terminal-pilot 0.0.19 → 0.0.20

package/dist/cli.js

@@ -7,12 +7,12 @@ var __export = (target, all) => {
 
 // src/cli.ts
 import { realpath as realpath2 } from "node:fs/promises";
-import path22 from "node:path";
+import path23 from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // ../toolcraft/src/cli.ts
 import { access as access2, lstat as lstat3, readFile as readFile4, rename as rename3, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
-import path13 from "node:path";
+import path14 from "node:path";
 import {
   Command as CommanderCommand,
   CommanderError as CommanderError2,
@@ -1278,6 +1278,7 @@ ${options.theme.muted(options.badges.map((badge) => badge[0] + badge.slice(1).to
 }
 
 // ../design-system/src/components/template.ts
+var MAX_PARTIAL_DEPTH = 100;
 var HTML_ESCAPE = {
   "&": "&",
   "<": "&lt;",
@@ -1289,14 +1290,27 @@ var HTML_ESCAPE = {
   "=": "&#x3D;"
 };
 function renderTemplate(template, view, options = {}) {
-  const prepared = options.yield === void 0 ? template : template.split("{{yield}}").join(options.yield);
+  const prepared = options.yield === void 0 ? template : resolveTemplatePartials(template, options.partials ?? {}).split("{{yield}}").join(options.yield);
   const tokens = parseTemplate(prepared);
-  const escape = options.escape === "none" ? String : escapeHtml;
-  const preserveMissing = options.yield !== void 0 && options.escape === "none";
-  return renderTokens(tokens, { view }, prepared, escape, preserveMissing);
+  validatePartialReferences(tokens, options.partials ?? {}, []);
+  if (options.validate === true) {
+    const expanded = resolveTemplatePartials(prepared, options.partials ?? {});
+    validateVariables(parseTemplate(expanded), { view });
+  }
+  const state = {
+    escape: options.escape === "none" ? String : escapeHtml,
+    partials: options.partials ?? {},
+    partialStack: [],
+    preserveMissing: options.yield !== void 0 && options.escape === "none",
+    validate: options.validate === true
+  };
+  return renderTokens(tokens, { view }, prepared, state);
+}
+function resolveTemplatePartials(template, partials) {
+  return expandTemplatePartials(template, partials, []);
 }
-function renderTemplateInContext(template, context, escape, preserveMissing) {
-  return renderTokens(parseTemplate(template), context, template, escape, preserveMissing);
+function renderTemplateInContext(template, context, state) {
+  return renderTokens(parseTemplate(template), context, template, state);
 }
 function parseTemplate(template) {
   const root = [];
@@ -1319,9 +1333,6 @@ function parseTemplate(template) {
       index = standalone?.nextIndex ?? parsed.end;
       continue;
     }
-    if (parsed.kind === "partial") {
-      throw new Error(`Partials are not supported: "${parsed.name}"`);
-    }
     if (parsed.kind === "delimiter") {
       throw new Error("Custom delimiters are not supported");
     }
@@ -1339,6 +1350,15 @@ function parseTemplate(template) {
       index = standalone?.nextIndex ?? parsed.end;
       continue;
     }
+    if (parsed.kind === "partial") {
+      tokens.push({
+        type: "partial",
+        name: parsed.name,
+        indent: standalone === void 0 ? "" : template.slice(standalone.lineStart, open)
+      });
+      index = standalone?.nextIndex ?? parsed.end;
+      continue;
+    }
     if (parsed.kind === "close") {
       const frame2 = stack.pop();
       if (frame2 === void 0) {
@@ -1409,7 +1429,7 @@ function getStandalone(template, tagStart, tagEnd, kind) {
   }
   return void 0;
 }
-function renderTokens(tokens, context, template, escape, preserveMissing) {
+function renderTokens(tokens, context, template, state) {
   let output = "";
   for (const token of tokens) {
     switch (token.type) {
@@ -1418,32 +1438,62 @@ function renderTokens(tokens, context, template, escape, preserveMissing) {
         continue;
       case "name":
       case "unescaped": {
-        const value = lookup(context, token.name);
-        if (value == null) {
-          if (preserveMissing) {
+        const result = lookup(context, token.name);
+        if (!result.hit || result.value == null) {
+          if (state.validate) {
+            throw new Error(`Template variable "${token.name}" not found.`);
+          }
+          if (state.preserveMissing) {
             output += token.raw;
           }
           continue;
         }
-        const rendered = String(value);
-        output += token.type === "name" ? escape(rendered) : rendered;
+        const rendered = String(result.value);
+        output += token.type === "name" ? state.escape(rendered) : rendered;
+        continue;
+      }
+      case "partial": {
+        if (!Object.hasOwn(state.partials, token.name)) {
+          throw new Error(`Partial "${token.name}" not found.`);
+        }
+        if (state.partialStack.includes(token.name)) {
+          throw new Error(
+            `Circular partial reference detected: ${[...state.partialStack, token.name].join(" -> ")}.`
+          );
+        }
+        if (state.partialStack.length >= MAX_PARTIAL_DEPTH) {
+          throw new Error(`Maximum partial depth exceeded (${MAX_PARTIAL_DEPTH}).`);
+        }
+        const partial = indentPartial(state.partials[token.name], token.indent);
+        output += renderTokens(parseTemplate(partial), context, partial, {
+          ...state,
+          partialStack: [...state.partialStack, token.name]
+        });
         continue;
       }
       case "inverted": {
-        const value = lookup(context, token.name);
+        const result = lookup(context, token.name);
+        if (!result.hit && state.validate) {
+          throw new Error(`Template variable "${token.name}" not found.`);
+        }
+        const value = result.value;
         if (!value || Array.isArray(value) && value.length === 0) {
-          output += renderTokens(token.children, context, template, escape, preserveMissing);
+          output += renderTokens(token.children, context, template, state);
         }
         continue;
       }
       case "section": {
-        const value = lookup(context, token.name);
+        const result = lookup(context, token.name);
+        if (!result.hit && state.validate) {
+          throw new Error(`Template variable "${token.name}" not found.`);
+        }
+        const value = result.value;
         if (!value) {
           continue;
         }
         if (Array.isArray(value)) {
           for (const item of value) {
-            output += renderTokens(token.children, pushContext(context, item), template, escape, preserveMissing);
+            output += renderTokens(token.children, pushContext(context, item), template, state);
           }
           continue;
         }
@@ -1452,7 +1502,7 @@ function renderTokens(tokens, context, template, escape, preserveMissing) {
           const rendered = value.call(
             context.view,
             raw,
-            (nextTemplate) => renderTemplateInContext(nextTemplate, context, escape, preserveMissing)
+            (nextTemplate) => renderTemplateInContext(nextTemplate, context, state)
           );
           if (rendered != null) {
             output += String(rendered);
@@ -1460,10 +1510,10 @@ function renderTokens(tokens, context, template, escape, preserveMissing) {
           continue;
         }
         if (typeof value === "object" || typeof value === "string" || typeof value === "number") {
-          output += renderTokens(token.children, pushContext(context, value), template, escape, preserveMissing);
+          output += renderTokens(token.children, pushContext(context, value), template, state);
           continue;
         }
-        output += renderTokens(token.children, context, template, escape, preserveMissing);
+        output += renderTokens(token.children, context, template, state);
       }
     }
   }
@@ -1471,17 +1521,115 @@ function renderTokens(tokens, context, template, escape, preserveMissing) {
 }
 function lookup(context, name) {
   if (name === ".") {
-    return callLambda(context.view, context.view);
+    return { hit: true, value: callLambda(context.view, context.view) };
   }
   let cursor = context;
   while (cursor !== void 0) {
     const result = name.includes(".") ? lookupDotted(cursor.view, name) : lookupName(cursor.view, name);
     if (result.hit) {
-      return callLambda(result.value, cursor.view);
+      return { hit: true, value: callLambda(result.value, cursor.view) };
     }
     cursor = cursor.parent;
   }
-  return void 0;
+  return { hit: false, value: void 0 };
+}
+function validateVariables(tokens, context) {
+  for (const token of tokens) {
+    if (token.type === "text" || token.type === "partial") {
+      continue;
+    }
+    if (token.type === "name" || token.type === "unescaped") {
+      if (!lookup(context, token.name).hit) {
+        throw new Error(`Template variable "${token.name}" not found.`);
+      }
+      continue;
+    }
+    if (token.type !== "section" && token.type !== "inverted") {
+      continue;
+    }
+    const result = lookup(context, token.name);
+    if (!result.hit) {
+      throw new Error(`Template variable "${token.name}" not found.`);
+    }
+    if (Array.isArray(result.value) && result.value.length > 0) {
+      for (const item of result.value) {
+        validateVariables(token.children, pushContext(context, item));
+      }
+      continue;
+    }
+    if (typeof result.value === "object" && result.value !== null || typeof result.value === "string" || typeof result.value === "number") {
+      validateVariables(token.children, pushContext(context, result.value));
+      continue;
+    }
+    validateVariables(token.children, context);
+  }
+}
+function validatePartialReferences(tokens, partials, partialStack) {
+  for (const token of tokens) {
+    if (token.type === "section" || token.type === "inverted") {
+      validatePartialReferences(token.children, partials, partialStack);
+      continue;
+    }
+    if (token.type !== "partial") {
+      continue;
+    }
+    if (!Object.hasOwn(partials, token.name)) {
+      throw new Error(`Partial "${token.name}" not found.`);
+    }
+    if (partialStack.includes(token.name)) {
+      throw new Error(
+        `Circular partial reference detected: ${[...partialStack, token.name].join(" -> ")}.`
+      );
+    }
+    if (partialStack.length >= MAX_PARTIAL_DEPTH) {
+      throw new Error(`Maximum partial depth exceeded (${MAX_PARTIAL_DEPTH}).`);
+    }
+    validatePartialReferences(parseTemplate(partials[token.name]), partials, [
+      ...partialStack,
+      token.name
+    ]);
+  }
+}
+function indentPartial(partial, indent) {
+  if (indent === "") {
+    return partial;
+  }
+  return partial.split("\n").map((line) => line === "" ? "" : `${indent}${line}`).join("\n");
+}
+function expandTemplatePartials(template, partials, partialStack) {
+  let output = "";
+  let index = 0;
+  while (index < template.length) {
+    const open = template.indexOf("{{", index);
+    if (open === -1) {
+      output += template.slice(index);
+      break;
+    }
+    const parsed = parseTag(template, open);
+    if (parsed.kind !== "partial") {
+      output += template.slice(index, parsed.end);
+      index = parsed.end;
+      continue;
+    }
+    if (!Object.hasOwn(partials, parsed.name)) {
+      throw new Error(`Partial "${parsed.name}" not found.`);
+    }
+    if (partialStack.includes(parsed.name)) {
+      throw new Error(
+        `Circular partial reference detected: ${[...partialStack, parsed.name].join(" -> ")}.`
+      );
+    }
+    if (partialStack.length >= MAX_PARTIAL_DEPTH) {
+      throw new Error(`Maximum partial depth exceeded (${MAX_PARTIAL_DEPTH}).`);
+    }
+    const standalone = getStandalone(template, open, parsed.end, parsed.kind);
+    const beforePartial = standalone === void 0 ? template.slice(index, open) : template.slice(index, standalone.lineStart);
+    const indent = standalone === void 0 ? "" : template.slice(standalone.lineStart, open);
+    const partial = indentPartial(partials[parsed.name], indent);
+    output += beforePartial + expandTemplatePartials(partial, partials, [...partialStack, parsed.name]);
+    index = standalone?.nextIndex ?? parsed.end;
+  }
+  return output;
 }
 function lookupName(view, name) {
   if (!isPropertyContainer(view) || !hasProperty(view, name)) {
@@ -2602,17 +2750,22 @@ import { randomBytes } from "node:crypto";
 // ../process-runner/src/docker/args.ts
 import path2 from "node:path";
 
+// ../process-runner/src/docker/env-file.ts
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path3 from "node:path";
+
 // ../process-runner/src/docker/docker-execution-env.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
 import { readdir, readFile, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path4 from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import path5 from "node:path";
 
 // ../process-runner/src/host/host-runner.ts
 import { spawn as spawnChildProcess } from "node:child_process";
 function createHostRunner(options = {}) {
-  const detached = options.detached === true;
+  const detachedByDefault = options.detached === true;
   return {
     name: "host",
     exec(spec) {
@@ -2630,18 +2783,19 @@ function createHostRunner(options = {}) {
       const stdinMode = spec.stdin ?? "ignore";
       const stdoutMode = spec.stdout ?? "pipe";
       const stderrMode = spec.stderr ?? "pipe";
+      const killProcessGroup = detachedByDefault || spec.killProcessGroup === true;
       const stdio = stdinMode === "inherit" && stdoutMode === "inherit" && stderrMode === "inherit" ? "inherit" : [stdinMode, stdoutMode, stderrMode];
       const child = spawnChildProcess(spec.command, spec.args ?? [], {
         cwd: spec.cwd,
         env: spec.env,
         stdio,
-        ...detached ? { detached: true } : {}
+        ...killProcessGroup ? { detached: true } : {}
       });
-      if (detached) {
+      if (killProcessGroup) {
         child.unref();
       }
       const kill = (signal) => {
-        if (detached && process.platform !== "win32" && child.pid !== void 0) {
+        if (killProcessGroup && process.platform !== "win32" && child.pid !== void 0) {
           process.kill(-child.pid, signal);
           return;
         }
@@ -2699,9 +2853,9 @@ function bindAbortSignal(signal, onAbort) {
 }
 
 // ../process-runner/src/workspace-transfer.ts
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { promises as nodeFs } from "node:fs";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // ../process-runner/src/testing/mock-runner.ts
 import { Readable, Writable } from "node:stream";
@@ -2772,7 +2926,7 @@ function resolveEndpoint(options = {}) {
 }
 
 // ../task-list/src/backends/utils.ts
-import path5 from "node:path";
+import path6 from "node:path";
 function compareCreated(left, right) {
   const leftCreated = typeof left.raw.created === "string" ? left.raw.created : "";
   const rightCreated = typeof right.raw.created === "string" ? right.raw.created : "";
@@ -2822,12 +2976,12 @@ async function statIfExists(fs4, filePath) {
   }
 }
 async function rejectSymbolicLinkComponents(fs4, filePath) {
-  const resolvedPath = path5.resolve(filePath);
-  const rootPath = path5.parse(resolvedPath).root;
-  const components = resolvedPath.slice(rootPath.length).split(path5.sep).filter(Boolean);
+  const resolvedPath = path6.resolve(filePath);
+  const rootPath = path6.parse(resolvedPath).root;
+  const components = resolvedPath.slice(rootPath.length).split(path6.sep).filter(Boolean);
   let currentPath = rootPath;
   for (const component of components) {
-    currentPath = path5.join(currentPath, component);
+    currentPath = path6.join(currentPath, component);
     try {
       if ((await fs4.lstat(currentPath)).isSymbolicLink()) {
         throw new Error(`Path "${filePath}" contains a symbolic link.`);
@@ -2843,7 +2997,7 @@ async function rejectSymbolicLinkComponents(fs4, filePath) {
 async function writeAtomically(fs4, filePath, content) {
   const tempPath = `${filePath}.tmp-${process.pid}-${tmpFileCounter}`;
   tmpFileCounter += 1;
-  await fs4.mkdir(path5.dirname(filePath), { recursive: true });
+  await fs4.mkdir(path6.dirname(filePath), { recursive: true });
   try {
     await fs4.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
     await fs4.rename(tempPath, filePath);
@@ -2859,7 +3013,7 @@ async function writeAtomically(fs4, filePath, content) {
   }
 }
 async function withFileLock(fs4, lockPath, operation) {
-  await fs4.mkdir(path5.dirname(lockPath), { recursive: true });
+  await fs4.mkdir(path6.dirname(lockPath), { recursive: true });
   for (; ; ) {
     try {
       await fs4.writeFile(lockPath, String(process.pid), { encoding: "utf8", flag: "wx" });
@@ -3946,7 +4100,7 @@ function parseQualifiedId(qualifiedId, listName) {
 }
 
 // ../task-list/src/backends/markdown-dir.ts
-import path6 from "node:path";
+import path7 from "node:path";
 import { parseDocument, stringify } from "yaml";
 
 // ../task-list/src/schema/task.schema.json
@@ -4065,16 +4219,16 @@ function parseQualifiedId2(qualifiedId) {
   };
 }
 function listPath(rootPath, layout, list) {
-  return layout.kind === "single" ? rootPath : path6.join(rootPath, list);
+  return layout.kind === "single" ? rootPath : path7.join(rootPath, list);
 }
 function archiveDirectoryPath(rootPath, layout, list) {
-  return layout.kind === "single" ? path6.join(rootPath, ARCHIVE_DIRECTORY_NAME) : path6.join(rootPath, list, ARCHIVE_DIRECTORY_NAME);
+  return layout.kind === "single" ? path7.join(rootPath, ARCHIVE_DIRECTORY_NAME) : path7.join(rootPath, list, ARCHIVE_DIRECTORY_NAME);
 }
 function activeTaskFilename(id, order, width) {
   return `${String(order).padStart(width, "0")}-${id}${MARKDOWN_EXTENSION}`;
 }
 function archivedTaskPath(rootPath, layout, list, id) {
-  return path6.join(archiveDirectoryPath(rootPath, layout, list), `${id}${MARKDOWN_EXTENSION}`);
+  return path7.join(archiveDirectoryPath(rootPath, layout, list), `${id}${MARKDOWN_EXTENSION}`);
 }
 function isMarkdownFile(entryName) {
   return entryName.endsWith(MARKDOWN_EXTENSION);
@@ -4200,7 +4354,7 @@ function createTask(list, id, frontmatter, body, mode, sourcePath) {
     state: frontmatter.state,
     description: body,
     metadata: metadataFromFrontmatter(frontmatter, mode),
-    ...sourcePath !== void 0 && { sourcePath: path6.resolve(sourcePath) }
+    ...sourcePath !== void 0 && { sourcePath: path7.resolve(sourcePath) }
   };
 }
 function serializeTaskDocument(frontmatter, description) {
@@ -4240,7 +4394,7 @@ async function readTaskFile(fs4, list, id, filePath, validStates, initialState,
       task: createTask(list, id, frontmatter, document.body, mode, filePath)
     };
   }
-  const parsedFilename = parseActiveFilename(path6.basename(filePath));
+  const parsedFilename = parseActiveFilename(path7.basename(filePath));
   const defaultName = parsedFilename?.id ?? id;
   const effectiveFrontmatter = {
     ...frontmatter,
@@ -4269,7 +4423,7 @@ async function findTaskLocation(fs4, rootPath, layout, list, id) {
   await rejectSymbolicLinkComponents(fs4, listDirectoryPath);
   const activeName = await findActiveTaskFilename(fs4, listDirectoryPath, id);
   if (activeName) {
-    const activePath = path6.join(listDirectoryPath, activeName);
+    const activePath = path7.join(listDirectoryPath, activeName);
     await rejectSymbolicLinkComponents(fs4, activePath);
     const activeStat = await statIfExists(fs4, activePath);
     if (activeStat?.isFile()) {
@@ -4391,7 +4545,7 @@ function createTasksView2(deps, layout, list) {
       if (isHiddenEntry(entryName)) continue;
       const parsed = parseActiveFilename(entryName);
       if (!parsed) continue;
-      const entryPath = path6.join(listDirectoryPath, entryName);
+      const entryPath = path7.join(listDirectoryPath, entryName);
       await rejectSymbolicLinkComponents(deps.fs, entryPath);
       const entryStat = await statIfExists(deps.fs, entryPath);
       if (!entryStat?.isFile()) continue;
@@ -4409,7 +4563,7 @@ function createTasksView2(deps, layout, list) {
     const entries = await readActiveEntries();
     const tasks = /* @__PURE__ */ new Map();
     for (const entry of entries) {
-      const filePath = path6.join(listDirectoryPath, entry.filename);
+      const filePath = path7.join(listDirectoryPath, entry.filename);
       const file = await readTaskFile(
         deps.fs,
         list,
@@ -4430,7 +4584,7 @@ function createTasksView2(deps, layout, list) {
     const result = [];
     for (const entryName of entries) {
       if (isHiddenEntry(entryName) || !isMarkdownFile(entryName)) continue;
-      const entryPath = path6.join(archivePath, entryName);
+      const entryPath = path7.join(archivePath, entryName);
       await rejectSymbolicLinkComponents(deps.fs, entryPath);
       const entryStat = await statIfExists(deps.fs, entryPath);
       if (!entryStat?.isFile()) continue;
@@ -4460,12 +4614,12 @@ function createTasksView2(deps, layout, list) {
       if (desiredOrder === void 0) continue;
       const desiredFilename = activeTaskFilename(entry.id, desiredOrder, width);
       if (entry.filename !== desiredFilename) {
-        const fromPath = path6.join(listDirectoryPath, entry.filename);
-        const stagingPath = path6.join(
+        const fromPath = path7.join(listDirectoryPath, entry.filename);
+        const stagingPath = path7.join(
           listDirectoryPath,
           `${desiredFilename}.staging-${process.pid}-${index}`
         );
-        const targetPath = path6.join(listDirectoryPath, desiredFilename);
+        const targetPath = path7.join(listDirectoryPath, desiredFilename);
         try {
           await deps.fs.rename(fromPath, stagingPath);
           staged.push({ original: fromPath, staging: stagingPath, target: targetPath, finalized: false });
@@ -4614,7 +4768,7 @@ function createTasksView2(deps, layout, list) {
       assertCreateHasId(input);
       validateTaskId(input.id);
       await rejectSymbolicLinkComponents(deps.fs, listDirectoryPath);
-      return withFileLock(deps.fs, path6.join(listDirectoryPath, ".transition.lock"), async () => {
+      return withFileLock(deps.fs, path7.join(listDirectoryPath, ".transition.lock"), async () => {
         const existing = await findTaskLocation(deps.fs, deps.path, layout, list, input.id);
         if (existing) {
           throw new TaskAlreadyExistsError(`Task "${list}/${input.id}" already exists.`);
@@ -4627,7 +4781,7 @@ function createTasksView2(deps, layout, list) {
         const nextOrder = maxOrder + 1;
         const width = padWidthForCount(activeEntries.length + 1);
         const filename = activeTaskFilename(input.id, nextOrder, width);
-        const targetPath = path6.join(listDirectoryPath, filename);
+        const targetPath = path7.join(listDirectoryPath, filename);
         const frontmatter = createdFrontmatter(
           deps.defaults,
           input,
@@ -4735,7 +4889,7 @@ function createTasksView2(deps, layout, list) {
       validateTaskId(id);
       const { event, nextTask } = await withFileLock(
         deps.fs,
-        path6.join(listDirectoryPath, ".transition.lock"),
+        path7.join(listDirectoryPath, ".transition.lock"),
         fireTask
       );
       await event.onEnter?.(nextTask);
@@ -4828,7 +4982,7 @@ async function markdownDirBackend(deps) {
       if (entryName === ARCHIVE_DIRECTORY_NAME || isHiddenEntry(entryName)) {
         continue;
       }
-      const entryPath = path6.join(deps.path, entryName);
+      const entryPath = path7.join(deps.path, entryName);
       await rejectSymbolicLinkComponents(deps.fs, entryPath);
       const entryStat = await statIfExists(deps.fs, entryPath);
       if (entryStat?.isDirectory()) {
@@ -4870,7 +5024,7 @@ async function markdownDirBackend(deps) {
     }
     const targetListDir = listPath(deps.path, layout, targetListName);
     await rejectSymbolicLinkComponents(deps.fs, targetListDir);
-    return withFileLock(deps.fs, path6.join(targetListDir, ".transition.lock"), async () => {
+    return withFileLock(deps.fs, path7.join(targetListDir, ".transition.lock"), async () => {
       const targetExisting = await findTaskLocation(deps.fs, deps.path, layout, targetListName, id);
       if (targetExisting) {
         throw new TaskAlreadyExistsError(`Task "${targetListName}/${id}" already exists.`);
@@ -4920,7 +5074,7 @@ async function markdownDirBackend(deps) {
       );
       const width = padWidthForCount(targetEntries.length + 1);
       const targetFilename = activeTaskFilename(id, maxOrder + 1, width);
-      const targetPath = path6.join(targetListDir, targetFilename);
+      const targetPath = path7.join(targetListDir, targetFilename);
       await deps.fs.rename(sourceLocation.path, targetPath);
       return createTask(
         targetListName,
@@ -4942,7 +5096,7 @@ async function markdownDirBackend(deps) {
 }
 
 // ../task-list/src/backends/yaml-file.ts
-import path7 from "node:path";
+import path8 from "node:path";
 import { isMap, parseDocument as parseDocument2 } from "yaml";
 
 // ../task-list/src/schema/store.schema.json
@@ -5038,7 +5192,7 @@ function createTask2(list, id, taskRecord, sourcePath) {
     state: taskRecord.state,
     description: descriptionFromTaskRecord(taskRecord),
     metadata: metadataFromTaskRecord(taskRecord),
-    ...sourcePath !== void 0 && { sourcePath: path7.resolve(sourcePath) }
+    ...sourcePath !== void 0 && { sourcePath: path8.resolve(sourcePath) }
   };
 }
 function matchesFilter(task, filter) {
@@ -5603,7 +5757,7 @@ async function openGhIssuesBackend(options) {
 
 // ../task-list/src/move.ts
 import * as fsPromises2 from "node:fs/promises";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // ../toolcraft/src/human-in-loop/approval-tasks.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
@@ -6099,13 +6253,13 @@ function formatAvailableApprovalCommandPaths(root) {
 }
 function enumerateApprovalCommandPaths(root) {
   const paths = [];
-  const visit = (node, path23) => {
+  const visit = (node, path24) => {
     if (node.kind === "command") {
-      paths.push(path23.join("."));
+      paths.push(path24.join("."));
       return;
     }
     for (const child of getVisibleCliChildren(node)) {
-      visit(child, [...path23, child.name]);
+      visit(child, [...path24, child.name]);
     }
   };
   if (root.kind === "command") {
@@ -6140,21 +6294,21 @@ function createHandlerContext(command, params17) {
 }
 function createFs() {
   return {
-    readFile: async (path23, encoding = "utf8") => readFile2(path23, { encoding }),
-    writeFile: async (path23, contents) => {
-      await writeFile2(path23, contents);
+    readFile: async (path24, encoding = "utf8") => readFile2(path24, { encoding }),
+    writeFile: async (path24, contents) => {
+      await writeFile2(path24, contents);
     },
-    exists: async (path23) => {
+    exists: async (path24) => {
       try {
-        await access(path23);
+        await access(path24);
         return true;
       } catch {
         return false;
       }
     },
-    lstat: async (path23) => lstat(path23),
+    lstat: async (path24) => lstat(path24),
     rename: async (fromPath, toPath) => rename(fromPath, toPath),
-    unlink: async (path23) => unlink(path23)
+    unlink: async (path24) => unlink(path24)
   };
 }
 function createEnv(values = process.env) {
@@ -6431,16 +6585,16 @@ function isMissingStateError(error3) {
 
 // ../toolcraft/src/error-report.ts
 import { mkdir as mkdir2, realpath, writeFile as writeFile4 } from "node:fs/promises";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import os from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 import { CommanderError } from "commander";
 
 // ../toolcraft/src/mcp-proxy.ts
 import { existsSync as existsSync2 } from "node:fs";
 import { lstat as lstat2, mkdir, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
-import path11 from "node:path";
-import { createHash as createHash3, randomUUID } from "node:crypto";
+import path12 from "node:path";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 
 // ../tiny-mcp-client/src/internal.ts
 import { spawn as spawn5 } from "node:child_process";
@@ -6448,13 +6602,13 @@ import { PassThrough as PassThrough2 } from "node:stream";
 
 // ../mcp-oauth/src/client/auth-store-session-store.ts
 import crypto from "node:crypto";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // ../auth-store/src/encrypted-file-store.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, scrypt } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 var derivedKeyCache = /* @__PURE__ */ new Map();
 var ENCRYPTION_ALGORITHM = "aes-256-gcm";
 var ENCRYPTION_VERSION = 1;
@@ -6466,6 +6620,7 @@ var temporaryFileSequence = 0;
 var EncryptedFileStore = class {
   fs;
   filePath;
+  symbolicLinkCheckStartPath;
   salt;
   getMachineIdentity;
   getRandomBytes;
@@ -6473,11 +6628,22 @@ var EncryptedFileStore = class {
   constructor(input) {
     this.fs = input.fs ?? fs;
     this.salt = input.salt;
-    this.filePath = input.filePath ?? path9.join(
-      (input.getHomeDirectory ?? homedir)(),
-      input.defaultDirectory ?? ".auth-store",
-      input.defaultFileName ?? "credentials.enc"
-    );
+    if (input.filePath === void 0) {
+      const homeDirectory = (input.getHomeDirectory ?? homedir)();
+      const defaultDirectory = input.defaultDirectory ?? ".auth-store";
+      this.filePath = path10.join(
+        homeDirectory,
+        defaultDirectory,
+        input.defaultFileName ?? "credentials.enc"
+      );
+      this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(
+        homeDirectory,
+        defaultDirectory
+      );
+    } else {
+      this.filePath = input.filePath;
+      this.symbolicLinkCheckStartPath = null;
+    }
     this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
     this.getRandomBytes = input.getRandomBytes ?? randomBytes4;
   }
@@ -6528,7 +6694,7 @@ var EncryptedFileStore = class {
       authTag: authTag.toString("base64"),
       ciphertext: ciphertext.toString("base64")
     };
-    await this.fs.mkdir(path9.dirname(this.filePath), { recursive: true });
+    await this.fs.mkdir(path10.dirname(this.filePath), { recursive: true });
     await this.assertRegularCredentialPath();
     const temporaryPath = `${this.filePath}.${process.pid}.${temporaryFileSequence++}.tmp`;
     try {
@@ -6557,8 +6723,11 @@ var EncryptedFileStore = class {
     }
   }
   async assertRegularCredentialPath() {
-    const resolvedPath = path9.resolve(this.filePath);
-    const protectedPaths = [path9.dirname(resolvedPath), resolvedPath];
+    const resolvedPath = path10.resolve(this.filePath);
+    const protectedPaths = getProtectedCredentialPaths(
+      resolvedPath,
+      this.symbolicLinkCheckStartPath
+    );
     for (const currentPath of protectedPaths) {
       try {
         const stats = await this.fs.lstat(currentPath);
@@ -6586,6 +6755,30 @@ var EncryptedFileStore = class {
     return this.keyPromise;
   }
 };
+function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
+  const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
+  return path10.resolve(homeDirectory, firstSegment ?? ".");
+}
+function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
+  if (symbolicLinkCheckStartPath === null) {
+    return [path10.dirname(resolvedPath), resolvedPath];
+  }
+  const resolvedStartPath = path10.resolve(symbolicLinkCheckStartPath);
+  if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
+    return [path10.dirname(resolvedPath), resolvedPath];
+  }
+  const protectedPaths = [resolvedStartPath];
+  let currentPath = resolvedStartPath;
+  for (const segment of path10.relative(resolvedStartPath, resolvedPath).split(path10.sep).filter(Boolean)) {
+    currentPath = path10.join(currentPath, segment);
+    protectedPaths.push(currentPath);
+  }
+  return protectedPaths;
+}
+function isPathInsideOrEqual(childPath, parentPath) {
+  const relativePath = path10.relative(parentPath, childPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !path10.isAbsolute(relativePath);
+}
 async function removeIfPresent(fileSystem, filePath) {
   try {
     await fileSystem.unlink(filePath);
@@ -6736,6 +6929,17 @@ function runSecurityCommand(command, args, options) {
     });
     let stdout = "";
     let stderr = "";
+    let stdinErrorMessage;
+    const appendStderr = (message2) => {
+      stderr = stderr.length === 0 ? message2 : `${stderr}${stderr.endsWith("\n") ? "" : "\n"}${message2}`;
+    };
+    const appendStdinError = () => {
+      if (stdinErrorMessage === void 0) {
+        return;
+      }
+      appendStderr(stdinErrorMessage);
+      stdinErrorMessage = void 0;
+    };
     child.stdout?.setEncoding("utf8");
     child.stdout?.on("data", (chunk) => {
       stdout += chunk.toString();
@@ -6745,17 +6949,23 @@ function runSecurityCommand(command, args, options) {
       stderr += chunk.toString();
     });
     if (options?.stdin !== void 0) {
+      child.stdin?.once("error", (error3) => {
+        stdinErrorMessage = error3 instanceof Error ? error3.message : String(error3);
+      });
       child.stdin?.end(options.stdin);
     }
     child.on("error", (error3) => {
       const message2 = error3 instanceof Error ? error3.message : String(error3 ?? "Unknown error");
+      appendStdinError();
+      appendStderr(message2);
       resolve({
         stdout,
-        stderr: stderr ? `${stderr}${message2}` : message2,
+        stderr,
         exitCode: 127
       });
     });
     child.on("close", (code) => {
+      appendStdinError();
       resolve({
         stdout,
         stderr,
@@ -6895,7 +7105,7 @@ function createAuthStoreClientStore(options) {
 }
 function createNamedSecretStore(key2, options, defaults) {
   const hash = crypto.createHash("sha256").update(key2).digest("hex");
-  const parsedFilePath = options.fileStore?.filePath === void 0 ? null : path10.parse(options.fileStore.filePath);
+  const parsedFilePath = options.fileStore?.filePath === void 0 ? null : path11.parse(options.fileStore.filePath);
   const fileStore = {
     ...options.fileStore,
     salt: options.fileStore?.salt ?? defaults.salt,
@@ -8478,10 +8688,19 @@ var McpClient = class {
     }
     try {
       let requestId;
+      let cancellationSent = false;
+      const sendCancellationNotification = () => {
+        if (requestId === void 0 || cancellationSent) {
+          return;
+        }
+        cancellationSent = true;
+        messageLayer.sendNotification("notifications/cancelled", { requestId });
+      };
       const requestPromise = messageLayer.sendRequest("tools/call", requestParams, {
         onRequestId: (nextRequestId) => {
           requestId = nextRequestId;
-        }
+        },
+        onTimeout: sendCancellationNotification
       }).then((result) => {
         if (!isCallToolResult(result)) {
           throw new McpError(ERROR_INVALID_REQUEST, "Invalid tool result");
@@ -8495,9 +8714,7 @@ var McpClient = class {
       let abortListener;
       const abortPromise = new Promise((_, reject) => {
         const rejectWithAbortReason = () => {
-          if (requestId !== void 0) {
-            messageLayer.sendNotification("notifications/cancelled", { requestId });
-          }
+          sendCancellationNotification();
           reject(signal.reason);
         };
         abortListener = rejectWithAbortReason;
@@ -9308,6 +9525,7 @@ var JsonRpcMessageLayer = class {
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         this.pendingRequests.delete(id);
+        options.onTimeout?.(id);
         reject(new Error(`JSON-RPC request "${method}" timed out after ${timeoutMs}ms`));
       }, timeoutMs);
       this.pendingRequests.set(id, { resolve, reject, timeout });
@@ -9720,13 +9938,13 @@ function convertJsonSchema(schema) {
   }
   return convertSchema(schema, schema, []);
 }
-function convertSchema(schema, root, path23) {
-  const resolvedSchema = resolveReferencedSchema(schema, root, path23);
+function convertSchema(schema, root, path24) {
+  const resolvedSchema = resolveReferencedSchema(schema, root, path24);
   const normalizedSchema = normalizeNullability(resolvedSchema);
   const composition = getComposition(normalizedSchema.schema);
   if (Array.isArray(normalizedSchema.schema.type)) {
     throw new Error(
-      `JSON Schema "${formatJsonSchemaPath(path23)}" has an unsupported type "${formatJsonSchemaType(
+      `JSON Schema "${formatJsonSchemaPath(path24)}" has an unsupported type "${formatJsonSchemaType(
         normalizedSchema.schema.type
       )}". Supported: string, number, integer, boolean, array, object.`
     );
@@ -9738,13 +9956,13 @@ function convertSchema(schema, root, path23) {
     return convertEnumSchema(resolvedSchema, normalizedSchema.nullable);
   }
   if (composition !== void 0) {
-    return convertCompositionSchema(normalizedSchema.schema, root, normalizedSchema.nullable, path23);
+    return convertCompositionSchema(normalizedSchema.schema, root, normalizedSchema.nullable, path24);
   }
   if (isRecordSchema(normalizedSchema.schema)) {
     return applyMetadata(
       S.Record(
         convertSchema(normalizedSchema.schema.additionalProperties, root, [
-          ...path23,
+          ...path24,
           "additionalProperties"
         ])
       ),
@@ -9793,12 +10011,12 @@ function convertSchema(schema, root, path23) {
       if (normalizedSchema.schema.items === void 0) {
         throw new Error(
           `JSON Schema "${formatJsonSchemaPath(
-            path23
+            path24
           )}" is an array but is missing the "items" field. Add "items": { ... } to declare the element type.`
         );
       }
       return S.Array(
-        convertSchema(normalizedSchema.schema.items, root, [...path23, "items"]),
+        convertSchema(normalizedSchema.schema.items, root, [...path24, "items"]),
         createCommonOptions(
           normalizedSchema.schema,
           normalizedSchema.nullable,
@@ -9808,7 +10026,7 @@ function convertSchema(schema, root, path23) {
     case "object":
       return convertObjectSchema(normalizedSchema.schema, root, {
         nullable: normalizedSchema.nullable,
-        path: path23
+        path: path24
       });
     case "null":
       return applyMetadata(S.Json(), normalizedSchema.schema, {
@@ -9823,12 +10041,12 @@ function convertSchema(schema, root, path23) {
       }
       throw new Error(
         `JSON Schema "${formatJsonSchemaPath(
-          path23
+          path24
         )}" must declare one of: "type", "enum", "const", "oneOf", "anyOf", or "allOf".`
       );
   }
   throw new Error(
-    `JSON Schema "${formatJsonSchemaPath(path23)}" has an unsupported type "${formatJsonSchemaType(
+    `JSON Schema "${formatJsonSchemaPath(path24)}" has an unsupported type "${formatJsonSchemaType(
       normalizedSchema.schema.type
     )}". Supported: string, number, integer, boolean, array, object.`
   );
@@ -9872,21 +10090,21 @@ function convertEnumSchema(schema, nullable) {
     )
   });
 }
-function convertCompositionSchema(schema, root, nullable, path23) {
+function convertCompositionSchema(schema, root, nullable, path24) {
   const composition = getComposition(schema);
   const branchSchemas = composition?.branches ?? [];
   const keyword = composition?.keyword ?? "oneOf";
   const branches = branchSchemas.map(
-    (branch, index) => resolveReferencedSchema(branch, root, [...path23, keyword, String(index)])
+    (branch, index) => resolveReferencedSchema(branch, root, [...path24, keyword, String(index)])
   );
-  const discriminator = findDiscriminator(branches, root, path23);
+  const discriminator = findDiscriminator(branches, root, path24);
   if (discriminator !== void 0) {
     const convertedBranches = Object.fromEntries(
       branches.map((branch, index) => [
         getDiscriminatorLiteral(branch, discriminator, root),
         convertObjectSchema(branch, root, {
           omitProperty: discriminator,
-          path: [...path23, keyword, String(index)]
+          path: [...path24, keyword, String(index)]
         })
       ])
     );
@@ -9905,7 +10123,7 @@ function convertCompositionSchema(schema, root, nullable, path23) {
     S.Union(
       branches.map(
         (branch, index) => convertObjectSchema(branch, root, {
-          path: [...path23, keyword, String(index)]
+          path: [...path24, keyword, String(index)]
         })
       )
     ),
@@ -10007,11 +10225,11 @@ function getComposition(schema) {
   }
   return void 0;
 }
-function formatJsonSchemaPath(path23) {
-  if (path23.length === 0) {
+function formatJsonSchemaPath(path24) {
+  if (path24.length === 0) {
     return "#";
   }
-  return `#/${path23.map(escapeJsonPointerSegment).join("/")}`;
+  return `#/${path24.map(escapeJsonPointerSegment).join("/")}`;
 }
 function formatJsonSchemaType(type2) {
   return Array.isArray(type2) ? JSON.stringify(type2) : String(type2);
@@ -10027,11 +10245,11 @@ function isRecordSchema(schema) {
   const propertyKeys = Object.keys(schema.properties ?? {});
   return schema.type === "object" && propertyKeys.length === 0 && typeof schema.additionalProperties === "object" && schema.additionalProperties !== null;
 }
-function findDiscriminator(branches, root, path23) {
+function findDiscriminator(branches, root, path24) {
   const [firstBranch] = branches;
   if (firstBranch === void 0) {
     throw new Error(
-      `JSON Schema "${formatJsonSchemaPath(path23)}" uses oneOf/anyOf/allOf but has no branches.`
+      `JSON Schema "${formatJsonSchemaPath(path24)}" uses oneOf/anyOf/allOf but has no branches.`
     );
   }
   const candidateKeys = Object.keys(firstBranch.properties ?? {});
@@ -10071,19 +10289,19 @@ function getDiscriminatorLiteral(branch, key2, root) {
   }
   return void 0;
 }
-function resolveReferencedSchema(schema, root, path23) {
+function resolveReferencedSchema(schema, root, path24) {
   if (schema.$ref === void 0) {
     return schema;
   }
   const resolvedTarget = resolveLocalRef(root, schema.$ref);
   if (resolvedTarget === void 0) {
     throw new Error(
-      `JSON Schema "${formatJsonSchemaPath(path23)}" uses "$ref": ${schema.$ref}. toolcraft only supports internal refs like "#/components/schemas/Foo".`
+      `JSON Schema "${formatJsonSchemaPath(path24)}" uses "$ref": ${schema.$ref}. toolcraft only supports internal refs like "#/components/schemas/Foo".`
     );
   }
   const { $ref: ignoredRef, ...siblingKeywords } = schema;
   void ignoredRef;
-  const resolvedSchema = resolveReferencedSchema(resolvedTarget, root, path23);
+  const resolvedSchema = resolveReferencedSchema(resolvedTarget, root, path24);
   if (Object.keys(siblingKeywords).length === 0) {
     return resolvedSchema;
   }
@@ -10107,9 +10325,9 @@ function mergeJsonSchemas(base, overlay) {
     ...mergedRequired === void 0 ? {} : { required: mergedRequired }
   };
 }
-function hasSelfReferencingRef(schema, root, path23 = "#", activePaths = /* @__PURE__ */ new Set()) {
+function hasSelfReferencingRef(schema, root, path24 = "#", activePaths = /* @__PURE__ */ new Set()) {
   const nextActivePaths = new Set(activePaths);
-  nextActivePaths.add(path23);
+  nextActivePaths.add(path24);
   const localRefPath = getLocalRefPath(schema.$ref);
   if (localRefPath !== void 0) {
     if (nextActivePaths.has(localRefPath)) {
@@ -10120,13 +10338,13 @@ function hasSelfReferencingRef(schema, root, path23 = "#", activePaths = /* @__P
       return true;
     }
   }
-  if (schema.items !== void 0 && hasSelfReferencingRef(schema.items, root, `${path23}/items`, nextActivePaths)) {
+  if (schema.items !== void 0 && hasSelfReferencingRef(schema.items, root, `${path24}/items`, nextActivePaths)) {
     return true;
   }
   if (typeof schema.additionalProperties === "object" && schema.additionalProperties !== null && hasSelfReferencingRef(
     schema.additionalProperties,
     root,
-    `${path23}/additionalProperties`,
+    `${path24}/additionalProperties`,
     nextActivePaths
   )) {
     return true;
@@ -10135,7 +10353,7 @@ function hasSelfReferencingRef(schema, root, path23 = "#", activePaths = /* @__P
     if (hasSelfReferencingRef(
       childSchema,
       root,
-      `${path23}/properties/${escapeJsonPointerSegment(key2)}`,
+      `${path24}/properties/${escapeJsonPointerSegment(key2)}`,
       nextActivePaths
     )) {
       return true;
@@ -10145,24 +10363,24 @@ function hasSelfReferencingRef(schema, root, path23 = "#", activePaths = /* @__P
     if (hasSelfReferencingRef(
       childSchema,
       root,
-      `${path23}/$defs/${escapeJsonPointerSegment(key2)}`,
+      `${path24}/$defs/${escapeJsonPointerSegment(key2)}`,
       nextActivePaths
     )) {
       return true;
     }
   }
   for (const [index, childSchema] of (schema.oneOf ?? []).entries()) {
-    if (hasSelfReferencingRef(childSchema, root, `${path23}/oneOf/${index}`, nextActivePaths)) {
+    if (hasSelfReferencingRef(childSchema, root, `${path24}/oneOf/${index}`, nextActivePaths)) {
       return true;
     }
   }
   for (const [index, childSchema] of (schema.anyOf ?? []).entries()) {
-    if (hasSelfReferencingRef(childSchema, root, `${path23}/anyOf/${index}`, nextActivePaths)) {
+    if (hasSelfReferencingRef(childSchema, root, `${path24}/anyOf/${index}`, nextActivePaths)) {
       return true;
     }
   }
   for (const [index, childSchema] of (schema.allOf ?? []).entries()) {
-    if (hasSelfReferencingRef(childSchema, root, `${path23}/allOf/${index}`, nextActivePaths)) {
+    if (hasSelfReferencingRef(childSchema, root, `${path24}/allOf/${index}`, nextActivePaths)) {
       return true;
     }
   }
@@ -10178,14 +10396,14 @@ function getLocalRefPath(ref) {
   return ref.startsWith("#/") ? ref : void 0;
 }
 function resolveLocalRef(root, ref) {
-  const path23 = getLocalRefPath(ref);
-  if (path23 === void 0) {
+  const path24 = getLocalRefPath(ref);
+  if (path24 === void 0) {
     return void 0;
   }
-  if (path23 === "#") {
+  if (path24 === "#") {
     return root;
   }
-  const segments = path23.slice(2).split("/").map(unescapeJsonPointerSegment);
+  const segments = path24.slice(2).split("/").map(unescapeJsonPointerSegment);
   let current = root;
   for (const segment of segments) {
     if (Array.isArray(current)) {
@@ -10446,8 +10664,8 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  const directory = path11.dirname(cachePath);
-  const tempPath = `${cachePath}.tmp-${randomUUID()}`;
+  const directory = path12.dirname(cachePath);
+  const tempPath = `${cachePath}.tmp-${randomUUID2()}`;
   await assertCachePathHasNoSymlinks(cachePath);
   await assertCachePathHasNoSymlinks(tempPath);
   await mkdir(directory, { recursive: true });
@@ -10627,13 +10845,13 @@ function collectProxyGroups(root) {
 function findProjectRoot(from = process.cwd()) {
   let current = process.cwd();
   if (from !== current) {
-    current = path11.resolve(from);
+    current = path12.resolve(from);
   }
   while (true) {
-    if (existsSync2(path11.join(current, "package.json"))) {
+    if (existsSync2(path12.join(current, "package.json"))) {
       return current;
     }
-    const parent = path11.dirname(current);
+    const parent = path12.dirname(current);
     if (parent === current) {
       return void 0;
     }
@@ -10650,7 +10868,7 @@ function resolveCachePath(name, projectRoot) {
   if (name.length === 0 || name === "." || name === ".." || name.includes("/") || name.includes("\\")) {
     throw new Error(`MCP proxy group name must be a file-safe name: "${name}".`);
   }
-  return path11.join(resolvedProjectRoot, ".toolcraft", "mcp", `${name}.json`);
+  return path12.join(resolvedProjectRoot, ".toolcraft", "mcp", `${name}.json`);
 }
 async function assertCachePathHasNoSymlinks(filePath) {
   let currentPath = filePath;
@@ -10664,10 +10882,10 @@ async function assertCachePathHasNoSymlinks(filePath) {
         throw error3;
       }
     }
-    if (path11.basename(currentPath) === ".toolcraft") {
+    if (path12.basename(currentPath) === ".toolcraft") {
       return;
     }
-    const parentPath = path11.dirname(currentPath);
+    const parentPath = path12.dirname(currentPath);
     if (parentPath === currentPath) {
       return;
     }
@@ -10741,20 +10959,20 @@ function reportsEnabled(option, env) {
 function resolveReportDir(option, projectRoot) {
   const configuredDir = typeof option === "object" ? option.dir : void 0;
   if (configuredDir === void 0 || configuredDir.length === 0) {
-    return path12.join(projectRoot, ".toolcraft", "errors");
+    return path13.join(projectRoot, ".toolcraft", "errors");
   }
-  return path12.isAbsolute(configuredDir) ? configuredDir : path12.join(projectRoot, configuredDir);
+  return path13.isAbsolute(configuredDir) ? configuredDir : path13.join(projectRoot, configuredDir);
 }
 function reportDirMustStayWithinProject(option) {
   const configuredDir = typeof option === "object" ? option.dir : void 0;
-  return configuredDir === void 0 || configuredDir.length === 0 || !path12.isAbsolute(configuredDir);
+  return configuredDir === void 0 || configuredDir.length === 0 || !path13.isAbsolute(configuredDir);
 }
 function isWithinDirectory(parent, child) {
-  const relative = path12.relative(parent, child);
-  return relative === "" || !path12.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path12.sep}`);
+  const relative = path13.relative(parent, child);
+  return relative === "" || !path13.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path13.sep}`);
 }
 async function assertReportDirWithinProject(projectRoot, reportDir) {
-  if (!isWithinDirectory(path12.resolve(projectRoot), path12.resolve(reportDir))) {
+  if (!isWithinDirectory(path13.resolve(projectRoot), path13.resolve(reportDir))) {
     throw new Error("Error report directory resolves outside project root.");
   }
   const [canonicalProjectRoot, canonicalReportDir] = await Promise.all([
@@ -10805,7 +11023,7 @@ function slugifyCommandPath(commandPath) {
   return output.length === 0 ? "root" : output;
 }
 function relativeDisplayPath(projectRoot, absolutePath) {
-  const relative = path12.relative(projectRoot, absolutePath);
+  const relative = path13.relative(projectRoot, absolutePath);
   return relative.length === 0 || relative.startsWith("..") ? absolutePath : relative;
 }
 function redactValue(value) {
@@ -11045,8 +11263,8 @@ async function writeErrorReport(context) {
   }
   const projectRoot = resolveProjectRoot(context.projectRoot);
   const reportDir = resolveReportDir(context.errorReports, projectRoot);
-  const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID2()}.log`;
-  const absolutePath = path12.join(reportDir, fileName);
+  const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID3()}.log`;
+  const absolutePath = path13.join(reportDir, fileName);
   await mkdir2(reportDir, { recursive: true });
   if (reportDirMustStayWithinProject(context.errorReports)) {
     await assertReportDirWithinProject(projectRoot, reportDir);
@@ -11510,7 +11728,7 @@ function inferProgramName(argv) {
   if (typeof entrypoint !== "string" || entrypoint.length === 0) {
     return "toolcraft";
   }
-  const parsed = path13.parse(entrypoint);
+  const parsed = path14.parse(entrypoint);
   return parsed.name.length > 0 ? parsed.name : "toolcraft";
 }
 function normalizeRoots(roots, argv) {
@@ -11568,11 +11786,11 @@ function formatSegment(segment, casing) {
   const separator = casing === "snake" ? "_" : "-";
   return splitWords3(segment).join(separator);
 }
-function toOptionFlag(path23, casing) {
-  return `--${path23.map((segment) => formatSegment(segment, casing)).join(".")}`;
+function toOptionFlag(path24, casing) {
+  return `--${path24.map((segment) => formatSegment(segment, casing)).join(".")}`;
 }
-function toOptionAttribute(path23, casing) {
-  return path23.map((segment) => {
+function toOptionAttribute(path24, casing) {
+  return path24.map((segment) => {
     const formatted = formatSegment(segment, casing);
     if (casing === "snake") {
       return formatted;
@@ -11583,23 +11801,23 @@ function toOptionAttribute(path23, casing) {
     ).join("");
   }).join(".");
 }
-function toDisplayPath(path23) {
-  return path23.join(".");
+function toDisplayPath(path24) {
+  return path24.join(".");
 }
-function toUnionKindControlPath(path23) {
-  if (path23.length === 0) {
+function toUnionKindControlPath(path24) {
+  if (path24.length === 0) {
     return ["kind"];
   }
-  const head = path23.slice(0, -1);
-  const tail = path23[path23.length - 1] ?? "";
+  const head = path24.slice(0, -1);
+  const tail = path24[path24.length - 1] ?? "";
   return [...head, `${tail}Kind`];
 }
-function toUnionKindDisplayPath(path23) {
-  if (path23.length === 0) {
+function toUnionKindDisplayPath(path24) {
+  if (path24.length === 0) {
     return "kind";
   }
-  const head = path23.slice(0, -1);
-  const tail = path23[path23.length - 1] ?? "";
+  const head = path24.slice(0, -1);
+  const tail = path24[path24.length - 1] ?? "";
   return [...head, `${tail}-kind`].join(".");
 }
 function createSyntheticEnumSchema(values) {
@@ -11615,14 +11833,14 @@ function getRequiredBranchFingerprint(branch, casing) {
   const requiredKeys = Object.entries(branch.shape).filter(([, schema]) => schema.kind !== "optional").map(([key2]) => formatSegment(key2, casing)).sort();
   return requiredKeys.join("+");
 }
-function collectFields(schema, casing, globalLongOptionFlags, path23 = [], inheritedOptional = false, variantContext) {
+function collectFields(schema, casing, globalLongOptionFlags, path24 = [], inheritedOptional = false, variantContext) {
   const collected = {
     dynamicFields: [],
     fields: [],
     variants: []
   };
   for (const [key2, rawChildSchema] of Object.entries(schema.shape)) {
-    const nextPath = [...path23, key2];
+    const nextPath = [...path24, key2];
     const runtimeOptional = inheritedOptional || rawChildSchema.kind === "optional";
     const childSchema = unwrapOptional2(rawChildSchema);
     const requiredWhenActive = rawChildSchema.kind !== "optional" && childSchema.default === void 0;
@@ -11803,9 +12021,9 @@ function collectFields(schema, casing, globalLongOptionFlags, path23 = [], inher
   }
   return collected;
 }
-function toCommanderOptionAttribute(path23, casing, globalLongOptionFlags) {
-  const optionAttribute = toOptionAttribute(path23, casing);
-  const optionFlag = toOptionFlag(path23, casing);
+function toCommanderOptionAttribute(path24, casing, globalLongOptionFlags) {
+  const optionAttribute = toOptionAttribute(path24, casing);
+  const optionFlag = toOptionFlag(path24, casing);
   if (!globalLongOptionFlags.has(optionFlag)) {
     return optionAttribute;
   }
@@ -12774,10 +12992,10 @@ function parseDebugStackMode(value) {
     formatInvalidEnumMessage("--debug", String(value), ["raw"], { candidates: ["raw"] })
   );
 }
-function setNestedValue(target, path23, value) {
+function setNestedValue(target, path24, value) {
   let cursor = target;
-  for (let index = 0; index < path23.length - 1; index += 1) {
-    const segment = path23[index] ?? "";
+  for (let index = 0; index < path24.length - 1; index += 1) {
+    const segment = path24[index] ?? "";
     const existing = Object.prototype.hasOwnProperty.call(cursor, segment) ? cursor[segment] : void 0;
     if (typeof existing === "object" && existing !== null) {
       cursor = existing;
@@ -12792,7 +13010,7 @@ function setNestedValue(target, path23, value) {
     });
     cursor = next;
   }
-  const leaf = path23[path23.length - 1];
+  const leaf = path24[path24.length - 1];
   if (leaf !== void 0) {
     Object.defineProperty(cursor, leaf, {
       value,
@@ -12902,21 +13120,21 @@ async function withOutputFormat2(output, fn) {
 }
 function createFs2() {
   return {
-    readFile: async (path23, encoding = "utf8") => readFile4(path23, { encoding }),
-    writeFile: async (path23, contents) => {
-      await writeFile5(path23, contents);
+    readFile: async (path24, encoding = "utf8") => readFile4(path24, { encoding }),
+    writeFile: async (path24, contents) => {
+      await writeFile5(path24, contents);
     },
-    exists: async (path23) => {
+    exists: async (path24) => {
       try {
-        await access2(path23);
+        await access2(path24);
         return true;
       } catch {
         return false;
       }
     },
-    lstat: async (path23) => lstat3(path23),
+    lstat: async (path24) => lstat3(path24),
     rename: async (fromPath, toPath) => rename3(fromPath, toPath),
-    unlink: async (path23) => unlink2(path23)
+    unlink: async (path24) => unlink2(path24)
   };
 }
 function createEnv2(values = process.env) {
@@ -12932,9 +13150,9 @@ function isPlainObject3(value) {
 function hasFieldValue(value) {
   return value !== void 0;
 }
-function hasNestedField(fields, path23) {
+function hasNestedField(fields, path24) {
   return fields.some(
-    (field) => path23.length < field.path.length && path23.every((segment, index) => field.path[index] === segment)
+    (field) => path24.length < field.path.length && path24.every((segment, index) => field.path[index] === segment)
   );
 }
 function describeExpectedPresetValue(schema) {
@@ -13040,9 +13258,9 @@ async function loadPresetValues(fields, presetPath) {
   }
   const fieldByPath = new Map(fields.map((field) => [field.displayPath, field]));
   const presetValues = {};
-  function visitObject(current, path23) {
+  function visitObject(current, path24) {
     for (const [key2, value] of Object.entries(current)) {
-      const nextPath = [...path23, key2];
+      const nextPath = [...path24, key2];
       const displayPath = toDisplayPath(nextPath);
       const field = fieldByPath.get(displayPath);
       if (field !== void 0) {
@@ -13249,8 +13467,8 @@ function createFixtureService(definition) {
   );
 }
 function resolveFixturePath(commandPath) {
-  const parsed = path13.parse(commandPath);
-  return path13.join(parsed.dir, `${parsed.name}.fixture.json`);
+  const parsed = path14.parse(commandPath);
+  return path14.join(parsed.dir, `${parsed.name}.fixture.json`);
 }
 function selectFixtureScenario(scenarios, selector, fixturePath) {
   if (isNumericFixtureSelector(selector)) {
@@ -13384,8 +13602,8 @@ function validateServices(services) {
     }
   }
 }
-function getNestedValue(target, path23) {
-  return path23.reduce(
+function getNestedValue(target, path24) {
+  return path24.reduce(
     (current, segment) => current !== null && typeof current === "object" ? current[segment] : void 0,
     target
   );
@@ -14536,7 +14754,8 @@ function configureCommanderSuggestionOutput(command) {
 }
 async function runCLI(roots, options = {}) {
   enableSourceMaps();
-  const root = mergeApprovalsGroup(normalizeRoots(roots, process.argv));
+  const normalizedRoot = normalizeRoots(roots, process.argv);
+  const root = options.approvals === false ? normalizedRoot : mergeApprovalsGroup(normalizedRoot);
   await resolveMcpProxies(root, { projectRoot: options.projectRoot });
   const casing = options.casing ?? "kebab";
   const services = options.services ?? {};
@@ -14648,7 +14867,7 @@ async function runCLI(roots, options = {}) {
 }
 
 // src/terminal-pilot.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/terminal-session.ts
 import { EventEmitter } from "node:events";
@@ -14667,7 +14886,7 @@ var DCS = 144;
 var SOS = 152;
 var PM = 158;
 var APC = 159;
-function stripAnsi3(input) {
+function stripAnsi4(input) {
   let output = "";
   for (let index = 0; index < input.length; index += 1) {
     const code = input.charCodeAt(index);
@@ -15547,7 +15766,7 @@ var TerminalScreen = class {
     cursor,
     size
   }) {
-    this.lines = Object.freeze(lines.map((line) => stripAnsi3(line)));
+    this.lines = Object.freeze(lines.map((line) => stripAnsi4(line)));
     this.rawLines = Object.freeze([...rawLines]);
     this.cursor = Object.freeze({ ...cursor });
     this.size = Object.freeze({ ...size });
@@ -15702,7 +15921,7 @@ var TerminalSession = class {
     });
   }
   async history(opts) {
-    const normalized = normalizeHistoryBuffer(stripAnsi3(this.rawBuffer));
+    const normalized = normalizeHistoryBuffer(stripAnsi4(this.rawBuffer));
     const lines = splitHistoryLines(normalized);
     if (opts?.last === void 0) {
       return lines;
@@ -15835,7 +16054,7 @@ function isMissingFileError(error3) {
   return "code" in error3 && error3.code === "ENOENT";
 }
 function matchPattern(buffer, pattern) {
-  const clean = normalizeHistoryBuffer(stripAnsi3(buffer));
+  const clean = normalizeHistoryBuffer(stripAnsi4(buffer));
   for (const line of clean.split("\n")) {
     if (typeof pattern === "string") {
       if (line.includes(pattern)) return line;
@@ -15923,7 +16142,7 @@ var TerminalPilot = class _TerminalPilot {
   }
   async newSession(opts) {
     const session = new TerminalSession({
-      id: randomUUID3(),
+      id: randomUUID4(),
       command: opts.command,
       args: opts.args,
       cwd: opts.cwd,
@@ -16191,7 +16410,7 @@ var getSession = defineCommand({
 
 // ../agent-skill-config/src/configs.ts
 import os2 from "node:os";
-import path14 from "node:path";
+import path15 from "node:path";
 
 // ../agent-defs/src/agents/claude-code.ts
 var claudeCodeAgent = {
@@ -16500,7 +16719,7 @@ var templateMutation = {
 };
 
 // ../config-mutations/src/execution/apply-mutation.ts
-import path16 from "node:path";
+import path17 from "node:path";
 
 // ../config-mutations/src/formats/json.ts
 import * as jsonc from "jsonc-parser";
@@ -16538,6 +16757,13 @@ function cloneConfigValue(value) {
 function isConfigObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function detectIndent(content) {
+  const match = content.match(/^[\t ]+/m);
+  if (match) {
+    return match[0];
+  }
+  return "  ";
+}
 function parse3(content) {
   if (!content || content.trim() === "") {
     return {};
@@ -16577,6 +16803,9 @@ function merge(base, patch) {
   }
   return result;
 }
+function configValuesEqual(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
 function prune(obj, shape) {
   let changed = false;
   const result = cloneConfigObject(obj);
@@ -16613,9 +16842,56 @@ function prune(obj, shape) {
   }
   return { changed, result };
 }
+function modifyAtPath(content, path24, value) {
+  const indent = detectIndent(content);
+  const formattingOptions = {
+    tabSize: indent === "	" ? 1 : indent.length,
+    insertSpaces: indent !== "	",
+    eol: "\n"
+  };
+  const edits = jsonc.modify(content, path24, value, { formattingOptions });
+  let result = jsonc.applyEdits(content, edits);
+  if (!result.endsWith("\n")) {
+    result += "\n";
+  }
+  return result;
+}
+function removeAtPath(content, path24) {
+  return modifyAtPath(content, path24, void 0);
+}
+function serializeUpdate(content, current, next) {
+  let result = content || "{}";
+  result = applyObjectUpdate(result, [], current, next);
+  if (!result.endsWith("\n")) {
+    result += "\n";
+  }
+  return result;
+}
+function applyObjectUpdate(content, path24, current, next) {
+  let result = content;
+  for (const key2 of Object.keys(current)) {
+    if (!hasConfigEntry(next, key2)) {
+      result = removeAtPath(result, [...path24, key2]);
+    }
+  }
+  for (const [key2, nextValue] of Object.entries(next)) {
+    const nextPath = [...path24, key2];
+    const hasCurrent = hasConfigEntry(current, key2);
+    const currentValue = hasCurrent ? current[key2] : void 0;
+    if (hasCurrent && isConfigObject(currentValue) && isConfigObject(nextValue)) {
+      result = applyObjectUpdate(result, nextPath, currentValue, nextValue);
+      continue;
+    }
+    if (!hasCurrent || !configValuesEqual(currentValue, nextValue)) {
+      result = modifyAtPath(result, nextPath, nextValue);
+    }
+  }
+  return result;
+}
 var jsonFormat = {
   parse: parse3,
   serialize,
+  serializeUpdate,
   merge,
   prune
 };
@@ -16799,20 +17075,20 @@ function getConfigFormat(pathOrFormat) {
   }
   return formatRegistry[formatName];
 }
-function detectFormat(path23) {
-  const ext = getExtension(path23);
+function detectFormat(path24) {
+  const ext = getExtension(path24);
   return extensionMap[ext];
 }
-function getExtension(path23) {
-  const lastDot = path23.lastIndexOf(".");
+function getExtension(path24) {
+  const lastDot = path24.lastIndexOf(".");
   if (lastDot === -1) {
     return "";
   }
-  return path23.slice(lastDot).toLowerCase();
+  return path24.slice(lastDot).toLowerCase();
 }
 
 // ../config-mutations/src/execution/path-utils.ts
-import path15 from "node:path";
+import path16 from "node:path";
 function expandHome(targetPath, homeDir) {
   if (!targetPath?.startsWith("~")) {
     return targetPath;
@@ -16829,7 +17105,7 @@ function expandHome(targetPath, homeDir) {
       remainder = remainder.slice(1);
     }
   }
-  return remainder.length === 0 ? homeDir : path15.join(homeDir, remainder);
+  return remainder.length === 0 ? homeDir : path16.join(homeDir, remainder);
 }
 function validateHomePath(targetPath) {
   if (typeof targetPath !== "string" || targetPath.length === 0) {
@@ -16844,21 +17120,21 @@ function validateHomePath(targetPath) {
 function resolvePath(rawPath, homeDir, pathMapper) {
   validateHomePath(rawPath);
   const expanded = expandHome(rawPath, homeDir);
-  const canonicalHome = path15.resolve(homeDir);
-  const canonicalExpanded = path15.resolve(expanded);
-  const relative = path15.relative(canonicalHome, canonicalExpanded);
-  if (relative === ".." || relative.startsWith(`..${path15.sep}`) || path15.isAbsolute(relative)) {
+  const canonicalHome = path16.resolve(homeDir);
+  const canonicalExpanded = path16.resolve(expanded);
+  const relative = path16.relative(canonicalHome, canonicalExpanded);
+  if (relative === ".." || relative.startsWith(`..${path16.sep}`) || path16.isAbsolute(relative)) {
     throw new Error(`Target path resolves outside home directory: "${rawPath}"`);
   }
   if (!pathMapper) {
     return canonicalExpanded;
   }
-  const rawDirectory = path15.dirname(expanded);
+  const rawDirectory = path16.dirname(expanded);
   const mappedDirectory = pathMapper.mapTargetDirectory({
     targetDirectory: rawDirectory
   });
-  const filename = path15.basename(expanded);
-  return filename.length === 0 ? mappedDirectory : path15.join(mappedDirectory, filename);
+  const filename = path16.basename(expanded);
+  return filename.length === 0 ? mappedDirectory : path16.join(mappedDirectory, filename);
 }
 
 // ../config-mutations/src/fs-utils.ts
@@ -16922,8 +17198,8 @@ function isAlreadyExists(error3) {
   return Boolean(error3 && typeof error3 === "object" && "code" in error3 && error3.code === "EEXIST");
 }
 async function assertRegularWriteTarget(context, targetPath) {
-  const boundary = path16.dirname(path16.resolve(context.homeDir));
-  let currentPath = path16.resolve(targetPath);
+  const boundary = path17.dirname(path17.resolve(context.homeDir));
+  let currentPath = path17.resolve(targetPath);
   while (currentPath !== boundary) {
     try {
       if ((await context.fs.lstat(currentPath)).isSymbolicLink()) {
@@ -16934,7 +17210,7 @@ async function assertRegularWriteTarget(context, targetPath) {
         throw error3;
       }
     }
-    const parentPath = path16.dirname(currentPath);
+    const parentPath = path17.dirname(currentPath);
     if (parentPath === currentPath) {
       return;
     }
@@ -16997,7 +17273,7 @@ function pruneKeysByPrefix(table, prefix) {
   const result = {};
   for (const [key2, value] of Object.entries(table)) {
     if (!key2.startsWith(prefix)) {
-      result[key2] = value;
+      setConfigEntry(result, key2, value);
     }
   }
   return result;
@@ -17006,28 +17282,43 @@ function isConfigObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function mergeWithPruneByPrefix(base, patch, pruneByPrefix) {
-  const result = { ...base };
+  const result = cloneConfigObject(base);
   const prefixMap = pruneByPrefix ?? {};
   for (const [key2, value] of Object.entries(patch)) {
+    if (value === void 0) {
+      continue;
+    }
     const current = result[key2];
     const prefix = prefixMap[key2];
     if (isConfigObject4(current) && isConfigObject4(value)) {
       if (prefix) {
         const pruned = pruneKeysByPrefix(current, prefix);
-        result[key2] = { ...pruned, ...value };
+        setConfigEntry(result, key2, mergePrunedConfigObject(pruned, value));
       } else {
-        result[key2] = mergeWithPruneByPrefix(
-          current,
-          value,
-          prefixMap
-        );
+        setConfigEntry(result, key2, mergeWithPruneByPrefix(current, value, prefixMap));
       }
       continue;
     }
-    result[key2] = value;
+    setConfigEntry(result, key2, value);
   }
   return result;
 }
+function mergePrunedConfigObject(base, patch) {
+  const result = cloneConfigObject(base);
+  for (const [key2, value] of Object.entries(patch)) {
+    if (value === void 0) {
+      continue;
+    }
+    setConfigEntry(result, key2, value);
+  }
+  return result;
+}
+function serializeConfigUpdate(format, rawContent, current, next) {
+  if (rawContent !== null && format.serializeUpdate) {
+    return format.serializeUpdate(rawContent, current, next);
+  }
+  return format.serialize(next);
+}
 async function applyMutation(mutation, context, options) {
   switch (mutation.kind) {
     case "ensureDirectory":
@@ -17340,6 +17631,7 @@ async function applyConfigMerge(mutation, context, options) {
   }
   const format = getConfigFormat(formatName);
   const rawContent = await readFileIfExists(context.fs, targetPath);
+  let preserveContent = rawContent;
   let current;
   try {
     current = rawContent === null ? {} : format.parse(rawContent);
@@ -17348,6 +17640,7 @@ async function applyConfigMerge(mutation, context, options) {
       await backupInvalidDocument(context, targetPath, rawContent);
     }
     current = {};
+    preserveContent = null;
   }
   const value = resolveValue(mutation.value, options);
   let merged;
@@ -17356,7 +17649,7 @@ async function applyConfigMerge(mutation, context, options) {
   } else {
     merged = format.merge(current, value);
   }
-  const serialized = format.serialize(merged);
+  const serialized = serializeConfigUpdate(format, preserveContent, current, merged);
   const changed = serialized !== rawContent;
   if (changed && !context.dryRun) {
     await writeAtomically2(context, targetPath, serialized);
@@ -17424,7 +17717,7 @@ async function applyConfigPrune(mutation, context, options) {
       details
     };
   }
-  const serialized = format.serialize(result);
+  const serialized = serializeConfigUpdate(format, rawContent, current, result);
   if (!context.dryRun) {
     await writeAtomically2(context, targetPath, serialized);
   }
@@ -17449,6 +17742,7 @@ async function applyConfigTransform(mutation, context, options) {
   }
   const format = getConfigFormat(formatName);
   const rawContent = await readFileIfExists(context.fs, targetPath);
+  let preserveContent = rawContent;
   let current;
   try {
     current = rawContent === null ? {} : format.parse(rawContent);
@@ -17457,6 +17751,7 @@ async function applyConfigTransform(mutation, context, options) {
       await backupInvalidDocument(context, targetPath, rawContent);
     }
     current = {};
+    preserveContent = null;
   }
   const { content: transformed, changed } = mutation.transform(current, options);
   if (!changed) {
@@ -17480,7 +17775,7 @@ async function applyConfigTransform(mutation, context, options) {
       details
     };
   }
-  const serialized = format.serialize(transformed);
+  const serialized = serializeConfigUpdate(format, preserveContent, current, transformed);
   if (!context.dryRun) {
     await writeAtomically2(context, targetPath, serialized);
   }
@@ -17622,7 +17917,7 @@ async function executeMutation(mutation, context, options) {
 
 // ../agent-skill-config/src/templates.ts
 import { readFile as readFile5, stat } from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../agent-skill-config/src/apply.ts
@@ -17699,21 +17994,21 @@ async function installSkill(agentId, skill, options) {
 
 // ../agent-skill-config/src/resolve-skill-reference.ts
 import { statSync as statSync2 } from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // ../agent-skill-config/src/git-exclude.ts
 import { execFileSync } from "node:child_process";
 import * as fs2 from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 
 // ../agent-skill-config/src/bridge-active-skills.ts
 import * as fs3 from "node:fs";
-import { createHash as createHash4, randomUUID as randomUUID4 } from "node:crypto";
-import path20 from "node:path";
+import { createHash as createHash4, randomUUID as randomUUID5 } from "node:crypto";
+import path21 from "node:path";
 
 // src/commands/installer.ts
 import os3 from "node:os";
-import path21 from "node:path";
+import path22 from "node:path";
 import * as nodeFs2 from "node:fs/promises";
 import { readFile as readFile6 } from "node:fs/promises";
 var DEFAULT_INSTALL_AGENT = "claude-code";
@@ -17780,7 +18075,7 @@ function resolveHomeRelativePath(targetPath, homeDir) {
     return homeDir;
   }
   if (targetPath.startsWith("~/")) {
-    return path21.join(homeDir, targetPath.slice(2));
+    return path22.join(homeDir, targetPath.slice(2));
   }
   return targetPath;
 }
@@ -17790,18 +18085,18 @@ function getSkillFolderWithHome(agent, scope, cwd, homeDir) {
     throwUnsupportedAgent(agent);
   }
   return {
-    displayPath: path21.join(
+    displayPath: path22.join(
       scope === "global" ? config.globalSkillDir : config.localSkillDir,
       TERMINAL_PILOT_SKILL_NAME
     ),
-    fullPath: path21.join(
-      scope === "global" ? resolveHomeRelativePath(config.globalSkillDir, homeDir) : path21.resolve(cwd, config.localSkillDir),
+    fullPath: path22.join(
+      scope === "global" ? resolveHomeRelativePath(config.globalSkillDir, homeDir) : path22.resolve(cwd, config.localSkillDir),
       TERMINAL_PILOT_SKILL_NAME
     )
   };
 }
 async function assertNoSymbolicLinkPath(fs4, targetPath) {
-  const rootPath = path21.parse(targetPath).root;
+  const rootPath = path22.parse(targetPath).root;
   let currentPath = targetPath;
   while (currentPath !== rootPath) {
     try {
@@ -17813,7 +18108,7 @@ async function assertNoSymbolicLinkPath(fs4, targetPath) {
         throw error3;
       }
     }
-    currentPath = path21.dirname(currentPath);
+    currentPath = path22.dirname(currentPath);
   }
 }
 
@@ -17952,7 +18247,7 @@ var resize = defineCommand({
 });
 
 // ../terminal-png/src/index.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { rename as rename4, rm, writeFile as writeFile6 } from "node:fs/promises";
 
 // ../terminal-png/src/ansi-parser.ts
@@ -18892,7 +19187,7 @@ async function renderTerminalPng(ansiText, options = {}) {
   });
   const png = renderPng(svg);
   if (options.output) {
-    const temporaryPath = `${options.output}.${randomUUID5()}.tmp`;
+    const temporaryPath = `${options.output}.${randomUUID6()}.tmp`;
     try {
       await writeFile6(temporaryPath, png, { flag: "wx" });
       await rename4(temporaryPath, options.output);
@@ -18969,7 +19264,7 @@ var type = defineCommand({
 });
 
 // src/commands/uninstall.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 var params14 = S.Object({
   agent: S.Enum(installableAgents, {
     description: "Agent to uninstall terminal-pilot from",
@@ -19005,7 +19300,7 @@ var uninstall = defineCommand({
         if (!await folderExists(services.fs, skill.fullPath)) {
           continue;
         }
-        const stagingPath = `${skill.fullPath}.removing-${randomUUID6()}`;
+        const stagingPath = `${skill.fullPath}.removing-${randomUUID7()}`;
         await services.fs.rename(skill.fullPath, stagingPath);
         staged.push({ ...skill, stagingPath });
       }
@@ -19135,7 +19430,7 @@ async function isDirectExecution(argv) {
   try {
     const modulePath = fileURLToPath5(import.meta.url);
     const [resolvedEntryPoint, resolvedModulePath] = await Promise.all([
-      realpath2(path22.resolve(entryPoint)),
+      realpath2(path23.resolve(entryPoint)),
       realpath2(modulePath)
     ]);
     return resolvedEntryPoint === resolvedModulePath;