@codacy/verity-cli 0.32.6-experimental.df0a578 → 0.32.7

package/bin/verity.js

@@ -6975,10 +6975,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep4, value } = collItem;
+        const { start, key, sep: sep3, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep4?.[0],
+          next: key ?? sep3?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -6992,7 +6992,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep4) {
+          if (!keyProps.anchor && !keyProps.tag && !sep3) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -7016,7 +7016,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep4 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep3 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -7032,7 +7032,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep4, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep3, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -7123,7 +7123,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep4 = "";
+        let sep3 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -7137,13 +7137,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep4 + cb;
-              sep4 = "";
+                comment += sep3 + cb;
+              sep3 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep4 += source;
+                sep3 += source;
               hasSpace = true;
               break;
             default:
@@ -7186,18 +7186,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep4, value } = collItem;
+        const { start, key, sep: sep3, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep4?.[0],
+          next: key ?? sep3?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep4 && !value) {
+          if (!props.anchor && !props.tag && !sep3 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -7251,8 +7251,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep4 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep4, null, props, onError);
+        if (!isMap && !sep3 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep3, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -7264,7 +7264,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep4 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep3 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -7275,8 +7275,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep4)
-                for (const st of sep4) {
+              if (sep3)
+                for (const st of sep3) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -7293,7 +7293,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep4, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep3, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -7473,7 +7473,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep4 = "";
+      let sep3 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -7490,24 +7490,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep4 + indent.slice(trimIndent) + content;
-          sep4 = "\n";
+          value += sep3 + indent.slice(trimIndent) + content;
+          sep3 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep4 === " ")
-            sep4 = "\n";
-          else if (!prevMoreIndented && sep4 === "\n")
-            sep4 = "\n\n";
-          value += sep4 + indent.slice(trimIndent) + content;
-          sep4 = "\n";
+          if (sep3 === " ")
+            sep3 = "\n";
+          else if (!prevMoreIndented && sep3 === "\n")
+            sep3 = "\n\n";
+          value += sep3 + indent.slice(trimIndent) + content;
+          sep3 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep4 === "\n")
+          if (sep3 === "\n")
             value += "\n";
           else
-            sep4 = "\n";
+            sep3 = "\n";
         } else {
-          value += sep4 + content;
-          sep4 = " ";
+          value += sep3 + content;
+          sep3 = " ";
           prevMoreIndented = false;
         }
       }
@@ -7689,25 +7689,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep4 = " ";
+      let sep3 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep4 === "\n")
-            res += sep4;
+          if (sep3 === "\n")
+            res += sep3;
           else
-            sep4 = "\n";
+            sep3 = "\n";
         } else {
-          res += sep4 + match[1];
-          sep4 = " ";
+          res += sep3 + match[1];
+          sep3 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep4 + (match?.[1] ?? "");
+      return res + sep3 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -8514,14 +8514,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep4, value }) {
+    function stringifyItem({ start, key, sep: sep3, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep4)
-        for (const st of sep4)
+      if (sep3)
+        for (const st of sep3)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -9671,18 +9671,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep4;
+          let sep3;
           if (scalar.end) {
-            sep4 = scalar.end;
-            sep4.push(this.sourceToken);
+            sep3 = scalar.end;
+            sep3.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep4 = [this.sourceToken];
+            sep3 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep4 }]
+            items: [{ start, key: scalar, sep: sep3 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -9835,15 +9835,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep4 = it.sep;
-                  sep4.push(this.sourceToken);
+                  const sep3 = it.sep;
+                  sep3.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep4 }]
+                    items: [{ start: start2, key, sep: sep3 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -10037,13 +10037,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep4 = fc.end.splice(1, fc.end.length);
-            sep4.push(this.sourceToken);
+            const sep3 = fc.end.splice(1, fc.end.length);
+            sep3.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep4 }]
+              items: [{ start, key: fc, sep: sep3 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -10413,6 +10413,7 @@ var MAX_ITERATIONS = 2;
 var MAX_SPEC_FILES = 6;
 var MAX_SPEC_FILE_BYTES = 512e3;
 var MAX_TOTAL_SPEC_BYTES = 512e3;
+var MAX_EXPLICIT_SPEC_FILE_BYTES = 10240;
 var MAX_PLAN_FILES = 3;
 var MAX_PLAN_FILE_BYTES = 512e3;
 var MAX_INTENT_CHARS = 2e3;
@@ -10523,7 +10524,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10969,8 +10970,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path3.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename4 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename4)) return true;
+    const basename5 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename5)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -11533,7 +11534,7 @@ function startSpinner(label2, opts = {}) {
 }
 
 // src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
 async function githubAccountId(owner) {
   try {
@@ -12800,12 +12801,50 @@ function resolveGuardMoments(explicit) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_fs6 = require("node:fs");
-var import_node_os2 = require("node:os");
+var import_node_fs7 = require("node:fs");
+
+// src/lib/which.ts
+var import_node_fs5 = require("node:fs");
 var import_node_path7 = require("node:path");
+function executableExtensions(platform, pathext) {
+  if (platform !== "win32") return [""];
+  const raw = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const out = [];
+  for (const ext of raw) {
+    const lower = ext.toLowerCase();
+    if (!out.includes(lower)) out.push(lower);
+    if (!out.includes(ext)) out.push(ext);
+  }
+  return out;
+}
+function whichSync(bin, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const rawPath = opts.path ?? process.env.PATH ?? "";
+  if (!rawPath) return null;
+  const exts = executableExtensions(platform, opts.pathext ?? process.env.PATHEXT);
+  const real = opts.real ?? true;
+  for (const dir of rawPath.split(import_node_path7.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = (0, import_node_path7.join)(dir, bin + ext);
+      try {
+        if (!(0, import_node_fs5.statSync)(candidate).isFile()) continue;
+        if (platform !== "win32") (0, import_node_fs5.accessSync)(candidate, import_node_fs5.constants.X_OK);
+        return real ? (0, import_node_fs5.realpathSync)(candidate) : candidate;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}
+
+// src/lib/plugin-ownership.ts
+var import_node_os2 = require("node:os");
+var import_node_path8 = require("node:path");
 
 // src/lib/stderr-log.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -12818,9 +12857,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs5.appendFileSync)(file, text);
+    (0, import_node_fs6.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -12868,8 +12907,8 @@ function markerPath() {
 }
 function readMarker() {
   try {
-    if (!(0, import_node_fs6.existsSync)(markerPath())) return null;
-    const raw = JSON.parse((0, import_node_fs6.readFileSync)(markerPath(), "utf-8"));
+    if (!(0, import_node_fs7.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs7.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
     if (!pluginRoot || CONTROL_CHARS.test(pluginRoot)) return null;
     return {
@@ -12886,23 +12925,23 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs6.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs7.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs6.writeFileSync)(markerPath(), JSON.stringify(marker));
+    (0, import_node_fs7.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
 function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".claude");
 }
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -12910,9 +12949,9 @@ function readJsonFile(path) {
 }
 function enabledPluginSetting(key) {
   const files = [
-    projectPath((0, import_node_path7.join)(".claude", "settings.local.json")),
-    projectPath((0, import_node_path7.join)(".claude", "settings.json")),
-    (0, import_node_path7.join)(claudeConfigDir(), "settings.json")
+    projectPath((0, import_node_path8.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path8.join)(".claude", "settings.json")),
+    (0, import_node_path8.join)(claudeConfigDir(), "settings.json")
   ];
   for (const file of files) {
     const map = readJsonFile(file)?.enabledPlugins;
@@ -12924,27 +12963,16 @@ function enabledPluginSetting(key) {
 }
 function marketplaceLocations() {
   const out = /* @__PURE__ */ new Map();
-  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   if (!known) return out;
   for (const [name, entry] of Object.entries(known)) {
     const loc2 = entry?.installLocation;
-    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path7.resolve)(loc2));
+    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path8.resolve)(loc2));
   }
   return out;
 }
 function verityPathEntry() {
-  const path = process.env.PATH;
-  if (!path) return null;
-  for (const dir of path.split(import_node_path7.delimiter)) {
-    if (!dir) continue;
-    const candidate = (0, import_node_path7.join)(dir, "verity");
-    try {
-      (0, import_node_fs6.accessSync)(candidate, import_node_fs6.constants.X_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
+  return whichSync("verity", { real: false });
 }
 function verityOnPath() {
   return verityPathEntry() !== null;
@@ -12953,7 +12981,7 @@ function globalVerityVersion() {
   const entry = verityPathEntry();
   if (!entry) return null;
   try {
-    const pkg = readJsonFile((0, import_node_path7.join)((0, import_node_path7.dirname)((0, import_node_fs6.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJsonFile((0, import_node_path8.join)((0, import_node_path8.dirname)((0, import_node_fs7.realpathSync)(entry)), "..", "package.json"));
     if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
     return pkg.version;
   } catch {
@@ -12965,7 +12993,7 @@ function pluginCliInvocation() {
   if (!root) return null;
   const onPath = globalVerityVersion();
   if (onPath !== null && onPath === activePluginVersion()) return null;
-  return `node ${JSON.stringify((0, import_node_path7.join)(root, "scripts", "verity.mjs"))}`;
+  return `node ${JSON.stringify((0, import_node_path8.join)(root, "scripts", "verity.mjs"))}`;
 }
 function cliVersionSkew() {
   if (!process.env.VERITY_PLUGIN_ROOT) return null;
@@ -12984,7 +13012,7 @@ var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
   const wanted = VERITY_MARKETPLACE;
   for (const file of ["settings.json", "settings.local.json"]) {
-    const path = (0, import_node_path7.join)(claudeConfigDir(), file);
+    const path = (0, import_node_path8.join)(claudeConfigDir(), file);
     const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
     const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
     if (entry2 && typeof entry2 === "object") {
@@ -12994,7 +13022,7 @@ function marketplaceConflict() {
       }
     }
   }
-  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   const entry = known?.[wanted];
   if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
     return { name: wanted, declaredAs: describeSource(entry.source) };
@@ -13015,7 +13043,7 @@ function describeSource(src) {
   return target ? `${kind} \u2192 ${target}` : kind;
 }
 function legacyMarketplaceInstall() {
-  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   for (const key of Object.keys(plugins)) {
     const at = key.lastIndexOf("@");
@@ -13027,13 +13055,13 @@ function legacyMarketplaceInstall() {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs6.realpathSync.native(p);
+    return import_node_fs7.realpathSync.native(p);
   } catch {
-    return (0, import_node_path7.resolve)(p);
+    return (0, import_node_path8.resolve)(p);
   }
 }
 function isWithin(want, dir) {
-  return want === dir || want.startsWith(dir + import_node_path7.sep);
+  return want === dir || want.startsWith(dir + import_node_path8.sep);
 }
 function entryAppliesHere(entry, here) {
   const e = entry;
@@ -13043,9 +13071,9 @@ function entryAppliesHere(entry, here) {
   return forProject === here;
 }
 function registrySays(pluginRoot) {
-  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
-  const want = (0, import_node_path7.resolve)(pluginRoot);
+  const want = (0, import_node_path8.resolve)(pluginRoot);
   const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
@@ -13054,15 +13082,15 @@ function registrySays(pluginRoot) {
     const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
     const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
-      return typeof installPath === "string" && (0, import_node_path7.resolve)(installPath) === want;
+      return typeof installPath === "string" && (0, import_node_path8.resolve)(installPath) === want;
     }) || source !== void 0 && applicable.length > 0 && isWithin(want, source);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
-      return (0, import_node_fs6.existsSync)(pluginRoot) ? "live" : "gone";
+      return (0, import_node_fs7.existsSync)(pluginRoot) ? "live" : "gone";
     }
   }
-  const managed = (0, import_node_path7.resolve)((0, import_node_path7.join)(claudeConfigDir(), "plugins", "cache"));
-  return want === managed || want.startsWith(managed + import_node_path7.sep) ? "gone" : "unverified";
+  const managed = (0, import_node_path8.resolve)((0, import_node_path8.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path8.sep) ? "gone" : "unverified";
 }
 var _live = /* @__PURE__ */ new Map();
 function pluginLiveness(pluginRoot) {
@@ -13076,7 +13104,7 @@ function clearStalePluginMarker() {
   const marker = readMarker();
   if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
   try {
-    (0, import_node_fs6.rmSync)(markerPath(), { force: true });
+    (0, import_node_fs7.rmSync)(markerPath(), { force: true });
   } catch {
     return null;
   }
@@ -13104,7 +13132,7 @@ function pluginActiveHere() {
   return activePluginInstall() !== null;
 }
 function registeredVerityPlugin() {
-  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   const here = realpathOr(repoRoot());
   for (const [key, value] of Object.entries(plugins)) {
@@ -13114,7 +13142,7 @@ function registeredVerityPlugin() {
     for (const entry of Array.isArray(value) ? value : []) {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
-      if (!installPath || !(0, import_node_fs6.existsSync)(installPath)) continue;
+      if (!installPath || !(0, import_node_fs7.existsSync)(installPath)) continue;
       if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
@@ -13299,7 +13327,7 @@ var import_node_crypto8 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
@@ -13335,7 +13363,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs7.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs8.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -13359,7 +13387,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs7.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs8.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -13652,9 +13680,9 @@ function isCommandOnlyTurn(input) {
 
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_os3 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
   "-",
@@ -13692,7 +13720,7 @@ function contextIdentity(input) {
   if (rawTree && !isSharedSentinel(rawTree)) {
     let resolved = rawTree;
     try {
-      resolved = import_node_fs8.realpathSync.native(rawTree);
+      resolved = import_node_fs9.realpathSync.native(rawTree);
     } catch {
     }
     treeKey = (0, import_node_crypto2.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
@@ -13708,13 +13736,13 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path8.resolve)(override) : (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path9.resolve)(override) : (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".verity");
 }
 function dossierDir(identity) {
-  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+  return (0, import_node_path9.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
 }
 function treeDir(identity) {
-  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+  return (0, import_node_path9.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
 }
 function scopeIdentity(token, sessionId) {
   const t = (token ?? "").trim();
@@ -13729,8 +13757,8 @@ function sessionScopeKey(token, sessionId) {
 
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs9 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs10 = require("node:fs");
+var import_node_path10 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -13769,7 +13797,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs9.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs10.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -13803,12 +13831,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs9.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs10.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path9.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path10.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -13822,13 +13850,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path9.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path10.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs9.existsSync)(filePath)) {
+    if ((0, import_node_fs10.existsSync)(filePath)) {
       const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises6.readFile)(filePath, "utf-8");
@@ -13839,213 +13867,21 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs9.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs10.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
     await (0, import_promises6.writeFile)(filePath, existing + line);
   } catch {
   }
 }
 
 // src/lib/memory-retrieval.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_fs11 = require("node:fs");
 var import_node_path11 = require("node:path");
-
-// src/lib/org-mirror.ts
-var import_node_fs10 = require("node:fs");
-var import_promises7 = require("node:fs/promises");
-var import_node_path10 = require("node:path");
-var ORG_KINDS = ["decision", "security", "gotcha", "pattern", "domain", "integration"];
-var STATE_FILE = ".org-pull-state.json";
-var BODY_MAX = 8192;
-function orgMirrorDir(remote = requestRemote()) {
-  const parsed = parseRemote(remote);
-  if (!parsed) return null;
-  return (0, import_node_path10.join)(verityHome(), "orgs", parsed.host, parsed.owner.toLowerCase(), "memory");
-}
-function slugify(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
-}
-function orgNodePath(node) {
-  const kind = ORG_KINDS.includes(node.kind) ? node.kind : "domain";
-  return `${kind}/${slugify(node.title) || "claim"}-${node.tag_id.replace(/-/g, "").slice(0, 8)}.md`;
-}
-function renderOrgNode(node, orgName) {
-  const fm = [
-    "---",
-    `id: ${JSON.stringify(node.tag_id)}`,
-    `node_id: ${JSON.stringify(node.node_id)}`,
-    'scope: "org"',
-    `org: ${JSON.stringify(orgName)}`,
-    `kind: ${JSON.stringify(node.kind)}`,
-    `title: ${JSON.stringify(node.title)}`,
-    `origin: ${JSON.stringify(node.origin)}`,
-    `signal: ${JSON.stringify(node.signal)}`,
-    `tier: ${node.tier === null ? "null" : JSON.stringify(node.tier)}`,
-    `applies_to: ${JSON.stringify(node.applies_to)}`,
-    `source_repo_count: ${JSON.stringify(node.source_repo_count)}`,
-    `promoted_at: ${JSON.stringify(node.promoted_at)}`,
-    'status: "active"',
-    "---"
-  ];
-  return `${fm.join("\n")}
-
-# ${node.title}
-
-${node.body.trim()}
-`;
-}
-function parseOrgNode(content) {
-  const m = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
-  if (!m) return null;
-  const fm = {};
-  for (const line of m[1].split("\n")) {
-    const kv = line.match(/^([a-z_]+):\s*(.*)$/);
-    if (!kv) continue;
-    try {
-      fm[kv[1]] = JSON.parse(kv[2]);
-    } catch {
-      fm[kv[1]] = kv[2];
-    }
-  }
-  if (fm.scope !== "org" || typeof fm.id !== "string" || typeof fm.title !== "string") return null;
-  if (fm.status && fm.status !== "active") return null;
-  const body = m[2].replace(/^\s*#[^\n]*\n/, "").trim();
-  return {
-    tag_id: fm.id,
-    node_id: typeof fm.node_id === "string" ? fm.node_id : "",
-    kind: typeof fm.kind === "string" ? fm.kind : "domain",
-    title: fm.title,
-    body,
-    origin: typeof fm.origin === "string" ? fm.origin : "",
-    signal: typeof fm.signal === "string" ? fm.signal : "",
-    tier: typeof fm.tier === "number" ? fm.tier : null,
-    applies_to: Array.isArray(fm.applies_to) ? fm.applies_to.filter((v) => typeof v === "string") : [],
-    source_repo_count: typeof fm.source_repo_count === "number" ? fm.source_repo_count : 1,
-    promoted_at: typeof fm.promoted_at === "string" ? fm.promoted_at : ""
-  };
-}
-async function readState(dir) {
-  try {
-    const parsed = JSON.parse(await (0, import_promises7.readFile)((0, import_node_path10.join)(dir, STATE_FILE), "utf-8"));
-    return {
-      version: typeof parsed?.version === "string" ? parsed.version : null,
-      organization: parsed?.organization && typeof parsed.organization.id === "string" ? parsed.organization : null,
-      files: Array.isArray(parsed?.files) ? parsed.files.filter((f) => typeof f === "string") : []
-    };
-  } catch {
-    return { version: null, organization: null, files: [] };
-  }
-}
-async function writeState(dir, state) {
-  await (0, import_promises7.mkdir)(dir, { recursive: true });
-  await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, STATE_FILE), JSON.stringify({
-    ...state.version ? { version: state.version } : {},
-    organization: state.organization,
-    pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
-    files: state.files
-  }, null, 2) + "\n");
-}
-function renderIndex(orgName, nodes) {
-  const lines = [
-    `# Org Knowledge \u2014 ${orgName}`,
-    "",
-    "*Auto-generated by verity CLI from what this organization's repositories learned. Do not hand-edit; `verity memory pull` overwrites it.*",
-    "",
-    '> These claims hold across the organization\'s repositories, not only this one. Each names where it came from. A claim that is wrong for this repository is demoted with `verity memory demote <id> --reason "\u2026"`, for everyone.',
-    ""
-  ];
-  const byKind = /* @__PURE__ */ new Map();
-  for (const n of nodes) byKind.set(n.kind, [...byKind.get(n.kind) ?? [], n]);
-  for (const kind of ORG_KINDS) {
-    const list2 = byKind.get(kind);
-    if (!list2?.length) continue;
-    lines.push(`## ${kind}/ (${list2.length})`);
-    for (const n of list2) lines.push(`- [[${orgNodePath(n).split("/")[1].replace(/\.md$/, "")}]] \u2014 ${n.title} \xB7 ${n.origin}`);
-    lines.push("");
-  }
-  if (nodes.length === 0) lines.push("No org knowledge yet.", "");
-  return lines.join("\n");
-}
-async function pullOrgKnowledge(opts) {
-  const dir = orgMirrorDir(opts.remote ?? requestRemote());
-  if (!dir) return { ok: true, status: "no_remote", received: 0, dir: null };
-  const state = await readState(dir);
-  const params = new URLSearchParams({ for: "agent" });
-  if (!opts.force && state.version) params.set("if_version", state.version);
-  const res = await apiRequest({
-    method: "GET",
-    path: `/memory/org?${params.toString()}`,
-    serviceUrl: opts.serviceUrl,
-    token: opts.token,
-    verbose: opts.verbose,
-    timeout: opts.timeoutMs ?? 3e4,
-    cmd: "memory-org-pull"
-  });
-  if (!res.ok) return { ok: false, error: res.error, category: res.category };
-  const page = res.data;
-  if (page.unchanged) return { ok: true, status: "unchanged", received: 0, dir };
-  const org = page.organization;
-  const nodes = org ? (page.nodes ?? []).flatMap((n) => typeof n.tag_id === "string" && typeof n.title === "string" && typeof n.body === "string" ? [{
-    tag_id: n.tag_id,
-    node_id: typeof n.node_id === "string" ? n.node_id : "",
-    kind: typeof n.kind === "string" ? n.kind : "domain",
-    title: n.title,
-    body: n.body.slice(0, BODY_MAX),
-    origin: typeof n.origin === "string" ? n.origin : "",
-    signal: typeof n.signal === "string" ? n.signal : "",
-    tier: typeof n.tier === "number" ? n.tier : null,
-    applies_to: Array.isArray(n.applies_to) ? n.applies_to.filter((v) => typeof v === "string") : [],
-    source_repo_count: typeof n.source_repo_count === "number" ? n.source_repo_count : 1,
-    promoted_at: typeof n.promoted_at === "string" ? n.promoted_at : ""
-  }] : []) : [];
-  const written = /* @__PURE__ */ new Set();
-  await (0, import_promises7.mkdir)(dir, { recursive: true });
-  for (const n of nodes) {
-    const rel = orgNodePath(n);
-    if (written.has(rel)) continue;
-    await (0, import_promises7.mkdir)((0, import_node_path10.join)(dir, rel.split("/")[0]), { recursive: true });
-    await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, rel), renderOrgNode(n, org?.name ?? ""));
-    written.add(rel);
-  }
-  for (const rel of state.files) {
-    if (!written.has(rel)) await (0, import_promises7.rm)((0, import_node_path10.join)(dir, rel), { force: true });
-  }
-  await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, "index.md"), renderIndex(org?.name ?? "no organization", nodes));
-  await writeState(dir, { version: org ? page.version : null, organization: org, files: [...written].sort() });
-  return { ok: true, status: org ? "pulled" : "none", received: nodes.length, dir };
-}
-async function readOrgMirror(remote = requestRemote()) {
-  const dir = orgMirrorDir(remote);
-  if (!dir || !(0, import_node_fs10.existsSync)(dir)) return [];
-  const out = [];
-  for (const kind of ORG_KINDS) {
-    const kindDir = (0, import_node_path10.join)(dir, kind);
-    if (!(0, import_node_fs10.existsSync)(kindDir)) continue;
-    let files;
-    try {
-      files = await (0, import_promises7.readdir)(kindDir);
-    } catch {
-      continue;
-    }
-    for (const file of files) {
-      if (!file.endsWith(".md")) continue;
-      try {
-        const node = parseOrgNode(await (0, import_promises7.readFile)((0, import_node_path10.join)(kindDir, file), "utf-8"));
-        if (node) out.push(node);
-      } catch {
-      }
-    }
-  }
-  return out;
-}
-
-// src/lib/memory-retrieval.ts
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
 var MAX_BUDGET_TOKENS = 4e3;
 var MIN_SCORE = 0.5;
-var ORG_MIN_SHARED_TERMS = 2;
 function tokenize(text) {
   return new Set(
     text.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2)
@@ -14058,26 +13894,6 @@ function jaccardKeywords(a, b) {
   const union = a.size + b.size - inter;
   return union === 0 ? 0 : inter / union;
 }
-function sharedTerms(a, b) {
-  let n = 0;
-  for (const w of a) if (b.has(w)) n++;
-  return n;
-}
-function orgNodeToLocal(n) {
-  return {
-    path: `org:${n.tag_id}`,
-    nodeId: n.tag_id,
-    kind: n.kind,
-    title: n.title,
-    body: n.body.slice(0, 2e3),
-    fileGlobs: [],
-    confidence: 0.5,
-    citedCount: 0,
-    tokenEstimate: Math.ceil((n.title.length + n.body.length) / 4) + 20,
-    scope: "org",
-    origin: n.origin
-  };
-}
 function globMatch(glob, filePath) {
   if (glob === filePath) return true;
   const suffixMatch = glob.match(/^\*\*\/\*(.+)$/);
@@ -14153,19 +13969,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  const hasRepoGraph = (0, import_node_fs11.existsSync)(memoryDir());
+  if (!(0, import_node_fs11.existsSync)(memoryDir())) return null;
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
-  for (const domain of hasRepoGraph ? DOMAINS : []) {
+  for (const domain of DOMAINS) {
     const domainDir = (0, import_node_path11.join)(memoryDir(), domain);
     if (!(0, import_node_fs11.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises8.readdir)(domainDir);
+      const files = await (0, import_promises7.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path11.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises7.readFile)((0, import_node_path11.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -14185,13 +14001,6 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
     } catch {
     }
   }
-  try {
-    for (const claim of await readOrgMirror()) {
-      const local = orgNodeToLocal(claim);
-      if (sharedTerms(tokenize(`${local.title} ${local.body}`), promptTokens) >= ORG_MIN_SHARED_TERMS) nodes.push(local);
-    }
-  } catch {
-  }
   if (nodes.length === 0) return null;
   const scored = nodes.map((n) => ({
     ...n,
@@ -14210,13 +14019,12 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   const lines = [
     "## Project Knowledge (auto-injected)",
     "",
-    `*${selected.length} node(s) relevant to your current task. See \`.verity/memory/index.md\` for the full knowledge base${selected.some((n) => n.scope === "org") ? ", and `~/.verity/orgs/` for what the organization's other repositories learned" : ""}.*`,
+    `*${selected.length} node(s) relevant to your current task. See \`.verity/memory/index.md\` for the full knowledge base.*`,
     ""
   ];
   for (const node of selected) {
     lines.push(`### ${node.title}`);
-    if (node.scope === "org") lines.push(`*org \xB7 ${node.origin}* \xB7 ${node.kind}`);
-    else lines.push(`*${node.kind}* \xB7 confidence ${Math.round(node.confidence * 100)}%`);
+    lines.push(`*${node.kind}* \xB7 confidence ${Math.round(node.confidence * 100)}%`);
     lines.push("");
     lines.push(node.body.slice(0, 800));
     lines.push("");
@@ -14231,7 +14039,7 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 }
 
 // src/lib/memory-sync.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 var import_node_fs14 = require("node:fs");
 var import_node_path13 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
@@ -14346,8 +14154,8 @@ function ensureVerityGitignore() {
     }
     let text = next.join("\n");
     if (!hasMarker) {
-      const sep4 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
-      text = text + sep4 + VERITY_GITIGNORE_BLOCK;
+      const sep3 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+      text = text + sep3 + VERITY_GITIGNORE_BLOCK;
     }
     if (text !== content) (0, import_node_fs12.writeFileSync)(".gitignore", text);
     return verified(
@@ -14377,8 +14185,8 @@ function writeFencedBlock() {
   lines = fenceMemoryLines(lines);
   let text = lines.join("\n");
   if (!hasMarker) {
-    const sep4 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
-    text = text + sep4 + VERITY_GITIGNORE_BLOCK;
+    const sep3 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+    text = text + sep3 + VERITY_GITIGNORE_BLOCK;
   }
   try {
     (0, import_node_fs12.writeFileSync)(".gitignore", text);
@@ -14428,8 +14236,8 @@ function keepMemoryTracked() {
   }
   if (content.includes(MEMORY_OPT_OUT_MARKER)) return "already";
   try {
-    const sep4 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
-    (0, import_node_fs12.writeFileSync)(".gitignore", content + sep4 + MEMORY_OPT_OUT_STANZA);
+    const sep3 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
+    (0, import_node_fs12.writeFileSync)(".gitignore", content + sep3 + MEMORY_OPT_OUT_STANZA);
   } catch {
     return "failed";
   }
@@ -14491,6 +14299,42 @@ function resolveInside(baseDir, candidate) {
   }
   return full;
 }
+var O_NOFOLLOW = typeof import_node_fs13.constants.O_NOFOLLOW === "number" ? import_node_fs13.constants.O_NOFOLLOW : 0;
+function readFileInside(baseDir, candidate, maxBytes) {
+  const full = resolveInside(baseDir, candidate);
+  if (!full) return null;
+  let realParent;
+  let realBase;
+  try {
+    realParent = (0, import_node_fs13.realpathSync)((0, import_node_path12.dirname)(full));
+    realBase = (0, import_node_fs13.realpathSync)((0, import_node_path12.resolve)(baseDir));
+  } catch {
+    return null;
+  }
+  const realBaseSep = realBase.endsWith(import_node_path12.sep) ? realBase : realBase + import_node_path12.sep;
+  if (realParent !== realBase && !realParent.startsWith(realBaseSep)) return null;
+  const target = (0, import_node_path12.join)(realParent, (0, import_node_path12.basename)(full));
+  let fd = null;
+  try {
+    fd = (0, import_node_fs13.openSync)(target, import_node_fs13.constants.O_RDONLY | O_NOFOLLOW);
+    const st = (0, import_node_fs13.fstatSync)(fd);
+    if (!st.isFile()) return null;
+    const cap = Math.min(maxBytes, st.size);
+    if (cap <= 0) return "";
+    const buf = Buffer.alloc(cap);
+    const bytesRead = (0, import_node_fs13.readSync)(fd, buf, 0, cap, 0);
+    return buf.subarray(0, bytesRead).toString("utf-8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        (0, import_node_fs13.closeSync)(fd);
+      } catch {
+      }
+    }
+  }
+}
 
 // src/lib/glob-match.ts
 function globToRegex(glob) {
@@ -14540,14 +14384,6 @@ function globToRegex(glob) {
   out = out.replace(/(?:\.\*)+/g, ".*");
   return new RegExp(`^${out}$`);
 }
-function globMatch2(glob, filePath) {
-  if (glob === filePath) return true;
-  try {
-    return globToRegex(glob).test(filePath);
-  } catch {
-    return false;
-  }
-}
 function anyPathMatches(glob, treePaths) {
   let regex;
   try {
@@ -14566,18 +14402,18 @@ var memoryDir2 = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS2 = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations", "_archive"];
 var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
-  await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
+  await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path13.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises8.mkdir)((0, import_node_path13.join)(memoryDir2(), domain), { recursive: true });
   }
   if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
   if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
   if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
@@ -14589,13 +14425,13 @@ async function buildManifest() {
     const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
     if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises9.readdir)(domainDir);
+      const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
         const fullPath = (0, import_node_path13.join)(memoryDir2(), filePath);
         try {
-          const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
+          const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
@@ -14606,13 +14442,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises8.readFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises8.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -14628,10 +14464,10 @@ async function readOnDiskNodes() {
     const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
     if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
-      for (const file of await (0, import_promises9.readdir)(domainDir)) {
+      for (const file of await (0, import_promises8.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -14643,7 +14479,7 @@ async function readOnDiskNodes() {
 async function readSyncBaseline() {
   const out = /* @__PURE__ */ new Map();
   try {
-    const parsed = JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises8.readFile)(syncStateFile(), "utf-8"));
     if (Array.isArray(parsed?.nodes)) {
       for (const n of parsed.nodes) if (n?.path) out.set(n.path, n.hash ?? null);
     } else if (Array.isArray(parsed?.paths)) {
@@ -14659,20 +14495,15 @@ async function recordSyncedNodePaths() {
     const next = JSON.stringify({ schema: 2, nodes }) + "\n";
     let existing = "";
     try {
-      existing = await (0, import_promises9.readFile)(syncStateFile(), "utf-8");
+      existing = await (0, import_promises8.readFile)(syncStateFile(), "utf-8");
     } catch {
     }
     if (existing === next) return;
-    await writeFileAtomic(syncStateFile(), next);
+    await (0, import_promises8.mkdir)(projectPath(VERITY_DIR), { recursive: true });
+    await (0, import_promises8.writeFile)(syncStateFile(), next);
   } catch {
   }
 }
-async function writeFileAtomic(path, content) {
-  await (0, import_promises9.mkdir)((0, import_node_path13.dirname)(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  await (0, import_promises9.writeFile)(tmp, content);
-  await (0, import_promises9.rename)(tmp, path);
-}
 async function recordSyncBaseline() {
   await recordSyncedNodePaths();
 }
@@ -14686,7 +14517,7 @@ async function computeEditedNodeUploads() {
     if (!(0, import_node_fs14.existsSync)(full)) continue;
     let content;
     try {
-      content = await (0, import_promises9.readFile)(full, "utf-8");
+      content = await (0, import_promises8.readFile)(full, "utf-8");
     } catch {
       continue;
     }
@@ -14707,56 +14538,31 @@ async function applyMemoryWrites(writes, opts = {}) {
   let count = 0;
   const notes = [];
   const treePaths = opts.treePaths;
-  const synced = /* @__PURE__ */ new Map();
   for (const write of writes) {
-    const outcome = await applyOneWrite(write, treePaths, opts.lastServed);
-    if (outcome.written) count++;
-    if (outcome.syncedHash) {
-      synced.set(write.path, outcome.syncedHash);
-      opts.served?.set(write.path, outcome.syncedHash);
-    }
-    notes.push(...outcome.notes);
+    const { written, notes: writeNotes } = await applyOneWrite(write, treePaths);
+    if (written) count++;
+    notes.push(...writeNotes);
   }
   await regenerateIndex();
-  if (opts.claudeMdPointer !== false) {
-    try {
-      await ensureClaudeMdPointer();
-    } catch {
-    }
+  try {
+    await ensureClaudeMdPointer();
+  } catch {
   }
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
-  if (opts.baseline === "written") await mergeSyncBaseline(synced);
-  else if (opts.recordBaseline !== false) await recordSyncedNodePaths();
+  await recordSyncedNodePaths();
   return count;
 }
-async function mergeSyncBaseline(entries) {
-  if (entries.size === 0) return;
-  try {
-    if ((0, import_node_fs14.existsSync)(syncStateFile())) {
-      try {
-        JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
-      } catch {
-        return;
-      }
-    }
-    const merged = await readSyncBaseline();
-    for (const [path, hash] of entries) merged.set(path, hash);
-    const nodes = [...merged].map(([path, hash]) => ({ path, hash }));
-    await writeFileAtomic(syncStateFile(), JSON.stringify({ schema: 2, nodes }) + "\n");
-  } catch {
-  }
-}
-async function applyOneWrite(write, treePaths, lastServed) {
+async function applyOneWrite(write, treePaths) {
   const fullPath = resolveInside(memoryDir2(), write.path);
   const notes = [];
   if (!fullPath) {
-    return { written: false, syncedHash: null, notes: [`${String(write.path)}: rejected \u2014 path escapes the memory directory`] };
+    return { written: false, notes: [`${String(write.path)}: rejected \u2014 path escapes the memory directory`] };
   }
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -14769,22 +14575,18 @@ async function applyOneWrite(write, treePaths, lastServed) {
   if ((0, import_node_fs14.existsSync)(fullPath)) {
     let existing = "";
     try {
-      existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
+      existing = await (0, import_promises8.readFile)(fullPath, "utf-8");
     } catch {
     }
-    if (existing === content) return { written: false, syncedHash: hashContent(content), notes };
+    if (existing === content) return { written: false, notes };
     if (existing !== "") {
-      const served = lastServed?.get(write.path);
-      if (served == null || served !== hashContent(existing)) {
-        notes.push(`${write.path}: kept local edit (differs from server)`);
-        return { written: false, syncedHash: null, notes };
-      }
-      notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
+      notes.push(`${write.path}: kept local edit (differs from server)`);
+      return { written: false, notes };
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path13.dirname)(fullPath), { recursive: true });
-  await (0, import_promises9.writeFile)(fullPath, content);
-  return { written: true, syncedHash: hashContent(content), notes };
+  await (0, import_promises8.mkdir)((0, import_node_path13.dirname)(fullPath), { recursive: true });
+  await (0, import_promises8.writeFile)(fullPath, content);
+  return { written: true, notes };
 }
 function groundFileGlobs(content, treePaths) {
   const globs = pickFrontmatterArray(content, "file_globs");
@@ -14826,7 +14628,7 @@ async function regenerateIndex() {
     const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
     if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises9.readdir)(domainDir);
+      const files = await (0, import_promises8.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       if (mdFiles.length === 0) continue;
       lines.push(`## ${domain}/ (${mdFiles.length})`);
@@ -14834,7 +14636,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -14861,11 +14663,11 @@ async function regenerateIndex() {
   const indexPath = (0, import_node_path13.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
-    existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
+    existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
   } catch {
   }
   if (existing === next) return;
-  await (0, import_promises9.writeFile)(indexPath, next);
+  await (0, import_promises8.writeFile)(indexPath, next);
 }
 function pickFrontmatter(content, key) {
   const re = new RegExp(`^${key}:\\s*"?([^"\\n]+?)"?\\s*$`, "m");
@@ -14892,169 +14694,6 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
-  "## Project Memory",
-  "",
-  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
-  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
-  "that may apply to the change you are about to make. Open specific node files via",
-  "the Read tool when the title or scope suggests relevance.",
-  "",
-  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
-  "superseded \u2014 ignore them unless investigating history.",
-  "",
-  "Knowledge the organization's other repositories learned is mirrored outside the",
-  "repo at `~/.verity/orgs/<host>/<owner>/memory/` (`verity memory org` lists it).",
-  "Each claim says where it came from; one that is wrong here is demoted for",
-  'everyone with `verity memory demote <id> --reason "\u2026"`.',
-  "",
-  "## Quality gate: accepted risks",
-  "",
-  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
-  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
-  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
-  "the user saying so in this conversation. The --reason must cite that source.",
-  "",
-  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
-  "binds to the file's current bytes and voids automatically when the file changes,",
-  "and every waive is recorded in the run ledger. For a pattern-level false positive",
-  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
-  "",
-  "## Post-task reflection",
-  "",
-  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
-  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
-  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
-  "cited with the files / PR / commands / error-signatures it came from. Skip",
-  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
-  "because nothing reviews the reflection before it lands.",
-  "",
-  "Then record it straight away. There is no confirm step, in any environment:",
-  "",
-  "```bash",
-  'verity reflect --user-input "<your draft>" --kind <kind>',
-  "```",
-  "",
-  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
-  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
-  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
-  "Never claim the second for your own draft, however good it is.",
-  "",
-  "**Name the files in the text.** Verity scopes the reflection to the paths it",
-  "cites, and a reflection that names no file in this repo is never retrieved for",
-  "a later review \u2014 it is recorded and then invisible. The command says so when it",
-  'happens; `--file-globs "<path or glob>"` is the fix when the prose cannot carry',
-  "the paths.",
-  "",
-  "Then tell the user, in one line, what you recorded and where: the command",
-  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
-  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
-  "that file is how they correct it.",
-  "",
-  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
-  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
-  "> markers is tool-owned and overwritten on each run.",
-  "",
-  "## Housekeeping Turns",
-  "",
-  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
-  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
-  "",
-  "```bash",
-  'verity ignore --turn --agent --reason "pulling latest before starting"',
-  "```",
-  "",
-  "This skips the review for that turn, which saves the turn Verity would",
-  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
-  "`--turn` when a single piece of housekeeping spans several turns.",
-  "",
-  "**It is a claim about the turn, not a way to silence review.** The declaration",
-  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
-  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
-  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
-  "are about to do, never work you have already done, and never as a way to get past",
-  "a finding. Declarations are budgeted per session and every one is recorded with",
-  "its reason."
-].join("\n");
-var CLAUDE_MD_PROSE_PRE_ORG = [
-  "## Project Memory",
-  "",
-  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
-  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
-  "that may apply to the change you are about to make. Open specific node files via",
-  "the Read tool when the title or scope suggests relevance.",
-  "",
-  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
-  "superseded \u2014 ignore them unless investigating history.",
-  "",
-  "## Quality gate: accepted risks",
-  "",
-  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
-  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
-  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
-  "the user saying so in this conversation. The --reason must cite that source.",
-  "",
-  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
-  "binds to the file's current bytes and voids automatically when the file changes,",
-  "and every waive is recorded in the run ledger. For a pattern-level false positive",
-  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
-  "",
-  "## Post-task reflection",
-  "",
-  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
-  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
-  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
-  "cited with the files / PR / commands / error-signatures it came from. Skip",
-  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
-  "because nothing reviews the reflection before it lands.",
-  "",
-  "Then record it straight away. There is no confirm step, in any environment:",
-  "",
-  "```bash",
-  'verity reflect --user-input "<your draft>" --kind <kind>',
-  "```",
-  "",
-  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
-  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
-  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
-  "Never claim the second for your own draft, however good it is.",
-  "",
-  "**Name the files in the text.** Verity scopes the reflection to the paths it",
-  "cites, and a reflection that names no file in this repo is never retrieved for",
-  "a later review \u2014 it is recorded and then invisible. The command says so when it",
-  'happens; `--file-globs "<path or glob>"` is the fix when the prose cannot carry',
-  "the paths.",
-  "",
-  "Then tell the user, in one line, what you recorded and where: the command",
-  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
-  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
-  "that file is how they correct it.",
-  "",
-  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
-  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
-  "> markers is tool-owned and overwritten on each run.",
-  "",
-  "## Housekeeping Turns",
-  "",
-  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
-  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
-  "",
-  "```bash",
-  'verity ignore --turn --agent --reason "pulling latest before starting"',
-  "```",
-  "",
-  "This skips the review for that turn, which saves the turn Verity would",
-  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
-  "`--turn` when a single piece of housekeeping spans several turns.",
-  "",
-  "**It is a claim about the turn, not a way to silence review.** The declaration",
-  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
-  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
-  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
-  "are about to do, never work you have already done, and never as a way to get past",
-  "a finding. Declarations are budgeted per session and every one is recorded with",
-  "its reason."
-].join("\n");
-var CLAUDE_MD_PROSE_PRE_AUTORECORD = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -15258,7 +14897,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
   const claudeMdPath = (0, import_node_path13.join)(cwd, "CLAUDE.md");
   let existing = "";
   if ((0, import_node_fs14.existsSync)(claudeMdPath)) {
-    existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
+    existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
   let endTag = CLAUDE_MD_END;
@@ -15314,7 +14953,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
     next = existing.replace(/\n*$/, "") + "\n\n" + block + "\n";
   }
   if (next === existing) return;
-  await (0, import_promises9.writeFile)(claudeMdPath, next);
+  await (0, import_promises8.writeFile)(claudeMdPath, next);
 }
 function extractPreserveContent(interior) {
   for (const [start, end] of [
@@ -15333,8 +14972,6 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
-    CLAUDE_MD_PROSE_PRE_ORG,
-    CLAUDE_MD_PROSE_PRE_AUTORECORD,
     CLAUDE_MD_PROSE_PRE_REFLECT,
     CLAUDE_MD_PROSE_PRE_WAIVE,
     CLAUDE_MD_PROSE_PRE_IGNORE,
@@ -16954,112 +16591,21 @@ async function fireClassify(prompt, sessionId, globals) {
 
 // src/commands/lifecycle.ts
 var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_path20 = require("node:path");
 
 // src/lib/baseline.ts
 var import_node_fs22 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_path19 = require("node:path");
 var import_node_crypto9 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs21 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_path18 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 
 // src/lib/files.ts
-var import_node_path18 = require("node:path");
-
-// src/lib/safe-read.ts
 var import_node_fs20 = require("node:fs");
 var import_node_path17 = require("node:path");
-var FLAGS = import_node_fs20.constants;
-var NOFOLLOW = FLAGS.O_NOFOLLOW;
-var NONBLOCK = FLAGS.O_NONBLOCK;
-function closeOpened(fd) {
-  try {
-    (0, import_node_fs20.closeSync)(fd);
-  } catch {
-  }
-}
-function isInsideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path17.sep) ? realRoot : realRoot + import_node_path17.sep);
-}
-function sameOpenedFile(opened, current, nofollowAvailable) {
-  if (!nofollowAvailable && (opened.ino === 0n || current.ino === 0n)) return false;
-  return opened.ino === current.ino && opened.dev === current.dev;
-}
-function openRegularInRoot(root, path) {
-  const full = (0, import_node_path17.isAbsolute)(path) ? path : (0, import_node_path17.join)(root, path);
-  let fd;
-  try {
-    fd = (0, import_node_fs20.openSync)(full, import_node_fs20.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
-  } catch (err) {
-    const code = err.code;
-    if (code === "ELOOP" || code === "EMLINK" || code === "EFTYPE") return { ok: false, reason: "symlink" };
-    if (code === "ENOENT" || code === "ENOTDIR") return { ok: false, reason: "missing" };
-    return { ok: false, reason: "unreadable" };
-  }
-  try {
-    const opened = (0, import_node_fs20.fstatSync)(fd, { bigint: true });
-    if (!opened.isFile()) {
-      closeOpened(fd);
-      return { ok: false, reason: "not-regular" };
-    }
-    const realRoot = import_node_fs20.realpathSync.native(root);
-    const realPath = import_node_fs20.realpathSync.native(full);
-    if (!isInsideRoot(realRoot, realPath)) {
-      closeOpened(fd);
-      return { ok: false, reason: "outside-root" };
-    }
-    const current = (0, import_node_fs20.statSync)(realPath, { bigint: true });
-    if (!sameOpenedFile(opened, current, NOFOLLOW !== void 0)) {
-      closeOpened(fd);
-      return { ok: false, reason: NOFOLLOW === void 0 ? "unreadable" : "outside-root" };
-    }
-    return { ok: true, fd, size: Number(opened.size), mtimeMs: Number(opened.mtimeMs) };
-  } catch {
-    closeOpened(fd);
-    return { ok: false, reason: "unreadable" };
-  }
-}
-function statRegularInRoot(root, path) {
-  const opened = openRegularInRoot(root, path);
-  if (!opened.ok) return opened;
-  closeOpened(opened.fd);
-  return { ok: true, size: opened.size, mtimeMs: opened.mtimeMs };
-}
-function readOpened(fd, size) {
-  try {
-    const buffer = Buffer.alloc(size);
-    let offset = 0;
-    while (offset < size) {
-      const n = (0, import_node_fs20.readSync)(fd, buffer, offset, size - offset, offset);
-      if (n === 0) break;
-      offset += n;
-    }
-    return buffer.subarray(0, offset);
-  } finally {
-    closeOpened(fd);
-  }
-}
-function readOpenedUtf8(fd, size) {
-  return readOpened(fd, size).toString("utf-8");
-}
-function readRegularFileInRoot(root, path, maxBytes) {
-  const opened = openRegularInRoot(root, path);
-  if (!opened.ok) return opened;
-  if (opened.size > maxBytes) {
-    closeOpened(opened.fd);
-    return { ok: false, reason: "too-large", size: opened.size };
-  }
-  try {
-    return { ok: true, content: readOpenedUtf8(opened.fd, opened.size), size: opened.size };
-  } catch {
-    return { ok: false, reason: "unreadable" };
-  }
-}
-
-// src/lib/files.ts
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -17127,14 +16673,19 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path18.extname)(filepath).slice(1);
+  const ext = (0, import_node_path17.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
   const withMtime = files.map((f) => {
-    const stat3 = statRegularInRoot(process.cwd(), f);
-    if (stat3.ok) return { path: f, mtime: stat3.mtimeMs };
-    return stat3.reason === "missing" ? null : { path: f, mtime: Number.NEGATIVE_INFINITY };
+    const resolved = resolveFile(f);
+    if (!resolved) return null;
+    try {
+      const stat3 = (0, import_node_fs20.statSync)(resolved);
+      return { path: f, resolved, mtime: stat3.mtimeMs };
+    } catch {
+      return null;
+    }
   }).filter((x) => x !== null);
   withMtime.sort((a, b) => b.mtime - a.mtime);
   return withMtime.map((x) => x.path);
@@ -17156,22 +16707,23 @@ function collectCodeDelta(files, opts) {
       droppedPaths.push(filepath);
       continue;
     }
-    const opened = openRegularInRoot(process.cwd(), filepath);
-    if (!opened.ok) {
-      exclude(
-        filepath,
-        opened.reason === "symlink" || opened.reason === "outside-root" ? "symlink" : opened.reason === "missing" ? "path-not-resolvable" : "not-stattable"
-      );
+    const resolved = resolveFile(filepath);
+    if (!resolved) {
+      exclude(filepath, "path-not-resolvable");
+      continue;
+    }
+    let size;
+    try {
+      size = (0, import_node_fs20.statSync)(resolved).size;
+    } catch {
+      exclude(filepath, "not-stattable");
       continue;
     }
-    const size = opened.size;
     if (size > maxFileBytes) {
-      closeOpened(opened.fd);
       exclude(filepath, `over-file-size-limit-${maxFileBytes}b`);
       continue;
     }
     if (totalSize + size > maxTotalBytes) {
-      closeOpened(opened.fd);
       truncationReason ??= "max_total_bytes";
       const idx = sorted.indexOf(filepath);
       droppedPaths.push(...sorted.slice(idx));
@@ -17179,7 +16731,7 @@ function collectCodeDelta(files, opts) {
     }
     let content;
     try {
-      content = readOpenedUtf8(opened.fd, size);
+      content = (0, import_node_fs20.readFileSync)(resolved, "utf-8");
     } catch {
       exclude(filepath, "not-readable");
       continue;
@@ -17224,7 +16776,7 @@ function generateSnapshotDiffs(files) {
   const diffs = [];
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path19.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path18.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
     if ((0, import_node_fs21.existsSync)(snapshotPath)) {
       const oldContent = (0, import_node_fs21.readFileSync)(snapshotPath, "utf-8");
@@ -17252,16 +16804,16 @@ function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path19.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path18.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs21.mkdirSync)((0, import_node_path19.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs21.mkdirSync)((0, import_node_path18.dirname)(snapshotPath), { recursive: true });
     (0, import_node_fs21.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path19.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path19.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path18.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path18.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
     (0, import_node_fs21.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs21.writeFileSync)(tmpOld, oldContent);
@@ -17294,7 +16846,7 @@ function cleanStaleSnapshots(dir, keepSet) {
     const entries = (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
-      const fullPath = (0, import_node_path19.join)(dir, entry.name);
+      const fullPath = (0, import_node_path18.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
@@ -17323,13 +16875,13 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto9.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path20.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path19.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path20.join)(dir, "manifest.json");
+  return (0, import_node_path19.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path20.join)(dir, "files", repoRelPath);
+  return (0, import_node_path19.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
@@ -17391,7 +16943,7 @@ function captureBaseline(opts = {}) {
     (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path20.join)(dir, "files");
+  const filesDir = (0, import_node_path19.join)(dir, "files");
   const mirrored = [];
   try {
     (0, import_node_fs22.mkdirSync)(filesDir, { recursive: true });
@@ -17401,7 +16953,7 @@ function captureBaseline(opts = {}) {
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
+        (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(dest), { recursive: true });
         (0, import_node_fs22.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
@@ -17509,7 +17061,7 @@ function absorbIntoBaseline(paths, sessionId) {
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
-      (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
+      (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(dest), { recursive: true });
       (0, import_node_fs22.writeFileSync)(dest, content);
       dirty.add(p);
       adopted++;
@@ -17557,7 +17109,7 @@ function pruneOldBaselines() {
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path20.join)(root, name);
+    const dir = (0, import_node_path19.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
@@ -17745,7 +17297,7 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path21.join)(root, file);
+        const abs = (0, import_node_path20.join)(root, file);
         return (0, import_node_fs23.existsSync)(abs) ? (0, import_node_fs23.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
@@ -17782,17 +17334,17 @@ async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
-    const timeout = new Promise((resolve6) => setTimeout(() => resolve6({}), 500));
-    const read = new Promise((resolve6) => {
+    const timeout = new Promise((resolve5) => setTimeout(() => resolve5({}), 500));
+    const read = new Promise((resolve5) => {
       process.stdin.on("data", (c) => chunks.push(c));
       process.stdin.on("end", () => {
         try {
-          resolve6(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
+          resolve5(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
         } catch {
-          resolve6({});
+          resolve5({});
         }
       });
-      process.stdin.on("error", () => resolve6({}));
+      process.stdin.on("error", () => resolve5({}));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -17802,25 +17354,25 @@ async function readHookStdin() {
 }
 
 // src/commands/standard.ts
-var import_promises13 = require("node:fs/promises");
+var import_promises12 = require("node:fs/promises");
 var import_node_fs30 = require("node:fs");
 var import_yaml3 = __toESM(require_dist());
 
 // src/lib/synthesize.ts
 var import_node_child_process9 = require("node:child_process");
 var import_node_fs26 = require("node:fs");
-var import_promises10 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
+var import_promises9 = require("node:fs/promises");
+var import_node_path23 = require("node:path");
 var import_yaml = __toESM(require_dist());
 
 // src/lib/data-dir.ts
 var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_path21 = require("node:path");
 function resolveDataDir() {
   const candidates2 = [
-    (0, import_node_path22.join)(__dirname, "..", "data"),
+    (0, import_node_path21.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path22.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path21.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
     // THE COMMITTED SOURCE, for a source checkout that has not been built.
     // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
@@ -17829,14 +17381,14 @@ function resolveDataDir() {
     // without this the synthesizer throws "Could not find Verity skill data"
     // for every test and every `verity` run from source. Resolved from this
     // module's own location, never the cwd: see the warning below.
-    (0, import_node_path22.join)(__dirname, "..", "..", "client"),
+    (0, import_node_path21.join)(__dirname, "..", "..", "client"),
     // bundled: cli/bin/ → ../../client
-    (0, import_node_path22.join)(__dirname, "..", "..", "..", "client"),
+    (0, import_node_path21.join)(__dirname, "..", "..", "..", "client"),
     // tsx: cli/src/lib/ → ../../../client
     ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs24.existsSync)((0, import_node_path22.join)(candidate, "skills"))) {
+    if ((0, import_node_fs24.existsSync)((0, import_node_path21.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -17845,13 +17397,13 @@ function resolveDataDir() {
   );
 }
 function setupDataPath(file) {
-  return (0, import_node_path22.join)(resolveDataDir(), "skills", "verity-setup", file);
+  return (0, import_node_path21.join)(resolveDataDir(), "skills", "verity-setup", file);
 }
 
 // src/lib/detect.ts
 var import_node_child_process8 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_path22 = require("node:path");
 var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -17915,18 +17467,18 @@ function walk(root) {
     for (const entry of entries) {
       if (found.length >= WALK_MAX_FILES) return;
       if (IGNORED_SEGMENTS.includes(entry.name)) continue;
-      const full = (0, import_node_path23.join)(dir, entry.name);
+      const full = (0, import_node_path22.join)(dir, entry.name);
       if (entry.isDirectory()) visit(full, depth + 1);
-      else if (entry.isFile()) found.push((0, import_node_path23.relative)(root, full));
+      else if (entry.isFile()) found.push((0, import_node_path22.relative)(root, full));
     }
   };
   visit(root, 0);
   return found;
 }
 function languageOf(path) {
-  const name = (0, import_node_path23.basename)(path);
+  const name = (0, import_node_path22.basename)(path);
   if (/^Dockerfile(\..+)?$/i.test(name)) return "dockerfile";
-  if (!(0, import_node_path23.extname)(name)) return null;
+  if (!(0, import_node_path22.extname)(name)) return null;
   const lang = detectLanguage(path);
   return lang || null;
 }
@@ -18008,12 +17560,12 @@ function declaredDependencies(root, files) {
       if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
     }
   };
-  readPackageJson((0, import_node_path23.join)(root, "package.json"));
-  const nested = files.filter((f) => f.includes("/") && (0, import_node_path23.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
-  for (const rel of nested) readPackageJson((0, import_node_path23.join)(root, rel));
+  readPackageJson((0, import_node_path22.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path22.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path22.join)(root, rel));
   const pythonManifests = [
-    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path23.join)(root, f)),
-    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path23.join)(root, f))
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path22.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path22.join)(root, f))
   ];
   for (const path of pythonManifests) {
     if (!(0, import_node_fs25.existsSync)(path)) continue;
@@ -18028,8 +17580,8 @@ function declaredDependencies(root, files) {
     }
   }
   const goMods = [
-    (0, import_node_path23.join)(root, "go.mod"),
-    ...files.filter((f) => f.includes("/") && (0, import_node_path23.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path23.join)(root, f))
+    (0, import_node_path22.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path22.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path22.join)(root, f))
   ];
   for (const path of goMods) {
     if (!(0, import_node_fs25.existsSync)(path)) continue;
@@ -18042,7 +17594,7 @@ function declaredDependencies(root, files) {
     }
   }
   for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
-    const path = (0, import_node_path23.join)(root, file);
+    const path = (0, import_node_path22.join)(root, file);
     if (!(0, import_node_fs25.existsSync)(path)) continue;
     try {
       const text = (0, import_node_fs25.readFileSync)(path, "utf-8");
@@ -18053,7 +17605,7 @@ function declaredDependencies(root, files) {
   return names2;
 }
 function detectBuildSystem(root, files) {
-  const has = (f) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, f)) || files.some((p) => (0, import_node_path23.basename)(p) === f);
+  const has = (f) => (0, import_node_fs25.existsSync)((0, import_node_path22.join)(root, f)) || files.some((p) => (0, import_node_path22.basename)(p) === f);
   if (has("pnpm-lock.yaml")) return "pnpm";
   if (has("yarn.lock")) return "yarn";
   if (has("bun.lock") || has("bun.lockb")) return "bun";
@@ -18070,8 +17622,8 @@ function detectBuildSystem(root, files) {
 }
 function detectArchitecture(root, files) {
   const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
-  if (workspaceMarkers.some((m) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, m)))) return "monorepo";
-  const pkg = readJson((0, import_node_path23.join)(root, "package.json"));
+  if (workspaceMarkers.some((m) => (0, import_node_fs25.existsSync)((0, import_node_path22.join)(root, m)))) return "monorepo";
+  const pkg = readJson((0, import_node_path22.join)(root, "package.json"));
   if (pkg && "workspaces" in pkg) return "monorepo";
   const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
   const nested = manifests.filter((f) => f.includes("/"));
@@ -18093,7 +17645,7 @@ function measureAvgFileLength(root, files, languages) {
   let total = 0;
   let counted = 0;
   for (let i = 0; i < candidates2.length; i += stride) {
-    const path = (0, import_node_path23.join)(root, candidates2[i]);
+    const path = (0, import_node_path22.join)(root, candidates2[i]);
     try {
       if ((0, import_node_fs25.statSync)(path).size > 2 * 1024 * 1024) continue;
       total += (0, import_node_fs25.readFileSync)(path, "utf-8").split("\n").length;
@@ -18126,14 +17678,14 @@ function detectProject(root = repoRoot()) {
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
     for (const marker of markers) {
-      if ((0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, marker))) {
+      if ((0, import_node_fs25.existsSync)((0, import_node_path22.join)(root, marker))) {
         existingToolConfigs.push({ tool, path: `./${marker}` });
         break;
       }
     }
   }
   return {
-    projectName: (0, import_node_path23.basename)(root),
+    projectName: (0, import_node_path22.basename)(root),
     languages,
     languageCounts,
     frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
@@ -18577,10 +18129,10 @@ async function correctVerityMdVersion(opts) {
     origin: { kind: "synthesized", tools: opts.tools }
   }));
 }
-async function writeFileTo(relative2, body) {
-  const target = projectPath(relative2);
-  await (0, import_promises10.mkdir)((0, import_node_path24.dirname)(target), { recursive: true });
-  await (0, import_promises10.writeFile)(target, body);
+async function writeFileTo(relative3, body) {
+  const target = projectPath(relative3);
+  await (0, import_promises9.mkdir)((0, import_node_path23.dirname)(target), { recursive: true });
+  await (0, import_promises9.writeFile)(target, body);
 }
 async function deriveConfigForStandard(standard) {
   const spec = standard.knowledge_spec ?? {};
@@ -18637,14 +18189,14 @@ ${validation.detail}`);
 }
 
 // src/lib/setup-state.ts
-var import_promises11 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 var import_node_fs27 = require("node:fs");
 var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
 async function readSetupState() {
   const path = projectPath(SETUP_STATE_FILE);
   if (!(0, import_node_fs27.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse(await (0, import_promises11.readFile)(path, "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises10.readFile)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -18659,7 +18211,7 @@ async function writeSetupState(patch) {
 
 // src/lib/push-setup.ts
 var import_node_fs29 = require("node:fs");
-var import_promises12 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/verityignore.ts
@@ -18828,7 +18380,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   const standardPath = projectPath(STANDARD_FILE);
   if (pushStandard && (0, import_node_fs29.existsSync)(standardPath)) {
     try {
-      const content = (0, import_yaml2.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
+      const content = (0, import_yaml2.parse)(await (0, import_promises11.readFile)(standardPath, "utf-8"));
       const upload = buildStandardUpload(content, readVerityIgnoreRaw());
       if (upload.warning) lines.push(upload.warning);
       const result = await apiRequest({
@@ -18853,7 +18405,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   if (pushConfig && (0, import_node_fs29.existsSync)(configPath)) {
     try {
-      const content = JSON.parse(await (0, import_promises12.readFile)(configPath, "utf-8"));
+      const content = JSON.parse(await (0, import_promises11.readFile)(configPath, "utf-8"));
       const result = await apiRequest({
         method: "POST",
         path: "/analysis-configs",
@@ -18887,7 +18439,7 @@ function registerStandardCommands(program2) {
         printError(`No ${STANDARD_FILE} here \u2014 run "verity standard synthesize" to create one.`);
         process.exit(1);
       }
-      const content = (0, import_yaml3.parse)(await (0, import_promises13.readFile)(standardPath, "utf-8"));
+      const content = (0, import_yaml3.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
       const derived = await deriveConfigForStandard(content);
       for (const path of derived.written) printInfo(`  ${path} \u2713`);
       for (const note of derived.notes) printWarn(`  ${note}`);
@@ -18943,7 +18495,7 @@ function registerStandardCommands(program2) {
     }
     let yamlContent;
     try {
-      yamlContent = await (0, import_promises13.readFile)(opts.file, "utf-8");
+      yamlContent = await (0, import_promises12.readFile)(opts.file, "utf-8");
     } catch {
       printError(`Cannot read ${opts.file}`);
       process.exit(1);
@@ -19040,7 +18592,7 @@ function parseIntensity(value) {
 }
 
 // src/commands/config.ts
-var import_promises14 = require("node:fs/promises");
+var import_promises13 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
   config.command("service-url").description("Print the resolved service URL (used by the shipped skills)").action(async () => {
@@ -19086,7 +18638,7 @@ function registerConfigCommands(program2) {
     }
     let content;
     try {
-      const raw = await (0, import_promises14.readFile)(opts.file, "utf-8");
+      const raw = await (0, import_promises13.readFile)(opts.file, "utf-8");
       content = JSON.parse(raw);
     } catch {
       printError(`Cannot read or parse ${opts.file}`);
@@ -19895,10 +19447,6 @@ function rgInvocations(env = process.env) {
   out.push({ cmd: `${(0, import_node_os4.homedir)()}/.local/bin/claude`, argv0: "rg" });
   return out;
 }
-function ripgrepEnv(base = process.env) {
-  const { RIPGREP_CONFIG_PATH: _dropped, ...rest } = base;
-  return rest;
-}
 var MAX_SYMBOLS = 12;
 var MAX_SITES = 24;
 var MAX_SITES_PER_FILE = 3;
@@ -20438,9 +19986,6 @@ function buildRepoContext(input) {
     };
   }
   const args = [
-    // `--no-config` + RIPGREP_CONFIG_PATH scrubbed below: a config file can add
-    // `--pre=<command>`, which runs a program per searched file.
-    "--no-config",
     "-n",
     "-w",
     "-F",
@@ -20473,7 +20018,6 @@ function buildRepoContext(input) {
     res = (0, import_node_child_process10.spawnSync)(inv.cmd, args, {
       ...inv.argv0 ? { argv0: inv.argv0 } : {},
       cwd: input.cwd ?? process.cwd(),
-      env: ripgrepEnv(),
       timeout: input.timeoutMs ?? RG_TIMEOUT_MS,
       maxBuffer: 4 * 1024 * 1024,
       encoding: "utf8"
@@ -20712,85 +20256,11 @@ function installRunEvidence(run2) {
 }
 
 // src/lib/git-frame.ts
+var import_node_child_process11 = require("node:child_process");
 var import_node_fs33 = require("node:fs");
 var import_node_os5 = require("node:os");
+var import_node_path24 = require("node:path");
 var import_node_path25 = require("node:path");
-var import_node_path26 = require("node:path");
-
-// src/lib/hardened-git.ts
-var import_node_child_process11 = require("node:child_process");
-var HARDENED_CONFIG_ARGS = [
-  "-c",
-  "core.fsmonitor=false",
-  "-c",
-  "core.pager=cat",
-  "-c",
-  "log.showSignature=false"
-];
-var DIFF_READ_FLAGS = ["--no-ext-diff", "--no-textconv"];
-var DEFAULT_GIT_TIMEOUT_MS = 6e4;
-var DEFAULT_GIT_MAX_BUFFER = 64 * 1024 * 1024;
-function hardenedGitEnv(base = process.env) {
-  const env = {};
-  for (const [key, value] of Object.entries(base)) {
-    if (key.startsWith("GIT_")) continue;
-    env[key] = value;
-  }
-  env.GIT_OPTIONAL_LOCKS = "0";
-  env.GIT_TERMINAL_PROMPT = "0";
-  return env;
-}
-function hardenedGitArgv(args) {
-  return [...HARDENED_CONFIG_ARGS, ...args];
-}
-function classifyError(err) {
-  const e = err;
-  const stderr = typeof e?.stderr === "string" ? e.stderr : e?.stderr ? e.stderr.toString("utf-8") : "";
-  if (e?.code === "ETIMEDOUT" || e?.killed && e?.signal === "SIGTERM") return { ok: false, error: "timeout", stderr };
-  if (e?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") return { ok: false, error: "too_large", stderr };
-  return { ok: false, error: "failed", stderr };
-}
-function runGitSync(cwd, args, opts = {}) {
-  try {
-    const stdout = (0, import_node_child_process11.execFileSync)("git", hardenedGitArgv(args), {
-      cwd,
-      env: hardenedGitEnv(),
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
-      maxBuffer: opts.maxBuffer ?? DEFAULT_GIT_MAX_BUFFER
-    });
-    return { ok: true, stdout };
-  } catch (err) {
-    return classifyError(err);
-  }
-}
-function runGit(cwd, args, opts = {}) {
-  return new Promise((resolvePromise) => {
-    (0, import_node_child_process11.execFile)(
-      "git",
-      hardenedGitArgv(args),
-      {
-        cwd,
-        env: hardenedGitEnv(),
-        encoding: "utf-8",
-        timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
-        maxBuffer: opts.maxBuffer ?? DEFAULT_GIT_MAX_BUFFER
-      },
-      (err, stdout, stderr) => {
-        if (err) {
-          const e = err;
-          e.stderr = stderr;
-          resolvePromise(classifyError(e));
-          return;
-        }
-        resolvePromise({ ok: true, stdout });
-      }
-    );
-  });
-}
-
-// src/lib/git-frame.ts
 var VALUE_TOKEN = `(?:'[^']*'|"[^"]*"|\\S+)`;
 var GIT_GLOBAL_OPTS = `(?:\\s+(?:-[Cc]\\s+${VALUE_TOKEN}|--?[\\w-]+(?:=\\S+)?))*`;
 var COMMIT_HEAD = `git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`;
@@ -20800,41 +20270,7 @@ var COMMIT_RE = new RegExp(`(?:^|[\\s;&|(])${COMMIT_HEAD}|(?:^|[;&|(])\\s*[^\\s;
 var PUSH_RE = new RegExp(`(?:^|[\\s;&|(])${PUSH_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${PUSH_HEAD}`);
 var GH_PR_RE = new RegExp(`(?:^|[\\s;&|(])${GH_PR_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${GH_PR_HEAD}`);
 function splitSegments(command) {
-  return stripHeredocBodies(command ?? "").split(/&&|\|\||;|\n/);
-}
-var HEREDOC_OPERATOR = /(^|[^<])<<(-?)[ \t]*(?:'([^'\n]+)'|"([^"\n]+)"|\\?([A-Za-z_][A-Za-z0-9_]*))/g;
-var SHELL_CONSUMER = /(^|[\s;&|(])(bash|sh|zsh|dash|ksh|fish|ssh|eval|exec|sudo|su|xargs|env|nohup|time|docker|kubectl|podman)(\s|$)/;
-function stripHeredocBodies(command) {
-  const lines = command.split("\n");
-  const out = [];
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    out.push(line);
-    i++;
-    const words = [];
-    HEREDOC_OPERATOR.lastIndex = 0;
-    let m;
-    while ((m = HEREDOC_OPERATOR.exec(line)) !== null) {
-      words.push({ word: m[3] ?? m[4] ?? m[5], dash: m[2] === "-" });
-    }
-    if (words.length === 0 || SHELL_CONSUMER.test(line)) continue;
-    let cursor = i;
-    let end = -1;
-    for (const { word, dash } of words) {
-      let k = cursor;
-      while (k < lines.length && (dash ? lines[k].replace(/^\t+/, "") : lines[k]) !== word) k++;
-      if (k >= lines.length) {
-        end = -1;
-        break;
-      }
-      end = k;
-      cursor = k + 1;
-    }
-    if (end === -1) continue;
-    i = end + 1;
-  }
-  return out.join("\n");
+  return (command ?? "").split(/&&|\|\||;|\n/);
 }
 function findMomentSegment(command, on) {
   const segments = splitSegments(command);
@@ -20877,8 +20313,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path26.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path25.isAbsolute)(expanded) ? expanded : (0, import_node_path25.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path25.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path24.isAbsolute)(expanded) ? expanded : (0, import_node_path24.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -20896,8 +20332,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path26.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path25.isAbsolute)(expanded) ? expanded : (0, import_node_path25.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path25.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path24.isAbsolute)(expanded) ? expanded : (0, import_node_path24.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -20952,14 +20388,17 @@ function parsePushTarget(segment) {
   return { remote, srcRef: src, dstRef: dst || null, isDelete };
 }
 function gitAt(dir, args) {
-  const res = runGitSync(dir, args);
-  return res.ok ? res.stdout.trim() : "";
+  try {
+    return (0, import_node_child_process11.execFileSync)("git", args, { cwd: dir, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
 }
 function realpathOr2(p) {
   try {
     return import_node_fs33.realpathSync.native(p);
   } catch {
-    return (0, import_node_path25.resolve)(p);
+    return (0, import_node_path24.resolve)(p);
   }
 }
 function resolveFrame(input) {
@@ -20998,7 +20437,7 @@ function resolveFrame(input) {
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
   const gitDir = gitDirRaw ? realpathOr2(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr2((0, import_node_path25.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path25.resolve)(dir, commonRaw)) : null;
+  const commonDir = commonRaw ? realpathOr2((0, import_node_path24.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path24.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
@@ -21173,7 +20612,7 @@ function stagedRange(frame, command) {
   if (plan.kind === "unpredictable") {
     return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
   }
-  const mergeHead = frame.gitDir ? (0, import_node_path26.join)(frame.gitDir, "MERGE_HEAD") : null;
+  const mergeHead = frame.gitDir ? (0, import_node_path25.join)(frame.gitDir, "MERGE_HEAD") : null;
   if (mergeHead && (0, import_node_fs33.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
@@ -21226,7 +20665,7 @@ function rangeChangeSignals(frame, range, paths) {
   const out = /* @__PURE__ */ new Map();
   if (range.kind === "nothing" || paths.length === 0) return out;
   if (range.kind === "push" && !range.base) return out;
-  const args = range.kind === "staged" || range.kind === "merge" ? ["diff", ...DIFF_READ_FLAGS, "--cached", "--unified=0"] : ["diff", ...DIFF_READ_FLAGS, "--unified=0", range.base, range.head === "INDEX" ? "HEAD" : range.head];
+  const args = range.kind === "staged" || range.kind === "merge" ? ["diff", "--cached", "--unified=0"] : ["diff", "--unified=0", range.base, range.head === "INDEX" ? "HEAD" : range.head];
   const diff = frameGit(frame, [...args, "--", ...paths]);
   let current = null;
   let oldSide = null;
@@ -21589,7 +21028,7 @@ function sanitizeCommandWithLoss(rawCmd) {
   const lost = lines.slice(1).some((l) => l.trim().length > 0);
   const first = lines[0];
   const cmd = sanitizeCommand(first);
-  const hadSeparator = SEPARATORS.some((sep4) => first.indexOf(sep4) > 0);
+  const hadSeparator = SEPARATORS.some((sep3) => first.indexOf(sep3) > 0);
   return { cmd, lost: lost || !hadSeparator && first.length > MAX_COMMAND_CHARS };
 }
 var SEPARATORS = [" | ", " > ", " >> ", " 2>", " && ", " ; "];
@@ -21598,11 +21037,11 @@ function sanitizeCommand(rawCmd) {
   let cmd = rawCmd.split("\n")[0];
   let cut = -1;
   let marker = "";
-  for (const sep4 of SEPARATORS) {
-    const idx = cmd.indexOf(sep4);
+  for (const sep3 of SEPARATORS) {
+    const idx = cmd.indexOf(sep3);
     if (idx > 0 && (cut === -1 || idx < cut)) {
       cut = idx;
-      marker = sep4.trim();
+      marker = sep3.trim();
     }
   }
   if (cut > -1) cmd = cmd.slice(0, cut);
@@ -21626,28 +21065,28 @@ async function readStopHookStdin() {
   try {
     if (process.stdin.isTTY) return empty;
     const chunks = [];
-    const timeout = new Promise((resolve6) => setTimeout(() => resolve6(empty), 500));
-    const read = new Promise((resolve6) => {
+    const timeout = new Promise((resolve5) => setTimeout(() => resolve5(empty), 500));
+    const read = new Promise((resolve5) => {
       process.stdin.on("data", (chunk) => chunks.push(chunk));
       process.stdin.on("end", () => {
         const raw = Buffer.concat(chunks).toString("utf-8").trim();
         if (!raw) {
-          resolve6(empty);
+          resolve5(empty);
           return;
         }
         try {
           const data = JSON.parse(raw);
-          resolve6({
+          resolve5({
             assistantMessage: typeof data.last_assistant_message === "string" ? data.last_assistant_message : null,
             stopReason: typeof data.stop_reason === "string" ? data.stop_reason : null,
             transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : null,
             sessionId: typeof data.session_id === "string" ? data.session_id : null
           });
         } catch {
-          resolve6(empty);
+          resolve5(empty);
         }
       });
-      process.stdin.on("error", () => resolve6(empty));
+      process.stdin.on("error", () => resolve5(empty));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -21851,7 +21290,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.6-experimental.df0a578" : "dev";
+    return true ? "0.32.7" : "dev";
   } catch {
     return "dev";
   }
@@ -21903,12 +21342,10 @@ var SEVERITY_ORDER = {
   Low: 3
 };
 function isCodacyAvailable() {
-  try {
-    (0, import_node_child_process12.execSync)("which codacy-analysis", { stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
-  }
+  return codacyAnalysisPath() !== null;
+}
+function codacyAnalysisPath() {
+  return whichSync("codacy-analysis");
 }
 function buildAnalyzerArgv(files) {
   return [
@@ -21935,6 +21372,16 @@ function withFailure(kind, detail) {
     summary: { ...EMPTY_RESULT.summary, failure: { kind, detail: detail.slice(0, 300) } }
   };
 }
+function runCodacyAnalysisIfAvailable(files) {
+  if (files.length === 0) return EMPTY_RESULT;
+  if (!isCodacyAvailable()) {
+    return withFailure(
+      "analyzer_unavailable",
+      "@codacy/analysis-cli was not found on PATH \u2014 no static analysis ran"
+    );
+  }
+  return runCodacyAnalysis(files);
+}
 function runCodacyAnalysis(files) {
   const empty = EMPTY_RESULT;
   if (files.length === 0) return empty;
@@ -21946,7 +21393,8 @@ function runCodacyAnalysis(files) {
     }
   });
   if (existingFiles.length === 0) return empty;
-  const proc = (0, import_node_child_process12.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
+  const analyzer = codacyAnalysisPath() ?? "codacy-analysis";
+  const proc = (0, import_node_child_process12.spawnSync)(analyzer, buildAnalyzerArgv(existingFiles), {
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -22114,11 +21562,10 @@ var EMPTY_STATIC = {
   summary: { total_findings: 0, by_severity: {}, tools_run: [] }
 };
 function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
-  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
+  if (skipStatic) return EMPTY_STATIC;
   let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
   if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
-  if (scannable.length === 0) return EMPTY_STATIC;
-  return runCodacyAnalysis(scannable);
+  return runCodacyAnalysisIfAvailable(scannable);
 }
 function localOnlyAndExit(staticResults) {
   printJsonCompact({
@@ -22210,7 +21657,7 @@ async function scope(run2) {
 
 // src/lib/specs.ts
 var import_node_fs36 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_path26 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -22229,6 +21676,16 @@ var SPEC_CANDIDATES = [
 var DOC_EXT = /\.(md|mdx|ya?ml|txt|rst|adoc)$/i;
 var UNCONSULTED_FILE_BYTES = 10240;
 var UNCONSULTED_TOTAL_BYTES = 30720;
+function readSpecFiles(specsOpt, root) {
+  const out = [];
+  for (const raw of specsOpt.split(",").map((f) => f.trim()).filter(Boolean)) {
+    const candidate = (0, import_node_path26.isAbsolute)(raw) ? (0, import_node_path26.relative)(root, raw) : raw;
+    const content = readFileInside(root, candidate, MAX_EXPLICIT_SPEC_FILE_BYTES);
+    if (content === null) continue;
+    out.push({ path: raw, content });
+  }
+  return out;
+}
 function discoverSpecs(consulted = []) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
@@ -22246,13 +21703,15 @@ function discoverSpecs(consulted = []) {
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
     const readBytes = Math.min(fileCap, remaining);
-    const opened = openRegularInRoot(process.cwd(), specPath);
-    if (!opened.ok) return true;
     try {
-      const bytes = readOpened(opened.fd, Math.min(opened.size, readBytes));
-      if (bytes.length === 0) return true;
-      result.push({ path: specPath, content: bytes.toString("utf-8") });
-      totalBytes += bytes.length;
+      const buf = Buffer.alloc(readBytes);
+      const fd = (0, import_node_fs36.openSync)(specPath, "r");
+      const bytesRead = (0, import_node_fs36.readSync)(fd, buf, 0, readBytes, 0);
+      (0, import_node_fs36.closeSync)(fd);
+      const content = buf.slice(0, bytesRead).toString("utf-8");
+      if (!content) return true;
+      result.push({ path: specPath, content });
+      totalBytes += content.length;
     } catch {
     }
     return true;
@@ -22281,7 +21740,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   try {
     const entries = (0, import_node_fs36.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path27.join)(dir, entry.name);
+      const fullPath = (0, import_node_path26.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -22293,51 +21752,37 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const home = process.env.HOME ?? "";
-  const homePlansDir = (0, import_node_path27.join)(home, ".claude", "plans");
-  const sources = [];
-  if (isRealDirectoryChain(process.cwd(), [".claude", "plans"])) {
-    sources.push({ root: process.cwd(), prefix: (0, import_node_path27.join)(".claude", "plans") });
-  }
-  if (home && (0, import_node_fs36.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
+  const homePlansDir = (0, import_node_path26.join)(process.env.HOME ?? "", ".claude", "plans");
+  const localPlansDir = ".claude/plans";
   const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const source of sources) {
-    let names2;
+  for (const plansDir of [localPlansDir, homePlansDir]) {
+    if (!(0, import_node_fs36.existsSync)(plansDir)) continue;
     try {
-      names2 = (0, import_node_fs36.readdirSync)(source.prefix ? (0, import_node_path27.join)(source.root, source.prefix) : source.root);
+      for (const f of (0, import_node_fs36.readdirSync)(plansDir)) {
+        if (!f.endsWith(".md") || seen.has(f)) continue;
+        seen.add(f);
+        const fullPath = (0, import_node_path26.join)(plansDir, f);
+        try {
+          const stat3 = (0, import_node_fs36.statSync)(fullPath);
+          candidates2.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
+        } catch {
+        }
+      }
     } catch {
-      continue;
-    }
-    for (const f of names2) {
-      if (!f.endsWith(".md") || seen.has(f)) continue;
-      seen.add(f);
-      const relPath = source.prefix ? (0, import_node_path27.join)(source.prefix, f) : f;
-      const stat3 = statRegularInRoot(source.root, relPath);
-      if (!stat3.ok) continue;
-      candidates2.push({ name: f, root: source.root, relPath, mtime: stat3.mtimeMs, size: stat3.size });
     }
   }
   candidates2.sort((a, b) => b.mtime - a.mtime);
   const result = [];
   for (const entry of candidates2.slice(0, MAX_PLAN_FILES)) {
     if (entry.size > MAX_PLAN_FILE_BYTES) continue;
-    const read = readRegularFileInRoot(entry.root, entry.relPath, MAX_PLAN_FILE_BYTES);
-    if (read.ok) result.push({ name: entry.name, content: read.content });
-  }
-  return result;
-}
-function isRealDirectoryChain(root, parts) {
-  let current = root;
-  for (const part of parts) {
-    current = (0, import_node_path27.join)(current, part);
     try {
-      if (!(0, import_node_fs36.lstatSync)(current).isDirectory()) return false;
+      const content = (0, import_node_fs36.readFileSync)(entry.path, "utf-8");
+      result.push({ name: entry.name, content });
     } catch {
-      return false;
     }
   }
-  return true;
+  return result;
 }
 var GUARD_DOC_EXT = /\.(md|mdx|txt|rst|adoc)$/i;
 function discoverGuardDocs(rangeFiles2) {
@@ -22348,21 +21793,16 @@ function discoverGuardDocs(rangeFiles2) {
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
     if (!(0, import_node_fs36.existsSync)(path)) continue;
-    const opened = openRegularInRoot(process.cwd(), path);
-    if (!opened.ok) continue;
-    if (opened.size > MAX_PLAN_FILE_BYTES || totalBytes + opened.size > MAX_TOTAL_SPEC_BYTES) {
-      closeOpened(opened.fd);
-      continue;
-    }
-    let bytes;
     try {
-      bytes = readOpened(opened.fd, opened.size);
+      const stat3 = (0, import_node_fs36.statSync)(path);
+      if (stat3.size > MAX_PLAN_FILE_BYTES) continue;
+      if (totalBytes + stat3.size > MAX_TOTAL_SPEC_BYTES) continue;
+      const content = (0, import_node_fs36.readFileSync)(path, "utf-8");
+      if (!content) continue;
+      result.push({ name: path, content });
+      totalBytes += content.length;
     } catch {
-      continue;
     }
-    if (bytes.length === 0) continue;
-    result.push({ name: path, content: bytes.toString("utf-8") });
-    totalBytes += bytes.length;
   }
   return result;
 }
@@ -22534,7 +21974,7 @@ async function mode(run2) {
 
 // src/lib/fold.ts
 var import_node_fs37 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_path27 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -22766,9 +22206,9 @@ function fold(transcriptPath, opts = {}) {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path28.join)(
-      (0, import_node_path28.dirname)(transcriptPath),
-      (0, import_node_path28.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path27.join)(
+      (0, import_node_path27.dirname)(transcriptPath),
+      (0, import_node_path27.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
     if ((0, import_node_fs37.existsSync)(sidecarDir)) {
@@ -22778,7 +22218,7 @@ function fold(transcriptPath, opts = {}) {
       const walk2 = (d, depth) => {
         if (depth > 4) return;
         for (const e of (0, import_node_fs37.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path28.join)(d, e.name);
+          const p = (0, import_node_path27.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
@@ -23102,14 +22542,12 @@ async function evidence(run2) {
           authorshipWasObservable
         });
         const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
-        if (!opts.skipStatic && isCodacyAvailable()) {
+        if (!opts.skipStatic) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
           if (baseline) {
             allScannable = allScannable.filter((f) => changedSinceBaseline(f, baseline));
           }
-          if (allScannable.length > 0) {
-            staticResults = runCodacyAnalysis(allScannable);
-          }
+          staticResults = runCodacyAnalysisIfAvailable(allScannable);
         }
         const deltaSet = baseline ? recentForReview.filter((f) => changedSinceBaseline(f, baseline)) : recentForReview;
         codeDelta = collectCodeDelta(deltaSet, {
@@ -23153,7 +22591,7 @@ async function evidence(run2) {
 
 // src/lib/cache-cleanup.ts
 var import_node_fs38 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_path28 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
@@ -23161,7 +22599,7 @@ function pruneStaleCache() {
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
     for (const entry of (0, import_node_fs38.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path29.join)(dir, entry);
+      const path = (0, import_node_path28.join)(dir, entry);
       try {
         const stat3 = (0, import_node_fs38.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
@@ -23327,9 +22765,9 @@ async function repoContext(run2) {
 }
 
 // src/lib/seed-runner.ts
-var import_promises15 = require("node:fs/promises");
+var import_promises14 = require("node:fs/promises");
 var import_node_fs40 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_path29 = require("node:path");
 var import_yaml4 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -23405,7 +22843,7 @@ function classifyClaudeSection(heading) {
   if (hasAny(["integration", "webhook", "third-party", "third party", "provider"])) return "integration";
   return "domain";
 }
-function slugify2(s) {
+function slugify(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
 }
 var FRAMEWORK_GLOBS = [
@@ -23502,7 +22940,7 @@ _Extracted from README on setup. Update when project direction changes._`,
   for (const fwRaw of frameworks) {
     const fw = fwRaw.trim();
     if (!fw) continue;
-    const slug = slugify2(fw);
+    const slug = slugify(fw);
     if (!slug || seenFrameworkSlugs.has(slug)) continue;
     seenFrameworkSlugs.add(slug);
     out.push({
@@ -23573,7 +23011,7 @@ async function runSeed(opts) {
   }
   let standardDoc;
   try {
-    const raw = await (0, import_promises15.readFile)(STANDARD_FILE, "utf-8");
+    const raw = await (0, import_promises14.readFile)(STANDARD_FILE, "utf-8");
     standardDoc = (0, import_yaml4.parse)(raw);
   } catch {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
@@ -23582,7 +23020,7 @@ async function runSeed(opts) {
   let readmeContent;
   if ((0, import_node_fs40.existsSync)("README.md")) {
     try {
-      readmeContent = await (0, import_promises15.readFile)("README.md", "utf-8");
+      readmeContent = await (0, import_promises14.readFile)("README.md", "utf-8");
     } catch {
     }
   }
@@ -23590,7 +23028,7 @@ async function runSeed(opts) {
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
     if ((0, import_node_fs40.existsSync)(p)) {
       try {
-        claudeMdContent = await (0, import_promises15.readFile)(p, "utf-8");
+        claudeMdContent = await (0, import_promises14.readFile)(p, "utf-8");
         break;
       } catch {
       }
@@ -23611,7 +23049,7 @@ async function runSeed(opts) {
   if (candidates2.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path30.join)(MEMORY_DIR, "domain", "project-overview.md");
+  const overviewPath = (0, import_node_path29.join)(MEMORY_DIR, "domain", "project-overview.md");
   if ((0, import_node_fs40.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
   }
@@ -23654,8 +23092,8 @@ async function runSeed(opts) {
       continue;
     }
     try {
-      await (0, import_promises15.mkdir)((0, import_node_path30.dirname)(targetPath), { recursive: true });
-      await (0, import_promises15.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
+      await (0, import_promises14.mkdir)((0, import_node_path29.dirname)(targetPath), { recursive: true });
+      await (0, import_promises14.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
     } catch (err) {
@@ -23668,7 +23106,7 @@ async function runSeed(opts) {
 
 // src/commands/analyze/phases/08-memory-manifest.ts
 var import_node_fs41 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_path30 = require("node:path");
 async function memoryManifest(run2) {
   const { globals } = run2;
   const { serviceUrl, token } = run2;
@@ -23678,7 +23116,7 @@ async function memoryManifest(run2) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path31.join)(VERITY_DIR, ".seeded");
+    const seedMarker = (0, import_node_path30.join)(VERITY_DIR, ".seeded");
     const hasStandard = (0, import_node_fs41.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs41.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
@@ -23796,7 +23234,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path32 = require("node:path");
+var import_node_path31 = require("node:path");
 async function workingMemory(run2) {
   const { opts } = run2;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run2;
@@ -23808,7 +23246,7 @@ async function workingMemory(run2) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path32.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path31.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -23945,6 +23383,15 @@ function parseAutonomousEnv(raw) {
   if (v === "0" || v === "false" || v === "off" || v === "no") return false;
   return true;
 }
+function resolveRunMode(inputs = {}) {
+  if (inputs.autonomousFlag === true) return "autonomous";
+  if (inputs.autonomousFlag === false) return "interactive";
+  const env = inputs.env ?? process.env;
+  const envDecision = parseAutonomousEnv(env.VERITY_AUTONOMOUS);
+  if (envDecision !== void 0) return envDecision ? "autonomous" : "interactive";
+  const isTTY = inputs.isTTY ?? Boolean(process.stdin?.isTTY);
+  return isTTY ? "interactive" : "autonomous";
+}
 function isExplicitlyAutonomous(env = process.env) {
   return parseAutonomousEnv(env.VERITY_AUTONOMOUS) === true || parseAutonomousEnv(env.CI) === true || parseAutonomousEnv(env.GITHUB_ACTIONS) === true;
 }
@@ -24364,7 +23811,7 @@ async function transmit(run2) {
 
 // src/commands/analyze/phases/13-reconcile.ts
 var import_node_fs44 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_path32 = require("node:path");
 async function reconcile(run2) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run2;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -24393,7 +23840,7 @@ async function reconcile(run2) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs44.readFileSync)((0, import_node_path33.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs44.readFileSync)((0, import_node_path32.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -24656,146 +24103,6 @@ function describeRelease(release, input) {
   }
 }
 
-// src/lib/memory-pull.ts
-var import_node_child_process14 = require("node:child_process");
-var import_promises16 = require("node:fs/promises");
-var pullStateFile = () => projectPath(`${VERITY_DIR}/.memory-pull-state.json`);
-var PAGE_SIZE = 200;
-var MAX_PAGES = 500;
-var memoryIsTracked = () => committedMemoryFiles().length > 0;
-async function pullRepoMemory(opts) {
-  if (memoryIsTracked()) return { ok: true, status: "tracked", received: 0, written: 0 };
-  const state = await readPullState();
-  const known = opts.force ? null : state.version;
-  let treePaths;
-  try {
-    treePaths = listTrackedFiles();
-  } catch {
-    treePaths = void 0;
-  }
-  const served = /* @__PURE__ */ new Map();
-  let received = 0;
-  let written = 0;
-  let version = null;
-  let cursor = null;
-  let pages = 0;
-  const remember = (complete) => writePullState({
-    version: complete ? version : null,
-    // A complete pull saw every file the server holds, so its ledger replaces the
-    // old one (a path that stopped arriving was archived). A partial one only adds.
-    served: complete ? served : new Map([...state.served, ...served])
-  });
-  do {
-    const params = new URLSearchParams({ limit: String(PAGE_SIZE) });
-    if (cursor) params.set("cursor", cursor);
-    else if (known) params.set("if_version", known);
-    const res = await apiRequest({
-      method: "GET",
-      path: `/memory/files?${params.toString()}`,
-      serviceUrl: opts.serviceUrl,
-      token: opts.token,
-      verbose: opts.verbose,
-      timeout: opts.timeoutMs ?? 3e4,
-      cmd: "memory-pull"
-    });
-    if (!res.ok) {
-      if (pages > 0) await remember(false);
-      return { ok: false, error: res.error, category: res.category };
-    }
-    const page = res.data;
-    if (page.unchanged) return { ok: true, status: "unchanged", received: 0, written: 0 };
-    if (pages === 0) version = page.version;
-    else if (page.version !== version) version = null;
-    const files = (page.files ?? []).map((f) => ({
-      path: f.path,
-      content: f.content,
-      node_id: f.node_id,
-      op: "create"
-    }));
-    received += files.length;
-    try {
-      written += await applyMemoryWrites(files, {
-        treePaths,
-        baseline: "written",
-        lastServed: state.served,
-        served,
-        claudeMdPointer: false
-      });
-    } catch (err) {
-      await remember(false);
-      throw err;
-    }
-    cursor = page.next_cursor;
-    pages++;
-  } while (cursor && pages < MAX_PAGES);
-  await remember(!cursor);
-  return { ok: true, status: "pulled", received, written };
-}
-async function readServedLedger() {
-  return (await readPullState()).served;
-}
-async function recordServedFiles(served) {
-  if (served.size === 0) return;
-  const state = await readPullState();
-  for (const [path, hash] of served) state.served.set(path, hash);
-  await writePullState(state);
-}
-async function readPullState() {
-  try {
-    const parsed = JSON.parse(await (0, import_promises16.readFile)(pullStateFile(), "utf-8"));
-    const served = /* @__PURE__ */ new Map();
-    if (parsed?.served && typeof parsed.served === "object") {
-      for (const [path, hash] of Object.entries(parsed.served)) {
-        if (typeof hash === "string") served.set(path, hash);
-      }
-    }
-    return { version: typeof parsed?.version === "string" ? parsed.version : null, served };
-  } catch {
-    return { version: null, served: /* @__PURE__ */ new Map() };
-  }
-}
-async function writePullState(state) {
-  try {
-    await (0, import_promises16.mkdir)(projectPath(VERITY_DIR), { recursive: true });
-    await (0, import_promises16.writeFile)(pullStateFile(), JSON.stringify({
-      ...state.version ? { version: state.version } : {},
-      pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
-      served: Object.fromEntries(state.served)
-    }) + "\n");
-  } catch {
-  }
-}
-function pullsAtSessionStart(auth2, source) {
-  if (source === "compact") return false;
-  if (auth2.source === "env" || auth2.source === "flag") return true;
-  return auth2.userId != null;
-}
-function spawnBackgroundPull(deps = {}) {
-  const d = {
-    spawn: import_node_child_process14.spawn,
-    execPath: process.execPath,
-    script: process.argv[1],
-    cwd: process.cwd(),
-    env: process.env,
-    ...deps
-  };
-  if (d.env.VERITY_NO_BACKGROUND_PULL === "1" || !d.script) return false;
-  try {
-    const child = d.spawn(d.execPath, [d.script, "memory", "pull", "--quiet"], {
-      cwd: d.cwd,
-      env: d.env,
-      detached: true,
-      stdio: "ignore"
-    });
-    child.on("error", () => {
-    });
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // src/lib/remediation-guard.ts
 var TOOL_CONFIG_PATTERNS = [
   /(^|\/)\.codacy\//,
@@ -24894,9 +24201,7 @@ async function render(run2) {
   if (memoryWritesRaw && memoryWritesRaw.length > 0) {
     try {
       const treePaths = listTrackedFiles();
-      const served = /* @__PURE__ */ new Map();
-      await applyMemoryWrites(memoryWritesRaw, { treePaths, lastServed: await readServedLedger(), served });
-      await recordServedFiles(served);
+      await applyMemoryWrites(memoryWritesRaw, { treePaths });
     } catch (err) {
       process.stderr.write(`verity: memory sync write failed: ${err.message}
 `);
@@ -25225,7 +24530,7 @@ var import_node_fs47 = require("node:fs");
 
 // src/lib/project-skills.ts
 var import_node_fs46 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_path33 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -25251,13 +24556,13 @@ var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
   if (!(0, import_node_fs46.existsSync)(root)) return [];
-  return ALL.filter((name) => (0, import_node_fs46.existsSync)((0, import_node_path34.join)(root, name)));
+  return ALL.filter((name) => (0, import_node_fs46.existsSync)((0, import_node_path33.join)(root, name)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name of staleProjectSkills()) {
-    (0, import_node_fs46.rmSync)((0, import_node_path34.join)(root, name), { recursive: true, force: true });
+    (0, import_node_fs46.rmSync)((0, import_node_path33.join)(root, name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -25383,7 +24688,6 @@ function registerBaselineCommands(program2) {
       }
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
-      if (authForScope.ok && pullsAtSessionStart(authForScope.data, source)) spawnBackgroundPull();
       const scopeSession = session;
       const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source });
       logEvent("baseline_capture", {
@@ -25446,45 +24750,22 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  let staticResults;
-  if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs48.existsSync)(f) || resolveFile(f) !== null);
-    staticResults = runCodacyAnalysis(scannable);
-  } else {
-    staticResults = {
-      tool: "@codacy/analysis-cli",
-      findings: [],
-      summary: { total_findings: 0, by_severity: {}, tools_run: [] }
-    };
-  }
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs48.existsSync)(f) || resolveFile(f) !== null);
+  const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) {
+    const staticFailure = staticResults.summary.failure;
     printJsonCompact({
-      gate_decision: "PASS",
-      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      gate_decision: "WARN",
+      systemMessage: staticFailure ? `Verity: not authenticated, and local static analysis did not run (${staticFailure.kind}) \u2014 nothing was examined. Run \`verity init\` to authenticate and unlock the full review.` : "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
       unauthenticated: true,
       static_results: staticResults
     });
     process.exit(0);
   }
-  let specs;
-  if (opts.specs) {
-    const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
-    specs = [];
-    for (const p of specPaths) {
-      if (!(0, import_node_fs48.existsSync)(p)) continue;
-      try {
-        const { readFileSync: readFileSync26 } = await import("node:fs");
-        const content = readFileSync26(p, "utf-8");
-        specs.push({ path: p, content: content.slice(0, 10240) });
-      } catch {
-      }
-    }
-  } else {
-    specs = discoverSpecs();
-  }
+  const specs = opts.specs ? readSpecFiles(opts.specs, repoRoot()) : discoverSpecs();
   const plans = discoverPlans();
   const requestBody = {
     static_results: staticResults,
@@ -25517,9 +24798,10 @@ async function runReview(opts, globals) {
   });
   if (!result.ok) {
     printError(`Service error: ${result.error}`);
+    const staticFailure = staticResults.summary.failure;
     printJsonCompact({
-      gate_decision: "PASS",
-      systemMessage: "Verity: Service unavailable \u2014 showing static results only",
+      gate_decision: "WARN",
+      systemMessage: staticFailure ? `Verity: service unavailable, and local static analysis did not run (${staticFailure.kind}) \u2014 nothing was examined` : "Verity: service unavailable \u2014 showing local static results only",
       offline: true,
       static_results: staticResults
     });
@@ -25535,387 +24817,14 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs49 = require("node:fs");
-var import_node_path35 = require("node:path");
-
-// src/lib/terminal-text.ts
-var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
-function terminalText(value, max = 4e3) {
-  if (typeof value !== "string") return "";
-  const clean2 = value.replace(CONTROL, "");
-  return clean2.length > max ? `${clean2.slice(0, max - 1)}\u2026` : clean2;
-}
-function terminalUrl(value) {
-  const clean2 = terminalText(value, 2e3);
-  return /^https?:\/\/\S+$/.test(clean2) ? clean2 : "";
-}
-
-// src/lib/agent-driver.ts
-var AGENT_DEADLINE_MS = {
-  "pre-commit": 9e4,
-  "pre-push": 18e4
-};
-var MIN_AGENT_START_MS = 25e3;
-var MIN_TURN_MS = 12e3;
-var FINISH_TIMEOUT_MS = 15e3;
-var CANCEL_TIMEOUT_MS = 3e3;
-var MAX_TURNS = 16;
-var ONE_SHOT_FINDING_FIELDS = ["severity", "category", "file", "line", "title", "description", "scope", "pattern_id"];
-function summarizeFindings(response) {
-  const findings = Array.isArray(response.findings) ? response.findings : [];
-  return findings.slice(0, 40).map((f) => {
-    const out = {};
-    const finding = f ?? {};
-    for (const key of ONE_SHOT_FINDING_FIELDS) if (finding[key] !== void 0) out[key] = finding[key];
-    return out;
-  });
-}
-function finishOneShot(settled) {
-  if (!settled) return { status: "pending" };
-  if (!settled.ok) return { status: "failed" };
-  const r = settled.response;
-  return {
-    status: "arrived",
-    ...typeof r.agent_attestation === "string" ? { attestation: r.agent_attestation } : {},
-    ...typeof r.run_id === "string" ? { run_id: r.run_id } : {},
-    ...typeof r.gate_decision === "string" ? { gate_decision: r.gate_decision } : {}
-  };
-}
-async function runAgentReview(options) {
-  const now = options.now ?? Date.now;
-  const remaining = () => options.deadlineMs - (now() - options.startedAt);
-  let settled = null;
-  const oneShotDone = options.oneShot.then(
-    (outcome) => {
-      settled = outcome;
-    },
-    () => {
-      settled = { ok: false };
-    }
-  );
-  if (remaining() < MIN_AGENT_START_MS) return { kind: "skipped", reason: "not enough time left after prep" };
-  const started = await options.http.post(
-    "/agent-review/start",
-    { ...options.start, remaining_ms: remaining() },
-    Math.max(1, remaining())
-  );
-  if (!started.ok) return { kind: "failed", reason: `start: ${started.error}` };
-  if (!started.data.enabled) return { kind: "disabled", reason: started.data.reason };
-  let state = started.data.state;
-  let calls = started.data.calls ?? [];
-  let done = started.data.done;
-  let sentOneShot = "pending";
-  const cancel = async () => {
-    await options.http.post("/agent-review/cancel", { state }, CANCEL_TIMEOUT_MS);
-  };
-  for (let turn = 0; !done; turn++) {
-    if (turn >= MAX_TURNS || remaining() < MIN_TURN_MS) break;
-    const results = await options.executeTools(calls);
-    let oneShot;
-    const current = settled;
-    if (current && sentOneShot === "pending") {
-      oneShot = current.ok ? { status: "arrived", findings: summarizeFindings(current.response) } : { status: "failed" };
-      sentOneShot = oneShot.status;
-    }
-    const turnRequest = { state, remaining_ms: remaining(), results, ...oneShot ? { one_shot: oneShot } : {} };
-    const next = await options.http.post("/agent-review/turn", turnRequest, Math.max(1, remaining()));
-    if (!next.ok) {
-      await cancel();
-      return { kind: "failed", reason: `turn: ${next.error}` };
-    }
-    state = next.data.state;
-    calls = next.data.calls ?? [];
-    done = next.data.done;
-  }
-  if (!settled) {
-    const wait = Math.max(0, remaining() - FINISH_TIMEOUT_MS);
-    await Promise.race([oneShotDone, new Promise((resolve6) => setTimeout(resolve6, wait))]);
-  }
-  const finished = await options.http.post(
-    "/agent-review/finish",
-    { state, session_id: options.sessionId, one_shot: finishOneShot(settled) },
-    FINISH_TIMEOUT_MS
-  );
-  if (!finished.ok) {
-    await cancel();
-    return { kind: "failed", reason: `finish: ${finished.error}` };
-  }
-  return { kind: "finished", response: finished.data };
-}
-
-// src/lib/agent-tools.ts
-var TOOL_LIMITS = {
-  outputChars: 16e3,
-  readLines: 400,
-  blameLines: 200,
-  searchHits: 50,
-  searchLineChars: 300,
-  listEntries: 200,
-  logCommits: 8,
-  textChars: 200,
-  pathChars: 400,
-  fileBytes: 4 * 1024 * 1024,
-  gitTimeoutMs: 2e3,
-  diffTimeoutMs: 1e4,
-  concurrency: 4
-};
-var DENIED_PATHS = [
-  /(^|\/)\.env(\.[^/]*)?$/i,
-  /\.(pem|key|p12|pfx|jks|keystore|asc|gpg|kdbx)$/i,
-  /(^|\/)id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i,
-  /(^|\/)\.(npmrc|netrc|pypirc|pgpass|git-credentials)$/i,
-  /(^|\/)(credentials|secrets?)(\.[^/]*)?$/i,
-  /(^|\/)\.(ssh|aws|gnupg|docker)(\/|$)/i,
-  /(^|\/)\.git(\/|$)/
-];
-function isDeniedPath(path) {
-  return DENIED_PATHS.some((pattern) => pattern.test(path)) || isVerityOwnedPath(path);
-}
-function validateRepoPath(value, { allowRoot = false } = {}) {
-  if (typeof value !== "string") return { ok: false, error: "path must be a string" };
-  let path = value.replace(/\\/g, "/").replace(/^\.\/+/, "");
-  if (allowRoot && (path === "" || path === ".")) return { ok: true, value: "" };
-  path = path.replace(/\/+$/, "");
-  if (!path || path.length > TOOL_LIMITS.pathChars) return { ok: false, error: "path is empty or too long" };
-  if (/[-]/.test(path)) return { ok: false, error: "path contains control characters" };
-  if (path.startsWith("/") || /^[A-Za-z]:/.test(path)) return { ok: false, error: "path must be relative to the repository root" };
-  if (path.split("/").some((segment) => segment === "..")) return { ok: false, error: "path must not leave the repository" };
-  if (path.startsWith("-") || path.startsWith(":")) return { ok: false, error: 'path must not start with "-" or ":"' };
-  if (isDeniedPath(path)) return { ok: false, error: "reading this path is not allowed" };
-  return { ok: true, value: path };
-}
-function lineNumber(value, fallback) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : fallback;
-}
-function capOutput(text) {
-  return text.length > TOOL_LIMITS.outputChars ? `${text.slice(0, TOOL_LIMITS.outputChars)}
-[truncated at ${TOOL_LIMITS.outputChars} characters]` : text;
-}
-function git(ctx, args, opts = {}) {
-  return runGit(ctx.root, args, { timeoutMs: opts.timeoutMs ?? TOOL_LIMITS.gitTimeoutMs, maxBuffer: opts.maxBuffer ?? TOOL_LIMITS.fileBytes });
-}
-function gitFailure(res, what) {
-  if (res.error === "timeout") return `${what} timed out`;
-  if (res.error === "too_large") return `${what} is too large`;
-  const detail = res.stderr.trim().split("\n")[0]?.slice(0, 160);
-  return detail ? `${what} failed: ${detail}` : `${what} failed`;
-}
-var INDEX = Symbol("index");
-function changeRevision(range) {
-  return range.kind === "push" ? range.head : INDEX;
-}
-function baseRevision(range) {
-  return range.kind === "push" ? range.base : "HEAD";
-}
-function objectSpec(revision, path) {
-  return revision === INDEX ? `:${path}` : `${revision}:${path}`;
-}
-async function readBlob(ctx, revision, path) {
-  const res = await git(ctx, ["cat-file", "blob", objectSpec(revision, path)]);
-  if (!res.ok) {
-    if (res.error === "failed") return { ok: false, error: `${path} is not a file in ${revision === INDEX ? "the staged version" : "that version"}` };
-    return { ok: false, error: gitFailure(res, `reading ${path}`) };
-  }
-  if (res.stdout.slice(0, 8e3).includes("\0")) return { ok: false, error: `${path} is a binary file` };
-  return { ok: true, value: res.stdout };
-}
-function numberedRange(content, startLine, endLine, maxLines) {
-  const lines = content.split("\n");
-  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
-  const total = lines.length;
-  const from = Math.min(Math.max(1, startLine), Math.max(1, total));
-  const to = Math.min(total, Math.max(from, endLine), from + maxLines - 1);
-  const width = String(to).length;
-  const body = lines.slice(from - 1, to).map((line, i) => `${String(from + i).padStart(width, " ")}| ${line}`).join("\n");
-  return `lines ${total === 0 ? 0 : from}-${to} of ${total}
-${body}`;
-}
-async function resolveRevision(ctx, value) {
-  if (value === "head") return { ok: true, value: changeRevision(ctx.range) };
-  if (value === "base") {
-    const base = baseRevision(ctx.range);
-    return base ? { ok: true, value: base } : { ok: false, error: "this change has no base version" };
-  }
-  if (typeof value === "string" && /^[0-9a-f]{7,40}$/.test(value)) {
-    const res = await git(ctx, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${value}^{commit}`]);
-    if (res.ok && res.stdout.trim()) return { ok: true, value: res.stdout.trim() };
-    return { ok: false, error: `unknown commit ${value}` };
-  }
-  return { ok: false, error: 'revision must be "base", "head", or a commit hash from git_log' };
-}
-var readFileTool = async (ctx, args) => {
-  const path = validateRepoPath(args.path);
-  if (!path.ok) return path;
-  const blob = await readBlob(ctx, changeRevision(ctx.range), path.value);
-  if (!blob.ok) return blob;
-  const start = lineNumber(args.start_line, 1);
-  const end = lineNumber(args.end_line, start + TOOL_LIMITS.readLines - 1);
-  return { ok: true, value: `${path.value} (${ctx.range.kind === "push" ? "pushed version" : "staged version"}), ${numberedRange(blob.value, start, end, TOOL_LIMITS.readLines)}` };
-};
-var gitShowTool = async (ctx, args) => {
-  const path = validateRepoPath(args.path);
-  if (!path.ok) return path;
-  const revision = await resolveRevision(ctx, args.revision);
-  if (!revision.ok) return revision;
-  const blob = await readBlob(ctx, revision.value, path.value);
-  if (!blob.ok) return blob;
-  const start = lineNumber(args.start_line, 1);
-  const end = lineNumber(args.end_line, start + TOOL_LIMITS.readLines - 1);
-  return { ok: true, value: `${path.value} at ${String(args.revision)}, ${numberedRange(blob.value, start, end, TOOL_LIMITS.readLines)}` };
-};
-var gitDiffTool = async (ctx, args) => {
-  const path = validateRepoPath(args.path);
-  if (!path.ok) return path;
-  const range = ctx.range;
-  let diffArgs;
-  if (range.kind === "push") {
-    if (!range.base) return { ok: false, error: "this push has no base to diff against" };
-    diffArgs = ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", range.base, range.head];
-  } else {
-    diffArgs = ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", "--cached"];
-  }
-  const res = await git(ctx, ["--literal-pathspecs", ...diffArgs, "--", path.value]);
-  if (!res.ok) return { ok: false, error: gitFailure(res, "diff") };
-  return { ok: true, value: res.stdout.trim() ? capOutput(res.stdout) : `no changes to ${path.value} in the change under review` };
-};
-var gitLogTool = async (ctx, args) => {
-  const path = validateRepoPath(args.path);
-  if (!path.ok) return path;
-  const count = Math.min(TOOL_LIMITS.logCommits, lineNumber(args.max_count, TOOL_LIMITS.logCommits));
-  const revision = ctx.range.kind === "push" ? ctx.range.head : "HEAD";
-  const res = await git(ctx, [
-    "--literal-pathspecs",
-    "log",
-    "--no-show-signature",
-    "--no-color",
-    "-n",
-    String(count),
-    "--date=short",
-    "--format=%h %ad %s",
-    revision,
-    "--",
-    path.value
-  ]);
-  if (!res.ok) return { ok: false, error: gitFailure(res, "log") };
-  return { ok: true, value: res.stdout.trim() ? capOutput(res.stdout.trim()) : `no commits touch ${path.value}` };
-};
-var gitBlameTool = async (ctx, args) => {
-  const path = validateRepoPath(args.path);
-  if (!path.ok) return path;
-  const start = lineNumber(args.start_line, 1);
-  const end = Math.min(lineNumber(args.end_line, start), start + TOOL_LIMITS.blameLines - 1);
-  const revision = ctx.range.kind === "push" ? ctx.range.head : "HEAD";
-  const res = await git(ctx, ["blame", "--no-textconv", "-s", "-L", `${start},${Math.max(start, end)}`, revision, "--", path.value]);
-  if (!res.ok) return { ok: false, error: gitFailure(res, "blame") };
-  return { ok: true, value: capOutput(res.stdout.trimEnd()) };
-};
-var listFilesTool = async (ctx, args) => {
-  const dir = validateRepoPath(args.dir, { allowRoot: true });
-  if (!dir.ok) return dir;
-  const glob = typeof args.glob === "string" && args.glob.length > 0 && args.glob.length <= 200 ? args.glob : null;
-  const scope2 = dir.value || ".";
-  const res = ctx.range.kind === "push" ? await git(ctx, ["--literal-pathspecs", "ls-tree", "-r", "--name-only", "-z", ctx.range.head, "--", scope2]) : await git(ctx, ["--literal-pathspecs", "ls-files", "-z", "--cached", "--", scope2]);
-  if (!res.ok) return { ok: false, error: gitFailure(res, "listing") };
-  const paths = res.stdout.split("\0").filter((p) => p && !isDeniedPath(p) && (!glob || globMatch2(glob, p)));
-  const shown = paths.slice(0, TOOL_LIMITS.listEntries);
-  const more = paths.length - shown.length;
-  return { ok: true, value: shown.length ? `${shown.join("\n")}${more > 0 ? `
-\u2026 ${more} more` : ""}` : "no matching files" };
-};
-var searchTool = async (ctx, args) => {
-  const text = args.text;
-  if (typeof text !== "string" || text.length === 0 || text.length > TOOL_LIMITS.textChars || /[\n\r]/.test(text)) {
-    return { ok: false, error: `text must be 1-${TOOL_LIMITS.textChars} characters on one line` };
-  }
-  const glob = typeof args.path_glob === "string" && args.path_glob.length > 0 ? args.path_glob : null;
-  if (glob && (glob.length > 200 || /[-]/.test(glob) || glob.startsWith("-"))) {
-    return { ok: false, error: "path_glob is not a valid glob" };
-  }
-  const pathspec = glob ? [`:(glob)${glob}`] : [];
-  const revision = ctx.range.kind === "push" ? [ctx.range.head] : ["--cached"];
-  const res = await git(ctx, ["grep", "-n", "-I", "-F", "--no-color", ...revision.filter((r) => r === "--cached"), "-e", text, ...revision.filter((r) => r !== "--cached"), "--", ...pathspec]);
-  if (!res.ok) {
-    if (res.error === "failed" && res.stderr.trim() === "") return { ok: true, value: "no matches" };
-    return { ok: false, error: gitFailure(res, "search") };
-  }
-  const prefix = ctx.range.kind === "push" ? `${ctx.range.head}:` : "";
-  const hits = [];
-  for (const raw of res.stdout.split("\n")) {
-    if (!raw) continue;
-    const line = prefix && raw.startsWith(prefix) ? raw.slice(prefix.length) : raw;
-    const file = line.slice(0, line.indexOf(":"));
-    if (isDeniedPath(file)) continue;
-    hits.push(line.length > TOOL_LIMITS.searchLineChars ? `${line.slice(0, TOOL_LIMITS.searchLineChars)}\u2026` : line);
-    if (hits.length >= TOOL_LIMITS.searchHits) break;
-  }
-  return { ok: true, value: hits.length ? hits.join("\n") : "no matches" };
-};
-var TOOLS = {
-  read_file: readFileTool,
-  search: searchTool,
-  list_files: listFilesTool,
-  git_log: gitLogTool,
-  git_blame: gitBlameTool,
-  git_show: gitShowTool,
-  git_diff: gitDiffTool
-};
-function makeToolExecutor(ctx) {
-  return async (calls) => {
-    const results = new Array(calls.length);
-    let next = 0;
-    const worker = async () => {
-      while (next < calls.length) {
-        const index = next++;
-        const call = calls[index];
-        const tool = TOOLS[call.name];
-        if (!tool) {
-          results[index] = { call_id: call.call_id, ok: false, error: `unknown tool ${call.name}` };
-          continue;
-        }
-        try {
-          const outcome = await tool(ctx, call.arguments ?? {});
-          results[index] = outcome.ok ? { call_id: call.call_id, ok: true, output: capOutput(outcome.value) } : { call_id: call.call_id, ok: false, error: outcome.error };
-        } catch (err) {
-          results[index] = { call_id: call.call_id, ok: false, error: `tool failed: ${String(err?.message ?? err).slice(0, 160)}` };
-        }
-      }
-    };
-    await Promise.all(Array.from({ length: Math.min(TOOL_LIMITS.concurrency, calls.length) }, worker));
-    return results;
-  };
-}
-async function buildAgentDiffs(ctx, paths, limits = { perFileChars: 24e3, totalChars: 12e4 }) {
-  const valid = paths.filter((p) => validateRepoPath(p).ok);
-  if (valid.length === 0 || ctx.range.kind === "nothing") return [];
-  if (ctx.range.kind === "push" && !ctx.range.base) return [];
-  const args = ctx.range.kind === "push" ? ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", ctx.range.base, ctx.range.head] : ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", "--cached"];
-  const res = await git(ctx, ["--literal-pathspecs", ...args, "--", ...valid], { timeoutMs: TOOL_LIMITS.diffTimeoutMs, maxBuffer: 16 * 1024 * 1024 });
-  if (!res.ok) return [];
-  const out = [];
-  let total = 0;
-  for (const chunk of res.stdout.split(/^(?=diff --git )/m)) {
-    if (!chunk.startsWith("diff --git ")) continue;
-    const plus = /^\+\+\+ b\/(.+)$/m.exec(chunk);
-    const minus = /^--- a\/(.+)$/m.exec(chunk);
-    const path = plus?.[1] ?? minus?.[1] ?? /^diff --git a\/(\S+)/.exec(chunk)?.[1];
-    if (!path || isDeniedPath(path)) continue;
-    const room = Math.min(limits.perFileChars, limits.totalChars - total);
-    if (room <= 0) break;
-    const diff = chunk.length > room ? chunk.slice(0, room) : chunk;
-    total += diff.length;
-    out.push({ path, diff });
-  }
-  return out;
-}
-
-// src/commands/guard.ts
-var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
+var import_node_path34 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path35.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path34.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     try {
-      if (process.stdin.isTTY) return resolve6(empty);
+      if (process.stdin.isTTY) return resolve5(empty);
       const chunks = [];
       let timer;
       let settled = false;
@@ -25928,7 +24837,7 @@ function readPreToolUseStdin() {
         process.stdin.removeListener("end", onEnd);
         process.stdin.removeListener("error", onError);
         process.stdin.pause();
-        resolve6(value);
+        resolve5(value);
       };
       const onEnd = () => {
         try {
@@ -25949,7 +24858,7 @@ function readPreToolUseStdin() {
       process.stdin.on("error", onError);
       process.stdin.resume();
     } catch {
-      resolve6(empty);
+      resolve5(empty);
     }
   });
 }
@@ -26061,13 +24970,8 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  let staticResults;
-  if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs49.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
-    staticResults = runCodacyAnalysis(scannable);
-  } else {
-    staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
-  }
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs49.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
     static_results: staticResults,
@@ -26130,100 +25034,12 @@ function coverageBlock(c) {
 }
 function emitAllowNotice(userMsg, agentMsg) {
   process.stdout.write(JSON.stringify({
-    systemMessage: terminalText(userMsg, 8e3),
-    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: terminalText(agentMsg, 4e4) }
+    systemMessage: userMsg,
+    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: agentMsg }
   }) + "\n");
   process.exit(0);
 }
-var GATES = ["PASS", "WARN", "FAIL"];
-function worstGate(...gates) {
-  const rank2 = (gate) => {
-    const index = GATES.indexOf(String(gate ?? "").toUpperCase());
-    return index === -1 ? 1 : index;
-  };
-  return GATES[Math.max(...gates.map(rank2))];
-}
-function withAgentVerdict(oneShot, agent) {
-  if (agent.one_shot_source === "none" && typeof oneShot.gate_decision === "string") {
-    const added = agent.findings.filter((f) => f.agent_added === true);
-    return {
-      ...oneShot,
-      gate_decision: worstGate(oneShot.gate_decision, agent.gate_decision ?? "WARN", "WARN"),
-      findings: [...Array.isArray(oneShot.findings) ? oneShot.findings : [], ...added],
-      agent_review: {
-        ...agent.agent_review,
-        gate_decision_before: oneShot.gate_decision,
-        one_shot_source: "none",
-        cleared: [],
-        downgraded: []
-      }
-    };
-  }
-  return {
-    ...oneShot,
-    gate_decision: agent.gate_decision,
-    findings: agent.findings,
-    agent_review: {
-      ...agent.agent_review,
-      gate_decision_before: agent.gate_decision_before,
-      one_shot_source: agent.one_shot_source,
-      cleared: agent.cleared,
-      downgraded: agent.downgraded ?? []
-    }
-  };
-}
-function describeAgentOutcome(outcome) {
-  if (!outcome || outcome.kind === "disabled") return null;
-  if (outcome.kind !== "finished") return `Agent review: not used (${outcome.reason})`;
-  const { agent_review: r, gate_decision: after, gate_decision_before: before } = outcome.response;
-  const checks = Number(r.code_runtime_checks ?? 0) + Number(r.container_checks ?? 0);
-  const verdict = before && after && before !== after ? `, verdict changed from ${before} to ${after}` : "";
-  return `Agent review: ${r.outcome}, ${r.turns} turn(s), ${r.local_calls} read(s), ${checks} code check(s), ${r.cleared} cleared, ${Number(r.downgraded ?? 0)} downgraded, ${r.added} added${verdict}`;
-}
-function startAgentReview(input) {
-  if (process.env.VERITY_GIT_MOMENT_AGENT === "off") return null;
-  const ctx = { root: input.root, range: input.range };
-  const http = {
-    async post(path, body, timeoutMs) {
-      const res = await apiRequest({
-        method: "POST",
-        path,
-        serviceUrl: input.serviceUrl,
-        token: input.token,
-        body,
-        timeout: timeoutMs,
-        cmd: "guard-agent",
-        verbose: input.verbose,
-        encodeBody: true
-      });
-      return res.ok ? { ok: true, data: res.data } : { ok: false, error: res.error };
-    }
-  };
-  const sentPaths = input.codeDelta.files.map((f) => f.path);
-  const run2 = async () => runAgentReview({
-    http,
-    executeTools: makeToolExecutor(ctx),
-    startedAt: input.hookStartedAt,
-    deadlineMs: AGENT_DEADLINE_MS[input.moment],
-    start: {
-      moment: input.moment,
-      iteration: input.iteration,
-      session_id: input.sessionId,
-      stated_intent: input.statedIntent,
-      changed_files: input.files,
-      sent_paths: sentPaths,
-      diffs: await buildAgentDiffs(ctx, sentPaths),
-      repo_context: input.requestBody.repo_context,
-      static_results: input.requestBody.static_results,
-      one_shot_chars: input.codeDelta.files.reduce((n, f) => n + f.content.length, 0)
-    },
-    oneShot: input.oneShot.then((r) => r.ok ? { ok: true, response: r.data } : { ok: false }),
-    sessionId: input.sessionId
-  });
-  return run2().catch((err) => ({ kind: "failed", reason: String(err?.message ?? err) }));
-}
 async function runGuard(opts, globals) {
-  const hookStartedAt = Date.now();
   const on = resolveGuardMoments(opts.on);
   if (on.length === 0) process.exit(0);
   const { command, cwd, sessionId } = await readPreToolUseStdin();
@@ -26295,12 +25111,12 @@ async function runGuard(opts, globals) {
       cwd: frame.worktreeRoot ?? process.cwd()
     });
     upgradeToExcerpts(repoContext2, {
-      // Rooted, no-follow read from the validated descriptor (safe-read.ts):
-      // site paths come from a search, and a site under a symlinked directory
-      // must not pull a file from outside the tree into the request.
       readFile: (rel) => {
-        const read = readRegularFileInRoot(frame.worktreeRoot ?? process.cwd(), rel, EXCERPT_SOURCE_MAX_BYTES);
-        return read.ok ? read.content : null;
+        try {
+          return (0, import_node_fs49.readFileSync)((0, import_node_path34.join)(frame.worktreeRoot ?? process.cwd(), rel), "utf8");
+        } catch {
+          return null;
+        }
       }
     });
     requestBody.repo_context = repoContext2;
@@ -26329,7 +25145,7 @@ async function runGuard(opts, globals) {
   };
   logToFileOnly(coverageBlock(coverage));
   const reviewStart = Date.now();
-  const oneShot = analyzeRequest({
+  const result = await analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
     body: requestBody,
@@ -26337,45 +25153,22 @@ async function runGuard(opts, globals) {
     timeout: 29e4,
     cmd: "guard"
   });
-  const agent = startAgentReview({
-    serviceUrl: urlResult.data,
-    token: tokenResult.data.token,
-    verbose: globals.verbose,
-    hookStartedAt,
-    moment,
-    root: frame.worktreeRoot,
-    range,
-    iteration: iter + 1,
-    sessionId,
-    statedIntent,
-    files,
-    codeDelta,
-    requestBody,
-    oneShot
-  });
-  const result = await oneShot;
-  const agentOutcome = agent ? await agent : null;
-  const agentVerdict = agentOutcome?.kind === "finished" && agentOutcome.response.gate_decision ? agentOutcome.response : null;
   const reviewSecs = Math.max(1, Math.round((Date.now() - reviewStart) / 1e3));
-  if (!result.ok && !agentVerdict) {
+  if (!result.ok) {
     const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
     emitAllowNotice(
       `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "service offline"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
       `Verity ${moment}: ${authRemedy ? "not authorized" : "service unavailable"} (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${authRemedy}`
     );
   }
-  const oneShotResponse = result.ok ? result.data : {};
-  const response = agentVerdict ? withAgentVerdict(oneShotResponse, agentVerdict) : oneShotResponse;
-  if (opts.json) process.stderr.write(JSON.stringify(response) + "\n");
+  if (opts.json) process.stderr.write(JSON.stringify(result.data) + "\n");
+  const response = result.data;
   const decision = response.gate_decision ?? "(unrecognised)";
   const viewUrl = response.view_url ?? "";
   const link = viewUrl ? ` \u2014 ${viewUrl}` : "";
   const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
-  const agentLine = describeAgentOutcome(agentOutcome);
-  const covDetail = agentLine ? `${coverageBlock(coverage)}
-  ${agentLine}` : coverageBlock(coverage);
-  const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
-  if (decision === "FAIL" && hasBlockingFinding(response, witnessed)) {
+  const covDetail = coverageBlock(coverage);
+  if (decision === "FAIL" && hasBlockingFinding(response, codeDelta.files.map((f) => f.path))) {
     writeIter(moment, iter + 1);
     writeBlockMessage(moment, response, covDetail);
     process.exit(2);
@@ -26394,16 +25187,12 @@ async function runGuard(opts, globals) {
   emitAllowNotice(notice.user, notice.agent);
 }
 function verdictNotice(ctx) {
-  const { moment, verb } = ctx;
-  const covLine = terminalText(ctx.covLine, 500);
-  const covDetail = terminalText(ctx.covDetail, 2e4);
-  const link = terminalText(ctx.link, 2100);
-  const viewUrl = terminalUrl(ctx.viewUrl);
-  const decision = ctx.decision == null ? "(unrecognised)" : terminalText(ctx.decision, 60);
+  const { moment, verb, covLine, covDetail, link, viewUrl } = ctx;
+  const decision = ctx.decision ?? "(unrecognised)";
   const report = viewUrl ? `
 Report: ${viewUrl}` : "";
   if (decision === "FAIL") {
-    const narrative = terminalText(ctx.narrative, 4e3);
+    const narrative = ctx.narrative ?? "";
     return {
       user: `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
       agent: `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
@@ -26434,9 +25223,9 @@ function writeBlockMessage(moment, response, covDetail) {
   const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
   const verb = moment === "pre-commit" ? "commit" : "push";
   const assessment = response.assessment;
-  const narrative = terminalText(assessment?.narrative, 4e3);
-  const findings = Array.isArray(response.findings) ? response.findings : [];
-  const viewUrl = terminalUrl(response.view_url);
+  const narrative = assessment?.narrative ?? "";
+  const findings = response.findings ?? [];
+  const viewUrl = response.view_url ?? "";
   process.stderr.write(`${RED}${BOLD}\u2501\u2501\u2501 Verity ${label2} gate: FAIL \u2501\u2501\u2501${NC}
 
 `);
@@ -26449,18 +25238,18 @@ function writeBlockMessage(moment, response, covDetail) {
 
 `);
     for (const f of agentFindings) {
-      const severity = terminalText(f.severity, 20).toUpperCase();
+      const severity = (f.severity ?? "").toUpperCase();
       const fix = f.fix;
-      process.stderr.write(`[${severity}] ${terminalText(f.title, 300)}
+      process.stderr.write(`[${severity}] ${f.title ?? ""}
 `);
-      process.stderr.write(`  File: ${terminalText(f.file, 400)}:${terminalText(String(f.line ?? ""), 12)}
+      process.stderr.write(`  File: ${f.file ?? ""}:${f.line ?? ""}
 `);
-      process.stderr.write(`  Fix: ${terminalText(fix?.description, 2e3) || "See description"}
+      process.stderr.write(`  Fix: ${fix?.description ?? "See description"}
 
 `);
     }
   }
-  process.stderr.write(`${DIM}${terminalText(covDetail, 2e4)}${NC}
+  process.stderr.write(`${DIM}${covDetail}${NC}
 
 `);
   if (viewUrl) process.stderr.write(`${CYAN}Full report: ${viewUrl}${NC}
@@ -26621,10 +25410,10 @@ function registerWaiveCommand(program2) {
 
 // src/commands/init.ts
 var import_node_fs54 = require("node:fs");
-var import_promises19 = require("node:fs/promises");
+var import_promises17 = require("node:fs/promises");
 var import_yaml6 = __toESM(require_dist());
-var import_node_path38 = require("node:path");
-var import_node_child_process17 = require("node:child_process");
+var import_node_path37 = require("node:path");
+var import_node_child_process16 = require("node:child_process");
 
 // src/lib/banner.ts
 var WORDMARK = [
@@ -26705,15 +25494,10 @@ function printPhase(n, of, title, subtitle) {
 var import_node_fs51 = require("node:fs");
 
 // src/lib/prereqs.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
-  try {
-    const out = (0, import_node_child_process15.execSync)(`command -v ${bin}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-    return out || null;
-  } catch {
-    return null;
-  }
+  return whichSync(bin, { real: false });
 }
 function checkNode() {
   const version = process.version;
@@ -26731,7 +25515,7 @@ function checkNode() {
 function checkGit() {
   let detail = "";
   try {
-    detail = (0, import_node_child_process15.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    detail = (0, import_node_child_process14.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return {
       id: "git",
@@ -26768,13 +25552,13 @@ function checkAnalysisCli() {
 }
 var INSTALL_TIMEOUT_MS = 12e4;
 function run(command, args, opts = {}) {
-  return new Promise((resolve6) => {
-    const child = (0, import_node_child_process15.spawn)(command, args, {
+  return new Promise((resolve5) => {
+    const child = (0, import_node_child_process14.spawn)(command, args, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
-    child.on("error", () => resolve6(false));
-    child.on("close", (code) => resolve6(code === 0));
+    child.on("error", () => resolve5(false));
+    child.on("close", (code) => resolve5(code === 0));
   });
 }
 async function installAnalysisCli() {
@@ -26818,7 +25602,7 @@ async function checkPrereqs(opts = {}) {
 }
 
 // src/lib/telemetry.ts
-var import_promises17 = require("node:fs/promises");
+var import_promises15 = require("node:fs/promises");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var GITIGNORE_FILE = ".gitignore";
 var GITIGNORE_ENTRY = SETTINGS_LOCAL_IGNORE_ENTRY;
@@ -26848,7 +25632,7 @@ function buildTelemetryEnv(serviceUrl) {
 var VERITY_TELEMETRY_KEYS = Object.keys(buildTelemetryEnv(""));
 async function readSettingsLocal() {
   try {
-    return JSON.parse(await (0, import_promises17.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
+    return JSON.parse(await (0, import_promises15.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
   } catch {
     return {};
   }
@@ -26860,7 +25644,7 @@ async function ensureGitignore() {
   const file = projectPath(GITIGNORE_FILE);
   let content = "";
   try {
-    content = await (0, import_promises17.readFile)(file, "utf-8");
+    content = await (0, import_promises15.readFile)(file, "utf-8");
   } catch {
   }
   const lines = content.split("\n").map((l) => l.trim());
@@ -26869,7 +25653,7 @@ async function ensureGitignore() {
   }
   const block = "# Verity telemetry \u2014 machine-local Claude Code settings\n" + GITIGNORE_ENTRY + "\n";
   const next = content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block;
-  await (0, import_promises17.writeFile)(file, next);
+  await (0, import_promises15.writeFile)(file, next);
 }
 async function installTelemetry(serviceUrl) {
   const env = buildTelemetryEnv(serviceUrl);
@@ -27050,15 +25834,15 @@ function registerDoctorCommand(program2) {
 
 // src/commands/migrate.ts
 var import_node_fs52 = require("node:fs");
-var import_node_path36 = require("node:path");
-var import_node_child_process16 = require("node:child_process");
+var import_node_path35 = require("node:path");
+var import_node_child_process15 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process16.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process15.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process16.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process15.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -27066,7 +25850,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process16.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process15.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -27087,8 +25871,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path36.join)(root, ".gate");
-  const verityDir = (0, import_node_path36.join)(root, ".verity");
+  const gateDir = (0, import_node_path35.join)(root, ".gate");
+  const verityDir = (0, import_node_path35.join)(root, ".verity");
   if ((0, import_node_fs52.existsSync)(gateDir) && !(0, import_node_fs52.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -27106,7 +25890,7 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process16.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process15.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
@@ -27142,11 +25926,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path36.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path36.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path35.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path35.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs52.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs52.existsSync)(verityCreds)) {
-    (0, import_node_fs52.mkdirSync)((0, import_node_path36.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs52.mkdirSync)((0, import_node_path35.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -27168,7 +25952,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path36.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path35.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs52.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -27179,13 +25963,13 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path36.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path36.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path35.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path35.join)(root, "VERITY.md");
   if (!(0, import_node_fs52.existsSync)(gateMd) || (0, import_node_fs52.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process16.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process15.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -27197,7 +25981,7 @@ function migrateStandardFile(root, actions) {
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path36.join)(root, ".claude", "settings.local.json");
+  const file = (0, import_node_path35.join)(root, ".claude", "settings.local.json");
   if (!(0, import_node_fs52.existsSync)(file)) return;
   let settings;
   try {
@@ -27245,8 +26029,8 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
     toAppend.push(line.replace(/\r$/, ""));
   }
   if (toAppend.length > 0) {
-    const sep4 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs52.writeFileSync)(verityCreds, verityContent + sep4 + toAppend.join("\n") + "\n");
+    const sep3 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
+    (0, import_node_fs52.writeFileSync)(verityCreds, verityContent + sep3 + toAppend.join("\n") + "\n");
   }
   (0, import_node_fs52.rmSync)(gateCreds, { force: true });
   return toAppend.length;
@@ -27260,7 +26044,7 @@ function readFileSyncSafe(path) {
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process16.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process15.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -27287,15 +26071,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path36.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path35.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs52.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path36.join)(relDir, entry) : entry;
-      const src = (0, import_node_path36.join)(gateDir, rel);
-      const dest = (0, import_node_path36.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path35.join)(relDir, entry) : entry;
+      const src = (0, import_node_path35.join)(gateDir, rel);
+      const dest = (0, import_node_path35.join)(verityDir, rel);
       if ((0, import_node_fs52.statSync)(src).isDirectory()) {
         walk2(rel);
       } else if (!(0, import_node_fs52.existsSync)(dest)) {
-        (0, import_node_fs52.mkdirSync)((0, import_node_path36.dirname)(dest), { recursive: true });
+        (0, import_node_fs52.mkdirSync)((0, import_node_path35.dirname)(dest), { recursive: true });
         (0, import_node_fs52.cpSync)(src, dest);
         copied++;
       }
@@ -27305,22 +26089,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path36.join)(root, ".gate");
-  const verityDir = (0, import_node_path36.join)(root, ".verity");
+  const gateDir = (0, import_node_path35.join)(root, ".gate");
+  const verityDir = (0, import_node_path35.join)(root, ".verity");
   if ((0, import_node_fs52.existsSync)(gateDir) && !(0, import_node_fs52.existsSync)(verityDir)) return true;
   if ((0, import_node_fs52.existsSync)(gateDir) && (0, import_node_fs52.existsSync)(verityDir)) {
-    if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(gateDir, "credentials")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs52.existsSync)((0, import_node_path35.join)(gateDir, "credentials")) && !(0, import_node_fs52.existsSync)((0, import_node_path35.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(gateDir, "memory")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs52.existsSync)((0, import_node_path35.join)(gateDir, "memory")) && !(0, import_node_fs52.existsSync)((0, import_node_path35.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path36.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path35.join)(root, "CLAUDE.md");
   if ((0, import_node_fs52.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(root, "GATE.md")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs52.existsSync)((0, import_node_path35.join)(root, "GATE.md")) && !(0, import_node_fs52.existsSync)((0, import_node_path35.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -27449,7 +26233,7 @@ function runSelect(opts) {
     cursor: initialIdx[0] ?? 0,
     chosen: new Set(mode2 === "single" ? [initialIdx[0] ?? 0] : initialIdx)
   };
-  return new Promise((resolve6) => {
+  return new Promise((resolve5) => {
     let painted = 0;
     let settled = false;
     const draw = () => {
@@ -27497,7 +26281,7 @@ function runSelect(opts) {
       if (settled) return;
       settled = true;
       restore();
-      resolve6(value);
+      resolve5(value);
     };
     readline2.emitKeypressEvents(input);
     input.setRawMode(true);
@@ -27518,9 +26302,9 @@ async function askLine(question, io = {}) {
     output: io.output ?? process.stdout
   });
   try {
-    return await new Promise((resolve6) => {
-      rl.question(question).then((a) => resolve6(a.trim())).catch(() => resolve6(null));
-      rl.once("close", () => setImmediate(() => resolve6(null)));
+    return await new Promise((resolve5) => {
+      rl.question(question).then((a) => resolve5(a.trim())).catch(() => resolve5(null));
+      rl.once("close", () => setImmediate(() => resolve5(null)));
     });
   } finally {
     rl.close();
@@ -27602,8 +26386,8 @@ async function promptMultiSelect(question, choices, fallback) {
 
 // src/lib/remote-config.ts
 var import_node_fs53 = require("node:fs");
-var import_promises18 = require("node:fs/promises");
-var import_node_path37 = require("node:path");
+var import_promises16 = require("node:fs/promises");
+var import_node_path36 = require("node:path");
 var import_yaml5 = __toESM(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -27652,7 +26436,7 @@ async function adoptRemoteSetup(found, opts) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
-      const local = await (0, import_promises18.readFile)(localIgnore, "utf-8").catch(() => null);
+      const local = await (0, import_promises16.readFile)(localIgnore, "utf-8").catch(() => null);
       if (local !== null && local !== rider) {
         notes.push(`${VERITYIGNORE_FILE} already exists here and differs from the pushed copy \u2014 kept yours.`);
       }
@@ -27679,10 +26463,10 @@ async function adoptRemoteSetup(found, opts) {
   written.push(VERITY_MD_FILE);
   return { written, notes };
 }
-async function writeOut(relative2, body) {
-  const target = projectPath(relative2);
-  await (0, import_promises18.mkdir)((0, import_node_path37.dirname)(target), { recursive: true });
-  await (0, import_promises18.writeFile)(target, body);
+async function writeOut(relative3, body) {
+  const target = projectPath(relative3);
+  await (0, import_promises16.mkdir)((0, import_node_path36.dirname)(target), { recursive: true });
+  await (0, import_promises16.writeFile)(target, body);
 }
 function describeRemote(found) {
   const when = found.standard.createdAt.slice(0, 10);
@@ -27752,7 +26536,7 @@ async function runOptionalAuth(resolution, opts = {}) {
   }
   let remote = "";
   try {
-    remote = (0, import_node_child_process17.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process16.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
   if (!healed) {
@@ -27798,15 +26582,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path38.join)(__dirname, "..", "data"),
+    (0, import_node_path37.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path38.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path37.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path38.join)(process.cwd(), "cli", "data")
+    (0, import_node_path37.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(candidate, "skills"))) {
+    if ((0, import_node_fs54.existsSync)((0, import_node_path37.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -27815,8 +26599,8 @@ function resolveDataDir2() {
   );
 }
 async function copyDir(src, dest) {
-  await (0, import_promises19.mkdir)(dest, { recursive: true });
-  await (0, import_promises19.cp)(src, dest, { recursive: true, force: true });
+  await (0, import_promises17.mkdir)(dest, { recursive: true });
+  await (0, import_promises17.cp)(src, dest, { recursive: true, force: true });
 }
 async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
@@ -27824,7 +26608,7 @@ async function skillIsCurrent(src, dest) {
     const walk2 = (d, prefix) => {
       for (const e of (0, import_node_fs54.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path38.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path37.join)(d, e.name), rel);
         else if (e.isFile()) out.push(rel);
       }
     };
@@ -27835,8 +26619,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises19.readFile)((0, import_node_path38.join)(src, rel), "utf-8");
-      const b = await (0, import_promises19.readFile)((0, import_node_path38.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises17.readFile)((0, import_node_path37.join)(src, rel), "utf-8");
+      const b = await (0, import_promises17.readFile)((0, import_node_path37.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -28023,7 +26807,7 @@ async function healStaleAnalysisConfig(globals) {
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
   printWarn("  running silently with nothing enabled. Re-deriving it from your Standard\u2026");
   try {
-    const content = (0, import_yaml6.parse)(await (0, import_promises19.readFile)(standardPath, "utf-8"));
+    const content = (0, import_yaml6.parse)(await (0, import_promises17.readFile)(standardPath, "utf-8"));
     const derived = await deriveConfigForStandard(content);
     for (const path of derived.written) printInfo(`  ${path} \u2713 (re-derived)`);
     for (const note of derived.notes) printWarn(`  ${note}`);
@@ -28104,7 +26888,7 @@ async function handoffToSetup(enabled, claudeInstalled) {
   console.log("  Usually a minute or two. Quit any time \u2014 re-running /verity-setup resumes.");
   console.log("");
   const startedAt = Date.now();
-  const run2 = (0, import_node_child_process17.spawnSync)("claude", ["/verity-setup"], { stdio: "inherit" });
+  const run2 = (0, import_node_child_process16.spawnSync)("claude", ["/verity-setup"], { stdio: "inherit" });
   if (run2.error) {
     printWarn(`Could not start Claude Code: ${run2.error.message}`);
     return instruct("start it yourself and run the skill there");
@@ -28114,12 +26898,12 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path38.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path37.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path38.join)(skillsSource, skill);
-    const dest = (0, import_node_path38.join)(skillsDest, skill);
+    const src = (0, import_node_path37.join)(skillsSource, skill);
+    const dest = (0, import_node_path37.join)(skillsDest, skill);
     if (!(0, import_node_fs54.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
@@ -28188,7 +26972,7 @@ async function checkPrerequisites(step) {
 }
 async function scaffoldProject(step, defaultsOnly) {
   step("Knowledge base, .gitignore and CLAUDE.md");
-  await (0, import_promises19.mkdir)(VERITY_DIR, { recursive: true });
+  await (0, import_promises17.mkdir)(VERITY_DIR, { recursive: true });
   await ensureMemoryDir();
   const ignoreResult = ensureVerityGitignore();
   if (ignoreResult === "failed") {
@@ -28353,8 +27137,8 @@ function registerInitCommand(program2) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
     await scaffoldProject(step, defaultsOnly);
-    const globalVerityDir = (0, import_node_path38.join)(process.env.HOME ?? "", ".verity");
-    await (0, import_promises19.mkdir)(globalVerityDir, { recursive: true });
+    const globalVerityDir = (0, import_node_path37.join)(process.env.HOME ?? "", ".verity");
+    await (0, import_promises17.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
     const gitMoments = [
@@ -28452,7 +27236,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.6-experimental.df0a578" : "dev"
+          cli_version: true ? "0.32.7" : "dev"
         }
       });
     } catch (err) {
@@ -28503,7 +27287,7 @@ function registerInitCommand(program2) {
 
 // src/commands/uninstall.ts
 var import_node_fs55 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_path38 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -28512,7 +27296,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path39.join)(skillsRoot, name);
+      const dir = (0, import_node_path38.join)(skillsRoot, name);
       if ((0, import_node_fs55.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
@@ -28558,7 +27342,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path39.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path38.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs55.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -28757,7 +27541,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs56 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_path39 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -28798,7 +27582,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs56.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs56.unlinkSync)((0, import_node_path40.join)(cacheDir, entry));
+            (0, import_node_fs56.unlinkSync)((0, import_node_path39.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -28825,7 +27609,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs56.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs56.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs56.unlinkSync)((0, import_node_path40.join)(logsDir, entry));
+            (0, import_node_fs56.unlinkSync)((0, import_node_path39.join)(logsDir, entry));
           } catch {
           }
         }
@@ -28837,52 +27621,10 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs57 = require("node:fs");
-
-// src/lib/reflection-globs.ts
-var MAX_GLOBS = 6;
-var PATH_TOKEN = /[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]{1,8}(?::\d+(?::\d+)?)?/g;
-function clean(token) {
-  return token.replace(/:\d+(?::\d+)?$/, "").replace(/^[`'"(\[]+/, "").replace(/[`'"),\].;!?]+$/, "").replace(/^\.\//, "");
-}
-function resolve5(token, treePaths) {
-  if (treePaths.includes(token)) return token;
-  const suffix = token.startsWith("/") ? token : `/${token}`;
-  const matches = treePaths.filter((p) => p.endsWith(suffix));
-  return matches.length === 1 ? matches[0] : null;
-}
-function deriveFileGlobs(text, treePaths) {
-  if (!text || treePaths.length === 0) return [];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const raw of text.match(PATH_TOKEN) ?? []) {
-    const token = clean(raw);
-    if (!token) continue;
-    const path = resolve5(token, treePaths);
-    if (!path || seen.has(path)) continue;
-    seen.add(path);
-    out.push(path);
-    if (out.length >= MAX_GLOBS) break;
-  }
-  return out;
-}
-
-// src/commands/reflect.ts
-async function writeNodeToDisk(args) {
-  try {
-    const written = await applyMemoryWrites(
-      [{ path: args.filePath, content: args.content, node_id: args.nodeId, op: "create" }],
-      { treePaths: listTrackedFiles(), recordBaseline: false }
-    );
-    if (written === 0) return false;
-    return (0, import_node_fs57.existsSync)(projectPath(`${VERITY_DIR}/memory/${args.filePath}`));
-  } catch {
-    return false;
-  }
-}
 function registerReflectCommand(program2) {
-  program2.command("reflect").description("Capture learnings \u2014 auto-extract or record a reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-dictated text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--confirmed", "The USER authored or confirmed these exact words \u2014 records as human-authored (source: user, confidence 1.0)").option("--file-globs <glob...>", "Files this reflection is about. Without any, the paths cited in the text are used; a reflection matching no file never surfaces in a review").option("--autonomous", "(deprecated, ignored) reflections are always recorded without a confirm step").action(async (opts) => {
+  program2.command("reflect").description("Capture learnings \u2014 auto-extract or submit a human reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-confirmed text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--autonomous", "Record the drafted reflection without a confirm step (auto-detected from TTY / VERITY_AUTONOMOUS when omitted)").action(async (opts) => {
     const globals = program2.opts();
+    const mode2 = resolveRunMode({ autonomousFlag: opts.autonomous });
     await ensureMemoryDir();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -28947,11 +27689,6 @@ function registerReflectCommand(program2) {
     if (userInput) {
       const validKinds = ["decision", "gotcha", "pattern", "security", "quality", "intent", "domain", "integration"];
       const kind = validKinds.includes(opts.kind) ? opts.kind : "gotcha";
-      const confirmed = opts.confirmed === true;
-      const source = confirmed ? "user" : "agent";
-      const explicitGlobs = Array.isArray(opts.fileGlobs) ? opts.fileGlobs.map((g) => g.trim()).filter(Boolean) : [];
-      const derivedGlobs = explicitGlobs.length > 0 ? [] : deriveFileGlobs(userInput, listTrackedFiles());
-      const fileGlobs = explicitGlobs.length > 0 ? explicitGlobs : derivedGlobs.length > 0 ? derivedGlobs : inheritedGlobs;
       const result = await apiRequest({
         method: "POST",
         path: "/compound/memory/nodes",
@@ -28962,23 +27699,14 @@ function registerReflectCommand(program2) {
           title: userInput.slice(0, 200),
           body: userInput,
           domains: [],
-          file_globs: fileGlobs,
-          source,
-          created_by: "reflect",
-          // The server VERIFIES this against the project before writing it —
-          // an id it cannot verify is dropped, never trusted and never an
-          // error. Sending it is what lets an auto-recorded reflection carry
-          // the same attribution a dashboard-written one does; without it the
-          // unreviewed node is the one that cannot say where it came from.
-          ...taskId && { task_id: taskId },
-          // Server-side default for each source; sent explicitly so an older
-          // server (which knows 'user'/'extractor'/'linter' only, and would
-          // silently coerce an unknown source to 'user' at 1.0) still records
-          // an honest confidence for a draft nobody confirmed.
-          confidence: confirmed ? 1 : 0.7
+          // Inherit globs from the current task's context_files so the
+          // reflection is actually reachable by reviewer injection.
+          // Falls back to [] when there's no task context — user can
+          // edit the markdown later to tighten retrieval.
+          file_globs: inheritedGlobs
         },
         verbose: globals.verbose,
-        cmd: confirmed ? "reflect_user" : "reflect_agent"
+        cmd: "reflect_user"
       });
       if (!result.ok) {
         printError(`Failed to save reflection: ${result.error}`);
@@ -28986,23 +27714,12 @@ function registerReflectCommand(program2) {
       }
       const nodeId = result.data.node_id;
       const filePath = result.data.file_path;
-      const viewUrl = typeof result.data.view_url === "string" ? result.data.view_url : null;
-      const content = typeof result.data.content === "string" ? result.data.content : null;
-      const synced = content !== null && await writeNodeToDisk({ filePath, content, nodeId });
-      printInfo(
-        synced ? `Recorded ${nodeId} \u2192 .verity/memory/${filePath}` : `Recorded ${nodeId} (syncs to .verity/memory/${filePath} on the next analysis).`
-      );
-      if (viewUrl) printInfo(`  ${viewUrl}`);
+      printInfo(`Queued: ${nodeId} (will sync to .verity/memory/${filePath} on next analysis).`);
       printInfo(
-        confirmed ? "  Recorded as yours (source: user)." : "  Auto-recorded from this task \u2014 nobody reviewed it. Edit or delete the file if it is wrong."
+        mode2 === "autonomous" ? "Recorded autonomously (no confirm step) into the project knowledge base." : "Recorded your confirmed reflection into the project knowledge base."
       );
-      if (fileGlobs.length === 0) {
-        printWarn(
-          'No files matched \u2014 this reflection will not surface in future reviews. Cite a path in the text, or pass --file-globs "<path or glob>".'
-        );
-      }
       if (taskResolution === "none") {
-        printInfo("  (No task context \u2014 reflection lives at the project level.)");
+        printInfo("(No task context \u2014 reflection lives at the project level.)");
       }
     } else {
       if (!taskId) {
@@ -29089,121 +27806,6 @@ function registerMemoryCommand(program2) {
     }
     process.exit(result.failed === 0 ? 0 : 1);
   });
-  memory.command("pull").description("Download this repo's knowledge graph into .verity/memory/ (the session-start hook runs it)").option("--force", "Fetch every node even if nothing changed since the last pull").option("--quiet", "Print nothing and always exit 0 (for the session-start hook)").action(async (opts) => {
-    const globals = program2.opts();
-    const quiet = !!opts.quiet;
-    const fail = (message) => {
-      if (!quiet) printError(message);
-      process.exit(quiet ? 0 : 1);
-    };
-    try {
-      process.chdir(repoRoot());
-    } catch {
-    }
-    const tokenResult = await resolveToken(globals.token);
-    if (!tokenResult.ok) return fail(tokenResult.error);
-    const urlResult = await resolveServiceUrl(globals.serviceUrl);
-    if (!urlResult.ok) return fail(urlResult.error);
-    let result;
-    try {
-      result = await pullRepoMemory({
-        serviceUrl: urlResult.data,
-        token: tokenResult.data.token,
-        verbose: globals.verbose,
-        force: !!opts.force
-      });
-    } catch (err) {
-      return fail(`Could not pull the knowledge graph: ${err.message}`);
-    }
-    logEvent("memory_pull", result.ok ? { status: result.status, received: result.received, written: result.written } : { status: "failed", category: result.category ?? null });
-    if (!result.ok) return fail(`Could not pull the knowledge graph: ${result.error}`);
-    if (!quiet) {
-      printInfo(result.status === "unchanged" ? "Knowledge graph is up to date." : result.status === "tracked" ? "Skipped: .verity/memory/ is tracked by git here, and the pull never rewrites tracked files. Run `verity memory untrack` to make the graph machine-local." : `Pulled ${result.received} node(s); ${result.written} new or updated file(s) written to .verity/memory/.`);
-    }
-    let org;
-    try {
-      org = await pullOrgKnowledge({
-        serviceUrl: urlResult.data,
-        token: tokenResult.data.token,
-        verbose: globals.verbose,
-        force: !!opts.force
-      });
-    } catch (err) {
-      org = { ok: false, error: err.message };
-    }
-    logEvent("memory_org_pull", org.ok ? { status: org.status, received: org.received } : { status: "failed", category: org.category ?? null });
-    if (!quiet) {
-      if (!org.ok) printWarn(`Could not refresh the org knowledge mirror: ${org.error}`);
-      else if (org.status === "pulled") printInfo(`Org knowledge: ${org.received} claim(s) mirrored at ${org.dir}.`);
-      else if (org.status === "unchanged") printInfo("Org knowledge mirror is up to date.");
-    }
-    process.exit(0);
-  });
-  memory.command("org").description("List the org knowledge mirrored for this repository's organization").action(async () => {
-    try {
-      process.chdir(repoRoot());
-    } catch {
-    }
-    const dir = orgMirrorDir();
-    if (!dir) {
-      printError("Not a repository with an origin remote, so there is no organization to list.");
-      process.exit(1);
-    }
-    const claims = await readOrgMirror();
-    if (claims.length === 0) {
-      printInfo(`No org knowledge mirrored yet (${dir}). Run \`verity memory pull\`.`);
-      process.exit(0);
-    }
-    for (const c of claims) console.log(`${c.tag_id}  ${c.kind.padEnd(11)} ${c.title}  \xB7 ${c.origin}`);
-    printInfo(`${claims.length} claim(s) at ${dir}. Demote one with \`verity memory demote <id> --reason "\u2026"\`.`);
-    process.exit(0);
-  });
-  memory.command("demote <claim-id>").description("Demote an org knowledge claim for the whole organization, with a reason").requiredOption("--reason <text>", "Why this claim should no longer be shared (1\u2013500 characters)").action(async (claimId, opts) => {
-    const globals = program2.opts();
-    try {
-      process.chdir(repoRoot());
-    } catch {
-    }
-    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(claimId)) {
-      printError("The claim id is the `id` in the mirrored file, a uuid. `verity memory org` lists them.");
-      process.exit(1);
-    }
-    const reason = opts.reason.trim();
-    if (reason.length === 0 || reason.length > 500) {
-      printError("--reason is 1 to 500 characters.");
-      process.exit(1);
-    }
-    const tokenResult = await resolveToken(globals.token);
-    if (!tokenResult.ok) {
-      printError(tokenResult.error);
-      process.exit(1);
-    }
-    const urlResult = await resolveServiceUrl(globals.serviceUrl);
-    if (!urlResult.ok) {
-      printError(urlResult.error);
-      process.exit(1);
-    }
-    const res = await apiRequest({
-      method: "POST",
-      path: `/memory/org/claims/${claimId}/demote`,
-      serviceUrl: urlResult.data,
-      token: tokenResult.data.token,
-      body: { reason },
-      verbose: globals.verbose,
-      cmd: "memory-demote",
-      extraHeaders: { "X-Verity-Via": "cli" }
-    });
-    if (!res.ok) {
-      printError(`Could not demote the claim: ${res.error}`);
-      process.exit(1);
-    }
-    printInfo(`Demoted ${claimId} for the whole organization. Restore it from the dashboard if that was wrong.`);
-    try {
-      await pullOrgKnowledge({ serviceUrl: urlResult.data, token: tokenResult.data.token, verbose: globals.verbose, force: true });
-    } catch {
-    }
-    process.exit(0);
-  });
   memory.command("untrack").description("Stop committing .verity/memory/ \u2014 the graph stays on disk and leaves your diffs").action(() => {
     try {
       process.chdir(repoRoot());
@@ -29367,8 +27969,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.6-experimental.df0a578").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.6-experimental.df0a578");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.7").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.7");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();