zelari-code 2.31.0 → 2.33.0

package/dist/cli/main.bundled.js

@@ -27111,6 +27111,19 @@ var init_contractCompiler = __esm({
 });
 
 // src/cli/kraken/verificationBridge.ts
+var verificationBridge_exports = {};
+__export(verificationBridge_exports, {
+  STRICT_DONE_EXIT_CODE: () => STRICT_DONE_EXIT_CODE,
+  anchorSelectionEvidence: () => anchorSelectionEvidence,
+  evaluateStrictBuildGate: () => evaluateStrictBuildGate,
+  evaluateStrictBuildGateFromSession: () => evaluateStrictBuildGateFromSession,
+  krakenResultsToContract: () => krakenResultsToContract,
+  matchNoteToToolTrace: () => matchNoteToToolTrace,
+  strictDoneEnabled: () => strictDoneEnabled,
+  strictEnvOverlay: () => strictEnvOverlay,
+  strictGateEventPayload: () => strictGateEventPayload,
+  strictGateExitCode: () => strictGateExitCode
+});
 import { createHash as createHash9 } from "node:crypto";
 function strictDoneEnabled(surface = "kraken", env = process.env) {
   if (surface === "mission") {
@@ -27392,6 +27405,20 @@ function strictGateEventPayload(evaluation) {
     summary: evaluation.summary
   };
 }
+function evaluateStrictBuildGateFromSession(mode, snapshot) {
+  const gate = evaluateKrakenCompletionGate(mode);
+  const evaluation = snapshot ? snapshotToCompletionEvaluation(snapshot) : null;
+  const blocked = evaluation ? evaluation.verdict !== "PASS" : false;
+  return {
+    gate,
+    strict: evaluation !== null,
+    evaluation,
+    native: null,
+    // session replay carries the payload, not in-process results
+    blocked,
+    summary: evaluation ? blocked ? `blocked (strict ${evaluation.verdict} from session log seq=${snapshot?.seq}): ${evaluation.summary}` : `open (strict PASS from session log seq=${snapshot?.seq}): ${evaluation.summary}` : "open (no strict verification record in session log)"
+  };
+}
 var STRICT_DONE_EXIT_CODE;
 var init_verificationBridge = __esm({
   "src/cli/kraken/verificationBridge.ts"() {
@@ -27405,6 +27432,461 @@ var init_verificationBridge = __esm({
   }
 });
 
+// src/cli/kraken/verifyStatus.ts
+var verifyStatus_exports = {};
+__export(verifyStatus_exports, {
+  formatStrictBlockExplanation: () => formatStrictBlockExplanation,
+  formatVerifyChip: () => formatVerifyChip,
+  getVerifyChip: () => getVerifyChip,
+  permissionsChip: () => permissionsChip,
+  recordStrictGateEvaluation: () => recordStrictGateEvaluation,
+  verifyStateFromGate: () => verifyStateFromGate
+});
+function verifyStateFromGate(evaluation) {
+  if (!evaluation.blocked) return "pass";
+  const verdict = evaluation.evaluation?.verdict;
+  if (verdict === "BLOCKED") return "blocked";
+  return "repair";
+}
+function formatVerifyChip(state3) {
+  if (state3 === "pass") return { label: "prova: PASS", tone: "green" };
+  if (state3 === "blocked") return { label: "prova: BLOCCATO", tone: "red" };
+  return { label: "prova: RIPARA", tone: "yellow" };
+}
+function permissionsChip(phase2, strictOn = strictDoneEnabled()) {
+  if (phase2 === "plan") return { label: "scrive: no (piano)", tone: "yellow" };
+  return strictOn ? { label: "scrive: s\xEC \xB7 prova obbligatoria", tone: "green" } : { label: "scrive: s\xEC \xB7 senza prova (dichiarato)", tone: "yellow" };
+}
+function formatStrictBlockExplanation(evaluation) {
+  const state3 = verifyStateFromGate(evaluation);
+  const gate = evaluation.gate;
+  if (state3 === "pass") {
+    return `[verifica] PASS \u2014 ${gate.passed}/${gate.total} prove superate.`;
+  }
+  const word = state3 === "blocked" ? "BLOCCATO" : "RIPARA";
+  const lines = [
+    `[verifica] ${word} \u2014 ${gate.passed}/${gate.total} prove superate; il turno non pu\xF2 dichiararsi finito senza prova.`
+  ];
+  const evalr = evaluation.evaluation ?? null;
+  if (evalr) {
+    const byId = /* @__PURE__ */ new Map();
+    for (const c of evalr.criteria ?? []) byId.set(c.id, c.text);
+    const unsatisfied = (evalr.results ?? []).filter((r) => r.status !== "pass");
+    if (unsatisfied.length > 0) {
+      lines.push("Mancano:");
+      for (const r of unsatisfied.slice(0, 8)) {
+        lines.push(`  \u2022 ${byId.get(r.criterionId) ?? r.criterionId} [${r.status}]`);
+      }
+      if (unsatisfied.length > 8) {
+        lines.push(`  \u2022 \u2026 e altri ${unsatisfied.length - 8}`);
+      }
+      const first = byId.get(unsatisfied[0].criterionId) ?? unsatisfied[0].criterionId;
+      lines.push(
+        state3 === "blocked" ? `Prossimo comando: /verify \u2014 poi porta evidenza per \xAB${first}\xBB e riprova.` : `Prossimo comando: ripara \xAB${first}\xBB, poi /verify per ricontrollare.`
+      );
+    }
+  }
+  lines.push(
+    "La prova \xE8 obbligatoria: chiudo il turno solo quando ogni criterio richiesto ha evidenza."
+  );
+  return lines.join("\n");
+}
+function recordStrictGateEvaluation(evaluation) {
+  const g = globalThis;
+  g.__zelariVerifyState = {
+    state: verifyStateFromGate(evaluation),
+    at: Date.now(),
+    passed: evaluation.gate.passed,
+    total: evaluation.gate.total
+  };
+}
+function getVerifyChip() {
+  const g = globalThis;
+  const s = g.__zelariVerifyState;
+  if (!s) return null;
+  return formatVerifyChip(s.state);
+}
+var init_verifyStatus = __esm({
+  "src/cli/kraken/verifyStatus.ts"() {
+    "use strict";
+    init_verificationBridge();
+  }
+});
+
+// src/cli/safety/policyLoadMode.ts
+var policyLoadMode_exports = {};
+__export(policyLoadMode_exports, {
+  POLICY_LOAD_BLOCK_REASON: () => POLICY_LOAD_BLOCK_REASON,
+  POLICY_LOAD_EXIT_CODE: () => POLICY_LOAD_EXIT_CODE,
+  POLICY_LOAD_MODE_ENV: () => POLICY_LOAD_MODE_ENV,
+  activePolicyLoadMode: () => activePolicyLoadMode,
+  activePolicyLoadSurface: () => activePolicyLoadSurface,
+  resolvePolicyLoadMode: () => resolvePolicyLoadMode,
+  setActivePolicyLoadSurface: () => setActivePolicyLoadSurface
+});
+function isTruthyFlag(v) {
+  const n = v?.trim().toLowerCase();
+  return n === "1" || n === "true" || n === "yes" || n === "on";
+}
+function resolvePolicyLoadMode(input) {
+  const v = input.override?.trim().toLowerCase();
+  if (v === "strict") return "strict";
+  if (v === "permissive") return "permissive";
+  if (input.surface === "headless" || input.surface === "mission") return "strict";
+  if (isTruthyFlag(input.ci)) return "strict";
+  return "permissive";
+}
+function setActivePolicyLoadSurface(surface) {
+  activeSurface = surface;
+}
+function activePolicyLoadSurface() {
+  return activeSurface;
+}
+function activePolicyLoadMode(env = process.env) {
+  return resolvePolicyLoadMode({
+    surface: activeSurface,
+    override: env[POLICY_LOAD_MODE_ENV],
+    ci: typeof env.CI === "string" ? env.CI : void 0
+  });
+}
+var POLICY_LOAD_MODE_ENV, POLICY_LOAD_BLOCK_REASON, POLICY_LOAD_EXIT_CODE, activeSurface;
+var init_policyLoadMode = __esm({
+  "src/cli/safety/policyLoadMode.ts"() {
+    "use strict";
+    POLICY_LOAD_MODE_ENV = "ZELARI_POLICY_LOAD_MODE";
+    POLICY_LOAD_BLOCK_REASON = "policy-load-failed";
+    POLICY_LOAD_EXIT_CODE = 2;
+    activeSurface = "tui";
+  }
+});
+
+// src/cli/safety/jails/darwin.ts
+import { existsSync as existsSync7 } from "node:fs";
+function sbplQuote(p3) {
+  return `"${p3.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function buildSeatbeltProfile(spec) {
+  const lines = [
+    "(version 1)",
+    `; zelari osJail (t28) \u2014 generated from JailSpec root=${spec.root}`,
+    "(allow default)",
+    "(deny file-write*)",
+    "(allow file-write*"
+  ];
+  for (const dir of spec.writable) {
+    lines.push(`  (subpath ${sbplQuote(dir)})`);
+  }
+  lines.push(")");
+  switch (spec.network.mode) {
+    case "deny":
+      lines.push("(deny network*)");
+      break;
+    case "allow":
+      lines.push("(allow network*)");
+      break;
+    case "allow-list":
+      lines.push(
+        `; allow-list hosts (${spec.network.hosts.join(", ")}) NOT kernel-filtered \u2014 degraded to allow`,
+        "(allow network*)"
+      );
+      break;
+  }
+  return lines.join("\n");
+}
+function darwinProbe(platform, exists) {
+  if (platform !== "darwin") {
+    return {
+      backend: "seatbelt",
+      available: false,
+      reason: `platform ${platform} is not darwin`
+    };
+  }
+  if (!exists(SANDBOX_EXEC_PATH)) {
+    return {
+      backend: "seatbelt",
+      available: false,
+      reason: `${SANDBOX_EXEC_PATH} not found`
+    };
+  }
+  return {
+    backend: "seatbelt",
+    available: true,
+    reason: `sandbox-exec available at ${SANDBOX_EXEC_PATH}`
+  };
+}
+var SANDBOX_EXEC_PATH, darwinBackend;
+var init_darwin = __esm({
+  "src/cli/safety/jails/darwin.ts"() {
+    "use strict";
+    SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+    darwinBackend = {
+      id: "seatbelt",
+      probe: () => darwinProbe(process.platform, (p3) => existsSync7(p3)),
+      wrap: (spec, program, argv) => ({
+        program: SANDBOX_EXEC_PATH,
+        argv: ["-p", buildSeatbeltProfile(spec), program, ...argv]
+      })
+    };
+  }
+});
+
+// src/cli/safety/jails/linux.ts
+import { existsSync as existsSync8 } from "node:fs";
+function findBinaryOnPath(bin, pathValue, exists) {
+  for (const dir of pathValue.split(/[:;]/)) {
+    if (!dir) continue;
+    const full = `${dir}/${bin}`;
+    if (exists(full)) return full;
+  }
+  return null;
+}
+function linuxProbe(platform, pathValue, exists) {
+  if (platform !== "linux") {
+    return { backend: "bwrap", available: false, reason: `platform ${platform} is not linux` };
+  }
+  const found = findBinaryOnPath(BWRAP_BIN, pathValue, exists);
+  if (!found) {
+    return {
+      backend: "bwrap",
+      available: false,
+      reason: `${BWRAP_BIN} not found on PATH (landlock needs native syscalls Node does not expose)`
+    };
+  }
+  return { backend: "bwrap", available: true, reason: `${BWRAP_BIN} found at ${found}` };
+}
+function buildBwrapArgs(spec, program, argv) {
+  const args = ["--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc"];
+  for (const dir of spec.writable) {
+    args.push("--bind-try", dir, dir);
+  }
+  if (spec.network.mode === "deny") {
+    args.push("--unshare-net");
+  }
+  args.push("--", program, ...argv);
+  return args;
+}
+var BWRAP_BIN, linuxBackend;
+var init_linux = __esm({
+  "src/cli/safety/jails/linux.ts"() {
+    "use strict";
+    BWRAP_BIN = "bwrap";
+    linuxBackend = {
+      id: "bwrap",
+      probe: () => linuxProbe(process.platform, process.env.PATH ?? "", (p3) => existsSync8(p3)),
+      wrap: (spec, program, argv) => ({
+        program: BWRAP_BIN,
+        argv: buildBwrapArgs(spec, program, argv)
+      })
+    };
+  }
+});
+
+// src/cli/safety/jails/win32.ts
+function win32Probe(platform) {
+  if (platform !== "win32") {
+    return { backend: "win32-restricted-token", available: false, reason: `platform ${platform} is not win32` };
+  }
+  return { backend: "win32-restricted-token", available: false, reason: WIN32_UNAVAILABLE_REASON };
+}
+var WIN32_UNAVAILABLE_REASON, win32Backend;
+var init_win32 = __esm({
+  "src/cli/safety/jails/win32.ts"() {
+    "use strict";
+    WIN32_UNAVAILABLE_REASON = "restricted-token + Job Object require native Windows APIs that pure Node does not expose (no native npm deps allowed, P5) \u2014 honest unavailable; see src/cli/safety/jails/win32.ts";
+    win32Backend = {
+      id: "win32-restricted-token",
+      probe: () => win32Probe(process.platform),
+      wrap: () => {
+        throw new Error(`win32 jail backend unavailable: ${WIN32_UNAVAILABLE_REASON}`);
+      }
+    };
+  }
+});
+
+// src/cli/safety/osJail.ts
+import { spawn as spawn4 } from "node:child_process";
+import { homedir as homedir4, tmpdir } from "node:os";
+import path27 from "node:path";
+function resolveJailMode(override, env = process.env) {
+  const v = override?.trim().toLowerCase();
+  if (v === "off") return "off";
+  if (v === "advisory") return "advisory";
+  if (v === "required") return "required";
+  const strictIntent = activePolicyLoadMode(env) === "strict" || (env.ZELARI_PERMISSION_PRESET ?? "").trim().toLowerCase() === "strict";
+  if (!strictIntent) return "advisory";
+  return probeJailBackend().available ? "required" : "advisory";
+}
+function activeJailMode(env = process.env) {
+  return resolveJailMode(env[OS_JAIL_ENV], env);
+}
+function platformBackend(platform = process.platform) {
+  switch (platform) {
+    case "darwin":
+      return darwinBackend;
+    case "linux":
+      return linuxBackend;
+    default:
+      return win32Backend;
+  }
+}
+function currentBackend(platform = process.platform) {
+  return testBackend ?? platformBackend(platform);
+}
+function probeJailBackend(platform = process.platform) {
+  if (testBackend) return testBackend.probe();
+  if (!probeCache || probeCache.platform !== platform) {
+    probeCache = { platform, result: platformBackend(platform).probe() };
+  }
+  return probeCache.result;
+}
+function defaultEnvAllowlist(platform = process.platform) {
+  return platform === "win32" ? [...BASE_ENV_ALLOWLIST, ...WIN32_ENV_ALLOWLIST] : BASE_ENV_ALLOWLIST;
+}
+function defaultWritable(root, home = homedir4(), tmp = tmpdir(), platform = process.platform) {
+  const raw = [path27.resolve(root), path27.resolve(tmp), path27.join(home, ".zelari-code")];
+  const out = [];
+  for (const p3 of raw) {
+    const key = platform === "win32" ? p3.toLowerCase() : p3;
+    if (!out.some((q) => (platform === "win32" ? q.toLowerCase() : q) === key)) out.push(p3);
+  }
+  return out;
+}
+function buildJailSpec(opts) {
+  return {
+    root: path27.resolve(opts.root),
+    network: opts.network ?? { mode: "deny" },
+    envAllowlist: opts.envAllowlist ?? defaultEnvAllowlist(),
+    writable: opts.writable ?? defaultWritable(opts.root)
+  };
+}
+function networkSpecFromClaimHosts(allowedHosts) {
+  if (!allowedHosts || allowedHosts.length === 0) return { mode: "deny" };
+  return { mode: "allow-list", hosts: [...new Set(allowedHosts)] };
+}
+function sanitizeEnv(env, allowlist, platform = process.platform) {
+  const wanted = new Set(allowlist.map((k) => platform === "win32" ? k.toLowerCase() : k));
+  const out = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (v === void 0) continue;
+    const key = platform === "win32" ? k.toLowerCase() : k;
+    if (wanted.has(key)) out[k] = v;
+  }
+  return out;
+}
+function jailDenyReason(probe, mode) {
+  return `OS jail backend unavailable (${probe.backend}: ${probe.reason}) with ZELARI_OS_JAIL=${mode} \u2014 execution is DENIED instead of running unjailed (t28 golden rule: missing backend + required \u21D2 deny, never warn/skip). Set ZELARI_OS_JAIL=advisory (visible fail-open) or =off to explicitly allow unjailed execution.`;
+}
+function jailAdvisoryNotice(probe) {
+  return `advisory: OS jail backend unavailable (${probe.backend}: ${probe.reason}) \u2014 this process will run UNJAILED (visible fail-open). Set ZELARI_OS_JAIL=required to deny instead.`;
+}
+function decideJailSpawn(spec, input) {
+  const mode = input.mode ?? activeJailMode();
+  const merged = { ...input.env ?? process.env, ...input.envExtras ?? {} };
+  if (mode === "off") return { action: "spawn-plain", env: merged };
+  const probe = probeJailBackend();
+  if (!probe.available) {
+    if (mode === "required") return { action: "deny", reason: jailDenyReason(probe, mode) };
+    return { action: "spawn-plain", env: sanitizeEnv(merged, spec.envAllowlist), notice: jailAdvisoryNotice(probe) };
+  }
+  const wrapped = currentBackend().wrap(spec, input.program, input.argv);
+  return {
+    action: "spawn-jailed",
+    probe,
+    program: wrapped.program,
+    argv: wrapped.argv,
+    env: sanitizeEnv(merged, spec.envAllowlist)
+  };
+}
+function spawnJailed(spec, req) {
+  const decision = decideJailSpawn(spec, {
+    program: req.program,
+    argv: req.argv,
+    env: req.env,
+    envExtras: req.envExtras
+  });
+  if (decision.action === "deny") {
+    return { outcome: "denied", reason: `[jail] ${decision.reason}` };
+  }
+  const notice = decision.action === "spawn-plain" ? decision.notice : void 0;
+  if (notice) {
+    console.error(`[os-jail] ${notice}`);
+    req.onNotice?.(notice);
+  }
+  const jailed = decision.action === "spawn-jailed";
+  const program = jailed ? decision.program : req.program;
+  const argv = jailed ? decision.argv : [...req.argv];
+  try {
+    const child = spawn4(program, argv, {
+      cwd: req.cwd,
+      signal: req.signal,
+      shell: false,
+      env: decision.env,
+      stdio: ["ignore", "pipe", "pipe"]
+      // non-interactive by construction
+    });
+    return {
+      outcome: "spawned",
+      child,
+      backend: jailed ? decision.probe.backend : "none",
+      jailed,
+      ...notice ? { notice } : {}
+    };
+  } catch (err) {
+    return { outcome: "failed", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+function jailAvailability(env = process.env) {
+  const mode = activeJailMode(env);
+  const probe = mode === "off" ? { backend: "none", available: false, reason: "jail disabled (ZELARI_OS_JAIL=off)" } : probeJailBackend();
+  return { mode, probe };
+}
+var OS_JAIL_ENV, testBackend, probeCache, BASE_ENV_ALLOWLIST, WIN32_ENV_ALLOWLIST;
+var init_osJail = __esm({
+  "src/cli/safety/osJail.ts"() {
+    "use strict";
+    init_policyLoadMode();
+    init_darwin();
+    init_linux();
+    init_win32();
+    OS_JAIL_ENV = "ZELARI_OS_JAIL";
+    testBackend = null;
+    probeCache = null;
+    BASE_ENV_ALLOWLIST = [
+      "PATH",
+      "HOME",
+      "USER",
+      "LANG",
+      "CI",
+      "TERM",
+      "NO_COLOR"
+    ];
+    WIN32_ENV_ALLOWLIST = [
+      "PATH",
+      "Path",
+      "HOMEDRIVE",
+      "HOMEPATH",
+      "SystemRoot",
+      "SystemDrive",
+      "ComSpec",
+      "PATHEXT",
+      "TEMP",
+      "TMP",
+      "APPDATA",
+      "LOCALAPPDATA",
+      "USERPROFILE",
+      "USERNAME",
+      "MSYSTEM",
+      "PROGRAMFILES",
+      "ProgramFiles",
+      "ProgramData",
+      "OS",
+      "NUMBER_OF_PROCESSORS",
+      "PROCESSOR_ARCHITECTURE",
+      "WINDIR"
+    ];
+  }
+});
+
 // packages/core/dist/shared/events.js
 function isBrainAgentStartEvent(e) {
   return e.type === "agent_start";
@@ -29461,7 +29943,7 @@ var init_providerStream = __esm({
 
 // packages/core/dist/core/sessionJsonl.js
 import { promises as fs13 } from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 import os from "node:os";
 async function readSession(filePath) {
   try {
@@ -29487,7 +29969,7 @@ async function readSession(filePath) {
   }
 }
 function defaultBaseDir() {
-  return path27.join(os.tmpdir(), "zelari-code", "sessions");
+  return path28.join(os.tmpdir(), "zelari-code", "sessions");
 }
 var MAX_PENDING_EVENTS, MAX_PENDING_BYTES, DEFAULT_FLUSH_INTERVAL_MS, SessionJsonlWriter;
 var init_sessionJsonl = __esm({
@@ -29513,7 +29995,7 @@ var init_sessionJsonl = __esm({
       idleWaiters = [];
       constructor(sessionId2, options = {}) {
         const baseDir = options.baseDir ?? defaultBaseDir();
-        this.filePath = path27.join(baseDir, `${sessionId2}.jsonl`);
+        this.filePath = path28.join(baseDir, `${sessionId2}.jsonl`);
         this.onError = options.onError ?? console.error;
         this.flushIntervalMs = options.flushIntervalMs ?? DEFAULT_FLUSH_INTERVAL_MS;
       }
@@ -29524,7 +30006,7 @@ var init_sessionJsonl = __esm({
       /** Ensure the parent directory exists — once per writer lifetime. */
       ensureDir() {
         if (!this.dirEnsured) {
-          this.dirEnsured = fs13.mkdir(path27.dirname(this.filePath), { recursive: true }).then(() => void 0).catch((err) => {
+          this.dirEnsured = fs13.mkdir(path28.dirname(this.filePath), { recursive: true }).then(() => void 0).catch((err) => {
             this.dirEnsured = null;
             throw err;
           });
@@ -29686,9 +30168,9 @@ var init_types6 = __esm({
 });
 
 // packages/core/dist/core/hooks/lifecycleHookRunner.js
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { readdirSync as readdirSync2, readFileSync as readFileSync7 } from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 function parseJson(text) {
   try {
     return JSON.parse(text);
@@ -29768,14 +30250,14 @@ var init_lifecycleHookRunner = __esm({
         }
         let loaded = 0;
         for (const f of files) {
-          const full = path28.join(dir, f);
+          const full = path29.join(dir, f);
           try {
             const parsed = parseJson(readFileSync7(full, "utf8"));
             if (!parsed || !parsed.name || !parsed.match) {
               this.logger(`skipping invalid hook file ${full}`);
               continue;
             }
-            parsed.name = parsed.name || path28.basename(f, ".json");
+            parsed.name = parsed.name || path29.basename(f, ".json");
             this.hooks.push(parsed);
             loaded += 1;
           } catch (err) {
@@ -29897,7 +30379,7 @@ var init_lifecycleHookRunner = __esm({
             reject(new Error("empty hook command"));
             return;
           }
-          const child = spawn4(argv[0], argv.slice(1), {
+          const child = spawn5(argv[0], argv.slice(1), {
             shell: false,
             cwd,
             stdio: ["pipe", "pipe", "pipe"],
@@ -30726,7 +31208,7 @@ var init_parseCssMotion = __esm({
 });
 
 // packages/core/dist/council/verification/citeVerify.js
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
 import { join as join4 } from "node:path";
 function extractCitations(text) {
   const out = [];
@@ -30750,7 +31232,7 @@ function verifyCitations(projectRoot, synthesisText) {
   const results = [];
   for (const cite of extractCitations(synthesisText)) {
     const abs = join4(projectRoot, cite.file);
-    if (!existsSync7(abs)) {
+    if (!existsSync9(abs)) {
       results.push({
         id: "synthesis.cite-invalid",
         severity: "error",
@@ -31069,11 +31551,11 @@ var init_synthesisAudit = __esm({
 });
 
 // packages/core/dist/council/verification/runChecks.js
-import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join5 } from "node:path";
 function loadNfrSpec(zelariRoot) {
   const path99 = join5(zelariRoot, "nfr-spec.json");
-  if (!existsSync8(path99))
+  if (!existsSync10(path99))
     return null;
   try {
     const raw = JSON.parse(readFileSync9(path99, "utf8"));
@@ -31087,11 +31569,11 @@ function loadNfrSpec(zelariRoot) {
 function resolveTargets(projectRoot, spec) {
   const found = [];
   for (const rel2 of spec.targets) {
-    if (existsSync8(join5(projectRoot, rel2))) {
+    if (existsSync10(join5(projectRoot, rel2))) {
       found.push(rel2);
     }
   }
-  if (found.length === 0 && existsSync8(join5(projectRoot, "index.html"))) {
+  if (found.length === 0 && existsSync10(join5(projectRoot, "index.html"))) {
     return ["index.html"];
   }
   return found;
@@ -31147,7 +31629,7 @@ function checkDeadCssHooks(html, relFile) {
 }
 function checkPlanReality(projectRoot, zelariRoot, targets, keywords) {
   const planPath = join5(zelariRoot, "plan.json");
-  if (!existsSync8(planPath) || keywords.length === 0)
+  if (!existsSync10(planPath) || keywords.length === 0)
     return [];
   let plan;
   try {
@@ -31187,11 +31669,11 @@ function checkPlanReality(projectRoot, zelariRoot, targets, keywords) {
 }
 function checkReadmeStale(projectRoot, targets) {
   const readmePath = join5(projectRoot, "README.md");
-  if (!existsSync8(readmePath) || targets.length === 0)
+  if (!existsSync10(readmePath) || targets.length === 0)
     return [];
   const readme = readFileSync9(readmePath, "utf8");
   const htmlPath = join5(projectRoot, targets[0]);
-  if (!existsSync8(htmlPath))
+  if (!existsSync10(htmlPath))
     return [];
   const html = readFileSync9(htmlPath, "utf8");
   const sectionCount = (html.match(/<section\s+id=/gi) ?? []).length;
@@ -31317,7 +31799,7 @@ var init_runChecks = __esm({
 });
 
 // packages/core/dist/council/verification/microGate.js
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";
 import { join as join6 } from "node:path";
 function checkDeadHooksInHtml(html) {
   const warnings = [];
@@ -31347,7 +31829,7 @@ function checkDeadHooksInHtml(html) {
 }
 function runMicroVerificationOnFile(projectRoot, relPath, zelariRoot) {
   const abs = join6(projectRoot, relPath);
-  if (!existsSync9(abs) || !/\.html?$/i.test(relPath))
+  if (!existsSync11(abs) || !/\.html?$/i.test(relPath))
     return [];
   const spec = (zelariRoot ? loadNfrSpec(zelariRoot) : null) ?? DEFAULT_NFR_SPEC;
   const anim = spec.animation ?? { compositorOnly: true, forbidLayoutProps: true };
@@ -31791,7 +32273,7 @@ var init_inlineJsAutofix = __esm({
 });
 
 // packages/core/dist/agents/councilApi.js
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { join as join8 } from "node:path";
 function extractBalancedJsonObject(s) {
   const start = s.indexOf("{");
@@ -32419,7 +32901,7 @@ async function* runCouncilPure(userMessage, config2, callbacks = {}) {
         const zelariRoot = `${chairmanProjectRoot}/.zelari`;
         const spec = loadNfrSpec(zelariRoot) ?? DEFAULT_NFR_SPEC;
         for (const rel2 of spec.targets) {
-          if (!existsSync10(join8(chairmanProjectRoot, rel2)))
+          if (!existsSync12(join8(chairmanProjectRoot, rel2)))
             continue;
           changedTargetFiles.add(rel2);
           for (const w of runChairmanMicroGate({ projectRoot: chairmanProjectRoot, relPath: rel2, zelariRoot })) {
@@ -32439,7 +32921,7 @@ async function* runCouncilPure(userMessage, config2, callbacks = {}) {
         const zelariRootReplay = `${chairmanProjectRoot}/.zelari`;
         const specReplay = loadNfrSpec(zelariRootReplay) ?? DEFAULT_NFR_SPEC;
         for (const rel2 of specReplay.targets) {
-          if (!existsSync10(join8(chairmanProjectRoot, rel2)))
+          if (!existsSync12(join8(chairmanProjectRoot, rel2)))
             continue;
           changedTargetFiles.add(rel2);
           for (const w of runChairmanMicroGate({
@@ -37549,7 +38031,7 @@ var CORE_VERSION;
 var init_version = __esm({
   "packages/core/dist/version.js"() {
     "use strict";
-    CORE_VERSION = "2.31.0";
+    CORE_VERSION = "2.33.0";
   }
 });
 
@@ -38252,8 +38734,8 @@ var init_graphStatus = __esm({
 });
 
 // src/cli/sessionManager.ts
-import { promises as fs14, existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync11, mkdirSync as mkdirSync6, unlinkSync as unlinkSync2, statSync } from "node:fs";
-import path29 from "node:path";
+import { promises as fs14, existsSync as existsSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync11, mkdirSync as mkdirSync6, unlinkSync as unlinkSync2, statSync } from "node:fs";
+import path30 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function getSessionBaseDir() {
   return sessionsDir();
@@ -38266,7 +38748,7 @@ async function ensureSessionDir() {
 }
 function getCurrentSessionId() {
   const file2 = getCurrentSessionFile();
-  if (!existsSync11(file2)) return null;
+  if (!existsSync13(file2)) return null;
   try {
     const content = readFileSync15(file2, "utf-8").trim();
     return content.length > 0 ? content : null;
@@ -38276,7 +38758,7 @@ function getCurrentSessionId() {
 }
 function setCurrentSessionId(id3) {
   const file2 = getCurrentSessionFile();
-  mkdirSync6(path29.dirname(file2), { recursive: true });
+  mkdirSync6(path30.dirname(file2), { recursive: true });
   writeFileSync11(file2, id3, "utf-8");
 }
 function clearCurrentSessionId() {
@@ -38288,11 +38770,11 @@ function clearCurrentSessionId() {
   }
 }
 function getCurrentBranchFile() {
-  return process.env.ANATHEMA_CURRENT_BRANCH_FILE ?? path29.join(path29.dirname(getCurrentSessionFile()), "currentBranch.txt");
+  return process.env.ANATHEMA_CURRENT_BRANCH_FILE ?? path30.join(path30.dirname(getCurrentSessionFile()), "currentBranch.txt");
 }
 function getCurrentBranch() {
   const file2 = getCurrentBranchFile();
-  if (!existsSync11(file2)) return null;
+  if (!existsSync13(file2)) return null;
   try {
     const content = readFileSync15(file2, "utf-8").trim();
     return content.length > 0 ? content : null;
@@ -38302,7 +38784,7 @@ function getCurrentBranch() {
 }
 function setCurrentBranch(name) {
   const file2 = getCurrentBranchFile();
-  mkdirSync6(path29.dirname(file2), { recursive: true });
+  mkdirSync6(path30.dirname(file2), { recursive: true });
   writeFileSync11(file2, name, "utf-8");
 }
 function newSessionId() {
@@ -38321,7 +38803,7 @@ async function listSessions() {
   for (const entry of entries) {
     if (!entry.endsWith(".jsonl")) continue;
     const id3 = entry.replace(/\.jsonl$/, "");
-    const filePath = path29.join(baseDir, entry);
+    const filePath = path30.join(baseDir, entry);
     try {
       const events = await readSession(filePath);
       let firstTs = 0;
@@ -38368,7 +38850,7 @@ ${lines.join("\n")}`
   return { message: `[${kind2}] handled` };
 }
 async function loadSessionEvents(id3) {
-  const filePath = path29.join(getSessionBaseDir(), `${id3}.jsonl`);
+  const filePath = path30.join(getSessionBaseDir(), `${id3}.jsonl`);
   return readSession(filePath);
 }
 var init_sessionManager = __esm({
@@ -38701,16 +39183,16 @@ var init_budgetRuntime = __esm({
 });
 
 // src/cli/budget/restoreRuntime.ts
-import path30 from "node:path";
+import path31 from "node:path";
 async function restoreBudgetRuntimeFromSession(budget, sessionId2, baseDir) {
-  const eventsPath = path30.join(resolveSessionsDir({ baseDir }), sessionId2, "events.jsonl");
+  const eventsPath = path31.join(resolveSessionsDir({ baseDir }), sessionId2, "events.jsonl");
   const report = await readSessionLog(eventsPath).catch(() => null);
   if (!report || report.events.length === 0) return false;
   budget.adoptLedgerFromEvents(report.events);
   return true;
 }
 async function lastHarnessManifestHash(sessionId2, baseDir) {
-  const eventsPath = path30.join(resolveSessionsDir({ baseDir }), sessionId2, "events.jsonl");
+  const eventsPath = path31.join(resolveSessionsDir({ baseDir }), sessionId2, "events.jsonl");
   const report = await readSessionLog(eventsPath).catch(() => null);
   if (!report) return null;
   for (let i = report.events.length - 1; i >= 0; i--) {
@@ -38759,21 +39241,21 @@ __export(updater_exports, {
   resolveBundledNpmCli: () => resolveBundledNpmCli
 });
 import { createRequire } from "node:module";
-import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync12 } from "node:fs";
-import path31 from "node:path";
+import { spawn as spawn6 } from "node:child_process";
+import { existsSync as existsSync14 } from "node:fs";
+import path32 from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveBundledNpmCli(execPath = process.execPath) {
-  const dir = path31.dirname(execPath);
+  const dir = path32.dirname(execPath);
   const candidates = [
     // Windows: C:\...\node.exe → C:\...\node_modules\npm\bin\npm-cli.js
-    path31.join(dir, "node_modules", "npm", "bin", "npm-cli.js"),
+    path32.join(dir, "node_modules", "npm", "bin", "npm-cli.js"),
     // POSIX: <prefix>/bin/node → <prefix>/lib/node_modules/npm/bin/npm-cli.js
-    path31.join(dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+    path32.join(dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
   ];
   for (const candidate of candidates) {
     try {
-      if (existsSync12(candidate)) return candidate;
+      if (existsSync14(candidate)) return candidate;
     } catch {
     }
   }
@@ -38786,7 +39268,7 @@ function looksLikeBrokenShim(exitCode, output) {
 }
 function getCurrentVersion() {
   try {
-    const pkgPath = path31.resolve(__dirname2, "..", "..", "package.json");
+    const pkgPath = path32.resolve(__dirname2, "..", "..", "package.json");
     const pkg = require2(pkgPath);
     return pkg.version;
   } catch {
@@ -38856,7 +39338,7 @@ async function checkForUpdate(fetcher = fetch, registryUrl) {
     updateAvailable: cmp < 0
   };
 }
-async function performUpdate(packageName = "zelari-code", executor = spawn5, resolveNpmCli = resolveBundledNpmCli, channel) {
+async function performUpdate(packageName = "zelari-code", executor = spawn6, resolveNpmCli = resolveBundledNpmCli, channel) {
   const tag = channel ?? distTagForVersion(getCurrentVersion());
   const args = ["install", "-g", `${packageName}@${tag}`];
   const primary = await runNpm(executor, args, "shim");
@@ -38909,7 +39391,7 @@ var init_updater = __esm({
     "use strict";
     init_cmdline();
     require2 = createRequire(import.meta.url);
-    __dirname2 = path31.dirname(fileURLToPath(import.meta.url));
+    __dirname2 = path32.dirname(fileURLToPath(import.meta.url));
     REGISTRY_URL = "https://registry.npmjs.org/zelari-code/latest";
   }
 });
@@ -39068,7 +39550,7 @@ var init_spineFileEvents = __esm({
 });
 
 // src/cli/sessionSpine.ts
-import path32 from "node:path";
+import path33 from "node:path";
 function spineEnabled() {
   return process.env.ZELARI_SESSION_SPINE !== "0";
 }
@@ -39267,8 +39749,8 @@ var init_sessionSpine = __esm({
         const mirror = new _SessionSpineMirror(sessionId2, options);
         if (!spineEnabled()) return mirror;
         try {
-          const sessionDir = path32.join(mirror.sessionsDir, sessionId2);
-          const report = await readSessionLog(path32.join(sessionDir, "events.jsonl"));
+          const sessionDir = path33.join(mirror.sessionsDir, sessionId2);
+          const report = await readSessionLog(path33.join(sessionDir, "events.jsonl"));
           const existed = report.events.length > 0 || report.issues.length > 0;
           if (report.events.some((e) => e.kind === "task.contract" || e.kind === "user.message")) {
             mirror.contractSeeded = true;
@@ -39444,7 +39926,7 @@ var init_sessionSpine = __esm({
       async derivedPriorTurns() {
         if (this.status !== "active" && this.status !== "closed") return null;
         const report = await readSessionLog(
-          path32.join(this.sessionsDir, this.sessionId, "events.jsonl")
+          path33.join(this.sessionsDir, this.sessionId, "events.jsonl")
         ).catch(() => null);
         if (!report || report.events.length === 0) return null;
         return deriveMessages(report.events);
@@ -39454,7 +39936,7 @@ var init_sessionSpine = __esm({
         if (this.status !== "active" && this.status !== "closed") return null;
         await this.flush();
         const report = await readSessionLog(
-          path32.join(this.sessionsDir, this.sessionId, "events.jsonl")
+          path33.join(this.sessionsDir, this.sessionId, "events.jsonl")
         ).catch(() => null);
         if (!report || report.events.length === 0) return null;
         return buildCompactionStateSnapshot(report.events, toSeq);
@@ -39467,7 +39949,7 @@ var init_sessionSpine = __esm({
       async lastVerificationRun() {
         if (this.status !== "active" && this.status !== "closed") return null;
         const report = await readSessionLog(
-          path32.join(this.sessionsDir, this.sessionId, "events.jsonl")
+          path33.join(this.sessionsDir, this.sessionId, "events.jsonl")
         ).catch(() => null);
         if (!report) return null;
         return lastVerificationRun(report.events);
@@ -39602,7 +40084,7 @@ var init_sessionSpine = __esm({
         if (steerText) {
           seq = seq.then(async (s) => {
             try {
-              const eventsPath = path32.join(this.sessionsDir, this.sessionId, "events.jsonl");
+              const eventsPath = path33.join(this.sessionsDir, this.sessionId, "events.jsonl");
               const report = await readSessionLog(eventsPath).catch(() => null);
               if (!report || typeof s !== "number") return s;
               const current = latestTaskContract(report.events);
@@ -39849,10 +40331,10 @@ var init_sessionSurface = __esm({
 });
 
 // src/cli/hooks/observationStore.ts
-import { existsSync as existsSync13, statSync as statSync2 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync15, statSync as statSync2 } from "node:fs";
+import path34 from "node:path";
 function sessionFilePath(sessionId2, baseDir) {
-  return path33.join(baseDir ?? getSessionBaseDir(), `${sessionId2}.jsonl`);
+  return path34.join(baseDir ?? getSessionBaseDir(), `${sessionId2}.jsonl`);
 }
 function isToolEnd(e) {
   return e.type === "tool_execution_end";
@@ -39862,7 +40344,7 @@ function isToolStart(e) {
 }
 async function loadObservationIndex(sessionId2, baseDir) {
   const filePath = sessionFilePath(sessionId2, baseDir);
-  const exists = existsSync13(filePath);
+  const exists = existsSync15(filePath);
   let mtimeMs = 0;
   if (exists) {
     try {
@@ -39874,7 +40356,7 @@ async function loadObservationIndex(sessionId2, baseDir) {
   const hit = cache.get(sessionId2);
   if (hit && !exists) return hit;
   if (hit && hit.filePath === filePath && hit.mtimeMs === mtimeMs) return hit;
-  const events = existsSync13(filePath) ? await readSession(filePath) : [];
+  const events = existsSync15(filePath) ? await readSession(filePath) : [];
   const names = /* @__PURE__ */ new Map();
   const bySeq = /* @__PURE__ */ new Map();
   const byToolCallId = /* @__PURE__ */ new Map();
@@ -39972,17 +40454,17 @@ var init_observationStore = __esm({
 
 // packages/core/dist/core/tools/toolOutputSpill.js
 import { createHash as createHash11, randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync12 } from "node:fs";
-import { homedir as homedir4, tmpdir } from "node:os";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, writeFileSync as writeFileSync12 } from "node:fs";
+import { homedir as homedir5, tmpdir as tmpdir2 } from "node:os";
 import { join as join14 } from "node:path";
 function resolveToolOutputDir() {
   const fromEnv = process.env.ZELARI_TOOL_OUTPUT_DIR?.trim();
   if (fromEnv)
     return fromEnv;
   try {
-    return join14(homedir4(), ".tmp", "zelari-code", "tool-output");
+    return join14(homedir5(), ".tmp", "zelari-code", "tool-output");
   } catch {
-    return join14(tmpdir(), "zelari-code", "tool-output");
+    return join14(tmpdir2(), "zelari-code", "tool-output");
   }
 }
 function isToolSpillEnabled() {
@@ -39998,7 +40480,7 @@ function spillToolOutput(fullText, meta3) {
     return null;
   try {
     const dir = resolveToolOutputDir();
-    if (!existsSync14(dir)) {
+    if (!existsSync16(dir)) {
       mkdirSync7(dir, { recursive: true });
     }
     const hash3 = createHash11("sha256").update(fullText).digest("hex").slice(0, 12);
@@ -40303,7 +40785,7 @@ var init_registry2 = __esm({
 });
 
 // src/cli/safety/sandboxPath.ts
-import path34 from "node:path";
+import path35 from "node:path";
 import fs15 from "node:fs";
 function normalizedCase(p3) {
   return IS_CASE_FOLDING ? p3.toLowerCase() : p3;
@@ -40312,7 +40794,7 @@ function isWithin(candidate, base2) {
   const c = normalizedCase(candidate);
   const b = normalizedCase(base2);
   if (c === b) return true;
-  const baseWithSep = b.endsWith(path34.sep) ? b : b + path34.sep;
+  const baseWithSep = b.endsWith(path35.sep) ? b : b + path35.sep;
   return c.startsWith(baseWithSep);
 }
 function escapeError(userPath, attempted, real, realRoot) {
@@ -40323,7 +40805,7 @@ function escapeError(userPath, attempted, real, realRoot) {
   );
 }
 function assertLexicalContainment(resolved, root, userPath) {
-  const rootWithSep = root.endsWith(path34.sep) ? root : root + path34.sep;
+  const rootWithSep = root.endsWith(path35.sep) ? root : root + path35.sep;
   if (resolved !== root && !resolved.startsWith(rootWithSep)) {
     throw new SandboxViolationError(
       `Path escapes sandbox root: ${userPath} \u2192 ${resolved} (root: ${root})`,
@@ -40336,13 +40818,13 @@ function assertRealAncestorContained(resolvedLexical, realRoot, userPath) {
   let probe = resolvedLexical;
   let realProbe = null;
   for (; ; ) {
-    if (probe === path34.dirname(probe)) break;
+    if (probe === path35.dirname(probe)) break;
     try {
       realProbe = fs15.realpathSync(probe);
       break;
     } catch (err) {
       if (err?.code === "ENOENT") {
-        probe = path34.dirname(probe);
+        probe = path35.dirname(probe);
         continue;
       }
       return;
@@ -40361,8 +40843,8 @@ function resolveSandboxedCore(userPath, options = {}) {
   if (typeof userPath !== "string" || userPath.length === 0) {
     throw new SandboxViolationError("Empty path", userPath, "");
   }
-  const root = path34.resolve(options.root ?? process.cwd());
-  const resolved = path34.isAbsolute(userPath) ? path34.resolve(userPath) : path34.resolve(root, userPath);
+  const root = path35.resolve(options.root ?? process.cwd());
+  const resolved = path35.isAbsolute(userPath) ? path35.resolve(userPath) : path35.resolve(root, userPath);
   assertLexicalContainment(resolved, root, userPath);
   let realRoot = null;
   try {
@@ -40380,8 +40862,8 @@ function verifyContainment(resolvedAbsolute, options = {}) {
   if (typeof resolvedAbsolute !== "string" || resolvedAbsolute.length === 0) {
     throw new SandboxViolationError("Empty path", resolvedAbsolute, "");
   }
-  const root = path34.resolve(options.root ?? process.cwd());
-  const resolved = path34.resolve(resolvedAbsolute);
+  const root = path35.resolve(options.root ?? process.cwd());
+  const resolved = path35.resolve(resolvedAbsolute);
   assertLexicalContainment(resolved, root, resolvedAbsolute);
   let realRoot = null;
   try {
@@ -40409,19 +40891,19 @@ var init_sandboxPath = __esm({
 });
 
 // src/cli/tools/krakenRadio.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync16, readdirSync as readdirSync3 } from "node:fs";
-import path35 from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync16, readdirSync as readdirSync3 } from "node:fs";
+import path36 from "node:path";
 function radioDir(cwd) {
-  return path35.join(cwd, ".zelari", "radio");
+  return path36.join(cwd, ".zelari", "radio");
 }
 function radioPath(cwd, sessionId2) {
   const safe = (sessionId2 || "default").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-  return path35.join(radioDir(cwd), `${safe}.jsonl`);
+  return path36.join(radioDir(cwd), `${safe}.jsonl`);
 }
 function appendKrakenRadio(cwd, sessionId2, event) {
   try {
     const dir = radioDir(cwd);
-    if (!existsSync15(dir)) mkdirSync8(dir, { recursive: true });
+    if (!existsSync17(dir)) mkdirSync8(dir, { recursive: true });
     const row = {
       ts: event.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
       kind: event.kind,
@@ -40451,7 +40933,7 @@ function appendKrakenRadio(cwd, sessionId2, event) {
 function readKrakenRadio(cwd, sessionId2, limit = 50) {
   try {
     const file2 = radioPath(cwd, sessionId2);
-    if (!existsSync15(file2)) return [];
+    if (!existsSync17(file2)) return [];
     const lines = readFileSync16(file2, "utf8").split(/\r?\n/).filter(Boolean);
     const slice = lines.slice(-Math.max(1, limit));
     const out = [];
@@ -40475,7 +40957,7 @@ function formatKrakenRadioStatus(cwd, sessionId2, limit = 12) {
     const flag = e.ok === false ? "\u2717" : e.ok === true ? "\u2713" : "\xB7";
     const ms = e.durationMs != null ? ` ${e.durationMs}ms` : "";
     const model = e.model ? ` [${e.model}]` : "";
-    const wt = e.worktree ? ` wt=${path35.basename(e.worktree)}` : "";
+    const wt = e.worktree ? ` wt=${path36.basename(e.worktree)}` : "";
     const detail = e.detail ? ` \u2014 ${e.detail.slice(0, 120)}` : "";
     return `${flag} ${e.ts.slice(11, 19)} ${e.kind} ${e.agent} "${e.description}"${model}${wt}${ms}${detail}`;
   });
@@ -40491,7 +40973,7 @@ var init_krakenRadio = __esm({
 import {
   mkdirSync as mkdirSync9,
   writeFileSync as writeFileSync13,
-  existsSync as existsSync16,
+  existsSync as existsSync18,
   accessSync,
   constants,
   realpathSync
@@ -40517,7 +40999,7 @@ function hashProject(projectPath) {
 }
 function isWritableDir(dir) {
   try {
-    if (!existsSync16(dir)) return false;
+    if (!existsSync18(dir)) return false;
     accessSync(dir, constants.W_OK);
     return true;
   } catch {
@@ -40526,9 +41008,9 @@ function isWritableDir(dir) {
 }
 function ensureWorkspaceDir(workspaceDir) {
   mkdirSync9(workspaceDir, { recursive: true });
-  if (workspaceDir.endsWith("/.zelari") && existsSync16(join15(workspaceDir, "..", ".git"))) {
+  if (workspaceDir.endsWith("/.zelari") && existsSync18(join15(workspaceDir, "..", ".git"))) {
     const gitignorePath = join15(workspaceDir, ".gitignore");
-    if (!existsSync16(gitignorePath)) {
+    if (!existsSync18(gitignorePath)) {
       writeFileSync13(gitignorePath, "*\n!.gitignore\n");
     }
   }
@@ -40569,7 +41051,7 @@ __export(storage_exports, {
 import {
   readFileSync as readFileSync17,
   writeFileSync as writeFileSync14,
-  existsSync as existsSync17,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync10,
   readdirSync as readdirSync4,
   renameSync as renameSync2
@@ -40829,7 +41311,7 @@ var init_storage = __esm({
     Storage = class {
       /** Read a Markdown file with frontmatter. Throws if not found. */
       read(path99) {
-        if (!existsSync17(path99)) {
+        if (!existsSync19(path99)) {
           throw new Error(`File not found: ${path99}`);
         }
         const md = readFileSync17(path99, "utf8");
@@ -40837,7 +41319,7 @@ var init_storage = __esm({
       }
       /** Read a Markdown file; returns null if not found. */
       readIfExists(path99) {
-        if (!existsSync17(path99)) return null;
+        if (!existsSync19(path99)) return null;
         return this.read(path99);
       }
       /**
@@ -40853,7 +41335,7 @@ var init_storage = __esm({
       }
       /** List all .md files in a directory (non-recursive). */
       listMarkdown(dir) {
-        if (!existsSync17(dir)) return [];
+        if (!existsSync19(dir)) return [];
         return readdirSync4(dir).filter((f) => f.endsWith(".md") && !f.startsWith(".")).map((f) => join16(dir, f));
       }
     };
@@ -40886,7 +41368,7 @@ var init_storage = __esm({
 // src/cli/workspace/planStore.ts
 import {
   copyFileSync,
-  existsSync as existsSync18,
+  existsSync as existsSync20,
   mkdirSync as mkdirSync11,
   readFileSync as readFileSync18,
   renameSync as renameSync3,
@@ -40950,7 +41432,7 @@ function writePlanTaskArtifact(rootDir, task) {
 }
 function loadHandle(rootDir) {
   const jsonPath = join17(rootDir, "plan.json");
-  if (!existsSync18(jsonPath)) {
+  if (!existsSync20(jsonPath)) {
     return { rootDir, tasks: [], counter: 0, rootFields: {} };
   }
   let parsed;
@@ -40985,7 +41467,7 @@ function saveHandle(rootDir, handle) {
   }
   const jsonPath = join17(rootDir, "plan.json");
   mkdirSync11(rootDir, { recursive: true });
-  if (existsSync18(jsonPath)) {
+  if (existsSync20(jsonPath)) {
     copyFileSync(jsonPath, `${jsonPath}.bak`);
   }
   const file2 = {
@@ -41073,8 +41555,8 @@ var init_planStore = __esm({
 });
 
 // src/cli/workspace/taskTouchGuard.ts
-import { existsSync as existsSync19 } from "node:fs";
-import path36 from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import path37 from "node:path";
 function isMutatingToolName(name) {
   return NATIVE_WRITE_TOOLS.has(name) || MCP_FS_WRITE_RE.test(name);
 }
@@ -41083,11 +41565,11 @@ function toPosixRel(projectRoot, p3) {
   if (raw.startsWith("/") || /^[a-zA-Z]:\//.test(raw)) {
     let rel2;
     try {
-      rel2 = path36.relative(projectRoot, p3);
+      rel2 = path37.relative(projectRoot, p3);
     } catch {
       return null;
     }
-    if (!rel2 || rel2.startsWith("..") || path36.isAbsolute(rel2)) return null;
+    if (!rel2 || rel2.startsWith("..") || path37.isAbsolute(rel2)) return null;
     return rel2.replace(/\\/g, "/");
   }
   return raw.replace(/^\.\//, "");
@@ -41142,7 +41624,7 @@ function createTaskTouchGuard(opts) {
   async function inspectWrite(rel2) {
     try {
       const planPath = planJsonPathFor(root);
-      if (!existsSync19(planPath)) return;
+      if (!existsSync21(planPath)) return;
       const tasks = await withPlanStore(root, (store6) => store6.tasks);
       for (const task of tasks) {
         if (task.status !== "completed" || !task.files?.length || !task.completedAt) continue;
@@ -41197,7 +41679,7 @@ var init_taskTouchGuard = __esm({
 // src/cli/gitOps.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify } from "node:util";
-import path37 from "node:path";
+import path38 from "node:path";
 async function git2(cwd, args) {
   try {
     const { stdout } = await execFileAsync("git", ["-C", cwd, ...args], {
@@ -41250,7 +41732,7 @@ async function undoWorkingChanges(opts = {}) {
   };
 }
 function defaultProjectRoot() {
-  return path37.resolve(__dirname, "..", "..", "..");
+  return path38.resolve(__dirname, "..", "..", "..");
 }
 var execFileAsync;
 var init_gitOps = __esm({
@@ -41261,7 +41743,7 @@ var init_gitOps = __esm({
 });
 
 // src/cli/workspace/taskStaleness.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 function taskStaleHours() {
   const raw = process.env.ZELARI_TASK_STALE_HOURS;
   if (raw === void 0 || raw.trim() === "") return TASK_STALE_HOURS_DEFAULT;
@@ -41273,7 +41755,7 @@ async function runTaskStalenessCheck(opts) {
   const root = opts.projectRoot;
   const nowMs = (opts.now ?? Date.now)();
   try {
-    if (!existsSync20(planJsonPathFor(root))) return [];
+    if (!existsSync22(planJsonPathFor(root))) return [];
     if (!await isGitRepo(root)) return [];
     const hours = opts.hoursOverride ?? taskStaleHours();
     const cutoff = nowMs - hours * 36e5;
@@ -41392,7 +41874,7 @@ __export(auditLogger_exports, {
   AuditLogger: () => AuditLogger
 });
 import { promises as fs16 } from "node:fs";
-import path38 from "node:path";
+import path39 from "node:path";
 function defaultAuditPath() {
   return auditLogPath();
 }
@@ -41438,7 +41920,7 @@ var init_auditLogger = __esm({
       async append(entry) {
         const line = JSON.stringify(entry) + "\n";
         this.writeQueue = this.writeQueue.then(async () => {
-          await fs16.mkdir(path38.dirname(this.logPath), { recursive: true });
+          await fs16.mkdir(path39.dirname(this.logPath), { recursive: true });
           await fs16.appendFile(this.logPath, line, "utf-8");
         });
         return this.writeQueue;
@@ -41483,9 +41965,9 @@ var init_auditLogger = __esm({
 });
 
 // src/cli/diagnostics/engine.ts
-import { spawn as spawn6 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import path39 from "node:path";
+import { spawn as spawn7 } from "node:child_process";
+import { existsSync as existsSync23 } from "node:fs";
+import path40 from "node:path";
 function parseEslintJson(stdout, _file2) {
   const json3 = safeJson(stdout);
   if (!Array.isArray(json3)) return [];
@@ -41544,7 +42026,7 @@ function safeJson(s) {
   }
 }
 function providerForFile(file2, providers = DEFAULT_PROVIDERS) {
-  const ext = path39.extname(file2).toLowerCase();
+  const ext = path40.extname(file2).toLowerCase();
   return providers.find((p3) => p3.extensions.includes(ext)) ?? null;
 }
 function resolveBin(bin, cwd) {
@@ -41552,10 +42034,10 @@ function resolveBin(bin, cwd) {
   let dir = cwd;
   for (let i = 0; i < 6; i += 1) {
     for (const suffix of suffixes) {
-      const candidate = path39.join(dir, "node_modules", ".bin", `${bin}${suffix}`);
-      if (existsSync21(candidate)) return candidate;
+      const candidate = path40.join(dir, "node_modules", ".bin", `${bin}${suffix}`);
+      if (existsSync23(candidate)) return candidate;
     }
-    const parent = path39.dirname(dir);
+    const parent = path40.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -41628,7 +42110,7 @@ var init_engine2 = __esm({
       };
       let child;
       try {
-        child = process.platform === "win32" ? spawn6(buildCmdLine(cmd, args), { cwd: opts.cwd, shell: true }) : spawn6(cmd, args, { cwd: opts.cwd });
+        child = process.platform === "win32" ? spawn7(buildCmdLine(cmd, args), { cwd: opts.cwd, shell: true }) : spawn7(cmd, args, { cwd: opts.cwd });
       } catch {
         done({ code: null, stdout: "", stderr: "" });
         return;
@@ -41660,8 +42142,8 @@ var init_engine2 = __esm({
 
 // src/cli/tools/krakenWorktree.ts
 import { execFile as execFile3 } from "node:child_process";
-import { existsSync as existsSync22, mkdirSync as mkdirSync12, rmSync } from "node:fs";
-import path40 from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, rmSync } from "node:fs";
+import path41 from "node:path";
 import { promisify as promisify2 } from "node:util";
 import { randomBytes as randomBytes4 } from "node:crypto";
 function isKrakenWorktreeEnabled(env = process.env) {
@@ -41709,10 +42191,10 @@ async function createKrakenWorktree(cwd, label) {
   const id3 = `${Date.now().toString(36)}-${randomBytes4(3).toString("hex")}`;
   const slug = (label ?? "task").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24) || "task";
   const branch = `kraken/${slug}-${id3}`;
-  const wtRoot = path40.join(repoRoot, ".zelari", "worktrees");
-  const wtPath = path40.join(wtRoot, `kraken-${id3}`);
+  const wtRoot = path41.join(repoRoot, ".zelari", "worktrees");
+  const wtPath = path41.join(wtRoot, `kraken-${id3}`);
   try {
-    if (!existsSync22(wtRoot)) mkdirSync12(wtRoot, { recursive: true });
+    if (!existsSync24(wtRoot)) mkdirSync12(wtRoot, { recursive: true });
   } catch {
     return null;
   }
@@ -41824,7 +42306,7 @@ async function cleanupKrakenWorktree(handle, env = process.env) {
   if (shouldKeepWorktree(env)) return;
   await git3(handle.repoRoot, ["worktree", "remove", "--force", handle.path]);
   try {
-    if (existsSync22(handle.path)) {
+    if (existsSync24(handle.path)) {
       rmSync(handle.path, { recursive: true, force: true });
     }
   } catch {
@@ -42192,8 +42674,8 @@ var init_tentacle = __esm({
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import path41 from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+import path42 from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 async function git4(cwd, args, env) {
   const { stdout } = await execFileAsync3("git", ["-C", cwd, ...args], {
@@ -42213,8 +42695,8 @@ async function isGitRepo2(cwd) {
   return await gitSafe(cwd, ["rev-parse", "--is-inside-work-tree"]) === "true";
 }
 async function withTempIndex(fn) {
-  const dir = mkdtempSync(path41.join(tmpdir2(), "zelari-ckpt-"));
-  const indexFile = path41.join(dir, "index");
+  const dir = mkdtempSync(path42.join(tmpdir3(), "zelari-ckpt-"));
+  const indexFile = path42.join(dir, "index");
   try {
     return await fn(indexFile);
   } finally {
@@ -42305,7 +42787,7 @@ async function restoreCheckpoint(cwd, id3) {
     const deleted = [];
     for (const rel2 of added) {
       try {
-        rmSync2(path41.join(cwd, rel2), { force: true });
+        rmSync2(path42.join(cwd, rel2), { force: true });
         deleted.push(rel2);
       } catch {
       }
@@ -42385,10 +42867,10 @@ var init_transactional = __esm({
 
 // src/cli/workspace/worldModel.ts
 import { promises as fs17 } from "node:fs";
-import path42 from "node:path";
-import { spawn as spawn7 } from "node:child_process";
+import path43 from "node:path";
+import { spawn as spawn8 } from "node:child_process";
 function worldDir(cwd) {
-  return path42.join(cwd, WORLD_DIR_NAME);
+  return path43.join(cwd, WORLD_DIR_NAME);
 }
 async function ensureWorldDir(cwd) {
   const dir = worldDir(cwd);
@@ -42398,10 +42880,10 @@ async function ensureWorldDir(cwd) {
 async function appendTimeline(cwd, entry) {
   const dir = await ensureWorldDir(cwd);
   const line = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry }) + "\n";
-  await fs17.appendFile(path42.join(dir, TIMELINE_FILE), line, "utf8");
+  await fs17.appendFile(path43.join(dir, TIMELINE_FILE), line, "utf8");
 }
 async function readChecks(cwd) {
-  const p3 = path42.join(worldDir(cwd), CHECKS_FILE);
+  const p3 = path43.join(worldDir(cwd), CHECKS_FILE);
   try {
     const raw = await fs17.readFile(p3, "utf8");
     const parsed = JSON.parse(raw);
@@ -42413,7 +42895,7 @@ async function readChecks(cwd) {
 function runShell(command, cwd, timeoutMs2, signal) {
   return new Promise((resolve9) => {
     const isWin = process.platform === "win32";
-    const child = spawn7(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
+    const child = spawn8(isWin ? "cmd.exe" : "/bin/sh", isWin ? ["/c", command] : ["-c", command], {
       cwd,
       env: process.env,
       windowsHide: true,
@@ -42476,8 +42958,8 @@ function runShell(command, cwd, timeoutMs2, signal) {
   });
 }
 async function runBacktest(cwd, signal) {
-  const checksPath = path42.join(worldDir(cwd), CHECKS_FILE);
-  const hypothesisPath = path42.join(worldDir(cwd), HYPOTHESIS_FILE);
+  const checksPath = path43.join(worldDir(cwd), CHECKS_FILE);
+  const hypothesisPath = path43.join(worldDir(cwd), HYPOTHESIS_FILE);
   const checks = await readChecks(cwd);
   if (checks.length === 0) {
     return {
@@ -42546,7 +43028,7 @@ var init_worldModel = __esm({
     "use strict";
     init_zod();
     init_toolTypes();
-    WORLD_DIR_NAME = path42.join(".zelari", "world");
+    WORLD_DIR_NAME = path43.join(".zelari", "world");
     HYPOTHESIS_FILE = "hypothesis.md";
     CHECKS_FILE = "checks.json";
     TIMELINE_FILE = "timeline.jsonl";
@@ -42563,7 +43045,7 @@ var init_worldModel = __esm({
       execute: async (args, ctx) => {
         try {
           const dir = await ensureWorldDir(ctx.cwd);
-          const file2 = path42.join(dir, HYPOTHESIS_FILE);
+          const file2 = path43.join(dir, HYPOTHESIS_FILE);
           if (args.append) {
             const block = `
 
@@ -42602,7 +43084,7 @@ ${args.content}
       execute: async (args, ctx) => {
         try {
           const dir = await ensureWorldDir(ctx.cwd);
-          const file2 = path42.join(dir, CHECKS_FILE);
+          const file2 = path43.join(dir, CHECKS_FILE);
           const body = { checks: args.checks };
           await fs17.writeFile(file2, JSON.stringify(body, null, 2) + "\n", "utf8");
           await appendTimeline(ctx.cwd, { kind: "checks_set", count: args.checks.length });
@@ -42641,8 +43123,8 @@ ${args.content}
                 stdoutPreview: "(dryRun)",
                 mismatch: "dryRun"
               })),
-              hypothesisPath: path42.join(worldDir(ctx.cwd), HYPOTHESIS_FILE),
-              checksPath: path42.join(worldDir(ctx.cwd), CHECKS_FILE)
+              hypothesisPath: path43.join(worldDir(ctx.cwd), HYPOTHESIS_FILE),
+              checksPath: path43.join(worldDir(ctx.cwd), CHECKS_FILE)
             });
           }
           const result = await runBacktest(ctx.cwd, ctx.signal);
@@ -42666,7 +43148,7 @@ ${args.content}
       execute: async (args, ctx) => {
         try {
           const dir = await ensureWorldDir(ctx.cwd);
-          const file2 = path42.join(dir, TIMELINE_FILE);
+          const file2 = path43.join(dir, TIMELINE_FILE);
           await appendTimeline(ctx.cwd, {
             kind: args.kind,
             summary: args.summary,
@@ -42690,9 +43172,9 @@ __export(graphMemory_exports, {
   toGraphSnapshot: () => toGraphSnapshot
 });
 import { promises as fs18 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 function snapshotPath(cwd) {
-  return path43.join(cwd, SNAPSHOT_DIR, SNAPSHOT_FILE);
+  return path44.join(cwd, SNAPSHOT_DIR, SNAPSHOT_FILE);
 }
 function toGraphSnapshot(graph, opts) {
   const unresolved = (opts.unresolvedFindings ?? []).map((u) => ({
@@ -42719,7 +43201,7 @@ async function saveGraphSnapshot(cwd, snapshot) {
   try {
     await fs18.access(cwd);
     const file2 = snapshotPath(cwd);
-    await fs18.mkdir(path43.dirname(file2), { recursive: true });
+    await fs18.mkdir(path44.dirname(file2), { recursive: true });
     await fs18.writeFile(file2, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
   } catch {
   }
@@ -42786,7 +43268,7 @@ var SNAPSHOT_DIR, SNAPSHOT_FILE, MAX_SNAPSHOT_FINDINGS_CHARS;
 var init_graphMemory = __esm({
   "src/cli/kraken/graphMemory.ts"() {
     "use strict";
-    SNAPSHOT_DIR = path43.join(".zelari", "kraken");
+    SNAPSHOT_DIR = path44.join(".zelari", "kraken");
     SNAPSHOT_FILE = "last-graph.json";
     MAX_SNAPSHOT_FINDINGS_CHARS = 400;
   }
@@ -42794,14 +43276,14 @@ var init_graphMemory = __esm({
 
 // src/cli/kraken/workbench.ts
 import { promises as fs19 } from "node:fs";
-import path44 from "node:path";
+import path45 from "node:path";
 function isWorkbenchEnabled(env = process.env) {
   const v = (env.ZELARI_KRAKEN_WORKBENCH ?? "1").trim().toLowerCase();
   if (v === "0" || v === "false" || v === "no" || v === "off") return false;
   return true;
 }
 function workbenchPath(cwd, graphId) {
-  return path44.join(cwd, ".zelari", "radio", `workbench-${graphId}.md`);
+  return path45.join(cwd, ".zelari", "radio", `workbench-${graphId}.md`);
 }
 function countByStatus2(nodes) {
   const out = { pending: 0, running: 0, done: 0, error: 0, skipped: 0 };
@@ -42964,7 +43446,7 @@ var init_workbench = __esm({
         if (!this.enabled) return null;
         if (!this.dirty && this.lastWrite) return this.lastWrite;
         const out = workbenchPath(this.cwd, this.graphId);
-        await fs19.mkdir(path44.dirname(out), { recursive: true });
+        await fs19.mkdir(path45.dirname(out), { recursive: true });
         const body = this.render();
         const tmp = `${out}.${process.pid}.${Date.now()}.tmp`;
         await fs19.writeFile(tmp, body, "utf8");
@@ -43110,9 +43592,9 @@ var init_semanticOwnership = __esm({
 
 // src/cli/ast/engine.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import path45 from "node:path";
+import path46 from "node:path";
 function isAstSupported(file2) {
-  return TS_EXTENSIONS.has(path45.extname(file2).toLowerCase());
+  return TS_EXTENSIONS.has(path46.extname(file2).toLowerCase());
 }
 function loadTs() {
   if (!tsPromise) {
@@ -43124,8 +43606,8 @@ function errMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
 async function parseFileSymbolsDiag(file2, cwd) {
-  const resolvedPath = path45.isAbsolute(file2) ? file2 : path45.join(cwd ?? process.cwd(), file2);
-  const extension = path45.extname(resolvedPath).toLowerCase();
+  const resolvedPath = path46.isAbsolute(file2) ? file2 : path46.join(cwd ?? process.cwd(), file2);
+  const extension = path46.extname(resolvedPath).toLowerCase();
   if (!TS_EXTENSIONS.has(extension)) {
     return {
       status: "unsupported-extension",
@@ -43167,7 +43649,7 @@ async function parseFileSymbolsDiag(file2, cwd) {
   }
   let source2;
   try {
-    source2 = ts.createSourceFile(path45.basename(resolvedPath), text, ts.ScriptTarget.Latest, true);
+    source2 = ts.createSourceFile(path46.basename(resolvedPath), text, ts.ScriptTarget.Latest, true);
   } catch (err) {
     return {
       status: "parse-error",
@@ -43460,14 +43942,14 @@ var init_spawnRoi = __esm({
 
 // src/cli/kraken/reputationStore.ts
 import { appendFile as appendFile2, mkdir as mkdir2, readFile as readFile6, rename, writeFile as writeFile2 } from "node:fs/promises";
-import path46 from "node:path";
+import path47 from "node:path";
 function resolveReputationStorePath(cwd = process.cwd(), env = process.env) {
   const override = env[REPUTATION_STORE_ENV]?.trim();
   if (override) return override;
-  return path46.join(cwd, ".zelari", "reputation.jsonl");
+  return path47.join(cwd, ".zelari", "reputation.jsonl");
 }
 async function appendRecord(storePath, record2) {
-  await mkdir2(path46.dirname(storePath), { recursive: true });
+  await mkdir2(path47.dirname(storePath), { recursive: true });
   await appendFile2(storePath, `${JSON.stringify(record2)}
 `, "utf8");
 }
@@ -44019,8 +44501,8 @@ __export(executor_exports, {
   resolveTransactional: () => resolveTransactional,
   thoroughnessForKind: () => thoroughnessForKind
 });
-import { existsSync as existsSync23 } from "node:fs";
-import path47 from "node:path";
+import { existsSync as existsSync25 } from "node:fs";
+import path48 from "node:path";
 async function defaultSymbolExtractor(file2) {
   if (!isAstSupported(file2)) return null;
   const r = await parseFileSymbolsDiag(file2);
@@ -44086,7 +44568,7 @@ function isWorldModelGateEnabled(cwd, env = process.env, checksExists = defaultC
 }
 function defaultChecksExists(cwd) {
   try {
-    return existsSync23(path47.join(cwd, ".zelari", "world", "checks.json"));
+    return existsSync25(path48.join(cwd, ".zelari", "world", "checks.json"));
   } catch {
     return false;
   }
@@ -44594,7 +45076,7 @@ var init_executor = __esm({
         try {
           const summary = aggregate(
             records,
-            { repo: path47.basename(this.parentCwd), role: agentForNode(node) },
+            { repo: path48.basename(this.parentCwd), role: agentForNode(node) },
             now
           );
           sample = summary.sample;
@@ -45071,7 +45553,7 @@ ${upstream}` : node.prompt,
           const model = res.ok && res.model && res.model !== "n/a" ? res.model : null;
           const reviewerVerdict = res.ok && this.isReviewerKind(node.kind) && typeof node.result === "string" && node.result.length > 0 ? parseVerifyVerdict(node.result).verdict : null;
           const record2 = reputationRecordFromNodeRun({
-            repo: path47.basename(this.parentCwd),
+            repo: path48.basename(this.parentCwd),
             role: agentForNode(node),
             kind: node.kind,
             ok: res.ok,
@@ -45459,7 +45941,7 @@ ${failed.error ?? "unknown error"}`,
 });
 
 // src/cli/tools/taskTool.ts
-import { existsSync as existsSync24 } from "node:fs";
+import { existsSync as existsSync26 } from "node:fs";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function resetTaskSpawnCount() {
   const g = globalThis;
@@ -45527,7 +46009,7 @@ ${findings || "(the reviewer reported FAIL without detail)"}`;
 async function runAutoVerifyAfterGeneral(opts) {
   const g = globalThis;
   g.__zelariGeneralVerifyDebt = { description: opts.original.description };
-  const inheritedCwd = opts.general.worktreePath && existsSync24(opts.general.worktreePath) ? opts.general.worktreePath : void 0;
+  const inheritedCwd = opts.general.worktreePath && existsSync26(opts.general.worktreePath) ? opts.general.worktreePath : void 0;
   const runVerify = (label) => runTentacle({
     deps: opts.deps,
     args: {
@@ -46653,7 +47135,7 @@ var init_askUser = __esm({
 });
 
 // src/cli/skillsMd.ts
-import { existsSync as existsSync25, readdirSync as readdirSync5, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync5, readFileSync as readFileSync19 } from "node:fs";
 import { join as join18 } from "node:path";
 function skillMdSearchDirs(projectRoot = process.cwd()) {
   return [
@@ -46718,7 +47200,7 @@ function loadSkillMdSkills(projectRoot = process.cwd(), options = {}) {
   const summary = { loaded: [], skipped: [] };
   const seen = new Set(options.existingIds ?? []);
   for (const dir of skillMdSearchDirs(projectRoot)) {
-    if (!existsSync25(dir)) continue;
+    if (!existsSync27(dir)) continue;
     let entries;
     try {
       entries = readdirSync5(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
@@ -46727,7 +47209,7 @@ function loadSkillMdSkills(projectRoot = process.cwd(), options = {}) {
     }
     for (const entry of entries) {
       const skillPath = join18(dir, entry, "SKILL.md");
-      if (!existsSync25(skillPath)) continue;
+      if (!existsSync27(skillPath)) continue;
       try {
         const parsed = parseSkillMd(readFileSync19(skillPath, "utf8"), skillPath);
         if (!parsed) {
@@ -46770,6 +47252,21 @@ var init_skillsMd = __esm({
 });
 
 // src/cli/budget/historySummary.ts
+function collectOpenObligations(text, out) {
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.length > 240) continue;
+    if (OPEN_OBLIGATION_LINE.test(line) || OPEN_OBLIGATION_KEYWORD.test(line)) {
+      out.push(oneLine(line, 200));
+    }
+  }
+}
+function collectEvidenceRefs(text, out) {
+  for (const re of EVIDENCE_PATTERNS) {
+    const matches = text.match(re);
+    if (matches) out.push(...matches);
+  }
+}
 function extractiveHistorySummary(dropped, opts) {
   const maxChars = opts?.maxChars ?? MAX_SUMMARY_CHARS;
   if (dropped.length === 0) return "No prior turns.";
@@ -46781,8 +47278,12 @@ function extractiveHistorySummary(dropped, opts) {
   const decisions = [];
   const tools = /* @__PURE__ */ new Map();
   const files = /* @__PURE__ */ new Set();
+  const openObligations = [];
+  const evidenceRefs = [];
   let toolResults = 0;
   for (const m of dropped) {
+    collectOpenObligations(m.content ?? "", openObligations);
+    collectEvidenceRefs(m.content ?? "", evidenceRefs);
     if (m.role === "user" && m.content.trim()) {
       const goal = oneLine(m.content, 220);
       userGoals.push(goal);
@@ -46820,6 +47321,14 @@ function extractiveHistorySummary(dropped, opts) {
     parts.push("## User constraints (preserve exactly)");
     for (const item of [...new Set(userConstraints)].slice(-8)) parts.push(`- ${item}`);
   }
+  if (openObligations.length) {
+    parts.push("## Open obligations (still owed \u2014 do not silently drop)");
+    for (const item of [...new Set(openObligations)].slice(-10)) parts.push(`- ${item}`);
+  }
+  if (evidenceRefs.length) {
+    parts.push("## Evidence anchors (verbatim refs, keep provenance)");
+    for (const item of [...new Set(evidenceRefs)].slice(-12)) parts.push(`- ${oneLine(item, 160)}`);
+  }
   if (unresolved.length) {
     parts.push("## Unresolved failures / pending repair");
     for (const item of [...new Set(unresolved)].slice(-8)) parts.push(`- ${item}`);
@@ -46878,11 +47387,19 @@ function collectPathsFromText(text, out) {
     n += 1;
   }
 }
-var MAX_SUMMARY_CHARS;
+var MAX_SUMMARY_CHARS, OPEN_OBLIGATION_LINE, OPEN_OBLIGATION_KEYWORD, EVIDENCE_PATTERNS;
 var init_historySummary = __esm({
   "src/cli/budget/historySummary.ts"() {
     "use strict";
     MAX_SUMMARY_CHARS = 3500;
+    OPEN_OBLIGATION_LINE = /^\s*[-*]\s+\[\s\]/;
+    OPEN_OBLIGATION_KEYWORD = /\b(TODO|PENDING|FIX ME|STILL OWED|DA FARE)\b\s*[:.]/;
+    EVIDENCE_PATTERNS = [
+      /OBSERVATION\s+ref=#\d+(?:[^,\n]{0,40})?/g,
+      /\bcommit\s+[0-9a-f]{7,40}\b/gi,
+      /\bpushed\s+[0-9a-f]{7,40}\b/gi,
+      /\bexit code\s+\d+\b/gi
+    ];
   }
 });
 
@@ -47008,15 +47525,25 @@ function withDroppedRange(result, dropped, strategy) {
   return { ...result, ...range, strategy };
 }
 function resolveMaxMessages(opts) {
-  const envTurns = envNumber(process.env.ZELARI_HISTORY_TURNS, { default: 6, min: 0 });
+  const envTurns = envNumber(process.env.ZELARI_HISTORY_TURNS, { default: 40, min: 0 });
   let turns = opts?.maxMessages ? Math.ceil(opts.maxMessages / 4) : envTurns;
-  if (opts?.durableStatePresent && !opts?.maxMessages && process.env.ZELARI_HISTORY_TURNS === void 0) {
-    turns = Math.min(turns, 3);
-  }
   if (turns <= 0) return 0;
   if (opts?.force && opts?.maxMessages) return Math.max(1, opts.maxMessages);
   return turns * 4;
 }
+function resolveHistoryCharBudget(opts) {
+  const halveForDurable = !!opts?.durableStatePresent && process.env.ZELARI_HISTORY_BUDGET_CHARS === void 0;
+  return envNumber(process.env.ZELARI_HISTORY_BUDGET_CHARS, {
+    default: halveForDurable ? 1e4 : 2e4,
+    min: 2e3,
+    max: 2e5
+  });
+}
+function historyChars(messages) {
+  let n = 0;
+  for (const m of messages) n += (m.content ?? "").length;
+  return n;
+}
 function findValidCutIndex(messages, naiveCut) {
   let cut = naiveCut;
   while (cut < messages.length) {
@@ -47100,7 +47627,12 @@ function compactHistoryDetailed(messages, opts) {
       "extractive"
     );
   }
-  if (messages.length <= maxMessages * 2 && !opts?.force) {
+  const charBudget = resolveHistoryCharBudget(opts);
+  const explicitCount = opts?.maxMessages !== void 0 || process.env.ZELARI_HISTORY_TURNS !== void 0;
+  const overChars = historyChars(messages) > charBudget;
+  const overCount = messages.length > maxMessages * 2;
+  const shouldCompact = overChars || explicitCount && overCount || !!opts?.force;
+  if (!shouldCompact) {
     return {
       messages,
       compacted: false,
@@ -47108,7 +47640,18 @@ function compactHistoryDetailed(messages, opts) {
       summary: ""
     };
   }
-  const naiveCut = Math.max(0, messages.length - maxMessages);
+  let naiveCut;
+  if (overChars) {
+    let cut2 = 0;
+    let keptChars = historyChars(messages);
+    while (cut2 < messages.length && keptChars > charBudget) {
+      keptChars -= (messages[cut2].content ?? "").length;
+      cut2 += 1;
+    }
+    naiveCut = Math.max(cut2, messages.length - maxMessages);
+  } else {
+    naiveCut = Math.max(0, messages.length - maxMessages);
+  }
   const cut = findValidCutIndex(messages, naiveCut);
   if (cut === 0) {
     return {
@@ -47372,7 +47915,11 @@ function resolveContextLimit(model, provider) {
 }
 function phaseKnobs(phase2) {
   return {
-    historyTurns: phase2 === "plan" ? envNumber(process.env.ZELARI_HISTORY_TURNS, { default: 8, min: 0 }) : envNumber(process.env.ZELARI_HISTORY_TURNS, { default: 6, min: 0 }),
+    // v2.32.0 (S3): count defaults raised to a runaway safety net — the
+    // primary history gate is the adaptive char budget (see
+    // historyCompaction.resolveHistoryCharBudget). An explicit
+    // ZELARI_HISTORY_TURNS stays a user contract and is honored as before.
+    historyTurns: phase2 === "plan" ? envNumber(process.env.ZELARI_HISTORY_TURNS, { default: 40, min: 0 }) : envNumber(process.env.ZELARI_HISTORY_TURNS, { default: 40, min: 0 }),
     maxToolLoopIterations: phase2 === "plan" ? envNumber(process.env.ZELARI_MAX_TOOL_LOOP_ITERATIONS, { default: 60, min: 1 }) : envNumber(process.env.ZELARI_MAX_TOOL_LOOP_ITERATIONS, {
       default: 120,
       min: 1
@@ -48059,8 +48606,8 @@ var init_planTaskTools = __esm({
 
 // src/cli/tools/inspectTypecheckSafety.ts
 import { promises as fs20 } from "node:fs";
-import path48 from "node:path";
-import { spawn as spawn8 } from "node:child_process";
+import path49 from "node:path";
+import { spawn as spawn9 } from "node:child_process";
 async function scanTsbuildinfo(root) {
   const found = [];
   const stack = [root];
@@ -48073,11 +48620,11 @@ async function scanTsbuildinfo(root) {
       continue;
     }
     for (const entry of entries) {
-      const p3 = path48.join(dir, entry.name);
+      const p3 = path49.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SCAN_SKIP.has(entry.name)) stack.push(p3);
       } else if (entry.name.endsWith(".tsbuildinfo")) {
-        found.push(path48.relative(root, p3).split(path48.sep).join("/"));
+        found.push(path49.relative(root, p3).split(path49.sep).join("/"));
       }
     }
   }
@@ -48086,7 +48633,7 @@ async function scanTsbuildinfo(root) {
 }
 async function gitStatusPorcelain(root) {
   return new Promise((resolve9) => {
-    const child = spawn8("git", ["status", "--porcelain"], { cwd: root, shell: false });
+    const child = spawn9("git", ["status", "--porcelain"], { cwd: root, shell: false });
     let out = "";
     child.stdout.on("data", (d) => out += d.toString());
     child.stderr.on("data", (d) => out += d.toString());
@@ -48113,7 +48660,7 @@ async function cleanupArtifacts(root, relPaths) {
   const failed = [];
   for (const rel2 of relPaths) {
     try {
-      await fs20.unlink(path48.join(root, rel2));
+      await fs20.unlink(path49.join(root, rel2));
       cleaned.push(rel2);
     } catch {
       failed.push(rel2);
@@ -48136,17 +48683,17 @@ var init_inspectTypecheckSafety = __esm({
 });
 
 // src/cli/tools/inspectCommand.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync26, promises as fs21 } from "node:fs";
+import { existsSync as existsSync28, promises as fs21 } from "node:fs";
 import os2 from "node:os";
-import path49 from "node:path";
+import path50 from "node:path";
 function resolveNodeModuleBin(start, rel2) {
-  let dir = path49.resolve(start);
+  let dir = path50.resolve(start);
   for (; ; ) {
-    const candidate = path49.join(dir, "node_modules", rel2);
-    if (existsSync26(candidate)) return candidate;
-    const parent = path49.dirname(dir);
+    const candidate = path50.join(dir, "node_modules", rel2);
+    if (existsSync28(candidate)) return candidate;
+    const parent = path50.dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -48214,7 +48761,7 @@ function buildInspectCommand(op, ctx) {
     case "npm_ls":
     case "npm_outdated":
     case "npm_view": {
-      const npmCli = ctx.npmCliPath ?? resolveNodeModuleBin(ctx.root, path49.join("npm", "bin", "npm-cli.js")) ?? path49.join(ctx.root, "node_modules", "npm", "bin", "npm-cli.js");
+      const npmCli = ctx.npmCliPath ?? resolveNodeModuleBin(ctx.root, path50.join("npm", "bin", "npm-cli.js")) ?? path50.join(ctx.root, "node_modules", "npm", "bin", "npm-cli.js");
       if (op.operation === "npm_view") {
         const err = rejectFlagLike("package", op.package);
         if (err) return { ok: false, reason: err };
@@ -48223,14 +48770,14 @@ function buildInspectCommand(op, ctx) {
       return { ok: true, command: process.execPath, argv: [npmCli, ...sub], inspectionClass: "env-info" };
     }
     case "typecheck": {
-      const project = path49.resolve(ctx.cwd, op.project ?? "tsconfig.json");
+      const project = path50.resolve(ctx.cwd, op.project ?? "tsconfig.json");
       const hash3 = createHash13("sha256").update(project).digest("hex").slice(0, 16);
-      const tsBuildInfoFile = path49.join(os2.tmpdir(), "zelari-inspect", `${hash3}.tsbuildinfo`);
+      const tsBuildInfoFile = path50.join(os2.tmpdir(), "zelari-inspect", `${hash3}.tsbuildinfo`);
       return {
         ok: true,
         command: process.execPath,
         argv: [
-          ctx.tscPath ?? resolveNodeModuleBin(ctx.root, path49.join("typescript", "bin", "tsc")) ?? resolveNodeModuleBin(ctx.cwd, path49.join("typescript", "bin", "tsc")) ?? path49.join(ctx.root, "node_modules", "typescript", "bin", "tsc"),
+          ctx.tscPath ?? resolveNodeModuleBin(ctx.root, path50.join("typescript", "bin", "tsc")) ?? resolveNodeModuleBin(ctx.cwd, path50.join("typescript", "bin", "tsc")) ?? path50.join(ctx.root, "node_modules", "typescript", "bin", "tsc"),
           "--noEmit",
           // S3.5 primary mechanism: redirect, never disable — composite forces
           // incremental (TS#30661), so --incremental false would break on the
@@ -48252,7 +48799,7 @@ function runSpawn(command, argv, opts) {
   return new Promise((resolve9) => {
     let child;
     try {
-      child = spawn9(command, argv, { cwd: opts.cwd, shell: false });
+      child = spawn10(command, argv, { cwd: opts.cwd, shell: false });
     } catch (err) {
       resolve9({ code: null, stdout: "", stderr: String(err), timedOut: false, spawnError: String(err) });
       return;
@@ -48538,379 +49085,6 @@ var init_selfKillGuard = __esm({
   }
 });
 
-// src/cli/safety/policyLoadMode.ts
-var policyLoadMode_exports = {};
-__export(policyLoadMode_exports, {
-  POLICY_LOAD_BLOCK_REASON: () => POLICY_LOAD_BLOCK_REASON,
-  POLICY_LOAD_EXIT_CODE: () => POLICY_LOAD_EXIT_CODE,
-  POLICY_LOAD_MODE_ENV: () => POLICY_LOAD_MODE_ENV,
-  activePolicyLoadMode: () => activePolicyLoadMode,
-  activePolicyLoadSurface: () => activePolicyLoadSurface,
-  resolvePolicyLoadMode: () => resolvePolicyLoadMode,
-  setActivePolicyLoadSurface: () => setActivePolicyLoadSurface
-});
-function isTruthyFlag(v) {
-  const n = v?.trim().toLowerCase();
-  return n === "1" || n === "true" || n === "yes" || n === "on";
-}
-function resolvePolicyLoadMode(input) {
-  const v = input.override?.trim().toLowerCase();
-  if (v === "strict") return "strict";
-  if (v === "permissive") return "permissive";
-  if (input.surface === "headless" || input.surface === "mission") return "strict";
-  if (isTruthyFlag(input.ci)) return "strict";
-  return "permissive";
-}
-function setActivePolicyLoadSurface(surface) {
-  activeSurface = surface;
-}
-function activePolicyLoadSurface() {
-  return activeSurface;
-}
-function activePolicyLoadMode(env = process.env) {
-  return resolvePolicyLoadMode({
-    surface: activeSurface,
-    override: env[POLICY_LOAD_MODE_ENV],
-    ci: typeof env.CI === "string" ? env.CI : void 0
-  });
-}
-var POLICY_LOAD_MODE_ENV, POLICY_LOAD_BLOCK_REASON, POLICY_LOAD_EXIT_CODE, activeSurface;
-var init_policyLoadMode = __esm({
-  "src/cli/safety/policyLoadMode.ts"() {
-    "use strict";
-    POLICY_LOAD_MODE_ENV = "ZELARI_POLICY_LOAD_MODE";
-    POLICY_LOAD_BLOCK_REASON = "policy-load-failed";
-    POLICY_LOAD_EXIT_CODE = 2;
-    activeSurface = "tui";
-  }
-});
-
-// src/cli/safety/jails/darwin.ts
-import { existsSync as existsSync27 } from "node:fs";
-function sbplQuote(p3) {
-  return `"${p3.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-function buildSeatbeltProfile(spec) {
-  const lines = [
-    "(version 1)",
-    `; zelari osJail (t28) \u2014 generated from JailSpec root=${spec.root}`,
-    "(allow default)",
-    "(deny file-write*)",
-    "(allow file-write*"
-  ];
-  for (const dir of spec.writable) {
-    lines.push(`  (subpath ${sbplQuote(dir)})`);
-  }
-  lines.push(")");
-  switch (spec.network.mode) {
-    case "deny":
-      lines.push("(deny network*)");
-      break;
-    case "allow":
-      lines.push("(allow network*)");
-      break;
-    case "allow-list":
-      lines.push(
-        `; allow-list hosts (${spec.network.hosts.join(", ")}) NOT kernel-filtered \u2014 degraded to allow`,
-        "(allow network*)"
-      );
-      break;
-  }
-  return lines.join("\n");
-}
-function darwinProbe(platform, exists) {
-  if (platform !== "darwin") {
-    return {
-      backend: "seatbelt",
-      available: false,
-      reason: `platform ${platform} is not darwin`
-    };
-  }
-  if (!exists(SANDBOX_EXEC_PATH)) {
-    return {
-      backend: "seatbelt",
-      available: false,
-      reason: `${SANDBOX_EXEC_PATH} not found`
-    };
-  }
-  return {
-    backend: "seatbelt",
-    available: true,
-    reason: `sandbox-exec available at ${SANDBOX_EXEC_PATH}`
-  };
-}
-var SANDBOX_EXEC_PATH, darwinBackend;
-var init_darwin = __esm({
-  "src/cli/safety/jails/darwin.ts"() {
-    "use strict";
-    SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
-    darwinBackend = {
-      id: "seatbelt",
-      probe: () => darwinProbe(process.platform, (p3) => existsSync27(p3)),
-      wrap: (spec, program, argv) => ({
-        program: SANDBOX_EXEC_PATH,
-        argv: ["-p", buildSeatbeltProfile(spec), program, ...argv]
-      })
-    };
-  }
-});
-
-// src/cli/safety/jails/linux.ts
-import { existsSync as existsSync28 } from "node:fs";
-function findBinaryOnPath(bin, pathValue, exists) {
-  for (const dir of pathValue.split(/[:;]/)) {
-    if (!dir) continue;
-    const full = `${dir}/${bin}`;
-    if (exists(full)) return full;
-  }
-  return null;
-}
-function linuxProbe(platform, pathValue, exists) {
-  if (platform !== "linux") {
-    return { backend: "bwrap", available: false, reason: `platform ${platform} is not linux` };
-  }
-  const found = findBinaryOnPath(BWRAP_BIN, pathValue, exists);
-  if (!found) {
-    return {
-      backend: "bwrap",
-      available: false,
-      reason: `${BWRAP_BIN} not found on PATH (landlock needs native syscalls Node does not expose)`
-    };
-  }
-  return { backend: "bwrap", available: true, reason: `${BWRAP_BIN} found at ${found}` };
-}
-function buildBwrapArgs(spec, program, argv) {
-  const args = ["--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc"];
-  for (const dir of spec.writable) {
-    args.push("--bind-try", dir, dir);
-  }
-  if (spec.network.mode === "deny") {
-    args.push("--unshare-net");
-  }
-  args.push("--", program, ...argv);
-  return args;
-}
-var BWRAP_BIN, linuxBackend;
-var init_linux = __esm({
-  "src/cli/safety/jails/linux.ts"() {
-    "use strict";
-    BWRAP_BIN = "bwrap";
-    linuxBackend = {
-      id: "bwrap",
-      probe: () => linuxProbe(process.platform, process.env.PATH ?? "", (p3) => existsSync28(p3)),
-      wrap: (spec, program, argv) => ({
-        program: BWRAP_BIN,
-        argv: buildBwrapArgs(spec, program, argv)
-      })
-    };
-  }
-});
-
-// src/cli/safety/jails/win32.ts
-function win32Probe(platform) {
-  if (platform !== "win32") {
-    return { backend: "win32-restricted-token", available: false, reason: `platform ${platform} is not win32` };
-  }
-  return { backend: "win32-restricted-token", available: false, reason: WIN32_UNAVAILABLE_REASON };
-}
-var WIN32_UNAVAILABLE_REASON, win32Backend;
-var init_win32 = __esm({
-  "src/cli/safety/jails/win32.ts"() {
-    "use strict";
-    WIN32_UNAVAILABLE_REASON = "restricted-token + Job Object require native Windows APIs that pure Node does not expose (no native npm deps allowed, P5) \u2014 honest unavailable; see src/cli/safety/jails/win32.ts";
-    win32Backend = {
-      id: "win32-restricted-token",
-      probe: () => win32Probe(process.platform),
-      wrap: () => {
-        throw new Error(`win32 jail backend unavailable: ${WIN32_UNAVAILABLE_REASON}`);
-      }
-    };
-  }
-});
-
-// src/cli/safety/osJail.ts
-import { spawn as spawn10 } from "node:child_process";
-import { homedir as homedir5, tmpdir as tmpdir3 } from "node:os";
-import path50 from "node:path";
-function resolveJailMode(override, env = process.env) {
-  const v = override?.trim().toLowerCase();
-  if (v === "off") return "off";
-  if (v === "advisory") return "advisory";
-  if (v === "required") return "required";
-  if (activePolicyLoadMode(env) !== "strict") return "advisory";
-  return probeJailBackend().available ? "required" : "advisory";
-}
-function activeJailMode(env = process.env) {
-  return resolveJailMode(env[OS_JAIL_ENV], env);
-}
-function platformBackend(platform = process.platform) {
-  switch (platform) {
-    case "darwin":
-      return darwinBackend;
-    case "linux":
-      return linuxBackend;
-    default:
-      return win32Backend;
-  }
-}
-function currentBackend(platform = process.platform) {
-  return testBackend ?? platformBackend(platform);
-}
-function probeJailBackend(platform = process.platform) {
-  if (testBackend) return testBackend.probe();
-  if (!probeCache || probeCache.platform !== platform) {
-    probeCache = { platform, result: platformBackend(platform).probe() };
-  }
-  return probeCache.result;
-}
-function defaultEnvAllowlist(platform = process.platform) {
-  return platform === "win32" ? [...BASE_ENV_ALLOWLIST, ...WIN32_ENV_ALLOWLIST] : BASE_ENV_ALLOWLIST;
-}
-function defaultWritable(root, home = homedir5(), tmp = tmpdir3(), platform = process.platform) {
-  const raw = [path50.resolve(root), path50.resolve(tmp), path50.join(home, ".zelari-code")];
-  const out = [];
-  for (const p3 of raw) {
-    const key = platform === "win32" ? p3.toLowerCase() : p3;
-    if (!out.some((q) => (platform === "win32" ? q.toLowerCase() : q) === key)) out.push(p3);
-  }
-  return out;
-}
-function buildJailSpec(opts) {
-  return {
-    root: path50.resolve(opts.root),
-    network: opts.network ?? { mode: "deny" },
-    envAllowlist: opts.envAllowlist ?? defaultEnvAllowlist(),
-    writable: opts.writable ?? defaultWritable(opts.root)
-  };
-}
-function networkSpecFromClaimHosts(allowedHosts) {
-  if (!allowedHosts || allowedHosts.length === 0) return { mode: "deny" };
-  return { mode: "allow-list", hosts: [...new Set(allowedHosts)] };
-}
-function sanitizeEnv(env, allowlist, platform = process.platform) {
-  const wanted = new Set(allowlist.map((k) => platform === "win32" ? k.toLowerCase() : k));
-  const out = {};
-  for (const [k, v] of Object.entries(env)) {
-    if (v === void 0) continue;
-    const key = platform === "win32" ? k.toLowerCase() : k;
-    if (wanted.has(key)) out[k] = v;
-  }
-  return out;
-}
-function jailDenyReason(probe, mode) {
-  return `OS jail backend unavailable (${probe.backend}: ${probe.reason}) with ZELARI_OS_JAIL=${mode} \u2014 execution is DENIED instead of running unjailed (t28 golden rule: missing backend + required \u21D2 deny, never warn/skip). Set ZELARI_OS_JAIL=advisory (visible fail-open) or =off to explicitly allow unjailed execution.`;
-}
-function jailAdvisoryNotice(probe) {
-  return `advisory: OS jail backend unavailable (${probe.backend}: ${probe.reason}) \u2014 this process will run UNJAILED (visible fail-open). Set ZELARI_OS_JAIL=required to deny instead.`;
-}
-function decideJailSpawn(spec, input) {
-  const mode = input.mode ?? activeJailMode();
-  const merged = { ...input.env ?? process.env, ...input.envExtras ?? {} };
-  if (mode === "off") return { action: "spawn-plain", env: merged };
-  const probe = probeJailBackend();
-  if (!probe.available) {
-    if (mode === "required") return { action: "deny", reason: jailDenyReason(probe, mode) };
-    return { action: "spawn-plain", env: sanitizeEnv(merged, spec.envAllowlist), notice: jailAdvisoryNotice(probe) };
-  }
-  const wrapped = currentBackend().wrap(spec, input.program, input.argv);
-  return {
-    action: "spawn-jailed",
-    probe,
-    program: wrapped.program,
-    argv: wrapped.argv,
-    env: sanitizeEnv(merged, spec.envAllowlist)
-  };
-}
-function spawnJailed(spec, req) {
-  const decision = decideJailSpawn(spec, {
-    program: req.program,
-    argv: req.argv,
-    env: req.env,
-    envExtras: req.envExtras
-  });
-  if (decision.action === "deny") {
-    return { outcome: "denied", reason: `[jail] ${decision.reason}` };
-  }
-  const notice = decision.action === "spawn-plain" ? decision.notice : void 0;
-  if (notice) {
-    console.error(`[os-jail] ${notice}`);
-    req.onNotice?.(notice);
-  }
-  const jailed = decision.action === "spawn-jailed";
-  const program = jailed ? decision.program : req.program;
-  const argv = jailed ? decision.argv : [...req.argv];
-  try {
-    const child = spawn10(program, argv, {
-      cwd: req.cwd,
-      signal: req.signal,
-      shell: false,
-      env: decision.env,
-      stdio: ["ignore", "pipe", "pipe"]
-      // non-interactive by construction
-    });
-    return {
-      outcome: "spawned",
-      child,
-      backend: jailed ? decision.probe.backend : "none",
-      jailed,
-      ...notice ? { notice } : {}
-    };
-  } catch (err) {
-    return { outcome: "failed", reason: err instanceof Error ? err.message : String(err) };
-  }
-}
-function jailAvailability(env = process.env) {
-  const mode = activeJailMode(env);
-  const probe = mode === "off" ? { backend: "none", available: false, reason: "jail disabled (ZELARI_OS_JAIL=off)" } : probeJailBackend();
-  return { mode, probe };
-}
-var OS_JAIL_ENV, testBackend, probeCache, BASE_ENV_ALLOWLIST, WIN32_ENV_ALLOWLIST;
-var init_osJail = __esm({
-  "src/cli/safety/osJail.ts"() {
-    "use strict";
-    init_policyLoadMode();
-    init_darwin();
-    init_linux();
-    init_win32();
-    OS_JAIL_ENV = "ZELARI_OS_JAIL";
-    testBackend = null;
-    probeCache = null;
-    BASE_ENV_ALLOWLIST = [
-      "PATH",
-      "HOME",
-      "USER",
-      "LANG",
-      "CI",
-      "TERM",
-      "NO_COLOR"
-    ];
-    WIN32_ENV_ALLOWLIST = [
-      "PATH",
-      "Path",
-      "HOMEDRIVE",
-      "HOMEPATH",
-      "SystemRoot",
-      "SystemDrive",
-      "ComSpec",
-      "PATHEXT",
-      "TEMP",
-      "TMP",
-      "APPDATA",
-      "LOCALAPPDATA",
-      "USERPROFILE",
-      "USERNAME",
-      "MSYSTEM",
-      "PROGRAMFILES",
-      "ProgramFiles",
-      "ProgramData",
-      "OS",
-      "NUMBER_OF_PROCESSORS",
-      "PROCESSOR_ARCHITECTURE",
-      "WINDIR"
-    ];
-  }
-});
-
 // src/cli/tools/execProcess.ts
 function createExecProcessTool(root, opts = {}) {
   const baseSpec = buildJailSpec({ root });
@@ -52425,6 +52599,21 @@ var init_resolveStream = __esm({
 });
 
 // src/cli/safety/toolPermissions.ts
+var toolPermissions_exports = {};
+__export(toolPermissions_exports, {
+  PERMISSION_PRESETS: () => PERMISSION_PRESETS,
+  activePermissionPreset: () => activePermissionPreset,
+  clearSessionPermissionGrants: () => clearSessionPermissionGrants,
+  defaultPermissionPolicy: () => defaultPermissionPolicy,
+  grantSessionCategory: () => grantSessionCategory,
+  grantSessionTool: () => grantSessionTool,
+  intersectPermissionPolicy: () => intersectPermissionPolicy,
+  isAutoPermissions: () => isAutoPermissions,
+  isSessionGranted: () => isSessionGranted,
+  listSessionPermissionGrants: () => listSessionPermissionGrants,
+  parsePermissionPreset: () => parsePermissionPreset,
+  resolveToolPermission: () => resolveToolPermission
+});
 function grantSessionTool(toolName) {
   const n = toolName.trim();
   if (n) sessionToolGrants.add(n);
@@ -52436,6 +52625,12 @@ function clearSessionPermissionGrants() {
   sessionToolGrants.clear();
   sessionCategoryGrants.clear();
 }
+function listSessionPermissionGrants() {
+  return {
+    tools: [...sessionToolGrants].sort(),
+    categories: [...sessionCategoryGrants]
+  };
+}
 function isSessionGranted(toolName, required2) {
   if (sessionToolGrants.has(toolName)) return true;
   if (!required2.length) return false;
@@ -52532,6 +52727,49 @@ var init_toolPermissions = __esm({
   }
 });
 
+// src/cli/safety/destructiveCommands.ts
+function commandTextFrom(input) {
+  const parts = [];
+  if (typeof input.command === "string" && input.command) parts.push(input.command);
+  if (typeof input.program === "string" && input.program) {
+    const args = Array.isArray(input.args) ? input.args.filter((a) => typeof a === "string") : [];
+    parts.push([input.program, ...args].join(" "));
+  }
+  return parts.join(" ; ");
+}
+function destructiveCommandHit(input) {
+  const text = commandTextFrom(input);
+  if (!text) return null;
+  for (const rule of DESTRUCTIVE_RULES) {
+    if (rule.pattern.test(text)) return rule.label;
+  }
+  return null;
+}
+var DESTRUCTIVE_RULES;
+var init_destructiveCommands = __esm({
+  "src/cli/safety/destructiveCommands.ts"() {
+    "use strict";
+    DESTRUCTIVE_RULES = [
+      // `rm` with BOTH recursive and force flags, any combination (-rf, -fr, -rvf).
+      { id: "rm-recursive-force", pattern: /\brm\s+(?:-{1,2}[a-z]*r[a-z]*f|-{1,2}[a-z]*f[a-z]*r)\b/i, label: "'rm' recursive+force delete" },
+      // Windows del/rd with the /s (subdirectories) switch.
+      { id: "del-subtree", pattern: /\bdel\b[^&|;]*\/s\b/i, label: "'del /s' subtree delete" },
+      { id: "rd-subtree", pattern: /\brd\b[^&|;]*\/s\b/i, label: "'rd /s' subtree delete" },
+      // PowerShell recursive delete.
+      { id: "remove-item-recurse", pattern: /\bremove-item\b[^&|;]*-recurse\b/i, label: "'Remove-Item -Recurse' recursive delete" },
+      // Volume format (DOS/Windows drive letter form).
+      { id: "format-volume", pattern: /\bformat\s+[a-z]:/i, label: "'format <volume>:'" },
+      // History rewrite on a shared ref.
+      { id: "git-push-force", pattern: /\bgit\s+push\b[^&|;]*--force\b/i, label: "'git push --force'" },
+      // Filesystem-level destroyers.
+      { id: "mkfs", pattern: /\bmkfs(?:\.\w+)?\b/i, label: "'mkfs' filesystem format" },
+      { id: "dd-raw-device", pattern: /\bdd\b[^&|;]*of=\/dev\//i, label: "'dd' raw device write" },
+      // Root-wide permission wipe.
+      { id: "chmod-root-777", pattern: /\bchmod\s+-R\s+777\s+\/(?:\s|$)/i, label: "'chmod -R 777 /' root permission wipe" }
+    ];
+  }
+});
+
 // src/cli/safety/provenance.ts
 function provenanceEnabled() {
   return process.env.ZELARI_PROVENANCE !== "0";
@@ -53907,6 +54145,13 @@ function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence =
           }
         }
       }
+      if (action === "allow" && required2.includes("execute") && activePermissionPreset() !== "yolo" && !isSessionGranted(original.name, required2)) {
+        const destructiveHit = destructiveCommandHit(input ?? {});
+        if (destructiveHit) {
+          action = "ask";
+          actionReason = `[destructive] ${destructiveHit} - confirm before execute`;
+        }
+      }
       const claimHit = claims && claims.effect !== void 0 ? claims.matchedRules.find((x) => x.effect === claims.effect) : void 0;
       const rulePrefix = contractRule ? `[contract] rule '${contractRule.match}'${contractRule.reason ? ` \u2014 ${contractRule.reason}` : ""}` : rule ? `[policy] rule '${rule.match}'${rule.reason ? ` \u2014 ${rule.reason}` : ""}` : claimHit ? `[policy] claim '${claimHit.match}'${claimHit.reason ? ` \u2014 ${claimHit.reason}` : ""}` : "";
       if (action === "deny") {
@@ -54328,6 +54573,7 @@ var init_toolRegistry = __esm({
     init_resolveStream();
     init_providerConfig();
     init_toolPermissions();
+    init_destructiveCommands();
     init_provenance();
     init_lifecycleHooks();
     init_astGate();
@@ -66638,6 +66884,7 @@ async function runOneTurn(opts, provider, model, providerStream, extras) {
       emitExtLog(`[extensions] strict load failed: ${extLoad.error.message} \u2014 continuing WITHOUT extensions`);
     }
   }
+  const { defaultPermissionPolicy: defaultPermissionPolicy2 } = await Promise.resolve().then(() => (init_toolPermissions(), toolPermissions_exports));
   const { registry: toolRegistry } = createBuiltinToolRegistry({
     root: cwd,
     onTentacleEvent: (ev) => emitEvent(ev),
@@ -66665,14 +66912,11 @@ async function runOneTurn(opts, provider, model, providerStream, extras) {
         ...ev.type === "task_update" ? { task: ev.task } : { tasks: ev.tasks }
       });
     },
-    permissionPolicy: {
-      read: "allow",
-      write: "allow",
-      execute: "allow",
-      network: "allow",
-      ui: "allow",
-      auto: true
-    },
+    // Serve/Desktop ask-bridge: an injected handler turns "ask" rules into
+    // an interactive approval (permission.request over NDJSON) instead of
+    // the fail-closed typedErr. Absent handler ⇒ unchanged fail-closed.
+    ...opts.onPermissionAsk ? { onPermissionAsk: opts.onPermissionAsk } : {},
+    permissionPolicy: defaultPermissionPolicy2(),
     ...nativeMemory ? { memoryService: nativeMemory } : {},
     memoryAutoWrite,
     ...extensionRuntime ? { extensions: extensionRuntime } : {},
@@ -68427,6 +68671,7 @@ async function runHeadlessKrakenGraph(opts, provider, model) {
     }
     const audit = new AuditLogger2();
     const { runTentacle: runTentacle2 } = await Promise.resolve().then(() => (init_tentacle(), tentacle_exports));
+    const { defaultPermissionPolicy: defaultPermissionPolicy2 } = await Promise.resolve().then(() => (init_toolPermissions(), toolPermissions_exports));
     const executor = new KrakenGraphExecutor2({
       taskToolDeps: {
         createSubAgentContext: createKrakenSubAgentContextFactory2({
@@ -68434,17 +68679,11 @@ async function runHeadlessKrakenGraph(opts, provider, model) {
           audit,
           sessionId: sessionId2,
           // P0.4 capability inheritance: tentacles intersect the headless
-          // parent policy. Headless runs are auto-allow (the same literal
-          // the main headless registry below uses), so this is a no-op
-          // today — wired for correctness if that default ever tightens.
-          parentPolicy: {
-            read: "allow",
-            write: "allow",
-            execute: "allow",
-            network: "allow",
-            ui: "allow",
-            auto: true
-          },
+          // parent policy. Headless now uses the shared preset engine
+          // (defaultPermissionPolicy — standard = execute/network ask, and
+          // ask without a UI fails closed), so this intersection actually
+          // bites: tentacles can never exceed the preset.
+          parentPolicy: defaultPermissionPolicy2(),
           // Anchor every tentacle to the SAME provider/model this run
           // resolved (Desktop's selector, or --provider/--model), instead
           // of the persisted provider.json default the factory falls back
@@ -68555,18 +68794,12 @@ function nodeSpineEnvelopeRun(spine, runOpts, run) {
 }
 async function buildCouncilToolRegistry(planMode, opts, memoryService, memoryAutoWrite = false, extras) {
   const cwd = opts ? resolveHeadlessCwd(opts) : process.cwd();
+  const { defaultPermissionPolicy: defaultPermissionPolicy2 } = await Promise.resolve().then(() => (init_toolPermissions(), toolPermissions_exports));
   const { registry: toolRegistry } = createBuiltinToolRegistry({
     root: cwd,
     planMode,
     ...extras?.lspProvider ? { lspProvider: extras.lspProvider } : {},
-    permissionPolicy: {
-      read: "allow",
-      write: "allow",
-      execute: "allow",
-      network: "allow",
-      ui: "allow",
-      auto: true
-    },
+    permissionPolicy: defaultPermissionPolicy2(),
     ...memoryService ? { memoryService } : {},
     memoryAutoWrite
   });
@@ -69084,17 +69317,11 @@ ${ragContext}` : slicePrompt;
         const { composeProjectContext: composeProjectContext2 } = await Promise.resolve().then(() => (init_composeContext(), composeContext_exports));
         const { loadDurableContext: loadDurableContext2 } = await Promise.resolve().then(() => (init_loadDurableContext(), loadDurableContext_exports));
         const { detectDegradedRun: detectDegradedRun2 } = await Promise.resolve().then(() => (init_council(), council_exports));
+        const { defaultPermissionPolicy: defaultPermissionPolicy2 } = await Promise.resolve().then(() => (init_toolPermissions(), toolPermissions_exports));
         const { registry: agentRegistry } = createBuiltinToolRegistry2({
           root: projectRoot,
           planMode: false,
-          permissionPolicy: {
-            read: "allow",
-            write: "allow",
-            execute: "allow",
-            network: "allow",
-            ui: "allow",
-            auto: true
-          }
+          permissionPolicy: defaultPermissionPolicy2()
         });
         await registerHeadlessMcp(agentRegistry, opts);
         const durableState = await loadDurableContext2(projectRoot);
@@ -70821,6 +71048,87 @@ var init_config = __esm({
   }
 });
 
+// src/cli/serve/permissionBridge.ts
+function applyTurnPermissionPreset(input) {
+  if (!input || typeof input !== "object") return false;
+  const raw = input.permissionPreset;
+  if (typeof raw !== "string") return false;
+  const value = raw.trim().toLowerCase();
+  if (!SERVE_PERMISSION_PRESETS.includes(value)) {
+    return false;
+  }
+  process.env[PRESET_ENV] = value;
+  return true;
+}
+function createServePermissionBridge(write, timeoutMs2 = 12e4) {
+  const pending = /* @__PURE__ */ new Map();
+  let seq = 0;
+  const settle = (requestId, decision) => {
+    const entry = pending.get(requestId);
+    if (!entry) return false;
+    pending.delete(requestId);
+    clearTimeout(entry.timer);
+    entry.resolve(decision);
+    return true;
+  };
+  return {
+    onPermissionAsk(payload) {
+      const requestId = `perm-${Date.now()}-${++seq}`;
+      return new Promise((resolve9) => {
+        const timer = setTimeout(() => {
+          settle(requestId, "deny");
+        }, timeoutMs2);
+        pending.set(requestId, { resolve: resolve9, timer });
+        write(
+          JSON.stringify({
+            type: "permission.request",
+            requestId,
+            tool: payload.tool,
+            category: payload.category,
+            ...payload.inputPreview !== void 0 ? { inputPreview: payload.inputPreview } : {},
+            ...payload.reason !== void 0 ? { reason: payload.reason } : {}
+          })
+        );
+      });
+    },
+    respond: settle,
+    pendingCount: () => pending.size
+  };
+}
+function servePermissionRespond(bridge, params) {
+  if (!params || typeof params !== "object") {
+    return { accepted: false, reason: "permission.respond requires an object params" };
+  }
+  const { requestId, decision } = params;
+  if (typeof requestId !== "string" || requestId.length === 0) {
+    return { accepted: false, reason: "permission.respond requires a non-empty string requestId" };
+  }
+  if (decision !== "allow" && decision !== "deny") {
+    return { accepted: false, reason: "permission.respond decision must be 'allow' or 'deny'" };
+  }
+  return { accepted: bridge.respond(requestId, decision) };
+}
+function asRegistryAskHandler(bridge) {
+  return async (req) => {
+    const reason = req.policyNote !== void 0 ? `${req.reason} ${req.policyNote}`.trim() : req.reason;
+    const decision = await bridge.onPermissionAsk({
+      tool: req.toolName,
+      category: req.categories.join(",") || "other",
+      reason,
+      ...req.claims && req.claims.length > 0 ? { inputPreview: req.claims.map((c) => c.summary).join(" \xB7 ") } : {}
+    });
+    return decision === "allow";
+  };
+}
+var SERVE_PERMISSION_PRESETS, PRESET_ENV;
+var init_permissionBridge = __esm({
+  "src/cli/serve/permissionBridge.ts"() {
+    "use strict";
+    SERVE_PERMISSION_PRESETS = ["standard", "strict", "yolo"];
+    PRESET_ENV = "ZELARI_PERMISSION_PRESET";
+  }
+});
+
 // src/cli/serve/spineLockSweep.ts
 import { promises as fs47 } from "node:fs";
 import path94 from "node:path";
@@ -70934,7 +71242,7 @@ function resolveTurnLspProvider(services) {
   const candidate = services?.lspManager;
   return candidate instanceof LspManager ? candidate : void 0;
 }
-function createCliRunTurn() {
+function createCliRunTurn(onPermissionAsk) {
   let streamPromise = null;
   const ensureStream = () => {
     if (!streamPromise) {
@@ -70960,6 +71268,8 @@ function createCliRunTurn() {
   return async (input, deps) => {
     const { provider, model, stream } = await ensureStream();
     const opts = bindHarnessTurnOptions(input, deps.session.workspaceRoot);
+    if (onPermissionAsk) opts.onPermissionAsk = onPermissionAsk;
+    applyTurnPermissionPreset(input);
     const lspProvider = resolveTurnLspProvider(deps.services);
     const exitCode = await dispatchHeadlessTurn(
       opts,
@@ -70993,15 +71303,26 @@ function startHarnessServer(options = {}) {
   const respond = (envelope) => {
     write(JSON.stringify(envelope));
   };
+  const permissionBridge = createServePermissionBridge(write);
   const dispatch = async (req) => {
     if (typeof req.method !== "string") {
       return { id: req.id ?? null, ok: false, error: { code: "bad_request", message: "missing method" } };
     }
     const params = req.params ?? {};
     switch (req.method) {
+      case "permission.respond": {
+        return {
+          id: req.id ?? null,
+          ok: true,
+          result: servePermissionRespond(permissionBridge, params)
+        };
+      }
       case "session.create": {
         const root = typeof params.workspaceRoot === "string" ? params.workspaceRoot : process.cwd();
-        const session = server.createSession({ workspaceRoot: root, runTurn: options.runTurn ?? createCliRunTurn() });
+        const session = server.createSession({
+          workspaceRoot: root,
+          runTurn: options.runTurn ?? createCliRunTurn(asRegistryAskHandler(permissionBridge))
+        });
         return { id: req.id ?? null, ok: true, result: { sessionId: session.id, workspaceRoot: session.workspaceRoot } };
       }
       case "run.turn": {
@@ -71153,6 +71474,7 @@ var init_harnessServer = __esm({
     init_completionProofPersist();
     init_policyGate();
     init_policyLoadMode();
+    init_permissionBridge();
     init_spineLockSweep();
   }
 });
@@ -73381,12 +73703,13 @@ function StatusBar({
   krakenLive = null,
   krakenGraph = null,
   verify = null,
-  permissions = null
+  permissions = null,
+  jail = null
 }) {
   const ctxLabel = contextLimit > 0 ? `${formatTokens(contextUsed)}/${formatTokens(contextLimit)}` : contextUsed > 0 ? formatTokens(contextUsed) : null;
   const modeLabel = mode === "council" ? "council" : mode === "zelari" ? "zelari" : "kraken";
   const modeColor = mode === "council" ? "magenta" : mode === "zelari" ? "green" : "red";
-  return /* @__PURE__ */ React6.createElement(Box5, { paddingX: 1, width: "100%", justifyContent: "space-between", gap: 2 }, /* @__PURE__ */ React6.createElement(Box5, { flexShrink: 2 }, /* @__PURE__ */ React6.createElement(Text6, { wrap: "truncate" }, /* @__PURE__ */ React6.createElement(Text6, { color: sessionActive ? "green" : "gray" }, sessionActive ? "\u25CF" : "\u25CB"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: phase2 === "plan" ? "yellow" : "green" }, phase2 === "plan" ? "\u25C7 plan" : "\u25C6 build"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: modeColor }, modeLabel), verify ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: verify.tone }, verify.label)) : null, permissions ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: permissions.tone }, permissions.label)) : null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, provider), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, null, model), cwd ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { color: "blue" }, cwd)) : null)), /* @__PURE__ */ React6.createElement(Box5, { flexShrink: 1 }, /* @__PURE__ */ React6.createElement(Text6, { wrap: "truncate" }, busy && elapsedMs !== null ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Spinner, { color: "yellow" }), /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, " ", formatDuration(elapsedMs)), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : lastMs !== null ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, "last ", formatDuration(lastMs)), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, queueCount > 0 ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, "queue ", queueCount), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, todoSummary ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, todoSummary), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, krakenLive ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, krakenLive), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, krakenGraph ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, krakenGraph), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, ctxLabel ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "cyan" }, ctxLabel), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, costUsd > 0 ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, formatCost(costUsd)), cachedTokens > 0 ? /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (", formatTokens(cachedTokens), " cached)") : null, cacheHitRate > 0 ? /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " ", Math.round(cacheHitRate * 100), "% hit") : null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, "session ", sessionId2))));
+  return /* @__PURE__ */ React6.createElement(Box5, { paddingX: 1, width: "100%", justifyContent: "space-between", gap: 2 }, /* @__PURE__ */ React6.createElement(Box5, { flexShrink: 2 }, /* @__PURE__ */ React6.createElement(Text6, { wrap: "truncate" }, /* @__PURE__ */ React6.createElement(Text6, { color: sessionActive ? "green" : "gray" }, sessionActive ? "\u25CF" : "\u25CB"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: phase2 === "plan" ? "yellow" : "green" }, phase2 === "plan" ? "\u25C7 plan" : "\u25C6 build"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: modeColor }, modeLabel), verify ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: verify.tone }, verify.label)) : null, permissions ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: permissions.tone }, permissions.label)) : null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), jail ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: jail.tone }, jail.label)) : null, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, provider), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, null, model), cwd ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 "), /* @__PURE__ */ React6.createElement(Text6, { color: "blue" }, cwd)) : null)), /* @__PURE__ */ React6.createElement(Box5, { flexShrink: 1 }, /* @__PURE__ */ React6.createElement(Text6, { wrap: "truncate" }, busy && elapsedMs !== null ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Spinner, { color: "yellow" }), /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, " ", formatDuration(elapsedMs)), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : lastMs !== null ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, "last ", formatDuration(lastMs)), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, queueCount > 0 ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, "queue ", queueCount), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, todoSummary ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, todoSummary), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, krakenLive ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, krakenLive), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, krakenGraph ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, krakenGraph), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, ctxLabel ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "cyan" }, ctxLabel), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, costUsd > 0 ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, formatCost(costUsd)), cachedTokens > 0 ? /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (", formatTokens(cachedTokens), " cached)") : null, cacheHitRate > 0 ? /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " ", Math.round(cacheHitRate * 100), "% hit") : null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " \xB7 ")) : null, /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, "session ", sessionId2))));
 }
 
 // src/cli/components/SelectList.tsx
@@ -73655,75 +73978,8 @@ function useExecutionTimer(busy, tickMs = 1e3) {
 init_paths2();
 init_sessionTodos();
 init_krakenLive();
-
-// src/cli/kraken/verifyStatus.ts
-init_verificationBridge();
-function verifyStateFromGate(evaluation) {
-  if (!evaluation.blocked) return "pass";
-  const verdict = evaluation.evaluation?.verdict;
-  if (verdict === "BLOCKED") return "blocked";
-  return "repair";
-}
-function formatVerifyChip(state3) {
-  if (state3 === "pass") return { label: "prova: PASS", tone: "green" };
-  if (state3 === "blocked") return { label: "prova: BLOCCATO", tone: "red" };
-  return { label: "prova: RIPARA", tone: "yellow" };
-}
-function permissionsChip(phase2, strictOn = strictDoneEnabled()) {
-  if (phase2 === "plan") return { label: "scrive: no (piano)", tone: "yellow" };
-  return strictOn ? { label: "scrive: s\xEC \xB7 prova obbligatoria", tone: "green" } : { label: "scrive: s\xEC \xB7 senza prova (dichiarato)", tone: "yellow" };
-}
-function formatStrictBlockExplanation(evaluation) {
-  const state3 = verifyStateFromGate(evaluation);
-  const gate = evaluation.gate;
-  if (state3 === "pass") {
-    return `[verifica] PASS \u2014 ${gate.passed}/${gate.total} prove superate.`;
-  }
-  const word = state3 === "blocked" ? "BLOCCATO" : "RIPARA";
-  const lines = [
-    `[verifica] ${word} \u2014 ${gate.passed}/${gate.total} prove superate; il turno non pu\xF2 dichiararsi finito senza prova.`
-  ];
-  const evalr = evaluation.evaluation ?? null;
-  if (evalr) {
-    const byId = /* @__PURE__ */ new Map();
-    for (const c of evalr.criteria ?? []) byId.set(c.id, c.text);
-    const unsatisfied = (evalr.results ?? []).filter((r) => r.status !== "pass");
-    if (unsatisfied.length > 0) {
-      lines.push("Mancano:");
-      for (const r of unsatisfied.slice(0, 8)) {
-        lines.push(`  \u2022 ${byId.get(r.criterionId) ?? r.criterionId} [${r.status}]`);
-      }
-      if (unsatisfied.length > 8) {
-        lines.push(`  \u2022 \u2026 e altri ${unsatisfied.length - 8}`);
-      }
-      const first = byId.get(unsatisfied[0].criterionId) ?? unsatisfied[0].criterionId;
-      lines.push(
-        state3 === "blocked" ? `Prossimo comando: /verify \u2014 poi porta evidenza per \xAB${first}\xBB e riprova.` : `Prossimo comando: ripara \xAB${first}\xBB, poi /verify per ricontrollare.`
-      );
-    }
-  }
-  lines.push(
-    "La prova \xE8 obbligatoria: chiudo il turno solo quando ogni criterio richiesto ha evidenza."
-  );
-  return lines.join("\n");
-}
-function recordStrictGateEvaluation(evaluation) {
-  const g = globalThis;
-  g.__zelariVerifyState = {
-    state: verifyStateFromGate(evaluation),
-    at: Date.now(),
-    passed: evaluation.gate.passed,
-    total: evaluation.gate.total
-  };
-}
-function getVerifyChip() {
-  const g = globalThis;
-  const s = g.__zelariVerifyState;
-  if (!s) return null;
-  return formatVerifyChip(s.state);
-}
-
-// src/cli/app.tsx
+init_verifyStatus();
+init_osJail();
 init_graphStatus();
 
 // packages/core/dist/agents/skills/builtin/debugging.js
@@ -76304,6 +76560,7 @@ init_delegationPolicy();
 init_completionGate();
 init_verificationBridge();
 init_completionProof();
+init_verifyStatus();
 init_nativeVerification();
 init_spineTelemetry();
 
@@ -78581,6 +78838,7 @@ function handleSlashCommand(text, availableSkills) {
   /state restore [id] [--no-tree] \u2014 set HEAD + optional git checkpoint restore
   /cache stats \u2014 prompt-cache hit rate, premium vs cached, stable busts
   /index [status] \u2014 build the semantic code index for semantic_search
+  /verify \u2014 re-evaluate the strict completion gate (deterministic, no LLM; criteria + next command)
   /mode [kraken|council|zelari] \u2014 switch dispatch mode (same as shift+tab; agent=alias kraken)
   /kraken [sessionId] \u2014 show Kraken tentacle radio (last spawns)
   /trust [path] \u2014 trust a folder so project MCP + project hooks load
@@ -79082,6 +79340,9 @@ ${formatSkillList(availableSkills)}`
     case "view-plan": {
       return { handled: true, kind: "view_plan" };
     }
+    case "verify": {
+      return { handled: true, kind: "verify" };
+    }
     case "index": {
       return args[0] === "status" ? { handled: true, kind: "index_status" } : { handled: true, kind: "index_build" };
     }
@@ -81817,6 +82078,21 @@ function useSlashDispatch(params) {
       setInput("");
       return;
     }
+    if (result.kind === "verify") {
+      try {
+        const { evaluateStrictBuildGate: evaluateStrictBuildGate2 } = await Promise.resolve().then(() => (init_verificationBridge(), verificationBridge_exports));
+        const { formatStrictBlockExplanation: formatStrictBlockExplanation2 } = await Promise.resolve().then(() => (init_verifyStatus(), verifyStatus_exports));
+        const evaluation = await evaluateStrictBuildGate2("build");
+        appendSystem(setMessages, `[verify] ${formatStrictBlockExplanation2(evaluation)}`);
+      } catch (err) {
+        appendSystem(
+          setMessages,
+          `[verify] gate unavailable: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      setInput("");
+      return;
+    }
     if (result.kind === "promote_member" && result.promoteMemberId) {
       await handlePromoteMember(baseCtx, result.promoteMemberId);
       setInput("");
@@ -82005,6 +82281,15 @@ function useTerminalSize(options = {}) {
 // src/cli/app.tsx
 init_chatStats();
 init_duration();
+function jailStatusChip() {
+  const mode = activeJailMode();
+  if (mode === "off") return null;
+  const probe = probeJailBackend();
+  if (!probe.available) {
+    return { label: `jail: advisory (${probe.backend})`, tone: "yellow" };
+  }
+  return mode === "required" ? { label: `jail: on (${probe.backend})`, tone: "green" } : { label: `jail: advisory (${probe.backend})`, tone: "yellow" };
+}
 var MODEL = process.env.OPENAI_MODEL ?? "grok-4.5";
 var providerDefaults = {
   "openai-compatible": "grok-4.5",
@@ -82220,7 +82505,8 @@ function App() {
       krakenLive: formatKrakenLiveSummary() ?? void 0,
       krakenGraph: formatKrakenGraphSummary() ?? void 0,
       verify: getVerifyChip() ?? void 0,
-      permissions: permissionsChip(phase2)
+      permissions: permissionsChip(phase2),
+      jail: jailStatusChip()
     }
   )), sidebarOpen && /* @__PURE__ */ React10.createElement(Sidebar, { version: VERSION, changes: gitChanges, rows: size.rows })));
 }
@@ -83299,6 +83585,14 @@ function pickRootComponent() {
     return { kind: "done" };
   }
   if (argv.includes("--doctor") || argv.includes("doctor")) {
+    if (argv.includes("--json")) {
+      const { collectDoctorReport: collectDoctorReport2 } = (init_doctor(), __toCommonJS(doctor_exports));
+      void collectDoctorReport2().then((report) => {
+        console.log(JSON.stringify(report));
+        process.exit(report.healthy ? 0 : 1);
+      });
+      return { kind: "done" };
+    }
     const { runDoctor: runDoctor2 } = (init_doctor(), __toCommonJS(doctor_exports));
     void runDoctor2().then((healthy) => process.exit(healthy ? 0 : 1));
     return { kind: "done" };
@@ -83418,7 +83712,7 @@ proposals: npm run evolve:propose \u2014 decisions in npm run evolve:decide (P1:
   }
   if (argv.includes("--help") || argv.includes("-h")) {
     console.log(
-      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor            Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --inspect [--json]  Unified project inspection (config, skills, MCP,\n                      hooks, plugins, AGENTS.md, trust status)\n  --trust [path]      Trust the cwd (or path) so project MCP + hooks load\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --permission-mcp <socket>  MCP stdio server for external agent permission prompts\n                      (spawned by claude --permission-prompt-tool)\n  --memory-mcp       Optional MCP stdio server for project memory\n    --cwd <path>      Trusted project root (requires ZELARI_MEMORY_MCP=1)\n    --client-id <id>  Stable local owner identity for private memories\n  --memory-json <json>  Read-only project-memory bridge for Zelari Desktop\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode kraken|council|zelari  Dispatch mode (default: kraken; agent=alias)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n    --profile <id>     Capability profile (minimal/v1|kraken/v1|council/v1|mission/v1)\n    --resume <id>      Continue a 2.0 spine session\n    --export-session <path>  Write zelari-session-export/1 after the run\n    --strict-done      Evidence-based BUILD completion gate\n    --task-file <path>  Read the task prompt from a file (Windows argv cap)\n    --once             Single-cycle run (cron/git-hook triggers, ADR-0014)\n    --kraken-graph <goal>  Plan + execute a Kraken task graph\n                      (variant: --kraken-graph-file <path>; kill-switch\n                      ZELARI_KRAKEN_GRAPH=0)\n    --plan-only        Serialize the graph plan to .zelari/radio/ and exit 0\n    --run-plan <id>    Execute a pre-built .zelari/radio/plan-<id>.json\n    --gauntlet         Host-driven gauntlet loop (builder/critic tentacles)\n  --session-export <id>  Print a portable 2.0 session export (no LLM)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --serve-harness     Long-lived harness kernel for hosts (NDJSON JSON-RPC\n                      on stdin/stdout; Desktop/companion transport)\n  --print-config      Print provider/model config as JSON (no secrets)\n  --print-settings    Print zelari.config.json values + the origin of\n                      each (default < user < project < env)\n  --permissions <p>   Permission preset: strict | standard | yolo \u2014 changes\n                      category DEFAULTS only (env vars and policy files win)\n  --evolve-status     Evolution ledger stats (read-only; ADR-0036; the\n                      ledger is written only when ZELARI_EVOLUTION=shadow)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n    --thinking <spec>  Thinking effort (auto|off|low|medium|high|budget:N)\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --login-oauth       Start subscription OAuth (grok, chatgpt, anthropic)\n    --provider <id>    grok | chatgpt | anthropic\n    --code <paste>    Anthropic magic-link code (CODE#STATE)\n    --no-browser      Do not open the system browser\n  --refresh-oauth     Force-refresh an OAuth access token\n    --provider <id>    grok | chatgpt | anthropic\n  --logout-oauth      Clear stored OAuth credentials\n    --provider <id>    grok | chatgpt | anthropic\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable for stdio servers\n    --url <endpoint>  Streamable HTTP endpoint (e.g. UE 5.8 editor)\n    --args <json>     JSON array of args (stdio, optional)\n    --timeout <ms>    Per-server request timeout (http, optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --preset unreal-mcp  Unreal Engine 5.8+ editor (MCP over HTTP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ZELARI_MEMORY_MCP=1  Enable the optional external memory MCP server\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
+      "zelari-code \u2014 AI Council coding agent CLI.\n\nUsage: zelari-code [options]\n\nOptions:\n  --version, -v       Print version and exit\n  --help, -h          Print this help and exit\n  --doctor [--json]   Diagnose install health (shim, bundle, PATH, deps,\n                      node/git/bash in the agent shell)\n  --inspect [--json]  Unified project inspection (config, skills, MCP,\n                      hooks, plugins, AGENTS.md, trust status)\n  --trust [path]      Trust the cwd (or path) so project MCP + hooks load\n  --fix-path          Add the npm global prefix to the user PATH\n                      (Windows only; fixes 'command not found' after install)\n  --fix-budget        Set recommended ZELARI_MAX_TOOL_LOOP_HARD=180,\n                      ZELARI_MAX_TOOL_LOOP_ITERATIONS=60, ZELARI_CONTEXT_LIMIT=400000\n                      at User scope (prevents the agent stopping mid-task)\n  --permission-mcp <socket>  MCP stdio server for external agent permission prompts\n                      (spawned by claude --permission-prompt-tool)\n  --memory-mcp       Optional MCP stdio server for project memory\n    --cwd <path>      Trusted project root (requires ZELARI_MEMORY_MCP=1)\n    --client-id <id>  Stable local owner identity for private memories\n  --memory-json <json>  Read-only project-memory bridge for Zelari Desktop\n  --skip-checks       Skip the boot-time prerequisite check\n                      (alias for ZELARI_SKIP_PREFLIGHT=1)\n  --no-wizard         Skip the first-run wizard\n  --reset-config      Re-run the wizard (clears provider.json on commit)\n  --headless          Run a single task without mounting the TUI\n    --task <text>       Task prompt (required in headless mode)\n    --output json|plain Output format (default: json)\n    --mode kraken|council|zelari  Dispatch mode (default: kraken; agent=alias)\n    --council          Alias for --mode council\n    --phase plan|build  Work phase (default: build)\n    --provider <id>    Provider override (default: active)\n    --model <id>       Model override (default: provider default)\n    --profile <id>     Capability profile (minimal/v1|kraken/v1|council/v1|mission/v1)\n    --resume <id>      Continue a 2.0 spine session\n    --export-session <path>  Write zelari-session-export/1 after the run\n    --strict-done      Evidence-based BUILD completion gate\n    --task-file <path>  Read the task prompt from a file (Windows argv cap)\n    --once             Single-cycle run (cron/git-hook triggers, ADR-0014)\n    --kraken-graph <goal>  Plan + execute a Kraken task graph\n                      (variant: --kraken-graph-file <path>; kill-switch\n                      ZELARI_KRAKEN_GRAPH=0)\n    --plan-only        Serialize the graph plan to .zelari/radio/ and exit 0\n    --run-plan <id>    Execute a pre-built .zelari/radio/plan-<id>.json\n    --gauntlet         Host-driven gauntlet loop (builder/critic tentacles)\n  --session-export <id>  Print a portable 2.0 session export (no LLM)\n  serve               Companion host for Android/remote clients (Tailscale)\n    --bind <ip>       Listen address (default: 127.0.0.1; use Tailscale IP)\n    --port <n>        Port (default: 7421)\n    --token <secret>  Bearer token (default: ~/.zelari-code/companion.token)\n    --project <path>  Allowlisted project root (repeatable)\n    --save-projects   Persist --project list to companion.json\n  --serve-harness     Long-lived harness kernel for hosts (NDJSON JSON-RPC\n                      on stdin/stdout; Desktop/companion transport)\n  --print-config      Print provider/model config as JSON (no secrets)\n  --print-settings    Print zelari.config.json values + the origin of\n                      each (default < user < project < env)\n  --permissions <p>   Permission preset: strict | standard | yolo \u2014 changes\n                      category DEFAULTS only (env vars and policy files win)\n  --evolve-status     Evolution ledger stats (read-only; ADR-0036; the\n                      ledger is written only when ZELARI_EVOLUTION=shadow)\n  --plugins-status    JSON status of optional plugins (Playwright, eslint, \u2026)\n  --plugins-install <id>  Install plugin (playwright also fetches Chromium)\n    --cwd <path>       Workspace for -D installs (default: process.cwd())\n  --set-config        Persist provider/model/endpoint\n    --provider <id>    Set active provider\n    --model <id>       Set model for that provider\n    --endpoint <url>   Custom OpenAI-compatible base URL\n    --endpoint-clear   Remove custom endpoint override\n    --thinking <spec>  Thinking effort (auto|off|low|medium|high|budget:N)\n  --set-key           Store an API key (never printed back)\n    --provider <id>    Provider id (required)\n    --key <secret>     API key (required)\n  --login-oauth       Start subscription OAuth (grok, chatgpt, anthropic)\n    --provider <id>    grok | chatgpt | anthropic\n    --code <paste>    Anthropic magic-link code (CODE#STATE)\n    --no-browser      Do not open the system browser\n  --refresh-oauth     Force-refresh an OAuth access token\n    --provider <id>    grok | chatgpt | anthropic\n  --logout-oauth      Clear stored OAuth credentials\n    --provider <id>    grok | chatgpt | anthropic\n  --discover-models   Refresh model list for a provider\n    --provider <id>    Provider (default: active)\n  --print-mcp         Print MCP server config (user + project)\n    --cwd <path>      Project root for .zelari/mcp.json\n  --set-mcp           Add/update an MCP server entry\n    --name <id>       Server name (required)\n    --command <bin>   Executable for stdio servers\n    --url <endpoint>  Streamable HTTP endpoint (e.g. UE 5.8 editor)\n    --args <json>     JSON array of args (stdio, optional)\n    --timeout <ms>    Per-server request timeout (http, optional)\n    --scope user|project  Default: user\n    --enabled true|false  Default: true\n    --cwd <path>      Required when scope=project\n  --set-mcp-preset    Install a named MCP preset (e.g. cua)\n    --preset cua      Cua Driver desktop computer-use (MCP)\n    --preset unreal-mcp  Unreal Engine 5.8+ editor (MCP over HTTP)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-mcp        Remove an MCP server entry\n    --name <id> --scope user|project [--cwd <path>]\n  --print-skills      Print skills (builtin + user + project)\n    --cwd <path>      Project root for .zelari/skills\n  --set-skill         Add/update a SKILL.md skill\n    --name <id>       Skill id (required)\n    --description <t> One-line description (required)\n    --body <text>     Markdown instructions (required)\n    --category <c>    plan|refactor|debug|review|test|docs|ops|git|db|maint\n    --tools <csv>     Comma-separated required tools (optional)\n    --cost <l>        low|medium|high (default: medium)\n    --scope user|project  Default: user\n    --cwd <path>      Required when scope=project\n  --remove-skill      Remove a user/project SKILL.md\n    --name <id> --scope user|project [--cwd <path>]\n  --generate-skill-from-url  Fetch URL + draft skill via model (JSON)\n    --url <https://...>  Required\n    --provider <id>   Override active provider\n    --model <name>    Override model for the selected provider\n  --print-ssh-targets Print SSH deploy/monitor targets\n  --set-ssh-target    Upsert target (--json '{...}' or flags)\n  --remove-ssh-target --id <id>\n  --test-ssh-target   --id <id>  (BatchMode ssh true)\n  --print-ssh-pubkey  --path <private-or-.pub>  (display public key)\n\nEnvironment:\n  ZELARI_NO_WIZARD=1    Skip the first-run wizard\n  ZELARI_SKIP_PREFLIGHT=1  Skip the boot prerequisite check\n  ZELARI_NO_PLUGIN_PROMPT=1  Skip the boot plugin-install prompt\n  ZELARI_MEMORY_MCP=1  Enable the optional external memory MCP server\n  ANATHEMA_DEV=1        Disable background update check + preflight\n"
     );
     process.exit(0);
   }