+          manifest,
+          error: message
+        });
+      } else {
+        writeManifestCache({
+          checkedAt: now,
+          manifestUrl,
+          error: message
+        });
+        return {
+          state: "error",
+          manifestUrl,
+          fromCache: false,
+          error: message
+        };
+      }
+    }
+  }
+  const active = readActiveContent();
+  if (!manifest || !manifest.knowledge && !manifest.skills)
+    return {
+      state: "unavailable",
+      manifestUrl,
+      fromCache,
+      ...active ? {
+        active
+      } : {},
+      ...manifest ? {
+        manifest
+      } : {}
+    };
+  if (manifest.minFaraiVersion && isSemver(manifest.minFaraiVersion) && compareSemver(FARAI_VERSION, manifest.minFaraiVersion) < 0) {
+    return {
+      state: "incompatible",
+      manifestUrl,
+      fromCache,
+      manifest,
+      ...active ? {
+        active
+      } : {}
+    };
+  }
+  if (!isNewerManifest(manifest, active))
+    return {
+      state: "up_to_date",
+      manifestUrl,
+      fromCache,
+      manifest,
+      ...active ? {
+        active
+      } : {}
+    };
+  return {
+    state: "update_available",
+    manifestUrl,
+    fromCache,
+    manifest,
+    ...active ? {
+      active
+    } : {}
+  };
+}
+async function applyContentUpdate(manifest, manifestUrl, options = {}) {
+  if (!manifest.knowledge && !manifest.skills)
+    throw new Error("content manifest has no artifacts");
+  ensureContentDirectories();
+  const release = acquireLock();
+  const stage = join23(contentVersionsDir(), `.staging-${process.pid}-${randomUUID4()}`);
+  const finalPath = contentVersionDir(manifest.contentVersion);
+  try {
+    mkdirSync7(stage, {
+      recursive: true,
+      mode: 448
+    });
+    ensurePrivateDirectory(stage, "content staging directory");
+    let knowledge = false;
+    let skills = false;
+    if (manifest.knowledge) {
+      const path = join23(stage, "knowledge.db");
+      await downloadArtifact(manifest.knowledge, path, options);
+      validateKnowledge(path, manifest.knowledge.schemaVersion);
+      knowledge = true;
+    }
+    if (manifest.skills) {
+      if (manifest.skills.size > CONTENT_SKILLS_MAX_BYTES)
+        throw new Error("skills artifact is too large");
+      const archive = join23(stage, "skills.tar.gz");
+      await downloadArtifact(manifest.skills, archive, options);
+      await extractSkills(archive, join23(stage, "skills"));
+      rmSync3(archive, {
+        force: true
+      });
+      skills = true;
+    }
+    atomicWriteFile(join23(stage, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, 384);
+    ensurePrivateRegularFileIfExists(join23(stage, "manifest.json"), "staged content manifest");
+    if (existsSync18(finalPath)) {
+      const existing = join23(finalPath, "manifest.json");
+      if (existsSync18(existing)) {
+        const current = parseStoredManifest(existing);
+        if (JSON.stringify(current) !== JSON.stringify(manifest))
+          throw new Error(`content version already exists with different metadata: ${manifest.contentVersion}`);
+        rmSync3(stage, {
+          recursive: true,
+          force: true
+        });
+      } else {
+        rmSync3(finalPath, {
+          recursive: true,
+          force: true
+        });
+        renameSync3(stage, finalPath);
+      }
+    } else {
+      renameSync3(stage, finalPath);
+    }
+    ensurePrivateDirectory(finalPath, "content version directory");
+    const previous = readActiveContent();
+    const pointer = {
+      schemaVersion: 1,
+      version: manifest.contentVersion,
+      generatedAt: manifest.generatedAt,
+      activatedAt: new Date().toISOString(),
+      manifestUrl,
+      ...previous && previous.version !== manifest.contentVersion ? {
+        previousVersion: previous.version
+      } : {},
+      knowledge,
+      skills
+    };
+    atomicWriteFile(contentActivePath(), `${JSON.stringify(pointer, null, 2)}
+`, 384);
+    syncDirectory(contentVersionsDir());
+    pruneVersions(pointer);
+    return {
+      version: pointer.version,
+      ...pointer.previousVersion ? {
+        previousVersion: pointer.previousVersion
+      } : {},
+      knowledge,
+      skills,
+      path: finalPath
+    };
+  } finally {
+    if (existsSync18(stage))
+      rmSync3(stage, {
+        recursive: true,
+        force: true
+      });
+    release();
+  }
+}
+function rollbackContentUpdate() {
+  ensureContentDirectories();
+  const release = acquireLock();
+  try {
+    const active = readActiveContent();
+    if (!active?.previousVersion)
+      throw new Error("no previous content version is available");
+    const previousPath = contentVersionDir(active.previousVersion);
+    if (!existsSync18(previousPath))
+      throw new Error(`previous content version is missing: ${active.previousVersion}`);
+    const manifest = parseStoredManifest(join23(previousPath, "manifest.json"));
+    const next = {
+      schemaVersion: 1,
+      version: active.previousVersion,
+      generatedAt: manifest.generatedAt,
+      activatedAt: new Date().toISOString(),
+      manifestUrl: active.manifestUrl,
+      previousVersion: active.version,
+      knowledge: Boolean(manifest.knowledge && existsSync18(join23(previousPath, "knowledge.db"))),
+      skills: Boolean(manifest.skills && existsSync18(join23(previousPath, "skills")))
+    };
+    atomicWriteFile(contentActivePath(), `${JSON.stringify(next, null, 2)}
+`, 384);
+    return {
+      version: next.version,
+      previousVersion: next.previousVersion,
+      knowledge: next.knowledge,
+      skills: next.skills,
+      path: previousPath
+    };
+  } finally {
+    release();
+  }
+}
+function contentStatus() {
+  ensureContentDirectories();
+  const active = readActiveContent();
+  const versions = readdirVersions();
+  const knowledgePath = activeContentKnowledgePath();
+  const skillsPath = activeContentSkillsDir();
+  return {
+    ...active ? {
+      active
+    } : {},
+    ...knowledgePath ? {
+      knowledgePath
+    } : {},
+    ...skillsPath ? {
+      skillsPath
+    } : {},
+    versions
+  };
+}
+function isContentVersionDismissed(version) {
+  try {
+    const value = JSON.parse(readBoundedFileTextSyncNoFollow(contentPreferencesPath(), CONTENT_PREFERENCES_MAX_BYTES, "content preferences"));
+    return value.dismissedVersion === version;
+  } catch {
+    return false;
+  }
+}
+function dismissContentVersion(version) {
+  ensureContentDirectories();
+  atomicWriteFile(contentPreferencesPath(), `${JSON.stringify({
+    dismissedVersion: version
+  })}
+`, 384);
+}
+function contentUpdateDisabled(configured) {
+  if (configured === false)
+    return true;
+  return [process.env.FARAI_DISABLE_CONTENT_UPDATE, process.env.FARAI_DISABLE_UPDATE_CHECK].some((value) => value === "1" || value?.toLowerCase() === "true" || value?.toLowerCase() === "yes");
+}
+function isNewerManifest(manifest, active) {
+  if (!active)
+    return true;
+  if (manifest.contentVersion === active.version)
+    return false;
+  const generated = Date.parse(manifest.generatedAt);
+  const activeGenerated = Date.parse(active.generatedAt);
+  if (Number.isFinite(generated) && Number.isFinite(activeGenerated))
+    return generated > activeGenerated;
+  return manifest.contentVersion > active.version;
+}
+function readManifestCache() {
+  try {
+    ensureContentDirectories();
+    const parsed = JSON.parse(readBoundedFileTextSyncNoFollow(contentManifestCachePath(), CONTENT_MANIFEST_MAX_BYTES * 2, "content manifest cache"));
+    if (typeof parsed.checkedAt !== "number" || !Number.isFinite(parsed.checkedAt) || typeof parsed.manifestUrl !== "string" || !parsed.manifestUrl)
+      return;
+    const manifest = parsed.manifest ? parseContentManifest(parsed.manifest, new URL(parsed.manifestUrl)) : undefined;
+    const error = typeof parsed.error === "string" && parsed.error ? parsed.error : undefined;
+    if (!manifest && !error)
+      return;
+    return {
+      checkedAt: parsed.checkedAt,
+      manifestUrl: parsed.manifestUrl,
+      ...manifest ? {
+        manifest
+      } : {},
+      ...error ? {
+        error
+      } : {}
+    };
+  } catch {
+    return;
+  }
+}
+function writeManifestCache(cache) {
+  try {
+    ensureContentDirectories();
+    atomicWriteFile(contentManifestCachePath(), `${JSON.stringify(cache)}
+`, 384);
+  } catch {}
+}
+function isFresh(checkedAt, now) {
+  const age = now - checkedAt;
+  return age >= 0 && age < CONTENT_MANIFEST_CACHE_TTL_MS;
+}
+function acquireLock() {
+  const path = contentLockPath();
+  ensureContentDirectories();
+  try {
+    const descriptor = openSync4(path, "wx", 384);
+    try {
+      writeSync(descriptor, JSON.stringify({
+        pid: process.pid,
+        createdAt: Date.now()
+      }));
+    } finally {
+      closeSync4(descriptor);
+    }
+    cleanupStagingDirectories();
+    return () => {
+      try {
+        unlinkSync6(path);
+      } catch {}
+    };
+  } catch (error) {
+    if (!isAlreadyExists(error) || !staleLock(path))
+      throw new Error("another farai content update is already running");
+    try {
+      unlinkSync6(path);
+    } catch {
+      throw new Error("another farai content update is already running");
+    }
+    return acquireLock();
+  }
+}
+function staleLock(path) {
+  try {
+    const stats = statSync6(path);
+    const parsed = JSON.parse(readBoundedFileTextSyncNoFollow(path, 4 * 1024, "content update lock"));
+    if (typeof parsed.pid === "number" && parsed.pid > 0) {
+      try {
+        process.kill(parsed.pid, 0);
+        return false;
+      } catch (error) {
+        if (!isNoSuchProcess(error))
+          return false;
+      }
+    }
+    return Date.now() - stats.mtimeMs >= CONTENT_LOCK_STALE_MS || typeof parsed.pid === "number";
+  } catch {
+    return true;
+  }
+}
+function cleanupStagingDirectories() {
+  for (const entry of readdirSync6(contentVersionsDir())) {
+    if (!entry.startsWith(".staging-"))
+      continue;
+    try {
+      rmSync3(join23(contentVersionsDir(), entry), {
+        recursive: true,
+        force: true
+      });
+    } catch {}
+  }
+}
+async function downloadArtifact(artifact2, destination, options) {
+  if (artifact2.size > CONTENT_ARTIFACT_MAX_BYTES)
+    throw new Error("content artifact is too large");
+  const url = new URL(artifact2.url);
+  mkdirSync7(dirname9(destination), {
+    recursive: true,
+    mode: 448
+  });
+  let bytes;
+  if (url.protocol === "file:") {
+    const source = Bun.file(url);
+    const sourcePath = fileURLToPath2(url);
+    const stats = lstatSync4(sourcePath);
+    if (!stats.isFile())
+      throw new Error("content artifact file must be a regular file");
+    if (stats.size !== artifact2.size)
+      throw new Error(`content artifact size mismatch: expected ${artifact2.size}, received ${stats.size}`);
+    await Bun.write(destination, source);
+    bytes = stats.size;
+  } else {
+    if (url.protocol !== "https:")
+      throw new Error("content artifact must use https or file");
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), Math.max(1, options.timeoutMs ?? CONTENT_UPDATE_TIMEOUT_MS));
+    timer.unref?.();
+    let descriptor;
+    try {
+      const response = await (options.fetcher ?? fetch)(url, {
+        signal: controller.signal
+      });
+      if (!response.ok || !response.body) {
+        try {
+          await response.body?.cancel();
+        } catch {}
+        throw new Error(`content artifact returned ${response.status}`);
+      }
+      const declared = Number(response.headers.get("content-length"));
+      if (Number.isSafeInteger(declared) && declared !== artifact2.size)
+        throw new Error(`content artifact size mismatch: expected ${artifact2.size}, received ${declared}`);
+      descriptor = openSync4(destination, "wx", 384);
+      const reader = response.body.getReader();
+      bytes = 0;
+      let completed = false;
+      try {
+        for (;; ) {
+          const next = await reader.read();
+          if (next.done) {
+            completed = true;
+            break;
+          }
+          bytes += next.value.byteLength;
+          if (bytes > artifact2.size)
+            throw new Error("content artifact exceeded declared size");
+          writeSync(descriptor, next.value);
+        }
+      } finally {
+        if (!completed)
+          reader.cancel().catch(() => {
+            return;
+          });
+        reader.releaseLock();
+      }
+      closeSync4(descriptor);
+      descriptor = undefined;
+    } finally {
+      clearTimeout(timer);
+      if (descriptor !== undefined)
+        try {
+          closeSync4(descriptor);
+        } catch {}
+    }
+  }
+  if (bytes !== artifact2.size)
+    throw new Error(`content artifact size mismatch: expected ${artifact2.size}, received ${bytes}`);
+  const digest2 = hashFile(destination);
+  if (digest2 !== artifact2.sha256)
+    throw new Error(`content artifact checksum mismatch for ${url.href}`);
+  ensurePrivateRegularFileIfExists(destination, "downloaded content artifact");
+}
+function validateKnowledge(path, schemaVersion) {
+  ensurePrivateSqlitePath(path, "staged knowledge database");
+  if (schemaVersion !== undefined && schemaVersion !== KNOWLEDGE_SCHEMA_VERSION)
+    throw new Error(`unsupported knowledge schema: ${schemaVersion}`);
+  const store = KnowledgeStore.openIfExists(path);
+  if (!store)
+    throw new Error("staged knowledge database could not be opened");
+  try {
+    const integrity = store.verifyIntegrity();
+    if (!integrity.ok)
+      throw new Error(`staged knowledge database failed integrity: ${integrity.issues.map((issue) => `${issue.kind}=${issue.count}`).join(", ")}`);
+  } finally {
+    store.close();
+  }
+}
+async function extractSkills(archive, destination) {
+  const listing = await spawnTar(["-tzf", archive]);
+  if (Buffer.byteLength(listing, "utf8") > CONTENT_SKILLS_LISTING_MAX_BYTES)
+    throw new Error("skills archive listing is too large");
+  const listingEntries = listing.split(/\r?\n/).map((item) => item.trim()).filter(Boolean);
+  if (listingEntries.length > CONTENT_SKILLS_MAX_ENTRIES)
+    throw new Error("skills archive contains too many entries");
+  for (const entry of listingEntries) {
+    if (entry.startsWith("/") || entry.split("/").includes("..") || entry.includes("\\"))
+      throw new Error("skills archive contains an unsafe path");
+  }
+  mkdirSync7(destination, {
+    recursive: true,
+    mode: 448
+  });
+  await spawnTar(["-xzf", archive, "-C", destination]);
+  const extractedEntries = [...walk(destination)];
+  if (extractedEntries.some((path) => lstatSync4(path).isSymbolicLink()))
+    throw new Error("skills archive contains a symbolic link");
+  if (!extractedEntries.some((path) => path.endsWith("/SKILL.md")))
+    throw new Error("skills archive contains no skills");
+}
+async function spawnTar(args) {
+  const proc = Bun.spawn(["tar", ...args], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
+  if (code !== 0)
+    throw new Error(`skills archive operation failed${stderr.trim() ? `: ${stderr.trim()}` : ""}`);
+  return stdout;
+}
+function* walk(root) {
+  const entries = readdirSync6(root).sort();
+  for (const entry of entries) {
+    const path = join23(root, entry);
+    const stat = lstatSync4(path);
+    yield path;
+    if (stat.isDirectory())
+      yield* walk(path);
+  }
+}
+function hashFile(path) {
+  const descriptor = openSync4(path, "r");
+  const hash = createHash10("sha256");
+  const buffer = Buffer.allocUnsafe(64 * 1024);
+  try {
+    for (;; ) {
+      const count2 = readSync2(descriptor, buffer, 0, buffer.length, null);
+      if (count2 === 0)
+        break;
+      hash.update(buffer.subarray(0, count2));
+    }
+    return hash.digest("hex");
+  } finally {
+    closeSync4(descriptor);
+  }
+}
+function parseStoredManifest(path) {
+  ensurePrivateRegularFileIfExists(path, "stored content manifest");
+  const raw = JSON.parse(readBoundedFileTextSyncNoFollow(path, CONTENT_MANIFEST_MAX_BYTES, "stored content manifest"));
+  return parseContentManifest(raw, new URL("file:///stored/manifest.json"));
+}
+function pruneVersions(active) {
+  const keep = new Set([active.version, active.previousVersion].filter((value) => Boolean(value)));
+  for (const version of readdirVersions()) {
+    if (keep.has(version))
+      continue;
+    try {
+      rmSync3(contentVersionDir(version), {
+        recursive: true,
+        force: true
+      });
+    } catch {}
+  }
+}
+function readdirVersions() {
+  try {
+    return readdirSync6(contentVersionsDir()).sort().filter((entry) => !entry.startsWith(".") && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(entry));
+  } catch {
+    return [];
+  }
+}
+function errorMessage6(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isAlreadyExists(error) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === "EEXIST");
+}
+function isNoSuchProcess(error) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === "ESRCH");
+}
+var CONTENT_MANIFEST_CACHE_TTL_MS, CONTENT_UPDATE_TIMEOUT_MS = 8000, CONTENT_ARTIFACT_MAX_BYTES = 2147483648, CONTENT_SKILLS_MAX_BYTES, CONTENT_SKILLS_MAX_ENTRIES = 8192, CONTENT_SKILLS_LISTING_MAX_BYTES, CONTENT_LOCK_STALE_MS, CONTENT_PREFERENCES_MAX_BYTES;
+var init_updater = __esm(() => {
+  init_version();
+  init_config();
+  init_atomic_file();
+  init_private_path();
+  init_file_read();
+  init_store();
+  init_paths2();
+  init_manifest();
+  CONTENT_MANIFEST_CACHE_TTL_MS = 20 * 60 * 60 * 1000;
+  CONTENT_SKILLS_MAX_BYTES = 256 * 1024 * 1024;
+  CONTENT_SKILLS_LISTING_MAX_BYTES = 4 * 1024 * 1024;
+  CONTENT_LOCK_STALE_MS = 15 * 60 * 1000;
+  CONTENT_PREFERENCES_MAX_BYTES = 32 * 1024;
+});
+
+// src/agent-knowledge/pack.ts
+import { closeSync as closeSync5, existsSync as existsSync19, fsyncSync as fsyncSync2, lstatSync as lstatSync5, mkdirSync as mkdirSync8, openSync as openSync5, readdirSync as readdirSync7, renameSync as renameSync4, rmSync as rmSync4, writeSync as writeSync2 } from "fs";
+import { createHash as createHash11, randomUUID as randomUUID5 } from "crypto";
+import { join as join24 } from "path";
 function packDir(meta) {
   assertPackPathPart(meta.id, "knowledge pack id");
   assertPackPathPart(meta.pin, "knowledge pack pin");
-  return join22(packsDir(), `${meta.id}@${meta.pin.slice(0, 12)}`);
+  return join24(packsDir(), `${meta.id}@${meta.pin.slice(0, 12)}`);
 }
 function writePack(meta, records, entities) {
   const root = packsDir();
   ensurePrivateDirectory(root, "knowledge pack directory");
   const dir = packDir(meta);
-  const temporary = `${dir}.tmp-${process.pid}-${randomUUID4()}`;
-  mkdirSync7(temporary, {
+  const temporary = `${dir}.tmp-${process.pid}-${randomUUID5()}`;
+  mkdirSync8(temporary, {
     mode: 448
   });
   try {
-    atomicWriteFile(join22(temporary, "meta.json"), `${JSON.stringify(meta, null, 2)}
+    atomicWriteFile(join24(temporary, "meta.json"), `${JSON.stringify(meta, null, 2)}
 `, 384);
-    writeJsonl(join22(temporary, "records.jsonl"), records, "knowledge records");
-    writeJsonl(join22(temporary, "entities.jsonl"), entities, "knowledge entities");
+    writeJsonl(join24(temporary, "records.jsonl"), records, "knowledge records");
+    writeJsonl(join24(temporary, "entities.jsonl"), entities, "knowledge entities");
     if (realDirectoryExists(dir, "knowledge pack"))
-      rmSync3(dir, {
+      rmSync4(dir, {
         recursive: true,
         force: true
       });
-    renameSync3(temporary, dir);
+    renameSync4(temporary, dir);
     syncDirectory(root);
   } catch (error) {
-    rmSync3(temporary, {
+    rmSync4(temporary, {
       recursive: true,
       force: true
     });
@@ -39126,19 +40042,19 @@ function writePack(meta, records, entities) {
 }
 function listPacks() {
   const root = packsDir();
-  if (!existsSync17(root))
+  if (!existsSync19(root))
     return [];
   assertRealDirectory(root, "knowledge pack directory");
-  const entries = readdirSync6(root);
+  const entries = readdirSync7(root);
   if (entries.length > PACK_DIRECTORY_MAX_COUNT)
     throw new Error(`knowledge pack directory exceeded ${PACK_DIRECTORY_MAX_COUNT} entries`);
   const out = [];
   for (const entry of entries) {
-    const dir = join22(root, entry);
+    const dir = join24(root, entry);
     try {
       assertRealDirectory(dir, "knowledge pack");
-      const metaPath = join22(dir, "meta.json");
-      if (!existsSync17(metaPath))
+      const metaPath = join24(dir, "meta.json");
+      if (!existsSync19(metaPath))
         continue;
       const meta = JSON.parse(readBoundedFileTextSyncNoFollow(metaPath, PACK_META_MAX_BYTES, "knowledge pack metadata"));
       if (!validPackMeta(meta))
@@ -39162,14 +40078,14 @@ function latestPacks() {
 }
 function readRecords(dir) {
   assertRealDirectory(dir, "knowledge pack");
-  return readJsonl(join22(dir, "records.jsonl"), "knowledge records");
+  return readJsonl(join24(dir, "records.jsonl"), "knowledge records");
 }
 function readEntities(dir) {
   assertRealDirectory(dir, "knowledge pack");
-  return readJsonl(join22(dir, "entities.jsonl"), "knowledge entities");
+  return readJsonl(join24(dir, "entities.jsonl"), "knowledge entities");
 }
 function readJsonl(path, label) {
-  if (!existsSync17(path))
+  if (!existsSync19(path))
     return [];
   const out = [];
   forEachFileLineSync(path, {
@@ -39190,7 +40106,7 @@ function readJsonl(path, label) {
   return out;
 }
 function writeJsonl(path, values, label) {
-  const descriptor = openSync4(path, "wx", 384);
+  const descriptor = openSync5(path, "wx", 384);
   let totalBytes = 0;
   try {
     for (const value of values) {
@@ -39203,7 +40119,7 @@ function writeJsonl(path, values, label) {
         throw new Error(`${label} exceeded ${PACK_JSONL_MAX_BYTES} bytes`);
       let offset = 0;
       while (offset < line.byteLength) {
-        const written = writeSync(descriptor, line, offset, line.byteLength - offset);
+        const written = writeSync2(descriptor, line, offset, line.byteLength - offset);
         if (written <= 0)
           throw new Error(`${label} write made no progress`);
         offset += written;
@@ -39211,7 +40127,7 @@ function writeJsonl(path, values, label) {
     }
     fsyncSync2(descriptor);
   } finally {
-    closeSync4(descriptor);
+    closeSync5(descriptor);
   }
 }
 function validPackMeta(value) {
@@ -39222,21 +40138,21 @@ function assertPackPathPart(value, label) {
     throw new Error(`${label} is invalid`);
 }
 function realDirectoryExists(path, label) {
-  if (!existsSync17(path))
+  if (!existsSync19(path))
     return false;
   assertRealDirectory(path, label);
   return true;
 }
 function assertRealDirectory(path, label) {
-  const stat = lstatSync4(path);
+  const stat = lstatSync5(path);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw new Error(`${label} must be a real directory`);
 }
 function recordId(pack, pin, discriminator) {
-  return createHash10("sha256").update(`${pack}\x00${pin}\x00${discriminator}`).digest("hex").slice(0, 16);
+  return createHash11("sha256").update(`${pack}\x00${pin}\x00${discriminator}`).digest("hex").slice(0, 16);
 }
 function sourceHash(body) {
-  return `sha256:${createHash10("sha256").update(body).digest("hex")}`;
+  return `sha256:${createHash11("sha256").update(body).digest("hex")}`;
 }
 function extractEntities(recordId2, text2) {
   const found = new Set;
@@ -39265,7 +40181,7 @@ var init_pack = __esm(() => {
   init_atomic_file();
   init_private_path();
   init_file_read();
-  init_paths2();
+  init_paths3();
   PACK_META_MAX_BYTES = 1024 * 1024;
   PACK_JSONL_MAX_BYTES = 256 * 1024 * 1024;
   PACK_LINE_MAX_BYTES = 64 * 1024 * 1024;
@@ -39289,34 +40205,34 @@ var init_pack = __esm(() => {
 });
 
 // src/agent-knowledge/ingest/taxonomy-pack.ts
-import { closeSync as closeSync5, existsSync as existsSync18, fsyncSync as fsyncSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync8, openSync as openSync5, readdirSync as readdirSync7, renameSync as renameSync4, rmSync as rmSync4, writeSync as writeSync2 } from "fs";
-import { randomUUID as randomUUID5 } from "crypto";
-import { join as join23 } from "path";
+import { closeSync as closeSync6, existsSync as existsSync20, fsyncSync as fsyncSync3, lstatSync as lstatSync6, mkdirSync as mkdirSync9, openSync as openSync6, readdirSync as readdirSync8, renameSync as renameSync5, rmSync as rmSync5, writeSync as writeSync3 } from "fs";
+import { randomUUID as randomUUID6 } from "crypto";
+import { join as join25 } from "path";
 function writeTaxonomy(meta, nodes, edges) {
   assertPathPart(meta.id, "taxonomy id");
   assertPathPart(meta.pin, "taxonomy pin");
   const root = taxonomyDir();
   ensurePrivateDirectory(root, "knowledge taxonomy directory");
-  const dir = join23(root, `${meta.id}@${meta.pin}`);
-  const temporary = `${dir}.tmp-${process.pid}-${randomUUID5()}`;
-  mkdirSync8(temporary, {
+  const dir = join25(root, `${meta.id}@${meta.pin}`);
+  const temporary = `${dir}.tmp-${process.pid}-${randomUUID6()}`;
+  mkdirSync9(temporary, {
     recursive: true,
     mode: 448
   });
   try {
-    atomicWriteFile(join23(temporary, "meta.json"), `${JSON.stringify(meta, null, 2)}
+    atomicWriteFile(join25(temporary, "meta.json"), `${JSON.stringify(meta, null, 2)}
 `, 384);
-    writeJsonl2(join23(temporary, "nodes.jsonl"), nodes, "taxonomy nodes");
-    writeJsonl2(join23(temporary, "edges.jsonl"), edges, "taxonomy edges");
+    writeJsonl2(join25(temporary, "nodes.jsonl"), nodes, "taxonomy nodes");
+    writeJsonl2(join25(temporary, "edges.jsonl"), edges, "taxonomy edges");
     if (realDirectoryExists2(dir, "knowledge taxonomy"))
-      rmSync4(dir, {
+      rmSync5(dir, {
         recursive: true,
         force: true
       });
-    renameSync4(temporary, dir);
+    renameSync5(temporary, dir);
     syncDirectory(root);
   } catch (error) {
-    rmSync4(temporary, {
+    rmSync5(temporary, {
       recursive: true,
       force: true
     });
@@ -39325,7 +40241,7 @@ function writeTaxonomy(meta, nodes, edges) {
   return dir;
 }
 function writeJsonl2(path, values, label) {
-  const descriptor = openSync5(path, "wx", 384);
+  const descriptor = openSync6(path, "wx", 384);
   let totalBytes = 0;
   try {
     for (const value of values) {
@@ -39338,7 +40254,7 @@ function writeJsonl2(path, values, label) {
         throw new Error(`${label} exceeded ${TAXONOMY_JSONL_MAX_BYTES} bytes`);
       let offset = 0;
       while (offset < line.byteLength) {
-        const written = writeSync2(descriptor, line, offset, line.byteLength - offset);
+        const written = writeSync3(descriptor, line, offset, line.byteLength - offset);
         if (written <= 0)
           throw new Error(`${label} write made no progress`);
         offset += written;
@@ -39346,24 +40262,24 @@ function writeJsonl2(path, values, label) {
     }
     fsyncSync3(descriptor);
   } finally {
-    closeSync5(descriptor);
+    closeSync6(descriptor);
   }
 }
 function listTaxonomies() {
   const root = taxonomyDir();
-  if (!existsSync18(root))
+  if (!existsSync20(root))
     return [];
   assertRealDirectory2(root, "knowledge taxonomy directory");
-  const entries = readdirSync7(root);
+  const entries = readdirSync8(root);
   if (entries.length > TAXONOMY_DIRECTORY_MAX_COUNT)
     throw new Error(`knowledge taxonomy directory exceeded ${TAXONOMY_DIRECTORY_MAX_COUNT} entries`);
   const out = [];
   for (const entry of entries) {
-    const dir = join23(root, entry);
+    const dir = join25(root, entry);
     try {
       assertRealDirectory2(dir, "knowledge taxonomy");
-      const metaPath = join23(dir, "meta.json");
-      if (!existsSync18(metaPath))
+      const metaPath = join25(dir, "meta.json");
+      if (!existsSync20(metaPath))
         continue;
       const meta = JSON.parse(readBoundedFileTextSyncNoFollow(metaPath, TAXONOMY_META_MAX_BYTES, "taxonomy metadata"));
       if (typeof meta?.id !== "string" || typeof meta.pin !== "string" || typeof meta.retrievedAt !== "string")
@@ -39387,14 +40303,14 @@ function latestTaxonomies() {
 }
 function readNodes(dir) {
   assertRealDirectory2(dir, "knowledge taxonomy");
-  return readJsonl2(join23(dir, "nodes.jsonl"));
+  return readJsonl2(join25(dir, "nodes.jsonl"));
 }
 function readEdges(dir) {
   assertRealDirectory2(dir, "knowledge taxonomy");
-  return readJsonl2(join23(dir, "edges.jsonl"));
+  return readJsonl2(join25(dir, "edges.jsonl"));
 }
 function readJsonl2(path) {
-  if (!existsSync18(path))
+  if (!existsSync20(path))
     return [];
   const out = [];
   forEachFileLineSync(path, {
@@ -39419,19 +40335,19 @@ function assertPathPart(value, label) {
     throw new Error(`${label} is invalid`);
 }
 function realDirectoryExists2(path, label) {
-  if (!existsSync18(path))
+  if (!existsSync20(path))
     return false;
   assertRealDirectory2(path, label);
   return true;
 }
 function assertRealDirectory2(path, label) {
-  const stat = lstatSync5(path);
+  const stat = lstatSync6(path);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw new Error(`${label} must be a real directory`);
 }
 var TAXONOMY_META_MAX_BYTES, TAXONOMY_JSONL_MAX_BYTES, TAXONOMY_LINE_MAX_BYTES, TAXONOMY_ENTRY_MAX_COUNT = 1e6, TAXONOMY_DIRECTORY_MAX_COUNT = 4096;
 var init_taxonomy_pack = __esm(() => {
-  init_paths2();
+  init_paths3();
   init_file_read();
   init_atomic_file();
   init_private_path();
@@ -39474,16 +40390,16 @@ var init_http2 = __esm(() => {
 });
 
 // src/agent-knowledge/ingest/enrichment.ts
-import { createReadStream, existsSync as existsSync19 } from "fs";
+import { createReadStream, existsSync as existsSync21 } from "fs";
 import { open as open3, rename, unlink as unlink2 } from "fs/promises";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import { Writable } from "stream";
 import { pipeline } from "stream/promises";
 import { StringDecoder as StringDecoder3 } from "string_decoder";
 import { createGunzip } from "zlib";
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 function enrichmentDir() {
-  return join24(knowledgeRoot(), "enrichment");
+  return join26(knowledgeRoot(), "enrichment");
 }
 async function ingestEnrichment() {
   const map = new Map;
@@ -39547,8 +40463,8 @@ async function ingestEnrichment() {
   };
 }
 function readEnrichment() {
-  const path = join24(enrichmentDir(), "enrichment.jsonl");
-  if (!existsSync19(path))
+  const path = join26(enrichmentDir(), "enrichment.jsonl");
+  if (!existsSync21(path))
     return [];
   const out = [];
   forEachFileLineSync(path, {
@@ -39569,7 +40485,7 @@ function readEnrichment() {
   return out;
 }
 async function forEachEpssLine(dir, consume) {
-  const archive = join24(dir, `.epss-${randomUUID6()}.csv.gz`);
+  const archive = join26(dir, `.epss-${randomUUID7()}.csv.gz`);
   try {
     await downloadKnowledgeFile(EPSS_URL, archive, EPSS_GZIP_MAX_BYTES, "epss archive");
     await pipeline(createReadStream(archive), createGunzip(), new BoundedLineSink(EPSS_CSV_MAX_BYTES, EPSS_LINE_MAX_BYTES, consume));
@@ -39580,8 +40496,8 @@ async function forEachEpssLine(dir, consume) {
   }
 }
 async function writeEnrichmentRows(dir, rows) {
-  const output = join24(dir, "enrichment.jsonl");
-  const temporary = join24(dir, `.enrichment-${randomUUID6()}.jsonl`);
+  const output = join26(dir, "enrichment.jsonl");
+  const temporary = join26(dir, `.enrichment-${randomUUID7()}.jsonl`);
   let file;
   try {
     file = await open3(temporary, "wx", 384);
@@ -39642,7 +40558,7 @@ function recordValue2(value) {
 }
 var KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", EPSS_URL = "https://epss.empiricalsecurity.com/epss_scores-current.csv.gz", KEV_MAX_BYTES, EPSS_GZIP_MAX_BYTES, EPSS_CSV_MAX_BYTES, EPSS_LINE_MAX_BYTES, OUTPUT_CHUNK_BYTES, ENRICHMENT_FILE_MAX_BYTES, KEV_ENTRY_MAX_COUNT = 1e5, ENRICHMENT_ROW_MAX_COUNT = 1e6, BoundedLineSink;
 var init_enrichment = __esm(() => {
-  init_paths2();
+  init_paths3();
   init_http2();
   init_file_read();
   init_private_path();
@@ -39699,18 +40615,18 @@ var init_enrichment = __esm(() => {
 });
 
 // src/agent-knowledge/build.ts
-import { createHash as createHash11, randomUUID as randomUUID7 } from "crypto";
-import { mkdirSync as mkdirSync9, renameSync as renameSync5, rmSync as rmSync5 } from "fs";
-import { dirname as dirname9 } from "path";
+import { createHash as createHash12, randomUUID as randomUUID8 } from "crypto";
+import { mkdirSync as mkdirSync10, renameSync as renameSync6, rmSync as rmSync6 } from "fs";
+import { dirname as dirname10 } from "path";
 function buildKnowledgeDb(options = {}) {
-  const path = options.path ?? knowledgeDbPath();
-  const temporary = `${path}.tmp-${process.pid}-${randomUUID7()}`;
-  mkdirSync9(dirname9(path), {
+  const path = options.path ?? legacyKnowledgeDbPath();
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID8()}`;
+  mkdirSync10(dirname10(path), {
     recursive: true,
     mode: 448
   });
   if (options.path === undefined)
-    ensurePrivateDirectory(dirname9(path), "farai home directory");
+    ensurePrivateDirectory(dirname10(path), "farai home directory");
   ensurePrivateRegularFileIfExists(path, "knowledge database");
   const store = new KnowledgeStore(temporary, true);
   const db = store.writable();
@@ -39767,18 +40683,18 @@ function buildKnowledgeDb(options = {}) {
     const actualEdges = rowCount(db, "kb_edges");
     store.close();
     ensurePrivateSqlitePath(temporary, "staged knowledge database");
-    rmSync5(`${temporary}-wal`, {
+    rmSync6(`${temporary}-wal`, {
       force: true
     });
-    rmSync5(`${temporary}-shm`, {
+    rmSync6(`${temporary}-shm`, {
       force: true
     });
-    rmSync5(`${temporary}-journal`, {
+    rmSync6(`${temporary}-journal`, {
       force: true
     });
-    renameSync5(temporary, path);
+    renameSync6(temporary, path);
     ensurePrivateRegularFileIfExists(path, "knowledge database");
-    syncDirectory(dirname9(path));
+    syncDirectory(dirname10(path));
     return {
       path,
       packs: packs.length,
@@ -39793,16 +40709,16 @@ function buildKnowledgeDb(options = {}) {
     try {
       store.close();
     } catch {}
-    rmSync5(temporary, {
+    rmSync6(temporary, {
       force: true
     });
-    rmSync5(`${temporary}-wal`, {
+    rmSync6(`${temporary}-wal`, {
       force: true
     });
-    rmSync5(`${temporary}-shm`, {
+    rmSync6(`${temporary}-shm`, {
       force: true
     });
-    rmSync5(`${temporary}-journal`, {
+    rmSync6(`${temporary}-journal`, {
       force: true
     });
     throw error;
@@ -39826,7 +40742,7 @@ function trackDuplicate(groups, record3) {
   const normalized = record3.answer.replace(/\s+/g, " ").trim().toLowerCase();
   if (normalized.length < 64)
     return;
-  const key = createHash11("sha256").update(normalized).digest("hex");
+  const key = createHash12("sha256").update(normalized).digest("hex");
   const list = groups.get(key) ?? [];
   list.push(record3.id);
   groups.set(key, list);
@@ -39849,24 +40765,24 @@ var init_build = __esm(() => {
   init_atomic_file();
   init_private_path();
   init_store();
-  init_paths2();
+  init_paths3();
   init_pack();
   init_taxonomy_pack();
   init_enrichment();
 });
 
 // src/agent-knowledge/ingest/git-source.ts
-import { existsSync as existsSync20, lstatSync as lstatSync6, renameSync as renameSync6, rmSync as rmSync6 } from "fs";
-import { randomUUID as randomUUID8 } from "crypto";
-import { join as join25 } from "path";
+import { existsSync as existsSync22, lstatSync as lstatSync7, renameSync as renameSync7, rmSync as rmSync7 } from "fs";
+import { randomUUID as randomUUID9 } from "crypto";
+import { join as join27 } from "path";
 async function fetchGitSource(source) {
   assertSource(source);
   const root = cacheDir();
   ensurePrivateDirectory(root, "knowledge cache directory");
-  const dir = join25(root, source.id);
+  const dir = join27(root, source.id);
   const cached = cachedRepositoryExists(dir);
   if (!cached) {
-    const staging = join25(root, `.${source.id}-clone-${randomUUID8()}`);
+    const staging = join27(root, `.${source.id}-clone-${randomUUID9()}`);
     try {
       const args = ["clone", "--depth", "1", "--branch", source.branch];
       if (source.sparse?.length)
@@ -39875,9 +40791,9 @@ async function fetchGitSource(source) {
       await run("git", args);
       if (source.sparse?.length)
         await run("git", ["-C", staging, "sparse-checkout", "set", "--no-cone", "--", ...source.sparse]);
-      renameSync6(staging, dir);
+      renameSync7(staging, dir);
     } finally {
-      rmSync6(staging, {
+      rmSync7(staging, {
         recursive: true,
         force: true
       });
@@ -39945,22 +40861,22 @@ function assertSource(source) {
     throw new Error(`invalid sparse path for git source: ${source.id}`);
 }
 function cachedRepositoryExists(dir) {
-  if (!existsSync20(dir))
+  if (!existsSync22(dir))
     return false;
-  const directory = lstatSync6(dir);
+  const directory = lstatSync7(dir);
   if (directory.isSymbolicLink() || !directory.isDirectory())
     throw new Error(`git source cache must be a real directory: ${dir}`);
-  const git = join25(dir, ".git");
-  if (!existsSync20(git))
+  const git = join27(dir, ".git");
+  if (!existsSync22(git))
     throw new Error(`git source cache is not a repository: ${dir}`);
-  const metadata = lstatSync6(git);
+  const metadata = lstatSync7(git);
   if (metadata.isSymbolicLink() || !metadata.isDirectory())
     throw new Error(`git source metadata must be a real directory: ${dir}`);
   return true;
 }
 var GIT_TIMEOUT_MS;
 var init_git_source = __esm(() => {
-  init_paths2();
+  init_paths3();
   init_captured_process();
   init_output_buffer();
   init_private_path();
@@ -40072,11 +40988,11 @@ var init_markdown_chunk = __esm(() => {
 });
 
 // src/agent-knowledge/ingest/hacktricks.ts
-import { existsSync as existsSync21, lstatSync as lstatSync7, readdirSync as readdirSync8 } from "fs";
-import { join as join26, relative as relative8 } from "path";
+import { existsSync as existsSync23, lstatSync as lstatSync8, readdirSync as readdirSync9 } from "fs";
+import { join as join28, relative as relative8 } from "path";
 async function ingestHacktricks() {
   const fetched = await fetchGitSource(SOURCE);
-  const srcDir = join26(fetched.dir, "src");
+  const srcDir = join28(fetched.dir, "src");
   const meta = {
     id: "hacktricks",
     sourceUrl: "https://github.com/HackTricks-wiki/hacktricks",
@@ -40128,9 +41044,9 @@ async function ingestHacktricks() {
   };
 }
 function markdownFiles(root) {
-  if (!existsSync21(root))
+  if (!existsSync23(root))
     return [];
-  const rootInfo = lstatSync7(root);
+  const rootInfo = lstatSync8(root);
   if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory())
     throw new Error("hacktricks source root must be a real directory");
   const out = [];
@@ -40138,12 +41054,12 @@ function markdownFiles(root) {
   let entries = 0;
   while (pending.length) {
     const dir = pending.pop();
-    for (const entry of readdirSync8(dir)) {
+    for (const entry of readdirSync9(dir)) {
       entries += 1;
       if (entries > WALK_ENTRY_MAX_COUNT)
         throw new Error(`hacktricks source exceeded ${WALK_ENTRY_MAX_COUNT} entries`);
-      const full = join26(dir, entry);
-      const info = lstatSync7(full);
+      const full = join28(dir, entry);
+      const info = lstatSync8(full);
       if (info.isSymbolicLink())
         continue;
       if (info.isDirectory())
@@ -40173,8 +41089,8 @@ var init_hacktricks = __esm(() => {
 });
 
 // src/agent-knowledge/ingest/payloads.ts
-import { existsSync as existsSync22, lstatSync as lstatSync8, readdirSync as readdirSync9 } from "fs";
-import { join as join27, relative as relative9 } from "path";
+import { existsSync as existsSync24, lstatSync as lstatSync9, readdirSync as readdirSync10 } from "fs";
+import { join as join29, relative as relative9 } from "path";
 async function ingestPayloads() {
   const fetched = await fetchGitSource(SOURCE2);
   const meta = {
@@ -40230,9 +41146,9 @@ async function ingestPayloads() {
   };
 }
 function markdownFiles2(root) {
-  if (!existsSync22(root))
+  if (!existsSync24(root))
     return [];
-  const rootInfo = lstatSync8(root);
+  const rootInfo = lstatSync9(root);
   if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory())
     throw new Error("payload source root must be a real directory");
   const out = [];
@@ -40240,14 +41156,14 @@ function markdownFiles2(root) {
   let entries = 0;
   while (pending.length) {
     const dir = pending.pop();
-    for (const entry of readdirSync9(dir)) {
+    for (const entry of readdirSync10(dir)) {
       if (entry === ".git")
         continue;
       entries += 1;
       if (entries > WALK_ENTRY_MAX_COUNT2)
         throw new Error(`payload source exceeded ${WALK_ENTRY_MAX_COUNT2} entries`);
-      const full = join27(dir, entry);
-      const info = lstatSync8(full);
+      const full = join29(dir, entry);
+      const info = lstatSync9(full);
       if (info.isSymbolicLink())
         continue;
       if (info.isDirectory())
@@ -40489,15 +41405,15 @@ var init_attack = __esm(() => {
 });
 
 // src/agent-knowledge/ingest/zip-fetch.ts
-import { existsSync as existsSync23, lstatSync as lstatSync9, mkdirSync as mkdirSync10, readdirSync as readdirSync10, renameSync as renameSync7, rmSync as rmSync7, unlinkSync as unlinkSync6 } from "fs";
-import { randomUUID as randomUUID9 } from "crypto";
-import { basename as basename5, join as join28, relative as relative10, resolve as resolve9 } from "path";
+import { existsSync as existsSync25, lstatSync as lstatSync10, mkdirSync as mkdirSync11, readdirSync as readdirSync11, renameSync as renameSync8, rmSync as rmSync8, unlinkSync as unlinkSync7 } from "fs";
+import { randomUUID as randomUUID10 } from "crypto";
+import { basename as basename5, join as join30, relative as relative10, resolve as resolve10 } from "path";
 async function fetchZippedXml(id2, url, pattern) {
-  const dir = join28(cacheDir(), id2);
+  const dir = join30(cacheDir(), id2);
   ensurePrivateDirectory(dir, `${id2} knowledge cache directory`);
-  const token = randomUUID9();
-  const zipPath = join28(dir, `.download-${token}.zip`);
-  const staging = join28(dir, `.extract-${token}`);
+  const token = randomUUID10();
+  const zipPath = join30(dir, `.download-${token}.zip`);
+  const staging = join30(dir, `.extract-${token}`);
   try {
     await downloadKnowledgeFile(url, zipPath, ZIP_MAX_BYTES, `${id2} zip archive`);
     const entries = await listArchiveEntries(zipPath);
@@ -40507,7 +41423,7 @@ async function fetchZippedXml(id2, url, pattern) {
     const declaredSize = await archiveEntrySize(zipPath, selected);
     if (declaredSize > XML_MAX_BYTES)
       throw new Error(`${id2} xml exceeded the ${XML_MAX_BYTES}-byte expanded limit`);
-    mkdirSync10(staging, {
+    mkdirSync11(staging, {
       recursive: true
     });
     const extracted = await runCapturedProcess("unzip", ["-o", "-q", zipPath, selected, "-d", staging], {
@@ -40518,26 +41434,26 @@ async function fetchZippedXml(id2, url, pattern) {
       throw new Error(`${id2} archive extraction timed out`);
     if (extracted.exitCode !== 0)
       throw new Error(extracted.stderr.trim() || `${id2} archive extraction failed`);
-    const stagedPath = resolve9(staging, selected);
+    const stagedPath = resolve10(staging, selected);
     const stagedRelative = relative10(staging, stagedPath);
     if (stagedRelative.startsWith("..") || stagedRelative.startsWith("/"))
       throw new Error(`${id2} archive entry escaped the extraction directory`);
-    const info = lstatSync9(stagedPath);
+    const info = lstatSync10(stagedPath);
     if (!info.isFile() || info.isSymbolicLink())
       throw new Error(`${id2} archive entry was not a regular file`);
     if (info.size > XML_MAX_BYTES || info.size !== declaredSize)
       throw new Error(`${id2} archive entry size did not match its validated metadata`);
-    const path = join28(dir, `${id2}.xml`);
-    renameSync7(stagedPath, path);
+    const path = join30(dir, `${id2}.xml`);
+    renameSync8(stagedPath, path);
     return {
       xml: readBoundedXml(path),
       path
     };
   } finally {
     try {
-      unlinkSync6(zipPath);
+      unlinkSync7(zipPath);
     } catch {}
-    rmSync7(staging, {
+    rmSync8(staging, {
       recursive: true,
       force: true
     });
@@ -40595,7 +41511,7 @@ function readBoundedXml(path) {
 }
 var ZIP_MAX_BYTES, XML_MAX_BYTES, ZIP_LIST_MAX_BYTES, ZIP_ENTRY_MAX_COUNT = 4096, UNZIP_TIMEOUT_MS = 60000;
 var init_zip_fetch = __esm(() => {
-  init_paths2();
+  init_paths3();
   init_http2();
   init_captured_process();
   init_file_read();
@@ -40898,7 +41814,7 @@ var init_command = __esm(() => {
   init_pack();
   init_taxonomy_pack();
   init_store();
-  init_paths2();
+  init_paths3();
   init_hacktricks();
   init_payloads();
   init_attack();
@@ -40918,6 +41834,80 @@ var init_command = __esm(() => {
   CORPUS_INGEST = new Set(["hacktricks", "payloads", ...TAXONOMY_INGEST]);
 });
 
+// src/agent-content/preflight.ts
+var exports_preflight = {};
+__export(exports_preflight, {
+  runStartupContentPreflight: () => runStartupContentPreflight
+});
+import { createInterface } from "readline";
+async function runStartupContentPreflight(workspace) {
+  const status2 = await checkContentUpdate({
+    workspace
+  });
+  if (status2.state !== "update_available" || !status2.manifest)
+    return "continue";
+  if (isContentVersionDismissed(status2.manifest.contentVersion))
+    return "continue";
+  const config = loadConfig(workspace);
+  if (config.updates?.prompt === false || !process.stdin.isTTY || !process.stdout.isTTY)
+    return "continue";
+  const answer = await promptForUpdate(status2.manifest.contentVersion, Boolean(status2.manifest.knowledge), Boolean(status2.manifest.skills));
+  if (answer === "cancelled")
+    return "cancelled";
+  if (answer === "dismiss") {
+    dismissContentVersion(status2.manifest.contentVersion);
+    return "continue";
+  }
+  if (answer === "later")
+    return "continue";
+  console.log("updating farai content...");
+  try {
+    const applied = await applyContentUpdate(status2.manifest, status2.manifestUrl);
+    const parts = [applied.knowledge ? "knowledge" : undefined, applied.skills ? "skills" : undefined].filter(Boolean).join(" + ");
+    console.log(`updated farai content to ${applied.version}${parts ? ` (${parts})` : ""}`);
+  } catch (error) {
+    console.error(`content update failed: ${errorMessage7(error)}`);
+    console.error("starting farai with the current content");
+  }
+  return "continue";
+}
+async function promptForUpdate(version, knowledge, skills) {
+  const contents = [knowledge ? "knowledge" : undefined, skills ? "skills" : undefined].filter(Boolean).join(" + ");
+  console.log("");
+  console.log(`farai content ${version} is available${contents ? ` (${contents})` : ""}`);
+  const interfaceHandle = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return await new Promise((resolve11) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      interfaceHandle.close();
+      resolve11(value);
+    };
+    interfaceHandle.once("SIGINT", () => finish("cancelled"));
+    interfaceHandle.question("update before starting? [enter=yes, n=later, d=skip version] ", (value) => {
+      const normalized = value.trim().toLowerCase();
+      if (normalized === "d" || normalized === "dismiss")
+        finish("dismiss");
+      else if (normalized === "n" || normalized === "no")
+        finish("later");
+      else
+        finish("apply");
+    });
+  });
+}
+function errorMessage7(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var init_preflight = __esm(() => {
+  init_config();
+  init_updater();
+});
+
 // node_modules/solid-js/dist/solid.js
 function getContextId(count2) {
   const num2 = String(count2), len = num2.length - 1;
@@ -49538,10 +50528,10 @@ function artifactRow(part, width) {
     return row;
   }
   const note = extractObject(payload, "note");
-  const artifact = extractObject(payload, "artifact") ?? extractObject(payload, "outputArtifact");
-  const title = artifactTitle(kind, note, artifact);
-  const detail = firstSemanticLine(stringField2(note, "text")) ?? stringField2(artifact, "path") ?? extractField(payload, "path") ?? extractField(payload, "title") ?? humanLabel(kind);
-  const body = artifactBody(payload, note, artifact);
+  const artifact2 = extractObject(payload, "artifact") ?? extractObject(payload, "outputArtifact");
+  const title = artifactTitle(kind, note, artifact2);
+  const detail = firstSemanticLine(stringField2(note, "text")) ?? stringField2(artifact2, "path") ?? extractField(payload, "path") ?? extractField(payload, "title") ?? humanLabel(kind);
+  const body = artifactBody(payload, note, artifact2);
   return {
     kind: "artifact",
     title,
@@ -49552,8 +50542,8 @@ function artifactRow(part, width) {
     id: part.id
   };
 }
-function artifactBody(payload, note, artifact) {
-  const candidates = [stringField2(note, "text"), stringField2(artifact, "content"), stringField2(artifact, "body"), stringField2(artifact, "text"), stringField2(artifact, "summary"), stringField2(artifact, "output"), extractField(payload, "content"), extractField(payload, "body"), extractField(payload, "text"), extractField(payload, "summary"), extractField(payload, "output")];
+function artifactBody(payload, note, artifact2) {
+  const candidates = [stringField2(note, "text"), stringField2(artifact2, "content"), stringField2(artifact2, "body"), stringField2(artifact2, "text"), stringField2(artifact2, "summary"), stringField2(artifact2, "output"), extractField(payload, "content"), extractField(payload, "body"), extractField(payload, "text"), extractField(payload, "summary"), extractField(payload, "output")];
   return candidates.find((value) => Boolean(value?.trim()))?.trim();
 }
 function firstSemanticLine(value) {
@@ -49568,10 +50558,10 @@ function mcpInventoryRow(part, width) {
     id: part.id
   };
 }
-function artifactTitle(kind, note, artifact) {
+function artifactTitle(kind, note, artifact2) {
   if (stringField2(note, "text"))
     return "saved note";
-  if (stringField2(artifact, "path"))
+  if (stringField2(artifact2, "path"))
     return "saved artifact";
   return humanLabel(kind);
 }
@@ -50147,7 +51137,7 @@ function createStoreResourceController(input) {
         actions.servicesSet(services.value);
       if (catalog.status === "fulfilled")
         actions.mcpCatalogSet(catalog.value.servers, catalog.value.statuses);
-      const errors = [refreshError, services.status === "rejected" ? errorMessage6(services.reason) : undefined, catalog.status === "rejected" ? errorMessage6(catalog.reason) : undefined].filter((message) => Boolean(message));
+      const errors = [refreshError, services.status === "rejected" ? errorMessage8(services.reason) : undefined, catalog.status === "rejected" ? errorMessage8(catalog.reason) : undefined].filter((message) => Boolean(message));
       actions.mcpStatusErrorSet(errors.length ? [...new Set(errors)].join(" \xB7 ") : undefined);
     } finally {
       if (mcpOverlayGeneration === generation && sessions2.owns(owner) && store.ui.statusDetail === "refreshing mcp") {
@@ -50169,7 +51159,7 @@ function createStoreResourceController(input) {
       actions.emailCatalogSet(catalog.accounts);
     } catch (error) {
       if (emailOverlayGeneration === generation && sessions2.owns(owner))
-        actions.errorSet(errorMessage6(error));
+        actions.errorSet(errorMessage8(error));
     } finally {
       if (emailOverlayGeneration === generation && sessions2.owns(owner) && store.ui.statusDetail === "loading email") {
         input.setStatusDetail(undefined);
@@ -50215,7 +51205,7 @@ function createStoreResourceController(input) {
       if (!sessions2.owns(owner))
         return;
       if (options.reportError !== false) {
-        actions.errorSet(errorMessage6(error));
+        actions.errorSet(errorMessage8(error));
         return;
       }
       throw error;
@@ -50258,7 +51248,7 @@ function containerState(imageExists, imageContractCurrent, persistentRunning, pe
     return "missing";
   return persistentRunning && persistentImageCurrent ? "running" : "stopped";
 }
-function errorMessage6(error) {
+function errorMessage8(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -50302,7 +51292,7 @@ function createStorePromptController(input) {
         await port.prompt(sessionId, text2);
       } catch (error) {
         if (isActiveSession(sessionId))
-          actions.errorSet(errorMessage7(error));
+          actions.errorSet(errorMessage9(error));
       } finally {
         if (submissions.get(sessionId) !== submission)
           return;
@@ -50314,7 +51304,7 @@ function createStorePromptController(input) {
           await sessions2.requestSnapshotRefresh(sessionId);
         } catch (error) {
           if (isActiveSession(sessionId))
-            actions.errorSet(errorMessage7(error));
+            actions.errorSet(errorMessage9(error));
         }
       }
     })();
@@ -50337,7 +51327,7 @@ function createStorePromptController(input) {
       return submitted;
     } catch (error) {
       if (sessions2.owns(owner))
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
       return false;
     } finally {
       if (sessions2.owns(owner) && store.ui.statusDetail === status2)
@@ -50364,7 +51354,7 @@ function createStorePromptController(input) {
     } catch (error) {
       if (sessions2.owns(owner) && store.snapshot.pendingUserInput?.id === requestId) {
         actions.requestUserInputSubmittingSet(false);
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
       }
       return false;
     }
@@ -50407,7 +51397,7 @@ function createStorePromptController(input) {
       await sessions2.requestSnapshotRefresh(owner.sessionId);
     } catch (error) {
       if (sessions2.owns(owner) && store.snapshot.pendingUserInput?.id === requestId)
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
     }
   }
   function queuePrompt(text2) {
@@ -50425,7 +51415,7 @@ function createStorePromptController(input) {
       return true;
     } catch (error) {
       if (owner && sessions2.owns(owner))
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
       return false;
     }
   }
@@ -50451,7 +51441,7 @@ function createStorePromptController(input) {
     } catch (error) {
       if (!sessions2.owns(owner))
         return;
-      const message = errorMessage7(error);
+      const message = errorMessage9(error);
       if (!/abort|cancel/i.test(message))
         actions.errorSet(message);
     } finally {
@@ -50476,7 +51466,7 @@ function createStorePromptController(input) {
       input.setStatusDetail("conversation cleared", 1500);
     } catch (error) {
       if (sessions2.owns(owner))
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
     }
   }
   async function cancelCurrentTurn() {
@@ -50499,7 +51489,7 @@ function createStorePromptController(input) {
       await port.cancelTurn(turnId, "cancelled by user");
     } catch (error) {
       if (sessions2.owns(owner))
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
     }
     if (!sessions2.owns(owner))
       return;
@@ -50507,7 +51497,7 @@ function createStorePromptController(input) {
       await sessions2.requestSnapshotRefresh(owner.sessionId);
     } catch (error) {
       if (sessions2.owns(owner))
-        actions.errorSet(errorMessage7(error));
+        actions.errorSet(errorMessage9(error));
     }
   }
   return {
@@ -50531,7 +51521,7 @@ function mergeQueuedPrompts(current, queued) {
     return current;
   return [...current, queued].sort((left, right) => left.sequence - right.sequence);
 }
-function errorMessage7(error) {
+function errorMessage9(error) {
   return error instanceof Error ? error.message : String(error);
 }
 var init_store_prompt_controller = __esm(() => {
@@ -54218,9 +55208,9 @@ function parseCommandArguments(value) {
 
 // src/agent-tui/clipboard.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, rmSync as rmSync8, writeFileSync as writeFileSync3 } from "fs";
+import { mkdtempSync, rmSync as rmSync9, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join29 } from "path";
+import { join as join31 } from "path";
 function writeClipboard(text2) {
   if (!text2)
     return {
@@ -54272,8 +55262,8 @@ function runClipboardCommand(command, text2) {
   };
 }
 function writeClipboardWithAppleScript(text2) {
-  const dir = mkdtempSync(join29(tmpdir2(), "farai-clipboard-"));
-  const path = join29(dir, "clipboard.txt");
+  const dir = mkdtempSync(join31(tmpdir2(), "farai-clipboard-"));
+  const path = join31(dir, "clipboard.txt");
   try {
     writeFileSync3(path, text2, {
       encoding: "utf8",
@@ -54297,7 +55287,7 @@ function writeClipboardWithAppleScript(text2) {
       error: `osascript: ${detail}`
     };
   } finally {
-    rmSync8(dir, {
+    rmSync9(dir, {
       recursive: true,
       force: true
     });
@@ -54318,9 +55308,9 @@ function ctrlCDecision(text2, armedUntil, now = Date.now()) {
 }
 
 // src/agent-tui/input/composer-controller.ts
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync9, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync10, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join30 } from "path";
+import { join as join32 } from "path";
 function createComposerController(input) {
   const {
     tui,
@@ -54588,8 +55578,8 @@ function createComposerController(input) {
       });
       return;
     }
-    const dir = mkdtempSync2(join30(tmpdir3(), "farai-editor-"));
-    const file = join30(dir, "prompt.md");
+    const dir = mkdtempSync2(join32(tmpdir3(), "farai-editor-"));
+    const file = join32(dir, "prompt.md");
     writeFileSync4(file, composer.ref()?.plainText ?? composer.text(), {
       encoding: "utf8",
       mode: 384
@@ -54623,7 +55613,7 @@ function createComposerController(input) {
         renderer.resume();
       } catch {}
       try {
-        rmSync9(dir, {
+        rmSync10(dir, {
           recursive: true,
           force: true
         });
@@ -57472,7 +58462,7 @@ function ToolResultContext(props) {
   const evidence = () => result()?.evidence ?? [];
   const attachments = () => result()?.attachments ?? [];
   const metadata = () => result()?.metadata ?? {};
-  const artifact = () => {
+  const artifact2 = () => {
     const value = metadata().outputArtifact;
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
   };
@@ -57514,7 +58504,7 @@ function ToolResultContext(props) {
       }), null);
       insert(_el$31, createComponent2(Show, {
         get when() {
-          return result()?.outputArtifactId || artifact();
+          return result()?.outputArtifactId || artifact2();
         },
         get children() {
           var _el$35 = createElement("box"), _el$36 = createElement("text");
@@ -57530,7 +58520,7 @@ function ToolResultContext(props) {
                 ...result()?.outputArtifactId ? {
                   id: result()?.outputArtifactId
                 } : {},
-                ...artifact() ?? {}
+                ...artifact2() ?? {}
               });
             },
             children: (line) => (() => {
@@ -65904,7 +66894,7 @@ var init_app = __esm(() => {
 });
 
 // src/agent-tui/update-check.ts
-import { dirname as dirname10, join as join31 } from "path";
+import { dirname as dirname11, join as join33 } from "path";
 function prepareUpdateCheck(options = {}) {
   if (updateCheckDisabled())
     return {
@@ -65947,42 +66937,9 @@ function createUpdateNotice(currentVersion, latestVersion) {
     updateCommand: "npm install -g farai@latest"
   };
 }
-function compareSemver(left, right) {
-  const a = parseSemver(left);
-  const b = parseSemver(right);
-  if (!a || !b)
-    return 0;
-  for (let index = 0;index < 3; index += 1) {
-    const delta = a.core[index] - b.core[index];
-    if (delta !== 0)
-      return delta < 0 ? -1 : 1;
-  }
-  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
-    if (a.prerelease.length === b.prerelease.length)
-      return 0;
-    return a.prerelease.length === 0 ? 1 : -1;
-  }
-  const length = Math.max(a.prerelease.length, b.prerelease.length);
-  for (let index = 0;index < length; index += 1) {
-    const aPart = a.prerelease[index];
-    const bPart = b.prerelease[index];
-    if (aPart === undefined || bPart === undefined)
-      return aPart === undefined ? -1 : 1;
-    if (aPart === bPart)
-      continue;
-    const aNumber = numericIdentifier(aPart);
-    const bNumber = numericIdentifier(bPart);
-    if (aNumber !== undefined && bNumber !== undefined)
-      return aNumber < bNumber ? -1 : 1;
-    if (aNumber !== undefined || bNumber !== undefined)
-      return aNumber !== undefined ? -1 : 1;
-    return aPart < bPart ? -1 : 1;
-  }
-  return 0;
-}
 function readUpdateCache(path = updateCachePath()) {
   try {
-    ensurePrivateDirectory(dirname10(path), "update cache directory");
+    ensurePrivateDirectory(dirname11(path), "update cache directory");
     ensurePrivateRegularFileIfExists(path, "update cache");
     const parsed = JSON.parse(readBoundedFileTextSyncNoFollow(path, UPDATE_RESPONSE_MAX_BYTES, "update cache"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
@@ -65990,7 +66947,7 @@ function readUpdateCache(path = updateCachePath()) {
     const value = parsed;
     if (typeof value.checkedAt !== "number" || !Number.isFinite(value.checkedAt))
       return;
-    if (typeof value.latestVersion !== "string" || !parseSemver(value.latestVersion))
+    if (typeof value.latestVersion !== "string" || !isSemver(value.latestVersion))
       return;
     return {
       checkedAt: value.checkedAt,
@@ -66001,13 +66958,13 @@ function readUpdateCache(path = updateCachePath()) {
   }
 }
 function updateCachePath() {
-  return join31(globalDataDir(), "update.json");
+  return join33(globalDataDir(), "update.json");
 }
 function readCurrentVersion() {
   try {
-    const packagePath = join31(import.meta.dir, "..", "..", "package.json");
+    const packagePath = join33(import.meta.dir, "..", "..", "package.json");
     const parsed = JSON.parse(readBoundedFileTextSync(packagePath, 1024 * 1024, "package metadata"));
-    return typeof parsed.version === "string" && parseSemver(parsed.version) ? parsed.version : undefined;
+    return typeof parsed.version === "string" && isSemver(parsed.version) ? parsed.version : undefined;
   } catch {
     return;
   }
@@ -66043,7 +67000,7 @@ async function fetchLatestVersion(fetcher, timeoutMs) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       throw new Error("invalid npm registry response");
     const version = parsed.version;
-    if (typeof version !== "string" || !parseSemver(version))
+    if (typeof version !== "string" || !isSemver(version))
       throw new Error("invalid npm package version");
     return version;
   } finally {
@@ -66052,7 +67009,7 @@ async function fetchLatestVersion(fetcher, timeoutMs) {
 }
 function writeUpdateCache(path, cache) {
   try {
-    ensurePrivateDirectory(dirname10(path), "update cache directory");
+    ensurePrivateDirectory(dirname11(path), "update cache directory");
     ensurePrivateRegularFileIfExists(path, "update cache");
     atomicWriteFile(path, `${JSON.stringify(cache)}
 `, 384);
@@ -66068,20 +67025,6 @@ function updateCheckDisabled() {
 function envEnabled(value) {
   return value === "1" || value?.toLowerCase() === "true" || value?.toLowerCase() === "yes";
 }
-function parseSemver(value) {
-  const match = value.trim().match(/^(?:v)?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/);
-  if (!match)
-    return;
-  return {
-    core: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4]?.split(".") ?? []
-  };
-}
-function numericIdentifier(value) {
-  if (!/^(0|[1-9]\d*)$/.test(value))
-    return;
-  return Number(value);
-}
 var UPDATE_CACHE_TTL_MS, UPDATE_CHECK_TIMEOUT_MS = 4000, UPDATE_REGISTRY_URL = "https://registry.npmjs.org/farai/latest", UPDATE_RESPONSE_MAX_BYTES;
 var init_update_check = __esm(() => {
   init_config();
@@ -66148,8 +67091,8 @@ async function runOpenTui(input) {
   const renderer = managedRenderer.renderer;
   const updateCheck = prepareUpdateCheck();
   let done;
-  const finished = new Promise((resolve10) => {
-    done = resolve10;
+  const finished = new Promise((resolve11) => {
+    done = resolve11;
   });
   let exitPromise;
   const onSigint = () => {
@@ -66390,6 +67333,80 @@ no sessions are available in this workspace`}`);
   };
 });
 
+// src/agent-content/command.ts
+var exports_command2 = {};
+__export(exports_command2, {
+  runContentUpdateCommand: () => runContentUpdateCommand
+});
+import { existsSync as existsSync26 } from "fs";
+async function runContentUpdateCommand(parsed, workspace) {
+  if (parsed.kind === "status") {
+    const status3 = contentStatus();
+    if (!status3.active) {
+      const knowledge = legacyKnowledgeDbPath();
+      console.log("content: bundled defaults");
+      console.log("active release: none");
+      console.log(`knowledge: ${existsSync26(knowledge) ? knowledge : "not installed"}`);
+      console.log("skills: bundled");
+      return 0;
+    }
+    console.log(`content: ${status3.active.version}`);
+    console.log(`activated: ${status3.active.activatedAt}`);
+    console.log(`knowledge: ${status3.knowledgePath ?? "local fallback"}`);
+    console.log(`skills: ${status3.skillsPath ?? "bundled fallback"}`);
+    console.log(`available versions: ${status3.versions.join(", ") || "none"}`);
+    return 0;
+  }
+  if (parsed.kind === "rollback") {
+    const result2 = rollbackContentUpdate();
+    console.log(`rolled back farai content to ${result2.version}`);
+    return 0;
+  }
+  const status2 = await checkContentUpdate({
+    workspace,
+    force: true
+  });
+  if (parsed.kind === "check")
+    return printContentUpdateStatus(status2);
+  if (status2.state === "up_to_date") {
+    console.log(`farai content is up to date${status2.active ? ` (${status2.active.version})` : ""}`);
+    return 0;
+  }
+  if (status2.state !== "update_available" || !status2.manifest)
+    return printContentUpdateStatus(status2);
+  const result = await applyContentUpdate(status2.manifest, status2.manifestUrl);
+  console.log(`updated farai content to ${result.version}`);
+  return 0;
+}
+function printContentUpdateStatus(status2) {
+  if (status2.state === "update_available") {
+    console.log(`content update available: ${status2.active?.version ?? "none"} -> ${status2.manifest?.contentVersion}`);
+    return 0;
+  }
+  if (status2.state === "up_to_date") {
+    console.log(`farai content is up to date${status2.active ? ` (${status2.active.version})` : ""}`);
+    return 0;
+  }
+  if (status2.state === "disabled") {
+    console.log("farai content updates are disabled");
+    return 0;
+  }
+  if (status2.state === "unavailable") {
+    console.log("the content channel has no published artifacts yet");
+    return 0;
+  }
+  if (status2.state === "incompatible") {
+    console.error(`content ${status2.manifest?.contentVersion} requires farai ${status2.manifest?.minFaraiVersion} or newer`);
+    return 1;
+  }
+  console.error(`content update check failed: ${status2.error ?? "unknown error"}`);
+  return 1;
+}
+var init_command2 = __esm(() => {
+  init_paths3();
+  init_updater();
+});
+
 // src/agent-benchmark/csi-cybench-33.ts
 var figureTimeout = (minutes, line) => ({
   status: "verified",
@@ -66651,40 +67668,40 @@ var init_csi_cybench_33 = __esm(() => {
 });
 
 // src/agent-benchmark/hash.ts
-import { createHash as createHash12 } from "crypto";
-import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync3, lstatSync as lstatSync10, openSync as openSync6, readSync as readSync2, readdirSync as readdirSync11 } from "fs";
-import { join as join32 } from "path";
+import { createHash as createHash13 } from "crypto";
+import { closeSync as closeSync7, constants as constants3, fstatSync as fstatSync3, lstatSync as lstatSync11, openSync as openSync7, readSync as readSync3, readdirSync as readdirSync12 } from "fs";
+import { join as join34 } from "path";
 function stableStringify(value) {
   return JSON.stringify(sortValue(value));
 }
 function sha256(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function hashPath(path) {
-  const stat = lstatSync10(path);
+  const stat = lstatSync11(path);
   if (stat.isFile())
-    return hashFile(path);
+    return hashFile2(path);
   if (!stat.isDirectory())
     throw new Error(`unsupported benchmark input type: ${path}`);
-  const hash = createHash12("sha256");
+  const hash = createHash13("sha256");
   hash.update("farai-directory-v2\x00");
   hashDirectory(path, Buffer.alloc(0), hash);
   return hash.digest("hex");
 }
-function hashFile(path) {
+function hashFile2(path) {
   return hashFileDetails(path).digest;
 }
 function hashFileDetails(path) {
-  const descriptor = openSync6(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+  const descriptor = openSync7(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
   try {
     const before = fstatSync3(descriptor);
     if (!before.isFile())
       throw new Error(`unsupported benchmark input type: ${path}`);
-    const hash = createHash12("sha256");
+    const hash = createHash13("sha256");
     let remaining2 = before.size;
     while (remaining2 > 0) {
       const chunk = Buffer.allocUnsafe(Math.min(1024 * 1024, remaining2));
-      const count2 = readSync2(descriptor, chunk, 0, chunk.length, null);
+      const count2 = readSync3(descriptor, chunk, 0, chunk.length, null);
       if (count2 === 0)
         throw new Error(`benchmark input changed while hashing: ${path}`);
       hash.update(chunk.subarray(0, count2));
@@ -66700,7 +67717,7 @@ function hashFileDetails(path) {
       size: before.size
     };
   } finally {
-    closeSync6(descriptor);
+    closeSync7(descriptor);
   }
 }
 function canonicalBenchmarkManifest(manifest) {
@@ -66755,22 +67772,22 @@ function sortValue(value) {
   return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortValue(item)]));
 }
 function hashDirectory(path, localPath, hash) {
-  const before = lstatSync10(path);
+  const before = lstatSync11(path);
   if (!before.isDirectory() || before.isSymbolicLink())
     throw new Error(`unsupported benchmark input type: ${path}`);
   hash.update("directory\x00");
   hash.update(localPath);
   hash.update(`\x00${before.mode & 511}\x00`);
-  const names = readdirSync11(path, {
+  const names = readdirSync12(path, {
     encoding: "buffer"
   }).map((name) => Buffer.from(name)).sort(Buffer.compare);
   for (const encodedName of names) {
     const name = encodedName.toString("utf8");
     if (!Buffer.from(name, "utf8").equals(encodedName))
       throw new Error(`benchmark input path is not valid utf-8: ${path}`);
-    const childPath = join32(path, name);
+    const childPath = join34(path, name);
     const childLocalPath = localPath.length === 0 ? encodedName : Buffer.concat([localPath, Buffer.from("/"), encodedName]);
-    const stat = lstatSync10(childPath);
+    const stat = lstatSync11(childPath);
     if (stat.isDirectory() && !stat.isSymbolicLink()) {
       hashDirectory(childPath, childLocalPath, hash);
       continue;
@@ -66782,7 +67799,7 @@ function hashDirectory(path, localPath, hash) {
     hash.update(childLocalPath);
     hash.update(`\x00${file.mode}\x00${file.size}\x00${file.digest}\x00`);
   }
-  const after = lstatSync10(path);
+  const after = lstatSync11(path);
   if (!after.isDirectory() || after.dev !== before.dev || after.ino !== before.ino || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) {
     throw new Error(`benchmark input changed while hashing: ${path}`);
   }
@@ -66790,7 +67807,7 @@ function hashDirectory(path, localPath, hash) {
 var init_hash = () => {};
 
 // src/agent-benchmark/manifest.ts
-import { isAbsolute as isAbsolute7, normalize as normalize3 } from "path";
+import { isAbsolute as isAbsolute8, normalize as normalize3 } from "path";
 async function loadBenchmarkManifest(path) {
   return normalizeBenchmarkManifest(JSON.parse(await readBoundedFileText(path, BENCHMARK_MANIFEST_MAX_BYTES, "benchmark manifest")));
 }
@@ -66829,27 +67846,27 @@ function normalizeBenchmarkManifest(value) {
       id: requiredString(suite.id, "suite.id"),
       version: requiredString(suite.version, "suite.version"),
       source: requiredString(suite.source, "suite.source"),
-      ...optionalString2(suite.sourceDigest ?? suite.source_digest) ? {
-        sourceDigest: optionalString2(suite.sourceDigest ?? suite.source_digest)
+      ...optionalString3(suite.sourceDigest ?? suite.source_digest) ? {
+        sourceDigest: optionalString3(suite.sourceDigest ?? suite.source_digest)
       } : {}
     },
     challenge: {
       id: requiredString(challenge.id, "challenge.id"),
       prompt: requiredString(challenge.prompt, "challenge.prompt"),
-      ...optionalString2(challenge.category) ? {
-        category: optionalString2(challenge.category)
+      ...optionalString3(challenge.category) ? {
+        category: optionalString3(challenge.category)
       } : {},
-      ...optionalString2(challenge.difficulty) ? {
-        difficulty: optionalString2(challenge.difficulty)
+      ...optionalString3(challenge.difficulty) ? {
+        difficulty: optionalString3(challenge.difficulty)
       } : {},
-      ...optionalString2(challenge.source) ? {
-        source: optionalString2(challenge.source)
+      ...optionalString3(challenge.source) ? {
+        source: optionalString3(challenge.source)
       } : {},
-      ...optionalString2(challenge.targetImage ?? challenge.target_image) ? {
-        targetImage: optionalString2(challenge.targetImage ?? challenge.target_image)
+      ...optionalString3(challenge.targetImage ?? challenge.target_image) ? {
+        targetImage: optionalString3(challenge.targetImage ?? challenge.target_image)
       } : {},
-      ...optionalString2(challenge.targetImageDigest ?? challenge.target_image_digest) ? {
-        targetImageDigest: optionalString2(challenge.targetImageDigest ?? challenge.target_image_digest)
+      ...optionalString3(challenge.targetImageDigest ?? challenge.target_image_digest) ? {
+        targetImageDigest: optionalString3(challenge.targetImageDigest ?? challenge.target_image_digest)
       } : {},
       ...challenge.targetCommand ?? challenge.target_command ? {
         targetCommand: stringArray3(challenge.targetCommand ?? challenge.target_command, "challenge.targetCommand")
@@ -66857,11 +67874,11 @@ function normalizeBenchmarkManifest(value) {
     },
     model: {
       selection: requiredString(model.selection, "model.selection"),
-      ...optionalString2(model.provider) ? {
-        provider: optionalString2(model.provider)
+      ...optionalString3(model.provider) ? {
+        provider: optionalString3(model.provider)
       } : {},
-      ...optionalString2(model.protocol) ? {
-        protocol: optionalString2(model.protocol)
+      ...optionalString3(model.protocol) ? {
+        protocol: optionalString3(model.protocol)
       } : {},
       ...optionalPositiveNumber(model.contextWindow ?? model.context_window, "model.contextWindow") ? {
         contextWindow: optionalPositiveNumber(model.contextWindow ?? model.context_window, "model.contextWindow")
@@ -66920,7 +67937,7 @@ function normalizeBenchmarkSuiteManifest(value) {
   const id2 = requiredString(raw.id, "id");
   const version = requiredString(raw.version, "version");
   const source = requiredString(raw.source, "source");
-  const sourceDigest = optionalString2(raw.sourceDigest ?? raw.source_digest);
+  const sourceDigest = optionalString3(raw.sourceDigest ?? raw.source_digest);
   const repetitions = positiveInteger4(raw.repetitions, "repetitions");
   const concurrency = positiveInteger4(raw.concurrency, "concurrency");
   const runs = raw.runs.map((entry, index) => {
@@ -66977,8 +67994,8 @@ function normalizeOracle(value) {
       executableSha256: optionalSha256(raw.executableSha256 ?? raw.executable_sha256, "oracle.executableSha256")
     } : {},
     flagPattern: requiredString(raw.flagPattern ?? raw.flag_pattern, "oracle.flagPattern"),
-    ...optionalString2(raw.flags) ? {
-      flags: optionalString2(raw.flags)
+    ...optionalString3(raw.flags) ? {
+      flags: optionalString3(raw.flags)
     } : {},
     ...optionalPositiveNumber(raw.timeoutSeconds ?? raw.timeout_seconds, "oracle.timeoutSeconds") ? {
       timeoutSeconds: optionalPositiveNumber(raw.timeoutSeconds ?? raw.timeout_seconds, "oracle.timeoutSeconds")
@@ -67034,7 +68051,7 @@ function optionalResource(raw, key, integer2, snake = key) {
   };
 }
 function safeRelativePath(value) {
-  if (isAbsolute7(value))
+  if (isAbsolute8(value))
     throw new Error(`benchmark destination must be relative: ${value}`);
   const normalized = normalize3(value).replace(/\\/g, "/");
   if (!normalized || normalized === "." || normalized.split("/").includes(".."))
@@ -67066,7 +68083,7 @@ function requiredString(value, name) {
     throw new Error(`${name} must be a non-empty string`);
   return value.trim();
 }
-function optionalString2(value) {
+function optionalString3(value) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 function optionalSha256(value, name) {
@@ -67113,7 +68130,7 @@ function optionalInteger(value, name, minimum) {
   return number;
 }
 var BENCHMARK_MANIFEST_MAX_BYTES;
-var init_manifest = __esm(() => {
+var init_manifest2 = __esm(() => {
   init_file_read();
   BENCHMARK_MANIFEST_MAX_BYTES = 32 * 1024 * 1024;
 });
@@ -67128,17 +68145,17 @@ __export(exports_csi_suite, {
   loadCsiCampaignConfig: () => loadCsiCampaignConfig,
   generateCsiBenchmarkSuite: () => generateCsiBenchmarkSuite
 });
-import { existsSync as existsSync24, readdirSync as readdirSync12, statSync as statSync6 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute8, join as join33, relative as relative11, resolve as resolve10 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync13, statSync as statSync7 } from "fs";
+import { dirname as dirname12, isAbsolute as isAbsolute9, join as join35, relative as relative11, resolve as resolve11 } from "path";
 async function loadCsiCampaignConfig(path) {
   return normalizeCsiCampaignConfig(JSON.parse(await readBoundedFileText(path, CSI_CAMPAIGN_MAX_BYTES, "csi campaign config")));
 }
 async function loadCsiMaterialIndex(root) {
-  return normalizeCsiMaterialIndex(JSON.parse(await readBoundedFileText(resolve10(root, "index.json"), CSI_MATERIAL_INDEX_MAX_BYTES, "csi material index")));
+  return normalizeCsiMaterialIndex(JSON.parse(await readBoundedFileText(resolve11(root, "index.json"), CSI_MATERIAL_INDEX_MAX_BYTES, "csi material index")));
 }
 async function generateCsiBenchmarkSuite(configInput, materialRoot) {
   const config = normalizeCsiCampaignConfig(configInput);
-  const root = resolve10(materialRoot);
+  const root = resolve11(materialRoot);
   const materials = await loadCsiMaterialIndex(root);
   const selectedIds = config.challenges ?? CSI_CYBENCH_33.challenges.map((challenge) => challenge.id);
   const selected = selectedIds.map((id2) => {
@@ -67154,16 +68171,16 @@ async function generateCsiBenchmarkSuite(configInput, materialRoot) {
     if (config.isolation.backend === "host" && material.requiresTarget)
       throw new Error(`host csi challenge requires a live target and cannot run in host smoke mode: ${challenge.id}`);
     const promptPath = protectedPath(root, material.promptFile, `${challenge.id}.promptFile`);
-    if (!existsSync24(promptPath) || !statSync6(promptPath).isFile())
+    if (!existsSync27(promptPath) || !statSync7(promptPath).isFile())
       throw new Error(`missing prompt file for csi challenge: ${challenge.id}`);
     const prompt = readBoundedFileTextSync(promptPath, CSI_PROMPT_MAX_BYTES, `csi prompt ${challenge.id}`).trim();
     if (!prompt)
       throw new Error(`empty prompt file for csi challenge: ${challenge.id}`);
     const files = material.files?.map((file, index) => {
       const source = protectedPath(root, file.source, `${challenge.id}.files[${index}].source`);
-      if (!existsSync24(source))
+      if (!existsSync27(source))
         throw new Error(`missing input for csi challenge ${challenge.id}: ${file.source}`);
-      if (statSync6(source).isDirectory() && !listFiles(source).length)
+      if (statSync7(source).isDirectory() && !listFiles(source).length)
         throw new Error(`empty input directory for csi challenge ${challenge.id}: ${file.source}`);
       const digest2 = hashPath(source);
       if (file.sha256 && file.sha256.toLowerCase() !== digest2)
@@ -67183,14 +68200,14 @@ async function generateCsiBenchmarkSuite(configInput, materialRoot) {
         throw new Error(`missing required protected files for csi challenge ${challenge.id}: ${missing.join(", ")}`);
     }
     const executable = protectedPath(root, material.oracle.executable, `${challenge.id}.oracle.executable`);
-    if (!existsSync24(executable) || !statSync6(executable).isFile())
+    if (!existsSync27(executable) || !statSync7(executable).isFile())
       throw new Error(`missing oracle executable for csi challenge: ${challenge.id}`);
-    if ((statSync6(executable).mode & 73) === 0)
+    if ((statSync7(executable).mode & 73) === 0)
       throw new Error(`oracle executable is not executable for csi challenge: ${challenge.id}`);
     const antiCheatExecutable = material.antiCheat ? protectedPath(root, material.antiCheat.executable, `${challenge.id}.antiCheat.executable`) : undefined;
-    if (antiCheatExecutable && (!existsSync24(antiCheatExecutable) || !statSync6(antiCheatExecutable).isFile()))
+    if (antiCheatExecutable && (!existsSync27(antiCheatExecutable) || !statSync7(antiCheatExecutable).isFile()))
       throw new Error(`missing anti-cheat executable for csi challenge: ${challenge.id}`);
-    if (antiCheatExecutable && (statSync6(antiCheatExecutable).mode & 73) === 0)
+    if (antiCheatExecutable && (statSync7(antiCheatExecutable).mode & 73) === 0)
       throw new Error(`anti-cheat executable is not executable for csi challenge: ${challenge.id}`);
     if (config.isolation.backend === "docker" && !material.target)
       throw new Error(`docker csi challenge requires a pinned target image: ${challenge.id}`);
@@ -67263,8 +68280,8 @@ async function generateCsiBenchmarkSuite(configInput, materialRoot) {
   });
 }
 function writeCsiBenchmarkSuite(suite, path) {
-  const directory = dirname11(resolve10(path));
-  if (!existsSync24(directory))
+  const directory = dirname12(resolve11(path));
+  if (!existsSync27(directory))
     throw new Error(`suite output directory does not exist: ${directory}`);
   atomicWriteFile(path, `${JSON.stringify(suite, null, 2)}
 `, 384);
@@ -67343,8 +68360,8 @@ function normalizeCsiMaterialIndex(value) {
           args: stringArray4(oracle.args, `challenges.${id2}.oracle.args`, true)
         },
         flagPattern: requiredString2(oracle.flagPattern ?? oracle.flag_pattern, `challenges.${id2}.oracle.flagPattern`),
-        ...optionalString3(oracle.flags) ? {
-          flags: optionalString3(oracle.flags)
+        ...optionalString4(oracle.flags) ? {
+          flags: optionalString4(oracle.flags)
         } : {},
         ...oracle.timeoutSeconds ?? oracle.timeout_seconds ? {
           timeoutSeconds: positiveNumber3(oracle.timeoutSeconds ?? oracle.timeout_seconds, `challenges.${id2}.oracle.timeoutSeconds`)
@@ -67390,18 +68407,18 @@ function resolveTimeoutMinutes(id2, catalog, material) {
   return material.minutes;
 }
 function protectedPath(root, path, name) {
-  if (isAbsolute8(path))
+  if (isAbsolute9(path))
     throw new Error(`${name} must be relative to the protected material root`);
-  const resolved = resolve10(root, path);
+  const resolved = resolve11(root, path);
   const difference = relative11(root, resolved);
-  if (!difference || difference.startsWith("..") || isAbsolute8(difference))
+  if (!difference || difference.startsWith("..") || isAbsolute9(difference))
     throw new Error(`${name} escapes the protected material root`);
   return resolved;
 }
 function listFiles(rootPath) {
-  if (!statSync6(rootPath).isDirectory())
+  if (!statSync7(rootPath).isDirectory())
     return [rootPath];
-  return readdirSync12(rootPath).flatMap((name) => listFiles(join33(rootPath, name)));
+  return readdirSync13(rootPath).flatMap((name) => listFiles(join35(rootPath, name)));
 }
 function object2(value, name) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -67413,7 +68430,7 @@ function requiredString2(value, name) {
     throw new Error(`${name} must be a non-empty string`);
   return value.trim();
 }
-function optionalString3(value) {
+function optionalString4(value) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 function stringArray4(value, name, allowEmpty) {
@@ -67455,7 +68472,7 @@ var CSI_CAMPAIGN_MAX_BYTES, CSI_MATERIAL_INDEX_MAX_BYTES, CSI_PROMPT_MAX_BYTES;
 var init_csi_suite = __esm(() => {
   init_csi_cybench_33();
   init_hash();
-  init_manifest();
+  init_manifest2();
   init_file_read();
   init_atomic_file();
   CSI_CAMPAIGN_MAX_BYTES = 4 * 1024 * 1024;
@@ -67464,28 +68481,28 @@ var init_csi_suite = __esm(() => {
 });
 
 // src/agent-benchmark/bundle.ts
-import { createHash as createHash13 } from "crypto";
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync11 } from "fs";
-import { join as join34 } from "path";
+import { createHash as createHash14 } from "crypto";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync12 } from "fs";
+import { join as join36 } from "path";
 function writeBenchmarkBundle(bundle, directory) {
-  mkdirSync11(directory, {
+  mkdirSync12(directory, {
     recursive: true
   });
   const files = new Map([["manifest.json", json(redactManifest(bundle.manifest))], ["result.json", json(bundle.result)], ["environment.json", json(bundle.result.frozen)], ["sessions.jsonl", jsonl(bundle.sessions)], ["turns.jsonl", jsonl(bundle.turns)], ["messages.jsonl", jsonl(bundle.messages)], ["events.jsonl", jsonl(bundle.events)], ["tool-calls.jsonl", jsonl(bundle.toolCalls)], ["jobs.jsonl", jsonl(bundle.jobs)], ["usage.jsonl", jsonl(bundle.usage)], ["compactions.jsonl", jsonl(bundle.compactions)], ["evidence.jsonl", jsonl(bundle.evidence)]]);
   for (const [name, content] of files)
-    atomicWriteFile(join34(directory, name), content, 384);
+    atomicWriteFile(join36(directory, name), content, 384);
   const checksums = [...files.keys()].sort().map((name) => `${sha2562(files.get(name))}  ${name}`).join(`
 `);
-  atomicWriteFile(join34(directory, "checksums.sha256"), `${checksums}
+  atomicWriteFile(join36(directory, "checksums.sha256"), `${checksums}
 `, 384);
   for (const name of [...files.keys(), "checksums.sha256"])
-    chmodSync3(join34(directory, name), 292);
+    chmodSync3(join36(directory, name), 292);
   return directory;
 }
 function writeBenchmarkResult(result, path) {
   const directory = path.slice(0, Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\")));
   if (directory)
-    mkdirSync11(directory, {
+    mkdirSync12(directory, {
       recursive: true
     });
   atomicWriteFile(path, json(result), 384);
@@ -67503,7 +68520,7 @@ function jsonl(values) {
 ` : "";
 }
 function sha2562(value) {
-  return createHash13("sha256").update(value).digest("hex");
+  return createHash14("sha256").update(value).digest("hex");
 }
 var init_bundle = __esm(() => {
   init_hash();
@@ -67511,8 +68528,8 @@ var init_bundle = __esm(() => {
 });
 
 // src/agent-benchmark/docker-lifecycle.ts
-import { existsSync as existsSync25 } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync28 } from "fs";
+import { resolve as resolve12 } from "path";
 
 class BenchmarkDockerLifecycle {
   constructor(manifest, workspace, runId, runner = runProcess2) {
@@ -67630,7 +68647,7 @@ function buildBenchmarkDockerPlan(manifest, workspace, runId, agentImageId) {
     throw new Error("docker benchmark requires a pinned target image");
   if (!manifest.antiCheat)
     throw new Error("docker benchmark requires an external anti-cheat hook");
-  if (!existsSync25(manifest.antiCheat.executable))
+  if (!existsSync28(manifest.antiCheat.executable))
     throw new Error("anti-cheat executable is missing");
   if (hashPath(manifest.antiCheat.executable) !== manifest.antiCheat.executableSha256)
     throw new Error("anti-cheat executable hash mismatch");
@@ -67649,7 +68666,7 @@ function buildBenchmarkDockerPlan(manifest, workspace, runId, agentImageId) {
   const resourceArgs = [...resources?.cpus ? ["--cpus", String(resources.cpus)] : [], ...resources?.memoryMb ? ["--memory", `${resources.memoryMb}m`] : []];
   const targetImage = pinnedImage(manifest.challenge.targetImage, manifest.challenge.targetImageDigest);
   const targetStart = ["run", "-d", "--name", names.target, "--network", names.network, "--network-alias", "target", "--cap-drop", "ALL", "--cap-add", "NET_BIND_SERVICE", ...common, ...resourceArgs, targetImage, ...manifest.challenge.targetCommand ?? []];
-  const resolvedWorkspace = resolve11(workspace);
+  const resolvedWorkspace = resolve12(workspace);
   const agentStart = ["run", "-d", "--name", names.agent, "--network", names.network, "--workdir", "/workspace", "--volume", `${resolvedWorkspace}:/workspace:rw`, "--volume", "/workspace/.farai", "--read-only", "--tmpfs", "/tmp:rw,nosuid,nodev,size=512m", "--tmpfs", "/root:rw,nosuid,nodev,size=256m", "--tmpfs", "/run:rw,nosuid,nodev,size=64m", "--cap-drop", "ALL", "--cap-add", "NET_ADMIN", "--cap-add", "NET_RAW", ...common, ...resourceArgs, agentImageId, "sleep", "infinity"];
   return {
     names,
@@ -67699,9 +68716,9 @@ var init_docker_lifecycle = __esm(() => {
 });
 
 // src/agent-benchmark/git-state.ts
-import { createHash as createHash14 } from "crypto";
-import { lstatSync as lstatSync11, readlinkSync } from "fs";
-import { isAbsolute as isAbsolute9, relative as relative12, resolve as resolve12 } from "path";
+import { createHash as createHash15 } from "crypto";
+import { lstatSync as lstatSync12, readlinkSync } from "fs";
+import { isAbsolute as isAbsolute10, relative as relative12, resolve as resolve13 } from "path";
 import { spawn as spawn5 } from "child_process";
 async function freezeGitSourceState(root) {
   if (!await isGitWorktree(root))
@@ -67738,7 +68755,7 @@ async function readGitCommit(root) {
   return commit.toLowerCase();
 }
 async function hashGitWorktree(root, hasCommit) {
-  const hash = createHash14("sha256");
+  const hash = createHash15("sha256");
   hash.update("farai-git-worktree-v2\x00");
   await hashCommand(root, ["status", "--porcelain=v1", "-z", "--untracked-files=no", "--ignore-submodules=none"], hash, "status");
   await hashCommand(root, ["diff", "--no-ext-diff", "--no-textconv", "--binary", "--full-index", "--submodule=diff", "--"], hash, "unstaged");
@@ -67780,17 +68797,17 @@ function hashUntrackedPath(root, encodedPath, hash) {
   const path = encodedPath.toString("utf8");
   if (!Buffer.from(path, "utf8").equals(encodedPath))
     throw new Error("git returned an untracked path that is not valid utf-8");
-  const absolute = resolve12(root, path);
-  const local = relative12(resolve12(root), absolute);
-  if (!path || isAbsolute9(path) || local === ".." || local.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute9(local)) {
+  const absolute = resolve13(root, path);
+  const local = relative12(resolve13(root), absolute);
+  if (!path || isAbsolute10(path) || local === ".." || local.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute10(local)) {
     throw new Error(`git returned an unsafe untracked path: ${path}`);
   }
-  const stat = lstatSync11(absolute);
+  const stat = lstatSync12(absolute);
   hash.update("path\x00");
   hash.update(encodedPath);
   hash.update("\x00");
   if (stat.isFile()) {
-    hash.update(`file\x00${stat.mode & 511}\x00${stat.size}\x00${hashFile(absolute)}\x00`);
+    hash.update(`file\x00${stat.mode & 511}\x00${stat.size}\x00${hashFile2(absolute)}\x00`);
     return;
   }
   if (stat.isSymbolicLink()) {
@@ -67891,27 +68908,27 @@ __export(exports_runner, {
   normalizeBenchmarkManifest: () => normalizeBenchmarkManifest,
   loadBenchmarkManifest: () => loadBenchmarkManifest
 });
-import { cpSync, existsSync as existsSync26, lstatSync as lstatSync12, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readdirSync as readdirSync13, renameSync as renameSync8, rmSync as rmSync10, rmdirSync } from "fs";
+import { cpSync, existsSync as existsSync29, lstatSync as lstatSync13, mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync3, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync11, rmdirSync } from "fs";
 import { arch, platform, tmpdir as tmpdir4 } from "os";
-import { dirname as dirname12, isAbsolute as isAbsolute10, join as join35, relative as relative13, resolve as resolve13 } from "path";
-import { randomUUID as randomUUID10 } from "crypto";
+import { dirname as dirname13, isAbsolute as isAbsolute11, join as join37, relative as relative13, resolve as resolve14 } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
 async function runBenchmark(input, options = {}) {
   const manifest = normalizeBenchmarkManifest(input);
   assertExecutableIsolation(manifest);
-  const workspace = options.workspace ?? mkdtempSync3(join35(tmpdir4(), "farai-benchmark-"));
-  const artifactsRoot = options.artifactsDir ?? mkdtempSync3(join35(tmpdir4(), "farai-benchmark-artifacts-"));
+  const workspace = options.workspace ?? mkdtempSync3(join37(tmpdir4(), "farai-benchmark-"));
+  const artifactsRoot = options.artifactsDir ?? mkdtempSync3(join37(tmpdir4(), "farai-benchmark-artifacts-"));
   const repetition = options.repetition ?? 1;
-  mkdirSync12(workspace, {
+  mkdirSync13(workspace, {
     recursive: true
   });
   assertCleanWorkspace(workspace);
   assertArtifactsOutsideWorkspace(workspace, artifactsRoot);
-  mkdirSync12(artifactsRoot, {
+  mkdirSync13(artifactsRoot, {
     recursive: true
   });
   stageFiles(manifest, workspace);
   const runId = id();
-  const bundlePath = join35(artifactsRoot, `${safeName2(manifest.challenge.id)}-r${repetition}-${runId}`);
+  const bundlePath = join37(artifactsRoot, `${safeName2(manifest.challenge.id)}-r${repetition}-${runId}`);
   const provider = options.provider ?? await createChatProviderForSession(syntheticSession(workspace, manifest));
   assertProvider(manifest, provider);
   const dockerLifecycle = manifest.isolation.backend === "docker" ? new BenchmarkDockerLifecycle(manifest, workspace, runId, options.dockerProcessRunner) : undefined;
@@ -67955,7 +68972,7 @@ async function runBenchmark(input, options = {}) {
     session = runtime.updateSession(session.id, {
       toolScope: activeTools.map((tool) => tool.name)
     });
-    const faraiRoot = options.faraiRoot ?? resolve13(import.meta.dir, "..", "..");
+    const faraiRoot = options.faraiRoot ?? resolve14(import.meta.dir, "..", "..");
     const frozen = await freezeRun(manifest, session, activeTools, faraiRoot, provider, dockerState?.agentImageId);
     const promptPromise = runtime.prompt(session, manifest.challenge.prompt).then((result2) => {
       response = result2.response;
@@ -68086,13 +69103,13 @@ function assertExecutableIsolation(manifest) {
   }
 }
 function assertCleanWorkspace(workspace) {
-  const entries = readdirSync13(workspace);
+  const entries = readdirSync14(workspace);
   if (entries.length)
     throw new Error(`benchmark workspace must be an empty scratch directory: ${workspace}`);
 }
 function assertArtifactsOutsideWorkspace(workspace, artifactsRoot) {
-  const difference = relative13(resolve13(workspace), resolve13(artifactsRoot));
-  const reverse = relative13(resolve13(artifactsRoot), resolve13(workspace));
+  const difference = relative13(resolve14(workspace), resolve14(artifactsRoot));
+  const reverse = relative13(resolve14(artifactsRoot), resolve14(workspace));
   if (!difference || !difference.startsWith("..") || !reverse.startsWith("..")) {
     throw new Error("benchmark artifacts directory must be outside the scratch workspace");
   }
@@ -68189,18 +69206,18 @@ function collectRunData(runtime, rootSessionId) {
   };
 }
 function stageFiles(manifest, workspace) {
-  const root = resolve13(workspace);
-  const workspaceStat = lstatSync12(root);
+  const root = resolve14(workspace);
+  const workspaceStat = lstatSync13(root);
   if (!workspaceStat.isDirectory() || workspaceStat.isSymbolicLink())
     throw new Error("benchmark workspace must be a real directory");
   const inputs = (manifest.files ?? []).map((file) => {
-    const source = resolve13(file.source);
-    if (!existsSync26(source))
+    const source = resolve14(file.source);
+    if (!existsSync29(source))
       throw new Error(`benchmark input does not exist: ${file.source}`);
     const expectedHash = file.sha256?.toLowerCase() ?? hashPath(source);
     if (hashPath(source) !== expectedHash)
       throw new Error(`benchmark input hash mismatch: ${file.source}`);
-    const target = resolve13(root, file.destination);
+    const target = resolve14(root, file.destination);
     if (!isDescendantPath(relative13(root, target)))
       throw new Error(`benchmark destination escapes scratch workspace: ${file.destination}`);
     return {
@@ -68222,10 +69239,10 @@ function stageFiles(manifest, workspace) {
   const createdDirectories = [];
   try {
     for (const input of inputs) {
-      ensureStagingParent(root, dirname12(input.target), createdDirectories);
-      const staged = join35(dirname12(input.target), `.${randomUUID10()}.farai-stage`);
+      ensureStagingParent(root, dirname13(input.target), createdDirectories);
+      const staged = join37(dirname13(input.target), `.${randomUUID11()}.farai-stage`);
       try {
-        const sourceStat = lstatSync12(input.source);
+        const sourceStat = lstatSync13(input.source);
         cpSync(input.source, staged, {
           recursive: sourceStat.isDirectory(),
           dereference: false,
@@ -68237,14 +69254,14 @@ function stageFiles(manifest, workspace) {
           throw new Error(`benchmark input was not staged: ${input.file.destination}`);
         if (hashPath(staged) !== input.expectedHash)
           throw new Error(`benchmark input changed while staging: ${input.file.source}`);
-        if (lstatSync12(staged).isDirectory() && !listFiles2(staged).length)
+        if (lstatSync13(staged).isDirectory() && !listFiles2(staged).length)
           throw new Error(`benchmark input staged an empty directory: ${input.file.destination}`);
         if (pathExists(input.target))
           throw new Error(`benchmark destinations must not overlap: ${input.file.destination}`);
-        renameSync8(staged, input.target);
+        renameSync9(staged, input.target);
         published.push(input.target);
       } finally {
-        rmSync10(staged, {
+        rmSync11(staged, {
           recursive: true,
           force: true
         });
@@ -68252,7 +69269,7 @@ function stageFiles(manifest, workspace) {
     }
   } catch (error) {
     for (const target of published.reverse())
-      rmSync10(target, {
+      rmSync11(target, {
         recursive: true,
         force: true
       });
@@ -68272,42 +69289,42 @@ function pathsOverlap(left, right) {
   return isDescendantPath(leftToRight) || isDescendantPath(rightToLeft);
 }
 function isDescendantPath(value) {
-  return Boolean(value) && value !== ".." && !value.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && !isAbsolute10(value);
+  return Boolean(value) && value !== ".." && !value.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && !isAbsolute11(value);
 }
 function listFiles2(rootPath) {
-  if (!existsSync26(rootPath))
+  if (!existsSync29(rootPath))
     return [];
-  const stat = lstatSync12(rootPath);
+  const stat = lstatSync13(rootPath);
   if (stat.isFile())
     return [rootPath];
   if (!stat.isDirectory())
     throw new Error(`unsupported staged benchmark input type: ${rootPath}`);
-  return readdirSync13(rootPath).flatMap((name) => listFiles2(join35(rootPath, name)));
+  return readdirSync14(rootPath).flatMap((name) => listFiles2(join37(rootPath, name)));
 }
 function ensureStagingParent(workspace, parent, createdDirectories) {
-  const root = resolve13(workspace);
-  const local = relative13(root, resolve13(parent));
+  const root = resolve14(workspace);
+  const local = relative13(root, resolve14(parent));
   if (local === "")
     return;
   if (!isDescendantPath(local))
     throw new Error("benchmark staging parent escapes scratch workspace");
   let current = root;
   for (const segment of local.split(/[\\/]+/).filter(Boolean)) {
-    current = join35(current, segment);
+    current = join37(current, segment);
     if (!pathExists(current)) {
-      mkdirSync12(current, {
+      mkdirSync13(current, {
         mode: 448
       });
       createdDirectories.push(current);
     }
-    const stat = lstatSync12(current);
+    const stat = lstatSync13(current);
     if (!stat.isDirectory() || stat.isSymbolicLink())
       throw new Error(`benchmark staging parent must be a real directory: ${current}`);
   }
 }
 function pathExists(path) {
   try {
-    lstatSync12(path);
+    lstatSync13(path);
     return true;
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
@@ -68357,7 +69374,7 @@ class BenchmarkHostBackend {
   hostPath(path) {
     if (path === "/workspace")
       return this.workspace;
-    return join35(this.workspace, path.slice("/workspace/".length));
+    return join37(this.workspace, path.slice("/workspace/".length));
   }
 }
 async function freezeRun(manifest, session, tools, faraiRoot, provider, kaliImageId) {
@@ -68505,7 +69522,7 @@ async function validateCandidates(manifest, sources, workspace) {
 }
 async function runOracle(oracle, candidate2, workspace, challengeId) {
   if (oracle.executableSha256) {
-    if (!existsSync26(oracle.command[0]))
+    if (!existsSync29(oracle.command[0]))
       return {
         ok: false,
         error: "oracle executable missing"
@@ -68602,7 +69619,7 @@ var init_runner = __esm(() => {
   init_docker_lifecycle();
   init_hash();
   init_git_state();
-  init_manifest();
+  init_manifest2();
 });
 
 // src/agent-benchmark/suite.ts
@@ -68613,16 +69630,16 @@ __export(exports_suite, {
   normalizeBenchmarkSuiteManifest: () => normalizeBenchmarkSuiteManifest,
   loadBenchmarkSuiteManifest: () => loadBenchmarkSuiteManifest
 });
-import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync4 } from "fs";
+import { mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync4 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
-import { join as join36 } from "path";
+import { join as join38 } from "path";
 async function runBenchmarkSuite(input, options = {}) {
   const manifest = normalizeBenchmarkSuiteManifest(input);
   const campaignId = id();
-  const root = options.artifactsDir ?? mkdtempSync4(join36(tmpdir5(), "farai-benchmark-campaign-"));
-  const bundlePath = join36(root, `${safeName3(manifest.id)}-${campaignId}`);
-  const runsPath = join36(bundlePath, "runs");
-  mkdirSync13(runsPath, {
+  const root = options.artifactsDir ?? mkdtempSync4(join38(tmpdir5(), "farai-benchmark-campaign-"));
+  const bundlePath = join38(root, `${safeName3(manifest.id)}-${campaignId}`);
+  const runsPath = join38(bundlePath, "runs");
+  mkdirSync14(runsPath, {
     recursive: true
   });
   const attempts = [];
@@ -68715,9 +69732,9 @@ async function runBenchmarkSuite(input, options = {}) {
       error: outcome.error
     })
   };
-  atomicWriteFile(join36(bundlePath, "campaign.json"), `${JSON.stringify(result, null, 2)}
+  atomicWriteFile(join38(bundlePath, "campaign.json"), `${JSON.stringify(result, null, 2)}
 `, 384);
-  atomicWriteFile(join36(bundlePath, "suite.sha256"), `${result.manifestHash}
+  atomicWriteFile(join38(bundlePath, "suite.sha256"), `${result.manifestHash}
 `, 384);
   return result;
 }
@@ -68758,7 +69775,7 @@ function safeName3(value) {
 var init_suite = __esm(() => {
   init_atomic_file();
   init_hash();
-  init_manifest();
+  init_manifest2();
   init_runner();
 });
 
@@ -68773,6 +69790,7 @@ init_global_config();
 init_config();
 init_branding();
 init_version();
+init_session_catalog();
 
 // src/cli/command-arguments.ts
 init_model_provider_validation();
@@ -68781,6 +69799,16 @@ function parseNoArguments(command, args) {
   if (args.length > 0)
     throw new Error(`${command} does not accept arguments`);
 }
+function parseUpdateArguments(args) {
+  const subcommand = args[0] ?? "status";
+  if (subcommand !== "check" && subcommand !== "apply" && subcommand !== "status" && subcommand !== "rollback") {
+    throw new Error(`unknown update command: ${subcommand}`);
+  }
+  parseNoArguments(`update ${subcommand}`, args.slice(1));
+  return {
+    kind: subcommand
+  };
+}
 function parseSetupArguments(args) {
   const {
     values,
@@ -69280,6 +70308,13 @@ async function main() {
       ensureDefaultUserConfig();
       console.log(globalConfigPath());
       break;
+    case "update":
+      if (wantsHelp(args2)) {
+        help("update");
+        break;
+      }
+      await updateContent(args2);
+      break;
     default:
       console.error(`unknown command: ${command}`);
       help();
@@ -69311,6 +70346,11 @@ async function doctor() {
   console.log(`kali image: ${backend2.image} (${image.exists ? "exists" : "missing"})`);
   console.log(`kali contract: ${image.contract ?? "missing"}`);
   console.log(`kali capabilities: ${image.contract === KALI_IMAGE_CONTRACT ? "ready" : "rebuild required"}`);
+  const {
+    contentStatus: contentStatus2
+  } = await Promise.resolve().then(() => (init_updater(), exports_updater));
+  const content = contentStatus2();
+  console.log(`content: ${content.active?.version ?? "local fallback"}`);
   console.log(`setup command: farai setup`);
 }
 async function setup(args2) {
@@ -69451,6 +70491,14 @@ async function initLab(args2) {
 }
 async function launchTui(workspace, sessionId) {
   ensureDefaultUserConfig();
+  const {
+    runStartupContentPreflight: runStartupContentPreflight2
+  } = await Promise.resolve().then(() => (init_preflight(), exports_preflight));
+  const effectiveWorkspace = sessionId ? resolveSessionLocation(sessionId)?.workspace ?? workspace : workspace;
+  if (await runStartupContentPreflight2(effectiveWorkspace) === "cancelled") {
+    process.exitCode = 130;
+    return;
+  }
   if (import.meta.path.endsWith(".ts")) {
     const sourceTuiPreload = "@opentui/solid/preload";
     await import(sourceTuiPreload);
@@ -69468,6 +70516,13 @@ async function launchTui(workspace, sessionId) {
     process.exitCode = 1;
   }
 }
+async function updateContent(args2) {
+  const parsed = parseUpdateArguments(args2);
+  const {
+    runContentUpdateCommand: runContentUpdateCommand2
+  } = await Promise.resolve().then(() => (init_command2(), exports_command2));
+  process.exitCode = await runContentUpdateCommand2(parsed, process.cwd());
+}
 async function run2(args2) {
   const {
     sessionId,
@@ -69633,7 +70688,14 @@ Usage:
     config: `Farai config
 
 Usage:
-  farai config`
+  farai config`,
+    update: `Farai update
+
+Usage:
+  farai update status
+  farai update check
+  farai update apply
+  farai update rollback`
   };
   if (topic && !pages[topic])
     throw new Error(`unknown help topic: ${topic}`);
@@ -69651,6 +70713,7 @@ Usage:
   farai bench run <manifest.json> [--output result.json] [--workspace scratch-dir] [--artifacts dir]
   farai bench suite <suite.json> [--artifacts dir]
   farai config
+  farai update [status|check|apply|rollback]
 
 settings live in ~/.local/pajarori/farai/config.toml; credentials use the system keyring.
 
@@ -69664,5 +70727,5 @@ Examples:
 `);
 }
 
-//# debugId=C611ADC20CC5D27764756E2164756E21
+//# debugId=59D0DF40CE3D0BDB64756E2164756E21
 //# sourceMappingURL=index.js.map