@attalabs/vinaya 0.21.0 → 0.22.0

package/dist/index.js

@@ -801,11 +801,16 @@ var DASH_LOOKALIKES = {
   "—": "―"
 };
 var DASH_CHARS = new Set(Object.keys(DASH_LOOKALIKES));
+var PIPE_LOOKALIKE = "｜";
 function sanitizeForTokensLine(value) {
   const stripped = stripNewlines(value);
   let result = "";
   for (let i = 0;i < stripped.length; i++) {
     const ch = stripped[i];
+    if (ch === "|") {
+      result += PIPE_LOOKALIKE;
+      continue;
+    }
     if (DASH_CHARS.has(ch)) {
       const leftReachable = i === 0 || /\s/.test(stripped[i - 1]);
       const rightReachable = i === stripped.length - 1 || /\s/.test(stripped[i + 1]);
@@ -857,6 +862,7 @@ function formatBreakdown(summary) {
 `);
 }
 // ../../packages/aeg-core/src/claude-code-transcript.ts
+import { createHash } from "node:crypto";
 function summarizeTranscript(jsonl) {
   const seen = new Set;
   const components = {
@@ -905,7 +911,14 @@ function numberOr(value, fallback) {
 function sanitizeKey(value) {
   return value.replace(/[^A-Za-z0-9]+/g, "-");
 }
+function collisionResistantKey(value) {
+  const digest = createHash("sha256").update(value).digest("hex");
+  return `${sanitizeKey(value)}-${digest}`;
+}
 function transcriptPointerPath(projectDir, tmpDir) {
+  return `${tmpDir}/claude-transcript-${collisionResistantKey(projectDir)}.txt`;
+}
+function legacyTranscriptPointerPath(projectDir, tmpDir) {
   return `${tmpDir}/claude-transcript-${sanitizeKey(projectDir)}.txt`;
 }
 function resolvePointer(explicitTranscriptPath, deps) {
@@ -913,13 +926,15 @@ function resolvePointer(explicitTranscriptPath, deps) {
     return { path: explicitTranscriptPath, corroborated: true };
   const projectDir = deps.env.CLAUDE_PROJECT_DIR ?? deps.cwd;
   const tmpDir = deps.env.TMPDIR ?? "/tmp";
-  const pointerPath = transcriptPointerPath(projectDir, tmpDir);
+  const primaryPointerPath = transcriptPointerPath(projectDir, tmpDir);
+  const legacyPointerPath = legacyTranscriptPointerPath(projectDir, tmpDir);
   const currentSessionId = deps.env.CLAUDE_CODE_SESSION_ID;
-  if (!deps.exists(pointerPath)) {
+  const pointerPath = deps.exists(primaryPointerPath) ? primaryPointerPath : deps.exists(legacyPointerPath) ? legacyPointerPath : undefined;
+  if (!pointerPath) {
     return {
       pointerExisted: false,
       corroborated: false,
-      error: `No transcript pointer at ${pointerPath} and no --transcript given. ` + "Either this repo installs no track-transcript.sh Stop hook (lacking one is not a defect — " + "name the transcript directly instead), or no session has completed a turn yet."
+      error: `No transcript pointer at ${primaryPointerPath} (nor its pre-migration name ${legacyPointerPath}) ` + "and no --transcript given. Either this repo installs no track-transcript.sh Stop hook (lacking one " + "is not a defect — name the transcript directly instead), or no session has completed a turn yet."
     };
   }
   let contents;
@@ -989,6 +1004,58 @@ function resolveMeteringCapability(deps, explicitTranscriptPath) {
   }
   return { capable: true, transcriptPath: resolved.path, summary };
 }
+// ../../packages/aeg-core/src/metering-io-guard.ts
+import { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync } from "node:fs";
+var GUARD_OPEN_FLAGS = fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW;
+function isTrustedMeteringStat(stat, ownUid) {
+  if (!stat.isFile())
+    return false;
+  if (typeof ownUid === "number" && stat.uid !== ownUid)
+    return false;
+  return true;
+}
+function ownUid() {
+  return typeof process.getuid === "function" ? process.getuid() : undefined;
+}
+function guardedOpen(path) {
+  try {
+    return openSync(path, GUARD_OPEN_FLAGS);
+  } catch {
+    return;
+  }
+}
+function hardenedExists(path) {
+  const fd = guardedOpen(path);
+  if (fd === undefined)
+    return false;
+  try {
+    return isTrustedMeteringStat(fstatSync(fd), ownUid());
+  } finally {
+    closeSync(fd);
+  }
+}
+function hardenedReadFile(path) {
+  const fd = guardedOpen(path);
+  if (fd === undefined) {
+    throw new Error(`refusing to read ${path}: not openable as a plain, non-symlinked file`);
+  }
+  try {
+    if (!isTrustedMeteringStat(fstatSync(fd), ownUid())) {
+      throw new Error(`refusing to read ${path}: not a regular file owned by this user`);
+    }
+    return readFileSync(fd, "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+function hardenedMeteringDeps() {
+  return {
+    env: process.env,
+    cwd: process.cwd(),
+    exists: hardenedExists,
+    readFile: hardenedReadFile
+  };
+}
 // ../../packages/aeg-core/src/file-classify.ts
 function isCodeFile(p) {
   if (p.endsWith(".md"))
@@ -1753,16 +1820,16 @@ function checkAdoptable(facts) {
 }
 // src/lib/detect.ts
 import { execFile as execFile4 } from "node:child_process";
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync } from "node:fs";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync } from "node:fs";
 import { join as join7 } from "node:path";
 import { promisify as promisify4 } from "node:util";
 
 // src/lib/artifacts.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/commands/doctrine.ts
-import { existsSync as existsSync2, readdirSync, readFileSync } from "node:fs";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join2, sep } from "node:path";
 import matter2 from "gray-matter";
 
@@ -1800,17 +1867,20 @@ function resolveDoctrineRoot(pkg = packageRoot(import.meta.url)) {
   if (!pkg.split(sep).includes("node_modules"))
     candidates.push(join2(dirname2(dirname2(pkg)), "aeg-root"));
   for (const root of candidates) {
-    if (existsSync2(join2(root, ...ENTRY_SEGMENTS)))
+    if (hasDoctrineEntry(root))
       return root;
   }
   return null;
 }
+function hasDoctrineEntry(root) {
+  return existsSync2(join2(root, ...ENTRY_SEGMENTS));
+}
 function listRoleNames(root) {
   const rolesDir = join2(root, "roles");
   if (!existsSync2(rolesDir))
     return [];
   return readdirSync(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).filter((roleName) => {
-    const { data } = matter2(readFileSync(join2(rolesDir, `${roleName}.md`), "utf8"));
+    const { data } = matter2(readFileSync2(join2(rolesDir, `${roleName}.md`), "utf8"));
     return data.actor !== "human";
   }).sort();
 }
@@ -1849,7 +1919,7 @@ function doctrineCommand(args) {
 }
 
 // src/lib/agents-skills-emitter.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "node:fs";
 import { join as join3 } from "node:path";
 import matter3 from "gray-matter";
 var AGENTS_SKILLS_GROUP = "Agent skills (.agents/skills/)";
@@ -1861,7 +1931,7 @@ function discoverRoleNames(doctrineRoot) {
   if (!existsSync3(rolesDir))
     return [];
   return readdirSync2(rolesDir).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -".md".length)).filter((roleName) => {
-    const { data } = matter3(readFileSync2(join3(rolesDir, `${roleName}.md`), "utf8"));
+    const { data } = matter3(readFileSync3(join3(rolesDir, `${roleName}.md`), "utf8"));
     return data.actor !== "human";
   }).sort();
 }
@@ -1933,9 +2003,11 @@ process.stdin.on("end", () => {
     return
   }
   if (!hook.transcript_path) return
+  const crypto = require("crypto")
   const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd()
   const tmpDir = process.env.TMPDIR || "/tmp"
-  const key = projectDir.replace(/[^A-Za-z0-9]+/g, "-")
+  const digest = crypto.createHash("sha256").update(projectDir).digest("hex")
+  const key = projectDir.replace(/[^A-Za-z0-9]+/g, "-") + "-" + digest
   const pointerPath = tmpDir + "/claude-transcript-" + key + ".txt"
   const content = (hook.session_id || "") + "\\t" + hook.transcript_path + "\\n"
   const scratchPath = pointerPath + "." + process.pid + "." + Math.random().toString(36).slice(2) + ".tmp"
@@ -2052,7 +2124,7 @@ function starterConfig() {
   };
 }
 function ownVersion() {
-  const pkg = JSON.parse(readFileSync3(join4(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync4(join4(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 var SETUP_BUN_SHA = "0c5077e51419868618aeaa5fe8019c62421857d6";
@@ -2962,13 +3034,13 @@ function buildInitOps(ctx) {
 
 // src/lib/ops.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname4, isAbsolute, join as join6, resolve as resolve2, sep as sep2 } from "node:path";
 
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { createHash } from "node:crypto";
-import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, realpathSync, writeFileSync } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync5, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname3, join as join5, resolve } from "node:path";
 import { z } from "zod";
@@ -3301,7 +3373,7 @@ function loadConfig() {
   if (!path)
     return null;
   try {
-    const raw = JSON.parse(readFileSync4(path, "utf-8"));
+    const raw = JSON.parse(readFileSync5(path, "utf-8"));
     return stripGlobalOnlyKeys(VinayaConfigSchema.parse(raw), path);
   } catch {
     return null;
@@ -3312,7 +3384,7 @@ function readRepoCiSetup(repoRoot) {
   if (!existsSync4(p))
     return null;
   try {
-    return VinayaConfigSchema.parse(JSON.parse(readFileSync4(p, "utf-8"))).ci?.setup ?? null;
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync5(p, "utf-8"))).ci?.setup ?? null;
   } catch {
     return null;
   }
@@ -3323,7 +3395,7 @@ function loadConfigChecked() {
     return { ok: true, config: null };
   let raw;
   try {
-    raw = JSON.parse(readFileSync4(path, "utf-8"));
+    raw = JSON.parse(readFileSync5(path, "utf-8"));
   } catch (err) {
     return { ok: false, path, error: `invalid JSON: ${err.message}` };
   }
@@ -3339,7 +3411,7 @@ function readTokensCollectTrustStore(storePath) {
   try {
     if (!existsSync4(storePath))
       return {};
-    const raw = JSON.parse(readFileSync4(storePath, "utf-8"));
+    const raw = JSON.parse(readFileSync5(storePath, "utf-8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
@@ -3385,7 +3457,7 @@ function gitBlobHash(absolutePath, cwd) {
   }
 }
 function tokensCollectTrustKey(repoGitCommonDir, interpreter, script) {
-  return createHash("sha256").update(JSON.stringify([repoGitCommonDir, interpreter, script])).digest("hex");
+  return createHash2("sha256").update(JSON.stringify([repoGitCommonDir, interpreter, script])).digest("hex");
 }
 function getTokensCollectTrust(repoGitCommonDir, interpreter, script, storePath = TOKENS_COLLECT_TRUST_PATH) {
   const key = tokensCollectTrustKey(repoGitCommonDir, interpreter, script);
@@ -3455,7 +3527,7 @@ function fileContains(repoRoot, relPath, needle) {
   const p = resolveManagedBlockPath(repoRoot, relPath);
   if (!existsSync5(p))
     return false;
-  return readFileSync5(p, "utf-8").includes(needle);
+  return readFileSync6(p, "utf-8").includes(needle);
 }
 function planInstall(ops, repoRoot, ownedFiles = new Set) {
   const entries = [];
@@ -3565,7 +3637,7 @@ function writeFileWithDirs(target, content, mode) {
 }
 function appendBlock(repoRoot, op) {
   const target = resolveManagedBlockPath(repoRoot, op.path);
-  const existing = readFileSync5(target, "utf-8");
+  const existing = readFileSync6(target, "utf-8");
   const sep3 = existing.endsWith(`
 `) ? `
 ` : `
@@ -3687,7 +3759,7 @@ function planEject(manifest, repoRoot) {
       });
       continue;
     }
-    const content = readFileSync5(p, "utf-8");
+    const content = readFileSync6(p, "utf-8");
     const stripped = stripBlockFromContent(content, b.marker, b.comment);
     const removesHost = stripped !== null && blockStripLeavesEmpty(stripped);
     actions.push({
@@ -3739,7 +3811,7 @@ function applyEject(plan, repoRoot) {
       const p = containedManagedBlockAbs(repoRoot, a.path);
       if (p === null)
         continue;
-      const content = readFileSync5(p, "utf-8");
+      const content = readFileSync6(p, "utf-8");
       const stripped = stripBlockFromContent(content, a.marker, a.comment);
       if (stripped === null)
         continue;
@@ -3870,7 +3942,7 @@ function foreignRawHooks(repoRoot) {
   return activeRawHooks(repoRoot).filter((f) => {
     const abs2 = resolveManagedBlockPath(repoRoot, `.git/hooks/${f}`);
     try {
-      const stripped = stripBlockFromContent(readFileSync6(abs2, "utf-8"), f, "hash");
+      const stripped = stripBlockFromContent(readFileSync7(abs2, "utf-8"), f, "hash");
       return stripped === null || !blockStripLeavesEmpty(stripped);
     } catch {
       return true;
@@ -4004,7 +4076,6 @@ function closeStdin() {
 
 // src/commands/tokens.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 var USAGE = [
   'Usage: vinaya tokens --phase "<task-id>: develop" --role Developer',
@@ -4156,10 +4227,7 @@ function runDeclaredCollect(command, deps) {
 var COLLECT_COMMAND_TIMEOUT_MS = 30000;
 function realDeps() {
   return {
-    env: process.env,
-    cwd: process.cwd(),
-    exists: existsSync7,
-    readFile: (path) => readFileSync7(path, "utf8"),
+    ...hardenedMeteringDeps(),
     loadConfig,
     repoConfigDir: repoLocalConfigDir,
     runScript: (interpreter, scriptAbsolutePath, cwd) => execFileSync4(interpreter, [scriptAbsolutePath], { cwd, encoding: "utf-8", timeout: COLLECT_COMMAND_TIMEOUT_MS }),
@@ -4813,11 +4881,11 @@ function emitCheckError(error) {
 }
 
 // src/checks/registry.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { join as join8 } from "node:path";
 var DIST_BIN_DIR = join8(packageRoot(import.meta.url), "dist", "checks", "bin");
 var SRC_BIN_DIR = join8(packageRoot(import.meta.url), "src", "checks", "bin");
-var BIN_DIR = existsSync8(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
+var BIN_DIR = existsSync7(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
 var BIN_EXT = BIN_DIR === DIST_BIN_DIR ? ".js" : ".ts";
 function bin(name) {
   return join8(BIN_DIR, `${name}${BIN_EXT}`);
@@ -4952,6 +5020,21 @@ var REGISTRY = [
     },
     1
   ],
+  [
+    {
+      name: "token-report",
+      run: bin("check-token-report"),
+      scope: "diff",
+      timeoutMs: 15000,
+      requiresOpenPr: true,
+      env: {
+        PR_BODY: { optional: true },
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    1
+  ],
   [
     {
       name: "no-disk-state",
@@ -5489,7 +5572,7 @@ async function runChecks(specs, opts) {
 }
 
 // src/roles/plan.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
 import { join as join10 } from "node:path";
 
 // ../../packages/sources/src/commands.ts
@@ -6125,7 +6208,7 @@ function resolveRoles(core, configRoles) {
 var NO_DOCTRINE_REASON = "no bundled doctrine found next to this CLI install — the doctrine ships inside the @attalabs/vinaya npm package. Reinstall it, or, in a repo that vendors the CLI, run the package's bundle-doctrine script first.";
 function readContract(configDir, contractPath) {
   const absolute = join10(configDir, contractPath);
-  if (!existsSync9(absolute)) {
+  if (!existsSync8(absolute)) {
     return { ok: false, errors: [`contract file "${contractPath}" does not exist (resolved to "${absolute}")`] };
   }
   try {
@@ -6424,7 +6507,7 @@ function commitMsgCommand(args) {
 
 // src/commands/demo.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync11, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync11, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join11 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
@@ -6467,7 +6550,7 @@ function gitDirAbs(repoRoot) {
 function recoverFromCrash(repoRoot, statePath) {
   const currentBranch = currentBranchName(repoRoot);
   let state = null;
-  if (existsSync10(statePath)) {
+  if (existsSync9(statePath)) {
     try {
       state = JSON.parse(readFileSync11(statePath, "utf-8"));
     } catch {
@@ -6539,14 +6622,14 @@ function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
   gitCapture(repoRoot, ["clean", "-fd"]);
   gitCapture(repoRoot, ["checkout", originalBranch]);
   gitCapture(repoRoot, ["branch", "-D", demoBranch]);
-  if (existsSync10(statePath))
+  if (existsSync9(statePath))
     rmSync2(statePath, { force: true });
 }
 async function runDemoBreak(repoRoot, args) {
   const keep = args.includes("--keep");
   const hookDir = resolveHookDir(repoRoot);
   const hookPath = resolveManagedBlockPath(repoRoot, `${hookDir}/pre-commit`);
-  if (!existsSync10(hookPath)) {
+  if (!existsSync9(hookPath)) {
     console.error("Vinaya hooks are not installed in this repo. Run `vinaya init` first.");
     return 1;
   }
@@ -6616,7 +6699,7 @@ Attempting to commit…
   process.stdout.write(`✓ Commit passed — the fix worked.
 `);
   if (keep) {
-    if (existsSync10(statePath))
+    if (existsSync9(statePath))
       unlinkSync(statePath);
     process.stdout.write(`
 --keep: leaving \`${demoBranch}\` checked out for you to inspect. Clean up with:
@@ -6644,7 +6727,7 @@ async function demoBreakCommand(args) {
 
 // src/commands/doctor.ts
 import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync15, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync6, readFileSync as readFileSync15, statSync as statSync2 } from "node:fs";
 import { delimiter, join as join14 } from "node:path";
 
 // src/lib/self-host.ts
@@ -6762,14 +6845,14 @@ function detectVendoredVinaya(repoRoot) {
 }
 
 // src/lib/env-lint.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "node:fs";
 var ENV_READ_PATTERN = /\b(?:process\.env|Bun\.env|Deno\.env)\b/;
 function checksMissingEnvDeclaration(specs) {
   const names = [];
   for (const spec of specs) {
     if (spec.env)
       continue;
-    if (!existsSync11(spec.run))
+    if (!existsSync10(spec.run))
       continue;
     let source;
     try {
@@ -6787,7 +6870,7 @@ function envDeclarationWarning(name) {
 }
 
 // src/lib/registry-write.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname6, join as join13 } from "node:path";
 var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
 var CONFIG_FILE_PATH = "vinaya.config.json";
@@ -6856,7 +6939,7 @@ ${newRow}
 function planRegistryRow(repoRoot, name, path, specsPath) {
   const abs2 = join13(repoRoot, PROJECTS_REGISTRY_PATH);
   const line = rowLine(name, path, specsPath);
-  if (!existsSync12(abs2)) {
+  if (!existsSync11(abs2)) {
     return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
   }
   const existing = readFileSync14(abs2, "utf-8");
@@ -6884,7 +6967,7 @@ function renderRegistryRowDiffLine(plan) {
 }
 function readProjectEntries(repoRoot) {
   const abs2 = join13(repoRoot, CONFIG_FILE_PATH);
-  if (!existsSync12(abs2))
+  if (!existsSync11(abs2))
     return [];
   try {
     return VinayaConfigSchema.parse(JSON.parse(readFileSync14(abs2, "utf-8"))).projects ?? [];
@@ -6932,12 +7015,7 @@ function realDeps4() {
     nodeVersion: () => process.version,
     bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
     packageVersion: readVersion,
-    meteringCapability: () => resolveMeteringCapability({
-      env: process.env,
-      cwd: process.cwd(),
-      exists: existsSync13,
-      readFile: (path) => readFileSync15(path, "utf8")
-    })
+    meteringCapability: () => resolveMeteringCapability(hardenedMeteringDeps())
   };
 }
 var ok = (check, message) => ({ check, severity: "ok", message });
@@ -6946,7 +7024,7 @@ var warn = (check, message) => ({ check, severity: "warn", message });
 var error = (check, message) => ({ check, severity: "error", message });
 function readConfig(repoRoot) {
   const p = join14(repoRoot, CONFIG_PATH);
-  if (!existsSync13(p))
+  if (!existsSync12(p))
     return { kind: "missing" };
   let raw;
   try {
@@ -6990,7 +7068,7 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
     if (op.kind === "create-file") {
       const check = labelForPath(op.path);
       const abs2 = join14(repoRoot, op.path);
-      const exists = existsSync13(abs2);
+      const exists = existsSync12(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       if (!exists) {
         findings.push(owned ? error(check, `${op.path} is recorded as vinaya-managed but missing on disk — run \`vinaya upgrade\`.`) : error(check, `${op.path} is not installed — run \`vinaya init\`.`));
@@ -7015,7 +7093,7 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
       const check = "hooks";
       const abs2 = resolveManagedBlockPath(repoRoot, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
-      if (!existsSync13(abs2)) {
+      if (!existsSync12(abs2)) {
         findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
         continue;
       }
@@ -7068,7 +7146,7 @@ function diagnoseCustomChecks(repoRoot, config) {
   const findings = [];
   for (const [name, entry2] of Object.entries(config.checks ?? {})) {
     const scriptAbs = join14(repoRoot, entry2.run);
-    findings.push(existsSync13(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
+    findings.push(existsSync12(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
   }
   return findings;
 }
@@ -7082,7 +7160,7 @@ function listTrackedFiles(repoRoot) {
 }
 function diagnoseDocOwnersHealth(repoRoot) {
   const path = join14(repoRoot, DOC_OWNERS_PATH);
-  const content = existsSync13(path) ? readFileSync15(path, "utf-8") : null;
+  const content = existsSync12(path) ? readFileSync15(path, "utf-8") : null;
   const state = classifyDocOwnersManifest(content);
   if (state === "absent" || state === "empty")
     return [];
@@ -7100,7 +7178,7 @@ function diagnoseDocOwnersHealth(repoRoot) {
     }
     if (!isUrlPointer(b.pointer)) {
       const pointerPath = join14(repoRoot, pointerToPath(b.pointer));
-      if (!existsSync13(pointerPath)) {
+      if (!existsSync12(pointerPath)) {
         flagged = true;
         findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
       }
@@ -7139,11 +7217,11 @@ function listChildDirsForDoctor(dir, repoRoot) {
 }
 function diagnoseBlastRadiusDeprecation(repoRoot, config) {
   const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot), (dir) => listChildDirsForDoctor(dir, repoRoot));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync13(join14(repoRoot, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync12(join14(repoRoot, p)));
   const covered = new Set([...derived, ...defaults]);
   const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
   const legacyPath = join14(repoRoot, LEGACY_AEG_PACKAGES_PATH);
-  if (!existsSync13(legacyPath)) {
+  if (!existsSync12(legacyPath)) {
     return [
       info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
     ];
@@ -7204,7 +7282,7 @@ function diagnoseCheckClassification(config) {
   return findings;
 }
 function diagnoseGlobalConfigChecks() {
-  if (!existsSync13(GLOBAL_CONFIG_PATH))
+  if (!existsSync12(GLOBAL_CONFIG_PATH))
     return [];
   let raw;
   try {
@@ -7258,7 +7336,7 @@ function coversWorkflowsDir(pattern) {
 }
 function diagnoseCodeowners(repoRoot) {
   const path = join14(repoRoot, ".github", "CODEOWNERS");
-  if (!existsSync13(path)) {
+  if (!existsSync12(path)) {
     return info("codeowners", "no .github/CODEOWNERS — vinaya's workflow files have no required-review protection; see `vinaya init`'s printed recommendation.");
   }
   let body;
@@ -7276,7 +7354,7 @@ function diagnoseVinayaOnPath(agents) {
     return [];
   const names = process.platform === "win32" ? ["vinaya.cmd", "vinaya.exe", "vinaya.bat"] : ["vinaya"];
   const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
-  const onPath = dirs.some((dir) => names.some((name) => existsSync13(join14(dir, name))));
+  const onPath = dirs.some((dir) => names.some((name) => existsSync12(join14(dir, name))));
   return [
     onPath ? ok("vinaya-on-path", "`vinaya` resolves on PATH — agent-native commands will work.") : info("vinaya-on-path", "`vinaya` is not resolvable on PATH — `/vinaya <role>` and the .agents/skills/vinaya-*/SKILL.md files " + 'installed here will fail "command not found" on first use. Run `npm install -g @attalabs/vinaya`.')
   ];
@@ -7289,7 +7367,7 @@ function diagnosePrincipals(config) {
 }
 function diagnoseProjectsCoherence(repoRoot, config) {
   const registryAbs = join14(repoRoot, PROJECTS_REGISTRY_PATH);
-  const registryNames = existsSync13(registryAbs) ? new Set(parseRegistry(readFileSync15(registryAbs, "utf-8")).map((p) => p.name)) : new Set;
+  const registryNames = existsSync12(registryAbs) ? new Set(parseRegistry(readFileSync15(registryAbs, "utf-8")).map((p) => p.name)) : new Set;
   const configNames = new Set((config?.projects ?? []).map((p) => p.name));
   if (registryNames.size === 0 && configNames.size === 0)
     return [];
@@ -7316,7 +7394,7 @@ function diagnoseTestCi(repoRoot) {
   if (typeof testScript !== "string" || testScript.trim() === "")
     return [];
   const workflowsDir = join14(repoRoot, ".github/workflows");
-  const files = existsSync13(workflowsDir) ? readdirSync6(workflowsDir).filter((name) => statSync2(join14(workflowsDir, name)).isFile()) : [];
+  const files = existsSync12(workflowsDir) ? readdirSync6(workflowsDir).filter((name) => statSync2(join14(workflowsDir, name)).isFile()) : [];
   const invoked = files.some((name) => {
     const content = readFileSync15(join14(workflowsDir, name), "utf-8");
     return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
@@ -7409,7 +7487,7 @@ async function doctorCommand(args) {
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
 import { join as join15 } from "node:path";
 function realDeps5() {
   return {
@@ -7428,7 +7506,7 @@ function parse(args) {
 }
 function readManifest(repoRoot) {
   const p = join15(repoRoot, CONFIG_PATH);
-  if (!existsSync14(p))
+  if (!existsSync13(p))
     return { kind: "none" };
   let raw;
   try {
@@ -7522,7 +7600,7 @@ async function ejectCommand(args) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join16 } from "node:path";
 function realDeps6() {
   return {
@@ -7564,7 +7642,7 @@ function parseAgentsFlag(args) {
 var PRODUCT_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function readManifest2(repoRoot) {
   const p = join16(repoRoot, CONFIG_PATH);
-  if (!existsSync15(p))
+  if (!existsSync14(p))
     return null;
   try {
     return VinayaConfigSchema.parse(JSON.parse(readFileSync17(p, "utf-8"))).managed ?? null;
@@ -7728,7 +7806,7 @@ import { execFileSync as execFileSync11 } from "node:child_process";
 
 // src/lib/forge-write.ts
 import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync16, mkdtempSync, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync15, mkdtempSync, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { readFileSync as readFileSync18 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join17 } from "node:path";
@@ -8031,7 +8109,7 @@ function readSharedPackages(root = repoRoot()) {
   if (!root)
     return [];
   const derived = deriveWorkspacePackageDomains(readWorkspaceGlobs(root), (dir) => listWorkspaceChildDirs(dir, root));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync16(join17(root, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync15(join17(root, p)));
   const configExtra = readConfigExtraDomains(root);
   return [...new Set([...derived, ...defaults, ...configExtra])];
 }
@@ -8573,7 +8651,7 @@ async function milestoneCloseCommand(args) {
 }
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync2, existsSync as existsSync17, mkdirSync as mkdirSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join18 } from "node:path";
 var TEMPLATE_PATH = join18(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join18("scripts", "vinaya-checks");
@@ -8594,11 +8672,11 @@ function newCheckCommand(args) {
     process.exit(2);
   }
   const scriptsDir = join18(process.cwd(), CHECKS_DIR);
-  if (!existsSync17(scriptsDir))
+  if (!existsSync16(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
   const fileStem = name.slice(name.indexOf("/") + 1);
   const targetPath = join18(scriptsDir, `${fileStem}.ts`);
-  if (existsSync17(targetPath)) {
+  if (existsSync16(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
@@ -8616,7 +8694,7 @@ ${registration}
 }
 
 // src/commands/new-noop-check.ts
-import { chmodSync as chmodSync3, existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join19 } from "node:path";
 var TEMPLATE_PATH2 = join19(packageRoot(import.meta.url), "templates", "noop-check.template.ts");
 var CHECKS_DIR2 = join19("vinaya", "checks");
@@ -8634,10 +8712,10 @@ function newNoopCheckCommand(args) {
     process.exit(2);
   }
   const checksDir = join19(process.cwd(), CHECKS_DIR2);
-  if (!existsSync18(checksDir))
+  if (!existsSync17(checksDir))
     mkdirSync5(checksDir, { recursive: true });
   const targetPath = join19(checksDir, `${name}.ts`);
-  if (existsSync18(targetPath)) {
+  if (existsSync17(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
@@ -8663,7 +8741,7 @@ ${registration}
 }
 
 // src/commands/new-role.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join20 } from "node:path";
 var TEMPLATE_PATH3 = join20(packageRoot(import.meta.url), "templates", "role.template.md");
 var ROLES_DIR = join20("vinaya", "roles");
@@ -8680,11 +8758,11 @@ A bare, un-namespaced key resolves as an OVERRIDE of a core role — a complete
     process.exit(2);
   }
   const rolesDir = join20(process.cwd(), ROLES_DIR);
-  if (!existsSync19(rolesDir))
+  if (!existsSync18(rolesDir))
     mkdirSync6(rolesDir, { recursive: true });
   const roleId = name.slice(name.indexOf("/") + 1);
   const targetPath = join20(rolesDir, `${roleId}.md`);
-  if (existsSync19(targetPath)) {
+  if (existsSync18(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
@@ -9153,7 +9231,7 @@ function prEditCommand(args) {
 
 // src/commands/pr-report.ts
 import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync22, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync22, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join21 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
@@ -9213,7 +9291,7 @@ function computeGroupA() {
 function resolveSelfEntry() {
   const root = packageRoot(import.meta.url);
   const dist = join21(root, "dist", "index.js");
-  return existsSync20(dist) ? dist : join21(root, "src", "index.ts");
+  return existsSync19(dist) ? dist : join21(root, "src", "index.ts");
 }
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function anyGateFailed(outcomes) {
@@ -9420,7 +9498,7 @@ async function prReportCommand(args) {
     throw err;
   }
   if (writePath) {
-    const existing = existsSync20(writePath) ? readFileSync22(writePath, "utf8") : "";
+    const existing = existsSync19(writePath) ? readFileSync22(writePath, "utf8") : "";
     const withEvidence = replaceEvidenceBlock(existing, result.blockInner);
     const tokensAddition = collectTokensAddition({
       phase: phaseOverride ?? derivePhase(),
@@ -9616,11 +9694,11 @@ async function prVerifyEvidenceCommand(args) {
 
 // src/commands/quickstart.ts
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync24 } from "node:fs";
 import { join as join23 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname7, join as join22 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
@@ -9639,7 +9717,7 @@ function appendDocOwnersBinding(content, glob, pointer) {
 function planDocOwnersBinding(repoRoot3, glob, pointer) {
   const abs2 = join22(repoRoot3, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync21(abs2)) {
+  if (!existsSync20(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
   const existing = readFileSync23(abs2, "utf-8");
@@ -9716,7 +9794,7 @@ function pointerIsMissingLocalFile(repoRoot3, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync22(join23(repoRoot3, path));
+  return !existsSync21(join23(repoRoot3, path));
 }
 async function bindDocOwnerLoop(deps, repoRoot3) {
   let any = false;
@@ -9807,12 +9885,7 @@ function realDeps7() {
       nodeVersion: () => process.version,
       bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
       packageVersion: readPackageVersion,
-      meteringCapability: () => resolveMeteringCapability({
-        env: process.env,
-        cwd: process.cwd(),
-        exists: existsSync22,
-        readFile: (path) => readFileSync24(path, "utf8")
-      })
+      meteringCapability: () => resolveMeteringCapability(hardenedMeteringDeps())
     },
     confirm: async (q, defaultYes) => promptYesNo(q, defaultYes),
     ask: async (q) => prompt(q),
@@ -10347,7 +10420,7 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
 
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync26, renameSync } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync26, renameSync } from "node:fs";
 import net from "node:net";
 import { dirname as dirname8, join as join25 } from "node:path";
 import { promisify as promisify5 } from "node:util";
@@ -10404,7 +10477,7 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   for (;; ) {
     const webDir = join25(dir, "apps", "vinaya-studio", "web");
     const pkgPath = join25(webDir, "package.json");
-    if (existsSync23(pkgPath)) {
+    if (existsSync22(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync26(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
@@ -10412,7 +10485,7 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
         }
       } catch {}
     }
-    if (existsSync23(join25(dir, ".git")))
+    if (existsSync22(join25(dir, ".git")))
       break;
     const parent = dirname8(dir);
     if (parent === dir)
@@ -10420,7 +10493,7 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
     dir = parent;
   }
   const standaloneWebDir = join25(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync23(join25(standaloneWebDir, "server.js"))) {
+  if (existsSync22(join25(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -10442,7 +10515,7 @@ function isPortFree(port) {
 function ensureStudioNodeModules(bundleRoot) {
   const real = join25(bundleRoot, "node_modules");
   const packed = join25(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync23(real) && existsSync23(packed)) {
+  if (!existsSync22(real) && existsSync22(packed)) {
     renameSync(packed, real);
   }
 }
@@ -10501,7 +10574,7 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync24, readFileSync as readFileSync27, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync27, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join26 } from "node:path";
 function realDeps8() {
   return {
@@ -10521,7 +10594,7 @@ function flags2(args) {
 }
 function readManifest3(repoRoot3) {
   const p = join26(repoRoot3, CONFIG_PATH);
-  if (!existsSync24(p))
+  if (!existsSync23(p))
     return { kind: "missing" };
   let raw;
   try {
@@ -10549,7 +10622,7 @@ function writeManifestVersion(repoRoot3, manifest) {
 }
 function stripFor(repoRoot3, path, marker, comment) {
   const abs2 = resolveManagedBlockPath(repoRoot3, path);
-  if (!existsSync24(abs2))
+  if (!existsSync23(abs2))
     return { path, marker, comment, present: false, removesHost: false };
   const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), marker, comment);
   if (stripped === null)
@@ -10578,7 +10651,7 @@ function planHookRouting(repoRoot3, manifest, recorded, hooksPathValue) {
   const blocked = [];
   for (const b of legacy) {
     const abs2 = resolveManagedBlockPath(repoRoot3, b.path);
-    if (!existsSync24(abs2))
+    if (!existsSync23(abs2))
       continue;
     const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
@@ -10620,7 +10693,7 @@ function planUpgrade(ops, repoRoot3, manifest, routing) {
   for (const op of ops) {
     if (op.kind === "create-file") {
       const abs2 = join26(repoRoot3, op.path);
-      const exists = existsSync24(abs2);
+      const exists = existsSync23(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       let action;
       let triggerChange;
@@ -10653,7 +10726,7 @@ function planUpgrade(ops, repoRoot3, manifest, routing) {
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync24(abs2)) {
+      } else if (!existsSync23(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
@@ -10791,7 +10864,7 @@ function applyUpgrade(plan, repoRoot3) {
     if (!s.present)
       continue;
     const abs2 = resolveManagedBlockPath(repoRoot3, s.path);
-    if (!existsSync24(abs2))
+    if (!existsSync23(abs2))
       continue;
     const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)