jorgex-stack 1.9.66 → 1.9.67

package/dist/cli.js

@@ -500,9 +500,9 @@ function readSystemPromptFile(target, rootDir) {
   if (rootDir !== void 0) {
     const probe = fs4.existsSync(target) ? target : path5.dirname(target);
     if (fs4.existsSync(probe) && fs4.existsSync(rootDir)) {
-      const resolved2 = fs4.realpathSync(probe);
+      const resolved3 = fs4.realpathSync(probe);
       const root = fs4.realpathSync(rootDir);
-      if (resolved2 !== root && !isContainedIn(resolved2, root)) {
+      if (resolved3 !== root && !isContainedIn(resolved3, root)) {
         throw new Error(`El prompt ${target} sale del destino aislado.`);
       }
     }
@@ -1276,12 +1276,12 @@ function sameIdentity(a, b) {
   return a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
 }
 function assertDirectory(configDir) {
-  const resolved2 = path11.resolve(configDir);
-  const stat = fs7.lstatSync(resolved2);
+  const resolved3 = path11.resolve(configDir);
+  const stat = fs7.lstatSync(resolved3);
   if (!stat.isDirectory() || stat.isSymbolicLink()) {
-    throw new Error(`Pi MCP config directory is not a real directory: ${resolved2}`);
+    throw new Error(`Pi MCP config directory is not a real directory: ${resolved3}`);
   }
-  return resolved2;
+  return resolved3;
 }
 function adapterPackagePath(configDir) {
   return path11.join(configDir, "npm", "node_modules", ADAPTER_PACKAGE, "package.json");
@@ -1558,6 +1558,16 @@ function migrateOfficialPiMcpConfig(input) {
   if (!removeExactSource(legacyPath, source)) return { migrated: false, backupPath };
   return { migrated: destination === null, backupPath };
 }
+function declaredPiMcpConfigFiles(stageDir) {
+  const file = path11.join(stageDir, "npm", "node_modules", "jorgex-pi", "contract", "jorgex-pi.v1.json");
+  const contract = JSON.parse(fs7.readFileSync(file, "utf8"));
+  const declaration = contract.mcpAdapterConfig;
+  if (declaration === void 0) return [];
+  if (declaration.schemaVersion !== 1 || !Array.isArray(declaration.files) || !declaration.files.every((file2) => typeof file2 === "string")) {
+    throw new Error("El candidato Pi declara un contrato MCP inv\xE1lido.");
+  }
+  return declaration.files;
+}
 var ADAPTER_PACKAGE, MAX_CONFIG_BYTES, SEMVER, OFFICIAL_ARGS;
 var init_pi_mcp_config = __esm({
   "src/lib/pi-mcp-config.ts"() {
@@ -1633,15 +1643,15 @@ function resolveTrustedNpmRoots(runtime, preciseTargets) {
   if (runtime !== "pi") return [];
   const roots = /* @__PURE__ */ new Set();
   for (const t of preciseTargets) {
-    const resolved2 = path12.resolve(t);
-    if (path12.basename(resolved2) === "npm") roots.add(resolved2);
+    const resolved3 = path12.resolve(t);
+    if (path12.basename(resolved3) === "npm") roots.add(resolved3);
   }
   return [...roots];
 }
 function findTrustedRootFor(linkPath, trustedRoots) {
-  const resolved2 = path12.resolve(linkPath);
+  const resolved3 = path12.resolve(linkPath);
   for (const root of trustedRoots) {
-    if (isContainedIn(resolved2, root)) return root;
+    if (isContainedIn(resolved3, root)) return root;
   }
   return null;
 }
@@ -1865,17 +1875,17 @@ function restoreTrustedSymlinks(snapshot, trustedRoots) {
 function findSetupSymlinkViolation(targets, homeDir, trustedRoots = []) {
   const homeResolved = path12.resolve(homeDir);
   for (const target of targets) {
-    const resolved2 = path12.resolve(target);
+    const resolved3 = path12.resolve(target);
     try {
-      if (fs8.lstatSync(resolved2).isSymbolicLink()) {
-        return `${resolved2}: el target es un symlink (no se respalda ni se ejecuta setup)`;
+      if (fs8.lstatSync(resolved3).isSymbolicLink()) {
+        return `${resolved3}: el target es un symlink (no se respalda ni se ejecuta setup)`;
       }
     } catch (error) {
       if (errnoCode2(error) !== "ENOENT") {
-        return `${resolved2}: ilegible (${errnoCode2(error)}, no se puede descartar alias)`;
+        return `${resolved3}: ilegible (${errnoCode2(error)}, no se puede descartar alias)`;
       }
     }
-    let dir = path12.dirname(resolved2);
+    let dir = path12.dirname(resolved3);
     while (dir !== homeResolved && isContainedIn(dir, homeResolved)) {
       try {
         if (fs8.lstatSync(dir).isSymbolicLink()) {
@@ -1891,8 +1901,8 @@ function findSetupSymlinkViolation(targets, homeDir, trustedRoots = []) {
       dir = parent;
     }
     try {
-      if (fs8.statSync(resolved2).isDirectory()) {
-        const bad = findSymlinkInTree(resolved2, trustedRoots);
+      if (fs8.statSync(resolved3).isDirectory()) {
+        const bad = findSymlinkInTree(resolved3, trustedRoots);
         if (bad !== null) return bad;
       }
     } catch {
@@ -2077,11 +2087,11 @@ async function runOfficialSetup(runtime, deps) {
       cleanupFailed = true;
     }
   }
-  const incomplete = restoreFailed || symlinkRestoreFailed || cleanupFailed;
+  const incomplete2 = restoreFailed || symlinkRestoreFailed || cleanupFailed;
   const combinedRestoreError = [restoreError, symlinkRestoreError].filter((p7) => p7 !== void 0).join("; ") || void 0;
   restoreError = combinedRestoreError;
   const detail = [spawnResult.stderr, verifyResult.stderr, verifyResult.reason, (verifyResult.layers ?? []).join(", ")].map((part) => (part ?? "").trim()).filter((part) => part !== "").join("; ") || "setup oficial fall\xF3";
-  const recoveryDetail = incomplete ? `${detail}; recuperaci\xF3n incompleta${restoreError !== void 0 ? `: ${restoreError}` : ""}` : detail;
+  const recoveryDetail = incomplete2 ? `${detail}; recuperaci\xF3n incompleta${restoreError !== void 0 ? `: ${restoreError}` : ""}` : detail;
   return {
     ok: false,
     ownershipTransferred: false,
@@ -2089,8 +2099,8 @@ async function runOfficialSetup(runtime, deps) {
     stderr: recoveryDetail,
     reason: recoveryDetail,
     ...verifyResult.layers === void 0 ? {} : { layers: verifyResult.layers },
-    ...incomplete ? { incompleteRecovery: true } : {},
-    recovery: incomplete ? "incomplete" : "complete",
+    ...incomplete2 ? { incompleteRecovery: true } : {},
+    recovery: incomplete2 ? "incomplete" : "complete",
     backupId,
     ...restoreError === void 0 ? {} : { restoreError }
   };
@@ -2169,9 +2179,9 @@ function validateOfficialSetupDestination(runtime, configDir, homeDir) {
     return `runOfficialSetupIfNeeded: configDir OpenCode incompatible (${configDir}); el provider solo alinea <parent>/opencode v\xEDa XDG_CONFIG_HOME.`;
   }
   if (runtime === "pi") {
-    const resolved2 = path12.resolve(configDir);
+    const resolved3 = path12.resolve(configDir);
     const homeResolved = path12.resolve(homeDir);
-    if (resolved2 !== homeResolved && !isContainedIn(resolved2, homeResolved)) {
+    if (resolved3 !== homeResolved && !isContainedIn(resolved3, homeResolved)) {
       return `runOfficialSetupIfNeeded: Pi PI_CODING_AGENT_DIR (${configDir}) fuera de HOME (${homeDir}): queda fuera de la frontera de restore acotada a HOME; usa un PI_CODING_AGENT_DIR dentro de HOME o ajusta HOME antes de reintentar.`;
     }
     return null;
@@ -3303,12 +3313,12 @@ function resolveStrictInstallPath(configDir) {
     return { ok: false, detail: `installPath:missing (absoluto requerido en ${registryFile})` };
   }
   const expectedRoot = path14.resolve(path14.join(configDir, "plugins", "cache", "engram"));
-  const resolved2 = path14.resolve(installPath);
-  if (resolved2 !== expectedRoot && !resolved2.startsWith(expectedRoot + path14.sep)) {
-    return { ok: false, detail: `installPath:foreign (${resolved2} fuera de ${expectedRoot})` };
+  const resolved3 = path14.resolve(installPath);
+  if (resolved3 !== expectedRoot && !resolved3.startsWith(expectedRoot + path14.sep)) {
+    return { ok: false, detail: `installPath:foreign (${resolved3} fuera de ${expectedRoot})` };
   }
   const configResolved = path14.resolve(configDir);
-  let cursor = resolved2;
+  let cursor = resolved3;
   while (cursor !== null && cursor !== configResolved) {
     try {
       if (fs10.lstatSync(cursor).isSymbolicLink()) {
@@ -3325,13 +3335,13 @@ function resolveStrictInstallPath(configDir) {
     cursor = parent === configResolved || parent.startsWith(configResolved + path14.sep) ? parent : null;
   }
   try {
-    if (!fs10.statSync(resolved2).isDirectory()) {
+    if (!fs10.statSync(resolved3).isDirectory()) {
       return { ok: false, detail: "installPath: no es un directorio" };
     }
   } catch {
     return { ok: false, detail: "installPath:missing (no existe)" };
   }
-  return { ok: true, installPath: resolved2 };
+  return { ok: true, installPath: resolved3 };
 }
 function checkStrictEnabled(configDir) {
   const settingsFile = path14.join(configDir, "settings.json");
@@ -3434,12 +3444,12 @@ function checkClaudeOfficialHooksAt(installPath) {
 }
 async function verifyOfficialSetup2(args) {
   const explicit = isExplicitClaudeMode(args.isExplicitClaudeConfigDir);
-  const resolved2 = resolveStrictInstallPath(args.configDir);
+  const resolved3 = resolveStrictInstallPath(args.configDir);
   const enabled = checkStrictEnabled(args.configDir);
-  const hasPlugin = resolved2.ok && enabled.ok;
-  const pluginDetail = !resolved2.ok ? resolved2.detail ?? "plugin:missing" : !enabled.ok ? enabled.detail ?? "plugin:disabled (enabledPlugins)" : null;
+  const hasPlugin = resolved3.ok && enabled.ok;
+  const pluginDetail = !resolved3.ok ? resolved3.detail ?? "plugin:missing" : !enabled.ok ? enabled.detail ?? "plugin:disabled (enabledPlugins)" : null;
   const hasMcp = typeof args.engramBin === "string" && args.engramBin !== "" ? checkClaudeOfficialMcp(args.configDir, args.engramBin, args.homeDir, explicit) : false;
-  const hasHooks = resolved2.ok && resolved2.installPath !== void 0 ? checkClaudeOfficialHooksAt(resolved2.installPath) : false;
+  const hasHooks = resolved3.ok && resolved3.installPath !== void 0 ? checkClaudeOfficialHooksAt(resolved3.installPath) : false;
   const passed = [];
   const missing = [];
   if (hasPlugin) passed.push("plugin");
@@ -4416,6 +4426,7 @@ args = [${(server.args ?? []).map(tomlString).join(", ")}]`);
 // src/adapters/pi.ts
 var pi_exports = {};
 __export(pi_exports, {
+  isNamedPiSource: () => isNamedPiSource,
   piAdapter: () => piAdapter,
   piSystemPromptFile: () => piSystemPromptFile,
   verifyOfficialSetup: () => verifyOfficialSetup4
@@ -4676,7 +4687,7 @@ var init_pi = __esm({
 
 // src/cli.ts
 import * as p6 from "@clack/prompts";
-import fs45 from "fs";
+import fs49 from "fs";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/install.ts
@@ -5356,16 +5367,16 @@ function assertRegularFile(file, label) {
   return stat;
 }
 function assertContained2(realRoot, candidate, label) {
-  let resolved2;
+  let resolved3;
   try {
-    resolved2 = fs19.realpathSync(candidate);
+    resolved3 = fs19.realpathSync(candidate);
   } catch {
     fail2(`cannot resolve ${label}: ${candidate}`);
   }
-  if (resolved2 !== realRoot && !resolved2.startsWith(realRoot + path25.sep)) {
+  if (resolved3 !== realRoot && !resolved3.startsWith(realRoot + path25.sep)) {
     fail2(`${label} escapes the stage`);
   }
-  return resolved2;
+  return resolved3;
 }
 function canonicalTarballUrl2(packageName, version) {
   const shortName = packageName.slice(packageName.lastIndexOf("/") + 1);
@@ -5531,8 +5542,8 @@ function localTarballPath(spec, stageDir) {
   if (!spec.startsWith("file:") || spec.startsWith("file://")) fail2("root lock source is not a local file");
   const relative = spec.slice("file:".length);
   if (relative === "" || relative.includes("\0")) fail2("root lock source is invalid");
-  const resolved2 = path25.resolve(stageDir, relative);
-  return resolved2;
+  const resolved3 = path25.resolve(stageDir, relative);
+  return resolved3;
 }
 function parseLockPackages(lock, packageName, release, stageDir, artifactPath) {
   if (!isRecord4(lock) || lock.lockfileVersion !== "9.0" || !isRecord4(lock.packages)) {
@@ -6231,6 +6242,29 @@ function realpathOrFail(file, label) {
     fail3(`cannot resolve ${label}: ${file}`);
   }
 }
+function assertBrowserExecutable(value) {
+  const executable = absolutePath(value, "browser executable");
+  if (executable !== value || CONTROL_CHARACTERS2.test(executable)) fail3("browser executable path must be canonical and contain no control characters");
+  const stat = lstatOrFail2(executable, "browser executable");
+  if (!stat.isFile() || stat.isSymbolicLink()) fail3("browser executable must be a regular non-symlink file");
+  if (realpathOrFail(executable, "browser executable") !== executable) fail3("browser executable path contains a symlink");
+  try {
+    fs20.accessSync(executable, process.platform === "win32" ? fs20.constants.F_OK : fs20.constants.X_OK);
+  } catch {
+    fail3("browser executable is not executable");
+  }
+  return executable;
+}
+function detectChromiumExecutable() {
+  const candidates = process.platform === "linux" ? ["/usr/bin/chromium-browser", "/usr/bin/chromium"] : process.platform === "darwin" ? ["/Applications/Chromium.app/Contents/MacOS/Chromium"] : process.platform === "win32" ? ["C:\\Program Files\\Chromium\\Application\\chrome.exe", "C:\\Program Files (x86)\\Chromium\\Application\\chrome.exe"] : [];
+  for (const candidate of candidates) {
+    try {
+      return assertBrowserExecutable(fs20.realpathSync(candidate));
+    } catch {
+    }
+  }
+  return void 0;
+}
 function assertRealDirectory2(directory, label) {
   const stat = lstatOrFail2(directory, label);
   if (!stat.isDirectory() || stat.isSymbolicLink()) fail3(`${label} must be a real directory: ${directory}`);
@@ -6253,9 +6287,9 @@ function isContained(root, candidate, allowEqual) {
   return relative !== ".." && !relative.startsWith(`..${path26.sep}`) && !path26.isAbsolute(relative);
 }
 function assertContained3(root, candidate, label) {
-  const resolved2 = realpathOrFail(candidate, label);
-  if (!isContained(root, resolved2, false)) fail3(`${label} escapes its root`);
-  return resolved2;
+  const resolved3 = realpathOrFail(candidate, label);
+  if (!isContained(root, resolved3, false)) fail3(`${label} escapes its root`);
+  return resolved3;
 }
 function assertStateDirectory(input) {
   const directory = absolutePath(input, "stateDir");
@@ -6324,6 +6358,8 @@ function validateStagedInput(input) {
     fail3("unsupported managed browser package");
   }
   const packageName = input.packageName;
+  if (input.browserExecutablePath !== void 0 && packageName !== "chrome-devtools-mcp") fail3("browser executable selector is supported only for DevTools");
+  const browserExecutablePath = input.browserExecutablePath === void 0 ? void 0 : assertBrowserExecutable(input.browserExecutablePath);
   const stateDir = assertStateDirectory(input.stateDir);
   const release = validateRelease(input.release);
   if (!isRecord5(input.staged)) fail3("staged tree evidence must be an object");
@@ -6348,7 +6384,7 @@ function validateStagedInput(input) {
   if (relativeEntry === "" || relativeEntry === ".." || relativeEntry.startsWith(`..${path26.sep}`) || path26.isAbsolute(relativeEntry)) {
     fail3("entryPath must be contained by staged node_modules");
   }
-  return { stateDir, packageName, release, nodeModulesPath, treePath: realTreePath, entryPath, treeSha256, closure };
+  return { stateDir, packageName, release, nodeModulesPath, treePath: realTreePath, entryPath, treeSha256, closure, browserExecutablePath };
 }
 async function acquireLock(lockPath) {
   for (let attempt = 0; attempt < LOCK_ATTEMPTS; attempt += 1) {
@@ -6429,7 +6465,7 @@ function resolveStagedBrowserEntry(staged, packageName) {
   if (!stat.isFile() || stat.isSymbolicLink() || !isContained(realRoot, realEntry, false)) {
     fail3("staged package bin must be a regular file in its root");
   }
-  return entry;
+  return realEntry;
 }
 function readOptionalRegularFile(file, label, maxBytes) {
   let stat;
@@ -6611,7 +6647,7 @@ function hashRegularFile(file) {
     }
   }
 }
-function launcherSource(nodeModulesPath, entryPath, expectedTreeSha256) {
+function launcherSource(nodeModulesPath, entryPath, expectedTreeSha256, browserExecutablePath) {
   return `const fs = (await import("node:fs")).default;
 const path = (await import("node:path")).default;
 const { createHash } = await import("node:crypto");
@@ -6754,7 +6790,8 @@ function treeHash(tree) {
 
 if (treeHash(root) !== expected) throw new Error("managed browser tree digest drifted before launch");
 process.argv[1] = entry;
-await import(pathToFileURL(entry).href);
+${browserExecutablePath === void 0 ? "" : `process.argv.push(${JSON.stringify(`--executablePath=${browserExecutablePath}`)});
+`}await import(pathToFileURL(entry).href);
 `;
 }
 function managedTreeVerifierSource() {
@@ -7015,7 +7052,13 @@ function writeActivePointerAtomic(packageDir, pointer, previous) {
   }
 }
 function sameVerifiedCandidate(receipt, prepared) {
-  return receipt.packageName === prepared.packageName && receipt.version === prepared.release.version && receipt.integrity === prepared.release.integrity && receipt.treeSha256 === prepared.treeSha256 && JSON.stringify(receipt.closure) === JSON.stringify(prepared.closure);
+  const expectedEntry = path26.join(receipt.treePath, path26.relative(prepared.nodeModulesPath, prepared.entryPath));
+  return receipt.packageName === prepared.packageName && receipt.version === prepared.release.version && receipt.integrity === prepared.release.integrity && receipt.treeSha256 === prepared.treeSha256 && JSON.stringify(receipt.closure) === JSON.stringify(prepared.closure) && receipt.entryPath === expectedEntry && receipt.launcherSha256 === createHash3("sha256").update(launcherSource(
+    receipt.treePath,
+    expectedEntry,
+    prepared.treeSha256,
+    prepared.browserExecutablePath
+  )).digest("hex");
 }
 async function activateManagedBrowserTree(input) {
   const prepared = validateStagedInput(input);
@@ -7071,7 +7114,7 @@ async function activateManagedBrowserTree(input) {
     const finalNodeModules = path26.join(finalRoot, "node_modules");
     const finalEntry = path26.join(finalNodeModules, relativeEntry);
     const launcherPath = path26.join(finalRoot, "launcher.mjs");
-    writeNewFile(launcherPath, launcherSource(finalNodeModules, finalEntry, prepared.treeSha256), 448);
+    writeNewFile(launcherPath, launcherSource(finalNodeModules, finalEntry, prepared.treeSha256, prepared.browserExecutablePath), 448);
     const launcherSha256 = hashRegularFile(launcherPath);
     const receipt = {
       schemaVersion: 1,
@@ -7208,14 +7251,15 @@ async function activateVerifiedBrowserArtifact(context, options) {
     fetchImpl: options.fetchImpl
   });
   if (context.packageName === "chrome-devtools-mcp") {
-    await verifyStagedDevtoolsCliArtifact({ stageDir, staged, release: context.release });
+    await verifyStagedDevtoolsCliArtifact({ stageDir, staged, release: context.release, browserExecutablePath: options.browserExecutablePath });
   }
   return activateManagedBrowserTree({
     stateDir: options.stateDir,
     packageName: context.packageName,
     release: context.release,
     staged,
-    entryPath: resolveStagedBrowserEntry(staged, context.packageName)
+    entryPath: resolveStagedBrowserEntry(staged, context.packageName),
+    browserExecutablePath: options.browserExecutablePath
   });
 }
 var PLAYWRIGHT_PKG = "@playwright/cli";
@@ -7332,10 +7376,12 @@ const { parseArguments } = await import(pathToFileURL(process.argv[1]).href);
 if (typeof parseArguments !== "function") process.exit(1);
 const parsed = parseArguments("probe", [
   process.execPath, process.argv[1],
-  "--isolated", "--redact-network-headers", "--no-performance-crux", "--no-usage-statistics"
+  "--isolated", "--redact-network-headers", "--no-performance-crux", "--no-usage-statistics",
+  ...(process.argv[2] === undefined ? [] : ["--executablePath=" + process.argv[2]])
 ], process.env);
 process.stdout.write(JSON.stringify([
-  parsed.isolated, parsed.redactNetworkHeaders, parsed.performanceCrux, parsed.usageStatistics
+  parsed.isolated, parsed.redactNetworkHeaders, parsed.performanceCrux, parsed.usageStatistics,
+  ...(process.argv[2] === undefined ? [] : [parsed.executablePath])
 ]));
 `;
 async function verifyStagedDevtoolsCliArtifact(input, deps) {
@@ -7351,18 +7397,18 @@ async function verifyStagedDevtoolsCliArtifact(input, deps) {
   const run = deps?.run ?? defaultDevtoolsCliRun;
   if (typeof run !== "function") fail4("run must be a function");
   const env = restrictedStageEnv(stageDir);
-  await assertDevtoolsPrivacyProof(run, realBinPath, packageDir, stageDir, env);
+  await assertDevtoolsPrivacyProof(run, realBinPath, packageDir, stageDir, env, input.browserExecutablePath);
   return { binPath, version: release.version };
 }
 function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function assertInsideStage(realStage, candidate, label) {
-  const resolved2 = path27.resolve(candidate);
-  if (resolved2 !== realStage && !resolved2.startsWith(realStage + path27.sep)) {
+  const resolved3 = path27.resolve(candidate);
+  if (resolved3 !== realStage && !resolved3.startsWith(realStage + path27.sep)) {
     fail4(`${label} escapes the stage`);
   }
-  return resolved2;
+  return resolved3;
 }
 async function defaultDevtoolsCliRun(command, args, options) {
   const planned = planDetectedBinCommand(command, args);
@@ -7423,11 +7469,12 @@ async function runDevtoolsCli(run, command, args, cwd, env, label) {
     throw asBrowserError(`${label} failed: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-async function assertDevtoolsPrivacyProof(run, scriptPath, realPackageDir, stageDir, env) {
+async function assertDevtoolsPrivacyProof(run, scriptPath, realPackageDir, stageDir, env, browserExecutablePath) {
+  const selectorArgs = browserExecutablePath === void 0 ? [] : [`--executablePath=${browserExecutablePath}`];
   const help = await runDevtoolsCli(
     run,
     process.execPath,
-    [scriptPath, ...DEVTOOLS_PRIVACY_FLAGS2, "--help"],
+    [scriptPath, ...DEVTOOLS_PRIVACY_FLAGS2, ...selectorArgs, "--help"],
     stageDir,
     env,
     "devtools help probe"
@@ -7441,6 +7488,9 @@ async function assertDevtoolsPrivacyProof(run, scriptPath, realPackageDir, stage
       fail4(`devtools help is missing ${flag}`);
     }
   }
+  if (browserExecutablePath !== void 0 && !help.stdout.includes("--executablePath")) {
+    fail4("devtools help is missing --executablePath");
+  }
   const parserModule = path27.join(realPackageDir, "build", "src", "config", "mcp-options.js");
   let realParserModule;
   try {
@@ -7455,13 +7505,14 @@ async function assertDevtoolsPrivacyProof(run, scriptPath, realPackageDir, stage
   const parserProbe = await runDevtoolsCli(
     run,
     process.execPath,
-    ["--input-type=module", "-e", DEVTOOLS_PARSER_PROBE, realParserModule],
+    ["--input-type=module", "-e", DEVTOOLS_PARSER_PROBE, realParserModule, ...browserExecutablePath === void 0 ? [] : [browserExecutablePath]],
     stageDir,
     probeEnv,
     "devtools parser probe"
   );
-  if (parserProbe.status !== 0 || parserProbe.stdout?.trim() !== "[true,true,false,false]") {
-    fail4("devtools parser does not honor the mandatory privacy flags");
+  const expectedParsed = [true, true, false, false, ...browserExecutablePath === void 0 ? [] : [browserExecutablePath]];
+  if (parserProbe.status !== 0 || parserProbe.stdout?.trim() !== JSON.stringify(expectedParsed)) {
+    fail4("devtools parser does not honor the mandatory privacy flags or browser executable selector");
   }
 }
 
@@ -7692,8 +7743,8 @@ function primaryModelOwnershipError(file = primaryModelOwnershipFile()) {
   return `Primary model: ownership inv\xE1lido en ${file}. Corrige o borra ese archivo antes de reintentar.`;
 }
 function primaryModelConfigKey(configDir) {
-  const resolved2 = path28.resolve(configDir);
-  return process.platform === "win32" ? resolved2.toLowerCase() : resolved2;
+  const resolved3 = path28.resolve(configDir);
+  return process.platform === "win32" ? resolved3.toLowerCase() : resolved3;
 }
 function loadPrimaryModelOwnership(file, runtime, configDir) {
   const key = primaryModelConfigKey(configDir);
@@ -8682,7 +8733,7 @@ async function runInstall(opts) {
             p.log.error("Playwright CLI y navegador se han instalado y la preferencia qued\xF3 activa, pero la gu\xEDa de navegador qued\xF3 en estado parcial. Ejecuta 'jorgex-stack sync' para repararla.");
           } else {
             const verified = verifiedCapability ?? (preparedEnv === void 0 ? inspectPlaywrightCapability({ browserVerified: true, expectedVersion: candidate.version }) : inspectPlaywrightCapability({ browserVerified: true, env: preparedEnv, expectedVersion: candidate.version }));
-            if (hasInjectedActivation && verified.effective && verified.cli.status === "current" && verified.cli.binPath !== null && verified.cli.detectedVersion !== null && verified.browserCache.status === "ready") {
+            if (verified.effective && verified.cli.status === "current" && verified.cli.binPath !== null && verified.cli.detectedVersion !== null && verified.browserCache.status === "ready") {
               opts.onPlaywrightCapability?.(verified);
             }
             p.log.success("Playwright CLI instalado y arranque de Chromium verificado.");
@@ -8818,12 +8869,12 @@ function validateRelease2(release) {
   return { expectedSha512: assertCanonicalSha512(integrity, "release integrity"), version };
 }
 function assertRealDir(p7, label) {
-  const resolved2 = path32.resolve(p7);
-  const st = lstatOrNull(resolved2);
+  const resolved3 = path32.resolve(p7);
+  const st = lstatOrNull(resolved3);
   if (st === null || !st.isDirectory() || st.isSymbolicLink()) {
     fail5(`${label} must be a real directory: ${p7}`);
   }
-  return resolved2;
+  return resolved3;
 }
 function readBoundedBytes(file, maxBytes, label) {
   const st = lstatOrNull(file);
@@ -8941,7 +8992,7 @@ function readContainedLinkTarget(linkPath, allowedRoot) {
   if (target === "" || path32.isAbsolute(target)) {
     fail5(`staged symlink must be relative: ${linkPath}`);
   }
-  const isStrictChild6 = (child) => {
+  const isStrictChild8 = (child) => {
     const rel = path32.relative(allowedRoot, child);
     return rel !== "" && rel !== ".." && !rel.startsWith(`..${path32.sep}`) && !path32.isAbsolute(rel);
   };
@@ -8953,7 +9004,7 @@ function readContainedLinkTarget(linkPath, allowedRoot) {
     const isLast = i === ops.length - 1;
     if (part === "..") {
       cur = path32.dirname(cur);
-      if (cur !== allowedRoot && !isStrictChild6(cur)) {
+      if (cur !== allowedRoot && !isStrictChild8(cur)) {
         fail5(`staged symlink escapes staged tree: ${linkPath} -> ${target}`);
       }
       const st2 = lstatOrNull(cur);
@@ -8967,7 +9018,7 @@ function readContainedLinkTarget(linkPath, allowedRoot) {
       continue;
     }
     const next = path32.join(cur, part);
-    if (next !== allowedRoot && !isStrictChild6(next)) {
+    if (next !== allowedRoot && !isStrictChild8(next)) {
       fail5(`staged symlink escapes staged tree: ${linkPath} -> ${target}`);
     }
     const st = lstatOrNull(next);
@@ -11838,7 +11889,7 @@ async function latestGithubCommit(repo) {
   }
 }
 function validateExtractedTree(destDir) {
-  const resolved2 = path37.resolve(destDir);
+  const resolved3 = path37.resolve(destDir);
   const walk = (dir) => {
     let entries;
     try {
@@ -11855,14 +11906,14 @@ function validateExtractedTree(destDir) {
         return false;
       }
       if (stat.isSymbolicLink()) return false;
-      if (!isContainedIn(full, resolved2)) return false;
+      if (!isContainedIn(full, resolved3)) return false;
       if (entry.isDirectory()) {
         if (!walk(full)) return false;
       }
     }
     return true;
   };
-  return walk(resolved2);
+  return walk(resolved3);
 }
 function resolveTarBin() {
   if (process.platform !== "win32") return "tar";
@@ -11872,7 +11923,7 @@ function resolveTarBin() {
 async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
   const url = `https://codeload.github.com/${repo}/tar.gz/${sha}`;
   const tmp = path37.join(os4.tmpdir(), `jorgex-tarball-${Date.now()}.tar.gz`);
-  const fail12 = (reason) => {
+  const fail14 = (reason) => {
     try {
       fs30.rmSync(destDir, { recursive: true, force: true });
     } catch {
@@ -11886,11 +11937,11 @@ async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
     });
     if (!res.ok) {
       if (res.status === 403 || res.status === 429) rateLimitHit = true;
-      return fail12(
+      return fail14(
         `HTTP ${res.status}${res.status === 403 || res.status === 429 ? " \u2014 rate limit; define GH_TOKEN o inicia sesi\xF3n en gh" : ""}`
       );
     }
-    if (!res.body) return fail12("respuesta HTTP sin cuerpo");
+    if (!res.body) return fail14("respuesta HTTP sin cuerpo");
     await pipeline(
       Readable.fromWeb(res.body),
       fs30.createWriteStream(tmp)
@@ -11902,21 +11953,21 @@ async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
     } catch (err) {
       const e = err;
       const detail = (e.stderr?.toString().trim() || e.message || "").split("\n")[0];
-      return fail12(detail ? `tar fall\xF3: ${detail}` : "tar no disponible o fall\xF3 la extracci\xF3n");
+      return fail14(detail ? `tar fall\xF3: ${detail}` : "tar no disponible o fall\xF3 la extracci\xF3n");
     }
     const resolvedDest = path37.resolve(destDir);
     const validateRoot = validateSubdir ? path37.resolve(resolvedDest, validateSubdir) : resolvedDest;
     if (validateRoot !== resolvedDest && !isContainedIn(validateRoot, resolvedDest)) {
-      return fail12(`la ruta de validaci\xF3n "${validateSubdir}" escapa del destino`);
+      return fail14(`la ruta de validaci\xF3n "${validateSubdir}" escapa del destino`);
     }
     if (fs30.existsSync(validateRoot) && !validateExtractedTree(validateRoot)) {
-      return fail12("el \xE1rbol extra\xEDdo contiene symlinks o rutas fuera del destino");
+      return fail14("el \xE1rbol extra\xEDdo contiene symlinks o rutas fuera del destino");
     }
     const validated = fs30.existsSync(validateRoot);
     return { ok: true, validated };
   } catch (err) {
     const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
-    return fail12(timedOut ? "timeout de descarga (120s)" : err instanceof Error ? `fallo de red: ${err.message}` : "error desconocido");
+    return fail14(timedOut ? "timeout de descarga (120s)" : err instanceof Error ? `fallo de red: ${err.message}` : "error desconocido");
   } finally {
     try {
       fs30.rmSync(tmp, { force: true });
@@ -13149,8 +13200,8 @@ init_model_map();
 
 // src/lib/pi-runtime.ts
 import os6 from "os";
-import path49 from "path";
-import fs41 from "fs";
+import path53 from "path";
+import fs45 from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
 
 // src/lib/pi-runtime-pin.json
@@ -13627,18 +13678,15 @@ function assertPiExecutable(piExecutable) {
   return absolute;
 }
 function assertRealDir2(p7, label) {
-  const resolved2 = path43.resolve(p7);
-  const st = lstatOrNull3(resolved2);
+  const resolved3 = path43.resolve(p7);
+  const st = lstatOrNull3(resolved3);
   if (st === null || !st.isDirectory() || st.isSymbolicLink()) {
     fail8(`${label} must be a real directory: ${p7}`);
   }
-  return resolved2;
+  return resolved3;
 }
 function sleep(ms) {
-  return new Promise((resolve) => {
-    const timer = setTimeout(resolve, ms);
-    if (typeof timer.unref === "function") timer.unref();
-  });
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function runtimePath(piExecutable) {
   const entries = process.platform === "win32" ? [
@@ -13780,7 +13828,7 @@ async function stopOwnedPiProcess(child) {
   }
   destroyChild(child);
 }
-function validateCommandsData(value) {
+function validateCommandsData(value, requireProviders) {
   if (!Array.isArray(value)) return { ok: false, message: "get_commands data.commands must be an array" };
   const names = [];
   for (const entry of value) {
@@ -13794,11 +13842,11 @@ function validateCommandsData(value) {
     if (seen.has(name)) return { ok: false, message: `duplicate command name: ${name}` };
     seen.add(name);
   }
-  const missing = [...REQUIRED_COMMANDS].filter((required) => !seen.has(required));
+  const missing = [...REQUIRED_COMMANDS, ...requireProviders ? ["mcp-adapter", "mcp"] : []].filter((required) => !seen.has(required));
   if (missing.length > 0) return { ok: false, message: `missing required commands: ${missing.join(", ")}` };
   return { ok: true, names };
 }
-function evaluateLines(lines, stateId, commandsId) {
+function evaluateLines(lines, stateId, commandsId, requireProviders) {
   let stateSeen = false;
   let commandsNames = null;
   for (const entry of lines) {
@@ -13806,7 +13854,7 @@ function evaluateLines(lines, stateId, commandsId) {
     const type = entry["type"];
     if (type === "extension_ui_request" && entry["method"] === "notify" && entry["notifyType"] === "error") {
       const message = typeof entry["message"] === "string" ? entry["message"] : "extension notification error";
-      if (message !== EXPECTED_MISSING_PROVIDER) {
+      if (requireProviders || message !== EXPECTED_MISSING_PROVIDER) {
         return { kind: "failed", message: `extension notification: ${message.slice(0, 300)}` };
       }
     }
@@ -13836,7 +13884,7 @@ function evaluateLines(lines, stateId, commandsId) {
     if (!isRecord12(entry["data"])) {
       return { kind: "failed", message: "get_commands response misses data" };
     }
-    const checked = validateCommandsData(entry["data"]["commands"]);
+    const checked = validateCommandsData(entry["data"]["commands"], requireProviders);
     if (!checked.ok) return { kind: "failed", message: checked.message };
     commandsNames = checked.names;
   }
@@ -13941,6 +13989,14 @@ async function runSmoke(input) {
   }
   if (timeout > 2147483647) fail8("timeoutMs exceeds platform bound");
   const env = buildSandboxEnv(stageRoot, stageResolved, piResolved);
+  if (input.providerSetup !== void 0) {
+    env.ENGRAM_BIN = assertPiExecutable(input.providerSetup.engramBin);
+    const endpoint = new URL(input.providerSetup.engramUrl);
+    if (endpoint.protocol !== "http:" || endpoint.hostname !== "127.0.0.1" || !endpoint.port || endpoint.username || endpoint.password) {
+      fail8("provider smoke requires its isolated loopback endpoint");
+    }
+    env.ENGRAM_URL = endpoint.href;
+  }
   const planned = planDetectedBinCommand(piResolved, [...EXPECTED_ARGV]);
   if (planned === null) fail8("unsafe executable for Windows launch");
   const stateId = 1;
@@ -13989,7 +14045,7 @@ ${JSON.stringify({ id: commandsId, type: "get_commands" })}
       if (out.malformed !== null) return { kind: "malformed", message: `malformed line-delimited JSON: ${out.malformed}` };
       const err = parseStderrComplete(stderrParts);
       if (err.rejected !== null) return { kind: "malformed", message: `unexpected stderr text: ${err.rejected}` };
-      return evaluateLines([...out.lines, ...err.lines], stateId, commandsId);
+      return evaluateLines([...out.lines, ...err.lines], stateId, commandsId, input.providerSetup !== void 0);
     };
     const scheduleReady = () => {
       if (settled) return;
@@ -14099,7 +14155,6 @@ ${JSON.stringify({ id: commandsId, type: "get_commands" })}
     });
     try {
       spawned.stdin?.write(requests);
-      spawned.stdin?.end();
     } catch (error) {
       void settleFailure(`stdin failed: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -14551,9 +14606,9 @@ function piPackageVersion(file) {
     return null;
   }
 }
-function managedPiVersion(executable, resolved2) {
-  const binDir = path45.dirname(resolved2);
-  if (path45.basename(resolved2) !== "pi" || path45.basename(binDir) !== "bin") {
+function managedPiVersion(executable, resolved3) {
+  const binDir = path45.dirname(resolved3);
+  if (path45.basename(resolved3) !== "pi" || path45.basename(binDir) !== "bin") {
     return invalidManagedPi("launcher gestionado de Pi no reconocido");
   }
   const agentDir = path45.dirname(binDir);
@@ -14593,9 +14648,9 @@ function managedPiVersion(executable, resolved2) {
     return invalidManagedPi("no se pudo leer la metadata del release Pi gestionado");
   }
 }
-function hasManagedPiMarker(resolved2) {
-  const binDir = path45.dirname(resolved2);
-  if (path45.basename(resolved2) !== "pi" || path45.basename(binDir) !== "bin") return false;
+function hasManagedPiMarker(resolved3) {
+  const binDir = path45.dirname(resolved3);
+  if (path45.basename(resolved3) !== "pi" || path45.basename(binDir) !== "bin") return false;
   const installDir = path45.join(path45.dirname(binDir), "install");
   try {
     return fs37.lstatSync(path45.join(installDir, "managed-install.json"), { throwIfNoEntry: false }) !== void 0 || fs37.lstatSync(path45.join(installDir, "current-version"), { throwIfNoEntry: false }) !== void 0;
@@ -14605,14 +14660,14 @@ function hasManagedPiMarker(resolved2) {
 }
 function inspectPiHostVersion(executable) {
   const absoluteExecutable = path45.resolve(executable);
-  let resolved2;
+  let resolved3;
   try {
-    resolved2 = fs37.realpathSync(absoluteExecutable);
+    resolved3 = fs37.realpathSync(absoluteExecutable);
   } catch {
     return { version: null, diagnostic: "no se pudo resolver el ejecutable Pi" };
   }
-  if (hasManagedPiMarker(resolved2)) return managedPiVersion(absoluteExecutable, resolved2);
-  let current = path45.dirname(resolved2);
+  if (hasManagedPiMarker(resolved3)) return managedPiVersion(absoluteExecutable, resolved3);
+  let current = path45.dirname(resolved3);
   for (let depth = 0; depth < 8; depth += 1) {
     for (const manifest of [
       path45.join(current, "package.json"),
@@ -14643,10 +14698,10 @@ function lstatOrNull5(p7) {
     return null;
   }
 }
-function assertRealDir3(resolved2, label) {
-  const st = lstatOrNull5(resolved2);
+function assertRealDir3(resolved3, label) {
+  const st = lstatOrNull5(resolved3);
   if (st === null || !st.isDirectory() || st.isSymbolicLink()) {
-    fail10(`${label} must be a real directory: ${resolved2}`);
+    fail10(`${label} must be a real directory: ${resolved3}`);
   }
 }
 function validatePaths(paths) {
@@ -16478,29 +16533,1089 @@ async function activatePreparedPiInstall(input, deps) {
   return { kind: "installed", receipt };
 }
 
-// src/lib/pi-cached-artifact.ts
+// src/lib/pi-provider-update.ts
+import fs43 from "fs";
+import path51 from "path";
+init_pi_mcp_config();
 init_npm_provider();
-import { createHash as createHash9, timingSafeEqual as timingSafeEqual6 } from "crypto";
+
+// src/lib/pi-provider-stage.ts
+init_npm_provider();
+import { randomBytes as randomBytes4 } from "crypto";
 import fs40 from "fs";
 import path48 from "path";
+var PROVIDER_NAMES = ["gentle-engram", "pi-mcp-adapter"];
+var MAX_JSON_BYTES3 = 1 * 1024 * 1024;
+var MAX_LOCK_BYTES2 = 4 * 1024 * 1024;
+var PROVIDER_PACKAGE_ROOT = "pi-extensions";
+function fail11(message) {
+  throw new Error(`pi-provider-stage: ${message}`);
+}
+function isRecord14(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function lstatOrNull7(target) {
+  try {
+    return fs40.lstatSync(target);
+  } catch {
+    return null;
+  }
+}
+function isStrictChild5(child, root) {
+  const relative = path48.relative(path48.resolve(root), path48.resolve(child));
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path48.sep}`) && !path48.isAbsolute(relative);
+}
+function assertRealDirectory3(target, label) {
+  const resolved3 = path48.resolve(target);
+  const stat = lstatOrNull7(resolved3);
+  if (stat === null || !stat.isDirectory() || stat.isSymbolicLink()) {
+    fail11(`${label} must be a real directory: ${target}`);
+  }
+  return resolved3;
+}
+function assertRegularFile2(target, label, maxBytes = MAX_JSON_BYTES3) {
+  const stat = lstatOrNull7(target);
+  if (stat === null || !stat.isFile() || stat.isSymbolicLink()) {
+    fail11(`${label} must be a regular file: ${target}`);
+  }
+  if (stat.size > maxBytes) fail11(`${label} exceeds size limit: ${target}`);
+}
+function readJson(target, label, maxBytes = MAX_JSON_BYTES3) {
+  assertRegularFile2(target, label, maxBytes);
+  let parsed;
+  try {
+    parsed = JSON.parse(fs40.readFileSync(target, "utf8"));
+  } catch {
+    fail11(`${label} is malformed: ${target}`);
+  }
+  if (!isRecord14(parsed)) fail11(`${label} must be an object: ${target}`);
+  return parsed;
+}
+function assertStageBoundary(homeDir, agentDir) {
+  const home = assertRealDirectory3(homeDir, "homeDir");
+  const agent = assertRealDirectory3(agentDir, "agentDir");
+  if (!isStrictChild5(agent, home)) fail11("agentDir must be inside homeDir");
+  return { home, agent };
+}
+function runtimePath3(piExecutable) {
+  const entries = process.platform === "win32" ? [
+    path48.dirname(piExecutable),
+    path48.dirname(process.execPath),
+    process.env.SystemRoot ? path48.join(process.env.SystemRoot, "System32") : null
+  ] : [path48.dirname(piExecutable), path48.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
+  return [...new Set(entries.filter((entry) => entry !== null && entry !== ""))].join(path48.delimiter);
+}
+function validatePiExecutable(value) {
+  if (typeof value !== "string" || value === "" || !path48.isAbsolute(value)) {
+    fail11("piExecutable must be a non-empty absolute path");
+  }
+  if (path48.basename(value).toLowerCase() === "npm" || path48.basename(value).toLowerCase().startsWith("npm.")) {
+    fail11("piExecutable must be the detected Pi CLI, never npm");
+  }
+  return path48.resolve(value);
+}
+function assertRelease2(name, release) {
+  if (!isRecord14(release)) fail11(`${name} release must be an object`);
+  if (!isStableSemverVersion(release.version)) fail11(`${name} release has an invalid version`);
+  if (typeof release.tarballUrl !== "string" || !isCanonicalSha512Integrity(release.integrity)) {
+    fail11(`${name} release has invalid registry metadata`);
+  }
+  return {
+    version: release.version,
+    tarballUrl: release.tarballUrl,
+    integrity: release.integrity
+  };
+}
+function createDirectory(target) {
+  try {
+    fs40.mkdirSync(target, { recursive: true, mode: 448 });
+    fs40.chmodSync(target, 448);
+  } catch {
+    fail11(`cannot create private stage directory: ${target}`);
+  }
+}
+function createStageRoot(homeDir) {
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    const candidate = path48.join(homeDir, `provider-stage-${randomBytes4(16).toString("hex")}`);
+    try {
+      fs40.mkdirSync(candidate, { mode: 448 });
+      fs40.chmodSync(candidate, 448);
+      return candidate;
+    } catch (error) {
+      if (error.code === "EEXIST") continue;
+      fail11(`cannot create private stage root: ${error.message}`);
+    }
+  }
+  fail11("cannot create private stage root after retries");
+}
+function stageEnvironment(stageRoot, stageAgentDir, piExecutable) {
+  const home = path48.join(stageRoot, "home");
+  const appdata = path48.join(stageRoot, "appdata");
+  const localappdata = path48.join(stageRoot, "localappdata");
+  const xdgConfig = path48.join(stageRoot, "xdg-config");
+  const xdgData = path48.join(stageRoot, "xdg-data");
+  const xdgCache = path48.join(stageRoot, "xdg-cache");
+  const temporary = path48.join(stageRoot, "tmp");
+  const npmCache = path48.join(stageRoot, "npm-cache");
+  const npmConfig = path48.join(stageRoot, "npmrc");
+  for (const directory of [
+    home,
+    appdata,
+    localappdata,
+    xdgConfig,
+    xdgData,
+    xdgCache,
+    temporary,
+    npmCache,
+    path48.dirname(npmConfig),
+    stageAgentDir
+  ]) createDirectory(directory);
+  const env = {
+    HOME: home,
+    USERPROFILE: home,
+    APPDATA: appdata,
+    LOCALAPPDATA: localappdata,
+    XDG_CONFIG_HOME: xdgConfig,
+    XDG_DATA_HOME: xdgData,
+    XDG_CACHE_HOME: xdgCache,
+    TEMP: temporary,
+    TMP: temporary,
+    TMPDIR: temporary,
+    npm_config_cache: npmCache,
+    npm_config_userconfig: npmConfig,
+    npm_config_install_strategy: "nested",
+    npm_config_ignore_scripts: "true",
+    npm_config_audit: "false",
+    npm_config_fund: "false",
+    npm_config_progress: "false",
+    NPM_CONFIG_IGNORE_SCRIPTS: "true",
+    NPM_CONFIG_UPDATE_NOTIFIER: "false",
+    PI_CODING_AGENT_DIR: stageAgentDir,
+    PATH: runtimePath3(piExecutable)
+  };
+  if (process.platform === "win32") {
+    for (const key of ["SystemRoot", "SystemDrive", "WINDIR", "COMSPEC", "PATHEXT", "OS"]) {
+      const value = process.env[key];
+      if (value) env[key] = value;
+    }
+  }
+  return env;
+}
+function assertFileAlias(spec, npmDir, artifactPath, label) {
+  if (typeof spec !== "string" || !spec.startsWith("file:")) fail11(`${label} must be a file: alias`);
+  const rest = spec.slice("file:".length);
+  if (rest === "") fail11(`${label} has an empty file: alias`);
+  if (path48.resolve(npmDir, rest) !== path48.resolve(artifactPath)) {
+    fail11(`${label} does not resolve to the verified artifact`);
+  }
+  return spec;
+}
+function normalizeBins(raw, packageName) {
+  if (typeof raw === "string") {
+    if (raw === "") fail11(`${packageName} declares an empty bin target`);
+    return { [packageName]: raw };
+  }
+  if (!isRecord14(raw)) fail11(`${packageName} must declare a bin map`);
+  const result = {};
+  for (const [name, target] of Object.entries(raw)) {
+    if (name === "" || name.includes("/") || name.includes("\\") || typeof target !== "string" || target === "") {
+      fail11(`${packageName} declares an invalid bin`);
+    }
+    result[name] = target;
+  }
+  if (Object.keys(result).length === 0) fail11(`${packageName} must declare at least one bin`);
+  return result;
+}
+function assertBinTargets(packageRoot, bins) {
+  const result = {};
+  for (const [name, target] of Object.entries(bins)) {
+    if (path48.isAbsolute(target)) fail11(`${name} bin must be relative`);
+    const candidate = path48.resolve(packageRoot, target);
+    if (!isStrictChild5(candidate, packageRoot)) fail11(`${name} bin escapes its package root`);
+    const stat = lstatOrNull7(candidate);
+    if (stat === null) fail11(`${name} bin target is missing`);
+    let real;
+    try {
+      real = fs40.realpathSync(candidate);
+    } catch {
+      fail11(`${name} bin target cannot be resolved`);
+    }
+    if (!isStrictChild5(real, packageRoot)) fail11(`${name} bin escapes its package root`);
+    const finalStat = fs40.statSync(candidate);
+    if (!finalStat.isFile()) fail11(`${name} bin target is not a file`);
+    result[name] = target;
+  }
+  return result;
+}
+function assertDirectRoots(nodeModules, provider) {
+  const entries = fs40.readdirSync(nodeModules);
+  const allowed = /* @__PURE__ */ new Set([provider, ".bin", ".package-lock.json"]);
+  for (const entry of entries) {
+    if (!allowed.has(entry)) fail11(`foreign direct provider root: ${entry}`);
+  }
+  const hiddenLock = path48.join(nodeModules, ".package-lock.json");
+  if (lstatOrNull7(hiddenLock) !== null) assertRegularFile2(hiddenLock, "staged provider hidden lock", MAX_LOCK_BYTES2);
+  const binDir = path48.join(nodeModules, ".bin");
+  const binStat = lstatOrNull7(binDir);
+  if (binStat !== null && (!binStat.isDirectory() || binStat.isSymbolicLink())) {
+    fail11("provider .bin must be a real directory");
+  }
+  if (binStat !== null) {
+    for (const entry of fs40.readdirSync(binDir, { withFileTypes: true })) {
+      const target = path48.join(binDir, entry.name);
+      if (!entry.isSymbolicLink()) continue;
+      let raw;
+      try {
+        raw = fs40.readlinkSync(target);
+      } catch {
+        fail11(`provider .bin entry is unreadable: ${entry.name}`);
+      }
+      if (raw === "" || path48.isAbsolute(raw)) fail11(`provider .bin entry escapes stage: ${entry.name}`);
+      const resolved3 = path48.resolve(binDir, raw);
+      if (!isStrictChild5(resolved3, nodeModules)) fail11(`provider .bin entry escapes stage: ${entry.name}`);
+      const stat = lstatOrNull7(resolved3);
+      if (stat === null) fail11(`provider .bin entry is broken: ${entry.name}`);
+    }
+  }
+}
+function assertLockEntries(packages, provider) {
+  for (const key of Object.keys(packages)) {
+    if (key === "" || key === `node_modules/${provider}`) continue;
+    if (!key.startsWith(`node_modules/${provider}/node_modules/`)) {
+      fail11(`foreign lock root: ${key}`);
+    }
+  }
+}
+function inspectProviderTree(stageAgentDir, artifactPath, release, provider) {
+  const npmDir = path48.join(stageAgentDir, "npm");
+  const modules = path48.join(npmDir, "node_modules");
+  assertRealDirectory3(npmDir, "staged provider npm root");
+  assertRealDirectory3(modules, "staged provider node_modules");
+  assertDirectRoots(modules, provider);
+  const lockPath = path48.join(npmDir, "package-lock.json");
+  const lock = readJson(lockPath, "staged provider lock", MAX_LOCK_BYTES2);
+  if (lock.name !== PROVIDER_PACKAGE_ROOT || lock.lockfileVersion !== 3) {
+    fail11("staged provider lock must be npm v3 pi-extensions");
+  }
+  if (!isRecord14(lock.packages)) fail11("staged provider lock misses packages");
+  const packages = lock.packages;
+  assertLockEntries(packages, provider);
+  const root = packages[""];
+  const parent = packages[`node_modules/${provider}`];
+  if (!isRecord14(root) || !isRecord14(parent)) fail11(`staged provider lock misses ${provider}`);
+  if (!isRecord14(root.dependencies)) fail11("staged provider lock misses root dependencies");
+  const rootSpec = assertFileAlias(root.dependencies[provider], npmDir, artifactPath, "provider root alias");
+  const parentSpec = assertFileAlias(parent.resolved, npmDir, artifactPath, "provider resolved alias");
+  if (rootSpec !== parentSpec) fail11("provider root/resolved aliases differ");
+  if (parent.version !== release.version || parent.integrity !== release.integrity) {
+    fail11(`staged provider lock metadata mismatch: ${provider}`);
+  }
+  const rootManifest = readJson(path48.join(npmDir, "package.json"), "staged provider root manifest");
+  if (rootManifest.name !== PROVIDER_PACKAGE_ROOT || !isRecord14(rootManifest.dependencies)) {
+    fail11("staged provider root manifest is invalid");
+  }
+  if (rootManifest.dependencies[provider] !== rootSpec) {
+    fail11("staged provider manifest alias differs from lock");
+  }
+  const packageRoot = path48.join(modules, provider);
+  assertRealDirectory3(packageRoot, `staged ${provider} root`);
+  const manifest = readJson(path48.join(packageRoot, "package.json"), `${provider} manifest`);
+  if (manifest.name !== provider || manifest.version !== release.version) {
+    fail11(`staged ${provider} manifest identity/version mismatch`);
+  }
+  const bins = assertBinTargets(packageRoot, normalizeBins(manifest.bin, provider));
+  let treeSha256;
+  try {
+    treeSha256 = inventoryTreeSha256(packageRoot);
+  } catch (error) {
+    fail11(`staged ${provider} tree is unsafe: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return {
+    name: provider,
+    version: release.version,
+    integrity: release.integrity,
+    packageRoot,
+    treeSha256,
+    bins
+  };
+}
+function failureDetail(result) {
+  const stderr = typeof result.stderr === "string" ? result.stderr : "";
+  const stdout = typeof result.stdout === "string" ? result.stdout : "";
+  const detail = stderr !== "" ? stderr : stdout !== "" ? stdout : `exit ${result.exitCode}`;
+  return detail.length > 500 ? `${detail.slice(0, 500)}\u2026` : detail;
+}
+function defaultStageRun(executable, args, options) {
+  return runPiStageProcess(executable, args, options);
+}
+async function stagePiProviderPackages(input, deps = {}) {
+  if (!isRecord14(input)) fail11("input must be an object");
+  const { home, agent } = assertStageBoundary(input.homeDir, input.agentDir);
+  const piExecutable = validatePiExecutable(input.piExecutable);
+  if (!isRecord14(input.releases)) fail11("releases must be an object");
+  const releases = {};
+  for (const name of PROVIDER_NAMES) releases[name] = assertRelease2(name, input.releases[name]);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  if (typeof fetchImpl !== "function") fail11("fetchImpl must be a function");
+  const run = deps.run ?? defaultStageRun;
+  if (typeof run !== "function") fail11("run must be a function");
+  const stageDir = createStageRoot(home);
+  const packages = [];
+  const stagedProviders = [];
+  for (const provider of PROVIDER_NAMES) {
+    const providerStage = path48.join(stageDir, provider);
+    const stageAgentDir = path48.join(providerStage, "pi-agent");
+    const downloads = path48.join(providerStage, "downloads");
+    const workspace = path48.join(providerStage, "workspace");
+    createDirectory(stageAgentDir);
+    createDirectory(downloads);
+    createDirectory(workspace);
+    const artifactPath = path48.join(downloads, `${provider}-${releases[provider].version}.tgz`);
+    const artifact = await downloadVerifiedNpmPackageTarball(provider, releases[provider], artifactPath, fetchImpl);
+    const env = stageEnvironment(providerStage, stageAgentDir, piExecutable);
+    stagedProviders.push({ provider, release: releases[provider], artifactPath: artifact.path, stageAgentDir, workspace, env });
+  }
+  for (const staged of stagedProviders) {
+    const provider = staged.provider;
+    const artifact = { path: staged.artifactPath };
+    const source = `npm:${provider}@file:${artifact.path}`;
+    let result;
+    try {
+      result = await run(piExecutable, ["install", source, "--no-approve"], { env: staged.env, cwd: staged.workspace });
+    } catch (error) {
+      fail11(`${provider} native stage failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isRecord14(result) || typeof result.exitCode !== "number") fail11(`${provider} native stage returned invalid output`);
+    if (result.exitCode !== 0) fail11(`${provider} native stage failed: ${failureDetail(result)}`);
+    packages.push(inspectProviderTree(staged.stageAgentDir, artifact.path, staged.release, provider));
+  }
+  return { stageDir, packages };
+}
+
+// src/lib/pi-provider-activation.ts
+init_pi();
+init_npm_provider();
+import crypto3 from "crypto";
+import fs41 from "fs";
+import path49 from "path";
+var PROVIDER_NAMES2 = ["gentle-engram", "pi-mcp-adapter"];
+var MAX_MANIFEST_BYTES2 = 1 * 1024 * 1024;
+var SHA256 = /^[a-f0-9]{64}$/;
+function resolved2(value) {
+  return path49.resolve(value);
+}
+function isStrictChild6(child, root) {
+  const rel = path49.relative(resolved2(root), resolved2(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path49.sep}`) && !path49.isAbsolute(rel);
+}
+function isContainedOrEqual(child, root) {
+  return resolved2(child) === resolved2(root) || isStrictChild6(child, root);
+}
+function lstatOrNull8(target) {
+  try {
+    return fs41.lstatSync(target);
+  } catch {
+    return null;
+  }
+}
+function incomplete(message) {
+  const error = new Error(`pi-provider-activation: ${message}`);
+  error.recovery = "incomplete";
+  throw error;
+}
+function fail12(message) {
+  throw new Error(`pi-provider-activation: ${message}`);
+}
+function assertAncestorsClean2(target, boundary, label) {
+  const boundaryResolved = resolved2(boundary);
+  let current = resolved2(target);
+  if (!isContainedOrEqual(current, boundaryResolved)) {
+    fail12(`${label} escapes its boundary: ${target}`);
+  }
+  for (; ; ) {
+    const stat = lstatOrNull8(current);
+    if (stat !== null && stat.isSymbolicLink()) fail12(`${label} ancestor is a symlink: ${current}`);
+    if (current === boundaryResolved) return;
+    const parent = path49.dirname(current);
+    if (parent === current || !isContainedOrEqual(parent, boundaryResolved)) {
+      fail12(`${label} has an unsafe ancestor: ${current}`);
+    }
+    current = parent;
+  }
+}
+function assertRealDirectory4(target, boundary, label) {
+  const value = resolved2(target);
+  if (!isStrictChild6(value, boundary) && value !== resolved2(boundary)) {
+    fail12(`${label} escapes its boundary: ${target}`);
+  }
+  assertAncestorsClean2(value, boundary, label);
+  const stat = lstatOrNull8(value);
+  if (stat === null || !stat.isDirectory() || stat.isSymbolicLink()) {
+    fail12(`${label} must be a real directory: ${target}`);
+  }
+  return value;
+}
+function assertOptionalRealDirectory(target, boundary, label) {
+  const value = resolved2(target);
+  if (!isStrictChild6(value, boundary)) fail12(`${label} escapes its boundary: ${target}`);
+  assertAncestorsClean2(path49.dirname(value), boundary, label);
+  const stat = lstatOrNull8(value);
+  if (stat === null) return false;
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail12(`${label} must be a real directory: ${target}`);
+  return true;
+}
+function assertRegularFile3(target, boundary, label) {
+  const value = resolved2(target);
+  if (!isStrictChild6(value, boundary)) fail12(`${label} escapes its boundary: ${target}`);
+  assertAncestorsClean2(path49.dirname(value), boundary, label);
+  const stat = lstatOrNull8(value);
+  if (stat === null || !stat.isFile() || stat.isSymbolicLink()) fail12(`${label} must be a regular file: ${target}`);
+}
+function readBoundedFile(target, boundary, label) {
+  assertRegularFile3(target, boundary, label);
+  const stat = lstatOrNull8(target);
+  if (stat === null || stat.size > MAX_MANIFEST_BYTES2) fail12(`${label} exceeds size bound: ${target}`);
+  try {
+    return fs41.readFileSync(target);
+  } catch {
+    fail12(`cannot read ${label}: ${target}`);
+  }
+}
+function readJsonObject(target, boundary, label) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readBoundedFile(target, boundary, label).toString("utf8"));
+  } catch {
+    fail12(`malformed ${label}: ${target}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    fail12(`${label} must be an object: ${target}`);
+  }
+  return parsed;
+}
+function realPathInside(target, root, label) {
+  let actual;
+  let rootActual;
+  try {
+    actual = fs41.realpathSync(target);
+    rootActual = fs41.realpathSync(root);
+  } catch {
+    fail12(`${label} cannot be resolved safely: ${target}`);
+  }
+  if (!isStrictChild6(actual, rootActual)) fail12(`${label} escapes its stage root: ${target}`);
+}
+function normalizeBins2(raw, packageName, label) {
+  if (typeof raw === "string") {
+    if (raw === "") fail12(`${label} has an empty bin target`);
+    return { [packageName]: raw };
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    fail12(`${label} must declare a bin map`);
+  }
+  const out = {};
+  for (const [name, target] of Object.entries(raw)) {
+    if (name === "" || name.includes("/") || name.includes("\\") || typeof target !== "string" || target === "") {
+      fail12(`${label} has an invalid bin declaration`);
+    }
+    out[name] = target;
+  }
+  return out;
+}
+function sortedMap(map) {
+  return JSON.stringify(Object.fromEntries(Object.entries(map).sort(([a], [b]) => a.localeCompare(b))));
+}
+function validateBinTarget(packageRoot, target, label) {
+  if (path49.isAbsolute(target)) fail12(`${label} must be relative: ${target}`);
+  const lexical = resolved2(path49.join(packageRoot, target));
+  if (!isStrictChild6(lexical, packageRoot)) fail12(`${label} escapes its package root: ${target}`);
+  assertAncestorsClean2(path49.dirname(lexical), packageRoot, label);
+  const stat = lstatOrNull8(lexical);
+  if (stat === null) fail12(`${label} does not exist: ${target}`);
+  let actual;
+  try {
+    actual = fs41.realpathSync(lexical);
+  } catch {
+    fail12(`${label} cannot be resolved: ${target}`);
+  }
+  if (!isStrictChild6(actual, resolved2(packageRoot))) fail12(`${label} escapes its package root: ${target}`);
+  let finalStat;
+  try {
+    finalStat = fs41.statSync(lexical);
+  } catch {
+    fail12(`${label} cannot be stat'ed: ${target}`);
+  }
+  if (!finalStat.isFile()) {
+    fail12(`${label} must point to a file: ${target}`);
+  }
+  return lexical;
+}
+function packageSource3(entry) {
+  if (typeof entry === "string") return entry;
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+  const source = entry.source;
+  return typeof source === "string" ? source : null;
+}
+function canonicalProviderSource(source, packageName) {
+  return isNamedPiSource(source, packageName);
+}
+function parseAndPlanSettings(settingsJson, packages) {
+  let parsed;
+  try {
+    parsed = JSON.parse(settingsJson);
+  } catch {
+    fail12("settings.json is malformed");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    fail12("settings.json root must be an object");
+  }
+  const root = parsed;
+  if (!Array.isArray(root.packages)) fail12("settings.json packages must be an array");
+  const entries = root.packages;
+  const planned = entries.map((entry) => {
+    if (typeof entry === "string") return entry;
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+      fail12("settings.json contains an entry without a canonical source");
+    }
+    const source = packageSource3(entry);
+    if (source === null) fail12("settings.json contains an entry without a canonical source");
+    return entry;
+  });
+  for (const provider of packages) {
+    const matches = planned.map((entry, index) => ({ entry, index, source: packageSource3(entry) })).filter((value) => value.source !== null && canonicalProviderSource(value.source, provider.name));
+    if (matches.length !== 1) {
+      fail12(`settings.json must contain exactly one canonical source for ${provider.name}`);
+    }
+    const match = matches[0];
+    if (match === void 0) fail12(`settings.json source missing for ${provider.name}`);
+    const nextSource = `npm:${provider.name}@${provider.version}`;
+    if (typeof match.entry === "string") {
+      planned[match.index] = nextSource;
+    } else {
+      match.entry.source = nextSource;
+    }
+  }
+  root.packages = planned;
+  return JSON.stringify(root);
+}
+function validateSettingsFile(settingsPath, agentDir, expected) {
+  assertRegularFile3(settingsPath, agentDir, "settings.json");
+  let current;
+  try {
+    current = fs41.readFileSync(settingsPath, "utf8");
+  } catch {
+    fail12(`cannot read settings.json: ${settingsPath}`);
+  }
+  if (current !== expected) fail12("settings.json changed since staging; refusing activation");
+}
+function validatePackageInput(provider, expectedName) {
+  if (provider.name !== expectedName) fail12(`unexpected provider package: ${provider.name}`);
+  if (!isStableSemverVersion(provider.version)) fail12(`invalid provider version: ${provider.version}`);
+  if (!isCanonicalSha512Integrity(provider.integrity)) fail12(`invalid provider integrity: ${provider.name}`);
+  if (!SHA256.test(provider.treeSha256)) fail12(`invalid provider tree hash: ${provider.name}`);
+  if (provider.bins === null || typeof provider.bins !== "object" || Array.isArray(provider.bins)) {
+    fail12(`provider bins must be a map: ${provider.name}`);
+  }
+}
+function validateCandidate(provider, stageDir) {
+  const candidateRoot = resolved2(provider.packageRoot);
+  const expectedRoot = path49.join(stageDir, provider.name, "pi-agent", "npm", "node_modules", provider.name);
+  if (candidateRoot !== resolved2(expectedRoot)) fail12(`candidate root is not the direct staged provider root: ${provider.name}`);
+  assertRealDirectory4(candidateRoot, stageDir, `candidate ${provider.name}`);
+  realPathInside(candidateRoot, stageDir, `candidate ${provider.name}`);
+  const manifest = readJsonObject(path49.join(candidateRoot, "package.json"), candidateRoot, `${provider.name} package.json`);
+  if (manifest.name !== provider.name || manifest.version !== provider.version) {
+    fail12(`candidate metadata does not match ${provider.name}`);
+  }
+  const manifestBins = normalizeBins2(manifest.bin, provider.name, `${provider.name} candidate bins`);
+  if (sortedMap(manifestBins) !== sortedMap(provider.bins)) {
+    fail12(`candidate bin map does not match metadata: ${provider.name}`);
+  }
+  for (const target of Object.values(manifestBins)) validateBinTarget(candidateRoot, target, `${provider.name} candidate bin`);
+  let actualTree;
+  try {
+    actualTree = inventoryTreeSha256(candidateRoot);
+  } catch (error) {
+    fail12(`candidate tree is unsafe: ${provider.name}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (actualTree !== provider.treeSha256) fail12(`candidate tree hash changed: ${provider.name}`);
+  return manifestBins;
+}
+function validateExistingPackage(activeRoot, agentDir, provider, candidateBins, modules) {
+  const stat = lstatOrNull8(activeRoot);
+  if (stat === null) return null;
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail12(`existing provider root is not a real directory: ${provider.name}`);
+  const manifest = readJsonObject(path49.join(activeRoot, "package.json"), activeRoot, `${provider.name} existing package.json`);
+  if (manifest.name !== provider.name || typeof manifest.version !== "string" || manifest.version === "") {
+    fail12(`existing provider metadata is not owned: ${provider.name}`);
+  }
+  const existingBins = normalizeBins2(manifest.bin, provider.name, `${provider.name} existing bins`);
+  if (sortedMap(existingBins) !== sortedMap(candidateBins)) {
+    fail12(`provider bin layout changed for ${provider.name}; manual migration required`);
+  }
+  for (const target of Object.values(existingBins)) validateBinTarget(activeRoot, target, `${provider.name} existing bin`);
+  const existingTree = inventoryTreeSha256(activeRoot);
+  const binDir = path49.join(modules, ".bin");
+  if (lstatOrNull8(binDir) !== null) assertRealDirectory4(binDir, modules, "npm .bin");
+  for (const [binName, target] of Object.entries(existingBins)) {
+    const wrapper = path49.join(binDir, binName);
+    const wrapperStat = lstatOrNull8(wrapper);
+    if (wrapperStat === null || !wrapperStat.isSymbolicLink()) continue;
+    let raw;
+    try {
+      raw = fs41.readlinkSync(wrapper);
+    } catch {
+      fail12(`provider bin wrapper is unreadable: ${wrapper}`);
+    }
+    const expected = resolved2(path49.join(activeRoot, target));
+    const actual = resolved2(path49.join(path49.dirname(wrapper), raw));
+    if (actual !== expected) fail12(`provider bin wrapper points elsewhere: ${wrapper}`);
+  }
+  return existingTree;
+}
+function atomicWrite(target, content, boundary) {
+  assertAncestorsClean2(path49.dirname(target), boundary, "atomic target");
+  const dir = path49.dirname(target);
+  const temporary = path49.join(dir, `.jorgex-provider-${process.pid}-${crypto3.randomBytes(12).toString("hex")}.tmp`);
+  let fd = null;
+  try {
+    fd = fs41.openSync(temporary, "wx", 384);
+    fs41.writeFileSync(fd, content, "utf8");
+    fs41.fsyncSync(fd);
+    fs41.closeSync(fd);
+    fd = null;
+    fs41.renameSync(temporary, target);
+  } finally {
+    if (fd !== null) {
+      try {
+        fs41.closeSync(fd);
+      } catch {
+      }
+    }
+    if (lstatOrNull8(temporary) !== null) fs41.rmSync(temporary, { force: true });
+  }
+}
+function sameRegularFile(target, expected, boundary) {
+  const stat = lstatOrNull8(target);
+  if (stat === null || !stat.isFile() || stat.isSymbolicLink()) return false;
+  try {
+    return fs41.readFileSync(target, "utf8") === expected;
+  } catch {
+    return false;
+  }
+}
+function markRecovery(error, state) {
+  const result = error instanceof Error ? error : new Error(String(error));
+  result.recovery = state;
+  return result;
+}
+function ensureTransactionFile(pathname, expected) {
+  const stat = lstatOrNull8(pathname);
+  if (stat === null || !stat.isFile() || stat.isSymbolicLink()) incomplete(`transaction state drifted: ${pathname}`);
+  let current;
+  try {
+    current = fs41.readFileSync(pathname, "utf8");
+  } catch {
+    incomplete(`transaction state unreadable: ${pathname}`);
+  }
+  if (current !== expected) incomplete(`transaction state drifted: ${pathname}`);
+}
+function removeTransactionState(lockPath, lockContent, markerPath, markerContent) {
+  assertAncestorsClean2(path49.dirname(lockPath), path49.dirname(path49.dirname(lockPath)), "transaction state");
+  ensureTransactionFile(lockPath, lockContent);
+  ensureTransactionFile(markerPath, markerContent);
+  fs41.unlinkSync(lockPath);
+  fs41.unlinkSync(markerPath);
+}
+function verifyPromotedPackage(state) {
+  const stat = lstatOrNull8(state.activeRoot);
+  if (stat === null || !stat.isDirectory() || stat.isSymbolicLink()) fail12(`promoted provider root missing: ${state.input.name}`);
+  const manifest = readJsonObject(path49.join(state.activeRoot, "package.json"), state.activeRoot, `${state.input.name} active package.json`);
+  if (manifest.name !== state.input.name || manifest.version !== state.input.version) {
+    fail12(`promoted provider metadata mismatch: ${state.input.name}`);
+  }
+  let tree;
+  try {
+    tree = inventoryTreeSha256(state.activeRoot);
+  } catch {
+    fail12(`promoted provider tree unreadable: ${state.input.name}`);
+  }
+  if (tree !== state.input.treeSha256) fail12(`promoted provider tree drifted: ${state.input.name}`);
+}
+function verifyPreviousPackageBeforeRename(state, agentDir) {
+  const stat = lstatOrNull8(state.activeRoot);
+  if (!state.existed) {
+    if (stat !== null) fail12(`unowned provider root appeared before promotion: ${state.input.name}`);
+    return;
+  }
+  if (stat === null || !stat.isDirectory() || stat.isSymbolicLink()) {
+    fail12(`existing provider root drifted before promotion: ${state.input.name}`);
+  }
+  assertAncestorsClean2(state.activeRoot, agentDir, `existing ${state.input.name}`);
+  const manifest = readJsonObject(path49.join(state.activeRoot, "package.json"), state.activeRoot, `${state.input.name} existing package.json`);
+  if (manifest.name !== state.input.name || typeof manifest.version !== "string" || manifest.version === "") {
+    fail12(`existing provider metadata drifted before promotion: ${state.input.name}`);
+  }
+  let currentTree;
+  try {
+    currentTree = inventoryTreeSha256(state.activeRoot);
+  } catch {
+    fail12(`existing provider tree became unreadable before promotion: ${state.input.name}`);
+  }
+  if (currentTree !== state.previousTreeSha256) {
+    fail12(`existing provider changed before promotion: ${state.input.name}`);
+  }
+}
+function verifyBackup(state) {
+  if (!state.existed) return;
+  const stat = lstatOrNull8(state.backupRoot);
+  if (stat === null || !stat.isDirectory() || stat.isSymbolicLink()) incomplete(`provider backup drifted: ${state.input.name}`);
+  if (state.previousTreeSha256 === null) incomplete(`provider backup hash missing: ${state.input.name}`);
+  let tree;
+  try {
+    tree = inventoryTreeSha256(state.backupRoot);
+  } catch {
+    incomplete(`provider backup unreadable: ${state.input.name}`);
+  }
+  if (tree !== state.previousTreeSha256) incomplete(`provider backup bytes drifted: ${state.input.name}`);
+}
+function restoreState(states, settingsPath, oldSettings, nextSettings, agentDir, lockPath, lockContent, markerPath, markerContent, backupDir, stageDir) {
+  ensureTransactionFile(lockPath, lockContent);
+  ensureTransactionFile(markerPath, markerContent);
+  if (!sameRegularFile(settingsPath, nextSettings, agentDir) && !sameRegularFile(settingsPath, oldSettings, agentDir)) incomplete("settings drifted during provider rollback");
+  const backupSettings = path49.join(backupDir, "settings.json");
+  assertRegularFile3(backupSettings, backupDir, "provider settings backup");
+  if (fs41.readFileSync(backupSettings, "utf8") !== oldSettings) incomplete("provider settings backup drifted");
+  for (const state of states) {
+    assertAncestorsClean2(path49.dirname(state.activeRoot), agentDir, `active ${state.input.name}`);
+    if (state.phase === "pending") {
+      verifyPreviousPackageBeforeRename(state, agentDir);
+      continue;
+    }
+    assertAncestorsClean2(path49.dirname(state.backupRoot), backupDir, `provider backup ${state.input.name}`);
+    verifyBackup(state);
+    if (state.phase === "promoted") {
+      verifyPromotedPackage(state);
+      assertAncestorsClean2(path49.dirname(state.candidateRoot), stageDir, `candidate ${state.input.name}`);
+      if (lstatOrNull8(state.candidateRoot) !== null) incomplete(`candidate stage root was replaced: ${state.input.name}`);
+    } else if (lstatOrNull8(state.activeRoot) !== null) {
+      incomplete(`provider root appeared after backup: ${state.input.name}`);
+    }
+  }
+  for (const state of [...states].reverse()) {
+    if (state.phase === "pending") continue;
+    if (state.phase === "promoted") fs41.renameSync(state.activeRoot, state.candidateRoot);
+    if (state.existed) fs41.renameSync(state.backupRoot, state.activeRoot);
+  }
+  atomicWrite(settingsPath, oldSettings, agentDir);
+  for (const state of states) verifyPreviousPackageBeforeRename(state, agentDir);
+  removeTransactionState(lockPath, lockContent, markerPath, markerContent);
+}
+async function activatePiProviderPackages(input) {
+  const homeDir = assertRealDirectory4(input.homeDir, resolved2(input.homeDir), "homeDir");
+  const agentDir = assertRealDirectory4(input.agentDir, homeDir, "agentDir");
+  const stageDir = assertRealDirectory4(input.stageDir, homeDir, "stageDir");
+  if (!isStrictChild6(stageDir, homeDir)) fail12("stageDir must be a strict child of homeDir");
+  if (!Array.isArray(input.packages) || input.packages.length !== PROVIDER_NAMES2.length) {
+    fail12("exactly the two owned provider packages are required");
+  }
+  const byName = new Map(input.packages.map((provider) => [provider.name, provider]));
+  if (byName.size !== PROVIDER_NAMES2.length) fail12("provider packages must not be duplicated");
+  const settingsPath = path49.join(agentDir, "settings.json");
+  validateSettingsFile(settingsPath, agentDir, input.settingsJson);
+  const nextSettings = parseAndPlanSettings(input.settingsJson, PROVIDER_NAMES2.map((name) => {
+    const provider = byName.get(name);
+    if (provider === void 0) fail12(`missing provider package: ${name}`);
+    return provider;
+  }));
+  const npmDir = path49.join(agentDir, "npm");
+  const modules = path49.join(npmDir, "node_modules");
+  assertRealDirectory4(npmDir, agentDir, "npm root");
+  assertRealDirectory4(modules, npmDir, "node_modules");
+  const managedRoot = path49.join(npmDir, "jorgex-pi-managed");
+  assertOptionalRealDirectory(managedRoot, npmDir, "managed root");
+  if (lstatOrNull8(managedRoot) === null) {
+    assertAncestorsClean2(path49.dirname(managedRoot), agentDir, "managed root");
+    fs41.mkdirSync(managedRoot, { recursive: true, mode: 448 });
+  }
+  const lockPath = path49.join(managedRoot, "transaction.lock");
+  const markerPath = path49.join(managedRoot, "active-transaction.json");
+  if (lstatOrNull8(lockPath) !== null) fail12(`transaction lock busy: ${lockPath}`);
+  if (lstatOrNull8(markerPath) !== null) fail12(`active transaction pending: ${markerPath}`);
+  const states = [];
+  for (const name of PROVIDER_NAMES2) {
+    const provider = byName.get(name);
+    if (provider === void 0) fail12(`missing provider package: ${name}`);
+    validatePackageInput(provider, name);
+    const candidateBins = validateCandidate(provider, stageDir);
+    const activeRoot = path49.join(modules, name);
+    assertAncestorsClean2(activeRoot, agentDir, `active ${name}`);
+    const previousTreeSha256 = validateExistingPackage(activeRoot, agentDir, provider, candidateBins, modules);
+    states.push({
+      input: provider,
+      candidateRoot: resolved2(provider.packageRoot),
+      activeRoot,
+      backupRoot: "",
+      existed: previousTreeSha256 !== null,
+      previousTreeSha256,
+      phase: "pending"
+    });
+  }
+  const backupDir = path49.join(stageDir, `.provider-activation-${crypto3.randomBytes(16).toString("hex")}`);
+  const backupProviders = path49.join(backupDir, "providers");
+  if (!isStrictChild6(backupDir, stageDir)) fail12("provider backup escaped stage root");
+  const lockContent = `${JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString(), backupDir })}
+`;
+  const markerContent = `${JSON.stringify({ phase: "provider-activation", backupDir, packages: PROVIDER_NAMES2, pid: process.pid }, null, 2)}
+`;
+  let lockAcquired = false;
+  let markerCreated = false;
+  let backupCreated = false;
+  try {
+    fs41.writeFileSync(lockPath, lockContent, { encoding: "utf8", flag: "wx", mode: 384 });
+    lockAcquired = true;
+    validateSettingsFile(settingsPath, agentDir, input.settingsJson);
+    const unchanged = JSON.stringify(JSON.parse(input.settingsJson)) === nextSettings && states.every((state) => state.previousTreeSha256 === state.input.treeSha256);
+    if (unchanged) {
+      await input.verify();
+      validateSettingsFile(settingsPath, agentDir, input.settingsJson);
+      for (const state of states) verifyPreviousPackageBeforeRename(state, agentDir);
+      ensureTransactionFile(lockPath, lockContent);
+      fs41.unlinkSync(lockPath);
+      lockAcquired = false;
+      return { ok: true, changed: false, backupDir: null };
+    }
+    fs41.writeFileSync(markerPath, markerContent, { encoding: "utf8", flag: "wx", mode: 384 });
+    markerCreated = true;
+    fs41.mkdirSync(backupDir, { recursive: false, mode: 448 });
+    backupCreated = true;
+    fs41.mkdirSync(backupProviders, { recursive: false, mode: 448 });
+    for (const state of states) {
+      state.backupRoot = path49.join(backupProviders, state.input.name);
+    }
+    fs41.writeFileSync(path49.join(backupDir, "settings.json"), input.settingsJson, { encoding: "utf8", flag: "wx", mode: 384 });
+    fs41.writeFileSync(path49.join(backupDir, "manifest.json"), `${JSON.stringify(states.map((state) => ({ name: state.input.name, existed: state.existed, treeSha256: state.previousTreeSha256 })), null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+    for (const state of states) {
+      const currentCandidateTree = inventoryTreeSha256(state.candidateRoot);
+      if (currentCandidateTree !== state.input.treeSha256) fail12(`candidate tree changed before promotion: ${state.input.name}`);
+      assertAncestorsClean2(path49.dirname(state.candidateRoot), stageDir, `candidate ${state.input.name}`);
+      assertAncestorsClean2(path49.dirname(state.activeRoot), agentDir, `active ${state.input.name}`);
+      verifyPreviousPackageBeforeRename(state, agentDir);
+      if (state.existed) {
+        fs41.renameSync(state.activeRoot, state.backupRoot);
+        state.phase = "backed-up";
+      }
+      fs41.renameSync(state.candidateRoot, state.activeRoot);
+      state.phase = "promoted";
+    }
+    for (const state of states) verifyPromotedPackage(state);
+    atomicWrite(settingsPath, nextSettings, agentDir);
+    if (!sameRegularFile(settingsPath, nextSettings, agentDir)) fail12("settings readback failed after provider promotion");
+    await input.verify();
+    for (const state of states) verifyPromotedPackage(state);
+    if (!sameRegularFile(settingsPath, nextSettings, agentDir)) fail12("settings drifted after provider verification");
+    removeTransactionState(lockPath, lockContent, markerPath, markerContent);
+    return { ok: true, changed: true, backupDir };
+  } catch (error) {
+    const original = error instanceof Error ? error : new Error(String(error));
+    if (!lockAcquired || !markerCreated || !backupCreated) {
+      try {
+        if (markerCreated) ensureTransactionFile(markerPath, markerContent);
+        if (markerCreated) fs41.unlinkSync(markerPath);
+        if (lockAcquired) ensureTransactionFile(lockPath, lockContent);
+        if (lockAcquired) fs41.unlinkSync(lockPath);
+      } catch {
+        incomplete(`activation failed before promotion and transaction cleanup was unsafe: ${original.message}`);
+      }
+      throw original;
+    }
+    try {
+      await Promise.resolve();
+      restoreState(states, settingsPath, input.settingsJson, nextSettings, agentDir, lockPath, lockContent, markerPath, markerContent, backupDir, stageDir);
+    } catch (rollbackError) {
+      const reason = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
+      incomplete(`rollback incomplete; retaining provider backup and transaction marker: ${reason}; original: ${original.message}`);
+    }
+    throw markRecovery(original, "complete");
+  }
+}
+
+// src/lib/pi-provider-smoke.ts
+init_pi_mcp_config();
+import fs42 from "fs";
+import path50 from "path";
+import { createServer } from "http";
+async function smokePiProviderRuntime(input) {
+  const root = fs42.mkdtempSync(path50.join(input.scratchRoot, "stage-providers-smoke-"));
+  const endpoint = createServer((_request, response) => {
+    response.writeHead(503, { "Content-Type": "application/json", Connection: "close" });
+    response.end('{"error":"isolated package smoke"}');
+  });
+  let failed = false;
+  let smokeError;
+  try {
+    const stageDir = path50.join(root, "pi-agent");
+    const modules = path50.join(stageDir, "npm", "node_modules");
+    fs42.mkdirSync(modules, { recursive: true });
+    fs42.mkdirSync(path50.join(root, "workspace"));
+    const packages = [];
+    for (const [name, source] of Object.entries({ "jorgex-pi": input.jorgexPackageRoot, ...input.providerRoots })) {
+      const packageRoot = fs42.realpathSync(source);
+      const metadata = JSON.parse(fs42.readFileSync(path50.join(packageRoot, "package.json"), "utf8"));
+      if (metadata.name !== name || typeof metadata.version !== "string" || !/^\d+\.\d+\.\d+$/.test(metadata.version)) {
+        throw new Error(`Pi provider smoke: invalid ${name} identity`);
+      }
+      fs42.symlinkSync(path50.relative(modules, packageRoot), path50.join(modules, name), "dir");
+      packages.push(`npm:${name}@${metadata.version}`);
+    }
+    fs42.writeFileSync(path50.join(stageDir, "settings.json"), JSON.stringify({ packages }));
+    fs42.writeFileSync(resolvePiAdapterConfigPath(stageDir), JSON.stringify({ mcpServers: {
+      engram: { command: input.engramBin, args: ["mcp", "--tools=agent"], lifecycle: "lazy", directTools: false }
+    } }));
+    await new Promise((resolve, reject) => {
+      endpoint.once("error", reject);
+      endpoint.listen(0, "127.0.0.1", () => {
+        endpoint.off("error", reject);
+        resolve();
+      });
+    });
+    const address = endpoint.address();
+    if (address === null || typeof address === "string") throw new Error("Pi provider smoke: no loopback endpoint");
+    return await smokeStagedPiRuntime({
+      piExecutable: input.piExecutable,
+      stageDir,
+      providerSetup: { engramBin: input.engramBin, engramUrl: `http://127.0.0.1:${address.port}` }
+    });
+  } catch (error) {
+    failed = true;
+    smokeError = error;
+    throw error;
+  } finally {
+    endpoint.closeAllConnections();
+    if (endpoint.listening) await new Promise((resolve) => endpoint.close(() => resolve()));
+    try {
+      fs42.rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+    } catch (cleanupError) {
+      if (!failed) throw cleanupError;
+      const detail = smokeError instanceof Error ? smokeError.message : String(smokeError);
+      throw new AggregateError(
+        [smokeError, cleanupError],
+        `${detail}; Pi provider smoke cleanup failed at ${root}`,
+        { cause: smokeError }
+      );
+    }
+  }
+}
+
+// src/lib/pi-provider-update.ts
+function isStrictChildPath(child, root) {
+  const rel = path51.relative(path51.resolve(root), path51.resolve(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path51.sep}`) && !path51.isAbsolute(rel);
+}
+async function completeUpdatedPiMcp(configDir, engramBin) {
+  const { verifyOfficialSetup: verifyOfficialSetup5 } = await Promise.resolve().then(() => (init_pi(), pi_exports));
+  const before = await verifyOfficialSetup5({ configDir, engramBin });
+  if (!before.layers.includes("packages")) throw new Error(before.reason ?? "Setup de paquetes Pi incompleto.");
+  migrateOfficialPiMcpConfig({ configDir, engramBin });
+  const after = await verifyOfficialSetup5({ configDir, engramBin });
+  if (!after.ok) throw new Error(after.reason ?? "Configuraci\xF3n MCP Pi no verificada.");
+}
+async function updatePiProviderPackages(input) {
+  const { homeDir, agentDir } = input;
+  if (!isStrictChildPath(agentDir, homeDir)) throw new Error("Pi provider agent directory is outside HOME");
+  const receiptPath = path51.join(homeDir, ".jorgex-stack", "pi-receipt.json");
+  const settingsPath = path51.join(agentDir, "settings.json");
+  for (const file of [receiptPath, settingsPath]) {
+    if (!fs43.lstatSync(file).isFile()) throw new Error("Pi provider update requires regular managed state files");
+  }
+  const receiptBytes = fs43.readFileSync(receiptPath, "utf8");
+  const settingsJson = fs43.readFileSync(settingsPath, "utf8");
+  const modules = path51.join(agentDir, "npm", "node_modules");
+  const packageLink = path51.join(modules, "jorgex-pi");
+  if (!fs43.lstatSync(packageLink).isSymbolicLink()) throw new Error("Pi provider update requires the managed private link");
+  const linkTarget = fs43.readlinkSync(packageLink);
+  const packageRoot = fs43.realpathSync(packageLink);
+  const releaseDir = path51.dirname(path51.dirname(packageRoot));
+  if (!isStrictChildPath(releaseDir, path51.join(agentDir, "npm", "jorgex-pi-managed", "releases")) || packageRoot !== path51.join(releaseDir, "node_modules", "jorgex-pi")) {
+    throw new Error("Pi provider update found an untrusted private release path");
+  }
+  const privateTree = inventoryTreeSha256(releaseDir);
+  const assertPrivateUnchanged = () => {
+    if (!fs43.lstatSync(receiptPath).isFile() || fs43.readFileSync(receiptPath, "utf8") !== receiptBytes || !fs43.lstatSync(packageLink).isSymbolicLink() || fs43.readlinkSync(packageLink) !== linkTarget || fs43.realpathSync(packageLink) !== packageRoot || inventoryTreeSha256(releaseDir) !== privateTree) {
+      throw new Error("Pi private receipt/link/tree drift during provider update");
+    }
+  };
+  const releases = {
+    "gentle-engram": await resolveLatestNpmPackageRelease("gentle-engram", fetch),
+    "pi-mcp-adapter": await resolveLatestNpmPackageRelease("pi-mcp-adapter", fetch)
+  };
+  const staged = await stagePiProviderPackages({ ...input, releases });
+  assertPrivateUnchanged();
+  const providerRoots = Object.fromEntries(staged.packages.map((provider) => [provider.name, provider.packageRoot]));
+  const activeRoots = { "gentle-engram": path51.join(modules, "gentle-engram"), "pi-mcp-adapter": path51.join(modules, "pi-mcp-adapter") };
+  const adapterAgentDir = path51.dirname(path51.dirname(path51.dirname(providerRoots["pi-mcp-adapter"])));
+  const selectedConfig = path51.basename(resolvePiAdapterConfigPath(adapterAgentDir));
+  if (!declaredPiMcpConfigFiles(agentDir).includes(selectedConfig)) {
+    throw new Error("The verified Pi package does not declare the candidate provider MCP reader");
+  }
+  for (const provider of staged.packages) {
+    if (inventoryTreeSha256(provider.packageRoot) !== provider.treeSha256) throw new Error("Pi provider stage drift before smoke");
+  }
+  const smoke = { piExecutable: input.piExecutable, engramBin: input.engramBin, scratchRoot: staged.stageDir, jorgexPackageRoot: packageLink };
+  await smokePiProviderRuntime({ ...smoke, providerRoots });
+  assertPrivateUnchanged();
+  const activation = await activatePiProviderPackages({
+    homeDir,
+    agentDir,
+    stageDir: staged.stageDir,
+    packages: staged.packages,
+    settingsJson,
+    verify: async () => {
+      assertPrivateUnchanged();
+      await smokePiProviderRuntime({ ...smoke, providerRoots: activeRoots });
+      assertPrivateUnchanged();
+    }
+  });
+  assertPrivateUnchanged();
+  try {
+    await completeUpdatedPiMcp(agentDir, input.engramBin);
+  } catch (error) {
+    throw new Error(`Pi providers activated and verified; MCP configuration pending with backup preserved: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  try {
+    fs43.rmSync(staged.stageDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  } catch (error) {
+    throw new Error(`Pi providers and MCP verified; stage cleanup pending at ${staged.stageDir}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { kind: activation.changed ? "updated" : "healthy", versions: {
+    "gentle-engram": releases["gentle-engram"].version,
+    "pi-mcp-adapter": releases["pi-mcp-adapter"].version
+  } };
+}
+
+// src/lib/pi-cached-artifact.ts
+init_npm_provider();
+import { createHash as createHash9, timingSafeEqual as timingSafeEqual6 } from "crypto";
+import fs44 from "fs";
+import path52 from "path";
 var PACKAGE_NAME5 = "jorgex-pi";
 var HEX643 = /^[0-9a-f]{64}$/;
 var HEX1283 = /^[0-9a-f]{128}$/;
 var MAX_TARBALL_BYTES4 = 128 * 1024 * 1024;
 var CHUNK_BYTES4 = 1024 * 1024;
-function isRecord14(value) {
+function isRecord15(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function lstatOrNull7(p7) {
+function lstatOrNull9(p7) {
   try {
-    return fs40.lstatSync(p7);
+    return fs44.lstatSync(p7);
   } catch {
     return null;
   }
 }
-function isStrictChild5(child, root) {
-  const rel = path48.relative(root, child);
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path48.sep}`) && !path48.isAbsolute(rel);
+function isStrictChild7(child, root) {
+  const rel = path52.relative(root, child);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path52.sep}`) && !path52.isAbsolute(rel);
 }
 function equalHex2(aHex, bHex) {
   let a;
@@ -16515,43 +17630,43 @@ function equalHex2(aHex, bHex) {
 }
 function verifyCachedPiArtifact(input) {
   try {
-    if (!isRecord14(input)) return false;
+    if (!isRecord15(input)) return false;
     const { receipt, homeDir, downloadsDir } = input;
-    if (typeof homeDir !== "string" || homeDir === "" || !path48.isAbsolute(homeDir)) return false;
-    if (typeof downloadsDir !== "string" || downloadsDir === "" || !path48.isAbsolute(downloadsDir)) {
+    if (typeof homeDir !== "string" || homeDir === "" || !path52.isAbsolute(homeDir)) return false;
+    if (typeof downloadsDir !== "string" || downloadsDir === "" || !path52.isAbsolute(downloadsDir)) {
       return false;
     }
-    const homeResolved = path48.resolve(homeDir);
-    const downloadsResolved = path48.resolve(downloadsDir);
-    const homeStat = lstatOrNull7(homeResolved);
+    const homeResolved = path52.resolve(homeDir);
+    const downloadsResolved = path52.resolve(downloadsDir);
+    const homeStat = lstatOrNull9(homeResolved);
     if (homeStat === null || !homeStat.isDirectory() || homeStat.isSymbolicLink()) return false;
-    const downloadsStat = lstatOrNull7(downloadsResolved);
+    const downloadsStat = lstatOrNull9(downloadsResolved);
     if (downloadsStat === null || !downloadsStat.isDirectory() || downloadsStat.isSymbolicLink()) {
       return false;
     }
-    if (!isStrictChild5(downloadsResolved, homeResolved)) return false;
-    const rel = path48.relative(homeResolved, downloadsResolved);
-    const parts = rel.split(path48.sep);
+    if (!isStrictChild7(downloadsResolved, homeResolved)) return false;
+    const rel = path52.relative(homeResolved, downloadsResolved);
+    const parts = rel.split(path52.sep);
     let cursor = homeResolved;
     for (const part of parts) {
       if (part === "" || part === "." || part === "..") return false;
-      cursor = path48.join(cursor, part);
-      const st2 = lstatOrNull7(cursor);
+      cursor = path52.join(cursor, part);
+      const st2 = lstatOrNull9(cursor);
       if (st2 === null || !st2.isDirectory() || st2.isSymbolicLink()) return false;
     }
-    if (!isRecord14(receipt)) return false;
+    if (!isRecord15(receipt)) return false;
     if (receipt["schemaVersion"] !== 1) return false;
-    if (!isRecord14(receipt["managedPackage"])) return false;
+    if (!isRecord15(receipt["managedPackage"])) return false;
     const candidate = receipt["candidate"];
-    if (!isRecord14(candidate)) return false;
+    if (!isRecord15(candidate)) return false;
     const pkg = candidate["package"];
-    if (!isRecord14(pkg)) return false;
+    if (!isRecord15(pkg)) return false;
     if (pkg["name"] !== PACKAGE_NAME5) return false;
     const version = pkg["version"];
     if (!isStableSemverVersion(version)) return false;
     if (pkg["source"] !== `npm:${PACKAGE_NAME5}@${version}`) return false;
     const tarball = candidate["tarball"];
-    if (!isRecord14(tarball)) return false;
+    if (!isRecord15(tarball)) return false;
     const bytes = tarball["bytes"];
     if (typeof bytes !== "number" || !Number.isInteger(bytes) || bytes < 0 || bytes > MAX_TARBALL_BYTES4) {
       return false;
@@ -16561,9 +17676,9 @@ function verifyCachedPiArtifact(input) {
     if (typeof sha2562 !== "string" || !HEX643.test(sha2562)) return false;
     if (typeof sha512 !== "string" || !HEX1283.test(sha512)) return false;
     const fileName = `${PACKAGE_NAME5}-${version}.tgz`;
-    const target = path48.join(downloadsResolved, fileName);
-    if (path48.dirname(target) !== downloadsResolved) return false;
-    const st = lstatOrNull7(target);
+    const target = path52.join(downloadsResolved, fileName);
+    if (path52.dirname(target) !== downloadsResolved) return false;
+    const st = lstatOrNull9(target);
     if (st === null) return false;
     if (st.isSymbolicLink()) return false;
     if (!st.isFile()) return false;
@@ -16571,7 +17686,7 @@ function verifyCachedPiArtifact(input) {
     if (st.size > MAX_TARBALL_BYTES4) return false;
     let fd;
     try {
-      fd = fs40.openSync(target, "r");
+      fd = fs44.openSync(target, "r");
     } catch {
       return false;
     }
@@ -16583,7 +17698,7 @@ function verifyCachedPiArtifact(input) {
       for (; ; ) {
         let read;
         try {
-          read = fs40.readSync(fd, buffer, 0, buffer.length, null);
+          read = fs44.readSync(fd, buffer, 0, buffer.length, null);
         } catch {
           return false;
         }
@@ -16595,7 +17710,7 @@ function verifyCachedPiArtifact(input) {
       }
     } finally {
       try {
-        fs40.closeSync(fd);
+        fs44.closeSync(fd);
       } catch {
       }
     }
@@ -16757,56 +17872,56 @@ async function resolvePiEngramRequirement(input, deps) {
     remedy: "La instalaci\xF3n termin\xF3, pero Engram no qued\xF3 detectable; configura ENGRAM_BIN."
   } : { kind: "existing", bin: detected, scope: "host" };
 }
-function runtimePath3(piExecutable) {
-  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path49.dirname(piExecutable), path49.dirname(process.execPath), process.env.SystemRoot ? path49.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path49.dirname(piExecutable), path49.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
-  return [...new Set(entries.filter((entry) => entry !== null))].join(path49.delimiter);
+function runtimePath4(piExecutable) {
+  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path53.dirname(piExecutable), path53.dirname(process.execPath), process.env.SystemRoot ? path53.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path53.dirname(piExecutable), path53.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
+  return [...new Set(entries.filter((entry) => entry !== null))].join(path53.delimiter);
 }
 function targetPaths(targetDir, engramBin, piExecutable) {
-  const root = path49.resolve(targetDir);
-  const codingAgentDir = path49.join(root, "pi-agent");
-  const home = path49.join(root, "home");
-  const temporary = path49.join(root, "tmp");
+  const root = path53.resolve(targetDir);
+  const codingAgentDir = path53.join(root, "pi-agent");
+  const home = path53.join(root, "home");
+  const temporary = path53.join(root, "tmp");
   return {
     codingAgentDir,
-    receiptPath: path49.join(root, "state", "pi-receipt.json"),
-    packageRunner: path49.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path53.join(root, "state", "pi-receipt.json"),
+    packageRunner: path53.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
       USERPROFILE: home,
-      APPDATA: path49.join(root, "appdata"),
-      LOCALAPPDATA: path49.join(root, "localappdata"),
-      XDG_CONFIG_HOME: path49.join(root, "xdg-config"),
-      XDG_DATA_HOME: path49.join(root, "xdg-data"),
-      XDG_CACHE_HOME: path49.join(root, "xdg-cache"),
+      APPDATA: path53.join(root, "appdata"),
+      LOCALAPPDATA: path53.join(root, "localappdata"),
+      XDG_CONFIG_HOME: path53.join(root, "xdg-config"),
+      XDG_DATA_HOME: path53.join(root, "xdg-data"),
+      XDG_CACHE_HOME: path53.join(root, "xdg-cache"),
       TEMP: temporary,
       TMP: temporary,
       TMPDIR: temporary,
-      npm_config_cache: path49.join(root, "npm-cache"),
+      npm_config_cache: path53.join(root, "npm-cache"),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
       PI_CODING_AGENT_DIR: codingAgentDir,
       ...engramBin === null ? {} : { ENGRAM_BIN: engramBin },
-      PATH: runtimePath3(piExecutable)
+      PATH: runtimePath4(piExecutable)
     }
   };
 }
 function userPaths(engramBin, piExecutable) {
   const home = os6.homedir();
-  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path49.join(home, ".pi", "agent");
+  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path53.join(home, ".pi", "agent");
   return {
     codingAgentDir,
-    receiptPath: path49.join(dataDir(), "pi-receipt.json"),
-    packageRunner: path49.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path53.join(dataDir(), "pi-receipt.json"),
+    packageRunner: path53.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
-      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path49.join(home, ".config"),
-      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path49.join(home, ".cache"),
+      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path53.join(home, ".config"),
+      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path53.join(home, ".cache"),
       TMPDIR: os6.tmpdir(),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
       PI_CODING_AGENT_DIR: codingAgentDir,
       ...engramBin === null ? {} : { ENGRAM_BIN: engramBin },
-      PATH: runtimePath3(piExecutable)
+      PATH: runtimePath4(piExecutable)
     }
   };
 }
@@ -16836,7 +17951,7 @@ function runPiRuntime(input, deps) {
   }
   const candidate = input.candidate ?? PI_RUNTIME_CANDIDATE;
   const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.detected.executable) : targetPaths(input.targetDir, input.engramBin, input.detected.executable);
-  const settingsJson = deps.readSettings(path49.join(paths.codingAgentDir, "settings.json"));
+  const settingsJson = deps.readSettings(path53.join(paths.codingAgentDir, "settings.json"));
   const receiptJson = deps.readReceipt(paths.receiptPath);
   const lifecycleInput = {
     candidate,
@@ -16912,21 +18027,21 @@ function detectPiRuntime() {
     executable,
     version: inspection?.version ?? null,
     versionDiagnostic: inspection?.diagnostic ?? null,
-    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path49.join(home, ".pi", "agent")
+    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path53.join(home, ".pi", "agent")
   };
 }
 function hasManagedPiRuntime(targetDir) {
-  const receipt = targetDir === void 0 ? path49.join(dataDir(), "pi-receipt.json") : path49.join(path49.resolve(targetDir), "state", "pi-receipt.json");
-  return fs41.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
+  const receipt = targetDir === void 0 ? path53.join(dataDir(), "pi-receipt.json") : path53.join(path53.resolve(targetDir), "state", "pi-receipt.json");
+  return fs45.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
 }
 function resolvePiEngramBin(targetDir) {
   if (targetDir === void 0) return detectEngram();
-  const candidate = path49.join(path49.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
-  return fs41.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
+  const candidate = path53.join(path53.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
+  return fs45.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
 }
 function readOptional(file, fallback) {
   try {
-    return fs41.readFileSync(file, "utf8");
+    return fs45.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return fallback;
     throw error;
@@ -16950,24 +18065,6 @@ function runProcess(invocation) {
     stderr: result.stderr ?? (result.error?.message ?? "")
   };
 }
-function declaredPiMcpConfigFiles(stageDir) {
-  const file = path49.join(stageDir, "npm", "node_modules", "jorgex-pi", "contract", "jorgex-pi.v1.json");
-  const contract = JSON.parse(fs41.readFileSync(file, "utf8"));
-  const declaration = contract.mcpAdapterConfig;
-  if (declaration === void 0) return [];
-  if (declaration.schemaVersion !== 1 || !Array.isArray(declaration.files) || !declaration.files.every((file2) => typeof file2 === "string")) {
-    throw new Error("El candidato Pi declara un contrato MCP inv\xE1lido.");
-  }
-  return declaration.files;
-}
-async function completeUpdatedPiMcp(configDir, engramBin) {
-  const { verifyOfficialSetup: verifyOfficialSetup5 } = await Promise.resolve().then(() => (init_pi(), pi_exports));
-  const before = await verifyOfficialSetup5({ configDir, engramBin });
-  if (!before.layers.includes("packages")) throw new Error(before.reason ?? "Setup de paquetes Pi incompleto.");
-  migrateOfficialPiMcpConfig({ configDir, engramBin });
-  const after = await verifyOfficialSetup5({ configDir, engramBin });
-  if (!after.ok) throw new Error(after.reason ?? "Configuraci\xF3n MCP Pi no verificada.");
-}
 function setupPiFailedRemedy(setup) {
   const detail = setup.reason ?? setup.stderr ?? "setup oficial Pi fall\xF3";
   const recovery = setup.recovery ?? "none";
@@ -17010,7 +18107,7 @@ function preparedInstallMismatch(candidate, prepared) {
     return "la release preparada no coincide con la versi\xF3n/SRI del candidato";
   }
   const stageDir = prepared?.stageDir;
-  if (typeof stageDir !== "string" || stageDir === "" || !/(^|[\\/])stage-[0-9a-f]{32}[\\/]pi-agent$/.test(path49.resolve(stageDir))) {
+  if (typeof stageDir !== "string" || stageDir === "" || !/(^|[\\/])stage-[0-9a-f]{32}[\\/]pi-agent$/.test(path53.resolve(stageDir))) {
     return "el stage preparado no tiene el layout aislado esperado (stage-<hex>/pi-agent)";
   }
   const evidence = prepared?.evidence;
@@ -17085,12 +18182,12 @@ function backupLegacyMigrationState(settingsPath, receiptPath, backupRoot) {
   }
 }
 function verifyActivePiRelease(input) {
-  const agentDir = path49.resolve(input.agentDir);
-  const npmDir = path49.join(agentDir, "npm");
-  const managedRoot = path49.join(npmDir, "jorgex-pi-managed");
+  const agentDir = path53.resolve(input.agentDir);
+  const npmDir = path53.join(agentDir, "npm");
+  const managedRoot = path53.join(npmDir, "jorgex-pi-managed");
   let receiptRaw;
   try {
-    receiptRaw = fs41.readFileSync(input.receiptPath, "utf8");
+    receiptRaw = fs45.readFileSync(input.receiptPath, "utf8");
   } catch {
     throw new Error(`pi-verify-active: no se pudo leer el receipt promovido: ${input.receiptPath}`);
   }
@@ -17119,7 +18216,7 @@ function verifyActivePiRelease(input) {
     throw new Error("pi-verify-active: el scope del receipt promovido no coincide con el esperado");
   }
   const scopeDir = scopeRecord["codingAgentDir"];
-  if (typeof scopeDir !== "string" || !path49.isAbsolute(scopeDir) || path49.resolve(scopeDir) !== agentDir) {
+  if (typeof scopeDir !== "string" || !path53.isAbsolute(scopeDir) || path53.resolve(scopeDir) !== agentDir) {
     throw new Error("pi-verify-active: el codingAgentDir del receipt promovido no coincide con el agentDir");
   }
   const receiptEngram = record["engram"];
@@ -17150,40 +18247,40 @@ function verifyActivePiRelease(input) {
     throw new Error("pi-verify-active: el receipt promovido no conserva las seis dependencias de la evidencia");
   }
   const linkPath = managedRecord["linkPath"];
-  if (typeof linkPath !== "string" || !path49.isAbsolute(linkPath)) {
+  if (typeof linkPath !== "string" || !path53.isAbsolute(linkPath)) {
     throw new Error("pi-verify-active: el receipt promovido no trae un linkPath absoluto");
   }
-  const linkResolved = path49.resolve(linkPath);
-  if (linkResolved !== path49.join(npmDir, "node_modules", "jorgex-pi")) {
+  const linkResolved = path53.resolve(linkPath);
+  if (linkResolved !== path53.join(npmDir, "node_modules", "jorgex-pi")) {
     throw new Error("pi-verify-active: el enlace publicado sale del entry propio");
   }
   const releaseDir = managedRecord["releaseDir"];
-  if (typeof releaseDir !== "string" || !path49.isAbsolute(releaseDir)) {
+  if (typeof releaseDir !== "string" || !path53.isAbsolute(releaseDir)) {
     throw new Error("pi-verify-active: el receipt promovido no trae un releaseDir absoluto");
   }
-  const releaseResolved = path49.resolve(releaseDir);
-  const expectedRelease = path49.join(managedRoot, "releases", derivePiReleaseId(input.candidate.tarball.sha256, input.evidence));
+  const releaseResolved = path53.resolve(releaseDir);
+  const expectedRelease = path53.join(managedRoot, "releases", derivePiReleaseId(input.candidate.tarball.sha256, input.evidence));
   if (releaseResolved !== expectedRelease) {
     throw new Error("pi-verify-active: el release promovido no coincide con el esperado");
   }
   let target;
   try {
-    const linkStat = fs41.lstatSync(linkResolved);
+    const linkStat = fs45.lstatSync(linkResolved);
     if (!linkStat.isSymbolicLink()) {
       throw new Error("pi-verify-active: el entry publicado no es un enlace");
     }
-    target = fs41.readlinkSync(linkResolved);
+    target = fs45.readlinkSync(linkResolved);
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("pi-verify-active: ")) throw error;
     throw new Error("pi-verify-active: no se pudo leer el enlace publicado");
   }
-  const packageRoot = path49.join(releaseResolved, "node_modules", "jorgex-pi");
-  if (target === "" || path49.isAbsolute(target) || path49.resolve(path49.dirname(linkResolved), target) !== packageRoot) {
+  const packageRoot = path53.join(releaseResolved, "node_modules", "jorgex-pi");
+  if (target === "" || path53.isAbsolute(target) || path53.resolve(path53.dirname(linkResolved), target) !== packageRoot) {
     throw new Error("pi-verify-active: el enlace publicado no apunta al release promovido");
   }
   let realRoot;
   try {
-    realRoot = fs41.realpathSync(linkResolved);
+    realRoot = fs45.realpathSync(linkResolved);
   } catch {
     throw new Error("pi-verify-active: no se pudo resolver el realpath del enlace publicado");
   }
@@ -17200,11 +18297,18 @@ function verifyActivePiRelease(input) {
     throw new Error("pi-verify-active: el inventario del release promovido difiere de la evidencia");
   }
 }
-function isStrictChildPath(child, root) {
-  const rel = path49.relative(path49.resolve(root), path49.resolve(child));
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path49.sep}`) && !path49.isAbsolute(rel);
+function isStrictChildPath2(child, root) {
+  const rel = path53.relative(path53.resolve(root), path53.resolve(child));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path53.sep}`) && !path53.isAbsolute(rel);
+}
+function routesInstalledPiToUpdate(input) {
+  if (input.operation !== "install") return false;
+  const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.detected.executable) : targetPaths(input.targetDir, input.engramBin, input.detected.executable);
+  const receipt = readOptional(paths.receiptPath, null);
+  return receipt !== null && !isLegacyUnmanagedReceipt(receipt);
 }
 async function preparePiRuntimeSystem(input) {
+  if (routesInstalledPiToUpdate(input)) return preparePiRuntimeSystem({ ...input, operation: "update" });
   if (input.operation !== "install" && input.operation !== "update") {
     return {
       kind: "blocked",
@@ -17220,7 +18324,7 @@ async function preparePiRuntimeSystem(input) {
         remedy: "El update con --target-dir nunca ejecuta preflight de red; aporta un stage preverificado o usa update real."
       };
     }
-    if (typeof input.engramBin !== "string" || input.engramBin === "" || !path49.isAbsolute(input.engramBin)) {
+    if (typeof input.engramBin !== "string" || input.engramBin === "" || !path53.isAbsolute(input.engramBin)) {
       return {
         kind: "blocked",
         reason: "engram-required",
@@ -17228,7 +18332,7 @@ async function preparePiRuntimeSystem(input) {
       };
     }
     const updateExecutable = input.detected.executable;
-    if (typeof updateExecutable !== "string" || updateExecutable === "" || !path49.isAbsolute(updateExecutable)) {
+    if (typeof updateExecutable !== "string" || updateExecutable === "" || !path53.isAbsolute(updateExecutable)) {
       return {
         kind: "blocked",
         reason: "pi-executable-missing",
@@ -17243,24 +18347,24 @@ async function preparePiRuntimeSystem(input) {
       };
     }
     const updateHomeDir = os6.homedir();
-    if (typeof updateHomeDir !== "string" || updateHomeDir === "" || !path49.isAbsolute(updateHomeDir)) {
+    if (typeof updateHomeDir !== "string" || updateHomeDir === "" || !path53.isAbsolute(updateHomeDir)) {
       return {
         kind: "blocked",
         reason: "preflight-failed",
         remedy: "HOME ilegible para el preflight Pi; Pi no qued\xF3 activado."
       };
     }
-    const updateAgentDir = process.env.PI_CODING_AGENT_DIR ?? path49.join(updateHomeDir, ".pi", "agent");
-    const updateReceiptPath = path49.join(updateHomeDir, ".jorgex-stack", "pi-receipt.json");
-    const updateDownloadsDir = path49.join(updateHomeDir, ".jorgex-stack", "packages");
-    if (!isStrictChildPath(updateAgentDir, updateHomeDir)) {
+    const updateAgentDir = process.env.PI_CODING_AGENT_DIR ?? path53.join(updateHomeDir, ".pi", "agent");
+    const updateReceiptPath = path53.join(updateHomeDir, ".jorgex-stack", "pi-receipt.json");
+    const updateDownloadsDir = path53.join(updateHomeDir, ".jorgex-stack", "packages");
+    if (!isStrictChildPath2(updateAgentDir, updateHomeDir)) {
       return {
         kind: "blocked",
         reason: "agent-dir-outside-home",
         remedy: `PI_CODING_AGENT_DIR (${updateAgentDir}) est\xE1 fuera de la frontera de restore HOME (${updateHomeDir}); corrige el destino antes de reintentar; Pi no qued\xF3 activado.`
       };
     }
-    const updateSettingsPath = path49.join(updateAgentDir, "settings.json");
+    const updateSettingsPath = path53.join(updateAgentDir, "settings.json");
     let updateReceiptRaw;
     let updateSettingsRaw;
     try {
@@ -17276,7 +18380,7 @@ async function preparePiRuntimeSystem(input) {
     const stripUpdateGateNewline = (value) => value.endsWith("\n") ? value.slice(0, -1) : value;
     const updateReceiptJson = updateReceiptRaw === null ? null : stripUpdateGateNewline(updateReceiptRaw);
     const updateSettingsJson = stripUpdateGateNewline(updateSettingsRaw);
-    const updatePackageRunner = path49.join(updateAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs");
+    const updatePackageRunner = path53.join(updateAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs");
     const updateGate = verifyOfflineManagedPiRelease(
       {
         detected: {
@@ -17304,7 +18408,7 @@ async function preparePiRuntimeSystem(input) {
       return "remedy" in updateGate && typeof updateGate.remedy === "string" ? updateGate : { kind: "blocked", reason: updateGate.reason, remedy: `Verificaci\xF3n offline del receipt Pi fall\xF3 (${updateGate.reason}); sin preflight ni cambios. Pi no qued\xF3 activado.` };
     }
     try {
-      fs41.mkdirSync(updateDownloadsDir, { recursive: true });
+      fs45.mkdirSync(updateDownloadsDir, { recursive: true });
     } catch (error) {
       return {
         kind: "blocked",
@@ -17355,7 +18459,7 @@ async function preparePiRuntimeSystem(input) {
     };
   }
   const piExecutable = input.detected.executable;
-  if (typeof piExecutable !== "string" || piExecutable === "" || !path49.isAbsolute(piExecutable)) {
+  if (typeof piExecutable !== "string" || piExecutable === "" || !path53.isAbsolute(piExecutable)) {
     return {
       kind: "blocked",
       reason: "pi-executable-missing",
@@ -17371,8 +18475,8 @@ async function preparePiRuntimeSystem(input) {
   }
   const homeDir = os6.homedir();
   const agentDir = userPaths(input.engramBin, piExecutable).codingAgentDir;
-  const downloadsDir = path49.join(dataDir(), "packages");
-  if (!isStrictChildPath(agentDir, homeDir)) {
+  const downloadsDir = path53.join(dataDir(), "packages");
+  if (!isStrictChildPath2(agentDir, homeDir)) {
     return {
       kind: "blocked",
       reason: "agent-dir-outside-home",
@@ -17381,7 +18485,7 @@ async function preparePiRuntimeSystem(input) {
   }
   let preflightReceipt;
   try {
-    preflightReceipt = fs41.lstatSync(path49.join(dataDir(), "pi-receipt.json"), { throwIfNoEntry: false });
+    preflightReceipt = fs45.lstatSync(path53.join(dataDir(), "pi-receipt.json"), { throwIfNoEntry: false });
   } catch (error) {
     if (error.code === "ENOENT") {
       preflightReceipt = void 0;
@@ -17396,7 +18500,7 @@ async function preparePiRuntimeSystem(input) {
   if (preflightReceipt === void 0) {
     let preflightEntry;
     try {
-      preflightEntry = fs41.lstatSync(path49.join(agentDir, "npm", "node_modules", "jorgex-pi"), {
+      preflightEntry = fs45.lstatSync(path53.join(agentDir, "npm", "node_modules", "jorgex-pi"), {
         throwIfNoEntry: false
       });
     } catch (error) {
@@ -17419,7 +18523,7 @@ async function preparePiRuntimeSystem(input) {
     }
   }
   try {
-    fs41.mkdirSync(downloadsDir, { recursive: true });
+    fs45.mkdirSync(downloadsDir, { recursive: true });
   } catch (error) {
     return {
       kind: "blocked",
@@ -17456,6 +18560,7 @@ async function preparePiRuntimeSystem(input) {
   }
 }
 async function runPiRuntimeSystem(input) {
+  if (routesInstalledPiToUpdate(input)) return runPiRuntimeSystem({ ...input, operation: "update" });
   if (input.engramBin === null && input.operation !== "uninstall") return runPiRuntime(input, {
     readSettings: () => {
       throw new Error("unreachable");
@@ -17510,7 +18615,7 @@ async function runPiRuntimeSystem(input) {
         remedy: `${mismatch}; Pi no qued\xF3 activado y no se descarg\xF3 ni modific\xF3 nada.`
       };
     }
-    const settingsPath = path49.join(paths.codingAgentDir, "settings.json");
+    const settingsPath = path53.join(paths.codingAgentDir, "settings.json");
     let settingsJson = readOptional(settingsPath, '{"packages":[]}');
     const receiptJson = readOptional(paths.receiptPath, null);
     const scopeKind = input.targetDir === void 0 ? "real" : "target-dir";
@@ -17553,8 +18658,8 @@ async function runPiRuntimeSystem(input) {
         };
       }
       try {
-        const freshEntry = path49.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
-        if (fs41.lstatSync(freshEntry, { throwIfNoEntry: false }) !== void 0) {
+        const freshEntry = path53.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
+        if (fs45.lstatSync(freshEntry, { throwIfNoEntry: false }) !== void 0) {
           return {
             kind: "blocked",
             reason: "unowned-entry",
@@ -17673,7 +18778,7 @@ async function runPiRuntimeSystem(input) {
         backupLegacyMigrationState(
           settingsPath,
           paths.receiptPath,
-          input.targetDir === void 0 ? void 0 : path49.join(path49.resolve(input.targetDir), "backups")
+          input.targetDir === void 0 ? void 0 : path53.join(path53.resolve(input.targetDir), "backups")
         );
       } catch (error) {
         return {
@@ -17683,7 +18788,7 @@ async function runPiRuntimeSystem(input) {
         };
       }
     }
-    const homeDir = input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir);
+    const homeDir = input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir);
     const agentDir = paths.codingAgentDir;
     const receiptPath = paths.receiptPath;
     const stageDir = prepared.stageDir;
@@ -17708,11 +18813,11 @@ async function runPiRuntimeSystem(input) {
     };
     const smokeStage = async (dir) => {
       await smokeStagedPiRuntime({ piExecutable: input.detected.executable, stageDir: dir });
-      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path49.join(dir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path49.dirname(dir) });
+      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path53.join(dir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path53.dirname(dir) });
     };
     const verifyActive = async () => {
       verifyActivePiRelease({ agentDir, receiptPath, candidate: activationCandidate, evidence, scopeKind, engramBin });
-      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path49.join(agentDir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path49.dirname(stageDir) });
+      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path53.join(agentDir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path53.dirname(stageDir) });
       verifyActivePiRelease({ agentDir, receiptPath, candidate: activationCandidate, evidence, scopeKind, engramBin });
     };
     try {
@@ -17739,7 +18844,7 @@ async function runPiRuntimeSystem(input) {
   }
   if (input.operation === "update") {
     const engramBinForUpdate = input.engramBin;
-    if (engramBinForUpdate === null || !path49.isAbsolute(engramBinForUpdate)) {
+    if (engramBinForUpdate === null || !path53.isAbsolute(engramBinForUpdate)) {
       return {
         kind: "blocked",
         reason: "engram-required",
@@ -17770,10 +18875,10 @@ async function runPiRuntimeSystem(input) {
         remedy: `${updateMismatch}; Pi no qued\xF3 activado y no se descarg\xF3 ni modific\xF3 nada.`
       };
     }
-    const updateSettingsPath = path49.join(paths.codingAgentDir, "settings.json");
+    const updateSettingsPath = path53.join(paths.codingAgentDir, "settings.json");
     const updateScopeKind = input.targetDir === void 0 ? "real" : "target-dir";
-    const updateHomeDir = input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir);
-    const updateDownloadsDir = input.targetDir === void 0 ? path49.join(dataDir(), "packages") : path49.join(path49.resolve(input.targetDir), "downloads");
+    const updateHomeDir = input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir);
+    const updateDownloadsDir = input.targetDir === void 0 ? path53.join(dataDir(), "packages") : path53.join(path53.resolve(input.targetDir), "downloads");
     const stripUpdateNewline = (value) => value.endsWith("\n") ? value.slice(0, -1) : value;
     let updateSettingsRaw;
     let updateReceiptRaw;
@@ -17851,7 +18956,7 @@ async function runPiRuntimeSystem(input) {
     }
     if (input.targetDir === void 0) {
       try {
-        const selectedFile = path49.basename(resolvePiAdapterConfigPath(paths.codingAgentDir));
+        const selectedFile = path53.basename(resolvePiAdapterConfigPath(paths.codingAgentDir));
         if (selectedFile === "mcp-adapter.json" && !declaredPiMcpConfigFiles(updatePrepared.stageDir).includes(selectedFile)) {
           throw new Error("El candidato Pi verificado no declara lector mcp-adapter.json; no se modifica la instalaci\xF3n.");
         }
@@ -17935,11 +19040,11 @@ async function runPiRuntimeSystem(input) {
     };
     const updateSmokeStage = async (dir) => {
       await smokeStagedPiRuntime({ piExecutable: input.detected.executable, stageDir: dir });
-      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path49.join(dir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path49.dirname(dir) });
+      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path53.join(dir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path53.dirname(dir) });
     };
     const updateVerifyActive = async () => {
       verifyActivePiRelease({ agentDir: updateAgentDir, receiptPath: updateReceiptPath, candidate: updateActivationCandidate, evidence: updateEvidence, scopeKind: updateScopeKind, engramBin: engramBinForUpdate });
-      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path49.join(updateAgentDir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path49.dirname(updatePrepared.stageDir) });
+      await smokeLinkedPiRuntime({ piExecutable: input.detected.executable, packageRoot: path53.join(updateAgentDir, "npm", "node_modules", "jorgex-pi"), scratchRoot: path53.dirname(updatePrepared.stageDir) });
       verifyActivePiRelease({ agentDir: updateAgentDir, receiptPath: updateReceiptPath, candidate: updateActivationCandidate, evidence: updateEvidence, scopeKind: updateScopeKind, engramBin: engramBinForUpdate });
     };
     try {
@@ -17979,13 +19084,13 @@ async function runPiRuntimeSystem(input) {
       };
     }
   }
-  const packageRoot = path49.dirname(path49.dirname(paths.packageRunner));
+  const packageRoot = path53.dirname(path53.dirname(paths.packageRunner));
   const writeReceipt = (receipt) => {
     writeText(paths.receiptPath, `${JSON.stringify(receipt, null, 2)}
 `);
   };
   if (input.operation === "sync") {
-    const settingsJson = readOptional(path49.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
+    const settingsJson = readOptional(path53.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
     const receiptJson = readOptional(paths.receiptPath, null);
     if (receiptJson === null) {
       return {
@@ -18036,11 +19141,11 @@ async function runPiRuntimeSystem(input) {
             run: runProcess,
             verifyManagedArtifact: (receipt) => verifyCachedPiArtifact({
               receipt,
-              homeDir: input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir),
-              downloadsDir: input.targetDir === void 0 ? path49.join(dataDir(), "packages") : path49.join(path49.resolve(input.targetDir), "downloads")
+              homeDir: input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir),
+              downloadsDir: input.targetDir === void 0 ? path53.join(dataDir(), "packages") : path53.join(path53.resolve(input.targetDir), "downloads")
             }),
-            isPackageAbsent: () => !fs41.existsSync(packageRoot),
-            deleteReceipt: () => fs41.rmSync(paths.receiptPath, { force: true })
+            isPackageAbsent: () => !fs45.existsSync(packageRoot),
+            deleteReceipt: () => fs45.rmSync(paths.receiptPath, { force: true })
           }
         );
       }
@@ -18052,7 +19157,7 @@ async function runPiRuntimeSystem(input) {
     }
   }
   if (input.operation === "models") {
-    const settingsJson = readOptional(path49.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
+    const settingsJson = readOptional(path53.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}');
     const receiptJson = readOptional(paths.receiptPath, null);
     if (receiptJson === null) {
       return {
@@ -18103,11 +19208,11 @@ async function runPiRuntimeSystem(input) {
         run: runProcess,
         verifyManagedArtifact: (receipt) => verifyCachedPiArtifact({
           receipt,
-          homeDir: input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir),
-          downloadsDir: input.targetDir === void 0 ? path49.join(dataDir(), "packages") : path49.join(path49.resolve(input.targetDir), "downloads")
+          homeDir: input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir),
+          downloadsDir: input.targetDir === void 0 ? path53.join(dataDir(), "packages") : path53.join(path53.resolve(input.targetDir), "downloads")
         }),
-        isPackageAbsent: () => !fs41.existsSync(packageRoot),
-        deleteReceipt: () => fs41.rmSync(paths.receiptPath, { force: true })
+        isPackageAbsent: () => !fs45.existsSync(packageRoot),
+        deleteReceipt: () => fs45.rmSync(paths.receiptPath, { force: true })
       }
     );
   }
@@ -18124,17 +19229,17 @@ async function runPiRuntimeSystem(input) {
       value,
       {
         backupSettings: () => createBackup(
-          [path49.join(paths.codingAgentDir, "settings.json")],
+          [path53.join(paths.codingAgentDir, "settings.json")],
           "pi-package-uninstall",
-          input.targetDir === void 0 ? void 0 : path49.join(path49.resolve(input.targetDir), "backups")
+          input.targetDir === void 0 ? void 0 : path53.join(path53.resolve(input.targetDir), "backups")
         ),
         run: runProcess,
         verifyManagedArtifact: (receipt) => verifyCachedPiArtifact({
           receipt,
-          homeDir: input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir),
-          downloadsDir: input.targetDir === void 0 ? path49.join(dataDir(), "packages") : path49.join(path49.resolve(input.targetDir), "downloads")
+          homeDir: input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir),
+          downloadsDir: input.targetDir === void 0 ? path53.join(dataDir(), "packages") : path53.join(path53.resolve(input.targetDir), "downloads")
         }),
-        readSettings: () => fs41.readFileSync(path49.join(paths.codingAgentDir, "settings.json"), "utf8"),
+        readSettings: () => fs45.readFileSync(path53.join(paths.codingAgentDir, "settings.json"), "utf8"),
         verifyLegacyPackage: (receipt) => {
           const op = value;
           let effectiveEngram = op.engramBin;
@@ -18143,7 +19248,7 @@ async function runPiRuntimeSystem(input) {
             const engram = Reflect.get(receipt, "engram");
             if (engram === null || typeof engram !== "object" || Array.isArray(engram)) return false;
             const binary = Reflect.get(engram, "binary");
-            if (typeof binary !== "string" || binary === "" || !path49.isAbsolute(binary)) return false;
+            if (typeof binary !== "string" || binary === "" || !path53.isAbsolute(binary)) return false;
             effectiveEngram = binary;
           }
           if (typeof effectiveEngram !== "string" || effectiveEngram === "") return false;
@@ -18167,17 +19272,17 @@ async function runPiRuntimeSystem(input) {
           }
           let currentReceiptRaw = null;
           try {
-            currentReceiptRaw = fs41.readFileSync(paths.receiptPath, "utf8");
+            currentReceiptRaw = fs45.readFileSync(paths.receiptPath, "utf8");
           } catch {
             return { kind: "blocked", reason: "remove-failed" };
           }
           if (typeof op.receiptJson === "string" && currentReceiptRaw !== op.receiptJson) {
             return { kind: "blocked", reason: "receipt-untrusted" };
           }
-          const settingsPath = path49.join(paths.codingAgentDir, "settings.json");
-          const legacyEntry = path49.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
+          const settingsPath = path53.join(paths.codingAgentDir, "settings.json");
+          const legacyEntry = path53.join(paths.codingAgentDir, "npm", "node_modules", "jorgex-pi");
           return deactivateVerifiedLegacyPiEntry({
-            homeDir: input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir),
+            homeDir: input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir),
             agentDir: paths.codingAgentDir,
             receiptPath: paths.receiptPath,
             source,
@@ -18185,19 +19290,19 @@ async function runPiRuntimeSystem(input) {
             verify: () => {
               let entryStat = null;
               try {
-                entryStat = fs41.lstatSync(legacyEntry);
+                entryStat = fs45.lstatSync(legacyEntry);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (entryStat !== null) throw new Error("managed entry still present after uninstall");
               let receiptStat = null;
               try {
-                receiptStat = fs41.lstatSync(paths.receiptPath);
+                receiptStat = fs45.lstatSync(paths.receiptPath);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (receiptStat !== null) throw new Error("receipt still present after uninstall");
-              if (fs41.readFileSync(settingsPath, "utf8") !== nextSettings) {
+              if (fs45.readFileSync(settingsPath, "utf8") !== nextSettings) {
                 throw new Error("settings mismatch after uninstall");
               }
             }
@@ -18212,9 +19317,9 @@ async function runPiRuntimeSystem(input) {
           if (typeof mp.releaseDir !== "string" || typeof mp.linkPath !== "string" || typeof mp.backupDir !== "string") {
             return { kind: "blocked", reason: "remove-failed" };
           }
-          const settingsPath = path49.join(paths.codingAgentDir, "settings.json");
+          const settingsPath = path53.join(paths.codingAgentDir, "settings.json");
           return deactivateVerifiedPiRelease({
-            homeDir: input.targetDir === void 0 ? os6.homedir() : path49.resolve(input.targetDir),
+            homeDir: input.targetDir === void 0 ? os6.homedir() : path53.resolve(input.targetDir),
             agentDir: paths.codingAgentDir,
             receiptPath: paths.receiptPath,
             managedPackage: mp,
@@ -18222,33 +19327,33 @@ async function runPiRuntimeSystem(input) {
             verify: () => {
               let entryStat = null;
               try {
-                entryStat = fs41.lstatSync(mp.linkPath);
+                entryStat = fs45.lstatSync(mp.linkPath);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (entryStat !== null) throw new Error("managed entry still present after uninstall");
               let releaseStat = null;
               try {
-                releaseStat = fs41.lstatSync(mp.releaseDir);
+                releaseStat = fs45.lstatSync(mp.releaseDir);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (releaseStat !== null) throw new Error("managed release still present after uninstall");
               let receiptStat = null;
               try {
-                receiptStat = fs41.lstatSync(paths.receiptPath);
+                receiptStat = fs45.lstatSync(paths.receiptPath);
               } catch (error) {
                 if (error.code !== "ENOENT") throw error;
               }
               if (receiptStat !== null) throw new Error("receipt still present after uninstall");
-              if (fs41.readFileSync(settingsPath, "utf8") !== nextSettings) {
+              if (fs45.readFileSync(settingsPath, "utf8") !== nextSettings) {
                 throw new Error("settings mismatch after uninstall");
               }
             }
           });
         },
-        isPackageAbsent: () => !fs41.existsSync(packageRoot),
-        deleteReceipt: () => fs41.rmSync(paths.receiptPath, { force: true })
+        isPackageAbsent: () => !fs45.existsSync(packageRoot),
+        deleteReceipt: () => fs45.rmSync(paths.receiptPath, { force: true })
       }
     )
   };
@@ -18261,11 +19366,11 @@ init_pi();
 init_system_prompt_sections();
 
 // src/lib/pi-browser-contract.ts
-import fs42 from "fs";
-import path50 from "path";
+import fs46 from "fs";
+import path54 from "path";
 var CONTRACT_FILE = "browser-handoffs.v1.json";
 var MAX_CONTRACT_BYTES = 4 * 1024;
-function fail11(message) {
+function fail13(message) {
   throw new Error(`Pi browser handoff contract: ${message}`);
 }
 function validSchemas(value) {
@@ -18273,53 +19378,135 @@ function validSchemas(value) {
 }
 function requirePiBrowserHandoffSchemas(packageRoot, required) {
   if (required.playwright === void 0 && required.devtools === void 0) return;
-  if (typeof packageRoot !== "string" || !path50.isAbsolute(packageRoot)) fail11("package root is not absolute");
+  if (typeof packageRoot !== "string" || !path54.isAbsolute(packageRoot)) fail13("package root is not absolute");
   let realRoot;
   try {
-    realRoot = fs42.realpathSync(packageRoot);
-    if (!fs42.statSync(realRoot).isDirectory()) fail11("package root is not a directory");
+    realRoot = fs46.realpathSync(packageRoot);
+    if (!fs46.statSync(realRoot).isDirectory()) fail13("package root is not a directory");
   } catch {
-    fail11("installed Pi package root is unavailable");
+    fail13("installed Pi package root is unavailable");
   }
-  const contractDir = path50.join(realRoot, "contract");
-  const file = path50.join(contractDir, CONTRACT_FILE);
+  const contractDir = path54.join(realRoot, "contract");
+  const file = path54.join(contractDir, CONTRACT_FILE);
   let raw;
   try {
-    const dirStat = fs42.lstatSync(contractDir);
-    const stat = fs42.lstatSync(file);
-    if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || !stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_CONTRACT_BYTES) fail11("contract is not a bounded regular file");
-    if (fs42.realpathSync(file) !== file) fail11("contract path is not canonical");
-    raw = fs42.readFileSync(file);
+    const dirStat = fs46.lstatSync(contractDir);
+    const stat = fs46.lstatSync(file);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || !stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_CONTRACT_BYTES) fail13("contract is not a bounded regular file");
+    if (fs46.realpathSync(file) !== file) fail13("contract path is not canonical");
+    raw = fs46.readFileSync(file);
     if (raw.byteLength > MAX_CONTRACT_BYTES || !Buffer.from(raw.toString("utf8"), "utf8").equals(raw)) {
-      fail11("contract is not bounded UTF-8");
+      fail13("contract is not bounded UTF-8");
     }
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("Pi browser handoff contract: ")) throw error;
-    fail11("installed Pi does not provide a readable browser schema contract");
+    fail13("installed Pi does not provide a readable browser schema contract");
   }
   let contract;
   try {
     contract = JSON.parse(raw.toString("utf8"));
   } catch {
-    fail11("contract is invalid JSON");
+    fail13("contract is invalid JSON");
   }
-  if (contract === null || typeof contract !== "object" || Array.isArray(contract)) fail11("contract is invalid");
+  if (contract === null || typeof contract !== "object" || Array.isArray(contract)) fail13("contract is invalid");
   const record = contract;
   if (Object.keys(record).sort().join("\0") !== ["devtools", "playwright", "schemaVersion"].join("\0") || record.schemaVersion !== 1 || !validSchemas(record.playwright) || !validSchemas(record.devtools)) {
-    fail11("contract schema is invalid");
+    fail13("contract schema is invalid");
   }
   if (required.playwright !== void 0 && !record.playwright.includes(required.playwright)) {
-    fail11(`Playwright handoff schema ${required.playwright} is unsupported`);
+    fail13(`Playwright handoff schema ${required.playwright} is unsupported`);
   }
   if (required.devtools !== void 0 && !record.devtools.includes(required.devtools)) {
-    fail11(`DevTools handoff schema ${required.devtools} is unsupported`);
+    fail13(`DevTools handoff schema ${required.devtools} is unsupported`);
+  }
+}
+
+// src/lib/pi-browser-update.ts
+var PLAYWRIGHT_PACKAGE = "@playwright/cli";
+var BROWSER_INSTALL_TIMEOUT_MS = 6e5;
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function assertSuccessfulProcess(result, action) {
+  if (result.error !== void 0 || result.status !== 0) {
+    throw new Error(`Playwright ${action} failed${result.error === void 0 ? "" : `: ${result.error.message}`}`);
+  }
+}
+async function refreshPiPlaywright(input) {
+  const previous = loadVerifiedManagedBrowserReceipt(input.stateDir, PLAYWRIGHT_PACKAGE);
+  let activated;
+  let observed;
+  let capability;
+  try {
+    await prepareVerifiedBrowserRelease(PLAYWRIGHT_PACKAGE, {
+      fetchImpl: input.fetchImpl ?? globalThis.fetch,
+      withVerifiedArtifact: async (context) => {
+        activated = await activateVerifiedBrowserArtifact(context, {
+          stateDir: input.stateDir,
+          pnpmBin: input.pnpmBin,
+          fetchImpl: input.fetchImpl ?? globalThis.fetch
+        });
+        const browserInstall = runVerifiedManagedPlaywright(
+          input.stateDir,
+          ["install-browser", "chromium"],
+          { timeoutMs: BROWSER_INSTALL_TIMEOUT_MS }
+        );
+        assertSuccessfulProcess(browserInstall, "Chromium installation");
+        const versionProbe = runVerifiedManagedPlaywright(
+          input.stateDir,
+          ["--version"],
+          { captureOutput: true, timeoutMs: 5e3 }
+        );
+        assertSuccessfulProcess(versionProbe, "version probe");
+        const reportedVersion = (versionProbe.stdout ?? "").trim().replace(/^playwright-cli\s+/i, "");
+        if (reportedVersion !== context.release.version) {
+          throw new Error(
+            `Playwright version probe returned ${reportedVersion || "no version"}; expected ${context.release.version}`
+          );
+        }
+        const current = loadVerifiedManagedBrowserReceipt(input.stateDir, PLAYWRIGHT_PACKAGE);
+        if (current === null || current.version !== context.release.version || current.integrity !== context.release.integrity || current.rootPath !== activated.rootPath) {
+          throw new Error("Playwright managed receipt does not match the verified release");
+        }
+        const browserCache = isPlaywrightBrowserReady();
+        if (browserCache.status !== "ready" || !verifyManagedPlaywrightBrowser(input.stateDir)) {
+          throw new Error("Playwright Chromium smoke failed");
+        }
+        capability = {
+          cli: { status: "current", binPath: current.launcherPath, detectedVersion: context.release.version },
+          browserCache,
+          browserVerified: true,
+          effective: true
+        };
+        observed = {
+          version: context.release.version,
+          integrity: context.release.integrity
+        };
+      }
+    });
+    if (observed === void 0 || capability === void 0) {
+      throw new Error("Playwright verified release did not complete activation and smoke");
+    }
+    return { observed, capability };
+  } catch (error) {
+    if (activated !== void 0) {
+      try {
+        await rollbackManagedBrowserActivation(input.stateDir, PLAYWRIGHT_PACKAGE, activated, previous);
+      } catch (rollbackError) {
+        throw new Error(
+          `${errorMessage(error)}; Playwright rollback also failed: ${errorMessage(rollbackError)}`
+        );
+      }
+    }
+    throw error;
   }
 }
 
 // src/lib/pi-managed-runtime.ts
 init_paths();
-import fs43 from "fs";
-import path51 from "path";
+import fs47 from "fs";
+import os7 from "os";
+import path55 from "path";
 function projectionOperation(operation) {
   return operation === "update" ? "sync" : operation;
 }
@@ -18449,6 +19636,7 @@ async function runManagedPiSystem(input) {
     devtoolsMcpObservedVersion: injectedDevtoolsObserved,
     playwrightCliEnabled: explicitPlaywright,
     playwrightCapability,
+    playwrightRefresh,
     packageOnly,
     writingStyle: suppliedStyle,
     writingStyleMode,
@@ -18473,15 +19661,18 @@ async function runManagedPiSystem(input) {
   const style = readsStyle ? suppliedStyle ?? preparedStyle : void 0;
   const mode = readsStyle ? writingStyleMode ?? (input.targetDir === void 0 ? loadInstallModePreference().mode : "human") : "human";
   const writingStyle = style && mode === "programmatic" ? { ...style, content: null } : style;
-  const devtoolsMcpEnabled = explicitDevtools ?? (input.targetDir === void 0 && loadDevtoolsMcpPreference(devtoolsMcpPreferenceFile(), "pi"));
+  const persistedDevtools = explicitDevtools === void 0 && input.targetDir === void 0 && loadDevtoolsMcpPreference(devtoolsMcpPreferenceFile(), "pi");
+  const devtoolsMcpEnabled = explicitDevtools ?? persistedDevtools;
   const needsDevtoolsObservation = devtoolsMcpEnabled === true && input.operation !== "uninstall" && input.operation !== "models";
   let devtoolsMcpObservedVersion = null;
   let devtoolsVerifiedForPersist;
-  const devtoolsManagedStateDir = input.targetDir === void 0 ? dataDir() : path51.join(input.targetDir, "home", ".jorgex-stack");
+  const devtoolsManagedStateDir = input.targetDir === void 0 ? dataDir() : path55.join(input.targetDir, "home", ".jorgex-stack");
+  const deliberateBrowserOperation = input.targetDir === void 0 && (input.operation === "install" || input.operation === "update");
+  const devtoolsRefreshRequested = deliberateBrowserOperation && devtoolsMcpEnabled === true && explicitDevtools !== false;
   if (needsDevtoolsObservation) {
     if (input.targetDir !== void 0) {
       devtoolsMcpObservedVersion = isValidObservedVersion(injectedDevtoolsObserved) ? { version: injectedDevtoolsObserved.version, integrity: injectedDevtoolsObserved.integrity } : null;
-    } else if ((input.operation === "install" || input.operation === "update") && explicitDevtools === true) {
+    } else if (devtoolsRefreshRequested) {
       if (isValidObservedVersion(injectedDevtoolsObserved)) {
         devtoolsMcpObservedVersion = { version: injectedDevtoolsObserved.version, integrity: injectedDevtoolsObserved.integrity };
         devtoolsVerifiedForPersist = devtoolsMcpObservedVersion;
@@ -18496,7 +19687,8 @@ async function runManagedPiSystem(input) {
               await activateVerifiedBrowserArtifact(context, {
                 stateDir: devtoolsManagedStateDir,
                 pnpmBin,
-                fetchImpl: globalThis.fetch
+                fetchImpl: globalThis.fetch,
+                browserExecutablePath: detectChromiumExecutable()
               });
             }
           });
@@ -18525,8 +19717,8 @@ async function runManagedPiSystem(input) {
   if (needsDevtoolsObservation) {
     try {
       if (input.targetDir !== void 0) {
-        const target = fs43.lstatSync(input.targetDir);
-        const home = fs43.lstatSync(path51.join(input.targetDir, "home"));
+        const target = fs47.lstatSync(input.targetDir);
+        const home = fs47.lstatSync(path55.join(input.targetDir, "home"));
         if (!target.isDirectory() || target.isSymbolicLink() || !home.isDirectory() || home.isSymbolicLink()) {
           throw new Error("HOME del target Pi no es un directorio real aislado");
         }
@@ -18543,14 +19735,56 @@ async function runManagedPiSystem(input) {
       };
     }
   }
+  if (input.targetDir === void 0 && devtoolsVerifiedForPersist !== void 0) {
+    saveDevtoolsMcpPreference(
+      devtoolsMcpPreferenceFile(),
+      "pi",
+      loadDevtoolsMcpPreference(devtoolsMcpPreferenceFile(), "pi") === true,
+      devtoolsVerifiedForPersist
+    );
+  }
   const devtoolsMcpVersion = devtoolsMcpObservedVersion?.version ?? null;
   const supportsPlaywright = PI_RUNTIME_CANDIDATE.contract.capabilities.includes("playwright-handoff-v1");
   const persistedPlaywright = input.targetDir === void 0 && loadPlaywrightCliPreference(void 0, "pi") === true;
   const selectedPlaywright = explicitPlaywright ?? persistedPlaywright;
-  const playwrightCapabilityEffective = playwrightCapability?.effective === true;
+  let effectivePlaywrightCapability = playwrightCapability;
+  let refreshedPlaywright;
+  const skipPlaywrightRefresh = playwrightRefresh === false;
+  const injectedPlaywrightCapability = input.operation === "install" && explicitPlaywright === true && playwrightCapability?.effective === true;
+  if (deliberateBrowserOperation && input.operation === "install" && supportsPlaywright && explicitPlaywright === true && !skipPlaywrightRefresh && !injectedPlaywrightCapability) {
+    return { kind: "blocked", reason: "playwright-capability-unverified", remedy: "El opt-in nuevo de Playwright requiere la adquisici\xF3n y verificaci\xF3n del CLI antes de proyectarse en Pi." };
+  }
+  const playwrightRefreshRequested = deliberateBrowserOperation && supportsPlaywright && selectedPlaywright === true && !skipPlaywrightRefresh && !injectedPlaywrightCapability;
+  if (playwrightRefreshRequested) {
+    const pnpmBin = resolvePnpmBin();
+    if (pnpmBin === null) {
+      return {
+        kind: "blocked",
+        reason: "playwright-refresh-failed",
+        remedy: "pnpm no est\xE1 disponible para actualizar el Playwright gestionado de Pi; instala pnpm y reintenta."
+      };
+    }
+    try {
+      refreshedPlaywright = await refreshPiPlaywright({ stateDir: dataDir(), pnpmBin });
+      effectivePlaywrightCapability = refreshedPlaywright.capability;
+      savePlaywrightCliPreference(
+        playwrightCliPreferenceFile(),
+        true,
+        { pi: persistedPlaywright },
+        refreshedPlaywright.observed
+      );
+    } catch (error) {
+      return {
+        kind: "blocked",
+        reason: "playwright-refresh-failed",
+        remedy: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+  const playwrightCapabilityEffective = effectivePlaywrightCapability?.effective === true;
   const playwrightCliEnabled = input.targetDir === void 0 && supportsPlaywright && selectedPlaywright && playwrightCapabilityEffective;
   const playwrightManagedStateDir = playwrightCliEnabled && input.operation !== "uninstall" && input.operation !== "models" ? dataDir() : void 0;
-  const playwrightDispatcherPath = playwrightManagedStateDir === void 0 ? void 0 : path51.join(path51.dirname(stackRoot()), "dist", "browser-playwright.js");
+  const playwrightDispatcherPath = playwrightManagedStateDir === void 0 ? void 0 : path55.join(path55.dirname(stackRoot()), "dist", "browser-playwright.js");
   let effectivePackageSource = PI_RUNTIME_CANDIDATE.package.source;
   const projectionInput = {
     writingStyle,
@@ -18569,7 +19803,7 @@ async function runManagedPiSystem(input) {
     devtoolsMcpVersion
   };
   if (preparedStyle !== void 0 && input.operation !== "doctor") applyWritingStyle(preparedStyle);
-  const result = await runManagedPiOperation(input.operation, {
+  let result = await runManagedPiOperation(input.operation, {
     installInitRemedy: input.targetDir === void 0 ? void 0 : INSTALL_INIT_TARGET_REMEDY,
     async runPackage(operation) {
       const raw = await runPiRuntimeSystem({
@@ -18579,7 +19813,7 @@ async function runManagedPiSystem(input) {
         operation,
         ...upgradePermissions ? { upgradePermissions: true } : {}
       });
-      if (effectiveCandidate !== void 0 && (operation === "install" && raw.kind === "installed" || operation === "update" && raw.kind === "updated")) {
+      if (effectiveCandidate !== void 0 && ((operation === "install" || operation === "update") && (raw.kind === "installed" || raw.kind === "updated"))) {
         const expected = effectiveCandidate.package;
         const receipt = raw.receipt;
         const observed = receipt?.candidate?.package ?? receipt?.package;
@@ -18592,7 +19826,7 @@ async function runManagedPiSystem(input) {
         }
         effectivePackageSource = observed.source;
       }
-      if ((operation === "sync" && raw.kind === "synced" || operation === "doctor" && raw.kind === "healthy" || operation === "update" && raw.kind === "healthy") && "packageSource" in raw && raw.packageSource !== void 0) {
+      if ((operation === "sync" && raw.kind === "synced" || operation === "doctor" && raw.kind === "healthy" || (operation === "update" || operation === "install") && raw.kind === "healthy") && "packageSource" in raw && raw.packageSource !== void 0) {
         const provided = raw.packageSource;
         if (typeof provided !== "string" || !/^npm:jorgex-pi@((0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*))$/.test(provided)) {
           return {
@@ -18607,7 +19841,7 @@ async function runManagedPiSystem(input) {
     },
     runProjection(operation) {
       if (playwrightCliEnabled || devtoolsMcpEnabled) {
-        const packageRoot = path51.join(path51.dirname(piSystemPromptFile(input.targetDir)), "npm", "node_modules", "jorgex-pi");
+        const packageRoot = path55.join(path55.dirname(piSystemPromptFile(input.targetDir)), "npm", "node_modules", "jorgex-pi");
         try {
           requirePiBrowserHandoffSchemas(packageRoot, {
             ...playwrightCliEnabled ? { playwright: 2 } : {},
@@ -18640,15 +19874,38 @@ async function runManagedPiSystem(input) {
       return Promise.resolve(completePiProjectionUninstallSystem(token, { operation: "uninstall", ...projectionInput }));
     }
   });
-  if (input.targetDir === void 0 && explicitDevtools !== void 0 && (input.operation === "install" || input.operation === "sync" || input.operation === "update") && result.kind !== "blocked") {
-    if (explicitDevtools === true && devtoolsVerifiedForPersist !== void 0) {
+  if (input.targetDir === void 0 && (input.operation === "install" || input.operation === "update") && result.kind !== "blocked") {
+    try {
+      if (input.engramBin === null) throw new Error("Engram no disponible para verificar los providers Pi");
+      const providers = await updatePiProviderPackages({
+        homeDir: os7.homedir(),
+        agentDir: path55.dirname(piSystemPromptFile()),
+        piExecutable: input.detected.executable,
+        engramBin: input.engramBin
+      });
+      if (providers.kind === "updated" && result.kind === "healthy") result = { kind: "updated" };
+    } catch (error) {
+      return { kind: "blocked", reason: "provider-update-failed", remedy: `La fase principal de Pi termin\xF3, pero la actualizaci\xF3n de providers est\xE1 incompleta: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  }
+  if (input.targetDir === void 0 && (explicitDevtools !== void 0 || devtoolsVerifiedForPersist !== void 0) && (input.operation === "install" || input.operation === "sync" || input.operation === "update") && result.kind !== "blocked") {
+    if (devtoolsVerifiedForPersist !== void 0) {
       saveDevtoolsMcpPreference(devtoolsMcpPreferenceFile(), "pi", true, devtoolsVerifiedForPersist);
-    } else {
+    } else if (explicitDevtools !== void 0) {
       saveDevtoolsMcpPreference(devtoolsMcpPreferenceFile(), "pi", explicitDevtools);
     }
   }
-  if (input.targetDir === void 0 && supportsPlaywright && explicitPlaywright !== void 0 && (input.operation === "install" || input.operation === "sync") && result.kind !== "blocked") {
-    savePlaywrightCliPreference(playwrightCliPreferenceFile(), true, { pi: explicitPlaywright });
+  if (input.targetDir === void 0 && supportsPlaywright && (explicitPlaywright !== void 0 || refreshedPlaywright !== void 0) && (input.operation === "install" || input.operation === "sync" || input.operation === "update") && result.kind !== "blocked") {
+    if (refreshedPlaywright !== void 0) {
+      savePlaywrightCliPreference(
+        playwrightCliPreferenceFile(),
+        true,
+        { pi: true },
+        refreshedPlaywright.observed
+      );
+    } else {
+      savePlaywrightCliPreference(playwrightCliPreferenceFile(), true, { pi: explicitPlaywright ?? true });
+    }
   }
   return result;
 }
@@ -18660,7 +19917,7 @@ init_fsx();
 
 // src/lib/quality-runner.ts
 init_detect();
-import path52 from "path";
+import path56 from "path";
 import { spawn as spawn3, spawnSync as spawnSync6 } from "child_process";
 
 // src/lib/quality-policy.ts
@@ -18762,7 +20019,7 @@ var SENSITIVE_OUTPUT_PATTERN = /((?:authorization\s*:\s*bearer\s+|bearer\s+))[^\
 var SENSITIVE_KEY_VALUE_PATTERN = /((?:^|(?<=[^\w.-]))(?:-{0,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\r\n,;]+)/gi;
 var SENSITIVE_SEPARATE_FLAG_PATTERN = /((?:^|(?<=[^\w.-]))-{1,2}(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))[ \t]+)(?:"[^"]*"|'[^']*'|[^\r\n,;]+)/gi;
 var SENSITIVE_STRUCTURED_VALUE_PATTERN = /((?:"|')?(?:token|password|api[-_]?key|access[-_]?token|_?auth(?:orization)?(?:[-_.]?token)?|aws[-_]?secret[-_]?access[-_]?key|private[-_]?key)(?:"|')?\s*:\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')/gi;
-function isRecord15(value) {
+function isRecord16(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function hasOwn(value, key) {
@@ -18783,7 +20040,7 @@ function assertExactKeys(value, allowed, label) {
   }
 }
 function requireRecord(value, label) {
-  if (!isRecord15(value)) throw new Error(`Invalid ${label}`);
+  if (!isRecord16(value)) throw new Error(`Invalid ${label}`);
   return value;
 }
 function requireText(value, label) {
@@ -19141,7 +20398,7 @@ function normalizeTimeout(value) {
   return timeoutMs;
 }
 var COMMIT_SHA_PATTERN2 = /^[0-9a-f]{40}$/i;
-function isRecord16(value) {
+function isRecord17(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function hasText3(value) {
@@ -19161,14 +20418,14 @@ function isQualityProfile3(value) {
   return typeof value === "string" && QUALITY_PROFILES.includes(value);
 }
 function assertValidEnvironment(value, label) {
-  if (!isRecord16(value)) throw new Error(`Invalid ${label}`);
+  if (!isRecord17(value)) throw new Error(`Invalid ${label}`);
   for (const [key, entry] of Object.entries(value)) {
     if (typeof entry !== "string") throw new Error(`Invalid ${label}.${key}`);
   }
 }
 function assertQualityPlanInput(value) {
-  if (!isRecord16(value)) throw new Error("Invalid quality plan");
-  if (!isRecord16(value.identity)) throw new Error("Invalid quality plan identity");
+  if (!isRecord17(value)) throw new Error("Invalid quality plan");
+  if (!isRecord17(value.identity)) throw new Error("Invalid quality plan identity");
   if (typeof value.identity.baseSha !== "string" || !COMMIT_SHA_PATTERN2.test(value.identity.baseSha)) {
     throw new Error("Invalid quality plan identity.baseSha");
   }
@@ -19180,7 +20437,7 @@ function assertQualityPlanInput(value) {
   const controlIds = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.controls.length; index += 1) {
     const control = value.controls[index];
-    if (!isRecord16(control) || !hasText3(control.id) || control.requirement !== "required" && control.requirement !== "optional") {
+    if (!isRecord17(control) || !hasText3(control.id) || control.requirement !== "required" && control.requirement !== "optional") {
       throw new Error(`Invalid quality plan controls[${index}]`);
     }
     if (controlIds.has(control.id)) {
@@ -19196,7 +20453,7 @@ function assertQualityPlanInput(value) {
   const commandControlIds = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.commands.length; index += 1) {
     const command = value.commands[index];
-    if (!isRecord16(command)) throw new Error(`Invalid quality plan commands[${index}]`);
+    if (!isRecord17(command)) throw new Error(`Invalid quality plan commands[${index}]`);
     const timeoutMs = command.timeoutMs;
     if (!hasText3(command.controlId) || !hasText3(command.commandId) || !hasText3(command.executable) || !isDenseStringArray2(command.argv) || !isNonNegativeSafeInteger(timeoutMs)) {
       throw new Error(`Invalid quality plan commands[${index}]`);
@@ -19253,7 +20510,7 @@ function killProcessTree(child) {
   if (pid === void 0) return;
   if (process.platform === "win32") {
     const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
-    const taskkill = path52.join(systemRoot, "System32", "taskkill.exe");
+    const taskkill = path56.join(systemRoot, "System32", "taskkill.exe");
     const result = spawnSync6(taskkill, ["/pid", String(pid), "/t", "/f"], {
       shell: false,
       stdio: "ignore",
@@ -19499,9 +20756,9 @@ async function runQualityPlan(input) {
 }
 
 // src/lib/engram-install.ts
-import fs44 from "fs";
-import os7 from "os";
-import path53 from "path";
+import fs48 from "fs";
+import os8 from "os";
+import path57 from "path";
 import { execFileSync as execFileSync8 } from "child_process";
 import { createHash as createHash11 } from "crypto";
 var MAX_ENGRAM_ARCHIVE_BYTES = 64 * 1024 * 1024;
@@ -19509,17 +20766,17 @@ var STABLE_TAG = /^v\d+\.\d+\.\d+$/;
 var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 async function installMissingEngram(options = {}) {
   const platform = options.platform ?? process.platform;
-  const homeDir = options.homeDir ?? os7.homedir();
-  if (!path53.isAbsolute(homeDir)) return { ok: false, reason: "El directorio personal debe ser absoluto." };
+  const homeDir = options.homeDir ?? os8.homedir();
+  if (!path57.isAbsolute(homeDir)) return { ok: false, reason: "El directorio personal debe ser absoluto." };
   const binaryName = platform === "win32" ? "engram.exe" : "engram";
-  const bin = path53.join(homeDir, ".local", "bin", binaryName);
+  const bin = path57.join(homeDir, ".local", "bin", binaryName);
   let staging;
   let outcome;
   try {
-    const existing = fs44.lstatSync(bin, { throwIfNoEntry: false });
+    const existing = fs48.lstatSync(bin, { throwIfNoEntry: false });
     if (existing) {
-      if (!fs44.statSync(bin).isFile()) throw new Error(`El destino Engram no es un archivo: ${bin}`);
-      fs44.accessSync(bin, platform === "win32" ? fs44.constants.F_OK : fs44.constants.X_OK);
+      if (!fs48.statSync(bin).isFile()) throw new Error(`El destino Engram no es un archivo: ${bin}`);
+      fs48.accessSync(bin, platform === "win32" ? fs48.constants.F_OK : fs48.constants.X_OK);
       outcome = { ok: true, bin };
     } else {
       const fetchFn = options.fetch ?? globalThis.fetch;
@@ -19632,19 +20889,19 @@ async function installMissingEngram(options = {}) {
       if (size !== approvedSize || createHash11("sha256").update(archive).digest("hex") !== approvedSha) {
         throw new Error("Engram: tama\xF1o o hash SHA-256 no coincide con el artefacto aprobado.");
       }
-      fs44.mkdirSync(path53.dirname(bin), { recursive: true });
-      staging = fs44.mkdtempSync(path53.join(path53.dirname(bin), ".engram-install-"));
-      const archivePath = path53.join(staging, expectedName);
-      fs44.writeFileSync(archivePath, archive, { flag: "wx", mode: 384 });
+      fs48.mkdirSync(path57.dirname(bin), { recursive: true });
+      staging = fs48.mkdtempSync(path57.join(path57.dirname(bin), ".engram-install-"));
+      const archivePath = path57.join(staging, expectedName);
+      fs48.writeFileSync(archivePath, archive, { flag: "wx", mode: 384 });
       const binary = execFileSync8(resolveTarBin(), ["-xOf", archivePath, binaryName], {
         maxBuffer: 64 * 1024 * 1024,
         timeout: 3e4,
         stdio: ["ignore", "pipe", "pipe"]
       });
       if (binary.length === 0) throw new Error("El artefacto Engram no contiene un binario v\xE1lido.");
-      const stagedBin = path53.join(staging, binaryName);
-      fs44.writeFileSync(stagedBin, binary, { flag: "wx", mode: 493 });
-      fs44.linkSync(stagedBin, bin);
+      const stagedBin = path57.join(staging, binaryName);
+      fs48.writeFileSync(stagedBin, binary, { flag: "wx", mode: 493 });
+      fs48.linkSync(stagedBin, bin);
       outcome = { ok: true, bin };
     }
   } catch (error) {
@@ -19652,7 +20909,7 @@ async function installMissingEngram(options = {}) {
   }
   if (staging !== void 0) {
     try {
-      fs44.rmSync(staging, { recursive: true, force: true });
+      fs48.rmSync(staging, { recursive: true, force: true });
     } catch (cleanupError) {
       const cleanupMsg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
       if (outcome !== void 0 && outcome.ok) {
@@ -20087,6 +21344,7 @@ async function runSelectedPi(options) {
     ...devtoolsMcpEnabled === void 0 ? {} : { devtoolsMcpEnabled },
     ...playwrightCliEnabled === void 0 ? {} : { playwrightCliEnabled },
     ...playwrightCapability === void 0 ? {} : { playwrightCapability },
+    ...options.playwrightRefresh === void 0 ? {} : { playwrightRefresh: options.playwrightRefresh },
     ...(() => {
       if (options.upgradePermissions !== true) return {};
       const supports = PI_RUNTIME_CANDIDATE.contract.capabilities.includes("permissions-upgrade-v1");
@@ -20219,7 +21477,7 @@ Flags disponibles: jorgex-stack --help`
         return;
       }
       try {
-        const plan = JSON.parse(fs45.readFileSync(flags.positional[0], "utf8"));
+        const plan = JSON.parse(fs49.readFileSync(flags.positional[0], "utf8"));
         const result = await runQualityPlan(plan);
         const serialized = serializeQualityReceipt(result.receipt);
         if (flags.receipt === void 0) process.stdout.write(`${serialized}
@@ -20338,6 +21596,7 @@ Flags disponibles: jorgex-stack --help`
           } else {
             const piExitCode = await runSelectedPi({
               operation: command,
+              ...command === "install" && playwrightToolConsent.interactive && !flags.yes && flags.targetDir === void 0 && !playwrightToolConsent.confirmed ? { playwrightRefresh: false } : {},
               targetDir: flags.targetDir,
               yes: flags.yes,
               resolvedEngramBin: flags.targetDir === void 0 ? engramBin : void 0,
@@ -20345,7 +21604,7 @@ Flags disponibles: jorgex-stack --help`
               writingStyle,
               modePreference: mode,
               playwrightCliEnabled: flags.targetDir === void 0 && exitCode === 0 && playwrightToolPlan.actions.length > 0 ? playwrightToolConsent.runtimeSelection?.pi : void 0,
-              playwrightCapability: shouldInspectPlaywrightCapability(flags.targetDir, flags.dryRun) ? inspectManagedPlaywrightCapability() : void 0,
+              playwrightCapability: playwrightCapability ?? (shouldInspectPlaywrightCapability(flags.targetDir, flags.dryRun) ? inspectManagedPlaywrightCapability() : void 0),
               ...flags.upgradePermissions ? { upgradePermissions: true } : {}
             });
             exitCode = Math.max(exitCode, piExitCode);