openkitt 0.2.5 → 0.2.7

package/dist/cli.js

@@ -2192,8 +2192,66 @@ var require_picocolors = __commonJS((exports, module) => {
   module.exports.createColors = createColors;
 });
 
+// node_modules/sisteransi/src/index.js
+var require_src = __commonJS((exports, module) => {
+  var ESC = "\x1B";
+  var CSI = `${ESC}[`;
+  var beep = "\x07";
+  var cursor = {
+    to(x, y) {
+      if (!y)
+        return `${CSI}${x + 1}G`;
+      return `${CSI}${y + 1};${x + 1}H`;
+    },
+    move(x, y) {
+      let ret = "";
+      if (x < 0)
+        ret += `${CSI}${-x}D`;
+      else if (x > 0)
+        ret += `${CSI}${x}C`;
+      if (y < 0)
+        ret += `${CSI}${-y}A`;
+      else if (y > 0)
+        ret += `${CSI}${y}B`;
+      return ret;
+    },
+    up: (count = 1) => `${CSI}${count}A`,
+    down: (count = 1) => `${CSI}${count}B`,
+    forward: (count = 1) => `${CSI}${count}C`,
+    backward: (count = 1) => `${CSI}${count}D`,
+    nextLine: (count = 1) => `${CSI}E`.repeat(count),
+    prevLine: (count = 1) => `${CSI}F`.repeat(count),
+    left: `${CSI}G`,
+    hide: `${CSI}?25l`,
+    show: `${CSI}?25h`,
+    save: `${ESC}7`,
+    restore: `${ESC}8`
+  };
+  var scroll = {
+    up: (count = 1) => `${CSI}S`.repeat(count),
+    down: (count = 1) => `${CSI}T`.repeat(count)
+  };
+  var erase = {
+    screen: `${CSI}2J`,
+    up: (count = 1) => `${CSI}1J`.repeat(count),
+    down: (count = 1) => `${CSI}J`.repeat(count),
+    line: `${CSI}2K`,
+    lineEnd: `${CSI}K`,
+    lineStart: `${CSI}1K`,
+    lines(count) {
+      let clear = "";
+      for (let i = 0;i < count; i++)
+        clear += this.line + (i < count - 1 ? cursor.up() : "");
+      if (count)
+        clear += cursor.left;
+      return clear;
+    }
+  };
+  module.exports = { cursor, scroll, erase, beep };
+});
+
 // src/credentials/encryption.ts
-import { execSync } from "node:child_process";
+import { execSync as execSync2 } from "node:child_process";
 import {
   createCipheriv,
   createDecipheriv,
@@ -2209,7 +2267,7 @@ function getMachineId() {
   const currentPlatform = platform();
   if (currentPlatform === "darwin") {
     try {
-      const output = execSync("ioreg -rd1 -c IOPlatformExpertDevice", {
+      const output = execSync2("ioreg -rd1 -c IOPlatformExpertDevice", {
         encoding: "utf-8",
         stdio: "pipe"
       });
@@ -2231,7 +2289,7 @@ function getMachineId() {
   }
   if (currentPlatform === "win32") {
     try {
-      const output = execSync('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid', {
+      const output = execSync2('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid', {
         encoding: "utf-8",
         stdio: "pipe"
       });
@@ -2298,17 +2356,17 @@ function isNotFoundError(errorMessage) {
   const normalized = errorMessage.toLowerCase();
   return normalized.includes("could not be found") || normalized.includes("item not found") || normalized.includes("not found") || normalized.includes("element not found");
 }
-function getErrorMessage(error) {
-  if (error instanceof Error) {
-    const maybeStderr = error.stderr;
+function getErrorMessage(error2) {
+  if (error2 instanceof Error) {
+    const maybeStderr = error2.stderr;
     if (typeof maybeStderr === "string" && maybeStderr.trim().length > 0) {
       return maybeStderr.trim();
     }
     if (Buffer.isBuffer(maybeStderr) && maybeStderr.length > 0) {
       return maybeStderr.toString("utf-8").trim();
     }
-    if (error.message.trim().length > 0) {
-      return error.message.trim();
+    if (error2.message.trim().length > 0) {
+      return error2.message.trim();
     }
   }
   return "Unknown keychain error";
@@ -2450,8 +2508,8 @@ async function setKeychainValue(key, value) {
       default:
         return { success: false, error: "Unsupported platform" };
     }
-  } catch (error) {
-    return { success: false, error: getErrorMessage(error) };
+  } catch (error2) {
+    return { success: false, error: getErrorMessage(error2) };
   }
 }
 async function getKeychainValue(key) {
@@ -2476,8 +2534,8 @@ async function getKeychainValue(key) {
       default:
         return null;
     }
-  } catch (error) {
-    const errorMessage = getErrorMessage(error);
+  } catch (error2) {
+    const errorMessage = getErrorMessage(error2);
     if (isNotFoundError(errorMessage)) {
       return null;
     }
@@ -2509,8 +2567,8 @@ async function deleteKeychainValue(key) {
       default:
         return { success: false, error: "Unsupported platform" };
     }
-  } catch (error) {
-    const errorMessage = getErrorMessage(error);
+  } catch (error2) {
+    const errorMessage = getErrorMessage(error2);
     if (isNotFoundError(errorMessage)) {
       return { success: true };
     }
@@ -2530,9 +2588,9 @@ __export(exports_config, {
   getLlmApiKey: () => getLlmApiKey,
   clearLlmCredentials: () => clearLlmCredentials
 });
-import { chmodSync, existsSync, mkdirSync, readFileSync as readFileSync2, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir, platform as platform2 } from "node:os";
-import { join } from "node:path";
+import { join as join3 } from "node:path";
 function isWindows() {
   return platform2() === "win32";
 }
@@ -2541,18 +2599,18 @@ function hasExtraPermissionBits(actualMode, allowedMode) {
   return (activeBits & ~allowedMode) !== 0;
 }
 function ensurePermissions(path, mode) {
-  if (isWindows() || !existsSync(path)) {
+  if (isWindows() || !existsSync3(path)) {
     return;
   }
-  const currentMode = statSync(path).mode;
+  const currentMode = statSync2(path).mode;
   if (hasExtraPermissionBits(currentMode, mode)) {
     console.warn(`[kitt] Detected permissive config permissions for ${path}. Auto-fixing.`);
     chmodSync(path, mode);
   }
 }
 function ensureConfigDir() {
-  if (!existsSync(CONFIG_DIR)) {
-    mkdirSync(CONFIG_DIR, { recursive: true, mode: DIR_MODE });
+  if (!existsSync3(CONFIG_DIR)) {
+    mkdirSync2(CONFIG_DIR, { recursive: true, mode: DIR_MODE });
   }
   if (!isWindows()) {
     ensurePermissions(CONFIG_DIR, DIR_MODE);
@@ -2560,7 +2618,7 @@ function ensureConfigDir() {
 }
 function readConfig() {
   ensureConfigDir();
-  if (!existsSync(CONFIG_FILE)) {
+  if (!existsSync3(CONFIG_FILE)) {
     return {};
   }
   if (!isWindows()) {
@@ -2582,19 +2640,19 @@ function writeConfig(config) {
   const payload = `${JSON.stringify(config, null, 2)}
 `;
   try {
-    writeFileSync(tempFile, payload, { encoding: "utf-8", mode: FILE_MODE });
+    writeFileSync2(tempFile, payload, { encoding: "utf-8", mode: FILE_MODE });
     if (!isWindows()) {
       chmodSync(tempFile, FILE_MODE);
     }
-    renameSync(tempFile, CONFIG_FILE);
+    renameSync2(tempFile, CONFIG_FILE);
     if (!isWindows()) {
       chmodSync(CONFIG_FILE, FILE_MODE);
     }
-  } catch (error) {
-    if (existsSync(tempFile)) {
+  } catch (error2) {
+    if (existsSync3(tempFile)) {
       unlinkSync(tempFile);
     }
-    throw error;
+    throw error2;
   }
 }
 function isStoredProvider(value) {
@@ -2718,66 +2776,8 @@ var CONFIG_DIR, CONFIG_FILE, KEYCHAIN_API_KEY = "llm-api-key", DIR_MODE = 448, F
 var init_config = __esm(() => {
   init_encryption();
   init_keychain();
-  CONFIG_DIR = join(homedir(), ".kitt");
-  CONFIG_FILE = join(CONFIG_DIR, "config.json");
-});
-
-// node_modules/sisteransi/src/index.js
-var require_src = __commonJS((exports, module) => {
-  var ESC = "\x1B";
-  var CSI = `${ESC}[`;
-  var beep = "\x07";
-  var cursor = {
-    to(x, y) {
-      if (!y)
-        return `${CSI}${x + 1}G`;
-      return `${CSI}${y + 1};${x + 1}H`;
-    },
-    move(x, y) {
-      let ret = "";
-      if (x < 0)
-        ret += `${CSI}${-x}D`;
-      else if (x > 0)
-        ret += `${CSI}${x}C`;
-      if (y < 0)
-        ret += `${CSI}${-y}A`;
-      else if (y > 0)
-        ret += `${CSI}${y}B`;
-      return ret;
-    },
-    up: (count = 1) => `${CSI}${count}A`,
-    down: (count = 1) => `${CSI}${count}B`,
-    forward: (count = 1) => `${CSI}${count}C`,
-    backward: (count = 1) => `${CSI}${count}D`,
-    nextLine: (count = 1) => `${CSI}E`.repeat(count),
-    prevLine: (count = 1) => `${CSI}F`.repeat(count),
-    left: `${CSI}G`,
-    hide: `${CSI}?25l`,
-    show: `${CSI}?25h`,
-    save: `${ESC}7`,
-    restore: `${ESC}8`
-  };
-  var scroll = {
-    up: (count = 1) => `${CSI}S`.repeat(count),
-    down: (count = 1) => `${CSI}T`.repeat(count)
-  };
-  var erase = {
-    screen: `${CSI}2J`,
-    up: (count = 1) => `${CSI}1J`.repeat(count),
-    down: (count = 1) => `${CSI}J`.repeat(count),
-    line: `${CSI}2K`,
-    lineEnd: `${CSI}K`,
-    lineStart: `${CSI}1K`,
-    lines(count) {
-      let clear = "";
-      for (let i = 0;i < count; i++)
-        clear += this.line + (i < count - 1 ? cursor.up() : "");
-      if (count)
-        clear += cursor.left;
-      return clear;
-    }
-  };
-  module.exports = { cursor, scroll, erase, beep };
+  CONFIG_DIR = join3(homedir(), ".kitt");
+  CONFIG_FILE = join3(CONFIG_DIR, "config.json");
 });
 
 // node_modules/@anthropic-ai/sdk/internal/tslib.mjs
@@ -185957,7 +185957,7 @@ var require_path_browserify = __commonJS((exports, module) => {
     _makeLong: function _makeLong(path3) {
       return path3;
     },
-    dirname: function dirname5(path3) {
+    dirname: function dirname4(path3) {
       assertPath(path3);
       if (path3.length === 0)
         return ".";
@@ -255595,497 +255595,118 @@ var {
 var import_picocolors12 = __toESM(require_picocolors(), 1);
 import { createInterface, emitKeypressEvents } from "node:readline";
 import { stdin as input, stdout as output } from "node:process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync15, realpathSync } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync15, realpathSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join23, resolve as resolve6, dirname as dirname6 } from "node:path";
+import { join as join23, resolve as resolve6, dirname as dirname5 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/utils/prerequisites.ts
-var import_picocolors = __toESM(require_picocolors(), 1);
-import { execSync as execSync2 } from "node:child_process";
-function getNodeVersion() {
-  try {
-    const output = execSync2("node --version", {
-      encoding: "utf-8",
-      stdio: "pipe"
-    }).trim();
-    return output.replace(/^v/, "");
-  } catch {
-    return "";
-  }
-}
-function getBunVersion() {
-  try {
-    const output = execSync2("bun --version", {
-      encoding: "utf-8",
-      stdio: "pipe"
-    }).trim();
-    return output;
-  } catch {
-    return null;
-  }
-}
-function getRailwayVersion() {
-  try {
-    const output = execSync2("railway --version", {
-      encoding: "utf-8",
-      stdio: "pipe"
-    }).trim();
-    return output || null;
-  } catch {
-    return null;
-  }
-}
-async function checkPrerequisites() {
-  const nodeVersion = getNodeVersion();
-  const bunVersion = getBunVersion();
-  const railwayVersion = getRailwayVersion();
-  return [
-    {
-      name: "Node.js",
-      found: !!nodeVersion,
-      version: nodeVersion || undefined
-    },
-    {
-      name: "Bun",
-      found: !!bunVersion,
-      version: bunVersion || undefined,
-      installUrl: bunVersion ? undefined : "https://bun.sh"
-    },
-    {
-      name: "Railway CLI",
-      found: !!railwayVersion,
-      version: railwayVersion || undefined,
-      installUrl: railwayVersion ? undefined : "https://docs.railway.com/cli"
-    }
-  ];
-}
-function displayPrerequisites(statuses) {
-  for (const status of statuses) {
-    if (status.found) {
-      const version = status.version ? `v${status.version}` : "";
-      const paddedName = status.name.padEnd(12);
-      console.log(`  ${import_picocolors.default.green("✓")} ${paddedName} ${version}`);
-    } else {
-      const paddedName = status.name.padEnd(12);
-      const installMsg = status.installUrl ? `not found. Install: ${status.installUrl}` : "not found";
-      console.log(`  ${import_picocolors.default.red("✗")} ${paddedName} ${installMsg}`);
-    }
-  }
-}
-async function displayLlmStatus() {
-  const paddedName = "LLM".padEnd(12);
-  try {
-    const { isLlmConfigured: isLlmConfigured2, getLlmConfig: getLlmConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
-    const [configured, config] = await Promise.all([isLlmConfigured2(), getLlmConfig2()]);
-    if (configured && config) {
-      const label = `${config.provider[0].toUpperCase()}${config.provider.slice(1)} (${config.model})`;
-      console.log(`  ${import_picocolors.default.green("✓")} ${paddedName} ${label}`);
-    } else {
-      console.log(`  ${import_picocolors.default.yellow("!")} ${paddedName} not configured`);
-    }
-  } catch {
-    console.log(`  ${import_picocolors.default.yellow("!")} ${paddedName} not configured`);
-  }
-}
-
-// src/manifest/reader.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import { join as join4, dirname as dirname2, resolve } from "node:path";
+import { execSync as execSync3 } from "node:child_process";
 
-// src/utils/global-config.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+// src/mcp/lifecycle.ts
+import { spawn, execSync } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
 import { join as join2 } from "node:path";
-function getGlobalConfigPath() {
-  return join2(homedir2(), ".kitt", "workspace.json");
-}
-function readGlobalConfig() {
-  const configPath = getGlobalConfigPath();
-  if (!existsSync2(configPath)) {
-    return {};
-  }
-  try {
-    const raw = readFileSync3(configPath, "utf-8").trim();
-    if (!raw)
-      return {};
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) {
-      return parsed;
-    }
-    return {};
-  } catch {
-    return {};
-  }
-}
-function writeGlobalConfig(config) {
-  const configPath = getGlobalConfigPath();
-  const configDir = join2(homedir2(), ".kitt");
-  mkdirSync2(configDir, { recursive: true });
-  writeFileSync2(configPath, JSON.stringify(config, null, 2) + `
-`, "utf-8");
-}
-function setGlobalWorkspacePath(workspacePath) {
-  const existing = readGlobalConfig();
-  writeGlobalConfig({ ...existing, workspacePath });
-}
-function getGlobalWorkspacePath() {
-  return readGlobalConfig().workspacePath ?? null;
-}
 
-// src/manifest/writer.ts
-import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { platform as platform3 } from "node:os";
-import { dirname, join as join3 } from "node:path";
-var DIR_MODE2 = 448;
-var FILE_MODE2 = 384;
-var MANIFEST_VERSION = "0.1.0";
-function isWindows2() {
-  return platform3() === "win32";
-}
-function ensureKittDir(manifestPath) {
-  const kittDir = dirname(manifestPath);
-  if (!existsSync3(kittDir)) {
-    mkdirSync3(kittDir, { recursive: true, mode: DIR_MODE2 });
-  }
-  if (!isWindows2()) {
-    chmodSync2(kittDir, DIR_MODE2);
-  }
-}
-function writeManifest(workspaceDir, manifest) {
-  const manifestPath = getManifestPath(workspaceDir);
-  const manifestDir = dirname(manifestPath);
-  const tempFile = join3(manifestDir, `manifest.json.tmp-${process.pid}-${Date.now()}`);
-  const payload = `${JSON.stringify(manifest, null, 2)}
+// src/audit/logger.ts
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { join } from "node:path";
+var AUDIT_DIR_NAME = ".kitt";
+var AUDIT_FILE_NAME = "audit.log";
+var ROTATED_LOG_1 = "audit.log.1";
+var ROTATED_LOG_2 = "audit.log.2";
+var MAX_LOG_SIZE_BYTES = 10 * 1024 * 1024;
+function formatLine(type, message) {
+  return `[${new Date().toISOString()}] ${type} ${message}
 `;
-  ensureKittDir(manifestPath);
-  try {
-    writeFileSync3(tempFile, payload, { encoding: "utf-8", mode: FILE_MODE2 });
-    if (!isWindows2()) {
-      chmodSync2(tempFile, FILE_MODE2);
-    }
-    renameSync2(tempFile, manifestPath);
-    if (!isWindows2()) {
-      chmodSync2(manifestPath, FILE_MODE2);
-    }
-  } catch (error) {
-    if (existsSync3(tempFile)) {
-      unlinkSync2(tempFile);
-    }
-    throw error;
-  }
-}
-function createInitialManifest(workspaceName, packageManager, railway) {
-  return {
-    version: MANIFEST_VERSION,
-    workspace: {
-      name: workspaceName,
-      packageManager,
-      ...railway ? { railway } : {}
-    },
-    settings: {},
-    apps: {},
-    packages: {}
-  };
 }
-function addApp(manifest, name, app) {
-  return {
-    ...manifest,
-    apps: {
-      ...manifest.apps,
-      [name]: app
-    }
-  };
-}
-function removeApp(manifest, name) {
-  const nextApps = { ...manifest.apps };
-  delete nextApps[name];
-  const nextPackages = {};
-  for (const [packageName, pkg] of Object.entries(manifest.packages)) {
-    nextPackages[packageName] = {
-      ...pkg,
-      consumers: pkg.consumers.filter((consumer) => consumer !== name)
-    };
-  }
-  return {
-    ...manifest,
-    apps: nextApps,
-    packages: nextPackages
-  };
-}
-function addPackage(manifest, name, pkg) {
-  return {
-    ...manifest,
-    packages: {
-      ...manifest.packages,
-      [name]: pkg
-    }
-  };
-}
-function addConsumer(manifest, packageName, appName) {
-  const pkg = manifest.packages[packageName];
-  if (!pkg) {
-    return {
-      ...manifest,
-      packages: {
-        ...manifest.packages
-      }
-    };
-  }
-  const consumers = pkg.consumers.includes(appName) ? [...pkg.consumers] : [...pkg.consumers, appName];
-  return {
-    ...manifest,
-    packages: {
-      ...manifest.packages,
-      [packageName]: {
-        ...pkg,
-        consumers
-      }
-    }
-  };
-}
-
-// src/manifest/reader.ts
-function isObjectRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function isValidWorkspaceManifest(value) {
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (typeof value.version !== "string") {
-    return false;
-  }
-  if (!isObjectRecord(value.workspace)) {
-    return false;
-  }
-  if (typeof value.workspace.name !== "string") {
-    return false;
-  }
-  const packageManager = value.workspace.packageManager;
-  if (packageManager !== "bun" && packageManager !== "npm" && packageManager !== "pnpm" && packageManager !== "yarn") {
-    return false;
-  }
-  if (!isObjectRecord(value.apps)) {
-    return false;
-  }
-  if (!isObjectRecord(value.packages)) {
-    return false;
-  }
-  if (!isObjectRecord(value.settings)) {
-    return false;
-  }
-  return true;
-}
-function getManifestPath(workspaceDir) {
-  return join4(workspaceDir, ".kitt", "manifest.json");
-}
-function isKittWorkspace(dir) {
-  return existsSync4(getManifestPath(dir));
-}
-function findWorkspaceRoot(startDir) {
-  let current = resolve(startDir);
-  while (true) {
-    if (isKittWorkspace(current))
-      return current;
-    const parent = dirname2(current);
-    if (parent === current)
-      break;
-    current = parent;
-  }
-  const globalPath = getGlobalWorkspacePath();
-  if (globalPath && isKittWorkspace(globalPath))
-    return globalPath;
-  return null;
-}
-function findWorkspaceRootStrict(startDir) {
-  let current = resolve(startDir);
-  while (true) {
-    if (isKittWorkspace(current))
-      return current;
-    const parent = dirname2(current);
-    if (parent === current)
-      break;
-    current = parent;
-  }
-  return null;
-}
-function readManifest(workspaceDir) {
-  const manifestPath = getManifestPath(workspaceDir);
-  if (!existsSync4(manifestPath)) {
-    return null;
-  }
-  try {
-    const raw = readFileSync4(manifestPath, "utf-8").trim();
-    if (raw.length === 0) {
-      return null;
-    }
-    const parsed = JSON.parse(raw);
-    if (!isValidWorkspaceManifest(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function reconcileManifest(workspaceDir) {
-  const manifest = readManifest(workspaceDir);
-  if (!manifest)
-    return null;
-  const staleApps = Object.keys(manifest.apps).filter((name) => !existsSync4(join4(workspaceDir, "apps", name)));
-  if (staleApps.length === 0)
-    return manifest;
-  let cleaned = manifest;
-  for (const name of staleApps) {
-    cleaned = removeApp(cleaned, name);
+function ensureAuditDir(auditDir) {
+  if (existsSync(auditDir)) {
+    return;
   }
-  writeManifest(workspaceDir, cleaned);
-  return cleaned;
+  mkdirSync(auditDir, { recursive: true, mode: 448 });
 }
-
-// src/utils/auth-guard.ts
-init_config();
-
-// src/credentials/railway.ts
-import { execSync as execSync3 } from "node:child_process";
-async function isRailwayInstalled() {
-  try {
-    execSync3("railway --version", {
-      encoding: "utf-8",
-      stdio: "pipe"
-    });
-    return true;
-  } catch {
-    return false;
+function rotateLogIfNeeded(logPath, log1Path, log2Path) {
+  if (!existsSync(logPath)) {
+    return;
   }
-}
-async function checkRailwayAuth() {
-  const installed = await isRailwayInstalled();
-  if (!installed) {
-    return {
-      authenticated: false,
-      error: "Railway CLI not installed"
-    };
+  const stats = statSync(logPath);
+  if (stats.size < MAX_LOG_SIZE_BYTES) {
+    return;
   }
-  try {
-    const output = execSync3("railway whoami", {
-      encoding: "utf-8",
-      stdio: "pipe"
-    }).trim();
-    if (output && output.length > 0) {
-      return {
-        authenticated: true,
-        username: output
-      };
-    }
-    return {
-      authenticated: false
-    };
-  } catch {
-    return {
-      authenticated: false
-    };
+  if (existsSync(log2Path)) {
+    rmSync(log2Path, { force: true });
   }
-}
-async function railwayLogin() {
-  try {
-    execSync3("railway login", {
-      stdio: "inherit"
-    });
-    return await checkRailwayAuth();
-  } catch {
-    return {
-      authenticated: false,
-      error: "Failed to complete Railway login"
-    };
+  if (existsSync(log1Path)) {
+    renameSync(log1Path, log2Path);
   }
+  renameSync(logPath, log1Path);
+  writeFileSync(logPath, "", { encoding: "utf8", mode: 384 });
 }
-async function railwayLogout() {
+function writeAuditLine(logPath, log1Path, log2Path, type, message) {
   try {
-    execSync3("railway logout", {
-      encoding: "utf-8",
-      stdio: "pipe"
-    });
-    return true;
+    rotateLogIfNeeded(logPath, log1Path, log2Path);
+    appendFileSync(logPath, formatLine(type, message), { encoding: "utf8", mode: 384 });
   } catch {
-    return false;
+    return;
   }
 }
-
-// src/utils/auth-guard.ts
-var WORKSPACE_REQUIRED = new Set([
-  "create",
-  "delete",
-  "list",
-  "run",
-  "deploy",
-  "deploy:template",
-  "env:create",
-  "env:vars",
-  "domain",
-  "logs",
-  "status",
-  "versions"
-]);
-var COMMAND_AUTH = {
-  login: "none",
-  logout: "none",
-  help: "none",
-  settings: "none",
-  list: "none",
-  versions: "none",
-  exit: "none",
-  init: "both",
-  create: "both",
-  delete: "both",
-  deploy: "both",
-  "deploy:template": "both",
-  "env:create": "both",
-  "env:vars": "both",
-  domain: "both",
-  logs: "both",
-  status: "both"
-};
-async function checkAuthGuard(commandKey) {
-  if (WORKSPACE_REQUIRED.has(commandKey)) {
-    const workspaceRoot = findWorkspaceRootStrict(process.cwd());
-    if (!workspaceRoot) {
-      return {
-        allowed: false,
-        message: "No KITT workspace found. Run /init to initialize one."
-      };
-    }
-  }
-  const requirement = COMMAND_AUTH[commandKey];
-  if (!requirement || requirement === "none") {
-    return { allowed: true };
-  }
-  if (requirement === "llm" || requirement === "both") {
-    const llmConfigured = await isLlmConfigured();
-    if (!llmConfigured) {
-      return {
-        allowed: false,
-        message: "LLM API key required. Run /login llm to configure."
-      };
-    }
-  }
-  if (requirement === "railway" || requirement === "both") {
-    const railwayStatus = await checkRailwayAuth();
-    if (!railwayStatus.authenticated) {
-      return {
-        allowed: false,
-        message: "Railway authentication required. Run /login railway to authenticate."
-      };
+function createAuditLogger(workspaceDir) {
+  const auditDir = join(workspaceDir, AUDIT_DIR_NAME);
+  const logPath = join(auditDir, AUDIT_FILE_NAME);
+  const log1Path = join(auditDir, ROTATED_LOG_1);
+  const log2Path = join(auditDir, ROTATED_LOG_2);
+  return {
+    log(type, message) {
+      try {
+        ensureAuditDir(auditDir);
+      } catch {
+        return;
+      }
+      writeAuditLine(logPath, log1Path, log2Path, type, message);
+    },
+    cmd(command, status, detail) {
+      const suffix = detail ? ` (${detail})` : "";
+      this.log("CMD", `${command} → ${status}${suffix}`);
+    },
+    cmdExec(command, status) {
+      this.log("CMD_EXEC", `${command} → ${status}`);
+    },
+    mcp(tool, params, status, detail) {
+      const suffix = detail ? ` (${detail})` : "";
+      this.log("MCP", `${tool} (${params}) → ${status}${suffix}`);
+    },
+    llmCall(provider, model, promptVersion, estimatedTokens, status) {
+      this.log("LLM_CALL", `${provider}/${model} (prompt: ${promptVersion}, est. ${estimatedTokens} tokens) → ${status}`);
+    },
+    fileWrite(path, hash) {
+      const suffix = hash ? ` (SHA-256: ${hash})` : "";
+      this.log("FILE_WRITE", `${path}${suffix}`);
+    },
+    staged(path, detail) {
+      this.log("STAGED", `${path} (${detail})`);
+    },
+    userConfirmed() {
+      this.log("USER_CONFIRMED", "staged changes");
+    },
+    security(action, message) {
+      this.log("SECURITY", `${action} ${message}`);
     }
-  }
-  return { allowed: true };
+  };
 }
 
 // node_modules/@clack/core/dist/index.mjs
 var import_sisteransi = __toESM(require_src(), 1);
 import { stdin as j, stdout as M } from "node:process";
-var import_picocolors2 = __toESM(require_picocolors(), 1);
+var import_picocolors = __toESM(require_picocolors(), 1);
 import O from "node:readline";
 import { Writable as X } from "node:stream";
 function DD({ onlyFirst: e = false } = {}) {
@@ -256481,10 +256102,10 @@ class MD extends x {
       this.valueWithCursor = this.masked;
     }), this.on("value", () => {
       if (this.cursor >= this.value.length)
-        this.valueWithCursor = `${this.masked}${import_picocolors2.default.inverse(import_picocolors2.default.hidden("_"))}`;
+        this.valueWithCursor = `${this.masked}${import_picocolors.default.inverse(import_picocolors.default.hidden("_"))}`;
       else {
         const F = this.masked.slice(0, this.cursor), s = this.masked.slice(this.cursor);
-        this.valueWithCursor = `${F}${import_picocolors2.default.inverse(s[0])}${s.slice(1)}`;
+        this.valueWithCursor = `${F}${import_picocolors.default.inverse(s[0])}${s.slice(1)}`;
       }
     });
   }
@@ -256529,7 +256150,7 @@ class RD extends x {
     if (this.cursor >= this.value.length)
       return `${this.value}█`;
     const u = this.value.slice(0, this.cursor), [t, ...F] = this.value.slice(this.cursor);
-    return `${u}${import_picocolors2.default.inverse(t)}${F.join("")}`;
+    return `${u}${import_picocolors.default.inverse(t)}${F.join("")}`;
   }
   get cursor() {
     return this._cursor;
@@ -256542,7 +256163,7 @@ class RD extends x {
 }
 
 // node_modules/@clack/prompts/dist/index.mjs
-var import_picocolors3 = __toESM(require_picocolors(), 1);
+var import_picocolors2 = __toESM(require_picocolors(), 1);
 var import_sisteransi2 = __toESM(require_src(), 1);
 import y2 from "node:process";
 function ce() {
@@ -256575,13 +256196,13 @@ var b2 = (t) => {
   switch (t) {
     case "initial":
     case "active":
-      return import_picocolors3.default.cyan(le);
+      return import_picocolors2.default.cyan(le);
     case "cancel":
-      return import_picocolors3.default.red(L2);
+      return import_picocolors2.default.red(L2);
     case "error":
-      return import_picocolors3.default.yellow(W2);
+      return import_picocolors2.default.yellow(W2);
     case "submit":
-      return import_picocolors3.default.green(C);
+      return import_picocolors2.default.green(C);
   }
 };
 var G2 = (t) => {
@@ -256591,66 +256212,66 @@ var G2 = (t) => {
   const $2 = a < r2.length && l2 > 0, g = a < r2.length && l2 + a < r2.length;
   return r2.slice(l2, l2 + a).map((p2, v2, f) => {
     const j2 = v2 === 0 && $2, E = v2 === f.length - 1 && g;
-    return j2 || E ? import_picocolors3.default.dim("...") : i(p2, v2 + l2 === n);
+    return j2 || E ? import_picocolors2.default.dim("...") : i(p2, v2 + l2 === n);
   });
 };
 var he = (t) => new RD({ validate: t.validate, placeholder: t.placeholder, defaultValue: t.defaultValue, initialValue: t.initialValue, render() {
-  const n = `${import_picocolors3.default.gray(o)}
+  const n = `${import_picocolors2.default.gray(o)}
 ${b2(this.state)}  ${t.message}
-`, r2 = t.placeholder ? import_picocolors3.default.inverse(t.placeholder[0]) + import_picocolors3.default.dim(t.placeholder.slice(1)) : import_picocolors3.default.inverse(import_picocolors3.default.hidden("_")), i = this.value ? this.valueWithCursor : r2;
+`, r2 = t.placeholder ? import_picocolors2.default.inverse(t.placeholder[0]) + import_picocolors2.default.dim(t.placeholder.slice(1)) : import_picocolors2.default.inverse(import_picocolors2.default.hidden("_")), i = this.value ? this.valueWithCursor : r2;
   switch (this.state) {
     case "error":
       return `${n.trim()}
-${import_picocolors3.default.yellow(o)}  ${i}
-${import_picocolors3.default.yellow(d2)}  ${import_picocolors3.default.yellow(this.error)}
+${import_picocolors2.default.yellow(o)}  ${i}
+${import_picocolors2.default.yellow(d2)}  ${import_picocolors2.default.yellow(this.error)}
 `;
     case "submit":
-      return `${n}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.dim(this.value || t.placeholder)}`;
+      return `${n}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.dim(this.value || t.placeholder)}`;
     case "cancel":
-      return `${n}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(this.value ?? ""))}${this.value?.trim() ? `
-${import_picocolors3.default.gray(o)}` : ""}`;
+      return `${n}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(this.value ?? ""))}${this.value?.trim() ? `
+${import_picocolors2.default.gray(o)}` : ""}`;
     default:
-      return `${n}${import_picocolors3.default.cyan(o)}  ${i}
-${import_picocolors3.default.cyan(d2)}
+      return `${n}${import_picocolors2.default.cyan(o)}  ${i}
+${import_picocolors2.default.cyan(d2)}
 `;
   }
 } }).prompt();
 var ge = (t) => new MD({ validate: t.validate, mask: t.mask ?? $e, render() {
-  const n = `${import_picocolors3.default.gray(o)}
+  const n = `${import_picocolors2.default.gray(o)}
 ${b2(this.state)}  ${t.message}
 `, r2 = this.valueWithCursor, i = this.masked;
   switch (this.state) {
     case "error":
       return `${n.trim()}
-${import_picocolors3.default.yellow(o)}  ${i}
-${import_picocolors3.default.yellow(d2)}  ${import_picocolors3.default.yellow(this.error)}
+${import_picocolors2.default.yellow(o)}  ${i}
+${import_picocolors2.default.yellow(d2)}  ${import_picocolors2.default.yellow(this.error)}
 `;
     case "submit":
-      return `${n}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.dim(i)}`;
+      return `${n}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.dim(i)}`;
     case "cancel":
-      return `${n}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(i ?? ""))}${i ? `
-${import_picocolors3.default.gray(o)}` : ""}`;
+      return `${n}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(i ?? ""))}${i ? `
+${import_picocolors2.default.gray(o)}` : ""}`;
     default:
-      return `${n}${import_picocolors3.default.cyan(o)}  ${r2}
-${import_picocolors3.default.cyan(d2)}
+      return `${n}${import_picocolors2.default.cyan(o)}  ${r2}
+${import_picocolors2.default.cyan(d2)}
 `;
   }
 } }).prompt();
 var ye = (t) => {
   const n = t.active ?? "Yes", r2 = t.inactive ?? "No";
   return new dD({ active: n, inactive: r2, initialValue: t.initialValue ?? true, render() {
-    const i = `${import_picocolors3.default.gray(o)}
+    const i = `${import_picocolors2.default.gray(o)}
 ${b2(this.state)}  ${t.message}
 `, s = this.value ? n : r2;
     switch (this.state) {
       case "submit":
-        return `${i}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.dim(s)}`;
+        return `${i}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.dim(s)}`;
       case "cancel":
-        return `${i}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(s))}
-${import_picocolors3.default.gray(o)}`;
+        return `${i}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(s))}
+${import_picocolors2.default.gray(o)}`;
       default:
-        return `${i}${import_picocolors3.default.cyan(o)}  ${this.value ? `${import_picocolors3.default.green(k2)} ${n}` : `${import_picocolors3.default.dim(P2)} ${import_picocolors3.default.dim(n)}`} ${import_picocolors3.default.dim("/")} ${this.value ? `${import_picocolors3.default.dim(P2)} ${import_picocolors3.default.dim(r2)}` : `${import_picocolors3.default.green(k2)} ${r2}`}
-${import_picocolors3.default.cyan(d2)}
+        return `${i}${import_picocolors2.default.cyan(o)}  ${this.value ? `${import_picocolors2.default.green(k2)} ${n}` : `${import_picocolors2.default.dim(P2)} ${import_picocolors2.default.dim(n)}`} ${import_picocolors2.default.dim("/")} ${this.value ? `${import_picocolors2.default.dim(P2)} ${import_picocolors2.default.dim(r2)}` : `${import_picocolors2.default.green(k2)} ${r2}`}
+${import_picocolors2.default.cyan(d2)}
 `;
     }
   } }).prompt();
@@ -256660,29 +256281,29 @@ var ve = (t) => {
     const s = r2.label ?? String(r2.value);
     switch (i) {
       case "selected":
-        return `${import_picocolors3.default.dim(s)}`;
+        return `${import_picocolors2.default.dim(s)}`;
       case "active":
-        return `${import_picocolors3.default.green(k2)} ${s} ${r2.hint ? import_picocolors3.default.dim(`(${r2.hint})`) : ""}`;
+        return `${import_picocolors2.default.green(k2)} ${s} ${r2.hint ? import_picocolors2.default.dim(`(${r2.hint})`) : ""}`;
       case "cancelled":
-        return `${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(s))}`;
+        return `${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(s))}`;
       default:
-        return `${import_picocolors3.default.dim(P2)} ${import_picocolors3.default.dim(s)}`;
+        return `${import_picocolors2.default.dim(P2)} ${import_picocolors2.default.dim(s)}`;
     }
   };
   return new LD({ options: t.options, initialValue: t.initialValue, render() {
-    const r2 = `${import_picocolors3.default.gray(o)}
+    const r2 = `${import_picocolors2.default.gray(o)}
 ${b2(this.state)}  ${t.message}
 `;
     switch (this.state) {
       case "submit":
-        return `${r2}${import_picocolors3.default.gray(o)}  ${n(this.options[this.cursor], "selected")}`;
+        return `${r2}${import_picocolors2.default.gray(o)}  ${n(this.options[this.cursor], "selected")}`;
       case "cancel":
-        return `${r2}${import_picocolors3.default.gray(o)}  ${n(this.options[this.cursor], "cancelled")}
-${import_picocolors3.default.gray(o)}`;
+        return `${r2}${import_picocolors2.default.gray(o)}  ${n(this.options[this.cursor], "cancelled")}
+${import_picocolors2.default.gray(o)}`;
       default:
-        return `${r2}${import_picocolors3.default.cyan(o)}  ${G2({ cursor: this.cursor, options: this.options, maxItems: t.maxItems, style: (i, s) => n(i, s ? "active" : "inactive") }).join(`
-${import_picocolors3.default.cyan(o)}  `)}
-${import_picocolors3.default.cyan(d2)}
+        return `${r2}${import_picocolors2.default.cyan(o)}  ${G2({ cursor: this.cursor, options: this.options, maxItems: t.maxItems, style: (i, s) => n(i, s ? "active" : "inactive") }).join(`
+${import_picocolors2.default.cyan(o)}  `)}
+${import_picocolors2.default.cyan(d2)}
 `;
     }
   } }).prompt();
@@ -256690,14 +256311,14 @@ ${import_picocolors3.default.cyan(d2)}
 var fe = (t) => {
   const n = (r2, i) => {
     const s = r2.label ?? String(r2.value);
-    return i === "active" ? `${import_picocolors3.default.cyan(A2)} ${s} ${r2.hint ? import_picocolors3.default.dim(`(${r2.hint})`) : ""}` : i === "selected" ? `${import_picocolors3.default.green(T)} ${import_picocolors3.default.dim(s)} ${r2.hint ? import_picocolors3.default.dim(`(${r2.hint})`) : ""}` : i === "cancelled" ? `${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(s))}` : i === "active-selected" ? `${import_picocolors3.default.green(T)} ${s} ${r2.hint ? import_picocolors3.default.dim(`(${r2.hint})`) : ""}` : i === "submitted" ? `${import_picocolors3.default.dim(s)}` : `${import_picocolors3.default.dim(F)} ${import_picocolors3.default.dim(s)}`;
+    return i === "active" ? `${import_picocolors2.default.cyan(A2)} ${s} ${r2.hint ? import_picocolors2.default.dim(`(${r2.hint})`) : ""}` : i === "selected" ? `${import_picocolors2.default.green(T)} ${import_picocolors2.default.dim(s)} ${r2.hint ? import_picocolors2.default.dim(`(${r2.hint})`) : ""}` : i === "cancelled" ? `${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(s))}` : i === "active-selected" ? `${import_picocolors2.default.green(T)} ${s} ${r2.hint ? import_picocolors2.default.dim(`(${r2.hint})`) : ""}` : i === "submitted" ? `${import_picocolors2.default.dim(s)}` : `${import_picocolors2.default.dim(F)} ${import_picocolors2.default.dim(s)}`;
   };
   return new SD({ options: t.options, initialValues: t.initialValues, required: t.required ?? true, cursorAt: t.cursorAt, validate(r2) {
     if (this.required && r2.length === 0)
       return `Please select at least one option.
-${import_picocolors3.default.reset(import_picocolors3.default.dim(`Press ${import_picocolors3.default.gray(import_picocolors3.default.bgWhite(import_picocolors3.default.inverse(" space ")))} to select, ${import_picocolors3.default.gray(import_picocolors3.default.bgWhite(import_picocolors3.default.inverse(" enter ")))} to submit`))}`;
+${import_picocolors2.default.reset(import_picocolors2.default.dim(`Press ${import_picocolors2.default.gray(import_picocolors2.default.bgWhite(import_picocolors2.default.inverse(" space ")))} to select, ${import_picocolors2.default.gray(import_picocolors2.default.bgWhite(import_picocolors2.default.inverse(" enter ")))} to submit`))}`;
   }, render() {
-    const r2 = `${import_picocolors3.default.gray(o)}
+    const r2 = `${import_picocolors2.default.gray(o)}
 ${b2(this.state)}  ${t.message}
 `, i = (s, c) => {
       const a = this.value.includes(s.value);
@@ -256705,44 +256326,44 @@ ${b2(this.state)}  ${t.message}
     };
     switch (this.state) {
       case "submit":
-        return `${r2}${import_picocolors3.default.gray(o)}  ${this.options.filter(({ value: s }) => this.value.includes(s)).map((s) => n(s, "submitted")).join(import_picocolors3.default.dim(", ")) || import_picocolors3.default.dim("none")}`;
+        return `${r2}${import_picocolors2.default.gray(o)}  ${this.options.filter(({ value: s }) => this.value.includes(s)).map((s) => n(s, "submitted")).join(import_picocolors2.default.dim(", ")) || import_picocolors2.default.dim("none")}`;
       case "cancel": {
-        const s = this.options.filter(({ value: c }) => this.value.includes(c)).map((c) => n(c, "cancelled")).join(import_picocolors3.default.dim(", "));
-        return `${r2}${import_picocolors3.default.gray(o)}  ${s.trim() ? `${s}
-${import_picocolors3.default.gray(o)}` : ""}`;
+        const s = this.options.filter(({ value: c }) => this.value.includes(c)).map((c) => n(c, "cancelled")).join(import_picocolors2.default.dim(", "));
+        return `${r2}${import_picocolors2.default.gray(o)}  ${s.trim() ? `${s}
+${import_picocolors2.default.gray(o)}` : ""}`;
       }
       case "error": {
         const s = this.error.split(`
-`).map((c, a) => a === 0 ? `${import_picocolors3.default.yellow(d2)}  ${import_picocolors3.default.yellow(c)}` : `   ${c}`).join(`
+`).map((c, a) => a === 0 ? `${import_picocolors2.default.yellow(d2)}  ${import_picocolors2.default.yellow(c)}` : `   ${c}`).join(`
 `);
-        return `${r2 + import_picocolors3.default.yellow(o)}  ${G2({ options: this.options, cursor: this.cursor, maxItems: t.maxItems, style: i }).join(`
-${import_picocolors3.default.yellow(o)}  `)}
+        return `${r2 + import_picocolors2.default.yellow(o)}  ${G2({ options: this.options, cursor: this.cursor, maxItems: t.maxItems, style: i }).join(`
+${import_picocolors2.default.yellow(o)}  `)}
 ${s}
 `;
       }
       default:
-        return `${r2}${import_picocolors3.default.cyan(o)}  ${G2({ options: this.options, cursor: this.cursor, maxItems: t.maxItems, style: i }).join(`
-${import_picocolors3.default.cyan(o)}  `)}
-${import_picocolors3.default.cyan(d2)}
+        return `${r2}${import_picocolors2.default.cyan(o)}  ${G2({ options: this.options, cursor: this.cursor, maxItems: t.maxItems, style: i }).join(`
+${import_picocolors2.default.cyan(o)}  `)}
+${import_picocolors2.default.cyan(d2)}
 `;
     }
   } }).prompt();
 };
-var J2 = `${import_picocolors3.default.gray(o)}  `;
+var J2 = `${import_picocolors2.default.gray(o)}  `;
 
 // src/utils/display.ts
-var import_picocolors4 = __toESM(require_picocolors(), 1);
+var import_picocolors3 = __toESM(require_picocolors(), 1);
 function success(message) {
-  console.log(`${import_picocolors4.default.green("✓")} ${message}`);
+  console.log(`${import_picocolors3.default.green("✓")} ${message}`);
 }
 function error(message) {
-  console.log(`${import_picocolors4.default.red("✗")} ${message}`);
+  console.log(`${import_picocolors3.default.red("✗")} ${message}`);
 }
 function warn(message) {
-  console.log(`${import_picocolors4.default.yellow("⚠")} ${message}`);
+  console.log(`${import_picocolors3.default.yellow("⚠")} ${message}`);
 }
 function info(message) {
-  console.log(`${import_picocolors4.default.blue("ℹ")} ${message}`);
+  console.log(`${import_picocolors3.default.blue("ℹ")} ${message}`);
 }
 var MODEL_PRICING = {
   "claude-opus-4-5": [15, 75],
@@ -256784,135 +256405,665 @@ function renderContextBanner(params) {
   const costUsd = pricing ? inputTokens / 1e6 * pricing[0] + outputTokens / 1e6 * pricing[1] : null;
   const providerLabel = provider.charAt(0).toUpperCase() + provider.slice(1);
   const width = 36;
-  const border = import_picocolors4.default.dim("─".repeat(width));
+  const border = import_picocolors3.default.dim("─".repeat(width));
   console.log("");
-  console.log(`  ${import_picocolors4.default.dim(border)}`);
-  console.log(`  ${import_picocolors4.default.dim("│")} ${import_picocolors4.default.bold("Context")}${" ".repeat(width - 9)}${import_picocolors4.default.dim("│")}`);
-  console.log(`  ${import_picocolors4.default.dim("│")} ${import_picocolors4.default.cyan(totalTokens.toLocaleString())} ${import_picocolors4.default.dim("tokens")}${" ".repeat(Math.max(0, width - 2 - totalTokens.toLocaleString().length - 7))}${import_picocolors4.default.dim("│")}`);
-  console.log(`  ${import_picocolors4.default.dim("│")} ${import_picocolors4.default.yellow(`${pctUsed}%`)} ${import_picocolors4.default.dim("of context window used")}${" ".repeat(Math.max(0, width - 2 - String(pctUsed).length - 1 - 22))}${import_picocolors4.default.dim("│")}`);
+  console.log(`  ${import_picocolors3.default.dim(border)}`);
+  console.log(`  ${import_picocolors3.default.dim("│")} ${import_picocolors3.default.bold("Context")}${" ".repeat(width - 9)}${import_picocolors3.default.dim("│")}`);
+  console.log(`  ${import_picocolors3.default.dim("│")} ${import_picocolors3.default.cyan(totalTokens.toLocaleString())} ${import_picocolors3.default.dim("tokens")}${" ".repeat(Math.max(0, width - 2 - totalTokens.toLocaleString().length - 7))}${import_picocolors3.default.dim("│")}`);
+  console.log(`  ${import_picocolors3.default.dim("│")} ${import_picocolors3.default.yellow(`${pctUsed}%`)} ${import_picocolors3.default.dim("of context window used")}${" ".repeat(Math.max(0, width - 2 - String(pctUsed).length - 1 - 22))}${import_picocolors3.default.dim("│")}`);
   if (costUsd !== null) {
     const costStr = formatCost(costUsd);
-    console.log(`  ${import_picocolors4.default.dim("│")} ${import_picocolors4.default.green(costStr)} ${import_picocolors4.default.dim("spent")}${" ".repeat(Math.max(0, width - 2 - costStr.length - 6))}${import_picocolors4.default.dim("│")}`);
+    console.log(`  ${import_picocolors3.default.dim("│")} ${import_picocolors3.default.green(costStr)} ${import_picocolors3.default.dim("spent")}${" ".repeat(Math.max(0, width - 2 - costStr.length - 6))}${import_picocolors3.default.dim("│")}`);
   }
-  console.log(`  ${import_picocolors4.default.dim("│")} ${import_picocolors4.default.dim(`${providerLabel} · ${model}`)}${" ".repeat(Math.max(0, width - 2 - providerLabel.length - 3 - model.length))}${import_picocolors4.default.dim("│")}`);
-  console.log(`  ${import_picocolors4.default.dim(border)}`);
+  console.log(`  ${import_picocolors3.default.dim("│")} ${import_picocolors3.default.dim(`${providerLabel} · ${model}`)}${" ".repeat(Math.max(0, width - 2 - providerLabel.length - 3 - model.length))}${import_picocolors3.default.dim("│")}`);
+  console.log(`  ${import_picocolors3.default.dim(border)}`);
   console.log("");
 }
 
-// src/sandbox/staging.ts
-import {
-  copyFileSync,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync5,
-  readdirSync,
-  readFileSync as readFileSync5,
-  rmSync as rmSync2,
-  statSync as statSync3,
-  writeFileSync as writeFileSync5
-} from "node:fs";
-import { createHash } from "node:crypto";
-import { dirname as dirname3, join as join6, relative } from "node:path";
-
-// src/audit/logger.ts
-import {
-  appendFileSync,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync4,
-  renameSync as renameSync3,
-  rmSync,
-  statSync as statSync2,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import { join as join5 } from "node:path";
-var AUDIT_DIR_NAME = ".kitt";
-var AUDIT_FILE_NAME = "audit.log";
-var ROTATED_LOG_1 = "audit.log.1";
-var ROTATED_LOG_2 = "audit.log.2";
-var MAX_LOG_SIZE_BYTES = 10 * 1024 * 1024;
-function formatLine(type, message) {
-  return `[${new Date().toISOString()}] ${type} ${message}
-`;
+// src/mcp/lifecycle.ts
+var MCP_START_FAILURE_MESSAGE = "Railway MCP Server not found. Install it: npm install -g @railway/mcp-server";
+var SHUTDOWN_TIMEOUT_MS = 5000;
+var auditLogger = createAuditLogger(".");
+function findMcpEntryPoint() {
+  try {
+    const globalRoot = execSync("npm root -g", { encoding: "utf-8", stdio: "pipe" }).trim();
+    const candidate = join2(globalRoot, "@railway", "mcp-server", "dist", "index.js");
+    if (existsSync2(candidate))
+      return candidate;
+  } catch {}
+  return null;
 }
-function ensureAuditDir(auditDir) {
-  if (existsSync5(auditDir)) {
-    return;
+var activeServer = null;
+var pendingSpawn = null;
+var shouldLogRespawn = false;
+var intentionallyShuttingDown = new WeakSet;
+function formatExitDetail(code, signal) {
+  const codeLabel = code === null ? "null" : String(code);
+  const signalLabel = signal ?? "null";
+  return `code=${codeLabel}, signal=${signalLabel}`;
+}
+function isChildRunning(child) {
+  return child.exitCode === null && !child.killed;
+}
+function buildServerProcess(child) {
+  if (!child.stdin || !child.stdout) {
+    throw new Error("MCP server stdio was not created");
   }
-  mkdirSync4(auditDir, { recursive: true, mode: 448 });
+  return {
+    process: child,
+    stdin: child.stdin,
+    stdout: child.stdout,
+    pid: child.pid ?? -1
+  };
 }
-function rotateLogIfNeeded(logPath, log1Path, log2Path) {
-  if (!existsSync5(logPath)) {
+function attachLifecycleListeners(child) {
+  child.stderr?.on("data", (chunk) => {
+    const message = String(chunk).trim();
+    if (!message) {
+      return;
+    }
+    auditLogger.mcp("server-lifecycle", "stderr", "FAILED", message);
+  });
+  child.on("exit", (code, signal) => {
+    const detail = formatExitDetail(code, signal);
+    if (activeServer?.process === child) {
+      activeServer = null;
+    }
+    if (intentionallyShuttingDown.has(child)) {
+      return;
+    }
+    shouldLogRespawn = true;
+    auditLogger.mcp("server-lifecycle", "crash", "FAILED", detail);
+  });
+}
+function displaySpawnFailure(reason) {
+  error(MCP_START_FAILURE_MESSAGE);
+  auditLogger.mcp("server-lifecycle", "spawn", "FAILED", reason);
+}
+async function spawnMcpServer() {
+  if (activeServer && isChildRunning(activeServer.process)) {
+    return activeServer;
+  }
+  if (pendingSpawn) {
+    return pendingSpawn;
+  }
+  const entryPoint = findMcpEntryPoint();
+  if (!entryPoint) {
+    throw new Error(MCP_START_FAILURE_MESSAGE);
+  }
+  const respawn = shouldLogRespawn;
+  const child = spawn("node", [entryPoint], {
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  attachLifecycleListeners(child);
+  pendingSpawn = new Promise((resolve, reject) => {
+    const handleError = (spawnError) => {
+      child.off("spawn", handleSpawn);
+      if (activeServer?.process === child) {
+        activeServer = null;
+      }
+      displaySpawnFailure(spawnError.message);
+      reject(spawnError);
+    };
+    const handleSpawn = () => {
+      child.off("error", handleError);
+      let serverProcess;
+      try {
+        serverProcess = buildServerProcess(child);
+      } catch (buildError) {
+        const err = buildError instanceof Error ? buildError : new Error(String(buildError));
+        displaySpawnFailure(err.message);
+        reject(err);
+        return;
+      }
+      activeServer = serverProcess;
+      shouldLogRespawn = false;
+      if (respawn) {
+        auditLogger.mcp("server-lifecycle", "respawn", "SUCCESS", `pid=${serverProcess.pid}`);
+      } else {
+        auditLogger.mcp("server-lifecycle", "spawn", "SUCCESS", `pid=${serverProcess.pid}`);
+      }
+      resolve(serverProcess);
+    };
+    child.once("error", handleError);
+    child.once("spawn", handleSpawn);
+  }).finally(() => {
+    pendingSpawn = null;
+  });
+  return pendingSpawn;
+}
+async function shutdownMcpServer() {
+  if (!activeServer) {
     return;
   }
-  const stats = statSync2(logPath);
-  if (stats.size < MAX_LOG_SIZE_BYTES) {
+  const child = activeServer.process;
+  intentionallyShuttingDown.add(child);
+  if (!isChildRunning(child)) {
+    activeServer = null;
     return;
   }
-  if (existsSync5(log2Path)) {
-    rmSync(log2Path, { force: true });
+  const exitPromise = new Promise((resolve) => {
+    child.once("exit", (code, signal) => {
+      resolve({ code, signal });
+    });
+  });
+  child.kill("SIGTERM");
+  let forcedKill = false;
+  const timeoutHandle = setTimeout(() => {
+    forcedKill = true;
+    child.kill("SIGKILL");
+  }, SHUTDOWN_TIMEOUT_MS);
+  const exitResult = await exitPromise;
+  clearTimeout(timeoutHandle);
+  activeServer = null;
+  const detail = forcedKill ? `forced after timeout (${formatExitDetail(exitResult.code, exitResult.signal)})` : formatExitDetail(exitResult.code, exitResult.signal);
+  auditLogger.mcp("server-lifecycle", "shutdown", "SUCCESS", detail);
+}
+
+// src/utils/prerequisites.ts
+var import_picocolors4 = __toESM(require_picocolors(), 1);
+function getNodeVersion() {
+  try {
+    const output = execSync3("node --version", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    return output.replace(/^v/, "");
+  } catch {
+    return "";
   }
-  if (existsSync5(log1Path)) {
-    renameSync3(log1Path, log2Path);
+}
+function getBunVersion() {
+  try {
+    const output = execSync3("bun --version", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    return output;
+  } catch {
+    return null;
   }
-  renameSync3(logPath, log1Path);
-  writeFileSync4(logPath, "", { encoding: "utf8", mode: 384 });
 }
-function writeAuditLine(logPath, log1Path, log2Path, type, message) {
+function getRailwayVersion() {
   try {
-    rotateLogIfNeeded(logPath, log1Path, log2Path);
-    appendFileSync(logPath, formatLine(type, message), { encoding: "utf8", mode: 384 });
+    const output = execSync3("railway --version", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    return output || null;
   } catch {
-    return;
+    return null;
   }
 }
-function createAuditLogger(workspaceDir) {
-  const auditDir = join5(workspaceDir, AUDIT_DIR_NAME);
-  const logPath = join5(auditDir, AUDIT_FILE_NAME);
-  const log1Path = join5(auditDir, ROTATED_LOG_1);
-  const log2Path = join5(auditDir, ROTATED_LOG_2);
-  return {
-    log(type, message) {
-      try {
-        ensureAuditDir(auditDir);
-      } catch {
-        return;
-      }
-      writeAuditLine(logPath, log1Path, log2Path, type, message);
-    },
-    cmd(command, status, detail) {
-      const suffix = detail ? ` (${detail})` : "";
-      this.log("CMD", `${command} → ${status}${suffix}`);
-    },
-    cmdExec(command, status) {
-      this.log("CMD_EXEC", `${command} → ${status}`);
-    },
-    mcp(tool, params, status, detail) {
-      const suffix = detail ? ` (${detail})` : "";
-      this.log("MCP", `${tool} (${params}) → ${status}${suffix}`);
-    },
-    llmCall(provider, model, promptVersion, estimatedTokens, status) {
-      this.log("LLM_CALL", `${provider}/${model} (prompt: ${promptVersion}, est. ${estimatedTokens} tokens) → ${status}`);
+async function checkPrerequisites() {
+  const nodeVersion = getNodeVersion();
+  const bunVersion = getBunVersion();
+  const railwayVersion = getRailwayVersion();
+  const mcpFound = findMcpEntryPoint() !== null;
+  return [
+    {
+      name: "Node.js",
+      found: !!nodeVersion,
+      version: nodeVersion || undefined
     },
-    fileWrite(path, hash) {
-      const suffix = hash ? ` (SHA-256: ${hash})` : "";
-      this.log("FILE_WRITE", `${path}${suffix}`);
+    {
+      name: "Bun",
+      found: !!bunVersion,
+      version: bunVersion || undefined,
+      installUrl: bunVersion ? undefined : "https://bun.sh"
     },
-    staged(path, detail) {
-      this.log("STAGED", `${path} (${detail})`);
+    {
+      name: "Railway CLI",
+      found: !!railwayVersion,
+      version: railwayVersion || undefined,
+      installUrl: railwayVersion ? undefined : "https://docs.railway.com/cli"
     },
-    userConfirmed() {
-      this.log("USER_CONFIRMED", "staged changes");
+    {
+      name: "Railway MCP",
+      found: mcpFound,
+      installUrl: mcpFound ? undefined : "npm install -g @railway/mcp-server"
+    }
+  ];
+}
+function displayPrerequisites(statuses) {
+  for (const status of statuses) {
+    if (status.found) {
+      const version = status.version ? `v${status.version}` : "";
+      const paddedName = status.name.padEnd(12);
+      console.log(`  ${import_picocolors4.default.green("✓")} ${paddedName} ${version}`);
+    } else {
+      const paddedName = status.name.padEnd(12);
+      const installMsg = status.installUrl ? `not found. Install: ${status.installUrl}` : "not found";
+      console.log(`  ${import_picocolors4.default.red("✗")} ${paddedName} ${installMsg}`);
+    }
+  }
+}
+async function displayLlmStatus() {
+  const paddedName = "LLM".padEnd(12);
+  try {
+    const { isLlmConfigured: isLlmConfigured2, getLlmConfig: getLlmConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
+    const [configured, config] = await Promise.all([isLlmConfigured2(), getLlmConfig2()]);
+    if (configured && config) {
+      const label = `${config.provider[0].toUpperCase()}${config.provider.slice(1)} (${config.model})`;
+      console.log(`  ${import_picocolors4.default.green("✓")} ${paddedName} ${label}`);
+    } else {
+      console.log(`  ${import_picocolors4.default.yellow("!")} ${paddedName} not configured`);
+    }
+  } catch {
+    console.log(`  ${import_picocolors4.default.yellow("!")} ${paddedName} not configured`);
+  }
+}
+
+// src/manifest/reader.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
+import { join as join6, dirname as dirname2, resolve } from "node:path";
+
+// src/utils/global-config.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
+function getGlobalConfigPath() {
+  return join4(homedir2(), ".kitt", "workspace.json");
+}
+function readGlobalConfig() {
+  const configPath = getGlobalConfigPath();
+  if (!existsSync4(configPath)) {
+    return {};
+  }
+  try {
+    const raw = readFileSync3(configPath, "utf-8").trim();
+    if (!raw)
+      return {};
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) {
+      return parsed;
+    }
+    return {};
+  } catch {
+    return {};
+  }
+}
+function writeGlobalConfig(config) {
+  const configPath = getGlobalConfigPath();
+  const configDir = join4(homedir2(), ".kitt");
+  mkdirSync3(configDir, { recursive: true });
+  writeFileSync3(configPath, JSON.stringify(config, null, 2) + `
+`, "utf-8");
+}
+function setGlobalWorkspacePath(workspacePath) {
+  const existing = readGlobalConfig();
+  writeGlobalConfig({ ...existing, workspacePath });
+}
+function getGlobalWorkspacePath() {
+  return readGlobalConfig().workspacePath ?? null;
+}
+
+// src/manifest/writer.ts
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { platform as platform3 } from "node:os";
+import { dirname, join as join5 } from "node:path";
+var DIR_MODE2 = 448;
+var FILE_MODE2 = 384;
+var MANIFEST_VERSION = "0.1.0";
+function isWindows2() {
+  return platform3() === "win32";
+}
+function ensureKittDir(manifestPath) {
+  const kittDir = dirname(manifestPath);
+  if (!existsSync5(kittDir)) {
+    mkdirSync4(kittDir, { recursive: true, mode: DIR_MODE2 });
+  }
+  if (!isWindows2()) {
+    chmodSync2(kittDir, DIR_MODE2);
+  }
+}
+function writeManifest(workspaceDir, manifest) {
+  const manifestPath = getManifestPath(workspaceDir);
+  const manifestDir = dirname(manifestPath);
+  const tempFile = join5(manifestDir, `manifest.json.tmp-${process.pid}-${Date.now()}`);
+  const payload = `${JSON.stringify(manifest, null, 2)}
+`;
+  ensureKittDir(manifestPath);
+  try {
+    writeFileSync4(tempFile, payload, { encoding: "utf-8", mode: FILE_MODE2 });
+    if (!isWindows2()) {
+      chmodSync2(tempFile, FILE_MODE2);
+    }
+    renameSync3(tempFile, manifestPath);
+    if (!isWindows2()) {
+      chmodSync2(manifestPath, FILE_MODE2);
+    }
+  } catch (error2) {
+    if (existsSync5(tempFile)) {
+      unlinkSync2(tempFile);
+    }
+    throw error2;
+  }
+}
+function createInitialManifest(workspaceName, packageManager, railway) {
+  return {
+    version: MANIFEST_VERSION,
+    workspace: {
+      name: workspaceName,
+      packageManager,
+      ...railway ? { railway } : {}
     },
-    security(action, message) {
-      this.log("SECURITY", `${action} ${message}`);
+    settings: {},
+    apps: {},
+    packages: {}
+  };
+}
+function addApp(manifest, name, app) {
+  return {
+    ...manifest,
+    apps: {
+      ...manifest.apps,
+      [name]: app
+    }
+  };
+}
+function removeApp(manifest, name) {
+  const nextApps = { ...manifest.apps };
+  delete nextApps[name];
+  const nextPackages = {};
+  for (const [packageName, pkg] of Object.entries(manifest.packages)) {
+    nextPackages[packageName] = {
+      ...pkg,
+      consumers: pkg.consumers.filter((consumer) => consumer !== name)
+    };
+  }
+  return {
+    ...manifest,
+    apps: nextApps,
+    packages: nextPackages
+  };
+}
+function addPackage(manifest, name, pkg) {
+  return {
+    ...manifest,
+    packages: {
+      ...manifest.packages,
+      [name]: pkg
+    }
+  };
+}
+function addConsumer(manifest, packageName, appName) {
+  const pkg = manifest.packages[packageName];
+  if (!pkg) {
+    return {
+      ...manifest,
+      packages: {
+        ...manifest.packages
+      }
+    };
+  }
+  const consumers = pkg.consumers.includes(appName) ? [...pkg.consumers] : [...pkg.consumers, appName];
+  return {
+    ...manifest,
+    packages: {
+      ...manifest.packages,
+      [packageName]: {
+        ...pkg,
+        consumers
+      }
     }
   };
 }
 
+// src/manifest/reader.ts
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function isValidWorkspaceManifest(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (typeof value.version !== "string") {
+    return false;
+  }
+  if (!isObjectRecord(value.workspace)) {
+    return false;
+  }
+  if (typeof value.workspace.name !== "string") {
+    return false;
+  }
+  const packageManager = value.workspace.packageManager;
+  if (packageManager !== "bun" && packageManager !== "npm" && packageManager !== "pnpm" && packageManager !== "yarn") {
+    return false;
+  }
+  if (!isObjectRecord(value.apps)) {
+    return false;
+  }
+  if (!isObjectRecord(value.packages)) {
+    return false;
+  }
+  if (!isObjectRecord(value.settings)) {
+    return false;
+  }
+  return true;
+}
+function getManifestPath(workspaceDir) {
+  return join6(workspaceDir, ".kitt", "manifest.json");
+}
+function isKittWorkspace(dir) {
+  return existsSync6(getManifestPath(dir));
+}
+function findWorkspaceRoot(startDir) {
+  let current = resolve(startDir);
+  while (true) {
+    if (isKittWorkspace(current))
+      return current;
+    const parent = dirname2(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+  const globalPath = getGlobalWorkspacePath();
+  if (globalPath && isKittWorkspace(globalPath))
+    return globalPath;
+  return null;
+}
+function findWorkspaceRootStrict(startDir) {
+  let current = resolve(startDir);
+  while (true) {
+    if (isKittWorkspace(current))
+      return current;
+    const parent = dirname2(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+  return null;
+}
+function readManifest(workspaceDir) {
+  const manifestPath = getManifestPath(workspaceDir);
+  if (!existsSync6(manifestPath)) {
+    return null;
+  }
+  try {
+    const raw = readFileSync4(manifestPath, "utf-8").trim();
+    if (raw.length === 0) {
+      return null;
+    }
+    const parsed = JSON.parse(raw);
+    if (!isValidWorkspaceManifest(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function reconcileManifest(workspaceDir) {
+  const manifest = readManifest(workspaceDir);
+  if (!manifest)
+    return null;
+  const staleApps = Object.keys(manifest.apps).filter((name) => !existsSync6(join6(workspaceDir, "apps", name)));
+  if (staleApps.length === 0)
+    return manifest;
+  let cleaned = manifest;
+  for (const name of staleApps) {
+    cleaned = removeApp(cleaned, name);
+  }
+  writeManifest(workspaceDir, cleaned);
+  return cleaned;
+}
+
+// src/utils/auth-guard.ts
+init_config();
+
+// src/credentials/railway.ts
+import { execSync as execSync4 } from "node:child_process";
+async function isRailwayInstalled() {
+  try {
+    execSync4("railway --version", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkRailwayAuth() {
+  const installed = await isRailwayInstalled();
+  if (!installed) {
+    return {
+      authenticated: false,
+      error: "Railway CLI not installed"
+    };
+  }
+  try {
+    const output = execSync4("railway whoami", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    if (output && output.length > 0) {
+      return {
+        authenticated: true,
+        username: output
+      };
+    }
+    return {
+      authenticated: false
+    };
+  } catch {
+    return {
+      authenticated: false
+    };
+  }
+}
+async function railwayLogin() {
+  try {
+    execSync4("railway login", {
+      stdio: "inherit"
+    });
+    return await checkRailwayAuth();
+  } catch {
+    return {
+      authenticated: false,
+      error: "Failed to complete Railway login"
+    };
+  }
+}
+async function railwayLogout() {
+  try {
+    execSync4("railway logout", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/utils/auth-guard.ts
+var WORKSPACE_REQUIRED = new Set([
+  "create",
+  "delete",
+  "list",
+  "run",
+  "deploy",
+  "deploy:template",
+  "env:create",
+  "env:vars",
+  "domain",
+  "logs",
+  "status",
+  "versions"
+]);
+var COMMAND_AUTH = {
+  login: "none",
+  logout: "none",
+  help: "none",
+  settings: "none",
+  list: "none",
+  versions: "none",
+  exit: "none",
+  init: "both",
+  create: "both",
+  delete: "both",
+  deploy: "both",
+  "deploy:template": "both",
+  "env:create": "both",
+  "env:vars": "both",
+  domain: "both",
+  logs: "both",
+  status: "both"
+};
+async function checkAuthGuard(commandKey) {
+  if (WORKSPACE_REQUIRED.has(commandKey)) {
+    const workspaceRoot = findWorkspaceRootStrict(process.cwd());
+    if (!workspaceRoot) {
+      return {
+        allowed: false,
+        message: "No KITT workspace found. Run /init to initialize one."
+      };
+    }
+  }
+  const requirement = COMMAND_AUTH[commandKey];
+  if (!requirement || requirement === "none") {
+    return { allowed: true };
+  }
+  if (requirement === "llm" || requirement === "both") {
+    const llmConfigured = await isLlmConfigured();
+    if (!llmConfigured) {
+      return {
+        allowed: false,
+        message: "LLM API key required. Run /login llm to configure."
+      };
+    }
+  }
+  if (requirement === "railway" || requirement === "both") {
+    const railwayStatus = await checkRailwayAuth();
+    if (!railwayStatus.authenticated) {
+      return {
+        allowed: false,
+        message: "Railway authentication required. Run /login railway to authenticate."
+      };
+    }
+  }
+  return { allowed: true };
+}
+
 // src/sandbox/staging.ts
+import {
+  copyFileSync,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync5,
+  readdirSync,
+  readFileSync as readFileSync5,
+  rmSync as rmSync2,
+  statSync as statSync3,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname as dirname3, join as join7, relative } from "node:path";
 var KITT_DIR = ".kitt";
 var STAGING_DIR = "staging";
 function getStagingDir(workspaceDir) {
-  return join6(workspaceDir, KITT_DIR, STAGING_DIR);
+  return join7(workspaceDir, KITT_DIR, STAGING_DIR);
 }
 function hashContent(content) {
   return createHash("sha256").update(content).digest("hex");
@@ -256929,7 +257080,7 @@ function countLines(content) {
 function collectStagedFilePaths(stagingDir, currentDir, output) {
   const entries = readdirSync(currentDir);
   for (const entry of entries) {
-    const absolutePath = join6(currentDir, entry);
+    const absolutePath = join7(currentDir, entry);
     const stats = statSync3(absolutePath);
     if (stats.isDirectory()) {
       collectStagedFilePaths(stagingDir, absolutePath, output);
@@ -256942,36 +257093,36 @@ function collectStagedFilePaths(stagingDir, currentDir, output) {
 function clearStaging(workspaceDir) {
   const logger = createAuditLogger(workspaceDir);
   const stagingDir = getStagingDir(workspaceDir);
-  if (existsSync6(stagingDir)) {
+  if (existsSync7(stagingDir)) {
     rmSync2(stagingDir, { recursive: true, force: true });
   }
   mkdirSync5(stagingDir, { recursive: true });
-  logger.staged(join6(KITT_DIR, STAGING_DIR), "cleared");
+  logger.staged(join7(KITT_DIR, STAGING_DIR), "cleared");
 }
 function writeToStaging(workspaceDir, relativePath, content) {
   const logger = createAuditLogger(workspaceDir);
   const stagingDir = getStagingDir(workspaceDir);
-  const stagedPath = join6(stagingDir, relativePath);
+  const stagedPath = join7(stagingDir, relativePath);
   assertWithinWorkspace(stagingDir, stagedPath);
   mkdirSync5(dirname3(stagedPath), { recursive: true });
   writeFileSync5(stagedPath, content, "utf-8");
   const hash = hashContent(content);
   logger.staged(relativePath, "written to staging");
-  logger.fileWrite(join6(KITT_DIR, STAGING_DIR, relativePath), hash);
+  logger.fileWrite(join7(KITT_DIR, STAGING_DIR, relativePath), hash);
 }
 function listStagedFiles(workspaceDir) {
   const logger = createAuditLogger(workspaceDir);
   const stagingDir = getStagingDir(workspaceDir);
-  if (!existsSync6(stagingDir)) {
+  if (!existsSync7(stagingDir)) {
     return [];
   }
   const filePaths = [];
   collectStagedFilePaths(stagingDir, stagingDir, filePaths);
   return filePaths.sort((a, b3) => a.localeCompare(b3)).map((stagedRelativePath) => {
-    const workspacePath = join6(workspaceDir, stagedRelativePath);
+    const workspacePath = join7(workspaceDir, stagedRelativePath);
     assertWithinWorkspace(workspaceDir, workspacePath);
-    const content = readFileSync5(join6(stagingDir, stagedRelativePath), "utf-8");
-    const isNew = !existsSync6(workspacePath);
+    const content = readFileSync5(join7(stagingDir, stagedRelativePath), "utf-8");
+    const isNew = !existsSync7(workspacePath);
     const isModified = !isNew;
     logger.staged(stagedRelativePath, isNew ? "new" : "modified");
     return {
@@ -256994,8 +257145,8 @@ function applyStagedChanges(workspaceDir, stagedFiles) {
   const logger = createAuditLogger(workspaceDir);
   const stagingDir = getStagingDir(workspaceDir);
   for (const stagedFile of stagedFiles) {
-    const sourcePath = join6(stagingDir, stagedFile.relativePath);
-    const destinationPath = join6(workspaceDir, stagedFile.relativePath);
+    const sourcePath = join7(stagingDir, stagedFile.relativePath);
+    const destinationPath = join7(workspaceDir, stagedFile.relativePath);
     assertWithinWorkspace(workspaceDir, destinationPath);
     mkdirSync5(dirname3(destinationPath), { recursive: true });
     copyFileSync(sourcePath, destinationPath);
@@ -257115,7 +257266,7 @@ function createRateLimiter() {
 }
 
 // src/llm/client.ts
-var auditLogger = createAuditLogger(".");
+var auditLogger2 = createAuditLogger(".");
 var DEFAULT_MAX_TOKENS = 8192;
 async function loadProvider(provider) {
   switch (provider) {
@@ -257159,17 +257310,17 @@ function ensureRateLimit(rateLimiter, provider, model, estimatedTokens) {
   if (check.allowed) {
     return;
   }
-  auditLogger.llmCall(provider, model, PROMPT_VERSION, estimatedTokens, "FAILED");
+  auditLogger2.llmCall(provider, model, PROMPT_VERSION, estimatedTokens, "FAILED");
   throw new Error(check.reason ?? "LLM call limit reached for this session.");
 }
 async function executeWithAudit(options) {
   const { provider, model, estimatedTokens, rateLimiter, operation } = options;
   try {
     const response = await operation();
-    auditLogger.llmCall(provider, model, PROMPT_VERSION, estimatedTokens, "SUCCESS");
+    auditLogger2.llmCall(provider, model, PROMPT_VERSION, estimatedTokens, "SUCCESS");
     return response;
   } catch (error4) {
-    auditLogger.llmCall(provider, model, PROMPT_VERSION, estimatedTokens, "FAILED");
+    auditLogger2.llmCall(provider, model, PROMPT_VERSION, estimatedTokens, "FAILED");
     throw error4;
   } finally {
     rateLimiter.recordCall(estimatedTokens);
@@ -257915,7 +258066,7 @@ var CLIENT_INFO = {
   name: "openkitt",
   version: "0.1.0"
 };
-var auditLogger2 = createAuditLogger(".");
+var auditLogger3 = createAuditLogger(".");
 function createJsonRpcError(code, message) {
   const error4 = new Error(message);
   error4.code = code;
@@ -258085,7 +258236,7 @@ async function createMcpClient(server2) {
       if (!isToolsListResult(result)) {
         throw new Error("Invalid tools/list response from MCP server");
       }
-      auditLogger2.mcp("tools/list", "{}", "SUCCESS");
+      auditLogger3.mcp("tools/list", "{}", "SUCCESS");
       return result.tools;
     },
     async callTool(name, args) {
@@ -258100,12 +258251,12 @@ async function createMcpClient(server2) {
           throw new Error("Invalid tools/call response from MCP server");
         }
         const status = result.isError ? "FAILED" : "SUCCESS";
-        auditLogger2.mcp(name, paramsText, status, result.isError ? "tool returned isError=true" : undefined);
+        auditLogger3.mcp(name, paramsText, status, result.isError ? "tool returned isError=true" : undefined);
         return result;
       } catch (requestError) {
         const error4 = requestError instanceof Error ? requestError : new Error(String(requestError));
         const detail = "code" in error4 ? `${String(error4.code)}: ${error4.message}` : error4.message;
-        auditLogger2.mcp(name, paramsText, "FAILED", detail);
+        auditLogger3.mcp(name, paramsText, "FAILED", detail);
         throw error4;
       }
     },
@@ -258116,137 +258267,6 @@ async function createMcpClient(server2) {
   };
 }
 
-// src/mcp/lifecycle.ts
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { dirname as dirname4, join as join7 } from "node:path";
-var MCP_ENTRY_POINT = join7(dirname4(fileURLToPath(import.meta.url)), "..", "..", "node_modules", "@railway", "mcp-server", "dist", "index.js");
-var MCP_START_FAILURE_MESSAGE = "Railway MCP Server failed to start. Try reinstalling: npm install -g openkitt@latest";
-var SHUTDOWN_TIMEOUT_MS = 5000;
-var auditLogger3 = createAuditLogger(".");
-var activeServer = null;
-var pendingSpawn = null;
-var shouldLogRespawn = false;
-var intentionallyShuttingDown = new WeakSet;
-function formatExitDetail(code, signal) {
-  const codeLabel = code === null ? "null" : String(code);
-  const signalLabel = signal ?? "null";
-  return `code=${codeLabel}, signal=${signalLabel}`;
-}
-function isChildRunning(child) {
-  return child.exitCode === null && !child.killed;
-}
-function buildServerProcess(child) {
-  if (!child.stdin || !child.stdout) {
-    throw new Error("MCP server stdio was not created");
-  }
-  return {
-    process: child,
-    stdin: child.stdin,
-    stdout: child.stdout,
-    pid: child.pid ?? -1
-  };
-}
-function attachLifecycleListeners(child) {
-  child.stderr?.on("data", (chunk) => {
-    const message = String(chunk).trim();
-    if (!message) {
-      return;
-    }
-    auditLogger3.mcp("server-lifecycle", "stderr", "FAILED", message);
-  });
-  child.on("exit", (code, signal) => {
-    const detail = formatExitDetail(code, signal);
-    if (activeServer?.process === child) {
-      activeServer = null;
-    }
-    if (intentionallyShuttingDown.has(child)) {
-      return;
-    }
-    shouldLogRespawn = true;
-    auditLogger3.mcp("server-lifecycle", "crash", "FAILED", detail);
-  });
-}
-function displaySpawnFailure(reason) {
-  error(MCP_START_FAILURE_MESSAGE);
-  auditLogger3.mcp("server-lifecycle", "spawn", "FAILED", reason);
-}
-async function spawnMcpServer() {
-  if (activeServer && isChildRunning(activeServer.process)) {
-    return activeServer;
-  }
-  if (pendingSpawn) {
-    return pendingSpawn;
-  }
-  const respawn = shouldLogRespawn;
-  const child = spawn("node", [MCP_ENTRY_POINT], {
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  attachLifecycleListeners(child);
-  pendingSpawn = new Promise((resolve2, reject) => {
-    const handleError = (spawnError) => {
-      child.off("spawn", handleSpawn);
-      if (activeServer?.process === child) {
-        activeServer = null;
-      }
-      displaySpawnFailure(spawnError.message);
-      reject(spawnError);
-    };
-    const handleSpawn = () => {
-      child.off("error", handleError);
-      let serverProcess;
-      try {
-        serverProcess = buildServerProcess(child);
-      } catch (buildError) {
-        const err = buildError instanceof Error ? buildError : new Error(String(buildError));
-        displaySpawnFailure(err.message);
-        reject(err);
-        return;
-      }
-      activeServer = serverProcess;
-      shouldLogRespawn = false;
-      if (respawn) {
-        auditLogger3.mcp("server-lifecycle", "respawn", "SUCCESS", `pid=${serverProcess.pid}`);
-      } else {
-        auditLogger3.mcp("server-lifecycle", "spawn", "SUCCESS", `pid=${serverProcess.pid}`);
-      }
-      resolve2(serverProcess);
-    };
-    child.once("error", handleError);
-    child.once("spawn", handleSpawn);
-  }).finally(() => {
-    pendingSpawn = null;
-  });
-  return pendingSpawn;
-}
-async function shutdownMcpServer() {
-  if (!activeServer) {
-    return;
-  }
-  const child = activeServer.process;
-  intentionallyShuttingDown.add(child);
-  if (!isChildRunning(child)) {
-    activeServer = null;
-    return;
-  }
-  const exitPromise = new Promise((resolve2) => {
-    child.once("exit", (code, signal) => {
-      resolve2({ code, signal });
-    });
-  });
-  child.kill("SIGTERM");
-  let forcedKill = false;
-  const timeoutHandle = setTimeout(() => {
-    forcedKill = true;
-    child.kill("SIGKILL");
-  }, SHUTDOWN_TIMEOUT_MS);
-  const exitResult = await exitPromise;
-  clearTimeout(timeoutHandle);
-  activeServer = null;
-  const detail = forcedKill ? `forced after timeout (${formatExitDetail(exitResult.code, exitResult.signal)})` : formatExitDetail(exitResult.code, exitResult.signal);
-  auditLogger3.mcp("server-lifecycle", "shutdown", "SUCCESS", detail);
-}
-
 // src/scaffold/packages.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join8 } from "node:path";
@@ -258393,7 +258413,7 @@ function scaffoldDefaultPackages(packagesDir) {
 }
 
 // src/utils/validation.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 var APP_NAME_REGEX = /^[a-z][a-z0-9-]{1,48}[a-z0-9]$/;
 function validateAppName(name) {
@@ -258420,7 +258440,7 @@ function sanitizeInput(input) {
 function validateAppNameUniqueness(name, workspaceDir) {
   const manifest = readManifest(workspaceDir);
   const existsInManifest = manifest !== null && name in manifest.apps;
-  const existsInAppsDirectory = existsSync7(join9(workspaceDir, "apps", name));
+  const existsInAppsDirectory = existsSync8(join9(workspaceDir, "apps", name));
   if (existsInManifest || existsInAppsDirectory) {
     return {
       valid: false,
@@ -258432,7 +258452,7 @@ function validateAppNameUniqueness(name, workspaceDir) {
 
 // src/versions/integrity.ts
 import { createHash as createHash2 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync8, readFileSync as readFileSync6, renameSync as renameSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync9, readFileSync as readFileSync6, renameSync as renameSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "node:fs";
 import { platform as platform4 } from "node:os";
 import { join as join10 } from "node:path";
 var FILE_MODE3 = 384;
@@ -258467,7 +258487,7 @@ function writeVersionsLock(workspaceDir, hash) {
       chmodSync3(lockPath, FILE_MODE3);
     }
   } catch (error4) {
-    if (existsSync8(tempPath)) {
+    if (existsSync9(tempPath)) {
       unlinkSync3(tempPath);
     }
     throw error4;
@@ -258921,7 +258941,7 @@ async function initCommand(context, _args) {
 }
 
 // src/commands/create.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync10 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join18 } from "node:path";
 init_config();
 
@@ -262205,7 +262225,7 @@ async function executeCreateScaffolding(options) {
 }
 
 // src/sandbox/scanner.ts
-import { existsSync as existsSync9, lstatSync, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync10, lstatSync, readFileSync as readFileSync8 } from "node:fs";
 import { extname, isAbsolute, join as join13, normalize, resolve as resolve3 } from "node:path";
 var ALLOWED_EXTENSIONS = new Set([
   ".ts",
@@ -262281,7 +262301,7 @@ function validateFilePath(filePath) {
       detail: "Path contains '..' segments and may escape the workspace"
     });
   }
-  if (existsSync9(filePath)) {
+  if (existsSync10(filePath)) {
     const stats = lstatSync(filePath);
     if (stats.isSymbolicLink()) {
       warnings.push({
@@ -262390,8 +262410,8 @@ async function confirmAndApply(options) {
 // src/ast/engine.ts
 var import_ts_morph = __toESM(require_ts_morph(), 1);
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join14, normalize as normalize2, relative as relative2, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join14, normalize as normalize2, relative as relative2, resolve as resolve4 } from "node:path";
 var KITT_DIR2 = ".kitt";
 var STAGING_DIR2 = "staging";
 function hashContent2(content) {
@@ -262435,7 +262455,7 @@ function createAstEngine(workspaceDir) {
     if (!isRelativePathInside(workspaceDir, fullPath)) {
       throw new Error(`Path is outside workspace: ${relativePath}`);
     }
-    if (!existsSync10(fullPath)) {
+    if (!existsSync11(fullPath)) {
       throw new Error(`File does not exist: ${relativePath}`);
     }
     const existing = project.getSourceFile(fullPath);
@@ -262450,7 +262470,7 @@ function createAstEngine(workspaceDir) {
     if (!isRelativePathInside(resolve4(workspaceDir, KITT_DIR2, STAGING_DIR2), stagingPath)) {
       throw new Error(`Refusing to write outside staging directory: ${relativePath}`);
     }
-    mkdirSync8(dirname5(stagingPath), { recursive: true });
+    mkdirSync8(dirname4(stagingPath), { recursive: true });
     const fullText = sourceFile.getFullText();
     writeFileSync10(stagingPath, fullText, "utf-8");
     auditLogger4.staged(relativePath, "AST modified");
@@ -262823,7 +262843,7 @@ function applyOperation(sourceFile, operation) {
 
 // src/ast/validator.ts
 var import_ts_morph3 = __toESM(require_ts_morph(), 1);
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { extname as extname2, isAbsolute as isAbsolute3, normalize as normalize3, relative as relative3, resolve as resolve5 } from "node:path";
 var VALID_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
 var TARGET_FILE_OPERATION = { op: "targetFile" };
@@ -263010,7 +263030,7 @@ function validateTargetFile(workspaceDir, filePath) {
       message: `Path is outside workspace: ${filePath}`
     });
   }
-  if (!existsSync11(absoluteTargetPath)) {
+  if (!existsSync12(absoluteTargetPath)) {
     errors.push({
       filePath,
       operation: TARGET_FILE_OPERATION,
@@ -263131,7 +263151,7 @@ function executeTransformPipeline(transforms, workspaceDir) {
 }
 
 // src/commands/create-pipeline.ts
-import { execSync as execSync4 } from "node:child_process";
+import { execSync as execSync5 } from "node:child_process";
 import { join as join15 } from "node:path";
 
 // src/utils/pm.ts
@@ -263308,7 +263328,7 @@ function executeCommandPipeline(commands, options) {
       continue;
     }
     try {
-      execSync4(bare, { cwd, stdio: "inherit" });
+      execSync5(bare, { cwd, stdio: "inherit" });
       results.push({
         command: cmd.command,
         purpose: cmd.purpose,
@@ -263391,13 +263411,13 @@ async function provisionInfrastructure(options) {
 
 // src/commands/run.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
 import { join as join17 } from "node:path";
 var import_picocolors6 = __toESM(require_picocolors(), 1);
 
 // src/commands/settings.ts
-import { execSync as execSync5 } from "node:child_process";
-import { chmodSync as chmodSync5, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync9, renameSync as renameSync5, rmSync as rmSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync11 } from "node:fs";
+import { execSync as execSync6 } from "node:child_process";
+import { chmodSync as chmodSync5, existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync9, renameSync as renameSync5, rmSync as rmSync3, unlinkSync as unlinkSync4, writeFileSync as writeFileSync11 } from "node:fs";
 import { homedir as homedir3, platform as platform6 } from "node:os";
 import { join as join16 } from "node:path";
 var SUPPORTED_PACKAGE_MANAGERS = ["bun", "npm", "pnpm", "yarn"];
@@ -263415,7 +263435,7 @@ function isWindows4() {
   return platform6() === "win32";
 }
 function ensureConfigDir2() {
-  if (!existsSync12(CONFIG_DIR2)) {
+  if (!existsSync13(CONFIG_DIR2)) {
     mkdirSync9(CONFIG_DIR2, { recursive: true, mode: DIR_MODE3 });
   }
   if (!isWindows4()) {
@@ -263427,7 +263447,7 @@ function isPackageManager(value) {
 }
 function readGlobalConfig2() {
   ensureConfigDir2();
-  if (!existsSync12(CONFIG_FILE2)) {
+  if (!existsSync13(CONFIG_FILE2)) {
     return {};
   }
   const raw = readFileSync9(CONFIG_FILE2, "utf-8").trim();
@@ -263459,7 +263479,7 @@ function writeGlobalConfig2(config) {
       chmodSync5(CONFIG_FILE2, FILE_MODE4);
     }
   } catch (writeError) {
-    if (existsSync12(tempFile)) {
+    if (existsSync13(tempFile)) {
       unlinkSync4(tempFile);
     }
     throw writeError;
@@ -263584,7 +263604,7 @@ async function maybeConfirmMigration(context, fromPm, toPm) {
 function migrateWorkspacePackageManager(workspaceDir, fromPm, toPm) {
   removePackageManagerArtifacts(workspaceDir, fromPm);
   writePackageManagerFiles(workspaceDir, toPm);
-  execSync5(getInstallCommand(toPm), { cwd: workspaceDir, stdio: "inherit" });
+  execSync6(getInstallCommand(toPm), { cwd: workspaceDir, stdio: "inherit" });
 }
 async function runDisplayMode(workspaceDir) {
   const autoOpen = readAutoOpenBrowser();
@@ -263668,7 +263688,7 @@ async function settingsCommand(context, args) {
 var DEV_SCRIPT_CANDIDATES = ["dev", "start", "serve", "preview"];
 function resolveDevScript(appDir) {
   const pkgPath = join17(appDir, "package.json");
-  if (!existsSync13(pkgPath)) {
+  if (!existsSync14(pkgPath)) {
     return { found: false, reason: "no-package-json", available: [] };
   }
   let pkg;
@@ -263955,7 +263975,7 @@ async function createCommand2(context, _args) {
     });
     logger.cmd("/create", "SUCCESS");
     success(`App ${selections.appName} created.`);
-    if (existsSync14(appDir)) {
+    if (existsSync15(appDir)) {
       const runCmd = getCommand(manifest.workspace.packageManager, "run");
       const scriptResolution = resolveDevScript(appDir);
       if (scriptResolution.found) {
@@ -264054,7 +264074,7 @@ async function deleteCommand(context, args) {
 }
 
 // src/commands/deploy.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync13 } from "node:fs";
 import { basename as basename2, join as join20 } from "node:path";
 init_config();
 
@@ -264118,7 +264138,7 @@ function matchesGitignorePattern(filePath, pattern) {
 }
 function loadGitignorePatterns(workspaceDir) {
   const gitignorePath = join20(workspaceDir, ".gitignore");
-  if (!existsSync15(gitignorePath)) {
+  if (!existsSync16(gitignorePath)) {
     return [];
   }
   return readFileSync11(gitignorePath, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
@@ -264257,7 +264277,7 @@ restartPolicyMaxRetries = 3${deployEnv}`;
 }
 function ensureRailwayToml(appName, framework, packageManager) {
   const railwayTomlPath = join20("apps", appName, "railway.toml");
-  if (existsSync15(railwayTomlPath)) {
+  if (existsSync16(railwayTomlPath)) {
     return false;
   }
   writeFileSync13(railwayTomlPath, generateRailwayToml(framework, packageManager), "utf-8");
@@ -264746,10 +264766,10 @@ var import_picocolors7 = __toESM(require_picocolors(), 1);
 init_config();
 
 // src/manifest/drift.ts
-import { existsSync as existsSync16, readdirSync as readdirSync4 } from "node:fs";
+import { existsSync as existsSync17, readdirSync as readdirSync4 } from "node:fs";
 import { join as join21 } from "node:path";
 function listDirectories(parentDir) {
-  if (!existsSync16(parentDir)) {
+  if (!existsSync17(parentDir)) {
     return [];
   }
   return readdirSync4(parentDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => left.localeCompare(right));
@@ -265084,7 +265104,7 @@ async function loginCommand(context, args, commandKey = "login") {
 }
 
 // src/commands/versions.ts
-import { existsSync as existsSync17, readFileSync as readFileSync12, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync12, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join22 } from "node:path";
 var import_picocolors9 = __toESM(require_picocolors(), 1);
 var TABLE_HEADER_INTEGRATION = "Integration";
@@ -265129,7 +265149,7 @@ function loadVersionsContext(logger) {
     return null;
   }
   const versionsPath = join22(workspaceDir, "versions.md");
-  if (!existsSync17(versionsPath)) {
+  if (!existsSync18(versionsPath)) {
     error("versions.md not found in workspace root.");
     logger.cmd("/versions", "FAILED", "versions.md missing");
     return null;
@@ -265562,7 +265582,7 @@ async function helpCommand(_context, _args) {
 // package.json
 var package_default = {
   name: "openkitt",
-  version: "0.2.5",
+  version: "0.2.7",
   description: "AI-powered monorepo scaffolding CLI",
   keywords: [
     "cli",
@@ -265606,7 +265626,6 @@ var package_default = {
     "@anthropic-ai/sdk": "^0.66.0",
     "@clack/prompts": "^0.11.0",
     "@google/generative-ai": "^0.24.1",
-    "@railway/mcp-server": "^0.1.8",
     commander: "^14.0.1",
     openai: "^6.6.0",
     picocolors: "^1.1.1",
@@ -265716,7 +265735,7 @@ function isVersionNewer(latest, current) {
   return false;
 }
 function hasFreshUpdateCache(now) {
-  if (!existsSync18(UPDATE_CHECK_FILE)) {
+  if (!existsSync19(UPDATE_CHECK_FILE)) {
     return false;
   }
   try {
@@ -265806,7 +265825,14 @@ async function dispatchCommand(commandLine, context) {
     console.log(import_picocolors12.default.red(`✗ ${authCheck.message}`));
     return "continue";
   }
-  await resolveAndRunHandler(route, context, parsed.args, parsed.key);
+  if (process.stdin.isTTY)
+    process.stdin.setRawMode(false);
+  try {
+    await resolveAndRunHandler(route, context, parsed.args, parsed.key);
+  } finally {
+    if (process.stdin.isTTY)
+      process.stdin.setRawMode(true);
+  }
   return "continue";
 }
 async function runSingleCommand(commandLine, context) {
@@ -265865,7 +265891,7 @@ function resolvePrompt() {
       workspaceRoot = current;
       break;
     }
-    const parent = dirname6(current);
+    const parent = dirname5(current);
     if (parent === current)
       break;
     current = parent;