jorgex-stack 1.5.0 → 1.7.0

package/dist/cli.js

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
+import {
+  HOME,
+  QUALITY_PROFILES,
+  canonicalJson,
+  createQualityReceipt,
+  dataDir,
+  evaluateQualityPolicy,
+  samePath,
+  serializeQualityReceipt,
+  sha256,
+  stackRoot,
+  validateQualityReceipt
+} from "./chunk-IO2FFZOH.js";
 
 // src/cli.ts
 import * as p6 from "@clack/prompts";
@@ -7,12 +20,13 @@ import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/install.ts
 import fs15 from "fs";
-import path21 from "path";
+import path20 from "path";
 import * as p from "@clack/prompts";
 
 // src/adapters/opencode.ts
-import path7 from "path";
+import path6 from "path";
 import fs3 from "fs";
+import { isDeepStrictEqual } from "util";
 import { pathToFileURL } from "url";
 
 // src/lib/canonical.ts
@@ -68,37 +82,12 @@ function loadCanonicalDefaults(stackDir) {
 }
 
 // src/lib/model-map.ts
-import path4 from "path";
-import { existsSync as existsSync2 } from "fs";
-
-// src/lib/paths.ts
-import os from "os";
-import path2 from "path";
+import path3 from "path";
 import { existsSync } from "fs";
-import { fileURLToPath } from "url";
-var HOME = os.homedir();
-function stackRoot() {
-  let dir = path2.dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 6; i++) {
-    const candidate = path2.join(dir, "stack");
-    if (existsSync(path2.join(candidate, "system-prompt", "AGENTS.md"))) return candidate;
-    dir = path2.dirname(dir);
-  }
-  throw new Error("No se encontr\xF3 stack/ relativa al CLI \u2014 instalaci\xF3n rota.");
-}
-function dataDir() {
-  return path2.join(HOME, ".jorgex-stack");
-}
-function samePath(a, b) {
-  const resolvedA = path2.resolve(a);
-  const resolvedB = path2.resolve(b);
-  if (process.platform === "win32") return resolvedA.toLowerCase() === resolvedB.toLowerCase();
-  return resolvedA === resolvedB;
-}
 
 // src/lib/fsx.ts
 import fs2 from "fs";
-import path3 from "path";
+import path2 from "path";
 function readTextIfExists(file) {
   try {
     return fs2.readFileSync(file, "utf8");
@@ -111,7 +100,7 @@ function ensureDir(dir) {
 }
 var tmpCounter = 0;
 function tmpPath(target) {
-  return path3.join(path3.dirname(target), `.jorgex-${process.pid}-${tmpCounter++}.tmp`);
+  return path2.join(path2.dirname(target), `.jorgex-${process.pid}-${tmpCounter++}.tmp`);
 }
 function renameInto(tmp, target) {
   try {
@@ -122,23 +111,23 @@ function renameInto(tmp, target) {
   }
 }
 function writeText(file, content) {
-  ensureDir(path3.dirname(file));
+  ensureDir(path2.dirname(file));
   const tmp = tmpPath(file);
   fs2.writeFileSync(tmp, content, "utf8");
   renameInto(tmp, file);
 }
 function copyFile(source, target) {
-  ensureDir(path3.dirname(target));
+  ensureDir(path2.dirname(target));
   const tmp = tmpPath(target);
   fs2.copyFileSync(source, tmp);
   renameInto(tmp, target);
 }
 function isContainedIn(child, root) {
-  const rel = path3.relative(path3.resolve(root), path3.resolve(child));
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path3.sep}`) && !path3.isAbsolute(rel);
+  const rel = path2.relative(path2.resolve(root), path2.resolve(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path2.sep}`) && !path2.isAbsolute(rel);
 }
 function pruneEmptyDirs(file, root) {
-  let dir = path3.dirname(file);
+  let dir = path2.dirname(file);
   while (dir.startsWith(root) && dir !== root) {
     try {
       if (fs2.readdirSync(dir).length > 0) return;
@@ -146,7 +135,7 @@ function pruneEmptyDirs(file, root) {
     } catch {
       return;
     }
-    dir = path3.dirname(dir);
+    dir = path2.dirname(dir);
   }
 }
 function sameFileContent(a, b) {
@@ -163,7 +152,7 @@ function listFilesRecursive(dir) {
   if (!fs2.existsSync(dir)) return out;
   const walk = (d) => {
     for (const entry of fs2.readdirSync(d, { withFileTypes: true })) {
-      const p7 = path3.join(d, entry.name);
+      const p7 = path2.join(d, entry.name);
       if (entry.isDirectory()) walk(p7);
       else out.push(p7);
     }
@@ -198,7 +187,7 @@ var DEFAULT_MODEL_MAP = {
   }
 };
 function modelMapFile() {
-  return path4.join(dataDir(), "model-map.json");
+  return path3.join(dataDir(), "model-map.json");
 }
 function loadModelMap() {
   const raw = readTextIfExists(modelMapFile());
@@ -217,22 +206,22 @@ function loadModelMap() {
 }
 function ensureModelMapFile() {
   const file = modelMapFile();
-  if (!existsSync2(file)) {
+  if (!existsSync(file)) {
     writeText(file, JSON.stringify(DEFAULT_MODEL_MAP, null, 2) + "\n");
   }
   return file;
 }
 
 // src/lib/detect.ts
-import path5 from "path";
-import { existsSync as existsSync3, statSync } from "fs";
+import path4 from "path";
+import { existsSync as existsSync2, statSync } from "fs";
 import { execFileSync } from "child_process";
 function lookPath(cmd) {
   const exts = process.platform === "win32" ? [".exe", ".cmd", ".bat", ".ps1", ""] : [""];
-  for (const dir of (process.env.PATH ?? "").split(path5.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path4.delimiter)) {
     if (!dir) continue;
     for (const ext of exts) {
-      const candidate = path5.join(dir, cmd + ext);
+      const candidate = path4.join(dir, cmd + ext);
       if (statSync(candidate, { throwIfNoEntry: false })?.isFile()) return candidate;
     }
   }
@@ -261,50 +250,50 @@ function runDetectedBin(bin, args, timeoutMs) {
   }
 }
 function detectOpenCode() {
-  const configDir = process.env.OPENCODE_CONFIG_DIR ?? path5.join(HOME, ".config", "opencode");
+  const configDir = process.env.OPENCODE_CONFIG_DIR ?? path4.join(HOME, ".config", "opencode");
   const binPath = lookPath("opencode");
   return {
     id: "opencode",
     name: "OpenCode",
-    installed: binPath !== null || existsSync3(configDir),
+    installed: binPath !== null || existsSync2(configDir),
     binPath,
     configDir
   };
 }
 function detectClaudeCode() {
-  const configDir = path5.join(HOME, ".claude");
+  const configDir = path4.join(HOME, ".claude");
   const binPath = lookPath("claude");
   return {
     id: "claude-code",
     name: "Claude Code",
-    installed: binPath !== null || existsSync3(configDir),
+    installed: binPath !== null || existsSync2(configDir),
     binPath,
     configDir
   };
 }
 function detectCodex() {
-  const configDir = process.env.CODEX_HOME ?? path5.join(HOME, ".codex");
+  const configDir = process.env.CODEX_HOME ?? path4.join(HOME, ".codex");
   const binPath = lookPath("codex");
   return {
     id: "codex",
     name: "Codex CLI",
-    installed: binPath !== null || existsSync3(configDir),
+    installed: binPath !== null || existsSync2(configDir),
     binPath,
     configDir
   };
 }
 function detectEngram() {
   const fromEnv = process.env.ENGRAM_BIN;
-  if (fromEnv && existsSync3(fromEnv)) return fromEnv;
+  if (fromEnv && existsSync2(fromEnv)) return fromEnv;
   const onPath = lookPath("engram");
   if (onPath) return onPath;
   const candidates = [
-    path5.join(HOME, "go", "bin", "engram.exe"),
-    path5.join(HOME, "go", "bin", "engram"),
-    path5.join(HOME, ".local", "bin", "engram.exe"),
-    path5.join(HOME, ".local", "bin", "engram")
+    path4.join(HOME, "go", "bin", "engram.exe"),
+    path4.join(HOME, "go", "bin", "engram"),
+    path4.join(HOME, ".local", "bin", "engram.exe"),
+    path4.join(HOME, ".local", "bin", "engram")
   ];
-  for (const c of candidates) if (existsSync3(c)) return c;
+  for (const c of candidates) if (existsSync2(c)) return c;
   return null;
 }
 
@@ -312,15 +301,19 @@ function detectEngram() {
 function markers(name) {
   return { open: `<!-- jorgex:${name} -->`, close: `<!-- /jorgex:${name} -->` };
 }
+function hasHealthyManagedMarkdownMarkers(existing, name) {
+  const { open, close } = markers(name);
+  const count = (marker) => existing.split(marker).length - 1;
+  const onOwnLine = (marker) => existing.split("\n").some((line) => line.trim() === marker);
+  return count(open) === 1 && count(close) === 1 && existing.indexOf(close) > existing.indexOf(open) && onOwnLine(open) && onOwnLine(close);
+}
 function repairOrphanMarkers(existing, name) {
   const { open, close } = markers(name);
   const count = (marker) => existing.split(marker).length - 1;
   const opens = count(open);
   const closes = count(close);
   if (opens === 0 && closes === 0) return existing;
-  const onOwnLine = (marker) => existing.split("\n").some((line) => line.trim() === marker);
-  const healthy = opens === 1 && closes === 1 && existing.indexOf(close) > existing.indexOf(open) && onOwnLine(open) && onOwnLine(close);
-  if (healthy) return existing;
+  if (hasHealthyManagedMarkdownMarkers(existing, name)) return existing;
   return existing.split("\n").map((line) => line.trim() === open || line.trim() === close ? null : line.split(open).join("").split(close).join("")).filter((line) => line !== null).join("\n");
 }
 function upsertMarkdownSection(existing, name, content) {
@@ -473,9 +466,9 @@ function readTomlSection(existing, section) {
 }
 
 // src/lib/hooks-format.ts
-import path6 from "path";
+import path5 from "path";
 function hookScriptNames(canonical) {
-  return Object.values(canonical.hooks).flat().flatMap((entry) => entry.hooks).map((h) => /\{\{SCRIPTS_DIR\}\}[/\\]([\w./-]+)/.exec(h.command)?.[1]).filter((s) => s !== void 0).map((s) => path6.basename(s));
+  return Object.values(canonical.hooks).flat().flatMap((entry) => entry.hooks).map((h) => /\{\{SCRIPTS_DIR\}\}[/\\]([\w./-]+)/.exec(h.command)?.[1]).filter((s) => s !== void 0).map((s) => path5.basename(s));
 }
 function plainHookCommands(canonical) {
   return new Set(
@@ -522,7 +515,7 @@ function upsertNativeHooks(existing, canonical, scriptsDir, mapMatcher = (m) =>
             ...h.timeout !== void 0 ? { timeout: h.timeout } : {}
           }))
         };
-        const scriptNames = entry.hooks.map((h) => /\{\{SCRIPTS_DIR\}\}[/\\]([\w./-]+)/.exec(h.command)?.[1]).filter((s) => s !== void 0).map((s) => path6.basename(s));
+        const scriptNames = entry.hooks.map((h) => /\{\{SCRIPTS_DIR\}\}[/\\]([\w./-]+)/.exec(h.command)?.[1]).filter((s) => s !== void 0).map((s) => path5.basename(s));
         const plainCommands = entry.hooks.map((h) => h.command).filter((c) => !c.includes("{{SCRIPTS_DIR}}"));
         const index = list.findIndex((existingEntry) => {
           const e = existingEntry;
@@ -552,6 +545,79 @@ var DESTRUCTIVE_GIT_DENY = [
 ];
 var GIT_GUARD_SCRIPT = "block-destructive-git.cjs";
 
+// src/lib/quality-capabilities.ts
+var QUALITY_CAPABILITY_NAMESPACE = "jorgex.quality.capabilities";
+var QUALITY_CAPABILITY_VERSION = 1;
+var QUALITY_CAPABILITY_IDS = [
+  "policy-guidance",
+  "tool-approval",
+  "external-verification"
+];
+var UNAVAILABLE_REASON = "No reviewed local declaration is available";
+var EXTERNAL_VERIFICATION_REASON = "External verification is available only through the external verifier";
+function hasText(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function isRuntime(value) {
+  return value === "claude-code" || value === "codex" || value === "opencode" || value === "pi";
+}
+function hasValidEvidence(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const evidence = value;
+  return hasText(evidence.source) && hasText(evidence.version);
+}
+function unavailableCapability(id, reason = UNAVAILABLE_REASON) {
+  return { id, state: "unavailable", reason };
+}
+function declarationFor(id, declarations, runtime) {
+  if (runtime === "unknown") {
+    return unavailableCapability(id, "Runtime is unknown; local capability cannot be established");
+  }
+  if (id === "external-verification") {
+    return unavailableCapability(id, EXTERNAL_VERIFICATION_REASON);
+  }
+  const matches = declarations.filter((declaration2) => declaration2?.id === id);
+  if (matches.length === 0) return unavailableCapability(id);
+  if (matches.length !== 1) return unavailableCapability(id, "Duplicate capability declarations are ambiguous");
+  const declaration = matches[0];
+  const state = declaration.state;
+  const reason = hasText(declaration.reason) ? declaration.reason.trim() : void 0;
+  if (!reason) return unavailableCapability(id, "Capability declaration has no reason");
+  if (state !== "prompt-only" && state !== "manual" && state !== "unavailable") {
+    return unavailableCapability(id, "Capability state is not a supported local state");
+  }
+  if (state === "unavailable") return { id, state, reason };
+  if (!hasValidEvidence(declaration.evidence)) {
+    return unavailableCapability(id, "Capability declaration lacks reviewed source/version evidence");
+  }
+  const evidence = declaration.evidence;
+  return {
+    id,
+    state,
+    reason,
+    evidence: {
+      source: evidence.source.trim(),
+      version: evidence.version.trim()
+    }
+  };
+}
+function hasManagedMarkdownSection(content, name) {
+  return content !== null && hasHealthyManagedMarkdownMarkers(content, name);
+}
+function createLocalCapabilityReport(runtime, declarations) {
+  const normalizedRuntime = isRuntime(runtime) ? runtime : "unknown";
+  return {
+    namespace: QUALITY_CAPABILITY_NAMESPACE,
+    version: QUALITY_CAPABILITY_VERSION,
+    runtime: normalizedRuntime,
+    capabilities: QUALITY_CAPABILITY_IDS.map((id) => declarationFor(id, declarations, normalizedRuntime))
+  };
+}
+function localQualityStatus(profile, status) {
+  if ((profile === "high" || profile === "release") && status === "pass") return "incomplete";
+  return status;
+}
+
 // src/adapters/opencode.ts
 function yamlString(value) {
   return JSON.stringify(value);
@@ -592,26 +658,55 @@ function pruneEmpty(parent, key) {
   const value = objectValue(parent[key]);
   if (value !== null && Object.keys(value).length === 0) delete parent[key];
 }
+function hasOpenCodeManualApproval(configDir) {
+  const content = readTextIfExists(path6.join(configDir, "opencode.json"));
+  if (content === null) return false;
+  try {
+    const root = JSON.parse(content);
+    const permission = objectValue(objectValue(root)?.permission);
+    const expected = loadCanonicalDefaults(stackRoot())["opencode"]?.["permission"];
+    return permission !== null && expected !== void 0 && isDeepStrictEqual(permission, expected);
+  } catch {
+    return false;
+  }
+}
 var opencodeAdapter = {
   id: "opencode",
   name: "OpenCode",
   detect: detectOpenCode,
+  reportCapabilities(configDir) {
+    const prompt = readTextIfExists(path6.join(configDir, "AGENTS.md"));
+    return createLocalCapabilityReport("opencode", [
+      ...hasManagedMarkdownSection(prompt, "system-prompt") ? [{
+        id: "policy-guidance",
+        state: "prompt-only",
+        reason: "The managed policy prompt is advisory and cannot enforce the policy",
+        evidence: { source: "jorgex-stack-system-prompt", version: "1" }
+      }] : [],
+      ...hasOpenCodeManualApproval(configDir) ? [{
+        id: "tool-approval",
+        state: "manual",
+        reason: "Canonical approval declarations require a human decision; runtime activation is not certified",
+        evidence: { source: "jorgex-stack-opencode-approval-policy", version: "1" }
+      }] : []
+    ]);
+  },
   injectEngramProtocol() {
     return false;
   },
   paths(configDir) {
     const isRealConfigDir = samePath(
       configDir,
-      process.env.OPENCODE_CONFIG_DIR ?? path7.join(HOME, ".config", "opencode")
+      process.env.OPENCODE_CONFIG_DIR ?? path6.join(HOME, ".config", "opencode")
     );
-    const agentsHome = isRealConfigDir ? HOME : path7.dirname(configDir);
+    const agentsHome = isRealConfigDir ? HOME : path6.dirname(configDir);
     return {
-      systemPromptFile: path7.join(configDir, "AGENTS.md"),
-      agentsDir: path7.join(configDir, "agents"),
-      skillsDir: path7.join(agentsHome, ".agents", "skills"),
-      commandsDir: path7.join(configDir, "commands"),
-      pluginsDir: path7.join(configDir, "plugins"),
-      scriptsDir: path7.join(configDir, "scripts"),
+      systemPromptFile: path6.join(configDir, "AGENTS.md"),
+      agentsDir: path6.join(configDir, "agents"),
+      skillsDir: path6.join(agentsHome, ".agents", "skills"),
+      commandsDir: path6.join(configDir, "commands"),
+      pluginsDir: path6.join(configDir, "plugins"),
+      scriptsDir: path6.join(configDir, "scripts"),
       outputStylesDir: null,
       profilesDir: null
     };
@@ -669,12 +764,12 @@ ${agent.body}`,
             ctx.warnings.push(`opencode: hook sin {{SCRIPTS_DIR}} no traducible: ${hook.command}`);
             continue;
           }
-          const script = `scripts/${path7.basename(match[1])}`;
+          const script = `scripts/${path6.basename(match[1])}`;
           (bashEntries[includes] ??= []).push(script);
         }
       }
     }
-    const hooksFile = path7.join(ctx.configDir, "hooks.json");
+    const hooksFile = path6.join(ctx.configDir, "hooks.json");
     const content = upsertJson(readTextIfExists(hooksFile), (root) => {
       const afterValue = root["tool.execute.after"] ??= {};
       if (afterValue === null || typeof afterValue !== "object" || Array.isArray(afterValue)) {
@@ -709,16 +804,16 @@ ${agent.body}`,
       }
     });
     actions.push({ kind: "write", target: hooksFile, content });
-    const scriptsSource = path7.join(ctx.stackDir, "scripts");
+    const scriptsSource = path6.join(ctx.stackDir, "scripts");
     if (fs3.existsSync(scriptsSource)) {
       for (const f of fs3.readdirSync(scriptsSource)) {
-        actions.push({ kind: "copy", source: path7.join(scriptsSource, f), target: path7.join(scriptsDir, f) });
+        actions.push({ kind: "copy", source: path6.join(scriptsSource, f), target: path6.join(scriptsDir, f) });
       }
     }
     return actions;
   },
   planMainConfig(canonical, ctx) {
-    const file = path7.join(ctx.configDir, "opencode.json");
+    const file = path6.join(ctx.configDir, "opencode.json");
     const { pluginsDir } = this.paths(ctx.configDir);
     const original = readTextIfExists(file);
     const contentSource = original === null || original.trim() === "" ? null : original;
@@ -830,7 +925,7 @@ ${agent.body}`,
       content = removeMarkdownSection(content, "browser");
       actions.push({ kind: "write", target: systemPromptFile, content });
     }
-    const configFile = path7.join(ctx.configDir, "opencode.json");
+    const configFile = path6.join(ctx.configDir, "opencode.json");
     const config = readTextIfExists(configFile);
     if (config !== null) {
       const mcpOwnership = [];
@@ -898,7 +993,7 @@ ${agent.body}`,
         ...primaryModelOwnership.length > 0 ? { primaryModelOwnership } : {}
       });
     }
-    const hooksFile = path7.join(ctx.configDir, "hooks.json");
+    const hooksFile = path6.join(ctx.configDir, "hooks.json");
     const hooksJson = readTextIfExists(hooksFile);
     if (hooksJson !== null) {
       const ourScripts = hookScriptNames(hooks);
@@ -924,8 +1019,9 @@ ${agent.body}`,
 };
 
 // src/adapters/claude-code.ts
-import path8 from "path";
+import path7 from "path";
 import fs4 from "fs";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 function yamlString2(value) {
   return JSON.stringify(value);
 }
@@ -936,6 +1032,21 @@ var ENGRAM_AGENT_TOOLS = [
   "Skill",
   ...memoryTools(["mem_context", "mem_search", "mem_get_observation", "mem_timeline", "mem_current_project"])
 ];
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasClaudeManualApproval(configDir) {
+  const content = readTextIfExists(path7.join(configDir, "settings.json"));
+  if (content === null) return false;
+  try {
+    const root = JSON.parse(content);
+    const permissions = isRecord(root) ? root.permissions : void 0;
+    const expected = loadCanonicalDefaults(stackRoot())["claude-code"]?.["permissions"];
+    return isRecord(permissions) && expected !== void 0 && isDeepStrictEqual2(permissions, expected);
+  } catch {
+    return false;
+  }
+}
 function toolsFor(agent) {
   if (agent.name === "engram") return ENGRAM_AGENT_TOOLS.join(", ");
   if (!agent.readonly) return null;
@@ -945,8 +1056,8 @@ function toolsFor(agent) {
   return tools.join(", ");
 }
 function hasEngramPlugin(configDir) {
-  if (fs4.existsSync(path8.join(configDir, "plugins", "marketplaces", "engram"))) return true;
-  const registry = readTextIfExists(path8.join(configDir, "plugins", "installed_plugins.json"));
+  if (fs4.existsSync(path7.join(configDir, "plugins", "marketplaces", "engram"))) return true;
+  const registry = readTextIfExists(path7.join(configDir, "plugins", "installed_plugins.json"));
   if (registry === null) return false;
   try {
     const parsed = JSON.parse(registry);
@@ -968,18 +1079,35 @@ var claudeCodeAdapter = {
   id: "claude-code",
   name: "Claude Code",
   detect: detectClaudeCode,
+  reportCapabilities(configDir) {
+    const prompt = readTextIfExists(path7.join(configDir, "CLAUDE.md"));
+    return createLocalCapabilityReport("claude-code", [
+      ...hasManagedMarkdownSection(prompt, "system-prompt") ? [{
+        id: "policy-guidance",
+        state: "prompt-only",
+        reason: "The managed policy prompt is advisory and cannot enforce the policy",
+        evidence: { source: "jorgex-stack-system-prompt", version: "1" }
+      }] : [],
+      ...hasClaudeManualApproval(configDir) ? [{
+        id: "tool-approval",
+        state: "manual",
+        reason: "Canonical approval declarations require a human decision; runtime activation is not certified",
+        evidence: { source: "jorgex-stack-claude-approval-policy", version: "1" }
+      }] : []
+    ]);
+  },
   injectEngramProtocol(ctx) {
     return !hasEngramPlugin(ctx.configDir);
   },
   paths(configDir) {
     return {
-      systemPromptFile: path8.join(configDir, "CLAUDE.md"),
-      agentsDir: path8.join(configDir, "agents"),
-      skillsDir: path8.join(configDir, "skills"),
-      commandsDir: path8.join(configDir, "commands"),
+      systemPromptFile: path7.join(configDir, "CLAUDE.md"),
+      agentsDir: path7.join(configDir, "agents"),
+      skillsDir: path7.join(configDir, "skills"),
+      commandsDir: path7.join(configDir, "commands"),
       pluginsDir: null,
-      scriptsDir: path8.join(configDir, "scripts"),
-      outputStylesDir: path8.join(configDir, "output-styles"),
+      scriptsDir: path7.join(configDir, "scripts"),
+      outputStylesDir: path7.join(configDir, "output-styles"),
       profilesDir: null
     };
   },
@@ -1025,9 +1153,9 @@ ${agent.body}`,
   planHooks(canonical, ctx) {
     const actions = [];
     const { scriptsDir } = this.paths(ctx.configDir);
-    const original = readTextIfExists(path8.join(ctx.configDir, "settings.json"));
+    const original = readTextIfExists(path7.join(ctx.configDir, "settings.json"));
     const contentSource = original === null || original.trim() === "" ? null : original;
-    const settingsFile = path8.join(ctx.configDir, "settings.json");
+    const settingsFile = path7.join(ctx.configDir, "settings.json");
     let content = upsertNativeHooks(contentSource, canonical, scriptsDir);
     const defaults = loadCanonicalDefaults(ctx.stackDir)["claude-code"];
     if (contentSource === null && defaults?.["permissions"] !== void 0) {
@@ -1041,16 +1169,16 @@ ${agent.body}`,
       });
     }
     actions.push({ kind: "write", target: settingsFile, content });
-    const scriptsSource = path8.join(ctx.stackDir, "scripts");
+    const scriptsSource = path7.join(ctx.stackDir, "scripts");
     if (fs4.existsSync(scriptsSource)) {
       for (const f of fs4.readdirSync(scriptsSource)) {
-        actions.push({ kind: "copy", source: path8.join(scriptsSource, f), target: path8.join(scriptsDir, f) });
+        actions.push({ kind: "copy", source: path7.join(scriptsSource, f), target: path7.join(scriptsDir, f) });
       }
     }
     return actions;
   },
   planMainConfig(canonical, ctx) {
-    const file = path8.join(path8.dirname(ctx.configDir), `${path8.basename(ctx.configDir)}.json`);
+    const file = path7.join(path7.dirname(ctx.configDir), `${path7.basename(ctx.configDir)}.json`);
     const mcpOwnership = [];
     const content = upsertJson(readTextIfExists(file), (root) => {
       const servers = root["mcpServers"] ??= {};
@@ -1115,7 +1243,7 @@ ${agent.body}`,
       content = removeMarkdownSection(content, "browser");
       actions.push({ kind: "write", target: systemPromptFile, content });
     }
-    const settingsFile = path8.join(ctx.configDir, "settings.json");
+    const settingsFile = path7.join(ctx.configDir, "settings.json");
     const settings = readTextIfExists(settingsFile);
     if (settings !== null) {
       const content = removeNativeHooks(settings, hooks);
@@ -1123,7 +1251,7 @@ ${agent.body}`,
         actions.push({ kind: "write", target: settingsFile, content: content.trim() === "{}" ? "" : content });
       }
     }
-    const mainFile = path8.join(path8.dirname(ctx.configDir), `${path8.basename(ctx.configDir)}.json`);
+    const mainFile = path7.join(path7.dirname(ctx.configDir), `${path7.basename(ctx.configDir)}.json`);
     const main2 = readTextIfExists(mainFile);
     if (main2 !== null) {
       const mcpOwnership = [];
@@ -1149,7 +1277,7 @@ ${agent.body}`,
 };
 
 // src/adapters/codex.ts
-import path9 from "path";
+import path8 from "path";
 import fs5 from "fs";
 function tomlString(value) {
   return JSON.stringify(value);
@@ -1173,37 +1301,194 @@ function isManagedOptionalStdioServer3(server, section) {
   return server.optional === true && server.transport === "stdio" && section?.trim() === stdioMcpSection(server);
 }
 function hasActiveEngramPlugin(configDir) {
-  const config = readTextIfExists(path9.join(configDir, "config.toml"));
+  const config = readTextIfExists(path8.join(configDir, "config.toml"));
   if (config === null) return false;
   const match = /\[plugins\."engram@[^"]*"\]([^[]*)/.exec(config);
   return match !== null && !/enabled\s*=\s*false/.test(match[1]);
 }
 function hasEngramProtocol(configDir) {
   if (hasActiveEngramPlugin(configDir)) return true;
-  if (fs5.existsSync(path9.join(configDir, "engram-instructions.md"))) return true;
-  const config = readTextIfExists(path9.join(configDir, "config.toml"));
+  if (fs5.existsSync(path8.join(configDir, "engram-instructions.md"))) return true;
+  const config = readTextIfExists(path8.join(configDir, "config.toml"));
   return config !== null && /engram-instructions\.md/.test(config);
 }
+var CODEX_JSON_STRING = String.raw`"(?:\\.|[^"\\\r\n])*"`;
+var CODEX_JSON_VALUE = String.raw`(?:${CODEX_JSON_STRING}|-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?|true|false)`;
+var CODEX_JSON_STRING_ARRAY = String.raw`\[(?:\s*${CODEX_JSON_STRING}(?:\s*,\s*${CODEX_JSON_STRING})*\s*)?\]`;
+var CODEX_KEY = String.raw`(?:[A-Za-z0-9_-]+|${CODEX_JSON_STRING})`;
+var CODEX_ASSIGNMENT = new RegExp(String.raw`^\s*(${CODEX_KEY})\s*=\s*(${CODEX_JSON_STRING_ARRAY}|${CODEX_JSON_VALUE})\s*(?:#.*)?$`);
+var CODEX_HEADER = new RegExp(String.raw`^\[\s*(${CODEX_KEY}(?:\s*\.\s*${CODEX_KEY})*)\s*\]\s*(?:#.*)?$`);
+var CODEX_PERMISSION_HEADERS = {
+  base: "permissions.jorgex-read-anywhere",
+  filesystem: "permissions.jorgex-read-anywhere.filesystem",
+  workspaceRoots: 'permissions.jorgex-read-anywhere.filesystem.":workspace_roots"'
+};
+var CODEX_PERMISSION_PROFILE = {
+  base: [["extends", ":workspace"]],
+  filesystem: [
+    [":root", "read"],
+    ["*.env", "deny"],
+    ["*.env.*", "deny"],
+    ["~/.ssh/**", "deny"],
+    ["~/.aws/credentials", "deny"],
+    ["~/.npmrc", "deny"],
+    ["~/.git-credentials", "deny"],
+    ["**/id_rsa", "deny"],
+    ["**/id_ed25519", "deny"],
+    ["**/*.pem", "deny"],
+    ["**/*.key", "deny"]
+  ],
+  workspaceRoots: [
+    [".", "write"],
+    ["*.env", "deny"],
+    ["*.env.*", "deny"],
+    [".ssh/**", "deny"],
+    [".aws/credentials", "deny"],
+    [".npmrc", "deny"],
+    [".git-credentials", "deny"],
+    ["**/id_rsa", "deny"],
+    ["**/id_ed25519", "deny"],
+    ["**/*.pem", "deny"],
+    ["**/*.key", "deny"]
+  ]
+};
+var CODEX_PERMISSION_SECTIONS = [
+  { header: CODEX_PERMISSION_HEADERS.base, entries: CODEX_PERMISSION_PROFILE.base, quoteKeys: false },
+  { header: CODEX_PERMISSION_HEADERS.filesystem, entries: CODEX_PERMISSION_PROFILE.filesystem, quoteKeys: true },
+  { header: CODEX_PERMISSION_HEADERS.workspaceRoots, entries: CODEX_PERMISSION_PROFILE.workspaceRoots, quoteKeys: true }
+];
+function renderCodexPermissionEntries(entries, quoteKeys) {
+  return entries.map(([key, value]) => `${quoteKeys ? JSON.stringify(key) : key} = ${JSON.stringify(value)}`).join("\n");
+}
+function parseCodexKey(raw) {
+  if (!raw.startsWith('"')) return raw;
+  try {
+    const value = JSON.parse(raw);
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+function parseCodexValue(raw) {
+  try {
+    const value = JSON.parse(raw);
+    return Array.isArray(value) && value.every((item) => typeof item === "string") || !Array.isArray(value) && (value === null || typeof value !== "object") ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseCodexHeader(line) {
+  const match = CODEX_HEADER.exec(line.trim());
+  if (match === null) return null;
+  for (const quoted of match[1].match(/"(?:\\.|[^"\\\r\n])*"/g) ?? []) {
+    if (parseCodexKey(quoted) === null) return null;
+  }
+  return match[1].replace(/\s*\.\s*/g, ".");
+}
+function scanCodexToml(config) {
+  if (config.includes("'''") || config.includes('"""')) return null;
+  const root = /* @__PURE__ */ new Map();
+  const sections = /* @__PURE__ */ new Map();
+  const headers = /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
+  let section = null;
+  for (const line of config.replace(/\r\n/g, "\n").split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("[")) {
+      const header = parseCodexHeader(trimmed);
+      if (header === null || headers.has(header)) return null;
+      headers.add(header);
+      if (header.startsWith(`${CODEX_PERMISSION_HEADERS.base}.`) && !CODEX_PERMISSION_SECTIONS.some((entry) => entry.header === header)) {
+        return null;
+      }
+      section = header;
+      if (CODEX_PERMISSION_SECTIONS.some((entry) => entry.header === header)) sections.set(header, /* @__PURE__ */ new Map());
+      continue;
+    }
+    const relevant = section === null || CODEX_PERMISSION_SECTIONS.some((entry) => entry.header === section);
+    const match = CODEX_ASSIGNMENT.exec(trimmed);
+    if (!relevant && match === null) continue;
+    if (match === null) return null;
+    const key = parseCodexKey(match[1]);
+    const value = parseCodexValue(match[2]);
+    if (key === null || value === void 0) return null;
+    if (section === null && (key === "profile" || key === "sandbox_mode")) return null;
+    const scope = section ?? "<root>";
+    const declaration = `${scope}\0${key}`;
+    if (keys.has(declaration)) return null;
+    keys.add(declaration);
+    if (section === null) root.set(key, value);
+    else if (sections.has(section)) sections.get(section).set(key, value);
+  }
+  return { root, sections };
+}
+function hasCanonicalCodexPermissionProfile(scan) {
+  for (const { header, entries } of CODEX_PERMISSION_SECTIONS) {
+    const actual = scan.sections.get(header);
+    if (actual === void 0 || actual.size !== entries.length) return false;
+    for (const [key, expected] of entries) {
+      if (actual.get(key) !== expected) return false;
+    }
+  }
+  return true;
+}
+function hasCodexManualApproval(configDir) {
+  const config = readTextIfExists(path8.join(configDir, "config.toml"));
+  if (config === null) return false;
+  const scan = scanCodexToml(config);
+  if (scan === null) return false;
+  try {
+    const defaults = loadCanonicalDefaults(stackRoot())["codex"];
+    const expectedApproval = defaults?.["approval_policy"];
+    const expectedPermissions = defaults?.["default_permissions"];
+    return typeof expectedApproval === "string" && typeof expectedPermissions === "string" && scan.root.get("approval_policy") === expectedApproval && scan.root.get("default_permissions") === expectedPermissions && hasCanonicalCodexPermissionProfile(scan);
+  } catch {
+    return false;
+  }
+}
 var codexAdapter = {
   id: "codex",
   name: "Codex CLI",
   detect: detectCodex,
+  reportCapabilities(configDir) {
+    const prompt = readTextIfExists(path8.join(configDir, "AGENTS.md"));
+    return createLocalCapabilityReport("codex", [
+      ...hasManagedMarkdownSection(prompt, "system-prompt") ? [{
+        id: "policy-guidance",
+        state: "prompt-only",
+        reason: "The managed policy prompt is advisory and cannot enforce the policy",
+        evidence: { source: "jorgex-stack-system-prompt", version: "1" }
+      }] : [],
+      ...hasCodexManualApproval(configDir) ? [{
+        id: "tool-approval",
+        state: "manual",
+        reason: "Canonical approval declarations require a human decision; runtime activation is not certified",
+        evidence: { source: "jorgex-stack-codex-approval-policy", version: "1" }
+      }] : [],
+      {
+        id: "external-verification",
+        state: "unavailable",
+        reason: "External verification is available only through the external verifier"
+      }
+    ]);
+  },
   injectEngramProtocol(ctx) {
     return !hasEngramProtocol(ctx.configDir);
   },
   paths(configDir) {
-    const isRealConfigDir = samePath(configDir, process.env.CODEX_HOME ?? path9.join(HOME, ".codex"));
-    const agentsHome = isRealConfigDir ? HOME : path9.dirname(configDir);
-    const skillsDir = path9.join(agentsHome, ".agents", "skills");
+    const isRealConfigDir = samePath(configDir, process.env.CODEX_HOME ?? path8.join(HOME, ".codex"));
+    const agentsHome = isRealConfigDir ? HOME : path8.dirname(configDir);
+    const skillsDir = path8.join(agentsHome, ".agents", "skills");
     return {
-      systemPromptFile: path9.join(configDir, "AGENTS.md"),
-      agentsDir: path9.join(configDir, "agents"),
+      systemPromptFile: path8.join(configDir, "AGENTS.md"),
+      agentsDir: path8.join(configDir, "agents"),
       skillsDir,
       // Los custom prompts de Codex están deprecados: los commands se
       // instalan como skills (renderCommand produce <nombre>/SKILL.md).
       commandsDir: skillsDir,
       pluginsDir: null,
-      scriptsDir: path9.join(configDir, "scripts"),
+      scriptsDir: path8.join(configDir, "scripts"),
       outputStylesDir: null,
       profilesDir: configDir
     };
@@ -1251,7 +1536,7 @@ ${body}`
   planHooks(canonical, ctx) {
     const actions = [];
     const { scriptsDir } = this.paths(ctx.configDir);
-    const hooksFile = path9.join(ctx.configDir, "hooks.json");
+    const hooksFile = path8.join(ctx.configDir, "hooks.json");
     const content = upsertNativeHooks(
       readTextIfExists(hooksFile),
       canonical,
@@ -1262,16 +1547,16 @@ ${body}`
     ctx.warnings.push(
       "Codex: los hooks no-managed requieren aprobaci\xF3n manual \u2014 ejecuta /hooks dentro de codex para activarlos."
     );
-    const scriptsSource = path9.join(ctx.stackDir, "scripts");
+    const scriptsSource = path8.join(ctx.stackDir, "scripts");
     if (fs5.existsSync(scriptsSource)) {
       for (const f of fs5.readdirSync(scriptsSource)) {
-        actions.push({ kind: "copy", source: path9.join(scriptsSource, f), target: path9.join(scriptsDir, f) });
+        actions.push({ kind: "copy", source: path8.join(scriptsSource, f), target: path8.join(scriptsDir, f) });
       }
     }
     return actions;
   },
   planMainConfig(canonical, ctx) {
-    const file = path9.join(ctx.configDir, "config.toml");
+    const file = path8.join(ctx.configDir, "config.toml");
     const original = readTextIfExists(file);
     const contentSource = original === null || original.trim() === "" ? null : original;
     let content = contentSource;
@@ -1287,37 +1572,20 @@ ${body}`
       ctx.warnings.push(
         "Codex: fresh config enables read-anywhere via the jorgex-read-anywhere permission profile; broad local reads can expose secrets not covered by deny rules."
       );
-      content = upsertTomlSection(content, "permissions.jorgex-read-anywhere", 'extends = ":workspace"');
       content = upsertTomlSection(
         content,
-        "permissions.jorgex-read-anywhere.filesystem",
-        [
-          '":root" = "read"',
-          '"*.env" = "deny"',
-          '"*.env.*" = "deny"',
-          '"~/.ssh/**" = "deny"',
-          '"~/.aws/credentials" = "deny"',
-          '"~/.npmrc" = "deny"',
-          '"~/.git-credentials" = "deny"',
-          '"**/id_rsa" = "deny"',
-          '"**/id_ed25519" = "deny"',
-          '"**/*.pem" = "deny"',
-          '"**/*.key" = "deny"'
-        ].join("\n")
+        CODEX_PERMISSION_HEADERS.base,
+        renderCodexPermissionEntries(CODEX_PERMISSION_PROFILE.base, false)
+      );
+      content = upsertTomlSection(
+        content,
+        CODEX_PERMISSION_HEADERS.filesystem,
+        renderCodexPermissionEntries(CODEX_PERMISSION_PROFILE.filesystem, true)
       );
       content += [
-        '\n[permissions.jorgex-read-anywhere.filesystem.":workspace_roots"]',
-        '"." = "write"',
-        '"*.env" = "deny"',
-        '"*.env.*" = "deny"',
-        '".ssh/**" = "deny"',
-        '".aws/credentials" = "deny"',
-        '".npmrc" = "deny"',
-        '".git-credentials" = "deny"',
-        '"**/id_rsa" = "deny"',
-        '"**/id_ed25519" = "deny"',
-        '"**/*.pem" = "deny"',
-        '"**/*.key" = "deny"',
+        `
+[${CODEX_PERMISSION_HEADERS.workspaceRoots}]`,
+        renderCodexPermissionEntries(CODEX_PERMISSION_PROFILE.workspaceRoots, true),
         ""
       ].join("\n");
     }
@@ -1407,7 +1675,7 @@ args = [${(server.args ?? []).map(tomlString).join(", ")}]`);
       content = removeMarkdownSection(content, "browser");
       actions.push({ kind: "write", target: systemPromptFile, content });
     }
-    const configFile = path9.join(ctx.configDir, "config.toml");
+    const configFile = path8.join(ctx.configDir, "config.toml");
     const config = readTextIfExists(configFile);
     if (config !== null) {
       let content = config;
@@ -1442,7 +1710,7 @@ args = [${(server.args ?? []).map(tomlString).join(", ")}]`);
         ...primaryModelOwnership.length > 0 ? { primaryModelOwnership } : {}
       });
     }
-    const hooksFile = path9.join(ctx.configDir, "hooks.json");
+    const hooksFile = path8.join(ctx.configDir, "hooks.json");
     const hooksJson = readTextIfExists(hooksFile);
     if (hooksJson !== null) {
       const content = removeNativeHooks(hooksJson, hooks);
@@ -1456,7 +1724,7 @@ args = [${(server.args ?? []).map(tomlString).join(", ")}]`);
 
 // src/lib/install-mode.ts
 import fs6 from "fs";
-import path10 from "path";
+import path9 from "path";
 var INSTALL_MODES = /* @__PURE__ */ new Set(["human", "programmatic"]);
 var SUBAGENT_CONCURRENCIES = /* @__PURE__ */ new Set(["serial", "parallel"]);
 var DEFAULT_INSTALL_MODE_PREFERENCE = {
@@ -1464,7 +1732,7 @@ var DEFAULT_INSTALL_MODE_PREFERENCE = {
   subagentConcurrency: "serial"
 };
 function installModePreferenceFile() {
-  return path10.join(dataDir(), "install-mode.json");
+  return path9.join(dataDir(), "install-mode.json");
 }
 function hasInstallModePreference(file = installModePreferenceFile()) {
   return fs6.existsSync(file);
@@ -1539,11 +1807,11 @@ function parseInstallModePreferenceFlags(mode, subagentConcurrency) {
 
 // src/lib/backup.ts
 import fs7 from "fs";
-import path11 from "path";
+import path10 from "path";
 import crypto from "crypto";
 var KEEP_BACKUPS = 10;
 function backupsRoot() {
-  return path11.join(dataDir(), "backups");
+  return path10.join(dataDir(), "backups");
 }
 function compositeChecksum(files) {
   const hash = crypto.createHash("sha256");
@@ -1562,19 +1830,19 @@ function createBackup(files, label, root = backupsRoot()) {
   if (latest?.checksum === checksum) return latest;
   const base = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${label}`;
   let id = base;
-  let dir = path11.join(root, id);
+  let dir = path10.join(root, id);
   for (let n = 1; fs7.existsSync(dir); n++) {
     id = `${base}-${n}`;
-    dir = path11.join(root, id);
+    dir = path10.join(root, id);
   }
-  ensureDir(path11.join(dir, "files"));
+  ensureDir(path10.join(dir, "files"));
   const entries = existing.map((original, i) => {
-    const stored = path11.join(dir, "files", `${String(i).padStart(4, "0")}-${path11.basename(original)}`);
+    const stored = path10.join(dir, "files", `${String(i).padStart(4, "0")}-${path10.basename(original)}`);
     fs7.copyFileSync(original, stored);
     return { original, stored };
   });
   const info = { id, label, createdAt: (/* @__PURE__ */ new Date()).toISOString(), files: entries, checksum };
-  writeText(path11.join(dir, "manifest.json"), JSON.stringify(info, null, 2) + "\n");
+  writeText(path10.join(dir, "manifest.json"), JSON.stringify(info, null, 2) + "\n");
   pruneBackups(root);
   return info;
 }
@@ -1583,7 +1851,7 @@ function listBackups(root = backupsRoot()) {
   const infos = [];
   for (const entry of fs7.readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const manifest = readTextIfExists(path11.join(root, entry.name, "manifest.json"));
+    const manifest = readTextIfExists(path10.join(root, entry.name, "manifest.json"));
     if (manifest === null) continue;
     try {
       infos.push(JSON.parse(manifest));
@@ -1600,7 +1868,7 @@ function restoreBackup(id, root = backupsRoot(), boundary = HOME) {
   for (const { original, stored } of info.files) {
     if (!fs7.existsSync(stored)) continue;
     if (!isContainedIn(original, boundary)) continue;
-    ensureDir(path11.dirname(original));
+    ensureDir(path10.dirname(original));
     fs7.copyFileSync(stored, original);
     restored++;
   }
@@ -1609,15 +1877,15 @@ function restoreBackup(id, root = backupsRoot(), boundary = HOME) {
 function pruneBackups(root) {
   const all = listBackups(root);
   for (const old of all.slice(KEEP_BACKUPS)) {
-    fs7.rmSync(path11.join(root, old.id), { recursive: true, force: true });
+    fs7.rmSync(path10.join(root, old.id), { recursive: true, force: true });
   }
 }
 
 // src/lib/manifest.ts
 import fs8 from "fs";
-import path12 from "path";
+import path11 from "path";
 function manifestFile() {
-  return path12.join(dataDir(), "manifest.json");
+  return path11.join(dataDir(), "manifest.json");
 }
 function readManifest(file = manifestFile()) {
   const raw = readTextIfExists(file);
@@ -1641,24 +1909,24 @@ function removeRuntimeManifest(id, file = manifestFile()) {
   writeText(file, JSON.stringify(manifest, null, 2) + "\n");
 }
 function findOrphans(prevOwned, currentTargets, root = HOME) {
-  return prevOwned.map((f) => path12.resolve(f)).filter(
-    (f) => !currentTargets.has(f) && path12.basename(f) !== "engram.ts" && isContainedIn(f, root) && fs8.existsSync(f)
+  return prevOwned.map((f) => path11.resolve(f)).filter(
+    (f) => !currentTargets.has(f) && path11.basename(f) !== "engram.ts" && isContainedIn(f, root) && fs8.existsSync(f)
   );
 }
 
 // src/components/system-prompt.ts
-import path14 from "path";
+import path13 from "path";
 import fs10 from "fs";
 
 // src/lib/mode-composition.ts
 import fs9 from "fs";
-import path13 from "path";
+import path12 from "path";
 var PROGRAMMATIC_ROOT = ["modes", "programmatic"];
 var PROGRAMMATIC_MARKER = "<!-- jorgex:programmatic-mode -->";
 var LEGACY_RESULT_CONTRACT_SECTION = /\n?##\s+Result contract[\s\S]*$/;
 var normalize = (value) => value.replace(/\r\n/g, "\n");
 function loadProgrammaticAddendum(stackDir, fileName) {
-  return normalize(fs9.readFileSync(path13.join(stackDir, ...PROGRAMMATIC_ROOT, fileName), "utf8")).trim();
+  return normalize(fs9.readFileSync(path12.join(stackDir, ...PROGRAMMATIC_ROOT, fileName), "utf8")).trim();
 }
 function appendAddendum(base, addendum) {
   const normalizedBase = normalize(base);
@@ -1701,15 +1969,15 @@ function composeProgrammaticAgentBody(stackDir, agent, mode, concurrency) {
 var normalize2 = (s) => s.replace(/\r\n/g, "\n");
 function planSystemPrompt(adapter, ctx) {
   const target = adapter.paths(ctx.configDir).systemPromptFile;
-  const agentsMd = normalize2(fs10.readFileSync(path14.join(ctx.stackDir, "system-prompt", "AGENTS.md"), "utf8"));
+  const agentsMd = normalize2(fs10.readFileSync(path13.join(ctx.stackDir, "system-prompt", "AGENTS.md"), "utf8"));
   const protocol = stripLeadingHtmlComments(
-    normalize2(fs10.readFileSync(path14.join(ctx.stackDir, "system-prompt", "engram-protocol.md"), "utf8"))
+    normalize2(fs10.readFileSync(path13.join(ctx.stackDir, "system-prompt", "engram-protocol.md"), "utf8"))
   );
   const composedAgentsMd = composeProgrammaticSystemPrompt(ctx.stackDir, agentsMd, ctx.mode);
   const browser = [
     ctx.playwrightCliEnabled ? "browser-playwright.md" : null,
     ctx.enabledMcpServers?.has(DEVTOOLS_MCP_SERVER) ? "browser-chrome-devtools.md" : null
-  ].filter((file) => file !== null).map((file) => normalize2(fs10.readFileSync(path14.join(ctx.stackDir, "system-prompt", file), "utf8"))).join("\n\n");
+  ].filter((file) => file !== null).map((file) => normalize2(fs10.readFileSync(path13.join(ctx.stackDir, "system-prompt", file), "utf8"))).join("\n\n");
   let content = readTextIfExists(target);
   content = upsertMarkdownSection(content, "system-prompt", composedAgentsMd);
   if (adapter.injectEngramProtocol(ctx)) {
@@ -1722,7 +1990,7 @@ function planSystemPrompt(adapter, ctx) {
 }
 
 // src/components/agents.ts
-import path15 from "path";
+import path14 from "path";
 function planAgents(adapter, ctx) {
   const { agentsDir, commandsDir, outputStylesDir, profilesDir, scriptsDir } = adapter.paths(ctx.configDir);
   const dirFor = {
@@ -1732,7 +2000,7 @@ function planAgents(adapter, ctx) {
     profile: profilesDir
   };
   const scriptsBase = scriptsDir.replace(/\\/g, "/");
-  return loadCanonicalAgents(path15.join(ctx.stackDir, "agents")).flatMap((agent) => {
+  return loadCanonicalAgents(path14.join(ctx.stackDir, "agents")).flatMap((agent) => {
     const composedAgent = {
       ...agent,
       body: composeProgrammaticAgentBody(ctx.stackDir, agent, ctx.mode, ctx.subagentConcurrency)
@@ -1744,42 +2012,42 @@ function planAgents(adapter, ctx) {
         return [];
       }
       const content = rendered.content.replace(/\{\{SCRIPTS_DIR\}\}/g, scriptsBase);
-      return [{ kind: "write", target: path15.join(dir, rendered.file), content }];
+      return [{ kind: "write", target: path14.join(dir, rendered.file), content }];
     });
   });
 }
 
 // src/components/skills.ts
-import path16 from "path";
+import path15 from "path";
 function planSkills(adapter, ctx) {
   const { skillsDir } = adapter.paths(ctx.configDir);
-  const source = path16.join(ctx.stackDir, "skills");
+  const source = path15.join(ctx.stackDir, "skills");
   return listFilesRecursive(source).map((file) => {
-    const relative = path16.relative(source, file);
-    return { kind: "copy", source: file, target: path16.join(skillsDir, relative) };
+    const relative = path15.relative(source, file);
+    return { kind: "copy", source: file, target: path15.join(skillsDir, relative) };
   });
 }
 
 // src/components/commands.ts
-import path17 from "path";
+import path16 from "path";
 import fs11 from "fs";
 function planCommands(adapter, ctx) {
   const { commandsDir } = adapter.paths(ctx.configDir);
-  const source = path17.join(ctx.stackDir, "commands");
+  const source = path16.join(ctx.stackDir, "commands");
   if (!fs11.existsSync(source)) return [];
   const commandFiles = [
     ...listMarkdownFiles(source),
-    ...listMarkdownFiles(path17.join(source, adapter.id))
+    ...listMarkdownFiles(path16.join(source, adapter.id))
   ];
   return commandFiles.map(({ file, fullPath }) => {
     const raw = fs11.readFileSync(fullPath, "utf8").replace(/\r\n/g, "\n");
     const rendered = adapter.renderCommand(file, raw);
-    return { kind: "write", target: path17.join(commandsDir, rendered.file), content: rendered.content };
+    return { kind: "write", target: path16.join(commandsDir, rendered.file), content: rendered.content };
   });
 }
 function listMarkdownFiles(dir) {
   if (!fs11.existsSync(dir)) return [];
-  return fs11.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => ({ file: entry.name, fullPath: path17.join(dir, entry.name) }));
+  return fs11.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => ({ file: entry.name, fullPath: path16.join(dir, entry.name) }));
 }
 
 // src/components/hooks.ts
@@ -1793,15 +2061,15 @@ function planMcp(adapter, ctx) {
 }
 
 // src/components/plugins.ts
-import path18 from "path";
+import path17 from "path";
 import fs12 from "fs";
 function planPlugins(adapter, ctx) {
   const { pluginsDir } = adapter.paths(ctx.configDir);
   if (pluginsDir === null) return [];
-  const source = path18.join(ctx.stackDir, "plugins", adapter.id);
+  const source = path17.join(ctx.stackDir, "plugins", adapter.id);
   if (!fs12.existsSync(source)) return [];
   return listFilesRecursive(source).filter((f) => f.endsWith(".ts")).map((sourceFile) => {
-    const target = path18.join(pluginsDir, path18.relative(source, sourceFile));
+    const target = path17.join(pluginsDir, path17.relative(source, sourceFile));
     const raw = fs12.readFileSync(sourceFile, "utf8");
     let content = raw;
     if (content.includes('"{{ENGRAM_BIN}}"')) {
@@ -1809,7 +2077,7 @@ function planPlugins(adapter, ctx) {
     }
     if (content.includes('"{{ENGRAM_PROTOCOL}}"')) {
       const protocol = stripLeadingHtmlComments(
-        fs12.readFileSync(path18.join(ctx.stackDir, "system-prompt", "engram-protocol.md"), "utf8").replace(/\r\n/g, "\n")
+        fs12.readFileSync(path17.join(ctx.stackDir, "system-prompt", "engram-protocol.md"), "utf8").replace(/\r\n/g, "\n")
       );
       content = content.replace(/"\{\{ENGRAM_PROTOCOL\}\}"/g, JSON.stringify(protocol));
     }
@@ -1821,8 +2089,8 @@ function planPlugins(adapter, ctx) {
 
 // src/lib/external-tools.ts
 import fs13 from "fs";
-import os2 from "os";
-import path19 from "path";
+import os from "os";
+import path18 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 var PLAYWRIGHT_CLI = {
   packageName: "@playwright/cli",
@@ -1873,9 +2141,9 @@ function resolvePnpmBin() {
   const pnpmCmd = lookPath("pnpm.cmd");
   return pnpmCmd !== null && !pnpmCmd.toLowerCase().endsWith(".ps1") ? pnpmCmd : null;
 }
-function isPlaywrightBrowserReady(env = process.env, platform = process.platform, homeDir = os2.homedir()) {
+function isPlaywrightBrowserReady(env = process.env, platform = process.platform, homeDir = os.homedir()) {
   const configuredPath = env.PLAYWRIGHT_BROWSERS_PATH;
-  const cacheDir = configuredPath ?? (platform === "win32" ? path19.join(env.LOCALAPPDATA ?? path19.join(homeDir, "AppData", "Local"), "ms-playwright") : platform === "darwin" ? path19.join(homeDir, "Library", "Caches", "ms-playwright") : path19.join(env.XDG_CACHE_HOME ?? path19.join(homeDir, ".cache"), "ms-playwright"));
+  const cacheDir = configuredPath ?? (platform === "win32" ? path18.join(env.LOCALAPPDATA ?? path18.join(homeDir, "AppData", "Local"), "ms-playwright") : platform === "darwin" ? path18.join(homeDir, "Library", "Caches", "ms-playwright") : path18.join(env.XDG_CACHE_HOME ?? path18.join(homeDir, ".cache"), "ms-playwright"));
   if (configuredPath === "0") return { status: "missing", path: cacheDir, errorCode: "DISABLED" };
   try {
     const ready = fs13.readdirSync(cacheDir, { withFileTypes: true }).some(
@@ -1923,7 +2191,7 @@ function executePlaywrightToolAction(action, pnpmBin = resolvePnpmBin()) {
 
 // src/lib/tool-preferences.ts
 import fs14 from "fs";
-import path20 from "path";
+import path19 from "path";
 var PLAYWRIGHT_CLI_PREFERENCE_VERSION = 1;
 var DEVTOOLS_MCP_PREFERENCE_VERSION = 1;
 var PRIMARY_MODEL_OWNERSHIP_VERSION = 1;
@@ -1936,7 +2204,7 @@ function readPreference(file) {
   }
 }
 function playwrightCliPreferenceFile(stateDir = dataDir()) {
-  return path20.join(stateDir, "playwright-cli.json");
+  return path19.join(stateDir, "playwright-cli.json");
 }
 function parsePlaywrightCliPreference(raw) {
   try {
@@ -1966,12 +2234,12 @@ function savePlaywrightCliPreference(file, enabled) {
   writeText(file, JSON.stringify({ version: PLAYWRIGHT_CLI_PREFERENCE_VERSION, enabled }) + "\n");
 }
 function devtoolsMcpPreferenceFile(stateDir = dataDir()) {
-  return path20.join(stateDir, "devtools-mcp.json");
+  return path19.join(stateDir, "devtools-mcp.json");
 }
 function primaryModelOwnershipFile(stateDir = dataDir()) {
-  return path20.join(stateDir, "primary-model.json");
+  return path19.join(stateDir, "primary-model.json");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isRuntimeId(value) {
@@ -1980,7 +2248,7 @@ function isRuntimeId(value) {
 function parseDevtoolsMcpState(raw) {
   try {
     const value = JSON.parse(raw);
-    if (!isRecord(value) || value.version !== DEVTOOLS_MCP_PREFERENCE_VERSION || !isRecord(value.enabled) || !isRecord(value.owned)) return null;
+    if (!isRecord2(value) || value.version !== DEVTOOLS_MCP_PREFERENCE_VERSION || !isRecord2(value.enabled) || !isRecord2(value.owned)) return null;
     const enabled = {};
     for (const [runtime, selected] of Object.entries(value.enabled)) {
       if (!isRuntimeId(runtime) || typeof selected !== "boolean") return null;
@@ -1988,7 +2256,7 @@ function parseDevtoolsMcpState(raw) {
     }
     const owned = {};
     for (const [runtime, servers] of Object.entries(value.owned)) {
-      if (!isRuntimeId(runtime) || !isRecord(servers)) return null;
+      if (!isRuntimeId(runtime) || !isRecord2(servers)) return null;
       const managed = {};
       for (const [server, marked] of Object.entries(servers)) {
         if (marked !== true) return null;
@@ -2044,13 +2312,13 @@ function saveDevtoolsMcpOwnership(file, runtime, server, owned) {
 function parsePrimaryModelOwnership(raw) {
   try {
     const value = JSON.parse(raw);
-    if (!isRecord(value) || value.version !== PRIMARY_MODEL_OWNERSHIP_VERSION || !isRecord(value.owned)) return null;
+    if (!isRecord2(value) || value.version !== PRIMARY_MODEL_OWNERSHIP_VERSION || !isRecord2(value.owned)) return null;
     const owned = {};
     for (const [runtime, configs] of Object.entries(value.owned)) {
-      if (!isRuntimeId(runtime) || !isRecord(configs)) return null;
+      if (!isRuntimeId(runtime) || !isRecord2(configs)) return null;
       const markedConfigs = {};
       for (const [configDir, fields] of Object.entries(configs)) {
-        if (configDir === "" || !isRecord(fields)) return null;
+        if (configDir === "" || !isRecord2(fields)) return null;
         const markedFields = {};
         for (const [field, state] of Object.entries(fields)) {
           if (field === "" || state !== true) return null;
@@ -2079,7 +2347,7 @@ function primaryModelOwnershipError(file = primaryModelOwnershipFile()) {
   return `Primary model: ownership inv\xE1lido en ${file}. Corrige o borra ese archivo antes de reintentar.`;
 }
 function primaryModelConfigKey(configDir) {
-  const resolved = path20.resolve(configDir);
+  const resolved = path19.resolve(configDir);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function loadPrimaryModelOwnership(file, runtime, configDir) {
@@ -2225,7 +2493,7 @@ function collectAllCurrentTargets(mode = DEFAULT_INSTALL_MODE_PREFERENCE) {
       continue;
     }
     try {
-      for (const action of buildPlan(adapter, ctx)) targets.add(path21.resolve(action.target));
+      for (const action of buildPlan(adapter, ctx)) targets.add(path20.resolve(action.target));
     } catch (error) {
       complete = false;
       warnings.push(
@@ -2327,10 +2595,10 @@ async function runInstall(opts) {
     }
     const writeManifest = () => {
       if (!useManifest) return;
-      const unmergeTargets = new Set(adapter.planUnmerge(canonicalMcp, canonicalHooks, ctx).map((a) => path21.resolve(a.target)));
+      const unmergeTargets = new Set(adapter.planUnmerge(canonicalMcp, canonicalHooks, ctx).map((a) => path20.resolve(a.target)));
       const keepTarget = (target) => !unmergeTargets.has(target);
-      const liveOwned = plan.map((a) => path21.resolve(a.target)).filter(keepTarget);
-      const previousOwned = (prevManifest?.owned ?? []).map((target) => path21.resolve(target)).filter(keepTarget);
+      const liveOwned = plan.map((a) => path20.resolve(a.target)).filter(keepTarget);
+      const previousOwned = (prevManifest?.owned ?? []).map((target) => path20.resolve(target)).filter(keepTarget);
       const owned = canOrphan ? liveOwned : [.../* @__PURE__ */ new Set([...previousOwned, ...liveOwned])];
       writeRuntimeManifest(id, { configDir, owned, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
     };
@@ -2359,7 +2627,7 @@ async function runInstall(opts) {
     const backup = useManifest ? createBackup([...updates.map((c) => c.action.target), ...orphans], `install-${id}`) : null;
     if (backup) p.log.info(`Backup: ${backup.id} (${backup.files.length} archivos)`);
     applyChanges(changes, useManifest ? (action) => persistConfigurationOwnershipChanges(id, configDir, [action]) : void 0);
-    const pruneRoot = useManifest ? HOME : path21.dirname(configDir);
+    const pruneRoot = useManifest ? HOME : path20.dirname(configDir);
     for (const orphan of orphans) {
       fs15.rmSync(orphan, { force: true });
       pruneEmptyDirs(orphan, pruneRoot);
@@ -2444,27 +2712,27 @@ async function runInstall(opts) {
 
 // src/uninstall.ts
 import fs17 from "fs";
-import path25 from "path";
+import path24 from "path";
 import * as p2 from "@clack/prompts";
 
 // src/lib/pi-projection-lifecycle.ts
 import fs16 from "fs";
-import path24 from "path";
+import path23 from "path";
 
 // src/adapters/pi.ts
-import path22 from "path";
+import path21 from "path";
 var piAdapter = {
   id: "pi",
   paths(configDir) {
-    const piConfigDir = process.env.PI_CODING_AGENT_DIR ?? path22.join(HOME, ".pi", "agent");
-    const agentsHome = samePath(configDir, piConfigDir) ? HOME : path22.join(path22.dirname(configDir), "home");
+    const piConfigDir = process.env.PI_CODING_AGENT_DIR ?? path21.join(HOME, ".pi", "agent");
+    const agentsHome = samePath(configDir, piConfigDir) ? HOME : path21.join(path21.dirname(configDir), "home");
     return {
-      systemPromptFile: path22.join(configDir, "AGENTS.md"),
-      agentsDir: path22.join(configDir, "agents"),
-      skillsDir: path22.join(agentsHome, ".agents", "skills"),
-      commandsDir: path22.join(configDir, "prompts"),
+      systemPromptFile: path21.join(configDir, "AGENTS.md"),
+      agentsDir: path21.join(configDir, "agents"),
+      skillsDir: path21.join(agentsHome, ".agents", "skills"),
+      commandsDir: path21.join(configDir, "prompts"),
       pluginsDir: null,
-      scriptsDir: path22.join(configDir, "scripts"),
+      scriptsDir: path21.join(configDir, "scripts"),
       outputStylesDir: null,
       profilesDir: null
     };
@@ -2478,7 +2746,7 @@ var piAdapter = {
 };
 
 // src/lib/pi-package-lifecycle.ts
-import path23 from "path";
+import path22 from "path";
 var REQUIRED_CAPABILITIES = /* @__PURE__ */ new Set([
   "foundation-contract-v1",
   "runner-json-v1",
@@ -2610,7 +2878,7 @@ function parseReceiptShape(receiptJson) {
       return null;
     }
     if (engram === void 0) return "upgrade-required";
-    if (engram === null || typeof engram !== "object" || Array.isArray(engram) || typeof Reflect.get(engram, "binary") !== "string" || !path23.isAbsolute(Reflect.get(engram, "binary"))) {
+    if (engram === null || typeof engram !== "object" || Array.isArray(engram) || typeof Reflect.get(engram, "binary") !== "string" || !path22.isAbsolute(Reflect.get(engram, "binary"))) {
       return null;
     }
     return parsed;
@@ -2647,7 +2915,7 @@ function planPiPackageLifecycle(input) {
   if (input.receiptJson !== null) {
     const parsedReceipt = parseReceipt(input.receiptJson, input.candidate, {
       kind: input.scope.kind,
-      codingAgentDir: path23.resolve(input.scope.codingAgentDir)
+      codingAgentDir: path22.resolve(input.scope.codingAgentDir)
     }, input.engramBin);
     if (parsedReceipt === "upgrade-required") return blocked(input, "receipt-upgrade-required");
     if (parsedReceipt === null) return blocked(input, "receipt-corrupt");
@@ -2682,7 +2950,7 @@ function planPiPackageLifecycle(input) {
     },
     receipt: expectedReceipt(input.candidate, "installing", {
       kind: input.scope.kind,
-      codingAgentDir: path23.resolve(input.scope.codingAgentDir)
+      codingAgentDir: path22.resolve(input.scope.codingAgentDir)
     }, input.engramBin),
     ownership: ownership(true)
   };
@@ -2697,7 +2965,7 @@ function parseRunnerRecord(stdout, stderr, command, candidate, packageRunner) {
     const parsed = JSON.parse(body);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     const record = parsed;
-    if (record.schemaVersion !== candidate.contract.runner.schemaVersion || record.command !== command || record.ok !== true || record.package === null || typeof record.package !== "object" || record.package.name !== candidate.package.name || record.package.version !== candidate.package.version || typeof record.package.root !== "string" || !path23.isAbsolute(record.package.root) || path23.resolve(packageRunner) !== path23.resolve(record.package.root, "bin", "jorgex-pi.mjs")) {
+    if (record.schemaVersion !== candidate.contract.runner.schemaVersion || record.command !== command || record.ok !== true || record.package === null || typeof record.package !== "object" || record.package.name !== candidate.package.name || record.package.version !== candidate.package.version || typeof record.package.root !== "string" || !path22.isAbsolute(record.package.root) || path22.resolve(packageRunner) !== path22.resolve(record.package.root, "bin", "jorgex-pi.mjs")) {
       return null;
     }
     return record;
@@ -2783,10 +3051,10 @@ function validateOwnedOperationState(input) {
   }))) {
     return { kind: "blocked", reason: "receipt-untrusted" };
   }
-  if (receipt.scope.kind !== (input.paths.targetDir ? "target-dir" : "real") || path23.resolve(receipt.scope.codingAgentDir) !== path23.resolve(input.paths.codingAgentDir)) {
+  if (receipt.scope.kind !== (input.paths.targetDir ? "target-dir" : "real") || path22.resolve(receipt.scope.codingAgentDir) !== path22.resolve(input.paths.codingAgentDir)) {
     return { kind: "blocked", reason: "source-divergent" };
   }
-  if (input.engramBin !== null && path23.resolve(receipt.engram.binary) !== path23.resolve(input.engramBin)) {
+  if (input.engramBin !== null && path22.resolve(receipt.engram.binary) !== path22.resolve(input.engramBin)) {
     return { kind: "blocked", reason: "receipt-corrupt" };
   }
   const source = receipt.candidate.package.source;
@@ -2883,18 +3151,18 @@ var preparedPiProjectionUninstalls = /* @__PURE__ */ new WeakMap();
 function projectionScope(scope) {
   return {
     ...scope,
-    settingsFile: path24.join(scope.codingAgentDir, "settings.json")
+    settingsFile: path23.join(scope.codingAgentDir, "settings.json")
   };
 }
 function isInside(root, file) {
-  const relative = path24.relative(path24.resolve(root), path24.resolve(file));
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path24.sep}`) && !path24.isAbsolute(relative);
+  const relative = path23.relative(path23.resolve(root), path23.resolve(file));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path23.sep}`) && !path23.isAbsolute(relative);
 }
 function isManagedPath(scope, file) {
   return isInside(scope.home, file) || isInside(scope.codingAgentDir, file);
 }
 function isAllowedPath(scope, file) {
-  return isManagedPath(scope, file) || path24.resolve(file) === path24.resolve(scope.receiptFile);
+  return isManagedPath(scope, file) || path23.resolve(file) === path23.resolve(scope.receiptFile);
 }
 function projectedPiAdapter(scope) {
   const paths = piAdapter.paths(scope.codingAgentDir);
@@ -2902,7 +3170,7 @@ function projectedPiAdapter(scope) {
     ...piAdapter,
     paths: () => ({
       ...paths,
-      skillsDir: path24.join(scope.home, ".agents", "skills")
+      skillsDir: path23.join(scope.home, ".agents", "skills")
     })
   };
 }
@@ -2942,9 +3210,9 @@ function assertPlanContained(plan, scope) {
   }
 }
 function receiptFor(plan, scope) {
-  const systemPrompt = path24.join(scope.codingAgentDir, "AGENTS.md");
+  const systemPrompt = path23.join(scope.codingAgentDir, "AGENTS.md");
   const owned = [...new Set(
-    plan.map((action) => path24.resolve(action.target)).filter((target) => target !== systemPrompt)
+    plan.map((action) => path23.resolve(action.target)).filter((target) => target !== systemPrompt)
   )];
   return {
     schemaVersion: 1,
@@ -2996,8 +3264,8 @@ function realPiProjectionScope() {
   return {
     kind: "real",
     home: HOME,
-    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path24.join(HOME, ".pi", "agent"),
-    receiptFile: path24.join(dataDir(), "pi-projection-receipt.json")
+    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path23.join(HOME, ".pi", "agent"),
+    receiptFile: path23.join(dataDir(), "pi-projection-receipt.json")
   };
 }
 function readTextOnlyIfMissing(file) {
@@ -3035,13 +3303,13 @@ function manifestOwned(manifest) {
   return new Set([
     ...manifest.runtimes.codex?.owned ?? [],
     ...manifest.runtimes.opencode?.owned ?? []
-  ].map((file) => path24.resolve(file)));
+  ].map((file) => path23.resolve(file)));
 }
 function withoutManagedPromptSections(content) {
   return ["system-prompt", "engram-protocol", "browser"].reduce((current, section) => removeMarkdownSection(current, section), content);
 }
 function uniquePaths(paths) {
-  return [...new Set(paths.map((file) => path24.resolve(file)))];
+  return [...new Set(paths.map((file) => path23.resolve(file)))];
 }
 function blocked2(reason, paths, remedy) {
   return { kind: "blocked", reason, paths: uniquePaths(paths), remedy };
@@ -3114,7 +3382,7 @@ function preparePiProjectionUninstall(input, deps) {
   }
   const scope = projectionScope(input.scope);
   const expectedReceipt2 = expectedProjectionReceipt(input, scope);
-  const prompt = path24.join(scope.codingAgentDir, "AGENTS.md");
+  const prompt = path23.join(scope.codingAgentDir, "AGENTS.md");
   let existingPrompt;
   try {
     existingPrompt = deps.readText(prompt);
@@ -3122,7 +3390,7 @@ function preparePiProjectionUninstall(input, deps) {
     return cleanupFailure([prompt]);
   }
   const promptContent = existingPrompt === null ? null : withoutManagedPromptSections(existingPrompt);
-  const promptUpdate = promptContent === null || promptContent === existingPrompt ? null : { file: path24.resolve(prompt), content: promptContent };
+  const promptUpdate = promptContent === null || promptContent === existingPrompt ? null : { file: path23.resolve(prompt), content: promptContent };
   const receiptRead = readProjectionReceipt(scope.receiptFile, deps);
   if (receiptRead.kind === "unreadable") return receiptUnreadable(scope.receiptFile);
   let ownedToRemove = [];
@@ -3138,7 +3406,7 @@ function preparePiProjectionUninstall(input, deps) {
       return cleanupFailure([scope.receiptFile]);
     }
     ownedToRemove = receipt.owned.filter((owned) => !retained.has(owned));
-    receiptFile = path24.resolve(scope.receiptFile);
+    receiptFile = path23.resolve(scope.receiptFile);
     backupTargets = [...backupTargets, ...receipt.owned, receiptFile];
   }
   const backup = backupExisting(backupTargets, deps);
@@ -3194,7 +3462,7 @@ function runPiProjectionLifecycle(input, deps) {
   const expectedReceipt2 = receiptContent(receipt);
   const drifted = plan.filter((action) => hasActionDrift(action, deps));
   if (input.operation === "doctor") {
-    const paths = drifted.map((action) => path24.resolve(action.target));
+    const paths = drifted.map((action) => path23.resolve(action.target));
     const currentSettings2 = deps.readText(scope.settingsFile);
     if (currentSettings2 === null || filterProjectedPiPackage(currentSettings2, input.packageSource) !== currentSettings2) {
       paths.push(scope.settingsFile);
@@ -3225,12 +3493,12 @@ function runPiProjectionLifecycle(input, deps) {
   return { kind: "synced", changed: drifted.length > 0 || packageWillChange || receiptChanged };
 }
 function systemProjectionLifecycle(input) {
-  const targetRoot = input.targetDir === void 0 ? null : path24.resolve(input.targetDir);
+  const targetRoot = input.targetDir === void 0 ? null : path23.resolve(input.targetDir);
   const scope = targetRoot === null ? realPiProjectionScope() : {
     kind: "target-dir",
-    home: path24.join(targetRoot, "home"),
-    codingAgentDir: path24.join(targetRoot, "pi-agent"),
-    receiptFile: path24.join(targetRoot, "state", "pi-projection-receipt.json")
+    home: path23.join(targetRoot, "home"),
+    codingAgentDir: path23.join(targetRoot, "pi-agent"),
+    receiptFile: path23.join(targetRoot, "state", "pi-projection-receipt.json")
   };
   return {
     input: {
@@ -3246,7 +3514,7 @@ function systemProjectionLifecycle(input) {
       backup: (paths) => createBackup(
         paths,
         `pi-projection-${input.operation}`,
-        targetRoot === null ? void 0 : path24.join(targetRoot, "backups")
+        targetRoot === null ? void 0 : path23.join(targetRoot, "backups")
       ),
       writeText,
       copyFile,
@@ -3327,7 +3595,7 @@ async function runUninstall(opts) {
       if (!detection.installed) continue;
       const keepCtx = makeContext(keep, detection.configDir);
       if (!keepCtx) continue;
-      for (const action of buildPlan(keep, keepCtx)) retained.add(path25.resolve(action.target));
+      for (const action of buildPlan(keep, keepCtx)) retained.add(path24.resolve(action.target));
     }
   }
   for (const id of opts.runtimes) {
@@ -3346,15 +3614,15 @@ async function runUninstall(opts) {
     if (!ctx) continue;
     ctx.preserveEngram = !removeEngram;
     const unmerge = adapter.planUnmerge(mcpForUnmerge, hooks, ctx);
-    const mergedTargets = new Set(unmerge.map((a) => path25.resolve(a.target)));
+    const mergedTargets = new Set(unmerge.map((a) => path24.resolve(a.target)));
     const usingRealConfig = opts.targetDir === void 0;
     const prevOwned = usingRealConfig ? readManifest().runtimes[id]?.owned ?? [] : [];
-    const pruneRoot = usingRealConfig ? HOME : path25.dirname(configDir);
+    const pruneRoot = usingRealConfig ? HOME : path24.dirname(configDir);
     const planTargets = [
-      .../* @__PURE__ */ new Set([...buildPlan(adapter, ctx).map((a) => path25.resolve(a.target)), ...prevOwned.map((t) => path25.resolve(t))])
+      .../* @__PURE__ */ new Set([...buildPlan(adapter, ctx).map((a) => path24.resolve(a.target)), ...prevOwned.map((t) => path24.resolve(t))])
     ].filter((t) => !mergedTargets.has(t) && fs17.existsSync(t));
     const deleteTargets = planTargets.filter(
-      (t) => !retained.has(t) && !(ctx.preserveEngram && path25.basename(t) === "engram.ts") && isContainedIn(t, pruneRoot)
+      (t) => !retained.has(t) && !(ctx.preserveEngram && path24.basename(t) === "engram.ts") && isContainedIn(t, pruneRoot)
     );
     const sharedKept = planTargets.length - deleteTargets.length;
     p2.log.step(`${adapter.name} \u2192 ${configDir}`);
@@ -3434,7 +3702,7 @@ async function runUninstall(opts) {
 }
 
 // src/doctor.ts
-import path26 from "path";
+import path25 from "path";
 import fs18 from "fs";
 import * as p3 from "@clack/prompts";
 function engramVersion(bin) {
@@ -3454,7 +3722,7 @@ function resolvePlaywrightDoctorState(input) {
   return { status: "healthy" };
 }
 function context7KeyConfigured(id, configDir) {
-  const file = id === "codex" ? path26.join(configDir, "config.toml") : id === "claude-code" ? path26.join(path26.dirname(configDir), `${path26.basename(configDir)}.json`) : path26.join(configDir, "opencode.json");
+  const file = id === "codex" ? path25.join(configDir, "config.toml") : id === "claude-code" ? path25.join(path25.dirname(configDir), `${path25.basename(configDir)}.json`) : path25.join(configDir, "opencode.json");
   const content = readTextIfExists(file);
   if (content === null) return null;
   const match = /CONTEXT7_API_KEY"?\s*[:=]\s*"([^"]*)"/.exec(content);
@@ -3477,8 +3745,8 @@ async function runDoctor() {
       p3.log.success(`Engram: ${version} (${engramBin})`);
     }
   }
-  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path26.join(HOME, ".engram");
-  const engramDb = path26.join(engramDataDir, "engram.db");
+  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path25.join(HOME, ".engram");
+  const engramDb = path25.join(engramDataDir, "engram.db");
   if (fs18.existsSync(engramDb)) {
     const sizeMb = (fs18.statSync(engramDb).size / 1024 / 1024).toFixed(1);
     p3.log.info(`Engram DB: ${engramDb} (${sizeMb} MB de memorias \u2014 el stack no la toca JAM\xC1S).`);
@@ -3534,6 +3802,9 @@ async function runDoctor() {
       p3.log.warn(`${adapter.name}: no instalado en esta m\xE1quina.`);
       continue;
     }
+    const capabilityReport = adapter.reportCapabilities(detection.configDir);
+    const capabilitySummary = capabilityReport.capabilities.map((capability) => `${capability.id}=${capability.state}`).join(", ");
+    p3.log.info(`${adapter.name}: capabilities diagnostic (${capabilitySummary}); no certifica enforcement local.`);
     const ctx = makeContext(adapter, detection.configDir, modePreference);
     if (!ctx) continue;
     let pending;
@@ -3558,10 +3829,10 @@ async function runDoctor() {
       p3.log.warn(`${adapter.name}: ${orphans.length} archivos hu\xE9rfanos de versiones previas \u2192 ejecuta 'sync'.`);
       problems++;
     }
-    if (adapter.id === "codex" && fs18.existsSync(path26.join(detection.configDir, "hooks.json"))) {
+    if (adapter.id === "codex" && fs18.existsSync(path25.join(detection.configDir, "hooks.json"))) {
       p3.log.info("Codex: recuerda que los hooks requieren aprobaci\xF3n manual \u2014 verifica con /hooks dentro de codex.");
     }
-    if (adapter.id === "codex" && fs18.existsSync(path26.join(detection.configDir, "AGENTS.override.md"))) {
+    if (adapter.id === "codex" && fs18.existsSync(path25.join(detection.configDir, "AGENTS.override.md"))) {
       p3.log.warn(
         "Codex: existe ~/.codex/AGENTS.override.md \u2014 tiene prioridad ABSOLUTA y tapa el AGENTS.md gestionado por el stack."
       );
@@ -3576,16 +3847,16 @@ async function runDoctor() {
 
 // src/update.ts
 import fs21 from "fs";
-import path29 from "path";
-import os4 from "os";
+import path28 from "path";
+import os3 from "os";
 import { execFileSync as execFileSync5 } from "child_process";
 import * as p4 from "@clack/prompts";
 
 // src/lib/github.ts
 import fs19 from "fs";
-import path27 from "path";
+import path26 from "path";
 import { execFileSync as execFileSync3 } from "child_process";
-import os3 from "os";
+import os2 from "os";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 var cachedToken;
@@ -3653,7 +3924,7 @@ async function latestGithubCommit(repo) {
   }
 }
 function validateExtractedTree(destDir) {
-  const resolved = path27.resolve(destDir);
+  const resolved = path26.resolve(destDir);
   const walk = (dir) => {
     let entries;
     try {
@@ -3662,7 +3933,7 @@ function validateExtractedTree(destDir) {
       return false;
     }
     for (const entry of entries) {
-      const full = path27.join(dir, entry.name);
+      const full = path26.join(dir, entry.name);
       let stat;
       try {
         stat = fs19.lstatSync(full);
@@ -3681,12 +3952,12 @@ function validateExtractedTree(destDir) {
 }
 function resolveTarBin() {
   if (process.platform !== "win32") return "tar";
-  const winTar = path27.join(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "tar.exe");
+  const winTar = path26.join(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "tar.exe");
   return fs19.existsSync(winTar) ? winTar : "tar";
 }
 async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
   const url = `https://codeload.github.com/${repo}/tar.gz/${sha}`;
-  const tmp = path27.join(os3.tmpdir(), `jorgex-tarball-${Date.now()}.tar.gz`);
+  const tmp = path26.join(os2.tmpdir(), `jorgex-tarball-${Date.now()}.tar.gz`);
   const fail = (reason) => {
     try {
       fs19.rmSync(destDir, { recursive: true, force: true });
@@ -3719,8 +3990,8 @@ async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
       const detail = (e.stderr?.toString().trim() || e.message || "").split("\n")[0];
       return fail(detail ? `tar fall\xF3: ${detail}` : "tar no disponible o fall\xF3 la extracci\xF3n");
     }
-    const resolvedDest = path27.resolve(destDir);
-    const validateRoot = validateSubdir ? path27.resolve(resolvedDest, validateSubdir) : resolvedDest;
+    const resolvedDest = path26.resolve(destDir);
+    const validateRoot = validateSubdir ? path26.resolve(resolvedDest, validateSubdir) : resolvedDest;
     if (validateRoot !== resolvedDest && !isContainedIn(validateRoot, resolvedDest)) {
       return fail(`la ruta de validaci\xF3n "${validateSubdir}" escapa del destino`);
     }
@@ -3742,7 +4013,7 @@ async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
 
 // src/lib/skill-update.ts
 import fs20 from "fs";
-import path28 from "path";
+import path27 from "path";
 import { execFileSync as execFileSync4 } from "child_process";
 var PROTECTED_SKILLS = /* @__PURE__ */ new Set([
   "agent-delegation",
@@ -3761,10 +4032,10 @@ function sameTextContentNormalized(a, b) {
 }
 function diffSkillDirs(upstreamDir, localDir) {
   const upstreamFiles = new Set(
-    listFilesRecursive(upstreamDir).map((f) => path28.relative(upstreamDir, f))
+    listFilesRecursive(upstreamDir).map((f) => path27.relative(upstreamDir, f))
   );
   const localFiles = new Set(
-    listFilesRecursive(localDir).map((f) => path28.relative(localDir, f))
+    listFilesRecursive(localDir).map((f) => path27.relative(localDir, f))
   );
   const added = [];
   const modified = [];
@@ -3772,7 +4043,7 @@ function diffSkillDirs(upstreamDir, localDir) {
   for (const rel of upstreamFiles) {
     if (!localFiles.has(rel)) {
       added.push(rel);
-    } else if (!sameTextContentNormalized(path28.join(upstreamDir, rel), path28.join(localDir, rel))) {
+    } else if (!sameTextContentNormalized(path27.join(upstreamDir, rel), path27.join(localDir, rel))) {
       modified.push(rel);
     }
   }
@@ -3834,7 +4105,7 @@ function replaceSkill(name, upstreamSkillDir, newCommit, opts) {
   if (PROTECTED_SKILLS.has(name)) {
     throw new Error(`La skill "${name}" es propia del stack y no se actualiza desde upstream.`);
   }
-  const upstreamsFile = upstreamsFilePath ?? path28.join(path28.dirname(stackRoot()), "upstreams.json");
+  const upstreamsFile = upstreamsFilePath ?? path27.join(path27.dirname(stackRoot()), "upstreams.json");
   const raw = fs20.readFileSync(upstreamsFile, "utf8");
   const data = JSON.parse(raw);
   const skillEntry = data?.skills?.[name];
@@ -3844,8 +4115,8 @@ function replaceSkill(name, upstreamSkillDir, newCommit, opts) {
   if (skillEntry.kind === "release") {
     throw new Error(`La skill "${name}" es de tipo release y no se actualiza con replaceSkill.`);
   }
-  const skillsRoot = localSkillsRoot ?? path28.join(stackRoot(), "skills");
-  const localSkillDir = path28.join(skillsRoot, name);
+  const skillsRoot = localSkillsRoot ?? path27.join(stackRoot(), "skills");
+  const localSkillDir = path27.join(skillsRoot, name);
   const localFiles = listFilesRecursive(localSkillDir);
   if (localFiles.length > 0) {
     createBackup(localFiles, `skill-update-${name}`, backupsRoot2);
@@ -3858,9 +4129,9 @@ function replaceSkill(name, upstreamSkillDir, newCommit, opts) {
       if (st.isSymbolicLink()) {
         throw new Error(`Symlink rechazado en upstream de skill "${name}": ${src}`);
       }
-      const rel = path28.relative(upstreamSkillDir, src);
-      const dest = path28.join(stagingDir, rel);
-      ensureDir(path28.dirname(dest));
+      const rel = path27.relative(upstreamSkillDir, src);
+      const dest = path27.join(stagingDir, rel);
+      ensureDir(path27.dirname(dest));
       copyFile(src, dest);
     }
     const oldDir = `${localSkillDir}.old-${process.pid}`;
@@ -3885,7 +4156,7 @@ function rateLimitHint(prefix) {
   return ghPresentButTokenFailed() ? `${prefix} Tienes gh instalado pero \`gh auth token\` no devolvi\xF3 credencial (\xBFsesi\xF3n caducada?) \u2014 prueba \`gh auth login\` o define GH_TOKEN.` : `${prefix} Define GH_TOKEN o inicia sesi\xF3n en gh CLI.`;
 }
 function loadUpstreams() {
-  const file = path29.join(path29.dirname(stackRoot()), "upstreams.json");
+  const file = path28.join(path28.dirname(stackRoot()), "upstreams.json");
   return JSON.parse(fs21.readFileSync(file, "utf8"));
 }
 function skillsToScan(maintainer, upstreams) {
@@ -4035,8 +4306,8 @@ function isEngramRunning() {
     return null;
   }
 }
-function isGitClone(projectRoot = path29.dirname(stackRoot())) {
-  return fs21.existsSync(path29.join(projectRoot, ".git"));
+function isGitClone(projectRoot = path28.dirname(stackRoot())) {
+  return fs21.existsSync(path28.join(projectRoot, ".git"));
 }
 var STACK_METHOD_CLONE = "git pull + pnpm install + pnpm build";
 function resolvePnpm() {
@@ -4051,7 +4322,7 @@ function cleanupTmp(dir) {
   }
 }
 function updateStackGitClone() {
-  const projectRoot = path29.dirname(stackRoot());
+  const projectRoot = path28.dirname(stackRoot());
   const git = lookPath("git");
   if (!git) throw new Error("git no encontrado en PATH.");
   const pnpm = resolvePnpm();
@@ -4068,7 +4339,7 @@ function updateStackGlobal() {
   execFileSync5(pnpm, ["add", "-g", "jorgex-stack@latest"], { stdio: "inherit" });
 }
 async function downloadSkillToTemp(repo, sha, skillPath) {
-  const root = fs21.mkdtempSync(path29.join(os4.tmpdir(), "jorgex-skill-"));
+  const root = fs21.mkdtempSync(path28.join(os3.tmpdir(), "jorgex-skill-"));
   try {
     const result = await downloadRepoTarball(repo, sha, root, skillPath);
     if (!result.ok) {
@@ -4076,14 +4347,14 @@ async function downloadSkillToTemp(repo, sha, skillPath) {
       return { error: result.reason };
     }
     if (skillPath) {
-      const sub = path29.resolve(path29.join(root, skillPath));
+      const sub = path28.resolve(path28.join(root, skillPath));
       if (!isContainedIn(sub, root)) {
         cleanupTmp(root);
         return { error: `la ruta "${skillPath}" escapa del directorio temporal` };
       }
       if (fs21.existsSync(sub)) return { dir: sub, root };
       const lastSeg = skillPath.split("/").pop();
-      const sub2 = path29.resolve(path29.join(root, lastSeg));
+      const sub2 = path28.resolve(path28.join(root, lastSeg));
       if (isContainedIn(sub2, root) && fs21.existsSync(sub2)) {
         if (!validateExtractedTree(sub2)) {
           cleanupTmp(root);
@@ -4104,10 +4375,10 @@ function pruneEngramDbBackups() {
   try {
     const dir = dataDir();
     if (!fs21.existsSync(dir)) return;
-    const backups = fs21.readdirSync(dir).filter((f) => f.startsWith("engram-db-backup-") && f.endsWith(".db")).map((f) => ({ name: f, mtime: fs21.statSync(path29.join(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+    const backups = fs21.readdirSync(dir).filter((f) => f.startsWith("engram-db-backup-") && f.endsWith(".db")).map((f) => ({ name: f, mtime: fs21.statSync(path28.join(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
     for (const old of backups.slice(3)) {
       try {
-        fs21.rmSync(path29.join(dir, old.name));
+        fs21.rmSync(path28.join(dir, old.name));
       } catch {
       }
     }
@@ -4116,17 +4387,17 @@ function pruneEngramDbBackups() {
 }
 function rotateLockedBinary(binPath, sweepRoot = HOME) {
   if (!fs21.existsSync(binPath)) return null;
-  const dir = path29.dirname(binPath);
-  const base = path29.basename(binPath);
+  const dir = path28.dirname(binPath);
+  const base = path28.basename(binPath);
   const escapedBase = base.replace(/[.*+?^$()|[\]{}\\]/g, "\\$&");
   const oldPattern = new RegExp("^" + escapedBase + "\\.old-\\d+$");
-  const resolvedDir = path29.resolve(dir);
-  if (resolvedDir === path29.resolve(sweepRoot) || isContainedIn(resolvedDir, sweepRoot)) {
+  const resolvedDir = path28.resolve(dir);
+  if (resolvedDir === path28.resolve(sweepRoot) || isContainedIn(resolvedDir, sweepRoot)) {
     try {
       for (const entry of fs21.readdirSync(dir)) {
         if (oldPattern.test(entry)) {
           try {
-            fs21.rmSync(path29.join(dir, entry), { force: true });
+            fs21.rmSync(path28.join(dir, entry), { force: true });
           } catch {
           }
         }
@@ -4134,7 +4405,7 @@ function rotateLockedBinary(binPath, sweepRoot = HOME) {
     } catch {
     }
   }
-  const rotated = path29.join(dir, `${base}.old-${Date.now()}`);
+  const rotated = path28.join(dir, `${base}.old-${Date.now()}`);
   fs21.renameSync(binPath, rotated);
   return rotated;
 }
@@ -4144,8 +4415,8 @@ async function updateEngram(engramRepo, latestVersion) {
       "Engram est\xE1 en ejecuci\xF3n: los procesos vivos seguir\xE1n usando la versi\xF3n antigua hasta que reinicies los clientes (Claude Code/OpenCode/Codex)."
     );
   }
-  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path29.join(HOME, ".engram");
-  const engramDb = path29.join(engramDataDir, "engram.db");
+  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path28.join(HOME, ".engram");
+  const engramDb = path28.join(engramDataDir, "engram.db");
   if (fs21.existsSync(engramDb)) {
     const doBackup = await p4.confirm({
       message: `\xBFHacer backup de la DB de Engram antes de actualizar? (${engramDb})`,
@@ -4153,7 +4424,7 @@ async function updateEngram(engramRepo, latestVersion) {
     });
     if (!p4.isCancel(doBackup) && doBackup) {
       const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const dest = path29.join(dataDir(), `engram-db-backup-${ts}.db`);
+      const dest = path28.join(dataDir(), `engram-db-backup-${ts}.db`);
       try {
         if (!fs21.existsSync(dataDir())) fs21.mkdirSync(dataDir(), { recursive: true });
         fs21.copyFileSync(engramDb, dest);
@@ -4490,7 +4761,7 @@ async function runInteractiveUpdate(localVersion, yes, dryRun = false, includeBr
       continue;
     }
     const { dir: tmpDir, root: tmpRoot } = tmpResult;
-    const localSkillDir = path29.join(stackRoot(), "skills", skillInfo.name);
+    const localSkillDir = path28.join(stackRoot(), "skills", skillInfo.name);
     const diff = renderSkillDiff(tmpDir, localSkillDir);
     if (diff) {
       p4.log.info(`Diff de ${skillInfo.name}:
@@ -4576,7 +4847,7 @@ ${diff}`);
 }
 
 // src/models-picker.ts
-import path30 from "path";
+import path29 from "path";
 import * as p5 from "@clack/prompts";
 var TIERS = ["strong", "standard", "cheap"];
 var EFFORTS = ["low", "medium", "high", "xhigh"];
@@ -4600,7 +4871,7 @@ function opencodeLiveModels(binPath) {
 }
 function agentsByTier() {
   const grouped = { strong: [], standard: [], cheap: [] };
-  for (const agent of loadCanonicalAgents(path30.join(stackRoot(), "agents"))) {
+  for (const agent of loadCanonicalAgents(path29.join(stackRoot(), "agents"))) {
     if (agent.mode === "subagent") grouped[agent.tier].push(agent.name);
   }
   return grouped;
@@ -4781,15 +5052,15 @@ function cancelled() {
 
 // src/lib/release.ts
 import fs22 from "fs";
-import path31 from "path";
+import path30 from "path";
 import { execFileSync as execFileSync6 } from "child_process";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath } from "url";
 function findPackageJson() {
-  let dir = path31.dirname(fileURLToPath2(import.meta.url));
+  let dir = path30.dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 6; i++) {
-    const candidate = path31.join(dir, "package.json");
+    const candidate = path30.join(dir, "package.json");
     if (fs22.existsSync(candidate)) return candidate;
-    dir = path31.dirname(dir);
+    dir = path30.dirname(dir);
   }
   throw new Error("No se encontr\xF3 package.json cerca del CLI.");
 }
@@ -4809,8 +5080,8 @@ function readPackageMetadata() {
 }
 
 // src/lib/pi-runtime.ts
-import os5 from "os";
-import path32 from "path";
+import os4 from "os";
+import path31 from "path";
 import fs23 from "fs";
 import { spawnSync } from "child_process";
 import { createHash } from "crypto";
@@ -4964,14 +5235,14 @@ function healthyDoctor(stdout, stderr, packageRunner, candidate) {
     if (record === null || typeof record !== "object" || Array.isArray(record)) return false;
     const packageValue = Reflect.get(record, "package");
     const result = Reflect.get(record, "result");
-    return Reflect.get(record, "schemaVersion") === 1 && Reflect.get(record, "command") === "doctor" && Reflect.get(record, "ok") === true && packageValue !== null && typeof packageValue === "object" && Reflect.get(packageValue, "name") === "jorgex-pi" && Reflect.get(packageValue, "version") === (candidate.package?.version ?? /^npm:jorgex-pi@([^\s]+)$/.exec(candidate.source)?.[1]) && path32.resolve(packageRunner) === path32.resolve(String(Reflect.get(packageValue, "root")), "bin", "jorgex-pi.mjs") && result !== null && typeof result === "object" && Reflect.get(result, "healthy") === true;
+    return Reflect.get(record, "schemaVersion") === 1 && Reflect.get(record, "command") === "doctor" && Reflect.get(record, "ok") === true && packageValue !== null && typeof packageValue === "object" && Reflect.get(packageValue, "name") === "jorgex-pi" && Reflect.get(packageValue, "version") === (candidate.package?.version ?? /^npm:jorgex-pi@([^\s]+)$/.exec(candidate.source)?.[1]) && path31.resolve(packageRunner) === path31.resolve(String(Reflect.get(packageValue, "root")), "bin", "jorgex-pi.mjs") && result !== null && typeof result === "object" && Reflect.get(result, "healthy") === true;
   } catch {
     return false;
   }
 }
 function installPiFromVerifiedTarball(input, deps) {
   const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.piExecutable) : targetPaths(input.targetDir, input.engramBin, input.piExecutable);
-  const destination = input.targetDir === void 0 ? path32.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path32.join(path32.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
+  const destination = input.targetDir === void 0 ? path31.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path31.join(path31.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
   const artifact = deps.download(destination);
   if (artifact.bytes !== input.candidate.bytes || artifact.sha256 !== input.candidate.sha256 || artifact.sha512 !== input.candidate.sha512) {
     return { kind: "blocked", reason: "tarball-integrity" };
@@ -4979,7 +5250,7 @@ function installPiFromVerifiedTarball(input, deps) {
   deps.backupSettings();
   const scope = {
     kind: input.targetDir === void 0 ? "real" : "target-dir",
-    codingAgentDir: path32.resolve(paths.codingAgentDir)
+    codingAgentDir: path31.resolve(paths.codingAgentDir)
   };
   const installing = flatCandidateReceipt(input.candidate, scope, "installing", input.engramBin);
   deps.writeReceiptAtomic(`${JSON.stringify(installing)}
@@ -5008,30 +5279,30 @@ function installPiFromVerifiedTarball(input, deps) {
   return { kind: "installed", receipt };
 }
 function runtimePath(piExecutable) {
-  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path32.dirname(piExecutable), path32.dirname(process.execPath), process.env.SystemRoot ? path32.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path32.dirname(piExecutable), path32.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
-  return [...new Set(entries.filter((entry) => entry !== null))].join(path32.delimiter);
+  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path31.dirname(piExecutable), path31.dirname(process.execPath), process.env.SystemRoot ? path31.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path31.dirname(piExecutable), path31.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
+  return [...new Set(entries.filter((entry) => entry !== null))].join(path31.delimiter);
 }
 function targetPaths(targetDir, engramBin, piExecutable) {
-  const root = path32.resolve(targetDir);
-  const codingAgentDir = path32.join(root, "pi-agent");
-  const home = path32.join(root, "home");
-  const temporary = path32.join(root, "tmp");
+  const root = path31.resolve(targetDir);
+  const codingAgentDir = path31.join(root, "pi-agent");
+  const home = path31.join(root, "home");
+  const temporary = path31.join(root, "tmp");
   return {
     codingAgentDir,
-    receiptPath: path32.join(root, "state", "pi-receipt.json"),
-    packageRunner: path32.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path31.join(root, "state", "pi-receipt.json"),
+    packageRunner: path31.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
       USERPROFILE: home,
-      APPDATA: path32.join(root, "appdata"),
-      LOCALAPPDATA: path32.join(root, "localappdata"),
-      XDG_CONFIG_HOME: path32.join(root, "xdg-config"),
-      XDG_DATA_HOME: path32.join(root, "xdg-data"),
-      XDG_CACHE_HOME: path32.join(root, "xdg-cache"),
+      APPDATA: path31.join(root, "appdata"),
+      LOCALAPPDATA: path31.join(root, "localappdata"),
+      XDG_CONFIG_HOME: path31.join(root, "xdg-config"),
+      XDG_DATA_HOME: path31.join(root, "xdg-data"),
+      XDG_CACHE_HOME: path31.join(root, "xdg-cache"),
       TEMP: temporary,
       TMP: temporary,
       TMPDIR: temporary,
-      npm_config_cache: path32.join(root, "npm-cache"),
+      npm_config_cache: path31.join(root, "npm-cache"),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
       PI_CODING_AGENT_DIR: codingAgentDir,
@@ -5041,17 +5312,17 @@ function targetPaths(targetDir, engramBin, piExecutable) {
   };
 }
 function userPaths(engramBin, piExecutable) {
-  const home = os5.homedir();
-  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path32.join(home, ".pi", "agent");
+  const home = os4.homedir();
+  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path31.join(home, ".pi", "agent");
   return {
     codingAgentDir,
-    receiptPath: path32.join(dataDir(), "pi-receipt.json"),
-    packageRunner: path32.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path31.join(dataDir(), "pi-receipt.json"),
+    packageRunner: path31.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
-      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path32.join(home, ".config"),
-      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path32.join(home, ".cache"),
-      TMPDIR: os5.tmpdir(),
+      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path31.join(home, ".config"),
+      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path31.join(home, ".cache"),
+      TMPDIR: os4.tmpdir(),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
       PI_CODING_AGENT_DIR: codingAgentDir,
@@ -5078,7 +5349,7 @@ function runPiRuntime(input, deps) {
     return { kind: "blocked", reason: "tarball-integrity" };
   }
   const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.detected.executable) : targetPaths(input.targetDir, input.engramBin, input.detected.executable);
-  const settingsJson = deps.readSettings(path32.join(paths.codingAgentDir, "settings.json"));
+  const settingsJson = deps.readSettings(path31.join(paths.codingAgentDir, "settings.json"));
   const receiptJson = deps.readReceipt(paths.receiptPath);
   const lifecycleInput = {
     candidate: PI_RUNTIME_CANDIDATE,
@@ -5138,14 +5409,14 @@ function readJsonFile(file) {
 function packageVersionFromExecutable(executable) {
   let current;
   try {
-    current = path32.dirname(fs23.realpathSync(executable));
+    current = path31.dirname(fs23.realpathSync(executable));
   } catch {
     return null;
   }
   for (let depth = 0; depth < 8; depth++) {
     const manifests = [
-      path32.join(current, "package.json"),
-      path32.join(current, "node_modules", "@earendil-works", "pi-coding-agent", "package.json")
+      path31.join(current, "package.json"),
+      path31.join(current, "node_modules", "@earendil-works", "pi-coding-agent", "package.json")
     ];
     for (const manifest of manifests) {
       try {
@@ -5156,7 +5427,7 @@ function packageVersionFromExecutable(executable) {
       } catch {
       }
     }
-    const parent = path32.dirname(current);
+    const parent = path31.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -5164,23 +5435,23 @@ function packageVersionFromExecutable(executable) {
 }
 function detectPiRuntime() {
   const executable = lookPath("pi");
-  const home = os5.homedir();
+  const home = os4.homedir();
   return {
     id: "pi",
     name: "Pi",
     installed: executable !== null,
     executable,
     version: executable === null ? null : packageVersionFromExecutable(executable),
-    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path32.join(home, ".pi", "agent")
+    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path31.join(home, ".pi", "agent")
   };
 }
 function hasManagedPiRuntime(targetDir) {
-  const receipt = targetDir === void 0 ? path32.join(dataDir(), "pi-receipt.json") : path32.join(path32.resolve(targetDir), "state", "pi-receipt.json");
+  const receipt = targetDir === void 0 ? path31.join(dataDir(), "pi-receipt.json") : path31.join(path31.resolve(targetDir), "state", "pi-receipt.json");
   return fs23.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
 }
 function resolvePiEngramBin(targetDir) {
   if (targetDir === void 0) return detectEngram();
-  const candidate = path32.join(path32.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
+  const candidate = path31.join(path31.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
   return fs23.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
 }
 function readOptional(file, fallback) {
@@ -5220,7 +5491,7 @@ async function acquirePiTarball(destination) {
     }
     fs23.rmSync(destination, { force: true });
   }
-  fs23.mkdirSync(path32.dirname(destination), { recursive: true });
+  fs23.mkdirSync(path31.dirname(destination), { recursive: true });
   const partial = `${destination}.partial-${process.pid}`;
   const response = await fetch(`https://registry.npmjs.org/jorgex-pi/-/jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`, {
     redirect: "error",
@@ -5293,7 +5564,7 @@ async function runPiRuntimeSystem(input) {
         remedy: "Instala Engram o configura un ENGRAM_BIN absoluto antes de reintentar."
       };
     }
-    const destination = input.targetDir === void 0 ? path32.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path32.join(path32.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
+    const destination = input.targetDir === void 0 ? path31.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path31.join(path31.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
     let artifact;
     try {
       artifact = await acquirePiTarball(destination);
@@ -5313,18 +5584,18 @@ async function runPiRuntimeSystem(input) {
     }, {
       download: () => artifact,
       backupSettings: () => createBackup(
-        [path32.join(paths.codingAgentDir, "settings.json")],
+        [path31.join(paths.codingAgentDir, "settings.json")],
         "pi-package-install",
-        input.targetDir === void 0 ? void 0 : path32.join(path32.resolve(input.targetDir), "backups")
+        input.targetDir === void 0 ? void 0 : path31.join(path31.resolve(input.targetDir), "backups")
       ),
       run: runProcess,
-      readSettings: () => readOptional(path32.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}'),
-      rewriteSettings: (content) => writeText(path32.join(paths.codingAgentDir, "settings.json"), `${content}
+      readSettings: () => readOptional(path31.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}'),
+      rewriteSettings: (content) => writeText(path31.join(paths.codingAgentDir, "settings.json"), `${content}
 `),
       writeReceiptAtomic: (content) => writeText(paths.receiptPath, content)
     });
   }
-  const packageRoot = path32.dirname(path32.dirname(paths.packageRunner));
+  const packageRoot = path31.dirname(path31.dirname(paths.packageRunner));
   const writeReceipt = (receipt) => {
     writeText(paths.receiptPath, `${JSON.stringify(receipt, null, 2)}
 `);
@@ -5342,9 +5613,9 @@ async function runPiRuntimeSystem(input) {
       value,
       {
         backupSettings: () => createBackup(
-          [path32.join(paths.codingAgentDir, "settings.json")],
+          [path31.join(paths.codingAgentDir, "settings.json")],
           "pi-package-uninstall",
-          input.targetDir === void 0 ? void 0 : path32.join(path32.resolve(input.targetDir), "backups")
+          input.targetDir === void 0 ? void 0 : path31.join(path31.resolve(input.targetDir), "backups")
         ),
         run: runProcess,
         isPackageAbsent: () => !fs23.existsSync(packageRoot),
@@ -5445,466 +5716,8 @@ async function runManagedPiSystem(input) {
 }
 
 // src/lib/quality-runner.ts
-import path33 from "path";
+import path32 from "path";
 import { spawn, spawnSync as spawnSync2 } from "child_process";
-
-// src/lib/quality-policy.ts
-var QUALITY_PROFILES = ["routine", "elevated", "high", "release"];
-function hasText(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-function isQualityProfile(value) {
-  return typeof value === "string" && QUALITY_PROFILES.includes(value);
-}
-function mergeStatus(current, next) {
-  if (current === "fail" || next === "fail") return "fail";
-  if (current === "incomplete" || next === "incomplete") return "incomplete";
-  return "pass";
-}
-function resultStatus(result) {
-  switch (result.status) {
-    case "fail":
-      return "fail";
-    case "incomplete":
-      return "incomplete";
-    case "not-applicable":
-      return "pass";
-    case "pass":
-      return hasText(result.evidence) ? "pass" : "incomplete";
-    default:
-      return "incomplete";
-  }
-}
-function evaluateQualityPolicy(input) {
-  const requestedProfile = input.profile === void 0 ? "routine" : input.profile;
-  if (!isQualityProfile(requestedProfile)) {
-    throw new Error(`Unknown quality profile: ${String(requestedProfile)}`);
-  }
-  const controls = /* @__PURE__ */ new Map();
-  let status = "pass";
-  let hasRequired = false;
-  for (const control of input.controls) {
-    if (!hasText(control.id) || control.requirement !== "required" && control.requirement !== "optional" || controls.has(control.id)) {
-      status = mergeStatus(status, "incomplete");
-      continue;
-    }
-    controls.set(control.id, control);
-    if (control.requirement === "required") hasRequired = true;
-  }
-  const results = /* @__PURE__ */ new Map();
-  for (const result of input.results) {
-    const control = controls.get(result.controlId);
-    if (!control || results.has(result.controlId)) {
-      status = mergeStatus(status, "incomplete");
-    }
-    if (control && !results.has(result.controlId)) {
-      results.set(result.controlId, result);
-    }
-    if (control && result.status === "not-applicable") {
-      const validException = control.requirement === "optional" && control.notApplicable === true && hasText(result.reason);
-      status = mergeStatus(status, validException ? "pass" : "incomplete");
-      continue;
-    }
-    if (control) status = mergeStatus(status, resultStatus(result));
-  }
-  if (!hasRequired) status = mergeStatus(status, "incomplete");
-  for (const control of controls.values()) {
-    if (control.requirement !== "required") continue;
-    const result = results.get(control.id);
-    if (!result) {
-      status = mergeStatus(status, "incomplete");
-      continue;
-    }
-    if (result.status === "not-applicable") {
-      status = mergeStatus(status, "incomplete");
-    } else {
-      status = mergeStatus(status, resultStatus(result));
-    }
-  }
-  return { profile: requestedProfile, status };
-}
-
-// src/lib/quality-receipt.ts
-import { createHash as createHash2 } from "crypto";
-var QUALITY_RECEIPT_NAMESPACE = "jorgex.quality.receipt";
-var QUALITY_RECEIPT_VERSION = 1;
-var COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
-var SHA256_PATTERN = /^[0-9a-f]{64}$/i;
-var MAX_EXCERPT_LENGTH = 512;
-var REDACTED = "[REDACTED]";
-var QUALITY_RESULT_STATUSES = [
-  "pass",
-  "fail",
-  "incomplete",
-  "not-applicable"
-];
-var SENSITIVE_FLAG_PATTERN = /^(?:-{1,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))$/i;
-var SENSITIVE_ASSIGNMENT_PATTERN = /^(?:-{0,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))\s*[=:]\s*.+$/i;
-var SENSITIVE_OUTPUT_PATTERN = /((?:authorization\s*:\s*bearer\s+|bearer\s+))[^\s,;]+/gi;
-var SENSITIVE_KEY_VALUE_PATTERN = /((?:^|(?<=[^\w.-]))(?:-{0,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\r\n,;]+)/gi;
-var SENSITIVE_SEPARATE_FLAG_PATTERN = /((?:^|(?<=[^\w.-]))-{1,2}(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))[ \t]+)(?:"[^"]*"|'[^']*'|[^\r\n,;]+)/gi;
-var SENSITIVE_STRUCTURED_VALUE_PATTERN = /((?:"|')?(?:token|password|api[-_]?key|access[-_]?token|_?auth(?:orization)?(?:[-_.]?token)?|aws[-_]?secret[-_]?access[-_]?key|private[-_]?key)(?:"|')?\s*:\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')/gi;
-function isRecord2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function hasOwn(value, key) {
-  return Object.prototype.hasOwnProperty.call(value, key);
-}
-function isDenseStringArray(value) {
-  if (!Array.isArray(value)) return false;
-  for (let index = 0; index < value.length; index += 1) {
-    if (!hasOwn(value, String(index)) || typeof value[index] !== "string") return false;
-  }
-  return true;
-}
-function assertExactKeys(value, allowed, label) {
-  const allowedKeys = new Set(allowed);
-  const unexpected = Object.keys(value).find((key) => !allowedKeys.has(key));
-  if (unexpected !== void 0) {
-    throw new Error(`Unexpected ${label} field: ${unexpected}`);
-  }
-}
-function requireRecord(value, label) {
-  if (!isRecord2(value)) throw new Error(`Invalid ${label}`);
-  return value;
-}
-function requireText(value, label) {
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`Invalid ${label}`);
-  }
-  return value;
-}
-function isQualityProfile2(value) {
-  return QUALITY_PROFILES.includes(value);
-}
-function isQualityReceiptResultStatus(value) {
-  return QUALITY_RESULT_STATUSES.includes(value);
-}
-function requireSha(value, label, pattern) {
-  const text2 = requireText(value, label);
-  if (!pattern.test(text2)) throw new Error(`Invalid ${label}`);
-  return text2;
-}
-function redactText(value) {
-  return value.replace(SENSITIVE_STRUCTURED_VALUE_PATTERN, (_match, prefix, quotedValue) => {
-    const quote = quotedValue[0];
-    return `${prefix}${quote}${REDACTED}${quote}`;
-  }).replace(SENSITIVE_OUTPUT_PATTERN, (_match, prefix) => {
-    const normalizedPrefix = prefix.toLowerCase().startsWith("authorization") ? prefix.slice(0, prefix.toLowerCase().indexOf("bearer") + "bearer".length) : "Bearer ";
-    return `${normalizedPrefix}${REDACTED}`;
-  }).replace(SENSITIVE_KEY_VALUE_PATTERN, `$1${REDACTED}`).replace(SENSITIVE_SEPARATE_FLAG_PATTERN, `$1${REDACTED}`);
-}
-function redactAssignment(value) {
-  const separator = value.indexOf("=") >= 0 ? "=" : ":";
-  const name = value.slice(0, value.indexOf(separator));
-  return `${name}${separator}${REDACTED}`;
-}
-function redactArgv(argv) {
-  if (!isDenseStringArray(argv)) throw new Error("Invalid argv: sparse or non-string array");
-  let redactNext = false;
-  return argv.map((argument) => {
-    if (redactNext) {
-      redactNext = false;
-      return REDACTED;
-    }
-    if (SENSITIVE_FLAG_PATTERN.test(argument)) {
-      redactNext = true;
-      return argument;
-    }
-    if (SENSITIVE_ASSIGNMENT_PATTERN.test(argument)) {
-      return redactAssignment(argument);
-    }
-    return redactText(argument);
-  });
-}
-function excerptFor(output) {
-  const stdout = redactText(output.stdout);
-  const stderr = redactText(output.stderr);
-  const combined = [stdout, stderr].filter((part) => part !== "").join("\n");
-  return Array.from(combined).slice(0, MAX_EXCERPT_LENGTH).join("");
-}
-function outputDigestFor(output) {
-  const sanitized = {
-    stdout: redactText(output.stdout),
-    stderr: redactText(output.stderr)
-  };
-  return sha256(canonicalJson(sanitized));
-}
-function normalizeCommand(command) {
-  return {
-    commandId: command.commandId,
-    executable: command.executable,
-    argv: redactArgv(command.argv),
-    exitCode: command.exitCode,
-    durationMs: command.durationMs,
-    excerpt: excerptFor(command.output),
-    outputDigest: outputDigestFor(command.output)
-  };
-}
-function normalizeResult(result) {
-  if (result.status === "pass") {
-    return {
-      controlId: result.controlId,
-      status: "pass",
-      evidence: result.evidence,
-      ...result.reason === void 0 ? {} : { reason: result.reason }
-    };
-  }
-  return {
-    controlId: result.controlId,
-    status: result.status,
-    ...result.evidence === void 0 ? {} : { evidence: result.evidence },
-    ...result.reason === void 0 ? {} : { reason: result.reason }
-  };
-}
-function normalizeProvenance(provenance) {
-  return {
-    issuer: provenance.issuer,
-    executionId: provenance.executionId,
-    evidenceLocator: provenance.evidenceLocator,
-    evidenceDigest: provenance.evidenceDigest
-  };
-}
-function canonicalValue(value) {
-  if (value === null) return "null";
-  switch (typeof value) {
-    case "string": {
-      const result = JSON.stringify(value);
-      if (result === void 0) throw new Error("Unable to canonicalize string");
-      return result;
-    }
-    case "boolean":
-      return value ? "true" : "false";
-    case "number": {
-      if (!Number.isFinite(value)) throw new Error("Cannot canonicalize non-finite number");
-      const result = JSON.stringify(value);
-      if (result === void 0) throw new Error("Unable to canonicalize number");
-      return result;
-    }
-    case "object": {
-      if (Array.isArray(value)) {
-        for (let index = 0; index < value.length; index += 1) {
-          if (!hasOwn(value, String(index))) {
-            throw new Error("Cannot canonicalize sparse array");
-          }
-        }
-        return `[${value.map((item) => canonicalValue(item)).join(",")}]`;
-      }
-      const prototype = Object.getPrototypeOf(value);
-      if (prototype !== Object.prototype && prototype !== null) {
-        throw new Error("Cannot canonicalize non-plain object");
-      }
-      const object = value;
-      return `{${Object.keys(object).sort().map((key) => {
-        return `${JSON.stringify(key)}:${canonicalValue(object[key])}`;
-      }).join(",")}}`;
-    }
-    default:
-      throw new Error(`Cannot canonicalize ${typeof value}`);
-  }
-}
-function canonicalJson(value) {
-  return canonicalValue(value);
-}
-function sha256(value) {
-  return createHash2("sha256").update(value, "utf8").digest("hex");
-}
-function validateIdentity(value, expected) {
-  const identity = requireRecord(value, "identity");
-  assertExactKeys(identity, ["profile", "baseSha", "headSha", "policyDigest"], "identity");
-  const profile = requireText(identity.profile, "identity.profile");
-  if (!isQualityProfile2(profile)) throw new Error(`Invalid identity.profile: ${profile}`);
-  const baseSha = requireSha(identity.baseSha, "identity.baseSha", COMMIT_SHA_PATTERN);
-  const headSha = requireSha(identity.headSha, "identity.headSha", COMMIT_SHA_PATTERN);
-  const policyDigest = requireSha(identity.policyDigest, "identity.policyDigest", SHA256_PATTERN);
-  const actual = { profile, baseSha, headSha, policyDigest };
-  if (expected !== void 0) {
-    for (const field of ["profile", "baseSha", "headSha", "policyDigest"]) {
-      if (actual[field] !== expected[field]) {
-        throw new Error(`Quality receipt identity mismatch: ${field}`);
-      }
-    }
-  }
-  return actual;
-}
-function validateProvenance(value) {
-  const provenance = requireRecord(value, "provenance");
-  assertExactKeys(provenance, ["issuer", "executionId", "evidenceLocator", "evidenceDigest"], "provenance");
-  const issuer = requireText(provenance.issuer, "provenance.issuer");
-  const executionId = requireText(provenance.executionId, "provenance.executionId");
-  const evidenceLocator = requireText(provenance.evidenceLocator, "provenance.evidenceLocator");
-  if (!/^https?:\/\/\S+$/.test(evidenceLocator)) {
-    throw new Error("Invalid provenance.evidenceLocator");
-  }
-  try {
-    const parsed = new URL(evidenceLocator);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error("unsupported locator protocol");
-    }
-  } catch {
-    throw new Error("Invalid provenance.evidenceLocator");
-  }
-  const evidenceDigest = requireSha(provenance.evidenceDigest, "provenance.evidenceDigest", SHA256_PATTERN);
-  return { issuer, executionId, evidenceLocator, evidenceDigest };
-}
-function validateCommand(value, index) {
-  const command = requireRecord(value, `commands[${index}]`);
-  assertExactKeys(
-    command,
-    ["commandId", "executable", "argv", "exitCode", "durationMs", "excerpt", "outputDigest"],
-    `commands[${index}]`
-  );
-  const commandId = requireText(command.commandId, `commands[${index}].commandId`);
-  const executable = requireText(command.executable, `commands[${index}].executable`);
-  if (!isDenseStringArray(command.argv)) {
-    throw new Error(`Invalid commands[${index}].argv`);
-  }
-  if (typeof command.exitCode !== "number" || !Number.isInteger(command.exitCode)) {
-    throw new Error(`Invalid commands[${index}].exitCode`);
-  }
-  if (typeof command.durationMs !== "number" || !Number.isFinite(command.durationMs) || command.durationMs < 0) {
-    throw new Error(`Invalid commands[${index}].durationMs`);
-  }
-  if (!hasOwn(command, "excerpt") || typeof command.excerpt !== "string") {
-    throw new Error(`Invalid commands[${index}].excerpt`);
-  }
-  const excerpt = command.excerpt;
-  if (Array.from(excerpt).length > MAX_EXCERPT_LENGTH) throw new Error(`Invalid commands[${index}].excerpt`);
-  if (redactText(excerpt) !== excerpt) {
-    throw new Error(`Invalid commands[${index}].excerpt: contains an unredacted secret`);
-  }
-  const argv = [...command.argv];
-  const sanitizedArgv = redactArgv(argv);
-  if (sanitizedArgv.some((argument, argumentIndex) => argument !== argv[argumentIndex])) {
-    throw new Error(`Invalid commands[${index}].argv: contains an unredacted secret`);
-  }
-  const outputDigest = requireSha(command.outputDigest, `commands[${index}].outputDigest`, SHA256_PATTERN);
-  return {
-    commandId,
-    executable,
-    argv,
-    exitCode: command.exitCode,
-    durationMs: command.durationMs,
-    excerpt,
-    outputDigest
-  };
-}
-function validateResult(value, index) {
-  const result = requireRecord(value, `results[${index}]`);
-  assertExactKeys(result, ["controlId", "status", "evidence", "reason"], `results[${index}]`);
-  const controlId = requireText(result.controlId, `results[${index}].controlId`);
-  const status = result.status;
-  if (typeof status !== "string" || !isQualityReceiptResultStatus(status)) {
-    throw new Error(`Invalid results[${index}].status`);
-  }
-  let evidence;
-  if (hasOwn(result, "evidence")) {
-    if (typeof result.evidence !== "string") {
-      throw new Error(`Invalid results[${index}].evidence`);
-    }
-    evidence = result.evidence;
-  }
-  let reason;
-  if (hasOwn(result, "reason")) {
-    if (typeof result.reason !== "string") {
-      throw new Error(`Invalid results[${index}].reason`);
-    }
-    reason = result.reason;
-  }
-  if (status === "pass") {
-    if (evidence === void 0 || evidence.trim() === "") {
-      throw new Error(`Invalid results[${index}].evidence: pass requires evidence`);
-    }
-    return {
-      controlId,
-      status,
-      evidence,
-      ...reason === void 0 ? {} : { reason }
-    };
-  }
-  return {
-    controlId,
-    status,
-    ...evidence === void 0 ? {} : { evidence },
-    ...reason === void 0 ? {} : { reason }
-  };
-}
-function validateQualityReceipt(value, expectedIdentity) {
-  const receipt = requireRecord(value, "quality receipt");
-  if (receipt.namespace !== QUALITY_RECEIPT_NAMESPACE) {
-    throw new Error(`Invalid quality receipt namespace: ${String(receipt.namespace)}`);
-  }
-  if (receipt.version !== QUALITY_RECEIPT_VERSION) {
-    throw new Error(`Unsupported quality receipt version: ${String(receipt.version)}`);
-  }
-  assertExactKeys(receipt, ["namespace", "version", "authority", "identity", "commands", "results", "provenance"], "receipt");
-  if (receipt.authority !== "local" && receipt.authority !== "enforced") {
-    throw new Error(`Invalid quality receipt authority: ${String(receipt.authority)}`);
-  }
-  const identity = validateIdentity(receipt.identity, expectedIdentity);
-  if (!Array.isArray(receipt.commands)) throw new Error("Invalid quality receipt commands");
-  if (!Array.isArray(receipt.results)) throw new Error("Invalid quality receipt results");
-  for (let index = 0; index < receipt.commands.length; index += 1) {
-    validateCommand(receipt.commands[index], index);
-  }
-  for (let index = 0; index < receipt.results.length; index += 1) {
-    validateResult(receipt.results[index], index);
-  }
-  const hasProvenance = hasOwn(receipt, "provenance");
-  if (receipt.authority === "enforced" && (!hasProvenance || receipt.provenance === void 0)) {
-    throw new Error("Enforced quality receipts require provenance");
-  }
-  if (hasProvenance) {
-    if (receipt.provenance === void 0) throw new Error("Invalid quality receipt provenance");
-    validateProvenance(receipt.provenance);
-  }
-  void identity;
-}
-function createQualityReceipt(input) {
-  const authority = input.authority;
-  if (authority !== "local" && authority !== "enforced") {
-    throw new Error(`Invalid quality receipt authority: ${String(authority)}`);
-  }
-  if (input.authority === "enforced" && input.provenance === void 0) {
-    throw new Error("Enforced quality receipts require provenance");
-  }
-  const base = {
-    namespace: QUALITY_RECEIPT_NAMESPACE,
-    version: QUALITY_RECEIPT_VERSION,
-    identity: {
-      profile: input.identity.profile,
-      baseSha: input.identity.baseSha,
-      headSha: input.identity.headSha,
-      policyDigest: input.identity.policyDigest
-    },
-    commands: input.commands.map(normalizeCommand),
-    results: input.results.map(normalizeResult)
-  };
-  let receipt;
-  if (input.authority === "enforced") {
-    const provenance = input.provenance;
-    if (provenance === void 0) throw new Error("Enforced quality receipts require provenance");
-    receipt = {
-      ...base,
-      authority: "enforced",
-      provenance: normalizeProvenance(provenance)
-    };
-  } else {
-    receipt = {
-      ...base,
-      authority: "local",
-      ...input.provenance === void 0 ? {} : { provenance: normalizeProvenance(input.provenance) }
-    };
-  }
-  validateQualityReceipt(receipt);
-  return receipt;
-}
-function serializeQualityReceipt(receipt) {
-  validateQualityReceipt(receipt);
-  return canonicalJson(receipt);
-}
-
-// src/lib/quality-runner.ts
 function normalizeLimit(value, name) {
   if (value === void 0) return void 0;
   if (!Number.isSafeInteger(value) || value < 0) {
@@ -5922,14 +5735,14 @@ function normalizeTimeout(value) {
   }
   return timeoutMs;
 }
-var COMMIT_SHA_PATTERN2 = /^[0-9a-f]{40}$/i;
+var COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function hasText2(value) {
   return typeof value === "string" && value.trim() !== "";
 }
-function isDenseStringArray2(value) {
+function isDenseStringArray(value) {
   if (!Array.isArray(value)) return false;
   for (let index = 0; index < value.length; index += 1) {
     if (!Object.prototype.hasOwnProperty.call(value, String(index)) || typeof value[index] !== "string") return false;
@@ -5939,7 +5752,7 @@ function isDenseStringArray2(value) {
 function isNonNegativeSafeInteger(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-function isQualityProfile3(value) {
+function isQualityProfile(value) {
   return typeof value === "string" && QUALITY_PROFILES.includes(value);
 }
 function assertValidEnvironment(value, label) {
@@ -5951,13 +5764,13 @@ function assertValidEnvironment(value, label) {
 function assertQualityPlanInput(value) {
   if (!isRecord3(value)) throw new Error("Invalid quality plan");
   if (!isRecord3(value.identity)) throw new Error("Invalid quality plan identity");
-  if (typeof value.identity.baseSha !== "string" || !COMMIT_SHA_PATTERN2.test(value.identity.baseSha)) {
+  if (typeof value.identity.baseSha !== "string" || !COMMIT_SHA_PATTERN.test(value.identity.baseSha)) {
     throw new Error("Invalid quality plan identity.baseSha");
   }
-  if (typeof value.identity.headSha !== "string" || !COMMIT_SHA_PATTERN2.test(value.identity.headSha)) {
+  if (typeof value.identity.headSha !== "string" || !COMMIT_SHA_PATTERN.test(value.identity.headSha)) {
     throw new Error("Invalid quality plan identity.headSha");
   }
-  if (!isQualityProfile3(value.profile)) throw new Error("Invalid quality plan profile");
+  if (!isQualityProfile(value.profile)) throw new Error("Invalid quality plan profile");
   if (!Array.isArray(value.controls)) throw new Error("Invalid quality plan controls");
   const controlIds = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.controls.length; index += 1) {
@@ -5980,7 +5793,7 @@ function assertQualityPlanInput(value) {
     const command = value.commands[index];
     if (!isRecord3(command)) throw new Error(`Invalid quality plan commands[${index}]`);
     const timeoutMs = command.timeoutMs;
-    if (!hasText2(command.controlId) || !hasText2(command.commandId) || !hasText2(command.executable) || !isDenseStringArray2(command.argv) || !isNonNegativeSafeInteger(timeoutMs)) {
+    if (!hasText2(command.controlId) || !hasText2(command.commandId) || !hasText2(command.executable) || !isDenseStringArray(command.argv) || !isNonNegativeSafeInteger(timeoutMs)) {
       throw new Error(`Invalid quality plan commands[${index}]`);
     }
     if (timeoutMs > MAX_NODE_TIMEOUT_MS) {
@@ -6035,7 +5848,7 @@ function killProcessTree(child) {
   if (pid === void 0) return;
   if (process.platform === "win32") {
     const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
-    const taskkill = path33.join(systemRoot, "System32", "taskkill.exe");
+    const taskkill = path32.join(systemRoot, "System32", "taskkill.exe");
     const result = spawnSync2(taskkill, ["/pid", String(pid), "/t", "/f"], {
       shell: false,
       stdio: "ignore",
@@ -6261,11 +6074,15 @@ async function runQualityPlan(input) {
     results.push(receiptResultFor(command.controlId, result));
   }
   results.push(...missingRequiredResults(input.controls, input.commands));
-  const evaluation = evaluateQualityPolicy({
+  const policyEvaluation = evaluateQualityPolicy({
     profile: input.profile,
     controls: input.controls,
     results
   });
+  const evaluation = {
+    ...policyEvaluation,
+    status: localQualityStatus(input.profile, policyEvaluation.status)
+  };
   const receipt = createQualityReceipt({
     authority: "local",
     identity,