@codacy/verity-cli 0.32.7 → 0.33.0-experimental.34db3a4

package/bin/verity.js

@@ -6975,10 +6975,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep3, value } = collItem;
+        const { start, key, sep: sep4, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep3?.[0],
+          next: key ?? sep4?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -6992,7 +6992,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep3) {
+          if (!keyProps.anchor && !keyProps.tag && !sep4) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -7016,7 +7016,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep3 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep4 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -7032,7 +7032,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep3, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep4, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -7123,7 +7123,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep3 = "";
+        let sep4 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -7137,13 +7137,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep3 + cb;
-              sep3 = "";
+                comment += sep4 + cb;
+              sep4 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep3 += source;
+                sep4 += source;
               hasSpace = true;
               break;
             default:
@@ -7186,18 +7186,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep3, value } = collItem;
+        const { start, key, sep: sep4, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep3?.[0],
+          next: key ?? sep4?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep3 && !value) {
+          if (!props.anchor && !props.tag && !sep4 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -7251,8 +7251,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep3 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep3, null, props, onError);
+        if (!isMap && !sep4 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep4, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -7264,7 +7264,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep3 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep4 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -7275,8 +7275,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep3)
-                for (const st of sep3) {
+              if (sep4)
+                for (const st of sep4) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -7293,7 +7293,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep3, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep4, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -7473,7 +7473,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep3 = "";
+      let sep4 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -7490,24 +7490,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep3 + indent.slice(trimIndent) + content;
-          sep3 = "\n";
+          value += sep4 + indent.slice(trimIndent) + content;
+          sep4 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep3 === " ")
-            sep3 = "\n";
-          else if (!prevMoreIndented && sep3 === "\n")
-            sep3 = "\n\n";
-          value += sep3 + indent.slice(trimIndent) + content;
-          sep3 = "\n";
+          if (sep4 === " ")
+            sep4 = "\n";
+          else if (!prevMoreIndented && sep4 === "\n")
+            sep4 = "\n\n";
+          value += sep4 + indent.slice(trimIndent) + content;
+          sep4 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep3 === "\n")
+          if (sep4 === "\n")
             value += "\n";
           else
-            sep3 = "\n";
+            sep4 = "\n";
         } else {
-          value += sep3 + content;
-          sep3 = " ";
+          value += sep4 + content;
+          sep4 = " ";
           prevMoreIndented = false;
         }
       }
@@ -7689,25 +7689,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep3 = " ";
+      let sep4 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep3 === "\n")
-            res += sep3;
+          if (sep4 === "\n")
+            res += sep4;
           else
-            sep3 = "\n";
+            sep4 = "\n";
         } else {
-          res += sep3 + match[1];
-          sep3 = " ";
+          res += sep4 + match[1];
+          sep4 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep3 + (match?.[1] ?? "");
+      return res + sep4 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -8514,14 +8514,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep3, value }) {
+    function stringifyItem({ start, key, sep: sep4, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep3)
-        for (const st of sep3)
+      if (sep4)
+        for (const st of sep4)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -9671,18 +9671,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep3;
+          let sep4;
           if (scalar.end) {
-            sep3 = scalar.end;
-            sep3.push(this.sourceToken);
+            sep4 = scalar.end;
+            sep4.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep3 = [this.sourceToken];
+            sep4 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep3 }]
+            items: [{ start, key: scalar, sep: sep4 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -9835,15 +9835,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep3 = it.sep;
-                  sep3.push(this.sourceToken);
+                  const sep4 = it.sep;
+                  sep4.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep3 }]
+                    items: [{ start: start2, key, sep: sep4 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -10037,13 +10037,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep3 = fc.end.splice(1, fc.end.length);
-            sep3.push(this.sourceToken);
+            const sep4 = fc.end.splice(1, fc.end.length);
+            sep4.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep3 }]
+              items: [{ start, key: fc, sep: sep4 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -10413,7 +10413,6 @@ var MAX_ITERATIONS = 2;
 var MAX_SPEC_FILES = 6;
 var MAX_SPEC_FILE_BYTES = 512e3;
 var MAX_TOTAL_SPEC_BYTES = 512e3;
-var MAX_EXPLICIT_SPEC_FILE_BYTES = 10240;
 var MAX_PLAN_FILES = 3;
 var MAX_PLAN_FILE_BYTES = 512e3;
 var MAX_INTENT_CHARS = 2e3;
@@ -10524,7 +10523,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10970,8 +10969,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path3.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename5 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename5)) return true;
+    const basename4 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename4)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -11534,7 +11533,7 @@ function startSpinner(label2, opts = {}) {
 }
 
 // src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
 async function githubAccountId(owner) {
   try {
@@ -12801,50 +12800,12 @@ function resolveGuardMoments(explicit) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_fs7 = require("node:fs");
-
-// src/lib/which.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
-function executableExtensions(platform, pathext) {
-  if (platform !== "win32") return [""];
-  const raw = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
-  const out = [];
-  for (const ext of raw) {
-    const lower = ext.toLowerCase();
-    if (!out.includes(lower)) out.push(lower);
-    if (!out.includes(ext)) out.push(ext);
-  }
-  return out;
-}
-function whichSync(bin, opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  const rawPath = opts.path ?? process.env.PATH ?? "";
-  if (!rawPath) return null;
-  const exts = executableExtensions(platform, opts.pathext ?? process.env.PATHEXT);
-  const real = opts.real ?? true;
-  for (const dir of rawPath.split(import_node_path7.delimiter)) {
-    if (!dir) continue;
-    for (const ext of exts) {
-      const candidate = (0, import_node_path7.join)(dir, bin + ext);
-      try {
-        if (!(0, import_node_fs5.statSync)(candidate).isFile()) continue;
-        if (platform !== "win32") (0, import_node_fs5.accessSync)(candidate, import_node_fs5.constants.X_OK);
-        return real ? (0, import_node_fs5.realpathSync)(candidate) : candidate;
-      } catch {
-        continue;
-      }
-    }
-  }
-  return null;
-}
-
-// src/lib/plugin-ownership.ts
+var import_node_fs6 = require("node:fs");
 var import_node_os2 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_path7 = require("node:path");
 
 // src/lib/stderr-log.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -12857,9 +12818,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs6.appendFileSync)(file, text);
+    (0, import_node_fs5.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -12907,8 +12868,8 @@ function markerPath() {
 }
 function readMarker() {
   try {
-    if (!(0, import_node_fs7.existsSync)(markerPath())) return null;
-    const raw = JSON.parse((0, import_node_fs7.readFileSync)(markerPath(), "utf-8"));
+    if (!(0, import_node_fs6.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs6.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
     if (!pluginRoot || CONTROL_CHARS.test(pluginRoot)) return null;
     return {
@@ -12925,23 +12886,23 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs7.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs6.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs7.writeFileSync)(markerPath(), JSON.stringify(marker));
+    (0, import_node_fs6.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
 function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".claude");
 }
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -12949,9 +12910,9 @@ function readJsonFile(path) {
 }
 function enabledPluginSetting(key) {
   const files = [
-    projectPath((0, import_node_path8.join)(".claude", "settings.local.json")),
-    projectPath((0, import_node_path8.join)(".claude", "settings.json")),
-    (0, import_node_path8.join)(claudeConfigDir(), "settings.json")
+    projectPath((0, import_node_path7.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path7.join)(".claude", "settings.json")),
+    (0, import_node_path7.join)(claudeConfigDir(), "settings.json")
   ];
   for (const file of files) {
     const map = readJsonFile(file)?.enabledPlugins;
@@ -12963,16 +12924,27 @@ function enabledPluginSetting(key) {
 }
 function marketplaceLocations() {
   const out = /* @__PURE__ */ new Map();
-  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   if (!known) return out;
   for (const [name, entry] of Object.entries(known)) {
     const loc2 = entry?.installLocation;
-    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path8.resolve)(loc2));
+    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path7.resolve)(loc2));
   }
   return out;
 }
 function verityPathEntry() {
-  return whichSync("verity", { real: false });
+  const path = process.env.PATH;
+  if (!path) return null;
+  for (const dir of path.split(import_node_path7.delimiter)) {
+    if (!dir) continue;
+    const candidate = (0, import_node_path7.join)(dir, "verity");
+    try {
+      (0, import_node_fs6.accessSync)(candidate, import_node_fs6.constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
 }
 function verityOnPath() {
   return verityPathEntry() !== null;
@@ -12981,7 +12953,7 @@ function globalVerityVersion() {
   const entry = verityPathEntry();
   if (!entry) return null;
   try {
-    const pkg = readJsonFile((0, import_node_path8.join)((0, import_node_path8.dirname)((0, import_node_fs7.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJsonFile((0, import_node_path7.join)((0, import_node_path7.dirname)((0, import_node_fs6.realpathSync)(entry)), "..", "package.json"));
     if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
     return pkg.version;
   } catch {
@@ -12993,7 +12965,7 @@ function pluginCliInvocation() {
   if (!root) return null;
   const onPath = globalVerityVersion();
   if (onPath !== null && onPath === activePluginVersion()) return null;
-  return `node ${JSON.stringify((0, import_node_path8.join)(root, "scripts", "verity.mjs"))}`;
+  return `node ${JSON.stringify((0, import_node_path7.join)(root, "scripts", "verity.mjs"))}`;
 }
 function cliVersionSkew() {
   if (!process.env.VERITY_PLUGIN_ROOT) return null;
@@ -13012,7 +12984,7 @@ var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
   const wanted = VERITY_MARKETPLACE;
   for (const file of ["settings.json", "settings.local.json"]) {
-    const path = (0, import_node_path8.join)(claudeConfigDir(), file);
+    const path = (0, import_node_path7.join)(claudeConfigDir(), file);
     const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
     const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
     if (entry2 && typeof entry2 === "object") {
@@ -13022,7 +12994,7 @@ function marketplaceConflict() {
       }
     }
   }
-  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   const entry = known?.[wanted];
   if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
     return { name: wanted, declaredAs: describeSource(entry.source) };
@@ -13043,7 +13015,7 @@ function describeSource(src) {
   return target ? `${kind} \u2192 ${target}` : kind;
 }
 function legacyMarketplaceInstall() {
-  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   for (const key of Object.keys(plugins)) {
     const at = key.lastIndexOf("@");
@@ -13055,13 +13027,13 @@ function legacyMarketplaceInstall() {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs7.realpathSync.native(p);
+    return import_node_fs6.realpathSync.native(p);
   } catch {
-    return (0, import_node_path8.resolve)(p);
+    return (0, import_node_path7.resolve)(p);
   }
 }
 function isWithin(want, dir) {
-  return want === dir || want.startsWith(dir + import_node_path8.sep);
+  return want === dir || want.startsWith(dir + import_node_path7.sep);
 }
 function entryAppliesHere(entry, here) {
   const e = entry;
@@ -13071,9 +13043,9 @@ function entryAppliesHere(entry, here) {
   return forProject === here;
 }
 function registrySays(pluginRoot) {
-  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
-  const want = (0, import_node_path8.resolve)(pluginRoot);
+  const want = (0, import_node_path7.resolve)(pluginRoot);
   const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
@@ -13082,15 +13054,15 @@ function registrySays(pluginRoot) {
     const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
     const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
-      return typeof installPath === "string" && (0, import_node_path8.resolve)(installPath) === want;
+      return typeof installPath === "string" && (0, import_node_path7.resolve)(installPath) === want;
     }) || source !== void 0 && applicable.length > 0 && isWithin(want, source);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
-      return (0, import_node_fs7.existsSync)(pluginRoot) ? "live" : "gone";
+      return (0, import_node_fs6.existsSync)(pluginRoot) ? "live" : "gone";
     }
   }
-  const managed = (0, import_node_path8.resolve)((0, import_node_path8.join)(claudeConfigDir(), "plugins", "cache"));
-  return want === managed || want.startsWith(managed + import_node_path8.sep) ? "gone" : "unverified";
+  const managed = (0, import_node_path7.resolve)((0, import_node_path7.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path7.sep) ? "gone" : "unverified";
 }
 var _live = /* @__PURE__ */ new Map();
 function pluginLiveness(pluginRoot) {
@@ -13104,7 +13076,7 @@ function clearStalePluginMarker() {
   const marker = readMarker();
   if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
   try {
-    (0, import_node_fs7.rmSync)(markerPath(), { force: true });
+    (0, import_node_fs6.rmSync)(markerPath(), { force: true });
   } catch {
     return null;
   }
@@ -13132,7 +13104,7 @@ function pluginActiveHere() {
   return activePluginInstall() !== null;
 }
 function registeredVerityPlugin() {
-  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   const here = realpathOr(repoRoot());
   for (const [key, value] of Object.entries(plugins)) {
@@ -13142,7 +13114,7 @@ function registeredVerityPlugin() {
     for (const entry of Array.isArray(value) ? value : []) {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
-      if (!installPath || !(0, import_node_fs7.existsSync)(installPath)) continue;
+      if (!installPath || !(0, import_node_fs6.existsSync)(installPath)) continue;
       if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
@@ -13327,7 +13299,7 @@ var import_node_crypto8 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs8 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
@@ -13363,7 +13335,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs8.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs7.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -13387,7 +13359,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs8.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs7.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -13680,9 +13652,9 @@ function isCommandOnlyTurn(input) {
 
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs9 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_os3 = require("node:os");
-var import_node_path9 = require("node:path");
+var import_node_path8 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
   "-",
@@ -13720,7 +13692,7 @@ function contextIdentity(input) {
   if (rawTree && !isSharedSentinel(rawTree)) {
     let resolved = rawTree;
     try {
-      resolved = import_node_fs9.realpathSync.native(rawTree);
+      resolved = import_node_fs8.realpathSync.native(rawTree);
     } catch {
     }
     treeKey = (0, import_node_crypto2.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
@@ -13736,13 +13708,13 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path9.resolve)(override) : (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path8.resolve)(override) : (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".verity");
 }
 function dossierDir(identity) {
-  return (0, import_node_path9.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
 }
 function treeDir(identity) {
-  return (0, import_node_path9.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
 }
 function scopeIdentity(token, sessionId) {
   const t = (token ?? "").trim();
@@ -13757,8 +13729,8 @@ function sessionScopeKey(token, sessionId) {
 
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs10 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_fs9 = require("node:fs");
+var import_node_path9 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -13797,7 +13769,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs10.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs9.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -13831,12 +13803,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs10.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs9.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path10.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path9.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -13850,13 +13822,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path10.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path9.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs10.existsSync)(filePath)) {
+    if ((0, import_node_fs9.existsSync)(filePath)) {
       const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises6.readFile)(filePath, "utf-8");
@@ -13867,21 +13839,213 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs10.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs9.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
     await (0, import_promises6.writeFile)(filePath, existing + line);
   } catch {
   }
 }
 
 // src/lib/memory-retrieval.ts
-var import_promises7 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 var import_node_fs11 = require("node:fs");
 var import_node_path11 = require("node:path");
+
+// src/lib/org-mirror.ts
+var import_node_fs10 = require("node:fs");
+var import_promises7 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
+var ORG_KINDS = ["decision", "security", "gotcha", "pattern", "domain", "integration"];
+var STATE_FILE = ".org-pull-state.json";
+var BODY_MAX = 8192;
+function orgMirrorDir(remote = requestRemote()) {
+  const parsed = parseRemote(remote);
+  if (!parsed) return null;
+  return (0, import_node_path10.join)(verityHome(), "orgs", parsed.host, parsed.owner.toLowerCase(), "memory");
+}
+function slugify(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
+}
+function orgNodePath(node) {
+  const kind = ORG_KINDS.includes(node.kind) ? node.kind : "domain";
+  return `${kind}/${slugify(node.title) || "claim"}-${node.tag_id.replace(/-/g, "").slice(0, 8)}.md`;
+}
+function renderOrgNode(node, orgName) {
+  const fm = [
+    "---",
+    `id: ${JSON.stringify(node.tag_id)}`,
+    `node_id: ${JSON.stringify(node.node_id)}`,
+    'scope: "org"',
+    `org: ${JSON.stringify(orgName)}`,
+    `kind: ${JSON.stringify(node.kind)}`,
+    `title: ${JSON.stringify(node.title)}`,
+    `origin: ${JSON.stringify(node.origin)}`,
+    `signal: ${JSON.stringify(node.signal)}`,
+    `tier: ${node.tier === null ? "null" : JSON.stringify(node.tier)}`,
+    `applies_to: ${JSON.stringify(node.applies_to)}`,
+    `source_repo_count: ${JSON.stringify(node.source_repo_count)}`,
+    `promoted_at: ${JSON.stringify(node.promoted_at)}`,
+    'status: "active"',
+    "---"
+  ];
+  return `${fm.join("\n")}
+
+# ${node.title}
+
+${node.body.trim()}
+`;
+}
+function parseOrgNode(content) {
+  const m = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!m) return null;
+  const fm = {};
+  for (const line of m[1].split("\n")) {
+    const kv = line.match(/^([a-z_]+):\s*(.*)$/);
+    if (!kv) continue;
+    try {
+      fm[kv[1]] = JSON.parse(kv[2]);
+    } catch {
+      fm[kv[1]] = kv[2];
+    }
+  }
+  if (fm.scope !== "org" || typeof fm.id !== "string" || typeof fm.title !== "string") return null;
+  if (fm.status && fm.status !== "active") return null;
+  const body = m[2].replace(/^\s*#[^\n]*\n/, "").trim();
+  return {
+    tag_id: fm.id,
+    node_id: typeof fm.node_id === "string" ? fm.node_id : "",
+    kind: typeof fm.kind === "string" ? fm.kind : "domain",
+    title: fm.title,
+    body,
+    origin: typeof fm.origin === "string" ? fm.origin : "",
+    signal: typeof fm.signal === "string" ? fm.signal : "",
+    tier: typeof fm.tier === "number" ? fm.tier : null,
+    applies_to: Array.isArray(fm.applies_to) ? fm.applies_to.filter((v) => typeof v === "string") : [],
+    source_repo_count: typeof fm.source_repo_count === "number" ? fm.source_repo_count : 1,
+    promoted_at: typeof fm.promoted_at === "string" ? fm.promoted_at : ""
+  };
+}
+async function readState(dir) {
+  try {
+    const parsed = JSON.parse(await (0, import_promises7.readFile)((0, import_node_path10.join)(dir, STATE_FILE), "utf-8"));
+    return {
+      version: typeof parsed?.version === "string" ? parsed.version : null,
+      organization: parsed?.organization && typeof parsed.organization.id === "string" ? parsed.organization : null,
+      files: Array.isArray(parsed?.files) ? parsed.files.filter((f) => typeof f === "string") : []
+    };
+  } catch {
+    return { version: null, organization: null, files: [] };
+  }
+}
+async function writeState(dir, state) {
+  await (0, import_promises7.mkdir)(dir, { recursive: true });
+  await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, STATE_FILE), JSON.stringify({
+    ...state.version ? { version: state.version } : {},
+    organization: state.organization,
+    pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
+    files: state.files
+  }, null, 2) + "\n");
+}
+function renderIndex(orgName, nodes) {
+  const lines = [
+    `# Org Knowledge \u2014 ${orgName}`,
+    "",
+    "*Auto-generated by verity CLI from what this organization's repositories learned. Do not hand-edit; `verity memory pull` overwrites it.*",
+    "",
+    '> These claims hold across the organization\'s repositories, not only this one. Each names where it came from. A claim that is wrong for this repository is demoted with `verity memory demote <id> --reason "\u2026"`, for everyone.',
+    ""
+  ];
+  const byKind = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKind.set(n.kind, [...byKind.get(n.kind) ?? [], n]);
+  for (const kind of ORG_KINDS) {
+    const list2 = byKind.get(kind);
+    if (!list2?.length) continue;
+    lines.push(`## ${kind}/ (${list2.length})`);
+    for (const n of list2) lines.push(`- [[${orgNodePath(n).split("/")[1].replace(/\.md$/, "")}]] \u2014 ${n.title} \xB7 ${n.origin}`);
+    lines.push("");
+  }
+  if (nodes.length === 0) lines.push("No org knowledge yet.", "");
+  return lines.join("\n");
+}
+async function pullOrgKnowledge(opts) {
+  const dir = orgMirrorDir(opts.remote ?? requestRemote());
+  if (!dir) return { ok: true, status: "no_remote", received: 0, dir: null };
+  const state = await readState(dir);
+  const params = new URLSearchParams({ for: "agent" });
+  if (!opts.force && state.version) params.set("if_version", state.version);
+  const res = await apiRequest({
+    method: "GET",
+    path: `/memory/org?${params.toString()}`,
+    serviceUrl: opts.serviceUrl,
+    token: opts.token,
+    verbose: opts.verbose,
+    timeout: opts.timeoutMs ?? 3e4,
+    cmd: "memory-org-pull"
+  });
+  if (!res.ok) return { ok: false, error: res.error, category: res.category };
+  const page = res.data;
+  if (page.unchanged) return { ok: true, status: "unchanged", received: 0, dir };
+  const org = page.organization;
+  const nodes = org ? (page.nodes ?? []).flatMap((n) => typeof n.tag_id === "string" && typeof n.title === "string" && typeof n.body === "string" ? [{
+    tag_id: n.tag_id,
+    node_id: typeof n.node_id === "string" ? n.node_id : "",
+    kind: typeof n.kind === "string" ? n.kind : "domain",
+    title: n.title,
+    body: n.body.slice(0, BODY_MAX),
+    origin: typeof n.origin === "string" ? n.origin : "",
+    signal: typeof n.signal === "string" ? n.signal : "",
+    tier: typeof n.tier === "number" ? n.tier : null,
+    applies_to: Array.isArray(n.applies_to) ? n.applies_to.filter((v) => typeof v === "string") : [],
+    source_repo_count: typeof n.source_repo_count === "number" ? n.source_repo_count : 1,
+    promoted_at: typeof n.promoted_at === "string" ? n.promoted_at : ""
+  }] : []) : [];
+  const written = /* @__PURE__ */ new Set();
+  await (0, import_promises7.mkdir)(dir, { recursive: true });
+  for (const n of nodes) {
+    const rel = orgNodePath(n);
+    if (written.has(rel)) continue;
+    await (0, import_promises7.mkdir)((0, import_node_path10.join)(dir, rel.split("/")[0]), { recursive: true });
+    await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, rel), renderOrgNode(n, org?.name ?? ""));
+    written.add(rel);
+  }
+  for (const rel of state.files) {
+    if (!written.has(rel)) await (0, import_promises7.rm)((0, import_node_path10.join)(dir, rel), { force: true });
+  }
+  await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, "index.md"), renderIndex(org?.name ?? "no organization", nodes));
+  await writeState(dir, { version: org ? page.version : null, organization: org, files: [...written].sort() });
+  return { ok: true, status: org ? "pulled" : "none", received: nodes.length, dir };
+}
+async function readOrgMirror(remote = requestRemote()) {
+  const dir = orgMirrorDir(remote);
+  if (!dir || !(0, import_node_fs10.existsSync)(dir)) return [];
+  const out = [];
+  for (const kind of ORG_KINDS) {
+    const kindDir = (0, import_node_path10.join)(dir, kind);
+    if (!(0, import_node_fs10.existsSync)(kindDir)) continue;
+    let files;
+    try {
+      files = await (0, import_promises7.readdir)(kindDir);
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      if (!file.endsWith(".md")) continue;
+      try {
+        const node = parseOrgNode(await (0, import_promises7.readFile)((0, import_node_path10.join)(kindDir, file), "utf-8"));
+        if (node) out.push(node);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+
+// src/lib/memory-retrieval.ts
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
 var MAX_BUDGET_TOKENS = 4e3;
 var MIN_SCORE = 0.5;
+var ORG_MIN_SHARED_TERMS = 2;
 function tokenize(text) {
   return new Set(
     text.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2)
@@ -13894,6 +14058,26 @@ function jaccardKeywords(a, b) {
   const union = a.size + b.size - inter;
   return union === 0 ? 0 : inter / union;
 }
+function sharedTerms(a, b) {
+  let n = 0;
+  for (const w of a) if (b.has(w)) n++;
+  return n;
+}
+function orgNodeToLocal(n) {
+  return {
+    path: `org:${n.tag_id}`,
+    nodeId: n.tag_id,
+    kind: n.kind,
+    title: n.title,
+    body: n.body.slice(0, 2e3),
+    fileGlobs: [],
+    confidence: 0.5,
+    citedCount: 0,
+    tokenEstimate: Math.ceil((n.title.length + n.body.length) / 4) + 20,
+    scope: "org",
+    origin: n.origin
+  };
+}
 function globMatch(glob, filePath) {
   if (glob === filePath) return true;
   const suffixMatch = glob.match(/^\*\*\/\*(.+)$/);
@@ -13969,19 +14153,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  if (!(0, import_node_fs11.existsSync)(memoryDir())) return null;
+  const hasRepoGraph = (0, import_node_fs11.existsSync)(memoryDir());
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
-  for (const domain of DOMAINS) {
+  for (const domain of hasRepoGraph ? DOMAINS : []) {
     const domainDir = (0, import_node_path11.join)(memoryDir(), domain);
     if (!(0, import_node_fs11.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises7.readdir)(domainDir);
+      const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises7.readFile)((0, import_node_path11.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path11.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -14001,6 +14185,13 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
     } catch {
     }
   }
+  try {
+    for (const claim of await readOrgMirror()) {
+      const local = orgNodeToLocal(claim);
+      if (sharedTerms(tokenize(`${local.title} ${local.body}`), promptTokens) >= ORG_MIN_SHARED_TERMS) nodes.push(local);
+    }
+  } catch {
+  }
   if (nodes.length === 0) return null;
   const scored = nodes.map((n) => ({
     ...n,
@@ -14019,12 +14210,13 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   const lines = [
     "## Project Knowledge (auto-injected)",
     "",
-    `*${selected.length} node(s) relevant to your current task. See \`.verity/memory/index.md\` for the full knowledge base.*`,
+    `*${selected.length} node(s) relevant to your current task. See \`.verity/memory/index.md\` for the full knowledge base${selected.some((n) => n.scope === "org") ? ", and `~/.verity/orgs/` for what the organization's other repositories learned" : ""}.*`,
     ""
   ];
   for (const node of selected) {
     lines.push(`### ${node.title}`);
-    lines.push(`*${node.kind}* \xB7 confidence ${Math.round(node.confidence * 100)}%`);
+    if (node.scope === "org") lines.push(`*org \xB7 ${node.origin}* \xB7 ${node.kind}`);
+    else lines.push(`*${node.kind}* \xB7 confidence ${Math.round(node.confidence * 100)}%`);
     lines.push("");
     lines.push(node.body.slice(0, 800));
     lines.push("");
@@ -14039,7 +14231,7 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 }
 
 // src/lib/memory-sync.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 var import_node_fs14 = require("node:fs");
 var import_node_path13 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
@@ -14154,8 +14346,8 @@ function ensureVerityGitignore() {
     }
     let text = next.join("\n");
     if (!hasMarker) {
-      const sep3 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
-      text = text + sep3 + VERITY_GITIGNORE_BLOCK;
+      const sep4 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+      text = text + sep4 + VERITY_GITIGNORE_BLOCK;
     }
     if (text !== content) (0, import_node_fs12.writeFileSync)(".gitignore", text);
     return verified(
@@ -14185,8 +14377,8 @@ function writeFencedBlock() {
   lines = fenceMemoryLines(lines);
   let text = lines.join("\n");
   if (!hasMarker) {
-    const sep3 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
-    text = text + sep3 + VERITY_GITIGNORE_BLOCK;
+    const sep4 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+    text = text + sep4 + VERITY_GITIGNORE_BLOCK;
   }
   try {
     (0, import_node_fs12.writeFileSync)(".gitignore", text);
@@ -14236,8 +14428,8 @@ function keepMemoryTracked() {
   }
   if (content.includes(MEMORY_OPT_OUT_MARKER)) return "already";
   try {
-    const sep3 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
-    (0, import_node_fs12.writeFileSync)(".gitignore", content + sep3 + MEMORY_OPT_OUT_STANZA);
+    const sep4 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
+    (0, import_node_fs12.writeFileSync)(".gitignore", content + sep4 + MEMORY_OPT_OUT_STANZA);
   } catch {
     return "failed";
   }
@@ -14299,42 +14491,6 @@ function resolveInside(baseDir, candidate) {
   }
   return full;
 }
-var O_NOFOLLOW = typeof import_node_fs13.constants.O_NOFOLLOW === "number" ? import_node_fs13.constants.O_NOFOLLOW : 0;
-function readFileInside(baseDir, candidate, maxBytes) {
-  const full = resolveInside(baseDir, candidate);
-  if (!full) return null;
-  let realParent;
-  let realBase;
-  try {
-    realParent = (0, import_node_fs13.realpathSync)((0, import_node_path12.dirname)(full));
-    realBase = (0, import_node_fs13.realpathSync)((0, import_node_path12.resolve)(baseDir));
-  } catch {
-    return null;
-  }
-  const realBaseSep = realBase.endsWith(import_node_path12.sep) ? realBase : realBase + import_node_path12.sep;
-  if (realParent !== realBase && !realParent.startsWith(realBaseSep)) return null;
-  const target = (0, import_node_path12.join)(realParent, (0, import_node_path12.basename)(full));
-  let fd = null;
-  try {
-    fd = (0, import_node_fs13.openSync)(target, import_node_fs13.constants.O_RDONLY | O_NOFOLLOW);
-    const st = (0, import_node_fs13.fstatSync)(fd);
-    if (!st.isFile()) return null;
-    const cap = Math.min(maxBytes, st.size);
-    if (cap <= 0) return "";
-    const buf = Buffer.alloc(cap);
-    const bytesRead = (0, import_node_fs13.readSync)(fd, buf, 0, cap, 0);
-    return buf.subarray(0, bytesRead).toString("utf-8");
-  } catch {
-    return null;
-  } finally {
-    if (fd !== null) {
-      try {
-        (0, import_node_fs13.closeSync)(fd);
-      } catch {
-      }
-    }
-  }
-}
 
 // src/lib/glob-match.ts
 function globToRegex(glob) {
@@ -14384,6 +14540,14 @@ function globToRegex(glob) {
   out = out.replace(/(?:\.\*)+/g, ".*");
   return new RegExp(`^${out}$`);
 }
+function globMatch2(glob, filePath) {
+  if (glob === filePath) return true;
+  try {
+    return globToRegex(glob).test(filePath);
+  } catch {
+    return false;
+  }
+}
 function anyPathMatches(glob, treePaths) {
   let regex;
   try {
@@ -14402,18 +14566,18 @@ var memoryDir2 = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS2 = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations", "_archive"];
 var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
-  await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
+  await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises8.mkdir)((0, import_node_path13.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path13.join)(memoryDir2(), domain), { recursive: true });
   }
   if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
   if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
   if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
@@ -14425,13 +14589,13 @@ async function buildManifest() {
     const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
     if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises8.readdir)(domainDir);
+      const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
         const fullPath = (0, import_node_path13.join)(memoryDir2(), filePath);
         try {
-          const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
+          const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
@@ -14442,13 +14606,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises8.readFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises8.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -14464,10 +14628,10 @@ async function readOnDiskNodes() {
     const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
     if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
-      for (const file of await (0, import_promises8.readdir)(domainDir)) {
+      for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -14479,7 +14643,7 @@ async function readOnDiskNodes() {
 async function readSyncBaseline() {
   const out = /* @__PURE__ */ new Map();
   try {
-    const parsed = JSON.parse(await (0, import_promises8.readFile)(syncStateFile(), "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
     if (Array.isArray(parsed?.nodes)) {
       for (const n of parsed.nodes) if (n?.path) out.set(n.path, n.hash ?? null);
     } else if (Array.isArray(parsed?.paths)) {
@@ -14495,15 +14659,20 @@ async function recordSyncedNodePaths() {
     const next = JSON.stringify({ schema: 2, nodes }) + "\n";
     let existing = "";
     try {
-      existing = await (0, import_promises8.readFile)(syncStateFile(), "utf-8");
+      existing = await (0, import_promises9.readFile)(syncStateFile(), "utf-8");
     } catch {
     }
     if (existing === next) return;
-    await (0, import_promises8.mkdir)(projectPath(VERITY_DIR), { recursive: true });
-    await (0, import_promises8.writeFile)(syncStateFile(), next);
+    await writeFileAtomic(syncStateFile(), next);
   } catch {
   }
 }
+async function writeFileAtomic(path, content) {
+  await (0, import_promises9.mkdir)((0, import_node_path13.dirname)(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  await (0, import_promises9.writeFile)(tmp, content);
+  await (0, import_promises9.rename)(tmp, path);
+}
 async function recordSyncBaseline() {
   await recordSyncedNodePaths();
 }
@@ -14517,7 +14686,7 @@ async function computeEditedNodeUploads() {
     if (!(0, import_node_fs14.existsSync)(full)) continue;
     let content;
     try {
-      content = await (0, import_promises8.readFile)(full, "utf-8");
+      content = await (0, import_promises9.readFile)(full, "utf-8");
     } catch {
       continue;
     }
@@ -14538,31 +14707,56 @@ async function applyMemoryWrites(writes, opts = {}) {
   let count = 0;
   const notes = [];
   const treePaths = opts.treePaths;
+  const synced = /* @__PURE__ */ new Map();
   for (const write of writes) {
-    const { written, notes: writeNotes } = await applyOneWrite(write, treePaths);
-    if (written) count++;
-    notes.push(...writeNotes);
+    const outcome = await applyOneWrite(write, treePaths, opts.lastServed);
+    if (outcome.written) count++;
+    if (outcome.syncedHash) {
+      synced.set(write.path, outcome.syncedHash);
+      opts.served?.set(write.path, outcome.syncedHash);
+    }
+    notes.push(...outcome.notes);
   }
   await regenerateIndex();
-  try {
-    await ensureClaudeMdPointer();
-  } catch {
+  if (opts.claudeMdPointer !== false) {
+    try {
+      await ensureClaudeMdPointer();
+    } catch {
+    }
   }
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises8.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
-  await recordSyncedNodePaths();
+  if (opts.baseline === "written") await mergeSyncBaseline(synced);
+  else if (opts.recordBaseline !== false) await recordSyncedNodePaths();
   return count;
 }
-async function applyOneWrite(write, treePaths) {
+async function mergeSyncBaseline(entries) {
+  if (entries.size === 0) return;
+  try {
+    if ((0, import_node_fs14.existsSync)(syncStateFile())) {
+      try {
+        JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
+      } catch {
+        return;
+      }
+    }
+    const merged = await readSyncBaseline();
+    for (const [path, hash] of entries) merged.set(path, hash);
+    const nodes = [...merged].map(([path, hash]) => ({ path, hash }));
+    await writeFileAtomic(syncStateFile(), JSON.stringify({ schema: 2, nodes }) + "\n");
+  } catch {
+  }
+}
+async function applyOneWrite(write, treePaths, lastServed) {
   const fullPath = resolveInside(memoryDir2(), write.path);
   const notes = [];
   if (!fullPath) {
-    return { written: false, notes: [`${String(write.path)}: rejected \u2014 path escapes the memory directory`] };
+    return { written: false, syncedHash: null, notes: [`${String(write.path)}: rejected \u2014 path escapes the memory directory`] };
   }
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -14575,18 +14769,22 @@ async function applyOneWrite(write, treePaths) {
   if ((0, import_node_fs14.existsSync)(fullPath)) {
     let existing = "";
     try {
-      existing = await (0, import_promises8.readFile)(fullPath, "utf-8");
+      existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
     } catch {
     }
-    if (existing === content) return { written: false, notes };
+    if (existing === content) return { written: false, syncedHash: hashContent(content), notes };
     if (existing !== "") {
-      notes.push(`${write.path}: kept local edit (differs from server)`);
-      return { written: false, notes };
+      const served = lastServed?.get(write.path);
+      if (served == null || served !== hashContent(existing)) {
+        notes.push(`${write.path}: kept local edit (differs from server)`);
+        return { written: false, syncedHash: null, notes };
+      }
+      notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
     }
   }
-  await (0, import_promises8.mkdir)((0, import_node_path13.dirname)(fullPath), { recursive: true });
-  await (0, import_promises8.writeFile)(fullPath, content);
-  return { written: true, notes };
+  await (0, import_promises9.mkdir)((0, import_node_path13.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.writeFile)(fullPath, content);
+  return { written: true, syncedHash: hashContent(content), notes };
 }
 function groundFileGlobs(content, treePaths) {
   const globs = pickFrontmatterArray(content, "file_globs");
@@ -14628,7 +14826,7 @@ async function regenerateIndex() {
     const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
     if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises8.readdir)(domainDir);
+      const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       if (mdFiles.length === 0) continue;
       lines.push(`## ${domain}/ (${mdFiles.length})`);
@@ -14636,7 +14834,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -14663,11 +14861,11 @@ async function regenerateIndex() {
   const indexPath = (0, import_node_path13.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
-    existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
+    existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
   } catch {
   }
   if (existing === next) return;
-  await (0, import_promises8.writeFile)(indexPath, next);
+  await (0, import_promises9.writeFile)(indexPath, next);
 }
 function pickFrontmatter(content, key) {
   const re = new RegExp(`^${key}:\\s*"?([^"\\n]+?)"?\\s*$`, "m");
@@ -14694,6 +14892,169 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "Knowledge the organization's other repositories learned is mirrored outside the",
+  "repo at `~/.verity/orgs/<host>/<owner>/memory/` (`verity memory org` lists it).",
+  "Each claim says where it came from; one that is wrong here is demoted for",
+  'everyone with `verity memory demote <id> --reason "\u2026"`.',
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "## Post-task reflection",
+  "",
+  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
+  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
+  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
+  "cited with the files / PR / commands / error-signatures it came from. Skip",
+  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
+  "because nothing reviews the reflection before it lands.",
+  "",
+  "Then record it straight away. There is no confirm step, in any environment:",
+  "",
+  "```bash",
+  'verity reflect --user-input "<your draft>" --kind <kind>',
+  "```",
+  "",
+  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
+  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
+  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
+  "Never claim the second for your own draft, however good it is.",
+  "",
+  "**Name the files in the text.** Verity scopes the reflection to the paths it",
+  "cites, and a reflection that names no file in this repo is never retrieved for",
+  "a later review \u2014 it is recorded and then invisible. The command says so when it",
+  'happens; `--file-globs "<path or glob>"` is the fix when the prose cannot carry',
+  "the paths.",
+  "",
+  "Then tell the user, in one line, what you recorded and where: the command",
+  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
+  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
+  "that file is how they correct it.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_ORG = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "## Post-task reflection",
+  "",
+  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
+  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
+  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
+  "cited with the files / PR / commands / error-signatures it came from. Skip",
+  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
+  "because nothing reviews the reflection before it lands.",
+  "",
+  "Then record it straight away. There is no confirm step, in any environment:",
+  "",
+  "```bash",
+  'verity reflect --user-input "<your draft>" --kind <kind>',
+  "```",
+  "",
+  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
+  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
+  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
+  "Never claim the second for your own draft, however good it is.",
+  "",
+  "**Name the files in the text.** Verity scopes the reflection to the paths it",
+  "cites, and a reflection that names no file in this repo is never retrieved for",
+  "a later review \u2014 it is recorded and then invisible. The command says so when it",
+  'happens; `--file-globs "<path or glob>"` is the fix when the prose cannot carry',
+  "the paths.",
+  "",
+  "Then tell the user, in one line, what you recorded and where: the command",
+  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
+  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
+  "that file is how they correct it.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_AUTORECORD = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -14897,7 +15258,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
   const claudeMdPath = (0, import_node_path13.join)(cwd, "CLAUDE.md");
   let existing = "";
   if ((0, import_node_fs14.existsSync)(claudeMdPath)) {
-    existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
+    existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
   let endTag = CLAUDE_MD_END;
@@ -14953,7 +15314,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
     next = existing.replace(/\n*$/, "") + "\n\n" + block + "\n";
   }
   if (next === existing) return;
-  await (0, import_promises8.writeFile)(claudeMdPath, next);
+  await (0, import_promises9.writeFile)(claudeMdPath, next);
 }
 function extractPreserveContent(interior) {
   for (const [start, end] of [
@@ -14972,6 +15333,8 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_ORG,
+    CLAUDE_MD_PROSE_PRE_AUTORECORD,
     CLAUDE_MD_PROSE_PRE_REFLECT,
     CLAUDE_MD_PROSE_PRE_WAIVE,
     CLAUDE_MD_PROSE_PRE_IGNORE,
@@ -16591,21 +16954,112 @@ async function fireClassify(prompt, sessionId, globals) {
 
 // src/commands/lifecycle.ts
 var import_node_fs23 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 
 // src/lib/baseline.ts
 var import_node_fs22 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 var import_node_crypto9 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs21 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 
 // src/lib/files.ts
+var import_node_path18 = require("node:path");
+
+// src/lib/safe-read.ts
 var import_node_fs20 = require("node:fs");
 var import_node_path17 = require("node:path");
+var FLAGS = import_node_fs20.constants;
+var NOFOLLOW = FLAGS.O_NOFOLLOW;
+var NONBLOCK = FLAGS.O_NONBLOCK;
+function closeOpened(fd) {
+  try {
+    (0, import_node_fs20.closeSync)(fd);
+  } catch {
+  }
+}
+function isInsideRoot(realRoot, realPath) {
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path17.sep) ? realRoot : realRoot + import_node_path17.sep);
+}
+function sameOpenedFile(opened, current, nofollowAvailable) {
+  if (!nofollowAvailable && (opened.ino === 0n || current.ino === 0n)) return false;
+  return opened.ino === current.ino && opened.dev === current.dev;
+}
+function openRegularInRoot(root, path) {
+  const full = (0, import_node_path17.isAbsolute)(path) ? path : (0, import_node_path17.join)(root, path);
+  let fd;
+  try {
+    fd = (0, import_node_fs20.openSync)(full, import_node_fs20.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
+  } catch (err) {
+    const code = err.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "EFTYPE") return { ok: false, reason: "symlink" };
+    if (code === "ENOENT" || code === "ENOTDIR") return { ok: false, reason: "missing" };
+    return { ok: false, reason: "unreadable" };
+  }
+  try {
+    const opened = (0, import_node_fs20.fstatSync)(fd, { bigint: true });
+    if (!opened.isFile()) {
+      closeOpened(fd);
+      return { ok: false, reason: "not-regular" };
+    }
+    const realRoot = import_node_fs20.realpathSync.native(root);
+    const realPath = import_node_fs20.realpathSync.native(full);
+    if (!isInsideRoot(realRoot, realPath)) {
+      closeOpened(fd);
+      return { ok: false, reason: "outside-root" };
+    }
+    const current = (0, import_node_fs20.statSync)(realPath, { bigint: true });
+    if (!sameOpenedFile(opened, current, NOFOLLOW !== void 0)) {
+      closeOpened(fd);
+      return { ok: false, reason: NOFOLLOW === void 0 ? "unreadable" : "outside-root" };
+    }
+    return { ok: true, fd, size: Number(opened.size), mtimeMs: Number(opened.mtimeMs) };
+  } catch {
+    closeOpened(fd);
+    return { ok: false, reason: "unreadable" };
+  }
+}
+function statRegularInRoot(root, path) {
+  const opened = openRegularInRoot(root, path);
+  if (!opened.ok) return opened;
+  closeOpened(opened.fd);
+  return { ok: true, size: opened.size, mtimeMs: opened.mtimeMs };
+}
+function readOpened(fd, size) {
+  try {
+    const buffer = Buffer.alloc(size);
+    let offset = 0;
+    while (offset < size) {
+      const n = (0, import_node_fs20.readSync)(fd, buffer, offset, size - offset, offset);
+      if (n === 0) break;
+      offset += n;
+    }
+    return buffer.subarray(0, offset);
+  } finally {
+    closeOpened(fd);
+  }
+}
+function readOpenedUtf8(fd, size) {
+  return readOpened(fd, size).toString("utf-8");
+}
+function readRegularFileInRoot(root, path, maxBytes) {
+  const opened = openRegularInRoot(root, path);
+  if (!opened.ok) return opened;
+  if (opened.size > maxBytes) {
+    closeOpened(opened.fd);
+    return { ok: false, reason: "too-large", size: opened.size };
+  }
+  try {
+    return { ok: true, content: readOpenedUtf8(opened.fd, opened.size), size: opened.size };
+  } catch {
+    return { ok: false, reason: "unreadable" };
+  }
+}
+
+// src/lib/files.ts
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -16673,19 +17127,14 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path17.extname)(filepath).slice(1);
+  const ext = (0, import_node_path18.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
   const withMtime = files.map((f) => {
-    const resolved = resolveFile(f);
-    if (!resolved) return null;
-    try {
-      const stat3 = (0, import_node_fs20.statSync)(resolved);
-      return { path: f, resolved, mtime: stat3.mtimeMs };
-    } catch {
-      return null;
-    }
+    const stat3 = statRegularInRoot(process.cwd(), f);
+    if (stat3.ok) return { path: f, mtime: stat3.mtimeMs };
+    return stat3.reason === "missing" ? null : { path: f, mtime: Number.NEGATIVE_INFINITY };
   }).filter((x) => x !== null);
   withMtime.sort((a, b) => b.mtime - a.mtime);
   return withMtime.map((x) => x.path);
@@ -16707,23 +17156,22 @@ function collectCodeDelta(files, opts) {
       droppedPaths.push(filepath);
       continue;
     }
-    const resolved = resolveFile(filepath);
-    if (!resolved) {
-      exclude(filepath, "path-not-resolvable");
-      continue;
-    }
-    let size;
-    try {
-      size = (0, import_node_fs20.statSync)(resolved).size;
-    } catch {
-      exclude(filepath, "not-stattable");
+    const opened = openRegularInRoot(process.cwd(), filepath);
+    if (!opened.ok) {
+      exclude(
+        filepath,
+        opened.reason === "symlink" || opened.reason === "outside-root" ? "symlink" : opened.reason === "missing" ? "path-not-resolvable" : "not-stattable"
+      );
       continue;
     }
+    const size = opened.size;
     if (size > maxFileBytes) {
+      closeOpened(opened.fd);
       exclude(filepath, `over-file-size-limit-${maxFileBytes}b`);
       continue;
     }
     if (totalSize + size > maxTotalBytes) {
+      closeOpened(opened.fd);
       truncationReason ??= "max_total_bytes";
       const idx = sorted.indexOf(filepath);
       droppedPaths.push(...sorted.slice(idx));
@@ -16731,7 +17179,7 @@ function collectCodeDelta(files, opts) {
     }
     let content;
     try {
-      content = (0, import_node_fs20.readFileSync)(resolved, "utf-8");
+      content = readOpenedUtf8(opened.fd, size);
     } catch {
       exclude(filepath, "not-readable");
       continue;
@@ -16776,7 +17224,7 @@ function generateSnapshotDiffs(files) {
   const diffs = [];
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path18.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path19.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
     if ((0, import_node_fs21.existsSync)(snapshotPath)) {
       const oldContent = (0, import_node_fs21.readFileSync)(snapshotPath, "utf-8");
@@ -16804,16 +17252,16 @@ function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path18.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path19.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs21.mkdirSync)((0, import_node_path18.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs21.mkdirSync)((0, import_node_path19.dirname)(snapshotPath), { recursive: true });
     (0, import_node_fs21.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path18.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path18.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path19.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path19.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
     (0, import_node_fs21.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs21.writeFileSync)(tmpOld, oldContent);
@@ -16846,7 +17294,7 @@ function cleanStaleSnapshots(dir, keepSet) {
     const entries = (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
-      const fullPath = (0, import_node_path18.join)(dir, entry.name);
+      const fullPath = (0, import_node_path19.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
@@ -16875,13 +17323,13 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto9.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path19.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path20.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path19.join)(dir, "manifest.json");
+  return (0, import_node_path20.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path19.join)(dir, "files", repoRelPath);
+  return (0, import_node_path20.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
@@ -16943,7 +17391,7 @@ function captureBaseline(opts = {}) {
     (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path19.join)(dir, "files");
+  const filesDir = (0, import_node_path20.join)(dir, "files");
   const mirrored = [];
   try {
     (0, import_node_fs22.mkdirSync)(filesDir, { recursive: true });
@@ -16953,7 +17401,7 @@ function captureBaseline(opts = {}) {
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(dest), { recursive: true });
+        (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
         (0, import_node_fs22.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
@@ -17061,7 +17509,7 @@ function absorbIntoBaseline(paths, sessionId) {
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
-      (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(dest), { recursive: true });
+      (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
       (0, import_node_fs22.writeFileSync)(dest, content);
       dirty.add(p);
       adopted++;
@@ -17109,7 +17557,7 @@ function pruneOldBaselines() {
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path19.join)(root, name);
+    const dir = (0, import_node_path20.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
@@ -17297,7 +17745,7 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path20.join)(root, file);
+        const abs = (0, import_node_path21.join)(root, file);
         return (0, import_node_fs23.existsSync)(abs) ? (0, import_node_fs23.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
@@ -17334,17 +17782,17 @@ async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
-    const timeout = new Promise((resolve5) => setTimeout(() => resolve5({}), 500));
-    const read = new Promise((resolve5) => {
+    const timeout = new Promise((resolve6) => setTimeout(() => resolve6({}), 500));
+    const read = new Promise((resolve6) => {
       process.stdin.on("data", (c) => chunks.push(c));
       process.stdin.on("end", () => {
         try {
-          resolve5(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
+          resolve6(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
         } catch {
-          resolve5({});
+          resolve6({});
         }
       });
-      process.stdin.on("error", () => resolve5({}));
+      process.stdin.on("error", () => resolve6({}));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -17354,25 +17802,25 @@ async function readHookStdin() {
 }
 
 // src/commands/standard.ts
-var import_promises12 = require("node:fs/promises");
+var import_promises13 = require("node:fs/promises");
 var import_node_fs30 = require("node:fs");
 var import_yaml3 = __toESM(require_dist());
 
 // src/lib/synthesize.ts
 var import_node_child_process9 = require("node:child_process");
 var import_node_fs26 = require("node:fs");
-var import_promises9 = require("node:fs/promises");
-var import_node_path23 = require("node:path");
+var import_promises10 = require("node:fs/promises");
+var import_node_path24 = require("node:path");
 var import_yaml = __toESM(require_dist());
 
 // src/lib/data-dir.ts
 var import_node_fs24 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 function resolveDataDir() {
   const candidates2 = [
-    (0, import_node_path21.join)(__dirname, "..", "data"),
+    (0, import_node_path22.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path21.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path22.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
     // THE COMMITTED SOURCE, for a source checkout that has not been built.
     // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
@@ -17381,14 +17829,14 @@ function resolveDataDir() {
     // without this the synthesizer throws "Could not find Verity skill data"
     // for every test and every `verity` run from source. Resolved from this
     // module's own location, never the cwd: see the warning below.
-    (0, import_node_path21.join)(__dirname, "..", "..", "client"),
+    (0, import_node_path22.join)(__dirname, "..", "..", "client"),
     // bundled: cli/bin/ → ../../client
-    (0, import_node_path21.join)(__dirname, "..", "..", "..", "client"),
+    (0, import_node_path22.join)(__dirname, "..", "..", "..", "client"),
     // tsx: cli/src/lib/ → ../../../client
     ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs24.existsSync)((0, import_node_path21.join)(candidate, "skills"))) {
+    if ((0, import_node_fs24.existsSync)((0, import_node_path22.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -17397,13 +17845,13 @@ function resolveDataDir() {
   );
 }
 function setupDataPath(file) {
-  return (0, import_node_path21.join)(resolveDataDir(), "skills", "verity-setup", file);
+  return (0, import_node_path22.join)(resolveDataDir(), "skills", "verity-setup", file);
 }
 
 // src/lib/detect.ts
 var import_node_child_process8 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -17467,18 +17915,18 @@ function walk(root) {
     for (const entry of entries) {
       if (found.length >= WALK_MAX_FILES) return;
       if (IGNORED_SEGMENTS.includes(entry.name)) continue;
-      const full = (0, import_node_path22.join)(dir, entry.name);
+      const full = (0, import_node_path23.join)(dir, entry.name);
       if (entry.isDirectory()) visit(full, depth + 1);
-      else if (entry.isFile()) found.push((0, import_node_path22.relative)(root, full));
+      else if (entry.isFile()) found.push((0, import_node_path23.relative)(root, full));
     }
   };
   visit(root, 0);
   return found;
 }
 function languageOf(path) {
-  const name = (0, import_node_path22.basename)(path);
+  const name = (0, import_node_path23.basename)(path);
   if (/^Dockerfile(\..+)?$/i.test(name)) return "dockerfile";
-  if (!(0, import_node_path22.extname)(name)) return null;
+  if (!(0, import_node_path23.extname)(name)) return null;
   const lang = detectLanguage(path);
   return lang || null;
 }
@@ -17560,12 +18008,12 @@ function declaredDependencies(root, files) {
       if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
     }
   };
-  readPackageJson((0, import_node_path22.join)(root, "package.json"));
-  const nested = files.filter((f) => f.includes("/") && (0, import_node_path22.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
-  for (const rel of nested) readPackageJson((0, import_node_path22.join)(root, rel));
+  readPackageJson((0, import_node_path23.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path23.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path23.join)(root, rel));
   const pythonManifests = [
-    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path22.join)(root, f)),
-    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path22.join)(root, f))
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path23.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path23.join)(root, f))
   ];
   for (const path of pythonManifests) {
     if (!(0, import_node_fs25.existsSync)(path)) continue;
@@ -17580,8 +18028,8 @@ function declaredDependencies(root, files) {
     }
   }
   const goMods = [
-    (0, import_node_path22.join)(root, "go.mod"),
-    ...files.filter((f) => f.includes("/") && (0, import_node_path22.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path22.join)(root, f))
+    (0, import_node_path23.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path23.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path23.join)(root, f))
   ];
   for (const path of goMods) {
     if (!(0, import_node_fs25.existsSync)(path)) continue;
@@ -17594,7 +18042,7 @@ function declaredDependencies(root, files) {
     }
   }
   for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
-    const path = (0, import_node_path22.join)(root, file);
+    const path = (0, import_node_path23.join)(root, file);
     if (!(0, import_node_fs25.existsSync)(path)) continue;
     try {
       const text = (0, import_node_fs25.readFileSync)(path, "utf-8");
@@ -17605,7 +18053,7 @@ function declaredDependencies(root, files) {
   return names2;
 }
 function detectBuildSystem(root, files) {
-  const has = (f) => (0, import_node_fs25.existsSync)((0, import_node_path22.join)(root, f)) || files.some((p) => (0, import_node_path22.basename)(p) === f);
+  const has = (f) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, f)) || files.some((p) => (0, import_node_path23.basename)(p) === f);
   if (has("pnpm-lock.yaml")) return "pnpm";
   if (has("yarn.lock")) return "yarn";
   if (has("bun.lock") || has("bun.lockb")) return "bun";
@@ -17622,8 +18070,8 @@ function detectBuildSystem(root, files) {
 }
 function detectArchitecture(root, files) {
   const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
-  if (workspaceMarkers.some((m) => (0, import_node_fs25.existsSync)((0, import_node_path22.join)(root, m)))) return "monorepo";
-  const pkg = readJson((0, import_node_path22.join)(root, "package.json"));
+  if (workspaceMarkers.some((m) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, m)))) return "monorepo";
+  const pkg = readJson((0, import_node_path23.join)(root, "package.json"));
   if (pkg && "workspaces" in pkg) return "monorepo";
   const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
   const nested = manifests.filter((f) => f.includes("/"));
@@ -17645,7 +18093,7 @@ function measureAvgFileLength(root, files, languages) {
   let total = 0;
   let counted = 0;
   for (let i = 0; i < candidates2.length; i += stride) {
-    const path = (0, import_node_path22.join)(root, candidates2[i]);
+    const path = (0, import_node_path23.join)(root, candidates2[i]);
     try {
       if ((0, import_node_fs25.statSync)(path).size > 2 * 1024 * 1024) continue;
       total += (0, import_node_fs25.readFileSync)(path, "utf-8").split("\n").length;
@@ -17678,14 +18126,14 @@ function detectProject(root = repoRoot()) {
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
     for (const marker of markers) {
-      if ((0, import_node_fs25.existsSync)((0, import_node_path22.join)(root, marker))) {
+      if ((0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, marker))) {
         existingToolConfigs.push({ tool, path: `./${marker}` });
         break;
       }
     }
   }
   return {
-    projectName: (0, import_node_path22.basename)(root),
+    projectName: (0, import_node_path23.basename)(root),
     languages,
     languageCounts,
     frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
@@ -18129,10 +18577,10 @@ async function correctVerityMdVersion(opts) {
     origin: { kind: "synthesized", tools: opts.tools }
   }));
 }
-async function writeFileTo(relative3, body) {
-  const target = projectPath(relative3);
-  await (0, import_promises9.mkdir)((0, import_node_path23.dirname)(target), { recursive: true });
-  await (0, import_promises9.writeFile)(target, body);
+async function writeFileTo(relative2, body) {
+  const target = projectPath(relative2);
+  await (0, import_promises10.mkdir)((0, import_node_path24.dirname)(target), { recursive: true });
+  await (0, import_promises10.writeFile)(target, body);
 }
 async function deriveConfigForStandard(standard) {
   const spec = standard.knowledge_spec ?? {};
@@ -18189,14 +18637,14 @@ ${validation.detail}`);
 }
 
 // src/lib/setup-state.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_node_fs27 = require("node:fs");
 var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
 async function readSetupState() {
   const path = projectPath(SETUP_STATE_FILE);
   if (!(0, import_node_fs27.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse(await (0, import_promises10.readFile)(path, "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises11.readFile)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -18211,7 +18659,7 @@ async function writeSetupState(patch) {
 
 // src/lib/push-setup.ts
 var import_node_fs29 = require("node:fs");
-var import_promises11 = require("node:fs/promises");
+var import_promises12 = require("node:fs/promises");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/verityignore.ts
@@ -18380,7 +18828,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   const standardPath = projectPath(STANDARD_FILE);
   if (pushStandard && (0, import_node_fs29.existsSync)(standardPath)) {
     try {
-      const content = (0, import_yaml2.parse)(await (0, import_promises11.readFile)(standardPath, "utf-8"));
+      const content = (0, import_yaml2.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
       const upload = buildStandardUpload(content, readVerityIgnoreRaw());
       if (upload.warning) lines.push(upload.warning);
       const result = await apiRequest({
@@ -18405,7 +18853,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   if (pushConfig && (0, import_node_fs29.existsSync)(configPath)) {
     try {
-      const content = JSON.parse(await (0, import_promises11.readFile)(configPath, "utf-8"));
+      const content = JSON.parse(await (0, import_promises12.readFile)(configPath, "utf-8"));
       const result = await apiRequest({
         method: "POST",
         path: "/analysis-configs",
@@ -18439,7 +18887,7 @@ function registerStandardCommands(program2) {
         printError(`No ${STANDARD_FILE} here \u2014 run "verity standard synthesize" to create one.`);
         process.exit(1);
       }
-      const content = (0, import_yaml3.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
+      const content = (0, import_yaml3.parse)(await (0, import_promises13.readFile)(standardPath, "utf-8"));
       const derived = await deriveConfigForStandard(content);
       for (const path of derived.written) printInfo(`  ${path} \u2713`);
       for (const note of derived.notes) printWarn(`  ${note}`);
@@ -18495,7 +18943,7 @@ function registerStandardCommands(program2) {
     }
     let yamlContent;
     try {
-      yamlContent = await (0, import_promises12.readFile)(opts.file, "utf-8");
+      yamlContent = await (0, import_promises13.readFile)(opts.file, "utf-8");
     } catch {
       printError(`Cannot read ${opts.file}`);
       process.exit(1);
@@ -18592,7 +19040,7 @@ function parseIntensity(value) {
 }
 
 // src/commands/config.ts
-var import_promises13 = require("node:fs/promises");
+var import_promises14 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
   config.command("service-url").description("Print the resolved service URL (used by the shipped skills)").action(async () => {
@@ -18638,7 +19086,7 @@ function registerConfigCommands(program2) {
     }
     let content;
     try {
-      const raw = await (0, import_promises13.readFile)(opts.file, "utf-8");
+      const raw = await (0, import_promises14.readFile)(opts.file, "utf-8");
       content = JSON.parse(raw);
     } catch {
       printError(`Cannot read or parse ${opts.file}`);
@@ -18747,7 +19195,9 @@ function formatRunDetail(run2) {
       if (f.description && f.description !== title) lines.push(`      ${f.description}`);
       const fix = f.fix?.description ?? f.suggestion;
       if (fix) lines.push(`      \u21B3 fix: ${fix}`);
-      if (f.scope === "pre-existing") lines.push("      (pre-existing)");
+      if (f.scope === "pre-existing") {
+        lines.push(f.provenance === "caused-elsewhere" ? "      (caused elsewhere \u2014 not by this change)" : "      (pre-existing)");
+      }
     }
   }
   const pending = run2.pending_items ?? [];
@@ -19447,6 +19897,10 @@ function rgInvocations(env = process.env) {
   out.push({ cmd: `${(0, import_node_os4.homedir)()}/.local/bin/claude`, argv0: "rg" });
   return out;
 }
+function ripgrepEnv(base = process.env) {
+  const { RIPGREP_CONFIG_PATH: _dropped, ...rest } = base;
+  return rest;
+}
 var MAX_SYMBOLS = 12;
 var MAX_SITES = 24;
 var MAX_SITES_PER_FILE = 3;
@@ -19943,6 +20397,112 @@ function partitionSites(rgLines, symbols, opts) {
   while (callers.length + tests.length > MAX_SITES) callers.pop();
   return { callers, tests, dropped };
 }
+var MAX_IMPORTERS = 12;
+var MAX_IMPORTERS_PER_FILE = 2;
+function moduleKey(path) {
+  return path.replace(/\.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i, "").replace(/\/index$/, "");
+}
+function importSpecifier(text) {
+  const m = /(?:\bfrom|\brequire\s*\(|\bimport\s*\(|^\s*import)\s*['"]([^'"\n]+)['"]/.exec(text);
+  return m?.[1] ?? null;
+}
+function resolveSpecifier(fromFile, spec) {
+  if (!spec.startsWith(".")) return null;
+  const dir = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
+  const out = [];
+  for (const part of (dir ? dir.split("/") : []).concat(spec.split("/"))) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") {
+      if (out.length === 0) return null;
+      out.pop();
+      continue;
+    }
+    out.push(part);
+  }
+  return out.length > 0 ? moduleKey(out.join("/")) : null;
+}
+function partitionImporters(rgLines, changedPaths, opts) {
+  const changedByKey = /* @__PURE__ */ new Map();
+  for (const p of changedPaths) changedByKey.set(moduleKey(p), p);
+  const hits = rgLines.map(parseRgLine).filter((h) => h !== null);
+  hits.sort((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line);
+  const perFile = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const h of hits) {
+    if (out.length >= MAX_IMPORTERS) break;
+    if (opts.sentPaths.has(h.file)) continue;
+    if (opts.isExcluded(h.file)) continue;
+    if (!isCodeSiteFile(h.file)) continue;
+    const spec = importSpecifier(h.text);
+    if (!spec) continue;
+    const resolved = resolveSpecifier(h.file, spec);
+    if (!resolved) continue;
+    const changed = changedByKey.get(resolved);
+    if (!changed) continue;
+    const used = perFile.get(h.file) ?? 0;
+    if (used >= MAX_IMPORTERS_PER_FILE) continue;
+    perFile.set(h.file, used + 1);
+    out.push({ file: h.file, line: h.line, text: h.text.trim().slice(0, SITE_TEXT_MAX), symbol: changed });
+  }
+  return out;
+}
+function runRg(args, cwd, timeoutMs) {
+  let res = null;
+  for (const inv of rgInvocations()) {
+    res = (0, import_node_child_process10.spawnSync)(inv.cmd, args, {
+      ...inv.argv0 ? { argv0: inv.argv0 } : {},
+      cwd,
+      env: ripgrepEnv(),
+      timeout: timeoutMs,
+      maxBuffer: 4 * 1024 * 1024,
+      encoding: "utf8"
+    });
+    if (res.error?.code !== "ENOENT") break;
+  }
+  if (!res || res.error?.code === "ENOENT") {
+    return { ok: false, reason: "no-tool" };
+  }
+  if (res.error) {
+    const code = res.error.code;
+    return { ok: false, reason: code === "ETIMEDOUT" ? "timeout" : "error" };
+  }
+  if (res.signal) return { ok: false, reason: "timeout" };
+  if (res.status !== 0 && res.status !== 1) return { ok: false, reason: "error" };
+  return { ok: true, lines: (res.stdout ?? "").split("\n").map((l) => l.replace(/^\.\//, "")).filter(Boolean) };
+}
+function findImporters(input) {
+  const basenames = [
+    ...new Set(input.changedPaths.map((p) => moduleKey(p).split("/").pop() ?? "").filter((b) => b.length > 0))
+  ].slice(0, MAX_SYMBOLS);
+  if (basenames.length === 0) return [];
+  const res = runRg(
+    [
+      "--no-config",
+      "-n",
+      "-w",
+      "-F",
+      "--no-heading",
+      "--color",
+      "never",
+      "-m",
+      "8",
+      "--max-columns",
+      "300",
+      "--max-columns-preview",
+      ...basenames.flatMap((b) => ["-e", b]),
+      "-g",
+      "!**/{dist,build,out,vendor,node_modules,.git,coverage,target,__pycache__}/**",
+      "./"
+    ],
+    input.cwd,
+    input.timeoutMs
+  );
+  if (!res.ok) return [];
+  return partitionImporters(res.lines, input.changedPaths, {
+    sentPaths: input.sentPaths,
+    isExcluded: input.isExcluded
+  });
+}
 function buildRepoContext(input) {
   const started = Date.now();
   let signalsByPath;
@@ -19977,7 +20537,18 @@ function buildRepoContext(input) {
   const unsupportedExts = [...unsupported].sort().slice(0, 8);
   const audit = unsupportedExts.length > 0 ? { unsupported_exts: unsupportedExts } : {};
   const symbols = rankSymbols([...new Set(collected)]);
+  const changedPaths = [.../* @__PURE__ */ new Set([...signalsByPath.keys(), ...input.deltaFiles.map((f) => f.path)])];
+  const importers = findImporters({
+    changedPaths,
+    sentPaths: input.sentPaths,
+    isExcluded: input.isExcluded,
+    cwd: input.cwd ?? process.cwd(),
+    timeoutMs: input.timeoutMs ?? RG_TIMEOUT_MS
+  });
   if (symbols.length === 0) {
+    if (importers.length > 0) {
+      return { state: "ok", symbols: [], ...audit, callers: [], tests: [], importers, elapsed_ms: Date.now() - started };
+    }
     const everySupportedFileFoundNothing = unsupportedExts.length > 0;
     return {
       state: "absent",
@@ -19986,6 +20557,9 @@ function buildRepoContext(input) {
     };
   }
   const args = [
+    // `--no-config` + RIPGREP_CONFIG_PATH scrubbed below: a config file can add
+    // `--pre=<command>`, which runs a program per searched file.
+    "--no-config",
     "-n",
     "-w",
     "-F",
@@ -20013,33 +20587,19 @@ function buildRepoContext(input) {
     "!**/{dist,build,out,vendor,node_modules,.git,coverage,target,__pycache__}/**",
     "./"
   ];
-  let res = null;
-  for (const inv of rgInvocations()) {
-    res = (0, import_node_child_process10.spawnSync)(inv.cmd, args, {
-      ...inv.argv0 ? { argv0: inv.argv0 } : {},
-      cwd: input.cwd ?? process.cwd(),
-      timeout: input.timeoutMs ?? RG_TIMEOUT_MS,
-      maxBuffer: 4 * 1024 * 1024,
-      encoding: "utf8"
-    });
-    if (res.error?.code !== "ENOENT") break;
-  }
-  if (!res || res.error?.code === "ENOENT") {
-    return { state: "absent", reason: "no-tool", symbols, ...audit };
-  }
-  if (res.error) {
-    const code = res.error.code;
-    if (code === "ETIMEDOUT") return { state: "absent", reason: "timeout", symbols, ...audit };
-    return { state: "absent", reason: "error", symbols, ...audit };
+  const res = runRg(args, input.cwd ?? process.cwd(), input.timeoutMs ?? RG_TIMEOUT_MS);
+  if (!res.ok) {
+    if (importers.length > 0) {
+      return { state: "ok", symbols, ...audit, callers: [], tests: [], importers, elapsed_ms: Date.now() - started };
+    }
+    return { state: "absent", reason: res.reason, symbols, ...audit };
   }
-  if (res.signal) return { state: "absent", reason: "timeout", symbols, ...audit };
-  if (res.status !== 0 && res.status !== 1) return { state: "absent", reason: "error", symbols, ...audit };
-  const lines = (res.stdout ?? "").split("\n").map((l) => l.replace(/^\.\//, "")).filter(Boolean);
+  const lines = res.lines;
   const { callers, tests, dropped } = partitionSites(lines, symbols, {
     sentPaths: input.sentPaths,
     isExcluded: input.isExcluded
   });
-  if (callers.length === 0 && tests.length === 0) {
+  if (callers.length === 0 && tests.length === 0 && importers.length === 0) {
     return {
       state: "absent",
       reason: "no-sites",
@@ -20056,6 +20616,7 @@ function buildRepoContext(input) {
     ...audit,
     callers,
     tests,
+    ...importers.length > 0 ? { importers } : {},
     elapsed_ms: Date.now() - started
   };
 }
@@ -20123,12 +20684,17 @@ function upgradeToExcerpts(rc, opts) {
 }
 function describeRepoContext(rc) {
   if (rc.state !== "ok") {
-    const exts = rc.unsupported_exts?.length ? ` \xB7 no rules for: ${rc.unsupported_exts.join(", ")}` : "";
-    return `absent (${rc.reason ?? "unknown"})${exts}`;
+    const bits = [
+      rc.symbols?.length ? `searched: ${rc.symbols.join(", ")}` : "",
+      rc.dropped_symbols?.length ? `dropped too-common: ${rc.dropped_symbols.join(", ")}` : "",
+      rc.unsupported_exts?.length ? `no rules for: ${rc.unsupported_exts.join(", ")}` : ""
+    ].filter(Boolean);
+    return `absent (${rc.reason ?? "unknown"})${bits.length > 0 ? ` \xB7 ${bits.join(" \xB7 ")}` : ""}`;
   }
   const parts = [
     `${rc.symbols?.length ?? 0} symbol(s) \u2192 ${rc.callers?.length ?? 0} caller(s) \xB7 ${rc.tests?.length ?? 0} test(s)`
   ];
+  if (rc.importers?.length) parts.push(`${rc.importers.length} importer(s)`);
   if (rc.excerpts?.length) parts.push(`${rc.excerpts.length} excerpt(s)`);
   if (rc.dropped_symbols?.length) parts.push(`dropped too-common: ${rc.dropped_symbols.join(", ")}`);
   if (rc.unsupported_exts?.length) parts.push(`no rules for: ${rc.unsupported_exts.join(", ")}`);
@@ -20256,11 +20822,85 @@ function installRunEvidence(run2) {
 }
 
 // src/lib/git-frame.ts
-var import_node_child_process11 = require("node:child_process");
 var import_node_fs33 = require("node:fs");
 var import_node_os5 = require("node:os");
-var import_node_path24 = require("node:path");
 var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
+
+// src/lib/hardened-git.ts
+var import_node_child_process11 = require("node:child_process");
+var HARDENED_CONFIG_ARGS = [
+  "-c",
+  "core.fsmonitor=false",
+  "-c",
+  "core.pager=cat",
+  "-c",
+  "log.showSignature=false"
+];
+var DIFF_READ_FLAGS = ["--no-ext-diff", "--no-textconv"];
+var DEFAULT_GIT_TIMEOUT_MS = 6e4;
+var DEFAULT_GIT_MAX_BUFFER = 64 * 1024 * 1024;
+function hardenedGitEnv(base = process.env) {
+  const env = {};
+  for (const [key, value] of Object.entries(base)) {
+    if (key.startsWith("GIT_")) continue;
+    env[key] = value;
+  }
+  env.GIT_OPTIONAL_LOCKS = "0";
+  env.GIT_TERMINAL_PROMPT = "0";
+  return env;
+}
+function hardenedGitArgv(args) {
+  return [...HARDENED_CONFIG_ARGS, ...args];
+}
+function classifyError(err) {
+  const e = err;
+  const stderr = typeof e?.stderr === "string" ? e.stderr : e?.stderr ? e.stderr.toString("utf-8") : "";
+  if (e?.code === "ETIMEDOUT" || e?.killed && e?.signal === "SIGTERM") return { ok: false, error: "timeout", stderr };
+  if (e?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") return { ok: false, error: "too_large", stderr };
+  return { ok: false, error: "failed", stderr };
+}
+function runGitSync(cwd, args, opts = {}) {
+  try {
+    const stdout = (0, import_node_child_process11.execFileSync)("git", hardenedGitArgv(args), {
+      cwd,
+      env: hardenedGitEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
+      maxBuffer: opts.maxBuffer ?? DEFAULT_GIT_MAX_BUFFER
+    });
+    return { ok: true, stdout };
+  } catch (err) {
+    return classifyError(err);
+  }
+}
+function runGit(cwd, args, opts = {}) {
+  return new Promise((resolvePromise) => {
+    (0, import_node_child_process11.execFile)(
+      "git",
+      hardenedGitArgv(args),
+      {
+        cwd,
+        env: hardenedGitEnv(),
+        encoding: "utf-8",
+        timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
+        maxBuffer: opts.maxBuffer ?? DEFAULT_GIT_MAX_BUFFER
+      },
+      (err, stdout, stderr) => {
+        if (err) {
+          const e = err;
+          e.stderr = stderr;
+          resolvePromise(classifyError(e));
+          return;
+        }
+        resolvePromise({ ok: true, stdout });
+      }
+    );
+  });
+}
+
+// src/lib/git-frame.ts
 var VALUE_TOKEN = `(?:'[^']*'|"[^"]*"|\\S+)`;
 var GIT_GLOBAL_OPTS = `(?:\\s+(?:-[Cc]\\s+${VALUE_TOKEN}|--?[\\w-]+(?:=\\S+)?))*`;
 var COMMIT_HEAD = `git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`;
@@ -20270,7 +20910,41 @@ var COMMIT_RE = new RegExp(`(?:^|[\\s;&|(])${COMMIT_HEAD}|(?:^|[;&|(])\\s*[^\\s;
 var PUSH_RE = new RegExp(`(?:^|[\\s;&|(])${PUSH_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${PUSH_HEAD}`);
 var GH_PR_RE = new RegExp(`(?:^|[\\s;&|(])${GH_PR_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${GH_PR_HEAD}`);
 function splitSegments(command) {
-  return (command ?? "").split(/&&|\|\||;|\n/);
+  return stripHeredocBodies(command ?? "").split(/&&|\|\||;|\n/);
+}
+var HEREDOC_OPERATOR = /(^|[^<])<<(-?)[ \t]*(?:'([^'\n]+)'|"([^"\n]+)"|\\?([A-Za-z_][A-Za-z0-9_]*))/g;
+var SHELL_CONSUMER = /(^|[\s;&|(])(bash|sh|zsh|dash|ksh|fish|ssh|eval|exec|sudo|su|xargs|env|nohup|time|docker|kubectl|podman)(\s|$)/;
+function stripHeredocBodies(command) {
+  const lines = command.split("\n");
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    out.push(line);
+    i++;
+    const words = [];
+    HEREDOC_OPERATOR.lastIndex = 0;
+    let m;
+    while ((m = HEREDOC_OPERATOR.exec(line)) !== null) {
+      words.push({ word: m[3] ?? m[4] ?? m[5], dash: m[2] === "-" });
+    }
+    if (words.length === 0 || SHELL_CONSUMER.test(line)) continue;
+    let cursor = i;
+    let end = -1;
+    for (const { word, dash } of words) {
+      let k = cursor;
+      while (k < lines.length && (dash ? lines[k].replace(/^\t+/, "") : lines[k]) !== word) k++;
+      if (k >= lines.length) {
+        end = -1;
+        break;
+      }
+      end = k;
+      cursor = k + 1;
+    }
+    if (end === -1) continue;
+    i = end + 1;
+  }
+  return out.join("\n");
 }
 function findMomentSegment(command, on) {
   const segments = splitSegments(command);
@@ -20313,8 +20987,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path25.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path24.isAbsolute)(expanded) ? expanded : (0, import_node_path24.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path26.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path25.isAbsolute)(expanded) ? expanded : (0, import_node_path25.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -20332,8 +21006,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path25.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path24.isAbsolute)(expanded) ? expanded : (0, import_node_path24.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path26.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path25.isAbsolute)(expanded) ? expanded : (0, import_node_path25.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -20388,17 +21062,14 @@ function parsePushTarget(segment) {
   return { remote, srcRef: src, dstRef: dst || null, isDelete };
 }
 function gitAt(dir, args) {
-  try {
-    return (0, import_node_child_process11.execFileSync)("git", args, { cwd: dir, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
+  const res = runGitSync(dir, args);
+  return res.ok ? res.stdout.trim() : "";
 }
 function realpathOr2(p) {
   try {
     return import_node_fs33.realpathSync.native(p);
   } catch {
-    return (0, import_node_path24.resolve)(p);
+    return (0, import_node_path25.resolve)(p);
   }
 }
 function resolveFrame(input) {
@@ -20437,7 +21108,7 @@ function resolveFrame(input) {
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
   const gitDir = gitDirRaw ? realpathOr2(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr2((0, import_node_path24.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path24.resolve)(dir, commonRaw)) : null;
+  const commonDir = commonRaw ? realpathOr2((0, import_node_path25.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path25.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
@@ -20612,7 +21283,7 @@ function stagedRange(frame, command) {
   if (plan.kind === "unpredictable") {
     return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
   }
-  const mergeHead = frame.gitDir ? (0, import_node_path25.join)(frame.gitDir, "MERGE_HEAD") : null;
+  const mergeHead = frame.gitDir ? (0, import_node_path26.join)(frame.gitDir, "MERGE_HEAD") : null;
   if (mergeHead && (0, import_node_fs33.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
@@ -20665,7 +21336,7 @@ function rangeChangeSignals(frame, range, paths) {
   const out = /* @__PURE__ */ new Map();
   if (range.kind === "nothing" || paths.length === 0) return out;
   if (range.kind === "push" && !range.base) return out;
-  const args = range.kind === "staged" || range.kind === "merge" ? ["diff", "--cached", "--unified=0"] : ["diff", "--unified=0", range.base, range.head === "INDEX" ? "HEAD" : range.head];
+  const args = range.kind === "staged" || range.kind === "merge" ? ["diff", ...DIFF_READ_FLAGS, "--cached", "--unified=0"] : ["diff", ...DIFF_READ_FLAGS, "--unified=0", range.base, range.head === "INDEX" ? "HEAD" : range.head];
   const diff = frameGit(frame, [...args, "--", ...paths]);
   let current = null;
   let oldSide = null;
@@ -21028,7 +21699,7 @@ function sanitizeCommandWithLoss(rawCmd) {
   const lost = lines.slice(1).some((l) => l.trim().length > 0);
   const first = lines[0];
   const cmd = sanitizeCommand(first);
-  const hadSeparator = SEPARATORS.some((sep3) => first.indexOf(sep3) > 0);
+  const hadSeparator = SEPARATORS.some((sep4) => first.indexOf(sep4) > 0);
   return { cmd, lost: lost || !hadSeparator && first.length > MAX_COMMAND_CHARS };
 }
 var SEPARATORS = [" | ", " > ", " >> ", " 2>", " && ", " ; "];
@@ -21037,11 +21708,11 @@ function sanitizeCommand(rawCmd) {
   let cmd = rawCmd.split("\n")[0];
   let cut = -1;
   let marker = "";
-  for (const sep3 of SEPARATORS) {
-    const idx = cmd.indexOf(sep3);
+  for (const sep4 of SEPARATORS) {
+    const idx = cmd.indexOf(sep4);
     if (idx > 0 && (cut === -1 || idx < cut)) {
       cut = idx;
-      marker = sep3.trim();
+      marker = sep4.trim();
     }
   }
   if (cut > -1) cmd = cmd.slice(0, cut);
@@ -21065,28 +21736,28 @@ async function readStopHookStdin() {
   try {
     if (process.stdin.isTTY) return empty;
     const chunks = [];
-    const timeout = new Promise((resolve5) => setTimeout(() => resolve5(empty), 500));
-    const read = new Promise((resolve5) => {
+    const timeout = new Promise((resolve6) => setTimeout(() => resolve6(empty), 500));
+    const read = new Promise((resolve6) => {
       process.stdin.on("data", (chunk) => chunks.push(chunk));
       process.stdin.on("end", () => {
         const raw = Buffer.concat(chunks).toString("utf-8").trim();
         if (!raw) {
-          resolve5(empty);
+          resolve6(empty);
           return;
         }
         try {
           const data = JSON.parse(raw);
-          resolve5({
+          resolve6({
             assistantMessage: typeof data.last_assistant_message === "string" ? data.last_assistant_message : null,
             stopReason: typeof data.stop_reason === "string" ? data.stop_reason : null,
             transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : null,
             sessionId: typeof data.session_id === "string" ? data.session_id : null
           });
         } catch {
-          resolve5(empty);
+          resolve6(empty);
         }
       });
-      process.stdin.on("error", () => resolve5(empty));
+      process.stdin.on("error", () => resolve6(empty));
       process.stdin.resume();
     });
     return await Promise.race([read, timeout]);
@@ -21290,7 +21961,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.7" : "dev";
+    return true ? "0.33.0-experimental.34db3a4" : "dev";
   } catch {
     return "dev";
   }
@@ -21342,10 +22013,12 @@ var SEVERITY_ORDER = {
   Low: 3
 };
 function isCodacyAvailable() {
-  return codacyAnalysisPath() !== null;
-}
-function codacyAnalysisPath() {
-  return whichSync("codacy-analysis");
+  try {
+    (0, import_node_child_process12.execSync)("which codacy-analysis", { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
 }
 function buildAnalyzerArgv(files) {
   return [
@@ -21372,16 +22045,6 @@ function withFailure(kind, detail) {
     summary: { ...EMPTY_RESULT.summary, failure: { kind, detail: detail.slice(0, 300) } }
   };
 }
-function runCodacyAnalysisIfAvailable(files) {
-  if (files.length === 0) return EMPTY_RESULT;
-  if (!isCodacyAvailable()) {
-    return withFailure(
-      "analyzer_unavailable",
-      "@codacy/analysis-cli was not found on PATH \u2014 no static analysis ran"
-    );
-  }
-  return runCodacyAnalysis(files);
-}
 function runCodacyAnalysis(files) {
   const empty = EMPTY_RESULT;
   if (files.length === 0) return empty;
@@ -21393,8 +22056,7 @@ function runCodacyAnalysis(files) {
     }
   });
   if (existingFiles.length === 0) return empty;
-  const analyzer = codacyAnalysisPath() ?? "codacy-analysis";
-  const proc = (0, import_node_child_process12.spawnSync)(analyzer, buildAnalyzerArgv(existingFiles), {
+  const proc = (0, import_node_child_process12.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -21562,10 +22224,11 @@ var EMPTY_STATIC = {
   summary: { total_findings: 0, by_severity: {}, tools_run: [] }
 };
 function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
-  if (skipStatic) return EMPTY_STATIC;
+  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
   let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
   if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
-  return runCodacyAnalysisIfAvailable(scannable);
+  if (scannable.length === 0) return EMPTY_STATIC;
+  return runCodacyAnalysis(scannable);
 }
 function localOnlyAndExit(staticResults) {
   printJsonCompact({
@@ -21657,7 +22320,7 @@ async function scope(run2) {
 
 // src/lib/specs.ts
 var import_node_fs36 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_path27 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -21676,16 +22339,6 @@ var SPEC_CANDIDATES = [
 var DOC_EXT = /\.(md|mdx|ya?ml|txt|rst|adoc)$/i;
 var UNCONSULTED_FILE_BYTES = 10240;
 var UNCONSULTED_TOTAL_BYTES = 30720;
-function readSpecFiles(specsOpt, root) {
-  const out = [];
-  for (const raw of specsOpt.split(",").map((f) => f.trim()).filter(Boolean)) {
-    const candidate = (0, import_node_path26.isAbsolute)(raw) ? (0, import_node_path26.relative)(root, raw) : raw;
-    const content = readFileInside(root, candidate, MAX_EXPLICIT_SPEC_FILE_BYTES);
-    if (content === null) continue;
-    out.push({ path: raw, content });
-  }
-  return out;
-}
 function discoverSpecs(consulted = []) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
@@ -21703,15 +22356,13 @@ function discoverSpecs(consulted = []) {
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
     const readBytes = Math.min(fileCap, remaining);
+    const opened = openRegularInRoot(process.cwd(), specPath);
+    if (!opened.ok) return true;
     try {
-      const buf = Buffer.alloc(readBytes);
-      const fd = (0, import_node_fs36.openSync)(specPath, "r");
-      const bytesRead = (0, import_node_fs36.readSync)(fd, buf, 0, readBytes, 0);
-      (0, import_node_fs36.closeSync)(fd);
-      const content = buf.slice(0, bytesRead).toString("utf-8");
-      if (!content) return true;
-      result.push({ path: specPath, content });
-      totalBytes += content.length;
+      const bytes = readOpened(opened.fd, Math.min(opened.size, readBytes));
+      if (bytes.length === 0) return true;
+      result.push({ path: specPath, content: bytes.toString("utf-8") });
+      totalBytes += bytes.length;
     } catch {
     }
     return true;
@@ -21740,7 +22391,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   try {
     const entries = (0, import_node_fs36.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path26.join)(dir, entry.name);
+      const fullPath = (0, import_node_path27.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -21752,37 +22403,51 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path26.join)(process.env.HOME ?? "", ".claude", "plans");
-  const localPlansDir = ".claude/plans";
+  const home = process.env.HOME ?? "";
+  const homePlansDir = (0, import_node_path27.join)(home, ".claude", "plans");
+  const sources = [];
+  if (isRealDirectoryChain(process.cwd(), [".claude", "plans"])) {
+    sources.push({ root: process.cwd(), prefix: (0, import_node_path27.join)(".claude", "plans") });
+  }
+  if (home && (0, import_node_fs36.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
   const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const plansDir of [localPlansDir, homePlansDir]) {
-    if (!(0, import_node_fs36.existsSync)(plansDir)) continue;
+  for (const source of sources) {
+    let names2;
     try {
-      for (const f of (0, import_node_fs36.readdirSync)(plansDir)) {
-        if (!f.endsWith(".md") || seen.has(f)) continue;
-        seen.add(f);
-        const fullPath = (0, import_node_path26.join)(plansDir, f);
-        try {
-          const stat3 = (0, import_node_fs36.statSync)(fullPath);
-          candidates2.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
-        } catch {
-        }
-      }
+      names2 = (0, import_node_fs36.readdirSync)(source.prefix ? (0, import_node_path27.join)(source.root, source.prefix) : source.root);
     } catch {
+      continue;
+    }
+    for (const f of names2) {
+      if (!f.endsWith(".md") || seen.has(f)) continue;
+      seen.add(f);
+      const relPath = source.prefix ? (0, import_node_path27.join)(source.prefix, f) : f;
+      const stat3 = statRegularInRoot(source.root, relPath);
+      if (!stat3.ok) continue;
+      candidates2.push({ name: f, root: source.root, relPath, mtime: stat3.mtimeMs, size: stat3.size });
     }
   }
   candidates2.sort((a, b) => b.mtime - a.mtime);
   const result = [];
   for (const entry of candidates2.slice(0, MAX_PLAN_FILES)) {
     if (entry.size > MAX_PLAN_FILE_BYTES) continue;
+    const read = readRegularFileInRoot(entry.root, entry.relPath, MAX_PLAN_FILE_BYTES);
+    if (read.ok) result.push({ name: entry.name, content: read.content });
+  }
+  return result;
+}
+function isRealDirectoryChain(root, parts) {
+  let current = root;
+  for (const part of parts) {
+    current = (0, import_node_path27.join)(current, part);
     try {
-      const content = (0, import_node_fs36.readFileSync)(entry.path, "utf-8");
-      result.push({ name: entry.name, content });
+      if (!(0, import_node_fs36.lstatSync)(current).isDirectory()) return false;
     } catch {
+      return false;
     }
   }
-  return result;
+  return true;
 }
 var GUARD_DOC_EXT = /\.(md|mdx|txt|rst|adoc)$/i;
 function discoverGuardDocs(rangeFiles2) {
@@ -21793,16 +22458,21 @@ function discoverGuardDocs(rangeFiles2) {
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
     if (!(0, import_node_fs36.existsSync)(path)) continue;
+    const opened = openRegularInRoot(process.cwd(), path);
+    if (!opened.ok) continue;
+    if (opened.size > MAX_PLAN_FILE_BYTES || totalBytes + opened.size > MAX_TOTAL_SPEC_BYTES) {
+      closeOpened(opened.fd);
+      continue;
+    }
+    let bytes;
     try {
-      const stat3 = (0, import_node_fs36.statSync)(path);
-      if (stat3.size > MAX_PLAN_FILE_BYTES) continue;
-      if (totalBytes + stat3.size > MAX_TOTAL_SPEC_BYTES) continue;
-      const content = (0, import_node_fs36.readFileSync)(path, "utf-8");
-      if (!content) continue;
-      result.push({ name: path, content });
-      totalBytes += content.length;
+      bytes = readOpened(opened.fd, opened.size);
     } catch {
+      continue;
     }
+    if (bytes.length === 0) continue;
+    result.push({ name: path, content: bytes.toString("utf-8") });
+    totalBytes += bytes.length;
   }
   return result;
 }
@@ -21974,7 +22644,7 @@ async function mode(run2) {
 
 // src/lib/fold.ts
 var import_node_fs37 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -22206,9 +22876,9 @@ function fold(transcriptPath, opts = {}) {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path27.join)(
-      (0, import_node_path27.dirname)(transcriptPath),
-      (0, import_node_path27.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path28.join)(
+      (0, import_node_path28.dirname)(transcriptPath),
+      (0, import_node_path28.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
     if ((0, import_node_fs37.existsSync)(sidecarDir)) {
@@ -22218,7 +22888,7 @@ function fold(transcriptPath, opts = {}) {
       const walk2 = (d, depth) => {
         if (depth > 4) return;
         for (const e of (0, import_node_fs37.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path27.join)(d, e.name);
+          const p = (0, import_node_path28.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
@@ -22542,12 +23212,14 @@ async function evidence(run2) {
           authorshipWasObservable
         });
         const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
-        if (!opts.skipStatic) {
+        if (!opts.skipStatic && isCodacyAvailable()) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
           if (baseline) {
             allScannable = allScannable.filter((f) => changedSinceBaseline(f, baseline));
           }
-          staticResults = runCodacyAnalysisIfAvailable(allScannable);
+          if (allScannable.length > 0) {
+            staticResults = runCodacyAnalysis(allScannable);
+          }
         }
         const deltaSet = baseline ? recentForReview.filter((f) => changedSinceBaseline(f, baseline)) : recentForReview;
         codeDelta = collectCodeDelta(deltaSet, {
@@ -22591,7 +23263,7 @@ async function evidence(run2) {
 
 // src/lib/cache-cleanup.ts
 var import_node_fs38 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_path29 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
@@ -22599,7 +23271,7 @@ function pruneStaleCache() {
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
     for (const entry of (0, import_node_fs38.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path28.join)(dir, entry);
+      const path = (0, import_node_path29.join)(dir, entry);
       try {
         const stat3 = (0, import_node_fs38.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
@@ -22760,14 +23432,15 @@ async function repoContext(run2) {
     dropped: run2.repoContext.dropped_symbols?.length ?? 0,
     callers: run2.repoContext.callers?.length ?? 0,
     tests: run2.repoContext.tests?.length ?? 0,
+    importers: run2.repoContext.importers?.length ?? 0,
     elapsed_ms: run2.repoContext.elapsed_ms ?? null
   });
 }
 
 // src/lib/seed-runner.ts
-var import_promises14 = require("node:fs/promises");
+var import_promises15 = require("node:fs/promises");
 var import_node_fs40 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_path30 = require("node:path");
 var import_yaml4 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -22843,7 +23516,7 @@ function classifyClaudeSection(heading) {
   if (hasAny(["integration", "webhook", "third-party", "third party", "provider"])) return "integration";
   return "domain";
 }
-function slugify(s) {
+function slugify2(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
 }
 var FRAMEWORK_GLOBS = [
@@ -22940,7 +23613,7 @@ _Extracted from README on setup. Update when project direction changes._`,
   for (const fwRaw of frameworks) {
     const fw = fwRaw.trim();
     if (!fw) continue;
-    const slug = slugify(fw);
+    const slug = slugify2(fw);
     if (!slug || seenFrameworkSlugs.has(slug)) continue;
     seenFrameworkSlugs.add(slug);
     out.push({
@@ -23011,7 +23684,7 @@ async function runSeed(opts) {
   }
   let standardDoc;
   try {
-    const raw = await (0, import_promises14.readFile)(STANDARD_FILE, "utf-8");
+    const raw = await (0, import_promises15.readFile)(STANDARD_FILE, "utf-8");
     standardDoc = (0, import_yaml4.parse)(raw);
   } catch {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
@@ -23020,7 +23693,7 @@ async function runSeed(opts) {
   let readmeContent;
   if ((0, import_node_fs40.existsSync)("README.md")) {
     try {
-      readmeContent = await (0, import_promises14.readFile)("README.md", "utf-8");
+      readmeContent = await (0, import_promises15.readFile)("README.md", "utf-8");
     } catch {
     }
   }
@@ -23028,7 +23701,7 @@ async function runSeed(opts) {
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
     if ((0, import_node_fs40.existsSync)(p)) {
       try {
-        claudeMdContent = await (0, import_promises14.readFile)(p, "utf-8");
+        claudeMdContent = await (0, import_promises15.readFile)(p, "utf-8");
         break;
       } catch {
       }
@@ -23049,7 +23722,7 @@ async function runSeed(opts) {
   if (candidates2.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path29.join)(MEMORY_DIR, "domain", "project-overview.md");
+  const overviewPath = (0, import_node_path30.join)(MEMORY_DIR, "domain", "project-overview.md");
   if ((0, import_node_fs40.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
   }
@@ -23092,8 +23765,8 @@ async function runSeed(opts) {
       continue;
     }
     try {
-      await (0, import_promises14.mkdir)((0, import_node_path29.dirname)(targetPath), { recursive: true });
-      await (0, import_promises14.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
+      await (0, import_promises15.mkdir)((0, import_node_path30.dirname)(targetPath), { recursive: true });
+      await (0, import_promises15.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
     } catch (err) {
@@ -23106,7 +23779,7 @@ async function runSeed(opts) {
 
 // src/commands/analyze/phases/08-memory-manifest.ts
 var import_node_fs41 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_path31 = require("node:path");
 async function memoryManifest(run2) {
   const { globals } = run2;
   const { serviceUrl, token } = run2;
@@ -23116,7 +23789,7 @@ async function memoryManifest(run2) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path30.join)(VERITY_DIR, ".seeded");
+    const seedMarker = (0, import_node_path31.join)(VERITY_DIR, ".seeded");
     const hasStandard = (0, import_node_fs41.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs41.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
@@ -23234,7 +23907,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 async function workingMemory(run2) {
   const { opts } = run2;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run2;
@@ -23246,7 +23919,7 @@ async function workingMemory(run2) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path31.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path32.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -23383,15 +24056,6 @@ function parseAutonomousEnv(raw) {
   if (v === "0" || v === "false" || v === "off" || v === "no") return false;
   return true;
 }
-function resolveRunMode(inputs = {}) {
-  if (inputs.autonomousFlag === true) return "autonomous";
-  if (inputs.autonomousFlag === false) return "interactive";
-  const env = inputs.env ?? process.env;
-  const envDecision = parseAutonomousEnv(env.VERITY_AUTONOMOUS);
-  if (envDecision !== void 0) return envDecision ? "autonomous" : "interactive";
-  const isTTY = inputs.isTTY ?? Boolean(process.stdin?.isTTY);
-  return isTTY ? "interactive" : "autonomous";
-}
 function isExplicitlyAutonomous(env = process.env) {
   return parseAutonomousEnv(env.VERITY_AUTONOMOUS) === true || parseAutonomousEnv(env.CI) === true || parseAutonomousEnv(env.GITHUB_ACTIONS) === true;
 }
@@ -23811,7 +24475,7 @@ async function transmit(run2) {
 
 // src/commands/analyze/phases/13-reconcile.ts
 var import_node_fs44 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_path33 = require("node:path");
 async function reconcile(run2) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run2;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -23840,7 +24504,7 @@ async function reconcile(run2) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs44.readFileSync)((0, import_node_path32.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs44.readFileSync)((0, import_node_path33.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -24083,23 +24747,163 @@ function mayBlock(input) {
   if (input.attempts > input.maxIterations) {
     return { block: false, release: "same-problem-cap" };
   }
-  if (input.blocks > ceiling) {
-    return { block: false, release: "block-ceiling" };
+  if (input.blocks > ceiling) {
+    return { block: false, release: "block-ceiling" };
+  }
+  return { block: true, release: null };
+}
+function describeRelease(release, input) {
+  const ceiling = input.ceiling ?? HARD_BLOCK_CEILING;
+  const open = input.findingCount > 0 ? `${input.findingCount} finding(s) remain OPEN and were NOT fixed. Human review required before deploying.` : "Human review required before deploying.";
+  switch (release) {
+    case "no-code-reviewed":
+      return `Verity: WARN \u2014 NOT BLOCKING: no code was reviewed on this turn, so there is nothing here to fix. Reported as advice instead. ${open}`;
+    case "nothing-moved":
+      return `Verity: WARN \u2014 NOT BLOCKING: nothing has changed since the last verdict, so re-raising it cannot move anything forward. ${open}`;
+    case "same-problem-cap":
+      return `Verity: WARN \u2014 self-healing limit (${input.maxIterations}) reached on the same finding. NO LONGER BLOCKING, but ${open}`;
+    case "block-ceiling":
+      return `Verity: WARN \u2014 ${ceiling} consecutive blocking verdicts reached; releasing the block so this cannot loop. ${open}`;
+  }
+}
+
+// src/lib/memory-pull.ts
+var import_node_child_process14 = require("node:child_process");
+var import_promises16 = require("node:fs/promises");
+var pullStateFile = () => projectPath(`${VERITY_DIR}/.memory-pull-state.json`);
+var PAGE_SIZE = 200;
+var MAX_PAGES = 500;
+var memoryIsTracked = () => committedMemoryFiles().length > 0;
+async function pullRepoMemory(opts) {
+  if (memoryIsTracked()) return { ok: true, status: "tracked", received: 0, written: 0 };
+  const state = await readPullState();
+  const known = opts.force ? null : state.version;
+  let treePaths;
+  try {
+    treePaths = listTrackedFiles();
+  } catch {
+    treePaths = void 0;
+  }
+  const served = /* @__PURE__ */ new Map();
+  let received = 0;
+  let written = 0;
+  let version = null;
+  let cursor = null;
+  let pages = 0;
+  const remember = (complete) => writePullState({
+    version: complete ? version : null,
+    // A complete pull saw every file the server holds, so its ledger replaces the
+    // old one (a path that stopped arriving was archived). A partial one only adds.
+    served: complete ? served : new Map([...state.served, ...served])
+  });
+  do {
+    const params = new URLSearchParams({ limit: String(PAGE_SIZE) });
+    if (cursor) params.set("cursor", cursor);
+    else if (known) params.set("if_version", known);
+    const res = await apiRequest({
+      method: "GET",
+      path: `/memory/files?${params.toString()}`,
+      serviceUrl: opts.serviceUrl,
+      token: opts.token,
+      verbose: opts.verbose,
+      timeout: opts.timeoutMs ?? 3e4,
+      cmd: "memory-pull"
+    });
+    if (!res.ok) {
+      if (pages > 0) await remember(false);
+      return { ok: false, error: res.error, category: res.category };
+    }
+    const page = res.data;
+    if (page.unchanged) return { ok: true, status: "unchanged", received: 0, written: 0 };
+    if (pages === 0) version = page.version;
+    else if (page.version !== version) version = null;
+    const files = (page.files ?? []).map((f) => ({
+      path: f.path,
+      content: f.content,
+      node_id: f.node_id,
+      op: "create"
+    }));
+    received += files.length;
+    try {
+      written += await applyMemoryWrites(files, {
+        treePaths,
+        baseline: "written",
+        lastServed: state.served,
+        served,
+        claudeMdPointer: false
+      });
+    } catch (err) {
+      await remember(false);
+      throw err;
+    }
+    cursor = page.next_cursor;
+    pages++;
+  } while (cursor && pages < MAX_PAGES);
+  await remember(!cursor);
+  return { ok: true, status: "pulled", received, written };
+}
+async function readServedLedger() {
+  return (await readPullState()).served;
+}
+async function recordServedFiles(served) {
+  if (served.size === 0) return;
+  const state = await readPullState();
+  for (const [path, hash] of served) state.served.set(path, hash);
+  await writePullState(state);
+}
+async function readPullState() {
+  try {
+    const parsed = JSON.parse(await (0, import_promises16.readFile)(pullStateFile(), "utf-8"));
+    const served = /* @__PURE__ */ new Map();
+    if (parsed?.served && typeof parsed.served === "object") {
+      for (const [path, hash] of Object.entries(parsed.served)) {
+        if (typeof hash === "string") served.set(path, hash);
+      }
+    }
+    return { version: typeof parsed?.version === "string" ? parsed.version : null, served };
+  } catch {
+    return { version: null, served: /* @__PURE__ */ new Map() };
+  }
+}
+async function writePullState(state) {
+  try {
+    await (0, import_promises16.mkdir)(projectPath(VERITY_DIR), { recursive: true });
+    await (0, import_promises16.writeFile)(pullStateFile(), JSON.stringify({
+      ...state.version ? { version: state.version } : {},
+      pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
+      served: Object.fromEntries(state.served)
+    }) + "\n");
+  } catch {
   }
-  return { block: true, release: null };
 }
-function describeRelease(release, input) {
-  const ceiling = input.ceiling ?? HARD_BLOCK_CEILING;
-  const open = input.findingCount > 0 ? `${input.findingCount} finding(s) remain OPEN and were NOT fixed. Human review required before deploying.` : "Human review required before deploying.";
-  switch (release) {
-    case "no-code-reviewed":
-      return `Verity: WARN \u2014 NOT BLOCKING: no code was reviewed on this turn, so there is nothing here to fix. Reported as advice instead. ${open}`;
-    case "nothing-moved":
-      return `Verity: WARN \u2014 NOT BLOCKING: nothing has changed since the last verdict, so re-raising it cannot move anything forward. ${open}`;
-    case "same-problem-cap":
-      return `Verity: WARN \u2014 self-healing limit (${input.maxIterations}) reached on the same finding. NO LONGER BLOCKING, but ${open}`;
-    case "block-ceiling":
-      return `Verity: WARN \u2014 ${ceiling} consecutive blocking verdicts reached; releasing the block so this cannot loop. ${open}`;
+function pullsAtSessionStart(auth2, source) {
+  if (source === "compact") return false;
+  if (auth2.source === "env" || auth2.source === "flag") return true;
+  return auth2.userId != null;
+}
+function spawnBackgroundPull(deps = {}) {
+  const d = {
+    spawn: import_node_child_process14.spawn,
+    execPath: process.execPath,
+    script: process.argv[1],
+    cwd: process.cwd(),
+    env: process.env,
+    ...deps
+  };
+  if (d.env.VERITY_NO_BACKGROUND_PULL === "1" || !d.script) return false;
+  try {
+    const child = d.spawn(d.execPath, [d.script, "memory", "pull", "--quiet"], {
+      cwd: d.cwd,
+      env: d.env,
+      detached: true,
+      stdio: "ignore"
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
   }
 }
 
@@ -24201,7 +25005,9 @@ async function render(run2) {
   if (memoryWritesRaw && memoryWritesRaw.length > 0) {
     try {
       const treePaths = listTrackedFiles();
-      await applyMemoryWrites(memoryWritesRaw, { treePaths });
+      const served = /* @__PURE__ */ new Map();
+      await applyMemoryWrites(memoryWritesRaw, { treePaths, lastServed: await readServedLedger(), served });
+      await recordServedFiles(served);
     } catch (err) {
       process.stderr.write(`verity: memory sync write failed: ${err.message}
 `);
@@ -24530,7 +25336,7 @@ var import_node_fs47 = require("node:fs");
 
 // src/lib/project-skills.ts
 var import_node_fs46 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_path34 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -24556,13 +25362,13 @@ var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
   if (!(0, import_node_fs46.existsSync)(root)) return [];
-  return ALL.filter((name) => (0, import_node_fs46.existsSync)((0, import_node_path33.join)(root, name)));
+  return ALL.filter((name) => (0, import_node_fs46.existsSync)((0, import_node_path34.join)(root, name)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name of staleProjectSkills()) {
-    (0, import_node_fs46.rmSync)((0, import_node_path33.join)(root, name), { recursive: true, force: true });
+    (0, import_node_fs46.rmSync)((0, import_node_path34.join)(root, name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -24688,6 +25494,7 @@ function registerBaselineCommands(program2) {
       }
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
+      if (authForScope.ok && pullsAtSessionStart(authForScope.data, source)) spawnBackgroundPull();
       const scopeSession = session;
       const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source });
       logEvent("baseline_capture", {
@@ -24750,22 +25557,45 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs48.existsSync)(f) || resolveFile(f) !== null);
-  const staticResults = runCodacyAnalysisIfAvailable(scannable);
+  let staticResults;
+  if (isCodacyAvailable()) {
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs48.existsSync)(f) || resolveFile(f) !== null);
+    staticResults = runCodacyAnalysis(scannable);
+  } else {
+    staticResults = {
+      tool: "@codacy/analysis-cli",
+      findings: [],
+      summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+    };
+  }
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) {
-    const staticFailure = staticResults.summary.failure;
     printJsonCompact({
-      gate_decision: "WARN",
-      systemMessage: staticFailure ? `Verity: not authenticated, and local static analysis did not run (${staticFailure.kind}) \u2014 nothing was examined. Run \`verity init\` to authenticate and unlock the full review.` : "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      gate_decision: "PASS",
+      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
       unauthenticated: true,
       static_results: staticResults
     });
     process.exit(0);
   }
-  const specs = opts.specs ? readSpecFiles(opts.specs, repoRoot()) : discoverSpecs();
+  let specs;
+  if (opts.specs) {
+    const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
+    specs = [];
+    for (const p of specPaths) {
+      if (!(0, import_node_fs48.existsSync)(p)) continue;
+      try {
+        const { readFileSync: readFileSync26 } = await import("node:fs");
+        const content = readFileSync26(p, "utf-8");
+        specs.push({ path: p, content: content.slice(0, 10240) });
+      } catch {
+      }
+    }
+  } else {
+    specs = discoverSpecs();
+  }
   const plans = discoverPlans();
   const requestBody = {
     static_results: staticResults,
@@ -24798,10 +25628,9 @@ async function runReview(opts, globals) {
   });
   if (!result.ok) {
     printError(`Service error: ${result.error}`);
-    const staticFailure = staticResults.summary.failure;
     printJsonCompact({
-      gate_decision: "WARN",
-      systemMessage: staticFailure ? `Verity: service unavailable, and local static analysis did not run (${staticFailure.kind}) \u2014 nothing was examined` : "Verity: service unavailable \u2014 showing local static results only",
+      gate_decision: "PASS",
+      systemMessage: "Verity: Service unavailable \u2014 showing static results only",
       offline: true,
       static_results: staticResults
     });
@@ -24817,14 +25646,387 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs49 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
+
+// src/lib/terminal-text.ts
+var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
+function terminalText(value, max = 4e3) {
+  if (typeof value !== "string") return "";
+  const clean2 = value.replace(CONTROL, "");
+  return clean2.length > max ? `${clean2.slice(0, max - 1)}\u2026` : clean2;
+}
+function terminalUrl(value) {
+  const clean2 = terminalText(value, 2e3);
+  return /^https?:\/\/\S+$/.test(clean2) ? clean2 : "";
+}
+
+// src/lib/agent-driver.ts
+var AGENT_DEADLINE_MS = {
+  "pre-commit": 9e4,
+  "pre-push": 18e4
+};
+var MIN_AGENT_START_MS = 25e3;
+var MIN_TURN_MS = 12e3;
+var FINISH_TIMEOUT_MS = 15e3;
+var CANCEL_TIMEOUT_MS = 3e3;
+var MAX_TURNS = 16;
+var ONE_SHOT_FINDING_FIELDS = ["severity", "category", "file", "line", "title", "description", "scope", "pattern_id"];
+function summarizeFindings(response) {
+  const findings = Array.isArray(response.findings) ? response.findings : [];
+  return findings.slice(0, 40).map((f) => {
+    const out = {};
+    const finding = f ?? {};
+    for (const key of ONE_SHOT_FINDING_FIELDS) if (finding[key] !== void 0) out[key] = finding[key];
+    return out;
+  });
+}
+function finishOneShot(settled) {
+  if (!settled) return { status: "pending" };
+  if (!settled.ok) return { status: "failed" };
+  const r = settled.response;
+  return {
+    status: "arrived",
+    ...typeof r.agent_attestation === "string" ? { attestation: r.agent_attestation } : {},
+    ...typeof r.run_id === "string" ? { run_id: r.run_id } : {},
+    ...typeof r.gate_decision === "string" ? { gate_decision: r.gate_decision } : {}
+  };
+}
+async function runAgentReview(options) {
+  const now = options.now ?? Date.now;
+  const remaining = () => options.deadlineMs - (now() - options.startedAt);
+  let settled = null;
+  const oneShotDone = options.oneShot.then(
+    (outcome) => {
+      settled = outcome;
+    },
+    () => {
+      settled = { ok: false };
+    }
+  );
+  if (remaining() < MIN_AGENT_START_MS) return { kind: "skipped", reason: "not enough time left after prep" };
+  const started = await options.http.post(
+    "/agent-review/start",
+    { ...options.start, remaining_ms: remaining() },
+    Math.max(1, remaining())
+  );
+  if (!started.ok) return { kind: "failed", reason: `start: ${started.error}` };
+  if (!started.data.enabled) return { kind: "disabled", reason: started.data.reason };
+  let state = started.data.state;
+  let calls = started.data.calls ?? [];
+  let done = started.data.done;
+  let sentOneShot = "pending";
+  const cancel = async () => {
+    await options.http.post("/agent-review/cancel", { state }, CANCEL_TIMEOUT_MS);
+  };
+  for (let turn = 0; !done; turn++) {
+    if (turn >= MAX_TURNS || remaining() < MIN_TURN_MS) break;
+    const results = await options.executeTools(calls);
+    let oneShot;
+    const current = settled;
+    if (current && sentOneShot === "pending") {
+      oneShot = current.ok ? { status: "arrived", findings: summarizeFindings(current.response) } : { status: "failed" };
+      sentOneShot = oneShot.status;
+    }
+    const turnRequest = { state, remaining_ms: remaining(), results, ...oneShot ? { one_shot: oneShot } : {} };
+    const next = await options.http.post("/agent-review/turn", turnRequest, Math.max(1, remaining()));
+    if (!next.ok) {
+      await cancel();
+      return { kind: "failed", reason: `turn: ${next.error}` };
+    }
+    state = next.data.state;
+    calls = next.data.calls ?? [];
+    done = next.data.done;
+  }
+  if (!settled) {
+    const wait = Math.max(0, remaining() - FINISH_TIMEOUT_MS);
+    await Promise.race([oneShotDone, new Promise((resolve6) => setTimeout(resolve6, wait))]);
+  }
+  const finished = await options.http.post(
+    "/agent-review/finish",
+    { state, session_id: options.sessionId, one_shot: finishOneShot(settled) },
+    FINISH_TIMEOUT_MS
+  );
+  if (!finished.ok) {
+    await cancel();
+    return { kind: "failed", reason: `finish: ${finished.error}` };
+  }
+  return { kind: "finished", response: finished.data };
+}
+
+// src/lib/agent-tools.ts
+var TOOL_LIMITS = {
+  outputChars: 16e3,
+  readLines: 400,
+  blameLines: 200,
+  searchHits: 50,
+  searchLineChars: 300,
+  listEntries: 200,
+  logCommits: 8,
+  textChars: 200,
+  pathChars: 400,
+  fileBytes: 4 * 1024 * 1024,
+  gitTimeoutMs: 2e3,
+  diffTimeoutMs: 1e4,
+  concurrency: 4
+};
+var DENIED_PATHS = [
+  /(^|\/)\.env(\.[^/]*)?$/i,
+  /\.(pem|key|p12|pfx|jks|keystore|asc|gpg|kdbx)$/i,
+  /(^|\/)id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i,
+  /(^|\/)\.(npmrc|netrc|pypirc|pgpass|git-credentials)$/i,
+  /(^|\/)(credentials|secrets?)(\.[^/]*)?$/i,
+  /(^|\/)\.(ssh|aws|gnupg|docker)(\/|$)/i,
+  /(^|\/)\.git(\/|$)/
+];
+function isDeniedPath(path) {
+  return DENIED_PATHS.some((pattern) => pattern.test(path)) || isVerityOwnedPath(path);
+}
+function validateRepoPath(value, { allowRoot = false } = {}) {
+  if (typeof value !== "string") return { ok: false, error: "path must be a string" };
+  let path = value.replace(/\\/g, "/").replace(/^\.\/+/, "");
+  if (allowRoot && (path === "" || path === ".")) return { ok: true, value: "" };
+  path = path.replace(/\/+$/, "");
+  if (!path || path.length > TOOL_LIMITS.pathChars) return { ok: false, error: "path is empty or too long" };
+  if (/[-]/.test(path)) return { ok: false, error: "path contains control characters" };
+  if (path.startsWith("/") || /^[A-Za-z]:/.test(path)) return { ok: false, error: "path must be relative to the repository root" };
+  if (path.split("/").some((segment) => segment === "..")) return { ok: false, error: "path must not leave the repository" };
+  if (path.startsWith("-") || path.startsWith(":")) return { ok: false, error: 'path must not start with "-" or ":"' };
+  if (isDeniedPath(path)) return { ok: false, error: "reading this path is not allowed" };
+  return { ok: true, value: path };
+}
+function lineNumber(value, fallback) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : fallback;
+}
+function capOutput(text) {
+  return text.length > TOOL_LIMITS.outputChars ? `${text.slice(0, TOOL_LIMITS.outputChars)}
+[truncated at ${TOOL_LIMITS.outputChars} characters]` : text;
+}
+function git(ctx, args, opts = {}) {
+  return runGit(ctx.root, args, { timeoutMs: opts.timeoutMs ?? TOOL_LIMITS.gitTimeoutMs, maxBuffer: opts.maxBuffer ?? TOOL_LIMITS.fileBytes });
+}
+function gitFailure(res, what) {
+  if (res.error === "timeout") return `${what} timed out`;
+  if (res.error === "too_large") return `${what} is too large`;
+  const detail = res.stderr.trim().split("\n")[0]?.slice(0, 160);
+  return detail ? `${what} failed: ${detail}` : `${what} failed`;
+}
+var INDEX = Symbol("index");
+function changeRevision(range) {
+  return range.kind === "push" ? range.head : INDEX;
+}
+function baseRevision(range) {
+  return range.kind === "push" ? range.base : "HEAD";
+}
+function objectSpec(revision, path) {
+  return revision === INDEX ? `:${path}` : `${revision}:${path}`;
+}
+async function readBlob(ctx, revision, path) {
+  const res = await git(ctx, ["cat-file", "blob", objectSpec(revision, path)]);
+  if (!res.ok) {
+    if (res.error === "failed") return { ok: false, error: `${path} is not a file in ${revision === INDEX ? "the staged version" : "that version"}` };
+    return { ok: false, error: gitFailure(res, `reading ${path}`) };
+  }
+  if (res.stdout.slice(0, 8e3).includes("\0")) return { ok: false, error: `${path} is a binary file` };
+  return { ok: true, value: res.stdout };
+}
+function numberedRange(content, startLine, endLine, maxLines) {
+  const lines = content.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const total = lines.length;
+  const from = Math.min(Math.max(1, startLine), Math.max(1, total));
+  const to = Math.min(total, Math.max(from, endLine), from + maxLines - 1);
+  const width = String(to).length;
+  const body = lines.slice(from - 1, to).map((line, i) => `${String(from + i).padStart(width, " ")}| ${line}`).join("\n");
+  return `lines ${total === 0 ? 0 : from}-${to} of ${total}
+${body}`;
+}
+async function resolveRevision(ctx, value) {
+  if (value === "head") return { ok: true, value: changeRevision(ctx.range) };
+  if (value === "base") {
+    const base = baseRevision(ctx.range);
+    return base ? { ok: true, value: base } : { ok: false, error: "this change has no base version" };
+  }
+  if (typeof value === "string" && /^[0-9a-f]{7,40}$/.test(value)) {
+    const res = await git(ctx, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${value}^{commit}`]);
+    if (res.ok && res.stdout.trim()) return { ok: true, value: res.stdout.trim() };
+    return { ok: false, error: `unknown commit ${value}` };
+  }
+  return { ok: false, error: 'revision must be "base", "head", or a commit hash from git_log' };
+}
+var readFileTool = async (ctx, args) => {
+  const path = validateRepoPath(args.path);
+  if (!path.ok) return path;
+  const blob = await readBlob(ctx, changeRevision(ctx.range), path.value);
+  if (!blob.ok) return blob;
+  const start = lineNumber(args.start_line, 1);
+  const end = lineNumber(args.end_line, start + TOOL_LIMITS.readLines - 1);
+  return { ok: true, value: `${path.value} (${ctx.range.kind === "push" ? "pushed version" : "staged version"}), ${numberedRange(blob.value, start, end, TOOL_LIMITS.readLines)}` };
+};
+var gitShowTool = async (ctx, args) => {
+  const path = validateRepoPath(args.path);
+  if (!path.ok) return path;
+  const revision = await resolveRevision(ctx, args.revision);
+  if (!revision.ok) return revision;
+  const blob = await readBlob(ctx, revision.value, path.value);
+  if (!blob.ok) return blob;
+  const start = lineNumber(args.start_line, 1);
+  const end = lineNumber(args.end_line, start + TOOL_LIMITS.readLines - 1);
+  return { ok: true, value: `${path.value} at ${String(args.revision)}, ${numberedRange(blob.value, start, end, TOOL_LIMITS.readLines)}` };
+};
+var gitDiffTool = async (ctx, args) => {
+  const path = validateRepoPath(args.path);
+  if (!path.ok) return path;
+  const range = ctx.range;
+  let diffArgs;
+  if (range.kind === "push") {
+    if (!range.base) return { ok: false, error: "this push has no base to diff against" };
+    diffArgs = ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", range.base, range.head];
+  } else {
+    diffArgs = ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", "--cached"];
+  }
+  const res = await git(ctx, ["--literal-pathspecs", ...diffArgs, "--", path.value]);
+  if (!res.ok) return { ok: false, error: gitFailure(res, "diff") };
+  return { ok: true, value: res.stdout.trim() ? capOutput(res.stdout) : `no changes to ${path.value} in the change under review` };
+};
+var gitLogTool = async (ctx, args) => {
+  const path = validateRepoPath(args.path);
+  if (!path.ok) return path;
+  const count = Math.min(TOOL_LIMITS.logCommits, lineNumber(args.max_count, TOOL_LIMITS.logCommits));
+  const revision = ctx.range.kind === "push" ? ctx.range.head : "HEAD";
+  const res = await git(ctx, [
+    "--literal-pathspecs",
+    "log",
+    "--no-show-signature",
+    "--no-color",
+    "-n",
+    String(count),
+    "--date=short",
+    "--format=%h %ad %s",
+    revision,
+    "--",
+    path.value
+  ]);
+  if (!res.ok) return { ok: false, error: gitFailure(res, "log") };
+  return { ok: true, value: res.stdout.trim() ? capOutput(res.stdout.trim()) : `no commits touch ${path.value}` };
+};
+var gitBlameTool = async (ctx, args) => {
+  const path = validateRepoPath(args.path);
+  if (!path.ok) return path;
+  const start = lineNumber(args.start_line, 1);
+  const end = Math.min(lineNumber(args.end_line, start), start + TOOL_LIMITS.blameLines - 1);
+  const revision = ctx.range.kind === "push" ? ctx.range.head : "HEAD";
+  const res = await git(ctx, ["blame", "--no-textconv", "-s", "-L", `${start},${Math.max(start, end)}`, revision, "--", path.value]);
+  if (!res.ok) return { ok: false, error: gitFailure(res, "blame") };
+  return { ok: true, value: capOutput(res.stdout.trimEnd()) };
+};
+var listFilesTool = async (ctx, args) => {
+  const dir = validateRepoPath(args.dir, { allowRoot: true });
+  if (!dir.ok) return dir;
+  const glob = typeof args.glob === "string" && args.glob.length > 0 && args.glob.length <= 200 ? args.glob : null;
+  const scope2 = dir.value || ".";
+  const res = ctx.range.kind === "push" ? await git(ctx, ["--literal-pathspecs", "ls-tree", "-r", "--name-only", "-z", ctx.range.head, "--", scope2]) : await git(ctx, ["--literal-pathspecs", "ls-files", "-z", "--cached", "--", scope2]);
+  if (!res.ok) return { ok: false, error: gitFailure(res, "listing") };
+  const paths = res.stdout.split("\0").filter((p) => p && !isDeniedPath(p) && (!glob || globMatch2(glob, p)));
+  const shown = paths.slice(0, TOOL_LIMITS.listEntries);
+  const more = paths.length - shown.length;
+  return { ok: true, value: shown.length ? `${shown.join("\n")}${more > 0 ? `
+\u2026 ${more} more` : ""}` : "no matching files" };
+};
+var searchTool = async (ctx, args) => {
+  const text = args.text;
+  if (typeof text !== "string" || text.length === 0 || text.length > TOOL_LIMITS.textChars || /[\n\r]/.test(text)) {
+    return { ok: false, error: `text must be 1-${TOOL_LIMITS.textChars} characters on one line` };
+  }
+  const glob = typeof args.path_glob === "string" && args.path_glob.length > 0 ? args.path_glob : null;
+  if (glob && (glob.length > 200 || /[-]/.test(glob) || glob.startsWith("-"))) {
+    return { ok: false, error: "path_glob is not a valid glob" };
+  }
+  const pathspec = glob ? [`:(glob)${glob}`] : [];
+  const revision = ctx.range.kind === "push" ? [ctx.range.head] : ["--cached"];
+  const res = await git(ctx, ["grep", "-n", "-I", "-F", "--no-color", ...revision.filter((r) => r === "--cached"), "-e", text, ...revision.filter((r) => r !== "--cached"), "--", ...pathspec]);
+  if (!res.ok) {
+    if (res.error === "failed" && res.stderr.trim() === "") return { ok: true, value: "no matches" };
+    return { ok: false, error: gitFailure(res, "search") };
+  }
+  const prefix = ctx.range.kind === "push" ? `${ctx.range.head}:` : "";
+  const hits = [];
+  for (const raw of res.stdout.split("\n")) {
+    if (!raw) continue;
+    const line = prefix && raw.startsWith(prefix) ? raw.slice(prefix.length) : raw;
+    const file = line.slice(0, line.indexOf(":"));
+    if (isDeniedPath(file)) continue;
+    hits.push(line.length > TOOL_LIMITS.searchLineChars ? `${line.slice(0, TOOL_LIMITS.searchLineChars)}\u2026` : line);
+    if (hits.length >= TOOL_LIMITS.searchHits) break;
+  }
+  return { ok: true, value: hits.length ? hits.join("\n") : "no matches" };
+};
+var TOOLS = {
+  read_file: readFileTool,
+  search: searchTool,
+  list_files: listFilesTool,
+  git_log: gitLogTool,
+  git_blame: gitBlameTool,
+  git_show: gitShowTool,
+  git_diff: gitDiffTool
+};
+function makeToolExecutor(ctx) {
+  return async (calls) => {
+    const results = new Array(calls.length);
+    let next = 0;
+    const worker = async () => {
+      while (next < calls.length) {
+        const index = next++;
+        const call = calls[index];
+        const tool = TOOLS[call.name];
+        if (!tool) {
+          results[index] = { call_id: call.call_id, ok: false, error: `unknown tool ${call.name}` };
+          continue;
+        }
+        try {
+          const outcome = await tool(ctx, call.arguments ?? {});
+          results[index] = outcome.ok ? { call_id: call.call_id, ok: true, output: capOutput(outcome.value) } : { call_id: call.call_id, ok: false, error: outcome.error };
+        } catch (err) {
+          results[index] = { call_id: call.call_id, ok: false, error: `tool failed: ${String(err?.message ?? err).slice(0, 160)}` };
+        }
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(TOOL_LIMITS.concurrency, calls.length) }, worker));
+    return results;
+  };
+}
+async function buildAgentDiffs(ctx, paths, limits = { perFileChars: 24e3, totalChars: 12e4 }) {
+  const valid = paths.filter((p) => validateRepoPath(p).ok);
+  if (valid.length === 0 || ctx.range.kind === "nothing") return [];
+  if (ctx.range.kind === "push" && !ctx.range.base) return [];
+  const args = ctx.range.kind === "push" ? ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", ctx.range.base, ctx.range.head] : ["diff", ...DIFF_READ_FLAGS, "--no-color", "-U10", "--cached"];
+  const res = await git(ctx, ["--literal-pathspecs", ...args, "--", ...valid], { timeoutMs: TOOL_LIMITS.diffTimeoutMs, maxBuffer: 16 * 1024 * 1024 });
+  if (!res.ok) return [];
+  const out = [];
+  let total = 0;
+  for (const chunk of res.stdout.split(/^(?=diff --git )/m)) {
+    if (!chunk.startsWith("diff --git ")) continue;
+    const plus = /^\+\+\+ b\/(.+)$/m.exec(chunk);
+    const minus = /^--- a\/(.+)$/m.exec(chunk);
+    const path = plus?.[1] ?? minus?.[1] ?? /^diff --git a\/(\S+)/.exec(chunk)?.[1];
+    if (!path || isDeniedPath(path)) continue;
+    const room = Math.min(limits.perFileChars, limits.totalChars - total);
+    if (room <= 0) break;
+    const diff = chunk.length > room ? chunk.slice(0, room) : chunk;
+    total += diff.length;
+    out.push({ path, diff });
+  }
+  return out;
+}
+
+// src/commands/guard.ts
+var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path34.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path35.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     try {
-      if (process.stdin.isTTY) return resolve5(empty);
+      if (process.stdin.isTTY) return resolve6(empty);
       const chunks = [];
       let timer;
       let settled = false;
@@ -24837,7 +26039,7 @@ function readPreToolUseStdin() {
         process.stdin.removeListener("end", onEnd);
         process.stdin.removeListener("error", onError);
         process.stdin.pause();
-        resolve5(value);
+        resolve6(value);
       };
       const onEnd = () => {
         try {
@@ -24858,7 +26060,7 @@ function readPreToolUseStdin() {
       process.stdin.on("error", onError);
       process.stdin.resume();
     } catch {
-      resolve5(empty);
+      resolve6(empty);
     }
   });
 }
@@ -24970,8 +26172,13 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs49.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
-  const staticResults = runCodacyAnalysisIfAvailable(scannable);
+  let staticResults;
+  if (isCodacyAvailable()) {
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs49.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+    staticResults = runCodacyAnalysis(scannable);
+  } else {
+    staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
+  }
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
     static_results: staticResults,
@@ -25034,12 +26241,103 @@ function coverageBlock(c) {
 }
 function emitAllowNotice(userMsg, agentMsg) {
   process.stdout.write(JSON.stringify({
-    systemMessage: userMsg,
-    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: agentMsg }
+    systemMessage: terminalText(userMsg, 8e3),
+    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: terminalText(agentMsg, 4e4) }
   }) + "\n");
   process.exit(0);
 }
+var GATES = ["PASS", "WARN", "FAIL"];
+function worstGate(...gates) {
+  const rank2 = (gate) => {
+    const index = GATES.indexOf(String(gate ?? "").toUpperCase());
+    return index === -1 ? 1 : index;
+  };
+  return GATES[Math.max(...gates.map(rank2))];
+}
+function oneShotLostOutcome(input) {
+  return input.agentGate === "FAIL" && input.agentBlocking ? "block" : "allow-without-review";
+}
+function withAgentVerdict(oneShot, agent) {
+  if (agent.one_shot_source === "none" && typeof oneShot.gate_decision === "string") {
+    const added = agent.findings.filter((f) => f.agent_added === true);
+    return {
+      ...oneShot,
+      gate_decision: worstGate(oneShot.gate_decision, agent.gate_decision ?? "WARN", "WARN"),
+      findings: [...Array.isArray(oneShot.findings) ? oneShot.findings : [], ...added],
+      agent_review: {
+        ...agent.agent_review,
+        gate_decision_before: oneShot.gate_decision,
+        one_shot_source: "none",
+        cleared: [],
+        downgraded: []
+      }
+    };
+  }
+  return {
+    ...oneShot,
+    gate_decision: agent.gate_decision,
+    findings: agent.findings,
+    agent_review: {
+      ...agent.agent_review,
+      gate_decision_before: agent.gate_decision_before,
+      one_shot_source: agent.one_shot_source,
+      cleared: agent.cleared,
+      downgraded: agent.downgraded ?? []
+    }
+  };
+}
+function describeAgentOutcome(outcome) {
+  if (!outcome || outcome.kind === "disabled") return null;
+  if (outcome.kind !== "finished") return `Agent review: not used (${outcome.reason})`;
+  const { agent_review: r, gate_decision: after, gate_decision_before: before } = outcome.response;
+  const checks = Number(r.code_runtime_checks ?? 0) + Number(r.container_checks ?? 0);
+  const verdict = before && after && before !== after ? `, verdict changed from ${before} to ${after}` : "";
+  return `Agent review: ${r.outcome}, ${r.turns} turn(s), ${r.local_calls} read(s), ${checks} code check(s), ${r.cleared} cleared, ${Number(r.downgraded ?? 0)} downgraded, ${r.added} added${verdict}`;
+}
+function startAgentReview(input) {
+  if (process.env.VERITY_GIT_MOMENT_AGENT === "off") return null;
+  const ctx = { root: input.root, range: input.range };
+  const http = {
+    async post(path, body, timeoutMs) {
+      const res = await apiRequest({
+        method: "POST",
+        path,
+        serviceUrl: input.serviceUrl,
+        token: input.token,
+        body,
+        timeout: timeoutMs,
+        cmd: "guard-agent",
+        verbose: input.verbose,
+        encodeBody: true
+      });
+      return res.ok ? { ok: true, data: res.data } : { ok: false, error: res.error };
+    }
+  };
+  const sentPaths = input.codeDelta.files.map((f) => f.path);
+  const run2 = async () => runAgentReview({
+    http,
+    executeTools: makeToolExecutor(ctx),
+    startedAt: input.hookStartedAt,
+    deadlineMs: AGENT_DEADLINE_MS[input.moment],
+    start: {
+      moment: input.moment,
+      iteration: input.iteration,
+      session_id: input.sessionId,
+      stated_intent: input.statedIntent,
+      changed_files: input.files,
+      sent_paths: sentPaths,
+      diffs: await buildAgentDiffs(ctx, sentPaths),
+      repo_context: input.requestBody.repo_context,
+      static_results: input.requestBody.static_results,
+      one_shot_chars: input.codeDelta.files.reduce((n, f) => n + f.content.length, 0)
+    },
+    oneShot: input.oneShot.then((r) => r.ok ? { ok: true, response: r.data } : { ok: false }),
+    sessionId: input.sessionId
+  });
+  return run2().catch((err) => ({ kind: "failed", reason: String(err?.message ?? err) }));
+}
 async function runGuard(opts, globals) {
+  const hookStartedAt = Date.now();
   const on = resolveGuardMoments(opts.on);
   if (on.length === 0) process.exit(0);
   const { command, cwd, sessionId } = await readPreToolUseStdin();
@@ -25111,12 +26409,12 @@ async function runGuard(opts, globals) {
       cwd: frame.worktreeRoot ?? process.cwd()
     });
     upgradeToExcerpts(repoContext2, {
+      // Rooted, no-follow read from the validated descriptor (safe-read.ts):
+      // site paths come from a search, and a site under a symlinked directory
+      // must not pull a file from outside the tree into the request.
       readFile: (rel) => {
-        try {
-          return (0, import_node_fs49.readFileSync)((0, import_node_path34.join)(frame.worktreeRoot ?? process.cwd(), rel), "utf8");
-        } catch {
-          return null;
-        }
+        const read = readRegularFileInRoot(frame.worktreeRoot ?? process.cwd(), rel, EXCERPT_SOURCE_MAX_BYTES);
+        return read.ok ? read.content : null;
       }
     });
     requestBody.repo_context = repoContext2;
@@ -25127,6 +26425,7 @@ async function runGuard(opts, globals) {
       symbols: repoContext2.symbols?.length ?? 0,
       callers: repoContext2.callers?.length ?? 0,
       tests: repoContext2.tests?.length ?? 0,
+      importers: repoContext2.importers?.length ?? 0,
       excerpts: repoContext2.excerpts?.length ?? 0,
       elapsed_ms: repoContext2.elapsed_ms ?? null
     });
@@ -25145,7 +26444,7 @@ async function runGuard(opts, globals) {
   };
   logToFileOnly(coverageBlock(coverage));
   const reviewStart = Date.now();
-  const result = await analyzeRequest({
+  const oneShot = analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
     body: requestBody,
@@ -25153,22 +26452,51 @@ async function runGuard(opts, globals) {
     timeout: 29e4,
     cmd: "guard"
   });
+  const agent = startAgentReview({
+    serviceUrl: urlResult.data,
+    token: tokenResult.data.token,
+    verbose: globals.verbose,
+    hookStartedAt,
+    moment,
+    root: frame.worktreeRoot,
+    range,
+    iteration: iter + 1,
+    sessionId,
+    statedIntent,
+    files,
+    codeDelta,
+    requestBody,
+    oneShot
+  });
+  const result = await oneShot;
+  const agentOutcome = agent ? await agent : null;
+  const agentVerdict = agentOutcome?.kind === "finished" && agentOutcome.response.gate_decision ? agentOutcome.response : null;
   const reviewSecs = Math.max(1, Math.round((Date.now() - reviewStart) / 1e3));
+  const oneShotResponse = result.ok ? result.data : {};
+  const response = agentVerdict ? withAgentVerdict(oneShotResponse, agentVerdict) : oneShotResponse;
+  if (opts.json) process.stderr.write(JSON.stringify(response) + "\n");
+  const decision = response.gate_decision ?? "(unrecognised)";
+  const viewUrl = response.view_url ?? "";
+  const link = viewUrl ? ` \u2014 ${viewUrl}` : "";
+  const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
+  const agentLine = describeAgentOutcome(agentOutcome);
+  const covDetail = agentLine ? `${coverageBlock(coverage)}
+  ${agentLine}` : coverageBlock(coverage);
+  const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
   if (!result.ok) {
     const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
+    if (oneShotLostOutcome({ agentGate: decision, agentBlocking: hasBlockingFinding(response, witnessed) }) === "block") {
+      writeIter(moment, iter + 1);
+      writeBlockMessage(moment, response, covDetail);
+      process.exit(2);
+    }
+    const agentNote = agentLine ? ` ${agentLine}, but it reviewed only part of the change.` : "";
     emitAllowNotice(
-      `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "service offline"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
-      `Verity ${moment}: ${authRemedy ? "not authorized" : "service unavailable"} (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${authRemedy}`
+      `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "no single-pass review"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
+      `Verity ${moment}: the single-pass review did not come back (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${agentNote}${authRemedy}`
     );
   }
-  if (opts.json) process.stderr.write(JSON.stringify(result.data) + "\n");
-  const response = result.data;
-  const decision = response.gate_decision ?? "(unrecognised)";
-  const viewUrl = response.view_url ?? "";
-  const link = viewUrl ? ` \u2014 ${viewUrl}` : "";
-  const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
-  const covDetail = coverageBlock(coverage);
-  if (decision === "FAIL" && hasBlockingFinding(response, codeDelta.files.map((f) => f.path))) {
+  if (decision === "FAIL" && hasBlockingFinding(response, witnessed)) {
     writeIter(moment, iter + 1);
     writeBlockMessage(moment, response, covDetail);
     process.exit(2);
@@ -25187,12 +26515,16 @@ async function runGuard(opts, globals) {
   emitAllowNotice(notice.user, notice.agent);
 }
 function verdictNotice(ctx) {
-  const { moment, verb, covLine, covDetail, link, viewUrl } = ctx;
-  const decision = ctx.decision ?? "(unrecognised)";
+  const { moment, verb } = ctx;
+  const covLine = terminalText(ctx.covLine, 500);
+  const covDetail = terminalText(ctx.covDetail, 2e4);
+  const link = terminalText(ctx.link, 2100);
+  const viewUrl = terminalUrl(ctx.viewUrl);
+  const decision = ctx.decision == null ? "(unrecognised)" : terminalText(ctx.decision, 60);
   const report = viewUrl ? `
 Report: ${viewUrl}` : "";
   if (decision === "FAIL") {
-    const narrative = ctx.narrative ?? "";
+    const narrative = terminalText(ctx.narrative, 4e3);
     return {
       user: `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
       agent: `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
@@ -25223,9 +26555,9 @@ function writeBlockMessage(moment, response, covDetail) {
   const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
   const verb = moment === "pre-commit" ? "commit" : "push";
   const assessment = response.assessment;
-  const narrative = assessment?.narrative ?? "";
-  const findings = response.findings ?? [];
-  const viewUrl = response.view_url ?? "";
+  const narrative = terminalText(assessment?.narrative, 4e3);
+  const findings = Array.isArray(response.findings) ? response.findings : [];
+  const viewUrl = terminalUrl(response.view_url);
   process.stderr.write(`${RED}${BOLD}\u2501\u2501\u2501 Verity ${label2} gate: FAIL \u2501\u2501\u2501${NC}
 
 `);
@@ -25238,18 +26570,18 @@ function writeBlockMessage(moment, response, covDetail) {
 
 `);
     for (const f of agentFindings) {
-      const severity = (f.severity ?? "").toUpperCase();
+      const severity = terminalText(f.severity, 20).toUpperCase();
       const fix = f.fix;
-      process.stderr.write(`[${severity}] ${f.title ?? ""}
+      process.stderr.write(`[${severity}] ${terminalText(f.title, 300)}
 `);
-      process.stderr.write(`  File: ${f.file ?? ""}:${f.line ?? ""}
+      process.stderr.write(`  File: ${terminalText(f.file, 400)}:${terminalText(String(f.line ?? ""), 12)}
 `);
-      process.stderr.write(`  Fix: ${fix?.description ?? "See description"}
+      process.stderr.write(`  Fix: ${terminalText(fix?.description, 2e3) || "See description"}
 
 `);
     }
   }
-  process.stderr.write(`${DIM}${covDetail}${NC}
+  process.stderr.write(`${DIM}${terminalText(covDetail, 2e4)}${NC}
 
 `);
   if (viewUrl) process.stderr.write(`${CYAN}Full report: ${viewUrl}${NC}
@@ -25410,10 +26742,10 @@ function registerWaiveCommand(program2) {
 
 // src/commands/init.ts
 var import_node_fs54 = require("node:fs");
-var import_promises17 = require("node:fs/promises");
+var import_promises19 = require("node:fs/promises");
 var import_yaml6 = __toESM(require_dist());
-var import_node_path37 = require("node:path");
-var import_node_child_process16 = require("node:child_process");
+var import_node_path38 = require("node:path");
+var import_node_child_process17 = require("node:child_process");
 
 // src/lib/banner.ts
 var WORDMARK = [
@@ -25494,10 +26826,15 @@ function printPhase(n, of, title, subtitle) {
 var import_node_fs51 = require("node:fs");
 
 // src/lib/prereqs.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
-  return whichSync(bin, { real: false });
+  try {
+    const out = (0, import_node_child_process15.execSync)(`command -v ${bin}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
 }
 function checkNode() {
   const version = process.version;
@@ -25515,7 +26852,7 @@ function checkNode() {
 function checkGit() {
   let detail = "";
   try {
-    detail = (0, import_node_child_process14.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    detail = (0, import_node_child_process15.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return {
       id: "git",
@@ -25552,13 +26889,13 @@ function checkAnalysisCli() {
 }
 var INSTALL_TIMEOUT_MS = 12e4;
 function run(command, args, opts = {}) {
-  return new Promise((resolve5) => {
-    const child = (0, import_node_child_process14.spawn)(command, args, {
+  return new Promise((resolve6) => {
+    const child = (0, import_node_child_process15.spawn)(command, args, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
-    child.on("error", () => resolve5(false));
-    child.on("close", (code) => resolve5(code === 0));
+    child.on("error", () => resolve6(false));
+    child.on("close", (code) => resolve6(code === 0));
   });
 }
 async function installAnalysisCli() {
@@ -25602,7 +26939,7 @@ async function checkPrereqs(opts = {}) {
 }
 
 // src/lib/telemetry.ts
-var import_promises15 = require("node:fs/promises");
+var import_promises17 = require("node:fs/promises");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var GITIGNORE_FILE = ".gitignore";
 var GITIGNORE_ENTRY = SETTINGS_LOCAL_IGNORE_ENTRY;
@@ -25632,7 +26969,7 @@ function buildTelemetryEnv(serviceUrl) {
 var VERITY_TELEMETRY_KEYS = Object.keys(buildTelemetryEnv(""));
 async function readSettingsLocal() {
   try {
-    return JSON.parse(await (0, import_promises15.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
+    return JSON.parse(await (0, import_promises17.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
   } catch {
     return {};
   }
@@ -25644,7 +26981,7 @@ async function ensureGitignore() {
   const file = projectPath(GITIGNORE_FILE);
   let content = "";
   try {
-    content = await (0, import_promises15.readFile)(file, "utf-8");
+    content = await (0, import_promises17.readFile)(file, "utf-8");
   } catch {
   }
   const lines = content.split("\n").map((l) => l.trim());
@@ -25653,7 +26990,7 @@ async function ensureGitignore() {
   }
   const block = "# Verity telemetry \u2014 machine-local Claude Code settings\n" + GITIGNORE_ENTRY + "\n";
   const next = content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block;
-  await (0, import_promises15.writeFile)(file, next);
+  await (0, import_promises17.writeFile)(file, next);
 }
 async function installTelemetry(serviceUrl) {
   const env = buildTelemetryEnv(serviceUrl);
@@ -25834,15 +27171,15 @@ function registerDoctorCommand(program2) {
 
 // src/commands/migrate.ts
 var import_node_fs52 = require("node:fs");
-var import_node_path35 = require("node:path");
-var import_node_child_process15 = require("node:child_process");
+var import_node_path36 = require("node:path");
+var import_node_child_process16 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process15.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process16.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process15.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process16.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -25850,7 +27187,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process15.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process16.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -25871,8 +27208,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path35.join)(root, ".gate");
-  const verityDir = (0, import_node_path35.join)(root, ".verity");
+  const gateDir = (0, import_node_path36.join)(root, ".gate");
+  const verityDir = (0, import_node_path36.join)(root, ".verity");
   if ((0, import_node_fs52.existsSync)(gateDir) && !(0, import_node_fs52.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -25890,7 +27227,7 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process15.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process16.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
@@ -25926,11 +27263,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path35.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path35.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path36.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path36.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs52.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs52.existsSync)(verityCreds)) {
-    (0, import_node_fs52.mkdirSync)((0, import_node_path35.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs52.mkdirSync)((0, import_node_path36.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -25952,7 +27289,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path35.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path36.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs52.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -25963,13 +27300,13 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path35.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path35.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path36.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path36.join)(root, "VERITY.md");
   if (!(0, import_node_fs52.existsSync)(gateMd) || (0, import_node_fs52.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process15.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process16.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -25981,7 +27318,7 @@ function migrateStandardFile(root, actions) {
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path35.join)(root, ".claude", "settings.local.json");
+  const file = (0, import_node_path36.join)(root, ".claude", "settings.local.json");
   if (!(0, import_node_fs52.existsSync)(file)) return;
   let settings;
   try {
@@ -26029,8 +27366,8 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
     toAppend.push(line.replace(/\r$/, ""));
   }
   if (toAppend.length > 0) {
-    const sep3 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs52.writeFileSync)(verityCreds, verityContent + sep3 + toAppend.join("\n") + "\n");
+    const sep4 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
+    (0, import_node_fs52.writeFileSync)(verityCreds, verityContent + sep4 + toAppend.join("\n") + "\n");
   }
   (0, import_node_fs52.rmSync)(gateCreds, { force: true });
   return toAppend.length;
@@ -26044,7 +27381,7 @@ function readFileSyncSafe(path) {
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process15.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process16.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -26071,15 +27408,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path35.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path36.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs52.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path35.join)(relDir, entry) : entry;
-      const src = (0, import_node_path35.join)(gateDir, rel);
-      const dest = (0, import_node_path35.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path36.join)(relDir, entry) : entry;
+      const src = (0, import_node_path36.join)(gateDir, rel);
+      const dest = (0, import_node_path36.join)(verityDir, rel);
       if ((0, import_node_fs52.statSync)(src).isDirectory()) {
         walk2(rel);
       } else if (!(0, import_node_fs52.existsSync)(dest)) {
-        (0, import_node_fs52.mkdirSync)((0, import_node_path35.dirname)(dest), { recursive: true });
+        (0, import_node_fs52.mkdirSync)((0, import_node_path36.dirname)(dest), { recursive: true });
         (0, import_node_fs52.cpSync)(src, dest);
         copied++;
       }
@@ -26089,22 +27426,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path35.join)(root, ".gate");
-  const verityDir = (0, import_node_path35.join)(root, ".verity");
+  const gateDir = (0, import_node_path36.join)(root, ".gate");
+  const verityDir = (0, import_node_path36.join)(root, ".verity");
   if ((0, import_node_fs52.existsSync)(gateDir) && !(0, import_node_fs52.existsSync)(verityDir)) return true;
   if ((0, import_node_fs52.existsSync)(gateDir) && (0, import_node_fs52.existsSync)(verityDir)) {
-    if ((0, import_node_fs52.existsSync)((0, import_node_path35.join)(gateDir, "credentials")) && !(0, import_node_fs52.existsSync)((0, import_node_path35.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(gateDir, "credentials")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs52.existsSync)((0, import_node_path35.join)(gateDir, "memory")) && !(0, import_node_fs52.existsSync)((0, import_node_path35.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(gateDir, "memory")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path35.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path36.join)(root, "CLAUDE.md");
   if ((0, import_node_fs52.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs52.existsSync)((0, import_node_path35.join)(root, "GATE.md")) && !(0, import_node_fs52.existsSync)((0, import_node_path35.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(root, "GATE.md")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -26233,7 +27570,7 @@ function runSelect(opts) {
     cursor: initialIdx[0] ?? 0,
     chosen: new Set(mode2 === "single" ? [initialIdx[0] ?? 0] : initialIdx)
   };
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let painted = 0;
     let settled = false;
     const draw = () => {
@@ -26281,7 +27618,7 @@ function runSelect(opts) {
       if (settled) return;
       settled = true;
       restore();
-      resolve5(value);
+      resolve6(value);
     };
     readline2.emitKeypressEvents(input);
     input.setRawMode(true);
@@ -26302,9 +27639,9 @@ async function askLine(question, io = {}) {
     output: io.output ?? process.stdout
   });
   try {
-    return await new Promise((resolve5) => {
-      rl.question(question).then((a) => resolve5(a.trim())).catch(() => resolve5(null));
-      rl.once("close", () => setImmediate(() => resolve5(null)));
+    return await new Promise((resolve6) => {
+      rl.question(question).then((a) => resolve6(a.trim())).catch(() => resolve6(null));
+      rl.once("close", () => setImmediate(() => resolve6(null)));
     });
   } finally {
     rl.close();
@@ -26386,8 +27723,8 @@ async function promptMultiSelect(question, choices, fallback) {
 
 // src/lib/remote-config.ts
 var import_node_fs53 = require("node:fs");
-var import_promises16 = require("node:fs/promises");
-var import_node_path36 = require("node:path");
+var import_promises18 = require("node:fs/promises");
+var import_node_path37 = require("node:path");
 var import_yaml5 = __toESM(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -26436,7 +27773,7 @@ async function adoptRemoteSetup(found, opts) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
-      const local = await (0, import_promises16.readFile)(localIgnore, "utf-8").catch(() => null);
+      const local = await (0, import_promises18.readFile)(localIgnore, "utf-8").catch(() => null);
       if (local !== null && local !== rider) {
         notes.push(`${VERITYIGNORE_FILE} already exists here and differs from the pushed copy \u2014 kept yours.`);
       }
@@ -26463,10 +27800,10 @@ async function adoptRemoteSetup(found, opts) {
   written.push(VERITY_MD_FILE);
   return { written, notes };
 }
-async function writeOut(relative3, body) {
-  const target = projectPath(relative3);
-  await (0, import_promises16.mkdir)((0, import_node_path36.dirname)(target), { recursive: true });
-  await (0, import_promises16.writeFile)(target, body);
+async function writeOut(relative2, body) {
+  const target = projectPath(relative2);
+  await (0, import_promises18.mkdir)((0, import_node_path37.dirname)(target), { recursive: true });
+  await (0, import_promises18.writeFile)(target, body);
 }
 function describeRemote(found) {
   const when = found.standard.createdAt.slice(0, 10);
@@ -26536,7 +27873,7 @@ async function runOptionalAuth(resolution, opts = {}) {
   }
   let remote = "";
   try {
-    remote = (0, import_node_child_process16.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process17.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
   if (!healed) {
@@ -26582,15 +27919,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path37.join)(__dirname, "..", "data"),
+    (0, import_node_path38.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path37.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path38.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path37.join)(process.cwd(), "cli", "data")
+    (0, import_node_path38.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs54.existsSync)((0, import_node_path37.join)(candidate, "skills"))) {
+    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -26599,8 +27936,8 @@ function resolveDataDir2() {
   );
 }
 async function copyDir(src, dest) {
-  await (0, import_promises17.mkdir)(dest, { recursive: true });
-  await (0, import_promises17.cp)(src, dest, { recursive: true, force: true });
+  await (0, import_promises19.mkdir)(dest, { recursive: true });
+  await (0, import_promises19.cp)(src, dest, { recursive: true, force: true });
 }
 async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
@@ -26608,7 +27945,7 @@ async function skillIsCurrent(src, dest) {
     const walk2 = (d, prefix) => {
       for (const e of (0, import_node_fs54.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path37.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path38.join)(d, e.name), rel);
         else if (e.isFile()) out.push(rel);
       }
     };
@@ -26619,8 +27956,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises17.readFile)((0, import_node_path37.join)(src, rel), "utf-8");
-      const b = await (0, import_promises17.readFile)((0, import_node_path37.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises19.readFile)((0, import_node_path38.join)(src, rel), "utf-8");
+      const b = await (0, import_promises19.readFile)((0, import_node_path38.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -26807,7 +28144,7 @@ async function healStaleAnalysisConfig(globals) {
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
   printWarn("  running silently with nothing enabled. Re-deriving it from your Standard\u2026");
   try {
-    const content = (0, import_yaml6.parse)(await (0, import_promises17.readFile)(standardPath, "utf-8"));
+    const content = (0, import_yaml6.parse)(await (0, import_promises19.readFile)(standardPath, "utf-8"));
     const derived = await deriveConfigForStandard(content);
     for (const path of derived.written) printInfo(`  ${path} \u2713 (re-derived)`);
     for (const note of derived.notes) printWarn(`  ${note}`);
@@ -26888,7 +28225,7 @@ async function handoffToSetup(enabled, claudeInstalled) {
   console.log("  Usually a minute or two. Quit any time \u2014 re-running /verity-setup resumes.");
   console.log("");
   const startedAt = Date.now();
-  const run2 = (0, import_node_child_process16.spawnSync)("claude", ["/verity-setup"], { stdio: "inherit" });
+  const run2 = (0, import_node_child_process17.spawnSync)("claude", ["/verity-setup"], { stdio: "inherit" });
   if (run2.error) {
     printWarn(`Could not start Claude Code: ${run2.error.message}`);
     return instruct("start it yourself and run the skill there");
@@ -26898,12 +28235,12 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path37.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path38.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path37.join)(skillsSource, skill);
-    const dest = (0, import_node_path37.join)(skillsDest, skill);
+    const src = (0, import_node_path38.join)(skillsSource, skill);
+    const dest = (0, import_node_path38.join)(skillsDest, skill);
     if (!(0, import_node_fs54.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
@@ -26972,7 +28309,7 @@ async function checkPrerequisites(step) {
 }
 async function scaffoldProject(step, defaultsOnly) {
   step("Knowledge base, .gitignore and CLAUDE.md");
-  await (0, import_promises17.mkdir)(VERITY_DIR, { recursive: true });
+  await (0, import_promises19.mkdir)(VERITY_DIR, { recursive: true });
   await ensureMemoryDir();
   const ignoreResult = ensureVerityGitignore();
   if (ignoreResult === "failed") {
@@ -27137,8 +28474,8 @@ function registerInitCommand(program2) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
     await scaffoldProject(step, defaultsOnly);
-    const globalVerityDir = (0, import_node_path37.join)(process.env.HOME ?? "", ".verity");
-    await (0, import_promises17.mkdir)(globalVerityDir, { recursive: true });
+    const globalVerityDir = (0, import_node_path38.join)(process.env.HOME ?? "", ".verity");
+    await (0, import_promises19.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
     const gitMoments = [
@@ -27236,7 +28573,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.7" : "dev"
+          cli_version: true ? "0.33.0-experimental.34db3a4" : "dev"
         }
       });
     } catch (err) {
@@ -27287,7 +28624,7 @@ function registerInitCommand(program2) {
 
 // src/commands/uninstall.ts
 var import_node_fs55 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_path39 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -27296,7 +28633,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path38.join)(skillsRoot, name);
+      const dir = (0, import_node_path39.join)(skillsRoot, name);
       if ((0, import_node_fs55.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
@@ -27342,7 +28679,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path38.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path39.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs55.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -27541,7 +28878,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs56 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_path40 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -27582,7 +28919,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs56.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs56.unlinkSync)((0, import_node_path39.join)(cacheDir, entry));
+            (0, import_node_fs56.unlinkSync)((0, import_node_path40.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -27609,7 +28946,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs56.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs56.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs56.unlinkSync)((0, import_node_path39.join)(logsDir, entry));
+            (0, import_node_fs56.unlinkSync)((0, import_node_path40.join)(logsDir, entry));
           } catch {
           }
         }
@@ -27621,10 +28958,52 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
+var import_node_fs57 = require("node:fs");
+
+// src/lib/reflection-globs.ts
+var MAX_GLOBS = 6;
+var PATH_TOKEN = /[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]{1,8}(?::\d+(?::\d+)?)?/g;
+function clean(token) {
+  return token.replace(/:\d+(?::\d+)?$/, "").replace(/^[`'"(\[]+/, "").replace(/[`'"),\].;!?]+$/, "").replace(/^\.\//, "");
+}
+function resolve5(token, treePaths) {
+  if (treePaths.includes(token)) return token;
+  const suffix = token.startsWith("/") ? token : `/${token}`;
+  const matches = treePaths.filter((p) => p.endsWith(suffix));
+  return matches.length === 1 ? matches[0] : null;
+}
+function deriveFileGlobs(text, treePaths) {
+  if (!text || treePaths.length === 0) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of text.match(PATH_TOKEN) ?? []) {
+    const token = clean(raw);
+    if (!token) continue;
+    const path = resolve5(token, treePaths);
+    if (!path || seen.has(path)) continue;
+    seen.add(path);
+    out.push(path);
+    if (out.length >= MAX_GLOBS) break;
+  }
+  return out;
+}
+
+// src/commands/reflect.ts
+async function writeNodeToDisk(args) {
+  try {
+    const written = await applyMemoryWrites(
+      [{ path: args.filePath, content: args.content, node_id: args.nodeId, op: "create" }],
+      { treePaths: listTrackedFiles(), recordBaseline: false }
+    );
+    if (written === 0) return false;
+    return (0, import_node_fs57.existsSync)(projectPath(`${VERITY_DIR}/memory/${args.filePath}`));
+  } catch {
+    return false;
+  }
+}
 function registerReflectCommand(program2) {
-  program2.command("reflect").description("Capture learnings \u2014 auto-extract or submit a human reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-confirmed text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--autonomous", "Record the drafted reflection without a confirm step (auto-detected from TTY / VERITY_AUTONOMOUS when omitted)").action(async (opts) => {
+  program2.command("reflect").description("Capture learnings \u2014 auto-extract or record a reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-dictated text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--confirmed", "The USER authored or confirmed these exact words \u2014 records as human-authored (source: user, confidence 1.0)").option("--file-globs <glob...>", "Files this reflection is about. Without any, the paths cited in the text are used; a reflection matching no file never surfaces in a review").option("--autonomous", "(deprecated, ignored) reflections are always recorded without a confirm step").action(async (opts) => {
     const globals = program2.opts();
-    const mode2 = resolveRunMode({ autonomousFlag: opts.autonomous });
     await ensureMemoryDir();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -27689,9 +29068,14 @@ function registerReflectCommand(program2) {
     if (userInput) {
       const validKinds = ["decision", "gotcha", "pattern", "security", "quality", "intent", "domain", "integration"];
       const kind = validKinds.includes(opts.kind) ? opts.kind : "gotcha";
+      const confirmed = opts.confirmed === true;
+      const source = confirmed ? "user" : "agent";
+      const explicitGlobs = Array.isArray(opts.fileGlobs) ? opts.fileGlobs.map((g) => g.trim()).filter(Boolean) : [];
+      const derivedGlobs = explicitGlobs.length > 0 ? [] : deriveFileGlobs(userInput, listTrackedFiles());
+      const fileGlobs = explicitGlobs.length > 0 ? explicitGlobs : derivedGlobs.length > 0 ? derivedGlobs : inheritedGlobs;
       const result = await apiRequest({
         method: "POST",
-        path: "/compound/memory/nodes",
+        path: "/compound/reflect",
         serviceUrl,
         token,
         body: {
@@ -27699,14 +29083,23 @@ function registerReflectCommand(program2) {
           title: userInput.slice(0, 200),
           body: userInput,
           domains: [],
-          // Inherit globs from the current task's context_files so the
-          // reflection is actually reachable by reviewer injection.
-          // Falls back to [] when there's no task context — user can
-          // edit the markdown later to tighten retrieval.
-          file_globs: inheritedGlobs
+          file_globs: fileGlobs,
+          source,
+          created_by: "reflect",
+          // The server VERIFIES this against the project before writing it —
+          // an id it cannot verify is dropped, never trusted and never an
+          // error. Sending it is what lets an auto-recorded reflection carry
+          // the same attribution a dashboard-written one does; without it the
+          // unreviewed node is the one that cannot say where it came from.
+          ...taskId && { task_id: taskId },
+          // Server-side default for each source; sent explicitly so an older
+          // server (which knows 'user'/'extractor'/'linter' only, and would
+          // silently coerce an unknown source to 'user' at 1.0) still records
+          // an honest confidence for a draft nobody confirmed.
+          confidence: confirmed ? 1 : 0.7
         },
         verbose: globals.verbose,
-        cmd: "reflect_user"
+        cmd: confirmed ? "reflect_user" : "reflect_agent"
       });
       if (!result.ok) {
         printError(`Failed to save reflection: ${result.error}`);
@@ -27714,12 +29107,30 @@ function registerReflectCommand(program2) {
       }
       const nodeId = result.data.node_id;
       const filePath = result.data.file_path;
-      printInfo(`Queued: ${nodeId} (will sync to .verity/memory/${filePath} on next analysis).`);
+      const viewUrl = typeof result.data.view_url === "string" ? result.data.view_url : null;
+      const recordedSource = typeof result.data.source === "string" ? result.data.source : source;
+      const recordedAsUser = recordedSource === "user";
+      const content = typeof result.data.content === "string" ? result.data.content : null;
+      const synced = content !== null && await writeNodeToDisk({ filePath, content, nodeId });
+      printInfo(
+        synced ? `Recorded ${nodeId} \u2192 .verity/memory/${filePath}` : `Recorded ${nodeId} (syncs to .verity/memory/${filePath} on the next analysis).`
+      );
+      if (viewUrl) printInfo(`  ${viewUrl}`);
       printInfo(
-        mode2 === "autonomous" ? "Recorded autonomously (no confirm step) into the project knowledge base." : "Recorded your confirmed reflection into the project knowledge base."
+        recordedAsUser ? "  Recorded as yours (source: user)." : "  Auto-recorded from this task \u2014 nobody reviewed it. Edit or delete the file if it is wrong."
       );
+      if (recordedSource !== source) {
+        printWarn(
+          `Provenance mismatch: sent source "${source}", the service recorded "${recordedSource}". Correct ${nodeId} on the dashboard \u2014 a draft stored as human-authored cannot be told apart later.`
+        );
+      }
+      if (fileGlobs.length === 0) {
+        printWarn(
+          'No files matched \u2014 this reflection will not surface in future reviews. Cite a path in the text, or pass --file-globs "<path or glob>".'
+        );
+      }
       if (taskResolution === "none") {
-        printInfo("(No task context \u2014 reflection lives at the project level.)");
+        printInfo("  (No task context \u2014 reflection lives at the project level.)");
       }
     } else {
       if (!taskId) {
@@ -27806,6 +29217,121 @@ function registerMemoryCommand(program2) {
     }
     process.exit(result.failed === 0 ? 0 : 1);
   });
+  memory.command("pull").description("Download this repo's knowledge graph into .verity/memory/ (the session-start hook runs it)").option("--force", "Fetch every node even if nothing changed since the last pull").option("--quiet", "Print nothing and always exit 0 (for the session-start hook)").action(async (opts) => {
+    const globals = program2.opts();
+    const quiet = !!opts.quiet;
+    const fail = (message) => {
+      if (!quiet) printError(message);
+      process.exit(quiet ? 0 : 1);
+    };
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) return fail(tokenResult.error);
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) return fail(urlResult.error);
+    let result;
+    try {
+      result = await pullRepoMemory({
+        serviceUrl: urlResult.data,
+        token: tokenResult.data.token,
+        verbose: globals.verbose,
+        force: !!opts.force
+      });
+    } catch (err) {
+      return fail(`Could not pull the knowledge graph: ${err.message}`);
+    }
+    logEvent("memory_pull", result.ok ? { status: result.status, received: result.received, written: result.written } : { status: "failed", category: result.category ?? null });
+    if (!result.ok) return fail(`Could not pull the knowledge graph: ${result.error}`);
+    if (!quiet) {
+      printInfo(result.status === "unchanged" ? "Knowledge graph is up to date." : result.status === "tracked" ? "Skipped: .verity/memory/ is tracked by git here, and the pull never rewrites tracked files. Run `verity memory untrack` to make the graph machine-local." : `Pulled ${result.received} node(s); ${result.written} new or updated file(s) written to .verity/memory/.`);
+    }
+    let org;
+    try {
+      org = await pullOrgKnowledge({
+        serviceUrl: urlResult.data,
+        token: tokenResult.data.token,
+        verbose: globals.verbose,
+        force: !!opts.force
+      });
+    } catch (err) {
+      org = { ok: false, error: err.message };
+    }
+    logEvent("memory_org_pull", org.ok ? { status: org.status, received: org.received } : { status: "failed", category: org.category ?? null });
+    if (!quiet) {
+      if (!org.ok) printWarn(`Could not refresh the org knowledge mirror: ${org.error}`);
+      else if (org.status === "pulled") printInfo(`Org knowledge: ${org.received} claim(s) mirrored at ${org.dir}.`);
+      else if (org.status === "unchanged") printInfo("Org knowledge mirror is up to date.");
+    }
+    process.exit(0);
+  });
+  memory.command("org").description("List the org knowledge mirrored for this repository's organization").action(async () => {
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    const dir = orgMirrorDir();
+    if (!dir) {
+      printError("Not a repository with an origin remote, so there is no organization to list.");
+      process.exit(1);
+    }
+    const claims = await readOrgMirror();
+    if (claims.length === 0) {
+      printInfo(`No org knowledge mirrored yet (${dir}). Run \`verity memory pull\`.`);
+      process.exit(0);
+    }
+    for (const c of claims) console.log(`${c.tag_id}  ${c.kind.padEnd(11)} ${c.title}  \xB7 ${c.origin}`);
+    printInfo(`${claims.length} claim(s) at ${dir}. Demote one with \`verity memory demote <id> --reason "\u2026"\`.`);
+    process.exit(0);
+  });
+  memory.command("demote <claim-id>").description("Demote an org knowledge claim for the whole organization, with a reason").requiredOption("--reason <text>", "Why this claim should no longer be shared (1\u2013500 characters)").action(async (claimId, opts) => {
+    const globals = program2.opts();
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(claimId)) {
+      printError("The claim id is the `id` in the mirrored file, a uuid. `verity memory org` lists them.");
+      process.exit(1);
+    }
+    const reason = opts.reason.trim();
+    if (reason.length === 0 || reason.length > 500) {
+      printError("--reason is 1 to 500 characters.");
+      process.exit(1);
+    }
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
+      process.exit(1);
+    }
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    const res = await apiRequest({
+      method: "POST",
+      path: `/memory/org/claims/${claimId}/demote`,
+      serviceUrl: urlResult.data,
+      token: tokenResult.data.token,
+      body: { reason },
+      verbose: globals.verbose,
+      cmd: "memory-demote",
+      extraHeaders: { "X-Verity-Via": "cli" }
+    });
+    if (!res.ok) {
+      printError(`Could not demote the claim: ${res.error}`);
+      process.exit(1);
+    }
+    printInfo(`Demoted ${claimId} for the whole organization. Restore it from the dashboard if that was wrong.`);
+    try {
+      await pullOrgKnowledge({ serviceUrl: urlResult.data, token: tokenResult.data.token, verbose: globals.verbose, force: true });
+    } catch {
+    }
+    process.exit(0);
+  });
   memory.command("untrack").description("Stop committing .verity/memory/ \u2014 the graph stays on disk and leaves your diffs").action(() => {
     try {
       process.chdir(repoRoot());
@@ -27969,8 +29495,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.7").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.7");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.0-experimental.34db3a4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.0-experimental.34db3a4");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();