@codacy/verity-cli 0.35.5 → 0.36.0

package/bin/verity.js

@@ -926,8 +926,8 @@ var require_suggestSimilar = __commonJS2({
         if (candidate.length <= 1) return;
         const distance = editDistance(word, candidate);
         const length = Math.max(word.length, candidate.length);
-        const similarity = (length - distance) / length;
-        if (similarity > minSimilarity) {
+        const similarity2 = (length - distance) / length;
+        if (similarity2 > minSimilarity) {
           if (distance < bestDistance) {
             bestDistance = distance;
             similar = [candidate];
@@ -14442,11 +14442,61 @@ var {
   Help
 } = import_index.default;
 
-// src/commands/auth.ts
-var import_node_child_process5 = require("node:child_process");
+// src/lib/child-process.ts
+var cp = __toESM2(require("node:child_process"));
+var import_node_util = require("node:util");
+function hiddenOptions(options) {
+  return { ...options ?? {}, windowsHide: true };
+}
+function argvCall(rest) {
+  let [args2, options, callback] = rest;
+  if (!Array.isArray(args2)) {
+    if (typeof args2 === "function") {
+      callback = args2;
+      options = void 0;
+    } else if (args2 != null && typeof args2 === "object") {
+      callback = options;
+      options = args2;
+    }
+    args2 = [];
+  }
+  if (typeof options === "function") {
+    callback = options;
+    options = void 0;
+  }
+  return { args: args2, options: hiddenOptions(options), callback };
+}
+var execSync2 = ((command, options) => cp.execSync(command, hiddenOptions(options)));
+var execFileSync2 = ((file, ...rest) => {
+  const { args: args2, options } = argvCall(rest);
+  return cp.execFileSync(file, args2, options);
+});
+var spawnSync2 = ((command, ...rest) => {
+  const { args: args2, options } = argvCall(rest);
+  return cp.spawnSync(command, args2, options);
+});
+var spawn2 = ((command, ...rest) => {
+  const { args: args2, options } = argvCall(rest);
+  return cp.spawn(command, args2, options);
+});
+var spawnShown = ((command, ...rest) => {
+  const { args: args2, options } = argvCall(rest);
+  const { windowsHide: _hidden, ...shown } = options;
+  return cp.spawn(command, args2, shown);
+});
+var execFile2 = ((file, ...rest) => {
+  const { args: args2, options, callback } = argvCall(rest);
+  return cp.execFile(file, args2, options, callback);
+});
+var execFileAsync = (0, import_node_util.promisify)(cp.execFile);
+Object.defineProperty(execFile2, import_node_util.promisify.custom, {
+  value: (file, ...rest) => {
+    const { args: args2, options } = argvCall(rest);
+    return execFileAsync(file, args2, options);
+  }
+});
 
 // src/constants.ts
-var import_node_child_process = require("node:child_process");
 var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 
@@ -14532,7 +14582,7 @@ var _repoRoot = null;
 function repoRoot() {
   if (_repoRoot === null) {
     try {
-      _repoRoot = (0, import_node_child_process.execSync)("git rev-parse --show-toplevel", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+      _repoRoot = execFileSync2("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     } catch {
       _repoRoot = process.cwd();
     }
@@ -14547,7 +14597,7 @@ var _mainRoot;
 function mainWorktreeRoot() {
   if (_mainRoot !== void 0) return _mainRoot;
   try {
-    const common = (0, import_node_child_process.execSync)("git rev-parse --git-common-dir", {
+    const common = execFileSync2("git", ["rev-parse", "--git-common-dir"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -14824,7 +14874,6 @@ function rotateIfNeeded(file) {
 // src/lib/credentials.ts
 var import_promises = require("node:fs/promises");
 var import_node_path3 = require("node:path");
-var import_node_child_process2 = require("node:child_process");
 
 // src/lib/service-origin.ts
 var LEGACY = new URL(LEGACY_PROD_SERVICE_ORIGIN);
@@ -14860,7 +14909,7 @@ function globalCredentialsPath() {
 }
 function currentRemote() {
   try {
-    return (0, import_node_child_process2.execSync)("git remote get-url origin", {
+    return execFileSync2("git", ["remote", "get-url", "origin"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -15073,15 +15122,64 @@ async function foldLegacyLocalCredential(remoteArg) {
 }
 
 // src/lib/git.ts
-var import_node_child_process3 = require("node:child_process");
 var import_node_fs4 = require("node:fs");
 var import_node_path4 = require("node:path");
+
+// src/lib/secret-paths.ts
+var SECRET_SHAPED_PATHS = [
+  // dotenv and direnv
+  /(^|\/)\.env(\.[^/]*)?$/i,
+  /(^|\/)\.envrc$/i,
+  // private keys, keystores, encrypted vaults
+  /\.(pem|key|p8|p12|pfx|jks|keystore|asc|gpg|kdbx|keytab|ovpn)$/i,
+  /(^|\/)id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i,
+  // tools that keep a credential in a dotfile
+  /(^|\/)\.(npmrc|netrc|pypirc|pgpass|git-credentials|htpasswd|s3cfg|boto|dockercfg|terraformrc)$/i,
+  /(^|\/)terraform\.rc$/i,
+  // Terraform state and variables carry provider secrets in plain text
+  /\.tfstate(\.backup)?$/i,
+  /\.tfvars(\.json)?$/i,
+  // cloud service-account keys and kubeconfig
+  /(^|\/)[^/]*service[-_]?account[^/]*\.json$/i,
+  /(^|\/)application_default_credentials\.json$/i,
+  /(^|\/)kubeconfig(\.(ya?ml|json|conf))?$/i,
+  // A file NAMED credentials or secret(s), with ANY extension. ⚠ This includes
+  // source modules such as `src/config/secrets.ts` and `credentials.py`: such a
+  // module often holds the literal key, so it is withheld like any other secret.
+  // The cost: the AI reviewer never reads it. Trivy still scans it on the
+  // machine (git.ts filterSecurity), and its path is sent. The agent tools
+  // refused these names before this list was shared (agent-code-tools.test.ts).
+  /(^|\/)(credentials|secrets?)(\.[^/]*)?$/i,
+  // directories that hold nothing but credentials
+  /(^|\/)\.(ssh|aws|gnupg|docker|kube)(\/|$)/i,
+  /(^|\/)\.git(\/|$)/
+];
+var SECRET_WITHHELD_REASON = "secret-shaped-path";
+var SECRET_REFUSED_READ = "shaped like a secret: Verity never sends this file";
+function isSecretShapedPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return SECRET_SHAPED_PATHS.some((pattern) => pattern.test(normalized));
+}
+function scannerWitnessedWithheld(excluded, staticFindings) {
+  const norm3 = (p) => p.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
+  const withheld = new Set((excluded ?? []).filter((e) => e.reason === SECRET_WITHHELD_REASON).map((e) => norm3(e.path)));
+  if (withheld.size === 0) return [];
+  const out2 = /* @__PURE__ */ new Set();
+  for (const s of staticFindings ?? []) {
+    if (typeof s.file !== "string" || typeof s.tool !== "string" || s.tool.length === 0) continue;
+    const file = norm3(s.file);
+    if (withheld.has(file)) out2.add(file);
+  }
+  return [...out2];
+}
+
+// src/lib/git.ts
 function resolveFile(relpath) {
   return (0, import_node_fs4.existsSync)(relpath) ? relpath : null;
 }
-function execGit(cmd) {
+function execGit(...args2) {
   try {
-    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", args2, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -15122,20 +15220,25 @@ function writeBaselineSha(sha) {
 }
 function commitObjectExists(sha) {
   if (!SHA_RE.test(sha)) return false;
-  return execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  try {
+    execFileSync2("git", ["cat-file", "-e", `${sha}^{commit}`], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
 }
 function committedSinceRewrite(oldSha) {
   if (!SHA_RE.test(oldSha)) return [];
-  const newLocal = new Set(splitLines(execGit(`git rev-list HEAD --not ${oldSha} --remotes`)));
+  const newLocal = new Set(splitLines(execGit("rev-list", "HEAD", "--not", oldSha, "--remotes")));
   if (newLocal.size === 0) return [];
   const files = /* @__PURE__ */ new Set();
-  for (const line2 of splitLines(execGit(`git cherry ${oldSha} HEAD`))) {
+  for (const line2 of splitLines(execGit("cherry", oldSha, "HEAD"))) {
     const sp = line2.indexOf(" ");
     if (sp < 0) continue;
     const mark = line2.slice(0, sp);
     const sha = line2.slice(sp + 1).trim();
     if (mark !== "+" || !newLocal.has(sha)) continue;
-    for (const f of splitLines(execGit(`git diff-tree --no-commit-id --name-only -r ${sha}`))) files.add(f);
+    for (const f of splitLines(execGit("diff-tree", "--no-commit-id", "--name-only", "-r", sha))) files.add(f);
   }
   return [...files].filter((f) => !isVerityOwnedPath(f));
 }
@@ -15148,13 +15251,13 @@ function isVerityOwnedPath(file) {
 function getChangedFiles() {
   const sets = /* @__PURE__ */ new Set();
   let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  for (const f of splitLines(execGit("diff", "--name-only", "HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("diff", "--name-only", "--cached"))) sets.add(f);
+  for (const f of splitLines(execGit("ls-files", "--others", "--exclude-standard"))) sets.add(f);
   const rawBaseline = readRawBaselineSha();
   const baseline = readBaselineSha();
   if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    const committed = splitLines(execGit("diff", "--name-only", `${baseline}..HEAD`));
     if (committed.length > 0) {
       hasRecentCommitFiles = true;
       for (const f of committed) sets.add(f);
@@ -15167,12 +15270,12 @@ function getChangedFiles() {
       for (const f of committed) sets.add(f);
     }
   } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const headTimestamp = parseInt(execGit("log", "-1", "--format=%ct", "HEAD"), 10) || 0;
     const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    const hasUnstaged = splitLines(execGit("diff", "--name-only", "HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("diff", "--name-only", "--cached")).length > 0;
     if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      const recentFiles = splitLines(execGit("diff", "--name-only", "HEAD~1..HEAD"));
       if (recentFiles.length > 0) {
         hasRecentCommitFiles = true;
         for (const f of recentFiles) sets.add(f);
@@ -15184,16 +15287,16 @@ function getChangedFiles() {
 }
 function getDirtyFiles() {
   const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  for (const f of splitLines(execGit("diff", "--name-only", "HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("diff", "--name-only", "--cached"))) set.add(f);
+  for (const f of splitLines(execGit("ls-files", "--others", "--exclude-standard"))) set.add(f);
   return Array.from(set).filter((f) => !isVerityOwnedPath(f));
 }
 function showContentAtRef(ref, repoRelPath) {
   if (!ref || ref === "no-git") return null;
   const normalizedPath = repoRelPath.replace(/\\/g, "/");
   try {
-    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+    return execFileSync2("git", ["show", `${ref}:${normalizedPath}`], {
       encoding: "utf-8",
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["pipe", "pipe", "pipe"]
@@ -15221,20 +15324,20 @@ function filterReviewable(files) {
 }
 function filterSecurity(files) {
   return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f)) || isSecretShapedPath(f)
   );
 }
 function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
+  return execGit("rev-parse", "HEAD") || "no-git";
 }
 function getCurrentBranch() {
-  const b = execGit("git rev-parse --abbrev-ref HEAD");
+  const b = execGit("rev-parse", "--abbrev-ref", "HEAD");
   return !b || b === "HEAD" ? null : b;
 }
 function commitResolves(sha) {
   if (!sha) return false;
   try {
-    (0, import_node_child_process3.execFileSync)("git", ["merge-base", "--is-ancestor", sha, "HEAD"], {
+    execFileSync2("git", ["merge-base", "--is-ancestor", sha, "HEAD"], {
       stdio: ["pipe", "pipe", "pipe"]
     });
     return true;
@@ -15247,7 +15350,7 @@ function commitsSincePaths(sha, paths) {
   try {
     const args2 = ["rev-list", "--count", `${sha}..HEAD`];
     if (paths.length > 0) args2.push("--", ...paths.slice(0, 50));
-    const out2 = (0, import_node_child_process3.execFileSync)("git", args2, {
+    const out2 = execFileSync2("git", args2, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -15301,8 +15404,8 @@ function parseRemote(raw) {
 }
 function listTrackedFiles() {
   const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  for (const f of splitLines(execGit("ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("ls-files", "--others", "--exclude-standard"))) set.add(f);
   return Array.from(set);
 }
 function sanitizeRemote(remote) {
@@ -15351,7 +15454,7 @@ function pinRefusalMessage(verdict, targetUrl) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.5" : "dev";
+    return true ? "0.36.0" : "dev";
   } catch {
     return "dev";
   }
@@ -15730,7 +15833,6 @@ async function maybeHealServiceUrl(resolution, verbose) {
 var import_node_os2 = require("node:os");
 
 // src/lib/handoff.ts
-var import_node_child_process4 = require("node:child_process");
 function isHttpsPage(url) {
   try {
     const u = new URL(url);
@@ -15767,7 +15869,7 @@ function openInBrowser(url, opts = {}) {
   const cmd = launcher(platform4, url);
   if (!cmd) return false;
   try {
-    const child = (opts.run ?? import_node_child_process4.spawn)(cmd[0], cmd[1], { stdio: "ignore", detached: true });
+    const child = (opts.run ?? spawnShown)(cmd[0], cmd[1], { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -15791,7 +15893,7 @@ function copyToClipboard(text3, opts = {}) {
   if (env.SSH_CONNECTION || env.SSH_TTY || env.CI) return false;
   for (const [cmd, args2] of clipboards(platform4, env)) {
     try {
-      const r = (opts.run ?? import_node_child_process4.spawnSync)(cmd, args2, { input: text3, stdio: ["pipe", "ignore", "ignore"], timeout: 2e3 });
+      const r = (opts.run ?? spawnSync2)(cmd, args2, { input: text3, stdio: ["pipe", "ignore", "ignore"], timeout: 2e3 });
       if (!r.error && r.status === 0) return true;
     } catch {
     }
@@ -16245,7 +16347,7 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process5.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = execFileSync2("git", ["remote", "get-url", "origin"], { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -16297,7 +16399,7 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process5.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = execFileSync2("git", ["remote", "get-url", "origin"], { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -16963,7 +17065,6 @@ var import_yaml = __toESM2(require_dist());
 var import_node_path11 = require("node:path");
 
 // src/lib/detect.ts
-var import_node_child_process6 = require("node:child_process");
 var import_node_fs10 = require("node:fs");
 var import_node_path10 = require("node:path");
 
@@ -17058,8 +17159,12 @@ function collectCodeDelta(files, opts) {
   let truncationReason = null;
   const droppedPaths = [];
   const excluded = [];
-  const exclude = (path, reason) => excluded.push({ path, reason, stage: "collectCodeDelta", kind: "capacity" });
+  const exclude = (path, reason, kind2 = "capacity") => excluded.push({ path, reason, stage: "collectCodeDelta", kind: kind2 });
   for (const filepath of sorted) {
+    if (isSecretShapedPath(filepath)) {
+      exclude(filepath, SECRET_WITHHELD_REASON, "policy");
+      continue;
+    }
     if (result.length >= maxFiles) {
       truncationReason ??= "max_files";
       droppedPaths.push(filepath);
@@ -17229,7 +17334,7 @@ function isProjectFile(path) {
 }
 function listProjectFiles(root) {
   try {
-    const out2 = (0, import_node_child_process6.execSync)("git ls-files -z --cached --others --exclude-standard", {
+    const out2 = execFileSync2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       cwd: root,
       encoding: "utf-8",
       maxBuffer: 32 * 1024 * 1024,
@@ -17717,8 +17822,8 @@ var CLI_DECLARATION = {
 // src/lib/verity-md.ts
 var UNPRINTABLE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]+/g;
 function markdownPlain(text3, max = 200) {
-  const oneLine2 = text3.replace(UNPRINTABLE, " ").replace(/\s+/g, " ").trim();
-  const bounded = oneLine2.length > max ? `${oneLine2.slice(0, max - 1)}\u2026` : oneLine2;
+  const oneLine3 = text3.replace(UNPRINTABLE, " ").replace(/\s+/g, " ").trim();
+  const bounded = oneLine3.length > max ? `${oneLine3.slice(0, max - 1)}\u2026` : oneLine3;
   return bounded.replace(/[\\`*_{}[\]()<>#+!|~]/g, (c) => `\\${c}`);
 }
 function serviceLink(url) {
@@ -19183,7 +19288,6 @@ var import_node_fs13 = require("node:fs");
 var import_node_path14 = require("node:path");
 
 // src/lib/hardened-git.ts
-var import_node_child_process7 = require("node:child_process");
 var HARDENED_CONFIG_ARGS = [
   "-c",
   "core.fsmonitor=false",
@@ -19217,7 +19321,7 @@ function classifyError(err2) {
 }
 function runGitSync(cwd, args2, opts = {}) {
   try {
-    const stdout = (0, import_node_child_process7.execFileSync)("git", hardenedGitArgv(args2), {
+    const stdout = execFileSync2("git", hardenedGitArgv(args2), {
       cwd,
       env: hardenedGitEnv(),
       encoding: "utf-8",
@@ -19232,7 +19336,7 @@ function runGitSync(cwd, args2, opts = {}) {
 }
 function runGit(cwd, args2, opts = {}) {
   return new Promise((resolvePromise) => {
-    (0, import_node_child_process7.execFile)(
+    execFile2(
       "git",
       hardenedGitArgv(args2),
       {
@@ -20094,7 +20198,6 @@ var import_node_crypto10 = require("node:crypto");
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
 var import_node_fs19 = require("node:fs");
-var import_node_child_process8 = require("node:child_process");
 var import_node_crypto2 = require("node:crypto");
 function stripImageReferences(text3) {
   return text3.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
@@ -20197,8 +20300,9 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process8.execSync)(
-      'git log --since="30 minutes ago" --format="%s" -5',
+    const output = execFileSync2(
+      "git",
+      ["log", "--since=30 minutes ago", "--format=%s", "-5"],
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
     if (!output) return [];
@@ -21206,7 +21310,6 @@ var import_node_path23 = require("node:path");
 var import_node_crypto4 = require("node:crypto");
 
 // src/lib/gitignore.ts
-var import_node_child_process9 = require("node:child_process");
 var import_node_fs24 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
@@ -21247,7 +21350,7 @@ var SUPERSEDED_STANDARD_LINE = "!.verity/standard.yaml";
 var OLD_COMMENT_LINES = /* @__PURE__ */ new Set([SUPERSEDED_COMMENT, ...MEMORY_COMMENT]);
 function isIgnored3(path, opts = {}) {
   try {
-    (0, import_node_child_process9.execSync)(`git check-ignore -q ${opts.noIndex ? "--no-index " : ""}-- "${path}"`, { stdio: "pipe" });
+    execFileSync2("git", ["check-ignore", "-q", ...opts.noIndex ? ["--no-index"] : [], "--", path], { stdio: "pipe" });
     return true;
   } catch (err2) {
     return err2.status === 1 ? false : null;
@@ -21266,7 +21369,7 @@ function memoryPosture() {
 }
 function committedMemoryFiles() {
   try {
-    return (0, import_node_child_process9.execSync)("git ls-files -z -- .verity/memory", {
+    return execFileSync2("git", ["ls-files", "-z", "--", ".verity/memory"], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).split("\0").filter(Boolean);
@@ -21282,7 +21385,7 @@ function standardPosture() {
 }
 function committedStandardFile() {
   try {
-    return (0, import_node_child_process9.execSync)(`git ls-files -z -- ${STANDARD_PATH}`, {
+    return execFileSync2("git", ["ls-files", "-z", "--", STANDARD_PATH], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).split("\0").filter(Boolean).length > 0;
@@ -21366,7 +21469,7 @@ function ensureVerityGitignore() {
 function untrackMemory() {
   if (committedMemoryFiles().length === 0) return "none";
   try {
-    (0, import_node_child_process9.execSync)("git rm -r --cached --quiet -- .verity/memory", { stdio: "pipe" });
+    execFileSync2("git", ["rm", "-r", "--cached", "--quiet", "--", ".verity/memory"], { stdio: "pipe" });
     return "untracked";
   } catch {
     return "failed";
@@ -21441,7 +21544,7 @@ function untrackStandard() {
   }
   if (!committedStandardFile()) return { ok: true, untracked: false };
   try {
-    (0, import_node_child_process9.execSync)(`git rm --cached --quiet -- ${STANDARD_PATH}`, { stdio: "pipe" });
+    execFileSync2("git", ["rm", "--cached", "--quiet", "--", STANDARD_PATH], { stdio: "pipe" });
     return { ok: true, untracked: true };
   } catch {
     restore();
@@ -21473,7 +21576,7 @@ function keepMemoryTracked() {
 function committedVerityState() {
   let out2 = "";
   try {
-    out2 = (0, import_node_child_process9.execSync)("git ls-files -z -- .verity", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    out2 = execFileSync2("git", ["ls-files", "-z", "--", ".verity"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
   } catch {
     return [];
   }
@@ -21484,16 +21587,16 @@ function untrackVerityState() {
   if (tracked.length === 0) return "none";
   const standardWasTracked = committedStandardFile();
   try {
-    (0, import_node_child_process9.execSync)("git rm -r --cached --quiet -- .verity", { stdio: "pipe" });
+    execFileSync2("git", ["rm", "-r", "--cached", "--quiet", "--", ".verity"], { stdio: "pipe" });
     if (standardWasTracked) {
       try {
-        (0, import_node_child_process9.execSync)(`git add -f -- ${STANDARD_PATH}`, { stdio: "pipe" });
+        execFileSync2("git", ["add", "-f", "--", STANDARD_PATH], { stdio: "pipe" });
       } catch {
       }
     }
     if (memoryPosture() === "committable") {
       try {
-        (0, import_node_child_process9.execSync)("git add -- .verity/memory", { stdio: "pipe" });
+        execFileSync2("git", ["add", "--", ".verity/memory"], { stdio: "pipe" });
       } catch {
       }
     }
@@ -21637,6 +21740,152 @@ async function buildManifest() {
 function hashContent(content) {
   return `sha256:${(0, import_node_crypto4.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
 }
+var hashNodeContent = hashContent;
+async function writeNodeFile(relPath, content) {
+  const fullPath = resolveInside(memoryDir2(), relPath);
+  if (!fullPath) return false;
+  if (!await ensureDirInRepo((0, import_node_path23.dirname)(fullPath))) return false;
+  return writeInTree(fullPath, content);
+}
+async function writeContainedNodeFile(fullPath, content) {
+  if (!await ensureDirInRepo((0, import_node_path23.dirname)(fullPath))) return false;
+  return writeInTree(fullPath, content);
+}
+async function removeNodeFile(relPath) {
+  const fullPath = resolveInside(memoryDir2(), relPath);
+  if (!fullPath || !dirInRepo((0, import_node_path23.dirname)(fullPath))) return false;
+  try {
+    await (0, import_promises9.rm)(fullPath, { force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function dirInRepo(dir) {
+  try {
+    return isInsideRoot((0, import_node_fs26.realpathSync)(repoRoot()), (0, import_node_fs26.realpathSync)(dir));
+  } catch {
+    return false;
+  }
+}
+function memoryDirEscapesRepo() {
+  return (0, import_node_fs26.existsSync)(memoryDir2()) && !dirInRepo(memoryDir2());
+}
+async function ensureDirInRepo(dir) {
+  let probe = dir;
+  while (!(0, import_node_fs26.existsSync)(probe) && (0, import_node_path23.dirname)(probe) !== probe) probe = (0, import_node_path23.dirname)(probe);
+  if (!dirInRepo(probe)) return false;
+  await (0, import_promises9.mkdir)(dir, { recursive: true });
+  return dirInRepo(dir);
+}
+async function writeFileAtomicInTree(path, content) {
+  const dir = (0, import_node_path23.dirname)(path);
+  if (!await ensureDirInRepo(dir)) return false;
+  const real = (0, import_node_fs26.realpathSync)(dir);
+  const tmp = `.${(0, import_node_path23.basename)(path)}.${process.pid}.${Date.now()}.tmp`;
+  if (!createInRoot(real, tmp, content)) return false;
+  try {
+    await (0, import_promises9.rename)((0, import_node_path23.join)(real, tmp), (0, import_node_path23.join)(real, (0, import_node_path23.basename)(path)));
+    return true;
+  } catch {
+    try {
+      await (0, import_promises9.rm)((0, import_node_path23.join)(real, tmp), { force: true });
+    } catch {
+    }
+    return false;
+  }
+}
+async function markNodesSynced(entries) {
+  await mergeSyncBaseline(new Map(entries));
+}
+async function forgetSyncedNodes(paths) {
+  if (paths.length === 0 || !(0, import_node_fs26.existsSync)(syncStateFile())) return;
+  try {
+    try {
+      JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
+    } catch {
+      return;
+    }
+    const baseline = await readSyncBaseline();
+    let changed = false;
+    for (const p of paths) changed = baseline.delete(p) || changed;
+    if (!changed) return;
+    const nodes = [...baseline].map(([path, hash]) => ({ path, hash }));
+    await writeFileAtomic(syncStateFile(), JSON.stringify({ schema: 2, nodes }) + "\n");
+  } catch {
+  }
+}
+async function refreshMemoryIndex() {
+  await regenerateIndex();
+}
+async function appendMemoryLog(lines) {
+  try {
+    const logPath = (0, import_node_path23.join)(memoryDir2(), "log.md");
+    const existing = (0, import_node_fs26.existsSync)(logPath) ? await (0, import_promises9.readFile)(logPath, "utf-8") : "# Memory Log\n\n";
+    writeInTree(logPath, existing + lines.join("\n") + "\n");
+  } catch {
+  }
+}
+function uploadableNodeContent(content) {
+  const m = content.match(/^(---\n[\s\S]*?\n---\n)([\s\S]*)$/);
+  if (!m) return content;
+  const lines = m[2].split("\n");
+  let start2 = 0;
+  while (start2 < lines.length && lines[start2].trim() === "") start2++;
+  if (start2 < lines.length && /^# \S/.test(lines[start2])) start2++;
+  let end = lines.length;
+  const related = lines.lastIndexOf("## Related");
+  if (related >= start2) {
+    const tail = lines.slice(related + 1);
+    if (tail.every((l) => l.trim() === "" || /^\*\*[^*]+:\*\*$/.test(l.trim()) || /^- \[\[[^\]]+\]\]$/.test(l.trim()))) {
+      end = related;
+    }
+  }
+  const body2 = lines.slice(start2, end).join("\n").trim();
+  return `${storableFrontmatter(m[1])}
+${body2}
+`;
+}
+function bareStorableValue(value) {
+  if (value === "" || value !== value.trim() || /[\r\n]/.test(value)) return null;
+  if (/^(null|true|false)$/.test(value) || /^\d+(\.\d+)?$/.test(value)) return null;
+  if (value.startsWith('"') || value.startsWith("[") && value.endsWith("]")) return null;
+  return value;
+}
+function storableFrontmatter(block) {
+  const lines = block.split("\n");
+  let inGlobs = false;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line2 = lines[i2];
+    if (/^file_globs:\s*$/.test(line2)) {
+      inGlobs = true;
+      continue;
+    }
+    if (inGlobs && /^\s+-\s/.test(line2)) {
+      const q = line2.match(/^(\s+-\s+)("(?:[^"\\]|\\.)*")\s*$/);
+      if (q && q[2].includes("\\")) {
+        const bare = unquote(q[2]);
+        if (bare !== null && !bare.startsWith('"') && bare === bare.trim() && !/[\r\n]/.test(bare)) lines[i2] = `${q[1]}${bare}`;
+      }
+      continue;
+    }
+    inGlobs = false;
+    const t2 = line2.match(/^title:\s*("(?:[^"\\]|\\.)*")\s*$/);
+    if (t2 && t2[1].includes("\\")) {
+      const bare = unquote(t2[1]);
+      const storable = bare === null ? null : bareStorableValue(bare);
+      if (storable !== null) lines[i2] = `title: ${storable}`;
+    }
+  }
+  return lines.join("\n");
+}
+function unquote(quoted) {
+  try {
+    return String(JSON.parse(quoted));
+  } catch {
+    return null;
+  }
+}
 async function readOnDiskNodes() {
   const out2 = /* @__PURE__ */ new Map();
   if (!(0, import_node_fs26.existsSync)(memoryDir2())) return out2;
@@ -21706,7 +21955,7 @@ async function computeEditedNodeUploads() {
     } catch {
       continue;
     }
-    if (hashContent(content) !== prevHash) uploads.push({ path, content });
+    if (hashContent(content) !== prevHash) uploads.push({ path, content: uploadableNodeContent(content) });
   }
   return uploads;
 }
@@ -21792,10 +22041,14 @@ async function applyOneWrite(write, treePaths, lastServed) {
     if (existing !== "") {
       const served = lastServed?.get(write.path);
       if (served == null || served !== hashContent(existing)) {
-        notes.push(`${write.path}: kept local edit (differs from server)`);
-        return { written: false, syncedHash: null, notes };
+        if (nodeSubstance(existing) !== nodeSubstance(content)) {
+          notes.push(`${write.path}: kept local edit (differs from server)`);
+          return { written: false, syncedHash: null, notes };
+        }
+        notes.push(`${write.path}: updated from server (the local edit is already on the server)`);
+      } else {
+        notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
       }
-      notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
     }
   }
   await (0, import_promises9.mkdir)((0, import_node_path23.dirname)(fullPath), { recursive: true });
@@ -21805,6 +22058,15 @@ async function applyOneWrite(write, treePaths, lastServed) {
   }
   return { written: true, syncedHash: hashContent(content), notes };
 }
+var SERVER_OWNED_LINE = /^(schema|created_at|updated_at|session|task|run|related|supersedes|superseded_by|contradicts|caused_by|example_of|evidence_run_ids|pattern_ref|source|created_by|confidence):/;
+function nodeSubstance(content) {
+  const m = uploadableNodeContent(content).match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!m) return content;
+  const fm = m[1].split("\n").filter((l) => !SERVER_OWNED_LINE.test(l)).join("\n");
+  return `${fm}
+---
+${m[2].replace(/\s+$/, "")}`;
+}
 function groundFileGlobs(content, treePaths) {
   const globs = pickFrontmatterArray(content, "file_globs");
   if (globs.length === 0) return { content, dropped: [] };
@@ -24339,7 +24601,6 @@ var import_node_crypto11 = require("node:crypto");
 // src/lib/snapshot.ts
 var import_node_fs32 = require("node:fs");
 var import_node_path27 = require("node:path");
-var import_node_child_process10 = require("node:child_process");
 function generateSnapshotDiffs(files) {
   if (!(0, import_node_fs32.existsSync)(SNAPSHOT_DIR)) {
     return { diffs: [], has_snapshots: false };
@@ -24389,8 +24650,9 @@ function computeDiff(oldContent, newContent, filePath) {
     (0, import_node_fs32.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs32.writeFileSync)(tmpOld, oldContent);
     (0, import_node_fs32.writeFileSync)(tmpNew, newContent);
-    const result = (0, import_node_child_process10.execSync)(
-      `git diff --no-index --unified=10 -- "${tmpOld}" "${tmpNew}"`,
+    const result = execFileSync2(
+      "git",
+      ["diff", "--no-index", "--unified=10", "--", tmpOld, tmpNew],
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
     return result || null;
@@ -25142,7 +25404,7 @@ var EXCLUDED_DIR = /(^|\/)(node_modules|dist|build|bin|out|vendor|coverage|\.ver
 var TEST_PATH = /(^|\/)(tests?|__tests__|spec|specs|fixtures?|e2e|testdata)\/|\.(test|spec|stories)\.[cm]?[jt]sx?$|_test\.(go|py|rb)$|test_[^/]*\.py$/;
 var GENERATED2 = /\.d\.ts$|\.min\.[jt]s$|\.generated\.|\.pb\.|lock\.json$|\.lock$|(^|\/)(integrations\/supabase\/types|database\.types|supabase\.types)\.ts$|(^|\/)__generated__\//;
 function isCandidateSource(file) {
-  return SOURCE_EXT.test(file) && !EXCLUDED_DIR.test(file) && !TEST_PATH.test(file) && !GENERATED2.test(file);
+  return SOURCE_EXT.test(file) && !EXCLUDED_DIR.test(file) && !TEST_PATH.test(file) && !GENERATED2.test(file) && !isSecretShapedPath(file);
 }
 function collectHistory(root, opts = {}) {
   const args2 = [
@@ -27947,7 +28209,6 @@ var import_node_fs58 = require("node:fs");
 var import_node_path46 = require("node:path");
 
 // src/lib/repo-context.ts
-var import_node_child_process11 = require("node:child_process");
 var import_node_os5 = require("node:os");
 function rgInvocations(env = process.env) {
   const out2 = [{ cmd: "rg" }];
@@ -28507,7 +28768,7 @@ function partitionImporters(rgLines, changedPaths, opts) {
 function runRg(args2, cwd, timeoutMs) {
   let res = null;
   for (const inv of rgInvocations()) {
-    res = (0, import_node_child_process11.spawnSync)(inv.cmd, args2, {
+    res = spawnSync2(inv.cmd, args2, {
       ...inv.argv0 ? { argv0: inv.argv0 } : {},
       cwd,
       env: ripgrepEnv(),
@@ -28974,7 +29235,7 @@ function findMomentSegment(command, on) {
 function classifyCommand(command, on) {
   return findMomentSegment(command, on)?.moment ?? null;
 }
-function unquote(token) {
+function unquote2(token) {
   if (token.length >= 2) {
     const first = token[0];
     if ((first === "'" || first === '"') && token.endsWith(first)) return token.slice(1, -1);
@@ -28994,7 +29255,7 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       dir = (0, import_node_os6.homedir)();
       continue;
     }
-    const raw = unquote(m[1]);
+    const raw = unquote2(m[1]);
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
@@ -29013,7 +29274,7 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     let cm;
     while ((cm = cRe.exec(optsRegion)) !== null) {
       named = true;
-      const raw = unquote(cm[1]);
+      const raw = unquote2(cm[1]);
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
@@ -29029,7 +29290,7 @@ function parsePushTarget(segment) {
   const m = PUSH_RE.exec(segment);
   if (!m) return none;
   const rest = segment.slice(m.index + m[0].length);
-  const tokens = (rest.match(new RegExp(`'[^']*'|"[^"]*"|\\S+`, "g")) ?? []).map(unquote);
+  const tokens = (rest.match(new RegExp(`'[^']*'|"[^"]*"|\\S+`, "g")) ?? []).map(unquote2);
   let remote = null;
   let refspec = null;
   let isDelete = false;
@@ -29189,7 +29450,7 @@ var COMMIT_VALUE_OPTS = /* @__PURE__ */ new Set([
 var ADD_HEAD = `git${GIT_GLOBAL_OPTS}\\s+add(?![\\w-])`;
 var ADD_RE = new RegExp(`(?:^|[\\s;&|(])${ADD_HEAD}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${ADD_HEAD}`);
 function pathspecOf(word) {
-  const raw = unquote(word);
+  const raw = unquote2(word);
   if (!raw) return { reason: "an empty pathspec" };
   if (PATHSPEC_UNRESOLVABLE.test(raw)) {
     return { reason: `the shell rewrites the pathspec "${raw}" before git sees it` };
@@ -29306,12 +29567,57 @@ function stagedRange(frame, command) {
         if (wtVsHead.has(f) && wtVsMerge.has(f) && !isVerityOwnedPath(f)) resolutions.add(f);
       }
     }
-    return { kind: "merge", base: "HEAD", head: "INDEX", via: "merge-resolutions", files: [...resolutions] };
+    const parents = [objectId(frame, "HEAD"), objectId(frame, "MERGE_HEAD")];
+    const bases2 = parents.every((p) => p !== null) ? parents : void 0;
+    return { kind: "merge", base: "HEAD", head: "INDEX", via: "merge-resolutions", files: [...resolutions], ...bases2 ? { bases: bases2 } : {} };
   }
+  const bases = stagedBases(frame, command);
   if (plan.kind === "files") {
-    return { kind: "staged", base: "HEAD", head: "INDEX", via: plan.via, files: plan.files };
+    return { kind: "staged", base: "HEAD", head: "INDEX", via: plan.via, files: plan.files, ...bases ? { bases } : {} };
   }
-  return { kind: "staged", base: "HEAD", head: "INDEX", via: "index" };
+  return { kind: "staged", base: "HEAD", head: "INDEX", via: "index", ...bases ? { bases } : {} };
+}
+var OBJECT_ID_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+function objectId(frame, ref) {
+  const id = frameGit(frame, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]);
+  return OBJECT_ID_RE.test(id) ? id : null;
+}
+function stagedBases(frame, command) {
+  const head = objectId(frame, "HEAD");
+  if (head === null) return void 0;
+  if (!command || !commitAmends(command)) return [head];
+  const parents = frameGit(frame, ["rev-list", "--parents", "-n", "1", head]).split(" ").slice(1);
+  return parents.length > 0 && parents.every((p) => OBJECT_ID_RE.test(p)) ? parents : void 0;
+}
+function commitAmends(command) {
+  const found = findMomentSegment(command, ["commit"]);
+  if (!found) return false;
+  const words = shellWords(splitSegments(command)[found.segmentIndex]);
+  const at = words.indexOf("commit");
+  if (at === -1) return false;
+  let skipValue = false;
+  for (const word of words.slice(at + 1)) {
+    if (skipValue) {
+      skipValue = false;
+      continue;
+    }
+    if (word === "--") break;
+    if (!word.startsWith("--")) {
+      if (word.startsWith("-") && word.length > 1) {
+        for (let i2 = 1; i2 < word.length; i2++) {
+          if (COMMIT_VALUE_OPTS.has(`-${word[i2]}`)) {
+            if (i2 === word.length - 1) skipValue = true;
+            break;
+          }
+        }
+      }
+      continue;
+    }
+    const name2 = word.split("=")[0];
+    if (name2.length >= 4 && "--amend".startsWith(name2)) return true;
+    if (COMMIT_VALUE_OPTS.has(name2) && !word.includes("=")) skipValue = true;
+  }
+  return false;
 }
 function resolvePushRange(frame, command, on) {
   const nothing = (via2) => ({ kind: "nothing", base: null, head: "HEAD", via: via2 });
@@ -29328,13 +29634,15 @@ function resolvePushRange(frame, command, on) {
   if (commits.length === 0) return { kind: "nothing", base: null, head, via: "already-published" };
   const boundary = frameGit(frame, ["rev-list", head, "--not", remotePattern, "--boundary"]).split("\n").filter((l) => l.startsWith("-")).map((l) => l.slice(1));
   const base = boundary.find((s) => SHA_RE2.test(s)) ?? null;
+  const published = boundary.filter((s) => OBJECT_ID_RE.test(s));
+  const bases = published.length > 0 && published.length <= MAX_CHANGE_BASES ? published : void 0;
   const files = /* @__PURE__ */ new Set();
   for (const sha of commits) {
     for (const f of frameGit(frame, ["diff-tree", "--no-commit-id", "--name-only", "-r", sha]).split("\n")) {
       if (f && !isVerityOwnedPath(f)) files.add(f);
     }
   }
-  return { kind: "push", base, head, via, files: [...files], commits };
+  return { kind: "push", base, head, via, files: [...files], commits, ...bases ? { bases } : {} };
 }
 function rangeFiles(frame, range) {
   if (range.files) return range.files.filter((f) => !isVerityOwnedPath(f));
@@ -29378,6 +29686,226 @@ function rangeChangeSignals(frame, range, paths) {
   flush();
   return out2;
 }
+var MAX_CHANGE_BASES = 8;
+var CHANGED_LINES_BUDGET_MS = 1500;
+var MAX_RANGES_PER_FILE = 2e3;
+var HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+function withoutCr(line2) {
+  return line2 !== void 0 && line2.endsWith("\r") ? line2.slice(0, -1) : line2;
+}
+function bodyLines(lines) {
+  return lines.length > 0 && lines[lines.length - 1] === "" ? lines.slice(0, -1) : lines;
+}
+function parseChangedHunks(diff, sent, base) {
+  const lines = /* @__PURE__ */ new Set();
+  const removedAfter = /* @__PURE__ */ new Set();
+  const text3 = diff.split("\n");
+  const rebuilt = [];
+  let oldPos = 0;
+  let hunks = 0;
+  for (let i2 = 0; i2 < text3.length; i2++) {
+    if (text3[i2].startsWith("Binary files ")) return { reason: "binary" };
+    const h = HUNK_RE.exec(text3[i2]);
+    if (!h) continue;
+    hunks++;
+    const oldStart = Number(h[1]);
+    const oldCount = h[2] === void 0 ? 1 : Number(h[2]);
+    const newStart = Number(h[3]);
+    const newCount = h[4] === void 0 ? 1 : Number(h[4]);
+    if (base) {
+      const copyUntil = oldCount === 0 ? oldStart : oldStart - 1;
+      if (copyUntil < oldPos || copyUntil > base.length) return { reason: "snapshot-differs" };
+      for (; oldPos < copyUntil; oldPos++) rebuilt.push(base[oldPos]);
+    }
+    let seenOld = 0;
+    let seenNew = 0;
+    while (seenOld < oldCount || seenNew < newCount) {
+      i2++;
+      if (i2 >= text3.length) return { reason: "diff-truncated" };
+      const l = text3[i2];
+      if (l.startsWith("\\")) continue;
+      if (l.startsWith("-") && seenOld < oldCount) {
+        if (base) {
+          if (oldPos >= base.length || withoutCr(base[oldPos]) !== withoutCr(l.slice(1))) return { reason: "snapshot-differs" };
+          oldPos++;
+        }
+        seenOld++;
+        continue;
+      }
+      if (l.startsWith("+") && seenNew < newCount) {
+        const at = newStart + seenNew;
+        if (withoutCr(sent[at - 1]) !== withoutCr(l.slice(1))) return { reason: "bytes-differ" };
+        if (base) {
+          rebuilt.push(l.slice(1));
+          if (rebuilt.length !== at) return { reason: "snapshot-differs" };
+        }
+        lines.add(at);
+        seenNew++;
+        continue;
+      }
+      return { reason: "diff-unparsed" };
+    }
+    if (newCount === 0) {
+      if (base && rebuilt.length !== newStart) return { reason: "snapshot-differs" };
+      removedAfter.add(newStart);
+    }
+  }
+  if (hunks === 0) return { reason: "no-hunks" };
+  if (base) {
+    for (; oldPos < base.length; oldPos++) rebuilt.push(base[oldPos]);
+    const want = bodyLines(sent);
+    const got = bodyLines(rebuilt);
+    if (got.length !== want.length || got.some((l, k) => withoutCr(l) !== withoutCr(want[k]))) {
+      return { reason: "snapshot-differs" };
+    }
+  }
+  return { lines, removedAfter };
+}
+function intersect(a, b) {
+  return new Set([...a].filter((x) => b.has(x)));
+}
+function toRanges(lines) {
+  const sorted = [...lines].sort((x, y) => x - y);
+  const out2 = [];
+  for (const n2 of sorted) {
+    const last = out2[out2.length - 1];
+    if (last && n2 === last[1] + 1) last[1] = n2;
+    else out2.push([n2, n2]);
+  }
+  return out2;
+}
+function rangeChangedLines(frame, range, files, budgetMs = CHANGED_LINES_BUDGET_MS) {
+  const out2 = { files: [], omitted: {} };
+  const omit = (why) => {
+    out2.omitted[why] = (out2.omitted[why] ?? 0) + 1;
+  };
+  const bases = range.bases ?? [];
+  if (!frame.worktreeRoot || range.kind === "nothing" || bases.length === 0) {
+    for (const _ of files) omit("no-base");
+    return out2;
+  }
+  const deadline = Date.now() + budgetMs;
+  const blobAt = (rev, path) => {
+    const r = runGitSync(frame.worktreeRoot, ["cat-file", "blob", `${rev}:${path}`], {
+      timeoutMs: Math.max(1, deadline - Date.now())
+    });
+    if (!r.ok && r.error === "timeout") return "deadline";
+    return { text: r.ok ? r.stdout : null };
+  };
+  const merges = [];
+  {
+    const parentSets = [];
+    if (range.kind === "push") {
+      const commits = range.commits ?? [];
+      let readAll = commits.length > 0 && commits.length <= 100;
+      if (readAll) {
+        const r = runGitSync(frame.worktreeRoot, ["show", "-s", "--format=%P", ...commits], {
+          timeoutMs: Math.max(1, deadline - Date.now())
+        });
+        if (r.ok) {
+          for (const line2 of r.stdout.split("\n")) {
+            const ps = line2.trim().split(/\s+/).filter(Boolean);
+            if (ps.length >= 2) parentSets.push(ps);
+          }
+        } else readAll = false;
+      }
+      if (!readAll && bases.length > 1) parentSets.push(bases);
+    } else if (bases.length > 1) {
+      parentSets.push(bases);
+    }
+    for (const parents of parentSets) {
+      const mb = runGitSync(frame.worktreeRoot, ["merge-base", "--octopus", ...parents], {
+        timeoutMs: Math.max(1, deadline - Date.now())
+      });
+      merges.push({ parents, split: mb.ok ? mb.stdout.trim().split("\n")[0] || null : null });
+    }
+  }
+  const mergedByAMerge = (path) => {
+    for (const m of merges) {
+      const split = m.split === null ? void 0 : blobAt(m.split, path);
+      if (split === "deadline") return "deadline";
+      let first;
+      let changed = 0;
+      for (const parent of m.parents) {
+        const b = blobAt(parent, path);
+        if (b === "deadline") return "deadline";
+        if (split === void 0) {
+          if (first === void 0) first = b.text;
+          else if (b.text !== first) return true;
+        } else if (b.text !== split.text && ++changed >= 2) {
+          return true;
+        }
+      }
+    }
+    return false;
+  };
+  for (const file of files) {
+    if (typeof file.content !== "string") {
+      omit("no-content");
+      continue;
+    }
+    const sent = file.content.split("\n");
+    let lines = null;
+    let removedAfter = null;
+    let why = null;
+    const merged = mergedByAMerge(file.path);
+    if (merged !== false) {
+      omit(merged === "deadline" ? "deadline" : "merged-file");
+      continue;
+    }
+    for (const base of bases) {
+      const left = deadline - Date.now();
+      if (left <= 0) {
+        why = "deadline";
+        break;
+      }
+      const res = runGitSync(frame.worktreeRoot, [
+        "--literal-pathspecs",
+        "diff",
+        ...DIFF_READ_FLAGS,
+        "--no-color",
+        "--no-renames",
+        "-U0",
+        "--src-prefix=a/",
+        "--dst-prefix=b/",
+        base,
+        "--",
+        file.path
+      ], { timeoutMs: left });
+      if (!res.ok) {
+        why = res.error === "timeout" ? "deadline" : "git-failed";
+        break;
+      }
+      const blob = blobAt(base, file.path);
+      if (blob === "deadline") {
+        why = "deadline";
+        break;
+      }
+      const parsed = parseChangedHunks(res.stdout, sent, blob.text === null ? [] : blob.text.split("\n"));
+      if ("reason" in parsed) {
+        why = parsed.reason;
+        break;
+      }
+      lines = lines ? intersect(lines, parsed.lines) : parsed.lines;
+      removedAfter = removedAfter ? intersect(removedAfter, parsed.removedAfter) : parsed.removedAfter;
+    }
+    if (why !== null) {
+      omit(why);
+      continue;
+    }
+    if (!lines || !removedAfter || lines.size === 0 && removedAfter.size === 0) {
+      omit("no-change");
+      continue;
+    }
+    const ranges = toRanges(lines);
+    if (ranges.length + removedAfter.size > MAX_RANGES_PER_FILE) {
+      omit("too-many-ranges");
+      continue;
+    }
+    out2.files.push({ path: file.path, ranges, removed_after: [...removedAfter].sort((x, y) => x - y) });
+  }
+  return out2;
+}
 function rangeMessages(frame, range) {
   if (range.kind !== "push" || !range.commits || range.commits.length === 0) return "";
   const commits = range.commits.slice(0, 100);
@@ -30120,7 +30648,6 @@ async function sendSkipBeacon(ctx, reason) {
 }
 
 // src/lib/static-analysis.ts
-var import_node_child_process12 = require("node:child_process");
 var import_node_module = require("node:module");
 var import_node_path37 = require("node:path");
 var import_node_fs47 = require("node:fs");
@@ -30130,9 +30657,9 @@ var import_node_fs46 = require("node:fs");
 var import_node_path36 = require("node:path");
 var TRIVY_PATTERNS = [
   "Trivy_secret",
-  "Trivy_malicious_packages",
   "Trivy_vulnerability_critical",
-  "Trivy_vulnerability_high"
+  "Trivy_vulnerability_high",
+  "Trivy_malicious_packages"
 ];
 var TRIVY_TOOL = "trivy";
 function trivyConfig() {
@@ -30171,6 +30698,14 @@ var SEVERITY_ORDER = {
 function isCodacyAvailable() {
   return resolveAnalyzer() !== null;
 }
+var ANALYZER_PRIVACY_ENV = {
+  TRIVY_DISABLE_TELEMETRY: "true",
+  TRIVY_OFFLINE_SCAN: "true",
+  CODACY_DISABLE_UPDATE_CHECK: "1"
+};
+function analyzerEnv(env = process.env) {
+  return { ...env, ...ANALYZER_PRIVACY_ENV };
+}
 var NO_BUNDLED_ANALYZER_ENV = "VERITY_NO_BUNDLED_ANALYZER";
 function bundledAnalyzer(from = __filename) {
   try {
@@ -30199,7 +30734,7 @@ function analyzerCommand(analyzer, argv, execPath = process.execPath) {
   return { command: analyzer.path, args: argv };
 }
 function prewarmFile(root = repoRoot()) {
-  const listed = (0, import_node_child_process12.spawnSync)("git", ["ls-files", "-z"], { cwd: root, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 });
+  const listed = spawnSync2("git", ["ls-files", "-z"], { cwd: root, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 });
   if (listed.status !== 0 || typeof listed.stdout !== "string") return null;
   for (const file of listed.stdout.split("\0")) {
     if (!file) continue;
@@ -30232,10 +30767,11 @@ function startTrivyPrewarm(opts = {}) {
     const file = prewarmFile();
     if (!file) return false;
     const { command, args: args2 } = analyzerCommand(analyzer, buildAnalyzerArgv([file], config));
-    const child = (opts.run ?? import_node_child_process12.spawn)(command, args2, {
+    const child = (opts.run ?? spawn2)(command, args2, {
       cwd: repoRoot(),
       detached: true,
-      stdio: "ignore"
+      stdio: "ignore",
+      env: analyzerEnv(opts.env ?? process.env)
     });
     child.on("error", () => {
     });
@@ -30312,10 +30848,11 @@ function runCodacyAnalysis(files, opts = {}) {
   const resolved = resolveAnalyzer();
   const { command, args: args2 } = resolved ? analyzerCommand(resolved, argv) : { command: "codacy-analysis", args: argv };
   const timeoutMs = opts.timeoutMs ?? ANALYZER_TIMEOUT_MS;
-  const proc = (0, import_node_child_process12.spawnSync)(command, args2, {
+  const proc = spawnSync2(command, args2, {
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024,
-    timeout: timeoutMs
+    timeout: timeoutMs,
+    env: analyzerEnv()
   });
   if (proc.error?.code === "ETIMEDOUT") {
     const background = (opts.prewarm ?? startTrivyPrewarm)();
@@ -30682,6 +31219,7 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
+    if (isSecretShapedPath(specPath)) return true;
     if (!(0, import_node_fs48.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
@@ -30751,7 +31289,7 @@ function discoverPlans() {
       continue;
     }
     for (const f of names2) {
-      if (!f.endsWith(".md") || seen.has(f)) continue;
+      if (!f.endsWith(".md") || seen.has(f) || isSecretShapedPath(f)) continue;
       seen.add(f);
       const relPath = source2.prefix ? (0, import_node_path38.join)(source2.prefix, f) : f;
       const stat3 = statRegularInRoot(source2.root, relPath);
@@ -30787,6 +31325,7 @@ function discoverGuardDocs(rangeFiles2) {
   for (const path of rangeFiles2) {
     if (result.length >= MAX_SPEC_FILES) break;
     if (!GUARD_DOC_EXT.test(path)) continue;
+    if (isSecretShapedPath(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
     if (!(0, import_node_fs48.existsSync)(path)) continue;
     const opened = openRegularInRoot(process.cwd(), path);
@@ -31566,7 +32105,7 @@ async function evidence(run4) {
               run4,
               "No files within size limits to analyze",
               "size-limit",
-              codeDelta.excluded.length > 0 ? "capacity" : "policy"
+              codeDelta.excluded.some((e) => e.kind === "capacity") ? "capacity" : "policy"
             );
           }
         }
@@ -31671,6 +32210,10 @@ function gatherContextFiles(contextPaths, deltaFiles, opts) {
       logEvent("context_file_skipped", { path: filePath, reason: "verity_owned" });
       continue;
     }
+    if (isSecretShapedPath(filePath)) {
+      logEvent("context_file_skipped", { path: filePath, reason: "secret_shaped" });
+      continue;
+    }
     const safePath2 = resolveInside(process.cwd(), filePath);
     if (!safePath2) {
       logEvent("context_file_skipped", { path: filePath, reason: "outside_repo" });
@@ -31994,7 +32537,7 @@ function definitionsIn(root, spec) {
       } else if (p.type === "arguments" && moduleCall(p.parent)) {
         const call = p.parent;
         const route = p.namedChildren[0];
-        const quoted = route && route.id !== n2.id && route.type === "string" ? unquote2(route.text) : null;
+        const quoted = route && route.id !== n2.id && route.type === "string" ? unquote3(route.text) : null;
         const path = quoted && /^[\w/:.{}*-]{1,60}$/.test(quoted) ? quoted : null;
         const callee = call.childForFieldName("function").text;
         add(path ? `${callee} ${path}` : callee, kind3, call.parent, n2, call);
@@ -32009,7 +32552,7 @@ function moduleCall(call) {
   const f = call?.type === "call_expression" ? call.childForFieldName("function") : null;
   return !!f && (f.type === "identifier" || f.type === "member_expression") && f.text.length <= 40 && !f.text.includes("\n") && call.parent?.type === "expression_statement" && call.parent.parent?.type === "program";
 }
-function unquote2(s) {
+function unquote3(s) {
   const body2 = s.replace(/^[rRbBuUfF]{0,2}(?=["'`])/, "");
   const q3 = body2.startsWith('"""') || body2.startsWith("'''");
   return q3 ? body2.slice(3, -3) : body2.slice(1, -1);
@@ -32032,8 +32575,8 @@ function argsOf(args2, spec) {
   return list2.slice(0, MAX_ARGS).map((a) => {
     let literal = null;
     const left = a.type === "binary_expression" ? a.childForFieldName("left") : null;
-    if (spec.strings.has(a.type)) literal = unquote2(a.text);
-    else if (left && spec.strings.has(left.type)) literal = `${unquote2(left.text)}${PLACEHOLDER}`;
+    if (spec.strings.has(a.type)) literal = unquote3(a.text);
+    else if (left && spec.strings.has(left.type)) literal = `${unquote3(left.text)}${PLACEHOLDER}`;
     return { literal: literal === null ? null : cap(literal, LITERAL_CAP), text: cap(a.text, TEXT_CAP) };
   });
 }
@@ -32648,7 +33191,7 @@ function accessMap(input) {
     }
   };
   consider(fileFns, path, true, state);
-  const terms = [];
+  const terms2 = [];
   let files = 0;
   let truncated = false;
   if (input.source) {
@@ -32659,7 +33202,7 @@ function accessMap(input) {
           truncated = true;
           break;
         }
-        terms.push(term);
+        terms2.push(term);
         const found = input.source.search(term, { maxHits: 200, timeoutMs: Math.max(100, Math.min(800, input.deadlineAt - Date.now())), sourceOnly: true });
         if (!found.ok) {
           truncated = true;
@@ -32706,7 +33249,7 @@ function accessMap(input) {
       swallowedWrites: [...new Set(effects.filter((e) => e.op === "write" && e.caught === "swallow").map((e) => e.line))]
     },
     unknownResources: effects.filter((e) => e.resource.name === null || e.resource.confidence === "unknown").length,
-    searched: { terms, files, truncated }
+    searched: { terms: terms2, files, truncated }
   };
 }
 function renderEffect(e) {
@@ -33203,9 +33746,9 @@ function tsCandidates(spec, fromPath, cfg) {
   }
   const out2 = [];
   for (const b of bases) {
-    const stem = b.replace(/\.(?:js|jsx|mjs|cjs)$/, "");
+    const stem2 = b.replace(/\.(?:js|jsx|mjs|cjs)$/, "");
     if (languageOf2(b)) out2.push(b);
-    for (const e of TS_EXTS) out2.push(`${stem}${e}`);
+    for (const e of TS_EXTS) out2.push(`${stem2}${e}`);
     for (const e of TS_EXTS) out2.push(`${b}/index${e}`);
   }
   return [...new Set(out2)];
@@ -33802,10 +34345,10 @@ var writersOfTool = async (ctx, args2) => {
   if (name2.length < 2) return { ok: false, error: "resource name too short to search for" };
   const deadline = Date.now() + TOOL_MS;
   const src = source(ctx);
-  const terms = [.../* @__PURE__ */ new Set([name2, ...searchTerms({ kind: "table", name: name2, confidence: "inferred" })])];
+  const terms2 = [.../* @__PURE__ */ new Set([name2, ...searchTerms({ kind: "table", name: name2, confidence: "inferred" })])];
   const files = /* @__PURE__ */ new Set();
   let truncated = false;
-  for (const t2 of terms) {
+  for (const t2 of terms2) {
     const found = src.search(t2, { maxHits: 300, timeoutMs: Math.max(100, deadline - Date.now()) });
     if (!found.ok) {
       truncated = true;
@@ -33867,17 +34410,38 @@ var TOOL_LIMITS = {
   diffTimeoutMs: 1e4,
   concurrency: 4
 };
-var DENIED_PATHS = [
-  /(^|\/)\.env(\.[^/]*)?$/i,
-  /\.(pem|key|p12|pfx|jks|keystore|asc|gpg|kdbx)$/i,
-  /(^|\/)id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i,
-  /(^|\/)\.(npmrc|netrc|pypirc|pgpass|git-credentials)$/i,
-  /(^|\/)(credentials|secrets?)(\.[^/]*)?$/i,
-  /(^|\/)\.(ssh|aws|gnupg|docker)(\/|$)/i,
-  /(^|\/)\.git(\/|$)/
-];
 function isDeniedPath(path) {
-  return DENIED_PATHS.some((pattern) => pattern.test(path)) || isVerityOwnedPath(path);
+  return isSecretShapedPath(path) || isVerityOwnedPath(path);
+}
+function diffChunkPaths(chunk) {
+  const out2 = /* @__PURE__ */ new Set();
+  const header = /^diff --git a\/(.+?) b\/(.+)$/m.exec(chunk);
+  if (header) {
+    out2.add(header[1]);
+    out2.add(header[2]);
+  }
+  for (const re of [/^--- a\/(.+)$/m, /^\+\+\+ b\/(.+)$/m, /^rename from (.+)$/m, /^rename to (.+)$/m, /^copy from (.+)$/m, /^copy to (.+)$/m]) {
+    const m = re.exec(chunk);
+    if (m) out2.add(m[1]);
+  }
+  return [...out2];
+}
+function withoutDeniedDiffs(diff) {
+  const kept = [];
+  const withheld = /* @__PURE__ */ new Set();
+  for (const chunk of diff.split(/^(?=diff --git )/m)) {
+    if (!chunk.startsWith("diff --git ")) {
+      if (chunk.trim()) kept.push(chunk);
+      continue;
+    }
+    const paths = diffChunkPaths(chunk);
+    if (paths.length === 0 || paths.some((p) => isDeniedPath(p))) {
+      withheld.add(paths[paths.length - 1] ?? "(a path that could not be read)");
+      continue;
+    }
+    kept.push(chunk);
+  }
+  return { text: kept.join(""), withheld: [...withheld] };
 }
 function validateRepoPath(value, { allowRoot = false } = {}) {
   if (typeof value !== "string") return { ok: false, error: "path must be a string" };
@@ -33984,7 +34548,12 @@ var gitDiffTool = async (ctx, args2) => {
   }
   const res = await git(ctx, ["--literal-pathspecs", ...diffArgs, "--", path.value]);
   if (!res.ok) return { ok: false, error: gitFailure(res, "diff") };
-  return { ok: true, value: res.stdout.trim() ? capOutput(res.stdout) : `no changes to ${path.value} in the change under review` };
+  if (!res.stdout.trim()) return { ok: true, value: `no changes to ${path.value} in the change under review` };
+  const { text: text3, withheld } = withoutDeniedDiffs(res.stdout);
+  const note = withheld.length > 0 ? `
+[not shown: ${withheld.length} file(s) shaped like secrets or owned by Verity: ${withheld.slice(0, 20).join(", ")}]` : "";
+  if (!text3.trim()) return { ok: true, value: `no reviewable changes to ${path.value} in the change under review${note}` };
+  return { ok: true, value: capOutput(text3) + note };
 };
 var gitLogTool = async (ctx, args2) => {
   const path = validateRepoPath(args2.path);
@@ -34361,23 +34930,23 @@ function deriveSeedNodes(inputs) {
   const out2 = [];
   const ks = inputs.knowledgeSpec;
   if (ks.project_name) {
-    const bodyLines = [];
+    const bodyLines2 = [];
     const arch3 = ks.architecture ? `${ks.architecture} ` : "";
     const langs = (ks.languages ?? []).filter(Boolean);
     const frameworks2 = (ks.frameworks ?? []).filter(Boolean);
     const primaryLang = langs[0] ?? "software";
-    bodyLines.push(`**${ks.project_name}** is a ${arch3}${primaryLang} project.`);
-    bodyLines.push("");
-    if (langs.length > 0) bodyLines.push(`- **Languages:** ${langs.join(", ")}`);
-    if (frameworks2.length > 0) bodyLines.push(`- **Frameworks:** ${frameworks2.join(", ")}`);
-    if (ks.build_system) bodyLines.push(`- **Build system:** ${ks.build_system}`);
-    if (ks.test_framework) bodyLines.push(`- **Test framework:** ${ks.test_framework}`);
-    bodyLines.push("");
-    bodyLines.push("_Generated from the Standard synthesized by `/verity-setup`. Edit this file to add project context._");
+    bodyLines2.push(`**${ks.project_name}** is a ${arch3}${primaryLang} project.`);
+    bodyLines2.push("");
+    if (langs.length > 0) bodyLines2.push(`- **Languages:** ${langs.join(", ")}`);
+    if (frameworks2.length > 0) bodyLines2.push(`- **Frameworks:** ${frameworks2.join(", ")}`);
+    if (ks.build_system) bodyLines2.push(`- **Build system:** ${ks.build_system}`);
+    if (ks.test_framework) bodyLines2.push(`- **Test framework:** ${ks.test_framework}`);
+    bodyLines2.push("");
+    bodyLines2.push("_Generated from the Standard synthesized by `/verity-setup`. Edit this file to add project context._");
     out2.push({
       kind: "domain",
       title: "Project overview",
-      body: bodyLines.join("\n"),
+      body: bodyLines2.join("\n"),
       domains: [],
       // Broad globs so the overview surfaces on any source file change.
       // It's the project's anchor node — cheap to inject, high signal.
@@ -34457,10 +35026,10 @@ var NODE_DIRS = ["decisions", "quality", "security", "intent", "gotchas", "patte
 function normalizeTitle(title) {
   return title.trim().replace(/\s+/g, " ").toLowerCase();
 }
-async function localSeedTitles(memoryDir3 = MEMORY_DIR) {
+async function localSeedTitles(memoryDir4 = MEMORY_DIR) {
   const titles = /* @__PURE__ */ new Set();
   for (const dir of NODE_DIRS) {
-    const full = (0, import_node_path42.join)(memoryDir3, dir);
+    const full = (0, import_node_path42.join)(memoryDir4, dir);
     if (!(0, import_node_fs53.existsSync)(full)) continue;
     let files;
     try {
@@ -34506,18 +35075,20 @@ function pickFrontmatterTitle(content) {
   }
   return raw;
 }
-async function serverSeedTitles(opts) {
-  const res = await apiRequest({
-    method: "GET",
-    path: "/compound/memory/nodes?created_by=seed&status=active&limit=100",
-    serviceUrl: opts.serviceUrl,
-    token: opts.token,
-    verbose: opts.verbose,
-    cmd: "memory_seed"
-  });
-  if (!res.ok || !Array.isArray(res.data.nodes)) return null;
+async function serverSeedTitles(opts, statuses = ["active"]) {
   const titles = /* @__PURE__ */ new Set();
-  for (const n2 of res.data.nodes) if (typeof n2?.title === "string") titles.add(normalizeTitle(n2.title));
+  for (const status of statuses) {
+    const res = await apiRequest({
+      method: "GET",
+      path: `/compound/memory/nodes?created_by=seed&status=${encodeURIComponent(status)}&limit=100`,
+      serviceUrl: opts.serviceUrl,
+      token: opts.token,
+      verbose: opts.verbose,
+      cmd: "memory_seed"
+    });
+    if (!res.ok || !Array.isArray(res.data.nodes)) return null;
+    for (const n2 of res.data.nodes) if (typeof n2?.title === "string") titles.add(normalizeTitle(n2.title));
+  }
   return titles;
 }
 function renderNodeMarkdown(candidate, nodeId, createdAt) {
@@ -34608,6 +35179,13 @@ async function runSeed(opts) {
         if (toPost.length === 0) {
           return { created: 0, existing: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
         }
+        const retired = await serverSeedTitles(opts, ["archived", "superseded"]);
+        if (retired) {
+          toPost = toPost.filter((c) => !retired.has(normalizeTitle(c.title)));
+          if (toPost.length === 0) {
+            return { created: 0, existing: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
+          }
+        }
       }
     }
   }
@@ -34657,8 +35235,9 @@ async function runSeed(opts) {
     }
     const content = typeof res.data.content === "string" && res.data.content.length > 0 ? res.data.content : renderNodeMarkdown(c, nodeId, createdAt);
     try {
-      await (0, import_promises11.mkdir)((0, import_node_path42.dirname)(targetPath), { recursive: true });
-      await (0, import_promises11.writeFile)(targetPath, content);
+      if (!await writeContainedNodeFile(targetPath, content)) {
+        throw new Error("refused: a link, or a folder outside the repository");
+      }
       if (deduplicated) existing++;
       else {
         created++;
@@ -34997,7 +35576,6 @@ function isExplicitlyAutonomous(env = process.env) {
 }
 
 // src/lib/task-context.ts
-var import_node_child_process13 = require("node:child_process");
 var CLOSING_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\b[\s:]*#(\d+)/i;
 var BRANCH_RE = /(?:^|[/_-])(?:issue|gh|fix)[-_/]?(\d+)\b/i;
 function parseLinkedIssue(sources) {
@@ -35013,7 +35591,7 @@ function parseLinkedIssue(sources) {
 }
 function safeExec(cmd, timeout) {
   try {
-    return (0, import_node_child_process13.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
+    return execSync2(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
   } catch {
     return "";
   }
@@ -35791,7 +36369,6 @@ function describeRelease(release, input) {
 }
 
 // src/lib/memory-pull.ts
-var import_node_child_process14 = require("node:child_process");
 var import_promises12 = require("node:fs/promises");
 var pullStateFile = () => projectPath(`${VERITY_DIR}/.memory-pull-state.json`);
 var PAGE_SIZE = 200;
@@ -35882,6 +36459,13 @@ async function recordServedFiles(served) {
   for (const [path, hash] of served) state.served.set(path, hash);
   await writePullState(state);
 }
+async function forgetServedFiles(paths) {
+  if (paths.length === 0) return;
+  const state = await readPullState();
+  let changed = false;
+  for (const p of paths) changed = state.served.delete(p) || changed;
+  if (changed) await writePullState(state);
+}
 async function readPullState() {
   try {
     const parsed = JSON.parse(await (0, import_promises12.readFile)(pullStateFile(), "utf-8"));
@@ -35914,7 +36498,7 @@ function pullsAtSessionStart(auth3, source2) {
 }
 function spawnBackgroundPull(deps = {}) {
   const d = {
-    spawn: import_node_child_process14.spawn,
+    spawn: spawn2,
     execPath: process.execPath,
     script: process.argv[1],
     cwd: process.cwd(),
@@ -36371,12 +36955,10 @@ async function runAnalyze(opts, globals) {
 
 // src/lib/prove/lean-background.ts
 var import_node_fs63 = require("node:fs");
-var import_node_child_process17 = require("node:child_process");
 var import_node_crypto18 = require("node:crypto");
 var import_node_path51 = require("node:path");
 
 // src/lib/prove/runner.ts
-var import_node_child_process15 = require("node:child_process");
 var import_node_os9 = require("node:os");
 var import_node_fs61 = require("node:fs");
 var import_node_os10 = require("node:os");
@@ -37114,7 +37696,7 @@ function findToolchain(env = process.env) {
   const candidates2 = [(0, import_node_path49.join)(managedBin, exe), ...elanHas ? [(0, import_node_path49.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
-      (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
+      execFileSync2(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
       return { lake: candidate, env: merged };
     } catch {
     }
@@ -37125,7 +37707,7 @@ var INSTALL_HINT = "Lean 4 is not installed. Run `verity lean install` (official
 function run2(tc, cwd, args2, timeoutMs) {
   const started = Date.now();
   try {
-    const stdout = (0, import_node_child_process15.execFileSync)(tc.lake, args2, {
+    const stdout = execFileSync2(tc.lake, args2, {
       cwd,
       env: tc.env,
       encoding: "utf-8",
@@ -37151,7 +37733,7 @@ function runAsync(tc, cwd, args2, timeoutMs) {
   const MAX = 16 * 1024 * 1024;
   return new Promise((resolve10) => {
     const posix = (0, import_node_os9.platform)() !== "win32";
-    const child = (0, import_node_child_process15.spawn)(tc.lake, args2, { cwd, env: tc.env, stdio: ["ignore", "pipe", "pipe"], detached: posix });
+    const child = spawn2(tc.lake, args2, { cwd, env: tc.env, stdio: ["ignore", "pipe", "pipe"], detached: posix });
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -37238,18 +37820,21 @@ function listModelFiles(root) {
 function trimDiagnostics(text3) {
   return text3.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
+function leanFileArg(rel) {
+  return rel.startsWith("-") ? `./${rel}` : rel;
+}
 function checkModel(tc, root, modelFile, opts = {}) {
   const proofsAbs = (0, import_node_path49.join)(root, PROOFS_DIR);
   const rel = (0, import_node_path49.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
-  const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
+  const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", leanFileArg(rel)], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
   const proofsAbs = (0, import_node_path49.join)(root, PROOFS_DIR);
   const rel = (0, import_node_path49.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
-  const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
+  const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", leanFileArg(rel)], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 function toReport(res, root, modelFile, timeoutMs) {
@@ -37303,7 +37888,6 @@ function writeResult(root, report) {
 // src/lib/prove/lean-install.ts
 var import_node_fs62 = require("node:fs");
 var import_node_crypto17 = require("node:crypto");
-var import_node_child_process16 = require("node:child_process");
 var import_node_os11 = require("node:os");
 var import_node_path50 = require("node:path");
 var import_promises13 = require("node:stream/promises");
@@ -37374,7 +37958,7 @@ function unzip(zip, dest) {
   const errors = [];
   for (const [cmd, args2] of attempts) {
     try {
-      (0, import_node_child_process16.execFileSync)(cmd, args2, { stdio: ["ignore", "ignore", "pipe"], timeout: 15 * 6e4 });
+      execFileSync2(cmd, args2, { stdio: ["ignore", "ignore", "pipe"], timeout: 15 * 6e4 });
       if ((0, import_node_fs62.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
       errors.push(`${cmd}: produced nothing`);
     } catch (err2) {
@@ -37577,7 +38161,7 @@ function startBackgroundInstall(opts) {
     (0, import_node_fs63.mkdirSync)(home, { recursive: true });
     const log = (0, import_node_fs63.openSync)((0, import_node_path51.join)(home, LOG_FILE), import_node_fs63.constants.O_WRONLY | import_node_fs63.constants.O_APPEND | import_node_fs63.constants.O_CREAT | (import_node_fs63.constants.O_NOFOLLOW ?? 0), 384);
     try {
-      const child = (opts.run ?? import_node_child_process17.spawn)(process.execPath, [opts.cli, "lean", "install", "--yes", "--background"], {
+      const child = (opts.run ?? spawn2)(process.execPath, [opts.cli, "lean", "install", "--yes", "--background"], {
         detached: true,
         stdio: ["ignore", log, log],
         env: { ...env, DO_NOT_TRACK: env.DO_NOT_TRACK ?? "1" }
@@ -38424,6 +39008,7 @@ var deterministicRanker = {
   }
 };
 function excerpt(root, file, bytes, readSource, changed, codeMap, codeSource) {
+  if (isSecretShapedPath(file)) return "";
   const read2 = readSource ? readSource(file, EXCERPT_SOURCE_CAP_BYTES) : readRegularFileInRoot(root, file, EXCERPT_SOURCE_CAP_BYTES);
   if (!read2.ok) return "";
   if (changed && changed.length > 0) {
@@ -39554,7 +40139,7 @@ function isTrackedInRoot(root, file) {
 }
 function buildReplayBrief(root, report, property, modelSource, readSource) {
   const sources = (report.header?.abstracts ?? []).map((a) => {
-    const read2 = readSource ? readSource(a.file, MAX_SOURCE_BYTES) : isTrackedInRoot(root, a.file) ? readRegularFileInRoot(root, a.file, MAX_SOURCE_BYTES) : { ok: false, reason: "not tracked by git \u2014 models may only abstract tracked source" };
+    const read2 = isSecretShapedPath(a.file) ? { ok: false, reason: SECRET_REFUSED_READ } : readSource ? readSource(a.file, MAX_SOURCE_BYTES) : isTrackedInRoot(root, a.file) ? readRegularFileInRoot(root, a.file, MAX_SOURCE_BYTES) : { ok: false, reason: "not tracked by git \u2014 models may only abstract tracked source" };
     const text3 = read2.ok ? read2.content : "";
     return {
       file: a.file,
@@ -40307,10 +40892,20 @@ function isNetworkError(message) {
 var GENERATE_RESERVE_MS = 4e4;
 function workingTreeReader(root) {
   return (file, maxBytes) => {
+    if (isSecretShapedPath(file)) return { ok: false, reason: SECRET_REFUSED_READ };
     const r = readRegularFileInRoot(root, file, maxBytes);
     return r.ok ? { ok: true, content: r.content } : { ok: false, reason: r.reason };
   };
 }
+function pushedTipReader(tip) {
+  return (file, maxBytes) => {
+    if (isSecretShapedPath(file)) return { ok: false, reason: SECRET_REFUSED_READ };
+    const content = showContentAtRef(tip, file);
+    if (content === null) return { ok: false, reason: `not at the pushed tip (${tip.slice(0, 12)})` };
+    if (Buffer.byteLength(content) > maxBytes) return { ok: false, reason: "too-large" };
+    return { ok: true, content };
+  };
+}
 function sha256Of(content) {
   return (0, import_node_crypto21.createHash)("sha256").update(content).digest("hex");
 }
@@ -41560,12 +42155,7 @@ function startFormalPhase(input) {
     changedLines = void 0;
   }
   const tip = input.range.kind === "push" && input.range.head !== "INDEX" ? input.range.head : null;
-  const readSource = tip ? (file, maxBytes) => {
-    const content = showContentAtRef(tip, file);
-    if (content === null) return { ok: false, reason: `not at the pushed tip (${tip.slice(0, 12)})` };
-    if (Buffer.byteLength(content) > maxBytes) return { ok: false, reason: "too-large" };
-    return { ok: true, content };
-  } : void 0;
+  const readSource = tip ? pushedTipReader(tip) : void 0;
   const run4 = async () => {
     const prep = await prepareFormalPhase(input.root, process.env, input.auth, readSource, withoutPaths(tip ? revisionSource(input.root, tip) : worktreeSource(input.root), isDeniedPath), { tier: profile.formal.tier });
     if (!prep.ok) return skippedOutcome(prep.skip, prep.detail);
@@ -41636,7 +42226,8 @@ async function runGuard(opts, globals) {
   if (!tokenResult.ok || !urlResult.ok) process.exit(0);
   logEvent("guard_frame", { moment, ...frameTelemetry(frame, range) });
   const codeDelta = collectCodeDelta(files, GIT_MOMENT_BUDGET);
-  if (codeDelta.total_files === 0) process.exit(0);
+  const withheld = codeDelta.excluded.some((e) => e.kind === "policy");
+  if (codeDelta.total_files === 0 && !withheld) process.exit(0);
   const statedIntent = extractStatedIntent(
     moment,
     command,
@@ -41651,6 +42242,14 @@ async function runGuard(opts, globals) {
     statedIntent,
     buildGuardCoverage(files, codeDelta, frame, range)
   );
+  const changedLines = rangeChangedLines(frame, range, codeDelta.files);
+  if (changedLines.files.length > 0) requestBody2.changed_lines = changedLines.files;
+  logEvent("guard_changed_lines", {
+    moment,
+    sent: codeDelta.files.length,
+    with_ranges: changedLines.files.length,
+    omitted: changedLines.omitted
+  });
   try {
     const ig = loadVerityIgnore();
     const reviewedRev = range.kind === "push" && range.head !== "INDEX" ? range.head : null;
@@ -41733,7 +42332,7 @@ async function runGuard(opts, globals) {
     timeout: 29e4,
     cmd: "guard"
   });
-  const agent = startAgentReview({
+  const agent = codeDelta.total_files === 0 ? null : startAgentReview({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
     verbose: globals.verbose,
@@ -41804,7 +42403,11 @@ async function runGuard(opts, globals) {
   const agentLine = describeAgentOutcome(agentOutcome);
   const formalLine = describeFormalOutcome(formalOutcome) || (projectConfig ? formalOffUnverifiedLine(moment, projectConfig) : "");
   const covDetail = [coverageBlock(coverage), agentLine, formalLine].filter(Boolean).join("\n  ");
-  const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
+  const witnessed = [
+    ...codeDelta.files.map((f) => f.path),
+    ...agentVerdict?.witnessed_files ?? [],
+    ...scannerWitnessedWithheld(codeDelta.excluded, requestBody2.static_results?.findings)
+  ];
   mergeFormalFindings(response, formalOutcome, files);
   decision = response.gate_decision ?? "(unrecognised)";
   if (formalOutcome) {
@@ -43014,7 +43617,6 @@ var Rail = class {
 var import_node_fs74 = require("node:fs");
 var import_node_path62 = require("node:path");
 var import_node_os13 = require("node:os");
-var import_node_child_process18 = require("node:child_process");
 function createInitUi(opts) {
   const term = opts.term ?? detectTerm();
   const screen = new Screen(term);
@@ -43040,7 +43642,7 @@ function markInitSeen(home = process.env.HOME || (0, import_node_os13.homedir)()
 }
 function repoLabel() {
   try {
-    const url = (0, import_node_child_process18.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     const parsed = parseRemote(url);
     if (parsed) return terminalText(`${parsed.owner}/${parsed.repo}`, 120);
   } catch {
@@ -43049,7 +43651,6 @@ function repoLabel() {
 }
 
 // src/lib/prereqs.ts
-var import_node_child_process19 = require("node:child_process");
 var import_node_fs75 = require("node:fs");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
@@ -43071,7 +43672,7 @@ function checkNode() {
 function checkGit() {
   let detail2 = "";
   try {
-    detail2 = (0, import_node_child_process19.execSync)("git --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    detail2 = execFileSync2("git", ["--version"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return {
       id: "git",
@@ -43126,7 +43727,7 @@ function sameFile(a, b) {
 var INSTALL_TIMEOUT_MS = 12e4;
 function run3(command, args2, opts = {}) {
   return new Promise((resolve10) => {
-    const child = (0, import_node_child_process19.spawn)(command, args2, {
+    const child = spawn2(command, args2, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
@@ -43325,12 +43926,11 @@ async function healLocalTelemetry(root = repoRoot()) {
 }
 
 // src/lib/telemetry-gate.ts
-var import_node_child_process20 = require("node:child_process");
 var import_node_fs76 = require("node:fs");
 var import_node_path65 = require("node:path");
 var PROJECT_MARKERS = ["setup.json", "config.json"];
 function writtenOnThisMachine(root, rel) {
-  const r = (0, import_node_child_process20.spawnSync)("git", hardenedGitArgv(["ls-files", "--error-unmatch", "--", rel]), {
+  const r = spawnSync2("git", hardenedGitArgv(["ls-files", "--error-unmatch", "--", rel]), {
     cwd: root,
     env: hardenedGitEnv(),
     encoding: "utf-8",
@@ -43660,7 +44260,6 @@ function backgroundStep(ui, opts) {
 var import_promises15 = require("node:fs/promises");
 
 // src/lib/codacy-legacy.ts
-var import_node_child_process21 = require("node:child_process");
 var VERITY_ESLINT_CONFIG_FILE = ".codacy/tools-configs/eslint.config.mjs";
 var VERITY_ESLINT_LOCAL_PATH = "./.codacy/tools-configs/eslint.config.mjs";
 var VERITY_ESLINT_FIRST_LINE = "// Verity-owned ESLint config for the quality gate.";
@@ -43682,7 +44281,7 @@ function classifyCodacyConfig(root = repoRoot()) {
 }
 function isTracked(root, path) {
   try {
-    (0, import_node_child_process21.execFileSync)("git", ["ls-files", "--error-unmatch", "--", path], { cwd: root, stdio: "pipe" });
+    execFileSync2("git", ["ls-files", "--error-unmatch", "--", path], { cwd: root, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -43697,7 +44296,7 @@ function removeVerityCodacyConfig(root = repoRoot()) {
         untracked.push(f);
         continue;
       }
-      (0, import_node_child_process21.execFileSync)("git", ["rm", "--quiet", "--", f], { cwd: root, stdio: "pipe" });
+      execFileSync2("git", ["rm", "--quiet", "--", f], { cwd: root, stdio: "pipe" });
       removed.push(f);
     }
   } catch (err2) {
@@ -44433,19 +45032,18 @@ function sayChanged(ui, before) {
 // src/commands/migrate.ts
 var import_node_fs79 = require("node:fs");
 var import_node_path68 = require("node:path");
-var import_node_child_process22 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
   let listing = "";
   try {
-    listing = (0, import_node_child_process22.execSync)(`npm ls -g --depth=0 --json ${pkg}`, { stdio: "pipe", timeout: 6e4 }).toString();
+    listing = execSync2(`npm ls -g --depth=0 --json ${pkg}`, { stdio: "pipe", timeout: 6e4 }).toString();
   } catch (err2) {
     const stdout = err2.stdout;
     listing = stdout ? stdout.toString() : "";
   }
   const installed2 = parseGlobalListing(listing, pkg);
   if (installed2 === false) return "absent";
-  (0, import_node_child_process22.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  execSync2(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
   return installed2 ? "removed" : "unknown";
 }
 function parseGlobalListing(listing, pkg) {
@@ -44463,7 +45061,7 @@ function parseGlobalListing(listing, pkg) {
   return Object.prototype.hasOwnProperty.call(deps, pkg);
 }
 function git2(cwd, args2) {
-  (0, import_node_child_process22.execFileSync)("git", hardenedGitArgv(args2), { cwd, stdio: "pipe", env: hardenedGitEnv() });
+  execFileSync2("git", hardenedGitArgv(args2), { cwd, stdio: "pipe", env: hardenedGitEnv() });
 }
 function isGitTracked(cwd, relPath) {
   try {
@@ -44797,7 +45395,6 @@ function registerMigrateCommand(program2) {
 }
 
 // src/commands/init/sign-in.ts
-var import_node_child_process23 = require("node:child_process");
 async function classifyExistingLogin(serviceUrl, remote, opts) {
   const existing = await resolveToken(opts.token);
   if (!existing.ok) return { kind: "none" };
@@ -44823,7 +45420,7 @@ async function classifyExistingLogin(serviceUrl, remote, opts) {
 }
 function gitRemote() {
   try {
-    return (0, import_node_child_process23.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", ["remote", "get-url", "origin"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
     return "";
   }
@@ -45011,7 +45608,7 @@ async function recordAnswers(ui, momentIds, telemetry, completed) {
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
       // A failed run also clears an earlier stamp: "done" describes this checkout now.
-      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.5" : "dev" } : void 0
+      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.36.0" : "dev" } : void 0
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -45714,6 +46311,9 @@ var import_node_fs84 = require("node:fs");
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
 var PATH_TOKEN = /[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]{1,8}(?::\d+(?::\d+)?)?/g;
+var GLOB_TOKEN = /[A-Za-z0-9_.-][A-Za-z0-9_./-]*\/[A-Za-z0-9_./*?-]*[*?][A-Za-z0-9_./*?-]*/g;
+var DIR_TOKEN = /[A-Za-z0-9_.-][A-Za-z0-9_./-]*\/(?![A-Za-z0-9_.*?/-])/g;
+var BARE_TOKEN = /`([A-Za-z0-9_][A-Za-z0-9_./-]*)`/g;
 function clean(token) {
   return token.replace(/:\d+(?::\d+)?$/, "").replace(/^[`'"(\[]+/, "").replace(/[`'"),\].;!?]+$/, "").replace(/^\.\//, "");
 }
@@ -45727,25 +46327,91 @@ function deriveFileGlobs(text3, treePaths) {
   if (!text3 || treePaths.length === 0) return [];
   const out2 = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const raw of text3.match(PATH_TOKEN) ?? []) {
-    const token = clean(raw);
-    if (!token) continue;
-    const path = resolve8(token, treePaths);
-    if (!path || seen.has(path)) continue;
-    seen.add(path);
-    out2.push(path);
+  const candidates2 = [];
+  for (const m of text3.matchAll(PATH_TOKEN)) {
+    const token = clean(m[0]);
+    candidates2.push({ at: m.index ?? 0, glob: token ? resolve8(token, treePaths) : null });
+  }
+  for (const m of text3.matchAll(GLOB_TOKEN)) {
+    candidates2.push({ at: m.index ?? 0, glob: resolveGlob(clean(m[0]), treePaths) });
+  }
+  for (const m of text3.matchAll(DIR_TOKEN)) {
+    candidates2.push({ at: m.index ?? 0, glob: resolveDir(m[0], treePaths) });
+  }
+  for (const m of text3.matchAll(BARE_TOKEN)) {
+    candidates2.push({ at: m.index ?? 0, glob: resolveBare(clean(m[1]), treePaths) });
+  }
+  candidates2.sort((a, b) => a.at - b.at);
+  for (const { glob } of candidates2) {
+    if (!glob || seen.has(glob)) continue;
+    seen.add(glob);
+    out2.push(glob);
     if (out2.length >= MAX_GLOBS) break;
   }
   return out2;
 }
+function resolveBare(token, treePaths) {
+  if (!token) return null;
+  if (token.includes("/")) return treePaths.includes(token) ? token : null;
+  if (!/^[A-Z]/.test(token)) return null;
+  return resolve8(token, treePaths);
+}
+function resolveGlob(token, treePaths) {
+  if (!token || !/[*?]/.test(token)) return null;
+  return anyPathMatches(token, treePaths) ? token : null;
+}
+function resolveDir(token, treePaths) {
+  const dir = token.replace(/^\.\//, "").replace(/\/+$/, "");
+  if (!dir || dir === "." || dir.startsWith("../")) return null;
+  const prefix = `${dir}/`;
+  return treePaths.some((p) => p.startsWith(prefix)) ? `${dir}/**` : null;
+}
+
+// src/lib/reflection-title.ts
+var DERIVED_TITLE_MAX = 120;
+var TITLE_MAX = 200;
+function deriveReflectionTitle(text3, max = DERIVED_TITLE_MAX) {
+  const firstLine = text3.split(/\r?\n/).map((l) => l.trim()).find((l) => l.length > 0) ?? "";
+  const line2 = stripMarkup(firstLine);
+  const sentence = firstSentence(line2);
+  return cutAtWord(sentence, max);
+}
+function checkExplicitTitle(raw) {
+  const title = raw.replace(/\s+/g, " ").trim();
+  if (!title) return { ok: false, error: "--title is empty." };
+  if (title.length > TITLE_MAX) {
+    return { ok: false, error: `--title is ${title.length} characters; the limit is ${TITLE_MAX}.` };
+  }
+  return { ok: true, title };
+}
+function stripMarkup(line2) {
+  let s = line2.replace(/^#{1,6}\s+/, "").replace(/^>\s*/, "").replace(/^(?:[-*+]|\d+[.)])\s+/, "").trim();
+  const wrapped = s.match(/^(\*\*|__|\*|_)(.+)\1$/);
+  if (wrapped) s = wrapped[2].trim();
+  return s.replace(/\s+/g, " ");
+}
+function firstSentence(line2) {
+  const m = line2.match(/^(.+?[.!?])(?=\s+[A-Z0-9`"'(\[])/);
+  const s = (m ? m[1] : line2).trim();
+  return s.replace(/[.:;,]+$/, "").trim() || s;
+}
+function cutAtWord(s, max) {
+  if (s.length <= max) return s;
+  const room = s.slice(0, max - 1);
+  const lastSpace = room.lastIndexOf(" ");
+  const head = lastSpace > max / 2 ? room.slice(0, lastSpace) : room;
+  return `${head.replace(/[\s,.;:—-]+$/, "")}\u2026`;
+}
 
 // src/commands/reflect.ts
 async function writeNodeToDisk(args2) {
   try {
+    const served = /* @__PURE__ */ new Map();
     const written = await applyMemoryWrites(
       [{ path: args2.filePath, content: args2.content, node_id: args2.nodeId, op: "create" }],
-      { treePaths: listTrackedFiles(), recordBaseline: false }
+      { treePaths: listTrackedFiles(), baseline: "written", lastServed: await readServedLedger(), served }
     );
+    await recordServedFiles(served);
     if (written === 0) return false;
     return (0, import_node_fs84.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
@@ -45753,13 +46419,26 @@ async function writeNodeToDisk(args2) {
   }
 }
 function registerReflectCommand(program2) {
-  program2.command("reflect").description("Capture learnings \u2014 auto-extract or record a reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-dictated text); - reads it from stdin, so the words never pass through shell quoting").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--confirmed", "The USER authored or confirmed these exact words \u2014 records as human-authored (source: user, confidence 1.0)").option("--file-globs <glob...>", "Files this reflection is about. Without any, the paths cited in the text are used; a reflection matching no file never surfaces in a review").option("--autonomous", "(deprecated, ignored) reflections are always recorded without a confirm step").action(async (opts) => {
+  program2.command("reflect").description("Capture learnings \u2014 auto-extract or record a reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-dictated text); - reads it from stdin, so the words never pass through shell quoting").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--title <text>", "The node title (up to 200 characters). Without it, the first line or sentence of the text is used").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--confirmed", "The USER authored or confirmed these exact words \u2014 records as human-authored (source: user, confidence 1.0)").option("--file-globs <glob...>", "Files this reflection is about. Without any, the paths cited in the text are used; a reflection matching no file never surfaces in a review").option("--autonomous", "(deprecated, ignored) reflections are always recorded without a confirm step").action(async (opts) => {
     const globals = program2.opts();
     const input = readTextInput(opts.userInput, "--user-input");
     if (!input.ok) {
       printError(input.error);
       process.exit(1);
     }
+    let explicitTitle = null;
+    if (typeof opts.title === "string") {
+      const checked = checkExplicitTitle(opts.title);
+      if (!checked.ok) {
+        printError(checked.error);
+        process.exit(1);
+      }
+      explicitTitle = checked.title;
+    }
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
     await ensureMemoryDir();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -45829,6 +46508,7 @@ function registerReflectCommand(program2) {
       const explicitGlobs = Array.isArray(opts.fileGlobs) ? opts.fileGlobs.map((g) => g.trim()).filter(Boolean) : [];
       const derivedGlobs = explicitGlobs.length > 0 ? [] : deriveFileGlobs(userInput, listTrackedFiles());
       const fileGlobs = explicitGlobs.length > 0 ? explicitGlobs : derivedGlobs.length > 0 ? derivedGlobs : inheritedGlobs;
+      const title = explicitTitle ?? deriveReflectionTitle(userInput);
       const result = await apiRequest({
         method: "POST",
         path: "/compound/reflect",
@@ -45836,7 +46516,7 @@ function registerReflectCommand(program2) {
         token,
         body: {
           kind: kind2,
-          title: userInput.slice(0, 200),
+          title,
           body: userInput,
           domains: [],
           file_globs: fileGlobs,
@@ -45871,9 +46551,12 @@ function registerReflectCommand(program2) {
       printInfo(
         synced ? `Recorded ${nodeId} \u2192 .verity/memory/${filePath}` : `Recorded ${nodeId} (syncs to .verity/memory/${filePath} on the next analysis).`
       );
+      const storedNode = result.data.node;
+      const storedTitle = typeof storedNode?.title === "string" ? storedNode.title : title;
+      printInfo(`  Title: ${terminalText(storedTitle, 200)}`);
       if (viewUrl) printInfo(`  ${viewUrl}`);
       printInfo(
-        recordedAsUser ? "  Recorded as yours (source: user)." : "  Auto-recorded from this task \u2014 nobody reviewed it. Edit or delete the file if it is wrong."
+        recordedAsUser ? "  Recorded as yours (source: user)." : `  Auto-recorded from this task \u2014 nobody reviewed it. If it is wrong: verity memory edit ${nodeId} \u2026, or verity memory delete ${nodeId}.`
       );
       if (recordedSource !== source2) {
         printWarn(
@@ -45917,9 +46600,1353 @@ function registerReflectCommand(program2) {
   });
 }
 
+// src/lib/memory-curate.ts
+var import_promises18 = require("node:fs/promises");
+var import_node_fs85 = require("node:fs");
+var import_node_path72 = require("node:path");
+var memoryDir3 = () => projectPath(`${VERITY_DIR}/memory`);
+var trashDir = () => projectPath(`${VERITY_DIR}/.memory-trash`);
+var NODE_DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
+var MAX_NODE_FILE_BYTES2 = 64 * 1024;
+var NODE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$/;
+var SETTABLE_STATUSES = ["active", "archived", "superseded"];
+function readInRepo(fullPath, max) {
+  const read2 = readRegularFileInRoot(repoRoot(), fullPath, max);
+  return read2.ok ? read2.content : null;
+}
+async function listLocalNodes() {
+  const out2 = [];
+  if (!(0, import_node_fs85.existsSync)(memoryDir3()) || memoryDirEscapesRepo()) return out2;
+  for (const domain of NODE_DOMAINS) {
+    const dir = (0, import_node_path72.join)(memoryDir3(), domain);
+    if (!(0, import_node_fs85.existsSync)(dir)) continue;
+    let files;
+    try {
+      files = (await (0, import_promises18.readdir)(dir)).filter((f) => f.endsWith(".md")).sort();
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const content = readInRepo((0, import_node_path72.join)(dir, file), MAX_NODE_FILE_BYTES2);
+      if (content === null) continue;
+      const id = readId(content) ?? file.replace(/\.md$/, "");
+      out2.push({ nodeId: id, path: `${domain}/${file}`, content });
+    }
+  }
+  return out2;
+}
+async function findLocalNode(nodeId) {
+  if (!NODE_ID_PATTERN.test(nodeId) || memoryDirEscapesRepo()) return null;
+  for (const domain of NODE_DOMAINS) {
+    const rel = `${domain}/${nodeId}.md`;
+    const content = readInRepo((0, import_node_path72.join)(memoryDir3(), rel), MAX_NODE_FILE_BYTES2);
+    if (content !== null && (readId(content) ?? nodeId) === nodeId) return { nodeId, path: rel, content };
+  }
+  return (await listLocalNodes()).find((n2) => n2.nodeId === nodeId) ?? null;
+}
+function readId(content) {
+  const id = pickFrontmatter(frontmatterOf2(content) ?? "", "id");
+  return id && NODE_ID_PATTERN.test(id) ? id : null;
+}
+function readTitle(content) {
+  const fm = frontmatterOf2(content);
+  const line2 = fm?.split("\n").find((l) => l.startsWith("title:"));
+  if (!line2) return null;
+  const raw = line2.slice("title:".length).trim();
+  if (raw.startsWith('"')) {
+    try {
+      return String(JSON.parse(raw));
+    } catch {
+      return raw.replace(/^"|"$/g, "");
+    }
+  }
+  return raw || null;
+}
+function readStatus(content) {
+  return pickFrontmatter(frontmatterOf2(content) ?? "", "status") ?? "active";
+}
+function readGlobs(content) {
+  const fm = frontmatterOf2(content) ?? "";
+  const lines = fm.split("\n");
+  const at = lines.findIndex((l) => /^file_globs:/.test(l));
+  if (at < 0) return [];
+  const inline = lines[at].slice("file_globs:".length).trim();
+  if (inline.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(inline);
+      return Array.isArray(parsed) ? parsed.map(String) : [];
+    } catch {
+      return pickFrontmatterArray(fm, "file_globs");
+    }
+  }
+  const out2 = [];
+  for (let j = at + 1; j < lines.length && /^\s+-\s/.test(lines[j]); j++) {
+    const item = lines[j].replace(/^\s+-\s+/, "").trim();
+    let value = item;
+    if (item.startsWith('"')) {
+      try {
+        value = String(JSON.parse(item));
+      } catch {
+        value = item.replace(/^"|"$/g, "");
+      }
+    }
+    if (value) out2.push(value);
+  }
+  return out2;
+}
+function frontmatterOf2(content) {
+  const m = content.match(/^---\n([\s\S]*?)\n---\n/);
+  return m ? `${m[1]}
+` : null;
+}
+function hasChanges(c) {
+  return c.title !== void 0 || c.fileGlobs !== void 0 || c.status !== void 0 || c.body !== void 0;
+}
+function applyNodeChanges(content, changes) {
+  const m = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!m) return null;
+  let fm = m[1];
+  let rest = m[2];
+  if (changes.title !== void 0) {
+    fm = setFrontmatterLine(fm, "title", JSON.stringify(changes.title));
+    const restLines = rest.split("\n");
+    const first = restLines.findIndex((l) => l.trim() !== "");
+    if (first >= 0 && /^# /.test(restLines[first])) {
+      restLines[first] = `# ${changes.title}`;
+      rest = restLines.join("\n");
+    }
+  }
+  if (changes.status !== void 0) fm = setFrontmatterLine(fm, "status", changes.status);
+  if (changes.fileGlobs !== void 0) {
+    const block = changes.fileGlobs.length > 0 ? "file_globs:\n" + changes.fileGlobs.map((g) => `  - ${JSON.stringify(g)}`).join("\n") : "file_globs: []";
+    fm = /^file_globs:/m.test(fm) ? replaceFileGlobsBlock(fm, block) : `${fm}
+${block}`;
+  }
+  if (changes.body !== void 0) rest = replaceBody(rest, changes.body);
+  return `---
+${fm}
+---
+${rest}`;
+}
+function setFrontmatterLine(fm, key, value) {
+  const re = new RegExp(`^${key}:.*$`, "m");
+  return re.test(fm) ? fm.replace(re, `${key}: ${value}`) : `${fm}
+${key}: ${value}`;
+}
+function replaceBody(rest, body2) {
+  const lines = rest.split("\n");
+  let i2 = 0;
+  while (i2 < lines.length && lines[i2].trim() === "") i2++;
+  const heading = i2 < lines.length && /^# \S/.test(lines[i2]) ? lines[i2] : null;
+  const related = lines.lastIndexOf("## Related");
+  const relatedBlock = related > i2 ? lines.slice(related).join("\n").trimEnd() : null;
+  const parts2 = [""];
+  if (heading) parts2.push(heading, "");
+  parts2.push(body2.trim());
+  if (relatedBlock) parts2.push("", relatedBlock);
+  return parts2.join("\n") + "\n";
+}
+async function fetchServiceNode(api, nodeId) {
+  const res = await apiRequest({
+    method: "GET",
+    path: `/compound/memory/nodes/${encodeURIComponent(nodeId)}`,
+    serviceUrl: api.serviceUrl,
+    token: api.token,
+    verbose: api.verbose,
+    cmd: "memory-curate-read"
+  });
+  if (!res.ok) return { ok: false, error: res.error, notFound: res.http_status === 404 };
+  return { ok: true, node: res.data };
+}
+async function setServiceStatus(api, nodeId, status) {
+  const res = await apiRequest({
+    method: "PATCH",
+    path: `/compound/memory/nodes/${encodeURIComponent(nodeId)}`,
+    serviceUrl: api.serviceUrl,
+    token: api.token,
+    body: { status },
+    verbose: api.verbose,
+    cmd: "memory-curate-status"
+  });
+  if (!res.ok) return { ok: false, error: res.error, notFound: res.http_status === 404 };
+  if (res.data.status !== status) {
+    return { ok: false, error: `the service answered with status "${String(res.data.status)}", not "${status}"` };
+  }
+  return { ok: true };
+}
+function uploadRefusal(content) {
+  if (!readId(content) || !pickFrontmatter(frontmatterOf2(content) ?? "", "kind") || !readTitle(content)) {
+    return "the file has no id, kind or title in its frontmatter, so the service would skip it";
+  }
+  const bodyLength = uploadBodyLength(content);
+  if (bodyLength > SERVICE_BODY_MAX) {
+    return `the body is ${bodyLength} characters; the service keeps ${SERVICE_BODY_MAX}, so it would be cut. Shorten it`;
+  }
+  const unstorable = unstorableField(content);
+  if (unstorable) {
+    return `the ${unstorable} would not be stored as written (it starts with a quote, is a bare number, true, false or null, or holds a line break). Change it`;
+  }
+  return null;
+}
+async function uploadNode(api, path, content, opts = {}) {
+  const refusal = uploadRefusal(content);
+  if (refusal) return { ok: false, error: refusal, unchanged: true };
+  const nodeId = readId(content);
+  const prior = await fetchServiceNode(api, nodeId);
+  if (!prior.ok && !prior.notFound) return { ok: false, error: `could not read the node first: ${prior.error}` };
+  const row2 = prior.ok ? prior.node : null;
+  if (opts.expect !== void 0 && (!row2 || !sameEditableFields(row2, opts.expect))) {
+    return { ok: false, stale: true, error: `the service copy of ${nodeId} is not the one expected, so it was not overwritten` };
+  }
+  const base = opts.base ?? content;
+  if (row2 && !opts.force && serviceIsNewer(row2, base) && !sameEditableFields(row2, base)) {
+    return {
+      ok: false,
+      stale: true,
+      error: `the service has a newer, different version of ${nodeId} (updated ${String(row2.updated_at)}) than the file here. Run \`verity memory pull\` and edit again, or pass --force to overwrite it`
+    };
+  }
+  const notes = [];
+  if (row2) {
+    const changed = ["source", "created_by", "confidence"].filter((k) => {
+      const v = pickFrontmatter(frontmatterOf2(content) ?? "", k);
+      return v !== null && v !== String(row2[k]);
+    });
+    if (changed.length > 0) notes.push(`${changed.join(", ")} ${changed.length > 1 ? "are" : "is"} kept from the service; the file's change to ${changed.length > 1 ? "them" : "it"} was not uploaded`);
+  }
+  const upload = row2 ? withRowFields(uploadableNodeContent(content), row2) : uploadableNodeContent(content);
+  const res = await apiRequest({
+    method: "POST",
+    path: "/compound/memory/sync",
+    serviceUrl: api.serviceUrl,
+    token: api.token,
+    body: { files: [{ path, content: upload }] },
+    verbose: api.verbose,
+    cmd: "memory-curate-upload"
+  });
+  if (!res.ok) return { ok: false, error: res.error };
+  const back = await fetchServiceNode(api, nodeId);
+  if (!back.ok) return { ok: false, error: `uploaded, but could not read it back: ${back.error}` };
+  const mismatched = [];
+  if (back.node.title !== readTitle(content)) mismatched.push("title");
+  if ((back.node.status ?? "active") !== readStatus(content)) mismatched.push("status");
+  const stored = Array.isArray(back.node.file_globs) ? back.node.file_globs.map(String) : [];
+  if (!sameSet(stored, readGlobs(content))) mismatched.push("file_globs");
+  if (back.node.body !== nodeBody(upload)) mismatched.push("body");
+  return { ok: true, mismatched, final: adoptRowFields(content, back.node), notes };
+}
+function unstorableField(content) {
+  const title = readTitle(content) ?? "";
+  if (/["\\]/.test(title) && bareStorableValue(title) === null) return "title";
+  if (/[\r\n]/.test(title)) return "title";
+  for (const g of readGlobs(content)) {
+    if (/["\\]/.test(g) && (g.startsWith('"') || g !== g.trim())) return "file_globs";
+    if (/[\r\n]/.test(g)) return "file_globs";
+  }
+  return null;
+}
+function timeOf(value) {
+  const t2 = typeof value === "string" ? Date.parse(value) : NaN;
+  return Number.isFinite(t2) ? t2 : null;
+}
+function serviceIsNewer(row2, content) {
+  const server = timeOf(row2.updated_at);
+  const local = timeOf(pickFrontmatter(frontmatterOf2(content) ?? "", "updated_at"));
+  return server !== null && local !== null && server - local > 1e3;
+}
+function sameEditableFields(row2, content) {
+  const globs = Array.isArray(row2.file_globs) ? row2.file_globs.map(String) : [];
+  return row2.title === readTitle(content) && (row2.status ?? "active") === readStatus(content) && sameSet(globs, readGlobs(content)) && row2.body === nodeBody(uploadableNodeContent(content));
+}
+function storableScalar(value) {
+  if (/[\r\n]/.test(value)) return null;
+  return /["\\]/.test(value) ? bareStorableValue(value) : JSON.stringify(value);
+}
+function withRowFields(content, row2) {
+  const m = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!m) return content;
+  const lines = [];
+  const evidence2 = Array.isArray(row2.evidence_run_ids) ? row2.evidence_run_ids.filter((x) => typeof x === "string") : [];
+  if (evidence2.length > 0) lines.push(`evidence_run_ids: ${JSON.stringify(evidence2)}`);
+  if (typeof row2.pattern_ref === "string" && row2.pattern_ref) {
+    const v = storableScalar(row2.pattern_ref);
+    if (v !== null) lines.push(`pattern_ref: ${v}`);
+  }
+  if (typeof row2.source === "string") {
+    const v = storableScalar(row2.source);
+    if (v !== null) lines.push(`source: ${v}`);
+  }
+  if (typeof row2.created_by === "string") {
+    const v = storableScalar(row2.created_by);
+    if (v !== null) lines.push(`created_by: ${v}`);
+  }
+  if (typeof row2.confidence === "number" && Number.isFinite(row2.confidence)) lines.push(`confidence: ${row2.confidence}`);
+  const replaced = new Set(lines.map((l) => l.slice(0, l.indexOf(":"))));
+  const fm = m[1].split("\n").filter((l) => !replaced.has(l.slice(0, l.indexOf(":"))));
+  return `---
+${[...fm, ...lines].join("\n")}
+---
+${m[2]}`;
+}
+function adoptRowFields(content, row2) {
+  const m = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!m) return content;
+  let fm = m[1];
+  const set = (key, value) => {
+    const re = new RegExp(`^${key}:.*$`, "m");
+    fm = re.test(fm) ? fm.replace(re, () => `${key}: ${value}`) : `${fm}
+${key}: ${value}`;
+  };
+  if (typeof row2.updated_at === "string" && timeOf(row2.updated_at) !== null) set("updated_at", row2.updated_at);
+  if (typeof row2.source === "string" && /^[a-z_]+$/.test(row2.source)) set("source", row2.source);
+  if (typeof row2.created_by === "string" && !/[\r\n]/.test(row2.created_by)) set("created_by", /^[A-Za-z0-9@._/-]+$/.test(row2.created_by) ? row2.created_by : JSON.stringify(row2.created_by));
+  if (typeof row2.confidence === "number" && Number.isFinite(row2.confidence)) set("confidence", String(row2.confidence));
+  return `---
+${fm}
+---
+${m[2]}`;
+}
+var SERVICE_BODY_MAX = 8192;
+function nodeBody(content) {
+  const m = content.match(/^---\n[\s\S]*?\n---\n([\s\S]*)$/);
+  return (m ? m[1] : content).trim();
+}
+function uploadBodyLength(content) {
+  return nodeBody(uploadableNodeContent(content)).length;
+}
+function sameSet(a, b) {
+  return a.length === b.length && a.every((x) => b.includes(x));
+}
+async function recordSynced(path, content) {
+  const entry = /* @__PURE__ */ new Map([[path, hashNodeContent(content)]]);
+  await markNodesSynced(entry);
+  await recordServedFiles(entry);
+}
+var MAX_TRASH_BYTES = 4 * MAX_NODE_FILE_BYTES2;
+async function readTrash(nodeId) {
+  if (!NODE_ID_PATTERN.test(nodeId)) return null;
+  const text3 = readInRepo((0, import_node_path72.join)(trashDir(), `${nodeId}.json`), MAX_TRASH_BYTES);
+  if (text3 === null) return null;
+  try {
+    const parsed = JSON.parse(text3);
+    return parsed?.node_id === nodeId ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function writeTrash(record2) {
+  const ok = await writeFileAtomicInTree((0, import_node_path72.join)(trashDir(), `${record2.node_id}.json`), JSON.stringify(record2, null, 2) + "\n");
+  if (!ok) throw new Error(".verity/.memory-trash/ is a link, or a folder outside the repository");
+}
+async function removeTrash(nodeId) {
+  if (!(0, import_node_fs85.existsSync)(trashDir()) || !dirInRepo(trashDir())) return;
+  try {
+    await (0, import_promises18.rm)((0, import_node_path72.join)(trashDir(), `${nodeId}.json`), { force: true });
+  } catch {
+  }
+}
+async function editNode(api, node, next, opts = {}) {
+  const refusal = uploadRefusal(next);
+  if (refusal) return { ok: false, error: refusal, unchanged: true };
+  if (next !== node.content && !await writeNodeFile(node.path, next)) {
+    return { ok: false, error: `could not write .verity/memory/${node.path} (a link, or a folder outside the repository)`, unchanged: true };
+  }
+  const up = await uploadNode(api, node.path, next, { force: opts.force, base: opts.base ?? node.content, expect: opts.expect });
+  if (!up.ok) {
+    if (up.stale && next !== node.content) await writeNodeFile(node.path, node.content);
+    return up;
+  }
+  if (up.mismatched.length > 0) return up;
+  const final = up.final !== next && await writeNodeFile(node.path, up.final) ? up.final : next;
+  await recordSynced(node.path, final);
+  await refreshMemoryIndex();
+  await appendMemoryLog([`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Uploaded ${node.nodeId} by hand (${node.path})`]);
+  return { ...up, final };
+}
+async function deleteNode(api, nodeId, opts = {}) {
+  const local = await findLocalNode(nodeId);
+  const status = opts.status ?? "archived";
+  const previous = await readTrash(nodeId);
+  try {
+    await writeTrash({
+      node_id: nodeId,
+      path: local?.path ?? null,
+      content: local?.content ?? null,
+      status_before: local ? readStatus(local.content) : "active",
+      reason: opts.reason ?? null,
+      deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      via: opts.via ?? "delete"
+    });
+  } catch (err2) {
+    return { ok: false, error: `could not save the local record in .verity/.memory-trash/ first (${err2.message}); nothing was changed` };
+  }
+  const set = await setServiceStatus(api, nodeId, status);
+  if (!set.ok && !(set.notFound && local)) {
+    if (previous) await writeTrash(previous).catch(() => {
+    });
+    else await removeTrash(nodeId);
+    return set;
+  }
+  const localOnly = !set.ok;
+  let fileKept = false;
+  if (local) {
+    if (await removeNodeFile(local.path)) {
+      await forgetSyncedNodes([local.path]);
+      await forgetServedFiles([local.path]);
+      await refreshMemoryIndex();
+    } else {
+      fileKept = true;
+    }
+  }
+  const why = opts.reason ? `: ${opts.reason}` : "";
+  await appendMemoryLog([`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 ${localOnly ? "Removed local-only" : `Set ${status}`} ${nodeId}${local ? ` (${local.path})` : ""} via ${opts.via ?? "delete"}${why}`]);
+  return { ok: true, path: local?.path ?? null, localOnly, fileKept };
+}
+async function restoreNode(api, nodeId, fallback) {
+  const trash = await readTrash(nodeId);
+  const path = trash?.path ?? fallback?.path ?? null;
+  const content = trash?.content ?? fallback?.content ?? null;
+  const set = await setServiceStatus(api, nodeId, "active");
+  const localOnly = !set.ok && !!set.notFound && path !== null && content !== null;
+  if (!set.ok && !localOnly) return set;
+  let restored = false;
+  if (path && content !== null) {
+    const next = readStatus(content) === "active" ? content : applyNodeChanges(content, { status: "active" }) ?? content;
+    if (!await writeNodeFile(path, next)) {
+      return { ok: false, error: `${localOnly ? "the service has no such node, and" : "active on the service again, but"} .verity/memory/${path} could not be written (a link, or a folder outside the repository). The text is kept in .verity/.memory-trash/${nodeId}.json` };
+    }
+    if (!localOnly) await recordSynced(path, next);
+    restored = true;
+  }
+  await removeTrash(nodeId);
+  await refreshMemoryIndex();
+  await appendMemoryLog([`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Restored ${nodeId}${path ? ` (${path})` : ""}${localOnly ? " (local only)" : ""}`]);
+  return { ok: true, path: restored ? path : null, fromTrash: restored, localOnly };
+}
+
+// src/commands/memory-curate.ts
+function cleanReason(raw) {
+  if (raw === void 0) return { ok: true, reason: null };
+  const reason = String(raw).replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+  if (reason.length === 0 || reason.length > 500) return { ok: false, error: "--reason is 1 to 500 characters." };
+  return { ok: true, reason };
+}
+async function resolveApi(program2) {
+  const globals = program2.opts();
+  const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError(tokenResult.error);
+    process.exit(1);
+  }
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!urlResult.ok) {
+    printError(urlResult.error);
+    process.exit(1);
+  }
+  return { serviceUrl: urlResult.data, token: tokenResult.data.token, verbose: globals.verbose };
+}
+function refuseLinkedMemoryDir() {
+  if (memoryDirEscapesRepo()) {
+    printError(".verity/memory is a link (or under one) that leads out of this repository. Refusing to read or change it.");
+    process.exit(1);
+  }
+}
+function checkNodeId(nodeId) {
+  if (!NODE_ID_PATTERN.test(nodeId)) {
+    printError('A node id looks like n123-some-slug. `verity memory ask "<topic>"` and .verity/memory/index.md list them.');
+    process.exit(1);
+  }
+}
+function registerMemoryCurationCommands(memory2, program2) {
+  memory2.command("edit <node-id>").description("Change a knowledge node and upload it now. With no change option, uploads the file as it is on disk").option("--title <text>", "New title (up to 200 characters)").option("--file-globs <glob...>", "Replace the files this node is about. Each glob must match a file in the repository").option("--status <status>", `New status: ${SETTABLE_STATUSES.join(", ")}`).option("--body <text>", "Replace the body; - reads it from stdin").option("--force", "Upload even when the service has a newer, different version of the node (it is overwritten)").action(async (nodeId, opts) => {
+    checkNodeId(nodeId);
+    const body2 = opts.body === void 0 ? null : readTextInput(opts.body, "--body");
+    if (body2 && !body2.ok) {
+      printError(body2.error);
+      process.exit(1);
+    }
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    refuseLinkedMemoryDir();
+    const changes = {};
+    if (opts.title !== void 0) {
+      const t2 = checkExplicitTitle(opts.title);
+      if (!t2.ok) {
+        printError(t2.error);
+        process.exit(1);
+      }
+      changes.title = t2.title;
+    }
+    if (opts.status !== void 0) {
+      if (!SETTABLE_STATUSES.includes(opts.status)) {
+        printError(`--status is one of: ${SETTABLE_STATUSES.join(", ")}.`);
+        process.exit(1);
+      }
+      changes.status = opts.status;
+    }
+    if (opts.fileGlobs !== void 0) {
+      const globs = [...new Set(opts.fileGlobs.map((g) => g.trim()).filter(Boolean))];
+      const tree2 = listTrackedFiles();
+      const unmatched = globs.filter((g) => !anyPathMatches(g, tree2));
+      if (globs.length === 0 || unmatched.length > 0) {
+        printError(globs.length === 0 ? "--file-globs needs at least one glob. A node with none never surfaces in a review." : `No file in this repository matches: ${unmatched.join(", ")}. Paths are relative to the repository root.`);
+        process.exit(1);
+      }
+      changes.fileGlobs = globs;
+    }
+    if (body2) changes.body = body2.text;
+    const api = await resolveApi(program2);
+    let node = await findLocalNode(nodeId);
+    if (!node) {
+      try {
+        await pullRepoMemory({ serviceUrl: api.serviceUrl, token: api.token, verbose: api.verbose });
+      } catch {
+      }
+      node = await findLocalNode(nodeId);
+    }
+    if (!node) {
+      printError(`No node ${nodeId} in .verity/memory/. \`verity memory pull\` fetches the graph; \`verity memory ask "<topic>"\` finds node ids.`);
+      process.exit(1);
+    }
+    const next = hasChanges(changes) ? applyNodeChanges(node.content, changes) : node.content;
+    if (next === null) {
+      printError(`.verity/memory/${terminalText(node.path)} has no frontmatter to change.`);
+      process.exit(1);
+    }
+    const bodyLength = uploadBodyLength(next);
+    if (bodyLength > SERVICE_BODY_MAX) {
+      printError(`The body is ${bodyLength} characters; the service keeps ${SERVICE_BODY_MAX}, so it would be cut. Shorten it.`);
+      process.exit(1);
+    }
+    if (changes.status !== void 0 && Object.keys(changes).length === 1) {
+      const set = await setServiceStatus(api, nodeId, changes.status);
+      if (!set.ok) {
+        printError(`Could not change the status of ${nodeId}: ${set.error}`);
+        process.exit(1);
+      }
+      const written = await writeNodeFile(node.path, next);
+      if (written) {
+        const entry = /* @__PURE__ */ new Map([[node.path, hashNodeContent(next)]]);
+        await markNodesSynced(entry);
+        await recordServedFiles(entry);
+        await refreshMemoryIndex();
+      }
+      printInfo(`${nodeId} is ${changes.status} on the service (.verity/memory/${terminalText(node.path)}).`);
+      if (!written) {
+        printError(`  But .verity/memory/${terminalText(node.path)} could not be written (a link, or a folder outside the repository). Its status line still says ${readStatus(node.content)}.`);
+        process.exit(1);
+      }
+      if (changes.status !== "active") printInfo("  It no longer surfaces in reviews. `verity memory delete` also removes the file here.");
+      process.exit(0);
+    }
+    const result = await editNode(api, node, next, { force: !!opts.force });
+    if (!result.ok) {
+      printError(`Could not upload ${nodeId}: ${result.error}`);
+      if (result.stale || result.unchanged) printWarn("  Nothing was changed, here or on the service.");
+      else if (next !== node.content) printWarn(`  The change is saved in .verity/memory/${terminalText(node.path)}. Run the same command again to upload it.`);
+      process.exit(1);
+    }
+    if (result.mismatched.length > 0) {
+      printError(`The service did not take the change to ${nodeId}: ${result.mismatched.join(", ")} differ from the file.`);
+      process.exit(1);
+    }
+    const changed = Object.keys(changes);
+    printInfo(changed.length > 0 ? `Updated ${nodeId} (${changed.map((k) => k === "fileGlobs" ? "file_globs" : k).join(", ")}) and uploaded it \u2192 .verity/memory/${terminalText(node.path)}` : `Uploaded ${nodeId} as it is on disk \u2192 .verity/memory/${terminalText(node.path)}`);
+    printInfo("  The service holds this version now. The next analysis will not send it again.");
+    for (const note of result.notes) printWarn(`  Note: ${note}.`);
+    process.exit(0);
+  });
+  memory2.command("delete <node-id>").description("Archive a knowledge node on the service and remove its file here. `verity memory restore` undoes it").option("--reason <text>", "Why the node is wrong or no longer applies (1\u2013500 characters, kept on this machine); - reads it from stdin").action(async (nodeId, opts) => {
+    checkNodeId(nodeId);
+    const rawReason = opts.reason === void 0 ? null : readTextInput(opts.reason, "--reason");
+    if (rawReason && !rawReason.ok) {
+      printError(rawReason.error);
+      process.exit(1);
+    }
+    const reason = cleanReason(rawReason ? rawReason.text : void 0);
+    if (!reason.ok) {
+      printError(reason.error);
+      process.exit(1);
+    }
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    refuseLinkedMemoryDir();
+    const api = await resolveApi(program2);
+    const result = await deleteNode(api, nodeId, { reason: reason.reason, via: "delete" });
+    if (!result.ok) {
+      printError(result.notFound ? `No node ${nodeId} on the service, and no file for it here.` : `Could not archive ${nodeId}: ${result.error}`);
+      process.exit(1);
+    }
+    if (result.localOnly) {
+      printInfo(`The service has no node ${nodeId}. Removed the file that existed only here (.verity/memory/${terminalText(result.path)}).`);
+    } else {
+      printInfo(`Archived ${nodeId} on the service${result.path ? ` and removed .verity/memory/${terminalText(result.path)}` : ""}.`);
+      printInfo("  It no longer surfaces in reviews, here or for your team.");
+    }
+    if (result.fileKept) {
+      printWarn(`  But .verity/memory/${terminalText(result.path)} could not be removed here. Delete it by hand; the service no longer serves it.`);
+    }
+    if (reason.reason) printInfo("  The reason is kept in .verity/.memory-trash/ and .verity/memory/log.md on this machine.");
+    printInfo(`  Undo: verity memory restore ${nodeId}`);
+    process.exit(0);
+  });
+  memory2.command("restore <node-id>").description("Undo `verity memory delete`: make the node active on the service again and put its file back").action(async (nodeId) => {
+    checkNodeId(nodeId);
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    refuseLinkedMemoryDir();
+    const api = await resolveApi(program2);
+    const trash = await readTrash(nodeId);
+    const result = await restoreNode(api, nodeId);
+    if (!result.ok) {
+      printError(result.notFound ? `No node ${nodeId} on the service.` : `Could not restore ${nodeId}: ${result.error}`);
+      process.exit(1);
+    }
+    if (result.fromTrash) {
+      printInfo(result.localOnly ? `Restored ${nodeId} here: back in .verity/memory/${terminalText(result.path)}. The service never had it, so it is still only on this machine.` : `Restored ${nodeId}: active on the service, and back in .verity/memory/${terminalText(result.path)}.`);
+      process.exit(0);
+    }
+    let fetched = false;
+    try {
+      const pull = await pullRepoMemory({ serviceUrl: api.serviceUrl, token: api.token, verbose: api.verbose, force: true });
+      fetched = pull.ok && !!await findLocalNode(nodeId);
+    } catch {
+    }
+    printInfo(fetched ? `Restored ${nodeId}: active on the service, and pulled back into .verity/memory/.` : `Restored ${nodeId} on the service. Its file arrives with the next \`verity memory pull\`.`);
+    if (trash?.reason) printInfo(`  It was deleted with the reason: ${terminalText(trash.reason, 500)}`);
+    process.exit(0);
+  });
+}
+
+// src/commands/memory-ask.ts
+var import_node_fs86 = require("node:fs");
+
+// src/lib/memory-ask.ts
+var K1 = 1.2;
+var B = 0.75;
+var TITLE_WEIGHT = 3;
+var PATH_BONUS = 2;
+var RELATIVE_FLOOR = 0.25;
+var ANSWER_LINES = 3;
+var MIN_SENTENCE = 20;
+function terms(text3) {
+  return text3.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !STOPWORDS.has(w)).map(stem);
+}
+function stem(w) {
+  if (w.length > 5 && w.endsWith("ies")) return `${w.slice(0, -3)}y`;
+  if (w.length > 5 && w.endsWith("ing")) return w.slice(0, -3);
+  if (w.length > 4 && w.endsWith("ed")) return w.slice(0, -2);
+  if (w.length > 3 && w.endsWith("s") && !w.endsWith("ss")) return w.slice(0, -1);
+  return w;
+}
+function globTerms(globs) {
+  return terms(globs.join(" ").replace(/[/*._-]+/g, " "));
+}
+function askMemory(question, nodes, opts = {}) {
+  const limit = Math.max(1, opts.limit ?? 5);
+  const qTerms = [...new Set(terms(question))];
+  const empty = { question, terms: qTerms, hits: [], answer: [] };
+  if (nodes.length === 0 || qTerms.length === 0 && !opts.citedPaths?.length) return empty;
+  const docs = nodes.map((n2) => {
+    const words = [
+      ...Array.from({ length: TITLE_WEIGHT }, () => terms(n2.title)).flat(),
+      ...terms(n2.body),
+      ...globTerms(n2.fileGlobs)
+    ];
+    const tf = /* @__PURE__ */ new Map();
+    for (const w of words) tf.set(w, (tf.get(w) ?? 0) + 1);
+    return { node: n2, tf, len: words.length };
+  });
+  const avgLen = docs.reduce((s, d) => s + d.len, 0) / docs.length || 1;
+  const df = /* @__PURE__ */ new Map();
+  for (const t2 of qTerms) df.set(t2, docs.filter((d) => d.tf.has(t2)).length);
+  const idf = (t2) => {
+    const n2 = df.get(t2) ?? 0;
+    return Math.log(1 + (docs.length - n2 + 0.5) / (n2 + 0.5));
+  };
+  const cited = (opts.citedPaths ?? []).filter(Boolean);
+  const scored = docs.map((d) => {
+    let score = 0;
+    for (const t2 of qTerms) {
+      const f = d.tf.get(t2) ?? 0;
+      if (f === 0) continue;
+      score += idf(t2) * (f * (K1 + 1)) / (f + K1 * (1 - B + B * d.len / avgLen));
+    }
+    if (cited.length > 0 && d.node.fileGlobs.some((g) => matchesAny(g, cited))) score += PATH_BONUS;
+    return { node: d.node, score };
+  }).filter((s) => s.score > 0);
+  scored.sort((a, b) => b.score - a.score || a.node.nodeId.localeCompare(b.node.nodeId));
+  const top = scored[0]?.score ?? 0;
+  const hits = scored.filter((s) => s.score >= top * RELATIVE_FLOOR).slice(0, limit).map((s) => ({
+    ...s.node,
+    score: Math.round(s.score * 100) / 100,
+    excerpt: bestSentences(s.node.body, qTerms, idf, 2)
+  }));
+  return { question, terms: qTerms, hits, answer: composeAnswer(hits, qTerms, idf) };
+}
+function matchesAny(glob, paths) {
+  let re;
+  try {
+    re = globToRegex(glob);
+  } catch {
+    return false;
+  }
+  return paths.some((p) => re.test(p) || p === glob || glob.startsWith(`${p}/`));
+}
+function sentences(body2) {
+  const prose = body2.replace(/```[\s\S]*?```/g, " ").split("\n").filter((l) => !/^\s*(#|- \[\[|\*\*[^*]+:\*\*\s*$|>)/.test(l)).join("\n");
+  return prose.split(/(?<=[.!?])\s+(?=[A-Z0-9`"'(\[])|\n{2,}/).map((s) => s.replace(/\s+/g, " ").trim()).filter((s) => s.length >= MIN_SENTENCE);
+}
+function sentenceScore(sentence, qTerms, idf) {
+  const own = new Set(terms(sentence));
+  let s = 0;
+  for (const t2 of qTerms) if (own.has(t2)) s += idf(t2);
+  return s;
+}
+function bestSentences(body2, qTerms, idf, n2) {
+  return sentences(body2).map((text3, i2) => ({ text: text3, i: i2, s: sentenceScore(text3, qTerms, idf) })).filter((x) => x.s > 0).sort((a, b) => b.s - a.s || a.i - b.i).slice(0, n2).map((x) => x.text);
+}
+function composeAnswer(hits, qTerms, idf) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  const pool = hits.slice(0, 3);
+  for (const round of [0, 1]) {
+    for (const h of pool) {
+      const text3 = h.excerpt[round];
+      if (!text3 || seen.has(text3) || sentenceScore(text3, qTerms, idf) === 0) continue;
+      seen.add(text3);
+      out2.push({ text: text3, nodeId: h.nodeId });
+      if (out2.length >= ANSWER_LINES) return out2;
+    }
+  }
+  return out2;
+}
+
+// src/commands/memory-ask.ts
+var BODY_JSON_MAX = 4e3;
+async function loadAskNodes(opts = {}) {
+  const out2 = [];
+  for (const n2 of await listLocalNodes()) {
+    const status = readStatus(n2.content);
+    if (!opts.includeInactive && status !== "active") continue;
+    const fm = n2.content.match(/^---\n([\s\S]*?)\n---\n/);
+    out2.push({
+      nodeId: n2.nodeId,
+      path: n2.path,
+      kind: pickFrontmatter(fm?.[1] ?? "", "kind") ?? n2.path.split("/")[0],
+      title: readTitle(n2.content) ?? n2.nodeId,
+      body: n2.content.slice(fm ? fm[0].length : 0).trim(),
+      fileGlobs: readGlobs(n2.content),
+      status,
+      scope: "repo"
+    });
+  }
+  try {
+    for (const c of await readOrgMirror()) {
+      out2.push({
+        nodeId: c.tag_id,
+        path: null,
+        kind: c.kind,
+        title: c.title,
+        body: c.body,
+        fileGlobs: [],
+        status: "active",
+        scope: "org",
+        origin: c.origin
+      });
+    }
+  } catch {
+  }
+  return out2;
+}
+function printText(result, full) {
+  const lines = [];
+  if (result.answer.length > 0) {
+    lines.push("Answer, quoted from the nodes (read the nodes before you rely on it):");
+    for (const a of result.answer) lines.push(`  - ${a.text} [${a.nodeId}]`);
+    lines.push("");
+  }
+  lines.push(`${result.hits.length} node(s), best first:`);
+  result.hits.forEach((h, i2) => {
+    const where2 = h.scope === "org" ? `org claim ${h.origin ?? ""}`.trim() : `.verity/memory/${h.path}`;
+    const status = h.status !== "active" ? ` \xB7 ${h.status}` : "";
+    lines.push("");
+    lines.push(`${i2 + 1}. ${h.nodeId} \xB7 ${h.kind}${status} \xB7 score ${h.score}`);
+    lines.push(`   ${h.title}`);
+    lines.push(`   ${where2}${h.fileGlobs.length > 0 ? ` \xB7 scope: ${h.fileGlobs.slice(0, 3).join(", ")}` : ""}`);
+    if (full) {
+      for (const l of h.body.split("\n")) lines.push(`   ${l}`);
+    } else {
+      for (const e of h.excerpt) lines.push(`   "${e}"`);
+    }
+  });
+  console.log(terminalText(lines.join("\n"), Number.POSITIVE_INFINITY));
+}
+function registerMemoryAskCommand(memory2) {
+  memory2.command("ask <question...>").alias("recall").description("Ask the knowledge graph a question. Prints the matching nodes with their ids, and the sentences that answer it. Local: nothing is sent").option("--limit <n>", "At most this many nodes (default 5)", "5").option("--json", "Print JSON: the quoted answer, and each node with its id, path, score and body").option("--full", "Print each node's whole body instead of the matching sentences").option("--all", "Include archived and superseded nodes still on disk").action(async (words, opts) => {
+    const fromStdin = words.length === 1 && words[0] === "-";
+    const stdin = fromStdin ? readTextInput("-", "the question") : null;
+    if (stdin && !stdin.ok) {
+      printError(stdin.error);
+      process.exit(1);
+    }
+    const question = (stdin ? stdin.text ?? "" : words.join(" ")).replace(/\s+/g, " ").trim();
+    const limit = Number.parseInt(opts.limit, 10);
+    if (!question) {
+      printError('Ask a question: verity memory ask "why do we \u2026"');
+      process.exit(1);
+    }
+    if (!Number.isInteger(limit) || limit < 1 || limit > 50) {
+      printError("--limit is 1 to 50.");
+      process.exit(1);
+    }
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    refuseLinkedMemoryDir();
+    const nodes = await loadAskNodes({ includeInactive: !!opts.all });
+    let tree2 = [];
+    try {
+      tree2 = listTrackedFiles();
+    } catch {
+    }
+    const result = askMemory(question, nodes, { limit, citedPaths: deriveFileGlobs(question, tree2) });
+    if (opts.json) {
+      console.log(JSON.stringify({
+        question: result.question,
+        answer: result.answer.map((a) => ({ text: a.text, node_id: a.nodeId })),
+        nodes: result.hits.map((h) => ({
+          node_id: h.nodeId,
+          kind: h.kind,
+          title: h.title,
+          status: h.status,
+          scope: h.scope,
+          ...h.scope === "org" ? { origin: h.origin ?? null } : { path: `.verity/memory/${h.path}` },
+          file_globs: h.fileGlobs,
+          score: h.score,
+          excerpt: h.excerpt,
+          body: h.body.length > BODY_JSON_MAX ? `${h.body.slice(0, BODY_JSON_MAX)}\u2026` : h.body
+        }))
+      }, null, 2));
+      process.exit(0);
+    }
+    if (nodes.length === 0) {
+      const hasGraph = (0, import_node_fs86.existsSync)(projectPath(`${VERITY_DIR}/memory`));
+      console.log(hasGraph ? "The knowledge graph here has no nodes yet." : "No knowledge graph in this repository yet. `verity memory pull` fetches it.");
+      process.exit(0);
+    }
+    if (result.hits.length === 0) {
+      console.log(`No node matches "${terminalText(question, 200)}". Try other words, or \`verity memory pull\` if the graph here is old.`);
+      process.exit(0);
+    }
+    printText(result, !!opts.full);
+    process.exit(0);
+  });
+}
+
+// src/commands/memory-dream.ts
+var import_promises19 = require("node:fs/promises");
+var import_node_fs87 = require("node:fs");
+var import_node_path73 = require("node:path");
+
+// src/lib/memory-dream.ts
+var MERGE_AT = 0.6;
+var REVIEW_AT = 0.4;
+var REVIEW_MAX = 40;
+function toDreamNode(file) {
+  if (readStatus(file.content) !== "active") return null;
+  const m = file.content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  const fm = m?.[1] ?? "";
+  const supersededBy = pickFrontmatter(fm, "superseded_by");
+  const confidence = Number.parseFloat(pickFrontmatter(fm, "confidence") ?? "");
+  return {
+    nodeId: file.nodeId,
+    path: file.path,
+    kind: pickFrontmatter(fm, "kind") ?? file.path.split("/")[0],
+    title: readTitle(file.content) ?? file.nodeId,
+    body: ownText(m?.[2] ?? ""),
+    fileGlobs: readGlobs(file.content),
+    source: pickFrontmatter(fm, "source") ?? "extractor",
+    confidence: Number.isFinite(confidence) ? confidence : 0.5,
+    createdAt: pickFrontmatter(fm, "created_at") ?? "",
+    createdBy: pickFrontmatter(fm, "created_by") ?? "",
+    supersededBy: supersededBy && supersededBy !== "null" ? supersededBy : null,
+    contradicts: pickFrontmatterArray(fm, "contradicts")
+  };
+}
+function ownText(rest) {
+  return rest.replace(/^\s*# .*\n/, "").replace(/\n## Related\n[\s\S]*$/, "").trim();
+}
+var STUB_SENTENCES = [
+  /This project uses \*\*[^*\n]+\*\*\.?/g,
+  /Capture gotchas and integration-specific decisions here via `\/verity-reflect` as they come up during work\.?/g
+];
+function isPlaceholder(n2) {
+  let own = n2.body;
+  let template = false;
+  for (const re of STUB_SENTENCES) {
+    const stripped = own.replace(re, " ");
+    if (stripped !== own) template = true;
+    own = stripped;
+  }
+  const ownTerms = terms(own);
+  if (template) return ownTerms.length === 0;
+  return ownTerms.length === 0 && terms(n2.title).length === 0;
+}
+function similarity(a, b) {
+  const all = jaccard(new Set(terms(`${a.title} ${a.body}`)), new Set(terms(`${b.title} ${b.body}`)));
+  const title = jaccard(new Set(terms(a.title)), new Set(terms(b.title)));
+  return Math.max(all, (all + title) / 2);
+}
+function jaccard(a, b) {
+  if (a.size === 0 || b.size === 0) return 0;
+  let inter = 0;
+  for (const x of a) if (b.has(x)) inter++;
+  return inter / (a.size + b.size - inter);
+}
+var SOURCE_RANK = { user: 3, agent: 2, extractor: 1 };
+function compareStrength(a, b) {
+  return (SOURCE_RANK[b.source] ?? 0) - (SOURCE_RANK[a.source] ?? 0) || b.confidence - a.confidence || b.fileGlobs.length - a.fileGlobs.length || a.createdAt.localeCompare(b.createdAt) || a.nodeId.localeCompare(b.nodeId);
+}
+var isConfirmed = (n2) => n2.source === "user";
+var pairKey = (a, b) => [a, b].sort().join("|");
+var NEGATION = /\b(?:not|no|never|none|nor|neither|without|avoid|stop|forbid(?:den)?|disallow(?:ed)?|cannot|can't|cant|don't|dont|doesn't|doesnt|didn't|isn't|aren't|wasn't|won't|wont|shouldn't|mustn't|needn't)\b/g;
+function negations(text3) {
+  return (text3.toLowerCase().replace(/[’`]/g, "'").match(NEGATION) ?? []).length;
+}
+function negatedTerms(text3) {
+  const lower = text3.toLowerCase().replace(/[’`]/g, "'");
+  const out2 = [];
+  for (const m of lower.matchAll(NEGATION)) {
+    const after = lower.slice((m.index ?? 0) + m[0].length, (m.index ?? 0) + m[0].length + 60);
+    out2.push(terms(after)[0] ?? "\u2205");
+  }
+  return out2.sort();
+}
+function samePolarity(a, b) {
+  if (negations(a.title) > 0 !== negations(b.title) > 0) return false;
+  const na = negatedTerms(`${a.title}. ${a.body}`);
+  const nb = negatedTerms(`${b.title}. ${b.body}`);
+  return na.length === nb.length && na.every((t2, i2) => t2 === nb[i2]);
+}
+var round2 = (x) => Math.round(x * 100) / 100;
+function planDream(input, opts = {}) {
+  const mergeAt = opts.mergeAt ?? MERGE_AT;
+  const reviewAt = Math.min(opts.reviewAt ?? REVIEW_AT, mergeAt);
+  const byId = new Map(input.map((n2) => [n2.nodeId, n2]));
+  const changes = [];
+  const review = [];
+  const touched = /* @__PURE__ */ new Set();
+  const reviewed = /* @__PURE__ */ new Set();
+  const addReview = (a, b, why, sim) => {
+    const key = pairKey(a.nodeId, b.nodeId);
+    if (reviewed.has(key)) return;
+    reviewed.add(key);
+    review.push({ nodes: [a.nodeId, b.nodeId], titles: [a.title, b.title], why, ...sim !== void 0 && { similarity: round2(sim) } });
+  };
+  for (const n2 of input) {
+    if (isConfirmed(n2) || !isPlaceholder(n2)) continue;
+    changes.push({ type: "prune", nodeId: n2.nodeId, title: n2.title, why: "a placeholder with no content of its own" });
+    touched.add(n2.nodeId);
+  }
+  for (const n2 of input) {
+    if (touched.has(n2.nodeId) || !n2.supersededBy) continue;
+    const by = byId.get(n2.supersededBy);
+    if (!by || touched.has(by.nodeId)) continue;
+    if (isConfirmed(n2)) {
+      addReview(n2, by, "marked superseded, but a person confirmed it");
+      continue;
+    }
+    changes.push({ type: "supersede", nodeId: n2.nodeId, title: n2.title, by: by.nodeId, why: `its superseded_by names ${by.nodeId}` });
+    touched.add(n2.nodeId);
+  }
+  for (const a of input) {
+    for (const id of a.contradicts) {
+      const b = byId.get(id);
+      if (!b || touched.has(a.nodeId) || touched.has(b.nodeId)) continue;
+      if (isConfirmed(a) !== isConfirmed(b)) {
+        const [keep, drop] = isConfirmed(a) ? [a, b] : [b, a];
+        changes.push({ type: "supersede", nodeId: drop.nodeId, title: drop.title, by: keep.nodeId, why: `contradicts ${keep.nodeId}, which a person confirmed` });
+        touched.add(drop.nodeId);
+      } else {
+        addReview(a, b, "they contradict each other, and nothing in the graph says which is right");
+      }
+    }
+  }
+  const contradicting = /* @__PURE__ */ new Set();
+  for (const a of input) for (const id of a.contradicts) contradicting.add(pairKey(a.nodeId, id));
+  const pool = input.filter((n2) => !touched.has(n2.nodeId)).sort(compareStrength);
+  const merged = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < pool.length; i2++) {
+    const keep = pool[i2];
+    if (merged.has(keep.nodeId)) continue;
+    for (let j = i2 + 1; j < pool.length; j++) {
+      const other = pool[j];
+      if (merged.has(other.nodeId) || other.kind !== keep.kind) continue;
+      if (contradicting.has(pairKey(keep.nodeId, other.nodeId))) continue;
+      const sim = similarity(keep, other);
+      if (sim < reviewAt) continue;
+      if (sim < mergeAt) {
+        addReview(keep, other, "they may say the same thing", sim);
+        continue;
+      }
+      if (!samePolarity(keep, other)) {
+        addReview(keep, other, "one says not or never where the other does not: they may say opposite things", sim);
+        continue;
+      }
+      if (isConfirmed(other)) {
+        addReview(keep, other, "a near-duplicate, but a person confirmed both or the weaker one", sim);
+        continue;
+      }
+      const addGlobs = other.fileGlobs.filter((g) => !keep.fileGlobs.includes(g));
+      if (isConfirmed(keep) && addGlobs.length > 0) {
+        addReview(keep, other, `a near-duplicate, but merging would widen the scope of ${keep.nodeId}, which a person confirmed`, sim);
+        continue;
+      }
+      changes.push({
+        type: "merge",
+        nodeId: other.nodeId,
+        title: other.title,
+        into: keep.nodeId,
+        similarity: round2(sim),
+        addGlobs,
+        why: `a near-duplicate of ${keep.nodeId}`
+      });
+      merged.add(other.nodeId);
+    }
+  }
+  review.sort((a, b) => (b.similarity ?? 1) - (a.similarity ?? 1));
+  return {
+    scanned: input.length,
+    changes,
+    review: review.slice(0, REVIEW_MAX),
+    reviewOverflow: Math.max(0, review.length - REVIEW_MAX)
+  };
+}
+function oneLine2(title, max = 90) {
+  const flat = title.replace(/\s+/g, " ").trim();
+  return flat.length <= max ? flat : `${flat.slice(0, max - 1).replace(/\s+\S*$/, "")}\u2026`;
+}
+function renderPlan(plan, heading) {
+  const lines = [`# ${heading}`, "", `Scanned ${plan.scanned} active node(s).`, ""];
+  const of = (t2) => plan.changes.filter((c) => c.type === t2);
+  const section = (title, items, line2) => {
+    if (items.length === 0) return;
+    lines.push(`## ${title} (${items.length})`, "");
+    for (const c of items) lines.push(line2(c));
+    lines.push("");
+  };
+  section("Merge near-duplicates", of("merge"), (c) => {
+    const m = c;
+    return `- ${m.nodeId} \u2192 into ${m.into} (overlap ${m.similarity})${m.addGlobs.length ? `, scope +${m.addGlobs.join(", ")}` : ""} \u2014 ${oneLine2(m.title)}`;
+  });
+  section("Retire superseded or contradicted", of("supersede"), (c) => `- ${c.nodeId} \u2014 ${c.why} \u2014 ${oneLine2(c.title)}`);
+  section("Prune placeholders", of("prune"), (c) => `- ${c.nodeId} \u2014 ${oneLine2(c.title)}`);
+  if (plan.changes.length === 0) lines.push("Nothing to change.", "");
+  if (plan.review.length > 0) {
+    lines.push(`## For a person to decide (${plan.review.length + plan.reviewOverflow}, not applied)`, "");
+    for (const r of plan.review) {
+      lines.push(`- ${r.nodes[0]} / ${r.nodes[1]}${r.similarity !== void 0 ? ` (overlap ${r.similarity})` : ""} \u2014 ${r.why}`);
+      lines.push(`  "${oneLine2(r.titles[0], 70)}" / "${oneLine2(r.titles[1], 70)}"`);
+    }
+    if (plan.reviewOverflow > 0) lines.push(`- \u2026 and ${plan.reviewOverflow} more`);
+    lines.push("", 'To act on one: verity memory delete <id> --reason "duplicate of <id>"', "");
+  }
+  return terminalText(lines.join("\n"), Number.POSITIVE_INFINITY);
+}
+
+// src/commands/memory-dream.ts
+var dreamsDir = () => projectPath(`${VERITY_DIR}/dreams`);
+var DREAM_ID = /^dream-\d{8}-\d{6}(?:-\d{3})?$/;
+var MAX_RECORD_BYTES2 = 8 * 1024 * 1024;
+function newDreamId(now = Date.now()) {
+  for (let t2 = now; ; t2++) {
+    const iso = new Date(t2).toISOString();
+    const id = `dream-${iso.slice(0, 10).replace(/-/g, "")}-${iso.slice(11, 19).replace(/:/g, "")}-${iso.slice(20, 23)}`;
+    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(dreamsDir(), `${id}.json`))) return id;
+  }
+}
+async function saveRecord(record2) {
+  const outcome = record2.results.length > 0 ? ["## Outcome", "", ...record2.results.map((r) => `- ${r.ok ? "done" : "FAILED"}: ${r.type} ${r.nodeId}${r.error ? ` \u2014 ${r.error}` : ""}`), ""] : [];
+  const footer = [`Status: ${record2.status}.`, "", `Undo: verity memory dream --revert ${record2.id}`, ""];
+  const saved = await writeFileAtomicInTree((0, import_node_path73.join)(dreamsDir(), `${record2.id}.json`), JSON.stringify(record2, null, 2) + "\n") && await writeFileAtomicInTree((0, import_node_path73.join)(dreamsDir(), `${record2.id}.md`), [renderPlan(record2.plan, record2.id), ...outcome, ...footer].join("\n"));
+  if (!saved) throw new Error(".verity/dreams/ is a link, or a folder outside the repository");
+}
+async function readRecord(id) {
+  if (!DREAM_ID.test(id)) return null;
+  const read2 = readRegularFileInRoot(repoRoot(), (0, import_node_path73.join)(dreamsDir(), `${id}.json`), MAX_RECORD_BYTES2);
+  if (!read2.ok) return null;
+  try {
+    const parsed = JSON.parse(read2.content);
+    return isDreamRecord(parsed) && parsed.id === id ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function isDreamRecord(v) {
+  const r = v;
+  const str4 = (x) => typeof x === "string";
+  if (!r || !str4(r.id) || !["applying", "applied", "partial", "reverted"].includes(r.status)) return false;
+  if (!r.plan || !Array.isArray(r.plan.changes) || !r.plan.changes.every((c) => !!c && str4(c.nodeId) && str4(c.type))) return false;
+  if (!Array.isArray(r.results) || !r.results.every((x) => !!x && str4(x.nodeId) && str4(x.type) && typeof x.ok === "boolean")) return false;
+  if (!r.before || typeof r.before !== "object" || Array.isArray(r.before)) return false;
+  const before = r.before;
+  if (!Object.values(before).every((b) => !!b && str4(b.path) && str4(b.content))) return false;
+  if (r.after !== void 0) {
+    if (!r.after || typeof r.after !== "object" || Array.isArray(r.after)) return false;
+    if (!Object.values(r.after).every((b) => !!b && str4(b.path) && str4(b.content))) return false;
+  }
+  return r.results.every((x) => !x.ok || Object.prototype.hasOwnProperty.call(before, x.nodeId));
+}
+async function resolveApi2(program2) {
+  const globals = program2.opts();
+  const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError(tokenResult.error);
+    process.exit(1);
+  }
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!urlResult.ok) {
+    printError(urlResult.error);
+    process.exit(1);
+  }
+  return { serviceUrl: urlResult.data, token: tokenResult.data.token, verbose: globals.verbose };
+}
+async function currentNodes() {
+  return (await listLocalNodes()).map(toDreamNode).filter((n2) => n2 !== null);
+}
+async function applyDreamPlan(api, plan) {
+  const record2 = { id: newDreamId(), created_at: (/* @__PURE__ */ new Date()).toISOString(), status: "applying", plan, before: {}, results: [] };
+  const keepers = new Set(plan.changes.filter((c) => c.type === "merge" && c.addGlobs.length > 0).map((c) => c.into));
+  for (const id of [...plan.changes.map((c) => c.nodeId), ...keepers]) {
+    const local = await findLocalNode(id);
+    if (local) record2.before[id] = { path: local.path, content: local.content };
+  }
+  await saveRecord(record2);
+  const addGlobs = /* @__PURE__ */ new Map();
+  for (const c of plan.changes) {
+    if (c.type === "merge" && c.addGlobs.length > 0 && record2.before[c.nodeId]) {
+      addGlobs.set(c.into, [...addGlobs.get(c.into) ?? [], ...c.addGlobs]);
+    }
+  }
+  const keeperFailed = /* @__PURE__ */ new Set();
+  for (const [id, globs] of addGlobs) {
+    const keeper = await findLocalNode(id);
+    let error;
+    if (!keeper || !record2.before[id]) error = "the file is not here";
+    else {
+      const before = record2.before[id];
+      const next = applyNodeChanges(keeper.content, { fileGlobs: [.../* @__PURE__ */ new Set([...readGlobs(keeper.content), ...globs])] });
+      const result = next === null ? { ok: false, error: "no frontmatter" } : await editNode(api, keeper, next);
+      if (result.ok && result.mismatched.length === 0) {
+        record2.after = { ...record2.after ?? {}, [id]: { path: before.path, content: result.final } };
+      } else if (result.ok && next !== null) {
+        error = `the service did not take: ${result.mismatched.join(", ")}`;
+        const back = await editNode(api, { ...keeper, content: next }, before.content, { force: true });
+        if (back.ok && back.mismatched.length === 0) error = `${error}; put back as it was`;
+        else {
+          const held = back.ok ? back.final : result.final;
+          record2.after = { ...record2.after ?? {}, [id]: { path: before.path, content: held } };
+          error = `${error}; and putting it back failed (${back.ok ? back.mismatched.join(", ") : back.error}): --revert retries`;
+        }
+      } else {
+        error = result.ok ? void 0 : result.error;
+        if (!await writeNodeFile(before.path, before.content)) {
+          error = `${error}; and the file here could not be put back, so it still has the wider scope (--revert puts it back)`;
+        }
+      }
+    }
+    if (error) keeperFailed.add(id);
+    record2.results.push({ nodeId: id, type: "scope", ok: !error, ...error && { error } });
+    await saveRecord(record2);
+  }
+  for (const change of plan.changes) {
+    if (!record2.before[change.nodeId]) {
+      record2.results.push({ nodeId: change.nodeId, type: change.type, ok: false, error: "its file is gone, so its text could not be saved; not changed" });
+      await saveRecord(record2);
+      continue;
+    }
+    if (change.type === "merge" && keeperFailed.has(change.into)) {
+      record2.results.push({ nodeId: change.nodeId, type: change.type, ok: false, error: `${change.into} could not take its scope; not merged` });
+      await saveRecord(record2);
+      continue;
+    }
+    const result = await deleteNode(api, change.nodeId, {
+      status: change.type === "prune" ? "archived" : "superseded",
+      via: "dream",
+      reason: `${record2.id}: ${change.why}`
+    });
+    record2.results.push({
+      nodeId: change.nodeId,
+      type: change.type,
+      ok: result.ok,
+      ...!result.ok && { error: result.error },
+      ...result.ok && result.fileKept && { error: "done on the service, but the file here could not be removed" }
+    });
+    await saveRecord(record2);
+  }
+  record2.status = record2.results.every((r) => r.ok) ? "applied" : "partial";
+  await saveRecord(record2);
+  return record2;
+}
+async function revert(api, record2) {
+  const out2 = [];
+  if (record2.status === "applying") {
+    const seen = new Set(record2.results.map((r) => r.nodeId));
+    for (const c of record2.plan.changes) {
+      if (!seen.has(c.nodeId) && record2.before[c.nodeId]) record2.results.push({ nodeId: c.nodeId, type: c.type, ok: true });
+    }
+    const planned = new Set(record2.plan.changes.map((c) => c.nodeId));
+    for (const id of Object.keys(record2.before)) {
+      if (!planned.has(id) && !seen.has(id)) record2.results.push({ nodeId: id, type: "scope", ok: true });
+    }
+  }
+  const changedOnService = record2.results.filter((x) => x.type === "scope" && (x.ok || record2.after?.[x.nodeId]));
+  for (const r of changedOnService) {
+    const before = record2.before[r.nodeId];
+    if (!before) {
+      out2.push({ ...r, ok: false, error: "no saved text" });
+      continue;
+    }
+    const current = await findLocalNode(r.nodeId) ?? { nodeId: r.nodeId, path: before.path, content: "" };
+    const after = record2.after?.[r.nodeId]?.content;
+    let result = await editNode(api, current, before.content, after !== void 0 ? { base: after } : {});
+    if (!result.ok && result.stale && after !== void 0) {
+      result = await editNode(api, current, before.content, { force: true, expect: before.content });
+    }
+    const error = !result.ok ? result.stale ? "changed on the service since this dream; not reverted. Fix it with `verity memory edit`" : result.error : result.mismatched.length > 0 ? `the service did not take: ${result.mismatched.join(", ")}` : void 0;
+    out2.push({ nodeId: r.nodeId, type: "scope", ok: !error, ...error && { error } });
+  }
+  for (const r of record2.results.filter((x) => !x.ok && x.type === "scope" && !record2.after?.[x.nodeId])) {
+    const before = record2.before[r.nodeId];
+    const current = await findLocalNode(r.nodeId);
+    if (!before || current?.content === before.content) continue;
+    const ok = await writeNodeFile(before.path, before.content);
+    out2.push({ nodeId: r.nodeId, type: "scope", ok, ...!ok && { error: "the file here could not be written back" } });
+  }
+  for (const r of [...record2.results].reverse().filter((x) => x.ok && x.type !== "scope")) {
+    const result = await restoreNode(api, r.nodeId, record2.before[r.nodeId]);
+    out2.push({ nodeId: r.nodeId, type: r.type, ok: result.ok, ...!result.ok && { error: result.error } });
+  }
+  return out2;
+}
+function registerMemoryDreamCommand(memory2, program2) {
+  memory2.command("dream").description("Consolidate the knowledge graph: merge near-duplicates, retire superseded nodes, prune empty placeholders. Prints the plan; --apply makes the changes and saves a report that --revert undoes").option("--apply", "Make the changes, on the service and here, and save a report in .verity/dreams/").option("--revert <dream-id>", "Undo an applied dream").option("--list", "List the dreams applied on this machine").option("--json", "Print the plan, or the outcome, as JSON").action(async (opts) => {
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    refuseLinkedMemoryDir();
+    if ([opts.apply, opts.revert !== void 0, opts.list].filter(Boolean).length > 1) {
+      printError("Use one of --apply, --revert and --list.");
+      process.exit(1);
+    }
+    if (opts.list) {
+      const files = (0, import_node_fs87.existsSync)(dreamsDir()) ? (await (0, import_promises19.readdir)(dreamsDir())).filter((f) => f.endsWith(".json") && DREAM_ID.test(f.slice(0, -5))).sort() : [];
+      if (files.length === 0) {
+        console.log("No dream has been applied on this machine.");
+        process.exit(0);
+      }
+      for (const f of files) {
+        const r = await readRecord(f.slice(0, -5));
+        if (r) console.log(terminalText(`${r.id}  ${r.status.padEnd(8)}  ${r.results.filter((x) => x.ok).length} change(s)  .verity/dreams/${r.id}.md`));
+      }
+      process.exit(0);
+    }
+    if (opts.revert !== void 0) {
+      if (!DREAM_ID.test(opts.revert)) {
+        printError("A dream id looks like dream-20261112-101500. `verity memory dream --list` lists them.");
+        process.exit(1);
+      }
+      const record3 = await readRecord(opts.revert);
+      if (!record3) {
+        printError(`No valid record .verity/dreams/${opts.revert}.json on this machine (missing, or not a record this command wrote).`);
+        process.exit(1);
+      }
+      if (record3.status === "reverted") {
+        printInfo(`${record3.id} is already reverted.`);
+        process.exit(0);
+      }
+      const api2 = await resolveApi2(program2);
+      const results = await revert(api2, record3);
+      const failed2 = results.filter((r) => !r.ok);
+      if (failed2.length === 0) {
+        record3.status = "reverted";
+        record3.reverted_at = (/* @__PURE__ */ new Date()).toISOString();
+        try {
+          await saveRecord(record3);
+        } catch (err2) {
+          printWarn(`Reverted, but the record could not be marked as reverted: ${err2.message}.`);
+        }
+      }
+      if (opts.json) {
+        console.log(JSON.stringify({ id: record3.id, status: record3.status, results }, null, 2));
+        process.exit(failed2.length ? 1 : 0);
+      }
+      if (failed2.length === 0) printInfo(`Reverted ${record3.id}: ${results.length} node(s) back as they were.`);
+      else {
+        printError(`Reverted ${results.length - failed2.length} of ${results.length}. Not reverted:`);
+        for (const f of failed2) printWarn(`  ${f.nodeId}: ${f.error}`);
+        printWarn(`  Run the same command again to retry.`);
+      }
+      process.exit(failed2.length ? 1 : 0);
+    }
+    const nodes = await currentNodes();
+    if (nodes.length === 0) {
+      console.log("No active nodes in .verity/memory/. `verity memory pull` fetches the graph.");
+      process.exit(0);
+    }
+    const plan = planDream(nodes);
+    if (!opts.apply) {
+      if (opts.json) console.log(JSON.stringify({ applied: false, ...plan }, null, 2));
+      else {
+        console.log(renderPlan(plan, "Dream plan (nothing changed yet)"));
+        if (plan.changes.length > 0) console.log("Apply it: verity memory dream --apply");
+      }
+      process.exit(0);
+    }
+    if (plan.changes.length === 0) {
+      if (opts.json) console.log(JSON.stringify({ applied: false, ...plan }, null, 2));
+      else console.log(renderPlan(plan, "Dream plan: nothing to change"));
+      process.exit(0);
+    }
+    const api = await resolveApi2(program2);
+    let record2;
+    try {
+      record2 = await applyDreamPlan(api, plan);
+    } catch (err2) {
+      printError(`Could not save the dream record: ${err2.message}. Changes stop here; the record on disk says what was done.`);
+      process.exit(1);
+    }
+    const failed = record2.results.filter((r) => !r.ok);
+    if (opts.json) {
+      console.log(JSON.stringify({ applied: true, id: record2.id, status: record2.status, report: `.verity/dreams/${record2.id}.md`, results: record2.results, review: plan.review }, null, 2));
+      process.exit(failed.length ? 1 : 0);
+    }
+    console.log(renderPlan(plan, `${record2.id} (applied)`));
+    if (failed.length > 0) {
+      printWarn(`${failed.length} change(s) failed:`);
+      for (const f of failed) printWarn(`  ${f.type} ${f.nodeId}: ${f.error}`);
+    }
+    printInfo(`Report: .verity/dreams/${record2.id}.md`);
+    printInfo(`Undo: verity memory dream --revert ${record2.id}`);
+    process.exit(failed.length ? 1 : 0);
+  });
+}
+
 // src/commands/memory.ts
 function registerMemoryCommand(program2) {
   const memory2 = program2.command("memory").description("Manage the project knowledge base");
+  registerMemoryCurationCommands(memory2, program2);
+  registerMemoryAskCommand(memory2);
+  registerMemoryDreamCommand(memory2, program2);
   memory2.command("seed").description("Seed .verity/memory/ from what /verity-setup already extracted (knowledge_spec, README, CLAUDE.md)").option("--force", "Re-seed even if the memory dir already has seeded nodes").option("--dry-run", "Print the candidate nodes without writing or syncing").action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -46184,7 +48211,7 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs85 = require("node:fs");
+var import_node_fs88 = require("node:fs");
 var SCOPE = "every Claude Code session on this machine";
 function declineHeaders(why) {
   process.stderr.write(`Verity telemetry is off here: ${why} Nothing is exported from this session.
@@ -46192,7 +48219,7 @@ function declineHeaders(why) {
   process.exitCode = 1;
 }
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs85.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs88.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -46300,12 +48327,12 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs87 = require("node:fs");
-var import_node_path73 = require("node:path");
+var import_node_fs90 = require("node:fs");
+var import_node_path75 = require("node:path");
 
 // src/lib/prove/on-demand-run.ts
-var import_node_fs86 = require("node:fs");
-var import_node_path72 = require("node:path");
+var import_node_fs89 = require("node:fs");
+var import_node_path74 = require("node:path");
 var ON_DEMAND_RUN = `${PROOFS_DIR}/.results/.formal-run.json`;
 var ON_DEMAND_RUN_REUSE_MS = 18 * 6e4;
 function isLocalState2(root) {
@@ -46327,7 +48354,7 @@ function forgetOnDemandRun(root) {
   setFormalRun(null);
   if (!isLocalState2(root)) return;
   try {
-    (0, import_node_fs86.unlinkSync)((0, import_node_path72.join)(root, ON_DEMAND_RUN));
+    (0, import_node_fs89.unlinkSync)((0, import_node_path74.join)(root, ON_DEMAND_RUN));
   } catch {
   }
 }
@@ -46504,7 +48531,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path73.relative)(root, (0, import_node_path73.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path75.relative)(root, (0, import_node_path75.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -46558,7 +48585,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs90.existsSync)((0, import_node_path75.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -46582,7 +48609,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path73.relative)(root, f);
+      report.file = (0, import_node_path75.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -46620,7 +48647,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs87.existsSync)((0, import_node_path73.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs90.existsSync)((0, import_node_path75.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -46659,7 +48686,7 @@ ${report.error ?? ""}`);
         process.exit(2);
       }
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path73.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path75.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -46680,7 +48707,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path73.relative)(root, (0, import_node_path73.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path75.relative)(root, (0, import_node_path75.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -46754,7 +48781,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path73.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path75.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
@@ -46803,8 +48830,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path73.relative)(root, (0, import_node_path73.isAbsolute)(file) ? file : (0, import_node_path73.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path73.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path75.relative)(root, (0, import_node_path75.isAbsolute)(file) ? file : (0, import_node_path75.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path75.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -46820,8 +48847,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path73.relative)(root, (0, import_node_path73.isAbsolute)(file) ? file : (0, import_node_path73.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path73.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path75.relative)(root, (0, import_node_path75.isAbsolute)(file) ? file : (0, import_node_path75.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path75.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -46855,10 +48882,9 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs88 = require("node:fs");
-var import_node_child_process24 = require("node:child_process");
+var import_node_fs91 = require("node:fs");
 var import_node_os16 = require("node:os");
-var import_node_path74 = require("node:path");
+var import_node_path76 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -46866,7 +48892,7 @@ function registerLeanCommand(program2) {
     let version = null;
     if (tc) {
       try {
-        version = (0, import_node_child_process24.execFileSync)(tc.lake.replace(/lake(\.exe)?$/, "lean$1"), ["--version"], { env: tc.env, encoding: "utf-8", timeout: 1e4 }).trim();
+        version = execFileSync2(tc.lake.replace(/lake(\.exe)?$/, "lean$1"), ["--version"], { env: tc.env, encoding: "utf-8", timeout: 1e4 }).trim();
       } catch {
         version = null;
       }
@@ -46877,7 +48903,7 @@ function registerLeanCommand(program2) {
     const bg = readInstallState();
     const background = bg ? { ...bg, running: bg.state === "running" && installRunning() } : null;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs88.existsSync)((0, import_node_path74.join)(managed, "bin")), asset: leanAssetName(), background });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs91.existsSync)((0, import_node_path76.join)(managed, "bin")), asset: leanAssetName(), background });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -46898,7 +48924,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs88.existsSync)((0, import_node_path74.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs91.existsSync)((0, import_node_path76.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -46934,20 +48960,20 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs88.existsSync)(dir)) {
+    if (!(0, import_node_fs91.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs88.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs91.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.36.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.5");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.36.0");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {