zelari-code 1.23.0 → 1.25.0

package/dist/cli/main.bundled.js

@@ -4,6 +4,12 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -21,6 +27,87 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/cli/modelPricing.ts
+function envOverride(model) {
+  const key = `ANATHEMA_PRICE_${model.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+  const raw = process.env[key] ?? process.env.ANATHEMA_PRICE_DEFAULT;
+  return parseRateOverride(raw);
+}
+function parseRateOverride(raw) {
+  if (!raw) return null;
+  const [inStr, outStr] = raw.split("/");
+  const input = Number.parseFloat(inStr);
+  const output = outStr !== void 0 ? Number.parseFloat(outStr) : input;
+  if (!Number.isFinite(input) || !Number.isFinite(output)) return null;
+  return { input, output };
+}
+function getModelRate(model) {
+  if (!model) return DEFAULT_RATE;
+  return envOverride(model) ?? PRICES_PER_MILLION[model] ?? DEFAULT_RATE;
+}
+function calculateCost(model, promptTokens, completionTokens, cachedPromptTokens = 0) {
+  if (!Number.isFinite(promptTokens) || promptTokens < 0) return 0;
+  if (!Number.isFinite(completionTokens) || completionTokens < 0) return 0;
+  const rate = getModelRate(model);
+  const cached2 = Number.isFinite(cachedPromptTokens) && cachedPromptTokens > 0 ? Math.min(cachedPromptTokens, promptTokens) : 0;
+  const uncachedPrompt = promptTokens - cached2;
+  const cachedRate = rate.cachedInput ?? rate.input * DEFAULT_CACHE_DISCOUNT;
+  const inputCost = uncachedPrompt / 1e6 * rate.input + cached2 / 1e6 * cachedRate;
+  const outputCost = completionTokens / 1e6 * rate.output;
+  return Number((inputCost + outputCost).toFixed(6));
+}
+function formatCost(usd) {
+  if (!Number.isFinite(usd) || usd < 0) return "$0.0000";
+  if (usd === 0) return "$0.0000";
+  if (usd < 1e-4) return "<$0.0001";
+  return `$${usd.toFixed(4)}`;
+}
+function formatTokens(tokens) {
+  if (!Number.isFinite(tokens) || tokens < 0) return "0";
+  if (tokens < 1e3) return `${tokens}`;
+  if (tokens < 1e6) return `${(tokens / 1e3).toFixed(1)}k`;
+  if (tokens < 1e9) return `${(tokens / 1e6).toFixed(2)}M`;
+  return `${(tokens / 1e9).toFixed(2)}B`;
+}
+var PRICES_PER_MILLION, DEFAULT_RATE, DEFAULT_CACHE_DISCOUNT;
+var init_modelPricing = __esm({
+  "src/cli/modelPricing.ts"() {
+    "use strict";
+    PRICES_PER_MILLION = {
+      // xAI Grok (list prices; grok-4.5 default reasoning_effort is "high")
+      "grok-4.5": { input: 2, output: 6, cachedInput: 0.5 },
+      "grok-4.3": { input: 1.25, output: 2.5, cachedInput: 0.2 },
+      "grok-4": { input: 3, output: 15 },
+      "grok-4-fast": { input: 0.2, output: 0.5 },
+      "grok-3": { input: 3, output: 15 },
+      "grok-3-mini": { input: 0.3, output: 0.5 },
+      "grok-2-vision": { input: 2, output: 10 },
+      // GLM / Z.AI
+      "glm-4.6": { input: 0.6, output: 2.2 },
+      "glm-4.5": { input: 0.5, output: 2 },
+      "glm-4.5-air": { input: 0.1, output: 0.6 },
+      "glm-z1": { input: 0.5, output: 2 },
+      // MiniMax
+      "MiniMax-M2.5": { input: 0.2, output: 1.1 },
+      "MiniMax-M2": { input: 0.2, output: 1.1 },
+      "MiniMax-M2-her": { input: 0.3, output: 1.2 },
+      // DeepSeek (global platform) — estimated list prices; override via
+      // ANATHEMA_PRICE_DEEPSEEK_V4_FLASH / ANATHEMA_PRICE_DEEPSEEK_V4_PRO.
+      // DeepSeek prompt-cache hits are ~10× cheaper than a cache miss.
+      "deepseek-v4-flash": { input: 0.14, output: 0.28, cachedInput: 0.014 },
+      "deepseek-v4-pro": { input: 0.55, output: 2.19, cachedInput: 0.055 },
+      // OpenAI (for openai-compatible fallback)
+      "gpt-4o": { input: 2.5, output: 10 },
+      "gpt-4o-mini": { input: 0.15, output: 0.6 },
+      "gpt-4-turbo": { input: 10, output: 30 },
+      "o1-preview": { input: 15, output: 60 },
+      "o1-mini": { input: 3, output: 12 }
+    };
+    DEFAULT_RATE = { input: 1, output: 3 };
+    DEFAULT_CACHE_DISCOUNT = 0.25;
+  }
+});
+
 // src/cli/grokOAuth.ts
 var grokOAuth_exports = {};
 __export(grokOAuth_exports, {
@@ -308,7 +395,7 @@ async function refreshGrokToken(options) {
   return parseTokenResponseBody(obj, accessToken);
 }
 async function openBrowser(url2) {
-  const { spawn: spawn11 } = await import("node:child_process");
+  const { spawn: spawn12 } = await import("node:child_process");
   const cmd = (() => {
     switch (process.platform) {
       case "darwin":
@@ -319,18 +406,18 @@ async function openBrowser(url2) {
         return { bin: "xdg-open", args: [url2] };
     }
   })();
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     try {
-      const child = spawn11(cmd.bin, cmd.args, {
+      const child = spawn12(cmd.bin, cmd.args, {
         stdio: "ignore",
         detached: true
       });
       child.on("error", (err) => reject(err));
       child.on("spawn", () => {
         child.unref();
-        resolve();
+        resolve3();
       });
-      setTimeout(() => resolve(), 100);
+      setTimeout(() => resolve3(), 100);
     } catch (err) {
       reject(err);
     }
@@ -754,6 +841,180 @@ var init_providerConfig = __esm({
   }
 });
 
+// src/cli/modelDiscovery.ts
+import { promises as fs3, existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { homedir } from "node:os";
+import path4 from "node:path";
+async function resolveDiscoveryBaseUrl(provider, options) {
+  if (options.baseUrl) return options.baseUrl;
+  const { getCustomEndpoint: getCustomEndpoint2 } = await Promise.resolve().then(() => (init_providerConfig(), providerConfig_exports));
+  const custom2 = getCustomEndpoint2(provider);
+  if (custom2) return custom2;
+  if (provider === "openai-compatible") {
+    const envBase = process.env.OPENAI_BASE_URL;
+    if (envBase && envBase.trim().length > 0) return envBase;
+  }
+  return PROVIDER_BASE_URLS[provider];
+}
+function defaultModelsFilePath() {
+  return process.env.ANATHEMA_MODELS_FILE ?? path4.join(homedir(), ".tmp", "zelari-code", "models.json");
+}
+function getModelsFilePath() {
+  return defaultModelsFilePath();
+}
+function loadModelsRegistry(file2 = getModelsFilePath()) {
+  if (!existsSync3(file2)) return {};
+  try {
+    const raw = readFileSync3(file2, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function getCachedModels(provider, file2 = getModelsFilePath()) {
+  const registry3 = loadModelsRegistry(file2);
+  return registry3[provider];
+}
+function isModelsCacheStale(provider, maxAgeMs = 6 * 60 * 60 * 1e3, file2 = getModelsFilePath(), now = Date.now()) {
+  const entry = getCachedModels(provider, file2);
+  if (!entry) return true;
+  return now - entry.fetchedAt > maxAgeMs;
+}
+async function withRegistryLock(fn) {
+  const next = writeChain.then(async () => fn());
+  writeChain = next.catch(() => void 0);
+  return next;
+}
+async function readModifyWriteRegistry(mutator, file2 = getModelsFilePath()) {
+  return withRegistryLock(async () => {
+    const onDisk = loadModelsRegistry(file2);
+    const merged = mutator(onDisk);
+    await fs3.mkdir(path4.dirname(file2), { recursive: true });
+    const tmp = `${file2}.tmp-${process.pid}-${Date.now()}`;
+    await fs3.writeFile(tmp, JSON.stringify(merged, null, 2), "utf-8");
+    await fs3.rename(tmp, file2);
+    return merged;
+  });
+}
+async function resolveAuthToken(provider, options) {
+  if (options.authToken) return options.authToken;
+  const { resolveApiKeyWithMeta: resolveApiKeyWithMeta2, getOAuthToken: getOAuthToken2 } = await Promise.resolve().then(() => (init_keyStore(), keyStore_exports));
+  if (provider === "grok") {
+    const oauth = getOAuthToken2("grok");
+    if (oauth?.apiKey) return oauth.apiKey;
+  }
+  const resolved = await resolveApiKeyWithMeta2(provider);
+  return resolved?.apiKey;
+}
+function parseOpenAIModelsResponse(json2, baseUrl) {
+  if (!json2 || typeof json2 !== "object") return [];
+  const obj = json2;
+  if (!Array.isArray(obj.data)) return [];
+  const models = [];
+  for (const m of obj.data) {
+    if (!m || typeof m.id !== "string") continue;
+    const out = { id: m.id };
+    if (typeof m.created === "number") out.created = m.created;
+    if (typeof m.owned_by === "string") out.ownedBy = m.owned_by;
+    const ctx = m.context_length;
+    if (typeof ctx === "number") out.contextLength = ctx;
+    models.push(out);
+  }
+  models.sort((a, b) => a.id.localeCompare(b.id));
+  return models;
+}
+async function discoverModelsForProvider(provider, options = {}) {
+  const baseUrl = await resolveDiscoveryBaseUrl(provider, options);
+  if (!baseUrl || baseUrl.trim().length === 0) {
+    throw new ModelDiscoveryError(
+      `No base URL for provider "${provider}" \u2014 set one with /provider custom <url> before discovering models`,
+      "no_base_url"
+    );
+  }
+  const url2 = `${baseUrl.replace(/\/$/, "")}/models`;
+  const authToken = await resolveAuthToken(provider, options);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let response;
+  try {
+    const headers = { Accept: "application/json" };
+    if (authToken) headers.Authorization = `Bearer ${authToken}`;
+    response = await fetchImpl(url2, { method: "GET", headers });
+  } catch (err) {
+    throw new ModelDiscoveryError(
+      `Network error contacting ${url2}: ${err instanceof Error ? err.message : String(err)}`,
+      "network_error"
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new ModelDiscoveryError(
+      `HTTP ${response.status} from ${url2}: ${body.slice(0, 200)}`,
+      `http_${response.status}`
+    );
+  }
+  let json2;
+  try {
+    json2 = await response.json();
+  } catch (err) {
+    throw new ModelDiscoveryError(
+      `Invalid JSON from ${url2}: ${err instanceof Error ? err.message : String(err)}`,
+      "invalid_json"
+    );
+  }
+  const models = parseOpenAIModelsResponse(json2, baseUrl);
+  if (models.length === 0) {
+    throw new ModelDiscoveryError(
+      `Provider ${provider} returned 0 models \u2014 refusing to overwrite cache`,
+      "empty_response"
+    );
+  }
+  const entry = {
+    models,
+    fetchedAt: Date.now(),
+    baseUrl
+  };
+  if (!options.skipCacheWrite) {
+    const file2 = getModelsFilePath();
+    await readModifyWriteRegistry((current) => {
+      current[provider] = entry;
+      return current;
+    }, file2);
+  }
+  return entry;
+}
+function discoverModelsInBackground(provider, options = {}) {
+  discoverModelsForProvider(provider, options).catch((err) => {
+    if (err instanceof ModelDiscoveryError && options.onError) {
+      options.onError(err);
+    }
+  });
+}
+var PROVIDER_BASE_URLS, writeChain, ModelDiscoveryError;
+var init_modelDiscovery = __esm({
+  "src/cli/modelDiscovery.ts"() {
+    "use strict";
+    PROVIDER_BASE_URLS = {
+      "grok": "https://api.x.ai/v1",
+      // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
+      "glm": "https://api.z.ai/api/coding/paas/v4",
+      "minimax": "https://api.minimax.io/v1",
+      // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
+      "deepseek": "https://api.deepseek.com",
+      "openai-compatible": "https://api.x.ai/v1"
+    };
+    writeChain = Promise.resolve();
+    ModelDiscoveryError = class extends Error {
+      constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "ModelDiscoveryError";
+      }
+    };
+  }
+});
+
 // packages/core/dist/agents/skills.js
 function getSkillsByCategory(cat) {
   return SKILL_CATALOG.filter((s) => s.category === cat);
@@ -1543,10 +1804,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path38) {
-  if (!path38)
+function getElementAtPath(obj, path40) {
+  if (!path40)
     return obj;
-  return path38.reduce((acc, key) => acc?.[key], obj);
+  return path40.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1874,11 +2135,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path38, issues) {
+function prefixIssues(path40, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path38);
+    iss.path.unshift(path40);
     return iss;
   });
 }
@@ -2096,16 +2357,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path38 = []) => {
+  const processError = (error52, path40 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path38, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path40, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else {
-        const fullpath = [...path38, ...issue2.path];
+        const fullpath = [...path40, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -2132,17 +2393,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path38 = []) => {
+  const processError = (error52, path40 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path38, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path40, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else {
-        const fullpath = [...path38, ...issue2.path];
+        const fullpath = [...path40, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -2174,8 +2435,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path38 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path38) {
+  const path40 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path40) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -15678,13 +15939,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path38 = ref.slice(1).split("/").filter(Boolean);
-  if (path38.length === 0) {
+  const path40 = ref.slice(1).split("/").filter(Boolean);
+  if (path40.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path38[0] === defsKey) {
-    const key = path38[1];
+  if (path40[0] === defsKey) {
+    const key = path40[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -16737,12 +16998,12 @@ function withNodeDirOnPath(base) {
     const nodeDir = dirname(process.execPath);
     if (!nodeDir)
       return env;
-    const sep = process.platform === "win32" ? ";" : ":";
+    const sep2 = process.platform === "win32" ? ";" : ":";
     const current = env.PATH ?? env.Path ?? "";
-    const parts = current.split(sep).filter((p3) => p3.length > 0);
+    const parts = current.split(sep2).filter((p3) => p3.length > 0);
     const has = parts.some((p3) => p3.toLowerCase() === nodeDir.toLowerCase());
     if (!has) {
-      env.PATH = `${nodeDir}${sep}${current}`;
+      env.PATH = `${nodeDir}${sep2}${current}`;
     }
   } catch {
   }
@@ -16769,7 +17030,7 @@ var init_shell = __esm({
       timeoutMs: 6e4,
       inputSchema: BashArgsSchema,
       execute: async (args, ctx) => {
-        return new Promise((resolve) => {
+        return new Promise((resolve3) => {
           const start = Date.now();
           const cwd = args.cwd ?? ctx.cwd;
           const resolved = resolveShell();
@@ -16817,14 +17078,14 @@ var init_shell = __esm({
           });
           const timer = setTimeout(() => {
             child.kill("SIGTERM");
-            resolve(typedErr(`Bash command timed out after ${args.timeoutMs}ms. If it was waiting for interactive input: stdin is closed \u2014 pass non-interactive flags or create the files directly instead of retrying.`));
+            resolve3(typedErr(`Bash command timed out after ${args.timeoutMs}ms. If it was waiting for interactive input: stdin is closed \u2014 pass non-interactive flags or create the files directly instead of retrying.`));
           }, args.timeoutMs);
           child.on("close", (code) => {
             clearTimeout(timer);
             const cappedStdout = stdout.slice(0, maxBuffer);
             const cappedStderr = stderr.slice(0, maxBuffer);
             const interactive = INTERACTIVE_CANCEL_RE.test(cappedStdout) || INTERACTIVE_CANCEL_RE.test(cappedStderr);
-            resolve(typedOk({
+            resolve3(typedOk({
               stdout: cappedStdout,
               stderr: cappedStderr,
               exitCode: code ?? -1,
@@ -16835,7 +17096,7 @@ var init_shell = __esm({
           });
           child.on("error", (err) => {
             clearTimeout(timer);
-            resolve(typedErr(err.message));
+            resolve3(typedErr(err.message));
           });
         });
       }
@@ -17848,11 +18109,11 @@ var init_tools = __esm({
           if (!ctx.addDocument)
             return "Knowledge vault tool not available.";
           const title = args["title"] || "New Document";
-          const path38 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+          const path40 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
           const content = args["content"] || "";
           const tags = args["tags"] || [];
           ctx.addDocument({
-            path: path38,
+            path: path40,
             title,
             content,
             format: "markdown",
@@ -17861,7 +18122,7 @@ var init_tools = __esm({
             workspaceId: ctx.workspaceId
           });
           ctx.addActivity("vault", "created document", title);
-          return `Document "${title}" created at "${path38}".`;
+          return `Document "${title}" created at "${path40}".`;
         }
       }
     ];
@@ -20548,8 +20809,8 @@ function wrapLegacyStream(legacyStream, params, _messages, _tools) {
       }
       if (done)
         break;
-      await new Promise((resolve) => {
-        resolveNext = resolve;
+      await new Promise((resolve3) => {
+        resolveNext = resolve3;
       });
     }
     await promise2;
@@ -20668,19 +20929,60 @@ __export(openai_compatible_exports, {
   resolveBaseUrl: () => resolveBaseUrl
 });
 function abortableSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) return resolve();
-    const t = setTimeout(resolve, ms);
+  return new Promise((resolve3) => {
+    if (signal?.aborted) return resolve3();
+    const t = setTimeout(resolve3, ms);
     signal?.addEventListener(
       "abort",
       () => {
         clearTimeout(t);
-        resolve();
+        resolve3();
       },
       { once: true }
     );
   });
 }
+function isTimeoutAbortMessage(msg) {
+  const m = msg.toLowerCase();
+  return m.includes("aborted due to timeout") || m.includes("timeout") || m.includes("the operation was aborted");
+}
+async function readChunkWithTimeout(reader, opts) {
+  if (opts.signal?.aborted) {
+    throw new Error("aborted");
+  }
+  const remaining = opts.deadlineMs - Date.now();
+  if (remaining <= 0) {
+    throw new Error(
+      `Provider stream exceeded max duration (${Math.round(PROVIDER_STREAM_MAX_MS / 1e3)}s). Raise ZELARI_PROVIDER_STREAM_MAX_MS if needed.`
+    );
+  }
+  const waitMs = Math.min(opts.idleMs, remaining);
+  let idleTimer;
+  let onAbort;
+  try {
+    return await Promise.race([
+      reader.read(),
+      new Promise((_, reject) => {
+        idleTimer = setTimeout(() => {
+          reject(
+            new Error(
+              `Provider stream idle for ${Math.round(waitMs / 1e3)}s (no tokens). The model/gateway stalled \u2014 try again or switch model. Override with ZELARI_PROVIDER_STREAM_IDLE_MS.`
+            )
+          );
+        }, waitMs);
+        if (opts.signal) {
+          onAbort = () => reject(new Error("aborted"));
+          opts.signal.addEventListener("abort", onAbort, { once: true });
+        }
+      })
+    ]);
+  } finally {
+    if (idleTimer) clearTimeout(idleTimer);
+    if (onAbort && opts.signal) {
+      opts.signal.removeEventListener("abort", onAbort);
+    }
+  }
+}
 function backoffDelay(attempt, retryAfterHeader) {
   if (retryAfterHeader) {
     const seconds = Number.parseFloat(retryAfterHeader);
@@ -20782,31 +21084,46 @@ function openaiCompatibleProvider(config2) {
         return;
       }
       try {
-        const timeoutSignal = AbortSignal.timeout(PROVIDER_TIMEOUT_MS);
-        const fetchSignal = params.signal ? AbortSignal.any([params.signal, timeoutSignal]) : timeoutSignal;
-        response = await fetch(`${config2.baseUrl}/chat/completions`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${config2.apiKey}`
-          },
-          body: JSON.stringify(body),
-          // Use `params.signal` (per-call AbortSignal from AgentHarness
-          // controller) so `.cancel()` actually aborts the HTTP request.
-          // `config.signal` is the factory-level signal, typically undefined.
-          // v0.6.0 audit HIGH-2.
-          // v1.10.0: also apply PROVIDER_TIMEOUT_MS so a stalled connection
-          // can't hang the harness forever.
-          signal: fetchSignal
-        });
+        const connectController = new AbortController();
+        const connectTimer = setTimeout(() => {
+          connectController.abort(
+            new Error(
+              `Provider connect timeout after ${Math.round(PROVIDER_CONNECT_TIMEOUT_MS / 1e3)}s (no response headers). Override ZELARI_PROVIDER_CONNECT_TIMEOUT_MS.`
+            )
+          );
+        }, PROVIDER_CONNECT_TIMEOUT_MS);
+        const signals = [connectController.signal];
+        if (params.signal) signals.push(params.signal);
+        const fetchSignal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+        try {
+          response = await fetch(`${config2.baseUrl}/chat/completions`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${config2.apiKey}`
+            },
+            body: JSON.stringify(body),
+            // Cancel aborts the HTTP request; stream idle is enforced below
+            // per-chunk so active multi-minute streams are not killed.
+            signal: fetchSignal
+          });
+        } finally {
+          clearTimeout(connectTimer);
+        }
       } catch (err) {
         lastStatus = 0;
-        lastErrText = err instanceof Error ? err.message : String(err);
+        const asErr = err instanceof Error ? err : null;
+        const causeMsg = asErr?.cause instanceof Error ? asErr.cause.message : typeof asErr?.cause === "string" ? String(asErr.cause) : "";
+        lastErrText = (causeMsg && causeMsg.includes("Provider connect") ? causeMsg : null) || asErr?.message || String(err);
+        if (isTimeoutAbortMessage(lastErrText) && !lastErrText.includes("Provider connect")) {
+          lastErrText = `Provider connect timeout after ${Math.round(PROVIDER_CONNECT_TIMEOUT_MS / 1e3)}s (no response headers). Last error: ${lastErrText}`;
+        }
         if (params.signal?.aborted) {
           yield { kind: "error", message: "aborted" };
           return;
         }
-        if (attempt < MAX_RETRIES) {
+        const maxAttempts = isTimeoutAbortMessage(lastErrText) ? Math.min(1, MAX_RETRIES) : MAX_RETRIES;
+        if (attempt < maxAttempts) {
           await abortableSleep(backoffDelay(attempt, null), params.signal);
           continue;
         }
@@ -20861,9 +21178,30 @@ function openaiCompatibleProvider(config2) {
       }
       toolCallAccumulator.clear();
     };
+    const streamDeadline = Date.now() + PROVIDER_STREAM_MAX_MS;
     try {
       while (true) {
-        const { value, done } = await reader.read();
+        let chunk;
+        try {
+          chunk = await readChunkWithTimeout(reader, {
+            idleMs: PROVIDER_STREAM_IDLE_MS,
+            deadlineMs: streamDeadline,
+            signal: params.signal
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (msg === "aborted" || params.signal?.aborted) {
+            yield { kind: "error", message: "aborted" };
+            return;
+          }
+          try {
+            await reader.cancel(msg);
+          } catch {
+          }
+          yield { kind: "error", message: msg };
+          return;
+        }
+        const { value, done } = chunk;
         if (done) break;
         buffer += decoder.decode(value, { stream: true });
         const lines = buffer.split("\n");
@@ -20989,7 +21327,7 @@ async function providerConfigFor(providerId) {
     providerId
   };
 }
-var RETRYABLE_STATUSES, MAX_RETRIES, BACKOFF_BASE_MS, BACKOFF_CAP_MS, PROVIDER_TIMEOUT_MS, PROVIDER_ENDPOINTS;
+var RETRYABLE_STATUSES, MAX_RETRIES, BACKOFF_BASE_MS, BACKOFF_CAP_MS, PROVIDER_CONNECT_TIMEOUT_MS, PROVIDER_STREAM_IDLE_MS, PROVIDER_STREAM_MAX_MS, PROVIDER_ENDPOINTS;
 var init_openai_compatible = __esm({
   "src/cli/provider/openai-compatible.ts"() {
     "use strict";
@@ -21003,10 +21341,20 @@ var init_openai_compatible = __esm({
     })();
     BACKOFF_BASE_MS = 500;
     BACKOFF_CAP_MS = 8e3;
-    PROVIDER_TIMEOUT_MS = (() => {
-      const raw = process.env.ZELARI_PROVIDER_TIMEOUT_MS;
+    PROVIDER_CONNECT_TIMEOUT_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_CONNECT_TIMEOUT_MS;
+      const n = raw ? Number.parseInt(raw, 10) : 9e4;
+      return Number.isFinite(n) && n >= 5e3 ? n : 9e4;
+    })();
+    PROVIDER_STREAM_IDLE_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_STREAM_IDLE_MS ?? process.env.ZELARI_PROVIDER_TIMEOUT_MS;
       const n = raw ? Number.parseInt(raw, 10) : 3e5;
-      return Number.isFinite(n) && n >= 1e4 ? n : 3e5;
+      return Number.isFinite(n) && n >= 15e3 ? n : 3e5;
+    })();
+    PROVIDER_STREAM_MAX_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_STREAM_MAX_MS;
+      const n = raw ? Number.parseInt(raw, 10) : 18e5;
+      return Number.isFinite(n) && n >= 6e4 ? n : 18e5;
     })();
     PROVIDER_ENDPOINTS = {
       "openai-compatible": "https://api.x.ai/v1",
@@ -21059,9 +21407,9 @@ function spillToolOutput(fullText, meta3) {
     const rnd = randomBytes(3).toString("hex");
     const safeTool = (meta3?.toolName ?? "tool").replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 32);
     const file2 = `${stamp}-${safeTool}-${hash3}-${rnd}.txt`;
-    const path38 = join(dir, file2);
-    writeFileSync5(path38, fullText, "utf8");
-    return path38;
+    const path40 = join(dir, file2);
+    writeFileSync5(path40, fullText, "utf8");
+    return path40;
   } catch {
     return null;
   }
@@ -21107,10 +21455,10 @@ function truncateToolResult(text, capOrOpts = TOOL_RESULT_LINE_CAP) {
 ${tail}`;
   }
   if (doSpill) {
-    const path38 = spillToolOutput(text, { toolName: opts.toolName });
-    if (path38) {
+    const path40 = spillToolOutput(text, { toolName: opts.toolName });
+    if (path40) {
       const spillNote = `
-\u2026 [full output spilled to: ${path38} \u2014 re-read with read_file if you need the complete text] \u2026`;
+\u2026 [full output spilled to: ${path40} \u2014 re-read with read_file if you need the complete text] \u2026`;
       if (preview.includes("] \u2026\n")) {
         preview = preview.replace("] \u2026\n", `] \u2026${spillNote}
 `);
@@ -21581,14 +21929,14 @@ var init_engine = __esm({
         parse: parseRuffJson
       }
     ];
-    defaultRunner = (cmd, args, opts) => new Promise((resolve) => {
+    defaultRunner = (cmd, args, opts) => new Promise((resolve3) => {
       let stdout = "";
       let stderr = "";
       let settled = false;
       const done = (r) => {
         if (settled) return;
         settled = true;
-        resolve(r);
+        resolve3(r);
       };
       let child;
       try {
@@ -22257,12 +22605,12 @@ var init_client = __esm({
         if (this.closed) return Promise.reject(new Error("LSP transport is closed"));
         const id = this.nextId++;
         const msg = { jsonrpc: "2.0", id, method, ...params !== void 0 ? { params } : {} };
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve3, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             reject(new Error(`LSP request "${method}" timed out after ${this.timeoutMs}ms`));
           }, this.timeoutMs);
-          this.pending.set(id, { resolve, reject, timer });
+          this.pending.set(id, { resolve: resolve3, reject, timer });
           this.transport.send(encodeMessage(msg));
         });
       }
@@ -22528,8 +22876,8 @@ var init_manager = __esm({
         if (cached2 !== void 0) return cached2;
         let resolveInit;
         let rejectInit;
-        const initialized = new Promise((resolve, reject) => {
-          resolveInit = resolve;
+        const initialized = new Promise((resolve3, reject) => {
+          resolveInit = resolve3;
           rejectInit = reject;
         });
         let entry = null;
@@ -23248,8 +23596,8 @@ async function runBrowserCheck(options, loader) {
   const failedRequests = [];
   const evaluateResults = [];
   const base = { ok: false, consoleErrors, pageErrors, failedRequests };
-  const resolve = loader ?? (() => loadPlaywright(options.cwd ?? process.cwd()));
-  const pw = await resolve();
+  const resolve3 = loader ?? (() => loadPlaywright(options.cwd ?? process.cwd()));
+  const pw = await resolve3();
   if (!pw) {
     return {
       ...base,
@@ -23542,21 +23890,21 @@ function normalizeAuth(auth) {
   return "agent";
 }
 function readSecrets() {
-  const path38 = getSshSecretsPath();
-  if (!existsSync11(path38)) return {};
+  const path40 = getSshSecretsPath();
+  if (!existsSync11(path40)) return {};
   try {
-    return JSON.parse(readFileSync8(path38, "utf8"));
+    return JSON.parse(readFileSync8(path40, "utf8"));
   } catch {
     return {};
   }
 }
 function writeSecrets(data) {
-  const path38 = getSshSecretsPath();
-  mkdirSync7(dirname2(path38), { recursive: true });
-  writeFileSync6(path38, `${JSON.stringify(data, null, 2)}
+  const path40 = getSshSecretsPath();
+  mkdirSync7(dirname2(path40), { recursive: true });
+  writeFileSync6(path40, `${JSON.stringify(data, null, 2)}
 `, "utf8");
   try {
-    chmodSync(path38, 384);
+    chmodSync(path40, 384);
   } catch {
   }
 }
@@ -23585,10 +23933,10 @@ function deleteSshPassword(id) {
   writeSecrets({ passwords });
 }
 function readStore2() {
-  const path38 = getSshTargetsPath();
-  if (!existsSync11(path38)) return [];
+  const path40 = getSshTargetsPath();
+  if (!existsSync11(path40)) return [];
   try {
-    const parsed = JSON.parse(readFileSync8(path38, "utf8"));
+    const parsed = JSON.parse(readFileSync8(path40, "utf8"));
     const list = Array.isArray(parsed.targets) ? parsed.targets : [];
     return list.filter(
       (t) => t && typeof t.id === "string" && typeof t.host === "string" && typeof t.user === "string"
@@ -23603,11 +23951,11 @@ function readStore2() {
   }
 }
 function writeStore2(targets) {
-  const path38 = getSshTargetsPath();
-  mkdirSync7(dirname2(path38), { recursive: true });
+  const path40 = getSshTargetsPath();
+  mkdirSync7(dirname2(path40), { recursive: true });
   const clean = targets.map(({ hasPassword: _hp, ...t }) => t);
   writeFileSync6(
-    path38,
+    path40,
     `${JSON.stringify({ targets: clean }, null, 2)}
 `,
     "utf8"
@@ -23741,9 +24089,9 @@ exec node "$(dirname "$0")/askpass.cjs"
   return sh;
 }
 function runSsh(target, remoteCommand, timeoutMs = 6e4) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     if (target.auth === "password" && !getSshPassword(target.id)) {
-      resolve({
+      resolve3({
         code: 1,
         stdout: "",
         stderr: "No password stored for this target \u2014 edit target and set password"
@@ -23775,7 +24123,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
     });
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
-      resolve({
+      resolve3({
         code: 124,
         stdout,
         stderr: stderr + "\n[ssh] timeout"
@@ -23783,7 +24131,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
     }, timeoutMs);
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve({
+      resolve3({
         code: 127,
         stdout,
         stderr: err.message.includes("ENOENT") ? "ssh not found on PATH \u2014 install OpenSSH client" : err.message
@@ -23791,7 +24139,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve({ code: code ?? 1, stdout, stderr });
+      resolve3({ code: code ?? 1, stdout, stderr });
     });
   });
 }
@@ -23853,11 +24201,11 @@ function formatSshTargetsForPrompt() {
   ];
   for (const t of targets) {
     const tags = t.tags?.length ? ` tags=[${t.tags.join(",")}]` : "";
-    const path38 = t.defaultRemotePath ? ` remotePath=${t.defaultRemotePath}` : "";
+    const path40 = t.defaultRemotePath ? ` remotePath=${t.defaultRemotePath}` : "";
     const allow = t.allowedCommands?.length ? ` allowed=${t.allowedCommands.join("|")}` : " allowed=status-only";
     const auth = t.auth === "password" ? " auth=password" : t.auth === "keyPath" ? " auth=key" : " auth=agent";
     lines.push(
-      `- id=${t.id} name=${t.name} ${t.user}@${t.host}:${t.port ?? 22}${auth}${path38}${tags}${allow}`
+      `- id=${t.id} name=${t.name} ${t.user}@${t.host}:${t.port ?? 22}${auth}${path40}${tags}${allow}`
     );
   }
   return lines.join("\n");
@@ -24010,7 +24358,7 @@ async function readChecks(cwd) {
   }
 }
 function runShell(command, cwd, timeoutMs, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const isWin = process.platform === "win32";
     const child = spawn5(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
       cwd,
@@ -24024,7 +24372,7 @@ function runShell(command, cwd, timeoutMs, signal) {
     const finish = (exitCode) => {
       if (settled) return;
       settled = true;
-      resolve({ exitCode, stdout, stderr });
+      resolve3({ exitCode, stdout, stderr });
     };
     const timer = setTimeout(() => {
       try {
@@ -25857,11 +26205,11 @@ var init_synthesisAudit = __esm({
 import { existsSync as existsSync13, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join6 } from "node:path";
 function loadNfrSpec(zelariRoot) {
-  const path38 = join6(zelariRoot, "nfr-spec.json");
-  if (!existsSync13(path38))
+  const path40 = join6(zelariRoot, "nfr-spec.json");
+  if (!existsSync13(path40))
     return null;
   try {
-    const raw = JSON.parse(readFileSync10(path38, "utf8"));
+    const raw = JSON.parse(readFileSync10(path40, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.targets))
       return null;
     return raw;
@@ -28167,9 +28515,9 @@ var init_types3 = __esm({
 import { readFileSync as readFileSync15 } from "node:fs";
 import { join as join12 } from "node:path";
 function readLessonsDeduped(zelariRoot) {
-  const path38 = join12(zelariRoot, LESSONS_FILE);
+  const path40 = join12(zelariRoot, LESSONS_FILE);
   try {
-    const raw = readFileSync15(path38, "utf8");
+    const raw = readFileSync15(path40, "utf8");
     const byId = /* @__PURE__ */ new Map();
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim())
@@ -28270,8 +28618,8 @@ function keywordsFrom(check2, signature) {
   return [.../* @__PURE__ */ new Set([...fromId, ...words])].slice(0, 12);
 }
 function writeLesson(zelariRoot, lesson) {
-  const path38 = join13(zelariRoot, LESSONS_FILE);
-  appendFileSync2(path38, `${JSON.stringify(lesson)}
+  const path40 = join13(zelariRoot, LESSONS_FILE);
+  appendFileSync2(path40, `${JSON.stringify(lesson)}
 `, "utf8");
 }
 function findSimilar(lessons, signature) {
@@ -30428,28 +30776,28 @@ var init_storage = __esm({
     VALID_SCALARS = /^(true|false|null|~)$/i;
     Storage = class {
       /** Read a Markdown file with frontmatter. Throws if not found. */
-      read(path38) {
-        if (!existsSync23(path38)) {
-          throw new Error(`File not found: ${path38}`);
+      read(path40) {
+        if (!existsSync23(path40)) {
+          throw new Error(`File not found: ${path40}`);
         }
-        const md = readFileSync20(path38, "utf8");
+        const md = readFileSync20(path40, "utf8");
         return parseFrontmatter(md);
       }
       /** Read a Markdown file; returns null if not found. */
-      readIfExists(path38) {
-        if (!existsSync23(path38)) return null;
-        return this.read(path38);
+      readIfExists(path40) {
+        if (!existsSync23(path40)) return null;
+        return this.read(path40);
       }
       /**
        * Write a Markdown file atomically (tmp + rename). Creates parent dirs.
        * The meta object is serialized as YAML frontmatter; body as Markdown.
        */
-      write(path38, meta3, body) {
-        mkdirSync9(dirname4(path38), { recursive: true });
-        const tmp = path38 + ".tmp-" + process.pid;
+      write(path40, meta3, body) {
+        mkdirSync9(dirname4(path40), { recursive: true });
+        const tmp = path40 + ".tmp-" + process.pid;
         const md = serializeFrontmatter(meta3, body);
         writeFileSync13(tmp, md, "utf8");
-        renameSync2(tmp, path38);
+        renameSync2(tmp, path40);
       }
       /** List all .md files in a directory (non-recursive). */
       listMarkdown(dir) {
@@ -30463,8 +30811,8 @@ var init_storage = __esm({
         const prev2 = this.chains.get(key) ?? Promise.resolve();
         let release = () => {
         };
-        const next = new Promise((resolve) => {
-          release = resolve;
+        const next = new Promise((resolve3) => {
+          release = resolve3;
         });
         const chained = prev2.then(() => next);
         this.chains.set(key, chained);
@@ -30527,8 +30875,8 @@ function readPlan(ctx) {
     } catch {
     }
   }
-  const path38 = workspaceFile(ctx.rootDir, "plan");
-  const doc = ctx.storage.readIfExists(path38);
+  const path40 = workspaceFile(ctx.rootDir, "plan");
+  const doc = ctx.storage.readIfExists(path40);
   if (!doc) return { phases: [], tasks: [], milestones: [] };
   const meta3 = doc.meta;
   return {
@@ -30693,7 +31041,7 @@ function addMilestoneRecord(ctx, summary, input) {
     dueDate: input.dueDate,
     targetVersion: version2
   });
-  const path38 = join23(ctx.rootDir, "milestones", `${id}.md`);
+  const path40 = join23(ctx.rootDir, "milestones", `${id}.md`);
   const meta3 = {
     kind: "milestone",
     id,
@@ -30710,7 +31058,7 @@ function addMilestoneRecord(ctx, summary, input) {
     `Target version: ${version2}`,
     ""
   ].join("\n");
-  ctx.storage.write(path38, meta3, body);
+  ctx.storage.write(path40, meta3, body);
   return { id, created: true };
 }
 function readPlanSummary(ctx) {
@@ -30914,7 +31262,7 @@ function addIdeaStub(ctx) {
         const tags = args["tags"] ?? [];
         const category = args["category"] ?? "General";
         const id = `${nextAdrId(ctx)}-${slugify3(title)}`;
-        const path38 = workspaceArtifact(ctx.rootDir, "decisions", id);
+        const path40 = workspaceArtifact(ctx.rootDir, "decisions", id);
         const meta3 = {
           kind: "adr",
           status: "proposed",
@@ -30940,7 +31288,7 @@ function addIdeaStub(ctx) {
           ...consequences.map((c) => `- ${c}`),
           ""
         ].join("\n");
-        ctx.storage.write(path38, meta3, body);
+        ctx.storage.write(path40, meta3, body);
         return `ADR ${id} created: "${title}". Status: proposed. Promote to accepted via /update ADR or manual edit.`;
       });
     }
@@ -31022,14 +31370,14 @@ function createDocumentStub(ctx) {
           ctx.storage.write(risksPath, riskMeta, content);
           return `Document "${title}" created at risks.md (workspace root).`;
         }
-        const path38 = workspaceArtifact(ctx.rootDir, "docs", slug);
+        const path40 = workspaceArtifact(ctx.rootDir, "docs", slug);
         const meta3 = {
           kind: "doc",
           id: slug,
           date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
           tags
         };
-        ctx.storage.write(path38, meta3, content);
+        ctx.storage.write(path40, meta3, content);
         return `Document "${title}" created at docs/${slug}.md.`;
       });
     }
@@ -31349,7 +31697,7 @@ ${fallback.output}`
   return primary;
 }
 function runNpm(executor, args, mode, npmCliPath) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -31361,7 +31709,7 @@ function runNpm(executor, args, mode, npmCliPath) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve({
+      resolve3({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -31370,7 +31718,7 @@ function runNpm(executor, args, mode, npmCliPath) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve({
+      resolve3({
         ok,
         output: stdout + stderr,
         error: ok ? void 0 : `npm exited with code ${code}`,
@@ -31494,7 +31842,7 @@ var init_mcpClient = __esm({
           return Promise.reject(new Error(`[mcp:${this.serverName}] not started`));
         const id = this.nextId++;
         const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params });
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve3, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             reject(
@@ -31503,7 +31851,7 @@ var init_mcpClient = __esm({
               )
             );
           }, timeoutMs);
-          this.pending.set(id, { resolve, reject, timer });
+          this.pending.set(id, { resolve: resolve3, reject, timer });
           child.stdin.write(payload + "\n", (err) => {
             if (err) {
               clearTimeout(timer);
@@ -31573,10 +31921,10 @@ function getUserMcpPath() {
 function getProjectMcpPath(projectRoot) {
   return join24(projectRoot, ".zelari", "mcp.json");
 }
-function readFile2(path38) {
-  if (!existsSync26(path38)) return {};
+function readFile2(path40) {
+  if (!existsSync26(path40)) return {};
   try {
-    const parsed = JSON.parse(readFileSync22(path38, "utf8"));
+    const parsed = JSON.parse(readFileSync22(path40, "utf8"));
     const out = {};
     for (const [name, cfg] of Object.entries(parsed.mcpServers ?? {})) {
       if (!cfg || typeof cfg.command !== "string" || !cfg.command.trim()) continue;
@@ -31592,10 +31940,10 @@ function readFile2(path38) {
     return {};
   }
 }
-function writeFile(path38, servers) {
-  mkdirSync11(dirname6(path38), { recursive: true });
+function writeFile(path40, servers) {
+  mkdirSync11(dirname6(path40), { recursive: true });
   const body = { mcpServers: servers };
-  writeFileSync15(path38, `${JSON.stringify(body, null, 2)}
+  writeFileSync15(path40, `${JSON.stringify(body, null, 2)}
 `, "utf8");
 }
 function listMcpServers(projectRoot) {
@@ -31628,9 +31976,9 @@ function upsertMcpServer(opts) {
   if (!opts.config.command?.trim()) {
     return { ok: false, error: "command is required" };
   }
-  let path38;
+  let path40;
   if (opts.scope === "user") {
-    path38 = getUserMcpPath();
+    path40 = getUserMcpPath();
   } else {
     const root = opts.projectRoot?.trim();
     if (!root) {
@@ -31639,30 +31987,30 @@ function upsertMcpServer(opts) {
         error: "projectRoot required for project scope (Open Folder first)"
       };
     }
-    path38 = getProjectMcpPath(root);
+    path40 = getProjectMcpPath(root);
   }
-  const current = readFile2(path38);
+  const current = readFile2(path40);
   current[name] = {
     command: opts.config.command.trim(),
     args: opts.config.args,
     env: opts.config.env,
     enabled: opts.config.enabled !== false
   };
-  writeFile(path38, current);
-  return { ok: true, path: path38 };
+  writeFile(path40, current);
+  return { ok: true, path: path40 };
 }
 function removeMcpServer(opts) {
-  const path38 = opts.scope === "user" ? getUserMcpPath() : opts.projectRoot ? getProjectMcpPath(opts.projectRoot) : null;
-  if (!path38) {
+  const path40 = opts.scope === "user" ? getUserMcpPath() : opts.projectRoot ? getProjectMcpPath(opts.projectRoot) : null;
+  if (!path40) {
     return { ok: false, error: "projectRoot required for project scope" };
   }
-  const current = readFile2(path38);
+  const current = readFile2(path40);
   if (!(opts.name in current)) {
-    return { ok: false, error: `Server "${opts.name}" not found in ${path38}` };
+    return { ok: false, error: `Server "${opts.name}" not found in ${path40}` };
   }
   delete current[opts.name];
-  writeFile(path38, current);
-  return { ok: true, path: path38 };
+  writeFile(path40, current);
+  return { ok: true, path: path40 };
 }
 var init_mcpConfigIo = __esm({
   "src/cli/mcp/mcpConfigIo.ts"() {
@@ -31999,10 +32347,10 @@ import { createHash as createHash5 } from "node:crypto";
 import { join as join26 } from "node:path";
 import { readFile as readFile3 } from "node:fs/promises";
 async function readPackageJson2(projectRoot) {
-  const path38 = join26(projectRoot, "package.json");
-  if (!existsSync28(path38)) return null;
+  const path40 = join26(projectRoot, "package.json");
+  if (!existsSync28(path40)) return null;
   try {
-    return JSON.parse(await readFile3(path38, "utf8"));
+    return JSON.parse(await readFile3(path40, "utf8"));
   } catch {
     return null;
   }
@@ -32084,9 +32432,9 @@ async function genBuild(ctx) {
   ].join("\n");
 }
 async function genOpenQuestions(ctx) {
-  const path38 = join26(ctx.rootDir, "risks.md");
-  if (!existsSync28(path38)) return "_No open questions._";
-  const content = readFileSync24(path38, "utf8");
+  const path40 = join26(ctx.rootDir, "risks.md");
+  if (!existsSync28(path40)) return "_No open questions._";
+  const content = readFileSync24(path40, "utf8");
   const lines = content.split("\n");
   const questions = [];
   let currentTitle = "";
@@ -32653,8 +33001,8 @@ async function runPostCouncilHook(ctx, options) {
           sources: scope.sources
         } : void 0
       });
-      const path38 = writeCouncilCompletion(ctx.rootDir, completion);
-      completionHook = { ran: true, path: path38, completion };
+      const path40 = writeCouncilCompletion(ctx.rootDir, completion);
+      completionHook = { ran: true, path: path40, completion };
     } catch (err) {
       completionHook = {
         ran: true,
@@ -33211,18 +33559,49 @@ var init_fileBackend = __esm({
   }
 });
 
+// src/cli/traceStore.ts
+import { promises as fs17 } from "node:fs";
+import * as path29 from "node:path";
+function traceDir(projectRoot) {
+  return path29.join(projectRoot, ".zelari", "trace");
+}
+function tracePath(projectRoot, missionId) {
+  return path29.join(traceDir(projectRoot), `${missionId}.json`);
+}
+async function saveTrace(projectRoot, missionId, entries) {
+  const dir = traceDir(projectRoot);
+  await fs17.mkdir(dir, { recursive: true });
+  const payload = {
+    missionId,
+    ts: Date.now(),
+    entries
+  };
+  await fs17.writeFile(
+    tracePath(projectRoot, missionId),
+    JSON.stringify(payload, null, 2) + "\n",
+    "utf8"
+  );
+}
+var init_traceStore = __esm({
+  "src/cli/traceStore.ts"() {
+    "use strict";
+  }
+});
+
 // src/cli/zelariMission.ts
 var zelariMission_exports = {};
 __export(zelariMission_exports, {
   formatBriefForChat: () => formatBriefForChat,
   isMissionAutoStart: () => isMissionAutoStart,
+  resolveMaxCost: () => resolveMaxCost,
   resolveMaxIterations: () => resolveMaxIterations,
   resolveMaxStall: () => resolveMaxStall,
+  resolveMaxTokens: () => resolveMaxTokens,
   runZelariMission: () => runZelariMission
 });
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { promises as fs17 } from "node:fs";
-import * as path29 from "node:path";
+import { promises as fs18 } from "node:fs";
+import * as path30 from "node:path";
 function resolveMaxIterations(env = process.env) {
   const raw = env.ZELARI_MISSION_MAX_ITER;
   const n = raw ? Number.parseInt(raw, 10) : DEFAULT_MAX_ITER;
@@ -33234,17 +33613,35 @@ function resolveMaxStall(env = process.env) {
   const n = Number.parseInt(raw, 10);
   return Number.isFinite(n) && n >= 0 ? n : DEFAULT_MAX_STALL;
 }
+function resolveMaxCost(env = process.env) {
+  const raw = env.ZELARI_MISSION_MAX_COST;
+  if (!raw) return void 0;
+  const n = Number.parseFloat(raw);
+  return Number.isFinite(n) && n > 0 ? n : void 0;
+}
+function resolveMaxTokens(env = process.env) {
+  const raw = env.ZELARI_MISSION_MAX_TOKENS;
+  if (!raw) return void 0;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : void 0;
+}
 function isMissionAutoStart(env = process.env) {
   return env.ZELARI_MISSION_AUTO === "1";
 }
 async function writeMissionState(projectRoot, state2) {
-  const dir = path29.join(projectRoot, ".zelari");
-  await fs17.mkdir(dir, { recursive: true });
-  await fs17.writeFile(
-    path29.join(dir, "mission-state.json"),
+  const dir = path30.join(projectRoot, ".zelari");
+  await fs18.mkdir(dir, { recursive: true });
+  await fs18.writeFile(
+    path30.join(dir, "mission-state.json"),
     JSON.stringify(state2, null, 2) + "\n",
     "utf8"
   );
+  if (state2.trace?.length) {
+    try {
+      await saveTrace(projectRoot, state2.missionId, state2.trace);
+    } catch {
+    }
+  }
 }
 function buildSlicePrompt(brief, userMessage, runMode, iteration) {
   if (runMode === "design-phase") {
@@ -33282,6 +33679,8 @@ async function runZelariMission(userMessage, brief, deps) {
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const maxIter = deps.maxIterations ?? resolveMaxIterations(deps.env);
   const maxStall = resolveMaxStall(deps.env);
+  const maxCost = resolveMaxCost(deps.env);
+  const maxTokens = resolveMaxTokens(deps.env);
   const missionId = deps.missionId ?? `m_${randomUUID5().slice(0, 8)}`;
   const startedAt = now().toISOString();
   const state2 = {
@@ -33317,6 +33716,8 @@ async function runZelariMission(userMessage, brief, deps) {
   let step = 0;
   let implStep = 0;
   let pendingDesign = designFirst;
+  let cumulativeCostUsd = 0;
+  let cumulativeTokens = 0;
   while (true) {
     const runMode = pendingDesign ? "design-phase" : "implementation";
     if (runMode === "implementation") {
@@ -33333,6 +33734,8 @@ async function runZelariMission(userMessage, brief, deps) {
     const promptIter = runMode === "implementation" ? implStep : 1;
     const slicePrompt = buildSlicePrompt(brief, userMessage, runMode, promptIter);
     const implementerRetry = runMode === "implementation" && implStep > 1;
+    const sliceStartedAt = now().toISOString();
+    const sliceStartMs = now().getTime();
     if (runMode === "design-phase") {
       deps.emit(
         `[zelari] design-phase (fuori budget) \xB7 step ${step} \xB7 slice ${brief.sliceMvp.id}`
@@ -33369,6 +33772,8 @@ async function runZelariMission(userMessage, brief, deps) {
       );
       return state2;
     }
+    if (typeof result.costUsd === "number") cumulativeCostUsd += result.costUsd;
+    if (typeof result.costTokens === "number") cumulativeTokens += result.costTokens;
     await deps.memory.add(
       JSON.stringify({
         iteration: step,
@@ -33394,6 +33799,20 @@ async function runZelariMission(userMessage, brief, deps) {
     }
     state2.lastCompletionOk = completionOk;
     state2.updatedAt = now().toISOString();
+    state2.cumulativeCostUsd = cumulativeCostUsd;
+    state2.cumulativeTokens = cumulativeTokens;
+    if (!state2.trace) state2.trace = [];
+    state2.trace.push({
+      sliceId: brief.sliceMvp.id,
+      iteration: step,
+      runMode,
+      completionOk,
+      degraded: result.degraded,
+      costTokens: typeof result.costTokens === "number" ? result.costTokens : void 0,
+      costUsd: typeof result.costUsd === "number" ? result.costUsd : void 0,
+      startedAt: sliceStartedAt,
+      durationMs: now().getTime() - sliceStartMs
+    });
     if (runMode === "design-phase") {
       pendingDesign = false;
       await writeMissionState(deps.projectRoot, state2);
@@ -33457,6 +33876,16 @@ async function runZelariMission(userMessage, brief, deps) {
         return state2;
       }
     }
+    if (maxCost !== void 0 && cumulativeCostUsd >= maxCost || maxTokens !== void 0 && cumulativeTokens >= maxTokens) {
+      state2.status = "stopped";
+      state2.updatedAt = now().toISOString();
+      await writeMissionState(deps.projectRoot, state2);
+      const reason = maxCost !== void 0 && cumulativeCostUsd >= maxCost ? `budget USD ${formatCost(cumulativeCostUsd)} \u2265 ${formatCost(maxCost)}` : `token ${formatTokens(cumulativeTokens)} \u2265 ${formatTokens(maxTokens)}`;
+      deps.emit(
+        `[zelari] fermata: ${reason}. Imposta ZELARI_MISSION_MAX_COST / ZELARI_MISSION_MAX_TOKENS pi\xF9 alto, o usa un modello pi\xF9 economico. Stato salvato in .zelari/mission-state.json`
+      );
+      return state2;
+    }
     await writeMissionState(deps.projectRoot, state2);
   }
   state2.status = "stopped";
@@ -33475,6 +33904,8 @@ var init_zelariMission = __esm({
     init_checkpointManager();
     init_fileStateStore();
     init_commitHelpers();
+    init_modelPricing();
+    init_traceStore();
     DEFAULT_MAX_ITER = 6;
     DEFAULT_MAX_STALL = 2;
   }
@@ -33632,6 +34063,8 @@ async function runAgentMissionSlice(deps) {
     });
     let text = "";
     let errored2 = false;
+    let promptTokens = 0;
+    let completionTokens = 0;
     try {
       for await (const event of harness.run()) {
         counter.onEvent(event);
@@ -33642,6 +34075,11 @@ async function runAgentMissionSlice(deps) {
         if (event.type === "agent_end" && event.reason === "error") {
           errored2 = true;
         }
+        if (event.type === "message_end" && event.usage) {
+          const u = event.usage;
+          promptTokens += u.promptTokens ?? 0;
+          completionTokens += u.completionTokens ?? 0;
+        }
         if (event.type === "error" && event.severity === "fatal") {
           errored2 = true;
         }
@@ -33664,7 +34102,9 @@ async function runAgentMissionSlice(deps) {
       successfulWrites: counter.state.successfulWrites,
       emittedWrites: counter.state.emittedWrites,
       errored: errored2,
-      messages: harness.getMessages()
+      messages: harness.getMessages(),
+      promptTokens,
+      completionTokens
     };
   }
   const initial = [
@@ -33676,6 +34116,8 @@ async function runAgentMissionSlice(deps) {
   let totalEmitted = pass.emittedWrites;
   let synthesisText = pass.text;
   let errored = pass.errored;
+  let totalPromptTokens = pass.promptTokens;
+  let totalCompletionTokens = pass.completionTokens;
   if (writeRetry && totalWrites === 0 && !errored) {
     deps.emit?.(
       "[zelari] build@agent: 0 write \u2014 forcing implementation retry"
@@ -33695,6 +34137,8 @@ async function runAgentMissionSlice(deps) {
 ${retry.text}` : retry.text;
     }
     errored = errored || retry.errored;
+    totalPromptTokens += retry.promptTokens;
+    totalCompletionTokens += retry.completionTokens;
   }
   const cleaned = cleanAgentContent(synthesisText, {
     stripQuestion: false,
@@ -33741,12 +34185,16 @@ ${retry.text}` : retry.text;
     else degraded = true;
   }
   void totalEmitted;
+  const costTokens = totalPromptTokens + totalCompletionTokens;
+  const costUsd = calculateCost(deps.model, totalPromptTokens, totalCompletionTokens);
   return {
     completionOk,
     ran: true,
     synthesisText: cleaned || void 0,
     writeCount: totalWrites,
-    degraded
+    degraded,
+    costTokens,
+    costUsd
   };
 }
 var MUTATING, AGENT_MISSION_IMPLEMENTER_PREAMBLE;
@@ -33759,6 +34207,7 @@ var init_missionSlice = __esm({
     init_dist();
     init_buildPolicy();
     init_envNumber();
+    init_modelPricing();
     MUTATING = /* @__PURE__ */ new Set(["write_file", "edit_file", "apply_diff"]);
     AGENT_MISSION_IMPLEMENTER_PREAMBLE = "You are the sole implementer for this Zelari mission slice. A multi-agent council may already have produced a plan under `.zelari/` \u2014 treat it as a SPEC to apply on disk. You MUST create or modify real project files with write_file / edit_file. Prose without successful writes is a failed slice.";
   }
@@ -33885,14 +34334,14 @@ function agentProbeEnv() {
   try {
     const nodeDir = dirname7(process.execPath);
     if (!nodeDir) return env;
-    const sep = process.platform === "win32" ? ";" : ":";
+    const sep2 = process.platform === "win32" ? ";" : ":";
     const current = env.PATH ?? env.Path ?? "";
-    const parts = current.split(sep).filter((p3) => p3.length > 0);
+    const parts = current.split(sep2).filter((p3) => p3.length > 0);
     const has = parts.some(
       (p3) => p3.toLowerCase() === nodeDir.toLowerCase()
     );
     if (!has) {
-      env.PATH = `${nodeDir}${sep}${current}`;
+      env.PATH = `${nodeDir}${sep2}${current}`;
     }
   } catch {
   }
@@ -34148,10 +34597,10 @@ var init_prereqChecks = __esm({
 
 // src/cli/plugins/prefs.ts
 import { existsSync as existsSync33, readFileSync as readFileSync28, writeFileSync as writeFileSync18, mkdirSync as mkdirSync13 } from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 import os9 from "node:os";
 function getPluginPrefsPath() {
-  return process.env.ZELARI_PLUGINS_PREFS_FILE ?? path31.join(os9.homedir(), ".tmp", "zelari-code", "plugins.json");
+  return process.env.ZELARI_PLUGINS_PREFS_FILE ?? path32.join(os9.homedir(), ".tmp", "zelari-code", "plugins.json");
 }
 function getPluginPrefs() {
   const file2 = getPluginPrefsPath();
@@ -34172,7 +34621,7 @@ function getPluginPrefs() {
 }
 function writePluginPrefs(prefs) {
   const file2 = getPluginPrefsPath();
-  mkdirSync13(path31.dirname(file2), { recursive: true });
+  mkdirSync13(path32.dirname(file2), { recursive: true });
   writeFileSync18(file2, JSON.stringify(prefs, null, 2), {
     encoding: "utf-8",
     mode: 384
@@ -34209,7 +34658,7 @@ __export(registry_exports, {
   isBinaryOnPath: () => isBinaryOnPath
 });
 import { existsSync as existsSync34 } from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 function detectLocalBin(bin) {
   return (cwd) => {
     try {
@@ -34227,9 +34676,9 @@ function isBinaryOnPath(bin, opts = {}) {
   const platform = opts.platform ?? process.platform;
   const exists = opts.exists ?? existsSync34;
   const pathEnv = opts.pathEnv ?? process.env.PATH ?? "";
-  const pathMod = platform === "win32" ? path32.win32 : path32.posix;
-  const sep = platform === "win32" ? ";" : ":";
-  const dirs = pathEnv.split(sep).filter((d) => d.length > 0);
+  const pathMod = platform === "win32" ? path33.win32 : path33.posix;
+  const sep2 = platform === "win32" ? ";" : ":";
+  const dirs = pathEnv.split(sep2).filter((d) => d.length > 0);
   const candidates = [bin];
   if (platform === "win32") {
     const pathExt = opts.pathExt ?? process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM";
@@ -34357,32 +34806,1268 @@ var init_registry2 = __esm({
   }
 });
 
+// src/cli/atMentions.ts
+var atMentions_exports = {};
+__export(atMentions_exports, {
+  expandAtMentions: () => expandAtMentions,
+  extractAtMentions: () => extractAtMentions,
+  hasAtMentions: () => hasAtMentions
+});
+import { existsSync as existsSync37, readFileSync as readFileSync30, statSync as statSync6 } from "node:fs";
+import { isAbsolute, relative as relative3, resolve, sep } from "node:path";
+function isProbablyText(name, head) {
+  if (/\.(txt|md|markdown|json|jsonc|ts|tsx|js|jsx|mjs|cjs|css|scss|html|htm|xml|yml|yaml|toml|ini|cfg|conf|rs|go|py|java|kt|swift|c|cc|cpp|h|hpp|cs|rb|php|sh|bash|zsh|ps1|sql|graphql|env|gitignore|dockerfile|makefile|cmake|lock|svg)$/i.test(
+    name
+  )) {
+    return true;
+  }
+  return !head.includes("\0") && /[\x09\x0a\x0d\x20-\x7e]/.test(head.slice(0, 200));
+}
+function underRoot(abs, root) {
+  const a = resolve(abs);
+  const r = resolve(root);
+  const prefix = r.endsWith(sep) ? r : r + sep;
+  return a === r || a.startsWith(prefix);
+}
+function extractAtMentions(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  AT_PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = AT_PATH_RE.exec(text)) !== null) {
+    const token = (m[2] ?? "").trim();
+    if (!token || token.includes("@")) continue;
+    const key = token.replace(/\\/g, "/").toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(token);
+  }
+  return out;
+}
+function resolveMention(token, cwd) {
+  const abs = isAbsolute(token) ? resolve(token) : resolve(cwd, token);
+  if (!underRoot(abs, cwd) && !isAbsolute(token)) {
+    if (!underRoot(abs, cwd)) {
+      return {
+        raw: token,
+        path: token,
+        absolute: abs,
+        isDir: false,
+        note: "outside project root \u2014 skipped"
+      };
+    }
+  }
+  if (isAbsolute(token) && !underRoot(abs, cwd)) {
+    return {
+      raw: token,
+      path: token,
+      absolute: abs,
+      isDir: false,
+      note: "outside project root \u2014 skipped"
+    };
+  }
+  if (!existsSync37(abs)) {
+    return {
+      raw: token,
+      path: token,
+      absolute: abs,
+      isDir: false,
+      note: "not found"
+    };
+  }
+  let st;
+  try {
+    st = statSync6(abs);
+  } catch {
+    return {
+      raw: token,
+      path: token,
+      absolute: abs,
+      isDir: false,
+      note: "unreadable"
+    };
+  }
+  const rel2 = relative3(cwd, abs).replace(/\\/g, "/") || ".";
+  if (st.isDirectory()) {
+    return {
+      raw: token,
+      path: rel2,
+      absolute: abs,
+      isDir: true,
+      note: "directory \u2014 list/read with tools as needed"
+    };
+  }
+  if (st.size > ATTACH_FILE_MAX_BYTES) {
+    return {
+      raw: token,
+      path: rel2,
+      absolute: abs,
+      isDir: false,
+      note: `too large (${Math.round(st.size / 1024)} KB) \u2014 path only`
+    };
+  }
+  try {
+    const buf = readFileSync30(abs);
+    const head = buf.subarray(0, 800).toString("utf8");
+    if (!isProbablyText(abs, head)) {
+      return {
+        raw: token,
+        path: rel2,
+        absolute: abs,
+        isDir: false,
+        note: "binary \u2014 path only"
+      };
+    }
+    let text = buf.toString("utf8");
+    if (text.charCodeAt(0) === 65279) text = text.slice(1);
+    if (text.length > ATTACH_TEXT_MAX) {
+      text = text.slice(0, ATTACH_TEXT_MAX) + `
+
+\u2026 [truncated, ${text.length - ATTACH_TEXT_MAX} more chars]`;
+    }
+    return { raw: token, path: rel2, absolute: abs, isDir: false, text };
+  } catch (err) {
+    return {
+      raw: token,
+      path: rel2,
+      absolute: abs,
+      isDir: false,
+      note: err instanceof Error ? err.message : "read failed"
+    };
+  }
+}
+function expandAtMentions(userText, cwd = process.cwd()) {
+  const tokens = extractAtMentions(userText);
+  if (tokens.length === 0) {
+    return { text: userText, hits: [] };
+  }
+  const hits = [];
+  for (const t of tokens) {
+    const hit = resolveMention(t, cwd);
+    if (hit) hits.push(hit);
+  }
+  if (hits.length === 0) {
+    return { text: userText, hits: [] };
+  }
+  const blocks = hits.map((h) => {
+    const label = h.path || h.raw;
+    if (h.text != null && h.text.length > 0) {
+      return `--- File: ${label} ---
+${h.text}
+--- End file ---`;
+    }
+    const extra = h.note ? ` (${h.note})` : "";
+    return `--- ${h.isDir ? "Dir" : "File"}: ${label}${extra} ---`;
+  });
+  const text = `${userText.trim()}
+
+[Tagged paths]
+${blocks.join("\n\n")}`;
+  return { text, hits };
+}
+function hasAtMentions(text) {
+  return extractAtMentions(text).length > 0;
+}
+var ATTACH_TEXT_MAX, ATTACH_FILE_MAX_BYTES, AT_PATH_RE;
+var init_atMentions = __esm({
+  "src/cli/atMentions.ts"() {
+    "use strict";
+    ATTACH_TEXT_MAX = 48e3;
+    ATTACH_FILE_MAX_BYTES = 512e3;
+    AT_PATH_RE = /(^|[\s([{])@((?:\.{1,2}\/)?[A-Za-z0-9_.+-]+(?:[\\/][A-Za-z0-9_.+-]+)*)/g;
+  }
+});
+
+// src/cli/triggerLock.ts
+var triggerLock_exports = {};
+__export(triggerLock_exports, {
+  acquireLock: () => acquireLock,
+  lockPath: () => lockPath,
+  releaseLock: () => releaseLock
+});
+import { promises as fs23 } from "node:fs";
+import * as path38 from "node:path";
+function lockPath(projectRoot) {
+  return path38.join(projectRoot, ".zelari", "trigger.lock");
+}
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    return code === "EPERM";
+  }
+}
+async function acquireLock(projectRoot, now = () => /* @__PURE__ */ new Date()) {
+  const lp = lockPath(projectRoot);
+  const dir = path38.dirname(lp);
+  await fs23.mkdir(dir, { recursive: true });
+  try {
+    const raw = await fs23.readFile(lp, "utf8");
+    const existing = JSON.parse(raw);
+    if (existing.pid && isPidAlive(existing.pid)) {
+      return { acquired: false, heldBy: existing.pid, lockPath: lp };
+    }
+  } catch {
+  }
+  const payload = {
+    pid: process.pid,
+    acquiredAt: now().toISOString()
+  };
+  await fs23.writeFile(lp, JSON.stringify(payload, null, 2) + "\n", "utf8");
+  return { acquired: true, lockPath: lp };
+}
+async function releaseLock(projectRoot) {
+  const lp = lockPath(projectRoot);
+  try {
+    await fs23.unlink(lp);
+  } catch {
+  }
+}
+var init_triggerLock = __esm({
+  "src/cli/triggerLock.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/desktopConfig.ts
+function wantsPrintConfig(argv) {
+  return argv.includes("--print-config");
+}
+function wantsSetKey(argv) {
+  return argv.includes("--set-key");
+}
+function wantsDiscoverModels(argv) {
+  return argv.includes("--discover-models");
+}
+function parseSetConfigFlags(argv) {
+  if (!argv.includes("--set-config")) {
+    return { request: null };
+  }
+  let provider;
+  let model;
+  let endpoint;
+  let endpointClear = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--provider") {
+      provider = argv[i + 1];
+      i++;
+    } else if (arg === "--model") {
+      model = argv[i + 1];
+      i++;
+    } else if (arg === "--endpoint") {
+      endpoint = argv[i + 1];
+      i++;
+    } else if (arg === "--endpoint-clear") {
+      endpointClear = true;
+    }
+  }
+  if (!provider && !model && !endpoint && !endpointClear) {
+    return {
+      request: null,
+      error: "--set-config requires --provider, --model, --endpoint, and/or --endpoint-clear"
+    };
+  }
+  if (provider !== void 0 && provider.trim().length === 0) {
+    return { request: null, error: "--provider cannot be empty" };
+  }
+  if (model !== void 0 && model.trim().length === 0) {
+    return { request: null, error: "--model cannot be empty" };
+  }
+  if (endpoint !== void 0 && endpoint.trim().length === 0) {
+    return { request: null, error: "--endpoint cannot be empty" };
+  }
+  if (endpoint && endpointClear) {
+    return { request: null, error: "--endpoint and --endpoint-clear conflict" };
+  }
+  return {
+    request: {
+      provider: provider?.trim(),
+      model: model?.trim(),
+      endpoint: endpoint?.trim(),
+      endpointClear: endpointClear || void 0
+    }
+  };
+}
+function parseSetKeyFlags(argv) {
+  if (!argv.includes("--set-key")) {
+    return { request: null };
+  }
+  let provider;
+  let key;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--provider") {
+      provider = argv[i + 1];
+      i++;
+    } else if (arg === "--key") {
+      key = argv[i + 1];
+      i++;
+    }
+  }
+  if (!provider || provider.trim().length === 0) {
+    return { request: null, error: "--set-key requires --provider <id>" };
+  }
+  if (!key || key.trim().length === 0) {
+    return { request: null, error: "--set-key requires --key <secret>" };
+  }
+  return {
+    request: {
+      provider: provider.trim(),
+      key: key.trim()
+    }
+  };
+}
+function parseDiscoverModelsFlags(argv) {
+  if (!argv.includes("--discover-models")) {
+    return { provider: null, present: false };
+  }
+  let provider;
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--provider") {
+      provider = argv[i + 1];
+      i++;
+    }
+  }
+  return {
+    present: true,
+    provider: provider?.trim() || null
+  };
+}
+function buildDesktopConfigSnapshot() {
+  const config2 = getProviderConfig();
+  const providers = PROVIDERS.map((p3) => {
+    const cached2 = getCachedModels(p3.id);
+    const models = cached2?.models.map((m) => m.id) ?? [];
+    const defaultModel = config2.modelByProvider[p3.id] ?? "";
+    if (defaultModel && !models.includes(defaultModel)) {
+      models.unshift(defaultModel);
+    }
+    const custom2 = getCustomEndpoint(p3.id);
+    const builtin = p3.baseUrl ?? null;
+    return {
+      id: p3.id,
+      displayName: p3.displayName,
+      hasKey: !!resolveApiKey(p3.id),
+      envVar: p3.envVar,
+      models,
+      defaultModel,
+      endpoint: custom2 ?? null,
+      baseUrl: custom2 ?? builtin
+    };
+  });
+  return {
+    activeProviderId: config2.activeProviderId,
+    modelByProvider: { ...config2.modelByProvider },
+    providers,
+    cliVersion: getCurrentVersion(),
+    configPaths: {
+      provider: getProviderConfigPath(),
+      keys: getKeyStorePath()
+    }
+  };
+}
+function printDesktopConfig() {
+  const snap = buildDesktopConfigSnapshot();
+  process.stdout.write(JSON.stringify(snap, null, 2) + "\n");
+}
+function applySetConfig(req) {
+  try {
+    const config2 = getProviderConfig();
+    let targetProvider = req.provider ?? config2.activeProviderId;
+    if (req.provider) {
+      const exists = PROVIDERS.some((p3) => p3.id === req.provider);
+      if (!exists) {
+        return {
+          ok: false,
+          error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
+        };
+      }
+      setActiveProviderId(req.provider);
+      targetProvider = req.provider;
+    }
+    if (req.endpointClear) {
+      clearCustomEndpoint(targetProvider);
+    }
+    if (req.endpoint) {
+      setCustomEndpoint(targetProvider, req.endpoint);
+    }
+    if (req.model) {
+      setModelForProvider(targetProvider, req.model);
+    }
+    const after = getProviderConfig();
+    const ep = getCustomEndpoint(after.activeProviderId);
+    return {
+      ok: true,
+      message: `activeProvider=${after.activeProviderId} model=${after.modelByProvider[after.activeProviderId]}` + (ep ? ` endpoint=${ep}` : "")
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function applySetKey(req) {
+  try {
+    const exists = PROVIDERS.some((p3) => p3.id === req.provider);
+    if (!exists) {
+      return {
+        ok: false,
+        error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
+      };
+    }
+    setApiKey(req.provider, req.key);
+    setActiveProviderId(req.provider);
+    return {
+      ok: true,
+      provider: req.provider,
+      masked: maskKey(req.key)
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function runDiscoverModels(providerArg) {
+  const config2 = getProviderConfig();
+  const providerId = (providerArg ?? config2.activeProviderId).trim();
+  if (!DISCOVERABLE.includes(providerId)) {
+    if (providerId === "custom") {
+    } else {
+      return {
+        ok: false,
+        error: `provider '${providerId}' is not discoverable. Use: ${DISCOVERABLE.join(", ")}`
+      };
+    }
+  }
+  const discoveryId = providerId === "custom" ? "openai-compatible" : providerId;
+  try {
+    const entry = await discoverModelsForProvider(discoveryId);
+    return {
+      ok: true,
+      payload: {
+        ok: true,
+        provider: providerId,
+        models: entry.models.map((m) => m.id),
+        fetchedAt: entry.fetchedAt,
+        baseUrl: entry.baseUrl
+      }
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var DISCOVERABLE;
+var init_desktopConfig = __esm({
+  "src/cli/desktopConfig.ts"() {
+    "use strict";
+    init_keyStore();
+    init_providerConfig();
+    init_modelDiscovery();
+    init_updater();
+    DISCOVERABLE = [
+      "grok",
+      "glm",
+      "minimax",
+      "deepseek",
+      "openai-compatible"
+    ];
+  }
+});
+
+// src/cli/companion/config.ts
+import {
+  existsSync as existsSync40,
+  mkdirSync as mkdirSync17,
+  readFileSync as readFileSync33,
+  writeFileSync as writeFileSync21
+} from "node:fs";
+import { join as join35 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { createHash as createHash6, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+function getZelariHome() {
+  return join35(homedir11(), ".zelari-code");
+}
+function getCompanionConfigPath() {
+  return join35(getZelariHome(), "companion.json");
+}
+function getCompanionTokenPath() {
+  return join35(getZelariHome(), "companion.token");
+}
+function ensureHome() {
+  const home = getZelariHome();
+  if (!existsSync40(home)) {
+    mkdirSync17(home, { recursive: true });
+  }
+}
+function loadCompanionConfig() {
+  const path40 = getCompanionConfigPath();
+  if (!existsSync40(path40)) {
+    return { projects: [] };
+  }
+  try {
+    const raw = JSON.parse(readFileSync33(path40, "utf8"));
+    const projects = Array.isArray(raw.projects) ? raw.projects.filter(
+      (p3) => p3 && typeof p3.path === "string" && p3.path.trim() && typeof (p3.id ?? p3.name) === "string"
+    ).map((p3) => ({
+      id: String(p3.id || p3.name).trim().toLowerCase().replace(/[^a-z0-9-_]+/g, "-").slice(0, 64),
+      name: String(p3.name || p3.id || "project").trim() || "project",
+      path: String(p3.path).trim()
+    })) : [];
+    return {
+      projects,
+      bind: typeof raw.bind === "string" ? raw.bind : void 0,
+      port: typeof raw.port === "number" ? raw.port : void 0
+    };
+  } catch {
+    return { projects: [] };
+  }
+}
+function saveCompanionConfig(cfg) {
+  ensureHome();
+  writeFileSync21(
+    getCompanionConfigPath(),
+    JSON.stringify(
+      {
+        bind: cfg.bind,
+        port: cfg.port,
+        projects: cfg.projects
+      },
+      null,
+      2
+    ) + "\n",
+    "utf8"
+  );
+}
+function loadOrCreateToken(explicit) {
+  if (explicit && explicit.trim()) {
+    return { token: explicit.trim(), created: false };
+  }
+  ensureHome();
+  const path40 = getCompanionTokenPath();
+  if (existsSync40(path40)) {
+    const t = readFileSync33(path40, "utf8").trim();
+    if (t) return { token: t, created: false };
+  }
+  const token = randomBytes2(24).toString("base64url");
+  writeFileSync21(path40, token + "\n", "utf8");
+  try {
+    const fs24 = __require("node:fs");
+    fs24.chmodSync?.(path40, 384);
+  } catch {
+  }
+  return { token, created: true };
+}
+function tokenMatches(expected, provided) {
+  if (!provided) return false;
+  const a = createHash6("sha256").update(expected).digest();
+  const b = createHash6("sha256").update(provided).digest();
+  try {
+    return timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function slugFromPath(p3) {
+  const base = p3.replace(/[/\\]+$/, "").split(/[/\\]/).pop() || "project";
+  return base.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "project";
+}
+function mergeProjects(cfg, extraPaths) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const p3 of cfg.projects) {
+    byId.set(p3.id, p3);
+  }
+  for (const raw of extraPaths) {
+    const path40 = raw.trim();
+    if (!path40) continue;
+    let id = slugFromPath(path40);
+    let n = 2;
+    while (byId.has(id) && byId.get(id).path !== path40) {
+      id = `${slugFromPath(path40)}-${n++}`;
+    }
+    byId.set(id, {
+      id,
+      name: slugFromPath(path40),
+      path: path40
+    });
+  }
+  return [...byId.values()];
+}
+function resolveProjectPath(projects, cwdOrId) {
+  if (!projects.length) {
+    return {
+      ok: false,
+      error: "No projects configured. Pass --project <path> or edit ~/.zelari-code/companion.json"
+    };
+  }
+  if (!cwdOrId || !String(cwdOrId).trim()) {
+    return { ok: true, project: projects[0] };
+  }
+  const key = String(cwdOrId).trim();
+  const byId = projects.find((p3) => p3.id === key || p3.name === key);
+  if (byId) return { ok: true, project: byId };
+  const norm = key.replace(/\\/g, "/").toLowerCase();
+  const byPath = projects.find(
+    (p3) => p3.path.replace(/\\/g, "/").toLowerCase() === norm
+  );
+  if (byPath) return { ok: true, project: byPath };
+  const under = projects.find((p3) => {
+    const root = p3.path.replace(/\\/g, "/").toLowerCase().replace(/\/$/, "");
+    return norm === root || norm.startsWith(root + "/");
+  });
+  if (under) {
+    return {
+      ok: true,
+      project: { ...under, path: key }
+    };
+  }
+  return {
+    ok: false,
+    error: `cwd/project not in allowlist: ${key}. Allowed: ${projects.map((p3) => p3.id).join(", ")}`
+  };
+}
+var DEFAULT_COMPANION_PORT, DEFAULT_COMPANION_BIND;
+var init_config = __esm({
+  "src/cli/companion/config.ts"() {
+    "use strict";
+    DEFAULT_COMPANION_PORT = 7421;
+    DEFAULT_COMPANION_BIND = "127.0.0.1";
+  }
+});
+
+// src/cli/companion/runManager.ts
+import { spawn as spawn11 } from "node:child_process";
+import { createInterface } from "node:readline";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { writeFileSync as writeFileSync22, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join36 } from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+var RunManager;
+var init_runManager = __esm({
+  "src/cli/companion/runManager.ts"() {
+    "use strict";
+    RunManager = class {
+      active = null;
+      recent = [];
+      getActive() {
+        return this.active?.run ?? null;
+      }
+      getRun(id) {
+        if (this.active?.run.id === id) return this.active.run;
+        return this.recent.find((r) => r.id === id) ?? null;
+      }
+      listRecent(limit = 20) {
+        const cur = this.active ? [this.active.run] : [];
+        return [...cur, ...this.recent].slice(0, limit);
+      }
+      subscribe(runId, fn) {
+        if (this.active?.run.id === runId) {
+          for (const ev of this.active.run.events) {
+            try {
+              fn(ev);
+            } catch {
+            }
+          }
+          this.active.listeners.add(fn);
+          return () => {
+            this.active?.listeners.delete(fn);
+          };
+        }
+        const past = this.recent.find((r) => r.id === runId);
+        if (past) {
+          for (const ev of past.events) {
+            try {
+              fn(ev);
+            } catch {
+            }
+          }
+        }
+        return () => {
+        };
+      }
+      emit(ev) {
+        if (!this.active) return;
+        this.active.run.events.push(ev);
+        if (this.active.run.events.length > 5e3) {
+          this.active.run.events.splice(0, this.active.run.events.length - 4e3);
+        }
+        for (const fn of this.active.listeners) {
+          try {
+            fn(ev);
+          } catch {
+          }
+        }
+      }
+      start(args) {
+        if (this.active) {
+          return {
+            ok: false,
+            error: `A run is already active (${this.active.run.id}). Cancel it first.`
+          };
+        }
+        const prompt = args.prompt?.trim();
+        if (!prompt) return { ok: false, error: "prompt is required" };
+        const id = randomUUID6();
+        const mode = (args.mode || "agent").toLowerCase();
+        const phase2 = (args.phase || "build").toLowerCase();
+        const run = {
+          id,
+          status: "running",
+          prompt,
+          mode,
+          phase: phase2,
+          cwd: args.cwd,
+          createdAt: Date.now(),
+          events: []
+        };
+        const cliEntry = process.argv[1];
+        if (!cliEntry) {
+          return { ok: false, error: "Cannot resolve CLI entry (process.argv[1])" };
+        }
+        const argv = [
+          cliEntry,
+          "--headless",
+          "--task",
+          prompt,
+          "--output",
+          "json",
+          "--mode",
+          mode === "council" || mode === "zelari" ? mode : "agent",
+          "--phase",
+          phase2 === "plan" ? "plan" : "build"
+        ];
+        if (args.provider?.trim()) {
+          argv.push("--provider", args.provider.trim());
+        }
+        if (args.model?.trim()) {
+          argv.push("--model", args.model.trim());
+        }
+        let historyFile;
+        if (args.history && Array.isArray(args.history) && args.history.length > 0) {
+          historyFile = join36(tmpdir3(), `zelari-companion-hist-${id}.json`);
+          try {
+            writeFileSync22(historyFile, JSON.stringify(args.history), "utf8");
+            argv.push("--history-file", historyFile);
+          } catch {
+            historyFile = void 0;
+          }
+        }
+        const child = spawn11(process.execPath, argv, {
+          cwd: args.cwd,
+          env: {
+            ...process.env,
+            ZELARI_SKIP_PREFLIGHT: "1",
+            ANATHEMA_DEV: "1",
+            FORCE_COLOR: "0"
+          },
+          stdio: ["ignore", "pipe", "pipe"],
+          windowsHide: true
+        });
+        this.active = { run, child, listeners: /* @__PURE__ */ new Set(), historyFile };
+        this.emit({
+          type: "log",
+          message: `[companion] run ${id} started mode=${mode} phase=${phase2} cwd=${args.cwd}`
+        });
+        if (child.stdout) {
+          const rl = createInterface({ input: child.stdout });
+          rl.on("line", (line) => {
+            const t = line.trim();
+            if (!t) return;
+            try {
+              const ev = JSON.parse(t);
+              this.emit(ev);
+            } catch {
+              this.emit({ type: "log", message: t });
+            }
+          });
+        }
+        child.stderr?.on("data", (buf) => {
+          const text = buf.toString("utf8").trim();
+          if (!text) return;
+          for (const line of text.split(/\r?\n/)) {
+            if (line.trim()) {
+              this.emit({ type: "log", message: line.trim() });
+            }
+          }
+        });
+        child.on("error", (err) => {
+          run.status = "error";
+          run.error = err.message;
+          run.finishedAt = Date.now();
+          this.emit({
+            type: "error",
+            severity: "fatal",
+            message: err.message,
+            code: "spawn"
+          });
+          this.finishActive();
+        });
+        child.on("close", (code) => {
+          if (run.status === "running") {
+            run.status = code === 0 ? "completed" : "error";
+            run.exitCode = code;
+            run.finishedAt = Date.now();
+            if (code !== 0 && !run.error) {
+              run.error = `exit ${code}`;
+            }
+          }
+          this.emit({
+            type: "run_finished",
+            runId: id,
+            status: run.status,
+            exitCode: code
+          });
+          this.finishActive();
+        });
+        return { ok: true, run };
+      }
+      cancel(runId) {
+        if (!this.active) {
+          return { ok: false, error: "No active run" };
+        }
+        if (runId && this.active.run.id !== runId) {
+          return { ok: false, error: `Run ${runId} is not active` };
+        }
+        const { run, child } = this.active;
+        run.status = "cancelled";
+        run.finishedAt = Date.now();
+        this.emit({
+          type: "log",
+          message: `[companion] cancelling run ${run.id}`
+        });
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+        setTimeout(() => {
+          try {
+            if (!child.killed) child.kill("SIGKILL");
+          } catch {
+          }
+        }, 1500);
+        return { ok: true };
+      }
+      finishActive() {
+        if (!this.active) return;
+        const { run, historyFile } = this.active;
+        if (historyFile) {
+          try {
+            unlinkSync2(historyFile);
+          } catch {
+          }
+        }
+        this.recent.unshift(run);
+        if (this.recent.length > 30) this.recent.length = 30;
+        this.active = null;
+      }
+    };
+  }
+});
+
+// src/cli/companion/serve.ts
+var serve_exports = {};
+__export(serve_exports, {
+  parseServeFlags: () => parseServeFlags,
+  runCompanionServe: () => runCompanionServe
+});
+import { createServer } from "node:http";
+import { existsSync as existsSync41 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+function readBody(req, max = 2e6) {
+  return new Promise((resolveBody, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > max) {
+        reject(new Error("body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => resolveBody(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+function sendJson(res, status, body, extraHeaders) {
+  const data = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(data),
+    "access-control-allow-origin": "*",
+    "access-control-allow-headers": "authorization, content-type",
+    "access-control-allow-methods": "GET, POST, OPTIONS",
+    ...extraHeaders
+  });
+  res.end(data);
+}
+function getBearer(req) {
+  const h = req.headers.authorization;
+  if (!h) return null;
+  const m = /^Bearer\s+(.+)$/i.exec(h.trim());
+  return m?.[1]?.trim() || null;
+}
+function parseUrl(req) {
+  return new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+}
+async function runCompanionServe(opts = {}) {
+  const fileCfg = loadCompanionConfig();
+  const bind = (opts.bind || fileCfg.bind || DEFAULT_COMPANION_BIND).trim();
+  const port = opts.port ?? fileCfg.port ?? DEFAULT_COMPANION_PORT;
+  const { token, created } = loadOrCreateToken(opts.token);
+  let projects = mergeProjects(fileCfg, opts.projects ?? []);
+  projects = projects.filter((p3) => {
+    const abs = resolve2(p3.path);
+    if (!existsSync41(abs)) {
+      process.stderr.write(
+        `[zelari-code serve] skip missing project path: ${p3.path}
+`
+      );
+      return false;
+    }
+    p3.path = abs;
+    return true;
+  });
+  if (opts.persistProjects && projects.length > 0) {
+    saveCompanionConfig({
+      ...fileCfg,
+      bind,
+      port,
+      projects
+    });
+  }
+  if (projects.length === 0) {
+    const cwd = resolve2(process.cwd());
+    projects = [
+      {
+        id: "default",
+        name: "default",
+        path: cwd
+      }
+    ];
+    process.stderr.write(
+      `[zelari-code serve] no projects configured \u2014 using cwd as default: ${cwd}
+  Add more: zelari-code serve --project <path>
+  Or edit ~/.zelari-code/companion.json
+`
+    );
+  }
+  const runs = new RunManager();
+  const server = createServer(async (req, res) => {
+    if (req.method === "OPTIONS") {
+      res.writeHead(204, {
+        "access-control-allow-origin": "*",
+        "access-control-allow-headers": "authorization, content-type",
+        "access-control-allow-methods": "GET, POST, OPTIONS"
+      });
+      res.end();
+      return;
+    }
+    const url2 = parseUrl(req);
+    const path40 = url2.pathname.replace(/\/+$/, "") || "/";
+    try {
+      if (req.method === "GET" && (path40 === "/health" || path40 === "/v1/health")) {
+        sendJson(res, 200, {
+          ok: true,
+          service: "zelari-companion",
+          version: getCurrentVersion(),
+          bind,
+          port,
+          projects: projects.length,
+          activeRun: runs.getActive()?.id ?? null
+        });
+        return;
+      }
+      if (path40.startsWith("/v1")) {
+        if (!tokenMatches(token, getBearer(req))) {
+          sendJson(res, 401, { ok: false, error: "unauthorized" });
+          return;
+        }
+      }
+      if (req.method === "GET" && path40 === "/v1/config") {
+        const snap = buildDesktopConfigSnapshot();
+        sendJson(res, 200, { ok: true, ...snap });
+        return;
+      }
+      if (req.method === "GET" && path40 === "/v1/projects") {
+        sendJson(res, 200, {
+          ok: true,
+          projects: projects.map((p3) => ({
+            id: p3.id,
+            name: p3.name,
+            path: p3.path
+          }))
+        });
+        return;
+      }
+      if (req.method === "GET" && path40 === "/v1/runs") {
+        sendJson(res, 200, {
+          ok: true,
+          active: runs.getActive(),
+          recent: runs.listRecent().map((r) => ({
+            id: r.id,
+            status: r.status,
+            mode: r.mode,
+            phase: r.phase,
+            cwd: r.cwd,
+            createdAt: r.createdAt,
+            finishedAt: r.finishedAt,
+            exitCode: r.exitCode,
+            promptPreview: r.prompt.slice(0, 120)
+          }))
+        });
+        return;
+      }
+      if (req.method === "POST" && path40 === "/v1/runs") {
+        const raw = await readBody(req);
+        let body = {};
+        try {
+          body = raw ? JSON.parse(raw) : {};
+        } catch {
+          sendJson(res, 400, { ok: false, error: "invalid JSON body" });
+          return;
+        }
+        const prompt = String(body.prompt ?? body.task ?? "").trim();
+        const mode = String(body.mode ?? "agent");
+        const phase2 = String(body.phase ?? "build");
+        const cwdArg = body.cwd != null ? String(body.cwd) : body.projectId != null ? String(body.projectId) : null;
+        const resolved = resolveProjectPath(projects, cwdArg);
+        if (!resolved.ok) {
+          sendJson(res, 400, { ok: false, error: resolved.error });
+          return;
+        }
+        const history2 = Array.isArray(body.history) ? body.history : void 0;
+        const result = runs.start({
+          prompt,
+          mode,
+          phase: phase2,
+          cwd: resolved.project.path,
+          provider: body.provider != null ? String(body.provider) : void 0,
+          model: body.model != null ? String(body.model) : void 0,
+          history: history2
+        });
+        if (!result.ok) {
+          sendJson(res, 409, { ok: false, error: result.error });
+          return;
+        }
+        sendJson(res, 201, {
+          ok: true,
+          run: {
+            id: result.run.id,
+            status: result.run.status,
+            mode: result.run.mode,
+            phase: result.run.phase,
+            cwd: result.run.cwd,
+            createdAt: result.run.createdAt
+          },
+          eventsUrl: `/v1/runs/${result.run.id}/events`,
+          cancelUrl: `/v1/runs/${result.run.id}/cancel`
+        });
+        return;
+      }
+      const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path40);
+      if (req.method === "GET" && eventsMatch) {
+        const runId = eventsMatch[1];
+        const run = runs.getRun(runId);
+        if (!run) {
+          sendJson(res, 404, { ok: false, error: "run not found" });
+          return;
+        }
+        res.writeHead(200, {
+          "content-type": "text/event-stream; charset=utf-8",
+          "cache-control": "no-cache, no-transform",
+          connection: "keep-alive",
+          "access-control-allow-origin": "*",
+          "access-control-allow-headers": "authorization, content-type"
+        });
+        res.write(`: connected run=${runId}
+
+`);
+        const writeEv = (ev) => {
+          try {
+            res.write(`data: ${JSON.stringify(ev)}
+
+`);
+          } catch {
+          }
+        };
+        const unsub = runs.subscribe(runId, writeEv);
+        if (run.status !== "running" && run.status !== "queued") {
+          writeEv({
+            type: "run_finished",
+            runId,
+            status: run.status,
+            exitCode: run.exitCode ?? null
+          });
+          unsub();
+          res.end();
+          return;
+        }
+        const heartbeat = setInterval(() => {
+          try {
+            res.write(`: ping
+
+`);
+          } catch {
+          }
+        }, 15e3);
+        const onClose = () => {
+          clearInterval(heartbeat);
+          unsub();
+        };
+        req.on("close", onClose);
+        const check2 = setInterval(() => {
+          const r = runs.getRun(runId);
+          if (!r || r.status !== "running" && r.status !== "queued") {
+            clearInterval(check2);
+            clearInterval(heartbeat);
+            unsub();
+            try {
+              res.end();
+            } catch {
+            }
+          }
+        }, 500);
+        return;
+      }
+      const cancelMatch = /^\/v1\/runs\/([^/]+)\/cancel$/.exec(path40);
+      if (req.method === "POST" && cancelMatch) {
+        const runId = cancelMatch[1];
+        const result = runs.cancel(runId);
+        if (!result.ok) {
+          sendJson(res, 404, { ok: false, error: result.error });
+          return;
+        }
+        sendJson(res, 200, { ok: true, cancelled: runId });
+        return;
+      }
+      sendJson(res, 404, { ok: false, error: "not found" });
+    } catch (err) {
+      sendJson(res, 500, {
+        ok: false,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(port, bind, () => resolveListen());
+  });
+  server.ref();
+  try {
+    process.stdin?.resume?.();
+  } catch {
+  }
+  const tokenHint = created ? `NEW token saved to ~/.zelari-code/companion.token` : `token: ~/.zelari-code/companion.token`;
+  const displayHost = bind === "0.0.0.0" || bind === "::" ? "127.0.0.1 (and LAN/Tailscale interfaces)" : bind;
+  process.stderr.write(
+    `
+[zelari-code serve] companion host listening
+  URL     http://${displayHost === "127.0.0.1 (and LAN/Tailscale interfaces)" ? "127.0.0.1" : bind}:${port}
+  Bind    ${bind}
+  Health  GET /health
+  Auth    Authorization: Bearer <token>
+  ${tokenHint}
+  Projects (${projects.length}): ${projects.map((p3) => p3.id).join(", ")}
+  Phone   use http://<PC-LAN-or-Tailscale-IP>:${port}  (not 127.0.0.1 on the phone)
+  Stop    Ctrl+C  (keep this window open)
+
+`
+  );
+  if (created) {
+    process.stderr.write(`  Token (copy now): ${token}
+
+`);
+  }
+  await new Promise((resolveStop) => {
+    let stopped = false;
+    const stop = (sig) => {
+      if (stopped) return;
+      stopped = true;
+      process.stderr.write(`[zelari-code serve] shutting down (${sig})\u2026
+`);
+      try {
+        runs.cancel();
+      } catch {
+      }
+      server.close(() => resolveStop());
+      setTimeout(() => resolveStop(), 3e3).unref();
+    };
+    process.once("SIGINT", () => stop("SIGINT"));
+    process.once("SIGTERM", () => stop("SIGTERM"));
+    process.once("SIGHUP", () => stop("SIGHUP"));
+  });
+}
+function parseServeFlags(argv) {
+  if (!argv.includes("serve") && !argv.includes("--serve")) {
+    return null;
+  }
+  const get = (flag) => {
+    const i = argv.indexOf(flag);
+    return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+  };
+  const projects = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--project" && argv[i + 1]) {
+      projects.push(argv[i + 1]);
+      i++;
+    }
+  }
+  const portRaw = get("--port");
+  const port = portRaw ? Number.parseInt(portRaw, 10) : void 0;
+  return {
+    bind: get("--bind"),
+    port: Number.isFinite(port) ? port : void 0,
+    token: get("--token"),
+    projects,
+    persistProjects: argv.includes("--save-projects")
+  };
+}
+var init_serve = __esm({
+  "src/cli/companion/serve.ts"() {
+    "use strict";
+    init_updater();
+    init_desktopConfig();
+    init_config();
+    init_runManager();
+  }
+});
+
 // src/cli/utils/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
   runDoctor: () => runDoctor
 });
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync38, readFileSync as readFileSync31, readlinkSync, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync42, readFileSync as readFileSync34, readlinkSync, statSync as statSync7 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import path37 from "node:path";
+import path39 from "node:path";
 function findPackageRoot(start) {
   let dir = start;
   for (let i = 0; i < 6; i += 1) {
-    const candidate = path37.join(dir, "package.json");
-    if (existsSync38(candidate)) {
+    const candidate = path39.join(dir, "package.json");
+    if (existsSync42(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync31(candidate, "utf8"));
+        const pkg = JSON.parse(readFileSync34(candidate, "utf8"));
         if (pkg.name === "zelari-code") return dir;
       } catch {
       }
     }
-    const parent = path37.dirname(dir);
+    const parent = path39.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return path37.resolve(__dirname3, "..", "..", "..");
+  return path39.resolve(__dirname3, "..", "..", "..");
 }
 function tryExec(cmd) {
   try {
@@ -34396,8 +36081,8 @@ function tryExec(cmd) {
 }
 function readPackageJson3() {
   try {
-    const pkgPath = path37.join(packageRoot, "package.json");
-    return JSON.parse(readFileSync31(pkgPath, "utf8"));
+    const pkgPath = path39.join(packageRoot, "package.json");
+    return JSON.parse(readFileSync34(pkgPath, "utf8"));
   } catch {
     return null;
   }
@@ -34412,17 +36097,17 @@ function checkShim(pkgName) {
   }
   const isWin = process.platform === "win32";
   const shimName = isWin ? "zelari-code.cmd" : "zelari-code";
-  const shimPath = path37.join(prefix, shimName);
-  if (!existsSync38(shimPath)) {
+  const shimPath = path39.join(prefix, shimName);
+  if (!existsSync42(shimPath)) {
     return FAIL(
       `shim not found at ${shimPath}
          fix:  npm install -g ${pkgName}@latest --force`
     );
   }
   try {
-    const st = statSync6(shimPath);
+    const st = statSync7(shimPath);
     if (isWin) {
-      const content = readFileSync31(shimPath, "utf8");
+      const content = readFileSync34(shimPath, "utf8");
       if (content.includes(`${pkgName}\\bin\\`) || content.includes(`${pkgName}/bin/`)) {
         return OK(`shim OK at ${shimPath} (${st.size} bytes)`);
       }
@@ -34440,8 +36125,8 @@ function checkShim(pkgName) {
          fix:  npm install -g ${pkgName}@latest --force`
       );
     }
-    const resolved = path37.resolve(path37.dirname(shimPath), target);
-    const expected = path37.join(
+    const resolved = path39.resolve(path39.dirname(shimPath), target);
+    const expected = path39.join(
       prefix,
       "node_modules",
       pkgName,
@@ -34480,15 +36165,15 @@ function checkNode(pkg) {
   return OK(`node ${raw}`);
 }
 function checkBundle() {
-  const bundle = path37.join(packageRoot, "dist", "cli", "main.bundled.js");
-  if (!existsSync38(bundle)) {
+  const bundle = path39.join(packageRoot, "dist", "cli", "main.bundled.js");
+  if (!existsSync42(bundle)) {
     return FAIL(
       `dist/cli/main.bundled.js missing at ${bundle}
          fix:  npm run build:cli   (then reinstall or run via tsx)`
     );
   }
   try {
-    const st = statSync6(bundle);
+    const st = statSync7(bundle);
     return OK(`bundle OK (${(st.size / 1024 / 1024).toFixed(2)} MB)`);
   } catch (err) {
     return FAIL(
@@ -34501,7 +36186,7 @@ function checkRuntimeDeps() {
   const missing = [];
   for (const dep of required2) {
     try {
-      const localReq = createRequire3(path37.join(packageRoot, "package.json"));
+      const localReq = createRequire3(path39.join(packageRoot, "package.json"));
       localReq.resolve(dep);
     } catch {
       missing.push(dep);
@@ -34677,7 +36362,7 @@ var init_doctor = __esm({
     "use strict";
     init_prereqChecks();
     require3 = createRequire3(import.meta.url);
-    __dirname3 = path37.dirname(fileURLToPath2(import.meta.url));
+    __dirname3 = path39.dirname(fileURLToPath2(import.meta.url));
     packageRoot = findPackageRoot(__dirname3);
     OK = (message) => ({
       ok: true,
@@ -34880,7 +36565,7 @@ function InputBarImpl({ value, onChange, onSubmit, disabled }) {
       value,
       onChange: stableChange,
       onSubmit: stableSubmit,
-      placeholder: disabled ? "..." : "Type a prompt or /skill <name>"
+      placeholder: disabled ? "..." : "Prompt, /skills, or @path"
     }
   ));
 }
@@ -35285,83 +36970,7 @@ function StreamingTail(m) {
 // src/cli/components/StatusBar.tsx
 import React6 from "react";
 import { Box as Box5, Text as Text6 } from "ink";
-
-// src/cli/modelPricing.ts
-var PRICES_PER_MILLION = {
-  // xAI Grok (list prices; grok-4.5 default reasoning_effort is "high")
-  "grok-4.5": { input: 2, output: 6, cachedInput: 0.5 },
-  "grok-4.3": { input: 1.25, output: 2.5, cachedInput: 0.2 },
-  "grok-4": { input: 3, output: 15 },
-  "grok-4-fast": { input: 0.2, output: 0.5 },
-  "grok-3": { input: 3, output: 15 },
-  "grok-3-mini": { input: 0.3, output: 0.5 },
-  "grok-2-vision": { input: 2, output: 10 },
-  // GLM / Z.AI
-  "glm-4.6": { input: 0.6, output: 2.2 },
-  "glm-4.5": { input: 0.5, output: 2 },
-  "glm-4.5-air": { input: 0.1, output: 0.6 },
-  "glm-z1": { input: 0.5, output: 2 },
-  // MiniMax
-  "MiniMax-M2.5": { input: 0.2, output: 1.1 },
-  "MiniMax-M2": { input: 0.2, output: 1.1 },
-  "MiniMax-M2-her": { input: 0.3, output: 1.2 },
-  // DeepSeek (global platform) — estimated list prices; override via
-  // ANATHEMA_PRICE_DEEPSEEK_V4_FLASH / ANATHEMA_PRICE_DEEPSEEK_V4_PRO.
-  // DeepSeek prompt-cache hits are ~10× cheaper than a cache miss.
-  "deepseek-v4-flash": { input: 0.14, output: 0.28, cachedInput: 0.014 },
-  "deepseek-v4-pro": { input: 0.55, output: 2.19, cachedInput: 0.055 },
-  // OpenAI (for openai-compatible fallback)
-  "gpt-4o": { input: 2.5, output: 10 },
-  "gpt-4o-mini": { input: 0.15, output: 0.6 },
-  "gpt-4-turbo": { input: 10, output: 30 },
-  "o1-preview": { input: 15, output: 60 },
-  "o1-mini": { input: 3, output: 12 }
-};
-var DEFAULT_RATE = { input: 1, output: 3 };
-var DEFAULT_CACHE_DISCOUNT = 0.25;
-function envOverride(model) {
-  const key = `ANATHEMA_PRICE_${model.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
-  const raw = process.env[key] ?? process.env.ANATHEMA_PRICE_DEFAULT;
-  return parseRateOverride(raw);
-}
-function parseRateOverride(raw) {
-  if (!raw) return null;
-  const [inStr, outStr] = raw.split("/");
-  const input = Number.parseFloat(inStr);
-  const output = outStr !== void 0 ? Number.parseFloat(outStr) : input;
-  if (!Number.isFinite(input) || !Number.isFinite(output)) return null;
-  return { input, output };
-}
-function getModelRate(model) {
-  if (!model) return DEFAULT_RATE;
-  return envOverride(model) ?? PRICES_PER_MILLION[model] ?? DEFAULT_RATE;
-}
-function calculateCost(model, promptTokens, completionTokens, cachedPromptTokens = 0) {
-  if (!Number.isFinite(promptTokens) || promptTokens < 0) return 0;
-  if (!Number.isFinite(completionTokens) || completionTokens < 0) return 0;
-  const rate = getModelRate(model);
-  const cached2 = Number.isFinite(cachedPromptTokens) && cachedPromptTokens > 0 ? Math.min(cachedPromptTokens, promptTokens) : 0;
-  const uncachedPrompt = promptTokens - cached2;
-  const cachedRate = rate.cachedInput ?? rate.input * DEFAULT_CACHE_DISCOUNT;
-  const inputCost = uncachedPrompt / 1e6 * rate.input + cached2 / 1e6 * cachedRate;
-  const outputCost = completionTokens / 1e6 * rate.output;
-  return Number((inputCost + outputCost).toFixed(6));
-}
-function formatCost(usd) {
-  if (!Number.isFinite(usd) || usd < 0) return "$0.0000";
-  if (usd === 0) return "$0.0000";
-  if (usd < 1e-4) return "<$0.0001";
-  return `$${usd.toFixed(4)}`;
-}
-function formatTokens(tokens) {
-  if (!Number.isFinite(tokens) || tokens < 0) return "0";
-  if (tokens < 1e3) return `${tokens}`;
-  if (tokens < 1e6) return `${(tokens / 1e3).toFixed(1)}k`;
-  if (tokens < 1e9) return `${(tokens / 1e6).toFixed(2)}M`;
-  return `${(tokens / 1e9).toFixed(2)}B`;
-}
-
-// src/cli/components/StatusBar.tsx
+init_modelPricing();
 function StatusBar({
   model,
   provider,
@@ -35507,175 +37116,8 @@ function StartupBanner({
   return /* @__PURE__ */ React9.createElement(Box8, { flexDirection: "column", marginBottom: 1 }, /* @__PURE__ */ React9.createElement(Text9, { color: "cyan" }, "zelari-code v", version2, " \u2014 ", providerId, "/", model), /* @__PURE__ */ React9.createElement(Text9, { dimColor: true }, "cwd: ", cwd), /* @__PURE__ */ React9.createElement(Text9, { dimColor: true }, "/help \xB7 /plan \xB7 /build \xB7 /view-plan \xB7 shift+tab mode"));
 }
 
-// src/cli/modelDiscovery.ts
-import { promises as fs3, existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { homedir } from "node:os";
-import path4 from "node:path";
-var PROVIDER_BASE_URLS = {
-  "grok": "https://api.x.ai/v1",
-  // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
-  "glm": "https://api.z.ai/api/coding/paas/v4",
-  "minimax": "https://api.minimax.io/v1",
-  // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
-  "deepseek": "https://api.deepseek.com",
-  "openai-compatible": "https://api.x.ai/v1"
-};
-async function resolveDiscoveryBaseUrl(provider, options) {
-  if (options.baseUrl) return options.baseUrl;
-  const { getCustomEndpoint: getCustomEndpoint2 } = await Promise.resolve().then(() => (init_providerConfig(), providerConfig_exports));
-  const custom2 = getCustomEndpoint2(provider);
-  if (custom2) return custom2;
-  if (provider === "openai-compatible") {
-    const envBase = process.env.OPENAI_BASE_URL;
-    if (envBase && envBase.trim().length > 0) return envBase;
-  }
-  return PROVIDER_BASE_URLS[provider];
-}
-function defaultModelsFilePath() {
-  return process.env.ANATHEMA_MODELS_FILE ?? path4.join(homedir(), ".tmp", "zelari-code", "models.json");
-}
-function getModelsFilePath() {
-  return defaultModelsFilePath();
-}
-function loadModelsRegistry(file2 = getModelsFilePath()) {
-  if (!existsSync3(file2)) return {};
-  try {
-    const raw = readFileSync3(file2, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object") return {};
-    return parsed;
-  } catch {
-    return {};
-  }
-}
-function getCachedModels(provider, file2 = getModelsFilePath()) {
-  const registry3 = loadModelsRegistry(file2);
-  return registry3[provider];
-}
-function isModelsCacheStale(provider, maxAgeMs = 6 * 60 * 60 * 1e3, file2 = getModelsFilePath(), now = Date.now()) {
-  const entry = getCachedModels(provider, file2);
-  if (!entry) return true;
-  return now - entry.fetchedAt > maxAgeMs;
-}
-var writeChain = Promise.resolve();
-async function withRegistryLock(fn) {
-  const next = writeChain.then(async () => fn());
-  writeChain = next.catch(() => void 0);
-  return next;
-}
-async function readModifyWriteRegistry(mutator, file2 = getModelsFilePath()) {
-  return withRegistryLock(async () => {
-    const onDisk = loadModelsRegistry(file2);
-    const merged = mutator(onDisk);
-    await fs3.mkdir(path4.dirname(file2), { recursive: true });
-    const tmp = `${file2}.tmp-${process.pid}-${Date.now()}`;
-    await fs3.writeFile(tmp, JSON.stringify(merged, null, 2), "utf-8");
-    await fs3.rename(tmp, file2);
-    return merged;
-  });
-}
-async function resolveAuthToken(provider, options) {
-  if (options.authToken) return options.authToken;
-  const { resolveApiKeyWithMeta: resolveApiKeyWithMeta2, getOAuthToken: getOAuthToken2 } = await Promise.resolve().then(() => (init_keyStore(), keyStore_exports));
-  if (provider === "grok") {
-    const oauth = getOAuthToken2("grok");
-    if (oauth?.apiKey) return oauth.apiKey;
-  }
-  const resolved = await resolveApiKeyWithMeta2(provider);
-  return resolved?.apiKey;
-}
-function parseOpenAIModelsResponse(json2, baseUrl) {
-  if (!json2 || typeof json2 !== "object") return [];
-  const obj = json2;
-  if (!Array.isArray(obj.data)) return [];
-  const models = [];
-  for (const m of obj.data) {
-    if (!m || typeof m.id !== "string") continue;
-    const out = { id: m.id };
-    if (typeof m.created === "number") out.created = m.created;
-    if (typeof m.owned_by === "string") out.ownedBy = m.owned_by;
-    const ctx = m.context_length;
-    if (typeof ctx === "number") out.contextLength = ctx;
-    models.push(out);
-  }
-  models.sort((a, b) => a.id.localeCompare(b.id));
-  return models;
-}
-async function discoverModelsForProvider(provider, options = {}) {
-  const baseUrl = await resolveDiscoveryBaseUrl(provider, options);
-  if (!baseUrl || baseUrl.trim().length === 0) {
-    throw new ModelDiscoveryError(
-      `No base URL for provider "${provider}" \u2014 set one with /provider custom <url> before discovering models`,
-      "no_base_url"
-    );
-  }
-  const url2 = `${baseUrl.replace(/\/$/, "")}/models`;
-  const authToken = await resolveAuthToken(provider, options);
-  const fetchImpl = options.fetchImpl ?? fetch;
-  let response;
-  try {
-    const headers = { Accept: "application/json" };
-    if (authToken) headers.Authorization = `Bearer ${authToken}`;
-    response = await fetchImpl(url2, { method: "GET", headers });
-  } catch (err) {
-    throw new ModelDiscoveryError(
-      `Network error contacting ${url2}: ${err instanceof Error ? err.message : String(err)}`,
-      "network_error"
-    );
-  }
-  if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new ModelDiscoveryError(
-      `HTTP ${response.status} from ${url2}: ${body.slice(0, 200)}`,
-      `http_${response.status}`
-    );
-  }
-  let json2;
-  try {
-    json2 = await response.json();
-  } catch (err) {
-    throw new ModelDiscoveryError(
-      `Invalid JSON from ${url2}: ${err instanceof Error ? err.message : String(err)}`,
-      "invalid_json"
-    );
-  }
-  const models = parseOpenAIModelsResponse(json2, baseUrl);
-  if (models.length === 0) {
-    throw new ModelDiscoveryError(
-      `Provider ${provider} returned 0 models \u2014 refusing to overwrite cache`,
-      "empty_response"
-    );
-  }
-  const entry = {
-    models,
-    fetchedAt: Date.now(),
-    baseUrl
-  };
-  if (!options.skipCacheWrite) {
-    const file2 = getModelsFilePath();
-    await readModifyWriteRegistry((current) => {
-      current[provider] = entry;
-      return current;
-    }, file2);
-  }
-  return entry;
-}
-function discoverModelsInBackground(provider, options = {}) {
-  discoverModelsForProvider(provider, options).catch((err) => {
-    if (err instanceof ModelDiscoveryError && options.onError) {
-      options.onError(err);
-    }
-  });
-}
-var ModelDiscoveryError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ModelDiscoveryError";
-  }
-};
-
 // src/cli/app.tsx
+init_modelDiscovery();
 init_skills2();
 
 // src/cli/hooks/useGitChanges.ts
@@ -35736,12 +37178,12 @@ function mergeChanges(unstaged, staged, untrackedPaths) {
   return [...byPath.values()].sort((a, b) => churn(b) - churn(a));
 }
 function runGit(args, cwd) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     execFile(
       "git",
       args,
       { cwd, timeout: 5e3, windowsHide: true, maxBuffer: 4 * 1024 * 1024 },
-      (err, stdout) => err ? reject(err) : resolve(stdout)
+      (err, stdout) => err ? reject(err) : resolve3(stdout)
     );
   });
 }
@@ -38391,12 +39833,12 @@ var MetricsLogger = class {
   }
   /** Append a single record synchronously (file I/O). */
   append(rec) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       try {
         this.maybeRotate();
         const line = JSON.stringify(rec) + "\n";
         appendFileSync(this.file, line, { encoding: "utf-8" });
-        resolve();
+        resolve3();
       } catch (err) {
         reject(err);
       }
@@ -38540,7 +39982,7 @@ init_toolRegistry();
 init_toolPermissions();
 function createPermissionAskHandler(opts) {
   const { setPicker: setPicker2, appendSystem: appendSystem2 } = opts;
-  return (req) => new Promise((resolve) => {
+  return (req) => new Promise((resolve3) => {
     const cats = req.categories;
     const catLabel = cats.length === 1 ? cats[0] : cats.join("+") || "action";
     const title = `Allow tool "${req.toolName}"?`;
@@ -38557,7 +39999,7 @@ ${detail}
       settled = true;
       setPicker2(null);
       if (note) appendSystem2?.(note, Date.now());
-      resolve(ok);
+      resolve3(ok);
     };
     const items = [
       { value: "allow", label: "Allow once" },
@@ -38705,6 +40147,9 @@ function finalizeStreamingAssistant(setMessages) {
 // src/cli/hooks/useChatTurn.ts
 init_conversationContext();
 
+// src/cli/hooks/chatStats.ts
+init_modelPricing();
+
 // src/cli/state/promptCacheStats.ts
 function emptyPromptCacheStats() {
   return {
@@ -38948,10 +40393,10 @@ function useChatTurn(params) {
         }
         setBusy(true);
         const workPhase = getPhase();
-        const onAskUser = setPicker2 ? (req) => new Promise((resolve) => {
+        const onAskUser = setPicker2 ? (req) => new Promise((resolve3) => {
           const choices = req.choices ?? [];
           if (choices.length < 2) {
-            resolve(null);
+            resolve3(null);
             return;
           }
           setLastClarification({
@@ -38972,7 +40417,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
             if (settled) return;
             settled = true;
             setPicker2(null);
-            resolve(value);
+            resolve3(value);
           };
           setPicker2({
             kind: "clarification",
@@ -39568,10 +41013,10 @@ async function dispatchCouncilPromptImpl(text, deps, overrides = {}) {
   const { composeProjectContext: composeProjectContext2 } = await Promise.resolve().then(() => (init_composeContext(), composeContext_exports));
   const { FeedbackStore: FeedbackStore2 } = await Promise.resolve().then(() => (init_councilFeedback(), councilFeedback_exports));
   const workPhase = getPhase();
-  const onAskUserCouncil = setPicker2 ? (req) => new Promise((resolve) => {
+  const onAskUserCouncil = setPicker2 ? (req) => new Promise((resolve3) => {
     const choices = req.choices ?? [];
     if (choices.length < 2) {
-      resolve(null);
+      resolve3(null);
       return;
     }
     setLastClarification({
@@ -39592,7 +41037,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
       if (settled) return;
       settled = true;
       setPicker2(null);
-      resolve(value);
+      resolve3(value);
     };
     setPicker2({
       kind: "clarification",
@@ -39721,10 +41166,10 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
         appendSystem(setMessages, message, Date.now());
       },
       // v1.8.0: pause council when a member asks a structured question.
-      onClarification: setPicker2 ? (req) => new Promise((resolve) => {
+      onClarification: setPicker2 ? (req) => new Promise((resolve3) => {
         const choices = req.choices ?? [];
         if (choices.length < 2) {
-          resolve(null);
+          resolve3(null);
           return;
         }
         setLastClarification({
@@ -39745,7 +41190,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
           if (settled) return;
           settled = true;
           setPicker2(null);
-          resolve(value);
+          resolve3(value);
         };
         setPicker2({
           kind: "clarification",
@@ -40357,7 +41802,8 @@ function handleSlashCommand(text, availableSkills) {
   /provider <name> \u2014 switch the active provider directly
   /provider custom <baseUrl> \u2014 point the active provider at a self-hosted endpoint (Ollama, LM Studio, vLLM, ...)
   /provider custom clear \u2014 clear the custom endpoint override
-  /skill <name> [input] \u2014 invoke a skill (autocomplete with /skill <TAB>)
+  /skill [name] [input] \u2014 list+pick a skill (no args) or invoke /skill <name>
+  /skills \u2014 interactive skill picker (same as /skill with no args)
   /skill-stats [name] \u2014 show invocation stats (success rate, avg duration, total tokens)
   /council <input> \u2014 invoke the multi-agent council on input
   /zelari <input> \u2014 run an autonomous mission (multi-run council until the MVP slice is complete)
@@ -40605,13 +42051,19 @@ ${formatSkillList(availableSkills)}`
         ...note ? { feedbackNote: note } : {}
       };
     }
+    case "skills": {
+      return {
+        handled: true,
+        kind: "skill_picker",
+        message: formatSkillList(availableSkills)
+      };
+    }
     case "skill": {
       const skillId = args[0];
       if (!skillId) {
         return {
           handled: true,
-          kind: "skill",
-          skillError: "Usage: /skill <name> [input]",
+          kind: "skill_picker",
           message: formatSkillList(availableSkills)
         };
       }
@@ -40620,7 +42072,7 @@ ${formatSkillList(availableSkills)}`
         return {
           handled: true,
           kind: "skill",
-          skillError: `Unknown skill: "${skillId}". Use /skill <TAB> for autocomplete.`,
+          skillError: `Unknown skill: "${skillId}". Use /skills to pick one.`,
           message: formatSkillList(availableSkills)
         };
       }
@@ -40628,7 +42080,8 @@ ${formatSkillList(availableSkills)}`
       const expandedSkill = expandSkillTemplate(skill, { input });
       return { handled: true, kind: "skill", expandedSkill };
     }
-    case "skill_stats": {
+    case "skill_stats":
+    case "skill-stats": {
       const skillId = args[0];
       return {
         handled: true,
@@ -40904,7 +42357,7 @@ ${formatSkillList(availableSkills)}`
 // src/cli/gitOps.ts
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import path30 from "node:path";
+import path31 from "node:path";
 var execFileAsync2 = promisify2(execFile3);
 async function git2(cwd, args) {
   try {
@@ -40950,7 +42403,7 @@ async function undoWorkingChanges(opts = {}) {
   };
 }
 function defaultProjectRoot() {
-  return path30.resolve(__dirname, "..", "..", "..");
+  return path31.resolve(__dirname, "..", "..", "..");
 }
 
 // src/cli/slashHandlers/git.ts
@@ -41474,7 +42927,7 @@ ${browsers.output}` : "") + (browsers.ok ? "" : `
   return result;
 }
 function runPlaywrightInstallChromium(cwd, executor) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -41487,7 +42940,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve({
+      resolve3({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -41496,7 +42949,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve({
+      resolve3({
         ok,
         output: stdout + stderr,
         exitCode: code,
@@ -41506,7 +42959,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
   });
 }
 function runNpm2(executor, args, cwd, mode, npmCliPath) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -41518,7 +42971,7 @@ function runNpm2(executor, args, cwd, mode, npmCliPath) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve({
+      resolve3({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -41527,7 +42980,7 @@ function runNpm2(executor, args, cwd, mode, npmCliPath) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve({
+      resolve3({
         ok,
         output: stdout + stderr,
         exitCode: code,
@@ -41590,17 +43043,17 @@ ${result.output.split("\n").slice(-8).join("\n")}` : "";
 }
 
 // src/cli/slashHandlers/promoteMember.ts
-import { promises as fs18 } from "node:fs";
-import path33 from "node:path";
+import { promises as fs19 } from "node:fs";
+import path34 from "node:path";
 import os10 from "node:os";
 async function handlePromoteMember(ctx, memberId) {
   try {
     const { promoteMember: promoteMember2 } = await Promise.resolve().then(() => (init_council(), council_exports));
     const { skill, markdown } = promoteMember2(memberId);
-    const skillDir = process.env.ANATHEMA_SKILL_DIR ?? path33.join(os10.homedir(), ".tmp", "zelari-code", "skills");
-    await fs18.mkdir(skillDir, { recursive: true });
-    const filePath = path33.join(skillDir, `${skill.id}.md`);
-    await fs18.writeFile(filePath, markdown, "utf8");
+    const skillDir = process.env.ANATHEMA_SKILL_DIR ?? path34.join(os10.homedir(), ".tmp", "zelari-code", "skills");
+    await fs19.mkdir(skillDir, { recursive: true });
+    const filePath = path34.join(skillDir, `${skill.id}.md`);
+    await fs19.writeFile(filePath, markdown, "utf8");
     appendSystem(
       ctx.setMessages,
       `[promote-member] ${skill.name} (${memberId}) \u2192 ${filePath}
@@ -41616,25 +43069,25 @@ async function handlePromoteMember(ctx, memberId) {
 }
 
 // src/cli/branchManager.ts
-import { promises as fs19, existsSync as existsSync35, readFileSync as readFileSync29, writeFileSync as writeFileSync19, mkdirSync as mkdirSync14, statSync as statSync4, rmSync as rmSync2 } from "node:fs";
-import path34 from "node:path";
+import { promises as fs20, existsSync as existsSync35, readFileSync as readFileSync29, writeFileSync as writeFileSync19, mkdirSync as mkdirSync14, statSync as statSync4, rmSync as rmSync2 } from "node:fs";
+import path35 from "node:path";
 import os11 from "node:os";
 var META_FILENAME = "meta.json";
 var SESSIONS_SUBDIR = "sessions";
 function getBranchesBaseDir() {
-  return process.env.ANATHEMA_BRANCHES_DIR ?? path34.join(os11.homedir(), ".tmp", "zelari-code", "branches");
+  return process.env.ANATHEMA_BRANCHES_DIR ?? path35.join(os11.homedir(), ".tmp", "zelari-code", "branches");
 }
 function getSessionsBaseDir() {
-  return process.env.ANATHEMA_SESSIONS_DIR ?? path34.join(os11.homedir(), ".tmp", "zelari-code", "sessions");
+  return process.env.ANATHEMA_SESSIONS_DIR ?? path35.join(os11.homedir(), ".tmp", "zelari-code", "sessions");
 }
 function branchPathFor(name, baseDir) {
-  return path34.join(baseDir, name);
+  return path35.join(baseDir, name);
 }
 function metaPathFor(name, baseDir) {
-  return path34.join(baseDir, name, META_FILENAME);
+  return path35.join(baseDir, name, META_FILENAME);
 }
 function sessionsPathFor(name, baseDir) {
-  return path34.join(baseDir, name, SESSIONS_SUBDIR);
+  return path35.join(baseDir, name, SESSIONS_SUBDIR);
 }
 function readBranchMeta(name, baseDir) {
   const metaPath = metaPathFor(name, baseDir);
@@ -41659,13 +43112,13 @@ function readBranchMeta(name, baseDir) {
 }
 function writeBranchMeta(name, baseDir, meta3) {
   const metaPath = metaPathFor(name, baseDir);
-  mkdirSync14(path34.dirname(metaPath), { recursive: true });
+  mkdirSync14(path35.dirname(metaPath), { recursive: true });
   writeFileSync19(metaPath, JSON.stringify(meta3, null, 2), "utf-8");
 }
 async function countSessions(name, baseDir) {
   const sessionsPath = sessionsPathFor(name, baseDir);
   try {
-    const entries = await fs19.readdir(sessionsPath);
+    const entries = await fs20.readdir(sessionsPath);
     return entries.filter((e) => e.endsWith(".jsonl")).length;
   } catch (err) {
     if (err.code === "ENOENT") return 0;
@@ -41710,15 +43163,15 @@ async function createBranch(name, fromSessionId, baseDir = getBranchesBaseDir(),
   if (branchExists(name, baseDir)) {
     throw new BranchAlreadyExistsError(name);
   }
-  const sourcePath = path34.join(sessionsBaseDir, `${fromSessionId}.jsonl`);
+  const sourcePath = path35.join(sessionsBaseDir, `${fromSessionId}.jsonl`);
   if (!existsSync35(sourcePath)) {
     throw new SessionNotFoundError(`Source session "${fromSessionId}" not found at ${sourcePath}`);
   }
   const branchPath = branchPathFor(name, baseDir);
   const branchSessionsPath = sessionsPathFor(name, baseDir);
   mkdirSync14(branchSessionsPath, { recursive: true });
-  const destPath = path34.join(branchSessionsPath, `${fromSessionId}.jsonl`);
-  await fs19.copyFile(sourcePath, destPath);
+  const destPath = path35.join(branchSessionsPath, `${fromSessionId}.jsonl`);
+  await fs20.copyFile(sourcePath, destPath);
   const meta3 = {
     name,
     createdAt: Date.now(),
@@ -41736,7 +43189,7 @@ async function createBranch(name, fromSessionId, baseDir = getBranchesBaseDir(),
 async function listBranches(baseDir = getBranchesBaseDir()) {
   let entries;
   try {
-    entries = await fs19.readdir(baseDir);
+    entries = await fs20.readdir(baseDir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -41817,26 +43270,26 @@ async function handleBranchCheckout(ctx, branchName) {
 }
 
 // src/cli/slashHandlers/workspace.ts
-import { promises as fs20 } from "node:fs";
-import path35 from "node:path";
+import { promises as fs21 } from "node:fs";
+import path36 from "node:path";
 async function handleWorkspaceShow(ctx, what) {
   try {
-    const zelari = path35.join(process.cwd(), ".zelari");
+    const zelari = path36.join(process.cwd(), ".zelari");
     let content;
     switch (what) {
       case "plan": {
-        const planPath = path35.join(zelari, "plan.md");
+        const planPath = path36.join(zelari, "plan.md");
         try {
-          content = await fs20.readFile(planPath, "utf-8");
+          content = await fs21.readFile(planPath, "utf-8");
         } catch {
           content = "(no plan.md yet \u2014 run a council session first)";
         }
         break;
       }
       case "decisions": {
-        const decisionsDir = path35.join(zelari, "decisions");
+        const decisionsDir = path36.join(zelari, "decisions");
         try {
-          const files = (await fs20.readdir(decisionsDir)).filter((f) => f.endsWith(".md")).sort();
+          const files = (await fs21.readdir(decisionsDir)).filter((f) => f.endsWith(".md")).sort();
           if (files.length === 0) {
             content = "(no ADRs yet \u2014 invoke /council to generate some)";
           } else {
@@ -41844,7 +43297,7 @@ async function handleWorkspaceShow(ctx, what) {
 `];
             const { parseFrontmatter: parseFrontmatter2 } = await Promise.resolve().then(() => (init_storage(), storage_exports));
             for (const f of files) {
-              const raw = await fs20.readFile(path35.join(decisionsDir, f), "utf-8");
+              const raw = await fs21.readFile(path36.join(decisionsDir, f), "utf-8");
               const { meta: meta3, body } = parseFrontmatter2(raw);
               const title = meta3.title ?? body.split("\n")[0]?.replace(/^#\s*/, "").trim() ?? f;
               lines.push(`- **${f.replace(/\.md$/, "")}** [${meta3.status ?? "unknown"}] ${title}`);
@@ -41857,27 +43310,27 @@ async function handleWorkspaceShow(ctx, what) {
         break;
       }
       case "risks": {
-        const risksPath = path35.join(zelari, "risks.md");
+        const risksPath = path36.join(zelari, "risks.md");
         try {
-          content = await fs20.readFile(risksPath, "utf-8");
+          content = await fs21.readFile(risksPath, "utf-8");
         } catch {
           content = "(no risks.md yet)";
         }
         break;
       }
       case "agents": {
-        const agentsPath = path35.join(process.cwd(), "AGENTS.MD");
+        const agentsPath = path36.join(process.cwd(), "AGENTS.MD");
         try {
-          content = await fs20.readFile(agentsPath, "utf-8");
+          content = await fs21.readFile(agentsPath, "utf-8");
         } catch {
           content = "(no AGENTS.MD yet at project root \u2014 run `/workspace sync` after a council session)";
         }
         break;
       }
       case "docs": {
-        const docsDir = path35.join(zelari, "docs");
+        const docsDir = path36.join(zelari, "docs");
         try {
-          const files = (await fs20.readdir(docsDir)).filter((f) => f.endsWith(".md")).sort();
+          const files = (await fs21.readdir(docsDir)).filter((f) => f.endsWith(".md")).sort();
           content = files.length ? `# Docs (${files.length})
 
 ` + files.map((f) => `- ${f}`).join("\n") : "(no docs drafts yet)";
@@ -41917,8 +43370,8 @@ async function handleWorkspaceReset(ctx, force) {
     return;
   }
   try {
-    const target = path35.join(process.cwd(), ".zelari");
-    await fs20.rm(target, { recursive: true, force: true });
+    const target = path36.join(process.cwd(), ".zelari");
+    await fs21.rm(target, { recursive: true, force: true });
     appendSystem(ctx.setMessages, "[workspace] .zelari/ removed");
   } catch (err) {
     appendSystem(ctx.setMessages, `[workspace reset error] ${err instanceof Error ? err.message : String(err)}`);
@@ -41980,6 +43433,7 @@ async function validateApiKey(providerId, apiKey, options = {}) {
 
 // src/cli/slashHandlers/provider.ts
 init_providerConfig();
+init_modelDiscovery();
 var UNKNOWN_PROVIDER_MSG = (id) => `[provider] unknown: ${id}. Available: openai-compatible, minimax, glm, grok, deepseek, custom`;
 var DISCOVERABLE_PROVIDERS = ["grok", "glm", "minimax", "deepseek", "openai-compatible"];
 function handleProviderList(ctx) {
@@ -42276,16 +43730,16 @@ function handleModelsRefresh(ctx) {
 }
 
 // src/cli/slashHandlers/skills.ts
-import path36 from "node:path";
+import path37 from "node:path";
 import os12 from "node:os";
 
 // src/cli/skillHistory.ts
-import { promises as fs21, existsSync as existsSync36, statSync as statSync5, renameSync as renameSync4, appendFileSync as appendFileSync3, mkdirSync as mkdirSync15 } from "node:fs";
+import { promises as fs22, existsSync as existsSync36, statSync as statSync5, renameSync as renameSync4, appendFileSync as appendFileSync3, mkdirSync as mkdirSync15 } from "node:fs";
 var SKILL_HISTORY_ROTATE_BYTES = 10 * 1024 * 1024;
 async function readSkillHistory(file2) {
   let raw = "";
   try {
-    raw = await fs21.readFile(file2, "utf-8");
+    raw = await fs22.readFile(file2, "utf-8");
   } catch {
     return [];
   }
@@ -42377,8 +43831,32 @@ async function applySteerInterrupt(options) {
 }
 
 // src/cli/slashHandlers/skills.ts
+function handleSkillPicker(ctx, skills, openPicker, fallbackMessage) {
+  if (!openPicker) {
+    appendSystem(
+      ctx.setMessages,
+      fallbackMessage ?? formatSkillList(skills)
+    );
+    return;
+  }
+  if (skills.length === 0) {
+    appendSystem(ctx.setMessages, "[skills] no skills registered");
+    return;
+  }
+  const items = [...skills].sort((a, b) => a.id.localeCompare(b.id)).map((s) => ({
+    value: s.id,
+    label: s.name || s.id,
+    hint: [s.category, s.estimatedCost, s.description?.slice(0, 60)].filter(Boolean).join(" \xB7 ")
+  }));
+  openPicker({
+    kind: "skill",
+    title: "Select a skill",
+    items,
+    commandPrefix: "/skill"
+  });
+}
 async function handleSkillStats(ctx, skillId) {
-  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path36.join(os12.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path37.join(os12.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
   try {
     const records = await readSkillHistory(historyFile);
     const stats = getSkillStats(records, skillId);
@@ -42394,7 +43872,7 @@ async function handleSkillCompare(ctx, ids, fallbackMessage) {
     appendSystem(ctx.setMessages, fallbackMessage ?? "[skill-compare] missing args");
     return;
   }
-  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path36.join(os12.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path37.join(os12.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
   try {
     const formatted = await compareSkillsFromFile(ids[0], ids[1], historyFile);
     appendSystem(ctx.setMessages, formatted);
@@ -42450,6 +43928,7 @@ function handleClearChat(setMessages, setSessionActive) {
 }
 
 // src/cli/hooks/useSlashDispatch.ts
+init_atMentions();
 function useSlashDispatch(params) {
   const {
     skills,
@@ -42490,19 +43969,27 @@ function useSlashDispatch(params) {
     const steerCtx = { ...skillCtx, harnessRef, setQueueCount, dispatchPrompt };
     const { onNewSession, onExit } = params;
     if (!result.handled) {
+      const expanded = expandAtMentions(value, process.cwd());
+      const promptText = expanded.text;
       appendUser(setMessages, value);
+      if (expanded.hits.length > 0) {
+        appendSystem(
+          setMessages,
+          `[tagged] ${expanded.hits.map((h) => h.path).join(", ")}`
+        );
+      }
       setSessionActive(true);
       if (mode === "zelari") {
         setInput("");
-        await dispatchZelariPrompt(value);
+        await dispatchZelariPrompt(promptText);
         return;
       }
       if (mode === "council") {
         setInput("");
-        await dispatchCouncilPrompt(value);
+        await dispatchCouncilPrompt(promptText);
         return;
       }
-      await dispatchPrompt(value);
+      await dispatchPrompt(promptText);
       setInput("");
       return;
     }
@@ -42852,11 +44339,20 @@ function useSlashDispatch(params) {
       setInput("");
       return;
     }
+    if (result.kind === "skill_picker") {
+      handleSkillPicker(skillCtx, skills, params.openPicker, result.message);
+      setInput("");
+      return;
+    }
     if (result.kind === "skill" && result.expandedSkill) {
       const sysMsg = result.message ?? `[skill] ${result.expandedSkill.skillId} \u2014 prompt ready (dispatch lands in Phase 14.7)`;
       appendSystem(setMessages, sysMsg);
       setInput("");
-      await dispatchPrompt(result.expandedSkill.prompt, {
+      const skillPrompt = expandAtMentions(
+        result.expandedSkill.prompt,
+        process.cwd()
+      ).text;
+      await dispatchPrompt(skillPrompt, {
         requiredTools: result.expandedSkill.requiredTools
       });
       return;
@@ -43507,9 +45003,9 @@ function ContinueKey({ onContinue }) {
 init_providerConfig();
 
 // src/cli/wizard/firstRun.ts
-import { existsSync as existsSync37 } from "node:fs";
+import { existsSync as existsSync38 } from "node:fs";
 function shouldRunWizard(input) {
-  const exists = input.exists ?? existsSync37;
+  const exists = input.exists ?? existsSync38;
   if (input.hasResetConfigFlag) {
     return { shouldRun: true, reason: "--reset-config flag forced wizard" };
   }
@@ -43794,7 +45290,7 @@ init_keyStore();
 init_providerConfig();
 init_openai_compatible();
 init_phase();
-import { readFileSync as readFileSync30 } from "node:fs";
+import { readFileSync as readFileSync31 } from "node:fs";
 function parseHeadlessFlags(argv) {
   if (!argv.includes("--headless")) {
     return { options: null };
@@ -43808,6 +45304,7 @@ function parseHeadlessFlags(argv) {
   let provider;
   let model;
   let history2;
+  let once = false;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--headless") continue;
@@ -43862,7 +45359,7 @@ function parseHeadlessFlags(argv) {
         let raw = null;
         if (arg === "--history-file") {
           try {
-            raw = readFileSync30(next, "utf-8");
+            raw = readFileSync31(next, "utf-8");
           } catch {
             raw = null;
           }
@@ -43896,6 +45393,8 @@ function parseHeadlessFlags(argv) {
         }
         i++;
       }
+    } else if (arg === "--once") {
+      once = true;
     }
   }
   if (councilFlag && !modeExplicit) {
@@ -43918,7 +45417,8 @@ function parseHeadlessFlags(argv) {
       useCouncil: mode === "council",
       provider,
       model,
-      ...history2 && history2.length > 0 ? { history: history2 } : {}
+      ...history2 && history2.length > 0 ? { history: history2 } : {},
+      ...once ? { once: true } : {}
     }
   };
 }
@@ -43989,6 +45489,17 @@ function createStreamScrubber() {
 
 // src/cli/runHeadless.ts
 async function runHeadless(opts) {
+  try {
+    const { expandAtMentions: expandAtMentions2 } = await Promise.resolve().then(() => (init_atMentions(), atMentions_exports));
+    const task = typeof opts.task === "string" ? opts.task : "";
+    if (task.includes("@")) {
+      const { text } = expandAtMentions2(task, process.cwd());
+      if (text !== task) {
+        opts = { ...opts, task: text };
+      }
+    }
+  } catch {
+  }
   let crashed = false;
   const handleFatal = (label, err) => {
     if (crashed) return;
@@ -44601,6 +46112,22 @@ ${JSON.stringify({ deliverable: brief.deliverableThisMission, mvp: brief.sliceMv
   }
   let exitCode = 0;
   let lastMissionAssistant = "";
+  let lockAcquired = false;
+  if (opts.once) {
+    const { acquireLock: acquireLock2 } = await Promise.resolve().then(() => (init_triggerLock(), triggerLock_exports));
+    const lockRes = await acquireLock2(projectRoot);
+    if (!lockRes.acquired) {
+      process.stderr.write(
+        `[zelari-code --once] skip: another mission is running (pid ${lockRes.heldBy}).
+`
+      );
+      return 0;
+    }
+    lockAcquired = true;
+    if (!process.env.ZELARI_MISSION_MAX_ITER) {
+      process.env.ZELARI_MISSION_MAX_ITER = "1";
+    }
+  }
   try {
     const state2 = await runZelariMission2(missionTask, brief, {
       projectRoot,
@@ -44819,6 +46346,10 @@ ${ragContext}` : slicePrompt;
     );
     return 2;
   } finally {
+    if (lockAcquired) {
+      const { releaseLock: releaseLock2 } = await Promise.resolve().then(() => (init_triggerLock(), triggerLock_exports));
+      await releaseLock2(projectRoot);
+    }
     await memory.close().catch(() => void 0);
   }
   if (opts.output === "json") {
@@ -44836,250 +46367,8 @@ ${ragContext}` : slicePrompt;
   return exitCode;
 }
 
-// src/cli/desktopConfig.ts
-init_keyStore();
-init_providerConfig();
-init_updater();
-function wantsPrintConfig(argv) {
-  return argv.includes("--print-config");
-}
-function wantsSetKey(argv) {
-  return argv.includes("--set-key");
-}
-function wantsDiscoverModels(argv) {
-  return argv.includes("--discover-models");
-}
-function parseSetConfigFlags(argv) {
-  if (!argv.includes("--set-config")) {
-    return { request: null };
-  }
-  let provider;
-  let model;
-  let endpoint;
-  let endpointClear = false;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--provider") {
-      provider = argv[i + 1];
-      i++;
-    } else if (arg === "--model") {
-      model = argv[i + 1];
-      i++;
-    } else if (arg === "--endpoint") {
-      endpoint = argv[i + 1];
-      i++;
-    } else if (arg === "--endpoint-clear") {
-      endpointClear = true;
-    }
-  }
-  if (!provider && !model && !endpoint && !endpointClear) {
-    return {
-      request: null,
-      error: "--set-config requires --provider, --model, --endpoint, and/or --endpoint-clear"
-    };
-  }
-  if (provider !== void 0 && provider.trim().length === 0) {
-    return { request: null, error: "--provider cannot be empty" };
-  }
-  if (model !== void 0 && model.trim().length === 0) {
-    return { request: null, error: "--model cannot be empty" };
-  }
-  if (endpoint !== void 0 && endpoint.trim().length === 0) {
-    return { request: null, error: "--endpoint cannot be empty" };
-  }
-  if (endpoint && endpointClear) {
-    return { request: null, error: "--endpoint and --endpoint-clear conflict" };
-  }
-  return {
-    request: {
-      provider: provider?.trim(),
-      model: model?.trim(),
-      endpoint: endpoint?.trim(),
-      endpointClear: endpointClear || void 0
-    }
-  };
-}
-function parseSetKeyFlags(argv) {
-  if (!argv.includes("--set-key")) {
-    return { request: null };
-  }
-  let provider;
-  let key;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--provider") {
-      provider = argv[i + 1];
-      i++;
-    } else if (arg === "--key") {
-      key = argv[i + 1];
-      i++;
-    }
-  }
-  if (!provider || provider.trim().length === 0) {
-    return { request: null, error: "--set-key requires --provider <id>" };
-  }
-  if (!key || key.trim().length === 0) {
-    return { request: null, error: "--set-key requires --key <secret>" };
-  }
-  return {
-    request: {
-      provider: provider.trim(),
-      key: key.trim()
-    }
-  };
-}
-function parseDiscoverModelsFlags(argv) {
-  if (!argv.includes("--discover-models")) {
-    return { provider: null, present: false };
-  }
-  let provider;
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === "--provider") {
-      provider = argv[i + 1];
-      i++;
-    }
-  }
-  return {
-    present: true,
-    provider: provider?.trim() || null
-  };
-}
-function buildDesktopConfigSnapshot() {
-  const config2 = getProviderConfig();
-  const providers = PROVIDERS.map((p3) => {
-    const cached2 = getCachedModels(p3.id);
-    const models = cached2?.models.map((m) => m.id) ?? [];
-    const defaultModel = config2.modelByProvider[p3.id] ?? "";
-    if (defaultModel && !models.includes(defaultModel)) {
-      models.unshift(defaultModel);
-    }
-    const custom2 = getCustomEndpoint(p3.id);
-    const builtin = p3.baseUrl ?? null;
-    return {
-      id: p3.id,
-      displayName: p3.displayName,
-      hasKey: !!resolveApiKey(p3.id),
-      envVar: p3.envVar,
-      models,
-      defaultModel,
-      endpoint: custom2 ?? null,
-      baseUrl: custom2 ?? builtin
-    };
-  });
-  return {
-    activeProviderId: config2.activeProviderId,
-    modelByProvider: { ...config2.modelByProvider },
-    providers,
-    cliVersion: getCurrentVersion(),
-    configPaths: {
-      provider: getProviderConfigPath(),
-      keys: getKeyStorePath()
-    }
-  };
-}
-function printDesktopConfig() {
-  const snap = buildDesktopConfigSnapshot();
-  process.stdout.write(JSON.stringify(snap, null, 2) + "\n");
-}
-function applySetConfig(req) {
-  try {
-    const config2 = getProviderConfig();
-    let targetProvider = req.provider ?? config2.activeProviderId;
-    if (req.provider) {
-      const exists = PROVIDERS.some((p3) => p3.id === req.provider);
-      if (!exists) {
-        return {
-          ok: false,
-          error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
-        };
-      }
-      setActiveProviderId(req.provider);
-      targetProvider = req.provider;
-    }
-    if (req.endpointClear) {
-      clearCustomEndpoint(targetProvider);
-    }
-    if (req.endpoint) {
-      setCustomEndpoint(targetProvider, req.endpoint);
-    }
-    if (req.model) {
-      setModelForProvider(targetProvider, req.model);
-    }
-    const after = getProviderConfig();
-    const ep = getCustomEndpoint(after.activeProviderId);
-    return {
-      ok: true,
-      message: `activeProvider=${after.activeProviderId} model=${after.modelByProvider[after.activeProviderId]}` + (ep ? ` endpoint=${ep}` : "")
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-function applySetKey(req) {
-  try {
-    const exists = PROVIDERS.some((p3) => p3.id === req.provider);
-    if (!exists) {
-      return {
-        ok: false,
-        error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
-      };
-    }
-    setApiKey(req.provider, req.key);
-    setActiveProviderId(req.provider);
-    return {
-      ok: true,
-      provider: req.provider,
-      masked: maskKey(req.key)
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-var DISCOVERABLE = [
-  "grok",
-  "glm",
-  "minimax",
-  "deepseek",
-  "openai-compatible"
-];
-async function runDiscoverModels(providerArg) {
-  const config2 = getProviderConfig();
-  const providerId = (providerArg ?? config2.activeProviderId).trim();
-  if (!DISCOVERABLE.includes(providerId)) {
-    if (providerId === "custom") {
-    } else {
-      return {
-        ok: false,
-        error: `provider '${providerId}' is not discoverable. Use: ${DISCOVERABLE.join(", ")}`
-      };
-    }
-  }
-  const discoveryId = providerId === "custom" ? "openai-compatible" : providerId;
-  try {
-    const entry = await discoverModelsForProvider(discoveryId);
-    return {
-      ok: true,
-      payload: {
-        ok: true,
-        provider: providerId,
-        models: entry.models.map((m) => m.id),
-        fetchedAt: entry.fetchedAt,
-        baseUrl: entry.baseUrl
-      }
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
+// src/cli/main.ts
+init_desktopConfig();
 
 // src/cli/plugins/cliFlags.ts
 init_registry2();
@@ -45178,6 +46467,451 @@ init_skillsMd();
 init_skills2();
 init_updater();
 init_mcpConfigIo();
+
+// src/cli/skillConfigIo.ts
+init_skills2();
+init_skillsMd();
+import {
+  existsSync as existsSync39,
+  mkdirSync as mkdirSync16,
+  readdirSync as readdirSync6,
+  readFileSync as readFileSync32,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync20
+} from "node:fs";
+import { dirname as dirname9, join as join34 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+
+// src/cli/skillCategories.ts
+var CODING_CATEGORIES_LIST = [
+  "plan",
+  "refactor",
+  "debug",
+  "review",
+  "test",
+  "docs",
+  "ops",
+  "git",
+  "db",
+  "maint"
+];
+var CODING_CATEGORIES2 = new Set(CODING_CATEGORIES_LIST);
+
+// src/cli/skillConfigIo.ts
+var NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var BUILTIN_SKILL_MODULES = [
+  "@zelari/core/skills/builtin/debugging",
+  "@zelari/core/skills/builtin/docs",
+  "@zelari/core/skills/builtin/git-ops",
+  "@zelari/core/skills/builtin/planning",
+  "@zelari/core/skills/builtin/refactoring",
+  "@zelari/core/skills/builtin/review",
+  "@zelari/core/skills/builtin/testing",
+  "@zelari/core/skills/builtin/schema-loop",
+  "@zelari/core/skills/builtin/computer-use-cua"
+];
+var builtinsLoaded = false;
+function ensureBuiltinSkillsLoadedSync() {
+  if (builtinsLoaded) return;
+  for (const spec of BUILTIN_SKILL_MODULES) {
+    try {
+      require?.(spec);
+    } catch {
+    }
+  }
+}
+function getUserSkillsDir() {
+  return join34(homedir10(), ".zelari-code", "skills");
+}
+function getProjectSkillsDir(projectRoot) {
+  return join34(projectRoot, ".zelari", "skills");
+}
+function skillFilePath(dir, name) {
+  return join34(dir, name, "SKILL.md");
+}
+function classifyScope(skillPath, projectRoot) {
+  const userDir = getUserSkillsDir().replace(/\\/g, "/");
+  const norm = skillPath.replace(/\\/g, "/");
+  if (norm.startsWith(userDir + "/") || norm === userDir) {
+    return { scope: "user", writable: true };
+  }
+  if (projectRoot) {
+    const projDir = getProjectSkillsDir(projectRoot).replace(/\\/g, "/");
+    if (norm.startsWith(projDir + "/") || norm === projDir) {
+      return { scope: "project", writable: true };
+    }
+  }
+  return { scope: "compat", writable: false };
+}
+function entryFromParsed(parsed, projectRoot) {
+  const { scope, writable } = classifyScope(parsed.sourcePath, projectRoot);
+  return {
+    id: parsed.name,
+    name: parsed.name,
+    description: parsed.description,
+    category: parsed.category,
+    estimatedCost: parsed.estimatedCost,
+    requiredTools: parsed.requiredTools,
+    scope,
+    path: parsed.sourcePath,
+    body: parsed.body,
+    builtin: false,
+    writable
+  };
+}
+function entryFromBuiltin(skill) {
+  return {
+    id: skill.id,
+    name: skill.name || skill.id,
+    description: skill.description || "",
+    category: skill.category,
+    estimatedCost: skill.estimatedCost,
+    requiredTools: skill.requiredTools,
+    scope: "builtin",
+    path: null,
+    // Expose body so Desktop skill picker can expand like `/skill <id>`.
+    body: skill.systemPromptFragment || void 0,
+    builtin: true,
+    writable: false
+  };
+}
+function scanSkillsDir(dir, projectRoot, seen, out) {
+  if (!existsSync39(dir)) return;
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const skillPath = skillFilePath(dir, entry);
+    if (!existsSync39(skillPath)) continue;
+    try {
+      const parsed = parseSkillMd(readFileSync32(skillPath, "utf8"), skillPath);
+      if (!parsed) continue;
+      if (seen.has(parsed.name)) continue;
+      seen.add(parsed.name);
+      out.push(entryFromParsed(parsed, projectRoot));
+    } catch {
+    }
+  }
+}
+function listSkillsSnapshot(projectRoot) {
+  const root = projectRoot && projectRoot.trim() ? projectRoot.trim() : null;
+  const userSkillsDir = getUserSkillsDir();
+  const projectSkillsDir = root ? getProjectSkillsDir(root) : null;
+  const skills = [];
+  const seen = /* @__PURE__ */ new Set();
+  if (root) {
+    scanSkillsDir(join34(root, ".zelari", "skills"), root, seen, skills);
+    scanSkillsDir(join34(root, ".claude", "skills"), root, seen, skills);
+    scanSkillsDir(join34(root, ".opencode", "skills"), root, seen, skills);
+  }
+  scanSkillsDir(userSkillsDir, root, seen, skills);
+  for (const s of listCodingSkills()) {
+    if (seen.has(s.id)) continue;
+    seen.add(s.id);
+    if (s.builtin) {
+      skills.push(entryFromBuiltin(s));
+    }
+  }
+  skills.sort((a, b) => {
+    const order = (s) => s === "project" ? 0 : s === "user" ? 1 : s === "compat" ? 2 : 3;
+    const d = order(a.scope) - order(b.scope);
+    if (d !== 0) return d;
+    return a.id.localeCompare(b.id);
+  });
+  return { userSkillsDir, projectSkillsDir, skills };
+}
+function serializeSkillMd(opts) {
+  const name = opts.name.trim().toLowerCase();
+  const description = opts.description.trim();
+  const body = opts.body.trim();
+  const lines = ["---", `name: ${name}`, `description: ${description}`];
+  const cat = (opts.category ?? "").trim().toLowerCase();
+  if (cat && CODING_CATEGORIES2.has(cat)) {
+    lines.push(`category: ${cat}`);
+  }
+  if (opts.tools && opts.tools.length > 0) {
+    lines.push(`tools: [${opts.tools.map((t) => t.trim()).filter(Boolean).join(", ")}]`);
+  }
+  const cost = (opts.cost ?? "").trim().toLowerCase();
+  if (cost === "low" || cost === "medium" || cost === "high") {
+    lines.push(`cost: ${cost}`);
+  }
+  lines.push("---", "", body, "");
+  return lines.join("\n");
+}
+function upsertSkill(opts) {
+  const name = opts.name.trim().toLowerCase();
+  if (!name || !NAME_RE.test(name)) {
+    return {
+      ok: false,
+      error: "Invalid skill name (use lowercase letters, digits, hyphens; max 64 chars)"
+    };
+  }
+  const description = opts.description.trim();
+  if (!description) {
+    return { ok: false, error: "description is required" };
+  }
+  const body = opts.body.trim();
+  if (!body) {
+    return { ok: false, error: "body is required" };
+  }
+  let dir;
+  if (opts.scope === "user") {
+    dir = getUserSkillsDir();
+  } else {
+    const root = opts.projectRoot?.trim();
+    if (!root) {
+      return {
+        ok: false,
+        error: "projectRoot required for project scope (Open Folder first)"
+      };
+    }
+    dir = getProjectSkillsDir(root);
+  }
+  const path40 = skillFilePath(dir, name);
+  const content = serializeSkillMd({
+    name,
+    description,
+    body,
+    category: opts.category,
+    tools: opts.tools,
+    cost: opts.cost
+  });
+  const parsed = parseSkillMd(content, path40);
+  if (!parsed) {
+    return { ok: false, error: "Generated SKILL.md failed validation" };
+  }
+  mkdirSync16(dirname9(path40), { recursive: true });
+  writeFileSync20(path40, content, "utf8");
+  return { ok: true, path: path40 };
+}
+function removeSkill(opts) {
+  const name = opts.name.trim().toLowerCase();
+  if (!name) {
+    return { ok: false, error: "name is required" };
+  }
+  let dir;
+  if (opts.scope === "user") {
+    dir = getUserSkillsDir();
+  } else {
+    const root = opts.projectRoot?.trim();
+    if (!root) {
+      return { ok: false, error: "projectRoot required for project scope" };
+    }
+    dir = getProjectSkillsDir(root);
+  }
+  const skillDir = join34(dir, name);
+  const path40 = skillFilePath(dir, name);
+  if (!existsSync39(path40) && !existsSync39(skillDir)) {
+    return { ok: false, error: `Skill "${name}" not found in ${dir}` };
+  }
+  try {
+    rmSync3(skillDir, { recursive: true, force: true });
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  return { ok: true, path: path40 };
+}
+
+// src/cli/generateSkillFromUrl.ts
+init_providerConfig();
+init_keyStore();
+init_openai_compatible();
+var MAX_PAGE_CHARS = 24e3;
+var FETCH_TIMEOUT_MS2 = 25e3;
+var LLM_TIMEOUT_MS = 9e4;
+var SYSTEM = `You convert web page content into a Zelari Code coding skill (SKILL.md style).
+
+Return ONLY a single JSON object (no markdown fences) with keys:
+- name: string, kebab-case id (a-z0-9-hyphens, max 64, start with letter/digit)
+- description: string, one line, what the skill does
+- body: string, markdown instructions the agent should follow (steps, rules, checks)
+- category: one of ${CODING_CATEGORIES_LIST.join("|")} (optional)
+- tools: string[] of tool names the skill needs (optional, e.g. bash, read_file, write_file)
+- cost: "low" | "medium" | "high" (optional, default medium)
+
+Rules:
+- Prefer actionable coding-agent instructions over marketing copy.
+- If the page is a skill/prompt already, adapt it cleanly to this schema.
+- If the page is docs/blog, distill a reusable workflow skill.
+- name must be unique-looking and descriptive (not "untitled" or "skill").
+- body must be non-empty markdown with clear steps.`;
+function stripHtml(html) {
+  let t = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<noscript[\s\S]*?<\/noscript>/gi, " ");
+  t = t.replace(/<!--[\s\S]*?-->/g, " ");
+  t = t.replace(/<[^>]+>/g, " ");
+  t = t.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+  t = t.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n");
+  t = t.replace(/[ \t]{2,}/g, " ").trim();
+  return t;
+}
+async function fetchUrlText(url2) {
+  const u = url2.trim();
+  if (!/^https?:\/\//i.test(u)) {
+    throw new Error("URL must start with http:// or https://");
+  }
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
+  try {
+    const res = await fetch(u, {
+      signal: controller.signal,
+      headers: {
+        "user-agent": "zelari-code-skill-import/1.0",
+        accept: "text/html,text/plain,application/json;q=0.9,*/*;q=0.8"
+      },
+      redirect: "follow"
+    });
+    if (!res.ok) {
+      throw new Error(`Fetch failed HTTP ${res.status}`);
+    }
+    const ct = (res.headers.get("content-type") || "").toLowerCase();
+    const raw = await res.text();
+    if (ct.includes("json") || raw.trimStart().startsWith("{") || raw.trimStart().startsWith("[")) {
+      return raw.slice(0, MAX_PAGE_CHARS);
+    }
+    if (ct.includes("html") || /<html[\s>]/i.test(raw) || /<body[\s>]/i.test(raw)) {
+      return stripHtml(raw).slice(0, MAX_PAGE_CHARS);
+    }
+    return raw.slice(0, MAX_PAGE_CHARS);
+  } finally {
+    clearTimeout(t);
+  }
+}
+function extractJsonObject(text) {
+  const trimmed = text.trim();
+  const fenced = /^```(?:json)?\s*([\s\S]*?)```$/i.exec(trimmed);
+  const body = fenced ? fenced[1].trim() : trimmed;
+  try {
+    return JSON.parse(body);
+  } catch {
+    const start = body.indexOf("{");
+    const end = body.lastIndexOf("}");
+    if (start >= 0 && end > start) {
+      return JSON.parse(body.slice(start, end + 1));
+    }
+    throw new Error("Model did not return valid JSON");
+  }
+}
+function normalizeDraft(raw, sourceUrl, provider, model) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid skill draft object");
+  }
+  const o = raw;
+  let name = String(o.name ?? "").trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  if (!name || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
+    try {
+      const path40 = new URL(sourceUrl).pathname.split("/").filter(Boolean).pop()?.replace(/\.[a-z0-9]+$/i, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+      name = path40 && /^[a-z0-9]/.test(path40) ? path40 : "imported-skill";
+    } catch {
+      name = "imported-skill";
+    }
+  }
+  const description = String(o.description ?? "").trim();
+  const body = String(o.body ?? "").trim();
+  if (!description) throw new Error("Model draft missing description");
+  if (!body) throw new Error("Model draft missing body");
+  const catRaw = String(o.category ?? "").trim().toLowerCase();
+  const category = CODING_CATEGORIES_LIST.includes(catRaw) ? catRaw : void 0;
+  let tools;
+  if (Array.isArray(o.tools)) {
+    tools = o.tools.map((t) => String(t).trim()).filter(Boolean);
+  } else if (typeof o.tools === "string" && o.tools.trim()) {
+    tools = o.tools.split(",").map((t) => t.trim()).filter(Boolean);
+  }
+  const costRaw = String(o.cost ?? "medium").trim().toLowerCase();
+  const cost = costRaw === "low" || costRaw === "high" || costRaw === "medium" ? costRaw : "medium";
+  return {
+    name,
+    description,
+    body,
+    category,
+    tools,
+    cost,
+    sourceUrl,
+    model,
+    provider
+  };
+}
+async function resolveLlm(opts) {
+  const active = opts.provider?.trim() || getProviderConfig().activeProviderId;
+  const meta3 = await resolveApiKeyWithMeta(active);
+  if (!meta3?.apiKey) {
+    throw new Error(
+      `No API key for provider '${active}'. Save a key in Settings \u2192 Provider.`
+    );
+  }
+  const baseUrl = resolveBaseUrl(active);
+  if (!baseUrl) {
+    throw new Error(
+      `No base URL for provider '${active}'. Set a custom endpoint in Settings.`
+    );
+  }
+  const model = opts.model?.trim() || getModelForProvider(active) || process.env.ZELARI_MODEL || "";
+  if (!model) {
+    throw new Error(`No model selected for provider '${active}'`);
+  }
+  return { provider: active, model, apiKey: meta3.apiKey, baseUrl };
+}
+async function generateSkillFromUrl(opts) {
+  const page = await fetchUrlText(opts.url);
+  if (!page.trim()) {
+    throw new Error("Page content is empty after fetch");
+  }
+  const llm = await resolveLlm({
+    provider: opts.provider,
+    model: opts.model
+  });
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), LLM_TIMEOUT_MS);
+  try {
+    const url2 = `${llm.baseUrl.replace(/\/$/, "")}/chat/completions`;
+    const res = await fetch(url2, {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${llm.apiKey}`
+      },
+      body: JSON.stringify({
+        model: llm.model,
+        temperature: 0.2,
+        max_tokens: 4096,
+        stream: false,
+        messages: [
+          { role: "system", content: SYSTEM },
+          {
+            role: "user",
+            content: `Source URL: ${opts.url.trim()}
+
+Page content (truncated):
+${page}`
+          }
+        ]
+      })
+    });
+    if (!res.ok) {
+      const errBody = await res.text().catch(() => "");
+      throw new Error(
+        `LLM HTTP ${res.status}${errBody ? `: ${errBody.slice(0, 200)}` : ""}`
+      );
+    }
+    const json2 = await res.json();
+    const text = json2.choices?.[0]?.message?.content?.trim();
+    if (!text) throw new Error("Empty model response");
+    const parsed = extractJsonObject(text);
+    return normalizeDraft(parsed, opts.url.trim(), llm.provider, llm.model);
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// src/cli/main.ts
 init_mcpPresets();
 init_targets();
 var VERSION = getCurrentVersion();
@@ -45217,7 +46951,7 @@ function runPreflight() {
 }
 async function backgroundUpdateCheck() {
   if (process.env.ANATHEMA_DEV === "1") return;
-  await new Promise((resolve) => setTimeout(resolve, 3e3));
+  await new Promise((resolve3) => setTimeout(resolve3, 3e3));
   try {
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_updater(), updater_exports));
     const info = await checkForUpdate2();
@@ -45255,6 +46989,35 @@ function pickRootComponent() {
     void runPluginsInstall(argv).then((code) => process.exit(code));
     return { kind: "done" };
   }
+  if (argv.includes("serve") || argv.includes("--serve")) {
+    const { parseServeFlags: parseServeFlags2 } = (init_serve(), __toCommonJS(serve_exports));
+    return { kind: "serve", serveOpts: parseServeFlags2(argv) ?? {} };
+  }
+  if (argv.includes("--generate-skill-from-url")) {
+    void (async () => {
+      try {
+        const get = (flag) => {
+          const i = argv.indexOf(flag);
+          return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+        };
+        const url2 = get("--url");
+        if (!url2) throw new Error("--url is required");
+        const draft = await generateSkillFromUrl({
+          url: url2,
+          provider: get("--provider"),
+          model: get("--model")
+        });
+        console.log(JSON.stringify({ ok: true, ...draft }, null, 2));
+        process.exit(0);
+      } catch (err) {
+        console.error(
+          `[zelari-code --generate-skill-from-url] ${err instanceof Error ? err.message : String(err)}`
+        );
+        process.exit(1);
+      }
+    })();
+    return { kind: "done" };
+  }
   if (argv.includes("--doctor") || argv.includes("doctor")) {
     const { runDoctor: runDoctor2 } = (init_doctor(), __toCommonJS(doctor_exports));
     void runDoctor2().then((healthy) => process.exit(healthy ? 0 : 1));
@@ -45306,7 +47069,7 @@ function pickRootComponent() {
   }
   if (argv.includes("--help") || argv.includes("-h")) {
     console.log(
-      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode agent|council|zelari  Dispatch mode (default: agent)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n  --print-config      Print provider/model config as JSON (no secrets)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable (required)\n    --args <json>     JSON array of args (optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
+      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode agent|council|zelari  Dispatch mode (default: agent)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --print-config      Print provider/model config as JSON (no secrets)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable (required)\n    --args <json>     JSON array of args (optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
     );
     process.exit(0);
   }
@@ -45385,6 +47148,82 @@ function pickRootComponent() {
       process.exit(1);
     }
   }
+  if (argv.includes("--print-skills")) {
+    try {
+      const cwdIdx = argv.indexOf("--cwd");
+      const cwd = cwdIdx >= 0 && argv[cwdIdx + 1] ? argv[cwdIdx + 1] : process.cwd();
+      ensureBuiltinSkillsLoadedSync();
+      const snap = listSkillsSnapshot(cwd);
+      console.log(JSON.stringify(snap, null, 2));
+      process.exit(0);
+    } catch (err) {
+      console.error(
+        `[zelari-code --print-skills] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+  }
+  if (argv.includes("--set-skill")) {
+    try {
+      const get = (flag) => {
+        const i = argv.indexOf(flag);
+        return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+      };
+      const name = get("--name");
+      const description = get("--description");
+      const body = get("--body");
+      const category = get("--category");
+      const toolsRaw = get("--tools");
+      const cost = get("--cost");
+      const scopeRaw = get("--scope") ?? "user";
+      const scope = scopeRaw === "project" ? "project" : "user";
+      const cwd = get("--cwd") ?? process.cwd();
+      if (!name) throw new Error("--name is required");
+      if (!description) throw new Error("--description is required");
+      if (!body) throw new Error("--body is required");
+      const tools = toolsRaw ? toolsRaw.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
+      const result = upsertSkill({
+        scope,
+        name,
+        description,
+        body,
+        category,
+        tools,
+        cost,
+        projectRoot: cwd
+      });
+      if (!result.ok) throw new Error(result.error);
+      console.log(JSON.stringify({ ok: true, path: result.path, name, scope }));
+      process.exit(0);
+    } catch (err) {
+      console.error(
+        `[zelari-code --set-skill] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+  }
+  if (argv.includes("--remove-skill")) {
+    try {
+      const get = (flag) => {
+        const i = argv.indexOf(flag);
+        return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+      };
+      const name = get("--name");
+      const scopeRaw = get("--scope") ?? "user";
+      const scope = scopeRaw === "project" ? "project" : "user";
+      const cwd = get("--cwd") ?? process.cwd();
+      if (!name) throw new Error("--name is required");
+      const result = removeSkill({ scope, name, projectRoot: cwd });
+      if (!result.ok) throw new Error(result.error);
+      console.log(JSON.stringify({ ok: true, path: result.path, name, scope }));
+      process.exit(0);
+    } catch (err) {
+      console.error(
+        `[zelari-code --remove-skill] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+  }
   if (argv.includes("--set-mcp-preset")) {
     try {
       const get = (flag) => {
@@ -45657,6 +47496,15 @@ function loadUserSkills() {
 function main() {
   const picked = pickRootComponent();
   if (picked.kind === "done") return;
+  if (picked.kind === "serve") {
+    void Promise.resolve().then(() => (init_serve(), serve_exports)).then(({ runCompanionServe: runCompanionServe2 }) => runCompanionServe2(picked.serveOpts ?? {})).then(() => process.exit(0)).catch((err) => {
+      console.error(
+        `[zelari-code serve] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    });
+    return;
+  }
   runPreflight();
   loadUserSkills();
   if (picked.kind === "headless") {
@@ -45670,7 +47518,7 @@ function main() {
         closeMcpClients2();
       } catch {
       }
-      await new Promise((resolve) => setImmediate(resolve));
+      await new Promise((resolve3) => setImmediate(resolve3));
       process.exit(code);
     }).catch(async (err) => {
       console.error(