kifaru 1.0.163 → 1.0.164

package/kifaru-pi.js

@@ -216,23 +216,23 @@ var require_auth_config = __commonJS((exports, module) => {
     writeAuthConfig: () => writeAuthConfig
   });
   module.exports = __toCommonJS(auth_config_exports);
-  var fs = __toESM2(__require("fs"));
-  var path = __toESM2(__require("path"));
+  var fs2 = __toESM2(__require("fs"));
+  var path2 = __toESM2(__require("path"));
   var import_token_util = require_token_util();
   function getAuthConfigPath() {
     const dataDir = (0, import_token_util.getVercelDataDir)();
     if (!dataDir) {
       throw new Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);
     }
-    return path.join(dataDir, "auth.json");
+    return path2.join(dataDir, "auth.json");
   }
   function readAuthConfig() {
     try {
       const authPath = getAuthConfigPath();
-      if (!fs.existsSync(authPath)) {
+      if (!fs2.existsSync(authPath)) {
         return null;
       }
-      const content = fs.readFileSync(authPath, "utf8");
+      const content = fs2.readFileSync(authPath, "utf8");
       if (!content) {
         return null;
       }
@@ -243,11 +243,11 @@ var require_auth_config = __commonJS((exports, module) => {
   }
   function writeAuthConfig(config2) {
     const authPath = getAuthConfigPath();
-    const authDir = path.dirname(authPath);
-    if (!fs.existsSync(authDir)) {
-      fs.mkdirSync(authDir, { mode: 504, recursive: true });
+    const authDir = path2.dirname(authPath);
+    if (!fs2.existsSync(authDir)) {
+      fs2.mkdirSync(authDir, { mode: 504, recursive: true });
     }
-    fs.writeFileSync(authPath, JSON.stringify(config2, null, 2), { mode: 384 });
+    fs2.writeFileSync(authPath, JSON.stringify(config2, null, 2), { mode: 384 });
   }
   function isValidAccessToken(authConfig, expirationBufferMs = 0) {
     if (!authConfig.token)
@@ -422,8 +422,8 @@ var require_token_util = __commonJS((exports, module) => {
     saveToken: () => saveToken
   });
   module.exports = __toCommonJS(token_util_exports);
-  var path = __toESM2(__require("path"));
-  var fs = __toESM2(__require("fs"));
+  var path2 = __toESM2(__require("path"));
+  var fs2 = __toESM2(__require("fs"));
   var import_token_error = require_token_error();
   var import_token_io = require_token_io();
   var import_auth_config = require_auth_config();
@@ -435,7 +435,7 @@ var require_token_util = __commonJS((exports, module) => {
     if (!dataDir) {
       return null;
     }
-    return path.join(dataDir, vercelFolder);
+    return path2.join(dataDir, vercelFolder);
   }
   async function getVercelToken2(options2) {
     const authConfig = (0, import_auth_config.readAuthConfig)();
@@ -503,11 +503,11 @@ var require_token_util = __commonJS((exports, module) => {
     if (!dir) {
       throw new import_token_error.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");
     }
-    const prjPath = path.join(dir, ".vercel", "project.json");
-    if (!fs.existsSync(prjPath)) {
+    const prjPath = path2.join(dir, ".vercel", "project.json");
+    if (!fs2.existsSync(prjPath)) {
       throw new import_token_error.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");
     }
-    const prj = JSON.parse(fs.readFileSync(prjPath, "utf8"));
+    const prj = JSON.parse(fs2.readFileSync(prjPath, "utf8"));
     if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
       throw new TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");
     }
@@ -518,11 +518,11 @@ var require_token_util = __commonJS((exports, module) => {
     if (!dir) {
       throw new import_token_error.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");
     }
-    const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
+    const tokenPath = path2.join(dir, "com.vercel.token", `${projectId}.json`);
     const tokenJson = JSON.stringify(token);
-    fs.mkdirSync(path.dirname(tokenPath), { mode: 504, recursive: true });
-    fs.writeFileSync(tokenPath, tokenJson);
-    fs.chmodSync(tokenPath, 432);
+    fs2.mkdirSync(path2.dirname(tokenPath), { mode: 504, recursive: true });
+    fs2.writeFileSync(tokenPath, tokenJson);
+    fs2.chmodSync(tokenPath, 432);
     return;
   }
   function loadToken(projectId) {
@@ -530,11 +530,11 @@ var require_token_util = __commonJS((exports, module) => {
     if (!dir) {
       throw new import_token_error.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");
     }
-    const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
-    if (!fs.existsSync(tokenPath)) {
+    const tokenPath = path2.join(dir, "com.vercel.token", `${projectId}.json`);
+    if (!fs2.existsSync(tokenPath)) {
       return null;
     }
-    const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
+    const token = JSON.parse(fs2.readFileSync(tokenPath, "utf8"));
     assertVercelOidcTokenResponse(token);
     return token;
   }
@@ -2191,16 +2191,16 @@ var require_src = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/xdg-basedir@5.1.0/node_modules/xdg-basedir/index.js
-import os from "os";
-import path from "path";
+import os2 from "os";
+import path2 from "path";
 var homeDirectory, env, xdgData, xdgConfig, xdgState, xdgCache, xdgRuntime, xdgDataDirectories, xdgConfigDirectories;
 var init_xdg_basedir = __esm(() => {
-  homeDirectory = os.homedir();
+  homeDirectory = os2.homedir();
   ({ env } = process);
-  xdgData = env.XDG_DATA_HOME || (homeDirectory ? path.join(homeDirectory, ".local", "share") : undefined);
-  xdgConfig = env.XDG_CONFIG_HOME || (homeDirectory ? path.join(homeDirectory, ".config") : undefined);
-  xdgState = env.XDG_STATE_HOME || (homeDirectory ? path.join(homeDirectory, ".local", "state") : undefined);
-  xdgCache = env.XDG_CACHE_HOME || (homeDirectory ? path.join(homeDirectory, ".cache") : undefined);
+  xdgData = env.XDG_DATA_HOME || (homeDirectory ? path2.join(homeDirectory, ".local", "share") : undefined);
+  xdgConfig = env.XDG_CONFIG_HOME || (homeDirectory ? path2.join(homeDirectory, ".config") : undefined);
+  xdgState = env.XDG_STATE_HOME || (homeDirectory ? path2.join(homeDirectory, ".local", "state") : undefined);
+  xdgCache = env.XDG_CACHE_HOME || (homeDirectory ? path2.join(homeDirectory, ".cache") : undefined);
   xdgRuntime = env.XDG_RUNTIME_DIR || undefined;
   xdgDataDirectories = (env.XDG_DATA_DIRS || "/usr/local/share/:/usr/share/").split(":");
   if (xdgData) {
@@ -2213,9 +2213,9 @@ var init_xdg_basedir = __esm(() => {
 });
 
 // ../opencode/src/global/index.ts
-import fs from "fs/promises";
-import path2 from "path";
-import os2 from "os";
+import fs2 from "fs/promises";
+import path3 from "path";
+import os3 from "os";
 function sanitizePath(p) {
   if (!p)
     return p;
@@ -2230,31 +2230,31 @@ var isSnap, realHome, primaryApp = "kifaru", legacyApp = "opencode", isWindows,
 var init_global = __esm(async () => {
   init_xdg_basedir();
   isSnap = process.env.HOME?.includes("/snap/");
-  realHome = isSnap ? process.env.XDG_CONFIG_HOME?.replace("/.config", "") || os2.homedir() : os2.homedir();
+  realHome = isSnap ? process.env.XDG_CONFIG_HOME?.replace("/.config", "") || os3.homedir() : os3.homedir();
   if (isSnap) {
     console.error(`[WARNING] Bun appears to be installed via Snap, which may cause file access issues.`);
     console.error(`[WARNING] If you experience errors, try installing Bun natively:`);
     console.error(`[WARNING]   sudo snap remove bun-js && curl -fsSL https://bun.sh/install | bash`);
   }
-  isWindows = os2.platform() === "win32";
-  appData = sanitizePath(process.env.APPDATA) || path2.join(os2.homedir(), "AppData", "Roaming");
-  localAppData = sanitizePath(process.env.LOCALAPPDATA) || path2.join(os2.homedir(), "AppData", "Local");
-  xdgDataFallback = sanitizePath(xdgData) || path2.join(realHome, ".local", "share");
-  xdgCacheFallback = sanitizePath(xdgCache) || path2.join(realHome, ".cache");
-  xdgConfigFallback = sanitizePath(xdgConfig) || path2.join(realHome, ".config");
-  xdgStateFallback = sanitizePath(xdgState) || path2.join(realHome, ".local", "state");
-  data = sanitizePath(isWindows ? path2.join(localAppData, primaryApp, "data") : path2.join(xdgDataFallback, primaryApp));
-  cache = sanitizePath(isWindows ? path2.join(localAppData, primaryApp, "cache") : path2.join(xdgCacheFallback, primaryApp));
-  config2 = sanitizePath(isWindows ? path2.join(appData, primaryApp, "config") : path2.join(xdgConfigFallback, primaryApp));
-  state = sanitizePath(isWindows ? path2.join(localAppData, primaryApp, "state") : path2.join(xdgStateFallback, primaryApp));
-  legacyData = sanitizePath(isWindows ? path2.join(localAppData, legacyApp, "data") : path2.join(xdgDataFallback, legacyApp));
-  legacyConfig = sanitizePath(isWindows ? path2.join(appData, legacyApp, "config") : path2.join(xdgConfigFallback, legacyApp));
+  isWindows = os3.platform() === "win32";
+  appData = sanitizePath(process.env.APPDATA) || path3.join(os3.homedir(), "AppData", "Roaming");
+  localAppData = sanitizePath(process.env.LOCALAPPDATA) || path3.join(os3.homedir(), "AppData", "Local");
+  xdgDataFallback = sanitizePath(xdgData) || path3.join(realHome, ".local", "share");
+  xdgCacheFallback = sanitizePath(xdgCache) || path3.join(realHome, ".cache");
+  xdgConfigFallback = sanitizePath(xdgConfig) || path3.join(realHome, ".config");
+  xdgStateFallback = sanitizePath(xdgState) || path3.join(realHome, ".local", "state");
+  data = sanitizePath(isWindows ? path3.join(localAppData, primaryApp, "data") : path3.join(xdgDataFallback, primaryApp));
+  cache = sanitizePath(isWindows ? path3.join(localAppData, primaryApp, "cache") : path3.join(xdgCacheFallback, primaryApp));
+  config2 = sanitizePath(isWindows ? path3.join(appData, primaryApp, "config") : path3.join(xdgConfigFallback, primaryApp));
+  state = sanitizePath(isWindows ? path3.join(localAppData, primaryApp, "state") : path3.join(xdgStateFallback, primaryApp));
+  legacyData = sanitizePath(isWindows ? path3.join(localAppData, legacyApp, "data") : path3.join(xdgDataFallback, legacyApp));
+  legacyConfig = sanitizePath(isWindows ? path3.join(appData, legacyApp, "config") : path3.join(xdgConfigFallback, legacyApp));
   ((Global) => {
     Global.Path = {
-      home: os2.homedir(),
+      home: os3.homedir(),
       data,
-      bin: path2.join(data, "bin"),
-      log: path2.join(data, "log"),
+      bin: path3.join(data, "bin"),
+      log: path3.join(data, "log"),
       cache,
       config: config2,
       state,
@@ -2274,29 +2274,29 @@ var init_global = __esm(async () => {
     console.warn(`[WARNING] XDG environment variables contain null bytes - they have been sanitized`);
   }
   await Promise.all([
-    fs.mkdir(Global.Path.data, { recursive: true }),
-    fs.mkdir(Global.Path.config, { recursive: true }),
-    fs.mkdir(Global.Path.state, { recursive: true }),
-    fs.mkdir(Global.Path.log, { recursive: true }),
-    fs.mkdir(Global.Path.bin, { recursive: true }),
-    fs.mkdir(Global.Path.cache, { recursive: true })
+    fs2.mkdir(Global.Path.data, { recursive: true }),
+    fs2.mkdir(Global.Path.config, { recursive: true }),
+    fs2.mkdir(Global.Path.state, { recursive: true }),
+    fs2.mkdir(Global.Path.log, { recursive: true }),
+    fs2.mkdir(Global.Path.bin, { recursive: true }),
+    fs2.mkdir(Global.Path.cache, { recursive: true })
   ]).catch((err) => {
     if (err.code !== "EEXIST") {
       console.error(`Warning: Could not create directories: ${err.message}`);
       console.error(`Try running: mkdir -p ~/.config/kifaru ~/.cache/kifaru`);
     }
   });
-  version2 = await Bun.file(path2.join(Global.Path.cache, "version")).text().catch(() => "0");
+  version2 = await Bun.file(path3.join(Global.Path.cache, "version")).text().catch(() => "0");
   if (version2 !== CACHE_VERSION) {
     try {
-      const contents = await fs.readdir(Global.Path.cache).catch(() => []);
-      await Promise.all(contents.map((item) => fs.rm(path2.join(Global.Path.cache, item), {
+      const contents = await fs2.readdir(Global.Path.cache).catch(() => []);
+      await Promise.all(contents.map((item) => fs2.rm(path3.join(Global.Path.cache, item), {
         recursive: true,
         force: true
       })));
     } catch (e) {}
-    await fs.mkdir(Global.Path.cache, { recursive: true }).catch(() => {});
-    await fs.writeFile(path2.join(Global.Path.cache, "version"), CACHE_VERSION).catch((err) => {
+    await fs2.mkdir(Global.Path.cache, { recursive: true }).catch(() => {});
+    await fs2.writeFile(path3.join(Global.Path.cache, "version"), CACHE_VERSION).catch((err) => {
       console.warn(`Warning: Could not write cache version file: ${err.message}`);
     });
   }
@@ -2538,10 +2538,10 @@ function mergeDefs2(...defs) {
 function cloneDef2(schema) {
   return mergeDefs2(schema._zod.def);
 }
-function getElementAtPath2(obj, path3) {
-  if (!path3)
+function getElementAtPath2(obj, path4) {
+  if (!path4)
     return obj;
-  return path3.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject2(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -2830,11 +2830,11 @@ function aborted2(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues2(path3, issues) {
+function prefixIssues2(path4, issues) {
   return issues.map((iss) => {
     var _a21;
     (_a21 = iss).path ?? (_a21.path = []);
-    iss.path.unshift(path3);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -3057,7 +3057,7 @@ function treeifyError2(error48, _mapper) {
     return issue3.message;
   };
   const result = { errors: [] };
-  const processError = (error49, path3 = []) => {
+  const processError = (error49, path4 = []) => {
     var _a21, _b16;
     for (const issue3 of error49.issues) {
       if (issue3.code === "invalid_union" && issue3.errors.length) {
@@ -3067,7 +3067,7 @@ function treeifyError2(error48, _mapper) {
       } else if (issue3.code === "invalid_element") {
         processError({ issues: issue3.issues }, issue3.path);
       } else {
-        const fullpath = [...path3, ...issue3.path];
+        const fullpath = [...path4, ...issue3.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue3));
           continue;
@@ -3099,8 +3099,8 @@ function treeifyError2(error48, _mapper) {
 }
 function toDotPath2(_path) {
   const segs = [];
-  const path3 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path3) {
+  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path4) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14952,8 +14952,8 @@ var init_zod = __esm(() => {
 });
 
 // ../opencode/src/auth/index.ts
-import path3 from "path";
-import fs2 from "fs/promises";
+import path4 from "path";
+import fs3 from "fs/promises";
 var Auth;
 var init_auth = __esm(async () => {
   init_zod();
@@ -14976,8 +14976,8 @@ var init_auth = __esm(async () => {
       token: zod_default.string()
     }).meta({ ref: "WellKnownAuth" });
     Auth.Info = zod_default.discriminatedUnion("type", [Auth.Oauth, Auth.Api, Auth.WellKnown]).meta({ ref: "Auth" });
-    const filepath = path3.join(Global.Path.data, "auth.json");
-    const legacyFilepath = path3.join(Global.Path.legacyData, "auth.json");
+    const filepath = path4.join(Global.Path.data, "auth.json");
+    const legacyFilepath = path4.join(Global.Path.legacyData, "auth.json");
     async function getFilepath() {
       const primaryExists = await Bun.file(filepath).exists();
       if (primaryExists)
@@ -15005,7 +15005,7 @@ var init_auth = __esm(async () => {
       const file3 = Bun.file(filepath);
       const data2 = await all();
       await Bun.write(file3, JSON.stringify({ ...data2, [key]: info }, null, 2));
-      await fs2.chmod(file3.name, 384);
+      await fs3.chmod(file3.name, 384);
     }
     Auth.set = set3;
     async function remove(key) {
@@ -15021,14 +15021,14 @@ var init_auth = __esm(async () => {
       const data2 = exists ? await file3.json().catch(() => ({})) : {};
       delete data2[key];
       await Bun.write(file3, JSON.stringify(data2, null, 2));
-      await fs2.chmod(file3.name, 384);
+      await fs3.chmod(file3.name, 384);
     }
   })(Auth ||= {});
 });
 
 // ../opencode/src/util/log.ts
-import path4 from "path";
-import fs3 from "fs/promises";
+import path5 from "path";
+import fs4 from "fs/promises";
 import { inspect } from "util";
 var Log2;
 var init_log = __esm(async () => {
@@ -15088,9 +15088,9 @@ var init_log = __esm(async () => {
         await flushPending();
         return;
       }
-      logpath = path4.join(Global.Path.log, options2.dev ? "dev.log" : new Date().toISOString().split(".")[0].replace(/:/g, "") + ".log");
+      logpath = path5.join(Global.Path.log, options2.dev ? "dev.log" : new Date().toISOString().split(".")[0].replace(/:/g, "") + ".log");
       const logfile = Bun.file(logpath);
-      await fs3.truncate(logpath).catch(() => {});
+      await fs4.truncate(logpath).catch(() => {});
       const writer = logfile.writer();
       write = async (msg) => {
         const num = writer.write(msg);
@@ -15109,7 +15109,7 @@ var init_log = __esm(async () => {
       if (files.length <= 5)
         return;
       const filesToDelete = files.slice(0, -10);
-      await Promise.all(filesToDelete.map((file4) => fs3.unlink(file4).catch(() => {})));
+      await Promise.all(filesToDelete.map((file4) => fs4.unlink(file4).catch(() => {})));
     }
     function formatError3(error92, depth = 0) {
       const result = error92.message;
@@ -15398,12 +15398,12 @@ var init_log = __esm(async () => {
 });
 
 // ../opencode/src/util/filesystem.ts
-import fs4 from "fs/promises";
+import fs5 from "fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve as resolve2 } from "path";
 var Filesystem;
 var init_filesystem = __esm(() => {
   ((Filesystem) => {
-    const exists = (file3) => fs4.stat(file3).then(() => true).catch(() => false);
+    const exists = (file3) => fs5.stat(file3).then(() => true).catch(() => false);
     function overlaps(a, b) {
       const relA = relative(a, b);
       const relB = relative(b, a);
@@ -15421,13 +15421,13 @@ var init_filesystem = __esm(() => {
       const suffix = [];
       while (true) {
         try {
-          const real = await fs4.realpath(current);
+          const real = await fs5.realpath(current);
           return suffix.length > 0 ? join(real, ...suffix.reverse()) : real;
         } catch {
           try {
-            const stat = await fs4.lstat(current);
+            const stat = await fs5.lstat(current);
             if (stat.isSymbolicLink()) {
-              const link = await fs4.readlink(current);
+              const link = await fs5.readlink(current);
               const linked = resolve2(dirname(current), link);
               const real = await resolveForContainment(linked);
               return suffix.length > 0 ? join(real, ...suffix.reverse()) : real;
@@ -15688,8 +15688,8 @@ var init_lock = __esm(() => {
 });
 
 // ../opencode/src/storage/storage.ts
-import path5 from "path";
-import fs5 from "fs/promises";
+import path6 from "path";
+import fs6 from "fs/promises";
 var {$ } = globalThis.Bun;
 var Storage;
 var init_storage = __esm(async () => {
@@ -15702,13 +15702,13 @@ var init_storage = __esm(async () => {
   ]);
   ((Storage) => {
     const log2 = Log2.create({ service: "storage" });
-    const exists = (file3) => fs5.stat(file3).then(() => true).catch(() => false);
+    const exists = (file3) => fs6.stat(file3).then(() => true).catch(() => false);
     Storage.NotFoundError = NamedError.create("NotFoundError", zod_default.object({
       message: zod_default.string()
     }));
     const MIGRATIONS = [
       async (dir) => {
-        const project = path5.resolve(dir, "../project");
+        const project = path6.resolve(dir, "../project");
         if (!await exists(project))
           return;
         for await (const projectDir of new Bun.Glob("*").scan({
@@ -15717,11 +15717,11 @@ var init_storage = __esm(async () => {
         })) {
           log2.info(`migrating project ${projectDir}`);
           let projectID = projectDir;
-          const fullProjectDir = path5.join(project, projectDir);
+          const fullProjectDir = path6.join(project, projectDir);
           let worktree = "/";
           if (projectID !== "global") {
             for await (const msgFile of new Bun.Glob("storage/session/message/*/*.json").scan({
-              cwd: path5.join(project, projectDir),
+              cwd: path6.join(project, projectDir),
               absolute: true
             })) {
               const json4 = await Bun.file(msgFile).json();
@@ -15738,7 +15738,7 @@ var init_storage = __esm(async () => {
             if (!id)
               continue;
             projectID = id;
-            await Bun.write(path5.join(dir, "project", projectID + ".json"), JSON.stringify({
+            await Bun.write(path6.join(dir, "project", projectID + ".json"), JSON.stringify({
               id,
               vcs: "git",
               worktree,
@@ -15752,7 +15752,7 @@ var init_storage = __esm(async () => {
               cwd: fullProjectDir,
               absolute: true
             })) {
-              const dest = path5.join(dir, "session", projectID, path5.basename(sessionFile));
+              const dest = path6.join(dir, "session", projectID, path6.basename(sessionFile));
               log2.info("copying", {
                 sessionFile,
                 dest
@@ -15764,7 +15764,7 @@ var init_storage = __esm(async () => {
                 cwd: fullProjectDir,
                 absolute: true
               })) {
-                const dest2 = path5.join(dir, "message", session.id, path5.basename(msgFile));
+                const dest2 = path6.join(dir, "message", session.id, path6.basename(msgFile));
                 log2.info("copying", {
                   msgFile,
                   dest: dest2
@@ -15776,7 +15776,7 @@ var init_storage = __esm(async () => {
                   cwd: fullProjectDir,
                   absolute: true
                 })) {
-                  const dest3 = path5.join(dir, "part", message.id, path5.basename(partFile));
+                  const dest3 = path6.join(dir, "part", message.id, path6.basename(partFile));
                   const part = await Bun.file(partFile).json();
                   log2.info("copying", {
                     partFile,
@@ -15800,8 +15800,8 @@ var init_storage = __esm(async () => {
           if (!session.summary?.diffs)
             continue;
           const { diffs } = session.summary;
-          await Bun.file(path5.join(dir, "session_diff", session.id + ".json")).write(JSON.stringify(diffs));
-          await Bun.file(path5.join(dir, "session", session.projectID, session.id + ".json")).write(JSON.stringify({
+          await Bun.file(path6.join(dir, "session_diff", session.id + ".json")).write(JSON.stringify(diffs));
+          await Bun.file(path6.join(dir, "session", session.projectID, session.id + ".json")).write(JSON.stringify({
             ...session,
             summary: {
               additions: diffs.reduce((sum, x) => sum + x.additions, 0),
@@ -15812,14 +15812,14 @@ var init_storage = __esm(async () => {
       }
     ];
     const state2 = lazy3(async () => {
-      const dir = path5.join(Global.Path.data, "storage");
-      await fs5.mkdir(dir, { recursive: true });
-      const migration = await Bun.file(path5.join(dir, "migration")).json().then((x) => parseInt(x)).catch(() => 0);
+      const dir = path6.join(Global.Path.data, "storage");
+      await fs6.mkdir(dir, { recursive: true });
+      const migration = await Bun.file(path6.join(dir, "migration")).json().then((x) => parseInt(x)).catch(() => 0);
       for (let index = migration;index < MIGRATIONS.length; index++) {
         log2.info("running migration", { index });
         const migration2 = MIGRATIONS[index];
         await migration2(dir).catch(() => log2.error("failed to run migration", { index }));
-        await Bun.write(path5.join(dir, "migration"), (index + 1).toString());
+        await Bun.write(path6.join(dir, "migration"), (index + 1).toString());
       }
       return {
         dir
@@ -15827,9 +15827,9 @@ var init_storage = __esm(async () => {
     });
     async function remove(key) {
       const dir = await state2().then((x) => x.dir);
-      const target = path5.join(dir, ...key) + ".json";
+      const target = path6.join(dir, ...key) + ".json";
       return withErrorHandling(async () => {
-        await fs5.unlink(target).catch(() => {});
+        await fs6.unlink(target).catch(() => {});
       });
     }
     Storage.remove = remove;
@@ -15839,7 +15839,7 @@ var init_storage = __esm(async () => {
     Storage.delete_ = delete_;
     async function read(key) {
       const dir = await state2().then((x) => x.dir);
-      const target = path5.join(dir, ...key) + ".json";
+      const target = path6.join(dir, ...key) + ".json";
       return withErrorHandling(async () => {
         using _ = await Lock.read(target);
         const result = await Bun.file(target).json();
@@ -15849,9 +15849,9 @@ var init_storage = __esm(async () => {
     Storage.read = read;
     async function update(key, fn) {
       const dir = await state2().then((x) => x.dir);
-      const target = path5.join(dir, ...key) + ".json";
+      const target = path6.join(dir, ...key) + ".json";
       return withErrorHandling(async () => {
-        await fs5.mkdir(path5.dirname(target), { recursive: true });
+        await fs6.mkdir(path6.dirname(target), { recursive: true });
         using _ = await Lock.write(target);
         const content = await Bun.file(target).json();
         fn(content);
@@ -15862,9 +15862,9 @@ var init_storage = __esm(async () => {
     Storage.update = update;
     async function write(key, content) {
       const dir = await state2().then((x) => x.dir);
-      const target = path5.join(dir, ...key) + ".json";
+      const target = path6.join(dir, ...key) + ".json";
       return withErrorHandling(async () => {
-        await fs5.mkdir(path5.dirname(target), { recursive: true });
+        await fs6.mkdir(path6.dirname(target), { recursive: true });
         using _ = await Lock.write(target);
         await Bun.write(target, JSON.stringify(content, null, 2));
       });
@@ -15886,9 +15886,9 @@ var init_storage = __esm(async () => {
       const dir = await state2().then((x) => x.dir);
       try {
         const result = await Array.fromAsync(glob.scan({
-          cwd: path5.join(dir, ...prefix),
+          cwd: path6.join(dir, ...prefix),
           onlyFiles: true
-        })).then((results) => results.map((x) => [...prefix, ...x.slice(0, -5).split(path5.sep)]));
+        })).then((results) => results.map((x) => [...prefix, ...x.slice(0, -5).split(path6.sep)]));
         result.sort();
         return result;
       } catch {
@@ -15936,7 +15936,7 @@ var init_flag = __esm(() => {
 });
 
 // ../opencode/src/project/project.ts
-import path6 from "path";
+import path7 from "path";
 var {$: $2 } = globalThis.Bun;
 var Project;
 var init_project = __esm(async () => {
@@ -15977,15 +15977,15 @@ var init_project = __esm(async () => {
         await Storage.write(["project", "global"], project2);
         return project2;
       }
-      let worktree = path6.dirname(git);
+      let worktree = path7.dirname(git);
       const timer = log2.time("git.rev-parse");
-      let id = await Bun.file(path6.join(git, "opencode")).text().then((x) => x.trim()).catch(() => {});
+      let id = await Bun.file(path7.join(git, "opencode")).text().then((x) => x.trim()).catch(() => {});
       if (!id) {
         const roots = await $2`git rev-list --max-parents=0 --all`.quiet().nothrow().cwd(worktree).text().then((x) => x.split(`
 `).filter(Boolean).map((x2) => x2.trim()).toSorted());
         id = roots[0];
         if (id)
-          Bun.file(path6.join(git, "opencode")).write(id);
+          Bun.file(path7.join(git, "opencode")).write(id);
       }
       timer.stop();
       if (!id) {
@@ -16308,7 +16308,7 @@ var init_bus = __esm(async () => {
 });
 
 // ../opencode/src/installation/index.ts
-import path7 from "path";
+import path8 from "path";
 var {$: $3 } = globalThis.Bun;
 function hasManagedInstall(output, method) {
   if (method === "brew")
@@ -16361,9 +16361,9 @@ var init_installation = __esm(async () => {
     }
     Installation.isLocal = isLocal;
     async function method() {
-      if (installPaths.some((item) => process.execPath.includes(path7.join(item, "bin"))))
+      if (installPaths.some((item) => process.execPath.includes(path8.join(item, "bin"))))
         return "curl";
-      if (process.execPath.includes(path7.join(".local", "bin")))
+      if (process.execPath.includes(path8.join(".local", "bin")))
         return "curl";
       const exec = process.execPath.toLowerCase();
       const checks5 = [
@@ -16476,7 +16476,7 @@ var init_installation = __esm(async () => {
         });
     }
     Installation.upgrade = upgrade;
-    Installation.VERSION = "1.0.163";
+    Installation.VERSION = "1.0.164";
     Installation.CHANNEL = typeof KIFARU_CHANNEL === "string" ? KIFARU_CHANNEL : "local";
     Installation.USER_AGENT = `kifaru/${Installation.CHANNEL}/${Installation.VERSION}`;
     async function latest() {
@@ -16498,7 +16498,7 @@ var init_installation = __esm(async () => {
 });
 
 // ../opencode/src/provider/models.ts
-import path8 from "path";
+import path9 from "path";
 var ModelsDev;
 var init_models = __esm(async () => {
   init_zod();
@@ -16509,7 +16509,7 @@ var init_models = __esm(async () => {
   ]);
   ((ModelsDev) => {
     const log2 = Log2.create({ service: "models.dev" });
-    const filepath = path8.join(Global.Path.cache, "models.json");
+    const filepath = path9.join(Global.Path.cache, "models.json");
     let cached3;
     let loading;
     let timer;
@@ -16571,9 +16571,9 @@ var init_models = __esm(async () => {
       const value = process.env.MODELS_DEV_API_JSON;
       if (!value)
         return;
-      if (path8.isAbsolute(value))
+      if (path9.isAbsolute(value))
         return value;
-      return path8.resolve(process.cwd(), value);
+      return path9.resolve(process.cwd(), value);
     }
     async function readFile(file3) {
       return file3.json().catch(() => {
@@ -17625,7 +17625,7 @@ var init_main = __esm(() => {
 });
 
 // ../opencode/src/bun/index.ts
-import path9 from "path";
+import path10 from "path";
 var {readableStreamToText } = globalThis.Bun;
 import { createRequire } from "module";
 var BunProc;
@@ -17679,8 +17679,8 @@ var init_bun = __esm(async () => {
     }));
     async function install(pkg, version4 = "latest") {
       using _2 = await Lock.write("bun-install");
-      const mod = path9.join(Global.Path.cache, "node_modules", pkg);
-      const pkgjson = Bun.file(path9.join(Global.Path.cache, "package.json"));
+      const mod = path10.join(Global.Path.cache, "node_modules", pkg);
+      const pkgjson = Bun.file(path10.join(Global.Path.cache, "package.json"));
       const parsed = await pkgjson.json().catch(async () => {
         const result = { dependencies: {} };
         await Bun.write(pkgjson.name, JSON.stringify(result, null, 2));
@@ -17738,20 +17738,20 @@ var init_bun = __esm(async () => {
       const local = workspace(pkg);
       if (local)
         return local;
-      const dir = path9.join(Global.Path.cache, "node_modules", pkg);
-      const pkgjson = Bun.file(path9.join(dir, "package.json"));
+      const dir = path10.join(Global.Path.cache, "node_modules", pkg);
+      const pkgjson = Bun.file(path10.join(dir, "package.json"));
       const exists = await pkgjson.exists();
       if (exists)
         return dir;
     }
     BunProc.resolve = resolve3;
     function workspace(pkg) {
-      const isBinary = !path9.basename(process.execPath).startsWith("bun");
+      const isBinary = !path10.basename(process.execPath).startsWith("bun");
       if (isBinary)
         return;
       try {
         const target = req.resolve(`${pkg}/package.json`);
-        return path9.dirname(target);
+        return path10.dirname(target);
       } catch {
         return;
       }
@@ -17761,9 +17761,9 @@ var init_bun = __esm(async () => {
 
 // ../opencode/src/runtime/python.ts
 import { createHash } from "crypto";
-import fs6 from "fs/promises";
+import fs7 from "fs/promises";
 import { accessSync, constants as fsConstants } from "fs";
-import path10 from "path";
+import path11 from "path";
 var PythonRuntime;
 var init_python = __esm(async () => {
   await __promiseAll([
@@ -17870,16 +17870,16 @@ var init_python = __esm(async () => {
           return { exitCode, stdout, stderr };
         },
         fileExists(filepath) {
-          return fs6.stat(filepath).then(() => true).catch(() => false);
+          return fs7.stat(filepath).then(() => true).catch(() => false);
         },
         readFile(filepath) {
-          return fs6.readFile(filepath, "utf8");
+          return fs7.readFile(filepath, "utf8");
         },
         writeFile(filepath, content) {
-          return fs6.writeFile(filepath, content);
+          return fs7.writeFile(filepath, content);
         },
         mkdir(filepath) {
-          return fs6.mkdir(filepath, { recursive: true }).then(() => {
+          return fs7.mkdir(filepath, { recursive: true }).then(() => {
             return;
           });
         },
@@ -17932,37 +17932,37 @@ var init_python = __esm(async () => {
     }
     PythonRuntime.lockHash = lockHash;
     function managedRoot(dataDir = Global.Path.data) {
-      return path10.join(dataDir, "python");
+      return path11.join(dataDir, "python");
     }
     PythonRuntime.managedRoot = managedRoot;
     function managedVenvPath(profile, dataDir = Global.Path.data) {
-      return path10.join(managedRoot(dataDir), profile);
+      return path11.join(managedRoot(dataDir), profile);
     }
     PythonRuntime.managedVenvPath = managedVenvPath;
     function venvBinDir(venvPath, platform = process.platform) {
-      return platform === "win32" ? path10.join(venvPath, "Scripts") : path10.join(venvPath, "bin");
+      return platform === "win32" ? path11.join(venvPath, "Scripts") : path11.join(venvPath, "bin");
     }
     PythonRuntime.venvBinDir = venvBinDir;
     function venvPythonPath(venvPath, platform = process.platform) {
-      return platform === "win32" ? path10.join(venvPath, "Scripts", "python.exe") : path10.join(venvPath, "bin", "python");
+      return platform === "win32" ? path11.join(venvPath, "Scripts", "python.exe") : path11.join(venvPath, "bin", "python");
     }
     PythonRuntime.venvPythonPath = venvPythonPath;
     function stampPath(profile, dataDir = Global.Path.data) {
-      return path10.join(managedVenvPath(profile, dataDir), ".kifaru-python.json");
+      return path11.join(managedVenvPath(profile, dataDir), ".kifaru-python.json");
     }
     PythonRuntime.stampPath = stampPath;
     function prependPathOnce(env2, dir) {
       const next = { ...env2 };
-      const parts = (next.PATH ?? "").split(path10.delimiter).filter(Boolean);
-      next.PATH = [dir, ...parts.filter((part) => part !== dir)].join(path10.delimiter);
+      const parts = (next.PATH ?? "").split(path11.delimiter).filter(Boolean);
+      next.PATH = [dir, ...parts.filter((part) => part !== dir)].join(path11.delimiter);
       return next;
     }
     PythonRuntime.prependPathOnce = prependPathOnce;
     function candidateVenvs(cwd, env2 = process.env) {
       return [
         { source: "active_venv", path: env2["VIRTUAL_ENV"] },
-        { source: "workspace_dotvenv", path: path10.join(cwd, ".venv") },
-        { source: "workspace_venv", path: path10.join(cwd, "venv") }
+        { source: "workspace_dotvenv", path: path11.join(cwd, ".venv") },
+        { source: "workspace_venv", path: path11.join(cwd, "venv") }
       ].filter((item) => Boolean(item.path));
     }
     PythonRuntime.candidateVenvs = candidateVenvs;
@@ -17989,11 +17989,11 @@ var init_python = __esm(async () => {
       }
       if (settings.explicitPythonBin) {
         const selected = settings.explicitPythonBin;
-        if (!path10.isAbsolute(selected)) {
+        if (!path11.isAbsolute(selected)) {
           return {
             ...base,
             selectedPython: selected,
-            selectedBinDir: path10.dirname(selected),
+            selectedBinDir: path11.dirname(selected),
             source: "explicit",
             projectVenvActive: false,
             available: false,
@@ -18003,7 +18003,7 @@ var init_python = __esm(async () => {
         return {
           ...base,
           selectedPython: selected,
-          selectedBinDir: path10.dirname(selected),
+          selectedBinDir: path11.dirname(selected),
           source: "explicit",
           projectVenvActive: false,
           available: await deps2.fileExists(selected)
@@ -18040,7 +18040,7 @@ var init_python = __esm(async () => {
       return {
         ...base,
         selectedPython: system,
-        selectedBinDir: system ? path10.dirname(system) : undefined,
+        selectedBinDir: system ? path11.dirname(system) : undefined,
         source: system ? "system" : "missing",
         projectVenvActive: false,
         available: Boolean(system)
@@ -18060,8 +18060,8 @@ var init_python = __esm(async () => {
         if (!dirs.includes(dir))
           dirs.push(dir);
       };
-      if (settings.explicitPythonBin && path10.isAbsolute(settings.explicitPythonBin)) {
-        add(path10.dirname(settings.explicitPythonBin));
+      if (settings.explicitPythonBin && path11.isAbsolute(settings.explicitPythonBin)) {
+        add(path11.dirname(settings.explicitPythonBin));
       }
       for (const candidate of candidateVenvs(input.cwd, env2)) {
         if (await deps2.fileExists(venvPythonPath(candidate.path, deps2.platform))) {
@@ -18249,7 +18249,7 @@ var init_python = __esm(async () => {
       }
       const installer = uv ? "uv" : "venv-pip";
       try {
-        await deps2.mkdir(path10.dirname(paths.venvPath));
+        await deps2.mkdir(path11.dirname(paths.venvPath));
         await deps2.writeFile(paths.lockPath, requirementsLock(settings.profile));
         if (uv) {
           if (needsVenv) {
@@ -18349,7 +18349,7 @@ ${result.stderr}`.trim();
       }
     }
     async function writeStamp(filepath, stamp, deps2) {
-      await deps2.mkdir(path10.dirname(filepath));
+      await deps2.mkdir(path11.dirname(filepath));
       await deps2.writeFile(filepath, JSON.stringify(stamp, null, 2) + `
 `);
     }
@@ -18360,7 +18360,7 @@ ${result.stderr}`.trim();
         binDir: venvBinDir(venvPath, platform),
         pythonPath: venvPythonPath(venvPath, platform),
         stampPath: stampPath(profile, dataDir),
-        lockPath: path10.join(managedRoot(dataDir), `${profile}.requirements.lock`)
+        lockPath: path11.join(managedRoot(dataDir), `${profile}.requirements.lock`)
       };
     }
     function whichInEnvironment(name21, env2, platform) {
@@ -18369,10 +18369,10 @@ ${result.stderr}`.trim();
       if (!pathValue)
         return Bun.which(name21);
       const extensions = platform === "win32" ? (env2.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean) : [""];
-      const hasExtension = platform === "win32" && path10.win32.extname(name21).length > 0;
+      const hasExtension = platform === "win32" && path11.win32.extname(name21).length > 0;
       for (const dir of pathValue.split(separator).filter(Boolean)) {
         for (const extension of hasExtension ? [""] : extensions) {
-          const candidate = platform === "win32" ? path10.win32.join(dir, name21 + extension.toLowerCase()) : path10.join(dir, name21);
+          const candidate = platform === "win32" ? path11.win32.join(dir, name21 + extension.toLowerCase()) : path11.join(dir, name21);
           try {
             accessSync(candidate, fsConstants.X_OK);
             return candidate;
@@ -18402,10 +18402,10 @@ ${result.stderr}`.trim();
 
 // ../opencode/src/lsp/server.ts
 import { spawn } from "child_process";
-import path11 from "path";
-import os3 from "os";
+import path12 from "path";
+import os4 from "os";
 var {$: $5 } = globalThis.Bun;
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 var LSPServer;
 var init_server = __esm(async () => {
   init_filesystem();
@@ -18419,13 +18419,13 @@ var init_server = __esm(async () => {
   ]);
   ((LSPServer) => {
     const log2 = Log2.create({ service: "lsp.server" });
-    const exists = (file3) => fs7.stat(file3).then(() => true).catch(() => false);
+    const exists = (file3) => fs8.stat(file3).then(() => true).catch(() => false);
     const NearestRoot = (includePatterns, excludePatterns) => {
       return async (file3) => {
         if (excludePatterns) {
           const excludedFiles = Filesystem.up({
             targets: excludePatterns,
-            start: path11.dirname(file3),
+            start: path12.dirname(file3),
             stop: Instance.directory
           });
           const excluded = await excludedFiles.next();
@@ -18435,14 +18435,14 @@ var init_server = __esm(async () => {
         }
         const files = Filesystem.up({
           targets: includePatterns,
-          start: path11.dirname(file3),
+          start: path12.dirname(file3),
           stop: Instance.directory
         });
         const first = await files.next();
         await files.return();
         if (!first.value)
           return Instance.directory;
-        return path11.dirname(first.value);
+        return path12.dirname(first.value);
       };
     };
     LSPServer.Deno = {
@@ -18450,14 +18450,14 @@ var init_server = __esm(async () => {
       root: async (file3) => {
         const files = Filesystem.up({
           targets: ["deno.json", "deno.jsonc"],
-          start: path11.dirname(file3),
+          start: path12.dirname(file3),
           stop: Instance.directory
         });
         const first = await files.next();
         await files.return();
         if (!first.value)
           return;
-        return path11.dirname(first.value);
+        return path12.dirname(first.value);
       },
       extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs"],
       async spawn(root) {
@@ -18506,7 +18506,7 @@ var init_server = __esm(async () => {
         let binary = Bun.which("vue-language-server");
         const args = [];
         if (!binary) {
-          const js = path11.join(Global.Path.bin, "node_modules", "@vue", "language-server", "bin", "vue-language-server.js");
+          const js = path12.join(Global.Path.bin, "node_modules", "@vue", "language-server", "bin", "vue-language-server.js");
           if (!await Bun.file(js).exists()) {
             if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
               return;
@@ -18547,7 +18547,7 @@ var init_server = __esm(async () => {
         if (!eslint)
           return;
         log2.info("spawning eslint server");
-        const serverPath = path11.join(Global.Path.bin, "vscode-eslint", "server", "out", "eslintServer.js");
+        const serverPath = path12.join(Global.Path.bin, "vscode-eslint", "server", "out", "eslintServer.js");
         if (!await Bun.file(serverPath).exists()) {
           if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
             return;
@@ -18555,20 +18555,20 @@ var init_server = __esm(async () => {
           const response = await fetch("https://github.com/microsoft/vscode-eslint/archive/refs/heads/main.zip");
           if (!response.ok)
             return;
-          const zipPath = path11.join(Global.Path.bin, "vscode-eslint.zip");
+          const zipPath = path12.join(Global.Path.bin, "vscode-eslint.zip");
           await Bun.file(zipPath).write(response);
           await $5`unzip -o -q ${zipPath}`.quiet().cwd(Global.Path.bin).nothrow();
-          await fs7.rm(zipPath, { force: true });
-          const extractedPath = path11.join(Global.Path.bin, "vscode-eslint-main");
-          const finalPath = path11.join(Global.Path.bin, "vscode-eslint");
-          const stats = await fs7.stat(finalPath).catch(() => {
+          await fs8.rm(zipPath, { force: true });
+          const extractedPath = path12.join(Global.Path.bin, "vscode-eslint-main");
+          const finalPath = path12.join(Global.Path.bin, "vscode-eslint");
+          const stats = await fs8.stat(finalPath).catch(() => {
             return;
           });
           if (stats) {
             log2.info("removing old eslint installation", { path: finalPath });
-            await fs7.rm(finalPath, { force: true, recursive: true });
+            await fs8.rm(finalPath, { force: true, recursive: true });
           }
-          await fs7.rename(extractedPath, finalPath);
+          await fs8.rename(extractedPath, finalPath);
           await $5`npm install`.cwd(finalPath).quiet();
           await $5`npm run compile`.cwd(finalPath).quiet();
           log2.info("installed VS Code ESLint server", { serverPath });
@@ -18616,7 +18616,7 @@ var init_server = __esm(async () => {
             log2.error("Failed to install gopls");
             return;
           }
-          bin = path11.join(Global.Path.bin, "gopls" + (process.platform === "win32" ? ".exe" : ""));
+          bin = path12.join(Global.Path.bin, "gopls" + (process.platform === "win32" ? ".exe" : ""));
           log2.info(`installed gopls`, {
             bin
           });
@@ -18657,7 +18657,7 @@ var init_server = __esm(async () => {
             log2.error("Failed to install rubocop");
             return;
           }
-          bin = path11.join(Global.Path.bin, "rubocop" + (process.platform === "win32" ? ".exe" : ""));
+          bin = path12.join(Global.Path.bin, "rubocop" + (process.platform === "win32" ? ".exe" : ""));
           log2.info(`installed rubocop`, {
             bin
           });
@@ -18677,7 +18677,7 @@ var init_server = __esm(async () => {
         let binary = Bun.which("pyright-langserver");
         const args = [];
         if (!binary) {
-          const js = path11.join(Global.Path.bin, "node_modules", "pyright", "dist", "pyright-langserver.js");
+          const js = path12.join(Global.Path.bin, "node_modules", "pyright", "dist", "pyright-langserver.js");
           if (!await Bun.file(js).exists()) {
             if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
               return;
@@ -18725,8 +18725,8 @@ var init_server = __esm(async () => {
       async spawn(root) {
         let binary = Bun.which("elixir-ls");
         if (!binary) {
-          const elixirLsPath = path11.join(Global.Path.bin, "elixir-ls");
-          binary = path11.join(Global.Path.bin, "elixir-ls-master", "release", process.platform === "win32" ? "language_server.bar" : "language_server.sh");
+          const elixirLsPath = path12.join(Global.Path.bin, "elixir-ls");
+          binary = path12.join(Global.Path.bin, "elixir-ls-master", "release", process.platform === "win32" ? "language_server.bar" : "language_server.sh");
           if (!await Bun.file(binary).exists()) {
             const elixir = Bun.which("elixir");
             if (!elixir) {
@@ -18739,14 +18739,14 @@ var init_server = __esm(async () => {
             const response = await fetch("https://github.com/elixir-lsp/elixir-ls/archive/refs/heads/master.zip");
             if (!response.ok)
               return;
-            const zipPath = path11.join(Global.Path.bin, "elixir-ls.zip");
+            const zipPath = path12.join(Global.Path.bin, "elixir-ls.zip");
             await Bun.file(zipPath).write(response);
             await $5`unzip -o -q ${zipPath}`.quiet().cwd(Global.Path.bin).nothrow();
-            await fs7.rm(zipPath, {
+            await fs8.rm(zipPath, {
               force: true,
               recursive: true
             });
-            await $5`mix deps.get && mix compile && mix elixir_ls.release2 -o release`.quiet().cwd(path11.join(Global.Path.bin, "elixir-ls-master")).env({ MIX_ENV: "prod", ...process.env });
+            await $5`mix deps.get && mix compile && mix elixir_ls.release2 -o release`.quiet().cwd(path12.join(Global.Path.bin, "elixir-ls-master")).env({ MIX_ENV: "prod", ...process.env });
             log2.info(`installed elixir-ls`, {
               path: elixirLsPath
             });
@@ -18824,15 +18824,15 @@ var init_server = __esm(async () => {
             log2.error("Failed to download zls");
             return;
           }
-          const tempPath = path11.join(Global.Path.bin, assetName);
+          const tempPath = path12.join(Global.Path.bin, assetName);
           await Bun.file(tempPath).write(downloadResponse);
           if (ext === "zip") {
             await $5`unzip -o -q ${tempPath}`.quiet().cwd(Global.Path.bin).nothrow();
           } else {
             await $5`tar -xf ${tempPath}`.cwd(Global.Path.bin).nothrow();
           }
-          await fs7.rm(tempPath, { force: true });
-          bin = path11.join(Global.Path.bin, "zls" + (platform === "win32" ? ".exe" : ""));
+          await fs8.rm(tempPath, { force: true });
+          bin = path12.join(Global.Path.bin, "zls" + (platform === "win32" ? ".exe" : ""));
           if (!await Bun.file(bin).exists()) {
             log2.error("Failed to extract zls binary");
             return;
@@ -18876,7 +18876,7 @@ var init_server = __esm(async () => {
             log2.error("Failed to install csharp-ls");
             return;
           }
-          bin = path11.join(Global.Path.bin, "csharp-ls" + (process.platform === "win32" ? ".exe" : ""));
+          bin = path12.join(Global.Path.bin, "csharp-ls" + (process.platform === "win32" ? ".exe" : ""));
           log2.info(`installed csharp-ls`, { bin });
         }
         return {
@@ -18920,15 +18920,15 @@ var init_server = __esm(async () => {
           return;
         }
         let currentDir = crateRoot;
-        while (currentDir !== path11.dirname(currentDir)) {
-          const cargoTomlPath = path11.join(currentDir, "Cargo.toml");
+        while (currentDir !== path12.dirname(currentDir)) {
+          const cargoTomlPath = path12.join(currentDir, "Cargo.toml");
           try {
             const cargoTomlContent = await Bun.file(cargoTomlPath).text();
             if (cargoTomlContent.includes("[workspace]")) {
               return currentDir;
             }
           } catch (err) {}
-          const parentDir = path11.dirname(currentDir);
+          const parentDir = path12.dirname(currentDir);
           if (parentDir === currentDir)
             break;
           currentDir = parentDir;
@@ -18966,7 +18966,7 @@ var init_server = __esm(async () => {
           };
         }
         const ext = process.platform === "win32" ? ".exe" : "";
-        const direct = path11.join(Global.Path.bin, "clangd" + ext);
+        const direct = path12.join(Global.Path.bin, "clangd" + ext);
         if (await Bun.file(direct).exists()) {
           return {
             process: spawn(direct, args, {
@@ -18974,13 +18974,13 @@ var init_server = __esm(async () => {
             })
           };
         }
-        const entries = await fs7.readdir(Global.Path.bin, { withFileTypes: true }).catch(() => []);
+        const entries = await fs8.readdir(Global.Path.bin, { withFileTypes: true }).catch(() => []);
         for (const entry of entries) {
           if (!entry.isDirectory())
             continue;
           if (!entry.name.startsWith("clangd_"))
             continue;
-          const candidate = path11.join(Global.Path.bin, entry.name, "bin", "clangd" + ext);
+          const candidate = path12.join(Global.Path.bin, entry.name, "bin", "clangd" + ext);
           if (await Bun.file(candidate).exists()) {
             return {
               process: spawn(candidate, args, {
@@ -19035,7 +19035,7 @@ var init_server = __esm(async () => {
           log2.error("Failed to download clangd");
           return;
         }
-        const archive = path11.join(Global.Path.bin, name21);
+        const archive = path12.join(Global.Path.bin, name21);
         const buf = await downloadResponse.arrayBuffer();
         if (buf.byteLength === 0) {
           log2.error("Failed to write clangd archive");
@@ -19054,8 +19054,8 @@ var init_server = __esm(async () => {
         if (tar) {
           await $5`tar -xf ${archive}`.cwd(Global.Path.bin).nothrow();
         }
-        await fs7.rm(archive, { force: true });
-        const bin = path11.join(Global.Path.bin, "clangd_" + tag, "bin", "clangd" + ext);
+        await fs8.rm(archive, { force: true });
+        const bin = path12.join(Global.Path.bin, "clangd_" + tag, "bin", "clangd" + ext);
         if (!await Bun.file(bin).exists()) {
           log2.error("Failed to extract clangd binary");
           return;
@@ -19063,8 +19063,8 @@ var init_server = __esm(async () => {
         if (platform !== "win32") {
           await $5`chmod +x ${bin}`.nothrow();
         }
-        await fs7.unlink(path11.join(Global.Path.bin, "clangd")).catch(() => {});
-        await fs7.symlink(bin, path11.join(Global.Path.bin, "clangd")).catch(() => {});
+        await fs8.unlink(path12.join(Global.Path.bin, "clangd")).catch(() => {});
+        await fs8.symlink(bin, path12.join(Global.Path.bin, "clangd")).catch(() => {});
         log2.info(`installed clangd`, { bin });
         return {
           process: spawn(bin, args, {
@@ -19081,7 +19081,7 @@ var init_server = __esm(async () => {
         let binary = Bun.which("svelteserver");
         const args = [];
         if (!binary) {
-          const js = path11.join(Global.Path.bin, "node_modules", "svelte-language-server", "bin", "server.js");
+          const js = path12.join(Global.Path.bin, "node_modules", "svelte-language-server", "bin", "server.js");
           if (!await Bun.file(js).exists()) {
             if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
               return;
@@ -19123,11 +19123,11 @@ var init_server = __esm(async () => {
           log2.info("typescript not found, required for Astro language server");
           return;
         }
-        const tsdk = path11.dirname(tsserver);
+        const tsdk = path12.dirname(tsserver);
         let binary = Bun.which("astro-ls");
         const args = [];
         if (!binary) {
-          const js = path11.join(Global.Path.bin, "node_modules", "@astrojs", "language-server", "bin", "nodeServer.js");
+          const js = path12.join(Global.Path.bin, "node_modules", "@astrojs", "language-server", "bin", "nodeServer.js");
           if (!await Bun.file(js).exists()) {
             if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
               return;
@@ -19181,27 +19181,27 @@ var init_server = __esm(async () => {
           log2.error("JDTLS requires at least Java 21.");
           return;
         }
-        const distPath = path11.join(Global.Path.bin, "jdtls");
-        const launcherDir = path11.join(distPath, "plugins");
+        const distPath = path12.join(Global.Path.bin, "jdtls");
+        const launcherDir = path12.join(distPath, "plugins");
         const installed = await exists(launcherDir);
         if (!installed) {
           if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
             return;
           log2.info("Downloading JDTLS LSP server.");
-          await fs7.mkdir(distPath, { recursive: true });
+          await fs8.mkdir(distPath, { recursive: true });
           const releaseURL = "https://www.eclipse.org/downloads/download.php?file=/jdtls/snapshots/jdt-language-server-latest.tar.gz";
-          const archivePath = path11.join(distPath, "release.tar.gz");
+          const archivePath = path12.join(distPath, "release.tar.gz");
           await $5`curl -L -o '${archivePath}' '${releaseURL}'`.quiet().nothrow();
           await $5`tar -xzf ${archivePath}`.cwd(distPath).quiet().nothrow();
-          await fs7.rm(archivePath, { force: true });
+          await fs8.rm(archivePath, { force: true });
         }
         const jarFileName = await $5`ls org.eclipse.equinox.launcher_*.jar`.cwd(launcherDir).quiet().nothrow().then(({ stdout }) => stdout.toString().trim());
-        const launcherJar = path11.join(launcherDir, jarFileName);
+        const launcherJar = path12.join(launcherDir, jarFileName);
         if (!await exists(launcherJar)) {
           log2.error(`Failed to locate the JDTLS launcher module in the installed directory: ${distPath}.`);
           return;
         }
-        const configFile = path11.join(distPath, (() => {
+        const configFile = path12.join(distPath, (() => {
           switch (process.platform) {
             case "darwin":
               return "config_mac";
@@ -19213,7 +19213,7 @@ var init_server = __esm(async () => {
               return "config_linux";
           }
         })());
-        const dataDir = await fs7.mkdtemp(path11.join(os3.tmpdir(), "opencode-jdtls-data"));
+        const dataDir = await fs8.mkdtemp(path12.join(os4.tmpdir(), "opencode-jdtls-data"));
         return {
           process: spawn(java, [
             "-jar",
@@ -19243,7 +19243,7 @@ var init_server = __esm(async () => {
         let binary = Bun.which("yaml-language-server");
         const args = [];
         if (!binary) {
-          const js = path11.join(Global.Path.bin, "node_modules", "yaml-language-server", "out", "server", "src", "server.js");
+          const js = path12.join(Global.Path.bin, "node_modules", "yaml-language-server", "out", "server", "src", "server.js");
           const exists2 = await Bun.file(js).exists();
           if (!exists2) {
             if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
@@ -19344,16 +19344,16 @@ var init_server = __esm(async () => {
             log2.error("Failed to download lua-language-server");
             return;
           }
-          const tempPath = path11.join(Global.Path.bin, assetName);
+          const tempPath = path12.join(Global.Path.bin, assetName);
           await Bun.file(tempPath).write(downloadResponse);
-          const installDir = path11.join(Global.Path.bin, `lua-language-server-${lualsArch}-${lualsPlatform}`);
-          const stats = await fs7.stat(installDir).catch(() => {
+          const installDir = path12.join(Global.Path.bin, `lua-language-server-${lualsArch}-${lualsPlatform}`);
+          const stats = await fs8.stat(installDir).catch(() => {
             return;
           });
           if (stats) {
-            await fs7.rm(installDir, { force: true, recursive: true });
+            await fs8.rm(installDir, { force: true, recursive: true });
           }
-          await fs7.mkdir(installDir, { recursive: true });
+          await fs8.mkdir(installDir, { recursive: true });
           if (ext === "zip") {
             const ok = await $5`unzip -o -q ${tempPath} -d ${installDir}`.quiet().catch((error92) => {
               log2.error("Failed to extract lua-language-server archive", { error: error92 });
@@ -19367,8 +19367,8 @@ var init_server = __esm(async () => {
             if (!ok)
               return;
           }
-          await fs7.rm(tempPath, { force: true });
-          bin = path11.join(installDir, "bin", "lua-language-server" + (platform === "win32" ? ".exe" : ""));
+          await fs8.rm(tempPath, { force: true });
+          bin = path12.join(installDir, "bin", "lua-language-server" + (platform === "win32" ? ".exe" : ""));
           if (!await Bun.file(bin).exists()) {
             log2.error("Failed to extract lua-language-server binary");
             return;
@@ -19399,7 +19399,7 @@ var init_server = __esm(async () => {
         let binary = Bun.which("intelephense");
         const args = [];
         if (!binary) {
-          const js = path11.join(Global.Path.bin, "node_modules", "intelephense", "lib", "intelephense.js");
+          const js = path12.join(Global.Path.bin, "node_modules", "intelephense", "lib", "intelephense.js");
           if (!await Bun.file(js).exists()) {
             if (Flag.KIFARU_DISABLE_LSP_DOWNLOAD)
               return;
@@ -22805,7 +22805,7 @@ var require_parse = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/gray-matter@4.0.3/node_modules/gray-matter/index.js
 var require_gray_matter = __commonJS((exports, module) => {
-  var fs8 = __require("fs");
+  var fs9 = __require("fs");
   var sections = require_section_matter();
   var defaults = require_defaults();
   var stringify = require_stringify();
@@ -22892,7 +22892,7 @@ var require_gray_matter = __commonJS((exports, module) => {
     return stringify(file3, data2, options2);
   };
   matter.read = function(filepath, options2) {
-    const str2 = fs8.readFileSync(filepath, "utf8");
+    const str2 = fs9.readFileSync(filepath, "utf8");
     const file3 = matter(str2, options2);
     file3.path = filepath;
     return file3;
@@ -22961,9 +22961,9 @@ var exports_config = {};
 __export(exports_config, {
   Config: () => Config
 });
-import path12 from "path";
-import os4 from "os";
-import fs8 from "fs/promises";
+import path13 from "path";
+import os5 from "os";
+import fs9 from "fs/promises";
 import { pathToFileURL } from "url";
 import { createHash as createHash2 } from "crypto";
 var Config;
@@ -23025,8 +23025,8 @@ var init_config = __esm(async () => {
           for (const match of line.matchAll(/\{file:([^}]+)\}/g)) {
             let referenced = match[1];
             if (referenced.startsWith("~/"))
-              referenced = path12.join(os4.homedir(), referenced.slice(2));
-            const resolved = path12.isAbsolute(referenced) ? referenced : path12.resolve(path12.dirname(filepath), referenced);
+              referenced = path13.join(os5.homedir(), referenced.slice(2));
+            const resolved = path13.isAbsolute(referenced) ? referenced : path13.resolve(path13.dirname(filepath), referenced);
             if (discovered.has(resolved))
               continue;
             discovered.add(resolved);
@@ -23049,12 +23049,12 @@ var init_config = __esm(async () => {
       const pluginIssues2 = [];
       const sourceFiles = new Set;
       for (const filename of CONFIG_FILENAMES) {
-        sourceFiles.add(path12.join(Global.Path.config, filename));
-        sourceFiles.add(path12.join(Instance.directory, filename));
-        sourceFiles.add(path12.join(Instance.worktree, filename));
+        sourceFiles.add(path13.join(Global.Path.config, filename));
+        sourceFiles.add(path13.join(Instance.directory, filename));
+        sourceFiles.add(path13.join(Instance.worktree, filename));
       }
-      sourceFiles.add(path12.join(Global.Path.config, "config.json"));
-      sourceFiles.add(path12.join(Global.Path.config, "config"));
+      sourceFiles.add(path13.join(Global.Path.config, "config.json"));
+      sourceFiles.add(path13.join(Global.Path.config, "config"));
       let result = await global2();
       recordPluginSources(pluginSources, result, Global.Path.config);
       if (Flag.KIFARU_CONFIG) {
@@ -23115,20 +23115,20 @@ var init_config = __esm(async () => {
         log2.debug("loading config from KIFARU_CONFIG_DIR", { path: Flag.KIFARU_CONFIG_DIR });
       }
       const watchedDirectories = new Set(directories2);
-      for (let current = path12.resolve(Instance.directory);; current = path12.dirname(current)) {
-        watchedDirectories.add(path12.join(current, ".kifaru"));
-        watchedDirectories.add(path12.join(current, ".opencode"));
-        if (samePath(current, Instance.worktree) || path12.dirname(current) === current)
+      for (let current = path13.resolve(Instance.directory);; current = path13.dirname(current)) {
+        watchedDirectories.add(path13.join(current, ".kifaru"));
+        watchedDirectories.add(path13.join(current, ".opencode"));
+        if (samePath(current, Instance.worktree) || path13.dirname(current) === current)
           break;
       }
       for (const directory of watchedDirectories) {
         for (const filename of CONFIG_FILENAMES)
-          sourceFiles.add(path12.join(directory, filename));
+          sourceFiles.add(path13.join(directory, filename));
       }
       const promises = [];
       for (const dir of directories2) {
         for (const filename of CONFIG_FILENAMES)
-          sourceFiles.add(path12.join(dir, filename));
+          sourceFiles.add(path13.join(dir, filename));
         if (dir.includes("\x00")) {
           log2.error(`[FATAL] Null byte detected in config directory: ${JSON.stringify(dir)}`);
           continue;
@@ -23137,7 +23137,7 @@ var init_config = __esm(async () => {
         const allowPlugins = samePath(dir, Global.Path.config) || !!Flag.KIFARU_CONFIG_DIR && samePath(dir, Flag.KIFARU_CONFIG_DIR) || Flag.allowProjectPlugins();
         if (dir.endsWith(".kifaru") || dir.endsWith(".opencode") || dir === Flag.KIFARU_CONFIG_DIR) {
           for (const file3 of CONFIG_FILENAMES) {
-            const filepath = path12.join(dir, file3);
+            const filepath = path13.join(dir, file3);
             log2.debug(`loading config from ${filepath}`);
             const config4 = await loadFile(filepath, allowPlugins ? undefined : {
               denyPlugins: {
@@ -23185,7 +23185,7 @@ var init_config = __esm(async () => {
         result.permission = D(result.permission ?? {}, JSON.parse(Flag.KIFARU_PERMISSION));
       }
       if (!result.username)
-        result.username = os4.userInfo().username;
+        result.username = os5.userInfo().username;
       if (result.autoshare === true && !result.share) {
         result.share = "auto";
       }
@@ -23229,7 +23229,7 @@ var init_config = __esm(async () => {
     Config.state = Instance.state(loadState);
     function samePath(left, right) {
       const normalize = (value) => {
-        const resolved = path12.resolve(value);
+        const resolved = path13.resolve(value);
         return process.platform === "win32" ? resolved.toLowerCase() : resolved;
       };
       return normalize(left) === normalize(right);
@@ -23267,12 +23267,12 @@ var init_config = __esm(async () => {
         return;
       installedDependencyDirectories.add(cleanDir);
       try {
-        await fs8.mkdir(cleanDir, { recursive: true }).catch(() => {});
-        const pkg = path12.join(cleanDir, "package.json");
+        await fs9.mkdir(cleanDir, { recursive: true }).catch(() => {});
+        const pkg = path13.join(cleanDir, "package.json");
         if (!await Bun.file(pkg).exists()) {
           await Bun.write(pkg, "{}");
         }
-        const gitignore = path12.join(cleanDir, ".gitignore");
+        const gitignore = path13.join(cleanDir, ".gitignore");
         const hasGitIgnore = await Bun.file(gitignore).exists();
         if (!hasGitIgnore)
           await Bun.write(gitignore, ["node_modules", "package.json", "bun.lock", ".gitignore"].join(`
@@ -23301,7 +23301,7 @@ var init_config = __esm(async () => {
             const index = item.indexOf(pattern);
             return item.slice(index + pattern.length, -3);
           }
-          return path12.basename(item, ".md");
+          return path13.basename(item, ".md");
         })();
         const config4 = {
           name: name21,
@@ -23329,7 +23329,7 @@ var init_config = __esm(async () => {
         const md = await ConfigMarkdown.parse(item);
         if (!md.data)
           continue;
-        let agentName = path12.basename(item, ".md");
+        let agentName = path13.basename(item, ".md");
         const agentFolderPath = item.includes("/.opencode/agent/") ? item.split("/.opencode/agent/")[1] : item.includes("/agent/") ? item.split("/agent/")[1] : agentName + ".md";
         if (agentFolderPath.includes("/")) {
           const relativePath = agentFolderPath.replace(".md", "");
@@ -23363,7 +23363,7 @@ var init_config = __esm(async () => {
         if (!md.data)
           continue;
         const config4 = {
-          name: path12.basename(item, ".md"),
+          name: path13.basename(item, ".md"),
           ...md.data,
           prompt: md.content.trim()
         };
@@ -23710,8 +23710,8 @@ var init_config = __esm(async () => {
     }
     Config.global = global2;
     async function loadGlobal() {
-      let result = C({}, D(await loadFile(path12.join(Global.Path.config, "config.json"))), D(await loadFile(path12.join(Global.Path.config, "opencode.json"))), D(await loadFile(path12.join(Global.Path.config, "opencode.jsonc"))));
-      await import(path12.join(Global.Path.config, "config"), {
+      let result = C({}, D(await loadFile(path13.join(Global.Path.config, "config.json"))), D(await loadFile(path13.join(Global.Path.config, "opencode.json"))), D(await loadFile(path13.join(Global.Path.config, "opencode.jsonc"))));
+      await import(path13.join(Global.Path.config, "config"), {
         with: {
           type: "toml"
         }
@@ -23721,8 +23721,8 @@ var init_config = __esm(async () => {
           result.model = `${provider}/${model}`;
         result["$schema"] = "https://github.com/Bastsec/kifaru/raw/main/kifaru.schema.json";
         result = D(result, rest);
-        await Bun.write(path12.join(Global.Path.config, "config.json"), JSON.stringify(result, null, 2));
-        await fs8.unlink(path12.join(Global.Path.config, "config"));
+        await Bun.write(path13.join(Global.Path.config, "config.json"), JSON.stringify(result, null, 2));
+        await fs9.unlink(path13.join(Global.Path.config, "config"));
       }).catch(() => {});
       return result;
     }
@@ -23743,7 +23743,7 @@ var init_config = __esm(async () => {
       });
       const fileMatches = text2.match(/\{file:[^}]+\}/g);
       if (fileMatches) {
-        const configDir = path12.dirname(configFilepath);
+        const configDir = path13.dirname(configFilepath);
         const lines = text2.split(`
 `);
         for (const match of fileMatches) {
@@ -23753,9 +23753,9 @@ var init_config = __esm(async () => {
           }
           let filePath = match.replace(/^\{file:/, "").replace(/\}$/, "");
           if (filePath.startsWith("~/")) {
-            filePath = path12.join(os4.homedir(), filePath.slice(2));
+            filePath = path13.join(os5.homedir(), filePath.slice(2));
           }
-          const resolvedPath = path12.isAbsolute(filePath) ? filePath : path12.resolve(configDir, filePath);
+          const resolvedPath = path13.isAbsolute(filePath) ? filePath : path13.resolve(configDir, filePath);
           const fileContent = (await Bun.file(resolvedPath).text().catch((error92) => {
             const errMsg = `bad file reference: "${match}"`;
             if (error92.code === "ENOENT") {
@@ -23819,7 +23819,7 @@ ${errorDetails}
           for (let i2 = 0;i2 < data3.plugin.length; i2++) {
             const plugin = data3.plugin[i2];
             try {
-              data3.plugin[i2] = pathToFileURL(Bun.resolveSync(plugin, path12.dirname(configFilepath))).href;
+              data3.plugin[i2] = pathToFileURL(Bun.resolveSync(plugin, path13.dirname(configFilepath))).href;
             } catch {
               try {
                 data3.plugin[i2] = import.meta.resolve(plugin, configFilepath);
@@ -23890,7 +23890,7 @@ ${errorDetails}
     }
     Config.refreshIfChanged = refreshIfChanged;
     async function update(config4) {
-      const filepath = path12.join(Instance.directory, "config.json");
+      const filepath = path13.join(Instance.directory, "config.json");
       const existing = await loadFile(filepath);
       await Bun.write(filepath, JSON.stringify(D(existing, config4), null, 2));
       await Instance.dispose();
@@ -50280,9 +50280,9 @@ var require_getMachineId_linux = __commonJS((exports) => {
   var api_1 = require_src();
   async function getMachineId() {
     const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-    for (const path16 of paths) {
+    for (const path17 of paths) {
       try {
-        const result = await fs_1.promises.readFile(path16, { encoding: "utf8" });
+        const result = await fs_1.promises.readFile(path17, { encoding: "utf8" });
         return result.trim();
       } catch (e2) {
         api_1.diag.debug(`error reading machine id: ${e2}`);
@@ -50466,7 +50466,7 @@ var require_ProcessDetector = __commonJS((exports) => {
   exports.processDetector = undefined;
   var api_1 = require_src();
   var semconv_1 = require_semconv2();
-  var os7 = __require("os");
+  var os8 = __require("os");
 
   class ProcessDetector {
     detect(_config) {
@@ -50487,7 +50487,7 @@ var require_ProcessDetector = __commonJS((exports) => {
         attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
       }
       try {
-        const userInfo = os7.userInfo();
+        const userInfo = os8.userInfo();
         attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
       } catch (e2) {
         api_1.diag.debug(`error obtaining process owner: ${e2}`);
@@ -52980,8 +52980,8 @@ var require_shared_env_configuration = __commonJS((exports) => {
 var require_otlp_node_http_env_configuration = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getNodeHttpConfigurationFromEnvironment = undefined;
-  var fs11 = __require("fs");
-  var path16 = __require("path");
+  var fs12 = __require("fs");
+  var path17 = __require("path");
   var core_1 = require_src3();
   var api_1 = require_src();
   var shared_env_configuration_1 = require_shared_env_configuration();
@@ -53006,7 +53006,7 @@ var require_otlp_node_http_env_configuration = __commonJS((exports) => {
       return;
     }
   }
-  function appendResourcePathToUrl(url3, path17) {
+  function appendResourcePathToUrl(url3, path18) {
     try {
       new URL(url3);
     } catch {
@@ -53016,11 +53016,11 @@ var require_otlp_node_http_env_configuration = __commonJS((exports) => {
     if (!url3.endsWith("/")) {
       url3 = url3 + "/";
     }
-    url3 += path17;
+    url3 += path18;
     try {
       new URL(url3);
     } catch {
-      api_1.diag.warn(`Configuration: Provided URL appended with '${path17}' is not a valid URL, using 'undefined' instead of '${url3}'`);
+      api_1.diag.warn(`Configuration: Provided URL appended with '${path18}' is not a valid URL, using 'undefined' instead of '${url3}'`);
       return;
     }
     return url3;
@@ -53045,7 +53045,7 @@ var require_otlp_node_http_env_configuration = __commonJS((exports) => {
     const filePath = signalSpecificPath ?? nonSignalSpecificPath;
     if (filePath != null) {
       try {
-        return fs11.readFileSync(path16.resolve(process.cwd(), filePath));
+        return fs12.readFileSync(path17.resolve(process.cwd(), filePath));
       } catch {
         api_1.diag.warn(warningMessage);
         return;
@@ -57595,26 +57595,26 @@ var require_module_details_from_path = __commonJS((exports, module) => {
         basedir += segments[i2] + sep;
       }
     }
-    var path16 = "";
+    var path17 = "";
     var lastSegmentIndex = segments.length - 1;
     for (var i22 = index + offset;i22 <= lastSegmentIndex; i22++) {
       if (i22 === lastSegmentIndex) {
-        path16 += segments[i22];
+        path17 += segments[i22];
       } else {
-        path16 += segments[i22] + sep;
+        path17 += segments[i22] + sep;
       }
     }
     return {
       name: name21,
       basedir,
-      path: path16
+      path: path17
     };
   };
 });
 
 // ../../node_modules/.bun/require-in-the-middle@8.0.1/node_modules/require-in-the-middle/index.js
 var require_require_in_the_middle = __commonJS((exports, module) => {
-  var path16 = __require("path");
+  var path17 = __require("path");
   var Module = __require("module");
   var debug = require_src14()("require-in-the-middle");
   var moduleDetailsFromPath = require_module_details_from_path();
@@ -57761,7 +57761,7 @@ var require_require_in_the_middle = __commonJS((exports, module) => {
         }
         moduleName = filename;
       } else if (hasWhitelist === true && modules.includes(filename)) {
-        const parsedPath = path16.parse(filename);
+        const parsedPath = path17.parse(filename);
         moduleName = parsedPath.name;
         basedir = parsedPath.dir;
       } else {
@@ -57799,7 +57799,7 @@ var require_require_in_the_middle = __commonJS((exports, module) => {
           }
           if (res !== filename) {
             if (internals === true) {
-              moduleName = moduleName + path16.sep + path16.relative(basedir, filename);
+              moduleName = moduleName + path17.sep + path17.relative(basedir, filename);
               debug("preparing to process require of internal file: %s", moduleName);
             } else {
               debug("ignoring require of non-main module file: %s", res);
@@ -57835,8 +57835,8 @@ var require_require_in_the_middle = __commonJS((exports, module) => {
     }
   };
   function resolveModuleName(stat) {
-    const normalizedPath = path16.sep !== "/" ? stat.path.split(path16.sep).join("/") : stat.path;
-    return path16.posix.join(stat.name, normalizedPath).replace(normalize, "");
+    const normalizedPath = path17.sep !== "/" ? stat.path.split(path17.sep).join("/") : stat.path;
+    return path17.posix.join(stat.name, normalizedPath).replace(normalize, "");
   }
 });
 
@@ -57904,7 +57904,7 @@ var require_RequireInTheMiddleSingleton = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.RequireInTheMiddleSingleton = undefined;
   var require_in_the_middle_1 = require_require_in_the_middle();
-  var path16 = __require("path");
+  var path17 = __require("path");
   var ModuleNameTrie_1 = require_ModuleNameTrie();
   var isMocha = [
     "afterEach",
@@ -57949,7 +57949,7 @@ var require_RequireInTheMiddleSingleton = __commonJS((exports) => {
   }
   exports.RequireInTheMiddleSingleton = RequireInTheMiddleSingleton;
   function normalizePathSeparators(moduleNameOrPath) {
-    return path16.sep !== ModuleNameTrie_1.ModuleNameSeparator ? moduleNameOrPath.split(path16.sep).join(ModuleNameTrie_1.ModuleNameSeparator) : moduleNameOrPath;
+    return path17.sep !== ModuleNameTrie_1.ModuleNameSeparator ? moduleNameOrPath.split(path17.sep).join(ModuleNameTrie_1.ModuleNameSeparator) : moduleNameOrPath;
   }
 });
 
@@ -58127,7 +58127,7 @@ var require_register = __commonJS((exports) => {
 
 // ../../node_modules/.bun/import-in-the-middle@3.5.1/node_modules/import-in-the-middle/index.js
 var require_import_in_the_middle = __commonJS((exports, module) => {
-  var path16 = __require("path");
+  var path17 = __require("path");
   var moduleDetailsFromPath = require_module_details_from_path();
   var { fileURLToPath } = __require("url");
   var { MessageChannel } = __require("worker_threads");
@@ -58246,7 +58246,7 @@ var require_import_in_the_middle = __commonJS((exports, module) => {
             } else if (baseDir.endsWith(specifiers.get(loadUrl)) || isTurbopackSpecifier(specifiers.get(loadUrl), baseDir)) {
               callHookFn(hookFn, namespace, name21, baseDir);
             } else if (internals) {
-              const internalPath = name21 + path16.sep + path16.relative(baseDir, filePath);
+              const internalPath = name21 + path17.sep + path17.relative(baseDir, filePath);
               callHookFn(hookFn, namespace, internalPath, baseDir);
             }
           } else if (matchArg === specifier) {
@@ -58315,7 +58315,7 @@ var require_utils11 = __commonJS((exports) => {
 var require_instrumentation2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.InstrumentationBase = undefined;
-  var path16 = __require("path");
+  var path17 = __require("path");
   var util_1 = __require("util");
   var semver_1 = require_semver2();
   var shimmer_1 = require_shimmer();
@@ -58416,7 +58416,7 @@ var require_instrumentation2 = __commonJS((exports) => {
     }
     _extractPackageVersion(baseDir) {
       try {
-        const json4 = (0, fs_1.readFileSync)(path16.join(baseDir, "package.json"), {
+        const json4 = (0, fs_1.readFileSync)(path17.join(baseDir, "package.json"), {
           encoding: "utf8"
         });
         const version4 = JSON.parse(json4).version;
@@ -58458,7 +58458,7 @@ var require_instrumentation2 = __commonJS((exports) => {
         return exports2;
       }
       const files = module2.files ?? [];
-      const normalizedName = path16.normalize(name21);
+      const normalizedName = path17.normalize(name21);
       const supportedFileInstrumentations = files.filter((f3) => f3.name === normalizedName && isSupported(f3.supportedVersions, version4, module2.includePrerelease));
       return supportedFileInstrumentations.reduce((patchedExports, file3) => {
         file3.moduleExports = patchedExports;
@@ -58504,8 +58504,8 @@ var require_instrumentation2 = __commonJS((exports) => {
       this._warnOnPreloadedModules();
       for (const module2 of this._modules) {
         const hookFn = (exports2, name21, baseDir) => {
-          if (!baseDir && path16.isAbsolute(name21)) {
-            const parsedPath = path16.parse(name21);
+          if (!baseDir && path17.isAbsolute(name21)) {
+            const parsedPath = path17.parse(name21);
             name21 = parsedPath.name;
             baseDir = parsedPath.dir;
           }
@@ -58514,7 +58514,7 @@ var require_instrumentation2 = __commonJS((exports) => {
         const onRequire = (exports2, name21, baseDir) => {
           return this._onRequire(module2, exports2, name21, baseDir);
         };
-        const hook = path16.isAbsolute(module2.name) ? new require_in_the_middle_1.Hook([module2.name], { internals: true }, onRequire) : this._requireInTheMiddleSingleton.register(module2.name, onRequire);
+        const hook = path17.isAbsolute(module2.name) ? new require_in_the_middle_1.Hook([module2.name], { internals: true }, onRequire) : this._requireInTheMiddleSingleton.register(module2.name, onRequire);
         this._hooks.push(hook);
         const esmHook = new import_in_the_middle_1.Hook([module2.name], { internals: true }, hookFn);
         this._hooks.push(esmHook);
@@ -59320,14 +59320,14 @@ var require_tls_helpers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CIPHER_SUITES = undefined;
   exports.getDefaultRootsData = getDefaultRootsData;
-  var fs11 = __require("fs");
+  var fs12 = __require("fs");
   exports.CIPHER_SUITES = process.env.GRPC_SSL_CIPHER_SUITES;
   var DEFAULT_ROOTS_FILE_PATH = process.env.GRPC_DEFAULT_SSL_ROOTS_FILE_PATH;
   var defaultRootsData = null;
   function getDefaultRootsData() {
     if (DEFAULT_ROOTS_FILE_PATH) {
       if (defaultRootsData === null) {
-        defaultRootsData = fs11.readFileSync(DEFAULT_ROOTS_FILE_PATH);
+        defaultRootsData = fs12.readFileSync(DEFAULT_ROOTS_FILE_PATH);
       }
       return defaultRootsData;
     }
@@ -59355,19 +59355,19 @@ var require_uri_parser = __commonJS((exports) => {
     };
   }
   var NUMBER_REGEX = /^\d+$/;
-  function splitHostPort(path16) {
-    if (path16.startsWith("[")) {
-      const hostEnd = path16.indexOf("]");
+  function splitHostPort(path17) {
+    if (path17.startsWith("[")) {
+      const hostEnd = path17.indexOf("]");
       if (hostEnd === -1) {
         return null;
       }
-      const host = path16.substring(1, hostEnd);
+      const host = path17.substring(1, hostEnd);
       if (host.indexOf(":") === -1) {
         return null;
       }
-      if (path16.length > hostEnd + 1) {
-        if (path16[hostEnd + 1] === ":") {
-          const portString = path16.substring(hostEnd + 2);
+      if (path17.length > hostEnd + 1) {
+        if (path17[hostEnd + 1] === ":") {
+          const portString = path17.substring(hostEnd + 2);
           if (NUMBER_REGEX.test(portString)) {
             return {
               host,
@@ -59385,7 +59385,7 @@ var require_uri_parser = __commonJS((exports) => {
         };
       }
     } else {
-      const splitPath = path16.split(":");
+      const splitPath = path17.split(":");
       if (splitPath.length === 2) {
         if (NUMBER_REGEX.test(splitPath[1])) {
           return {
@@ -59397,7 +59397,7 @@ var require_uri_parser = __commonJS((exports) => {
         }
       } else {
         return {
-          host: path16
+          host: path17
         };
       }
     }
@@ -59938,7 +59938,7 @@ var require_service_config = __commonJS((exports) => {
   exports.validateRetryThrottling = validateRetryThrottling;
   exports.validateServiceConfig = validateServiceConfig;
   exports.extractAndSelectServiceConfig = extractAndSelectServiceConfig;
-  var os7 = __require("os");
+  var os8 = __require("os");
   var constants_1 = require_constants2();
   var DURATION_REGEX = /^\d+(\.\d{1,9})?s$/;
   var CLIENT_LANGUAGE_STRING = "node";
@@ -60237,7 +60237,7 @@ var require_service_config = __commonJS((exports) => {
       if (Array.isArray(validatedConfig.clientHostname)) {
         let hostnameMatched = false;
         for (const hostname5 of validatedConfig.clientHostname) {
-          if (hostname5 === os7.hostname()) {
+          if (hostname5 === os8.hostname()) {
             hostnameMatched = true;
           }
         }
@@ -62332,14 +62332,14 @@ var require_client_interceptors = __commonJS((exports) => {
     }
   }
   exports.InterceptingCall = InterceptingCall;
-  function getCall(channel, path16, options2) {
+  function getCall(channel, path17, options2) {
     var _a24, _b16;
     const deadline = (_a24 = options2.deadline) !== null && _a24 !== undefined ? _a24 : Infinity;
     const host = options2.host;
     const parent = (_b16 = options2.parent) !== null && _b16 !== undefined ? _b16 : null;
     const propagateFlags = options2.propagate_flags;
     const credentials = options2.credentials;
-    const call = channel.createCall(path16, deadline, host, parent, propagateFlags);
+    const call = channel.createCall(path17, deadline, host, parent, propagateFlags);
     if (credentials) {
       call.setCredentials(credentials);
     }
@@ -62902,9 +62902,9 @@ var require_make_client = __commonJS((exports) => {
     ServiceClientImpl.serviceName = serviceName;
     return ServiceClientImpl;
   }
-  function partial3(fn, path16, serialize, deserialize) {
+  function partial3(fn, path17, serialize, deserialize) {
     return function(...args) {
-      return fn.call(this, path16, serialize, deserialize, ...args);
+      return fn.call(this, path17, serialize, deserialize, ...args);
     };
   }
   function isProtobufTypeDefinition(obj) {
@@ -63384,20 +63384,20 @@ var require_codegen = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/@protobufjs+fetch@1.1.1/node_modules/@protobufjs/fetch/util/fs.js
 var require_fs = __commonJS((exports, module) => {
-  var fs11 = null;
+  var fs12 = null;
   try {
-    fs11 = __require("fs");
-    if (!fs11 || !fs11.readFile || !fs11.readFileSync)
-      fs11 = null;
+    fs12 = __require("fs");
+    if (!fs12 || !fs12.readFile || !fs12.readFileSync)
+      fs12 = null;
   } catch (e2) {}
-  module.exports = fs11;
+  module.exports = fs12;
 });
 
 // ../../node_modules/.bun/@protobufjs+fetch@1.1.1/node_modules/@protobufjs/fetch/index.js
 var require_fetch = __commonJS((exports, module) => {
   module.exports = fetch2;
   var asPromise = require_aspromise();
-  var fs11 = require_fs();
+  var fs12 = require_fs();
   function fetch2(filename, options2, callback) {
     if (typeof options2 === "function") {
       callback = options2;
@@ -63406,8 +63406,8 @@ var require_fetch = __commonJS((exports, module) => {
       options2 = {};
     if (!callback)
       return asPromise(fetch2, this, filename, options2);
-    if (!options2.xhr && fs11 && fs11.readFile)
-      return fs11.readFile(filename, function fetchReadFileCallback(err, contents) {
+    if (!options2.xhr && fs12 && fs12.readFile)
+      return fs12.readFile(filename, function fetchReadFileCallback(err, contents) {
         return err && typeof XMLHttpRequest !== "undefined" ? fetch2.xhr(filename, options2, callback) : err ? callback(err) : callback(null, options2.binary ? contents : contents.toString("utf8"));
       });
     return fetch2.xhr(filename, options2, callback);
@@ -63442,13 +63442,13 @@ var require_fetch = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/@protobufjs+path@1.1.2/node_modules/@protobufjs/path/index.js
 var require_path = __commonJS((exports) => {
-  var path16 = exports;
-  var isAbsolute2 = path16.isAbsolute = function isAbsolute3(path17) {
-    return /^(?:\/|\w+:)/.test(path17);
+  var path17 = exports;
+  var isAbsolute2 = path17.isAbsolute = function isAbsolute3(path18) {
+    return /^(?:\/|\w+:)/.test(path18);
   };
-  var normalize = path16.normalize = function normalize2(path17) {
-    path17 = path17.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
-    var parts = path17.split("/"), absolute = isAbsolute2(path17), prefix = "";
+  var normalize = path17.normalize = function normalize2(path18) {
+    path18 = path18.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+    var parts = path18.split("/"), absolute = isAbsolute2(path18), prefix = "";
     if (absolute)
       prefix = parts.shift() + "/";
     for (var i2 = 0;i2 < parts.length; ) {
@@ -63466,7 +63466,7 @@ var require_path = __commonJS((exports) => {
     }
     return prefix + parts.join("/");
   };
-  path16.resolve = function resolve3(originPath, includePath, alreadyNormalized) {
+  path17.resolve = function resolve3(originPath, includePath, alreadyNormalized) {
     if (!alreadyNormalized)
       includePath = normalize(includePath);
     if (isAbsolute2(includePath))
@@ -63487,13 +63487,13 @@ var require_patterns = __commonJS((exports) => {
 
 // ../../node_modules/.bun/protobufjs@7.6.6/node_modules/protobufjs/src/util/fs.js
 var require_fs2 = __commonJS((exports, module) => {
-  var fs11 = null;
+  var fs12 = null;
   try {
-    fs11 = __require("fs");
-    if (!fs11 || !fs11.readFile || !fs11.readFileSync)
-      fs11 = null;
+    fs12 = __require("fs");
+    if (!fs12 || !fs12.readFile || !fs12.readFileSync)
+      fs12 = null;
   } catch (e2) {}
-  module.exports = fs11;
+  module.exports = fs12;
 });
 
 // ../../node_modules/.bun/protobufjs@7.6.6/node_modules/protobufjs/src/namespace.js
@@ -63634,18 +63634,18 @@ var require_namespace = __commonJS((exports, module) => {
     object4.onRemove(this);
     return clearCache(this);
   };
-  Namespace.prototype.define = function define2(path16, json4) {
-    if (util2.isString(path16))
-      path16 = path16.split(".");
-    else if (!Array.isArray(path16))
+  Namespace.prototype.define = function define2(path17, json4) {
+    if (util2.isString(path17))
+      path17 = path17.split(".");
+    else if (!Array.isArray(path17))
       throw TypeError("illegal path");
-    if (path16 && path16.length && path16[0] === "")
+    if (path17 && path17.length && path17[0] === "")
       throw Error("path must be relative");
-    if (path16.length > util2.recursionLimit)
+    if (path17.length > util2.recursionLimit)
       throw Error("max depth exceeded");
     var ptr = this;
-    while (path16.length > 0) {
-      var part = path16.shift();
+    while (path17.length > 0) {
+      var part = path17.shift();
       if (ptr.nested && ptr.nested[part]) {
         ptr = ptr.nested[part];
         if (!(ptr instanceof Namespace))
@@ -63682,26 +63682,26 @@ var require_namespace = __commonJS((exports, module) => {
     });
     return this;
   };
-  Namespace.prototype.lookup = function lookup(path16, filterTypes, parentAlreadyChecked) {
+  Namespace.prototype.lookup = function lookup(path17, filterTypes, parentAlreadyChecked) {
     if (typeof filterTypes === "boolean") {
       parentAlreadyChecked = filterTypes;
       filterTypes = undefined;
     } else if (filterTypes && !Array.isArray(filterTypes))
       filterTypes = [filterTypes];
-    if (util2.isString(path16) && path16.length) {
-      if (path16 === ".")
+    if (util2.isString(path17) && path17.length) {
+      if (path17 === ".")
         return this.root;
-      path16 = path16.split(".");
-    } else if (!path16.length)
+      path17 = path17.split(".");
+    } else if (!path17.length)
       return this;
-    var flatPath = path16.join(".");
-    if (path16[0] === "")
-      return this.root.lookup(path16.slice(1), filterTypes);
+    var flatPath = path17.join(".");
+    if (path17[0] === "")
+      return this.root.lookup(path17.slice(1), filterTypes);
     var found = this.root._fullyQualifiedObjects && this.root._fullyQualifiedObjects["." + flatPath];
     if (found && (!filterTypes || filterTypes.indexOf(found.constructor) > -1)) {
       return found;
     }
-    found = this._lookupImpl(path16, flatPath);
+    found = this._lookupImpl(path17, flatPath);
     if (found && (!filterTypes || filterTypes.indexOf(found.constructor) > -1)) {
       return found;
     }
@@ -63709,7 +63709,7 @@ var require_namespace = __commonJS((exports, module) => {
       return null;
     var current = this;
     while (current.parent) {
-      found = current.parent._lookupImpl(path16, flatPath);
+      found = current.parent._lookupImpl(path17, flatPath);
       if (found && (!filterTypes || filterTypes.indexOf(found.constructor) > -1)) {
         return found;
       }
@@ -63717,22 +63717,22 @@ var require_namespace = __commonJS((exports, module) => {
     }
     return null;
   };
-  Namespace.prototype._lookupImpl = function lookup(path16, flatPath) {
+  Namespace.prototype._lookupImpl = function lookup(path17, flatPath) {
     if (Object.prototype.hasOwnProperty.call(this._lookupCache, flatPath)) {
       return this._lookupCache[flatPath];
     }
-    var found = this.get(path16[0]);
+    var found = this.get(path17[0]);
     var exact = null;
     if (found) {
-      if (path16.length === 1) {
+      if (path17.length === 1) {
         exact = found;
       } else if (found instanceof Namespace) {
-        path16 = path16.slice(1);
-        exact = found._lookupImpl(path16, path16.join("."));
+        path17 = path17.slice(1);
+        exact = found._lookupImpl(path17, path17.join("."));
       }
     } else {
       for (var i2 = 0;i2 < this.nestedArray.length; ++i2)
-        if (this._nestedArray[i2] instanceof Namespace && (found = this._nestedArray[i2]._lookupImpl(path16, flatPath))) {
+        if (this._nestedArray[i2] instanceof Namespace && (found = this._nestedArray[i2]._lookupImpl(path17, flatPath))) {
           exact = found;
           break;
         }
@@ -63740,28 +63740,28 @@ var require_namespace = __commonJS((exports, module) => {
     this._lookupCache[flatPath] = exact;
     return exact;
   };
-  Namespace.prototype.lookupType = function lookupType(path16) {
-    var found = this.lookup(path16, [Type4]);
+  Namespace.prototype.lookupType = function lookupType(path17) {
+    var found = this.lookup(path17, [Type4]);
     if (!found)
-      throw Error("no such type: " + path16);
+      throw Error("no such type: " + path17);
     return found;
   };
-  Namespace.prototype.lookupEnum = function lookupEnum(path16) {
-    var found = this.lookup(path16, [Enum]);
+  Namespace.prototype.lookupEnum = function lookupEnum(path17) {
+    var found = this.lookup(path17, [Enum]);
     if (!found)
-      throw Error("no such Enum '" + path16 + "' in " + this);
+      throw Error("no such Enum '" + path17 + "' in " + this);
     return found;
   };
-  Namespace.prototype.lookupTypeOrEnum = function lookupTypeOrEnum(path16) {
-    var found = this.lookup(path16, [Type4, Enum]);
+  Namespace.prototype.lookupTypeOrEnum = function lookupTypeOrEnum(path17) {
+    var found = this.lookup(path17, [Type4, Enum]);
     if (!found)
-      throw Error("no such Type or Enum '" + path16 + "' in " + this);
+      throw Error("no such Type or Enum '" + path17 + "' in " + this);
     return found;
   };
-  Namespace.prototype.lookupService = function lookupService(path16) {
-    var found = this.lookup(path16, [Service]);
+  Namespace.prototype.lookupService = function lookupService(path17) {
+    var found = this.lookup(path17, [Service]);
     if (!found)
-      throw Error("no such Service '" + path16 + "' in " + this);
+      throw Error("no such Service '" + path17 + "' in " + this);
     return found;
   };
   Namespace._configure = function(Type_, Service_, Enum_) {
@@ -65094,13 +65094,13 @@ var require_util3 = __commonJS((exports, module) => {
     Object.defineProperty(object4, "$type", { value: enm, enumerable: false });
     return enm;
   };
-  util2.setProperty = function setProperty2(dst, path16, value, ifNotSet) {
-    function setProp(dst2, path17, value2) {
-      var part = path17.shift();
+  util2.setProperty = function setProperty2(dst, path17, value, ifNotSet) {
+    function setProp(dst2, path18, value2) {
+      var part = path18.shift();
       if (util2.isUnsafeProperty(part))
         return dst2;
-      if (path17.length > 0) {
-        dst2[part] = setProp(dst2[part] || {}, path17, value2);
+      if (path18.length > 0) {
+        dst2[part] = setProp(dst2[part] || {}, path18, value2);
       } else {
         var prevValue = dst2[part];
         if (prevValue && ifNotSet)
@@ -65113,12 +65113,12 @@ var require_util3 = __commonJS((exports, module) => {
     }
     if (typeof dst !== "object")
       throw TypeError("dst must be an object");
-    if (!path16)
+    if (!path17)
       throw TypeError("path must be specified");
-    path16 = path16.split(".");
-    if (path16.length > util2.recursionLimit)
+    path17 = path17.split(".");
+    if (path17.length > util2.recursionLimit)
       throw Error("max depth exceeded");
-    return setProp(dst, path16, value);
+    return setProp(dst, path17, value);
   };
   Object.defineProperty(util2, "decorateRoot", {
     get: function() {
@@ -65560,12 +65560,12 @@ var require_object = __commonJS((exports, module) => {
     },
     fullName: {
       get: function() {
-        var path16 = [this.name], ptr = this.parent;
+        var path17 = [this.name], ptr = this.parent;
         while (ptr) {
-          path16.unshift(ptr.name);
+          path17.unshift(ptr.name);
           ptr = ptr.parent;
         }
-        return path16.join(".");
+        return path17.join(".");
       }
     }
   });
@@ -69388,19 +69388,19 @@ var require_type3 = __commonJS((exports, module) => {
 var require_util4 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.addCommonProtos = exports.loadProtosWithOptionsSync = exports.loadProtosWithOptions = undefined;
-  var fs11 = __require("fs");
-  var path16 = __require("path");
+  var fs12 = __require("fs");
+  var path17 = __require("path");
   var Protobuf = require_src17();
   function addIncludePathResolver(root, includePaths) {
     const originalResolvePath = root.resolvePath;
     root.resolvePath = (origin, target) => {
-      if (path16.isAbsolute(target)) {
+      if (path17.isAbsolute(target)) {
         return target;
       }
       for (const directory of includePaths) {
-        const fullPath = path16.join(directory, target);
+        const fullPath = path17.join(directory, target);
         try {
-          fs11.accessSync(fullPath, fs11.constants.R_OK);
+          fs12.accessSync(fullPath, fs12.constants.R_OK);
           return fullPath;
         } catch (err) {
           continue;
@@ -71718,7 +71718,7 @@ var require_subchannel_call = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Http2SubchannelCall = undefined;
   var http2 = __require("http2");
-  var os7 = __require("os");
+  var os8 = __require("os");
   var constants_1 = require_constants2();
   var metadata_1 = require_metadata();
   var stream_decoder_1 = require_stream_decoder();
@@ -71726,7 +71726,7 @@ var require_subchannel_call = __commonJS((exports) => {
   var constants_2 = require_constants2();
   var TRACER_NAME = "subchannel_call";
   function getSystemErrorName(errno) {
-    for (const [name21, num] of Object.entries(os7.constants.errno)) {
+    for (const [name21, num] of Object.entries(os8.constants.errno)) {
       if (num === errno) {
         return name21;
       }
@@ -74526,9 +74526,9 @@ var require_server_call = __commonJS((exports) => {
   }
 
   class ServerUnaryCallImpl extends events_1.EventEmitter {
-    constructor(path16, call, metadata, request) {
+    constructor(path17, call, metadata, request) {
       super();
-      this.path = path16;
+      this.path = path17;
       this.call = call;
       this.metadata = metadata;
       this.request = request;
@@ -74559,9 +74559,9 @@ var require_server_call = __commonJS((exports) => {
   exports.ServerUnaryCallImpl = ServerUnaryCallImpl;
 
   class ServerReadableStreamImpl extends stream_1.Readable {
-    constructor(path16, call, metadata) {
+    constructor(path17, call, metadata) {
       super({ objectMode: true });
-      this.path = path16;
+      this.path = path17;
       this.call = call;
       this.metadata = metadata;
       this.cancelled = false;
@@ -74594,9 +74594,9 @@ var require_server_call = __commonJS((exports) => {
   exports.ServerReadableStreamImpl = ServerReadableStreamImpl;
 
   class ServerWritableStreamImpl extends stream_1.Writable {
-    constructor(path16, call, metadata, request) {
+    constructor(path17, call, metadata, request) {
       super({ objectMode: true });
-      this.path = path16;
+      this.path = path17;
       this.call = call;
       this.metadata = metadata;
       this.request = request;
@@ -74650,9 +74650,9 @@ var require_server_call = __commonJS((exports) => {
   exports.ServerWritableStreamImpl = ServerWritableStreamImpl;
 
   class ServerDuplexStreamImpl extends stream_1.Duplex {
-    constructor(path16, call, metadata) {
+    constructor(path17, call, metadata) {
       super({ objectMode: true });
-      this.path = path16;
+      this.path = path17;
       this.call = call;
       this.metadata = metadata;
       this.pendingStatus = {
@@ -76852,11 +76852,11 @@ var require_server = __commonJS((exports) => {
         }
         return true;
       }
-      _retrieveHandler(path16) {
-        serverCallTrace("Received call to method " + path16 + " at address " + this.serverAddressString);
-        const handler = this.handlers.get(path16);
+      _retrieveHandler(path17) {
+        serverCallTrace("Received call to method " + path17 + " at address " + this.serverAddressString);
+        const handler = this.handlers.get(path17);
         if (handler === undefined) {
-          serverCallTrace("No handler registered for method " + path16 + ". Sending UNIMPLEMENTED status.");
+          serverCallTrace("No handler registered for method " + path17 + ". Sending UNIMPLEMENTED status.");
           return null;
         }
         return handler;
@@ -76879,10 +76879,10 @@ var require_server = __commonJS((exports) => {
           channelzSessionInfo === null || channelzSessionInfo === undefined || channelzSessionInfo.streamTracker.addCallFailed();
           return;
         }
-        const path16 = headers[HTTP2_HEADER_PATH];
-        const handler = this._retrieveHandler(path16);
+        const path17 = headers[HTTP2_HEADER_PATH];
+        const handler = this._retrieveHandler(path17);
         if (!handler) {
-          this._respondWithError(getUnimplementedStatusResponse(path16), stream, channelzSessionInfo);
+          this._respondWithError(getUnimplementedStatusResponse(path17), stream, channelzSessionInfo);
           return;
         }
         const callEventTracker = {
@@ -76931,10 +76931,10 @@ var require_server = __commonJS((exports) => {
         if (this._verifyContentType(stream, headers) !== true) {
           return;
         }
-        const path16 = headers[HTTP2_HEADER_PATH];
-        const handler = this._retrieveHandler(path16);
+        const path17 = headers[HTTP2_HEADER_PATH];
+        const handler = this._retrieveHandler(path17);
         if (!handler) {
-          this._respondWithError(getUnimplementedStatusResponse(path16), stream, null);
+          this._respondWithError(getUnimplementedStatusResponse(path17), stream, null);
           return;
         }
         const call = (0, server_interceptors_1.getServerInterceptingCall)([...extraInterceptors, ...this.interceptors], stream, headers, null, handler, this.options);
@@ -77913,7 +77913,7 @@ var require_load_balancer_pick_first = __commonJS((exports) => {
 var require_certificate_provider = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FileWatcherCertificateProvider = undefined;
-  var fs11 = __require("fs");
+  var fs12 = __require("fs");
   var logging = require_logging();
   var constants_1 = require_constants2();
   var util_1 = __require("util");
@@ -77921,7 +77921,7 @@ var require_certificate_provider = __commonJS((exports) => {
   function trace2(text2) {
     logging.trace(constants_1.LogVerbosity.DEBUG, TRACER_NAME, text2);
   }
-  var readFilePromise = (0, util_1.promisify)(fs11.readFile);
+  var readFilePromise = (0, util_1.promisify)(fs12.readFile);
 
   class FileWatcherCertificateProvider {
     constructor(config4) {
@@ -78172,13 +78172,13 @@ var require_resolver_uds = __commonJS((exports) => {
       this.listener = listener;
       this.hasReturnedResult = false;
       this.endpoints = [];
-      let path16;
+      let path17;
       if (target.authority === "") {
-        path16 = "/" + target.path;
+        path17 = "/" + target.path;
       } else {
-        path16 = target.path;
+        path17 = target.path;
       }
-      this.endpoints = [{ addresses: [{ path: path16 }] }];
+      this.endpoints = [{ addresses: [{ path: path17 }] }];
     }
     updateResolution() {
       if (!this.hasReturnedResult) {
@@ -78236,12 +78236,12 @@ var require_resolver_ip = __commonJS((exports) => {
         return;
       }
       const pathList = target.path.split(",");
-      for (const path16 of pathList) {
-        const hostPort = (0, uri_parser_1.splitHostPort)(path16);
+      for (const path17 of pathList) {
+        const hostPort = (0, uri_parser_1.splitHostPort)(path17);
         if (hostPort === null) {
           this.error = {
             code: constants_1.Status.UNAVAILABLE,
-            details: `Failed to parse ${target.scheme} address ${path16}`,
+            details: `Failed to parse ${target.scheme} address ${path17}`,
             metadata: new metadata_1.Metadata
           };
           return;
@@ -78249,7 +78249,7 @@ var require_resolver_ip = __commonJS((exports) => {
         if (target.scheme === IPV4_SCHEME && !(0, net_1.isIPv4)(hostPort.host) || target.scheme === IPV6_SCHEME && !(0, net_1.isIPv6)(hostPort.host)) {
           this.error = {
             code: constants_1.Status.UNAVAILABLE,
-            details: `Failed to parse ${target.scheme} address ${path16}`,
+            details: `Failed to parse ${target.scheme} address ${path17}`,
             metadata: new metadata_1.Metadata
           };
           return;
@@ -79540,10 +79540,10 @@ var require_create_service_client_constructor = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.createServiceClientConstructor = undefined;
   var grpc = require_src19();
-  function createServiceClientConstructor(path16, name21) {
+  function createServiceClientConstructor(path17, name21) {
     const serviceDefinition = {
       export: {
-        path: path16,
+        path: path17,
         requestStream: false,
         responseStream: false,
         requestSerialize: (arg) => {
@@ -79746,8 +79746,8 @@ var require_otlp_grpc_env_configuration = __commonJS((exports) => {
   var core_1 = require_src3();
   var grpc_exporter_transport_1 = require_grpc_exporter_transport();
   var node_http_1 = require_index_node_http();
-  var fs11 = __require("fs");
-  var path16 = __require("path");
+  var fs12 = __require("fs");
+  var path17 = __require("path");
   var api_1 = require_src();
   function fallbackIfNullishOrBlank(signalSpecific, nonSignalSpecific) {
     if (signalSpecific != null && signalSpecific !== "") {
@@ -79796,7 +79796,7 @@ var require_otlp_grpc_env_configuration = __commonJS((exports) => {
     const filePath = fallbackIfNullishOrBlank(signalSpecificPath, nonSignalSpecificPath);
     if (filePath != null) {
       try {
-        return fs11.readFileSync(path16.resolve(process.cwd(), filePath));
+        return fs12.readFileSync(path17.resolve(process.cwd(), filePath));
       } catch {
         api_1.diag.warn(warningMessage);
         return;
@@ -83048,17 +83048,17 @@ var require_visit = __commonJS((exports) => {
   visit3.BREAK = BREAK;
   visit3.SKIP = SKIP;
   visit3.REMOVE = REMOVE;
-  function visit_(key, node, visitor, path16) {
-    const ctrl = callVisitor(key, node, visitor, path16);
+  function visit_(key, node, visitor, path17) {
+    const ctrl = callVisitor(key, node, visitor, path17);
     if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-      replaceNode(key, path16, ctrl);
-      return visit_(key, ctrl, visitor, path16);
+      replaceNode(key, path17, ctrl);
+      return visit_(key, ctrl, visitor, path17);
     }
     if (typeof ctrl !== "symbol") {
       if (identity.isCollection(node)) {
-        path16 = Object.freeze(path16.concat(node));
+        path17 = Object.freeze(path17.concat(node));
         for (let i2 = 0;i2 < node.items.length; ++i2) {
-          const ci = visit_(i2, node.items[i2], visitor, path16);
+          const ci = visit_(i2, node.items[i2], visitor, path17);
           if (typeof ci === "number")
             i2 = ci - 1;
           else if (ci === BREAK)
@@ -83069,13 +83069,13 @@ var require_visit = __commonJS((exports) => {
           }
         }
       } else if (identity.isPair(node)) {
-        path16 = Object.freeze(path16.concat(node));
-        const ck = visit_("key", node.key, visitor, path16);
+        path17 = Object.freeze(path17.concat(node));
+        const ck = visit_("key", node.key, visitor, path17);
         if (ck === BREAK)
           return BREAK;
         else if (ck === REMOVE)
           node.key = null;
-        const cv = visit_("value", node.value, visitor, path16);
+        const cv = visit_("value", node.value, visitor, path17);
         if (cv === BREAK)
           return BREAK;
         else if (cv === REMOVE)
@@ -83096,17 +83096,17 @@ var require_visit = __commonJS((exports) => {
   visitAsync.BREAK = BREAK;
   visitAsync.SKIP = SKIP;
   visitAsync.REMOVE = REMOVE;
-  async function visitAsync_(key, node, visitor, path16) {
-    const ctrl = await callVisitor(key, node, visitor, path16);
+  async function visitAsync_(key, node, visitor, path17) {
+    const ctrl = await callVisitor(key, node, visitor, path17);
     if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-      replaceNode(key, path16, ctrl);
-      return visitAsync_(key, ctrl, visitor, path16);
+      replaceNode(key, path17, ctrl);
+      return visitAsync_(key, ctrl, visitor, path17);
     }
     if (typeof ctrl !== "symbol") {
       if (identity.isCollection(node)) {
-        path16 = Object.freeze(path16.concat(node));
+        path17 = Object.freeze(path17.concat(node));
         for (let i2 = 0;i2 < node.items.length; ++i2) {
-          const ci = await visitAsync_(i2, node.items[i2], visitor, path16);
+          const ci = await visitAsync_(i2, node.items[i2], visitor, path17);
           if (typeof ci === "number")
             i2 = ci - 1;
           else if (ci === BREAK)
@@ -83117,13 +83117,13 @@ var require_visit = __commonJS((exports) => {
           }
         }
       } else if (identity.isPair(node)) {
-        path16 = Object.freeze(path16.concat(node));
-        const ck = await visitAsync_("key", node.key, visitor, path16);
+        path17 = Object.freeze(path17.concat(node));
+        const ck = await visitAsync_("key", node.key, visitor, path17);
         if (ck === BREAK)
           return BREAK;
         else if (ck === REMOVE)
           node.key = null;
-        const cv = await visitAsync_("value", node.value, visitor, path16);
+        const cv = await visitAsync_("value", node.value, visitor, path17);
         if (cv === BREAK)
           return BREAK;
         else if (cv === REMOVE)
@@ -83150,23 +83150,23 @@ var require_visit = __commonJS((exports) => {
     }
     return visitor;
   }
-  function callVisitor(key, node, visitor, path16) {
+  function callVisitor(key, node, visitor, path17) {
     if (typeof visitor === "function")
-      return visitor(key, node, path16);
+      return visitor(key, node, path17);
     if (identity.isMap(node))
-      return visitor.Map?.(key, node, path16);
+      return visitor.Map?.(key, node, path17);
     if (identity.isSeq(node))
-      return visitor.Seq?.(key, node, path16);
+      return visitor.Seq?.(key, node, path17);
     if (identity.isPair(node))
-      return visitor.Pair?.(key, node, path16);
+      return visitor.Pair?.(key, node, path17);
     if (identity.isScalar(node))
-      return visitor.Scalar?.(key, node, path16);
+      return visitor.Scalar?.(key, node, path17);
     if (identity.isAlias(node))
-      return visitor.Alias?.(key, node, path16);
+      return visitor.Alias?.(key, node, path17);
     return;
   }
-  function replaceNode(key, path16, node) {
-    const parent = path16[path16.length - 1];
+  function replaceNode(key, path17, node) {
+    const parent = path17[path17.length - 1];
     if (identity.isCollection(parent)) {
       parent.items[key] = node;
     } else if (identity.isPair(parent)) {
@@ -83725,10 +83725,10 @@ var require_Collection = __commonJS((exports) => {
   var createNode = require_createNode();
   var identity = require_identity();
   var Node = require_Node();
-  function collectionFromPath(schema, path16, value) {
+  function collectionFromPath(schema, path17, value) {
     let v2 = value;
-    for (let i2 = path16.length - 1;i2 >= 0; --i2) {
-      const k2 = path16[i2];
+    for (let i2 = path17.length - 1;i2 >= 0; --i2) {
+      const k2 = path17[i2];
       if (typeof k2 === "number" && Number.isInteger(k2) && k2 >= 0) {
         const a2 = [];
         a2[k2] = v2;
@@ -83747,7 +83747,7 @@ var require_Collection = __commonJS((exports) => {
       sourceObjects: new Map
     });
   }
-  var isEmptyPath = (path16) => path16 == null || typeof path16 === "object" && !!path16[Symbol.iterator]().next().done;
+  var isEmptyPath = (path17) => path17 == null || typeof path17 === "object" && !!path17[Symbol.iterator]().next().done;
 
   class Collection extends Node.NodeBase {
     constructor(type, schema) {
@@ -83768,11 +83768,11 @@ var require_Collection = __commonJS((exports) => {
         copy.range = this.range.slice();
       return copy;
     }
-    addIn(path16, value) {
-      if (isEmptyPath(path16))
+    addIn(path17, value) {
+      if (isEmptyPath(path17))
         this.add(value);
       else {
-        const [key, ...rest] = path16;
+        const [key, ...rest] = path17;
         const node = this.get(key, true);
         if (identity.isCollection(node))
           node.addIn(rest, value);
@@ -83782,8 +83782,8 @@ var require_Collection = __commonJS((exports) => {
           throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
       }
     }
-    deleteIn(path16) {
-      const [key, ...rest] = path16;
+    deleteIn(path17) {
+      const [key, ...rest] = path17;
       if (rest.length === 0)
         return this.delete(key);
       const node = this.get(key, true);
@@ -83792,8 +83792,8 @@ var require_Collection = __commonJS((exports) => {
       else
         throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
     }
-    getIn(path16, keepScalar) {
-      const [key, ...rest] = path16;
+    getIn(path17, keepScalar) {
+      const [key, ...rest] = path17;
       const node = this.get(key, true);
       if (rest.length === 0)
         return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -83808,15 +83808,15 @@ var require_Collection = __commonJS((exports) => {
         return n2 == null || allowScalar && identity.isScalar(n2) && n2.value == null && !n2.commentBefore && !n2.comment && !n2.tag;
       });
     }
-    hasIn(path16) {
-      const [key, ...rest] = path16;
+    hasIn(path17) {
+      const [key, ...rest] = path17;
       if (rest.length === 0)
         return this.has(key);
       const node = this.get(key, true);
       return identity.isCollection(node) ? node.hasIn(rest) : false;
     }
-    setIn(path16, value) {
-      const [key, ...rest] = path16;
+    setIn(path17, value) {
+      const [key, ...rest] = path17;
       if (rest.length === 0) {
         this.set(key, value);
       } else {
@@ -86209,9 +86209,9 @@ var require_Document = __commonJS((exports) => {
       if (assertCollection(this.contents))
         this.contents.add(value);
     }
-    addIn(path16, value) {
+    addIn(path17, value) {
       if (assertCollection(this.contents))
-        this.contents.addIn(path16, value);
+        this.contents.addIn(path17, value);
     }
     createAlias(node, name21) {
       if (!node.anchor) {
@@ -86260,30 +86260,30 @@ var require_Document = __commonJS((exports) => {
     delete(key) {
       return assertCollection(this.contents) ? this.contents.delete(key) : false;
     }
-    deleteIn(path16) {
-      if (Collection.isEmptyPath(path16)) {
+    deleteIn(path17) {
+      if (Collection.isEmptyPath(path17)) {
         if (this.contents == null)
           return false;
         this.contents = null;
         return true;
       }
-      return assertCollection(this.contents) ? this.contents.deleteIn(path16) : false;
+      return assertCollection(this.contents) ? this.contents.deleteIn(path17) : false;
     }
     get(key, keepScalar) {
       return identity.isCollection(this.contents) ? this.contents.get(key, keepScalar) : undefined;
     }
-    getIn(path16, keepScalar) {
-      if (Collection.isEmptyPath(path16))
+    getIn(path17, keepScalar) {
+      if (Collection.isEmptyPath(path17))
         return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-      return identity.isCollection(this.contents) ? this.contents.getIn(path16, keepScalar) : undefined;
+      return identity.isCollection(this.contents) ? this.contents.getIn(path17, keepScalar) : undefined;
     }
     has(key) {
       return identity.isCollection(this.contents) ? this.contents.has(key) : false;
     }
-    hasIn(path16) {
-      if (Collection.isEmptyPath(path16))
+    hasIn(path17) {
+      if (Collection.isEmptyPath(path17))
         return this.contents !== undefined;
-      return identity.isCollection(this.contents) ? this.contents.hasIn(path16) : false;
+      return identity.isCollection(this.contents) ? this.contents.hasIn(path17) : false;
     }
     set(key, value) {
       if (this.contents == null) {
@@ -86292,13 +86292,13 @@ var require_Document = __commonJS((exports) => {
         this.contents.set(key, value);
       }
     }
-    setIn(path16, value) {
-      if (Collection.isEmptyPath(path16)) {
+    setIn(path17, value) {
+      if (Collection.isEmptyPath(path17)) {
         this.contents = value;
       } else if (this.contents == null) {
-        this.contents = Collection.collectionFromPath(this.schema, Array.from(path16), value);
+        this.contents = Collection.collectionFromPath(this.schema, Array.from(path17), value);
       } else if (assertCollection(this.contents)) {
-        this.contents.setIn(path16, value);
+        this.contents.setIn(path17, value);
       }
     }
     setSchema(version4, options2 = {}) {
@@ -88195,9 +88195,9 @@ var require_cst_visit = __commonJS((exports) => {
   visit3.BREAK = BREAK;
   visit3.SKIP = SKIP;
   visit3.REMOVE = REMOVE;
-  visit3.itemAtPath = (cst, path16) => {
+  visit3.itemAtPath = (cst, path17) => {
     let item = cst;
-    for (const [field, index] of path16) {
+    for (const [field, index] of path17) {
       const tok = item?.[field];
       if (tok && "items" in tok) {
         item = tok.items[index];
@@ -88206,23 +88206,23 @@ var require_cst_visit = __commonJS((exports) => {
     }
     return item;
   };
-  visit3.parentCollection = (cst, path16) => {
-    const parent = visit3.itemAtPath(cst, path16.slice(0, -1));
-    const field = path16[path16.length - 1][0];
+  visit3.parentCollection = (cst, path17) => {
+    const parent = visit3.itemAtPath(cst, path17.slice(0, -1));
+    const field = path17[path17.length - 1][0];
     const coll = parent?.[field];
     if (coll && "items" in coll)
       return coll;
     throw new Error("Parent collection not found");
   };
-  function _visit(path16, item, visitor) {
-    let ctrl = visitor(item, path16);
+  function _visit(path17, item, visitor) {
+    let ctrl = visitor(item, path17);
     if (typeof ctrl === "symbol")
       return ctrl;
     for (const field of ["key", "value"]) {
       const token = item[field];
       if (token && "items" in token) {
         for (let i2 = 0;i2 < token.items.length; ++i2) {
-          const ci = _visit(Object.freeze(path16.concat([[field, i2]])), token.items[i2], visitor);
+          const ci = _visit(Object.freeze(path17.concat([[field, i2]])), token.items[i2], visitor);
           if (typeof ci === "number")
             i2 = ci - 1;
           else if (ci === BREAK)
@@ -88233,10 +88233,10 @@ var require_cst_visit = __commonJS((exports) => {
           }
         }
         if (typeof ctrl === "function" && field === "key")
-          ctrl = ctrl(item, path16);
+          ctrl = ctrl(item, path17);
       }
     }
-    return typeof ctrl === "function" ? ctrl(item, path16) : ctrl;
+    return typeof ctrl === "function" ? ctrl(item, path17) : ctrl;
   }
   exports.visit = visit3;
 });
@@ -89523,14 +89523,14 @@ var require_parser = __commonJS((exports) => {
           case "scalar":
           case "single-quoted-scalar":
           case "double-quoted-scalar": {
-            const fs11 = this.flowScalar(this.type);
+            const fs12 = this.flowScalar(this.type);
             if (atNextItem || it.value) {
-              map3.items.push({ start, key: fs11, sep: [] });
+              map3.items.push({ start, key: fs12, sep: [] });
               this.onKeyLine = true;
             } else if (it.sep) {
-              this.stack.push(fs11);
+              this.stack.push(fs12);
             } else {
-              Object.assign(it, { key: fs11, sep: [] });
+              Object.assign(it, { key: fs12, sep: [] });
               this.onKeyLine = true;
             }
             return;
@@ -89658,13 +89658,13 @@ var require_parser = __commonJS((exports) => {
           case "scalar":
           case "single-quoted-scalar":
           case "double-quoted-scalar": {
-            const fs11 = this.flowScalar(this.type);
+            const fs12 = this.flowScalar(this.type);
             if (!it || it.value)
-              fc.items.push({ start: [], key: fs11, sep: [] });
+              fc.items.push({ start: [], key: fs12, sep: [] });
             else if (it.sep)
-              this.stack.push(fs11);
+              this.stack.push(fs12);
             else
-              Object.assign(it, { key: fs11, sep: [] });
+              Object.assign(it, { key: fs12, sep: [] });
             return;
           }
           case "flow-map-end":
@@ -89972,7 +89972,7 @@ var require_FileConfigFactory = __commonJS((exports) => {
   exports.setLoggerProvider = exports.getSeverity = exports.setMeterProvider = exports.getTemporalityPreference = exports.setTracerProvider = exports.setPropagator = exports.setAttributeLimits = exports.setResourceAttributes = exports.parseConfigFile = exports.hasValidConfigFile = exports.FileConfigFactory = undefined;
   var core_1 = require_src3();
   var configModel_1 = require_configModel();
-  var fs11 = __require("fs");
+  var fs12 = __require("fs");
   var yaml = require_dist2();
   var utils_1 = require_utils14();
   var commonModel_1 = require_commonModel();
@@ -89995,7 +89995,7 @@ var require_FileConfigFactory = __commonJS((exports) => {
   function hasValidConfigFile() {
     const configFile = (0, core_1.getStringFromEnv)("OTEL_CONFIG_FILE");
     if (configFile) {
-      if (!(configFile.endsWith(".yaml") || configFile.endsWith(".yml")) || !fs11.existsSync(configFile)) {
+      if (!(configFile.endsWith(".yaml") || configFile.endsWith(".yml")) || !fs12.existsSync(configFile)) {
         api_1.diag.warn(`Config file ${configFile} set on OTEL_CONFIG_FILE is not valid`);
         return false;
       }
@@ -90007,7 +90007,7 @@ var require_FileConfigFactory = __commonJS((exports) => {
   function parseConfigFile(config4) {
     const supportedFileVersions = ["1.0-rc.3"];
     const configFile = (0, core_1.getStringFromEnv)("OTEL_CONFIG_FILE") || "";
-    const file3 = fs11.readFileSync(configFile, "utf8");
+    const file3 = fs12.readFileSync(configFile, "utf8");
     const parsedContent = yaml.parse(file3);
     if (parsedContent["file_format"] && supportedFileVersions.includes(parsedContent["file_format"])) {
       const disabled = (0, utils_1.getBooleanFromConfigFile)(parsedContent["disabled"]);
@@ -92866,7 +92866,7 @@ var init_client = __esm(() => {
 });
 
 // ../opencode/src/auth/user-session/util.ts
-import os7 from "os";
+import os8 from "os";
 function cleanURL(value) {
   const input = readString(value);
   if (!input)
@@ -92874,7 +92874,7 @@ function cleanURL(value) {
   return input.replace(/\/$/, "");
 }
 function defaultDeviceName() {
-  return `${os7.hostname()} (${process.platform})`;
+  return `${os8.hostname()} (${process.platform})`;
 }
 function endpointURL(baseURL, suffix) {
   const target = new URL(baseURL);
@@ -93317,14 +93317,14 @@ var init_state2 = __esm(async () => {
 });
 
 // ../opencode/src/auth/user-session/storage.ts
-import fs11 from "fs/promises";
-import os8 from "os";
-import path16 from "path";
+import fs12 from "fs/promises";
+import os9 from "os";
+import path17 from "path";
 function filePath() {
-  return path16.join(Global.Path.data, "auth", "session.json");
+  return path17.join(Global.Path.data, "auth", "session.json");
 }
 function displayPath() {
-  const homedir = os8.homedir();
+  const homedir = os9.homedir();
   const filepath = filePath();
   return filepath.startsWith(homedir) ? filepath.replace(homedir, "~") : filepath;
 }
@@ -93332,7 +93332,7 @@ async function load() {
   const target = filePath();
   try {
     using _2 = await Lock.read(target);
-    const raw = await fs11.readFile(target, "utf-8");
+    const raw = await fs12.readFile(target, "utf-8");
     return Stored.parse(JSON.parse(raw));
   } catch (error92) {
     if (isMissingError(error92))
@@ -93355,20 +93355,20 @@ async function loadStrict() {
 async function save(input) {
   const parsed = Stored.parse(input);
   const target = filePath();
-  const dir = path16.dirname(target);
+  const dir = path17.dirname(target);
   const temp = `${target}.tmp`;
   using _2 = await Lock.write(target);
-  await fs11.mkdir(dir, { recursive: true });
-  await fs11.writeFile(temp, JSON.stringify(parsed, null, 2));
-  await fs11.chmod(temp, 384);
-  await fs11.rename(temp, target);
-  await fs11.chmod(target, 384);
+  await fs12.mkdir(dir, { recursive: true });
+  await fs12.writeFile(temp, JSON.stringify(parsed, null, 2));
+  await fs12.chmod(temp, 384);
+  await fs12.rename(temp, target);
+  await fs12.chmod(target, 384);
   return parsed;
 }
 async function clear() {
   const target = filePath();
   using _2 = await Lock.write(target);
-  await fs11.unlink(target).catch((error92) => {
+  await fs12.unlink(target).catch((error92) => {
     if (!isMissingError(error92))
       throw error92;
   });
@@ -96145,6 +96145,545 @@ class GovernedSkillTool {
     };
   }
 }
+// ../core/src/skills/embedded-skills.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+// ../core/src/skills/embedded-skills.generated.ts
+var EMBEDDED_KIFARU_SKILLS = [
+  { dir: "kifaru-claim-discipline", content: `---
+name: kifaru-claim-discipline
+description: "Use when reporting findings or writing assessment claims. Enforces bottom-up claim writing: CVE-version consistency, CVSS base vectors only, impact grounded to proven primitives, and uniform credential redaction."
+---
+
+# Kifaru Claim Discipline
+
+The report is judged by its weakest claim. This skill encodes the \`REPORT_CONTRACT\` + report-lint rules (opencode \`report-contract.ts\`) and the RQ-01..04 remediation from the pi run-quality review, so every published claim is bottom-up from proven evidence. The mechanical lint lives in the \`kifaru_report_lint\` extension; this skill is the writing discipline that makes the lint pass.
+
+## Claim Rules
+
+1. **Bottom-up impact.** Write "I did X, observed Y". Never "could/may/potentially lead to". If you did not prove it, do not claim it. Impact is grounded to the **last confirmed primitive** and its privilege level: \`whoami \u2192 www-data\` reads as "RCE as unprivileged web user", never "root shell".
+2. **Severity is a CVSS 3.1 base vector.** Bare scores ("10/10 CRITICAL") are never published. Each metric is justified by what was verified (access vector, privileges, scope, confidentiality/integrity/availability impact). Base metrics only \u2014 Temporal/Environmental adjustments belong to the client, and reflexively maxing to 9.8 is a triage red flag.
+3. **CVE\u2194version consistency.** A CVE claim must match the running version: banner/server/package version evidence must fall inside the CVE's affected range. Otherwise use the honest framing: \`[observed behavior: <what happened> on <version>] (CVE-\u2026 applies to <different range>; attribution unverified for this banner)\` \u2014 and drop the CVE from the title.
+4. **Uniform credential redaction.** Every secret shape (\`password=\`, \`sk_live_\`, \`AKIA\`, JWTs with non-masked payloads, DB_PASSWORD, JWT_SECRET, Stripe/Mailgun keys) is masked everywhere, consistently, including in "sanitized" sections. If a section says sanitized, it is sanitized.
+5. **Evidence-bound scope.** Every origin exercised must fall inside the attested scope set. If a dev/staging origin differs from the top-level target, say explicitly whether it is in scope \u2014 never imply it.
+6. **No scaffolding slop.** No OWASP/CWE boilerplate paragraphs, no "in conclusion / it is important to note / as shown above / etc.", no generic mitigations. One line of class context at most.
+
+## Report Shape (per finding, in order)
+
+Description \u2192 Vulnerability discovery \u2192 Proof of Concept (replayable, raw request/response or exact commands, tokens stripped) \u2192 Exploitation (atomic steps, preconditions stated) \u2192 Impact (bottom-up) \u2192 Remediation (optional) \u2192 References (optional).
+
+## Prove the primitive, then STOP
+
+Do not mass-exfiltrate data or run destructive post-exploitation to "demonstrate" impact. The minimal proof that confirms the boundary is the proof that ships.
+` },
+  { dir: "kifaru-coverage-method", content: `---
+name: kifaru-coverage-method
+description: Use during and after an assessment to track coverage of (Asset x Vulnerability Class) cells, record why cells are blocked instead of silently skipped, and decide when a hunt is honestly complete.
+---
+
+# Kifaru Coverage Method
+
+A hunt is not complete until **every (Asset \xD7 Vulnerability Class) cell is accounted for**. Skipping cells silently is how findings are missed; claiming coverage without evidence is how reports are rejected. This skill carries the opencode \`CoverageManager\` / \`PivotEngine\` discipline into the Pi runtime as a method (the machine-readable state lives in the \`kifaru_coverage\` extension).
+
+## Cell Model
+
+Track cells \`(asset, vuln_class)\`. Each must reach a **terminal state**:
+
+| State               | Meaning                                                                |
+| ------------------- | ---------------------------------------------------------------------- |
+| \`TESTED_SAFE\`       | Actively tested, no vulnerability found \u2014 with the test that proves it |
+| \`VERIFIED\`          | Finding confirmed with minimal proof                                   |
+| \`GHOST\`             | Asset unreachable (DNS dead, removed) \u2014 with the probe                 |
+| \`JUSTIFIED_BLOCKED\` | Formally justified why testing was impossible \u2014 not "I skipped it"     |
+
+\`PENDING\` and \`OBSTRUCTED\` are **not terminal**. They must be resolved, pivoted, or formally justified.
+
+## Blocked Cells \u2192 Pivot, Don't Skip
+
+When a cell is obstructed (WAF, rate limit, auth wall, challenge, 404-everything), try in order:
+
+1. **Alternate route**: different endpoint/version/param/Header/Case, hidden or legacy paths, mobile or third-party client surfaces.
+2. **Alternate signal**: passive indicators (source, config, bundle) instead of live behavior; error-differential instead of direct access.
+3. **Alternate timing**: slow rate, authenticated context, off-peak, or single low-noise retry (respect limits).
+4. **Escalation to operator**: if a legitimately blocked cell is material to the assessment, surface it as a question \u2014 a formal \`JUSTIFIED_BLOCKED\` needs an explicit reason such as "WAF challenge on /admin; no bypass found after pivot attempts; manual testing recommended."
+
+Record for every blocked cell: the attempts, the reason, and why a pivot was not possible.
+
+## Honest Completion
+
+Before finishing a stage, produce the coverage ledger and check:
+
+- No cell left \`PENDING\`/\`OBSTRUCTED\` without an explicit reason.
+- Every \`TESTED_SAFE\` has its decisive test; every \`VERIFIED\` has its minimal proof.
+- Ghost and justified-blocked counts are proportionate to effort \u2014 many of either without evidence reads as skimming.
+- Completion criteria from the workflow are mapped onto covered cells; anything un-mapped is called out.
+
+The ledger feeds the report's scope/honesty claims; it must survive the \`kifaru-claim-discipline\` review.
+` },
+  { dir: "kifaru-hunt-intake", content: `---
+name: kifaru-hunt-intake
+description: Use at the start of an authorized Kifaru hunt or assessment to convert scope, target material, repo context, logs, captures, or notes into a concise operating brief, select the right workflow, preserve authorization limits, and define falsifiable research theses before running tools.
+---
+
+# Kifaru Hunt Intake
+
+Use this skill first when a security task is broad, ambiguous, multi-domain, or likely to turn into a live hunt. Read-only planning skill: it provides instructions only, it does not authorize activity by itself.
+
+## Operating Contract
+
+Keep the platform's system, operator, and safety prompts ahead of this skill. Preserve the authorization limits recorded for this run: in-scope assets, allowed actions, constraints, and proof limits. If scope or authorization is missing, stay passive: local artifact review, threat modeling, report drafting, or questions for the operator.
+
+## Intake Flow
+
+1. **Normalize the target.** Extract assets, repo paths, apps, packages, APIs, domains, accounts, cloud tenants, and environment assumptions. Separate confirmed facts from claims and missing data.
+2. **Build the trust map.** Identify principals, roles, tenants, tokens, object ownership, control/data plane boundaries, async workers, webhooks, external integrations, and admin/support paths.
+3. **Choose the narrowest next skill.** Web/API/SaaS/local source \u2192 \`kifaru-web-app-review\`; APK/IPA/mobile SDK \u2192 \`kifaru-mobile-app-review\`; IAM/cloud/Kubernetes \u2192 \`kifaru-cloud-identity-review\`; dependencies/CI/CD \u2192 \`kifaru-supply-chain-review\`; AI/ML/LLM/agent systems \u2192 \`kifaru-ai-agent-review\`; confirmed finding \u2192 \`kifaru-vulnerability-report\`.
+4. **Convert leads into theses** (see \`kifaru-hypothesis-engineering\`):
+   - Invariant: the security rule that must hold.
+   - Negative-space source: the overlooked state, role, parser, lifecycle step, cache, wrapper, or trust handoff.
+   - Reachability: the exact role, endpoint, file, input, state, version, feature gate, or integration path.
+   - Disproof plan: the fastest safe way to kill the idea.
+   - Minimal proof: the smallest scoped evidence that confirms impact.
+   - Impact ceiling: the strongest defensible impact without speculation.
+5. **Pick the first tool path.** Prefer \`read\`, \`grep\`, \`find\`, \`ls\` for local evidence; \`bash\` for controlled, scoped probes; the platform's governed hunt/file tools when available. Use current external context (\`webfetch\`/search) only when needed and allowed.
+
+## Quality Gate
+
+Do not call a lead a vulnerability until it has:
+
+- A real security boundary.
+- Reachability from an in-scope starting point.
+- Evidence from source, config, request/response, logs, runtime behavior, or a minimal proof.
+- Passed the \`kifaru-verification-discipline\` checks.
+- Survived \`kifaru-claim-discipline\` wording before it appears in a report.
+` },
+  { dir: "kifaru-hypothesis-engineering", content: `---
+name: kifaru-hypothesis-engineering
+description: Use before testing any input or endpoint. Converts leads into falsifiable research theses with invariants, negative-space sources, reachability, disproof plans, and minimal proof, so hunting is intent-driven instead of checklist-driven.
+---
+
+# Kifaru Hypothesis Engineering
+
+Hunting is a series of **falsifiable experiments**, not a checklist. A thesis that cannot be killed cheaply is not ready to test. This skill carries the hypothesis discipline from the opencode \`HypothesisEngine\` into the Pi runtime.
+
+## Thesis Template
+
+For every candidate, write one line each:
+
+1. **Invariant** \u2014 the security rule that must hold if the system is safe (e.g., "a tenant can only read objects it owns", "a token from user A cannot mint user B sessions").
+2. **Negative-space source** \u2014 the overlooked state/role/parser/lifecycle step/cache/wrapper/trust handoff where the invariant is most likely broken (e.g., "IDOR in the CSV export path, not the JSON one").
+3. **Reachability** \u2014 the exact role, endpoint, file, input, state, version, feature gate, or integration path that reaches the source.
+4. **Disproof plan** \u2014 the fastest safe way to kill the idea (e.g., "call as tenant B, get empty list \u2192 dead").
+5. **Minimal proof** \u2014 the smallest scoped evidence that would confirm impact (e.g., "tenant B sees tenant A's object name in export").
+6. **Impact ceiling** \u2014 the strongest defensible impact without speculation (e.g., "cross-tenant read of one object", NOT "full database dump").
+
+## Rules
+
+- **One thesis per probe.** A request that could confirm three theses confirms none; ambiguity is how false positives get born.
+- **Test the cheapest kills first.** Cheap disproof beats deep exploitation. Prioritize theses by (cost to kill) \xD7 (impact ceiling).
+- **Record outcomes.** Every thesis ends in: confirmed, dead, or obstructed \u2014 with the evidence. Obstructed theses feeding \`kifaru-coverage-method\` justifications.
+- **No novelty for its own sake.** Escalate technique only when a conventional test is disproven AND the target hasn't seen that class (see \`kifaru-playbook-waf-bypass\`).
+- **Reuse playbooks.** For known classes, open the matching playbook (\`kifaru-playbook-idor\`, \`business-logic\`, \`race-condition\`, \`graphql\`, \`auth-flow\`, \`waf-bypass\`) and adapt its checks into theses for THIS target, not verbatim scans.
+
+## Anti-Patterns
+
+- Blind fuzzing without an invariant.
+- "Let's try every payload in the list" as a first move.
+- Confirming a symptom without the boundary ("we got 500s, could be anything").
+- Testing out of reachability scope.
+` },
+  { dir: "kifaru-playbook-auth-flow", content: `---
+name: kifaru-playbook-auth-flow
+description: "Use when testing authentication and session flows: login, password reset, account recovery, OAuth/SSO callbacks, session issuance, MFA, and token handling. Covers flow-level flaws code review often misses."
+---
+
+# Auth-Flow Playbook
+
+Carries the opencode \`auth-flow-hunter\` methodology into the Pi runtime. Auth flaws live in the _sequence_ of a flow, not in one endpoint \u2014 every check names the flow invariant first.
+
+## Flow Invariants to Name
+
+- Login: "only a valid credential pair issues a session for that identity".
+- Reset/recovery: "the recovery proof (token/code) is single-use, bound to the account, and issued to the owner's channel".
+- OAuth/SSO: "the callback validates state, nonce, and binds the returned identity to the session that started the flow".
+- MFA: "a second factor is required for the whole session, not bypassable by a different path".
+- Session: "a session can only act as its own identity; revocation takes effect".
+
+## Thesis Sources
+
+1. **Reset-flow split-brain**: the token is checked in one endpoint but the account is changed in another; IDOR on \`user_id\` in the reset/verify call; token valid for any account (bound to mailbox but not account).
+2. **Recovery channel mixups**: email vs SMS vs backup codes accept each other's proofs; recovery answers (security questions) replace the password without re-proof.
+3. **OAuth/SSO callback flaws**: missing/wrong \`state\`/\`nonce\` validation, identity claimed from token without signature/issuer validation, "login as" driven by a client-supplied identity claim, mixed OAuth providers on one callback.
+4. **Session issuance bypass**: login sets pre-auth cookie privileges; \`POST /login\` accepts a stale session flag; remember-me tokens not rotated after password change; parallel session limit gaps.
+5. **MFA bypass paths**: an API endpoint that sets the auth cookie without the second factor; MFA checked on web but not on mobile/API; MFA prompt answerable with a different factor; time-based code not tied to the session.
+6. **Password change/re-auth**: "change password" without current password re-proof (token-bearing path), logout not revoking tokens, orphaned OAuth-linked accounts.
+
+## Method
+
+- Walk the full flow happy-path once, capturing every request (this is the control and the flow map).
+- Attack each transition's _proof of identity_ (which evidence is tested at which step) and _binding_ (is that evidence bound to the account/session being changed?).
+- Control group: run the flow as the account owner; experiment: substitute another account's context at the vulnerable step.
+- Verify 3/3 and check contextuality (is the flow reachable in prod topology? does the token actually survive to the sensitive step?).
+
+## Traps
+
+- Client-side flow constraints: flip steps/params in the raw request; the UI is not the protocol.
+- Never actually take over a real account: prove the primitive against your own test accounts, or demonstrate the exact step (token accepted for another account, state not validated) without completing the takeover.
+- Tokens in logs/history: capture only what is needed; redact per \`kifaru-claim-discipline\`.
+
+Evidence to keep: the flow request sequence, the vulnerable step's request/response, the control and experiment outcomes, and the precise invariant violated.
+` },
+  { dir: "kifaru-playbook-business-logic", content: `---
+name: kifaru-playbook-business-logic
+description: Use when testing workflows, state machines, and price/quantity/step logic. Covers broken workflow ordering, state confusion, duplicate/concurrent submits, quota and pricing bypasses, and voucher/coupon logic.
+---
+
+# Business Logic Playbook
+
+Carries the opencode \`business-logic-hunter\` methodology into the Pi runtime. Business logic bugs violate the invariant of a _process_, not a component \u2014 so each check starts by naming the process invariant.
+
+## Process Invariants to Name
+
+- Order/payment/refund: "a refund is only issued for a paid, owned order, once".
+- Onboarding/KYC: "identity evidence is submitted before verification, state is monotonic".
+- Quota/billing: "usage is decremented only on successful consumption".
+- Vouchers/referrals: "a code is single-use, per-eligible-account, within validity".
+- Transfers: "source balance is debited atomically with credit".
+
+## Common Broken-Invariant Sources (theses)
+
+1. **State-machine splitting**: the same workflow reachable via different entrypoints (mobile vs web vs API) whose state transitions are not shared. Submit in app A, mutate in app B.
+2. **Step reordering**: skip ahead (pay-without-address, ship-without-payment), go back (re-enter earlier state after a grant), replay a terminal state's callback (webhook replay).
+3. **Idempotency abuse**: retry a charge/transfer with the same id after partial failure; race the contention window (see \`kifaru-playbook-race-condition\` for the concurrency mechanics).
+4. **Integer/rounding seams**: fractional quantities, negative quantities, price overrides in client payloads that reach the server, currency conversion drift.
+5. **Entitlement vs usage split**: plan gates checked at purchase but enforced per-request elsewhere (or vice versa), so a downgrade leaves old permissions live.
+6. **Referral/voucher logic**: self-referral, reusing own code, applied to ineligible item/tenant, redeemed twice via two sessions, expiry bypass by clock tampering (if server trusts client time \u2014 flag, don't rely on it).
+
+## Method
+
+For each invariant: write the disproof experiment (\`kifaru-hypothesis-engineering\`), run the control group (happy path first \u2014 prove the happy path works exactly once), then the attack sequence. Business logic findings are stateful: capture the full request sequence and the differing final state as evidence.
+
+## Traps
+
+- "It's by design" \u2014 distinguish intended flexibility from violated invariant by naming the invariant in the report.
+- Server-side truth: never claim a pricing bypass from a client-side response alone; prove the state change server-side (ledger, receipt, quota counter).
+- Escalation guardrails: stop at minimal proof (a single successful unauthorized state change); never chain into mass fund movement or destructive cleanup (see \`kifaru-claim-discipline\` \u2014 prove the primitive, then STOP).
+` },
+  { dir: "kifaru-playbook-graphql", content: `---
+name: kifaru-playbook-graphql
+description: Use when the target exposes a GraphQL endpoint (often /graphql, /gql, /api/v2/graphql, GET-variant, or batched). Covers introspection abuse, query depth/complexity/batching abuse, field-level authorization gaps, and union/alias leaks.
+---
+
+# GraphQL Playbook
+
+Carries the opencode \`graphql-hunter\` methodology into the Pi runtime. GraphQL concentrates many authorization and DoS risks into one endpoint; the negative-space source is usually "the resolver trusts the field path, not the data owner".
+
+## Discovery Theses
+
+1. **Endpoint & transport variants**: \`POST /graphql\`, \`GET /graphql?query=\` (also CSRF-able), alternate paths and version prefixes, websocket subscriptions, and \`application/graphql\` content type. Test the GET variant as a CSRF vector if state-changing mutations exist.
+2. **Introspection**: \`{ __schema { types { name fields { name args { name type { name kind ofType { name } } } } } } }\` \u2014 enabled introspection leaks the entire data model. Record it as an observation; use it to map field-level boundaries.
+3. **Batching & aliasing**: multiple operations or aliased copies of one operation in a single request. This defeats per-request authz that checks the "operation", and multiplies any per-resolver issue.
+4. **Field-level access control**: the schema surface includes fields the top-level resource authz never checks (owner email vs notes; user vs internal fields; union member objects). Test each sensitive field against the wrong identity.
+5. **Depth/complexity abuse**: deeply nested fragments and duplicate fields to drive resolver cost (DoS/financial abuse). Only probe to the minimal proof that cost limits are absent; do not hammer.
+
+## Method
+
+- Introspect \u2192 derive the full field graph \u2192 annotate trust boundaries from the source/API docs (\`kifaru-source-analysis\`).
+- For each boundary: query the field as the object's owner (control) and as a foreign identity (experiment) \u2014 the IDOR method applies per _field_, not per _resource_.
+- Test mutations with the business-logic invariants: state transitions, voucher/transfer mutations, file-upload-like mutations (\`createUploadUrl\`), and email/account takeover chains.
+- Aliasing: same mutation twice under two aliases in one request to leak or double-execute.
+
+## Traps
+
+- Introspection on = informational, not a finding by itself; report it as hardening (disable in prod) with the evidence showing it.
+- Query depth/batching tests must respect the platform's rate limits and stay minimal-proof; never construct an actual resource-exhaustion attack beyond demonstrating the absence of a limit (with operator approval for that if material).
+- Field-level gaps need the same 5-check discipline: control group, 3/3, contextual (is the field reachable in production topology?).
+
+GraphQL reports benefit from the schema diff: show the vulnerable field path, the query used, and the differing response vs. the control identity.
+` },
+  { dir: "kifaru-playbook-idor", content: `---
+name: kifaru-playbook-idor
+description: Use when testing authorization boundaries and object access. Covers IDOR and cross-tenant access across JSON/CSV/export paths, batch APIs, webhooks, and indirect references, with control-group methodology.
+---
+
+# IDOR / Broken Object-Level Authorization Playbook
+
+Carries the opencode \`idor-hunter\` methodology into the Pi runtime. **Method, not checklist**: adapt each check into theses for this target (\`kifaru-hypothesis-engineering\`).
+
+## Boundary Map First
+
+- Every endpoint taking an object reference: path params, query, body fields, nested resources, export/batch variants.
+- Which identity is the caller and which tenant/account owns the object? (From \`kifaru-recon-intelligence\` trust map.)
+
+## Theses to Build (most common negative-space sources)
+
+1. **The export/download path differs from the fetch path.** Object IDs validated in \`GET /api/items/:id\` are often trusted in \`GET /export?id=\` or CSV/report generators. Test every object-bearing endpoint's _other formats_.
+2. **Batch / bulk operations trust the caller's references.** \`POST /import\`, \`POST /batch\`, \`DELETE /items[]\`, webhook deliveries \u2014 arrays skip per-item authorization.
+3. **Indirect references**: hashes (predictable, reversible, or from a known sequential source), tokens, filenames, \`id\` reused across resources \u2014 enumerate and test the reference scheme itself.
+4. **State mutations leak reads**: \`PATCH\`, status transitions, and workflows (approve/reject) return the parent object's data on success/error, leaking fields the direct GET would hide.
+5. **Tenant-selection headers**: \`X-Tenant\`, \`Host\`, subdomain isolation vs header isolation \u2014 test whether the object namespace is enforced consistently across both.
+6. **UUID\u2192integer downgrades**: some code paths accept both; the integer path may skip ownership checks.
+
+## Control-Group Method (required for VERIFIED)
+
+For each thesis, the **control** is the same call as a properly-authorized identity (or the same call with your own object):
+
+- Experimental: call as identity B on object owned by A \u2192 observe data A-owned.
+- Control: call as identity A on A's object \u2192 passes; call as B on a B object \u2192 passes.
+- The finding is the _difference_, verified 3/3 (\`kifaru-verification-discipline\`).
+
+## Traps
+
+- Client-side filtering (data returned but filtered in UI) \u2014 read raw responses.
+- Symmetric multi-tenancy by design (shared lists are features; document as observation).
+- IDs you generated yourself \u2014 find the other-tenant instance, prove cross-identity, not just cross-object-you-created.
+- Caching: a 200 with A's data may be a shared cache artifact \u2014 vary the object and identity to prove binding.
+
+Record every cell reached as clean or verified in \`kifaru-coverage-method\`; blocked cells (auth wall on object enumeration) become pivot attempts, never silence.
+` },
+  { dir: "kifaru-playbook-race-condition", content: `---
+name: kifaru-playbook-race-condition
+description: Use when a resource or state transition is shared across requests, especially money movement, redemption, account creation, or contention-prone checks-and-actseams. Covers TOCTOU races with control-group methodology and safe concurrency.
+---
+
+# Race Condition Playbook
+
+Carries the opencode \`race-condition-hunter\` methodology into the Pi runtime. A race is a **check-then-act** seam where two interleavings produce different state. Candidates: redeem-voucher, transfer/withdraw, create-then-claim username/email, quota decrement, signup bonus, idempotency-keyed endpoints.
+
+## Find the Seam First (theses)
+
+1. **Check and act are separate statements** (balance \u2265 amount; then debit; redeem valid; then mark used) with no locking or unique constraint visible.
+2. **Idempotency key reuse**: an endpoint that claims idempotency but computes the idempotency _state_ after the side effect, or only dedupes on success.
+3. **Client can fan out the race**: same request body with different (or same) request IDs fired in parallel \u2014 if dedup is by request-id and the check precedes the write, parallel distinct ids pass.
+4. **Read-then-write on a row with no version**: profile update, counter increment, status transition from the same initial state.
+
+## Method
+
+1. **Baseline the happy path** once: confirm the check passes and the act commits exactly once.
+2. **Serial retry**: same request N times sequentially \u2014 confirms idempotency claim and gives the serial baseline.
+3. **Parallel fan-out** (the race): fire the same effective operation concurrently \u2014 same id and distinct ids, both in small bursts (the contention window is usually tiny; bursts of 5-20 by tiny scripted delay ranges beat naive "all at once").
+4. **Observe the ledger**: count redemptions/debits/creations server-side after calming down. The finding is the _difference_: parallel count > serial count for the same inputs.
+5. **Reproduce 3/3** with a fresh state each time (\`kifaru-verification-discipline\`).
+
+## Safety & Ethics
+
+- Scope strictly: only the race on the _material_ state transition, minimal proof (e.g., one extra redemption, a second username claim), then STOP.
+- Respect rate limits and platform rules; concurrency bursts must stay within the assessment's allowed volume. Never race for financial gain beyond the proof.
+- If the platform has a bug-bounty defined race policy (e.g., "single repeated logical unit"), follow it.
+
+## Evidence
+
+Capture: the request payload(s) used, the concurrency strategy (count \xD7 timing), the serial-baseline count, the parallel count, and the server-side state rows proving the difference. This evidence must survive the 5-check pyramid and the claim discipline (impact = "one extra redemption of a single-use code", not "unlimited fraud").
+` },
+  { dir: "kifaru-playbook-waf-bypass", content: `---
+name: kifaru-playbook-waf-bypass
+description: Use when a WAF, challenge wall, or signature-based filter blocks testing or when standard payloads are being filtered. Escalates technique only after a conventional test is disproven, with methodology for encoding, normalization, and parser differentials.
+---
+
+# WAF / Filter Bypass Playbook
+
+Carries the opencode \`waf-bypass\` / \`cloudflare-bypass\` methodology into the Pi runtime. **Bypass is an escalation, not a first move**: it applies when a specific thesis is otherwise blocked or when the filter itself is the target. Stay within the assessment's authorized actions (anti-bot evasion may itself be out of scope \u2014 check the program rules first).
+
+## Read the Filter First
+
+Characterize how the filter decides:
+
+- Signature (regex/literal match) vs behavioral (rate/payload shape) vs challenge (JS/checkbox/CAPTCHA).
+- Where it inspects: path, headers, query, body, JSON keys vs values, multipart, gzip.
+- Double-decoding seams: the front proxy decodes once, the app decodes again (or on a different component: WAF on one field, app on another).
+
+## Escalation Ladder (test each rung with the SAME thesis)
+
+1. **Encoding/normalization**: URL-encode, UTF-8 overlong forms, Unicode homoglyphs, case, whitespace (tabs/newlines), parameter pollution (\`?a=1&a=payload\` \u2014 which value does the app take?). Compare filter vs app decoding.
+2. **Context splitting**: move the payload where inspection differs \u2014 JSON key vs value, header vs query, multipart filename vs content, cookie vs body, unparsed fragment (\`#\`-after, \`;\` params).
+3. **Parser differential (the big one)**: two ways to reach the same app logic with different filter-visible text. Dup-parameter behavior, nested JSON, malformed-but-accepted input (stray quotes/braces), content-type confusion, chunked/HTTP-smuggling-adjacent framing (only with explicit authorization \u2014 smuggling is high-risk; prefer framing variants that are still well-formed).
+4. **Challenges**: for JS/CAPTCHA challenge walls, the bypass is normally _not_ fighting the challenge (that's anti-bot evasion); instead find the same capability on an unchallenged route/API/legacy endpoint used by first-party clients. Testing that path is legitimate; bypassing the challenge itself usually is not.
+5. **Request-shape minification**: remove everything the filter keys on (drop headers the filter marks, use the minimal well-formed request the app accepts) \u2014 often all that's needed.
+
+## Controlled Differential Method
+
+For each rung: send the _filtered baseline_ (blocked response), then the variant (allowed response) **to the same endpoint**. The finding needs: the filter's decision on both, and the app's behavior on both. A variant that passes the filter but is rejected by the app is not a bypass.
+
+## Traps
+
+- Claiming bypass from the filter response alone \u2014 prove the app executed the payload (behavioral outcome), 3/3.
+- Anti-bot/challenge evasion beyond the authorized method is disallowed in most programs; when in doubt, surface it as an operator question.
+- Keep volume minimal: WAF tests generate lots of noise; throttle and spread requests, record the decisive pairs only.
+- Report the _mechanism_ (which normalization/parser seam), not just "got blocked \u2192 encoded \u2192 worked".
+
+Evidence: the blocked request, the bypassing request, the app's differential outcome, and the filter component name. Straight to \`kifaru-verification-discipline\` (SKEPTICAL check: is the success actually attribute-shape mismatch, i.e., the filter never saw that endpoint?).
+` },
+  { dir: "kifaru-recon-intelligence", content: `---
+name: kifaru-recon-intelligence
+description: Use when starting reconnaissance or expanding attack surface on a target. Drives targeted recon decisions from target characteristics, detected defenses, and phase progression (passive to active) instead of running a fixed checklist of tools.
+---
+
+# Kifaru Recon Intelligence
+
+Reconnaissance must be **decision-driven, not tool-driven**. Every probe should answer a question that changes the next action. This skill converts the opencode \`ReconIntelligence\` decision system into run-time methodology for the Pi runtime.
+
+## Operating Principles
+
+1. **Characterize first.** Classify the target: web app, API, mobile, cloud control plane, network service, or supply chain. Extract stack, framework, version, auth model, and trust boundaries from source/artifacts before touching the network.
+2. **Detect defenses early.** Fingerprint WAF, rate limiting, challenge walls (Cloudflare), auth gates, and anomaly detection from response shapes and headers. Record them; they change tradecraft (see \`kifaru-playbook-waf-bypass\`).
+3. **Phase progression is one-way and reversible-by-justification:**
+   - **Passive**: source review, artifact inspection, headers, certificate transparency, metadata, docs. No interaction with the live service beyond what normal browsing does.
+   - **Active, low-noise**: non-destructive requests, fingerprinting, option scanning, error probing at low rate.
+   - **Active, directed**: only endpoints/inputs that a passive phase implicated. Never broad fuzzing of everything.
+   - **Exploit validation**: only after a specific, reachable hypothesis exists and the plan survives disproof (see \`kifaru-hypothesis-engineering\`).
+4. **Each phase must produce a decision input**: a trust map update, a defense signature, a candidate input surface, or a falsifiable thesis. If a probe cannot change a decision, don't run it.
+
+## Attack-Surface Expansion
+
+From the trust map (intake), enumerate laterally:
+
+- Alternate entry points: admin paths, API versions, health/debug endpoints, websockets, webhooks, file/media flows, async workers, mobile deep links / IPC.
+- Cross-tenant seams: object ownership, tenant headers, IDs in URLs/params, shared services, account impersonation, import/export paths.
+- Support paths: password reset, account recovery, support impersonation, rate-limit counters, audit logs, backup/recovery endpoints.
+- Integration surfaces: OAuth flows, SSO callbacks, webhook receivers, outbound integrations, SDK key material.
+
+## Tradecraft Profile
+
+Maintain and replay a compact profile:
+
+\`\`\`
+target_class, stack, version_evidence
+defenses_seen        (waf: n|y + flavor, rate_limit: n|y, auth: kind, challenge: n|y)
+passive_findings     (boundaries, secrets-in-repo, version hints)
+candidate_inputs     (endpoint \xD7 input \xD7 state, with the negative-space source)
+phase                (passive | active-low | active-directed | exploit-validation)
+open_theses          (link to kifaru-hypothesis-engineering)
+\`\`\`
+
+## Handoff
+
+Finish recon by naming: (1) the expanded trust map, (2) the ranked input surface with negative-space sources, (3) defenses and the tradecraft adjustments, (4) the top falsifiable theses ready for \`kifaru-hypothesis-engineering\`. Silence is a finding too: record surfaces examined and found clean so coverage can be reported honestly (see \`kifaru-coverage-method\`).
+` },
+  { dir: "kifaru-source-analysis", content: `---
+name: kifaru-source-analysis
+description: "Use for code, configuration, and artifact review before active testing. Applies the static-first discipline of the opencode code-analyzer and heuristic-scanner: find candidate inputs, secrets, trust boundaries, and version hints from source so live testing is targeted."
+---
+
+# Kifaru Source Analysis
+
+Source and artifacts are the cheapest reconnaissance. Analyze before probing; the analysis produces the input surface and version evidence that active phases consume (\`kifaru-recon-intelligence\`).
+
+## Passes
+
+1. **Trust boundaries pass.** Map where untrusted input crosses into trusted code: parsers, deserializers, template renderers, SQL/query builders, file paths, shell-invoking helpers, SSRF-prone fetchers, crypto/key handling, auth checks, and tenant-scoping helpers. Name each boundary and every input reaching it.
+2. **Secret & key-material pass.** Search for keys, tokens, credentials, JWTs, cloud roles, signing keys in source, configs, env templates, lockfiles, CI, and history. Record the _class_ and where it leaks; never paste full secrets into notes (redact to a prefix).
+3. **Version & dependency pass.** Capture server/package versions from manifests (\`package.json\`, \`go.mod\`, \`Dockerfile\`, lockfiles, \`Server\` headers) and match them to known-affected versions. This is the evidence \`kifaru-claim-discipline\` needs for CVE claims.
+4. **Candidate input pass.** Enumerate endpoints, handlers, routes, controllers, CLI entrypoints, mobile deep links / IPC, and file-format handlers with their inputs and auth context \u2014 the reachability rows for \`kifaru-hypothesis-engineering\`.
+5. **Config pass.** Flag debug/admin surfaces, permissive CORS, missing security headers, weak cookie flags, post-mortem/default credentials, exposed internal URLs, and non-production features gated only by config.
+
+## Heuristics (fast wins, not conclusions)
+
+- Handler asymmetry: the export path differs from the fetch path; the webhook skips the auth middleware; the batch API trusts the caller's tenant.
+- Trusted-input copy-paste: an internal helper used with attacker-controlled data.
+- Version mismatch between banner and dependency manifest (a claim-discipline trap).
+- Dead code that still routes (hidden endpoints).
+- Parser split-brain: two parsers for the same content (see playbooks for dup-parser attacks).
+- Defaults that differ between envs (dev secret rotation off in prod).
+
+## Output
+
+One note per strong candidate: boundary + source line + negative-space insight + minimal proof plan. Do not finish with a list of TODOs; finish with ranked theses for active testing, and version/secret evidence for the report. Cells examined and clean go into \`kifaru-coverage-method\` as \`TESTED_SAFE\`.
+` },
+  { dir: "kifaru-verification-discipline", content: `---
+name: kifaru-verification-discipline
+description: Use before any finding is recorded or reported. Applies the 5-check verification pyramid and 3-strike reproducibility rule so every confirmed finding survives triage with zero false positives.
+---
+
+# Kifaru Verification Discipline
+
+Every finding must pass the **5-check verification pyramid** before it is recorded as confirmed. A finding that cannot pass is demoted to an observation or dropped. This skill carries the opencode \`VerificationLayer\` / \`enhanced-verifier\` discipline into the Pi runtime as a checklist the model applies to its own work (the mechanical gates live in the \`kifaru_proof_gate\` extension).
+
+## The 5-Check Pyramid (ALL must pass)
+
+1. **DIFFERENTIAL** \u2014 the exploit behavior differs from a clean baseline. Run the same request/action against the control (safe input, baseline object, known-good state); you must see a difference attributable to the vulnerability, not noise.
+2. **REPRODUCIBLE** \u2014 the primitive reproduces consistently (3/3 attempts on identical state). One lucky run is a hint, not a finding.
+3. **IMPACTFUL** \u2014 there is real security impact: crossing a trust boundary, accessing unauthorized data, altering state, or degrading availability. "Interesting error message" is not impact.
+4. **SKEPTICAL** \u2014 you actively look for alternative explanations: default behavior, intended feature, rate-limit artifact, cache, client-side-only issue, previous state leak, or a test artifact of your own tooling. If an alternative survives, the finding does not.
+5. **CONTEXTUAL** \u2014 the finding makes sense given target context: the component is reachable in production topology, the affected version is the running version, the feature is actually enabled, and the impact chain does not require assumptions you cannot support.
+
+## 3-Strike Rule
+
+For exploit-type findings: attempt reproduction three times independently (fresh state where possible). \`verified\` requires \u22653 consistent confirmations; a single failure with a plausible flake explanation is allowed only with the reason recorded. Two failures \u2192 the finding is \`inconclusive\`, not confirmed.
+
+## Proof Requirements by Class (evidence you must hold)
+
+- **Injection / traversal / RCE-like**: the actual content that crossed the boundary (output, file content, code exec).
+- **IDOR / access control**: the cross-boundary object shown to the wrong identity + the same call as a control that fails.
+- **CSRF / state change**: request that changed state + evidence the change happened server-side.
+- **Secrets / data exposure**: the secret class shown, never the full secret in the report.
+- **Race / logic**: sequence of requests + the differing outcome vs. serialized baseline.
+
+## Reporting Handoff
+
+Findings that pass move to \`kifaru-vulnerability-report\`; wording must then survive \`kifaru-claim-discipline\` (the two skills are complementary: verification proves, claims word what was proven). Findings that fail are demoted to coverage ledger entries (\`kifaru-coverage-method\`) or dropped, never carried forward as "maybe".
+` },
+  { dir: "kifaru-vulnerability-report", content: `---
+name: kifaru-vulnerability-report
+description: Use when Kifaru has verified notes, code references, HTTP captures, logs, screenshots, tests, or proof artifacts and needs a concise disclosure-ready vulnerability report with invariant, root cause, exploitability, impact, severity reasoning, remediation, and regression tests.
+---
+
+# Kifaru Vulnerability Report
+
+Turns verified hunt output into a single, replayable, disclosure-ready report. Input: the coverage ledger, the verified findings, and their minimal proofs. Output: one report document that survives triage because every claim is bottom-up.
+
+## Per-Finding Structure
+
+1. **Title** \u2014 primitive + affected component (no unverified CVE in the title).
+2. **Invariant violated** \u2014 the security rule that should have held.
+3. **Root cause** \u2014 the exact flaw (code path / config / design gap) with reference.
+4. **Proof of concept** \u2014 raw request/response or exact commands a reader can replay from scratch. Include only the necessary requests; strip session tokens; redact PII uniformly.
+5. **Exploitation** \u2014 atomic steps, each one observable, preconditions stated (auth state, role, interaction). No step that says "trigger the vulnerability".
+6. **Impact** \u2014 bottom-up from the PoC: what was actually read/changed/executed and at what privilege. No speculation.
+7. **Severity** \u2014 CVSS 3.1 base vector, each metric justified by the evidence.
+8. **Remediation** \u2014 specific fix (patch, config, design change); regression test.
+
+## Discipline Before Writing
+
+- Every finding has passed \`kifaru-verification-discipline\` (5-check + 3-strike).
+- Language follows \`kifaru-claim-discipline\` (no could/may/potentially; base metrics only; CVE\u2194version consistent; secrets masked).
+- Scope: every origin exercised is inside the attested set, or explicitly flagged.
+- Run the report through the \`kifaru_report_lint\` extension; publish nothing that fails lint without an operator override.
+
+## Report-Writing Order (per finding)
+
+Description \u2192 Vulnerability discovery \u2192 Proof of Concept \u2192 Exploitation \u2192 Impact \u2192 Remediation (optional) \u2192 References (optional).
+
+Then: an executive summary that claims exactly what the per-finding sections prove \u2014 no more, no less. Prove the primitive, then STOP: no mass exfiltration or destructive post-exploitation to "demonstrate" impact.
+` }
+];
+
+// ../core/src/skills/embedded-skills.ts
+function kifaruSkillsRoot() {
+  if (process.env.KIFARU_SKILLS_DIR)
+    return path.resolve(process.env.KIFARU_SKILLS_DIR);
+  const xdg = process.env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share");
+  return path.join(xdg, "kifaru", "skills");
+}
+function materializeKifaruSkills(root = kifaruSkillsRoot(), skills = EMBEDDED_KIFARU_SKILLS) {
+  let wroteAny = false;
+  let anyPresent = false;
+  for (const skill of skills) {
+    const dir = path.join(root, skill.dir);
+    const file = path.join(dir, "SKILL.md");
+    try {
+      const existing = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : undefined;
+      if (existing !== skill.content) {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(file, skill.content);
+        wroteAny = true;
+      }
+      anyPresent = true;
+    } catch {}
+  }
+  return anyPresent ? root : null;
+}
 // ../core/src/sandbox/mock-sandbox.ts
 class MockSandboxSession {
   options;
@@ -96183,19 +96722,19 @@ class MockSandboxSession {
       durationMs: Date.now() - started
     };
   }
-  async readFile(path) {
+  async readFile(path2) {
     if (this.isClosed)
       throw new Error("Sandbox session is closed");
-    const content = this.files.get(path);
+    const content = this.files.get(path2);
     if (content === undefined) {
-      throw new Error(`File not found: ${path}`);
+      throw new Error(`File not found: ${path2}`);
     }
     return content;
   }
-  async writeFile(path, content) {
+  async writeFile(path2, content) {
     if (this.isClosed)
       throw new Error("Sandbox session is closed");
-    this.files.set(path, content);
+    this.files.set(path2, content);
   }
   async close() {
     this.isClosed = true;
@@ -97614,10 +98153,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path) {
-  if (!path)
+function getElementAtPath(obj, path2) {
+  if (!path2)
     return obj;
-  return path.reduce((acc, key) => acc?.[key], obj);
+  return path2.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -97998,11 +98537,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path, issues) {
+function prefixIssues(path2, issues) {
   return issues.map((iss) => {
     var _a15;
     (_a15 = iss).path ?? (_a15.path = []);
-    iss.path.unshift(path);
+    iss.path.unshift(path2);
     return iss;
   });
 }
@@ -98185,7 +98724,7 @@ function formatError(error, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error2, path = []) => {
+  const processError = (error2, path2 = []) => {
     var _a15, _b15;
     for (const issue2 of error2.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -98195,7 +98734,7 @@ function treeifyError(error, mapper = (issue2) => issue2.message) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path, ...issue2.path];
+        const fullpath = [...path2, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -98227,8 +98766,8 @@ function treeifyError(error, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path) {
+  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path2) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -109975,13 +110514,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path = ref.slice(1).split("/").filter(Boolean);
-  if (path.length === 0) {
+  const path2 = ref.slice(1).split("/").filter(Boolean);
+  if (path2.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path[0] === defsKey) {
-    const key = path[1];
+  if (path2[0] === defsKey) {
+    const key = path2[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -110737,8 +111276,8 @@ function getErrorMap2() {
 
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path, errorMaps, issueData } = params;
-  const fullPath = [...path, ...issueData.path || []];
+  const { data, path: path2, errorMaps, issueData } = params;
+  const fullPath = [...path2, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -110850,11 +111389,11 @@ var errorUtil;
 
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
-  constructor(parent, value, path, key) {
+  constructor(parent, value, path2, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path;
+    this._path = path2;
     this._key = key;
   }
   get path() {
@@ -125296,15 +125835,15 @@ function createAgentSelectList(currentWorkflowKey, onSelect, onCancel) {
 }
 
 // src/agent-runtime.ts
-import path18 from "path";
+import path19 from "path";
 
 // ../opencode/src/runtime/child-environment.ts
 await __promiseAll([
   init_auth(),
   init_config()
 ]);
-import os5 from "os";
-import path13 from "path";
+import os6 from "os";
+import path14 from "path";
 var MODEL_PROVIDER_CREDENTIAL_ENV_VARS = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_OAUTH_TOKEN",
@@ -125369,10 +125908,10 @@ var ChildEnvironment;
     const env2 = { ...input };
     if (process.platform === "win32")
       return env2;
-    const home = os5.homedir();
+    const home = os6.homedir();
     const required3 = [
-      path13.join(home, ".local/bin"),
-      path13.join(home, ".local/share/kifaru/bin"),
+      path14.join(home, ".local/bin"),
+      path14.join(home, ".local/share/kifaru/bin"),
       "/usr/local/sbin",
       "/usr/local/bin",
       "/usr/sbin",
@@ -125380,7 +125919,7 @@ var ChildEnvironment;
       "/sbin",
       "/bin"
     ];
-    const current = (env2.PATH ?? "").split(path13.delimiter).filter(Boolean);
+    const current = (env2.PATH ?? "").split(path14.delimiter).filter(Boolean);
     const seen = new Set(current);
     for (const directory of required3) {
       if (seen.has(directory))
@@ -125388,7 +125927,7 @@ var ChildEnvironment;
       current.push(directory);
       seen.add(directory);
     }
-    env2.PATH = current.join(path13.delimiter);
+    env2.PATH = current.join(path14.delimiter);
     return env2;
   }
   ChildEnvironment.withExecutablePath = withExecutablePath;
@@ -125398,9 +125937,9 @@ var ChildEnvironment;
 await init_python();
 
 // src/invoker-resolver.ts
-import fs9 from "fs";
-import os6 from "os";
-import path14 from "path";
+import fs10 from "fs";
+import os7 from "os";
+import path15 from "path";
 function resolveTuiInvoker(catalog) {
   return new PiAiModelInvoker(resolveTuiModels(catalog));
 }
@@ -125408,12 +125947,12 @@ var KIFARU_SESSION_PROVIDER = "kifaru-session";
 function sessionGatewayFile() {
   if (process.env.KIFARU_SESSION_FILE)
     return process.env.KIFARU_SESSION_FILE;
-  const xdg = process.env.XDG_DATA_HOME || path14.join(os6.homedir(), ".local", "share");
-  return path14.join(xdg, "kifaru", "data", "auth", "session.json");
+  const xdg = process.env.XDG_DATA_HOME || path15.join(os7.homedir(), ".local", "share");
+  return path15.join(xdg, "kifaru", "data", "auth", "session.json");
 }
 function loadStoredSession() {
   try {
-    const raw = fs9.readFileSync(sessionGatewayFile(), "utf8");
+    const raw = fs10.readFileSync(sessionGatewayFile(), "utf8");
     const data2 = JSON.parse(raw);
     if (!data2?.accessToken || !data2?.gatewayEnv?.api)
       return null;
@@ -125466,8 +126005,8 @@ function resolveTuiModels(catalog) {
 }
 
 // src/opencode-host-tools.ts
-import fs12 from "fs/promises";
-import path17 from "path";
+import fs13 from "fs/promises";
+import path18 from "path";
 import { Type as Type4 } from "@earendil-works/pi-ai";
 
 // ../opencode/src/tool/runtime/host.ts
@@ -125481,8 +126020,8 @@ await __promiseAll([
   init_python()
 ]);
 import { createHash as createHash3 } from "crypto";
-import fs10 from "fs/promises";
-import path15 from "path";
+import fs11 from "fs/promises";
+import path16 from "path";
 var PythonHelpers;
 ((PythonHelpers) => {
   const log2 = Log2.create({ service: "runtime.python-helpers" });
@@ -125728,15 +126267,15 @@ if __name__ == "__main__":
   PythonHelpers.HUNT_MODULE_VERSION = createHash3("sha256").update(PythonHelpers.HUNT_MODULE_SOURCE).digest("hex").slice(0, 12);
   function defaultDeps() {
     return {
-      mkdir: (dir) => fs10.mkdir(dir, { recursive: true }).then(() => {
+      mkdir: (dir) => fs11.mkdir(dir, { recursive: true }).then(() => {
         return;
       }),
-      readFile: (file3) => fs10.readFile(file3, "utf8"),
-      writeFile: (file3, content) => fs10.writeFile(file3, content)
+      readFile: (file3) => fs11.readFile(file3, "utf8"),
+      writeFile: (file3, content) => fs11.writeFile(file3, content)
     };
   }
   function helpersDir(dataDir = Global.Path.data) {
-    return path15.join(PythonRuntime.managedRoot(dataDir), "helpers");
+    return path16.join(PythonRuntime.managedRoot(dataDir), "helpers");
   }
   PythonHelpers.helpersDir = helpersDir;
   const ensureTasks = new Map;
@@ -125746,8 +126285,8 @@ if __name__ == "__main__":
     if (cached3)
       return cached3;
     const task = (async () => {
-      const target = path15.join(dir, "hunt.py");
-      const stamp = path15.join(dir, ".hunt-version");
+      const target = path16.join(dir, "hunt.py");
+      const stamp = path16.join(dir, ".hunt-version");
       try {
         const [onDisk, current] = await Promise.all([
           deps2.readFile(target).catch(() => {
@@ -125772,8 +126311,8 @@ if __name__ == "__main__":
   PythonHelpers.ensure = ensure;
   function prependPythonPath(env2, dir) {
     const next = { ...env2 };
-    const parts = (next.PYTHONPATH ?? "").split(path15.delimiter).filter(Boolean);
-    next.PYTHONPATH = [dir, ...parts.filter((part) => part !== dir)].join(path15.delimiter);
+    const parts = (next.PYTHONPATH ?? "").split(path16.delimiter).filter(Boolean);
+    next.PYTHONPATH = [dir, ...parts.filter((part) => part !== dir)].join(path16.delimiter);
     return next;
   }
   PythonHelpers.prependPythonPath = prependPythonPath;
@@ -126272,7 +126811,7 @@ function shell() {
   return Bun.which("bash") ?? true;
 }
 function resolvePath(filePath2, cwd) {
-  return path17.isAbsolute(filePath2) ? filePath2 : path17.resolve(cwd, filePath2);
+  return path18.isAbsolute(filePath2) ? filePath2 : path18.resolve(cwd, filePath2);
 }
 function evidence(description, artifactType, data2) {
   return { description, artifactType, data: data2, timestamp: Date.now() };
@@ -126350,7 +126889,7 @@ class OpenCodeHostReadTool {
     const filePath2 = resolvePath(requested, this.cwd);
     const offset = typeof params.offset === "number" ? Math.max(0, Math.trunc(params.offset)) : 0;
     const limit = typeof params.limit === "number" ? Math.min(DEFAULT_READ_LIMIT, Math.max(1, Math.trunc(params.limit))) : DEFAULT_READ_LIMIT;
-    const contents = await fs12.readFile(filePath2, "utf8");
+    const contents = await fs13.readFile(filePath2, "utf8");
     const lines = contents.split(`
 `);
     const selected = lines.slice(offset, offset + limit).map((line, index) => {
@@ -126394,8 +126933,8 @@ class OpenCodeHostWriteTool {
       throw new Error("Missing or empty 'filePath' parameter for write.");
     const content = typeof params.content === "string" ? params.content : "";
     const filePath2 = resolvePath(requested, this.cwd);
-    await fs12.mkdir(path17.dirname(filePath2), { recursive: true });
-    await fs12.writeFile(filePath2, content, "utf8");
+    await fs13.mkdir(path18.dirname(filePath2), { recursive: true });
+    await fs13.writeFile(filePath2, content, "utf8");
     return {
       output: `Wrote ${Buffer.byteLength(content)} bytes to ${filePath2}`,
       evidence: evidence(`Wrote host file: ${filePath2}`, "host_file_write", {
@@ -126454,7 +126993,7 @@ function createTuiAgentRuntime(catalog, options2 = {}) {
     }),
     store: new InMemoryStageSessionStore
   });
-  const workingDirectory = path18.resolve(options2.workingDirectory ?? options2.workspaceRoot ?? process.env.KIFARU_TUI_WORKSPACE_ROOT ?? process.cwd());
+  const workingDirectory = path19.resolve(options2.workingDirectory ?? options2.workspaceRoot ?? process.env.KIFARU_TUI_WORKSPACE_ROOT ?? process.cwd());
   const budget = options2.budget;
   PythonRuntime.startupBootstrap().catch(() => {
     return;
@@ -127024,7 +127563,7 @@ import {
 
 // src/pi-python-runtime.ts
 await init_python();
-import path19 from "path";
+import path20 from "path";
 import {
   createBashToolDefinition,
   createLocalBashOperations
@@ -127090,7 +127629,7 @@ async function capturePythonPrompt(cwd) {
   const environment = await prepareHostEnvironment(process.env, cwd, false);
   const expected = PythonRuntime.expectedCommands(environment.settings.profile);
   const discovered = expected.filter((command) => Bun.which(command, { PATH: environment.env.PATH, cwd }) !== null);
-  const helperAvailable = await Bun.file(path19.join(PythonHelpers.helpersDir(), "hunt.py")).exists();
+  const helperAvailable = await Bun.file(path20.join(PythonHelpers.helpersDir(), "hunt.py")).exists();
   return pythonRuntimePrompt({
     settings: environment.settings,
     selection: environment.selection,
@@ -127211,6 +127750,7 @@ ${runtimePrompt(state2, cwd)}`
 async function runKifaruPiSdkTui(options2 = {}) {
   const cwd = options2.cwd ?? process.cwd();
   const agentDir = getAgentDir();
+  const kifaruSkillsPath = materializeKifaruSkills();
   const catalog = options2.catalog ?? new ModelCatalogRegistry;
   const initial = splitThinkingRef(options2.initialModelRef ?? "azure/FW-DeepSeek-V4-Flash-0731");
   const initialResolution = catalog.resolve(initial.modelRef);
@@ -127246,7 +127786,8 @@ async function runKifaruPiSdkTui(options2 = {}) {
           createPythonRuntimeExtension({
             shellPath: settingsManager.getShellPath()
           })
-        ]
+        ],
+        ...kifaruSkillsPath ? { additionalSkillPaths: [kifaruSkillsPath] } : {}
       }
     });
     const hasExistingMessages = sessionManager.buildSessionContext().messages.length > 0;
@@ -127294,7 +127835,7 @@ async function runKifaruTui(options2) {
 // bin/kifaru-tui.ts
 var args = process.argv.slice(2);
 if (args.includes("--version") || args.includes("-v")) {
-  console.log("1.0.163");
+  console.log("1.0.164");
   process.exit(0);
 }
 if (args.includes("--help") || args.includes("-h")) {