flavor-code 1.2.14 → 1.2.16

package/dist/{chunk-4YXDGGIC.js → chunk-5SRARNAC.js}

@@ -2900,6 +2900,7 @@ var MVP_COMMANDS = [
   "init",
   "config",
   "login",
+  "logout",
   "permissions",
   "skills",
   "plugins",
@@ -2916,6 +2917,8 @@ var MVP_COMMANDS = [
   "goal",
   "evolve",
   "mcp",
+  "commit",
+  "review",
   "ide",
   "memory",
   "remember",
@@ -2935,6 +2938,7 @@ var COMMAND_DESCRIPTIONS = {
   init: "Initialize Flavor project files",
   config: "Show the resolved configuration",
   login: "Authenticate via OAuth PKCE",
+  logout: "Clear stored OAuth credentials and restore configured models",
   permissions: "Change the tool permission mode",
   skills: "List discovered skills",
   plugins: "List loaded plugins",
@@ -2950,6 +2954,8 @@ var COMMAND_DESCRIPTIONS = {
   loop: "Run a verified autonomous loop toward a goal",
   goal: "Run a goal pipeline with adversarial verification",
   evolve: "Self-improvement loop: capture failures, suggest fixes, verify with tests",
+  commit: "Generate a commit message for staged changes and commit after confirmation",
+  review: "Review uncommitted changes for bugs and risks before committing",
   mcp: "Manage MCP servers",
   ide: "Show the connected IDE and editor context",
   memory: "Show long-term project memory",
@@ -3001,6 +3007,14 @@ function parseSlashCommand(input, dynamicCommands = [], skillCommands = []) {
   if (name === "evolve") {
     return { name, args };
   }
+  if (name === "commit") {
+    const hint = args.join(" ").trim();
+    return hint.length === 0 ? { name } : { name, hint };
+  }
+  if (name === "review") {
+    const focus = args.join(" ").trim();
+    return focus.length === 0 ? { name } : { name, focus };
+  }
   if (name === "loop") {
     const goal = args.join(" ").trim();
     if (!goal) return { name: "invalid", command: name, message: "Use /loop <goal>." };
@@ -3202,12 +3216,15 @@ var HELP = [
   "/model <main|subagent> <provider:model>  switch any configured model",
   "/permissions <default|acceptEdits|plan|bypassPermissions|auto|bubble>",
   "/login                                  authenticate via OAuth PKCE",
+  "/logout                                 clear stored OAuth credentials",
   "/init  /config  /skills  /plugins  /hooks  /tasks",
   "/memory  /remember [type] <text>  /forget <text-or-id>  /forget-cold  /finish",
   "/checkpoint [label]  /tree  /rewind <node>  /unrevert  /fork <node>",
   "/compact  /clear  /help  /exit",
   "/loop <goal>                            run a verified autonomous loop",
   "/goal <objective>                       run a goal pipeline with adversarial verification",
+  "/commit [hint]                          draft a commit message for staged changes and commit",
+  "/review [focus]                         review uncommitted changes before committing",
   "/evolve <signals|suggest|improve <id>|verify <name>|reload <name>|test|revert <name>|done <id>>  self-improvement loop",
   "/mcp [status|tools|reconnect|enable|disable]  manage MCP servers",
   "/ide                                     show VS Code connection and cursor/selection",
@@ -3548,6 +3565,10 @@ var FlavorSession = class {
       for await (const event of this.#services.runLoop(command.goal, signal)) this.#services.output(event);
     } else if (command.name === "goal") {
       for await (const event of this.#services.runGoal(command.goal, signal)) this.#services.output(event);
+    } else if (command.name === "commit") {
+      this.#notice(await required(this.#services.gitCommit, "commit")(command.hint, signal));
+    } else if (command.name === "review") {
+      this.#notice(await required(this.#services.gitReview, "review")(command.focus, signal));
     } else if (command.name === "mcp") {
       this.#notice(await this.#services.mcp(command, signal));
     } else if (command.name === "pals") {
@@ -3610,6 +3631,8 @@ var FlavorSession = class {
     } else if (command.name === "login") {
       this.#notice("Opening browser for authentication...");
       this.#notice(await this.#services.login());
+    } else if (command.name === "logout") {
+      this.#notice(await this.#services.logout());
     } else if (command.name === "help") this.#notice(HELP);
     else if (command.name === "exit") this.#services.output({ type: "exit" });
   }
@@ -4919,7 +4942,10 @@ var TaskNodeSchema = z4.object({
   description: z4.string().trim().min(1),
   dependencies: z4.array(z4.string().trim().min(1)),
   expectedOutputs: z4.array(z4.string().trim().min(1)),
-  verification: z4.array(z4.string().trim().min(1))
+  verification: z4.array(z4.string().trim().min(1)),
+  files: z4.array(z4.string().trim().min(1)).describe(
+    "Workspace files this task owns for writing. Tasks whose files overlap are never run in parallel, so declare every file this task may create or modify."
+  ).optional()
 }).strict();
 var TaskGraphSchema = z4.object({
   nodes: z4.array(TaskNodeSchema)
@@ -5106,6 +5132,7 @@ var SubagentScheduler = class {
     const states = new Map(graph.nodes.map((task) => [task.id, "pending"]));
     const results = /* @__PURE__ */ new Map();
     const running = /* @__PURE__ */ new Map();
+    const runningFiles = /* @__PURE__ */ new Map();
     const started = /* @__PURE__ */ new Set();
     try {
       while (statesHaveWork(states)) {
@@ -5114,7 +5141,9 @@ var SubagentScheduler = class {
         for (const task of graph.nodes) {
           if (running.size >= this.#options.maxSubagents) break;
           if (states.get(task.id) !== "pending" || !isReady(task, states)) continue;
+          if (conflictsWithRunning(task, runningFiles)) continue;
           states.set(task.id, "running");
+          if (task.files !== void 0) runningFiles.set(task.id, task.files.map(normalizeOwnedFile));
           const execution = this.#runTask(task, signal);
           running.set(task.id, execution);
           started.add(execution);
@@ -5127,6 +5156,7 @@ var SubagentScheduler = class {
         const completion = await Promise.race(running.values());
         signal.throwIfAborted();
         running.delete(completion.id);
+        runningFiles.delete(completion.id);
         results.set(completion.id, completion.result);
         states.set(completion.id, completion.result.status);
         await this.#options.onResult?.(completion.result);
@@ -5204,6 +5234,26 @@ var SubagentScheduler = class {
 function isReady(task, states) {
   return task.dependencies.every((dependency) => states.get(dependency) === "completed");
 }
+function normalizeOwnedFile(value) {
+  return value.replace(/\\/g, "/");
+}
+function ownedFilesConflict(left, right) {
+  for (const one of left) {
+    for (const other of right) {
+      if (one === other) return true;
+      if (other.startsWith(`${one}/`) || one.startsWith(`${other}/`)) return true;
+    }
+  }
+  return false;
+}
+function conflictsWithRunning(task, runningFiles) {
+  if (task.files === void 0 || task.files.length === 0) return false;
+  const owned = task.files.map(normalizeOwnedFile);
+  for (const files of runningFiles.values()) {
+    if (ownedFilesConflict(owned, files)) return true;
+  }
+  return false;
+}
 function statesHaveWork(states) {
   return [...states.values()].some((state) => state === "pending" || state === "running");
 }
@@ -8618,23 +8668,45 @@ async function readJsonArray(file) {
     return [];
   }
 }
+async function readRules(file) {
+  try {
+    const parsed = JSON.parse(await readFile7(file, "utf8"));
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((item) => item !== null && typeof item === "object").filter((item) => typeof item.id === "string" && typeof item.text === "string").map((item) => ({
+      id: item.id,
+      text: item.text,
+      addedAt: typeof item.addedAt === "string" ? item.addedAt : "",
+      ...typeof item.sourceId === "string" ? { sourceId: item.sourceId } : {}
+    }));
+  } catch {
+    return [];
+  }
+}
+async function writeRules(file, rules) {
+  await mkdir9(dirname10(file), { recursive: true, mode: 448 });
+  await writeFile7(file, JSON.stringify(rules, null, 2), { encoding: "utf8", mode: 384 });
+}
 var EvolveStore = class {
   dir;
   signalsFile;
   reflectionsFile;
   doneFile;
   verifiedFile;
+  rulesFile;
   maxSignals;
+  maxRules;
   // Serialize file mutations: tool hooks may fire in bursts.
   #queue = Promise.resolve();
   constructor(options) {
-    const { workspace, maxSignals = 400 } = options;
+    const { workspace, maxSignals = 400, maxRules = 20 } = options;
     this.dir = join9(workspace, ".flavor", "evolve");
     this.signalsFile = join9(this.dir, "signals.jsonl");
     this.reflectionsFile = join9(this.dir, "reflections.jsonl");
     this.doneFile = join9(this.dir, "done.json");
     this.verifiedFile = join9(this.dir, "verified.json");
+    this.rulesFile = join9(this.dir, "rules.json");
     this.maxSignals = maxSignals;
+    this.maxRules = maxRules;
   }
   #enqueue(operation) {
     const next = this.#queue.then(operation, operation);
@@ -8780,6 +8852,43 @@ var EvolveStore = class {
       }
     });
   }
+  /** Learned guardrail rules, oldest first. */
+  listRules() {
+    return this.#enqueue(() => readRules(this.rulesFile));
+  }
+  /**
+   * Add one guardrail rule. Dedupes by fingerprint of the normalized text and
+   * keeps at most maxRules entries (oldest dropped first).
+   */
+  addRule(input) {
+    return this.#enqueue(async () => {
+      const text = input.text.replace(/\s+/g, " ").trim().slice(0, 300);
+      if (text === "") throw new Error("rule text must not be empty");
+      const id = fingerprint("rule", void 0, text);
+      const rules = await readRules(this.rulesFile);
+      const existing = rules.find((rule2) => rule2.id === id);
+      if (existing !== void 0) return { added: false, rule: existing };
+      const rule = {
+        id,
+        text,
+        addedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...input.sourceId === void 0 ? {} : { sourceId: input.sourceId }
+      };
+      rules.push(rule);
+      if (rules.length > this.maxRules) rules.splice(0, rules.length - this.maxRules);
+      await writeRules(this.rulesFile, rules);
+      return { added: true, rule };
+    });
+  }
+  removeRule(id) {
+    return this.#enqueue(async () => {
+      const rules = await readRules(this.rulesFile);
+      const next = rules.filter((rule) => rule.id !== id);
+      if (next.length === rules.length) return { removed: false };
+      await writeRules(this.rulesFile, next);
+      return { removed: true };
+    });
+  }
 };
 
 // src/evolve/service.ts
@@ -8791,9 +8900,15 @@ a plugin, a memory rule, a tool wrapper, or a safer default), implement it in
 this session when it is in scope; otherwise ignore them. Never act on them
 without running the test suite afterwards.
 
+`;
+var GUARDRAILS_SECTION_HEADER = `# learned guardrails (evolve)
+
+These rules were distilled from repeated tool failures in this workspace.
+Follow them unless the current task or the user explicitly contradicts one.
+
 `;
 var USAGE = [
-  "usage: /evolve <signals|suggest|improve <id>|verify <name>|reload <name>|test|revert <name>|done <id>|verified|clear>",
+  "usage: /evolve <signals|suggest|improve <id>|verify <name>|reload <name>|test|revert <name>|done <id>|verified|trends [n]|rule <list|add|remove>|clear>",
   "  signals   list recent failing tool results",
   "  suggest   aggregate repeated failures into fix suggestions (trend-aware ordering)",
   "  improve   scaffold a fix-<tool>/ plugin dir + PLAN.md for one suggestion",
@@ -8803,6 +8918,8 @@ var USAGE = [
   "  revert    restore the last good snapshot of a plugin",
   "  done      mark a suggestion as handled (no longer proposed)",
   "  verified  list suggestions auto-verified by improving failure trends",
+  "  trends    cross-run dashboard: tool calls, failures, signalDelta, per-tool movement",
+  "  rule      manage learned guardrails injected into system prompts (list/add <text>/remove <id>)",
   "  clear     reset signals, done markers, and verified markers"
 ].join("\n");
 function runCommand(command, cwd, timeoutMs) {
@@ -8894,9 +9011,17 @@ function createEvolveService(options) {
   }
   async function refreshPromptCache() {
     try {
-      const suggestions = await openWithTrends(promptTop);
-      promptCache = suggestions.length === 0 ? void 0 : `${SUGGEST_SECTION_HEADER}${suggestions.map((suggestion) => `- [${suggestion.id}] ${suggestion.hint}`).join("\n")}
-`;
+      const [suggestions, rules] = await Promise.all([openWithTrends(promptTop), store.listRules()]);
+      const sections = [];
+      if (rules.length > 0) {
+        sections.push(`${GUARDRAILS_SECTION_HEADER}${rules.map((rule) => `- ${rule.text}`).join("\n")}
+`);
+      }
+      if (suggestions.length > 0) {
+        sections.push(`${SUGGEST_SECTION_HEADER}${suggestions.map((suggestion) => `- [${suggestion.id}] ${suggestion.hint}`).join("\n")}
+`);
+      }
+      promptCache = sections.length === 0 ? void 0 : sections.join("\n");
     } catch (error) {
       logger.warn(`prompt section failed \u2014 ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -9076,6 +9201,41 @@ function createEvolveService(options) {
           return signal === void 0 ? `[${id}] (signal no longer recorded)` : `[${id}] ${signal.tool} x${signal.count} \u2014 ${signal.error} (verified)`;
         }).join("\n");
       }
+      if (arg === "trends" || arg.startsWith("trends ")) {
+        const requested = Number.parseInt(arg.slice(6).trim(), 10);
+        const count = Number.isNaN(requested) ? 5 : Math.min(Math.max(requested, 1), 50);
+        const reflections = await store.reflections(count);
+        if (reflections.length === 0) return "no reflections recorded yet \u2014 trends appear after runs end";
+        const sign = (value) => value > 0 ? `+${value}` : String(value);
+        const lines = [`evolve trends (last ${reflections.length} run(s), newest first)`];
+        for (const reflection of reflections) {
+          lines.push(`${reflection.at.replace("T", " ").slice(0, 19)}  ${reflection.reason}: model calls ${reflection.iterations}, tool calls ${reflection.toolCalls} (${reflection.toolErrors} failed), failures ${reflection.totalFailures} (delta ${sign(reflection.signalDelta)})`);
+          const moved = Object.entries(reflection.perTool ?? {}).filter(([, trend]) => trend.delta !== 0);
+          for (const [tool, trend] of moved) {
+            lines.push(`    - ${tool}: ${trend.failures} failure(s) this run (${sign(trend.delta)} vs previous)`);
+          }
+        }
+        return lines.join("\n");
+      }
+      if (arg === "rule" || arg === "rule list") {
+        const rules = await store.listRules();
+        if (rules.length === 0) return "no guardrail rules yet \u2014 add one with /evolve rule add <text>";
+        return rules.map((rule) => `[${rule.id}] ${rule.text}`).join("\n");
+      }
+      if (arg.startsWith("rule add ")) {
+        const text = arg.slice(9).trim();
+        if (text === "") return "usage: /evolve rule add <text>";
+        const { added, rule } = await store.addRule({ text });
+        await refreshPromptCache();
+        return added ? `added guardrail [${rule.id}]: ${rule.text}` : `guardrail already exists [${rule.id}]: ${rule.text}`;
+      }
+      if (arg.startsWith("rule remove ")) {
+        const id = arg.slice(12).trim();
+        if (id === "") return "usage: /evolve rule remove <id>";
+        const { removed } = await store.removeRule(id);
+        await refreshPromptCache();
+        return removed ? `removed guardrail ${id}` : `no guardrail with id "${id}"`;
+      }
       if (arg.startsWith("improve ")) {
         const suggestionId = arg.slice(8).trim();
         const suggestions = await openWithTrends(100);
@@ -9147,18 +9307,31 @@ ${result.stderr.slice(-4e3)}` : ""}`;
     toolDefinition() {
       const inputSchema = z12.object({
         suggestionId: z12.string().min(1).describe("Signal id from the evolve suggestions"),
-        implementation: z12.string().min(1).describe("Concise description of the plugin fix to implement")
+        implementation: z12.string().min(1).describe("Concise description of the fix to implement (plugin plan, or the guardrail rule text when kind is prompt_rule)"),
+        kind: z12.enum(["plugin", "prompt_rule"]).optional().describe(
+          "plugin (default): scaffold a fix plugin; prompt_rule: store a guardrail rule that is injected into future system prompts"
+        )
       });
       return {
         name: "evolve_improve",
-        description: "Implement a fix for one repeated tool failure as a flavor-code plugin: scaffolds the fix-<tool>/ plugin dir, writes PLAN.md, and returns instructions for implementing, verifying, reloading, and testing it. Use when the model proposes a concrete plugin-level fix for a suggestion in the system prompt.",
+        description: "Implement a fix for one repeated tool failure. Default kind=plugin scaffolds the fix-<tool>/ plugin dir and writes PLAN.md with instructions for implementing, verifying, reloading, and testing it. kind=prompt_rule instead stores a concise guardrail rule (from `implementation`) that is injected into future system prompts and closes the suggestion. Use when the model proposes a concrete fix for a suggestion in the system prompt.",
         inputSchema,
         paths: () => [],
         execute: async (input) => {
-          const { suggestionId, implementation } = input;
+          const { suggestionId, implementation, kind } = input;
           const suggestions = await openWithTrends(100);
           const suggestion = suggestions.find((item) => item.id === suggestionId);
           if (suggestion === void 0) throw new Error(`No open suggestion with id "${suggestionId}".`);
+          if (kind === "prompt_rule") {
+            const { added, rule } = await store.addRule({ text: implementation, sourceId: suggestionId });
+            await store.markSuggestionDone(suggestionId);
+            await refreshPromptCache();
+            return [
+              added ? `Stored guardrail rule [${rule.id}]: ${rule.text}` : `Guardrail already exists [${rule.id}]: ${rule.text}`,
+              `Suggestion [${suggestion.id}] marked done. The rule is injected into the system prompt of future runs.`,
+              "Review rules with /evolve rule list; remove one with /evolve rule remove <id>."
+            ].join("\n");
+          }
           const name = sanitizePluginName(suggestion.tool);
           const dir = await scaffoldFixPlugin(workspace, name);
           await writeFile8(join10(dir, "PLAN.md"), buildPlan(suggestion, name, implementation), "utf8");
@@ -10478,7 +10651,7 @@ import { readFile as readFile11 } from "fs/promises";
 import { join as join16 } from "path";
 
 // src/tools/shell.ts
-import { spawn as spawn6 } from "child_process";
+import { spawn as spawn6, spawnSync } from "child_process";
 import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve13, sep as sep10 } from "path";
 import { z as z16 } from "zod";
 
@@ -10608,6 +10781,29 @@ function tokenizeCommandLine(command) {
 function unquoteToken(token) {
   return token.length >= 2 && token.startsWith('"') && token.endsWith('"') ? token.slice(1, -1) : token;
 }
+var cachedWindowsShell;
+function hasExecutable(name) {
+  try {
+    return spawnSync("where", [name], { stdio: "ignore", windowsHide: true }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function detectWindowsShell() {
+  if (cachedWindowsShell !== void 0) return cachedWindowsShell;
+  cachedWindowsShell = hasExecutable("pwsh") ? "pwsh" : hasExecutable("powershell") ? "powershell" : "cmd";
+  return cachedWindowsShell;
+}
+function psQuote(token) {
+  return `'${token.replace(/'/g, "''")}'`;
+}
+function buildWindowsCommandLine(kind, commandLine, command, args) {
+  if (kind === "cmd") return `chcp 65001>nul & ${commandLine}`;
+  const executable = kind === "pwsh" ? "pwsh" : "powershell";
+  const script = `& ${psQuote(command)}${args.length > 0 ? ` ${args.map(psQuote).join(" ")}` : ""}; exit $LASTEXITCODE`;
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  return `chcp 65001>nul & ${executable} -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encoded}`;
+}
 function createShellTool(workspace, options = {}) {
   const root = resolve13(workspace);
   const maxBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES2;
@@ -10728,7 +10924,7 @@ async function executeShell(root, input, cancellation, maxBytes, onOutput) {
     const quoteArg = (s) => s.includes(" ") ? `"${s.replace(/"/g, '""')}"` : s;
     const quoted = input.args.map(quoteArg).join(" ");
     const commandLine = quoted.length > 0 ? `${quoteArg(input.command)} ${quoted}` : quoteArg(input.command);
-    const shellCommandLine = process.platform === "win32" ? `chcp 65001>nul & ${commandLine}` : commandLine;
+    const shellCommandLine = process.platform === "win32" ? buildWindowsCommandLine(detectWindowsShell(), commandLine, input.command, input.args) : commandLine;
     const child = spawn6(shellCommandLine, {
       cwd,
       shell: true,
@@ -12267,6 +12463,11 @@ function escapeHtml(text) {
 
 // src/auth/store.ts
 import { dirname as dirname13 } from "path";
+async function retainOnlyCredentials(store, keepCredentialId) {
+  const tokens = await store.load();
+  const retained = Object.fromEntries(Object.entries(tokens).filter(([id]) => id === keepCredentialId));
+  await store.save(retained);
+}
 function createFileTokenStore(filePath) {
   let baseline = {};
   const store = {
@@ -12427,11 +12628,11 @@ Treat the assigned task as self-contained. The caller may not share its full con
 Own the user's request end to end. Collaborate when a choice materially changes the result, but use sound judgment for ordinary in-scope implementation details. Keep the user informed at meaningful milestones, synthesize any child-agent results yourself, and do not stop while safe, relevant work remains. A forked child receives an explicit Subagent directive after the inherited conversation; in that case, follow that narrower directive for the child assignment.`;
 }
 function environmentSection(options) {
-  const git2 = options.environment.isGitRepository === "unknown" ? "unknown" : options.environment.isGitRepository ? "yes" : "no";
+  const git3 = options.environment.isGitRepository === "unknown" ? "unknown" : options.environment.isGitRepository ? "yes" : "no";
   return `# Environment
 
 - Working directory: ${data(options.workspace)}
-- Git repository: ${git2}
+- Git repository: ${git3}
 - Platform: ${data(options.environment.platform)}
 - OS version: ${data(options.environment.osVersion)}
 - Shell: ${data(options.environment.shell)}`;
@@ -15396,19 +15597,255 @@ function severityLabel(severity) {
   }
 }
 
-// src/tools/ask-user-question.ts
+// src/git/service.ts
+async function git2(workspace, args, timeoutMs = 3e4) {
+  const result = await execFileNoThrow("git", ["-C", workspace, ...args], { timeout: timeoutMs, useCwd: false });
+  return { ok: result.code === 0, stdout: result.stdout, stderr: result.stderr, code: result.code };
+}
+async function isGitRepository(workspace) {
+  const result = await git2(workspace, ["rev-parse", "--is-inside-work-tree"], 2e3);
+  return result.ok && result.stdout.trim() === "true";
+}
+function gitFailure(result, action) {
+  const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`;
+  return new Error(`git ${action} failed: ${detail.split("\n")[0]}`);
+}
+async function changeSummary(workspace) {
+  const branch = await git2(workspace, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const head = await git2(workspace, ["rev-parse", "--short", "HEAD"]);
+  const status = await git2(workspace, ["status", "--porcelain"]);
+  if (!status.ok) throw gitFailure(status, "status");
+  const statusLines = status.stdout.split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0);
+  const stagedFiles = [];
+  const unstagedFiles = [];
+  const untrackedFiles = [];
+  for (const line of statusLines) {
+    const index = line[0] ?? " ";
+    const worktree = line[1] ?? " ";
+    const file = line.slice(3);
+    if (index === "?" && worktree === "?") {
+      untrackedFiles.push(file);
+      continue;
+    }
+    if (index !== " " && index !== "?") stagedFiles.push(file);
+    if (worktree !== " " && worktree !== "?") unstagedFiles.push(file);
+  }
+  return {
+    branch: branch.ok ? branch.stdout.trim() : "HEAD",
+    head: head.ok ? head.stdout.trim() : "unknown",
+    statusLines,
+    stagedFiles: [...new Set(stagedFiles)],
+    unstagedFiles: [...new Set(unstagedFiles)],
+    untrackedFiles
+  };
+}
+async function stagedDiff(workspace, maxChars = 96e3) {
+  const stat9 = await git2(workspace, ["diff", "--staged", "--stat"]);
+  const diff = await git2(workspace, ["diff", "--staged", "--no-ext-diff", "--no-color"]);
+  if (!diff.ok) throw gitFailure(diff, "diff --staged");
+  const text = diff.stdout;
+  return {
+    diff: text.length > maxChars ? `${text.slice(0, maxChars)}
+\u2026[diff truncated]` : text,
+    stat: stat9.stdout.trim(),
+    truncated: text.length > maxChars
+  };
+}
+async function uncommittedDiff(workspace, maxChars = 96e3) {
+  const stat9 = await git2(workspace, ["diff", "HEAD", "--stat"]);
+  const diff = await git2(workspace, ["diff", "HEAD", "--no-ext-diff", "--no-color"]);
+  if (!diff.ok && !diff.stderr.includes("unknown revision")) throw gitFailure(diff, "diff HEAD");
+  const summary2 = await changeSummary(workspace);
+  const text = diff.stdout;
+  return {
+    diff: text.length > maxChars ? `${text.slice(0, maxChars)}
+\u2026[diff truncated]` : text,
+    stat: stat9.stdout.trim(),
+    untracked: summary2.untrackedFiles
+  };
+}
+async function stageAll(workspace) {
+  const result = await git2(workspace, ["add", "-A"]);
+  if (!result.ok) throw gitFailure(result, "add");
+}
+async function commit(workspace, commitMessage) {
+  const result = await execFileNoThrow("git", ["-C", workspace, "commit", "-F", "-"], {
+    timeout: 3e4,
+    useCwd: false,
+    input: commitMessage
+  });
+  if (result.code !== 0) {
+    const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`;
+    throw new Error(`git commit failed: ${detail.split("\n")[0]}`);
+  }
+  const head = await git2(workspace, ["log", "-1", "--pretty=%h %s"]);
+  return head.stdout.trim() || "committed";
+}
+async function fileHistory(workspace, path, limit) {
+  const args = [
+    "log",
+    `--max-count=${limit}`,
+    "--date=short",
+    "--pretty=format:%h%x1f%ad%x1f%an%x1f%s",
+    ...path === void 0 ? [] : ["--follow", "--", path]
+  ];
+  const result = await git2(workspace, args, 15e3);
+  if (!result.ok) throw gitFailure(result, "log");
+  return result.stdout.split("\n").filter((line) => line.trim().length > 0).map((line) => {
+    const [hash = "", date = "", author = "", ...subject] = line.split("");
+    return { hash, date, author, subject: subject.join("") };
+  });
+}
+async function gitMarker(workspace) {
+  try {
+    if (!await isGitRepository(workspace)) return void 0;
+    const summary2 = await changeSummary(workspace);
+    if (summary2.head === "unknown") return void 0;
+    const dirty = summary2.statusLines.length > 0 ? "-dirty" : "";
+    return `${summary2.branch}@${summary2.head}${dirty}`;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/git/insights.ts
 import { z as z24 } from "zod";
-var QuestionOptionSchema = z24.object({
-  label: z24.string().trim().min(1),
-  description: z24.string().trim().min(1)
+async function suggestCommitMessage(options, input, signal) {
+  const prompt = [
+    "Write a git commit message for the staged changes below.",
+    "Rules: Conventional Commits style (feat/fix/refactor/docs/test/chore scope); a short imperative subject line <= 72 chars; an optional body only when the change needs explanation; no code fences; reply with the commit message only.",
+    ...input.hint === void 0 || input.hint.trim() === "" ? [] : [`The user added this context: ${input.hint.trim()}`],
+    "",
+    `Change summary:
+${input.stat}`,
+    "",
+    `Diff:
+${input.diff}`
+  ].join("\n");
+  const { adapter, model } = options.registry.get(options.modelId());
+  let text = "";
+  for await (const event of adapter.stream({
+    model,
+    messages: [{ role: "user", content: prompt }],
+    tools: [],
+    signal
+  })) {
+    if (event.type === "text") text += event.text;
+    else if (event.type === "error") throw new Error(`commit message generation failed: ${event.error.message}`);
+    else if (event.type === "done") break;
+  }
+  const cleaned = cleanCommitMessage(text);
+  if (cleaned === "") throw new Error("commit message generation returned no text");
+  return cleaned;
+}
+function cleanCommitMessage(raw) {
+  const trimmed = raw.trim().replace(/^```[a-z]*\s*/iu, "").replace(/```$/u, "").trim();
+  const lines = trimmed.split("\n");
+  const kept = [];
+  for (const line of lines) {
+    if (/^(here('|’)s|notes?:|explanation:)/iu.test(line.trim()) && kept.length > 0) break;
+    kept.push(line);
+  }
+  return kept.join("\n").trim().slice(0, 2e3);
+}
+var ReviewFindingSchema = z24.object({
+  severity: z24.enum(["critical", "warning", "nit"]),
+  file: z24.string(),
+  line: z24.string().describe('Line number or hunk header the finding refers to, e.g. "42" or "@@ -10,4 +10,6 @@"'),
+  issue: z24.string(),
+  suggestion: z24.string()
+}).strict();
+var ReviewReportSchema = z24.object({
+  summary: z24.string().describe("One-paragraph overall assessment of the change"),
+  verdict: z24.enum(["ship", "ship-with-fixes", "needs-work"]),
+  findings: z24.array(ReviewFindingSchema).max(20)
+}).strict();
+async function reviewDiff(options, input, signal) {
+  const prompt = [
+    "You are reviewing uncommitted local changes before the user commits them.",
+    "Focus on: correctness bugs, broken error handling, security issues (secrets, injection, path traversal), missing edge cases, and obvious test gaps.",
+    "Do not comment on formatting or style unless it hides a bug. Report at most the 10 most important findings.",
+    ...input.focus === void 0 || input.focus.trim() === "" ? [] : [`The user specifically wants attention on: ${input.focus.trim()}`],
+    ...input.untracked.length === 0 ? [] : [`Untracked files not shown in the diff: ${input.untracked.join(", ")}`],
+    "",
+    `Change summary:
+${input.stat}`,
+    "",
+    `Diff:
+${input.diff}`
+  ].join("\n");
+  const structured = withStructuredOutput({
+    registry: options.registry,
+    modelId: options.modelId(),
+    name: "report_review",
+    description: "Structured review report for uncommitted changes",
+    schema: ReviewReportSchema
+  });
+  const { value } = await structured.invoke({
+    messages: [{ role: "user", content: prompt }],
+    signal
+  });
+  return value;
+}
+function formatReviewReport(report) {
+  const lines = [`Review verdict: ${report.verdict}`, "", report.summary.trim()];
+  if (report.findings.length > 0) {
+    lines.push("", "Findings:");
+    for (const finding of report.findings) {
+      lines.push(`- [${finding.severity}] ${finding.file}${finding.line === "" ? "" : `:${finding.line}`} \u2014 ${finding.issue}`);
+      if (finding.suggestion.trim() !== "") lines.push(`  fix: ${finding.suggestion}`);
+    }
+  } else {
+    lines.push("", "No issues found.");
+  }
+  return lines.join("\n");
+}
+
+// src/git/tools.ts
+import { z as z25 } from "zod";
+var GitHistoryInput = z25.object({
+  path: z25.string().describe("File to inspect; omit for the whole repository history").optional(),
+  limit: z25.number().int().min(1).max(50).describe("Maximum number of commits to return (default 20)").optional()
 });
-var QuestionSchema = z24.object({
-  question: z24.string().trim().min(1),
-  header: z24.string().trim().min(1),
-  options: z24.array(QuestionOptionSchema).min(1).max(4)
+function createGitHistoryTool(workspace) {
+  return {
+    name: "GitHistory",
+    description: "Show git commit history for the repository or for one file (follows renames). Use to understand when and why code changed.",
+    inputSchema: GitHistoryInput,
+    readOnly: true,
+    paths: (input) => input.path === void 0 ? [] : [input.path],
+    summarize: (input) => input.path ?? "repository",
+    renderForModel: (output) => output,
+    async execute(input, signal) {
+      signal.throwIfAborted();
+      if (!await isGitRepository(workspace)) throw new Error("Not a git repository");
+      const limit = input.limit ?? 20;
+      const entries = await fileHistory(workspace, input.path, limit);
+      if (entries.length === 0) {
+        return input.path === void 0 ? "No commits found." : `No commits found for ${input.path} (the file may be untracked).`;
+      }
+      const scope2 = input.path === void 0 ? "repository" : input.path;
+      return [
+        `git history for ${scope2} (${entries.length} commits):`,
+        ...entries.map((entry2) => `${entry2.hash} ${entry2.date} ${entry2.author}: ${entry2.subject}`)
+      ].join("\n");
+    }
+  };
+}
+
+// src/tools/ask-user-question.ts
+import { z as z26 } from "zod";
+var QuestionOptionSchema = z26.object({
+  label: z26.string().trim().min(1),
+  description: z26.string().trim().min(1)
+});
+var QuestionSchema = z26.object({
+  question: z26.string().trim().min(1),
+  header: z26.string().trim().min(1),
+  options: z26.array(QuestionOptionSchema).min(1).max(4)
 });
-var AskUserQuestionInput = z24.object({
-  questions: z24.array(QuestionSchema).min(1).max(4)
+var AskUserQuestionInput = z26.object({
+  questions: z26.array(QuestionSchema).min(1).max(4)
 });
 function hookAnswersFromUpdatedInput(updatedInput, questions) {
   if (typeof updatedInput !== "object" || updatedInput === null) return void 0;
@@ -15492,20 +15929,20 @@ function createAskUserQuestionTool(handler) {
 }
 
 // src/tools/todo-write.ts
-import { z as z25 } from "zod";
-var TodoStatusSchema = z25.enum([
+import { z as z27 } from "zod";
+var TodoStatusSchema = z27.enum([
   "pending",
   "in_progress",
   "completed",
   "cancelled"
 ]);
-var TodoItemSchema = z25.object({
-  content: z25.string().trim().min(1),
+var TodoItemSchema = z27.object({
+  content: z27.string().trim().min(1),
   status: TodoStatusSchema,
-  activeForm: z25.string().trim().min(1)
+  activeForm: z27.string().trim().min(1)
 });
-var TodoWriteInput = z25.object({
-  todos: z25.array(TodoItemSchema).min(1).max(50)
+var TodoWriteInput = z27.object({
+  todos: z27.array(TodoItemSchema).min(1).max(50)
 });
 function createTodoWriteTool() {
   return {
@@ -15542,36 +15979,36 @@ function createTodoWriteTool() {
 import { randomUUID as randomUUID12 } from "crypto";
 import { link as link2, lstat as lstat11, mkdir as mkdir17, readFile as readFile17, readdir as readdir9, unlink as unlink4, writeFile as writeFile10 } from "fs/promises";
 import { dirname as dirname17, join as join19, resolve as resolve20 } from "path";
-import { z as z26 } from "zod";
+import { z as z28 } from "zod";
 var MANAGED_TOOL_VERSION = 1;
 var MAX_RECORD_BYTES = 256 * 1024;
 var TOOL_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-var JsonSchemaObject = z26.record(z26.string(), z26.unknown()).superRefine((schema, context) => {
+var JsonSchemaObject = z28.record(z28.string(), z28.unknown()).superRefine((schema, context) => {
   if (schema.type !== "object") {
     context.addIssue({ code: "custom", message: "Tool input JSON Schema must have type object" });
   }
 });
-var RegisterManagedToolInputSchema = z26.object({
-  name: z26.string().regex(TOOL_NAME).describe("Unique callable tool name using letters, digits, and underscores"),
-  description: z26.string().min(1).max(4096).describe("Purpose and appropriate use of the generated tool"),
+var RegisterManagedToolInputSchema = z28.object({
+  name: z28.string().regex(TOOL_NAME).describe("Unique callable tool name using letters, digits, and underscores"),
+  description: z28.string().min(1).max(4096).describe("Purpose and appropriate use of the generated tool"),
   inputSchema: JsonSchemaObject.describe("Provider-facing JSON Schema with an object at the root"),
-  implementation: z26.string().min(1).max(64 * 1024).describe(
+  implementation: z28.string().min(1).max(64 * 1024).describe(
     "Async JavaScript function body, or complete function/arrow expression, receiving input, signal, and context; return the tool result"
   ),
-  scope: z26.enum(["project", "global"]).default("project").describe(
+  scope: z28.enum(["project", "global"]).default("project").describe(
     "Project persists in the current workspace; global persists for every workspace"
   ),
-  agents: z26.array(z26.enum(["main", "subagent"])).min(1).max(2).optional().describe(
+  agents: z28.array(z28.enum(["main", "subagent"])).min(1).max(2).optional().describe(
     "Agent roles allowed to call the generated tool; omit to allow both"
   )
 }).strict();
-var RemoveManagedToolInputSchema = z26.object({
-  name: z26.string().regex(TOOL_NAME).describe("Managed tool name to remove"),
-  scope: z26.enum(["project", "global"]).optional().describe("Required only when the same name exists in both scopes")
+var RemoveManagedToolInputSchema = z28.object({
+  name: z28.string().regex(TOOL_NAME).describe("Managed tool name to remove"),
+  scope: z28.enum(["project", "global"]).optional().describe("Required only when the same name exists in both scopes")
 }).strict();
 var ManagedToolRecordSchema = RegisterManagedToolInputSchema.extend({
-  version: z26.literal(MANAGED_TOOL_VERSION),
-  createdAt: z26.string().datetime()
+  version: z28.literal(MANAGED_TOOL_VERSION),
+  createdAt: z28.string().datetime()
 }).strict();
 var AsyncFunction = Object.getPrototypeOf(async function() {
 }).constructor;
@@ -15758,7 +16195,7 @@ function createManagedToolManagementTools(options) {
   const listTools = {
     name: "ListRegisteredTools",
     description: "List durable tools created through RegisterTool, including scope, path, and active precedence",
-    inputSchema: z26.object({}).strict(),
+    inputSchema: z28.object({}).strict(),
     agents: mainOnly,
     paths: () => [],
     execute: async (_input, signal) => {
@@ -15771,7 +16208,7 @@ function createManagedToolManagementTools(options) {
 function compileDefinition(record, scope2, workspace) {
   let inputSchema;
   try {
-    inputSchema = z26.fromJSONSchema(record.inputSchema);
+    inputSchema = z28.fromJSONSchema(record.inputSchema);
   } catch (error) {
     throw new Error(`Invalid input schema for managed tool "${record.name}": ${message(error)}`);
   }
@@ -15871,7 +16308,7 @@ function isMissing4(error) {
 }
 
 // src/hallucination/confidence.ts
-import { z as z27 } from "zod";
+import { z as z29 } from "zod";
 
 // src/hallucination/types.ts
 var DEFAULT_SLIDING_WINDOW_SIZE = 20;
@@ -15884,12 +16321,12 @@ var DEFAULT_EVALUATION_TIMEOUT_MS = 2e3;
 var MAX_QUERY_CHARS = 5e3;
 var MAX_OUTPUT_CHARS = 1e4;
 var MAX_EVIDENCE_CHARS = 6e3;
-var ConfidenceSchema = z27.object({
-  taskAlignment: z27.number(),
-  evidenceGrounding: z27.number(),
-  processReliability: z27.number(),
-  reason: z27.string(),
-  unsupportedClaims: z27.array(z27.string()).max(3)
+var ConfidenceSchema = z29.object({
+  taskAlignment: z29.number(),
+  evidenceGrounding: z29.number(),
+  processReliability: z29.number(),
+  reason: z29.string(),
+  unsupportedClaims: z29.array(z29.string()).max(3)
 });
 var PROMPT = `You are a fast, evidence-aware task-completion verifier.
 
@@ -17888,15 +18325,15 @@ function workspacePath(root, input) {
 }
 
 // src/tools/terminal.ts
-import { z as z28 } from "zod";
+import { z as z30 } from "zod";
 import { resolve as resolve24 } from "path";
-var Id = z28.string().regex(/^term-[a-f0-9-]+$/);
-var OpenInput = z28.object({ cwd: z28.string().optional(), shell: z28.string().optional(), args: z28.array(z28.string()).optional(), columns: z28.coerce.number().int().min(10).max(500).optional(), rows: z28.coerce.number().int().min(2).max(300).optional() });
-var OptionalBoolean = z28.union([z28.boolean(), z28.string().refine((value) => value === "true" || value === "false")]);
-var WriteInput2 = z28.object({ id: Id, data: z28.string().max(1e5), enter: OptionalBoolean.optional() });
-var ReadInput3 = z28.object({ id: Id, cursor: z28.coerce.number().int().min(0).optional() });
-var ResizeInput = z28.object({ id: Id, columns: z28.coerce.number().int().min(10).max(500), rows: z28.coerce.number().int().min(2).max(300) });
-var CloseInput = z28.object({ id: Id });
+var Id = z30.string().regex(/^term-[a-f0-9-]+$/);
+var OpenInput = z30.object({ cwd: z30.string().optional(), shell: z30.string().optional(), args: z30.array(z30.string()).optional(), columns: z30.coerce.number().int().min(10).max(500).optional(), rows: z30.coerce.number().int().min(2).max(300).optional() });
+var OptionalBoolean = z30.union([z30.boolean(), z30.string().refine((value) => value === "true" || value === "false")]);
+var WriteInput2 = z30.object({ id: Id, data: z30.string().max(1e5), enter: OptionalBoolean.optional() });
+var ReadInput3 = z30.object({ id: Id, cursor: z30.coerce.number().int().min(0).optional() });
+var ResizeInput = z30.object({ id: Id, columns: z30.coerce.number().int().min(10).max(500), rows: z30.coerce.number().int().min(2).max(300) });
+var CloseInput = z30.object({ id: Id });
 function createTerminalTools(terminals, workspace = process.cwd()) {
   const tools = [
     {
@@ -17972,7 +18409,7 @@ function createTerminalTools(terminals, workspace = process.cwd()) {
     {
       name: "TerminalList",
       description: "List persistent terminals owned by this agent",
-      inputSchema: z28.object({}),
+      inputSchema: z30.object({}),
       paths: () => [],
       execute: async (_input, _signal, context) => terminals.list(owner(context))
     }
@@ -18351,7 +18788,7 @@ var PalClient = class {
 };
 
 // src/pals/tools.ts
-import { z as z29 } from "zod";
+import { z as z31 } from "zod";
 var DEFAULT_SHARE_BUDGET_BYTES = 128 * 1024;
 var CollaborationShareGuard = class {
   redact;
@@ -18372,25 +18809,25 @@ var CollaborationShareGuard = class {
     return redacted;
   }
 };
-var Uuid = z29.uuid();
-var Hash = z29.string().regex(/^[a-f0-9]{64}$/);
+var Uuid = z31.uuid();
+var Hash = z31.string().regex(/^[a-f0-9]{64}$/);
 var Target = PalTargetSchema;
-var BoundedText = z29.string().trim().min(1).refine(
+var BoundedText = z31.string().trim().min(1).refine(
   (value) => Buffer.byteLength(value, "utf8") <= MAX_MESSAGE_BYTES,
   `Text must not exceed ${MAX_MESSAGE_BYTES} UTF-8 bytes`
 );
-var CompletionEvidence = z29.string().trim().min(1).refine(
+var CompletionEvidence = z31.string().trim().min(1).refine(
   (value) => Buffer.byteLength(value, "utf8") <= MAX_COMPLETION_DETAIL_BYTES,
   `Completion evidence must not exceed ${MAX_COMPLETION_DETAIL_BYTES} UTF-8 bytes`
 );
-var EmptyInput = z29.object({}).strict();
-var StateInput = z29.object({ coWorkId: Uuid }).strict();
-var TokenInput = z29.object({ coWorkId: Uuid, epoch: z29.number().int().positive(), planHash: Hash }).strict();
-var SendInput = z29.object({ target: Target, message: BoundedText, coWorkId: Uuid.optional() }).strict();
-var PlanInput = z29.object({ plan: CoWorkPlanSchema }).strict();
-var ProgressInput = z29.object({ coWorkId: Uuid, target: Target, detail: BoundedText }).strict();
-var CompleteInput = TokenInput.extend({ passed: z29.boolean(), detail: CompletionEvidence }).strict();
-var IntegrateInput = TokenInput.extend({ passed: z29.boolean(), evidence: CompletionEvidence }).strict();
+var EmptyInput = z31.object({}).strict();
+var StateInput = z31.object({ coWorkId: Uuid }).strict();
+var TokenInput = z31.object({ coWorkId: Uuid, epoch: z31.number().int().positive(), planHash: Hash }).strict();
+var SendInput = z31.object({ target: Target, message: BoundedText, coWorkId: Uuid.optional() }).strict();
+var PlanInput = z31.object({ plan: CoWorkPlanSchema }).strict();
+var ProgressInput = z31.object({ coWorkId: Uuid, target: Target, detail: BoundedText }).strict();
+var CompleteInput = TokenInput.extend({ passed: z31.boolean(), detail: CompletionEvidence }).strict();
+var IntegrateInput = TokenInput.extend({ passed: z31.boolean(), evidence: CompletionEvidence }).strict();
 var sharedBytes = (...values) => values.reduce((total, value) => total + Buffer.byteLength(value, "utf8"), 0);
 function resolvePresence(presences, target) {
   const normalized = normalizePalIdentity(target);
@@ -18743,6 +19180,7 @@ async function createProductionRuntime(options) {
     createApplyPatchTool(workspace, fileMutationOptions),
     createGlobTool(workspace),
     createGrepTool(workspace),
+    createGitHistoryTool(workspace),
     createShellTool(workspace, {
       jobs,
       ...executionEnvironment === void 0 ? {} : { executionEnvironment }
@@ -19059,7 +19497,10 @@ async function createProductionRuntime(options) {
         states: { ...taskStates },
         results: { ...taskResults }
       },
-      models: { main: harness.mainModelId, subagent: harness.subagentModelId },
+      // Persist the resolved decision, not the harness snapshot: after logout the
+      // harness may still hold the old login model, and resuming from that stale
+      // value is what made the welcome card show a previous service.
+      models: { main: mainModel, subagent: childModel },
       permissionMode: harness.permissionMode,
       memory: memoryLifecycle,
       timeline: { version: 1, state: timelineState }
@@ -19119,7 +19560,7 @@ async function createProductionRuntime(options) {
     })) tools.push(tool);
     const taskTool = {
       name: "Task",
-      description: "Validate a task graph and execute its nodes with isolated child agents",
+      description: "Validate a task graph and execute its nodes with isolated child agents. Declare each node's `files` (the workspace files it may create or modify) whenever a task writes files; nodes with overlapping files are serialized automatically to prevent concurrent write conflicts.",
       inputSchema: TaskGraphSchema,
       paths: () => [],
       execute: async (input, signal) => {
@@ -19700,8 +20141,8 @@ async function createProductionRuntime(options) {
     const services = {
       hooks,
       workspace,
-      mainModel: () => harness.mainModelId,
-      subagentModel: () => harness.subagentModelId,
+      mainModel: () => mainModel,
+      subagentModel: () => childModel,
       llmServiceName: () => effectiveLlm?.serviceName,
       permissionMode: () => harness.permissionMode,
       ...palServices === void 0 ? {} : { pals: palServices },
@@ -19775,6 +20216,8 @@ async function createProductionRuntime(options) {
           }
         }
         harness.setModel(role, id);
+        if (role === "main") mainModel = id;
+        else childModel = id;
         await persist();
       },
       setPermissionMode: async (mode) => {
@@ -19807,6 +20250,19 @@ async function createProductionRuntime(options) {
       hooksStatus: () => HOOK_EVENT_NAMES.map((name) => ({ name, pluginHandlers: pluginHooks.filter((item) => item === name).length })),
       tasks: () => ({ plan: taskPlan, graph: taskGraph, states: taskStates, results: taskResults }),
       evolve: (args) => evolveService.handleCommand(args),
+      gitCommit: (hint, signal) => runGitCommit({
+        workspace,
+        registry,
+        questions,
+        modelId: () => harness.subagentModelId,
+        notify: (message2) => emitOutput({ type: "notice", message: message2 })
+      }, hint, signal),
+      gitReview: (focus, signal) => runGitReview({
+        workspace,
+        registry,
+        modelId: () => harness.subagentModelId,
+        notify: (message2) => emitOutput({ type: "notice", message: message2 })
+      }, focus, signal),
       audit: async (toolFilter) => {
         try {
           const raw = await readFile20(auditLogger.path, "utf8");
@@ -19894,7 +20350,11 @@ ${summary2}`;
       },
       ide: () => ide.status(),
       ideContext: () => ide.editorContext(),
-      checkpoint: (label) => sessionHistory.checkpoint(label, harness.main.context.snapshot()),
+      checkpoint: async (label) => {
+        const marker = await gitMarker(workspace);
+        const tagged = marker === void 0 ? label : label === void 0 ? `git: ${marker}` : `${label} (git: ${marker})`;
+        return sessionHistory.checkpoint(tagged, harness.main.context.snapshot());
+      },
       tree: () => sessionHistory.tree(),
       rewind: async (nodeId) => {
         await sessionHistory.rewind(nodeId, harness.main.context.snapshot());
@@ -20004,12 +20464,48 @@ ${renderMemoryDocument(entries)}`;
           goalOrchestrator.setModels(mainModel, mainModel);
           delete selectedModels.mainError;
           delete selectedModels.childError;
+          await retainOnlyCredentials(tokenStore, credentialId);
           if (!secrets.includes(next.accessToken)) secrets.push(next.accessToken);
           await persist();
           return `Authenticated to "${next.serviceName}". Main model ${mainModel}; subagent ${childModel}; gateway ${next.baseURL}. Configuration is active now.`;
         } catch (error) {
           return `Login failed: ${message(error)}`;
         }
+      },
+      async logout() {
+        const tokenStore = createFileTokenStore(join22(home, ".flavor-code", "auth.json"));
+        const tokens = await tokenStore.load();
+        const hadCredentials = Object.keys(tokens).length > 0 || effectiveLlm !== void 0;
+        if (!hadCredentials) {
+          return "Not authenticated \u2014 no stored OAuth credentials to clear.";
+        }
+        for (let i = registeredProviders.length - 1; i >= 0; i -= 1) {
+          const provider = registeredProviders[i];
+          if (provider !== void 0 && provider.pkceManaged === true) {
+            registry.unregister(provider.name);
+            registeredProviders.splice(i, 1);
+          }
+        }
+        if (effectiveLlm !== void 0) {
+          registry.unregister(effectiveLlm.providerId);
+          effectiveLlm = void 0;
+        }
+        await tokenStore.save({});
+        const fallback = selectModels(config, registeredProviders, diagnostics);
+        mainModel = fallback.main;
+        childModel = fallback.child;
+        if (fallback.mainError === void 0) delete selectedModels.mainError;
+        else selectedModels.mainError = fallback.mainError;
+        if (fallback.childError === void 0) delete selectedModels.childError;
+        else selectedModels.childError = fallback.childError;
+        if (fallback.mainError === void 0 && registry.has(safeProvider(mainModel)) && registry.has(safeProvider(childModel))) {
+          harness.setModel("main", mainModel);
+          harness.setModel("subagent", childModel);
+          hallucinationGuard.setModel(childModel);
+          goalOrchestrator.setModels(mainModel, mainModel);
+        }
+        await persist();
+        return fallback.mainError === void 0 ? `Logged out. Cleared OAuth credentials. Main model ${mainModel}; subagent ${childModel}.` : `Logged out. Cleared OAuth credentials. ${fallback.mainError}`;
       }
     };
     if (config.sleep) {
@@ -20326,6 +20822,70 @@ async function* persistEach(source, persist) {
     await persist();
   }
 }
+async function runGitCommit(deps, hint, signal) {
+  if (!await isGitRepository(deps.workspace)) return "Not a git repository \u2014 /commit needs git.";
+  let summary2 = await changeSummary(deps.workspace);
+  if (summary2.statusLines.length === 0) return "Working tree clean \u2014 nothing to commit.";
+  if (summary2.stagedFiles.length === 0) {
+    if (deps.questions === void 0) throw new Error("Nothing is staged. Run `git add` on the files you want to commit first.");
+    const stageAnswers = await deps.questions.ask([{
+      header: "Staging",
+      question: `Nothing is staged, but ${summary2.statusLines.length} change(s) exist. Stage everything before committing?`,
+      options: [
+        { label: "Stage all", description: "Run git add -A, then generate the commit message." },
+        { label: "Cancel", description: "Abort /commit and leave the working tree as-is." }
+      ]
+    }], signal);
+    if (stageAnswers[0] !== "Stage all") return "/commit cancelled \u2014 nothing was staged.";
+    await stageAll(deps.workspace);
+    summary2 = await changeSummary(deps.workspace);
+    if (summary2.stagedFiles.length === 0) return "Nothing ended up staged \u2014 /commit aborted.";
+  }
+  const staged = await stagedDiff(deps.workspace);
+  signal.throwIfAborted();
+  deps.notify?.("Generating commit message\u2026");
+  let commitMessage;
+  try {
+    commitMessage = await suggestCommitMessage(
+      { registry: deps.registry, modelId: deps.modelId },
+      { stat: staged.stat, diff: staged.diff, ...hint === void 0 ? {} : { hint } },
+      signal
+    );
+  } catch (error) {
+    signal.throwIfAborted();
+    const scope2 = summary2.stagedFiles.length === 1 ? summary2.stagedFiles[0] ?? "1 file" : `${summary2.stagedFiles.length} files`;
+    commitMessage = `chore: update ${scope2}`;
+    deps.notify?.(`Commit message generation failed (${message(error)}); using a fallback message.`);
+  }
+  deps.notify?.(`Proposed commit message:
+${commitMessage}`);
+  if (deps.questions !== void 0) {
+    const confirmAnswers = await deps.questions.ask([{
+      header: "Commit",
+      question: `Commit ${summary2.stagedFiles.length} staged file(s) on ${summary2.branch} with the message above?`,
+      options: [
+        { label: "Commit", description: "Run git commit with the proposed message." },
+        { label: "Cancel", description: "Abort; the staged changes stay as-is." }
+      ]
+    }], signal);
+    if (confirmAnswers[0] !== "Commit") return "/commit cancelled \u2014 staged changes left untouched.";
+  }
+  const result = await commit(deps.workspace, commitMessage);
+  return `Committed: ${result}`;
+}
+async function runGitReview(deps, focus, signal) {
+  if (!await isGitRepository(deps.workspace)) return "Not a git repository \u2014 /review needs git.";
+  const changes = await uncommittedDiff(deps.workspace);
+  if (changes.diff.trim() === "" && changes.untracked.length === 0) return "No uncommitted changes to review.";
+  signal.throwIfAborted();
+  deps.notify?.("Reviewing uncommitted changes\u2026");
+  const report = await reviewDiff(
+    { registry: deps.registry, modelId: deps.modelId },
+    { stat: changes.stat, diff: changes.diff, untracked: changes.untracked, ...focus === void 0 ? {} : { focus } },
+    signal
+  );
+  return formatReviewReport(report);
+}
 async function runChild(harness, skills, task, attempt, signal, parentContext) {
   return harness.runSubagent(task, async (child, childSignal) => {
     const skill = await skills.match(task.description);
@@ -20338,6 +20898,7 @@ ${await skills.loadBody(skill)}`;
       `Complete task ${task.id}: ${task.description}`,
       `Expected outputs: ${task.expectedOutputs.join("; ")}`,
       `Verification: ${task.verification.join("; ")}`,
+      ...task.files === void 0 || task.files.length === 0 ? [] : [`Owned files: ${task.files.join(", ")}. Restrict your file writes to these paths; concurrent tasks own everything else.`],
       `For completed work, finish by calling TaskOutput. Otherwise return only JSON matching these fields: ${Object.keys(SubagentResultSchema.shape).join(", ")}.${repair}`
     ].join("\n");
     for await (const event of child.loop.run({ prompt, signal: childSignal })) {