steward-cli 0.12.0 → 0.14.0

package/dist/cli.js

@@ -52395,6 +52395,8 @@ function formatToolStatus(options) {
   let mainLine = `${bullet} ${dispName}`;
   if (truncatedArg) {
     mainLine += `${source_default.dim("(")}${source_default.dim(truncatedArg)}${source_default.dim(")")}`;
+  } else {
+    mainLine += `${source_default.dim("()")}`;
   }
   const lines = [mainLine];
   if (status === "completed" && options.toolOutput) {
@@ -70954,7 +70956,6 @@ class ToolCatalog {
       aiTools[name] = tool({
         description: def.description,
         inputSchema: def.parameters,
-        parameters: def.parameters,
         execute: async (args) => {
           return def.execute(args, context);
         }
@@ -70966,13 +70967,52 @@ class ToolCatalog {
 var defaultToolCatalog = new ToolCatalog;
 
 // src/tools/read-file/index.ts
-import { existsSync as existsSync9, lstatSync as lstatSync3, readFileSync as readFileSync8 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync9, lstatSync as lstatSync3, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve5, sep as sep3 } from "node:path";
 var readFileInputSchema = object({
   path: string2().describe("The path of the file to read (relative to current working directory or absolute)."),
   offset: number2().int().min(1).optional().describe("The line number to start reading from (1-indexed). Defaults to 1."),
   limit: number2().int().min(1).max(2000).optional().describe("The maximum number of lines to read. Defaults to 200.")
 });
+function isPathInside2(targetPath, basePath) {
+  const normTarget = resolve5(targetPath);
+  const normBase = resolve5(basePath);
+  if (normTarget === normBase) {
+    return true;
+  }
+  const prefix = normBase.endsWith(sep3) ? normBase : `${normBase}${sep3}`;
+  return normTarget.startsWith(prefix);
+}
+function resolveSafeReadPath(cwd, filePath) {
+  if (!filePath || !filePath.trim()) {
+    throw new Error("File path cannot be empty.");
+  }
+  const trimmed = filePath.trim();
+  const resolved = isAbsolute2(trimmed) ? resolve5(trimmed) : resolve5(cwd, trimmed);
+  if (!isPathInside2(resolved, cwd)) {
+    throw new Error(`Access denied: path "${filePath}" resolves outside the trusted workspace root ("${cwd}").`);
+  }
+  if (!existsSync9(resolved)) {
+    throw new Error(`File not found: ${filePath}`);
+  }
+  let realTarget;
+  try {
+    realTarget = realpathSync3(resolved);
+  } catch {
+    realTarget = resolved;
+  }
+  if (!isPathInside2(realTarget, cwd)) {
+    throw new Error(`Access denied: symlink "${filePath}" points outside the trusted workspace root.`);
+  }
+  const stat = lstatSync3(resolved);
+  if (stat.isDirectory()) {
+    throw new Error(`Cannot read path because it is a directory: ${filePath}`);
+  }
+  if (!stat.isFile() && !stat.isSymbolicLink()) {
+    throw new Error(`Cannot read special or non-regular file: ${filePath}`);
+  }
+  return realTarget;
+}
 function isBinaryBuffer(buffer) {
   const checkLength = Math.min(buffer.length, 1024);
   for (let i = 0;i < checkLength; i++) {
@@ -70985,7 +71025,7 @@ function isBinaryBuffer(buffer) {
 var readFileTool = {
   name: "read_file",
   displayName: "Read",
-  description: "Reads the contents of a file with 1-indexed line numbers. Supports reading specific line ranges via offset and limit. Read is read-only and does not mutate or checkpoint.",
+  description: "Reads the contents of a file. Supports reading specific line ranges via offset and limit. Read is read-only and does not mutate or checkpoint.",
   parameters: readFileInputSchema,
   confirmationPolicy: "never",
   summarize: (_args, result) => {
@@ -70993,10 +71033,7 @@ var readFileTool = {
     return `Read ${lines} line${lines === 1 ? "" : "s"}`;
   },
   execute: async (args, context) => {
-    const targetPath = isAbsolute2(args.path) ? args.path : resolve5(context.cwd, args.path);
-    if (!existsSync9(targetPath)) {
-      throw new Error(`File not found: ${args.path}`);
-    }
+    const targetPath = resolveSafeReadPath(context.cwd, args.path);
     const stat = lstatSync3(targetPath);
     if (stat.isDirectory()) {
       throw new Error(`Cannot read path because it is a directory: ${args.path}`);
@@ -71032,18 +71069,13 @@ var readFileTool = {
     const startIndex = Math.max(0, startLine - 1);
     const endIndex = Math.min(totalLines, startIndex + limit);
     const slice = allLines.slice(startIndex, endIndex);
-    const padWidth = String(endIndex).length;
-    const formattedContent = slice.map((line, idx) => {
-      const lineNum = String(startIndex + idx + 1).padStart(padWidth, " ");
-      return `${lineNum} | ${line}`;
-    }).join(`
-`);
     return {
       path: args.path,
       totalLines,
       startLine,
       endLine: endIndex,
-      content: formattedContent,
+      content: slice.join(`
+`),
       isTruncated: endIndex < totalLines,
       linesRead: slice.length
     };
@@ -71051,6 +71083,9 @@ var readFileTool = {
 };
 
 // src/tools/write-file/index.ts
+import { existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync3 } from "node:fs";
+
+// src/utils/atomic-write.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
@@ -71059,13 +71094,46 @@ import {
   fsyncSync as fsyncSync5,
   mkdirSync as mkdirSync7,
   openSync as openSync6,
-  readFileSync as readFileSync9,
   renameSync as renameSync5,
-  statSync as statSync3,
   unlinkSync as unlinkSync5,
   writeSync as writeSync5
 } from "node:fs";
 import { dirname as dirname5, join as join7 } from "node:path";
+function atomicWriteFileSync(targetPath, content, options = {}) {
+  const buffer = typeof content === "string" ? Buffer.from(content, options.encoding ?? "utf-8") : content;
+  const dir = dirname5(targetPath);
+  if (!existsSync10(dir)) {
+    mkdirSync7(dir, { recursive: true });
+  }
+  const mode = options.mode ?? 420;
+  const tmpPath = join7(dir, `.tmp-write-${randomUUID5().slice(0, 8)}`);
+  let fd = null;
+  try {
+    fd = openSync6(tmpPath, "w", mode);
+    writeSync5(fd, buffer, 0, buffer.length);
+    fsyncSync5(fd);
+    closeSync6(fd);
+    fd = null;
+    try {
+      chmodSync2(tmpPath, mode);
+    } catch {}
+    renameSync5(tmpPath, targetPath);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync6(fd);
+      } catch {}
+    }
+    if (existsSync10(tmpPath)) {
+      try {
+        unlinkSync5(tmpPath);
+      } catch {}
+    }
+    throw err;
+  }
+}
+
+// src/tools/write-file/index.ts
 var writeFileInputSchema = object({
   file_path: string2().describe("The path of the file to write (relative to current working directory or absolute inside trusted workspace)."),
   content: string2().describe("The full text content to write to the file.")
@@ -71097,7 +71165,7 @@ ${detail}${overflow}`;
   },
   execute: async (args, context) => {
     const { absolutePath: targetPath, relativePath } = resolveDirectMutationPath(context.cwd, args.file_path);
-    const isNew = !existsSync10(targetPath);
+    const isNew = !existsSync11(targetPath);
     const beforeContent = isNew ? null : readFileSync9(targetPath, "utf-8");
     const afterContent = args.content;
     const linesWritten = afterContent.length === 0 ? 0 : afterContent.split(/\r?\n/).length;
@@ -71133,11 +71201,11 @@ ${detail}${overflow}`;
         throw new Error("File write permission denied by user.");
       }
       if (isNew) {
-        if (existsSync10(targetPath)) {
+        if (existsSync11(targetPath)) {
           throw new Error(`File was created externally during approval review: "${relativePath}". Mutation aborted to prevent data loss.`);
         }
       } else {
-        if (!existsSync10(targetPath)) {
+        if (!existsSync11(targetPath)) {
           throw new Error(`File was deleted externally during approval review: "${relativePath}". Mutation aborted.`);
         }
         const freshContent = readFileSync9(targetPath, "utf-8");
@@ -71145,42 +71213,14 @@ ${detail}${overflow}`;
           throw new Error(`File was modified externally during approval review: "${relativePath}". Mutation aborted to prevent data loss.`);
         }
       }
-      const newBuffer = Buffer.from(afterContent, "utf-8");
-      const dir = dirname5(targetPath);
-      if (!existsSync10(dir)) {
-        mkdirSync7(dir, { recursive: true });
-      }
       let existingMode = 420;
       if (!isNew) {
         try {
           existingMode = statSync3(targetPath).mode;
         } catch {}
       }
-      const tmpPath = join7(dir, `.tmp-write-${randomUUID5().slice(0, 8)}`);
-      let fd = null;
-      try {
-        fd = openSync6(tmpPath, "w", existingMode);
-        writeSync5(fd, newBuffer, 0, newBuffer.length);
-        fsyncSync5(fd);
-        closeSync6(fd);
-        fd = null;
-        try {
-          chmodSync2(tmpPath, existingMode);
-        } catch {}
-        renameSync5(tmpPath, targetPath);
-      } catch (err) {
-        if (fd !== null) {
-          try {
-            closeSync6(fd);
-          } catch {}
-        }
-        if (existsSync10(tmpPath)) {
-          try {
-            unlinkSync5(tmpPath);
-          } catch {}
-        }
-        throw err;
-      }
+      const newBuffer = Buffer.from(afterContent, "utf-8");
+      atomicWriteFileSync(targetPath, newBuffer, { mode: existingMode });
       if (context.checkpointTracker) {
         await context.checkpointTracker.completeMutation(targetPath);
       }
@@ -71200,20 +71240,7 @@ ${detail}${overflow}`;
 };
 
 // src/tools/edit-file/index.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
-import {
-  chmodSync as chmodSync3,
-  closeSync as closeSync7,
-  existsSync as existsSync11,
-  fsyncSync as fsyncSync6,
-  openSync as openSync7,
-  readFileSync as readFileSync10,
-  renameSync as renameSync6,
-  statSync as statSync4,
-  unlinkSync as unlinkSync6,
-  writeSync as writeSync6
-} from "node:fs";
-import { dirname as dirname6, join as join8 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
 
 // src/utils/diff.ts
 function tokenizeLines(content) {
@@ -71523,7 +71550,7 @@ ${diffLines.join(`
   },
   execute: async (args, context) => {
     const { absolutePath: targetPath, relativePath } = resolveDirectMutationPath(context.cwd, args.file_path);
-    if (!existsSync11(targetPath)) {
+    if (!existsSync12(targetPath)) {
       throw new Error(`Cannot edit file because it does not exist: "${args.file_path}". Use write_file to create new files.`);
     }
     const currentContent = readFileSync10(targetPath, "utf-8");
@@ -71574,65 +71601,30 @@ ${diffLines.join(`
       if (!perm.allowed) {
         throw new Error("File edit permission denied by user.");
       }
-      if (!existsSync11(targetPath)) {
+      if (!existsSync12(targetPath)) {
         throw new Error(`File was deleted externally during approval review: "${relativePath}". Mutation aborted.`);
       }
       const freshContent = readFileSync10(targetPath, "utf-8");
       if (freshContent !== currentContent) {
         throw new Error(`File was modified externally during approval review: "${relativePath}". Mutation aborted to prevent data loss.`);
       }
-      const beforeLines = currentContent.split(/\r?\n/);
-      const afterLines = updatedContent.split(/\r?\n/);
-      const lineDelta = afterLines.length - beforeLines.length;
+      const diff = buildUnifiedDiff(currentContent, updatedContent, 0);
       let addedLines = 0;
       let removedLines = 0;
-      const oldLinesInMatch = args.old_string.split(/\r?\n/).length;
-      const newLinesInMatch = args.new_string.split(/\r?\n/).length;
-      const totalReplacedOccurrences = args.replace_all ? matchCount : 1;
-      if (oldLinesInMatch === newLinesInMatch && !args.old_string.includes(`
-`) && !args.new_string.includes(`
-`)) {
-        addedLines = totalReplacedOccurrences;
-        removedLines = totalReplacedOccurrences;
-      } else {
-        removedLines = (oldLinesInMatch - 1) * totalReplacedOccurrences + (lineDelta < 0 ? Math.abs(lineDelta) : 0);
-        addedLines = (newLinesInMatch - 1) * totalReplacedOccurrences + (lineDelta > 0 ? lineDelta : 0);
-        if (addedLines === 0 && removedLines === 0 && args.old_string !== args.new_string) {
-          addedLines = totalReplacedOccurrences;
-          removedLines = totalReplacedOccurrences;
+      for (const hunk of diff.hunks) {
+        for (const line of hunk.lines) {
+          if (line.kind === "addition")
+            addedLines++;
+          if (line.kind === "deletion")
+            removedLines++;
         }
       }
-      const newBuffer = Buffer.from(updatedContent, "utf-8");
-      const dir = dirname6(targetPath);
       let existingMode = 420;
       try {
         existingMode = statSync4(targetPath).mode;
       } catch {}
-      const tmpPath = join8(dir, `.tmp-edit-${randomUUID6().slice(0, 8)}`);
-      let fd = null;
-      try {
-        fd = openSync7(tmpPath, "w", existingMode);
-        writeSync6(fd, newBuffer, 0, newBuffer.length);
-        fsyncSync6(fd);
-        closeSync7(fd);
-        fd = null;
-        try {
-          chmodSync3(tmpPath, existingMode);
-        } catch {}
-        renameSync6(tmpPath, targetPath);
-      } catch (err) {
-        if (fd !== null) {
-          try {
-            closeSync7(fd);
-          } catch {}
-        }
-        if (existsSync11(tmpPath)) {
-          try {
-            unlinkSync6(tmpPath);
-          } catch {}
-        }
-        throw err;
-      }
+      const newBuffer = Buffer.from(updatedContent, "utf-8");
+      atomicWriteFileSync(targetPath, newBuffer, { mode: existingMode });
       if (context.checkpointTracker) {
         await context.checkpointTracker.completeMutation(targetPath);
       }
@@ -71653,7 +71645,7 @@ ${diffLines.join(`
 
 // src/tools/glob/index.ts
 import { readdirSync as readdirSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join9, relative as relative2, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join8, relative as relative2, resolve as resolve6 } from "node:path";
 var globInputSchema = object({
   pattern: string2().describe('Glob pattern to match files against (e.g. "**/*.ts", "src/*.json").'),
   path: string2().optional().describe("Starting directory path. Defaults to workspace root."),
@@ -71682,10 +71674,10 @@ function walkDir(dir, baseDir, matcher, results, limit) {
         break;
       if (entry.isDirectory()) {
         if (!IGNORED_DIRS.has(entry.name)) {
-          walkDir(join9(dir, entry.name), baseDir, matcher, results, limit);
+          walkDir(join8(dir, entry.name), baseDir, matcher, results, limit);
         }
       } else if (entry.isFile()) {
-        const rel = relative2(baseDir, join9(dir, entry.name));
+        const rel = relative2(baseDir, join8(dir, entry.name));
         if (matcher(rel, entry.name)) {
           results.push(rel);
         }
@@ -71705,7 +71697,13 @@ var globTool = {
   },
   execute: async (args, context) => {
     const startTime = Date.now();
-    const searchRoot = args.path ? isAbsolute3(args.path) ? args.path : resolve6(context.cwd, args.path) : context.cwd;
+    const searchRoot = args.path ? isAbsolute3(args.path) ? resolve6(args.path) : resolve6(context.cwd, args.path) : context.cwd;
+    const normCwd = resolve6(context.cwd);
+    const normTarget = resolve6(searchRoot);
+    const prefix = normCwd.endsWith("/") ? normCwd : `${normCwd}/`;
+    if (normTarget !== normCwd && !normTarget.startsWith(prefix)) {
+      throw new Error(`Access denied: path "${args.path}" resolves outside the trusted workspace root ("${context.cwd}").`);
+    }
     const limit = args.limit ?? 100;
     const pattern = args.pattern.trim();
     const regex = globToRegex(pattern);
@@ -71728,7 +71726,7 @@ var globTool = {
 
 // src/tools/grep/index.ts
 import { readFileSync as readFileSync11, readdirSync as readdirSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join10, relative as relative3, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join9, relative as relative3, resolve as resolve7 } from "node:path";
 var grepInputSchema = object({
   pattern: string2().describe("The regex or text pattern to search for across files."),
   path: string2().optional().describe("Target directory or file path to search. Defaults to current directory."),
@@ -71757,7 +71755,7 @@ function searchInDir(dir, baseDir, regex, fileFilter, results, filesWithMatches,
     for (const entry of entries) {
       if (results.length >= limit)
         break;
-      const fullPath = join10(dir, entry.name);
+      const fullPath = join9(dir, entry.name);
       if (entry.isDirectory()) {
         if (!IGNORED_DIRS2.has(entry.name)) {
           searchInDir(fullPath, baseDir, regex, fileFilter, results, filesWithMatches, limit);
@@ -71803,7 +71801,13 @@ var grepTool = {
   },
   execute: async (args, context) => {
     const startTime = Date.now();
-    const searchRoot = args.path ? isAbsolute4(args.path) ? args.path : resolve7(context.cwd, args.path) : context.cwd;
+    const searchRoot = args.path ? isAbsolute4(args.path) ? resolve7(args.path) : resolve7(context.cwd, args.path) : context.cwd;
+    const normCwd = resolve7(context.cwd);
+    const normTarget = resolve7(searchRoot);
+    const prefix = normCwd.endsWith("/") ? normCwd : `${normCwd}/`;
+    if (normTarget !== normCwd && !normTarget.startsWith(prefix)) {
+      throw new Error(`Access denied: path "${args.path}" resolves outside the trusted workspace root ("${context.cwd}").`);
+    }
     const limit = args.limit ?? 100;
     const isCaseSensitive = args.case_sensitive ?? false;
     const flags = isCaseSensitive ? "" : "i";
@@ -71858,7 +71862,7 @@ var grepTool = {
 
 // src/tools/list-dir/index.ts
 import { readdirSync as readdirSync4, statSync as statSync5 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join11, resolve as resolve8 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join10, resolve as resolve8 } from "node:path";
 var listDirInputSchema = object({
   path: string2().optional().describe("Directory path to list. Defaults to current working directory."),
   recursive: boolean2().optional().describe("If true, lists files recursively (depth 2). Defaults to false.")
@@ -71875,7 +71879,13 @@ var listDirTool = {
     return `Listed ${files} file${files === 1 ? "" : "s"}, ${dirs} director${dirs === 1 ? "y" : "ies"}`;
   },
   execute: async (args, context) => {
-    const targetPath = args.path ? isAbsolute5(args.path) ? args.path : resolve8(context.cwd, args.path) : context.cwd;
+    const targetPath = args.path ? isAbsolute5(args.path) ? resolve8(args.path) : resolve8(context.cwd, args.path) : context.cwd;
+    const normCwd = resolve8(context.cwd);
+    const normTarget = resolve8(targetPath);
+    const prefix = normCwd.endsWith("/") ? normCwd : `${normCwd}/`;
+    if (normTarget !== normCwd && !normTarget.startsWith(prefix)) {
+      throw new Error(`Access denied: path "${args.path}" resolves outside the trusted workspace root ("${context.cwd}").`);
+    }
     const rawEntries = readdirSync4(targetPath, { withFileTypes: true });
     const entries = [];
     let fileCount = 0;
@@ -71892,7 +71902,7 @@ var listDirTool = {
         type = "file";
         fileCount++;
         try {
-          sizeBytes = statSync5(join11(targetPath, entry.name)).size;
+          sizeBytes = statSync5(join10(targetPath, entry.name)).size;
         } catch {}
       } else {
         fileCount++;
@@ -71960,7 +71970,7 @@ import { rmSync as rmSync3 } from "node:fs";
 // src/services/tasks/process.ts
 import { spawn } from "node:child_process";
 import { createWriteStream, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join11 } from "node:path";
 import { tmpdir, homedir as homedir4 } from "node:os";
 
 // src/services/tasks/shell.ts
@@ -72008,16 +72018,16 @@ class ShellExecution {
     this.command = options.command;
     this.cwd = options.cwd;
     this.startedAt = new Date().toISOString();
-    const taskDir = join12(homedir4(), ".steward", "tasks", options.sessionId || "default");
+    const taskDir = join11(homedir4(), ".steward", "tasks", options.sessionId || "default");
     try {
       mkdirSync8(taskDir, { recursive: true });
     } catch {
-      const fallbackDir = join12(tmpdir(), "steward-tasks");
+      const fallbackDir = join11(tmpdir(), "steward-tasks");
       mkdirSync8(fallbackDir, { recursive: true });
-      this.outputPath = join12(fallbackDir, `${this.taskId}.log`);
+      this.outputPath = join11(fallbackDir, `${this.taskId}.log`);
       return;
     }
-    this.outputPath = join12(taskDir, `${this.taskId}.log`);
+    this.outputPath = join11(taskDir, `${this.taskId}.log`);
   }
   get status() {
     switch (this.state) {
@@ -72534,27 +72544,38 @@ async function evaluateBashPermission(req, context) {
 
 // src/tools/bash/index.ts
 var bashInputSchema = object({
-  command: string2().min(1).describe("The command to execute in the system shell."),
-  explanation: string2().min(1).max(240).describe("Brief sentence explaining why this command is needed (displayed in permission prompt).")
+  command: string2({
+    required_error: "command is required"
+  }).min(1, "command cannot be empty").describe("The command to execute in the system shell."),
+  explanation: string2({
+    required_error: "An explanation is mandatory for running a bash command.",
+    invalid_type_error: "explanation must be a string."
+  }).min(1, "An explanation is mandatory for running a bash command.").max(240).describe("Mandatory brief sentence explaining why this command is needed and what it does (displayed in permission prompt).")
 });
 var bashTool = {
   name: "bash",
   displayName: "Bash",
-  description: "Executes a command in the platform shell. Commands that exceed the foreground limit (~12s) automatically continue as background shell tasks. Use task_read, task_send_input, and task_kill to manage background tasks. Note: Bash commands are NOT tracked by the file checkpoint system (/rewind).",
+  description: "Executes a command in the platform shell. An explanation of what the command does and why it is needed is MANDATORY. Commands that exceed the foreground limit (~12s) automatically continue as background shell tasks. Use task_read, task_send_input, and task_kill to manage background tasks. Note: Bash commands are NOT tracked by the file checkpoint system (/rewind).",
   parameters: bashInputSchema,
   confirmationPolicy: "never",
+  summarizeArgs: (args) => {
+    return args.command ?? "";
+  },
   summarize: (_args, result) => {
     if (result && "status" in result && result.status === "backgrounded") {
       return `Moved to background · task id: ${result.taskId}`;
     }
-    const code = result?.exitCode ?? 0;
+    const code = result && "exitCode" in result ? result.exitCode : 0;
     return `Ran successfully · exit code: ${code}`;
   },
   execute: async (args, context) => {
-    const command = args.command.trim();
-    const explanation = args.explanation.trim();
+    const command = typeof args?.command === "string" ? args.command.trim() : "";
+    if (!command) {
+      throw new Error("Command is required and cannot be empty.");
+    }
+    const explanation = typeof args?.explanation === "string" ? args.explanation.trim() : "";
     if (!explanation) {
-      throw new Error("An explanation is required for running a bash command.");
+      throw new Error("An explanation is mandatory for running a bash command.");
     }
     const perm = await evaluateBashPermission({ command, explanation }, context);
     if (!perm.allowed) {
@@ -72676,10 +72697,34 @@ var taskKillTool = {
     return context.shellTasks.kill(args.task_id);
   }
 };
+
+// src/tools/task-list/index.ts
+var taskListInputSchema = object({});
+var taskListTool = {
+  name: "task_list",
+  displayName: "Task List",
+  description: "Lists all currently tracked background shell tasks along with their IDs, statuses, commands, and exit codes.",
+  parameters: taskListInputSchema,
+  confirmationPolicy: "never",
+  summarize: (_args, result) => {
+    const count = result?.total ?? 0;
+    return `Listed ${count} background task${count === 1 ? "" : "s"}`;
+  },
+  execute: async (_args, context) => {
+    if (!context.shellTasks) {
+      throw new Error("No shell tasks manager available in execution context.");
+    }
+    const tasks = context.shellTasks.list();
+    return {
+      tasks,
+      total: tasks.length
+    };
+  }
+};
 // package.json
 var package_default = {
   name: "steward-cli",
-  version: "0.12.0",
+  version: "0.14.0",
   description: "Interactive AI engineering assistant for the terminal with human-in-the-loop control across local and frontier models.",
   author: "sapirrior",
   license: "MIT",
@@ -72896,6 +72941,727 @@ var webSearchTool = {
     };
   }
 };
+// src/services/todos/store.ts
+import {
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync12,
+  renameSync as renameSync6,
+  unlinkSync as unlinkSync6,
+  writeFileSync as writeFileSync3,
+  openSync as openSync7,
+  fsyncSync as fsyncSync6,
+  closeSync as closeSync7
+} from "node:fs";
+import { join as join12 } from "node:path";
+import { randomUUID as randomUUID6 } from "node:crypto";
+
+// src/config/env.ts
+var ALL_PROVIDER_NAMES = [
+  "gemini",
+  "anthropic",
+  "openai",
+  "xai",
+  "mistral",
+  "deepseek",
+  "openrouter",
+  "custom"
+];
+function getEnvConfig() {
+  const geminiApiKey = process.env["GEMINI_API_KEY"]?.trim() || process.env["GOOGLE_GENERATIVE_AI_API_KEY"]?.trim() || undefined;
+  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || undefined;
+  const openaiApiKey = process.env["OPENAI_API_KEY"]?.trim() || undefined;
+  const xaiApiKey = process.env["XAI_API_KEY"]?.trim() || undefined;
+  const mistralApiKey = process.env["MISTRAL_API_KEY"]?.trim() || undefined;
+  const deepseekApiKey = process.env["DEEPSEEK_API_KEY"]?.trim() || undefined;
+  const openrouterApiKey = process.env["OPENROUTER_API_KEY"]?.trim() || undefined;
+  const customApiKey = process.env["CUSTOM_API_KEY"]?.trim() || undefined;
+  const customApiModelName = process.env["CUSTOM_API_MODEL_NAME"]?.trim() || undefined;
+  const customApiUrl = process.env["CUSTOM_API_URL"]?.trim() || undefined;
+  return {
+    geminiApiKey,
+    anthropicApiKey,
+    openaiApiKey,
+    xaiApiKey,
+    mistralApiKey,
+    deepseekApiKey,
+    openrouterApiKey,
+    custom: {
+      apiKey: customApiKey,
+      modelName: customApiModelName,
+      baseURL: customApiUrl
+    }
+  };
+}
+function hasProviderConfig(provider, config = getEnvConfig()) {
+  switch (provider) {
+    case "gemini":
+      return Boolean(config.geminiApiKey);
+    case "anthropic":
+      return Boolean(config.anthropicApiKey);
+    case "openai":
+      return Boolean(config.openaiApiKey);
+    case "xai":
+      return Boolean(config.xaiApiKey);
+    case "mistral":
+      return Boolean(config.mistralApiKey);
+    case "deepseek":
+      return Boolean(config.deepseekApiKey);
+    case "openrouter":
+      return Boolean(config.openrouterApiKey);
+    case "custom":
+      return Boolean(config.custom.baseURL && config.custom.modelName);
+  }
+}
+function getAvailableProviders(config = getEnvConfig()) {
+  const providers = [];
+  if (hasProviderConfig("gemini", config))
+    providers.push("gemini");
+  if (hasProviderConfig("anthropic", config))
+    providers.push("anthropic");
+  if (hasProviderConfig("openai", config))
+    providers.push("openai");
+  if (hasProviderConfig("xai", config))
+    providers.push("xai");
+  if (hasProviderConfig("mistral", config))
+    providers.push("mistral");
+  if (hasProviderConfig("deepseek", config))
+    providers.push("deepseek");
+  if (hasProviderConfig("openrouter", config))
+    providers.push("openrouter");
+  if (hasProviderConfig("custom", config))
+    providers.push("custom");
+  return providers;
+}
+// src/services/todos/store.ts
+var VALID_STATUSES = [
+  "pending",
+  "in_progress",
+  "completed",
+  "cancelled",
+  "blocked"
+];
+var MIN_ITEMS = 2;
+var MAX_ITEMS = 10;
+
+class SessionLockQueue {
+  queues = new Map;
+  async runExclusive(sessionId, task) {
+    const prev = this.queues.get(sessionId) ?? Promise.resolve();
+    let release;
+    const current = new Promise((resolve) => {
+      release = resolve;
+    });
+    this.queues.set(sessionId, prev.then(() => current, () => current));
+    try {
+      await prev;
+      return await task();
+    } finally {
+      release();
+      if (this.queues.get(sessionId) === current) {
+        this.queues.delete(sessionId);
+      }
+    }
+  }
+}
+var sessionLocks = new SessionLockQueue;
+function sanitizeSessionId(sessionId) {
+  if (!sessionId || typeof sessionId !== "string") {
+    throw new Error("Invalid sessionId: must be a non-empty string");
+  }
+  const clean = sessionId.trim();
+  if (!clean || clean.includes("..") || clean.includes("/") || clean.includes("\\")) {
+    throw new Error(`Invalid sessionId for path resolution: "${sessionId}"`);
+  }
+  return clean;
+}
+function getSessionTodosDir(sessionId) {
+  const safeId = sanitizeSessionId(sessionId);
+  return join12(getSettingsDir(), "todos", safeId);
+}
+function getSessionTodosFilePath(sessionId) {
+  return join12(getSessionTodosDir(sessionId), "todos.json");
+}
+function validateTodoList(todos) {
+  if (!Array.isArray(todos)) {
+    throw new Error("Invalid todos format: expected an array of todo items");
+  }
+  if (todos.length < MIN_ITEMS || todos.length > MAX_ITEMS) {
+    throw new Error(`Todo list must contain between ${MIN_ITEMS} and ${MAX_ITEMS} items (received ${todos.length})`);
+  }
+  const seenIds = new Set;
+  let inProgressCount = 0;
+  const validated = [];
+  for (let i = 0;i < todos.length; i++) {
+    const item = todos[i];
+    if (!item || typeof item !== "object") {
+      throw new Error(`Invalid todo at index ${i}: item must be an object`);
+    }
+    const { id, description, status } = item;
+    if (typeof id !== "string" || !id.trim()) {
+      throw new Error(`Invalid todo at index ${i}: id must be a non-empty string`);
+    }
+    const trimmedId = id.trim();
+    if (seenIds.has(trimmedId)) {
+      throw new Error(`Duplicate todo id "${trimmedId}" at index ${i}`);
+    }
+    seenIds.add(trimmedId);
+    if (typeof description !== "string" || !description.trim()) {
+      throw new Error(`Invalid todo at index ${i} (${trimmedId}): description must be a non-empty string`);
+    }
+    if (typeof status !== "string" || !VALID_STATUSES.includes(status)) {
+      throw new Error(`Invalid todo at index ${i} (${trimmedId}): status must be one of ${VALID_STATUSES.join(", ")} (got "${status}")`);
+    }
+    if (status === "in_progress") {
+      inProgressCount++;
+    }
+    validated.push({
+      id: trimmedId,
+      description: description.trim(),
+      status
+    });
+  }
+  if (inProgressCount > 1) {
+    throw new Error(`At most 1 todo item can be 'in_progress' at any time (found ${inProgressCount} in_progress items)`);
+  }
+  return validated;
+}
+async function readTodoList(sessionId) {
+  const filePath = getSessionTodosFilePath(sessionId);
+  if (!existsSync13(filePath)) {
+    return null;
+  }
+  const raw = readFileSync12(filePath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Corrupted todo state for session "${sessionId}": failed to parse JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Corrupted todo state for session "${sessionId}": root must be an object`);
+  }
+  const record = parsed;
+  if (record.schemaVersion !== 1) {
+    throw new Error(`Unsupported todo schemaVersion "${record.schemaVersion}" (expected 1) for session "${sessionId}"`);
+  }
+  if (typeof record.sessionId !== "string") {
+    throw new Error(`Invalid todo state for session "${sessionId}": missing or invalid sessionId`);
+  }
+  const validatedTodos = validateTodoList(record.todos);
+  return {
+    schemaVersion: 1,
+    sessionId: record.sessionId,
+    updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : new Date().toISOString(),
+    todos: validatedTodos
+  };
+}
+async function writeTodoList(sessionId, todos) {
+  return sessionLocks.runExclusive(sessionId, async () => {
+    const validated = validateTodoList(todos);
+    const safeSessionId = sanitizeSessionId(sessionId);
+    const dir = getSessionTodosDir(safeSessionId);
+    if (!existsSync13(dir)) {
+      mkdirSync9(dir, { recursive: true, mode: 448 });
+    }
+    const payload = {
+      schemaVersion: 1,
+      sessionId: safeSessionId,
+      updatedAt: new Date().toISOString(),
+      todos: validated
+    };
+    const targetPath = getSessionTodosFilePath(safeSessionId);
+    const tempPath = join12(dir, `.todos.${randomUUID6()}.tmp`);
+    const jsonStr = JSON.stringify(payload, null, 2) + `
+`;
+    try {
+      writeFileSync3(tempPath, jsonStr, { encoding: "utf-8", mode: 384 });
+      const fd = openSync7(tempPath, "r");
+      try {
+        fsyncSync6(fd);
+      } finally {
+        closeSync7(fd);
+      }
+      renameSync6(tempPath, targetPath);
+    } catch (err) {
+      try {
+        if (existsSync13(tempPath)) {
+          unlinkSync6(tempPath);
+        }
+      } catch {}
+      throw err;
+    }
+    return payload;
+  });
+}
+async function updateTodoItem(sessionId, todoId, updates) {
+  return sessionLocks.runExclusive(sessionId, async () => {
+    if (!todoId || typeof todoId !== "string" || !todoId.trim()) {
+      throw new Error("todoId must be a non-empty string");
+    }
+    const targetId = todoId.trim();
+    const current = await readTodoList(sessionId);
+    if (!current) {
+      throw new Error(`No todo list found for session "${sessionId}". Create one first with TodoWrite.`);
+    }
+    const itemIndex = current.todos.findIndex((t) => t.id === targetId);
+    if (itemIndex === -1) {
+      throw new Error(`Todo item with id "${targetId}" not found in current session todo list`);
+    }
+    if (updates.status === undefined && updates.description === undefined) {
+      throw new Error("At least one of status or description must be provided for update");
+    }
+    const currentItem = current.todos[itemIndex];
+    const newStatus = updates.status !== undefined ? updates.status : currentItem.status;
+    const newDescription = updates.description !== undefined ? updates.description.trim() : currentItem.description;
+    if (!newDescription) {
+      throw new Error("Updated description cannot be empty");
+    }
+    const updatedTodos = current.todos.map((item, idx) => {
+      if (idx !== itemIndex) {
+        return item;
+      }
+      return {
+        ...item,
+        status: newStatus,
+        description: newDescription
+      };
+    });
+    const validated = validateTodoList(updatedTodos);
+    const safeSessionId = sanitizeSessionId(sessionId);
+    const dir = getSessionTodosDir(safeSessionId);
+    if (!existsSync13(dir)) {
+      mkdirSync9(dir, { recursive: true, mode: 448 });
+    }
+    const payload = {
+      schemaVersion: 1,
+      sessionId: safeSessionId,
+      updatedAt: new Date().toISOString(),
+      todos: validated
+    };
+    const targetPath = getSessionTodosFilePath(safeSessionId);
+    const tempPath = join12(dir, `.todos.${randomUUID6()}.tmp`);
+    const jsonStr = JSON.stringify(payload, null, 2) + `
+`;
+    try {
+      writeFileSync3(tempPath, jsonStr, { encoding: "utf-8", mode: 384 });
+      const fd = openSync7(tempPath, "r");
+      try {
+        fsyncSync6(fd);
+      } finally {
+        closeSync7(fd);
+      }
+      renameSync6(tempPath, targetPath);
+    } catch (err) {
+      try {
+        if (existsSync13(tempPath)) {
+          unlinkSync6(tempPath);
+        }
+      } catch {}
+      throw err;
+    }
+    return payload;
+  });
+}
+// src/tools/todo-write/index.ts
+var todoItemSchema = object({
+  id: string2().min(1, "id is required").describe("Unique identifier for the todo item"),
+  description: string2().min(1, "description is required").describe("Clear description of the task"),
+  status: _enum(["pending", "in_progress", "completed", "cancelled", "blocked"]).describe("Current status of the todo item")
+});
+var todoWriteParamsSchema = object({
+  todos: array(todoItemSchema).min(2, "Todo list must contain at least 2 items").max(10, "Todo list must contain at most 10 items").describe("Complete list of 2 to 10 todo items establishing the execution plan")
+});
+function formatTodoCheckbox(status) {
+  switch (status) {
+    case "completed":
+      return "[x]";
+    case "in_progress":
+      return `[${figures.sliderPointer}]`;
+    case "cancelled":
+      return `[${figures.cross}]`;
+    case "blocked":
+      return `[${figures.warning}]`;
+    case "pending":
+    default:
+      return "[ ]";
+  }
+}
+function formatTodoListSummary(todos, maxItems = 10) {
+  const visible = todos.slice(0, maxItems);
+  const hiddenCount = todos.length - visible.length;
+  const lines = visible.map((t, i) => `${i + 1}. ${formatTodoCheckbox(t.status)} ${t.description}`);
+  if (hiddenCount > 0) {
+    lines.push(`… and ${hiddenCount} more`);
+  }
+  return lines.join(`
+`);
+}
+var todoWriteTool = {
+  name: "todo_write",
+  displayName: "TodoWrite",
+  icon: "\uD83D\uDCDD",
+  description: "Initializes or replaces the current session todo list with 2 to 10 items. Use this to establish or replace the multi-step execution plan for the session.",
+  parameters: todoWriteParamsSchema,
+  summarizeArgs(args) {
+    if (!args.todos || args.todos.length === 0)
+      return "";
+    if (args.todos.length <= 2) {
+      return args.todos.map((t) => `"${t.description}"`).join(", ");
+    }
+    return `"${args.todos[0]?.description}", "${args.todos[1]?.description}", +${args.todos.length - 2} more`;
+  },
+  async execute(args, context) {
+    if (!context.sessionId) {
+      throw new Error("TodoWrite requires an active session ID in ToolContext");
+    }
+    return writeTodoList(context.sessionId, args.todos);
+  },
+  summarize(args, result) {
+    const list = result?.todos ?? args.todos;
+    const total = list.length;
+    const header = `Added ${total} todos`;
+    const details = formatTodoListSummary(list);
+    return `${header}
+${details}`;
+  }
+};
+
+// src/tools/todo-update/index.ts
+var todoUpdateParamsSchema = object({
+  id: string2().min(1, "id is required").describe("ID of the existing todo item to update"),
+  status: _enum(["pending", "in_progress", "completed", "cancelled", "blocked"]).optional().describe("New status for the todo item"),
+  description: string2().min(1).optional().describe("Updated description for the todo item")
+});
+function formatTodoCheckbox2(status) {
+  switch (status) {
+    case "completed":
+      return "[x]";
+    case "in_progress":
+      return `[${figures.sliderPointer}]`;
+    case "cancelled":
+      return `[${figures.cross}]`;
+    case "blocked":
+      return `[${figures.warning}]`;
+    case "pending":
+    default:
+      return "[ ]";
+  }
+}
+function formatTodoListSummary2(todos, maxItems = 10) {
+  const visible = todos.slice(0, maxItems);
+  const hiddenCount = todos.length - visible.length;
+  const lines = visible.map((t, i) => `${i + 1}. ${formatTodoCheckbox2(t.status)} ${t.description}`);
+  if (hiddenCount > 0) {
+    lines.push(`… and ${hiddenCount} more`);
+  }
+  return lines.join(`
+`);
+}
+var todoUpdateTool = {
+  name: "todo_update",
+  displayName: "TodoUpdate",
+  icon: "✓",
+  description: "Updates a single todo item status or description in the current session. Cannot create new items or update multiple items at once.",
+  parameters: todoUpdateParamsSchema,
+  summarizeArgs(args) {
+    const parts = [`id: "${args.id}"`];
+    if (args.status)
+      parts.push(`status: "${args.status}"`);
+    if (args.description)
+      parts.push(`desc: "${args.description}"`);
+    return parts.join(", ");
+  },
+  async execute(args, context) {
+    if (!context.sessionId) {
+      throw new Error("TodoUpdate requires an active session ID in ToolContext");
+    }
+    return updateTodoItem(context.sessionId, args.id, {
+      status: args.status,
+      description: args.description
+    });
+  },
+  summarize(args, result) {
+    if (!result || !result.todos) {
+      return `Todo ${args.id} updated`;
+    }
+    const total = result.todos.length;
+    const completed = result.todos.filter((t) => t.status === "completed").length;
+    const updatedItem = result.todos.find((t) => t.id === args.id);
+    const statusText = updatedItem?.status ?? args.status ?? "updated";
+    const header = `Todo ${args.id} ${statusText} · ${completed}/${total} done`;
+    const details = formatTodoListSummary2(result.todos);
+    return `${header}
+${details}`;
+  }
+};
+
+// src/tools/todo-read/index.ts
+var todoReadParamsSchema = object({});
+function formatTodoCheckbox3(status) {
+  switch (status) {
+    case "completed":
+      return "[x]";
+    case "in_progress":
+      return `[${figures.sliderPointer}]`;
+    case "cancelled":
+      return `[${figures.cross}]`;
+    case "blocked":
+      return `[${figures.warning}]`;
+    case "pending":
+    default:
+      return "[ ]";
+  }
+}
+function formatTodoListSummary3(todos, maxItems = 10) {
+  const visible = todos.slice(0, maxItems);
+  const hiddenCount = todos.length - visible.length;
+  const lines = visible.map((t, i) => `${i + 1}. ${formatTodoCheckbox3(t.status)} ${t.description}`);
+  if (hiddenCount > 0) {
+    lines.push(`… and ${hiddenCount} more`);
+  }
+  return lines.join(`
+`);
+}
+var todoReadTool = {
+  name: "todo_read",
+  displayName: "TodoRead",
+  icon: "\uD83D\uDCCB",
+  description: "Reads the current session todo list without modifying it. Returns an empty result if no todos have been established yet.",
+  parameters: todoReadParamsSchema,
+  summarizeArgs() {
+    return "";
+  },
+  async execute(_args, context) {
+    if (!context.sessionId) {
+      throw new Error("TodoRead requires an active session ID in ToolContext");
+    }
+    const list = await readTodoList(context.sessionId);
+    if (!list) {
+      return {
+        hasTodos: false,
+        todos: [],
+        message: "No todos currently established for this session."
+      };
+    }
+    return {
+      hasTodos: true,
+      todos: list.todos,
+      updatedAt: list.updatedAt
+    };
+  },
+  summarize(_args, result) {
+    if (!result || !result.hasTodos || result.todos.length === 0) {
+      return "No active todos";
+    }
+    const total = result.todos.length;
+    const completed = result.todos.filter((t) => t.status === "completed").length;
+    const active = result.todos.find((t) => t.status === "in_progress");
+    const header = active ? `Todos ${completed}/${total} done · ▶ ${active.description}` : `Todos ${completed}/${total} done`;
+    const details = formatTodoListSummary3(result.todos);
+    return `${header}
+${details}`;
+  }
+};
+// src/skills/discovery.ts
+import { existsSync as existsSync14, readdirSync as readdirSync5, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { isAbsolute as isAbsolute6, join as join13, normalize, resolve as resolve9, sep as sep4 } from "node:path";
+var MAX_SKILL_FILE_SIZE = 64 * 1024;
+function parseSkillFrontmatter(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match || !match[1]) {
+    return null;
+  }
+  const rawYaml = match[1];
+  const lines = rawYaml.split(/\r?\n/);
+  const result = {};
+  let currentKey = null;
+  let descriptionLines = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const keyMatch = line.match(/^([a-zA-Z0-9_-]+):\s*(.*)$/);
+    if (keyMatch && keyMatch[1]) {
+      const key = keyMatch[1].toLowerCase();
+      const val = (keyMatch[2] ?? "").trim();
+      if (key === "name") {
+        currentKey = "name";
+        result.name = unquote(val);
+      } else if (key === "description") {
+        currentKey = "description";
+        if (val === ">" || val === ">-" || val === "|" || val === "|-") {
+          descriptionLines = [];
+        } else if (val) {
+          descriptionLines = [unquote(val)];
+        } else {
+          descriptionLines = [];
+        }
+      } else {
+        currentKey = null;
+      }
+    } else if (currentKey === "description" && (line.startsWith("  ") || line.startsWith("\t"))) {
+      descriptionLines.push(trimmed);
+    }
+  }
+  if (descriptionLines.length > 0) {
+    result.description = descriptionLines.join(" ").trim();
+  }
+  return result;
+}
+function unquote(str) {
+  const trimmed = str.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function discoverSkills(cwd = process.cwd()) {
+  const targets = [
+    { dir: join13(cwd, ".agents", "skills"), source: "workspace" },
+    { dir: join13(homedir5(), ".agents", "skills"), source: "user-agents" },
+    { dir: join13(homedir5(), ".steward", "skills"), source: "user-steward" }
+  ];
+  const skillMap = new Map;
+  for (const target of targets) {
+    if (!existsSync14(target.dir)) {
+      continue;
+    }
+    try {
+      const entries = readdirSync5(target.dir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory())
+          continue;
+        const skillDir = join13(target.dir, entry.name);
+        const skillMdPath = join13(skillDir, "SKILL.md");
+        const fallbackMdPath = join13(skillDir, "skill.md");
+        const resolvedFile = existsSync14(skillMdPath) ? skillMdPath : existsSync14(fallbackMdPath) ? fallbackMdPath : null;
+        if (!resolvedFile)
+          continue;
+        try {
+          const raw = readFileSync13(resolvedFile, "utf-8");
+          const frontmatter = parseSkillFrontmatter(raw);
+          const skillName = frontmatter?.name || entry.name;
+          const description = frontmatter?.description || "No description provided.";
+          if (!skillMap.has(skillName)) {
+            skillMap.set(skillName, {
+              name: skillName,
+              description,
+              filePath: resolvedFile,
+              dirPath: skillDir,
+              source: target.source
+            });
+          }
+        } catch {}
+      }
+    } catch {}
+  }
+  return Array.from(skillMap.values());
+}
+function getSkill(name, cwd = process.cwd()) {
+  const cleanName = name.trim();
+  const all = discoverSkills(cwd);
+  return all.find((s) => s.name.toLowerCase() === cleanName.toLowerCase()) ?? null;
+}
+function readSkillResource(name, relativePath, cwd = process.cwd(), maxBytes = MAX_SKILL_FILE_SIZE) {
+  const skill = getSkill(name, cwd);
+  if (!skill) {
+    throw new Error(`Skill "${name}" not found`);
+  }
+  let targetFilePath;
+  if (!relativePath || !relativePath.trim()) {
+    targetFilePath = skill.filePath;
+  } else {
+    const trimmedPath = relativePath.trim();
+    if (isAbsolute6(trimmedPath)) {
+      throw new Error(`Invalid skill resource path: absolute paths are not permitted (${trimmedPath})`);
+    }
+    const normalizedRelative = normalize(trimmedPath);
+    if (normalizedRelative.startsWith("..") || normalizedRelative.includes(`${sep4}..`)) {
+      throw new Error(`Invalid skill resource path: directory traversal ("..") is forbidden (${trimmedPath})`);
+    }
+    targetFilePath = resolve9(skill.dirPath, normalizedRelative);
+    const resolvedDir = resolve9(skill.dirPath);
+    if (!targetFilePath.startsWith(resolvedDir + sep4) && targetFilePath !== resolvedDir) {
+      throw new Error(`Resource "${trimmedPath}" resolves outside skill directory`);
+    }
+  }
+  if (!existsSync14(targetFilePath)) {
+    throw new Error(`Skill resource file "${targetFilePath}" does not exist`);
+  }
+  const stat = statSync6(targetFilePath);
+  if (!stat.isFile()) {
+    throw new Error(`Skill resource path "${targetFilePath}" is not a regular file`);
+  }
+  if (stat.size > maxBytes) {
+    throw new Error(`Skill resource file exceeds size limit of ${maxBytes} bytes (file is ${stat.size} bytes)`);
+  }
+  const content = readFileSync13(targetFilePath, "utf-8");
+  return {
+    name: skill.name,
+    description: skill.description,
+    source: skill.source,
+    resourcePath: targetFilePath,
+    content
+  };
+}
+// src/tools/skill-list/index.ts
+var skillListParamsSchema = object({});
+var skillListTool = {
+  name: "skill_list",
+  displayName: "SkillList",
+  icon: "\uD83D\uDCA1",
+  description: "Discovers and lists all available specialized skills and their descriptions. Use this when you need specialized domain knowledge or workflows.",
+  parameters: skillListParamsSchema,
+  summarizeArgs() {
+    return "";
+  },
+  async execute(_args, context) {
+    const cwd = context?.cwd ?? process.cwd();
+    const skills = discoverSkills(cwd);
+    return skills.map((s) => ({
+      name: s.name,
+      description: s.description,
+      source: s.source
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  },
+  summarize(_args, result) {
+    const count = result?.length ?? 0;
+    if (count === 0) {
+      return "Discovered 0 skills";
+    }
+    return `Discovered ${count} skill${count === 1 ? "" : "s"}`;
+  }
+};
+
+// src/tools/skill-read/index.ts
+var skillReadParamsSchema = object({
+  name: string2().min(1, "Skill name is required"),
+  path: string2().optional()
+});
+var skillReadTool = {
+  name: "skill_read",
+  displayName: "SkillRead",
+  icon: "\uD83D\uDCD6",
+  description: "Loads and reads the instructions (SKILL.md) or a relative resource file of a specialized skill by name. Use this when a task requires specialized guidelines.",
+  parameters: skillReadParamsSchema,
+  summarizeArgs(args) {
+    if (args.path) {
+      return `name="${args.name}" path="${args.path}"`;
+    }
+    return `name="${args.name}"`;
+  },
+  async execute(args, context) {
+    const cwd = context?.cwd ?? process.cwd();
+    return readSkillResource(args.name, args.path, cwd);
+  },
+  summarize(args, result) {
+    const target = args.path ? `${args.name}/${args.path}` : args.name;
+    const len = result?.content ? ` (${result.content.length} bytes)` : "";
+    return `SkillRead: ${target}${len}`;
+  }
+};
 
 // src/tools/index.ts
 var builtInTools = [
@@ -72907,11 +73673,17 @@ var builtInTools = [
   listDirTool,
   sleepTool,
   bashTool,
+  taskListTool,
   taskReadTool,
   taskSendInputTool,
   taskKillTool,
   webFetchTool,
-  webSearchTool
+  webSearchTool,
+  todoWriteTool,
+  todoUpdateTool,
+  todoReadTool,
+  skillListTool,
+  skillReadTool
 ];
 for (const tool of builtInTools) {
   defaultToolCatalog.register(tool);
@@ -72953,6 +73725,7 @@ var MAX_RETAINED_TERMINAL_TASKS = 50;
 class ShellTaskManager {
   tasks = new Map;
   terminalTimestamps = new Map;
+  evictedTaskReasons = new Map;
   isShuttingDown = false;
   generateTaskId() {
     return `task-${randomBytes(4).toString("hex")}`;
@@ -72986,7 +73759,7 @@ class ShellTaskManager {
     this.evictExpiredTasks();
     const exec = this.tasks.get(taskId);
     if (!exec) {
-      throw new Error(`Task "${taskId}" not found or expired.`);
+      throw this.getTaskNotFoundError(taskId);
     }
     const rawOutput = exec.getRecentOutput();
     const { preview, truncated } = boundResultText(rawOutput);
@@ -73007,7 +73780,7 @@ class ShellTaskManager {
     this.evictExpiredTasks();
     const exec = this.tasks.get(taskId);
     if (!exec) {
-      throw new Error(`Task "${taskId}" not found or expired.`);
+      throw this.getTaskNotFoundError(taskId);
     }
     if (!exec.isRunning) {
       throw new Error(`Task "${taskId}" is not running (status: ${exec.status}).`);
@@ -73028,7 +73801,7 @@ class ShellTaskManager {
     this.evictExpiredTasks();
     const exec = this.tasks.get(taskId);
     if (!exec) {
-      throw new Error(`Task "${taskId}" not found or expired.`);
+      throw this.getTaskNotFoundError(taskId);
     }
     if (exec.isRunning) {
       await exec.kill();
@@ -73102,6 +73875,7 @@ class ShellTaskManager {
         }
         this.tasks.delete(id);
         this.terminalTimestamps.delete(id);
+        this.recordEviction(id, "expired due to 10-minute retention TTL");
       }
     }
     const remainingTerminal = Array.from(this.terminalTimestamps.entries()).sort((a, b) => a[1] - b[1]);
@@ -73115,86 +73889,25 @@ class ShellTaskManager {
       }
       this.tasks.delete(oldestId);
       this.terminalTimestamps.delete(oldestId);
+      this.recordEviction(oldestId, "evicted due to task capacity limit (50 tasks max)");
     }
   }
-}
-
-// src/config/env.ts
-var ALL_PROVIDER_NAMES = [
-  "gemini",
-  "anthropic",
-  "openai",
-  "xai",
-  "mistral",
-  "deepseek",
-  "openrouter",
-  "custom"
-];
-function getEnvConfig() {
-  const geminiApiKey = process.env["GEMINI_API_KEY"]?.trim() || process.env["GOOGLE_GENERATIVE_AI_API_KEY"]?.trim() || undefined;
-  const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || undefined;
-  const openaiApiKey = process.env["OPENAI_API_KEY"]?.trim() || undefined;
-  const xaiApiKey = process.env["XAI_API_KEY"]?.trim() || undefined;
-  const mistralApiKey = process.env["MISTRAL_API_KEY"]?.trim() || undefined;
-  const deepseekApiKey = process.env["DEEPSEEK_API_KEY"]?.trim() || undefined;
-  const openrouterApiKey = process.env["OPENROUTER_API_KEY"]?.trim() || undefined;
-  const customApiKey = process.env["CUSTOM_API_KEY"]?.trim() || undefined;
-  const customApiModelName = process.env["CUSTOM_API_MODEL_NAME"]?.trim() || undefined;
-  const customApiUrl = process.env["CUSTOM_API_URL"]?.trim() || undefined;
-  return {
-    geminiApiKey,
-    anthropicApiKey,
-    openaiApiKey,
-    xaiApiKey,
-    mistralApiKey,
-    deepseekApiKey,
-    openrouterApiKey,
-    custom: {
-      apiKey: customApiKey,
-      modelName: customApiModelName,
-      baseURL: customApiUrl
+  recordEviction(taskId, reason) {
+    if (this.evictedTaskReasons.size >= 100) {
+      const oldest = this.evictedTaskReasons.keys().next().value;
+      if (oldest) {
+        this.evictedTaskReasons.delete(oldest);
+      }
     }
-  };
-}
-function hasProviderConfig(provider, config = getEnvConfig()) {
-  switch (provider) {
-    case "gemini":
-      return Boolean(config.geminiApiKey);
-    case "anthropic":
-      return Boolean(config.anthropicApiKey);
-    case "openai":
-      return Boolean(config.openaiApiKey);
-    case "xai":
-      return Boolean(config.xaiApiKey);
-    case "mistral":
-      return Boolean(config.mistralApiKey);
-    case "deepseek":
-      return Boolean(config.deepseekApiKey);
-    case "openrouter":
-      return Boolean(config.openrouterApiKey);
-    case "custom":
-      return Boolean(config.custom.baseURL && config.custom.modelName);
+    this.evictedTaskReasons.set(taskId, reason);
+  }
+  getTaskNotFoundError(taskId) {
+    const reason = this.evictedTaskReasons.get(taskId);
+    if (reason) {
+      return new Error(`Task "${taskId}" was ${reason}.`);
+    }
+    return new Error(`Task "${taskId}" not found (task ID does not exist).`);
   }
-}
-function getAvailableProviders(config = getEnvConfig()) {
-  const providers = [];
-  if (hasProviderConfig("gemini", config))
-    providers.push("gemini");
-  if (hasProviderConfig("anthropic", config))
-    providers.push("anthropic");
-  if (hasProviderConfig("openai", config))
-    providers.push("openai");
-  if (hasProviderConfig("xai", config))
-    providers.push("xai");
-  if (hasProviderConfig("mistral", config))
-    providers.push("mistral");
-  if (hasProviderConfig("deepseek", config))
-    providers.push("deepseek");
-  if (hasProviderConfig("openrouter", config))
-    providers.push("openrouter");
-  if (hasProviderConfig("custom", config))
-    providers.push("custom");
-  return providers;
 }
 // src/errors/classifier.ts
 function classifyError(error) {
@@ -73340,15 +74053,15 @@ function classifyError(error) {
   };
 }
 // src/errors/logger.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync12, mkdirSync as mkdirSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { join as join13 } from "node:path";
+import { appendFileSync as appendFileSync3, existsSync as existsSync15, mkdirSync as mkdirSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join14 } from "node:path";
 var SENSITIVE_KEY_REGEX = /api[_-]?key|token|secret|password|auth|credential|bearer/i;
 function getLogsRootDir() {
   if (process.env.STEWARD_LOGS_DIR) {
     return process.env.STEWARD_LOGS_DIR;
   }
-  return join13(homedir5(), ".steward", "logs");
+  return join14(homedir6(), ".steward", "logs");
 }
 function getLogDateTime(d = new Date) {
   const year = d.getFullYear();
@@ -73432,11 +74145,11 @@ function logError(error, contextInfo) {
   try {
     const rootDir = getLogsRootDir();
     const { date, time } = getLogDateTime();
-    const dateDir = join13(rootDir, date);
-    if (!existsSync12(dateDir)) {
-      mkdirSync9(dateDir, { recursive: true });
+    const dateDir = join14(rootDir, date);
+    if (!existsSync15(dateDir)) {
+      mkdirSync10(dateDir, { recursive: true });
     }
-    const logPath = join13(dateDir, `${time}.log`);
+    const logPath = join14(dateDir, `${time}.log`);
     const structured = classifyError(error);
     const mem = process.memoryUsage ? process.memoryUsage() : undefined;
     const logEntry = {
@@ -73462,10 +74175,10 @@ function logError(error, contextInfo) {
 ` + JSON.stringify(logEntry, null, 2) + `
 
 `;
-    if (existsSync12(logPath)) {
+    if (existsSync15(logPath)) {
       appendFileSync3(logPath, formatted, "utf-8");
     } else {
-      writeFileSync3(logPath, formatted, "utf-8");
+      writeFileSync4(logPath, formatted, "utf-8");
     }
     return logPath;
   } catch {
@@ -111123,7 +111836,7 @@ function createProviderExecutedToolFactory2({
     supportsDeferredResults
   });
 }
-async function resolve9(value) {
+async function resolve10(value) {
   if (typeof value === "function") {
     value = value();
   }
@@ -116349,7 +117062,7 @@ var XaiSpeechModel = class _XaiSpeechModel {
     const { requestBody, warnings, withTimestamps } = await this.getArgs(options);
     const { value, responseHeaders, rawValue } = await postJsonToApi4({
       url: `${this.config.baseURL}/tts`,
-      headers: combineHeaders4(this.config.headers ? await resolve9(this.config.headers) : undefined, options.headers),
+      headers: combineHeaders4(this.config.headers ? await resolve10(this.config.headers) : undefined, options.headers),
       body: requestBody,
       failedResponseHandler: xaiFailedResponseHandler,
       successfulResponseHandler: withTimestamps ? createJsonResponseHandler4(xaiSpeechTimestampsResponseSchema) : createBinaryResponseHandler2(),
@@ -117156,288 +117869,59 @@ function inferProviderFromModelId(modelId) {
   }
   return null;
 }
-// src/skills/discovery.ts
-import { existsSync as existsSync13, readdirSync as readdirSync5, readFileSync as readFileSync12 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join14 } from "node:path";
-function parseSkillFrontmatter(content) {
-  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!match || !match[1]) {
-    return null;
-  }
-  const rawYaml = match[1];
-  const lines = rawYaml.split(/\r?\n/);
-  const result = {};
-  let currentKey = null;
-  let descriptionLines = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#"))
-      continue;
-    const keyMatch = line.match(/^([a-zA-Z0-9_-]+):\s*(.*)$/);
-    if (keyMatch && keyMatch[1]) {
-      const key = keyMatch[1].toLowerCase();
-      const val = (keyMatch[2] ?? "").trim();
-      if (key === "name") {
-        currentKey = "name";
-        result.name = unquote(val);
-      } else if (key === "description") {
-        currentKey = "description";
-        if (val === ">" || val === ">-" || val === "|" || val === "|-") {
-          descriptionLines = [];
-        } else if (val) {
-          descriptionLines = [unquote(val)];
-        } else {
-          descriptionLines = [];
-        }
-      } else {
-        currentKey = null;
-      }
-    } else if (currentKey === "description" && (line.startsWith("  ") || line.startsWith("\t"))) {
-      descriptionLines.push(trimmed);
-    }
-  }
-  if (descriptionLines.length > 0) {
-    result.description = descriptionLines.join(" ").trim();
-  }
-  return result;
-}
-function unquote(str) {
-  const trimmed = str.trim();
-  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
-    return trimmed.slice(1, -1);
-  }
-  return trimmed;
-}
-function discoverSkills(cwd = process.cwd()) {
-  const targets = [
-    { dir: join14(cwd, ".agents", "skills"), source: "workspace" },
-    { dir: join14(homedir6(), ".agents", "skills"), source: "user-agents" },
-    { dir: join14(homedir6(), ".steward", "skills"), source: "user-steward" }
-  ];
-  const skillMap = new Map;
-  for (const target of targets) {
-    if (!existsSync13(target.dir)) {
-      continue;
-    }
-    try {
-      const entries = readdirSync5(target.dir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory())
-          continue;
-        const skillDir = join14(target.dir, entry.name);
-        const skillMdPath = join14(skillDir, "SKILL.md");
-        const fallbackMdPath = join14(skillDir, "skill.md");
-        const resolvedFile = existsSync13(skillMdPath) ? skillMdPath : existsSync13(fallbackMdPath) ? fallbackMdPath : null;
-        if (!resolvedFile)
-          continue;
-        try {
-          const raw = readFileSync12(resolvedFile, "utf-8");
-          const frontmatter = parseSkillFrontmatter(raw);
-          const skillName = frontmatter?.name || entry.name;
-          const description = frontmatter?.description || "No description provided.";
-          if (!skillMap.has(skillName)) {
-            skillMap.set(skillName, {
-              name: skillName,
-              description,
-              filePath: resolvedFile,
-              dirPath: skillDir,
-              source: target.source
-            });
-          }
-        } catch {}
-      }
-    } catch {}
-  }
-  return Array.from(skillMap.values());
-}
-function formatSkillsForSystemPrompt(skills) {
-  if (skills.length === 0)
-    return "";
-  const list = skills.map((s) => `- ${s.name} (${s.filePath}): ${s.description}`).join(`
-`);
-  return `<skills>
-You can use specialized 'skills' to help you with complex tasks.
-
-Skills are folders of instructions, scripts, and resources that extend your capabilities for specialized tasks. Each skill folder contains a SKILL.md file with YAML frontmatter and detailed markdown instructions.
-
-Available skills:
-${list}
 
-If a skill seems relevant to your current task, you MUST read its SKILL.md instructions using read_file before proceeding.
-</skills>`;
-}
 // src/engine/system-prompt.ts
 function buildSystemPrompt(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const platform = process.platform;
-  const skills = options.skills ?? discoverSkills(cwd);
   const dateUTC = new Date().toUTCString();
-  let isAGitREPO = "no";
-  try {
-    isAGitREPO = Bun.spawnSync(["git", "status"], { cwd, stdio: ["ignore", "ignore", "ignore"] }).exitCode === 0 ? "yes" : "no";
-  } catch {
-    isAGitREPO = "no";
-  }
-  let prompt = `
-    You are an interactive CLI tool that helps users with software engineering tasks. Use the instructions below and the tools available to you to assist the user.
-
-    IMPORTANT: Assist with defensive security tasks only. Refuse to create, modify, or improve code that may be used maliciously. Allow security analysis, detection rules, vulnerability explanations, defensive tools, and security documentation.
-    NOTE: - To give feedback, users should report the issue at https://github.com/sapirrior/steward/issues
-
-    NOTE: When the user directly asks about Steward (eg 'can Steward do...', 'does Steward have...') or asks in second person (eg 'are you able...', 'can you do...', 'will you be abel to do...'), response the USER to head over to the Open-Source repo of Steward (https://github.com/sapirrior/steward/) for information related to steward and its architecture
-
-    # Tone and style
-    You should be concise, direct, and to the point.
-    You MUST answer concisely with fewer than 4 lines (not including the tool use or code generation), unless the USER asks for detail.
-    Do not add additional code explanation summary unless requested by the USER. After working on a file, just stop, rather than providing an explanation of what you did.
-    IMPORTANT: You should minimize the output tokens as much as possible while maintaining appropriate helpfulness, quality, and accuracy. Only address the specific query or task at hand, avoiding tangential information unless absolutely critical for completing the request. If you can answer in 1-4 sentences or a short paragraph, please do.
-    IMPORTANT: You should NOT answer with unnecessary preamble or postamble (such as explaining your code or summarizing your action), unless the user asks you explicitly.
-    IMPORTANT: Keep your responses short, since they will be displayed on a command line interface.
-    Answer the user's question directly, without elaboration, explanation, or details. One word answers are best. Avoid introductions, conclusions, and explanations. You MUST avoid text before/after your response, such as "The answer is <answer>.", "Here is the content of the file..." or "Based on the information provided, the answer is..." or "Here is what I will do next...". Here are some examples to demonstrate appropriate verbosity:
-
-    <example>
-    user: what is 2 + 2
-    assistant: 4
-    </example>
-
-    <example>
-    user: 4 + 4
-    assistant: 8
-    </example>
-
-    <example>
-    user: what command should I run to read the content of a specific file?
-    assistant: cat
-    </example>
-
-    <example>
-    user: what command should I run to watch files in the current directory?
-    [assistant runs the ls command through tool call to list the files in the current directory, then read docs/commands in the relevant file to find out how to watch files]
-    assistant: npm run dev
-    </example>
-
-    <example>
-    user: can you find all the TODO comments in src/
-    [assistant runs search text tool call and sees TODO comment occurance in src/foo.c at line 11 src/boo.c at 180]
-    assistant: src/foo:11 and src/boo.c:180
-    </example>
-
-    When you run a non-trivial bash command, you should explain what the command does and why you are running it, to make sure the USER understands what you are doing (this is especially very important when you are running a command that will make changes to the USER's system including file mutation).
-    Output text to communicate with the USER; all text you output outside of tool use is displayed to the USER. Only use tools to complete tasks. Never use tools like Bash or code comments as means to communicate with the USER during the session.
-    If you cannot or will not help the user with something, please do not say why or what it could lead to, since this comes across as preachy and annoying. Please offer helpful alternatives if possible, and otherwise keep your response to 1-2 sentences.
-    IMPORTANT: Only use emojis if the USER explicitly requests it. Avoid using emojis in all communication unless asked.
-    IMPORTANT: Keep your responses short, since they will be displayed on a command line interface.
-
-    # Proactiveness
-    You are allowed to be proactive, but only when the USER asks you to do something. You should strive to strike a balance between:
-    - Doing the right thing when asked, including taking actions and follow-up actions
-    - Not surprising the USER with actions you take without asking
-    For example, if the USER asks you how to approach something, you should do your best to answer their question first, and not immediately jump into taking actions.
-
-    # Following conventions
-    When making changes to files, first understand the file's code conventions. Mimic code style, use existing libraries and utilities, and follow existing patterns.
-    - NEVER assume that a given library is available, even if it is well known or. Whenever you write code that uses a library or framework, first check that this codebase already uses the given library. For example, you might look at neighboring files, or check the package.json (or cargo.toml or pyproject.toml, and so on depending on the language).
-    - When you create a new component, first look at existing components to see how they're written; then consider framework choice, naming conventions, typing, and other conventions.
-    - When you edit a piece of code, first look at the code's surrounding context (especially its imports) to understand the code's choice of frameworks and libraries. Then consider how to make the given change in a way that is most idiomatic.
-    - Always follow security best practices. Never introduce code that exposes or logs secrets and keys. Never commit secrets or keys to the repository.
-    - Always read the AI Context File / Memory File / Contributing Guidelines / readme for better understanding of the codebase, code writing styles or conventions. For example (not limited to): AGENTS.md, IMPORTANT.md, CONTRIBUTING.md, readme.txt / README.md.
-
-    # Code style
-   - IMPORTANT: DO NOT ADD **ANY** COMMENTS unless explicitly asked.
+  let prompt = `You are Steward, an interactive software-engineering agent operating in a terminal workspace. Assist the user with building, refactoring, debugging, inspecting, and verifying software.
 
-   # Tool usage policy
-   - Use the edit file and write file tools for both normal code/file changes as well as making plans and todos.
-   - When WebFetch returns a message about a redirect to a different host, immediately make a new WebFetch request with the redirect URL provided in the response.
-   - When web search returns but does not contain enough data, use the URLs from the results and WebFetch them for more detailed information.
-   - When a command moves to the background as a shell task, use task_read to inspect its status/output, task_send_input to send standard input (always include a trailing '
-' to submit a line / press Enter), and task_kill to terminate it.
+IMPORTANT: Assist with defensive security tasks only. Refuse to create, modify, or improve code intended for malicious use.
 
-   # Task Management (Planning)
-   You have access to the write file and edit file tools to help you manage and plan tasks alongside normal file/code creation. Use these tools VERY frequently to ensure that you are tracking your tasks and giving the user visibility into your progress.
-   These tools are also EXTREMELY helpful for planning tasks and for breaking down larger complex tasks into smaller steps. If you do not use this tool when planning, you may forget to do important tasks — and that is unacceptable.
-   IMPORTANT: Write plans/tasks in the codebase/repository's .steward/plans/ directory and write them in standard Markdown format. For example, a terminal TUI library plan: [project dir]/.steward/plans/tui_library_plan.md, an HTTP API server plan: [project dir]/.steward/plans/api_server_implementation_plan.md.
-   IMPORTANT: If the user asks to create the plan in a different directory than the standard [project dir]/.steward/plans/, proceed normally but warn the USER that it is not recommended to make plans outside the .steward/plans/ directory.
-   IMPORTANT: Always use proper names for the plan/task files (wrong: plan.md, plan_12.md, implementation.md; right: code_refactor_plan.md, codebase_migration_plan.md).
-   IMPORTANT: It is **VERY VERY IMPORTANT** to always put a todo list between the main title header and the content of the plan. It is critical that you mark todos as completed as soon as you are done with a task. **NEVER** batch up multiple tasks before marking them as completed.
+# Operating Principles
+- Inspect before editing: investigate existing files, directories, and patterns before making changes.
+- Minimal and idiomatic: prefer the smallest correct change that aligns with existing repository architecture and conventions.
+- Never assume external dependencies or libraries exist; check project configuration files (e.g. package.json, Cargo.toml, pyproject.toml) first.
+- Security and secrets: never expose, commit, or log API keys, credentials, or secrets.
+- Verify your changes: run relevant project verification or tests after making non-trivial modifications.
+- Never commit git changes unless the user explicitly requests you to commit.
+- Provide direct, concise responses suitable for a terminal interface. Explain non-obvious failures or decisions clearly without unnecessary filler or commentary.
+- When referencing code locations, use the format: \`file_path:line_number\`.
+- Avoid adding redundant comments unless explaining non-obvious invariants or explicitly requested.
 
-   <example>
-   user: Run the build and fix any type errors.
-   assistant: I'm going to use the TodoWrite tool to write the following items to the todo list:
-   - Run the build
-   - Fix any type errors
-   [assistant uses write_file to write the task todo/plan in [project dir]/.steward/plans/fixing_type_errors_plan.md]
-   assistant: I'm now going to run the build using Bash.
-   [assistant runs the build command and gets 10 type errors]
-   assistant: Looks like I found 10 type errors. I'm going to use the edit file tool to write 10 items to the todo list.
-   [assistant runs edit tool and puts 10 child todos under the 'figure out type error files' todo in [project dir]/.steward/plans/fixing_type_errors_plan.md]
-   assistant: Marking the first todo as in_progress.
-   [assistant uses the edit file to mark 'run build command to find type errors' todo]
-   Let me start working on the first item...
-   [assistant reads the first file, uses edit tool and fixes it]
-   The first item has been fixed, let me mark the first todo as completed, and move on to the second item...
-   [same as first one, assistant fixes all files]
-   </example>
-   In the above example, the assistant completes all the tasks, including the 10 error fixes and running the build to double-check the fixes.
+# Tool Usage Policy
+- Investigation: use read_file, grep, list_dir, and glob to explore code before modifying it.
+- Mutations: ALWAYS use write_file and edit_file to create or modify files rather than bash redirection (e.g. cat > file). write_file and edit_file participate in the file checkpoint and rewind system (/rewind), whereas bash commands are not tracked by checkpoints.
+- Commands: when using bash, you MUST always provide a concise, non-empty 'explanation' parameter describing what the command does and why it is needed.
+- Background tasks: use task_list to inspect active and recent tasks, task_read to check status/output, task_send_input to send standard input (with a trailing newline), and task_kill to terminate.
+- Web: use web_fetch and web_search when external documentation or live data is needed. If web_fetch indicates a redirect, follow up with the target URL.
 
-   <example>
-   user: Help me write a new feature that allows users to track their usage metrics and export them to various formats
+# Task and Plan Management (Todos)
+- For multi-step, complex, or verification-heavy tasks, maintain operational state using session todos:
+  - todo_write (TodoWrite): initialize or replace the session todo list (must contain 2 to 10 items).
+  - todo_update (TodoUpdate): update exactly one todo item status or description as progress occurs.
+  - todo_read (TodoRead): inspect current session todos when recovering or verifying progress.
+- Keep at most one item in 'in_progress' status at any time.
+- Mark todos completed immediately after completing each step; do not batch progress updates.
+- For simple, one-step queries or edits, do not create a todo list.
 
-   assistant: I'll help you implement a usage metrics tracking and export feature. Let me first use the write file tool to plan this task.
-   Adding the following todos to the todo list:
-   1. Research existing metrics tracking in the codebase
-   2. Design the metrics collection system
-   3. Implement core metrics tracking functionality
-   4. Create export functionality for different formats
-   [assistant uses the write file to write the plan and its todos in [project dir]/.steward/plans/]
-   Let me start by researching the existing codebase to understand what metrics we might already be tracking and how we can build on that.
-   [assistant lists all files and reads all the relevant files step by step]
-   I'm going to search for any existing metrics or telemetry code in the project.
-   [assistant runs search text to find any existing telemetry code in the codebase]
-   I've found some existing telemetry code. Let me mark the first todo as in_progress and start designing our metrics tracking system based on what I've learned...
-   [assistant continues implementing the feature step by step, marking todos as completed as they go]
-   </example>
+# Specialized Skills Policy
+- Skills are discoverable on-demand packages of specialized instructions located in workspace or user configuration.
+- Use skill_list (SkillList) to discover available skills and their descriptions.
+- Use skill_read (SkillRead) to load a skill's instructions (SKILL.md) or relative resources only when a task requires specialized domain guidance.
+- Skill instructions are supplemental and must not override core safety rules, tool boundaries, or user permission constraints.
 
-   IMPORTANT: Completed todo: marked with ◉ beside the todo text and * beside the current working todo.
-
-   # Doing tasks
-   The user will primarily request you perform software engineering tasks. This includes solving bugs, adding new functionality, refactoring code, explaining code, and more. For these tasks the following steps are recommended:
-   - Use the write file tool to plan the task if required.
-   - Use the available search tools to understand the codebase and the user's query. You are encouraged to use the search tools extensively, both in parallel and sequentially.
-   - Implement the solution using all tools available to you.
-   - Verify the solution if possible with tests. NEVER assume a specific test framework or test script. Check the README or search the codebase to determine the testing approach.
-   - VERY IMPORTANT: When you have completed a task, you MUST run the lint and typecheck commands (e.g. npm run lint, npm run typecheck, ruff, etc.) with Bash if they were provided to you to ensure your code is correct. If you are unable to find the correct command, ask the user for the command to run and if they supply it, proactively suggest writing it to AGENTS.md so that you will know to run it next time.
-   NEVER commit changes unless the user explicitly asks you to. It is VERY IMPORTANT to only commit when explicitly asked, otherwise the user will feel that you are being too proactive.
-
-   Here is useful information about the environment you are running in:
-   <env>
-   Working directory: ${cwd}
-   Is directory a git repo: ${isAGitREPO}
-   Platform: ${platform}
-   Today's date: ${dateUTC}
-   </env>
-
-   # Code References
-   When referencing specific functions or pieces of code, include the pattern \`file_path:line_number\` to allow the user to easily navigate to the source code location.
-   
-   <example>
-   user: Where are errors from the client handled?
-   assistant: Clients are marked as failed in the \`connectToServer\` function in src/services/process.ts:712.
-   </example>`;
-  const skillsPrompt = formatSkillsForSystemPrompt(skills);
-  if (skillsPrompt) {
-    prompt += `
-
-${skillsPrompt}`;
-  }
+<env>
+Working directory: ${cwd}
+Platform: ${platform}
+Today's date: ${dateUTC}
+</env>`;
   if (options.userRules && options.userRules.length > 0) {
     prompt += `
 
 <user_defined_rules>
-The following rules are set by the user and MUST be followed without exception.
-They take precedence over all other style and behaviour guidelines above,
-except for the operating_principles and security sections.
-
+The following rules are configured by the user and must be followed:
 ${options.userRules.map((rule) => `- ${rule}`).join(`
 `)}
 </user_defined_rules>`;
@@ -117601,6 +118085,7 @@ class AgentSession {
     await tracker.beginTurn(turnId, this.sessionData.turns.length + 1);
     const toolContext = {
       cwd,
+      sessionId: this.sessionData.id,
       abortSignal: this.activeAbortController.signal,
       checkpointTracker: tracker,
       mutationLocks: globalMutationLockManager,
@@ -117617,6 +118102,7 @@ class AgentSession {
       activeTools = defaultToolCatalog.toAISDKTools(toolContext);
     }
     const instructions = buildSystemPrompt({
+      cwd,
       extraInstructions: options.extraInstructions
     });
     const wrappedOnEvent = (event) => {
@@ -119068,6 +119554,7 @@ class StatusBar extends Component {
   clip = true;
   warningTimer = null;
   voiceTimer = null;
+  updateTimer = null;
   constructor(props) {
     super(props);
     this.state = {
@@ -119077,7 +119564,8 @@ class StatusBar extends Component {
       exitPending: props.exitPending,
       warning: props.warning,
       voiceState: props.voiceState ?? "idle",
-      voiceDurationSec: props.voiceDurationSec ?? 0
+      voiceDurationSec: props.voiceDurationSec ?? 0,
+      updateStatus: props.updateStatus
     };
   }
   update(partial) {
@@ -119100,8 +119588,20 @@ class StatusBar extends Component {
       });
     }
   }
-  setUpdateStatus(updateStatus) {
+  setUpdateStatus(updateStatus, durationMs) {
+    if (this.updateTimer) {
+      clearTimeout(this.updateTimer);
+      this.updateTimer = null;
+    }
     this.setState({ updateStatus });
+    if (updateStatus && durationMs && durationMs > 0) {
+      this.updateTimer = setTimeout(() => {
+        this.updateTimer = null;
+        if (this.state.updateStatus === updateStatus) {
+          this.setState({ updateStatus: undefined });
+        }
+      }, durationMs);
+    }
   }
   showWarning(warningText, durationMs = 4000) {
     if (this.warningTimer) {
@@ -119125,6 +119625,10 @@ class StatusBar extends Component {
       clearInterval(this.voiceTimer);
       this.voiceTimer = null;
     }
+    if (this.updateTimer) {
+      clearTimeout(this.updateTimer);
+      this.updateTimer = null;
+    }
   }
   render(width) {
     const theme = getTheme();
@@ -119158,14 +119662,10 @@ class StatusBar extends Component {
     } else if (updateStatus && updateStatus.state !== "idle") {
       if (updateStatus.state === "checking") {
         left = source_default.white(updateStatus.message ?? "Checking for updates...");
-      } else if (updateStatus.state === "no-updates") {
-        left = source_default.white(updateStatus.message ?? "No updates found");
       } else if (updateStatus.state === "available") {
-        left = source_default.white(updateStatus.message ?? `Found version v${updateStatus.version ?? ""}`);
-      } else if (updateStatus.state === "downloading") {
-        left = source_default.white(updateStatus.message ?? `Downloading v${updateStatus.version ?? ""}...`);
-      } else if (updateStatus.state === "ready") {
-        left = source_default.white.bold(updateStatus.message ?? "Update complete · Restart to apply");
+        left = source_default.white(updateStatus.message ?? `Update v${updateStatus.version ?? ""} is available`);
+      } else if (updateStatus.state === "no-updates") {
+        left = source_default.white(updateStatus.message ?? "Steward is up to date");
       } else if (updateStatus.state === "error" && updateStatus.message) {
         left = themeColor2(theme.error)(updateStatus.message);
       } else if (isBusy) {
@@ -119306,6 +119806,8 @@ class StreamingView extends Component {
         const maxArgLen = Math.max(10, maxCols - toolName.length - 8);
         const truncatedArg = targetArg.length > maxArgLen ? truncateMiddle(targetArg, maxArgLen) : targetArg;
         line += `${source_default.dim("(")}${source_default.dim(truncatedArg)}${source_default.dim(")")}`;
+      } else {
+        line += `${source_default.dim("()")}`;
       }
       lines.push(line);
       if (activeTool.recentLines && activeTool.recentLines.length > 0) {
@@ -120088,6 +120590,9 @@ class TrustGate extends Component {
 
 // src/tui/components/docks/ModelPicker.tsx
 class ModelPicker extends SelectList {
+  wrap = false;
+  clip = true;
+  ellipsis = false;
   constructor(props) {
     super({
       items: props.models,
@@ -120136,6 +120641,9 @@ class ModelPicker extends SelectList {
 
 // src/tui/components/docks/SessionMenu.tsx
 class SessionMenu extends SelectList {
+  wrap = false;
+  clip = true;
+  ellipsis = false;
   constructor(props) {
     super({
       items: props.sessions,
@@ -120518,6 +121026,9 @@ function buildRewindItems(session, cwd) {
 }
 
 class RewindMenu extends SelectList {
+  wrap = false;
+  clip = true;
+  ellipsis = false;
   constructor(props) {
     const items = buildRewindItems(props.session, props.cwd);
     super({
@@ -121139,6 +121650,15 @@ class FilePermissionDock extends Component {
 }
 
 // src/tui/utils/permission-queue.ts
+function settleItem(item, allowed) {
+  item.settled = true;
+  if (item.kind === "bash") {
+    item.resolve({ allowed });
+  } else {
+    item.resolve({ allowed });
+  }
+}
+
 class PermissionQueue {
   queue = [];
   activeItem = null;
@@ -121209,28 +121729,25 @@ class PermissionQueue {
     if (!current || current.settled) {
       return;
     }
-    current.settled = true;
     this.activeItem = null;
     this.onHide();
-    current.resolve({ allowed });
+    settleItem(current, allowed);
     this.processNext();
   }
   cancelItem(item) {
     if (item.settled)
       return;
     if (this.activeItem === item) {
-      item.settled = true;
       this.activeItem = null;
       this.onHide();
-      item.resolve({ allowed: false });
+      settleItem(item, false);
       this.processNext();
     } else {
       const idx = this.queue.indexOf(item);
       if (idx !== -1) {
         this.queue.splice(idx, 1);
       }
-      item.settled = true;
-      item.resolve({ allowed: false });
+      settleItem(item, false);
     }
   }
   processNext() {
@@ -121238,8 +121755,7 @@ class PermissionQueue {
       const next = this.queue.shift();
       if (next.settled || next.abortSignal?.aborted) {
         if (!next.settled) {
-          next.settled = true;
-          next.resolve({ allowed: false });
+          settleItem(next, false);
         }
         continue;
       }
@@ -121251,16 +121767,15 @@ class PermissionQueue {
   }
   clear() {
     if (this.activeItem && !this.activeItem.settled) {
-      this.activeItem.settled = true;
-      this.activeItem.resolve({ allowed: false });
+      const active = this.activeItem;
       this.activeItem = null;
       this.onHide();
+      settleItem(active, false);
     }
     while (this.queue.length > 0) {
       const item = this.queue.shift();
       if (!item.settled) {
-        item.settled = true;
-        item.resolve({ allowed: false });
+        settleItem(item, false);
       }
     }
   }
@@ -121347,17 +121862,19 @@ function classifyVoiceError(err) {
   };
 }
 // src/voice/prerequisites.ts
+import { spawn as spawn2 } from "node:child_process";
 async function defaultCheckParec() {
-  try {
-    const proc = Bun.spawn(["which", "parec"], {
-      stdout: "ignore",
-      stderr: "ignore"
-    });
-    const exitCode = await proc.exited;
-    return exitCode === 0;
-  } catch {
-    return false;
-  }
+  return new Promise((resolve) => {
+    try {
+      const proc = spawn2("which", ["parec"], {
+        stdio: "ignore"
+      });
+      proc.on("error", () => resolve(false));
+      proc.on("close", (code) => resolve(code === 0));
+    } catch {
+      resolve(false);
+    }
+  });
 }
 async function checkVoicePrerequisites(options = {}) {
   const config = options.config ?? getEnvConfig();
@@ -121425,6 +121942,8 @@ class TranscriptAccumulator {
   }
 }
 // src/voice/recorder.ts
+import { spawn as spawn3 } from "node:child_process";
+import { Readable } from "node:stream";
 var DEFAULT_PAREC_ARGS = ["--raw", "--rate=16000", "--channels=1", "--format=s16le"];
 
 class ParecAudioRecorder {
@@ -121436,12 +121955,40 @@ class ParecAudioRecorder {
   checkAvailableFn;
   constructor(options) {
     this.spawnFn = options?.spawnFn ?? ((cmd, opts) => {
-      const p = Bun.spawn(cmd, opts);
+      const [executable, ...args] = cmd;
+      const child = spawn3(executable, args, {
+        stdio: [
+          "ignore",
+          opts.stdout === "pipe" ? "pipe" : "ignore",
+          opts.stderr === "pipe" ? "pipe" : "ignore"
+        ]
+      });
+      const exited = new Promise((resolve) => {
+        child.on("close", (code) => resolve(code ?? 0));
+        child.on("error", () => resolve(1));
+      });
+      const stdout = child.stdout ? Readable.toWeb(child.stdout) : null;
+      const stderr = child.stderr ? Readable.toWeb(child.stderr) : null;
       return {
-        stdout: p.stdout,
-        stderr: p.stderr,
-        exited: p.exited,
-        kill: (sig) => p.kill(sig)
+        stdout,
+        stderr,
+        exited,
+        kill: (sig) => {
+          try {
+            if (typeof sig === "number") {
+              const signalMap = {
+                2: "SIGINT",
+                9: "SIGKILL",
+                15: "SIGTERM"
+              };
+              child.kill(signalMap[sig] || sig);
+            } else if (sig) {
+              child.kill(sig);
+            } else {
+              child.kill();
+            }
+          } catch {}
+        }
       };
     });
     this.checkAvailableFn = options?.checkAvailableFn ?? defaultCheckParec;
@@ -122088,9 +122635,11 @@ class VoiceController {
   }
 }
 // src/services/updater/service.ts
-import { spawn as spawn2 } from "node:child_process";
 var DEFAULT_REPO = "sapirrior/steward";
 function parseSemver(v) {
+  if (!v || typeof v !== "string") {
+    return [0, 0, 0];
+  }
   const clean = v.replace(/^v/i, "").trim().split("-")[0] ?? "";
   const parts = clean.split(".").map((p) => parseInt(p, 10) || 0);
   return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
@@ -122109,14 +122658,13 @@ function isNewerVersion(current, latest) {
   return lPat > cPat;
 }
 
-class AutoUpdaterService {
+class UpdateCheckerService {
   currentVersion;
   repo;
   state = "idle";
   options;
   checkTimer = null;
-  intervalTimer = null;
-  isUpdating = false;
+  resetTimer = null;
   constructor(options = {}) {
     this.options = options;
     this.currentVersion = options.currentVersion || package_default.version || "0.0.0";
@@ -122131,14 +122679,8 @@ class AutoUpdaterService {
   getCurrentVersion() {
     return this.currentVersion;
   }
-  get latestReleaseApi() {
-    return `https://api.github.com/repos/${this.repo}/releases/latest`;
-  }
-  get installShUrl() {
-    return `https://raw.githubusercontent.com/${this.repo}/main/installer/install.sh`;
-  }
-  get installPs1Url() {
-    return `https://raw.githubusercontent.com/${this.repo}/main/installer/install.ps1`;
+  get rawPackageJsonUrl() {
+    return `https://raw.githubusercontent.com/${this.repo}/main/package.json`;
   }
   setState(state, info) {
     this.state = state;
@@ -122148,156 +122690,94 @@ class AutoUpdaterService {
     if (process.env.STEWARD_NO_UPDATE_CHECK === "1" || process.env.STEWARD_NO_UPDATE_CHECK === "true") {
       return null;
     }
+    if (this.resetTimer) {
+      clearTimeout(this.resetTimer);
+      this.resetTimer = null;
+    }
     try {
       this.setState("checking", { message: "Checking for updates..." });
+      const checkStartTime = Date.now();
       const controller = new AbortController;
       const timeout = setTimeout(() => controller.abort(), this.options.timeoutMs ?? 1e4);
-      const response = await fetch(this.latestReleaseApi, {
+      const response = await fetch(this.rawPackageJsonUrl, {
         headers: {
           "User-Agent": `steward-cli/${this.currentVersion}`,
-          Accept: "application/vnd.github.v3+json"
+          Accept: "application/json"
         },
         signal: controller.signal
       });
       clearTimeout(timeout);
+      const elapsed = Date.now() - checkStartTime;
+      const targetMinDisplay = this.options.minDisplayMs !== undefined ? this.options.minDisplayMs : 1000;
+      const minDisplayDelay = Math.max(0, targetMinDisplay - elapsed);
+      if (minDisplayDelay > 0) {
+        await new Promise((resolve) => setTimeout(resolve, minDisplayDelay));
+      }
       if (!response.ok) {
-        this.setState("idle");
+        this.setState("error", { message: "Failed to check for updates" });
+        this.resetTimer = setTimeout(() => {
+          if (this.state === "error")
+            this.setState("idle");
+        }, 3000);
         return null;
       }
       const data = await response.json();
-      const rawTag = data.tag_name ?? "";
-      const latestVersion = rawTag.replace(/^v/i, "").trim();
+      if (!data || typeof data !== "object" || typeof data.version !== "string") {
+        this.setState("error", { message: "Invalid upstream version response" });
+        this.resetTimer = setTimeout(() => {
+          if (this.state === "error")
+            this.setState("idle");
+        }, 3000);
+        return null;
+      }
+      const latestVersion = data.version.replace(/^v/i, "").trim();
       if (!latestVersion) {
-        this.setState("idle");
+        this.setState("error", { message: "Empty upstream version response" });
+        this.resetTimer = setTimeout(() => {
+          if (this.state === "error")
+            this.setState("idle");
+        }, 3000);
         return null;
       }
       const hasUpdate = isNewerVersion(this.currentVersion, latestVersion);
       const updateInfo = {
         currentVersion: this.currentVersion,
         latestVersion,
-        hasUpdate,
-        tag: rawTag,
-        releaseUrl: data.html_url
+        hasUpdate
       };
       if (hasUpdate) {
         this.setState("available", {
           version: latestVersion,
-          message: `Found version v${latestVersion}`
-        });
-      } else {
-        this.setState("no-updates", { message: "No updates found" });
-        setTimeout(() => {
-          if (this.state === "no-updates") {
-            this.setState("idle");
-          }
-        }, 3000);
-      }
-      return updateInfo;
-    } catch (err) {
-      logError(err, { component: "AutoUpdaterService", method: "checkForUpdates" });
-      this.setState("idle");
-      return null;
-    }
-  }
-  async installUpdate(version) {
-    if (this.isUpdating)
-      return false;
-    this.isUpdating = true;
-    this.setState("downloading", {
-      version,
-      message: `Downloading v${version}...`
-    });
-    try {
-      const isWindows = process.platform === "win32";
-      let childProcess;
-      if (isWindows) {
-        childProcess = spawn2("powershell", [
-          "-NoProfile",
-          "-ExecutionPolicy",
-          "Bypass",
-          "-Command",
-          `irm ${this.installPs1Url} | iex`
-        ], {
-          stdio: "ignore",
-          windowsHide: true
+          message: `Update v${latestVersion} is available`
         });
       } else {
-        childProcess = spawn2("bash", ["-c", `curl -fsSL ${this.installShUrl} | bash`], {
-          stdio: "ignore",
-          env: {
-            ...process.env,
-            HOME: process.env.HOME || "",
-            PATH: process.env.PATH || ""
-          }
+        this.setState("no-updates", {
+          version: this.currentVersion,
+          message: `Steward is up to date (v${this.currentVersion})`
         });
-      }
-      const success = await new Promise((resolve) => {
-        const timeout = setTimeout(() => {
-          try {
-            childProcess.kill();
-          } catch {}
-          resolve(false);
-        }, 300000);
-        childProcess.on("exit", (code) => {
-          clearTimeout(timeout);
-          resolve(code === 0);
-        });
-        childProcess.on("error", () => {
-          clearTimeout(timeout);
-          resolve(false);
-        });
-      });
-      if (success) {
-        this.setState("ready", {
-          version,
-          message: `Update complete · Restart to apply`
-        });
-        return true;
-      } else {
-        this.setState("error", {
-          version,
-          message: `Update to v${version} failed`
-        });
-        setTimeout(() => {
-          if (this.state === "error") {
+        this.resetTimer = setTimeout(() => {
+          if (this.state === "no-updates")
             this.setState("idle");
-          }
-        }, 4000);
-        return false;
+        }, 3500);
       }
+      return updateInfo;
     } catch (err) {
-      logError(err, { component: "AutoUpdaterService", method: "installUpdate" });
-      this.setState("error", { version, message: "Update failed" });
-      setTimeout(() => {
-        if (this.state === "error") {
+      logError(err, { component: "UpdateCheckerService", method: "checkForUpdates" });
+      this.setState("error", { message: "Failed to check for updates" });
+      this.resetTimer = setTimeout(() => {
+        if (this.state === "error")
           this.setState("idle");
-        }
-      }, 4000);
-      return false;
-    } finally {
-      this.isUpdating = false;
+      }, 3000);
+      return null;
     }
   }
-  startBackgroundCheck(initialDelayMs = 2000, intervalMs) {
-    if (this.checkTimer)
+  startBackgroundCheck(initialDelayMs = 2000) {
+    if (this.checkTimer) {
       clearTimeout(this.checkTimer);
-    if (this.intervalTimer)
-      clearInterval(this.intervalTimer);
-    const performCheck = async () => {
-      const update = await this.checkForUpdates();
-      if (update && update.hasUpdate) {
-        setTimeout(async () => {
-          await this.installUpdate(update.latestVersion);
-        }, 1200);
-      }
-    };
+    }
     this.checkTimer = setTimeout(async () => {
       this.checkTimer = null;
-      await performCheck();
-      const recurringInterval = intervalMs ?? this.options.checkIntervalMs;
-      if (recurringInterval && recurringInterval > 0) {
-        this.intervalTimer = setInterval(performCheck, recurringInterval);
-      }
+      await this.checkForUpdates();
     }, initialDelayMs);
   }
   dispose() {
@@ -122305,9 +122785,9 @@ class AutoUpdaterService {
       clearTimeout(this.checkTimer);
       this.checkTimer = null;
     }
-    if (this.intervalTimer) {
-      clearInterval(this.intervalTimer);
-      this.intervalTimer = null;
+    if (this.resetTimer) {
+      clearTimeout(this.resetTimer);
+      this.resetTimer = null;
     }
   }
 }
@@ -122326,7 +122806,7 @@ class TUIApp {
   ctrlCTimer = null;
   isBusy = false;
   voiceController;
-  autoUpdater;
+  updateChecker;
   permissionQueue;
   constructor(options = {}) {
     this.cwd = options.cwd ?? process.cwd();
@@ -122389,11 +122869,23 @@ class TUIApp {
         this.statusBar.showWarning(warning);
       }
     });
-    this.autoUpdater = new AutoUpdaterService({
+    this.updateChecker = new UpdateCheckerService({
       currentVersion: options.version,
       onStatusChange: (state, info) => {
         if (state === "idle") {
           this.statusBar.setUpdateStatus(undefined);
+        } else if (state === "available") {
+          this.statusBar.setUpdateStatus({
+            state,
+            version: info?.version,
+            message: info?.message
+          }, 8000);
+        } else if (state === "error") {
+          this.statusBar.setUpdateStatus({
+            state,
+            version: info?.version,
+            message: info?.message
+          }, 4000);
         } else {
           this.statusBar.setUpdateStatus({
             state,
@@ -122499,7 +122991,7 @@ class TUIApp {
     this.engine.mount(this.streamingView, { kind: "custom" });
     this.engine.mount(this.promptInput, { keepCursorVisible: true, kind: "input" });
     this.engine.mount(this.statusBar, { kind: "custom" });
-    this.autoUpdater.startBackgroundCheck(3000);
+    this.updateChecker.startBackgroundCheck(3000);
     this.engine.addInputListener((chunk) => {
       const action = parseKeyInput(chunk);
       if (this.voiceController.isActive) {
@@ -122935,7 +123427,7 @@ class TUIApp {
     this.permissionQueue.clear();
     this.session.shutdown().catch(() => {});
     this.voiceController.dispose();
-    this.autoUpdater.dispose();
+    this.updateChecker.dispose();
     this.engine.cleanupSync();
     if (this.onExitCallback) {
       this.onExitCallback();