@codacy/verity-cli 0.34.0-experimental.ec5aae9 → 0.34.1-experimental.199c728

package/bin/verity.js

@@ -27257,7 +27257,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.ec5aae9" : "dev";
+    return true ? "0.34.1-experimental.199c728" : "dev";
   } catch {
     return "dev";
   }
@@ -33434,12 +33434,41 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs55 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs56 = require("node:fs");
+var import_node_path43 = require("node:path");
 
-// src/lib/project-skills.ts
+// src/lib/skew-notice.ts
 var import_node_fs54 = require("node:fs");
 var import_node_path41 = require("node:path");
+var MARKER = ".skew-notice.json";
+function markerPath2() {
+  return (0, import_node_path41.join)(verityHome(), MARKER);
+}
+function today(now) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, "0");
+  const d = String(now.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+function skewNoticeDue(skew, now = /* @__PURE__ */ new Date()) {
+  try {
+    const seen = JSON.parse((0, import_node_fs54.readFileSync)(markerPath2(), "utf-8"));
+    return !(seen.global === skew.global && seen.hooks === skew.hooks && seen.day === today(now));
+  } catch {
+    return true;
+  }
+}
+function recordSkewNotice(skew, now = /* @__PURE__ */ new Date()) {
+  try {
+    (0, import_node_fs54.mkdirSync)(verityHome(), { recursive: true, mode: 448 });
+    (0, import_node_fs54.writeFileSync)(markerPath2(), JSON.stringify({ global: skew.global, hooks: skew.hooks, day: today(now) }) + "\n");
+  } catch {
+  }
+}
+
+// src/lib/project-skills.ts
+var import_node_fs55 = require("node:fs");
+var import_node_path42 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -33465,14 +33494,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs54.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs54.existsSync)((0, import_node_path41.join)(root, name2)));
+  if (!(0, import_node_fs55.existsSync)(root)) return [];
+  return ALL.filter((name2) => (0, import_node_fs55.existsSync)((0, import_node_path42.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs54.rmSync)((0, import_node_path41.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs55.rmSync)((0, import_node_path42.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -33502,10 +33531,12 @@ function registerBaselineCommands(program2) {
       const skew = cliVersionSkew();
       const why = skew ? `the \`verity\` on PATH is ${skew.global} but the hooks run ${skew.hooks}, so it is not the CLI they use` : verityOnPath() ? "the `verity` on PATH is a separate install whose version could not be read" : "this machine has no `verity` on PATH \u2014 the plugin carries its own copy";
       const cliLine = cli ? `Verity CLI: ${why}. When a Verity skill tells you to run \`verity <args>\`, run \`${cli} <args>\` instead. Everything else about the command is identical.` : null;
-      const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
-      const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
+      const skewLoud = !!skew && skewNoticeDue(skew);
+      const skewMsg = skew && skewLoud ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
+      const loginWarning = "Until they have, do not send them to run `verity login` in a terminal: that runs the global one, which can sign this machine in to a different server.";
+      const skewNote = !skew ? null : skewLoud ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. ${loginWarning}` : `The user's global \`verity\` is ${skew.global} and the hooks run ${skew.hooks}; \`${skew.remedy}\` fixes it. They were already told today, so do not repeat it unprompted \u2014 mention it only where it matters, such as before suggesting a \`verity\` command for their terminal. ${loginWarning}`;
       if (!verityConfigured()) {
-        if (isMachineStore((0, import_node_path42.join)(repoRoot(), VERITY_DIR))) process.exit(0);
+        if (isMachineStore((0, import_node_path43.join)(repoRoot(), VERITY_DIR))) process.exit(0);
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
@@ -33532,19 +33563,20 @@ function registerBaselineCommands(program2) {
             }
           }) + "\n"
         );
+        if (skew && skewMsg) recordSkewNotice(skew);
         process.exit(0);
       }
       const realStart = source2 === void 0 || source2 === "startup" || source2 === "clear";
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs55.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs56.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs55.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs56.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
@@ -33572,7 +33604,7 @@ function registerBaselineCommands(program2) {
           }
         }
         if (memoryAgentLine) notices.push(memoryAgentLine);
-        if (notices.length > 0) {
+        if (notices.length > 0 || skewMsg) {
           process.stdout.write(
             JSON.stringify({
               ...userMsg || skewMsg || memoryMsg ? { systemMessage: [skewMsg, userMsg, memoryMsg].filter(Boolean).join("\n") } : {},
@@ -33582,6 +33614,7 @@ function registerBaselineCommands(program2) {
               }
             }) + "\n"
           );
+          if (skew && skewMsg) recordSkewNotice(skew);
         }
       } else if (memoryMsg) {
         process.stdout.write(
@@ -33645,7 +33678,7 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars); - reads it from stdin, so the words never pass through shell quoting").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -33668,7 +33701,7 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs56.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs57.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -33734,12 +33767,12 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs61 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_fs62 = require("node:fs");
+var import_node_path49 = require("node:path");
 
 // src/lib/vendored.ts
-var import_node_fs57 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs58 = require("node:fs");
+var import_node_path44 = require("node:path");
 var INSTALLED_SKILL = /^\.claude\/skills\/(verity-[a-z0-9-]+)\/(.+)$/;
 function dataDirOrNull() {
   try {
@@ -33754,7 +33787,7 @@ function shippedSkillFile(path, dataDir = dataDirOrNull()) {
   const [, skill, rel] = m;
   if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
   try {
-    return (0, import_node_fs57.readFileSync)((0, import_node_path43.join)(dataDir, "skills", skill, rel), "utf8");
+    return (0, import_node_fs58.readFileSync)((0, import_node_path44.join)(dataDir, "skills", skill, rel), "utf8");
   } catch {
     return null;
   }
@@ -33864,7 +33897,7 @@ async function runAgentReview(options) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 var import_node_crypto19 = require("node:crypto");
 
 // src/lib/prove/signals.ts
@@ -35591,18 +35624,18 @@ function renderReplay(model, property, r) {
 // src/lib/prove/runner.ts
 var import_node_child_process15 = require("node:child_process");
 var import_node_os8 = require("node:os");
-var import_node_fs60 = require("node:fs");
+var import_node_fs61 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 
 // src/lib/prove/scaffold.ts
-var import_node_fs59 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs60 = require("node:fs");
+var import_node_path46 = require("node:path");
 
 // src/lib/prove/safe-write.ts
-var import_node_fs58 = require("node:fs");
+var import_node_fs59 = require("node:fs");
 var import_node_crypto15 = require("node:crypto");
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
     super(`refusing to write ${path}: ${reason}`);
@@ -35611,10 +35644,10 @@ var SafeWriteError = class extends Error {
     this.name = "SafeWriteError";
   }
 };
-var FLAGS3 = import_node_fs58.constants;
+var FLAGS3 = import_node_fs59.constants;
 var NOFOLLOW2 = FLAGS3.O_NOFOLLOW ?? 0;
 function assertPlainRelative(rel) {
-  if (!rel || (0, import_node_path44.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
+  if (!rel || (0, import_node_path45.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
   for (const part of rel.split(/[\\/]/)) {
     if (part === ".." || part === "" || part === ".") throw new SafeWriteError("bad-path", rel);
   }
@@ -35623,34 +35656,34 @@ function ensureDirsNoFollow(root, rel) {
   const parts2 = rel.split(/[\\/]/);
   let cur = root;
   for (const part of parts2.slice(0, -1)) {
-    cur = (0, import_node_path44.join)(cur, part);
+    cur = (0, import_node_path45.join)(cur, part);
     let st;
     try {
-      st = (0, import_node_fs58.lstatSync)(cur);
+      st = (0, import_node_fs59.lstatSync)(cur);
     } catch {
-      (0, import_node_fs58.mkdirSync)(cur);
+      (0, import_node_fs59.mkdirSync)(cur);
       continue;
     }
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", cur);
     if (!st.isDirectory()) throw new SafeWriteError("not-regular", cur);
   }
-  return (0, import_node_path44.join)(root, rel);
+  return (0, import_node_path45.join)(root, rel);
 }
 function insideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path44.sep) ? realRoot : realRoot + import_node_path44.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path45.sep) ? realRoot : realRoot + import_node_path45.sep);
 }
 function removeQuietly(path) {
   try {
-    (0, import_node_fs58.unlinkSync)(path);
+    (0, import_node_fs59.unlinkSync)(path);
   } catch {
   }
 }
 function writeFileInRootNoFollow(root, rel, content) {
   assertPlainRelative(rel);
   const dest = ensureDirsNoFollow(root, rel);
-  const dir = (0, import_node_path44.dirname)(dest);
+  const dir = (0, import_node_path45.dirname)(dest);
   try {
-    const st = (0, import_node_fs58.lstatSync)(dest);
+    const st = (0, import_node_fs59.lstatSync)(dest);
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", dest);
     if (!st.isFile()) throw new SafeWriteError("not-regular", dest);
   } catch (err2) {
@@ -35658,41 +35691,41 @@ function writeFileInRootNoFollow(root, rel, content) {
   }
   let realRoot;
   try {
-    realRoot = (0, import_node_fs58.realpathSync)(root);
+    realRoot = (0, import_node_fs59.realpathSync)(root);
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path44.join)(dir, `.${(0, import_node_path44.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path45.join)(dir, `.${(0, import_node_path45.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
-    fd = (0, import_node_fs58.openSync)(tmp, import_node_fs58.constants.O_WRONLY | import_node_fs58.constants.O_CREAT | import_node_fs58.constants.O_EXCL | NOFOLLOW2, 420);
+    fd = (0, import_node_fs59.openSync)(tmp, import_node_fs59.constants.O_WRONLY | import_node_fs59.constants.O_CREAT | import_node_fs59.constants.O_EXCL | NOFOLLOW2, 420);
   } catch {
     throw new SafeWriteError("unwritable", tmp);
   }
   try {
-    const opened = (0, import_node_fs58.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs59.fstatSync)(fd, { bigint: true });
     let realTmp;
     try {
-      realTmp = (0, import_node_fs58.realpathSync)(tmp);
+      realTmp = (0, import_node_fs59.realpathSync)(tmp);
     } catch {
       throw new SafeWriteError("escaped", tmp);
     }
-    const there = (0, import_node_fs58.lstatSync)(realTmp, { bigint: true });
+    const there = (0, import_node_fs59.lstatSync)(realTmp, { bigint: true });
     if (!opened.isFile() || there.ino !== opened.ino || there.dev !== opened.dev || !insideRoot(realRoot, realTmp)) {
       throw new SafeWriteError("escaped", tmp);
     }
     const buf = Buffer.from(content, "utf-8");
     let off = 0;
-    while (off < buf.length) off += (0, import_node_fs58.writeSync)(fd, buf, off, buf.length - off);
+    while (off < buf.length) off += (0, import_node_fs59.writeSync)(fd, buf, off, buf.length - off);
   } catch (err2) {
-    (0, import_node_fs58.closeSync)(fd);
+    (0, import_node_fs59.closeSync)(fd);
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", tmp);
   }
-  (0, import_node_fs58.closeSync)(fd);
+  (0, import_node_fs59.closeSync)(fd);
   try {
-    if (!insideRoot(realRoot, (0, import_node_fs58.realpathSync)(dir)) || (0, import_node_fs58.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
-    (0, import_node_fs58.renameSync)(tmp, dest);
+    if (!insideRoot(realRoot, (0, import_node_fs59.realpathSync)(dir)) || (0, import_node_fs59.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
+    (0, import_node_fs59.renameSync)(tmp, dest);
   } catch (err2) {
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", dest);
@@ -35706,9 +35739,9 @@ function pathHasNoLink(root, rel) {
   }
   let cur = root;
   for (const part of rel.split(/[\\/]/)) {
-    cur = cur + import_node_path44.sep + part;
+    cur = cur + import_node_path45.sep + part;
     try {
-      if ((0, import_node_fs58.lstatSync)(cur).isSymbolicLink()) return false;
+      if ((0, import_node_fs59.lstatSync)(cur).isSymbolicLink()) return false;
     } catch {
       return true;
     }
@@ -36018,20 +36051,20 @@ This directory is machine-local and gitignored (see ../.gitignore). Models are
 never committed; what reaches the team is the bug report and the fix.
 `;
 function scaffoldProofs(root) {
-  const proofsDir = (0, import_node_path45.join)(root, PROOFS_DIR);
+  const proofsDir = (0, import_node_path46.join)(root, PROOFS_DIR);
   const written = [];
   const kept = [];
   for (const stray of ["lakefile.lean"]) {
     const rel = `${PROOFS_DIR}/${stray}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
     try {
-      (0, import_node_fs59.rmSync)((0, import_node_path45.join)(root, rel), { force: true });
+      (0, import_node_fs60.rmSync)((0, import_node_path46.join)(root, rel), { force: true });
     } catch {
     }
   }
   for (const f of PROOFS_TEMPLATE_FILES) {
     const rel = `${PROOFS_DIR}/${f.path}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
     const current = readRegularFileInRoot(root, rel, 4 * 1024 * 1024);
     if (current.ok && current.content === f.content) {
       kept.push(rel);
@@ -36044,8 +36077,8 @@ function scaffoldProofs(root) {
     [`${PROOFS_DIR}/.gitignore`, LOCAL_GITIGNORE],
     [`${MODELS_DIR}/README.md`, MODELS_README]
   ]) {
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
-    if (existsNoFollow((0, import_node_path45.join)(root, rel))) {
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
+    if (existsNoFollow((0, import_node_path46.join)(root, rel))) {
       kept.push(rel);
       continue;
     }
@@ -36056,7 +36089,7 @@ function scaffoldProofs(root) {
 }
 function existsNoFollow(abs) {
   try {
-    (0, import_node_fs59.lstatSync)(abs);
+    (0, import_node_fs60.lstatSync)(abs);
     return true;
   } catch {
     return false;
@@ -36314,17 +36347,17 @@ function renderReport(r) {
 
 // src/lib/prove/runner.ts
 function verityLeanHome(env = process.env) {
-  return env.VERITY_LEAN_HOME ?? (0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
+  return env.VERITY_LEAN_HOME ?? (0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
 }
 function findToolchain(env = process.env) {
-  const managedBin = (0, import_node_path46.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
-  const elanBin = (0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const elanHas = (0, import_node_fs60.existsSync)((0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
-  const userPath = (env.PATH ?? "").split(import_node_path46.delimiter).filter((d) => d && (elanHas || (0, import_node_path46.resolve)(d) !== (0, import_node_path46.resolve)(elanBin)));
-  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path46.delimiter);
+  const managedBin = (0, import_node_path47.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
+  const elanBin = (0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
+  const elanHas = (0, import_node_fs61.existsSync)((0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path47.delimiter).filter((d) => d && (elanHas || (0, import_node_path47.resolve)(d) !== (0, import_node_path47.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path47.delimiter);
   const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
-  const candidates2 = [(0, import_node_path46.join)(managedBin, exe), ...elanHas ? [(0, import_node_path46.join)(elanBin, exe)] : [], exe];
+  const candidates2 = [(0, import_node_path47.join)(managedBin, exe), ...elanHas ? [(0, import_node_path47.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
       (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
@@ -36403,7 +36436,7 @@ function proofsWorkspaceProblem(root) {
   for (const rel of [".verity", PROOFS_DIR, `${PROOFS_DIR}/.lake`]) {
     let st;
     try {
-      st = (0, import_node_fs60.lstatSync)((0, import_node_path46.join)(root, rel));
+      st = (0, import_node_fs61.lstatSync)((0, import_node_path47.join)(root, rel));
     } catch {
       break;
     }
@@ -36423,44 +36456,44 @@ function refused(problem) {
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return run2(tc, (0, import_node_path46.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return run2(tc, (0, import_node_path47.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 async function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return runAsync(tc, (0, import_node_path46.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return runAsync(tc, (0, import_node_path47.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
-  if (!rel.endsWith(".lean") || (0, import_node_path46.isAbsolute)(rel) || rel.startsWith("..")) return false;
+  if (!rel.endsWith(".lean") || (0, import_node_path47.isAbsolute)(rel) || rel.startsWith("..")) return false;
   return statRegularInRoot(modelsAbs, rel).ok;
 }
 function resolveModelFile(root, arg) {
-  const modelsAbs = (0, import_node_path46.join)(root, MODELS_DIR);
-  const asPath = (0, import_node_path46.relative)(modelsAbs, (0, import_node_path46.isAbsolute)(arg) ? arg : (0, import_node_path46.resolve)(root, arg));
+  const modelsAbs = (0, import_node_path47.join)(root, MODELS_DIR);
+  const asPath = (0, import_node_path47.relative)(modelsAbs, (0, import_node_path47.isAbsolute)(arg) ? arg : (0, import_node_path47.resolve)(root, arg));
   const candidates2 = arg.includes("/") || arg.includes("\\") ? [asPath] : [arg, `${arg}.lean`];
   for (const rel of candidates2) {
-    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path46.join)(modelsAbs, rel);
+    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path47.join)(modelsAbs, rel);
   }
   return null;
 }
 function listModelFiles(root) {
-  const modelsAbs = (0, import_node_path46.join)(root, MODELS_DIR);
-  if (!(0, import_node_fs60.existsSync)(modelsAbs)) return [];
-  return (0, import_node_fs60.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path46.join)(modelsAbs, f));
+  const modelsAbs = (0, import_node_path47.join)(root, MODELS_DIR);
+  if (!(0, import_node_fs61.existsSync)(modelsAbs)) return [];
+  return (0, import_node_fs61.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path47.join)(modelsAbs, f));
 }
 function trimDiagnostics(text) {
   return text.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
 function checkModel(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path46.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path46.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path47.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path47.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path46.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path46.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path47.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path47.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
@@ -36469,10 +36502,10 @@ function toReport(res, root, modelFile, timeoutMs) {
   const parsed = parseVerityLines(res.stdout);
   const combined = `${res.stdout}
 ${res.stderr}`;
-  const name2 = parsed.header?.model ?? (0, import_node_path46.basename)(modelFile, ".lean");
+  const name2 = parsed.header?.model ?? (0, import_node_path47.basename)(modelFile, ".lean");
   const report = {
     model: name2,
-    file: (0, import_node_path46.relative)(root, modelFile),
+    file: (0, import_node_path47.relative)(root, modelFile),
     ok: res.ok,
     header: parsed.header,
     properties: parsed.properties,
@@ -36717,15 +36750,15 @@ function nonNegative(v) {
   return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
 }
 function readLedger(root) {
-  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const empty = { day: today, models: 0, costUsd: 0 };
+  const today2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const empty = { day: today2, models: 0, costUsd: 0 };
   if (!isLocalState(root, AUTO_LEDGER)) return empty;
   const read2 = readRegularFileInRoot(root, AUTO_LEDGER, 4096);
   if (!read2.ok) return empty;
   try {
     const o = JSON.parse(read2.content);
-    if (o.day !== today || typeof o.models !== "number") return empty;
-    return { day: today, models: nonNegative(o.models), costUsd: nonNegative(o.costUsd) };
+    if (o.day !== today2 || typeof o.models !== "number") return empty;
+    return { day: today2, models: nonNegative(o.models), costUsd: nonNegative(o.costUsd) };
   } catch {
     return empty;
   }
@@ -37042,7 +37075,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path47.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path48.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -37164,7 +37197,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path47.relative)(root, (0, import_node_path47.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path48.relative)(root, (0, import_node_path48.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -37197,7 +37230,19 @@ async function generateAndCheck(root, req, opts) {
   const read2 = readSrc(req.file, 96 * 1024);
   if (!read2.ok) return { ok: false, error: `${req.file}: ${read2.reason}`, rounds: 0, costUsd: 0 };
   const sha2562 = sha256Of(read2.content);
-  const { lines, numbered: numbered2 } = describeTarget(read2.content, req.symbol, req.file, req.lines, { codeMap: opts.deps.codeMap });
+  const { lines, numbered: numbered2, extent } = describeTarget(read2.content, req.symbol, req.file, req.lines, { codeMap: opts.deps.codeMap });
+  let warning;
+  if (!lines) {
+    const outline = extent === "fallback:not-found" ? opts.deps.codeMap?.outline(req.file, read2.content) : void 0;
+    if (outline?.source === "tree-sitter") {
+      const names2 = [...new Set(outline.value.filter((f) => f.name && f.kind !== "lambda").map((f) => f.qualified))];
+      const last = (req.symbol.split(/[.#:]/).pop() ?? req.symbol).toLowerCase();
+      const close = names2.filter((n) => n.toLowerCase().includes(last));
+      const shown = (close.length > 0 ? close : names2).slice(0, 12);
+      return { ok: false, error: `no function \`${req.symbol}\` in ${req.file}${shown.length ? ` (it has: ${shown.join(", ")})` : ""}. Name one as ${req.file}#<name>, or pass --lines a-b`, rounds: 0, costUsd: 0 };
+    }
+    warning = `could not find the lines of \`${req.symbol}\` in ${req.file} (${extent}): the model is written from the start of the file, and a replay must copy half of the whole file. Pass --lines a-b to name the code.`;
+  }
   const target = {
     file: req.file,
     symbol: req.symbol,
@@ -37205,7 +37250,9 @@ async function generateAndCheck(root, req, opts) {
     sha256: sha2562,
     numbered: numbered2,
     reasons: req.hint ? [`the user's worry, in their words: ${req.hint.slice(0, 280)}`] : [],
-    properties: []
+    properties: [],
+    // The run row records which extractor answered, as at push.
+    extentSource: extent
   };
   const context = opts.deps.codeMap && !req.lines ? targetContext({ codeMap: opts.deps.codeMap, codeSource: opts.deps.codeSource, readSource: readSrc, file: req.file, content: read2.content, symbol: req.symbol }) : null;
   Object.assign(target, context?.fields ?? {});
@@ -37227,7 +37274,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path47.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path48.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -37241,14 +37288,14 @@ async function generateAndCheck(root, req, opts) {
         const g = basisOf(p.source, files);
         return g.ok ? [] : [`${p.id}: ${g.why}`];
       });
-      if (bad.length === 0) return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd };
+      if (bad.length === 0) return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd, ...warning ? { warning } : {} };
       lastError = ungroundedMessage(bad.join("; "));
       if (round < maxRounds) {
         previous = { source: gen.source, error: lastError };
         continue;
       }
       const grounded = report.properties.filter((p) => basisOf(p.source, files).ok);
-      if (grounded.length > 0) return { ok: true, name: gen.name, file: rel, report: { ...report, properties: grounded }, rounds: round, costUsd };
+      if (grounded.length > 0) return { ok: true, name: gen.name, file: rel, report: { ...report, properties: grounded }, rounds: round, costUsd, ...warning ? { warning } : {} };
       break;
     }
     lastError = stray ? `the model abstracts ${stray.file}, not ${req.file}` : report.error ?? (report.malformed ? "the model printed malformed VERITY lines" : "the model reported no property");
@@ -37274,9 +37321,16 @@ async function prepareFormalPhase(root, env = process.env, auth2, readSource, co
   }
   const build = await buildLibraryAsync(toolchain, root, 9e4);
   if (!build.ok) return { ok: false, skip: "library-build-failed", detail: build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).join(" ").slice(0, 200) };
+  const code = await loadCodeContext(root, env, codeSource);
+  return { ok: true, deps: { ...defaultDeps({ auth: auth2, apiKey, env, toolchain, readSource, ...code }), codeSource: code.codeSource } };
+}
+async function loadCodeContext(root, env = process.env, codeSource) {
   const loaded = await loadCodeMap(env);
-  const source2 = codeSource ?? withoutPaths(worktreeSource(root), isDeniedPath);
-  return { ok: true, deps: { ...defaultDeps({ auth: auth2, apiKey, env, toolchain, readSource, codeMap: loaded.ok ? loaded.map : null, codeSource: source2 }), codeSource: source2 } };
+  return { codeMap: loaded.ok ? loaded.map : null, codeSource: codeSource ?? withoutPaths(worktreeSource(root), isDeniedPath) };
+}
+async function onDemandDeps(root, opts) {
+  const code = await loadCodeContext(root, opts.env);
+  return { ...defaultDeps({ ...opts, tier: "deep", ...code }), codeSource: code.codeSource };
 }
 function changedFunction(codeMap, file, content, changed) {
   const outline = codeMap.outline(file, content);
@@ -37357,7 +37411,7 @@ var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var VENDORED_READ_MAX_BYTES = 256 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path48.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path49.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve9) => {
@@ -37402,7 +37456,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs61.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs62.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -37422,10 +37476,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs61.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs62.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs61.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs62.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -37435,10 +37489,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs61.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs61.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs62.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs62.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs61.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs61.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs62.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs62.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -37508,7 +37562,7 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs61.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs62.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
@@ -38134,7 +38188,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto20 = require("node:crypto");
-var import_node_fs62 = require("node:fs");
+var import_node_fs63 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -38163,7 +38217,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs62.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs63.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -38188,10 +38242,10 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs67 = require("node:fs");
+var import_node_fs68 = require("node:fs");
 var import_promises20 = require("node:fs/promises");
 var import_yaml6 = __toESM2(require_dist());
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 var import_node_os11 = require("node:os");
 var import_node_child_process19 = require("node:child_process");
 
@@ -38271,7 +38325,7 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs63 = require("node:fs");
+var import_node_fs64 = require("node:fs");
 
 // src/lib/prereqs.ts
 var import_node_child_process16 = require("node:child_process");
@@ -38479,11 +38533,11 @@ async function buildReport() {
   const hooks = wiring.status;
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
-  const hasConfig = (0, import_node_fs63.existsSync)(projectPath(CODACY_CONFIG_FILE));
+  const hasConfig = (0, import_node_fs64.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs63.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs64.existsSync)(projectPath(STANDARD_FILE)),
     analysisConfig: hasConfig,
-    verityMd: (0, import_node_fs63.existsSync)(projectPath(VERITY_MD_FILE)),
+    verityMd: (0, import_node_fs64.existsSync)(projectPath(VERITY_MD_FILE)),
     analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
@@ -38642,8 +38696,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs64 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_fs65 = require("node:fs");
+var import_node_path50 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -38680,12 +38734,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path49.join)(root, ".gate");
-  const verityDir = (0, import_node_path49.join)(root, ".verity");
-  if ((0, import_node_fs64.existsSync)(gateDir) && !(0, import_node_fs64.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path50.join)(root, ".gate");
+  const verityDir = (0, import_node_path50.join)(root, ".verity");
+  if ((0, import_node_fs65.existsSync)(gateDir) && !(0, import_node_fs65.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs64.existsSync)(gateDir) && (0, import_node_fs64.existsSync)(verityDir)) {
+  if ((0, import_node_fs65.existsSync)(gateDir) && (0, import_node_fs65.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -38706,13 +38760,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs64.existsSync)(gateDir)) {
+    if ((0, import_node_fs65.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs64.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs65.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -38728,18 +38782,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs64.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs65.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path49.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path49.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs64.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs64.existsSync)(verityCreds)) {
-    (0, import_node_fs64.mkdirSync)((0, import_node_path49.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path50.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path50.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs65.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs65.existsSync)(verityCreds)) {
+    (0, import_node_fs65.mkdirSync)((0, import_node_path50.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -38761,8 +38815,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path49.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs64.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path50.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs65.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -38772,9 +38826,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path49.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path49.join)(root, "VERITY.md");
-  if (!(0, import_node_fs64.existsSync)(gateMd) || (0, import_node_fs64.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path50.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path50.join)(root, "VERITY.md");
+  if (!(0, import_node_fs65.existsSync)(gateMd) || (0, import_node_fs65.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -38786,12 +38840,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs64.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs65.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path49.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs64.existsSync)(file)) return;
+  const file = (0, import_node_path50.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs65.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -38839,14 +38893,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep6 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs64.writeFileSync)(verityCreds, verityContent + sep6 + toAppend.join("\n") + "\n");
+    (0, import_node_fs65.writeFileSync)(verityCreds, verityContent + sep6 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs64.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs65.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs64.readFileSync)(path, "utf-8");
+    return (0, import_node_fs65.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -38861,35 +38915,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs64.renameSync)(from, to);
+    (0, import_node_fs65.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs64.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs64.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs65.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs65.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs64.renameSync)(from, to);
+    (0, import_node_fs65.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs64.cpSync)(from, to);
-    (0, import_node_fs64.rmSync)(from, { force: true });
+    (0, import_node_fs65.cpSync)(from, to);
+    (0, import_node_fs65.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path49.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs64.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path49.join)(relDir, entry) : entry;
-      const src = (0, import_node_path49.join)(gateDir, rel);
-      const dest = (0, import_node_path49.join)(verityDir, rel);
-      if ((0, import_node_fs64.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path50.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs65.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path50.join)(relDir, entry) : entry;
+      const src = (0, import_node_path50.join)(gateDir, rel);
+      const dest = (0, import_node_path50.join)(verityDir, rel);
+      if ((0, import_node_fs65.statSync)(src).isDirectory()) {
         walk2(rel);
-      } else if (!(0, import_node_fs64.existsSync)(dest)) {
-        (0, import_node_fs64.mkdirSync)((0, import_node_path49.dirname)(dest), { recursive: true });
-        (0, import_node_fs64.cpSync)(src, dest);
+      } else if (!(0, import_node_fs65.existsSync)(dest)) {
+        (0, import_node_fs65.mkdirSync)((0, import_node_path50.dirname)(dest), { recursive: true });
+        (0, import_node_fs65.cpSync)(src, dest);
         copied++;
       }
     }
@@ -38898,22 +38952,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path49.join)(root, ".gate");
-  const verityDir = (0, import_node_path49.join)(root, ".verity");
-  if ((0, import_node_fs64.existsSync)(gateDir) && !(0, import_node_fs64.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs64.existsSync)(gateDir) && (0, import_node_fs64.existsSync)(verityDir)) {
-    if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(gateDir, "credentials")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path50.join)(root, ".gate");
+  const verityDir = (0, import_node_path50.join)(root, ".verity");
+  if ((0, import_node_fs65.existsSync)(gateDir) && !(0, import_node_fs65.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs65.existsSync)(gateDir) && (0, import_node_fs65.existsSync)(verityDir)) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(gateDir, "credentials")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(gateDir, "memory")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(gateDir, "memory")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path49.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs64.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path50.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs65.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(root, "GATE.md")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(root, "GATE.md")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -39194,11 +39248,11 @@ async function promptMultiSelect(question, choices, fallback) {
 }
 
 // src/lib/prove/lean-install.ts
-var import_node_fs65 = require("node:fs");
+var import_node_fs66 = require("node:fs");
 var import_node_crypto21 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
@@ -39209,10 +39263,10 @@ function freeBytes(dir) {
   let d = dir;
   for (let i2 = 0; i2 < 64; i2++) {
     try {
-      const st = (0, import_node_fs65.statfsSync)(d);
+      const st = (0, import_node_fs66.statfsSync)(d);
       return Number(st.bavail) * Number(st.bsize);
     } catch {
-      const up = (0, import_node_path50.join)(d, "..");
+      const up = (0, import_node_path51.join)(d, "..");
       if (up === d) return null;
       d = up;
     }
@@ -39234,7 +39288,7 @@ function expectedSha256(asset, version = pinnedVersion()) {
 function sha256File(path) {
   return new Promise((resolve9, reject) => {
     const hash = (0, import_node_crypto21.createHash)("sha256");
-    (0, import_node_fs65.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve9(hash.digest("hex"))).on("error", reject);
+    (0, import_node_fs66.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve9(hash.digest("hex"))).on("error", reject);
   });
 }
 async function verifyDownload(zip, asset, version = pinnedVersion()) {
@@ -39254,7 +39308,7 @@ function leanAssetName(version = pinnedVersion()) {
   return suffix ? `lean-${v}-${suffix}.zip` : null;
 }
 function pinnedVersionDir(env = process.env) {
-  return (0, import_node_path50.join)(verityLeanHome(env), pinnedVersion());
+  return (0, import_node_path51.join)(verityLeanHome(env), pinnedVersion());
 }
 function lakeBinary() {
   return (0, import_node_os10.platform)() === "win32" ? "lake.exe" : "lake";
@@ -39265,12 +39319,12 @@ function unzip(zip, dest) {
   for (const [cmd, args2] of attempts) {
     try {
       (0, import_node_child_process18.execFileSync)(cmd, args2, { stdio: ["ignore", "ignore", "pipe"], timeout: 15 * 6e4 });
-      if ((0, import_node_fs65.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
+      if ((0, import_node_fs66.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
       errors.push(`${cmd}: produced nothing`);
     } catch (err2) {
       errors.push(`${cmd}: ${String(err2.message).split("\n")[0].slice(0, 120)}`);
       try {
-        for (const e of (0, import_node_fs65.readdirSync)(dest)) (0, import_node_fs65.rmSync)((0, import_node_path50.join)(dest, e), { recursive: true, force: true });
+        for (const e of (0, import_node_fs66.readdirSync)(dest)) (0, import_node_fs66.rmSync)((0, import_node_path51.join)(dest, e), { recursive: true, force: true });
       } catch {
       }
     }
@@ -39296,7 +39350,7 @@ async function download(url, dest, onProgress, stallMs = DOWNLOAD_STALL_MS) {
       seen += chunk.length;
       onProgress(seen, total);
     });
-    await (0, import_promises18.pipeline)(stream, (0, import_node_fs65.createWriteStream)(dest), { signal: ctrl.signal });
+    await (0, import_promises18.pipeline)(stream, (0, import_node_fs66.createWriteStream)(dest), { signal: ctrl.signal });
   } catch (err2) {
     if (ctrl.signal.aborted) throw new Error(`download stalled: nothing received for ${Math.round(stallMs / 1e3)} s`);
     throw err2;
@@ -39346,10 +39400,10 @@ async function installLean(opts = {}) {
     const gb = (n) => (n / 1024 ** 3).toFixed(1);
     return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
   }
-  const tmp = (0, import_node_path50.join)(home, ".tmp");
-  (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
-  (0, import_node_fs65.mkdirSync)(tmp, { recursive: true });
-  const zip = (0, import_node_path50.join)(tmp, asset);
+  const tmp = (0, import_node_path51.join)(home, ".tmp");
+  (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs66.mkdirSync)(tmp, { recursive: true });
+  const zip = (0, import_node_path51.join)(tmp, asset);
   say(`downloading ${url}`);
   let lastPct = -1;
   try {
@@ -39362,40 +39416,40 @@ async function installLean(opts = {}) {
       }
     });
   } catch (err2) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: err2.message };
   }
   say("verifying checksum");
   const verified = await verifyDownload(zip, asset);
   if (!verified.ok) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: verified.error };
   }
   say("unpacking (this takes a minute)");
-  const unpack = (0, import_node_path50.join)(tmp, "unpack");
-  (0, import_node_fs65.mkdirSync)(unpack);
+  const unpack = (0, import_node_path51.join)(tmp, "unpack");
+  (0, import_node_fs66.mkdirSync)(unpack);
   const unpacked = unzip(zip, unpack);
   if (!unpacked.ok) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: `unpack failed: ${unpacked.error}` };
   }
-  const entries = (0, import_node_fs65.readdirSync)(unpack);
-  const top = entries.length === 1 && (0, import_node_fs65.statSync)((0, import_node_path50.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path50.join)(unpack, entries[0]) : unpack;
-  if (!(0, import_node_fs65.existsSync)((0, import_node_path50.join)(top, "bin", lakeBinary()))) {
-    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+  const entries = (0, import_node_fs66.readdirSync)(unpack);
+  const top = entries.length === 1 && (0, import_node_fs66.statSync)((0, import_node_path51.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path51.join)(unpack, entries[0]) : unpack;
+  if (!(0, import_node_fs66.existsSync)((0, import_node_path51.join)(top, "bin", lakeBinary()))) {
+    (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: "the archive did not contain bin/lake" };
   }
-  (0, import_node_fs65.rmSync)(dir, { recursive: true, force: true });
-  (0, import_node_fs65.mkdirSync)(home, { recursive: true });
-  (0, import_node_fs65.renameSync)(top, dir);
-  (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs66.rmSync)(dir, { recursive: true, force: true });
+  (0, import_node_fs66.mkdirSync)(home, { recursive: true });
+  (0, import_node_fs66.renameSync)(top, dir);
+  (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
   return { ok: true, dir };
 }
 
 // src/lib/remote-config.ts
-var import_node_fs66 = require("node:fs");
+var import_node_fs67 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 var import_yaml5 = __toESM2(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -39440,7 +39494,7 @@ async function adoptRemoteSetup(found, opts) {
   written.push(STANDARD_FILE);
   if (rider !== null) {
     const localIgnore = projectPath(VERITYIGNORE_FILE);
-    if (!(0, import_node_fs66.existsSync)(localIgnore)) {
+    if (!(0, import_node_fs67.existsSync)(localIgnore)) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
@@ -39473,7 +39527,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative6, body2) {
   const target = projectPath(relative6);
-  await (0, import_promises19.mkdir)((0, import_node_path51.dirname)(target), { recursive: true });
+  await (0, import_promises19.mkdir)((0, import_node_path52.dirname)(target), { recursive: true });
   await (0, import_promises19.writeFile)(target, body2);
 }
 function describeRemote(found) {
@@ -39590,15 +39644,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path52.join)(__dirname, "..", "data"),
+    (0, import_node_path53.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path52.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path53.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path52.join)(process.cwd(), "cli", "data")
+    (0, import_node_path53.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs67.existsSync)((0, import_node_path52.join)(candidate, "skills"))) {
+    if ((0, import_node_fs68.existsSync)((0, import_node_path53.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -39614,9 +39668,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out2 = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs67.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs68.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path52.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path53.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -39627,8 +39681,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises20.readFile)((0, import_node_path52.join)(src, rel), "utf-8");
-      const b = await (0, import_promises20.readFile)((0, import_node_path52.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises20.readFile)((0, import_node_path53.join)(src, rel), "utf-8");
+      const b = await (0, import_promises20.readFile)((0, import_node_path53.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -39831,7 +39885,7 @@ async function synthesizeLocally(opts) {
 async function healStaleAnalysisConfig(globals) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   const standardPath = projectPath(STANDARD_FILE);
-  if (!(0, import_node_fs67.existsSync)(configPath) || !(0, import_node_fs67.existsSync)(standardPath)) return;
+  if (!(0, import_node_fs68.existsSync)(configPath) || !(0, import_node_fs68.existsSync)(standardPath)) return;
   const validation = validatePatternIds();
   if (validation.status !== "invalid") return;
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
@@ -39928,17 +39982,17 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path52.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path53.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path52.join)(skillsSource, skill);
-    const dest = (0, import_node_path52.join)(skillsDest, skill);
-    if (!(0, import_node_fs67.existsSync)(src)) {
+    const src = (0, import_node_path53.join)(skillsSource, skill);
+    const dest = (0, import_node_path53.join)(skillsDest, skill);
+    if (!(0, import_node_fs68.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs67.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs68.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -40087,7 +40141,7 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
   if (!toolchain) {
     const dir = pinnedVersionDir();
     const home = (0, import_node_os11.homedir)();
-    const shown = dir.startsWith(home + import_node_path52.sep) ? `~${dir.slice(home.length)}` : dir;
+    const shown = dir.startsWith(home + import_node_path53.sep) ? `~${dir.slice(home.length)}` : dir;
     console.log("");
     console.log(`    "yes" installs Lean 4 (${LEAN_DOWNLOAD_SIZE}) into ${shown}`);
   }
@@ -40146,7 +40200,7 @@ function registerInitCommand(program2) {
     const staleMarker = clearStalePluginMarker();
     const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs67.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs68.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -40249,7 +40303,7 @@ function registerInitCommand(program2) {
       untrackMemory: opts.untrackMemory === true,
       untrackState: opts.untrackState === true
     });
-    const globalVerityDir = (0, import_node_path52.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path53.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -40324,7 +40378,7 @@ function registerInitCommand(program2) {
     }
     step("Your project's Standard");
     let haveStandard = false;
-    if ((0, import_node_fs67.existsSync)(projectPath(STANDARD_FILE))) {
+    if ((0, import_node_fs68.existsSync)(projectPath(STANDARD_FILE))) {
       printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
       haveStandard = true;
     } else {
@@ -40354,7 +40408,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.ec5aae9" : "dev"
+          cli_version: true ? "0.34.1-experimental.199c728" : "dev"
         }
       });
     } catch (err2) {
@@ -40404,8 +40458,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs68 = require("node:fs");
-var import_node_path53 = require("node:path");
+var import_node_fs69 = require("node:fs");
+var import_node_path54 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -40414,11 +40468,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path53.join)(skillsRoot, name2);
-      if ((0, import_node_fs68.existsSync)(dir)) {
+      const dir = (0, import_node_path54.join)(skillsRoot, name2);
+      if ((0, import_node_fs69.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs68.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs69.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -40432,24 +40486,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs68.existsSync)(verityDir)) {
+    if ((0, import_node_fs69.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs68.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs69.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs68.existsSync)(verityMd)) {
+      if ((0, import_node_fs69.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs68.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs69.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs68.existsSync)(path) && (0, import_node_fs68.statSync)(path).isDirectory() && (0, import_node_fs68.readdirSync)(path).length === 0) {
-        (0, import_node_fs68.rmdirSync)(path);
+      if ((0, import_node_fs69.existsSync)(path) && (0, import_node_fs69.statSync)(path).isDirectory() && (0, import_node_fs69.readdirSync)(path).length === 0) {
+        (0, import_node_fs69.rmdirSync)(path);
       }
     };
     actions.push({
@@ -40460,11 +40514,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path53.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs68.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path54.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs69.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs68.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs69.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -40658,8 +40712,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs69 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_fs70 = require("node:fs");
+var import_node_path55 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -40696,11 +40750,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs69.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs69.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs70.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs70.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs69.unlinkSync)((0, import_node_path54.join)(cacheDir, entry));
+            (0, import_node_fs70.unlinkSync)((0, import_node_path55.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -40715,19 +40769,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs69.existsSync)(file)) {
+      if ((0, import_node_fs70.existsSync)(file)) {
         try {
-          (0, import_node_fs69.writeFileSync)(file, "");
+          (0, import_node_fs70.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs69.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs69.readdirSync)(logsDir)) {
+      if ((0, import_node_fs70.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs70.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs69.unlinkSync)((0, import_node_path54.join)(logsDir, entry));
+            (0, import_node_fs70.unlinkSync)((0, import_node_path55.join)(logsDir, entry));
           } catch {
           }
         }
@@ -40739,7 +40793,7 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs70 = require("node:fs");
+var import_node_fs71 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -40777,7 +40831,7 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs70.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs71.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
@@ -41214,9 +41268,9 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs71 = require("node:fs");
+var import_node_fs72 = require("node:fs");
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs71.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs72.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -41293,8 +41347,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs72 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_fs73 = require("node:fs");
+var import_node_path56 = require("node:path");
 
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -41436,7 +41490,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path55.relative)(root, (0, import_node_path55.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path56.relative)(root, (0, import_node_path56.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -41490,7 +41544,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs72.existsSync)((0, import_node_path55.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs73.existsSync)((0, import_node_path56.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41514,7 +41568,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path55.relative)(root, f);
+      report.file = (0, import_node_path56.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -41552,7 +41606,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs72.existsSync)((0, import_node_path55.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs73.existsSync)((0, import_node_path56.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41583,7 +41637,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path55.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path56.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -41603,7 +41657,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path55.relative)(root, (0, import_node_path55.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path56.relative)(root, (0, import_node_path56.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -41675,7 +41729,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path55.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path56.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -41688,21 +41742,22 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
       printError("Verity library did not build");
       process.exit(2);
     }
-    const deps = defaultDeps({ auth: auth2 ?? void 0, apiKey: process.env.VERITY_PROVE_DIRECT === "1" ? process.env.OPENAI_API_KEY : void 0, toolchain: tc, tier: "deep" });
+    const deps = await onDemandDeps(root, { auth: auth2 ?? void 0, apiKey: process.env.VERITY_PROVE_DIRECT === "1" ? process.env.OPENAI_API_KEY : void 0, toolchain: tc });
     if (!opts.json) printInfo(`asking the Verity service for a model of ${symbol || `${file}:${opts.lines}`} \u2026`);
     const out2 = await generateAndCheck(root, { file, symbol: symbol || `${file}:${opts.lines}`, lines, hint: opts.hint, revise }, { deps, maxRounds: 3 });
     if (!out2.ok) {
       if (opts.json) printJson(out2);
-      else printError(`${out2.error} (${out2.rounds} round(s)${out2.costUsd ? `, $${out2.costUsd.toFixed(2)}` : ""}) \u2014 write the model by hand (Models/README.md) or narrow the target`);
+      else printError(out2.rounds === 0 ? out2.error : `${out2.error} (${out2.rounds} round(s)${out2.costUsd ? `, $${out2.costUsd.toFixed(2)}` : ""}) \u2014 write the model by hand (Models/README.md) or narrow the target`);
       process.exit(2);
     }
+    if (out2.warning && !opts.json) printWarn(out2.warning);
     try {
       writeResult(root, out2.report);
     } catch (err2) {
       if (!(err2 instanceof SafeWriteError)) throw err2;
     }
     if (opts.json) {
-      printJson({ name: out2.name, file: out2.file, rounds: out2.rounds, cost_usd: out2.costUsd, report: { ...out2.report, passes: reportPasses(out2.report), summary: summarize(out2.report) } });
+      printJson({ name: out2.name, file: out2.file, rounds: out2.rounds, cost_usd: out2.costUsd, ...out2.warning ? { warning: out2.warning } : {}, report: { ...out2.report, passes: reportPasses(out2.report), summary: summarize(out2.report) } });
       return;
     }
     printInfo(`wrote ${out2.file} (${out2.rounds} round(s)${out2.costUsd ? `, $${out2.costUsd.toFixed(2)}` : ""})`);
@@ -41714,8 +41769,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path55.relative)(root, (0, import_node_path55.isAbsolute)(file) ? file : (0, import_node_path55.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path55.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path56.relative)(root, (0, import_node_path56.isAbsolute)(file) ? file : (0, import_node_path56.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path56.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -41731,8 +41786,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path55.relative)(root, (0, import_node_path55.isAbsolute)(file) ? file : (0, import_node_path55.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path55.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path56.relative)(root, (0, import_node_path56.isAbsolute)(file) ? file : (0, import_node_path56.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path56.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -41766,10 +41821,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs73 = require("node:fs");
+var import_node_fs74 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 var import_node_os12 = require("node:os");
-var import_node_path56 = require("node:path");
+var import_node_path57 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -41786,7 +41841,7 @@ function registerLeanCommand(program2) {
     const managed = pinnedVersionDir();
     const matches = version ? version.includes(pin) : false;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs73.existsSync)((0, import_node_path56.join)(managed, "bin")), asset: leanAssetName() });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs74.existsSync)((0, import_node_path57.join)(managed, "bin")), asset: leanAssetName() });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -41804,7 +41859,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs73.existsSync)((0, import_node_path56.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs74.existsSync)((0, import_node_path57.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -41840,18 +41895,18 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs73.existsSync)(dir)) {
+    if (!(0, import_node_fs74.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs73.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs74.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.ec5aae9").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.ec5aae9");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.1-experimental.199c728").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.1-experimental.199c728");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();