harnessed 3.9.25 → 4.0.0

package/dist/cli.mjs

@@ -3,22 +3,22 @@ import { spawnSync, spawn, execSync } from 'child_process';
 import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync } from 'fs';
 import { join, dirname, resolve, sep, relative } from 'path';
 import { homedir } from 'os';
-import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, access, rename } from 'fs/promises';
 import { Type } from '@sinclair/typebox';
+import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, access, rename } from 'fs/promises';
 import { Value } from '@sinclair/typebox/value';
-import { LineCounter, parseDocument, parse, isSeq, isScalar } from 'yaml';
 import lockfile from 'proper-lockfile';
+import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';
 import * as p from '@clack/prompts';
 import { Command } from 'commander';
 import { Ajv } from 'ajv';
 import * as ajvFormatsNs from 'ajv-formats';
 import { fileURLToPath } from 'url';
 import { createHash } from 'crypto';
+import { Parser } from 'expr-eval';
 import { createPatch } from 'diff';
 import pc from 'picocolors';
 import { stdout, stdin } from 'process';
 import * as readline from 'readline/promises';
-import { Parser } from 'expr-eval';
 import { query } from '@anthropic-ai/claude-agent-sdk';
 
 var __defProp = Object.defineProperty;
@@ -119,158 +119,6 @@ var init_harnessedRoot = __esm({
   "src/installers/lib/harnessedRoot.ts"() {
   }
 });
-function checkNodeVersion() {
-  const v = process.versions.node;
-  const major = Number.parseInt(v.split(".")[0] ?? "0", 10);
-  return major >= 22 ? { name: "node \u2265 22", status: "pass", message: `node ${v}` } : {
-    name: "node \u2265 22",
-    status: "fail",
-    message: `node ${v} (need \u2265 22)`,
-    fix: "nvm install 22 && nvm use 22"
-  };
-}
-async function checkMcpScope() {
-  const projectMcp = join(process.cwd(), ".mcp.json");
-  const userClaude = join(homedir(), ".claude.json");
-  let projectExists = false;
-  try {
-    await readFile(projectMcp, "utf8");
-    projectExists = true;
-  } catch {
-  }
-  let userHasMcp = false;
-  try {
-    const raw = await readFile(userClaude, "utf8");
-    const parsed = JSON.parse(raw);
-    userHasMcp = !!parsed.mcpServers && Object.keys(parsed.mcpServers).length > 0;
-  } catch {
-  }
-  if (userHasMcp) {
-    return {
-      name: "mcp scope = project",
-      status: "fail",
-      message: `~/.claude.json has user-scope mcpServers (CC #54803 risk)`,
-      fix: "remove user-scope entries; re-add via `claude mcp add --scope project ...`"
-    };
-  }
-  return {
-    name: "mcp scope = project",
-    status: "pass",
-    message: projectExists ? "project .mcp.json present" : "no MCP servers installed"
-  };
-}
-function checkJq() {
-  const finder = process.platform === "win32" ? "where" : "which";
-  const r = spawnSync(finder, ["jq"], { encoding: "utf8" });
-  if (r.status === 0 && r.stdout.trim().length > 0) {
-    return {
-      name: "jq present",
-      status: "pass",
-      message: r.stdout.split(/\r?\n/)[0]?.trim() ?? "jq found"
-    };
-  }
-  const fix = process.platform === "win32" ? "winget install jqlang.jq  (or: scoop install jq)" : process.platform === "darwin" ? "brew install jq" : "apt-get install jq  (or: dnf install jq)";
-  return { name: "jq present", status: "fail", message: "jq not found in PATH", fix };
-}
-function checkWinBash() {
-  if (process.platform !== "win32") {
-    return { name: "bash flavor (win)", status: "pass", message: "skipped (non-Windows)" };
-  }
-  const where = spawnSync("where", ["bash"], { encoding: "utf8" });
-  const firstBash = (where.stdout ?? "").split(/\r?\n/)[0]?.trim() ?? "(not found)";
-  if (where.status !== 0 || !firstBash || firstBash === "(not found)") {
-    return {
-      name: "bash flavor (win)",
-      status: "fail",
-      message: "no bash on PATH",
-      fix: "install Git for Windows (Git Bash) and ensure it is on PATH"
-    };
-  }
-  const probe = spawnSync("bash", ["-c", "echo $WSL_DISTRO_NAME"], { encoding: "utf8" });
-  const distro = (probe.stdout ?? "").trim();
-  if (distro.length > 0) {
-    return {
-      name: "bash flavor (win)",
-      status: "fail",
-      message: `WSL bash (${distro}) \u2014 ralph-loop subagent fork breaks under WSL`,
-      fix: "reorder PATH so Git Bash precedes WSL bash.exe (Settings \u2192 System \u2192 Environment Variables)"
-    };
-  }
-  return { name: "bash flavor (win)", status: "pass", message: `${firstBash} (Git Bash / native)` };
-}
-var init_check_builtin = __esm({
-  "src/cli/lib/check-builtin.ts"() {
-  }
-});
-
-// src/cli/lib/probe-gstack.ts
-var probe_gstack_exports = {};
-__export(probe_gstack_exports, {
-  probeGstackPrefix: () => probeGstackPrefix
-});
-function probeOne(cmd) {
-  const finder = process.platform === "win32" ? "where" : "which";
-  const r = spawnSync(finder, [cmd], { encoding: "utf8" });
-  return r.status === 0 && (r.stdout?.trim().length ?? 0) > 0;
-}
-function probeGstackPrefix() {
-  const hasGstack = probeOne("gstack-office-hours");
-  const hasBare = probeOne("office-hours");
-  if (hasGstack && !hasBare) {
-    return { status: "pass", prefix: "gstack-", detail: "gstack-office-hours found" };
-  }
-  if (!hasGstack && hasBare) {
-    return { status: "pass", prefix: "", detail: "office-hours found (--no-prefix mode)" };
-  }
-  if (hasGstack && hasBare) {
-    return {
-      status: "fail",
-      detail: "both gstack-office-hours AND office-hours found \u2014 ambiguous",
-      fix: `edit .harnessed/config.json manually: '{"gstack_prefix":"gstack-"}' OR '{"gstack_prefix":""}'`
-    };
-  }
-  return {
-    status: "fail",
-    detail: "neither gstack-office-hours nor office-hours found in PATH",
-    fix: "install gstack: `npm i -g @gstack/cli` (or your preferred install method)"
-  };
-}
-var init_probe_gstack = __esm({
-  "src/cli/lib/probe-gstack.ts"() {
-  }
-});
-
-// src/manifest/lib/path-guard.ts
-function checkPathSafe(input) {
-  for (const re of PATH_TRAVERSAL_PATTERNS) {
-    if (re.test(input)) throw new PathTraversalError();
-  }
-}
-var PATH_TRAVERSAL_PATTERNS, PathTraversalError;
-var init_path_guard = __esm({
-  "src/manifest/lib/path-guard.ts"() {
-    PATH_TRAVERSAL_PATTERNS = [
-      /\.\.\//,
-      // (1) Unix dot-dot-slash: ../../etc/passwd
-      /\.\.\\/,
-      // (2) Windows backslash: ..\windows\system32
-      // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional null-byte injection detection (R10.4 D-03 OWASP A1 vector 3)
-      /\x00/,
-      // (3) Null byte injection: path\x00attack
-      /%2[eE]%2[eE]/,
-      // (4) URL-encoded dot-dot: %2e%2e%2fetc
-      /%25[2][eE]%25[2][eE]/
-      // (5) Double-encoded: %252e%252e%252f
-    ];
-    PathTraversalError = class _PathTraversalError extends Error {
-      constructor() {
-        super("path traversal attempt detected");
-        this.name = "PathTraversalError";
-        Object.setPrototypeOf(this, _PathTraversalError.prototype);
-      }
-    };
-  }
-});
 function branchOnSchemaVersion(v, handlers) {
   const isKnownVersion = Object.values(SCHEMA_VERSIONS).includes(v);
   return isKnownVersion ? handlers.v1() : handlers.unknown();
@@ -338,171 +186,168 @@ var init_schemaVersion = __esm({
     ]);
   }
 });
-var AliasEntryV1, AliasesV1;
-var init_aliases_v1 = __esm({
-  "src/manifest/schema/aliases.v1.ts"() {
+var CheckpointStatus, CheckpointV1;
+var init_checkpoint_v1 = __esm({
+  "src/checkpoint/schema/checkpoint.v1.ts"() {
     init_schemaVersion();
-    AliasEntryV1 = Type.Object(
+    CheckpointStatus = Type.Union([
+      Type.Literal("active"),
+      Type.Literal("paused"),
+      Type.Literal("complete")
+    ]);
+    CheckpointV1 = Type.Object(
       {
-        redirect: Type.String({ minLength: 1 }),
-        reason: Type.String({ minLength: 1, maxLength: 500 }),
-        // DOS cap sister governance.ts
-        since_version: Type.String({ pattern: "^\\d+\\.\\d+\\.\\d+$" }),
-        // semver strict
-        deprecation_date: Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" }),
-        // ISO-date Phase 3.2 W2 Rule 1
-        removal_date: Type.Optional(Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" }))
-        // optional long-tail window
+        schemaVersion: Type.Literal(SCHEMA_VERSIONS.checkpoint),
+        phase: Type.String({ minLength: 1 }),
+        status: CheckpointStatus,
+        last_task: Type.String(),
+        key_decisions: Type.Array(Type.String()),
+        canonical_refs: Type.Array(Type.String()),
+        /** D-04 WIRE-IN: optional SDK session_id captured via `sdkSpawn`
+         *  `onSessionId` callback (CD-4 closure-ready) for future `--resume`. */
+        session_id: Type.Optional(Type.String()),
+        /** RESEARCH § 1.3 critical constraint — SDK session resume requires cwd
+         *  match; we capture and validate at restore time. */
+        cwd: Type.String({ minLength: 1 }),
+        timestamp: Type.String({ minLength: 1 }),
+        // ISO-8601 by convention (TypeBox `format` requires Ajv-style format registry; we keep shape-check only — drift caught in writeCheckpoint path)
+        archive_path: Type.String({ minLength: 1 })
       },
       { additionalProperties: false }
     );
-    AliasesV1 = Type.Object(
+  }
+});
+var WorkflowStatus, CurrentWorkflowV1;
+var init_currentWorkflow_v1 = __esm({
+  "src/checkpoint/schema/currentWorkflow.v1.ts"() {
+    init_schemaVersion();
+    WorkflowStatus = Type.Union([
+      Type.Literal("active"),
+      Type.Literal("paused"),
+      Type.Literal("complete")
+    ]);
+    CurrentWorkflowV1 = Type.Object(
       {
-        schemaVersion: Type.Literal(SCHEMA_VERSIONS.aliases),
-        // 'harnessed.aliases.v1'
-        aliases: Type.Record(Type.String({ minLength: 1 }), AliasEntryV1)
+        schemaVersion: Type.Literal(SCHEMA_VERSIONS.currentWorkflow),
+        phase: Type.String({ minLength: 1 }),
+        status: WorkflowStatus,
+        last_checkpoint_path: Type.Union([Type.String(), Type.Null()]),
+        // ISO-8601 by convention (TypeBox `format` requires Ajv-style registry; shape-check only here, drift surfaces in state.ts writer).
+        started_at: Type.String({ minLength: 1 }),
+        paused_at: Type.Optional(Type.String({ minLength: 1 })),
+        completed_at: Type.Optional(Type.String({ minLength: 1 }))
       },
       { additionalProperties: false }
     );
   }
 });
 
-// src/manifest/aliases.ts
-var aliases_exports = {};
-__export(aliases_exports, {
-  listDeprecations: () => listDeprecations,
-  loadAliases: () => loadAliases,
-  resolveAlias: () => resolveAlias
-});
-function loadAliases() {
-  if (_cached) return _cached;
-  if (!existsSync(ALIASES_PATH)) return null;
-  const raw = readFileSync(ALIASES_PATH, "utf8");
-  const parsed = parse(raw);
-  if (!Value.Check(AliasesV1, parsed)) {
-    const errs = [...Value.Errors(AliasesV1, parsed)].slice(0, 3);
-    throw new Error(
-      `aliases.yaml schema invalid: ${errs.map((e) => `${e.path} ${e.message}`).join("; ")}`
-    );
+// src/checkpoint/schema/index.ts
+var init_schema = __esm({
+  "src/checkpoint/schema/index.ts"() {
+    init_checkpoint_v1();
+    init_currentWorkflow_v1();
   }
-  _cached = parsed;
-  return parsed;
-}
-function resolveAlias(name) {
-  checkPathSafe(name);
-  return loadAliases()?.aliases?.[name]?.redirect ?? null;
+});
+function statePath() {
+  return harnessedFile("current-workflow.json");
 }
-function listDeprecations() {
-  const a = loadAliases();
-  return a ? Object.entries(a.aliases).map(([old, entry]) => ({ old, entry })) : [];
+function lockTarget() {
+  return getHarnessedRoot();
 }
-var ALIASES_PATH, _cached;
-var init_aliases = __esm({
-  "src/manifest/aliases.ts"() {
-    init_path_guard();
-    init_aliases_v1();
-    ALIASES_PATH = join(process.cwd(), "manifests", "aliases.yaml");
-    _cached = null;
-  }
-});
-
-// src/cli/lib/check-deprecations.ts
-var check_deprecations_exports = {};
-__export(check_deprecations_exports, {
-  checkDeprecations: () => checkDeprecations
-});
-function checkDeprecations() {
+function lockOpts() {
+  return {
+    stale: 1e4,
+    retries: { retries: 3, factor: 2, minTimeout: 100 },
+    lockfilePath: harnessedFile(".lock")
+  };
+}
+async function withLock(fn) {
+  const target = lockTarget();
+  await mkdir(target, { recursive: true });
+  let release;
   try {
-    const deprecations = listDeprecations();
-    if (deprecations.length === 0) {
-      return { name: "deprecated manifests", status: "pass", message: "no deprecated manifests" };
-    }
-    const lines = deprecations.map(({ old, entry }) => {
-      const removal = entry.removal_date ? `, removes ${entry.removal_date}` : "";
-      return `  '${old}' \u2192 '${entry.redirect}' (since ${entry.since_version}, ${entry.deprecation_date}${removal}; ${entry.reason})`;
-    });
-    return {
-      name: "deprecated manifests",
-      status: "warn",
-      message: `${deprecations.length} deprecated manifest(s):
-${lines.join("\n")}`,
-      fix: "install paths auto-redirect; consider migrating manifest references to new names"
-    };
+    release = await lockfile.lock(target, lockOpts());
   } catch (e) {
-    return {
-      name: "deprecated manifests",
-      status: "fail",
-      message: `aliases.yaml load error: ${e.message}`,
-      fix: "verify manifests/aliases.yaml schema (see docs/PROJECT-SPEC.md)"
-    };
+    if (e.code === "ELOCKED") throw new LockHeldError();
+    throw e;
+  }
+  try {
+    return await fn();
+  } finally {
+    await release?.();
   }
 }
-var init_check_deprecations = __esm({
-  "src/cli/lib/check-deprecations.ts"() {
-    init_aliases();
+async function readCurrentWorkflow() {
+  let raw;
+  try {
+    raw = await readFile(statePath(), "utf8");
+  } catch {
+    return null;
   }
-});
-var CheckpointStatus, CheckpointV1;
-var init_checkpoint_v1 = __esm({
-  "src/checkpoint/schema/checkpoint.v1.ts"() {
-    init_schemaVersion();
-    CheckpointStatus = Type.Union([
-      Type.Literal("active"),
-      Type.Literal("paused"),
-      Type.Literal("complete")
-    ]);
-    CheckpointV1 = Type.Object(
-      {
-        schemaVersion: Type.Literal(SCHEMA_VERSIONS.checkpoint),
-        phase: Type.String({ minLength: 1 }),
-        status: CheckpointStatus,
-        last_task: Type.String(),
-        key_decisions: Type.Array(Type.String()),
-        canonical_refs: Type.Array(Type.String()),
-        /** D-04 WIRE-IN: optional SDK session_id captured via `sdkSpawn`
-         *  `onSessionId` callback (CD-4 closure-ready) for future `--resume`. */
-        session_id: Type.Optional(Type.String()),
-        /** RESEARCH § 1.3 critical constraint — SDK session resume requires cwd
-         *  match; we capture and validate at restore time. */
-        cwd: Type.String({ minLength: 1 }),
-        timestamp: Type.String({ minLength: 1 }),
-        // ISO-8601 by convention (TypeBox `format` requires Ajv-style format registry; we keep shape-check only — drift caught in writeCheckpoint path)
-        archive_path: Type.String({ minLength: 1 })
-      },
-      { additionalProperties: false }
-    );
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
   }
-});
-var WorkflowStatus, CurrentWorkflowV1;
-var init_currentWorkflow_v1 = __esm({
-  "src/checkpoint/schema/currentWorkflow.v1.ts"() {
-    init_schemaVersion();
-    WorkflowStatus = Type.Union([
-      Type.Literal("active"),
-      Type.Literal("paused"),
-      Type.Literal("complete")
-    ]);
-    CurrentWorkflowV1 = Type.Object(
-      {
-        schemaVersion: Type.Literal(SCHEMA_VERSIONS.currentWorkflow),
-        phase: Type.String({ minLength: 1 }),
-        status: WorkflowStatus,
-        last_checkpoint_path: Type.Union([Type.String(), Type.Null()]),
-        // ISO-8601 by convention (TypeBox `format` requires Ajv-style registry; shape-check only here, drift surfaces in state.ts writer).
-        started_at: Type.String({ minLength: 1 }),
-        paused_at: Type.Optional(Type.String({ minLength: 1 })),
-        completed_at: Type.Optional(Type.String({ minLength: 1 }))
-      },
-      { additionalProperties: false }
-    );
+  const v = parsed.schemaVersion ?? "";
+  return branchOnSchemaVersion(v, {
+    v1: () => Value.Check(CurrentWorkflowV1, parsed) ? parsed : null,
+    unknown: () => null
+  });
+}
+async function writeCurrentWorkflow(s) {
+  if (!Value.Check(CurrentWorkflowV1, s)) {
+    const errs = [...Value.Errors(CurrentWorkflowV1, s)].map((e) => e.message).join("; ");
+    throw new WorkflowStateError(`current-workflow schema validation failed: ${errs}`);
   }
-});
-
-// src/checkpoint/schema/index.ts
-var init_schema = __esm({
-  "src/checkpoint/schema/index.ts"() {
-    init_checkpoint_v1();
-    init_currentWorkflow_v1();
+  const path = statePath();
+  await mkdir(dirname(path), { recursive: true });
+  await withLock(async () => {
+    await writeFile(path, JSON.stringify(s, null, 2), "utf8");
+  });
+}
+async function activate(phase, checkpointPath = null) {
+  await writeCurrentWorkflow({
+    schemaVersion: SCHEMA_VERSIONS.currentWorkflow,
+    phase,
+    status: "active",
+    last_checkpoint_path: checkpointPath,
+    started_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+async function pause() {
+  const s = await readCurrentWorkflow();
+  if (!s) return;
+  await writeCurrentWorkflow({ ...s, status: "paused", paused_at: (/* @__PURE__ */ new Date()).toISOString() });
+}
+async function complete() {
+  const s = await readCurrentWorkflow();
+  if (!s) return;
+  await writeCurrentWorkflow({ ...s, status: "complete", completed_at: (/* @__PURE__ */ new Date()).toISOString() });
+}
+var WorkflowStateError, LockHeldError;
+var init_state = __esm({
+  "src/checkpoint/state.ts"() {
+    init_harnessedRoot();
+    init_schemaVersion();
+    init_schema();
+    WorkflowStateError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "WorkflowStateError";
+      }
+    };
+    LockHeldError = class _LockHeldError extends Error {
+      constructor() {
+        super(
+          `another harnessed process holds the lock at ${harnessedFile(".lock")} \u2014 wait or kill stale process (try: harnessed status)`
+        );
+        this.name = "LockHeldError";
+        Object.setPrototypeOf(this, _LockHeldError.prototype);
+      }
+    };
   }
 });
 function estimateTokens(s) {
@@ -554,754 +399,949 @@ var init_template = __esm({
   }
 });
 
-// src/cli/lib/check-token-budget.ts
-var check_token_budget_exports = {};
-__export(check_token_budget_exports, {
-  checkTokenBudget: () => checkTokenBudget
+// src/checkpoint/engineHook.ts
+var engineHook_exports = {};
+__export(engineHook_exports, {
+  activatePhase: () => activatePhase,
+  completePhase: () => completePhase
 });
-function scanSkillsDir(root) {
-  if (!existsSync(root)) return [];
-  return readdirSync(root).flatMap((name) => {
-    const md = join(root, name, "SKILL.md");
-    if (!existsSync(md)) return [];
-    const fm = readFileSync(md, "utf8").match(/^---\n([\s\S]*?)\n---/)?.[1] ?? "";
-    const desc = fm.match(/^description:\s*(.+)$/m)?.[1] ?? "";
-    return [{ name, tokens: estimateTokens(desc) }];
-  });
+async function activatePhase(phaseId) {
+  const checkpointPath = join(harnessedSubdir("checkpoints"), `${phaseId}.json`);
+  await activate(phaseId, checkpointPath);
+  return { checkpointPath };
 }
-function checkTokenBudget() {
-  const roots = [join(homedir(), ".claude", "skills"), join(process.cwd(), "skills")];
-  const items = roots.flatMap(scanSkillsDir);
-  const total = items.reduce((s, i) => s + i.tokens, 0);
-  const over = items.filter((i) => i.tokens > PER_SKILL_THRESHOLD).length;
-  if (total <= TOTAL_THRESHOLD && over === 0) {
-    const msg = `${items.length} skill(s) total ${total} tokens (under 1% / 2000 threshold)`;
-    return { name: "token budget", status: "pass", message: msg };
+async function completePhase(ctx) {
+  if (ctx.phaseId === "unknown") {
+    console.error(
+      `[harnessed] WARN engineHook: phaseId="unknown" \u2014 checkpoint paths fall back to ${join(harnessedSubdir("checkpoints"), "unknown.json")} (Karpathy fail-loud non-blocking; W-04 mitigation)`
+    );
   }
-  const top = [...items].sort((a, b) => b.tokens - a.tokens).slice(0, 3).map((t2) => `${t2.name}:${t2.tokens}`).join(", ");
-  const pct = (total / CONTEXT_WINDOW_TOKENS * 100).toFixed(2);
-  const message = `${items.length} skill(s) total ${total} tokens (${pct}% of 200000) \u2014 top: ${top}`;
-  return {
-    name: "token budget",
-    status: "warn",
-    message,
-    fix: "shorten verbose skill descriptions OR review per-skill > 5000 tokens"
-  };
+  writeCheckpoint({
+    schemaVersion: SCHEMA_VERSIONS.checkpoint,
+    phase: ctx.phaseId,
+    status: "complete",
+    last_task: ctx.lastTask ?? "engine.runRouting complete",
+    key_decisions: ctx.keyDecisions ?? [],
+    canonical_refs: ctx.canonicalRefs ?? [],
+    ...ctx.sessionId ? { session_id: ctx.sessionId } : {},
+    cwd: process.cwd(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    archive_path: `${join(harnessedSubdir("archive"), `phase-${ctx.phaseId}`)}/`
+  });
+  await complete();
 }
-var CONTEXT_WINDOW_TOKENS, TOTAL_THRESHOLD, PER_SKILL_THRESHOLD;
-var init_check_token_budget = __esm({
-  "src/cli/lib/check-token-budget.ts"() {
+var init_engineHook = __esm({
+  "src/checkpoint/engineHook.ts"() {
+    init_harnessedRoot();
+    init_schemaVersion();
+    init_state();
     init_template();
-    CONTEXT_WINDOW_TOKENS = 2e5;
-    TOTAL_THRESHOLD = 2e3;
-    PER_SKILL_THRESHOLD = 5e3;
   }
 });
-async function checkAgentTeams() {
-  const envValue = process.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
-  const envOn = envValue === "1";
-  let settingsValue;
-  let settingsOn = false;
-  try {
-    const path = resolve(homedir(), ".claude", "settings.json");
-    const raw = await readFile(path, "utf8");
-    const data = JSON.parse(raw);
-    settingsValue = data.env?.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
-    settingsOn = settingsValue === "1";
-  } catch {
-  }
-  const detected = { env: envOn, settingsJson: settingsOn };
-  if (envOn || settingsOn) {
-    return { status: "pass", detected, envValue, settingsValue };
-  }
-  return {
-    status: "missing",
-    detected,
-    envValue,
-    settingsValue,
-    remediation: 'Agent Teams not enabled. Add to ~/.claude/settings.json:\n  "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" }\nOR run: claude config set env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS 1\nOR export env var:\n  export CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1\nThen restart Claude Code (CC >= 2.1.133 required).'
+function checkNodeVersion() {
+  const v = process.versions.node;
+  const major = Number.parseInt(v.split(".")[0] ?? "0", 10);
+  return major >= 22 ? { name: "node \u2265 22", status: "pass", message: `node ${v}` } : {
+    name: "node \u2265 22",
+    status: "fail",
+    message: `node ${v} (need \u2265 22)`,
+    fix: "nvm install 22 && nvm use 22"
   };
 }
-var init_checkAgentTeams = __esm({
-  "src/cli/lib/checkAgentTeams.ts"() {
+async function checkMcpScope() {
+  const projectMcp = join(process.cwd(), ".mcp.json");
+  const userClaude = join(homedir(), ".claude.json");
+  let projectExists = false;
+  try {
+    await readFile(projectMcp, "utf8");
+    projectExists = true;
+  } catch {
   }
-});
-
-// src/cli/lib/check-agent-teams-doctor.ts
-var check_agent_teams_doctor_exports = {};
-__export(check_agent_teams_doctor_exports, {
-  checkAgentTeamsDoctor: () => checkAgentTeamsDoctor
-});
-async function checkAgentTeamsDoctor() {
-  const r = await checkAgentTeams();
-  if (r.status === "pass") {
-    const source = r.detected.env ? "env var" : "settings.json";
+  let userHasMcp = false;
+  try {
+    const raw = await readFile(userClaude, "utf8");
+    const parsed = JSON.parse(raw);
+    userHasMcp = !!parsed.mcpServers && Object.keys(parsed.mcpServers).length > 0;
+  } catch {
+  }
+  if (userHasMcp) {
     return {
-      name: "Agent Teams env",
-      status: "pass",
-      message: `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 (${source})`
+      name: "mcp scope = project",
+      status: "fail",
+      message: `~/.claude.json has user-scope mcpServers (CC #54803 risk)`,
+      fix: "remove user-scope entries; re-add via `claude mcp add --scope project ...`"
     };
   }
   return {
-    name: "Agent Teams env",
-    status: "warn",
-    message: "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS not set (Agent Teams disabled)",
-    fix: r.remediation
+    name: "mcp scope = project",
+    status: "pass",
+    message: projectExists ? "project .mcp.json present" : "no MCP servers installed"
   };
 }
-var init_check_agent_teams_doctor = __esm({
-  "src/cli/lib/check-agent-teams-doctor.ts"() {
-    init_checkAgentTeams();
+function checkJq() {
+  const finder = process.platform === "win32" ? "where" : "which";
+  const r = spawnSync(finder, ["jq"], { encoding: "utf8" });
+  if (r.status === 0 && r.stdout.trim().length > 0) {
+    return {
+      name: "jq present",
+      status: "pass",
+      message: r.stdout.split(/\r?\n/)[0]?.trim() ?? "jq found"
+    };
   }
-});
-
-// src/cli/lib/check-planning-with-files.ts
-var check_planning_with_files_exports = {};
-__export(check_planning_with_files_exports, {
-  checkPlanningWithFiles: () => checkPlanningWithFiles
-});
-async function checkPlanningWithFiles() {
-  const root = join(
-    homedir(),
-    ".claude",
-    "plugins",
-    "cache",
-    "planning-with-files",
-    "planning-with-files"
-  );
-  try {
-    const entries = await readdir(root);
-    const versions = entries.filter((e) => /^\d+\.\d+/.test(e));
-    if (versions.length > 0) {
-      return {
-        name: "planning-with-files plugin",
-        status: "pass",
-        message: `installed (version ${versions.join(", ")})`
-      };
-    }
+  const fix = process.platform === "win32" ? "winget install jqlang.jq  (or: scoop install jq)" : process.platform === "darwin" ? "brew install jq" : "apt-get install jq  (or: dnf install jq)";
+  return { name: "jq present", status: "fail", message: "jq not found in PATH", fix };
+}
+function checkWinBash() {
+  if (process.platform !== "win32") {
+    return { name: "bash flavor (win)", status: "pass", message: "skipped (non-Windows)" };
+  }
+  const where = spawnSync("where", ["bash"], { encoding: "utf8" });
+  const firstBash = (where.stdout ?? "").split(/\r?\n/)[0]?.trim() ?? "(not found)";
+  if (where.status !== 0 || !firstBash || firstBash === "(not found)") {
     return {
-      name: "planning-with-files plugin",
-      status: "warn",
-      message: "plugin directory exists but no version subdir found",
-      fix: REMEDIATION,
-      install_commands: INSTALL_COMMANDS
+      name: "bash flavor (win)",
+      status: "fail",
+      message: "no bash on PATH",
+      fix: "install Git for Windows (Git Bash) and ensure it is on PATH"
     };
-  } catch {
+  }
+  const probe = spawnSync("bash", ["-c", "echo $WSL_DISTRO_NAME"], { encoding: "utf8" });
+  const distro = (probe.stdout ?? "").trim();
+  if (distro.length > 0) {
     return {
-      name: "planning-with-files plugin",
-      status: "warn",
-      message: "not installed (plugin cache path missing)",
-      fix: REMEDIATION,
-      install_commands: INSTALL_COMMANDS
+      name: "bash flavor (win)",
+      status: "fail",
+      message: `WSL bash (${distro}) \u2014 ralph-loop subagent fork breaks under WSL`,
+      fix: "reorder PATH so Git Bash precedes WSL bash.exe (Settings \u2192 System \u2192 Environment Variables)"
     };
   }
+  return { name: "bash flavor (win)", status: "pass", message: `${firstBash} (Git Bash / native)` };
 }
-var REMEDIATION, INSTALL_COMMANDS;
-var init_check_planning_with_files = __esm({
-  "src/cli/lib/check-planning-with-files.ts"() {
-    REMEDIATION = "install via `claude plugin marketplace add OthmanAdi/planning-with-files && claude plugin install planning-with-files` (requires >=2.2.0 per R20.15 + D-15)";
-    INSTALL_COMMANDS = [
-      "claude plugin marketplace add OthmanAdi/planning-with-files",
-      "claude plugin install planning-with-files"
-    ];
+var init_check_builtin = __esm({
+  "src/cli/lib/check-builtin.ts"() {
   }
 });
 
-// src/cli/lib/check-mattpocock-skills.ts
-var check_mattpocock_skills_exports = {};
-__export(check_mattpocock_skills_exports, {
-  checkMattpocockSkills: () => checkMattpocockSkills
+// src/cli/lib/probe-gstack.ts
+var probe_gstack_exports = {};
+__export(probe_gstack_exports, {
+  probeGstackPrefix: () => probeGstackPrefix
 });
-async function checkMattpocockSkills() {
-  const pluginRoot = join(
-    homedir(),
-    ".claude",
-    "plugins",
-    "cache",
-    "mattpocock-skills",
-    "mattpocock-skills"
-  );
-  const skillRoot = join(homedir(), ".claude", "skills", "mattpocock-skills");
-  try {
-    const entries = await readdir(pluginRoot);
-    const versions = entries.filter((e) => /^\d+\.\d+/.test(e));
-    if (versions.length > 0) {
-      return {
-        name: "mattpocock-skills",
-        status: "pass",
-        message: `installed as plugin (version ${versions.join(", ")})`
-      };
-    }
-  } catch {
+function probeOne(cmd) {
+  const finder = process.platform === "win32" ? "where" : "which";
+  const r = spawnSync(finder, [cmd], { encoding: "utf8" });
+  return r.status === 0 && (r.stdout?.trim().length ?? 0) > 0;
+}
+function probeGstackPrefix() {
+  const hasGstack = probeOne("gstack-office-hours");
+  const hasBare = probeOne("office-hours");
+  if (hasGstack && !hasBare) {
+    return { status: "pass", prefix: "gstack-", detail: "gstack-office-hours found" };
   }
-  try {
-    await stat(skillRoot);
+  if (!hasGstack && hasBare) {
+    return { status: "pass", prefix: "", detail: "office-hours found (--no-prefix mode)" };
+  }
+  if (hasGstack && hasBare) {
     return {
-      name: "mattpocock-skills",
-      status: "pass",
-      message: `installed as user-skill (${skillRoot})`
+      status: "fail",
+      detail: "both gstack-office-hours AND office-hours found \u2014 ambiguous",
+      fix: `edit .harnessed/config.json manually: '{"gstack_prefix":"gstack-"}' OR '{"gstack_prefix":""}'`
     };
-  } catch {
-  }
-  const indicators = ["diagnose", "tdd", "zoom-out"];
-  for (const ind of indicators) {
-    const indPath = join(homedir(), ".claude", "skills", ind);
-    try {
-      await stat(indPath);
-      return {
-        name: "mattpocock-skills",
-        status: "pass",
-        message: `installed as individual skills (found ${ind}/)`
-      };
-    } catch {
-    }
   }
   return {
-    name: "mattpocock-skills",
-    status: "warn",
-    message: "not installed (plugin cache + user-skill paths both missing)",
-    fix: REMEDIATION2,
-    install_commands: INSTALL_COMMANDS2
+    status: "fail",
+    detail: "neither gstack-office-hours nor office-hours found in PATH",
+    fix: "install gstack: `npm i -g @gstack/cli` (or your preferred install method)"
   };
 }
-var REMEDIATION2, INSTALL_COMMANDS2;
-var init_check_mattpocock_skills = __esm({
-  "src/cli/lib/check-mattpocock-skills.ts"() {
-    REMEDIATION2 = "install via `npx skills@latest add mattpocock/skills` (or git clone https://github.com/mattpocock/skills ~/.claude/skills/mattpocock-skills); methodology fallback already inline in role-prompts.yaml per v3.6.0 Phase 1 \u2014 install is optional but enables /grill-with-docs /zoom-out etc. SlashCommand acceleration";
-    INSTALL_COMMANDS2 = ["npx skills@latest add mattpocock/skills"];
+var init_probe_gstack = __esm({
+  "src/cli/lib/probe-gstack.ts"() {
   }
 });
-function getUserClaudeJsonPath() {
-  return join(homedir(), ".claude.json");
-}
-async function readUserClaudeJson() {
-  const path = getUserClaudeJsonPath();
-  let raw;
-  try {
-    raw = await readFile(path, "utf8");
-  } catch (err2) {
-    if (err2.code === "ENOENT") return {};
-    throw err2;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed === null || typeof parsed !== "object") return {};
-    return parsed;
-  } catch {
-    return {};
+
+// src/manifest/lib/path-guard.ts
+function checkPathSafe(input) {
+  for (const re of PATH_TRAVERSAL_PATTERNS) {
+    if (re.test(input)) throw new PathTraversalError();
   }
 }
-async function isMcpServerRegistered(name) {
-  const config = await readUserClaudeJson();
-  const servers = config.mcpServers;
-  if (!servers || typeof servers !== "object") return false;
-  return Object.hasOwn(servers, name);
-}
-async function isPluginRegistered(pluginName) {
-  try {
-    const path = join(homedir(), ".claude", "plugins", "installed_plugins.json");
-    const raw = await readFile(path, "utf8");
-    const parsed = JSON.parse(raw);
-    const plugins = parsed.plugins;
-    if (plugins && typeof plugins === "object") {
-      if (Object.hasOwn(plugins, pluginName)) return true;
-      if (Object.keys(plugins).some((k) => k.split("@")[0] === pluginName)) return true;
-    }
-  } catch {
-  }
-  for (const path of [
-    join(homedir(), ".claude", "settings.json"),
-    join(homedir(), ".claude.json")
-  ]) {
-    try {
-      const raw = await readFile(path, "utf8");
-      const parsed = JSON.parse(raw);
-      const plugins = parsed.enabledPlugins;
-      if (plugins && typeof plugins === "object") {
-        if (Object.hasOwn(plugins, pluginName)) return true;
-        if (Object.keys(plugins).some((k) => k.split("@")[0] === pluginName)) return true;
+var PATH_TRAVERSAL_PATTERNS, PathTraversalError;
+var init_path_guard = __esm({
+  "src/manifest/lib/path-guard.ts"() {
+    PATH_TRAVERSAL_PATTERNS = [
+      /\.\.\//,
+      // (1) Unix dot-dot-slash: ../../etc/passwd
+      /\.\.\\/,
+      // (2) Windows backslash: ..\windows\system32
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional null-byte injection detection (R10.4 D-03 OWASP A1 vector 3)
+      /\x00/,
+      // (3) Null byte injection: path\x00attack
+      /%2[eE]%2[eE]/,
+      // (4) URL-encoded dot-dot: %2e%2e%2fetc
+      /%25[2][eE]%25[2][eE]/
+      // (5) Double-encoded: %252e%252e%252f
+    ];
+    PathTraversalError = class _PathTraversalError extends Error {
+      constructor() {
+        super("path traversal attempt detected");
+        this.name = "PathTraversalError";
+        Object.setPrototypeOf(this, _PathTraversalError.prototype);
       }
-    } catch {
-    }
-  }
-  return false;
-}
-var init_readClaudeConfig = __esm({
-  "src/installers/lib/readClaudeConfig.ts"() {
-  }
-});
-
-// src/cli/lib/check-mcp-availability.ts
-var check_mcp_availability_exports = {};
-__export(check_mcp_availability_exports, {
-  checkMcpAvailability: () => checkMcpAvailability
-});
-async function checkMcpAvailability() {
-  const installed = [];
-  const missing = [];
-  for (const s of TARGET_SERVERS) {
-    const present = await isMcpServerRegistered(s);
-    if (present) {
-      installed.push(s);
-    } else {
-      missing.push(s);
-    }
-  }
-  if (missing.length === 0) {
-    return {
-      name: "MCP servers (tavily/exa/chrome-devtools)",
-      status: "pass",
-      message: `all 3 installed: ${installed.join(", ")}`
-    };
-  }
-  if (installed.length === 0) {
-    return {
-      name: "MCP servers (tavily/exa/chrome-devtools)",
-      status: "warn",
-      message: "none of 3 target MCP servers registered in ~/.claude.json",
-      fix: "run `harnessed setup` to install via Step B (manifests/tools/{tavily,exa,chrome-devtools}-mcp.yaml)"
     };
   }
-  return {
-    name: "MCP servers (tavily/exa/chrome-devtools)",
-    status: "warn",
-    message: `${installed.length}/3 installed: ${installed.join(", ")}; missing: ${missing.join(", ")}`,
-    fix: "run `harnessed setup` to install missing MCPs via Step B"
-  };
-}
-var TARGET_SERVERS;
-var init_check_mcp_availability = __esm({
-  "src/cli/lib/check-mcp-availability.ts"() {
-    init_readClaudeConfig();
-    TARGET_SERVERS = ["tavily-mcp", "exa-mcp", "chrome-devtools-mcp"];
-  }
-});
-
-// src/cli/lib/doctor-registry.ts
-var CHECKS;
-var init_doctor_registry = __esm({
-  "src/cli/lib/doctor-registry.ts"() {
-    init_check_builtin();
-    CHECKS = [
-      async () => checkNodeVersion(),
-      checkMcpScope,
-      async () => checkJq(),
-      async () => checkWinBash(),
-      async () => {
-        const { checkOrigin: checkOrigin2 } = await Promise.resolve().then(() => (init_origin_check(), origin_check_exports));
-        const r = checkOrigin2(process.cwd(), { allowFork: true });
-        return { name: "origin URL", status: r.status, message: r.detail, fix: r.fix };
-      },
-      async () => {
-        const { probeGstackPrefix: probeGstackPrefix2 } = await Promise.resolve().then(() => (init_probe_gstack(), probe_gstack_exports));
-        const r = probeGstackPrefix2();
-        return { name: "gstack prefix", status: r.status, message: r.detail, fix: r.fix };
-      },
-      async () => (await Promise.resolve().then(() => (init_check_deprecations(), check_deprecations_exports))).checkDeprecations(),
-      async () => (await Promise.resolve().then(() => (init_check_token_budget(), check_token_budget_exports))).checkTokenBudget(),
-      async () => (await Promise.resolve().then(() => (init_check_agent_teams_doctor(), check_agent_teams_doctor_exports))).checkAgentTeamsDoctor(),
-      async () => (await Promise.resolve().then(() => (init_check_planning_with_files(), check_planning_with_files_exports))).checkPlanningWithFiles(),
-      async () => (await Promise.resolve().then(() => (init_check_mattpocock_skills(), check_mattpocock_skills_exports))).checkMattpocockSkills(),
-      async () => (await Promise.resolve().then(() => (init_check_mcp_availability(), check_mcp_availability_exports))).checkMcpAvailability()
-    ];
-  }
 });
-var PinnedUpstream, KnownGoodV1;
-var init_known_good_v1 = __esm({
-  "src/manifest/schema/known-good.v1.ts"() {
+var AliasEntryV1, AliasesV1;
+var init_aliases_v1 = __esm({
+  "src/manifest/schema/aliases.v1.ts"() {
     init_schemaVersion();
-    PinnedUpstream = Type.Object(
+    AliasEntryV1 = Type.Object(
       {
-        name: Type.String({ minLength: 1 }),
-        version: Type.String({ minLength: 1 }),
-        install_method: Type.String({ minLength: 1 })
-        // npm-cli / mcp-stdio-add / etc per Phase 2.X
+        redirect: Type.String({ minLength: 1 }),
+        reason: Type.String({ minLength: 1, maxLength: 500 }),
+        // DOS cap sister governance.ts
+        since_version: Type.String({ pattern: "^\\d+\\.\\d+\\.\\d+$" }),
+        // semver strict
+        deprecation_date: Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" }),
+        // ISO-date Phase 3.2 W2 Rule 1
+        removal_date: Type.Optional(Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" }))
+        // optional long-tail window
       },
       { additionalProperties: false }
     );
-    KnownGoodV1 = Type.Object(
+    AliasesV1 = Type.Object(
       {
-        schemaVersion: Type.Literal(SCHEMA_VERSIONS.knownGood),
-        // 'harnessed.known-good.v1'
-        harnessed_version: Type.String({ pattern: "^\\d+\\.\\d+\\.\\d+$" }),
-        // semver strict
-        e2e_verified_at: Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" }),
-        // ISO date pattern
-        upstreams: Type.Array(PinnedUpstream)
+        schemaVersion: Type.Literal(SCHEMA_VERSIONS.aliases),
+        // 'harnessed.aliases.v1'
+        aliases: Type.Record(Type.String({ minLength: 1 }), AliasEntryV1)
       },
       { additionalProperties: false }
     );
   }
 });
 
-// src/manifest/knownGood.ts
-var knownGood_exports = {};
-__export(knownGood_exports, {
-  getPinnedVersion: () => getPinnedVersion,
-  loadKnownGood: () => loadKnownGood
+// src/manifest/aliases.ts
+var aliases_exports = {};
+__export(aliases_exports, {
+  listDeprecations: () => listDeprecations,
+  loadAliases: () => loadAliases,
+  resolveAlias: () => resolveAlias
 });
-function loadKnownGood(harnessedVer) {
-  if (_cache.has(harnessedVer)) return _cache.get(harnessedVer) ?? null;
-  const path = join(versionsDir(), `${harnessedVer}-known-good.yaml`);
-  if (!existsSync(path)) {
-    _cache.set(harnessedVer, null);
-    return null;
-  }
-  const raw = readFileSync(path, "utf8");
+function loadAliases() {
+  if (_cached) return _cached;
+  if (!existsSync(ALIASES_PATH)) return null;
+  const raw = readFileSync(ALIASES_PATH, "utf8");
   const parsed = parse(raw);
-  if (!Value.Check(KnownGoodV1, parsed)) {
-    const errs = [...Value.Errors(KnownGoodV1, parsed)].slice(0, 3);
+  if (!Value.Check(AliasesV1, parsed)) {
+    const errs = [...Value.Errors(AliasesV1, parsed)].slice(0, 3);
     throw new Error(
-      `${path} schema invalid: ${errs.map((e) => `${e.path} ${e.message}`).join("; ")}`
+      `aliases.yaml schema invalid: ${errs.map((e) => `${e.path} ${e.message}`).join("; ")}`
     );
   }
-  _cache.set(harnessedVer, parsed);
+  _cached = parsed;
   return parsed;
 }
-function getPinnedVersion(upstreamName, harnessedVer) {
-  const kg = loadKnownGood(harnessedVer);
-  if (!kg) return null;
-  const entry = kg.upstreams.find((u) => u.name === upstreamName);
-  return entry?.version ?? null;
+function resolveAlias(name) {
+  checkPathSafe(name);
+  return loadAliases()?.aliases?.[name]?.redirect ?? null;
 }
-var versionsDir, _cache;
-var init_knownGood = __esm({
-  "src/manifest/knownGood.ts"() {
-    init_known_good_v1();
-    versionsDir = () => join(process.cwd(), "versions");
-    _cache = /* @__PURE__ */ new Map();
+function listDeprecations() {
+  const a = loadAliases();
+  return a ? Object.entries(a.aliases).map(([old, entry]) => ({ old, entry })) : [];
+}
+var ALIASES_PATH, _cached;
+var init_aliases = __esm({
+  "src/manifest/aliases.ts"() {
+    init_path_guard();
+    init_aliases_v1();
+    ALIASES_PATH = join(process.cwd(), "manifests", "aliases.yaml");
+    _cached = null;
   }
 });
-function statePath2() {
-  return harnessedFile("current-workflow.json");
-}
-function lockTarget() {
-  return getHarnessedRoot();
-}
-function lockOpts() {
-  return {
-    stale: 1e4,
-    retries: { retries: 3, factor: 2, minTimeout: 100 },
-    lockfilePath: harnessedFile(".lock")
-  };
-}
-async function withLock(fn) {
-  const target = lockTarget();
-  await mkdir(target, { recursive: true });
-  let release;
+
+// src/cli/lib/check-deprecations.ts
+var check_deprecations_exports = {};
+__export(check_deprecations_exports, {
+  checkDeprecations: () => checkDeprecations
+});
+function checkDeprecations() {
   try {
-    release = await lockfile.lock(target, lockOpts());
+    const deprecations = listDeprecations();
+    if (deprecations.length === 0) {
+      return { name: "deprecated manifests", status: "pass", message: "no deprecated manifests" };
+    }
+    const lines = deprecations.map(({ old, entry }) => {
+      const removal = entry.removal_date ? `, removes ${entry.removal_date}` : "";
+      return `  '${old}' \u2192 '${entry.redirect}' (since ${entry.since_version}, ${entry.deprecation_date}${removal}; ${entry.reason})`;
+    });
+    return {
+      name: "deprecated manifests",
+      status: "warn",
+      message: `${deprecations.length} deprecated manifest(s):
+${lines.join("\n")}`,
+      fix: "install paths auto-redirect; consider migrating manifest references to new names"
+    };
   } catch (e) {
-    if (e.code === "ELOCKED") throw new LockHeldError();
-    throw e;
-  }
-  try {
-    return await fn();
-  } finally {
-    await release?.();
+    return {
+      name: "deprecated manifests",
+      status: "fail",
+      message: `aliases.yaml load error: ${e.message}`,
+      fix: "verify manifests/aliases.yaml schema (see docs/PROJECT-SPEC.md)"
+    };
   }
 }
-async function readCurrentWorkflow() {
-  let raw;
-  try {
-    raw = await readFile(statePath2(), "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
+var init_check_deprecations = __esm({
+  "src/cli/lib/check-deprecations.ts"() {
+    init_aliases();
   }
-  const v = parsed.schemaVersion ?? "";
-  return branchOnSchemaVersion(v, {
-    v1: () => Value.Check(CurrentWorkflowV1, parsed) ? parsed : null,
-    unknown: () => null
+});
+
+// src/cli/lib/check-token-budget.ts
+var check_token_budget_exports = {};
+__export(check_token_budget_exports, {
+  checkTokenBudget: () => checkTokenBudget
+});
+function scanSkillsDir(root) {
+  if (!existsSync(root)) return [];
+  return readdirSync(root).flatMap((name) => {
+    const md = join(root, name, "SKILL.md");
+    if (!existsSync(md)) return [];
+    const fm = readFileSync(md, "utf8").match(/^---\n([\s\S]*?)\n---/)?.[1] ?? "";
+    const desc = fm.match(/^description:\s*(.+)$/m)?.[1] ?? "";
+    return [{ name, tokens: estimateTokens(desc) }];
   });
 }
-async function writeCurrentWorkflow(s) {
-  if (!Value.Check(CurrentWorkflowV1, s)) {
-    const errs = [...Value.Errors(CurrentWorkflowV1, s)].map((e) => e.message).join("; ");
-    throw new WorkflowStateError(`current-workflow schema validation failed: ${errs}`);
+function checkTokenBudget() {
+  const roots = [join(homedir(), ".claude", "skills"), join(process.cwd(), "skills")];
+  const items = roots.flatMap(scanSkillsDir);
+  const total = items.reduce((s, i) => s + i.tokens, 0);
+  const over = items.filter((i) => i.tokens > PER_SKILL_THRESHOLD).length;
+  if (total <= TOTAL_THRESHOLD && over === 0) {
+    const msg = `${items.length} skill(s) total ${total} tokens (under 1% / 2000 threshold)`;
+    return { name: "token budget", status: "pass", message: msg };
   }
-  const path = statePath2();
-  await mkdir(dirname(path), { recursive: true });
-  await withLock(async () => {
-    await writeFile(path, JSON.stringify(s, null, 2), "utf8");
-  });
-}
-async function activate(phase, checkpointPath = null) {
-  await writeCurrentWorkflow({
-    schemaVersion: SCHEMA_VERSIONS.currentWorkflow,
-    phase,
-    status: "active",
-    last_checkpoint_path: checkpointPath,
-    started_at: (/* @__PURE__ */ new Date()).toISOString()
-  });
-}
-async function pause() {
-  const s = await readCurrentWorkflow();
-  if (!s) return;
-  await writeCurrentWorkflow({ ...s, status: "paused", paused_at: (/* @__PURE__ */ new Date()).toISOString() });
+  const top = [...items].sort((a, b) => b.tokens - a.tokens).slice(0, 3).map((t2) => `${t2.name}:${t2.tokens}`).join(", ");
+  const pct = (total / CONTEXT_WINDOW_TOKENS * 100).toFixed(2);
+  const message = `${items.length} skill(s) total ${total} tokens (${pct}% of 200000) \u2014 top: ${top}`;
+  return {
+    name: "token budget",
+    status: "warn",
+    message,
+    fix: "shorten verbose skill descriptions OR review per-skill > 5000 tokens"
+  };
 }
-async function complete() {
-  const s = await readCurrentWorkflow();
-  if (!s) return;
-  await writeCurrentWorkflow({ ...s, status: "complete", completed_at: (/* @__PURE__ */ new Date()).toISOString() });
+var CONTEXT_WINDOW_TOKENS, TOTAL_THRESHOLD, PER_SKILL_THRESHOLD;
+var init_check_token_budget = __esm({
+  "src/cli/lib/check-token-budget.ts"() {
+    init_template();
+    CONTEXT_WINDOW_TOKENS = 2e5;
+    TOTAL_THRESHOLD = 2e3;
+    PER_SKILL_THRESHOLD = 5e3;
+  }
+});
+async function checkAgentTeams() {
+  const envValue = process.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+  const envOn = envValue === "1";
+  let settingsValue;
+  let settingsOn = false;
+  try {
+    const path = resolve(homedir(), ".claude", "settings.json");
+    const raw = await readFile(path, "utf8");
+    const data = JSON.parse(raw);
+    settingsValue = data.env?.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
+    settingsOn = settingsValue === "1";
+  } catch {
+  }
+  const detected = { env: envOn, settingsJson: settingsOn };
+  if (envOn || settingsOn) {
+    return { status: "pass", detected, envValue, settingsValue };
+  }
+  return {
+    status: "missing",
+    detected,
+    envValue,
+    settingsValue,
+    remediation: 'Agent Teams not enabled. Add to ~/.claude/settings.json:\n  "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" }\nOR run: claude config set env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS 1\nOR export env var:\n  export CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1\nThen restart Claude Code (CC >= 2.1.133 required).'
+  };
 }
-var WorkflowStateError, LockHeldError;
-var init_state = __esm({
-  "src/checkpoint/state.ts"() {
-    init_harnessedRoot();
-    init_schemaVersion();
-    init_schema();
-    WorkflowStateError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "WorkflowStateError";
-      }
-    };
-    LockHeldError = class _LockHeldError extends Error {
-      constructor() {
-        super(
-          `another harnessed process holds the lock at ${harnessedFile(".lock")} \u2014 wait or kill stale process (try: harnessed status)`
-        );
-        this.name = "LockHeldError";
-        Object.setPrototypeOf(this, _LockHeldError.prototype);
-      }
-    };
+var init_checkAgentTeams = __esm({
+  "src/cli/lib/checkAgentTeams.ts"() {
   }
 });
 
-// src/checkpoint/resume.ts
-var resume_exports = {};
-__export(resume_exports, {
-  runResume: () => runResume
+// src/cli/lib/check-agent-teams-doctor.ts
+var check_agent_teams_doctor_exports = {};
+__export(check_agent_teams_doctor_exports, {
+  checkAgentTeamsDoctor: () => checkAgentTeamsDoctor
 });
-async function runResume() {
-  const current = await readCurrentWorkflow();
-  if (!current) {
-    return {
-      status: "no-paused-phase",
-      error: "no current-workflow.json found under <harnessed-root>"
-    };
-  }
-  if (current.status !== "paused") {
+async function checkAgentTeamsDoctor() {
+  const r = await checkAgentTeams();
+  if (r.status === "pass") {
+    const source = r.detected.env ? "env var" : "settings.json";
     return {
-      status: "no-paused-phase",
-      error: `workflow status is '${current.status}', not 'paused'`
+      name: "Agent Teams env",
+      status: "pass",
+      message: `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 (${source})`
     };
   }
-  if (!current.last_checkpoint_path) {
-    return { status: "corrupt", error: "last_checkpoint_path missing", path: "" };
-  }
-  const path = current.last_checkpoint_path;
-  let raw;
-  try {
-    raw = await readFile(path, "utf8");
-  } catch (e) {
-    return { status: "corrupt", error: `checkpoint missing: ${e.message}`, path };
+  return {
+    name: "Agent Teams env",
+    status: "warn",
+    message: "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS not set (Agent Teams disabled)",
+    fix: r.remediation
+  };
+}
+var init_check_agent_teams_doctor = __esm({
+  "src/cli/lib/check-agent-teams-doctor.ts"() {
+    init_checkAgentTeams();
   }
-  let parsed;
+});
+
+// src/cli/lib/check-planning-with-files.ts
+var check_planning_with_files_exports = {};
+__export(check_planning_with_files_exports, {
+  checkPlanningWithFiles: () => checkPlanningWithFiles
+});
+async function checkPlanningWithFiles() {
+  const root = join(
+    homedir(),
+    ".claude",
+    "plugins",
+    "cache",
+    "planning-with-files",
+    "planning-with-files"
+  );
   try {
-    parsed = JSON.parse(raw);
-  } catch (e) {
+    const entries = await readdir(root);
+    const versions = entries.filter((e) => /^\d+\.\d+/.test(e));
+    if (versions.length > 0) {
+      return {
+        name: "planning-with-files plugin",
+        status: "pass",
+        message: `installed (version ${versions.join(", ")})`
+      };
+    }
     return {
-      status: "corrupt",
-      error: `checkpoint JSON parse failed: ${e.message}`,
-      path
+      name: "planning-with-files plugin",
+      status: "warn",
+      message: "plugin directory exists but no version subdir found",
+      fix: REMEDIATION,
+      install_commands: INSTALL_COMMANDS
+    };
+  } catch {
+    return {
+      name: "planning-with-files plugin",
+      status: "warn",
+      message: "not installed (plugin cache path missing)",
+      fix: REMEDIATION,
+      install_commands: INSTALL_COMMANDS
     };
   }
-  const v = parsed.schemaVersion ?? "";
-  const validated = branchOnSchemaVersion(v, {
-    v1: () => Value.Check(CheckpointV1, parsed) ? parsed : null,
-    unknown: () => null
-  });
-  if (!validated) {
-    const errs = [...Value.Errors(CheckpointV1, parsed)].map((e) => e.message).join("; ");
-    return { status: "corrupt", error: `checkpoint schema validation failed: ${errs}`, path };
-  }
-  const cwd = process.cwd();
-  const cwdWarn = validated.cwd !== cwd ? `\u26A0 checkpoint cwd '${validated.cwd}' \u2260 current cwd '${cwd}' \u2014 SDK session resume may fail (\xA7 1.3); fresh-session fallback` : void 0;
-  const sidHint = validated.session_id ? ` (session_id: ${validated.session_id} \u2014 SDK will redirect to original session)` : " (fresh session \u2014 context reloaded from checkpoint)";
-  const resumeHint = `\u2192 in Claude Code: /gsd-execute-phase ${validated.phase}${sidHint}`;
-  return { status: "ok", checkpoint: validated, ...cwdWarn ? { cwdWarn } : {}, resumeHint };
 }
-var init_resume = __esm({
-  "src/checkpoint/resume.ts"() {
-    init_schemaVersion();
-    init_schema();
-    init_state();
+var REMEDIATION, INSTALL_COMMANDS;
+var init_check_planning_with_files = __esm({
+  "src/cli/lib/check-planning-with-files.ts"() {
+    REMEDIATION = "install via `claude plugin marketplace add OthmanAdi/planning-with-files && claude plugin install planning-with-files` (requires >=2.2.0 per R20.15 + D-15)";
+    INSTALL_COMMANDS = [
+      "claude plugin marketplace add OthmanAdi/planning-with-files",
+      "claude plugin install planning-with-files"
+    ];
   }
 });
 
-// src/cli/lib/auto-install.ts
-var auto_install_exports = {};
-__export(auto_install_exports, {
-  runAutoInstall: () => runAutoInstall
+// src/cli/lib/check-mattpocock-skills.ts
+var check_mattpocock_skills_exports = {};
+__export(check_mattpocock_skills_exports, {
+  checkMattpocockSkills: () => checkMattpocockSkills
 });
-async function runAutoInstall(opts) {
-  const out = { installed: [], skipped: [], failed: [] };
-  if (!opts.autoInstall) {
-    return out;
-  }
-  const results = await Promise.all(CHECKS.map((c) => c()));
-  const installables = results.filter(
-    (r) => r.status === "warn" && Array.isArray(r.install_commands) && r.install_commands.length > 0
-  );
-  if (installables.length === 0) {
-    return out;
-  }
-  console.log(
-    `
-\u{1F4A1} ${installables.length} optional check(s) installable \u2014 harnessed can run install commands now:`
+async function checkMattpocockSkills() {
+  const pluginRoot = join(
+    homedir(),
+    ".claude",
+    "plugins",
+    "cache",
+    "mattpocock-skills",
+    "mattpocock-skills"
   );
-  for (const check of installables) {
-    const commands = check.install_commands;
-    if (opts.nonInteractive) {
-      out.skipped.push(check.name);
-      continue;
-    }
-    const preview = commands.map((c) => `    $ ${c}`).join("\n");
-    console.log(`
-  ${check.name}:`);
-    console.log(preview);
-    const ans = await p.confirm({
-      message: `Run ${commands.length} install command(s) for "${check.name}"?`,
-      initialValue: true
-    });
-    if (p.isCancel(ans) || ans !== true) {
-      out.skipped.push(check.name);
-      continue;
-    }
-    const failureReasons = [];
-    for (const cmd of commands) {
-      const tokens = cmd.split(/\s+/).filter((t2) => t2.length > 0);
-      const exe = tokens[0];
-      const args = tokens.slice(1);
-      if (exe === void 0) {
-        failureReasons.push(`empty command in install_commands`);
-        continue;
-      }
-      const r = spawnSync(exe, args, {
-        encoding: "utf8",
-        stdio: "inherit",
-        // Windows needs shell for `.cmd` / `.bat` exes (npx.cmd / claude.cmd
-        // shims); Unix is fine either way. Pass-through to OS shell handles
-        // PATH resolution + extension lookup.
-        shell: true
-      });
-      if (r.status !== 0) {
-        const reason = r.error !== void 0 ? `spawn error on \`${cmd}\`: ${r.error.message}` : `exit ${r.status ?? "<unknown>"} on \`${cmd}\``;
-        failureReasons.push(reason);
-        console.error(`    \u2717 ${cmd} \u2014 ${reason}`);
-      }
+  const skillRoot = join(homedir(), ".claude", "skills", "mattpocock-skills");
+  try {
+    const entries = await readdir(pluginRoot);
+    const versions = entries.filter((e) => /^\d+\.\d+/.test(e));
+    if (versions.length > 0) {
+      return {
+        name: "mattpocock-skills",
+        status: "pass",
+        message: `installed as plugin (version ${versions.join(", ")})`
+      };
     }
-    if (failureReasons.length === 0) {
-      out.installed.push(check.name);
-      console.log(`  \u2713 installed ${check.name}`);
-    } else if (failureReasons.length === commands.length) {
-      out.failed.push({
-        name: check.name,
-        reason: `all commands failed (${failureReasons.length})`
-      });
-      console.error(`  \u2717 failed ${check.name} \u2014 all ${commands.length} commands failed`);
-    } else {
-      out.failed.push({
-        name: check.name,
-        reason: `partial: ${failureReasons.length}/${commands.length} commands failed`
-      });
-      console.error(
-        `  \u26A0 ${check.name} \u2014 partial: ${failureReasons.length}/${commands.length} commands failed (others succeeded)`
-      );
+  } catch {
+  }
+  try {
+    await stat(skillRoot);
+    return {
+      name: "mattpocock-skills",
+      status: "pass",
+      message: `installed as user-skill (${skillRoot})`
+    };
+  } catch {
+  }
+  const indicators = ["diagnose", "tdd", "zoom-out"];
+  for (const ind of indicators) {
+    const indPath = join(homedir(), ".claude", "skills", ind);
+    try {
+      await stat(indPath);
+      return {
+        name: "mattpocock-skills",
+        status: "pass",
+        message: `installed as individual skills (found ${ind}/)`
+      };
+    } catch {
     }
   }
-  console.log(
-    `
-Auto-install summary: ${out.installed.length} installed / ${out.skipped.length} skipped / ${out.failed.length} failed`
-  );
-  return out;
+  return {
+    name: "mattpocock-skills",
+    status: "warn",
+    message: "not installed (plugin cache + user-skill paths both missing)",
+    fix: REMEDIATION2,
+    install_commands: INSTALL_COMMANDS2
+  };
 }
-var init_auto_install = __esm({
-  "src/cli/lib/auto-install.ts"() {
-    init_doctor_registry();
+var REMEDIATION2, INSTALL_COMMANDS2;
+var init_check_mattpocock_skills = __esm({
+  "src/cli/lib/check-mattpocock-skills.ts"() {
+    REMEDIATION2 = "install via `npx skills@latest add mattpocock/skills` (or git clone https://github.com/mattpocock/skills ~/.claude/skills/mattpocock-skills); methodology fallback already inline in role-prompts.yaml per v3.6.0 Phase 1 \u2014 install is optional but enables /grill-with-docs /zoom-out etc. SlashCommand acceleration";
+    INSTALL_COMMANDS2 = ["npx skills@latest add mattpocock/skills"];
   }
 });
-
-// package.json
-var package_default = {
-  version: "3.9.25"};
-
-// src/manifest/errors.ts
-function instancePathToKeyPath(instancePath) {
-  if (!instancePath || instancePath === "/") return [];
-  return instancePath.split("/").filter(Boolean).map((seg) => {
-    const n = Number(seg);
-    return Number.isInteger(n) && String(n) === seg ? n : seg;
-  });
+function getUserClaudeJsonPath() {
+  return join(homedir(), ".claude.json");
 }
-function locateLineFromDoc(doc, lineCounter, instancePath) {
-  const path = instancePathToKeyPath(instancePath);
-  let node;
-  if (path.length === 0) {
-    node = doc.contents;
-  } else {
-    node = doc.getIn(path, true);
+async function readUserClaudeJson() {
+  const path = getUserClaudeJsonPath();
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return {};
+    throw err2;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object") return {};
+    return parsed;
+  } catch {
+    return {};
   }
-  if (!node || typeof node !== "object") return { line: null, column: null };
-  const range = node.range;
-  if (!range) return { line: null, column: null };
-  const offset = range[0];
-  const pos = lineCounter.linePos(offset);
-  return { line: pos.line, column: pos.col };
 }
-function ajvErrorToFriendly(err2, file, doc, lineCounter) {
-  let path = err2.instancePath || "/";
-  const params = err2.params;
-  if (err2.keyword === "additionalProperties" && params && typeof params.additionalProperty === "string") {
-    path = `${path}/${params.additionalProperty}`;
-  } else if (err2.keyword === "required" && params && typeof params.missingProperty === "string") {
-    path = `${path}/${params.missingProperty}`;
+async function isMcpServerRegistered(name) {
+  const config = await readUserClaudeJson();
+  const servers = config.mcpServers;
+  if (!servers || typeof servers !== "object") return false;
+  return Object.hasOwn(servers, name);
+}
+async function isPluginRegistered(pluginName) {
+  try {
+    const path = join(homedir(), ".claude", "plugins", "installed_plugins.json");
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw);
+    const plugins = parsed.plugins;
+    if (plugins && typeof plugins === "object") {
+      if (Object.hasOwn(plugins, pluginName)) return true;
+      if (Object.keys(plugins).some((k) => k.split("@")[0] === pluginName)) return true;
+    }
+  } catch {
   }
-  let line = null;
-  let column = null;
-  if (doc && lineCounter) {
-    const lookupPath = err2.keyword === "required" ? err2.instancePath || "/" : path;
-    const loc = locateLineFromDoc(doc, lineCounter, lookupPath);
-    line = loc.line;
-    column = loc.column;
+  for (const path of [
+    join(homedir(), ".claude", "settings.json"),
+    join(homedir(), ".claude.json")
+  ]) {
+    try {
+      const raw = await readFile(path, "utf8");
+      const parsed = JSON.parse(raw);
+      const plugins = parsed.enabledPlugins;
+      if (plugins && typeof plugins === "object") {
+        if (Object.hasOwn(plugins, pluginName)) return true;
+        if (Object.keys(plugins).some((k) => k.split("@")[0] === pluginName)) return true;
+      }
+    } catch {
+    }
   }
-  return {
-    file,
-    path,
-    message: err2.message ?? "unknown error",
-    line,
-    column,
-    keyword: err2.keyword
-  };
-}
-function yamlParseErrorToFriendly(err2, file) {
-  return {
-    file,
-    path: "/",
-    message: err2.message,
-    line: err2.linePos?.[0]?.line ?? null,
-    column: err2.linePos?.[0]?.col ?? null,
-    keyword: "yaml-parse"
-  };
+  return false;
 }
-var ApiVersion = Type.Literal("harnessed/v1");
-var Kind = Type.Literal("Manifest");
-var SpdxLicense = Type.Union([
-  Type.Literal("MIT"),
-  Type.Literal("Apache-2.0"),
-  Type.Literal("BSD-3-Clause"),
-  Type.Literal("ISC"),
-  Type.Literal("0BSD"),
-  Type.Literal("MIT-0"),
-  Type.Literal("anthropics-official")
-]);
+var init_readClaudeConfig = __esm({
+  "src/installers/lib/readClaudeConfig.ts"() {
+  }
+});
+
+// src/cli/lib/check-mcp-availability.ts
+var check_mcp_availability_exports = {};
+__export(check_mcp_availability_exports, {
+  checkMcpAvailability: () => checkMcpAvailability
+});
+async function checkMcpAvailability() {
+  const installed = [];
+  const missing = [];
+  for (const s of TARGET_SERVERS) {
+    const present = await isMcpServerRegistered(s);
+    if (present) {
+      installed.push(s);
+    } else {
+      missing.push(s);
+    }
+  }
+  if (missing.length === 0) {
+    return {
+      name: "MCP servers (tavily/exa/chrome-devtools)",
+      status: "pass",
+      message: `all 3 installed: ${installed.join(", ")}`
+    };
+  }
+  if (installed.length === 0) {
+    return {
+      name: "MCP servers (tavily/exa/chrome-devtools)",
+      status: "warn",
+      message: "none of 3 target MCP servers registered in ~/.claude.json",
+      fix: "run `harnessed setup` to install via Step B (manifests/tools/{tavily,exa,chrome-devtools}-mcp.yaml)"
+    };
+  }
+  return {
+    name: "MCP servers (tavily/exa/chrome-devtools)",
+    status: "warn",
+    message: `${installed.length}/3 installed: ${installed.join(", ")}; missing: ${missing.join(", ")}`,
+    fix: "run `harnessed setup` to install missing MCPs via Step B"
+  };
+}
+var TARGET_SERVERS;
+var init_check_mcp_availability = __esm({
+  "src/cli/lib/check-mcp-availability.ts"() {
+    init_readClaudeConfig();
+    TARGET_SERVERS = ["tavily-mcp", "exa-mcp", "chrome-devtools-mcp"];
+  }
+});
+
+// src/cli/lib/doctor-registry.ts
+var CHECKS;
+var init_doctor_registry = __esm({
+  "src/cli/lib/doctor-registry.ts"() {
+    init_check_builtin();
+    CHECKS = [
+      async () => checkNodeVersion(),
+      checkMcpScope,
+      async () => checkJq(),
+      async () => checkWinBash(),
+      async () => {
+        const { checkOrigin: checkOrigin2 } = await Promise.resolve().then(() => (init_origin_check(), origin_check_exports));
+        const r = checkOrigin2(process.cwd(), { allowFork: true });
+        return { name: "origin URL", status: r.status, message: r.detail, fix: r.fix };
+      },
+      async () => {
+        const { probeGstackPrefix: probeGstackPrefix2 } = await Promise.resolve().then(() => (init_probe_gstack(), probe_gstack_exports));
+        const r = probeGstackPrefix2();
+        return { name: "gstack prefix", status: r.status, message: r.detail, fix: r.fix };
+      },
+      async () => (await Promise.resolve().then(() => (init_check_deprecations(), check_deprecations_exports))).checkDeprecations(),
+      async () => (await Promise.resolve().then(() => (init_check_token_budget(), check_token_budget_exports))).checkTokenBudget(),
+      async () => (await Promise.resolve().then(() => (init_check_agent_teams_doctor(), check_agent_teams_doctor_exports))).checkAgentTeamsDoctor(),
+      async () => (await Promise.resolve().then(() => (init_check_planning_with_files(), check_planning_with_files_exports))).checkPlanningWithFiles(),
+      async () => (await Promise.resolve().then(() => (init_check_mattpocock_skills(), check_mattpocock_skills_exports))).checkMattpocockSkills(),
+      async () => (await Promise.resolve().then(() => (init_check_mcp_availability(), check_mcp_availability_exports))).checkMcpAvailability()
+    ];
+  }
+});
+var PinnedUpstream, KnownGoodV1;
+var init_known_good_v1 = __esm({
+  "src/manifest/schema/known-good.v1.ts"() {
+    init_schemaVersion();
+    PinnedUpstream = Type.Object(
+      {
+        name: Type.String({ minLength: 1 }),
+        version: Type.String({ minLength: 1 }),
+        install_method: Type.String({ minLength: 1 })
+        // npm-cli / mcp-stdio-add / etc per Phase 2.X
+      },
+      { additionalProperties: false }
+    );
+    KnownGoodV1 = Type.Object(
+      {
+        schemaVersion: Type.Literal(SCHEMA_VERSIONS.knownGood),
+        // 'harnessed.known-good.v1'
+        harnessed_version: Type.String({ pattern: "^\\d+\\.\\d+\\.\\d+$" }),
+        // semver strict
+        e2e_verified_at: Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" }),
+        // ISO date pattern
+        upstreams: Type.Array(PinnedUpstream)
+      },
+      { additionalProperties: false }
+    );
+  }
+});
+
+// src/manifest/knownGood.ts
+var knownGood_exports = {};
+__export(knownGood_exports, {
+  getPinnedVersion: () => getPinnedVersion,
+  loadKnownGood: () => loadKnownGood
+});
+function loadKnownGood(harnessedVer) {
+  if (_cache.has(harnessedVer)) return _cache.get(harnessedVer) ?? null;
+  const path = join(versionsDir(), `${harnessedVer}-known-good.yaml`);
+  if (!existsSync(path)) {
+    _cache.set(harnessedVer, null);
+    return null;
+  }
+  const raw = readFileSync(path, "utf8");
+  const parsed = parse(raw);
+  if (!Value.Check(KnownGoodV1, parsed)) {
+    const errs = [...Value.Errors(KnownGoodV1, parsed)].slice(0, 3);
+    throw new Error(
+      `${path} schema invalid: ${errs.map((e) => `${e.path} ${e.message}`).join("; ")}`
+    );
+  }
+  _cache.set(harnessedVer, parsed);
+  return parsed;
+}
+function getPinnedVersion(upstreamName, harnessedVer) {
+  const kg = loadKnownGood(harnessedVer);
+  if (!kg) return null;
+  const entry = kg.upstreams.find((u) => u.name === upstreamName);
+  return entry?.version ?? null;
+}
+var versionsDir, _cache;
+var init_knownGood = __esm({
+  "src/manifest/knownGood.ts"() {
+    init_known_good_v1();
+    versionsDir = () => join(process.cwd(), "versions");
+    _cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/checkpoint/resume.ts
+var resume_exports = {};
+__export(resume_exports, {
+  runResume: () => runResume
+});
+async function runResume() {
+  const current = await readCurrentWorkflow();
+  if (!current) {
+    return {
+      status: "no-paused-phase",
+      error: "no current-workflow.json found under <harnessed-root>"
+    };
+  }
+  if (current.status !== "paused") {
+    return {
+      status: "no-paused-phase",
+      error: `workflow status is '${current.status}', not 'paused'`
+    };
+  }
+  if (!current.last_checkpoint_path) {
+    return { status: "corrupt", error: "last_checkpoint_path missing", path: "" };
+  }
+  const path = current.last_checkpoint_path;
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (e) {
+    return { status: "corrupt", error: `checkpoint missing: ${e.message}`, path };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return {
+      status: "corrupt",
+      error: `checkpoint JSON parse failed: ${e.message}`,
+      path
+    };
+  }
+  const v = parsed.schemaVersion ?? "";
+  const validated = branchOnSchemaVersion(v, {
+    v1: () => Value.Check(CheckpointV1, parsed) ? parsed : null,
+    unknown: () => null
+  });
+  if (!validated) {
+    const errs = [...Value.Errors(CheckpointV1, parsed)].map((e) => e.message).join("; ");
+    return { status: "corrupt", error: `checkpoint schema validation failed: ${errs}`, path };
+  }
+  const cwd = process.cwd();
+  const cwdWarn = validated.cwd !== cwd ? `\u26A0 checkpoint cwd '${validated.cwd}' \u2260 current cwd '${cwd}' \u2014 SDK session resume may fail (\xA7 1.3); fresh-session fallback` : void 0;
+  const sidHint = validated.session_id ? ` (session_id: ${validated.session_id} \u2014 SDK will redirect to original session)` : " (fresh session \u2014 context reloaded from checkpoint)";
+  const resumeHint = `\u2192 in Claude Code: /gsd-execute-phase ${validated.phase}${sidHint}`;
+  return { status: "ok", checkpoint: validated, ...cwdWarn ? { cwdWarn } : {}, resumeHint };
+}
+var init_resume = __esm({
+  "src/checkpoint/resume.ts"() {
+    init_schemaVersion();
+    init_schema();
+    init_state();
+  }
+});
+
+// src/cli/lib/auto-install.ts
+var auto_install_exports = {};
+__export(auto_install_exports, {
+  runAutoInstall: () => runAutoInstall
+});
+async function runAutoInstall(opts) {
+  const out = { installed: [], skipped: [], failed: [] };
+  if (!opts.autoInstall) {
+    return out;
+  }
+  const results = await Promise.all(CHECKS.map((c) => c()));
+  const installables = results.filter(
+    (r) => r.status === "warn" && Array.isArray(r.install_commands) && r.install_commands.length > 0
+  );
+  if (installables.length === 0) {
+    return out;
+  }
+  console.log(
+    `
+\u{1F4A1} ${installables.length} optional check(s) installable \u2014 harnessed can run install commands now:`
+  );
+  for (const check of installables) {
+    const commands = check.install_commands;
+    if (opts.nonInteractive) {
+      out.skipped.push(check.name);
+      continue;
+    }
+    const preview = commands.map((c) => `    $ ${c}`).join("\n");
+    console.log(`
+  ${check.name}:`);
+    console.log(preview);
+    const ans = await p.confirm({
+      message: `Run ${commands.length} install command(s) for "${check.name}"?`,
+      initialValue: true
+    });
+    if (p.isCancel(ans) || ans !== true) {
+      out.skipped.push(check.name);
+      continue;
+    }
+    const failureReasons = [];
+    for (const cmd of commands) {
+      const tokens = cmd.split(/\s+/).filter((t2) => t2.length > 0);
+      const exe = tokens[0];
+      const args = tokens.slice(1);
+      if (exe === void 0) {
+        failureReasons.push(`empty command in install_commands`);
+        continue;
+      }
+      const r = spawnSync(exe, args, {
+        encoding: "utf8",
+        stdio: "inherit",
+        // Windows needs shell for `.cmd` / `.bat` exes (npx.cmd / claude.cmd
+        // shims); Unix is fine either way. Pass-through to OS shell handles
+        // PATH resolution + extension lookup.
+        shell: true
+      });
+      if (r.status !== 0) {
+        const reason = r.error !== void 0 ? `spawn error on \`${cmd}\`: ${r.error.message}` : `exit ${r.status ?? "<unknown>"} on \`${cmd}\``;
+        failureReasons.push(reason);
+        console.error(`    \u2717 ${cmd} \u2014 ${reason}`);
+      }
+    }
+    if (failureReasons.length === 0) {
+      out.installed.push(check.name);
+      console.log(`  \u2713 installed ${check.name}`);
+    } else if (failureReasons.length === commands.length) {
+      out.failed.push({
+        name: check.name,
+        reason: `all commands failed (${failureReasons.length})`
+      });
+      console.error(`  \u2717 failed ${check.name} \u2014 all ${commands.length} commands failed`);
+    } else {
+      out.failed.push({
+        name: check.name,
+        reason: `partial: ${failureReasons.length}/${commands.length} commands failed`
+      });
+      console.error(
+        `  \u26A0 ${check.name} \u2014 partial: ${failureReasons.length}/${commands.length} commands failed (others succeeded)`
+      );
+    }
+  }
+  console.log(
+    `
+Auto-install summary: ${out.installed.length} installed / ${out.skipped.length} skipped / ${out.failed.length} failed`
+  );
+  return out;
+}
+var init_auto_install = __esm({
+  "src/cli/lib/auto-install.ts"() {
+    init_doctor_registry();
+  }
+});
+
+// package.json
+var package_default = {
+  version: "4.0.0"};
+
+// src/manifest/errors.ts
+function instancePathToKeyPath(instancePath) {
+  if (!instancePath || instancePath === "/") return [];
+  return instancePath.split("/").filter(Boolean).map((seg) => {
+    const n = Number(seg);
+    return Number.isInteger(n) && String(n) === seg ? n : seg;
+  });
+}
+function locateLineFromDoc(doc, lineCounter, instancePath) {
+  const path = instancePathToKeyPath(instancePath);
+  let node;
+  if (path.length === 0) {
+    node = doc.contents;
+  } else {
+    node = doc.getIn(path, true);
+  }
+  if (!node || typeof node !== "object") return { line: null, column: null };
+  const range = node.range;
+  if (!range) return { line: null, column: null };
+  const offset = range[0];
+  const pos = lineCounter.linePos(offset);
+  return { line: pos.line, column: pos.col };
+}
+function ajvErrorToFriendly(err2, file, doc, lineCounter) {
+  let path = err2.instancePath || "/";
+  const params = err2.params;
+  if (err2.keyword === "additionalProperties" && params && typeof params.additionalProperty === "string") {
+    path = `${path}/${params.additionalProperty}`;
+  } else if (err2.keyword === "required" && params && typeof params.missingProperty === "string") {
+    path = `${path}/${params.missingProperty}`;
+  }
+  let line = null;
+  let column = null;
+  if (doc && lineCounter) {
+    const lookupPath = err2.keyword === "required" ? err2.instancePath || "/" : path;
+    const loc = locateLineFromDoc(doc, lineCounter, lookupPath);
+    line = loc.line;
+    column = loc.column;
+  }
+  return {
+    file,
+    path,
+    message: err2.message ?? "unknown error",
+    line,
+    column,
+    keyword: err2.keyword
+  };
+}
+function yamlParseErrorToFriendly(err2, file) {
+  return {
+    file,
+    path: "/",
+    message: err2.message,
+    line: err2.linePos?.[0]?.line ?? null,
+    column: err2.linePos?.[0]?.col ?? null,
+    keyword: "yaml-parse"
+  };
+}
+var ApiVersion = Type.Literal("harnessed/v1");
+var Kind = Type.Literal("Manifest");
+var SpdxLicense = Type.Union([
+  Type.Literal("MIT"),
+  Type.Literal("Apache-2.0"),
+  Type.Literal("BSD-3-Clause"),
+  Type.Literal("ISC"),
+  Type.Literal("0BSD"),
+  Type.Literal("MIT-0"),
+  Type.Literal("anthropics-official")
+]);
 var LicenseSource = Type.Union([
   Type.Literal("README"),
   Type.Literal("registry"),
@@ -2082,7 +2122,7 @@ function renderHumanTable(records) {
   }
 }
 function pipeToJq(filterExpr, lines) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve16, reject) => {
     const child = spawn("jq", [filterExpr], {
       stdio: ["pipe", "inherit", "inherit"],
       windowsHide: true
@@ -2091,249 +2131,610 @@ function pipeToJq(filterExpr, lines) {
       const e = err2;
       if (e.code === "ENOENT") {
         console.error(t("audit_log.jq_missing"));
-        resolve14(1);
+        resolve16(1);
       } else {
         reject(err2);
       }
     });
-    child.on("close", (code) => resolve14(code ?? 0));
-    child.stdin.write(lines.join("\n"));
-    child.stdin.end();
+    child.on("close", (code) => resolve16(code ?? 0));
+    child.stdin.write(lines.join("\n"));
+    child.stdin.end();
+  });
+}
+function registerAuditLog(program2) {
+  program2.command("audit-log").description(
+    "Query routing audit log (<harnessed-root>/audit.log) with optional jq filter (R10.1)"
+  ).option("--filter <expr>", `jq filter expression (e.g. '.category=="engineering"')`).option("--tail <n>", "show N most recent records (default 50)", "50").option("--head <n>", "show N oldest records (--head takes priority over --tail)").option("--reverse", "flip output order").option("--json", "output full 12-field JSON instead of human table").action(
+    async (opts) => {
+      const tailN = opts.tail !== void 0 ? Number(opts.tail) : 50;
+      if (Number.isNaN(tailN) || tailN < 1) {
+        console.error(t("audit_log.tail_invalid"));
+        process.exit(2);
+      }
+      const headN = opts.head !== void 0 ? Number(opts.head) : void 0;
+      if (headN !== void 0 && (Number.isNaN(headN) || headN < 1)) {
+        console.error(t("audit_log.head_invalid"));
+        process.exit(2);
+      }
+      const path = auditPath();
+      if (!existsSync(path)) {
+        console.log(t("audit_log.no_records_file", { path }));
+        process.exit(0);
+      }
+      const raw = readFileSync(path, "utf8");
+      const lines = raw.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+      if (lines.length === 0) {
+        console.log(t("audit_log.no_records_empty"));
+        process.exit(0);
+      }
+      let records = [];
+      for (const line of lines) {
+        try {
+          records.push(JSON.parse(line));
+        } catch {
+        }
+      }
+      if (headN !== void 0) {
+        records = records.slice(0, headN);
+      } else {
+        records = records.slice(-tailN);
+      }
+      if (opts.reverse) records = records.reverse();
+      records = records.map(redactRecord);
+      if (opts.filter) {
+        const redactedLines = records.map((r) => JSON.stringify(r));
+        const exitCode = await pipeToJq(opts.filter, redactedLines);
+        process.exit(exitCode);
+      }
+      if (opts.json) {
+        for (const r of records) {
+          console.log(JSON.stringify(r, null, 2));
+        }
+      } else {
+        renderHumanTable(records);
+      }
+      process.exit(0);
+    }
+  );
+}
+
+// src/installers/lib/backup.ts
+init_harnessedRoot();
+function getBackupRoot() {
+  return harnessedSubdir("backups");
+}
+var HOME_DIR = process.env.HOME ?? process.env.USERPROFILE ?? "";
+function mirrorPath(target, scope, backupDir) {
+  const root = scope === "HOME" ? HOME_DIR : ".";
+  const rel = root ? relative(root, target) : target;
+  if (!rel || rel.startsWith("..")) {
+    const flat = createHash("sha1").update(target).digest("hex").slice(0, 16);
+    return join(backupDir, scope, flat);
+  }
+  return join(backupDir, scope, rel);
+}
+function detectEol(buf) {
+  return buf.includes("\r\n") ? "crlf" : "lf";
+}
+async function backup(plan, ctx) {
+  const filename = ctx.manifest.metadata.name;
+  const backupId = (/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-");
+  const backupDir = join(getBackupRoot(), backupId);
+  try {
+    await mkdir(backupDir, { recursive: true });
+  } catch (err2) {
+    return {
+      ok: false,
+      error: {
+        file: filename,
+        path: "/",
+        message: `failed to create backup dir ${backupDir}: ${err2.message}`,
+        line: null,
+        column: null,
+        keyword: "backup-mkdir-failed"
+      }
+    };
+  }
+  const entries = [];
+  for (const file of plan.files) {
+    let buf;
+    try {
+      buf = await readFile(file.target);
+    } catch (err2) {
+      const code = err2.code;
+      if (code === "ENOENT" && file.oldText === "") {
+        entries.push({
+          target: file.target,
+          backup: "",
+          // sentinel: no backup written; rollback should unlink target
+          sha1: "",
+          eol: "lf"
+          // moot for non-existent file; default to lf
+        });
+        continue;
+      }
+      return {
+        ok: false,
+        error: {
+          file: filename,
+          path: file.target,
+          message: `failed to read original file for backup: ${err2.message}`,
+          line: null,
+          column: null,
+          keyword: "backup-read-failed"
+        }
+      };
+    }
+    const sha1 = createHash("sha1").update(buf).digest("hex");
+    const eol = detectEol(buf);
+    const dest = mirrorPath(file.target, file.scope, backupDir);
+    try {
+      await mkdir(dirname(dest), { recursive: true });
+      await writeFile(dest, buf);
+    } catch (err2) {
+      return {
+        ok: false,
+        error: {
+          file: filename,
+          path: dest,
+          message: `failed to write backup copy: ${err2.message}`,
+          line: null,
+          column: null,
+          keyword: "backup-write-failed"
+        }
+      };
+    }
+    entries.push({ target: file.target, backup: dest, sha1, eol });
+  }
+  const metadata = {
+    installer: filename,
+    manifest: filename,
+    timestamp: backupId,
+    files: entries
+  };
+  const metadataPath = join(backupDir, "metadata.json");
+  try {
+    await writeFile(metadataPath, `${JSON.stringify(metadata, null, 2)}
+`, "utf8");
+  } catch (err2) {
+    return {
+      ok: false,
+      error: {
+        file: filename,
+        path: metadataPath,
+        message: `failed to write metadata.json: ${err2.message}`,
+        line: null,
+        column: null,
+        keyword: "backup-metadata-failed"
+      }
+    };
+  }
+  return { ok: true, backupId, backupDir };
+}
+
+// src/cli/backup-list.ts
+function registerBackupList(program2) {
+  const backup2 = program2.command("backup").description("Backup snapshot operations");
+  backup2.command("list").description("List backup snapshots under .harnessed-backup/").action(async () => {
+    const root = getBackupRoot();
+    let dirs;
+    try {
+      dirs = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+    } catch {
+      console.log(t("backup.no_backups", { root }));
+      return;
+    }
+    if (dirs.length === 0) {
+      console.log(t("backup.no_backups_empty", { root }));
+      return;
+    }
+    for (const ts of dirs) {
+      try {
+        const meta = JSON.parse(
+          await readFile(join(root, ts, "metadata.json"), "utf8")
+        );
+        console.log(
+          `${ts}  ${meta.manifest}  (${meta.files.length} file${meta.files.length === 1 ? "" : "s"})`
+        );
+      } catch {
+        console.log(`${ts}  (metadata.json missing or unreadable)`);
+      }
+    }
+    console.log(t("backup.total_snapshots", { count: dirs.length }));
+  });
+}
+
+// src/cli/checkpoint.ts
+var ACTIONS = ["start", "complete", "fail"];
+function isAction(a) {
+  return ACTIONS.includes(a);
+}
+function registerCheckpoint(program2) {
+  program2.command("checkpoint <action> <sub>").description(
+    "Record workflow progress: start | complete | fail <sub-workflow> (writes to ~/.claude/harnessed/checkpoints/)"
+  ).option("--summary <text>", "short summary stored as the checkpoint lastTask").action(async (action, sub, opts) => {
+    if (!isAction(action)) {
+      console.error(
+        `[harnessed] checkpoint: unknown action "${action}" \u2014 expected one of ${ACTIONS.join(", ")}`
+      );
+      process.exit(1);
+      return;
+    }
+    const { activatePhase: activatePhase2, completePhase: completePhase2 } = await Promise.resolve().then(() => (init_engineHook(), engineHook_exports));
+    if (action === "start") {
+      const { checkpointPath } = await activatePhase2(sub);
+      console.log(`[harnessed] checkpoint started: ${sub} \u2192 ${checkpointPath}`);
+      process.exit(0);
+      return;
+    }
+    if (action === "complete") {
+      await completePhase2({
+        phaseId: sub,
+        status: "complete",
+        lastTask: opts.summary ?? `phase ${sub} complete`
+      });
+      console.log(`[harnessed] checkpoint complete: ${sub}`);
+      process.exit(0);
+      return;
+    }
+    await completePhase2({
+      phaseId: sub,
+      status: "complete",
+      lastTask: `FAILED: ${opts.summary ?? ""}`
+    });
+    console.error(
+      `[harnessed] checkpoint FAILED recorded: ${sub}${opts.summary ? ` \u2014 ${opts.summary}` : ""}`
+    );
+    process.exit(1);
   });
 }
-function registerAuditLog(program2) {
-  program2.command("audit-log").description(
-    "Query routing audit log (<harnessed-root>/audit.log) with optional jq filter (R10.1)"
-  ).option("--filter <expr>", `jq filter expression (e.g. '.category=="engineering"')`).option("--tail <n>", "show N most recent records (default 50)", "50").option("--head <n>", "show N oldest records (--head takes priority over --tail)").option("--reverse", "flip output order").option("--json", "output full 12-field JSON instead of human table").action(
-    async (opts) => {
-      const tailN = opts.tail !== void 0 ? Number(opts.tail) : 50;
-      if (Number.isNaN(tailN) || tailN < 1) {
-        console.error(t("audit_log.tail_invalid"));
-        process.exit(2);
-      }
-      const headN = opts.head !== void 0 ? Number(opts.head) : void 0;
-      if (headN !== void 0 && (Number.isNaN(headN) || headN < 1)) {
-        console.error(t("audit_log.head_invalid"));
-        process.exit(2);
-      }
-      const path = auditPath();
-      if (!existsSync(path)) {
-        console.log(t("audit_log.no_records_file", { path }));
-        process.exit(0);
-      }
-      const raw = readFileSync(path, "utf8");
-      const lines = raw.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-      if (lines.length === 0) {
-        console.log(t("audit_log.no_records_empty"));
-        process.exit(0);
-      }
-      let records = [];
-      for (const line of lines) {
-        try {
-          records.push(JSON.parse(line));
-        } catch {
-        }
-      }
-      if (headN !== void 0) {
-        records = records.slice(0, headN);
-      } else {
-        records = records.slice(-tailN);
-      }
-      if (opts.reverse) records = records.reverse();
-      records = records.map(redactRecord);
-      if (opts.filter) {
-        const redactedLines = records.map((r) => JSON.stringify(r));
-        const exitCode = await pipeToJq(opts.filter, redactedLines);
-        process.exit(exitCode);
-      }
-      if (opts.json) {
-        for (const r of records) {
-          console.log(JSON.stringify(r, null, 2));
-        }
-      } else {
-        renderHumanTable(records);
+
+// src/cli/doctor.ts
+init_doctor_registry();
+function registerDoctor(program2) {
+  program2.command("doctor").description(
+    "Preflight checks (Node / MCP scope / jq / Win bash / origin URL / gstack prefix / deprecations / token budget / Agent Teams / planning-with-files / mattpocock-skills / MCP availability)"
+  ).option("--json", "output JSON instead of human-readable").action(async (opts) => {
+    const results = await Promise.all(CHECKS.map((c) => c()));
+    const hasFail = results.some((r) => r.status === "fail");
+    const hasWarn = results.some((r) => r.status === "warn");
+    if (opts.json) {
+      console.log(
+        JSON.stringify(
+          { checks: results, summary: hasFail ? "fail" : hasWarn ? "warn" : "pass" },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const r of results) {
+        const mark = r.status === "pass" ? "\u2713" : r.status === "warn" ? "\u26A0" : "\u2717";
+        console.log(`${mark} ${r.name} \u2014 ${r.message}`);
+        if (r.status !== "pass" && r.fix) console.log(`    fix: ${r.fix}`);
       }
-      process.exit(0);
+      console.log(
+        hasFail ? t("doctor.summary.fail") : hasWarn ? t("doctor.summary.warn") : t("doctor.summary.pass")
+      );
     }
-  );
+    process.exit(hasFail ? 1 : 0);
+  });
+}
+var PARSER_OPTIONS = {
+  operators: {
+    add: false,
+    subtract: false,
+    multiply: false,
+    divide: false,
+    logical: true,
+    comparison: true,
+    in: true,
+    assignment: false
+  }
+};
+var _parserSingleton = new Parser(PARSER_OPTIONS);
+var GateEvalError = class extends Error {
+  constructor(message, expression) {
+    super(message);
+    this.expression = expression;
+    this.name = "GateEvalError";
+  }
+  expression;
+};
+function evalGate(expression, context) {
+  try {
+    const parsed = _parserSingleton.parse(expression);
+    const result = parsed.evaluate(context);
+    if (typeof result !== "boolean") {
+      throw new GateEvalError(
+        `Expression must evaluate to boolean, got ${typeof result}`,
+        expression
+      );
+    }
+    return result;
+  } catch (err2) {
+    if (err2 instanceof GateEvalError) throw err2;
+    throw new GateEvalError(`Gate eval failed: ${err2.message}`, expression);
+  }
 }
 
-// src/installers/lib/backup.ts
-init_harnessedRoot();
-function getBackupRoot() {
-  return harnessedSubdir("backups");
+// src/workflow/schema/judgment.ts
+init_schemaVersion();
+var TriggerInvocation = Type.Object(
+  {
+    capability: Type.String()
+  },
+  { additionalProperties: false }
+);
+var RequiresCapabilities = Type.Object(
+  {
+    capabilities: Type.Array(Type.String())
+  },
+  { additionalProperties: false }
+);
+var JudgmentTrigger = Type.Object(
+  {
+    description: Type.Optional(Type.String()),
+    fires_when: Type.Optional(Type.String()),
+    skips_when: Type.Optional(Type.String()),
+    invokes: Type.Optional(Type.Array(TriggerInvocation)),
+    requires: Type.Optional(RequiresCapabilities),
+    wraps: Type.Optional(Type.Array(Type.String()))
+  },
+  { additionalProperties: false }
+);
+var FallbackRule = Type.Object(
+  {
+    description: Type.Optional(Type.String()),
+    fallback_action: Type.Optional(Type.String()),
+    message_template: Type.Optional(Type.String()),
+    override_signal: Type.Optional(Type.Array(Type.String())),
+    chain_isolation: Type.Optional(Type.Boolean())
+  },
+  { additionalProperties: false }
+);
+var JudgmentTriggersFile = Type.Object(
+  {
+    schema_version: Type.Literal(SCHEMA_VERSIONS.judgment),
+    triggers: Type.Record(Type.String(), JudgmentTrigger)
+  },
+  { additionalProperties: false }
+);
+var JudgmentRulesFile = Type.Object(
+  {
+    schema_version: Type.Literal(SCHEMA_VERSIONS.judgment),
+    rules: Type.Record(Type.String(), FallbackRule)
+  },
+  { additionalProperties: false }
+);
+Type.Union([JudgmentTriggersFile, JudgmentRulesFile]);
+var UserOverrideEntry = Type.Object(
+  {
+    id: Type.String({ minLength: 1 }),
+    // kebab-case (e.g. 'brainstorm', 'arch-review')
+    keywords: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+    triggers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })
+  },
+  { additionalProperties: false }
+);
+var UserOverridesFile = Type.Object(
+  {
+    schema_version: Type.Literal("harnessed.user-overrides.v1"),
+    overrides: Type.Array(UserOverrideEntry, { minItems: 1 })
+  },
+  { additionalProperties: false }
+);
+
+// src/workflow/judgmentResolver.ts
+var TriggerNotFoundError = class extends Error {
+  constructor(trigger, fileName) {
+    super(`Trigger '${trigger}' not found in judgments/${fileName}.yaml`);
+    this.trigger = trigger;
+    this.fileName = fileName;
+    this.name = "TriggerNotFoundError";
+  }
+  trigger;
+  fileName;
+};
+var _fileCache = /* @__PURE__ */ new Map();
+async function resolveJudgmentGate(gateRef, context, packageRoot) {
+  const userOverrides = context.user_overrides;
+  if (Array.isArray(userOverrides) && userOverrides.includes(gateRef)) {
+    return true;
+  }
+  const parts = gateRef.split(".");
+  if (parts.length !== 4 || parts[0] !== "judgments") {
+    throw new Error(`Invalid gate ref: ${gateRef}`);
+  }
+  const [, fileName, triggerName, fieldName] = parts;
+  let parsed = _fileCache.get(fileName);
+  if (!parsed) {
+    const yamlPath = resolve(packageRoot, "workflows", "judgments", `${fileName}.yaml`);
+    const raw = await readFile(yamlPath, "utf8");
+    const parsedRaw = parse(raw);
+    const schema = fileName === "fallback" ? JudgmentRulesFile : JudgmentTriggersFile;
+    if (!Value.Check(schema, parsedRaw)) {
+      const errors = [...Value.Errors(schema, parsedRaw)].slice(0, 3).map((e) => `${e.path} ${e.message}`).join("; ");
+      throw new Error(`Invalid judgment file ${fileName}.yaml: ${errors}`);
+    }
+    parsed = parsedRaw;
+    _fileCache.set(fileName, parsed);
+  }
+  const entries = "triggers" in parsed ? parsed.triggers : parsed.rules;
+  const trigger = entries[triggerName];
+  if (!trigger) {
+    throw new TriggerNotFoundError(triggerName, fileName);
+  }
+  const expr = fieldName === "fires" ? trigger.fires_when : fieldName === "skips" ? trigger.skips_when : void 0;
+  if (!expr) {
+    throw new Error(
+      `Field '${fieldName}' has no expression in trigger '${triggerName}' of ${fileName}.yaml`
+    );
+  }
+  return evalGate(expr, context);
 }
-var HOME_DIR = process.env.HOME ?? process.env.USERPROFILE ?? "";
-function mirrorPath(target, scope, backupDir) {
-  const root = scope === "HOME" ? HOME_DIR : ".";
-  const rel = root ? relative(root, target) : target;
-  if (!rel || rel.startsWith("..")) {
-    const flat = createHash("sha1").update(target).digest("hex").slice(0, 16);
-    return join(backupDir, scope, flat);
+function getPackageRoot() {
+  const thisFile = fileURLToPath(import.meta.url);
+  const thisDir = dirname(thisFile);
+  if (thisDir.endsWith("dist") || thisDir.replace(/\\/g, "/").endsWith("/dist")) {
+    return resolve(thisDir, "..");
   }
-  return join(backupDir, scope, rel);
+  return resolve(thisDir, "..", "..", "..");
 }
-function detectEol(buf) {
-  return buf.includes("\r\n") ? "crlf" : "lf";
+
+// src/cli/gates.ts
+var VALID_MASTERS = /* @__PURE__ */ new Set(["auto", "discuss", "plan", "task", "verify"]);
+var PARALLELISM_GATE = "judgments.parallelism-gate.agent-teams-upgrade.fires";
+function defaultContext(task, stage) {
+  return {
+    task,
+    user_understanding_unclear: false,
+    phase: {
+      stage,
+      is_critical_module: true,
+      is_final_step: true,
+      is_major_release: false,
+      has_auth_or_secrets: false,
+      has_design_changes: false,
+      has_ui_changes: false,
+      requires_creative_polish: false,
+      is_complex_architecture: true,
+      has_cross_phase_data_flow: true,
+      open_decisions: 2,
+      scope_days: 2,
+      scope_locked_in_history: false,
+      single_task: false,
+      type: "general"
+    },
+    subtask: {
+      approaches: 2,
+      core_algorithm: true,
+      has_api_contract: true,
+      error_cost: "high",
+      lines: 50,
+      type: "general",
+      is_core_business_logic: true,
+      is_algorithm: true,
+      is_data_processing: true,
+      regression_risk: "high",
+      reliability_required: true,
+      communication_needed: false,
+      needs_lib_docs: false,
+      needs_web_search: false,
+      parallel_count: 1,
+      search_type: "general",
+      test_type: "general"
+    }
+  };
 }
-async function backup(plan, ctx) {
-  const filename = ctx.manifest.metadata.name;
-  const backupId = (/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-");
-  const backupDir = join(getBackupRoot(), backupId);
-  try {
-    await mkdir(backupDir, { recursive: true });
-  } catch (err2) {
-    return {
-      ok: false,
-      error: {
-        file: filename,
-        path: "/",
-        message: `failed to create backup dir ${backupDir}: ${err2.message}`,
-        line: null,
-        column: null,
-        keyword: "backup-mkdir-failed"
-      }
-    };
-  }
-  const entries = [];
-  for (const file of plan.files) {
-    let buf;
-    try {
-      buf = await readFile(file.target);
-    } catch (err2) {
-      const code = err2.code;
-      if (code === "ENOENT" && file.oldText === "") {
-        entries.push({
-          target: file.target,
-          backup: "",
-          // sentinel: no backup written; rollback should unlink target
-          sha1: "",
-          eol: "lf"
-          // moot for non-existent file; default to lf
-        });
-        continue;
-      }
-      return {
-        ok: false,
-        error: {
-          file: filename,
-          path: file.target,
-          message: `failed to read original file for backup: ${err2.message}`,
-          line: null,
-          column: null,
-          keyword: "backup-read-failed"
-        }
-      };
+function resolveMasterYamlPath(master, packageRoot) {
+  return master === "auto" ? resolve(packageRoot, "workflows", "auto", "workflow.yaml") : resolve(packageRoot, "workflows", master, "auto", "workflow.yaml");
+}
+function registerGates(program2) {
+  program2.command("gates").description(
+    "Evaluate which sub-workflows fire for a master orchestrator (JSON plan, no spawn)."
+  ).argument("<master>", "master name: auto | discuss | plan | task | verify").option("--task <text>", "task description (injected as gateContext.task)").option("--skip-sub <names>", "comma-separated sub names to skip without gate eval").option("--context <json>", "JSON object merged over the default gate context").action(async (master, raw) => {
+    if (!VALID_MASTERS.has(master)) {
+      console.error(
+        `error: unknown master '${master}'. Expected one of: auto, discuss, plan, task, verify.`
+      );
+      process.exit(1);
+      return;
     }
-    const sha1 = createHash("sha1").update(buf).digest("hex");
-    const eol = detectEol(buf);
-    const dest = mirrorPath(file.target, file.scope, backupDir);
+    const packageRoot = getPackageRoot();
+    const yamlPath = resolveMasterYamlPath(master, packageRoot);
+    let raw_yaml;
     try {
-      await mkdir(dirname(dest), { recursive: true });
-      await writeFile(dest, buf);
+      raw_yaml = await readFile(yamlPath, "utf8");
     } catch (err2) {
-      return {
-        ok: false,
-        error: {
-          file: filename,
-          path: dest,
-          message: `failed to write backup copy: ${err2.message}`,
-          line: null,
-          column: null,
-          keyword: "backup-write-failed"
-        }
-      };
+      console.error(
+        `error: failed to read master workflow.yaml at ${yamlPath} \u2014 ${err2.message}`
+      );
+      process.exit(1);
+      return;
     }
-    entries.push({ target: file.target, backup: dest, sha1, eol });
-  }
-  const metadata = {
-    installer: filename,
-    manifest: filename,
-    timestamp: backupId,
-    files: entries
-  };
-  const metadataPath = join(backupDir, "metadata.json");
-  try {
-    await writeFile(metadataPath, `${JSON.stringify(metadata, null, 2)}
-`, "utf8");
-  } catch (err2) {
-    return {
-      ok: false,
-      error: {
-        file: filename,
-        path: metadataPath,
-        message: `failed to write metadata.json: ${err2.message}`,
-        line: null,
-        column: null,
-        keyword: "backup-metadata-failed"
-      }
-    };
-  }
-  return { ok: true, backupId, backupDir };
-}
-
-// src/cli/backup-list.ts
-function registerBackupList(program2) {
-  const backup2 = program2.command("backup").description("Backup snapshot operations");
-  backup2.command("list").description("List backup snapshots under .harnessed-backup/").action(async () => {
-    const root = getBackupRoot();
-    let dirs;
+    let parsed;
     try {
-      dirs = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name).sort();
-    } catch {
-      console.log(t("backup.no_backups", { root }));
+      parsed = parse(raw_yaml);
+    } catch (err2) {
+      console.error(`error: failed to parse ${yamlPath} \u2014 ${err2.message}`);
+      process.exit(1);
       return;
     }
-    if (dirs.length === 0) {
-      console.log(t("backup.no_backups_empty", { root }));
+    const delegates = parsed?.delegates_to;
+    if (!Array.isArray(delegates) || delegates.length === 0) {
+      console.error(`error: master '${master}' workflow.yaml missing delegates_to[]`);
+      process.exit(1);
       return;
     }
-    for (const ts of dirs) {
+    const clauses = delegates;
+    const task = typeof raw.task === "string" ? raw.task : "";
+    const stage = master;
+    const ctx = defaultContext(task, stage);
+    if (typeof raw.context === "string" && raw.context.length > 0) {
+      let extra;
       try {
-        const meta = JSON.parse(
-          await readFile(join(root, ts, "metadata.json"), "utf8")
-        );
-        console.log(
-          `${ts}  ${meta.manifest}  (${meta.files.length} file${meta.files.length === 1 ? "" : "s"})`
-        );
-      } catch {
-        console.log(`${ts}  (metadata.json missing or unreadable)`);
+        extra = JSON.parse(raw.context);
+      } catch (err2) {
+        console.error(`error: --context is not valid JSON \u2014 ${err2.message}`);
+        process.exit(1);
+        return;
+      }
+      if (extra && typeof extra === "object") {
+        Object.assign(ctx, extra);
       }
     }
-    console.log(t("backup.total_snapshots", { count: dirs.length }));
-  });
-}
-
-// src/cli/doctor.ts
-init_doctor_registry();
-function registerDoctor(program2) {
-  program2.command("doctor").description(
-    "Preflight checks (Node / MCP scope / jq / Win bash / origin URL / gstack prefix / deprecations / token budget / Agent Teams / planning-with-files / mattpocock-skills / MCP availability)"
-  ).option("--json", "output JSON instead of human-readable").action(async (opts) => {
-    const results = await Promise.all(CHECKS.map((c) => c()));
-    const hasFail = results.some((r) => r.status === "fail");
-    const hasWarn = results.some((r) => r.status === "warn");
-    if (opts.json) {
-      console.log(
-        JSON.stringify(
-          { checks: results, summary: hasFail ? "fail" : hasWarn ? "warn" : "pass" },
-          null,
-          2
-        )
-      );
-    } else {
-      for (const r of results) {
-        const mark = r.status === "pass" ? "\u2713" : r.status === "warn" ? "\u26A0" : "\u2717";
-        console.log(`${mark} ${r.name} \u2014 ${r.message}`);
-        if (r.status !== "pass" && r.fix) console.log(`    fix: ${r.fix}`);
+    const skipSubs = new Set(
+      typeof raw.skipSub === "string" && raw.skipSub.length > 0 ? raw.skipSub.split(",").map((s) => s.trim()).filter((s) => s.length > 0) : []
+    );
+    ctx.skip_subs = [...skipSubs];
+    ctx.task = task;
+    const fire = [];
+    const skip = [];
+    for (const clause of clauses) {
+      if (skipSubs.has(clause.sub)) {
+        skip.push({
+          sub: clause.sub,
+          reason: "skipped via skip_subs (done interactively in main session)"
+        });
+        continue;
+      }
+      if (!clause.gate) {
+        fire.push(fireEntry(clause));
+        continue;
+      }
+      try {
+        const passes = await resolveJudgmentGate(clause.gate, ctx, packageRoot);
+        if (passes) {
+          fire.push(fireEntry(clause));
+        } else {
+          skip.push({ sub: clause.sub, reason: `gate ${clause.gate} = false` });
+        }
+      } catch (e) {
+        console.warn(
+          `\u26A0\uFE0F master ${master} sub ${clause.sub} gate ${clause.gate} eval failed (${e.message}); firing sub as if gate=true (ADR 0029 fail-soft).`
+        );
+        fire.push(fireEntry(clause));
       }
-      console.log(
-        hasFail ? t("doctor.summary.fail") : hasWarn ? t("doctor.summary.warn") : t("doctor.summary.pass")
-      );
     }
-    process.exit(hasFail ? 1 : 0);
+    let parallelism = { escalate_to_teams: false, reason: null };
+    try {
+      const escalate = await resolveJudgmentGate(PARALLELISM_GATE, ctx, packageRoot);
+      parallelism = escalate ? { escalate_to_teams: true, reason: "agent-teams-upgrade gate fired" } : { escalate_to_teams: false, reason: null };
+    } catch {
+      parallelism = { escalate_to_teams: false, reason: null };
+    }
+    const result = { master, fire, skip, parallelism };
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(0);
   });
 }
+function fireEntry(clause) {
+  const entry = { sub: clause.sub };
+  if (clause.order !== void 0) entry.order = clause.order;
+  if (clause.mode !== void 0) entry.mode = clause.mode;
+  if (clause.gate !== void 0) entry.gate = clause.gate;
+  return entry;
+}
 var DURATION_RE = /^(\d+)([dhmw])$/;
 function parseDuration(s) {
   const m = DURATION_RE.exec(s);
@@ -2561,11 +2962,11 @@ function preflight(ctx) {
 // src/installers/lib/state.ts
 init_harnessedRoot();
 var DEFAULT_STATE = { version: "1", installed: {} };
-function statePath(_cwd) {
+function statePath2(_cwd) {
   return harnessedFile("state.json");
 }
 async function readState(cwd) {
-  const path = statePath();
+  const path = statePath2();
   let raw;
   try {
     raw = await readFile(path, "utf8");
@@ -2586,7 +2987,7 @@ async function readState(cwd) {
   }
 }
 async function writeState(cwd, state) {
-  const path = statePath();
+  const path = statePath2();
   const tmp = `${path}.tmp`;
   await mkdir(dirname(path), { recursive: true });
   await writeFile(tmp, `${JSON.stringify(state, null, 2)}
@@ -2753,10 +3154,10 @@ async function spawnCmd(ctx, cmd, args, timeoutMs) {
   child.stderr?.setEncoding("utf8").on("data", (chunk) => {
     stderr += chunk;
   });
-  return await new Promise((resolve14) => {
+  return await new Promise((resolve16) => {
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve14({
+      resolve16({
         ok: false,
         phase: "spawn",
         error: {
@@ -2771,7 +3172,7 @@ async function spawnCmd(ctx, cmd, args, timeoutMs) {
     }, effectiveTimeoutMs);
     child.on("error", (err2) => {
       clearTimeout(timer);
-      resolve14({
+      resolve16({
         ok: false,
         phase: "spawn",
         error: {
@@ -2786,7 +3187,7 @@ async function spawnCmd(ctx, cmd, args, timeoutMs) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve14({ ok: true, exitCode: code ?? -1, stdout: stdout2, stderr });
+      resolve16({ ok: true, exitCode: code ?? -1, stdout: stdout2, stderr });
     });
   });
 }
@@ -2899,7 +3300,7 @@ async function isAlreadyInstalled(ctx, opts = {}) {
 // src/installers/ccPluginMarketplace.ts
 init_readClaudeConfig();
 function runArgs(claudeArgs, cwd, timeoutMs = 15e3) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve16) => {
     const isWin = process.platform === "win32";
     const child = isWin ? spawn("cmd.exe", ["/c", "claude", ...claudeArgs], { cwd, windowsHide: true }) : spawn("claude", claudeArgs, { cwd, shell: false });
     let stderr = "";
@@ -2908,15 +3309,15 @@ function runArgs(claudeArgs, cwd, timeoutMs = 15e3) {
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve14({ exitCode: -1, stderr: `${stderr}[timeout after ${timeoutMs}ms]` });
+      resolve16({ exitCode: -1, stderr: `${stderr}[timeout after ${timeoutMs}ms]` });
     }, timeoutMs);
     child.on("error", (e) => {
       clearTimeout(timer);
-      resolve14({ exitCode: -1, stderr: `${stderr}${e.message}` });
+      resolve16({ exitCode: -1, stderr: `${stderr}${e.message}` });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve14({ exitCode: code ?? -1, stderr });
+      resolve16({ exitCode: code ?? -1, stderr });
     });
   });
 }
@@ -3062,7 +3463,7 @@ ${newEntry}
   return { ok: true, backupId: bk.backupId, appliedFiles: [settingsFile] };
 };
 function gitRevParseHead(cwd, timeoutMs = 1e4) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve16) => {
     const isWin = process.platform === "win32";
     const child = isWin ? spawn("cmd.exe", ["/c", "git", "rev-parse", "HEAD"], { cwd, windowsHide: true }) : spawn("git", ["rev-parse", "HEAD"], { cwd, shell: false });
     let stdout2 = "";
@@ -3071,15 +3472,15 @@ function gitRevParseHead(cwd, timeoutMs = 1e4) {
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve14({ sha: "", exit: -1 });
+      resolve16({ sha: "", exit: -1 });
     }, timeoutMs);
     child.on("error", () => {
       clearTimeout(timer);
-      resolve14({ sha: "", exit: -1 });
+      resolve16({ sha: "", exit: -1 });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve14({ sha: stdout2.trim(), exit: code ?? -1 });
+      resolve16({ sha: stdout2.trim(), exit: code ?? -1 });
     });
   });
 }
@@ -3786,16 +4187,6 @@ async function runInstall(manifest, opts) {
 
 // src/cli/install.ts
 init_path_guard();
-function getPackageRoot() {
-  const thisFile = fileURLToPath(import.meta.url);
-  const thisDir = dirname(thisFile);
-  if (thisDir.endsWith("dist") || thisDir.replace(/\\/g, "/").endsWith("/dist")) {
-    return resolve(thisDir, "..");
-  }
-  return resolve(thisDir, "..", "..", "..");
-}
-
-// src/cli/install.ts
 function formatError(e) {
   const head = `error: ${e.message}`;
   const where = e.path && e.path !== "/" ? `
@@ -3954,67 +4345,37 @@ function registerManifestAdd(program2) {
       process.exit(0);
     }
     const rl = readline.createInterface({ input: stdin, output: stdout });
-    const payload = {
-      upstream,
-      created_at: (/* @__PURE__ */ new Date()).toISOString(),
-      author: process.env.USER ?? process.env.USERNAME ?? "unknown"
-    };
-    for (const { q, f } of QA) {
-      const a = (await rl.question(`${q}
-> `)).trim();
-      if (!a) {
-        console.error(t("manifest_add.empty_answer"));
-        rl.close();
-        process.exit(1);
-      }
-      payload[f] = a;
-    }
-    rl.close();
-    const dryRun = raw.dryRun === true;
-    if (!dryRun) {
-      writeFileSync(outPath, `${JSON.stringify(payload, null, 2)}
-`, "utf8");
-      console.log(t("manifest_add.gate_passed_wrote", { path: outPath }));
-    } else {
-      console.log(t("manifest_add.gate_passed_dry_run", { path: outPath }));
-      console.log(JSON.stringify(payload, null, 2));
-    }
-    process.exit(0);
-  });
-}
-
-// src/checkpoint/engineHook.ts
-init_harnessedRoot();
-init_schemaVersion();
-init_state();
-init_template();
-async function activatePhase(phaseId) {
-  const checkpointPath = join(harnessedSubdir("checkpoints"), `${phaseId}.json`);
-  await activate(phaseId, checkpointPath);
-  return { checkpointPath };
-}
-async function completePhase(ctx) {
-  if (ctx.phaseId === "unknown") {
-    console.error(
-      `[harnessed] WARN engineHook: phaseId="unknown" \u2014 checkpoint paths fall back to ${join(harnessedSubdir("checkpoints"), "unknown.json")} (Karpathy fail-loud non-blocking; W-04 mitigation)`
-    );
-  }
-  writeCheckpoint({
-    schemaVersion: SCHEMA_VERSIONS.checkpoint,
-    phase: ctx.phaseId,
-    status: "complete",
-    last_task: ctx.lastTask ?? "engine.runRouting complete",
-    key_decisions: ctx.keyDecisions ?? [],
-    canonical_refs: ctx.canonicalRefs ?? [],
-    ...ctx.sessionId ? { session_id: ctx.sessionId } : {},
-    cwd: process.cwd(),
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    archive_path: `${join(harnessedSubdir("archive"), `phase-${ctx.phaseId}`)}/`
+    const payload = {
+      upstream,
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      author: process.env.USER ?? process.env.USERNAME ?? "unknown"
+    };
+    for (const { q, f } of QA) {
+      const a = (await rl.question(`${q}
+> `)).trim();
+      if (!a) {
+        console.error(t("manifest_add.empty_answer"));
+        rl.close();
+        process.exit(1);
+      }
+      payload[f] = a;
+    }
+    rl.close();
+    const dryRun = raw.dryRun === true;
+    if (!dryRun) {
+      writeFileSync(outPath, `${JSON.stringify(payload, null, 2)}
+`, "utf8");
+      console.log(t("manifest_add.gate_passed_wrote", { path: outPath }));
+    } else {
+      console.log(t("manifest_add.gate_passed_dry_run", { path: outPath }));
+      console.log(JSON.stringify(payload, null, 2));
+    }
+    process.exit(0);
   });
-  await complete();
 }
 
 // src/workflow/run.ts
+init_engineHook();
 init_state();
 async function loadRolePrompts(workflowsDir) {
   const path = join(workflowsDir, "role-prompts.yaml");
@@ -4027,36 +4388,123 @@ async function loadRolePrompts(workflowsDir) {
   const doc = parse(raw);
   return doc?.prompts ?? {};
 }
-function generateCommandFile(name, prompt, _capabilities, _installedPlugins, _installedUserSkills) {
-  const isMaster = prompt.is_master === true;
-  const argHint = isMaster ? "[task description]" : "[requirement text or omit]";
-  const stagedNote = name === "auto" ? "\n- For stage-by-stage review, append `--staged` (pauses between stages for user review)." : "";
-  const body = [
+var INTERACTIVE_COMMANDS = /* @__PURE__ */ new Set([
+  "discuss",
+  "discuss-strategic",
+  "discuss-phase",
+  "discuss-subtask",
+  "task-clarify"
+]);
+var ORCHESTRATOR_COMMANDS = /* @__PURE__ */ new Set(["auto", "plan", "task", "verify"]);
+var MARKER = `<!-- harnessed-generated:v3.4.4 -->`;
+function spawnLoopSteps(indent) {
+  const i = indent;
+  return [
+    `${i}a. Bash: \`harnessed prompt <sub> --task "<spec>" --json\` \u2192 parse \`{prompt, max_iterations, model}\`.`,
+    `${i}b. Spawn a CC-native subagent (Task / Agent tool) with that \`prompt\` and \`model\`. Wrap in the ralph-loop plugin for completion-promise enforcement:`,
+    `${i}   \`/ralph-loop "<prompt>" --max-iterations <max_iterations> --completion-promise "COMPLETE"\``,
+    `${i}   If the ralph-loop plugin is not installed, self-loop: spawn \u2192 check output for \`<promise>COMPLETE</promise>\` \u2192 if absent, re-spawn with the prior output appended (up to max_iterations).`,
+    `${i}c. If the subagent output contains \`STATUS: NEEDS_CLARIFICATION\` + a question list: STOP. Use AskUserQuestion to relay those exact questions to the user. Append the user's answers to the spec, then re-spawn the same sub. (This is the round-trip headless spawn cannot do.)`,
+    `${i}d. On \`<promise>COMPLETE</promise>\`: Bash \`harnessed checkpoint complete <sub> --summary "<one-line>"\`.`
+  ];
+}
+function buildInteractiveBody(name, prompt) {
+  return [
+    `# /${name}`,
+    ``,
+    prompt.description,
+    ``,
+    `## How to run (interactive \u2014 in THIS session)`,
+    ``,
+    `Clarification requires real user dialogue. Spawned subagents cannot ask the user questions, so run this stage directly in this session \u2014 do NOT spawn it.`,
+    ``,
+    `1. Evaluate the clarification criteria for "$ARGUMENTS":`,
+    `   - Strategic layer: new feature / new milestone / unclear business scope \u2192 run gstack \`/office-hours\` + \`/plan-ceo-review\``,
+    `   - Phase layer: \u22652 open implementation decisions / unclear cross-phase API contract \u2192 run GSD \`/gsd-discuss-phase\``,
+    `   - Subtask layer: \u22652 distinct approaches / core algorithm / API contract design / high error cost \u2192 run superpowers brainstorming`,
+    `2. For each layer that fires, hold the dialogue with the user (use AskUserQuestion for option-style decisions). Lock every open decision.`,
+    `3. Skip layers that don't fire \u2014 state which were skipped and why (transparent skip).`,
+    `4. Persist locked decisions to \`.planning/\` via planning-with-files (\`findings.md\` / \`task_plan.md\`).`,
+    ``,
+    `Output: a locked spec the execution stages can consume without further user input. Then run \`/plan\` \u2192 \`/task\` \u2192 \`/verify\` with that spec.`,
+    ``,
+    `## Notes`,
+    ``,
+    `- Generated by \`harnessed setup\`. Re-run after a harnessed upgrade to refresh.`,
+    ``,
+    MARKER,
+    ``
+  ].join("\n");
+}
+function buildOrchestratorBody(name, prompt) {
+  const autoDiscussStep = name === "auto" ? [
+    `1. FIRST run the discuss stage interactively in THIS session (spawned subagents cannot ask the user questions). Evaluate strategic / phase / subtask clarification criteria for "$ARGUMENTS"; for each that fires, dialogue with the user (AskUserQuestion) and lock decisions; transparent-skip the rest. Produce a locked spec.`
+  ] : [
+    `1. If the clarification criteria fire for "$ARGUMENTS" (\u22652 approaches / core algorithm / API contract / high error cost), clarify interactively in THIS session first (AskUserQuestion) and lock decisions. Otherwise transparent-skip. Produce a locked spec.`
+  ];
+  return [
     `# /${name}`,
     ``,
     prompt.description,
     ``,
-    `## How to invoke`,
+    `## How to run (orchestrator \u2014 clarify in THIS session, then drive native subagent spawns)`,
+    ``,
+    `harnessed is the orchestration brain: \`harnessed gates\` tells you which subs fire, \`harnessed prompt\` gives you each sub's spawn-ready prompt. YOU (the main session) do the spawning with CC-native Task / Agent tools \u2014 keeping the session responsive, enabling Agent Teams, and letting clarification round-trips reach the user.`,
+    ``,
+    ...autoDiscussStep,
+    `2. Bash: \`harnessed gates ${name} --task "<locked spec>" --skip-sub clarify\` \u2192 parse the JSON \`{fire: [{sub, order, mode}], skip, parallelism: {escalate_to_teams}}\`.`,
+    `3. If \`parallelism.escalate_to_teams === true\`: this stage needs multiple subagents to coordinate (SendMessage / shared contract). Read \`~/.claude/rules/agent-teams.md\`, then \`TeamCreate\` \u2192 \`Agent(name, team_name, ...)\` per fired sub (prompt from \`harnessed prompt <sub>\`) \u2192 coordinate via SendMessage \u2192 \`SendMessage shutdown_request\` + \`TeamDelete\`.`,
+    `4. Otherwise, for each fired sub in \`order\` (serial subs sequentially, parallel subs concurrently via parallel Task calls):`,
+    ...spawnLoopSteps("   "),
+    `5. Report a per-sub fired/skipped summary to the user. ${name === "auto" ? "Then run the `retro` stage to capture lessons." : ""}`,
+    ``,
+    `Do NOT pipe to \`harnessed run ${name}\` \u2014 that is the CI/headless path (SDK spawn, blocks the session, no Agent Teams, no clarification round-trip).`,
+    ``,
+    `## Notes`,
+    ``,
+    `- Generated by \`harnessed setup\`. Re-run after a harnessed upgrade to refresh.`,
+    `- gate/discipline SoT: \`workflows/${nameToYamlHintPath(name)}\` + \`workflows/judgments/\` \u2014 consumed by \`harnessed gates\` + \`harnessed prompt\`.`,
+    ``,
+    MARKER,
+    ``
+  ].join("\n");
+}
+function buildExecutionBody(name, prompt) {
+  return [
+    `# /${name}`,
+    ``,
+    prompt.description,
     ``,
-    `Use the Bash tool to run:`,
+    `## How to run (execution \u2014 native subagent spawn)`,
     ``,
-    "```bash",
-    `echo "$ARGUMENTS" | harnessed run ${name} --task-stdin`,
-    "```",
+    `harnessed gives you the spawn-ready prompt; YOU spawn the subagent with a CC-native Task / Agent tool (keeps the session responsive + lets clarification round-trips reach the user).`,
     ``,
-    `If \`$ARGUMENTS\` is empty (slash command invoked with no args), run \`harnessed run ${name}\` (no stdin pipe).`,
+    ...spawnLoopSteps("").map(
+      (s) => s.replace("<sub>", name).replace('--task "<spec>"', '--task "$ARGUMENTS"')
+    ),
     ``,
-    `After completion, the Bash output prints a \`Next:\` hint on stderr suggesting the next stage. Decide whether to invoke based on conversation context \u2014 the hint is informational, not prescriptive.`,
+    `Do NOT pipe to \`harnessed run ${name}\` \u2014 that is the CI/headless path (SDK spawn).`,
     ``,
     `## Notes`,
     ``,
-    `- This file is generated by \`harnessed setup\` v3.4.4+. Re-run \`harnessed setup\` after a harnessed upgrade to refresh.`,
-    `- The sister \`~/.claude/skills/${name}/SKILL.md\` is the Skill-tool entry point (Claude loads it when triggers match \`trigger_phrases:\`). Both files invoke the same \`harnessed run ${name}\` Bash command.${stagedNote}`,
-    `- Workflow runtime: \`src/workflow/run.ts\` walks \`workflows/${nameToYamlHintPath(name)}\` with disciplines + judgments + master orchestration applied per the yaml \`delegates_to[]\` + \`gate\` clauses.`,
+    `- Generated by \`harnessed setup\`. Re-run after a harnessed upgrade to refresh.`,
+    `- The sister \`~/.claude/skills/${name}/SKILL.md\` is the Skill-tool entry point (Claude loads it when triggers match). gate/discipline SoT: \`workflows/${nameToYamlHintPath(name)}\`.`,
     ``,
-    `<!-- harnessed-generated:v3.4.4 -->`,
+    MARKER,
     ``
   ].join("\n");
+}
+function generateCommandFile(name, prompt, _capabilities, _installedPlugins, _installedUserSkills) {
+  const isMaster = prompt.is_master === true;
+  const argHint = isMaster ? "[task description]" : "[requirement text or omit]";
+  let body;
+  if (INTERACTIVE_COMMANDS.has(name)) {
+    body = buildInteractiveBody(name, prompt);
+  } else if (ORCHESTRATOR_COMMANDS.has(name)) {
+    body = buildOrchestratorBody(name, prompt);
+  } else {
+    body = buildExecutionBody(name, prompt);
+  }
   const warnings = [];
   const frontmatter = [
     "---",
@@ -4344,159 +4792,6 @@ async function readGovernance() {
 async function isVetoed() {
   return (await readGovernance())?.status === "vetoed";
 }
-var PARSER_OPTIONS = {
-  operators: {
-    add: false,
-    subtract: false,
-    multiply: false,
-    divide: false,
-    logical: true,
-    comparison: true,
-    in: true,
-    assignment: false
-  }
-};
-var _parserSingleton = new Parser(PARSER_OPTIONS);
-var GateEvalError = class extends Error {
-  constructor(message, expression) {
-    super(message);
-    this.expression = expression;
-    this.name = "GateEvalError";
-  }
-  expression;
-};
-function evalGate(expression, context) {
-  try {
-    const parsed = _parserSingleton.parse(expression);
-    const result = parsed.evaluate(context);
-    if (typeof result !== "boolean") {
-      throw new GateEvalError(
-        `Expression must evaluate to boolean, got ${typeof result}`,
-        expression
-      );
-    }
-    return result;
-  } catch (err2) {
-    if (err2 instanceof GateEvalError) throw err2;
-    throw new GateEvalError(`Gate eval failed: ${err2.message}`, expression);
-  }
-}
-
-// src/workflow/schema/judgment.ts
-init_schemaVersion();
-var TriggerInvocation = Type.Object(
-  {
-    capability: Type.String()
-  },
-  { additionalProperties: false }
-);
-var RequiresCapabilities = Type.Object(
-  {
-    capabilities: Type.Array(Type.String())
-  },
-  { additionalProperties: false }
-);
-var JudgmentTrigger = Type.Object(
-  {
-    description: Type.Optional(Type.String()),
-    fires_when: Type.Optional(Type.String()),
-    skips_when: Type.Optional(Type.String()),
-    invokes: Type.Optional(Type.Array(TriggerInvocation)),
-    requires: Type.Optional(RequiresCapabilities),
-    wraps: Type.Optional(Type.Array(Type.String()))
-  },
-  { additionalProperties: false }
-);
-var FallbackRule = Type.Object(
-  {
-    description: Type.Optional(Type.String()),
-    fallback_action: Type.Optional(Type.String()),
-    message_template: Type.Optional(Type.String()),
-    override_signal: Type.Optional(Type.Array(Type.String())),
-    chain_isolation: Type.Optional(Type.Boolean())
-  },
-  { additionalProperties: false }
-);
-var JudgmentTriggersFile = Type.Object(
-  {
-    schema_version: Type.Literal(SCHEMA_VERSIONS.judgment),
-    triggers: Type.Record(Type.String(), JudgmentTrigger)
-  },
-  { additionalProperties: false }
-);
-var JudgmentRulesFile = Type.Object(
-  {
-    schema_version: Type.Literal(SCHEMA_VERSIONS.judgment),
-    rules: Type.Record(Type.String(), FallbackRule)
-  },
-  { additionalProperties: false }
-);
-Type.Union([JudgmentTriggersFile, JudgmentRulesFile]);
-var UserOverrideEntry = Type.Object(
-  {
-    id: Type.String({ minLength: 1 }),
-    // kebab-case (e.g. 'brainstorm', 'arch-review')
-    keywords: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
-    triggers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })
-  },
-  { additionalProperties: false }
-);
-var UserOverridesFile = Type.Object(
-  {
-    schema_version: Type.Literal("harnessed.user-overrides.v1"),
-    overrides: Type.Array(UserOverrideEntry, { minItems: 1 })
-  },
-  { additionalProperties: false }
-);
-
-// src/workflow/judgmentResolver.ts
-var TriggerNotFoundError = class extends Error {
-  constructor(trigger, fileName) {
-    super(`Trigger '${trigger}' not found in judgments/${fileName}.yaml`);
-    this.trigger = trigger;
-    this.fileName = fileName;
-    this.name = "TriggerNotFoundError";
-  }
-  trigger;
-  fileName;
-};
-var _fileCache = /* @__PURE__ */ new Map();
-async function resolveJudgmentGate(gateRef, context, packageRoot) {
-  const userOverrides = context.user_overrides;
-  if (Array.isArray(userOverrides) && userOverrides.includes(gateRef)) {
-    return true;
-  }
-  const parts = gateRef.split(".");
-  if (parts.length !== 4 || parts[0] !== "judgments") {
-    throw new Error(`Invalid gate ref: ${gateRef}`);
-  }
-  const [, fileName, triggerName, fieldName] = parts;
-  let parsed = _fileCache.get(fileName);
-  if (!parsed) {
-    const yamlPath = resolve(packageRoot, "workflows", "judgments", `${fileName}.yaml`);
-    const raw = await readFile(yamlPath, "utf8");
-    const parsedRaw = parse(raw);
-    const schema = fileName === "fallback" ? JudgmentRulesFile : JudgmentTriggersFile;
-    if (!Value.Check(schema, parsedRaw)) {
-      const errors = [...Value.Errors(schema, parsedRaw)].slice(0, 3).map((e) => `${e.path} ${e.message}`).join("; ");
-      throw new Error(`Invalid judgment file ${fileName}.yaml: ${errors}`);
-    }
-    parsed = parsedRaw;
-    _fileCache.set(fileName, parsed);
-  }
-  const entries = "triggers" in parsed ? parsed.triggers : parsed.rules;
-  const trigger = entries[triggerName];
-  if (!trigger) {
-    throw new TriggerNotFoundError(triggerName, fileName);
-  }
-  const expr = fieldName === "fires" ? trigger.fires_when : fieldName === "skips" ? trigger.skips_when : void 0;
-  if (!expr) {
-    throw new Error(
-      `Field '${fieldName}' has no expression in trigger '${triggerName}' of ${fileName}.yaml`
-    );
-  }
-  return evalGate(expr, context);
-}
 
 // src/workflow/lib/promiseExtract.ts
 var PROMISE_PATTERN = /<promise>([^<]+)<\/promise>/;
@@ -4917,7 +5212,7 @@ function loadPhases(yamlPath, vars) {
   }
   return validated;
 }
-function resolveMasterYamlPath(masterName, packageRoot) {
+function resolveMasterYamlPath2(masterName, packageRoot) {
   return masterName === "auto" ? resolve(packageRoot, "workflows", "auto", "workflow.yaml") : resolve(packageRoot, "workflows", masterName, "auto", "workflow.yaml");
 }
 function resolveSubYamlPath(masterName, subName, packageRoot) {
@@ -5021,7 +5316,7 @@ async function maybeArbitrate(firedClauses, packageRoot) {
 
 // src/workflow/masterOrchestrator.ts
 async function runMasterOrchestrator(masterName, context, packageRoot, spawnDriver = defaultSpawnDriver, opts = {}) {
-  const yamlPath = resolveMasterYamlPath(masterName, packageRoot);
+  const yamlPath = resolveMasterYamlPath2(masterName, packageRoot);
   const raw = await readFile(yamlPath, "utf8");
   const parsed = parse(raw);
   if (!Value.Check(WorkflowSchemaV3, parsed)) {
@@ -5042,8 +5337,17 @@ async function runMasterOrchestrator(masterName, context, packageRoot, spawnDriv
     }
     effectiveOpts = pre.opts;
   }
+  const skipSubs = new Set(Array.isArray(context.skip_subs) ? context.skip_subs : []);
   const gateEvalled = [];
   for (const clause of master.delegates_to) {
+    if (skipSubs.has(clause.sub)) {
+      gateEvalled.push({
+        clause,
+        passes: false,
+        reason: `skipped via skip_subs (done interactively in main session)`
+      });
+      continue;
+    }
     if (!clause.gate) {
       gateEvalled.push({ clause, passes: true });
       continue;
@@ -5395,6 +5699,78 @@ async function runWorkflow(yamlPath, vars, opts = {}) {
     ...skippedPhases.length > 0 ? { skippedPhases } : {}
   };
 }
+
+// src/cli/prompt.ts
+var DEFAULT_MAX_ITERATIONS = 20;
+var DEFAULT_MODEL = "sonnet";
+var DEFAULT_SPECIALIST = "Implementation Engineer";
+var PROTOCOLS = `
+## Completion protocol
+When done emit: <promise>COMPLETE</promise>
+
+## Clarification protocol
+If you hit a gray area you cannot decide (\u22652 reasonable options, missing key context, ambiguous requirement), do NOT self-decide. Emit:
+STATUS: NEEDS_CLARIFICATION
+1. <question>
+2. <question>
+The main session will relay these to the user and re-spawn you with answers.
+`;
+async function resolveMaxIterations2(sub, packageRoot) {
+  try {
+    const path = resolve(packageRoot, "workflows", "defaults.yaml");
+    const raw = await readFile(path, "utf8");
+    const doc = parse(raw);
+    const entry = doc?.ralph_max_iterations?.[sub];
+    if (typeof entry === "number" && Number.isFinite(entry)) {
+      return entry;
+    }
+    if (entry && typeof entry === "object") {
+      for (const v of Object.values(entry)) {
+        if (typeof v === "number" && Number.isFinite(v)) {
+          return v;
+        }
+      }
+    }
+    return DEFAULT_MAX_ITERATIONS;
+  } catch {
+    return DEFAULT_MAX_ITERATIONS;
+  }
+}
+function registerPrompt(program2) {
+  program2.command("prompt").description(
+    "Print a spawn-ready prompt for a sub-workflow (role + checklist + protocols, no spawn)."
+  ).argument("<sub>", "sub-workflow name (e.g. task-code, verify-paranoid)").option("--task <text>", "task description prepended as a ## Task section").option("--json", "emit JSON {prompt, max_iterations, model, specialist} instead of text").action(async (sub, raw) => {
+    const packageRoot = getPackageRoot();
+    const workflowsDir = resolve(packageRoot, "workflows");
+    const rolePrompts = await loadRolePrompts(workflowsDir);
+    const def = buildAgentDef(sub, rolePrompts, void 0, void 0, void 0);
+    const body = def.prompt;
+    const taskSection = typeof raw.task === "string" && raw.task.length > 0 ? `## Task
+${raw.task}
+
+` : "";
+    const fullPrompt = `${taskSection}${body}
+${PROTOCOLS}`;
+    if (raw.json) {
+      const maxIterations = await resolveMaxIterations2(sub, packageRoot);
+      const rp = rolePrompts[sub];
+      const model = def.model ?? DEFAULT_MODEL;
+      const specialist = rp?.specialist ?? DEFAULT_SPECIALIST;
+      console.log(
+        JSON.stringify({
+          prompt: fullPrompt,
+          max_iterations: maxIterations,
+          model,
+          specialist
+        })
+      );
+      process.exit(0);
+      return;
+    }
+    console.log(fullPrompt);
+    process.exit(0);
+  });
+}
 async function loadUserOverrides(packageRoot) {
   const yamlPath = resolve(packageRoot, "workflows", "judgments", "user-overrides.yaml");
   let raw;
@@ -5441,7 +5817,7 @@ var _autoChainCache = null;
 var _autoChainLoadFailed = false;
 function registerRun(program2) {
   program2.command("run").description(
-    "Run a harnessed workflow (master orchestrator or sub-workflow). Slash commands invoke via this subcommand."
+    "Run a harnessed workflow via in-process SDK spawn (CI/headless mode \u2014 blocks, no Agent Teams, no clarification round-trip). Slash commands use CC-native spawn via gates/prompt/checkpoint instead."
   ).argument("[name]", "workflow name (e.g. discuss, verify-paranoid, research, auto)").option("--task <text>", "task description (passed as workflow gateContext.task)").option("--task-stdin", "read task description from stdin until EOF (avoids shell-escape)").option(
     "--max-iterations <n>",
     "ralph-loop max iter (default 20; honored Phase 3 onward)",
@@ -5449,7 +5825,10 @@ function registerRun(program2) {
   ).option("--model <model>", "subagent model: 'haiku' | 'sonnet' | 'opus'").option(
     "--dry-run",
     "validate yaml load + walk runtime without spawning (Phase 1 default for verification)"
-  ).option("--staged", "/auto super-master: pause between stages for user review").option("--list", "print all known workflow names and exit").action(async (name, raw) => {
+  ).option("--staged", "/auto super-master: pause between stages for user review").option(
+    "--skip-sub <names>",
+    "comma-separated sub names to skip (work already done interactively in main session, e.g. clarify)"
+  ).option("--list", "print all known workflow names and exit").action(async (name, raw) => {
     if (raw.list) {
       const names = await listWorkflowNames(WORKFLOWS_DIR);
       for (const n of names) console.log(n);
@@ -5541,6 +5920,10 @@ function registerRun(program2) {
       ...raw.model ? { modelOverride: raw.model } : {},
       ...raw.maxIterations ? { maxIterations: raw.maxIterations } : {},
       ...raw.staged ? { staged: true } : {},
+      // v3.9.26 Option A — skip subs done interactively in main session.
+      ...typeof raw.skipSub === "string" && raw.skipSub.length > 0 ? {
+        skip_subs: raw.skipSub.split(",").map((s) => s.trim()).filter((s) => s.length > 0)
+      } : {},
       ...matchedTriggers.length > 0 ? { user_overrides: matchedTriggers } : {}
     };
     if (raw.dryRun) {
@@ -6279,20 +6662,19 @@ function printGrouped(b, prefix = "") {
   const GROUP_ORDER = ["mcp-tool", "command", "cli-binary", "other"];
   const groupOf = (n) => b.componentTypes[n] ?? "other";
   const buckets = {};
+  const push = (group, entry) => {
+    if (!buckets[group]) buckets[group] = [];
+    buckets[group].push(entry);
+  };
   for (const n of b.failed) {
     const m = n.match(/^([^:]+):/);
     const baseName = m?.[1] ?? n;
-    (buckets[groupOf(baseName)] ??= []).push({ status: "failed", name: n });
+    push(groupOf(baseName), { status: "failed", name: n });
   }
-  for (const n of b.installed) (buckets[groupOf(n)] ??= []).push({ status: "installed", name: n });
+  for (const n of b.installed) push(groupOf(n), { status: "installed", name: n });
   for (const s of b.skipped)
-    (buckets[groupOf(s.name)] ??= []).push({
-      status: "skipped",
-      name: s.name,
-      suffix: ` \u2014 ${s.reason}`
-    });
-  for (const n of b.alreadyInstalled)
-    (buckets[groupOf(n)] ??= []).push({ status: "already-installed", name: n });
+    push(groupOf(s.name), { status: "skipped", name: s.name, suffix: ` \u2014 ${s.reason}` });
+  for (const n of b.alreadyInstalled) push(groupOf(n), { status: "already-installed", name: n });
   for (const g of GROUP_ORDER) {
     const entries = buckets[g];
     if (!entries || entries.length === 0) continue;
@@ -6682,7 +7064,7 @@ var uninstallNpmCli = async (ctx) => {
   const m = install.cmd.match(/npm\s+(?:install|i)\s+(?:-g\s+)?(\S+)/);
   const pkg = m?.[1] ?? ctx.manifest.metadata.upstream.source;
   const isWin = process.platform === "win32";
-  const result = await new Promise((resolve14) => {
+  const result = await new Promise((resolve16) => {
     const child = isWin ? spawn("cmd.exe", ["/c", "npm", "uninstall", "-g", pkg], { windowsHide: true }) : spawn("npm", ["uninstall", "-g", pkg], { shell: false });
     let stderr = "";
     child.stderr?.setEncoding("utf8").on("data", (c) => {
@@ -6690,15 +7072,15 @@ var uninstallNpmCli = async (ctx) => {
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      resolve14({ exitCode: -1, stderr: `${stderr}[timeout]` });
+      resolve16({ exitCode: -1, stderr: `${stderr}[timeout]` });
     }, 3e4);
     child.on("error", (e) => {
       clearTimeout(timer);
-      resolve14({ exitCode: -1, stderr: e.message });
+      resolve16({ exitCode: -1, stderr: e.message });
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve14({ exitCode: code ?? -1, stderr });
+      resolve16({ exitCode: code ?? -1, stderr });
     });
   });
   if (result.exitCode !== 0) {
@@ -6788,7 +7170,8 @@ async function removeSettingsEnv(settingsPath3) {
   if (!changed) return false;
   if (Object.keys(env).length === 0) delete data.env;
   else data.env = env;
-  await writeFile(settingsPath3, JSON.stringify(data, null, 2) + "\n", "utf8");
+  await writeFile(settingsPath3, `${JSON.stringify(data, null, 2)}
+`, "utf8");
   return true;
 }
 async function runUnifiedUninstall(home, dryRun) {
@@ -6996,6 +7379,9 @@ registerResume(program);
 registerUninstall(program);
 registerSetup(program);
 registerRun(program);
+registerGates(program);
+registerPrompt(program);
+registerCheckpoint(program);
 program.parse(process.argv);
 //# sourceMappingURL=cli.mjs.map
 //# sourceMappingURL=cli.mjs.map