jorgex-stack 1.9.63 → 1.9.64

package/dist/cli.js

@@ -4330,7 +4330,7 @@ var init_pi = __esm({
 
 // src/cli.ts
 import * as p6 from "@clack/prompts";
-import fs43 from "fs";
+import fs44 from "fs";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/install.ts
@@ -12734,8 +12734,8 @@ init_model_map();
 
 // src/lib/pi-runtime.ts
 import os6 from "os";
-import path47 from "path";
-import fs39 from "fs";
+import path48 from "path";
+import fs40 from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
 
 // src/lib/pi-runtime-pin.json
@@ -12789,8 +12789,8 @@ init_paths();
 
 // src/lib/pi-install-preflight.ts
 init_npm_provider();
-import fs35 from "fs";
-import path43 from "path";
+import fs36 from "fs";
+import path44 from "path";
 
 // src/lib/pi-candidate.ts
 import fs33 from "fs";
@@ -13490,18 +13490,121 @@ async function stageVerifiedPiTarball(input, run) {
   return { stageDir, evidence, sourceAlias };
 }
 
-// src/lib/pi-install-preflight.ts
+// src/lib/pi-host-version.ts
+import fs35 from "fs";
+import path43 from "path";
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
+function invalidManagedPi(diagnostic) {
+  return { version: null, diagnostic };
+}
+function readJsonFile(file) {
+  try {
+    const stat = fs35.lstatSync(file, { throwIfNoEntry: false });
+    if (!stat?.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) return null;
+    return JSON.parse(fs35.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function piPackageVersion(file) {
+  try {
+    const value = readJsonFile(file);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+    const packageName = Reflect.get(value, "name");
+    const version = Reflect.get(value, "version");
+    return packageName === PI_PACKAGE_NAME && typeof version === "string" && version !== "" && !/\s/.test(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+function managedPiVersion(executable, resolved2) {
+  const binDir = path43.dirname(resolved2);
+  if (path43.basename(resolved2) !== "pi" || path43.basename(binDir) !== "bin") {
+    return invalidManagedPi("launcher gestionado de Pi no reconocido");
+  }
+  const agentDir = path43.dirname(binDir);
+  const installDir = path43.join(agentDir, "install");
+  try {
+    if (!fs35.lstatSync(executable).isSymbolicLink()) {
+      return invalidManagedPi("el entrypoint gestionado de Pi no es un symlink");
+    }
+    const metadata = readJsonFile(path43.join(installDir, "managed-install.json"));
+    if (metadata === null || typeof metadata !== "object" || Array.isArray(metadata)) {
+      return invalidManagedPi("install/managed-install.json falta o no es JSON v\xE1lido");
+    }
+    const entrypoint = Reflect.get(metadata, "entrypoint");
+    if (Reflect.get(metadata, "kind") !== "pi-managed-install" || Reflect.get(metadata, "schemaVersion") !== 1 || Reflect.get(metadata, "layout") !== "releases-v1" || entrypoint === null || typeof entrypoint !== "object" || Array.isArray(entrypoint) || Reflect.get(entrypoint, "type") !== "symlink" || Reflect.get(entrypoint, "path") !== executable) {
+      return invalidManagedPi("install/managed-install.json no coincide con el entrypoint de Pi");
+    }
+    const currentPath = path43.join(installDir, "current-version");
+    const currentStat = fs35.lstatSync(currentPath, { throwIfNoEntry: false });
+    if (!currentStat?.isFile() || currentStat.isSymbolicLink() || currentStat.size > 128) {
+      return invalidManagedPi("install/current-version falta o no es un archivo regular acotado");
+    }
+    const version = fs35.readFileSync(currentPath, "utf8").trim();
+    if (version === "." || version === ".." || !/^[0-9A-Za-z._+-]+$/.test(version)) {
+      return invalidManagedPi("install/current-version contiene una versi\xF3n inv\xE1lida");
+    }
+    const releaseDir = path43.join(installDir, "releases", version);
+    if (fs35.realpathSync(releaseDir) !== releaseDir) {
+      return invalidManagedPi("install/releases contiene un enlace fuera del release gestionado");
+    }
+    const packageDir = path43.join(releaseDir, "node_modules", "@earendil-works", "pi-coding-agent");
+    if (fs35.realpathSync(packageDir) !== packageDir) {
+      return invalidManagedPi("el paquete Pi del release gestionado es un symlink");
+    }
+    const packageVersion = piPackageVersion(path43.join(packageDir, "package.json"));
+    return packageVersion === version ? { version, diagnostic: null } : invalidManagedPi("el manifest de @earendil-works/pi-coding-agent no coincide con install/current-version");
+  } catch {
+    return invalidManagedPi("no se pudo leer la metadata del release Pi gestionado");
+  }
+}
+function hasManagedPiMarker(resolved2) {
+  const binDir = path43.dirname(resolved2);
+  if (path43.basename(resolved2) !== "pi" || path43.basename(binDir) !== "bin") return false;
+  const installDir = path43.join(path43.dirname(binDir), "install");
+  try {
+    return fs35.lstatSync(path43.join(installDir, "managed-install.json"), { throwIfNoEntry: false }) !== void 0 || fs35.lstatSync(path43.join(installDir, "current-version"), { throwIfNoEntry: false }) !== void 0;
+  } catch {
+    return true;
+  }
+}
+function inspectPiHostVersion(executable) {
+  const absoluteExecutable = path43.resolve(executable);
+  let resolved2;
+  try {
+    resolved2 = fs35.realpathSync(absoluteExecutable);
+  } catch {
+    return { version: null, diagnostic: "no se pudo resolver el ejecutable Pi" };
+  }
+  if (hasManagedPiMarker(resolved2)) return managedPiVersion(absoluteExecutable, resolved2);
+  let current = path43.dirname(resolved2);
+  for (let depth = 0; depth < 8; depth += 1) {
+    for (const manifest of [
+      path43.join(current, "package.json"),
+      path43.join(current, "node_modules", "@earendil-works", "pi-coding-agent", "package.json")
+    ]) {
+      const version = piPackageVersion(manifest);
+      if (version !== null) return { version, diagnostic: null };
+    }
+    const parent = path43.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return { version: null, diagnostic: "no se encontr\xF3 el manifest del paquete Pi instalado" };
+}
+
+// src/lib/pi-install-preflight.ts
 function fail9(message) {
   throw new Error(`pi-install-preflight: ${message}`);
 }
 function isStrictChild3(child, root) {
-  const rel = path43.relative(path43.resolve(root), path43.resolve(child));
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path43.sep}`) && !path43.isAbsolute(rel);
+  const rel = path44.relative(path44.resolve(root), path44.resolve(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path44.sep}`) && !path44.isAbsolute(rel);
 }
 function lstatOrNull4(p7) {
   try {
-    return fs35.lstatSync(p7);
+    return fs36.lstatSync(p7);
   } catch {
     return null;
   }
@@ -13517,24 +13620,24 @@ function validatePaths(paths) {
     fail9("paths must be an object");
   }
   const { homeDir, agentDir, piExecutable, downloadsDir } = paths;
-  if (typeof homeDir !== "string" || homeDir === "" || !path43.isAbsolute(homeDir)) {
+  if (typeof homeDir !== "string" || homeDir === "" || !path44.isAbsolute(homeDir)) {
     fail9("homeDir must be a non-empty absolute path");
   }
-  if (typeof agentDir !== "string" || agentDir === "" || !path43.isAbsolute(agentDir)) {
+  if (typeof agentDir !== "string" || agentDir === "" || !path44.isAbsolute(agentDir)) {
     fail9("agentDir must be a non-empty absolute path");
   }
-  if (typeof piExecutable !== "string" || piExecutable === "" || !path43.isAbsolute(piExecutable)) {
+  if (typeof piExecutable !== "string" || piExecutable === "" || !path44.isAbsolute(piExecutable)) {
     fail9("piExecutable must be a non-empty absolute path");
   }
   if (piExecutable === "npm") {
     fail9("piExecutable must be the detected Pi CLI, never npm");
   }
-  if (typeof downloadsDir !== "string" || downloadsDir === "" || !path43.isAbsolute(downloadsDir)) {
+  if (typeof downloadsDir !== "string" || downloadsDir === "" || !path44.isAbsolute(downloadsDir)) {
     fail9("downloadsDir must be a non-empty absolute path");
   }
-  const homeResolved = path43.resolve(homeDir);
-  const agentResolved = path43.resolve(agentDir);
-  const downloadsResolved = path43.resolve(downloadsDir);
+  const homeResolved = path44.resolve(homeDir);
+  const agentResolved = path44.resolve(agentDir);
+  const downloadsResolved = path44.resolve(downloadsDir);
   assertRealDir2(homeResolved, "homeDir");
   assertRealDir2(agentResolved, "agentDir");
   assertRealDir2(downloadsResolved, "downloadsDir");
@@ -13562,43 +13665,6 @@ function validateDeps(deps) {
   }
   return { fetchImpl, run };
 }
-function readJsonFile(file) {
-  return JSON.parse(fs35.readFileSync(file, "utf8"));
-}
-function detectPiHostVersion(piExecutable) {
-  let current;
-  try {
-    current = path43.dirname(fs35.realpathSync(piExecutable));
-  } catch {
-    fail9(`cannot resolve Pi executable: ${piExecutable}`);
-  }
-  for (let depth = 0; depth < 8; depth++) {
-    const manifests = [
-      path43.join(current, "package.json"),
-      path43.join(current, "node_modules", PI_PACKAGE_NAME, "package.json")
-    ];
-    for (const manifest of manifests) {
-      let parsed;
-      try {
-        parsed = readJsonFile(manifest);
-      } catch {
-        continue;
-      }
-      if (parsed !== null && typeof parsed === "object" && Reflect.get(parsed, "name") === PI_PACKAGE_NAME && typeof Reflect.get(parsed, "version") === "string") {
-        const version = Reflect.get(parsed, "version");
-        if (version !== "" && !/\s/.test(version)) {
-          return version;
-        }
-      }
-    }
-    const parent = path43.dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
-  }
-  fail9(`cannot detect Pi host version from executable: ${piExecutable}`);
-}
 async function preparePiManagedInstall(paths, deps) {
   const { homeDir, agentDir, piExecutable, downloadsDir } = validatePaths(paths);
   const { fetchImpl, run } = validateDeps(deps);
@@ -13627,8 +13693,8 @@ async function preparePiManagedInstall(paths, deps) {
       `pi-install-preflight: producer commit resolution failed: ${error instanceof Error ? error.message : String(error)}`
     );
   }
-  const downloadsResolved = path43.resolve(downloadsDir);
-  const destination = path43.join(downloadsResolved, `jorgex-pi-${release.version}.tgz`);
+  const downloadsResolved = path44.resolve(downloadsDir);
+  const destination = path44.join(downloadsResolved, `jorgex-pi-${release.version}.tgz`);
   if (!isStrictChild3(destination, downloadsResolved)) {
     fail9(`tarball destination escapes downloadsDir: ${destination}`);
   }
@@ -13657,7 +13723,8 @@ async function preparePiManagedInstall(paths, deps) {
   } catch (error) {
     throw error;
   }
-  const hostVersion = detectPiHostVersion(piExecutable);
+  const hostInspection = inspectPiHostVersion(piExecutable);
+  const hostVersion = hostInspection.version ?? fail9(`cannot detect Pi host version: ${hostInspection.diagnostic ?? "unknown reason"}`);
   let candidate;
   try {
     candidate = await buildStagedPiCandidate({
@@ -13679,16 +13746,16 @@ import { createHash as createHash8 } from "crypto";
 
 // src/lib/pi-private-release.ts
 import crypto2 from "crypto";
-import fs36 from "fs";
-import path44 from "path";
+import fs37 from "fs";
+import path45 from "path";
 var RELEASE_ID_PATTERN = /^[0-9a-f]{64}$/;
 var EXPECTED_ENTRY = "jorgex-pi";
 function resolved(p7) {
-  return path44.resolve(p7);
+  return path45.resolve(p7);
 }
 function isStrictChild4(child, root) {
-  const rel = path44.relative(resolved(root), resolved(child));
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path44.sep}`) && !path44.isAbsolute(rel);
+  const rel = path45.relative(resolved(root), resolved(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path45.sep}`) && !path45.isAbsolute(rel);
 }
 function assertStrictChild(child, root, label) {
   if (!isStrictChild4(child, root)) {
@@ -13697,7 +13764,7 @@ function assertStrictChild(child, root, label) {
 }
 function lstatOrNull5(p7) {
   try {
-    return fs36.lstatSync(p7);
+    return fs37.lstatSync(p7);
   } catch {
     return null;
   }
@@ -13719,7 +13786,7 @@ function assertAncestorsClean(dir, stop, label) {
       throw new Error(`${label} ancestor is a symlink: ${cur}`);
     }
     if (cur === stopResolved) break;
-    const parent = path44.dirname(cur);
+    const parent = path45.dirname(cur);
     if (parent === cur) break;
     cur = parent;
     if (cur.length < stopResolved.length) break;
@@ -13731,7 +13798,7 @@ function assertFilePathClean(file, stop, label) {
   if (st !== null && st.isSymbolicLink()) {
     throw new Error(`${label} is a symlink: ${file}`);
   }
-  assertAncestorsClean(path44.dirname(resolved(file)), stop, label);
+  assertAncestorsClean(path45.dirname(resolved(file)), stop, label);
 }
 function assertDirClean(dir, stop, label) {
   assertStrictChild(dir, stop, label);
@@ -13743,17 +13810,17 @@ function assertDirClean(dir, stop, label) {
 }
 function assertLinkInsideRoot(linkPath, allowedRoot, label, finalKind) {
   const allowedResolved = resolved(allowedRoot);
-  const linkParent = path44.dirname(resolved(linkPath));
+  const linkParent = path45.dirname(resolved(linkPath));
   if (linkParent !== allowedResolved && !isStrictChild4(linkParent, allowedResolved)) {
     throw new Error(`${label} escapes owner root: ${linkPath}`);
   }
   let target;
   try {
-    target = fs36.readlinkSync(linkPath);
+    target = fs37.readlinkSync(linkPath);
   } catch {
     throw new Error(`${label} is broken or unreadable: ${linkPath}`);
   }
-  if (target === "" || path44.isAbsolute(target)) {
+  if (target === "" || path45.isAbsolute(target)) {
     throw new Error(`${label} must be a relative symlink: ${linkPath}`);
   }
   const parentStat = lstatOrNull5(linkParent);
@@ -13769,7 +13836,7 @@ function assertLinkInsideRoot(linkPath, allowedRoot, label, finalKind) {
     const part = ops[i];
     const isLast = i === ops.length - 1;
     if (part === "..") {
-      cur = path44.dirname(cur);
+      cur = path45.dirname(cur);
       if (cur !== allowedResolved && !isStrictChild4(cur, allowedResolved)) {
         throw new Error(`${label} escapes owner root: ${linkPath} -> ${target}`);
       }
@@ -13792,7 +13859,7 @@ function assertLinkInsideRoot(linkPath, allowedRoot, label, finalKind) {
       }
       continue;
     }
-    const next = path44.join(cur, part);
+    const next = path45.join(cur, part);
     if (next !== allowedResolved && !isStrictChild4(next, allowedResolved)) {
       throw new Error(`${label} escapes owner root: ${linkPath} -> ${target}`);
     }
@@ -13832,12 +13899,12 @@ function validateStageTree(stagedNpm) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = fs36.readdirSync(dir, { withFileTypes: true });
+      entries = fs37.readdirSync(dir, { withFileTypes: true });
     } catch {
       throw new Error(`staged tree unreadable: ${dir}`);
     }
     for (const entry of entries) {
-      const full = path44.join(dir, entry.name);
+      const full = path45.join(dir, entry.name);
       if (entry.isSymbolicLink()) {
         assertInternalSymlink(full, root, "staged symlink");
         continue;
@@ -13849,39 +13916,39 @@ function validateStageTree(stagedNpm) {
   }
 }
 function atomicWritePrivate(target, content) {
-  const dir = path44.dirname(resolved(target));
-  fs36.mkdirSync(dir, { recursive: true });
-  const tmp = path44.join(dir, `.tmp-${crypto2.randomBytes(16).toString("hex")}`);
+  const dir = path45.dirname(resolved(target));
+  fs37.mkdirSync(dir, { recursive: true });
+  const tmp = path45.join(dir, `.tmp-${crypto2.randomBytes(16).toString("hex")}`);
   let fd = null;
   try {
-    fd = fs36.openSync(tmp, "wx", 384);
-    fs36.writeFileSync(fd, content, "utf8");
-    fs36.fsyncSync(fd);
-    fs36.closeSync(fd);
+    fd = fs37.openSync(tmp, "wx", 384);
+    fs37.writeFileSync(fd, content, "utf8");
+    fs37.fsyncSync(fd);
+    fs37.closeSync(fd);
     fd = null;
   } finally {
     if (fd !== null) {
       try {
-        fs36.closeSync(fd);
+        fs37.closeSync(fd);
       } catch {
       }
-      fs36.rmSync(tmp, { force: true });
+      fs37.rmSync(tmp, { force: true });
     }
   }
   const tmpStat = lstatOrNull5(tmp);
   if (tmpStat === null || !tmpStat.isFile()) {
     try {
-      fs36.rmSync(tmp, { force: true });
+      fs37.rmSync(tmp, { force: true });
     } catch {
       failIncomplete(`cannot clean private temp (recovery incomplete): ${tmp}`);
     }
     throw new Error(`private temp is not a regular file: ${target}`);
   }
   try {
-    fs36.renameSync(tmp, target);
+    fs37.renameSync(tmp, target);
   } catch (err) {
     try {
-      fs36.rmSync(tmp, { force: true });
+      fs37.rmSync(tmp, { force: true });
     } catch {
       const original = err instanceof Error ? err.message : String(err ?? "rename failed");
       failIncomplete(`cannot clean private temp after rename failure (recovery incomplete): ${tmp}: ${original}`);
@@ -13898,7 +13965,7 @@ async function activateVerifiedPiRelease(input) {
   if (typeof input.homeDir !== "string" || input.homeDir === "") {
     throw new Error(`homeDir must be a non-empty absolute path`);
   }
-  if (!path44.isAbsolute(input.homeDir)) {
+  if (!path45.isAbsolute(input.homeDir)) {
     throw new Error(`homeDir must be absolute: ${input.homeDir}`);
   }
   if (!RELEASE_ID_PATTERN.test(releaseId)) {
@@ -13934,22 +14001,22 @@ async function activateVerifiedPiRelease(input) {
   if (stageStat === null || !stageStat.isDirectory() || stageStat.isSymbolicLink()) {
     throw new Error(`stageDir must be a real directory: ${input.stageDir}`);
   }
-  const settingsPath = path44.join(agentDir, "settings.json");
-  const npmDir = path44.join(agentDir, "npm");
-  const nodeModules = path44.join(npmDir, "node_modules");
-  const linkPath = path44.join(nodeModules, EXPECTED_ENTRY);
-  const stagedNpm = path44.join(stageDir, "npm");
-  const stagedModules = path44.join(stagedNpm, "node_modules");
-  const stagedEntry = path44.join(stagedModules, EXPECTED_ENTRY);
-  const releaseRoot = path44.join(npmDir, "jorgex-pi-managed", "releases");
-  const releaseDir = path44.join(releaseRoot, releaseId);
-  const managedRoot = path44.join(npmDir, "jorgex-pi-managed");
-  const markerPath = path44.join(managedRoot, "active-transaction.json");
-  const lockPath = path44.join(managedRoot, "transaction.lock");
-  const backupDir = path44.join(stageDir, ".activate-backup");
-  const backupEntry = path44.join(backupDir, "entry");
-  const backupSettings = path44.join(backupDir, "settings.json");
-  const backupReceipt = path44.join(backupDir, "receipt.json");
+  const settingsPath = path45.join(agentDir, "settings.json");
+  const npmDir = path45.join(agentDir, "npm");
+  const nodeModules = path45.join(npmDir, "node_modules");
+  const linkPath = path45.join(nodeModules, EXPECTED_ENTRY);
+  const stagedNpm = path45.join(stageDir, "npm");
+  const stagedModules = path45.join(stagedNpm, "node_modules");
+  const stagedEntry = path45.join(stagedModules, EXPECTED_ENTRY);
+  const releaseRoot = path45.join(npmDir, "jorgex-pi-managed", "releases");
+  const releaseDir = path45.join(releaseRoot, releaseId);
+  const managedRoot = path45.join(npmDir, "jorgex-pi-managed");
+  const markerPath = path45.join(managedRoot, "active-transaction.json");
+  const lockPath = path45.join(managedRoot, "transaction.lock");
+  const backupDir = path45.join(stageDir, ".activate-backup");
+  const backupEntry = path45.join(backupDir, "entry");
+  const backupSettings = path45.join(backupDir, "settings.json");
+  const backupReceipt = path45.join(backupDir, "receipt.json");
   const expectedTarget = `../jorgex-pi-managed/releases/${releaseId}/node_modules/${EXPECTED_ENTRY}`;
   assertStrictChild(agentDir, homeDir, "agentDir");
   assertStrictChild(receiptPath, homeDir, "receiptPath");
@@ -14002,7 +14069,7 @@ async function activateVerifiedPiRelease(input) {
   let oldEntryExisted = false;
   if (linkStat !== null) {
     oldEntryExisted = true;
-    assertAncestorsClean(path44.dirname(linkPath), homeDir, "managed entry");
+    assertAncestorsClean(path45.dirname(linkPath), homeDir, "managed entry");
     if (linkStat.isSymbolicLink()) {
       assertManagedEntrySymlink(linkPath, npmDir, "managed entry");
     } else if (!linkStat.isDirectory()) {
@@ -14019,10 +14086,10 @@ async function activateVerifiedPiRelease(input) {
   let oldReceipt = null;
   try {
     if (lstatOrNull5(settingsPath) !== null) {
-      oldSettings = fs36.readFileSync(settingsPath, "utf8");
+      oldSettings = fs37.readFileSync(settingsPath, "utf8");
     }
     if (lstatOrNull5(receiptPath) !== null) {
-      oldReceipt = fs36.readFileSync(receiptPath, "utf8");
+      oldReceipt = fs37.readFileSync(receiptPath, "utf8");
     }
   } catch {
     throw new Error(`cannot read previous settings/receipt`);
@@ -14034,7 +14101,7 @@ async function activateVerifiedPiRelease(input) {
   const ownedBackupFiles = /* @__PURE__ */ new Map();
   const releaseLock = () => {
     if (!lockAcquired) return;
-    fs36.rmSync(lockPath, { force: true });
+    fs37.rmSync(lockPath, { force: true });
     lockAcquired = false;
   };
   const captureBackupDirIdentity = () => {
@@ -14060,7 +14127,7 @@ async function activateVerifiedPiRelease(input) {
     if (dirStat.dev !== backupDirDev || dirStat.ino !== backupDirIno) return "backup dir replaced";
     let entries;
     try {
-      entries = fs36.readdirSync(backupDir);
+      entries = fs37.readdirSync(backupDir);
     } catch {
       return "cannot list backup";
     }
@@ -14070,7 +14137,7 @@ async function activateVerifiedPiRelease(input) {
       if (!allowed.has(entry)) return `unknown backup entry: ${entry}`;
     }
     for (const entry of entries) {
-      const full = resolved(path44.join(backupDir, entry));
+      const full = resolved(path45.join(backupDir, entry));
       const owned = ownedBackupFiles.get(full);
       if (!owned) return `unowned backup file: ${entry}`;
       const st = lstatOrNull5(full);
@@ -14078,14 +14145,14 @@ async function activateVerifiedPiRelease(input) {
       if (st.dev !== owned.dev || st.ino !== owned.ino) return `backup file replaced: ${entry}`;
       let cur;
       try {
-        cur = fs36.readFileSync(full, "utf8");
+        cur = fs37.readFileSync(full, "utf8");
       } catch {
         return `cannot read backup file: ${entry}`;
       }
       if (cur !== owned.content) return `backup file bytes drifted: ${entry}`;
     }
     for (const [fullPath] of ownedBackupFiles) {
-      const base = path44.basename(fullPath);
+      const base = path45.basename(fullPath);
       if (!entries.includes(base)) return `owned backup file missing: ${base}`;
     }
     return null;
@@ -14107,7 +14174,7 @@ async function activateVerifiedPiRelease(input) {
         }
         let cur;
         try {
-          cur = fs36.readFileSync(fullPath, "utf8");
+          cur = fs37.readFileSync(fullPath, "utf8");
         } catch {
           failIncomplete(
             `backup drifted during cleanup, preserving foreign state (recovery incomplete): ${fullPath}: ${original}`
@@ -14119,7 +14186,7 @@ async function activateVerifiedPiRelease(input) {
             `backup drifted during cleanup, preserving foreign state (recovery incomplete): ${fullPath}: ${original}`
           );
         }
-        fs36.unlinkSync(fullPath);
+        fs37.unlinkSync(fullPath);
       }
     } catch (err) {
       if (err instanceof Error && err.recovery === "incomplete") throw err;
@@ -14129,13 +14196,13 @@ async function activateVerifiedPiRelease(input) {
       );
     }
     try {
-      const remaining = fs36.readdirSync(backupDir);
+      const remaining = fs37.readdirSync(backupDir);
       if (remaining.length !== 0) {
         failIncomplete(
           `backup dir not empty after owned cleanup, preserving foreign state (recovery incomplete): ${backupDir}: ${original}`
         );
       }
-      fs36.rmdirSync(backupDir);
+      fs37.rmdirSync(backupDir);
     } catch (err) {
       if (err instanceof Error && err.recovery === "incomplete") throw err;
       const msg = err instanceof Error ? err.message : String(err ?? "rmdir failed");
@@ -14144,7 +14211,7 @@ async function activateVerifiedPiRelease(input) {
       );
     }
     try {
-      fs36.rmSync(markerPath, { force: true });
+      fs37.rmSync(markerPath, { force: true });
       releaseLock();
     } catch {
       failIncomplete(`cannot clear transaction state after rollback: ${original}`);
@@ -14160,7 +14227,7 @@ async function activateVerifiedPiRelease(input) {
     if (!backupCreated) {
       const problems = [];
       try {
-        fs36.rmSync(markerPath, { force: true });
+        fs37.rmSync(markerPath, { force: true });
       } catch {
         problems.push("cannot remove marker");
       }
@@ -14179,7 +14246,7 @@ async function activateVerifiedPiRelease(input) {
     if (err instanceof Error) throw err;
     throw new Error(original);
   };
-  fs36.mkdirSync(managedRoot, { recursive: true });
+  fs37.mkdirSync(managedRoot, { recursive: true });
   assertAncestorsClean(managedRoot, homeDir, "managed root");
   const managedRootStat = lstatOrNull5(managedRoot);
   if (managedRootStat === null || !managedRootStat.isDirectory() || managedRootStat.isSymbolicLink()) {
@@ -14188,14 +14255,14 @@ async function activateVerifiedPiRelease(input) {
   const lockToken = `${JSON.stringify({ pid: process.pid, stageDir, releaseId, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `;
   try {
-    fs36.writeFileSync(lockPath, lockToken, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(lockPath, lockToken, { encoding: "utf8", flag: "wx", mode: 384 });
     lockAcquired = true;
   } catch {
     failIncomplete(`transaction lock busy: concurrent activation holds the exclusive lock (recovery incomplete): ${lockPath}`);
   }
   if (lstatOrNull5(markerPath) !== null) {
     try {
-      fs36.rmSync(lockPath, { force: true });
+      fs37.rmSync(lockPath, { force: true });
       lockAcquired = false;
     } catch {
     }
@@ -14204,10 +14271,10 @@ async function activateVerifiedPiRelease(input) {
   const markerContent = `${JSON.stringify({ stageDir, backupDir, releaseId, releaseDir, phase: "prepared", pid: process.pid }, null, 2)}
 `;
   try {
-    fs36.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
   } catch {
     try {
-      fs36.rmSync(lockPath, { force: true });
+      fs37.rmSync(lockPath, { force: true });
       lockAcquired = false;
     } catch {
     }
@@ -14225,7 +14292,7 @@ async function activateVerifiedPiRelease(input) {
     }
   }
   try {
-    fs36.mkdirSync(backupDir);
+    fs37.mkdirSync(backupDir);
     backupCreated = true;
     captureBackupDirIdentity();
   } catch (err) {
@@ -14245,7 +14312,7 @@ async function activateVerifiedPiRelease(input) {
   }
   const persistBackupCopy = (target, content) => {
     if (content === null) return;
-    fs36.writeFileSync(target, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(target, content, { encoding: "utf8", flag: "wx", mode: 384 });
     trackOwnedBackupFile(target, content);
   };
   let entryMoved = false;
@@ -14255,10 +14322,10 @@ async function activateVerifiedPiRelease(input) {
   try {
     persistBackupCopy(backupSettings, oldSettings);
     persistBackupCopy(backupReceipt, oldReceipt);
-    const metaPath = path44.join(backupDir, "meta.json");
+    const metaPath = path45.join(backupDir, "meta.json");
     const metaContent = `${JSON.stringify({ releaseId, oldEntryExisted }, null, 2)}
 `;
-    fs36.writeFileSync(metaPath, metaContent, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(metaPath, metaContent, { encoding: "utf8", flag: "wx", mode: 384 });
     trackOwnedBackupFile(metaPath, metaContent);
   } catch {
     abortBeforePublish(new Error(`cannot persist private backup`));
@@ -14274,7 +14341,7 @@ async function activateVerifiedPiRelease(input) {
       } else {
         let target = null;
         try {
-          target = fs36.readlinkSync(linkPath);
+          target = fs37.readlinkSync(linkPath);
         } catch {
           target = null;
         }
@@ -14286,7 +14353,7 @@ async function activateVerifiedPiRelease(input) {
     if (drift === null && wroteSettings) {
       let cur = null;
       try {
-        cur = fs36.readFileSync(settingsPath, "utf8");
+        cur = fs37.readFileSync(settingsPath, "utf8");
       } catch {
         cur = null;
       }
@@ -14295,7 +14362,7 @@ async function activateVerifiedPiRelease(input) {
     if (drift === null && wroteReceipt) {
       let cur = null;
       try {
-        cur = fs36.readFileSync(receiptPath, "utf8");
+        cur = fs37.readFileSync(receiptPath, "utf8");
       } catch {
         cur = null;
       }
@@ -14311,7 +14378,7 @@ async function activateVerifiedPiRelease(input) {
         if (cur === null || !cur.isSymbolicLink()) {
           problems.push("published entry link missing");
         } else {
-          fs36.unlinkSync(linkPath);
+          fs37.unlinkSync(linkPath);
         }
       } else if (lstatOrNull5(linkPath) !== null) {
         problems.push("unexpected managed entry");
@@ -14327,7 +14394,7 @@ async function activateVerifiedPiRelease(input) {
         } else if (lstatOrNull5(linkPath) !== null) {
           problems.push("managed entry still present");
         } else {
-          fs36.renameSync(backupEntry, linkPath);
+          fs37.renameSync(backupEntry, linkPath);
         }
       } else if (lstatOrNull5(linkPath) !== null) {
         problems.push("unexpected managed entry");
@@ -14340,7 +14407,7 @@ async function activateVerifiedPiRelease(input) {
         if (oldSettings !== null) {
           atomicWritePrivate(settingsPath, oldSettings);
         } else {
-          fs36.rmSync(settingsPath, { force: true });
+          fs37.rmSync(settingsPath, { force: true });
         }
       }
     } catch {
@@ -14351,7 +14418,7 @@ async function activateVerifiedPiRelease(input) {
         if (oldReceipt !== null) {
           atomicWritePrivate(receiptPath, oldReceipt);
         } else {
-          fs36.rmSync(receiptPath, { force: true });
+          fs37.rmSync(receiptPath, { force: true });
         }
       }
     } catch {
@@ -14361,7 +14428,7 @@ async function activateVerifiedPiRelease(input) {
       const destStat = lstatOrNull5(releaseDir);
       const stagedStat = lstatOrNull5(stagedNpm);
       if (destStat !== null && stagedStat === null) {
-        fs36.renameSync(releaseDir, stagedNpm);
+        fs37.renameSync(releaseDir, stagedNpm);
       } else if (destStat !== null && stagedStat !== null) {
         problems.push("staged tree and promoted release both present");
       } else if (destStat === null && stagedStat === null) {
@@ -14381,7 +14448,7 @@ async function activateVerifiedPiRelease(input) {
       clearOwnedBackupThenCooperativeState(original);
     } else {
       try {
-        fs36.rmSync(markerPath, { force: true });
+        fs37.rmSync(markerPath, { force: true });
         releaseLock();
       } catch {
         failIncomplete(`cannot clear transaction state after rollback: ${original}`);
@@ -14397,14 +14464,14 @@ async function activateVerifiedPiRelease(input) {
   };
   try {
     if (oldEntryExisted) {
-      fs36.renameSync(linkPath, backupEntry);
+      fs37.renameSync(linkPath, backupEntry);
       entryMoved = true;
     }
   } catch {
     abortBeforePublish(new Error(`cannot backup previous managed entry`));
   }
   try {
-    fs36.mkdirSync(releaseRoot, { recursive: true });
+    fs37.mkdirSync(releaseRoot, { recursive: true });
     assertAncestorsClean(releaseRoot, homeDir, "release root");
     const rootStat = lstatOrNull5(releaseRoot);
     if (rootStat === null || !rootStat.isDirectory() || rootStat.isSymbolicLink()) {
@@ -14413,8 +14480,8 @@ async function activateVerifiedPiRelease(input) {
     if (lstatOrNull5(releaseDir) !== null) {
       throw new Error(`release already exists: ${releaseDir}`);
     }
-    fs36.renameSync(stagedNpm, releaseDir);
-    fs36.symlinkSync(expectedTarget, linkPath, "dir");
+    fs37.renameSync(stagedNpm, releaseDir);
+    fs37.symlinkSync(expectedTarget, linkPath, "dir");
     publishedLink = true;
     atomicWritePrivate(settingsPath, input.nextSettings);
     wroteSettings = true;
@@ -14432,7 +14499,7 @@ async function activateVerifiedPiRelease(input) {
     rollback(err);
   }
   try {
-    fs36.rmSync(markerPath, { force: true });
+    fs37.rmSync(markerPath, { force: true });
     releaseLock();
   } catch {
     failIncomplete(`cannot clear transaction state after activation (recovery incomplete): ${markerPath}`);
@@ -14448,14 +14515,14 @@ function isManagedDependency(value) {
 }
 function readTextOrNull(p7) {
   try {
-    return fs36.readFileSync(p7, "utf8");
+    return fs37.readFileSync(p7, "utf8");
   } catch {
     return null;
   }
 }
 function safeReadlink(p7) {
   try {
-    return fs36.readlinkSync(p7);
+    return fs37.readlinkSync(p7);
   } catch {
     return null;
   }
@@ -14471,7 +14538,7 @@ function deactivateVerifiedPiRelease(input) {
   if (typeof input.homeDir !== "string" || input.homeDir === "" || typeof input.agentDir !== "string" || input.agentDir === "" || typeof input.receiptPath !== "string" || input.receiptPath === "" || typeof mp.releaseDir !== "string" || mp.releaseDir === "" || typeof mp.linkPath !== "string" || mp.linkPath === "" || typeof mp.backupDir !== "string" || mp.backupDir === "") {
     throw new Error(`homeDir, agentDir, receiptPath and managedPackage paths must be non-empty strings`);
   }
-  if (!path44.isAbsolute(input.homeDir)) {
+  if (!path45.isAbsolute(input.homeDir)) {
     throw new Error(`homeDir must be absolute: ${input.homeDir}`);
   }
   if (typeof mp.lockSha256 !== "string" || !HEX64_PATTERN.test(mp.lockSha256)) {
@@ -14512,23 +14579,23 @@ function deactivateVerifiedPiRelease(input) {
   if (agentStat === null || !agentStat.isDirectory() || agentStat.isSymbolicLink()) {
     throw new Error(`agentDir must be a real directory: ${input.agentDir}`);
   }
-  const settingsPath = path44.join(agentDir, "settings.json");
-  const npmDir = path44.join(agentDir, "npm");
-  const nodeModules = path44.join(npmDir, "node_modules");
-  const expectedLink = path44.join(nodeModules, EXPECTED_ENTRY);
-  const releaseRoot = path44.join(npmDir, "jorgex-pi-managed", "releases");
-  const managedRoot = path44.join(npmDir, "jorgex-pi-managed");
-  const markerPath = path44.join(managedRoot, "active-transaction.json");
-  const lockPath = path44.join(managedRoot, "transaction.lock");
+  const settingsPath = path45.join(agentDir, "settings.json");
+  const npmDir = path45.join(agentDir, "npm");
+  const nodeModules = path45.join(npmDir, "node_modules");
+  const expectedLink = path45.join(nodeModules, EXPECTED_ENTRY);
+  const releaseRoot = path45.join(npmDir, "jorgex-pi-managed", "releases");
+  const managedRoot = path45.join(npmDir, "jorgex-pi-managed");
+  const markerPath = path45.join(managedRoot, "active-transaction.json");
+  const lockPath = path45.join(managedRoot, "transaction.lock");
   if (linkPath !== expectedLink) {
     throw new Error(`managed link must be the owned entry: ${expectedLink}`);
   }
-  const releaseId = path44.basename(releaseDir);
-  if (path44.dirname(releaseDir) !== releaseRoot || !HEX64_PATTERN.test(releaseId)) {
+  const releaseId = path45.basename(releaseDir);
+  if (path45.dirname(releaseDir) !== releaseRoot || !HEX64_PATTERN.test(releaseId)) {
     throw new Error(`managed release must live under the private releases root: ${releaseDir}`);
   }
   const expectedTarget = `../jorgex-pi-managed/releases/${releaseId}/node_modules/${EXPECTED_ENTRY}`;
-  const packageRoot = path44.join(releaseDir, "node_modules", EXPECTED_ENTRY);
+  const packageRoot = path45.join(releaseDir, "node_modules", EXPECTED_ENTRY);
   assertStrictChild(agentDir, homeDir, "agentDir");
   assertStrictChild(receiptPath, homeDir, "receiptPath");
   assertStrictChild(releaseDir, agentDir, "managed release");
@@ -14567,7 +14634,7 @@ function deactivateVerifiedPiRelease(input) {
   if (linkStat === null || !linkStat.isSymbolicLink()) {
     throw new Error(`managed entry must be the owned symlink: ${linkPath}`);
   }
-  assertAncestorsClean(path44.dirname(linkPath), homeDir, "managed entry");
+  assertAncestorsClean(path45.dirname(linkPath), homeDir, "managed entry");
   const observedTarget = safeReadlink(linkPath);
   if (observedTarget === null || observedTarget !== expectedTarget) {
     throw new Error(`managed entry points outside the owned release: ${linkPath}`);
@@ -14579,7 +14646,7 @@ function deactivateVerifiedPiRelease(input) {
   }
   let liveRealpath = null;
   try {
-    liveRealpath = fs36.realpathSync(linkPath);
+    liveRealpath = fs37.realpathSync(linkPath);
   } catch {
     liveRealpath = null;
   }
@@ -14596,7 +14663,7 @@ function deactivateVerifiedPiRelease(input) {
     throw new Error(`activation backup must be a real directory: ${mp.backupDir}`);
   }
   assertAncestorsClean(activationBackupDir, homeDir, "activation backup");
-  const lockFile = path44.join(releaseDir, "package-lock.json");
+  const lockFile = path45.join(releaseDir, "package-lock.json");
   const lockStat = lstatOrNull5(lockFile);
   if (lockStat === null || lockStat.isSymbolicLink() || !lockStat.isFile()) {
     throw new Error(`managed lock must be a regular file: ${lockFile}`);
@@ -14606,7 +14673,7 @@ function deactivateVerifiedPiRelease(input) {
   }
   let lockBytes;
   try {
-    lockBytes = fs36.readFileSync(lockFile);
+    lockBytes = fs37.readFileSync(lockFile);
   } catch {
     throw new Error(`cannot read managed lock: ${lockFile}`);
   }
@@ -14624,19 +14691,19 @@ function deactivateVerifiedPiRelease(input) {
   let oldReceipt = null;
   try {
     if (lstatOrNull5(settingsPath) !== null) {
-      oldSettings = fs36.readFileSync(settingsPath, "utf8");
+      oldSettings = fs37.readFileSync(settingsPath, "utf8");
     }
-    oldReceipt = fs36.readFileSync(receiptPath, "utf8");
+    oldReceipt = fs37.readFileSync(receiptPath, "utf8");
   } catch {
     throw new Error(`cannot read previous settings/receipt`);
   }
   let lockAcquired = false;
   const releaseLock = () => {
     if (!lockAcquired) return;
-    fs36.rmSync(lockPath, { force: true });
+    fs37.rmSync(lockPath, { force: true });
     lockAcquired = false;
   };
-  fs36.mkdirSync(managedRoot, { recursive: true });
+  fs37.mkdirSync(managedRoot, { recursive: true });
   assertAncestorsClean(managedRoot, homeDir, "managed root");
   const managedRootStat = lstatOrNull5(managedRoot);
   if (managedRootStat === null || !managedRootStat.isDirectory() || managedRootStat.isSymbolicLink()) {
@@ -14644,7 +14711,7 @@ function deactivateVerifiedPiRelease(input) {
   }
   let uninstallBackupDir = "";
   for (let i = 0; i < 5 && uninstallBackupDir === ""; i++) {
-    const candidateDir = path44.join(managedRoot, `uninstall-backup-${crypto2.randomBytes(8).toString("hex")}`);
+    const candidateDir = path45.join(managedRoot, `uninstall-backup-${crypto2.randomBytes(8).toString("hex")}`);
     if (lstatOrNull5(candidateDir) === null) uninstallBackupDir = candidateDir;
   }
   if (uninstallBackupDir === "") {
@@ -14654,14 +14721,14 @@ function deactivateVerifiedPiRelease(input) {
   const lockToken = `${JSON.stringify({ op: "uninstall", pid: process.pid, agentDir, releaseId, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `;
   try {
-    fs36.writeFileSync(lockPath, lockToken, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(lockPath, lockToken, { encoding: "utf8", flag: "wx", mode: 384 });
     lockAcquired = true;
   } catch {
     failIncomplete(`transaction lock busy: concurrent operation holds the exclusive lock (recovery incomplete): ${lockPath}`);
   }
   if (lstatOrNull5(markerPath) !== null) {
     try {
-      fs36.rmSync(lockPath, { force: true });
+      fs37.rmSync(lockPath, { force: true });
       lockAcquired = false;
     } catch {
     }
@@ -14670,10 +14737,10 @@ function deactivateVerifiedPiRelease(input) {
   const markerContent = `${JSON.stringify({ phase: "uninstall", releaseDir, linkPath, receiptPath, backupDir: uninstallBackupDir, activationBackupDir, releaseId, pid: process.pid }, null, 2)}
 `;
   try {
-    fs36.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
   } catch {
     try {
-      fs36.rmSync(lockPath, { force: true });
+      fs37.rmSync(lockPath, { force: true });
       lockAcquired = false;
     } catch {
     }
@@ -14682,7 +14749,7 @@ function deactivateVerifiedPiRelease(input) {
   const abortOwnTransaction = (err) => {
     const problems = [];
     try {
-      fs36.rmSync(markerPath, { force: true });
+      fs37.rmSync(markerPath, { force: true });
     } catch {
       problems.push("cannot remove marker");
     }
@@ -14692,7 +14759,7 @@ function deactivateVerifiedPiRelease(input) {
       problems.push("cannot release lock");
     }
     try {
-      fs36.rmSync(uninstallBackupDir, { recursive: true, force: true });
+      fs37.rmSync(uninstallBackupDir, { recursive: true, force: true });
     } catch {
       problems.push("cannot clear backup");
     }
@@ -14728,7 +14795,7 @@ function deactivateVerifiedPiRelease(input) {
     }
     if (drift !== null) {
       try {
-        fs36.rmSync(markerPath, { force: true });
+        fs37.rmSync(markerPath, { force: true });
         releaseLock();
       } catch {
       }
@@ -14737,7 +14804,7 @@ function deactivateVerifiedPiRelease(input) {
   };
   recheckLiveState();
   try {
-    fs36.mkdirSync(uninstallBackupDir, { recursive: true });
+    fs37.mkdirSync(uninstallBackupDir, { recursive: true });
   } catch (err) {
     abortOwnTransaction(err);
   }
@@ -14747,22 +14814,22 @@ function deactivateVerifiedPiRelease(input) {
   }
   let backupEntries = [];
   try {
-    backupEntries = fs36.readdirSync(uninstallBackupDir);
+    backupEntries = fs37.readdirSync(uninstallBackupDir);
   } catch {
     abortOwnTransaction(new Error(`cannot inspect uninstall backup: ${uninstallBackupDir}`));
   }
   if (backupEntries.length !== 0) {
     abortOwnTransaction(new Error(`uninstall backup is not empty: ${uninstallBackupDir}`));
   }
-  const backupReleaseDir = path44.join(uninstallBackupDir, "release");
-  const backupReceiptFile = path44.join(uninstallBackupDir, "pi-receipt.json");
-  const backupSettingsFile = path44.join(uninstallBackupDir, "settings.json");
+  const backupReleaseDir = path45.join(uninstallBackupDir, "release");
+  const backupReceiptFile = path45.join(uninstallBackupDir, "pi-receipt.json");
+  const backupSettingsFile = path45.join(uninstallBackupDir, "settings.json");
   try {
     if (oldSettings !== null) {
-      fs36.writeFileSync(backupSettingsFile, oldSettings, { encoding: "utf8", flag: "wx", mode: 384 });
+      fs37.writeFileSync(backupSettingsFile, oldSettings, { encoding: "utf8", flag: "wx", mode: 384 });
     }
-    fs36.writeFileSync(
-      path44.join(uninstallBackupDir, "meta.json"),
+    fs37.writeFileSync(
+      path45.join(uninstallBackupDir, "meta.json"),
       `${JSON.stringify({ phase: "uninstall", releaseDir, linkPath, receiptPath, linkTarget: observedTarget }, null, 2)}
 `,
       { encoding: "utf8", flag: "wx", mode: 384 }
@@ -14815,14 +14882,14 @@ function deactivateVerifiedPiRelease(input) {
     const problems = [];
     if (movedRelease) {
       try {
-        fs36.renameSync(backupReleaseDir, releaseDir);
+        fs37.renameSync(backupReleaseDir, releaseDir);
       } catch {
         problems.push("cannot restore release");
       }
     }
     if (removedLink) {
       try {
-        fs36.symlinkSync(observedTarget, linkPath, "dir");
+        fs37.symlinkSync(observedTarget, linkPath, "dir");
       } catch {
         problems.push("cannot restore managed entry");
       }
@@ -14832,7 +14899,7 @@ function deactivateVerifiedPiRelease(input) {
         if (oldSettings !== null) {
           atomicWritePrivate(settingsPath, oldSettings);
         } else {
-          fs36.rmSync(settingsPath, { force: true });
+          fs37.rmSync(settingsPath, { force: true });
         }
       } catch {
         problems.push("cannot restore previous settings");
@@ -14840,7 +14907,7 @@ function deactivateVerifiedPiRelease(input) {
     }
     if (movedReceipt) {
       try {
-        fs36.renameSync(backupReceiptFile, receiptPath);
+        fs37.renameSync(backupReceiptFile, receiptPath);
       } catch {
         problems.push("cannot restore receipt");
       }
@@ -14849,9 +14916,9 @@ function deactivateVerifiedPiRelease(input) {
       failIncomplete(`uninstall rollback incomplete (${problems.join("; ")}): ${original}`);
     }
     try {
-      fs36.rmSync(markerPath, { force: true });
+      fs37.rmSync(markerPath, { force: true });
       releaseLock();
-      fs36.rmSync(uninstallBackupDir, { recursive: true, force: true });
+      fs37.rmSync(uninstallBackupDir, { recursive: true, force: true });
     } catch {
       failIncomplete(`cannot clear transaction state after rollback: ${original}`);
     }
@@ -14864,11 +14931,11 @@ function deactivateVerifiedPiRelease(input) {
     throw wrapped;
   };
   try {
-    fs36.unlinkSync(linkPath);
+    fs37.unlinkSync(linkPath);
     removedLink = true;
-    fs36.renameSync(releaseDir, backupReleaseDir);
+    fs37.renameSync(releaseDir, backupReleaseDir);
     movedRelease = true;
-    fs36.renameSync(receiptPath, backupReceiptFile);
+    fs37.renameSync(receiptPath, backupReceiptFile);
     movedReceipt = true;
     atomicWritePrivate(settingsPath, input.nextSettings);
     wroteSettings = true;
@@ -14890,7 +14957,7 @@ function deactivateVerifiedPiRelease(input) {
     rollbackDeactivate(new Error(`verify must be synchronous and return void, got thenable`));
   }
   try {
-    fs36.rmSync(markerPath, { force: true });
+    fs37.rmSync(markerPath, { force: true });
     releaseLock();
   } catch {
     failIncomplete(`cannot clear transaction state after uninstall (recovery incomplete): ${markerPath}`);
@@ -14931,7 +14998,7 @@ function readRegularTextLegacy(file, label) {
     throw new Error(`${label} exceeds size bound: ${file}`);
   }
   try {
-    return fs36.readFileSync(file, "utf8");
+    return fs37.readFileSync(file, "utf8");
   } catch {
     throw new Error(`cannot read ${label}: ${file}`);
   }
@@ -14943,7 +15010,7 @@ function deactivateVerifiedLegacyPiEntry(input) {
   if (typeof input.homeDir !== "string" || input.homeDir === "" || typeof input.agentDir !== "string" || input.agentDir === "" || typeof input.receiptPath !== "string" || input.receiptPath === "" || typeof input.source !== "string" || input.source === "") {
     throw new Error(`homeDir, agentDir, receiptPath and source must be non-empty strings`);
   }
-  if (!path44.isAbsolute(input.homeDir)) {
+  if (!path45.isAbsolute(input.homeDir)) {
     throw new Error(`homeDir must be absolute: ${input.homeDir}`);
   }
   const sourceMatch = LEGACY_SOURCE_PATTERN.exec(input.source);
@@ -14977,13 +15044,13 @@ function deactivateVerifiedLegacyPiEntry(input) {
   if (agentStat === null || !agentStat.isDirectory() || agentStat.isSymbolicLink()) {
     throw new Error(`agentDir must be a real directory: ${input.agentDir}`);
   }
-  const settingsPath = path44.join(agentDir, "settings.json");
-  const npmDir = path44.join(agentDir, "npm");
-  const nodeModules = path44.join(npmDir, "node_modules");
-  const legacyEntry = path44.join(nodeModules, EXPECTED_ENTRY);
-  const managedRoot = path44.join(npmDir, "jorgex-pi-managed");
-  const markerPath = path44.join(managedRoot, "active-transaction.json");
-  const lockPath = path44.join(managedRoot, "transaction.lock");
+  const settingsPath = path45.join(agentDir, "settings.json");
+  const npmDir = path45.join(agentDir, "npm");
+  const nodeModules = path45.join(npmDir, "node_modules");
+  const legacyEntry = path45.join(nodeModules, EXPECTED_ENTRY);
+  const managedRoot = path45.join(npmDir, "jorgex-pi-managed");
+  const markerPath = path45.join(managedRoot, "active-transaction.json");
+  const lockPath = path45.join(managedRoot, "transaction.lock");
   assertStrictChild(agentDir, homeDir, "agentDir");
   assertStrictChild(receiptPath, homeDir, "receiptPath");
   assertStrictChild(managedRoot, agentDir, "managed root");
@@ -15016,8 +15083,8 @@ function deactivateVerifiedLegacyPiEntry(input) {
   if (entryStat === null || !entryStat.isDirectory() || entryStat.isSymbolicLink()) {
     throw new Error(`managed entry must be a real directory, not a symlink: ${legacyEntry}`);
   }
-  assertAncestorsClean(path44.dirname(legacyEntry), homeDir, "managed entry");
-  const manifestPath = path44.join(legacyEntry, "package.json");
+  assertAncestorsClean(path45.dirname(legacyEntry), homeDir, "managed entry");
+  const manifestPath = path45.join(legacyEntry, "package.json");
   const manifestStat = lstatOrNull5(manifestPath);
   if (manifestStat === null || !manifestStat.isFile() || manifestStat.isSymbolicLink()) {
     throw new Error(`managed entry manifest must be a regular file: ${manifestPath}`);
@@ -15114,10 +15181,10 @@ function deactivateVerifiedLegacyPiEntry(input) {
   let lockAcquired = false;
   const releaseLock = () => {
     if (!lockAcquired) return;
-    fs36.rmSync(lockPath, { force: true });
+    fs37.rmSync(lockPath, { force: true });
     lockAcquired = false;
   };
-  fs36.mkdirSync(managedRoot, { recursive: true });
+  fs37.mkdirSync(managedRoot, { recursive: true });
   assertAncestorsClean(managedRoot, homeDir, "managed root");
   const managedRootStat = lstatOrNull5(managedRoot);
   if (managedRootStat === null || !managedRootStat.isDirectory() || managedRootStat.isSymbolicLink()) {
@@ -15125,7 +15192,7 @@ function deactivateVerifiedLegacyPiEntry(input) {
   }
   let uninstallBackupDir = "";
   for (let i = 0; i < 5 && uninstallBackupDir === ""; i++) {
-    const candidateDir = path44.join(managedRoot, `uninstall-backup-${crypto2.randomBytes(8).toString("hex")}`);
+    const candidateDir = path45.join(managedRoot, `uninstall-backup-${crypto2.randomBytes(8).toString("hex")}`);
     if (lstatOrNull5(candidateDir) === null) uninstallBackupDir = candidateDir;
   }
   if (uninstallBackupDir === "") {
@@ -15135,14 +15202,14 @@ function deactivateVerifiedLegacyPiEntry(input) {
   const lockToken = `${JSON.stringify({ op: "uninstall-legacy", pid: process.pid, agentDir, source: input.source, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `;
   try {
-    fs36.writeFileSync(lockPath, lockToken, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(lockPath, lockToken, { encoding: "utf8", flag: "wx", mode: 384 });
     lockAcquired = true;
   } catch {
     failIncomplete(`transaction lock busy: concurrent operation holds the exclusive lock (recovery incomplete): ${lockPath}`);
   }
   if (lstatOrNull5(markerPath) !== null) {
     try {
-      fs36.rmSync(lockPath, { force: true });
+      fs37.rmSync(lockPath, { force: true });
       lockAcquired = false;
     } catch {
     }
@@ -15151,10 +15218,10 @@ function deactivateVerifiedLegacyPiEntry(input) {
   const markerContent = `${JSON.stringify({ phase: "uninstall-legacy", legacyEntry, receiptPath, backupDir: uninstallBackupDir, source: input.source, pid: process.pid }, null, 2)}
 `;
   try {
-    fs36.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
   } catch {
     try {
-      fs36.rmSync(lockPath, { force: true });
+      fs37.rmSync(lockPath, { force: true });
       lockAcquired = false;
     } catch {
     }
@@ -15163,7 +15230,7 @@ function deactivateVerifiedLegacyPiEntry(input) {
   const abortOwnTransaction = (err) => {
     const problems = [];
     try {
-      fs36.rmSync(markerPath, { force: true });
+      fs37.rmSync(markerPath, { force: true });
     } catch {
       problems.push("cannot remove marker");
     }
@@ -15173,7 +15240,7 @@ function deactivateVerifiedLegacyPiEntry(input) {
       problems.push("cannot release lock");
     }
     try {
-      fs36.rmSync(uninstallBackupDir, { recursive: true, force: true });
+      fs37.rmSync(uninstallBackupDir, { recursive: true, force: true });
     } catch {
       problems.push("cannot clear backup");
     }
@@ -15192,7 +15259,7 @@ function deactivateVerifiedLegacyPiEntry(input) {
     abortOwnTransaction(new Error(`receipt or settings drifted before uninstall: ${legacyEntry}`));
   }
   try {
-    fs36.mkdirSync(uninstallBackupDir, { recursive: true });
+    fs37.mkdirSync(uninstallBackupDir, { recursive: true });
   } catch (err) {
     abortOwnTransaction(err);
   }
@@ -15202,20 +15269,20 @@ function deactivateVerifiedLegacyPiEntry(input) {
   }
   let backupEntries = [];
   try {
-    backupEntries = fs36.readdirSync(uninstallBackupDir);
+    backupEntries = fs37.readdirSync(uninstallBackupDir);
   } catch {
     abortOwnTransaction(new Error(`cannot inspect uninstall backup: ${uninstallBackupDir}`));
   }
   if (backupEntries.length !== 0) {
     abortOwnTransaction(new Error(`uninstall backup is not empty: ${uninstallBackupDir}`));
   }
-  const backupEntryDir = path44.join(uninstallBackupDir, "entry");
-  const backupReceiptFile = path44.join(uninstallBackupDir, "pi-receipt.json");
-  const backupSettingsFile = path44.join(uninstallBackupDir, "settings.json");
+  const backupEntryDir = path45.join(uninstallBackupDir, "entry");
+  const backupReceiptFile = path45.join(uninstallBackupDir, "pi-receipt.json");
+  const backupSettingsFile = path45.join(uninstallBackupDir, "settings.json");
   try {
-    fs36.writeFileSync(backupSettingsFile, oldSettings, { encoding: "utf8", flag: "wx", mode: 384 });
-    fs36.writeFileSync(
-      path44.join(uninstallBackupDir, "meta.json"),
+    fs37.writeFileSync(backupSettingsFile, oldSettings, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs37.writeFileSync(
+      path45.join(uninstallBackupDir, "meta.json"),
       `${JSON.stringify({ phase: "uninstall-legacy", legacyEntry, receiptPath, source: input.source }, null, 2)}
 `,
       { encoding: "utf8", flag: "wx", mode: 384 }
@@ -15259,14 +15326,14 @@ function deactivateVerifiedLegacyPiEntry(input) {
     const problems = [];
     if (movedReceipt) {
       try {
-        fs36.renameSync(backupReceiptFile, receiptPath);
+        fs37.renameSync(backupReceiptFile, receiptPath);
       } catch {
         problems.push("cannot restore receipt");
       }
     }
     if (movedEntry) {
       try {
-        fs36.renameSync(backupEntryDir, legacyEntry);
+        fs37.renameSync(backupEntryDir, legacyEntry);
       } catch {
         problems.push("cannot restore previous entry");
       }
@@ -15282,9 +15349,9 @@ function deactivateVerifiedLegacyPiEntry(input) {
       failIncomplete(`uninstall rollback incomplete (${problems.join("; ")}): ${original}`);
     }
     try {
-      fs36.rmSync(markerPath, { force: true });
+      fs37.rmSync(markerPath, { force: true });
       releaseLock();
-      fs36.rmSync(uninstallBackupDir, { recursive: true, force: true });
+      fs37.rmSync(uninstallBackupDir, { recursive: true, force: true });
     } catch {
       failIncomplete(`cannot clear transaction state after rollback: ${original}`);
     }
@@ -15297,9 +15364,9 @@ function deactivateVerifiedLegacyPiEntry(input) {
     throw wrapped;
   };
   try {
-    fs36.renameSync(legacyEntry, backupEntryDir);
+    fs37.renameSync(legacyEntry, backupEntryDir);
     movedEntry = true;
-    fs36.renameSync(receiptPath, backupReceiptFile);
+    fs37.renameSync(receiptPath, backupReceiptFile);
     movedReceipt = true;
     atomicWritePrivate(settingsPath, input.nextSettings);
     wroteSettings = true;
@@ -15321,7 +15388,7 @@ function deactivateVerifiedLegacyPiEntry(input) {
     rollbackLegacy(new Error(`verify must be synchronous and return void, got thenable`));
   }
   try {
-    fs36.rmSync(markerPath, { force: true });
+    fs37.rmSync(markerPath, { force: true });
     releaseLock();
   } catch {
     failIncomplete(`cannot clear transaction state after uninstall (recovery incomplete): ${markerPath}`);
@@ -15377,8 +15444,8 @@ async function activatePreparedPiInstall(input, deps) {
 // src/lib/pi-stage-smoke.ts
 init_detect();
 import { spawn, spawnSync as spawnSync4 } from "child_process";
-import fs37 from "fs";
-import path45 from "path";
+import fs38 from "fs";
+import path46 from "path";
 var REQUIRED_COMMANDS = ["goal", "subagents", "permission-system", "websearch", "jorgex:header"];
 var EXPECTED_ARGV = ["--mode", "rpc", "--no-session", "--no-approve", "--offline", "--no-context-files"];
 var KNOWN_STDERR_WARNING = "[pi-web-access] Dynamic tool activation requires Pi 0.86.1 or newer; web tools remain eagerly available.";
@@ -15395,13 +15462,13 @@ function isRecord12(value) {
 }
 function lstatOrNull6(p7) {
   try {
-    return fs37.lstatSync(p7);
+    return fs38.lstatSync(p7);
   } catch {
     return null;
   }
 }
 function assertPiExecutable(piExecutable) {
-  const absolute = path45.resolve(piExecutable);
+  const absolute = path46.resolve(piExecutable);
   const linkStat = lstatOrNull6(absolute);
   if (linkStat === null) {
     fail10(`piExecutable must exist: ${piExecutable}`);
@@ -15409,13 +15476,13 @@ function assertPiExecutable(piExecutable) {
   if (linkStat.isSymbolicLink()) {
     let real;
     try {
-      real = fs37.realpathSync(absolute);
+      real = fs38.realpathSync(absolute);
     } catch {
       fail10(`piExecutable symlink is broken: ${piExecutable}`);
     }
     let targetStat;
     try {
-      targetStat = fs37.statSync(real);
+      targetStat = fs38.statSync(real);
     } catch {
       fail10(`piExecutable symlink target is missing: ${piExecutable}`);
     }
@@ -15424,7 +15491,7 @@ function assertPiExecutable(piExecutable) {
     }
     if (process.platform !== "win32") {
       try {
-        fs37.accessSync(real, fs37.constants.X_OK);
+        fs38.accessSync(real, fs38.constants.X_OK);
       } catch {
         fail10(`piExecutable symlink target is not executable: ${piExecutable}`);
       }
@@ -15436,7 +15503,7 @@ function assertPiExecutable(piExecutable) {
   }
   if (process.platform !== "win32") {
     try {
-      fs37.accessSync(absolute, fs37.constants.X_OK);
+      fs38.accessSync(absolute, fs38.constants.X_OK);
     } catch {
       fail10(`piExecutable is not executable: ${piExecutable}`);
     }
@@ -15444,7 +15511,7 @@ function assertPiExecutable(piExecutable) {
   return absolute;
 }
 function assertRealDir3(p7, label) {
-  const resolved2 = path45.resolve(p7);
+  const resolved2 = path46.resolve(p7);
   const st = lstatOrNull6(resolved2);
   if (st === null || !st.isDirectory() || st.isSymbolicLink()) {
     fail10(`${label} must be a real directory: ${p7}`);
@@ -15459,24 +15526,24 @@ function sleep(ms) {
 }
 function runtimePath2(piExecutable) {
   const entries = process.platform === "win32" ? [
-    path45.dirname(piExecutable),
-    path45.dirname(process.execPath),
-    process.env.SystemRoot ? path45.join(process.env.SystemRoot, "System32") : null
-  ] : [path45.dirname(piExecutable), path45.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
-  return [...new Set(entries.filter((entry) => entry !== null))].join(path45.delimiter);
+    path46.dirname(piExecutable),
+    path46.dirname(process.execPath),
+    process.env.SystemRoot ? path46.join(process.env.SystemRoot, "System32") : null
+  ] : [path46.dirname(piExecutable), path46.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
+  return [...new Set(entries.filter((entry) => entry !== null))].join(path46.delimiter);
 }
 function buildSandboxEnv(stageRoot, stageDir, piExecutable) {
-  const home = path45.join(stageRoot, "home");
-  const appdata = path45.join(stageRoot, "appdata");
-  const localappdata = path45.join(stageRoot, "localappdata");
-  const xdgConfig = path45.join(stageRoot, "xdg-config");
-  const xdgData = path45.join(stageRoot, "xdg-data");
-  const xdgCache = path45.join(stageRoot, "xdg-cache");
-  const temporary = path45.join(stageRoot, "tmp");
-  const npmCache = path45.join(stageRoot, "npm-cache");
+  const home = path46.join(stageRoot, "home");
+  const appdata = path46.join(stageRoot, "appdata");
+  const localappdata = path46.join(stageRoot, "localappdata");
+  const xdgConfig = path46.join(stageRoot, "xdg-config");
+  const xdgData = path46.join(stageRoot, "xdg-data");
+  const xdgCache = path46.join(stageRoot, "xdg-cache");
+  const temporary = path46.join(stageRoot, "tmp");
+  const npmCache = path46.join(stageRoot, "npm-cache");
   for (const dir of [home, appdata, localappdata, xdgConfig, xdgData, xdgCache, temporary, npmCache]) {
     try {
-      fs37.mkdirSync(dir, { recursive: true, mode: 448 });
+      fs38.mkdirSync(dir, { recursive: true, mode: 448 });
     } catch {
       fail10(`cannot prepare isolated stage dir: ${dir}`);
     }
@@ -15553,7 +15620,7 @@ async function stopOwned(child) {
   if (process.platform === "win32") {
     try {
       const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
-      const taskkill = path45.join(systemRoot, "System32", "taskkill.exe");
+      const taskkill = path46.join(systemRoot, "System32", "taskkill.exe");
       spawnSync4(taskkill, ["/pid", String(pid), "/t", "/f"], {
         shell: false,
         stdio: "ignore",
@@ -15702,26 +15769,26 @@ async function smokeStagedPiRuntime(input) {
 async function runSmoke(input) {
   if (!isRecord12(input)) fail10("input must be an object");
   const { piExecutable, stageDir, timeoutMs } = input;
-  if (typeof piExecutable !== "string" || piExecutable === "" || !path45.isAbsolute(piExecutable)) {
+  if (typeof piExecutable !== "string" || piExecutable === "" || !path46.isAbsolute(piExecutable)) {
     fail10("piExecutable must be a non-empty absolute path");
   }
-  if (typeof stageDir !== "string" || stageDir === "" || !path45.isAbsolute(stageDir)) {
+  if (typeof stageDir !== "string" || stageDir === "" || !path46.isAbsolute(stageDir)) {
     fail10("stageDir must be a non-empty absolute path");
   }
   const piResolved = assertPiExecutable(piExecutable);
   const stageResolved = assertRealDir3(stageDir, "stageDir");
-  if (path45.basename(stageResolved) !== "pi-agent") {
+  if (path46.basename(stageResolved) !== "pi-agent") {
     fail10("stageDir must be the staged pi-agent dir (stageRoot/pi-agent)");
   }
-  const stageRoot = path45.dirname(stageResolved);
+  const stageRoot = path46.dirname(stageResolved);
   const stageRootStat = lstatOrNull6(stageRoot);
   if (stageRootStat === null || !stageRootStat.isDirectory() || stageRootStat.isSymbolicLink()) {
     fail10("stageRoot must be a real directory");
   }
-  if (!path45.basename(stageRoot).startsWith("stage-")) {
+  if (!path46.basename(stageRoot).startsWith("stage-")) {
     fail10("stageRoot must be a private stage- dir");
   }
-  const workspace = path45.join(stageRoot, "workspace");
+  const workspace = path46.join(stageRoot, "workspace");
   assertRealDir3(workspace, "stage workspace");
   let timeout = DEFAULT_TIMEOUT_MS;
   if (timeoutMs !== void 0) {
@@ -15900,8 +15967,8 @@ ${JSON.stringify({ id: commandsId, type: "get_commands" })}
 // src/lib/pi-cached-artifact.ts
 init_npm_provider();
 import { createHash as createHash9, timingSafeEqual as timingSafeEqual6 } from "crypto";
-import fs38 from "fs";
-import path46 from "path";
+import fs39 from "fs";
+import path47 from "path";
 var PACKAGE_NAME5 = "jorgex-pi";
 var HEX643 = /^[0-9a-f]{64}$/;
 var HEX1283 = /^[0-9a-f]{128}$/;
@@ -15912,14 +15979,14 @@ function isRecord13(value) {
 }
 function lstatOrNull7(p7) {
   try {
-    return fs38.lstatSync(p7);
+    return fs39.lstatSync(p7);
   } catch {
     return null;
   }
 }
 function isStrictChild5(child, root) {
-  const rel = path46.relative(root, child);
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path46.sep}`) && !path46.isAbsolute(rel);
+  const rel = path47.relative(root, child);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path47.sep}`) && !path47.isAbsolute(rel);
 }
 function equalHex2(aHex, bHex) {
   let a;
@@ -15936,12 +16003,12 @@ function verifyCachedPiArtifact(input) {
   try {
     if (!isRecord13(input)) return false;
     const { receipt, homeDir, downloadsDir } = input;
-    if (typeof homeDir !== "string" || homeDir === "" || !path46.isAbsolute(homeDir)) return false;
-    if (typeof downloadsDir !== "string" || downloadsDir === "" || !path46.isAbsolute(downloadsDir)) {
+    if (typeof homeDir !== "string" || homeDir === "" || !path47.isAbsolute(homeDir)) return false;
+    if (typeof downloadsDir !== "string" || downloadsDir === "" || !path47.isAbsolute(downloadsDir)) {
       return false;
     }
-    const homeResolved = path46.resolve(homeDir);
-    const downloadsResolved = path46.resolve(downloadsDir);
+    const homeResolved = path47.resolve(homeDir);
+    const downloadsResolved = path47.resolve(downloadsDir);
     const homeStat = lstatOrNull7(homeResolved);
     if (homeStat === null || !homeStat.isDirectory() || homeStat.isSymbolicLink()) return false;
     const downloadsStat = lstatOrNull7(downloadsResolved);
@@ -15949,12 +16016,12 @@ function verifyCachedPiArtifact(input) {
       return false;
     }
     if (!isStrictChild5(downloadsResolved, homeResolved)) return false;
-    const rel = path46.relative(homeResolved, downloadsResolved);
-    const parts = rel.split(path46.sep);
+    const rel = path47.relative(homeResolved, downloadsResolved);
+    const parts = rel.split(path47.sep);
     let cursor = homeResolved;
     for (const part of parts) {
       if (part === "" || part === "." || part === "..") return false;
-      cursor = path46.join(cursor, part);
+      cursor = path47.join(cursor, part);
       const st2 = lstatOrNull7(cursor);
       if (st2 === null || !st2.isDirectory() || st2.isSymbolicLink()) return false;
     }
@@ -15980,8 +16047,8 @@ function verifyCachedPiArtifact(input) {
     if (typeof sha2562 !== "string" || !HEX643.test(sha2562)) return false;
     if (typeof sha512 !== "string" || !HEX1283.test(sha512)) return false;
     const fileName = `${PACKAGE_NAME5}-${version}.tgz`;
-    const target = path46.join(downloadsResolved, fileName);
-    if (path46.dirname(target) !== downloadsResolved) return false;
+    const target = path47.join(downloadsResolved, fileName);
+    if (path47.dirname(target) !== downloadsResolved) return false;
     const st = lstatOrNull7(target);
     if (st === null) return false;
     if (st.isSymbolicLink()) return false;
@@ -15990,7 +16057,7 @@ function verifyCachedPiArtifact(input) {
     if (st.size > MAX_TARBALL_BYTES4) return false;
     let fd;
     try {
-      fd = fs38.openSync(target, "r");
+      fd = fs39.openSync(target, "r");
     } catch {
       return false;
     }
@@ -16002,7 +16069,7 @@ function verifyCachedPiArtifact(input) {
       for (; ; ) {
         let read;
         try {
-          read = fs38.readSync(fd, buffer, 0, buffer.length, null);
+          read = fs39.readSync(fd, buffer, 0, buffer.length, null);
         } catch {
           return false;
         }
@@ -16014,7 +16081,7 @@ function verifyCachedPiArtifact(input) {
       }
     } finally {
       try {
-        fs38.closeSync(fd);
+        fs39.closeSync(fd);
       } catch {
       }
     }
@@ -16176,30 +16243,30 @@ async function resolvePiEngramRequirement(input, deps) {
   } : { kind: "existing", bin: detected, scope: "host" };
 }
 function runtimePath3(piExecutable) {
-  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path47.dirname(piExecutable), path47.dirname(process.execPath), process.env.SystemRoot ? path47.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path47.dirname(piExecutable), path47.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
-  return [...new Set(entries.filter((entry) => entry !== null))].join(path47.delimiter);
+  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path48.dirname(piExecutable), path48.dirname(process.execPath), process.env.SystemRoot ? path48.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path48.dirname(piExecutable), path48.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
+  return [...new Set(entries.filter((entry) => entry !== null))].join(path48.delimiter);
 }
 function targetPaths(targetDir, engramBin, piExecutable) {
-  const root = path47.resolve(targetDir);
-  const codingAgentDir = path47.join(root, "pi-agent");
-  const home = path47.join(root, "home");
-  const temporary = path47.join(root, "tmp");
+  const root = path48.resolve(targetDir);
+  const codingAgentDir = path48.join(root, "pi-agent");
+  const home = path48.join(root, "home");
+  const temporary = path48.join(root, "tmp");
   return {
     codingAgentDir,
-    receiptPath: path47.join(root, "state", "pi-receipt.json"),
-    packageRunner: path47.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path48.join(root, "state", "pi-receipt.json"),
+    packageRunner: path48.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
       USERPROFILE: home,
-      APPDATA: path47.join(root, "appdata"),
-      LOCALAPPDATA: path47.join(root, "localappdata"),
-      XDG_CONFIG_HOME: path47.join(root, "xdg-config"),
-      XDG_DATA_HOME: path47.join(root, "xdg-data"),
-      XDG_CACHE_HOME: path47.join(root, "xdg-cache"),
+      APPDATA: path48.join(root, "appdata"),
+      LOCALAPPDATA: path48.join(root, "localappdata"),
+      XDG_CONFIG_HOME: path48.join(root, "xdg-config"),
+      XDG_DATA_HOME: path48.join(root, "xdg-data"),
+      XDG_CACHE_HOME: path48.join(root, "xdg-cache"),
       TEMP: temporary,
       TMP: temporary,
       TMPDIR: temporary,
-      npm_config_cache: path47.join(root, "npm-cache"),
+      npm_config_cache: path48.join(root, "npm-cache"),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
       PI_CODING_AGENT_DIR: codingAgentDir,
@@ -16210,15 +16277,15 @@ function targetPaths(targetDir, engramBin, piExecutable) {
 }
 function userPaths(engramBin, piExecutable) {
   const home = os6.homedir();
-  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path47.join(home, ".pi", "agent");
+  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path48.join(home, ".pi", "agent");
   return {
     codingAgentDir,
-    receiptPath: path47.join(dataDir(), "pi-receipt.json"),
-    packageRunner: path47.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path48.join(dataDir(), "pi-receipt.json"),
+    packageRunner: path48.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
-      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path47.join(home, ".config"),
-      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path47.join(home, ".cache"),
+      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path48.join(home, ".config"),
+      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path48.join(home, ".cache"),
       TMPDIR: os6.tmpdir(),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
@@ -16254,7 +16321,7 @@ function runPiRuntime(input, deps) {
   }
   const candidate = input.candidate ?? PI_RUNTIME_CANDIDATE;
   const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.detected.executable) : targetPaths(input.targetDir, input.engramBin, input.detected.executable);
-  const settingsJson = deps.readSettings(path47.join(paths.codingAgentDir, "settings.json"));
+  const settingsJson = deps.readSettings(path48.join(paths.codingAgentDir, "settings.json"));
   const receiptJson = deps.readReceipt(paths.receiptPath);
   const lifecycleInput = {
     candidate,
@@ -16319,60 +16386,32 @@ function runPiRuntime(input, deps) {
   persistReturnedReceipt(result, paths, deps);
   return result;
 }
-function readJsonFile2(file) {
-  return JSON.parse(fs39.readFileSync(file, "utf8"));
-}
-function packageVersionFromExecutable(executable) {
-  let current;
-  try {
-    current = path47.dirname(fs39.realpathSync(executable));
-  } catch {
-    return null;
-  }
-  for (let depth = 0; depth < 8; depth++) {
-    const manifests = [
-      path47.join(current, "package.json"),
-      path47.join(current, "node_modules", "@earendil-works", "pi-coding-agent", "package.json")
-    ];
-    for (const manifest of manifests) {
-      try {
-        const parsed = readJsonFile2(manifest);
-        if (parsed !== null && typeof parsed === "object" && Reflect.get(parsed, "name") === "@earendil-works/pi-coding-agent" && typeof Reflect.get(parsed, "version") === "string") {
-          return Reflect.get(parsed, "version");
-        }
-      } catch {
-      }
-    }
-    const parent = path47.dirname(current);
-    if (parent === current) break;
-    current = parent;
-  }
-  return null;
-}
 function detectPiRuntime() {
   const executable = lookPath("pi");
   const home = os6.homedir();
+  const inspection = executable === null ? null : inspectPiHostVersion(executable);
   return {
     id: "pi",
     name: "Pi",
     installed: executable !== null,
     executable,
-    version: executable === null ? null : packageVersionFromExecutable(executable),
-    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path47.join(home, ".pi", "agent")
+    version: inspection?.version ?? null,
+    versionDiagnostic: inspection?.diagnostic ?? null,
+    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path48.join(home, ".pi", "agent")
   };
 }
 function hasManagedPiRuntime(targetDir) {
-  const receipt = targetDir === void 0 ? path47.join(dataDir(), "pi-receipt.json") : path47.join(path47.resolve(targetDir), "state", "pi-receipt.json");
-  return fs39.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
+  const receipt = targetDir === void 0 ? path48.join(dataDir(), "pi-receipt.json") : path48.join(path48.resolve(targetDir), "state", "pi-receipt.json");
+  return fs40.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
 }
 function resolvePiEngramBin(targetDir) {
   if (targetDir === void 0) return detectEngram();
-  const candidate = path47.join(path47.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
-  return fs39.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
+  const candidate = path48.join(path48.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
+  return fs40.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
 }
 function readOptional(file, fallback) {
   try {
-    return fs39.readFileSync(file, "utf8");
+    return fs40.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return fallback;
     throw error;
@@ -16438,7 +16477,7 @@ function preparedInstallMismatch(candidate, prepared) {
     return "la release preparada no coincide con la versi\xF3n/SRI del candidato";
   }
   const stageDir = prepared?.stageDir;
-  if (typeof stageDir !== "string" || stageDir === "" || !/(^|[\\/])stage-[0-9a-f]{32}[\\/]pi-agent$/.test(path47.resolve(stageDir))) {
+  if (typeof stageDir !== "string" || stageDir === "" || !/(^|[\\/])stage-[0-9a-f]{32}[\\/]pi-agent$/.test(path48.resolve(stageDir))) {
     return "el stage preparado no tiene el layout aislado esperado (stage-<hex>/pi-agent)";
   }
   const evidence = prepared?.evidence;
@@ -16513,12 +16552,12 @@ function backupLegacyMigrationState(settingsPath, receiptPath, backupRoot) {
   }
 }
 function verifyActivePiRelease(input) {
-  const agentDir = path47.resolve(input.agentDir);
-  const npmDir = path47.join(agentDir, "npm");
-  const managedRoot = path47.join(npmDir, "jorgex-pi-managed");
+  const agentDir = path48.resolve(input.agentDir);
+  const npmDir = path48.join(agentDir, "npm");
+  const managedRoot = path48.join(npmDir, "jorgex-pi-managed");
   let receiptRaw;
   try {
-    receiptRaw = fs39.readFileSync(input.receiptPath, "utf8");
+    receiptRaw = fs40.readFileSync(input.receiptPath, "utf8");
   } catch {
     throw new Error(`pi-verify-active: no se pudo leer el receipt promovido: ${input.receiptPath}`);
   }
@@ -16547,7 +16586,7 @@ function verifyActivePiRelease(input) {
     throw new Error("pi-verify-active: el scope del receipt promovido no coincide con el esperado");
   }
   const scopeDir = scopeRecord["codingAgentDir"];
-  if (typeof scopeDir !== "string" || !path47.isAbsolute(scopeDir) || path47.resolve(scopeDir) !== agentDir) {
+  if (typeof scopeDir !== "string" || !path48.isAbsolute(scopeDir) || path48.resolve(scopeDir) !== agentDir) {
     throw new Error("pi-verify-active: el codingAgentDir del receipt promovido no coincide con el agentDir");
   }
   const receiptEngram = record["engram"];
@@ -16578,40 +16617,40 @@ function verifyActivePiRelease(input) {
     throw new Error("pi-verify-active: el receipt promovido no conserva las seis dependencias de la evidencia");
   }
   const linkPath = managedRecord["linkPath"];
-  if (typeof linkPath !== "string" || !path47.isAbsolute(linkPath)) {
+  if (typeof linkPath !== "string" || !path48.isAbsolute(linkPath)) {
     throw new Error("pi-verify-active: el receipt promovido no trae un linkPath absoluto");
   }
-  const linkResolved = path47.resolve(linkPath);
-  if (linkResolved !== path47.join(npmDir, "node_modules", "jorgex-pi")) {
+  const linkResolved = path48.resolve(linkPath);
+  if (linkResolved !== path48.join(npmDir, "node_modules", "jorgex-pi")) {
     throw new Error("pi-verify-active: el enlace publicado sale del entry propio");
   }
   const releaseDir = managedRecord["releaseDir"];
-  if (typeof releaseDir !== "string" || !path47.isAbsolute(releaseDir)) {
+  if (typeof releaseDir !== "string" || !path48.isAbsolute(releaseDir)) {
     throw new Error("pi-verify-active: el receipt promovido no trae un releaseDir absoluto");
   }
-  const releaseResolved = path47.resolve(releaseDir);
-  const releaseRel = path47.relative(managedRoot, releaseResolved);
-  if (releaseRel === "" || releaseRel === ".." || releaseRel.startsWith(`..${path47.sep}`) || path47.isAbsolute(releaseRel)) {
+  const releaseResolved = path48.resolve(releaseDir);
+  const releaseRel = path48.relative(managedRoot, releaseResolved);
+  if (releaseRel === "" || releaseRel === ".." || releaseRel.startsWith(`..${path48.sep}`) || path48.isAbsolute(releaseRel)) {
     throw new Error("pi-verify-active: el release promovido sale del root gestionado");
   }
   let target;
   try {
-    const linkStat = fs39.lstatSync(linkResolved);
+    const linkStat = fs40.lstatSync(linkResolved);
     if (!linkStat.isSymbolicLink()) {
       throw new Error("pi-verify-active: el entry publicado no es un enlace");
     }
-    target = fs39.readlinkSync(linkResolved);
+    target = fs40.readlinkSync(linkResolved);
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("pi-verify-active: ")) throw error;
     throw new Error("pi-verify-active: no se pudo leer el enlace publicado");
   }
-  const packageRoot = path47.join(releaseResolved, "node_modules", "jorgex-pi");
-  if (target === "" || path47.isAbsolute(target) || path47.resolve(path47.dirname(linkResolved), target) !== packageRoot) {
+  const packageRoot = path48.join(releaseResolved, "node_modules", "jorgex-pi");
+  if (target === "" || path48.isAbsolute(target) || path48.resolve(path48.dirname(linkResolved), target) !== packageRoot) {
     throw new Error("pi-verify-active: el enlace publicado no apunta al release promovido");
   }
   let realRoot;
   try {
-    realRoot = fs39.realpathSync(linkResolved);
+    realRoot = fs40.realpathSync(linkResolved);
   } catch {
     throw new Error("pi-verify-active: no se pudo resolver el realpath del enlace publicado");
   }
@@ -16629,8 +16668,8 @@ function verifyActivePiRelease(input) {
   }
 }
 function isStrictChildPath(child, root) {
-  const rel = path47.relative(path47.resolve(root), path47.resolve(child));
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path47.sep}`) && !path47.isAbsolute(rel);
+  const rel = path48.relative(path48.resolve(root), path48.resolve(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path48.sep}`) && !path48.isAbsolute(rel);
 }
 async function preparePiRuntimeSystem(input) {
   if (input.operation !== "install" && input.operation !== "update") {
@@ -16648,7 +16687,7 @@ async function preparePiRuntimeSystem(input) {
         remedy: "El update con --target-dir nunca ejecuta preflight de red; aporta un stage preverificado o usa update real."
       };
     }
-    if (typeof input.engramBin !== "string" || input.engramBin === "" || !path47.isAbsolute(input.engramBin)) {
+    if (typeof input.engramBin !== "string" || input.engramBin === "" || !path48.isAbsolute(input.engramBin)) {
       return {
         kind: "blocked",
         reason: "engram-required",
@@ -16656,7 +16695,7 @@ async function preparePiRuntimeSystem(input) {
       };
     }
     const updateExecutable = input.detected.executable;
-    if (typeof updateExecutable !== "string" || updateExecutable === "" || !path47.isAbsolute(updateExecutable)) {
+    if (typeof updateExecutable !== "string" || updateExecutable === "" || !path48.isAbsolute(updateExecutable)) {
       return {
         kind: "blocked",
         reason: "pi-executable-missing",
@@ -16671,16 +16710,16 @@ async function preparePiRuntimeSystem(input) {
       };
     }
     const updateHomeDir = os6.homedir();
-    if (typeof updateHomeDir !== "string" || updateHomeDir === "" || !path47.isAbsolute(updateHomeDir)) {
+    if (typeof updateHomeDir !== "string" || updateHomeDir === "" || !path48.isAbsolute(updateHomeDir)) {
       return {
         kind: "blocked",
         reason: "preflight-failed",
         remedy: "HOME ilegible para el preflight Pi; Pi no qued\xF3 activado."
       };
     }
-    const updateAgentDir = process.env.PI_CODING_AGENT_DIR ?? path47.join(updateHomeDir, ".pi", "agent");
-    const updateReceiptPath = path47.join(updateHomeDir, ".jorgex-stack", "pi-receipt.json");
-    const updateDownloadsDir = path47.join(updateHomeDir, ".jorgex-stack", "packages");
+    const updateAgentDir = process.env.PI_CODING_AGENT_DIR ?? path48.join(updateHomeDir, ".pi", "agent");
+    const updateReceiptPath = path48.join(updateHomeDir, ".jorgex-stack", "pi-receipt.json");
+    const updateDownloadsDir = path48.join(updateHomeDir, ".jorgex-stack", "packages");
     if (!isStrictChildPath(updateAgentDir, updateHomeDir)) {
       return {
         kind: "blocked",
@@ -16688,7 +16727,7 @@ async function preparePiRuntimeSystem(input) {
         remedy: `PI_CODING_AGENT_DIR (${updateAgentDir}) est\xE1 fuera de la frontera de restore HOME (${updateHomeDir}); corrige el destino antes de reintentar; Pi no qued\xF3 activado.`
       };
     }
-    const updateSettingsPath = path47.join(updateAgentDir, "settings.json");
+    const updateSettingsPath = path48.join(updateAgentDir, "settings.json");
     let updateReceiptRaw;
     let updateSettingsRaw;
     try {
@@ -16704,7 +16743,7 @@ async function preparePiRuntimeSystem(input) {
     const stripUpdateGateNewline = (value) => value.endsWith("\n") ? value.slice(0, -1) : value;
     const updateReceiptJson = updateReceiptRaw === null ? null : stripUpdateGateNewline(updateReceiptRaw);
     const updateSettingsJson = stripUpdateGateNewline(updateSettingsRaw);
-    const updatePackageRunner = path47.join(updateAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs");
+    const updatePackageRunner = path48.join(updateAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs");
     const updateGate = verifyOfflineManagedPiRelease(
       {
         detected: {
@@ -16732,7 +16771,7 @@ async function preparePiRuntimeSystem(input) {
       return "remedy" in updateGate && typeof updateGate.remedy === "string" ? updateGate : { kind: "blocked", reason: updateGate.reason, remedy: `Verificaci\xF3n offline del receipt Pi fall\xF3 (${updateGate.reason}); sin preflight ni cambios. Pi no qued\xF3 activado.` };
     }
     try {
-      fs39.mkdirSync(updateDownloadsDir, { recursive: true });
+      fs40.mkdirSync(updateDownloadsDir, { recursive: true });
     } catch (error) {
       return {
         kind: "blocked",
@@ -16788,7 +16827,7 @@ async function preparePiRuntimeSystem(input) {
     };
   }
   const piExecutable = input.detected.executable;
-  if (typeof piExecutable !== "string" || piExecutable === "" || !path47.isAbsolute(piExecutable)) {
+  if (typeof piExecutable !== "string" || piExecutable === "" || !path48.isAbsolute(piExecutable)) {
     return {
       kind: "blocked",
       reason: "pi-executable-missing",
@@ -16804,7 +16843,7 @@ async function preparePiRuntimeSystem(input) {
   }
   const homeDir = os6.homedir();
   const agentDir = userPaths(input.engramBin, piExecutable).codingAgentDir;
-  const downloadsDir = path47.join(dataDir(), "packages");
+  const downloadsDir = path48.join(dataDir(), "packages");
   if (!isStrictChildPath(agentDir, homeDir)) {
     return {
       kind: "blocked",
@@ -16814,7 +16853,7 @@ async function preparePiRuntimeSystem(input) {
   }
   let preflightReceipt;
   try {
-    preflightReceipt = fs39.lstatSync(path47.join(dataDir(), "pi-receipt.json"), { throwIfNoEntry: false });
+    preflightReceipt = fs40.lstatSync(path48.join(dataDir(), "pi-receipt.json"), { throwIfNoEntry: false });
   } catch (error) {
     if (error.code === "ENOENT") {
       preflightReceipt = void 0;
@@ -16829,7 +16868,7 @@ async function preparePiRuntimeSystem(input) {
   if (preflightReceipt === void 0) {
     let preflightEntry;
     try {
-      preflightEntry = fs39.lstatSync(path47.join(agentDir, "npm", "node_modules", "jorgex-pi"), {
+      preflightEntry = fs40.lstatSync(path48.join(agentDir, "npm", "node_modules", "jorgex-pi"), {
         throwIfNoEntry: false
       });
     } catch (error) {
@@ -16852,7 +16891,7 @@ async function preparePiRuntimeSystem(input) {
     }
   }
   try {
-    fs39.mkdirSync(downloadsDir, { recursive: true });
+    fs40.mkdirSync(downloadsDir, { recursive: true });
   } catch (error) {
     return {
       kind: "blocked",
@@ -16948,7 +16987,7 @@ async function runPiRuntimeSystem(input) {
         remedy: `${mismatch}; Pi no qued\xF3 activado y no se descarg\xF3 ni modific\xF3 nada.`
       };
     }
-    const settingsPath = path47.join(paths.codingAgentDir, "settings.json");
+    const settingsPath = path48.join(paths.codingAgentDir, "settings.json");
     let settingsJson = readOptional(settingsPath, '{"packages":[]}');
     const receiptJson = readOptional(paths.receiptPath, null);
     const scopeKind = input.targetDir === void 0 ? "real" : "target-dir";
@@ -16991,8 +17030,8 @@ async function runPiRuntimeSystem(input) {
         };
       }
       try {
-        const freshEntry = path47.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
-        if (fs39.lstatSync(freshEntry, { throwIfNoEntry: false }) !== void 0) {
+        const freshEntry = path48.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
+        if (fs40.lstatSync(freshEntry, { throwIfNoEntry: false }) !== void 0) {
           return {
             kind: "blocked",
             reason: "unowned-entry",
@@ -17102,7 +17141,7 @@ async function runPiRuntimeSystem(input) {
         backupLegacyMigrationState(
           settingsPath,
           paths.receiptPath,
-          input.targetDir === void 0 ? void 0 : path47.join(path47.resolve(input.targetDir), "backups")
+          input.targetDir === void 0 ? void 0 : path48.join(path48.resolve(input.targetDir), "backups")
         );
       } catch (error) {
         return {
@@ -17112,7 +17151,7 @@ async function runPiRuntimeSystem(input) {
         };
       }
     }
-    const homeDir = input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir);
+    const homeDir = input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir);
     const agentDir = paths.codingAgentDir;
     const receiptPath = paths.receiptPath;
     const stageDir = prepared.stageDir;
@@ -17165,7 +17204,7 @@ async function runPiRuntimeSystem(input) {
   }
   if (input.operation === "update") {
     const engramBinForUpdate = input.engramBin;
-    if (engramBinForUpdate === null || !path47.isAbsolute(engramBinForUpdate)) {
+    if (engramBinForUpdate === null || !path48.isAbsolute(engramBinForUpdate)) {
       return {
         kind: "blocked",
         reason: "engram-required",
@@ -17196,10 +17235,10 @@ async function runPiRuntimeSystem(input) {
         remedy: `${updateMismatch}; Pi no qued\xF3 activado y no se descarg\xF3 ni modific\xF3 nada.`
       };
     }
-    const updateSettingsPath = path47.join(paths.codingAgentDir, "settings.json");
+    const updateSettingsPath = path48.join(paths.codingAgentDir, "settings.json");
     const updateScopeKind = input.targetDir === void 0 ? "real" : "target-dir";
-    const updateHomeDir = input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir);
-    const updateDownloadsDir = input.targetDir === void 0 ? path47.join(dataDir(), "packages") : path47.join(path47.resolve(input.targetDir), "downloads");
+    const updateHomeDir = input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir);
+    const updateDownloadsDir = input.targetDir === void 0 ? path48.join(dataDir(), "packages") : path48.join(path48.resolve(input.targetDir), "downloads");
     const stripUpdateNewline = (value) => value.endsWith("\n") ? value.slice(0, -1) : value;
     let updateSettingsRaw;
     let updateReceiptRaw;
@@ -17378,13 +17417,13 @@ async function runPiRuntimeSystem(input) {
       };
     }
   }
-  const packageRoot = path47.dirname(path47.dirname(paths.packageRunner));
+  const packageRoot = path48.dirname(path48.dirname(paths.packageRunner));
   const writeReceipt = (receipt) => {
     writeText(paths.receiptPath, `${JSON.stringify(receipt, null, 2)}
 `);
   };
   if (input.operation === "sync") {
-    const settingsJson = readOptional(path47.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
+    const settingsJson = readOptional(path48.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
     const receiptJson = readOptional(paths.receiptPath, null);
     if (receiptJson === null) {
       return {
@@ -17435,11 +17474,11 @@ async function runPiRuntimeSystem(input) {
             run: runProcess,
             verifyManagedArtifact: (receipt) => verifyCachedPiArtifact({
               receipt,
-              homeDir: input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir),
-              downloadsDir: input.targetDir === void 0 ? path47.join(dataDir(), "packages") : path47.join(path47.resolve(input.targetDir), "downloads")
+              homeDir: input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir),
+              downloadsDir: input.targetDir === void 0 ? path48.join(dataDir(), "packages") : path48.join(path48.resolve(input.targetDir), "downloads")
             }),
-            isPackageAbsent: () => !fs39.existsSync(packageRoot),
-            deleteReceipt: () => fs39.rmSync(paths.receiptPath, { force: true })
+            isPackageAbsent: () => !fs40.existsSync(packageRoot),
+            deleteReceipt: () => fs40.rmSync(paths.receiptPath, { force: true })
           }
         );
       }
@@ -17451,7 +17490,7 @@ async function runPiRuntimeSystem(input) {
     }
   }
   if (input.operation === "models") {
-    const settingsJson = readOptional(path47.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
+    const settingsJson = readOptional(path48.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
     const receiptJson = readOptional(paths.receiptPath, null);
     if (receiptJson === null) {
       return {
@@ -17502,11 +17541,11 @@ async function runPiRuntimeSystem(input) {
         run: runProcess,
         verifyManagedArtifact: (receipt) => verifyCachedPiArtifact({
           receipt,
-          homeDir: input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir),
-          downloadsDir: input.targetDir === void 0 ? path47.join(dataDir(), "packages") : path47.join(path47.resolve(input.targetDir), "downloads")
+          homeDir: input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir),
+          downloadsDir: input.targetDir === void 0 ? path48.join(dataDir(), "packages") : path48.join(path48.resolve(input.targetDir), "downloads")
         }),
-        isPackageAbsent: () => !fs39.existsSync(packageRoot),
-        deleteReceipt: () => fs39.rmSync(paths.receiptPath, { force: true })
+        isPackageAbsent: () => !fs40.existsSync(packageRoot),
+        deleteReceipt: () => fs40.rmSync(paths.receiptPath, { force: true })
       }
     );
   }
@@ -17523,17 +17562,17 @@ async function runPiRuntimeSystem(input) {
       value,
       {
         backupSettings: () => createBackup(
-          [path47.join(paths.codingAgentDir, "settings.json")],
+          [path48.join(paths.codingAgentDir, "settings.json")],
           "pi-package-uninstall",
-          input.targetDir === void 0 ? void 0 : path47.join(path47.resolve(input.targetDir), "backups")
+          input.targetDir === void 0 ? void 0 : path48.join(path48.resolve(input.targetDir), "backups")
         ),
         run: runProcess,
         verifyManagedArtifact: (receipt) => verifyCachedPiArtifact({
           receipt,
-          homeDir: input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir),
-          downloadsDir: input.targetDir === void 0 ? path47.join(dataDir(), "packages") : path47.join(path47.resolve(input.targetDir), "downloads")
+          homeDir: input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir),
+          downloadsDir: input.targetDir === void 0 ? path48.join(dataDir(), "packages") : path48.join(path48.resolve(input.targetDir), "downloads")
         }),
-        readSettings: () => fs39.readFileSync(path47.join(paths.codingAgentDir, "settings.json"), "utf8"),
+        readSettings: () => fs40.readFileSync(path48.join(paths.codingAgentDir, "settings.json"), "utf8"),
         verifyLegacyPackage: (receipt) => {
           const op = value;
           let effectiveEngram = op.engramBin;
@@ -17542,7 +17581,7 @@ async function runPiRuntimeSystem(input) {
             const engram = Reflect.get(receipt, "engram");
             if (engram === null || typeof engram !== "object" || Array.isArray(engram)) return false;
             const binary = Reflect.get(engram, "binary");
-            if (typeof binary !== "string" || binary === "" || !path47.isAbsolute(binary)) return false;
+            if (typeof binary !== "string" || binary === "" || !path48.isAbsolute(binary)) return false;
             effectiveEngram = binary;
           }
           if (typeof effectiveEngram !== "string" || effectiveEngram === "") return false;
@@ -17566,17 +17605,17 @@ async function runPiRuntimeSystem(input) {
           }
           let currentReceiptRaw = null;
           try {
-            currentReceiptRaw = fs39.readFileSync(paths.receiptPath, "utf8");
+            currentReceiptRaw = fs40.readFileSync(paths.receiptPath, "utf8");
           } catch {
             return { kind: "blocked", reason: "remove-failed" };
           }
           if (typeof op.receiptJson === "string" && currentReceiptRaw !== op.receiptJson) {
             return { kind: "blocked", reason: "receipt-untrusted" };
           }
-          const settingsPath = path47.join(paths.codingAgentDir, "settings.json");
-          const legacyEntry = path47.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
+          const settingsPath = path48.join(paths.codingAgentDir, "settings.json");
+          const legacyEntry = path48.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
           return deactivateVerifiedLegacyPiEntry({
-            homeDir: input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir),
+            homeDir: input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir),
             agentDir: paths.codingAgentDir,
             receiptPath: paths.receiptPath,
             source,
@@ -17584,19 +17623,19 @@ async function runPiRuntimeSystem(input) {
             verify: () => {
               let entryStat = null;
               try {
-                entryStat = fs39.lstatSync(legacyEntry);
+                entryStat = fs40.lstatSync(legacyEntry);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (entryStat !== null) throw new Error("managed entry still present after uninstall");
               let receiptStat = null;
               try {
-                receiptStat = fs39.lstatSync(paths.receiptPath);
+                receiptStat = fs40.lstatSync(paths.receiptPath);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (receiptStat !== null) throw new Error("receipt still present after uninstall");
-              if (fs39.readFileSync(settingsPath, "utf8") !== nextSettings) {
+              if (fs40.readFileSync(settingsPath, "utf8") !== nextSettings) {
                 throw new Error("settings mismatch after uninstall");
               }
             }
@@ -17611,9 +17650,9 @@ async function runPiRuntimeSystem(input) {
           if (typeof mp.releaseDir !== "string" || typeof mp.linkPath !== "string" || typeof mp.backupDir !== "string") {
             return { kind: "blocked", reason: "remove-failed" };
           }
-          const settingsPath = path47.join(paths.codingAgentDir, "settings.json");
+          const settingsPath = path48.join(paths.codingAgentDir, "settings.json");
           return deactivateVerifiedPiRelease({
-            homeDir: input.targetDir === void 0 ? os6.homedir() : path47.resolve(input.targetDir),
+            homeDir: input.targetDir === void 0 ? os6.homedir() : path48.resolve(input.targetDir),
             agentDir: paths.codingAgentDir,
             receiptPath: paths.receiptPath,
             managedPackage: mp,
@@ -17621,33 +17660,33 @@ async function runPiRuntimeSystem(input) {
             verify: () => {
               let entryStat = null;
               try {
-                entryStat = fs39.lstatSync(mp.linkPath);
+                entryStat = fs40.lstatSync(mp.linkPath);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (entryStat !== null) throw new Error("managed entry still present after uninstall");
               let releaseStat = null;
               try {
-                releaseStat = fs39.lstatSync(mp.releaseDir);
+                releaseStat = fs40.lstatSync(mp.releaseDir);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (releaseStat !== null) throw new Error("managed release still present after uninstall");
               let receiptStat = null;
               try {
-                receiptStat = fs39.lstatSync(paths.receiptPath);
+                receiptStat = fs40.lstatSync(paths.receiptPath);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (receiptStat !== null) throw new Error("receipt still present after uninstall");
-              if (fs39.readFileSync(settingsPath, "utf8") !== nextSettings) {
+              if (fs40.readFileSync(settingsPath, "utf8") !== nextSettings) {
                 throw new Error("settings mismatch after uninstall");
               }
             }
           });
         },
-        isPackageAbsent: () => !fs39.existsSync(packageRoot),
-        deleteReceipt: () => fs39.rmSync(paths.receiptPath, { force: true })
+        isPackageAbsent: () => !fs40.existsSync(packageRoot),
+        deleteReceipt: () => fs40.rmSync(paths.receiptPath, { force: true })
       }
     )
   };
@@ -17660,8 +17699,8 @@ init_pi();
 init_system_prompt_sections();
 
 // src/lib/pi-browser-contract.ts
-import fs40 from "fs";
-import path48 from "path";
+import fs41 from "fs";
+import path49 from "path";
 var CONTRACT_FILE = "browser-handoffs.v1.json";
 var MAX_CONTRACT_BYTES = 4 * 1024;
 function fail11(message) {
@@ -17672,23 +17711,23 @@ function validSchemas(value) {
 }
 function requirePiBrowserHandoffSchemas(packageRoot, required) {
   if (required.playwright === void 0 && required.devtools === void 0) return;
-  if (typeof packageRoot !== "string" || !path48.isAbsolute(packageRoot)) fail11("package root is not absolute");
+  if (typeof packageRoot !== "string" || !path49.isAbsolute(packageRoot)) fail11("package root is not absolute");
   let realRoot;
   try {
-    realRoot = fs40.realpathSync(packageRoot);
-    if (!fs40.statSync(realRoot).isDirectory()) fail11("package root is not a directory");
+    realRoot = fs41.realpathSync(packageRoot);
+    if (!fs41.statSync(realRoot).isDirectory()) fail11("package root is not a directory");
   } catch {
     fail11("installed Pi package root is unavailable");
   }
-  const contractDir = path48.join(realRoot, "contract");
-  const file = path48.join(contractDir, CONTRACT_FILE);
+  const contractDir = path49.join(realRoot, "contract");
+  const file = path49.join(contractDir, CONTRACT_FILE);
   let raw;
   try {
-    const dirStat = fs40.lstatSync(contractDir);
-    const stat = fs40.lstatSync(file);
+    const dirStat = fs41.lstatSync(contractDir);
+    const stat = fs41.lstatSync(file);
     if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || !stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_CONTRACT_BYTES) fail11("contract is not a bounded regular file");
-    if (fs40.realpathSync(file) !== file) fail11("contract path is not canonical");
-    raw = fs40.readFileSync(file);
+    if (fs41.realpathSync(file) !== file) fail11("contract path is not canonical");
+    raw = fs41.readFileSync(file);
     if (raw.byteLength > MAX_CONTRACT_BYTES || !Buffer.from(raw.toString("utf8"), "utf8").equals(raw)) {
       fail11("contract is not bounded UTF-8");
     }
@@ -17717,8 +17756,8 @@ function requirePiBrowserHandoffSchemas(packageRoot, required) {
 
 // src/lib/pi-managed-runtime.ts
 init_paths();
-import fs41 from "fs";
-import path49 from "path";
+import fs42 from "fs";
+import path50 from "path";
 function projectionOperation(operation) {
   return operation === "update" ? "sync" : operation;
 }
@@ -17876,7 +17915,7 @@ async function runManagedPiSystem(input) {
   const needsDevtoolsObservation = devtoolsMcpEnabled === true && input.operation !== "uninstall" && input.operation !== "models";
   let devtoolsMcpObservedVersion = null;
   let devtoolsVerifiedForPersist;
-  const devtoolsManagedStateDir = input.targetDir === void 0 ? dataDir() : path49.join(input.targetDir, "home", ".jorgex-stack");
+  const devtoolsManagedStateDir = input.targetDir === void 0 ? dataDir() : path50.join(input.targetDir, "home", ".jorgex-stack");
   if (needsDevtoolsObservation) {
     if (input.targetDir !== void 0) {
       devtoolsMcpObservedVersion = isValidObservedVersion(injectedDevtoolsObserved) ? { version: injectedDevtoolsObserved.version, integrity: injectedDevtoolsObserved.integrity } : null;
@@ -17924,8 +17963,8 @@ async function runManagedPiSystem(input) {
   if (needsDevtoolsObservation) {
     try {
       if (input.targetDir !== void 0) {
-        const target = fs41.lstatSync(input.targetDir);
-        const home = fs41.lstatSync(path49.join(input.targetDir, "home"));
+        const target = fs42.lstatSync(input.targetDir);
+        const home = fs42.lstatSync(path50.join(input.targetDir, "home"));
         if (!target.isDirectory() || target.isSymbolicLink() || !home.isDirectory() || home.isSymbolicLink()) {
           throw new Error("HOME del target Pi no es un directorio real aislado");
         }
@@ -17949,7 +17988,7 @@ async function runManagedPiSystem(input) {
   const playwrightCapabilityEffective = playwrightCapability?.effective === true;
   const playwrightCliEnabled = input.targetDir === void 0 && supportsPlaywright && selectedPlaywright && playwrightCapabilityEffective;
   const playwrightManagedStateDir = playwrightCliEnabled && input.operation !== "uninstall" && input.operation !== "models" ? dataDir() : void 0;
-  const playwrightDispatcherPath = playwrightManagedStateDir === void 0 ? void 0 : path49.join(path49.dirname(stackRoot()), "dist", "browser-playwright.js");
+  const playwrightDispatcherPath = playwrightManagedStateDir === void 0 ? void 0 : path50.join(path50.dirname(stackRoot()), "dist", "browser-playwright.js");
   let effectivePackageSource = PI_RUNTIME_CANDIDATE.package.source;
   const projectionInput = {
     writingStyle,
@@ -18006,7 +18045,7 @@ async function runManagedPiSystem(input) {
     },
     runProjection(operation) {
       if (playwrightCliEnabled || devtoolsMcpEnabled) {
-        const packageRoot = path49.join(path49.dirname(piSystemPromptFile(input.targetDir)), "npm", "node_modules", "jorgex-pi");
+        const packageRoot = path50.join(path50.dirname(piSystemPromptFile(input.targetDir)), "npm", "node_modules", "jorgex-pi");
         try {
           requirePiBrowserHandoffSchemas(packageRoot, {
             ...playwrightCliEnabled ? { playwright: 2 } : {},
@@ -18059,7 +18098,7 @@ init_fsx();
 
 // src/lib/quality-runner.ts
 init_detect();
-import path50 from "path";
+import path51 from "path";
 import { spawn as spawn2, spawnSync as spawnSync6 } from "child_process";
 
 // src/lib/quality-policy.ts
@@ -18652,7 +18691,7 @@ function killProcessTree(child) {
   if (pid === void 0) return;
   if (process.platform === "win32") {
     const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
-    const taskkill = path50.join(systemRoot, "System32", "taskkill.exe");
+    const taskkill = path51.join(systemRoot, "System32", "taskkill.exe");
     const result = spawnSync6(taskkill, ["/pid", String(pid), "/t", "/f"], {
       shell: false,
       stdio: "ignore",
@@ -18898,9 +18937,9 @@ async function runQualityPlan(input) {
 }
 
 // src/lib/engram-install.ts
-import fs42 from "fs";
+import fs43 from "fs";
 import os7 from "os";
-import path51 from "path";
+import path52 from "path";
 import { execFileSync as execFileSync8 } from "child_process";
 import { createHash as createHash11 } from "crypto";
 var MAX_ENGRAM_ARCHIVE_BYTES = 64 * 1024 * 1024;
@@ -18909,16 +18948,16 @@ var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 async function installMissingEngram(options = {}) {
   const platform = options.platform ?? process.platform;
   const homeDir = options.homeDir ?? os7.homedir();
-  if (!path51.isAbsolute(homeDir)) return { ok: false, reason: "El directorio personal debe ser absoluto." };
+  if (!path52.isAbsolute(homeDir)) return { ok: false, reason: "El directorio personal debe ser absoluto." };
   const binaryName = platform === "win32" ? "engram.exe" : "engram";
-  const bin = path51.join(homeDir, ".local", "bin", binaryName);
+  const bin = path52.join(homeDir, ".local", "bin", binaryName);
   let staging;
   let outcome;
   try {
-    const existing = fs42.lstatSync(bin, { throwIfNoEntry: false });
+    const existing = fs43.lstatSync(bin, { throwIfNoEntry: false });
     if (existing) {
-      if (!fs42.statSync(bin).isFile()) throw new Error(`El destino Engram no es un archivo: ${bin}`);
-      fs42.accessSync(bin, platform === "win32" ? fs42.constants.F_OK : fs42.constants.X_OK);
+      if (!fs43.statSync(bin).isFile()) throw new Error(`El destino Engram no es un archivo: ${bin}`);
+      fs43.accessSync(bin, platform === "win32" ? fs43.constants.F_OK : fs43.constants.X_OK);
       outcome = { ok: true, bin };
     } else {
       const fetchFn = options.fetch ?? globalThis.fetch;
@@ -19031,19 +19070,19 @@ async function installMissingEngram(options = {}) {
       if (size !== approvedSize || createHash11("sha256").update(archive).digest("hex") !== approvedSha) {
         throw new Error("Engram: tama\xF1o o hash SHA-256 no coincide con el artefacto aprobado.");
       }
-      fs42.mkdirSync(path51.dirname(bin), { recursive: true });
-      staging = fs42.mkdtempSync(path51.join(path51.dirname(bin), ".engram-install-"));
-      const archivePath = path51.join(staging, expectedName);
-      fs42.writeFileSync(archivePath, archive, { flag: "wx", mode: 384 });
+      fs43.mkdirSync(path52.dirname(bin), { recursive: true });
+      staging = fs43.mkdtempSync(path52.join(path52.dirname(bin), ".engram-install-"));
+      const archivePath = path52.join(staging, expectedName);
+      fs43.writeFileSync(archivePath, archive, { flag: "wx", mode: 384 });
       const binary = execFileSync8(resolveTarBin(), ["-xOf", archivePath, binaryName], {
         maxBuffer: 64 * 1024 * 1024,
         timeout: 3e4,
         stdio: ["ignore", "pipe", "pipe"]
       });
       if (binary.length === 0) throw new Error("El artefacto Engram no contiene un binario v\xE1lido.");
-      const stagedBin = path51.join(staging, binaryName);
-      fs42.writeFileSync(stagedBin, binary, { flag: "wx", mode: 493 });
-      fs42.linkSync(stagedBin, bin);
+      const stagedBin = path52.join(staging, binaryName);
+      fs43.writeFileSync(stagedBin, binary, { flag: "wx", mode: 493 });
+      fs43.linkSync(stagedBin, bin);
       outcome = { ok: true, bin };
     }
   } catch (error) {
@@ -19051,7 +19090,7 @@ async function installMissingEngram(options = {}) {
   }
   if (staging !== void 0) {
     try {
-      fs42.rmSync(staging, { recursive: true, force: true });
+      fs43.rmSync(staging, { recursive: true, force: true });
     } catch (cleanupError) {
       const cleanupMsg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
       if (outcome !== void 0 && outcome.ok) {
@@ -19447,7 +19486,7 @@ async function runSelectedPi(options) {
     return 1;
   }
   if (detected.version === null) {
-    console.error("No se pudo verificar la versi\xF3n instalada de Pi sin ejecutarlo; revisa la instalaci\xF3n de Pi.");
+    console.error(`No se pudo verificar la versi\xF3n instalada de Pi sin ejecutarlo: ${detected.versionDiagnostic ?? "causa desconocida"}. Repara Pi con su instalador oficial antes de reintentar.`);
     return 1;
   }
   let engramBin = resolvedEngramBin === void 0 ? resolvePiEngramBin(targetDir) : resolvedEngramBin;
@@ -19618,7 +19657,7 @@ Flags disponibles: jorgex-stack --help`
         return;
       }
       try {
-        const plan = JSON.parse(fs43.readFileSync(flags.positional[0], "utf8"));
+        const plan = JSON.parse(fs44.readFileSync(flags.positional[0], "utf8"));
         const result = await runQualityPlan(plan);
         const serialized = serializeQualityReceipt(result.receipt);
         if (flags.receipt === void 0) process.stdout.write(`${serialized}