@codacy/verity-cli 0.32.0 → 0.32.1-experimental.c640abd

package/bin/verity.js

@@ -911,18 +911,18 @@ var require_suggestSimilar = __commonJS({
       }
       return d[a.length][b.length];
     }
-    function suggestSimilar(word, candidates) {
-      if (!candidates || candidates.length === 0) return "";
-      candidates = Array.from(new Set(candidates));
+    function suggestSimilar(word, candidates2) {
+      if (!candidates2 || candidates2.length === 0) return "";
+      candidates2 = Array.from(new Set(candidates2));
       const searchingOptions = word.startsWith("--");
       if (searchingOptions) {
         word = word.slice(2);
-        candidates = candidates.map((candidate) => candidate.slice(2));
+        candidates2 = candidates2.map((candidate) => candidate.slice(2));
       }
       let similar = [];
       let bestDistance = maxDistance;
       const minSimilarity = 0.4;
-      candidates.forEach((candidate) => {
+      candidates2.forEach((candidate) => {
         if (candidate.length <= 1) return;
         const distance = editDistance(word, candidate);
         const length = Math.max(word.length, candidate.length);
@@ -6974,10 +6974,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep2, value } = collItem;
+        const { start, key, sep: sep3, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep2?.[0],
+          next: key ?? sep3?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -6991,7 +6991,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep2) {
+          if (!keyProps.anchor && !keyProps.tag && !sep3) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -7015,7 +7015,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep2 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep3 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -7031,7 +7031,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep2, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep3, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -7122,7 +7122,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep2 = "";
+        let sep3 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -7136,13 +7136,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep2 + cb;
-              sep2 = "";
+                comment += sep3 + cb;
+              sep3 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep2 += source;
+                sep3 += source;
               hasSpace = true;
               break;
             default:
@@ -7185,18 +7185,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep2, value } = collItem;
+        const { start, key, sep: sep3, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep2?.[0],
+          next: key ?? sep3?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep2 && !value) {
+          if (!props.anchor && !props.tag && !sep3 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -7250,8 +7250,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep2 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep2, null, props, onError);
+        if (!isMap && !sep3 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep3, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -7263,7 +7263,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep2 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep3 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -7274,8 +7274,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep2)
-                for (const st of sep2) {
+              if (sep3)
+                for (const st of sep3) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -7292,7 +7292,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep2, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep3, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -7472,7 +7472,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep2 = "";
+      let sep3 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -7489,24 +7489,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep2 + indent.slice(trimIndent) + content;
-          sep2 = "\n";
+          value += sep3 + indent.slice(trimIndent) + content;
+          sep3 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep2 === " ")
-            sep2 = "\n";
-          else if (!prevMoreIndented && sep2 === "\n")
-            sep2 = "\n\n";
-          value += sep2 + indent.slice(trimIndent) + content;
-          sep2 = "\n";
+          if (sep3 === " ")
+            sep3 = "\n";
+          else if (!prevMoreIndented && sep3 === "\n")
+            sep3 = "\n\n";
+          value += sep3 + indent.slice(trimIndent) + content;
+          sep3 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep2 === "\n")
+          if (sep3 === "\n")
             value += "\n";
           else
-            sep2 = "\n";
+            sep3 = "\n";
         } else {
-          value += sep2 + content;
-          sep2 = " ";
+          value += sep3 + content;
+          sep3 = " ";
           prevMoreIndented = false;
         }
       }
@@ -7684,25 +7684,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep2 = " ";
+      let sep3 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep2 === "\n")
-            res += sep2;
+          if (sep3 === "\n")
+            res += sep3;
           else
-            sep2 = "\n";
+            sep3 = "\n";
         } else {
-          res += sep2 + match[1];
-          sep2 = " ";
+          res += sep3 + match[1];
+          sep3 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep2 + (match?.[1] ?? "");
+      return res + sep3 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -8509,14 +8509,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep2, value }) {
+    function stringifyItem({ start, key, sep: sep3, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep2)
-        for (const st of sep2)
+      if (sep3)
+        for (const st of sep3)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -9659,18 +9659,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep2;
+          let sep3;
           if (scalar.end) {
-            sep2 = scalar.end;
-            sep2.push(this.sourceToken);
+            sep3 = scalar.end;
+            sep3.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep2 = [this.sourceToken];
+            sep3 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep2 }]
+            items: [{ start, key: scalar, sep: sep3 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -9822,15 +9822,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep2 = it.sep;
-                  sep2.push(this.sourceToken);
+                  const sep3 = it.sep;
+                  sep3.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep2 }]
+                    items: [{ start: start2, key, sep: sep3 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -10024,13 +10024,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep2 = fc.end.splice(1, fc.end.length);
-            sep2.push(this.sourceToken);
+            const sep3 = fc.end.splice(1, fc.end.length);
+            sep3.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep2 }]
+              items: [{ start, key: fc, sep: sep3 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -10509,7 +10509,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -11519,7 +11519,7 @@ function startSpinner(label2, opts = {}) {
 }
 
 // src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
 async function githubAccountId(owner) {
   try {
@@ -12735,6 +12735,7 @@ async function applyMomentSelection(moments) {
 
 // src/lib/project-config.ts
 var import_node_fs4 = require("node:fs");
+var import_node_path6 = require("node:path");
 var DEFAULTS = { git_moments: [] };
 function isMoment(value) {
   return value === "commit" || value === "push";
@@ -12742,20 +12743,40 @@ function isMoment(value) {
 function parseMoments(raw) {
   return [...new Set(raw.split(",").map((s) => s.trim()).filter(isMoment))];
 }
-function readProjectConfig() {
+function readConfigFile(path) {
   try {
-    if (!(0, import_node_fs4.existsSync)(PROJECT_CONFIG_FILE)) return DEFAULTS;
-    const raw = JSON.parse((0, import_node_fs4.readFileSync)(PROJECT_CONFIG_FILE, "utf-8"));
+    if (!(0, import_node_fs4.existsSync)(path)) return null;
+    const raw = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
     const moments = Array.isArray(raw.git_moments) ? raw.git_moments.filter(isMoment) : [];
-    return { git_moments: [...new Set(moments)] };
+    const source = raw.git_moments_source === "user" || raw.git_moments_source === "init" ? raw.git_moments_source : void 0;
+    return { git_moments: [...new Set(moments)], ...source ? { git_moments_source: source } : {} };
   } catch {
     return DEFAULTS;
   }
 }
+function candidates() {
+  const local = projectPath(PROJECT_CONFIG_FILE);
+  const out = [{ path: local, source: "local" }];
+  const main = mainWorktreeRoot();
+  if (main) {
+    const inherited = (0, import_node_path6.join)(main, PROJECT_CONFIG_FILE);
+    if (inherited !== local) out.push({ path: inherited, source: "main-worktree" });
+  }
+  return out;
+}
+function readProjectConfig() {
+  for (const { path, source } of candidates()) {
+    const cfg = readConfigFile(path);
+    if (cfg) return { ...cfg, source, path };
+  }
+  return { ...DEFAULTS, source: "default" };
+}
 function writeProjectConfig(patch) {
-  const next = { ...readProjectConfig(), ...patch };
-  (0, import_node_fs4.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs4.writeFileSync)(PROJECT_CONFIG_FILE, JSON.stringify(next, null, 2) + "\n");
+  const { git_moments, git_moments_source } = readProjectConfig();
+  const next = { git_moments, ...git_moments_source ? { git_moments_source } : {}, ...patch };
+  const target = projectPath(PROJECT_CONFIG_FILE);
+  (0, import_node_fs4.mkdirSync)((0, import_node_path6.dirname)(target), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
   return next;
 }
 function resolveGuardMoments(explicit) {
@@ -12765,6 +12786,8 @@ function resolveGuardMoments(explicit) {
 
 // src/lib/plugin-ownership.ts
 var import_node_fs6 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path7 = require("node:path");
 
 // src/lib/stderr-log.ts
 var import_node_fs5 = require("node:fs");
@@ -12821,16 +12844,19 @@ function logToFileOnly(text) {
 }
 
 // src/lib/plugin-ownership.ts
-var MARKER_TTL_SECONDS = 24 * 60 * 60;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
 function isPluginInvocation() {
   return !!process.env.VERITY_PLUGIN_ROOT;
 }
+function markerPath() {
+  return projectPath(PLUGIN_MARKER_FILE);
+}
 function readMarker() {
   try {
-    if (!(0, import_node_fs6.existsSync)(PLUGIN_MARKER_FILE)) return null;
-    const raw = JSON.parse((0, import_node_fs6.readFileSync)(PLUGIN_MARKER_FILE, "utf-8"));
+    if (!(0, import_node_fs6.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs6.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
-    if (!pluginRoot) return null;
+    if (!pluginRoot || CONTROL_CHARS.test(pluginRoot)) return null;
     return {
       session_id: typeof raw.session_id === "string" ? raw.session_id : null,
       plugin_root: pluginRoot,
@@ -12845,17 +12871,109 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs6.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs6.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs6.writeFileSync)(PLUGIN_MARKER_FILE, JSON.stringify(marker));
+    (0, import_node_fs6.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
+function claudeConfigDir() {
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".claude");
+}
+function readJsonFile(path) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function enabledPluginSetting(key) {
+  const files = [
+    projectPath((0, import_node_path7.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path7.join)(".claude", "settings.json")),
+    (0, import_node_path7.join)(claudeConfigDir(), "settings.json")
+  ];
+  for (const file of files) {
+    const map = readJsonFile(file)?.enabledPlugins;
+    if (map && typeof map === "object" && key in map) {
+      return map[key] !== false;
+    }
+  }
+  return void 0;
+}
+function marketplaceLocations() {
+  const out = /* @__PURE__ */ new Map();
+  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  if (!known) return out;
+  for (const [name, entry] of Object.entries(known)) {
+    const loc2 = entry?.installLocation;
+    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path7.resolve)(loc2));
+  }
+  return out;
+}
+function realpathOr(p) {
+  try {
+    return import_node_fs6.realpathSync.native(p);
+  } catch {
+    return (0, import_node_path7.resolve)(p);
+  }
+}
+function isWithin(want, dir) {
+  return want === dir || want.startsWith(dir + import_node_path7.sep);
+}
+function entryAppliesHere(entry, here) {
+  const e = entry;
+  const scope2 = typeof e?.scope === "string" ? e.scope : "user";
+  if (scope2 === "user") return true;
+  const forProject = typeof e?.projectPath === "string" ? realpathOr(e.projectPath) : "";
+  return forProject === here;
+}
+function registrySays(pluginRoot) {
+  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  if (!plugins || typeof plugins !== "object") return "unverified";
+  const want = (0, import_node_path7.resolve)(pluginRoot);
+  const here = realpathOr(repoRoot());
+  const markets = marketplaceLocations();
+  for (const [key, value] of Object.entries(plugins)) {
+    const at = key.lastIndexOf("@");
+    const source = at > 0 ? markets.get(key.slice(at + 1)) : void 0;
+    const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
+    const claims = applicable.some((entry) => {
+      const installPath = entry?.installPath;
+      return typeof installPath === "string" && (0, import_node_path7.resolve)(installPath) === want;
+    }) || source !== void 0 && applicable.length > 0 && isWithin(want, source);
+    if (claims) {
+      if (enabledPluginSetting(key) === false) return "gone";
+      return (0, import_node_fs6.existsSync)(pluginRoot) ? "live" : "gone";
+    }
+  }
+  const managed = (0, import_node_path7.resolve)((0, import_node_path7.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path7.sep) ? "gone" : "unverified";
+}
+var _live = /* @__PURE__ */ new Map();
+function pluginLiveness(pluginRoot) {
+  const cached2 = _live.get(pluginRoot);
+  if (cached2 !== void 0) return cached2;
+  const said = registrySays(pluginRoot);
+  _live.set(pluginRoot, said);
+  return said;
+}
+function clearStalePluginMarker() {
+  const marker = readMarker();
+  if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
+  try {
+    (0, import_node_fs6.rmSync)(markerPath(), { force: true });
+  } catch {
+    return null;
+  }
+  return { pluginRoot: marker.plugin_root, version: marker.version };
+}
 function shouldDeferToPlugin(sessionId) {
   if (isPluginInvocation()) {
     recordPluginOwnership(sessionId);
@@ -12863,13 +12981,44 @@ function shouldDeferToPlugin(sessionId) {
   }
   const marker = readMarker();
   if (!marker) return false;
-  if (!(0, import_node_fs6.existsSync)(marker.plugin_root)) return false;
+  const liveness = pluginLiveness(marker.plugin_root);
+  if (liveness === "gone") return false;
   if (sessionId && marker.session_id) return sessionId === marker.session_id;
-  return Math.floor(Date.now() / 1e3) - marker.ts < MARKER_TTL_SECONDS;
+  logToFileOnly(
+    // JSON-encoded: `plugin_root` is repository-controlled, and raw it could
+    // write forged lines into the one place someone looks to understand why
+    // the gate did what it did. (`readMarker` also refuses control characters.)
+    `plugin ownership: no session id to match against the marker for ${JSON.stringify(marker.plugin_root)} \u2014 running rather than standing down, because only an exact session match is evidence a repository cannot write.`
+  );
+  return false;
 }
 function pluginActiveHere() {
+  return activePluginInstall() !== null;
+}
+function registeredVerityPlugin() {
+  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  if (!plugins || typeof plugins !== "object") return null;
+  const here = realpathOr(repoRoot());
+  for (const [key, value] of Object.entries(plugins)) {
+    const at = key.lastIndexOf("@");
+    if ((at > 0 ? key.slice(0, at) : key) !== "verity") continue;
+    if (enabledPluginSetting(key) === false) continue;
+    for (const entry of Array.isArray(value) ? value : []) {
+      const e = entry;
+      const installPath = typeof e.installPath === "string" ? e.installPath : "";
+      if (!installPath || !(0, import_node_fs6.existsSync)(installPath)) continue;
+      if (!entryAppliesHere(entry, here)) continue;
+      return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
+    }
+  }
+  return null;
+}
+function activePluginInstall() {
   const marker = readMarker();
-  return !!marker && (0, import_node_fs6.existsSync)(marker.plugin_root);
+  if (marker && pluginLiveness(marker.plugin_root) === "live") {
+    return { pluginRoot: marker.plugin_root, version: marker.version };
+  }
+  return registeredVerityPlugin();
 }
 function deferredToPlugin(command, sessionId) {
   if (!shouldDeferToPlugin(sessionId)) return false;
@@ -12879,21 +13028,63 @@ function deferredToPlugin(command, sessionId) {
   return true;
 }
 
+// src/lib/hook-wiring.ts
+function carriesAnyVerityHook(s) {
+  return s.stop || s.intent || s.baseline || s.compact || s.sessionEnd || s.guard;
+}
+async function resolveHookWiring() {
+  const settings = await checkAllVerityHooks();
+  const config = readProjectConfig();
+  const gitMoments = { source: config.source, path: config.path };
+  if (!pluginActiveHere()) {
+    return { source: "settings", status: settings, settings, duplicateSettingsHooks: false, gitMoments };
+  }
+  const status = {
+    stop: true,
+    intent: true,
+    baseline: true,
+    compact: true,
+    sessionEnd: true,
+    guard: true,
+    guardOn: config.git_moments
+  };
+  return {
+    source: "plugin",
+    status,
+    settings,
+    duplicateSettingsHooks: carriesAnyVerityHook(settings),
+    gitMoments
+  };
+}
+
 // src/commands/hooks.ts
 var ALL_MOMENTS = ["stop", "pre-commit", "pre-push"];
-function parseMoments2(raw) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const part of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
-    if (ALL_MOMENTS.includes(part)) seen.add(part);
+function parseMomentSelection(raw) {
+  const parts = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  if (parts.length === 1 && parts[0].toLowerCase() === "none") return { moments: [] };
+  if (parts.length === 0) {
+    return { error: `--moments was empty. Pass one or more of ${ALL_MOMENTS.join(", ")} \u2014 or "none" to gate nothing.` };
+  }
+  const unknown = parts.filter((p) => !ALL_MOMENTS.includes(p));
+  if (unknown.length > 0) {
+    return {
+      error: `--moments: unrecognised ${unknown.length === 1 ? "moment" : "moments"} ${unknown.map((u) => `"${u}"`).join(", ")}. Valid: ${ALL_MOMENTS.join(", ")} \u2014 or "none" to gate nothing.`
+    };
   }
-  return ALL_MOMENTS.filter((m) => seen.has(m));
+  const seen = new Set(parts);
+  return { moments: ALL_MOMENTS.filter((m) => seen.has(m)) };
 }
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage Claude Code hook wiring");
   hooks.command("install").description("Install Verity hooks into Claude Code settings").option("--force", "Overwrite existing Verity hooks").option("--moments <list>", "Reconcile to exactly these moments: stop,pre-commit,pre-push").action(async (opts) => {
     const force = opts.force ?? false;
     if (opts.moments != null) {
-      const moments = parseMoments2(opts.moments);
+      const parsed = parseMomentSelection(opts.moments);
+      if ("error" in parsed) {
+        printError(parsed.error);
+        process.exit(1);
+      }
+      const moments = parsed.moments;
       const gitMoments = [
         ...moments.includes("pre-commit") ? ["commit"] : [],
         ...moments.includes("pre-push") ? ["push"] : []
@@ -12954,20 +13145,22 @@ function registerHooksCommands(program2) {
     printInfo("  SessionStart hook: verity baseline capture");
   });
   hooks.command("check").description("Check if Verity hooks are installed").action(async () => {
-    const status = await checkAllVerityHooks();
-    if (pluginActiveHere()) {
-      const moments = readProjectConfig().git_moments;
+    const wiring = await resolveHookWiring();
+    const status = wiring.status;
+    if (wiring.source === "plugin") {
+      const moments = status.guardOn;
+      const inherited = wiring.gitMoments.source === "main-worktree" && wiring.gitMoments.path ? ` (inherited from the main worktree: ${wiring.gitMoments.path})` : "";
       printInfo("Wired by the Verity Claude Code plugin (not .claude/settings.json):");
       printInfo("  Stop hook (verity analyze): installed");
       printInfo("  Intent hook (verity intent capture): installed");
       printInfo("  Baseline hook (verity baseline capture): installed");
       printInfo(
-        `  Git-moment gate (verity guard): ${moments.length ? `installed [${moments.join(", ")}]` : "wired but gating nothing"}`
+        `  Git-moment gate (verity guard): ${moments.length ? `installed [${moments.join(", ")}]${inherited}` : "wired but gating nothing"}`
       );
       if (!moments.length) {
         printInfo('  Enable it with "verity config git-moments commit,push".');
       }
-      if (status.stop || status.intent || status.baseline || status.guard) {
+      if (wiring.duplicateSettingsHooks) {
         printWarn("  Duplicate hooks also exist in .claude/settings.json. They stand down at run time,");
         printWarn('  but remove them with "verity init --plugin-mode" so the wiring says what it does.');
       }
@@ -13352,8 +13545,8 @@ function isCommandOnlyTurn(input) {
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
 var import_node_fs8 = require("node:fs");
-var import_node_os2 = require("node:os");
-var import_node_path6 = require("node:path");
+var import_node_os3 = require("node:os");
+var import_node_path8 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
   "-",
@@ -13407,13 +13600,13 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path6.resolve)(override) : (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path8.resolve)(override) : (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".verity");
 }
 function dossierDir(identity) {
-  return (0, import_node_path6.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
 }
 function treeDir(identity) {
-  return (0, import_node_path6.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
 }
 function scopeIdentity(token, sessionId) {
   const t = (token ?? "").trim();
@@ -13429,7 +13622,7 @@ function sessionScopeKey(token, sessionId) {
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
 var import_node_fs9 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_path9 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -13507,7 +13700,7 @@ async function cleanupTaskContextBuffers() {
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path7.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path9.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -13521,7 +13714,7 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path7.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path9.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
@@ -13547,7 +13740,7 @@ async function appendEntry(taskId, entry) {
 // src/lib/memory-retrieval.ts
 var import_promises7 = require("node:fs/promises");
 var import_node_fs10 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_path10 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -13645,14 +13838,14 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path8.join)(memoryDir(), domain);
+    const domainDir = (0, import_node_path10.join)(memoryDir(), domain);
     if (!(0, import_node_fs10.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises7.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises7.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises7.readFile)((0, import_node_path10.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -13712,26 +13905,26 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 // src/lib/memory-sync.ts
 var import_promises8 = require("node:fs/promises");
 var import_node_fs12 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_path12 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 
 // src/lib/safe-path.ts
 var import_node_fs11 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_path11 = require("node:path");
 function resolveInside(baseDir, candidate) {
   if (typeof candidate !== "string" || candidate.length === 0) return null;
-  if ((0, import_node_path9.isAbsolute)(candidate)) return null;
-  const baseAbs = (0, import_node_path9.resolve)(baseDir);
-  const full = (0, import_node_path9.resolve)(baseAbs, candidate);
-  const baseSep = baseAbs.endsWith(import_node_path9.sep) ? baseAbs : baseAbs + import_node_path9.sep;
+  if ((0, import_node_path11.isAbsolute)(candidate)) return null;
+  const baseAbs = (0, import_node_path11.resolve)(baseDir);
+  const full = (0, import_node_path11.resolve)(baseAbs, candidate);
+  const baseSep = baseAbs.endsWith(import_node_path11.sep) ? baseAbs : baseAbs + import_node_path11.sep;
   if (full !== baseAbs && !full.startsWith(baseSep)) return null;
   try {
     if ((0, import_node_fs11.existsSync)(baseAbs)) {
       const realBase = (0, import_node_fs11.realpathSync)(baseAbs);
-      const realBaseSep = realBase.endsWith(import_node_path9.sep) ? realBase : realBase + import_node_path9.sep;
+      const realBaseSep = realBase.endsWith(import_node_path11.sep) ? realBase : realBase + import_node_path11.sep;
       let probe = full;
       while (!(0, import_node_fs11.existsSync)(probe)) {
-        const parent = (0, import_node_path9.dirname)(probe);
+        const parent = (0, import_node_path11.dirname)(probe);
         if (parent === probe) break;
         probe = parent;
       }
@@ -13812,16 +14005,16 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises8.mkdir)((0, import_node_path10.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises8.mkdir)((0, import_node_path12.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs12.existsSync)((0, import_node_path10.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs12.existsSync)((0, import_node_path12.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path12.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs12.existsSync)((0, import_node_path10.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs12.existsSync)((0, import_node_path12.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path12.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs12.existsSync)((0, import_node_path10.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs12.existsSync)((0, import_node_path12.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path12.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
@@ -13830,14 +14023,14 @@ async function buildManifest() {
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path10.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path12.join)(memoryDir2(), domain);
     if (!(0, import_node_fs12.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path10.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path12.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -13850,13 +14043,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises8.readFile)((0, import_node_path10.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises8.readFile)((0, import_node_path12.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises8.readFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises8.readFile)((0, import_node_path12.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -13869,13 +14062,13 @@ async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
   if (!(0, import_node_fs12.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path10.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path12.join)(memoryDir2(), domain);
     if (!(0, import_node_fs12.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises8.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path10.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path12.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -13921,7 +14114,7 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path10.join)(memoryDir2(), path);
+    const full = (0, import_node_path12.join)(memoryDir2(), path);
     if (!(0, import_node_fs12.existsSync)(full)) continue;
     let content;
     try {
@@ -13958,8 +14151,8 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs12.existsSync)((0, import_node_path10.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs12.existsSync)((0, import_node_path12.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path12.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises8.writeFile)((0, import_node_path12.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
@@ -13991,7 +14184,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises8.mkdir)((0, import_node_path10.dirname)(fullPath), { recursive: true });
+  await (0, import_promises8.mkdir)((0, import_node_path12.dirname)(fullPath), { recursive: true });
   await (0, import_promises8.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -14032,7 +14225,7 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path10.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path12.join)(memoryDir2(), domain);
     if (!(0, import_node_fs12.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
@@ -14043,7 +14236,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path10.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path12.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -14067,7 +14260,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path10.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path12.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
@@ -14301,7 +14494,7 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path10.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path12.join)(cwd, "CLAUDE.md");
   let existing = "";
   if ((0, import_node_fs12.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
@@ -14441,7 +14634,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 // src/lib/dossier-session.ts
 var import_node_fs17 = require("node:fs");
 var import_node_crypto7 = require("node:crypto");
-var import_node_path13 = require("node:path");
+var import_node_path15 = require("node:path");
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -14547,7 +14740,7 @@ function statementAnchorKey(file, patternId) {
 // src/lib/dossier/log.ts
 var import_node_crypto4 = require("node:crypto");
 var import_node_fs13 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_path13 = require("node:path");
 var CRC_TABLE = (() => {
   const t = new Int32Array(256);
   for (let i = 0; i < 256; i++) {
@@ -14570,9 +14763,9 @@ function openDossier(identity) {
     return {
       dir,
       identity,
-      eventsPath: (0, import_node_path11.join)(dir, "events.jsonl"),
-      foldPath: (0, import_node_path11.join)(dir, "fold.json"),
-      rotatedDir: (0, import_node_path11.join)(dir, "rotated")
+      eventsPath: (0, import_node_path13.join)(dir, "events.jsonl"),
+      foldPath: (0, import_node_path13.join)(dir, "fold.json"),
+      rotatedDir: (0, import_node_path13.join)(dir, "rotated")
     };
   } catch {
     return null;
@@ -14645,11 +14838,11 @@ function rotateIfNeeded2(d) {
     if (!(0, import_node_fs13.existsSync)(d.eventsPath)) return;
     if ((0, import_node_fs13.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
     (0, import_node_fs13.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
-    (0, import_node_fs13.renameSync)(d.eventsPath, (0, import_node_path11.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
+    (0, import_node_fs13.renameSync)(d.eventsPath, (0, import_node_path13.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
     const kept = (0, import_node_fs13.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - ROTATE_KEEP))) {
       try {
-        (0, import_node_fs13.renameSync)((0, import_node_path11.join)(d.rotatedDir, stale), (0, import_node_path11.join)(d.rotatedDir, `${stale}.pruned`));
+        (0, import_node_fs13.renameSync)((0, import_node_path13.join)(d.rotatedDir, stale), (0, import_node_path13.join)(d.rotatedDir, `${stale}.pruned`));
       } catch {
       }
     }
@@ -14660,7 +14853,7 @@ function rotateIfNeeded2(d) {
 // src/lib/dossier/fold-dossier.ts
 var import_node_crypto5 = require("node:crypto");
 var import_node_fs14 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_path14 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
   human_reachable: { value: "unknown", tier: "unknown" },
   authorship_observability: { value: "unknown", tier: "unknown" },
@@ -14716,7 +14909,7 @@ function foldDossier(d, opts = {}) {
       state.meta.rotations = files.length;
       for (const f of files) {
         try {
-          ingest((0, import_node_fs14.readFileSync)((0, import_node_path12.join)(d.rotatedDir, f), "utf8"));
+          ingest((0, import_node_fs14.readFileSync)((0, import_node_path14.join)(d.rotatedDir, f), "utf8"));
         } catch {
           state.meta.dropped_lines++;
         }
@@ -15573,16 +15766,16 @@ function foreignAuthoredPaths(identity, opts = {}) {
     for (const entry of (0, import_node_fs17.readdirSync)(dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (entry.name === identity.sessionKey) continue;
-      const log = (0, import_node_path13.join)(dir, entry.name, "events.jsonl");
+      const log = (0, import_node_path15.join)(dir, entry.name, "events.jsonl");
       try {
         if (!(0, import_node_fs17.existsSync)(log)) continue;
         if (now - (0, import_node_fs17.statSync)(log).mtimeMs > windowMs) continue;
         const sib = {
-          dir: (0, import_node_path13.join)(dir, entry.name),
+          dir: (0, import_node_path15.join)(dir, entry.name),
           identity,
           eventsPath: log,
-          foldPath: (0, import_node_path13.join)(dir, entry.name, "fold.json"),
-          rotatedDir: (0, import_node_path13.join)(dir, entry.name, "rotated")
+          foldPath: (0, import_node_path15.join)(dir, entry.name, "fold.json"),
+          rotatedDir: (0, import_node_path15.join)(dir, entry.name, "rotated")
         };
         const state = readFoldCache(sib) ?? foldDossier(sib);
         sessions++;
@@ -15610,22 +15803,22 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
   let removed = 0;
   try {
     const mine = dossierDir(identity);
-    const userDir = (0, import_node_path13.dirname)((0, import_node_path13.dirname)(mine));
+    const userDir = (0, import_node_path15.dirname)((0, import_node_path15.dirname)(mine));
     if (!(0, import_node_fs17.existsSync)(userDir)) return 0;
     const cutoff = Date.now() - maxAgeMs;
     for (const tree of (0, import_node_fs17.readdirSync)(userDir, { withFileTypes: true })) {
       if (!tree.isDirectory()) continue;
-      const treePath = (0, import_node_path13.join)(userDir, tree.name);
+      const treePath = (0, import_node_path15.join)(userDir, tree.name);
       let live = 0;
       for (const entry of (0, import_node_fs17.readdirSync)(treePath, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = (0, import_node_path13.join)(treePath, entry.name);
+        const dir = (0, import_node_path15.join)(treePath, entry.name);
         if (dir === mine) {
           live++;
           continue;
         }
         try {
-          const log = (0, import_node_path13.join)(dir, "events.jsonl");
+          const log = (0, import_node_path15.join)(dir, "events.jsonl");
           const at = (0, import_node_fs17.existsSync)(log) ? (0, import_node_fs17.statSync)(log).mtimeMs : (0, import_node_fs17.statSync)(dir).mtimeMs;
           if (at < cutoff) {
             (0, import_node_fs17.rmSync)(dir, { recursive: true, force: true });
@@ -15680,7 +15873,7 @@ function recordTurn(d, t) {
   for (const a of t.authored) {
     const origin = a.owner === "subagent" ? "subagent" : "edit_tool";
     const prior = t.known?.authored?.get(a.p);
-    const hash = fileHash((0, import_node_path13.join)(root, a.p));
+    const hash = fileHash((0, import_node_path15.join)(root, a.p));
     const hunks = Math.max(0, a.h - (prior?.hunks ?? 0));
     const adds = Math.max(0, a.a - (prior?.adds ?? 0));
     const dels = Math.max(0, a.d - (prior?.dels ?? 0));
@@ -15713,7 +15906,7 @@ function recordTurn(d, t) {
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
   for (const u of t.unobserved) {
-    const hash = fileHash((0, import_node_path13.join)(root, u.p));
+    const hash = fileHash((0, import_node_path15.join)(root, u.p));
     if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
     appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
   }
@@ -15748,7 +15941,7 @@ function recordVerdict(d, v) {
     if (!sent.has(f.file)) continue;
     if (!lines.has(f.file)) {
       try {
-        const abs = (0, import_node_path13.join)(root, f.file);
+        const abs = (0, import_node_path15.join)(root, f.file);
         lines.set(f.file, (0, import_node_fs17.existsSync)(abs) ? (0, import_node_fs17.readFileSync)(abs, "utf8").split("\n") : null);
       } catch {
         lines.set(f.file, null);
@@ -15849,7 +16042,7 @@ function recallMemory(d, identity, opts) {
       budgetBytes: opts.budgetBytes,
       readFileLines: (file) => {
         try {
-          const abs = (0, import_node_path13.join)(root, file);
+          const abs = (0, import_node_path15.join)(root, file);
           return (0, import_node_fs17.existsSync)(abs) ? (0, import_node_fs17.readFileSync)(abs, "utf8").split("\n") : null;
         } catch {
           return null;
@@ -15995,21 +16188,21 @@ async function fireClassify(prompt, sessionId, globals) {
 
 // src/commands/lifecycle.ts
 var import_node_fs21 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_path19 = require("node:path");
 
 // src/lib/baseline.ts
 var import_node_fs20 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_path18 = require("node:path");
 var import_node_crypto9 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs19 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_path17 = require("node:path");
 var import_node_child_process6 = require("node:child_process");
 
 // src/lib/files.ts
 var import_node_fs18 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_path16 = require("node:path");
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -16077,7 +16270,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path14.extname)(filepath).slice(1);
+  const ext = (0, import_node_path16.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -16180,7 +16373,7 @@ function generateSnapshotDiffs(files) {
   const diffs = [];
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path15.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path17.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
     if ((0, import_node_fs19.existsSync)(snapshotPath)) {
       const oldContent = (0, import_node_fs19.readFileSync)(snapshotPath, "utf-8");
@@ -16208,16 +16401,16 @@ function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path15.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path17.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs19.mkdirSync)((0, import_node_path15.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs19.mkdirSync)((0, import_node_path17.dirname)(snapshotPath), { recursive: true });
     (0, import_node_fs19.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path15.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path15.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path17.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path17.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
     (0, import_node_fs19.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs19.writeFileSync)(tmpOld, oldContent);
@@ -16250,7 +16443,7 @@ function cleanStaleSnapshots(dir, keepSet) {
     const entries = (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
-      const fullPath = (0, import_node_path15.join)(dir, entry.name);
+      const fullPath = (0, import_node_path17.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
@@ -16279,13 +16472,13 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto9.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path16.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path18.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path16.join)(dir, "manifest.json");
+  return (0, import_node_path18.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path16.join)(dir, "files", repoRelPath);
+  return (0, import_node_path18.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
@@ -16347,7 +16540,7 @@ function captureBaseline(opts = {}) {
     (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path16.join)(dir, "files");
+  const filesDir = (0, import_node_path18.join)(dir, "files");
   const mirrored = [];
   try {
     (0, import_node_fs20.mkdirSync)(filesDir, { recursive: true });
@@ -16357,7 +16550,7 @@ function captureBaseline(opts = {}) {
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs20.mkdirSync)((0, import_node_path16.dirname)(dest), { recursive: true });
+        (0, import_node_fs20.mkdirSync)((0, import_node_path18.dirname)(dest), { recursive: true });
         (0, import_node_fs20.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
@@ -16465,7 +16658,7 @@ function absorbIntoBaseline(paths, sessionId) {
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
-      (0, import_node_fs20.mkdirSync)((0, import_node_path16.dirname)(dest), { recursive: true });
+      (0, import_node_fs20.mkdirSync)((0, import_node_path18.dirname)(dest), { recursive: true });
       (0, import_node_fs20.writeFileSync)(dest, content);
       dirty.add(p);
       adopted++;
@@ -16513,7 +16706,7 @@ function pruneOldBaselines() {
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path16.join)(root, name);
+    const dir = (0, import_node_path18.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
@@ -16701,7 +16894,7 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path17.join)(root, file);
+        const abs = (0, import_node_path19.join)(root, file);
         return (0, import_node_fs21.existsSync)(abs) ? (0, import_node_fs21.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
@@ -16738,17 +16931,17 @@ async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
-    const timeout = new Promise((resolve4) => setTimeout(() => resolve4({}), 500));
-    const read = new Promise((resolve4) => {
+    const timeout = new Promise((resolve5) => setTimeout(() => resolve5({}), 500));
+    const read = new Promise((resolve5) => {
       process.stdin.on("data", (c) => chunks.push(c));
       process.stdin.on("end", () => {
         try {
-          resolve4(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
+          resolve5(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
         } catch {
-          resolve4({});
+          resolve5({});
         }
       });
-      process.stdin.on("error", () => resolve4({}));
+      process.stdin.on("error", () => resolve5({}));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -16766,17 +16959,17 @@ var import_yaml3 = __toESM(require_dist());
 var import_node_child_process8 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
-var import_node_path20 = require("node:path");
+var import_node_path22 = require("node:path");
 var import_yaml = __toESM(require_dist());
 
 // src/lib/data-dir.ts
 var import_node_fs22 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_path20 = require("node:path");
 function resolveDataDir() {
-  const candidates = [
-    (0, import_node_path18.join)(__dirname, "..", "data"),
+  const candidates2 = [
+    (0, import_node_path20.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path18.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path20.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
     // THE COMMITTED SOURCE, for a source checkout that has not been built.
     // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
@@ -16785,14 +16978,14 @@ function resolveDataDir() {
     // without this the synthesizer throws "Could not find Verity skill data"
     // for every test and every `verity` run from source. Resolved from this
     // module's own location, never the cwd: see the warning below.
-    (0, import_node_path18.join)(__dirname, "..", "..", "client"),
+    (0, import_node_path20.join)(__dirname, "..", "..", "client"),
     // bundled: cli/bin/ → ../../client
-    (0, import_node_path18.join)(__dirname, "..", "..", "..", "client"),
+    (0, import_node_path20.join)(__dirname, "..", "..", "..", "client"),
     // tsx: cli/src/lib/ → ../../../client
     ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
   ];
-  for (const candidate of candidates) {
-    if ((0, import_node_fs22.existsSync)((0, import_node_path18.join)(candidate, "skills"))) {
+  for (const candidate of candidates2) {
+    if ((0, import_node_fs22.existsSync)((0, import_node_path20.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -16801,13 +16994,13 @@ function resolveDataDir() {
   );
 }
 function setupDataPath(file) {
-  return (0, import_node_path18.join)(resolveDataDir(), "skills", "verity-setup", file);
+  return (0, import_node_path20.join)(resolveDataDir(), "skills", "verity-setup", file);
 }
 
 // src/lib/detect.ts
 var import_node_child_process7 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_path21 = require("node:path");
 var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -16870,18 +17063,18 @@ function walk(root) {
     for (const entry of entries) {
       if (found.length >= WALK_MAX_FILES) return;
       if (IGNORED_SEGMENTS.includes(entry.name)) continue;
-      const full = (0, import_node_path19.join)(dir, entry.name);
+      const full = (0, import_node_path21.join)(dir, entry.name);
       if (entry.isDirectory()) visit(full, depth + 1);
-      else if (entry.isFile()) found.push((0, import_node_path19.relative)(root, full));
+      else if (entry.isFile()) found.push((0, import_node_path21.relative)(root, full));
     }
   };
   visit(root, 0);
   return found;
 }
 function languageOf(path) {
-  const name = (0, import_node_path19.basename)(path);
+  const name = (0, import_node_path21.basename)(path);
   if (/^Dockerfile(\..+)?$/i.test(name)) return "dockerfile";
-  if (!(0, import_node_path19.extname)(name)) return null;
+  if (!(0, import_node_path21.extname)(name)) return null;
   const lang = detectLanguage(path);
   return lang || null;
 }
@@ -16963,12 +17156,12 @@ function declaredDependencies(root, files) {
       if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
     }
   };
-  readPackageJson((0, import_node_path19.join)(root, "package.json"));
-  const nested = files.filter((f) => f.includes("/") && (0, import_node_path19.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
-  for (const rel of nested) readPackageJson((0, import_node_path19.join)(root, rel));
+  readPackageJson((0, import_node_path21.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path21.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path21.join)(root, rel));
   const pythonManifests = [
-    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path19.join)(root, f)),
-    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path19.join)(root, f))
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path21.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path21.join)(root, f))
   ];
   for (const path of pythonManifests) {
     if (!(0, import_node_fs23.existsSync)(path)) continue;
@@ -16983,8 +17176,8 @@ function declaredDependencies(root, files) {
     }
   }
   const goMods = [
-    (0, import_node_path19.join)(root, "go.mod"),
-    ...files.filter((f) => f.includes("/") && (0, import_node_path19.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path19.join)(root, f))
+    (0, import_node_path21.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path21.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path21.join)(root, f))
   ];
   for (const path of goMods) {
     if (!(0, import_node_fs23.existsSync)(path)) continue;
@@ -16997,7 +17190,7 @@ function declaredDependencies(root, files) {
     }
   }
   for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
-    const path = (0, import_node_path19.join)(root, file);
+    const path = (0, import_node_path21.join)(root, file);
     if (!(0, import_node_fs23.existsSync)(path)) continue;
     try {
       const text = (0, import_node_fs23.readFileSync)(path, "utf-8");
@@ -17008,7 +17201,7 @@ function declaredDependencies(root, files) {
   return names2;
 }
 function detectBuildSystem(root, files) {
-  const has = (f) => (0, import_node_fs23.existsSync)((0, import_node_path19.join)(root, f)) || files.some((p) => (0, import_node_path19.basename)(p) === f);
+  const has = (f) => (0, import_node_fs23.existsSync)((0, import_node_path21.join)(root, f)) || files.some((p) => (0, import_node_path21.basename)(p) === f);
   if (has("pnpm-lock.yaml")) return "pnpm";
   if (has("yarn.lock")) return "yarn";
   if (has("bun.lock") || has("bun.lockb")) return "bun";
@@ -17025,8 +17218,8 @@ function detectBuildSystem(root, files) {
 }
 function detectArchitecture(root, files) {
   const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
-  if (workspaceMarkers.some((m) => (0, import_node_fs23.existsSync)((0, import_node_path19.join)(root, m)))) return "monorepo";
-  const pkg = readJson((0, import_node_path19.join)(root, "package.json"));
+  if (workspaceMarkers.some((m) => (0, import_node_fs23.existsSync)((0, import_node_path21.join)(root, m)))) return "monorepo";
+  const pkg = readJson((0, import_node_path21.join)(root, "package.json"));
   if (pkg && "workspaces" in pkg) return "monorepo";
   const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
   const nested = manifests.filter((f) => f.includes("/"));
@@ -17039,16 +17232,16 @@ function detectArchitecture(root, files) {
 var SAMPLE_LIMIT = 300;
 function measureAvgFileLength(root, files, languages) {
   const primary = new Set(languages.slice(0, 2));
-  const candidates = files.filter((f) => {
+  const candidates2 = files.filter((f) => {
     const lang = languageOf(f);
     return lang !== null && primary.has(lang);
   });
-  if (candidates.length === 0) return null;
-  const stride = Math.max(1, Math.floor(candidates.length / SAMPLE_LIMIT));
+  if (candidates2.length === 0) return null;
+  const stride = Math.max(1, Math.floor(candidates2.length / SAMPLE_LIMIT));
   let total = 0;
   let counted = 0;
-  for (let i = 0; i < candidates.length; i += stride) {
-    const path = (0, import_node_path19.join)(root, candidates[i]);
+  for (let i = 0; i < candidates2.length; i += stride) {
+    const path = (0, import_node_path21.join)(root, candidates2[i]);
     try {
       if ((0, import_node_fs23.statSync)(path).size > 2 * 1024 * 1024) continue;
       total += (0, import_node_fs23.readFileSync)(path, "utf-8").split("\n").length;
@@ -17076,14 +17269,14 @@ function detectProject(root = repoRoot()) {
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
     for (const marker of markers) {
-      if ((0, import_node_fs23.existsSync)((0, import_node_path19.join)(root, marker))) {
+      if ((0, import_node_fs23.existsSync)((0, import_node_path21.join)(root, marker))) {
         existingToolConfigs.push({ tool, path: `./${marker}` });
         break;
       }
     }
   }
   return {
-    projectName: (0, import_node_path19.basename)(root),
+    projectName: (0, import_node_path21.basename)(root),
     languages,
     languageCounts,
     frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
@@ -17529,7 +17722,7 @@ async function correctVerityMdVersion(opts) {
 }
 async function writeFileTo(relative2, body) {
   const target = projectPath(relative2);
-  await (0, import_promises9.mkdir)((0, import_node_path20.dirname)(target), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path22.dirname)(target), { recursive: true });
   await (0, import_promises9.writeFile)(target, body);
 }
 async function deriveConfigForStandard(standard) {
@@ -18004,7 +18197,11 @@ function registerConfigCommands(program2) {
   });
   config.command("git-moments [moments]").description('Get or set the git moments the guard reviews: commit,push \u2014 or "none"').action((moments) => {
     if (moments === void 0) {
-      const current = readProjectConfig().git_moments;
+      const config2 = readProjectConfig();
+      const current = config2.git_moments;
+      if (config2.source === "main-worktree" && config2.path) {
+        printInfo(`Inherited from the main worktree: ${config2.path}`);
+      }
       process.stdout.write((current.length ? current.join(",") : "none") + "\n");
       return;
     }
@@ -18013,7 +18210,7 @@ function registerConfigCommands(program2) {
       printError(`Unrecognised moments: ${moments}. Use "commit", "push", "commit,push", or "none".`);
       process.exit(1);
     }
-    writeProjectConfig({ git_moments: next });
+    writeProjectConfig({ git_moments: next, git_moments_source: "user" });
     printInfo(
       next.length ? `Git-moment review enabled for: ${next.join(", ")}` : "Git-moment review disabled \u2014 commits and pushes are no longer gated."
     );
@@ -18474,8 +18671,14 @@ function timeAgo(isoDate) {
   return `${days}d ago`;
 }
 function registerStatusCommand(program2) {
-  program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries", "5").option("--json", "Output raw JSON").action(async (opts) => {
+  program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries (1-100)", "5").option("--json", "Output raw JSON").action(async (opts) => {
     const globals = program2.opts();
+    const rawLimit = String(opts.limit).trim();
+    const limit = /^\d{1,3}$/.test(rawLimit) ? Number(rawLimit) : Number.NaN;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      printError(`--limit must be a whole number between 1 and 100 (got "${opts.limit}").`);
+      process.exit(1);
+    }
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
       printError(tokenResult.error);
@@ -18513,7 +18716,7 @@ function registerStatusCommand(program2) {
       if (opts.history && !denial) {
         const runsResult = await apiRequest({
           method: "GET",
-          path: `/runs?limit=${opts.limit}`,
+          path: `/runs?limit=${limit}`,
           serviceUrl,
           token,
           verbose: globals.verbose
@@ -18553,12 +18756,14 @@ function registerStatusCommand(program2) {
       printInfo(`Standard:    v${s.version} (${s.quality_dimensions} quality, ${s.security_patterns} security, ${s.custom_patterns} custom)`);
       printInfo(`Languages:   ${s.languages.join(", ")}`);
     }
-    const hookStatus = await checkAllVerityHooks();
+    const wiring = await resolveHookWiring();
+    const hookStatus = wiring.status;
     const moments = [];
     if (hookStatus.stop) moments.push("stop");
     if (hookStatus.guardOn.includes("commit")) moments.push("pre-commit");
     if (hookStatus.guardOn.includes("push")) moments.push("pre-push/PR");
-    printInfo(`Moments:     ${moments.length > 0 ? moments.join(", ") : 'none (run "verity init")'}`);
+    const via = wiring.source === "plugin" ? " (wired by the Verity plugin)" : "";
+    printInfo(`Moments:     ${moments.length > 0 ? `${moments.join(", ")}${via}` : 'none (run "verity init")'}`);
     if (!mem) return;
     if (mem.recent_runs) {
       const r = mem.recent_runs;
@@ -18635,7 +18840,7 @@ function registerStatusCommand(program2) {
     if (opts.history) {
       const runsResult = await apiRequest({
         method: "GET",
-        path: `/runs?limit=${opts.limit}`,
+        path: `/runs?limit=${limit}`,
         serviceUrl,
         token,
         verbose: globals.verbose
@@ -18826,11 +19031,11 @@ var import_node_fs43 = require("node:fs");
 
 // src/lib/repo-context.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_os3 = require("node:os");
+var import_node_os4 = require("node:os");
 function rgInvocations(env = process.env) {
   const out = [{ cmd: "rg" }];
   if (env.CLAUDE_CODE_EXECPATH) out.push({ cmd: env.CLAUDE_CODE_EXECPATH, argv0: "rg" });
-  out.push({ cmd: `${(0, import_node_os3.homedir)()}/.local/bin/claude`, argv0: "rg" });
+  out.push({ cmd: `${(0, import_node_os4.homedir)()}/.local/bin/claude`, argv0: "rg" });
   return out;
 }
 var MAX_SYMBOLS = 12;
@@ -19644,9 +19849,9 @@ function installRunEvidence(run2) {
 // src/lib/git-frame.ts
 var import_node_child_process10 = require("node:child_process");
 var import_node_fs31 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path21 = require("node:path");
-var import_node_path22 = require("node:path");
+var import_node_os5 = require("node:os");
+var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var VALUE_TOKEN = `(?:'[^']*'|"[^"]*"|\\S+)`;
 var GIT_GLOBAL_OPTS = `(?:\\s+(?:-[Cc]\\s+${VALUE_TOKEN}|--?[\\w-]+(?:=\\S+)?))*`;
 var COMMIT_HEAD = `git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`;
@@ -19692,15 +19897,15 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (!m) continue;
     named = true;
     if (m[1] === void 0) {
-      dir = (0, import_node_os4.homedir)();
+      dir = (0, import_node_os5.homedir)();
       continue;
     }
     const raw = unquote(m[1]);
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os4.homedir)() : raw.startsWith("~/") ? (0, import_node_path22.join)((0, import_node_os4.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path21.isAbsolute)(expanded) ? expanded : (0, import_node_path21.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path24.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path23.isAbsolute)(expanded) ? expanded : (0, import_node_path23.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -19718,8 +19923,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os4.homedir)() : raw.startsWith("~/") ? (0, import_node_path22.join)((0, import_node_os4.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path21.isAbsolute)(expanded) ? expanded : (0, import_node_path21.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path24.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path23.isAbsolute)(expanded) ? expanded : (0, import_node_path23.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -19780,11 +19985,11 @@ function gitAt(dir, args) {
     return "";
   }
 }
-function realpathOr(p) {
+function realpathOr2(p) {
   try {
     return import_node_fs31.realpathSync.native(p);
   } catch {
-    return (0, import_node_path21.resolve)(p);
+    return (0, import_node_path23.resolve)(p);
   }
 }
 function resolveFrame(input) {
@@ -19822,13 +20027,13 @@ function resolveFrame(input) {
   }
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
-  const gitDir = gitDirRaw ? realpathOr(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr((0, import_node_path21.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path21.resolve)(dir, commonRaw)) : null;
+  const gitDir = gitDirRaw ? realpathOr2(gitDirRaw) : null;
+  const commonDir = commonRaw ? realpathOr2((0, import_node_path23.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path23.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
     frame: {
-      worktreeRoot: realpathOr(toplevel),
+      worktreeRoot: realpathOr2(toplevel),
       gitDir,
       commonDir,
       // The one honest definition: a linked worktree's own git dir differs from
@@ -19848,14 +20053,172 @@ function refResolves(frame, ref) {
   return frameGit(frame, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]) !== "";
 }
 var SHA_RE2 = /^[0-9a-f]{40}$/;
-function stagedRange(frame) {
+function shellWords(segment) {
+  return segment.match(/'[^']*'|"[^"]*"|\S+/g) ?? [];
+}
+var ADD_FLAGS_REPLAYABLE = /* @__PURE__ */ new Set([
+  "-A",
+  "--all",
+  "--no-ignore-removal",
+  "-u",
+  "--update",
+  "--no-all",
+  "--ignore-removal",
+  "-f",
+  "--force",
+  "-v",
+  "--verbose",
+  "-N",
+  "--intent-to-add",
+  "--renormalize",
+  "--sparse",
+  "--ignore-errors",
+  "--refresh"
+]);
+var ADD_FLAGS_INTERACTIVE = /* @__PURE__ */ new Set(["-i", "--interactive", "-p", "--patch", "-e", "--edit"]);
+var PATHSPEC_UNRESOLVABLE = /[$`\\*?[\]{}~]/;
+var COMMIT_VALUE_OPTS = /* @__PURE__ */ new Set([
+  "-m",
+  "--message",
+  "-F",
+  "--file",
+  "-C",
+  "--reuse-message",
+  "-c",
+  "--reedit-message",
+  "--author",
+  "--date",
+  "-t",
+  "--template",
+  "--fixup",
+  "--squash",
+  "--trailer",
+  "--cleanup"
+]);
+var ADD_HEAD = `git${GIT_GLOBAL_OPTS}\\s+add(?![\\w-])`;
+var ADD_RE = new RegExp(`(?:^|[\\s;&|(])${ADD_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${ADD_HEAD}`);
+function pathspecOf(word) {
+  const raw = unquote(word);
+  if (!raw) return { reason: "an empty pathspec" };
+  if (PATHSPEC_UNRESOLVABLE.test(raw)) {
+    return { reason: `the shell rewrites the pathspec "${raw}" before git sees it` };
+  }
+  return { path: raw };
+}
+function parseAddSegment(segment) {
+  const words = shellWords(segment);
+  const at = words.indexOf("add");
+  if (at === -1) return { reason: 'the "git add" arguments could not be read' };
+  const flags = [];
+  const paths = [];
+  let literal = false;
+  for (const word of words.slice(at + 1)) {
+    if (literal || !word.startsWith("-") || word === "-") {
+      if (word === "--" && !literal) {
+        literal = true;
+        continue;
+      }
+      const p = pathspecOf(word);
+      if ("reason" in p) return p;
+      paths.push(p.path);
+      continue;
+    }
+    if (word === "--") {
+      literal = true;
+      continue;
+    }
+    const parts = /^-[A-Za-z]{2,}$/.test(word) ? [...word.slice(1)].map((c) => `-${c}`) : [word];
+    for (const flag of parts) {
+      if (ADD_FLAGS_INTERACTIVE.has(flag)) {
+        return { reason: `"git add ${flag}" stages what a human picks at a prompt` };
+      }
+      if (!ADD_FLAGS_REPLAYABLE.has(flag.split("=")[0])) {
+        return { reason: `unmodelled "git add" option ${flag}` };
+      }
+      flags.push(flag);
+    }
+  }
+  return { flags, paths };
+}
+function commitStagesTrackedChanges(segment) {
+  const words = shellWords(segment);
+  const at = words.indexOf("commit");
+  if (at === -1) return false;
+  let skipValue = false;
+  for (const word of words.slice(at + 1)) {
+    if (skipValue) {
+      skipValue = false;
+      continue;
+    }
+    if (word === "--") break;
+    if (!word.startsWith("-") || word === "-") continue;
+    if (word.startsWith("--")) {
+      const name = word.split("=")[0];
+      if (name === "--all") return true;
+      if (COMMIT_VALUE_OPTS.has(name) && !word.includes("=")) skipValue = true;
+      continue;
+    }
+    for (let i = 1; i < word.length; i++) {
+      const flag = `-${word[i]}`;
+      if (flag === "-a") return true;
+      if (COMMIT_VALUE_OPTS.has(flag)) {
+        if (i === word.length - 1) skipValue = true;
+        break;
+      }
+    }
+  }
+  return false;
+}
+function planInCommandStaging(frame, command) {
+  const found = findMomentSegment(command, ["commit"]);
+  if (!found) return { kind: "none" };
+  const segments = splitSegments(command);
+  if (commitStagesTrackedChanges(segments[found.segmentIndex])) {
+    return {
+      kind: "files",
+      via: "index+commit-a",
+      files: frameGit(frame, ["diff", "--name-only", "HEAD"]).split("\n").filter(Boolean)
+    };
+  }
+  const addSegments = segments.slice(0, found.segmentIndex).filter((s) => ADD_RE.test(s));
+  if (addSegments.length === 0) return { kind: "none" };
+  const staged = new Set(
+    frameGit(frame, ["diff", "--cached", "--name-only"]).split("\n").filter(Boolean)
+  );
+  for (const segment of addSegments) {
+    const parsed = parseAddSegment(segment);
+    if ("reason" in parsed) return { kind: "unpredictable", reason: parsed.reason };
+    const args = ["add", "--dry-run", "--ignore-missing", ...parsed.flags];
+    if (parsed.paths.length > 0) args.push("--", ...parsed.paths);
+    for (const line of frameGit(frame, args).split("\n")) {
+      const m = line.match(/^(?:add|remove) '(.*)'$/);
+      if (m) staged.add(m[1]);
+    }
+  }
+  return { kind: "files", via: "index+staged-in-command", files: [...staged] };
+}
+function stagedRange(frame, command) {
   if (!frame.worktreeRoot) return { kind: "nothing", base: null, head: "INDEX", via: "refused" };
-  const mergeHead = frame.gitDir ? (0, import_node_path22.join)(frame.gitDir, "MERGE_HEAD") : null;
+  const plan = command ? planInCommandStaging(frame, command) : { kind: "none" };
+  if (plan.kind === "unpredictable") {
+    return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
+  }
+  const mergeHead = frame.gitDir ? (0, import_node_path24.join)(frame.gitDir, "MERGE_HEAD") : null;
   if (mergeHead && (0, import_node_fs31.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
-    const resolutions = [...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f));
-    return { kind: "merge", base: "HEAD", head: "INDEX", via: "merge-resolutions", files: resolutions };
+    const resolutions = new Set([...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f)));
+    if (plan.kind === "files") {
+      const wtVsHead = new Set(frameGit(frame, ["diff", "--name-only", "HEAD"]).split("\n").filter(Boolean));
+      const wtVsMerge = new Set(frameGit(frame, ["diff", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
+      for (const f of plan.files) {
+        if (wtVsHead.has(f) && wtVsMerge.has(f) && !isVerityOwnedPath(f)) resolutions.add(f);
+      }
+    }
+    return { kind: "merge", base: "HEAD", head: "INDEX", via: "merge-resolutions", files: [...resolutions] };
+  }
+  if (plan.kind === "files") {
+    return { kind: "staged", base: "HEAD", head: "INDEX", via: plan.via, files: plan.files };
   }
   return { kind: "staged", base: "HEAD", head: "INDEX", via: "index" };
 }
@@ -19937,7 +20300,7 @@ function frameTelemetry(frame, range, divergence) {
     refusal: frame.refusal
   };
   if (divergence) {
-    t.root_differs = !!frame.worktreeRoot && !!divergence.actualRoot && realpathOr(frame.worktreeRoot) !== realpathOr(divergence.actualRoot);
+    t.root_differs = !!frame.worktreeRoot && !!divergence.actualRoot && realpathOr2(frame.worktreeRoot) !== realpathOr2(divergence.actualRoot);
     const a = [...divergence.actualFiles].sort().join("\n");
     const b = [...divergence.frameFiles].sort().join("\n");
     t.files_differ = a !== b;
@@ -20247,7 +20610,7 @@ function sanitizeCommandWithLoss(rawCmd) {
   const lost = lines.slice(1).some((l) => l.trim().length > 0);
   const first = lines[0];
   const cmd = sanitizeCommand(first);
-  const hadSeparator = SEPARATORS.some((sep2) => first.indexOf(sep2) > 0);
+  const hadSeparator = SEPARATORS.some((sep3) => first.indexOf(sep3) > 0);
   return { cmd, lost: lost || !hadSeparator && first.length > MAX_COMMAND_CHARS };
 }
 var SEPARATORS = [" | ", " > ", " >> ", " 2>", " && ", " ; "];
@@ -20256,11 +20619,11 @@ function sanitizeCommand(rawCmd) {
   let cmd = rawCmd.split("\n")[0];
   let cut = -1;
   let marker = "";
-  for (const sep2 of SEPARATORS) {
-    const idx = cmd.indexOf(sep2);
+  for (const sep3 of SEPARATORS) {
+    const idx = cmd.indexOf(sep3);
     if (idx > 0 && (cut === -1 || idx < cut)) {
       cut = idx;
-      marker = sep2.trim();
+      marker = sep3.trim();
     }
   }
   if (cut > -1) cmd = cmd.slice(0, cut);
@@ -20284,28 +20647,28 @@ async function readStopHookStdin() {
   try {
     if (process.stdin.isTTY) return empty;
     const chunks = [];
-    const timeout = new Promise((resolve4) => setTimeout(() => resolve4(empty), 500));
-    const read = new Promise((resolve4) => {
+    const timeout = new Promise((resolve5) => setTimeout(() => resolve5(empty), 500));
+    const read = new Promise((resolve5) => {
       process.stdin.on("data", (chunk) => chunks.push(chunk));
       process.stdin.on("end", () => {
         const raw = Buffer.concat(chunks).toString("utf-8").trim();
         if (!raw) {
-          resolve4(empty);
+          resolve5(empty);
           return;
         }
         try {
           const data = JSON.parse(raw);
-          resolve4({
+          resolve5({
             assistantMessage: typeof data.last_assistant_message === "string" ? data.last_assistant_message : null,
             stopReason: typeof data.stop_reason === "string" ? data.stop_reason : null,
             transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : null,
             sessionId: typeof data.session_id === "string" ? data.session_id : null
           });
         } catch {
-          resolve4(empty);
+          resolve5(empty);
         }
       });
-      process.stdin.on("error", () => resolve4(empty));
+      process.stdin.on("error", () => resolve5(empty));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -20509,7 +20872,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.0" : "dev";
+    return true ? "0.32.1-experimental.c640abd" : "dev";
   } catch {
     return "dev";
   }
@@ -20868,7 +21231,7 @@ async function scope(run2) {
 
 // src/lib/specs.ts
 var import_node_fs34 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_path25 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -20941,7 +21304,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   try {
     const entries = (0, import_node_fs34.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path23.join)(dir, entry.name);
+      const fullPath = (0, import_node_path25.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -20953,9 +21316,9 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path23.join)(process.env.HOME ?? "", ".claude", "plans");
+  const homePlansDir = (0, import_node_path25.join)(process.env.HOME ?? "", ".claude", "plans");
   const localPlansDir = ".claude/plans";
-  const candidates = [];
+  const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
   for (const plansDir of [localPlansDir, homePlansDir]) {
     if (!(0, import_node_fs34.existsSync)(plansDir)) continue;
@@ -20963,19 +21326,19 @@ function discoverPlans() {
       for (const f of (0, import_node_fs34.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
-        const fullPath = (0, import_node_path23.join)(plansDir, f);
+        const fullPath = (0, import_node_path25.join)(plansDir, f);
         try {
           const stat3 = (0, import_node_fs34.statSync)(fullPath);
-          candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
+          candidates2.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
         } catch {
         }
       }
     } catch {
     }
   }
-  candidates.sort((a, b) => b.mtime - a.mtime);
+  candidates2.sort((a, b) => b.mtime - a.mtime);
   const result = [];
-  for (const entry of candidates.slice(0, MAX_PLAN_FILES)) {
+  for (const entry of candidates2.slice(0, MAX_PLAN_FILES)) {
     if (entry.size > MAX_PLAN_FILE_BYTES) continue;
     try {
       const content = (0, import_node_fs34.readFileSync)(entry.path, "utf-8");
@@ -21175,7 +21538,7 @@ async function mode(run2) {
 
 // src/lib/fold.ts
 var import_node_fs35 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_path26 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -21407,9 +21770,9 @@ function fold(transcriptPath, opts = {}) {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path24.join)(
-      (0, import_node_path24.dirname)(transcriptPath),
-      (0, import_node_path24.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path26.join)(
+      (0, import_node_path26.dirname)(transcriptPath),
+      (0, import_node_path26.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
     if ((0, import_node_fs35.existsSync)(sidecarDir)) {
@@ -21419,7 +21782,7 @@ function fold(transcriptPath, opts = {}) {
       const walk2 = (d, depth) => {
         if (depth > 4) return;
         for (const e of (0, import_node_fs35.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path24.join)(d, e.name);
+          const p = (0, import_node_path26.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
@@ -21794,7 +22157,7 @@ async function evidence(run2) {
 
 // src/lib/cache-cleanup.ts
 var import_node_fs36 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_path27 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
@@ -21802,7 +22165,7 @@ function pruneStaleCache() {
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
     for (const entry of (0, import_node_fs36.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path25.join)(dir, entry);
+      const path = (0, import_node_path27.join)(dir, entry);
       try {
         const stat3 = (0, import_node_fs36.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
@@ -21821,7 +22184,7 @@ function pruneStaleCache() {
 
 // src/lib/context-files.ts
 var import_node_fs37 = require("node:fs");
-var import_node_os5 = require("node:os");
+var import_node_os6 = require("node:os");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
 var MAX_CONTEXT_TOTAL_BYTES = 24576;
@@ -21829,7 +22192,7 @@ function readSetContextPaths(summary, deltaFiles) {
   const reads = summary?.files_read ?? [];
   if (reads.length === 0) return [];
   const root = process.cwd().replace(/\/+$/, "");
-  const home = (0, import_node_os5.homedir)();
+  const home = (0, import_node_os6.homedir)();
   const toRepoRelative2 = (p) => {
     if (!p) return null;
     let abs;
@@ -21970,7 +22333,7 @@ async function repoContext(run2) {
 // src/lib/seed-runner.ts
 var import_promises14 = require("node:fs/promises");
 var import_node_fs38 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_path28 = require("node:path");
 var import_yaml4 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -22237,7 +22600,7 @@ async function runSeed(opts) {
       }
     }
   }
-  const candidates = deriveSeedNodes({
+  const candidates2 = deriveSeedNodes({
     knowledgeSpec: {
       project_name: knowledgeSpec.project_name,
       languages: knowledgeSpec.languages,
@@ -22249,20 +22612,20 @@ async function runSeed(opts) {
     readmeContent,
     claudeMdContent
   });
-  if (candidates.length === 0) {
+  if (candidates2.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path26.join)(MEMORY_DIR, "domain", "project-overview.md");
+  const overviewPath = (0, import_node_path28.join)(MEMORY_DIR, "domain", "project-overview.md");
   if ((0, import_node_fs38.existsSync)(overviewPath) && !opts.force) {
-    return { created: 0, failed: 0, skipped: "already_seeded", candidates };
+    return { created: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
   }
   if (opts.dryRun) {
-    return { created: 0, failed: 0, skipped: null, candidates };
+    return { created: 0, failed: 0, skipped: null, candidates: candidates2 };
   }
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   let created = 0;
   let failed = 0;
-  for (const c of candidates) {
+  for (const c of candidates2) {
     const res = await apiRequest({
       method: "POST",
       path: "/compound/memory/nodes",
@@ -22295,7 +22658,7 @@ async function runSeed(opts) {
       continue;
     }
     try {
-      await (0, import_promises14.mkdir)((0, import_node_path26.dirname)(targetPath), { recursive: true });
+      await (0, import_promises14.mkdir)((0, import_node_path28.dirname)(targetPath), { recursive: true });
       await (0, import_promises14.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
@@ -22304,12 +22667,12 @@ async function runSeed(opts) {
       failed++;
     }
   }
-  return { created, failed, skipped: null, candidates };
+  return { created, failed, skipped: null, candidates: candidates2 };
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
 var import_node_fs39 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_path29 = require("node:path");
 async function memoryManifest(run2) {
   const { globals } = run2;
   const { serviceUrl, token } = run2;
@@ -22319,7 +22682,7 @@ async function memoryManifest(run2) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path27.join)(VERITY_DIR, ".seeded");
+    const seedMarker = (0, import_node_path29.join)(VERITY_DIR, ".seeded");
     const hasStandard = (0, import_node_fs39.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs39.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
@@ -22437,7 +22800,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path28 = require("node:path");
+var import_node_path30 = require("node:path");
 async function workingMemory(run2) {
   const { opts } = run2;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run2;
@@ -22449,7 +22812,7 @@ async function workingMemory(run2) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path28.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path30.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -23014,7 +23377,7 @@ async function transmit(run2) {
 
 // src/commands/analyze/phases/13-reconcile.ts
 var import_node_fs42 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_path31 = require("node:path");
 async function reconcile(run2) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run2;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -23043,7 +23406,7 @@ async function reconcile(run2) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs42.readFileSync)((0, import_node_path29.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs42.readFileSync)((0, import_node_path31.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -23895,14 +24258,14 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs45 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_path32 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path30.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path32.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     try {
-      if (process.stdin.isTTY) return resolve4(empty);
+      if (process.stdin.isTTY) return resolve5(empty);
       const chunks = [];
       let timer;
       let settled = false;
@@ -23915,7 +24278,7 @@ function readPreToolUseStdin() {
         process.stdin.removeListener("end", onEnd);
         process.stdin.removeListener("error", onError);
         process.stdin.pause();
-        resolve4(value);
+        resolve5(value);
       };
       const onEnd = () => {
         try {
@@ -23936,7 +24299,7 @@ function readPreToolUseStdin() {
       process.stdin.on("error", onError);
       process.stdin.resume();
     } catch {
-      resolve4(empty);
+      resolve5(empty);
     }
   });
 }
@@ -23994,7 +24357,7 @@ function registerGuardCommand(program2) {
   });
 }
 function resolveMomentRange(moment, frame, command, on) {
-  return moment === "pre-commit" ? stagedRange(frame) : resolvePushRange(frame, command, on);
+  return moment === "pre-commit" ? stagedRange(frame, command) : resolvePushRange(frame, command, on);
 }
 function describeRange(range) {
   if (range.kind === "staged") return "staged";
@@ -24154,6 +24517,13 @@ async function runGuard(opts, globals) {
     );
   }
   const range = resolveMomentRange(moment, frame, command, on);
+  if (range.refusal) {
+    logEvent("guard_frame", { moment, ...frameTelemetry(frame, range) });
+    emitAllowNotice(
+      `\u26A0 Verity ${moment}: could not tell what this ${verb} will include \u2014 ${verb === "commit" ? "committed" : "pushed"} WITHOUT review`,
+      `Verity ${moment}: this command stages files as it runs and the resulting set could not be resolved (${range.refusal}); the ${verb} was allowed WITHOUT a Verity review. Stage first (\`git add \u2026\`) and re-run the ${verb} to have it reviewed.`
+    );
+  }
   const files = rangeFiles(frame, range);
   if (files.length === 0) process.exit(0);
   const tokenResult = await resolveToken(globals.token);
@@ -24189,7 +24559,7 @@ async function runGuard(opts, globals) {
     upgradeToExcerpts(repoContext2, {
       readFile: (rel) => {
         try {
-          return (0, import_node_fs45.readFileSync)((0, import_node_path30.join)(frame.worktreeRoot ?? process.cwd(), rel), "utf8");
+          return (0, import_node_fs45.readFileSync)((0, import_node_path32.join)(frame.worktreeRoot ?? process.cwd(), rel), "utf8");
         } catch {
           return null;
         }
@@ -24250,29 +24620,50 @@ async function runGuard(opts, globals) {
     process.exit(2);
   }
   resetIter(moment);
+  const notice = verdictNotice({
+    decision,
+    moment,
+    verb,
+    covLine,
+    covDetail,
+    link,
+    viewUrl,
+    narrative: response.assessment?.narrative ?? ""
+  });
+  emitAllowNotice(notice.user, notice.agent);
+}
+function verdictNotice(ctx) {
+  const { moment, verb, covLine, covDetail, link, viewUrl } = ctx;
+  const decision = ctx.decision ?? "(unrecognised)";
+  const report = viewUrl ? `
+Report: ${viewUrl}` : "";
   if (decision === "FAIL") {
-    const narrative = response.assessment?.narrative ?? "";
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
-      `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
+    const narrative = ctx.narrative ?? "";
+    return {
+      user: `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
+      agent: `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
+${covDetail}${report}`
+    };
   }
   if (decision === "WARN") {
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
-      `Verity ${moment} review: WARN (proceeding).
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
+    return {
+      user: `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
+      agent: `Verity ${moment} review: WARN (proceeding).
+${covDetail}${report}`
+    };
   }
-  emitAllowNotice(
-    `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
-    `Verity ${moment} review: PASS.
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-  );
+  if (decision === "PASS") {
+    return {
+      user: `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
+      agent: `Verity ${moment} review: PASS.
+${covDetail}${report}`
+    };
+  }
+  return {
+    user: `\u26A0 Verity ${moment}: no verdict came back \u2014 ${verb === "commit" ? "committed" : "pushed"} WITHOUT a usable review (${covLine})${link}`,
+    agent: `Verity ${moment}: the service answered with no recognisable gate decision (${decision}); the ${verb} was allowed, but nothing reviewed it. Treat this as unreviewed, not as a pass.
+${covDetail}${report}`
+  };
 }
 function writeBlockMessage(moment, response, covDetail) {
   const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
@@ -24467,7 +24858,7 @@ function registerWaiveCommand(program2) {
 var import_node_fs51 = require("node:fs");
 var import_promises17 = require("node:fs/promises");
 var import_yaml6 = __toESM(require_dist());
-var import_node_path33 = require("node:path");
+var import_node_path35 = require("node:path");
 var import_node_child_process16 = require("node:child_process");
 
 // src/lib/banner.ts
@@ -24504,8 +24895,8 @@ function printBanner(opts) {
   const dim = (text) => color ? `${DIM3}${text}${RESET2}` : text;
   process.stderr.write("\n");
   if (!art) {
-    const candidates = [`Verity ${version}`, "Verity"];
-    const text = candidates.find((c) => c.length + INDENT.length <= columns);
+    const candidates2 = [`Verity ${version}`, "Verity"];
+    const text = candidates2.find((c) => c.length + INDENT.length <= columns);
     if (text) process.stderr.write(`${INDENT}${dim(text)}
 `);
     process.stderr.write("\n");
@@ -24612,13 +25003,13 @@ function checkAnalysisCli() {
 }
 var INSTALL_TIMEOUT_MS = 12e4;
 function run(command, args, opts = {}) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const child = (0, import_node_child_process13.spawn)(command, args, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
-    child.on("error", () => resolve4(false));
-    child.on("close", (code) => resolve4(code === 0));
+    child.on("error", () => resolve5(false));
+    child.on("close", (code) => resolve5(code === 0));
   });
 }
 async function installAnalysisCli() {
@@ -24717,8 +25108,8 @@ function ensureVerityGitignore() {
       next = lines.map((l) => BREAKING_ENTRIES.has(l.trim()) ? ".verity/*" : l).join("\n");
     }
     if (!hasMarker) {
-      const sep2 = next === "" ? "" : next.endsWith("\n") ? "\n" : "\n\n";
-      next = next + sep2 + VERITY_GITIGNORE_BLOCK;
+      const sep3 = next === "" ? "" : next.endsWith("\n") ? "\n" : "\n\n";
+      next = next + sep3 + VERITY_GITIGNORE_BLOCK;
     }
     (0, import_node_fs47.writeFileSync)(".gitignore", next);
     return verified(needsRepair ? "repaired" : "added");
@@ -24845,7 +25236,8 @@ async function uninstallTelemetry() {
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
   const state = await readSetupState();
-  const hooks = await checkAllVerityHooks();
+  const wiring = await resolveHookWiring();
+  const hooks = wiring.status;
   const telemetry = await checkTelemetry();
   const hasConfig = (0, import_node_fs48.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
@@ -24884,6 +25276,11 @@ async function buildReport() {
       'Your analysis config names pattern ids that no longer resolve, so those tools run with nothing enabled and report zero issues. Fix: "verity standard synthesize --config-only" (or re-run "verity init").'
     );
   }
+  if (wiring.duplicateSettingsHooks) {
+    next.push(
+      'Duplicate Verity hooks also exist in .claude/settings.json. They stand down at run time under the plugin, but remove them with "verity init --plugin-mode" so the wiring says what it does.'
+    );
+  }
   if (state?.telemetry === "deferred") {
     next.push('Telemetry was requested but needs a token \u2014 run "verity login", then "verity telemetry install".');
   }
@@ -24899,7 +25296,12 @@ async function buildReport() {
       moments: state?.moments ?? null,
       telemetry: state?.telemetry ?? null
     },
-    hooks: { ...hooks, noAnalysisMoment },
+    hooks: {
+      source: wiring.source,
+      ...hooks,
+      duplicateSettingsHooks: wiring.duplicateSettingsHooks,
+      noAnalysisMoment
+    },
     telemetry: { enabled: telemetry.enabled, endpoint: telemetry.endpoint },
     artifacts,
     next
@@ -24922,8 +25324,9 @@ function registerDoctorCommand(program2) {
     printInfo(`  verity init: ${report.phases.init.done ? `done ${report.phases.init.completed_at ?? ""}`.trim() : "NOT run here"}`);
     printInfo(`  /verity-setup: ${report.phases.setup.done ? "done" : "not completed"}`);
     printInfo(`  intensity: ${report.answers.intensity ?? "\u2014"}    moments: ${report.answers.moments?.join(", ") ?? "\u2014"}`);
-    printInfo("Hooks:");
-    printInfo(`  Stop (verity analyze): ${report.hooks.stop ? "on" : "off"}`);
+    const plugin = report.hooks.source === "plugin";
+    printInfo(plugin ? "Hooks: wired by the Verity Claude Code plugin (not .claude/settings.json)" : "Hooks:");
+    printInfo(`  Stop (verity analyze): ${report.hooks.stop ? plugin ? "on (plugin)" : "on" : "off"}`);
     printInfo(`  Git-moment gate: ${report.hooks.guardOn.length ? report.hooks.guardOn.join(", ") : "off"}`);
     printInfo(`  Infra (intent/baseline/compact/session-end): ${[report.hooks.intent, report.hooks.baseline, report.hooks.compact, report.hooks.sessionEnd].filter(Boolean).length}/4`);
     printInfo(`Telemetry: ${report.telemetry.enabled ? `enabled \u2192 ${report.telemetry.endpoint}` : "disabled"}`);
@@ -24946,7 +25349,7 @@ function registerDoctorCommand(program2) {
 
 // src/commands/migrate.ts
 var import_node_fs49 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_path33 = require("node:path");
 var import_node_child_process15 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -24983,8 +25386,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path31.join)(root, ".gate");
-  const verityDir = (0, import_node_path31.join)(root, ".verity");
+  const gateDir = (0, import_node_path33.join)(root, ".gate");
+  const verityDir = (0, import_node_path33.join)(root, ".verity");
   if ((0, import_node_fs49.existsSync)(gateDir) && !(0, import_node_fs49.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -25038,11 +25441,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path31.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path31.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path33.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path33.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs49.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs49.existsSync)(verityCreds)) {
-    (0, import_node_fs49.mkdirSync)((0, import_node_path31.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs49.mkdirSync)((0, import_node_path33.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -25064,7 +25467,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path31.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path33.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs49.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -25075,8 +25478,8 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path31.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path31.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path33.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path33.join)(root, "VERITY.md");
   if (!(0, import_node_fs49.existsSync)(gateMd) || (0, import_node_fs49.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
@@ -25093,7 +25496,7 @@ function migrateStandardFile(root, actions) {
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path31.join)(root, ".claude", "settings.local.json");
+  const file = (0, import_node_path33.join)(root, ".claude", "settings.local.json");
   if (!(0, import_node_fs49.existsSync)(file)) return;
   let settings;
   try {
@@ -25141,8 +25544,8 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
     toAppend.push(line.replace(/\r$/, ""));
   }
   if (toAppend.length > 0) {
-    const sep2 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs49.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
+    const sep3 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
+    (0, import_node_fs49.writeFileSync)(verityCreds, verityContent + sep3 + toAppend.join("\n") + "\n");
   }
   (0, import_node_fs49.rmSync)(gateCreds, { force: true });
   return toAppend.length;
@@ -25183,15 +25586,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path31.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path33.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs49.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path31.join)(relDir, entry) : entry;
-      const src = (0, import_node_path31.join)(gateDir, rel);
-      const dest = (0, import_node_path31.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path33.join)(relDir, entry) : entry;
+      const src = (0, import_node_path33.join)(gateDir, rel);
+      const dest = (0, import_node_path33.join)(verityDir, rel);
       if ((0, import_node_fs49.statSync)(src).isDirectory()) {
         walk2(rel);
       } else if (!(0, import_node_fs49.existsSync)(dest)) {
-        (0, import_node_fs49.mkdirSync)((0, import_node_path31.dirname)(dest), { recursive: true });
+        (0, import_node_fs49.mkdirSync)((0, import_node_path33.dirname)(dest), { recursive: true });
         (0, import_node_fs49.cpSync)(src, dest);
         copied++;
       }
@@ -25201,22 +25604,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path31.join)(root, ".gate");
-  const verityDir = (0, import_node_path31.join)(root, ".verity");
+  const gateDir = (0, import_node_path33.join)(root, ".gate");
+  const verityDir = (0, import_node_path33.join)(root, ".verity");
   if ((0, import_node_fs49.existsSync)(gateDir) && !(0, import_node_fs49.existsSync)(verityDir)) return true;
   if ((0, import_node_fs49.existsSync)(gateDir) && (0, import_node_fs49.existsSync)(verityDir)) {
-    if ((0, import_node_fs49.existsSync)((0, import_node_path31.join)(gateDir, "credentials")) && !(0, import_node_fs49.existsSync)((0, import_node_path31.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs49.existsSync)((0, import_node_path33.join)(gateDir, "credentials")) && !(0, import_node_fs49.existsSync)((0, import_node_path33.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs49.existsSync)((0, import_node_path31.join)(gateDir, "memory")) && !(0, import_node_fs49.existsSync)((0, import_node_path31.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs49.existsSync)((0, import_node_path33.join)(gateDir, "memory")) && !(0, import_node_fs49.existsSync)((0, import_node_path33.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path31.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path33.join)(root, "CLAUDE.md");
   if ((0, import_node_fs49.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs49.existsSync)((0, import_node_path31.join)(root, "GATE.md")) && !(0, import_node_fs49.existsSync)((0, import_node_path31.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs49.existsSync)((0, import_node_path33.join)(root, "GATE.md")) && !(0, import_node_fs49.existsSync)((0, import_node_path33.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -25280,7 +25683,13 @@ function applyKey(state, action, count, mode2) {
     }
     case "jump": {
       if (action.index >= count) return { status: "open", state };
-      return { status: "open", state: { cursor: action.index, chosen: state.chosen } };
+      if (mode2 === "single") {
+        return { status: "open", state: { cursor: action.index, chosen: state.chosen } };
+      }
+      const chosen = new Set(state.chosen);
+      if (chosen.has(action.index)) chosen.delete(action.index);
+      else chosen.add(action.index);
+      return { status: "open", state: { cursor: action.index, chosen } };
     }
     case "toggle": {
       if (mode2 === "single") {
@@ -25325,7 +25734,7 @@ function renderSelect(question, choices, state, mode2, color = colorEnabled()) {
     const hint = choice.hint ? `${pad}   ${paint(choice.hint, DIM4)}` : "";
     lines.push(`  ${cursor} ${marker} ${here ? paint(label2, BOLD2) : label2}${hint}`);
   });
-  const keys = mode2 === "multi" ? "\u2191\u2193 move \xB7 space toggle \xB7 enter confirm" : "\u2191\u2193 move \xB7 enter confirm";
+  const keys = mode2 === "multi" ? "\u2191\u2193 move \xB7 space or number toggle \xB7 enter confirm" : "\u2191\u2193 move \xB7 number jumps \xB7 enter confirm";
   lines.push(`  ${paint(state.hint ?? keys, state.hint ? GREEN3 : DIM4)}`);
   return lines;
 }
@@ -25339,7 +25748,7 @@ function runSelect(opts) {
     cursor: initialIdx[0] ?? 0,
     chosen: new Set(mode2 === "single" ? [initialIdx[0] ?? 0] : initialIdx)
   };
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let painted = 0;
     let settled = false;
     const draw = () => {
@@ -25387,7 +25796,7 @@ function runSelect(opts) {
       if (settled) return;
       settled = true;
       restore();
-      resolve4(value);
+      resolve5(value);
     };
     readline2.emitKeypressEvents(input);
     input.setRawMode(true);
@@ -25408,9 +25817,9 @@ async function askLine(question, io = {}) {
     output: io.output ?? process.stdout
   });
   try {
-    return await new Promise((resolve4) => {
-      rl.question(question).then((a) => resolve4(a.trim())).catch(() => resolve4(null));
-      rl.once("close", () => setImmediate(() => resolve4(null)));
+    return await new Promise((resolve5) => {
+      rl.question(question).then((a) => resolve5(a.trim())).catch(() => resolve5(null));
+      rl.once("close", () => setImmediate(() => resolve5(null)));
     });
   } finally {
     rl.close();
@@ -25493,7 +25902,7 @@ async function promptMultiSelect(question, choices, fallback) {
 // src/lib/remote-config.ts
 var import_node_fs50 = require("node:fs");
 var import_promises16 = require("node:fs/promises");
-var import_node_path32 = require("node:path");
+var import_node_path34 = require("node:path");
 var import_yaml5 = __toESM(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -25571,7 +25980,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative2, body) {
   const target = projectPath(relative2);
-  await (0, import_promises16.mkdir)((0, import_node_path32.dirname)(target), { recursive: true });
+  await (0, import_promises16.mkdir)((0, import_node_path34.dirname)(target), { recursive: true });
   await (0, import_promises16.writeFile)(target, body);
 }
 function describeRemote(found) {
@@ -25687,16 +26096,16 @@ async function runOptionalAuth(resolution, opts = {}) {
   }
 }
 function resolveDataDir2() {
-  const candidates = [
-    (0, import_node_path33.join)(__dirname, "..", "data"),
+  const candidates2 = [
+    (0, import_node_path35.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path33.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path35.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path33.join)(process.cwd(), "cli", "data")
+    (0, import_node_path35.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
-  for (const candidate of candidates) {
-    if ((0, import_node_fs51.existsSync)((0, import_node_path33.join)(candidate, "skills"))) {
+  for (const candidate of candidates2) {
+    if ((0, import_node_fs51.existsSync)((0, import_node_path35.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -25714,7 +26123,7 @@ async function skillIsCurrent(src, dest) {
     const walk2 = (d, prefix) => {
       for (const e of (0, import_node_fs51.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path33.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path35.join)(d, e.name), rel);
         else if (e.isFile()) out.push(rel);
       }
     };
@@ -25725,8 +26134,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises17.readFile)((0, import_node_path33.join)(src, rel), "utf-8");
-      const b = await (0, import_promises17.readFile)((0, import_node_path33.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises17.readFile)((0, import_node_path35.join)(src, rel), "utf-8");
+      const b = await (0, import_promises17.readFile)((0, import_node_path35.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -26001,12 +26410,12 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path33.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path35.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path33.join)(skillsSource, skill);
-    const dest = (0, import_node_path33.join)(skillsDest, skill);
+    const src = (0, import_node_path35.join)(skillsSource, skill);
+    const dest = (0, import_node_path35.join)(skillsDest, skill);
     if (!(0, import_node_fs51.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
@@ -26109,12 +26518,16 @@ function registerInitCommand(program2) {
   program2.command("init").alias("setup").description("Set up Verity in the current project (asks the setup questions, then hands off to /verity-setup)").option("--force", "Reinstall the skills even when they are already up to date (hooks are always reconciled)").option("-y, --yes", "Take the recommended answer for every question (no prompts)").option("--no-setup", "Skip the /verity-setup handoff at the end").option(
     "--plugin-mode",
     "The Claude Code plugin owns the skills and hooks: install neither, and remove any this project already has"
+  ).option(
+    "--no-plugin",
+    "Ignore any Claude Code plugin here and wire this project's own skills and hooks"
   ).option("--no-adopt", "Don't offer this repository's existing Standard from the service; synthesize a new one").action(async (opts) => {
     const force = opts.force ?? false;
     const wantsHandoff = opts.setup !== false;
     const wantsAdopt = opts.adopt !== false;
     const defaultsOnly = (opts.yes ?? false) || !interactive();
-    const pluginMode = opts.pluginMode ?? pluginActiveHere();
+    const staleMarker = clearStalePluginMarker();
+    const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
     const isProject = projectMarkers.some((m) => (0, import_node_fs51.existsSync)(m));
     if (!isProject) {
@@ -26131,6 +26544,26 @@ function registerInitCommand(program2) {
     } else {
       printPhase(1, 2, "this machine", "prerequisites \xB7 skills \xB7 hooks \xB7 sign-in");
     }
+    if (staleMarker) {
+      printInfo(`Cleared a stale plugin marker \u2014 ${staleMarker.pluginRoot} is no longer installed.`);
+    }
+    const install = pluginMode ? activePluginInstall() : null;
+    if (pluginMode) {
+      const where = install ? ` \u2014 ${install.pluginRoot}${install.version ? ` (v${install.version})` : ""}` : "";
+      printInfo(`Hooks here: the Verity Claude Code plugin${where}.`);
+      printInfo("  Skills and hooks come from the plugin, so this run installs neither \u2014 and removes");
+      printInfo("  any this project still carries from an earlier npm install.");
+      printInfo("  It still does the half the plugin cannot: your Standard and analysis config, the");
+      printInfo("  knowledge base, CLAUDE.md, .gitignore, the review moments, and sign-in.");
+      printInfo("  Want this project to own its own copy instead? Uninstall the plugin, or use --no-plugin.");
+    } else if (opts.plugin === false && pluginActiveHere()) {
+      printWarn("Hooks here: this project's .claude/settings.json (--no-plugin).");
+      printWarn("  The Verity plugin is active on this machine and would otherwise own them. Both sets");
+      printWarn("  will fire; the settings.json copy stands down at run time so each turn is gated once.");
+    } else {
+      printInfo("Hooks here: this project's .claude/settings.json (no Verity Claude Code plugin is active).");
+    }
+    console.log("");
     const TOTAL_STEPS = 9;
     let stepNo = 0;
     const step = (label2) => {
@@ -26162,7 +26595,7 @@ function registerInitCommand(program2) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
     await scaffoldProject(step, defaultsOnly);
-    const globalVerityDir = (0, import_node_path33.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path35.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises17.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -26170,9 +26603,18 @@ function registerInitCommand(program2) {
       ...moments.includes("pre-commit") ? ["commit"] : [],
       ...moments.includes("pre-push") ? ["push"] : []
     ];
-    writeProjectConfig({ git_moments: gitMoments });
+    const existingMoments = readProjectConfig();
+    const keepExisting = defaultsOnly && existingMoments.git_moments_source === "user";
+    if (keepExisting) {
+      printInfo(
+        `  Keeping the git moments you set: ${existingMoments.git_moments.join(", ") || "none"} (this run asked no questions, so it does not overrule them).`
+      );
+    } else {
+      writeProjectConfig({ git_moments: gitMoments, git_moments_source: "init" });
+    }
+    const effectiveMoments = keepExisting ? existingMoments.git_moments : gitMoments;
     if (pluginMode) {
-      await adoptPluginWiring(gitMoments, moments);
+      await adoptPluginWiring(effectiveMoments, moments);
     } else {
       await reconcileOwnWiring(moments);
     }
@@ -26244,7 +26686,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.0" : "dev"
+          cli_version: true ? "0.32.1-experimental.c640abd" : "dev"
         }
       });
     } catch (err) {
@@ -26284,7 +26726,7 @@ function registerInitCommand(program2) {
 
 // src/commands/uninstall.ts
 var import_node_fs52 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_path36 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -26303,7 +26745,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path34.join)(skillsRoot, name);
+      const dir = (0, import_node_path36.join)(skillsRoot, name);
       if ((0, import_node_fs52.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
@@ -26349,7 +26791,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path34.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path36.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs52.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -26548,7 +26990,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs53 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_path37 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -26589,7 +27031,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs53.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs53.unlinkSync)((0, import_node_path35.join)(cacheDir, entry));
+            (0, import_node_fs53.unlinkSync)((0, import_node_path37.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -26616,7 +27058,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs53.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs53.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs53.unlinkSync)((0, import_node_path35.join)(logsDir, entry));
+            (0, import_node_fs53.unlinkSync)((0, import_node_path37.join)(logsDir, entry));
           } catch {
           }
         }
@@ -26924,8 +27366,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.0");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.1-experimental.c640abd").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.1-experimental.c640abd");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();