zelari-code 1.44.0 → 1.46.1

package/dist/cli/main.bundled.js

@@ -665,7 +665,7 @@ async function refreshGrokToken(options) {
   return parseTokenResponseBody(obj, accessToken);
 }
 async function openBrowser(url2) {
-  const { spawn: spawn14 } = await import("node:child_process");
+  const { spawn: spawn16 } = await import("node:child_process");
   const cmd = (() => {
     switch (process.platform) {
       case "darwin":
@@ -678,7 +678,7 @@ async function openBrowser(url2) {
   })();
   return new Promise((resolve3, reject) => {
     try {
-      const child = spawn14(cmd.bin, cmd.args, {
+      const child = spawn16(cmd.bin, cmd.args, {
         stdio: "ignore",
         detached: true
       });
@@ -3181,10 +3181,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path53) {
-  if (!path53)
+function getElementAtPath(obj, path55) {
+  if (!path55)
     return obj;
-  return path53.reduce((acc, key) => acc?.[key], obj);
+  return path55.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -3512,11 +3512,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path53, issues) {
+function prefixIssues(path55, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path53);
+    iss.path.unshift(path55);
     return iss;
   });
 }
@@ -3734,16 +3734,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path53 = []) => {
+  const processError = (error52, path55 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path53, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path55, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path53, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path53, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else {
-        const fullpath = [...path53, ...issue2.path];
+        const fullpath = [...path55, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -3770,17 +3770,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path53 = []) => {
+  const processError = (error52, path55 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path53, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path55, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path53, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path53, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else {
-        const fullpath = [...path53, ...issue2.path];
+        const fullpath = [...path55, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -3812,8 +3812,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path53 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path53) {
+  const path55 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path55) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -17316,13 +17316,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path53 = ref.slice(1).split("/").filter(Boolean);
-  if (path53.length === 0) {
+  const path55 = ref.slice(1).split("/").filter(Boolean);
+  if (path55.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path53[0] === defsKey) {
-    const key = path53[1];
+  if (path55[0] === defsKey) {
+    const key = path55[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -18625,6 +18625,27 @@ function coerceStringList(value, fallback) {
   }
   return fallback;
 }
+function hasRecursiveGlob(include) {
+  return include.some((g) => g.includes("**"));
+}
+function scopeWarnings(allEntries, include, matched) {
+  const warnings = [];
+  const filesWalked = allEntries.filter((e) => e.type === "file").length;
+  if (filesWalked === 0)
+    return warnings;
+  if (matched === 0) {
+    warnings.push(`SEARCH_EMPTY_SCOPE: include globs matched 0 of ${filesWalked} files walked \u2014 '*' matches only one path segment; use '**/<glob>' for recursive matching. Do not interpret this result as "pattern not found".`);
+    return warnings;
+  }
+  if (hasRecursiveGlob(include) || matched >= filesWalked)
+    return warnings;
+  const recursiveRegexes = compileGlobs(include.map((g) => `**/${g}`));
+  const wouldMatch = allEntries.filter((e) => e.type === "file" && matchesAnyCompiled(e.name, recursiveRegexes)).length;
+  if (wouldMatch > matched) {
+    warnings.push(`include globs matched ${matched} of ${filesWalked} files walked \u2014 '*' matches only one path segment; a '**/*.ts'-style recursive glob would have matched ${wouldMatch - matched} more file(s) in subdirectories`);
+  }
+  return warnings;
+}
 async function searchFile(absPath, relPath, regex, contextLines, remainingSlots) {
   let buf;
   try {
@@ -18701,7 +18722,7 @@ var init_search = __esm({
     });
     grepContentTool = {
       name: "grep_content",
-      description: 'Regex search for content in a file OR recursively in a directory. When path is a directory, include/exclude globs filter which files are searched (default: all files, excluding node_modules/dist/.git/etc.). include/exclude accept a single glob string (e.g. "*.ts") OR an array of globs. Returns matches with line numbers and surrounding context.',
+      description: 'Regex search for content in a file OR recursively in a directory. When path is a directory, include/exclude globs filter which files are searched (default: all files, excluding node_modules/dist/.git/etc.). Glob semantics: "*" matches ONE path segment only ("*.ts" does NOT match "sub/file.ts"); use "**" for recursive matching ("**/*.ts" matches at any depth). include/exclude accept a single glob string (e.g. "*.ts") OR an array of globs. Returns matches with line numbers and context, plus filesWalked/filesInTree counts and a warning when the include globs matched suspiciously few files.',
       permissions: ["read"],
       timeoutMs: 3e4,
       inputSchema: GrepContentArgsSchema,
@@ -18709,8 +18730,15 @@ var init_search = __esm({
         try {
           const absRoot = path8.isAbsolute(args.path) ? args.path : path8.join(ctx.cwd, args.path);
           const regex = new RegExp(args.pattern, "gm");
-          const include = coerceStringList(args.include, ["*"]);
+          const rawInclude = args.include;
+          const include = coerceStringList(rawInclude, ["*"]);
           const exclude = coerceStringList(args.exclude, DEFAULT_EXCLUDES);
+          const warnings = [];
+          if (Array.isArray(rawInclude) && rawInclude.length === 0) {
+            warnings.push('DEPRECATED_INPUT: empty include array \u2014 omit the field instead; this will become INVALID_ARGUMENT (planned v1.47). Fell back to ["*"]');
+          } else if (typeof rawInclude === "string") {
+            warnings.push(`include coerced from bare string to ${JSON.stringify(include)}`);
+          }
           if (!await isDirectory(absRoot)) {
             const single = await searchFile(absRoot, args.path, regex, args.contextLines, args.maxMatches);
             return typedOk({
@@ -18718,12 +18746,18 @@ var init_search = __esm({
               totalMatches: single.total,
               truncated: single.truncated,
               filesSearched: 1,
-              filesInTree: 1
+              filesInTree: 1,
+              filesWalked: 1,
+              effectiveInclude: include,
+              effectiveExclude: exclude,
+              ...warnings.length > 0 ? { warning: warnings.join("; ") } : {}
             });
           }
           const allEntries = [];
           await walk(absRoot, "", 0, args.maxDepth, exclude, allEntries, ctx.signal);
           const matchedFiles = filterByInclude(allEntries, include);
+          const filesWalked = allEntries.filter((e) => e.type === "file").length;
+          warnings.push(...scopeWarnings(allEntries, include, matchedFiles.length));
           const allMatches = [];
           let totalMatches = 0;
           let truncated = false;
@@ -18748,7 +18782,11 @@ var init_search = __esm({
             totalMatches,
             truncated,
             filesSearched,
-            filesInTree: matchedFiles.length
+            filesInTree: matchedFiles.length,
+            filesWalked,
+            effectiveInclude: include,
+            effectiveExclude: exclude,
+            ...warnings.length > 0 ? { warning: warnings.join("; ") } : {}
           });
         } catch (err) {
           return typedErr(err instanceof Error ? err.message : String(err));
@@ -19535,11 +19573,11 @@ var init_tools = __esm({
           if (!ctx.addDocument)
             return "Knowledge vault tool not available.";
           const title = args["title"] || "New Document";
-          const path53 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+          const path55 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
           const content = args["content"] || "";
           const tags = args["tags"] || [];
           ctx.addDocument({
-            path: path53,
+            path: path55,
             title,
             content,
             format: "markdown",
@@ -19548,7 +19586,7 @@ var init_tools = __esm({
             workspaceId: ctx.workspaceId
           });
           ctx.addActivity("vault", "created document", title);
-          return `Document "${title}" created at "${path53}".`;
+          return `Document "${title}" created at "${path55}".`;
         }
       }
     ];
@@ -23877,11 +23915,11 @@ var init_synthesisAudit = __esm({
 import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join2 } from "node:path";
 function loadNfrSpec(zelariRoot) {
-  const path53 = join2(zelariRoot, "nfr-spec.json");
-  if (!existsSync7(path53))
+  const path55 = join2(zelariRoot, "nfr-spec.json");
+  if (!existsSync7(path55))
     return null;
   try {
-    const raw = JSON.parse(readFileSync7(path53, "utf8"));
+    const raw = JSON.parse(readFileSync7(path55, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.targets))
       return null;
     return raw;
@@ -26187,9 +26225,9 @@ var init_types4 = __esm({
 import { readFileSync as readFileSync12 } from "node:fs";
 import { join as join8 } from "node:path";
 function readLessonsDeduped(zelariRoot) {
-  const path53 = join8(zelariRoot, LESSONS_FILE);
+  const path55 = join8(zelariRoot, LESSONS_FILE);
   try {
-    const raw = readFileSync12(path53, "utf8");
+    const raw = readFileSync12(path55, "utf8");
     const byId = /* @__PURE__ */ new Map();
     for (const line of raw.split(/\r?\n/)) {
       if (!line.trim())
@@ -26290,8 +26328,8 @@ function keywordsFrom(check2, signature) {
   return [.../* @__PURE__ */ new Set([...fromId, ...words])].slice(0, 12);
 }
 function writeLesson(zelariRoot, lesson) {
-  const path53 = join9(zelariRoot, LESSONS_FILE);
-  appendFileSync(path53, `${JSON.stringify(lesson)}
+  const path55 = join9(zelariRoot, LESSONS_FILE);
+  appendFileSync(path55, `${JSON.stringify(lesson)}
 `, "utf8");
 }
 function findSimilar(lessons, signature) {
@@ -26904,9 +26942,9 @@ function findCycle(nodes) {
     if (color.get(start) !== WHITE)
       continue;
     const stack = [[start, 0]];
-    const path53 = [];
+    const path55 = [];
     color.set(start, GRAY);
-    path53.push(start);
+    path55.push(start);
     while (stack.length > 0) {
       const top = stack[stack.length - 1];
       const [id, idx] = top;
@@ -26919,17 +26957,17 @@ function findCycle(nodes) {
           continue;
         const c = color.get(dep);
         if (c === GRAY) {
-          const at = path53.indexOf(dep);
-          return [...path53.slice(at), dep];
+          const at = path55.indexOf(dep);
+          return [...path55.slice(at), dep];
         }
         if (c === WHITE) {
           color.set(dep, GRAY);
-          path53.push(dep);
+          path55.push(dep);
           stack.push([dep, 0]);
         }
       } else {
         color.set(id, BLACK);
-        path53.pop();
+        path55.pop();
         stack.pop();
       }
     }
@@ -27849,8 +27887,8 @@ var init_runner = __esm({
           failed: [...this.tentaclesById.values()].filter((r) => r.status === "error"),
           pending: []
         };
-        const path53 = await this.host.saveSnapshot(snapshot, ".zelari/kraken/snapshots");
-        this.host.log(`checkpoint: ${label ?? "auto"} \u2192 ${path53}`);
+        const path55 = await this.host.saveSnapshot(snapshot, ".zelari/kraken/snapshots");
+        this.host.log(`checkpoint: ${label ?? "auto"} \u2192 ${path55}`);
         return snapshot;
       }
       callLog(msg, data) {
@@ -29463,9 +29501,9 @@ function spillToolOutput(fullText, meta3) {
     const rnd = randomBytes2(3).toString("hex");
     const safeTool = (meta3?.toolName ?? "tool").replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 32);
     const file2 = `${stamp}-${safeTool}-${hash3}-${rnd}.txt`;
-    const path53 = join11(dir, file2);
-    writeFileSync11(path53, fullText, "utf8");
-    return path53;
+    const path55 = join11(dir, file2);
+    writeFileSync11(path55, fullText, "utf8");
+    return path55;
   } catch {
     return null;
   }
@@ -29511,10 +29549,10 @@ function truncateToolResult(text, capOrOpts = TOOL_RESULT_LINE_CAP) {
 ${tail}`;
   }
   if (doSpill) {
-    const path53 = spillToolOutput(text, { toolName: opts.toolName });
-    if (path53) {
+    const path55 = spillToolOutput(text, { toolName: opts.toolName });
+    if (path55) {
       const spillNote = `
-\u2026 [full output spilled to: ${path53} \u2014 re-read with read_file if you need the complete text] \u2026`;
+\u2026 [full output spilled to: ${path55} \u2014 re-read with read_file if you need the complete text] \u2026`;
       if (preview.includes("] \u2026\n")) {
         preview = preview.replace("] \u2026\n", `] \u2026${spillNote}
 `);
@@ -30689,6 +30727,10 @@ var init_taskTool = __esm({
     EXPLORE_PROMPT = [
       "You are a focused EXPLORE tentacle of Kraken (parent super-agent).",
       "READ-ONLY tools only (read, list, grep, fetch). No edits, no shell.",
+      "OBSERVATION INTEGRITY: negative evidence is valid only from a completed",
+      "observation. Never conclude that code/symbols/files do not exist from",
+      "degraded results, zero files examined, or unavailable backends - report",
+      "the degraded status instead and widen the observation.",
       "Gather only what you need, then STOP with a concise conclusion:",
       "file paths, symbols, line refs, and how things connect. No large dumps.",
       "Respect any Scope / Acceptance sections in the user prompt.",
@@ -31375,28 +31417,28 @@ var init_storage = __esm({
     VALID_SCALARS = /^(true|false|null|~)$/i;
     Storage = class {
       /** Read a Markdown file with frontmatter. Throws if not found. */
-      read(path53) {
-        if (!existsSync18(path53)) {
-          throw new Error(`File not found: ${path53}`);
+      read(path55) {
+        if (!existsSync18(path55)) {
+          throw new Error(`File not found: ${path55}`);
         }
-        const md = readFileSync16(path53, "utf8");
+        const md = readFileSync16(path55, "utf8");
         return parseFrontmatter(md);
       }
       /** Read a Markdown file; returns null if not found. */
-      readIfExists(path53) {
-        if (!existsSync18(path53)) return null;
-        return this.read(path53);
+      readIfExists(path55) {
+        if (!existsSync18(path55)) return null;
+        return this.read(path55);
       }
       /**
        * Write a Markdown file atomically (tmp + rename). Creates parent dirs.
        * The meta object is serialized as YAML frontmatter; body as Markdown.
        */
-      write(path53, meta3, body) {
-        mkdirSync11(dirname2(path53), { recursive: true });
-        const tmp = path53 + ".tmp-" + process.pid;
+      write(path55, meta3, body) {
+        mkdirSync11(dirname2(path55), { recursive: true });
+        const tmp = path55 + ".tmp-" + process.pid;
         const md = serializeFrontmatter(meta3, body);
         writeFileSync13(tmp, md, "utf8");
-        renameSync2(tmp, path53);
+        renameSync2(tmp, path55);
       }
       /** List all .md files in a directory (non-recursive). */
       listMarkdown(dir) {
@@ -31458,8 +31500,8 @@ function nextPlanTaskId(store4) {
   return `t${store4.counter}`;
 }
 function writePlanTaskArtifact(rootDir, task) {
-  const path53 = join15(rootDir, "plan-tasks", `${task.id}.md`);
-  mkdirSync12(dirname3(path53), { recursive: true });
+  const path55 = join15(rootDir, "plan-tasks", `${task.id}.md`);
+  mkdirSync12(dirname3(path55), { recursive: true });
   const meta3 = {
     kind: "task",
     id: task.id,
@@ -31480,7 +31522,7 @@ function writePlanTaskArtifact(rootDir, task) {
     task.notes?.trim() ? task.notes.trim() : "_(no notes)_",
     ""
   ].filter((l) => l !== null).join("\n");
-  new Storage().write(path53, meta3, body);
+  new Storage().write(path55, meta3, body);
 }
 function loadHandle(rootDir) {
   const jsonPath = join15(rootDir, "plan.json");
@@ -31799,6 +31841,369 @@ var init_planTaskTools = __esm({
   }
 });
 
+// src/cli/tools/inspectTypecheckSafety.ts
+import { promises as fs12 } from "node:fs";
+import path21 from "node:path";
+import { spawn as spawn4 } from "node:child_process";
+async function scanTsbuildinfo(root) {
+  const found = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await fs12.readdir(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const p3 = path21.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SCAN_SKIP.has(entry.name)) stack.push(p3);
+      } else if (entry.name.endsWith(".tsbuildinfo")) {
+        found.push(path21.relative(root, p3).split(path21.sep).join("/"));
+      }
+    }
+  }
+  found.sort();
+  return found;
+}
+async function gitStatusPorcelain(root) {
+  return new Promise((resolve3) => {
+    const child = spawn4("git", ["status", "--porcelain"], { cwd: root, shell: false });
+    let out = "";
+    child.stdout.on("data", (d) => out += d.toString());
+    child.stderr.on("data", (d) => out += d.toString());
+    child.on("error", () => resolve3("<git-unavailable>"));
+    child.on("close", (code) => resolve3(code === 0 ? out : `<git-exit-${code ?? "none"}>`));
+  });
+}
+async function fingerprintWorkspace(root) {
+  const [gitStatus, tsbuildinfoFiles] = await Promise.all([
+    gitStatusPorcelain(root),
+    scanTsbuildinfo(root)
+  ]);
+  return { gitStatus, tsbuildinfoFiles };
+}
+function diffFingerprints(pre, post) {
+  const preSet = new Set(pre.tsbuildinfoFiles);
+  return {
+    newTsbuildinfo: post.tsbuildinfoFiles.filter((f) => !preSet.has(f)),
+    gitStatusChanged: post.gitStatus !== pre.gitStatus
+  };
+}
+async function cleanupArtifacts(root, relPaths) {
+  const cleaned = [];
+  const failed = [];
+  for (const rel2 of relPaths) {
+    try {
+      await fs12.unlink(path21.join(root, rel2));
+      cleaned.push(rel2);
+    } catch {
+      failed.push(rel2);
+    }
+  }
+  return { cleaned, failed };
+}
+function classifyTypecheckRefusal(output) {
+  if (/composite/i.test(output) && /(may not|cannot|disallow|disable)/i.test(output)) {
+    return "the TypeScript compiler refused to run on this composite/incremental project shape (tsc-level error about the build setup, not a type error) \u2014 inspect_command will not fake an empty result; run the project typecheck script directly if you need it";
+  }
+  return null;
+}
+var SCAN_SKIP;
+var init_inspectTypecheckSafety = __esm({
+  "src/cli/tools/inspectTypecheckSafety.ts"() {
+    "use strict";
+    SCAN_SKIP = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+  }
+});
+
+// src/cli/tools/inspectCommand.ts
+import { spawn as spawn5 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { existsSync as existsSync20, promises as fs13 } from "node:fs";
+import os8 from "node:os";
+import path22 from "node:path";
+function resolveNodeModuleBin(start, rel2) {
+  let dir = path22.resolve(start);
+  for (; ; ) {
+    const candidate = path22.join(dir, "node_modules", rel2);
+    if (existsSync20(candidate)) return candidate;
+    const parent = path22.dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function rejectFlagLike(kind, value) {
+  if (value.startsWith("-")) {
+    return `${kind} must not start with "-" (got ${JSON.stringify(value)}) \u2014 pass a value, not a flag`;
+  }
+  return null;
+}
+function buildInspectCommand(op, ctx) {
+  switch (op.operation) {
+    case "git_status":
+      return {
+        ok: true,
+        command: "git",
+        argv: ["status", ...op.short ? ["--short"] : []],
+        inspectionClass: "git-inspection"
+      };
+    case "git_log":
+      return {
+        ok: true,
+        command: "git",
+        argv: [
+          "log",
+          ...op.oneline ? ["--oneline"] : [],
+          ...op.limit !== void 0 ? ["-n", String(op.limit)] : []
+        ],
+        inspectionClass: "git-inspection"
+      };
+    case "git_diff": {
+      if (op.path !== void 0) {
+        const err = rejectFlagLike("path", op.path);
+        if (err) return { ok: false, reason: err };
+      }
+      return {
+        ok: true,
+        command: "git",
+        argv: [
+          "diff",
+          "--no-ext-diff",
+          "--no-textconv",
+          ...op.staged ? ["--staged"] : [],
+          ...op.path !== void 0 ? ["--", op.path] : []
+        ],
+        inspectionClass: "git-inspection"
+      };
+    }
+    case "git_show": {
+      const err = rejectFlagLike("ref", op.ref);
+      if (err) return { ok: false, reason: err };
+      return {
+        ok: true,
+        command: "git",
+        argv: ["show", "--no-ext-diff", "--no-textconv", op.ref],
+        inspectionClass: "git-inspection"
+      };
+    }
+    case "git_branch_current":
+      return { ok: true, command: "git", argv: ["branch", "--show-current"], inspectionClass: "git-inspection" };
+    case "git_ls_files":
+      return { ok: true, command: "git", argv: ["ls-files"], inspectionClass: "git-inspection" };
+    case "node_version":
+      return { ok: true, command: process.execPath, argv: ["--version"], inspectionClass: "env-info" };
+    case "npm_ls":
+    case "npm_outdated":
+    case "npm_view": {
+      const npmCli = ctx.npmCliPath ?? resolveNodeModuleBin(ctx.root, path22.join("npm", "bin", "npm-cli.js")) ?? path22.join(ctx.root, "node_modules", "npm", "bin", "npm-cli.js");
+      if (op.operation === "npm_view") {
+        const err = rejectFlagLike("package", op.package);
+        if (err) return { ok: false, reason: err };
+      }
+      const sub = op.operation === "npm_ls" ? ["ls", "--depth=0"] : op.operation === "npm_outdated" ? ["outdated"] : ["view", op.package];
+      return { ok: true, command: process.execPath, argv: [npmCli, ...sub], inspectionClass: "env-info" };
+    }
+    case "typecheck": {
+      const project = path22.resolve(ctx.cwd, op.project ?? "tsconfig.json");
+      const hash3 = createHash5("sha256").update(project).digest("hex").slice(0, 16);
+      const tsBuildInfoFile = path22.join(os8.tmpdir(), "zelari-inspect", `${hash3}.tsbuildinfo`);
+      return {
+        ok: true,
+        command: process.execPath,
+        argv: [
+          ctx.tscPath ?? resolveNodeModuleBin(ctx.root, path22.join("typescript", "bin", "tsc")) ?? resolveNodeModuleBin(ctx.cwd, path22.join("typescript", "bin", "tsc")) ?? path22.join(ctx.root, "node_modules", "typescript", "bin", "tsc"),
+          "--noEmit",
+          // S3.5 primary mechanism: redirect, never disable — composite forces
+          // incremental (TS#30661), so --incremental false would break on the
+          // very fixture it must support. The CLI override wins over any
+          // tsBuildInfoFile written into the tsconfig.
+          "--incremental",
+          "--tsBuildInfoFile",
+          tsBuildInfoFile,
+          "-p",
+          project
+        ],
+        inspectionClass: "project-code-execution",
+        tsBuildInfoFile
+      };
+    }
+  }
+}
+function runSpawn(command, argv, opts) {
+  return new Promise((resolve3) => {
+    let child;
+    try {
+      child = spawn5(command, argv, { cwd: opts.cwd, shell: false });
+    } catch (err) {
+      resolve3({ code: null, stdout: "", stderr: String(err), timedOut: false, spawnError: String(err) });
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, opts.timeoutMs);
+    const onAbort = () => {
+      timedOut = true;
+      child.kill();
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout?.on("data", (d) => stdout += d.toString());
+    child.stderr?.on("data", (d) => stderr += d.toString());
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve3({ code: null, stdout, stderr, timedOut, spawnError: err.message });
+    });
+    child.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      resolve3({ code, stdout, stderr, timedOut });
+    });
+  });
+}
+function capOutput(stdout, stderr) {
+  const combined = stderr ? `${stdout}
+[stderr]
+${stderr}` : stdout;
+  if (combined.length <= MAX_OUTPUT_CHARS) return { output: combined, truncated: false };
+  return {
+    output: `${combined.slice(0, MAX_OUTPUT_CHARS)}
+\u2026 (truncated, ${combined.length} chars total)`,
+    truncated: true
+  };
+}
+async function typecheckGuarded(built, root, signal) {
+  const pre = await fingerprintWorkspace(root);
+  const r = await runSpawn(built.command, built.argv, { cwd: root, timeoutMs: TYPECHECK_TIMEOUT_MS, signal });
+  if (r.spawnError) {
+    return typedErr(`SPAWN_ERROR: typecheck could not launch: ${r.spawnError}`);
+  }
+  const { output, truncated } = capOutput(r.stdout, r.stderr);
+  const refusal = r.code !== 0 ? classifyTypecheckRefusal(`${r.stdout}
+${r.stderr}`) : null;
+  if (refusal) {
+    return typedOk({
+      status: "unsupported_project_shape",
+      operation: "typecheck",
+      inspectionClass: built.inspectionClass,
+      reason: refusal,
+      exitCode: r.code,
+      output,
+      truncated
+    });
+  }
+  const post = await fingerprintWorkspace(root);
+  const delta = diffFingerprints(pre, post);
+  if (delta.newTsbuildinfo.length > 0 || delta.gitStatusChanged) {
+    const cleanup = await cleanupArtifacts(root, delta.newTsbuildinfo);
+    return typedOk({
+      status: "degraded",
+      operation: "typecheck",
+      inspectionClass: built.inspectionClass,
+      exitCode: r.code,
+      output,
+      truncated,
+      artifactsWritten: delta.newTsbuildinfo,
+      gitStatusChanged: delta.gitStatusChanged,
+      cleanedUp: cleanup.cleaned,
+      cleanupFailed: cleanup.failed,
+      note: `UNEXPECTED WORKSPACE ARTIFACTS: the typecheck wrote build artifacts into the workspace despite the tsbuildinfo redirect. This result is NOT a clean observation \u2014 treat the typecheck verdict as unreliable until the artifact leak is understood. ${cleanup.cleaned.length} artifact(s) removed, ${cleanup.failed.length} could not be removed.`
+    });
+  }
+  return typedOk({
+    status: "ok",
+    operation: "typecheck",
+    inspectionClass: built.inspectionClass,
+    exitCode: r.code,
+    output,
+    truncated,
+    note: r.code === 0 ? "compiler completed with no diagnostics; tsbuildinfo was redirected to the OS temp dir \u2014 the workspace is untouched (verified by pre/post fingerprint)" : `compiler exited ${r.code} \u2014 diagnostics above are real type errors (a successful, scoped observation: the run itself worked and wrote nothing to the workspace)`
+  });
+}
+function createInspectCommandTool(rootOrDeps) {
+  const deps = typeof rootOrDeps === "string" ? { root: rootOrDeps } : rootOrDeps;
+  const tool = {
+    name: "inspect_command",
+    description: "Allowlisted read-only command inspector for plan/read-only sessions (no shell, no mutations). Pick an operation instead of writing a command: git_status, git_log, git_diff, git_show, git_branch_current, git_ls_files, typecheck, node_version, npm_ls, npm_outdated, npm_view. typecheck runs the project TypeScript compiler with --noEmit and a temp-dir tsbuildinfo redirect, verified by a pre/post workspace fingerprint (inspectionClass: 'project-code-execution' \u2014 you are executing the project's own toolchain, not reading git).",
+    permissions: ["read"],
+    timeoutMs: 9e4,
+    inputSchema: inspectInputSchema,
+    execute: async (input, ctx) => {
+      const op = input;
+      const cwd = ctx?.cwd ?? deps.root;
+      const built = buildInspectCommand(op, { root: deps.root, cwd, tscPath: deps.tscPath, npmCliPath: deps.npmCliPath });
+      if (!built.ok) return typedErr(`INVALID_ARGUMENT: ${built.reason}`);
+      if (op.operation === "typecheck") {
+        const tsc = built.argv[0];
+        try {
+          await fs13.access(tsc);
+        } catch {
+          return typedErr(
+            `TYPESCRIPT_UNAVAILABLE: no TypeScript compiler at ${tsc} \u2014 inspect_command typecheck uses the project toolchain (walk-up to node_modules/typescript/bin/tsc) and refuses to guess. Install dependencies or fall back to read_file/grep_content.`
+          );
+        }
+        return typecheckGuarded(built, deps.root, ctx?.signal);
+      }
+      const r = await runSpawn(built.command, built.argv, { cwd, timeoutMs: SPAWN_TIMEOUT_MS, signal: ctx?.signal });
+      if (r.spawnError) return typedErr(`SPAWN_ERROR: ${op.operation} could not launch: ${r.spawnError}`);
+      const { output, truncated } = capOutput(r.stdout, r.stderr);
+      return typedOk({
+        status: r.timedOut ? "timeout" : "ok",
+        operation: op.operation,
+        inspectionClass: built.inspectionClass,
+        exitCode: r.code,
+        output,
+        truncated,
+        ...r.timedOut ? { note: `command timed out after ${SPAWN_TIMEOUT_MS} ms` } : {}
+      });
+    }
+  };
+  return tool;
+}
+var MAX_OUTPUT_CHARS, SPAWN_TIMEOUT_MS, TYPECHECK_TIMEOUT_MS, inspectInputSchema;
+var init_inspectCommand = __esm({
+  "src/cli/tools/inspectCommand.ts"() {
+    "use strict";
+    init_zod();
+    init_toolTypes();
+    init_inspectTypecheckSafety();
+    MAX_OUTPUT_CHARS = 8 * 1024;
+    SPAWN_TIMEOUT_MS = 85e3;
+    TYPECHECK_TIMEOUT_MS = 85e3;
+    inspectInputSchema = external_exports.discriminatedUnion("operation", [
+      external_exports.object({ operation: external_exports.literal("git_status"), short: external_exports.boolean().optional() }),
+      external_exports.object({
+        operation: external_exports.literal("git_log"),
+        limit: external_exports.number().int().min(1).max(200).optional(),
+        oneline: external_exports.boolean().optional()
+      }),
+      external_exports.object({
+        operation: external_exports.literal("git_diff"),
+        staged: external_exports.boolean().optional(),
+        path: external_exports.string().optional()
+      }),
+      external_exports.object({ operation: external_exports.literal("git_show"), ref: external_exports.string().min(1) }),
+      external_exports.object({ operation: external_exports.literal("git_branch_current") }),
+      external_exports.object({ operation: external_exports.literal("git_ls_files") }),
+      external_exports.object({ operation: external_exports.literal("typecheck"), project: external_exports.string().optional() }),
+      external_exports.object({ operation: external_exports.literal("node_version") }),
+      external_exports.object({ operation: external_exports.literal("npm_ls") }),
+      external_exports.object({ operation: external_exports.literal("npm_outdated") }),
+      external_exports.object({ operation: external_exports.literal("npm_view"), package: external_exports.string().min(1) })
+    ]);
+  }
+});
+
 // src/cli/lsp/protocol.ts
 function encodeMessage(message) {
   const json2 = JSON.stringify(message);
@@ -31862,6 +32267,10 @@ function fmtLocation(loc, relativeTo) {
   const col = (loc.range?.start?.character ?? 0) + 1;
   return `${rel2}:${line}:${col}`;
 }
+function degradedNote(provider, file2) {
+  if (provider.serverStatusFor?.(file2) !== "unavailable") return void 0;
+  return "LSP_PROVIDER_DEGRADED: no language server is available for this file (server not installed or failed to start) \u2014 an empty result here is NOT evidence about the symbol; fall back to ast_outline/find_symbol, grep_content or read_file.";
+}
 function createLspTools(provider, root = process.cwd()) {
   const goToDefinition = {
     name: "go_to_definition",
@@ -31871,9 +32280,11 @@ function createLspTools(provider, root = process.cwd()) {
     execute: async (args) => {
       const a = args;
       const locs = await provider.definition(a.path, a.line - 1, a.column - 1);
+      const degraded = degradedNote(provider, a.path);
       return typedOk({
         definitions: locs.map((l) => fmtLocation(l, root)),
-        count: locs.length
+        count: locs.length,
+        ...degraded ? { degraded } : {}
       });
     }
   };
@@ -31885,9 +32296,11 @@ function createLspTools(provider, root = process.cwd()) {
     execute: async (args) => {
       const a = args;
       const locs = await provider.references(a.path, a.line - 1, a.column - 1);
+      const degraded = degradedNote(provider, a.path);
       return typedOk({
         references: locs.map((l) => fmtLocation(l, root)),
-        count: locs.length
+        count: locs.length,
+        ...degraded ? { degraded } : {}
       });
     }
   };
@@ -31899,7 +32312,13 @@ function createLspTools(provider, root = process.cwd()) {
     execute: async (args) => {
       const a = args;
       const text = await provider.hover(a.path, a.line - 1, a.column - 1);
-      return typedOk({ hover: text ?? "(no hover information)" });
+      const degraded = degradedNote(provider, a.path);
+      return typedOk({
+        // Degraded + no text → the note replaces the neutral message:
+        // "(no hover information)" would be a fake-empty under a dead server.
+        hover: text ?? degraded ?? "(no hover information)",
+        ...degraded ? { degraded } : {}
+      });
     }
   };
   const documentSymbols = {
@@ -31912,9 +32331,11 @@ function createLspTools(provider, root = process.cwd()) {
     execute: async (args) => {
       const a = args;
       const symbols = await provider.documentSymbols(a.path);
+      const degraded = degradedNote(provider, a.path);
       return typedOk({
         symbols: symbols.map((s) => `${s.kind} ${s.name} (line ${s.line})`),
-        count: symbols.length
+        count: symbols.length,
+        ...degraded ? { degraded } : {}
       });
     }
   };
@@ -31928,12 +32349,16 @@ function createLspTools(provider, root = process.cwd()) {
     execute: async (args) => {
       const a = args;
       const result = await provider.rename(a.path, a.line - 1, a.column - 1, a.newName);
+      const degraded = degradedNote(provider, a.path);
       if (!result) {
-        return typedOk({ preview: "no rename available at this position (symbol not found or not renameable)" });
+        return typedOk({
+          preview: degraded ?? "no rename available at this position (symbol not found or not renameable)"
+        });
       }
       return typedOk({
         totalEdits: result.totalEdits,
-        files: result.files.map((f) => `${relativePosix(root, f.file)} (${f.count} edit${f.count === 1 ? "" : "s"})`)
+        files: result.files.map((f) => `${relativePosix(root, f.file)} (${f.count} edit${f.count === 1 ? "" : "s"})`),
+        ...degraded ? { degraded } : {}
       });
     }
   };
@@ -32035,9 +32460,9 @@ var init_client = __esm({
 });
 
 // src/cli/lsp/servers.ts
-import path21 from "node:path";
+import path23 from "node:path";
 function languageIdForFile(file2) {
-  const ext = path21.extname(file2).toLowerCase();
+  const ext = path23.extname(file2).toLowerCase();
   const map2 = {
     ".ts": "typescript",
     ".tsx": "typescriptreact",
@@ -32052,7 +32477,7 @@ function languageIdForFile(file2) {
   return map2[ext] ?? "plaintext";
 }
 function serverForFile(file2, servers = LSP_SERVERS) {
-  const ext = path21.extname(file2).toLowerCase();
+  const ext = path23.extname(file2).toLowerCase();
   return servers.find((s) => s.extensions.includes(ext)) ?? null;
 }
 function resolveServerCommand(file2, cwd, servers = LSP_SERVERS) {
@@ -32101,7 +32526,7 @@ var init_servers = __esm({
 });
 
 // src/cli/lsp/manager.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 import { readFileSync as readFileSync18 } from "node:fs";
 function processTransport(child) {
   return {
@@ -32237,7 +32662,7 @@ var init_manager = __esm({
       // languages already flagged as unavailable
       constructor(options = {}) {
         this.cwd = options.cwd ?? process.cwd();
-        this.spawnImpl = options.spawnImpl ?? spawn4;
+        this.spawnImpl = options.spawnImpl ?? spawn6;
         this.timeoutMs = options.timeoutMs ?? 15e3;
         this.onWarn = options.onWarn ?? ((m) => console.error(m));
       }
@@ -32401,6 +32826,14 @@ var init_manager = __esm({
           null
         );
       }
+      /** See LspProvider.serverStatusFor (WS4). Call AFTER a provider method:
+       *  the server entry is lazily created on first use, so the status is only
+       *  meaningful once the manager has served that language once. */
+      serverStatusFor(file2) {
+        const cmd = resolveServerCommand(file2, this.cwd);
+        if (!cmd) return "unavailable";
+        return this.servers.get(cmd.language) === null ? "unavailable" : "available";
+      }
       dispose() {
         for (const entry of this.servers.values()) entry?.dispose();
         this.servers.clear();
@@ -32420,31 +32853,69 @@ var init_manager = __esm({
 
 // src/cli/ast/engine.ts
 import { readFile } from "node:fs/promises";
-import path22 from "node:path";
-function isAstSupported(file2) {
-  return TS_EXTENSIONS.has(path22.extname(file2).toLowerCase());
-}
+import path24 from "node:path";
 function loadTs() {
   if (!tsPromise) {
     tsPromise = import("typescript").then((m) => m.default ?? m).catch(() => null);
   }
   return tsPromise;
 }
-async function parseFileSymbols(file2) {
-  if (!isAstSupported(file2)) return [];
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function parseFileSymbolsDiag(file2, cwd) {
+  const resolvedPath = path24.isAbsolute(file2) ? file2 : path24.join(cwd ?? process.cwd(), file2);
+  const extension = path24.extname(resolvedPath).toLowerCase();
+  if (!TS_EXTENSIONS.has(extension)) {
+    return {
+      status: "unsupported-extension",
+      extension: extension || "(none)",
+      resolvedPath,
+      recoverable: false,
+      recommendedFallback: "read_file"
+    };
+  }
   const ts = await loadTs();
-  if (!ts) return [];
+  if (!ts) {
+    return {
+      status: "typescript-unavailable",
+      resolvedPath,
+      recoverable: true,
+      recommendedFallback: "read_file"
+    };
+  }
   let text;
   try {
-    text = await readFile(file2, "utf8");
-  } catch {
-    return [];
+    text = await readFile(resolvedPath, "utf8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      return {
+        status: "file-not-found",
+        resolvedPath,
+        recoverable: false,
+        recommendedFallback: "grep_content"
+      };
+    }
+    return {
+      status: "read-error",
+      resolvedPath,
+      message: errMessage(err),
+      recoverable: true,
+      recommendedFallback: "read_file"
+    };
   }
   let source;
   try {
-    source = ts.createSourceFile(path22.basename(file2), text, ts.ScriptTarget.Latest, true);
-  } catch {
-    return [];
+    source = ts.createSourceFile(path24.basename(resolvedPath), text, ts.ScriptTarget.Latest, true);
+  } catch (err) {
+    return {
+      status: "parse-error",
+      resolvedPath,
+      message: errMessage(err),
+      recoverable: false,
+      recommendedFallback: "read_file"
+    };
   }
   const out = [];
   const lineOf = (pos) => source.getLineAndCharacterOfPosition(pos).line + 1;
@@ -32490,15 +32961,7 @@ async function parseFileSymbols(file2) {
     ts.forEachChild(node, visit);
   };
   visit(source);
-  return out;
-}
-async function astOutline(file2) {
-  const symbols = await parseFileSymbols(file2);
-  return symbols.map(({ text: _text, ...rest }) => rest);
-}
-async function findSymbol(file2, name) {
-  const symbols = await parseFileSymbols(file2);
-  return symbols.find((s) => s.name === name) ?? null;
+  return { status: "ok", symbols: out };
 }
 var TS_EXTENSIONS, tsPromise;
 var init_engine2 = __esm({
@@ -32509,23 +32972,54 @@ var init_engine2 = __esm({
 });
 
 // src/cli/ast/tools.ts
-function createAstTools() {
+function degradedPayload(r) {
+  return {
+    status: r.status,
+    resolvedPath: r.resolvedPath,
+    recoverable: r.recoverable,
+    recommendedFallback: r.recommendedFallback
+  };
+}
+function degradedNote2(r) {
+  switch (r.status) {
+    case "file-not-found":
+      return `file not found \u2014 looked at ${r.resolvedPath} (relative paths resolve against the workspace root)`;
+    case "typescript-unavailable":
+      return 'TypeScript compiler API unavailable \u2014 the "typescript" package could not be loaded. AST tools need it; disable them with ZELARI_AST=0 or fall back to read_file/grep_content.';
+    case "unsupported-extension":
+      return `unsupported file extension "${r.extension}" \u2014 ast_outline/find_symbol only parse TS/JS files (.ts/.tsx/.js/.jsx/.mjs/.cjs)`;
+    case "read-error":
+      return `could not read ${r.resolvedPath}: ${r.message}`;
+    case "parse-error":
+      return `TypeScript failed to parse ${r.resolvedPath}: ${r.message}`;
+  }
+}
+function createAstTools(root) {
   const outline = {
     name: "ast_outline",
-    description: "Structural outline of a TS/JS file: every declaration (function, class, method, interface, type, enum, variable) with its line range and whether it's exported. Faster and more precise than reading the whole file to find where things are. TS/JS only.",
+    description: "Structural outline of a TS/JS file: every declaration (function, class, method, interface, type, enum, variable) with its line range and whether it's exported. Faster and more precise than reading the whole file to find where things are. Relative paths resolve against the working directory. TS/JS only.",
     permissions: ["read"],
     inputSchema: external_exports.object({
       path: external_exports.string().min(1).describe("Path to the TS/JS file to outline.")
     }),
-    execute: async (args) => {
+    execute: async (args, ctx) => {
       const { path: file2 } = args;
-      const symbols = await astOutline(file2);
-      if (symbols.length === 0) {
-        return typedOk({ symbols: [], note: "no declarations found (or not a TS/JS file / TypeScript unavailable)" });
+      const r = await parseFileSymbolsDiag(file2, ctx?.cwd ?? root);
+      if (r.status !== "ok") {
+        return typedOk({ symbols: [], note: degradedNote2(r), ...degradedPayload(r) });
+      }
+      if (r.symbols.length === 0) {
+        return typedOk({
+          status: "ok",
+          count: 0,
+          symbols: [],
+          note: "file parsed successfully but contains no declarations"
+        });
       }
       return typedOk({
-        count: symbols.length,
-        symbols: symbols.map(
+        status: "ok",
+        count: r.symbols.length,
+        symbols: r.symbols.map(
           (s) => `${s.exported ? "export " : ""}${s.kind} ${s.name} (lines ${s.line}-${s.endLine})`
         )
       });
@@ -32533,21 +33027,30 @@ function createAstTools() {
   };
   const findSymbolTool = {
     name: "find_symbol",
-    description: "Locate a named declaration in a TS/JS file and return its EXACT source text and line range. Use this to grab a function/class/method verbatim so you can edit_file it reliably (node-accurate) instead of guessing the surrounding text. TS/JS only.",
+    description: "Locate a named declaration in a TS/JS file and return its EXACT source text and line range. Use this to grab a function/class/method verbatim so you can edit_file it reliably (node-accurate) instead of guessing the surrounding text. Relative paths resolve against the working directory. TS/JS only.",
     permissions: ["read"],
     inputSchema: external_exports.object({
       path: external_exports.string().min(1).describe("Path to the TS/JS file."),
       name: external_exports.string().min(1).describe("The declaration name to find (function/class/method/etc).")
     }),
-    execute: async (args) => {
+    execute: async (args, ctx) => {
       const { path: file2, name } = args;
-      const sym = await findSymbol(file2, name);
+      const r = await parseFileSymbolsDiag(file2, ctx?.cwd ?? root);
+      if (r.status !== "ok") {
+        return typedOk({ found: false, note: degradedNote2(r), ...degradedPayload(r) });
+      }
+      const sym = r.symbols.find((s) => s.name === name);
       if (!sym) {
-        return typedOk({ found: false, note: `no declaration named "${name}" found in ${file2}` });
+        return typedOk({
+          found: false,
+          status: "ok",
+          note: `no declaration named "${name}" found in ${r.symbols.length > 0 ? `${file2} (declarations present: ${[...new Set(r.symbols.map((s) => s.name))].slice(0, 12).join(", ")})` : file2}`
+        });
       }
       const truncated = sym.text.length > MAX_TEXT_CHARS;
       return typedOk({
         found: true,
+        status: "ok",
         kind: sym.kind,
         exported: sym.exported,
         line: sym.line,
@@ -32627,13 +33130,13 @@ var init_store = __esm({
 });
 
 // src/cli/semantic/index.ts
-import { promises as fs12, existsSync as existsSync20, readFileSync as readFileSync19 } from "node:fs";
+import { promises as fs14, existsSync as existsSync21, readFileSync as readFileSync19 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import path23 from "node:path";
-import { createHash as createHash5 } from "node:crypto";
+import path25 from "node:path";
+import { createHash as createHash6 } from "node:crypto";
 function getIndexPath(root) {
-  const hash3 = createHash5("sha1").update(path23.resolve(root)).digest("hex").slice(0, 16);
-  return process.env.ZELARI_SEMANTIC_FILE ?? path23.join(homedir6(), ".tmp", "zelari-code", "semantic", `${hash3}.json`);
+  const hash3 = createHash6("sha1").update(path25.resolve(root)).digest("hex").slice(0, 16);
+  return process.env.ZELARI_SEMANTIC_FILE ?? path25.join(homedir6(), ".tmp", "zelari-code", "semantic", `${hash3}.json`);
 }
 async function collectSourceFiles(root, maxFiles = 1500) {
   const out = [];
@@ -32641,7 +33144,7 @@ async function collectSourceFiles(root, maxFiles = 1500) {
     if (out.length >= maxFiles) return;
     let entries;
     try {
-      entries = await fs12.readdir(dir, { withFileTypes: true });
+      entries = await fs14.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -32651,11 +33154,11 @@ async function collectSourceFiles(root, maxFiles = 1500) {
         if (entry.isDirectory() && IGNORE_DIRS.has(entry.name)) continue;
         if (entry.isDirectory()) continue;
       }
-      const full = path23.join(dir, entry.name);
+      const full = path25.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (IGNORE_DIRS.has(entry.name)) continue;
         await walk2(full);
-      } else if (SOURCE_EXTENSIONS.has(path23.extname(entry.name).toLowerCase())) {
+      } else if (SOURCE_EXTENSIONS.has(path25.extname(entry.name).toLowerCase())) {
         out.push(full);
       }
     }
@@ -32671,7 +33174,7 @@ async function buildIndex(files, embed, options) {
   for (const file2 of files) {
     let text;
     try {
-      text = await fs12.readFile(file2, "utf8");
+      text = await fs14.readFile(file2, "utf8");
     } catch {
       continue;
     }
@@ -32704,14 +33207,14 @@ async function buildIndex(files, embed, options) {
 }
 async function saveIndex(root, data) {
   const file2 = getIndexPath(root);
-  await fs12.mkdir(path23.dirname(file2), { recursive: true });
+  await fs14.mkdir(path25.dirname(file2), { recursive: true });
   const tmp = `${file2}.tmp-${process.pid}`;
-  await fs12.writeFile(tmp, JSON.stringify(data), "utf8");
-  await fs12.rename(tmp, file2);
+  await fs14.writeFile(tmp, JSON.stringify(data), "utf8");
+  await fs14.rename(tmp, file2);
 }
 function loadIndex(root) {
   const file2 = getIndexPath(root);
-  if (!existsSync20(file2)) return null;
+  if (!existsSync21(file2)) return null;
   try {
     const parsed = JSON.parse(readFileSync19(file2, "utf8"));
     if (parsed && Array.isArray(parsed.chunks)) return parsed;
@@ -32856,7 +33359,7 @@ var init_provider = __esm({
 });
 
 // src/cli/semantic/tools.ts
-import path24 from "node:path";
+import path26 from "node:path";
 function createSemanticTool(deps) {
   const buildEmbedFn = deps.buildEmbedFn ?? buildProviderEmbedFn;
   return {
@@ -32883,7 +33386,7 @@ function createSemanticTool(deps) {
       return typedOk({
         count: res.hits.length,
         results: res.hits.map((h) => ({
-          location: `${path24.relative(deps.root, h.file) || h.file}:${h.startLine}-${h.endLine}`,
+          location: `${path26.relative(deps.root, h.file) || h.file}:${h.startLine}-${h.endLine}`,
           score: Number(h.score.toFixed(3)),
           preview: h.text.length > 400 ? `${h.text.slice(0, 400)}\u2026` : h.text
         }))
@@ -32903,7 +33406,7 @@ var init_tools4 = __esm({
 
 // src/cli/browser/driver.ts
 import { createRequire } from "node:module";
-import path25 from "node:path";
+import path27 from "node:path";
 import { pathToFileURL } from "node:url";
 function asPlaywright(mod) {
   if (!mod || typeof mod !== "object") return null;
@@ -32914,10 +33417,10 @@ function asPlaywright(mod) {
   return null;
 }
 async function loadPlaywright(cwd) {
-  const base = cwd && cwd.length > 0 ? path25.resolve(cwd) : void 0;
+  const base = cwd && cwd.length > 0 ? path27.resolve(cwd) : void 0;
   if (base) {
     try {
-      const req = createRequire(path25.join(base, "package.json"));
+      const req = createRequire(path27.join(base, "package.json"));
       const resolved = req.resolve("playwright");
       const mod = await import(pathToFileURL(resolved).href);
       const pw = asPlaywright(mod);
@@ -33132,8 +33635,8 @@ var init_driver = __esm({
 });
 
 // src/cli/browser/tools.ts
-import path26 from "node:path";
-import os8 from "node:os";
+import path28 from "node:path";
+import os9 from "node:os";
 function createBrowserTool(deps = {}) {
   return {
     name: "browser_check",
@@ -33150,8 +33653,8 @@ function createBrowserTool(deps = {}) {
     }),
     execute: async (args, ctx) => {
       const a = args;
-      const dir = deps.screenshotDir ?? os8.tmpdir();
-      const screenshotPath = a.screenshot === false ? void 0 : path26.join(dir, `zelari-browser-${Date.now()}.png`);
+      const dir = deps.screenshotDir ?? os9.tmpdir();
+      const screenshotPath = a.screenshot === false ? void 0 : path28.join(dir, `zelari-browser-${Date.now()}.png`);
       const result = await runBrowserCheck(
         {
           url: a.url,
@@ -33243,14 +33746,14 @@ __export(targets_exports, {
 });
 import {
   chmodSync,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync13,
   readFileSync as readFileSync20,
   writeFileSync as writeFileSync15
 } from "node:fs";
 import { dirname as dirname4, join as join16 } from "node:path";
 import { homedir as homedir7 } from "node:os";
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 function getSshTargetsPath() {
   return join16(homedir7(), ".zelari-code", "ssh-targets.json");
 }
@@ -33263,21 +33766,21 @@ function normalizeAuth(auth) {
   return "agent";
 }
 function readSecrets() {
-  const path53 = getSshSecretsPath();
-  if (!existsSync21(path53)) return {};
+  const path55 = getSshSecretsPath();
+  if (!existsSync22(path55)) return {};
   try {
-    return JSON.parse(readFileSync20(path53, "utf8"));
+    return JSON.parse(readFileSync20(path55, "utf8"));
   } catch {
     return {};
   }
 }
 function writeSecrets(data) {
-  const path53 = getSshSecretsPath();
-  mkdirSync13(dirname4(path53), { recursive: true });
-  writeFileSync15(path53, `${JSON.stringify(data, null, 2)}
+  const path55 = getSshSecretsPath();
+  mkdirSync13(dirname4(path55), { recursive: true });
+  writeFileSync15(path55, `${JSON.stringify(data, null, 2)}
 `, "utf8");
   try {
-    chmodSync(path53, 384);
+    chmodSync(path55, 384);
   } catch {
   }
 }
@@ -33306,10 +33809,10 @@ function deleteSshPassword(id) {
   writeSecrets({ passwords });
 }
 function readStore2() {
-  const path53 = getSshTargetsPath();
-  if (!existsSync21(path53)) return [];
+  const path55 = getSshTargetsPath();
+  if (!existsSync22(path55)) return [];
   try {
-    const parsed = JSON.parse(readFileSync20(path53, "utf8"));
+    const parsed = JSON.parse(readFileSync20(path55, "utf8"));
     const list = Array.isArray(parsed.targets) ? parsed.targets : [];
     return list.filter(
       (t) => t && typeof t.id === "string" && typeof t.host === "string" && typeof t.user === "string"
@@ -33324,11 +33827,11 @@ function readStore2() {
   }
 }
 function writeStore2(targets) {
-  const path53 = getSshTargetsPath();
-  mkdirSync13(dirname4(path53), { recursive: true });
+  const path55 = getSshTargetsPath();
+  mkdirSync13(dirname4(path55), { recursive: true });
   const clean = targets.map(({ hasPassword: _hp, ...t }) => t);
   writeFileSync15(
-    path53,
+    path55,
     `${JSON.stringify({ targets: clean }, null, 2)}
 `,
     "utf8"
@@ -33480,7 +33983,7 @@ function runSsh(target, remoteCommand, timeoutMs = 6e4) {
       if (!env.DISPLAY) env.DISPLAY = "1";
       env.ZELARI_SSH_ASKPASS_PASS = pass;
     }
-    const child = spawn5("ssh", args, {
+    const child = spawn7("ssh", args, {
       windowsHide: true,
       env,
       stdio: ["ignore", "pipe", "pipe"]
@@ -33521,7 +34024,7 @@ function readSshPublicKey(keyOrPubPath) {
   if (!raw) return { ok: false, error: "Empty path" };
   const candidates = raw.endsWith(".pub") ? [raw] : [`${raw}.pub`, raw];
   for (const p3 of candidates) {
-    if (!existsSync21(p3)) continue;
+    if (!existsSync22(p3)) continue;
     try {
       const content = readFileSync20(p3, "utf8").trim();
       if (!content) continue;
@@ -33574,11 +34077,11 @@ function formatSshTargetsForPrompt() {
   ];
   for (const t of targets) {
     const tags = t.tags?.length ? ` tags=[${t.tags.join(",")}]` : "";
-    const path53 = t.defaultRemotePath ? ` remotePath=${t.defaultRemotePath}` : "";
+    const path55 = t.defaultRemotePath ? ` remotePath=${t.defaultRemotePath}` : "";
     const allow = t.allowedCommands?.length ? ` allowed=${t.allowedCommands.join("|")}` : " allowed=status-only";
     const auth = t.auth === "password" ? " auth=password" : t.auth === "keyPath" ? " auth=key" : " auth=agent";
     lines.push(
-      `- id=${t.id} name=${t.name} ${t.user}@${t.host}:${t.port ?? 22}${auth}${path53}${tags}${allow}`
+      `- id=${t.id} name=${t.name} ${t.user}@${t.host}:${t.port ?? 22}${auth}${path55}${tags}${allow}`
     );
   }
   return lines.join("\n");
@@ -33704,26 +34207,26 @@ var init_tools6 = __esm({
 });
 
 // src/cli/workspace/worldModel.ts
-import { promises as fs13 } from "node:fs";
-import path27 from "node:path";
-import { spawn as spawn6 } from "node:child_process";
+import { promises as fs15 } from "node:fs";
+import path29 from "node:path";
+import { spawn as spawn8 } from "node:child_process";
 function worldDir(cwd) {
-  return path27.join(cwd, WORLD_DIR_NAME);
+  return path29.join(cwd, WORLD_DIR_NAME);
 }
 async function ensureWorldDir(cwd) {
   const dir = worldDir(cwd);
-  await fs13.mkdir(dir, { recursive: true });
+  await fs15.mkdir(dir, { recursive: true });
   return dir;
 }
 async function appendTimeline(cwd, entry) {
   const dir = await ensureWorldDir(cwd);
   const line = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry }) + "\n";
-  await fs13.appendFile(path27.join(dir, TIMELINE_FILE), line, "utf8");
+  await fs15.appendFile(path29.join(dir, TIMELINE_FILE), line, "utf8");
 }
 async function readChecks(cwd) {
-  const p3 = path27.join(worldDir(cwd), CHECKS_FILE);
+  const p3 = path29.join(worldDir(cwd), CHECKS_FILE);
   try {
-    const raw = await fs13.readFile(p3, "utf8");
+    const raw = await fs15.readFile(p3, "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.checks) ? parsed.checks : [];
   } catch {
@@ -33733,7 +34236,7 @@ async function readChecks(cwd) {
 function runShell(command, cwd, timeoutMs, signal) {
   return new Promise((resolve3) => {
     const isWin = process.platform === "win32";
-    const child = spawn6(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
+    const child = spawn8(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
       cwd,
       env: process.env,
       windowsHide: true,
@@ -33796,8 +34299,8 @@ function runShell(command, cwd, timeoutMs, signal) {
   });
 }
 async function runBacktest(cwd, signal) {
-  const checksPath = path27.join(worldDir(cwd), CHECKS_FILE);
-  const hypothesisPath = path27.join(worldDir(cwd), HYPOTHESIS_FILE);
+  const checksPath = path29.join(worldDir(cwd), CHECKS_FILE);
+  const hypothesisPath = path29.join(worldDir(cwd), HYPOTHESIS_FILE);
   const checks = await readChecks(cwd);
   if (checks.length === 0) {
     return {
@@ -33866,7 +34369,7 @@ var init_worldModel = __esm({
     "use strict";
     init_zod();
     init_toolTypes();
-    WORLD_DIR_NAME = path27.join(".zelari", "world");
+    WORLD_DIR_NAME = path29.join(".zelari", "world");
     HYPOTHESIS_FILE = "hypothesis.md";
     CHECKS_FILE = "checks.json";
     TIMELINE_FILE = "timeline.jsonl";
@@ -33883,7 +34386,7 @@ var init_worldModel = __esm({
       execute: async (args, ctx) => {
         try {
           const dir = await ensureWorldDir(ctx.cwd);
-          const file2 = path27.join(dir, HYPOTHESIS_FILE);
+          const file2 = path29.join(dir, HYPOTHESIS_FILE);
           if (args.append) {
             const block = `
 
@@ -33891,11 +34394,11 @@ var init_worldModel = __esm({
 
 ${args.content}
 `;
-            await fs13.appendFile(file2, block, "utf8");
+            await fs15.appendFile(file2, block, "utf8");
           } else {
-            await fs13.writeFile(file2, args.content, "utf8");
+            await fs15.writeFile(file2, args.content, "utf8");
           }
-          const st = await fs13.stat(file2);
+          const st = await fs15.stat(file2);
           await appendTimeline(ctx.cwd, { kind: "hypothesis_update", bytes: st.size, append: !!args.append });
           return typedOk({ path: file2, bytes: st.size });
         } catch (err) {
@@ -33922,9 +34425,9 @@ ${args.content}
       execute: async (args, ctx) => {
         try {
           const dir = await ensureWorldDir(ctx.cwd);
-          const file2 = path27.join(dir, CHECKS_FILE);
+          const file2 = path29.join(dir, CHECKS_FILE);
           const body = { checks: args.checks };
-          await fs13.writeFile(file2, JSON.stringify(body, null, 2) + "\n", "utf8");
+          await fs15.writeFile(file2, JSON.stringify(body, null, 2) + "\n", "utf8");
           await appendTimeline(ctx.cwd, { kind: "checks_set", count: args.checks.length });
           return typedOk({ path: file2, count: args.checks.length });
         } catch (err) {
@@ -33961,8 +34464,8 @@ ${args.content}
                 stdoutPreview: "(dryRun)",
                 mismatch: "dryRun"
               })),
-              hypothesisPath: path27.join(worldDir(ctx.cwd), HYPOTHESIS_FILE),
-              checksPath: path27.join(worldDir(ctx.cwd), CHECKS_FILE)
+              hypothesisPath: path29.join(worldDir(ctx.cwd), HYPOTHESIS_FILE),
+              checksPath: path29.join(worldDir(ctx.cwd), CHECKS_FILE)
             });
           }
           const result = await runBacktest(ctx.cwd, ctx.signal);
@@ -33986,7 +34489,7 @@ ${args.content}
       execute: async (args, ctx) => {
         try {
           const dir = await ensureWorldDir(ctx.cwd);
-          const file2 = path27.join(dir, TIMELINE_FILE);
+          const file2 = path29.join(dir, TIMELINE_FILE);
           await appendTimeline(ctx.cwd, {
             kind: args.kind,
             summary: args.summary,
@@ -34094,13 +34597,13 @@ __export(folderTrust_exports, {
   untrustFolder: () => untrustFolder
 });
 import { homedir as homedir8 } from "node:os";
-import { existsSync as existsSync22, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "node:fs";
-import path28 from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "node:fs";
+import path30 from "node:path";
 function trustStorePath() {
-  return _overrideStorePath ?? path28.join(homedir8(), ".zelari-code", "trust.json");
+  return _overrideStorePath ?? path30.join(homedir8(), ".zelari-code", "trust.json");
 }
 function normalize(p3) {
-  const resolved = path28.resolve(p3);
+  const resolved = path30.resolve(p3);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function readStore3() {
@@ -34116,7 +34619,7 @@ function readStore3() {
 function writeStore3(store4) {
   const p3 = trustStorePath();
   try {
-    mkdirSync14(path28.dirname(p3), { recursive: true });
+    mkdirSync14(path30.dirname(p3), { recursive: true });
     writeFileSync16(p3, JSON.stringify(store4, null, 2), "utf8");
   } catch (err) {
     throw new Error(
@@ -34142,7 +34645,7 @@ function isFolderTrusted(folderPath) {
 }
 function trustFolder(folderPath) {
   const store4 = readStore3();
-  const normalized = path28.resolve(folderPath);
+  const normalized = path30.resolve(folderPath);
   if (!store4.folders.some((f) => normalize(f.path) === normalize(normalized))) {
     store4.folders.push({ path: normalized, trustedAt: (/* @__PURE__ */ new Date()).toISOString() });
     writeStore3(store4);
@@ -34172,7 +34675,7 @@ function getTrustStorePath() {
   return trustStorePath();
 }
 function hasTrustStore() {
-  return existsSync22(trustStorePath());
+  return existsSync23(trustStorePath());
 }
 function _setTrustStorePathForTests(p3) {
   _overrideStorePath = p3;
@@ -34256,9 +34759,9 @@ var init_lifecycleHooks = __esm({
 });
 
 // src/cli/toolResultCache.ts
-import { createHash as createHash6 } from "node:crypto";
-import { promises as fs14 } from "node:fs";
-import path29 from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { promises as fs16 } from "node:fs";
+import path31 from "node:path";
 function isToolCacheEnabled() {
   const raw = process.env.ZELARI_TOOL_CACHE;
   return raw !== "0" && raw !== "false" && raw !== "off";
@@ -34269,7 +34772,7 @@ function resolveToolCacheTtlMs() {
   return Number.isFinite(n) && n >= 0 ? n : TOOL_CACHE_DEFAULT_TTL_MS;
 }
 function hashKey(parts) {
-  return createHash6("sha256").update(JSON.stringify(parts), "utf8").digest("hex");
+  return createHash7("sha256").update(JSON.stringify(parts), "utf8").digest("hex");
 }
 function resultBytes(result) {
   try {
@@ -34343,9 +34846,9 @@ async function statKey(toolName, input, ctx) {
   if (!input || typeof input !== "object") return null;
   const rawPath = input.path;
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const abs = path29.isAbsolute(rawPath) ? rawPath : path29.join(ctx.cwd, rawPath);
+  const abs = path31.isAbsolute(rawPath) ? rawPath : path31.join(ctx.cwd, rawPath);
   try {
-    const st = await fs14.stat(abs);
+    const st = await fs16.stat(abs);
     return hashKey({
       tool: toolName,
       args: input,
@@ -34584,8 +35087,17 @@ function createBuiltinToolRegistry(options = {}) {
     description: t.description,
     permissions: t.permissions ?? []
   }));
+  if (readOnly && process.env.ZELARI_INSPECT_COMMAND !== "0") {
+    const inspectTool = createInspectCommandTool(root);
+    registry4.register(withPerm(inspectTool));
+    tools.push({
+      name: inspectTool.name,
+      description: inspectTool.description,
+      permissions: inspectTool.permissions ?? []
+    });
+  }
   if (process.env.ZELARI_AST !== "0") {
-    for (const t of createAstTools()) {
+    for (const t of createAstTools(root)) {
       registry4.register(t);
       tools.push({ name: t.name, description: t.description, permissions: t.permissions ?? [] });
     }
@@ -34641,7 +35153,7 @@ function createBuiltinToolRegistry(options = {}) {
       permissions: taskTool.permissions ?? []
     });
   }
-  if (!readOnly && process.env.ZELARI_LSP !== "0" && options.lspProvider !== null) {
+  if (process.env.ZELARI_LSP !== "0" && options.lspProvider !== null) {
     const lspTools = options.lspProvider ? createLspTools(options.lspProvider, root) : createLspTools(getSharedLspManager(root), root);
     for (const t of lspTools) {
       registry4.register(t);
@@ -34927,6 +35439,7 @@ var init_toolRegistry = __esm({
     init_skillTool();
     init_todoTools();
     init_planTaskTools();
+    init_inspectCommand();
     init_tools2();
     init_manager();
     init_tools3();
@@ -34957,21 +35470,21 @@ var init_toolRegistry = __esm({
 });
 
 // src/cli/state/fileStateStore.ts
-import { createHash as createHash7, randomUUID as randomUUID2 } from "node:crypto";
-import { promises as fs15 } from "node:fs";
-import * as path30 from "node:path";
+import { createHash as createHash8, randomUUID as randomUUID2 } from "node:crypto";
+import { promises as fs17 } from "node:fs";
+import * as path32 from "node:path";
 function shortId() {
   return randomUUID2().replace(/-/g, "").slice(0, 12);
 }
 async function writeJsonAtomic(filePath, data) {
-  await fs15.mkdir(path30.dirname(filePath), { recursive: true });
+  await fs17.mkdir(path32.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  await fs15.writeFile(tmp, JSON.stringify(data, null, 2) + "\n", "utf8");
-  await fs15.rename(tmp, filePath);
+  await fs17.writeFile(tmp, JSON.stringify(data, null, 2) + "\n", "utf8");
+  await fs17.rename(tmp, filePath);
 }
 async function readJsonFile(filePath) {
   try {
-    const raw = await fs15.readFile(filePath, "utf8");
+    const raw = await fs17.readFile(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -35009,7 +35522,7 @@ async function getStateStore(projectRoot, env = process.env) {
   }
 }
 function hashStablePrompt(stable) {
-  return createHash7("sha256").update(stable, "utf8").digest("hex").slice(0, 16);
+  return createHash8("sha256").update(stable, "utf8").digest("hex").slice(0, 16);
 }
 var DEFAULT_MATERIALIZE_CHARS, FileDurableStateStore, NoopDurableStateStore;
 var init_fileStateStore = __esm({
@@ -35025,13 +35538,13 @@ var init_fileStateStore = __esm({
       indexPath = "";
       async init(projectRoot) {
         this.root = projectRoot;
-        this.stateDir = path30.join(projectRoot, ".zelari", "state");
-        this.commitsDir = path30.join(this.stateDir, "commits");
-        this.artifactsDir = path30.join(this.stateDir, "artifacts");
-        this.headPath = path30.join(this.stateDir, "HEAD.json");
-        this.indexPath = path30.join(this.stateDir, "index.jsonl");
-        await fs15.mkdir(this.commitsDir, { recursive: true });
-        await fs15.mkdir(this.artifactsDir, { recursive: true });
+        this.stateDir = path32.join(projectRoot, ".zelari", "state");
+        this.commitsDir = path32.join(this.stateDir, "commits");
+        this.artifactsDir = path32.join(this.stateDir, "artifacts");
+        this.headPath = path32.join(this.stateDir, "HEAD.json");
+        this.indexPath = path32.join(this.stateDir, "index.jsonl");
+        await fs17.mkdir(this.commitsDir, { recursive: true });
+        await fs17.mkdir(this.artifactsDir, { recursive: true });
       }
       async commit(input) {
         if (!input.force && input.verification.ran && !input.verification.ok) {
@@ -35042,13 +35555,13 @@ var init_fileStateStore = __esm({
         const discoveries = input.discoveries ?? [];
         const parent = await this.head();
         const id = shortId();
-        const artifactRel = path30.join("artifacts", id);
-        const artifactAbs = path30.join(this.artifactsDir, id);
-        await fs15.mkdir(artifactAbs, { recursive: true });
+        const artifactRel = path32.join("artifacts", id);
+        const artifactAbs = path32.join(this.artifactsDir, id);
+        await fs17.mkdir(artifactAbs, { recursive: true });
         const summary = defaultSummary(input, discoveries);
-        await fs15.writeFile(path30.join(artifactAbs, "summary.md"), summary + "\n", "utf8");
-        await writeJsonAtomic(path30.join(artifactAbs, "discoveries.json"), discoveries);
-        await writeJsonAtomic(path30.join(artifactAbs, "verification.json"), input.verification);
+        await fs17.writeFile(path32.join(artifactAbs, "summary.md"), summary + "\n", "utf8");
+        await writeJsonAtomic(path32.join(artifactAbs, "discoveries.json"), discoveries);
+        await writeJsonAtomic(path32.join(artifactAbs, "verification.json"), input.verification);
         const meta3 = {
           id,
           parentId: parent?.id ?? null,
@@ -35060,16 +35573,16 @@ var init_fileStateStore = __esm({
           workspaceCheckpointId: input.workspaceCheckpointId,
           verification: {
             ...input.verification,
-            reportPath: input.verification.reportPath ?? path30.join(".zelari", "state", artifactRel, "verification.json").replace(/\\/g, "/")
+            reportPath: input.verification.reportPath ?? path32.join(".zelari", "state", artifactRel, "verification.json").replace(/\\/g, "/")
           },
           changedPaths: input.changedPaths ?? [],
           stablePromptHash: input.stablePromptHash,
           discoveryCount: discoveries.length,
           artifactDir: artifactRel.replace(/\\/g, "/")
         };
-        await writeJsonAtomic(path30.join(this.commitsDir, `${id}.json`), meta3);
+        await writeJsonAtomic(path32.join(this.commitsDir, `${id}.json`), meta3);
         await writeJsonAtomic(this.headPath, { id, updatedAt: meta3.createdAt });
-        await fs15.appendFile(this.indexPath, JSON.stringify({ id, createdAt: meta3.createdAt, label: meta3.label }) + "\n", "utf8");
+        await fs17.appendFile(this.indexPath, JSON.stringify({ id, createdAt: meta3.createdAt, label: meta3.label }) + "\n", "utf8");
         return stripStored(meta3);
       }
       async head() {
@@ -35078,13 +35591,13 @@ var init_fileStateStore = __esm({
         return this.get(head.id);
       }
       async get(id) {
-        const stored = await readJsonFile(path30.join(this.commitsDir, `${id}.json`));
+        const stored = await readJsonFile(path32.join(this.commitsDir, `${id}.json`));
         return stored ? stripStored(stored) : null;
       }
       async list(limit = 20) {
         let raw;
         try {
-          raw = await fs15.readFile(this.indexPath, "utf8");
+          raw = await fs17.readFile(this.indexPath, "utf8");
         } catch {
           return [];
         }
@@ -35117,9 +35630,9 @@ var init_fileStateStore = __esm({
       async loadDiscoveries(id) {
         const meta3 = id ? await this.get(id) : await this.head();
         if (!meta3) return [];
-        const stored = await readJsonFile(path30.join(this.commitsDir, `${meta3.id}.json`));
+        const stored = await readJsonFile(path32.join(this.commitsDir, `${meta3.id}.json`));
         if (!stored?.artifactDir) return [];
-        const discPath = path30.join(this.stateDir, stored.artifactDir, "discoveries.json");
+        const discPath = path32.join(this.stateDir, stored.artifactDir, "discoveries.json");
         return await readJsonFile(discPath) ?? [];
       }
       async materializeContext(id, maxChars = DEFAULT_MATERIALIZE_CHARS) {
@@ -35722,7 +36235,7 @@ __export(conversationContext_exports, {
   setHistory: () => setHistory,
   setLastClarification: () => setLastClarification
 });
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync24 } from "node:fs";
 import { join as join19 } from "node:path";
 function getHistory() {
   return history;
@@ -35731,7 +36244,7 @@ function setHistory(messages) {
   history = [...messages];
 }
 function compactInPlace(cwd = process.cwd()) {
-  const durableStatePresent = existsSync23(join19(cwd, ".zelari", "state", "HEAD.json"));
+  const durableStatePresent = existsSync24(join19(cwd, ".zelari", "state", "HEAD.json"));
   history = compactHistory(history, { durableStatePresent });
 }
 function appendMessages(msgs) {
@@ -36122,7 +36635,7 @@ var claudeProvider_exports = {};
 __export(claudeProvider_exports, {
   createLocalCliProvider: () => createLocalCliProvider
 });
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 function waitForExit(child, timeoutMs = 2e3) {
   return new Promise((resolve3) => {
     if (child.exitCode != null) return resolve3(child.exitCode);
@@ -36151,7 +36664,7 @@ function createLocalCliProvider(opts = {}) {
         );
       }
     }
-    const spawnFn = opts.spawnFn ?? spawn7;
+    const spawnFn = opts.spawnFn ?? spawn9;
     let child;
     try {
       child = spawnFn(cli, args, {
@@ -36246,12 +36759,12 @@ var init_claudeProvider = __esm({
 });
 
 // src/cli/workspace/projectInstructions.ts
-import { existsSync as existsSync24, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync22 } from "node:fs";
 import { join as join20 } from "node:path";
 function loadProjectInstructions(projectRoot = process.cwd(), maxChars = MAX_CHARS) {
   for (const name of CANDIDATES) {
     const full = join20(projectRoot, name);
-    if (!existsSync24(full)) continue;
+    if (!existsSync25(full)) continue;
     try {
       let raw = readFileSync22(full, "utf8");
       raw = raw.replace(/\r\n/g, "\n").trim();
@@ -36297,7 +36810,7 @@ __export(workspaceSummary_exports, {
   buildWorkspaceSummary: () => buildWorkspaceSummary,
   buildZelariReadHint: () => buildZelariReadHint
 });
-import { existsSync as existsSync25, readFileSync as readFileSync23, readdirSync as readdirSync6, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync23, readdirSync as readdirSync6, statSync as statSync4 } from "node:fs";
 import { join as join21, relative } from "node:path";
 function buildWorkspaceSummary(projectRoot = process.cwd(), options = {}) {
   const { maxEntries = 30, maxChars = 3500, maxDeps = 24, maxScripts = 16 } = options;
@@ -36332,7 +36845,7 @@ function formatTaskLine(t) {
 function buildPlanSummary(projectRoot = process.cwd(), options) {
   const zelariRoot = resolveWorkspaceRoot(projectRoot);
   const planPath = join21(zelariRoot, "plan.json");
-  if (!existsSync25(planPath)) return null;
+  if (!existsSync26(planPath)) return null;
   let plan;
   try {
     plan = JSON.parse(readFileSync23(planPath, "utf8"));
@@ -36475,7 +36988,7 @@ function pickNextTask(open) {
 }
 function buildZelariReadHint(projectRoot = process.cwd()) {
   const planPath = join21(resolveWorkspaceRoot(projectRoot), "plan.json");
-  if (!existsSync25(planPath)) return "";
+  if (!existsSync26(planPath)) return "";
   return [
     "# Council workspace detected (.zelari/) \u2014 DRAFT vault",
     "`.zelari/plan.json` and `.zelari/docs/` hold **design hypotheses**, not verified product state.",
@@ -36491,7 +37004,7 @@ function safeProjectName(root) {
 }
 function readPackageJson(projectRoot) {
   const p3 = join21(projectRoot, "package.json");
-  if (!existsSync25(p3)) return null;
+  if (!existsSync26(p3)) return null;
   try {
     return JSON.parse(readFileSync23(p3, "utf8"));
   } catch {
@@ -36595,12 +37108,12 @@ var init_workspaceSummary = __esm({
 });
 
 // src/cli/workspace/buildLessonsSummary.ts
-import { existsSync as existsSync26 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 import { join as join22 } from "node:path";
 function buildLessonsSummary(projectRoot = process.cwd(), taskText) {
   if (process.env["ZELARI_LESSONS"] === "0") return null;
   const zelariRoot = resolveWorkspaceRoot(projectRoot);
-  if (!existsSync26(join22(zelariRoot, "lessons.jsonl"))) return null;
+  if (!existsSync27(join22(zelariRoot, "lessons.jsonl"))) return null;
   const lessons = recallLessons(zelariRoot, {
     maxLessons: 5,
     maxBytes: 2048,
@@ -36621,7 +37134,7 @@ var composeContext_exports = {};
 __export(composeContext_exports, {
   composeProjectContext: () => composeProjectContext
 });
-import { existsSync as existsSync27, readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync28, readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
 import { join as join23 } from "node:path";
 function cap2(text, max, label) {
   if (!text || text.length <= max) return { text: text || "", truncated: false };
@@ -36634,13 +37147,13 @@ function cap2(text, max, label) {
 }
 function buildDesignIndex(projectRoot, maxChars) {
   const root = resolveWorkspaceRoot(projectRoot);
-  if (!existsSync27(root)) return "";
+  if (!existsSync28(root)) return "";
   const lines = [
     "# Design vault index (.zelari/) \u2014 HYPOTHESES only",
     "Full design docs are NOT product source of truth. Open with list_files / read_file / searchDocuments if needed."
   ];
   const docsDir = join23(root, "docs");
-  if (existsSync27(docsDir)) {
+  if (existsSync28(docsDir)) {
     try {
       const docs = readdirSync7(docsDir).filter((n) => n.endsWith(".md")).slice(0, 12);
       if (docs.length > 0) {
@@ -36654,12 +37167,12 @@ function buildDesignIndex(projectRoot, maxChars) {
     }
   }
   for (const name of ["risks.md", "plan.json", "nfr-spec.json"]) {
-    if (existsSync27(join23(root, name))) {
+    if (existsSync28(join23(root, name))) {
       lines.push(`- .zelari/${name} present`);
     }
   }
   const decisionsDir = join23(root, "decisions");
-  if (existsSync27(decisionsDir)) {
+  if (existsSync28(decisionsDir)) {
     try {
       const n = readdirSync7(decisionsDir).filter((f) => f.endsWith(".md")).length;
       if (n > 0) lines.push(`- .zelari/decisions/ (${n} ADR file(s) \u2014 treat proposed as non-binding)`);
@@ -36761,15 +37274,15 @@ function composeProjectContext(input) {
 function readDurableHeadSync(projectRoot) {
   try {
     const headPath = join23(projectRoot, ".zelari", "state", "HEAD.json");
-    if (!existsSync27(headPath)) return "";
+    if (!existsSync28(headPath)) return "";
     const head = JSON.parse(readFileSync24(headPath, "utf8"));
     if (!head?.id) return "";
     const metaPath = join23(projectRoot, ".zelari", "state", "commits", `${head.id}.json`);
-    if (!existsSync27(metaPath)) return "";
+    if (!existsSync28(metaPath)) return "";
     const meta3 = JSON.parse(readFileSync24(metaPath, "utf8"));
     const discPath = meta3.artifactDir ? join23(projectRoot, ".zelari", "state", meta3.artifactDir, "discoveries.json") : join23(projectRoot, ".zelari", "state", "artifacts", head.id, "discoveries.json");
     let discoveries = [];
-    if (existsSync27(discPath)) {
+    if (existsSync28(discPath)) {
       discoveries = JSON.parse(readFileSync24(discPath, "utf8"));
     }
     const reusable = discoveries.filter((d) => d.reusable !== false);
@@ -36803,11 +37316,11 @@ var planDetect_exports = {};
 __export(planDetect_exports, {
   hasWorkspacePlan: () => hasWorkspacePlan
 });
-import { existsSync as existsSync28, readFileSync as readFileSync25 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync25 } from "node:fs";
 import { join as join24 } from "node:path";
 function hasWorkspacePlan(projectRoot = process.cwd()) {
   const planPath = join24(resolveWorkspaceRoot(projectRoot), "plan.json");
-  if (!existsSync28(planPath)) return false;
+  if (!existsSync29(planPath)) return false;
   try {
     const parsed = JSON.parse(readFileSync25(planPath, "utf8"));
     return Array.isArray(parsed.phases) && parsed.phases.length > 0;
@@ -36868,7 +37381,7 @@ __export(stubs_exports, {
   resolveWorkspaceRoot: () => resolveWorkspaceRoot
 });
 import {
-  existsSync as existsSync29,
+  existsSync as existsSync30,
   readdirSync as readdirSync8,
   writeFileSync as writeFileSync17,
   readFileSync as readFileSync26,
@@ -36889,7 +37402,7 @@ function planJsonPath(ctx) {
 }
 function readPlan(ctx) {
   const jsonPath = planJsonPath(ctx);
-  if (existsSync29(jsonPath)) {
+  if (existsSync30(jsonPath)) {
     try {
       const parsed = JSON.parse(
         readFileSync26(jsonPath, "utf8")
@@ -36904,8 +37417,8 @@ function readPlan(ctx) {
     } catch {
     }
   }
-  const path53 = workspaceFile(ctx.rootDir, "plan");
-  const doc = ctx.storage.readIfExists(path53);
+  const path55 = workspaceFile(ctx.rootDir, "plan");
+  const doc = ctx.storage.readIfExists(path55);
   if (!doc) return { phases: [], tasks: [], milestones: [] };
   const meta3 = doc.meta;
   return {
@@ -36999,7 +37512,7 @@ function renderPlanBody(summary) {
 }
 function nextAdrId(ctx) {
   const decisionsDir = join25(ctx.rootDir, "decisions");
-  if (!existsSync29(decisionsDir)) return "001";
+  if (!existsSync30(decisionsDir)) return "001";
   const existing = readdirSync8(decisionsDir).filter((f) => f.endsWith(".md")).map((f) => f.match(/^(\d+)-/)).filter((m) => !!m).map((m) => parseInt(m[1], 10));
   const max = existing.length === 0 ? 0 : Math.max(...existing);
   return String(max + 1).padStart(3, "0");
@@ -37083,7 +37596,7 @@ function addMilestoneRecord(ctx, summary, input) {
     dueDate: input.dueDate,
     targetVersion: version2
   });
-  const path53 = join25(ctx.rootDir, "milestones", `${id}.md`);
+  const path55 = join25(ctx.rootDir, "milestones", `${id}.md`);
   const meta3 = {
     kind: "milestone",
     id,
@@ -37100,7 +37613,7 @@ function addMilestoneRecord(ctx, summary, input) {
     `Target version: ${version2}`,
     ""
   ].join("\n");
-  ctx.storage.write(path53, meta3, body);
+  ctx.storage.write(path55, meta3, body);
   return { id, created: true };
 }
 function readPlanSummary(ctx) {
@@ -37304,7 +37817,7 @@ function addIdeaStub(ctx) {
         const tags = args["tags"] ?? [];
         const category = args["category"] ?? "General";
         const id = `${nextAdrId(ctx)}-${slugify3(title)}`;
-        const path53 = workspaceArtifact(ctx.rootDir, "decisions", id);
+        const path55 = workspaceArtifact(ctx.rootDir, "decisions", id);
         const meta3 = {
           kind: "adr",
           status: "proposed",
@@ -37330,7 +37843,7 @@ function addIdeaStub(ctx) {
           ...consequences.map((c) => `- ${c}`),
           ""
         ].join("\n");
-        ctx.storage.write(path53, meta3, body);
+        ctx.storage.write(path55, meta3, body);
         return `ADR ${id} created: "${title}". Status: proposed. Promote to accepted via /update ADR or manual edit.`;
       });
     }
@@ -37412,14 +37925,14 @@ function createDocumentStub(ctx) {
           ctx.storage.write(risksPath, riskMeta, content);
           return `Document "${title}" created at risks.md (workspace root).`;
         }
-        const path53 = workspaceArtifact(ctx.rootDir, "docs", slug);
+        const path55 = workspaceArtifact(ctx.rootDir, "docs", slug);
         const meta3 = {
           kind: "doc",
           id: slug,
           date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
           tags
         };
-        ctx.storage.write(path53, meta3, content);
+        ctx.storage.write(path55, meta3, content);
         return `Document "${title}" created at docs/${slug}.md.`;
       });
     }
@@ -37455,7 +37968,7 @@ function searchDocumentsStub(ctx) {
       ];
       const results = [];
       for (const file2 of files) {
-        if (!existsSync29(file2)) continue;
+        if (!existsSync30(file2)) continue;
         const raw = readFileSync26(file2, "utf8");
         const content = raw.toLowerCase();
         let idx = -1;
@@ -37636,21 +38149,21 @@ __export(updater_exports, {
   resolveBundledNpmCli: () => resolveBundledNpmCli
 });
 import { createRequire as createRequire2 } from "node:module";
-import { spawn as spawn8 } from "node:child_process";
-import { existsSync as existsSync30 } from "node:fs";
-import path31 from "node:path";
+import { spawn as spawn10 } from "node:child_process";
+import { existsSync as existsSync31 } from "node:fs";
+import path33 from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveBundledNpmCli(execPath = process.execPath) {
-  const dir = path31.dirname(execPath);
+  const dir = path33.dirname(execPath);
   const candidates = [
     // Windows: C:\...\node.exe → C:\...\node_modules\npm\bin\npm-cli.js
-    path31.join(dir, "node_modules", "npm", "bin", "npm-cli.js"),
+    path33.join(dir, "node_modules", "npm", "bin", "npm-cli.js"),
     // POSIX: <prefix>/bin/node → <prefix>/lib/node_modules/npm/bin/npm-cli.js
-    path31.join(dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+    path33.join(dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
   ];
   for (const candidate of candidates) {
     try {
-      if (existsSync30(candidate)) return candidate;
+      if (existsSync31(candidate)) return candidate;
     } catch {
     }
   }
@@ -37663,7 +38176,7 @@ function looksLikeBrokenShim(exitCode, output) {
 }
 function getCurrentVersion() {
   try {
-    const pkgPath = path31.resolve(__dirname2, "..", "..", "package.json");
+    const pkgPath = path33.resolve(__dirname2, "..", "..", "package.json");
     const pkg = require2(pkgPath);
     return pkg.version;
   } catch {
@@ -37723,7 +38236,7 @@ async function checkForUpdate(fetcher = fetch, registryUrl) {
     updateAvailable: cmp < 0
   };
 }
-async function performUpdate(packageName = "zelari-code", executor = spawn8, resolveNpmCli = resolveBundledNpmCli) {
+async function performUpdate(packageName = "zelari-code", executor = spawn10, resolveNpmCli = resolveBundledNpmCli) {
   const args = ["install", "-g", `${packageName}@latest`];
   const primary = await runNpm(executor, args, "shim");
   if (primary.ok) return primary;
@@ -37775,13 +38288,13 @@ var init_updater = __esm({
     "use strict";
     init_cmdline();
     require2 = createRequire2(import.meta.url);
-    __dirname2 = path31.dirname(fileURLToPath(import.meta.url));
+    __dirname2 = path33.dirname(fileURLToPath(import.meta.url));
     REGISTRY_URL = "https://registry.npmjs.org/zelari-code/latest";
   }
 });
 
 // src/cli/mcp/mcpClient.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn11 } from "node:child_process";
 var DEFAULT_REQUEST_TIMEOUT_MS, INIT_TIMEOUT_MS, MCP_PROTOCOL_VERSION, McpClient;
 var init_mcpClient = __esm({
   "src/cli/mcp/mcpClient.ts"() {
@@ -37809,10 +38322,10 @@ var init_mcpClient = __esm({
           env: { ...process.env, ...this.config.env ?? {} },
           windowsHide: true
         };
-        const child = process.platform === "win32" ? spawn9(buildCmdLine(this.config.command, this.config.args ?? []), {
+        const child = process.platform === "win32" ? spawn11(buildCmdLine(this.config.command, this.config.args ?? []), {
           ...spawnOpts,
           shell: true
-        }) : spawn9(this.config.command, this.config.args ?? [], spawnOpts);
+        }) : spawn11(this.config.command, this.config.args ?? [], spawnOpts);
         this.child = child;
         child.stdout.setEncoding("utf8");
         child.stdout.on("data", (chunk) => this.onStdout(chunk));
@@ -37950,7 +38463,7 @@ var init_mcpClient = __esm({
 
 // src/cli/mcp/mcpConfigIo.ts
 import {
-  existsSync as existsSync31,
+  existsSync as existsSync32,
   mkdirSync as mkdirSync16,
   readFileSync as readFileSync27,
   writeFileSync as writeFileSync18
@@ -37963,10 +38476,10 @@ function getUserMcpPath() {
 function getProjectMcpPath(projectRoot) {
   return join26(projectRoot, ".zelari", "mcp.json");
 }
-function readFile2(path53) {
-  if (!existsSync31(path53)) return {};
+function readFile2(path55) {
+  if (!existsSync32(path55)) return {};
   try {
-    const parsed = JSON.parse(readFileSync27(path53, "utf8"));
+    const parsed = JSON.parse(readFileSync27(path55, "utf8"));
     const out = {};
     for (const [name, cfg] of Object.entries(parsed.mcpServers ?? {})) {
       if (!cfg || typeof cfg.command !== "string" || !cfg.command.trim()) continue;
@@ -37982,10 +38495,10 @@ function readFile2(path53) {
     return {};
   }
 }
-function writeFile(path53, servers) {
-  mkdirSync16(dirname7(path53), { recursive: true });
+function writeFile(path55, servers) {
+  mkdirSync16(dirname7(path55), { recursive: true });
   const body = { mcpServers: servers };
-  writeFileSync18(path53, `${JSON.stringify(body, null, 2)}
+  writeFileSync18(path55, `${JSON.stringify(body, null, 2)}
 `, "utf8");
 }
 function listMcpServers(projectRoot) {
@@ -38018,9 +38531,9 @@ function upsertMcpServer(opts) {
   if (!opts.config.command?.trim()) {
     return { ok: false, error: "command is required" };
   }
-  let path53;
+  let path55;
   if (opts.scope === "user") {
-    path53 = getUserMcpPath();
+    path55 = getUserMcpPath();
   } else {
     const root = opts.projectRoot?.trim();
     if (!root) {
@@ -38029,30 +38542,30 @@ function upsertMcpServer(opts) {
         error: "projectRoot required for project scope (Open Folder first)"
       };
     }
-    path53 = getProjectMcpPath(root);
+    path55 = getProjectMcpPath(root);
   }
-  const current = readFile2(path53);
+  const current = readFile2(path55);
   current[name] = {
     command: opts.config.command.trim(),
     args: opts.config.args,
     env: opts.config.env,
     enabled: opts.config.enabled !== false
   };
-  writeFile(path53, current);
-  return { ok: true, path: path53 };
+  writeFile(path55, current);
+  return { ok: true, path: path55 };
 }
 function removeMcpServer(opts) {
-  const path53 = opts.scope === "user" ? getUserMcpPath() : opts.projectRoot ? getProjectMcpPath(opts.projectRoot) : null;
-  if (!path53) {
+  const path55 = opts.scope === "user" ? getUserMcpPath() : opts.projectRoot ? getProjectMcpPath(opts.projectRoot) : null;
+  if (!path55) {
     return { ok: false, error: "projectRoot required for project scope" };
   }
-  const current = readFile2(path53);
+  const current = readFile2(path55);
   if (!(opts.name in current)) {
-    return { ok: false, error: `Server "${opts.name}" not found in ${path53}` };
+    return { ok: false, error: `Server "${opts.name}" not found in ${path55}` };
   }
   delete current[opts.name];
-  writeFile(path53, current);
-  return { ok: true, path: path53 };
+  writeFile(path55, current);
+  return { ok: true, path: path55 };
 }
 var init_mcpConfigIo = __esm({
   "src/cli/mcp/mcpConfigIo.ts"() {
@@ -38194,7 +38707,7 @@ __export(mcpManager_exports, {
   readMcpConfig: () => readMcpConfig,
   registerMcpTools: () => registerMcpTools
 });
-import { existsSync as existsSync32, readFileSync as readFileSync28 } from "node:fs";
+import { existsSync as existsSync33, readFileSync as readFileSync28 } from "node:fs";
 import { join as join27 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 function readMcpConfig(projectRoot = process.cwd(), opts) {
@@ -38207,7 +38720,7 @@ function readMcpConfig(projectRoot = process.cwd(), opts) {
     paths.push(join27(projectRoot, ".zelari", "mcp.json"));
   }
   for (const p3 of paths) {
-    if (!existsSync32(p3)) continue;
+    if (!existsSync33(p3)) continue;
     try {
       const parsed = JSON.parse(readFileSync28(p3, "utf8"));
       for (const [name, cfg] of Object.entries(parsed.mcpServers ?? {})) {
@@ -38223,7 +38736,7 @@ async function ensureLoaded(projectRoot) {
   if (state2.loaded) return;
   state2.loaded = true;
   const trusted = isFolderTrusted(projectRoot);
-  if (!trusted && existsSync32(join27(projectRoot, ".zelari", "mcp.json"))) {
+  if (!trusted && existsSync33(join27(projectRoot, ".zelari", "mcp.json"))) {
     state2.warnings.push(
       "[mcp] project .zelari/mcp.json ignored \u2014 folder not trusted (run /trust or `zelari-code --trust` to enable project MCP)"
     );
@@ -38448,15 +38961,15 @@ __export(agentsMd_exports, {
   serializeAgentsMd: () => serializeAgentsMd,
   updateAgentsMd: () => updateAgentsMd
 });
-import { existsSync as existsSync33, readFileSync as readFileSync29, writeFileSync as writeFileSync19 } from "node:fs";
-import { createHash as createHash8 } from "node:crypto";
+import { existsSync as existsSync34, readFileSync as readFileSync29, writeFileSync as writeFileSync19 } from "node:fs";
+import { createHash as createHash9 } from "node:crypto";
 import { join as join28 } from "node:path";
 import { readFile as readFile3 } from "node:fs/promises";
 async function readPackageJson2(projectRoot) {
-  const path53 = join28(projectRoot, "package.json");
-  if (!existsSync33(path53)) return null;
+  const path55 = join28(projectRoot, "package.json");
+  if (!existsSync34(path55)) return null;
   try {
-    return JSON.parse(await readFile3(path53, "utf8"));
+    return JSON.parse(await readFile3(path55, "utf8"));
   } catch {
     return null;
   }
@@ -38479,7 +38992,7 @@ async function genTechStack(ctx) {
 }
 async function genDecisions(ctx) {
   const decisionsDir = join28(ctx.rootDir, "decisions");
-  if (!existsSync33(decisionsDir)) return "_No ADRs yet._";
+  if (!existsSync34(decisionsDir)) return "_No ADRs yet._";
   const files = ctx.storage.listMarkdown(decisionsDir).sort();
   const accepted = [];
   const proposed = [];
@@ -38505,7 +39018,7 @@ async function genDecisions(ctx) {
 async function genConventions(ctx) {
   const lines = [];
   const claudeMd = join28(ctx.projectRoot, "CLAUDE.MD");
-  if (existsSync33(claudeMd)) {
+  if (existsSync34(claudeMd)) {
     const content = readFileSync29(claudeMd, "utf8");
     const match = content.match(/## Architecture rules[\s\S]+?(?=\n## |\n*$)/);
     if (match) {
@@ -38538,9 +39051,9 @@ async function genBuild(ctx) {
   ].join("\n");
 }
 async function genOpenQuestions(ctx) {
-  const path53 = join28(ctx.rootDir, "risks.md");
-  if (!existsSync33(path53)) return "_No open questions._";
-  const content = readFileSync29(path53, "utf8");
+  const path55 = join28(ctx.rootDir, "risks.md");
+  if (!existsSync34(path55)) return "_No open questions._";
+  const content = readFileSync29(path55, "utf8");
   const lines = content.split("\n");
   const questions = [];
   let currentTitle = "";
@@ -38615,7 +39128,7 @@ function titleCase(id) {
 }
 async function updateAgentsMd(ctx, projectRoot) {
   const agentsPath = join28(projectRoot, "AGENTS.MD");
-  if (existsSync33(agentsPath)) {
+  if (existsSync34(agentsPath)) {
     const content = readFileSync29(agentsPath, "utf8");
     const hasAnyMarker = AUTO_SECTIONS.some((id) => content.includes(MARKER_OPEN(id)));
     if (!hasAnyMarker) {
@@ -38631,7 +39144,7 @@ async function updateAgentsMd(ctx, projectRoot) {
     newSections.set(id, await GENERATORS[id](ctx));
   }
   let manualContent = "";
-  if (existsSync33(agentsPath)) {
+  if (existsSync34(agentsPath)) {
     const { manualBlocks } = parseAgentsMd(readFileSync29(agentsPath, "utf8"));
     manualContent = manualBlocks.after;
   } else {
@@ -38648,7 +39161,7 @@ async function updateAgentsMd(ctx, projectRoot) {
       ""
     ].join("\n");
   }
-  const oldContent = existsSync33(agentsPath) ? readFileSync29(agentsPath, "utf8") : "";
+  const oldContent = existsSync34(agentsPath) ? readFileSync29(agentsPath, "utf8") : "";
   const { sections: oldSections } = parseAgentsMd(oldContent);
   const changedSections = [];
   for (const id of AUTO_SECTIONS) {
@@ -38664,7 +39177,7 @@ async function updateAgentsMd(ctx, projectRoot) {
   return { changed: true, sections: changedSections };
 }
 function hash2(s) {
-  return createHash8("sha256").update(s).digest("hex").slice(0, 16);
+  return createHash9("sha256").update(s).digest("hex").slice(0, 16);
 }
 var AUTO_SECTIONS, MARKER_OPEN, MARKER_CLOSE, GENERATORS;
 var init_agentsMd = __esm({
@@ -38785,11 +39298,11 @@ var init_completeDesign = __esm({
 });
 
 // src/cli/workspace/planDriftCheck.ts
-import { existsSync as existsSync34, readFileSync as readFileSync30, readdirSync as readdirSync9, statSync as statSync5, writeFileSync as writeFileSync20 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync30, readdirSync as readdirSync9, statSync as statSync5, writeFileSync as writeFileSync20 } from "node:fs";
 import { join as join29 } from "node:path";
 function findCanonicalDoc(rootDir) {
   const docsDir = join29(rootDir, "docs");
-  if (!existsSync34(docsDir)) return null;
+  if (!existsSync35(docsDir)) return null;
   const candidates = readdirSync9(docsDir).filter((f) => /^plan-canonical.*\.md$/i.test(f)).map((f) => ({ f, mtime: statSync5(join29(docsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   return candidates.length > 0 ? candidates[0].f : null;
 }
@@ -38814,9 +39327,9 @@ function versionKey(value) {
 function firstString2(v) {
   return typeof v === "string" && v.trim().length > 0 ? v : null;
 }
-function readFileSyncSafe(path53) {
+function readFileSyncSafe(path55) {
   try {
-    return readFileSync30(path53, "utf8");
+    return readFileSync30(path55, "utf8");
   } catch {
     return null;
   }
@@ -38826,7 +39339,7 @@ async function runPlanDriftCheck(rootDir) {
     return { ran: false, reason: "ZELARI_DRIFT_CHECK=0 (disabled)" };
   }
   const planPath = join29(rootDir, "plan.json");
-  if (!existsSync34(planPath)) {
+  if (!existsSync35(planPath)) {
     return { ran: false, reason: ".zelari/plan.json missing (not design-phase)" };
   }
   let plan;
@@ -38956,8 +39469,8 @@ var init_planDriftCheck = __esm({
 });
 
 // src/cli/workspace/projectSmoke.ts
-import { spawn as spawn10 } from "node:child_process";
-import { existsSync as existsSync35, readFileSync as readFileSync31 } from "node:fs";
+import { spawn as spawn12 } from "node:child_process";
+import { existsSync as existsSync36, readFileSync as readFileSync31 } from "node:fs";
 import { join as join30 } from "node:path";
 function pickSmokeScript(scripts) {
   if (!scripts) return null;
@@ -38971,7 +39484,7 @@ async function runProjectSmoke(projectRoot, timeoutMs = DEFAULT_TIMEOUT_MS2) {
     return { ran: false, reason: "ZELARI_SMOKE=0 (disabled)" };
   }
   const pkgPath = join30(projectRoot, "package.json");
-  if (!existsSync35(pkgPath)) {
+  if (!existsSync36(pkgPath)) {
     return { ran: false, reason: "no package.json (skipped)" };
   }
   let scripts = {};
@@ -38986,12 +39499,12 @@ async function runProjectSmoke(projectRoot, timeoutMs = DEFAULT_TIMEOUT_MS2) {
     return { ran: false, reason: "no typecheck/test/build script (skipped)" };
   }
   return await new Promise((resolveRun) => {
-    const child = process.platform === "win32" ? spawn10(buildCmdLine("npm.cmd", ["run", script]), {
+    const child = process.platform === "win32" ? spawn12(buildCmdLine("npm.cmd", ["run", script]), {
       cwd: projectRoot,
       stdio: ["ignore", "pipe", "pipe"],
       env: process.env,
       shell: true
-    }) : spawn10("npm", ["run", script], {
+    }) : spawn12("npm", ["run", script], {
       cwd: projectRoot,
       stdio: ["ignore", "pipe", "pipe"],
       env: process.env
@@ -39063,8 +39576,8 @@ __export(postCouncilHook_exports, {
   runImplementationVerificationHook: () => runImplementationVerificationHook,
   runPostCouncilHook: () => runPostCouncilHook
 });
-import { spawn as spawn11 } from "node:child_process";
-import { existsSync as existsSync36, readFileSync as readFileSync32 } from "node:fs";
+import { spawn as spawn13 } from "node:child_process";
+import { existsSync as existsSync37, readFileSync as readFileSync32 } from "node:fs";
 import { join as join31 } from "node:path";
 async function runCompleteDesignPostProcessor(ctx, options) {
   if (options?.runMode === "implementation") {
@@ -39078,7 +39591,7 @@ async function runCompleteDesignPostProcessor(ctx, options) {
   }
   const planJsonPath2 = join31(ctx.rootDir, "plan.json");
   const scriptPath = join31(ctx.projectRoot, "complete-design.mjs");
-  if (!existsSync36(planJsonPath2)) {
+  if (!existsSync37(planJsonPath2)) {
     return {
       ran: false,
       reason: ".zelari/plan.json missing (not design-phase)"
@@ -39094,7 +39607,7 @@ async function runCompleteDesignPostProcessor(ctx, options) {
   if (phaseCount === 0) {
     return { ran: false, reason: ".zelari/plan.json has no phases" };
   }
-  if (!existsSync36(scriptPath)) {
+  if (!existsSync37(scriptPath)) {
     try {
       const builtin = await runBuiltinCompleteDesign(ctx);
       return {
@@ -39112,7 +39625,7 @@ async function runCompleteDesignPostProcessor(ctx, options) {
     }
   }
   return await new Promise((resolveRun) => {
-    const child = spawn11(process.execPath, [scriptPath], {
+    const child = spawn13(process.execPath, [scriptPath], {
       cwd: ctx.projectRoot,
       stdio: ["ignore", "pipe", "pipe"],
       env: process.env
@@ -39279,8 +39792,8 @@ async function runPostCouncilHook(ctx, options) {
           sources: scope.sources
         } : void 0
       });
-      const path53 = writeCouncilCompletion(ctx.rootDir, completion);
-      completionHook = { ran: true, path: path53, completion };
+      const path55 = writeCouncilCompletion(ctx.rootDir, completion);
+      completionHook = { ran: true, path: path55, completion };
     } catch (err) {
       completionHook = {
         ran: true,
@@ -39319,14 +39832,14 @@ __export(councilFeedback_exports, {
   FeedbackStore: () => FeedbackStore
 });
 import {
-  promises as fs16,
-  existsSync as existsSync37,
+  promises as fs18,
+  existsSync as existsSync38,
   readFileSync as readFileSync33,
   writeFileSync as writeFileSync21,
   mkdirSync as mkdirSync17
 } from "node:fs";
-import path32 from "node:path";
-import os9 from "node:os";
+import path34 from "node:path";
+import os10 from "node:os";
 var FeedbackStore;
 var init_councilFeedback = __esm({
   "src/cli/councilFeedback.ts"() {
@@ -39336,7 +39849,7 @@ var init_councilFeedback = __esm({
       now;
       entries = [];
       constructor(options = {}) {
-        this.file = options.file ?? (process.env.ANATHEMA_COUNCIL_FEEDBACK_FILE ?? path32.join(os9.homedir(), ".tmp", "zelari-code", "council-feedback.json"));
+        this.file = options.file ?? (process.env.ANATHEMA_COUNCIL_FEEDBACK_FILE ?? path34.join(os10.homedir(), ".tmp", "zelari-code", "council-feedback.json"));
         this.now = options.now ?? Date.now;
         this.load();
       }
@@ -39429,7 +39942,7 @@ var init_councilFeedback = __esm({
       }
       // --- persistence ---------------------------------------------------------
       load() {
-        if (!existsSync37(this.file)) return;
+        if (!existsSync38(this.file)) return;
         try {
           const raw = readFileSync33(this.file, "utf-8");
           const parsed = JSON.parse(raw);
@@ -39442,7 +39955,7 @@ var init_councilFeedback = __esm({
         }
       }
       save() {
-        mkdirSync17(path32.dirname(this.file), { recursive: true });
+        mkdirSync17(path34.dirname(this.file), { recursive: true });
         writeFileSync21(
           this.file,
           JSON.stringify({ entries: this.entries }, null, 2),
@@ -39452,7 +39965,7 @@ var init_councilFeedback = __esm({
       /** Async variant of load for callers that prefer async IO. */
       async loadAsync() {
         try {
-          const raw = await fs16.readFile(this.file, "utf-8");
+          const raw = await fs18.readFile(this.file, "utf-8");
           const parsed = JSON.parse(raw);
           if (parsed && Array.isArray(parsed.entries)) {
             this.entries = parsed.entries.filter(
@@ -39510,7 +40023,7 @@ import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import path33 from "node:path";
+import path35 from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 async function git2(cwd, args, env) {
   const { stdout } = await execFileAsync2("git", ["-C", cwd, ...args], {
@@ -39530,8 +40043,8 @@ async function isGitRepo(cwd) {
   return await gitSafe(cwd, ["rev-parse", "--is-inside-work-tree"]) === "true";
 }
 async function withTempIndex(fn) {
-  const dir = mkdtempSync(path33.join(tmpdir2(), "zelari-ckpt-"));
-  const indexFile = path33.join(dir, "index");
+  const dir = mkdtempSync(path35.join(tmpdir2(), "zelari-ckpt-"));
+  const indexFile = path35.join(dir, "index");
   try {
     return await fn(indexFile);
   } finally {
@@ -39622,7 +40135,7 @@ async function restoreCheckpoint(cwd, id) {
     const deleted = [];
     for (const rel2 of added) {
       try {
-        rmSync2(path33.join(cwd, rel2), { force: true });
+        rmSync2(path35.join(cwd, rel2), { force: true });
         deleted.push(rel2);
       } catch {
       }
@@ -39722,8 +40235,8 @@ __export(fileBackend_exports, {
   isMemoryEnabled: () => isMemoryEnabled
 });
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { promises as fs17 } from "node:fs";
-import * as path34 from "node:path";
+import { promises as fs19 } from "node:fs";
+import * as path36 from "node:path";
 function tokenize(text) {
   return text.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((t) => t.length >= 3);
 }
@@ -39767,9 +40280,9 @@ var init_fileBackend = __esm({
       logPath = "";
       memoryDir = "";
       async init(projectRoot) {
-        this.memoryDir = path34.join(projectRoot, ".zelari", "memory");
-        this.logPath = path34.join(this.memoryDir, "log.jsonl");
-        await fs17.mkdir(this.memoryDir, { recursive: true });
+        this.memoryDir = path36.join(projectRoot, ".zelari", "memory");
+        this.logPath = path36.join(this.memoryDir, "log.jsonl");
+        await fs19.mkdir(this.memoryDir, { recursive: true });
       }
       async add(content, metadata = {}, graph) {
         const fact = {
@@ -39779,7 +40292,7 @@ var init_fileBackend = __esm({
           ...graph ? { graph } : {},
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        await fs17.appendFile(this.logPath, JSON.stringify(fact) + "\n", "utf8");
+        await fs19.appendFile(this.logPath, JSON.stringify(fact) + "\n", "utf8");
         return fact.id;
       }
       async search(query, options = {}) {
@@ -39807,7 +40320,7 @@ var init_fileBackend = __esm({
       async readAll() {
         let raw;
         try {
-          raw = await fs17.readFile(this.logPath, "utf8");
+          raw = await fs19.readFile(this.logPath, "utf8");
         } catch {
           return [];
         }
@@ -39840,23 +40353,23 @@ var init_fileBackend = __esm({
 });
 
 // src/cli/traceStore.ts
-import { promises as fs18 } from "node:fs";
-import * as path35 from "node:path";
+import { promises as fs20 } from "node:fs";
+import * as path37 from "node:path";
 function traceDir(projectRoot) {
-  return path35.join(projectRoot, ".zelari", "trace");
+  return path37.join(projectRoot, ".zelari", "trace");
 }
 function tracePath(projectRoot, missionId) {
-  return path35.join(traceDir(projectRoot), `${missionId}.json`);
+  return path37.join(traceDir(projectRoot), `${missionId}.json`);
 }
 async function saveTrace(projectRoot, missionId, entries) {
   const dir = traceDir(projectRoot);
-  await fs18.mkdir(dir, { recursive: true });
+  await fs20.mkdir(dir, { recursive: true });
   const payload = {
     missionId,
     ts: Date.now(),
     entries
   };
-  await fs18.writeFile(
+  await fs20.writeFile(
     tracePath(projectRoot, missionId),
     JSON.stringify(payload, null, 2) + "\n",
     "utf8"
@@ -39880,8 +40393,8 @@ __export(zelariMission_exports, {
   runZelariMission: () => runZelariMission
 });
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { promises as fs19 } from "node:fs";
-import * as path36 from "node:path";
+import { promises as fs21 } from "node:fs";
+import * as path38 from "node:path";
 function resolveMaxIterations(env = process.env) {
   const raw = env.ZELARI_MISSION_MAX_ITER;
   const n = raw ? Number.parseInt(raw, 10) : DEFAULT_MAX_ITER;
@@ -39909,10 +40422,10 @@ function isMissionAutoStart(env = process.env) {
   return env.ZELARI_MISSION_AUTO === "1";
 }
 async function writeMissionState(projectRoot, state3) {
-  const dir = path36.join(projectRoot, ".zelari");
-  await fs19.mkdir(dir, { recursive: true });
-  await fs19.writeFile(
-    path36.join(dir, "mission-state.json"),
+  const dir = path38.join(projectRoot, ".zelari");
+  await fs21.mkdir(dir, { recursive: true });
+  await fs21.writeFile(
+    path38.join(dir, "mission-state.json"),
     JSON.stringify(state3, null, 2) + "\n",
     "utf8"
   );
@@ -40512,7 +41025,7 @@ function safeSocketPath(socketPath) {
   return socketPath.trim();
 }
 function startPermissionBroker(socketPath, handlers, opts) {
-  const path53 = safeSocketPath(socketPath);
+  const path55 = safeSocketPath(socketPath);
   const requestTimeoutMs = opts?.requestTimeoutMs ?? PERMISSION_BROKER_DEFAULT_TIMEOUT_MS;
   const sockets = /* @__PURE__ */ new Set();
   const server = createServer2((socket) => {
@@ -40612,10 +41125,10 @@ function startPermissionBroker(socketPath, handlers, opts) {
   return new Promise((resolve3, reject) => {
     const onError = (err) => reject(err);
     server.once("error", onError);
-    server.listen(path53, () => {
+    server.listen(path55, () => {
       server.removeListener("error", onError);
       resolve3({
-        socketPath: path53,
+        socketPath: path55,
         stop: () => new Promise((res) => {
           for (const s of sockets) s.destroy();
           sockets.clear();
@@ -40626,7 +41139,7 @@ function startPermissionBroker(socketPath, handlers, opts) {
             if (done) return;
             done = true;
             if (process.platform !== "win32") {
-              unlink(path53, () => res());
+              unlink(path55, () => res());
             } else {
               res();
             }
@@ -40639,11 +41152,11 @@ function startPermissionBroker(socketPath, handlers, opts) {
   });
 }
 function requestBrokerAsk(socketPath, ask, opts) {
-  const path53 = safeSocketPath(socketPath);
+  const path55 = safeSocketPath(socketPath);
   const requestTimeoutMs = opts?.requestTimeoutMs ?? PERMISSION_BROKER_DEFAULT_TIMEOUT_MS;
   const connectTimeoutMs = opts?.connectTimeoutMs ?? PERMISSION_BROKER_DEFAULT_CONNECT_TIMEOUT_MS;
   return new Promise((resolve3, reject) => {
-    const socket = connect(path53);
+    const socket = connect(path55);
     let buffer = "";
     let settled = false;
     const settle = (fn) => {
@@ -40658,7 +41171,7 @@ function requestBrokerAsk(socketPath, ask, opts) {
       settle(
         () => reject(
           new Error(
-            `permission broker unavailable at "${path53}" (connect timed out after ${connectTimeoutMs}ms)`
+            `permission broker unavailable at "${path55}" (connect timed out after ${connectTimeoutMs}ms)`
           )
         )
       );
@@ -41390,10 +41903,10 @@ __export(graphMemory_exports, {
   saveGraphSnapshot: () => saveGraphSnapshot,
   toGraphSnapshot: () => toGraphSnapshot
 });
-import { promises as fs20 } from "node:fs";
-import path38 from "node:path";
+import { promises as fs22 } from "node:fs";
+import path40 from "node:path";
 function snapshotPath(cwd) {
-  return path38.join(cwd, SNAPSHOT_DIR, SNAPSHOT_FILE);
+  return path40.join(cwd, SNAPSHOT_DIR, SNAPSHOT_FILE);
 }
 function toGraphSnapshot(graph, opts) {
   const unresolved = (opts.unresolvedFindings ?? []).map((u) => ({
@@ -41418,16 +41931,16 @@ function toGraphSnapshot(graph, opts) {
 }
 async function saveGraphSnapshot(cwd, snapshot) {
   try {
-    await fs20.access(cwd);
+    await fs22.access(cwd);
     const file2 = snapshotPath(cwd);
-    await fs20.mkdir(path38.dirname(file2), { recursive: true });
-    await fs20.writeFile(file2, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs22.mkdir(path40.dirname(file2), { recursive: true });
+    await fs22.writeFile(file2, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
   } catch {
   }
 }
 async function loadGraphSnapshot(cwd) {
   try {
-    const raw = await fs20.readFile(snapshotPath(cwd), "utf8");
+    const raw = await fs22.readFile(snapshotPath(cwd), "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.nodes)) return null;
     return parsed;
@@ -41487,7 +42000,7 @@ var SNAPSHOT_DIR, SNAPSHOT_FILE, MAX_SNAPSHOT_FINDINGS_CHARS;
 var init_graphMemory = __esm({
   "src/cli/kraken/graphMemory.ts"() {
     "use strict";
-    SNAPSHOT_DIR = path38.join(".zelari", "kraken");
+    SNAPSHOT_DIR = path40.join(".zelari", "kraken");
     SNAPSHOT_FILE = "last-graph.json";
     MAX_SNAPSHOT_FINDINGS_CHARS = 400;
   }
@@ -41502,15 +42015,15 @@ var init_tentacle = __esm({
 });
 
 // src/cli/kraken/workbench.ts
-import { promises as fs21 } from "node:fs";
-import path39 from "node:path";
+import { promises as fs23 } from "node:fs";
+import path41 from "node:path";
 function isWorkbenchEnabled(env = process.env) {
   const v = (env.ZELARI_KRAKEN_WORKBENCH ?? "1").trim().toLowerCase();
   if (v === "0" || v === "false" || v === "no" || v === "off") return false;
   return true;
 }
 function workbenchPath(cwd, graphId) {
-  return path39.join(cwd, ".zelari", "radio", `workbench-${graphId}.md`);
+  return path41.join(cwd, ".zelari", "radio", `workbench-${graphId}.md`);
 }
 function countByStatus2(nodes) {
   const out = { pending: 0, running: 0, done: 0, error: 0, skipped: 0 };
@@ -41673,11 +42186,11 @@ var init_workbench = __esm({
         if (!this.enabled) return null;
         if (!this.dirty && this.lastWrite) return this.lastWrite;
         const out = workbenchPath(this.cwd, this.graphId);
-        await fs21.mkdir(path39.dirname(out), { recursive: true });
+        await fs23.mkdir(path41.dirname(out), { recursive: true });
         const body = this.render();
         const tmp = `${out}.${process.pid}.${Date.now()}.tmp`;
-        await fs21.writeFile(tmp, body, "utf8");
-        await fs21.rename(tmp, out);
+        await fs23.writeFile(tmp, body, "utf8");
+        await fs23.rename(tmp, out);
         this.dirty = false;
         this.lastWrite = Promise.resolve(out);
         return out;
@@ -41869,8 +42382,8 @@ __export(executor_exports, {
   resolveNodeTimeoutMs: () => resolveNodeTimeoutMs,
   thoroughnessForKind: () => thoroughnessForKind
 });
-import { existsSync as existsSync38 } from "node:fs";
-import path40 from "node:path";
+import { existsSync as existsSync39 } from "node:fs";
+import path42 from "node:path";
 function resolveMaxParallel(env = process.env) {
   const raw = env.ZELARI_KRAKEN_MAX_PARALLEL;
   if (raw === void 0 || raw === "") return DEFAULT_MAX_PARALLEL;
@@ -41928,7 +42441,7 @@ function isWorldModelGateEnabled(cwd, env = process.env, checksExists = defaultC
 }
 function defaultChecksExists(cwd) {
   try {
-    return existsSync38(path40.join(cwd, ".zelari", "world", "checks.json"));
+    return existsSync39(path42.join(cwd, ".zelari", "world", "checks.json"));
   } catch {
     return false;
   }
@@ -42895,7 +43408,7 @@ __export(prereqChecks_exports, {
   runPrereqChecks: () => runPrereqChecks
 });
 import { execSync, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync39 } from "node:fs";
+import { existsSync as existsSync40 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 function isWslBashPath2(p3) {
   if (!p3 || typeof p3 !== "string") return false;
@@ -43019,7 +43532,7 @@ function agentProbeEnv() {
 }
 function existsSyncSafe2(p3) {
   try {
-    return existsSync39(p3);
+    return existsSync40(p3);
   } catch {
     return false;
   }
@@ -43266,16 +43779,16 @@ var init_prereqChecks = __esm({
 });
 
 // src/cli/plugins/prefs.ts
-import { existsSync as existsSync40, readFileSync as readFileSync34, writeFileSync as writeFileSync22, mkdirSync as mkdirSync18 } from "node:fs";
-import path43 from "node:path";
-import os10 from "node:os";
+import { existsSync as existsSync41, readFileSync as readFileSync34, writeFileSync as writeFileSync22, mkdirSync as mkdirSync18 } from "node:fs";
+import path45 from "node:path";
+import os11 from "node:os";
 function getPluginPrefsPath() {
-  return process.env.ZELARI_PLUGINS_PREFS_FILE ?? path43.join(os10.homedir(), ".tmp", "zelari-code", "plugins.json");
+  return process.env.ZELARI_PLUGINS_PREFS_FILE ?? path45.join(os11.homedir(), ".tmp", "zelari-code", "plugins.json");
 }
 function getPluginPrefs() {
   const file2 = getPluginPrefsPath();
   try {
-    if (!existsSync40(file2)) return { ...DEFAULTS2, dontAskAgain: {} };
+    if (!existsSync41(file2)) return { ...DEFAULTS2, dontAskAgain: {} };
     const raw = readFileSync34(file2, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && parsed.dontAskAgain && typeof parsed.dontAskAgain === "object") {
@@ -43291,7 +43804,7 @@ function getPluginPrefs() {
 }
 function writePluginPrefs(prefs) {
   const file2 = getPluginPrefsPath();
-  mkdirSync18(path43.dirname(file2), { recursive: true });
+  mkdirSync18(path45.dirname(file2), { recursive: true });
   writeFileSync22(file2, JSON.stringify(prefs, null, 2), {
     encoding: "utf-8",
     mode: 384
@@ -43327,8 +43840,8 @@ __export(registry_exports, {
   findPlugin: () => findPlugin,
   isBinaryOnPath: () => isBinaryOnPath
 });
-import { existsSync as existsSync41 } from "node:fs";
-import path44 from "node:path";
+import { existsSync as existsSync42 } from "node:fs";
+import path46 from "node:path";
 function detectLocalBin(bin) {
   return (cwd) => {
     try {
@@ -43344,9 +43857,9 @@ function isBinaryOnPath(bin, opts = {}) {
     return false;
   }
   const platform = opts.platform ?? process.platform;
-  const exists = opts.exists ?? existsSync41;
+  const exists = opts.exists ?? existsSync42;
   const pathEnv = opts.pathEnv ?? process.env.PATH ?? "";
-  const pathMod = platform === "win32" ? path44.win32 : path44.posix;
+  const pathMod = platform === "win32" ? path46.win32 : path46.posix;
   const sep2 = platform === "win32" ? ";" : ":";
   const dirs = pathEnv.split(sep2).filter((d) => d.length > 0);
   const candidates = [bin];
@@ -44078,7 +44591,7 @@ __export(atMentions_exports, {
   extractAtMentions: () => extractAtMentions,
   hasAtMentions: () => hasAtMentions
 });
-import { existsSync as existsSync44, readFileSync as readFileSync36, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync45, readFileSync as readFileSync36, statSync as statSync8 } from "node:fs";
 import { basename as basename3, isAbsolute as isAbsolute2, relative as relative3, resolve, sep } from "node:path";
 function isImagePath(abs) {
   const ext = abs.split(".").pop()?.toLowerCase() ?? "";
@@ -44132,7 +44645,7 @@ function resolveMention(token, cwd) {
       note: "outside project root \u2014 skipped"
     };
   }
-  if (!existsSync44(abs)) {
+  if (!existsSync45(abs)) {
     return {
       raw: token,
       path: token,
@@ -44292,10 +44805,10 @@ __export(triggerLock_exports, {
   lockPath: () => lockPath,
   releaseLock: () => releaseLock
 });
-import { promises as fs29 } from "node:fs";
-import * as path49 from "node:path";
+import { promises as fs31 } from "node:fs";
+import * as path51 from "node:path";
 function lockPath(projectRoot) {
-  return path49.join(projectRoot, ".zelari", "trigger.lock");
+  return path51.join(projectRoot, ".zelari", "trigger.lock");
 }
 function isPidAlive(pid) {
   try {
@@ -44308,10 +44821,10 @@ function isPidAlive(pid) {
 }
 async function acquireLock(projectRoot, now = () => /* @__PURE__ */ new Date()) {
   const lp = lockPath(projectRoot);
-  const dir = path49.dirname(lp);
-  await fs29.mkdir(dir, { recursive: true });
+  const dir = path51.dirname(lp);
+  await fs31.mkdir(dir, { recursive: true });
   try {
-    const raw = await fs29.readFile(lp, "utf8");
+    const raw = await fs31.readFile(lp, "utf8");
     const existing = JSON.parse(raw);
     if (existing.pid && isPidAlive(existing.pid)) {
       return { acquired: false, heldBy: existing.pid, lockPath: lp };
@@ -44322,13 +44835,13 @@ async function acquireLock(projectRoot, now = () => /* @__PURE__ */ new Date())
     pid: process.pid,
     acquiredAt: now().toISOString()
   };
-  await fs29.writeFile(lp, JSON.stringify(payload, null, 2) + "\n", "utf8");
+  await fs31.writeFile(lp, JSON.stringify(payload, null, 2) + "\n", "utf8");
   return { acquired: true, lockPath: lp };
 }
 async function releaseLock(projectRoot) {
   const lp = lockPath(projectRoot);
   try {
-    await fs29.unlink(lp);
+    await fs31.unlink(lp);
   } catch {
   }
 }
@@ -44692,7 +45205,7 @@ var init_skillCategories = __esm({
 
 // src/cli/skillConfigIo.ts
 import {
-  existsSync as existsSync46,
+  existsSync as existsSync47,
   mkdirSync as mkdirSync21,
   readdirSync as readdirSync10,
   readFileSync as readFileSync38,
@@ -44766,7 +45279,7 @@ function entryFromBuiltin(skill) {
   };
 }
 function scanSkillsDir(dir, projectRoot, seen, out) {
-  if (!existsSync46(dir)) return;
+  if (!existsSync47(dir)) return;
   let entries;
   try {
     entries = readdirSync10(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
@@ -44775,7 +45288,7 @@ function scanSkillsDir(dir, projectRoot, seen, out) {
   }
   for (const entry of entries) {
     const skillPath = skillFilePath(dir, entry);
-    if (!existsSync46(skillPath)) continue;
+    if (!existsSync47(skillPath)) continue;
     try {
       const parsed = parseSkillMd(readFileSync38(skillPath, "utf8"), skillPath);
       if (!parsed) continue;
@@ -44861,7 +45374,7 @@ function upsertSkill(opts) {
     }
     dir = getProjectSkillsDir(root);
   }
-  const path53 = skillFilePath(dir, name);
+  const path55 = skillFilePath(dir, name);
   const content = serializeSkillMd({
     name,
     description,
@@ -44870,13 +45383,13 @@ function upsertSkill(opts) {
     tools: opts.tools,
     cost: opts.cost
   });
-  const parsed = parseSkillMd(content, path53);
+  const parsed = parseSkillMd(content, path55);
   if (!parsed) {
     return { ok: false, error: "Generated SKILL.md failed validation" };
   }
-  mkdirSync21(dirname10(path53), { recursive: true });
-  writeFileSync24(path53, content, "utf8");
-  return { ok: true, path: path53 };
+  mkdirSync21(dirname10(path55), { recursive: true });
+  writeFileSync24(path55, content, "utf8");
+  return { ok: true, path: path55 };
 }
 function removeSkill(opts) {
   const name = opts.name.trim().toLowerCase();
@@ -44894,8 +45407,8 @@ function removeSkill(opts) {
     dir = getProjectSkillsDir(root);
   }
   const skillDir = join37(dir, name);
-  const path53 = skillFilePath(dir, name);
-  if (!existsSync46(path53) && !existsSync46(skillDir)) {
+  const path55 = skillFilePath(dir, name);
+  if (!existsSync47(path55) && !existsSync47(skillDir)) {
     return { ok: false, error: `Skill "${name}" not found in ${dir}` };
   }
   try {
@@ -44906,7 +45419,7 @@ function removeSkill(opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  return { ok: true, path: path53 };
+  return { ok: true, path: path55 };
 }
 var NAME_RE, BUILTIN_SKILL_MODULES, builtinsLoaded;
 var init_skillConfigIo = __esm({
@@ -45200,14 +45713,14 @@ var init_permissionCli = __esm({
 
 // src/cli/companion/config.ts
 import {
-  existsSync as existsSync47,
+  existsSync as existsSync48,
   mkdirSync as mkdirSync22,
   readFileSync as readFileSync39,
   writeFileSync as writeFileSync25
 } from "node:fs";
 import { join as join38 } from "node:path";
 import { homedir as homedir13 } from "node:os";
-import { createHash as createHash9, randomBytes as randomBytes5, timingSafeEqual } from "node:crypto";
+import { createHash as createHash10, randomBytes as randomBytes5, timingSafeEqual } from "node:crypto";
 function getZelariHome() {
   return join38(homedir13(), ".zelari-code");
 }
@@ -45219,17 +45732,17 @@ function getCompanionTokenPath() {
 }
 function ensureHome() {
   const home = getZelariHome();
-  if (!existsSync47(home)) {
+  if (!existsSync48(home)) {
     mkdirSync22(home, { recursive: true });
   }
 }
 function loadCompanionConfig() {
-  const path53 = getCompanionConfigPath();
-  if (!existsSync47(path53)) {
+  const path55 = getCompanionConfigPath();
+  if (!existsSync48(path55)) {
     return { projects: [] };
   }
   try {
-    const raw = JSON.parse(readFileSync39(path53, "utf8"));
+    const raw = JSON.parse(readFileSync39(path55, "utf8"));
     const projects = Array.isArray(raw.projects) ? raw.projects.filter(
       (p3) => p3 && typeof p3.path === "string" && p3.path.trim() && typeof (p3.id ?? p3.name) === "string"
     ).map((p3) => ({
@@ -45267,24 +45780,24 @@ function loadOrCreateToken(explicit) {
     return { token: explicit.trim(), created: false };
   }
   ensureHome();
-  const path53 = getCompanionTokenPath();
-  if (existsSync47(path53)) {
-    const t = readFileSync39(path53, "utf8").trim();
+  const path55 = getCompanionTokenPath();
+  if (existsSync48(path55)) {
+    const t = readFileSync39(path55, "utf8").trim();
     if (t) return { token: t, created: false };
   }
   const token = randomBytes5(24).toString("base64url");
-  writeFileSync25(path53, token + "\n", "utf8");
+  writeFileSync25(path55, token + "\n", "utf8");
   try {
-    const fs31 = __require("node:fs");
-    fs31.chmodSync?.(path53, 384);
+    const fs33 = __require("node:fs");
+    fs33.chmodSync?.(path55, 384);
   } catch {
   }
   return { token, created: true };
 }
 function tokenMatches(expected, provided) {
   if (!provided) return false;
-  const a = createHash9("sha256").update(expected).digest();
-  const b = createHash9("sha256").update(provided).digest();
+  const a = createHash10("sha256").update(expected).digest();
+  const b = createHash10("sha256").update(provided).digest();
   try {
     return timingSafeEqual(a, b);
   } catch {
@@ -45301,17 +45814,17 @@ function mergeProjects(cfg, extraPaths) {
     byId.set(p3.id, p3);
   }
   for (const raw of extraPaths) {
-    const path53 = raw.trim();
-    if (!path53) continue;
-    let id = slugFromPath(path53);
+    const path55 = raw.trim();
+    if (!path55) continue;
+    let id = slugFromPath(path55);
     let n = 2;
-    while (byId.has(id) && byId.get(id).path !== path53) {
-      id = `${slugFromPath(path53)}-${n++}`;
+    while (byId.has(id) && byId.get(id).path !== path55) {
+      id = `${slugFromPath(path55)}-${n++}`;
     }
     byId.set(id, {
       id,
-      name: slugFromPath(path53),
-      path: path53
+      name: slugFromPath(path55),
+      path: path55
     });
   }
   return [...byId.values()];
@@ -45359,7 +45872,7 @@ var init_config = __esm({
 });
 
 // src/cli/companion/runManager.ts
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn15 } from "node:child_process";
 import { createInterface as createInterface2 } from "node:readline";
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { writeFileSync as writeFileSync26, unlinkSync as unlinkSync3 } from "node:fs";
@@ -45475,7 +45988,7 @@ var init_runManager = __esm({
             historyFile = void 0;
           }
         }
-        const child = spawn13(process.execPath, argv, {
+        const child = spawn15(process.execPath, argv, {
           cwd: args.cwd,
           env: {
             ...process.env,
@@ -45594,7 +46107,7 @@ __export(serve_exports, {
   runCompanionServe: () => runCompanionServe
 });
 import { createServer as createServer3 } from "node:http";
-import { existsSync as existsSync48 } from "node:fs";
+import { existsSync as existsSync49 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 function readBody(req, max = 2e6) {
   return new Promise((resolveBody, reject) => {
@@ -45642,7 +46155,7 @@ async function runCompanionServe(opts = {}) {
   let projects = mergeProjects(fileCfg, opts.projects ?? []);
   projects = projects.filter((p3) => {
     const abs = resolve2(p3.path);
-    if (!existsSync48(abs)) {
+    if (!existsSync49(abs)) {
       process.stderr.write(
         `[zelari-code serve] skip missing project path: ${p3.path}
 `
@@ -45688,9 +46201,9 @@ async function runCompanionServe(opts = {}) {
       return;
     }
     const url2 = parseUrl(req);
-    const path53 = url2.pathname.replace(/\/+$/, "") || "/";
+    const path55 = url2.pathname.replace(/\/+$/, "") || "/";
     try {
-      if (req.method === "GET" && (path53 === "/health" || path53 === "/v1/health")) {
+      if (req.method === "GET" && (path55 === "/health" || path55 === "/v1/health")) {
         sendJson2(res, 200, {
           ok: true,
           service: "zelari-companion",
@@ -45702,18 +46215,18 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      if (path53.startsWith("/v1")) {
+      if (path55.startsWith("/v1")) {
         if (!tokenMatches(token, getBearer(req))) {
           sendJson2(res, 401, { ok: false, error: "unauthorized" });
           return;
         }
       }
-      if (req.method === "GET" && path53 === "/v1/config") {
+      if (req.method === "GET" && path55 === "/v1/config") {
         const snap = buildDesktopConfigSnapshot();
         sendJson2(res, 200, { ok: true, ...snap });
         return;
       }
-      if (req.method === "GET" && path53 === "/v1/projects") {
+      if (req.method === "GET" && path55 === "/v1/projects") {
         sendJson2(res, 200, {
           ok: true,
           projects: projects.map((p3) => ({
@@ -45724,7 +46237,7 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      if (req.method === "GET" && path53 === "/v1/runs") {
+      if (req.method === "GET" && path55 === "/v1/runs") {
         sendJson2(res, 200, {
           ok: true,
           active: runs.getActive(),
@@ -45742,7 +46255,7 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      if (req.method === "POST" && path53 === "/v1/runs") {
+      if (req.method === "POST" && path55 === "/v1/runs") {
         const raw = await readBody(req);
         let body = {};
         try {
@@ -45789,7 +46302,7 @@ async function runCompanionServe(opts = {}) {
         });
         return;
       }
-      const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path53);
+      const eventsMatch = /^\/v1\/runs\/([^/]+)\/events$/.exec(path55);
       if (req.method === "GET" && eventsMatch) {
         const runId = eventsMatch[1];
         const run = runs.getRun(runId);
@@ -45854,7 +46367,7 @@ async function runCompanionServe(opts = {}) {
         }, 500);
         return;
       }
-      const cancelMatch = /^\/v1\/runs\/([^/]+)\/cancel$/.exec(path53);
+      const cancelMatch = /^\/v1\/runs\/([^/]+)\/cancel$/.exec(path55);
       if (req.method === "POST" && cancelMatch) {
         const runId = cancelMatch[1];
         const result = runs.cancel(runId);
@@ -45964,26 +46477,26 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor
 });
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync49, readFileSync as readFileSync40, readlinkSync, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync50, readFileSync as readFileSync40, readlinkSync, statSync as statSync9 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import path51 from "node:path";
+import path53 from "node:path";
 function findPackageRoot(start) {
   let dir = start;
   for (let i = 0; i < 6; i += 1) {
-    const candidate = path51.join(dir, "package.json");
-    if (existsSync49(candidate)) {
+    const candidate = path53.join(dir, "package.json");
+    if (existsSync50(candidate)) {
       try {
         const pkg = JSON.parse(readFileSync40(candidate, "utf8"));
         if (pkg.name === "zelari-code") return dir;
       } catch {
       }
     }
-    const parent = path51.dirname(dir);
+    const parent = path53.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return path51.resolve(__dirname3, "..", "..", "..");
+  return path53.resolve(__dirname3, "..", "..", "..");
 }
 function tryExec(cmd) {
   try {
@@ -45997,7 +46510,7 @@ function tryExec(cmd) {
 }
 function readPackageJson3() {
   try {
-    const pkgPath = path51.join(packageRoot, "package.json");
+    const pkgPath = path53.join(packageRoot, "package.json");
     return JSON.parse(readFileSync40(pkgPath, "utf8"));
   } catch {
     return null;
@@ -46013,8 +46526,8 @@ function checkShim(pkgName) {
   }
   const isWin = process.platform === "win32";
   const shimName = isWin ? "zelari-code.cmd" : "zelari-code";
-  const shimPath = path51.join(prefix, shimName);
-  if (!existsSync49(shimPath)) {
+  const shimPath = path53.join(prefix, shimName);
+  if (!existsSync50(shimPath)) {
     return FAIL(
       `shim not found at ${shimPath}
          fix:  npm install -g ${pkgName}@latest --force`
@@ -46041,8 +46554,8 @@ function checkShim(pkgName) {
          fix:  npm install -g ${pkgName}@latest --force`
       );
     }
-    const resolved = path51.resolve(path51.dirname(shimPath), target);
-    const expected = path51.join(
+    const resolved = path53.resolve(path53.dirname(shimPath), target);
+    const expected = path53.join(
       prefix,
       "node_modules",
       pkgName,
@@ -46081,8 +46594,8 @@ function checkNode(pkg) {
   return OK(`node ${raw}`);
 }
 function checkBundle() {
-  const bundle = path51.join(packageRoot, "dist", "cli", "main.bundled.js");
-  if (!existsSync49(bundle)) {
+  const bundle = path53.join(packageRoot, "dist", "cli", "main.bundled.js");
+  if (!existsSync50(bundle)) {
     return FAIL(
       `dist/cli/main.bundled.js missing at ${bundle}
          fix:  npm run build:cli   (then reinstall or run via tsx)`
@@ -46102,7 +46615,7 @@ function checkRuntimeDeps() {
   const missing = [];
   for (const dep of required2) {
     try {
-      const localReq = createRequire3(path51.join(packageRoot, "package.json"));
+      const localReq = createRequire3(path53.join(packageRoot, "package.json"));
       localReq.resolve(dep);
     } catch {
       missing.push(dep);
@@ -46278,7 +46791,7 @@ var init_doctor = __esm({
     "use strict";
     init_prereqChecks();
     require3 = createRequire3(import.meta.url);
-    __dirname3 = path51.dirname(fileURLToPath2(import.meta.url));
+    __dirname3 = path53.dirname(fileURLToPath2(import.meta.url));
     packageRoot = findPackageRoot(__dirname3);
     OK = (message) => ({
       ok: true,
@@ -46462,15 +46975,15 @@ __export(inspect_exports, {
   collectInspectReport: () => collectInspectReport,
   runInspect: () => runInspect
 });
-import path52 from "node:path";
-import { existsSync as existsSync50, readFileSync as readFileSync41, readdirSync as readdirSync11 } from "node:fs";
+import path54 from "node:path";
+import { existsSync as existsSync51, readFileSync as readFileSync41, readdirSync as readdirSync11 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
 async function collectInspectReport(cwd = process.cwd()) {
   ensureBuiltinSkillsLoadedSync();
   const snap = listSkillsSnapshot(cwd);
   const mcp = listMcpServers(cwd);
-  const userMcpPath = path52.join(homedir14(), ".zelari-code", "mcp.json");
-  const projectMcpPath = path52.join(cwd, ".zelari", "mcp.json");
+  const userMcpPath = path54.join(homedir14(), ".zelari-code", "mcp.json");
+  const projectMcpPath = path54.join(cwd, ".zelari", "mcp.json");
   const globalHooks = globalHooksDir();
   const projectHooks = projectHooksDir(cwd);
   const projectTrusted = isFolderTrusted(cwd);
@@ -46496,11 +47009,11 @@ async function collectInspectReport(cwd = process.cwd()) {
       folders: listTrustedFolders()
     },
     configSources: [
-      { path: userMcpPath, exists: existsSync50(userMcpPath) },
-      { path: projectMcpPath, exists: existsSync50(projectMcpPath) },
-      { path: path52.join(homedir14(), ".zelari-code", "provider.json"), exists: existsSync50(path52.join(homedir14(), ".zelari-code", "provider.json")) },
-      { path: path52.join(cwd, ".zelari", "AGENTS.md"), exists: existsSync50(path52.join(cwd, ".zelari", "AGENTS.md")) },
-      { path: path52.join(cwd, "AGENTS.md"), exists: existsSync50(path52.join(cwd, "AGENTS.md")) }
+      { path: userMcpPath, exists: existsSync51(userMcpPath) },
+      { path: projectMcpPath, exists: existsSync51(projectMcpPath) },
+      { path: path54.join(homedir14(), ".zelari-code", "provider.json"), exists: existsSync51(path54.join(homedir14(), ".zelari-code", "provider.json")) },
+      { path: path54.join(cwd, ".zelari", "AGENTS.md"), exists: existsSync51(path54.join(cwd, ".zelari", "AGENTS.md")) },
+      { path: path54.join(cwd, "AGENTS.md"), exists: existsSync51(path54.join(cwd, "AGENTS.md")) }
     ],
     skills: {
       total: snap.skills.length,
@@ -46513,7 +47026,7 @@ async function collectInspectReport(cwd = process.cwd()) {
       user: mcp.servers.filter((s) => s.scope === "user").map((s) => ({ name: s.name, enabled: s.enabled !== false })),
       project: mcp.servers.filter((s) => s.scope === "project").map((s) => ({ name: s.name, enabled: s.enabled !== false })),
       projectTrusted,
-      projectConfigExists: existsSync50(projectMcpPath)
+      projectConfigExists: existsSync51(projectMcpPath)
     },
     hooks: {
       global: {
@@ -46540,12 +47053,12 @@ function listJsonFiles(dir) {
 }
 function findAgentsMd(cwd) {
   const candidates = [
-    path52.join(cwd, "AGENTS.md"),
-    path52.join(cwd, ".zelari", "AGENTS.md")
+    path54.join(cwd, "AGENTS.md"),
+    path54.join(cwd, ".zelari", "AGENTS.md")
   ];
   const found = [];
   for (const c of candidates) {
-    if (existsSync50(c)) {
+    if (existsSync51(c)) {
       try {
         const text = readFileSync41(c, "utf8");
         found.push(`${c} (${text.length} bytes)`);
@@ -50321,6 +50834,8 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
           "You are in PLAN mode. Explore and design only.",
           "- Do NOT implement production code or run destructive shell commands.",
           "- write_file / edit_file / bash / apply_diff are unavailable.",
+          "- inspect_command IS available: allowlisted read-only inspector (no shell). Use it for git_status/git_log/git_diff/git_show/git_branch_current/git_ls_files/typecheck/node_version/npm_ls/npm_outdated/npm_view - it turns claims into execution-verified observations.",
+          "- OBSERVATION INTEGRITY: negative evidence is valid only from a completed observation. Never conclude that code/symbols/files do not exist from degraded results, zero files examined, or unavailable backends (grep_content SEARCH_EMPTY_SCOPE, ast/LSP degraded status, inspect_command unsupported shapes).",
           "- Produce a clear plan, ask clarifying questions (---QUESTION---), use workspace plan tools when relevant.",
           "- When the plan is ready, tell the user to run /build to implement."
         ].join("\n") : workPhase === "build" ? [
@@ -52423,7 +52938,7 @@ init_messageHelpers();
 // src/cli/gitOps.ts
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import path37 from "node:path";
+import path39 from "node:path";
 var execFileAsync3 = promisify3(execFile4);
 async function git3(cwd, args) {
   try {
@@ -52469,7 +52984,7 @@ async function undoWorkingChanges(opts = {}) {
   };
 }
 function defaultProjectRoot() {
-  return path37.resolve(__dirname, "..", "..", "..");
+  return path39.resolve(__dirname, "..", "..", "..");
 }
 
 // src/cli/slashHandlers/git.ts
@@ -52914,13 +53429,13 @@ ${digest}
 init_auditLogger();
 init_toolRegistry();
 init_messageHelpers();
-import { promises as fs23 } from "node:fs";
+import { promises as fs25 } from "node:fs";
 
 // src/cli/tools/krakenCsvFanout.ts
 init_zod();
 init_taskTool();
-import { promises as fs22 } from "node:fs";
-import path41 from "node:path";
+import { promises as fs24 } from "node:fs";
+import path43 from "node:path";
 import { randomBytes as randomBytes4 } from "node:crypto";
 var CsvFanoutArgsSchema = external_exports.object({
   csv_path: external_exports.string().min(1),
@@ -52941,7 +53456,7 @@ var CsvFanoutArgsSchema = external_exports.object({
   max_runtime_seconds: external_exports.number().int().positive().optional()
 });
 async function readCsv(filePath) {
-  const text = await fs22.readFile(filePath, "utf8");
+  const text = await fs24.readFile(filePath, "utf8");
   return parseCsv(text);
 }
 function parseCsv(text) {
@@ -53014,8 +53529,8 @@ function resolveMaxConcurrency(env = process.env) {
 }
 async function runCsvFanout(args, deps, opts) {
   const start = Date.now();
-  const absCsv = path41.isAbsolute(args.csv_path) ? args.csv_path : path41.join(opts.parentCwd, args.csv_path);
-  const absOut = path41.isAbsolute(args.output_csv_path) ? args.output_csv_path : path41.join(opts.parentCwd, args.output_csv_path);
+  const absCsv = path43.isAbsolute(args.csv_path) ? args.csv_path : path43.join(opts.parentCwd, args.csv_path);
+  const absOut = path43.isAbsolute(args.output_csv_path) ? args.output_csv_path : path43.join(opts.parentCwd, args.output_csv_path);
   const { headers: headers2, rows } = await readCsv(absCsv);
   if (headers2.length === 0) {
     throw new Error(`kraken_csv_fanout: ${absCsv} is empty`);
@@ -53071,7 +53586,7 @@ async function runCsvFanout(args, deps, opts) {
         errored += 1;
         errors.push(`${row[args.id_column] ?? i}: ${res.error}`);
       }
-      await fs22.mkdir(path41.dirname(absOut), { recursive: true });
+      await fs24.mkdir(path43.dirname(absOut), { recursive: true });
       await queueWrite(serializeCsv(outHeaders, outputRecords));
     }
   }
@@ -53093,8 +53608,8 @@ async function runCsvFanout(args, deps, opts) {
 }
 async function atomicWrite(file2, contents) {
   const tmp = `${file2}.${process.pid}.${Date.now()}.${randomBytes4(6).toString("hex")}.tmp`;
-  await fs22.writeFile(tmp, contents, "utf8");
-  await fs22.rename(tmp, file2);
+  await fs24.writeFile(tmp, contents, "utf8");
+  await fs24.rename(tmp, file2);
 }
 
 // src/cli/slashHandlers/krakenFanout.ts
@@ -53192,7 +53707,7 @@ async function handleKrakenFanout(ctx, raw) {
   }
   const absCsv = isAbsolute(parsed.args.csv_path) ? parsed.args.csv_path : joinPath(ctx.cwd, parsed.args.csv_path);
   try {
-    await fs23.access(absCsv);
+    await fs25.access(absCsv);
   } catch {
     appendSystem(ctx.setMessages, `[kraken fanout] source CSV not found: ${absCsv}`);
     return;
@@ -53265,8 +53780,8 @@ function splitArgs(s) {
 
 // src/cli/slashHandlers/krakenWorkbench.ts
 init_messageHelpers();
-import { promises as fs24 } from "node:fs";
-import path42 from "node:path";
+import { promises as fs26 } from "node:fs";
+import path44 from "node:path";
 
 // src/cli/kraken/workbenchView.ts
 var EMPTY = {
@@ -53383,15 +53898,15 @@ function formatWorkbenchForTerminal(p3) {
 
 // src/cli/slashHandlers/krakenWorkbench.ts
 async function handleKrakenWorkbench(ctx) {
-  const dir = path42.join(ctx.cwd, ".zelari", "radio");
+  const dir = path44.join(ctx.cwd, ".zelari", "radio");
   let latest = null;
   let latestMtime = 0;
   try {
-    const files = await fs24.readdir(dir);
+    const files = await fs26.readdir(dir);
     for (const f of files) {
       if (!f.startsWith("workbench-") || !f.endsWith(".md")) continue;
-      const full = path42.join(dir, f);
-      const stat = await fs24.stat(full);
+      const full = path44.join(dir, f);
+      const stat = await fs26.stat(full);
       if (stat.mtimeMs > latestMtime) {
         latestMtime = stat.mtimeMs;
         latest = full;
@@ -53403,14 +53918,14 @@ async function handleKrakenWorkbench(ctx) {
     appendSystem(ctx.setMessages, "[kraken workbench] no workbench file found (.zelari/radio/workbench-*.md)");
     return;
   }
-  const content = await fs24.readFile(latest, "utf8");
+  const content = await fs26.readFile(latest, "utf8");
   const parsed = parseWorkbench(content);
   const rendered = formatWorkbenchForTerminal(parsed);
   if (!rendered.trim()) {
-    appendSystem(ctx.setMessages, `[kraken workbench] ${path42.basename(latest)}: (no nodes / no events yet)`);
+    appendSystem(ctx.setMessages, `[kraken workbench] ${path44.basename(latest)}: (no nodes / no events yet)`);
     return;
   }
-  appendSystem(ctx.setMessages, `[kraken workbench] ${path42.basename(latest)}:
+  appendSystem(ctx.setMessages, `[kraken workbench] ${path44.basename(latest)}:
 ${rendered}`);
 }
 
@@ -53564,8 +54079,8 @@ init_registry3();
 // src/cli/plugins/installer.ts
 init_cmdline();
 init_updater();
-import { spawn as spawn12 } from "node:child_process";
-async function installPlugin(spec, cwd, executor = spawn12) {
+import { spawn as spawn14 } from "node:child_process";
+async function installPlugin(spec, cwd, executor = spawn14) {
   const scopeFlag = spec.installScope === "global" ? "-g" : "-D";
   const args = ["install", scopeFlag, spec.npmPackage];
   let result = await runNpm2(executor, args, cwd, "shim");
@@ -53715,17 +54230,17 @@ ${result.output.split("\n").slice(-8).join("\n")}` : "";
 
 // src/cli/slashHandlers/promoteMember.ts
 init_messageHelpers();
-import { promises as fs25 } from "node:fs";
-import path45 from "node:path";
-import os11 from "node:os";
+import { promises as fs27 } from "node:fs";
+import path47 from "node:path";
+import os12 from "node:os";
 async function handlePromoteMember(ctx, memberId) {
   try {
     const { promoteMember: promoteMember2 } = await Promise.resolve().then(() => (init_council(), council_exports));
     const { skill, markdown } = promoteMember2(memberId);
-    const skillDir = process.env.ANATHEMA_SKILL_DIR ?? path45.join(os11.homedir(), ".tmp", "zelari-code", "skills");
-    await fs25.mkdir(skillDir, { recursive: true });
-    const filePath = path45.join(skillDir, `${skill.id}.md`);
-    await fs25.writeFile(filePath, markdown, "utf8");
+    const skillDir = process.env.ANATHEMA_SKILL_DIR ?? path47.join(os12.homedir(), ".tmp", "zelari-code", "skills");
+    await fs27.mkdir(skillDir, { recursive: true });
+    const filePath = path47.join(skillDir, `${skill.id}.md`);
+    await fs27.writeFile(filePath, markdown, "utf8");
     appendSystem(
       ctx.setMessages,
       `[promote-member] ${skill.name} (${memberId}) \u2192 ${filePath}
@@ -53741,29 +54256,29 @@ async function handlePromoteMember(ctx, memberId) {
 }
 
 // src/cli/branchManager.ts
-import { promises as fs26, existsSync as existsSync42, readFileSync as readFileSync35, writeFileSync as writeFileSync23, mkdirSync as mkdirSync19, statSync as statSync6, rmSync as rmSync3 } from "node:fs";
-import path46 from "node:path";
-import os12 from "node:os";
+import { promises as fs28, existsSync as existsSync43, readFileSync as readFileSync35, writeFileSync as writeFileSync23, mkdirSync as mkdirSync19, statSync as statSync6, rmSync as rmSync3 } from "node:fs";
+import path48 from "node:path";
+import os13 from "node:os";
 var META_FILENAME = "meta.json";
 var SESSIONS_SUBDIR = "sessions";
 function getBranchesBaseDir() {
-  return process.env.ANATHEMA_BRANCHES_DIR ?? path46.join(os12.homedir(), ".tmp", "zelari-code", "branches");
+  return process.env.ANATHEMA_BRANCHES_DIR ?? path48.join(os13.homedir(), ".tmp", "zelari-code", "branches");
 }
 function getSessionsBaseDir() {
-  return process.env.ANATHEMA_SESSIONS_DIR ?? path46.join(os12.homedir(), ".tmp", "zelari-code", "sessions");
+  return process.env.ANATHEMA_SESSIONS_DIR ?? path48.join(os13.homedir(), ".tmp", "zelari-code", "sessions");
 }
 function branchPathFor(name, baseDir) {
-  return path46.join(baseDir, name);
+  return path48.join(baseDir, name);
 }
 function metaPathFor(name, baseDir) {
-  return path46.join(baseDir, name, META_FILENAME);
+  return path48.join(baseDir, name, META_FILENAME);
 }
 function sessionsPathFor(name, baseDir) {
-  return path46.join(baseDir, name, SESSIONS_SUBDIR);
+  return path48.join(baseDir, name, SESSIONS_SUBDIR);
 }
 function readBranchMeta(name, baseDir) {
   const metaPath = metaPathFor(name, baseDir);
-  if (!existsSync42(metaPath)) {
+  if (!existsSync43(metaPath)) {
     throw new BranchNotFoundError(`Branch "${name}" not found`);
   }
   try {
@@ -53784,13 +54299,13 @@ function readBranchMeta(name, baseDir) {
 }
 function writeBranchMeta(name, baseDir, meta3) {
   const metaPath = metaPathFor(name, baseDir);
-  mkdirSync19(path46.dirname(metaPath), { recursive: true });
+  mkdirSync19(path48.dirname(metaPath), { recursive: true });
   writeFileSync23(metaPath, JSON.stringify(meta3, null, 2), "utf-8");
 }
 async function countSessions(name, baseDir) {
   const sessionsPath = sessionsPathFor(name, baseDir);
   try {
-    const entries = await fs26.readdir(sessionsPath);
+    const entries = await fs28.readdir(sessionsPath);
     return entries.filter((e) => e.endsWith(".jsonl")).length;
   } catch (err) {
     if (err.code === "ENOENT") return 0;
@@ -53823,7 +54338,7 @@ var SessionNotFoundError = class extends Error {
 };
 function branchExists(name, baseDir = getBranchesBaseDir()) {
   const bp = branchPathFor(name, baseDir);
-  return existsSync42(bp) && existsSync42(metaPathFor(name, baseDir));
+  return existsSync43(bp) && existsSync43(metaPathFor(name, baseDir));
 }
 async function createBranch(name, fromSessionId, baseDir = getBranchesBaseDir(), sessionsBaseDir = getSessionsBaseDir()) {
   if (!name || name.trim().length === 0) {
@@ -53835,15 +54350,15 @@ async function createBranch(name, fromSessionId, baseDir = getBranchesBaseDir(),
   if (branchExists(name, baseDir)) {
     throw new BranchAlreadyExistsError(name);
   }
-  const sourcePath = path46.join(sessionsBaseDir, `${fromSessionId}.jsonl`);
-  if (!existsSync42(sourcePath)) {
+  const sourcePath = path48.join(sessionsBaseDir, `${fromSessionId}.jsonl`);
+  if (!existsSync43(sourcePath)) {
     throw new SessionNotFoundError(`Source session "${fromSessionId}" not found at ${sourcePath}`);
   }
   const branchPath = branchPathFor(name, baseDir);
   const branchSessionsPath = sessionsPathFor(name, baseDir);
   mkdirSync19(branchSessionsPath, { recursive: true });
-  const destPath = path46.join(branchSessionsPath, `${fromSessionId}.jsonl`);
-  await fs26.copyFile(sourcePath, destPath);
+  const destPath = path48.join(branchSessionsPath, `${fromSessionId}.jsonl`);
+  await fs28.copyFile(sourcePath, destPath);
   const meta3 = {
     name,
     createdAt: Date.now(),
@@ -53861,7 +54376,7 @@ async function createBranch(name, fromSessionId, baseDir = getBranchesBaseDir(),
 async function listBranches(baseDir = getBranchesBaseDir()) {
   let entries;
   try {
-    entries = await fs26.readdir(baseDir);
+    entries = await fs28.readdir(baseDir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -53869,7 +54384,7 @@ async function listBranches(baseDir = getBranchesBaseDir()) {
   const results = [];
   for (const entry of entries) {
     const metaPath = metaPathFor(entry, baseDir);
-    if (!existsSync42(metaPath)) continue;
+    if (!existsSync43(metaPath)) continue;
     try {
       const meta3 = readBranchMeta(entry, baseDir);
       const sessionCount = await countSessions(entry, baseDir);
@@ -53944,26 +54459,26 @@ async function handleBranchCheckout(ctx, branchName) {
 
 // src/cli/slashHandlers/workspace.ts
 init_messageHelpers();
-import { promises as fs27 } from "node:fs";
-import path47 from "node:path";
+import { promises as fs29 } from "node:fs";
+import path49 from "node:path";
 async function handleWorkspaceShow(ctx, what) {
   try {
-    const zelari = path47.join(process.cwd(), ".zelari");
+    const zelari = path49.join(process.cwd(), ".zelari");
     let content;
     switch (what) {
       case "plan": {
-        const planPath = path47.join(zelari, "plan.md");
+        const planPath = path49.join(zelari, "plan.md");
         try {
-          content = await fs27.readFile(planPath, "utf-8");
+          content = await fs29.readFile(planPath, "utf-8");
         } catch {
           content = "(no plan.md yet \u2014 run a council session first)";
         }
         break;
       }
       case "decisions": {
-        const decisionsDir = path47.join(zelari, "decisions");
+        const decisionsDir = path49.join(zelari, "decisions");
         try {
-          const files = (await fs27.readdir(decisionsDir)).filter((f) => f.endsWith(".md")).sort();
+          const files = (await fs29.readdir(decisionsDir)).filter((f) => f.endsWith(".md")).sort();
           if (files.length === 0) {
             content = "(no ADRs yet \u2014 invoke /council to generate some)";
           } else {
@@ -53971,7 +54486,7 @@ async function handleWorkspaceShow(ctx, what) {
 `];
             const { parseFrontmatter: parseFrontmatter2 } = await Promise.resolve().then(() => (init_storage(), storage_exports));
             for (const f of files) {
-              const raw = await fs27.readFile(path47.join(decisionsDir, f), "utf-8");
+              const raw = await fs29.readFile(path49.join(decisionsDir, f), "utf-8");
               const { meta: meta3, body } = parseFrontmatter2(raw);
               const title = meta3.title ?? body.split("\n")[0]?.replace(/^#\s*/, "").trim() ?? f;
               lines.push(`- **${f.replace(/\.md$/, "")}** [${meta3.status ?? "unknown"}] ${title}`);
@@ -53984,27 +54499,27 @@ async function handleWorkspaceShow(ctx, what) {
         break;
       }
       case "risks": {
-        const risksPath = path47.join(zelari, "risks.md");
+        const risksPath = path49.join(zelari, "risks.md");
         try {
-          content = await fs27.readFile(risksPath, "utf-8");
+          content = await fs29.readFile(risksPath, "utf-8");
         } catch {
           content = "(no risks.md yet)";
         }
         break;
       }
       case "agents": {
-        const agentsPath = path47.join(process.cwd(), "AGENTS.MD");
+        const agentsPath = path49.join(process.cwd(), "AGENTS.MD");
         try {
-          content = await fs27.readFile(agentsPath, "utf-8");
+          content = await fs29.readFile(agentsPath, "utf-8");
         } catch {
           content = "(no AGENTS.MD yet at project root \u2014 run `/workspace sync` after a council session)";
         }
         break;
       }
       case "docs": {
-        const docsDir = path47.join(zelari, "docs");
+        const docsDir = path49.join(zelari, "docs");
         try {
-          const files = (await fs27.readdir(docsDir)).filter((f) => f.endsWith(".md")).sort();
+          const files = (await fs29.readdir(docsDir)).filter((f) => f.endsWith(".md")).sort();
           content = files.length ? `# Docs (${files.length})
 
 ` + files.map((f) => `- ${f}`).join("\n") : "(no docs drafts yet)";
@@ -54044,8 +54559,8 @@ async function handleWorkspaceReset(ctx, force) {
     return;
   }
   try {
-    const target = path47.join(process.cwd(), ".zelari");
-    await fs27.rm(target, { recursive: true, force: true });
+    const target = path49.join(process.cwd(), ".zelari");
+    await fs29.rm(target, { recursive: true, force: true });
     appendSystem(ctx.setMessages, "[workspace] .zelari/ removed");
   } catch (err) {
     appendSystem(ctx.setMessages, `[workspace reset error] ${err instanceof Error ? err.message : String(err)}`);
@@ -54056,16 +54571,16 @@ async function handleWorkspaceReset(ctx, force) {
 init_provider2();
 
 // src/cli/slashHandlers/skills.ts
-import path48 from "node:path";
-import os13 from "node:os";
+import path50 from "node:path";
+import os14 from "node:os";
 
 // src/cli/skillHistory.ts
-import { promises as fs28, existsSync as existsSync43, statSync as statSync7, renameSync as renameSync5, appendFileSync as appendFileSync4, mkdirSync as mkdirSync20 } from "node:fs";
+import { promises as fs30, existsSync as existsSync44, statSync as statSync7, renameSync as renameSync5, appendFileSync as appendFileSync4, mkdirSync as mkdirSync20 } from "node:fs";
 var SKILL_HISTORY_ROTATE_BYTES = 10 * 1024 * 1024;
 async function readSkillHistory(file2) {
   let raw = "";
   try {
-    raw = await fs28.readFile(file2, "utf-8");
+    raw = await fs30.readFile(file2, "utf-8");
   } catch {
     return [];
   }
@@ -54185,7 +54700,7 @@ function handleSkillPicker(ctx, skills, openPicker, fallbackMessage) {
   });
 }
 async function handleSkillStats(ctx, skillId) {
-  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path48.join(os13.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path50.join(os14.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
   try {
     const records = await readSkillHistory(historyFile);
     const stats = getSkillStats(records, skillId);
@@ -54201,7 +54716,7 @@ async function handleSkillCompare(ctx, ids, fallbackMessage) {
     appendSystem(ctx.setMessages, fallbackMessage ?? "[skill-compare] missing args");
     return;
   }
-  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path48.join(os13.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+  const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path50.join(os14.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
   try {
     const formatted = await compareSkillsFromFile(ids[0], ids[1], historyFile);
     appendSystem(ctx.setMessages, formatted);
@@ -55388,9 +55903,9 @@ function ContinueKey({ onContinue }) {
 init_providerConfig();
 
 // src/cli/wizard/firstRun.ts
-import { existsSync as existsSync45 } from "node:fs";
+import { existsSync as existsSync46 } from "node:fs";
 function shouldRunWizard(input) {
-  const exists = input.exists ?? existsSync45;
+  const exists = input.exists ?? existsSync46;
   if (input.hasResetConfigFlag) {
     return { shouldRun: true, reason: "--reset-config flag forced wizard" };
   }
@@ -55711,6 +56226,16 @@ function parseHeadlessFlags(argv) {
     } else if (arg === "--task") {
       task = argv[i + 1];
       i++;
+    } else if (arg === "--task-file") {
+      const next = argv[i + 1];
+      if (next) {
+        try {
+          const fromFile = readFileSync37(next, "utf-8");
+          if (fromFile.trim()) task = fromFile;
+        } catch {
+        }
+      }
+      i++;
     } else if (arg === "--council") {
       councilFlag = true;
     } else if (arg === "--mode") {
@@ -55805,6 +56330,16 @@ function parseHeadlessFlags(argv) {
     } else if (arg === "--kraken-graph") {
       krakenGraph = argv[i + 1];
       i++;
+    } else if (arg === "--kraken-graph-file") {
+      const next = argv[i + 1];
+      if (next) {
+        try {
+          const fromFile = readFileSync37(next, "utf-8");
+          if (fromFile.trim()) krakenGraph = fromFile;
+        } catch {
+        }
+      }
+      i++;
     } else if (arg === "--plan-only") {
       planOnly = true;
     } else if (arg === "--run-plan") {
@@ -55913,8 +56448,8 @@ function createStreamScrubber2() {
 // src/cli/runHeadless.ts
 init_taskTool();
 init_sessionTodos();
-import { promises as fs30 } from "node:fs";
-import path50 from "node:path";
+import { promises as fs32 } from "node:fs";
+import path52 from "node:path";
 import { randomUUID as randomUUID6 } from "node:crypto";
 async function runHeadless(opts) {
   resetTaskSpawnCount();
@@ -56066,11 +56601,11 @@ async function runHeadlessKrakenGraph(opts, provider, model) {
   try {
     let preflightGraph;
     if (opts.runPlan && opts.runPlan.trim() !== "") {
-      const planPath = path50.join(cwd, ".zelari", "radio", `plan-${opts.runPlan}.json`);
+      const planPath = path52.join(cwd, ".zelari", "radio", `plan-${opts.runPlan}.json`);
       log(`loading pre-flight plan: ${planPath}`);
       let raw;
       try {
-        raw = await fs30.readFile(planPath, "utf8");
+        raw = await fs32.readFile(planPath, "utf8");
       } catch (e) {
         log(`plan file not found: ${planPath} (${e.message})`);
         return 1;
@@ -56106,10 +56641,10 @@ async function runHeadlessKrakenGraph(opts, provider, model) {
     log(formatKrakenGraphAscii2(graph));
     if (opts.planOnly) {
       const planId = randomUUID6();
-      const planDir = path50.join(cwd, ".zelari", "radio");
-      const planPath = path50.join(planDir, `plan-${planId}.json`);
-      await fs30.mkdir(planDir, { recursive: true });
-      await fs30.writeFile(
+      const planDir = path52.join(cwd, ".zelari", "radio");
+      const planPath = path52.join(planDir, `plan-${planId}.json`);
+      await fs32.mkdir(planDir, { recursive: true });
+      await fs32.writeFile(
         planPath,
         JSON.stringify(
           { id: graph.id, nodes: [...graph.nodes.values()] },
@@ -57214,8 +57749,8 @@ function normalizeDraft(raw, sourceUrl, provider, model) {
   let name = String(o.name ?? "").trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
   if (!name || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
     try {
-      const path53 = new URL(sourceUrl).pathname.split("/").filter(Boolean).pop()?.replace(/\.[a-z0-9]+$/i, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
-      name = path53 && /^[a-z0-9]/.test(path53) ? path53 : "imported-skill";
+      const path55 = new URL(sourceUrl).pathname.split("/").filter(Boolean).pop()?.replace(/\.[a-z0-9]+$/i, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+      name = path55 && /^[a-z0-9]/.test(path55) ? path55 : "imported-skill";
     } catch {
       name = "imported-skill";
     }