terminal-pilot 0.0.30 → 0.0.32

package/dist/testing/cli-repl.js

@@ -79,12 +79,12 @@ function consumeTerminatedString(input, index, allowBellTerminator) {
 
 // src/cli.ts
 import { realpath as realpath3 } from "node:fs/promises";
-import path23 from "node:path";
+import path24 from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // ../toolcraft/src/cli.ts
-import { access as access2, lstat as lstat3, readFile as readFile4, rename as rename3, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
-import path14 from "node:path";
+import { access as access2, lstat as lstat3, readFile as readFile5, rename as rename3, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
+import path15 from "node:path";
 import {
   Command as CommanderCommand,
   CommanderError as CommanderError2,
@@ -450,7 +450,8 @@ function renderMarkdownCode(content) {
     currentRun = 0;
   }
   const delimiter = "`".repeat(longestRun + 1);
-  return `${delimiter}${value}${delimiter}`;
+  const paddedValue = value.startsWith("`") || value.endsWith("`") ? ` ${value} ` : value;
+  return `${delimiter}${paddedValue}${delimiter}`;
 }
 function renderMarkdownLink(content) {
   const value = renderMarkdownInline(content);
@@ -605,7 +606,54 @@ var symbols = {
 
 // ../toolcraft-design/src/internal/strip-ansi.ts
 function stripAnsi2(value) {
-  return value.replace(/\u001b\[[0-9;]*m/g, "");
+  let output = "";
+  let index = 0;
+  while (index < value.length) {
+    const char = value[index];
+    if (char === "\x1B") {
+      index = skipEscapeSequence(value, index);
+      continue;
+    }
+    if (char === "\x9B") {
+      index = skipCsiSequence(value, index + 1);
+      continue;
+    }
+    output += char;
+    index += char.length;
+  }
+  return output;
+}
+function skipEscapeSequence(value, index) {
+  const next = value[index + 1];
+  if (next === "[") {
+    return skipCsiSequence(value, index + 2);
+  }
+  if (next === "]") {
+    return skipOscSequence(value, index + 2);
+  }
+  return Math.min(value.length, index + 2);
+}
+function skipCsiSequence(value, index) {
+  while (index < value.length) {
+    const codePoint = value.charCodeAt(index);
+    index += 1;
+    if (codePoint >= 64 && codePoint <= 126) {
+      break;
+    }
+  }
+  return index;
+}
+function skipOscSequence(value, index) {
+  while (index < value.length) {
+    if (value[index] === "\x07") {
+      return index + 1;
+    }
+    if (value[index] === "\x1B" && value[index + 1] === "\\") {
+      return index + 2;
+    }
+    index += 1;
+  }
+  return index;
 }
 
 // ../toolcraft-design/src/prompts/primitives/log.ts
@@ -1394,38 +1442,14 @@ function renderTable(options) {
 }
 
 // ../toolcraft-design/src/components/detail-card.ts
+import stringWidth from "fast-string-width";
+import { wrapAnsi } from "fast-wrap-ansi";
 function wrap(value, width) {
-  const lines = [];
-  for (const paragraph of value.split("\n")) {
-    let line = "";
-    for (const rawWord of paragraph.split(" ")) {
-      const words = [];
-      let word = rawWord;
-      while (word.length > width) {
-        words.push(word.slice(0, width));
-        word = word.slice(width);
-      }
-      words.push(word);
-      for (const word2 of words) {
-        if (line.length === 0) {
-          line = word2;
-          continue;
-        }
-        if (`${line} ${word2}`.length <= width) {
-          line = `${line} ${word2}`;
-          continue;
-        }
-        lines.push(line);
-        line = word2;
-      }
-    }
-    lines.push(line);
-  }
-  return lines;
+  return wrapAnsi(value, Math.max(1, width), { hard: true, trim: true }).split("\n");
 }
 function renderRows(rows, theme, width) {
   if (rows.length === 0) return [];
-  const labelWidth = Math.max(...rows.map((row) => row.label.length));
+  const labelWidth = Math.max(...rows.map((row) => stringWidth(row.label)));
   const valueWidth = Math.max(20, width - labelWidth - 2);
   const continuation = " ".repeat(labelWidth + 2);
   return rows.flatMap((row) => {
@@ -1446,12 +1470,16 @@ function renderDetailCard(options) {
 ${options.theme.muted(options.badges.map((badge) => badge[0] + badge.slice(1).toLowerCase()).join(" \xB7 "))}` : identity;
   const blocks = [hero];
   for (const prose of options.prose ?? []) {
-    blocks.push(prose.title ? [options.theme.header(prose.title), wrap(prose.value, width).join("\n")].join("\n") : wrap(prose.value, width).join("\n"));
+    blocks.push(
+      prose.title ? [options.theme.header(prose.title), wrap(prose.value, width).join("\n")].join("\n") : wrap(prose.value, width).join("\n")
+    );
   }
   for (const section of options.sections ?? []) {
     if (section.rows.length === 0) continue;
     const rows = renderRows(section.rows, options.theme, width);
-    blocks.push(section.title ? [options.theme.header(section.title), ...rows].join("\n") : rows.join("\n"));
+    blocks.push(
+      section.title ? [options.theme.header(section.title), ...rows].join("\n") : rows.join("\n")
+    );
   }
   return blocks.join("\n\n");
 }
@@ -1878,13 +1906,13 @@ import { LineCounter, parse, parseDocument } from "yaml";
 // ../frontmatter/src/stringify.ts
 import { stringify } from "yaml";
 
+// ../toolcraft-design/src/dashboard/terminal-width.ts
+var graphemeSegmenter3 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+
 // ../toolcraft-design/src/acp/writer.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 var storage = new AsyncLocalStorage2();
 
-// ../toolcraft-design/src/dashboard/terminal-width.ts
-var graphemeSegmenter3 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
-
 // ../toolcraft-design/src/dashboard/terminal.ts
 import readline from "node:readline";
 import { PassThrough } from "node:stream";
@@ -1981,8 +2009,8 @@ function mapKey(name, char) {
 }
 
 // ../toolcraft-design/src/prompts/interactive/wrap.ts
-import { wrapAnsi } from "fast-wrap-ansi";
-import stringWidth from "fast-string-width";
+import { wrapAnsi as wrapAnsi2 } from "fast-wrap-ansi";
+import stringWidth2 from "fast-string-width";
 function getColumns(output) {
   return Math.max(1, output.columns ?? 80);
 }
@@ -1990,7 +2018,7 @@ function getRows(output) {
   return Math.max(1, output.rows ?? 20);
 }
 function wrapFrame(output, frame) {
-  return wrapAnsi(frame, getColumns(output), { hard: true, trim: false });
+  return wrapAnsi2(frame, getColumns(output), { hard: true, trim: false });
 }
 
 // ../toolcraft-design/src/prompts/interactive/core.ts
@@ -2311,7 +2339,7 @@ function confirmPrompt(opts) {
 }
 
 // ../toolcraft-design/src/prompts/interactive/pagination.ts
-import { wrapAnsi as wrapAnsi2 } from "fast-wrap-ansi";
+import { wrapAnsi as wrapAnsi3 } from "fast-wrap-ansi";
 function countLines(values) {
   return values.reduce((sum, value) => sum + value.split("\n").length, 0);
 }
@@ -2354,7 +2382,7 @@ function limitOptions(opts) {
   }
   const hasTopMarker = cappedVisibleCount < options.length && start > 0;
   const hasBottomMarker = cappedVisibleCount < options.length && start + cappedVisibleCount < options.length;
-  const visible = options.slice(start, start + cappedVisibleCount).map((option, index) => wrapAnsi2(style(option, start + index === cursor2), columns, { hard: true, trim: false }));
+  const visible = options.slice(start, start + cappedVisibleCount).map((option, index) => wrapAnsi3(style(option, start + index === cursor2), columns, { hard: true, trim: false }));
   const trimmed = trimToRows(
     visible,
     Math.max(cursor2 - start, 0),
@@ -2737,6 +2765,9 @@ function isOptionalSchema(schema) {
 function getRequiredKeys(schema) {
   return Object.keys(schema.shape).filter((key2) => !isOptionalSchema(schema.shape[key2])).sort();
 }
+function getRequiredKeyFingerprint(schema) {
+  return getRequiredKeys(schema).join("+");
+}
 function assertUniqueRequiredKeyFingerprints(branches) {
   const fingerprints = /* @__PURE__ */ new Map();
   branches.forEach((branch, index) => {
@@ -2774,6 +2805,451 @@ function Union(branches) {
   };
 }
 
+// ../toolcraft-schema/src/validate.ts
+var missingValue = /* @__PURE__ */ Symbol("missingValue");
+function validate(schema, value) {
+  const state = { issues: [] };
+  const result = walkSchema(schema, value, [], state);
+  if (state.issues.length > 0) {
+    return { ok: false, issues: state.issues };
+  }
+  return { ok: true, value: result.present ? result.value : void 0 };
+}
+function walkSchema(schema, value, path25, state) {
+  if (schema.kind === "optional") {
+    return walkOptional(schema, value, path25, state);
+  }
+  if (value === missingValue) {
+    addIssue(
+      state,
+      path25,
+      expectedFor(schema),
+      "missing",
+      `Expected ${expectedFor(schema)} at ${formatPath(path25)}`
+    );
+    return { present: false };
+  }
+  if (value === null && schema.nullable === true) {
+    return { present: true, value };
+  }
+  switch (schema.kind) {
+    case "string":
+      return walkString(schema, value, path25, state);
+    case "number":
+      return walkNumber(schema, value, path25, state);
+    case "boolean":
+      return walkBoolean(value, path25, state);
+    case "enum":
+      return walkEnum(schema, value, path25, state);
+    case "array":
+      return walkArray(schema, value, path25, state);
+    case "object":
+      return walkObject(schema, value, path25, state);
+    case "oneOf":
+      return walkOneOf(schema, value, path25, state);
+    case "union":
+      return walkUnion(schema, value, path25, state);
+    case "record":
+      return walkRecord(schema, value, path25, state);
+    case "json":
+      return walkJson(value, path25, state);
+  }
+}
+function walkOptional(schema, value, path25, state) {
+  if (value === missingValue || value === void 0) {
+    const defaultValue = getDefault(schema.inner);
+    if (defaultValue.present) {
+      return walkSchema(schema.inner, cloneDefault(defaultValue.value), path25, state);
+    }
+    return { present: false };
+  }
+  return walkSchema(schema.inner, value, path25, state);
+}
+function walkString(schema, value, path25, state) {
+  if (typeof value !== "string") {
+    addExpectedIssue(state, path25, "string", value);
+    return { present: true, value };
+  }
+  if (schema.minLength !== void 0 && value.length < schema.minLength) {
+    const expected = `string with length at least ${schema.minLength}`;
+    addIssue(
+      state,
+      path25,
+      expected,
+      `string with length ${value.length}`,
+      `Expected ${expected} at ${formatPath(path25)}`
+    );
+  }
+  if (schema.maxLength !== void 0 && value.length > schema.maxLength) {
+    const expected = `string with length at most ${schema.maxLength}`;
+    addIssue(
+      state,
+      path25,
+      expected,
+      `string with length ${value.length}`,
+      `Expected ${expected} at ${formatPath(path25)}`
+    );
+  }
+  if (schema.pattern !== void 0) {
+    const pattern = compilePattern(schema.pattern);
+    if (pattern === void 0 || !pattern.test(value)) {
+      const expected = `string matching pattern ${schema.pattern}`;
+      addIssue(state, path25, expected, value, `Expected ${expected} at ${formatPath(path25)}`);
+    }
+  }
+  return { present: true, value };
+}
+function walkNumber(schema, value, path25, state) {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    addExpectedIssue(state, path25, schema.jsonType === "integer" ? "integer" : "number", value);
+    return { present: true, value };
+  }
+  if (schema.jsonType === "integer" && !Number.isInteger(value)) {
+    addExpectedIssue(state, path25, "integer", value);
+  }
+  if (schema.minimum !== void 0 && value < schema.minimum) {
+    const expected = `number greater than or equal to ${schema.minimum}`;
+    addIssue(state, path25, expected, String(value), `Expected ${expected} at ${formatPath(path25)}`);
+  }
+  if (schema.maximum !== void 0 && value > schema.maximum) {
+    const expected = `number less than or equal to ${schema.maximum}`;
+    addIssue(state, path25, expected, String(value), `Expected ${expected} at ${formatPath(path25)}`);
+  }
+  return { present: true, value };
+}
+function walkBoolean(value, path25, state) {
+  if (typeof value !== "boolean") {
+    addExpectedIssue(state, path25, "boolean", value);
+  }
+  return { present: true, value };
+}
+function walkEnum(schema, value, path25, state) {
+  if (!schema.values.includes(value)) {
+    const expected = `one of ${schema.values.join(", ")}`;
+    addIssue(
+      state,
+      path25,
+      expected,
+      receivedValue(value),
+      `Expected ${expected} at ${formatPath(path25)}`
+    );
+  }
+  return { present: true, value };
+}
+function walkArray(schema, value, path25, state) {
+  if (!Array.isArray(value)) {
+    addExpectedIssue(state, path25, "array", value);
+    return { present: true, value };
+  }
+  if (schema.minItems !== void 0 && value.length < schema.minItems) {
+    const expected = `array with at least ${schema.minItems} items`;
+    addIssue(
+      state,
+      path25,
+      expected,
+      `array with ${value.length} items`,
+      `Expected ${expected} at ${formatPath(path25)}`
+    );
+  }
+  if (schema.maxItems !== void 0 && value.length > schema.maxItems) {
+    const expected = `array with at most ${schema.maxItems} items`;
+    addIssue(
+      state,
+      path25,
+      expected,
+      `array with ${value.length} items`,
+      `Expected ${expected} at ${formatPath(path25)}`
+    );
+  }
+  const nextValue = value.map((item, index) => {
+    const result = walkSchema(schema.item, item, [...path25, String(index)], state);
+    return result.present ? result.value : item;
+  });
+  return { present: true, value: nextValue };
+}
+function walkObject(schema, value, path25, state, injectedProperties = {}) {
+  if (!isPlainRecord(value)) {
+    addExpectedIssue(state, path25, "object", value);
+    return { present: true, value };
+  }
+  const nextValue = {};
+  const allowedKeys = /* @__PURE__ */ new Set([...Object.keys(schema.shape), ...Object.keys(injectedProperties)]);
+  for (const [key2, propertySchema] of Object.entries(schema.shape)) {
+    const propertyValue = Object.hasOwn(value, key2) ? value[key2] : missingValue;
+    const result = walkSchema(propertySchema, propertyValue, [...path25, key2], state);
+    if (result.present) {
+      setOwnValue(nextValue, key2, result.value);
+    }
+  }
+  for (const [key2, injectedValue] of Object.entries(injectedProperties)) {
+    if (Object.hasOwn(value, key2)) {
+      setOwnValue(nextValue, key2, value[key2]);
+    } else {
+      setOwnValue(nextValue, key2, injectedValue);
+    }
+  }
+  for (const [key2, propertyValue] of Object.entries(value)) {
+    if (allowedKeys.has(key2)) {
+      continue;
+    }
+    if (schema.additionalProperties === true) {
+      setOwnValue(nextValue, key2, propertyValue);
+    } else {
+      addUnexpectedPropertyIssue(state, [...path25, key2]);
+    }
+  }
+  return { present: true, value: nextValue };
+}
+function walkOneOf(schema, value, path25, state) {
+  if (!isPlainRecord(value)) {
+    addExpectedIssue(state, path25, "object", value);
+    return { present: true, value };
+  }
+  const discriminatorValue = value[schema.discriminator];
+  const discriminatorPath = [...path25, schema.discriminator];
+  const branchValues = Object.keys(schema.branches);
+  const expected = `one of ${branchValues.join(", ")}`;
+  if (!Object.hasOwn(value, schema.discriminator)) {
+    addIssueWithMessage(
+      state,
+      discriminatorPath,
+      expected,
+      "missing",
+      `Missing discriminator "${schema.discriminator}" at ${formatPath(path25)}. Expected one of: ${branchValues.join(", ")}.`
+    );
+    return { present: true, value };
+  }
+  if (typeof discriminatorValue !== "string" || !Object.hasOwn(schema.branches, discriminatorValue)) {
+    addIssueWithMessage(
+      state,
+      discriminatorPath,
+      expected,
+      receivedValue(discriminatorValue),
+      `Expected ${expected} at ${formatPath(discriminatorPath)}, got ${formatReceivedDiscriminator(discriminatorValue)}`
+    );
+    return { present: true, value };
+  }
+  return walkObject(schema.branches[discriminatorValue], value, path25, state, {
+    [schema.discriminator]: discriminatorValue
+  });
+}
+function walkUnion(schema, value, path25, state) {
+  if (isPlainRecord(value)) {
+    const candidateBranches = schema.branches.filter((branch) => hasRequiredKeys(branch, value));
+    if (candidateBranches.length === 1) {
+      return walkObject(candidateBranches[0], value, path25, state);
+    }
+  }
+  const matches = [];
+  for (const branch of schema.branches) {
+    const branchState = { issues: [] };
+    const result = walkObject(branch, value, path25, branchState);
+    if (branchState.issues.length === 0 && result.present) {
+      matches.push({ fingerprint: getRequiredKeyFingerprint(branch), value: result.value });
+    }
+  }
+  if (matches.length === 1) {
+    return { present: true, value: matches[0].value };
+  }
+  if (matches.length === 0) {
+    const branchDescriptions = schema.branches.map((branch) => getRequiredKeyFingerprint(branch));
+    addIssueWithMessage(
+      state,
+      path25,
+      "exactly one union branch",
+      "0 matching branches",
+      `No union branch matched at ${formatPath(path25)}. Tried ${schema.branches.length} branches. Expected one of: ${branchDescriptions.join(" | ")}.`
+    );
+    return { present: true, value };
+  }
+  addIssueWithMessage(
+    state,
+    path25,
+    "exactly one union branch",
+    `${matches.length} matching branches`,
+    `Expected exactly one union branch at ${formatPath(path25)}, but matched more than one branch: ${matches.map((match) => match.fingerprint).join(" | ")}`
+  );
+  return { present: true, value };
+}
+function hasRequiredKeys(schema, value) {
+  for (const [key2, propertySchema] of Object.entries(schema.shape)) {
+    if (propertySchema.kind !== "optional" && !Object.hasOwn(value, key2)) {
+      return false;
+    }
+  }
+  return true;
+}
+function walkRecord(schema, value, path25, state) {
+  if (!isPlainRecord(value)) {
+    addExpectedIssue(state, path25, "object", value);
+    return { present: true, value };
+  }
+  const nextValue = {};
+  for (const [key2, propertyValue] of Object.entries(value)) {
+    const result = walkSchema(schema.value, propertyValue, [...path25, key2], state);
+    if (result.present) {
+      setOwnValue(nextValue, key2, result.value);
+    }
+  }
+  return { present: true, value: nextValue };
+}
+function walkJson(value, path25, state) {
+  if (isJsonValue(value)) {
+    return { present: true, value };
+  }
+  addExpectedIssue(state, path25, "JSON value", value);
+  return { present: true, value };
+}
+function getDefault(schema) {
+  if (schema.default !== void 0) {
+    return { present: true, value: schema.default };
+  }
+  if (schema.kind === "optional") {
+    return getDefault(schema.inner);
+  }
+  return { present: false };
+}
+function isPlainRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isJsonValue(value, ancestors = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return typeof value !== "number" || Number.isFinite(value);
+  }
+  if (Array.isArray(value)) {
+    if (ancestors.has(value)) {
+      return false;
+    }
+    ancestors.add(value);
+    const result = value.every((item) => isJsonValue(item, ancestors));
+    ancestors.delete(value);
+    return result;
+  }
+  if (isPlainRecord(value)) {
+    if (ancestors.has(value)) {
+      return false;
+    }
+    ancestors.add(value);
+    const result = Object.values(value).every((item) => isJsonValue(item, ancestors));
+    ancestors.delete(value);
+    return result;
+  }
+  return false;
+}
+function cloneDefault(value) {
+  return structuredClone(value);
+}
+function setOwnValue(target, key2, value) {
+  Object.defineProperty(target, key2, {
+    configurable: true,
+    enumerable: true,
+    writable: true,
+    value
+  });
+}
+function expectedFor(schema) {
+  switch (schema.kind) {
+    case "string":
+      return "string";
+    case "number":
+      return schema.jsonType === "integer" ? "integer" : "number";
+    case "boolean":
+      return "boolean";
+    case "enum":
+      return `one of ${schema.values.join(", ")}`;
+    case "array":
+      return "array";
+    case "object":
+    case "oneOf":
+    case "record":
+      return "object";
+    case "union":
+      return "exactly one union branch";
+    case "json":
+      return "JSON value";
+    case "optional":
+      return expectedFor(schema.inner);
+  }
+}
+function addExpectedIssue(state, path25, expected, value) {
+  addIssue(
+    state,
+    path25,
+    expected,
+    receivedType(value),
+    `Expected ${expected} at ${formatPath(path25)}`
+  );
+}
+function addUnexpectedPropertyIssue(state, path25) {
+  addIssue(
+    state,
+    path25,
+    "no additional properties",
+    "unknown property",
+    `Unexpected property ${formatPath(path25)}`
+  );
+}
+function addIssue(state, path25, expected, received, _message) {
+  state.issues.push({
+    path: path25,
+    expected,
+    received,
+    message: formatIssueMessage(expected, path25, received)
+  });
+}
+function addIssueWithMessage(state, path25, expected, received, message2) {
+  state.issues.push({
+    path: path25,
+    expected,
+    received,
+    message: message2
+  });
+}
+function formatIssueMessage(expected, path25, received) {
+  return `Expected ${expected} at ${formatPath(path25)}, got ${received}`;
+}
+function formatPath(path25) {
+  return path25.length === 0 ? "value" : path25.join(".");
+}
+function compilePattern(pattern) {
+  try {
+    return new RegExp(pattern);
+  } catch {
+    return void 0;
+  }
+}
+function receivedType(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return "array";
+  }
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return "integer";
+  }
+  return typeof value;
+}
+function receivedValue(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value === void 0) {
+    return "undefined";
+  }
+  return String(value);
+}
+function formatReceivedDiscriminator(value) {
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  return receivedValue(value);
+}
+
 // ../toolcraft-schema/src/index.ts
 function assertValidEnumValues(values) {
   if (values.length === 0) {
@@ -2797,6 +3273,22 @@ function assertFiniteNumber(value, name) {
     throw new Error(`${name} must be finite`);
   }
 }
+function assertMinMaxOrder(minimum, maximum, minimumName, maximumName) {
+  if (minimum !== void 0 && maximum !== void 0 && minimum > maximum) {
+    throw new Error(`${minimumName} must be less than or equal to ${maximumName}`);
+  }
+}
+function assertValidDefault(schema) {
+  if (schema.default === void 0) {
+    return;
+  }
+  const result = validate(schema, schema.default);
+  if (!result.ok) {
+    throw new Error(
+      `default must satisfy schema: ${result.issues[0]?.message ?? "invalid default"}`
+    );
+  }
+}
 function assertPattern(pattern) {
   if (pattern === void 0) {
     return;
@@ -2811,56 +3303,71 @@ var S = {
   String(options = {}) {
     assertNonNegativeInteger(options.minLength, "minLength");
     assertNonNegativeInteger(options.maxLength, "maxLength");
+    assertMinMaxOrder(options.minLength, options.maxLength, "minLength", "maxLength");
     assertPattern(options.pattern);
-    return {
+    const schema = {
       kind: "string",
       ...options
     };
+    assertValidDefault(schema);
+    return schema;
   },
   Number(options = {}) {
     assertFiniteNumber(options.minimum, "minimum");
     assertFiniteNumber(options.maximum, "maximum");
+    assertMinMaxOrder(options.minimum, options.maximum, "minimum", "maximum");
     assertFiniteNumber(options.default, "default");
     if (options.jsonType === "integer" && options.default !== void 0 && !Number.isInteger(options.default)) {
       throw new Error("default must be an integer");
     }
-    return {
+    const schema = {
       kind: "number",
       ...options
     };
+    assertValidDefault(schema);
+    return schema;
   },
   Boolean(options = {}) {
-    return {
+    const schema = {
       kind: "boolean",
       ...options
     };
+    assertValidDefault(schema);
+    return schema;
   },
   Enum(values, options = {}) {
     assertValidEnumValues(values);
     if (options.jsonType === "integer" && values.some((value) => typeof value !== "number" || !Number.isInteger(value))) {
       throw new Error("Integer enum values must be integers");
     }
-    return {
+    const schema = {
       kind: "enum",
       values,
       ...options
     };
+    assertValidDefault(schema);
+    return schema;
   },
   Array(item, options = {}) {
     assertNonNegativeInteger(options.minItems, "minItems");
     assertNonNegativeInteger(options.maxItems, "maxItems");
-    return {
+    assertMinMaxOrder(options.minItems, options.maxItems, "minItems", "maxItems");
+    const schema = {
       kind: "array",
       item,
       ...options
     };
+    assertValidDefault(schema);
+    return schema;
   },
   Object(shape, options = {}) {
-    return {
+    const schema = {
       kind: "object",
       shape,
       ...options
     };
+    assertValidDefault(schema);
+    return schema;
   },
   Optional(inner) {
     return {
@@ -3235,6 +3742,7 @@ function createBaseCommand(config2) {
     kind: "command",
     name: config2.name,
     description: config2.description,
+    hidden: config2.hidden ?? false,
     examples: cloneCommandExamples(config2.examples),
     aliases: [...config2.aliases ?? []],
     positional: [...config2.positional ?? []],
@@ -3251,6 +3759,7 @@ function createBaseCommand(config2) {
   Object.defineProperty(command, commandConfigSymbol, {
     value: {
       scope: cloneScope(config2.scope),
+      hidden: config2.hidden ?? false,
       examples: cloneCommandExamples(config2.examples),
       result: config2.result,
       humanInLoop: config2.humanInLoop,
@@ -3301,6 +3810,7 @@ function materializeCommand(command, inherited) {
     kind: "command",
     name: command.name,
     description: command.description,
+    hidden: internal.hidden,
     examples: cloneCommandExamples(internal.examples),
     aliases: [...command.aliases],
     positional: [...command.positional],
@@ -3317,6 +3827,7 @@ function materializeCommand(command, inherited) {
   Object.defineProperty(materialized, commandConfigSymbol, {
     value: {
       scope: cloneScope(internal.scope),
+      hidden: internal.hidden,
       examples: cloneCommandExamples(internal.examples),
       result: internal.result,
       humanInLoop: internal.humanInLoop,
@@ -3432,6 +3943,9 @@ function isRecord(value) {
 function isStateList(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function hasVisibleName(value) {
+  return value.trim().length > 0;
+}
 function canFireFromState(event, fromState) {
   if (event.from === "*") {
     return event.to !== fromState;
@@ -3446,6 +3960,9 @@ function validateMachine(machine) {
     throw new TypeError("State machine states must be a string array.");
   }
   const states = new Set(machine.states);
+  if (machine.states.some((state) => !hasVisibleName(state))) {
+    throw new Error("State names must not be empty.");
+  }
   if (!hasOwnRecordField(machine, "initial") || typeof machine.initial !== "string") {
     throw new TypeError("State machine initial must be a string.");
   }
@@ -3456,6 +3973,9 @@ function validateMachine(machine) {
     throw new TypeError("State machine events must be an object.");
   }
   for (const [eventName, event] of Object.entries(machine.events)) {
+    if (!hasVisibleName(eventName)) {
+      throw new Error("Event names must not be empty.");
+    }
     if (!isRecord(event)) {
       throw new TypeError(`Event "${eventName}" must be an object.`);
     }
@@ -3565,6 +4085,13 @@ import { text as text3 } from "node:stream/consumers";
 // ../process-runner/src/docker/context.ts
 import { execSync } from "node:child_process";
 
+// ../process-runner/src/docker/build-context.ts
+import { readdir, readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import path2 from "node:path";
+var require2 = createRequire(import.meta.url);
+var createIgnore = require2("ignore");
+
 // ../process-runner/src/docker/engine.ts
 import { execSync as execSync2 } from "node:child_process";
 
@@ -3573,19 +4100,19 @@ import * as childProcess from "node:child_process";
 import { randomBytes } from "node:crypto";
 
 // ../process-runner/src/docker/args.ts
-import path2 from "node:path";
+import path3 from "node:path";
 
 // ../process-runner/src/docker/env-file.ts
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 
 // ../process-runner/src/docker/docker-execution-env.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
-import { readdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { readFile as readFile2, realpath, writeFile } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import path5 from "node:path";
+import path6 from "node:path";
 
 // ../process-runner/src/host/host-runner.ts
 import { spawn as spawnChildProcess } from "node:child_process";
@@ -3718,7 +4245,7 @@ function bindAbortSignal(signal, onAbort) {
 // ../process-runner/src/workspace-transfer.ts
 import { createHash, randomUUID } from "node:crypto";
 import { promises as nodeFs } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 
 // ../process-runner/src/testing/mock-runner.ts
 import { Readable, Writable } from "node:stream";
@@ -3790,7 +4317,7 @@ function resolveEndpoint(options = {}) {
 
 // ../task-list/src/backends/utils.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import path6 from "node:path";
+import path7 from "node:path";
 function compareCreated(left, right) {
   const leftCreated = typeof left.raw.created === "string" ? left.raw.created : "";
   const rightCreated = typeof right.raw.created === "string" ? right.raw.created : "";
@@ -3822,15 +4349,33 @@ function sortStrings(values) {
 function sortTasks(tasks) {
   return [...tasks].sort((left, right) => left.qualifiedId.localeCompare(right.qualifiedId));
 }
+function isTrimmedPrintableIdentifier(value) {
+  if (value.length === 0 || value !== value.trim()) {
+    return false;
+  }
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) {
+      return false;
+    }
+  }
+  return true;
+}
 function validateTaskId(id) {
-  if (id.length === 0 || id.startsWith(".") || id.includes("/") || id.includes("\\") || id.includes("..")) {
+  if (!isTrimmedPrintableIdentifier(id) || id.startsWith(".") || id.includes("/") || id.includes("\\") || id.includes("..")) {
     throw new Error(`Invalid task id "${id}".`);
   }
   return id;
 }
-async function statIfExists(fs4, filePath) {
+function validateTaskName(name) {
+  if (name.trim().length === 0) {
+    throw new Error("Task name must not be empty.");
+  }
+  return name;
+}
+async function statIfExists(fs5, filePath) {
   try {
-    return await fs4.stat(filePath);
+    return await fs5.stat(filePath);
   } catch (error3) {
     if (hasErrorCode(error3, "ENOENT")) {
       return void 0;
@@ -3838,15 +4383,18 @@ async function statIfExists(fs4, filePath) {
     throw error3;
   }
 }
-async function rejectSymbolicLinkComponents(fs4, filePath) {
-  const resolvedPath = path6.resolve(filePath);
-  const rootPath = path6.parse(resolvedPath).root;
-  const components = resolvedPath.slice(rootPath.length).split(path6.sep).filter(Boolean);
+async function rejectSymbolicLinkComponents(fs5, filePath) {
+  const resolvedPath = path7.resolve(filePath);
+  const rootPath = path7.parse(resolvedPath).root;
+  const components = resolvedPath.slice(rootPath.length).split(path7.sep).filter(Boolean);
   let currentPath = rootPath;
   for (const component of components) {
-    currentPath = path6.join(currentPath, component);
+    currentPath = path7.join(currentPath, component);
     try {
-      if ((await fs4.lstat(currentPath)).isSymbolicLink()) {
+      if ((await fs5.lstat(currentPath)).isSymbolicLink()) {
+        if (currentPath === "/tmp") {
+          continue;
+        }
         throw new Error(`Path "${filePath}" contains a symbolic link.`);
       }
     } catch (error3) {
@@ -3857,19 +4405,19 @@ async function rejectSymbolicLinkComponents(fs4, filePath) {
     }
   }
 }
-async function writeAtomically(fs4, filePath, content) {
+async function writeAtomically(fs5, filePath, content) {
   const tempPath = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
   let tempCreated = false;
-  await fs4.mkdir(path6.dirname(filePath), { recursive: true });
+  await fs5.mkdir(path7.dirname(filePath), { recursive: true });
   try {
-    await fs4.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
+    await fs5.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
     tempCreated = true;
-    await fs4.rename(tempPath, filePath);
+    await fs5.rename(tempPath, filePath);
     tempCreated = false;
   } catch (error3) {
     if (tempCreated || !hasErrorCode(error3, "EEXIST")) {
       try {
-        await fs4.unlink(tempPath);
+        await fs5.unlink(tempPath);
       } catch (unlinkError) {
         if (!hasErrorCode(unlinkError, "ENOENT")) {
           throw unlinkError;
@@ -3879,18 +4427,18 @@ async function writeAtomically(fs4, filePath, content) {
     throw error3;
   }
 }
-async function withFileLock(fs4, lockPath, operation) {
-  await fs4.mkdir(path6.dirname(lockPath), { recursive: true });
+async function withFileLock(fs5, lockPath, operation) {
+  await fs5.mkdir(path7.dirname(lockPath), { recursive: true });
   for (; ; ) {
     try {
-      await fs4.writeFile(lockPath, String(process.pid), { encoding: "utf8", flag: "wx" });
+      await fs5.writeFile(lockPath, String(process.pid), { encoding: "utf8", flag: "wx" });
       break;
     } catch (error3) {
       if (!hasErrorCode(error3, "EEXIST")) {
-        await fs4.unlink(lockPath).catch(() => void 0);
+        await fs5.unlink(lockPath).catch(() => void 0);
         throw error3;
       }
-      if (await removeAbandonedLock(fs4, lockPath)) {
+      if (await removeAbandonedLock(fs5, lockPath)) {
         continue;
       }
       await Promise.resolve();
@@ -3899,13 +4447,13 @@ async function withFileLock(fs4, lockPath, operation) {
   try {
     return await operation();
   } finally {
-    await fs4.unlink(lockPath);
+    await fs5.unlink(lockPath);
   }
 }
-async function removeAbandonedLock(fs4, lockPath) {
+async function removeAbandonedLock(fs5, lockPath) {
   let content;
   try {
-    content = await fs4.readFile(lockPath, "utf8");
+    content = await fs5.readFile(lockPath, "utf8");
   } catch (error3) {
     if (hasErrorCode(error3, "ENOENT")) {
       return true;
@@ -3913,11 +4461,11 @@ async function removeAbandonedLock(fs4, lockPath) {
     throw error3;
   }
   const owner = Number(content);
-  if (!Number.isInteger(owner) || owner <= 0 || isProcessRunning(owner)) {
+  if (Number.isInteger(owner) && owner > 0 && isProcessRunning(owner)) {
     return false;
   }
   try {
-    await fs4.unlink(lockPath);
+    await fs5.unlink(lockPath);
     return true;
   } catch (error3) {
     if (hasErrorCode(error3, "ENOENT")) {
@@ -4185,6 +4733,9 @@ async function ghIssuesBackend(deps) {
   if (deps.state?.labelPrefix === "") {
     throw new Error("gh-issues state.labelPrefix must be a non-empty string when configured.");
   }
+  if (deps.stateMachine !== void 0) {
+    validateMachine(deps.stateMachine);
+  }
   const client = createGhClient({
     token: deps.token,
     endpoint: deps.endpoint,
@@ -4344,7 +4895,9 @@ function createTasksView(name, session, context) {
           );
           projectItemId = added.addProjectV2ItemById?.item?.id ?? void 0;
           if (projectItemId === void 0) {
-            throw new Error("GitHub addProjectV2ItemById response did not include project item id.");
+            throw new Error(
+              "GitHub addProjectV2ItemById response did not include project item id."
+            );
           }
         }
         if (session.labelPrefix === void 0) {
@@ -4573,12 +5126,15 @@ async function resolveProjectItemId(id, listName, session, context) {
   const issueNumber = parseIssueNumber(id, listName);
   let after;
   while (true) {
-    const result = await context.client.graphql(ISSUE_STATE_LABELS_QUERY, {
-      owner: context.repoOwner,
-      repo: context.repoName,
-      number: issueNumber,
-      after
-    });
+    const result = await context.client.graphql(
+      ISSUE_STATE_LABELS_QUERY,
+      {
+        owner: context.repoOwner,
+        repo: context.repoName,
+        number: issueNumber,
+        after
+      }
+    );
     const issue = result.repository?.issue ?? null;
     if (issue === null) {
       throw new TaskNotFoundError(`Task "${listName}/${id}" not found.`);
@@ -4855,12 +5411,27 @@ async function fetchIssueTask(id, listName, session, context) {
   });
 }
 function parseIssueNumber(id, listName) {
+  if (!isCanonicalDecimalIssueId(id)) {
+    throw new TaskNotFoundError(`Task "${listName}/${id}" not found.`);
+  }
   const issueNumber = Number(id);
-  if (!Number.isInteger(issueNumber) || issueNumber < 1) {
+  if (!Number.isSafeInteger(issueNumber) || issueNumber < 1) {
     throw new TaskNotFoundError(`Task "${listName}/${id}" not found.`);
   }
   return issueNumber;
 }
+function isCanonicalDecimalIssueId(id) {
+  if (id.length === 0 || id[0] === "0") {
+    return false;
+  }
+  for (let index = 0; index < id.length; index += 1) {
+    const charCode = id.charCodeAt(index);
+    if (charCode < 48 || charCode > 57) {
+      return false;
+    }
+  }
+  return true;
+}
 function mapProjectItemToTask(item, listName, session) {
   const content = item.content;
   if (!isIssueNode(content)) {
@@ -4968,7 +5539,7 @@ function parseQualifiedId(qualifiedId, listName) {
 }
 
 // ../task-list/src/backends/markdown-dir.ts
-import path7 from "node:path";
+import path8 from "node:path";
 import { parseDocument as parseDocument2, stringify as stringify2 } from "yaml";
 
 // ../task-list/src/schema/task.schema.json
@@ -5071,7 +5642,7 @@ function resolveListLayout(deps) {
   return deps.singleList ? { kind: "single", name: deps.singleList } : { kind: "multi" };
 }
 function validateListName(name) {
-  if (name.length === 0 || name === ARCHIVE_DIRECTORY_NAME || name.startsWith(".") || name.includes("/") || name.includes("\\") || name.includes("..")) {
+  if (!isTrimmedPrintableIdentifier(name) || name === ARCHIVE_DIRECTORY_NAME || name.startsWith(".") || name.includes("/") || name.includes("\\") || name.includes("..")) {
     throw new Error(`Invalid task list name "${name}".`);
   }
   return name;
@@ -5087,16 +5658,16 @@ function parseQualifiedId2(qualifiedId) {
   };
 }
 function listPath(rootPath, layout, list) {
-  return layout.kind === "single" ? rootPath : path7.join(rootPath, list);
+  return layout.kind === "single" ? rootPath : path8.join(rootPath, list);
 }
 function archiveDirectoryPath(rootPath, layout, list) {
-  return layout.kind === "single" ? path7.join(rootPath, ARCHIVE_DIRECTORY_NAME) : path7.join(rootPath, list, ARCHIVE_DIRECTORY_NAME);
+  return layout.kind === "single" ? path8.join(rootPath, ARCHIVE_DIRECTORY_NAME) : path8.join(rootPath, list, ARCHIVE_DIRECTORY_NAME);
 }
 function activeTaskFilename(id, order, width) {
   return `${String(order).padStart(width, "0")}-${id}${MARKDOWN_EXTENSION}`;
 }
 function archivedTaskPath(rootPath, layout, list, id) {
-  return path7.join(archiveDirectoryPath(rootPath, layout, list), `${id}${MARKDOWN_EXTENSION}`);
+  return path8.join(archiveDirectoryPath(rootPath, layout, list), `${id}${MARKDOWN_EXTENSION}`);
 }
 function isMarkdownFile(entryName) {
   return entryName.endsWith(MARKDOWN_EXTENSION);
@@ -5198,7 +5769,7 @@ function hasOwnTaskField(frontmatter, key2) {
 function reservedFrontmatterKeys(mode) {
   return mode === "passthrough" ? PASSTHROUGH_RESERVED_FRONTMATTER_KEYS : RESERVED_FRONTMATTER_KEYS;
 }
-function setOwnValue(record, key2, value) {
+function setOwnValue2(record, key2, value) {
   Object.defineProperty(record, key2, {
     value,
     enumerable: true,
@@ -5211,7 +5782,7 @@ function metadataFromFrontmatter(frontmatter, mode) {
   const reservedKeys = reservedFrontmatterKeys(mode);
   for (const [key2, value] of Object.entries(frontmatter)) {
     if (!reservedKeys.has(key2)) {
-      setOwnValue(metadata, key2, value);
+      setOwnValue2(metadata, key2, value);
     }
   }
   return metadata;
@@ -5225,7 +5796,7 @@ function createTask(list, id, frontmatter, body, mode, sourcePath) {
     state: frontmatter.state,
     description: body,
     metadata: metadataFromFrontmatter(frontmatter, mode),
-    ...sourcePath !== void 0 && { sourcePath: path7.resolve(sourcePath) }
+    ...sourcePath !== void 0 && { sourcePath: path8.resolve(sourcePath) }
   };
 }
 function serializeTaskDocument(frontmatter, description) {
@@ -5234,9 +5805,9 @@ ${stringify2(frontmatter)}---
 
 ${description}`;
 }
-async function readDirectoryNames(fs4, directoryPath) {
+async function readDirectoryNames(fs5, directoryPath) {
   try {
-    return sortStrings(await fs4.readdir(directoryPath));
+    return sortStrings(await fs5.readdir(directoryPath));
   } catch (error3) {
     if (hasErrorCode(error3, "ENOENT")) {
       return [];
@@ -5252,9 +5823,9 @@ async function ensureRootPath(deps) {
   }
   await deps.fs.stat(deps.path);
 }
-async function readTaskFile(fs4, list, id, filePath, validStates, initialState, mode) {
-  await rejectSymbolicLinkComponents(fs4, filePath);
-  const content = await fs4.readFile(filePath, "utf8");
+async function readTaskFile(fs5, list, id, filePath, validStates, initialState, mode) {
+  await rejectSymbolicLinkComponents(fs5, filePath);
+  const content = await fs5.readFile(filePath, "utf8");
   const document = splitTaskDocument(content, filePath, mode);
   const frontmatter = mode === "passthrough" && document.frontmatter.trim().length === 0 ? {} : readFrontmatter(document.frontmatter, filePath);
   if (mode !== "passthrough") {
@@ -5265,11 +5836,9 @@ async function readTaskFile(fs4, list, id, filePath, validStates, initialState,
       task: createTask(list, id, frontmatter, document.body, mode, filePath)
     };
   }
-  const parsedFilename = parseActiveFilename(path7.basename(filePath));
-  const defaultName = parsedFilename?.id ?? id;
   const effectiveFrontmatter = {
     ...frontmatter,
-    name: typeof frontmatter.name === "string" ? frontmatter.name : defaultName,
+    name: typeof frontmatter.name === "string" ? frontmatter.name : id,
     state: typeof frontmatter.state === "string" && validStates.has(frontmatter.state) ? frontmatter.state : initialState
   };
   return {
@@ -5278,44 +5847,95 @@ async function readTaskFile(fs4, list, id, filePath, validStates, initialState,
     task: createTask(list, id, effectiveFrontmatter, document.body, mode, filePath)
   };
 }
-async function findActiveTaskFilename(fs4, listDirectoryPath, id) {
-  const entries = await readDirectoryNames(fs4, listDirectoryPath);
+async function readPassthroughFrontmatter(fs5, filePath, mode) {
+  if (mode !== "passthrough") {
+    return {};
+  }
+  const content = await fs5.readFile(filePath, "utf8");
+  const document = splitTaskDocument(content, filePath, mode);
+  if (document.frontmatter.trim().length === 0) {
+    return {};
+  }
+  return readFrontmatter(document.frontmatter, filePath);
+}
+async function resolveActiveFilenameEntry(fs5, entryName, entryPath, parsed, mode) {
+  if (mode !== "passthrough" || parsed.order === null) {
+    return parsed;
+  }
+  const frontmatter = await readPassthroughFrontmatter(fs5, entryPath, mode);
+  if (Object.keys(frontmatter).length === 0 && orderedFilenamePrefixLength(entryName) <= MIN_PREFIX_WIDTH) {
+    return parsed;
+  }
+  if (typeof frontmatter.state === "string" || hasOwnTaskField(frontmatter, "$schema") || hasOwnTaskField(frontmatter, "kind") || hasOwnTaskField(frontmatter, "version")) {
+    return parsed;
+  }
+  return {
+    id: entryName.slice(0, -MARKDOWN_EXTENSION.length),
+    order: null,
+    filename: parsed.filename
+  };
+}
+function orderedFilenamePrefixLength(entryName) {
+  const stem = entryName.slice(0, -MARKDOWN_EXTENSION.length);
+  const separatorIndex = stem.indexOf("-");
+  if (separatorIndex <= 0) {
+    return Number.POSITIVE_INFINITY;
+  }
+  for (let index = 0; index < separatorIndex; index += 1) {
+    const code = stem.charCodeAt(index);
+    if (code < 48 || code > 57) {
+      return Number.POSITIVE_INFINITY;
+    }
+  }
+  return separatorIndex;
+}
+async function findActiveTaskFilename(fs5, listDirectoryPath, id, mode) {
+  const entries = await readDirectoryNames(fs5, listDirectoryPath);
   for (const entryName of entries) {
     if (isHiddenEntry(entryName)) continue;
     const parsed = parseActiveFilename(entryName);
-    if (parsed?.id === id) {
+    if (!parsed) continue;
+    const entryPath = path8.join(listDirectoryPath, entryName);
+    const resolved = await resolveActiveFilenameEntry(
+      fs5,
+      entryName,
+      entryPath,
+      { id: parsed.id, order: parsed.order, filename: entryName },
+      mode
+    );
+    if (resolved.id === id) {
       return entryName;
     }
   }
   return void 0;
 }
-async function findTaskLocation(fs4, rootPath, layout, list, id) {
+async function findTaskLocation(fs5, rootPath, layout, list, id, mode) {
   const listDirectoryPath = listPath(rootPath, layout, list);
-  await rejectSymbolicLinkComponents(fs4, listDirectoryPath);
-  const activeName = await findActiveTaskFilename(fs4, listDirectoryPath, id);
+  await rejectSymbolicLinkComponents(fs5, listDirectoryPath);
+  const activeName = await findActiveTaskFilename(fs5, listDirectoryPath, id, mode);
   if (activeName) {
-    const activePath = path7.join(listDirectoryPath, activeName);
-    await rejectSymbolicLinkComponents(fs4, activePath);
-    const activeStat = await statIfExists(fs4, activePath);
+    const activePath = path8.join(listDirectoryPath, activeName);
+    await rejectSymbolicLinkComponents(fs5, activePath);
+    const activeStat = await statIfExists(fs5, activePath);
     if (activeStat?.isFile()) {
       return { archived: false, path: activePath };
     }
   }
   const archivedPath = archivedTaskPath(rootPath, layout, list, id);
-  await rejectSymbolicLinkComponents(fs4, archiveDirectoryPath(rootPath, layout, list));
-  await rejectSymbolicLinkComponents(fs4, archivedPath);
-  const archivedStat = await statIfExists(fs4, archivedPath);
+  await rejectSymbolicLinkComponents(fs5, archiveDirectoryPath(rootPath, layout, list));
+  await rejectSymbolicLinkComponents(fs5, archivedPath);
+  const archivedStat = await statIfExists(fs5, archivedPath);
   if (archivedStat?.isFile()) {
     return { archived: true, path: archivedPath };
   }
   return void 0;
 }
-async function readTaskAtLocation(fs4, rootPath, layout, list, id, validStates, initialState, mode) {
-  const location = await findTaskLocation(fs4, rootPath, layout, list, id);
+async function readTaskAtLocation(fs5, rootPath, layout, list, id, validStates, initialState, mode) {
+  const location = await findTaskLocation(fs5, rootPath, layout, list, id, mode);
   if (!location) {
     throw new TaskNotFoundError(`Task "${list}/${id}" not found.`);
   }
-  return readTaskFile(fs4, list, id, location.path, validStates, initialState, mode);
+  return readTaskFile(fs5, list, id, location.path, validStates, initialState, mode);
 }
 function createdFrontmatter(defaults2, input, initialState, mode) {
   const frontmatter = mode !== "passthrough" ? {
@@ -5331,12 +5951,12 @@ function createdFrontmatter(defaults2, input, initialState, mode) {
   const reservedKeys = reservedFrontmatterKeys(mode);
   for (const [key2, value] of Object.entries(defaults2.metadata)) {
     if (!reservedKeys.has(key2)) {
-      setOwnValue(frontmatter, key2, value);
+      setOwnValue2(frontmatter, key2, value);
     }
   }
   for (const [key2, value] of Object.entries(input.metadata ?? {})) {
     if (!reservedKeys.has(key2)) {
-      setOwnValue(frontmatter, key2, value);
+      setOwnValue2(frontmatter, key2, value);
     }
   }
   frontmatter.created = (/* @__PURE__ */ new Date()).toISOString();
@@ -5358,7 +5978,7 @@ function updatedFrontmatter(existingFrontmatter, task, patch, mode) {
   const reservedKeys = reservedFrontmatterKeys(mode);
   for (const [key2, value] of Object.entries(patch.metadata ?? {})) {
     if (!reservedKeys.has(key2)) {
-      setOwnValue(nextFrontmatter, key2, value);
+      setOwnValue2(nextFrontmatter, key2, value);
     }
   }
   return nextFrontmatter;
@@ -5382,7 +6002,7 @@ function firedFrontmatter(existingFrontmatter, task, to, mode, metadataPatch) {
   const reservedKeys = reservedFrontmatterKeys(mode);
   for (const [key2, value] of Object.entries(metadataPatch ?? {})) {
     if (!reservedKeys.has(key2)) {
-      setOwnValue(nextFrontmatter, key2, value);
+      setOwnValue2(nextFrontmatter, key2, value);
     }
   }
   return nextFrontmatter;
@@ -5416,11 +6036,19 @@ function createTasksView2(deps, layout, list) {
       if (isHiddenEntry(entryName)) continue;
       const parsed = parseActiveFilename(entryName);
       if (!parsed) continue;
-      const entryPath = path7.join(listDirectoryPath, entryName);
+      const entryPath = path8.join(listDirectoryPath, entryName);
       await rejectSymbolicLinkComponents(deps.fs, entryPath);
       const entryStat = await statIfExists(deps.fs, entryPath);
       if (!entryStat?.isFile()) continue;
-      result.push({ id: parsed.id, order: parsed.order, filename: entryName });
+      result.push(
+        await resolveActiveFilenameEntry(
+          deps.fs,
+          entryName,
+          entryPath,
+          { id: parsed.id, order: parsed.order, filename: entryName },
+          deps.frontmatterMode
+        )
+      );
     }
     result.sort((left, right) => {
       const leftOrder = left.order ?? Number.POSITIVE_INFINITY;
@@ -5434,7 +6062,7 @@ function createTasksView2(deps, layout, list) {
     const entries = await readActiveEntries();
     const tasks = /* @__PURE__ */ new Map();
     for (const entry of entries) {
-      const filePath = path7.join(listDirectoryPath, entry.filename);
+      const filePath = path8.join(listDirectoryPath, entry.filename);
       const file = await readTaskFile(
         deps.fs,
         list,
@@ -5455,7 +6083,7 @@ function createTasksView2(deps, layout, list) {
     const result = [];
     for (const entryName of entries) {
       if (isHiddenEntry(entryName) || !isMarkdownFile(entryName)) continue;
-      const entryPath = path7.join(archivePath, entryName);
+      const entryPath = path8.join(archivePath, entryName);
       await rejectSymbolicLinkComponents(deps.fs, entryPath);
       const entryStat = await statIfExists(deps.fs, entryPath);
       if (!entryStat?.isFile()) continue;
@@ -5485,15 +6113,20 @@ function createTasksView2(deps, layout, list) {
       if (desiredOrder === void 0) continue;
       const desiredFilename = activeTaskFilename(entry.id, desiredOrder, width);
       if (entry.filename !== desiredFilename) {
-        const fromPath = path7.join(listDirectoryPath, entry.filename);
-        const stagingPath = path7.join(
+        const fromPath = path8.join(listDirectoryPath, entry.filename);
+        const stagingPath = path8.join(
           listDirectoryPath,
           `${desiredFilename}.staging-${process.pid}-${index}`
         );
-        const targetPath = path7.join(listDirectoryPath, desiredFilename);
+        const targetPath = path8.join(listDirectoryPath, desiredFilename);
         try {
           await deps.fs.rename(fromPath, stagingPath);
-          staged.push({ original: fromPath, staging: stagingPath, target: targetPath, finalized: false });
+          staged.push({
+            original: fromPath,
+            staging: stagingPath,
+            target: targetPath,
+            finalized: false
+          });
         } catch (error3) {
           for (const stagedEntry of staged.reverse()) {
             await deps.fs.rename(stagedEntry.staging, stagedEntry.original);
@@ -5628,8 +6261,7 @@ function createTasksView2(deps, layout, list) {
         if (filter?.state && entry.task.state !== filter.state) return false;
         return true;
       });
-      const orderedActiveTasks = applyOrder(orderedActive, filter?.order);
-      return [...orderedActiveTasks, ...filteredArchived.map((entry) => entry.task)];
+      return applyOrder([...orderedActive, ...filteredArchived], filter?.order);
     },
     async get(id) {
       return (await getTaskFile(id)).task;
@@ -5638,9 +6270,17 @@ function createTasksView2(deps, layout, list) {
       assertCreateDoesNotSetState(input);
       assertCreateHasId(input);
       validateTaskId(input.id);
+      validateTaskName(input.name);
       await rejectSymbolicLinkComponents(deps.fs, listDirectoryPath);
-      return withFileLock(deps.fs, path7.join(listDirectoryPath, ".transition.lock"), async () => {
-        const existing = await findTaskLocation(deps.fs, deps.path, layout, list, input.id);
+      return withFileLock(deps.fs, path8.join(listDirectoryPath, ".transition.lock"), async () => {
+        const existing = await findTaskLocation(
+          deps.fs,
+          deps.path,
+          layout,
+          list,
+          input.id,
+          deps.frontmatterMode
+        );
         if (existing) {
           throw new TaskAlreadyExistsError(`Task "${list}/${input.id}" already exists.`);
         }
@@ -5652,7 +6292,7 @@ function createTasksView2(deps, layout, list) {
         const nextOrder = maxOrder + 1;
         const width = padWidthForCount(activeEntries.length + 1);
         const filename = activeTaskFilename(input.id, nextOrder, width);
-        const targetPath = path7.join(listDirectoryPath, filename);
+        const targetPath = path8.join(listDirectoryPath, filename);
         const frontmatter = createdFrontmatter(
           deps.defaults,
           input,
@@ -5661,12 +6301,22 @@ function createTasksView2(deps, layout, list) {
         );
         const description = input.description ?? "";
         await writeAtomically(deps.fs, targetPath, serializeTaskDocument(frontmatter, description));
-        return createTask(list, input.id, frontmatter, description, deps.frontmatterMode, targetPath);
+        return createTask(
+          list,
+          input.id,
+          frontmatter,
+          description,
+          deps.frontmatterMode,
+          targetPath
+        );
       });
     },
     async update(id, patch) {
       assertUpdateDoesNotSetState(patch);
       validateTaskId(id);
+      if (patch.name !== void 0) {
+        validateTaskName(patch.name);
+      }
       const existing = await getTaskFile(id);
       const nextFrontmatter = updatedFrontmatter(
         existing.frontmatter,
@@ -5752,7 +6402,14 @@ function createTasksView2(deps, layout, list) {
       };
       if (stateMachine.events[eventName]?.to === "archived") {
         validateTaskId(id);
-        const location = await findTaskLocation(deps.fs, deps.path, layout, list, id);
+        const location = await findTaskLocation(
+          deps.fs,
+          deps.path,
+          layout,
+          list,
+          id,
+          deps.frontmatterMode
+        );
         if (!location) {
           throw new TaskNotFoundError(`Task "${list}/${id}" not found.`);
         }
@@ -5760,7 +6417,7 @@ function createTasksView2(deps, layout, list) {
       validateTaskId(id);
       const { event, nextTask } = await withFileLock(
         deps.fs,
-        path7.join(listDirectoryPath, ".transition.lock"),
+        path8.join(listDirectoryPath, ".transition.lock"),
         fireTask
       );
       await event.onEnter?.(nextTask);
@@ -5780,7 +6437,14 @@ function createTasksView2(deps, layout, list) {
     },
     async delete(id) {
       validateTaskId(id);
-      const location = await findTaskLocation(deps.fs, deps.path, layout, list, id);
+      const location = await findTaskLocation(
+        deps.fs,
+        deps.path,
+        layout,
+        list,
+        id,
+        deps.frontmatterMode
+      );
       if (!location) {
         throw new TaskNotFoundError(`Task "${list}/${id}" not found.`);
       }
@@ -5853,7 +6517,7 @@ async function markdownDirBackend(deps) {
       if (entryName === ARCHIVE_DIRECTORY_NAME || isHiddenEntry(entryName)) {
         continue;
       }
-      const entryPath = path7.join(deps.path, entryName);
+      const entryPath = path8.join(deps.path, entryName);
       await rejectSymbolicLinkComponents(deps.fs, entryPath);
       const entryStat = await statIfExists(deps.fs, entryPath);
       if (entryStat?.isDirectory()) {
@@ -5895,12 +6559,26 @@ async function markdownDirBackend(deps) {
     }
     const targetListDir = listPath(deps.path, layout, targetListName);
     await rejectSymbolicLinkComponents(deps.fs, targetListDir);
-    return withFileLock(deps.fs, path7.join(targetListDir, ".transition.lock"), async () => {
-      const targetExisting = await findTaskLocation(deps.fs, deps.path, layout, targetListName, id);
+    return withFileLock(deps.fs, path8.join(targetListDir, ".transition.lock"), async () => {
+      const targetExisting = await findTaskLocation(
+        deps.fs,
+        deps.path,
+        layout,
+        targetListName,
+        id,
+        deps.frontmatterMode
+      );
       if (targetExisting) {
         throw new TaskAlreadyExistsError(`Task "${targetListName}/${id}" already exists.`);
       }
-      const sourceLocation = await findTaskLocation(deps.fs, deps.path, layout, sourceListName, id);
+      const sourceLocation = await findTaskLocation(
+        deps.fs,
+        deps.path,
+        layout,
+        sourceListName,
+        id,
+        deps.frontmatterMode
+      );
       if (!sourceLocation) {
         throw new TaskNotFoundError(`Task "${sourceListName}/${id}" not found.`);
       }
@@ -5945,7 +6623,7 @@ async function markdownDirBackend(deps) {
       );
       const width = padWidthForCount(targetEntries.length + 1);
       const targetFilename = activeTaskFilename(id, maxOrder + 1, width);
-      const targetPath = path7.join(targetListDir, targetFilename);
+      const targetPath = path8.join(targetListDir, targetFilename);
       await deps.fs.rename(sourceLocation.path, targetPath);
       return createTask(
         targetListName,
@@ -5967,7 +6645,7 @@ async function markdownDirBackend(deps) {
 }
 
 // ../task-list/src/backends/yaml-file.ts
-import path8 from "node:path";
+import path9 from "node:path";
 import { isMap, parseDocument as parseDocument3 } from "yaml";
 
 // ../task-list/src/schema/store.schema.json
@@ -6027,7 +6705,7 @@ function malformedTask2(list, id, field) {
   return new MalformedTaskError(`Malformed task "${list}/${id}": invalid "${field}".`);
 }
 function validateListName2(name) {
-  if (name.length === 0 || name.startsWith(".") || name.includes("/") || name.includes("\\") || name.includes("..")) {
+  if (!isTrimmedPrintableIdentifier(name) || name.startsWith(".") || name.includes("/") || name.includes("\\") || name.includes("..")) {
     throw new Error(`Invalid task list name "${name}".`);
   }
   return name;
@@ -6064,7 +6742,7 @@ function createTask2(list, id, taskRecord, sourcePath) {
     state: getOwnEntry(taskRecord, "state"),
     description: descriptionFromTaskRecord(taskRecord),
     metadata: metadataFromTaskRecord(taskRecord),
-    ...sourcePath !== void 0 && { sourcePath: path8.resolve(sourcePath) }
+    ...sourcePath !== void 0 && { sourcePath: path9.resolve(sourcePath) }
   };
 }
 function matchesFilter(task, filter) {
@@ -6235,8 +6913,8 @@ function serializeDocument(document) {
   return serialized.endsWith("\n") ? serialized : `${serialized}
 `;
 }
-async function readStore(fs4, filePath, validStates) {
-  const content = await fs4.readFile(filePath, "utf8");
+async function readStore(fs5, filePath, validStates) {
+  const content = await fs5.readFile(filePath, "utf8");
   const document = parseStoreDocument(filePath, content);
   const store = document.toJS();
   assertValidStoreRecord(store, filePath);
@@ -6376,6 +7054,7 @@ function createTasksView3(deps, list) {
       assertCreateDoesNotSetState2(input);
       assertCreateHasId2(input);
       validateTaskId(input.id);
+      validateTaskName(input.name);
       const { document, store } = await readStore(deps.fs, deps.path, validStates);
       if (getTaskRecord(store, list, input.id)) {
         throw new TaskAlreadyExistsError(`Task "${list}/${input.id}" already exists.`);
@@ -6388,6 +7067,9 @@ function createTasksView3(deps, list) {
     async update(id, patch) {
       assertUpdateDoesNotSetState2(patch);
       validateTaskId(id);
+      if (patch.name !== void 0) {
+        validateTaskName(patch.name);
+      }
       const { document, store } = await readStore(deps.fs, deps.path, validStates);
       const existing = getTaskOrThrow(store, list, id);
       const nextTaskRecord = buildUpdatedTaskRecord(existing, patch);
@@ -6479,6 +7161,11 @@ function createTasksView3(deps, list) {
         insertIndex = anchor.position === "top" ? 0 : listNode.items.length;
       } else {
         const anchorId = "before" in anchor ? anchor.before : anchor.after;
+        const activeIds = new Set(activeItemIds(listNode, validStates));
+        if (!activeIds.has(anchorId)) {
+          listNode.items.splice(fromIndex, 0, movedPair);
+          throw new AnchorNotFoundError(anchorId);
+        }
         const anchorIndex = findItemIndex(listNode, anchorId);
         if (anchorIndex < 0) {
           listNode.items.splice(fromIndex, 0, movedPair);
@@ -6663,7 +7350,7 @@ function isRecord4(value) {
 
 // ../task-list/src/move.ts
 import * as fsPromises2 from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // ../toolcraft/src/human-in-loop/approval-tasks.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
@@ -6850,7 +7537,7 @@ function areEqualStrings(left, right) {
 }
 
 // ../toolcraft/src/human-in-loop/runner.ts
-import { access, lstat, readFile as readFile2, rename, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { access, lstat, readFile as readFile3, rename, unlink, writeFile as writeFile2 } from "node:fs/promises";
 
 // ../toolcraft/src/human-in-loop/default-provider.ts
 import process3 from "node:process";
@@ -6882,7 +7569,7 @@ on error number -128
 end try`;
 }
 function parseStdout(out) {
-  const value = out.endsWith("\r\n") ? out.slice(0, -2) : out.endsWith("\n") ? out.slice(0, -1) : out;
+  const value = out.endsWith("\r\n") ? out.slice(0, -2) : out.endsWith("\n") ? out.slice(0, -1) : out.endsWith("\r") ? out.slice(0, -1) : out;
   switch (value) {
     case "Approve":
     case "APPROVED":
@@ -7162,13 +7849,13 @@ function formatAvailableApprovalCommandPaths(root) {
 }
 function enumerateApprovalCommandPaths(root) {
   const paths = [];
-  const visit = (node, path24) => {
+  const visit = (node, path25) => {
     if (node.kind === "command") {
-      paths.push(path24.join("."));
+      paths.push(path25.join("."));
       return;
     }
     for (const child of getVisibleCliChildren(node)) {
-      visit(child, [...path24, child.name]);
+      visit(child, [...path25, child.name]);
     }
   };
   if (root.kind === "command") {
@@ -7203,21 +7890,21 @@ function createHandlerContext(command, params17) {
 }
 function createFs() {
   return {
-    readFile: async (path24, encoding = "utf8") => readFile2(path24, { encoding }),
-    writeFile: async (path24, contents, options) => {
-      await writeFile2(path24, contents, options);
+    readFile: async (path25, encoding = "utf8") => readFile3(path25, { encoding }),
+    writeFile: async (path25, contents, options) => {
+      await writeFile2(path25, contents, options);
     },
-    exists: async (path24) => {
+    exists: async (path25) => {
       try {
-        await access(path24);
+        await access(path25);
         return true;
       } catch {
         return false;
       }
     },
-    lstat: async (path24) => lstat(path24),
+    lstat: async (path25) => lstat(path25),
     rename: async (fromPath, toPath) => rename(fromPath, toPath),
-    unlink: async (path24) => unlink(path24)
+    unlink: async (path25) => unlink(path25)
   };
 }
 function createEnv(values = process.env) {
@@ -7496,13 +8183,13 @@ function isMissingStateError(error3) {
 import { mkdir as mkdir2, realpath as realpath2, writeFile as writeFile4 } from "node:fs/promises";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import os from "node:os";
-import path13 from "node:path";
+import path14 from "node:path";
 import { CommanderError } from "commander";
 
 // ../toolcraft/src/mcp-proxy.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { lstat as lstat2, mkdir, readFile as readFile3, rename as rename2, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
-import path12 from "node:path";
+import { lstat as lstat2, mkdir, readFile as readFile4, rename as rename2, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
+import path13 from "node:path";
 import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
 
 // ../tiny-mcp-client/src/internal.ts
@@ -7511,13 +8198,13 @@ import { PassThrough as PassThrough2 } from "node:stream";
 
 // ../mcp-oauth/src/client/auth-store-session-store.ts
 import crypto from "node:crypto";
-import path11 from "node:path";
+import path12 from "node:path";
 
 // ../auth-store/src/encrypted-file-store.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, randomUUID as randomUUID3, scrypt } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // ../auth-store/src/error-codes.ts
 function hasOwnErrorCode3(error3, code) {
@@ -7546,10 +8233,13 @@ var EncryptedFileStore = class {
     if (input.filePath === void 0) {
       const homeDirectory = (input.getHomeDirectory ?? homedir)();
       const defaultDirectory = input.defaultDirectory ?? ".auth-store";
-      this.filePath = path10.join(
+      const defaultFileName = input.defaultFileName ?? "credentials.enc";
+      assertSafeDefaultDirectory(defaultDirectory);
+      assertSafeDefaultFileName(defaultFileName);
+      this.filePath = path11.join(
         homeDirectory,
         defaultDirectory,
-        input.defaultFileName ?? "credentials.enc"
+        defaultFileName
       );
       this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(
         homeDirectory,
@@ -7609,7 +8299,7 @@ var EncryptedFileStore = class {
       authTag: authTag.toString("base64"),
       ciphertext: ciphertext.toString("base64")
     };
-    await this.fs.mkdir(path10.dirname(this.filePath), { recursive: true });
+    await this.fs.mkdir(path11.dirname(this.filePath), { recursive: true });
     await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID3()}.tmp`;
     let temporaryCreated = false;
@@ -7641,7 +8331,7 @@ var EncryptedFileStore = class {
     }
   }
   async assertCredentialPathHasNoSymbolicLinks(targetPath) {
-    const resolvedPath = path10.resolve(targetPath);
+    const resolvedPath = path11.resolve(targetPath);
     const protectedPaths = getProtectedCredentialPaths(
       resolvedPath,
       this.symbolicLinkCheckStartPath
@@ -7675,27 +8365,62 @@ var EncryptedFileStore = class {
 };
 function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
   const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
-  return path10.resolve(homeDirectory, firstSegment ?? ".");
+  return path11.resolve(homeDirectory, firstSegment ?? ".");
 }
 function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
   if (symbolicLinkCheckStartPath === null) {
-    return [path10.dirname(resolvedPath), resolvedPath];
+    return getExplicitProtectedCredentialPaths(resolvedPath);
   }
-  const resolvedStartPath = path10.resolve(symbolicLinkCheckStartPath);
+  const resolvedStartPath = path11.resolve(symbolicLinkCheckStartPath);
   if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
-    return [path10.dirname(resolvedPath), resolvedPath];
+    return [path11.dirname(resolvedPath), resolvedPath];
   }
   const protectedPaths = [resolvedStartPath];
   let currentPath = resolvedStartPath;
-  for (const segment of path10.relative(resolvedStartPath, resolvedPath).split(path10.sep).filter(Boolean)) {
-    currentPath = path10.join(currentPath, segment);
+  for (const segment of path11.relative(resolvedStartPath, resolvedPath).split(path11.sep).filter(Boolean)) {
+    currentPath = path11.join(currentPath, segment);
+    protectedPaths.push(currentPath);
+  }
+  return protectedPaths;
+}
+function assertSafeDefaultDirectory(defaultDirectory) {
+  if (path11.isAbsolute(defaultDirectory) || path11.win32.isAbsolute(defaultDirectory)) {
+    throw new Error("defaultDirectory must be a relative path inside the home directory");
+  }
+  for (const segment of splitPathSegments(defaultDirectory)) {
+    if (segment === "..") {
+      throw new Error("defaultDirectory must be a relative path inside the home directory");
+    }
+  }
+}
+function assertSafeDefaultFileName(defaultFileName) {
+  if (defaultFileName.trim().length === 0 || defaultFileName === "." || defaultFileName === ".." || splitPathSegments(defaultFileName).length !== 1) {
+    throw new Error("defaultFileName must be a file name without path separators");
+  }
+}
+function splitPathSegments(value) {
+  return value.split("/").flatMap((segment) => segment.split("\\")).filter((segment) => segment.length > 0);
+}
+function getExplicitProtectedCredentialPaths(resolvedPath) {
+  const parsed = path11.parse(resolvedPath);
+  const segments = resolvedPath.slice(parsed.root.length).split(path11.sep).filter((segment) => segment.length > 0);
+  if (segments.length <= 1) {
+    return [resolvedPath];
+  }
+  const protectedPaths = [];
+  let currentPath = parsed.root;
+  for (const [index, segment] of segments.entries()) {
+    currentPath = path11.join(currentPath, segment);
+    if (index === 0) {
+      continue;
+    }
     protectedPaths.push(currentPath);
   }
   return protectedPaths;
 }
 function isPathInsideOrEqual(childPath, parentPath) {
-  const relativePath = path10.relative(parentPath, childPath);
-  return relativePath === "" || !relativePath.startsWith("..") && !path10.isAbsolute(relativePath);
+  const relativePath = path11.relative(parentPath, childPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !path11.isAbsolute(relativePath);
 }
 async function removeIfPresent(fileSystem, filePath) {
   try {
@@ -7786,8 +8511,14 @@ var KeychainStore = class {
   account;
   constructor(input) {
     this.runCommand = input.runCommand ?? runSecurityCommand;
-    this.service = input.service;
-    this.account = input.account;
+    this.service = input.service.trim();
+    this.account = input.account.trim();
+    if (this.service.length === 0) {
+      throw new Error("Keychain service must not be empty");
+    }
+    if (this.account.length === 0) {
+      throw new Error("Keychain account must not be empty");
+    }
   }
   async get() {
     const result = await this.executeSecurityCommand(
@@ -7814,10 +8545,10 @@ var KeychainStore = class {
         "-a",
         this.account,
         "-U",
-        "-w"
+        "-w",
+        value
       ],
-      "store secret in macOS Keychain",
-      { stdin: value }
+      "store secret in macOS Keychain"
     );
     if (getCommandExitCode(result) !== 0) {
       throw createSecurityCliFailure("store secret in macOS Keychain", result);
@@ -7962,13 +8693,14 @@ function createSecretStore(input) {
 function resolveBackend(input) {
   const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
   const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
-  if (configuredBackend === "keychain") {
+  const backend = configuredBackend?.trim();
+  if (backend === "keychain") {
     return "keychain";
   }
-  if (configuredBackend === void 0 || configuredBackend === "file") {
+  if (backend === void 0 || backend === "file") {
     return "file";
   }
-  throw new Error(`Unsupported auth store backend: ${configuredBackend}`);
+  throw new Error(`Unsupported auth store backend: ${backend}`);
 }
 function getOwnEnvValue(env, key2) {
   return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
@@ -7993,6 +8725,7 @@ var DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
 var DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
 var DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
 var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
+var MAX_JS_DATE_MS = 864e13;
 function createAuthStoreSessionStore(options = {}) {
   return {
     async load(resource) {
@@ -8002,10 +8735,10 @@ function createAuthStoreSessionStore(options = {}) {
         return null;
       }
       const parsed = JSON.parse(value);
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      if (isStoredOAuthSession(parsed)) {
         return parsed;
       }
-      throw new Error("Stored OAuth session must be a JSON object");
+      throw new Error("Stored OAuth session must match the expected shape");
     },
     async save(resource, session) {
       const store = createResourceSecretStore(resource, options);
@@ -8049,10 +8782,10 @@ function createAuthStoreClientStore(options) {
 function createNamedSecretStore(key2, options, defaults2) {
   const hash = crypto.createHash("sha256").update(key2).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
-  const parsedFilePath = configuredFilePath === void 0 ? null : path11.parse(configuredFilePath);
+  const parsedFilePath = configuredFilePath === void 0 ? null : path12.parse(configuredFilePath);
   const fileStore = {
     ...options.fileStore,
-    filePath: parsedFilePath === null ? void 0 : path11.join(
+    filePath: parsedFilePath === null ? void 0 : path12.join(
       parsedFilePath.dir,
       `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
     ),
@@ -8068,28 +8801,20 @@ function createNamedSecretStore(key2, options, defaults2) {
   return createSecretStore({ ...options, fileStore, keychainStore }).store;
 }
 function createResourceSecretStore(resource, options) {
-  return createNamedSecretStore(
-    canonicalizeResourceIndicator(resource),
-    options,
-    {
-      salt: DEFAULT_FILE_SALT,
-      directory: DEFAULT_FILE_DIRECTORY,
-      service: DEFAULT_KEYCHAIN_SERVICE,
-      accountPrefix: "provider"
-    }
-  );
+  return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
+    salt: DEFAULT_FILE_SALT,
+    directory: DEFAULT_FILE_DIRECTORY,
+    service: DEFAULT_KEYCHAIN_SERVICE,
+    accountPrefix: "provider"
+  });
 }
 function createIssuerSecretStore(issuer, options) {
-  return createNamedSecretStore(
-    issuer,
-    options,
-    {
-      salt: DEFAULT_CLIENT_FILE_SALT,
-      directory: DEFAULT_CLIENT_FILE_DIRECTORY,
-      service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
-      accountPrefix: "issuer"
-    }
-  );
+  return createNamedSecretStore(issuer, options, {
+    salt: DEFAULT_CLIENT_FILE_SALT,
+    directory: DEFAULT_CLIENT_FILE_DIRECTORY,
+    service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
+    accountPrefix: "issuer"
+  });
 }
 function isObjectRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -8101,6 +8826,50 @@ function getOwnString(record, key2) {
   const value = getOwnEntry4(record, key2);
   return typeof value === "string" ? value : void 0;
 }
+function isStoredOAuthSession(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry4(value, "client")) && isStoredOAuthDiscovery(getOwnEntry4(value, "discovery")) && isStoredOAuthTokensOrMissing(getOwnEntry4(value, "tokens"));
+}
+function isStoredOAuthClient(value) {
+  if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
+    return false;
+  }
+  const clientSecret = getOwnEntry4(value, "clientSecret");
+  return clientSecret === void 0 || typeof clientSecret === "string" && clientSecret.trim().length > 0;
+}
+function isStoredOAuthDiscovery(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  return isNonBlankOwnString(value, "resourceMetadataUrl") && isObjectRecord(getOwnEntry4(value, "resourceMetadata")) && isObjectRecord(getOwnEntry4(value, "authorizationServerMetadata"));
+}
+function isStoredOAuthTokensOrMissing(value) {
+  if (value === void 0) {
+    return true;
+  }
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
+    return false;
+  }
+  const expiresAt = getOwnEntry4(value, "expiresAt");
+  if (expiresAt !== null && (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS || !Number.isFinite(new Date(expiresAt).getTime()))) {
+    return false;
+  }
+  const refreshToken = getOwnEntry4(value, "refreshToken");
+  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+    return false;
+  }
+  const scope = getOwnEntry4(value, "scope");
+  return scope === void 0 || typeof scope === "string" && scope.trim().length > 0;
+}
+function isNonBlankOwnString(record, key2) {
+  const value = getOwnString(record, key2);
+  return value !== void 0 && value.trim().length > 0;
+}
 
 // ../mcp-oauth/src/client/default-oauth-client-provider.ts
 import { URL as URL2 } from "node:url";
@@ -8211,9 +8980,7 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
       } catch (error3) {
         res.writeHead(400);
         res.end(error3 instanceof Error ? error3.message : "Invalid OAuth callback");
-        if (callbackParameters.error === null) {
-          settle(() => reject(error3 instanceof Error ? error3 : new Error(String(error3))));
-        }
+        settle(() => reject(error3 instanceof Error ? error3 : new Error(String(error3))));
         return;
       }
       const authorizationError = callbackParameters.error;
@@ -8225,7 +8992,10 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
         return;
       }
       try {
-        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        const code = validateAuthorizationCallbackParameters(
+          callbackParameters,
+          expectedAuthorization
+        );
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(buildSuccessPage(options.landingPage));
         settle(() => resolve(code));
@@ -8248,7 +9018,10 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
             const description = callbackParameters.errorDescription ?? callbackParameters.error;
             throw createAuthorizationError(callbackParameters.error, description);
           }
-          const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+          const code = validateAuthorizationCallbackParameters(
+            callbackParameters,
+            expectedAuthorization
+          );
           settle(() => resolve(code));
         } catch (error3) {
           settle(() => reject(error3 instanceof Error ? error3 : new Error(String(error3))));
@@ -8353,6 +9126,7 @@ function generateCodeChallenge(verifier) {
 }
 
 // ../mcp-oauth/src/client/token-endpoint.ts
+var MAX_JS_DATE_MS2 = 864e13;
 var OAuthError = class extends Error {
   error;
   errorDescription;
@@ -8430,22 +9204,32 @@ async function requestTokens(input) {
   if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
     throw new Error("OAuth token response missing access_token");
   }
+  const normalizedAccessToken = accessToken.trim();
   const tokenType = normalizeBearerTokenType(getOwnEntry6(payload, "token_type"));
   if (tokenType === null) {
     throw new Error("OAuth token response missing token_type=Bearer");
   }
   const expiresIn = getOwnEntry6(payload, "expires_in");
-  if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn < 0) {
-    throw new Error("OAuth token response has invalid expires_in");
+  let expiresAt = null;
+  if (expiresIn !== void 0) {
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || !Number.isInteger(expiresIn) || expiresIn < 0) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+    expiresAt = input.now() + expiresIn * 1e3;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS2 || !Number.isFinite(new Date(expiresAt).getTime())) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
   }
   const refreshToken = getOwnEntry6(payload, "refresh_token");
   const scope = getOwnEntry6(payload, "scope");
+  const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
+  const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : void 0;
   return {
-    accessToken,
-    refreshToken: typeof refreshToken === "string" && refreshToken.length > 0 ? refreshToken : void 0,
+    accessToken: normalizedAccessToken,
+    refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
     tokenType,
-    expiresAt: typeof expiresIn === "number" && Number.isFinite(expiresIn) ? input.now() + expiresIn * 1e3 : null,
-    scope: typeof scope === "string" && scope.length > 0 ? scope : void 0
+    expiresAt,
+    scope: normalizedScope === void 0 ? void 0 : normalizedScope
   };
 }
 async function readOAuthJsonObjectResponse(response) {
@@ -8496,6 +9280,7 @@ function normalizeBearerTokenType(value) {
 }
 
 // ../mcp-oauth/src/client/default-oauth-client-provider.ts
+var MAX_JS_DATE_MS3 = 864e13;
 function createOAuthClientProvider(options) {
   if (isProviderOptions(options)) {
     return options.provider;
@@ -8660,7 +9445,12 @@ function createDefaultOAuthClientProvider(options) {
         });
         let resolvedClient = null;
         try {
-          resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2);
+          resolvedClient = await resolveClient(
+            currentSession,
+            discovery,
+            loopback.redirectUri,
+            fetch2
+          );
           const sessionWithoutTokens = {
             resource,
             authorizationServer: discovery.authorizationServer,
@@ -8727,28 +9517,26 @@ function createDefaultOAuthClientProvider(options) {
     return finalPromise;
   }
   async function resolveClient(existingSession, discovery, redirectUri, fetch2) {
+    const configuredClient = normalizeConfiguredClient(options.client);
     if (options.client.mode === "static") {
+      if (configuredClient === null) {
+        throw new Error("OAuth client_id must not be blank");
+      }
       return {
         kind: "static",
         fromStoredRegistration: false,
-        client: {
-          clientId: options.client.clientId,
-          clientSecret: options.client.clientSecret
-        }
+        client: configuredClient
       };
     }
     const registrationEndpoint = getOwnString2(
       discovery.authorizationServerMetadata,
       "registration_endpoint"
     );
-    if (registrationEndpoint === void 0 && options.client.clientId !== void 0) {
+    if (registrationEndpoint === void 0 && configuredClient !== null) {
       return {
         kind: "static",
         fromStoredRegistration: false,
-        client: {
-          clientId: options.client.clientId,
-          clientSecret: options.client.clientSecret
-        }
+        client: configuredClient
       };
     }
     const storedClient = await loadRegisteredClient(discovery.authorizationServer);
@@ -8770,7 +9558,7 @@ function createDefaultOAuthClientProvider(options) {
       throw new Error("Authorization server metadata is missing registration_endpoint");
     }
     if (existingSession !== null && existingSession.client.clientId.length > 0) {
-      const isConfiguredStaticFallback = options.client.clientId !== void 0 && existingSession.client.clientId === options.client.clientId && existingSession.client.clientSecret === options.client.clientSecret;
+      const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
       if (!isConfiguredStaticFallback) {
         await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
         return {
@@ -8798,8 +9586,8 @@ function createDefaultOAuthClientProvider(options) {
     }
     const clientSecret = getOwnString2(payload, "client_secret");
     const registeredClient = {
-      clientId,
-      clientSecret: clientSecret !== void 0 && clientSecret.length > 0 ? clientSecret : void 0
+      clientId: clientId.trim(),
+      clientSecret: clientSecret !== void 0 && clientSecret.trim().length > 0 ? clientSecret.trim() : void 0
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -8912,14 +9700,16 @@ function normalizeStoredClient(value) {
   if (clientId === void 0 || clientId.trim().length === 0) {
     return null;
   }
+  const normalizedClientId = clientId.trim();
   const clientSecret = getOwnEntry7(value, "clientSecret");
   if (clientSecret === void 0) {
-    return { clientId };
+    return { clientId: normalizedClientId };
   }
   if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
     return null;
   }
-  return { clientId, clientSecret };
+  const normalizedClientSecret = clientSecret.trim();
+  return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
 }
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
@@ -8930,20 +9720,45 @@ function normalizeStoredTokens(value) {
   const expiresAt = getOwnEntry7(value, "expiresAt");
   const refreshToken = getOwnEntry7(value, "refreshToken");
   const scope = getOwnString2(value, "scope");
-  const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken : void 0;
-  if (accessToken === void 0 || accessToken.trim().length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isFinite(expiresAt)) || refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+  const normalizedAccessToken = accessToken?.trim();
+  const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
+  const normalizedScope = scope?.trim();
+  if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
     return void 0;
   }
   return {
-    accessToken,
+    accessToken: normalizedAccessToken,
     tokenType,
     expiresAt,
     ...normalizedRefreshToken === void 0 ? {} : { refreshToken: normalizedRefreshToken },
-    ...scope === void 0 || scope.length === 0 ? {} : { scope }
+    ...normalizedScope === void 0 || normalizedScope.length === 0 ? {} : { scope: normalizedScope }
+  };
+}
+function getClientMetadata(client) {
+  if (client.metadata === void 0) {
+    return void 0;
+  }
+  return {
+    clientName: normalizeOptionalOAuthString(client.metadata.clientName),
+    scope: normalizeOptionalOAuthString(client.metadata.scope),
+    softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
+    softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
   };
 }
-function getClientMetadata(client) {
-  return client.metadata;
+function normalizeConfiguredClient(client) {
+  const clientId = normalizeOptionalOAuthString(client.clientId);
+  if (clientId === void 0) {
+    return null;
+  }
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
+  return clientSecret === void 0 ? { clientId } : { clientId, clientSecret };
+}
+function normalizeOptionalOAuthString(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length === 0 ? void 0 : trimmed;
 }
 function getOwnEntry7(record, key2) {
   return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
@@ -8972,11 +9787,7 @@ function buildAuthorizationUrl(input) {
     "authorization_endpoint",
     "Authorization server metadata"
   );
-  const issuer = requireOwnString(
-    input.metadata,
-    "issuer",
-    "Authorization server metadata"
-  );
+  const issuer = requireOwnString(input.metadata, "issuer", "Authorization server metadata");
   const url = new URL2(authorizationEndpoint);
   const resource = canonicalizeResourceIndicator(input.resource);
   const state = createAuthorizationState({
@@ -9584,7 +10395,7 @@ var McpClient = class {
       await onToolsChanged();
     });
     messageLayer.onNotification("notifications/resources/list_changed", async () => {
-      if (onResourcesChanged === void 0) {
+      if (onResourcesChanged === void 0 || this.currentServerCapabilities?.resources?.listChanged !== true) {
         return;
       }
       await onResourcesChanged();
@@ -9603,7 +10414,7 @@ var McpClient = class {
       await onResourceUpdated(uri);
     });
     messageLayer.onNotification("notifications/prompts/list_changed", async () => {
-      if (onPromptsChanged === void 0) {
+      if (onPromptsChanged === void 0 || this.currentServerCapabilities?.prompts?.listChanged !== true) {
         return;
       }
       await onPromptsChanged();
@@ -9834,7 +10645,11 @@ var McpClient = class {
       throw new Error("Server does not support resources");
     }
     const requestParams = params17.cursor === void 0 ? void 0 : { cursor: params17.cursor };
-    return await messageLayer.sendRequest("resources/list", requestParams);
+    const result = await messageLayer.sendRequest("resources/list", requestParams);
+    if (!isResourcesListResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid resources/list result");
+    }
+    return result;
   }
   async listResourceTemplates(params17 = {}) {
     const messageLayer = this.getMessageLayerOrThrow();
@@ -9843,7 +10658,11 @@ var McpClient = class {
       throw new Error("Server does not support resources");
     }
     const requestParams = params17.cursor === void 0 ? void 0 : { cursor: params17.cursor };
-    return await messageLayer.sendRequest("resources/templates/list", requestParams);
+    const result = await messageLayer.sendRequest("resources/templates/list", requestParams);
+    if (!isResourceTemplatesListResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid resources/templates/list result");
+    }
+    return result;
   }
   async readResource(params17) {
     const messageLayer = this.getMessageLayerOrThrow();
@@ -9851,7 +10670,11 @@ var McpClient = class {
     if (serverCapabilities.resources === void 0) {
       throw new Error("Server does not support resources");
     }
-    return await messageLayer.sendRequest("resources/read", params17);
+    const result = await messageLayer.sendRequest("resources/read", params17);
+    if (!isReadResourceResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid resources/read result");
+    }
+    return result;
   }
   async subscribe(uri) {
     const messageLayer = this.getMessageLayerOrThrow();
@@ -9886,7 +10709,11 @@ var McpClient = class {
     if (serverCapabilities.prompts === void 0) {
       throw new Error("Server does not support prompts");
     }
-    return await messageLayer.sendRequest("prompts/get", params17);
+    const result = await messageLayer.sendRequest("prompts/get", params17);
+    if (!isGetPromptResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid prompts/get result");
+    }
+    return result;
   }
   async complete(params17) {
     const messageLayer = this.getMessageLayerOrThrow();
@@ -9894,7 +10721,11 @@ var McpClient = class {
     if (serverCapabilities.completions === void 0) {
       throw new Error("Server does not support completions");
     }
-    return await messageLayer.sendRequest("completion/complete", params17);
+    const result = await messageLayer.sendRequest("completion/complete", params17);
+    if (!isCompleteResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid completion/complete result");
+    }
+    return result;
   }
   async setLogLevel(level) {
     const messageLayer = this.getMessageLayerOrThrow();
@@ -10885,6 +11716,44 @@ function isCallToolResult(value) {
 function isToolsListResult(value) {
   return isObjectRecord5(value) && Array.isArray(value.tools) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
 }
+function isResourcesListResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.resources) && value.resources.every(isResource) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+}
+function isResourceTemplatesListResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.resourceTemplates) && value.resourceTemplates.every(isResourceTemplate) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+}
+function isReadResourceResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.contents) && value.contents.every(isResourceContents);
+}
+function isGetPromptResult(value) {
+  return isObjectRecord5(value) && (value.description === void 0 || typeof value.description === "string") && Array.isArray(value.messages) && value.messages.every(isPromptMessage);
+}
+function isCompleteResult(value) {
+  return isObjectRecord5(value) && isObjectRecord5(value.completion) && Array.isArray(value.completion.values) && value.completion.values.every((candidate) => typeof candidate === "string") && (value.completion.hasMore === void 0 || typeof value.completion.hasMore === "boolean") && (value.completion.total === void 0 || typeof value.completion.total === "number");
+}
+function isResource(value) {
+  return isObjectRecord5(value) && typeof value.uri === "string" && typeof value.name === "string" && (value.description === void 0 || typeof value.description === "string") && (value.mimeType === void 0 || typeof value.mimeType === "string") && (value.size === void 0 || typeof value.size === "number");
+}
+function isResourceTemplate(value) {
+  return isObjectRecord5(value) && typeof value.uriTemplate === "string" && typeof value.name === "string" && (value.description === void 0 || typeof value.description === "string") && (value.mimeType === void 0 || typeof value.mimeType === "string");
+}
+function isResourceContents(value) {
+  if (!isObjectRecord5(value) || typeof value.uri !== "string") {
+    return false;
+  }
+  if (value.mimeType !== void 0 && typeof value.mimeType !== "string") {
+    return false;
+  }
+  const hasText = value.text !== void 0;
+  const hasBlob = value.blob !== void 0;
+  if (!hasText && !hasBlob) {
+    return false;
+  }
+  return (!hasText || typeof value.text === "string") && (!hasBlob || typeof value.blob === "string");
+}
+function isPromptMessage(value) {
+  return isObjectRecord5(value) && (value.role === "user" || value.role === "assistant") && isContentItem(value.content);
+}
 function isContentItem(value) {
   if (!isObjectRecord5(value)) {
     return false;
@@ -10898,7 +11767,7 @@ function isContentItem(value) {
   if (value.type !== "resource" || !isObjectRecord5(value.resource)) {
     return false;
   }
-  return typeof value.resource.uri === "string" && (value.resource.mimeType === void 0 || typeof value.resource.mimeType === "string") && (typeof value.resource.text === "string" || typeof value.resource.blob === "string");
+  return isResourceContents(value.resource);
 }
 function hasOwn(value, property) {
   return Object.prototype.hasOwnProperty.call(value, property);
@@ -11038,13 +11907,13 @@ function convertJsonSchema(schema) {
   }
   return convertSchema(schema, schema, []);
 }
-function convertSchema(schema, root, path24) {
-  const resolvedSchema = resolveReferencedSchema(schema, root, path24);
+function convertSchema(schema, root, path25) {
+  const resolvedSchema = resolveReferencedSchema(schema, root, path25);
   const normalizedSchema = normalizeNullability(resolvedSchema);
   const composition = getComposition(normalizedSchema.schema);
   if (Array.isArray(normalizedSchema.schema.type)) {
     throw new Error(
-      `JSON Schema "${formatJsonSchemaPath(path24)}" has an unsupported type "${formatJsonSchemaType(
+      `JSON Schema "${formatJsonSchemaPath(path25)}" has an unsupported type "${formatJsonSchemaType(
         normalizedSchema.schema.type
       )}". Supported: string, number, integer, boolean, array, object.`
     );
@@ -11056,13 +11925,13 @@ function convertSchema(schema, root, path24) {
     return convertEnumSchema(resolvedSchema, normalizedSchema.nullable);
   }
   if (composition !== void 0) {
-    return convertCompositionSchema(normalizedSchema.schema, root, normalizedSchema.nullable, path24);
+    return convertCompositionSchema(normalizedSchema.schema, root, normalizedSchema.nullable, path25);
   }
   if (isRecordSchema(normalizedSchema.schema)) {
     return applyMetadata(
       S.Record(
         convertSchema(normalizedSchema.schema.additionalProperties, root, [
-          ...path24,
+          ...path25,
           "additionalProperties"
         ])
       ),
@@ -11111,12 +11980,12 @@ function convertSchema(schema, root, path24) {
       if (normalizedSchema.schema.items === void 0) {
         throw new Error(
           `JSON Schema "${formatJsonSchemaPath(
-            path24
+            path25
           )}" is an array but is missing the "items" field. Add "items": { ... } to declare the element type.`
         );
       }
       return S.Array(
-        convertSchema(normalizedSchema.schema.items, root, [...path24, "items"]),
+        convertSchema(normalizedSchema.schema.items, root, [...path25, "items"]),
         createCommonOptions(
           normalizedSchema.schema,
           normalizedSchema.nullable,
@@ -11126,7 +11995,7 @@ function convertSchema(schema, root, path24) {
     case "object":
       return convertObjectSchema(normalizedSchema.schema, root, {
         nullable: normalizedSchema.nullable,
-        path: path24
+        path: path25
       });
     case "null":
       return applyMetadata(S.Json(), normalizedSchema.schema, {
@@ -11141,12 +12010,12 @@ function convertSchema(schema, root, path24) {
       }
       throw new Error(
         `JSON Schema "${formatJsonSchemaPath(
-          path24
+          path25
         )}" must declare one of: "type", "enum", "const", "oneOf", "anyOf", or "allOf".`
       );
   }
   throw new Error(
-    `JSON Schema "${formatJsonSchemaPath(path24)}" has an unsupported type "${formatJsonSchemaType(
+    `JSON Schema "${formatJsonSchemaPath(path25)}" has an unsupported type "${formatJsonSchemaType(
       normalizedSchema.schema.type
     )}". Supported: string, number, integer, boolean, array, object.`
   );
@@ -11190,21 +12059,21 @@ function convertEnumSchema(schema, nullable) {
     )
   });
 }
-function convertCompositionSchema(schema, root, nullable, path24) {
+function convertCompositionSchema(schema, root, nullable, path25) {
   const composition = getComposition(schema);
   const branchSchemas = composition?.branches ?? [];
   const keyword = composition?.keyword ?? "oneOf";
   const branches = branchSchemas.map(
-    (branch, index) => resolveReferencedSchema(branch, root, [...path24, keyword, String(index)])
+    (branch, index) => resolveReferencedSchema(branch, root, [...path25, keyword, String(index)])
   );
-  const discriminator = findDiscriminator(branches, root, path24);
+  const discriminator = findDiscriminator(branches, root, path25);
   if (discriminator !== void 0) {
     const convertedBranches = Object.fromEntries(
       branches.map((branch, index) => [
         getDiscriminatorLiteral(branch, discriminator, root),
         convertObjectSchema(branch, root, {
           omitProperty: discriminator,
-          path: [...path24, keyword, String(index)]
+          path: [...path25, keyword, String(index)]
         })
       ])
     );
@@ -11223,7 +12092,7 @@ function convertCompositionSchema(schema, root, nullable, path24) {
     S.Union(
       branches.map(
         (branch, index) => convertObjectSchema(branch, root, {
-          path: [...path24, keyword, String(index)]
+          path: [...path25, keyword, String(index)]
         })
       )
     ),
@@ -11337,11 +12206,11 @@ function getComposition(schema) {
   }
   return void 0;
 }
-function formatJsonSchemaPath(path24) {
-  if (path24.length === 0) {
+function formatJsonSchemaPath(path25) {
+  if (path25.length === 0) {
     return "#";
   }
-  return `#/${path24.map(escapeJsonPointerSegment).join("/")}`;
+  return `#/${path25.map(escapeJsonPointerSegment).join("/")}`;
 }
 function formatJsonSchemaType(type2) {
   return Array.isArray(type2) ? JSON.stringify(type2) : String(type2);
@@ -11357,11 +12226,11 @@ function isRecordSchema(schema) {
   const propertyKeys = Object.keys(schema.properties ?? {});
   return schema.type === "object" && propertyKeys.length === 0 && typeof schema.additionalProperties === "object" && schema.additionalProperties !== null;
 }
-function findDiscriminator(branches, root, path24) {
+function findDiscriminator(branches, root, path25) {
   const [firstBranch] = branches;
   if (firstBranch === void 0) {
     throw new Error(
-      `JSON Schema "${formatJsonSchemaPath(path24)}" uses oneOf/anyOf/allOf but has no branches.`
+      `JSON Schema "${formatJsonSchemaPath(path25)}" uses oneOf/anyOf/allOf but has no branches.`
     );
   }
   const candidateKeys = Object.keys(firstBranch.properties ?? {});
@@ -11401,19 +12270,19 @@ function getDiscriminatorLiteral(branch, key2, root) {
   }
   return void 0;
 }
-function resolveReferencedSchema(schema, root, path24) {
+function resolveReferencedSchema(schema, root, path25) {
   if (schema.$ref === void 0) {
     return schema;
   }
   const resolvedTarget = resolveLocalRef(root, schema.$ref);
   if (resolvedTarget === void 0) {
     throw new Error(
-      `JSON Schema "${formatJsonSchemaPath(path24)}" uses "$ref": ${schema.$ref}. toolcraft only supports internal refs like "#/components/schemas/Foo".`
+      `JSON Schema "${formatJsonSchemaPath(path25)}" uses "$ref": ${schema.$ref}. toolcraft only supports internal refs like "#/components/schemas/Foo".`
     );
   }
   const { $ref: ignoredRef, ...siblingKeywords } = schema;
   void ignoredRef;
-  const resolvedSchema = resolveReferencedSchema(resolvedTarget, root, path24);
+  const resolvedSchema = resolveReferencedSchema(resolvedTarget, root, path25);
   if (Object.keys(siblingKeywords).length === 0) {
     return resolvedSchema;
   }
@@ -11437,9 +12306,9 @@ function mergeJsonSchemas(base, overlay) {
     ...mergedRequired === void 0 ? {} : { required: mergedRequired }
   };
 }
-function hasSelfReferencingRef(schema, root, path24 = "#", activePaths = /* @__PURE__ */ new Set()) {
+function hasSelfReferencingRef(schema, root, path25 = "#", activePaths = /* @__PURE__ */ new Set()) {
   const nextActivePaths = new Set(activePaths);
-  nextActivePaths.add(path24);
+  nextActivePaths.add(path25);
   const localRefPath = getLocalRefPath(schema.$ref);
   if (localRefPath !== void 0) {
     if (nextActivePaths.has(localRefPath)) {
@@ -11450,13 +12319,13 @@ function hasSelfReferencingRef(schema, root, path24 = "#", activePaths = /* @__P
       return true;
     }
   }
-  if (schema.items !== void 0 && hasSelfReferencingRef(schema.items, root, `${path24}/items`, nextActivePaths)) {
+  if (schema.items !== void 0 && hasSelfReferencingRef(schema.items, root, `${path25}/items`, nextActivePaths)) {
     return true;
   }
   if (typeof schema.additionalProperties === "object" && schema.additionalProperties !== null && hasSelfReferencingRef(
     schema.additionalProperties,
     root,
-    `${path24}/additionalProperties`,
+    `${path25}/additionalProperties`,
     nextActivePaths
   )) {
     return true;
@@ -11465,7 +12334,7 @@ function hasSelfReferencingRef(schema, root, path24 = "#", activePaths = /* @__P
     if (hasSelfReferencingRef(
       childSchema,
       root,
-      `${path24}/properties/${escapeJsonPointerSegment(key2)}`,
+      `${path25}/properties/${escapeJsonPointerSegment(key2)}`,
       nextActivePaths
     )) {
       return true;
@@ -11475,24 +12344,24 @@ function hasSelfReferencingRef(schema, root, path24 = "#", activePaths = /* @__P
     if (hasSelfReferencingRef(
       childSchema,
       root,
-      `${path24}/$defs/${escapeJsonPointerSegment(key2)}`,
+      `${path25}/$defs/${escapeJsonPointerSegment(key2)}`,
       nextActivePaths
     )) {
       return true;
     }
   }
   for (const [index, childSchema] of (schema.oneOf ?? []).entries()) {
-    if (hasSelfReferencingRef(childSchema, root, `${path24}/oneOf/${index}`, nextActivePaths)) {
+    if (hasSelfReferencingRef(childSchema, root, `${path25}/oneOf/${index}`, nextActivePaths)) {
       return true;
     }
   }
   for (const [index, childSchema] of (schema.anyOf ?? []).entries()) {
-    if (hasSelfReferencingRef(childSchema, root, `${path24}/anyOf/${index}`, nextActivePaths)) {
+    if (hasSelfReferencingRef(childSchema, root, `${path25}/anyOf/${index}`, nextActivePaths)) {
       return true;
     }
   }
   for (const [index, childSchema] of (schema.allOf ?? []).entries()) {
-    if (hasSelfReferencingRef(childSchema, root, `${path24}/allOf/${index}`, nextActivePaths)) {
+    if (hasSelfReferencingRef(childSchema, root, `${path25}/allOf/${index}`, nextActivePaths)) {
       return true;
     }
   }
@@ -11508,14 +12377,14 @@ function getLocalRefPath(ref) {
   return ref.startsWith("#/") ? ref : void 0;
 }
 function resolveLocalRef(root, ref) {
-  const path24 = getLocalRefPath(ref);
-  if (path24 === void 0) {
+  const path25 = getLocalRefPath(ref);
+  if (path25 === void 0) {
     return void 0;
   }
-  if (path24 === "#") {
+  if (path25 === "#") {
     return root;
   }
-  const segments = path24.slice(2).split("/").map(unescapeJsonPointerSegment);
+  const segments = path25.slice(2).split("/").map(unescapeJsonPointerSegment);
   let current = root;
   for (const segment of segments) {
     if (Array.isArray(current)) {
@@ -11561,15 +12430,15 @@ function getBooleanDefault(value) {
   return typeof value === "boolean" ? value : void 0;
 }
 function getArrayDefault(value) {
-  return Array.isArray(value) && value.every((item) => isJsonValue(item)) ? value : void 0;
+  return Array.isArray(value) && value.every((item) => isJsonValue2(item)) ? value : void 0;
 }
 function getPrimitiveEnumDefault(value, candidates) {
   return isPrimitiveEnumValue(value) && candidates.includes(value) ? value : void 0;
 }
 function getJsonDefault(value) {
-  return isJsonValue(value) ? value : void 0;
+  return isJsonValue2(value) ? value : void 0;
 }
-function isJsonValue(value) {
+function isJsonValue2(value) {
   if (value === null) {
     return true;
   }
@@ -11577,12 +12446,12 @@ function isJsonValue(value) {
     return true;
   }
   if (Array.isArray(value)) {
-    return value.every((item) => isJsonValue(item));
+    return value.every((item) => isJsonValue2(item));
   }
   if (!isPlainObject(value)) {
     return false;
   }
-  return Object.values(value).every((item) => isJsonValue(item));
+  return Object.values(value).every((item) => isJsonValue2(item));
 }
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11677,6 +12546,7 @@ function createProxyCommand(parent, tool, commandName, connection) {
     kind: "command",
     name: commandName,
     description: tool.description,
+    hidden: false,
     examples: [],
     aliases: [],
     positional: [],
@@ -11772,7 +12642,7 @@ async function ensureConnected(connection) {
 async function readCache(cachePath) {
   try {
     await assertCachePathHasNoSymlinks(cachePath);
-    const raw = await readFile3(cachePath, "utf8");
+    const raw = await readFile4(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object" || !Array.isArray(parsed.tools) || parsed.upstream === void 0 || typeof parsed.upstream.name !== "string" || typeof parsed.upstream.version !== "string") {
       return void 0;
@@ -11793,7 +12663,7 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  const directory = path12.dirname(cachePath);
+  const directory = path13.dirname(cachePath);
   const tempPath = `${cachePath}.tmp-${randomUUID4()}`;
   let tempCreated = false;
   await assertCachePathHasNoSymlinks(cachePath);
@@ -11990,13 +12860,13 @@ function collectProxyGroups(root) {
 function findProjectRoot(from = process.cwd()) {
   let current = process.cwd();
   if (from !== current) {
-    current = path12.resolve(from);
+    current = path13.resolve(from);
   }
   while (true) {
-    if (existsSync2(path12.join(current, "package.json"))) {
+    if (existsSync2(path13.join(current, "package.json"))) {
       return current;
     }
-    const parent = path12.dirname(current);
+    const parent = path13.dirname(current);
     if (parent === current) {
       return void 0;
     }
@@ -12013,7 +12883,7 @@ function resolveCachePath(name, projectRoot) {
   if (name.length === 0 || name === "." || name === ".." || name.includes("/") || name.includes("\\")) {
     throw new Error(`MCP proxy group name must be a file-safe name: "${name}".`);
   }
-  return path12.join(resolvedProjectRoot, ".toolcraft", "mcp", `${name}.json`);
+  return path13.join(resolvedProjectRoot, ".toolcraft", "mcp", `${name}.json`);
 }
 async function assertCachePathHasNoSymlinks(filePath) {
   let currentPath = filePath;
@@ -12027,10 +12897,10 @@ async function assertCachePathHasNoSymlinks(filePath) {
         throw error3;
       }
     }
-    if (path12.basename(currentPath) === ".toolcraft") {
+    if (path13.basename(currentPath) === ".toolcraft") {
       return;
     }
-    const parentPath = path12.dirname(currentPath);
+    const parentPath = path13.dirname(currentPath);
     if (parentPath === currentPath) {
       return;
     }
@@ -12176,20 +13046,20 @@ function reportsEnabled(option, env) {
 function resolveReportDir(option, projectRoot) {
   const configuredDir = typeof option === "object" ? option.dir : void 0;
   if (configuredDir === void 0 || configuredDir.length === 0) {
-    return path13.join(projectRoot, ".toolcraft", "errors");
+    return path14.join(projectRoot, ".toolcraft", "errors");
   }
-  return path13.isAbsolute(configuredDir) ? configuredDir : path13.join(projectRoot, configuredDir);
+  return path14.isAbsolute(configuredDir) ? configuredDir : path14.join(projectRoot, configuredDir);
 }
 function reportDirMustStayWithinProject(option) {
   const configuredDir = typeof option === "object" ? option.dir : void 0;
-  return configuredDir === void 0 || configuredDir.length === 0 || !path13.isAbsolute(configuredDir);
+  return configuredDir === void 0 || configuredDir.length === 0 || !path14.isAbsolute(configuredDir);
 }
 function isWithinDirectory(parent, child) {
-  const relative = path13.relative(parent, child);
-  return relative === "" || !path13.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path13.sep}`);
+  const relative = path14.relative(parent, child);
+  return relative === "" || !path14.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path14.sep}`);
 }
 async function assertReportDirWithinProject(projectRoot, reportDir) {
-  if (!isWithinDirectory(path13.resolve(projectRoot), path13.resolve(reportDir))) {
+  if (!isWithinDirectory(path14.resolve(projectRoot), path14.resolve(reportDir))) {
     throw new Error("Error report directory resolves outside project root.");
   }
   const [canonicalProjectRoot, canonicalReportDir] = await Promise.all([
@@ -12240,7 +13110,7 @@ function slugifyCommandPath(commandPath) {
   return output.length === 0 ? "root" : output;
 }
 function relativeDisplayPath(projectRoot, absolutePath) {
-  const relative = path13.relative(projectRoot, absolutePath);
+  const relative = path14.relative(projectRoot, absolutePath);
   return relative.length === 0 || relative.startsWith("..") ? absolutePath : relative;
 }
 function redactValue(value) {
@@ -12560,7 +13430,7 @@ async function writeErrorReport(context) {
   const projectRoot = resolveProjectRoot(context.projectRoot);
   const reportDir = resolveReportDir(context.errorReports, projectRoot);
   const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID5()}.log`;
-  const absolutePath = path13.join(reportDir, fileName);
+  const absolutePath = path14.join(reportDir, fileName);
   await mkdir2(reportDir, { recursive: true });
   if (reportDirMustStayWithinProject(context.errorReports)) {
     await assertReportDirWithinProject(projectRoot, reportDir);
@@ -13030,7 +13900,7 @@ function inferProgramName(argv) {
   if (typeof entrypoint !== "string" || entrypoint.length === 0) {
     return "toolcraft";
   }
-  const parsed = path14.parse(entrypoint);
+  const parsed = path15.parse(entrypoint);
   return parsed.name.length > 0 ? parsed.name : "toolcraft";
 }
 function normalizeRoots(roots, argv) {
@@ -13088,11 +13958,11 @@ function formatSegment(segment, casing) {
   const separator = casing === "snake" ? "_" : "-";
   return splitWords3(segment).join(separator);
 }
-function toOptionFlag(path24, casing) {
-  return `--${path24.map((segment) => formatSegment(segment, casing)).join(".")}`;
+function toOptionFlag(path25, casing) {
+  return `--${path25.map((segment) => formatSegment(segment, casing)).join(".")}`;
 }
-function toOptionAttribute(path24, casing) {
-  return path24.map((segment) => {
+function toOptionAttribute(path25, casing) {
+  return path25.map((segment) => {
     const formatted = formatSegment(segment, casing);
     if (casing === "snake") {
       return formatted;
@@ -13103,23 +13973,23 @@ function toOptionAttribute(path24, casing) {
     ).join("");
   }).join(".");
 }
-function toDisplayPath(path24) {
-  return path24.join(".");
+function toDisplayPath(path25) {
+  return path25.join(".");
 }
-function toUnionKindControlPath(path24) {
-  if (path24.length === 0) {
+function toUnionKindControlPath(path25) {
+  if (path25.length === 0) {
     return ["kind"];
   }
-  const head = path24.slice(0, -1);
-  const tail = path24[path24.length - 1] ?? "";
+  const head = path25.slice(0, -1);
+  const tail = path25[path25.length - 1] ?? "";
   return [...head, `${tail}Kind`];
 }
-function toUnionKindDisplayPath(path24) {
-  if (path24.length === 0) {
+function toUnionKindDisplayPath(path25) {
+  if (path25.length === 0) {
     return "kind";
   }
-  const head = path24.slice(0, -1);
-  const tail = path24[path24.length - 1] ?? "";
+  const head = path25.slice(0, -1);
+  const tail = path25[path25.length - 1] ?? "";
   return [...head, `${tail}-kind`].join(".");
 }
 function createSyntheticEnumSchema(values) {
@@ -13135,14 +14005,14 @@ function getRequiredBranchFingerprint(branch, casing) {
   const requiredKeys = Object.entries(branch.shape).filter(([, schema]) => schema.kind !== "optional").map(([key2]) => formatSegment(key2, casing)).sort();
   return requiredKeys.join("+");
 }
-function collectFields(schema, casing, globalLongOptionFlags, path24 = [], inheritedOptional = false, variantContext) {
+function collectFields(schema, casing, globalLongOptionFlags, path25 = [], inheritedOptional = false, variantContext) {
   const collected = {
     dynamicFields: [],
     fields: [],
     variants: []
   };
   for (const [key2, rawChildSchema] of Object.entries(schema.shape)) {
-    const nextPath = [...path24, key2];
+    const nextPath = [...path25, key2];
     const runtimeOptional = inheritedOptional || rawChildSchema.kind === "optional";
     const childSchema = unwrapOptional2(rawChildSchema);
     const requiredWhenActive = rawChildSchema.kind !== "optional" && childSchema.default === void 0;
@@ -13328,9 +14198,9 @@ function collectFields(schema, casing, globalLongOptionFlags, path24 = [], inher
   }
   return collected;
 }
-function toCommanderOptionAttribute(path24, casing, globalLongOptionFlags) {
-  const optionAttribute = toOptionAttribute(path24, casing);
-  const optionFlag = toOptionFlag(path24, casing);
+function toCommanderOptionAttribute(path25, casing, globalLongOptionFlags) {
+  const optionAttribute = toOptionAttribute(path25, casing);
+  const optionFlag = toOptionFlag(path25, casing);
   if (!globalLongOptionFlags.has(optionFlag)) {
     return optionAttribute;
   }
@@ -13603,6 +14473,20 @@ function parseArrayValue(value, schema, label) {
     (item) => parseScalarValue(item, itemSchema, label)
   );
 }
+function isNegativeNumericArrayToken(token, schema) {
+  if (!token.startsWith("-") || token.startsWith("--")) {
+    return false;
+  }
+  const itemSchema = unwrapOptional2(schema.item);
+  if (itemSchema.kind !== "number") {
+    return false;
+  }
+  const items = splitArrayInput(token);
+  return items.length > 0 && items.every((item) => isValidNumberSchemaValue(Number(item), itemSchema));
+}
+function isNextArrayOptionToken(token, schema) {
+  return token.startsWith("-") && !isNegativeNumericArrayToken(token, schema);
+}
 function validateArrayBounds(value, schema, label) {
   if (schema.minItems !== void 0 && value.length < schema.minItems) {
     throw new UserError(
@@ -13742,6 +14626,14 @@ function isNodeVisibleInScope(node, scope) {
 function getVisibleChildren(group, scope) {
   return group.children.filter((child) => isNodeVisibleInScope(child, scope));
 }
+function getHelpChildren(group, scope) {
+  return getVisibleChildren(group, scope).filter((child) => {
+    if (child.kind === "command") {
+      return child.hidden !== true;
+    }
+    return true;
+  });
+}
 function findVisibleChild(group, token, scope) {
   return getVisibleChildren(group, scope).find(
     (child) => child.name === token || child.aliases.includes(token)
@@ -13888,6 +14780,26 @@ function describeHelpValueToken(schema, field) {
   }
   return describeFieldNameValueToken(field.displayPath, field.optionFlag) ?? "value";
 }
+function formatCompactEnumSignatureToken(schema) {
+  if (schema.kind !== "enum" || schema.values.length < 2 || schema.values.length > 3) {
+    return void 0;
+  }
+  const tokens = schema.values.map((value) => String(value));
+  const compact = tokens.every(
+    (token) => token.length > 0 && token.length <= 24 && token.trim() === token && !token.includes("|") && !token.includes("	") && !token.includes("\n") && !token.includes("\r") && !token.includes(" ")
+  );
+  return compact ? tokens.join("|") : void 0;
+}
+function formatCommandParameterFieldFlags(field, globalLongOptionFlags) {
+  if (field.positionalIndex !== void 0 || field.schema.kind === "boolean") {
+    return formatHelpFieldFlags(field, globalLongOptionFlags);
+  }
+  const enumToken = formatCompactEnumSignatureToken(field.schema);
+  if (enumToken !== void 0) {
+    return `${formatOptionFlags(field, globalLongOptionFlags)} ${enumToken}`;
+  }
+  return formatHelpFieldFlags(field, globalLongOptionFlags);
+}
 function describeDynamicFieldType(field) {
   if (field.schema.kind === "record") {
     const valueSchema = unwrapOptional2(field.schema.value);
@@ -14055,7 +14967,7 @@ function formatCommandParameterTokens(command, casing, globalLongOptionFlags) {
   const fields = assignPositionals(collected.fields, command.positional);
   return fields.filter((field) => field.global !== true).map(
     (field) => wrapOptionalCommandParameterToken(
-      formatHelpFieldFlags(field, globalLongOptionFlags),
+      formatCommandParameterFieldFlags(field, globalLongOptionFlags),
       field.positionalIndex === void 0 && (field.optional || field.hasDefault)
     )
   ).concat(
@@ -14069,7 +14981,7 @@ function formatCommandRowName(node, casing, globalLongOptionFlags) {
   return name;
 }
 function formatCommandRows(group, scope, casing, globalLongOptionFlags) {
-  return getVisibleChildren(group, scope).map((child) => ({
+  return getHelpChildren(group, scope).map((child) => ({
     name: formatCommandRowName(child, casing, globalLongOptionFlags),
     description: child.description ?? ""
   }));
@@ -14113,7 +15025,7 @@ function collectSchemaGlobalFieldRows(group, scope, casing, globalLongOptionFlag
       }
       return;
     }
-    for (const child of getVisibleChildren(node, scope)) {
+    for (const child of getHelpChildren(node, scope)) {
       visit(child);
     }
   };
@@ -14136,6 +15048,17 @@ function buildUsageLine(breadcrumb, rootUsageName, suffix) {
   const tokens = [rootUsageName, subPath, suffix].filter((segment) => segment.length > 0);
   return tokens.join(" ");
 }
+function formatGroupUsageSuffix(group, scope, casing, globalLongOptionFlags) {
+  if (group.default !== void 0 && group.default.hidden === true && group.default.scope.includes(scope)) {
+    const parameterTokens = formatCommandParameterTokens(
+      group.default,
+      casing,
+      globalLongOptionFlags
+    );
+    return ["[command]", "[OPTIONS]", ...parameterTokens].join(" ");
+  }
+  return "[command] [OPTIONS]";
+}
 function renderGroupHelp(group, breadcrumb, scope, casing, globalOptions, rootUsageName, isRoot) {
   const sections = [];
   const globalLongOptionFlags = getGlobalLongOptionFlags(
@@ -14169,7 +15092,11 @@ ${builtInLine}`
   return renderHelpDocument({
     breadcrumb,
     rootUsageName,
-    usageLine: buildUsageLine(breadcrumb, rootUsageName, "[command] [OPTIONS]"),
+    usageLine: buildUsageLine(
+      breadcrumb,
+      rootUsageName,
+      formatGroupUsageSuffix(group, scope, casing, globalLongOptionFlags)
+    ),
     description: group.description,
     requiresAuth: group.requires?.auth === true,
     sections
@@ -14278,6 +15205,8 @@ function createNodeCommand(node, casing, globalLongOptionFlags, execute, presets
       return null;
     }
     const command = new CommanderCommand(node.name);
+    Reflect.set(command, "_toolcraftHidden", node.hidden);
+    Reflect.set(command, "_toolcraftOriginalName", node.name);
     const collected = collectFields(node.params, casing, globalLongOptionFlags);
     const fields = assignPositionals(collected.fields, node.positional);
     validateUniqueOptionFlags(fields, globalLongOptionFlags);
@@ -14321,6 +15250,7 @@ function createNodeCommand(node, casing, globalLongOptionFlags, execute, presets
   if (!isNodeVisibleInScope(node, "cli")) {
     return null;
   }
+  const reservedChildNames = node.children.filter((child) => !isNodeVisibleInScope(child, "cli")).flatMap((child) => getNodeCommandNames(child));
   const visibleChildren = node.children.map(
     (child) => createNodeCommand(
       child,
@@ -14333,6 +15263,7 @@ function createNodeCommand(node, casing, globalLongOptionFlags, execute, presets
     )
   ).filter((child) => child !== null);
   const group = new CommanderCommand(node.name);
+  Reflect.set(group, "_toolcraftReservedChildNames", reservedChildNames);
   if (node.description !== void 0) {
     group.description(node.description);
   }
@@ -14347,7 +15278,7 @@ function createNodeCommand(node, casing, globalLongOptionFlags, execute, presets
   return group;
 }
 function addCommanderChild(parent, child, isDefault, siblingNames) {
-  if (isDefault && child.name().length === 0) {
+  if (isDefault && (child.name().length === 0 || isToolcraftHiddenCommander(child))) {
     let internalName = "__toolcraft_default__";
     let suffix = 2;
     while (siblingNames.has(internalName)) {
@@ -14355,10 +15286,37 @@ function addCommanderChild(parent, child, isDefault, siblingNames) {
       suffix += 1;
     }
     child.name(internalName);
+    Reflect.set(
+      parent,
+      "_toolcraftHiddenDefaultNames",
+      getToolcraftHiddenDefaultNames(parent).concat([
+        ...new Set([Reflect.get(child, "_toolcraftOriginalName"), ...child.aliases()].filter(
+          (name) => typeof name === "string" && name.length > 0
+        ))
+      ])
+    );
     parent.addCommand(child, { hidden: true, isDefault: true });
     return;
   }
-  parent.addCommand(child, isDefault ? { isDefault: true } : void 0);
+  const options = {
+    ...isDefault ? { isDefault: true } : {},
+    ...isToolcraftHiddenCommander(child) ? { hidden: true } : {}
+  };
+  parent.addCommand(child, Object.keys(options).length > 0 ? options : void 0);
+}
+function isToolcraftHiddenCommander(command) {
+  return Reflect.get(command, "_toolcraftHidden") === true;
+}
+function getToolcraftHiddenDefaultNames(command) {
+  const value = Reflect.get(command, "_toolcraftHiddenDefaultNames");
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function getToolcraftReservedChildNames(command) {
+  const value = Reflect.get(command, "_toolcraftReservedChildNames");
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function getNodeCommandNames(node) {
+  return [node.name, ...node.aliases].filter((name) => name.length > 0);
 }
 function addGlobalOptions(command, presetsEnabled, controls) {
   const options = [];
@@ -14410,10 +15368,10 @@ function parseDebugStackMode(value) {
     formatInvalidEnumMessage("--debug", String(value), ["raw"], { candidates: ["raw"] })
   );
 }
-function setNestedValue(target, path24, value) {
+function setNestedValue(target, path25, value) {
   let cursor2 = target;
-  for (let index = 0; index < path24.length - 1; index += 1) {
-    const segment = path24[index] ?? "";
+  for (let index = 0; index < path25.length - 1; index += 1) {
+    const segment = path25[index] ?? "";
     const existing = Object.prototype.hasOwnProperty.call(cursor2, segment) ? cursor2[segment] : void 0;
     if (typeof existing === "object" && existing !== null) {
       cursor2 = existing;
@@ -14428,7 +15386,7 @@ function setNestedValue(target, path24, value) {
     });
     cursor2 = next;
   }
-  const leaf = path24[path24.length - 1];
+  const leaf = path25[path25.length - 1];
   if (leaf !== void 0) {
     Object.defineProperty(cursor2, leaf, {
       value,
@@ -14520,6 +15478,37 @@ function resolveOutput(resolvedFlags) {
   }
   return "rich";
 }
+function resolveOutputFromArgv(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index] ?? "";
+    if (token === "--json") {
+      return "json";
+    }
+    if (token === "--md" || token === "--markdown") {
+      return "md";
+    }
+    if (token === "--output") {
+      const value = argv[index + 1];
+      if (value === "rich" || value === "md" || value === "json") {
+        return value;
+      }
+      if (value === "markdown") {
+        return "md";
+      }
+      continue;
+    }
+    if (token.startsWith("--output=")) {
+      const value = token.slice("--output=".length);
+      if (value === "rich" || value === "md" || value === "json") {
+        return value;
+      }
+      if (value === "markdown") {
+        return "md";
+      }
+    }
+  }
+  return "rich";
+}
 var DESIGN_SYSTEM_OUTPUT_BY_MODE = {
   rich: "terminal",
   md: "markdown",
@@ -14545,21 +15534,21 @@ async function withOutputFormat2(output, fn) {
 }
 function createFs2() {
   return {
-    readFile: async (path24, encoding = "utf8") => readFile4(path24, { encoding }),
-    writeFile: async (path24, contents, options) => {
-      await writeFile5(path24, contents, options);
+    readFile: async (path25, encoding = "utf8") => readFile5(path25, { encoding }),
+    writeFile: async (path25, contents, options) => {
+      await writeFile5(path25, contents, options);
     },
-    exists: async (path24) => {
+    exists: async (path25) => {
       try {
-        await access2(path24);
+        await access2(path25);
         return true;
       } catch {
         return false;
       }
     },
-    lstat: async (path24) => lstat3(path24),
+    lstat: async (path25) => lstat3(path25),
     rename: async (fromPath, toPath) => rename3(fromPath, toPath),
-    unlink: async (path24) => unlink3(path24)
+    unlink: async (path25) => unlink3(path25)
   };
 }
 function createEnv2(values = process.env) {
@@ -14575,9 +15564,9 @@ function isPlainObject4(value) {
 function hasFieldValue(value) {
   return value !== void 0;
 }
-function hasNestedField(fields, path24) {
+function hasNestedField(fields, path25) {
   return fields.some(
-    (field) => path24.length < field.path.length && path24.every((segment, index) => field.path[index] === segment)
+    (field) => path25.length < field.path.length && path25.every((segment, index) => field.path[index] === segment)
   );
 }
 function describeExpectedPresetValue(schema) {
@@ -14680,7 +15669,7 @@ function validatePresetFieldValue(value, field, presetPath) {
 async function loadPresetValues(fields, presetPath) {
   let rawPreset;
   try {
-    rawPreset = await readFile4(presetPath, {
+    rawPreset = await readFile5(presetPath, {
       encoding: "utf8"
     });
   } catch (error3) {
@@ -14706,9 +15695,9 @@ async function loadPresetValues(fields, presetPath) {
   }
   const fieldByPath = new Map(fields.map((field) => [field.displayPath, field]));
   const presetValues = {};
-  function visitObject(current, path24) {
+  function visitObject(current, path25) {
     for (const [key2, value] of Object.entries(current)) {
-      const nextPath = [...path24, key2];
+      const nextPath = [...path25, key2];
       const displayPath = toDisplayPath(nextPath);
       const field = fieldByPath.get(displayPath);
       if (field !== void 0) {
@@ -14915,8 +15904,8 @@ function createFixtureService(definition) {
   );
 }
 function resolveFixturePath(commandPath) {
-  const parsed = path14.parse(commandPath);
-  return path14.join(parsed.dir, `${parsed.name}.fixture.json`);
+  const parsed = path15.parse(commandPath);
+  return path15.join(parsed.dir, `${parsed.name}.fixture.json`);
 }
 function selectFixtureScenario(scenarios, selector, fixturePath) {
   if (isNumericFixtureSelector(selector)) {
@@ -14947,7 +15936,7 @@ async function loadFixtureScenario(command, selector) {
   const fixturePath = resolveFixturePath(commandPath);
   let rawFixture;
   try {
-    rawFixture = await readFile4(fixturePath, {
+    rawFixture = await readFile5(fixturePath, {
       encoding: "utf8"
     });
   } catch {
@@ -15041,6 +16030,44 @@ function renderApprovalDeclined(error3) {
   logger2.error(error3.message);
   process.exitCode = 1;
 }
+function renderCliErrorPattern(pattern) {
+  const logger2 = createLogger();
+  if (pattern.kind === "usage") {
+    logger2.error(
+      appendUsagePointer(pattern.message, {
+        rootUsageName: pattern.rootUsageName,
+        commandPath: pattern.commandPath
+      })
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (pattern.kind === "runtime-user") {
+    logger2.error(pattern.message);
+    process.exitCode = 1;
+    return;
+  }
+  if (pattern.kind === "toolcraft-bug") {
+    logger2.error(
+      `toolcraft hit an internal invariant: ${pattern.error.message}
+This is a bug in toolcraft or in the command definition; it cannot be worked around by changing argv. Re-run with --debug for a stack trace and file an issue.`
+    );
+    if (pattern.debugStackMode !== void 0 && pattern.error.stack) {
+      process.stderr.write(`${formatDebugStack(pattern.error.stack, pattern.debugStackMode)}
+`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  logger2.error(
+    pattern.debugStackMode !== void 0 ? pattern.message : `${pattern.message} Use --debug for a stack trace.`
+  );
+  if (pattern.debugStackMode !== void 0 && pattern.stack !== void 0) {
+    process.stderr.write(`${formatDebugStack(pattern.stack, pattern.debugStackMode)}
+`);
+  }
+  process.exitCode = 1;
+}
 function validateServices(services) {
   for (const name of Object.keys(services)) {
     if (RESERVED_SERVICE_NAMES.has(name)) {
@@ -15050,8 +16077,8 @@ function validateServices(services) {
     }
   }
 }
-function getNestedValue(target, path24) {
-  return path24.reduce(
+function getNestedValue(target, path25) {
+  return path25.reduce(
     (current, segment) => current !== null && typeof current === "object" ? current[segment] : void 0,
     target
   );
@@ -15136,7 +16163,7 @@ function consumeFieldValue(args, index, schema, label, inlineValue) {
     let cursor2 = index + 1;
     while (cursor2 < args.length) {
       const token = args[cursor2] ?? "";
-      if (token.startsWith("-")) {
+      if (isNextArrayOptionToken(token, schema)) {
         break;
       }
       const parsed = parseArrayValue(token, schema, label);
@@ -15961,73 +16988,82 @@ function renderHttpError(error3, options) {
 `);
   }
 }
-function handleRunError(error3, options) {
+async function handleRunError(error3, options) {
   const logger2 = createLogger();
-  if (error3 instanceof UserError) {
-    logger2.error(
-      appendUsagePointer(error3.message, {
-        rootUsageName: options.rootUsageName,
-        commandPath: options.commandPath
-      })
-    );
-    process.exitCode = 1;
-    return;
-  }
-  if (error3 instanceof Error && error3.name === "ToolcraftBugError") {
-    logger2.error(
-      `toolcraft hit an internal invariant: ${error3.message}
-This is a bug in toolcraft or in the command definition; it cannot be worked around by changing argv. Re-run with --debug for a stack trace and file an issue.`
-    );
-    if (options.debugStackMode !== void 0 && error3.stack) {
-      process.stderr.write(`${formatDebugStack(error3.stack, options.debugStackMode)}
-`);
-    }
-    process.exitCode = 1;
-    return;
-  }
-  if (error3 instanceof CommanderError2) {
-    process.exitCode = error3.exitCode;
-    if (error3.code === "commander.helpDisplayed" || error3.code === "commander.version") {
+  await withOutputFormat2(options.output, async () => {
+    if (error3 instanceof UserError) {
+      renderCliErrorPattern(
+        options.userErrorPattern === "usage" ? {
+          kind: "usage",
+          message: error3.message,
+          rootUsageName: options.rootUsageName,
+          commandPath: options.commandPath
+        } : {
+          kind: "runtime-user",
+          message: error3.message
+        }
+      );
       return;
     }
-    if (error3.code === "commander.unknownCommand") {
-      logger2.error(
-        appendUsagePointer(
-          formatUnknownCommandError(error3, options.program, options.argv ?? process.argv),
-          {
-            rootUsageName: options.rootUsageName,
-            commandPath: options.commandPath
-          }
-        )
-      );
+    if (error3 instanceof Error && error3.name === "ToolcraftBugError") {
+      renderCliErrorPattern({
+        kind: "toolcraft-bug",
+        error: error3,
+        debugStackMode: options.debugStackMode
+      });
       return;
     }
-    if (error3.code === "commander.unknownOption") {
-      const argv = options.argv ?? process.argv;
+    if (error3 instanceof CommanderError2) {
+      process.exitCode = error3.exitCode;
+      if (error3.code === "commander.helpDisplayed" || error3.code === "commander.version") {
+        return;
+      }
+      if (error3.code === "commander.unknownCommand") {
+        logger2.error(
+          appendUsagePointer(
+            formatUnknownCommandError(error3, options.program, options.argv ?? process.argv),
+            {
+              rootUsageName: options.rootUsageName,
+              commandPath: options.commandPath
+            }
+          )
+        );
+        return;
+      }
+      if (error3.code === "commander.unknownOption") {
+        const argv = options.argv ?? process.argv;
+        logger2.error(
+          appendUsagePointer(formatUnknownOptionError(error3, options.program, argv), {
+            rootUsageName: options.rootUsageName,
+            commandPath: options.commandPath.length > 0 ? options.commandPath : findCurrentCommanderCommandPath(options.program, argv)
+          })
+        );
+        return;
+      }
       logger2.error(
-        appendUsagePointer(formatUnknownOptionError(error3, options.program, argv), {
+        appendUsagePointer(formatCommanderErrorMessage(error3), {
           rootUsageName: options.rootUsageName,
-          commandPath: options.commandPath.length > 0 ? options.commandPath : findCurrentCommanderCommandPath(options.program, argv)
+          commandPath: options.commandPath.length > 0 ? options.commandPath : findCurrentCommanderCommandPath(options.program, options.argv ?? process.argv)
         })
       );
       return;
     }
-    return;
-  }
-  if (isHttpErrorLike(error3)) {
-    renderHttpError(error3, options);
-    process.exitCode = 1;
-    return;
-  }
-  const message2 = error3 instanceof Error ? error3.message : String(error3);
-  logger2.error(
-    options.debugStackMode !== void 0 ? message2 : `${message2} Use --debug for a stack trace.`
-  );
-  if (options.debugStackMode !== void 0 && error3 instanceof Error && error3.stack) {
-    process.stderr.write(`${formatDebugStack(error3.stack, options.debugStackMode)}
-`);
-  }
-  process.exitCode = 1;
+    if (isHttpErrorLike(error3)) {
+      renderHttpError(error3, options);
+      process.exitCode = 1;
+      return;
+    }
+    const message2 = error3 instanceof Error ? error3.message : String(error3);
+    renderCliErrorPattern({
+      kind: "unexpected",
+      message: message2,
+      stack: error3 instanceof Error ? error3.stack : void 0,
+      debugStackMode: options.debugStackMode
+    });
+  });
+}
+function formatCommanderErrorMessage(error3) {
+  return error3.message.startsWith("error:") ? error3.message : `error: ${error3.message}`;
 }
 function formatInvalidEnumMessage(label, value, values, opts = {}) {
   const suggestions = suggest(
@@ -16188,6 +17224,13 @@ function findUnknownCommanderCommand(program, argv) {
       }
       continue;
     }
+    if (getToolcraftHiddenDefaultNames(current).includes(token) || getToolcraftReservedChildNames(current).includes(token)) {
+      return {
+        input: token,
+        currentCommand: current,
+        commandPath: pathSegments.join(" ")
+      };
+    }
     if (current.commands.length === 0 || getDefaultCommanderCommandName(current) !== void 0) {
       return void 0;
     }
@@ -16262,6 +17305,11 @@ async function runCLI(roots, options = {}) {
   if (version !== void 0) {
     program.version(version, "--version");
   }
+  Reflect.set(
+    program,
+    "_toolcraftReservedChildNames",
+    root.children.filter((child) => !isNodeVisibleInScope(child, "cli")).flatMap((child) => getNodeCommandNames(child))
+  );
   let lastActionCommand;
   let resolvedCommandPath = "";
   let errorReportContext;
@@ -16336,13 +17384,15 @@ async function runCLI(roots, options = {}) {
       process.stderr.write(`Saved error report to ${report.displayPath}
 `);
     }
-    handleRunError(error3, {
+    await handleRunError(error3, {
       debugStackMode: resolvedFlags !== void 0 ? resolveDebugStackMode(resolvedFlags.debug) : getDebugStackModeFromArgv(process.argv),
+      output: resolvedFlags !== void 0 ? resolveOutput(resolvedFlags) : resolveOutputFromArgv(process.argv),
       verbose: resolvedFlags ? Boolean(resolvedFlags.verbose) : process.argv.includes("--verbose"),
       program,
       argv: process.argv,
       rootUsageName,
-      commandPath: resolvedCommandPath
+      commandPath: resolvedCommandPath,
+      userErrorPattern: errorReportContext?.params === void 0 ? "usage" : "runtime-user"
     });
   }
 }
@@ -16353,7 +17403,7 @@ import { randomUUID as randomUUID6 } from "node:crypto";
 // src/terminal-session.ts
 import { EventEmitter as EventEmitter2 } from "node:events";
 import { accessSync, chmodSync, constants } from "node:fs";
-import { createRequire } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 import { dirname, join } from "node:path";
 import * as nodePty from "node-pty";
 
@@ -17492,8 +18542,8 @@ var spawnHelperChecked = false;
 function ensureSpawnHelperExecutable() {
   if (spawnHelperChecked) return;
   spawnHelperChecked = true;
-  const require3 = createRequire(import.meta.url);
-  const nodePtyDir = dirname(require3.resolve("node-pty"));
+  const require4 = createRequire2(import.meta.url);
+  const nodePtyDir = dirname(require4.resolve("node-pty"));
   const helper = join(nodePtyDir, "..", "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper");
   try {
     accessSync(helper, constants.X_OK);
@@ -17913,7 +18963,7 @@ var getSession = defineCommand({
 
 // ../agent-skill-config/src/configs.ts
 import os2 from "node:os";
-import path15 from "node:path";
+import path16 from "node:path";
 
 // ../agent-defs/src/agents/claude-code.ts
 var claudeCodeAgent = {
@@ -18277,7 +19327,7 @@ var templateMutation = {
 
 // ../config-mutations/src/execution/apply-mutation.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import path17 from "node:path";
+import path18 from "node:path";
 
 // ../config-mutations/src/formats/json.ts
 import * as jsonc from "jsonc-parser";
@@ -18400,22 +19450,22 @@ function prune(obj, shape) {
   }
   return { changed, result };
 }
-function modifyAtPath(content, path24, value) {
+function modifyAtPath(content, path25, value) {
   const indent = detectIndent(content);
   const formattingOptions = {
     tabSize: indent === "	" ? 1 : indent.length,
     insertSpaces: indent !== "	",
     eol: "\n"
   };
-  const edits = jsonc.modify(content, path24, value, { formattingOptions });
+  const edits = jsonc.modify(content, path25, value, { formattingOptions });
   let result = jsonc.applyEdits(content, edits);
   if (!result.endsWith("\n")) {
     result += "\n";
   }
   return result;
 }
-function removeAtPath(content, path24) {
-  return modifyAtPath(content, path24, void 0);
+function removeAtPath(content, path25) {
+  return modifyAtPath(content, path25, void 0);
 }
 function serializeUpdate(content, current, next) {
   let result = content || "{}";
@@ -18425,15 +19475,15 @@ function serializeUpdate(content, current, next) {
   }
   return result;
 }
-function applyObjectUpdate(content, path24, current, next) {
+function applyObjectUpdate(content, path25, current, next) {
   let result = content;
   for (const key2 of Object.keys(current)) {
     if (!hasConfigEntry(next, key2)) {
-      result = removeAtPath(result, [...path24, key2]);
+      result = removeAtPath(result, [...path25, key2]);
     }
   }
   for (const [key2, nextValue] of Object.entries(next)) {
-    const nextPath = [...path24, key2];
+    const nextPath = [...path25, key2];
     const hasCurrent = hasConfigEntry(current, key2);
     const currentValue = hasCurrent ? current[key2] : void 0;
     if (hasCurrent && isConfigObject(currentValue) && isConfigObject(nextValue)) {
@@ -18633,20 +19683,20 @@ function getConfigFormat(pathOrFormat) {
   }
   return formatRegistry[formatName];
 }
-function detectFormat(path24) {
-  const ext = getExtension(path24);
+function detectFormat(path25) {
+  const ext = getExtension(path25);
   return extensionMap[ext];
 }
-function getExtension(path24) {
-  const lastDot = path24.lastIndexOf(".");
+function getExtension(path25) {
+  const lastDot = path25.lastIndexOf(".");
   if (lastDot === -1) {
     return "";
   }
-  return path24.slice(lastDot).toLowerCase();
+  return path25.slice(lastDot).toLowerCase();
 }
 
 // ../config-mutations/src/execution/path-utils.ts
-import path16 from "node:path";
+import path17 from "node:path";
 function expandHome(targetPath, homeDir) {
   if (!targetPath?.startsWith("~")) {
     return targetPath;
@@ -18663,7 +19713,7 @@ function expandHome(targetPath, homeDir) {
       remainder = remainder.slice(1);
     }
   }
-  return remainder.length === 0 ? homeDir : path16.join(homeDir, remainder);
+  return remainder.length === 0 ? homeDir : path17.join(homeDir, remainder);
 }
 function validateHomePath(targetPath) {
   if (typeof targetPath !== "string" || targetPath.length === 0) {
@@ -18678,21 +19728,21 @@ function validateHomePath(targetPath) {
 function resolvePath(rawPath, homeDir, pathMapper) {
   validateHomePath(rawPath);
   const expanded = expandHome(rawPath, homeDir);
-  const canonicalHome = path16.resolve(homeDir);
-  const canonicalExpanded = path16.resolve(expanded);
-  const relative = path16.relative(canonicalHome, canonicalExpanded);
-  if (relative === ".." || relative.startsWith(`..${path16.sep}`) || path16.isAbsolute(relative)) {
+  const canonicalHome = path17.resolve(homeDir);
+  const canonicalExpanded = path17.resolve(expanded);
+  const relative = path17.relative(canonicalHome, canonicalExpanded);
+  if (relative === ".." || relative.startsWith(`..${path17.sep}`) || path17.isAbsolute(relative)) {
     throw new Error(`Target path resolves outside home directory: "${rawPath}"`);
   }
   if (!pathMapper) {
     return canonicalExpanded;
   }
-  const rawDirectory = path16.dirname(expanded);
+  const rawDirectory = path17.dirname(expanded);
   const mappedDirectory = pathMapper.mapTargetDirectory({
     targetDirectory: rawDirectory
   });
-  const filename = path16.basename(expanded);
-  return filename.length === 0 ? mappedDirectory : path16.join(mappedDirectory, filename);
+  const filename = path17.basename(expanded);
+  return filename.length === 0 ? mappedDirectory : path17.join(mappedDirectory, filename);
 }
 
 // ../config-mutations/src/error-codes.ts
@@ -18704,9 +19754,9 @@ function hasOwnErrorCode5(error3, code) {
 function isNotFound(error3) {
   return hasOwnErrorCode5(error3, "ENOENT");
 }
-async function readFileIfExists(fs4, target) {
+async function readFileIfExists(fs5, target) {
   try {
-    return await fs4.readFile(target, "utf8");
+    return await fs5.readFile(target, "utf8");
   } catch (error3) {
     if (isNotFound(error3)) {
       return null;
@@ -18714,9 +19764,9 @@ async function readFileIfExists(fs4, target) {
     throw error3;
   }
 }
-async function pathExists(fs4, target) {
+async function pathExists(fs5, target) {
   try {
-    await fs4.stat(target);
+    await fs5.stat(target);
     return true;
   } catch (error3) {
     if (isNotFound(error3)) {
@@ -18762,8 +19812,8 @@ function isAlreadyExists(error3) {
   return hasOwnErrorCode5(error3, "EEXIST");
 }
 async function assertRegularWriteTarget(context, targetPath) {
-  const boundary = path17.dirname(path17.resolve(context.homeDir));
-  let currentPath = path17.resolve(targetPath);
+  const boundary = path18.dirname(path18.resolve(context.homeDir));
+  let currentPath = path18.resolve(targetPath);
   while (currentPath !== boundary) {
     try {
       if ((await context.fs.lstat(currentPath)).isSymbolicLink()) {
@@ -18774,7 +19824,7 @@ async function assertRegularWriteTarget(context, targetPath) {
         throw error3;
       }
     }
-    const parentPath = path17.dirname(currentPath);
+    const parentPath = path18.dirname(currentPath);
     if (parentPath === currentPath) {
       return;
     }
@@ -18839,6 +19889,56 @@ function describeMutation(kind, targetPath) {
       return "Operation";
   }
 }
+function mutationTargetPath(mutation, options) {
+  switch (mutation.kind) {
+    case "ensureDirectory":
+    case "removeDirectory":
+      return resolveValue(mutation.path, options);
+    case "removeFile":
+    case "chmod":
+    case "backup":
+    case "restoreBackup":
+    case "configMerge":
+    case "configPrune":
+    case "configTransform":
+    case "templateWrite":
+    case "templateMergeToml":
+    case "templateMergeJson":
+      return resolveValue(mutation.target, options);
+    default:
+      return void 0;
+  }
+}
+function resolveMutationDetails(mutation, context, options) {
+  try {
+    const rawTarget = mutationTargetPath(mutation, options);
+    if (rawTarget === void 0) {
+      return {
+        kind: mutation.kind,
+        label: mutation.label ?? mutation.kind
+      };
+    }
+    try {
+      const targetPath = resolvePath(rawTarget, context.homeDir, context.pathMapper);
+      return {
+        kind: mutation.kind,
+        label: mutation.label ?? describeMutation(mutation.kind, targetPath),
+        targetPath
+      };
+    } catch {
+      return {
+        kind: mutation.kind,
+        label: mutation.label ?? describeMutation(mutation.kind, rawTarget),
+        targetPath: void 0
+      };
+    }
+  } catch {
+    return {
+      kind: mutation.kind,
+      label: mutation.label ?? mutation.kind
+    };
+  }
+}
 function pruneKeysByPrefix(table, prefix) {
   const result = {};
   for (const [key2, value] of Object.entries(table)) {
@@ -18929,6 +20029,7 @@ async function applyEnsureDirectory(mutation, context, options) {
     label: mutation.label ?? describeMutation(mutation.kind, targetPath),
     targetPath
   };
+  await assertRegularWriteTarget(context, targetPath);
   const existed = await pathExists(context.fs, targetPath);
   if (!context.dryRun) {
     await context.fs.mkdir(targetPath, { recursive: true });
@@ -19045,6 +20146,7 @@ async function applyChmod(mutation, context, options) {
     };
   }
   try {
+    await assertRegularWriteTarget(context, targetPath);
     const stat2 = await context.fs.stat(targetPath);
     const currentMode = typeof stat2.mode === "number" ? stat2.mode & 511 : null;
     if (currentMode === mutation.mode) {
@@ -19078,6 +20180,7 @@ async function applyBackup(mutation, context, options) {
     label: mutation.label ?? describeMutation(mutation.kind, targetPath),
     targetPath
   };
+  await assertRegularWriteTarget(context, targetPath);
   if (mutation.once && await findLatestGeneratedBackup(context.fs, targetPath) !== null) {
     return {
       outcome: { changed: false, effect: "none", detail: "noop" },
@@ -19144,13 +20247,13 @@ async function applyRestoreBackup(mutation, context, options) {
   }
   return { outcome: { changed: true, effect: "copy", detail: "restore" }, details };
 }
-async function findLatestGeneratedBackup(fs4, targetPath) {
+async function findLatestGeneratedBackup(fs5, targetPath) {
   const separatorIndex = targetPath.lastIndexOf("/");
   const directoryPath = separatorIndex <= 0 ? "/" : targetPath.slice(0, separatorIndex);
   const targetName = targetPath.slice(separatorIndex + 1);
   let entries;
   try {
-    entries = await fs4.readdir(directoryPath);
+    entries = await fs5.readdir(directoryPath);
   } catch (error3) {
     if (isNotFound(error3)) {
       return null;
@@ -19214,6 +20317,9 @@ async function applyConfigMerge(mutation, context, options) {
     preserveContent = null;
   }
   const value = resolveValue(mutation.value, options);
+  if (!isConfigObject4(value)) {
+    throw new Error(`configMerge value must be an object for "${rawPath}".`);
+  }
   let merged;
   if (mutation.pruneByPrefix) {
     merged = mergeWithPruneByPrefix(current, value, mutation.pruneByPrefix);
@@ -19347,6 +20453,13 @@ async function applyConfigTransform(mutation, context, options) {
     };
   }
   const serialized = serializeConfigUpdate(format, preserveContent, current, transformed);
+  const serializedChanged = serialized !== rawContent;
+  if (!serializedChanged) {
+    return {
+      outcome: { changed: false, effect: "none", detail: "noop" },
+      details
+    };
+  }
   if (!context.dryRun) {
     await writeAtomically2(context, targetPath, serialized);
   }
@@ -19463,25 +20576,14 @@ async function runMutations(mutations, context, options) {
   };
 }
 async function executeMutation(mutation, context, options) {
-  context.observers?.onStart?.({
-    kind: mutation.kind,
-    label: mutation.label ?? mutation.kind,
-    targetPath: void 0
-    // Will be resolved during apply
-  });
+  const pendingDetails = resolveMutationDetails(mutation, context, options);
+  context.observers?.onStart?.(pendingDetails);
   try {
     const { outcome, details } = await applyMutation(mutation, context, options);
     context.observers?.onComplete?.(details, outcome);
     return { outcome, details };
   } catch (error3) {
-    context.observers?.onError?.(
-      {
-        kind: mutation.kind,
-        label: mutation.label ?? mutation.kind,
-        targetPath: void 0
-      },
-      error3
-    );
+    context.observers?.onError?.(pendingDetails, error3);
     throw error3;
   }
 }
@@ -19492,8 +20594,8 @@ function hasOwnErrorCode6(error3, code) {
 }
 
 // ../agent-skill-config/src/templates.ts
-import { readFile as readFile5, stat } from "node:fs/promises";
-import path18 from "node:path";
+import { readFile as readFile6, stat } from "node:fs/promises";
+import path19 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../agent-skill-config/src/apply.ts
@@ -19510,9 +20612,9 @@ function toHomeRelative(localSkillDir) {
   const normalized = localSkillDir.startsWith("./") ? localSkillDir.slice(2) : localSkillDir;
   return `~/${normalized}`;
 }
-async function pathExists2(fs4, targetPath) {
+async function pathExists2(fs5, targetPath) {
   try {
-    await fs4.stat(targetPath);
+    await fs5.stat(targetPath);
     return true;
   } catch (error3) {
     if (hasOwnErrorCode6(error3, "ENOENT")) {
@@ -19529,7 +20631,7 @@ async function installSkill(agentId, skill, options) {
   }
   const scope = options.scope ?? "local";
   const config2 = support.config;
-  if (skill.name.length === 0 || skill.name === "." || skill.name === ".." || skill.name.includes("/") || skill.name.includes("\\") || skill.name.includes("\n") || skill.name.includes("\r")) {
+  if (skill.name.length === 0 || skill.name !== skill.name.trim() || skill.name === "." || skill.name === ".." || skill.name.includes("/") || skill.name.includes("\\") || skill.name.includes("\n") || skill.name.includes("\r")) {
     throw new Error(`Invalid skill name: ${skill.name}`);
   }
   const skillDir = scope === "global" ? config2.globalSkillDir : toHomeRelative(config2.localSkillDir);
@@ -19565,29 +20667,29 @@ async function installSkill(agentId, skill, options) {
       }
     }
   );
-  return { skillPath: skillFilePath, displayPath };
+  return { skillPath: absoluteSkillPath, displayPath };
 }
 
 // ../agent-skill-config/src/resolve-skill-reference.ts
-import { statSync as statSync2 } from "node:fs";
-import path19 from "node:path";
+import * as fs2 from "node:fs";
+import path20 from "node:path";
 
 // ../agent-skill-config/src/git-exclude.ts
 import { execFileSync } from "node:child_process";
 import { randomUUID as randomUUID8 } from "node:crypto";
-import * as fs2 from "node:fs";
-import path20 from "node:path";
+import * as fs3 from "node:fs";
+import path21 from "node:path";
 
 // ../agent-skill-config/src/bridge-active-skills.ts
-import * as fs3 from "node:fs";
+import * as fs4 from "node:fs";
 import { createHash as createHash4, randomUUID as randomUUID9 } from "node:crypto";
-import path21 from "node:path";
+import path22 from "node:path";
 
 // src/commands/installer.ts
 import os3 from "node:os";
-import path22 from "node:path";
+import path23 from "node:path";
 import * as nodeFs2 from "node:fs/promises";
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 var DEFAULT_INSTALL_AGENT = "claude-code";
 var DEFAULT_INSTALL_SCOPE = "local";
 var TERMINAL_PILOT_SKILL_NAME = "terminal-pilot";
@@ -19637,7 +20739,7 @@ async function loadTerminalPilotTemplate() {
   ];
   for (const candidate of candidates) {
     try {
-      terminalPilotTemplateCache = await readFile6(candidate, "utf8");
+      terminalPilotTemplateCache = await readFile7(candidate, "utf8");
       return terminalPilotTemplateCache;
     } catch (error3) {
       if (!isNotFoundError2(error3)) {
@@ -19652,7 +20754,7 @@ function resolveHomeRelativePath(targetPath, homeDir) {
     return homeDir;
   }
   if (targetPath.startsWith("~/")) {
-    return path22.join(homeDir, targetPath.slice(2));
+    return path23.join(homeDir, targetPath.slice(2));
   }
   return targetPath;
 }
@@ -19662,22 +20764,22 @@ function getSkillFolderWithHome(agent, scope, cwd, homeDir) {
     throwUnsupportedAgent(agent);
   }
   return {
-    displayPath: path22.join(
+    displayPath: path23.join(
       scope === "global" ? config2.globalSkillDir : config2.localSkillDir,
       TERMINAL_PILOT_SKILL_NAME
     ),
-    fullPath: path22.join(
-      scope === "global" ? resolveHomeRelativePath(config2.globalSkillDir, homeDir) : path22.resolve(cwd, config2.localSkillDir),
+    fullPath: path23.join(
+      scope === "global" ? resolveHomeRelativePath(config2.globalSkillDir, homeDir) : path23.resolve(cwd, config2.localSkillDir),
       TERMINAL_PILOT_SKILL_NAME
     )
   };
 }
-async function assertNoSymbolicLinkPath(fs4, targetPath) {
-  const rootPath = path22.parse(targetPath).root;
+async function assertNoSymbolicLinkPath(fs5, targetPath) {
+  const rootPath = path23.parse(targetPath).root;
   let currentPath = targetPath;
   while (currentPath !== rootPath) {
     try {
-      if ((await fs4.lstat(currentPath)).isSymbolicLink()) {
+      if ((await fs5.lstat(currentPath)).isSymbolicLink()) {
         throw new UserError(`Refusing terminal-pilot skill operation through symbolic link: ${currentPath}`);
       }
     } catch (error3) {
@@ -19685,7 +20787,7 @@ async function assertNoSymbolicLinkPath(fs4, targetPath) {
         throw error3;
       }
     }
-    currentPath = path22.dirname(currentPath);
+    currentPath = path23.dirname(currentPath);
   }
 }
 
@@ -20384,11 +21486,11 @@ import { Resvg } from "@resvg/resvg-js";
 
 // ../terminal-png/src/font.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
+import { createRequire as createRequire3 } from "node:module";
 import { dirname as dirname2, join as join2 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-var require2 = createRequire2(import.meta.url);
-var fontPackageRoot = dirname2(require2.resolve("jetbrains-mono/package.json"));
+var require3 = createRequire3(import.meta.url);
+var fontPackageRoot = dirname2(require3.resolve("jetbrains-mono/package.json"));
 var webfontRoot = join2(fontPackageRoot, "fonts/webfonts");
 function readWebfontBase64(filename) {
   return readFileSync4(join2(webfontRoot, filename)).toString("base64");
@@ -21098,9 +22200,9 @@ var uninstall = defineCommand({
     };
   }
 });
-async function folderExists(fs4, folderPath) {
+async function folderExists(fs5, folderPath) {
   try {
-    await fs4.stat(folderPath);
+    await fs5.stat(folderPath);
     return true;
   } catch (error3) {
     if (hasOwnErrorCode4(error3, "ENOENT")) {
@@ -21245,7 +22347,7 @@ async function isDirectExecution(argv) {
   try {
     const modulePath = fileURLToPath5(import.meta.url);
     const [resolvedEntryPoint, resolvedModulePath] = await Promise.all([
-      realpath3(path23.resolve(entryPoint)),
+      realpath3(path24.resolve(entryPoint)),
       realpath3(modulePath)
     ]);
     return resolvedEntryPoint === resolvedModulePath;