@attalabs/vinaya 0.19.3 → 0.20.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync27 } from "node:fs";
+import { readFileSync as readFileSync28 } from "node:fs";
 import { dirname as dirname9, join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -182,6 +182,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -724,6 +731,141 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/report-tokens.ts
+function formatTokensLine(input) {
+  const model = input.modelOverride ?? input.summary?.model ?? "—";
+  if (!input.summary) {
+    return `Tokens: ${input.phase} — ${input.role} — ${model} — —`;
+  }
+  const { inputTokens, cacheCreationInputTokens, cacheReadInputTokens, outputTokens } = input.summary.components;
+  const tokensIn = inputTokens + cacheCreationInputTokens + cacheReadInputTokens;
+  return `Tokens: ${input.phase} — ${input.role} — ${model} — ${tokensIn}/${outputTokens}/—`;
+}
+function formatBreakdown(summary) {
+  const { inputTokens, cacheCreationInputTokens, cacheReadInputTokens, outputTokens } = summary.components;
+  return [
+    `  fresh input tokens:    ${inputTokens}`,
+    `  cache creation tokens: ${cacheCreationInputTokens}`,
+    `  cache read tokens:     ${cacheReadInputTokens}`,
+    `  output tokens:         ${outputTokens}`,
+    `  model:                 ${summary.model ?? "—"}`,
+    `  messages summed:       ${summary.messageCount}`
+  ].join(`
+`);
+}
+// ../../packages/aeg-core/src/claude-code-transcript.ts
+function summarizeTranscript(jsonl) {
+  const seen = new Set;
+  const components = {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheCreationInputTokens: 0,
+    cacheReadInputTokens: 0
+  };
+  let model = null;
+  let messageCount = 0;
+  for (const rawLine of jsonl.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line)
+      continue;
+    let entry2;
+    try {
+      entry2 = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!entry2 || typeof entry2 !== "object")
+      continue;
+    const obj = entry2;
+    if (obj.type !== "assistant")
+      continue;
+    const message = obj.message;
+    const id = message?.id;
+    const usage = message?.usage;
+    if (typeof id !== "string" || !id || !usage || seen.has(id))
+      continue;
+    seen.add(id);
+    messageCount++;
+    components.inputTokens += numberOr(usage.input_tokens, 0);
+    components.outputTokens += numberOr(usage.output_tokens, 0);
+    components.cacheCreationInputTokens += numberOr(usage.cache_creation_input_tokens, 0);
+    components.cacheReadInputTokens += numberOr(usage.cache_read_input_tokens, 0);
+    const messageModel = message?.model;
+    if (typeof messageModel === "string" && messageModel)
+      model = messageModel;
+  }
+  return { components, model, messageCount };
+}
+function numberOr(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function sanitizeKey(value) {
+  return value.replace(/[^A-Za-z0-9]+/g, "-");
+}
+function transcriptPointerPath(projectDir, tmpDir) {
+  return `${tmpDir}/claude-transcript-${sanitizeKey(projectDir)}.txt`;
+}
+function resolvePointer(explicitTranscriptPath, deps) {
+  if (explicitTranscriptPath)
+    return { path: explicitTranscriptPath };
+  const projectDir = deps.env.CLAUDE_PROJECT_DIR ?? deps.cwd;
+  const tmpDir = deps.env.TMPDIR ?? "/tmp";
+  const pointerPath = transcriptPointerPath(projectDir, tmpDir);
+  if (!deps.exists(pointerPath)) {
+    return {
+      error: `No transcript pointer at ${pointerPath} and no --transcript given. ` + "Either this repo installs no track-transcript.sh Stop hook (lacking one is not a defect — " + "name the transcript directly instead), or no session has completed a turn yet."
+    };
+  }
+  let contents;
+  try {
+    contents = deps.readFile(pointerPath).trim();
+  } catch (err) {
+    return { error: `Transcript pointer at ${pointerPath} could not be read: ${err.message}` };
+  }
+  const [pointerSessionId, transcriptPath] = contents.split("\t");
+  if (!transcriptPath) {
+    return { error: `Transcript pointer file ${pointerPath} is malformed: "${contents}"` };
+  }
+  const currentSessionId = deps.env.CLAUDE_CODE_SESSION_ID;
+  if (currentSessionId && pointerSessionId && currentSessionId !== pointerSessionId) {
+    return {
+      error: `Transcript pointer at ${pointerPath} is stale: written for session ${pointerSessionId}, ` + `but this session is ${currentSessionId}. Name your own transcript with --transcript instead of ` + "reporting another session's figures as yours."
+    };
+  }
+  return { path: transcriptPath };
+}
+function resolveMeteringCapability(deps, explicitTranscriptPath) {
+  const resolved = resolvePointer(explicitTranscriptPath, deps);
+  if ("error" in resolved) {
+    return { capable: false, reason: "no-transcript-resolved", detail: resolved.error };
+  }
+  if (!deps.exists(resolved.path)) {
+    return {
+      capable: false,
+      reason: "transcript-unreadable",
+      detail: `Resolved transcript path ${resolved.path} does not exist.`
+    };
+  }
+  let jsonl;
+  try {
+    jsonl = deps.readFile(resolved.path);
+  } catch (err) {
+    return {
+      capable: false,
+      reason: "transcript-unreadable",
+      detail: `Transcript at ${resolved.path} could not be read: ${err.message}`
+    };
+  }
+  const summary = summarizeTranscript(jsonl);
+  if (summary.messageCount === 0) {
+    return {
+      capable: false,
+      reason: "transcript-empty",
+      detail: `Transcript at ${resolved.path} yielded zero assistant messages with usage data — ` + "it's empty, unparseable, or not yet flushed to disk."
+    };
+  }
+  return { capable: true, transcriptPath: resolved.path, summary };
+}
 // ../../packages/aeg-core/src/file-classify.ts
 function isCodeFile(p) {
   if (p.endsWith(".md"))
@@ -1368,6 +1510,14 @@ function checkDirectMainPush(fact) {
     return { verdict: "legitimate", mergedPrNumber: first };
   return { verdict: "direct-push", sha: fact.sha };
 }
+// ../../packages/aeg-core/src/ensure-label.ts
+var LABEL_COLOR = "B60205";
+function ensureLabelExists(repoFlag, name, description, io) {
+  const existing = io.listLabelNames(repoFlag);
+  if (existing.includes(name))
+    return;
+  io.createLabel(repoFlag, name, description, LABEL_COLOR);
+}
 // ../../packages/aeg-core/src/dead-branch-push-audit.ts
 function findDeadBranchPushes(facts) {
   return facts.filter((f) => new Date(f.latestCommitAt).getTime() > new Date(f.resolvedAt).getTime()).map(({ branch, prNumber, prState, resolvedAt, latestCommitAt }) => ({
@@ -1634,6 +1784,91 @@ function buildClaudeCommandOps() {
   ];
 }
 
+// src/lib/claude-stop-hook-emitter.ts
+var CLAUDE_STOP_HOOK_GROUP = "Claude Code Stop hook (transcript pointer)";
+var CLAUDE_STOP_HOOK_MARKER = "track-transcript";
+var CLAUDE_STOP_HOOK_SCRIPT_PATH = ".claude/hooks/track-transcript.sh";
+var CLAUDE_SETTINGS_PATH = ".claude/settings.json";
+var SH_PREAMBLE = `#!/usr/bin/env sh
+`;
+function renderTrackTranscriptScriptBody() {
+  return `# Vinaya-managed Stop hook. Records this session's transcript_path (and
+# session_id) so the token-report adapter can resolve it without scanning
+# ~/.claude/projects/ for the newest file, which silently grabs another
+# concurrent session's transcript when two worktrees are active at once.
+node -e '
+const fs = require("fs")
+let data = ""
+process.stdin.on("data", (c) => { data += c })
+process.stdin.on("end", () => {
+  let hook
+  try {
+    hook = JSON.parse(data)
+  } catch {
+    return
+  }
+  if (!hook.transcript_path) return
+  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd()
+  const tmpDir = process.env.TMPDIR || "/tmp"
+  const key = projectDir.replace(/[^A-Za-z0-9]+/g, "-")
+  const pointerPath = tmpDir + "/claude-transcript-" + key + ".txt"
+  const content = (hook.session_id || "") + "\\t" + hook.transcript_path + "\\n"
+  const scratchPath = pointerPath + "." + process.pid + "." + Math.random().toString(36).slice(2) + ".tmp"
+  try {
+    fs.writeFileSync(scratchPath, content, { mode: 0o600, flag: "wx" })
+  } catch {
+    return
+  }
+  try {
+    fs.renameSync(scratchPath, pointerPath)
+  } catch {
+    try { fs.unlinkSync(scratchPath) } catch {}
+  }
+})
+'
+exit 0`;
+}
+function renderClaudeSettingsWithStopHook() {
+  const settings = {
+    $schema: "https://json.schemastore.org/claude-code-settings.json",
+    hooks: {
+      Stop: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: `$CLAUDE_PROJECT_DIR/${CLAUDE_STOP_HOOK_SCRIPT_PATH}`,
+              timeout: 5
+            }
+          ]
+        }
+      ]
+    }
+  };
+  return `${JSON.stringify(settings, null, 2)}
+`;
+}
+function buildClaudeStopHookOps() {
+  return [
+    {
+      kind: "managed-block",
+      path: CLAUDE_STOP_HOOK_SCRIPT_PATH,
+      marker: CLAUDE_STOP_HOOK_MARKER,
+      body: renderTrackTranscriptScriptBody(),
+      comment: "hash",
+      hostPreamble: SH_PREAMBLE,
+      mode: 493,
+      group: CLAUDE_STOP_HOOK_GROUP
+    },
+    {
+      kind: "create-file",
+      path: CLAUDE_SETTINGS_PATH,
+      content: renderClaudeSettingsWithStopHook(),
+      group: CLAUDE_STOP_HOOK_GROUP
+    }
+  ];
+}
+
 // src/lib/gemini-command-emitter.ts
 var GEMINI_COMMAND_GROUP = "Gemini CLI command (.gemini/commands/)";
 var GEMINI_COMMAND_PATH = ".gemini/commands/vinaya.toml";
@@ -2396,6 +2631,7 @@ function starterDocOwners() {
 }
 var FIXED_LABEL_METADATA = {
   blocked: { color: "e11d21", description: "Execution halted pending an external unblock" },
+  backlog: { color: "ededed", description: "Deliberately unplanned — belongs to no tranche until promoted" },
   "tier-0": { color: "ededed", description: "Trivial / mechanical change" },
   "tier-1": { color: "c5def5", description: "Standard task — code + tests + docs" },
   "tier-3": { color: "d93f0b", description: "Records a decision; ratification-gated" },
@@ -2451,6 +2687,14 @@ var CODEOWNERS_NOTE = `Recommended: require review on vinaya's own workflow file
 Then add this flag to the branch-protection command above:
 
   -F required_pull_request_reviews.require_code_owner_reviews=true`;
+var PRINCIPALS_NOTE = `Recommended: without this, review-gate trusts nobody's verdicts on this repo.
+
+  Add to vinaya.config.json:
+    "principals": ["<your-github-login>"]
+
+Anyone reviewing a PR here (code-reviewer/security verdicts, the
+vinaya/waiver:review label) must be listed, or their comments are ignored
+and every PR reads as unreviewed. \`vinaya doctor\` reports when this is unset.`;
 function buildInitOps(ctx) {
   const ops = [];
   const hookMode = 493;
@@ -2563,13 +2807,31 @@ function buildInitOps(ctx) {
   }
   if (ctx.agents.has("claude")) {
     ops.push(...buildClaudeCommandOps());
+    ops.push(...buildClaudeStopHookOps());
   }
   if (ctx.agents.has("gemini")) {
     ops.push(buildGeminiCommandOp());
   }
+  if (ctx.agents.size > 0) {
+    const affected = [];
+    if (ctx.agents.has("claude"))
+      affected.push("the `/vinaya <role>` command (.claude/commands/vinaya.md)");
+    if (ctx.agents.has("gemini"))
+      affected.push("the `/vinaya` command (.gemini/commands/vinaya.toml)");
+    if (ctx.agents.has("skills"))
+      affected.push("every .agents/skills/vinaya-*/SKILL.md file");
+    ops.push({
+      kind: "print",
+      message: "The agent-native commands above (`vinaya doctrine`) need `vinaya` resolvable on PATH:\n\n" + `  npm install -g @attalabs/vinaya
+
+` + `Without a global install, ${affected.join(" and ")} fail "command not found" the first time an agent ` + "tries to use them.",
+      group: "Agent-native commands (printed, never applied)"
+    });
+  }
   ops.push(...labelOps());
   ops.push({ kind: "print", message: BRANCH_PROTECTION_NOTE, group: "Branch protection (printed, never applied)" });
   ops.push({ kind: "print", message: CODEOWNERS_NOTE, group: "Branch protection (printed, never applied)" });
+  ops.push({ kind: "print", message: PRINCIPALS_NOTE, group: "Review trust (printed, never applied)" });
   return ops;
 }
 
@@ -2703,8 +2965,15 @@ function isSafeRepoRelPath(p) {
 var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
+var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
+function isCanonicalHookBlockPath(p) {
+  return CANONICAL_HOOK_BLOCK_PREFIXES.some((prefix) => p.startsWith(prefix) && p.length > prefix.length);
+}
+var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
+  message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
+});
 var ManagedBlockRecordSchema = z.object({
-  path: SafeRepoRelPath,
+  path: ManagedHookBlockPath,
   marker: z.string(),
   comment: z.enum(["hash", "html"])
 });
@@ -3828,11 +4097,15 @@ function gatherDeadBranchFacts(repoFlag) {
   }
   return facts;
 }
-function ensureLabelExists(repoFlag, name, description) {
+function listLabelNames(repoFlag) {
   const existing = shSoftJson(["gh", "label", "list", "-R", repoFlag, "--json", "name", "--limit", "200"]) ?? [];
-  if (existing.some((l) => l.name === name))
-    return;
-  shSoft(["gh", "label", "create", name, "-R", repoFlag, "--color", "B60205", "--description", description]);
+  return existing.map((l) => l.name);
+}
+function createLabel(repoFlag, name, description, color) {
+  shSoft(["gh", "label", "create", name, "-R", repoFlag, "--color", color, "--description", description]);
+}
+function ensureLabelExists2(repoFlag, name, description) {
+  ensureLabelExists(repoFlag, name, description, { listLabelNames, createLabel });
 }
 function commentIdFromUrl(url) {
   const match = url.match(/issuecomment-(\d+)/);
@@ -3870,7 +4143,7 @@ function runDeadBranchAudit(repoFlag) {
     const facts = gatherDeadBranchFacts(repoFlag);
     const findings = findDeadBranchPushes(facts);
     if (findings.length > 0) {
-      ensureLabelExists(repoFlag, DEAD_BRANCH_LABEL, DEAD_BRANCH_LABEL_DESCRIPTION);
+      ensureLabelExists2(repoFlag, DEAD_BRANCH_LABEL, DEAD_BRANCH_LABEL_DESCRIPTION);
       for (const finding of findings)
         flagDeadBranchPush(finding, repoFlag);
     }
@@ -3918,7 +4191,7 @@ function incidentAlreadyOpen(sha, repoFlag) {
   return issues.length > 0;
 }
 function openDirectPushIncident(sha, repoFlag) {
-  ensureLabelExists(repoFlag, DIRECT_PUSH_LABEL, DIRECT_PUSH_LABEL_DESCRIPTION);
+  ensureLabelExists2(repoFlag, DIRECT_PUSH_LABEL, DIRECT_PUSH_LABEL_DESCRIPTION);
   if (incidentAlreadyOpen(sha, repoFlag)) {
     console.error(`[vinaya audit] incident already open for ${sha} — not duplicating.`);
     return;
@@ -4051,8 +4324,8 @@ function bin(name) {
 function runsUnderAll(spec) {
   return !spec.ownWorkflow;
 }
-function coreCheckRegistry() {
-  return [
+var REGISTRY = [
+  [
     {
       name: "brief-shape",
       run: bin("check-brief-shape"),
@@ -4063,6 +4336,9 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "doc-coverage",
       run: bin("check-doc-coverage"),
@@ -4078,6 +4354,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "coherence",
       run: bin("check-coherence"),
@@ -4090,6 +4369,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "dispatch-readiness",
       run: bin("check-dispatch-readiness"),
@@ -4099,9 +4381,13 @@ function coreCheckRegistry() {
         AEG_REPO: { optional: true },
         BRANCH: { optional: true },
         GITHUB_TOKEN: { optional: true },
-        GH_TOKEN: { optional: true }
+        GH_TOKEN: { optional: true },
+        PREMISE_FILE: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "closes-n",
       run: bin("check-closes-n"),
@@ -4116,6 +4402,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "single-plan-pr",
       run: bin("check-single-plan-pr"),
@@ -4128,6 +4417,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "test-plan",
       run: bin("check-test-plan"),
@@ -4139,6 +4431,9 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "body-bare-digits",
       run: bin("check-body-bare-digits"),
@@ -4154,6 +4449,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "no-disk-state",
       run: bin("check-no-disk-state"),
@@ -4161,6 +4459,9 @@ function coreCheckRegistry() {
       timeoutMs: 15000,
       env: { BASE_SHA: { optional: true } }
     },
+    0
+  ],
+  [
     {
       name: "registry-gates",
       run: bin("check-registry-gates"),
@@ -4172,6 +4473,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "review-gate",
       run: bin("check-review-gate"),
@@ -4185,6 +4489,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "branch-topology",
       run: bin("check-branch-topology"),
@@ -4197,6 +4504,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "dead-branch-push",
       run: bin("check-dead-branch-push"),
@@ -4208,6 +4518,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "first-push-dispatch",
       run: bin("check-first-push-dispatch"),
@@ -4220,6 +4533,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "doc-coverage-push",
       run: bin("check-doc-coverage-push"),
@@ -4237,6 +4553,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "issue-assignment",
       run: bin("check-issue-assignment"),
@@ -4249,6 +4568,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "evidence-fresh",
       run: bin("check-evidence-fresh"),
@@ -4263,6 +4585,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "reader-resolvable-prose",
       run: bin("check-reader-resolvable-prose"),
@@ -4270,6 +4595,9 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: {}
     },
+    0
+  ],
+  [
     {
       name: "retired-vocabulary",
       run: bin("check-retired-vocabulary"),
@@ -4277,6 +4605,9 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: {}
     },
+    0
+  ],
+  [
     {
       name: "doctrine-portability",
       run: bin("check-doctrine-portability"),
@@ -4284,15 +4615,33 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: { BASE_SHA: { optional: true } }
     },
+    0
+  ],
+  [
     {
       name: "workspace-escape",
       run: bin("check-workspace-escape"),
       scope: "full",
       timeoutMs: 30000,
       env: {}
-    }
-  ];
+    },
+    0
+  ],
+  [
+    {
+      name: "main-branch-refusal",
+      run: bin("check-main-branch-refusal"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ]
+];
+function coreCheckRegistry() {
+  return REGISTRY.map(([spec]) => spec);
 }
+var CORE_CHECK_RING = Object.fromEntries(REGISTRY.map(([spec, ring]) => [spec.name, ring]));
 
 // src/checks/resolver.ts
 var NAMESPACE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
@@ -4889,6 +5238,28 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "tokens",
+    description: "Print a role's `Tokens: …` report line — the portable front door over the collection adapter",
+    flags: [
+      { flag: "--phase", description: 'e.g. `"<task-id>: develop"` — required' },
+      { flag: "--role", description: "e.g. `Developer` — required" },
+      { flag: "--model", description: "Overrides the model id the adapter derived, if given" },
+      {
+        flag: "--transcript",
+        description: "Read this transcript directly. Supported primary route — use it whenever you know which transcript " + "is yours, and always in a repo with no track-transcript.sh hook. Omitted resolves via the Stop-hook " + "pointer file, if this repo installs that hook."
+      },
+      {
+        flag: "--in / --out",
+        description: "Manual entry: the exact token figures, for a host whose usage arrives by some other means than a " + "Claude Code transcript. Both required together; skips transcript resolution entirely."
+      }
+    ],
+    details: [
+      "Resolves the Claude Code collection adapter (`resolveMeteringCapability`, `summarizeTranscript`, `formatTokensLine`) from the INSTALLED `@attalabs/aeg-core` package, never by a repo-relative path — the fix for `packages/aeg-core/bin/report-tokens.ts` not existing in an adopter repo with no local `packages/`.",
+      "Refuses — never emits a `0/0/—` line — when no transcript resolves, a resolved transcript can't be read, or it summarizes to zero usage records (empty, unparseable, or not yet flushed to disk). Capability is probed by actually attempting resolution, never declared from the host being Claude Code."
+    ],
+    status: "shipped"
+  },
   {
     name: "doctrine",
     description: "Print the absolute path of the bundled doctrine's front door (aeg-root/skills/aeg/SKILL.md) on this machine",
@@ -5715,7 +6086,7 @@ async function demoBreakCommand(args) {
 // src/commands/doctor.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync2 } from "node:fs";
-import { join as join13 } from "node:path";
+import { delimiter, join as join13 } from "node:path";
 
 // src/lib/self-host.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync11, realpathSync } from "node:fs";
@@ -5870,7 +6241,13 @@ function realDeps3() {
     readHooksPath: readCoreHooksPath,
     nodeVersion: () => process.version,
     bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
-    packageVersion: readVersion
+    packageVersion: readVersion,
+    meteringCapability: () => resolveMeteringCapability({
+      env: process.env,
+      cwd: process.cwd(),
+      exists: existsSync11,
+      readFile: (path) => readFileSync13(path, "utf8")
+    })
   };
 }
 var ok = (check, message) => ({ check, severity: "ok", message });
@@ -5905,6 +6282,8 @@ function labelForPath(path) {
     return "agent-skills";
   if (path === CLAUDE_COMMAND_PATH)
     return "claude-command";
+  if (path === CLAUDE_SETTINGS_PATH)
+    return "claude-stop-hook";
   if (path === GEMINI_COMMAND_PATH)
     return "gemini-command";
   if (path === CHECKS_FOLDER_PLACEHOLDER_PATH || path === ROLES_FOLDER_PLACEHOLDER_PATH)
@@ -6150,6 +6529,14 @@ function diagnoseGlobalConfigChecks() {
     return [];
   return [warn("checks", globalChecksIgnoredWarning(GLOBAL_CONFIG_PATH))];
 }
+function diagnoseTokenMetering(deps) {
+  const capability = deps.meteringCapability();
+  if (capability.capable)
+    return [];
+  return [
+    info("tokens", `Token-metering capability probe: incapable (${capability.reason}) — ${capability.detail} Real per-turn ` + "token figures cannot currently be collected via `vinaya tokens`. Report them by whatever means your " + "host offers, or supply them directly with `vinaya tokens --in <n> --out <n>`.")
+  ];
+}
 async function diagnoseEnvironment(deps, hasDrift) {
   const findings = [];
   const auth = await deps.ghAuthStatus();
@@ -6194,6 +6581,22 @@ function diagnoseCodeowners(repoRoot) {
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).some((line) => coversWorkflowsDir(line.split(/\s+/)[0] ?? ""));
   return covered ? info("codeowners", ".github/CODEOWNERS covers .github/workflows/**.") : warn("codeowners", ".github/CODEOWNERS exists but has no entry covering .github/workflows/** — workflow file edits can merge unreviewed.");
 }
+function diagnoseVinayaOnPath(agents) {
+  if (agents.size === 0)
+    return [];
+  const names = process.platform === "win32" ? ["vinaya.cmd", "vinaya.exe", "vinaya.bat"] : ["vinaya"];
+  const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+  const onPath = dirs.some((dir) => names.some((name) => existsSync11(join13(dir, name))));
+  return [
+    onPath ? ok("vinaya-on-path", "`vinaya` resolves on PATH — agent-native commands will work.") : info("vinaya-on-path", "`vinaya` is not resolvable on PATH — `/vinaya <role>` and the .agents/skills/vinaya-*/SKILL.md files " + 'installed here will fail "command not found" on first use. Run `npm install -g @attalabs/vinaya`.')
+  ];
+}
+function diagnosePrincipals(config) {
+  if (config.principals && config.principals.length > 0) {
+    return info("principals", `review-gate trusts ${config.principals.length} declared principal(s).`);
+  }
+  return info("principals", 'vinaya.config.json has no "principals" — review-gate and the waiver-label actor check both fall back to a ' + "hardcoded placeholder allowlist that will not include anyone on this repo. Every reviewer's verdict is " + 'silently ignored (DANGLING) until you add `"principals": ["<your-github-login>", ...]` to vinaya.config.json.');
+}
 var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
 function diagnoseTestCi(repoRoot) {
   let pkg;
@@ -6272,12 +6675,15 @@ async function runDoctor(args, deps) {
     findings.push(...await diagnoseHookRouting(repo.repoRoot, hookDir, deps.readHooksPath));
     findings.push(...diagnoseCustomChecks(repo.repoRoot, configRead.config));
     findings.push(...diagnoseDocOwnersHealth(repo.repoRoot));
+    findings.push(diagnosePrincipals(configRead.config));
+    findings.push(...diagnoseVinayaOnPath(ctx.agents));
   }
   findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseBriefSchemaDrift(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseCheckClassification(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseGlobalConfigChecks());
+  findings.push(...diagnoseTokenMetering(deps));
   findings.push(...await diagnoseEnvironment(deps, hasDrift));
   findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
   findings.push(diagnoseCodeowners(repo.repoRoot));
@@ -6634,7 +7040,7 @@ function pathFlag(args) {
   const i = args.indexOf("--path");
   return i !== -1 && args[i + 1] ? args[i + 1] : ".";
 }
-var PATH_INJECTION_RE = /[|\r\n]/;
+var PATH_INJECTION_RE = /[|`\r\n]/;
 function validPathFlag(path) {
   return !PATH_INJECTION_RE.test(path);
 }
@@ -6647,7 +7053,7 @@ async function runInitProduct(args, deps) {
   }
   const productPath = pathFlag(args);
   if (!validPathFlag(productPath)) {
-    console.error("Error: --path must not contain '|' or a newline (it is written into a markdown table row).");
+    console.error("Error: --path must not contain '|', a backtick, or a newline (it is written into a markdown table row and must round-trip verbatim).");
     return 2;
   }
   const specsPath = productPath === "." ? "specs/" : `${productPath}/specs/`;
@@ -7568,6 +7974,66 @@ ${registration}
 // src/commands/pr.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
 
+// src/lib/numstat.ts
+function summariseNumstat(numstat) {
+  const rows = numstat.split(`
+`).filter((l) => l.trim() !== "");
+  let added = 0;
+  let deleted = 0;
+  let binary = 0;
+  for (const row of rows) {
+    const [a, d] = row.split("\t");
+    if (a === "-" || d === "-") {
+      binary++;
+      continue;
+    }
+    added += Number(a) || 0;
+    deleted += Number(d) || 0;
+  }
+  const files = `${rows.length} file${rows.length === 1 ? "" : "s"} changed`;
+  const bin2 = binary > 0 ? `, ${binary} binary` : "";
+  return `${files}, ${added} insertion${added === 1 ? "" : "s"}(+), ${deleted} deletion${deleted === 1 ? "" : "s"}(-)${bin2}`;
+}
+var EVIDENCE_SUMMARY_PREFIX = "Summary: ";
+
+// src/checks/scan-context.ts
+var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
+var HTML_ENTITIES = {
+  "&quot;": '"',
+  "&apos;": "'",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&amp;": "&"
+};
+function decodeNamedEntities(body) {
+  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
+}
+function normalizeBody(rawBody) {
+  return decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
+}
+function buildAnchorLookupMask(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
+
+class ScanContext {
+  raw;
+  normalised;
+  masked;
+  constructor(raw, normalised, masked) {
+    this.raw = raw;
+    this.normalised = normalised;
+    this.masked = masked;
+  }
+  static from(rawBody) {
+    const normalised = normalizeBody(rawBody);
+    return new ScanContext(rawBody, normalised, buildAnchorLookupMask(normalised));
+  }
+  rawResolutionAgrees(field) {
+    const rawHasPair = anchoredRegionBounds(this.raw, field) !== null;
+    return rawHasPair === (anchoredRegionBounds(this.masked, field) !== null);
+  }
+}
+
 // src/checks/body-bare-digits-logic.ts
 function blankRange(text, start, end) {
   const region = text.slice(start, end);
@@ -7743,8 +8209,8 @@ var BOUNDED_ANCHOR_BLANK = {
   PROJECT: blankProjectField,
   EVIDENCE: blankEvidenceField
 };
-function buildScanMask(body) {
-  let masked = maskDetailsBlocks(maskCode(body));
+function buildScanMask(ctx) {
+  let masked = ctx.masked;
   masked = blankAnchoredRegions(masked);
   masked = blankPremiseValues(masked);
   masked = blankTokenReportSection(masked);
@@ -7753,17 +8219,6 @@ function buildScanMask(body) {
 }
 var TOKEN_WITH_DIGIT = /\S*\p{Nd}\S*/gu;
 var LIST_MARKER_TOKEN = /^\p{Nd}{1,9}[.)]$/u;
-var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
-var HTML_ENTITIES = {
-  "&quot;": '"',
-  "&apos;": "'",
-  "&lt;": "<",
-  "&gt;": ">",
-  "&amp;": "&"
-};
-function decodeNamedEntities(body) {
-  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
-}
 function isLineLeadingListMarker(line, matchStart, rawToken) {
   if (!LIST_MARKER_TOKEN.test(rawToken))
     return false;
@@ -7771,8 +8226,9 @@ function isLineLeadingListMarker(line, matchStart, rawToken) {
   return /^ {0,3}$/.test(before);
 }
 function checkBareDigits(rawBody) {
-  const body = decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
-  const masked = buildScanMask(body);
+  const ctx = ScanContext.from(rawBody);
+  const body = ctx.normalised;
+  const masked = buildScanMask(ctx);
   const maskedLines = masked.split(`
 `);
   const origLines = body.split(`
@@ -8077,10 +8533,26 @@ function renderGroupB(outcomes) {
 `);
 }
 function buildBlockInner(groupA, gateOutcomes) {
-  return [`Head: ${groupA.head}`, "", renderGroupA(groupA), "", renderGroupB(gateOutcomes)].join(`
+  return [
+    `Head: ${groupA.head}`,
+    `${EVIDENCE_SUMMARY_PREFIX}\`${summariseNumstat(groupA.numstat)}\``,
+    "",
+    renderGroupA(groupA),
+    "",
+    renderGroupB(gateOutcomes)
+  ].join(`
 `);
 }
+
+class DivergentEvidenceAnchorError extends Error {
+  constructor() {
+    super("the AEG:EVIDENCE anchor resolves differently before and after normalisation — a zero-width character or an HTML entity inside a marker makes this writer and the checks that read the block disagree about which pair is real. Remove it and re-run.");
+    this.name = "DivergentEvidenceAnchorError";
+  }
+}
 function replaceEvidenceBlock(body, blockInner) {
+  if (!ScanContext.from(body).rawResolutionAgrees("EVIDENCE"))
+    throw new DivergentEvidenceAnchorError;
   const full = `${EVIDENCE_START}
 ${blockInner}
 ${EVIDENCE_END}`;
@@ -8327,7 +8799,13 @@ function realDeps6() {
       readHooksPath: readCoreHooksPath,
       nodeVersion: () => process.version,
       bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
-      packageVersion: readPackageVersion
+      packageVersion: readPackageVersion,
+      meteringCapability: () => resolveMeteringCapability({
+        env: process.env,
+        cwd: process.cwd(),
+        exists: existsSync21,
+        readFile: (path) => readFileSync23(path, "utf8")
+      })
     },
     confirm: async (q, defaultYes) => promptYesNo(q, defaultYes),
     ask: async (q) => prompt(q),
@@ -8509,6 +8987,12 @@ function renderFindingsSection(findings) {
 function renderTokensLine(role, roleLabel, input) {
   return `Tokens: ${input.taskId}: ${role} — ${roleLabel} — ${input.model} — ${input.tokensIn}/${input.tokensOut}/${input.cost}`;
 }
+function renderCastByLine(roleLabel, sessionId) {
+  return `Cast by: ${roleLabel} (session ${sessionId})`;
+}
+function resolveSessionId(env) {
+  return env.CLAUDE_CODE_SESSION_ID ?? "(unknown)";
+}
 var CODE_REVIEW_VERDICT_TEXT = {
   APPROVE: "APPROVE",
   REQUEST_CHANGES: "REQUEST CHANGES"
@@ -8530,7 +9014,8 @@ function renderCodeReviewComment(input) {
     `TESTS: ${input.tests}`,
     `DOCS: ${input.docs}`,
     "",
-    renderTokensLine("review", "Reviewer", input)
+    renderTokensLine("review", "Reviewer", input),
+    renderCastByLine("Reviewer", input.sessionId)
   ].join(`
 `);
 }
@@ -8553,7 +9038,7 @@ function renderSecurityComment(input) {
   if (input.secretsEvidence !== null) {
     lines.push("```", input.secretsEvidence, "```", "");
   }
-  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input));
+  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input), renderCastByLine("Security", input.sessionId));
   return lines.join(`
 `);
 }
@@ -8775,7 +9260,8 @@ async function reviewPostCommand(args) {
   const tokensIn = requireTokenField(flags2, "--tokens-in");
   const tokensOut = requireTokenField(flags2, "--tokens-out");
   const cost = requireFlag(flags2, "--cost");
-  const tokens = { taskId, model, tokensIn, tokensOut, cost };
+  const sessionId = resolveSessionId(process.env);
+  const tokens = { taskId, model, tokensIn, tokensOut, cost, sessionId };
   const headSha = resolveHeadSha(pr);
   const principalAllowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
   let body;
@@ -9007,10 +9493,128 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
   }
 }
 
+// src/commands/tokens.ts
+import { existsSync as existsSync23, readFileSync as readFileSync26 } from "node:fs";
+var USAGE4 = [
+  'Usage: vinaya tokens --phase "<task-id>: develop" --role Developer',
+  "  [--model <id>] [--transcript <path>] [--in <tokens-in> --out <tokens-out>]",
+  "",
+  "  --transcript   Read this transcript directly. Supported primary route — use it whenever you know",
+  "                 which transcript is yours, and always in a repo with no track-transcript.sh hook.",
+  "  (omitted)      Resolve via the Stop-hook pointer file, if this repo installs that hook.",
+  "  --in/--out     Manual entry: the exact token figures, for a host whose usage arrives by some other",
+  "                 means than a Claude Code transcript. Both required together; skips transcript",
+  "                 resolution entirely."
+].join(`
+`);
+function parseArgs(argv) {
+  let phase;
+  let role;
+  let model;
+  let transcriptPath;
+  let tokensInRaw;
+  let tokensOutRaw;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--phase")
+      phase = argv[++i];
+    else if (arg === "--role")
+      role = argv[++i];
+    else if (arg === "--model")
+      model = argv[++i];
+    else if (arg === "--transcript")
+      transcriptPath = argv[++i];
+    else if (arg === "--in")
+      tokensInRaw = argv[++i];
+    else if (arg === "--out")
+      tokensOutRaw = argv[++i];
+  }
+  if (!phase || !role) {
+    throw new Error(USAGE4);
+  }
+  if (tokensInRaw === undefined !== (tokensOutRaw === undefined)) {
+    throw new Error("vinaya tokens: --in and --out must be given together, or not at all.");
+  }
+  const tokensIn = tokensInRaw === undefined ? undefined : Number(tokensInRaw);
+  const tokensOut = tokensOutRaw === undefined ? undefined : Number(tokensOutRaw);
+  if (tokensIn !== undefined && (!Number.isFinite(tokensIn) || tokensIn < 0)) {
+    throw new Error(`vinaya tokens: --in must be a non-negative integer, got "${tokensInRaw}".`);
+  }
+  if (tokensOut !== undefined && (!Number.isFinite(tokensOut) || tokensOut < 0)) {
+    throw new Error(`vinaya tokens: --out must be a non-negative integer, got "${tokensOutRaw}".`);
+  }
+  return { phase, role, model, transcriptPath, tokensIn, tokensOut };
+}
+function manualSummary(tokensIn, tokensOut) {
+  return {
+    components: {
+      inputTokens: tokensIn,
+      outputTokens: tokensOut,
+      cacheCreationInputTokens: 0,
+      cacheReadInputTokens: 0
+    },
+    model: null,
+    messageCount: 1
+  };
+}
+function realDeps7() {
+  return {
+    env: process.env,
+    cwd: process.cwd(),
+    exists: existsSync23,
+    readFile: (path) => readFileSync26(path, "utf8")
+  };
+}
+function buildTokensResult(parsed, deps) {
+  if (parsed.tokensIn !== undefined && parsed.tokensOut !== undefined) {
+    const summary = manualSummary(parsed.tokensIn, parsed.tokensOut);
+    return {
+      line: formatTokensLine({ phase: parsed.phase, role: parsed.role, summary, modelOverride: parsed.model }),
+      breakdown: undefined
+    };
+  }
+  const capability = resolveMeteringCapability(deps, parsed.transcriptPath);
+  if (!capability.capable) {
+    throw new Error(`vinaya tokens: refused — could not resolve real usage figures (${capability.reason}).
+${capability.detail}
+
+${USAGE4}`);
+  }
+  return {
+    line: formatTokensLine({
+      phase: parsed.phase,
+      role: parsed.role,
+      summary: capability.summary,
+      modelOverride: parsed.model
+    }),
+    breakdown: formatBreakdown(capability.summary)
+  };
+}
+function tokensCommand(argv) {
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (err) {
+    console.error(err.message);
+    process.exit(2);
+  }
+  let result;
+  try {
+    result = buildTokensResult(parsed, realDeps7());
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+  if (result.breakdown)
+    console.error(result.breakdown);
+  process.stdout.write(`${result.line}
+`);
+}
+
 // src/commands/upgrade.ts
-import { existsSync as existsSync23, readFileSync as readFileSync26, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync27, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join26 } from "node:path";
-function realDeps7() {
+function realDeps8() {
   return {
     detectRepo: detectGitRepo,
     hookDirFor: resolveHookDir,
@@ -9028,11 +9632,11 @@ function flags2(args) {
 }
 function readManifest3(repoRoot2) {
   const p = join26(repoRoot2, CONFIG_PATH);
-  if (!existsSync23(p))
+  if (!existsSync24(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync26(p, "utf-8"));
+    raw = JSON.parse(readFileSync27(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -9049,16 +9653,16 @@ function readManifest3(repoRoot2) {
 }
 function writeManifestVersion(repoRoot2, manifest) {
   const configAbs = join26(repoRoot2, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync26(configAbs, "utf-8"));
+  const seed = JSON.parse(readFileSync27(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
   writeFileSync13(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
 function stripFor(repoRoot2, path, marker, comment) {
   const abs2 = resolveManagedBlockPath(repoRoot2, path);
-  if (!existsSync23(abs2))
+  if (!existsSync24(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync26(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
@@ -9085,9 +9689,9 @@ function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
   const blocked = [];
   for (const b of legacy) {
     const abs2 = resolveManagedBlockPath(repoRoot2, b.path);
-    if (!existsSync23(abs2))
+    if (!existsSync24(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync26(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
@@ -9127,11 +9731,11 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
   for (const op of ops) {
     if (op.kind === "create-file") {
       const abs2 = join26(repoRoot2, op.path);
-      const exists = existsSync23(abs2);
+      const exists = existsSync24(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       let action;
       let triggerChange;
-      if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
+      if ((op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) && exists) {
         action = "keep";
       } else if (!owned) {
         action = exists ? "refuse-foreign" : "not-installed";
@@ -9139,7 +9743,7 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
         action = "recreate";
         hasChanges = true;
       } else {
-        const diskContent = readFileSync26(abs2, "utf-8");
+        const diskContent = readFileSync27(abs2, "utf-8");
         if (diskContent !== op.content) {
           action = "regenerate";
           hasChanges = true;
@@ -9160,11 +9764,11 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync23(abs2)) {
+      } else if (!existsSync24(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync26(abs2, "utf-8");
+        const content = readFileSync27(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -9270,7 +9874,7 @@ function renderUpgradeDiff(plan) {
 }
 function regenerateBlock(repoRoot2, op) {
   const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
-  const content = readFileSync26(abs2, "utf-8");
+  const content = readFileSync27(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
     writeFileSync13(abs2, stripped.endsWith(`
@@ -9298,9 +9902,9 @@ function applyUpgrade(plan, repoRoot2) {
     if (!s.present)
       continue;
     const abs2 = resolveManagedBlockPath(repoRoot2, s.path);
-    if (!existsSync23(abs2))
+    if (!existsSync24(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync26(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
@@ -9385,7 +9989,7 @@ Vinaya upgraded.
   return 0;
 }
 async function upgradeCommand(args) {
-  process.exit(await runUpgrade(args, realDeps7()));
+  process.exit(await runUpgrade(args, realDeps8()));
 }
 
 // src/commands/waiver.ts
@@ -9526,7 +10130,7 @@ function printHelp() {
 // src/index.ts
 var PACKAGE_ROOT = join27(dirname9(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync27(join27(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync28(join27(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -9679,6 +10283,10 @@ try {
       await quickstartCommand(args);
       break;
     }
+    case "tokens": {
+      tokensCommand(args);
+      break;
+    }
     default:
       console.error(`Unknown command: ${command}`);
       printHelp();