zelari-code 1.24.0 → 1.25.0

package/dist/cli/main.bundled.js

@@ -4,6 +4,12 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -389,7 +395,7 @@ async function refreshGrokToken(options) {
   return parseTokenResponseBody(obj, accessToken);
 }
 async function openBrowser(url2) {
-  const { spawn: spawn11 } = await import("node:child_process");
+  const { spawn: spawn12 } = await import("node:child_process");
   const cmd = (() => {
     switch (process.platform) {
       case "darwin":
@@ -400,18 +406,18 @@ async function openBrowser(url2) {
         return { bin: "xdg-open", args: [url2] };
     }
   })();
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     try {
-      const child = spawn11(cmd.bin, cmd.args, {
+      const child = spawn12(cmd.bin, cmd.args, {
         stdio: "ignore",
         detached: true
       });
       child.on("error", (err) => reject(err));
       child.on("spawn", () => {
         child.unref();
-        resolve();
+        resolve3();
       });
-      setTimeout(() => resolve(), 100);
+      setTimeout(() => resolve3(), 100);
     } catch (err) {
       reject(err);
     }
@@ -835,6 +841,180 @@ var init_providerConfig = __esm({
   }
 });
 
+// src/cli/modelDiscovery.ts
+import { promises as fs3, existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { homedir } from "node:os";
+import path4 from "node:path";
+async function resolveDiscoveryBaseUrl(provider, options) {
+  if (options.baseUrl) return options.baseUrl;
+  const { getCustomEndpoint: getCustomEndpoint2 } = await Promise.resolve().then(() => (init_providerConfig(), providerConfig_exports));
+  const custom2 = getCustomEndpoint2(provider);
+  if (custom2) return custom2;
+  if (provider === "openai-compatible") {
+    const envBase = process.env.OPENAI_BASE_URL;
+    if (envBase && envBase.trim().length > 0) return envBase;
+  }
+  return PROVIDER_BASE_URLS[provider];
+}
+function defaultModelsFilePath() {
+  return process.env.ANATHEMA_MODELS_FILE ?? path4.join(homedir(), ".tmp", "zelari-code", "models.json");
+}
+function getModelsFilePath() {
+  return defaultModelsFilePath();
+}
+function loadModelsRegistry(file2 = getModelsFilePath()) {
+  if (!existsSync3(file2)) return {};
+  try {
+    const raw = readFileSync3(file2, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function getCachedModels(provider, file2 = getModelsFilePath()) {
+  const registry3 = loadModelsRegistry(file2);
+  return registry3[provider];
+}
+function isModelsCacheStale(provider, maxAgeMs = 6 * 60 * 60 * 1e3, file2 = getModelsFilePath(), now = Date.now()) {
+  const entry = getCachedModels(provider, file2);
+  if (!entry) return true;
+  return now - entry.fetchedAt > maxAgeMs;
+}
+async function withRegistryLock(fn) {
+  const next = writeChain.then(async () => fn());
+  writeChain = next.catch(() => void 0);
+  return next;
+}
+async function readModifyWriteRegistry(mutator, file2 = getModelsFilePath()) {
+  return withRegistryLock(async () => {
+    const onDisk = loadModelsRegistry(file2);
+    const merged = mutator(onDisk);
+    await fs3.mkdir(path4.dirname(file2), { recursive: true });
+    const tmp = `${file2}.tmp-${process.pid}-${Date.now()}`;
+    await fs3.writeFile(tmp, JSON.stringify(merged, null, 2), "utf-8");
+    await fs3.rename(tmp, file2);
+    return merged;
+  });
+}
+async function resolveAuthToken(provider, options) {
+  if (options.authToken) return options.authToken;
+  const { resolveApiKeyWithMeta: resolveApiKeyWithMeta2, getOAuthToken: getOAuthToken2 } = await Promise.resolve().then(() => (init_keyStore(), keyStore_exports));
+  if (provider === "grok") {
+    const oauth = getOAuthToken2("grok");
+    if (oauth?.apiKey) return oauth.apiKey;
+  }
+  const resolved = await resolveApiKeyWithMeta2(provider);
+  return resolved?.apiKey;
+}
+function parseOpenAIModelsResponse(json2, baseUrl) {
+  if (!json2 || typeof json2 !== "object") return [];
+  const obj = json2;
+  if (!Array.isArray(obj.data)) return [];
+  const models = [];
+  for (const m of obj.data) {
+    if (!m || typeof m.id !== "string") continue;
+    const out = { id: m.id };
+    if (typeof m.created === "number") out.created = m.created;
+    if (typeof m.owned_by === "string") out.ownedBy = m.owned_by;
+    const ctx = m.context_length;
+    if (typeof ctx === "number") out.contextLength = ctx;
+    models.push(out);
+  }
+  models.sort((a, b) => a.id.localeCompare(b.id));
+  return models;
+}
+async function discoverModelsForProvider(provider, options = {}) {
+  const baseUrl = await resolveDiscoveryBaseUrl(provider, options);
+  if (!baseUrl || baseUrl.trim().length === 0) {
+    throw new ModelDiscoveryError(
+      `No base URL for provider "${provider}" \u2014 set one with /provider custom <url> before discovering models`,
+      "no_base_url"
+    );
+  }
+  const url2 = `${baseUrl.replace(/\/$/, "")}/models`;
+  const authToken = await resolveAuthToken(provider, options);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let response;
+  try {
+    const headers = { Accept: "application/json" };
+    if (authToken) headers.Authorization = `Bearer ${authToken}`;
+    response = await fetchImpl(url2, { method: "GET", headers });
+  } catch (err) {
+    throw new ModelDiscoveryError(
+      `Network error contacting ${url2}: ${err instanceof Error ? err.message : String(err)}`,
+      "network_error"
+    );
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new ModelDiscoveryError(
+      `HTTP ${response.status} from ${url2}: ${body.slice(0, 200)}`,
+      `http_${response.status}`
+    );
+  }
+  let json2;
+  try {
+    json2 = await response.json();
+  } catch (err) {
+    throw new ModelDiscoveryError(
+      `Invalid JSON from ${url2}: ${err instanceof Error ? err.message : String(err)}`,
+      "invalid_json"
+    );
+  }
+  const models = parseOpenAIModelsResponse(json2, baseUrl);
+  if (models.length === 0) {
+    throw new ModelDiscoveryError(
+      `Provider ${provider} returned 0 models \u2014 refusing to overwrite cache`,
+      "empty_response"
+    );
+  }
+  const entry = {
+    models,
+    fetchedAt: Date.now(),
+    baseUrl
+  };
+  if (!options.skipCacheWrite) {
+    const file2 = getModelsFilePath();
+    await readModifyWriteRegistry((current) => {
+      current[provider] = entry;
+      return current;
+    }, file2);
+  }
+  return entry;
+}
+function discoverModelsInBackground(provider, options = {}) {
+  discoverModelsForProvider(provider, options).catch((err) => {
+    if (err instanceof ModelDiscoveryError && options.onError) {
+      options.onError(err);
+    }
+  });
+}
+var PROVIDER_BASE_URLS, writeChain, ModelDiscoveryError;
+var init_modelDiscovery = __esm({
+  "src/cli/modelDiscovery.ts"() {
+    "use strict";
+    PROVIDER_BASE_URLS = {
+      "grok": "https://api.x.ai/v1",
+      // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
+      "glm": "https://api.z.ai/api/coding/paas/v4",
+      "minimax": "https://api.minimax.io/v1",
+      // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
+      "deepseek": "https://api.deepseek.com",
+      "openai-compatible": "https://api.x.ai/v1"
+    };
+    writeChain = Promise.resolve();
+    ModelDiscoveryError = class extends Error {
+      constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "ModelDiscoveryError";
+      }
+    };
+  }
+});
+
 // packages/core/dist/agents/skills.js
 function getSkillsByCategory(cat) {
   return SKILL_CATALOG.filter((s) => s.category === cat);
@@ -16818,12 +16998,12 @@ function withNodeDirOnPath(base) {
     const nodeDir = dirname(process.execPath);
     if (!nodeDir)
       return env;
-    const sep = process.platform === "win32" ? ";" : ":";
+    const sep2 = process.platform === "win32" ? ";" : ":";
     const current = env.PATH ?? env.Path ?? "";
-    const parts = current.split(sep).filter((p3) => p3.length > 0);
+    const parts = current.split(sep2).filter((p3) => p3.length > 0);
     const has = parts.some((p3) => p3.toLowerCase() === nodeDir.toLowerCase());
     if (!has) {
-      env.PATH = `${nodeDir}${sep}${current}`;
+      env.PATH = `${nodeDir}${sep2}${current}`;
     }
   } catch {
   }
@@ -16850,7 +17030,7 @@ var init_shell = __esm({
       timeoutMs: 6e4,
       inputSchema: BashArgsSchema,
       execute: async (args, ctx) => {
-        return new Promise((resolve) => {
+        return new Promise((resolve3) => {
           const start = Date.now();
           const cwd = args.cwd ?? ctx.cwd;
           const resolved = resolveShell();
@@ -16898,14 +17078,14 @@ var init_shell = __esm({
           });
           const timer = setTimeout(() => {
             child.kill("SIGTERM");
-            resolve(typedErr(`Bash command timed out after ${args.timeoutMs}ms. If it was waiting for interactive input: stdin is closed \u2014 pass non-interactive flags or create the files directly instead of retrying.`));
+            resolve3(typedErr(`Bash command timed out after ${args.timeoutMs}ms. If it was waiting for interactive input: stdin is closed \u2014 pass non-interactive flags or create the files directly instead of retrying.`));
           }, args.timeoutMs);
           child.on("close", (code) => {
             clearTimeout(timer);
             const cappedStdout = stdout.slice(0, maxBuffer);
             const cappedStderr = stderr.slice(0, maxBuffer);
             const interactive = INTERACTIVE_CANCEL_RE.test(cappedStdout) || INTERACTIVE_CANCEL_RE.test(cappedStderr);
-            resolve(typedOk({
+            resolve3(typedOk({
               stdout: cappedStdout,
               stderr: cappedStderr,
               exitCode: code ?? -1,
@@ -16916,7 +17096,7 @@ var init_shell = __esm({
           });
           child.on("error", (err) => {
             clearTimeout(timer);
-            resolve(typedErr(err.message));
+            resolve3(typedErr(err.message));
           });
         });
       }
@@ -20629,8 +20809,8 @@ function wrapLegacyStream(legacyStream, params, _messages, _tools) {
       }
       if (done)
         break;
-      await new Promise((resolve) => {
-        resolveNext = resolve;
+      await new Promise((resolve3) => {
+        resolveNext = resolve3;
       });
     }
     await promise2;
@@ -20749,19 +20929,60 @@ __export(openai_compatible_exports, {
   resolveBaseUrl: () => resolveBaseUrl
 });
 function abortableSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) return resolve();
-    const t = setTimeout(resolve, ms);
+  return new Promise((resolve3) => {
+    if (signal?.aborted) return resolve3();
+    const t = setTimeout(resolve3, ms);
     signal?.addEventListener(
       "abort",
       () => {
         clearTimeout(t);
-        resolve();
+        resolve3();
       },
       { once: true }
     );
   });
 }
+function isTimeoutAbortMessage(msg) {
+  const m = msg.toLowerCase();
+  return m.includes("aborted due to timeout") || m.includes("timeout") || m.includes("the operation was aborted");
+}
+async function readChunkWithTimeout(reader, opts) {
+  if (opts.signal?.aborted) {
+    throw new Error("aborted");
+  }
+  const remaining = opts.deadlineMs - Date.now();
+  if (remaining <= 0) {
+    throw new Error(
+      `Provider stream exceeded max duration (${Math.round(PROVIDER_STREAM_MAX_MS / 1e3)}s). Raise ZELARI_PROVIDER_STREAM_MAX_MS if needed.`
+    );
+  }
+  const waitMs = Math.min(opts.idleMs, remaining);
+  let idleTimer;
+  let onAbort;
+  try {
+    return await Promise.race([
+      reader.read(),
+      new Promise((_, reject) => {
+        idleTimer = setTimeout(() => {
+          reject(
+            new Error(
+              `Provider stream idle for ${Math.round(waitMs / 1e3)}s (no tokens). The model/gateway stalled \u2014 try again or switch model. Override with ZELARI_PROVIDER_STREAM_IDLE_MS.`
+            )
+          );
+        }, waitMs);
+        if (opts.signal) {
+          onAbort = () => reject(new Error("aborted"));
+          opts.signal.addEventListener("abort", onAbort, { once: true });
+        }
+      })
+    ]);
+  } finally {
+    if (idleTimer) clearTimeout(idleTimer);
+    if (onAbort && opts.signal) {
+      opts.signal.removeEventListener("abort", onAbort);
+    }
+  }
+}
 function backoffDelay(attempt, retryAfterHeader) {
   if (retryAfterHeader) {
     const seconds = Number.parseFloat(retryAfterHeader);
@@ -20863,31 +21084,46 @@ function openaiCompatibleProvider(config2) {
         return;
       }
       try {
-        const timeoutSignal = AbortSignal.timeout(PROVIDER_TIMEOUT_MS);
-        const fetchSignal = params.signal ? AbortSignal.any([params.signal, timeoutSignal]) : timeoutSignal;
-        response = await fetch(`${config2.baseUrl}/chat/completions`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${config2.apiKey}`
-          },
-          body: JSON.stringify(body),
-          // Use `params.signal` (per-call AbortSignal from AgentHarness
-          // controller) so `.cancel()` actually aborts the HTTP request.
-          // `config.signal` is the factory-level signal, typically undefined.
-          // v0.6.0 audit HIGH-2.
-          // v1.10.0: also apply PROVIDER_TIMEOUT_MS so a stalled connection
-          // can't hang the harness forever.
-          signal: fetchSignal
-        });
+        const connectController = new AbortController();
+        const connectTimer = setTimeout(() => {
+          connectController.abort(
+            new Error(
+              `Provider connect timeout after ${Math.round(PROVIDER_CONNECT_TIMEOUT_MS / 1e3)}s (no response headers). Override ZELARI_PROVIDER_CONNECT_TIMEOUT_MS.`
+            )
+          );
+        }, PROVIDER_CONNECT_TIMEOUT_MS);
+        const signals = [connectController.signal];
+        if (params.signal) signals.push(params.signal);
+        const fetchSignal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+        try {
+          response = await fetch(`${config2.baseUrl}/chat/completions`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${config2.apiKey}`
+            },
+            body: JSON.stringify(body),
+            // Cancel aborts the HTTP request; stream idle is enforced below
+            // per-chunk so active multi-minute streams are not killed.
+            signal: fetchSignal
+          });
+        } finally {
+          clearTimeout(connectTimer);
+        }
       } catch (err) {
         lastStatus = 0;
-        lastErrText = err instanceof Error ? err.message : String(err);
+        const asErr = err instanceof Error ? err : null;
+        const causeMsg = asErr?.cause instanceof Error ? asErr.cause.message : typeof asErr?.cause === "string" ? String(asErr.cause) : "";
+        lastErrText = (causeMsg && causeMsg.includes("Provider connect") ? causeMsg : null) || asErr?.message || String(err);
+        if (isTimeoutAbortMessage(lastErrText) && !lastErrText.includes("Provider connect")) {
+          lastErrText = `Provider connect timeout after ${Math.round(PROVIDER_CONNECT_TIMEOUT_MS / 1e3)}s (no response headers). Last error: ${lastErrText}`;
+        }
         if (params.signal?.aborted) {
           yield { kind: "error", message: "aborted" };
           return;
         }
-        if (attempt < MAX_RETRIES) {
+        const maxAttempts = isTimeoutAbortMessage(lastErrText) ? Math.min(1, MAX_RETRIES) : MAX_RETRIES;
+        if (attempt < maxAttempts) {
           await abortableSleep(backoffDelay(attempt, null), params.signal);
           continue;
         }
@@ -20942,9 +21178,30 @@ function openaiCompatibleProvider(config2) {
       }
       toolCallAccumulator.clear();
     };
+    const streamDeadline = Date.now() + PROVIDER_STREAM_MAX_MS;
     try {
       while (true) {
-        const { value, done } = await reader.read();
+        let chunk;
+        try {
+          chunk = await readChunkWithTimeout(reader, {
+            idleMs: PROVIDER_STREAM_IDLE_MS,
+            deadlineMs: streamDeadline,
+            signal: params.signal
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (msg === "aborted" || params.signal?.aborted) {
+            yield { kind: "error", message: "aborted" };
+            return;
+          }
+          try {
+            await reader.cancel(msg);
+          } catch {
+          }
+          yield { kind: "error", message: msg };
+          return;
+        }
+        const { value, done } = chunk;
         if (done) break;
         buffer += decoder.decode(value, { stream: true });
         const lines = buffer.split("\n");
@@ -21070,7 +21327,7 @@ async function providerConfigFor(providerId) {
     providerId
   };
 }
-var RETRYABLE_STATUSES, MAX_RETRIES, BACKOFF_BASE_MS, BACKOFF_CAP_MS, PROVIDER_TIMEOUT_MS, PROVIDER_ENDPOINTS;
+var RETRYABLE_STATUSES, MAX_RETRIES, BACKOFF_BASE_MS, BACKOFF_CAP_MS, PROVIDER_CONNECT_TIMEOUT_MS, PROVIDER_STREAM_IDLE_MS, PROVIDER_STREAM_MAX_MS, PROVIDER_ENDPOINTS;
 var init_openai_compatible = __esm({
   "src/cli/provider/openai-compatible.ts"() {
     "use strict";
@@ -21084,10 +21341,20 @@ var init_openai_compatible = __esm({
     })();
     BACKOFF_BASE_MS = 500;
     BACKOFF_CAP_MS = 8e3;
-    PROVIDER_TIMEOUT_MS = (() => {
-      const raw = process.env.ZELARI_PROVIDER_TIMEOUT_MS;
+    PROVIDER_CONNECT_TIMEOUT_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_CONNECT_TIMEOUT_MS;
+      const n = raw ? Number.parseInt(raw, 10) : 9e4;
+      return Number.isFinite(n) && n >= 5e3 ? n : 9e4;
+    })();
+    PROVIDER_STREAM_IDLE_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_STREAM_IDLE_MS ?? process.env.ZELARI_PROVIDER_TIMEOUT_MS;
       const n = raw ? Number.parseInt(raw, 10) : 3e5;
-      return Number.isFinite(n) && n >= 1e4 ? n : 3e5;
+      return Number.isFinite(n) && n >= 15e3 ? n : 3e5;
+    })();
+    PROVIDER_STREAM_MAX_MS = (() => {
+      const raw = process.env.ZELARI_PROVIDER_STREAM_MAX_MS;
+      const n = raw ? Number.parseInt(raw, 10) : 18e5;
+      return Number.isFinite(n) && n >= 6e4 ? n : 18e5;
     })();
     PROVIDER_ENDPOINTS = {
       "openai-compatible": "https://api.x.ai/v1",
@@ -21662,14 +21929,14 @@ var init_engine = __esm({
         parse: parseRuffJson
       }
     ];
-    defaultRunner = (cmd, args, opts) => new Promise((resolve) => {
+    defaultRunner = (cmd, args, opts) => new Promise((resolve3) => {
       let stdout = "";
       let stderr = "";
       let settled = false;
       const done = (r) => {
         if (settled) return;
         settled = true;
-        resolve(r);
+        resolve3(r);
       };
       let child;
       try {
@@ -22338,12 +22605,12 @@ var init_client = __esm({
         if (this.closed) return Promise.reject(new Error("LSP transport is closed"));
         const id = this.nextId++;
         const msg = { jsonrpc: "2.0", id, method, ...params !== void 0 ? { params } : {} };
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve3, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             reject(new Error(`LSP request "${method}" timed out after ${this.timeoutMs}ms`));
           }, this.timeoutMs);
-          this.pending.set(id, { resolve, reject, timer });
+          this.pending.set(id, { resolve: resolve3, reject, timer });
           this.transport.send(encodeMessage(msg));
         });
       }
@@ -22609,8 +22876,8 @@ var init_manager = __esm({
         if (cached2 !== void 0) return cached2;
         let resolveInit;
         let rejectInit;
-        const initialized = new Promise((resolve, reject) => {
-          resolveInit = resolve;
+        const initialized = new Promise((resolve3, reject) => {
+          resolveInit = resolve3;
           rejectInit = reject;
         });
         let entry = null;
@@ -23329,8 +23596,8 @@ async function runBrowserCheck(options, loader) {
   const failedRequests = [];
   const evaluateResults = [];
   const base = { ok: false, consoleErrors, pageErrors, failedRequests };
-  const resolve = loader ?? (() => loadPlaywright(options.cwd ?? process.cwd()));
-  const pw = await resolve();
+  const resolve3 = loader ?? (() => loadPlaywright(options.cwd ?? process.cwd()));
+  const pw = await resolve3();
   if (!pw) {
     return {
       ...base,
@@ -23822,9 +24089,9 @@ exec node "$(dirname "$0")/askpass.cjs"
   return sh;
 }
 function runSsh(target, remoteCommand, timeoutMs = 6e4) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     if (target.auth === "password" && !getSshPassword(target.id)) {
-      resolve({
+      resolve3({
         code: 1,
         stdout: "",
         stderr: "No password stored for this target \u2014 edit target and set password"
@@ -23856,7 +24123,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
     });
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
-      resolve({
+      resolve3({
         code: 124,
         stdout,
         stderr: stderr + "\n[ssh] timeout"
@@ -23864,7 +24131,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
     }, timeoutMs);
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve({
+      resolve3({
         code: 127,
         stdout,
         stderr: err.message.includes("ENOENT") ? "ssh not found on PATH \u2014 install OpenSSH client" : err.message
@@ -23872,7 +24139,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve({ code: code ?? 1, stdout, stderr });
+      resolve3({ code: code ?? 1, stdout, stderr });
     });
   });
 }
@@ -24091,7 +24358,7 @@ async function readChecks(cwd) {
   }
 }
 function runShell(command, cwd, timeoutMs, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const isWin = process.platform === "win32";
     const child = spawn5(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
       cwd,
@@ -24105,7 +24372,7 @@ function runShell(command, cwd, timeoutMs, signal) {
     const finish = (exitCode) => {
       if (settled) return;
       settled = true;
-      resolve({ exitCode, stdout, stderr });
+      resolve3({ exitCode, stdout, stderr });
     };
     const timer = setTimeout(() => {
       try {
@@ -30544,8 +30811,8 @@ var init_storage = __esm({
         const prev2 = this.chains.get(key) ?? Promise.resolve();
         let release = () => {
         };
-        const next = new Promise((resolve) => {
-          release = resolve;
+        const next = new Promise((resolve3) => {
+          release = resolve3;
         });
         const chained = prev2.then(() => next);
         this.chains.set(key, chained);
@@ -31430,7 +31697,7 @@ ${fallback.output}`
   return primary;
 }
 function runNpm(executor, args, mode, npmCliPath) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -31442,7 +31709,7 @@ function runNpm(executor, args, mode, npmCliPath) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve({
+      resolve3({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -31451,7 +31718,7 @@ function runNpm(executor, args, mode, npmCliPath) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve({
+      resolve3({
         ok,
         output: stdout + stderr,
         error: ok ? void 0 : `npm exited with code ${code}`,
@@ -31575,7 +31842,7 @@ var init_mcpClient = __esm({
           return Promise.reject(new Error(`[mcp:${this.serverName}] not started`));
         const id = this.nextId++;
         const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params });
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve3, reject) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             reject(
@@ -31584,7 +31851,7 @@ var init_mcpClient = __esm({
               )
             );
           }, timeoutMs);
-          this.pending.set(id, { resolve, reject, timer });
+          this.pending.set(id, { resolve: resolve3, reject, timer });
           child.stdin.write(payload + "\n", (err) => {
             if (err) {
               clearTimeout(timer);
@@ -34067,14 +34334,14 @@ function agentProbeEnv() {
   try {
     const nodeDir = dirname7(process.execPath);
     if (!nodeDir) return env;
-    const sep = process.platform === "win32" ? ";" : ":";
+    const sep2 = process.platform === "win32" ? ";" : ":";
     const current = env.PATH ?? env.Path ?? "";
-    const parts = current.split(sep).filter((p3) => p3.length > 0);
+    const parts = current.split(sep2).filter((p3) => p3.length > 0);
     const has = parts.some(
       (p3) => p3.toLowerCase() === nodeDir.toLowerCase()
     );
     if (!has) {
-      env.PATH = `${nodeDir}${sep}${current}`;
+      env.PATH = `${nodeDir}${sep2}${current}`;
     }
   } catch {
   }
@@ -34410,8 +34677,8 @@ function isBinaryOnPath(bin, opts = {}) {
   const exists = opts.exists ?? existsSync34;
   const pathEnv = opts.pathEnv ?? process.env.PATH ?? "";
   const pathMod = platform === "win32" ? path33.win32 : path33.posix;
-  const sep = platform === "win32" ? ";" : ":";
-  const dirs = pathEnv.split(sep).filter((d) => d.length > 0);
+  const sep2 = platform === "win32" ? ";" : ":";
+  const dirs = pathEnv.split(sep2).filter((d) => d.length > 0);
   const candidates = [bin];
   if (platform === "win32") {
     const pathExt = opts.pathExt ?? process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM";
@@ -34539,6 +34806,178 @@ var init_registry2 = __esm({
   }
 });
 
+// src/cli/atMentions.ts
+var atMentions_exports = {};
+__export(atMentions_exports, {
+  expandAtMentions: () => expandAtMentions,
+  extractAtMentions: () => extractAtMentions,
+  hasAtMentions: () => hasAtMentions
+});
+import { existsSync as existsSync37, readFileSync as readFileSync30, statSync as statSync6 } from "node:fs";
+import { isAbsolute, relative as relative3, resolve, sep } from "node:path";
+function isProbablyText(name, head) {
+  if (/\.(txt|md|markdown|json|jsonc|ts|tsx|js|jsx|mjs|cjs|css|scss|html|htm|xml|yml|yaml|toml|ini|cfg|conf|rs|go|py|java|kt|swift|c|cc|cpp|h|hpp|cs|rb|php|sh|bash|zsh|ps1|sql|graphql|env|gitignore|dockerfile|makefile|cmake|lock|svg)$/i.test(
+    name
+  )) {
+    return true;
+  }
+  return !head.includes("\0") && /[\x09\x0a\x0d\x20-\x7e]/.test(head.slice(0, 200));
+}
+function underRoot(abs, root) {
+  const a = resolve(abs);
+  const r = resolve(root);
+  const prefix = r.endsWith(sep) ? r : r + sep;
+  return a === r || a.startsWith(prefix);
+}
+function extractAtMentions(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  AT_PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = AT_PATH_RE.exec(text)) !== null) {
+    const token = (m[2] ?? "").trim();
+    if (!token || token.includes("@")) continue;
+    const key = token.replace(/\\/g, "/").toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(token);
+  }
+  return out;
+}
+function resolveMention(token, cwd) {
+  const abs = isAbsolute(token) ? resolve(token) : resolve(cwd, token);
+  if (!underRoot(abs, cwd) && !isAbsolute(token)) {
+    if (!underRoot(abs, cwd)) {
+      return {
+        raw: token,
+        path: token,
+        absolute: abs,
+        isDir: false,
+        note: "outside project root \u2014 skipped"
+      };
+    }
+  }
+  if (isAbsolute(token) && !underRoot(abs, cwd)) {
+    return {
+      raw: token,
+      path: token,
+      absolute: abs,
+      isDir: false,
+      note: "outside project root \u2014 skipped"
+    };
+  }
+  if (!existsSync37(abs)) {
+    return {
+      raw: token,
+      path: token,
+      absolute: abs,
+      isDir: false,
+      note: "not found"
+    };
+  }
+  let st;
+  try {
+    st = statSync6(abs);
+  } catch {
+    return {
+      raw: token,
+      path: token,
+      absolute: abs,
+      isDir: false,
+      note: "unreadable"
+    };
+  }
+  const rel2 = relative3(cwd, abs).replace(/\\/g, "/") || ".";
+  if (st.isDirectory()) {
+    return {
+      raw: token,
+      path: rel2,
+      absolute: abs,
+      isDir: true,
+      note: "directory \u2014 list/read with tools as needed"
+    };
+  }
+  if (st.size > ATTACH_FILE_MAX_BYTES) {
+    return {
+      raw: token,
+      path: rel2,
+      absolute: abs,
+      isDir: false,
+      note: `too large (${Math.round(st.size / 1024)} KB) \u2014 path only`
+    };
+  }
+  try {
+    const buf = readFileSync30(abs);
+    const head = buf.subarray(0, 800).toString("utf8");
+    if (!isProbablyText(abs, head)) {
+      return {
+        raw: token,
+        path: rel2,
+        absolute: abs,
+        isDir: false,
+        note: "binary \u2014 path only"
+      };
+    }
+    let text = buf.toString("utf8");
+    if (text.charCodeAt(0) === 65279) text = text.slice(1);
+    if (text.length > ATTACH_TEXT_MAX) {
+      text = text.slice(0, ATTACH_TEXT_MAX) + `
+
+\u2026 [truncated, ${text.length - ATTACH_TEXT_MAX} more chars]`;
+    }
+    return { raw: token, path: rel2, absolute: abs, isDir: false, text };
+  } catch (err) {
+    return {
+      raw: token,
+      path: rel2,
+      absolute: abs,
+      isDir: false,
+      note: err instanceof Error ? err.message : "read failed"
+    };
+  }
+}
+function expandAtMentions(userText, cwd = process.cwd()) {
+  const tokens = extractAtMentions(userText);
+  if (tokens.length === 0) {
+    return { text: userText, hits: [] };
+  }
+  const hits = [];
+  for (const t of tokens) {
+    const hit = resolveMention(t, cwd);
+    if (hit) hits.push(hit);
+  }
+  if (hits.length === 0) {
+    return { text: userText, hits: [] };
+  }
+  const blocks = hits.map((h) => {
+    const label = h.path || h.raw;
+    if (h.text != null && h.text.length > 0) {
+      return `--- File: ${label} ---
+${h.text}
+--- End file ---`;
+    }
+    const extra = h.note ? ` (${h.note})` : "";
+    return `--- ${h.isDir ? "Dir" : "File"}: ${label}${extra} ---`;
+  });
+  const text = `${userText.trim()}
+
+[Tagged paths]
+${blocks.join("\n\n")}`;
+  return { text, hits };
+}
+function hasAtMentions(text) {
+  return extractAtMentions(text).length > 0;
+}
+var ATTACH_TEXT_MAX, ATTACH_FILE_MAX_BYTES, AT_PATH_RE;
+var init_atMentions = __esm({
+  "src/cli/atMentions.ts"() {
+    "use strict";
+    ATTACH_TEXT_MAX = 48e3;
+    ATTACH_FILE_MAX_BYTES = 512e3;
+    AT_PATH_RE = /(^|[\s([{])@((?:\.{1,2}\/)?[A-Za-z0-9_.+-]+(?:[\\/][A-Za-z0-9_.+-]+)*)/g;
+  }
+});
+
 // src/cli/triggerLock.ts
 var triggerLock_exports = {};
 __export(triggerLock_exports, {
@@ -34592,13 +35031,1024 @@ var init_triggerLock = __esm({
   }
 });
 
+// src/cli/desktopConfig.ts
+function wantsPrintConfig(argv) {
+  return argv.includes("--print-config");
+}
+function wantsSetKey(argv) {
+  return argv.includes("--set-key");
+}
+function wantsDiscoverModels(argv) {
+  return argv.includes("--discover-models");
+}
+function parseSetConfigFlags(argv) {
+  if (!argv.includes("--set-config")) {
+    return { request: null };
+  }
+  let provider;
+  let model;
+  let endpoint;
+  let endpointClear = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--provider") {
+      provider = argv[i + 1];
+      i++;
+    } else if (arg === "--model") {
+      model = argv[i + 1];
+      i++;
+    } else if (arg === "--endpoint") {
+      endpoint = argv[i + 1];
+      i++;
+    } else if (arg === "--endpoint-clear") {
+      endpointClear = true;
+    }
+  }
+  if (!provider && !model && !endpoint && !endpointClear) {
+    return {
+      request: null,
+      error: "--set-config requires --provider, --model, --endpoint, and/or --endpoint-clear"
+    };
+  }
+  if (provider !== void 0 && provider.trim().length === 0) {
+    return { request: null, error: "--provider cannot be empty" };
+  }
+  if (model !== void 0 && model.trim().length === 0) {
+    return { request: null, error: "--model cannot be empty" };
+  }
+  if (endpoint !== void 0 && endpoint.trim().length === 0) {
+    return { request: null, error: "--endpoint cannot be empty" };
+  }
+  if (endpoint && endpointClear) {
+    return { request: null, error: "--endpoint and --endpoint-clear conflict" };
+  }
+  return {
+    request: {
+      provider: provider?.trim(),
+      model: model?.trim(),
+      endpoint: endpoint?.trim(),
+      endpointClear: endpointClear || void 0
+    }
+  };
+}
+function parseSetKeyFlags(argv) {
+  if (!argv.includes("--set-key")) {
+    return { request: null };
+  }
+  let provider;
+  let key;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--provider") {
+      provider = argv[i + 1];
+      i++;
+    } else if (arg === "--key") {
+      key = argv[i + 1];
+      i++;
+    }
+  }
+  if (!provider || provider.trim().length === 0) {
+    return { request: null, error: "--set-key requires --provider <id>" };
+  }
+  if (!key || key.trim().length === 0) {
+    return { request: null, error: "--set-key requires --key <secret>" };
+  }
+  return {
+    request: {
+      provider: provider.trim(),
+      key: key.trim()
+    }
+  };
+}
+function parseDiscoverModelsFlags(argv) {
+  if (!argv.includes("--discover-models")) {
+    return { provider: null, present: false };
+  }
+  let provider;
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--provider") {
+      provider = argv[i + 1];
+      i++;
+    }
+  }
+  return {
+    present: true,
+    provider: provider?.trim() || null
+  };
+}
+function buildDesktopConfigSnapshot() {
+  const config2 = getProviderConfig();
+  const providers = PROVIDERS.map((p3) => {
+    const cached2 = getCachedModels(p3.id);
+    const models = cached2?.models.map((m) => m.id) ?? [];
+    const defaultModel = config2.modelByProvider[p3.id] ?? "";
+    if (defaultModel && !models.includes(defaultModel)) {
+      models.unshift(defaultModel);
+    }
+    const custom2 = getCustomEndpoint(p3.id);
+    const builtin = p3.baseUrl ?? null;
+    return {
+      id: p3.id,
+      displayName: p3.displayName,
+      hasKey: !!resolveApiKey(p3.id),
+      envVar: p3.envVar,
+      models,
+      defaultModel,
+      endpoint: custom2 ?? null,
+      baseUrl: custom2 ?? builtin
+    };
+  });
+  return {
+    activeProviderId: config2.activeProviderId,
+    modelByProvider: { ...config2.modelByProvider },
+    providers,
+    cliVersion: getCurrentVersion(),
+    configPaths: {
+      provider: getProviderConfigPath(),
+      keys: getKeyStorePath()
+    }
+  };
+}
+function printDesktopConfig() {
+  const snap = buildDesktopConfigSnapshot();
+  process.stdout.write(JSON.stringify(snap, null, 2) + "\n");
+}
+function applySetConfig(req) {
+  try {
+    const config2 = getProviderConfig();
+    let targetProvider = req.provider ?? config2.activeProviderId;
+    if (req.provider) {
+      const exists = PROVIDERS.some((p3) => p3.id === req.provider);
+      if (!exists) {
+        return {
+          ok: false,
+          error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
+        };
+      }
+      setActiveProviderId(req.provider);
+      targetProvider = req.provider;
+    }
+    if (req.endpointClear) {
+      clearCustomEndpoint(targetProvider);
+    }
+    if (req.endpoint) {
+      setCustomEndpoint(targetProvider, req.endpoint);
+    }
+    if (req.model) {
+      setModelForProvider(targetProvider, req.model);
+    }
+    const after = getProviderConfig();
+    const ep = getCustomEndpoint(after.activeProviderId);
+    return {
+      ok: true,
+      message: `activeProvider=${after.activeProviderId} model=${after.modelByProvider[after.activeProviderId]}` + (ep ? ` endpoint=${ep}` : "")
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function applySetKey(req) {
+  try {
+    const exists = PROVIDERS.some((p3) => p3.id === req.provider);
+    if (!exists) {
+      return {
+        ok: false,
+        error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
+      };
+    }
+    setApiKey(req.provider, req.key);
+    setActiveProviderId(req.provider);
+    return {
+      ok: true,
+      provider: req.provider,
+      masked: maskKey(req.key)
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function runDiscoverModels(providerArg) {
+  const config2 = getProviderConfig();
+  const providerId = (providerArg ?? config2.activeProviderId).trim();
+  if (!DISCOVERABLE.includes(providerId)) {
+    if (providerId === "custom") {
+    } else {
+      return {
+        ok: false,
+        error: `provider '${providerId}' is not discoverable. Use: ${DISCOVERABLE.join(", ")}`
+      };
+    }
+  }
+  const discoveryId = providerId === "custom" ? "openai-compatible" : providerId;
+  try {
+    const entry = await discoverModelsForProvider(discoveryId);
+    return {
+      ok: true,
+      payload: {
+        ok: true,
+        provider: providerId,
+        models: entry.models.map((m) => m.id),
+        fetchedAt: entry.fetchedAt,
+        baseUrl: entry.baseUrl
+      }
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var DISCOVERABLE;
+var init_desktopConfig = __esm({
+  "src/cli/desktopConfig.ts"() {
+    "use strict";
+    init_keyStore();
+    init_providerConfig();
+    init_modelDiscovery();
+    init_updater();
+    DISCOVERABLE = [
+      "grok",
+      "glm",
+      "minimax",
+      "deepseek",
+      "openai-compatible"
+    ];
+  }
+});
+
+// src/cli/companion/config.ts
+import {
+  existsSync as existsSync40,
+  mkdirSync as mkdirSync17,
+  readFileSync as readFileSync33,
+  writeFileSync as writeFileSync21
+} from "node:fs";
+import { join as join35 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { createHash as createHash6, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+function getZelariHome() {
+  return join35(homedir11(), ".zelari-code");
+}
+function getCompanionConfigPath() {
+  return join35(getZelariHome(), "companion.json");
+}
+function getCompanionTokenPath() {
+  return join35(getZelariHome(), "companion.token");
+}
+function ensureHome() {
+  const home = getZelariHome();
+  if (!existsSync40(home)) {
+    mkdirSync17(home, { recursive: true });
+  }
+}
+function loadCompanionConfig() {
+  const path40 = getCompanionConfigPath();
+  if (!existsSync40(path40)) {
+    return { projects: [] };
+  }
+  try {
+    const raw = JSON.parse(readFileSync33(path40, "utf8"));
+    const projects = Array.isArray(raw.projects) ? raw.projects.filter(
+      (p3) => p3 && typeof p3.path === "string" && p3.path.trim() && typeof (p3.id ?? p3.name) === "string"
+    ).map((p3) => ({
+      id: String(p3.id || p3.name).trim().toLowerCase().replace(/[^a-z0-9-_]+/g, "-").slice(0, 64),
+      name: String(p3.name || p3.id || "project").trim() || "project",
+      path: String(p3.path).trim()
+    })) : [];
+    return {
+      projects,
+      bind: typeof raw.bind === "string" ? raw.bind : void 0,
+      port: typeof raw.port === "number" ? raw.port : void 0
+    };
+  } catch {
+    return { projects: [] };
+  }
+}
+function saveCompanionConfig(cfg) {
+  ensureHome();
+  writeFileSync21(
+    getCompanionConfigPath(),
+    JSON.stringify(
+      {
+        bind: cfg.bind,
+        port: cfg.port,
+        projects: cfg.projects
+      },
+      null,
+      2
+    ) + "\n",
+    "utf8"
+  );
+}
+function loadOrCreateToken(explicit) {
+  if (explicit && explicit.trim()) {
+    return { token: explicit.trim(), created: false };
+  }
+  ensureHome();
+  const path40 = getCompanionTokenPath();
+  if (existsSync40(path40)) {
+    const t = readFileSync33(path40, "utf8").trim();
+    if (t) return { token: t, created: false };
+  }
+  const token = randomBytes2(24).toString("base64url");
+  writeFileSync21(path40, token + "\n", "utf8");
+  try {
+    const fs24 = __require("node:fs");
+    fs24.chmodSync?.(path40, 384);
+  } catch {
+  }
+  return { token, created: true };
+}
+function tokenMatches(expected, provided) {
+  if (!provided) return false;
+  const a = createHash6("sha256").update(expected).digest();
+  const b = createHash6("sha256").update(provided).digest();
+  try {
+    return timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function slugFromPath(p3) {
+  const base = p3.replace(/[/\\]+$/, "").split(/[/\\]/).pop() || "project";
+  return base.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "project";
+}
+function mergeProjects(cfg, extraPaths) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const p3 of cfg.projects) {
+    byId.set(p3.id, p3);
+  }
+  for (const raw of extraPaths) {
+    const path40 = raw.trim();
+    if (!path40) continue;
+    let id = slugFromPath(path40);
+    let n = 2;
+    while (byId.has(id) && byId.get(id).path !== path40) {
+      id = `${slugFromPath(path40)}-${n++}`;
+    }
+    byId.set(id, {
+      id,
+      name: slugFromPath(path40),
+      path: path40
+    });
+  }
+  return [...byId.values()];
+}
+function resolveProjectPath(projects, cwdOrId) {
+  if (!projects.length) {
+    return {
+      ok: false,
+      error: "No projects configured. Pass --project <path> or edit ~/.zelari-code/companion.json"
+    };
+  }
+  if (!cwdOrId || !String(cwdOrId).trim()) {
+    return { ok: true, project: projects[0] };
+  }
+  const key = String(cwdOrId).trim();
+  const byId = projects.find((p3) => p3.id === key || p3.name === key);
+  if (byId) return { ok: true, project: byId };
+  const norm = key.replace(/\\/g, "/").toLowerCase();
+  const byPath = projects.find(
+    (p3) => p3.path.replace(/\\/g, "/").toLowerCase() === norm
+  );
+  if (byPath) return { ok: true, project: byPath };
+  const under = projects.find((p3) => {
+    const root = p3.path.replace(/\\/g, "/").toLowerCase().replace(/\/$/, "");
+    return norm === root || norm.startsWith(root + "/");
+  });
+  if (under) {
+    return {
+      ok: true,
+      project: { ...under, path: key }
+    };
+  }
+  return {
+    ok: false,
+    error: `cwd/project not in allowlist: ${key}. Allowed: ${projects.map((p3) => p3.id).join(", ")}`
+  };
+}
+var DEFAULT_COMPANION_PORT, DEFAULT_COMPANION_BIND;
+var init_config = __esm({
+  "src/cli/companion/config.ts"() {
+    "use strict";
+    DEFAULT_COMPANION_PORT = 7421;
+    DEFAULT_COMPANION_BIND = "127.0.0.1";
+  }
+});
+
+// src/cli/companion/runManager.ts
+import { spawn as spawn11 } from "node:child_process";
+import { createInterface } from "node:readline";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { writeFileSync as writeFileSync22, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join36 } from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+var RunManager;
+var init_runManager = __esm({
+  "src/cli/companion/runManager.ts"() {
+    "use strict";
+    RunManager = class {
+      active = null;
+      recent = [];
+      getActive() {
+        return this.active?.run ?? null;
+      }
+      getRun(id) {
+        if (this.active?.run.id === id) return this.active.run;
+        return this.recent.find((r) => r.id === id) ?? null;
+      }
+      listRecent(limit = 20) {
+        const cur = this.active ? [this.active.run] : [];
+        return [...cur, ...this.recent].slice(0, limit);
+      }
+      subscribe(runId, fn) {
+        if (this.active?.run.id === runId) {
+          for (const ev of this.active.run.events) {
+            try {
+              fn(ev);
+            } catch {
+            }
+          }
+          this.active.listeners.add(fn);
+          return () => {
+            this.active?.listeners.delete(fn);
+          };
+        }
+        const past = this.recent.find((r) => r.id === runId);
+        if (past) {
+          for (const ev of past.events) {
+            try {
+              fn(ev);
+            } catch {
+            }
+          }
+        }
+        return () => {
+        };
+      }
+      emit(ev) {
+        if (!this.active) return;
+        this.active.run.events.push(ev);
+        if (this.active.run.events.length > 5e3) {
+          this.active.run.events.splice(0, this.active.run.events.length - 4e3);
+        }
+        for (const fn of this.active.listeners) {
+          try {
+            fn(ev);
+          } catch {
+          }
+        }
+      }
+      start(args) {
+        if (this.active) {
+          return {
+            ok: false,
+            error: `A run is already active (${this.active.run.id}). Cancel it first.`
+          };
+        }
+        const prompt = args.prompt?.trim();
+        if (!prompt) return { ok: false, error: "prompt is required" };
+        const id = randomUUID6();
+        const mode = (args.mode || "agent").toLowerCase();
+        const phase2 = (args.phase || "build").toLowerCase();
+        const run = {
+          id,
+          status: "running",
+          prompt,
+          mode,
+          phase: phase2,
+          cwd: args.cwd,
+          createdAt: Date.now(),
+          events: []
+        };
+        const cliEntry = process.argv[1];
+        if (!cliEntry) {
+          return { ok: false, error: "Cannot resolve CLI entry (process.argv[1])" };
+        }
+        const argv = [
+          cliEntry,
+          "--headless",
+          "--task",
+          prompt,
+          "--output",
+          "json",
+          "--mode",
+          mode === "council" || mode === "zelari" ? mode : "agent",
+          "--phase",
+          phase2 === "plan" ? "plan" : "build"
+        ];
+        if (args.provider?.trim()) {
+          argv.push("--provider", args.provider.trim());
+        }
+        if (args.model?.trim()) {
+          argv.push("--model", args.model.trim());
+        }
+        let historyFile;
+        if (args.history && Array.isArray(args.history) && args.history.length > 0) {
+          historyFile = join36(tmpdir3(), `zelari-companion-hist-${id}.json`);
+          try {
+            writeFileSync22(historyFile, JSON.stringify(args.history), "utf8");
+            argv.push("--history-file", historyFile);
+          } catch {
+            historyFile = void 0;
+          }
+        }
+        const child = spawn11(process.execPath, argv, {
+          cwd: args.cwd,
+          env: {
+            ...process.env,
+            ZELARI_SKIP_PREFLIGHT: "1",
+            ANATHEMA_DEV: "1",
+            FORCE_COLOR: "0"
+          },
+          stdio: ["ignore", "pipe", "pipe"],
+          windowsHide: true
+        });
+        this.active = { run, child, listeners: /* @__PURE__ */ new Set(), historyFile };
+        this.emit({
+          type: "log",
+          message: `[companion] run ${id} started mode=${mode} phase=${phase2} cwd=${args.cwd}`
+        });
+        if (child.stdout) {
+          const rl = createInterface({ input: child.stdout });
+          rl.on("line", (line) => {
+            const t = line.trim();
+            if (!t) return;
+            try {
+              const ev = JSON.parse(t);
+              this.emit(ev);
+            } catch {
+              this.emit({ type: "log", message: t });
+            }
+          });
+        }
+        child.stderr?.on("data", (buf) => {
+          const text = buf.toString("utf8").trim();
+          if (!text) return;
+          for (const line of text.split(/\r?\n/)) {
+            if (line.trim()) {
+              this.emit({ type: "log", message: line.trim() });
+            }
+          }
+        });
+        child.on("error", (err) => {
+          run.status = "error";
+          run.error = err.message;
+          run.finishedAt = Date.now();
+          this.emit({
+            type: "error",
+            severity: "fatal",
+            message: err.message,
+            code: "spawn"
+          });
+          this.finishActive();
+        });
+        child.on("close", (code) => {
+          if (run.status === "running") {
+            run.status = code === 0 ? "completed" : "error";
+            run.exitCode = code;
+            run.finishedAt = Date.now();
+            if (code !== 0 && !run.error) {
+              run.error = `exit ${code}`;
+            }
+          }
+          this.emit({
+            type: "run_finished",
+            runId: id,
+            status: run.status,
+            exitCode: code
+          });
+          this.finishActive();
+        });
+        return { ok: true, run };
+      }
+      cancel(runId) {
+        if (!this.active) {
+          return { ok: false, error: "No active run" };
+        }
+        if (runId && this.active.run.id !== runId) {
+          return { ok: false, error: `Run ${runId} is not active` };
+        }
+        const { run, child } = this.active;
+        run.status = "cancelled";
+        run.finishedAt = Date.now();
+        this.emit({
+          type: "log",
+          message: `[companion] cancelling run ${run.id}`
+        });
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+        setTimeout(() => {
+          try {
+            if (!child.killed) child.kill("SIGKILL");
+          } catch {
+          }
+        }, 1500);
+        return { ok: true };
+      }
+      finishActive() {
+        if (!this.active) return;
+        const { run, historyFile } = this.active;
+        if (historyFile) {
+          try {
+            unlinkSync2(historyFile);
+          } catch {
+          }
+        }
+        this.recent.unshift(run);
+        if (this.recent.length > 30) this.recent.length = 30;
+        this.active = null;
+      }
+    };
+  }
+});
+
+// src/cli/companion/serve.ts
+var serve_exports = {};
+__export(serve_exports, {
+  parseServeFlags: () => parseServeFlags,
+  runCompanionServe: () => runCompanionServe
+});
+import { createServer } from "node:http";
+import { existsSync as existsSync41 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+function readBody(req, max = 2e6) {
+  return new Promise((resolveBody, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > max) {
+        reject(new Error("body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => resolveBody(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+function sendJson(res, status, body, extraHeaders) {
+  const data = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(data),
+    "access-control-allow-origin": "*",
+    "access-control-allow-headers": "authorization, content-type",
+    "access-control-allow-methods": "GET, POST, OPTIONS",
+    ...extraHeaders
+  });
+  res.end(data);
+}
+function getBearer(req) {
+  const h = req.headers.authorization;
+  if (!h) return null;
+  const m = /^Bearer\s+(.+)$/i.exec(h.trim());
+  return m?.[1]?.trim() || null;
+}
+function parseUrl(req) {
+  return new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+}
+async function runCompanionServe(opts = {}) {
+  const fileCfg = loadCompanionConfig();
+  const bind = (opts.bind || fileCfg.bind || DEFAULT_COMPANION_BIND).trim();
+  const port = opts.port ?? fileCfg.port ?? DEFAULT_COMPANION_PORT;
+  const { token, created } = loadOrCreateToken(opts.token);
+  let projects = mergeProjects(fileCfg, opts.projects ?? []);
+  projects = projects.filter((p3) => {
+    const abs = resolve2(p3.path);
+    if (!existsSync41(abs)) {
+      process.stderr.write(
+        `[zelari-code serve] skip missing project path: ${p3.path}
+`
+      );
+      return false;
+    }
+    p3.path = abs;
+    return true;
+  });
+  if (opts.persistProjects && projects.length > 0) {
+    saveCompanionConfig({
+      ...fileCfg,
+      bind,
+      port,
+      projects
+    });
+  }
+  if (projects.length === 0) {
+    const cwd = resolve2(process.cwd());
+    projects = [
+      {
+        id: "default",
+        name: "default",
+        path: cwd
+      }
+    ];
+    process.stderr.write(
+      `[zelari-code serve] no projects configured \u2014 using cwd as default: ${cwd}
+  Add more: zelari-code serve --project <path>
+  Or edit ~/.zelari-code/companion.json
+`
+    );
+  }
+  const runs = new RunManager();
+  const server = createServer(async (req, res) => {
+    if (req.method === "OPTIONS") {
+      res.writeHead(204, {
+        "access-control-allow-origin": "*",
+        "access-control-allow-headers": "authorization, content-type",
+        "access-control-allow-methods": "GET, POST, OPTIONS"
+      });
+      res.end();
+      return;
+    }
+    const url2 = parseUrl(req);
+    const path40 = url2.pathname.replace(/\/+$/, "") || "/";
+    try {
+      if (req.method === "GET" && (path40 === "/health" || path40 === "/v1/health")) {
+        sendJson(res, 200, {
+          ok: true,
+          service: "zelari-companion",
+          version: getCurrentVersion(),
+          bind,
+          port,
+          projects: projects.length,
+          activeRun: runs.getActive()?.id ?? null
+        });
+        return;
+      }
+      if (path40.startsWith("/v1")) {
+        if (!tokenMatches(token, getBearer(req))) {
+          sendJson(res, 401, { ok: false, error: "unauthorized" });
+          return;
+        }
+      }
+      if (req.method === "GET" && path40 === "/v1/config") {
+        const snap = buildDesktopConfigSnapshot();
+        sendJson(res, 200, { ok: true, ...snap });
+        return;
+      }
+      if (req.method === "GET" && path40 === "/v1/projects") {
+        sendJson(res, 200, {
+          ok: true,
+          projects: projects.map((p3) => ({
+            id: p3.id,
+            name: p3.name,
+            path: p3.path
+          }))
+        });
+        return;
+      }
+      if (req.method === "GET" && path40 === "/v1/runs") {
+        sendJson(res, 200, {
+          ok: true,
+          active: runs.getActive(),
+          recent: runs.listRecent().map((r) => ({
+            id: r.id,
+            status: r.status,
+            mode: r.mode,
+            phase: r.phase,
+            cwd: r.cwd,
+            createdAt: r.createdAt,
+            finishedAt: r.finishedAt,
+            exitCode: r.exitCode,
+            promptPreview: r.prompt.slice(0, 120)
+          }))
+        });
+        return;
+      }
+      if (req.method === "POST" && path40 === "/v1/runs") {
+        const raw = await readBody(req);
+        let body = {};
+        try {
+          body = raw ? JSON.parse(raw) : {};
+        } catch {
+          sendJson(res, 400, { ok: false, error: "invalid JSON body" });
+          return;
+        }
+        const prompt = String(body.prompt ?? body.task ?? "").trim();
+        const mode = String(body.mode ?? "agent");
+        const phase2 = String(body.phase ?? "build");
+        const cwdArg = body.cwd != null ? String(body.cwd) : body.projectId != null ? String(body.projectId) : null;
+        const resolved = resolveProjectPath(projects, cwdArg);
+        if (!resolved.ok) {
+          sendJson(res, 400, { ok: false, error: resolved.error });
+          return;
+        }
+        const history2 = Array.isArray(body.history) ? body.history : void 0;
+        const result = runs.start({
+          prompt,
+          mode,
+          phase: phase2,
+          cwd: resolved.project.path,
+          provider: body.provider != null ? String(body.provider) : void 0,
+          model: body.model != null ? String(body.model) : void 0,
+          history: history2
+        });
+        if (!result.ok) {
+          sendJson(res, 409, { ok: false, error: result.error });
+          return;
+        }
+        sendJson(res, 201, {
+          ok: true,
+          run: {
+            id: result.run.id,
+            status: result.run.status,
+            mode: result.run.mode,
+            phase: result.run.phase,
+            cwd: result.run.cwd,
+            createdAt: result.run.createdAt
+          },
+          eventsUrl: `/v1/runs/${result.run.id}/events`,
+          cancelUrl: `/v1/runs/${result.run.id}/cancel`
+        });
+        return;
+      }
+      const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path40);
+      if (req.method === "GET" && eventsMatch) {
+        const runId = eventsMatch[1];
+        const run = runs.getRun(runId);
+        if (!run) {
+          sendJson(res, 404, { ok: false, error: "run not found" });
+          return;
+        }
+        res.writeHead(200, {
+          "content-type": "text/event-stream; charset=utf-8",
+          "cache-control": "no-cache, no-transform",
+          connection: "keep-alive",
+          "access-control-allow-origin": "*",
+          "access-control-allow-headers": "authorization, content-type"
+        });
+        res.write(`: connected run=${runId}
+
+`);
+        const writeEv = (ev) => {
+          try {
+            res.write(`data: ${JSON.stringify(ev)}
+
+`);
+          } catch {
+          }
+        };
+        const unsub = runs.subscribe(runId, writeEv);
+        if (run.status !== "running" && run.status !== "queued") {
+          writeEv({
+            type: "run_finished",
+            runId,
+            status: run.status,
+            exitCode: run.exitCode ?? null
+          });
+          unsub();
+          res.end();
+          return;
+        }
+        const heartbeat = setInterval(() => {
+          try {
+            res.write(`: ping
+
+`);
+          } catch {
+          }
+        }, 15e3);
+        const onClose = () => {
+          clearInterval(heartbeat);
+          unsub();
+        };
+        req.on("close", onClose);
+        const check2 = setInterval(() => {
+          const r = runs.getRun(runId);
+          if (!r || r.status !== "running" && r.status !== "queued") {
+            clearInterval(check2);
+            clearInterval(heartbeat);
+            unsub();
+            try {
+              res.end();
+            } catch {
+            }
+          }
+        }, 500);
+        return;
+      }
+      const cancelMatch = /^\/v1\/runs\/([^/]+)\/cancel$/.exec(path40);
+      if (req.method === "POST" && cancelMatch) {
+        const runId = cancelMatch[1];
+        const result = runs.cancel(runId);
+        if (!result.ok) {
+          sendJson(res, 404, { ok: false, error: result.error });
+          return;
+        }
+        sendJson(res, 200, { ok: true, cancelled: runId });
+        return;
+      }
+      sendJson(res, 404, { ok: false, error: "not found" });
+    } catch (err) {
+      sendJson(res, 500, {
+        ok: false,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(port, bind, () => resolveListen());
+  });
+  server.ref();
+  try {
+    process.stdin?.resume?.();
+  } catch {
+  }
+  const tokenHint = created ? `NEW token saved to ~/.zelari-code/companion.token` : `token: ~/.zelari-code/companion.token`;
+  const displayHost = bind === "0.0.0.0" || bind === "::" ? "127.0.0.1 (and LAN/Tailscale interfaces)" : bind;
+  process.stderr.write(
+    `
+[zelari-code serve] companion host listening
+  URL     http://${displayHost === "127.0.0.1 (and LAN/Tailscale interfaces)" ? "127.0.0.1" : bind}:${port}
+  Bind    ${bind}
+  Health  GET /health
+  Auth    Authorization: Bearer <token>
+  ${tokenHint}
+  Projects (${projects.length}): ${projects.map((p3) => p3.id).join(", ")}
+  Phone   use http://<PC-LAN-or-Tailscale-IP>:${port}  (not 127.0.0.1 on the phone)
+  Stop    Ctrl+C  (keep this window open)
+
+`
+  );
+  if (created) {
+    process.stderr.write(`  Token (copy now): ${token}
+
+`);
+  }
+  await new Promise((resolveStop) => {
+    let stopped = false;
+    const stop = (sig) => {
+      if (stopped) return;
+      stopped = true;
+      process.stderr.write(`[zelari-code serve] shutting down (${sig})\u2026
+`);
+      try {
+        runs.cancel();
+      } catch {
+      }
+      server.close(() => resolveStop());
+      setTimeout(() => resolveStop(), 3e3).unref();
+    };
+    process.once("SIGINT", () => stop("SIGINT"));
+    process.once("SIGTERM", () => stop("SIGTERM"));
+    process.once("SIGHUP", () => stop("SIGHUP"));
+  });
+}
+function parseServeFlags(argv) {
+  if (!argv.includes("serve") && !argv.includes("--serve")) {
+    return null;
+  }
+  const get = (flag) => {
+    const i = argv.indexOf(flag);
+    return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+  };
+  const projects = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--project" && argv[i + 1]) {
+      projects.push(argv[i + 1]);
+      i++;
+    }
+  }
+  const portRaw = get("--port");
+  const port = portRaw ? Number.parseInt(portRaw, 10) : void 0;
+  return {
+    bind: get("--bind"),
+    port: Number.isFinite(port) ? port : void 0,
+    token: get("--token"),
+    projects,
+    persistProjects: argv.includes("--save-projects")
+  };
+}
+var init_serve = __esm({
+  "src/cli/companion/serve.ts"() {
+    "use strict";
+    init_updater();
+    init_desktopConfig();
+    init_config();
+    init_runManager();
+  }
+});
+
 // src/cli/utils/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
   runDoctor: () => runDoctor
 });
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync38, readFileSync as readFileSync31, readlinkSync, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync42, readFileSync as readFileSync34, readlinkSync, statSync as statSync7 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import path39 from "node:path";
@@ -34606,9 +36056,9 @@ function findPackageRoot(start) {
   let dir = start;
   for (let i = 0; i < 6; i += 1) {
     const candidate = path39.join(dir, "package.json");
-    if (existsSync38(candidate)) {
+    if (existsSync42(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync31(candidate, "utf8"));
+        const pkg = JSON.parse(readFileSync34(candidate, "utf8"));
         if (pkg.name === "zelari-code") return dir;
       } catch {
       }
@@ -34632,7 +36082,7 @@ function tryExec(cmd) {
 function readPackageJson3() {
   try {
     const pkgPath = path39.join(packageRoot, "package.json");
-    return JSON.parse(readFileSync31(pkgPath, "utf8"));
+    return JSON.parse(readFileSync34(pkgPath, "utf8"));
   } catch {
     return null;
   }
@@ -34648,16 +36098,16 @@ function checkShim(pkgName) {
   const isWin = process.platform === "win32";
   const shimName = isWin ? "zelari-code.cmd" : "zelari-code";
   const shimPath = path39.join(prefix, shimName);
-  if (!existsSync38(shimPath)) {
+  if (!existsSync42(shimPath)) {
     return FAIL(
       `shim not found at ${shimPath}
          fix:  npm install -g ${pkgName}@latest --force`
     );
   }
   try {
-    const st = statSync6(shimPath);
+    const st = statSync7(shimPath);
     if (isWin) {
-      const content = readFileSync31(shimPath, "utf8");
+      const content = readFileSync34(shimPath, "utf8");
       if (content.includes(`${pkgName}\\bin\\`) || content.includes(`${pkgName}/bin/`)) {
         return OK(`shim OK at ${shimPath} (${st.size} bytes)`);
       }
@@ -34716,14 +36166,14 @@ function checkNode(pkg) {
 }
 function checkBundle() {
   const bundle = path39.join(packageRoot, "dist", "cli", "main.bundled.js");
-  if (!existsSync38(bundle)) {
+  if (!existsSync42(bundle)) {
     return FAIL(
       `dist/cli/main.bundled.js missing at ${bundle}
          fix:  npm run build:cli   (then reinstall or run via tsx)`
     );
   }
   try {
-    const st = statSync6(bundle);
+    const st = statSync7(bundle);
     return OK(`bundle OK (${(st.size / 1024 / 1024).toFixed(2)} MB)`);
   } catch (err) {
     return FAIL(
@@ -35115,7 +36565,7 @@ function InputBarImpl({ value, onChange, onSubmit, disabled }) {
       value,
       onChange: stableChange,
       onSubmit: stableSubmit,
-      placeholder: disabled ? "..." : "Type a prompt or /skill <name>"
+      placeholder: disabled ? "..." : "Prompt, /skills, or @path"
     }
   ));
 }
@@ -35666,175 +37116,8 @@ function StartupBanner({
   return /* @__PURE__ */ React9.createElement(Box8, { flexDirection: "column", marginBottom: 1 }, /* @__PURE__ */ React9.createElement(Text9, { color: "cyan" }, "zelari-code v", version2, " \u2014 ", providerId, "/", model), /* @__PURE__ */ React9.createElement(Text9, { dimColor: true }, "cwd: ", cwd), /* @__PURE__ */ React9.createElement(Text9, { dimColor: true }, "/help \xB7 /plan \xB7 /build \xB7 /view-plan \xB7 shift+tab mode"));
 }
 
-// src/cli/modelDiscovery.ts
-import { promises as fs3, existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { homedir } from "node:os";
-import path4 from "node:path";
-var PROVIDER_BASE_URLS = {
-  "grok": "https://api.x.ai/v1",
-  // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
-  "glm": "https://api.z.ai/api/coding/paas/v4",
-  "minimax": "https://api.minimax.io/v1",
-  // Must match PROVIDER_ENDPOINTS in provider/openai-compatible.ts (chat host).
-  "deepseek": "https://api.deepseek.com",
-  "openai-compatible": "https://api.x.ai/v1"
-};
-async function resolveDiscoveryBaseUrl(provider, options) {
-  if (options.baseUrl) return options.baseUrl;
-  const { getCustomEndpoint: getCustomEndpoint2 } = await Promise.resolve().then(() => (init_providerConfig(), providerConfig_exports));
-  const custom2 = getCustomEndpoint2(provider);
-  if (custom2) return custom2;
-  if (provider === "openai-compatible") {
-    const envBase = process.env.OPENAI_BASE_URL;
-    if (envBase && envBase.trim().length > 0) return envBase;
-  }
-  return PROVIDER_BASE_URLS[provider];
-}
-function defaultModelsFilePath() {
-  return process.env.ANATHEMA_MODELS_FILE ?? path4.join(homedir(), ".tmp", "zelari-code", "models.json");
-}
-function getModelsFilePath() {
-  return defaultModelsFilePath();
-}
-function loadModelsRegistry(file2 = getModelsFilePath()) {
-  if (!existsSync3(file2)) return {};
-  try {
-    const raw = readFileSync3(file2, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object") return {};
-    return parsed;
-  } catch {
-    return {};
-  }
-}
-function getCachedModels(provider, file2 = getModelsFilePath()) {
-  const registry3 = loadModelsRegistry(file2);
-  return registry3[provider];
-}
-function isModelsCacheStale(provider, maxAgeMs = 6 * 60 * 60 * 1e3, file2 = getModelsFilePath(), now = Date.now()) {
-  const entry = getCachedModels(provider, file2);
-  if (!entry) return true;
-  return now - entry.fetchedAt > maxAgeMs;
-}
-var writeChain = Promise.resolve();
-async function withRegistryLock(fn) {
-  const next = writeChain.then(async () => fn());
-  writeChain = next.catch(() => void 0);
-  return next;
-}
-async function readModifyWriteRegistry(mutator, file2 = getModelsFilePath()) {
-  return withRegistryLock(async () => {
-    const onDisk = loadModelsRegistry(file2);
-    const merged = mutator(onDisk);
-    await fs3.mkdir(path4.dirname(file2), { recursive: true });
-    const tmp = `${file2}.tmp-${process.pid}-${Date.now()}`;
-    await fs3.writeFile(tmp, JSON.stringify(merged, null, 2), "utf-8");
-    await fs3.rename(tmp, file2);
-    return merged;
-  });
-}
-async function resolveAuthToken(provider, options) {
-  if (options.authToken) return options.authToken;
-  const { resolveApiKeyWithMeta: resolveApiKeyWithMeta2, getOAuthToken: getOAuthToken2 } = await Promise.resolve().then(() => (init_keyStore(), keyStore_exports));
-  if (provider === "grok") {
-    const oauth = getOAuthToken2("grok");
-    if (oauth?.apiKey) return oauth.apiKey;
-  }
-  const resolved = await resolveApiKeyWithMeta2(provider);
-  return resolved?.apiKey;
-}
-function parseOpenAIModelsResponse(json2, baseUrl) {
-  if (!json2 || typeof json2 !== "object") return [];
-  const obj = json2;
-  if (!Array.isArray(obj.data)) return [];
-  const models = [];
-  for (const m of obj.data) {
-    if (!m || typeof m.id !== "string") continue;
-    const out = { id: m.id };
-    if (typeof m.created === "number") out.created = m.created;
-    if (typeof m.owned_by === "string") out.ownedBy = m.owned_by;
-    const ctx = m.context_length;
-    if (typeof ctx === "number") out.contextLength = ctx;
-    models.push(out);
-  }
-  models.sort((a, b) => a.id.localeCompare(b.id));
-  return models;
-}
-async function discoverModelsForProvider(provider, options = {}) {
-  const baseUrl = await resolveDiscoveryBaseUrl(provider, options);
-  if (!baseUrl || baseUrl.trim().length === 0) {
-    throw new ModelDiscoveryError(
-      `No base URL for provider "${provider}" \u2014 set one with /provider custom <url> before discovering models`,
-      "no_base_url"
-    );
-  }
-  const url2 = `${baseUrl.replace(/\/$/, "")}/models`;
-  const authToken = await resolveAuthToken(provider, options);
-  const fetchImpl = options.fetchImpl ?? fetch;
-  let response;
-  try {
-    const headers = { Accept: "application/json" };
-    if (authToken) headers.Authorization = `Bearer ${authToken}`;
-    response = await fetchImpl(url2, { method: "GET", headers });
-  } catch (err) {
-    throw new ModelDiscoveryError(
-      `Network error contacting ${url2}: ${err instanceof Error ? err.message : String(err)}`,
-      "network_error"
-    );
-  }
-  if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new ModelDiscoveryError(
-      `HTTP ${response.status} from ${url2}: ${body.slice(0, 200)}`,
-      `http_${response.status}`
-    );
-  }
-  let json2;
-  try {
-    json2 = await response.json();
-  } catch (err) {
-    throw new ModelDiscoveryError(
-      `Invalid JSON from ${url2}: ${err instanceof Error ? err.message : String(err)}`,
-      "invalid_json"
-    );
-  }
-  const models = parseOpenAIModelsResponse(json2, baseUrl);
-  if (models.length === 0) {
-    throw new ModelDiscoveryError(
-      `Provider ${provider} returned 0 models \u2014 refusing to overwrite cache`,
-      "empty_response"
-    );
-  }
-  const entry = {
-    models,
-    fetchedAt: Date.now(),
-    baseUrl
-  };
-  if (!options.skipCacheWrite) {
-    const file2 = getModelsFilePath();
-    await readModifyWriteRegistry((current) => {
-      current[provider] = entry;
-      return current;
-    }, file2);
-  }
-  return entry;
-}
-function discoverModelsInBackground(provider, options = {}) {
-  discoverModelsForProvider(provider, options).catch((err) => {
-    if (err instanceof ModelDiscoveryError && options.onError) {
-      options.onError(err);
-    }
-  });
-}
-var ModelDiscoveryError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "ModelDiscoveryError";
-  }
-};
-
 // src/cli/app.tsx
+init_modelDiscovery();
 init_skills2();
 
 // src/cli/hooks/useGitChanges.ts
@@ -35895,12 +37178,12 @@ function mergeChanges(unstaged, staged, untrackedPaths) {
   return [...byPath.values()].sort((a, b) => churn(b) - churn(a));
 }
 function runGit(args, cwd) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     execFile(
       "git",
       args,
       { cwd, timeout: 5e3, windowsHide: true, maxBuffer: 4 * 1024 * 1024 },
-      (err, stdout) => err ? reject(err) : resolve(stdout)
+      (err, stdout) => err ? reject(err) : resolve3(stdout)
     );
   });
 }
@@ -38550,12 +39833,12 @@ var MetricsLogger = class {
   }
   /** Append a single record synchronously (file I/O). */
   append(rec) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       try {
         this.maybeRotate();
         const line = JSON.stringify(rec) + "\n";
         appendFileSync(this.file, line, { encoding: "utf-8" });
-        resolve();
+        resolve3();
       } catch (err) {
         reject(err);
       }
@@ -38699,7 +39982,7 @@ init_toolRegistry();
 init_toolPermissions();
 function createPermissionAskHandler(opts) {
   const { setPicker: setPicker2, appendSystem: appendSystem2 } = opts;
-  return (req) => new Promise((resolve) => {
+  return (req) => new Promise((resolve3) => {
     const cats = req.categories;
     const catLabel = cats.length === 1 ? cats[0] : cats.join("+") || "action";
     const title = `Allow tool "${req.toolName}"?`;
@@ -38716,7 +39999,7 @@ ${detail}
       settled = true;
       setPicker2(null);
       if (note) appendSystem2?.(note, Date.now());
-      resolve(ok);
+      resolve3(ok);
     };
     const items = [
       { value: "allow", label: "Allow once" },
@@ -39110,10 +40393,10 @@ function useChatTurn(params) {
         }
         setBusy(true);
         const workPhase = getPhase();
-        const onAskUser = setPicker2 ? (req) => new Promise((resolve) => {
+        const onAskUser = setPicker2 ? (req) => new Promise((resolve3) => {
           const choices = req.choices ?? [];
           if (choices.length < 2) {
-            resolve(null);
+            resolve3(null);
             return;
           }
           setLastClarification({
@@ -39134,7 +40417,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
             if (settled) return;
             settled = true;
             setPicker2(null);
-            resolve(value);
+            resolve3(value);
           };
           setPicker2({
             kind: "clarification",
@@ -39730,10 +41013,10 @@ async function dispatchCouncilPromptImpl(text, deps, overrides = {}) {
   const { composeProjectContext: composeProjectContext2 } = await Promise.resolve().then(() => (init_composeContext(), composeContext_exports));
   const { FeedbackStore: FeedbackStore2 } = await Promise.resolve().then(() => (init_councilFeedback(), councilFeedback_exports));
   const workPhase = getPhase();
-  const onAskUserCouncil = setPicker2 ? (req) => new Promise((resolve) => {
+  const onAskUserCouncil = setPicker2 ? (req) => new Promise((resolve3) => {
     const choices = req.choices ?? [];
     if (choices.length < 2) {
-      resolve(null);
+      resolve3(null);
       return;
     }
     setLastClarification({
@@ -39754,7 +41037,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
       if (settled) return;
       settled = true;
       setPicker2(null);
-      resolve(value);
+      resolve3(value);
     };
     setPicker2({
       kind: "clarification",
@@ -39883,10 +41166,10 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
         appendSystem(setMessages, message, Date.now());
       },
       // v1.8.0: pause council when a member asks a structured question.
-      onClarification: setPicker2 ? (req) => new Promise((resolve) => {
+      onClarification: setPicker2 ? (req) => new Promise((resolve3) => {
         const choices = req.choices ?? [];
         if (choices.length < 2) {
-          resolve(null);
+          resolve3(null);
           return;
         }
         setLastClarification({
@@ -39907,7 +41190,7 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
           if (settled) return;
           settled = true;
           setPicker2(null);
-          resolve(value);
+          resolve3(value);
         };
         setPicker2({
           kind: "clarification",
@@ -40519,7 +41802,8 @@ function handleSlashCommand(text, availableSkills) {
   /provider <name> \u2014 switch the active provider directly
   /provider custom <baseUrl> \u2014 point the active provider at a self-hosted endpoint (Ollama, LM Studio, vLLM, ...)
   /provider custom clear \u2014 clear the custom endpoint override
-  /skill <name> [input] \u2014 invoke a skill (autocomplete with /skill <TAB>)
+  /skill [name] [input] \u2014 list+pick a skill (no args) or invoke /skill <name>
+  /skills \u2014 interactive skill picker (same as /skill with no args)
   /skill-stats [name] \u2014 show invocation stats (success rate, avg duration, total tokens)
   /council <input> \u2014 invoke the multi-agent council on input
   /zelari <input> \u2014 run an autonomous mission (multi-run council until the MVP slice is complete)
@@ -40767,13 +42051,19 @@ ${formatSkillList(availableSkills)}`
         ...note ? { feedbackNote: note } : {}
       };
     }
+    case "skills": {
+      return {
+        handled: true,
+        kind: "skill_picker",
+        message: formatSkillList(availableSkills)
+      };
+    }
     case "skill": {
       const skillId = args[0];
       if (!skillId) {
         return {
           handled: true,
-          kind: "skill",
-          skillError: "Usage: /skill <name> [input]",
+          kind: "skill_picker",
           message: formatSkillList(availableSkills)
         };
       }
@@ -40782,7 +42072,7 @@ ${formatSkillList(availableSkills)}`
         return {
           handled: true,
           kind: "skill",
-          skillError: `Unknown skill: "${skillId}". Use /skill <TAB> for autocomplete.`,
+          skillError: `Unknown skill: "${skillId}". Use /skills to pick one.`,
           message: formatSkillList(availableSkills)
         };
       }
@@ -40790,7 +42080,8 @@ ${formatSkillList(availableSkills)}`
       const expandedSkill = expandSkillTemplate(skill, { input });
       return { handled: true, kind: "skill", expandedSkill };
     }
-    case "skill_stats": {
+    case "skill_stats":
+    case "skill-stats": {
       const skillId = args[0];
       return {
         handled: true,
@@ -41636,7 +42927,7 @@ ${browsers.output}` : "") + (browsers.ok ? "" : `
   return result;
 }
 function runPlaywrightInstallChromium(cwd, executor) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -41649,7 +42940,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve({
+      resolve3({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -41658,7 +42949,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve({
+      resolve3({
         ok,
         output: stdout + stderr,
         exitCode: code,
@@ -41668,7 +42959,7 @@ function runPlaywrightInstallChromium(cwd, executor) {
   });
 }
 function runNpm2(executor, args, cwd, mode, npmCliPath) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let stdout = "";
     let stderr = "";
     const stdio = ["ignore", "pipe", "pipe"];
@@ -41680,7 +42971,7 @@ function runNpm2(executor, args, cwd, mode, npmCliPath) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve({
+      resolve3({
         ok: false,
         output: stdout + stderr,
         error: err.message,
@@ -41689,7 +42980,7 @@ function runNpm2(executor, args, cwd, mode, npmCliPath) {
     });
     child.on("close", (code) => {
       const ok = code === 0;
-      resolve({
+      resolve3({
         ok,
         output: stdout + stderr,
         exitCode: code,
@@ -42142,6 +43433,7 @@ async function validateApiKey(providerId, apiKey, options = {}) {
 
 // src/cli/slashHandlers/provider.ts
 init_providerConfig();
+init_modelDiscovery();
 var UNKNOWN_PROVIDER_MSG = (id) => `[provider] unknown: ${id}. Available: openai-compatible, minimax, glm, grok, deepseek, custom`;
 var DISCOVERABLE_PROVIDERS = ["grok", "glm", "minimax", "deepseek", "openai-compatible"];
 function handleProviderList(ctx) {
@@ -42539,6 +43831,30 @@ async function applySteerInterrupt(options) {
 }
 
 // src/cli/slashHandlers/skills.ts
+function handleSkillPicker(ctx, skills, openPicker, fallbackMessage) {
+  if (!openPicker) {
+    appendSystem(
+      ctx.setMessages,
+      fallbackMessage ?? formatSkillList(skills)
+    );
+    return;
+  }
+  if (skills.length === 0) {
+    appendSystem(ctx.setMessages, "[skills] no skills registered");
+    return;
+  }
+  const items = [...skills].sort((a, b) => a.id.localeCompare(b.id)).map((s) => ({
+    value: s.id,
+    label: s.name || s.id,
+    hint: [s.category, s.estimatedCost, s.description?.slice(0, 60)].filter(Boolean).join(" \xB7 ")
+  }));
+  openPicker({
+    kind: "skill",
+    title: "Select a skill",
+    items,
+    commandPrefix: "/skill"
+  });
+}
 async function handleSkillStats(ctx, skillId) {
   const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path37.join(os12.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
   try {
@@ -42612,6 +43928,7 @@ function handleClearChat(setMessages, setSessionActive) {
 }
 
 // src/cli/hooks/useSlashDispatch.ts
+init_atMentions();
 function useSlashDispatch(params) {
   const {
     skills,
@@ -42652,19 +43969,27 @@ function useSlashDispatch(params) {
     const steerCtx = { ...skillCtx, harnessRef, setQueueCount, dispatchPrompt };
     const { onNewSession, onExit } = params;
     if (!result.handled) {
+      const expanded = expandAtMentions(value, process.cwd());
+      const promptText = expanded.text;
       appendUser(setMessages, value);
+      if (expanded.hits.length > 0) {
+        appendSystem(
+          setMessages,
+          `[tagged] ${expanded.hits.map((h) => h.path).join(", ")}`
+        );
+      }
       setSessionActive(true);
       if (mode === "zelari") {
         setInput("");
-        await dispatchZelariPrompt(value);
+        await dispatchZelariPrompt(promptText);
         return;
       }
       if (mode === "council") {
         setInput("");
-        await dispatchCouncilPrompt(value);
+        await dispatchCouncilPrompt(promptText);
         return;
       }
-      await dispatchPrompt(value);
+      await dispatchPrompt(promptText);
       setInput("");
       return;
     }
@@ -43014,11 +44339,20 @@ function useSlashDispatch(params) {
       setInput("");
       return;
     }
+    if (result.kind === "skill_picker") {
+      handleSkillPicker(skillCtx, skills, params.openPicker, result.message);
+      setInput("");
+      return;
+    }
     if (result.kind === "skill" && result.expandedSkill) {
       const sysMsg = result.message ?? `[skill] ${result.expandedSkill.skillId} \u2014 prompt ready (dispatch lands in Phase 14.7)`;
       appendSystem(setMessages, sysMsg);
       setInput("");
-      await dispatchPrompt(result.expandedSkill.prompt, {
+      const skillPrompt = expandAtMentions(
+        result.expandedSkill.prompt,
+        process.cwd()
+      ).text;
+      await dispatchPrompt(skillPrompt, {
         requiredTools: result.expandedSkill.requiredTools
       });
       return;
@@ -43669,9 +45003,9 @@ function ContinueKey({ onContinue }) {
 init_providerConfig();
 
 // src/cli/wizard/firstRun.ts
-import { existsSync as existsSync37 } from "node:fs";
+import { existsSync as existsSync38 } from "node:fs";
 function shouldRunWizard(input) {
-  const exists = input.exists ?? existsSync37;
+  const exists = input.exists ?? existsSync38;
   if (input.hasResetConfigFlag) {
     return { shouldRun: true, reason: "--reset-config flag forced wizard" };
   }
@@ -43956,7 +45290,7 @@ init_keyStore();
 init_providerConfig();
 init_openai_compatible();
 init_phase();
-import { readFileSync as readFileSync30 } from "node:fs";
+import { readFileSync as readFileSync31 } from "node:fs";
 function parseHeadlessFlags(argv) {
   if (!argv.includes("--headless")) {
     return { options: null };
@@ -44025,7 +45359,7 @@ function parseHeadlessFlags(argv) {
         let raw = null;
         if (arg === "--history-file") {
           try {
-            raw = readFileSync30(next, "utf-8");
+            raw = readFileSync31(next, "utf-8");
           } catch {
             raw = null;
           }
@@ -44155,6 +45489,17 @@ function createStreamScrubber() {
 
 // src/cli/runHeadless.ts
 async function runHeadless(opts) {
+  try {
+    const { expandAtMentions: expandAtMentions2 } = await Promise.resolve().then(() => (init_atMentions(), atMentions_exports));
+    const task = typeof opts.task === "string" ? opts.task : "";
+    if (task.includes("@")) {
+      const { text } = expandAtMentions2(task, process.cwd());
+      if (text !== task) {
+        opts = { ...opts, task: text };
+      }
+    }
+  } catch {
+  }
   let crashed = false;
   const handleFatal = (label, err) => {
     if (crashed) return;
@@ -45022,250 +46367,8 @@ ${ragContext}` : slicePrompt;
   return exitCode;
 }
 
-// src/cli/desktopConfig.ts
-init_keyStore();
-init_providerConfig();
-init_updater();
-function wantsPrintConfig(argv) {
-  return argv.includes("--print-config");
-}
-function wantsSetKey(argv) {
-  return argv.includes("--set-key");
-}
-function wantsDiscoverModels(argv) {
-  return argv.includes("--discover-models");
-}
-function parseSetConfigFlags(argv) {
-  if (!argv.includes("--set-config")) {
-    return { request: null };
-  }
-  let provider;
-  let model;
-  let endpoint;
-  let endpointClear = false;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--provider") {
-      provider = argv[i + 1];
-      i++;
-    } else if (arg === "--model") {
-      model = argv[i + 1];
-      i++;
-    } else if (arg === "--endpoint") {
-      endpoint = argv[i + 1];
-      i++;
-    } else if (arg === "--endpoint-clear") {
-      endpointClear = true;
-    }
-  }
-  if (!provider && !model && !endpoint && !endpointClear) {
-    return {
-      request: null,
-      error: "--set-config requires --provider, --model, --endpoint, and/or --endpoint-clear"
-    };
-  }
-  if (provider !== void 0 && provider.trim().length === 0) {
-    return { request: null, error: "--provider cannot be empty" };
-  }
-  if (model !== void 0 && model.trim().length === 0) {
-    return { request: null, error: "--model cannot be empty" };
-  }
-  if (endpoint !== void 0 && endpoint.trim().length === 0) {
-    return { request: null, error: "--endpoint cannot be empty" };
-  }
-  if (endpoint && endpointClear) {
-    return { request: null, error: "--endpoint and --endpoint-clear conflict" };
-  }
-  return {
-    request: {
-      provider: provider?.trim(),
-      model: model?.trim(),
-      endpoint: endpoint?.trim(),
-      endpointClear: endpointClear || void 0
-    }
-  };
-}
-function parseSetKeyFlags(argv) {
-  if (!argv.includes("--set-key")) {
-    return { request: null };
-  }
-  let provider;
-  let key;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--provider") {
-      provider = argv[i + 1];
-      i++;
-    } else if (arg === "--key") {
-      key = argv[i + 1];
-      i++;
-    }
-  }
-  if (!provider || provider.trim().length === 0) {
-    return { request: null, error: "--set-key requires --provider <id>" };
-  }
-  if (!key || key.trim().length === 0) {
-    return { request: null, error: "--set-key requires --key <secret>" };
-  }
-  return {
-    request: {
-      provider: provider.trim(),
-      key: key.trim()
-    }
-  };
-}
-function parseDiscoverModelsFlags(argv) {
-  if (!argv.includes("--discover-models")) {
-    return { provider: null, present: false };
-  }
-  let provider;
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === "--provider") {
-      provider = argv[i + 1];
-      i++;
-    }
-  }
-  return {
-    present: true,
-    provider: provider?.trim() || null
-  };
-}
-function buildDesktopConfigSnapshot() {
-  const config2 = getProviderConfig();
-  const providers = PROVIDERS.map((p3) => {
-    const cached2 = getCachedModels(p3.id);
-    const models = cached2?.models.map((m) => m.id) ?? [];
-    const defaultModel = config2.modelByProvider[p3.id] ?? "";
-    if (defaultModel && !models.includes(defaultModel)) {
-      models.unshift(defaultModel);
-    }
-    const custom2 = getCustomEndpoint(p3.id);
-    const builtin = p3.baseUrl ?? null;
-    return {
-      id: p3.id,
-      displayName: p3.displayName,
-      hasKey: !!resolveApiKey(p3.id),
-      envVar: p3.envVar,
-      models,
-      defaultModel,
-      endpoint: custom2 ?? null,
-      baseUrl: custom2 ?? builtin
-    };
-  });
-  return {
-    activeProviderId: config2.activeProviderId,
-    modelByProvider: { ...config2.modelByProvider },
-    providers,
-    cliVersion: getCurrentVersion(),
-    configPaths: {
-      provider: getProviderConfigPath(),
-      keys: getKeyStorePath()
-    }
-  };
-}
-function printDesktopConfig() {
-  const snap = buildDesktopConfigSnapshot();
-  process.stdout.write(JSON.stringify(snap, null, 2) + "\n");
-}
-function applySetConfig(req) {
-  try {
-    const config2 = getProviderConfig();
-    let targetProvider = req.provider ?? config2.activeProviderId;
-    if (req.provider) {
-      const exists = PROVIDERS.some((p3) => p3.id === req.provider);
-      if (!exists) {
-        return {
-          ok: false,
-          error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
-        };
-      }
-      setActiveProviderId(req.provider);
-      targetProvider = req.provider;
-    }
-    if (req.endpointClear) {
-      clearCustomEndpoint(targetProvider);
-    }
-    if (req.endpoint) {
-      setCustomEndpoint(targetProvider, req.endpoint);
-    }
-    if (req.model) {
-      setModelForProvider(targetProvider, req.model);
-    }
-    const after = getProviderConfig();
-    const ep = getCustomEndpoint(after.activeProviderId);
-    return {
-      ok: true,
-      message: `activeProvider=${after.activeProviderId} model=${after.modelByProvider[after.activeProviderId]}` + (ep ? ` endpoint=${ep}` : "")
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-function applySetKey(req) {
-  try {
-    const exists = PROVIDERS.some((p3) => p3.id === req.provider);
-    if (!exists) {
-      return {
-        ok: false,
-        error: `unknown provider '${req.provider}'. Available: ${PROVIDERS.map((p3) => p3.id).join(", ")}`
-      };
-    }
-    setApiKey(req.provider, req.key);
-    setActiveProviderId(req.provider);
-    return {
-      ok: true,
-      provider: req.provider,
-      masked: maskKey(req.key)
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-var DISCOVERABLE = [
-  "grok",
-  "glm",
-  "minimax",
-  "deepseek",
-  "openai-compatible"
-];
-async function runDiscoverModels(providerArg) {
-  const config2 = getProviderConfig();
-  const providerId = (providerArg ?? config2.activeProviderId).trim();
-  if (!DISCOVERABLE.includes(providerId)) {
-    if (providerId === "custom") {
-    } else {
-      return {
-        ok: false,
-        error: `provider '${providerId}' is not discoverable. Use: ${DISCOVERABLE.join(", ")}`
-      };
-    }
-  }
-  const discoveryId = providerId === "custom" ? "openai-compatible" : providerId;
-  try {
-    const entry = await discoverModelsForProvider(discoveryId);
-    return {
-      ok: true,
-      payload: {
-        ok: true,
-        provider: providerId,
-        models: entry.models.map((m) => m.id),
-        fetchedAt: entry.fetchedAt,
-        baseUrl: entry.baseUrl
-      }
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
+// src/cli/main.ts
+init_desktopConfig();
 
 // src/cli/plugins/cliFlags.ts
 init_registry2();
@@ -45364,6 +46467,451 @@ init_skillsMd();
 init_skills2();
 init_updater();
 init_mcpConfigIo();
+
+// src/cli/skillConfigIo.ts
+init_skills2();
+init_skillsMd();
+import {
+  existsSync as existsSync39,
+  mkdirSync as mkdirSync16,
+  readdirSync as readdirSync6,
+  readFileSync as readFileSync32,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync20
+} from "node:fs";
+import { dirname as dirname9, join as join34 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+
+// src/cli/skillCategories.ts
+var CODING_CATEGORIES_LIST = [
+  "plan",
+  "refactor",
+  "debug",
+  "review",
+  "test",
+  "docs",
+  "ops",
+  "git",
+  "db",
+  "maint"
+];
+var CODING_CATEGORIES2 = new Set(CODING_CATEGORIES_LIST);
+
+// src/cli/skillConfigIo.ts
+var NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var BUILTIN_SKILL_MODULES = [
+  "@zelari/core/skills/builtin/debugging",
+  "@zelari/core/skills/builtin/docs",
+  "@zelari/core/skills/builtin/git-ops",
+  "@zelari/core/skills/builtin/planning",
+  "@zelari/core/skills/builtin/refactoring",
+  "@zelari/core/skills/builtin/review",
+  "@zelari/core/skills/builtin/testing",
+  "@zelari/core/skills/builtin/schema-loop",
+  "@zelari/core/skills/builtin/computer-use-cua"
+];
+var builtinsLoaded = false;
+function ensureBuiltinSkillsLoadedSync() {
+  if (builtinsLoaded) return;
+  for (const spec of BUILTIN_SKILL_MODULES) {
+    try {
+      require?.(spec);
+    } catch {
+    }
+  }
+}
+function getUserSkillsDir() {
+  return join34(homedir10(), ".zelari-code", "skills");
+}
+function getProjectSkillsDir(projectRoot) {
+  return join34(projectRoot, ".zelari", "skills");
+}
+function skillFilePath(dir, name) {
+  return join34(dir, name, "SKILL.md");
+}
+function classifyScope(skillPath, projectRoot) {
+  const userDir = getUserSkillsDir().replace(/\\/g, "/");
+  const norm = skillPath.replace(/\\/g, "/");
+  if (norm.startsWith(userDir + "/") || norm === userDir) {
+    return { scope: "user", writable: true };
+  }
+  if (projectRoot) {
+    const projDir = getProjectSkillsDir(projectRoot).replace(/\\/g, "/");
+    if (norm.startsWith(projDir + "/") || norm === projDir) {
+      return { scope: "project", writable: true };
+    }
+  }
+  return { scope: "compat", writable: false };
+}
+function entryFromParsed(parsed, projectRoot) {
+  const { scope, writable } = classifyScope(parsed.sourcePath, projectRoot);
+  return {
+    id: parsed.name,
+    name: parsed.name,
+    description: parsed.description,
+    category: parsed.category,
+    estimatedCost: parsed.estimatedCost,
+    requiredTools: parsed.requiredTools,
+    scope,
+    path: parsed.sourcePath,
+    body: parsed.body,
+    builtin: false,
+    writable
+  };
+}
+function entryFromBuiltin(skill) {
+  return {
+    id: skill.id,
+    name: skill.name || skill.id,
+    description: skill.description || "",
+    category: skill.category,
+    estimatedCost: skill.estimatedCost,
+    requiredTools: skill.requiredTools,
+    scope: "builtin",
+    path: null,
+    // Expose body so Desktop skill picker can expand like `/skill <id>`.
+    body: skill.systemPromptFragment || void 0,
+    builtin: true,
+    writable: false
+  };
+}
+function scanSkillsDir(dir, projectRoot, seen, out) {
+  if (!existsSync39(dir)) return;
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const skillPath = skillFilePath(dir, entry);
+    if (!existsSync39(skillPath)) continue;
+    try {
+      const parsed = parseSkillMd(readFileSync32(skillPath, "utf8"), skillPath);
+      if (!parsed) continue;
+      if (seen.has(parsed.name)) continue;
+      seen.add(parsed.name);
+      out.push(entryFromParsed(parsed, projectRoot));
+    } catch {
+    }
+  }
+}
+function listSkillsSnapshot(projectRoot) {
+  const root = projectRoot && projectRoot.trim() ? projectRoot.trim() : null;
+  const userSkillsDir = getUserSkillsDir();
+  const projectSkillsDir = root ? getProjectSkillsDir(root) : null;
+  const skills = [];
+  const seen = /* @__PURE__ */ new Set();
+  if (root) {
+    scanSkillsDir(join34(root, ".zelari", "skills"), root, seen, skills);
+    scanSkillsDir(join34(root, ".claude", "skills"), root, seen, skills);
+    scanSkillsDir(join34(root, ".opencode", "skills"), root, seen, skills);
+  }
+  scanSkillsDir(userSkillsDir, root, seen, skills);
+  for (const s of listCodingSkills()) {
+    if (seen.has(s.id)) continue;
+    seen.add(s.id);
+    if (s.builtin) {
+      skills.push(entryFromBuiltin(s));
+    }
+  }
+  skills.sort((a, b) => {
+    const order = (s) => s === "project" ? 0 : s === "user" ? 1 : s === "compat" ? 2 : 3;
+    const d = order(a.scope) - order(b.scope);
+    if (d !== 0) return d;
+    return a.id.localeCompare(b.id);
+  });
+  return { userSkillsDir, projectSkillsDir, skills };
+}
+function serializeSkillMd(opts) {
+  const name = opts.name.trim().toLowerCase();
+  const description = opts.description.trim();
+  const body = opts.body.trim();
+  const lines = ["---", `name: ${name}`, `description: ${description}`];
+  const cat = (opts.category ?? "").trim().toLowerCase();
+  if (cat && CODING_CATEGORIES2.has(cat)) {
+    lines.push(`category: ${cat}`);
+  }
+  if (opts.tools && opts.tools.length > 0) {
+    lines.push(`tools: [${opts.tools.map((t) => t.trim()).filter(Boolean).join(", ")}]`);
+  }
+  const cost = (opts.cost ?? "").trim().toLowerCase();
+  if (cost === "low" || cost === "medium" || cost === "high") {
+    lines.push(`cost: ${cost}`);
+  }
+  lines.push("---", "", body, "");
+  return lines.join("\n");
+}
+function upsertSkill(opts) {
+  const name = opts.name.trim().toLowerCase();
+  if (!name || !NAME_RE.test(name)) {
+    return {
+      ok: false,
+      error: "Invalid skill name (use lowercase letters, digits, hyphens; max 64 chars)"
+    };
+  }
+  const description = opts.description.trim();
+  if (!description) {
+    return { ok: false, error: "description is required" };
+  }
+  const body = opts.body.trim();
+  if (!body) {
+    return { ok: false, error: "body is required" };
+  }
+  let dir;
+  if (opts.scope === "user") {
+    dir = getUserSkillsDir();
+  } else {
+    const root = opts.projectRoot?.trim();
+    if (!root) {
+      return {
+        ok: false,
+        error: "projectRoot required for project scope (Open Folder first)"
+      };
+    }
+    dir = getProjectSkillsDir(root);
+  }
+  const path40 = skillFilePath(dir, name);
+  const content = serializeSkillMd({
+    name,
+    description,
+    body,
+    category: opts.category,
+    tools: opts.tools,
+    cost: opts.cost
+  });
+  const parsed = parseSkillMd(content, path40);
+  if (!parsed) {
+    return { ok: false, error: "Generated SKILL.md failed validation" };
+  }
+  mkdirSync16(dirname9(path40), { recursive: true });
+  writeFileSync20(path40, content, "utf8");
+  return { ok: true, path: path40 };
+}
+function removeSkill(opts) {
+  const name = opts.name.trim().toLowerCase();
+  if (!name) {
+    return { ok: false, error: "name is required" };
+  }
+  let dir;
+  if (opts.scope === "user") {
+    dir = getUserSkillsDir();
+  } else {
+    const root = opts.projectRoot?.trim();
+    if (!root) {
+      return { ok: false, error: "projectRoot required for project scope" };
+    }
+    dir = getProjectSkillsDir(root);
+  }
+  const skillDir = join34(dir, name);
+  const path40 = skillFilePath(dir, name);
+  if (!existsSync39(path40) && !existsSync39(skillDir)) {
+    return { ok: false, error: `Skill "${name}" not found in ${dir}` };
+  }
+  try {
+    rmSync3(skillDir, { recursive: true, force: true });
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  return { ok: true, path: path40 };
+}
+
+// src/cli/generateSkillFromUrl.ts
+init_providerConfig();
+init_keyStore();
+init_openai_compatible();
+var MAX_PAGE_CHARS = 24e3;
+var FETCH_TIMEOUT_MS2 = 25e3;
+var LLM_TIMEOUT_MS = 9e4;
+var SYSTEM = `You convert web page content into a Zelari Code coding skill (SKILL.md style).
+
+Return ONLY a single JSON object (no markdown fences) with keys:
+- name: string, kebab-case id (a-z0-9-hyphens, max 64, start with letter/digit)
+- description: string, one line, what the skill does
+- body: string, markdown instructions the agent should follow (steps, rules, checks)
+- category: one of ${CODING_CATEGORIES_LIST.join("|")} (optional)
+- tools: string[] of tool names the skill needs (optional, e.g. bash, read_file, write_file)
+- cost: "low" | "medium" | "high" (optional, default medium)
+
+Rules:
+- Prefer actionable coding-agent instructions over marketing copy.
+- If the page is a skill/prompt already, adapt it cleanly to this schema.
+- If the page is docs/blog, distill a reusable workflow skill.
+- name must be unique-looking and descriptive (not "untitled" or "skill").
+- body must be non-empty markdown with clear steps.`;
+function stripHtml(html) {
+  let t = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<noscript[\s\S]*?<\/noscript>/gi, " ");
+  t = t.replace(/<!--[\s\S]*?-->/g, " ");
+  t = t.replace(/<[^>]+>/g, " ");
+  t = t.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+  t = t.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n");
+  t = t.replace(/[ \t]{2,}/g, " ").trim();
+  return t;
+}
+async function fetchUrlText(url2) {
+  const u = url2.trim();
+  if (!/^https?:\/\//i.test(u)) {
+    throw new Error("URL must start with http:// or https://");
+  }
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
+  try {
+    const res = await fetch(u, {
+      signal: controller.signal,
+      headers: {
+        "user-agent": "zelari-code-skill-import/1.0",
+        accept: "text/html,text/plain,application/json;q=0.9,*/*;q=0.8"
+      },
+      redirect: "follow"
+    });
+    if (!res.ok) {
+      throw new Error(`Fetch failed HTTP ${res.status}`);
+    }
+    const ct = (res.headers.get("content-type") || "").toLowerCase();
+    const raw = await res.text();
+    if (ct.includes("json") || raw.trimStart().startsWith("{") || raw.trimStart().startsWith("[")) {
+      return raw.slice(0, MAX_PAGE_CHARS);
+    }
+    if (ct.includes("html") || /<html[\s>]/i.test(raw) || /<body[\s>]/i.test(raw)) {
+      return stripHtml(raw).slice(0, MAX_PAGE_CHARS);
+    }
+    return raw.slice(0, MAX_PAGE_CHARS);
+  } finally {
+    clearTimeout(t);
+  }
+}
+function extractJsonObject(text) {
+  const trimmed = text.trim();
+  const fenced = /^```(?:json)?\s*([\s\S]*?)```$/i.exec(trimmed);
+  const body = fenced ? fenced[1].trim() : trimmed;
+  try {
+    return JSON.parse(body);
+  } catch {
+    const start = body.indexOf("{");
+    const end = body.lastIndexOf("}");
+    if (start >= 0 && end > start) {
+      return JSON.parse(body.slice(start, end + 1));
+    }
+    throw new Error("Model did not return valid JSON");
+  }
+}
+function normalizeDraft(raw, sourceUrl, provider, model) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid skill draft object");
+  }
+  const o = raw;
+  let name = String(o.name ?? "").trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  if (!name || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
+    try {
+      const path40 = new URL(sourceUrl).pathname.split("/").filter(Boolean).pop()?.replace(/\.[a-z0-9]+$/i, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+      name = path40 && /^[a-z0-9]/.test(path40) ? path40 : "imported-skill";
+    } catch {
+      name = "imported-skill";
+    }
+  }
+  const description = String(o.description ?? "").trim();
+  const body = String(o.body ?? "").trim();
+  if (!description) throw new Error("Model draft missing description");
+  if (!body) throw new Error("Model draft missing body");
+  const catRaw = String(o.category ?? "").trim().toLowerCase();
+  const category = CODING_CATEGORIES_LIST.includes(catRaw) ? catRaw : void 0;
+  let tools;
+  if (Array.isArray(o.tools)) {
+    tools = o.tools.map((t) => String(t).trim()).filter(Boolean);
+  } else if (typeof o.tools === "string" && o.tools.trim()) {
+    tools = o.tools.split(",").map((t) => t.trim()).filter(Boolean);
+  }
+  const costRaw = String(o.cost ?? "medium").trim().toLowerCase();
+  const cost = costRaw === "low" || costRaw === "high" || costRaw === "medium" ? costRaw : "medium";
+  return {
+    name,
+    description,
+    body,
+    category,
+    tools,
+    cost,
+    sourceUrl,
+    model,
+    provider
+  };
+}
+async function resolveLlm(opts) {
+  const active = opts.provider?.trim() || getProviderConfig().activeProviderId;
+  const meta3 = await resolveApiKeyWithMeta(active);
+  if (!meta3?.apiKey) {
+    throw new Error(
+      `No API key for provider '${active}'. Save a key in Settings \u2192 Provider.`
+    );
+  }
+  const baseUrl = resolveBaseUrl(active);
+  if (!baseUrl) {
+    throw new Error(
+      `No base URL for provider '${active}'. Set a custom endpoint in Settings.`
+    );
+  }
+  const model = opts.model?.trim() || getModelForProvider(active) || process.env.ZELARI_MODEL || "";
+  if (!model) {
+    throw new Error(`No model selected for provider '${active}'`);
+  }
+  return { provider: active, model, apiKey: meta3.apiKey, baseUrl };
+}
+async function generateSkillFromUrl(opts) {
+  const page = await fetchUrlText(opts.url);
+  if (!page.trim()) {
+    throw new Error("Page content is empty after fetch");
+  }
+  const llm = await resolveLlm({
+    provider: opts.provider,
+    model: opts.model
+  });
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), LLM_TIMEOUT_MS);
+  try {
+    const url2 = `${llm.baseUrl.replace(/\/$/, "")}/chat/completions`;
+    const res = await fetch(url2, {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${llm.apiKey}`
+      },
+      body: JSON.stringify({
+        model: llm.model,
+        temperature: 0.2,
+        max_tokens: 4096,
+        stream: false,
+        messages: [
+          { role: "system", content: SYSTEM },
+          {
+            role: "user",
+            content: `Source URL: ${opts.url.trim()}
+
+Page content (truncated):
+${page}`
+          }
+        ]
+      })
+    });
+    if (!res.ok) {
+      const errBody = await res.text().catch(() => "");
+      throw new Error(
+        `LLM HTTP ${res.status}${errBody ? `: ${errBody.slice(0, 200)}` : ""}`
+      );
+    }
+    const json2 = await res.json();
+    const text = json2.choices?.[0]?.message?.content?.trim();
+    if (!text) throw new Error("Empty model response");
+    const parsed = extractJsonObject(text);
+    return normalizeDraft(parsed, opts.url.trim(), llm.provider, llm.model);
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// src/cli/main.ts
 init_mcpPresets();
 init_targets();
 var VERSION = getCurrentVersion();
@@ -45403,7 +46951,7 @@ function runPreflight() {
 }
 async function backgroundUpdateCheck() {
   if (process.env.ANATHEMA_DEV === "1") return;
-  await new Promise((resolve) => setTimeout(resolve, 3e3));
+  await new Promise((resolve3) => setTimeout(resolve3, 3e3));
   try {
     const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_updater(), updater_exports));
     const info = await checkForUpdate2();
@@ -45441,6 +46989,35 @@ function pickRootComponent() {
     void runPluginsInstall(argv).then((code) => process.exit(code));
     return { kind: "done" };
   }
+  if (argv.includes("serve") || argv.includes("--serve")) {
+    const { parseServeFlags: parseServeFlags2 } = (init_serve(), __toCommonJS(serve_exports));
+    return { kind: "serve", serveOpts: parseServeFlags2(argv) ?? {} };
+  }
+  if (argv.includes("--generate-skill-from-url")) {
+    void (async () => {
+      try {
+        const get = (flag) => {
+          const i = argv.indexOf(flag);
+          return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+        };
+        const url2 = get("--url");
+        if (!url2) throw new Error("--url is required");
+        const draft = await generateSkillFromUrl({
+          url: url2,
+          provider: get("--provider"),
+          model: get("--model")
+        });
+        console.log(JSON.stringify({ ok: true, ...draft }, null, 2));
+        process.exit(0);
+      } catch (err) {
+        console.error(
+          `[zelari-code --generate-skill-from-url] ${err instanceof Error ? err.message : String(err)}`
+        );
+        process.exit(1);
+      }
+    })();
+    return { kind: "done" };
+  }
   if (argv.includes("--doctor") || argv.includes("doctor")) {
     const { runDoctor: runDoctor2 } = (init_doctor(), __toCommonJS(doctor_exports));
     void runDoctor2().then((healthy) => process.exit(healthy ? 0 : 1));
@@ -45492,7 +47069,7 @@ function pickRootComponent() {
   }
   if (argv.includes("--help") || argv.includes("-h")) {
     console.log(
-      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode agent|council|zelari  Dispatch mode (default: agent)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n  --print-config      Print provider/model config as JSON (no secrets)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable (required)\n    --args <json>     JSON array of args (optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
+      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode agent|council|zelari  Dispatch mode (default: agent)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --print-config      Print provider/model config as JSON (no secrets)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable (required)\n    --args <json>     JSON array of args (optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
     );
     process.exit(0);
   }
@@ -45571,6 +47148,82 @@ function pickRootComponent() {
       process.exit(1);
     }
   }
+  if (argv.includes("--print-skills")) {
+    try {
+      const cwdIdx = argv.indexOf("--cwd");
+      const cwd = cwdIdx >= 0 && argv[cwdIdx + 1] ? argv[cwdIdx + 1] : process.cwd();
+      ensureBuiltinSkillsLoadedSync();
+      const snap = listSkillsSnapshot(cwd);
+      console.log(JSON.stringify(snap, null, 2));
+      process.exit(0);
+    } catch (err) {
+      console.error(
+        `[zelari-code --print-skills] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+  }
+  if (argv.includes("--set-skill")) {
+    try {
+      const get = (flag) => {
+        const i = argv.indexOf(flag);
+        return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+      };
+      const name = get("--name");
+      const description = get("--description");
+      const body = get("--body");
+      const category = get("--category");
+      const toolsRaw = get("--tools");
+      const cost = get("--cost");
+      const scopeRaw = get("--scope") ?? "user";
+      const scope = scopeRaw === "project" ? "project" : "user";
+      const cwd = get("--cwd") ?? process.cwd();
+      if (!name) throw new Error("--name is required");
+      if (!description) throw new Error("--description is required");
+      if (!body) throw new Error("--body is required");
+      const tools = toolsRaw ? toolsRaw.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
+      const result = upsertSkill({
+        scope,
+        name,
+        description,
+        body,
+        category,
+        tools,
+        cost,
+        projectRoot: cwd
+      });
+      if (!result.ok) throw new Error(result.error);
+      console.log(JSON.stringify({ ok: true, path: result.path, name, scope }));
+      process.exit(0);
+    } catch (err) {
+      console.error(
+        `[zelari-code --set-skill] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+  }
+  if (argv.includes("--remove-skill")) {
+    try {
+      const get = (flag) => {
+        const i = argv.indexOf(flag);
+        return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+      };
+      const name = get("--name");
+      const scopeRaw = get("--scope") ?? "user";
+      const scope = scopeRaw === "project" ? "project" : "user";
+      const cwd = get("--cwd") ?? process.cwd();
+      if (!name) throw new Error("--name is required");
+      const result = removeSkill({ scope, name, projectRoot: cwd });
+      if (!result.ok) throw new Error(result.error);
+      console.log(JSON.stringify({ ok: true, path: result.path, name, scope }));
+      process.exit(0);
+    } catch (err) {
+      console.error(
+        `[zelari-code --remove-skill] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+  }
   if (argv.includes("--set-mcp-preset")) {
     try {
       const get = (flag) => {
@@ -45843,6 +47496,15 @@ function loadUserSkills() {
 function main() {
   const picked = pickRootComponent();
   if (picked.kind === "done") return;
+  if (picked.kind === "serve") {
+    void Promise.resolve().then(() => (init_serve(), serve_exports)).then(({ runCompanionServe: runCompanionServe2 }) => runCompanionServe2(picked.serveOpts ?? {})).then(() => process.exit(0)).catch((err) => {
+      console.error(
+        `[zelari-code serve] ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    });
+    return;
+  }
   runPreflight();
   loadUserSkills();
   if (picked.kind === "headless") {
@@ -45856,7 +47518,7 @@ function main() {
         closeMcpClients2();
       } catch {
       }
-      await new Promise((resolve) => setImmediate(resolve));
+      await new Promise((resolve3) => setImmediate(resolve3));
       process.exit(code);
     }).catch(async (err) => {
       console.error(