pi-career 0.2.0 → 0.3.0

package/dist/index.js

@@ -12,11 +12,12 @@ import { TextDecoder as TextDecoder2 } from "node:util";
 
 // src/errors.ts
 var ERROR_MESSAGES = {
+  unsupported_platform: "pi-career supports only macOS and Linux.",
   invalid_request: "The Career Core tool request is invalid.",
   invalid_executable_override: "CAREER_CLI_PATH must be a bounded absolute executable path.",
   managed_contract_invalid: "The selected Career Core runtime has incompatible managed contracts.",
-  runtime_unavailable: "No compatible Career Core runtime is available. Install @revazi/career@0.1.1 or configure a compatible local career executable.",
-  runtime_acquisition_failed: "Automatic acquisition of @revazi/career@0.1.1 failed. Install that exact package or configure a compatible local career executable.",
+  runtime_unavailable: "No compatible Career Core runtime is available. Install @revazi/career@0.2.0 or configure a compatible local career executable.",
+  runtime_acquisition_failed: "Automatic acquisition of @revazi/career@0.2.0 failed. Install that exact package or configure a compatible local career executable.",
   missing_executable: "The selected Career Core runtime was not found.",
   executable_unavailable: "The selected Career Core runtime is not available for execution.",
   cancelled: "The Career Core operation was cancelled.",
@@ -63,7 +64,7 @@ var MANAGED_INVOKE_OPTIONS = {
   toolResultMaxBytes: MANAGED_OUTPUT_MAX_BYTES,
   toolResultMaxLines: MANAGED_RESULT_MAX_LINES
 };
-var EXPECTED_CORE_VERSION = "0.1.1";
+var EXPECTED_CORE_VERSION = "0.2.0";
 var EXPECTED_OPERATIONS = {
   "core.capabilities": {
     capability: "core.capabilities",
@@ -292,21 +293,20 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { TextDecoder } from "node:util";
 var CAREER_PACKAGE_NAME = "@revazi/career";
-var CAREER_PACKAGE_VERSION = "0.1.1";
+var CAREER_PACKAGE_VERSION = "0.2.0";
 var CAREER_LAUNCHER_SCHEMA = "career.npm_launcher.v2";
 var CAREER_TARGET_CATALOG = "targets.json";
+var CAREER_LAUNCHER_ENTRY = "bin/career.js";
 var CAREER_PLATFORM_PACKAGES = Object.freeze([
   "@revazi/career-darwin-arm64",
   "@revazi/career-darwin-x64",
   "@revazi/career-linux-x64-gnu",
   "@revazi/career-linux-arm64-gnu",
   "@revazi/career-linux-x64-musl",
-  "@revazi/career-linux-arm64-musl",
-  "@revazi/career-win32-x64-msvc",
-  "@revazi/career-win32-arm64-msvc"
+  "@revazi/career-linux-arm64-musl"
 ]);
 var CAREER_LAUNCHER_FILES = Object.freeze([
-  "bin/career.js",
+  CAREER_LAUNCHER_ENTRY,
   CAREER_TARGET_CATALOG,
   "README.md",
   "LICENSE-MIT",
@@ -324,6 +324,7 @@ var ACQUISITION_TIMEOUT_MS = 12e4;
 var TERMINATION_GRACE_MS = 250;
 var CANONICAL_NPM_REGISTRY = "https://registry.npmjs.org/";
 var SOURCE_ORDER = ["path", "package-local", "acquired"];
+var SUPPORTED_PLATFORMS = /* @__PURE__ */ new Set(["darwin", "linux"]);
 var requireFromPackage = createRequire(import.meta.url);
 var cachedResolution;
 var pendingResolution;
@@ -336,7 +337,11 @@ function runtimeEnvironmentKey(environment) {
     environmentValue(environment, "PATH") ?? null
   ]);
 }
+function assertSupportedPlatform() {
+  if (!SUPPORTED_PLATFORMS.has(process.platform)) throw adapterError("unsupported_platform");
+}
 function resolveCareerExecutable(environment = process.env) {
+  assertSupportedPlatform();
   const override = environmentValue(environment, "CAREER_CLI_PATH");
   if (override === void 0) return void 0;
   if (override.length === 0 || override.includes("\0") || Buffer.byteLength(override, "utf8") > EXECUTABLE_MAX_BYTES || !path.isAbsolute(override)) {
@@ -359,20 +364,15 @@ function pathEntries(environmentPath, cwd) {
   if (environmentPath === void 0 || environmentPath.includes("\0") || Buffer.byteLength(environmentPath, "utf8") > PATH_MAX_BYTES) return [];
   return environmentPath.split(path.delimiter).map((entry) => path.resolve(entry || cwd));
 }
-function executableNames() {
-  return process.platform === "win32" ? ["career.exe", "career.com", "career"] : ["career"];
-}
 async function pathRoute(environment, cwd) {
   for (const directory of pathEntries(environmentValue(environment, "PATH"), cwd)) {
-    for (const name of executableNames()) {
-      const candidate = path.join(directory, name);
-      try {
-        const metadata = await lstat(candidate);
-        if (!metadata.isFile() && !metadata.isSymbolicLink()) continue;
-        await access(candidate, fsConstants.X_OK);
-        return route(candidate, [], "path");
-      } catch {
-      }
+    const candidate = path.join(directory, "career");
+    try {
+      const metadata = await lstat(candidate);
+      if (!metadata.isFile() && !metadata.isSymbolicLink()) continue;
+      await access(candidate, fsConstants.X_OK);
+      return route(candidate, [], "path");
+    } catch {
     }
   }
   return void 0;
@@ -381,7 +381,7 @@ function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function boundedRegularFile(metadata, maximumBytes, executable) {
-  return !metadata.isSymbolicLink() && metadata.isFile() && metadata.size >= 2 && metadata.size <= maximumBytes && (!executable || process.platform === "win32" || (metadata.mode & 73) !== 0);
+  return !metadata.isSymbolicLink() && metadata.isFile() && metadata.size >= 2 && metadata.size <= maximumBytes && (!executable || (metadata.mode & 73) !== 0);
 }
 function exactKeys2(value, expected) {
   return Object.keys(value).sort().join("\0") === [...expected].sort().join("\0");
@@ -392,7 +392,7 @@ function exactStringArray(value, expected) {
 function launcherManifestIsValid(manifest) {
   if (!isRecord2(manifest) || !isRecord2(manifest.bin) || !isRecord2(manifest.optionalDependencies) || !isRecord2(manifest.career_launcher)) return false;
   const optionalDependencies = manifest.optionalDependencies;
-  return manifest.name === CAREER_PACKAGE_NAME && manifest.version === CAREER_PACKAGE_VERSION && exactKeys2(manifest.bin, ["career"]) && manifest.bin.career === "bin/career.js" && exactStringArray(manifest.files, CAREER_LAUNCHER_FILES) && exactKeys2(optionalDependencies, CAREER_PLATFORM_PACKAGES) && CAREER_PLATFORM_PACKAGES.every(
+  return manifest.name === CAREER_PACKAGE_NAME && manifest.version === CAREER_PACKAGE_VERSION && exactKeys2(manifest.bin, ["career"]) && manifest.bin.career === CAREER_LAUNCHER_ENTRY && exactStringArray(manifest.files, CAREER_LAUNCHER_FILES) && exactKeys2(optionalDependencies, CAREER_PLATFORM_PACKAGES) && CAREER_PLATFORM_PACKAGES.every(
     (packageName) => optionalDependencies[packageName] === CAREER_PACKAGE_VERSION
   ) && exactKeys2(manifest.career_launcher, [
     "schema_version",
@@ -410,12 +410,12 @@ async function readLauncherRoute(manifestPath, source, execPath) {
     ]);
     if (!boundedRegularFile(manifestMetadata, PACKAGE_MANIFEST_MAX_BYTES, false)) return void 0;
     const nodeMetadata = await lstat(realNodePath);
-    if (!nodeMetadata.isFile() || process.platform !== "win32" && (nodeMetadata.mode & 73) === 0) return void 0;
+    if (!nodeMetadata.isFile() || (nodeMetadata.mode & 73) === 0) return void 0;
     const bytes = await readFile(manifestPath);
     if (bytes.length !== manifestMetadata.size) return void 0;
     const manifest = JSON.parse(bytes.toString("utf8"));
     if (!launcherManifestIsValid(manifest)) return void 0;
-    const launcherPath = path.join(path.dirname(manifestPath), "bin", "career.js");
+    const launcherPath = path.join(path.dirname(manifestPath), CAREER_LAUNCHER_ENTRY);
     const launcherMetadata = await lstat(launcherPath);
     if (!boundedRegularFile(launcherMetadata, LAUNCHER_MAX_BYTES, true)) return void 0;
     return route(realNodePath, [launcherPath], source);
@@ -442,48 +442,15 @@ async function packageLocalRoute(dependencies) {
 function npmExecPathValues(environment) {
   return Object.entries(environment).filter(([key]) => key.toLowerCase() === "npm_execpath").map(([, value]) => value);
 }
-function samePath(left, right) {
-  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
-}
-function environmentValues(environment, key) {
-  return Object.entries(environment).filter(([name]) => name.toLowerCase() === key.toLowerCase()).map(([, value]) => value);
-}
-async function trustedWindowsShell(environment) {
-  const roots = environmentValues(environment, "SystemRoot");
-  const suppliedShells = environmentValues(environment, "ComSpec");
-  if (roots.length !== 1 || suppliedShells.length > 1) throw new Error("invalid Windows tools");
-  const root = roots[0];
-  if (typeof root !== "string" || !path.isAbsolute(root) || root.includes("\0")) {
-    throw new Error("invalid Windows root");
-  }
-  const rootMetadata = await lstat(root);
-  if (rootMetadata.isSymbolicLink() || !rootMetadata.isDirectory()) {
-    throw new Error("invalid Windows root");
-  }
-  const realSystemRoot = await realpath(root);
-  const derivedShell = path.join(realSystemRoot, "System32", "cmd.exe");
-  const realShell = await realpath(derivedShell);
-  if (!samePath(realShell, derivedShell)) throw new Error("invalid Windows shell path");
-  const shellMetadata = await lstat(realShell);
-  if (shellMetadata.isSymbolicLink() || !shellMetadata.isFile()) {
-    throw new Error("invalid Windows shell");
-  }
-  if (suppliedShells.length === 1) {
-    const suppliedShell = suppliedShells[0];
-    if (typeof suppliedShell !== "string" || !path.isAbsolute(suppliedShell)) {
-      throw new Error("invalid ComSpec");
-    }
-    if (!samePath(await realpath(suppliedShell), realShell)) throw new Error("conflicting ComSpec");
-  }
-  return { scriptShell: realShell, systemRoot: realSystemRoot };
-}
 async function trustedNpm(execPath, environment) {
   try {
     if (!path.isAbsolute(execPath)) throw new Error("invalid node path");
     const realNodePath = await realpath(execPath);
     const nodeMetadata = await lstat(realNodePath);
-    if (!nodeMetadata.isFile() || process.platform !== "win32" && (nodeMetadata.mode & 73) === 0) throw new Error("invalid node executable");
-    const derivedNpmCliPath = process.platform === "win32" ? path.join(path.dirname(realNodePath), "node_modules", "npm", "bin", "npm-cli.js") : path.join(
+    if (!nodeMetadata.isFile() || (nodeMetadata.mode & 73) === 0) {
+      throw new Error("invalid node executable");
+    }
+    const derivedNpmCliPath = path.join(
       path.dirname(path.dirname(realNodePath)),
       "lib",
       "node_modules",
@@ -492,9 +459,11 @@ async function trustedNpm(execPath, environment) {
       "npm-cli.js"
     );
     const realNpmCliPath = await realpath(derivedNpmCliPath);
-    if (!samePath(realNpmCliPath, derivedNpmCliPath)) throw new Error("invalid npm path");
+    if (realNpmCliPath !== derivedNpmCliPath) throw new Error("invalid npm path");
     const npmMetadata = await lstat(realNpmCliPath);
-    if (!npmMetadata.isFile() || process.platform !== "win32" && (npmMetadata.mode & 73) === 0) throw new Error("invalid npm executable");
+    if (!npmMetadata.isFile() || (npmMetadata.mode & 73) === 0) {
+      throw new Error("invalid npm executable");
+    }
     const supplied = npmExecPathValues(environment);
     if (supplied.length > 1) throw new Error("ambiguous npm_execpath");
     if (supplied.length === 1) {
@@ -502,19 +471,10 @@ async function trustedNpm(execPath, environment) {
       if (typeof suppliedPath !== "string" || !path.isAbsolute(suppliedPath)) {
         throw new Error("invalid npm_execpath");
       }
-      if (!samePath(await realpath(suppliedPath), realNpmCliPath)) {
+      if (await realpath(suppliedPath) !== realNpmCliPath) {
         throw new Error("conflicting npm_execpath");
       }
     }
-    if (process.platform === "win32") {
-      const windows = await trustedWindowsShell(environment);
-      return {
-        nodePath: realNodePath,
-        npmCliPath: realNpmCliPath,
-        scriptShell: windows.scriptShell,
-        windowsSystemRoot: windows.systemRoot
-      };
-    }
     return { nodePath: realNodePath, npmCliPath: realNpmCliPath, scriptShell: "/bin/sh" };
   } catch {
     throw adapterError("runtime_acquisition_failed");
@@ -532,24 +492,9 @@ var FORBIDDEN_NPM_ENVIRONMENT = /* @__PURE__ */ new Set([
   "npm_config_script_shell"
 ]);
 function sanitizedNpmEnvironment(environment, trusted) {
-  const windowsControlled = /* @__PURE__ */ new Set(["comspec", "pathext", "systemroot", "windir"]);
   const sanitized = Object.fromEntries(Object.entries(environment).filter(
-    ([key, value]) => typeof value === "string" && key.toLowerCase() !== "path" && !(process.platform === "win32" && windowsControlled.has(key.toLowerCase())) && !FORBIDDEN_NPM_ENVIRONMENT.has(key.toLowerCase().replaceAll("-", "_"))
+    ([key, value]) => typeof value === "string" && key.toLowerCase() !== "path" && !FORBIDDEN_NPM_ENVIRONMENT.has(key.toLowerCase().replaceAll("-", "_"))
   ));
-  if (process.platform === "win32" && trusted.windowsSystemRoot !== void 0) {
-    return {
-      ...sanitized,
-      PATH: [
-        path.dirname(trusted.nodePath),
-        path.dirname(trusted.scriptShell),
-        trusted.windowsSystemRoot
-      ].join(path.delimiter),
-      ComSpec: trusted.scriptShell,
-      SystemRoot: trusted.windowsSystemRoot,
-      WINDIR: trusted.windowsSystemRoot,
-      PATHEXT: ".COM;.EXE;.BAT;.CMD"
-    };
-  }
   return {
     ...sanitized,
     PATH: [path.dirname(trusted.nodePath), "/usr/bin", "/bin"].join(path.delimiter)
@@ -576,12 +521,7 @@ function decodeAcquiredLauncherOutput(stdout) {
 function terminateAcquisitionProcessTree(child, signal) {
   try {
     if (child.pid === void 0) throw new Error("missing process id");
-    if (process.platform === "win32") {
-      process.kill(child.pid, "SIGBREAK");
-      if (signal === "SIGKILL") child.kill("SIGKILL");
-    } else {
-      process.kill(-child.pid, signal);
-    }
+    process.kill(-child.pid, signal);
   } catch {
     try {
       child.kill(signal);
@@ -591,7 +531,6 @@ function terminateAcquisitionProcessTree(child, signal) {
 }
 async function runAcquisition(trusted, environment, cwd, signal) {
   const { nodePath, npmCliPath, scriptShell } = trusted;
-  const locatorNode = process.platform === "win32" ? path.basename(nodePath) : nodePath;
   if (signal?.aborted) throw adapterError("cancelled");
   const arguments_ = [
     npmCliPath,
@@ -604,7 +543,7 @@ async function runAcquisition(trusted, environment, cwd, signal) {
     `--registry=${CANONICAL_NPM_REGISTRY}`,
     `--package=${CAREER_PACKAGE_SPEC}`,
     "--",
-    locatorNode,
+    nodePath,
     "-p",
     LOCATE_ACQUIRED_PATH_EXPRESSION
   ];
@@ -616,8 +555,7 @@ async function runAcquisition(trusted, environment, cwd, signal) {
         detached: true,
         env: sanitizedNpmEnvironment(environment, trusted),
         shell: false,
-        stdio: ["ignore", "pipe", "pipe"],
-        windowsHide: true
+        stdio: ["ignore", "pipe", "pipe"]
       });
     } catch {
       resolve({ code: null, signal: null, spawnError: true, stdout: [], stderrBytes: 0 });
@@ -753,6 +691,7 @@ async function resolveUncached(options) {
   throw adapterError("runtime_unavailable");
 }
 async function resolveCareerRuntime(options) {
+  assertSupportedPlatform();
   const environment = options.environment ?? process.env;
   const environmentKey = runtimeEnvironmentKey(environment);
   const useCache = options.afterSource === void 0 && options.dependencies === void 0;
@@ -1013,8 +952,7 @@ function executePrepared(prepared, runtime, signal, limits) {
     try {
       child = spawn2(runtime.command, [...runtime.argumentPrefix, ...prepared.args], {
         shell: false,
-        stdio: ["pipe", "pipe", "pipe"],
-        windowsHide: true
+        stdio: ["pipe", "pipe", "pipe"]
       });
     } catch {
       reject(new ProcessAttemptError(adapterError("executable_unavailable"), false));
@@ -1139,6 +1077,7 @@ async function executeResolved(prepared, runtime, signal, limits) {
   }
 }
 async function invokeCareerCli(invocation, signal, options = {}) {
+  assertSupportedPlatform();
   const prepared = prepareInvocation(invocation);
   if (signal?.aborted) throw adapterError("cancelled");
   const limits = executionLimits(options);
@@ -1163,7 +1102,7 @@ async function invokeCareerCli(invocation, signal, options = {}) {
 // src/managed/tool.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
-import { Text } from "@earendil-works/pi-tui";
+import { Text as Text2 } from "@earendil-works/pi-tui";
 
 // src/workflow/config.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -1250,7 +1189,7 @@ function validLabel(value) {
 }
 function normalizeGeneratedVariantsRoot(value) {
   if (typeof value !== "string" || value.length === 0 || Buffer.byteLength(value, "utf8") > PATH_MAX_BYTES2 || !path2.isAbsolute(value) || /[\u0000-\u001f\u007f]/.test(value)) return void 0;
-  const normalized = path2.normalize(value);
+  const normalized = path2.resolve(value);
   return path2.dirname(normalized) === normalized ? void 0 : normalized;
 }
 function parseRoot(value) {
@@ -1415,7 +1354,7 @@ function serializeCoreInput(value) {
 }
 
 // src/workflow/scan.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { lstat as lstat3, opendir, readFile as readFile3, realpath as realpath3 } from "node:fs/promises";
 import path3 from "node:path";
 import { TextDecoder as TextDecoder4 } from "node:util";
@@ -1489,20 +1428,245 @@ function isWithinCoreCharacterLimit(value) {
   return true;
 }
 
+// src/workflow/variant-metadata.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// src/workflow/strict-json.ts
+var MAX_DEPTH = 32;
+var NUMBER_PATTERN = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/;
+function invalidJson() {
+  throw new SyntaxError("invalid strict JSON");
+}
+function parseStrictJson(text) {
+  let offset = 0;
+  function skipWhitespace() {
+    while (offset < text.length && /[\u0009\u000a\u000d\u0020]/.test(text[offset])) offset += 1;
+  }
+  function skipEscape() {
+    offset += 1;
+    const escaped = text[offset];
+    if (escaped === "u") {
+      if (!/^[0-9a-fA-F]{4}$/.test(text.slice(offset + 1, offset + 5))) invalidJson();
+      offset += 5;
+      return;
+    }
+    if (escaped === void 0 || !['"', "\\", "/", "b", "f", "n", "r", "t"].includes(escaped)) {
+      invalidJson();
+    }
+    offset += 1;
+  }
+  function parseString() {
+    if (text[offset] !== '"') invalidJson();
+    const start = offset;
+    offset += 1;
+    while (offset < text.length) {
+      const character = text[offset];
+      if (character === '"') {
+        offset += 1;
+        try {
+          return JSON.parse(text.slice(start, offset));
+        } catch {
+          invalidJson();
+        }
+      }
+      if (text.charCodeAt(offset) <= 31) invalidJson();
+      if (character === "\\") skipEscape();
+      else offset += 1;
+    }
+    invalidJson();
+  }
+  function parseObject2(depth) {
+    offset += 1;
+    skipWhitespace();
+    const keys = /* @__PURE__ */ new Set();
+    if (text[offset] === "}") {
+      offset += 1;
+      return;
+    }
+    while (offset < text.length) {
+      const key = parseString();
+      if (keys.has(key)) invalidJson();
+      keys.add(key);
+      skipWhitespace();
+      if (text[offset] !== ":") invalidJson();
+      offset += 1;
+      parseValue(depth + 1);
+      skipWhitespace();
+      if (text[offset] === "}") {
+        offset += 1;
+        return;
+      }
+      if (text[offset] !== ",") invalidJson();
+      offset += 1;
+      skipWhitespace();
+    }
+    invalidJson();
+  }
+  function parseArray(depth) {
+    offset += 1;
+    skipWhitespace();
+    if (text[offset] === "]") {
+      offset += 1;
+      return;
+    }
+    while (offset < text.length) {
+      parseValue(depth + 1);
+      skipWhitespace();
+      if (text[offset] === "]") {
+        offset += 1;
+        return;
+      }
+      if (text[offset] !== ",") invalidJson();
+      offset += 1;
+      skipWhitespace();
+    }
+    invalidJson();
+  }
+  function parseValue(depth) {
+    if (depth > MAX_DEPTH) invalidJson();
+    skipWhitespace();
+    const character = text[offset];
+    if (character === "{") return parseObject2(depth);
+    if (character === "[") return parseArray(depth);
+    if (character === '"') {
+      parseString();
+      return;
+    }
+    for (const literal of ["true", "false", "null"]) {
+      if (text.startsWith(literal, offset)) {
+        offset += literal.length;
+        return;
+      }
+    }
+    const number = text.slice(offset).match(NUMBER_PATTERN)?.[0];
+    if (number !== void 0) {
+      offset += number.length;
+      return;
+    }
+    invalidJson();
+  }
+  if (text.length === 0) invalidJson();
+  parseValue(0);
+  skipWhitespace();
+  if (offset !== text.length) invalidJson();
+  try {
+    return JSON.parse(text);
+  } catch {
+    invalidJson();
+  }
+}
+
+// src/workflow/variant-metadata.ts
+var ASSISTED_SIDECAR_MAX_BYTES = 16384;
+var MANAGED_VARIANTS_MARKER_NAME = ".pi-career-variants.json";
+var MANAGED_VARIANTS_MARKER_SCHEMA = "pi.career.variants_directory.v1";
+var ASSISTED_VARIANT_SCHEMA_V1 = "pi.career.assisted_variant_meta.v1";
+var ASSISTED_VARIANT_SCHEMA_V2 = "pi.career.assisted_variant_meta.v2";
+var SHA2562 = /^[a-f0-9]{64}$/;
+var CANONICAL_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var LEGACY_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys4(value, expected) {
+  return Object.keys(value).sort().join("\0") === [...expected].sort().join("\0");
+}
+function validSha256(value) {
+  return typeof value === "string" && SHA2562.test(value);
+}
+function validCanonicalTimestamp(value) {
+  return typeof value === "string" && CANONICAL_TIMESTAMP.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+}
+function sha256Bytes(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function encodeCanonical(value) {
+  return Buffer.from(`${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function encodeManagedVariantsMarker(libraryRootId, createdAt) {
+  if (!validSha256(libraryRootId) || !validCanonicalTimestamp(createdAt)) {
+    throw new TypeError("invalid managed variants marker");
+  }
+  return encodeCanonical({
+    schema_version: MANAGED_VARIANTS_MARKER_SCHEMA,
+    kind: "managed_variants_directory",
+    library_root_id: libraryRootId,
+    created_at: createdAt
+  });
+}
+function parseManagedVariantsMarker(text, expectedLibraryRootId) {
+  try {
+    const value = parseStrictJson(text);
+    if (!isRecord3(value) || !exactKeys4(value, [
+      "schema_version",
+      "kind",
+      "library_root_id",
+      "created_at"
+    ])) return void 0;
+    if (value.schema_version !== MANAGED_VARIANTS_MARKER_SCHEMA || value.kind !== "managed_variants_directory" || value.library_root_id !== expectedLibraryRootId || !validSha256(value.library_root_id) || !validCanonicalTimestamp(value.created_at)) return void 0;
+    return value;
+  } catch {
+    return void 0;
+  }
+}
+function encodeAssistedVariantMetadataV2(metadata) {
+  if (!validSha256(metadata.base_document_id) || !validSha256(metadata.base_text_sha256) || !validSha256(metadata.artifact_sha256) || !validCanonicalTimestamp(metadata.created_at)) throw new TypeError("invalid assisted variant metadata");
+  return encodeCanonical({
+    schema_version: ASSISTED_VARIANT_SCHEMA_V2,
+    kind: "assisted_variant",
+    authority: "assisted_non_authoritative",
+    base_document_id: metadata.base_document_id,
+    base_text_sha256: metadata.base_text_sha256,
+    artifact_sha256: metadata.artifact_sha256,
+    created_at: metadata.created_at
+  });
+}
+function parseLegacyMetadata(value) {
+  if (!exactKeys4(value, ["schema_version", "kind", "base_document_id", "created_at"])) {
+    return void 0;
+  }
+  if (value.kind !== "assisted_variant" || !validSha256(value.base_document_id) || typeof value.created_at !== "string" || !LEGACY_TIMESTAMP.test(value.created_at) || !Number.isFinite(Date.parse(value.created_at))) return void 0;
+  return { schemaVersion: ASSISTED_VARIANT_SCHEMA_V1, baseDocumentId: value.base_document_id };
+}
+function parseHashBoundMetadata(value, artifactBytes) {
+  if (!exactKeys4(value, [
+    "schema_version",
+    "kind",
+    "authority",
+    "base_document_id",
+    "base_text_sha256",
+    "artifact_sha256",
+    "created_at"
+  ])) return void 0;
+  if (value.kind !== "assisted_variant" || value.authority !== "assisted_non_authoritative" || !validSha256(value.base_document_id) || !validSha256(value.base_text_sha256) || !validSha256(value.artifact_sha256) || value.artifact_sha256 !== sha256Bytes(artifactBytes) || !validCanonicalTimestamp(value.created_at)) return void 0;
+  return { schemaVersion: ASSISTED_VARIANT_SCHEMA_V2, baseDocumentId: value.base_document_id };
+}
+function parseAssistedVariantMetadata(text, artifactBytes) {
+  try {
+    const value = parseStrictJson(text);
+    if (!isRecord3(value)) return void 0;
+    if (value.schema_version === ASSISTED_VARIANT_SCHEMA_V1) return parseLegacyMetadata(value);
+    if (value.schema_version === ASSISTED_VARIANT_SCHEMA_V2) {
+      return parseHashBoundMetadata(value, artifactBytes);
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/workflow/scan.ts
 var SCAN_MAX_DEPTH = 8;
 var SCAN_MAX_FILES_PER_ROOT = 500;
 var SCAN_MAX_FILES_TOTAL = 2e3;
 var SCAN_MAX_RAW_BYTES = 256 * 1024;
-var SIDECAR_MAX_BYTES = 16384;
 var MAX_DIRECTORY_ENTRIES_PER_ROOT = 1e4;
-var SHA2562 = /^[a-f0-9]{64}$/;
-var ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
 function compareText(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function sha256(value) {
-  return createHash2("sha256").update(value).digest("hex");
+  return createHash3("sha256").update(value).digest("hex");
 }
 function normalizeDocumentText(value) {
   return value.replace(/\r\n?/g, "\n");
@@ -1535,34 +1699,58 @@ function resumeLabel(file, format, text) {
 function sidecarPath(file) {
   return path3.join(path3.dirname(file), `${path3.basename(file, path3.extname(file))}.pi-career.json`);
 }
-function validSidecar(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  const record = value;
-  const keys = "base_document_id,created_at,kind,schema_version";
-  if (Object.keys(record).sort().join(",") !== keys) return false;
-  if (record.schema_version !== "pi.career.assisted_variant_meta.v1" || record.kind !== "assisted_variant") {
-    return false;
-  }
-  if (typeof record.base_document_id !== "string" || !SHA2562.test(record.base_document_id)) return false;
-  return typeof record.created_at === "string" && ISO_UTC.test(record.created_at) && Number.isFinite(Date.parse(record.created_at));
+function privateMode(metadata, expected) {
+  const userId = process.geteuid?.() ?? process.getuid?.();
+  return userId !== void 0 && metadata.uid === userId && (metadata.mode & 511) === expected;
 }
-async function readSidecar(file) {
+async function readSidecar(file, artifactBytes, required) {
   const sidecar = sidecarPath(file);
   try {
     const metadata = await lstat3(sidecar);
-    const invalidMetadata = !metadata.isFile() || metadata.isSymbolicLink() || metadata.size <= 0 || metadata.size > SIDECAR_MAX_BYTES;
-    if (invalidMetadata) return { kind: "original", invalid: true };
+    const invalidMetadata = !metadata.isFile() || metadata.isSymbolicLink() || metadata.size <= 0 || metadata.size > ASSISTED_SIDECAR_MAX_BYTES;
+    if (invalidMetadata) return { kind: "quarantined" };
     const bytes = await readFile3(sidecar);
-    if (bytes.length !== metadata.size) return { kind: "original", invalid: true };
+    if (bytes.length !== metadata.size) return { kind: "quarantined" };
     const text = new TextDecoder4("utf-8", { fatal: true }).decode(bytes);
-    const parsed = JSON.parse(text);
-    if (!validSidecar(parsed)) return { kind: "original", invalid: true };
-    return { kind: "assisted_variant", variantGroupId: parsed.base_document_id, invalid: false };
+    const parsed = parseAssistedVariantMetadata(text, artifactBytes);
+    if (parsed === void 0 || parsed.schemaVersion === "pi.career.assisted_variant_meta.v2" && !privateMode(metadata, 384)) {
+      return { kind: "quarantined" };
+    }
+    return { kind: "assisted_variant", variantGroupId: parsed.baseDocumentId };
   } catch (error) {
-    if (error?.code === "ENOENT") return { kind: "original", invalid: false };
-    return { kind: "original", invalid: true };
+    if (error?.code === "ENOENT") {
+      return { kind: required ? "quarantined" : "original" };
+    }
+    return { kind: "quarantined" };
+  }
+}
+function managedVariantsPath(config, root) {
+  const configured = config.generated_variants_root === void 0 ? void 0 : path3.resolve(config.generated_variants_root);
+  return configured !== void 0 && path3.dirname(configured) === root.path ? configured : path3.join(root.path, "variants");
+}
+async function managedVariantsDirectory(config, root) {
+  const directoryPath = managedVariantsPath(config, root);
+  try {
+    const directory = await lstat3(directoryPath);
+    const canonical = await realpath3(directoryPath);
+    if (!directory.isDirectory() || directory.isSymbolicLink() || canonical !== directoryPath || !privateMode(directory, 448)) return { path: directoryPath, markerValid: false };
+    const markerPath = path3.join(directoryPath, MANAGED_VARIANTS_MARKER_NAME);
+    const marker = await lstat3(markerPath);
+    if (!marker.isFile() || marker.isSymbolicLink() || marker.size <= 0 || marker.size > ASSISTED_SIDECAR_MAX_BYTES || !privateMode(marker, 384)) return { path: directoryPath, markerValid: false };
+    const bytes = await readFile3(markerPath);
+    if (bytes.length !== marker.size) return { path: directoryPath, markerValid: false };
+    const text = new TextDecoder4("utf-8", { fatal: true }).decode(bytes);
+    return {
+      path: directoryPath,
+      markerValid: parseManagedVariantsMarker(text, root.id) !== void 0
+    };
+  } catch {
+    return { path: directoryPath, markerValid: false };
   }
 }
+function containingManagedVariants(file, managedDirectories) {
+  return managedDirectories.filter((managed) => file.startsWith(`${managed.path}${path3.sep}`));
+}
 async function scanRootIsCurrent(root) {
   try {
     const metadata = await lstat3(root.path);
@@ -1645,7 +1833,7 @@ async function collectCandidates(root, maximum, warnings2) {
   });
   return { candidates, capped, stale: false };
 }
-async function scanCandidate(root, candidate, warnings2) {
+async function scanCandidate(root, candidate, managedDirectories, warnings2) {
   let metadata;
   let canonical;
   try {
@@ -1690,9 +1878,15 @@ async function scanCandidate(root, candidate, warnings2) {
   }
   const text = normalizeDocumentText(decoded);
   const id = sha256(canonical);
-  const sidecar = await readSidecar(canonical);
-  if (sidecar.invalid) {
+  const containingManaged = containingManagedVariants(canonical, managedDirectories);
+  if (containingManaged.some((managed) => !managed.markerValid)) {
+    warnings2.push({ code: "invalid_assisted_sidecar", root_id: root.id, relative_path: candidate.relative });
+    return void 0;
+  }
+  const sidecar = await readSidecar(canonical, bytes, containingManaged.length > 0);
+  if (sidecar.kind === "quarantined") {
     warnings2.push({ code: "invalid_assisted_sidecar", root_id: root.id, relative_path: candidate.relative });
+    return void 0;
   }
   return {
     id,
@@ -1714,6 +1908,9 @@ async function scanLibrary(config) {
   const warnings2 = [];
   const records = [];
   const roots = [];
+  const managedDirectories = await Promise.all(
+    config.library_roots.map((root) => managedVariantsDirectory(config, root))
+  );
   let totalCapped = false;
   let scannedCandidateCount = 0;
   for (const root of config.library_roots) {
@@ -1736,7 +1933,7 @@ async function scanLibrary(config) {
     scannedCandidateCount += collected.candidates.length;
     const rootRecords = [];
     for (const candidate of collected.candidates) {
-      const record = await scanCandidate(root, candidate, warnings2);
+      const record = await scanCandidate(root, candidate, managedDirectories, warnings2);
       if (record !== void 0) rootRecords.push(record);
     }
     records.push(...rootRecords);
@@ -1762,7 +1959,7 @@ function eligibleOriginals(scan) {
 }
 
 // src/workflow/result-projection.ts
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function numberField(value, field) {
@@ -1772,7 +1969,7 @@ function numberField(value, field) {
 }
 function recordField(value, field) {
   const found = value[field];
-  if (!isRecord3(found)) throw workflowError("core_result_invalid");
+  if (!isRecord4(found)) throw workflowError("core_result_invalid");
   return found;
 }
 function arrayField(value, field) {
@@ -1782,7 +1979,7 @@ function arrayField(value, field) {
 }
 function compactObjects(value, fields, maximum) {
   return value.slice(0, maximum).flatMap((candidate) => {
-    if (!isRecord3(candidate)) return [];
+    if (!isRecord4(candidate)) return [];
     const selected = {};
     for (const field of fields) {
       if (candidate[field] !== void 0) selected[field] = candidate[field];
@@ -1794,7 +1991,7 @@ function compactWarnings(value) {
   return compactObjects(value, ["code", "message", "related_fields", "related_categories"], 3);
 }
 function parseConfidencePreview(value) {
-  if (!isRecord3(value) || typeof value.label !== "string" || typeof value.score !== "number") {
+  if (!isRecord4(value) || typeof value.label !== "string" || typeof value.score !== "number") {
     throw workflowError("core_result_invalid");
   }
   return { label: value.label, score: value.score };
@@ -1802,7 +1999,7 @@ function parseConfidencePreview(value) {
 function parseCoreJson(json) {
   try {
     const value = JSON.parse(json);
-    if (!isRecord3(value)) throw workflowError("core_result_invalid");
+    if (!isRecord4(value)) throw workflowError("core_result_invalid");
     return value;
   } catch (error) {
     if (error instanceof Error && error.name === "CareerWorkflowError") throw error;
@@ -1814,7 +2011,7 @@ function projectResumeAnalysis(result) {
   const checks = arrayField(result, "checks");
   const confidence = recordField(result, "confidence_context");
   const parseConfidence = parseConfidencePreview(confidence.parse_confidence);
-  const adjusted = checks.some((check) => isRecord3(check) && check.score_adjusted === true);
+  const adjusted = checks.some((check) => isRecord4(check) && check.score_adjusted === true);
   return {
     schema_version: RESULT_PROJECTION_SCHEMA,
     core_schema_version: "career.resume_analysis.v1",
@@ -1841,7 +2038,7 @@ function projectJobMatch(result) {
   const recommendation = recordField(result, "recommendation");
   if (typeof recommendation.label !== "string") throw workflowError("core_result_invalid");
   const provisional = confidence.is_uncertain === true;
-  const adjusted = categories.some((category) => isRecord3(category) && category.score_adjusted === true);
+  const adjusted = categories.some((category) => isRecord4(category) && category.score_adjusted === true);
   return {
     schema_version: RESULT_PROJECTION_SCHEMA,
     core_schema_version: "career.job_match.v1",
@@ -1932,12 +2129,12 @@ function rankMatches(values) {
 // src/workflow/session-state.ts
 var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var SHA2563 = /^[a-f0-9]{64}$/;
-var ISO_UTC2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var CARD_MAX_BYTES = 16384;
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function exactKeys4(value, required, optional = []) {
+function exactKeys5(value, required, optional = []) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => allowed.has(key));
 }
@@ -1948,10 +2145,10 @@ function boundedLabel(value) {
   return typeof value === "string" && value.length > 0 && [...value].length <= 120 && !/[\u0000-\u001f\u007f]/.test(value);
 }
 function validBase(value) {
-  return value.schema_version === WORKFLOW_STATE_SCHEMA && typeof value.state_id === "string" && UUID2.test(value.state_id) && typeof value.created_at === "string" && ISO_UTC2.test(value.created_at) && Number.isFinite(Date.parse(value.created_at));
+  return value.schema_version === WORKFLOW_STATE_SCHEMA && typeof value.state_id === "string" && UUID2.test(value.state_id) && typeof value.created_at === "string" && ISO_UTC.test(value.created_at) && Number.isFinite(Date.parse(value.created_at));
 }
 function validFlags(value) {
-  if (!isRecord4(value) || !exactKeys4(value, ["adjusted", "provisional", "close_cluster", "stale"])) {
+  if (!isRecord5(value) || !exactKeys5(value, ["adjusted", "provisional", "close_cluster", "stale"])) {
     return false;
   }
   return [value.adjusted, value.provisional, value.close_cluster, value.stale].every(
@@ -1959,10 +2156,10 @@ function validFlags(value) {
   );
 }
 function validProjection(value) {
-  if (!isRecord4(value) || !exactKeys4(value, ["schema_version", "core_schema_version", "summary", "ui_flags"])) {
+  if (!isRecord5(value) || !exactKeys5(value, ["schema_version", "core_schema_version", "summary", "ui_flags"])) {
     return false;
   }
-  if (value.schema_version !== RESULT_PROJECTION_SCHEMA || value.core_schema_version !== "career.resume_analysis.v1" && value.core_schema_version !== "career.job_match.v1" || !isRecord4(value.summary) || !validFlags(value.ui_flags)) return false;
+  if (value.schema_version !== RESULT_PROJECTION_SCHEMA || value.core_schema_version !== "career.resume_analysis.v1" && value.core_schema_version !== "career.job_match.v1" || !isRecord5(value.summary) || !validFlags(value.ui_flags)) return false;
   return Buffer.byteLength(JSON.stringify(value), "utf8") <= CARD_MAX_BYTES;
 }
 function isUuid(value) {
@@ -1973,7 +2170,7 @@ function isSha256(value) {
 }
 var APPLICATION_STATUSES = /* @__PURE__ */ new Set(["preparing", "applied", "interviewing", "closed"]);
 function parseApplication(value) {
-  if (!exactKeys4(value, [
+  if (!exactKeys5(value, [
     "schema_version",
     "kind",
     "state_id",
@@ -1988,10 +2185,10 @@ function parseApplication(value) {
 }
 function parseApplicationClear(value) {
   const keys = ["schema_version", "kind", "state_id", "created_at", "clears_state_id"];
-  return exactKeys4(value, keys) && isUuid(value.clears_state_id) ? value : void 0;
+  return exactKeys5(value, keys) && isUuid(value.clears_state_id) ? value : void 0;
 }
 function parseVacancy(value) {
-  if (!exactKeys4(value, [
+  if (!exactKeys5(value, [
     "schema_version",
     "kind",
     "state_id",
@@ -2011,21 +2208,21 @@ function parseVacancy(value) {
 }
 function parseVacancyClear(value) {
   const keys = ["schema_version", "kind", "state_id", "created_at", "clears_state_id"];
-  return exactKeys4(value, keys) && isUuid(value.clears_state_id) ? value : void 0;
+  return exactKeys5(value, keys) && isUuid(value.clears_state_id) ? value : void 0;
 }
 function parseConsent(value) {
   const keys = ["schema_version", "kind", "state_id", "created_at", "scope", "granted"];
-  return exactKeys4(value, keys) && value.scope === "session_persistence" && typeof value.granted === "boolean" ? value : void 0;
+  return exactKeys5(value, keys) && value.scope === "session_persistence" && typeof value.granted === "boolean" ? value : void 0;
 }
 function parseConsentClear(value) {
   const keys = ["schema_version", "kind", "state_id", "created_at", "scope", "clears_state_id"];
-  return exactKeys4(value, keys) && value.scope === "session_persistence" && isUuid(value.clears_state_id) ? value : void 0;
+  return exactKeys5(value, keys) && value.scope === "session_persistence" && isUuid(value.clears_state_id) ? value : void 0;
 }
 function validInputDigests(value) {
-  return isRecord4(value) && exactKeys4(value, ["resume_text_sha256", "vacancy_text_sha256"]) && isSha256(value.resume_text_sha256) && isSha256(value.vacancy_text_sha256);
+  return isRecord5(value) && exactKeys5(value, ["resume_text_sha256", "vacancy_text_sha256"]) && isSha256(value.resume_text_sha256) && isSha256(value.vacancy_text_sha256);
 }
 function parseResultCard(value) {
-  if (!exactKeys4(value, [
+  if (!exactKeys5(value, [
     "schema_version",
     "kind",
     "state_id",
@@ -2049,7 +2246,7 @@ function parseResultCard(value) {
   return validProjection(value.projection) ? value : void 0;
 }
 function parseWorkflowEntryData(value) {
-  if (!isRecord4(value) || !validBase(value)) return void 0;
+  if (!isRecord5(value) || !validBase(value)) return void 0;
   switch (value.kind) {
     case "application":
       return parseApplication(value);
@@ -2203,11 +2400,18 @@ var MESSAGES = {
   result_not_found: "The requested ephemeral result handle is unavailable or expired.",
   review_not_found: "The requested ephemeral review handle is unavailable or expired.",
   selection_invalid: "Selected change IDs are invalid for this reviewed proposal.",
+  pdf_materialization_unsupported: "PDF review changes are manual-application guidance and cannot be materialized from extracted text.",
   managed_contract_invalid: "The selected Career Core managed-adapter contracts are incompatible.",
   managed_result_invalid: "Career Core returned an unexpected managed-workflow result.",
   managed_result_capacity: "The complete Career Core result exceeds the bounded in-memory managed-result capacity.",
   detail_too_large: "The requested model-visible detail is too large; request a narrower section.",
-  session_changed: "The Pi session changed; run career_run context again for fresh ephemeral handles."
+  session_changed: "The Pi session changed; run career_run context again for fresh ephemeral handles.",
+  variant_save_unavailable: "The materialized variant is unavailable, stale, or ineligible for local saving.",
+  variant_save_destination_invalid: "The managed variants destination is unavailable or does not meet the private-directory contract.",
+  variant_save_preview_changed: "The exact save preview changed or was cancelled; no file was written.",
+  variant_save_collision: "A save destination already exists; no existing file was replaced.",
+  variant_save_verification_failed: "The saved variant could not be verified as an excluded assisted artifact.",
+  variant_save_status_unknown: "The save reached an indeterminate local-filesystem state; inspect the approved destination before retrying."
 };
 var CareerRunError = class extends Error {
   code;
@@ -2221,6 +2425,9 @@ var CareerRunError = class extends Error {
     this.code = code;
   }
 };
+function careerRunErrorMessage(code) {
+  return MESSAGES[code];
+}
 function careerRunError(code) {
   return new CareerRunError(code);
 }
@@ -2246,7 +2453,7 @@ var SECTIONS = /* @__PURE__ */ new Set([
   "certifications",
   "other"
 ]);
-function isRecord5(value) {
+function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function hasExactKeys(value, keys) {
@@ -2267,7 +2474,7 @@ function stringList(value, minimum, maximum, itemMaximum) {
   return new Set(strings).size === strings.length ? [...strings] : void 0;
 }
 function parseVariantChange(value) {
-  if (!isRecord5(value) || !hasExactKeys(value, [
+  if (!isRecord6(value) || !hasExactKeys(value, [
     "section",
     "start_line",
     "end_line",
@@ -2290,7 +2497,7 @@ function parseVariantChange(value) {
   };
 }
 function parseAnalysisSuggestion(value) {
-  if (!isRecord5(value) || !hasExactKeys(value, [
+  if (!isRecord6(value) || !hasExactKeys(value, [
     "basis_check_id",
     "start_line",
     "end_line",
@@ -2310,7 +2517,7 @@ function parseAnalysisSuggestion(value) {
   };
 }
 function parseAnalysisReplacement(value) {
-  if (!isRecord5(value) || !hasExactKeys(value, [
+  if (!isRecord6(value) || !hasExactKeys(value, [
     "basis_check_id",
     "start_line",
     "end_line",
@@ -2330,7 +2537,7 @@ function parseAnalysisReplacement(value) {
   };
 }
 function parseVariantChanges(payload) {
-  if (!isRecord5(payload) || !hasExactKeys(payload, ["changes"]) || !Array.isArray(payload.changes) || payload.changes.length > 50) {
+  if (!isRecord6(payload) || !hasExactKeys(payload, ["changes"]) || !Array.isArray(payload.changes) || payload.changes.length > 50) {
     throw new Error("managed_payload_invalid");
   }
   const changes = payload.changes.map(parseVariantChange);
@@ -2338,7 +2545,7 @@ function parseVariantChanges(payload) {
   return changes;
 }
 function parseAnalysisSuggestions(payload) {
-  if (!isRecord5(payload) || !hasExactKeys(payload, ["suggestions"]) || !Array.isArray(payload.suggestions) || payload.suggestions.length > 3) {
+  if (!isRecord6(payload) || !hasExactKeys(payload, ["suggestions"]) || !Array.isArray(payload.suggestions) || payload.suggestions.length > 3) {
     throw new Error("managed_payload_invalid");
   }
   const suggestions = payload.suggestions.map(parseAnalysisSuggestion);
@@ -2348,7 +2555,7 @@ function parseAnalysisSuggestions(payload) {
   return suggestions;
 }
 function parseAnalysisReplacements(payload) {
-  if (!isRecord5(payload) || !hasExactKeys(payload, ["replacements"]) || !Array.isArray(payload.replacements) || payload.replacements.length > 3) {
+  if (!isRecord6(payload) || !hasExactKeys(payload, ["replacements"]) || !Array.isArray(payload.replacements) || payload.replacements.length > 3) {
     throw new Error("managed_payload_invalid");
   }
   const replacements = payload.replacements.map(parseAnalysisReplacement);
@@ -2370,7 +2577,7 @@ function handlePrefix(kind) {
   return kind === "review" ? "review" : kind === "variant" ? "variant" : "result";
 }
 function entryBytes(entry) {
-  return Buffer.byteLength(entry.json, "utf8") + (entry.reviewInput === void 0 ? 0 : Buffer.byteLength(JSON.stringify(entry.reviewInput), "utf8"));
+  return Buffer.byteLength(entry.json, "utf8") + (entry.reviewInput === void 0 ? 0 : Buffer.byteLength(JSON.stringify(entry.reviewInput), "utf8")) + (entry.variantSource === void 0 ? 0 : Buffer.byteLength(JSON.stringify(entry.variantSource), "utf8"));
 }
 var ManagedRegistry = class {
   constructor(uuid, now) {
@@ -2489,9 +2696,38 @@ var careerRunParameters = Type.Object({
 
 // src/managed/engine.ts
 var MODEL_DETAIL_MAX_BYTES = 5e4;
-function isRecord6(value) {
+function isRecord7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function stringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function validVariantSelectionChange(value, expectedId) {
+  if (!isRecord7(value)) return false;
+  return [
+    value.change_id === expectedId,
+    typeof value.section === "string",
+    Number.isSafeInteger(value.start_line),
+    Number.isSafeInteger(value.end_line),
+    typeof value.original_text === "string",
+    typeof value.proposed_text === "string",
+    stringArray(value.resume_evidence),
+    stringArray(value.vacancy_evidence)
+  ].every(Boolean);
+}
+function variantSelectionChange(value, expectedId) {
+  if (!validVariantSelectionChange(value, expectedId)) return void 0;
+  return {
+    change_id: expectedId,
+    section: value.section,
+    start_line: value.start_line,
+    end_line: value.end_line,
+    original_text: value.original_text,
+    proposed_text: value.proposed_text,
+    resume_evidence: [...value.resume_evidence],
+    vacancy_evidence: [...value.vacancy_evidence]
+  };
+}
 function arrayField2(value, field) {
   const found = value[field];
   if (!Array.isArray(found)) throw careerRunError("managed_result_invalid");
@@ -2509,13 +2745,13 @@ function parseConsentDecision(payload) {
   return payload;
 }
 function parseMaterializeRequest(payload) {
-  if (!isRecord6(payload) || Object.keys(payload).join("") !== "selected_change_ids") {
+  if (!isRecord7(payload) || Object.keys(payload).join("") !== "selected_change_ids") {
     throw careerRunError("invalid_request");
   }
   return parseSelectedChangeIds(payload.selected_change_ids);
 }
 function parseDetailRequest(payload) {
-  if (!isRecord6(payload)) throw careerRunError("invalid_request");
+  if (!isRecord7(payload)) throw careerRunError("invalid_request");
   const keys = Object.keys(payload).sort().join("\0");
   if (keys !== "section" && keys !== "item\0section") throw careerRunError("invalid_request");
   if (!DETAIL_SECTIONS.includes(payload.section)) {
@@ -2643,7 +2879,7 @@ function compactReplacementReview(result) {
   };
 }
 function compactCanonicalChanges(changes) {
-  return changes.map((change) => isRecord6(change) ? {
+  return changes.map((change) => isRecord7(change) ? {
     change_id: change.change_id,
     section: change.section,
     start_line: change.start_line,
@@ -2678,9 +2914,9 @@ function compactVariant(result) {
   };
 }
 function evidenceDetail(value) {
-  const analysis = isRecord6(value.baseline_analysis) ? value.baseline_analysis : value;
-  const checks = isRecord6(analysis) && Array.isArray(analysis.checks) ? analysis.checks : [];
-  return checks.flatMap((check) => isRecord6(check) && Array.isArray(check.evidence) ? [{ check_id: check.check_id, evidence: check.evidence }] : []);
+  const analysis = isRecord7(value.baseline_analysis) ? value.baseline_analysis : value;
+  const checks = isRecord7(analysis) && Array.isArray(analysis.checks) ? analysis.checks : [];
+  return checks.flatMap((check) => isRecord7(check) && Array.isArray(check.evidence) ? [{ check_id: check.check_id, evidence: check.evidence }] : []);
 }
 var DETAIL_SUMMARIES = {
   "resume.analyze": compactAnalyze,
@@ -2691,8 +2927,8 @@ var DETAIL_SUMMARIES = {
   "resume.variant.materialize": compactVariant
 };
 function analysisChecks(value) {
-  const analysis = isRecord6(value.baseline_analysis) ? value.baseline_analysis : value;
-  return isRecord6(analysis) && Array.isArray(analysis.checks) ? analysis.checks : [];
+  const analysis = isRecord7(value.baseline_analysis) ? value.baseline_analysis : value;
+  return isRecord7(analysis) && Array.isArray(analysis.checks) ? analysis.checks : [];
 }
 function reviewedItems(value) {
   const items = value.changes ?? value.suggestions ?? value.replacements ?? value.selected_changes ?? [];
@@ -2700,7 +2936,7 @@ function reviewedItems(value) {
   return items;
 }
 function exactReviewedItem(items, item) {
-  const found = items.find((candidate) => isRecord6(candidate) && (candidate.change_id === item || candidate.suggestion_id === item || candidate.replacement_id === item));
+  const found = items.find((candidate) => isRecord7(candidate) && (candidate.change_id === item || candidate.suggestion_id === item || candidate.replacement_id === item));
   if (found === void 0) throw careerRunError("result_not_found");
   return found;
 }
@@ -2730,6 +2966,23 @@ function mapInternalError(error) {
   }
   throw managedFailure(error);
 }
+function selectableVariantReview(review) {
+  if (review === void 0) throw careerRunError("review_not_found");
+  if (![review.operation === "resume.variant.review", review.retainedChangeIds !== void 0].every(Boolean)) {
+    throw careerRunError("review_not_found");
+  }
+  if (review.materializationAllowed !== true) throw careerRunError("pdf_materialization_unsupported");
+  ensureSchema(review.value, "career.resume_variant_review.v1");
+  validateAuthority(review.value);
+  return review;
+}
+function selectableVariantChanges(review) {
+  const values = arrayField2(review.value, "changes");
+  if (values.length !== review.retainedChangeIds.length) throw careerRunError("managed_result_invalid");
+  const changes = values.map((value, index) => variantSelectionChange(value, review.retainedChangeIds[index]));
+  if (changes.some((change) => change === void 0)) throw careerRunError("managed_result_invalid");
+  return changes;
+}
 var CareerRunEngine = class {
   constructor(options) {
     this.options = options;
@@ -2754,6 +3007,53 @@ var CareerRunEngine = class {
   shutdown() {
     this.registry.clear();
   }
+  materializedVariantForSave(handle, ctx) {
+    try {
+      const sessionId = ctx.sessionManager.getSessionId();
+      this.registry.enterSession(sessionId);
+      requireConsent(ctx);
+      if (!this.registry.hasContext(sessionId)) throw careerRunError("context_required");
+      const entry = this.registry.get(handle, "variant");
+      if (entry === void 0 || entry.operation !== "resume.variant.materialize" || entry.variantSource === void 0) throw careerRunError("variant_save_unavailable");
+      ensureSchema(entry.value, "career.resume_variant.v1");
+      validateAuthority(entry.value);
+      const assistedText = entry.value.assisted_resume_text;
+      const selected = arrayField2(entry.value, "selected_changes");
+      if (typeof assistedText !== "string" || selected.length === 0) {
+        throw careerRunError("managed_result_invalid");
+      }
+      const selectedChangeIds = selected.map((change) => isRecord7(change) && typeof change.change_id === "string" ? change.change_id : "");
+      if (selectedChangeIds.some((id) => !/^change-[0-9]{4}$/.test(id))) {
+        throw careerRunError("managed_result_invalid");
+      }
+      return {
+        handle: entry.handle,
+        assistedText,
+        selectedChangeIds,
+        source: { ...entry.variantSource }
+      };
+    } catch (error) {
+      mapInternalError(error);
+    }
+  }
+  variantSelectionReview(handle, ctx) {
+    try {
+      const sessionId = ctx.sessionManager.getSessionId();
+      this.registry.enterSession(sessionId);
+      requireConsent(ctx);
+      if (!this.registry.hasContext(sessionId)) throw careerRunError("context_required");
+      const review = selectableVariantReview(this.registry.get(handle, "review"));
+      return {
+        handle: review.handle,
+        authority: "assisted_non_authoritative",
+        changes: selectableVariantChanges(review),
+        discarded_changes: arrayField2(review.value, "discarded_changes"),
+        warnings: warnings(review.value)
+      };
+    } catch (error) {
+      mapInternalError(error);
+    }
+  }
   async run(params, signal, ctx) {
     try {
       this.registry.enterSession(ctx.sessionManager.getSessionId());
@@ -2994,20 +3294,32 @@ var CareerRunEngine = class {
       json: invocation.json,
       value,
       reviewInput: input,
-      retainedChangeIds
+      retainedChangeIds,
+      materializationAllowed: resume.format !== "pdf",
+      variantSource: {
+        resumeId: resume.id,
+        rootId: resume.root_id,
+        format: resume.format,
+        textSha256: resume.text_sha256
+      }
     });
-    return resultEnvelope("variant-review", { review: entry.handle, ...summary }, {
+    return resultEnvelope("variant-review", {
+      review: entry.handle,
+      ...summary,
+      next_action: resume.format === "pdf" ? "Stop this turn. Present the reviewed changes as manual-application guidance only; extracted PDF text cannot be materialized as a styled resume." : `Stop this turn. In TUI, ask the user to run /career-review ${entry.handle}; otherwise show exact change details and ask for explicit canonical IDs. Only a later user turn may materialize the selected IDs.`
+    }, {
       status: "complete",
       handle: entry.handle,
-      summary: `${retainedChangeIds.length} retained change(s)`
+      action: resume.format === "pdf" ? "pdf_manual" : "review_select",
+      summary: resume.format === "pdf" ? `${retainedChangeIds.length} retained change(s) • PDF manual application only` : `${retainedChangeIds.length} retained change(s) • explicit selection required`
     });
   }
   retainedChangeIds(value) {
     const changes = arrayField2(value, "changes");
     const ids = changes.flatMap(
-      (change) => isRecord6(change) && typeof change.change_id === "string" ? [change.change_id] : []
+      (change) => isRecord7(change) && typeof change.change_id === "string" ? [change.change_id] : []
     );
-    if (ids.length !== changes.length) throw careerRunError("managed_result_invalid");
+    if (ids.length !== changes.length || new Set(ids).size !== ids.length || ids.some((id) => !/^change-[0-9]{4}$/.test(id))) throw careerRunError("managed_result_invalid");
     return ids;
   }
   async materialize(params, signal, ctx) {
@@ -3018,6 +3330,8 @@ var CareerRunEngine = class {
     if (review === void 0 || review.operation !== "resume.variant.review" || review.reviewInput === void 0 || review.retainedChangeIds === void 0) {
       throw careerRunError("review_not_found");
     }
+    if (review.materializationAllowed !== true) throw careerRunError("pdf_materialization_unsupported");
+    if (review.variantSource === void 0) throw careerRunError("managed_result_invalid");
     const selected = parseMaterializeRequest(params.payload);
     const retained = new Set(review.retainedChangeIds);
     if (selected.some((id) => !retained.has(id))) throw careerRunError("selection_invalid");
@@ -3038,11 +3352,17 @@ var CareerRunEngine = class {
       kind: "variant",
       operation: "resume.variant.materialize",
       json: invocation.json,
-      value
+      value,
+      variantSource: review.variantSource
     });
-    return resultEnvelope("materialize", { variant: entry.handle, ...summary }, {
+    return resultEnvelope("materialize", {
+      variant: entry.handle,
+      ...summary,
+      next_action: `This assisted/non-authoritative result remains in memory. To review and save it locally, the user may run /career-save ${entry.handle}; never invoke saving as a model action.`
+    }, {
       status: "complete",
       handle: entry.handle,
+      action: "save_available",
       summary: `${selected.length} selected change(s) materialized`
     });
   }
@@ -3081,93 +3401,6 @@ var CareerRunEngine = class {
   }
 };
 
-// src/managed/tool.ts
-function managedToolActive(pi, includeRaw) {
-  const current = pi.getActiveTools();
-  const retained = current.filter((name) => !RAW_TOOL_NAMES.includes(name));
-  const next = includeRaw ? [...retained, ...RAW_TOOL_NAMES] : retained;
-  if (!next.includes(MANAGED_TOOL_NAME)) next.push(MANAGED_TOOL_NAME);
-  pi.setActiveTools([...new Set(next)]);
-}
-function registerCareerRun(pi, options = {}) {
-  const engine = new CareerRunEngine({
-    pi,
-    agentDir: options.agentDir ?? getAgentDir(),
-    invoke: options.invoke ?? invokeCareerCli,
-    now: options.now ?? (() => /* @__PURE__ */ new Date()),
-    uuid: options.uuid ?? randomUUID2
-  });
-  pi.registerTool({
-    name: MANAGED_TOOL_NAME,
-    label: "Career",
-    description: "Run managed local Career Core workflows with ephemeral handles and native payload objects instead of nested JSON strings.",
-    promptGuidelines: [
-      "Start with context. If consent is required, ask first; consent payload is `approve` or `decline`. Use returned handles; match/variant-review use the current vacancy implicitly.",
-      "Proposal payloads use Core fields. Materialize payload is {selected_change_ids:[...]}; detail payload is {section,item?}. Preserve warnings/uncertainty/authority, and never select changes automatically."
-    ],
-    parameters: careerRunParameters,
-    async execute(_toolCallId, params, signal, onUpdate, ctx) {
-      onUpdate?.({
-        content: [{ type: "text", text: `Running career ${params.command}…` }],
-        details: { schema_version: "pi.career.run_details.v1", command: params.command }
-      });
-      return engine.run(params, signal, ctx);
-    },
-    renderCall(args, theme) {
-      return new Text(
-        theme.fg("toolTitle", theme.bold("career ")) + theme.fg("accent", args.command ?? "run"),
-        0,
-        0
-      );
-    },
-    renderResult(result, { expanded, isPartial }, theme) {
-      if (isPartial) return new Text(theme.fg("warning", "Running Career Core…"), 0, 0);
-      const details = result.details;
-      if (details === void 0) return new Text(theme.fg("dim", "Career result unavailable"), 0, 0);
-      const lines = [
-        theme.fg(details.status === "consent_required" ? "warning" : "success", details.summary),
-        ...expanded && details.handle !== void 0 ? [theme.fg("dim", details.handle)] : []
-      ];
-      return new Text(lines.join("\n"), 0, 0);
-    }
-  });
-  pi.registerCommand("career-tools", {
-    description: "Choose managed or advanced raw Career Core tools",
-    getArgumentCompletions: (prefix) => ["managed", "raw", "status"].filter((value) => value.startsWith(prefix)).map((value) => ({ value, label: value })),
-    handler: async (args, ctx) => {
-      const mode = args.trim();
-      if (mode === "managed") managedToolActive(pi, false);
-      else if (mode === "raw") managedToolActive(pi, true);
-      else if (mode !== "status" && mode !== "") {
-        ctx.ui.notify("Usage: /career-tools managed|raw|status", "warning");
-        return;
-      }
-      const activeRaw = RAW_TOOL_NAMES.filter((name) => pi.getActiveTools().includes(name));
-      ctx.ui.notify(
-        `Career tools: career_run active; raw Career Core tools ${activeRaw.length === 0 ? "inactive" : "active"}.`,
-        "info"
-      );
-    }
-  });
-  pi.on("session_start", (_event, ctx) => {
-    engine.enterSession(ctx.sessionManager.getSessionId());
-    managedToolActive(pi, false);
-  });
-  pi.on("session_tree", (_event, ctx) => {
-    engine.resetSession(ctx.sessionManager.getSessionId());
-  });
-  pi.on("session_shutdown", () => {
-    engine.shutdown();
-  });
-}
-
-// src/workflow/commands.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import {
-  BorderedLoader,
-  getAgentDir as getAgentDir2
-} from "@earendil-works/pi-coding-agent";
-
 // src/workflow/renderers.ts
 import os from "node:os";
 import path4 from "node:path";
@@ -3533,21 +3766,910 @@ var DetailViewer = class {
   }
 };
 
-// src/workflow/workbench.ts
-var WORKBENCH_MAX_SOURCE_CHARACTERS = 8e4;
-var WORKBENCH_MAX_PROMPT_BYTES = 262144;
-var WORKBENCH_MAX_QUESTION_CHARACTERS = 4e3;
-function characterCount(value) {
-  return [...value].length;
-}
-function formatRule(resume) {
-  if (resume.format === "pdf") {
-    return "The resume came from searchable PDF text extraction. You cannot inspect its visual layout, typography, columns, spacing, or graphics. Return targeted section-level suggestions and replacement snippets for the user to apply in the styled source; never claim that PDF styling was preserved or inspected.";
-  }
-  if (resume.format === "markdown") {
-    return "The resume includes Markdown structure. Preserve its existing heading hierarchy, list structure, ordering, and all unchanged wording in every proposed edit.";
+// src/workflow/detail-viewer.ts
+async function showDetailText(ctx, label, text) {
+  if (ctx.mode !== "tui") {
+    ctx.ui.notify(text, "info");
+    return;
   }
-  return "The resume is plain text. Preserve its existing section order, line structure, and all unchanged wording in every proposed edit.";
+  await ctx.ui.custom((tui, theme, keybindings, done) => new DetailViewer(
+    label,
+    text,
+    theme,
+    keybindings,
+    Math.max(1, Math.min(20, tui.terminal.rows - 6)),
+    () => tui.requestRender(),
+    () => done(void 0)
+  ));
+}
+
+// src/managed/review-selector.ts
+var CONTINUE = "Continue with selected changes";
+var BACK_TO_REVIEW = "Back to reviewed changes";
+var CANCEL = "Cancel";
+var REPEAT_SELECTION = { done: false };
+function lineRange(change) {
+  return change.start_line === change.end_line ? `line ${change.start_line}` : `lines ${change.start_line}-${change.end_line}`;
+}
+function exactChangeValue(change) {
+  return {
+    change_id: change.change_id,
+    section: change.section,
+    start_line: change.start_line,
+    end_line: change.end_line,
+    original_text: change.original_text,
+    proposed_text: change.proposed_text,
+    resume_evidence: change.resume_evidence,
+    vacancy_evidence: change.vacancy_evidence
+  };
+}
+function exactChangeText(change) {
+  return JSON.stringify(exactChangeValue(change), null, 2);
+}
+function selectedChangeText(change, index, total) {
+  return [
+    `Change ${index + 1} of ${total}`,
+    `ID: ${JSON.stringify(change.change_id)}`,
+    `Section: ${JSON.stringify(change.section)}`,
+    `Line bounds: ${change.start_line}-${change.end_line}`,
+    `Before: ${JSON.stringify(change.original_text)}`,
+    `After: ${JSON.stringify(change.proposed_text)}`,
+    `Resume evidence (${change.resume_evidence.length}): ${JSON.stringify(change.resume_evidence)}`,
+    `Vacancy evidence (${change.vacancy_evidence.length}): ${JSON.stringify(change.vacancy_evidence)}`
+  ].join("\n");
+}
+function selectedChangesText(review, selected) {
+  return [
+    `Authority: ${review.authority}`,
+    `Selected changes: ${selected.length}`,
+    "",
+    selected.map((change, index) => selectedChangeText(change, index, selected.length)).join("\n\n")
+  ].join("\n");
+}
+function noticeText(review) {
+  return JSON.stringify({
+    authority: review.authority,
+    warnings: review.warnings,
+    discarded_changes: review.discarded_changes
+  }, null, 2);
+}
+function changeOption(change, included) {
+  return `${change.change_id} • ${change.section} • ${lineRange(change)} • ${included ? "included" : "excluded"}`;
+}
+function noticesOption(review, reviewed) {
+  return `Warnings and discards • ${review.warnings.length} warnings • ${review.discarded_changes.length} discarded • ${reviewed ? "reviewed" : "review required"}`;
+}
+function changeOptions(review, included) {
+  return new Map(review.changes.map((change) => [
+    changeOption(change, included.has(change.change_id)),
+    change
+  ]));
+}
+function selectedAction(selected, notices, byOption) {
+  const fixed = /* @__PURE__ */ new Map([
+    [void 0, { kind: "cancel" }],
+    [CANCEL, { kind: "cancel" }],
+    [notices, { kind: "notices" }],
+    [CONTINUE, { kind: "continue" }]
+  ]);
+  const change = byOption.get(selected ?? "");
+  return fixed.get(selected) ?? (change === void 0 ? { kind: "cancel" } : { kind: "change", change });
+}
+async function nextReviewAction(ctx, review, state) {
+  const notices = noticesOption(review, state.noticesReviewed);
+  const byOption = changeOptions(review, state.included);
+  const selected = await ctx.ui.select(
+    `Career reviewed changes • assisted/non-authoritative • ${state.included.size} selected`,
+    [notices, ...byOption.keys(), CONTINUE, CANCEL]
+  );
+  return selectedAction(selected, notices, byOption);
+}
+function selectionOptions(wasIncluded) {
+  return wasIncluded ? ["Keep included", "Exclude", "Back without changing"] : ["Include", "Keep excluded", "Back without changing"];
+}
+async function exactSelection(ctx, change, included) {
+  await showDetailText(
+    ctx,
+    `${change.change_id} • ${change.section} • ${lineRange(change)}`,
+    exactChangeText(change)
+  );
+  const decision = await ctx.ui.select(
+    `Explicit selection • ${change.change_id}`,
+    selectionOptions(included.has(change.change_id))
+  );
+  const decisions = /* @__PURE__ */ new Map([
+    ["Include", () => included.add(change.change_id)],
+    ["Keep included", () => included.add(change.change_id)],
+    ["Exclude", () => included.delete(change.change_id)],
+    ["Keep excluded", () => included.delete(change.change_id)]
+  ]);
+  decisions.get(decision)?.();
+}
+function completeSelection(ctx, review, state) {
+  if (!state.noticesReviewed) {
+    ctx.ui.notify("Review all Career Core warnings and discarded-change reasons before continuing.", "warning");
+    return void 0;
+  }
+  if (state.included.size === 0) {
+    ctx.ui.notify("Include at least one exact canonical change before continuing.", "warning");
+    return void 0;
+  }
+  return review.changes.filter((change) => state.included.has(change.change_id));
+}
+function prepareOption(count) {
+  return `Prepare ${count} selected change ID${count === 1 ? "" : "s"}`;
+}
+function finalChangeOption(change, index, total) {
+  return `Review selected ${index + 1}/${total} • ${change.change_id} • ${change.section} • ${lineRange(change)}`;
+}
+function confirmationOutcome(decision, prepare, selected) {
+  const outcomes = /* @__PURE__ */ new Map([
+    [void 0, { done: true }],
+    [CANCEL, { done: true }],
+    [BACK_TO_REVIEW, REPEAT_SELECTION],
+    [prepare, { done: true, selection: selected.map((change) => change.change_id) }]
+  ]);
+  return outcomes.get(decision) ?? { done: true };
+}
+async function confirmSelection(ctx, selected) {
+  const prepare = prepareOption(selected.length);
+  const byOption = new Map(selected.map((change, index) => [
+    finalChangeOption(change, index, selected.length),
+    { change, index }
+  ]));
+  while (true) {
+    const decision = await ctx.ui.select(
+      "Final selection • inspect, prepare, or go back • nothing runs automatically",
+      [...byOption.keys(), prepare, BACK_TO_REVIEW, CANCEL]
+    );
+    const target = byOption.get(decision ?? "");
+    if (target === void 0) return confirmationOutcome(decision, prepare, selected);
+    await showDetailText(
+      ctx,
+      `Selected ${target.index + 1}/${selected.length} • ${target.change.change_id}`,
+      selectedChangeText(target.change, target.index, selected.length)
+    );
+  }
+}
+async function continueSelection(ctx, review, state) {
+  const selected = completeSelection(ctx, review, state);
+  if (selected === void 0) return REPEAT_SELECTION;
+  await showDetailText(
+    ctx,
+    `${selected.length} selected change${selected.length === 1 ? "" : "s"} • final review`,
+    selectedChangesText(review, selected)
+  );
+  return await confirmSelection(ctx, selected);
+}
+async function reviewNotices(ctx, review, state) {
+  await showDetailText(ctx, "Warnings and discarded changes", noticeText(review));
+  state.noticesReviewed = true;
+  return REPEAT_SELECTION;
+}
+async function reviewChange(ctx, state, change) {
+  await exactSelection(ctx, change, state.included);
+  return REPEAT_SELECTION;
+}
+async function applyAction(ctx, review, state, action) {
+  const handlers = {
+    cancel: async () => ({ done: true }),
+    notices: async () => await reviewNotices(ctx, review, state),
+    continue: async () => await continueSelection(ctx, review, state),
+    change: async () => await reviewChange(
+      ctx,
+      state,
+      action.change
+    )
+  };
+  return await handlers[action.kind]();
+}
+function noticesRequired(review) {
+  return [review.warnings.length > 0, review.discarded_changes.length > 0].some(Boolean);
+}
+function selectableReview(ctx, review) {
+  return [ctx.mode === "tui", review.changes.length > 0].every(Boolean);
+}
+async function selectVariantChanges(ctx, review) {
+  if (!selectableReview(ctx, review)) return void 0;
+  const state = {
+    included: /* @__PURE__ */ new Set(),
+    noticesReviewed: !noticesRequired(review)
+  };
+  while (true) {
+    const action = await nextReviewAction(ctx, review, state);
+    const outcome = await applyAction(ctx, review, state, action);
+    if (outcome.done) return outcome.selection;
+  }
+}
+function materializeEditorText(reviewHandle, selectedChangeIds) {
+  const request = {
+    command: "materialize",
+    handle: reviewHandle,
+    payload: { selected_change_ids: selectedChangeIds }
+  };
+  return [
+    "I explicitly reviewed and selected these canonical Career Core changes in /career-review.",
+    "",
+    `Call career_run with exactly this request: ${JSON.stringify(request)}`,
+    "",
+    "Use exactly these selected IDs and the unchanged review handle. Keep the result assisted/non-authoritative. Do not analyze or match it as an original, and do not save or write any file."
+  ].join("\n");
+}
+
+// src/workflow/variant-save.ts
+import { createHash as createHash4 } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import {
+  chmod as chmod2,
+  link,
+  lstat as lstat4,
+  mkdir as mkdir2,
+  open as open2,
+  readFile as readFile4,
+  readdir,
+  realpath as realpath4,
+  unlink
+} from "node:fs/promises";
+import path5 from "node:path";
+import { TextDecoder as TextDecoder5 } from "node:util";
+import {
+  withFileMutationQueue
+} from "@earendil-works/pi-coding-agent";
+var ARTIFACT_MAX_BYTES = 262144;
+var PREVIEW_MAX_BYTES = 524288;
+var PATH_MAX_BYTES3 = 4096;
+var CONFIRM_TIMEOUT_MS = 10 * 60 * 1e3;
+var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var VARIANT_HANDLE = /^variant:[a-f0-9-]{8,64}$/;
+var SHA2564 = /^[a-f0-9]{64}$/;
+var CHANGE_ID = /^change-[0-9]{4}$/;
+var DEFAULT_FS = {
+  chmod: chmod2,
+  link,
+  lstat: lstat4,
+  mkdir: mkdir2,
+  open: open2,
+  readFile: readFile4,
+  readdir,
+  realpath: realpath4,
+  unlink
+};
+function isNodeError(error, code) {
+  return error !== null && typeof error === "object" && error.code === code;
+}
+function hash(value) {
+  return createHash4("sha256").update(value).digest("hex");
+}
+function hasUnpairedSurrogate(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) return true;
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      return true;
+    }
+  }
+  return false;
+}
+function sameCandidate(left, right) {
+  return left.handle === right.handle && left.assistedText === right.assistedText && left.selectedChangeIds.join("\0") === right.selectedChangeIds.join("\0") && left.source.resumeId === right.source.resumeId && left.source.rootId === right.source.rootId && left.source.format === right.source.format && left.source.textSha256 === right.source.textSha256;
+}
+function validCandidateIdentity(candidate) {
+  return VARIANT_HANDLE.test(candidate.handle) && SHA2564.test(candidate.source.resumeId) && SHA2564.test(candidate.source.rootId) && SHA2564.test(candidate.source.textSha256) && (candidate.source.format === "markdown" || candidate.source.format === "text");
+}
+function validSelectedChanges(selectedChangeIds) {
+  return selectedChangeIds.length > 0 && new Set(selectedChangeIds).size === selectedChangeIds.length && selectedChangeIds.every((id) => CHANGE_ID.test(id));
+}
+function validateCandidate(candidate) {
+  if (!validCandidateIdentity(candidate) || !validSelectedChanges(candidate.selectedChangeIds) || candidate.assistedText.length === 0 || candidate.assistedText.includes("\r") || hasUnpairedSurrogate(candidate.assistedText)) {
+    throw careerRunError("variant_save_unavailable");
+  }
+  const bytes = Buffer.from(candidate.assistedText, "utf8");
+  if (bytes.length === 0 || bytes.length > ARTIFACT_MAX_BYTES) {
+    throw careerRunError("variant_save_unavailable");
+  }
+  return bytes;
+}
+function effectiveUserId() {
+  return process.geteuid?.() ?? process.getuid?.();
+}
+function privateMetadata(metadata, mode) {
+  const userId = effectiveUserId();
+  return userId !== void 0 && metadata.uid === userId && (metadata.mode & 511) === mode;
+}
+function directManagedRoot(config, root) {
+  const configured = config.generated_variants_root === void 0 ? void 0 : path5.resolve(config.generated_variants_root);
+  return configured !== void 0 && path5.dirname(configured) === root.path ? configured : path5.join(root.path, "variants");
+}
+function validBoundedPath(value) {
+  return path5.isAbsolute(value) && path5.normalize(value) === value && Buffer.byteLength(value, "utf8") <= PATH_MAX_BYTES3 && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function validDestination(config, root, directoryPath) {
+  return validBoundedPath(root.path) && validBoundedPath(directoryPath) && path5.dirname(directoryPath) === root.path && directoryPath !== root.path && !config.library_roots.some((configuredRoot) => configuredRoot.path === directoryPath);
+}
+function basicTimestamp(createdAt) {
+  return createdAt.replace(/[-:.]/g, "");
+}
+function canonicalJson(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+function fileNameFor(candidate, createdAt, saveId) {
+  const extension = candidate.source.format === "markdown" ? "md" : "txt";
+  const suffix = saveId.replaceAll("-", "").slice(0, 8);
+  return `resume-assisted-${basicTimestamp(createdAt)}-${suffix}.${extension}`;
+}
+var VariantSaveWorkflow = class {
+  constructor(options) {
+    this.options = options;
+    this.fs = options.fs ?? DEFAULT_FS;
+  }
+  options;
+  fs;
+  receipts = /* @__PURE__ */ new Map();
+  rootLocks = /* @__PURE__ */ new Map();
+  clearReceipts() {
+    this.receipts.clear();
+  }
+  async run(handle, ctx, resolveCandidate) {
+    if (!ctx.isIdle()) throw careerRunError("variant_save_unavailable");
+    const candidate = resolveCandidate();
+    const existing = this.receipts.get(handle);
+    if (existing !== void 0) {
+      if (!sameCandidate(existing.plan.candidate, candidate) || existing.plan.sessionId !== ctx.sessionManager.getSessionId()) {
+        throw careerRunError("variant_save_unavailable");
+      }
+      if (!await this.verifyPublishedPair(existing.plan)) {
+        throw careerRunError("variant_save_verification_failed");
+      }
+      await this.verifyRescan(existing.plan);
+      return {
+        status: "existing",
+        artifactPath: existing.plan.artifactPath,
+        sidecarPath: existing.plan.sidecarPath
+      };
+    }
+    const plan = await this.preparePlan(candidate, ctx.sessionManager.getSessionId());
+    const reviewed = await ctx.ui.editor("Review exact assisted-variant save plan", plan.previewText);
+    if (reviewed === void 0) return { status: "cancelled" };
+    if (reviewed !== plan.previewText) throw careerRunError("variant_save_preview_changed");
+    const confirmed = await ctx.ui.confirm(
+      "Save assisted resume variant?",
+      [
+        `Save ID: ${plan.saveId}`,
+        `Directory: ${plan.directoryPath}`,
+        `Artifact: ${path5.basename(plan.artifactPath)} (${plan.artifactBytes.length} bytes, ${hash(plan.artifactBytes)})`,
+        `Sidecar: ${path5.basename(plan.sidecarPath)} (${plan.sidecarBytes.length} bytes, ${hash(plan.sidecarBytes)})`,
+        ...plan.markerBytes === void 0 ? [] : [
+          `Create managed marker: ${MANAGED_VARIANTS_MARKER_NAME} (${plan.markerBytes.length} bytes, ${hash(plan.markerBytes)})`
+        ],
+        "This is assisted/non-authoritative. Existing files will never be replaced."
+      ].join("\n"),
+      { timeout: CONFIRM_TIMEOUT_MS }
+    );
+    if (!confirmed || ctx.signal?.aborted) return { status: "cancelled" };
+    const current = resolveCandidate();
+    if (!sameCandidate(plan.candidate, current) || plan.sessionId !== ctx.sessionManager.getSessionId()) {
+      throw careerRunError("variant_save_unavailable");
+    }
+    const paths = [plan.artifactPath, plan.sidecarPath, ...plan.markerBytes === void 0 ? [] : [plan.markerPath]].sort();
+    await this.withRootLock(plan.directoryPath, () => this.withMutationQueues(paths, async () => {
+      const lockedCandidate = resolveCandidate();
+      if (!sameCandidate(plan.candidate, lockedCandidate) || plan.sessionId !== ctx.sessionManager.getSessionId() || !ctx.isIdle() || ctx.signal?.aborted) {
+        throw careerRunError("variant_save_unavailable");
+      }
+      await this.revalidatePlan(plan);
+      await this.publishPlan(plan);
+    }));
+    this.receipts.set(handle, { plan });
+    await this.verifyRescan(plan);
+    return { status: "saved", artifactPath: plan.artifactPath, sidecarPath: plan.sidecarPath };
+  }
+  async currentOriginal(candidate) {
+    const config = await loadConfig(this.options.agentDir);
+    const scan = await scanLibrary(config);
+    const root = config.library_roots.find((value) => value.id === candidate.source.rootId);
+    const rootSummary = scan.roots.find((value) => value.root_id === candidate.source.rootId);
+    const matches = eligibleOriginals(scan).filter((record) => record.id === candidate.source.resumeId && record.root_id === candidate.source.rootId && record.format === candidate.source.format && record.text_sha256 === candidate.source.textSha256);
+    if (root === void 0 || rootSummary === void 0 || rootSummary.stale || rootSummary.capped || scan.total_capped || matches.length !== 1) throw careerRunError("variant_save_unavailable");
+    const directoryPath = directManagedRoot(config, root);
+    if (!validDestination(config, root, directoryPath)) {
+      throw careerRunError("variant_save_destination_invalid");
+    }
+    const destination = await this.inspectDestination(directoryPath, root);
+    return { config, root, record: matches[0], destination };
+  }
+  async inspectDestination(directoryPath, root) {
+    const markerPath = path5.join(directoryPath, MANAGED_VARIANTS_MARKER_NAME);
+    let metadata;
+    try {
+      metadata = await this.fs.lstat(directoryPath);
+    } catch (error) {
+      if (isNodeError(error, "ENOENT")) return { kind: "absent", directoryPath, markerPath };
+      throw careerRunError("variant_save_destination_invalid");
+    }
+    const canonical = await this.fs.realpath(directoryPath).catch(() => void 0);
+    if (!metadata.isDirectory() || metadata.isSymbolicLink() || canonical !== directoryPath || !privateMetadata(metadata, 448)) throw careerRunError("variant_save_destination_invalid");
+    const entries = await this.fs.readdir(directoryPath).catch(() => void 0);
+    if (entries === void 0) throw careerRunError("variant_save_destination_invalid");
+    const markerState = await this.inspectMarker(markerPath, root.id);
+    if (markerState === "valid") return { kind: "managed", directoryPath, markerPath };
+    if (markerState === "invalid" || entries.length !== 0) {
+      throw careerRunError("variant_save_destination_invalid");
+    }
+    return { kind: "empty", directoryPath, markerPath };
+  }
+  async inspectMarker(markerPath, expectedRootId) {
+    try {
+      const marker = await this.fs.lstat(markerPath);
+      if (!marker.isFile() || marker.isSymbolicLink() || !privateMetadata(marker, 384) || marker.size <= 0 || marker.size > ASSISTED_SIDECAR_MAX_BYTES) return "invalid";
+      const bytes = await this.fs.readFile(markerPath);
+      if (bytes.length !== marker.size) return "invalid";
+      const text = new TextDecoder5("utf-8", { fatal: true }).decode(bytes);
+      return parseManagedVariantsMarker(text, expectedRootId) === void 0 ? "invalid" : "valid";
+    } catch (error) {
+      return isNodeError(error, "ENOENT") ? "absent" : "invalid";
+    }
+  }
+  async preparePlan(candidate, sessionId) {
+    const artifactBytes = validateCandidate(candidate);
+    const prepared = await this.currentOriginal(candidate);
+    const saveId = this.options.uuid().toLowerCase();
+    const createdAt = this.options.now().toISOString();
+    if (!UUID3.test(saveId)) throw careerRunError("variant_save_unavailable");
+    const fileName = fileNameFor(candidate, createdAt, saveId);
+    const artifactPath = path5.join(prepared.destination.directoryPath, fileName);
+    const sidecarPath2 = path5.join(
+      prepared.destination.directoryPath,
+      `${fileName.slice(0, -path5.extname(fileName).length)}.pi-career.json`
+    );
+    if (![prepared.destination.markerPath, artifactPath, sidecarPath2].every(validBoundedPath)) {
+      throw careerRunError("variant_save_destination_invalid");
+    }
+    await this.requireAbsent(artifactPath);
+    await this.requireAbsent(sidecarPath2);
+    const sidecarBytes = encodeAssistedVariantMetadataV2({
+      base_document_id: candidate.source.resumeId,
+      base_text_sha256: candidate.source.textSha256,
+      artifact_sha256: sha256Bytes(artifactBytes),
+      created_at: createdAt
+    });
+    const markerBytes = prepared.destination.kind === "managed" ? void 0 : encodeManagedVariantsMarker(prepared.root.id, createdAt);
+    if (sidecarBytes.length > ASSISTED_SIDECAR_MAX_BYTES || markerBytes !== void 0 && markerBytes.length > ASSISTED_SIDECAR_MAX_BYTES) {
+      throw careerRunError("variant_save_unavailable");
+    }
+    const preview = {
+      schema_version: "pi.career.variant_save_preview.v1",
+      save_id: saveId,
+      initialize_directory: markerBytes !== void 0,
+      directory_path: prepared.destination.directoryPath,
+      marker: markerBytes === void 0 ? null : {
+        path: prepared.destination.markerPath,
+        utf8_bytes: markerBytes.length,
+        sha256: hash(markerBytes),
+        text: markerBytes.toString("utf8")
+      },
+      artifact: {
+        path: artifactPath,
+        format: candidate.source.format,
+        utf8_bytes: artifactBytes.length,
+        sha256: hash(artifactBytes),
+        text: candidate.assistedText
+      },
+      sidecar: {
+        path: sidecarPath2,
+        utf8_bytes: sidecarBytes.length,
+        sha256: hash(sidecarBytes),
+        text: sidecarBytes.toString("utf8")
+      }
+    };
+    const previewText = canonicalJson(preview);
+    if (Buffer.byteLength(previewText, "utf8") > PREVIEW_MAX_BYTES) {
+      throw careerRunError("variant_save_unavailable");
+    }
+    return {
+      saveId,
+      sessionId,
+      candidate,
+      createdAt,
+      directoryPath: prepared.destination.directoryPath,
+      markerPath: prepared.destination.markerPath,
+      artifactPath,
+      sidecarPath: sidecarPath2,
+      artifactBytes,
+      sidecarBytes,
+      ...markerBytes === void 0 ? {} : { markerBytes },
+      initialDestinationKind: prepared.destination.kind,
+      previewText
+    };
+  }
+  async revalidatePlan(plan) {
+    validateCandidate(plan.candidate);
+    const prepared = await this.currentOriginal(plan.candidate);
+    if (prepared.destination.directoryPath !== plan.directoryPath || prepared.destination.markerPath !== plan.markerPath || prepared.destination.kind !== plan.initialDestinationKind) throw careerRunError("variant_save_destination_invalid");
+    await this.requireAbsent(plan.artifactPath);
+    await this.requireAbsent(plan.sidecarPath);
+  }
+  async requireAbsent(file) {
+    try {
+      await this.fs.lstat(file);
+      throw careerRunError("variant_save_collision");
+    } catch (error) {
+      if (error instanceof CareerRunError) throw error;
+      if (!isNodeError(error, "ENOENT")) throw careerRunError("variant_save_destination_invalid");
+    }
+  }
+  async publishPlan(plan) {
+    if (plan.markerBytes !== void 0) await this.initializeDirectory(plan);
+    let sidecarTemp;
+    let artifactTemp;
+    let sidecarLinked = false;
+    let artifactLinked = false;
+    try {
+      sidecarTemp = await this.writeTemp(plan, "sidecar", plan.sidecarBytes);
+      artifactTemp = await this.writeTemp(plan, "artifact", plan.artifactBytes);
+      await this.publishTemp(sidecarTemp, plan.sidecarPath);
+      sidecarLinked = true;
+      await this.publishTemp(artifactTemp, plan.artifactPath);
+      artifactLinked = true;
+      await this.safeUnlink(sidecarTemp.path);
+      await this.safeUnlink(artifactTemp.path);
+      await this.syncDirectory(plan.directoryPath);
+      if (!await this.verifyPublishedPair(plan, sidecarTemp.metadata, artifactTemp.metadata)) {
+        throw careerRunError("variant_save_status_unknown");
+      }
+    } catch (error) {
+      if (sidecarTemp !== void 0) await this.safeUnlink(sidecarTemp.path);
+      if (artifactTemp !== void 0) await this.safeUnlink(artifactTemp.path);
+      if (sidecarTemp !== void 0 && artifactTemp !== void 0 && await this.verifyPublishedPair(plan, sidecarTemp.metadata, artifactTemp.metadata)) return;
+      if (!artifactLinked && sidecarTemp !== void 0) {
+        await this.unlinkIfIdentity(plan.sidecarPath, sidecarTemp.metadata);
+      }
+      this.throwPublicationFailure(error, sidecarLinked, artifactLinked);
+    }
+  }
+  throwPublicationFailure(error, sidecarLinked, artifactLinked) {
+    if (error instanceof CareerRunError) throw error;
+    if (isNodeError(error, "EEXIST")) throw careerRunError("variant_save_collision");
+    throw careerRunError(sidecarLinked || artifactLinked ? "variant_save_status_unknown" : "variant_save_destination_invalid");
+  }
+  async initializeDirectory(plan) {
+    if (plan.markerBytes === void 0) return;
+    if (plan.initialDestinationKind === "absent") {
+      try {
+        await this.fs.mkdir(plan.directoryPath, { mode: 448, recursive: false });
+      } catch (error) {
+        if (isNodeError(error, "EEXIST")) throw careerRunError("variant_save_collision");
+        throw careerRunError("variant_save_destination_invalid");
+      }
+      await this.fs.chmod(plan.directoryPath, 448).catch(() => {
+        throw careerRunError("variant_save_destination_invalid");
+      });
+    }
+    const directory = await this.fs.lstat(plan.directoryPath).catch(() => {
+      throw careerRunError("variant_save_destination_invalid");
+    });
+    const canonical = await this.fs.realpath(plan.directoryPath).catch(() => {
+      throw careerRunError("variant_save_destination_invalid");
+    });
+    if (!directory.isDirectory() || directory.isSymbolicLink() || canonical !== plan.directoryPath || !privateMetadata(directory, 448)) throw careerRunError("variant_save_destination_invalid");
+    await this.requireAbsent(plan.markerPath);
+    const markerTemp = await this.writeTemp(plan, "marker", plan.markerBytes);
+    try {
+      await this.publishTemp(markerTemp, plan.markerPath);
+      await this.safeUnlink(markerTemp.path);
+      await this.syncDirectory(plan.directoryPath);
+      if (!await this.verifyExactFile(plan.markerPath, plan.markerBytes, markerTemp.metadata)) {
+        throw careerRunError("variant_save_status_unknown");
+      }
+    } catch (error) {
+      await this.safeUnlink(markerTemp.path);
+      if (error instanceof CareerRunError) throw error;
+      if (isNodeError(error, "EEXIST")) throw careerRunError("variant_save_collision");
+      throw careerRunError("variant_save_destination_invalid");
+    }
+  }
+  async writeTemp(plan, role, bytes) {
+    const temporary = path5.join(plan.directoryPath, `.pi-career-${plan.saveId}-${role}.tmp`);
+    let handle;
+    try {
+      handle = await this.fs.open(
+        temporary,
+        constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | constants2.O_NOFOLLOW,
+        384
+      );
+      await handle.writeFile(bytes);
+      await handle.sync();
+      await handle.chmod(384);
+      const metadata = await handle.stat();
+      await handle.close();
+      handle = void 0;
+      if (!metadata.isFile() || metadata.isSymbolicLink() || !privateMetadata(metadata, 384) || metadata.size !== bytes.length) {
+        throw careerRunError("variant_save_destination_invalid");
+      }
+      const checked = await this.fs.readFile(temporary);
+      if (!checked.equals(bytes)) throw careerRunError("variant_save_destination_invalid");
+      return { path: temporary, metadata };
+    } catch (error) {
+      if (handle !== void 0) await handle.close().catch(() => void 0);
+      await this.safeUnlink(temporary);
+      if (error instanceof CareerRunError) throw error;
+      if (isNodeError(error, "EEXIST")) throw careerRunError("variant_save_collision");
+      throw careerRunError("variant_save_destination_invalid");
+    }
+  }
+  async publishTemp(temporary, finalPath) {
+    await this.fs.link(temporary.path, finalPath);
+  }
+  async verifyExactFile(file, expected, identity) {
+    try {
+      const metadata = await this.fs.lstat(file);
+      if (!metadata.isFile() || metadata.isSymbolicLink() || !privateMetadata(metadata, 384) || metadata.size !== expected.length || identity !== void 0 && (metadata.dev !== identity.dev || metadata.ino !== identity.ino)) return false;
+      const bytes = await this.fs.readFile(file);
+      return bytes.equals(expected);
+    } catch {
+      return false;
+    }
+  }
+  async verifyPublishedPair(plan, sidecarIdentity, artifactIdentity) {
+    if (!await this.verifyExactFile(plan.sidecarPath, plan.sidecarBytes, sidecarIdentity) || !await this.verifyExactFile(plan.artifactPath, plan.artifactBytes, artifactIdentity)) return false;
+    try {
+      const text = new TextDecoder5("utf-8", { fatal: true }).decode(await this.fs.readFile(plan.sidecarPath));
+      const parsed = parseAssistedVariantMetadata(text, plan.artifactBytes);
+      return parsed?.baseDocumentId === plan.candidate.source.resumeId;
+    } catch {
+      return false;
+    }
+  }
+  async verifyRescan(plan) {
+    const config = await loadConfig(this.options.agentDir);
+    const scan = await scanLibrary(config);
+    const root = scan.roots.find((value) => value.root_id === plan.candidate.source.rootId);
+    const configuredRoot = config.library_roots.find((value) => value.id === plan.candidate.source.rootId);
+    const relativePath = configuredRoot === void 0 ? void 0 : path5.relative(configuredRoot.path, plan.artifactPath).split(path5.sep).join("/");
+    const records = scan.records.filter((record) => record.path === plan.artifactPath);
+    const eligible = eligibleOriginals(scan).some((record) => record.path === plan.artifactPath);
+    if (root === void 0 || configuredRoot === void 0 || relativePath === void 0 || root.stale || root.capped || scan.total_capped || records.length !== 1 || records[0].format !== plan.candidate.source.format || records[0].text !== plan.candidate.assistedText || records[0].kind !== "assisted_variant" || records[0].variant_group_id !== plan.candidate.source.resumeId || eligible || scan.warnings.some((warning) => warning.code === "invalid_assisted_sidecar" && warning.root_id === plan.candidate.source.rootId && warning.relative_path === relativePath)) throw careerRunError("variant_save_verification_failed");
+  }
+  async unlinkIfIdentity(file, identity) {
+    try {
+      const metadata = await this.fs.lstat(file);
+      if (metadata.dev === identity.dev && metadata.ino === identity.ino) await this.fs.unlink(file);
+    } catch {
+    }
+  }
+  async safeUnlink(file) {
+    await this.fs.unlink(file).catch(() => void 0);
+  }
+  async syncDirectory(directory) {
+    let handle;
+    try {
+      handle = await this.fs.open(directory, constants2.O_RDONLY);
+      await handle.sync();
+      await handle.close();
+    } catch {
+      if (handle !== void 0) await handle.close().catch(() => void 0);
+      throw careerRunError("variant_save_status_unknown");
+    }
+  }
+  async withMutationQueues(paths, operation) {
+    const run = (index) => index >= paths.length ? operation() : withFileMutationQueue(paths[index], () => run(index + 1));
+    return run(0);
+  }
+  async withRootLock(root, operation) {
+    const previous = this.rootLocks.get(root) ?? Promise.resolve();
+    let release = () => void 0;
+    const gate = new Promise((resolve) => {
+      release = resolve;
+    });
+    const current = previous.then(() => gate);
+    this.rootLocks.set(root, current);
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this.rootLocks.get(root) === current) this.rootLocks.delete(root);
+    }
+  }
+};
+
+// src/managed/tool.ts
+var REVIEW_HANDLE_PATTERN = /^review:[a-f0-9-]{8,64}$/;
+var VARIANT_HANDLE_PATTERN = /^variant:[a-f0-9-]{8,64}$/;
+function managedToolActive(pi, includeRaw) {
+  const current = pi.getActiveTools();
+  const retained = current.filter((name) => !RAW_TOOL_NAMES.includes(name));
+  const next = includeRaw ? [...retained, ...RAW_TOOL_NAMES] : retained;
+  if (!next.includes(MANAGED_TOOL_NAME)) next.push(MANAGED_TOOL_NAME);
+  pi.setActiveTools([...new Set(next)]);
+}
+function registerCareerRun(pi, options = {}) {
+  const agentDir = options.agentDir ?? getAgentDir();
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const uuid = options.uuid ?? randomUUID2;
+  const engine = new CareerRunEngine({
+    pi,
+    agentDir,
+    invoke: options.invoke ?? invokeCareerCli,
+    now,
+    uuid
+  });
+  const variantSave = new VariantSaveWorkflow({ agentDir, now, uuid });
+  pi.registerTool({
+    name: MANAGED_TOOL_NAME,
+    label: "Career",
+    description: "Run managed local Career Core workflows with ephemeral handles and native payload objects instead of nested JSON strings.",
+    promptGuidelines: [
+      "Start with context. If consent is required, ask first; consent payload is `approve` or `decline`. Use returned handles; match/variant-review use the current vacancy implicitly.",
+      "Proposal payloads use Core fields. Materialize payload is {selected_change_ids:[...]}; detail payload is {section,item?}. Preserve warnings/uncertainty/authority, and never select changes automatically.",
+      "career_run variant-review must end its turn. For non-PDF originals in TUI, direct the user to /career-review with the returned review handle; only a later user-submitted turn may materialize explicitly selected IDs. PDF changes remain manual guidance only.",
+      "After materialization, never initiate persistence. The user alone may run /career-save with the returned variant handle for exact local preview and confirmation."
+    ],
+    parameters: careerRunParameters,
+    async execute(_toolCallId, params, signal, onUpdate, ctx) {
+      onUpdate?.({
+        content: [{ type: "text", text: `Running career ${params.command}…` }],
+        details: { schema_version: "pi.career.run_details.v1", command: params.command }
+      });
+      const result = await engine.run(params, signal, ctx);
+      if (params.command === "consent" && params.payload === "decline") {
+        variantSave.clearReceipts();
+      }
+      return params.command === "variant-review" ? { ...result, terminate: true } : result;
+    },
+    renderCall(args, theme) {
+      return new Text2(
+        theme.fg("toolTitle", theme.bold("career ")) + theme.fg("accent", args.command ?? "run"),
+        0,
+        0
+      );
+    },
+    renderResult(result, { expanded, isPartial }, theme) {
+      if (isPartial) return new Text2(theme.fg("warning", "Running Career Core…"), 0, 0);
+      const details = result.details;
+      if (details === void 0) return new Text2(theme.fg("dim", "Career result unavailable"), 0, 0);
+      const lines = [
+        theme.fg(details.status === "consent_required" ? "warning" : "success", details.summary),
+        ...details.action === "review_select" && details.handle !== void 0 ? [theme.fg("accent", `Run /career-review ${details.handle}`)] : [],
+        ...details.action === "save_available" && details.handle !== void 0 ? [theme.fg("accent", `User may run /career-save ${details.handle}`)] : [],
+        ...expanded && details.handle !== void 0 && details.action !== "review_select" && details.action !== "save_available" ? [theme.fg("dim", details.handle)] : []
+      ];
+      return new Text2(lines.join("\n"), 0, 0);
+    }
+  });
+  pi.registerCommand("career-review", {
+    description: "Review and explicitly select retained variant changes in TUI",
+    handler: async (args, ctx) => {
+      if (ctx.mode !== "tui") {
+        ctx.ui.notify("/career-review requires TUI mode.", "error");
+        return;
+      }
+      const handle = args.trim();
+      if (!REVIEW_HANDLE_PATTERN.test(handle)) {
+        ctx.ui.notify("Usage: /career-review review:<ephemeral-handle>", "warning");
+        return;
+      }
+      try {
+        await ctx.waitForIdle();
+        const review = engine.variantSelectionReview(handle, ctx);
+        if (review.changes.length === 0) {
+          ctx.ui.notify("This review has no retained changes to select.", "warning");
+          return;
+        }
+        const selected = await selectVariantChanges(ctx, review);
+        if (selected === void 0) return;
+        ctx.ui.setEditorText(materializeEditorText(review.handle, selected));
+        ctx.ui.notify(
+          `${selected.length} reviewed change ID${selected.length === 1 ? "" : "s"} prepared in the editor. Review and submit manually; nothing was materialized, sent, saved, or written.`,
+          "info"
+        );
+      } catch (error) {
+        if (error instanceof CareerRunError) {
+          ctx.ui.notify(careerRunErrorMessage(error.code), "error");
+          return;
+        }
+        ctx.ui.notify("The reviewed-change selector failed without persisting a selection.", "error");
+      }
+    }
+  });
+  pi.registerCommand("career-save", {
+    description: "Preview and explicitly save one current assisted Markdown/text materialization",
+    handler: async (args, ctx) => {
+      if (ctx.mode !== "tui" && ctx.mode !== "rpc") {
+        ctx.ui.notify("/career-save requires TUI or RPC mode.", "error");
+        return;
+      }
+      if (!ctx.isIdle()) {
+        ctx.ui.notify("Wait for the current agent run to settle before saving.", "warning");
+        return;
+      }
+      const handle = args.trim();
+      if (!VARIANT_HANDLE_PATTERN.test(handle)) {
+        ctx.ui.notify("Usage: /career-save variant:<ephemeral-handle>", "warning");
+        return;
+      }
+      try {
+        const outcome = await variantSave.run(
+          handle,
+          ctx,
+          () => engine.materializedVariantForSave(handle, ctx)
+        );
+        if (outcome.status === "cancelled") {
+          ctx.ui.notify("Assisted-variant save cancelled; no file was written.", "info");
+          return;
+        }
+        ctx.ui.notify(
+          `${outcome.status === "existing" ? "Verified existing" : "Saved"} assisted variant: ${outcome.artifactPath}
+Sidecar: ${outcome.sidecarPath}`,
+          "info"
+        );
+      } catch (error) {
+        if (error instanceof CareerRunError) {
+          ctx.ui.notify(careerRunErrorMessage(error.code), "error");
+          return;
+        }
+        ctx.ui.notify("The assisted variant could not be saved or verified.", "error");
+      }
+    }
+  });
+  pi.registerCommand("career-tools", {
+    description: "Choose managed or advanced raw Career Core tools",
+    getArgumentCompletions: (prefix) => ["managed", "raw", "status"].filter((value) => value.startsWith(prefix)).map((value) => ({ value, label: value })),
+    handler: async (args, ctx) => {
+      const mode = args.trim();
+      if (mode === "managed") managedToolActive(pi, false);
+      else if (mode === "raw") managedToolActive(pi, true);
+      else if (mode !== "status" && mode !== "") {
+        ctx.ui.notify("Usage: /career-tools managed|raw|status", "warning");
+        return;
+      }
+      const activeRaw = RAW_TOOL_NAMES.filter((name) => pi.getActiveTools().includes(name));
+      ctx.ui.notify(
+        `Career tools: career_run active; raw Career Core tools ${activeRaw.length === 0 ? "inactive" : "active"}.`,
+        "info"
+      );
+    }
+  });
+  pi.on("session_start", (_event, ctx) => {
+    variantSave.clearReceipts();
+    engine.enterSession(ctx.sessionManager.getSessionId());
+    managedToolActive(pi, false);
+  });
+  pi.on("session_tree", (_event, ctx) => {
+    variantSave.clearReceipts();
+    engine.resetSession(ctx.sessionManager.getSessionId());
+  });
+  pi.on("session_shutdown", () => {
+    variantSave.clearReceipts();
+    engine.shutdown();
+  });
+}
+
+// src/workflow/commands.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import {
+  BorderedLoader,
+  getAgentDir as getAgentDir2
+} from "@earendil-works/pi-coding-agent";
+
+// src/workflow/workbench.ts
+var WORKBENCH_MAX_SOURCE_CHARACTERS = 8e4;
+var WORKBENCH_MAX_PROMPT_BYTES = 262144;
+var WORKBENCH_MAX_QUESTION_CHARACTERS = 4e3;
+function characterCount(value) {
+  return [...value].length;
+}
+function formatRule(resume) {
+  if (resume.format === "pdf") {
+    return "The resume came from searchable PDF text extraction. You cannot inspect its visual layout, typography, columns, spacing, or graphics. Return targeted section-level suggestions and replacement snippets for the user to apply in the styled source; never claim that PDF styling was preserved or inspected.";
+  }
+  if (resume.format === "markdown") {
+    return "The resume includes Markdown structure. Preserve its existing heading hierarchy, list structure, ordering, and all unchanged wording in every proposed edit.";
+  }
+  return "The resume is plain text. Preserve its existing section order, line structure, and all unchanged wording in every proposed edit.";
 }
 function workflowProtocol(mode, resume) {
   switch (mode) {
@@ -3578,7 +4700,7 @@ function workflowProtocol(mode, resume) {
       }
       return `${review}
 4. Ask the user to select retained IDs, then stop; never select or materialize now.
-5. Only after later selection, call career_run "materialize" with the returned review handle and selected IDs. Keep it assisted/non-authoritative; never analyze, match, or save it as original.`;
+5. Only after later selection, call career_run "materialize" with the returned review handle and selected IDs. Keep it assisted/non-authoritative and never analyze or match it as original. Do not initiate persistence; only tell the user they may run the returned \`/career-save <variant-handle>\` command for a separate exact local preview and confirmation.`;
     }
     case "question":
       return `1. Answer from the original; use complete analysis or matching when relevant.
@@ -3866,20 +4988,7 @@ async function showDetail(ctx, sections) {
   const choice = await ctx.ui.select("Career detail", [...sections.map((section2) => section2.label), "Close"]);
   const section = sections.find((candidate) => candidate.label === choice);
   if (section === void 0) return;
-  const text = detailText(section);
-  if (ctx.mode !== "tui") {
-    ctx.ui.notify(text, "info");
-    return;
-  }
-  await ctx.ui.custom((tui, theme, keybindings, done) => new DetailViewer(
-    section.label,
-    text,
-    theme,
-    keybindings,
-    Math.max(1, Math.min(20, tui.terminal.rows - 6)),
-    () => tui.requestRender(),
-    () => done(void 0)
-  ));
+  await showDetailText(ctx, section.label, detailText(section));
 }
 function registerCareerCommands(pi, options = {}) {
   const dependencies = {
@@ -4552,6 +5661,7 @@ function resultContent(json, operation) {
   };
 }
 function careerCoreExtension(pi) {
+  assertSupportedPlatform();
   registerCareerCommands(pi);
   pi.registerTool({
     name: "career_core_discover",