@codacy/verity-cli 0.33.3-experimental.53cd005 → 0.33.3-experimental.5a3f573

package/bin/verity.js

@@ -15677,9 +15677,34 @@ async function githubCanSeeRepo(owner, repo, token) {
   if (res.ok) return { ok: true, data: true };
   return { ok: false, error: `GitHub repo lookup failed (HTTP ${res.status})` };
 }
-async function githubDeviceFlow() {
-  const override = process.env.VERITY_PROVIDER_TOKEN;
-  if (override) return { ok: true, data: override };
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+function isSafeText(v) {
+  return typeof v === "string" && v.length > 0 && v.length < 2048 && !CONTROL_CHARS.test(v);
+}
+var GITHUB_DEVICE_VERIFICATION_URL = "https://github.com/login/device";
+function isGithubDeviceUrl(v) {
+  if (!isSafeText(v)) return false;
+  let url;
+  try {
+    url = new URL(v);
+  } catch {
+    return false;
+  }
+  return url.protocol === "https:" && url.hostname === "github.com" && url.port === "" && url.username === "" && url.password === "" && url.pathname === "/login/device" && url.search === "" && url.hash === "";
+}
+async function requestDeviceCode() {
+  if (process.env.VERITY_PROVIDER_TOKEN) {
+    return {
+      ok: true,
+      data: {
+        device_code: "provider-token-override",
+        user_code: "OVER-RIDE",
+        verification_uri: GITHUB_DEVICE_VERIFICATION_URL,
+        expires_in: 900,
+        interval: 0
+      }
+    };
+  }
   let dc;
   try {
     const res = await fetch(GITHUB_DEVICE_CODE_URL, {
@@ -15700,15 +15725,40 @@ async function githubDeviceFlow() {
       error: "GitHub did not return a device code (is Device Flow enabled on the OAuth app?)"
     };
   }
-  printInfo("");
-  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
-  printInfo(`And enter the code:         ${dc.user_code}`);
+  if (!isSafeText(dc.device_code) || !isSafeText(dc.user_code) || !isGithubDeviceUrl(dc.verification_uri)) {
+    return { ok: false, error: "GitHub returned invalid device-flow data" };
+  }
+  const num = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : null;
+  if (dc.expires_in != null && num(dc.expires_in) === null) {
+    return { ok: false, error: "GitHub returned invalid device-flow data" };
+  }
+  if (dc.interval != null && num(dc.interval) === null) {
+    return { ok: false, error: "GitHub returned invalid device-flow data" };
+  }
+  return {
+    ok: true,
+    data: {
+      device_code: dc.device_code,
+      user_code: dc.user_code,
+      // The canonical form, not the string as received: what is shown and saved
+      // is exactly the page the check above accepted.
+      verification_uri: GITHUB_DEVICE_VERIFICATION_URL,
+      // || (not ??) so a falsy/zero value from the provider floors to a safe
+      // default — a 0 interval would otherwise spin a tight polling loop.
+      expires_in: dc.expires_in || 900,
+      interval: dc.interval || 5
+    }
+  };
+}
+async function pollDeviceToken(dc, opts) {
+  const override = process.env.VERITY_PROVIDER_TOKEN;
+  if (override) return { ok: true, data: override };
+  const waitUntil = Math.min(opts.waitUntil ?? opts.codeExpiresAt, opts.codeExpiresAt);
   const spinner = startSpinner(`Waiting for you to approve in the browser \xB7 code ${dc.user_code}`);
-  const deadline = Date.now() + (dc.expires_in || 900) * 1e3;
   let interval = dc.interval || 5;
   try {
-    while (Date.now() < deadline) {
-      await sleep(interval * 1e3);
+    while (Date.now() < waitUntil) {
+      await sleep(Math.min(interval * 1e3, Math.max(0, waitUntil - Date.now())));
       let data;
       try {
         const res = await fetch(GITHUB_ACCESS_TOKEN_URL, {
@@ -15736,18 +15786,36 @@ async function githubDeviceFlow() {
           interval += 5;
           break;
         case "access_denied":
-          return { ok: false, error: "Authorization was denied on GitHub." };
+          return { ok: false, error: "Authorization was denied on GitHub.", reason: "denied" };
         case "expired_token":
-          return { ok: false, error: "The authorization code expired. Re-run register." };
+          return { ok: false, error: 'The authorization code expired. Run "verity login" again.', reason: "expired" };
         default:
-          if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
+          if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}`, reason: "error" };
       }
     }
-    return { ok: false, error: "Timed out waiting for GitHub authorization." };
+    if (Date.now() >= opts.codeExpiresAt) {
+      return { ok: false, error: 'The authorization code expired. Run "verity login" again.', reason: "expired" };
+    }
+    return { ok: false, error: "Still waiting for approval on GitHub.", reason: "waiting" };
   } finally {
     spinner.stop();
   }
 }
+async function githubDeviceFlow() {
+  const override = process.env.VERITY_PROVIDER_TOKEN;
+  if (override) return { ok: true, data: override };
+  const code = await requestDeviceCode();
+  if (!code.ok) return code;
+  const dc = code.data;
+  printInfo("");
+  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
+  printInfo(`And enter the code:         ${dc.user_code}`);
+  const polled = await pollDeviceToken(dc, { codeExpiresAt: Date.now() + dc.expires_in * 1e3 });
+  if (!polled.ok) {
+    return { ok: false, error: polled.reason === "waiting" ? "Timed out waiting for GitHub authorization." : polled.error };
+  }
+  return { ok: true, data: polled.data };
+}
 
 // src/lib/register.ts
 var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -15842,11 +15910,14 @@ function deviceLabel() {
 }
 async function loginOnce(opts) {
   const usingTokenOverride = Boolean(process.env.VERITY_PROVIDER_TOKEN);
-  const providerAuth = await githubDeviceFlow();
-  if (!providerAuth.ok) {
-    return { ok: false, error: providerAuth.error };
+  let providerToken = opts.providerToken;
+  if (!providerToken) {
+    const providerAuth = await githubDeviceFlow();
+    if (!providerAuth.ok) {
+      return { ok: false, error: providerAuth.error };
+    }
+    providerToken = providerAuth.data;
   }
-  const providerToken = providerAuth.data;
   const parsed = opts.remote ? parseRemote(opts.remote) : null;
   if (!usingTokenOverride && parsed && parsed.provider === "github") {
     const installed2 = await ensureAppInstalled(parsed.owner, parsed.repo, providerToken);
@@ -15989,6 +16060,71 @@ function registerAuthCommands(program2) {
   });
 }
 
+// src/lib/pending-login.ts
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
+function pendingLoginPath() {
+  return `${process.env.HOME}/.verity/pending-login.json`;
+}
+function savePendingLogin(dc, serviceUrl, now = Date.now()) {
+  const record = {
+    version: 1,
+    device_code: dc.device_code,
+    user_code: dc.user_code,
+    verification_uri: dc.verification_uri,
+    interval: dc.interval,
+    expires_at: new Date(now + dc.expires_in * 1e3).toISOString(),
+    service_url: serviceUrl,
+    created_at: new Date(now).toISOString()
+  };
+  const path = pendingLoginPath();
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  clearPendingLogin();
+  (0, import_node_fs4.writeFileSync)(path, JSON.stringify(record, null, 2) + "\n", { mode: 384, flag: "wx" });
+  try {
+    (0, import_node_fs4.chmodSync)(path, 384);
+  } catch {
+  }
+  return record;
+}
+function readPendingLogin(now = Date.now()) {
+  const path = pendingLoginPath();
+  if (!(0, import_node_fs4.existsSync)(path)) return { status: "none" };
+  try {
+    if ((0, import_node_fs4.lstatSync)(path).isSymbolicLink()) return { status: "invalid", reason: "it is a symlink" };
+  } catch {
+    return { status: "none" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
+  } catch {
+    return { status: "invalid", reason: "it is not valid JSON" };
+  }
+  const r = parsed;
+  const str3 = isSafeText;
+  if (!r || typeof r !== "object" || r.version !== 1 || !str3(r.device_code) || !str3(r.user_code) || !str3(r.verification_uri) || !str3(r.service_url) || !str3(r.expires_at) || // ⚠ A NEGATIVE INTERVAL IS A TIGHT LOOP. pollDeviceToken floors only a falsy
+  // one, so -1 would poll GitHub back to back until it answered slow_down.
+  typeof r.interval !== "number" || !Number.isFinite(r.interval) || r.interval < 0) {
+    return { status: "invalid", reason: "it is missing fields" };
+  }
+  if (!isGithubDeviceUrl(r.verification_uri)) {
+    return { status: "invalid", reason: "its verification link is not GitHub's device page" };
+  }
+  const expires = Date.parse(r.expires_at);
+  if (!Number.isFinite(expires)) return { status: "invalid", reason: "its expiry is not a date" };
+  const record = r;
+  return expires <= now ? { status: "expired", record } : { status: "ok", record };
+}
+function clearPendingLogin() {
+  try {
+    (0, import_node_fs4.unlinkSync)(pendingLoginPath());
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/login-report.ts
 async function reportLoginOutcome(out2, opts = {}) {
   const identity = out2.email ?? (out2.userId != null ? `user #${out2.userId}` : "your account");
@@ -16055,8 +16191,24 @@ async function reportLoginOutcome(out2, opts = {}) {
 
 // src/commands/login.ts
 function registerLoginCommand(program2) {
-  program2.command("login").description("Log in to Verity (one GitHub login grants access to all your repositories)").option("--force", "Re-authenticate even if already logged in").action(async (opts) => {
+  program2.command("login").description("Log in to Verity (one GitHub login grants access to all your repositories)").option("--force", "Re-authenticate even if already logged in").option("--start", "Show the GitHub code and return at once (finish with --finish); prints JSON").option("--finish", "Wait for approval of the code --start showed, then log in; prints JSON").option("--wait <seconds>", "With --finish: how long to wait for approval before returning", "100").option("--cancel", "Discard a code --start showed that will not be approved").action(async (opts) => {
     const globals = program2.opts();
+    const modes = [opts.start, opts.finish, opts.cancel].filter(Boolean).length;
+    if (modes > 1) {
+      printError("Use one of --start, --finish or --cancel.");
+      process.exit(1);
+    }
+    if (opts.cancel) {
+      const removed = clearPendingLogin();
+      printInfo(removed ? "Discarded the pending sign-in." : "No sign-in was pending.");
+      printJson({ status: removed ? "cancelled" : "no_pending" });
+      return;
+    }
+    const split = !!(opts.start || opts.finish);
+    if (!split && !process.stdin.isTTY && (process.env.CLAUDECODE || process.env.CLAUDE_SESSION_ID)) {
+      printWarn("Inside a Claude Code session the code below may not be visible until this command ends.");
+      printWarn('  Use "verity login --start", then "verity login --finish" once it is approved.');
+    }
     const resolution = await resolveServiceUrlForAuth(globals.serviceUrl);
     if (resolution.source === "default") {
       printInfo(`No Verity service configured on this machine \u2014 using the default: ${resolution.url}`);
@@ -16069,6 +16221,10 @@ function registerLoginCommand(program2) {
       printInfo("  Completing login updates ~/.verity/credentials against the live service.");
     }
     const remote = currentRemote();
+    if (opts.finish) {
+      await finishSplitLogin({ serviceUrl, remote, verbose: globals.verbose, waitSeconds: opts.wait });
+      return;
+    }
     if (remote && !parseRemote(remote)) {
       printWarn(`This repository's origin remote is not a recognizable git URL: ${remote}`);
       printInfo("  Verity cannot identify the repository from it, so runs here will not be saved.");
@@ -16083,6 +16239,14 @@ function registerLoginCommand(program2) {
         if (!nudge && !upgrade) {
           printInfo(`Already logged in as ${who.data.email ?? `user #${who.data.user_id}`}. \u2713`);
           printInfo("  Re-authenticate with: verity login --force");
+          if (split) {
+            printJson({
+              status: "logged_in",
+              email: who.data.email ?? null,
+              repo_covered: who.data.grant_status != null,
+              already: true
+            });
+          }
           return;
         }
         if (nudge) {
@@ -16098,6 +16262,34 @@ function registerLoginCommand(program2) {
         printWarn("Could not confirm your current login state with the service \u2014 proceeding to log in.");
       }
     }
+    if (opts.start) {
+      const code = await requestDeviceCode();
+      if (!code.ok) {
+        printError(`Login failed: ${code.error}`);
+        printJson({ status: "failed", error: code.error });
+        process.exit(1);
+      }
+      let pending;
+      try {
+        pending = savePendingLogin(code.data, serviceUrl);
+      } catch (err2) {
+        const error = `could not save the pending sign-in: ${err2.message}`;
+        printError(`Login failed: ${error}`);
+        printJson({ status: "failed", error });
+        process.exit(1);
+      }
+      printInfo(`To authorize Verity, open:  ${pending.verification_uri}`);
+      printInfo(`And enter the code:         ${pending.user_code}`);
+      printInfo(`  Then run "verity login --finish". The code expires at ${pending.expires_at}.`);
+      printJson({
+        status: "pending",
+        verification_uri: pending.verification_uri,
+        user_code: pending.user_code,
+        expires_at: pending.expires_at,
+        service_url: pending.service_url
+      });
+      return;
+    }
     printInfo("Authenticating with GitHub\u2026");
     const result = await loginOnce({ serviceUrl, remote: remote || void 0, verbose: globals.verbose });
     if (!result.ok) {
@@ -16107,6 +16299,64 @@ function registerLoginCommand(program2) {
     await reportLoginOutcome(result.data, { remote: remote || void 0, verbose: globals.verbose });
   });
 }
+var MAX_WAIT_SECONDS = 600;
+async function finishSplitLogin(opts) {
+  function fail(status, error, clear) {
+    if (clear) clearPendingLogin();
+    printError(`Login failed: ${error}`);
+    printJson({ status, error });
+    process.exit(1);
+  }
+  const wait = Number(String(opts.waitSeconds ?? "100").trim());
+  if (!Number.isInteger(wait) || wait < 0 || wait > MAX_WAIT_SECONDS) {
+    fail("invalid", `--wait must be a whole number of seconds from 0 to ${MAX_WAIT_SECONDS}`, false);
+  }
+  const read2 = readPendingLogin();
+  if (read2.status === "none") fail("no_pending", 'no sign-in is pending \u2014 run "verity login --start" first', false);
+  if (read2.status === "invalid") fail("invalid", `the pending sign-in is unusable (${read2.reason}) \u2014 run "verity login --start" again`, true);
+  if (read2.status === "expired") fail("expired", 'the code expired before it was approved \u2014 run "verity login --start" again', true);
+  const pending = read2.record;
+  if (pending.service_url !== opts.serviceUrl) {
+    fail(
+      "service_changed",
+      `the sign-in was started for ${pending.service_url}, but this machine now resolves ${opts.serviceUrl} \u2014 run "verity login --start" again`,
+      true
+    );
+  }
+  const polled = await pollDeviceToken(pending, {
+    codeExpiresAt: Date.parse(pending.expires_at),
+    waitUntil: Date.now() + wait * 1e3
+  });
+  if (!polled.ok) {
+    if (polled.reason === "waiting") {
+      printInfo(`Not approved yet. Enter ${pending.user_code} at ${pending.verification_uri}, then run "verity login --finish" again.`);
+      printJson({
+        status: "pending",
+        verification_uri: pending.verification_uri,
+        user_code: pending.user_code,
+        expires_at: pending.expires_at
+      });
+      process.exit(2);
+    }
+    fail(polled.reason, polled.error, true);
+  }
+  clearPendingLogin();
+  const result = await loginOnce({
+    serviceUrl: opts.serviceUrl,
+    remote: opts.remote || void 0,
+    verbose: opts.verbose,
+    providerToken: polled.data
+  });
+  if (!result.ok) fail("failed", result.error, false);
+  const data = result.data;
+  await reportLoginOutcome(data, { remote: opts.remote || void 0, verbose: opts.verbose });
+  printJson({
+    status: "logged_in",
+    email: data.email ?? null,
+    repo_count: data.repoCount,
+    expires_at: data.expiresAt ?? null
+  });
+}
 
 // src/commands/token.ts
 function registerTokenCommand(program2) {
@@ -16424,11 +16674,11 @@ function registerLogoutCommand(program2) {
 
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path4 = require("node:path");
+var import_node_path5 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -16474,7 +16724,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
+  await (0, import_promises3.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
   await (0, import_promises3.writeFile)(file, next);
   return true;
 }
@@ -16659,13 +16909,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -16854,8 +17104,8 @@ async function applyMomentSelection(moments) {
 }
 
 // src/lib/project-config.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path7 = require("node:path");
 var DEFAULTS = { git_moments: [] };
 function isMoment(value) {
   return value === "commit" || value === "push";
@@ -16865,8 +17115,8 @@ function parseMoments(raw) {
 }
 function readConfigFile(path) {
   try {
-    if (!(0, import_node_fs4.existsSync)(path)) return null;
-    const raw = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
+    if (!(0, import_node_fs5.existsSync)(path)) return null;
+    const raw = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf-8"));
     const moments = Array.isArray(raw.git_moments) ? raw.git_moments.filter(isMoment) : [];
     const source2 = raw.git_moments_source === "user" || raw.git_moments_source === "init" ? raw.git_moments_source : void 0;
     return {
@@ -16883,7 +17133,7 @@ function candidates() {
   const out2 = [{ path: local, source: "local" }];
   const main = mainWorktreeRoot();
   if (main) {
-    const inherited = (0, import_node_path6.join)(main, PROJECT_CONFIG_FILE);
+    const inherited = (0, import_node_path7.join)(main, PROJECT_CONFIG_FILE);
     if (inherited !== local) out2.push({ path: inherited, source: "main-worktree" });
   }
   return out2;
@@ -16904,8 +17154,8 @@ function writeProjectConfig(patch) {
     ...patch
   };
   const target = projectPath(PROJECT_CONFIG_FILE);
-  (0, import_node_fs4.mkdirSync)((0, import_node_path6.dirname)(target), { recursive: true });
-  (0, import_node_fs4.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
+  (0, import_node_fs5.mkdirSync)((0, import_node_path7.dirname)(target), { recursive: true });
+  (0, import_node_fs5.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
   return next;
 }
 function resolveGuardMoments(explicit) {
@@ -16914,11 +17164,11 @@ function resolveGuardMoments(explicit) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 
 // src/lib/which.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path8 = require("node:path");
 function executableExtensions(platform4, pathext) {
   if (platform4 !== "win32") return [""];
   const raw = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
@@ -16936,14 +17186,14 @@ function whichSync(bin, opts = {}) {
   if (!rawPath) return null;
   const exts = executableExtensions(platform4, opts.pathext ?? process.env.PATHEXT);
   const real = opts.real ?? true;
-  for (const dir of rawPath.split(import_node_path7.delimiter)) {
+  for (const dir of rawPath.split(import_node_path8.delimiter)) {
     if (!dir) continue;
     for (const ext of exts) {
-      const candidate = (0, import_node_path7.join)(dir, bin + ext);
+      const candidate = (0, import_node_path8.join)(dir, bin + ext);
       try {
-        if (!(0, import_node_fs5.statSync)(candidate).isFile()) continue;
-        if (platform4 !== "win32") (0, import_node_fs5.accessSync)(candidate, import_node_fs5.constants.X_OK);
-        return real ? (0, import_node_fs5.realpathSync)(candidate) : candidate;
+        if (!(0, import_node_fs6.statSync)(candidate).isFile()) continue;
+        if (platform4 !== "win32") (0, import_node_fs6.accessSync)(candidate, import_node_fs6.constants.X_OK);
+        return real ? (0, import_node_fs6.realpathSync)(candidate) : candidate;
       } catch {
         continue;
       }
@@ -16954,10 +17204,10 @@ function whichSync(bin, opts = {}) {
 
 // src/lib/plugin-ownership.ts
 var import_node_os2 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 
 // src/lib/stderr-log.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -16970,9 +17220,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs6.appendFileSync)(file, text);
+    (0, import_node_fs7.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -17011,7 +17261,7 @@ function logToFileOnly(text) {
 }
 
 // src/lib/plugin-ownership.ts
-var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+var CONTROL_CHARS2 = /[\u0000-\u001f\u007f]/;
 function isPluginInvocation() {
   return !!process.env.VERITY_PLUGIN_ROOT;
 }
@@ -17020,11 +17270,11 @@ function markerPath() {
 }
 function readMarker() {
   try {
-    if (!(0, import_node_fs7.existsSync)(markerPath())) return null;
-    const raw = JSON.parse((0, import_node_fs7.readFileSync)(markerPath(), "utf-8"));
+    if (!(0, import_node_fs8.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs8.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
-    if (!pluginRoot || CONTROL_CHARS.test(pluginRoot)) return null;
-    const version = typeof raw.version === "string" && !CONTROL_CHARS.test(raw.version) ? raw.version : null;
+    if (!pluginRoot || CONTROL_CHARS2.test(pluginRoot)) return null;
+    const version = typeof raw.version === "string" && !CONTROL_CHARS2.test(raw.version) ? raw.version : null;
     return {
       session_id: typeof raw.session_id === "string" ? raw.session_id : null,
       plugin_root: pluginRoot,
@@ -17039,23 +17289,23 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs7.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs8.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs7.writeFileSync)(markerPath(), JSON.stringify(marker));
+    (0, import_node_fs8.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
 function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path9.join)((0, import_node_os2.homedir)(), ".claude");
 }
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -17063,9 +17313,9 @@ function readJsonFile(path) {
 }
 function enabledPluginSetting(key) {
   const files = [
-    projectPath((0, import_node_path8.join)(".claude", "settings.local.json")),
-    projectPath((0, import_node_path8.join)(".claude", "settings.json")),
-    (0, import_node_path8.join)(claudeConfigDir(), "settings.json")
+    projectPath((0, import_node_path9.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path9.join)(".claude", "settings.json")),
+    (0, import_node_path9.join)(claudeConfigDir(), "settings.json")
   ];
   for (const file of files) {
     const map = readJsonFile(file)?.enabledPlugins;
@@ -17077,11 +17327,11 @@ function enabledPluginSetting(key) {
 }
 function marketplaceLocations() {
   const out2 = /* @__PURE__ */ new Map();
-  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path9.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   if (!known) return out2;
   for (const [name2, entry] of Object.entries(known)) {
     const loc2 = entry?.installLocation;
-    if (typeof loc2 === "string" && loc2) out2.set(name2, (0, import_node_path8.resolve)(loc2));
+    if (typeof loc2 === "string" && loc2) out2.set(name2, (0, import_node_path9.resolve)(loc2));
   }
   return out2;
 }
@@ -17095,7 +17345,7 @@ function globalVerityVersion() {
   const entry = verityPathEntry();
   if (!entry) return null;
   try {
-    const pkg = readJsonFile((0, import_node_path8.join)((0, import_node_path8.dirname)((0, import_node_fs7.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJsonFile((0, import_node_path9.join)((0, import_node_path9.dirname)((0, import_node_fs8.realpathSync)(entry)), "..", "package.json"));
     if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
     return pkg.version;
   } catch {
@@ -17112,7 +17362,7 @@ var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
   const wanted = VERITY_MARKETPLACE;
   for (const file of ["settings.json", "settings.local.json"]) {
-    const path = (0, import_node_path8.join)(claudeConfigDir(), file);
+    const path = (0, import_node_path9.join)(claudeConfigDir(), file);
     const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
     const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
     if (entry2 && typeof entry2 === "object") {
@@ -17122,7 +17372,7 @@ function marketplaceConflict() {
       }
     }
   }
-  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path9.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   const entry = known?.[wanted];
   if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
     return { name: wanted, declaredAs: describeSource(entry.source) };
@@ -17143,7 +17393,7 @@ function describeSource(src) {
   return target ? `${kind} \u2192 ${target}` : kind;
 }
 function legacyMarketplaceInstall() {
-  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path9.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   for (const key of Object.keys(plugins)) {
     const at = key.lastIndexOf("@");
@@ -17155,13 +17405,13 @@ function legacyMarketplaceInstall() {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs7.realpathSync.native(p);
+    return import_node_fs8.realpathSync.native(p);
   } catch {
-    return (0, import_node_path8.resolve)(p);
+    return (0, import_node_path9.resolve)(p);
   }
 }
 function isWithin(want, dir) {
-  return want === dir || want.startsWith(dir + import_node_path8.sep);
+  return want === dir || want.startsWith(dir + import_node_path9.sep);
 }
 function entryAppliesHere(entry, here) {
   const e = entry;
@@ -17171,9 +17421,9 @@ function entryAppliesHere(entry, here) {
   return forProject === here;
 }
 function registrySays(pluginRoot) {
-  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path9.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
-  const want = (0, import_node_path8.resolve)(pluginRoot);
+  const want = (0, import_node_path9.resolve)(pluginRoot);
   const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
@@ -17182,15 +17432,15 @@ function registrySays(pluginRoot) {
     const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
     const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
-      return typeof installPath === "string" && (0, import_node_path8.resolve)(installPath) === want;
+      return typeof installPath === "string" && (0, import_node_path9.resolve)(installPath) === want;
     }) || source2 !== void 0 && applicable.length > 0 && isWithin(want, source2);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
-      return (0, import_node_fs7.existsSync)(pluginRoot) ? "live" : "gone";
+      return (0, import_node_fs8.existsSync)(pluginRoot) ? "live" : "gone";
     }
   }
-  const managed = (0, import_node_path8.resolve)((0, import_node_path8.join)(claudeConfigDir(), "plugins", "cache"));
-  return want === managed || want.startsWith(managed + import_node_path8.sep) ? "gone" : "unverified";
+  const managed = (0, import_node_path9.resolve)((0, import_node_path9.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path9.sep) ? "gone" : "unverified";
 }
 var _live = /* @__PURE__ */ new Map();
 function pluginLiveness(pluginRoot) {
@@ -17204,7 +17454,7 @@ function clearStalePluginMarker() {
   const marker = readMarker();
   if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
   try {
-    (0, import_node_fs7.rmSync)(markerPath(), { force: true });
+    (0, import_node_fs8.rmSync)(markerPath(), { force: true });
   } catch {
     return null;
   }
@@ -17232,7 +17482,7 @@ function pluginActiveHere() {
   return activePluginInstall() !== null;
 }
 function registeredVerityPlugin() {
-  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path9.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   const here = realpathOr(repoRoot());
   for (const [key, value] of Object.entries(plugins)) {
@@ -17242,7 +17492,7 @@ function registeredVerityPlugin() {
     for (const entry of Array.isArray(value) ? value : []) {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
-      if (!installPath || !(0, import_node_fs7.existsSync)(installPath)) continue;
+      if (!installPath || !(0, import_node_fs8.existsSync)(installPath)) continue;
       if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
@@ -17294,28 +17544,28 @@ async function resolveHookWiring() {
 }
 
 // src/lib/cli-provenance.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_os3 = require("node:os");
-var import_node_path9 = require("node:path");
+var import_node_path10 = require("node:path");
 var CLI_PACKAGE = "@codacy/verity-cli";
-var CLI_ENTRY = (0, import_node_path9.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
+var CLI_ENTRY = (0, import_node_path10.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
 function readJson(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs9.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
 }
 function versionUnder(base) {
-  const entry = (0, import_node_path9.join)(base, CLI_ENTRY);
-  if (!(0, import_node_fs8.existsSync)(entry)) return null;
-  const pkg = readJson((0, import_node_path9.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
+  const entry = (0, import_node_path10.join)(base, CLI_ENTRY);
+  if (!(0, import_node_fs9.existsSync)(entry)) return null;
+  const pkg = readJson((0, import_node_path10.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
   return typeof pkg?.version === "string" ? pkg.version : null;
 }
 function versionForEntry(entry) {
   try {
-    const pkg = readJson((0, import_node_path9.join)((0, import_node_path9.dirname)((0, import_node_fs8.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJson((0, import_node_path10.join)((0, import_node_path10.dirname)((0, import_node_fs9.realpathSync)(entry)), "..", "package.json"));
     return typeof pkg?.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -17323,16 +17573,16 @@ function versionForEntry(entry) {
 }
 function resolveHooksCli(pluginRoot) {
   const override = process.env.VERITY_CLI_PATH;
-  if (override && (0, import_node_fs8.existsSync)(override)) {
+  if (override && (0, import_node_fs9.existsSync)(override)) {
     return { version: versionForEntry(override), rung: "override" };
   }
   const fromPlugin = versionUnder(pluginRoot);
   if (fromPlugin !== null) return { version: fromPlugin, rung: "plugin" };
-  if ((0, import_node_fs8.existsSync)((0, import_node_path9.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
-  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".verity", "plugin-cli");
+  if ((0, import_node_fs9.existsSync)((0, import_node_path10.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
+  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".verity", "plugin-cli");
   const fromData = versionUnder(dataDir);
   if (fromData !== null) return { version: fromData, rung: "plugin-data" };
-  if ((0, import_node_fs8.existsSync)((0, import_node_path9.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
+  if ((0, import_node_fs9.existsSync)((0, import_node_path10.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
   const global = globalVerityVersion();
   if (global !== null) return { version: global, rung: "global" };
   return null;
@@ -17434,7 +17684,7 @@ function pluginCliInvocation() {
   return resolverCommand(root);
 }
 function resolverCommand(root) {
-  return `node ${JSON.stringify((0, import_node_path9.join)(root, "scripts", "verity.mjs"))}`;
+  return `node ${JSON.stringify((0, import_node_path10.join)(root, "scripts", "verity.mjs"))}`;
 }
 
 // src/commands/hooks.ts
@@ -17574,7 +17824,7 @@ var import_node_crypto9 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
@@ -17610,7 +17860,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs9.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs10.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -17634,7 +17884,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs9.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs10.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -17927,9 +18177,9 @@ function isCommandOnlyTurn(input) {
 
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs10 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 var import_node_os4 = require("node:os");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
   "-",
@@ -17967,7 +18217,7 @@ function contextIdentity(input) {
   if (rawTree && !isSharedSentinel(rawTree)) {
     let resolved = rawTree;
     try {
-      resolved = import_node_fs10.realpathSync.native(rawTree);
+      resolved = import_node_fs11.realpathSync.native(rawTree);
     } catch {
     }
     treeKey = (0, import_node_crypto2.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
@@ -17983,13 +18233,13 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path10.resolve)(override) : (0, import_node_path10.join)((0, import_node_os4.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path11.resolve)(override) : (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".verity");
 }
 function dossierDir(identity) {
-  return (0, import_node_path10.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+  return (0, import_node_path11.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
 }
 function treeDir(identity) {
-  return (0, import_node_path10.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+  return (0, import_node_path11.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
 }
 function scopeIdentity(token, sessionId) {
   const t = (token ?? "").trim();
@@ -18004,8 +18254,8 @@ function sessionScopeKey(token, sessionId) {
 
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs11 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs12 = require("node:fs");
+var import_node_path12 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -18044,7 +18294,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs11.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs12.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -18078,12 +18328,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs11.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs12.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path11.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path12.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -18097,13 +18347,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path11.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path12.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs11.existsSync)(filePath)) {
+    if ((0, import_node_fs12.existsSync)(filePath)) {
       const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises6.readFile)(filePath, "utf-8");
@@ -18114,7 +18364,7 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line2 = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs11.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs12.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
     await (0, import_promises6.writeFile)(filePath, existing + line2);
   } catch {
   }
@@ -18122,20 +18372,20 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs14 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path15 = require("node:path");
 
 // src/lib/org-mirror.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 var ORG_KINDS = ["decision", "security", "gotcha", "pattern", "domain", "integration"];
 var STATE_FILE = ".org-pull-state.json";
 var BODY_MAX = 8192;
 function orgMirrorDir(remote = requestRemote()) {
   const parsed = parseRemote(remote);
   if (!parsed) return null;
-  return (0, import_node_path12.join)(verityHome(), "orgs", parsed.host, parsed.owner.toLowerCase(), "memory");
+  return (0, import_node_path13.join)(verityHome(), "orgs", parsed.host, parsed.owner.toLowerCase(), "memory");
 }
 function slugify(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
@@ -18201,7 +18451,7 @@ function parseOrgNode(content) {
 }
 async function readState(dir) {
   try {
-    const parsed = JSON.parse(await (0, import_promises7.readFile)((0, import_node_path12.join)(dir, STATE_FILE), "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises7.readFile)((0, import_node_path13.join)(dir, STATE_FILE), "utf-8"));
     return {
       version: typeof parsed?.version === "string" ? parsed.version : null,
       organization: parsed?.organization && typeof parsed.organization.id === "string" ? parsed.organization : null,
@@ -18213,7 +18463,7 @@ async function readState(dir) {
 }
 async function writeState(dir, state) {
   await (0, import_promises7.mkdir)(dir, { recursive: true });
-  await (0, import_promises7.writeFile)((0, import_node_path12.join)(dir, STATE_FILE), JSON.stringify({
+  await (0, import_promises7.writeFile)((0, import_node_path13.join)(dir, STATE_FILE), JSON.stringify({
     ...state.version ? { version: state.version } : {},
     organization: state.organization,
     pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -18278,24 +18528,24 @@ async function pullOrgKnowledge(opts) {
   for (const n of nodes) {
     const rel = orgNodePath(n);
     if (written.has(rel)) continue;
-    await (0, import_promises7.mkdir)((0, import_node_path12.join)(dir, rel.split("/")[0]), { recursive: true });
-    await (0, import_promises7.writeFile)((0, import_node_path12.join)(dir, rel), renderOrgNode(n, org?.name ?? ""));
+    await (0, import_promises7.mkdir)((0, import_node_path13.join)(dir, rel.split("/")[0]), { recursive: true });
+    await (0, import_promises7.writeFile)((0, import_node_path13.join)(dir, rel), renderOrgNode(n, org?.name ?? ""));
     written.add(rel);
   }
   for (const rel of state.files) {
-    if (!written.has(rel)) await (0, import_promises7.rm)((0, import_node_path12.join)(dir, rel), { force: true });
+    if (!written.has(rel)) await (0, import_promises7.rm)((0, import_node_path13.join)(dir, rel), { force: true });
   }
-  await (0, import_promises7.writeFile)((0, import_node_path12.join)(dir, "index.md"), renderIndex(org?.name ?? "no organization", nodes));
+  await (0, import_promises7.writeFile)((0, import_node_path13.join)(dir, "index.md"), renderIndex(org?.name ?? "no organization", nodes));
   await writeState(dir, { version: org ? page.version : null, organization: org, files: [...written].sort() });
   return { ok: true, status: org ? "pulled" : "none", received: nodes.length, dir };
 }
 async function readOrgMirror(remote = requestRemote()) {
   const dir = orgMirrorDir(remote);
-  if (!dir || !(0, import_node_fs12.existsSync)(dir)) return [];
+  if (!dir || !(0, import_node_fs13.existsSync)(dir)) return [];
   const out2 = [];
   for (const kind of ORG_KINDS) {
-    const kindDir = (0, import_node_path12.join)(dir, kind);
-    if (!(0, import_node_fs12.existsSync)(kindDir)) continue;
+    const kindDir = (0, import_node_path13.join)(dir, kind);
+    if (!(0, import_node_fs13.existsSync)(kindDir)) continue;
     let files;
     try {
       files = await (0, import_promises7.readdir)(kindDir);
@@ -18305,7 +18555,7 @@ async function readOrgMirror(remote = requestRemote()) {
     for (const file of files) {
       if (!file.endsWith(".md")) continue;
       try {
-        const node = parseOrgNode(await (0, import_promises7.readFile)((0, import_node_path12.join)(kindDir, file), "utf-8"));
+        const node = parseOrgNode(await (0, import_promises7.readFile)((0, import_node_path13.join)(kindDir, file), "utf-8"));
         if (node) out2.push(node);
       } catch {
       }
@@ -18315,29 +18565,29 @@ async function readOrgMirror(remote = requestRemote()) {
 }
 
 // src/lib/safe-read.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path13 = require("node:path");
-var FLAGS = import_node_fs13.constants;
+var import_node_fs14 = require("node:fs");
+var import_node_path14 = require("node:path");
+var FLAGS = import_node_fs14.constants;
 var NOFOLLOW = FLAGS.O_NOFOLLOW;
 var NONBLOCK = FLAGS.O_NONBLOCK;
 function closeOpened(fd) {
   try {
-    (0, import_node_fs13.closeSync)(fd);
+    (0, import_node_fs14.closeSync)(fd);
   } catch {
   }
 }
 function isInsideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path13.sep) ? realRoot : realRoot + import_node_path13.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path14.sep) ? realRoot : realRoot + import_node_path14.sep);
 }
 function sameOpenedFile(opened, current, nofollowAvailable) {
   if (!nofollowAvailable && (opened.ino === 0n || current.ino === 0n)) return false;
   return opened.ino === current.ino && opened.dev === current.dev;
 }
 function openRegularInRoot(root, path) {
-  const full = (0, import_node_path13.isAbsolute)(path) ? path : (0, import_node_path13.join)(root, path);
+  const full = (0, import_node_path14.isAbsolute)(path) ? path : (0, import_node_path14.join)(root, path);
   let fd;
   try {
-    fd = (0, import_node_fs13.openSync)(full, import_node_fs13.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
+    fd = (0, import_node_fs14.openSync)(full, import_node_fs14.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
   } catch (err2) {
     const code = err2.code;
     if (code === "ELOOP" || code === "EMLINK" || code === "EFTYPE") return { ok: false, reason: "symlink" };
@@ -18345,18 +18595,18 @@ function openRegularInRoot(root, path) {
     return { ok: false, reason: "unreadable" };
   }
   try {
-    const opened = (0, import_node_fs13.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs14.fstatSync)(fd, { bigint: true });
     if (!opened.isFile()) {
       closeOpened(fd);
       return { ok: false, reason: "not-regular" };
     }
-    const realRoot = import_node_fs13.realpathSync.native(root);
-    const realPath = import_node_fs13.realpathSync.native(full);
+    const realRoot = import_node_fs14.realpathSync.native(root);
+    const realPath = import_node_fs14.realpathSync.native(full);
     if (!isInsideRoot(realRoot, realPath)) {
       closeOpened(fd);
       return { ok: false, reason: "outside-root" };
     }
-    const current = (0, import_node_fs13.statSync)(realPath, { bigint: true });
+    const current = (0, import_node_fs14.statSync)(realPath, { bigint: true });
     if (!sameOpenedFile(opened, current, NOFOLLOW !== void 0)) {
       closeOpened(fd);
       return { ok: false, reason: NOFOLLOW === void 0 ? "unreadable" : "outside-root" };
@@ -18378,7 +18628,7 @@ function readOpened(fd, size) {
     const buffer = Buffer.alloc(size);
     let offset = 0;
     while (offset < size) {
-      const n = (0, import_node_fs13.readSync)(fd, buffer, offset, size - offset, offset);
+      const n = (0, import_node_fs14.readSync)(fd, buffer, offset, size - offset, offset);
       if (n === 0) break;
       offset += n;
     }
@@ -18693,14 +18943,14 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  const hasRepoGraph = (0, import_node_fs14.existsSync)(memoryDir());
+  const hasRepoGraph = (0, import_node_fs15.existsSync)(memoryDir());
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const orgPromptTerms = orgTerms(promptText);
   const nodes = [];
   for (const domain of hasRepoGraph ? DOMAINS : []) {
-    const domainDir = (0, import_node_path14.join)(memoryDir(), domain);
-    if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path15.join)(memoryDir(), domain);
+    if (!(0, import_node_fs15.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
@@ -18774,27 +19024,27 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 }
 
 // src/lib/injection-record.ts
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_node_crypto3 = require("node:crypto");
 
 // src/lib/safe-write.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path15 = require("node:path");
-var FLAGS2 = import_node_fs15.constants;
+var import_node_fs16 = require("node:fs");
+var import_node_path16 = require("node:path");
+var FLAGS2 = import_node_fs16.constants;
 var O_NOFOLLOW = FLAGS2.O_NOFOLLOW ?? 0;
 var NOFOLLOW_AVAILABLE = O_NOFOLLOW !== 0;
 function validateRoot(root) {
   try {
-    const parentReal = (0, import_node_fs15.realpathSync)((0, import_node_path15.dirname)(root));
-    const expected = (0, import_node_path15.join)(parentReal, (0, import_node_path15.basename)(root));
+    const parentReal = (0, import_node_fs16.realpathSync)((0, import_node_path16.dirname)(root));
+    const expected = (0, import_node_path16.join)(parentReal, (0, import_node_path16.basename)(root));
     try {
-      (0, import_node_fs15.mkdirSync)(expected);
+      (0, import_node_fs16.mkdirSync)(expected);
     } catch (e) {
       if (e.code !== "EEXIST") return null;
     }
-    const st = (0, import_node_fs15.lstatSync)(expected, { bigint: true });
+    const st = (0, import_node_fs16.lstatSync)(expected, { bigint: true });
     if (st.isSymbolicLink() || !st.isDirectory()) return null;
-    if ((0, import_node_fs15.realpathSync)(expected) !== expected) return null;
+    if ((0, import_node_fs16.realpathSync)(expected) !== expected) return null;
     return { real: expected, dev: st.dev, ino: st.ino };
   } catch {
     return null;
@@ -18802,18 +19052,18 @@ function validateRoot(root) {
 }
 function rootUnchanged(root) {
   try {
-    const st = (0, import_node_fs15.lstatSync)(root.real, { bigint: true });
+    const st = (0, import_node_fs16.lstatSync)(root.real, { bigint: true });
     return !st.isSymbolicLink() && st.isDirectory() && st.dev === root.dev && st.ino === root.ino;
   } catch {
     return false;
   }
 }
 function bareName(name2) {
-  return !!name2 && name2 === (0, import_node_path15.basename)(name2) && name2 !== "." && name2 !== ".." && !name2.includes("\0");
+  return !!name2 && name2 === (0, import_node_path16.basename)(name2) && name2 !== "." && name2 !== ".." && !name2.includes("\0");
 }
 function absentOrRegular(path) {
   try {
-    const st = (0, import_node_fs15.lstatSync)(path);
+    const st = (0, import_node_fs16.lstatSync)(path);
     return st.isFile() && !st.isSymbolicLink();
   } catch (e) {
     return e.code === "ENOENT";
@@ -18821,11 +19071,11 @@ function absentOrRegular(path) {
 }
 function verifyOpened(fd, path, root) {
   try {
-    const opened = (0, import_node_fs15.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs16.fstatSync)(fd, { bigint: true });
     if (!opened.isFile() || opened.nlink !== 1n) return false;
-    const real = (0, import_node_fs15.realpathSync)(path);
+    const real = (0, import_node_fs16.realpathSync)(path);
     if (!isInsideRoot(root.real, real)) return false;
-    const current = (0, import_node_fs15.statSync)(real, { bigint: true });
+    const current = (0, import_node_fs16.statSync)(real, { bigint: true });
     if (!sameOpenedFile(opened, current, NOFOLLOW_AVAILABLE)) return false;
     return rootUnchanged(root);
   } catch {
@@ -18834,21 +19084,21 @@ function verifyOpened(fd, path, root) {
 }
 function removeIfOurs(fd, path) {
   try {
-    const opened = (0, import_node_fs15.fstatSync)(fd, { bigint: true });
-    const at = (0, import_node_fs15.lstatSync)(path, { bigint: true });
-    if (!at.isSymbolicLink() && at.dev === opened.dev && at.ino === opened.ino) (0, import_node_fs15.unlinkSync)(path);
+    const opened = (0, import_node_fs16.fstatSync)(fd, { bigint: true });
+    const at = (0, import_node_fs16.lstatSync)(path, { bigint: true });
+    if (!at.isSymbolicLink() && at.dev === opened.dev && at.ino === opened.ino) (0, import_node_fs16.unlinkSync)(path);
   } catch {
   }
 }
 function openTarget(path, append2) {
-  const base = import_node_fs15.constants.O_WRONLY | (append2 ? import_node_fs15.constants.O_APPEND : 0) | O_NOFOLLOW;
+  const base = import_node_fs16.constants.O_WRONLY | (append2 ? import_node_fs16.constants.O_APPEND : 0) | O_NOFOLLOW;
   try {
-    return { fd: (0, import_node_fs15.openSync)(path, base), created: false };
+    return { fd: (0, import_node_fs16.openSync)(path, base), created: false };
   } catch (e) {
     if (e.code !== "ENOENT") return null;
   }
   try {
-    return { fd: (0, import_node_fs15.openSync)(path, base | import_node_fs15.constants.O_CREAT | import_node_fs15.constants.O_EXCL, 384), created: true };
+    return { fd: (0, import_node_fs16.openSync)(path, base | import_node_fs16.constants.O_CREAT | import_node_fs16.constants.O_EXCL, 384), created: true };
   } catch {
     return null;
   }
@@ -18856,7 +19106,7 @@ function openTarget(path, append2) {
 function writeVerified(root, name2, hooks, append2, write) {
   const r = validateRoot(root);
   if (!r || !bareName(name2)) return false;
-  const path = (0, import_node_path15.join)(r.real, name2);
+  const path = (0, import_node_path16.join)(r.real, name2);
   if (!absentOrRegular(path)) return false;
   if (!runHook(hooks)) return false;
   const opened = openTarget(path, append2);
@@ -18872,7 +19122,7 @@ function writeVerified(root, name2, hooks, append2, write) {
     return false;
   } finally {
     try {
-      (0, import_node_fs15.closeSync)(opened.fd);
+      (0, import_node_fs16.closeSync)(opened.fd);
     } catch {
     }
   }
@@ -18887,13 +19137,13 @@ function runHook(hooks) {
 }
 function appendInRoot(root, name2, text, hooks = {}) {
   return writeVerified(root, name2, hooks, true, (fd) => {
-    (0, import_node_fs15.writeSync)(fd, text);
+    (0, import_node_fs16.writeSync)(fd, text);
   });
 }
 function replaceInRoot(root, name2, text, hooks = {}) {
   return writeVerified(root, name2, hooks, false, (fd) => {
-    (0, import_node_fs15.ftruncateSync)(fd, 0);
-    (0, import_node_fs15.writeSync)(fd, text, 0);
+    (0, import_node_fs16.ftruncateSync)(fd, 0);
+    (0, import_node_fs16.writeSync)(fd, text, 0);
   });
 }
 
@@ -18941,7 +19191,7 @@ function hashPrompt(prompt) {
 function recordInjection(event) {
   if (!appendInRoot(projectPath(VERITY_DIR), "injections.jsonl", JSON.stringify(event) + "\n")) return;
   try {
-    if ((0, import_node_fs16.lstatSync)(recordPath()).size > COMPACT_AT_BYTES) writeEvents(readPendingInjections());
+    if ((0, import_node_fs17.lstatSync)(recordPath()).size > COMPACT_AT_BYTES) writeEvents(readPendingInjections());
   } catch {
   }
 }
@@ -18951,7 +19201,7 @@ function writeEvents(events) {
 function readPendingInjections() {
   try {
     const p = recordPath();
-    if (!(0, import_node_fs16.existsSync)(p)) return [];
+    if (!(0, import_node_fs17.existsSync)(p)) return [];
     const read2 = readRegularFileInRoot(projectPath(VERITY_DIR), "injections.jsonl", MAX_RECORD_BYTES);
     if (!read2.ok) return [];
     const out2 = [];
@@ -18971,13 +19221,13 @@ function readPendingInjections() {
 
 // src/lib/memory-sync.ts
 var import_promises9 = require("node:fs/promises");
-var import_node_fs19 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path18 = require("node:path");
 var import_node_crypto4 = require("node:crypto");
 
 // src/lib/gitignore.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
 var VERITY_GITIGNORE_BLOCK = [
@@ -19061,7 +19311,7 @@ function fenceMemoryLines(lines) {
 function ensureVerityGitignore() {
   let content = "";
   try {
-    content = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs18.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -19088,7 +19338,7 @@ function ensureVerityGitignore() {
       const sep5 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
       text = text + sep5 + VERITY_GITIGNORE_BLOCK;
     }
-    if (text !== content) (0, import_node_fs17.writeFileSync)(".gitignore", text);
+    if (text !== content) (0, import_node_fs18.writeFileSync)(".gitignore", text);
     return verified(
       memoryIsCommitted ? "memory-tracked" : hasSupersededMemory ? "memory-fenced" : needsRepair ? "repaired" : "added"
     );
@@ -19108,7 +19358,7 @@ function untrackMemory() {
 function writeFencedBlock() {
   let content = "";
   try {
-    content = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs18.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -19120,7 +19370,7 @@ function writeFencedBlock() {
     text = text + sep5 + VERITY_GITIGNORE_BLOCK;
   }
   try {
-    (0, import_node_fs17.writeFileSync)(".gitignore", text);
+    (0, import_node_fs18.writeFileSync)(".gitignore", text);
     return true;
   } catch {
     return false;
@@ -19129,14 +19379,14 @@ function writeFencedBlock() {
 function fenceMemory() {
   let original = null;
   try {
-    original = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
+    original = (0, import_node_fs18.readFileSync)(".gitignore", "utf-8");
   } catch {
     original = null;
   }
   const restore = () => {
     try {
-      if (original === null) (0, import_node_fs17.rmSync)(".gitignore", { force: true });
-      else (0, import_node_fs17.writeFileSync)(".gitignore", original);
+      if (original === null) (0, import_node_fs18.rmSync)(".gitignore", { force: true });
+      else (0, import_node_fs18.writeFileSync)(".gitignore", original);
     } catch {
     }
   };
@@ -19154,7 +19404,7 @@ function fenceMemory() {
 }
 function memoryOptOut() {
   try {
-    return (0, import_node_fs17.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
+    return (0, import_node_fs18.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
   } catch {
     return false;
   }
@@ -19162,13 +19412,13 @@ function memoryOptOut() {
 function keepMemoryTracked() {
   let content = "";
   try {
-    content = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs18.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   if (content.includes(MEMORY_OPT_OUT_MARKER)) return "already";
   try {
     const sep5 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
-    (0, import_node_fs17.writeFileSync)(".gitignore", content + sep5 + MEMORY_OPT_OUT_STANZA);
+    (0, import_node_fs18.writeFileSync)(".gitignore", content + sep5 + MEMORY_OPT_OUT_STANZA);
   } catch {
     return "failed";
   }
@@ -19203,26 +19453,26 @@ function untrackVerityState() {
 }
 
 // src/lib/safe-path.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
 function resolveInside(baseDir, candidate) {
   if (typeof candidate !== "string" || candidate.length === 0) return null;
-  if ((0, import_node_path16.isAbsolute)(candidate)) return null;
-  const baseAbs = (0, import_node_path16.resolve)(baseDir);
-  const full = (0, import_node_path16.resolve)(baseAbs, candidate);
-  const baseSep = baseAbs.endsWith(import_node_path16.sep) ? baseAbs : baseAbs + import_node_path16.sep;
+  if ((0, import_node_path17.isAbsolute)(candidate)) return null;
+  const baseAbs = (0, import_node_path17.resolve)(baseDir);
+  const full = (0, import_node_path17.resolve)(baseAbs, candidate);
+  const baseSep = baseAbs.endsWith(import_node_path17.sep) ? baseAbs : baseAbs + import_node_path17.sep;
   if (full !== baseAbs && !full.startsWith(baseSep)) return null;
   try {
-    if ((0, import_node_fs18.existsSync)(baseAbs)) {
-      const realBase = (0, import_node_fs18.realpathSync)(baseAbs);
-      const realBaseSep = realBase.endsWith(import_node_path16.sep) ? realBase : realBase + import_node_path16.sep;
+    if ((0, import_node_fs19.existsSync)(baseAbs)) {
+      const realBase = (0, import_node_fs19.realpathSync)(baseAbs);
+      const realBaseSep = realBase.endsWith(import_node_path17.sep) ? realBase : realBase + import_node_path17.sep;
       let probe = full;
-      while (!(0, import_node_fs18.existsSync)(probe)) {
-        const parent = (0, import_node_path16.dirname)(probe);
+      while (!(0, import_node_fs19.existsSync)(probe)) {
+        const parent = (0, import_node_path17.dirname)(probe);
         if (parent === probe) break;
         probe = parent;
       }
-      const realProbe = (0, import_node_fs18.realpathSync)(probe);
+      const realProbe = (0, import_node_fs19.realpathSync)(probe);
       if (realProbe !== realBase && !realProbe.startsWith(realBaseSep)) return null;
     }
   } catch {
@@ -19230,37 +19480,37 @@ function resolveInside(baseDir, candidate) {
   }
   return full;
 }
-var O_NOFOLLOW2 = typeof import_node_fs18.constants.O_NOFOLLOW === "number" ? import_node_fs18.constants.O_NOFOLLOW : 0;
+var O_NOFOLLOW2 = typeof import_node_fs19.constants.O_NOFOLLOW === "number" ? import_node_fs19.constants.O_NOFOLLOW : 0;
 function readFileInside(baseDir, candidate, maxBytes) {
   const full = resolveInside(baseDir, candidate);
   if (!full) return null;
   let realParent;
   let realBase;
   try {
-    realParent = (0, import_node_fs18.realpathSync)((0, import_node_path16.dirname)(full));
-    realBase = (0, import_node_fs18.realpathSync)((0, import_node_path16.resolve)(baseDir));
+    realParent = (0, import_node_fs19.realpathSync)((0, import_node_path17.dirname)(full));
+    realBase = (0, import_node_fs19.realpathSync)((0, import_node_path17.resolve)(baseDir));
   } catch {
     return null;
   }
-  const realBaseSep = realBase.endsWith(import_node_path16.sep) ? realBase : realBase + import_node_path16.sep;
+  const realBaseSep = realBase.endsWith(import_node_path17.sep) ? realBase : realBase + import_node_path17.sep;
   if (realParent !== realBase && !realParent.startsWith(realBaseSep)) return null;
-  const target = (0, import_node_path16.join)(realParent, (0, import_node_path16.basename)(full));
+  const target = (0, import_node_path17.join)(realParent, (0, import_node_path17.basename)(full));
   let fd = null;
   try {
-    fd = (0, import_node_fs18.openSync)(target, import_node_fs18.constants.O_RDONLY | O_NOFOLLOW2);
-    const st = (0, import_node_fs18.fstatSync)(fd);
+    fd = (0, import_node_fs19.openSync)(target, import_node_fs19.constants.O_RDONLY | O_NOFOLLOW2);
+    const st = (0, import_node_fs19.fstatSync)(fd);
     if (!st.isFile()) return null;
     const cap2 = Math.min(maxBytes, st.size);
     if (cap2 <= 0) return "";
     const buf = Buffer.alloc(cap2);
-    const bytesRead = (0, import_node_fs18.readSync)(fd, buf, 0, cap2, 0);
+    const bytesRead = (0, import_node_fs19.readSync)(fd, buf, 0, cap2, 0);
     return buf.subarray(0, bytesRead).toString("utf-8");
   } catch {
     return null;
   } finally {
     if (fd !== null) {
       try {
-        (0, import_node_fs18.closeSync)(fd);
+        (0, import_node_fs19.closeSync)(fd);
       } catch {
       }
     }
@@ -19343,32 +19593,32 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path17.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path18.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs20.existsSync)((0, import_node_path18.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path18.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs20.existsSync)((0, import_node_path18.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path18.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs20.existsSync)((0, import_node_path18.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path18.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs19.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs20.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path17.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs19.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path18.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs20.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path17.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path18.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -19381,13 +19631,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path17.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path18.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto4.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path18.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -19398,15 +19648,15 @@ function hashContent(content) {
 }
 async function readOnDiskNodes() {
   const out2 = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs19.existsSync)(memoryDir2())) return out2;
+  if (!(0, import_node_fs20.existsSync)(memoryDir2())) return out2;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path17.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs19.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path18.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs20.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out2.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path17.join)(domainDir, file), "utf-8")));
+          out2.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path18.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -19443,7 +19693,7 @@ async function recordSyncedNodePaths() {
   }
 }
 async function writeFileAtomic(path, content) {
-  await (0, import_promises9.mkdir)((0, import_node_path17.dirname)(path), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path18.dirname)(path), { recursive: true });
   const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
   await (0, import_promises9.writeFile)(tmp, content);
   await (0, import_promises9.rename)(tmp, path);
@@ -19457,8 +19707,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path17.join)(memoryDir2(), path);
-    if (!(0, import_node_fs19.existsSync)(full)) continue;
+    const full = (0, import_node_path18.join)(memoryDir2(), path);
+    if (!(0, import_node_fs20.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises9.readFile)(full, "utf-8");
@@ -19502,8 +19752,8 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path18.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path18.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   if (opts.baseline === "written") await mergeSyncBaseline(synced);
@@ -19513,7 +19763,7 @@ async function applyMemoryWrites(writes, opts = {}) {
 async function mergeSyncBaseline(entries) {
   if (entries.size === 0) return;
   try {
-    if ((0, import_node_fs19.existsSync)(syncStateFile())) {
+    if ((0, import_node_fs20.existsSync)(syncStateFile())) {
       try {
         JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
       } catch {
@@ -19541,7 +19791,7 @@ async function applyOneWrite(write, treePaths, lastServed) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs19.existsSync)(fullPath)) {
+  if ((0, import_node_fs20.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
@@ -19557,7 +19807,7 @@ async function applyOneWrite(write, treePaths, lastServed) {
       notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path17.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path18.dirname)(fullPath), { recursive: true });
   await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, syncedHash: hashContent(content), notes };
 }
@@ -19598,8 +19848,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path17.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs19.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path18.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs20.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -19609,7 +19859,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path17.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path18.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -19633,7 +19883,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path17.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path18.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
@@ -20030,9 +20280,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path17.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path18.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs19.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs20.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -20173,9 +20423,9 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/lib/dossier-session.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var import_node_crypto8 = require("node:crypto");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -20280,8 +20530,8 @@ function statementAnchorKey(file, patternId) {
 
 // src/lib/dossier/log.ts
 var import_node_crypto5 = require("node:crypto");
-var import_node_fs20 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_path19 = require("node:path");
 var CRC_TABLE = (() => {
   const t = new Int32Array(256);
   for (let i2 = 0; i2 < 256; i2++) {
@@ -20300,13 +20550,13 @@ function crc32(s) {
 function openDossier(identity) {
   try {
     const dir = dossierDir(identity);
-    (0, import_node_fs20.mkdirSync)(dir, { recursive: true, mode: 448 });
+    (0, import_node_fs21.mkdirSync)(dir, { recursive: true, mode: 448 });
     return {
       dir,
       identity,
-      eventsPath: (0, import_node_path18.join)(dir, "events.jsonl"),
-      foldPath: (0, import_node_path18.join)(dir, "fold.json"),
-      rotatedDir: (0, import_node_path18.join)(dir, "rotated")
+      eventsPath: (0, import_node_path19.join)(dir, "events.jsonl"),
+      foldPath: (0, import_node_path19.join)(dir, "fold.json"),
+      rotatedDir: (0, import_node_path19.join)(dir, "rotated")
     };
   } catch {
     return null;
@@ -20368,7 +20618,7 @@ function appendEvent(d, ev) {
       at: ev.at ?? (/* @__PURE__ */ new Date()).toISOString(),
       ...ev
     });
-    (0, import_node_fs20.appendFileSync)(d.eventsPath, line2, { mode: 384 });
+    (0, import_node_fs21.appendFileSync)(d.eventsPath, line2, { mode: 384 });
     return true;
   } catch {
     return false;
@@ -20376,14 +20626,14 @@ function appendEvent(d, ev) {
 }
 function rotateIfNeeded2(d) {
   try {
-    if (!(0, import_node_fs20.existsSync)(d.eventsPath)) return;
-    if ((0, import_node_fs20.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
-    (0, import_node_fs20.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
-    (0, import_node_fs20.renameSync)(d.eventsPath, (0, import_node_path18.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
-    const kept = (0, import_node_fs20.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
+    if (!(0, import_node_fs21.existsSync)(d.eventsPath)) return;
+    if ((0, import_node_fs21.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
+    (0, import_node_fs21.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
+    (0, import_node_fs21.renameSync)(d.eventsPath, (0, import_node_path19.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
+    const kept = (0, import_node_fs21.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - ROTATE_KEEP))) {
       try {
-        (0, import_node_fs20.renameSync)((0, import_node_path18.join)(d.rotatedDir, stale), (0, import_node_path18.join)(d.rotatedDir, `${stale}.pruned`));
+        (0, import_node_fs21.renameSync)((0, import_node_path19.join)(d.rotatedDir, stale), (0, import_node_path19.join)(d.rotatedDir, `${stale}.pruned`));
       } catch {
       }
     }
@@ -20393,8 +20643,8 @@ function rotateIfNeeded2(d) {
 
 // src/lib/dossier/fold-dossier.ts
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs21 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path20 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
   human_reachable: { value: "unknown", tier: "unknown" },
   authorship_observability: { value: "unknown", tier: "unknown" },
@@ -20445,12 +20695,12 @@ function foldDossier(d, opts = {}) {
     }
   };
   try {
-    if ((0, import_node_fs21.existsSync)(d.rotatedDir)) {
-      const files = (0, import_node_fs21.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
+    if ((0, import_node_fs22.existsSync)(d.rotatedDir)) {
+      const files = (0, import_node_fs22.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
       state.meta.rotations = files.length;
       for (const f of files) {
         try {
-          ingest((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(d.rotatedDir, f), "utf8"));
+          ingest((0, import_node_fs22.readFileSync)((0, import_node_path20.join)(d.rotatedDir, f), "utf8"));
         } catch {
           state.meta.dropped_lines++;
         }
@@ -20459,9 +20709,9 @@ function foldDossier(d, opts = {}) {
   } catch {
   }
   try {
-    if ((0, import_node_fs21.existsSync)(d.eventsPath)) {
-      state.meta.upto_offset = (0, import_node_fs21.statSync)(d.eventsPath).size;
-      ingest((0, import_node_fs21.readFileSync)(d.eventsPath, "utf8"));
+    if ((0, import_node_fs22.existsSync)(d.eventsPath)) {
+      state.meta.upto_offset = (0, import_node_fs22.statSync)(d.eventsPath).size;
+      ingest((0, import_node_fs22.readFileSync)(d.eventsPath, "utf8"));
     }
   } catch {
   }
@@ -20732,7 +20982,7 @@ function applyBounds(state, input) {
 }
 
 // src/lib/dossier/cache.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs23 = require("node:fs");
 function compactState(s) {
   const ms = (iso) => Date.parse(iso) || 0;
   return {
@@ -20861,20 +21111,20 @@ function encodeState(s) {
 function writeFoldCache(d, state) {
   try {
     const tmp = `${d.foldPath}.${process.pid}.tmp`;
-    (0, import_node_fs22.writeFileSync)(tmp, encodeState(state), { mode: 384 });
-    (0, import_node_fs22.renameSync)(tmp, d.foldPath);
+    (0, import_node_fs23.writeFileSync)(tmp, encodeState(state), { mode: 384 });
+    (0, import_node_fs23.renameSync)(tmp, d.foldPath);
   } catch {
   }
 }
 function readFoldCache(d) {
   try {
-    if (!(0, import_node_fs22.existsSync)(d.foldPath)) return null;
-    const raw = JSON.parse((0, import_node_fs22.readFileSync)(d.foldPath, "utf8"));
+    if (!(0, import_node_fs23.existsSync)(d.foldPath)) return null;
+    const raw = JSON.parse((0, import_node_fs23.readFileSync)(d.foldPath, "utf8"));
     if (raw?.v !== 1) return null;
     const cached2 = expandState(raw);
     if (!cached2?.meta) return null;
-    const size = (0, import_node_fs22.existsSync)(d.eventsPath) ? (0, import_node_fs22.statSync)(d.eventsPath).size : 0;
-    const rotations = (0, import_node_fs22.existsSync)(d.rotatedDir) ? (0, import_node_fs22.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).length : 0;
+    const size = (0, import_node_fs23.existsSync)(d.eventsPath) ? (0, import_node_fs23.statSync)(d.eventsPath).size : 0;
+    const rotations = (0, import_node_fs23.existsSync)(d.rotatedDir) ? (0, import_node_fs23.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).length : 0;
     if (cached2.meta.upto_offset !== size || cached2.meta.rotations !== rotations) return null;
     return cached2;
   } catch {
@@ -20925,13 +21175,13 @@ function assessContinuity(i2) {
 
 // src/lib/dossier/reanchor.ts
 var import_node_crypto7 = require("node:crypto");
-var import_node_fs23 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 function lineSha(text) {
   return (0, import_node_crypto7.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
 }
 function fileHash(path) {
   try {
-    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs23.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
+    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs24.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
   } catch {
     return null;
   }
@@ -21303,20 +21553,20 @@ function foreignAuthoredPaths(identity, opts = {}) {
   let sessions = 0;
   try {
     const dir = treeDir(identity);
-    if (!(0, import_node_fs24.existsSync)(dir)) return { paths: [], sessions: 0 };
-    for (const entry of (0, import_node_fs24.readdirSync)(dir, { withFileTypes: true })) {
+    if (!(0, import_node_fs25.existsSync)(dir)) return { paths: [], sessions: 0 };
+    for (const entry of (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (entry.name === identity.sessionKey) continue;
-      const log = (0, import_node_path20.join)(dir, entry.name, "events.jsonl");
+      const log = (0, import_node_path21.join)(dir, entry.name, "events.jsonl");
       try {
-        if (!(0, import_node_fs24.existsSync)(log)) continue;
-        if (now - (0, import_node_fs24.statSync)(log).mtimeMs > windowMs) continue;
+        if (!(0, import_node_fs25.existsSync)(log)) continue;
+        if (now - (0, import_node_fs25.statSync)(log).mtimeMs > windowMs) continue;
         const sib = {
-          dir: (0, import_node_path20.join)(dir, entry.name),
+          dir: (0, import_node_path21.join)(dir, entry.name),
           identity,
           eventsPath: log,
-          foldPath: (0, import_node_path20.join)(dir, entry.name, "fold.json"),
-          rotatedDir: (0, import_node_path20.join)(dir, entry.name, "rotated")
+          foldPath: (0, import_node_path21.join)(dir, entry.name, "fold.json"),
+          rotatedDir: (0, import_node_path21.join)(dir, entry.name, "rotated")
         };
         const state = readFoldCache(sib) ?? foldDossier(sib);
         sessions++;
@@ -21344,25 +21594,25 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
   let removed = 0;
   try {
     const mine = dossierDir(identity);
-    const userDir = (0, import_node_path20.dirname)((0, import_node_path20.dirname)(mine));
-    if (!(0, import_node_fs24.existsSync)(userDir)) return 0;
+    const userDir = (0, import_node_path21.dirname)((0, import_node_path21.dirname)(mine));
+    if (!(0, import_node_fs25.existsSync)(userDir)) return 0;
     const cutoff = Date.now() - maxAgeMs;
-    for (const tree of (0, import_node_fs24.readdirSync)(userDir, { withFileTypes: true })) {
+    for (const tree of (0, import_node_fs25.readdirSync)(userDir, { withFileTypes: true })) {
       if (!tree.isDirectory()) continue;
-      const treePath = (0, import_node_path20.join)(userDir, tree.name);
+      const treePath = (0, import_node_path21.join)(userDir, tree.name);
       let live = 0;
-      for (const entry of (0, import_node_fs24.readdirSync)(treePath, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs25.readdirSync)(treePath, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = (0, import_node_path20.join)(treePath, entry.name);
+        const dir = (0, import_node_path21.join)(treePath, entry.name);
         if (dir === mine) {
           live++;
           continue;
         }
         try {
-          const log = (0, import_node_path20.join)(dir, "events.jsonl");
-          const at = (0, import_node_fs24.existsSync)(log) ? (0, import_node_fs24.statSync)(log).mtimeMs : (0, import_node_fs24.statSync)(dir).mtimeMs;
+          const log = (0, import_node_path21.join)(dir, "events.jsonl");
+          const at = (0, import_node_fs25.existsSync)(log) ? (0, import_node_fs25.statSync)(log).mtimeMs : (0, import_node_fs25.statSync)(dir).mtimeMs;
           if (at < cutoff) {
-            (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
+            (0, import_node_fs25.rmSync)(dir, { recursive: true, force: true });
             removed++;
           } else {
             live++;
@@ -21372,7 +21622,7 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
       }
       if (live === 0) {
         try {
-          (0, import_node_fs24.rmSync)(treePath, { recursive: false, force: false });
+          (0, import_node_fs25.rmSync)(treePath, { recursive: false, force: false });
         } catch {
         }
       }
@@ -21389,8 +21639,8 @@ function sessionDossier(token, sessionId) {
 }
 function hasActiveGoal(d) {
   try {
-    if (!(0, import_node_fs24.existsSync)(d.eventsPath)) return false;
-    return (0, import_node_fs24.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
+    if (!(0, import_node_fs25.existsSync)(d.eventsPath)) return false;
+    return (0, import_node_fs25.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
   } catch {
     return false;
   }
@@ -21414,7 +21664,7 @@ function recordTurn(d, t) {
   for (const a of t.authored) {
     const origin = a.owner === "subagent" ? "subagent" : "edit_tool";
     const prior = t.known?.authored?.get(a.p);
-    const hash = fileHash((0, import_node_path20.join)(root, a.p));
+    const hash = fileHash((0, import_node_path21.join)(root, a.p));
     const hunks = Math.max(0, a.h - (prior?.hunks ?? 0));
     const adds = Math.max(0, a.a - (prior?.adds ?? 0));
     const dels = Math.max(0, a.d - (prior?.dels ?? 0));
@@ -21447,7 +21697,7 @@ function recordTurn(d, t) {
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
   for (const u of t.unobserved) {
-    const hash = fileHash((0, import_node_path20.join)(root, u.p));
+    const hash = fileHash((0, import_node_path21.join)(root, u.p));
     if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
     appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
   }
@@ -21482,8 +21732,8 @@ function recordVerdict(d, v) {
     if (!sent.has(f.file)) continue;
     if (!lines.has(f.file)) {
       try {
-        const abs = (0, import_node_path20.join)(root, f.file);
-        lines.set(f.file, (0, import_node_fs24.existsSync)(abs) ? (0, import_node_fs24.readFileSync)(abs, "utf8").split("\n") : null);
+        const abs = (0, import_node_path21.join)(root, f.file);
+        lines.set(f.file, (0, import_node_fs25.existsSync)(abs) ? (0, import_node_fs25.readFileSync)(abs, "utf8").split("\n") : null);
       } catch {
         lines.set(f.file, null);
       }
@@ -21583,8 +21833,8 @@ function recallMemory(d, identity, opts) {
       budgetBytes: opts.budgetBytes,
       readFileLines: (file) => {
         try {
-          const abs = (0, import_node_path20.join)(root, file);
-          return (0, import_node_fs24.existsSync)(abs) ? (0, import_node_fs24.readFileSync)(abs, "utf8").split("\n") : null;
+          const abs = (0, import_node_path21.join)(root, file);
+          return (0, import_node_fs25.existsSync)(abs) ? (0, import_node_fs25.readFileSync)(abs, "utf8").split("\n") : null;
         } catch {
           return null;
         }
@@ -21752,21 +22002,21 @@ async function fireClassify(prompt, sessionId, globals) {
 }
 
 // src/commands/lifecycle.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path25 = require("node:path");
 
 // src/lib/baseline.ts
-var import_node_fs26 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path24 = require("node:path");
 var import_node_crypto10 = require("node:crypto");
 
 // src/lib/snapshot.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_path23 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 
 // src/lib/files.ts
-var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -21834,7 +22084,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path21.extname)(filepath).slice(1);
+  const ext = (0, import_node_path22.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -21925,16 +22175,16 @@ function collectCodeDelta(files, opts) {
 
 // src/lib/snapshot.ts
 function generateSnapshotDiffs(files) {
-  if (!(0, import_node_fs25.existsSync)(SNAPSHOT_DIR)) {
+  if (!(0, import_node_fs26.existsSync)(SNAPSHOT_DIR)) {
     return { diffs: [], has_snapshots: false };
   }
   const diffs = [];
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path22.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path23.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
-    if ((0, import_node_fs25.existsSync)(snapshotPath)) {
-      const oldContent = (0, import_node_fs25.readFileSync)(snapshotPath, "utf-8");
+    if ((0, import_node_fs26.existsSync)(snapshotPath)) {
+      const oldContent = (0, import_node_fs26.readFileSync)(snapshotPath, "utf-8");
       if (oldContent === file.content) continue;
       const diff = computeDiff(oldContent, file.content, file.path);
       if (diff) {
@@ -21959,20 +22209,20 @@ function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path22.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path23.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(snapshotPath), { recursive: true });
-    (0, import_node_fs25.writeFileSync)(snapshotPath, file.content);
+    (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs26.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path22.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path22.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path23.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path23.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
-    (0, import_node_fs25.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
-    (0, import_node_fs25.writeFileSync)(tmpOld, oldContent);
-    (0, import_node_fs25.writeFileSync)(tmpNew, newContent);
+    (0, import_node_fs26.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
+    (0, import_node_fs26.writeFileSync)(tmpOld, oldContent);
+    (0, import_node_fs26.writeFileSync)(tmpNew, newContent);
     const result = (0, import_node_child_process7.execSync)(
       `git diff --no-index --unified=10 -- "${tmpOld}" "${tmpNew}"`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -21986,32 +22236,32 @@ function computeDiff(oldContent, newContent, filePath) {
     return null;
   } finally {
     try {
-      (0, import_node_fs25.unlinkSync)(tmpOld);
+      (0, import_node_fs26.unlinkSync)(tmpOld);
     } catch {
     }
     try {
-      (0, import_node_fs25.unlinkSync)(tmpNew);
+      (0, import_node_fs26.unlinkSync)(tmpNew);
     } catch {
     }
   }
 }
 function cleanStaleSnapshots(dir, keepSet) {
-  if (!(0, import_node_fs25.existsSync)(dir)) return;
+  if (!(0, import_node_fs26.existsSync)(dir)) return;
   try {
-    const entries = (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs26.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
-      const fullPath = (0, import_node_path22.join)(dir, entry.name);
+      const fullPath = (0, import_node_path23.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
-          const remaining = (0, import_node_fs25.readdirSync)(fullPath);
-          if (remaining.length === 0) (0, import_node_fs25.rmdirSync)(fullPath);
+          const remaining = (0, import_node_fs26.readdirSync)(fullPath);
+          if (remaining.length === 0) (0, import_node_fs26.rmdirSync)(fullPath);
         } catch {
         }
       } else if (!keepSet.has(fullPath)) {
         try {
-          (0, import_node_fs25.unlinkSync)(fullPath);
+          (0, import_node_fs26.unlinkSync)(fullPath);
         } catch {
         }
       }
@@ -22030,20 +22280,20 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto10.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path23.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path24.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path23.join)(dir, "manifest.json");
+  return (0, import_node_path24.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path23.join)(dir, "files", repoRelPath);
+  return (0, import_node_path24.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
 function writeCarry(sessionId, headSha) {
   try {
-    (0, import_node_fs26.mkdirSync)(projectPath(BASELINE_DIR), { recursive: true });
-    (0, import_node_fs26.writeFileSync)(
+    (0, import_node_fs27.mkdirSync)(projectPath(BASELINE_DIR), { recursive: true });
+    (0, import_node_fs27.writeFileSync)(
       projectPath(CARRY_FILE),
       JSON.stringify({ from_key: sessionKey(sessionId), head_sha: headSha, ts: Date.now() })
     );
@@ -22053,10 +22303,10 @@ function writeCarry(sessionId, headSha) {
 function claimCarry(newKey) {
   const carryPath = projectPath(CARRY_FILE);
   try {
-    if (!(0, import_node_fs26.existsSync)(carryPath)) return null;
-    const carry = JSON.parse((0, import_node_fs26.readFileSync)(carryPath, "utf-8"));
+    if (!(0, import_node_fs27.existsSync)(carryPath)) return null;
+    const carry = JSON.parse((0, import_node_fs27.readFileSync)(carryPath, "utf-8"));
     try {
-      (0, import_node_fs26.rmSync)(carryPath, { force: true });
+      (0, import_node_fs27.rmSync)(carryPath, { force: true });
     } catch {
     }
     if (!carry?.from_key || typeof carry.ts !== "number") return null;
@@ -22067,11 +22317,11 @@ function claimCarry(newKey) {
     if (!prior) return null;
     const toDir = sessionDir(newKey);
     try {
-      (0, import_node_fs26.rmSync)(toDir, { recursive: true, force: true });
+      (0, import_node_fs27.rmSync)(toDir, { recursive: true, force: true });
     } catch {
     }
-    (0, import_node_fs26.renameSync)(fromDir, toDir);
-    (0, import_node_fs26.writeFileSync)(manifestPath(toDir), JSON.stringify({ ...prior, session_id: newKey }) + "\n");
+    (0, import_node_fs27.renameSync)(fromDir, toDir);
+    (0, import_node_fs27.writeFileSync)(manifestPath(toDir), JSON.stringify({ ...prior, session_id: newKey }) + "\n");
     return readManifest(toDir);
   } catch {
     return null;
@@ -22095,21 +22345,21 @@ function captureBaseline(opts = {}) {
   const head_sha = getCurrentCommit();
   const dirty = getDirtyFiles();
   try {
-    (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path23.join)(dir, "files");
+  const filesDir = (0, import_node_path24.join)(dir, "files");
   const mirrored = [];
   try {
-    (0, import_node_fs26.mkdirSync)(filesDir, { recursive: true });
+    (0, import_node_fs27.mkdirSync)(filesDir, { recursive: true });
     for (const p of dirty) {
       if (p.includes("..")) continue;
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(dest), { recursive: true });
-        (0, import_node_fs26.writeFileSync)(dest, content);
+        (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(dest), { recursive: true });
+        (0, import_node_fs27.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
       }
@@ -22124,8 +22374,8 @@ function captureBaseline(opts = {}) {
     version: BASELINE_VERSION
   };
   try {
-    (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs26.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
+    (0, import_node_fs27.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs27.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
   } catch {
   }
   pruneOldBaselines();
@@ -22136,9 +22386,9 @@ function readBaseline(sessionId) {
 }
 function readManifest(dir) {
   const mp = manifestPath(dir);
-  if (!(0, import_node_fs26.existsSync)(mp)) return null;
+  if (!(0, import_node_fs27.existsSync)(mp)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs26.readFileSync)(mp, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs27.readFileSync)(mp, "utf-8"));
     if (typeof parsed.head_sha !== "string" || typeof parsed.captured_at !== "number" || !Array.isArray(parsed.dirty_paths) || parsed.version !== BASELINE_VERSION) {
       return null;
     }
@@ -22169,9 +22419,9 @@ function preImage(repoRelPath, baseline) {
 function resolvePreImage(repoRelPath, baseline) {
   if (baseline.dirty_paths.includes(repoRelPath)) {
     const mp = mirrorPath(sessionDir(sessionKey(baseline.session_id)), repoRelPath);
-    if ((0, import_node_fs26.existsSync)(mp)) {
+    if ((0, import_node_fs27.existsSync)(mp)) {
       try {
-        return { content: (0, import_node_fs26.readFileSync)(mp, "utf-8"), existed: true };
+        return { content: (0, import_node_fs27.readFileSync)(mp, "utf-8"), existed: true };
       } catch {
       }
     }
@@ -22216,8 +22466,8 @@ function absorbIntoBaseline(paths, sessionId) {
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
-      (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(dest), { recursive: true });
-      (0, import_node_fs26.writeFileSync)(dest, content);
+      (0, import_node_fs27.mkdirSync)((0, import_node_path24.dirname)(dest), { recursive: true });
+      (0, import_node_fs27.writeFileSync)(dest, content);
       dirty.add(p);
       adopted++;
     } catch {
@@ -22226,7 +22476,7 @@ function absorbIntoBaseline(paths, sessionId) {
   if (adopted === 0) return 0;
   try {
     const updated = { ...baseline, dirty_paths: [...dirty] };
-    (0, import_node_fs26.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
+    (0, import_node_fs27.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
     preImageCache.delete(baseline);
   } catch {
     return 0;
@@ -22237,7 +22487,7 @@ function changedSinceBaseline(repoRelPath, baseline) {
   const pre = preImage(repoRelPath, baseline);
   let current;
   try {
-    current = (0, import_node_fs26.readFileSync)(projectPath(repoRelPath), "utf-8");
+    current = (0, import_node_fs27.readFileSync)(projectPath(repoRelPath), "utf-8");
   } catch {
     return pre.existed;
   }
@@ -22246,8 +22496,8 @@ function changedSinceBaseline(repoRelPath, baseline) {
 }
 function safeReadForMirror(absPath) {
   try {
-    if ((0, import_node_fs26.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
-    const buf = (0, import_node_fs26.readFileSync)(absPath);
+    if ((0, import_node_fs27.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
+    const buf = (0, import_node_fs27.readFileSync)(absPath);
     if (buf.includes(0)) return null;
     return buf.toString("utf-8");
   } catch {
@@ -22258,18 +22508,18 @@ function pruneOldBaselines() {
   const root = projectPath(BASELINE_DIR);
   let entries;
   try {
-    entries = (0, import_node_fs26.readdirSync)(root);
+    entries = (0, import_node_fs27.readdirSync)(root);
   } catch {
     return;
   }
   const now = Date.now();
   for (const name2 of entries) {
-    const dir = (0, import_node_path23.join)(root, name2);
+    const dir = (0, import_node_path24.join)(root, name2);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
-        if (now - (0, import_node_fs26.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
-          (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
+        if (now - (0, import_node_fs27.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
+          (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
         }
       } catch {
       }
@@ -22277,7 +22527,7 @@ function pruneOldBaselines() {
     }
     if (now - manifest.captured_at <= BASELINE_TTL_MS) continue;
     try {
-      (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -22452,8 +22702,8 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path24.join)(root, file);
-        return (0, import_node_fs27.existsSync)(abs) ? (0, import_node_fs27.readFileSync)(abs, "utf8").split("\n") : null;
+        const abs = (0, import_node_path25.join)(root, file);
+        return (0, import_node_fs28.existsSync)(abs) ? (0, import_node_fs28.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
       }
@@ -22510,24 +22760,24 @@ async function readHookStdin() {
 
 // src/commands/standard.ts
 var import_promises13 = require("node:fs/promises");
-var import_node_fs34 = require("node:fs");
+var import_node_fs35 = require("node:fs");
 var import_yaml3 = __toESM2(require_dist());
 
 // src/lib/synthesize.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 var import_yaml = __toESM2(require_dist());
 
 // src/lib/data-dir.ts
-var import_node_fs28 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs29 = require("node:fs");
+var import_node_path26 = require("node:path");
 function resolveDataDir() {
   const candidates2 = [
-    (0, import_node_path25.join)(__dirname, "..", "data"),
+    (0, import_node_path26.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path25.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path26.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
     // THE COMMITTED SOURCE, for a source checkout that has not been built.
     // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
@@ -22536,14 +22786,14 @@ function resolveDataDir() {
     // without this the synthesizer throws "Could not find Verity skill data"
     // for every test and every `verity` run from source. Resolved from this
     // module's own location, never the cwd: see the warning below.
-    (0, import_node_path25.join)(__dirname, "..", "..", "client"),
+    (0, import_node_path26.join)(__dirname, "..", "..", "client"),
     // bundled: cli/bin/ → ../../client
-    (0, import_node_path25.join)(__dirname, "..", "..", "..", "client"),
+    (0, import_node_path26.join)(__dirname, "..", "..", "..", "client"),
     // tsx: cli/src/lib/ → ../../../client
     ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs28.existsSync)((0, import_node_path25.join)(candidate, "skills"))) {
+    if ((0, import_node_fs29.existsSync)((0, import_node_path26.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -22552,13 +22802,13 @@ function resolveDataDir() {
   );
 }
 function setupDataPath(file) {
-  return (0, import_node_path25.join)(resolveDataDir(), "skills", "verity-setup", file);
+  return (0, import_node_path26.join)(resolveDataDir(), "skills", "verity-setup", file);
 }
 
 // src/lib/detect.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs29 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_fs30 = require("node:fs");
+var import_node_path27 = require("node:path");
 var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -22615,25 +22865,25 @@ function walk(root) {
     if (depth > WALK_MAX_DEPTH || found.length >= WALK_MAX_FILES) return;
     let entries;
     try {
-      entries = (0, import_node_fs29.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs30.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (found.length >= WALK_MAX_FILES) return;
       if (IGNORED_SEGMENTS.includes(entry.name)) continue;
-      const full = (0, import_node_path26.join)(dir, entry.name);
+      const full = (0, import_node_path27.join)(dir, entry.name);
       if (entry.isDirectory()) visit(full, depth + 1);
-      else if (entry.isFile()) found.push((0, import_node_path26.relative)(root, full));
+      else if (entry.isFile()) found.push((0, import_node_path27.relative)(root, full));
     }
   };
   visit(root, 0);
   return found;
 }
 function languageOf(path) {
-  const name2 = (0, import_node_path26.basename)(path);
+  const name2 = (0, import_node_path27.basename)(path);
   if (/^Dockerfile(\..+)?$/i.test(name2)) return "dockerfile";
-  if (!(0, import_node_path26.extname)(name2)) return null;
+  if (!(0, import_node_path27.extname)(name2)) return null;
   const lang = detectLanguage(path);
   return lang || null;
 }
@@ -22690,7 +22940,7 @@ var TOOL_CONFIG_MARKERS = [
 ];
 function readJson2(path) {
   try {
-    return JSON.parse((0, import_node_fs29.readFileSync)(path, "utf-8"));
+    return JSON.parse((0, import_node_fs30.readFileSync)(path, "utf-8"));
   } catch {
     return null;
   }
@@ -22715,17 +22965,17 @@ function declaredDependencies(root, files) {
       if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
     }
   };
-  readPackageJson((0, import_node_path26.join)(root, "package.json"));
-  const nested = files.filter((f) => f.includes("/") && (0, import_node_path26.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
-  for (const rel of nested) readPackageJson((0, import_node_path26.join)(root, rel));
+  readPackageJson((0, import_node_path27.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path27.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path27.join)(root, rel));
   const pythonManifests = [
-    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path26.join)(root, f)),
-    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path26.join)(root, f))
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path27.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path27.join)(root, f))
   ];
   for (const path of pythonManifests) {
-    if (!(0, import_node_fs29.existsSync)(path)) continue;
+    if (!(0, import_node_fs30.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs29.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs30.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/^\s*["']?([A-Za-z][A-Za-z0-9._-]+)/gm)) names2.push(m[1]);
       for (const line2 of text.split("\n")) {
         if (!/dependencies\s*=/.test(line2)) continue;
@@ -22735,13 +22985,13 @@ function declaredDependencies(root, files) {
     }
   }
   const goMods = [
-    (0, import_node_path26.join)(root, "go.mod"),
-    ...files.filter((f) => f.includes("/") && (0, import_node_path26.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path26.join)(root, f))
+    (0, import_node_path27.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path27.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path27.join)(root, f))
   ];
   for (const path of goMods) {
-    if (!(0, import_node_fs29.existsSync)(path)) continue;
+    if (!(0, import_node_fs30.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs29.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs30.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/^\s+([\w.-]+\/[\w./-]+)\s+v/gm)) {
         names2.push(m[1].replace(/^github\.com\//, ""));
       }
@@ -22749,10 +22999,10 @@ function declaredDependencies(root, files) {
     }
   }
   for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
-    const path = (0, import_node_path26.join)(root, file);
-    if (!(0, import_node_fs29.existsSync)(path)) continue;
+    const path = (0, import_node_path27.join)(root, file);
+    if (!(0, import_node_fs30.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs29.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs30.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/["'<]([A-Za-z][A-Za-z0-9._-]{2,})["'>]/g)) names2.push(m[1]);
     } catch {
     }
@@ -22760,7 +23010,7 @@ function declaredDependencies(root, files) {
   return names2;
 }
 function detectBuildSystem(root, files) {
-  const has = (f) => (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, f)) || files.some((p) => (0, import_node_path26.basename)(p) === f);
+  const has = (f) => (0, import_node_fs30.existsSync)((0, import_node_path27.join)(root, f)) || files.some((p) => (0, import_node_path27.basename)(p) === f);
   if (has("pnpm-lock.yaml")) return "pnpm";
   if (has("yarn.lock")) return "yarn";
   if (has("bun.lock") || has("bun.lockb")) return "bun";
@@ -22777,8 +23027,8 @@ function detectBuildSystem(root, files) {
 }
 function detectArchitecture(root, files) {
   const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
-  if (workspaceMarkers.some((m) => (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, m)))) return "monorepo";
-  const pkg = readJson2((0, import_node_path26.join)(root, "package.json"));
+  if (workspaceMarkers.some((m) => (0, import_node_fs30.existsSync)((0, import_node_path27.join)(root, m)))) return "monorepo";
+  const pkg = readJson2((0, import_node_path27.join)(root, "package.json"));
   if (pkg && "workspaces" in pkg) return "monorepo";
   const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
   const nested = manifests.filter((f) => f.includes("/"));
@@ -22800,10 +23050,10 @@ function measureAvgFileLength(root, files, languages) {
   let total = 0;
   let counted = 0;
   for (let i2 = 0; i2 < candidates2.length; i2 += stride) {
-    const path = (0, import_node_path26.join)(root, candidates2[i2]);
+    const path = (0, import_node_path27.join)(root, candidates2[i2]);
     try {
-      if ((0, import_node_fs29.statSync)(path).size > 2 * 1024 * 1024) continue;
-      total += (0, import_node_fs29.readFileSync)(path, "utf-8").split("\n").length;
+      if ((0, import_node_fs30.statSync)(path).size > 2 * 1024 * 1024) continue;
+      total += (0, import_node_fs30.readFileSync)(path, "utf-8").split("\n").length;
       counted++;
     } catch {
     }
@@ -22833,14 +23083,14 @@ function detectProject(root = repoRoot()) {
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
     for (const marker of markers) {
-      if ((0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, marker))) {
+      if ((0, import_node_fs30.existsSync)((0, import_node_path27.join)(root, marker))) {
         existingToolConfigs.push({ tool, path: `./${marker}` });
         break;
       }
     }
   }
   return {
-    projectName: (0, import_node_path26.basename)(root),
+    projectName: (0, import_node_path27.basename)(root),
     languages,
     languageCounts,
     frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
@@ -22938,8 +23188,8 @@ ${closingNote(input.origin)}
 
 // src/lib/synthesize.ts
 function loadCatalog() {
-  const catalog = (0, import_yaml.parse)((0, import_node_fs30.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
-  const template = (0, import_yaml.parse)((0, import_node_fs30.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
+  const catalog = (0, import_yaml.parse)((0, import_node_fs31.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
+  const template = (0, import_yaml.parse)((0, import_node_fs31.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
   return { catalog, template };
 }
 function selectTools(languages, intensity, catalog) {
@@ -23217,7 +23467,7 @@ function validatePatternIds() {
 }
 async function runSynthesis(opts) {
   const standardPath = projectPath(STANDARD_FILE);
-  if ((0, import_node_fs30.existsSync)(standardPath) && !opts.force) {
+  if ((0, import_node_fs31.existsSync)(standardPath) && !opts.force) {
     return { refused: `${STANDARD_FILE} already exists \u2014 pass --force to replace it.` };
   }
   const detected = opts.detected ?? detectProject();
@@ -23286,7 +23536,7 @@ async function correctVerityMdVersion(opts) {
 }
 async function writeFileTo(relative6, body2) {
   const target = projectPath(relative6);
-  await (0, import_promises10.mkdir)((0, import_node_path27.dirname)(target), { recursive: true });
+  await (0, import_promises10.mkdir)((0, import_node_path28.dirname)(target), { recursive: true });
   await (0, import_promises10.writeFile)(target, body2);
 }
 async function deriveConfigForStandard(standard) {
@@ -23345,11 +23595,11 @@ ${validation.detail}`);
 
 // src/lib/setup-state.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs31 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
 async function readSetupState() {
   const path = projectPath(SETUP_STATE_FILE);
-  if (!(0, import_node_fs31.existsSync)(path)) return null;
+  if (!(0, import_node_fs32.existsSync)(path)) return null;
   try {
     const parsed = JSON.parse(await (0, import_promises11.readFile)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
@@ -23365,12 +23615,12 @@ async function writeSetupState(patch) {
 }
 
 // src/lib/push-setup.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
 var import_yaml2 = __toESM2(require_dist());
 
 // src/lib/verityignore.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var EMPTY = { rules: [], securityOverlap: [], problems: [] };
 var SECURITY_PROBES = [
   ".env",
@@ -23463,9 +23713,9 @@ function isIgnored3(ig, path) {
 }
 function loadVerityIgnore() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs32.existsSync)(file)) return EMPTY;
+  if (!(0, import_node_fs33.existsSync)(file)) return EMPTY;
   try {
-    return parseVerityIgnore((0, import_node_fs32.readFileSync)(file, "utf-8"));
+    return parseVerityIgnore((0, import_node_fs33.readFileSync)(file, "utf-8"));
   } catch {
     return EMPTY;
   }
@@ -23503,9 +23753,9 @@ function buildStandardUpload(standard, ignoreRaw) {
 }
 function readVerityIgnoreRaw() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs32.existsSync)(file)) return null;
+  if (!(0, import_node_fs33.existsSync)(file)) return null;
   try {
-    return (0, import_node_fs32.readFileSync)(file, "utf-8");
+    return (0, import_node_fs33.readFileSync)(file, "utf-8");
   } catch {
     return null;
   }
@@ -23533,7 +23783,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   }
   let standardVersion = null;
   const standardPath = projectPath(STANDARD_FILE);
-  if (pushStandard && (0, import_node_fs33.existsSync)(standardPath)) {
+  if (pushStandard && (0, import_node_fs34.existsSync)(standardPath)) {
     try {
       const content = (0, import_yaml2.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
       const upload = buildStandardUpload(content, readVerityIgnoreRaw());
@@ -23558,7 +23808,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   }
   let configPushed = false;
   const configPath = projectPath(CODACY_CONFIG_FILE);
-  if (pushConfig && (0, import_node_fs33.existsSync)(configPath)) {
+  if (pushConfig && (0, import_node_fs34.existsSync)(configPath)) {
     try {
       const content = JSON.parse(await (0, import_promises12.readFile)(configPath, "utf-8"));
       const result = await apiRequest({
@@ -23590,7 +23840,7 @@ function registerStandardCommands(program2) {
     const state = await readSetupState();
     if (opts.configOnly) {
       const standardPath = projectPath(STANDARD_FILE);
-      if (!(0, import_node_fs34.existsSync)(standardPath)) {
+      if (!(0, import_node_fs35.existsSync)(standardPath)) {
         printError(`No ${STANDARD_FILE} here \u2014 run "verity standard synthesize" to create one.`);
         process.exit(1);
       }
@@ -23936,10 +24186,10 @@ function formatRunDetail(run4) {
 }
 
 // src/lib/ignore-declaration.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 
 // src/lib/debounce.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
@@ -23947,9 +24197,9 @@ function scopedFile(base, sessionId) {
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs35.existsSync)(file)) return null;
+  if (!(0, import_node_fs36.existsSync)(file)) return null;
   try {
-    const lastTs = parseInt((0, import_node_fs35.readFileSync)(file, "utf-8").trim(), 10);
+    const lastTs = parseInt((0, import_node_fs36.readFileSync)(file, "utf-8").trim(), 10);
     const nowTs = Math.floor(Date.now() / 1e3);
     const elapsed = nowTs - lastTs;
     if (elapsed < debounceSeconds) {
@@ -23962,10 +24212,10 @@ function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
 function checkMtime(files, bypassForRecentCommits, sessionId) {
   if (bypassForRecentCommits) return null;
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs35.existsSync)(file)) return null;
+  if (!(0, import_node_fs36.existsSync)(file)) return null;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs35.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs36.statSync)(file).mtimeMs;
   } catch {
     return null;
   }
@@ -23973,7 +24223,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
     const resolved = resolveFile(f);
     if (!resolved) continue;
     try {
-      const stat3 = (0, import_node_fs35.statSync)(resolved);
+      const stat3 = (0, import_node_fs36.statSync)(resolved);
       if (stat3.mtimeMs > debounceTime) {
         return null;
       }
@@ -23989,8 +24239,8 @@ function computeContentHash(files) {
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
     try {
-      if ((0, import_node_fs35.existsSync)(resolved)) {
-        hash.update((0, import_node_fs35.readFileSync)(resolved));
+      if ((0, import_node_fs36.existsSync)(resolved)) {
+        hash.update((0, import_node_fs36.readFileSync)(resolved));
       }
     } catch {
     }
@@ -24000,9 +24250,9 @@ function computeContentHash(files) {
 function checkContentHash(files, sessionId) {
   const hash = computeContentHash(files);
   const file = scopedFile(HASH_FILE, sessionId);
-  if ((0, import_node_fs35.existsSync)(file)) {
+  if ((0, import_node_fs36.existsSync)(file)) {
     try {
-      const storedHash = (0, import_node_fs35.readFileSync)(file, "utf-8").trim();
+      const storedHash = (0, import_node_fs36.readFileSync)(file, "utf-8").trim();
       if (hash === storedHash) {
         return { skip: "No source changes since last analysis", hash };
       }
@@ -24012,24 +24262,24 @@ function checkContentHash(files, sessionId) {
   return { skip: null, hash };
 }
 function recordAnalysisStart(sessionId) {
-  (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs35.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
+  (0, import_node_fs36.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs36.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
 }
 function recordPassHash(hash, sessionId) {
-  (0, import_node_fs35.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
+  (0, import_node_fs36.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
 }
 function narrowToRecent(files, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs35.existsSync)(file)) return files;
+  if (!(0, import_node_fs36.existsSync)(file)) return files;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs35.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs36.statSync)(file).mtimeMs;
   } catch {
     return files;
   }
   const recent = files.filter((f) => {
     try {
-      return (0, import_node_fs35.existsSync)(f) && (0, import_node_fs35.statSync)(f).mtimeMs > debounceTime;
+      return (0, import_node_fs36.existsSync)(f) && (0, import_node_fs36.statSync)(f).mtimeMs > debounceTime;
     } catch {
       return false;
     }
@@ -24042,9 +24292,9 @@ function readIteration(currentCommit, _contentHash) {
 var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
 function readBlockState(currentCommit, opts) {
   if (opts?.newUserPrompt) return NO_BLOCKS;
-  if (!(0, import_node_fs35.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
+  if (!(0, import_node_fs36.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
   try {
-    const stored = (0, import_node_fs35.readFileSync)(ITERATION_FILE, "utf-8").trim();
+    const stored = (0, import_node_fs36.readFileSync)(ITERATION_FILE, "utf-8").trim();
     const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
     if (!parsed) return NO_BLOCKS;
     if (parsed.commit !== currentCommit) return NO_BLOCKS;
@@ -24090,8 +24340,8 @@ function isSameProblem(previous, current) {
   return current.split(",").some((k) => prev.has(k));
 }
 function writeBlockState(commit, state) {
-  (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs35.writeFileSync)(
+  (0, import_node_fs36.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs36.writeFileSync)(
     ITERATION_FILE,
     JSON.stringify({
       v: 2,
@@ -24196,9 +24446,9 @@ function resolveIgnoreState(keys) {
 }
 function readIgnoreState(sessionId) {
   const file = stateFile(sessionId);
-  if (!(0, import_node_fs36.existsSync)(file)) return null;
+  if (!(0, import_node_fs37.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs36.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs37.readFileSync)(file, "utf-8")) ?? {};
     const spent = typeof o.spent === "number" ? o.spent : 0;
     const raw = o.active;
     let active = null;
@@ -24222,8 +24472,8 @@ function readIgnoreState(sessionId) {
 }
 function writeIgnoreState(state, sessionId) {
   try {
-    (0, import_node_fs36.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
-    (0, import_node_fs36.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
+    (0, import_node_fs37.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs37.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
   } catch {
   }
 }
@@ -24606,7 +24856,7 @@ function createRun(opts, globals) {
 }
 
 // src/commands/analyze/index.ts
-var import_node_fs50 = require("node:fs");
+var import_node_fs51 = require("node:fs");
 
 // src/lib/repo-context.ts
 var import_node_child_process11 = require("node:child_process");
@@ -25645,10 +25895,10 @@ function installRunEvidence(run4) {
 }
 
 // src/lib/git-frame.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_os6 = require("node:os");
-var import_node_path28 = require("node:path");
 var import_node_path29 = require("node:path");
+var import_node_path30 = require("node:path");
 var VALUE_TOKEN = `(?:'[^']*'|"[^"]*"|\\S+)`;
 var GIT_GLOBAL_OPTS = `(?:\\s+(?:-[Cc]\\s+${VALUE_TOKEN}|--?[\\w-]+(?:=\\S+)?))*`;
 var COMMIT_HEAD = `git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`;
@@ -25735,8 +25985,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path29.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path28.isAbsolute)(expanded) ? expanded : (0, import_node_path28.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path30.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path29.isAbsolute)(expanded) ? expanded : (0, import_node_path29.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -25754,8 +26004,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path29.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path28.isAbsolute)(expanded) ? expanded : (0, import_node_path28.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path30.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path29.isAbsolute)(expanded) ? expanded : (0, import_node_path29.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -25815,14 +26065,14 @@ function gitAt(dir, args2) {
 }
 function realpathOr2(p) {
   try {
-    return import_node_fs37.realpathSync.native(p);
+    return import_node_fs38.realpathSync.native(p);
   } catch {
-    return (0, import_node_path28.resolve)(p);
+    return (0, import_node_path29.resolve)(p);
   }
 }
 function resolveFrame(input) {
   const found = findMomentSegment(input.command, input.on);
-  const hookDirUsable = !!input.hookCwd && (0, import_node_fs37.existsSync)(input.hookCwd);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs38.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
   const refuse = (refusal) => ({
@@ -25845,7 +26095,7 @@ function resolveFrame(input) {
     if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs37.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs38.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
@@ -25856,7 +26106,7 @@ function resolveFrame(input) {
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
   const gitDir = gitDirRaw ? realpathOr2(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr2((0, import_node_path28.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path28.resolve)(dir, commonRaw)) : null;
+  const commonDir = commonRaw ? realpathOr2((0, import_node_path29.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path29.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
@@ -26031,8 +26281,8 @@ function stagedRange(frame, command) {
   if (plan.kind === "unpredictable") {
     return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
   }
-  const mergeHead = frame.gitDir ? (0, import_node_path29.join)(frame.gitDir, "MERGE_HEAD") : null;
-  if (mergeHead && (0, import_node_fs37.existsSync)(mergeHead)) {
+  const mergeHead = frame.gitDir ? (0, import_node_path30.join)(frame.gitDir, "MERGE_HEAD") : null;
+  if (mergeHead && (0, import_node_fs38.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
     const resolutions = new Set([...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f)));
@@ -26166,7 +26416,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -26193,7 +26443,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs38.statSync)(transcriptPath).size;
+    size = (0, import_node_fs39.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -26201,7 +26451,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs38.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs39.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -26771,7 +27021,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.53cd005" : "dev";
+    return true ? "0.33.3-experimental.5a3f573" : "dev";
   } catch {
     return "dev";
   }
@@ -26812,7 +27062,7 @@ async function sendSkipBeacon(ctx, reason) {
 
 // src/lib/static-analysis.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -26868,7 +27118,7 @@ function runCodacyAnalysis(files) {
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs39.existsSync)(f);
+      return (0, import_node_fs40.existsSync)(f);
     } catch {
       return false;
     }
@@ -27137,8 +27387,8 @@ async function scope(run4) {
 }
 
 // src/lib/specs.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path31 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -27160,7 +27410,7 @@ var UNCONSULTED_TOTAL_BYTES = 30720;
 function readSpecFiles(specsOpt, root) {
   const out2 = [];
   for (const raw of specsOpt.split(",").map((f) => f.trim()).filter(Boolean)) {
-    const candidate = (0, import_node_path30.isAbsolute)(raw) ? (0, import_node_path30.relative)(root, raw) : raw;
+    const candidate = (0, import_node_path31.isAbsolute)(raw) ? (0, import_node_path31.relative)(root, raw) : raw;
     const content = readFileInside(root, candidate, MAX_EXPLICIT_SPEC_FILE_BYTES);
     if (content === null) continue;
     out2.push({ path: raw, content });
@@ -27179,7 +27429,7 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs40.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs41.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
@@ -27202,7 +27452,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs40.existsSync)(dir)) continue;
+    if (!(0, import_node_fs41.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -27217,9 +27467,9 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path30.join)(dir, entry.name);
+      const fullPath = (0, import_node_path31.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -27232,25 +27482,25 @@ function findMdFiles(dir, maxDepth, depth = 0) {
 }
 function discoverPlans() {
   const home = process.env.HOME ?? "";
-  const homePlansDir = (0, import_node_path30.join)(home, ".claude", "plans");
+  const homePlansDir = (0, import_node_path31.join)(home, ".claude", "plans");
   const sources = [];
   if (isRealDirectoryChain(process.cwd(), [".claude", "plans"])) {
-    sources.push({ root: process.cwd(), prefix: (0, import_node_path30.join)(".claude", "plans") });
+    sources.push({ root: process.cwd(), prefix: (0, import_node_path31.join)(".claude", "plans") });
   }
-  if (home && (0, import_node_fs40.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
+  if (home && (0, import_node_fs41.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
   const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
   for (const source2 of sources) {
     let names2;
     try {
-      names2 = (0, import_node_fs40.readdirSync)(source2.prefix ? (0, import_node_path30.join)(source2.root, source2.prefix) : source2.root);
+      names2 = (0, import_node_fs41.readdirSync)(source2.prefix ? (0, import_node_path31.join)(source2.root, source2.prefix) : source2.root);
     } catch {
       continue;
     }
     for (const f of names2) {
       if (!f.endsWith(".md") || seen.has(f)) continue;
       seen.add(f);
-      const relPath = source2.prefix ? (0, import_node_path30.join)(source2.prefix, f) : f;
+      const relPath = source2.prefix ? (0, import_node_path31.join)(source2.prefix, f) : f;
       const stat3 = statRegularInRoot(source2.root, relPath);
       if (!stat3.ok) continue;
       candidates2.push({ name: f, root: source2.root, relPath, mtime: stat3.mtimeMs, size: stat3.size });
@@ -27268,9 +27518,9 @@ function discoverPlans() {
 function isRealDirectoryChain(root, parts2) {
   let current = root;
   for (const part of parts2) {
-    current = (0, import_node_path30.join)(current, part);
+    current = (0, import_node_path31.join)(current, part);
     try {
-      if (!(0, import_node_fs40.lstatSync)(current).isDirectory()) return false;
+      if (!(0, import_node_fs41.lstatSync)(current).isDirectory()) return false;
     } catch {
       return false;
     }
@@ -27285,7 +27535,7 @@ function discoverGuardDocs(rangeFiles2) {
     if (result.length >= MAX_SPEC_FILES) break;
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
-    if (!(0, import_node_fs40.existsSync)(path)) continue;
+    if (!(0, import_node_fs41.existsSync)(path)) continue;
     const opened = openRegularInRoot(process.cwd(), path);
     if (!opened.ok) continue;
     if (opened.size > MAX_PLAN_FILE_BYTES || totalBytes + opened.size > MAX_TOTAL_SPEC_BYTES) {
@@ -27471,8 +27721,8 @@ async function mode(run4) {
 }
 
 // src/lib/fold.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path32 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -27609,7 +27859,7 @@ function candidateRoots(repoRoot2) {
   const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out2 = [norm];
   try {
-    const real = import_node_fs41.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs42.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm) out2.push(real);
   } catch {
   }
@@ -27697,31 +27947,31 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs41.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs41.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs42.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs42.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path31.join)(
-      (0, import_node_path31.dirname)(transcriptPath),
-      (0, import_node_path31.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path32.join)(
+      (0, import_node_path32.dirname)(transcriptPath),
+      (0, import_node_path32.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs41.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs42.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
       const walk2 = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs41.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path31.join)(d, e.name);
+        for (const e of (0, import_node_fs42.readdirSync)(d, { withFileTypes: true })) {
+          const p = (0, import_node_path32.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs41.statSync)(p);
+              const st = (0, import_node_fs42.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -27738,7 +27988,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs41.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs42.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -27773,7 +28023,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs41.statSync)(path);
+    const st = (0, import_node_fs42.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -28088,20 +28338,20 @@ async function evidence(run4) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs42 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path33 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs42.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs43.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path32.join)(dir, entry);
+      const path = (0, import_node_path33.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs42.statSync)(path);
+        const stat3 = (0, import_node_fs43.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs42.unlinkSync)(path);
+          (0, import_node_fs43.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -28115,7 +28365,7 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_node_os7 = require("node:os");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
@@ -28173,7 +28423,7 @@ function gatherContextFiles(contextPaths, deltaFiles, opts) {
       continue;
     }
     try {
-      const content = (0, import_node_fs43.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs44.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -28331,8 +28581,8 @@ function languageOf2(path) {
 }
 
 // src/lib/code/runtime.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path34 = require("node:path");
 var import_web_tree_sitter2 = __toESM2(require_web_tree_sitter2());
 
 // src/lib/code/grammars.json
@@ -28392,18 +28642,18 @@ var grammars_default = {
 var MAX_PARSE_BYTES = 512 * 1024;
 function grammarCandidates(file, pkg, env = process.env) {
   return [
-    ...env.VERITY_GRAMMAR_DIR ? [(0, import_node_path33.join)(env.VERITY_GRAMMAR_DIR, file)] : [],
-    (0, import_node_path33.join)(__dirname, "..", "data", "grammars", file),
+    ...env.VERITY_GRAMMAR_DIR ? [(0, import_node_path34.join)(env.VERITY_GRAMMAR_DIR, file)] : [],
+    (0, import_node_path34.join)(__dirname, "..", "data", "grammars", file),
     // bundled: cli/bin/ → cli/data/grammars/
-    (0, import_node_path33.join)(__dirname, "..", "..", "..", "data", "grammars", file),
+    (0, import_node_path34.join)(__dirname, "..", "..", "..", "data", "grammars", file),
     // tsx: cli/src/lib/code/ → cli/data/grammars/
-    (0, import_node_path33.join)(__dirname, "..", "..", "..", "node_modules", pkg, file)
+    (0, import_node_path34.join)(__dirname, "..", "..", "..", "node_modules", pkg, file)
     // tsx, before a build: the pinned devDependency
   ];
 }
 function locateGrammar(id, env = process.env) {
   const g = grammars_default[id];
-  return grammarCandidates(g.file, g.package, env).find((p) => (0, import_node_fs44.existsSync)(p)) ?? null;
+  return grammarCandidates(g.file, g.package, env).find((p) => (0, import_node_fs45.existsSync)(p)) ?? null;
 }
 var loading = null;
 function loadRuntime(env = process.env) {
@@ -29530,7 +29780,7 @@ var MAX_CALLERS = 30;
 var MAX_READ_BYTES4 = 512 * 1024;
 var IDENT = /^[A-Za-z_$][\w$]*$/;
 var TEST_OR_TOOLING = /(^|\/)(tests?|__tests__|spec|specs|fixtures?|e2e|testdata|experiments|scripts)\/|\.(test|spec)\.[cm]?[jt]sx?$|_test\.(py|go)$|(^|\/)test_[^/]+\.py$/;
-var dirname16 = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "";
+var dirname17 = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "";
 function joinPath(dir, rel) {
   const out2 = dir ? dir.split("/") : [];
   for (const part of rel.split("/")) {
@@ -29655,7 +29905,7 @@ function parseJsonc(text) {
   return JSON.parse(out2.replace(/,(\s*[}\]])/g, "$1"));
 }
 function tsconfigFor(source2, fromPath, cache) {
-  for (let dir = dirname16(fromPath); ; dir = dirname16(dir)) {
+  for (let dir = dirname17(fromPath); ; dir = dirname17(dir)) {
     const file = dir ? `${dir}/tsconfig.json` : "tsconfig.json";
     if (!cache.has(file)) {
       const read2 = source2.read(file, 256 * 1024);
@@ -29679,7 +29929,7 @@ function tsconfigFor(source2, fromPath, cache) {
 function tsCandidates(spec, fromPath, cfg) {
   const bases = [];
   if (spec.startsWith(".")) {
-    const b = joinPath(dirname16(fromPath), spec);
+    const b = joinPath(dirname17(fromPath), spec);
     if (b !== null) bases.push(b);
   } else if (cfg) {
     const root = cfg.baseUrl !== null ? joinPath(cfg.dir, cfg.baseUrl) : cfg.dir;
@@ -29711,8 +29961,8 @@ function pyCandidates(spec, fromPath) {
   const mod = spec.slice(dots).replace(/\./g, "/");
   const out2 = [];
   if (dots > 0) {
-    let dir = dirname16(fromPath);
-    for (let i2 = 1; i2 < dots; i2++) dir = dirname16(dir);
+    let dir = dirname17(fromPath);
+    for (let i2 = 1; i2 < dots; i2++) dir = dirname17(dir);
     const b = mod ? joinPath(dir, mod) : dir;
     if (b !== null) out2.push(`${b}.py`, `${b}/__init__.py`);
   } else {
@@ -29739,7 +29989,7 @@ function moduleFiles(source2, spec, fromPath, lang, cache = /* @__PURE__ */ new
     const module2 = mod.ok ? /^\s*module\s+(\S+)/m.exec(mod.content)?.[1] : void 0;
     if (!module2 || !(spec === module2 || spec.startsWith(`${module2}/`))) return [];
     const dir = spec.slice(module2.length + 1);
-    return source2.list(dir || void 0).filter((p) => dirname16(p) === dir && p.endsWith(".go") && !p.endsWith("_test.go"));
+    return source2.list(dir || void 0).filter((p) => dirname17(p) === dir && p.endsWith(".go") && !p.endsWith("_test.go"));
   }
   if (lang === "java") {
     const suffix = `${spec.replace(/\./g, "/")}.java`;
@@ -29790,7 +30040,7 @@ function definitionOf(input) {
     if (type?.startsWith(RESULT_OF)) {
       const [fnName, idx] = type.slice(RESULT_OF.length).split("#");
       type = null;
-      const others = lang === "go" ? source2.list(dirname16(path) || void 0).filter((p) => dirname16(p) === dirname16(path) && p.endsWith(".go") && p !== path) : (() => {
+      const others = lang === "go" ? source2.list(dirname17(path) || void 0).filter((p) => dirname17(p) === dirname17(path) && p.endsWith(".go") && p !== path) : (() => {
         const imp = importOf(content, lang, fnName, null);
         return imp ? moduleFiles(source2, imp.spec, path, lang, tsCache) : [];
       })();
@@ -29837,7 +30087,7 @@ function definitionOf(input) {
     }
   }
   if (out2.length === 0 && lang === "go" && !receiver) {
-    for (const f of source2.list(dirname16(path) || void 0).filter((p) => dirname16(p) === dirname16(path) && p.endsWith(".go") && p !== path)) {
+    for (const f of source2.list(dirname17(path) || void 0).filter((p) => dirname17(p) === dirname17(path) && p.endsWith(".go") && p !== path)) {
       add(functionsNamed(outlineOf2(f), name2), "package");
       if (Date.now() > input.deadlineAt) break;
     }
@@ -30732,8 +30982,8 @@ async function repoContext(run4) {
 
 // src/lib/seed-runner.ts
 var import_promises15 = require("node:fs/promises");
-var import_node_fs45 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_path35 = require("node:path");
 var import_yaml4 = __toESM2(require_dist());
 
 // src/lib/seed.ts
@@ -30956,8 +31206,8 @@ function normalizeTitle(title) {
 async function localSeedTitles(memoryDir3 = MEMORY_DIR) {
   const titles = /* @__PURE__ */ new Set();
   for (const dir of NODE_DIRS) {
-    const full = (0, import_node_path34.join)(memoryDir3, dir);
-    if (!(0, import_node_fs45.existsSync)(full)) continue;
+    const full = (0, import_node_path35.join)(memoryDir3, dir);
+    if (!(0, import_node_fs46.existsSync)(full)) continue;
     let files;
     try {
       files = await (0, import_promises15.readdir)(full);
@@ -30968,7 +31218,7 @@ async function localSeedTitles(memoryDir3 = MEMORY_DIR) {
       if (!file.endsWith(".md")) continue;
       let content;
       try {
-        content = await (0, import_promises15.readFile)((0, import_node_path34.join)(full, file), "utf-8");
+        content = await (0, import_promises15.readFile)((0, import_node_path35.join)(full, file), "utf-8");
       } catch {
         continue;
       }
@@ -31039,7 +31289,7 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs45.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs46.existsSync)(STANDARD_FILE)) {
     return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
@@ -31051,7 +31301,7 @@ async function runSeed(opts) {
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs45.existsSync)("README.md")) {
+  if ((0, import_node_fs46.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises15.readFile)("README.md", "utf-8");
     } catch {
@@ -31059,7 +31309,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs45.existsSync)(p)) {
+    if ((0, import_node_fs46.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises15.readFile)(p, "utf-8");
         break;
@@ -31139,13 +31389,13 @@ async function runSeed(opts) {
       continue;
     }
     const deduplicated = res.data.deduplicated === true;
-    if (deduplicated && (0, import_node_fs45.existsSync)(targetPath)) {
+    if (deduplicated && (0, import_node_fs46.existsSync)(targetPath)) {
       existing++;
       continue;
     }
     const content = typeof res.data.content === "string" && res.data.content.length > 0 ? res.data.content : renderNodeMarkdown(c, nodeId, createdAt);
     try {
-      await (0, import_promises15.mkdir)((0, import_node_path34.dirname)(targetPath), { recursive: true });
+      await (0, import_promises15.mkdir)((0, import_node_path35.dirname)(targetPath), { recursive: true });
       await (0, import_promises15.writeFile)(targetPath, content);
       if (deduplicated) existing++;
       else {
@@ -31161,8 +31411,8 @@ async function runSeed(opts) {
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs46 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_path36 = require("node:path");
 async function memoryManifest(run4) {
   const { globals } = run4;
   const { serviceUrl, token } = run4;
@@ -31172,9 +31422,9 @@ async function memoryManifest(run4) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path35.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs46.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs46.existsSync)(seedMarker);
+    const seedMarker = (0, import_node_path36.join)(VERITY_DIR, ".seeded");
+    const hasStandard = (0, import_node_fs47.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs47.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -31187,7 +31437,7 @@ async function memoryManifest(run4) {
             dryRun: false
           });
           if (seedResult.created > 0 || seedResult.existing > 0) {
-            (0, import_node_fs46.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created} existing=${seedResult.existing}
+            (0, import_node_fs47.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created} existing=${seedResult.existing}
 `);
             if (seedResult.created > 0) {
               autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
@@ -31198,7 +31448,7 @@ async function memoryManifest(run4) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs46.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs47.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -31293,7 +31543,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path36 = require("node:path");
+var import_node_path37 = require("node:path");
 async function workingMemory(run4) {
   const { opts } = run4;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run4;
@@ -31305,7 +31555,7 @@ async function workingMemory(run4) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path36.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path37.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -31387,7 +31637,7 @@ async function workingMemory(run4) {
 }
 
 // src/lib/note-budget.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -31409,9 +31659,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs47.existsSync)(file)) return null;
+  if (!(0, import_node_fs48.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs47.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs48.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -31425,8 +31675,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs47.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs47.writeFileSync)(
+    (0, import_node_fs48.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs48.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -31758,14 +32008,14 @@ async function buildRequest(run4) {
 }
 
 // src/lib/offline.ts
-var import_node_fs48 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 var import_node_crypto13 = require("node:crypto");
 function cacheRequest(body2) {
   try {
-    (0, import_node_fs48.mkdirSync)(CACHE_DIR, { recursive: true });
+    (0, import_node_fs49.mkdirSync)(CACHE_DIR, { recursive: true });
     const suffix = (0, import_node_crypto13.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs48.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body2)));
+    (0, import_node_fs49.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body2)));
   } catch {
   }
 }
@@ -31884,8 +32134,8 @@ async function transmit(run4) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs49 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs50 = require("node:fs");
+var import_node_path38 = require("node:path");
 async function reconcile(run4) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory: memory2, memorySession, response, reviewable, securityFiles, turnId } = run4;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -31914,7 +32164,7 @@ async function reconcile(run4) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line2) => {
         try {
-          const src = (0, import_node_fs49.readFileSync)((0, import_node_path37.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs50.readFileSync)((0, import_node_path38.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line2 - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -32736,7 +32986,7 @@ function registerAnalyzeCommand(program2) {
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
   if (!verityConfigured()) {
-    (0, import_node_fs50.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    (0, import_node_fs51.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
     process.exit(0);
   }
   const run4 = createRun(opts, globals);
@@ -32757,11 +33007,11 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 
 // src/lib/project-skills.ts
-var import_node_fs51 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs52 = require("node:fs");
+var import_node_path39 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -32787,14 +33037,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs51.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs51.existsSync)((0, import_node_path38.join)(root, name2)));
+  if (!(0, import_node_fs52.existsSync)(root)) return [];
+  return ALL.filter((name2) => (0, import_node_fs52.existsSync)((0, import_node_path39.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs51.rmSync)((0, import_node_path38.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs52.rmSync)((0, import_node_path39.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -32859,13 +33109,13 @@ function registerBaselineCommands(program2) {
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs52.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs53.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs52.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs53.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
@@ -32884,7 +33134,7 @@ function registerBaselineCommands(program2) {
         if (needsSetup) {
           userMsg = stale.length > 0 ? `Verity: the plugin is installed \u2014 run /verity:init to finish setting it up here (it will also clear ${stale.length} duplicate skills).` : "Verity: the plugin is installed \u2014 run /verity:init to finish setting it up here.";
           notices.push(
-            "The Verity plugin is installed here but /verity:init has not been run for this project. Installing the plugin cannot repair a project on its own \u2014 Claude Code has no post-install hook \u2014 so tell the user to run /verity:init (they type it; it is not a skill you can invoke). It asks how they want reviews to run, then does the repair."
+            "The Verity plugin is installed here but /verity:init has not been run for this project. Installing the plugin cannot repair a project on its own \u2014 Claude Code has no post-install hook \u2014 so tell the user to run /verity:init (they type it; it is not a skill you can invoke). It asks how they want reviews to run, about telemetry and whether to sign in \u2014 all in the session \u2014 then does the repair and the sign-in."
           );
           if (stale.length > 0) {
             notices.push(
@@ -32966,7 +33216,7 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs53 = require("node:fs");
+var import_node_fs54 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -32983,7 +33233,7 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs53.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs54.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -33049,8 +33299,8 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs57 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs58 = require("node:fs");
+var import_node_path44 = require("node:path");
 
 // src/lib/terminal-text.ts
 var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
@@ -33158,7 +33408,7 @@ async function runAgentReview(options) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 var import_node_crypto18 = require("node:crypto");
 
 // src/lib/prove/signals.ts
@@ -34824,18 +35074,18 @@ function renderReplay(model, property, r) {
 // src/lib/prove/runner.ts
 var import_node_child_process15 = require("node:child_process");
 var import_node_os8 = require("node:os");
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path41 = require("node:path");
+var import_node_path42 = require("node:path");
 
 // src/lib/prove/scaffold.ts
-var import_node_fs55 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs56 = require("node:fs");
+var import_node_path41 = require("node:path");
 
 // src/lib/prove/safe-write.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 var import_node_crypto14 = require("node:crypto");
-var import_node_path39 = require("node:path");
+var import_node_path40 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
     super(`refusing to write ${path}: ${reason}`);
@@ -34844,10 +35094,10 @@ var SafeWriteError = class extends Error {
     this.name = "SafeWriteError";
   }
 };
-var FLAGS3 = import_node_fs54.constants;
+var FLAGS3 = import_node_fs55.constants;
 var NOFOLLOW2 = FLAGS3.O_NOFOLLOW ?? 0;
 function assertPlainRelative(rel) {
-  if (!rel || (0, import_node_path39.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
+  if (!rel || (0, import_node_path40.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
   for (const part of rel.split(/[\\/]/)) {
     if (part === ".." || part === "" || part === ".") throw new SafeWriteError("bad-path", rel);
   }
@@ -34856,34 +35106,34 @@ function ensureDirsNoFollow(root, rel) {
   const parts2 = rel.split(/[\\/]/);
   let cur = root;
   for (const part of parts2.slice(0, -1)) {
-    cur = (0, import_node_path39.join)(cur, part);
+    cur = (0, import_node_path40.join)(cur, part);
     let st;
     try {
-      st = (0, import_node_fs54.lstatSync)(cur);
+      st = (0, import_node_fs55.lstatSync)(cur);
     } catch {
-      (0, import_node_fs54.mkdirSync)(cur);
+      (0, import_node_fs55.mkdirSync)(cur);
       continue;
     }
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", cur);
     if (!st.isDirectory()) throw new SafeWriteError("not-regular", cur);
   }
-  return (0, import_node_path39.join)(root, rel);
+  return (0, import_node_path40.join)(root, rel);
 }
 function insideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path39.sep) ? realRoot : realRoot + import_node_path39.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path40.sep) ? realRoot : realRoot + import_node_path40.sep);
 }
 function removeQuietly(path) {
   try {
-    (0, import_node_fs54.unlinkSync)(path);
+    (0, import_node_fs55.unlinkSync)(path);
   } catch {
   }
 }
 function writeFileInRootNoFollow(root, rel, content) {
   assertPlainRelative(rel);
   const dest = ensureDirsNoFollow(root, rel);
-  const dir = (0, import_node_path39.dirname)(dest);
+  const dir = (0, import_node_path40.dirname)(dest);
   try {
-    const st = (0, import_node_fs54.lstatSync)(dest);
+    const st = (0, import_node_fs55.lstatSync)(dest);
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", dest);
     if (!st.isFile()) throw new SafeWriteError("not-regular", dest);
   } catch (err2) {
@@ -34891,41 +35141,41 @@ function writeFileInRootNoFollow(root, rel, content) {
   }
   let realRoot;
   try {
-    realRoot = (0, import_node_fs54.realpathSync)(root);
+    realRoot = (0, import_node_fs55.realpathSync)(root);
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path39.join)(dir, `.${(0, import_node_path39.basename)(dest)}.${(0, import_node_crypto14.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path40.join)(dir, `.${(0, import_node_path40.basename)(dest)}.${(0, import_node_crypto14.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
-    fd = (0, import_node_fs54.openSync)(tmp, import_node_fs54.constants.O_WRONLY | import_node_fs54.constants.O_CREAT | import_node_fs54.constants.O_EXCL | NOFOLLOW2, 420);
+    fd = (0, import_node_fs55.openSync)(tmp, import_node_fs55.constants.O_WRONLY | import_node_fs55.constants.O_CREAT | import_node_fs55.constants.O_EXCL | NOFOLLOW2, 420);
   } catch {
     throw new SafeWriteError("unwritable", tmp);
   }
   try {
-    const opened = (0, import_node_fs54.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs55.fstatSync)(fd, { bigint: true });
     let realTmp;
     try {
-      realTmp = (0, import_node_fs54.realpathSync)(tmp);
+      realTmp = (0, import_node_fs55.realpathSync)(tmp);
     } catch {
       throw new SafeWriteError("escaped", tmp);
     }
-    const there = (0, import_node_fs54.lstatSync)(realTmp, { bigint: true });
+    const there = (0, import_node_fs55.lstatSync)(realTmp, { bigint: true });
     if (!opened.isFile() || there.ino !== opened.ino || there.dev !== opened.dev || !insideRoot(realRoot, realTmp)) {
       throw new SafeWriteError("escaped", tmp);
     }
     const buf = Buffer.from(content, "utf-8");
     let off = 0;
-    while (off < buf.length) off += (0, import_node_fs54.writeSync)(fd, buf, off, buf.length - off);
+    while (off < buf.length) off += (0, import_node_fs55.writeSync)(fd, buf, off, buf.length - off);
   } catch (err2) {
-    (0, import_node_fs54.closeSync)(fd);
+    (0, import_node_fs55.closeSync)(fd);
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", tmp);
   }
-  (0, import_node_fs54.closeSync)(fd);
+  (0, import_node_fs55.closeSync)(fd);
   try {
-    if (!insideRoot(realRoot, (0, import_node_fs54.realpathSync)(dir)) || (0, import_node_fs54.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
-    (0, import_node_fs54.renameSync)(tmp, dest);
+    if (!insideRoot(realRoot, (0, import_node_fs55.realpathSync)(dir)) || (0, import_node_fs55.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
+    (0, import_node_fs55.renameSync)(tmp, dest);
   } catch (err2) {
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", dest);
@@ -34939,9 +35189,9 @@ function pathHasNoLink(root, rel) {
   }
   let cur = root;
   for (const part of rel.split(/[\\/]/)) {
-    cur = cur + import_node_path39.sep + part;
+    cur = cur + import_node_path40.sep + part;
     try {
-      if ((0, import_node_fs54.lstatSync)(cur).isSymbolicLink()) return false;
+      if ((0, import_node_fs55.lstatSync)(cur).isSymbolicLink()) return false;
     } catch {
       return true;
     }
@@ -35251,20 +35501,20 @@ This directory is machine-local and gitignored (see ../.gitignore). Models are
 never committed; what reaches the team is the bug report and the fix.
 `;
 function scaffoldProofs(root) {
-  const proofsDir = (0, import_node_path40.join)(root, PROOFS_DIR);
+  const proofsDir = (0, import_node_path41.join)(root, PROOFS_DIR);
   const written = [];
   const kept = [];
   for (const stray of ["lakefile.lean"]) {
     const rel = `${PROOFS_DIR}/${stray}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path40.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path41.join)(root, rel));
     try {
-      (0, import_node_fs55.rmSync)((0, import_node_path40.join)(root, rel), { force: true });
+      (0, import_node_fs56.rmSync)((0, import_node_path41.join)(root, rel), { force: true });
     } catch {
     }
   }
   for (const f of PROOFS_TEMPLATE_FILES) {
     const rel = `${PROOFS_DIR}/${f.path}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path40.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path41.join)(root, rel));
     const current = readRegularFileInRoot(root, rel, 4 * 1024 * 1024);
     if (current.ok && current.content === f.content) {
       kept.push(rel);
@@ -35277,8 +35527,8 @@ function scaffoldProofs(root) {
     [`${PROOFS_DIR}/.gitignore`, LOCAL_GITIGNORE],
     [`${MODELS_DIR}/README.md`, MODELS_README]
   ]) {
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path40.join)(root, rel));
-    if (existsNoFollow((0, import_node_path40.join)(root, rel))) {
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path41.join)(root, rel));
+    if (existsNoFollow((0, import_node_path41.join)(root, rel))) {
       kept.push(rel);
       continue;
     }
@@ -35289,7 +35539,7 @@ function scaffoldProofs(root) {
 }
 function existsNoFollow(abs) {
   try {
-    (0, import_node_fs55.lstatSync)(abs);
+    (0, import_node_fs56.lstatSync)(abs);
     return true;
   } catch {
     return false;
@@ -35547,16 +35797,16 @@ function renderReport(r) {
 
 // src/lib/prove/runner.ts
 function verityLeanHome(env = process.env) {
-  return env.VERITY_LEAN_HOME ?? (0, import_node_path41.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
+  return env.VERITY_LEAN_HOME ?? (0, import_node_path42.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
 }
 function findToolchain(env = process.env) {
-  const managedBin = (0, import_node_path41.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
-  const elanBin = (0, import_node_path41.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const path = [managedBin, elanBin, env.PATH ?? ""].filter(Boolean).join(import_node_path41.delimiter);
+  const managedBin = (0, import_node_path42.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
+  const elanBin = (0, import_node_path42.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
+  const path = [managedBin, elanBin, env.PATH ?? ""].filter(Boolean).join(import_node_path42.delimiter);
   const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
-  const elanHas = (0, import_node_fs56.existsSync)((0, import_node_path41.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const elanHas = (0, import_node_fs57.existsSync)((0, import_node_path42.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
-  const candidates2 = [(0, import_node_path41.join)(managedBin, exe), ...elanHas ? [(0, import_node_path41.join)(elanBin, exe)] : [], exe];
+  const candidates2 = [(0, import_node_path42.join)(managedBin, exe), ...elanHas ? [(0, import_node_path42.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
       (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
@@ -35632,41 +35882,41 @@ function runAsync(tc, cwd, args2, timeoutMs) {
 var DEFAULT_BUILD_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_CHECK_TIMEOUT_MS = 12e4;
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
-  return run2(tc, (0, import_node_path41.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return run2(tc, (0, import_node_path42.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
-  return runAsync(tc, (0, import_node_path41.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return runAsync(tc, (0, import_node_path42.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
-  if (!rel.endsWith(".lean") || (0, import_node_path41.isAbsolute)(rel) || rel.startsWith("..")) return false;
+  if (!rel.endsWith(".lean") || (0, import_node_path42.isAbsolute)(rel) || rel.startsWith("..")) return false;
   return statRegularInRoot(modelsAbs, rel).ok;
 }
 function resolveModelFile(root, arg) {
-  const modelsAbs = (0, import_node_path41.join)(root, MODELS_DIR);
-  const asPath = (0, import_node_path41.relative)(modelsAbs, (0, import_node_path41.isAbsolute)(arg) ? arg : (0, import_node_path41.resolve)(root, arg));
+  const modelsAbs = (0, import_node_path42.join)(root, MODELS_DIR);
+  const asPath = (0, import_node_path42.relative)(modelsAbs, (0, import_node_path42.isAbsolute)(arg) ? arg : (0, import_node_path42.resolve)(root, arg));
   const candidates2 = arg.includes("/") || arg.includes("\\") ? [asPath] : [arg, `${arg}.lean`];
   for (const rel of candidates2) {
-    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path41.join)(modelsAbs, rel);
+    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path42.join)(modelsAbs, rel);
   }
   return null;
 }
 function listModelFiles(root) {
-  const modelsAbs = (0, import_node_path41.join)(root, MODELS_DIR);
-  if (!(0, import_node_fs56.existsSync)(modelsAbs)) return [];
-  return (0, import_node_fs56.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path41.join)(modelsAbs, f));
+  const modelsAbs = (0, import_node_path42.join)(root, MODELS_DIR);
+  if (!(0, import_node_fs57.existsSync)(modelsAbs)) return [];
+  return (0, import_node_fs57.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path42.join)(modelsAbs, f));
 }
 function trimDiagnostics(text) {
   return text.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
 function checkModel(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path41.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path41.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path42.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path42.relative)(proofsAbs, modelFile);
   const res = run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path41.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path41.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path42.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path42.relative)(proofsAbs, modelFile);
   const res = await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
@@ -35674,10 +35924,10 @@ function toReport(res, root, modelFile, timeoutMs) {
   const parsed = parseVerityLines(res.stdout);
   const combined = `${res.stdout}
 ${res.stderr}`;
-  const name2 = parsed.header?.model ?? (0, import_node_path41.basename)(modelFile, ".lean");
+  const name2 = parsed.header?.model ?? (0, import_node_path42.basename)(modelFile, ".lean");
   const report = {
     model: name2,
-    file: (0, import_node_path41.relative)(root, modelFile),
+    file: (0, import_node_path42.relative)(root, modelFile),
     ok: res.ok,
     header: parsed.header,
     properties: parsed.properties,
@@ -36207,7 +36457,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path42.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path43.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -36307,7 +36557,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path42.relative)(root, (0, import_node_path42.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path43.relative)(root, (0, import_node_path43.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -36370,7 +36620,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path42.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path43.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -36480,7 +36730,7 @@ var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path43.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path44.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve8) => {
@@ -36525,7 +36775,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs57.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs58.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -36545,10 +36795,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs57.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs58.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs57.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs58.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -36558,10 +36808,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs57.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs57.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs58.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs58.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs57.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs57.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs58.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs58.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -36631,7 +36881,7 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs57.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs58.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
@@ -37239,7 +37489,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto19 = require("node:crypto");
-var import_node_fs58 = require("node:fs");
+var import_node_fs59 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -37268,7 +37518,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto19.createHash)("sha256").update((0, import_node_fs58.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto19.createHash)("sha256").update((0, import_node_fs59.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -37293,10 +37543,10 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs63 = require("node:fs");
+var import_node_fs64 = require("node:fs");
 var import_promises20 = require("node:fs/promises");
 var import_yaml6 = __toESM2(require_dist());
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 var import_node_child_process19 = require("node:child_process");
 
 // src/lib/banner.ts
@@ -37375,7 +37625,7 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs59 = require("node:fs");
+var import_node_fs60 = require("node:fs");
 
 // src/lib/prereqs.ts
 var import_node_child_process16 = require("node:child_process");
@@ -37583,11 +37833,11 @@ async function buildReport() {
   const hooks = wiring.status;
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
-  const hasConfig = (0, import_node_fs59.existsSync)(projectPath(CODACY_CONFIG_FILE));
+  const hasConfig = (0, import_node_fs60.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs59.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs60.existsSync)(projectPath(STANDARD_FILE)),
     analysisConfig: hasConfig,
-    verityMd: (0, import_node_fs59.existsSync)(projectPath(VERITY_MD_FILE)),
+    verityMd: (0, import_node_fs60.existsSync)(projectPath(VERITY_MD_FILE)),
     analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
@@ -37634,8 +37884,18 @@ async function buildReport() {
   if (state?.telemetry === "deferred") {
     next.push('Telemetry was requested but needs a token \u2014 run "verity login", then "verity telemetry install".');
   }
-  const memory2 = { posture: memoryPosture(), trackedFiles: committedMemoryFiles().length };
-  if (memory2.trackedFiles > 0 && !memoryOptOut()) {
+  const memory2 = {
+    posture: memoryPosture(),
+    trackedFiles: committedMemoryFiles().length,
+    optedOut: memoryOptOut()
+  };
+  const trackedState = { files: committedVerityState().length };
+  if (trackedState.files > 0) {
+    next.push(
+      `${trackedState.files} machine-local Verity state file(s) under .verity/ are tracked in git (they can include copies of flagged secrets). Run "verity init --untrack-state" to untrack them (the files stay on disk).`
+    );
+  }
+  if (memory2.trackedFiles > 0 && !memory2.optedOut) {
     next.push(
       `${memory2.trackedFiles} knowledge-graph file(s) under .verity/memory/ are tracked in git, so Verity's generated notes appear in every diff and pull request. Run "verity memory untrack" to stop that (the files stay on disk), or "verity memory track" if this project commits them on purpose.`
     );
@@ -37674,6 +37934,7 @@ async function buildReport() {
     telemetry: { enabled: telemetry.enabled, endpoint: telemetry.endpoint },
     artifacts,
     memory: memory2,
+    trackedState,
     next
   };
 }
@@ -37733,8 +37994,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs60 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_fs61 = require("node:fs");
+var import_node_path45 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -37771,12 +38032,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path44.join)(root, ".gate");
-  const verityDir = (0, import_node_path44.join)(root, ".verity");
-  if ((0, import_node_fs60.existsSync)(gateDir) && !(0, import_node_fs60.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path45.join)(root, ".gate");
+  const verityDir = (0, import_node_path45.join)(root, ".verity");
+  if ((0, import_node_fs61.existsSync)(gateDir) && !(0, import_node_fs61.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs60.existsSync)(gateDir) && (0, import_node_fs60.existsSync)(verityDir)) {
+  if ((0, import_node_fs61.existsSync)(gateDir) && (0, import_node_fs61.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -37797,13 +38058,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs60.existsSync)(gateDir)) {
+    if ((0, import_node_fs61.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs60.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs61.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -37819,18 +38080,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs60.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs61.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path44.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path44.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs60.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs60.existsSync)(verityCreds)) {
-    (0, import_node_fs60.mkdirSync)((0, import_node_path44.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path45.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path45.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs61.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs61.existsSync)(verityCreds)) {
+    (0, import_node_fs61.mkdirSync)((0, import_node_path45.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -37852,8 +38113,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path44.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs60.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path45.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs61.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -37863,9 +38124,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path44.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path44.join)(root, "VERITY.md");
-  if (!(0, import_node_fs60.existsSync)(gateMd) || (0, import_node_fs60.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path45.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path45.join)(root, "VERITY.md");
+  if (!(0, import_node_fs61.existsSync)(gateMd) || (0, import_node_fs61.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -37877,12 +38138,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs60.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs61.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path44.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs60.existsSync)(file)) return;
+  const file = (0, import_node_path45.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs61.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -37930,14 +38191,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep5 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs60.writeFileSync)(verityCreds, verityContent + sep5 + toAppend.join("\n") + "\n");
+    (0, import_node_fs61.writeFileSync)(verityCreds, verityContent + sep5 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs60.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs61.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs60.readFileSync)(path, "utf-8");
+    return (0, import_node_fs61.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -37952,35 +38213,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs60.renameSync)(from, to);
+    (0, import_node_fs61.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs60.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs60.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs61.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs61.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs60.renameSync)(from, to);
+    (0, import_node_fs61.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs60.cpSync)(from, to);
-    (0, import_node_fs60.rmSync)(from, { force: true });
+    (0, import_node_fs61.cpSync)(from, to);
+    (0, import_node_fs61.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path44.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs60.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path44.join)(relDir, entry) : entry;
-      const src = (0, import_node_path44.join)(gateDir, rel);
-      const dest = (0, import_node_path44.join)(verityDir, rel);
-      if ((0, import_node_fs60.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path45.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs61.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path45.join)(relDir, entry) : entry;
+      const src = (0, import_node_path45.join)(gateDir, rel);
+      const dest = (0, import_node_path45.join)(verityDir, rel);
+      if ((0, import_node_fs61.statSync)(src).isDirectory()) {
         walk2(rel);
-      } else if (!(0, import_node_fs60.existsSync)(dest)) {
-        (0, import_node_fs60.mkdirSync)((0, import_node_path44.dirname)(dest), { recursive: true });
-        (0, import_node_fs60.cpSync)(src, dest);
+      } else if (!(0, import_node_fs61.existsSync)(dest)) {
+        (0, import_node_fs61.mkdirSync)((0, import_node_path45.dirname)(dest), { recursive: true });
+        (0, import_node_fs61.cpSync)(src, dest);
         copied++;
       }
     }
@@ -37989,22 +38250,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path44.join)(root, ".gate");
-  const verityDir = (0, import_node_path44.join)(root, ".verity");
-  if ((0, import_node_fs60.existsSync)(gateDir) && !(0, import_node_fs60.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs60.existsSync)(gateDir) && (0, import_node_fs60.existsSync)(verityDir)) {
-    if ((0, import_node_fs60.existsSync)((0, import_node_path44.join)(gateDir, "credentials")) && !(0, import_node_fs60.existsSync)((0, import_node_path44.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path45.join)(root, ".gate");
+  const verityDir = (0, import_node_path45.join)(root, ".verity");
+  if ((0, import_node_fs61.existsSync)(gateDir) && !(0, import_node_fs61.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs61.existsSync)(gateDir) && (0, import_node_fs61.existsSync)(verityDir)) {
+    if ((0, import_node_fs61.existsSync)((0, import_node_path45.join)(gateDir, "credentials")) && !(0, import_node_fs61.existsSync)((0, import_node_path45.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs60.existsSync)((0, import_node_path44.join)(gateDir, "memory")) && !(0, import_node_fs60.existsSync)((0, import_node_path44.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs61.existsSync)((0, import_node_path45.join)(gateDir, "memory")) && !(0, import_node_fs61.existsSync)((0, import_node_path45.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path44.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs60.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path45.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs61.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs60.existsSync)((0, import_node_path44.join)(root, "GATE.md")) && !(0, import_node_fs60.existsSync)((0, import_node_path44.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs61.existsSync)((0, import_node_path45.join)(root, "GATE.md")) && !(0, import_node_fs61.existsSync)((0, import_node_path45.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -38285,11 +38546,11 @@ async function promptMultiSelect(question, choices, fallback) {
 }
 
 // src/lib/prove/lean-install.ts
-var import_node_fs61 = require("node:fs");
+var import_node_fs62 = require("node:fs");
 var import_node_crypto20 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
@@ -38309,7 +38570,7 @@ function expectedSha256(asset, version = pinnedVersion()) {
 function sha256File(path) {
   return new Promise((resolve8, reject) => {
     const hash = (0, import_node_crypto20.createHash)("sha256");
-    (0, import_node_fs61.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve8(hash.digest("hex"))).on("error", reject);
+    (0, import_node_fs62.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve8(hash.digest("hex"))).on("error", reject);
   });
 }
 async function verifyDownload(zip, asset, version = pinnedVersion()) {
@@ -38329,7 +38590,7 @@ function leanAssetName(version = pinnedVersion()) {
   return suffix ? `lean-${v}-${suffix}.zip` : null;
 }
 function pinnedVersionDir(env = process.env) {
-  return (0, import_node_path45.join)(verityLeanHome(env), pinnedVersion());
+  return (0, import_node_path46.join)(verityLeanHome(env), pinnedVersion());
 }
 function lakeBinary() {
   return (0, import_node_os10.platform)() === "win32" ? "lake.exe" : "lake";
@@ -38340,12 +38601,12 @@ function unzip(zip, dest) {
   for (const [cmd, args2] of attempts) {
     try {
       (0, import_node_child_process18.execFileSync)(cmd, args2, { stdio: ["ignore", "ignore", "pipe"], timeout: 15 * 6e4 });
-      if ((0, import_node_fs61.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
+      if ((0, import_node_fs62.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
       errors.push(`${cmd}: produced nothing`);
     } catch (err2) {
       errors.push(`${cmd}: ${String(err2.message).split("\n")[0].slice(0, 120)}`);
       try {
-        for (const e of (0, import_node_fs61.readdirSync)(dest)) (0, import_node_fs61.rmSync)((0, import_node_path45.join)(dest, e), { recursive: true, force: true });
+        for (const e of (0, import_node_fs62.readdirSync)(dest)) (0, import_node_fs62.rmSync)((0, import_node_path46.join)(dest, e), { recursive: true, force: true });
       } catch {
       }
     }
@@ -38362,7 +38623,7 @@ async function download(url, dest, onProgress) {
     seen += chunk.length;
     onProgress(seen, total);
   });
-  await (0, import_promises18.pipeline)(stream, (0, import_node_fs61.createWriteStream)(dest));
+  await (0, import_promises18.pipeline)(stream, (0, import_node_fs62.createWriteStream)(dest));
 }
 function inPlaceProgress(label2, write = (s) => process.stderr.write(s)) {
   let active = false;
@@ -38400,10 +38661,10 @@ async function installLean(opts = {}) {
   const dir = pinnedVersionDir(env);
   const url = `${RELEASES}/${pinnedVersion()}/${asset}`;
   const home = verityLeanHome(env);
-  const tmp = (0, import_node_path45.join)(home, ".tmp");
-  (0, import_node_fs61.rmSync)(tmp, { recursive: true, force: true });
-  (0, import_node_fs61.mkdirSync)(tmp, { recursive: true });
-  const zip = (0, import_node_path45.join)(tmp, asset);
+  const tmp = (0, import_node_path46.join)(home, ".tmp");
+  (0, import_node_fs62.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs62.mkdirSync)(tmp, { recursive: true });
+  const zip = (0, import_node_path46.join)(tmp, asset);
   say(`downloading ${url}`);
   let lastPct = -1;
   try {
@@ -38416,40 +38677,40 @@ async function installLean(opts = {}) {
       }
     });
   } catch (err2) {
-    (0, import_node_fs61.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs62.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: err2.message };
   }
   say("verifying checksum");
   const verified = await verifyDownload(zip, asset);
   if (!verified.ok) {
-    (0, import_node_fs61.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs62.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: verified.error };
   }
   say("unpacking (this takes a minute)");
-  const unpack = (0, import_node_path45.join)(tmp, "unpack");
-  (0, import_node_fs61.mkdirSync)(unpack);
+  const unpack = (0, import_node_path46.join)(tmp, "unpack");
+  (0, import_node_fs62.mkdirSync)(unpack);
   const unpacked = unzip(zip, unpack);
   if (!unpacked.ok) {
-    (0, import_node_fs61.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs62.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: `unpack failed: ${unpacked.error}` };
   }
-  const entries = (0, import_node_fs61.readdirSync)(unpack);
-  const top = entries.length === 1 && (0, import_node_fs61.statSync)((0, import_node_path45.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path45.join)(unpack, entries[0]) : unpack;
-  if (!(0, import_node_fs61.existsSync)((0, import_node_path45.join)(top, "bin", lakeBinary()))) {
-    (0, import_node_fs61.rmSync)(tmp, { recursive: true, force: true });
+  const entries = (0, import_node_fs62.readdirSync)(unpack);
+  const top = entries.length === 1 && (0, import_node_fs62.statSync)((0, import_node_path46.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path46.join)(unpack, entries[0]) : unpack;
+  if (!(0, import_node_fs62.existsSync)((0, import_node_path46.join)(top, "bin", lakeBinary()))) {
+    (0, import_node_fs62.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: "the archive did not contain bin/lake" };
   }
-  (0, import_node_fs61.rmSync)(dir, { recursive: true, force: true });
-  (0, import_node_fs61.mkdirSync)(home, { recursive: true });
-  (0, import_node_fs61.renameSync)(top, dir);
-  (0, import_node_fs61.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs62.rmSync)(dir, { recursive: true, force: true });
+  (0, import_node_fs62.mkdirSync)(home, { recursive: true });
+  (0, import_node_fs62.renameSync)(top, dir);
+  (0, import_node_fs62.rmSync)(tmp, { recursive: true, force: true });
   return { ok: true, dir };
 }
 
 // src/lib/remote-config.ts
-var import_node_fs62 = require("node:fs");
+var import_node_fs63 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 var import_yaml5 = __toESM2(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -38494,7 +38755,7 @@ async function adoptRemoteSetup(found, opts) {
   written.push(STANDARD_FILE);
   if (rider !== null) {
     const localIgnore = projectPath(VERITYIGNORE_FILE);
-    if (!(0, import_node_fs62.existsSync)(localIgnore)) {
+    if (!(0, import_node_fs63.existsSync)(localIgnore)) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
@@ -38527,7 +38788,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative6, body2) {
   const target = projectPath(relative6);
-  await (0, import_promises19.mkdir)((0, import_node_path46.dirname)(target), { recursive: true });
+  await (0, import_promises19.mkdir)((0, import_node_path47.dirname)(target), { recursive: true });
   await (0, import_promises19.writeFile)(target, body2);
 }
 function describeRemote(found) {
@@ -38644,15 +38905,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path47.join)(__dirname, "..", "data"),
+    (0, import_node_path48.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path47.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path48.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path47.join)(process.cwd(), "cli", "data")
+    (0, import_node_path48.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs63.existsSync)((0, import_node_path47.join)(candidate, "skills"))) {
+    if ((0, import_node_fs64.existsSync)((0, import_node_path48.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -38668,9 +38929,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out2 = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs63.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs64.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path47.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path48.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -38681,8 +38942,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises20.readFile)((0, import_node_path47.join)(src, rel), "utf-8");
-      const b = await (0, import_promises20.readFile)((0, import_node_path47.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises20.readFile)((0, import_node_path48.join)(src, rel), "utf-8");
+      const b = await (0, import_promises20.readFile)((0, import_node_path48.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -38730,8 +38991,14 @@ async function askSetupQuestions(defaultsOnly, previous, given = {}) {
   const momentsDefault = given.moments ?? (previous?.moments?.length ? previous.moments : await momentsFromInstalledHooks());
   const askIntensity = !given.intensity;
   const askMoments = !given.moments;
+  const givenTelemetry = async () => {
+    if (given.telemetry === void 0) return "not-asked";
+    const enabled = (await checkTelemetry()).enabled;
+    if (given.telemetry) return enabled ? "already-on" : "yes";
+    return enabled ? "turn-off" : "no";
+  };
   if (defaultsOnly || !askIntensity && !askMoments) {
-    return { intensity: intensityDefault, moments: momentsDefault, telemetry: "not-asked" };
+    return { intensity: intensityDefault, moments: momentsDefault, telemetry: await givenTelemetry() };
   }
   if (previous?.intensity || previous?.moments) {
     printInfo(`Current: ${intensityDefault} \xB7 ${momentsDefault.join(", ")} \u2014 press Enter to keep either.`);
@@ -38746,6 +39013,9 @@ async function askSetupQuestions(defaultsOnly, previous, given = {}) {
     MOMENT_CHOICES,
     momentsDefault
   );
+  if (given.telemetry !== void 0) {
+    return { intensity, moments, telemetry: await givenTelemetry() };
+  }
   const current = await checkTelemetry();
   if (current.enabled) {
     printInfo(`Cost & usage telemetry: already enabled \u2192 ${current.endpoint}`);
@@ -38760,6 +39030,12 @@ async function askSetupQuestions(defaultsOnly, previous, given = {}) {
   const wants = await promptYes("  Enable cost & usage telemetry? [Y/n] ", { nonInteractive: false });
   return { intensity, moments, telemetry: wants ? "yes" : "no" };
 }
+function parseTelemetryAnswer(raw) {
+  const v = raw.trim().toLowerCase();
+  if (v === "on") return true;
+  if (v === "off") return false;
+  return null;
+}
 function insideClaudeCode() {
   return !!process.env.CLAUDECODE || !!process.env.CLAUDE_SESSION_ID;
 }
@@ -38868,7 +39144,7 @@ async function synthesizeLocally(opts) {
 async function healStaleAnalysisConfig(globals) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   const standardPath = projectPath(STANDARD_FILE);
-  if (!(0, import_node_fs63.existsSync)(configPath) || !(0, import_node_fs63.existsSync)(standardPath)) return;
+  if (!(0, import_node_fs64.existsSync)(configPath) || !(0, import_node_fs64.existsSync)(standardPath)) return;
   const validation = validatePatternIds();
   if (validation.status !== "invalid") return;
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
@@ -38965,17 +39241,17 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path47.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path48.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path47.join)(skillsSource, skill);
-    const dest = (0, import_node_path47.join)(skillsDest, skill);
-    if (!(0, import_node_fs63.existsSync)(src)) {
+    const src = (0, import_node_path48.join)(skillsSource, skill);
+    const dest = (0, import_node_path48.join)(skillsDest, skill);
+    if (!(0, import_node_fs64.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs63.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs64.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -39037,7 +39313,7 @@ async function checkPrerequisites(step) {
   }
   return prereqs.checks.some((c) => c.id === "claude" && c.status === "ok");
 }
-async function scaffoldProject(step, defaultsOnly, pluginMode) {
+async function scaffoldProject(step, defaultsOnly, pluginMode, given = {}) {
   step("Knowledge base, .gitignore and CLAUDE.md");
   await (0, import_promises20.mkdir)(VERITY_DIR, { recursive: true });
   await ensureMemoryDir();
@@ -39062,7 +39338,7 @@ async function scaffoldProject(step, defaultsOnly, pluginMode) {
   const trackedMemory = memoryOptOut() ? [] : committedMemoryFiles();
   if (trackedMemory.length > 0) {
     printWarn(`  ${trackedMemory.length} knowledge-graph file(s) are tracked, so they show up in every diff.`);
-    const fence = defaultsOnly ? false : await promptYes("  Stop tracking them (files stay on disk)? [Y/n] ", { nonInteractive: false });
+    const fence = given.untrackMemory ? true : defaultsOnly ? false : await promptYes("  Stop tracking them (files stay on disk)? [Y/n] ", { nonInteractive: false });
     if (fence) {
       const result = fenceMemory();
       if (!result.ok) printWarn('  Could not untrack \u2014 run "verity memory untrack" when you can');
@@ -39077,7 +39353,7 @@ async function scaffoldProject(step, defaultsOnly, pluginMode) {
   const tracked = committedVerityState();
   if (tracked.length > 0) {
     printWarn(`  ${tracked.length} Verity state file(s) are tracked in git (e.g. ${tracked[0]}).`);
-    const untrack = defaultsOnly ? false : await promptYes("  Untrack them now (files stay on disk)? [Y/n] ", { nonInteractive: false });
+    const untrack = given.untrackState ? true : defaultsOnly ? false : await promptYes("  Untrack them now (files stay on disk)? [Y/n] ", { nonInteractive: false });
     if (untrack) {
       const result = untrackVerityState();
       if (result === "untracked") printInfo("  Untracked (staged) \u2014 commit to finish \u2713");
@@ -39155,7 +39431,10 @@ function registerInitCommand(program2) {
   ).option(
     "--intensity <level>",
     "Answer the analysis-intensity question without asking: lightweight | balanced | thorough"
-  ).action(async (opts) => {
+  ).option(
+    "--telemetry <on|off>",
+    "Answer the cost & usage telemetry question without asking: on | off"
+  ).option("--untrack-memory", 'Answer yes to "stop tracking the knowledge graph in git?" without asking').option("--untrack-state", 'Answer yes to "untrack committed Verity state?" without asking').action(async (opts) => {
     const force = opts.force ?? false;
     const wantsHandoff = opts.setup !== false;
     const wantsAdopt = opts.adopt !== false;
@@ -39163,7 +39442,7 @@ function registerInitCommand(program2) {
     const staleMarker = clearStalePluginMarker();
     const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs63.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs64.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -39244,16 +39523,29 @@ function registerInitCommand(program2) {
       }
       givenIntensity = match.id;
     }
+    let givenTelemetry;
+    if (opts.telemetry != null) {
+      const parsed = parseTelemetryAnswer(String(opts.telemetry));
+      if (parsed === null) {
+        printError(`--telemetry: unrecognised "${opts.telemetry}". Valid: on, off.`);
+        process.exit(1);
+      }
+      givenTelemetry = parsed;
+    }
     const answers = await askSetupQuestions(defaultsOnly, previous, {
       intensity: givenIntensity,
-      moments: givenMoments
+      moments: givenMoments,
+      telemetry: givenTelemetry
     });
     const { intensity, moments } = answers;
     if (defaultsOnly) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
-    await scaffoldProject(step, defaultsOnly, pluginMode);
-    const globalVerityDir = (0, import_node_path47.join)(process.env.HOME ?? "", ".verity");
+    await scaffoldProject(step, defaultsOnly, pluginMode, {
+      untrackMemory: opts.untrackMemory === true,
+      untrackState: opts.untrackState === true
+    });
+    const globalVerityDir = (0, import_node_path48.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -39301,8 +39593,14 @@ function registerInitCommand(program2) {
       printInfo('  not asked (unattended run) \u2014 enable later with "verity telemetry install"');
     } else if (answers.telemetry === "no") {
       printInfo('  declined \u2014 enable later with "verity telemetry install"');
-    }
-    let telemetryChoice = answers.telemetry === "already-on" ? "enabled" : answers.telemetry === "no" ? "declined" : wantsTelemetry ? "deferred" : void 0;
+    } else if (answers.telemetry === "already-on") {
+      printInfo("  already enabled \u2713");
+    } else if (answers.telemetry === "turn-off") {
+      const removed = await uninstallTelemetry();
+      if (removed.ok) printInfo('  turned off (--telemetry off) \u2014 re-enable with "verity telemetry install"');
+      else printWarn(`  Could not turn telemetry off: ${removed.error}`);
+    }
+    let telemetryChoice = answers.telemetry === "already-on" ? "enabled" : answers.telemetry === "no" || answers.telemetry === "turn-off" ? "declined" : wantsTelemetry ? "deferred" : void 0;
     if (wantsTelemetry) {
       const globals = program2.opts();
       const token = await resolveToken(globals.token);
@@ -39322,7 +39620,7 @@ function registerInitCommand(program2) {
     }
     step("Your project's Standard");
     let haveStandard = false;
-    if ((0, import_node_fs63.existsSync)(projectPath(STANDARD_FILE))) {
+    if ((0, import_node_fs64.existsSync)(projectPath(STANDARD_FILE))) {
       printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
       haveStandard = true;
     } else {
@@ -39352,7 +39650,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.53cd005" : "dev"
+          cli_version: true ? "0.33.3-experimental.5a3f573" : "dev"
         }
       });
     } catch (err2) {
@@ -39402,8 +39700,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs64 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_fs65 = require("node:fs");
+var import_node_path49 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -39412,11 +39710,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path48.join)(skillsRoot, name2);
-      if ((0, import_node_fs64.existsSync)(dir)) {
+      const dir = (0, import_node_path49.join)(skillsRoot, name2);
+      if ((0, import_node_fs65.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs64.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs65.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -39430,24 +39728,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs64.existsSync)(verityDir)) {
+    if ((0, import_node_fs65.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs64.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs65.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs64.existsSync)(verityMd)) {
+      if ((0, import_node_fs65.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs64.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs65.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs64.existsSync)(path) && (0, import_node_fs64.statSync)(path).isDirectory() && (0, import_node_fs64.readdirSync)(path).length === 0) {
-        (0, import_node_fs64.rmdirSync)(path);
+      if ((0, import_node_fs65.existsSync)(path) && (0, import_node_fs65.statSync)(path).isDirectory() && (0, import_node_fs65.readdirSync)(path).length === 0) {
+        (0, import_node_fs65.rmdirSync)(path);
       }
     };
     actions.push({
@@ -39458,11 +39756,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path48.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs64.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path49.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs65.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs64.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs65.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -39656,8 +39954,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs65 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_fs66 = require("node:fs");
+var import_node_path50 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -39694,11 +39992,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs65.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs65.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs66.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs66.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs65.unlinkSync)((0, import_node_path49.join)(cacheDir, entry));
+            (0, import_node_fs66.unlinkSync)((0, import_node_path50.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -39713,19 +40011,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs65.existsSync)(file)) {
+      if ((0, import_node_fs66.existsSync)(file)) {
         try {
-          (0, import_node_fs65.writeFileSync)(file, "");
+          (0, import_node_fs66.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs65.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs65.readdirSync)(logsDir)) {
+      if ((0, import_node_fs66.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs66.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs65.unlinkSync)((0, import_node_path49.join)(logsDir, entry));
+            (0, import_node_fs66.unlinkSync)((0, import_node_path50.join)(logsDir, entry));
           } catch {
           }
         }
@@ -39737,7 +40035,7 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs66 = require("node:fs");
+var import_node_fs67 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -39775,7 +40073,7 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs66.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs67.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
@@ -40207,6 +40505,15 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
+var import_node_fs68 = require("node:fs");
+async function recordTelemetryChoice(choice) {
+  if (!(0, import_node_fs68.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  try {
+    if ((await readSetupState())?.telemetry === choice) return;
+    await writeSetupState({ telemetry: choice });
+  } catch {
+  }
+}
 function registerTelemetryCommands(program2) {
   const telemetry = program2.command("telemetry").description("Manage Claude Code OpenTelemetry export to Verity (cost & usage)");
   telemetry.command("install").description("Enable Claude Code telemetry export to Verity (writes .claude/settings.local.json)").action(async () => {
@@ -40232,6 +40539,7 @@ function registerTelemetryCommands(program2) {
       printError(result.error);
       process.exit(1);
     }
+    await recordTelemetryChoice("enabled");
     printInfo(`Telemetry enabled \u2192 ${result.data.endpoint}`);
     printInfo(`  wrote ${SETTINGS_LOCAL_FILE2} (no token stored \u2014 resolved at runtime via otelHeadersHelper)`);
     printInfo("  takes effect on your NEXT Claude Code session; first metrics appear within ~60s of activity");
@@ -40268,6 +40576,7 @@ function registerTelemetryCommands(program2) {
       printError(result.error);
       process.exit(1);
     }
+    await recordTelemetryChoice("declined");
     printInfo(
       result.data.removed > 0 ? `Telemetry disabled (${result.data.removed} keys removed from ${SETTINGS_LOCAL_FILE2})` : "Telemetry was not enabled \u2014 nothing to remove."
     );
@@ -40275,8 +40584,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs67 = require("node:fs");
-var import_node_path50 = require("node:path");
+var import_node_fs69 = require("node:fs");
+var import_node_path51 = require("node:path");
 
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -40412,7 +40721,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path50.relative)(root, (0, import_node_path50.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path51.relative)(root, (0, import_node_path51.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -40466,7 +40775,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs67.existsSync)((0, import_node_path50.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs69.existsSync)((0, import_node_path51.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -40490,7 +40799,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path50.relative)(root, f);
+      report.file = (0, import_node_path51.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -40528,7 +40837,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs67.existsSync)((0, import_node_path50.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs69.existsSync)((0, import_node_path51.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -40559,7 +40868,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path50.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path51.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -40579,7 +40888,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path50.relative)(root, (0, import_node_path50.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path51.relative)(root, (0, import_node_path51.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -40639,7 +40948,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path50.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path51.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError('--revise needs an existing model under Models/ and --note "<what the replay showed>"');
         process.exit(2);
@@ -40678,8 +40987,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path50.relative)(root, (0, import_node_path50.isAbsolute)(file) ? file : (0, import_node_path50.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path50.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path51.relative)(root, (0, import_node_path51.isAbsolute)(file) ? file : (0, import_node_path51.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path51.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -40695,8 +41004,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path50.relative)(root, (0, import_node_path50.isAbsolute)(file) ? file : (0, import_node_path50.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path50.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path51.relative)(root, (0, import_node_path51.isAbsolute)(file) ? file : (0, import_node_path51.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path51.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -40730,10 +41039,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs68 = require("node:fs");
+var import_node_fs70 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 var import_node_os11 = require("node:os");
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -40750,7 +41059,7 @@ function registerLeanCommand(program2) {
     const managed = pinnedVersionDir();
     const matches = version ? version.includes(pin) : false;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs68.existsSync)((0, import_node_path51.join)(managed, "bin")), asset: leanAssetName() });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs70.existsSync)((0, import_node_path52.join)(managed, "bin")), asset: leanAssetName() });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -40768,7 +41077,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs68.existsSync)((0, import_node_path51.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs70.existsSync)((0, import_node_path52.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -40804,18 +41113,18 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs68.existsSync)(dir)) {
+    if (!(0, import_node_fs70.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs68.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs70.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.53cd005").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.53cd005");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.5a3f573").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.5a3f573");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();