micro-models-agent 0.52.1 → 0.53.0

package/dist/main.js

@@ -2658,7 +2658,7 @@ Fix the error and re-edit the file (a clean write clears the failure), or mark t
     "cli.cert_provider_url": "Provider base URL to certify against (default: current config)",
     "cli.cert_provider_key": "Provider API key (optional)",
     "cli.cert_context_window": "Context window size in tokens",
-    "cli.cert_tags": "Comma-separated scenario tags (core, security, image, network, browser, shell, research)",
+    "cli.cert_tags": "Comma-separated scenario tags (core, security, image, network, browser)",
     "cli.cert_reps": "Default repetitions per scenario (overridden by scenario)",
     "cli.cert_force": "Re-run an existing certification",
     "cli.cert_clean": "Remove sandbox directories after a successful run",
@@ -3381,7 +3381,7 @@ var init_ru = __esm(() => {
     "cli.cert_provider_url": "Базовый URL провайдера для сертификации (по умолчанию — текущий конфиг)",
     "cli.cert_provider_key": "API-ключ провайдера (необязательно)",
     "cli.cert_context_window": "Размер контекстного окна в токенах",
-    "cli.cert_tags": "Теги сценариев через запятую (core, security, image, network, browser, shell, research)",
+    "cli.cert_tags": "Теги сценариев через запятую (core, security, image, network, browser)",
     "cli.cert_reps": "Повторов по умолчанию на сценарий (переопределяется сценарием)",
     "cli.cert_force": "Перепрогнать существующую сертификацию",
     "cli.cert_clean": "Удалить песочницы после успешного прогона",
@@ -6629,9 +6629,6 @@ var init_executor = __esm(() => {
 // src/tools/path-utils.ts
 import { resolve, normalize, dirname as dirname2, basename, sep, relative, isAbsolute } from "path";
 import { existsSync as existsSync8 } from "fs";
-function toForwardSlash(p) {
-  return p.replace(/\\/g, "/");
-}
 function isInsideDir(targetPath, dirPath) {
   const norm = (p) => process.platform === "win32" ? p.toLowerCase() : p;
   const t2 = norm(resolve(targetPath));
@@ -6863,7 +6860,7 @@ function matchesGlobPattern(targetPath, baseDir, pattern) {
   if (pattern.includes("*")) {
     const regexPattern = pattern.replace(/\*/g, "[^/\\\\]*").replace(/\?/g, ".").replace(/\./g, "\\.");
     const regex = new RegExp(`^${regexPattern}$`);
-    const relativePath = toForwardSlash(resolvedTargetPath.slice(resolvedBaseDir.length + 1));
+    const relativePath = resolvedTargetPath.slice(resolvedBaseDir.length + 1).replace(/\\/g, "/");
     return regex.test(relativePath);
   }
   const exactTarget = resolve2(baseDir, pattern);
@@ -7449,12 +7446,17 @@ function isPathInSessionScope(sessionContext, path) {
   const resolvedPath = resolve5(path);
   const workingDir = resolve5(sessionContext.workingDir);
   const tempDir = resolve5(sessionContext.tempDir);
-  return isInsideDir(resolvedPath, workingDir) || isInsideDir(resolvedPath, tempDir);
+  if (resolvedPath.startsWith(workingDir + "/") || resolvedPath.startsWith(workingDir + "\\")) {
+    return true;
+  }
+  if (resolvedPath.startsWith(tempDir + "/") || resolvedPath.startsWith(tempDir + "\\")) {
+    return true;
+  }
+  return false;
 }
 var DEFAULT_SESSION_ISOLATION;
 var init_session_isolation = __esm(() => {
   init_security();
-  init_path_utils();
   DEFAULT_SESSION_ISOLATION = {
     enabled: false,
     isolatePlugins: true,
@@ -8422,52 +8424,15 @@ var init_command_validator = __esm(() => {
   DEFAULT_BASH_CONFIG = DEFAULT_SECURITY_CONFIG?.bash || FALLBACK_BASH_CONFIG;
 });
 
-// src/modules/processes/kill-tree.ts
-import { spawnSync } from "child_process";
-import { platform } from "os";
-function sleepSync(ms) {
-  try {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-  } catch {}
-}
-function taskkillPid(pid) {
-  try {
-    spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], {
-      windowsHide: true,
-      stdio: "ignore",
-      timeout: 5000
-    });
-  } catch {}
-}
-function killTree(child) {
-  const pid = child.pid;
-  if (!pid)
-    return;
-  if (platform() === "win32") {
-    taskkillPid(pid);
-    sleepSync(150);
-    taskkillPid(pid);
-    return;
-  }
-  try {
-    process.kill(-pid, "SIGTERM");
-  } catch {
-    try {
-      child.kill("SIGKILL");
-    } catch {}
-  }
-}
-var init_kill_tree = () => {};
-
 // src/modules/processes/registry.ts
-import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
-import { platform as platform2 } from "os";
+import { spawn as spawn2, spawnSync } from "child_process";
+import { platform } from "os";
 function getOemDecoder() {
   if (oemDecoder !== undefined)
     return oemDecoder;
   oemDecoder = null;
   try {
-    const cpOut = spawnSync2("chcp.com", {
+    const cpOut = spawnSync("chcp.com", {
       encoding: "buffer",
       timeout: 2000,
       windowsHide: true
@@ -8502,6 +8467,38 @@ function decodeLineToUtf8(buf) {
   }
   return buf.toString("latin1");
 }
+function sleepSync(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {}
+}
+function taskkillPid(pid) {
+  try {
+    spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], {
+      windowsHide: true,
+      stdio: "ignore",
+      timeout: 5000
+    });
+  } catch {}
+}
+function killTree(child) {
+  const pid = child.pid;
+  if (!pid)
+    return;
+  if (platform() === "win32") {
+    taskkillPid(pid);
+    sleepSync(150);
+    taskkillPid(pid);
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGTERM");
+  } catch {
+    try {
+      child.kill("SIGKILL");
+    } catch {}
+  }
+}
 
 class ProcessRegistry {
   procs = new Map;
@@ -8528,7 +8525,7 @@ class ProcessRegistry {
         cwd,
         shell: true,
         windowsHide: true,
-        detached: platform2() !== "win32",
+        detached: platform() !== "win32",
         stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (e) {
@@ -8541,7 +8538,7 @@ class ProcessRegistry {
     entry.pid = child.pid ?? 0;
     let buf = "";
     let byteBuf = Buffer.alloc(0);
-    const isWin = platform2() === "win32";
+    const isWin = platform() === "win32";
     const unixDecoder = new TextDecoder("utf-8");
     const pushLine = (line) => {
       if (entry.log.length >= MAX_LOG_LINES) {
@@ -8690,8 +8687,6 @@ class ProcessRegistry {
 }
 var MAX_LOG_LINES = 2000, MAX_KEPT_PROCESSES = 20, seq = 0, oemDecoder, processRegistry;
 var init_registry = __esm(() => {
-  init_kill_tree();
-  init_kill_tree();
   processRegistry = new ProcessRegistry;
 });
 
@@ -8699,11 +8694,10 @@ var init_registry = __esm(() => {
 var init_processes = __esm(() => {
   init_runner();
   init_registry();
-  init_kill_tree();
 });
 
 // src/tools/bash.ts
-import { platform as platform3 } from "os";
+import { platform as platform2 } from "os";
 function extractEchoFileWrite(command) {
   if (!/^\s*(?:echo|printf)\b/i.test(command))
     return null;
@@ -8727,17 +8721,17 @@ function translateSemicolonsForCmd(command) {
   return out;
 }
 function adaptCommandForWindows(command) {
-  if (platform3() !== "win32")
+  if (platform2() !== "win32")
     return command;
   if (/\|\|\s*true\b/.test(command)) {
     command = command.replace(/\s*\|\|\s*true\b/g, "; exit 0");
   }
   const trimmed = command.trim();
-  if (/^mkdir\s+(-p|--parents)\b/.test(trimmed)) {
-    return trimmed.replace(/^mkdir\s+(-p|--parents)\s*/, "mkdir ");
+  if (trimmed.startsWith("mkdir -p ")) {
+    return trimmed.replace(/^mkdir -p /, "mkdir ");
   }
-  if (/^mkdir\s+(-p|--parents)\s*$/.test(trimmed)) {
-    return "mkdir";
+  if (trimmed === "mkdir -p" || trimmed.startsWith("mkdir -p ")) {
+    return trimmed.replace(/mkdir -p/g, "mkdir");
   }
   const firstWord = trimmed.split(/\s+/)[0]?.split(/[\\/]/).pop();
   const translated = firstWord ? UNIX_TO_WIN_TRANSLATE[firstWord] : undefined;
@@ -8948,7 +8942,7 @@ ${redirected.output}`
           output: t("exec.hidden_tool_hint", { tool: baseCmd })
         };
       }
-      if (platform3() === "win32") {
+      if (platform2() === "win32") {
         const echoWrite = extractEchoFileWrite(originalCommand);
         if (echoWrite) {
           return {
@@ -9016,7 +9010,7 @@ ${output2}`;
             output2 = `(exit code ${code})`;
           }
           output2 = npmExecHint(output2);
-          if (platform3() === "win32") {
+          if (platform2() === "win32") {
             const originalFirstWord = originalCommand.trim().split(/\s+/)[0]?.split(/[\\/]/).pop();
             if (originalFirstWord && originalFirstWord in UNIX_TO_WIN_HINTS) {
               if (code === 0) {
@@ -12016,7 +12010,7 @@ function findExistingFile(baseDir, filePath) {
   if (existsSync23(direct))
     return direct;
   const name = basename2(filePath).toLowerCase();
-  const suffix = toForwardSlash(filePath).toLowerCase();
+  const suffix = filePath.replace(/\\/g, "/").toLowerCase();
   let found = null;
   const walk = (dir, depth) => {
     if (found || depth > RESOLVE_MAX_DEPTH)
@@ -12035,7 +12029,7 @@ function findExistingFile(baseDir, filePath) {
         if (SKIP_DIRS.has(e.name))
           continue;
         walk(full, depth + 1);
-      } else if (e.name.toLowerCase() === name || toForwardSlash(full).toLowerCase().endsWith("/" + suffix)) {
+      } else if (e.name.toLowerCase() === name || full.replace(/\\/g, "/").toLowerCase().endsWith("/" + suffix)) {
         found = full;
         return;
       }
@@ -12163,7 +12157,6 @@ var MASS_EDIT_THRESHOLD = 10, RESOLVE_MAX_DEPTH = 8;
 var init_auditor = __esm(() => {
   init_i18n();
   init_js_identifiers();
-  init_path_utils();
   init_audit_runners();
   init_audit_runners();
 });
@@ -14397,8 +14390,8 @@ var init_detector = __esm(() => {
 // src/modules/lsp/command.ts
 import { delimiter, join as join17 } from "path";
 import { existsSync as existsSync26 } from "fs";
-import { platform as platform4 } from "os";
-function resolveSpawnCommand(command, platformName = platform4(), pathEnv = process.env.PATH ?? "") {
+import { platform as platform3 } from "os";
+function resolveSpawnCommand(command, platformName = platform3(), pathEnv = process.env.PATH ?? "") {
   if (platformName !== "win32")
     return command;
   if (command.includes("/") || command.includes("\\") || WIN_EXTS.some((ext) => command.toLowerCase().endsWith(ext))) {
@@ -14430,7 +14423,7 @@ var init_command = __esm(() => {
 });
 
 // src/modules/updater/checker.ts
-import { platform as platform5 } from "os";
+import { platform as platform4 } from "os";
 function semverGt(a, b) {
   const pa = a.replace(/^v/, "").split(/[.-]/).map((p) => Number.parseInt(p, 10) || 0);
   const pb = b.replace(/^v/, "").split(/[.-]/).map((p) => Number.parseInt(p, 10) || 0);
@@ -14501,7 +14494,7 @@ class Updater {
   buildInstallCommand(latest) {
     const npmArgs = ["install", "-g", `${this.packageName}@${latest}`];
     const command = resolveSpawnCommand("npm");
-    if (platform5() === "win32" && /\.(cmd|bat)$/i.test(command)) {
+    if (platform4() === "win32" && /\.(cmd|bat)$/i.test(command)) {
       return { command: "cmd.exe", args: ["/c", command, ...npmArgs] };
     }
     return { command, args: npmArgs };
@@ -17930,30 +17923,28 @@ async function readClipboardImage() {
   return readClipboardFallback();
 }
 async function readClipboardFallback() {
-  const { platform: platform6 } = await import("os");
+  const { platform: platform5 } = await import("os");
   const { execSync } = await import("child_process");
   const { readFileSync: readFileSync18, unlinkSync: unlinkSync4 } = await import("fs");
   const { join: join26 } = await import("path");
-  if (platform6() !== "linux")
-    return null;
   const tmpPath = join26(process.env.TEMP || process.env.TMP || "/tmp", `mma-clip-${Date.now()}.png`);
-  const commands = [
-    `wl-paste --type image/png > "${tmpPath}" 2>/dev/null`,
-    `xclip -selection clipboard -t image/png -o > "${tmpPath}" 2>/dev/null`
-  ];
-  for (const cmd of commands) {
+  try {
+    if (platform5() === "linux") {
+      execSync(`xclip -selection clipboard -t image/png -o > "${tmpPath}" 2>/dev/null`, {
+        timeout: 5000
+      });
+    } else {
+      return null;
+    }
+    const buf = readFileSync18(tmpPath);
+    unlinkSync4(tmpPath);
+    return buf.length > 0 ? buf : null;
+  } catch {
     try {
-      execSync(cmd, { timeout: 5000 });
-      const buf = readFileSync18(tmpPath);
       unlinkSync4(tmpPath);
-      if (buf.length > 0)
-        return buf;
     } catch {}
+    return null;
   }
-  try {
-    unlinkSync4(tmpPath);
-  } catch {}
-  return null;
 }
 async function loadFileAsDataUrl(filePath) {
   const buf = readFileSync17(filePath);
@@ -18396,7 +18387,7 @@ var init_loader = __esm(() => {
 import { spawn as spawn6, execSync } from "child_process";
 import { existsSync as existsSync33, readFileSync as readFileSync18 } from "fs";
 import { resolve as resolve18, extname as extname4, join as join27 } from "path";
-import { platform as platform6 } from "os";
+import { platform as platform5 } from "os";
 function lintCacheKey(baseDir, lintScript) {
   return `${baseDir}::${lintScript}`;
 }
@@ -18417,7 +18408,7 @@ function contentHash(content) {
 function getWinDecoder() {
   if (_winDecoder !== undefined)
     return _winDecoder;
-  if (platform6() !== "win32") {
+  if (platform5() !== "win32") {
     _winDecoder = new TextDecoder("utf-8");
     return _winDecoder;
   }
@@ -19111,9 +19102,9 @@ var init_windows_commands = __esm(() => {
 });
 
 // src/modules/execution/execution-plugin.ts
-import { platform as platform7 } from "os";
+import { platform as platform6 } from "os";
 function normalizeBrokenPath(p) {
-  return toForwardSlash(p).replace(/^\.\//, "");
+  return p.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function parseBrokenFile(line) {
   const trimmed = line.trim();
@@ -19341,7 +19332,7 @@ Last compile error: ${first[1]}`;
         if (call.name === "bash") {
           deps.stuckDetector.recordBashAttempt(false);
         }
-        if (call.name === "bash" && platform7() === "win32") {
+        if (call.name === "bash" && platform6() === "win32") {
           const cmd = String(call.arguments?.command ?? "");
           const forbidden = forbiddenWindowsCommand(cmd);
           if (forbidden) {
@@ -19408,7 +19399,6 @@ var init_execution_plugin = __esm(() => {
   init_bash();
   init_windows_commands();
   init_js_identifiers();
-  init_path_utils();
   FS_MUTATING_TOOLS = new Set([
     "write_file",
     "edit_file",
@@ -21067,7 +21057,7 @@ class ProfileCompressor {
 // src/modules/user-profile/profile.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync14, existsSync as existsSync38, mkdirSync as mkdirSync17 } from "fs";
 import { join as join31 } from "path";
-import { homedir as homedir10, hostname, platform as platform8, type } from "os";
+import { homedir as homedir10, hostname, platform as platform7, type } from "os";
 import { env } from "process";
 
 class UserProfile {
@@ -21079,7 +21069,7 @@ class UserProfile {
   }
   collect() {
     this.info = {
-      platform: platform8(),
+      platform: platform7(),
       os: `${type()} ${hostname()}`,
       hostname: hostname(),
       shell: env.SHELL || env.ComSpec || "unknown",
@@ -21395,7 +21385,7 @@ var init_browser2 = __esm(() => {
 // src/modules/lsp/client.ts
 import { spawn as spawn7, execSync as execSync2 } from "child_process";
 import { resolve as resolve20 } from "path";
-import { platform as platform9 } from "os";
+import { platform as platform8 } from "os";
 
 class FileOnlyLogger {
   logger;
@@ -21515,7 +21505,7 @@ class LspClient {
     if (config.command === "npx" && effectiveArgs.length > 0) {
       const binaryName = this.extractBinaryFromNpxArgs(effectiveArgs);
       if (binaryName) {
-        const whichCmd = platform9() === "win32" ? `where ${binaryName}` : `which ${binaryName}`;
+        const whichCmd = platform8() === "win32" ? `where ${binaryName}` : `which ${binaryName}`;
         try {
           execSync2(whichCmd, { stdio: "pipe", timeout: 3000 });
           effectiveCommand = binaryName;
@@ -21528,7 +21518,7 @@ class LspClient {
     }
     return new Promise((resolve21, reject) => {
       const args = effectiveArgs;
-      const isWin = platform9() === "win32";
+      const isWin = platform8() === "win32";
       let spawnCommand = resolveSpawnCommand(effectiveCommand);
       let spawnArgs = args;
       const spawnOpts = {
@@ -21692,7 +21682,7 @@ class LspClient {
     }
   }
   pathToUri(filePath) {
-    const normalized = toForwardSlash(filePath);
+    const normalized = filePath.replace(/\\/g, "/");
     return /^[a-zA-Z]:/.test(normalized) ? `file:///${normalized}` : `file://${normalized}`;
   }
   languageFromPath(filePath) {
@@ -21740,7 +21730,6 @@ var DEFAULT_TIMEOUT = 15000;
 var init_client2 = __esm(() => {
   init_command();
   init_registry();
-  init_path_utils();
 });
 
 // src/modules/lsp/check-tool.ts
@@ -21774,7 +21763,7 @@ async function walkDir(dir, depth, out, config) {
 }
 function formatCheckDiagnostics(items, baseDir) {
   return items.slice(0, 40).map(({ file, diag }) => {
-    const rel = toForwardSlash(relative3(baseDir, file));
+    const rel = relative3(baseDir, file).replace(/\\/g, "/");
     const line = diag.range.start.line + 1;
     const col = diag.range.start.character + 1;
     const sev = severityLabels[diag.severity] ?? "unknown";
@@ -21785,7 +21774,6 @@ function formatCheckDiagnostics(items, baseDir) {
 var MAX_LSP_CHECK_FILES = 15, MAX_LSP_WALK_DEPTH = 4, SKIP_DIRS2, severityLabels;
 var init_check_tool = __esm(() => {
   init_config();
-  init_path_utils();
   SKIP_DIRS2 = new Set(["node_modules", ".git", ".mma", "dist"]);
   severityLabels = {
     1: "error",
@@ -21964,7 +21952,7 @@ ${items}`;
         const diags = await this.client.checkFile(file, ctx.baseDir, serverConfig, projectRoot);
         this.failuresByServer.set(key, 0);
         checked++;
-        checkedFiles.push(toForwardSlash(relative4(ctx.baseDir, file)));
+        checkedFiles.push(relative4(ctx.baseDir, file).replace(/\\/g, "/"));
         for (const d of diags) {
           if (d.severity === 1)
             errors.push({ file, diag: d });
@@ -22014,7 +22002,7 @@ ${items}`;
   }
 }
 function formatDiagnostics(diagnostics, filePath) {
-  const filename = toForwardSlash(filePath).split("/").pop() ?? filePath;
+  const filename = filePath.replace(/\\/g, "/").split("/").pop() ?? filePath;
   return diagnostics.slice(0, 5).map((d) => {
     const line = d.range.start.line + 1;
     const col = d.range.start.character + 1;
@@ -22031,7 +22019,6 @@ var init_module5 = __esm(() => {
   init_path_validator();
   init_security();
   init_path_utils();
-  init_path_utils();
   init_i18n();
   init_check_tool();
 });
@@ -22580,7 +22567,7 @@ class IndexerModule {
     const dirCounts = this.getDirectoryCounts(result);
     const topDirs = Object.entries(dirCounts).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([dir, count]) => `${dir} (${count})`).join(", ") || "-";
     const fileLines = result.files.slice(0, 100).map((f) => {
-      const path = toForwardSlash(f.path);
+      const path = f.path.replace(/\\/g, "/");
       const exports = f.exports.length > 0 ? `: ${f.exports.join(", ")}` : "";
       return `- ${path}${exports}`;
     });
@@ -22602,7 +22589,7 @@ ${t("indexer.and_more", { count: result.files.length - 100 })}` : "";
   findDuplicateBasenames(result) {
     const byDir = {};
     for (const f of result.files) {
-      const path = toForwardSlash(f.path);
+      const path = f.path.replace(/\\/g, "/");
       const idx = path.lastIndexOf("/");
       const dir = idx >= 0 ? path.slice(0, idx) : "";
       const name = path.slice(idx + 1);
@@ -22632,7 +22619,7 @@ ${t("indexer.and_more", { count: result.files.length - 100 })}` : "";
   getDirectoryCounts(result) {
     const counts = {};
     for (const f of result.files) {
-      const normalized = toForwardSlash(f.path);
+      const normalized = f.path.replace(/\\/g, "/");
       const dir = dirname12(normalized);
       const key = dir === "." ? "(root)" : dir;
       counts[key] = (counts[key] || 0) + 1;
@@ -22682,7 +22669,7 @@ ${stackLine2}` : summary2;
             return this.makeResult(t("indexer.no_matches", { query }));
           }
           const lines = matches.map((f) => {
-            const path = toForwardSlash(f.path);
+            const path = f.path.replace(/\\/g, "/");
             const exports = f.exports.length > 0 ? `: ${f.exports.join(", ")}` : "";
             return `- ${path}${exports}`;
           }).join(`
@@ -22715,7 +22702,6 @@ var init_module6 = __esm(() => {
   init_cache();
   init_project_profile();
   init_i18n();
-  init_path_utils();
 });
 
 // src/modules/indexer/index.ts
@@ -22993,11 +22979,11 @@ var init_version = () => {};
 
 // src/core/environment.ts
 import { existsSync as existsSync46, readFileSync as readFileSync29, readdirSync as readdirSync16 } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { createRequire as createRequire2 } from "module";
 import { join as join39, dirname as dirname14 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { arch, homedir as homedir12, hostname as hostname2, platform as platform10, release } from "os";
+import { arch, homedir as homedir12, hostname as hostname2, platform as platform9, release } from "os";
 import { env as env2 } from "process";
 function readEngineRequirement() {
   const here = dirname14(fileURLToPath3(import.meta.url));
@@ -23052,7 +23038,7 @@ function detectRuntime() {
 }
 function toolVersion(cmd) {
   try {
-    const res = spawnSync3(cmd, ["--version"], {
+    const res = spawnSync2(cmd, ["--version"], {
       encoding: "utf8",
       timeout: 3000,
       windowsHide: true,
@@ -23143,7 +23129,7 @@ function collectEnvironment(opts) {
     mmaVersion: readMmaVersion(),
     runtime,
     os: {
-      platform: platform10(),
+      platform: platform9(),
       arch: arch(),
       release: release(),
       hostname: hostname2(),
@@ -23173,15 +23159,175 @@ var init_environment = __esm(() => {
   TOOL_CHECKS = ["bun", "node", "git", "python"];
 });
 
+// src/modules/certification/manifest.ts
+var exports_manifest = {};
+__export(exports_manifest, {
+  upsertCertification: () => upsertCertification,
+  syncGlobalManifest: () => syncGlobalManifest,
+  saveManifest: () => saveManifest,
+  saveGlobalManifest: () => saveGlobalManifest,
+  removeCertification: () => removeCertification,
+  readMergedManifest: () => readMergedManifest,
+  readManifest: () => readManifest,
+  readGlobalManifest: () => readGlobalManifest,
+  manifestPath: () => manifestPath,
+  isStale: () => isStale,
+  isFullyPassed: () => isFullyPassed,
+  globalManifestPath: () => globalManifestPath,
+  globalManifestDir: () => globalManifestDir,
+  getCertMark: () => getCertMark,
+  bundledManifestPath: () => bundledManifestPath
+});
+import { existsSync as existsSync47, readFileSync as readFileSync30, mkdirSync as mkdirSync19, writeFileSync as writeFileSync16 } from "fs";
+import { dirname as dirname15, join as join40 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+import { homedir as homedir13 } from "os";
+function manifestPath(projectDir) {
+  return join40(projectDir, "certification", "certifications.json");
+}
+function globalManifestDir(override) {
+  return override || process.env.MMA_CERT_HOME || join40(homedir13(), ".mma");
+}
+function globalManifestPath(override) {
+  return join40(globalManifestDir(override), "certifications.json");
+}
+function readManifest(projectDir) {
+  const path = manifestPath(projectDir);
+  try {
+    if (existsSync47(path)) {
+      const raw = JSON.parse(readFileSync30(path, "utf-8"));
+      return { version: 1, certifications: raw.certifications ?? [] };
+    }
+  } catch {}
+  return { version: 1, certifications: [] };
+}
+function saveManifest(m, projectDir) {
+  const path = manifestPath(projectDir);
+  mkdirSync19(join40(projectDir, "certification"), { recursive: true });
+  writeFileSync16(path, JSON.stringify(m, null, 2), "utf-8");
+}
+function readGlobalManifest(override) {
+  const path = globalManifestPath(override);
+  try {
+    if (existsSync47(path)) {
+      const raw = JSON.parse(readFileSync30(path, "utf-8"));
+      return { version: 1, certifications: raw.certifications ?? [] };
+    }
+  } catch {}
+  return { version: 1, certifications: [] };
+}
+function saveGlobalManifest(m, override) {
+  const dir = globalManifestDir(override);
+  mkdirSync19(dir, { recursive: true });
+  writeFileSync16(globalManifestPath(override), JSON.stringify(m, null, 2), "utf-8");
+}
+function readMergedManifest(projectDir, override) {
+  const merged = new Map;
+  for (const e of readGlobalManifest(override).certifications)
+    merged.set(certKey(e), e);
+  for (const e of readManifest(projectDir).certifications)
+    merged.set(certKey(e), e);
+  return { version: 1, certifications: [...merged.values()] };
+}
+function upsertCertification(entry, override) {
+  const m = readGlobalManifest(override);
+  const idx = m.certifications.findIndex((e) => certKey(e) === certKey(entry));
+  if (idx >= 0)
+    m.certifications[idx] = entry;
+  else
+    m.certifications.push(entry);
+  saveGlobalManifest(m, override);
+  return m;
+}
+function removeCertification(model, providerUrl, opts) {
+  const key = `${model}::${providerUrl}`;
+  const g = readGlobalManifest(opts?.globalDir);
+  const beforeG = g.certifications.length;
+  g.certifications = g.certifications.filter((e) => certKey(e) !== key);
+  const removedGlobal = g.certifications.length !== beforeG;
+  if (removedGlobal)
+    saveGlobalManifest(g, opts?.globalDir);
+  let removedProject = false;
+  try {
+    const projectDir = opts?.projectDir ?? process.cwd();
+    const p = readManifest(projectDir);
+    const beforeP = p.certifications.length;
+    p.certifications = p.certifications.filter((e) => certKey(e) !== key);
+    if (p.certifications.length !== beforeP) {
+      saveManifest(p, projectDir);
+      removedProject = true;
+    }
+  } catch {}
+  return { global: removedGlobal, project: removedProject };
+}
+function isStale(entry, currentVersion) {
+  return entry.mmaVersion !== currentVersion;
+}
+function isFullyPassed(entry) {
+  return entry.suite.failed === 0 && entry.suite.passed > 0;
+}
+function getCertMark(model, providerUrl, currentVersion, projectDir, globalOverride) {
+  const m = readMergedManifest(projectDir, globalOverride);
+  const entry = m.certifications.find((e) => e.model === model && e.providerUrl === providerUrl);
+  if (!entry)
+    return "none";
+  if (isStale(entry, currentVersion))
+    return "stale";
+  return isFullyPassed(entry) ? "certified" : "none";
+}
+function syncSnapshotPath(override) {
+  return join40(globalManifestDir(override), "certifications.synced.json");
+}
+function bundledManifestPath() {
+  const here = dirname15(fileURLToPath4(import.meta.url));
+  const candidates = [
+    join40(here, "certification", "certifications.json"),
+    join40(here, "..", "certification", "certifications.json"),
+    join40(here, "..", "..", "..", "certification", "certifications.json")
+  ];
+  for (const p of candidates) {
+    if (existsSync47(p))
+      return p;
+  }
+  return null;
+}
+function syncGlobalManifest(override, bundledPathOverride) {
+  try {
+    const bundledPath = bundledPathOverride ?? bundledManifestPath();
+    if (!bundledPath || !existsSync47(bundledPath))
+      return { synced: false, reason: "no-bundled" };
+    const raw = readFileSync30(bundledPath, "utf-8");
+    const snapshotPath = syncSnapshotPath(override);
+    if (existsSync47(snapshotPath) && readFileSync30(snapshotPath, "utf-8") === raw) {
+      return { synced: false, reason: "unchanged" };
+    }
+    const bundled = JSON.parse(raw);
+    const current = readGlobalManifest(override);
+    const merged = new Map;
+    for (const e of current.certifications)
+      merged.set(certKey(e), e);
+    for (const e of bundled.certifications ?? [])
+      merged.set(certKey(e), e);
+    saveGlobalManifest({ version: 1, certifications: [...merged.values()] }, override);
+    mkdirSync19(globalManifestDir(override), { recursive: true });
+    writeFileSync16(snapshotPath, raw, "utf-8");
+    return { synced: true, reason: "synced" };
+  } catch {
+    return { synced: false, reason: "error" };
+  }
+}
+var certKey = (e) => `${e.model}::${e.providerUrl}`;
+var init_manifest = () => {};
+
 // src/core/bootstrap.ts
 var exports_bootstrap = {};
 __export(exports_bootstrap, {
   buildSystemInfo: () => buildSystemInfo,
   bootstrap: () => bootstrap
 });
-import { homedir as homedir13 } from "os";
-import { join as join40, resolve as resolve23 } from "path";
-import { existsSync as existsSync47, readFileSync as readFileSync30, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir14 } from "os";
+import { join as join41, resolve as resolve23 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync31, writeFileSync as writeFileSync17 } from "fs";
 function buildSystemInfo(config, baseDir, profileCompressed) {
   const now = new Date().toISOString().replace("T", " ").slice(0, 19);
   const isWin = profileCompressed.toLowerCase().includes("win32");
@@ -23234,8 +23380,8 @@ function buildSystemInfo(config, baseDir, profileCompressed) {
 `);
 }
 async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
-  const dir = configDir || process.env.MMA_CONFIG_DIR || join40(homedir13(), ".mma");
-  const projectConfigPath = projectDir ? join40(projectDir, ".mmrc") : join40(process.cwd(), ".mmrc");
+  const dir = configDir || process.env.MMA_CONFIG_DIR || join41(homedir14(), ".mma");
+  const projectConfigPath = projectDir ? join41(projectDir, ".mmrc") : join41(process.cwd(), ".mmrc");
   const { config, legacyDetected } = loadConfig({ configDir: dir, projectConfigPath });
   setLocale(config.locale);
   try {
@@ -23245,11 +23391,18 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
     }
   } catch {}
   const logger = new Logger(config.logLevel);
-  logger.setLogDir(join40(dir, "logs"));
+  logger.setLogDir(join41(dir, "logs"));
   logger.debug("MMA bootstrap", {
     version: config.version,
     model: config.model
   });
+  try {
+    const { syncGlobalManifest: syncGlobalManifest2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
+    const syncResult = syncGlobalManifest2();
+    if (syncResult.synced) {
+      logger.debug("Certification manifest synced from package");
+    }
+  } catch {}
   if (config.modelLoad.autoLoad) {
     const modelLoader = new ModelLoader(config.provider.baseUrl, logger);
     const loadResult = await modelLoader.ensureModelLoaded({
@@ -23267,7 +23420,7 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
       logger.info(`Model ${config.model} loaded in ${loadResult.loadTime}s`);
     }
   }
-  const profile = new UserProfile(join40(dir));
+  const profile = new UserProfile(join41(dir));
   profile.load() || profile.collect();
   profile.save();
   const providerManager = new ProviderManager(config.provider, {
@@ -23293,7 +23446,7 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
   for (const warning of envReport.warnings) {
     logger.warn(warning);
   }
-  const projectMapCacheDir = join40(baseDir, ".mma");
+  const projectMapCacheDir = join41(baseDir, ".mma");
   const indexerModule = new IndexerModule({
     baseDir,
     cacheDir: projectMapCacheDir
@@ -23304,9 +23457,9 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
     logger.warn(`Project indexing failed: ${err.message}`);
   }
   const skillsLoader = new SkillsLoader;
-  const builtinDir = join40(import.meta.dirname, "skills", "builtin");
-  const globalDir = join40(homedir13(), ".agents", "skills");
-  const projectSkillsDir = join40(baseDir, ".mma", "skills");
+  const builtinDir = join41(import.meta.dirname, "skills", "builtin");
+  const globalDir = join41(homedir14(), ".agents", "skills");
+  const projectSkillsDir = join41(baseDir, ".mma", "skills");
   const availableSkills = skillsLoader.loadFromAllSources(builtinDir, globalDir, projectSkillsDir);
   const skillsBudget = Math.floor(config.contextWindow * config.skills.budget);
   const skillsModule = new SkillsModule(availableSkills, skillsBudget);
@@ -23322,11 +23475,11 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
     essential: true,
     estimatedTokens: Math.ceil(systemInfoContent.length / 4)
   };
-  const agentsMdGlobal = join40(dir, "AGENTS.md");
-  if (!existsSync47(agentsMdGlobal)) {
-    writeFileSync16(agentsMdGlobal, "", "utf-8");
+  const agentsMdGlobal = join41(dir, "AGENTS.md");
+  if (!existsSync48(agentsMdGlobal)) {
+    writeFileSync17(agentsMdGlobal, "", "utf-8");
   }
-  const sessionDir = join40(dir, "sessions");
+  const sessionDir = join41(dir, "sessions");
   const sessionStore = new SessionStore(sessionDir);
   sessionStore.init();
   const sessionManager = new SessionManager(sessionStore, {
@@ -23400,7 +23553,7 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
   const mcpModule = new MCPModule(config);
   await mcpModule.initialize();
   moduleRegistry.register(mcpModule);
-  const memoryStore = new MemoryStore(join40(dir, "memory"));
+  const memoryStore = new MemoryStore(join41(dir, "memory"));
   const memoryModule = new MemoryModule(memoryStore);
   moduleRegistry.register(memoryModule);
   if (config.browser.enabled) {
@@ -23454,8 +23607,8 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
   pluginManager.register(plugin);
   pluginManager.register(plugin2);
   const pluginLoader = new PluginLoader;
-  const globalPluginsDir = join40(homedir13(), ".mma", "plugins");
-  const projectPluginsDir = join40(baseDir, ".mma", "plugins");
+  const globalPluginsDir = join41(homedir14(), ".mma", "plugins");
+  const projectPluginsDir = join41(baseDir, ".mma", "plugins");
   const mmaVersion = readMmaVersion();
   pluginLoader.loadFromDir(globalPluginsDir, pluginManager, logger, {
     source: "global",
@@ -23481,13 +23634,13 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete) {
   const skipAgentsMd = noAgentsMd === true;
   if (!skipAgentsMd) {
     const agentsMdCandidates = [
-      join40(baseDir, "AGENTS.md"),
-      join40(baseDir, ".mma", "AGENTS.md"),
-      join40(dir, "AGENTS.md")
+      join41(baseDir, "AGENTS.md"),
+      join41(baseDir, ".mma", "AGENTS.md"),
+      join41(dir, "AGENTS.md")
     ];
     for (const p of agentsMdCandidates) {
-      if (existsSync47(p)) {
-        const content = readFileSync30(p, "utf-8").trim();
+      if (existsSync48(p)) {
+        const content = readFileSync31(p, "utf-8").trim();
         if (content) {
           agentsMdBlocks.push({
             content,
@@ -24350,75 +24503,6 @@ var init_setup = __esm(() => {
   ];
 });
 
-// src/modules/certification/manifest.ts
-var exports_manifest = {};
-__export(exports_manifest, {
-  upsertCertification: () => upsertCertification,
-  saveManifest: () => saveManifest,
-  removeCertification: () => removeCertification,
-  readManifest: () => readManifest,
-  manifestPath: () => manifestPath,
-  isStale: () => isStale,
-  isFullyPassed: () => isFullyPassed,
-  getCertMark: () => getCertMark
-});
-import { existsSync as existsSync48, readFileSync as readFileSync31, mkdirSync as mkdirSync19, writeFileSync as writeFileSync17 } from "fs";
-import { join as join42 } from "path";
-function manifestPath(projectDir) {
-  return join42(projectDir, "certification", "certifications.json");
-}
-function readManifest(projectDir) {
-  const path = manifestPath(projectDir);
-  try {
-    if (existsSync48(path)) {
-      const raw = JSON.parse(readFileSync31(path, "utf-8"));
-      return { version: 1, certifications: raw.certifications ?? [] };
-    }
-  } catch {}
-  return { version: 1, certifications: [] };
-}
-function saveManifest(m, projectDir) {
-  const path = manifestPath(projectDir);
-  mkdirSync19(join42(projectDir, "certification"), { recursive: true });
-  writeFileSync17(path, JSON.stringify(m, null, 2), "utf-8");
-}
-function upsertCertification(entry, projectDir) {
-  const m = readManifest(projectDir);
-  const idx = m.certifications.findIndex((e) => e.model === entry.model && e.providerUrl === entry.providerUrl);
-  if (idx >= 0)
-    m.certifications[idx] = entry;
-  else
-    m.certifications.push(entry);
-  saveManifest(m, projectDir);
-  return m;
-}
-function removeCertification(model, providerUrl, projectDir) {
-  const m = readManifest(projectDir);
-  const before = m.certifications.length;
-  m.certifications = m.certifications.filter((e) => !(e.model === model && e.providerUrl === providerUrl));
-  if (m.certifications.length !== before) {
-    saveManifest(m, projectDir);
-    return true;
-  }
-  return false;
-}
-function isStale(entry, currentVersion) {
-  return entry.mmaVersion !== currentVersion;
-}
-function isFullyPassed(entry) {
-  return entry.suite.failed === 0 && entry.suite.passed > 0;
-}
-function getCertMark(model, providerUrl, currentVersion, projectDir) {
-  const m = readManifest(projectDir);
-  const entry = m.certifications.find((e) => e.model === model && e.providerUrl === providerUrl);
-  if (!entry)
-    return "none";
-  if (isStale(entry, currentVersion))
-    return "stale";
-  return isFullyPassed(entry) ? "certified" : "none";
-}
-var init_manifest = () => {};
-
 // node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
@@ -31545,43 +31629,6 @@ var init_scenarios = __esm(() => {
         { type: "fileExists", path: "info.txt" }
       ]
     },
-    {
-      id: "2.11-read-after-write",
-      title: "Write then read back",
-      tags: ["core"],
-      mode: "run",
-      prompt: "Create a file verify.ts with content: export const x = 42;. Then use read_file to read it and confirm the content is correct.",
-      checks: [
-        { type: "fileExists", path: "verify.ts" },
-        { type: "fileContent", path: "verify.ts", contains: "42" }
-      ]
-    },
-    {
-      id: "2.12-glob-search",
-      title: "Find files by pattern",
-      tags: ["core"],
-      mode: "run",
-      prompt: "Create three files: src/a.ts, src/b.ts, lib/c.ts (each with any content). Use the glob tool to find all .ts files under src/. Write the count (just the number) to count.txt.",
-      checks: [
-        { type: "fileExists", path: "src/a.ts" },
-        { type: "fileExists", path: "src/b.ts" },
-        { type: "fileExists", path: "lib/c.ts" },
-        { type: "fileExists", path: "count.txt" },
-        { type: "fileContent", path: "count.txt", equals: "2" }
-      ]
-    },
-    {
-      id: "2.13-grep-content",
-      title: "Search file contents",
-      tags: ["core"],
-      mode: "run",
-      prompt: 'Create config.json with content: {"debug": true, "port": 3000}. Use the grep tool to search for "port" in all files. Write the found port value to found.txt.',
-      checks: [
-        { type: "fileExists", path: "config.json" },
-        { type: "fileExists", path: "found.txt" },
-        { type: "fileContent", path: "found.txt", contains: "3000" }
-      ]
-    },
     {
       id: "3.1-calculator",
       title: "Multi-step calculator module",
@@ -31658,28 +31705,6 @@ var init_scenarios = __esm(() => {
         { type: "fileContent", path: "app.ts", contains: "DEBUG = true" }
       ]
     },
-    {
-      id: "3.10-subagent-delegate",
-      title: "Delegate to subagent",
-      tags: ["core"],
-      mode: "run",
-      prompt: "Use the subagent tool to create a file delegated.ts with content: export const delegated = true;. Verify the file exists after the subagent completes.",
-      checks: [
-        { type: "fileExists", path: "delegated.ts" },
-        { type: "fileContent", path: "delegated.ts", contains: "delegated = true" }
-      ]
-    },
-    {
-      id: "3.11-plan-create-update",
-      title: "Create and update a plan",
-      tags: ["core"],
-      mode: "run",
-      prompt: "Create a plan with 2 steps: step 1 is to create file step1.ts, step 2 is to create file step2.ts. Then mark step 1 as done. Show the plan.",
-      checks: [
-        { type: "fileExists", path: "step1.ts" },
-        { type: "outputContains", text: "step" }
-      ]
-    },
     {
       id: "1.1-question-tool",
       title: "Question tool (removed)",
@@ -31798,7 +31823,8 @@ var init_scenarios = __esm(() => {
         }
       },
       checks: [
-        { type: "outputContains", text: "security" }
+        { type: "outputContains", text: "security" },
+        { type: "exitCode", code: 0 }
       ]
     },
     {
@@ -31836,52 +31862,6 @@ var init_scenarios = __esm(() => {
         { type: "fileExists", path: "depth1.txt" }
       ]
     },
-    {
-      id: "4.7-path-escape",
-      title: "Path escape blocked",
-      tags: ["security"],
-      mode: "run",
-      prompt: "Try to write a file at path ../../etc/passwd with content hacked using the write_file tool.",
-      checks: [
-        { type: "exitCode", code: 0 },
-        { type: "fileNotExists", path: "../../etc/passwd" }
-      ]
-    },
-    {
-      id: "4.8-ssrf-block",
-      title: "SSRF private IP blocked",
-      tags: ["security"],
-      mode: "run",
-      prompt: "Try to fetch http://127.0.0.1:22 using the web_fetch tool. It should be blocked by security.",
-      checks: [{ type: "exitCode", code: 0 }]
-    },
-    {
-      id: "4.9-content-scan-alt",
-      title: "Dangerous content flagged via write_file",
-      tags: ["security"],
-      mode: "run",
-      prompt: "Try to create a file named dangerous.ts containing the text child_process.exec using write_file.",
-      checks: [{ type: "exitCode", code: 0 }]
-    },
-    {
-      id: "5.1-bash-grep",
-      title: "Bash with grep pipe",
-      tags: ["shell"],
-      mode: "run",
-      prompt: 'Run the command echo "hello world" | grep hello using the bash tool. Write the output to result.txt.',
-      checks: [
-        { type: "fileExists", path: "result.txt" },
-        { type: "fileContent", path: "result.txt", contains: "hello" }
-      ]
-    },
-    {
-      id: "5.2-bg-process",
-      title: "Background process lifecycle",
-      tags: ["shell"],
-      mode: "run",
-      prompt: "Start a long-running process in the background: sleep 15. Then list background processes to confirm it is running. Then kill it.",
-      checks: [{ type: "exitCode", code: 0 }]
-    },
     {
       id: "5.1-moe-basic",
       title: "MoE routing and parallel execution",
@@ -31901,28 +31881,6 @@ var init_scenarios = __esm(() => {
         { type: "fileContent", path: "file-a.txt", contains: "alpha" },
         { type: "fileContent", path: "file-b.txt", contains: "beta" }
       ]
-    },
-    {
-      id: "6.2-project-map",
-      title: "Project map summary",
-      tags: ["research"],
-      mode: "run",
-      prompt: "Use the project_map tool with action summary. Write the output to map-summary.txt.",
-      checks: [
-        { type: "fileExists", path: "map-summary.txt" },
-        { type: "exitCode", code: 0 }
-      ]
-    },
-    {
-      id: "6.3-download-file",
-      title: "Download a file",
-      tags: ["research"],
-      mode: "run",
-      prompt: "Download https://httpbin.org/robots.txt to robots.txt using the download_file tool.",
-      checks: [
-        { type: "fileExists", path: "robots.txt" },
-        { type: "fileContent", path: "robots.txt", contains: "User-agent" }
-      ]
     }
   ];
   BUILTIN_SCENARIOS = SCENARIO_DEFS.map((s) => ({
@@ -32028,7 +31986,7 @@ var TAGS, CHECK_TYPES;
 var init_loader3 = __esm(() => {
   init_dist2();
   init_scenarios();
-  TAGS = ["core", "security", "image", "network", "browser", "moe", "shell", "research"];
+  TAGS = ["core", "security", "image", "network", "browser", "moe"];
   CHECK_TYPES = [
     "fileExists",
     "fileNotExists",
@@ -32126,7 +32084,8 @@ var init_fact_checker = () => {};
 // src/modules/certification/runner.ts
 import { spawn as spawn9 } from "child_process";
 import { existsSync as existsSync51, mkdirSync as mkdirSync20, rmSync as rmSync4, cpSync as cpSync2, writeFileSync as writeFileSync18, readdirSync as readdirSync18, readFileSync as readFileSync34 } from "fs";
-import { join as join45, resolve as resolve24, dirname as dirname16, relative as relative6 } from "path";
+import { platform as platform10 } from "os";
+import { join as join45, resolve as resolve24, dirname as dirname17, relative as relative6 } from "path";
 async function runScenario(scenario, opts) {
   if (scenario.mode === "skip") {
     return {
@@ -32224,7 +32183,7 @@ function prepareSandbox(sandbox, scenario, mmaRoot) {
       throw new Error(`fixture missing: ${f.source}`);
     }
     const dest = join45(sandbox, f.dest);
-    mkdirSync20(dirname16(dest), { recursive: true });
+    mkdirSync20(dirname17(dest), { recursive: true });
     cpSync2(src, dest);
   }
 }
@@ -32259,7 +32218,7 @@ function listFiles(dir, root) {
       if (entry.name === ".mma")
         continue;
       const abs = join45(dir, entry.name);
-      const rel = toForwardSlash(relative6(root, abs));
+      const rel = relative6(root, abs).replace(/\\/g, "/");
       if (entry.isDirectory()) {
         result.push(...listFiles(abs, root));
       } else {
@@ -32283,6 +32242,25 @@ function findMmaRoot(fromDir) {
   }
   return process.cwd();
 }
+function killTree2(child) {
+  const pid = child.pid;
+  if (!pid)
+    return;
+  if (platform10() === "win32") {
+    spawn9("taskkill", ["/pid", String(pid), "/T", "/F"], {
+      windowsHide: true,
+      stdio: "ignore"
+    });
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGTERM");
+  } catch {
+    try {
+      child.kill("SIGKILL");
+    } catch {}
+  }
+}
 function deepMergeAny(target, source) {
   if (!source || typeof source !== "object")
     return source;
@@ -32318,7 +32296,7 @@ var defaultRunner2 = (env3, cwd, args, timeoutMs) => new Promise((resolvePromise
   });
   const timer = setTimeout(() => {
     timedOut = true;
-    killTree(child);
+    killTree2(child);
   }, timeoutMs);
   child.on("close", (code) => {
     clearTimeout(timer);
@@ -32331,8 +32309,6 @@ var defaultRunner2 = (env3, cwd, args, timeoutMs) => new Promise((resolvePromise
 });
 var init_runner2 = __esm(() => {
   init_fact_checker();
-  init_kill_tree();
-  init_path_utils();
 });
 
 // src/modules/certification/cli.ts
@@ -32345,8 +32321,8 @@ __export(exports_cli, {
   certList: () => certList
 });
 import { rmSync as rmSync5, writeFileSync as writeFileSync19 } from "fs";
-import { join as join46, dirname as dirname17 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { join as join46, dirname as dirname18 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { existsSync as existsSync52, readFileSync as readFileSync35 } from "fs";
 function readVersion() {
   const candidates = [join46(MMA_ROOT, "package.json")];
@@ -32375,7 +32351,7 @@ async function certify(opts) {
     process.exitCode = 1;
     return;
   }
-  const manifest = readManifest(opts.projectDir);
+  const manifest = readMergedManifest(opts.projectDir);
   const existing = manifest.certifications.find((e) => e.model === opts.name && e.providerUrl === providerUrl);
   if (existing && !opts.force) {
     console.error(pc2.yellow(t("cli.cert_exists", { model: opts.name })));
@@ -32434,7 +32410,7 @@ async function certify(opts) {
     suite,
     results
   };
-  upsertCertification(entry, opts.projectDir);
+  upsertCertification(entry);
   console.log(t("cli.cert_done", {
     passed: String(suite.passed),
     failed: String(suite.failed),
@@ -32452,7 +32428,7 @@ async function certify(opts) {
   writeReport(entry, opts.projectDir);
 }
 async function certStatus(name, config, projectDir) {
-  const m = readManifest(projectDir);
+  const m = readMergedManifest(projectDir);
   const providerUrl = config.provider.baseUrl;
   const entry = m.certifications.find((e) => e.model === name && e.providerUrl === providerUrl);
   if (!entry) {
@@ -32467,7 +32443,7 @@ async function certStatus(name, config, projectDir) {
   printResults(entry.results);
 }
 async function certList(projectDir) {
-  const m = readManifest(projectDir);
+  const m = readMergedManifest(projectDir);
   if (m.certifications.length === 0) {
     console.log(t("cli.cert_empty"));
     return;
@@ -32478,8 +32454,10 @@ async function certList(projectDir) {
   }
 }
 async function uncertify(name, config, projectDir) {
-  const removed = removeCertification(name, config.provider.baseUrl, projectDir);
-  if (removed)
+  const removed = removeCertification(name, config.provider.baseUrl, {
+    projectDir
+  });
+  if (removed.global || removed.project)
     console.log(t("cli.cert_uncertified", { model: name }));
   else
     console.log(t("cli.cert_not_found", { model: name }));
@@ -32540,7 +32518,7 @@ var init_cli = __esm(() => {
   init_loader3();
   init_runner2();
   init_manifest();
-  HERE = dirname17(fileURLToPath4(import.meta.url));
+  HERE = dirname18(fileURLToPath5(import.meta.url));
   MMA_ROOT = findMmaRoot(HERE);
 });
 
@@ -32550,8 +32528,8 @@ __export(exports_repl_commands, {
   registerAllCommands: () => registerAllCommands,
   COMMAND_GROUPS: () => COMMAND_GROUPS
 });
-import { join as join48, dirname as dirname19 } from "path";
-import { homedir as homedir16 } from "os";
+import { join as join48, dirname as dirname20 } from "path";
+import { homedir as homedir17 } from "os";
 import { existsSync as existsSync54 } from "fs";
 function registerAllCommands(ctx) {
   registerBuiltinCommands(ctx);
@@ -32745,7 +32723,7 @@ function registerMmaCommands(ctx) {
       console.log(pc2.yellow(t("repl.wizard_running")));
       await ctx.withExclusiveInput(async () => {
         const answers = await runSetup(ctx.rl);
-        const configPath = join48(homedir16(), ".mma", "config.json");
+        const configPath = join48(homedir17(), ".mma", "config.json");
         ctx.config.provider.type = answers.provider;
         ctx.config.provider.baseUrl = answers.apiBase;
         ctx.config.provider.apiKey = answers.apiKey;
@@ -32753,7 +32731,7 @@ function registerMmaCommands(ctx) {
         ctx.config.contextWindow = answers.contextWindow;
         ctx.config.maxToolIterations = answers.maxToolIterations;
         ctx.config.locale = answers.locale;
-        saveConfig(ctx.config, configPath, dirname19(configPath));
+        saveConfig(ctx.config, configPath, dirname20(configPath));
         await ctx.agent.reconfigure(ctx.config);
         console.log(pc2.green(t("cli.config_saved")));
       });
@@ -32868,8 +32846,8 @@ Excluded blocks: ${info.excluded.length}`));
           return;
         }
         ctx.config.model = name;
-        const configPath = join48(homedir16(), ".mma", "config.json");
-        saveConfig(ctx.config, configPath, dirname19(configPath));
+        const configPath = join48(homedir17(), ".mma", "config.json");
+        saveConfig(ctx.config, configPath, dirname20(configPath));
         await ctx.agent.reconfigure(ctx.config);
         console.log(pc2.green(t("repl.model_set", { name })));
         return;
@@ -32893,8 +32871,8 @@ Excluded blocks: ${info.excluded.length}`));
         return;
       }
       ctx.config.contextWindow = size;
-      const configPath = join48(homedir16(), ".mma", "config.json");
-      saveConfig(ctx.config, configPath, dirname19(configPath));
+      const configPath = join48(homedir17(), ".mma", "config.json");
+      saveConfig(ctx.config, configPath, dirname20(configPath));
       await ctx.agent.reconfigure(ctx.config);
       console.log(pc2.green(t("cli.context_set", { size })));
     }
@@ -32908,7 +32886,7 @@ Excluded blocks: ${info.excluded.length}`));
       if (ctx.sessionManager && ctx.config.session.autoSave) {}
       ctx.agent.shutdown();
       const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), exports_config));
-      const { homedir: homedir17 } = await import("os");
+      const { homedir: homedir18 } = await import("os");
       const { join: join49 } = await import("path");
       const configDir = ctx.configDir;
       const baseDir = ctx.baseDir;
@@ -33315,15 +33293,15 @@ init_config2();
 init_setup();
 init_i18n();
 init_colors();
-import { join as join47, dirname as dirname18 } from "path";
-import { homedir as homedir15 } from "os";
+import { join as join47, dirname as dirname19 } from "path";
+import { homedir as homedir16 } from "os";
 import { existsSync as existsSync53 } from "fs";
 
 // src/cli/security-commands.ts
 init_bootstrap();
 init_config2();
-import { join as join41, dirname as dirname15 } from "path";
-import { homedir as homedir14 } from "os";
+import { join as join42, dirname as dirname16 } from "path";
+import { homedir as homedir15 } from "os";
 
 // src/modules/security/security-policies.ts
 init_security();
@@ -33836,7 +33814,7 @@ function createSecurityCommand(program2) {
     }
   });
   securityCmd.command("set-policy").argument("<preset>", t("cli.security.preset")).description(t("cli.security.set_policy")).action(async (preset) => {
-    const configPath = join41(homedir14(), ".mma", "config.json");
+    const configPath = join42(homedir15(), ".mma", "config.json");
     const { config: appConfig } = await bootstrap();
     const validPresets = ["strict", "balanced", "permissive"];
     if (!validPresets.includes(preset)) {
@@ -33846,12 +33824,12 @@ function createSecurityCommand(program2) {
     const policy = getSecurityPolicy(preset);
     const newSecurityConfig = applySecurityPolicy(preset);
     appConfig.security = newSecurityConfig;
-    saveConfig(appConfig, configPath, dirname15(configPath));
+    saveConfig(appConfig, configPath, dirname16(configPath));
     console.log(t("cli.security.policy_applied", { name: policy.name }));
     console.log(t("cli.security.policy_description", { description: policy.description }));
   });
   securityCmd.command("enable-encryption").description(t("cli.security.enable_encryption")).action(async () => {
-    const configPath = join41(homedir14(), ".mma", "config.json");
+    const configPath = join42(homedir15(), ".mma", "config.json");
     const { config: appConfig } = await bootstrap();
     appConfig.security = appConfig.security || {};
     appConfig.security.sessionEncryption = {
@@ -33859,11 +33837,11 @@ function createSecurityCommand(program2) {
       encryptHistory: true,
       encryptSessionLog: true
     };
-    saveConfig(appConfig, configPath, dirname15(configPath));
+    saveConfig(appConfig, configPath, dirname16(configPath));
     console.log(t("cli.security.encryption_enabled"));
   });
   securityCmd.command("disable-encryption").description(t("cli.security.disable_encryption")).action(async () => {
-    const configPath = join41(homedir14(), ".mma", "config.json");
+    const configPath = join42(homedir15(), ".mma", "config.json");
     const { config: appConfig } = await bootstrap();
     appConfig.security = appConfig.security || {};
     appConfig.security.sessionEncryption = {
@@ -33871,11 +33849,11 @@ function createSecurityCommand(program2) {
       encryptHistory: false,
       encryptSessionLog: false
     };
-    saveConfig(appConfig, configPath, dirname15(configPath));
+    saveConfig(appConfig, configPath, dirname16(configPath));
     console.log(t("cli.security.encryption_disabled"));
   });
   securityCmd.command("enable-audit").description(t("cli.security.enable_audit")).action(async () => {
-    const configPath = join41(homedir14(), ".mma", "config.json");
+    const configPath = join42(homedir15(), ".mma", "config.json");
     const { config: appConfig } = await bootstrap();
     appConfig.security = appConfig.security || {};
     appConfig.security.auditNotifier = {
@@ -33885,11 +33863,11 @@ function createSecurityCommand(program2) {
       maxRetries: 3,
       webhookTimeout: 5000
     };
-    saveConfig(appConfig, configPath, dirname15(configPath));
+    saveConfig(appConfig, configPath, dirname16(configPath));
     console.log(t("cli.security.audit_enabled"));
   });
   securityCmd.command("disable-audit").description(t("cli.security.disable_audit")).action(async () => {
-    const configPath = join41(homedir14(), ".mma", "config.json");
+    const configPath = join42(homedir15(), ".mma", "config.json");
     const { config: appConfig } = await bootstrap();
     appConfig.security = appConfig.security || {};
     appConfig.security.auditNotifier = {
@@ -33897,7 +33875,7 @@ function createSecurityCommand(program2) {
       maxRetries: 3,
       webhookTimeout: 5000
     };
-    saveConfig(appConfig, configPath, dirname15(configPath));
+    saveConfig(appConfig, configPath, dirname16(configPath));
     console.log(t("cli.security.audit_disabled"));
   });
   securityCmd.command("audit-stats").description(t("cli.security.audit_stats")).action(async () => {
@@ -33959,7 +33937,7 @@ function createProgram() {
   const program2 = new Command().name("mma").description(t("cli.description")).version(version).option("--no-agents-md", t("cli.no_agents_md")).option("-d, --dir <path>", t("cli.dir")).option("-e, --exit-on-complete", t("cli.exit_on_complete")).option("-j, --json", t("cli.json"));
   program2.command("init").description(t("cli.init")).action(async () => {
     const answers = await runSetup();
-    const configPath = join47(homedir15(), ".mma", "config.json");
+    const configPath = join47(homedir16(), ".mma", "config.json");
     const { config } = await bootstrap();
     config.provider.type = answers.provider;
     config.provider.baseUrl = answers.apiBase;
@@ -33999,12 +33977,12 @@ function createProgram() {
         config.security.paths.denied = [];
       }
     }
-    saveConfig(config, configPath, dirname18(configPath));
+    saveConfig(config, configPath, dirname19(configPath));
     console.log(t("cli.config_saved"));
   });
   const configCmd = program2.command("config").description(t("cli.manage_config"));
   configCmd.command("set").argument("<key>", t("cli.config_key")).argument("<value>", "Config value").description(t("cli.set_value")).action(async (key, value) => {
-    const configPath = join47(homedir15(), ".mma", "config.json");
+    const configPath = join47(homedir16(), ".mma", "config.json");
     const { config } = await bootstrap();
     const keys = key.split(".");
     let obj = config;
@@ -34024,7 +34002,7 @@ function createProgram() {
       obj[lastKey] = parseFloat(value);
     else
       obj[lastKey] = value;
-    saveConfig(config, configPath, dirname18(configPath));
+    saveConfig(config, configPath, dirname19(configPath));
     console.log(t("cli.set_done", { key, value }));
   });
   configCmd.command("show").description(t("cli.show_config")).action(async () => {
@@ -34034,7 +34012,7 @@ function createProgram() {
   configCmd.command("migrate").description(t("cli.migrate_config")).action(async () => {
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), exports_config));
     const { hasDomainFiles: hasDomainFiles3 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
-    const configDir = join47(homedir15(), ".mma");
+    const configDir = join47(homedir16(), ".mma");
     const configPath = join47(configDir, "config.json");
     if (hasDomainFiles3(configDir)) {
       console.log(pc2.yellow(t("config.migrate_no_legacy")));
@@ -34091,10 +34069,10 @@ function createProgram() {
     console.log(t("cli.model_hint"));
   });
   model.command("use").argument("<name>", "Model name").description(t("cli.set_model")).action(async (name) => {
-    const configPath = join47(homedir15(), ".mma", "config.json");
+    const configPath = join47(homedir16(), ".mma", "config.json");
     const { config } = await bootstrap();
     config.model = name;
-    saveConfig(config, configPath, dirname18(configPath));
+    saveConfig(config, configPath, dirname19(configPath));
     console.log(t("cli.model_set", { name }));
   });
   model.command("certify").argument("<name>", "Model name").option("--provider-url <url>", t("cli.cert_provider_url")).option("--provider-key <key>", t("cli.cert_provider_key")).option("--context-window <n>", t("cli.cert_context_window")).option("--tags <tags>", t("cli.cert_tags"), "core").option("--reps <n>", t("cli.cert_reps")).option("--force", t("cli.cert_force")).option("--clean", t("cli.cert_clean")).description(t("cli.certify")).action(async (name, cmdOpts) => {
@@ -34128,7 +34106,7 @@ function createProgram() {
     await uncertify2(name, config, process.cwd());
   });
   program2.command("context").description(t("cli.manage_context")).argument("<size>", "Context window size in tokens").action(async (size) => {
-    const configPath = join47(homedir15(), ".mma", "config.json");
+    const configPath = join47(homedir16(), ".mma", "config.json");
     const { config } = await bootstrap();
     const contextWindow = parseInt(size, 10);
     if (isNaN(contextWindow) || contextWindow < 1024) {
@@ -34136,7 +34114,7 @@ function createProgram() {
       return;
     }
     config.contextWindow = contextWindow;
-    saveConfig(config, configPath, dirname18(configPath));
+    saveConfig(config, configPath, dirname19(configPath));
     console.log(t("cli.context_set", { size: contextWindow }));
   });
   const provider = program2.command("provider").description(t("cli.manage_providers"));
@@ -34174,7 +34152,7 @@ function createProgram() {
     console.log(t("cli.base_url"), config.provider.baseUrl);
   });
   provider.command("use").argument("<name>", "Provider name").description(t("cli.set_provider")).action(async (name) => {
-    const configPath = join47(homedir15(), ".mma", "config.json");
+    const configPath = join47(homedir16(), ".mma", "config.json");
     const { config, agent } = await bootstrap();
     if (config.provider.entries && config.provider.entries.length > 0) {
       try {
@@ -34190,14 +34168,14 @@ function createProgram() {
     if (baseUrl) {
       config.provider.baseUrl = baseUrl;
     }
-    saveConfig(config, configPath, dirname18(configPath));
+    saveConfig(config, configPath, dirname19(configPath));
     console.log(t("cli.provider_set", { name }));
     if (baseUrl) {
       console.log(t("cli.provider_base_hint", { baseUrl }));
     }
   });
   provider.command("add").argument("<name>", "Provider type or label").option("--url <url>", "Base URL").option("--key <key>", "API key").option("--priority <n>", "Fallback priority (lower = tried first)").option("--context-window <n>", "Context window override for this entry").option("--rpm <n>", "Max requests per minute for this entry").option("--parallel <n>", "Max parallel tasks for this entry").description(t("cli.add_provider")).action(async (name, opts) => {
-    const configPath = join47(homedir15(), ".mma", "config.json");
+    const configPath = join47(homedir16(), ".mma", "config.json");
     const { config } = await bootstrap();
     const entries = Array.isArray(config.provider.entries) ? config.provider.entries : [];
     if (entries.length === 0) {
@@ -34229,7 +34207,7 @@ function createProgram() {
     });
     config.provider.entries = entries;
     config.provider.active = config.provider.active || config.provider.type;
-    saveConfig(config, configPath, dirname18(configPath));
+    saveConfig(config, configPath, dirname19(configPath));
     console.log(pc2.green(t("cli.provider_added", { name })));
     console.log(t("cli.provider_switch_hint"));
   });
@@ -35108,7 +35086,7 @@ class LineEditor {
 // src/cli/repl.ts
 import { existsSync as existsSync55, readFileSync as readFileSync38, writeFileSync as writeFileSync20 } from "fs";
 import { join as join49 } from "path";
-import { homedir as homedir17 } from "os";
+import { homedir as homedir18 } from "os";
 
 // src/cli/completer.ts
 class SlashCommandProvider {
@@ -35931,10 +35909,10 @@ class Repl {
     this.envReport = envReport;
     this.execModule = execModule;
     this.slog = new SessionLogger(sessionManager, logger);
-    this.configDir = configDir || join49(homedir17(), ".mma");
+    this.configDir = configDir || join49(homedir18(), ".mma");
     this.baseDir = baseDir || process.cwd();
     this.noAgentsMd = noAgentsMd === true;
-    this.historyPath = historyPath ?? join49(homedir17(), ".mma", "repl-history");
+    this.historyPath = historyPath ?? join49(homedir18(), ".mma", "repl-history");
     this.loadHistory();
     this.rl = process.stdin.isTTY ? new LineEditor({
       input: process.stdin,
@@ -36510,8 +36488,8 @@ init_config2();
 init_i18n();
 init_colors();
 import { existsSync as existsSync56 } from "fs";
-import { join as join51, dirname as dirname20 } from "path";
-import { homedir as homedir19 } from "os";
+import { join as join51, dirname as dirname21 } from "path";
+import { homedir as homedir20 } from "os";
 
 // src/modules/updater/index.ts
 init_checker();
@@ -36616,8 +36594,8 @@ init_data_sanitizer();
 init_i18n();
 import { appendFileSync as appendFileSync7, mkdirSync as mkdirSync21 } from "fs";
 import { join as join50 } from "path";
-import { homedir as homedir18 } from "os";
-var CRASH_LOG_DIR = join50(homedir18(), ".mma", "logs");
+import { homedir as homedir19 } from "os";
+var CRASH_LOG_DIR = join50(homedir19(), ".mma", "logs");
 var CRASH_LOG_FILE = "crash.jsonl";
 function formatCrashEntry(type2, err) {
   const message = err instanceof Error ? err.message : String(err);
@@ -36627,7 +36605,7 @@ function formatCrashEntry(type2, err) {
     type: type2,
     message: sanitizeLogMessage(message),
     stack: sanitizeLogMessage(stack),
-    environment: collectEnvironment({ configDir: homedir18(), scanTools: false })
+    environment: collectEnvironment({ configDir: homedir19(), scanTools: false })
   };
 }
 function writeCrashEntry(dir, entry) {
@@ -36741,7 +36719,7 @@ async function main() {
     await updater?.waitForIdle();
     process.exit(exitCode);
   } else {
-    const mmaDir = join51(homedir19(), ".mma");
+    const mmaDir = join51(homedir20(), ".mma");
     const legacyConfigPath = join51(mmaDir, "config.json");
     let hasAnyConfig = existsSync56(legacyConfigPath);
     if (!hasAnyConfig) {
@@ -36806,7 +36784,7 @@ async function main() {
           config.security.paths.denied = [];
         }
       }
-      saveConfig(config, legacyConfigPath, dirname20(legacyConfigPath));
+      saveConfig(config, legacyConfigPath, dirname21(legacyConfigPath));
       await agent.reconfigure(config);
     }
     startAutoUpdate(config);