npm - @codacy/verity-cli - Versions diffs - 0.34.1-experimental.c910405 → 0.34.2-experimental.d59d8cb - Mend

@codacy/verity-cli 0.34.1-experimental.c910405 → 0.34.2-experimental.d59d8cb

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/bin/verity.js CHANGED Viewed

@@ -6975,10 +6975,10 @@ var require_resolve_block_map = __commonJS2({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start: start2, key, sep: sep6, value } = collItem;
+        const { start: start2, key, sep: sep7, value } = collItem;
         const keyProps = resolveProps.resolveProps(start2, {
           indicator: "explicit-key-ind",
-          next: key ?? sep6?.[0],
+          next: key ?? sep7?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -6992,7 +6992,7 @@ var require_resolve_block_map = __commonJS2({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep6) {
+          if (!keyProps.anchor && !keyProps.tag && !sep7) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -7016,7 +7016,7 @@ var require_resolve_block_map = __commonJS2({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep6 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep7 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -7032,7 +7032,7 @@ var require_resolve_block_map = __commonJS2({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep6, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep7, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -7123,7 +7123,7 @@ var require_resolve_end = __commonJS2({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep6 = "";
+        let sep7 = "";
         for (const token of end) {
           const { source: source2, type } = token;
           switch (type) {
@@ -7137,13 +7137,13 @@ var require_resolve_end = __commonJS2({
               if (!comment)
                 comment = cb;
               else
-                comment += sep6 + cb;
-              sep6 = "";
+                comment += sep7 + cb;
+              sep7 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep6 += source2;
+                sep7 += source2;
               hasSpace = true;
               break;
             default:
@@ -7186,18 +7186,18 @@ var require_resolve_flow_collection = __commonJS2({
       let offset = fc.offset + fc.start.source.length;
       for (let i2 = 0; i2 < fc.items.length; ++i2) {
         const collItem = fc.items[i2];
-        const { start: start2, key, sep: sep6, value } = collItem;
+        const { start: start2, key, sep: sep7, value } = collItem;
         const props = resolveProps.resolveProps(start2, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep6?.[0],
+          next: key ?? sep7?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep6 && !value) {
+          if (!props.anchor && !props.tag && !sep7 && !value) {
             if (i2 === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i2 < fc.items.length - 1)
@@ -7251,8 +7251,8 @@ var require_resolve_flow_collection = __commonJS2({
             }
           }
         }
-        if (!isMap && !sep6 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep6, null, props, onError);
+        if (!isMap && !sep7 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep7, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -7264,7 +7264,7 @@ var require_resolve_flow_collection = __commonJS2({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep6 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep7 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -7275,8 +7275,8 @@ var require_resolve_flow_collection = __commonJS2({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep6)
-                for (const st of sep6) {
+              if (sep7)
+                for (const st of sep7) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -7293,7 +7293,7 @@ var require_resolve_flow_collection = __commonJS2({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep6, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep7, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -7473,7 +7473,7 @@ var require_resolve_block_scalar = __commonJS2({
           chompStart = i2 + 1;
       }
       let value = "";
-      let sep6 = "";
+      let sep7 = "";
       let prevMoreIndented = false;
       for (let i2 = 0; i2 < contentStart; ++i2)
         value += lines[i2][0].slice(trimIndent) + "\n";
@@ -7490,24 +7490,24 @@ var require_resolve_block_scalar = __commonJS2({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep6 + indent.slice(trimIndent) + content;
-          sep6 = "\n";
+          value += sep7 + indent.slice(trimIndent) + content;
+          sep7 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep6 === " ")
-            sep6 = "\n";
-          else if (!prevMoreIndented && sep6 === "\n")
-            sep6 = "\n\n";
-          value += sep6 + indent.slice(trimIndent) + content;
-          sep6 = "\n";
+          if (sep7 === " ")
+            sep7 = "\n";
+          else if (!prevMoreIndented && sep7 === "\n")
+            sep7 = "\n\n";
+          value += sep7 + indent.slice(trimIndent) + content;
+          sep7 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep6 === "\n")
+          if (sep7 === "\n")
             value += "\n";
           else
-            sep6 = "\n";
+            sep7 = "\n";
         } else {
-          value += sep6 + content;
-          sep6 = " ";
+          value += sep7 + content;
+          sep7 = " ";
           prevMoreIndented = false;
         }
       }
@@ -7689,25 +7689,25 @@ var require_resolve_flow_scalar = __commonJS2({
       if (!match)
         return source2;
       let res = match[1];
-      let sep6 = " ";
+      let sep7 = " ";
       let pos = first.lastIndex;
       line2.lastIndex = pos;
       while (match = line2.exec(source2)) {
         if (match[1] === "") {
-          if (sep6 === "\n")
-            res += sep6;
+          if (sep7 === "\n")
+            res += sep7;
           else
-            sep6 = "\n";
+            sep7 = "\n";
         } else {
-          res += sep6 + match[1];
-          sep6 = " ";
+          res += sep7 + match[1];
+          sep7 = " ";
         }
         pos = line2.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source2);
-      return res + sep6 + (match?.[1] ?? "");
+      return res + sep7 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source2, onError) {
       let res = "";
@@ -8514,14 +8514,14 @@ var require_cst_stringify = __commonJS2({
         }
       }
     }
-    function stringifyItem({ start: start2, key, sep: sep6, value }) {
+    function stringifyItem({ start: start2, key, sep: sep7, value }) {
       let res = "";
       for (const st of start2)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep6)
-        for (const st of sep6)
+      if (sep7)
+        for (const st of sep7)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -9671,18 +9671,18 @@ var require_parser = __commonJS2({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start2 = getFirstKeyStartProps(prev);
-          let sep6;
+          let sep7;
           if (scalar.end) {
-            sep6 = scalar.end;
-            sep6.push(this.sourceToken);
+            sep7 = scalar.end;
+            sep7.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep6 = [this.sourceToken];
+            sep7 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start: start2, key: scalar, sep: sep6 }]
+            items: [{ start: start2, key: scalar, sep: sep7 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -9835,15 +9835,15 @@ var require_parser = __commonJS2({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start3 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep6 = it.sep;
-                  sep6.push(this.sourceToken);
+                  const sep7 = it.sep;
+                  sep7.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start3, key, sep: sep6 }]
+                    items: [{ start: start3, key, sep: sep7 }]
                   });
                 } else if (start2.length > 0) {
                   it.sep = it.sep.concat(start2, this.sourceToken);
@@ -10037,13 +10037,13 @@ var require_parser = __commonJS2({
             const prev = getPrevProps(parent);
             const start2 = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep6 = fc.end.splice(1, fc.end.length);
-            sep6.push(this.sourceToken);
+            const sep7 = fc.end.splice(1, fc.end.length);
+            sep7.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start: start2, key: fc, sep: sep6 }]
+              items: [{ start: start2, key: fc, sep: sep7 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -15172,8 +15172,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path4.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename9 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename9)) return true;
+    const basename11 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename11)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -16287,6 +16287,15 @@ async function reportLoginOutcome(out2, opts = {}) {
   }
 }
+// src/lib/session-env.ts
+function envSessionId(env = process.env) {
+  for (const name2 of ["CLAUDE_SESSION_ID", "CLAUDE_CODE_SESSION_ID"]) {
+    const value = env[name2];
+    if (value) return value;
+  }
+  return void 0;
+}
 // src/commands/login.ts
 function registerLoginCommand(program2) {
   program2.command("login").description("Log in to Verity (one GitHub login grants access to all your repositories)").option("--force", "Re-authenticate even if already logged in").option("--start", "Show the GitHub code and return at once (finish with --finish); prints JSON").option("--finish", "Wait for approval of the code --start showed, then log in; prints JSON").option("--wait <seconds>", "With --finish: how long to wait for approval before returning", "100").option("--cancel", "Discard a code --start showed that will not be approved").action(async (opts) => {
@@ -16303,7 +16312,7 @@ function registerLoginCommand(program2) {
       return;
     }
     const split = !!(opts.start || opts.finish);
-    if (!split && !process.stdin.isTTY && (process.env.CLAUDECODE || process.env.CLAUDE_SESSION_ID)) {
+    if (!split && !process.stdin.isTTY && (process.env.CLAUDECODE || envSessionId())) {
       printWarn("Inside a Claude Code session the code below may not be visible until this command ends.");
       printWarn('  Use "verity login --start", then "verity login --finish" once it is approved.');
     }
@@ -19477,8 +19486,8 @@ function ensureVerityGitignore() {
     }
     let text = next.join("\n");
     if (!hasMarker) {
-      const sep6 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
-      text = text + sep6 + VERITY_GITIGNORE_BLOCK;
+      const sep7 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+      text = text + sep7 + VERITY_GITIGNORE_BLOCK;
     }
     if (text !== content) (0, import_node_fs19.writeFileSync)(".gitignore", text);
     return verified(
@@ -19508,8 +19517,8 @@ function writeFencedBlock() {
   lines = fenceMemoryLines(lines);
   let text = lines.join("\n");
   if (!hasMarker) {
-    const sep6 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
-    text = text + sep6 + VERITY_GITIGNORE_BLOCK;
+    const sep7 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
+    text = text + sep7 + VERITY_GITIGNORE_BLOCK;
   }
   try {
     (0, import_node_fs19.writeFileSync)(".gitignore", text);
@@ -19559,8 +19568,8 @@ function keepMemoryTracked() {
   }
   if (content.includes(MEMORY_OPT_OUT_MARKER)) return "already";
   try {
-    const sep6 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
-    (0, import_node_fs19.writeFileSync)(".gitignore", content + sep6 + MEMORY_OPT_OUT_STANZA);
+    const sep7 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
+    (0, import_node_fs19.writeFileSync)(".gitignore", content + sep7 + MEMORY_OPT_OUT_STANZA);
   } catch {
     return "failed";
   }
@@ -22150,13 +22159,13 @@ function registerIntentCommands(program2) {
       if (!prompt) {
         process.exit(0);
       }
-      if (deferredToPlugin("intent capture", event.session_id ?? process.env.CLAUDE_SESSION_ID ?? null)) {
+      if (deferredToPlugin("intent capture", event.session_id ?? envSessionId() ?? null)) {
         process.exit(0);
       }
       const isPrimitive = isSlashCommand(prompt);
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
-      const scopeSession = event.session_id || process.env.CLAUDE_SESSION_ID || "";
+      const scopeSession = event.session_id || envSessionId() || "";
       if (!isPrimitive) await appendToConversationBuffer(prompt, sessionScopeKey(scopeToken, scopeSession));
       if (!isPrimitive) {
         try {
@@ -22876,7 +22885,12 @@ function registerLifecycleCommands(program2) {
       }
       if (!verityConfigured()) process.exit(0);
       const event = await readHookStdin();
-      const sessionId = opts.sessionId ?? event.session_id ?? process.env.CLAUDE_SESSION_ID ?? null;
+      const resolved = resolveHookSession(opts.sessionId, event, envSessionId());
+      if (!resolved.ok) {
+        logEvent("lifecycle_session_flag_refused", { command: "compact" });
+        process.exit(0);
+      }
+      const sessionId = resolved.sessionId;
       if (deferredToPlugin("compact", sessionId)) process.exit(0);
       const globals = program2.opts();
       const tok = await resolveToken(globals.token);
@@ -22905,9 +22919,14 @@ function registerLifecycleCommands(program2) {
       }
       if (!verityConfigured()) process.exit(0);
       const event = await readHookStdin();
-      const sessionId = opts.sessionId ?? event.session_id ?? process.env.CLAUDE_SESSION_ID ?? null;
+      const resolved = resolveHookSession(opts.sessionId, event, envSessionId());
+      if (!resolved.ok) {
+        logEvent("lifecycle_session_flag_refused", { command: "session end" });
+        process.exit(0);
+      }
+      const sessionId = resolved.sessionId;
       if (deferredToPlugin("session end", sessionId)) process.exit(0);
-      const reason = opts.reason ?? event.session_end_reason ?? event.reason ?? "other";
+      const reason = hookWord(opts.reason) ?? event.session_end_reason ?? event.reason ?? "other";
       if (reason === "clear") {
         writeCarry(sessionId ?? void 0, getCurrentCommit());
       }
@@ -22991,20 +23010,56 @@ function buildCompactionContext(session) {
   const trimmed = [...lines.slice(0, 5), ...lines.slice(5, 5 + 2)].join("\n");
   return trimmed.length <= MAX_CHARS ? trimmed : null;
 }
+var MAX_HOOK_EVENT_BYTES = 64 * 1024;
+var SESSION_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var HOOK_WORD = /^[a-z][a-z_]{0,63}$/;
+function isHookSessionId(value) {
+  return typeof value === "string" && SESSION_ID.test(value);
+}
+function hookWord(value) {
+  return typeof value === "string" && HOOK_WORD.test(value) ? value : void 0;
+}
+function resolveHookSession(flag, event, env) {
+  if (flag !== void 0) return isHookSessionId(flag) ? { ok: true, sessionId: flag } : { ok: false };
+  if (event.session_id) return { ok: true, sessionId: event.session_id };
+  return { ok: true, sessionId: isHookSessionId(env) ? env : null };
+}
+function parseHookEvent(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw.trim() || "{}");
+  } catch {
+    return {};
+  }
+  if (!data || typeof data !== "object" || Array.isArray(data)) return {};
+  const o = data;
+  const event = {};
+  if (isHookSessionId(o.session_id)) event.session_id = o.session_id;
+  const compaction = hookWord(o.compaction_type);
+  if (compaction) event.compaction_type = compaction;
+  const endReason = hookWord(o.session_end_reason);
+  if (endReason) event.session_end_reason = endReason;
+  const reason = hookWord(o.reason);
+  if (reason) event.reason = reason;
+  return event;
+}
 async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
+    let size = 0;
     const timeout = new Promise((resolve9) => setTimeout(() => resolve9({}), 500));
     const read2 = new Promise((resolve9) => {
-      process.stdin.on("data", (c) => chunks.push(c));
-      process.stdin.on("end", () => {
-        try {
-          resolve9(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
-        } catch {
+      process.stdin.on("data", (c) => {
+        size += c.length;
+        if (size > MAX_HOOK_EVENT_BYTES) {
+          process.stdin.destroy();
           resolve9({});
+          return;
         }
+        chunks.push(c);
       });
+      process.stdin.on("end", () => resolve9(parseHookEvent(Buffer.concat(chunks).toString("utf-8"))));
       process.stdin.on("error", () => resolve9({}));
       process.stdin.resume();
     });
@@ -23828,8 +23883,8 @@ async function correctVerityMdVersion(opts) {
     origin: { kind: "synthesized", tools: opts.tools }
   }));
 }
-async function writeFileTo(relative6, body2) {
-  const target = projectPath(relative6);
+async function writeFileTo(relative7, body2) {
+  const target = projectPath(relative7);
   await (0, import_promises10.mkdir)((0, import_node_path29.dirname)(target), { recursive: true });
   await (0, import_promises10.writeFile)(target, body2);
 }
@@ -24908,7 +24963,7 @@ function registerStatusCommand(program2) {
     {
       const tokenForScope = tokenResult.data.token;
       const found = resolveIgnoreState(
-        ignoreStateKeys(tokenForScope, process.env.CLAUDE_SESSION_ID || void 0)
+        ignoreStateKeys(tokenForScope, envSessionId())
       );
       const now = Math.floor(Date.now() / 1e3);
       const active = resolveActive(found?.state ?? null, now);
@@ -25101,7 +25156,7 @@ async function sendGeneralFeedback(message, opts, globals) {
     process.exit(1);
   }
   const body2 = { message };
-  const sessionId = opts.sessionId ?? process.env.CLAUDE_SESSION_ID;
+  const sessionId = opts.sessionId ?? envSessionId();
   const model = opts.model ?? process.env.CLAUDE_MODEL ?? "unknown";
   if (sessionId) body2.session_id = sessionId;
   if (model) body2.agent_model = model;
@@ -26345,7 +26400,7 @@ function resolveFrame(input) {
   const hookDirUsable = !!input.hookCwd && (0, import_node_fs40.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
-  const refuse = (refusal) => ({
+  const refuse2 = (refusal) => ({
     moment: found?.moment ?? null,
     frame: { worktreeRoot: null, gitDir: null, commonDir: null, isLinkedWorktree: false, branch: null, anchor, refusal }
   });
@@ -26359,19 +26414,19 @@ function resolveFrame(input) {
       if (!kindRes.some((re) => re.test(segments[i2]))) continue;
       const target = extractCommandTarget(input.command, i2, baseDir);
       if (target.named) anchor = "command-target";
-      if (target.unresolvable) return refuse(`target:${target.unresolvable}`);
+      if (target.unresolvable) return refuse2(`target:${target.unresolvable}`);
       dirs.add(target.dir ?? baseDir);
     }
-    if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
+    if (dirs.size > 1) return refuse2(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs40.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs40.existsSync)(targetDir)) return refuse2(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
   const toplevel = gitAt(dir, ["rev-parse", "--show-toplevel"]);
   if (!toplevel) {
-    return refuse(anchor === "command-target" ? `target:not a git repository: ${dir}` : `anchor:not a git repository: ${dir}`);
+    return refuse2(anchor === "command-target" ? `target:not a git repository: ${dir}` : `anchor:not a git repository: ${dir}`);
   }
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
@@ -26967,7 +27022,7 @@ function sanitizeCommandWithLoss(rawCmd) {
   const lost = lines.slice(1).some((l) => l.trim().length > 0);
   const first = lines[0];
   const cmd = sanitizeCommand(first);
-  const hadSeparator = SEPARATORS.some((sep6) => first.indexOf(sep6) > 0);
+  const hadSeparator = SEPARATORS.some((sep7) => first.indexOf(sep7) > 0);
   return { cmd, lost: lost || !hadSeparator && first.length > MAX_COMMAND_CHARS };
 }
 var SEPARATORS = [" | ", " > ", " >> ", " 2>", " && ", " ; "];
@@ -26976,11 +27031,11 @@ function sanitizeCommand(rawCmd) {
   let cmd = rawCmd.split("\n")[0];
   let cut = -1;
   let marker = "";
-  for (const sep6 of SEPARATORS) {
-    const idx = cmd.indexOf(sep6);
+  for (const sep7 of SEPARATORS) {
+    const idx = cmd.indexOf(sep7);
     if (idx > 0 && (cut === -1 || idx < cut)) {
       cut = idx;
-      marker = sep6.trim();
+      marker = sep7.trim();
     }
   }
   if (cut > -1) cmd = cmd.slice(0, cut);
@@ -27047,13 +27102,13 @@ async function bootstrap(run4) {
     isTTY: process.stdout.isTTY === true
   });
   const { assistantMessage: assistantResponse, stopReason, transcriptPath, sessionId } = await readStopHookStdin();
-  if (deferredToPlugin("analyze", sessionId ?? process.env.CLAUDE_SESSION_ID ?? null)) {
+  if (deferredToPlugin("analyze", sessionId ?? envSessionId() ?? null)) {
     process.exit(0);
   }
   const actionSummary = transcriptPath ? await extractActionSummary(transcriptPath) : null;
   const tokenResult = await resolveToken(globals.token);
   const scopeToken = tokenResult.ok ? tokenResult.data.token : void 0;
-  const rawSessionId = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+  const rawSessionId = sessionId || envSessionId();
   const baselineSessionId = sessionScopeKey(scopeToken, rawSessionId);
   if (tokenResult.ok) {
     run4.beacon = {
@@ -27258,7 +27313,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.1-experimental.c910405" : "dev";
+    return true ? "0.34.2-experimental.d59d8cb" : "dev";
   } catch {
     return "dev";
   }
@@ -28059,7 +28114,7 @@ async function connect(run4) {
 async function mode(run4) {
   const { opts, globals } = run4;
   const { actionSummary, allForReview, assistantResponse, baseline, conversation, memory: memory2, noFilesChanged, serviceUrl, sessionId, token, turnAuthoredCode } = run4;
-  const sessionIdForMemory = sessionId || process.env.CLAUDE_SESSION_ID || "";
+  const sessionIdForMemory = sessionId || envSessionId() || "";
   let predictedMode;
   try {
     const memoryPath2 = sessionIdForMemory ? `/memory?session_id=${encodeURIComponent(sessionIdForMemory)}` : "/memory";
@@ -31952,7 +32007,7 @@ async function workingMemory(run4) {
   const { opts } = run4;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run4;
   let { reachability } = run4;
-  const memorySession = sessionDossier(token, sessionId ?? process.env.CLAUDE_SESSION_ID ?? null);
+  const memorySession = sessionDossier(token, sessionId ?? envSessionId() ?? null);
   let memory2 = null;
   let incrementReport = null;
   if (memorySession) {
@@ -32225,7 +32280,7 @@ async function buildRequest(run4) {
     context: {
       agent_model: process.env.CLAUDE_MODEL ?? "unknown",
       agent_harness: "claude-code",
-      session_id: sessionId || process.env.CLAUDE_SESSION_ID || "unknown",
+      session_id: sessionId || envSessionId() || "unknown",
       iteration,
       // Makes fleet composition falsifiable — without it, no adoption-gated
       // rollout decision can be checked against anything.
@@ -33522,12 +33577,12 @@ function registerBaselineCommands(program2) {
       if (!process.stdin.isTTY) {
         const input = (await readStdin()).trim();
         if (input) {
-          const event = parseHookEvent(input);
+          const event = parseHookEvent2(input);
           if (opts.sessionId === void 0) sessionId = event.sessionId;
           if (opts.source === void 0) source2 = event.source;
         }
       }
-      const session = sessionId ?? validSessionId(process.env.CLAUDE_SESSION_ID);
+      const session = sessionId ?? validSessionId(envSessionId());
       const cli = pluginCliInvocation();
       const skew = cliVersionSkew();
       const why = skew ? `the \`verity\` on PATH is ${skew.global} but the hooks run ${skew.hooks}, so it is not the CLI they use` : verityOnPath() ? "the `verity` on PATH is a separate install whose version could not be read" : "this machine has no `verity` on PATH \u2014 the plugin carries its own copy";
@@ -33647,7 +33702,7 @@ function registerBaselineCommands(program2) {
     process.exit(0);
   });
 }
-var MAX_HOOK_EVENT_BYTES = 64 * 1024;
+var MAX_HOOK_EVENT_BYTES2 = 64 * 1024;
 var HOOK_SOURCES = /* @__PURE__ */ new Set(["startup", "resume", "clear", "compact"]);
 var SESSION_ID_RE2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 async function readStdin() {
@@ -33655,11 +33710,11 @@ async function readStdin() {
   let size = 0;
   for await (const chunk of process.stdin) {
     size += chunk.length;
-    if (size <= MAX_HOOK_EVENT_BYTES) chunks.push(chunk);
+    if (size <= MAX_HOOK_EVENT_BYTES2) chunks.push(chunk);
   }
-  return size > MAX_HOOK_EVENT_BYTES ? "" : Buffer.concat(chunks).toString("utf-8");
+  return size > MAX_HOOK_EVENT_BYTES2 ? "" : Buffer.concat(chunks).toString("utf-8");
 }
-function parseHookEvent(input) {
+function parseHookEvent2(input) {
   let event;
   try {
     event = JSON.parse(input);
@@ -33680,6 +33735,34 @@ function hookSource(value) {
 // src/commands/review.ts
 var import_node_fs57 = require("node:fs");
+var import_node_path44 = require("node:path");
+function containReviewPaths(paths, base) {
+  const kept = [];
+  const refused2 = [];
+  for (const raw of paths) {
+    const candidate = (0, import_node_path44.isAbsolute)(raw) ? relativeForm(base, raw) : raw;
+    if (candidate === "" || resolveInside(base, candidate) === null) refused2.push(raw);
+    else kept.push(candidate);
+  }
+  return { kept, refused: refused2 };
+}
+function relativeForm(base, abs) {
+  const lexical = (0, import_node_path44.relative)(base, abs);
+  if (!(lexical === ".." || lexical.startsWith(`..${import_node_path44.sep}`) || (0, import_node_path44.isAbsolute)(lexical))) return lexical;
+  try {
+    let dir = (0, import_node_path44.dirname)(abs);
+    let rest = (0, import_node_path44.basename)(abs);
+    while (!(0, import_node_fs57.existsSync)(dir)) {
+      const up = (0, import_node_path44.dirname)(dir);
+      if (up === dir) return lexical;
+      rest = (0, import_node_path44.join)((0, import_node_path44.basename)(dir), rest);
+      dir = up;
+    }
+    return (0, import_node_path44.relative)((0, import_node_fs57.realpathSync)(base), (0, import_node_path44.join)((0, import_node_fs57.realpathSync)(dir), rest));
+  } catch {
+    return lexical;
+  }
+}
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars); - reads it from stdin, so the words never pass through shell quoting").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -33698,8 +33781,20 @@ function registerReviewCommand(program2) {
   });
 }
 async function runReview(opts, globals) {
-  const allFiles = opts.files.split(",").map((f) => f.trim()).filter(Boolean);
-  const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
+  const base = process.cwd();
+  const files = containReviewPaths(opts.files.split(",").map((f) => f.trim()).filter(Boolean), base);
+  const changed = opts.changed ? containReviewPaths(opts.changed.split(",").map((f) => f.trim()).filter(Boolean), base) : files;
+  const refused2 = Array.from(/* @__PURE__ */ new Set([...files.refused, ...changed.refused]));
+  if (refused2.length > 0) {
+    printJsonCompact({
+      gate_decision: "WARN",
+      systemMessage: `Verity: refused ${refused2.length} path(s) outside this repository \u2014 nothing was reviewed. Pass paths inside the repository you run \`verity review\` from.`,
+      refused_paths: refused2
+    });
+    process.exit(0);
+  }
+  const allFiles = files.kept;
+  const changedFiles = changed.kept;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
   const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs57.existsSync)(f) || resolveFile(f) !== null);
@@ -33727,7 +33822,7 @@ async function runReview(opts, globals) {
     context: {
       agent_model: process.env.CLAUDE_MODEL ?? "unknown",
       agent_harness: "claude-code",
-      session_id: process.env.CLAUDE_SESSION_ID ?? "unknown",
+      session_id: envSessionId() ?? "unknown",
       trigger: "review",
       iteration: 1
     }
@@ -33769,11 +33864,11 @@ async function runReview(opts, globals) {
 // src/commands/guard.ts
 var import_node_fs62 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_path50 = require("node:path");
 // src/lib/vendored.ts
 var import_node_fs58 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 var INSTALLED_SKILL = /^\.claude\/skills\/(verity-[a-z0-9-]+)\/(.+)$/;
 function dataDirOrNull() {
   try {
@@ -33788,7 +33883,7 @@ function shippedSkillFile(path, dataDir = dataDirOrNull()) {
   const [, skill, rel] = m;
   if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
   try {
-    return (0, import_node_fs58.readFileSync)((0, import_node_path44.join)(dataDir, "skills", skill, rel), "utf8");
+    return (0, import_node_fs58.readFileSync)((0, import_node_path45.join)(dataDir, "skills", skill, rel), "utf8");
   } catch {
     return null;
   }
@@ -33898,7 +33993,7 @@ async function runAgentReview(options) {
 }
 // src/lib/prove/auto.ts
-var import_node_path48 = require("node:path");
+var import_node_path49 = require("node:path");
 var import_node_crypto19 = require("node:crypto");
 // src/lib/prove/signals.ts
@@ -35585,9 +35680,9 @@ async function runReplay(brief, opts) {
   if (opts.auth) return runReplayViaServer(brief, opts.auth, opts.timeoutMs);
   const env = opts.env ?? process.env;
   const none = { covered: 0, total: 0, ratio: 0, basis: "none" };
-  const refuse = (error) => ({ claimed: null, verdict: "unverified", reason: "", downgrade: error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: 0, containerId: null, error });
-  if (env.VERITY_PROVE_DIRECT !== "1") return refuse("not logged in (run `verity login`); replays run on the Verity service");
-  if (!opts.apiKey) return refuse("OPENAI_API_KEY is not set");
+  const refuse2 = (error) => ({ claimed: null, verdict: "unverified", reason: "", downgrade: error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: 0, containerId: null, error });
+  if (env.VERITY_PROVE_DIRECT !== "1") return refuse2("not logged in (run `verity login`); replays run on the Verity service");
+  if (!opts.apiKey) return refuse2("OPENAI_API_KEY is not set");
   return runReplayInContainer(brief, { apiKey: opts.apiKey, model: opts.model, timeoutMs: opts.timeoutMs, maxRounds: opts.maxRounds, fetchImpl: opts.fetchImpl });
 }
 function renderReplay(model, property, r) {
@@ -35627,16 +35722,16 @@ var import_node_child_process15 = require("node:child_process");
 var import_node_os8 = require("node:os");
 var import_node_fs61 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 // src/lib/prove/scaffold.ts
 var import_node_fs60 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 // src/lib/prove/safe-write.ts
 var import_node_fs59 = require("node:fs");
 var import_node_crypto15 = require("node:crypto");
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
     super(`refusing to write ${path}: ${reason}`);
@@ -35648,7 +35743,7 @@ var SafeWriteError = class extends Error {
 var FLAGS3 = import_node_fs59.constants;
 var NOFOLLOW2 = FLAGS3.O_NOFOLLOW ?? 0;
 function assertPlainRelative(rel) {
-  if (!rel || (0, import_node_path45.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
+  if (!rel || (0, import_node_path46.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
   for (const part of rel.split(/[\\/]/)) {
     if (part === ".." || part === "" || part === ".") throw new SafeWriteError("bad-path", rel);
   }
@@ -35657,7 +35752,7 @@ function ensureDirsNoFollow(root, rel) {
   const parts2 = rel.split(/[\\/]/);
   let cur = root;
   for (const part of parts2.slice(0, -1)) {
-    cur = (0, import_node_path45.join)(cur, part);
+    cur = (0, import_node_path46.join)(cur, part);
     let st;
     try {
       st = (0, import_node_fs59.lstatSync)(cur);
@@ -35668,10 +35763,10 @@ function ensureDirsNoFollow(root, rel) {
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", cur);
     if (!st.isDirectory()) throw new SafeWriteError("not-regular", cur);
   }
-  return (0, import_node_path45.join)(root, rel);
+  return (0, import_node_path46.join)(root, rel);
 }
 function insideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path45.sep) ? realRoot : realRoot + import_node_path45.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path46.sep) ? realRoot : realRoot + import_node_path46.sep);
 }
 function removeQuietly(path) {
   try {
@@ -35682,7 +35777,7 @@ function removeQuietly(path) {
 function writeFileInRootNoFollow(root, rel, content) {
   assertPlainRelative(rel);
   const dest = ensureDirsNoFollow(root, rel);
-  const dir = (0, import_node_path45.dirname)(dest);
+  const dir = (0, import_node_path46.dirname)(dest);
   try {
     const st = (0, import_node_fs59.lstatSync)(dest);
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", dest);
@@ -35696,7 +35791,7 @@ function writeFileInRootNoFollow(root, rel, content) {
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path45.join)(dir, `.${(0, import_node_path45.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path46.join)(dir, `.${(0, import_node_path46.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
     fd = (0, import_node_fs59.openSync)(tmp, import_node_fs59.constants.O_WRONLY | import_node_fs59.constants.O_CREAT | import_node_fs59.constants.O_EXCL | NOFOLLOW2, 420);
@@ -35740,7 +35835,7 @@ function pathHasNoLink(root, rel) {
   }
   let cur = root;
   for (const part of rel.split(/[\\/]/)) {
-    cur = cur + import_node_path45.sep + part;
+    cur = cur + import_node_path46.sep + part;
     try {
       if ((0, import_node_fs59.lstatSync)(cur).isSymbolicLink()) return false;
     } catch {
@@ -36052,20 +36147,20 @@ This directory is machine-local and gitignored (see ../.gitignore). Models are
 never committed; what reaches the team is the bug report and the fix.
 `;
 function scaffoldProofs(root) {
-  const proofsDir = (0, import_node_path46.join)(root, PROOFS_DIR);
+  const proofsDir = (0, import_node_path47.join)(root, PROOFS_DIR);
   const written = [];
   const kept = [];
   for (const stray of ["lakefile.lean"]) {
     const rel = `${PROOFS_DIR}/${stray}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path47.join)(root, rel));
     try {
-      (0, import_node_fs60.rmSync)((0, import_node_path46.join)(root, rel), { force: true });
+      (0, import_node_fs60.rmSync)((0, import_node_path47.join)(root, rel), { force: true });
     } catch {
     }
   }
   for (const f of PROOFS_TEMPLATE_FILES) {
     const rel = `${PROOFS_DIR}/${f.path}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path47.join)(root, rel));
     const current = readRegularFileInRoot(root, rel, 4 * 1024 * 1024);
     if (current.ok && current.content === f.content) {
       kept.push(rel);
@@ -36078,8 +36173,8 @@ function scaffoldProofs(root) {
     [`${PROOFS_DIR}/.gitignore`, LOCAL_GITIGNORE],
     [`${MODELS_DIR}/README.md`, MODELS_README]
   ]) {
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path46.join)(root, rel));
-    if (existsNoFollow((0, import_node_path46.join)(root, rel))) {
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path47.join)(root, rel));
+    if (existsNoFollow((0, import_node_path47.join)(root, rel))) {
       kept.push(rel);
       continue;
     }
@@ -36348,17 +36443,17 @@ function renderReport(r) {
 // src/lib/prove/runner.ts
 function verityLeanHome(env = process.env) {
-  return env.VERITY_LEAN_HOME ?? (0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
+  return env.VERITY_LEAN_HOME ?? (0, import_node_path48.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
 }
 function findToolchain(env = process.env) {
-  const managedBin = (0, import_node_path47.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
-  const elanBin = (0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const elanHas = (0, import_node_fs61.existsSync)((0, import_node_path47.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
-  const userPath = (env.PATH ?? "").split(import_node_path47.delimiter).filter((d) => d && (elanHas || (0, import_node_path47.resolve)(d) !== (0, import_node_path47.resolve)(elanBin)));
-  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path47.delimiter);
+  const managedBin = (0, import_node_path48.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
+  const elanBin = (0, import_node_path48.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
+  const elanHas = (0, import_node_fs61.existsSync)((0, import_node_path48.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path48.delimiter).filter((d) => d && (elanHas || (0, import_node_path48.resolve)(d) !== (0, import_node_path48.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path48.delimiter);
   const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
-  const candidates2 = [(0, import_node_path47.join)(managedBin, exe), ...elanHas ? [(0, import_node_path47.join)(elanBin, exe)] : [], exe];
+  const candidates2 = [(0, import_node_path48.join)(managedBin, exe), ...elanHas ? [(0, import_node_path48.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
       (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
@@ -36437,7 +36532,7 @@ function proofsWorkspaceProblem(root) {
   for (const rel of [".verity", PROOFS_DIR, `${PROOFS_DIR}/.lake`]) {
     let st;
     try {
-      st = (0, import_node_fs61.lstatSync)((0, import_node_path47.join)(root, rel));
+      st = (0, import_node_fs61.lstatSync)((0, import_node_path48.join)(root, rel));
     } catch {
       break;
     }
@@ -36457,44 +36552,44 @@ function refused(problem) {
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return run2(tc, (0, import_node_path47.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return run2(tc, (0, import_node_path48.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 async function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return runAsync(tc, (0, import_node_path47.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return runAsync(tc, (0, import_node_path48.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
-  if (!rel.endsWith(".lean") || (0, import_node_path47.isAbsolute)(rel) || rel.startsWith("..")) return false;
+  if (!rel.endsWith(".lean") || (0, import_node_path48.isAbsolute)(rel) || rel.startsWith("..")) return false;
   return statRegularInRoot(modelsAbs, rel).ok;
 }
 function resolveModelFile(root, arg) {
-  const modelsAbs = (0, import_node_path47.join)(root, MODELS_DIR);
-  const asPath = (0, import_node_path47.relative)(modelsAbs, (0, import_node_path47.isAbsolute)(arg) ? arg : (0, import_node_path47.resolve)(root, arg));
+  const modelsAbs = (0, import_node_path48.join)(root, MODELS_DIR);
+  const asPath = (0, import_node_path48.relative)(modelsAbs, (0, import_node_path48.isAbsolute)(arg) ? arg : (0, import_node_path48.resolve)(root, arg));
   const candidates2 = arg.includes("/") || arg.includes("\\") ? [asPath] : [arg, `${arg}.lean`];
   for (const rel of candidates2) {
-    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path47.join)(modelsAbs, rel);
+    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path48.join)(modelsAbs, rel);
   }
   return null;
 }
 function listModelFiles(root) {
-  const modelsAbs = (0, import_node_path47.join)(root, MODELS_DIR);
+  const modelsAbs = (0, import_node_path48.join)(root, MODELS_DIR);
   if (!(0, import_node_fs61.existsSync)(modelsAbs)) return [];
-  return (0, import_node_fs61.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path47.join)(modelsAbs, f));
+  return (0, import_node_fs61.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path48.join)(modelsAbs, f));
 }
 function trimDiagnostics(text) {
   return text.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
 function checkModel(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path47.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path47.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path48.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path48.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path47.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path47.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path48.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path48.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
@@ -36503,10 +36598,10 @@ function toReport(res, root, modelFile, timeoutMs) {
   const parsed = parseVerityLines(res.stdout);
   const combined = `${res.stdout}
 ${res.stderr}`;
-  const name2 = parsed.header?.model ?? (0, import_node_path47.basename)(modelFile, ".lean");
+  const name2 = parsed.header?.model ?? (0, import_node_path48.basename)(modelFile, ".lean");
   const report = {
     model: name2,
-    file: (0, import_node_path47.relative)(root, modelFile),
+    file: (0, import_node_path48.relative)(root, modelFile),
     ok: res.ok,
     header: parsed.header,
     properties: parsed.properties,
@@ -37076,7 +37171,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path48.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path49.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -37198,7 +37293,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path48.relative)(root, (0, import_node_path48.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path49.relative)(root, (0, import_node_path49.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -37275,7 +37370,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path48.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path49.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -37537,7 +37632,7 @@ var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var VENDORED_READ_MAX_BYTES = 256 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path49.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path50.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve9) => {
@@ -37701,7 +37796,7 @@ function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedInte
       agent_harness: "claude-code",
       // Prefer the session id Claude Code passes on the hook payload; fall back
       // to the env var, then 'unknown'.
-      session_id: sessionId ?? process.env.CLAUDE_SESSION_ID ?? "unknown",
+      session_id: sessionId ?? envSessionId() ?? "unknown",
       trigger,
       iteration: iter + 1
     }
@@ -38229,7 +38324,7 @@ function writeBlockMessage(moment, response, covDetail) {
 // src/commands/ignore.ts
 function registerIgnoreCommand(program2) {
-  const ignore = program2.command("ignore").description("Declare the next turn (or a short window) as housekeeping \u2014 no review needed").option("--turn", "Cover the next turn only (the default)").option("--for <duration>", "Cover a window: 30m, 45s, 1h (max 60m)").option("--reason <reason>", "Why this window needs no review \u2014 required, and recorded").option("--agent", "Mark the declaration as agent-invoked (a ledger label, not a permission)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID)").option("--json", "Output raw JSON").action(async (opts) => {
+  const ignore = program2.command("ignore").description("Declare the next turn (or a short window) as housekeeping \u2014 no review needed").option("--turn", "Cover the next turn only (the default)").option("--for <duration>", "Cover a window: 30m, 45s, 1h (max 60m)").option("--reason <reason>", "Why this window needs no review \u2014 required, and recorded").option("--agent", "Mark the declaration as agent-invoked (a ledger label, not a permission)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID, then $CLAUDE_CODE_SESSION_ID)").option("--json", "Output raw JSON").action(async (opts) => {
     const globals = program2.opts();
     const now = Math.floor(Date.now() / 1e3);
     const reason = opts.reason?.trim();
@@ -38256,7 +38351,7 @@ function registerIgnoreCommand(program2) {
     }
     const tokenResult = await resolveToken(globals.token);
     const token = tokenResult.ok ? tokenResult.data.token : void 0;
-    const sessionId = opts.sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+    const sessionId = opts.sessionId || envSessionId();
     const keys = ignoreStateKeys(token, sessionId);
     const existing = resolveIgnoreState(keys);
     const spent = existing?.state.spent ?? 0;
@@ -38302,11 +38397,11 @@ function registerIgnoreCommand(program2) {
     printInfo(`Verity will skip ${window2} \u2014 "${reason}" (${spent + 1}/${IGNORE_BUDGET} this session).`);
     printInfo("It covers turns that author nothing. If anything is written, the declaration voids and the review runs.");
   });
-  ignore.command("clear").description("Cancel the active declaration (the spent budget is not refunded)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID)").action(async (opts) => {
+  ignore.command("clear").description("Cancel the active declaration (the spent budget is not refunded)").option("--session-id <id>", "Session id (defaults to $CLAUDE_SESSION_ID, then $CLAUDE_CODE_SESSION_ID)").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     const token = tokenResult.ok ? tokenResult.data.token : void 0;
-    const sessionId = opts.sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+    const sessionId = opts.sessionId || envSessionId();
     const found = resolveIgnoreState(ignoreStateKeys(token, sessionId));
     const active = resolveActive(found?.state ?? null, Math.floor(Date.now() / 1e3));
     if (!found || !active) {
@@ -38378,7 +38473,7 @@ function registerWaiveCommand(program2) {
 var import_node_fs68 = require("node:fs");
 var import_promises20 = require("node:fs/promises");
 var import_yaml6 = __toESM2(require_dist());
-var import_node_path53 = require("node:path");
+var import_node_path54 = require("node:path");
 var import_node_os11 = require("node:os");
 var import_node_child_process19 = require("node:child_process");
@@ -38830,7 +38925,7 @@ function registerDoctorCommand(program2) {
 // src/commands/migrate.ts
 var import_node_fs65 = require("node:fs");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -38867,8 +38962,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path50.join)(root, ".gate");
-  const verityDir = (0, import_node_path50.join)(root, ".verity");
+  const gateDir = (0, import_node_path51.join)(root, ".gate");
+  const verityDir = (0, import_node_path51.join)(root, ".verity");
   if ((0, import_node_fs65.existsSync)(gateDir) && !(0, import_node_fs65.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -38922,11 +39017,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path50.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path50.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path51.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path51.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs65.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs65.existsSync)(verityCreds)) {
-    (0, import_node_fs65.mkdirSync)((0, import_node_path50.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs65.mkdirSync)((0, import_node_path51.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -38948,7 +39043,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path50.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path51.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs65.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -38959,8 +39054,8 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path50.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path50.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path51.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path51.join)(root, "VERITY.md");
   if (!(0, import_node_fs65.existsSync)(gateMd) || (0, import_node_fs65.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
@@ -38977,7 +39072,7 @@ function migrateStandardFile(root, actions) {
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path50.join)(root, ".claude", "settings.local.json");
+  const file = (0, import_node_path51.join)(root, ".claude", "settings.local.json");
   if (!(0, import_node_fs65.existsSync)(file)) return;
   let settings;
   try {
@@ -39025,8 +39120,8 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
     toAppend.push(line2.replace(/\r$/, ""));
   }
   if (toAppend.length > 0) {
-    const sep6 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs65.writeFileSync)(verityCreds, verityContent + sep6 + toAppend.join("\n") + "\n");
+    const sep7 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
+    (0, import_node_fs65.writeFileSync)(verityCreds, verityContent + sep7 + toAppend.join("\n") + "\n");
   }
   (0, import_node_fs65.rmSync)(gateCreds, { force: true });
   return toAppend.length;
@@ -39067,15 +39162,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path50.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path51.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs65.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path50.join)(relDir, entry) : entry;
-      const src = (0, import_node_path50.join)(gateDir, rel);
-      const dest = (0, import_node_path50.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path51.join)(relDir, entry) : entry;
+      const src = (0, import_node_path51.join)(gateDir, rel);
+      const dest = (0, import_node_path51.join)(verityDir, rel);
       if ((0, import_node_fs65.statSync)(src).isDirectory()) {
         walk2(rel);
       } else if (!(0, import_node_fs65.existsSync)(dest)) {
-        (0, import_node_fs65.mkdirSync)((0, import_node_path50.dirname)(dest), { recursive: true });
+        (0, import_node_fs65.mkdirSync)((0, import_node_path51.dirname)(dest), { recursive: true });
         (0, import_node_fs65.cpSync)(src, dest);
         copied++;
       }
@@ -39085,22 +39180,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path50.join)(root, ".gate");
-  const verityDir = (0, import_node_path50.join)(root, ".verity");
+  const gateDir = (0, import_node_path51.join)(root, ".gate");
+  const verityDir = (0, import_node_path51.join)(root, ".verity");
   if ((0, import_node_fs65.existsSync)(gateDir) && !(0, import_node_fs65.existsSync)(verityDir)) return true;
   if ((0, import_node_fs65.existsSync)(gateDir) && (0, import_node_fs65.existsSync)(verityDir)) {
-    if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(gateDir, "credentials")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path51.join)(gateDir, "credentials")) && !(0, import_node_fs65.existsSync)((0, import_node_path51.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(gateDir, "memory")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path51.join)(gateDir, "memory")) && !(0, import_node_fs65.existsSync)((0, import_node_path51.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path50.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path51.join)(root, "CLAUDE.md");
   if ((0, import_node_fs65.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs65.existsSync)((0, import_node_path50.join)(root, "GATE.md")) && !(0, import_node_fs65.existsSync)((0, import_node_path50.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs65.existsSync)((0, import_node_path51.join)(root, "GATE.md")) && !(0, import_node_fs65.existsSync)((0, import_node_path51.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -39385,7 +39480,7 @@ var import_node_fs66 = require("node:fs");
 var import_node_crypto21 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
@@ -39399,7 +39494,7 @@ function freeBytes(dir) {
       const st = (0, import_node_fs66.statfsSync)(d);
       return Number(st.bavail) * Number(st.bsize);
     } catch {
-      const up = (0, import_node_path51.join)(d, "..");
+      const up = (0, import_node_path52.join)(d, "..");
       if (up === d) return null;
       d = up;
     }
@@ -39441,7 +39536,7 @@ function leanAssetName(version = pinnedVersion()) {
   return suffix ? `lean-${v}-${suffix}.zip` : null;
 }
 function pinnedVersionDir(env = process.env) {
-  return (0, import_node_path51.join)(verityLeanHome(env), pinnedVersion());
+  return (0, import_node_path52.join)(verityLeanHome(env), pinnedVersion());
 }
 function lakeBinary() {
   return (0, import_node_os10.platform)() === "win32" ? "lake.exe" : "lake";
@@ -39457,7 +39552,7 @@ function unzip(zip, dest) {
     } catch (err2) {
       errors.push(`${cmd}: ${String(err2.message).split("\n")[0].slice(0, 120)}`);
       try {
-        for (const e of (0, import_node_fs66.readdirSync)(dest)) (0, import_node_fs66.rmSync)((0, import_node_path51.join)(dest, e), { recursive: true, force: true });
+        for (const e of (0, import_node_fs66.readdirSync)(dest)) (0, import_node_fs66.rmSync)((0, import_node_path52.join)(dest, e), { recursive: true, force: true });
       } catch {
       }
     }
@@ -39533,10 +39628,10 @@ async function installLean(opts = {}) {
     const gb = (n) => (n / 1024 ** 3).toFixed(1);
     return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
   }
-  const tmp = (0, import_node_path51.join)(home, ".tmp");
+  const tmp = (0, import_node_path52.join)(home, ".tmp");
   (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
   (0, import_node_fs66.mkdirSync)(tmp, { recursive: true });
-  const zip = (0, import_node_path51.join)(tmp, asset);
+  const zip = (0, import_node_path52.join)(tmp, asset);
   say(`downloading ${url}`);
   let lastPct = -1;
   try {
@@ -39559,7 +39654,7 @@ async function installLean(opts = {}) {
     return { ok: false, error: verified.error };
   }
   say("unpacking (this takes a minute)");
-  const unpack = (0, import_node_path51.join)(tmp, "unpack");
+  const unpack = (0, import_node_path52.join)(tmp, "unpack");
   (0, import_node_fs66.mkdirSync)(unpack);
   const unpacked = unzip(zip, unpack);
   if (!unpacked.ok) {
@@ -39567,8 +39662,8 @@ async function installLean(opts = {}) {
     return { ok: false, error: `unpack failed: ${unpacked.error}` };
   }
   const entries = (0, import_node_fs66.readdirSync)(unpack);
-  const top = entries.length === 1 && (0, import_node_fs66.statSync)((0, import_node_path51.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path51.join)(unpack, entries[0]) : unpack;
-  if (!(0, import_node_fs66.existsSync)((0, import_node_path51.join)(top, "bin", lakeBinary()))) {
+  const top = entries.length === 1 && (0, import_node_fs66.statSync)((0, import_node_path52.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path52.join)(unpack, entries[0]) : unpack;
+  if (!(0, import_node_fs66.existsSync)((0, import_node_path52.join)(top, "bin", lakeBinary()))) {
     (0, import_node_fs66.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: "the archive did not contain bin/lake" };
   }
@@ -39582,7 +39677,7 @@ async function installLean(opts = {}) {
 // src/lib/remote-config.ts
 var import_node_fs67 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 var import_yaml5 = __toESM2(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -39658,9 +39753,9 @@ async function adoptRemoteSetup(found, opts) {
   written.push(VERITY_MD_FILE);
   return { written, notes };
 }
-async function writeOut(relative6, body2) {
-  const target = projectPath(relative6);
-  await (0, import_promises19.mkdir)((0, import_node_path52.dirname)(target), { recursive: true });
+async function writeOut(relative7, body2) {
+  const target = projectPath(relative7);
+  await (0, import_promises19.mkdir)((0, import_node_path53.dirname)(target), { recursive: true });
   await (0, import_promises19.writeFile)(target, body2);
 }
 function describeRemote(found) {
@@ -39777,15 +39872,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path53.join)(__dirname, "..", "data"),
+    (0, import_node_path54.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path53.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path54.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path53.join)(process.cwd(), "cli", "data")
+    (0, import_node_path54.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs68.existsSync)((0, import_node_path53.join)(candidate, "skills"))) {
+    if ((0, import_node_fs68.existsSync)((0, import_node_path54.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -39803,7 +39898,7 @@ async function skillIsCurrent(src, dest) {
     const walk2 = (d, prefix) => {
       for (const e of (0, import_node_fs68.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path53.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path54.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -39814,8 +39909,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises20.readFile)((0, import_node_path53.join)(src, rel), "utf-8");
-      const b = await (0, import_promises20.readFile)((0, import_node_path53.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises20.readFile)((0, import_node_path54.join)(src, rel), "utf-8");
+      const b = await (0, import_promises20.readFile)((0, import_node_path54.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -39911,7 +40006,7 @@ function parseTelemetryAnswer(raw) {
   return null;
 }
 function insideClaudeCode() {
-  return !!process.env.CLAUDECODE || !!process.env.CLAUDE_SESSION_ID;
+  return !!process.env.CLAUDECODE || !!envSessionId();
 }
 function resumeDeferredPending(previous) {
   return previous?.telemetry === "deferred";
@@ -40115,12 +40210,12 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path53.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path54.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path53.join)(skillsSource, skill);
-    const dest = (0, import_node_path53.join)(skillsDest, skill);
+    const src = (0, import_node_path54.join)(skillsSource, skill);
+    const dest = (0, import_node_path54.join)(skillsDest, skill);
     if (!(0, import_node_fs68.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
@@ -40274,7 +40369,7 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
   if (!toolchain) {
     const dir = pinnedVersionDir();
     const home = (0, import_node_os11.homedir)();
-    const shown = dir.startsWith(home + import_node_path53.sep) ? `~${dir.slice(home.length)}` : dir;
+    const shown = dir.startsWith(home + import_node_path54.sep) ? `~${dir.slice(home.length)}` : dir;
     console.log("");
     console.log(`    "yes" installs Lean 4 (${LEAN_DOWNLOAD_SIZE}) into ${shown}`);
   }
@@ -40436,7 +40531,7 @@ function registerInitCommand(program2) {
       untrackMemory: opts.untrackMemory === true,
       untrackState: opts.untrackState === true
     });
-    const globalVerityDir = (0, import_node_path53.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path54.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -40541,7 +40636,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.1-experimental.c910405" : "dev"
+          cli_version: true ? "0.34.2-experimental.d59d8cb" : "dev"
         }
       });
     } catch (err2) {
@@ -40592,7 +40687,7 @@ function registerInitCommand(program2) {
 // src/commands/uninstall.ts
 var import_node_fs69 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_path55 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -40601,7 +40696,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path54.join)(skillsRoot, name2);
+      const dir = (0, import_node_path55.join)(skillsRoot, name2);
       if ((0, import_node_fs69.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
@@ -40647,7 +40742,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path54.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path55.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs69.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -40678,9 +40773,26 @@ function registerUninstallCommand(program2) {
 // src/commands/task.ts
 function memoryPath() {
-  const sid = process.env.CLAUDE_SESSION_ID;
+  const sid = envSessionId();
   return sid ? `/memory?session_id=${encodeURIComponent(sid)}` : "/memory";
 }
+var TASK_STATUSES = ["active", "closed", "merged"];
+var TASK_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isTaskId(value) {
+  return typeof value === "string" && TASK_ID.test(value);
+}
+function taskListPath(status) {
+  if (status === void 0) return "/tasks";
+  if (!TASK_STATUSES.includes(status)) return null;
+  return `/tasks?status=${encodeURIComponent(status)}`;
+}
+function taskActionPath(taskId, action) {
+  return isTaskId(taskId) ? `/tasks/${encodeURIComponent(taskId)}/${action}` : null;
+}
+function refuse(message) {
+  printError(message);
+  process.exit(1);
+}
 function timeAgo2(isoDate) {
   const ms = Date.now() - new Date(isoDate).getTime();
   const mins = Math.floor(ms / 6e4);
@@ -40708,10 +40820,11 @@ function registerTaskCommands(program2) {
   task.command("list").description("List tasks").option("--status <status>", "Filter by status (active, closed, merged)").action(async (opts) => {
     const globals = program2.opts();
     const { token, serviceUrl } = await getAuth(globals);
-    const statusParam = opts.status ? `?status=${opts.status}` : "";
+    const listPath = taskListPath(opts.status);
+    if (!listPath) refuse(`Unknown status ${JSON.stringify(String(opts.status).slice(0, 40))} \u2014 use one of: ${TASK_STATUSES.join(", ")}`);
     const result = await apiRequest({
       method: "GET",
-      path: `/tasks${statusParam}`,
+      path: listPath,
       serviceUrl,
       token,
       verbose: globals.verbose,
@@ -40760,9 +40873,11 @@ function registerTaskCommands(program2) {
       }
       taskId = ct.id;
     }
+    const closePath = taskActionPath(taskId, "close");
+    if (!closePath) refuse(`Not a task id (expected a UUID): ${JSON.stringify(String(taskId).slice(0, 80))}`);
     const result = await apiRequest({
       method: "POST",
-      path: `/tasks/${taskId}/close`,
+      path: closePath,
       serviceUrl,
       token,
       verbose: globals.verbose,
@@ -40809,9 +40924,11 @@ function registerTaskCommands(program2) {
       }
       taskId = ct.id;
     }
+    const renamePath = taskActionPath(taskId, "rename");
+    if (!renamePath) refuse(`Not a task id (expected a UUID): ${JSON.stringify(String(taskId).slice(0, 80))}`);
     const result = await apiRequest({
       method: "POST",
-      path: `/tasks/${taskId}/rename`,
+      path: renamePath,
       serviceUrl,
       token,
       body: { label: label2.slice(0, 120) },
@@ -40826,6 +40943,9 @@ function registerTaskCommands(program2) {
   });
   task.command("merge <source> <target>").description("Merge source task into target task").action(async (source2, target) => {
     const globals = program2.opts();
+    if (!isTaskId(source2) || !isTaskId(target)) {
+      refuse("task merge takes two task ids (UUIDs): `verity task merge <source> <target>`");
+    }
     const { token, serviceUrl } = await getAuth(globals);
     const result = await apiRequest({
       method: "POST",
@@ -40846,7 +40966,7 @@ function registerTaskCommands(program2) {
 // src/commands/reset.ts
 var import_node_fs70 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_path56 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -40855,75 +40975,92 @@ function registerResetCommand(program2) {
         const tokenResult = await resolveToken(globals.token);
         const urlResult = await resolveServiceUrl(globals.serviceUrl);
         if (tokenResult.ok && urlResult.ok) {
+          const sessionId = envSessionId();
           const mem = await apiRequest({
             method: "GET",
-            path: process.env.CLAUDE_SESSION_ID ? `/memory?session_id=${encodeURIComponent(process.env.CLAUDE_SESSION_ID)}` : "/memory",
+            path: sessionId ? `/memory?session_id=${encodeURIComponent(sessionId)}` : "/memory",
             serviceUrl: urlResult.data,
             token: tokenResult.data.token,
             timeout: 1e4,
             cmd: "reset_lookup"
           });
           const ct = mem.ok ? mem.data.current_task : null;
-          if (ct?.id) {
+          const closePath = ct?.id ? taskActionPath(ct.id, "close") : null;
+          if (ct?.id && !closePath) {
+            printError("The current task in the service response has a malformed id \u2014 not closing it.");
+          }
+          if (closePath) {
             const closeResult = await apiRequest({
               method: "POST",
-              path: `/tasks/${ct.id}/close`,
+              path: closePath,
               serviceUrl: urlResult.data,
               token: tokenResult.data.token,
               timeout: 1e4,
               cmd: "reset_close"
             });
             if (closeResult.ok) {
-              printInfo(`Closed task: "${ct.label}"`);
+              printInfo(`Closed task: "${terminalText(ct?.label, 200) || "(unnamed)"}"`);
             }
           }
         }
       } catch {
       }
     }
-    const cacheDir = projectPath(CACHE_DIR);
-    let purged = 0;
-    if ((0, import_node_fs70.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs70.readdirSync)(cacheDir)) {
-        if (entry.startsWith("pending-")) {
-          try {
-            (0, import_node_fs70.unlinkSync)((0, import_node_path55.join)(cacheDir, entry));
-            purged++;
-          } catch {
-          }
-        }
-      }
-    }
+    const purged = purgeVerityDir((0, import_node_path56.basename)(CACHE_DIR), (name2) => name2.startsWith("pending-"));
+    if (purged === null) printError(`Did not purge ${CACHE_DIR}: it is not a directory inside ${VERITY_DIR}.`);
+    const stateDir2 = projectPath(VERITY_DIR);
     const filesToClear = [
-      projectPath(INTENT_FILE),
-      projectPath(HASH_FILE),
-      projectPath(BASELINE_SHA_FILE),
-      projectPath(`${VERITY_DIR}/.iteration-count`),
-      projectPath(`${VERITY_DIR}/.last-analysis`)
+      (0, import_node_path56.basename)(INTENT_FILE),
+      (0, import_node_path56.basename)(HASH_FILE),
+      (0, import_node_path56.basename)(BASELINE_SHA_FILE),
+      ".iteration-count",
+      ".last-analysis"
     ];
-    for (const file of filesToClear) {
-      if ((0, import_node_fs70.existsSync)(file)) {
-        try {
-          (0, import_node_fs70.writeFileSync)(file, "");
-        } catch {
-        }
+    for (const name2 of filesToClear) {
+      if (lstatOrNull((0, import_node_path56.join)(stateDir2, name2)) && !replaceInRoot(stateDir2, name2, "")) {
+        printError(`Did not clear ${VERITY_DIR}/${name2}: it is not a regular file inside ${VERITY_DIR}.`);
       }
     }
     if (opts.all) {
-      const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs70.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs70.readdirSync)(logsDir)) {
-          try {
-            (0, import_node_fs70.unlinkSync)((0, import_node_path55.join)(logsDir, entry));
-          } catch {
-          }
-        }
-      }
-      printInfo("Cleared diagnostic logs.");
+      const logs = purgeVerityDir(".logs", () => true);
+      if (logs === null) printError(`Did not clear ${VERITY_DIR}/.logs: it is not a directory inside ${VERITY_DIR}.`);
+      else printInfo("Cleared diagnostic logs.");
     }
-    printInfo(`Reset complete. Purged ${purged} cached request${purged !== 1 ? "s" : ""}.${opts.keepTask ? "" : " Next run starts a new task."}`);
+    const count = purged ?? 0;
+    printInfo(`Reset complete. Purged ${count} cached request${count !== 1 ? "s" : ""}.${opts.keepTask ? "" : " Next run starts a new task."}`);
   });
 }
+function lstatOrNull(path) {
+  try {
+    return (0, import_node_fs70.lstatSync)(path);
+  } catch {
+    return null;
+  }
+}
+function purgeVerityDir(child, select) {
+  const verityDir = projectPath(VERITY_DIR);
+  const dir = (0, import_node_path56.join)(verityDir, child);
+  const parent = lstatOrNull(verityDir);
+  const st = lstatOrNull(dir);
+  if (!st) return 0;
+  if (!parent || parent.isSymbolicLink() || !parent.isDirectory()) return null;
+  if (st.isSymbolicLink() || !st.isDirectory()) return null;
+  try {
+    if ((0, import_node_fs70.realpathSync)(dir) !== (0, import_node_path56.join)((0, import_node_fs70.realpathSync)(verityDir), child)) return null;
+  } catch {
+    return null;
+  }
+  let removed = 0;
+  for (const entry of (0, import_node_fs70.readdirSync)(dir, { withFileTypes: true })) {
+    if (entry.isDirectory() || !select(entry.name)) continue;
+    try {
+      (0, import_node_fs70.unlinkSync)((0, import_node_path56.join)(dir, entry.name));
+      removed++;
+    } catch {
+    }
+  }
+  return removed;
+}
 // src/commands/reflect.ts
 var import_node_fs71 = require("node:fs");
@@ -40995,7 +41132,7 @@ function registerReflectCommand(program2) {
     let taskResolution = "flag";
     let inheritedGlobs = [];
     if (!taskId) {
-      const sessionId = process.env.CLAUDE_SESSION_ID ?? "";
+      const sessionId = envSessionId() ?? "";
       const memPath = sessionId ? `/memory?session_id=${encodeURIComponent(sessionId)}` : "/memory";
       const mem = await apiRequest({
         method: "GET",
@@ -41481,7 +41618,7 @@ function registerTelemetryCommands(program2) {
 // src/commands/prove.ts
 var import_node_fs73 = require("node:fs");
-var import_node_path56 = require("node:path");
+var import_node_path57 = require("node:path");
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -41623,7 +41760,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path56.relative)(root, (0, import_node_path56.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path57.relative)(root, (0, import_node_path57.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -41677,7 +41814,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs73.existsSync)((0, import_node_path56.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs73.existsSync)((0, import_node_path57.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41701,7 +41838,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path56.relative)(root, f);
+      report.file = (0, import_node_path57.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -41739,7 +41876,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs73.existsSync)((0, import_node_path56.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs73.existsSync)((0, import_node_path57.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41770,7 +41907,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path56.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path57.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -41790,7 +41927,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path56.relative)(root, (0, import_node_path56.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path57.relative)(root, (0, import_node_path57.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -41864,7 +42001,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path56.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path57.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -41904,8 +42041,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path56.relative)(root, (0, import_node_path56.isAbsolute)(file) ? file : (0, import_node_path56.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path56.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path57.relative)(root, (0, import_node_path57.isAbsolute)(file) ? file : (0, import_node_path57.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path57.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -41921,8 +42058,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path56.relative)(root, (0, import_node_path56.isAbsolute)(file) ? file : (0, import_node_path56.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path56.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path57.relative)(root, (0, import_node_path57.isAbsolute)(file) ? file : (0, import_node_path57.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path57.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -41959,7 +42096,7 @@ function refreshScaffold(root) {
 var import_node_fs74 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 var import_node_os12 = require("node:os");
-var import_node_path57 = require("node:path");
+var import_node_path58 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -41976,7 +42113,7 @@ function registerLeanCommand(program2) {
     const managed = pinnedVersionDir();
     const matches = version ? version.includes(pin) : false;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs74.existsSync)((0, import_node_path57.join)(managed, "bin")), asset: leanAssetName() });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs74.existsSync)((0, import_node_path58.join)(managed, "bin")), asset: leanAssetName() });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -41994,7 +42131,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs74.existsSync)((0, import_node_path57.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs74.existsSync)((0, import_node_path58.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -42040,8 +42177,8 @@ function registerLeanCommand(program2) {
 }
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.1-experimental.c910405").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.1-experimental.c910405");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.2-experimental.d59d8cb").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.2-experimental.d59d8cb");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();