flavor-code 1.2.20 → 1.3.0

package/dist/{chunk-AXLUVJKC.js → chunk-KL4UHJ2Q.js}

@@ -64,12 +64,12 @@ function normalizeProviderError(error) {
 
 // src/utils/async.ts
 function withTimeout(promise, ms) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled) return;
       settled = true;
-      resolve26({ timedOut: true, value: void 0 });
+      resolve28({ timedOut: true, value: void 0 });
     }, ms);
     timer.unref?.();
     promise.then(
@@ -77,7 +77,7 @@ function withTimeout(promise, ms) {
         if (!settled) {
           settled = true;
           clearTimeout(timer);
-          resolve26({ timedOut: false, value });
+          resolve28({ timedOut: false, value });
         }
       },
       (error) => {
@@ -92,13 +92,13 @@ function withTimeout(promise, ms) {
 }
 function awaitWithSignal(promise, signal) {
   signal.throwIfAborted();
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     const onAbort = () => reject(signal.reason);
     signal.addEventListener("abort", onAbort, { once: true });
     promise.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve26(value);
+        resolve28(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -156,12 +156,14 @@ var PermissionEngine = class {
   #workspace;
   #mode;
   #profile;
+  #policy;
   constructor(options) {
     const root = resolve(options.workspace);
     this.#lexicalWorkspace = root;
     this.#workspace = existsSync(root) ? realpathSync.native(root) : root;
     this.#mode = canonicalMode(options.mode ?? "default");
     this.#profile = options.profile ?? "standard";
+    this.#policy = options.policy;
   }
   get mode() {
     return this.#mode;
@@ -176,6 +178,14 @@ var PermissionEngine = class {
     this.#profile = profile;
   }
   decide(request) {
+    const builtIn = this.#builtInDecision(request);
+    if (builtIn.decision === "deny") return builtIn;
+    const policy = this.#policy?.decide(request);
+    if (policy === void 0) return builtIn;
+    if (policy.decision === "allow") return builtIn.decision === "ask" ? policy : builtIn;
+    return policy;
+  }
+  #builtInDecision(request) {
     if (request.tool === "Task") return request.agent === "main" ? { decision: "allow" } : { decision: "deny", reason: "Task delegation is restricted to the main agent" };
     if (CONTROL_TOOLS.has(request.tool)) return { decision: "allow" };
     if (COLLABORATION_CONTROL_TOOLS.has(request.tool)) return request.agent === "main" ? { decision: "allow" } : { decision: "deny", reason: "Cross-instance collaboration is restricted to the main agent" };
@@ -3298,10 +3308,21 @@ var FlavorSession = class {
   #activePlanning = /* @__PURE__ */ new Set();
   #planningIdleWaiters = /* @__PURE__ */ new Set();
   #pendingCoWorkStarts = [];
+  #activeSteeringDurableIds = /* @__PURE__ */ new Set();
+  #durableResumeStarted = false;
   #permissionBaseline;
   #activeSubmission;
   constructor(services) {
     this.#services = services;
+    for (const item of services.durableQueue?.recover() ?? []) {
+      const submission = recoveredSubmission(item.payload);
+      if (submission === void 0) {
+        services.durableQueue?.ack(item.id);
+        continue;
+      }
+      this.#queue.enqueue(item.kind, submission.text);
+      this.#queuedSubmissions[item.kind].push({ ...submission, durableId: item.id });
+    }
   }
   get active() {
     return this.#active !== void 0;
@@ -3311,6 +3332,11 @@ var FlavorSession = class {
   }
   clearQueue() {
     const snapshot4 = this.#queue.clear();
+    for (const kind of ["steer", "followUp"]) {
+      for (const submission of this.#queuedSubmissions[kind]) {
+        if (submission.durableId !== void 0) this.#services.durableQueue?.ack(submission.durableId);
+      }
+    }
     this.#queuedSubmissions.steer.length = 0;
     this.#queuedSubmissions.followUp.length = 0;
     return snapshot4;
@@ -3452,6 +3478,7 @@ var FlavorSession = class {
     }).then(async (decision) => {
       if (decision.additionalContext !== void 0) await this.#services.addContext?.(decision.additionalContext);
       this.#started = true;
+      this.#resumeDurableQueue();
     });
     return this.#startPromise;
   }
@@ -3466,6 +3493,7 @@ var FlavorSession = class {
     const operation = this.#submissionTail.catch(() => {
     }).then(() => this.#runSubmissionChain(submission)).finally(() => {
       this.#pendingSubmissions -= 1;
+      if (this.#pendingSubmissions === 0) this.#resumeDurableQueue();
     });
     this.#submissionTail = operation;
     return operation;
@@ -3476,6 +3504,7 @@ var FlavorSession = class {
     while (pending.length > 0) {
       const submission = pending.shift();
       if (!this.#isSubmissionCurrent(submission) || submission.controlOnly === true) {
+        this.#ackDurable(submission);
         pending.push(...this.#drainMessages("steer"), ...this.#drainMessages("followUp"));
         continue;
       }
@@ -3489,10 +3518,17 @@ var FlavorSession = class {
     const prompt = submission.text;
     await this.start();
     if (this.#closed) throw new Error("Session is closed");
-    if (!this.#isSubmissionCurrent(submission)) return;
+    if (!this.#isSubmissionCurrent(submission)) {
+      this.#ackDurable(submission);
+      return;
+    }
     if (submission.coWorkPlanningKey !== void 0) {
-      if (!await this.#activatePlanningGate(submission.coWorkPlanningKey)) return;
+      if (!await this.#activatePlanningGate(submission.coWorkPlanningKey)) {
+        this.#ackDurable(submission);
+        return;
+      }
     }
+    if (submission.durableId !== void 0) this.#services.durableQueue?.claim(submission.durableId);
     const controller = new AbortController();
     this.#active = controller;
     this.#activeSubmission = submission;
@@ -3519,7 +3555,7 @@ var FlavorSession = class {
       const command = parseSlashCommand(prompt, this.#services.pluginCommands().map(({ name }) => name), skillNames);
       if (command !== null) await this.#dispatch(command, controller.signal);
       else for await (const event of this.#services.run(prompt, controller.signal, {
-        getSteeringMessages: () => this.#drainMessages("steer").map((item) => item.text),
+        getSteeringMessages: () => this.#drainMessages("steer", true).map((item) => item.text),
         ...decision.additionalContext === void 0 ? {} : { additionalContext: decision.additionalContext },
         ...submission.initialUserMessage === void 0 ? {} : { initialUserMessage: submission.initialUserMessage }
       })) {
@@ -3555,6 +3591,8 @@ var FlavorSession = class {
           } catch {
           }
         }
+        this.#ackDurable(submission);
+        this.#ackActiveSteering();
       }
     }
   }
@@ -3708,12 +3746,42 @@ var FlavorSession = class {
     });
   }
   #enqueueMessage(kind, submission) {
+    const durableId = submission.durableId ?? this.#services.durableQueue?.admit(kind, durablePayload(submission));
     this.#queue.enqueue(kind, submission.text);
-    this.#queuedSubmissions[kind].push(submission);
+    this.#queuedSubmissions[kind].push(durableId === void 0 ? submission : { ...submission, durableId });
   }
-  #drainMessages(kind) {
+  #drainMessages(kind, activeSteering = false) {
     const prompts = this.#queue.drain(kind);
-    return prompts.map((prompt) => this.#queuedSubmissions[kind].shift() ?? normalizeRequiredSubmission(prompt));
+    return prompts.map((prompt) => {
+      const submission = this.#queuedSubmissions[kind].shift() ?? normalizeRequiredSubmission(prompt);
+      if (activeSteering && submission.durableId !== void 0) {
+        this.#services.durableQueue?.claim(submission.durableId);
+        this.#activeSteeringDurableIds.add(submission.durableId);
+      }
+      return submission;
+    });
+  }
+  #resumeDurableQueue() {
+    if (this.#durableResumeStarted || this.#closed || this.active || this.#pendingSubmissions > 0) return;
+    if (!this.#queue.hasPending) return;
+    this.#durableResumeStarted = true;
+    const submissions = [...this.#drainMessages("steer"), ...this.#drainMessages("followUp")];
+    if (submissions.length === 0) return;
+    this.#notice("Resuming a queued prompt recovered from the durable harness journal.");
+    for (const submission of submissions) {
+      this.#enqueueNormalizedSubmission(submission).catch((error) => {
+        this.#services.output({ type: "error", error: { code: "unknown", message: message(error) } });
+      });
+    }
+  }
+  #ackDurable(submission) {
+    if (submission.durableId === void 0) return;
+    this.#services.durableQueue?.ack(submission.durableId);
+    this.#activeSteeringDurableIds.delete(submission.durableId);
+  }
+  #ackActiveSteering() {
+    for (const id of this.#activeSteeringDurableIds) this.#services.durableQueue?.ack(id);
+    this.#activeSteeringDurableIds.clear();
   }
   #outputQueuedSubmission(submission) {
     const origin = submission.remoteOrigin;
@@ -3752,9 +3820,9 @@ var FlavorSession = class {
   }
   #waitForPlanningIdle(key) {
     if (!this.#activePlanning.has(key)) return Promise.resolve();
-    return new Promise((resolve26) => {
+    return new Promise((resolve28) => {
       const check = () => {
-        if (!this.#activePlanning.has(key)) resolve26();
+        if (!this.#activePlanning.has(key)) resolve28();
         else this.#planningIdleWaiters.add(check);
       };
       this.#planningIdleWaiters.add(check);
@@ -3808,6 +3876,23 @@ function normalizeRequiredSubmission(input) {
   if (normalized === void 0) throw new Error("Cannot queue an empty message");
   return normalized;
 }
+function durablePayload(submission) {
+  const { durableId: _durableId, ...payload } = submission;
+  return structuredClone(payload);
+}
+function recoveredSubmission(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const input = value;
+  if (typeof input.text !== "string" || input.text.trim().length === 0) return void 0;
+  if (typeof input.displayText !== "string") return void 0;
+  if (input.controlOnly !== void 0 && typeof input.controlOnly !== "boolean") return void 0;
+  if (input.coWorkPlanningKey !== void 0 && typeof input.coWorkPlanningKey !== "string") return void 0;
+  if (input.remoteOrigin !== void 0) {
+    const origin = input.remoteOrigin;
+    if (typeof origin.senderId !== "string" || typeof origin.senderAlias !== "string" || typeof origin.prompt !== "string") return void 0;
+  }
+  return structuredClone(input);
+}
 function coWorkKey(coWorkId, epoch) {
   return `${coWorkId}:${epoch}`;
 }
@@ -4085,12 +4170,12 @@ var BrokerStateError = class extends Error {
 };
 var WINDOWS_PIPE_PREFIX = "\\\\.\\pipe\\";
 function canConnect(address) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve28) => {
     const socket = new Socket();
     const finish = (connected) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve26(connected);
+      resolve28(connected);
     };
     socket.once("connect", () => finish(true));
     socket.once("error", () => finish(false));
@@ -4139,7 +4224,7 @@ var PalBrokerServer = class {
     this.authToken ??= await loadOrCreatePalAuthToken(this.authHome === void 0 ? {} : { home: this.authHome });
     try {
       await this.prepareAddress();
-      await new Promise((resolve26, reject) => {
+      await new Promise((resolve28, reject) => {
         const onError = (error) => {
           this.server.off("listening", onListening);
           reject(error);
@@ -4148,7 +4233,7 @@ var PalBrokerServer = class {
           this.server.off("error", onError);
           this.started = true;
           this.ownsAddress = true;
-          resolve26();
+          resolve28();
         };
         this.server.once("error", onError);
         this.server.once("listening", onListening);
@@ -4176,7 +4261,7 @@ var PalBrokerServer = class {
     const ownsAddress = this.ownsAddress;
     for (const connection of this.connections) connection.socket.destroy();
     if (this.started) {
-      await new Promise((resolve26) => this.server.close(() => resolve26()));
+      await new Promise((resolve28) => this.server.close(() => resolve28()));
       this.started = false;
     }
     this.ownsAddress = false;
@@ -4845,15 +4930,15 @@ var PalBrokerState = class {
 // src/pals/broker-cli.ts
 var startupAttempts = /* @__PURE__ */ new Map();
 function delay(milliseconds) {
-  return new Promise((resolve26) => setTimeout(resolve26, milliseconds));
+  return new Promise((resolve28) => setTimeout(resolve28, milliseconds));
 }
 function canConnect2(address) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve28) => {
     const socket = new Socket2();
     const finish = (connected) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve26(connected);
+      resolve28(connected);
     };
     socket.once("connect", () => finish(true));
     socket.once("error", () => finish(false));
@@ -4889,8 +4974,8 @@ async function runPalBroker(options) {
   const sweepIntervalMs = options.sweepIntervalMs ?? 5e3;
   const idleShutdownMs = options.idleShutdownMs ?? 3e4;
   let resolveClosed;
-  const closed = new Promise((resolve26) => {
-    resolveClosed = resolve26;
+  const closed = new Promise((resolve28) => {
+    resolveClosed = resolve28;
   });
   let closing;
   const timer = setInterval(() => {
@@ -4930,10 +5015,10 @@ async function ensureOnce(options) {
 }
 
 // src/production.ts
-import { readFile as readFile20 } from "fs/promises";
-import { createHash as createHash13, randomUUID as randomUUID16 } from "crypto";
+import { readFile as readFile22 } from "fs/promises";
+import { createHash as createHash17, randomUUID as randomUUID18 } from "crypto";
 import { homedir as homedir2, release as osRelease, tmpdir as tmpdir3, version as osVersion } from "os";
-import { basename as basename6, join as join22, relative as relative20, resolve as resolve25, sep as sep19 } from "path";
+import { basename as basename6, join as join24, relative as relative20, resolve as resolve27, sep as sep20 } from "path";
 
 // src/agent/subagents.ts
 import { z as z5 } from "zod";
@@ -5475,6 +5560,9 @@ function createTaskPlanTools(options) {
   return [planTool, updateTool];
 }
 
+// src/context/manager.ts
+import { createHash as createHash4, randomUUID as randomUUID6 } from "crypto";
+
 // src/context/compaction.ts
 var DEFAULT_COMPACTION_POLICY = {
   windowTokens: 2e5,
@@ -5686,6 +5774,9 @@ var ContextManager = class _ContextManager {
   #lastCompactProgress;
   #forkPinnedBoundary = false;
   #forkCompactBoundary = false;
+  #epoch;
+  #visibilityLog = [];
+  #activeTransientSystem = /* @__PURE__ */ new Map();
   constructor(options) {
     if (options.compactAtChars !== void 0 && options.compactAtChars <= 0) throw new Error("compactAtChars must be positive");
     if (options.toolOutputChars <= 0) throw new Error("toolOutputChars must be positive");
@@ -5712,6 +5803,7 @@ var ContextManager = class _ContextManager {
     this.#summarize = options.summarize;
     this.#onCompactProgress = options.onCompactProgress;
     this.#hooks = options.hooks;
+    this.#epoch = this.#createEpoch();
   }
   clear() {
     this.#compact = void 0;
@@ -5722,6 +5814,9 @@ var ContextManager = class _ContextManager {
     this.#consecutiveAutoCompactFailures = 0;
     this.#forkPinnedBoundary = false;
     this.#forkCompactBoundary = false;
+    this.#epoch = this.#createEpoch();
+    this.#visibilityLog = [];
+    this.#activeTransientSystem.clear();
   }
   /**
    * Create an isolated child context whose model-visible prefix is identical to
@@ -5748,6 +5843,7 @@ var ContextManager = class _ContextManager {
       hooks: options.hooks ?? this.#hooks
     });
     child.#compact = this.#compact === void 0 ? void 0 : { ...this.#compact };
+    child.#epoch = cloneEpoch(this.#epoch);
     child.#messages = this.#messages.map((message2) => {
       const { cacheBreakpoint: _cacheBreakpoint, ...copy } = cloneForkMessage(message2);
       return copy;
@@ -5771,9 +5867,70 @@ var ContextManager = class _ContextManager {
   updateTaskState(taskState) {
     this.#taskState = taskState;
   }
+  beginTransientSystem(content) {
+    const id = randomUUID6();
+    const record = {
+      id,
+      role: "system",
+      content,
+      admittedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      scope: "run"
+    };
+    this.#visibilityLog.push(record);
+    this.#activeTransientSystem.set(id, { role: "system", content });
+    return id;
+  }
+  endTransientSystem(id) {
+    this.#activeTransientSystem.delete(id);
+  }
+  /**
+   * Admit dynamic source changes at a model-call savepoint. The stable prefix
+   * remains byte-identical; changes become chronological, persisted system
+   * messages after the cache breakpoint.
+   */
+  refreshContextSources() {
+    const updates = [];
+    const next = this.#resolvedDynamicSources(this.#epoch.sources);
+    let currentStable;
+    try {
+      currentStable = this.#buildStableMessages(this.#epoch.stableMessages);
+    } catch {
+      currentStable = void 0;
+    }
+    const currentStableHash = currentStable === void 0 ? this.#epoch.stableSourceHash : hashMessages(currentStable);
+    if (currentStable !== void 0 && currentStableHash !== this.#epoch.stableSourceHash) {
+      const value = currentStable.map((message2) => message2.content).join("\n\n");
+      if (this.#epoch.sources["system-baseline"] !== value) {
+        updates.push(contextUpdateMessage("system-baseline", value));
+        this.#epoch.sources["system-baseline"] = value;
+      }
+    } else if (currentStable !== void 0 && this.#epoch.sources["system-baseline"] !== void 0) {
+      const value = currentStable.map((message2) => message2.content).join("\n\n");
+      updates.push(contextUpdateMessage("system-baseline", value));
+      delete this.#epoch.sources["system-baseline"];
+    }
+    for (const key of DYNAMIC_SOURCE_ORDER) {
+      const value = next[key];
+      if (value === void 0 || value === this.#epoch.sources[key]) continue;
+      updates.push(contextUpdateMessage(key, displaySourceValue(key, value)));
+      this.#epoch.sources[key] = value;
+    }
+    for (const key of DYNAMIC_SOURCE_ORDER) {
+      if (key in next || !(key in this.#epoch.sources)) continue;
+      updates.push(contextUpdateMessage(key, "(removed)"));
+      delete this.#epoch.sources[key];
+    }
+    if (updates.length === 0) return false;
+    this.#messages.push(...updates);
+    this.#lastRecordedInputTokens = void 0;
+    this.#estimatedTokensAtLastRecordedUsage = void 0;
+    return true;
+  }
   snapshot() {
     return {
       ...this.#compact === void 0 ? {} : { compact: { ...this.#compact } },
+      epoch: cloneEpoch(this.#epoch),
+      ...this.#visibilityLog.length === 0 ? {} : { visibilityLog: this.#visibilityLog.map((item) => ({ ...item })) },
       messages: providerValidMessages(this.#messages)
     };
   }
@@ -5781,6 +5938,9 @@ var ContextManager = class _ContextManager {
     const messages = providerValidMessages(snapshot4.messages);
     const legacySummary = snapshot4.summary?.role === "system" && snapshot4.summary.content.startsWith("Conversation summary\n") ? snapshot4.summary.content.slice("Conversation summary\n".length) : void 0;
     this.#compact = snapshot4.compact === void 0 ? legacySummary === void 0 ? void 0 : { summary: legacySummary, compactedAt: (/* @__PURE__ */ new Date(0)).toISOString() } : { ...snapshot4.compact };
+    if (snapshot4.epoch !== void 0) this.#epoch = cloneEpoch(snapshot4.epoch);
+    this.#visibilityLog = snapshot4.visibilityLog?.map((item) => ({ ...item })) ?? [];
+    this.#activeTransientSystem.clear();
     this.#messages = messages.map((message2) => message2.role === "tool" ? { ...message2, content: truncateToolOutput(message2.content, this.#toolOutputChars) } : cloneMessage2(message2));
     this.#lastRecordedInputTokens = void 0;
     this.#estimatedTokensAtLastRecordedUsage = void 0;
@@ -5798,7 +5958,8 @@ var ContextManager = class _ContextManager {
         content: compactContinuationMessage(this.#compact.summary),
         ...this.#forkCompactBoundary ? { cacheBreakpoint: true } : {}
       }],
-      ...this.#messages.map(cloneMessage2)
+      ...this.#messages.map(cloneMessage2),
+      ...[...this.#activeTransientSystem.values()].map(cloneMessage2)
     ];
   }
   estimatedTokens() {
@@ -5821,6 +5982,7 @@ var ContextManager = class _ContextManager {
   }
   async prepareForModelCall(signal = new AbortController().signal) {
     signal.throwIfAborted();
+    this.refreshContextSources();
     if (!this.needsCompaction()) return false;
     const originalMessages = this.#messages;
     const originalRecordedUsage = this.#lastRecordedInputTokens;
@@ -5914,6 +6076,7 @@ var ContextManager = class _ContextManager {
     this.#reportCompactProgress(90);
     this.#compact = nextCompact;
     this.#messages = nextMessages.map(cloneMessage2);
+    this.#epoch = this.#createEpoch();
     this.#lastRecordedInputTokens = void 0;
     this.#estimatedTokensAtLastRecordedUsage = void 0;
     this.#reportCompactProgress(100);
@@ -5935,11 +6098,33 @@ var ContextManager = class _ContextManager {
     return Math.max(estimated, this.#lastRecordedInputTokens + appendedEstimate);
   }
   #pinnedMessages() {
-    const userMemory = this.#resolvedUserMemory();
+    return [
+      ...this.#epoch.stableMessages.map(cloneMessage2),
+      ...sourceMessages(this.#epoch.sources)
+    ];
+  }
+  #resolvedUserMemory() {
+    const message2 = this.#epoch.stableMessages.find((item) => item.content.startsWith("User memory\n"));
+    return message2?.content.slice("User memory\n".length);
+  }
+  #createEpoch() {
+    const stableMessages = this.#buildStableMessages();
+    const sources = this.#resolvedDynamicSources();
+    return {
+      version: 1,
+      id: randomUUID6(),
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      stableMessages,
+      sources,
+      stableSourceHash: hashMessages(stableMessages)
+    };
+  }
+  #buildStableMessages(fallback = []) {
+    const resolvedUserMemory = tryResolveOptionalSystemSections(this.#userMemory);
+    const fallbackUserMemory = fallback.find((item) => item.content.startsWith("User memory\n"));
+    const userMemory = resolvedUserMemory.available ? resolvedUserMemory.sections?.join("\n\n") : fallbackUserMemory?.content.slice("User memory\n".length);
     const stable = [
       ...resolveSystemSections(this.#system).map((content) => ({ role: "system", content })),
-      // Breakpoint after FLAVOR.md so the byte-stable system prompt plus project
-      // guidance stays cached even when the trailing user memory section changes.
       ...this.#flavor === void 0 ? [] : [{
         role: "system",
         content: `FLAVOR.md
@@ -5949,29 +6134,87 @@ ${this.#flavor}`,
       ...this.#workspaceInstructions === void 0 ? [] : [{
         role: "system",
         content: `Workspace instructions
-${this.#workspaceInstructions}`,
-        cacheBreakpoint: true
+${this.#workspaceInstructions}`
       }],
-      // Stable user preferences close the cacheable prefix.
-      ...userMemory === void 0 ? [] : [{ role: "system", content: `User memory
-${userMemory}` }]
-    ];
-    const dynamic = [
-      ...this.#memory === void 0 ? [] : [{ role: "system", content: `Long-term memory
-${this.#memory}` }],
-      ...this.#taskState === void 0 ? [] : [{ role: "system", content: `Task state
-${this.#taskState}` }],
-      ...this.#volatileSystem === void 0 ? [] : resolveSystemSections(this.#volatileSystem).map((content) => ({ role: "system", content }))
+      ...userMemory === void 0 || userMemory.length === 0 ? [] : [{
+        role: "system",
+        content: `User memory
+${userMemory}`,
+        cacheBreakpoint: true
+      }]
     ];
-    if (dynamic.length > 0 && stable.length > 0) stable[stable.length - 1].cacheBreakpoint = true;
-    return [...stable, ...dynamic];
-  }
-  #resolvedUserMemory() {
-    if (this.#userMemory === void 0) return void 0;
-    const content = resolveSystemSections(this.#userMemory).join("\n\n");
-    return content.length === 0 ? void 0 : content;
+    if (stable.length > 0 && (userMemory === void 0 || userMemory.length === 0)) {
+      stable[stable.length - 1].cacheBreakpoint = true;
+    }
+    return stable;
+  }
+  #resolvedDynamicSources(previous = {}) {
+    const result = {};
+    if (this.#memory !== void 0) result["long-term-memory"] = this.#memory;
+    if (this.#taskState !== void 0) result["task-state"] = this.#taskState;
+    const volatile = tryResolveOptionalSystemSections(this.#volatileSystem);
+    if (!volatile.available && previous["runtime"] !== void 0) result["runtime"] = previous["runtime"];
+    else if (volatile.sections !== void 0 && volatile.sections.length > 0) result["runtime"] = JSON.stringify(volatile.sections);
+    return result;
   }
 };
+var DYNAMIC_SOURCE_ORDER = ["long-term-memory", "task-state", "runtime"];
+function sourceMessages(sources) {
+  return DYNAMIC_SOURCE_ORDER.flatMap((key) => {
+    const content = sources[key];
+    if (content === void 0) return [];
+    if (key === "runtime") {
+      try {
+        const sections = JSON.parse(content);
+        if (Array.isArray(sections) && sections.every((item) => typeof item === "string")) {
+          return sections.map((item) => ({ role: "system", content: item }));
+        }
+      } catch {
+      }
+    }
+    const label = key === "long-term-memory" ? "Long-term memory" : key === "task-state" ? "Task state" : "Runtime";
+    return [{
+      role: "system",
+      content: `${label}
+${content}`
+    }];
+  });
+}
+function displaySourceValue(source, value) {
+  if (source !== "runtime") return value;
+  try {
+    const sections = JSON.parse(value);
+    if (Array.isArray(sections) && sections.every((item) => typeof item === "string")) return sections.join("\n\n");
+  } catch {
+  }
+  return value;
+}
+function contextUpdateMessage(source, content) {
+  return { role: "system", content: `Context update [${source}]
+${content}` };
+}
+function cloneEpoch(epoch) {
+  return {
+    ...epoch,
+    stableMessages: epoch.stableMessages.map((message2) => ({
+      role: "system",
+      content: message2.content,
+      ...message2.cacheBreakpoint === void 0 ? {} : { cacheBreakpoint: message2.cacheBreakpoint }
+    })),
+    sources: { ...epoch.sources }
+  };
+}
+function hashMessages(messages) {
+  return createHash4("sha256").update(JSON.stringify(messages)).digest("hex");
+}
+function tryResolveOptionalSystemSections(source) {
+  if (source === void 0) return { available: true };
+  try {
+    return { available: true, sections: resolveSystemSections(source) };
+  } catch {
+    return { available: false };
+  }
+}
 function resolveSystemSections(source) {
   const resolved = typeof source === "function" ? source() : source;
   const sections = typeof resolved === "string" ? [resolved] : resolved;
@@ -6036,7 +6279,10 @@ function providerValidMessages(input) {
   const availableResults = new Set(input.filter((message2) => message2.role === "tool" && message2.toolCallId).map((message2) => message2.toolCallId));
   const output = [];
   for (const original of input) {
-    if (original.role === "system") continue;
+    if (original.role === "system") {
+      output.push(cloneMessage2(original));
+      continue;
+    }
     if (original.role === "assistant" && original.toolCalls !== void 0) {
       const calls = original.toolCalls.filter((call) => call.id && call.name && availableResults.has(call.id));
       calls.forEach((call) => announced.add(call.id));
@@ -6055,7 +6301,7 @@ function providerValidMessages(input) {
 }
 
 // src/context/workspace-instructions.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { lstat as lstat4, readFile as readFile6, realpath as realpath2 } from "fs/promises";
 import { dirname as dirname9, isAbsolute as isAbsolute4, relative as relative6, resolve as resolve6, sep as sep6 } from "path";
 var NAMES = ["AGENTS.md", "CLAUDE.md", "AGENTS.local.md", "CLAUDE.local.md"];
@@ -6130,7 +6376,7 @@ var WorkspaceInstructions = class {
             path,
             depth: directory.depth,
             content,
-            digest: createHash4("sha256").update(bytes).digest("hex")
+            digest: createHash5("sha256").update(bytes).digest("hex")
           });
         } catch {
         }
@@ -6543,10 +6789,10 @@ function sanitize(message2, secrets) {
 }
 function waitForRetry(delayMs, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve26();
+      resolve28();
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
@@ -6618,6 +6864,15 @@ var AgentLoop = class {
     this.#iterationLimitMode = mode;
   }
   async *run(request) {
+    const transientId = request.additionalContext === void 0 ? void 0 : this.#options.context.beginTransientSystem(request.additionalContext);
+    try {
+      yield* this.#runInternal(request);
+    } finally {
+      if (transientId !== void 0) this.#options.context.endTransientSystem(transientId);
+    }
+  }
+  async *#runInternal(request) {
+    this.#options.context.refreshContextSources();
     this.#options.context.append(request.initialUserMessage ?? { role: "user", content: request.prompt });
     let totalInputTokens = 0;
     let totalOutputTokens = 0;
@@ -6695,10 +6950,7 @@ var AgentLoop = class {
         const { adapter, model } = resolved;
         const modelRequest = {
           model,
-          messages: [
-            ...this.#options.context.messagesForModel(),
-            ...request.additionalContext ? [{ role: "system", content: request.additionalContext }] : []
-          ],
+          messages: this.#options.context.messagesForModel(),
           tools: [...this.#options.tools],
           ...request.signal === void 0 ? {} : { signal: request.signal }
         };
@@ -6724,6 +6976,13 @@ var AgentLoop = class {
         let providerError = false;
         let usage;
         const modelCallId = String(++modelInvocation);
+        const journalModelId = this.#options.modelJournal?.start({
+          agent: this.#options.agent,
+          model: attemptedModelId,
+          iteration,
+          attempt,
+          messages: modelRequest.messages
+        });
         yield { type: "model-start", id: modelCallId };
         try {
           for await (const event of adapter.stream(modelRequest)) {
@@ -6794,6 +7053,9 @@ var AgentLoop = class {
               providerError = false;
             }
           }
+          if (journalModelId !== void 0) {
+            this.#options.modelJournal?.complete(journalModelId, completed, terminalError?.message);
+          }
         }
         yield { type: "model-end", id: modelCallId };
         if (usage !== void 0) {
@@ -7132,10 +7394,10 @@ function serializeToolInput(input) {
 }
 function waitForRetry2(delayMs, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve26();
+      resolve28();
     }, delayMs);
     const onAbort = () => {
       clearTimeout(timer);
@@ -7211,7 +7473,7 @@ function redactClassifierText(value) {
 }
 
 // src/tools/runtime.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import { mkdir as mkdir7, writeFile as writeFile4 } from "fs/promises";
 import { basename as basename2, join as join7, resolve as resolve7 } from "path";
 import { z as z9 } from "zod";
@@ -7252,6 +7514,7 @@ var ToolRuntime = class {
   #workspace;
   #outputLimits;
   #afterSuccess;
+  #journal;
   #turnOutputChars = 0;
   #disposed = false;
   constructor(options) {
@@ -7264,6 +7527,7 @@ var ToolRuntime = class {
     this.#workspace = resolve7(options.workspace ?? process.cwd());
     this.#outputLimits = { ...DEFAULT_TOOL_OUTPUT_LIMITS, ...options.outputLimits };
     this.#afterSuccess = options.afterSuccess;
+    this.#journal = options.journal;
     validateOutputLimit("perToolChars", this.#outputLimits.perToolChars);
     validateOutputLimit("perTurnChars", this.#outputLimits.perTurnChars);
     this.#disposeSchemas = [
@@ -7336,6 +7600,18 @@ var ToolRuntime = class {
     }
   }
   async execute(call, context) {
+    const definition = this.#tools.get(call.name);
+    const journalId = definition === void 0 || this.#journal === void 0 ? void 0 : this.#journal.start(call.name, call.input, definition.retrySafe === true || definition.readOnly === true);
+    try {
+      const result = await this.#execute(call, context);
+      if (journalId !== void 0) this.#journal?.complete(journalId, result);
+      return result;
+    } catch (error) {
+      if (journalId !== void 0) this.#journal?.interrupt(journalId, message(error));
+      throw error;
+    }
+  }
+  async #execute(call, context) {
     const tool = this.#tools.get(call.name);
     if (tool === void 0) return { ok: false, error: { code: "unknown_tool", message: `Unknown tool: ${call.name}` } };
     const signal = context.signal ?? new AbortController().signal;
@@ -7480,7 +7756,7 @@ var ToolRuntime = class {
     this.#turnOutputChars += preview.length;
     const directory = join7(this.#workspace, ".flavor", "tool-results");
     await mkdir7(directory, { recursive: true });
-    const filename2 = `${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID6()}-${safeFilename(tool)}.txt`;
+    const filename2 = `${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID7()}-${safeFilename(tool)}.txt`;
     const savedTo = join7(directory, filename2);
     await writeFile4(savedTo, serialized, "utf8");
     return {
@@ -7505,8 +7781,8 @@ var ToolRuntime = class {
     const limited = await this.#limitOutput(tool, content);
     return typeof limited === "string" ? limited : serializeToolOutput(limited);
   }
-  async #fail(tool, input, agent, code, errorMessage) {
-    const result = { ok: false, error: { code, message: errorMessage } };
+  async #fail(tool, input, agent, code, errorMessage2) {
+    const result = { ok: false, error: { code, message: errorMessage2 } };
     try {
       await this.#hooks.emit({
         version: 1,
@@ -7657,6 +7933,7 @@ var LocalHarness = class {
       workspace: this.#options.workspace,
       ...this.#options.afterToolSuccess === void 0 ? {} : { afterSuccess: this.#options.afterToolSuccess },
       profile: this.#permissionProfile,
+      ...this.#options.permissionPolicy === void 0 ? {} : { policy: this.#options.permissionPolicy },
       mode: this.#options.loopMode ? "bypassPermissions" : agent === "subagent" ? this.#mainPermissions.mode === "plan" ? "plan" : "bubble" : this.#options.permissionMode ?? "default"
     });
     if (agent === "main") this.#mainPermissions = permissions;
@@ -7671,7 +7948,8 @@ var LocalHarness = class {
           registry: this.#options.registry,
           modelId: () => this.#subagentModelId
         })
-      } : {}
+      } : {},
+      ...this.#options.toolJournal === void 0 ? {} : { journal: this.#options.toolJournal }
     });
     try {
       const tools = definitions.map(toModelTool);
@@ -7689,7 +7967,8 @@ var LocalHarness = class {
         ownerId,
         ...maxIterations === void 0 ? {} : { maxIterations },
         ...isMain && this.#options.hasActiveProgress !== void 0 ? { hasActiveProgress: this.#options.hasActiveProgress } : {},
-        ...isMain && this.#options.hallucinationGuard !== void 0 ? { hallucinationGuard: this.#options.hallucinationGuard } : {}
+        ...isMain && this.#options.hallucinationGuard !== void 0 ? { hallucinationGuard: this.#options.hallucinationGuard } : {},
+        ...this.#options.modelJournal === void 0 ? {} : { modelJournal: this.#options.modelJournal }
       });
       loop.setIterationLimitMode(this.#permissionProfile === "d2c" ? "d2c" : "standard");
       return { get modelId() {
@@ -7714,11 +7993,306 @@ function toModelTool(tool) {
   return tool.modelStrict === void 0 ? modelTool : { ...modelTool, strict: tool.modelStrict };
 }
 
+// src/harness/journal.ts
+import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import { closeSync, constants, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync, truncateSync, writeSync } from "fs";
+import { join as join8, relative as relative7, resolve as resolve8, sep as sep7 } from "path";
+import { z as z10 } from "zod";
+
+// src/harness/invariants.ts
+function harnessInvariantViolations(records) {
+  const violations = [];
+  const queues = /* @__PURE__ */ new Set();
+  const tools = /* @__PURE__ */ new Set();
+  const models = /* @__PURE__ */ new Set();
+  const turns = /* @__PURE__ */ new Set();
+  records.forEach((record, index) => {
+    if (record.sequence !== index + 1) violations.push(`sequence ${record.sequence} is not ${index + 1}`);
+    const id = typeof record.payload.id === "string" ? record.payload.id : "";
+    if (record.type === "queue.admitted") {
+      if (queues.has(id)) violations.push(`queue ${id} was admitted twice`);
+      queues.add(id);
+    } else if (record.type === "queue.claimed" || record.type === "queue.released") {
+      if (!queues.has(id)) violations.push(`${record.type} references unknown queue ${id}`);
+    } else if (record.type === "queue.acked") {
+      if (!queues.delete(id)) violations.push(`queue.acked references unknown queue ${id}`);
+    } else if (record.type === "tool.started") {
+      if (tools.has(id)) violations.push(`tool ${id} was started twice`);
+      tools.add(id);
+    } else if (record.type === "tool.completed" || record.type === "tool.interrupted") {
+      if (!tools.delete(id)) violations.push(`${record.type} references unknown tool ${id}`);
+    } else if (record.type === "model.requested") {
+      if (models.has(id)) violations.push(`model ${id} was requested twice`);
+      if (!Array.isArray(record.payload.messages)) violations.push(`model ${id} has no replayable messages`);
+      models.add(id);
+    } else if (record.type === "model.completed") {
+      if (!models.delete(id)) violations.push(`model.completed references unknown model ${id}`);
+    } else if (record.type === "turn.started") {
+      if (turns.has(id)) violations.push(`turn ${id} was started twice`);
+      if (!("prompt" in record.payload)) violations.push(`turn ${id} has no replayable prompt`);
+      turns.add(id);
+    } else if (record.type === "turn.completed" || record.type === "turn.interrupted") {
+      if (!turns.delete(id)) violations.push(`${record.type} references unknown turn ${id}`);
+    }
+  });
+  return violations;
+}
+function assertHarnessInvariants(records) {
+  const violations = harnessInvariantViolations(records);
+  if (violations.length > 0) throw new Error(`Harness invariant violation: ${violations.join("; ")}`);
+}
+
+// src/harness/journal.ts
+var HARNESS_JOURNAL_VERSION = 1;
+var MAX_JOURNAL_BYTES = 32 * 1024 * 1024;
+var QueueKindSchema = z10.enum(["steer", "followUp"]);
+var EventTypeSchema = z10.enum([
+  "queue.admitted",
+  "queue.claimed",
+  "queue.acked",
+  "queue.released",
+  "turn.started",
+  "turn.completed",
+  "turn.interrupted",
+  "model.requested",
+  "model.completed",
+  "tool.started",
+  "tool.completed",
+  "tool.interrupted",
+  "savepoint.created",
+  "recovery.completed"
+]);
+var JournalRecordSchema = z10.object({
+  version: z10.literal(HARNESS_JOURNAL_VERSION),
+  sequence: z10.number().int().positive(),
+  id: z10.string().uuid(),
+  timestamp: z10.string().datetime({ offset: true }),
+  type: EventTypeSchema,
+  payload: z10.record(z10.string(), z10.unknown()),
+  previousHash: z10.string().regex(/^[a-f0-9]{64}$/).nullable(),
+  hash: z10.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var HarnessJournal = class {
+  #path;
+  #now;
+  #maxBytes;
+  #sequence = 0;
+  #lastHash = null;
+  #records = [];
+  constructor(options) {
+    const workspace = resolve8(options.workspace);
+    const directory = join8(workspace, ".flavor", "sessions");
+    assertSessionId(options.sessionId);
+    mkdirSync2(directory, { recursive: true, mode: 448 });
+    assertWithin(workspace, directory);
+    const canonicalWorkspace = realpathSync2.native(workspace);
+    const canonicalDirectory = realpathSync2.native(directory);
+    if (!isWithin2(canonicalWorkspace, canonicalDirectory)) throw new Error("Harness journal directory escapes the workspace");
+    this.#path = join8(canonicalDirectory, `${options.sessionId}.events.jsonl`);
+    this.#now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+    this.#maxBytes = options.maxBytes ?? MAX_JOURNAL_BYTES;
+    if (!Number.isSafeInteger(this.#maxBytes) || this.#maxBytes < 1024) throw new Error("maxBytes must be an integer of at least 1024");
+    this.#load();
+  }
+  get path() {
+    return this.#path;
+  }
+  get records() {
+    return this.#records.map((record) => structuredClone(record));
+  }
+  admitQueue(kind, payload) {
+    QueueKindSchema.parse(kind);
+    const id = randomUUID8();
+    this.#append("queue.admitted", { id, kind, payload });
+    return id;
+  }
+  claimQueue(id) {
+    this.#append("queue.claimed", { id });
+  }
+  ackQueue(id) {
+    this.#append("queue.acked", { id });
+  }
+  releaseQueue(id, reason) {
+    this.#append("queue.released", { id, reason });
+  }
+  startTurn(config, prompt) {
+    const id = randomUUID8();
+    this.#append("turn.started", { id, config: structuredClone(config), configHash: hashJson(config), prompt: structuredClone(prompt), promptHash: hashJson(prompt) });
+    return id;
+  }
+  completeTurn(id) {
+    this.#append("turn.completed", { id });
+  }
+  interruptTurn(id, reason) {
+    this.#append("turn.interrupted", { id, reason });
+  }
+  startModel(input) {
+    const id = randomUUID8();
+    this.#append("model.requested", { id, ...structuredClone(input), messagesHash: hashJson(input.messages) });
+    return id;
+  }
+  completeModel(id, completed, error) {
+    this.#append("model.completed", { id, completed, ...error === void 0 ? {} : { error } });
+  }
+  startTool(tool, input, retrySafe) {
+    const id = randomUUID8();
+    this.#append("tool.started", { id, tool, input: structuredClone(input), inputHash: hashJson(input), retrySafe });
+    return id;
+  }
+  completeTool(id, result) {
+    this.#append("tool.completed", { id, result: structuredClone(result) });
+  }
+  interruptTool(id, reason) {
+    this.#append("tool.interrupted", { id, reason });
+  }
+  savepoint(phase, config) {
+    const id = randomUUID8();
+    this.#append("savepoint.created", { id, phase, configHash: hashJson(config) });
+    return id;
+  }
+  recover() {
+    const queue = /* @__PURE__ */ new Map();
+    const claimed = /* @__PURE__ */ new Set();
+    const tools = /* @__PURE__ */ new Map();
+    const models = /* @__PURE__ */ new Set();
+    const turns = /* @__PURE__ */ new Set();
+    let lastSavepoint;
+    for (const record of this.#records) {
+      const payload = record.payload;
+      const id = typeof payload.id === "string" ? payload.id : "";
+      if (record.type === "queue.admitted") {
+        const kind = QueueKindSchema.parse(payload.kind);
+        queue.set(id, { id, kind, payload: payload.payload, admittedAt: record.timestamp, recovered: false });
+      } else if (record.type === "queue.claimed") claimed.add(id);
+      else if (record.type === "queue.acked") {
+        queue.delete(id);
+        claimed.delete(id);
+      } else if (record.type === "queue.released") claimed.delete(id);
+      else if (record.type === "turn.started") turns.add(id);
+      else if (record.type === "turn.completed" || record.type === "turn.interrupted") turns.delete(id);
+      else if (record.type === "model.requested") models.add(id);
+      else if (record.type === "model.completed") models.delete(id);
+      else if (record.type === "tool.started") tools.set(id, {
+        id,
+        tool: String(payload.tool ?? "unknown"),
+        retrySafe: payload.retrySafe === true,
+        inputHash: String(payload.inputHash ?? "")
+      });
+      else if (record.type === "tool.completed" || record.type === "tool.interrupted") tools.delete(id);
+      else if (record.type === "savepoint.created") lastSavepoint = {
+        id,
+        phase: String(payload.phase ?? "unknown"),
+        configHash: String(payload.configHash ?? "")
+      };
+    }
+    const recovered = [...queue.values()].map((item) => ({ ...item, recovered: claimed.has(item.id) }));
+    return {
+      queue: recovered,
+      incompleteTools: [...tools.values()],
+      incompleteModelIds: [...models],
+      interruptedTurnIds: [...turns],
+      ...lastSavepoint === void 0 ? {} : { lastSavepoint }
+    };
+  }
+  markRecoveryComplete(recovery) {
+    for (const item of recovery.queue) if (item.recovered) this.releaseQueue(item.id, "process-recovery");
+    for (const tool of recovery.incompleteTools) {
+      this.interruptTool(tool.id, tool.retrySafe ? "interrupted by process exit; eligible only for explicit retry" : "interrupted by process exit; automatic replay forbidden");
+    }
+    for (const id of recovery.incompleteModelIds) this.completeModel(id, false, "interrupted by process exit");
+    for (const id of recovery.interruptedTurnIds) this.interruptTurn(id, "interrupted by process exit");
+    this.#append("recovery.completed", {
+      queueItems: recovery.queue.length,
+      interruptedTools: recovery.incompleteTools.length,
+      interruptedModels: recovery.incompleteModelIds.length,
+      interruptedTurns: recovery.interruptedTurnIds.length
+    });
+  }
+  #load() {
+    if (!existsSync2(this.#path)) return;
+    const metadata = statSync(this.#path);
+    if (!metadata.isFile()) throw new Error("Harness journal path is not a regular file");
+    if (metadata.size > this.#maxBytes) throw new Error(`Harness journal exceeds ${this.#maxBytes} bytes`);
+    const raw = readFileSync3(this.#path, "utf8");
+    const committed = raw.endsWith("\n") ? raw : raw.slice(0, Math.max(0, raw.lastIndexOf("\n") + 1));
+    if (committed.length !== raw.length) truncateSync(this.#path, Buffer.byteLength(committed));
+    const lines = committed.split("\n").filter(Boolean);
+    let previousHash = null;
+    for (const line of lines) {
+      const record = JournalRecordSchema.parse(JSON.parse(line));
+      if (record.sequence !== this.#records.length + 1) throw new Error("Harness journal sequence is not contiguous");
+      if (record.previousHash !== previousHash) throw new Error("Harness journal hash chain is broken");
+      if (record.hash !== recordHash(record)) throw new Error("Harness journal record hash is invalid");
+      this.#records.push(record);
+      previousHash = record.hash;
+    }
+    this.#sequence = this.#records.length;
+    this.#lastHash = previousHash;
+    assertHarnessInvariants(this.#records);
+  }
+  #append(type, payload) {
+    const normalizedPayload = jsonSafeRecord(payload);
+    const unsigned = {
+      version: HARNESS_JOURNAL_VERSION,
+      sequence: this.#sequence + 1,
+      id: randomUUID8(),
+      timestamp: this.#now(),
+      type,
+      payload: normalizedPayload,
+      previousHash: this.#lastHash
+    };
+    const record = JournalRecordSchema.parse({ ...unsigned, hash: hashJson(unsigned) });
+    const line = `${JSON.stringify(record)}
+`;
+    const priorBytes = existsSync2(this.#path) ? statSync(this.#path).size : 0;
+    if (priorBytes + Buffer.byteLength(line) > this.#maxBytes) throw new Error(`Harness journal exceeds ${this.#maxBytes} bytes`);
+    const fd = openSync(this.#path, constants.O_CREAT | constants.O_APPEND | constants.O_WRONLY, 384);
+    try {
+      writeSync(fd, line, void 0, "utf8");
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    this.#records.push(record);
+    this.#sequence = record.sequence;
+    this.#lastHash = record.hash;
+  }
+};
+function jsonSafeRecord(value) {
+  const json = JSON.stringify(value, (_key, item) => typeof item === "bigint" ? `${item}n` : item);
+  return JSON.parse(json);
+}
+function hashJson(value) {
+  return createHash6("sha256").update(stableJson(value)).digest("hex");
+}
+function recordHash(record) {
+  const { hash: _hash, ...unsigned } = record;
+  return hashJson(unsigned);
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    const object = value;
+    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? String(value);
+}
+function assertSessionId(value) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value)) throw new Error("Invalid session id");
+}
+function assertWithin(root, target) {
+  if (!isWithin2(resolve8(root), resolve8(target))) throw new Error("Harness journal path escapes the workspace");
+}
+function isWithin2(root, target) {
+  const rel = relative7(root, target);
+  return rel === "" || !rel.startsWith("..") && rel !== ".." && !rel.startsWith(`..${sep7}`);
+}
+
 // src/hooks/bus.ts
 import { spawn as spawn4 } from "child_process";
 
 // src/hooks/types.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var HOOK_EVENT_NAMES = [
   "SessionStart",
   "UserPromptSubmit",
@@ -7741,13 +8315,13 @@ var HOOK_EVENT_NAMES = [
   "Notification",
   "LoopEnd"
 ];
-var PayloadSchema = z10.record(z10.string(), z10.unknown());
-var eventSchema = (type) => z10.object({
-  version: z10.literal(1),
-  type: z10.literal(type),
+var PayloadSchema = z11.record(z11.string(), z11.unknown());
+var eventSchema = (type) => z11.object({
+  version: z11.literal(1),
+  type: z11.literal(type),
   payload: PayloadSchema
 });
-var HookEventSchema = z10.discriminatedUnion("type", [
+var HookEventSchema = z11.discriminatedUnion("type", [
   eventSchema("SessionStart"),
   eventSchema("UserPromptSubmit"),
   eventSchema("Stop"),
@@ -7769,11 +8343,11 @@ var HookEventSchema = z10.discriminatedUnion("type", [
   eventSchema("Notification"),
   eventSchema("LoopEnd")
 ]);
-var HookDecisionSchema = z10.object({
-  decision: z10.enum(["allow", "deny", "ask"]),
-  reason: z10.string().optional(),
-  updatedInput: z10.unknown().optional(),
-  additionalContext: z10.string().optional()
+var HookDecisionSchema = z11.object({
+  decision: z11.enum(["allow", "deny", "ask"]),
+  reason: z11.string().optional(),
+  updatedInput: z11.unknown().optional(),
+  additionalContext: z11.string().optional()
 });
 
 // src/hooks/bus.ts
@@ -7863,7 +8437,7 @@ var HookBus = class {
   }
 };
 function runShellHandler(descriptor, event, signal) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     const child = spawn4(descriptor.command, [...descriptor.args ?? []], {
       env: { ...process.env, ...descriptor.env },
       shell: false,
@@ -7906,7 +8480,7 @@ function runShellHandler(descriptor, event, signal) {
         return;
       }
       try {
-        resolve26(HookDecisionSchema.parse(JSON.parse(stdout)));
+        resolve28(HookDecisionSchema.parse(JSON.parse(stdout)));
       } catch (error) {
         reject(error);
       }
@@ -8057,27 +8631,28 @@ function createIncidentReporter(options) {
 // src/evolve/service.ts
 import { spawn as spawn5 } from "child_process";
 import { writeFile as writeFile8 } from "fs/promises";
-import { join as join10 } from "path";
-import { z as z13 } from "zod";
+import { join as join11 } from "path";
+import { z as z14 } from "zod";
 
 // src/evolve/loader.ts
 import { cp, mkdir as mkdir8, mkdtemp, readdir as readdir4, rm as rm2, stat as stat4, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join8, resolve as resolve9 } from "path";
+import { join as join9, resolve as resolve10 } from "path";
 
 // src/plugins/host.ts
-import { lstatSync, realpathSync as realpathSync2 } from "fs";
-import { lstat as lstat5, open as open5, readdir as readdir3, realpath as realpath4, stat as stat3, writeFile as writeFile5 } from "fs/promises";
-import { isAbsolute as isAbsolute5, relative as relative7, resolve as resolve8, sep as sep7 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { lstatSync, realpathSync as realpathSync3 } from "fs";
+import { lstat as lstat5, open as open5, readFile as readFile7, readdir as readdir3, realpath as realpath4, stat as stat3, writeFile as writeFile5 } from "fs/promises";
+import { isAbsolute as isAbsolute5, relative as relative8, resolve as resolve9, sep as sep8 } from "path";
 import { pathToFileURL } from "url";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/plugins/types.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var PLUGIN_NAME = /^(?:@[a-z0-9][a-z0-9._-]{0,63}\/)?[a-z0-9][a-z0-9._-]{0,63}$/;
 var CONTRIBUTION_NAME = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
-var entry = z11.object({ name: z11.string().regex(CONTRIBUTION_NAME) }).strict();
-var uniqueArray = (schema, label, identify = (item) => String(item)) => z11.array(schema).max(256).superRefine((items, context) => {
+var entry = z12.object({ name: z12.string().regex(CONTRIBUTION_NAME) }).strict();
+var uniqueArray = (schema, label, identify = (item) => String(item)) => z12.array(schema).max(256).superRefine((items, context) => {
   const seen = /* @__PURE__ */ new Set();
   for (const [index, item] of items.entries()) {
     const key = identify(item);
@@ -8085,17 +8660,23 @@ var uniqueArray = (schema, label, identify = (item) => String(item)) => z11.arra
     seen.add(key);
   }
 });
-var PluginManifestSchema = z11.object({
-  name: z11.string().regex(PLUGIN_NAME),
-  version: z11.string().min(1).max(64),
-  apiVersion: z11.literal("1"),
-  main: z11.string().min(1).max(512),
-  permissions: uniqueArray(z11.enum(["filesystem:read", "filesystem:write"]), "permission").max(16),
-  contributes: z11.object({
+var PluginManifestSchema = z12.object({
+  name: z12.string().regex(PLUGIN_NAME),
+  version: z12.string().min(1).max(64),
+  apiVersion: z12.literal("1"),
+  main: z12.string().min(1).max(512),
+  permissions: uniqueArray(z12.enum([
+    "filesystem:read",
+    "filesystem:write",
+    "network",
+    "process",
+    "runtime:in-process"
+  ]), "permission").max(16),
+  contributes: z12.object({
     commands: uniqueArray(entry, "command contribution", (item) => item.name),
     tools: uniqueArray(entry, "tool contribution", (item) => item.name),
-    hooks: uniqueArray(z11.object({ name: z11.enum(HOOK_EVENT_NAMES) }).strict(), "hook contribution", (item) => item.name),
-    skillRoots: uniqueArray(entry.extend({ path: z11.string().min(1).max(512) }).strict(), "skill-root contribution", (item) => item.name),
+    hooks: uniqueArray(z12.object({ name: z12.enum(HOOK_EVENT_NAMES) }).strict(), "hook contribution", (item) => item.name),
+    skillRoots: uniqueArray(entry.extend({ path: z12.string().min(1).max(512) }).strict(), "skill-root contribution", (item) => item.name),
     modelAdapters: uniqueArray(entry, "model-adapter contribution", (item) => item.name)
   }).strict()
 }).strict();
@@ -8274,8 +8855,8 @@ function isSandboxResult(value) {
   if (!Array.isArray(contributions.hooks) || !contributions.hooks.every(named)) return false;
   if (!Array.isArray(contributions.skillRoots) || !contributions.skillRoots.every((item) => named(item) && typeof item.root === "string")) return false;
   if (!Array.isArray(contributions.modelAdapters) || !contributions.modelAdapters.every(named)) return false;
-  const same = (left, right) => left.length === right.length && left.every((name, index) => name === right[index]?.name);
-  return same(result.registeredCommands, contributions.commands) && same(result.registeredTools, contributions.tools) && same(result.registeredHooks, contributions.hooks) && same(result.registeredSkillRoots, contributions.skillRoots) && same(result.registeredModelAdapters, contributions.modelAdapters);
+  const same2 = (left, right) => left.length === right.length && left.every((name, index) => name === right[index]?.name);
+  return same2(result.registeredCommands, contributions.commands) && same2(result.registeredTools, contributions.tools) && same2(result.registeredHooks, contributions.hooks) && same2(result.registeredSkillRoots, contributions.skillRoots) && same2(result.registeredModelAdapters, contributions.modelAdapters);
 }
 
 // src/plugins/host.ts
@@ -8380,7 +8961,7 @@ var PluginHost = class {
     const roots = [];
     for (const directory of directories) {
       try {
-        for (const entry2 of await readdir3(directory, { withFileTypes: true })) if (entry2.isDirectory()) roots.push(resolve8(directory, entry2.name));
+        for (const entry2 of await readdir3(directory, { withFileTypes: true })) if (entry2.isDirectory()) roots.push(resolve9(directory, entry2.name));
       } catch (error) {
         this.#diagnose(directory, error, directory);
       }
@@ -8413,14 +8994,15 @@ var PluginHost = class {
       const rootInfo = await lstat5(inputRoot);
       if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) throw new Error("Plugin root must be a static directory");
       const root = await realpath4(inputRoot);
-      const rawManifest = await readManifest(resolve8(root, MANIFEST));
+      const rawManifest = await readManifest(resolve9(root, MANIFEST));
       if (typeof rawManifest === "object" && rawManifest !== null && "name" in rawManifest && typeof rawManifest.name === "string") {
         diagnosticLabel = rawManifest.name;
       }
       const manifest = PluginManifestSchema.parse(rawManifest);
       const entry2 = resolveContained(root, manifest.main, "Plugin entry");
       const entrySnapshot = await snapshotEntry(root, entry2);
-      return { manifest, root, source, entry: entry2, entrySnapshot };
+      const fingerprint2 = createHash7("sha256").update(JSON.stringify(manifest)).update(await readFile7(entrySnapshot.physicalPath)).digest("hex");
+      return { manifest, root, source, entry: entry2, entrySnapshot, fingerprint: fingerprint2 };
     } catch (error) {
       this.#diagnose(diagnosticLabel, error, inputRoot);
       return void 0;
@@ -8435,6 +9017,22 @@ var PluginHost = class {
     const useSandbox = this.#options.sandbox === true;
     try {
       await verifyEntry(candidate.root, candidate.entry, candidate.entrySnapshot);
+      if (!useSandbox && this.#options.requireInProcessTrust === true && !candidate.manifest.permissions.includes("runtime:in-process")) {
+        throw new Error("Legacy in-process plugins must declare runtime:in-process");
+      }
+      const trustRequest = {
+        name: plugin,
+        version: candidate.manifest.version,
+        source: candidate.source,
+        root: candidate.root,
+        fingerprint: candidate.fingerprint,
+        sandboxed: useSandbox,
+        permissions: [...candidate.manifest.permissions]
+      };
+      const trusted = await this.#options.authorizePlugin?.(trustRequest);
+      if (trusted === false || !useSandbox && this.#options.requireInProcessTrust === true && trusted !== true) {
+        throw new Error(`Plugin "${plugin}" is not trusted for ${useSandbox ? "sandboxed" : "in-process"} activation`);
+      }
       if (useSandbox) {
         const session = await bounded(
           startPluginSandbox({
@@ -8462,7 +9060,7 @@ var PluginHost = class {
           const tool = {
             name: contribution.toolName,
             description: contribution.description,
-            inputSchema: z12.unknown(),
+            inputSchema: z13.unknown(),
             ...contribution.modelInputSchema === void 0 ? {} : { modelInputSchema: contribution.modelInputSchema },
             ...contribution.readOnly === void 0 ? {} : { readOnly: contribution.readOnly },
             paths: () => [],
@@ -8507,7 +9105,15 @@ var PluginHost = class {
         }
       }
       this.#assertAllDeclaredRegistered(candidate, claimed);
-      const metadata = { name: plugin, version: candidate.manifest.version, source: candidate.source, root: candidate.root };
+      const metadata = {
+        name: plugin,
+        version: candidate.manifest.version,
+        source: candidate.source,
+        root: candidate.root,
+        fingerprint: candidate.fingerprint,
+        sandboxed: useSandbox,
+        permissions: [...candidate.manifest.permissions]
+      };
       this.#active.push({ metadata, disposers, state });
       try {
         await bounded(Promise.resolve(this.#options.emitLifecycle?.("PluginLoad", metadata)), this.#activationTimeoutMs, "PluginLoad lifecycle");
@@ -8573,7 +9179,7 @@ var PluginHost = class {
       assertActive();
       const permission = `filesystem:${operation}`;
       if (!manifest.permissions.includes(permission)) throw new Error(`Plugin ${manifest.name} lacks ${permission} permission`);
-      const path = resolve8(rawPath);
+      const path = resolve9(rawPath);
       const authorized = await this.#options.authorizeFilesystem?.({ plugin: manifest.name, operation, path });
       assertActive();
       if (authorized !== true) throw new Error(`Filesystem ${operation} denied for plugin ${manifest.name}`);
@@ -8612,7 +9218,7 @@ var PluginHost = class {
         if (expected !== registered) throw new Error(`Registered skill root "${name}" does not match its declaration`);
         const info = lstatSync(registered, { bigint: true });
         if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Skill root "${name}" must be a static directory`);
-        const physical = realpathSync2.native(registered);
+        const physical = realpathSync3.native(registered);
         assertContained(candidate.root, physical, "Skill root");
         const snapshot4 = fromStats(info);
         const capability = Object.freeze({ path: physical, identity: Object.freeze(pickIdentity(snapshot4)) });
@@ -8705,13 +9311,13 @@ function assertSnapshot(expected, actual, label) {
 }
 function resolveContained(root, value, label) {
   if (isAbsolute5(value)) throw new Error(`${label} must be relative to the plugin root`);
-  const candidate = resolve8(root, value);
+  const candidate = resolve9(root, value);
   assertContained(root, candidate, label);
   return candidate;
 }
 function assertContained(root, candidate, label) {
-  const delta = relative7(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep7}`) || isAbsolute5(delta)) throw new Error(`${label} escapes the plugin root`);
+  const delta = relative8(root, candidate);
+  if (delta === ".." || delta.startsWith(`..${sep8}`) || isAbsolute5(delta)) throw new Error(`${label} escapes the plugin root`);
 }
 function scopedLogger(logger, plugin) {
   const prefix = `[plugin:${plugin}] `;
@@ -8754,17 +9360,17 @@ function compare(left, right) {
 }
 
 // src/evolve/loader.ts
-var PLUGIN_DIR = join8(".flavor", "plugins");
-var VERSIONS_DIR = join8(".flavor", "plugins", ".versions");
+var PLUGIN_DIR = join9(".flavor", "plugins");
+var VERSIONS_DIR = join9(".flavor", "plugins", ".versions");
 function sanitizePluginName(tool) {
   const base = String(tool ?? "fix").replace(/[^a-z0-9-]/gi, "-").toLowerCase();
   return base.startsWith("fix-") ? base : `fix-${base}`;
 }
 function fixPluginDir(workspace, name) {
-  return resolve9(workspace, PLUGIN_DIR, name);
+  return resolve10(workspace, PLUGIN_DIR, name);
 }
 function versionsDirFor(workspace, name) {
-  return resolve9(workspace, VERSIONS_DIR, name);
+  return resolve10(workspace, VERSIONS_DIR, name);
 }
 function timestamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-");
@@ -8799,8 +9405,8 @@ export function activate(ctx) {
 async function scaffoldFixPlugin(workspace, name) {
   const dir = fixPluginDir(workspace, name);
   await mkdir8(dir, { recursive: true });
-  const manifestPath = join8(dir, "flavor-plugin.json");
-  const entryPath = join8(dir, "index.js");
+  const manifestPath = join9(dir, "flavor-plugin.json");
+  const entryPath = join9(dir, "index.js");
   try {
     await writeFile6(manifestPath, SCAFFOLD_MANIFEST(name), { encoding: "utf8", flag: "wx" });
     await writeFile6(entryPath, SCAFFOLD_ENTRY(name), { encoding: "utf8", flag: "wx" });
@@ -8820,9 +9426,9 @@ async function verifyFixPlugin(workspace, name) {
     return { ok: false, provided: [], tools: [], commands: [], error: `Plugin "${name}" not found.` };
   }
   const collected = { tools: [], commands: [] };
-  const sandbox = await mkdtemp(join8(tmpdir2(), "flavor-evolve-verify-"));
+  const sandbox = await mkdtemp(join9(tmpdir2(), "flavor-evolve-verify-"));
   try {
-    await cp(pluginRoot, join8(sandbox, name), { recursive: true });
+    await cp(pluginRoot, join9(sandbox, name), { recursive: true });
     const host = new PluginHost({
       projectPluginDirs: [sandbox],
       sandbox: true,
@@ -8873,7 +9479,7 @@ async function verifyFixPlugin(workspace, name) {
 }
 async function snapshotFixPlugin(workspace, name) {
   const pluginRoot = fixPluginDir(workspace, name);
-  const snapshotRoot = join8(versionsDirFor(workspace, name), timestamp());
+  const snapshotRoot = join9(versionsDirFor(workspace, name), timestamp());
   await mkdir8(snapshotRoot, { recursive: true });
   await cp(pluginRoot, snapshotRoot, { recursive: true });
   return snapshotRoot;
@@ -8894,7 +9500,7 @@ async function revertFixPlugin(workspace, name) {
   }
   const snapshots = entries.filter((entry2) => !entry2.startsWith(".")).sort();
   if (snapshots.length === 0) throw new Error(`Plugin "${name}" has no snapshot to restore.`);
-  const latest = join8(versionsRoot, snapshots[snapshots.length - 1]);
+  const latest = join9(versionsRoot, snapshots[snapshots.length - 1]);
   await rm2(pluginRoot, { recursive: true, force: true });
   await mkdir8(pluginRoot, { recursive: true });
   await cp(latest, pluginRoot, { recursive: true });
@@ -8902,14 +9508,14 @@ async function revertFixPlugin(workspace, name) {
 }
 
 // src/evolve/store.ts
-import { createHash as createHash5 } from "crypto";
-import { appendFile, mkdir as mkdir9, readFile as readFile7, rm as rm3, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname11, join as join9 } from "path";
+import { createHash as createHash8 } from "crypto";
+import { appendFile, mkdir as mkdir9, readFile as readFile8, rm as rm3, writeFile as writeFile7 } from "fs/promises";
+import { dirname as dirname11, join as join10 } from "path";
 function normalizeError(message2) {
   return String(message2 ?? "").replace(/\s+/g, " ").replace(/"[^"]*"/g, '"\u2026"').replace(/`[^`]*`/g, '"\u2026"').trim().slice(0, 160);
 }
 function fingerprint(tool, errorCode, error) {
-  return createHash5("sha1").update(`${tool}::${errorCode ?? ""}::${normalizeError(error)}`).digest("hex").slice(0, 12);
+  return createHash8("sha1").update(`${tool}::${errorCode ?? ""}::${normalizeError(error)}`).digest("hex").slice(0, 12);
 }
 function argKeys(args) {
   if (args === null || typeof args !== "object") return [];
@@ -8917,7 +9523,7 @@ function argKeys(args) {
 }
 async function readJsonLines(file) {
   try {
-    const text = await readFile7(file, "utf8");
+    const text = await readFile8(file, "utf8");
     const records = [];
     for (const line of text.split("\n")) {
       const trimmed = line.trim();
@@ -8940,7 +9546,7 @@ async function writeJsonLines(file, records) {
 }
 async function readJsonArray(file) {
   try {
-    const parsed = JSON.parse(await readFile7(file, "utf8"));
+    const parsed = JSON.parse(await readFile8(file, "utf8"));
     return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
   } catch {
     return [];
@@ -8948,7 +9554,7 @@ async function readJsonArray(file) {
 }
 async function readRules(file) {
   try {
-    const parsed = JSON.parse(await readFile7(file, "utf8"));
+    const parsed = JSON.parse(await readFile8(file, "utf8"));
     if (!Array.isArray(parsed)) return [];
     return parsed.filter((item) => item !== null && typeof item === "object").filter((item) => typeof item.id === "string" && typeof item.text === "string").map((item) => ({
       id: item.id,
@@ -8977,12 +9583,12 @@ var EvolveStore = class {
   #queue = Promise.resolve();
   constructor(options) {
     const { workspace, maxSignals = 400, maxRules = 20 } = options;
-    this.dir = join9(workspace, ".flavor", "evolve");
-    this.signalsFile = join9(this.dir, "signals.jsonl");
-    this.reflectionsFile = join9(this.dir, "reflections.jsonl");
-    this.doneFile = join9(this.dir, "done.json");
-    this.verifiedFile = join9(this.dir, "verified.json");
-    this.rulesFile = join9(this.dir, "rules.json");
+    this.dir = join10(workspace, ".flavor", "evolve");
+    this.signalsFile = join10(this.dir, "signals.jsonl");
+    this.reflectionsFile = join10(this.dir, "reflections.jsonl");
+    this.doneFile = join10(this.dir, "done.json");
+    this.verifiedFile = join10(this.dir, "verified.json");
+    this.rulesFile = join10(this.dir, "rules.json");
     this.maxSignals = maxSignals;
     this.maxRules = maxRules;
   }
@@ -9201,7 +9807,7 @@ var USAGE = [
   "  clear     reset signals, done markers, and verified markers"
 ].join("\n");
 function runCommand(command, cwd, timeoutMs) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve28) => {
     const isWindows = process.platform === "win32";
     const child = spawn5(isWindows ? "cmd.exe" : "/bin/sh", isWindows ? ["/d", "/s", "/c", command] : ["-c", command], {
       cwd,
@@ -9211,7 +9817,7 @@ function runCommand(command, cwd, timeoutMs) {
     let stderr = "";
     const timer = setTimeout(() => {
       child.kill();
-      resolve26({ ok: false, stdout, stderr: `${stderr}
+      resolve28({ ok: false, stdout, stderr: `${stderr}
 [killed: exceeded ${timeoutMs}ms]`, code: "timeout" });
     }, timeoutMs);
     child.stdout.on("data", (chunk) => {
@@ -9222,12 +9828,12 @@ function runCommand(command, cwd, timeoutMs) {
     });
     child.on("error", (error) => {
       clearTimeout(timer);
-      resolve26({ ok: false, stdout, stderr: `${stderr}
+      resolve28({ ok: false, stdout, stderr: `${stderr}
 ${error.message}`, code: "spawn" });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve26({ ok: code === 0, stdout, stderr, code: code ?? "unknown" });
+      resolve28({ ok: code === 0, stdout, stderr, code: code ?? "unknown" });
     });
   });
 }
@@ -9521,7 +10127,7 @@ function createEvolveService(options) {
         if (suggestion === void 0) return `No open suggestion with id "${suggestionId}". Use /evolve suggest to list them.`;
         const name = sanitizePluginName(suggestion.tool);
         const dir = await scaffoldFixPlugin(workspace, name);
-        await writeFile8(join10(dir, "PLAN.md"), buildPlan(suggestion, name, "See the repeated failure below; describe your fix in PLAN.md."), "utf8");
+        await writeFile8(join11(dir, "PLAN.md"), buildPlan(suggestion, name, "See the repeated failure below; describe your fix in PLAN.md."), "utf8");
         await snapshotFixPlugin(workspace, name);
         return [
           `suggestion ${suggestion.id}: ${suggestion.tool} x${suggestion.count} \u2014 ${suggestion.error}`,
@@ -9583,10 +10189,10 @@ ${result.stderr.slice(-4e3)}` : ""}`;
       return USAGE;
     },
     toolDefinition() {
-      const inputSchema = z13.object({
-        suggestionId: z13.string().min(1).describe("Signal id from the evolve suggestions"),
-        implementation: z13.string().min(1).describe("Concise description of the fix to implement (plugin plan, or the guardrail rule text when kind is prompt_rule)"),
-        kind: z13.enum(["plugin", "prompt_rule"]).optional().describe(
+      const inputSchema = z14.object({
+        suggestionId: z14.string().min(1).describe("Signal id from the evolve suggestions"),
+        implementation: z14.string().min(1).describe("Concise description of the fix to implement (plugin plan, or the guardrail rule text when kind is prompt_rule)"),
+        kind: z14.enum(["plugin", "prompt_rule"]).optional().describe(
           "plugin (default): scaffold a fix plugin; prompt_rule: store a guardrail rule that is injected into future system prompts"
         )
       });
@@ -9612,7 +10218,7 @@ ${result.stderr.slice(-4e3)}` : ""}`;
           }
           const name = sanitizePluginName(suggestion.tool);
           const dir = await scaffoldFixPlugin(workspace, name);
-          await writeFile8(join10(dir, "PLAN.md"), buildPlan(suggestion, name, implementation), "utf8");
+          await writeFile8(join11(dir, "PLAN.md"), buildPlan(suggestion, name, implementation), "utf8");
           await snapshotFixPlugin(workspace, name);
           return [
             `Scaffolded fix plugin at ${dir} for suggestion [${suggestion.id}] (${suggestion.tool} x${suggestion.count}).`,
@@ -9652,8 +10258,8 @@ function buildLoopCyclePrompt(input) {
 }
 
 // src/loop/types.ts
-import { z as z14 } from "zod";
-var LoopStatusSchema = z14.enum([
+import { z as z15 } from "zod";
+var LoopStatusSchema = z15.enum([
   "running",
   "succeeded",
   "failed",
@@ -9663,65 +10269,65 @@ var LoopStatusSchema = z14.enum([
   "no_progress",
   "needs_human"
 ]);
-var LoopApprovalSchema = z14.object({
-  dimension: z14.enum(["cycles", "tokens"]),
-  previousCheckpoint: z14.number().int().nonnegative(),
-  newCheckpoint: z14.number().int().positive(),
-  usage: z14.number().int().nonnegative(),
-  approvedAt: z14.string().datetime({ offset: true })
+var LoopApprovalSchema = z15.object({
+  dimension: z15.enum(["cycles", "tokens"]),
+  previousCheckpoint: z15.number().int().nonnegative(),
+  newCheckpoint: z15.number().int().positive(),
+  usage: z15.number().int().nonnegative(),
+  approvedAt: z15.string().datetime({ offset: true })
 }).strict();
-var LoopVerificationCommandSchema = z14.object({
-  command: z14.string().min(1),
-  args: z14.array(z14.string()),
-  exitCode: z14.number().int().nullable(),
-  stdout: z14.string(),
-  stderr: z14.string(),
-  truncated: z14.boolean()
+var LoopVerificationCommandSchema = z15.object({
+  command: z15.string().min(1),
+  args: z15.array(z15.string()),
+  exitCode: z15.number().int().nullable(),
+  stdout: z15.string(),
+  stderr: z15.string(),
+  truncated: z15.boolean()
 }).strict();
-var LoopVerificationEvidenceSchema = z14.object({
-  passed: z14.boolean(),
-  commands: z14.array(LoopVerificationCommandSchema),
-  summary: z14.string()
+var LoopVerificationEvidenceSchema = z15.object({
+  passed: z15.boolean(),
+  commands: z15.array(LoopVerificationCommandSchema),
+  summary: z15.string()
 }).strict();
-var LoopCycleEvidenceSchema = z14.object({
-  cycle: z14.number().int().positive(),
-  startedAt: z14.string().datetime({ offset: true }),
-  completedAt: z14.string().datetime({ offset: true }),
-  inputTokens: z14.number().int().nonnegative(),
-  outputTokens: z14.number().int().nonnegative(),
-  workspaceFingerprint: z14.string(),
+var LoopCycleEvidenceSchema = z15.object({
+  cycle: z15.number().int().positive(),
+  startedAt: z15.string().datetime({ offset: true }),
+  completedAt: z15.string().datetime({ offset: true }),
+  inputTokens: z15.number().int().nonnegative(),
+  outputTokens: z15.number().int().nonnegative(),
+  workspaceFingerprint: z15.string(),
   verification: LoopVerificationEvidenceSchema
 }).strict();
-var LoopStateSchema = z14.object({
-  version: z14.literal(1),
-  loopId: z14.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
-  goal: z14.string().trim().min(1),
-  workspace: z14.string().min(1),
-  createdAt: z14.string().datetime({ offset: true }),
-  updatedAt: z14.string().datetime({ offset: true }),
+var LoopStateSchema = z15.object({
+  version: z15.literal(1),
+  loopId: z15.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+  goal: z15.string().trim().min(1),
+  workspace: z15.string().min(1),
+  createdAt: z15.string().datetime({ offset: true }),
+  updatedAt: z15.string().datetime({ offset: true }),
   status: LoopStatusSchema,
-  config: z14.object({
-    cycleStep: z14.number().int().positive(),
-    tokenStep: z14.number().int().positive(),
-    isolation: z14.literal("auto")
+  config: z15.object({
+    cycleStep: z15.number().int().positive(),
+    tokenStep: z15.number().int().positive(),
+    isolation: z15.literal("auto")
   }).strict(),
-  budget: z14.object({
-    cyclesUsed: z14.number().int().nonnegative(),
-    inputTokens: z14.number().int().nonnegative(),
-    outputTokens: z14.number().int().nonnegative(),
-    cycleCheckpoint: z14.number().int().positive(),
-    tokenCheckpoint: z14.number().int().positive(),
-    approvals: z14.array(LoopApprovalSchema)
+  budget: z15.object({
+    cyclesUsed: z15.number().int().nonnegative(),
+    inputTokens: z15.number().int().nonnegative(),
+    outputTokens: z15.number().int().nonnegative(),
+    cycleCheckpoint: z15.number().int().positive(),
+    tokenCheckpoint: z15.number().int().positive(),
+    approvals: z15.array(LoopApprovalSchema)
   }).strict(),
-  cycles: z14.array(LoopCycleEvidenceSchema),
-  terminalReason: z14.string().optional()
+  cycles: z15.array(LoopCycleEvidenceSchema),
+  terminalReason: z15.string().optional()
 }).strict();
-var LoopEventSchema = z14.object({
-  version: z14.literal(1),
-  type: z14.enum(["created", "cycle_started", "cycle_completed", "verification", "budget_approved", "terminal"]),
-  timestamp: z14.string().datetime({ offset: true }),
-  loopId: z14.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
-  payload: z14.record(z14.string(), z14.unknown())
+var LoopEventSchema = z15.object({
+  version: z15.literal(1),
+  type: z15.enum(["created", "cycle_started", "cycle_completed", "verification", "budget_approved", "terminal"]),
+  timestamp: z15.string().datetime({ offset: true }),
+  loopId: z15.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+  payload: z15.record(z15.string(), z15.unknown())
 }).strict();
 
 // src/loop/budget.ts
@@ -10033,19 +10639,20 @@ ${evidence.summary}`;
 };
 
 // src/goal/orchestrator.ts
+import { createHash as createHash10 } from "crypto";
 import { writeFile as writeFile9, mkdir as mkdir10 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/goal/types.ts
-import { z as z15 } from "zod";
-var GoalPhaseSchema = z15.enum([
+import { z as z16 } from "zod";
+var GoalPhaseSchema = z16.enum([
   "idle",
   "planning",
   "executing",
   "verifying",
   "complete"
 ]);
-var GoalStatusSchema = z15.enum([
+var GoalStatusSchema = z16.enum([
   "active",
   "paused",
   "achieved",
@@ -10053,43 +10660,61 @@ var GoalStatusSchema = z15.enum([
   "blocked",
   "failed"
 ]);
-var AcceptanceCriterionSchema = z15.object({
-  id: z15.number().int().positive(),
-  description: z15.string().min(1),
-  type: z15.enum(["gating", "evidence"])
+var AcceptanceCriterionSchema = z16.object({
+  id: z16.number().int().positive(),
+  description: z16.string().min(1),
+  type: z16.enum(["gating", "evidence"])
+}).strict();
+var PlanSchema = z16.object({
+  kind: z16.enum(["code-change", "analysis", "research"]),
+  criteria: z16.array(AcceptanceCriterionSchema).min(1).max(32),
+  verificationPlan: z16.string().min(1),
+  nonGoals: z16.array(z16.string()).max(16),
+  assumedScope: z16.array(z16.string()).max(16),
+  approach: z16.string().optional(),
+  checklist: z16.array(z16.string()).max(32).optional()
 }).strict();
-var PlanSchema = z15.object({
-  kind: z15.enum(["code-change", "analysis", "research"]),
-  criteria: z15.array(AcceptanceCriterionSchema).min(1).max(32),
-  verificationPlan: z15.string().min(1),
-  nonGoals: z15.array(z15.string()).max(16),
-  assumedScope: z15.array(z15.string()).max(16),
-  approach: z15.string().optional(),
-  checklist: z15.array(z15.string()).max(32).optional()
+var GapSchema = z16.object({
+  criterion: z16.string().min(1),
+  description: z16.string().min(1),
+  blocking: z16.enum(["model_fixable", "contradiction", "unverifiable"])
 }).strict();
-var GapSchema = z15.object({
-  criterion: z15.string().min(1),
-  description: z15.string().min(1),
-  blocking: z15.enum(["model_fixable", "contradiction", "unverifiable"])
+var VerdictSchema = z16.object({
+  refuted: z16.boolean(),
+  gaps: z16.array(GapSchema)
 }).strict();
-var VerdictSchema = z15.object({
-  refuted: z15.boolean(),
-  gaps: z15.array(GapSchema)
+var HostVerificationEvidenceSchema = z16.object({
+  passed: z16.boolean(),
+  summary: z16.string(),
+  commands: z16.array(z16.object({
+    command: z16.string(),
+    args: z16.array(z16.string()),
+    exitCode: z16.number().int().nullable(),
+    stdout: z16.string().optional(),
+    stderr: z16.string().optional(),
+    truncated: z16.boolean().optional()
+  }).strict()).max(100)
 }).strict();
-var GoalStateSchema = z15.object({
-  id: z15.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
-  objective: z15.string().min(1),
+var GoalStateSchema = z16.object({
+  id: z16.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+  objective: z16.string().min(1),
   phase: GoalPhaseSchema,
   status: GoalStatusSchema,
   plan: PlanSchema.nullable(),
-  planPath: z15.string().nullable(),
-  verifyRounds: z15.number().int().min(0),
-  workerRounds: z15.number().int().min(0),
-  lastGaps: z15.array(GapSchema),
-  gapFingerprint: z15.string(),
-  stallStreak: z15.number().int().min(0),
-  createdAt: z15.string().datetime({ offset: true }),
-  updatedAt: z15.string().datetime({ offset: true })
+  planPath: z16.string().nullable(),
+  verifyRounds: z16.number().int().min(0),
+  workerRounds: z16.number().int().min(0),
+  lastGaps: z16.array(GapSchema),
+  gapFingerprint: z16.string(),
+  stallStreak: z16.number().int().min(0),
+  contractHash: z16.string().regex(/^[a-f0-9]{64}$/),
+  evidenceRounds: z16.array(z16.object({
+    round: z16.number().int().positive(),
+    workspaceDiffHash: z16.string().regex(/^[a-f0-9]{64}$/),
+    hostVerification: HostVerificationEvidenceSchema.optional()
+  }).strict()).max(1e3),
+  createdAt: z16.string().datetime({ offset: true }),
+  updatedAt: z16.string().datetime({ offset: true })
 }).strict();
 
 // src/goal/planner.ts
@@ -10179,9 +10804,9 @@ function extractJson(text) {
 }
 
 // src/goal/classifier.ts
-import { createHash as createHash6 } from "crypto";
-import { readFile as readFile8, readdir as readdir5 } from "fs/promises";
-import { join as join11, relative as relative8 } from "path";
+import { createHash as createHash9 } from "crypto";
+import { readFile as readFile9 } from "fs/promises";
+import { join as join12 } from "path";
 function buildSkepticPrompt(evidence, plan, index) {
   const criteriaList = plan.criteria.map((c) => `  ${c.id}. [${c.type}] ${c.description}`).join("\n");
   return [
@@ -10203,6 +10828,10 @@ function buildSkepticPrompt(evidence, plan, index) {
     `Changed files: ${evidence.changedFiles.length > 0 ? evidence.changedFiles.join(", ") : "(none)"}`,
     `Plan file: ${evidence.planFile ?? "(unavailable)"}`,
     `Prior gaps: ${evidence.priorGaps || "(none)"}`,
+    `Contract hash: ${evidence.contractHash}`,
+    `Workspace diff hash: ${evidence.workspaceDiffHash}`,
+    `Workspace status: ${evidence.workspaceStatus.length > 0 ? evidence.workspaceStatus.join(" | ") : "(clean)"}`,
+    `Host verification: ${evidence.hostVerification === void 0 ? "(not configured)" : JSON.stringify(evidence.hostVerification)}`,
     "",
     "## Implementer's Closing Statement",
     evidence.finalResponse || "(no closing statement)",
@@ -10214,7 +10843,8 @@ function buildSkepticPrompt(evidence, plan, index) {
     "4. Missing tests alone are NOT grounds for refutation unless a criterion explicitly requires them.",
     "5. NEVER invent requirements beyond the contract (objective + criteria + non-goals).",
     "6. In repeat verification rounds, focus on whether PRIOR_GAPS have been fixed. New issues are only valid if they are clearly demonstrable defects.",
-    "7. Audit the CURRENT workspace state \u2014 do not re-execute code unless it is a cheap spot-check.",
+    "7. Host verification is authoritative. A failed deterministic command must be refuted.",
+    "8. Every PRIOR_GAP must have current evidence that it was resolved; uncertainty means refuted.",
     "",
     "## Output",
     "Write your verdict as a single JSON object (no markdown, no preamble):",
@@ -10243,8 +10873,12 @@ async function runClassifier(evidence, plan, options) {
   for (const result of skepticResults) {
     try {
       verdicts.push(parseVerdict(result));
-    } catch {
-      verdicts.push({ refuted: false, gaps: [] });
+    } catch (error) {
+      verdicts.push({ refuted: true, gaps: [{
+        criterion: "verification-panel",
+        description: `Skeptic output was unavailable or invalid: ${error instanceof Error ? error.message : String(error)}`,
+        blocking: "unverifiable"
+      }] });
     }
   }
   return aggregate(verdicts);
@@ -10345,50 +10979,56 @@ function deduplicateGaps(gaps) {
 }
 function computeFingerprint(gaps) {
   const content = gaps.map((g) => `${g.criterion}:${g.description}`).sort().join("\n");
-  return createHash6("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash9("sha256").update(content).digest("hex").slice(0, 16);
 }
-async function collectEvidence(workspace, objective, finalResponse, priorGaps) {
-  const changedFiles = await collectChangedFiles(workspace);
-  const planPath = join11(workspace, ".flavor", "goal-plan.md");
+async function collectEvidence(workspace, objective, finalResponse, priorGaps, contractHash2 = createHash9("sha256").update(objective).digest("hex"), hostVerification) {
+  const workspaceState = await collectWorkspaceState(workspace);
+  const planPath = join12(workspace, ".flavor", "goal-plan.md");
   let planFile = null;
   try {
-    planFile = await readFile8(planPath, "utf8");
+    planFile = await readFile9(planPath, "utf8");
   } catch {
   }
   return {
     objective,
-    changedFiles: changedFiles.map((f) => relative8(workspace, f)),
+    changedFiles: workspaceState.changedFiles,
     planFile,
     finalResponse,
-    priorGaps
+    priorGaps,
+    contractHash: contractHash2,
+    workspaceDiffHash: workspaceState.diffHash,
+    workspaceStatus: workspaceState.status,
+    ...hostVerification === void 0 ? {} : { hostVerification }
   };
 }
-async function collectChangedFiles(workspace) {
-  const results = [];
-  const seen = /* @__PURE__ */ new Set();
-  async function walk(dir) {
-    let entries;
-    try {
-      entries = await readdir5(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry2 of entries) {
-      const full = join11(dir, entry2.name);
-      const rel = relative8(workspace, full);
-      if (entry2.name === ".git" || entry2.name === "node_modules" || entry2.name === ".flavor" || entry2.name.startsWith(".")) continue;
-      if (entry2.isDirectory()) {
-        await walk(full);
-      } else if (entry2.isFile()) {
-        if (!seen.has(rel)) {
-          seen.add(rel);
-          results.push(full);
-        }
-      }
-    }
+async function collectWorkspaceState(workspace) {
+  const statusResult = await execFileNoThrow("git", ["-C", workspace, "status", "--porcelain=v1", "--untracked-files=all"], {
+    timeout: 3e4,
+    useCwd: false
+  });
+  if (statusResult.code !== 0) {
+    return {
+      changedFiles: [],
+      status: ["not-a-git-worktree"],
+      diffHash: createHash9("sha256").update("not-a-git-worktree").digest("hex")
+    };
   }
-  await walk(workspace);
-  return results.sort();
+  const status = statusResult.stdout.split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean);
+  const changedFiles = status.map((line) => {
+    const value = line.slice(3);
+    const arrow = value.lastIndexOf(" -> ");
+    return arrow >= 0 ? value.slice(arrow + 4) : value;
+  }).sort();
+  const diff = await execFileNoThrow("git", ["-C", workspace, "diff", "--no-ext-diff", "--binary", "HEAD"], {
+    timeout: 3e4,
+    useCwd: false
+  });
+  const untracked = status.filter((line) => line.startsWith("?? ")).map((line) => line.slice(3)).sort().join("\n");
+  return {
+    changedFiles,
+    status,
+    diffHash: createHash9("sha256").update(diff.stdout).update("\nUNTRACKED\n").update(untracked).digest("hex")
+  };
 }
 
 // src/goal/orchestrator.ts
@@ -10419,6 +11059,8 @@ var GoalOrchestrator = class {
       lastGaps: [],
       gapFingerprint: "",
       stallStreak: 0,
+      contractHash: contractHash(request.goal, null),
+      evidenceRounds: [],
       createdAt,
       updatedAt: createdAt
     };
@@ -10439,7 +11081,7 @@ var GoalOrchestrator = class {
         signal: request.signal
       });
       planPath = await writePlanFile(workspace, plan);
-      await persistState({ plan, planPath });
+      await persistState({ plan, planPath, contractHash: contractHash(request.goal, plan) });
       yield { type: "goal-plan-created", plan, planPath };
     } catch (error) {
       const reason = `Goal planning failed: ${message(error)}`;
@@ -10492,15 +11134,35 @@ var GoalOrchestrator = class {
       }
       await persistState({ phase: "verifying", status: "active", verifyRounds: round });
       yield { type: "goal-verification-start", round };
+      const hostVerification = await this.#options.verifyHost?.(request.signal);
       const evidence = await collectEvidence(
         workspace,
         request.goal,
         finalResponse.slice(-4e3),
         // Last 4000 chars of response
-        formatPriorGaps(priorGaps)
+        formatPriorGaps(priorGaps),
+        state.contractHash,
+        hostVerification
       );
+      await persistState({ evidenceRounds: [...state.evidenceRounds, {
+        round,
+        workspaceDiffHash: evidence.workspaceDiffHash,
+        ...hostVerification === void 0 ? {} : { hostVerification }
+      }] });
       let outcome;
-      try {
+      if (plan.kind === "code-change" && hostVerification !== void 0 && !hostVerification.passed) {
+        if (hostVerification.commands.length === 0) {
+          outcome = { type: "blocked", reason: `Host verification unavailable: ${hostVerification.summary}` };
+        } else {
+          const gaps = [{ criterion: "host-verification", description: hostVerification.summary, blocking: "model_fixable" }];
+          outcome = {
+            type: "not_achieved",
+            gaps,
+            summary: hostVerification.summary,
+            fingerprint: createHash10("sha256").update(hostVerification.summary).digest("hex").slice(0, 16)
+          };
+        }
+      } else try {
         outcome = await runClassifier(evidence, plan, {
           registry: this.#options.registry,
           modelId: this.#options.classifierModelId,
@@ -10510,8 +11172,8 @@ var GoalOrchestrator = class {
         });
       } catch (error) {
         outcome = {
-          type: "achieved",
-          summary: `Classifier infrastructure error (fail-open): ${message(error)}`
+          type: "blocked",
+          reason: `Classifier infrastructure error: ${message(error)}`
         };
       }
       yield {
@@ -10570,9 +11232,12 @@ var GoalOrchestrator = class {
     };
   }
 };
+function contractHash(objective, plan) {
+  return createHash10("sha256").update(JSON.stringify({ objective, plan })).digest("hex");
+}
 async function writePlanFile(workspace, plan) {
-  const dir = join12(workspace, ".flavor");
-  const planPath = join12(dir, "goal-plan.md");
+  const dir = join13(workspace, ".flavor");
+  const planPath = join13(dir, "goal-plan.md");
   await mkdir10(dir, { recursive: true });
   const criteriaText = plan.criteria.map((c) => `- [${c.type}] AC-${c.id}: ${c.description}`).join("\n");
   const content = [
@@ -10647,18 +11312,18 @@ function formatPriorGaps(gaps) {
 }
 
 // src/goal/store.ts
-import { constants } from "fs";
-import { randomUUID as randomUUID7 } from "crypto";
+import { constants as constants2 } from "fs";
+import { randomUUID as randomUUID9 } from "crypto";
 import { lstat as lstat6, mkdir as mkdir11, open as open6, rename as rename4, rm as rm4 } from "fs/promises";
-import { dirname as dirname12, join as join13, relative as relative9, resolve as resolve10, sep as sep8 } from "path";
+import { dirname as dirname12, join as join14, relative as relative9, resolve as resolve11, sep as sep9 } from "path";
 var DEFAULT_MAX_BYTES = 1024 * 1024;
 var GoalStore = class {
   #workspace;
   #root;
   #maxBytes;
   constructor(options) {
-    this.#workspace = resolve10(options.workspace);
-    this.#root = join13(this.#workspace, ".flavor", "goals");
+    this.#workspace = resolve11(options.workspace);
+    this.#root = join14(this.#workspace, ".flavor", "goals");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
   }
   async save(input) {
@@ -10666,16 +11331,16 @@ var GoalStore = class {
     await assertNoSymlink(this.#workspace, dirname12(this.#root));
     await mkdir11(this.#root, { recursive: true, mode: 448 });
     await assertNoSymlink(this.#workspace, this.#root);
-    const target = join13(this.#root, `${state.id}.json`);
+    const target = join14(this.#root, `${state.id}.json`);
     const body = `${JSON.stringify(state, null, 2)}
 `;
     if (Buffer.byteLength(body) > this.#maxBytes) {
       throw new Error(`Goal state exceeds maximum size of ${this.#maxBytes} bytes`);
     }
-    const temporary = join13(this.#root, `.${state.id}.${process.pid}.${randomUUID7()}.tmp`);
+    const temporary = join14(this.#root, `.${state.id}.${process.pid}.${randomUUID9()}.tmp`);
     let handle;
     try {
-      handle = await open6(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+      handle = await open6(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
       await handle.writeFile(body, "utf8");
       await handle.sync();
       await handle.close();
@@ -10688,10 +11353,10 @@ var GoalStore = class {
   }
 };
 async function assertNoSymlink(root, target) {
-  let cursor = resolve10(target);
-  const stop = resolve10(root);
+  let cursor = resolve11(target);
+  const stop = resolve11(root);
   const value = relative9(stop, cursor);
-  if (value === ".." || value.startsWith(`..${sep8}`) || value.includes(":")) {
+  if (value === ".." || value.startsWith(`..${sep9}`) || value.includes(":")) {
     throw new Error("Goal path escapes workspace");
   }
   const chain = [];
@@ -10712,8 +11377,8 @@ function isCode3(error, code) {
 }
 
 // src/loop/isolation.ts
-import { appendFile as appendFile2, mkdir as mkdir12, readFile as readFile9 } from "fs/promises";
-import { join as join14, resolve as resolve11 } from "path";
+import { appendFile as appendFile2, mkdir as mkdir12, readFile as readFile10 } from "fs/promises";
+import { join as join15, resolve as resolve12 } from "path";
 var CODE_CHANGE = /\b(?:fix|implement|add|update|change|modify|refactor|build|create|remove|delete|write|migrate)\b|修复|实现|添加|更新|修改|重构|创建|删除|迁移/i;
 var READ_ONLY = /\b(?:review|analy[sz]e|inspect|explain|research|investigate|audit|summari[sz]e|report)\b|调研|分析|审查|检查|解释|研究|总结|报告/i;
 function inferGoalIntent(goal) {
@@ -10723,7 +11388,7 @@ function inferGoalIntent(goal) {
 }
 async function prepareLoopWorkspace(options) {
   options.signal?.throwIfAborted();
-  const root = resolve11(options.root);
+  const root = resolve12(options.root);
   const intent = inferGoalIntent(options.goal);
   if (intent === "read_only") return { kind: "ready", workspace: { root, mode: "current" } };
   const inside = await git(root, ["rev-parse", "--is-inside-work-tree"]);
@@ -10736,8 +11401,8 @@ async function prepareLoopWorkspace(options) {
     return { kind: "needs_human", reason: "The workspace has uncommitted changes that a new worktree would omit." };
   }
   options.signal?.throwIfAborted();
-  const worktrees = join14(root, ".worktrees");
-  const path = join14(worktrees, `loop-${options.loopId}`);
+  const worktrees = join15(root, ".worktrees");
+  const path = join15(worktrees, `loop-${options.loopId}`);
   const branch = `loop/${options.loopId}`;
   try {
     await ensureWorktreeDirectoryIgnored(root);
@@ -10766,13 +11431,13 @@ async function ensureWorktreeDirectoryIgnored(root) {
   if (ignored2.code === 0) return;
   const commonDirectory = await git(root, ["rev-parse", "--git-common-dir"]);
   if (commonDirectory.code !== 0) throw new Error(commonDirectory.stderr.trim() || "Git common directory is unavailable");
-  const gitDirectory = resolve11(root, commonDirectory.stdout.trim());
-  const infoDirectory = join14(gitDirectory, "info");
-  const excludePath = join14(infoDirectory, "exclude");
+  const gitDirectory = resolve12(root, commonDirectory.stdout.trim());
+  const infoDirectory = join15(gitDirectory, "info");
+  const excludePath = join15(infoDirectory, "exclude");
   await mkdir12(infoDirectory, { recursive: true });
   let existing = "";
   try {
-    existing = await readFile9(excludePath, "utf8");
+    existing = await readFile10(excludePath, "utf8");
   } catch (error) {
     if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")) throw error;
   }
@@ -10782,10 +11447,10 @@ async function ensureWorktreeDirectoryIgnored(root) {
 }
 
 // src/loop/store.ts
-import { constants as constants2 } from "fs";
-import { lstat as lstat7, mkdir as mkdir13, open as open7, readFile as readFile10, realpath as realpath5, rename as rename5, rm as rm5, stat as stat5 } from "fs/promises";
-import { dirname as dirname13, join as join15, relative as relative10, resolve as resolve12, sep as sep9 } from "path";
-import { randomUUID as randomUUID8 } from "crypto";
+import { constants as constants3 } from "fs";
+import { lstat as lstat7, mkdir as mkdir13, open as open7, readFile as readFile11, realpath as realpath5, rename as rename5, rm as rm5, stat as stat5 } from "fs/promises";
+import { dirname as dirname13, join as join16, relative as relative10, resolve as resolve13, sep as sep10 } from "path";
+import { randomUUID as randomUUID10 } from "crypto";
 var LOOP_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var DEFAULT_MAX_BYTES2 = 5 * 1024 * 1024;
 var LoopStore = class {
@@ -10794,8 +11459,8 @@ var LoopStore = class {
   #maxBytes;
   #appendTails = /* @__PURE__ */ new Map();
   constructor(options) {
-    this.#workspace = resolve12(options.workspace);
-    this.#root = join15(this.#workspace, ".flavor", "loops");
+    this.#workspace = resolve13(options.workspace);
+    this.#root = join16(this.#workspace, ".flavor", "loops");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES2;
   }
   async create(state) {
@@ -10812,14 +11477,14 @@ var LoopStore = class {
     const state = LoopStateSchema.parse(input);
     await this.#assertWorkspace(state.workspace);
     const directory = await this.#prepare(state.loopId);
-    const target = join15(directory, "state.json");
+    const target = join16(directory, "state.json");
     const body = `${JSON.stringify(state, null, 2)}
 `;
     if (Buffer.byteLength(body) > this.#maxBytes) throw new Error(`Loop state exceeds maximum size of ${this.#maxBytes} bytes`);
-    const temporary = join15(directory, `.state.${process.pid}.${randomUUID8()}.tmp`);
+    const temporary = join16(directory, `.state.${process.pid}.${randomUUID10()}.tmp`);
     let handle;
     try {
-      handle = await open7(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+      handle = await open7(temporary, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
       await handle.writeFile(body, "utf8");
       await handle.sync();
       await handle.close();
@@ -10832,17 +11497,17 @@ var LoopStore = class {
   }
   async load(loopId) {
     const directory = await this.#safeExisting(loopId);
-    const target = join15(directory, "state.json");
+    const target = join16(directory, "state.json");
     try {
       const metadata = await stat5(target);
       if (!metadata.isFile() || metadata.size > this.#maxBytes) throw new Error("Loop state is not a bounded regular file");
-      const raw = await readFile10(target, "utf8");
+      const raw = await readFile11(target, "utf8");
       const state = LoopStateSchema.parse(JSON.parse(raw));
       await this.#assertWorkspace(state.workspace);
       return state;
     } catch (error) {
       if (isCode4(error, "ENOENT")) throw new Error(`Loop "${loopId}" was not found`);
-      const quarantine = `${target}.corrupt-${Date.now()}-${randomUUID8().slice(0, 8)}`;
+      const quarantine = `${target}.corrupt-${Date.now()}-${randomUUID10().slice(0, 8)}`;
       await rename5(target, quarantine).catch(() => void 0);
       throw new Error(`Loop "${loopId}" is corrupt and was quarantined: ${message(error)}`);
     }
@@ -10852,8 +11517,8 @@ var LoopStore = class {
     const previous = this.#appendTails.get(event.loopId) ?? Promise.resolve();
     const next = previous.catch(() => void 0).then(async () => {
       const directory = await this.#prepare(event.loopId);
-      const path = join15(directory, "events.jsonl");
-      const handle = await open7(path, constants2.O_CREAT | constants2.O_APPEND | constants2.O_WRONLY, 384);
+      const path = join16(directory, "events.jsonl");
+      const handle = await open7(path, constants3.O_CREAT | constants3.O_APPEND | constants3.O_WRONLY, 384);
       try {
         await handle.writeFile(`${JSON.stringify(event)}
 `, "utf8");
@@ -10869,7 +11534,7 @@ var LoopStore = class {
     await assertNoSymlink2(this.#workspace, dirname13(this.#root));
     await mkdir13(this.#root, { recursive: true, mode: 448 });
     await assertNoSymlink2(this.#workspace, this.#root);
-    const directory = join15(this.#root, loopId);
+    const directory = join16(this.#root, loopId);
     await mkdir13(directory, { recursive: true, mode: 448 });
     await assertNoSymlink2(this.#workspace, directory);
     return directory;
@@ -10877,7 +11542,7 @@ var LoopStore = class {
   async #safeExisting(loopId) {
     validateId(loopId);
     await assertNoSymlink2(this.#workspace, this.#root);
-    const directory = join15(this.#root, loopId);
+    const directory = join16(this.#root, loopId);
     await assertNoSymlink2(this.#workspace, directory);
     return directory;
   }
@@ -10893,9 +11558,9 @@ function validateId(loopId) {
   if (!LOOP_ID.test(loopId)) throw new Error("Invalid loop id");
 }
 async function assertNoSymlink2(root, target) {
-  let cursor = resolve12(target);
-  const stop = resolve12(root);
-  if (!isWithin2(stop, cursor)) throw new Error("Loop path escapes workspace");
+  let cursor = resolve13(target);
+  const stop = resolve13(root);
+  if (!isWithin3(stop, cursor)) throw new Error("Loop path escapes workspace");
   const chain = [];
   while (cursor !== stop) {
     chain.push(cursor);
@@ -10909,15 +11574,15 @@ async function assertNoSymlink2(root, target) {
     }
   }
 }
-function isWithin2(root, path) {
-  const value = relative10(resolve12(root), resolve12(path));
-  return value === "" || !value.startsWith(`..${sep9}`) && value !== ".." && !value.includes(":");
+function isWithin3(root, path) {
+  const value = relative10(resolve13(root), resolve13(path));
+  return value === "" || !value.startsWith(`..${sep10}`) && value !== ".." && !value.includes(":");
 }
 async function canonical(path) {
   try {
-    return await realpath5(resolve12(path));
+    return await realpath5(resolve13(path));
   } catch {
-    return resolve12(path);
+    return resolve13(path);
   }
 }
 function isCode4(error, code) {
@@ -10925,25 +11590,25 @@ function isCode4(error, code) {
 }
 
 // src/loop/verifier.ts
-import { readFile as readFile11 } from "fs/promises";
-import { join as join16 } from "path";
+import { readFile as readFile12 } from "fs/promises";
+import { join as join17 } from "path";
 
 // src/tools/shell.ts
 import { spawn as spawn6, spawnSync } from "child_process";
-import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve13, sep as sep10 } from "path";
-import { z as z17 } from "zod";
+import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve14, sep as sep11 } from "path";
+import { z as z18 } from "zod";
 
 // src/tools/jobs.ts
-import { z as z16 } from "zod";
-var JobId = z16.string().regex(/^job-[a-f0-9-]+$/);
-var ReadInput = z16.object({ id: JobId, cursor: z16.coerce.number().int().min(0).optional() });
-var IdInput = z16.object({ id: JobId });
+import { z as z17 } from "zod";
+var JobId = z17.string().regex(/^job-[a-f0-9-]+$/);
+var ReadInput = z17.object({ id: JobId, cursor: z17.coerce.number().int().min(0).optional() });
+var IdInput = z17.object({ id: JobId });
 function createJobTools(registry) {
   const tools = [
     {
       name: "JobList",
       description: "List background jobs owned by this agent",
-      inputSchema: z16.object({}),
+      inputSchema: z17.object({}),
       paths: () => [],
       execute: async (_input, _signal, context) => registry.list(owner(context)),
       presentResult: (output) => jobListPresentation(output)
@@ -11018,14 +11683,14 @@ var ELLIPSIS = "\u2026";
 var TERMINATION_GRACE_MS = 250;
 var TERMINATION_FAILURE_MS = 5e3;
 var STREAM_CLOSE_GRACE_MS = 500;
-var ShellInput = z17.object({
-  command: z17.string().min(1),
-  args: z17.array(z17.string()),
-  cwd: z17.string().min(1).nullable().optional(),
-  timeoutMs: z17.coerce.number().int().positive().max(864e5).nullable().optional(),
+var ShellInput = z18.object({
+  command: z18.string().min(1),
+  args: z18.array(z18.string()),
+  cwd: z18.string().min(1).nullable().optional(),
+  timeoutMs: z18.coerce.number().int().positive().max(864e5).nullable().optional(),
   // Accepts booleans and their string forms (weak-typed models emit "true");
   // kept transform-free so the schema converts to JSON Schema for providers.
-  background: z17.union([z17.boolean(), z17.string().refine((value) => value === "true" || value === "false")]).optional()
+  background: z18.union([z18.boolean(), z18.string().refine((value) => value === "true" || value === "false")]).optional()
 });
 function normalizeShellCommand(input) {
   const { command, args } = input;
@@ -11083,7 +11748,7 @@ function buildWindowsCommandLine(kind, commandLine, command, args) {
   return `chcp 65001>nul & ${executable} -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encoded}`;
 }
 function createShellTool(workspace, options = {}) {
-  const root = resolve13(workspace);
+  const root = resolve14(workspace);
   const maxBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES2;
   const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
   if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("maxOutputBytes must be a positive integer");
@@ -11372,9 +12037,9 @@ function backgroundFlag(value) {
   return value === true || value === "true";
 }
 function workingDirectory(root, cwd = ".") {
-  const candidate = resolve13(root, cwd);
+  const candidate = resolve14(root, cwd);
   const delta = relative11(root, candidate);
-  if (delta === ".." || delta.startsWith(`..${sep10}`) || isAbsolute6(delta)) throw new Error("Working directory is outside the workspace");
+  if (delta === ".." || delta.startsWith(`..${sep11}`) || isAbsolute6(delta)) throw new Error("Working directory is outside the workspace");
   return candidate;
 }
 async function terminateTree(pid) {
@@ -11484,13 +12149,13 @@ var SCRIPT_PRIORITY = ["test", "typecheck", "lint", "build", "smoke:install"];
 async function inferVerificationPlan(workspace) {
   const commands = [];
   const seen = /* @__PURE__ */ new Set();
-  const packageJson = await optionalJson(join16(workspace, "package.json"));
+  const packageJson = await optionalJson(join17(workspace, "package.json"));
   const scripts = isRecord2(packageJson?.scripts) ? packageJson.scripts : {};
   for (const name of SCRIPT_PRIORITY) {
     if (typeof scripts[name] !== "string" || isUnconditionalPassThrough(scripts[name])) continue;
     add(commands, seen, npmScript(name));
   }
-  const flavor = await optionalText(join16(workspace, "FLAVOR.md"));
+  const flavor = await optionalText(join17(workspace, "FLAVOR.md"));
   if (flavor !== void 0) {
     for (const match of flavor.matchAll(/^- `([^`]+)`\s*$/gm)) {
       const parsed = parseTrustedCommand(match[1] ?? "");
@@ -11557,7 +12222,7 @@ function isUnconditionalPassThrough(script) {
 }
 async function optionalText(path) {
   try {
-    return await readFile11(path, "utf8");
+    return await readFile12(path, "utf8");
   } catch (error) {
     if (isCode5(error, "ENOENT")) return void 0;
     throw error;
@@ -11578,7 +12243,7 @@ function isCode5(error, code) {
 
 // src/models/anthropic.ts
 import Anthropic from "@anthropic-ai/sdk";
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 
 // src/utils/json.ts
 function safeParseJson(input) {
@@ -11780,7 +12445,7 @@ var AnthropicModelAdapter = class {
             source: {
               type: "base64",
               media_type: block.mediaType,
-              data: (await readFile12(block.source.path)).toString("base64")
+              data: (await readFile13(block.source.path)).toString("base64")
             }
           }));
           if (message2.cacheBreakpoint && Array.isArray(content) && content.length > 0) {
@@ -11962,7 +12627,7 @@ function resolveCacheProfile(input) {
 
 // src/models/openai.ts
 import OpenAI from "openai";
-import { readFile as readFile13 } from "fs/promises";
+import { readFile as readFile14 } from "fs/promises";
 async function toInput(message2) {
   if (message2.role === "tool") {
     if (!message2.toolCallId) throw new Error("Tool messages require toolCallId");
@@ -11974,7 +12639,7 @@ async function toInput(message2) {
   }
   const content = typeof message2.content === "string" ? message2.content : await Promise.all(message2.content.map(async (block) => block.type === "text" ? { type: "input_text", text: block.text } : {
     type: "input_image",
-    image_url: `data:${block.mediaType};base64,${(await readFile13(block.source.path)).toString("base64")}`,
+    image_url: `data:${block.mediaType};base64,${(await readFile14(block.source.path)).toString("base64")}`,
     detail: "auto"
   }));
   return [
@@ -12193,8 +12858,8 @@ var ModelRegistry = class {
 };
 
 // src/mcp/client.ts
-import { createHash as createHash7 } from "crypto";
-import { z as z18 } from "zod";
+import { createHash as createHash11 } from "crypto";
+import { z as z19 } from "zod";
 var McpManager = class {
   #workspace;
   #clientFactory;
@@ -12330,7 +12995,7 @@ async function listAllTools(client) {
 function createMcpToolDefinition(serverName, timeoutMs, client, remote) {
   if (remote.name.length === 0) throw new Error("MCP tool name must not be empty");
   if (!isRecord3(remote.inputSchema)) throw new Error(`MCP tool "${remote.name}" has no JSON object input schema`);
-  const inputSchema = z18.fromJSONSchema(
+  const inputSchema = z19.fromJSONSchema(
     remote.inputSchema
   );
   return {
@@ -12360,7 +13025,7 @@ function mcpToolName(serverName, remoteName) {
   const safe = remoteName.replace(/[^A-Za-z0-9_-]/g, "_") || "tool";
   const direct = `${prefix}${safe}`;
   if (direct.length <= 64 && safe === remoteName) return direct;
-  const suffix = `__${createHash7("sha256").update(remoteName).digest("hex").slice(0, 8)}`;
+  const suffix = `__${createHash11("sha256").update(remoteName).digest("hex").slice(0, 8)}`;
   return `${prefix}${safe.slice(0, Math.max(1, 64 - prefix.length - suffix.length))}${suffix}`;
 }
 function mcpErrorText(content) {
@@ -12379,7 +13044,7 @@ function isRecord3(value) {
 }
 
 // src/mcp/sdk.ts
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   getDefaultEnvironment,
@@ -12401,7 +13066,7 @@ async function connectSdkMcpClient(input, dependencies = DEFAULT_DEPENDENCIES) {
     command: config.command,
     args: [...config.args],
     env: { ...dependencies.defaultEnvironment(), ...config.env },
-    cwd: resolve14(input.workspace, config.cwd ?? "."),
+    cwd: resolve15(input.workspace, config.cwd ?? "."),
     // MCP servers frequently log startup banners to stderr. Inheriting that
     // stream corrupts Ink's input area, so connection errors are surfaced
     // through McpManager diagnostics instead.
@@ -12426,14 +13091,14 @@ async function connectSdkMcpClient(input, dependencies = DEFAULT_DEPENDENCIES) {
 }
 
 // src/auth/oauth.ts
-import { randomBytes as randomBytes2, createHash as createHash9 } from "crypto";
+import { randomBytes as randomBytes2, createHash as createHash13 } from "crypto";
 import { createServer as createServer2 } from "http";
 import { URL as URL2, URLSearchParams } from "url";
 
 // src/auth/oauth-config.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 function oauthCredentialId(tokenUrl, clientId) {
-  const digest = createHash8("sha256").update(`${tokenUrl}\0${clientId}`, "utf8").digest("base64url");
+  const digest = createHash12("sha256").update(`${tokenUrl}\0${clientId}`, "utf8").digest("base64url");
   return `oauth:${digest}`;
 }
 function parseOAuthLlmConfig(value) {
@@ -12606,8 +13271,8 @@ var OAuthCallbackAuthProvider = class {
   async #startCallbackServer(expectedState, signal) {
     let serverResolve;
     let serverReject;
-    const codePromise = new Promise((resolve26, reject) => {
-      serverResolve = resolve26;
+    const codePromise = new Promise((resolve28, reject) => {
+      serverResolve = resolve28;
       serverReject = reject;
     });
     const server = createServer2((req, res) => {
@@ -12641,7 +13306,7 @@ var OAuthCallbackAuthProvider = class {
       );
       serverResolve(code);
     });
-    return new Promise((resolve26, reject) => {
+    return new Promise((resolve28, reject) => {
       server.once("error", (error) => {
         reject(new Error(`OAuth callback server failed: ${error.message}`));
       });
@@ -12658,7 +13323,7 @@ var OAuthCallbackAuthProvider = class {
         signal.addEventListener("abort", () => {
           serverReject(new Error("OAuth flow aborted"));
         }, { once: true });
-        resolve26({ redirectUri, promise: codePromise });
+        resolve28({ redirectUri, promise: codePromise });
       });
     });
   }
@@ -12690,7 +13355,7 @@ var OAuthCallbackAuthProvider = class {
     return randomBytes2(32).toString("base64url");
   }
   #computeCodeChallenge(verifier) {
-    return createHash9("sha256").update(verifier).digest("base64url");
+    return createHash13("sha256").update(verifier).digest("base64url");
   }
   #generateState() {
     return randomBytes2(32).toString("base64url");
@@ -12799,6 +13464,141 @@ function isStoredToken(value) {
   return typeof value === "object" && value !== null && "accessToken" in value && typeof value.accessToken === "string" && value.accessToken.length > 0 && "expiresAt" in value && typeof value.expiresAt === "string" && (!("configVersion" in value) || value.configVersion === void 0 || Number.isInteger(value.configVersion) && value.configVersion >= 1) && (!("llmConfig" in value) || value.llmConfig === void 0 || isOAuthLlmConfig(value.llmConfig));
 }
 
+// src/permissions/policy.ts
+import { readFile as readFile15 } from "fs/promises";
+import { join as join18, resolve as resolve16 } from "path";
+import { z as z20 } from "zod";
+var DecisionSchema2 = z20.enum(["allow", "ask", "deny"]);
+var PrefixSchema = z20.array(z20.string().min(1).max(1024)).min(1).max(64);
+var RuleSchema = z20.object({
+  id: z20.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+  decision: DecisionSchema2,
+  prefix: PrefixSchema,
+  tool: z20.string().min(1).max(256).optional(),
+  agent: z20.enum(["main", "subagent"]).optional(),
+  justification: z20.string().min(1).max(2048).optional(),
+  match: z20.array(PrefixSchema).max(100).optional(),
+  notMatch: z20.array(PrefixSchema).max(100).optional()
+}).strict();
+var PolicyFileSchema = z20.object({ version: z20.literal(1), rules: z20.array(RuleSchema).max(1e4) }).strict();
+var CompiledPermissionPolicy = class {
+  #rules;
+  diagnostics;
+  constructor(rules, diagnostics = []) {
+    this.#rules = [...rules];
+    this.diagnostics = [...diagnostics];
+  }
+  get rules() {
+    return this.#rules.map((rule) => ({ ...rule, prefix: [...rule.prefix] }));
+  }
+  decide(request) {
+    const tokens = requestTokens(request);
+    const matches = this.#rules.filter((rule) => (rule.tool === void 0 || same(rule.tool, request.tool)) && (rule.agent === void 0 || rule.agent === request.agent) && prefixMatches(rule.prefix, tokens));
+    if (matches.length === 0) return void 0;
+    const strictest = matches.reduce((selected, candidate) => rank(candidate.decision) > rank(selected.decision) ? candidate : selected);
+    const reason = strictest.justification ?? `Permission rule ${strictest.id} from ${strictest.tier} policy`;
+    return { decision: strictest.decision, reason };
+  }
+};
+async function loadPermissionPolicy(options) {
+  const sources = [
+    ...options.managedPath === void 0 ? [] : [{ tier: "managed", path: resolve16(options.managedPath) }],
+    { tier: "user", path: join18(resolve16(options.home), ".flavor-code", "permissions.json") },
+    { tier: "project", path: join18(resolve16(options.workspace), ".flavor", "permissions.json") },
+    { tier: "local", path: join18(resolve16(options.workspace), ".flavor", "permissions.local.json") }
+  ];
+  const rules = [];
+  for (const source of sources) {
+    let raw;
+    try {
+      raw = await readFile15(source.path, "utf8");
+    } catch (error) {
+      if (isCode6(error, "ENOENT")) continue;
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = PolicyFileSchema.parse(JSON.parse(raw));
+    } catch (error) {
+      throw new Error(`Invalid ${source.tier} permission policy ${source.path}: ${errorMessage(error)}`);
+    }
+    for (const input of parsed.rules) {
+      validateExamples(input, source.path);
+      rules.push({ ...input, source: source.path, tier: source.tier });
+    }
+  }
+  for (const input of options.sessionRules ?? []) {
+    const rule = RuleSchema.parse(input);
+    validateExamples(rule, "session");
+    rules.push({ ...rule, source: "session", tier: "session" });
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const rule of rules) {
+    if (ids.has(rule.id)) throw new Error(`Duplicate permission rule id: ${rule.id}`);
+    ids.add(rule.id);
+  }
+  return new CompiledPermissionPolicy(rules, shadowDiagnostics(rules));
+}
+function validateExamples(rule, source) {
+  for (const example of rule.match ?? []) {
+    if (!prefixMatches(rule.prefix, example)) throw new Error(`Permission rule ${rule.id} in ${source} failed a match example`);
+  }
+  for (const example of rule.notMatch ?? []) {
+    if (prefixMatches(rule.prefix, example)) throw new Error(`Permission rule ${rule.id} in ${source} failed a notMatch example`);
+  }
+}
+function shadowDiagnostics(rules) {
+  const diagnostics = [];
+  for (let index = 0; index < rules.length; index += 1) {
+    const rule = rules[index];
+    const shadow = rules.slice(0, index).find((candidate) => sameScope(candidate, rule) && prefixMatches(candidate.prefix, rule.prefix) && rank(candidate.decision) >= rank(rule.decision));
+    if (shadow !== void 0) diagnostics.push(`Permission rule ${rule.id} is shadowed by ${shadow.id}`);
+  }
+  return diagnostics;
+}
+function sameScope(left, right) {
+  return (left.tool === void 0 || right.tool === void 0 || same(left.tool, right.tool)) && (left.agent === void 0 || right.agent === void 0 || left.agent === right.agent);
+}
+function requestTokens(request) {
+  if (request.command === void 0) return [request.tool];
+  if (request.args !== void 0 && request.args.length > 0) return [request.command, ...request.args];
+  return splitCommand(request.command);
+}
+function splitCommand(command) {
+  const result = [];
+  let current = "";
+  let quote;
+  for (const character of command.trim()) {
+    if (character === "'" || character === '"') {
+      if (quote === character) quote = void 0;
+      else if (quote === void 0) quote = character;
+      else current += character;
+    } else if (/\s/.test(character) && quote === void 0) {
+      if (current.length > 0) {
+        result.push(current);
+        current = "";
+      }
+    } else current += character;
+  }
+  if (current.length > 0) result.push(current);
+  return result;
+}
+function prefixMatches(prefix, input) {
+  return prefix.length <= input.length && prefix.every((token, index) => same(token, input[index] ?? ""));
+}
+function same(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+function rank(decision) {
+  return decision === "deny" ? 2 : decision === "ask" ? 1 : 0;
+}
+function isCode6(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/prompts/system.ts
 function buildSystemPrompt(options) {
   const sections = [
@@ -12925,9 +13725,9 @@ function data(value) {
 }
 
 // src/skills/registry.ts
-import { constants as constants3 } from "fs";
-import { lstat as lstat8, open as defaultOpen, readdir as readdir6, realpath as realpath6 } from "fs/promises";
-import { isAbsolute as isAbsolute7, relative as relative12, resolve as resolve15, sep as sep11 } from "path";
+import { constants as constants4 } from "fs";
+import { lstat as lstat8, open as defaultOpen, readdir as readdir5, realpath as realpath6 } from "fs/promises";
+import { isAbsolute as isAbsolute7, relative as relative12, resolve as resolve17, sep as sep12 } from "path";
 import { marked } from "marked";
 import { parseDocument } from "yaml";
 var SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -13058,7 +13858,7 @@ var SkillRegistry = class {
     const body = await this.loadBody(record.metadata);
     const references = extractResourceReferences(body);
     if (!references.has(normalized)) throw new Error(`Skill resource is not directly referenced: ${reference}`);
-    const candidate = resolve15(record.metadata.root, ...parts);
+    const candidate = resolve17(record.metadata.root, ...parts);
     const file = await openVerifiedFile(candidate, record.metadata.root, "Resource", this.#options.openFile);
     try {
       if (file.snapshot.size > BigInt(this.#options.maxResourceBytes)) throw new Error(`Skill resource is too large: ${reference}`);
@@ -13087,14 +13887,14 @@ var SkillRegistry = class {
   async #discoverSource(roots, source) {
     const found = [];
     for (const configuredRoot of roots) {
-      const root = resolve15(configuredRoot);
+      const root = resolve17(configuredRoot);
       let entries;
       let physicalRoot = root;
       try {
         const rootInfo = await lstat8(root);
         if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw new Error("Skill root must be a real directory");
         physicalRoot = await realpath6(root);
-        entries = await readdir6(root, { withFileTypes: true });
+        entries = await readdir5(root, { withFileTypes: true });
       } catch (error) {
         if (isMissing2(error)) continue;
         this.#diagnose(root, error);
@@ -13102,13 +13902,13 @@ var SkillRegistry = class {
       }
       entries.sort((left, right) => compareCodePoints(left.name, right.name));
       for (const entry2 of entries) {
-        const skillRoot = resolve15(root, entry2.name);
+        const skillRoot = resolve17(root, entry2.name);
         try {
           if (entry2.isSymbolicLink()) throw new Error("Symlinked skill directories are not allowed");
           if (!entry2.isDirectory()) continue;
           const physicalSkillRoot = await realpath6(skillRoot);
-          if (!isWithin3(physicalRoot, physicalSkillRoot)) throw new Error("Skill directory escapes its registry root");
-          const skillFile = resolve15(skillRoot, "SKILL.md");
+          if (!isWithin4(physicalRoot, physicalSkillRoot)) throw new Error("Skill directory escapes its registry root");
+          const skillFile = resolve17(skillRoot, "SKILL.md");
           const parsed = await readFrontmatterFile(
             skillFile,
             physicalSkillRoot,
@@ -13249,9 +14049,9 @@ async function openVerifiedFile(path, root, label, opener, expected) {
   if (initial.isSymbolicLink()) throw new Error(`${label} symlinks are not allowed`);
   assertRegular(initial, label);
   const canonical3 = await realpath6(path);
-  if (!isWithin3(root, canonical3)) throw new Error(`${label} escapes the skill root`);
-  const noFollow = typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
-  const handle = await opener(canonical3, constants3.O_RDONLY | noFollow);
+  if (!isWithin4(root, canonical3)) throw new Error(`${label} escapes the skill root`);
+  const noFollow = typeof constants4.O_NOFOLLOW === "number" ? constants4.O_NOFOLLOW : 0;
+  const handle = await opener(canonical3, constants4.O_RDONLY | noFollow);
   try {
     const opened = await handle.stat({ bigint: true });
     assertRegular(opened, label);
@@ -13308,9 +14108,9 @@ function decodeUtf82(content, label) {
     throw new Error(`${label} contains invalid UTF-8 encoding`, { cause: error });
   }
 }
-function isWithin3(root, candidate) {
+function isWithin4(root, candidate) {
   const delta = relative12(root, candidate);
-  return delta === "" || delta !== ".." && !delta.startsWith(`..${sep11}`) && !isAbsolute7(delta);
+  return delta === "" || delta !== ".." && !delta.startsWith(`..${sep12}`) && !isAbsolute7(delta);
 }
 function isMissing2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
@@ -13357,7 +14157,7 @@ function score(metadata, query) {
 }
 
 // src/skills/tool.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 
 // src/skills/arguments.ts
 function expandSkillArguments(body, argumentsText) {
@@ -13414,13 +14214,13 @@ function splitSkillArguments(input) {
 }
 
 // src/skills/tool.ts
-var SkillInput = z19.object({
-  skill: z19.string().min(1),
-  arguments: z19.string().optional()
+var SkillInput = z21.object({
+  skill: z21.string().min(1),
+  arguments: z21.string().optional()
 }).strict();
-var SkillResourceInput = z19.object({
-  skill: z19.string().min(1),
-  reference: z19.string().min(1)
+var SkillResourceInput = z21.object({
+  skill: z21.string().min(1),
+  reference: z21.string().min(1)
 }).strict();
 function createSkillTool(registry) {
   return {
@@ -13472,98 +14272,125 @@ function createSkillResourceTool(registry) {
 }
 
 // src/session/store.ts
-import { constants as constants4 } from "fs";
-import { lstat as lstat9, mkdir as mkdir14, open as open8, readFile as readFile14, readdir as readdir7, realpath as realpath7, rename as rename6, rm as rm6, stat as stat6 } from "fs/promises";
-import { basename as basename3, dirname as dirname15, join as join17, relative as relative13, resolve as resolve16, sep as sep12 } from "path";
-import { randomUUID as randomUUID9 } from "crypto";
-import { z as z20 } from "zod";
-var SESSION_VERSION = 3;
+import { constants as constants5 } from "fs";
+import { lstat as lstat9, mkdir as mkdir14, open as open8, readFile as readFile16, readdir as readdir6, realpath as realpath7, rename as rename6, rm as rm6, stat as stat6 } from "fs/promises";
+import { basename as basename3, dirname as dirname15, join as join19, relative as relative13, resolve as resolve18, sep as sep13 } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
+import { z as z22 } from "zod";
+var SESSION_VERSION = 4;
 var DEFAULT_MAX_SESSION_BYTES = 5 * 1024 * 1024;
-var SessionIdSchema = z20.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/, "Invalid session id");
-var IsoDateSchema = z20.string().datetime({ offset: true });
-var ToolCallSchema = z20.object({
-  id: z20.string().min(1).max(256),
-  name: z20.string().min(1).max(256),
-  input: z20.unknown()
+var SessionIdSchema = z22.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/, "Invalid session id");
+var IsoDateSchema = z22.string().datetime({ offset: true });
+var ToolCallSchema = z22.object({
+  id: z22.string().min(1).max(256),
+  name: z22.string().min(1).max(256),
+  input: z22.unknown()
 }).strict();
-var TextContentBlockSchema = z20.object({
-  type: z20.literal("text"),
-  text: z20.string().max(DEFAULT_MAX_SESSION_BYTES)
+var TextContentBlockSchema = z22.object({
+  type: z22.literal("text"),
+  text: z22.string().max(DEFAULT_MAX_SESSION_BYTES)
 }).strict();
-var ImageContentBlockSchema = z20.object({
-  type: z20.literal("image"),
-  source: z20.object({ type: z20.literal("file"), path: z20.string().min(1).max(32768) }).strict(),
-  mediaType: z20.enum(["image/png", "image/jpeg", "image/webp"]),
-  sha256: z20.string().regex(/^[a-f0-9]{64}$/),
-  bytes: z20.number().int().positive().max(20 * 1024 * 1024),
-  name: z20.string().min(1).max(255).optional()
+var ImageContentBlockSchema = z22.object({
+  type: z22.literal("image"),
+  source: z22.object({ type: z22.literal("file"), path: z22.string().min(1).max(32768) }).strict(),
+  mediaType: z22.enum(["image/png", "image/jpeg", "image/webp"]),
+  sha256: z22.string().regex(/^[a-f0-9]{64}$/),
+  bytes: z22.number().int().positive().max(20 * 1024 * 1024),
+  name: z22.string().min(1).max(255).optional()
 }).strict();
-var UserContentSchema = z20.union([
-  z20.string().max(DEFAULT_MAX_SESSION_BYTES),
-  z20.array(z20.discriminatedUnion("type", [TextContentBlockSchema, ImageContentBlockSchema])).min(1).max(100)
+var UserContentSchema = z22.union([
+  z22.string().max(DEFAULT_MAX_SESSION_BYTES),
+  z22.array(z22.discriminatedUnion("type", [TextContentBlockSchema, ImageContentBlockSchema])).min(1).max(100)
 ]);
 var MessageMetadataShape = {
-  toolCallId: z20.string().min(1).max(256).optional(),
-  toolCalls: z20.array(ToolCallSchema).max(1e3).optional()
+  toolCallId: z22.string().min(1).max(256).optional(),
+  toolCalls: z22.array(ToolCallSchema).max(1e3).optional()
 };
-var MessageSchema = z20.discriminatedUnion("role", [
-  z20.object({ role: z20.literal("user"), content: UserContentSchema, ...MessageMetadataShape }).strict(),
-  z20.object({ role: z20.literal("assistant"), content: z20.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict(),
-  z20.object({ role: z20.literal("tool"), content: z20.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict()
+var MessageSchema = z22.discriminatedUnion("role", [
+  z22.object({ role: z22.literal("user"), content: UserContentSchema, ...MessageMetadataShape }).strict(),
+  z22.object({ role: z22.literal("system"), content: z22.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict(),
+  z22.object({ role: z22.literal("assistant"), content: z22.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict(),
+  z22.object({ role: z22.literal("tool"), content: z22.string().max(DEFAULT_MAX_SESSION_BYTES), ...MessageMetadataShape }).strict()
 ]);
-var LegacySummarySchema = z20.object({ role: z20.literal("system"), content: z20.string().max(DEFAULT_MAX_SESSION_BYTES) }).strict();
-var CompactBoundarySchema = z20.object({
-  summary: z20.string().min(1).max(DEFAULT_MAX_SESSION_BYTES),
+var LegacySummarySchema = z22.object({ role: z22.literal("system"), content: z22.string().max(DEFAULT_MAX_SESSION_BYTES) }).strict();
+var CompactBoundarySchema = z22.object({
+  summary: z22.string().min(1).max(DEFAULT_MAX_SESSION_BYTES),
   compactedAt: IsoDateSchema
 }).strict();
-var StateSchema = z20.enum(["pending", "running", "completed", "failed", "blocked", "cancelled"]);
-var MemoryLifecycleSchema = z20.object({
-  status: z20.enum(["active", "completed", "abandoned"]),
-  taskId: z20.string().regex(/^memory-[A-Za-z0-9._-]{1,120}$/).optional(),
-  messageStart: z20.number().int().min(0).max(5e4).optional(),
+var StateSchema = z22.enum(["pending", "running", "completed", "failed", "blocked", "cancelled"]);
+var MemoryLifecycleSchema = z22.object({
+  status: z22.enum(["active", "completed", "abandoned"]),
+  taskId: z22.string().regex(/^memory-[A-Za-z0-9._-]{1,120}$/).optional(),
+  messageStart: z22.number().int().min(0).max(5e4).optional(),
   finalizedAt: IsoDateSchema.optional(),
-  transcriptHash: z20.string().regex(/^[a-f0-9]{64}$/).optional()
+  transcriptHash: z22.string().regex(/^[a-f0-9]{64}$/).optional()
 }).strict();
-var SessionBaseSchema = z20.object({
+var SessionBaseSchema = z22.object({
   sessionId: SessionIdSchema,
   createdAt: IsoDateSchema,
   updatedAt: IsoDateSchema,
-  workspace: z20.object({ path: z20.string().min(1).max(32768) }).strict(),
-  tasks: z20.object({
+  workspace: z22.object({ path: z22.string().min(1).max(32768) }).strict(),
+  tasks: z22.object({
     plan: TaskPlanSchema.optional(),
     graph: TaskGraphSchema.optional(),
-    states: z20.record(z20.string(), StateSchema),
-    results: z20.record(z20.string(), SubagentResultSchema)
+    states: z22.record(z22.string(), StateSchema),
+    results: z22.record(z22.string(), SubagentResultSchema)
   }).strict(),
-  models: z20.object({ main: z20.string().min(1).max(1024), subagent: z20.string().min(1).max(1024) }).strict(),
+  models: z22.object({ main: z22.string().min(1).max(1024), subagent: z22.string().min(1).max(1024) }).strict(),
   permissionMode: PermissionModeSchema,
   memory: MemoryLifecycleSchema.optional()
 }).strict();
 var SessionDocumentV1Schema = SessionBaseSchema.extend({
-  version: z20.literal(1),
-  conversation: z20.object({
+  version: z22.literal(1),
+  conversation: z22.object({
     summary: LegacySummarySchema.optional(),
-    messages: z20.array(MessageSchema).max(5e4)
+    messages: z22.array(MessageSchema).max(5e4)
   }).strict()
 }).strict();
-var ConversationSchema = z20.object({
+var ConversationSchema = z22.object({
   compact: CompactBoundarySchema.optional(),
-  messages: z20.array(MessageSchema).max(5e4)
+  messages: z22.array(MessageSchema).max(5e4)
 }).strict();
 var SessionDocumentV2Schema = SessionBaseSchema.extend({
-  version: z20.literal(2),
+  version: z22.literal(2),
   conversation: ConversationSchema
 }).strict();
-var TranscriptStateSchema = z20.custom(isTranscriptState, "Invalid transcript state");
-var TimelineSchema = z20.object({
-  version: z20.literal(1),
+var TranscriptStateSchema = z22.custom(isTranscriptState, "Invalid transcript state");
+var TimelineSchema = z22.object({
+  version: z22.literal(1),
   state: TranscriptStateSchema
 }).strict();
+var ContextEpochSchema = z22.object({
+  version: z22.literal(1),
+  id: z22.string().uuid(),
+  startedAt: IsoDateSchema,
+  stableMessages: z22.array(z22.object({
+    role: z22.literal("system"),
+    content: z22.string().max(DEFAULT_MAX_SESSION_BYTES),
+    cacheBreakpoint: z22.boolean().optional()
+  }).strict()).max(1e3),
+  sources: z22.record(z22.string().min(1).max(128), z22.string().max(DEFAULT_MAX_SESSION_BYTES)),
+  stableSourceHash: z22.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var ContextVisibilityRecordSchema = z22.object({
+  id: z22.string().uuid(),
+  role: z22.literal("system"),
+  content: z22.string().max(DEFAULT_MAX_SESSION_BYTES),
+  admittedAt: IsoDateSchema,
+  scope: z22.literal("run")
+}).strict();
+var SessionDocumentV3Schema = SessionBaseSchema.extend({
+  version: z22.literal(3),
+  conversation: ConversationSchema,
+  timeline: TimelineSchema
+}).strict();
 var SessionDocumentSchema = SessionBaseSchema.extend({
-  version: z20.literal(SESSION_VERSION),
-  conversation: z20.object({
+  version: z22.literal(SESSION_VERSION),
+  conversation: z22.object({
     compact: CompactBoundarySchema.optional(),
-    messages: z20.array(MessageSchema).max(5e4)
+    epoch: ContextEpochSchema.optional(),
+    visibilityLog: z22.array(ContextVisibilityRecordSchema).max(1e4).optional(),
+    messages: z22.array(MessageSchema).max(5e4)
   }).strict(),
   timeline: TimelineSchema
 }).strict();
@@ -13573,8 +14400,8 @@ var SessionStore = class {
   #maxBytes;
   #maxSessions;
   constructor(options) {
-    this.#workspace = resolve16(options.workspace);
-    this.#sessions = join17(this.#workspace, ".flavor", "sessions");
+    this.#workspace = resolve18(options.workspace);
+    this.#sessions = join19(this.#workspace, ".flavor", "sessions");
     this.#maxBytes = options.maxBytes ?? DEFAULT_MAX_SESSION_BYTES;
     if (!Number.isSafeInteger(this.#maxBytes) || this.#maxBytes < 256) throw new Error("maxBytes must be an integer of at least 256");
     this.#maxSessions = options.maxSessions ?? 50;
@@ -13585,11 +14412,13 @@ var SessionStore = class {
     await this.#assertWorkspace(document.workspace.path);
     await this.#prepareDirectory();
     const target = this.#path(document.sessionId);
-    const { conversation: { messages, compact }, timeline, ...meta } = document;
+    const { conversation: { messages, compact, epoch, visibilityLog }, timeline, ...meta } = document;
     const metaLine = JSON.stringify({
       __meta: true,
       ...meta,
       ...compact === void 0 ? {} : { compact },
+      ...epoch === void 0 ? {} : { epoch },
+      ...visibilityLog === void 0 ? {} : { visibilityLog },
       timeline: {
         version: timeline.version,
         nextId: timeline.state.nextId,
@@ -13604,10 +14433,10 @@ var SessionStore = class {
     const body = `${lines.join("\n")}
 `;
     if (Buffer.byteLength(body) > this.#maxBytes) throw new Error(`Session exceeds maximum size of ${this.#maxBytes} bytes`);
-    const temporary = join17(this.#sessions, `.${document.sessionId}.${process.pid}.${randomUUID9()}.tmp`);
+    const temporary = join19(this.#sessions, `.${document.sessionId}.${process.pid}.${randomUUID11()}.tmp`);
     let handle;
     try {
-      handle = await open8(temporary, constants4.O_CREAT | constants4.O_EXCL | constants4.O_WRONLY, 384);
+      handle = await open8(temporary, constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY, 384);
       await handle.writeFile(body, "utf8");
       await handle.sync();
       await handle.close();
@@ -13632,7 +14461,7 @@ var SessionStore = class {
     try {
       raw = await boundedRead(path, this.#maxBytes);
     } catch (error) {
-      if (isCode6(error, "ENOENT")) throw new Error(`Session "${sessionId}" was not found in this workspace`);
+      if (isCode7(error, "ENOENT")) throw new Error(`Session "${sessionId}" was not found in this workspace`);
       throw error;
     }
     let parsed;
@@ -13643,6 +14472,8 @@ var SessionStore = class {
       throw new Error(`Session "${sessionId}" is corrupt or incompatible and was quarantined as ${basename3(quarantine)}: ${message(error)}`);
     }
     await this.#assertWorkspace(parsed.workspace.path);
+    const storedVersion = storedSessionVersion(raw);
+    if (storedVersion < SESSION_VERSION) await this.#backupLegacy(path, raw, storedVersion);
     return normalizeAbandonedTasks(parsed);
   }
   #parseSession(raw) {
@@ -13658,19 +14489,25 @@ var SessionStore = class {
       const timelineRecords = records.filter(isTimelineRecord);
       const summary2 = meta.summary;
       const compact = meta.compact;
+      const epoch = meta.epoch;
+      const visibilityLog = meta.visibilityLog;
       const timeline = meta.timeline;
       delete meta.__meta;
       delete meta.summary;
       delete meta.compact;
+      delete meta.epoch;
+      delete meta.visibilityLog;
       delete meta.timeline;
       candidate = {
         ...meta,
         conversation: {
           ...meta.version === 1 && summary2 !== void 0 ? { summary: summary2 } : {},
-          ...(meta.version === 2 || meta.version === SESSION_VERSION) && compact !== void 0 ? { compact } : {},
+          ...(meta.version === 2 || meta.version === 3 || meta.version === SESSION_VERSION) && compact !== void 0 ? { compact } : {},
+          ...meta.version === SESSION_VERSION && epoch !== void 0 ? { epoch } : {},
+          ...meta.version === SESSION_VERSION && visibilityLog !== void 0 ? { visibilityLog } : {},
           messages
         },
-        ...meta.version === SESSION_VERSION ? {
+        ...meta.version === 3 || meta.version === SESSION_VERSION ? {
           timeline: timelineFromRecords(timeline, timelineRecords)
         } : {}
       };
@@ -13683,10 +14520,10 @@ var SessionStore = class {
     try {
       await this.#assertSafeExistingDirectory();
     } catch (error) {
-      if (isCode6(error, "ENOENT")) return [];
+      if (isCode7(error, "ENOENT")) return [];
       throw error;
     }
-    const names = (await readdir7(this.#sessions)).filter((name) => name.endsWith(".jsonl")).sort();
+    const names = (await readdir6(this.#sessions)).filter((name) => name.endsWith(".jsonl") && !name.endsWith(".events.jsonl")).sort();
     const entries = [];
     for (const name of names) {
       const id = name.slice(0, -6);
@@ -13705,7 +14542,7 @@ var SessionStore = class {
     try {
       await this.#assertSafeExistingDirectory();
     } catch (error) {
-      if (isCode6(error, "ENOENT")) return;
+      if (isCode7(error, "ENOENT")) return;
       throw error;
     }
     const path = this.#path(sessionId);
@@ -13713,14 +14550,15 @@ var SessionStore = class {
       const metadata = await lstat9(path);
       if (!metadata.isFile()) throw new Error("Session path is not a regular file");
       await rm6(path);
+      await rm6(join19(this.#sessions, `${sessionId}.events.jsonl`), { force: true }).catch(() => void 0);
     } catch (error) {
-      if (!isCode6(error, "ENOENT")) throw error;
+      if (!isCode7(error, "ENOENT")) throw error;
     }
   }
   #path(sessionId) {
     SessionIdSchema.parse(sessionId);
-    const path = resolve16(this.#sessions, `${sessionId}.jsonl`);
-    if (!isWithin4(this.#sessions, path)) throw new Error("Invalid session id");
+    const path = resolve18(this.#sessions, `${sessionId}.jsonl`);
+    if (!isWithin5(this.#sessions, path)) throw new Error("Invalid session id");
     return path;
   }
   async #prune() {
@@ -13729,6 +14567,7 @@ var SessionStore = class {
     const excess = entries.slice(this.#maxSessions);
     for (const entry2 of excess) {
       await rm6(this.#path(entry2.sessionId), { force: true }).catch(() => void 0);
+      await rm6(join19(this.#sessions, `${entry2.sessionId}.events.jsonl`), { force: true }).catch(() => void 0);
     }
   }
   async #assertWorkspace(stored) {
@@ -13747,19 +14586,38 @@ var SessionStore = class {
     await assertNoSymlink3(this.#workspace, this.#sessions);
     const canonicalRoot = await realpath7(this.#workspace);
     const canonicalSessions = await realpath7(this.#sessions);
-    if (!isWithin4(canonicalRoot, canonicalSessions)) throw new Error("Session directory escapes the workspace");
+    if (!isWithin5(canonicalRoot, canonicalSessions)) throw new Error("Session directory escapes the workspace");
   }
   async #quarantine(path) {
-    const target = `${path}.corrupt-${Date.now()}-${randomUUID9().slice(0, 8)}`;
+    const target = `${path}.corrupt-${Date.now()}-${randomUUID11().slice(0, 8)}`;
     await rename6(path, target);
     return target;
   }
+  async #backupLegacy(path, raw, version) {
+    const target = `${path}.v${version}.bak`;
+    let handle;
+    try {
+      handle = await open8(target, constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY, 384);
+      await handle.writeFile(raw, "utf8");
+      await handle.sync();
+    } catch (error) {
+      if (!isCode7(error, "EEXIST")) throw error;
+    } finally {
+      await handle?.close().catch(() => void 0);
+    }
+  }
 };
+function storedSessionVersion(raw) {
+  const trimmed = raw.trim();
+  const first = JSON.parse(trimmed.split("\n", 1)[0] ?? "{}");
+  const candidate = first.__meta === true ? first.version : JSON.parse(trimmed).version;
+  return typeof candidate === "number" && Number.isInteger(candidate) ? candidate : 0;
+}
 async function boundedRead(path, maxBytes) {
   const metadata = await stat6(path);
   if (!metadata.isFile()) throw new Error("Session path is not a regular file");
   if (metadata.size > maxBytes) throw new Error(`Session exceeds maximum read size of ${maxBytes} bytes`);
-  const value = await readFile14(path);
+  const value = await readFile16(path);
   if (value.byteLength > maxBytes) throw new Error(`Session exceeds maximum read size of ${maxBytes} bytes`);
   return value.toString("utf8");
 }
@@ -13816,6 +14674,10 @@ function normalizeAbandonedTasks(document) {
 function parseAndMigrateSession(input) {
   if (typeof input !== "object" || input === null || !("version" in input)) throw new Error("Session version is missing");
   if (input.version === SESSION_VERSION) return SessionDocumentSchema.parse(input);
+  if (input.version === 3) {
+    const legacy2 = SessionDocumentV3Schema.parse(input);
+    return SessionDocumentSchema.parse({ ...legacy2, version: SESSION_VERSION });
+  }
   if (input.version === 2) {
     const legacy2 = SessionDocumentV2Schema.parse(input);
     return SessionDocumentSchema.parse({
@@ -13823,7 +14685,7 @@ function parseAndMigrateSession(input) {
       version: SESSION_VERSION,
       timeline: {
         version: 1,
-        state: transcriptFromLegacyConversation(legacy2.conversation.messages, legacy2.conversation.compact)
+        state: transcriptFromLegacyConversation(legacy2.conversation.messages.filter((message2) => message2.role !== "system"), legacy2.conversation.compact)
       }
     });
   }
@@ -13842,7 +14704,7 @@ function parseAndMigrateSession(input) {
     },
     timeline: {
       version: 1,
-      state: transcriptFromLegacyConversation(conversation.messages, compact)
+      state: transcriptFromLegacyConversation(conversation.messages.filter((message2) => message2.role !== "system"), compact)
     }
   });
 }
@@ -13897,9 +14759,9 @@ function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function assertNoSymlink3(root, target) {
-  let cursor = resolve16(target);
-  const stop = resolve16(root);
-  if (!isWithin4(stop, cursor)) throw new Error("Session path escapes the workspace");
+  let cursor = resolve18(target);
+  const stop = resolve18(root);
+  if (!isWithin5(stop, cursor)) throw new Error("Session path escapes the workspace");
   const chain = [];
   while (cursor !== stop) {
     chain.push(cursor);
@@ -13909,22 +14771,22 @@ async function assertNoSymlink3(root, target) {
     try {
       if ((await lstat9(path)).isSymbolicLink()) throw new Error(`Session path contains a symbolic link: ${path}`);
     } catch (error) {
-      if (!isCode6(error, "ENOENT")) throw error;
+      if (!isCode7(error, "ENOENT")) throw error;
     }
   }
 }
-function isWithin4(root, path) {
-  const value = relative13(resolve16(root), resolve16(path));
-  return value === "" || !value.startsWith(`..${sep12}`) && value !== ".." && !value.includes(":");
+function isWithin5(root, path) {
+  const value = relative13(resolve18(root), resolve18(path));
+  return value === "" || !value.startsWith(`..${sep13}`) && value !== ".." && !value.includes(":");
 }
 async function canonical2(path) {
   try {
-    return await realpath7(resolve16(path));
+    return await realpath7(resolve18(path));
   } catch {
-    return resolve16(path);
+    return resolve18(path);
   }
 }
-function isCode6(error, code) {
+function isCode7(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 function sanitize2(input, seen = /* @__PURE__ */ new WeakSet()) {
@@ -13946,47 +14808,47 @@ function sanitize2(input, seen = /* @__PURE__ */ new WeakSet()) {
 }
 
 // src/sleep/organizer.ts
-import { constants as constants5 } from "fs";
-import { randomUUID as randomUUID10 } from "crypto";
-import { lstat as lstat10, mkdir as mkdir15, open as open9, readdir as readdir8, realpath as realpath8, rename as rename7, rm as rm7 } from "fs/promises";
-import { isAbsolute as isAbsolute8, join as join18, relative as relative14, resolve as resolve17, sep as sep13 } from "path";
-import { z as z21 } from "zod";
-var DateKeySchema = z21.string().regex(/^\d{4}-\d{2}-\d{2}$/);
-var ReviewSchema = z21.object({
-  title: z21.string().min(1).max(120),
-  taskSummary: z21.array(z21.string().min(1)).min(1).max(20),
-  executionReflection: z21.array(z21.string().min(1)).min(1).max(20),
-  decisionsAndLearnings: z21.array(z21.string().min(1)).max(20),
-  openQuestionsAndRisks: z21.array(z21.string().min(1)).max(20),
-  tomorrowPlan: z21.array(z21.string().min(1)).min(1).max(20),
-  toolUsage: z21.object({
-    totalCalls: z21.number().int().min(0),
-    shell: z21.number().int().min(0),
-    fileRead: z21.number().int().min(0),
-    fileWrite: z21.number().int().min(0),
-    search: z21.number().int().min(0),
-    lsp: z21.number().int().min(0),
-    subagent: z21.number().int().min(0),
-    other: z21.number().int().min(0)
+import { constants as constants6 } from "fs";
+import { randomUUID as randomUUID12 } from "crypto";
+import { lstat as lstat10, mkdir as mkdir15, open as open9, readdir as readdir7, realpath as realpath8, rename as rename7, rm as rm7 } from "fs/promises";
+import { isAbsolute as isAbsolute8, join as join20, relative as relative14, resolve as resolve19, sep as sep14 } from "path";
+import { z as z23 } from "zod";
+var DateKeySchema = z23.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+var ReviewSchema = z23.object({
+  title: z23.string().min(1).max(120),
+  taskSummary: z23.array(z23.string().min(1)).min(1).max(20),
+  executionReflection: z23.array(z23.string().min(1)).min(1).max(20),
+  decisionsAndLearnings: z23.array(z23.string().min(1)).max(20),
+  openQuestionsAndRisks: z23.array(z23.string().min(1)).max(20),
+  tomorrowPlan: z23.array(z23.string().min(1)).min(1).max(20),
+  toolUsage: z23.object({
+    totalCalls: z23.number().int().min(0),
+    shell: z23.number().int().min(0),
+    fileRead: z23.number().int().min(0),
+    fileWrite: z23.number().int().min(0),
+    search: z23.number().int().min(0),
+    lsp: z23.number().int().min(0),
+    subagent: z23.number().int().min(0),
+    other: z23.number().int().min(0)
   }).strict(),
-  tokenEstimate: z21.object({
-    estimatedInput: z21.number().int().min(0),
-    estimatedOutput: z21.number().int().min(0),
-    notes: z21.string().max(200)
+  tokenEstimate: z23.object({
+    estimatedInput: z23.number().int().min(0),
+    estimatedOutput: z23.number().int().min(0),
+    notes: z23.string().max(200)
   }).strict(),
-  humanIntervention: z21.object({
-    approvalRequests: z21.number().int().min(0),
-    questionsAsked: z21.number().int().min(0),
-    summary: z21.string().max(300)
+  humanIntervention: z23.object({
+    approvalRequests: z23.number().int().min(0),
+    questionsAsked: z23.number().int().min(0),
+    summary: z23.string().max(300)
   }).strict(),
-  qualityIndicators: z21.object({
-    hallucinationAlerts: z21.array(z21.string().min(1)).max(10),
-    failuresAndRetries: z21.array(z21.string().min(1)).max(10),
-    codeChangeSummary: z21.string().max(500),
-    overallAssessment: z21.string().max(200)
+  qualityIndicators: z23.object({
+    hallucinationAlerts: z23.array(z23.string().min(1)).max(10),
+    failuresAndRetries: z23.array(z23.string().min(1)).max(10),
+    codeChangeSummary: z23.string().max(500),
+    overallAssessment: z23.string().max(200)
   }).strict(),
-  knowledgeDeposits: z21.object({
-    worthRemembering: z21.array(z21.string().min(1)).max(10)
+  knowledgeDeposits: z23.object({
+    worthRemembering: z23.array(z23.string().min(1)).max(10)
   }).strict()
 }).strict();
 function localDateKey(date) {
@@ -14003,8 +14865,8 @@ var ProjectSleepOrganizer = class {
   #sessions;
   #generate;
   constructor(options) {
-    this.#workspace = resolve17(options.workspace);
-    this.#sleepDirectory = join18(this.#workspace, ".flavor", "sleep");
+    this.#workspace = resolve19(options.workspace);
+    this.#sleepDirectory = join20(this.#workspace, ".flavor", "sleep");
     this.#sessions = options.sessions ?? new SessionStore({ workspace: this.#workspace });
     this.#generate = options.generate;
   }
@@ -14013,10 +14875,10 @@ var ProjectSleepOrganizer = class {
     signal.throwIfAborted();
     await this.#prepareDirectory();
     if (await this.#hasReport(date)) return { status: "exists", date };
-    const lockPath = join18(this.#sleepDirectory, `.${date}.lock`);
+    const lockPath = join20(this.#sleepDirectory, `.${date}.lock`);
     let lock;
     try {
-      lock = await open9(lockPath, constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY, 384);
+      lock = await open9(lockPath, constants6.O_CREAT | constants6.O_EXCL | constants6.O_WRONLY, 384);
     } catch (error) {
       if (hasCode(error, "EEXIST")) return { status: "locked", date };
       throw error;
@@ -14048,7 +14910,7 @@ Previous output was invalid. Repair it and return strict JSON only.`;
       }
       if (review === void 0) throw lastError;
       const filename2 = `${date}-${filenameSummary(review.title)}.md`;
-      const path = join18(this.#sleepDirectory, filename2);
+      const path = join20(this.#sleepDirectory, filename2);
       const markdown = renderSleepReport(date, review, documents);
       await this.#atomicWrite(path, markdown);
       return { status: "written", date, path, sessionCount: documents.length };
@@ -14090,24 +14952,24 @@ Previous output was invalid. Repair it and return strict JSON only.`;
     });
   }
   async #prepareDirectory() {
-    const flavorDirectory = join18(this.#workspace, ".flavor");
+    const flavorDirectory = join20(this.#workspace, ".flavor");
     await assertNotSymlink(flavorDirectory);
     await mkdir15(flavorDirectory, { recursive: true, mode: 448 });
     await assertNotSymlink(this.#sleepDirectory);
     await mkdir15(this.#sleepDirectory, { recursive: true, mode: 448 });
     const root = await realpath8(this.#workspace);
     const target = await realpath8(this.#sleepDirectory);
-    if (!isWithin5(root, target)) throw new Error("Sleep directory escapes the workspace");
+    if (!isWithin6(root, target)) throw new Error("Sleep directory escapes the workspace");
   }
   async #hasReport(date) {
     const prefix = `${date}-`;
-    return (await readdir8(this.#sleepDirectory, { withFileTypes: true })).some((entry2) => entry2.isFile() && entry2.name.startsWith(prefix) && entry2.name.endsWith(".md"));
+    return (await readdir7(this.#sleepDirectory, { withFileTypes: true })).some((entry2) => entry2.isFile() && entry2.name.startsWith(prefix) && entry2.name.endsWith(".md"));
   }
   async #atomicWrite(path, content) {
-    const temporary = join18(this.#sleepDirectory, `.${randomUUID10()}.tmp`);
+    const temporary = join20(this.#sleepDirectory, `.${randomUUID12()}.tmp`);
     let handle;
     try {
-      handle = await open9(temporary, constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY, 384);
+      handle = await open9(temporary, constants6.O_CREAT | constants6.O_EXCL | constants6.O_WRONLY, 384);
       await handle.writeFile(content, "utf8");
       await handle.sync();
       await handle.close();
@@ -14425,11 +15287,11 @@ async function assertNotSymlink(path) {
     if (!hasCode(error, "ENOENT")) throw error;
   }
 }
-function isWithin5(root, candidate) {
+function isWithin6(root, candidate) {
   const path = relative14(root, candidate);
   if (path === "") return true;
-  if (path === ".." || path.startsWith(`..${sep13}`) || isAbsolute8(path)) return false;
-  return process.platform !== "win32" || resolve17(root, path).toLowerCase().startsWith(`${resolve17(root).toLowerCase()}${sep13}`);
+  if (path === ".." || path.startsWith(`..${sep14}`) || isAbsolute8(path)) return false;
+  return process.platform !== "win32" || resolve19(root, path).toLowerCase().startsWith(`${resolve19(root).toLowerCase()}${sep14}`);
 }
 function hasCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
@@ -14477,11 +15339,11 @@ function computeSessionStats(documents) {
 }
 
 // src/tools/files.ts
-import { constants as constants6 } from "fs";
-import { mkdir as mkdir16, open as open10, readFile as readFile15, realpath as realpath9, rename as rename8, rm as rm8, stat as stat7 } from "fs/promises";
-import { dirname as dirname16, isAbsolute as isAbsolute9, relative as relative15, resolve as resolve18, sep as sep14 } from "path";
-import { randomUUID as randomUUID11 } from "crypto";
-import { z as z22 } from "zod";
+import { constants as constants7 } from "fs";
+import { mkdir as mkdir16, open as open10, readFile as readFile17, realpath as realpath9, rename as rename8, rm as rm8, stat as stat7 } from "fs/promises";
+import { dirname as dirname16, isAbsolute as isAbsolute9, relative as relative15, resolve as resolve20, sep as sep15 } from "path";
+import { randomUUID as randomUUID13 } from "crypto";
+import { z as z24 } from "zod";
 
 // src/tools/file-diff.ts
 var MAX_DIFF_PREVIEW_LINES = 120;
@@ -14587,18 +15449,18 @@ function truncateLines(lines) {
 
 // src/tools/files.ts
 var MAX_READ_BYTES = 1048576;
-var ReadInput2 = z22.object({
-  path: z22.string().min(1),
-  maxBytes: z22.coerce.number().int().positive().max(MAX_READ_BYTES).nullable().optional(),
-  startLine: z22.coerce.number().int().positive().nullable().optional(),
-  endLine: z22.coerce.number().int().positive().nullable().optional(),
+var ReadInput2 = z24.object({
+  path: z24.string().min(1),
+  maxBytes: z24.coerce.number().int().positive().max(MAX_READ_BYTES).nullable().optional(),
+  startLine: z24.coerce.number().int().positive().nullable().optional(),
+  endLine: z24.coerce.number().int().positive().nullable().optional(),
   // Accepts booleans and their string forms (weak-typed models emit "true");
   // kept transform-free so the schema converts to JSON Schema for providers.
-  force: z22.union([z22.boolean(), z22.string().refine((value) => value === "true" || value === "false")]).nullable().optional()
+  force: z24.union([z24.boolean(), z24.string().refine((value) => value === "true" || value === "false")]).nullable().optional()
 });
-var WriteInput = z22.object({ path: z22.string().min(1), content: z22.string() });
-var EditInput = z22.object({ path: z22.string().min(1), oldText: z22.string().min(1), newText: z22.string() });
-var ApplyPatchInput = z22.object({ patch: z22.string().min(1) });
+var WriteInput = z24.object({ path: z24.string().min(1), content: z24.string() });
+var EditInput = z24.object({ path: z24.string().min(1), oldText: z24.string().min(1), newText: z24.string() });
+var ApplyPatchInput = z24.object({ patch: z24.string().min(1) });
 var FileObservationStore = class {
   #versions = /* @__PURE__ */ new Map();
   get(path) {
@@ -14617,7 +15479,7 @@ var FileObservationStore = class {
 };
 function createReadTool(workspace, options = {}) {
   const guard = createPathGuard(workspace);
-  const openFile2 = options.openFile ?? ((path) => open10(path, constants6.O_RDONLY));
+  const openFile2 = options.openFile ?? ((path) => open10(path, constants7.O_RDONLY));
   const readHistory = /* @__PURE__ */ new Map();
   return {
     name: "Read",
@@ -14796,9 +15658,9 @@ function createApplyPatchTool(workspace, options = {}) {
   };
 }
 function createPathGuard(workspace) {
-  const root = resolve18(workspace);
+  const root = resolve20(workspace);
   const lexical = (input) => {
-    const candidate = resolve18(root, input);
+    const candidate = resolve20(root, input);
     if (!within2(root, candidate)) throw new Error("Path is outside the workspace");
     return candidate;
   };
@@ -14833,9 +15695,9 @@ function createPathGuard(workspace) {
 async function atomicWrite(path, content, signal, expectedVersion) {
   abortIfNeeded(signal);
   await mkdir16(dirname16(path), { recursive: true });
-  const temporary = `${path}.${randomUUID11()}.tmp`;
+  const temporary = `${path}.${randomUUID13()}.tmp`;
   try {
-    const handle = await open10(temporary, constants6.O_CREAT | constants6.O_EXCL | constants6.O_WRONLY, 384);
+    const handle = await open10(temporary, constants7.O_CREAT | constants7.O_EXCL | constants7.O_WRONLY, 384);
     try {
       await handle.writeFile(content, "utf8");
       await handle.sync();
@@ -14852,7 +15714,7 @@ async function atomicWrite(path, content, signal, expectedVersion) {
   }
 }
 async function readText(path) {
-  const contents = await readFile15(path);
+  const contents = await readFile17(path);
   if (isBinary(contents)) throw new Error("Cannot edit binary file as text");
   return contents.toString("utf8");
 }
@@ -14882,7 +15744,7 @@ function versionOfStat(info) {
 }
 async function readOptionalPresentationText(path) {
   try {
-    const contents = await readFile15(path);
+    const contents = await readFile17(path);
     return isBinary(contents) ? { exists: true } : { exists: true, text: contents.toString("utf8") };
   } catch (error) {
     return isMissing3(error) ? { exists: false } : { exists: true };
@@ -14968,7 +15830,7 @@ async function readBounded2(path, maxBytes, signal, openFile2) {
 }
 function within2(root, candidate) {
   const delta = relative15(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep14}`) && delta !== ".." && !isAbsolute9(delta);
+  return delta === "" || !delta.startsWith(`..${sep15}`) && delta !== ".." && !isAbsolute9(delta);
 }
 function forceFlag(value) {
   return value === true || value === "true";
@@ -15194,22 +16056,22 @@ import { lookup } from "dns/promises";
 import { isIP } from "net";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-import { z as z23 } from "zod";
-var WebFetchInput = z23.object({
-  url: z23.string().url().max(8192),
-  timeoutMs: z23.coerce.number().int().positive().max(12e4).optional(),
-  maxBytes: z23.coerce.number().int().positive().max(10 * 1024 * 1024).optional()
+import { z as z25 } from "zod";
+var WebFetchInput = z25.object({
+  url: z25.string().url().max(8192),
+  timeoutMs: z25.coerce.number().int().positive().max(12e4).optional(),
+  maxBytes: z25.coerce.number().int().positive().max(10 * 1024 * 1024).optional()
 });
-var WebSearchInput = z23.object({
-  query: z23.string().trim().min(1).max(1e3),
-  maxResults: z23.coerce.number().int().min(1).max(20).optional()
+var WebSearchInput = z25.object({
+  query: z25.string().trim().min(1).max(1e3),
+  maxResults: z25.coerce.number().int().min(1).max(20).optional()
 });
 function createWebFetchTool() {
   return {
     name: "WebFetch",
     description: "Fetch a public HTTP(S) page with SSRF protection and return readable text",
     inputSchema: WebFetchInput,
-    outputSchema: z23.object({ url: z23.string(), status: z23.number(), contentType: z23.string(), content: z23.string(), truncated: z23.boolean() }),
+    outputSchema: z25.object({ url: z25.string(), status: z25.number(), contentType: z25.string(), content: z25.string(), truncated: z25.boolean() }),
     paths: () => [],
     summarize: (input) => input.url,
     presentCall: (input) => ({ kind: "web", title: `Fetching ${new URL(input.url).hostname}`, url: input.url }),
@@ -15235,7 +16097,7 @@ function createWebSearchTool(provider = createDefaultWebSearchProvider()) {
     name: "WebSearch",
     description: "Search the public web and return titles, URLs, and snippets",
     inputSchema: WebSearchInput,
-    outputSchema: z23.object({ query: z23.string(), results: z23.array(z23.object({ title: z23.string(), url: z23.string(), snippet: z23.string() })) }),
+    outputSchema: z25.object({ query: z25.string(), results: z25.array(z25.object({ title: z25.string(), url: z25.string(), snippet: z25.string() })) }),
     paths: () => [],
     summarize: (input) => input.query,
     presentCall: (input) => ({ kind: "web", title: `Searching: ${input.query}` }),
@@ -15499,11 +16361,11 @@ function charset(contentType) {
 
 // src/tools/lsp.ts
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync2 } from "fs";
-import { access, constants as constants7, readFile as readFile16 } from "fs/promises";
-import { basename as basename4, dirname as dirname17, extname, isAbsolute as isAbsolute10, relative as relative16, resolve as resolve19, sep as sep15 } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { access, constants as constants8, readFile as readFile18 } from "fs/promises";
+import { basename as basename4, dirname as dirname17, extname, isAbsolute as isAbsolute10, relative as relative16, resolve as resolve21, sep as sep16 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL2 } from "url";
-import { z as z24 } from "zod";
+import { z as z26 } from "zod";
 var LSP_REQUEST_TIMEOUT_MS = 15e3;
 var LspConnection = class {
   #process;
@@ -15600,8 +16462,8 @@ var LspConnection = class {
     const id = this.#nextId++;
     const request = { jsonrpc: "2.0", id, method, params };
     const timeout = AbortSignal.timeout(LSP_REQUEST_TIMEOUT_MS);
-    const promise = new Promise((resolve26, reject) => {
-      this.#pending.set(id, { resolve: resolve26, reject });
+    const promise = new Promise((resolve28, reject) => {
+      this.#pending.set(id, { resolve: resolve28, reject });
       timeout.addEventListener("abort", () => {
         if (this.#pending.has(id)) {
           this.#pending.delete(id);
@@ -15666,7 +16528,7 @@ var LspConnection = class {
     const url = new URL(uri);
     if (url.protocol !== "file:") return;
     const filePath = fileURLToPath3(url);
-    const text = await readFile16(filePath, "utf8");
+    const text = await readFile18(filePath, "utf8");
     const current = this.#documents.get(uri);
     if (current === void 0) {
       this.#documents.set(uri, { text, version: 1 });
@@ -15717,7 +16579,7 @@ var LspBuffer = class {
     }
   }
 };
-var TYPESCRIPT_CLI = resolve19(
+var TYPESCRIPT_CLI = resolve21(
   dirname17(fileURLToPath3(import.meta.resolve("typescript/package.json"))),
   "lib",
   "tsc.js"
@@ -15759,7 +16621,7 @@ var RealLspManager = class {
   #serverConfigs;
   #onStatus;
   constructor(options) {
-    this.#workspace = resolve19(options.workspace);
+    this.#workspace = resolve21(options.workspace);
     this.#serverConfigs = options.serverConfigs ?? KNOWN_SERVERS;
     this.#onStatus = options.onStatus;
   }
@@ -15808,7 +16670,7 @@ var RealLspManager = class {
     if (pending !== void 0) return pending;
     const config = this.#serverConfigs.find((c) => c.language === language);
     if (config === void 0) return void 0;
-    const hasRoot = config.rootFiles.some((file) => existsSync2(resolve19(this.#workspace, file)));
+    const hasRoot = config.rootFiles.some((file) => existsSync3(resolve21(this.#workspace, file)));
     if (!hasRoot) return void 0;
     const startPromise = this.#startServer(config);
     this.#pendingStarts.set(language, startPromise);
@@ -15822,7 +16684,7 @@ var RealLspManager = class {
   }
   async #startServer(config) {
     try {
-      await access(config.command, constants7.X_OK);
+      await access(config.command, constants8.X_OK);
     } catch {
     }
     const connection = new LspConnection(config.command, config.args, this.#workspace);
@@ -15837,25 +16699,25 @@ var RealLspManager = class {
     return connection;
   }
 };
-var LspFindRefsInput = z24.object({
-  file: z24.string().min(1),
-  line: z24.coerce.number().int().nonnegative(),
-  character: z24.coerce.number().int().nonnegative()
+var LspFindRefsInput = z26.object({
+  file: z26.string().min(1),
+  line: z26.coerce.number().int().nonnegative(),
+  character: z26.coerce.number().int().nonnegative()
 });
-var LspHoverInput = z24.object({
-  file: z24.string().min(1),
-  line: z24.coerce.number().int().nonnegative(),
-  character: z24.coerce.number().int().nonnegative()
+var LspHoverInput = z26.object({
+  file: z26.string().min(1),
+  line: z26.coerce.number().int().nonnegative(),
+  character: z26.coerce.number().int().nonnegative()
 });
-var LspDiagnosticsInput = z24.object({
-  file: z24.string().min(1)
+var LspDiagnosticsInput = z26.object({
+  file: z26.string().min(1)
 });
 function createLspTools(workspace, options = {}) {
-  const root = resolve19(workspace);
+  const root = resolve21(workspace);
   const manager = options.manager ?? new RealLspManager({ workspace: root, onStatus: options.onStatus });
   const guard = (input) => {
-    const candidate = resolve19(root, input);
-    if (!isWithin6(root, candidate)) throw new Error("Path is outside the workspace");
+    const candidate = resolve21(root, input);
+    if (!isWithin7(root, candidate)) throw new Error("Path is outside the workspace");
     return candidate;
   };
   const toUri = (filePath) => pathToFileURL2(filePath).href;
@@ -15929,9 +16791,9 @@ function languageIdForPath(filePath) {
       return "typescript";
   }
 }
-function isWithin6(root, candidate) {
+function isWithin7(root, candidate) {
   const delta = relative16(root, candidate);
-  return delta === "" || !delta.startsWith(`..${sep15}`) && delta !== ".." && !isAbsolute10(delta);
+  return delta === "" || !delta.startsWith(`..${sep16}`) && delta !== ".." && !isAbsolute10(delta);
 }
 function uriToPath(uri) {
   try {
@@ -16074,7 +16936,7 @@ async function gitMarker(workspace) {
 }
 
 // src/git/insights.ts
-import { z as z25 } from "zod";
+import { z as z27 } from "zod";
 async function suggestCommitMessage(options, input, signal) {
   const prompt = [
     "Write a git commit message for the staged changes below.",
@@ -16113,17 +16975,17 @@ function cleanCommitMessage(raw) {
   }
   return kept.join("\n").trim().slice(0, 2e3);
 }
-var ReviewFindingSchema = z25.object({
-  severity: z25.enum(["critical", "warning", "nit"]),
-  file: z25.string(),
-  line: z25.string().describe('Line number or hunk header the finding refers to, e.g. "42" or "@@ -10,4 +10,6 @@"'),
-  issue: z25.string(),
-  suggestion: z25.string()
+var ReviewFindingSchema = z27.object({
+  severity: z27.enum(["critical", "warning", "nit"]),
+  file: z27.string(),
+  line: z27.string().describe('Line number or hunk header the finding refers to, e.g. "42" or "@@ -10,4 +10,6 @@"'),
+  issue: z27.string(),
+  suggestion: z27.string()
 }).strict();
-var ReviewReportSchema = z25.object({
-  summary: z25.string().describe("One-paragraph overall assessment of the change"),
-  verdict: z25.enum(["ship", "ship-with-fixes", "needs-work"]),
-  findings: z25.array(ReviewFindingSchema).max(20)
+var ReviewReportSchema = z27.object({
+  summary: z27.string().describe("One-paragraph overall assessment of the change"),
+  verdict: z27.enum(["ship", "ship-with-fixes", "needs-work"]),
+  findings: z27.array(ReviewFindingSchema).max(20)
 }).strict();
 async function reviewDiff(options, input, signal) {
   const prompt = [
@@ -16167,10 +17029,10 @@ function formatReviewReport(report) {
 }
 
 // src/git/tools.ts
-import { z as z26 } from "zod";
-var GitHistoryInput = z26.object({
-  path: z26.string().describe("File to inspect; omit for the whole repository history").optional(),
-  limit: z26.number().int().min(1).max(50).describe("Maximum number of commits to return (default 20)").optional()
+import { z as z28 } from "zod";
+var GitHistoryInput = z28.object({
+  path: z28.string().describe("File to inspect; omit for the whole repository history").optional(),
+  limit: z28.number().int().min(1).max(50).describe("Maximum number of commits to return (default 20)").optional()
 });
 function createGitHistoryTool(workspace) {
   return {
@@ -16199,18 +17061,18 @@ function createGitHistoryTool(workspace) {
 }
 
 // src/tools/ask-user-question.ts
-import { z as z27 } from "zod";
-var QuestionOptionSchema = z27.object({
-  label: z27.string().trim().min(1),
-  description: z27.string().trim().min(1)
+import { z as z29 } from "zod";
+var QuestionOptionSchema = z29.object({
+  label: z29.string().trim().min(1),
+  description: z29.string().trim().min(1)
 });
-var QuestionSchema = z27.object({
-  question: z27.string().trim().min(1),
-  header: z27.string().trim().min(1),
-  options: z27.array(QuestionOptionSchema).min(1).max(4)
+var QuestionSchema = z29.object({
+  question: z29.string().trim().min(1),
+  header: z29.string().trim().min(1),
+  options: z29.array(QuestionOptionSchema).min(1).max(4)
 });
-var AskUserQuestionInput = z27.object({
-  questions: z27.array(QuestionSchema).min(1).max(4)
+var AskUserQuestionInput = z29.object({
+  questions: z29.array(QuestionSchema).min(1).max(4)
 });
 function hookAnswersFromUpdatedInput(updatedInput, questions) {
   if (typeof updatedInput !== "object" || updatedInput === null) return void 0;
@@ -16239,7 +17101,7 @@ var QuestionBridge = class {
   ask(questions, signal) {
     if (this.#pending !== void 0) return Promise.reject(new Error("A question is already pending"));
     if (signal.aborted) return Promise.reject(signal.reason);
-    return new Promise((resolve26, reject) => {
+    return new Promise((resolve28, reject) => {
       const onAbort = () => {
         this.#pending = void 0;
         reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason)));
@@ -16251,7 +17113,7 @@ var QuestionBridge = class {
           signal.removeEventListener("abort", onAbort);
           this.#pending = void 0;
           this.#onChange?.();
-          resolve26(answers);
+          resolve28(answers);
         },
         reject: (error) => {
           signal.removeEventListener("abort", onAbort);
@@ -16294,20 +17156,20 @@ function createAskUserQuestionTool(handler) {
 }
 
 // src/tools/todo-write.ts
-import { z as z28 } from "zod";
-var TodoStatusSchema = z28.enum([
+import { z as z30 } from "zod";
+var TodoStatusSchema = z30.enum([
   "pending",
   "in_progress",
   "completed",
   "cancelled"
 ]);
-var TodoItemSchema = z28.object({
-  content: z28.string().trim().min(1),
+var TodoItemSchema = z30.object({
+  content: z30.string().trim().min(1),
   status: TodoStatusSchema,
-  activeForm: z28.string().trim().min(1)
+  activeForm: z30.string().trim().min(1)
 });
-var TodoWriteInput = z28.object({
-  todos: z28.array(TodoItemSchema).min(1).max(50)
+var TodoWriteInput = z30.object({
+  todos: z30.array(TodoItemSchema).min(1).max(50)
 });
 function createTodoWriteTool() {
   return {
@@ -16341,39 +17203,39 @@ function createTodoWriteTool() {
 }
 
 // src/tools/managed.ts
-import { randomUUID as randomUUID12 } from "crypto";
-import { link as link2, lstat as lstat11, mkdir as mkdir17, readFile as readFile17, readdir as readdir9, unlink as unlink4, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname18, join as join19, resolve as resolve20 } from "path";
-import { z as z29 } from "zod";
+import { randomUUID as randomUUID14 } from "crypto";
+import { link as link2, lstat as lstat11, mkdir as mkdir17, readFile as readFile19, readdir as readdir8, unlink as unlink4, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname18, join as join21, resolve as resolve22 } from "path";
+import { z as z31 } from "zod";
 var MANAGED_TOOL_VERSION = 1;
 var MAX_RECORD_BYTES = 256 * 1024;
 var TOOL_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-var JsonSchemaObject = z29.record(z29.string(), z29.unknown()).superRefine((schema, context) => {
+var JsonSchemaObject = z31.record(z31.string(), z31.unknown()).superRefine((schema, context) => {
   if (schema.type !== "object") {
     context.addIssue({ code: "custom", message: "Tool input JSON Schema must have type object" });
   }
 });
-var RegisterManagedToolInputSchema = z29.object({
-  name: z29.string().regex(TOOL_NAME).describe("Unique callable tool name using letters, digits, and underscores"),
-  description: z29.string().min(1).max(4096).describe("Purpose and appropriate use of the generated tool"),
+var RegisterManagedToolInputSchema = z31.object({
+  name: z31.string().regex(TOOL_NAME).describe("Unique callable tool name using letters, digits, and underscores"),
+  description: z31.string().min(1).max(4096).describe("Purpose and appropriate use of the generated tool"),
   inputSchema: JsonSchemaObject.describe("Provider-facing JSON Schema with an object at the root"),
-  implementation: z29.string().min(1).max(64 * 1024).describe(
+  implementation: z31.string().min(1).max(64 * 1024).describe(
     "Async JavaScript function body, or complete function/arrow expression, receiving input, signal, and context; return the tool result"
   ),
-  scope: z29.enum(["project", "global"]).default("project").describe(
+  scope: z31.enum(["project", "global"]).default("project").describe(
     "Project persists in the current workspace; global persists for every workspace"
   ),
-  agents: z29.array(z29.enum(["main", "subagent"])).min(1).max(2).optional().describe(
+  agents: z31.array(z31.enum(["main", "subagent"])).min(1).max(2).optional().describe(
     "Agent roles allowed to call the generated tool; omit to allow both"
   )
 }).strict();
-var RemoveManagedToolInputSchema = z29.object({
-  name: z29.string().regex(TOOL_NAME).describe("Managed tool name to remove"),
-  scope: z29.enum(["project", "global"]).optional().describe("Required only when the same name exists in both scopes")
+var RemoveManagedToolInputSchema = z31.object({
+  name: z31.string().regex(TOOL_NAME).describe("Managed tool name to remove"),
+  scope: z31.enum(["project", "global"]).optional().describe("Required only when the same name exists in both scopes")
 }).strict();
 var ManagedToolRecordSchema = RegisterManagedToolInputSchema.extend({
-  version: z29.literal(MANAGED_TOOL_VERSION),
-  createdAt: z29.string().datetime()
+  version: z31.literal(MANAGED_TOOL_VERSION),
+  createdAt: z31.string().datetime()
 }).strict();
 var AsyncFunction = Object.getPrototypeOf(async function() {
 }).constructor;
@@ -16385,9 +17247,9 @@ var ManagedToolStore = class {
   #entries = /* @__PURE__ */ new Map();
   #diagnostics = [];
   constructor(options) {
-    this.#workspace = resolve20(options.workspace);
-    this.#projectRoot = join19(this.#workspace, ".flavor", "tools");
-    this.#globalRoot = join19(resolve20(options.home), ".flavor-code", "tools");
+    this.#workspace = resolve22(options.workspace);
+    this.#projectRoot = join21(this.#workspace, ".flavor", "tools");
+    this.#globalRoot = join21(resolve22(options.home), ".flavor-code", "tools");
     this.#now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   }
   get diagnostics() {
@@ -16434,7 +17296,7 @@ var ManagedToolStore = class {
       version: MANAGED_TOOL_VERSION,
       createdAt: this.#now()
     });
-    const path = join19(this.directory(input.scope), filename(input.name));
+    const path = join21(this.directory(input.scope), filename(input.name));
     const definition = compileDefinition(record, input.scope, this.#workspace);
     await writeExclusive(path, `${JSON.stringify(record, void 0, 2)}
 `);
@@ -16459,25 +17321,25 @@ var ManagedToolStore = class {
     if (!parsed.success) return [];
     const matches = this.#matching(parsed.data.name).filter((entry2) => parsed.data.scope === void 0 || entry2.scope === parsed.data.scope);
     if (matches.length > 0) return matches.map((entry2) => entry2.path);
-    return [join19(this.directory(parsed.data.scope ?? "project"), filename(parsed.data.name))];
+    return [join21(this.directory(parsed.data.scope ?? "project"), filename(parsed.data.name))];
   }
   async #loadDirectory(scope2) {
     const root = this.directory(scope2);
     let names;
     try {
-      names = (await readdir9(root, { withFileTypes: true })).filter((entry2) => entry2.name.endsWith(".json")).sort((left, right) => compare2(left.name, right.name)).map((entry2) => entry2.name);
+      names = (await readdir8(root, { withFileTypes: true })).filter((entry2) => entry2.name.endsWith(".json")).sort((left, right) => compare2(left.name, right.name)).map((entry2) => entry2.name);
     } catch (error) {
       if (isMissing4(error)) return;
       this.#diagnostics.push(`${root}: ${message(error)}`);
       return;
     }
     for (const name of names) {
-      const path = join19(root, name);
+      const path = join21(root, name);
       try {
         const info = await lstat11(path);
         if (!info.isFile() || info.isSymbolicLink()) throw new Error("Managed tool record must be a regular file");
         if (info.size > MAX_RECORD_BYTES) throw new Error(`Managed tool record exceeds ${MAX_RECORD_BYTES} bytes`);
-        const record = ManagedToolRecordSchema.parse(JSON.parse(await readFile17(path, "utf8")));
+        const record = ManagedToolRecordSchema.parse(JSON.parse(await readFile19(path, "utf8")));
         if (record.scope !== scope2) throw new Error(`Managed tool record scope must match its ${scope2} directory`);
         const key = scopedKey(scope2, record.name);
         if (this.#entries.has(key)) throw new Error(`Duplicate managed tool name in ${scope2} scope: ${record.name}`);
@@ -16560,7 +17422,7 @@ function createManagedToolManagementTools(options) {
   const listTools = {
     name: "ListRegisteredTools",
     description: "List durable tools created through RegisterTool, including scope, path, and active precedence",
-    inputSchema: z29.object({}).strict(),
+    inputSchema: z31.object({}).strict(),
     agents: mainOnly,
     paths: () => [],
     execute: async (_input, signal) => {
@@ -16573,7 +17435,7 @@ function createManagedToolManagementTools(options) {
 function compileDefinition(record, scope2, workspace) {
   let inputSchema;
   try {
-    inputSchema = z29.fromJSONSchema(record.inputSchema);
+    inputSchema = z31.fromJSONSchema(record.inputSchema);
   } catch (error) {
     throw new Error(`Invalid input schema for managed tool "${record.name}": ${message(error)}`);
   }
@@ -16628,7 +17490,7 @@ ${sourceUrl}`
 }
 async function writeExclusive(path, content) {
   await mkdir17(dirname18(path), { recursive: true });
-  const temporary = `${path}.${randomUUID12()}.tmp`;
+  const temporary = `${path}.${randomUUID14()}.tmp`;
   try {
     await writeFile10(temporary, content, { encoding: "utf8", flag: "wx", mode: 384 });
     await link2(temporary, path);
@@ -16673,7 +17535,7 @@ function isMissing4(error) {
 }
 
 // src/hallucination/confidence.ts
-import { z as z30 } from "zod";
+import { z as z32 } from "zod";
 
 // src/hallucination/types.ts
 var DEFAULT_SLIDING_WINDOW_SIZE = 20;
@@ -16686,12 +17548,12 @@ var DEFAULT_EVALUATION_TIMEOUT_MS = 2e3;
 var MAX_QUERY_CHARS = 5e3;
 var MAX_OUTPUT_CHARS = 1e4;
 var MAX_EVIDENCE_CHARS = 6e3;
-var ConfidenceSchema = z30.object({
-  taskAlignment: z30.number(),
-  evidenceGrounding: z30.number(),
-  processReliability: z30.number(),
-  reason: z30.string(),
-  unsupportedClaims: z30.array(z30.string()).max(3)
+var ConfidenceSchema = z32.object({
+  taskAlignment: z32.number(),
+  evidenceGrounding: z32.number(),
+  processReliability: z32.number(),
+  reason: z32.string(),
+  unsupportedClaims: z32.array(z32.string()).max(3)
 });
 var PROMPT = `You are a fast, evidence-aware task-completion verifier.
 
@@ -17018,7 +17880,7 @@ function buildWarningMessages(report, languageTag) {
 }
 
 // src/hallucination/sliding-window.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 var SlidingWindow = class {
   #windowSize;
   #threshold;
@@ -17034,7 +17896,7 @@ var SlidingWindow = class {
   }
   hash(toolName, params) {
     const sorted = JSON.stringify(params, sortedKeys(params));
-    return createHash10("sha256").update(`${toolName}:${sorted}`).digest("hex");
+    return createHash14("sha256").update(`${toolName}:${sorted}`).digest("hex");
   }
   push(toolName, params) {
     const hash = this.hash(toolName, params);
@@ -17389,9 +18251,9 @@ ${total}`;
 }
 
 // src/memory/store.ts
-import { createHash as createHash11 } from "crypto";
-import { readFile as readFile18, rm as rm9 } from "fs/promises";
-import { resolve as resolve21, join as join20, relative as relative17, sep as sep16 } from "path";
+import { createHash as createHash15 } from "crypto";
+import { readFile as readFile20, rm as rm9 } from "fs/promises";
+import { resolve as resolve23, join as join22, relative as relative17, sep as sep17 } from "path";
 
 // src/memory/similarity.ts
 function normalizeForSimilarity(value) {
@@ -17493,10 +18355,10 @@ var MemoryStore = class {
   constructor(options) {
     if (!Number.isSafeInteger(options.maxEntries) || options.maxEntries < 1) throw new Error("maxEntries must be an integer of at least 1");
     if (!Number.isSafeInteger(options.maxEntryChars) || options.maxEntryChars < 1) throw new Error("maxEntryChars must be an integer of at least 1");
-    this.workspace = resolve21(options.workspace);
-    this.#memoryRoot = join20(this.workspace, ".flavor", "memory");
-    this.path = join20(this.#memoryRoot, "MEMORY.md");
-    this.#behaviorPath = join20(this.#memoryRoot, "behavior.json");
+    this.workspace = resolve23(options.workspace);
+    this.#memoryRoot = join22(this.workspace, ".flavor", "memory");
+    this.path = join22(this.#memoryRoot, "MEMORY.md");
+    this.#behaviorPath = join22(this.#memoryRoot, "behavior.json");
     this.#maxEntries = options.maxEntries;
     this.#maxEntryChars = options.maxEntryChars;
   }
@@ -17714,14 +18576,14 @@ var MemoryStore = class {
     });
   }
   async #readTaskItem(reference) {
-    const document = decodeTask(await readFile18(this.#resolveContentPath(reference.contentPath), "utf8"));
+    const document = decodeTask(await readFile20(this.#resolveContentPath(reference.contentPath), "utf8"));
     return document.items.find((item) => item.id === reference.id)?.content ?? reference.summary;
   }
   #resolveContentPath(contentPath) {
     if (!/^tasks\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.md$/.test(contentPath)) throw new Error("Invalid memory content path");
-    const path = resolve21(this.#memoryRoot, ...contentPath.split("/"));
+    const path = resolve23(this.#memoryRoot, ...contentPath.split("/"));
     const rel = relative17(this.#memoryRoot, path);
-    if (rel === ".." || rel.startsWith(`..${sep16}`)) throw new Error("Memory content path escapes the memory directory");
+    if (rel === ".." || rel.startsWith(`..${sep17}`)) throw new Error("Memory content path escapes the memory directory");
     return path;
   }
   async #updateIndex(update) {
@@ -17875,7 +18737,7 @@ function sanitizeTopicKey(value) {
   return value.normalize("NFKC").toLocaleLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
 }
 function memoryId(type, content) {
-  return createHash11("sha256").update(`${type}\0${normalizeMemoryContent(content).toLocaleLowerCase()}`, "utf8").digest("hex").slice(0, 12);
+  return createHash15("sha256").update(`${type}\0${normalizeMemoryContent(content).toLocaleLowerCase()}`, "utf8").digest("hex").slice(0, 12);
 }
 function assertTaskId(taskId) {
   if (!TASK_ID.test(taskId)) throw new Error(`Invalid memory task id: ${taskId}`);
@@ -18190,8 +19052,8 @@ function createExecutionEnvironment(workspace, config) {
 }
 
 // src/ide/client.ts
-import { readFile as readFile19, readdir as readdir10, stat as stat8 } from "fs/promises";
-import { basename as basename5, join as join21, relative as relative18, resolve as resolve22, sep as sep17 } from "path";
+import { readFile as readFile21, readdir as readdir9, stat as stat8 } from "fs/promises";
+import { basename as basename5, join as join23, relative as relative18, resolve as resolve24, sep as sep18 } from "path";
 var FlavorIdeClient = class {
   #workspace;
   #home;
@@ -18202,8 +19064,8 @@ var FlavorIdeClient = class {
   #sessionId;
   #eventTail = Promise.resolve();
   constructor(options) {
-    this.#workspace = resolve22(options.workspace);
-    this.#home = resolve22(options.home);
+    this.#workspace = resolve24(options.workspace);
+    this.#home = resolve24(options.home);
     this.#environment = options.environment ?? process.env;
     this.#fetch = options.fetch ?? fetch;
   }
@@ -18230,7 +19092,7 @@ var FlavorIdeClient = class {
   }
   async promptContext() {
     const context = await this.editorContext();
-    if (context?.filePath === void 0 || !isWithin7(this.#workspace, context.filePath)) return void 0;
+    if (context?.filePath === void 0 || !isWithin8(this.#workspace, context.filePath)) return void 0;
     const path = relativeDisplay(this.#workspace, context.filePath);
     const cursor = context.selection.active;
     if (context.selection.isEmpty || !context.selectedText) {
@@ -18287,23 +19149,23 @@ var FlavorIdeClient = class {
       };
       if (await this.#healthy(configured)) return configured;
     }
-    const directory = join21(this.#home, ".flavor-code", "ide");
+    const directory = join23(this.#home, ".flavor-code", "ide");
     let entries;
     try {
-      entries = (await readdir10(directory)).filter((name) => name.endsWith(".lock"));
+      entries = (await readdir9(directory)).filter((name) => name.endsWith(".lock"));
     } catch {
       return void 0;
     }
     const candidates = (await Promise.all(entries.map(async (name) => {
-      const path = join21(directory, name);
+      const path = join23(directory, name);
       try {
-        const [contents, info] = await Promise.all([readFile19(path, "utf8"), stat8(path)]);
+        const [contents, info] = await Promise.all([readFile21(path, "utf8"), stat8(path)]);
         const lock = parseLockfile(contents);
         return lock === void 0 ? void 0 : { lock, modified: info.mtimeMs };
       } catch {
         return void 0;
       }
-    }))).filter((item) => item !== void 0).filter(({ lock }) => lock.workspaceFolders.some((folder) => isWithin7(folder, this.#workspace))).sort((left, right) => right.modified - left.modified);
+    }))).filter((item) => item !== void 0).filter(({ lock }) => lock.workspaceFolders.some((folder) => isWithin8(folder, this.#workspace))).sort((left, right) => right.modified - left.modified);
     for (const { lock } of candidates) {
       if (await this.#healthy(lock)) return lock;
     }
@@ -18400,10 +19262,10 @@ function parsePort(value) {
   const port = Number(value);
   return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
 }
-function isWithin7(parent, child) {
-  const base = normalize(resolve22(parent));
-  const target = normalize(resolve22(child));
-  return target === base || target.startsWith(`${base}${sep17}`);
+function isWithin8(parent, child) {
+  const base = normalize(resolve24(parent));
+  const target = normalize(resolve24(child));
+  return target === base || target.startsWith(`${base}${sep18}`);
 }
 function normalize(path) {
   const normalized = path.normalize("NFC");
@@ -18415,7 +19277,7 @@ function relativeDisplay(workspace, filePath) {
 }
 
 // src/jobs/registry.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var JobRegistry = class {
   #jobs = /* @__PURE__ */ new Map();
   #maxOutputChars;
@@ -18429,11 +19291,11 @@ var JobRegistry = class {
   }
   create(input) {
     this.#pruneCompleted();
-    const id = `job-${randomUUID13().slice(0, 12)}`;
+    const id = `job-${randomUUID15().slice(0, 12)}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let settle;
-    const done = new Promise((resolve26) => {
-      settle = resolve26;
+    const done = new Promise((resolve28) => {
+      settle = resolve28;
     });
     const record = {
       id,
@@ -18555,9 +19417,9 @@ function snapshot2(job) {
 }
 
 // src/terminal/service.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { createRequire as nodeCreateRequire } from "module";
-import { isAbsolute as isAbsolute11, relative as relative19, resolve as resolve23, sep as sep18 } from "path";
+import { isAbsolute as isAbsolute11, relative as relative19, resolve as resolve25, sep as sep19 } from "path";
 var TerminalService = class {
   #root;
   #factory;
@@ -18565,7 +19427,7 @@ var TerminalService = class {
   #maxOutputChars;
   #sessions = /* @__PURE__ */ new Map();
   constructor(workspace, options = {}) {
-    this.#root = resolve23(workspace);
+    this.#root = resolve25(workspace);
     this.#factory = options.factory ?? defaultFactory;
     this.#jobs = options.jobs;
     this.#maxOutputChars = options.maxOutputChars ?? 2e5;
@@ -18573,7 +19435,7 @@ var TerminalService = class {
   open(input) {
     const cwd = workspacePath(this.#root, input.cwd ?? ".");
     const shell = input.shell ?? defaultShell();
-    const id = `term-${randomUUID14().slice(0, 12)}`;
+    const id = `term-${randomUUID16().slice(0, 12)}`;
     const pty = this.#factory(shell, input.args ?? [], {
       cwd,
       cols: input.columns ?? 100,
@@ -18683,30 +19545,30 @@ function cleanEnvironment(environment) {
   return Object.fromEntries(Object.entries(environment).filter((entry2) => entry2[1] !== void 0));
 }
 function workspacePath(root, input) {
-  const path = resolve23(root, input);
+  const path = resolve25(root, input);
   const delta = relative19(root, path);
-  if (delta === ".." || delta.startsWith(`..${sep18}`) || isAbsolute11(delta)) throw new Error("Terminal cwd is outside the workspace");
+  if (delta === ".." || delta.startsWith(`..${sep19}`) || isAbsolute11(delta)) throw new Error("Terminal cwd is outside the workspace");
   return path;
 }
 
 // src/tools/terminal.ts
-import { z as z31 } from "zod";
-import { resolve as resolve24 } from "path";
-var Id = z31.string().regex(/^term-[a-f0-9-]+$/);
-var OpenInput = z31.object({ cwd: z31.string().optional(), shell: z31.string().optional(), args: z31.array(z31.string()).optional(), columns: z31.coerce.number().int().min(10).max(500).optional(), rows: z31.coerce.number().int().min(2).max(300).optional() });
-var OptionalBoolean = z31.union([z31.boolean(), z31.string().refine((value) => value === "true" || value === "false")]);
-var WriteInput2 = z31.object({ id: Id, data: z31.string().max(1e5), enter: OptionalBoolean.optional() });
-var ReadInput3 = z31.object({ id: Id, cursor: z31.coerce.number().int().min(0).optional() });
-var ResizeInput = z31.object({ id: Id, columns: z31.coerce.number().int().min(10).max(500), rows: z31.coerce.number().int().min(2).max(300) });
-var CloseInput = z31.object({ id: Id });
+import { z as z33 } from "zod";
+import { resolve as resolve26 } from "path";
+var Id = z33.string().regex(/^term-[a-f0-9-]+$/);
+var OpenInput = z33.object({ cwd: z33.string().optional(), shell: z33.string().optional(), args: z33.array(z33.string()).optional(), columns: z33.coerce.number().int().min(10).max(500).optional(), rows: z33.coerce.number().int().min(2).max(300).optional() });
+var OptionalBoolean = z33.union([z33.boolean(), z33.string().refine((value) => value === "true" || value === "false")]);
+var WriteInput2 = z33.object({ id: Id, data: z33.string().max(1e5), enter: OptionalBoolean.optional() });
+var ReadInput3 = z33.object({ id: Id, cursor: z33.coerce.number().int().min(0).optional() });
+var ResizeInput = z33.object({ id: Id, columns: z33.coerce.number().int().min(10).max(500), rows: z33.coerce.number().int().min(2).max(300) });
+var CloseInput = z33.object({ id: Id });
 function createTerminalTools(terminals, workspace = process.cwd()) {
   const tools = [
     {
       name: "TerminalOpen",
       description: "Open a persistent interactive pseudo-terminal in the workspace",
       inputSchema: OpenInput,
-      paths: (input) => [resolve24(workspace, input.cwd ?? ".")],
-      permissions: (input) => ({ paths: [resolve24(workspace, input.cwd ?? ".")], command: input.shell ?? "system-shell", args: input.args ?? [], cwd: resolve24(workspace, input.cwd ?? ".") }),
+      paths: (input) => [resolve26(workspace, input.cwd ?? ".")],
+      permissions: (input) => ({ paths: [resolve26(workspace, input.cwd ?? ".")], command: input.shell ?? "system-shell", args: input.args ?? [], cwd: resolve26(workspace, input.cwd ?? ".") }),
       execute: async (input, _signal, context) => terminals.open({
         owner: owner(context),
         ...input.cwd === void 0 ? {} : { cwd: input.cwd },
@@ -18774,7 +19636,7 @@ function createTerminalTools(terminals, workspace = process.cwd()) {
     {
       name: "TerminalList",
       description: "List persistent terminals owned by this agent",
-      inputSchema: z31.object({}),
+      inputSchema: z33.object({}),
       paths: () => [],
       execute: async (_input, _signal, context) => terminals.list(owner(context))
     }
@@ -18783,10 +19645,10 @@ function createTerminalTools(terminals, workspace = process.cwd()) {
 }
 
 // src/pals/address.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 function opaqueUserScope(userScope) {
   if (userScope.length === 0) throw new Error("User scope must not be empty");
-  const digest = createHash12("sha256").update(userScope, "utf8").digest("hex").slice(0, 16);
+  const digest = createHash16("sha256").update(userScope, "utf8").digest("hex").slice(0, 16);
   return `u-${digest}`;
 }
 function palSocketAddress(options) {
@@ -18799,7 +19661,7 @@ function palSocketAddress(options) {
 }
 
 // src/pals/client.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { Socket as Socket3 } from "net";
 var DEFAULT_REQUEST_TIMEOUT_MS = 5e3;
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 1e4;
@@ -18875,7 +19737,7 @@ var PalClient = class {
     return this.starting;
   }
   async list() {
-    const data2 = await this.request({ version: 1, type: "list", requestId: randomUUID15() });
+    const data2 = await this.request({ version: 1, type: "list", requestId: randomUUID17() });
     return PalPresenceListSchema.parse(data2);
   }
   async rename(alias) {
@@ -18888,38 +19750,38 @@ var PalClient = class {
       throw error;
     }
   }
-  async sendTask(target, message2, messageId = randomUUID15()) {
-    const data2 = await this.request({ version: 1, type: "task", requestId: randomUUID15(), messageId, target, goal: message2 });
+  async sendTask(target, message2, messageId = randomUUID17()) {
+    const data2 = await this.request({ version: 1, type: "task", requestId: randomUUID17(), messageId, target, goal: message2 });
     return DeliveryReceiptSchema.parse(data2);
   }
-  async sendChat(target, message2, messageId = randomUUID15()) {
-    const data2 = await this.request({ version: 1, type: "chat", requestId: randomUUID15(), messageId, target, message: message2 });
+  async sendChat(target, message2, messageId = randomUUID17()) {
+    const data2 = await this.request({ version: 1, type: "chat", requestId: randomUUID17(), messageId, target, message: message2 });
     return DeliveryReceiptSchema.parse(data2);
   }
   async startCoWork(input) {
     const data2 = await this.request({
       version: 1,
       type: "cowork-propose",
-      requestId: randomUUID15(),
-      coWorkId: input.coWorkId ?? randomUUID15(),
+      requestId: randomUUID17(),
+      coWorkId: input.coWorkId ?? randomUUID17(),
       goal: input.goal,
       participants: input.participants
     });
     return CoWorkSnapshotSchema.parse(data2);
   }
   async coWorkAction(action) {
-    const request = { version: 1, requestId: randomUUID15(), ...action };
+    const request = { version: 1, requestId: randomUUID17(), ...action };
     return CoWorkSnapshotSchema.parse(await this.request(request));
   }
   async coWorkStatus(coWorkId) {
-    const data2 = await this.request({ version: 1, type: "cowork-get", requestId: randomUUID15(), coWorkId });
+    const data2 = await this.request({ version: 1, type: "cowork-get", requestId: randomUUID17(), coWorkId });
     return CoWorkSnapshotSchema.parse(data2);
   }
   async integrateCoWork(input) {
     return this.coWorkAction({ type: "cowork-integration", ...input });
   }
   async cancelCoWork(coWorkId, reason) {
-    const data2 = await this.request({ version: 1, type: "cowork-cancel", requestId: randomUUID15(), coWorkId, reason });
+    const data2 = await this.request({ version: 1, type: "cowork-cancel", requestId: randomUUID17(), coWorkId, reason });
     return CoWorkSnapshotSchema.parse(data2);
   }
   subscribe(listener) {
@@ -18931,9 +19793,9 @@ var PalClient = class {
     if (this.registered && this.socket !== void 0) {
       let disconnectTimer;
       await Promise.race([
-        this.request({ version: 1, type: "disconnect", requestId: randomUUID15() }).catch(() => void 0),
-        new Promise((resolve26) => {
-          disconnectTimer = setTimeout(resolve26, Math.min(this.requestTimeoutMs, 250));
+        this.request({ version: 1, type: "disconnect", requestId: randomUUID17() }).catch(() => void 0),
+        new Promise((resolve28) => {
+          disconnectTimer = setTimeout(resolve28, Math.min(this.requestTimeoutMs, 250));
         })
       ]);
       if (disconnectTimer !== void 0) clearTimeout(disconnectTimer);
@@ -18979,7 +19841,7 @@ var PalClient = class {
     return presence;
   }
   openSocket() {
-    return new Promise((resolve26, reject) => {
+    return new Promise((resolve28, reject) => {
       let settled = false;
       const rejectConnection = (error) => {
         if (settled) return;
@@ -19002,7 +19864,7 @@ var PalClient = class {
         settled = true;
         if (this.connectingReject === rejectConnection) this.connectingReject = void 0;
         socket.off("error", onInitialError);
-        resolve26();
+        resolve28();
       };
       const onInitialError = (error) => {
         socket.off("connect", onConnect);
@@ -19022,7 +19884,7 @@ var PalClient = class {
     const data2 = await this.request({
       version: 1,
       type: "register",
-      requestId: randomUUID15(),
+      requestId: randomUUID17(),
       authToken: this.authToken,
       presence: { version: 1, ...this.registration, connectedAt: now, lastSeenAt: now }
     });
@@ -19033,12 +19895,12 @@ var PalClient = class {
     if (this.closed || socket === void 0 || socket.destroyed || !socket.writable) {
       return Promise.reject(new Error(this.closed ? "Pal client is closed" : "Pal client is not connected"));
     }
-    return new Promise((resolve26, reject) => {
+    return new Promise((resolve28, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(request.requestId);
         reject(new Error(`Pal request '${request.type}' timed out`));
       }, this.requestTimeoutMs);
-      this.pending.set(request.requestId, { resolve: resolve26, reject, timer });
+      this.pending.set(request.requestId, { resolve: resolve28, reject, timer });
       let frame;
       try {
         frame = encodeControlFrame(BrokerRequestSchema.parse(request));
@@ -19134,7 +19996,7 @@ var PalClient = class {
       if (!this.registered) return;
       if (this.heartbeatPending) return;
       this.heartbeatPending = true;
-      void this.request({ version: 1, type: "heartbeat", requestId: randomUUID15() }).catch(() => void 0).finally(() => {
+      void this.request({ version: 1, type: "heartbeat", requestId: randomUUID17() }).catch(() => void 0).finally(() => {
         this.heartbeatPending = false;
       });
     }, this.heartbeatIntervalMs);
@@ -19153,7 +20015,7 @@ var PalClient = class {
 };
 
 // src/pals/tools.ts
-import { z as z32 } from "zod";
+import { z as z34 } from "zod";
 var DEFAULT_SHARE_BUDGET_BYTES = 128 * 1024;
 var CollaborationShareGuard = class {
   redact;
@@ -19174,25 +20036,25 @@ var CollaborationShareGuard = class {
     return redacted;
   }
 };
-var Uuid = z32.uuid();
-var Hash = z32.string().regex(/^[a-f0-9]{64}$/);
+var Uuid = z34.uuid();
+var Hash = z34.string().regex(/^[a-f0-9]{64}$/);
 var Target = PalTargetSchema;
-var BoundedText = z32.string().trim().min(1).refine(
+var BoundedText = z34.string().trim().min(1).refine(
   (value) => Buffer.byteLength(value, "utf8") <= MAX_MESSAGE_BYTES,
   `Text must not exceed ${MAX_MESSAGE_BYTES} UTF-8 bytes`
 );
-var CompletionEvidence = z32.string().trim().min(1).refine(
+var CompletionEvidence = z34.string().trim().min(1).refine(
   (value) => Buffer.byteLength(value, "utf8") <= MAX_COMPLETION_DETAIL_BYTES,
   `Completion evidence must not exceed ${MAX_COMPLETION_DETAIL_BYTES} UTF-8 bytes`
 );
-var EmptyInput = z32.object({}).strict();
-var StateInput = z32.object({ coWorkId: Uuid }).strict();
-var TokenInput = z32.object({ coWorkId: Uuid, epoch: z32.number().int().positive(), planHash: Hash }).strict();
-var SendInput = z32.object({ target: Target, message: BoundedText, coWorkId: Uuid.optional() }).strict();
-var PlanInput = z32.object({ plan: CoWorkPlanSchema }).strict();
-var ProgressInput = z32.object({ coWorkId: Uuid, target: Target, detail: BoundedText }).strict();
-var CompleteInput = TokenInput.extend({ passed: z32.boolean(), detail: CompletionEvidence }).strict();
-var IntegrateInput = TokenInput.extend({ passed: z32.boolean(), evidence: CompletionEvidence }).strict();
+var EmptyInput = z34.object({}).strict();
+var StateInput = z34.object({ coWorkId: Uuid }).strict();
+var TokenInput = z34.object({ coWorkId: Uuid, epoch: z34.number().int().positive(), planHash: Hash }).strict();
+var SendInput = z34.object({ target: Target, message: BoundedText, coWorkId: Uuid.optional() }).strict();
+var PlanInput = z34.object({ plan: CoWorkPlanSchema }).strict();
+var ProgressInput = z34.object({ coWorkId: Uuid, target: Target, detail: BoundedText }).strict();
+var CompleteInput = TokenInput.extend({ passed: z34.boolean(), detail: CompletionEvidence }).strict();
+var IntegrateInput = TokenInput.extend({ passed: z34.boolean(), evidence: CompletionEvidence }).strict();
 var sharedBytes = (...values) => values.reduce((total, value) => total + Buffer.byteLength(value, "utf8"), 0);
 function resolvePresence(presences, target) {
   const normalized = normalizePalIdentity(target);
@@ -19376,7 +20238,7 @@ var ApprovalBridge = class {
   request(request, signal = new AbortController().signal) {
     if (this.#settle !== void 0) return Promise.resolve("deny");
     if (signal.aborted) return Promise.resolve("deny");
-    this.#pending = { id: randomUUID16(), ...request };
+    this.#pending = { id: randomUUID18(), ...request };
     this.#onChange?.();
     return new Promise((resolvePromise) => {
       this.#settle = resolvePromise;
@@ -19397,8 +20259,8 @@ var ApprovalBridge = class {
   }
 };
 async function createProductionRuntime(options) {
-  const workspace = resolve25(options.workspace ?? process.cwd());
-  const home = resolve25(options.home ?? homedir2());
+  const workspace = resolve27(options.workspace ?? process.cwd());
+  const home = resolve27(options.home ?? homedir2());
   const environment = options.environment ?? process.env;
   const ide = new FlavorIdeClient({ workspace, home, environment });
   const ideReady = ide.initialize();
@@ -19507,6 +20369,12 @@ async function createProductionRuntime(options) {
   );
   const registry = new ModelRegistry();
   const diagnostics = [];
+  const permissionPolicy = await loadPermissionPolicy({
+    workspace,
+    home,
+    ...environment.FLAVOR_MANAGED_PERMISSIONS === void 0 ? {} : { managedPath: environment.FLAVOR_MANAGED_PERMISSIONS }
+  });
+  diagnostics.push(...permissionPolicy.diagnostics);
   const approvals = new ApprovalBridge(options.onApprovalChange);
   const resolveToolApproval = options.approvalPolicy === "deny" && options.rpcToolApprovals !== true ? () => "deny" : (request, signal) => approvals.request(request, signal);
   const questions = new QuestionBridge(options.onApprovalChange);
@@ -19601,9 +20469,10 @@ async function createProductionRuntime(options) {
   const registeredProviders = registration.registered;
   let effectiveLlm = registration.effectiveLlm;
   const pluginHost = new PluginHost({
-    globalPluginDirs: [join22(home, ".flavor-code", "plugins")],
-    projectPluginDirs: [join22(workspace, ".flavor", "plugins")],
+    globalPluginDirs: [join24(home, ".flavor-code", "plugins")],
+    projectPluginDirs: [join24(workspace, ".flavor", "plugins")],
     config,
+    sandbox: options.pluginSandbox ?? true,
     registrations: {
       command(name, handler, description) {
         if (typeof handler !== "function") throw new Error(`Plugin command "${name}" must be a function.`);
@@ -19704,7 +20573,7 @@ async function createProductionRuntime(options) {
       const address = palSocketAddress({
         platform: process.platform,
         userScope: home,
-        runtimeDir: join22(tmpdir3(), `flavor-code-pals-${createHash13("sha256").update(home).digest("hex").slice(0, 16)}`)
+        runtimeDir: join24(tmpdir3(), `flavor-code-pals-${createHash17("sha256").update(home).digest("hex").slice(0, 16)}`)
       });
       collaborationClient = collaboration.client ?? collaboration.createClient?.({
         instanceId: collaboration.instanceId,
@@ -19802,8 +20671,8 @@ async function createProductionRuntime(options) {
       diagnostics.push(`MCP servers could not start: ${message(error)}`);
     });
     const skills = new SkillRegistry({
-      globalRoots: [join22(home, ".flavor-code", "skills")],
-      projectRoots: [join22(workspace, ".flavor", "skills"), ...pluginSkillRoots],
+      globalRoots: [join24(home, ".flavor-code", "skills")],
+      projectRoots: [join24(workspace, ".flavor", "skills"), ...pluginSkillRoots],
       authorizeResource: async () => true,
       disabledNames: config.skills.disabled
     });
@@ -19811,7 +20680,7 @@ async function createProductionRuntime(options) {
     skillsReady.catch(() => void 0);
     tools.push(createSkillTool(skills), createSkillResourceTool(skills));
     if (options.extraTools !== void 0) tools.push(...options.extraTools);
-    const flavor = await optionalText2(join22(workspace, "FLAVOR.md"));
+    const flavor = await optionalText2(join24(workspace, "FLAVOR.md"));
     const instructionBaseline = await workspaceInstructions.baseline();
     let memoryContext;
     if (memoryStore !== void 0) {
@@ -19835,7 +20704,18 @@ async function createProductionRuntime(options) {
     let taskResults = { ...recovered?.tasks.results ?? {} };
     const subagentStartedAt = {};
     const subagentElapsedMs = {};
-    let sessionId = recovered?.sessionId ?? `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID16().slice(0, 8)}`;
+    let sessionId = recovered?.sessionId ?? `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID18().slice(0, 8)}`;
+    let harnessJournal = new HarnessJournal({ workspace, sessionId });
+    const harnessRecovery = harnessJournal.recover();
+    if (harnessRecovery.queue.length > 0 || harnessRecovery.incompleteTools.length > 0 || harnessRecovery.incompleteModelIds.length > 0 || harnessRecovery.interruptedTurnIds.length > 0) {
+      diagnostics.push(
+        `Recovered durable harness state: ${harnessRecovery.queue.length} queued prompt(s), ${harnessRecovery.incompleteTools.length} interrupted tool call(s), ${harnessRecovery.incompleteModelIds.length} interrupted model call(s), ${harnessRecovery.interruptedTurnIds.length} interrupted turn(s).`
+      );
+      for (const tool of harnessRecovery.incompleteTools.filter((item) => !item.retrySafe)) {
+        diagnostics.push(`Interrupted non-retry-safe tool "${tool.tool}" was not replayed (${tool.inputHash.slice(0, 12)}).`);
+      }
+      harnessJournal.markRecoveryComplete(harnessRecovery);
+    }
     setUsageSession(sessionId);
     ideSessionId = sessionId;
     await ideReady;
@@ -20008,8 +20888,8 @@ async function createProductionRuntime(options) {
         volatileSystem: () => [
           buildCurrentDateSection(promptEnvironment.date),
           buildRuntimeEnvironmentSection({
-            model: agent === "main" ? harness.mainModelId : contextModelId,
-            permissionMode: agent === "subagent" ? harness.permissionMode === "plan" ? "plan" : "bubble" : harness.permissionMode
+            model: agent === "main" && harnessCreated ? harness.mainModelId : contextModelId,
+            permissionMode: agent === "subagent" ? (harnessCreated ? harness.permissionMode : recovered?.permissionMode ?? config.permissionMode) === "plan" ? "plan" : "bubble" : harnessCreated ? harness.permissionMode : recovered?.permissionMode ?? config.permissionMode
           })
         ],
         ...flavor === void 0 ? {} : { flavor },
@@ -20048,15 +20928,36 @@ async function createProductionRuntime(options) {
       tools,
       createContext,
       permissionMode: recovered?.permissionMode ?? config.permissionMode,
+      permissionPolicy,
       maxIterationsMain: config.maxIterations.main,
       maxIterationsSubagent: config.maxIterations.subagent,
       hasActiveProgress,
       afterToolSuccess: async (_tool, paths, _input, _output, context) => workspaceInstructions.discover(paths, context.ownerId ?? context.agent),
+      toolJournal: {
+        start: (tool, input, retrySafe) => harnessJournal.startTool(tool, input, retrySafe),
+        complete: (id, result) => harnessJournal.completeTool(id, result),
+        interrupt: (id, reason) => harnessJournal.interruptTool(id, reason)
+      },
+      modelJournal: {
+        start: (input) => harnessJournal.startModel(input),
+        complete: (id, completed, error) => harnessJournal.completeModel(id, completed, error)
+      },
       approve: resolveToolApproval
     });
     harnessCreated = true;
     if (recovered !== void 0) harness.main.context.restore({
       ...recovered.conversation.compact === void 0 ? {} : { compact: recovered.conversation.compact },
+      ...recovered.conversation.epoch === void 0 ? {} : { epoch: {
+        ...recovered.conversation.epoch,
+        stableMessages: recovered.conversation.epoch.stableMessages.map((message2) => ({
+          role: "system",
+          content: message2.content,
+          ...message2.cacheBreakpoint === void 0 ? {} : { cacheBreakpoint: message2.cacheBreakpoint }
+        }))
+      } },
+      ...recovered.conversation.visibilityLog === void 0 ? {} : {
+        visibilityLog: recovered.conversation.visibilityLog
+      },
       messages: recovered.conversation.messages.map((message2) => {
         const metadata = {
           ...message2.toolCallId === void 0 ? {} : { toolCallId: message2.toolCallId },
@@ -20235,7 +21136,7 @@ async function createProductionRuntime(options) {
         agent,
         providerError,
         errorCode,
-        errorMessage,
+        errorMessage: errorMessage2,
         attempt,
         maxAttempts,
         purpose,
@@ -20251,7 +21152,7 @@ async function createProductionRuntime(options) {
           model: typeof modelId === "string" ? modelId : void 0,
           agent: typeof agent === "string" ? agent : void 0,
           errorCode: typeof errorCode === "string" ? errorCode : void 0,
-          errorMessage: typeof errorMessage === "string" ? errorMessage : void 0,
+          errorMessage: typeof errorMessage2 === "string" ? errorMessage2 : void 0,
           attempt: typeof attempt === "number" ? attempt : void 0,
           maxAttempts: typeof maxAttempts === "number" ? maxAttempts : void 0,
           purpose: typeof purpose === "string" ? purpose : void 0,
@@ -20306,7 +21207,7 @@ async function createProductionRuntime(options) {
         evolveService.toolDefinition(),
         ...mcpTools
       ];
-      const loopFlavor = await optionalText2(join22(input.workspace, "FLAVOR.md"));
+      const loopFlavor = await optionalText2(join24(input.workspace, "FLAVOR.md"));
       const loopInstructionBaseline = await loopInstructions.baseline();
       const loopEnvironment = createPromptEnvironment({
         now: /* @__PURE__ */ new Date(),
@@ -20318,6 +21219,7 @@ async function createProductionRuntime(options) {
       let compactionInputTokens = 0;
       let compactionOutputTokens = 0;
       let loopHarness;
+      let loopHarnessCreated = false;
       const createLoopContext = (agent, agentTools, contextModelId) => {
         const language2 = resolveLanguage(config.language);
         const { compactAtChars, toolOutputChars, ...compaction } = config.context;
@@ -20337,8 +21239,8 @@ async function createProductionRuntime(options) {
           volatileSystem: () => [
             buildCurrentDateSection(loopEnvironment.date),
             buildRuntimeEnvironmentSection({
-              model: agent === "main" ? loopHarness.mainModelId : contextModelId,
-              permissionMode: agent === "subagent" ? loopHarness.permissionMode === "plan" ? "plan" : "bubble" : loopHarness.permissionMode
+              model: agent === "main" && loopHarnessCreated ? loopHarness.mainModelId : contextModelId,
+              permissionMode: agent === "subagent" ? (loopHarnessCreated ? loopHarness.permissionMode : harness.permissionMode) === "plan" ? "plan" : "bubble" : loopHarnessCreated ? loopHarness.permissionMode : harness.permissionMode
             })
           ],
           ...loopFlavor === void 0 ? {} : { flavor: loopFlavor },
@@ -20372,12 +21274,23 @@ async function createProductionRuntime(options) {
         tools: loopTools,
         createContext: createLoopContext,
         permissionMode: harness.permissionMode,
+        permissionPolicy,
         maxIterationsMain: config.maxIterations.main,
         maxIterationsSubagent: config.maxIterations.subagent,
         loopMode: true,
         afterToolSuccess: async (_tool, paths, _input, _output, context) => loopInstructions.discover(paths, context.ownerId ?? context.agent),
+        toolJournal: {
+          start: (tool, input2, retrySafe) => harnessJournal.startTool(tool, input2, retrySafe),
+          complete: (id, result) => harnessJournal.completeTool(id, result),
+          interrupt: (id, reason) => harnessJournal.interruptTool(id, reason)
+        },
+        modelJournal: {
+          start: (input2) => harnessJournal.startModel(input2),
+          complete: (id, completed, error) => harnessJournal.completeModel(id, completed, error)
+        },
         approve: resolveToolApproval
       });
+      loopHarnessCreated = true;
       let runReason = "finished";
       try {
         evolveService.beginRun();
@@ -20433,7 +21346,7 @@ async function createProductionRuntime(options) {
         return answers[0] === "Continue" ? "approved" : "rejected";
       },
       fingerprint: workspaceFingerprint,
-      idFactory: () => `loop-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID16().slice(0, 8)}`
+      idFactory: () => `loop-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID18().slice(0, 8)}`
     });
     const goalStore = new GoalStore({ workspace });
     const goalOrchestrator = new GoalOrchestrator({
@@ -20445,8 +21358,14 @@ async function createProductionRuntime(options) {
       maxRounds: 5,
       maxStallStreak: 2,
       persistence: goalStore,
+      verifyHost: async (signal) => runVerificationPlan(
+        await inferVerificationPlan(workspace),
+        workspace,
+        signal,
+        executionEnvironment
+      ),
       now: () => (/* @__PURE__ */ new Date()).toISOString(),
-      idFactory: () => `goal-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID16().slice(0, 8)}`,
+      idFactory: () => `goal-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID18().slice(0, 8)}`,
       runWorker: ({ workspace: goalWorkspace, prompt, signal }) => runLoopWorker({ workspace: goalWorkspace, prompt, signal })
     });
     let sessionHistory = await SessionHistory.open({
@@ -20507,6 +21426,13 @@ async function createProductionRuntime(options) {
     const services = {
       hooks,
       workspace,
+      durableQueue: {
+        recover: () => harnessRecovery.queue,
+        admit: (kind, payload) => harnessJournal.admitQueue(kind, payload),
+        claim: (id) => harnessJournal.claimQueue(id),
+        ack: (id) => harnessJournal.ackQueue(id),
+        release: (id, reason) => harnessJournal.releaseQueue(id, reason)
+      },
       mainModel: () => mainModel,
       subagentModel: () => childModel,
       llmServiceName: () => effectiveLlm?.serviceName,
@@ -20518,7 +21444,14 @@ async function createProductionRuntime(options) {
       ...palServices === void 0 ? {} : { pals: palServices },
       run: (prompt, signal, runOptions) => {
         interruptedTaskPlanNeedsReassessment = false;
-        return persistAndCheckpointAfter(runMain(
+        const turnConfig = Object.freeze({
+          mainModel,
+          subagentModel: childModel,
+          permissionMode: harness.permissionMode,
+          contextEpoch: harness.main.context.snapshot().epoch?.id ?? "legacy"
+        });
+        const turnId = harnessJournal.startTurn(turnConfig, { prompt, initialUserMessage: runOptions?.initialUserMessage });
+        return durableTurn(persistAndCheckpointAfter(runMain(
           harness,
           skills,
           prompt,
@@ -20538,7 +21471,7 @@ async function createProductionRuntime(options) {
           prompt,
           context: harness.main.context.snapshot(),
           label: `turn: ${prompt.slice(0, 80)}`
-        }));
+        })), harnessJournal, turnId, turnConfig);
       },
       runSkill: (skill, prompt, signal) => persistAfter(
         runExplicitSkill(harness, skills, skill, prompt, signal, selectedModels.mainError),
@@ -20635,7 +21568,7 @@ async function createProductionRuntime(options) {
       }, focus, signal),
       audit: async (toolFilter) => {
         try {
-          const raw = await readFile20(auditLogger.path, "utf8");
+          const raw = await readFile22(auditLogger.path, "utf8");
           const lines = raw.trim().split("\n").filter((line) => line.length > 0);
           const entries = lines.map((line) => {
             try {
@@ -20674,7 +21607,7 @@ ${summary2}`;
       },
       usage: async () => {
         try {
-          const raw = await readFile20(usageLogPath(), "utf8");
+          const raw = await readFile22(usageLogPath(), "utf8");
           return formatUsageSummary(summarizeUsage(parseUsageEntries(raw)));
         } catch (error) {
           if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
@@ -20702,7 +21635,8 @@ ${summary2}`;
         for (const key of Object.keys(subagentStartedAt)) delete subagentStartedAt[key];
         for (const key of Object.keys(subagentElapsedMs)) delete subagentElapsedMs[key];
         const previousIdeSessionId = ideSessionId;
-        sessionId = `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID16().slice(0, 8)}`;
+        sessionId = `session-${(/* @__PURE__ */ new Date()).toISOString().replace(/[^0-9]/g, "").slice(0, 17)}-${randomUUID18().slice(0, 8)}`;
+        harnessJournal = new HarnessJournal({ workspace, sessionId });
         setUsageSession(sessionId);
         ideSessionId = sessionId;
         if (previousIdeSessionId !== void 0) await ide.endSession(previousIdeSessionId);
@@ -20800,7 +21734,7 @@ ${renderMemoryDocument(entries)}`;
           return `Provider "${providerName}" is missing authorizationUrl, tokenUrl, or clientId.`;
         }
         try {
-          const tokenStore = createFileTokenStore(join22(home, ".flavor-code", "auth.json"));
+          const tokenStore = createFileTokenStore(join24(home, ".flavor-code", "auth.json"));
           const credentialId = oauthCredentialId(oauthConfig.tokenUrl, oauthConfig.clientId);
           await migrateLegacyOAuthToken(tokenStore, providerName, credentialId);
           const oauth = new OAuthCallbackAuthProvider({
@@ -20843,7 +21777,7 @@ ${renderMemoryDocument(entries)}`;
         }
       },
       async logout() {
-        const tokenStore = createFileTokenStore(join22(home, ".flavor-code", "auth.json"));
+        const tokenStore = createFileTokenStore(join24(home, ".flavor-code", "auth.json"));
         const tokens = await tokenStore.load();
         const hadCredentials = Object.keys(tokens).length > 0 || effectiveLlm !== void 0;
         if (!hadCredentials) {
@@ -21073,7 +22007,7 @@ function terminalProgressState(status) {
   return "failed";
 }
 async function workspaceFingerprint(workspace) {
-  const hash = createHash13("sha256");
+  const hash = createHash17("sha256");
   const diff = await execFileNoThrow(
     "git",
     ["-C", workspace, "diff", "--no-ext-diff", "--binary", "HEAD"],
@@ -21089,13 +22023,13 @@ async function workspaceFingerprint(workspace) {
   let remaining = 5 * 1024 * 1024;
   for (const name of untracked.stdout.split("\0").filter(Boolean).sort()) {
     if (name === ".flavor/loops" || name.startsWith(".flavor/loops/")) continue;
-    const path = resolve25(workspace, name);
-    const relativePath = relative20(resolve25(workspace), path);
-    if (relativePath === ".." || relativePath.startsWith(`..${sep19}`)) continue;
+    const path = resolve27(workspace, name);
+    const relativePath = relative20(resolve27(workspace), path);
+    if (relativePath === ".." || relativePath.startsWith(`..${sep20}`)) continue;
     hash.update(name);
     if (remaining <= 0) continue;
     try {
-      const content = await readFile20(path);
+      const content = await readFile22(path);
       const slice = content.subarray(0, remaining);
       hash.update(slice);
       remaining -= slice.length;
@@ -21194,6 +22128,27 @@ async function* persistEach(source, persist) {
     await persist();
   }
 }
+async function* durableTurn(source, journal, turnId, config) {
+  let failure;
+  let completed = false;
+  try {
+    for await (const event of source) {
+      if (event.type === "error") failure = event.error.message;
+      yield event;
+    }
+    completed = true;
+  } catch (error) {
+    failure = message(error);
+    throw error;
+  } finally {
+    if (completed && failure === void 0) {
+      journal.completeTurn(turnId);
+      journal.savepoint("turn-complete", config);
+    } else {
+      journal.interruptTurn(turnId, failure ?? "turn consumer interrupted before completion");
+    }
+  }
+}
 async function runGitCommit(deps, hint, signal) {
   if (!await isGitRepository(deps.workspace)) return "Not a git repository \u2014 /commit needs git.";
   let summary2 = await changeSummary(deps.workspace);
@@ -21287,7 +22242,7 @@ async function registerConfiguredAdapters(providers, registry, environment, diag
   const configured = { ...providers };
   if (configured.openai === void 0 && environment.OPENAI_API_KEY) configured.openai = { type: "openai", apiKey: environment.OPENAI_API_KEY };
   if (configured.anthropic === void 0 && environment.ANTHROPIC_API_KEY) configured.anthropic = { type: "anthropic", apiKey: environment.ANTHROPIC_API_KEY };
-  const oauthTokenStore = createFileTokenStore(join22(home, ".flavor-code", "auth.json"));
+  const oauthTokenStore = createFileTokenStore(join24(home, ".flavor-code", "auth.json"));
   const registered = [];
   let effectiveLlm;
   for (const [name, provider] of Object.entries(configured)) {
@@ -21552,7 +22507,7 @@ async function generateSleepReview(registry, modelId, prompt, signal) {
 }
 async function optionalText2(path) {
   try {
-    return await readFile20(path, "utf8");
+    return await readFile22(path, "utf8");
   } catch (error) {
     if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return void 0;
     throw error;
@@ -21568,13 +22523,15 @@ function sameToolName(left, right) {
 function storedConversation(snapshot4) {
   return {
     ...snapshot4.compact === void 0 ? {} : { compact: snapshot4.compact },
+    ...snapshot4.epoch === void 0 ? {} : { epoch: snapshot4.epoch },
+    ...snapshot4.visibilityLog === void 0 ? {} : { visibilityLog: snapshot4.visibilityLog },
     messages: snapshot4.messages.flatMap((message2) => {
-      if (message2.role === "system") return [];
       const metadata = {
         ...message2.toolCallId === void 0 ? {} : { toolCallId: message2.toolCallId },
         ...message2.toolCalls === void 0 ? {} : { toolCalls: message2.toolCalls }
       };
       if (message2.role === "user") return { role: "user", content: message2.content, ...metadata };
+      if (message2.role === "system") return { role: "system", content: message2.content, ...metadata };
       if (message2.role === "assistant") return { role: "assistant", content: message2.content, ...metadata };
       return { role: "tool", content: message2.content, ...metadata };
     })
@@ -21704,10 +22661,10 @@ async function* runGoalSession(orchestrator, goal, signal) {
 }
 function memoryTranscriptHash(messages) {
   const visible = messages.filter((item) => item.role === "user" || item.role === "assistant").map((item) => `${item.role}\0${modelContentText(item.content).trim()}`).join("\n");
-  return createHash13("sha256").update(visible, "utf8").digest("hex");
+  return createHash17("sha256").update(visible, "utf8").digest("hex");
 }
 function createMemoryTaskId() {
-  return `memory-${randomUUID16()}`;
+  return `memory-${randomUUID18()}`;
 }
 
 export {