@codex-agent/cli 0.1.0-main.13.sha3ad2ccf → 0.1.0-main.14.shac4b2c28

package/dist/codex-agent.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 
 // src/cli.mjs
-import fs10 from "node:fs";
-import path10 from "node:path";
+import fs11 from "node:fs";
+import path11 from "node:path";
 
 // src/core.mjs
-import fs9 from "node:fs";
-import path9 from "node:path";
+import fs10 from "node:fs";
+import path10 from "node:path";
 
 // ../../plugins/codex-agent/scripts/context-project.mjs
 import crypto4 from "node:crypto";
-import fs5 from "node:fs";
-import path5 from "node:path";
+import fs6 from "node:fs";
+import path6 from "node:path";
 
 // ../../plugins/codex-agent/generated/agent-profiles.mjs
 var agentProfiles = [
@@ -170,13 +170,13 @@ var listTreeFiles = (root, { includeDirectories = false } = {}) => {
   const visit = (directory) => {
     for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
       const absolute = path.join(directory, entry.name);
-      const relative2 = slash(path.relative(absoluteRoot, absolute));
-      if (entry.isSymbolicLink()) throw new Error(`Refusing to traverse symbolic link: ${relative2}`);
+      const relative3 = slash(path.relative(absoluteRoot, absolute));
+      if (entry.isSymbolicLink()) throw new Error(`Refusing to traverse symbolic link: ${relative3}`);
       if (entry.isDirectory()) {
-        if (includeDirectories) entries.push({ absolute, relative: relative2, type: "directory" });
+        if (includeDirectories) entries.push({ absolute, relative: relative3, type: "directory" });
         visit(absolute);
-      } else if (entry.isFile()) entries.push({ absolute, relative: relative2, type: "file" });
-      else throw new Error(`Unsupported filesystem entry in context catalog: ${relative2}`);
+      } else if (entry.isFile()) entries.push({ absolute, relative: relative3, type: "file" });
+      else throw new Error(`Unsupported filesystem entry in context catalog: ${relative3}`);
     }
   };
   visit(absoluteRoot);
@@ -295,13 +295,13 @@ var lstat = (target) => {
 };
 var filesystemErrorCode = (error) => typeof error?.code === "string" ? error.code : "UNKNOWN";
 var isInside = (root, target) => {
-  const relative2 = path2.relative(root, target);
-  return relative2 === "" || !relative2.startsWith(`..${path2.sep}`) && relative2 !== ".." && !path2.isAbsolute(relative2);
+  const relative3 = path2.relative(root, target);
+  return relative3 === "" || !relative3.startsWith(`..${path2.sep}`) && relative3 !== ".." && !path2.isAbsolute(relative3);
 };
 var inspectAncestry = (root, target) => {
   let current = root;
-  const relative2 = path2.relative(root, target);
-  const segments = relative2 ? relative2.split(path2.sep).filter(Boolean) : [];
+  const relative3 = path2.relative(root, target);
+  const segments = relative3 ? relative3.split(path2.sep).filter(Boolean) : [];
   for (const [position, segment] of segments.entries()) {
     current = path2.join(current, segment);
     const inspected = lstat(current);
@@ -1193,15 +1193,15 @@ var applyLockedTransaction = ({ root, documents, indexContent, backupPaths = []
     const stagedIndex = path3.join(stagedRoot, "index.json");
     fs3.writeFileSync(stagedIndex, indexContent, { flag: "wx" });
     const backedUp = [];
-    const existingBackups = normalizedBackups.filter((relative2) => fs3.existsSync(path3.join(contextRoot, ...relative2.split("/"))));
+    const existingBackups = normalizedBackups.filter((relative3) => fs3.existsSync(path3.join(contextRoot, ...relative3.split("/"))));
     if (existingBackups.length) {
       const backupRoot = path3.join(codexAgentRoot, "backups", timestamp(), ".codex-agent", "context");
       assertNoSymlink(projectRoot, backupRoot, "Context backup directory");
-      for (const relative2 of existingBackups) {
-        const source = path3.join(contextRoot, ...relative2.split("/"));
+      for (const relative3 of existingBackups) {
+        const source = path3.join(contextRoot, ...relative3.split("/"));
         assertInside(contextRoot, source, "Context backup source");
         assertNoSymlink(projectRoot, source, "Context backup source");
-        const destination = path3.join(backupRoot, ...relative2.split("/"));
+        const destination = path3.join(backupRoot, ...relative3.split("/"));
         fs3.mkdirSync(path3.dirname(destination), { recursive: true });
         fs3.copyFileSync(source, destination, fs3.constants.COPYFILE_EXCL);
         backedUp.push(slash(path3.relative(projectRoot, destination)));
@@ -1233,13 +1233,13 @@ var applyLockedTransaction = ({ root, documents, indexContent, backupPaths = []
       items: manifestItems
     };
     writeRecoveryManifest({ transactionRoot, manifest });
-    const promote = (relative2) => {
-      const staged = path3.join(stagedRoot, ...relative2.split("/"));
-      const destination = path3.join(contextRoot, ...relative2.split("/"));
+    const promote = (relative3) => {
+      const staged = path3.join(stagedRoot, ...relative3.split("/"));
+      const destination = path3.join(contextRoot, ...relative3.split("/"));
       assertInside(contextRoot, destination, "Context transaction destination");
       assertNoSymlink(projectRoot, destination, "Context transaction destination");
       fs3.mkdirSync(path3.dirname(destination), { recursive: true });
-      const rollback = path3.join(rollbackRoot, ...relative2.split("/"));
+      const rollback = path3.join(rollbackRoot, ...relative3.split("/"));
       const existed = fs3.existsSync(destination);
       if (existed) {
         fs3.mkdirSync(path3.dirname(rollback), { recursive: true });
@@ -1547,61 +1547,25 @@ var inspectContextCatalogPath = ({ root, relativePath, kind = "recovery" }) => {
   return inspectCatalog({ projectRoot, contextRoot, kind });
 };
 
-// ../../plugins/codex-agent/scripts/context-project.mjs
-var ANALYSIS_VERSION = 1;
-var CONTEXT_LIFECYCLE_VERSION = 1;
-var HASH_PATTERN2 = /^[a-f0-9]{64}$/;
-var LIFECYCLE_PHASES = /* @__PURE__ */ new Set(["prepared", "migration-applied", "managed-running", "managed-applied"]);
-var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
-  ".git",
-  ".codex-agent",
-  ".next",
-  ".nuxt",
-  ".turbo",
-  ".venv",
-  "build",
-  "coverage",
-  "dist",
-  "node_modules",
-  "target",
-  "vendor"
-]);
-var MANAGED_CONTEXT = [
-  ["architecture", "architecture/system.md", "System architecture, modules, entrypoints, and detected boundaries.", ["architecture", "modules", "entrypoints"], "high", ["modules", "entrypoints", "conventions.boundaries"]],
-  ["code-quality", "standards/code-quality.md", "Detected source layout, naming, and engineering conventions.", ["code", "quality", "conventions"], "critical", ["conventions", "languages"]],
-  ["testing", "standards/testing.md", "Detected test tooling, locations, and repository commands.", ["test", "verification", "commands"], "high", ["testing", "commands"]],
-  ["security", "standards/security.md", "Detected security-sensitive boundaries and baseline safeguards.", ["security", "auth", "secrets"], "critical", ["security"]],
-  ["project-intelligence", "project-intelligence/project.md", "Detected stack, package tooling, CI, and project intelligence.", ["project", "stack", "ci"], "medium", ["project", "packageManager", "languages", "frameworks", "ciCd"]]
-];
-var CODEX_AGENT_IGNORE_RULES = [
-  ".codex-agent/analysis.json",
-  ".codex-agent/sessions/",
-  ".codex-agent/backups/",
-  ".codex-agent/.locks/",
-  ".codex-agent/.transactions/",
-  ".codex-agent/**/*.tmp-*"
-];
-var BROAD_CODEX_AGENT_IGNORE_RULES = /* @__PURE__ */ new Set([
-  ".codex-agent",
-  ".codex-agent/",
-  ".codex-agent/**",
-  "/.codex-agent",
-  "/.codex-agent/",
-  "/.codex-agent/**"
-]);
-var MANAGED_CODEX_AGENT_IGNORE_RULES = new Set(CODEX_AGENT_IGNORE_RULES);
+// ../../plugins/codex-agent/scripts/lib/project-analysis.mjs
+import fs5 from "node:fs";
+import path5 from "node:path";
+var ANALYSIS_VERSION = 2;
 var slash2 = (value) => value.split(path5.sep).join("/");
 var unique = (items) => [...new Set(items.filter(Boolean))];
 var relative = (root, file) => slash2(path5.relative(root, file));
-var signal = (value, evidence = [], confidence = "unknown", status = "unknown") => ({
-  value,
-  evidence: unique(evidence),
-  confidence,
-  status
-});
+var signal = (value, evidence = [], confidence = "unknown", status = "unknown") => ({ value, evidence: unique(evidence), confidence, status });
 var detected = (value, evidence, confidence = "high") => signal(value, evidence, confidence, "detected");
 var inferred = (value, evidence, confidence = "medium") => signal(value, evidence, confidence, "inferred");
 var unknown = (empty) => signal(empty, [], "unknown", "unknown");
+var readText = (file, limit = 2 * 1024 * 1024) => {
+  try {
+    if (fs5.statSync(file).size > limit) return "";
+    return fs5.readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+};
 var readJson = (file) => {
   try {
     return JSON.parse(fs5.readFileSync(file, "utf8"));
@@ -1609,10 +1573,127 @@ var readJson = (file) => {
     return null;
   }
 };
-var walk = (root, limit = 6e3) => {
+var attributes = (tag) => Object.fromEntries([...tag.matchAll(/([A-Za-z_][\w:.-]*)\s*=\s*"([^"]*)"/g)].map((match) => [match[1].toLowerCase(), match[2]]));
+var major = (version) => String(version ?? "").replace(/^[^\d]*/, "").match(/^\d+/)?.[0] ?? null;
+var escapeRegex = (value) => value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+var globRegex = (pattern) => {
+  let source = "";
+  for (let index = 0; index < pattern.length; index += 1) {
+    const character = pattern[index];
+    if (character === "*" && pattern[index + 1] === "*") {
+      source += ".*";
+      index += 1;
+    } else if (character === "*") source += "[^/]*";
+    else if (character === "?") source += "[^/]";
+    else source += escapeRegex(character);
+  }
+  return source;
+};
+var parseIgnoreRules = (root) => [".gitignore", ".tfignore", ".ignore"].flatMap((name) => {
+  const file = path5.join(root, name);
+  if (!fs5.existsSync(file) || !fs5.statSync(file).isFile()) return [];
+  return readText(file).split(/\r?\n/).flatMap((line) => {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) return [];
+    const negated = trimmed.startsWith("!");
+    let body = (negated ? trimmed.slice(1) : trimmed).replace(/\\/g, "/");
+    const anchored = body.startsWith("/");
+    if (anchored) body = body.slice(1);
+    const directory = body.endsWith("/");
+    body = body.replace(/\/$/, "");
+    if (!body) return [];
+    const prefix = anchored || body.includes("/") ? "^" : "(?:^|/)";
+    return [{ source: name, negated, regex: new RegExp(`${prefix}${globRegex(body)}${directory ? "(?:/|$)" : "$"}`, "i") }];
+  });
+});
+var rootFiles = (root) => fs5.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
+var expandRootGlob = (root, pattern) => {
+  const normalized = slash2(pattern).replace(/^\.\//, "").replace(/\/$/, "");
+  const segments = normalized.split("/");
+  const results = [];
+  const visit = (directory, index) => {
+    if (index === segments.length) {
+      results.push(relative(root, directory) || ".");
+      return;
+    }
+    const segment = segments[index];
+    if (!segment.includes("*") && !segment.includes("?")) {
+      visit(path5.join(directory, segment), index + 1);
+      return;
+    }
+    if (!fs5.existsSync(directory)) return;
+    const matcher = new RegExp(`^${globRegex(segment)}$`);
+    for (const entry of fs5.readdirSync(directory, { withFileTypes: true })) if (entry.isDirectory() && matcher.test(entry.name)) visit(path5.join(directory, entry.name), index + 1);
+  };
+  visit(root, 0);
+  return results.filter((item) => fs5.existsSync(path5.join(root, item)));
+};
+var rootContainerMembers = (root) => {
+  const members = [];
+  const evidence = [];
+  const add = (member, source) => {
+    const normalized = slash2(member).replace(/^\.\//, "").replace(/\/$/, "");
+    if (!normalized || normalized.startsWith("../") || path5.isAbsolute(normalized)) return;
+    for (const expanded of normalized.includes("*") || normalized.includes("?") ? expandRootGlob(root, normalized) : [normalized]) {
+      if (!members.includes(expanded)) members.push(expanded);
+    }
+    evidence.push(source);
+  };
+  for (const file of rootFiles(root)) {
+    const absolute = path5.join(root, file);
+    const lower = file.toLowerCase();
+    const content = readText(absolute);
+    if (lower.endsWith(".sln")) for (const match of content.matchAll(/^Project\("[^"]+"\)\s*=\s*"[^"]+",\s*"([^"]+\.(?:cs|fs|vb)proj)"/gmi)) add(path5.dirname(match[1].replace(/\\/g, "/")), file);
+    else if (lower === "package.json") {
+      const manifest = readJson(absolute);
+      const workspaces = Array.isArray(manifest?.workspaces) ? manifest.workspaces : manifest?.workspaces?.packages;
+      for (const member of workspaces ?? []) add(member, "package.json#workspaces");
+    } else if (lower === "cargo.toml") {
+      const workspaceBlock = content.match(/^\s*\[workspace\]\s*$([\s\S]*?)(?=^\s*\[|(?![\s\S]))/m)?.[1] ?? "";
+      const workspace = workspaceBlock.match(/members\s*=\s*\[([\s\S]*?)\]/m)?.[1] ?? "";
+      for (const match of workspace.matchAll(/["']([^"']+)["']/g)) add(match[1], "Cargo.toml#workspace.members");
+    } else if (lower === "go.work") {
+      for (const match of content.matchAll(/^\s*use\s+([^\s()]+)\s*$/gm)) add(match[1], "go.work#use");
+      for (const block of content.matchAll(/^\s*use\s*\(\s*$([\s\S]*?)^\s*\)\s*$/gm)) {
+        for (const line of block[1].split(/\r?\n/)) {
+          const member = line.replace(/\/\/.*$/, "").trim();
+          if (member) add(member, "go.work#use");
+        }
+      }
+    } else if (lower === "pom.xml") for (const match of content.matchAll(/<module>([^<]+)<\/module>/g)) add(match[1], "pom.xml#modules");
+    else if (["settings.gradle", "settings.gradle.kts"].includes(lower)) {
+      for (const statement of content.matchAll(/^\s*(include|includeBuild)\s*(?:\(([^)]*)\)|(.+))$/gm)) {
+        for (const match of (statement[2] ?? statement[3] ?? "").matchAll(/["']:?([^"']+)["']/g)) add(match[1].replace(/:/g, "/"), `${file}#${statement[1]}`);
+      }
+    }
+  }
+  return { members: unique(members), evidence: unique(evidence) };
+};
+var INTERNAL_METADATA = /* @__PURE__ */ new Set([".agents", ".codex", ".codex-agent", ".git", ".hg", ".opencode", ".svn"]);
+var FALLBACK_TRANSIENT = /* @__PURE__ */ new Set([".cache", ".idea", ".tmp", ".venv", ".vs", "bin", "coverage", "dist", "node_modules", "obj", "testresults"]);
+var inventoryRepository = (root, declaredRoots, limit = 5e4) => {
+  const rules = parseIgnoreRules(root);
   const files = [];
+  const excluded = [];
+  let truncated = false;
+  const declared = unique(declaredRoots.map((item) => slash2(item).replace(/^\.\//, "").replace(/\/$/, "")));
+  const requiredToReachDeclared = (candidate) => declared.some((item) => candidate === item || item.startsWith(`${candidate}/`));
+  const declaredPathPrefixes = (item) => item.split("/").map((_, index, segments) => segments.slice(0, index + 1).join("/"));
+  const ruleWouldHideDeclared = (rule, candidate) => declared.filter((item) => candidate === item || candidate.startsWith(`${item}/`) || item.startsWith(`${candidate}/`)).some((item) => declaredPathPrefixes(item).some((prefix) => rule.regex.test(prefix) || rule.regex.test(`${prefix}/`)));
+  const ignoredByRule = (candidate, directory) => {
+    let ignored = false;
+    let source = null;
+    for (const rule of rules) if ((rule.regex.test(candidate) || directory && rule.regex.test(`${candidate}/`)) && !ruleWouldHideDeclared(rule, candidate)) {
+      ignored = !rule.negated;
+      source = rule.source;
+    }
+    return ignored ? source : null;
+  };
   const visit = (directory) => {
-    if (files.length >= limit) return;
+    if (files.length >= limit) {
+      truncated = true;
+      return;
+    }
     let entries = [];
     try {
       entries = fs5.readdirSync(directory, { withFileTypes: true });
@@ -1620,26 +1701,56 @@ var walk = (root, limit = 6e3) => {
       return;
     }
     for (const entry of entries) {
-      if (files.length >= limit) break;
-      if (entry.isDirectory() && IGNORED_DIRECTORIES.has(entry.name)) continue;
+      if (files.length >= limit) {
+        truncated = true;
+        break;
+      }
       const absolute = path5.join(directory, entry.name);
-      if (entry.isDirectory()) visit(absolute);
-      else if (entry.isFile()) files.push(absolute);
+      const candidate = relative(root, absolute);
+      if (entry.isDirectory()) {
+        if (INTERNAL_METADATA.has(entry.name.toLowerCase())) continue;
+        const requiredPath = requiredToReachDeclared(candidate);
+        const ignoreSource = ignoredByRule(candidate, true);
+        const fallback = requiredPath ? false : FALLBACK_TRANSIENT.has(entry.name.toLowerCase());
+        if (ignoreSource || fallback) {
+          excluded.push({ path: candidate, role: fallback ? "transient" : "ignored", source: ignoreSource ?? "fallback" });
+          continue;
+        }
+        visit(absolute);
+      } else if (entry.isFile() && !ignoredByRule(candidate, false)) files.push(absolute);
     }
   };
   visit(root);
-  return files.sort();
-};
-var dependencyNames = (manifest) => new Set(Object.keys({
-  ...manifest?.dependencies ?? {},
-  ...manifest?.devDependencies ?? {},
-  ...manifest?.peerDependencies ?? {}
-}));
-var packageCommand = (manager, script) => {
-  if (manager === "npm" && script === "test") return "npm test";
-  if (manager === "yarn") return `yarn ${script}`;
-  return `${manager || "npm"} run ${script}`;
-};
+  return { files: files.sort(), excluded, truncated, limit };
+};
+var extensionLanguages = /* @__PURE__ */ new Map([
+  [".js", "JavaScript"],
+  [".mjs", "JavaScript"],
+  [".cjs", "JavaScript"],
+  [".jsx", "JavaScript"],
+  [".ts", "TypeScript"],
+  [".tsx", "TypeScript"],
+  [".py", "Python"],
+  [".go", "Go"],
+  [".rs", "Rust"],
+  [".java", "Java"],
+  [".kt", "Kotlin"],
+  [".swift", "Swift"],
+  [".rb", "Ruby"],
+  [".php", "PHP"],
+  [".cs", "C#"],
+  [".fs", "F#"],
+  [".vb", "Visual Basic"],
+  [".cpp", "C++"],
+  [".cc", "C++"],
+  [".c", "C"],
+  [".vue", "Vue"],
+  [".svelte", "Svelte"],
+  [".cshtml", "Razor"],
+  [".razor", "Razor"],
+  [".css", "CSS"],
+  [".scss", "Sass"]
+]);
 var classifyNaming = (name) => {
   if (/^[a-z][a-z0-9]*(?:-[a-z0-9]+)+$/.test(name)) return "kebab-case";
   if (/^[a-z][A-Za-z0-9]*$/.test(name) && /[A-Z]/.test(name)) return "camelCase";
@@ -1647,53 +1758,148 @@ var classifyNaming = (name) => {
   if (/^[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/.test(name)) return "snake_case";
   return null;
 };
-var analyzeProject = ({ root }) => {
+var dependencyTechnologies = /* @__PURE__ */ new Map([
+  ["next", ["Next.js"]],
+  ["react", ["React"]],
+  ["vue", ["Vue"]],
+  ["@angular/core", ["Angular"]],
+  ["svelte", ["Svelte"]],
+  ["@sveltejs/kit", ["SvelteKit"]],
+  ["express", ["Express"]],
+  ["fastify", ["Fastify"]],
+  ["@nestjs/core", ["NestJS"]],
+  ["django", ["Django"]],
+  ["flask", ["Flask"]],
+  ["fastapi", ["FastAPI"]],
+  ["spring-boot-starter-web", ["Spring Boot"]],
+  ["rails", ["Ruby on Rails"]],
+  ["laravel/framework", ["Laravel"]],
+  ["github.com/gin-gonic/gin", ["Gin"]],
+  ["actix-web", ["Actix Web"]],
+  ["axum", ["Axum"]],
+  ["microsoft.aspnet.mvc", ["ASP.NET MVC", "major"]],
+  ["microsoft.aspnet.webapi.core", ["ASP.NET Web API"]],
+  ["entityframework", ["Entity Framework", "major"]],
+  ["unity", ["Unity"]],
+  ["topshelf", ["Topshelf"]],
+  ["serilog", ["Serilog"]],
+  ["jquery", ["jQuery"]],
+  ["bootstrap", ["Bootstrap", "major"]],
+  ["vitest", ["Vitest"]],
+  ["jest", ["Jest"]],
+  ["pytest", ["pytest"]],
+  ["junit", ["JUnit"]],
+  ["xunit", ["xUnit"]]
+]);
+var dependencyRecord = (ecosystem, name, version, evidence) => ({ ecosystem, name: String(name), version: String(version ?? ""), evidence });
+var parseDependencies = (root, file) => {
+  const absolute = path5.join(root, file);
+  const lower = path5.basename(file).toLowerCase();
+  const content = readText(absolute);
+  const result = [];
+  const add = (ecosystem, name, version) => {
+    if (name) result.push(dependencyRecord(ecosystem, name, version, `${file}#${name}`));
+  };
+  if (["package.json", "composer.json"].includes(lower)) {
+    const manifest = readJson(absolute);
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "require", "require-dev"]) for (const [name, version] of Object.entries(manifest?.[field] ?? {})) add(lower === "composer.json" ? "composer" : "node", name, version);
+  } else if (lower === "packages.config") for (const match of content.matchAll(/<package\b[^>]*>/gi)) {
+    const item = attributes(match[0]);
+    add("nuget", item.id, item.version);
+  }
+  else if (lower === "requirements.txt") for (const line of content.split(/\r?\n/)) {
+    const match = line.trim().match(/^([A-Za-z0-9_.-]+)\s*(?:==|~=|>=|<=|>|<)?\s*([^;\s#]*)/);
+    if (match) add("python", match[1], match[2]);
+  }
+  else if (lower === "cargo.toml") {
+    let section2 = "";
+    for (const line of content.split(/\r?\n/)) {
+      const header = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
+      if (header) {
+        section2 = header[1].toLowerCase();
+        continue;
+      }
+      if (!/(^|\.)dependencies$/.test(section2)) continue;
+      const match = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(?:["']([^"']+)["']|\{[^}]*version\s*=\s*["']([^"']+))/);
+      if (match) add("cargo", match[1], match[2] ?? match[3]);
+    }
+  } else if (lower === "pyproject.toml") {
+    let section2 = "";
+    for (const line of content.split(/\r?\n/)) {
+      const header = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
+      if (header) {
+        section2 = header[1].toLowerCase();
+        continue;
+      }
+      if (section2 === "project") {
+        const list = line.match(/^\s*dependencies\s*=\s*\[(.*)\]\s*(?:#.*)?$/);
+        for (const item of list?.[1]?.matchAll(/["']([A-Za-z0-9_.-]+)(?:\[[^\]]+\])?\s*([^"']*)["']/g) ?? []) add("python", item[1], item[2]);
+      } else if (section2 === "tool.poetry.dependencies" || section2.startsWith("tool.poetry.group.") && section2.endsWith(".dependencies")) {
+        const match = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(?:["']([^"']+)["']|\{[^}]*version\s*=\s*["']([^"']+))/);
+        if (match && match[1].toLowerCase() !== "python") add("python", match[1], match[2] ?? match[3]);
+      }
+    }
+  } else if (lower === "go.mod") for (const match of content.matchAll(/^\s*([A-Za-z0-9_.\-/]+)\s+v([^\s]+)\s*$/gm)) add("go", match[1], match[2]);
+  else if (lower === "pom.xml") for (const match of content.matchAll(/<dependency>[\s\S]*?<artifactId>([^<]+)<\/artifactId>[\s\S]*?(?:<version>([^<]+)<\/version>)?[\s\S]*?<\/dependency>/gi)) add("maven", match[1], match[2]);
+  else if (["build.gradle", "build.gradle.kts"].includes(lower)) for (const match of content.matchAll(/["']([^:"']+):([^:"']+):([^"']+)["']/g)) add("gradle", match[2], match[3]);
+  else if (lower === "gemfile" || lower.endsWith(".gemspec")) for (const match of content.matchAll(/\bgem\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/g)) add("ruby", match[1], match[2]);
+  return result;
+};
+var manifestKinds = [
+  { id: "node", names: ["package.json"], toolchain: "Node package tooling" },
+  { id: "dotnet", pattern: /\.(?:cs|fs|vb)proj$/i, toolchain: "MSBuild" },
+  { id: "python", names: ["pyproject.toml", "requirements.txt", "setup.py"], toolchain: "Python packaging" },
+  { id: "jvm", names: ["pom.xml", "build.gradle", "build.gradle.kts"], toolchain: "JVM build tooling" },
+  { id: "go", names: ["go.mod"], toolchain: "Go modules" },
+  { id: "rust", names: ["Cargo.toml"], toolchain: "Cargo" },
+  { id: "php", names: ["composer.json"], toolchain: "Composer" },
+  { id: "ruby", names: ["Gemfile"], pattern: /\.gemspec$/i, toolchain: "Bundler" }
+];
+var manifestKind = (file) => manifestKinds.find((kind) => kind.names?.some((name) => name.toLowerCase() === path5.basename(file).toLowerCase()) || kind.pattern?.test(file));
+var resolveUnit = (root, manifest, declaredMembers) => {
+  const kind = manifestKind(manifest);
+  if (!kind) return null;
+  const unitPath = path5.posix.dirname(manifest) === "." ? "." : path5.posix.dirname(manifest);
+  const base = path5.basename(manifest).toLowerCase();
+  let name = path5.posix.basename(unitPath === "." ? root : unitPath);
+  if (base === "package.json") name = readJson(path5.join(root, manifest))?.name ?? name;
+  else if (/\.(?:cs|fs|vb)proj$/i.test(manifest)) name = path5.basename(manifest, path5.extname(manifest));
+  else if (base === "go.mod") name = readText(path5.join(root, manifest)).match(/^module\s+(.+)$/m)?.[1] ?? name;
+  return { name, path: unitPath, kind: kind.id, manifest, declared: declaredMembers.includes(unitPath), evidence: [manifest] };
+};
+var belongsToUnit = (file, unit) => unit.path === "." || file === unit.path || file.startsWith(`${unit.path}/`);
+var isVendoredAsset = (file) => /(^|\/)(?:vendor|third[_-]?party|node_modules)(\/|$)|\.min\.(?:js|css)$/i.test(file) || /(^|\/)scripts\/(?:tinymce|bootstrap|jquery|modernizr|respond)(\/|$)/i.test(file) || /(^|\/)content\/(?:bootstrap|tinymce)(\/|$)/i.test(file);
+var targetFramework = (value) => {
+  const target = String(value ?? "").trim().replace(/^v/i, "");
+  if (/^\d+(?:\.\d+)+$/.test(target)) return `.NET Framework ${target}`;
+  const legacy = target.match(/^net(\d)(\d)(\d?)$/i);
+  if (legacy && Number(legacy[1]) <= 4) return `.NET Framework ${legacy[1]}.${legacy[2]}${legacy[3] ? `.${legacy[3]}` : ""}`;
+  const standard = target.match(/^netstandard(\d+)\.(\d+)/i);
+  if (standard) return `.NET Standard ${standard[1]}.${standard[2]}`;
+  const modern = target.match(/^net(\d+)(?:\.(\d+))?/i);
+  return modern ? `.NET ${modern[1]}${modern[2] ? `.${modern[2]}` : ""}` : null;
+};
+var scriptCommand = (manager, name) => {
+  if (manager === "npm" && name === "test") return "npm test";
+  if (manager === "yarn") return `yarn ${name}`;
+  return `${manager} run ${name}`;
+};
+var detectorRegistry = Object.freeze(manifestKinds.map((detector) => Object.freeze({ ...detector })));
+var analyzeRepository = ({ root, scanLimit = 5e4 }) => {
+  if (!Number.isSafeInteger(scanLimit) || scanLimit < 1) throw new Error("scanLimit must be a positive integer");
   const requestedRoot = path5.resolve(root);
   if (!fs5.existsSync(requestedRoot)) throw new Error(`Project root not found: ${requestedRoot}`);
   const projectRoot = fs5.realpathSync(requestedRoot);
-  const files = walk(projectRoot);
-  const paths = files.map((file) => relative(projectRoot, file));
+  const container = rootContainerMembers(projectRoot);
+  const inventory = inventoryRepository(projectRoot, container.members, scanLimit);
+  const paths = inventory.files.map((file) => relative(projectRoot, file));
   const pathSet = new Set(paths);
-  const manifestPath = path5.join(projectRoot, "package.json");
-  const manifest = fs5.existsSync(manifestPath) ? readJson(manifestPath) : null;
-  const dependencies = dependencyNames(manifest);
-  const lockManagers = [
-    ["pnpm-lock.yaml", "pnpm"],
-    ["yarn.lock", "yarn"],
-    ["bun.lockb", "bun"],
-    ["bun.lock", "bun"],
-    ["package-lock.json", "npm"]
-  ].filter(([file]) => pathSet.has(file));
-  const declaredManager = typeof manifest?.packageManager === "string" ? manifest.packageManager.split("@")[0] : null;
-  const manager = declaredManager || lockManagers[0]?.[1] || (manifest ? "npm" : null);
-  const managerEvidence = [
-    ...declaredManager ? ["package.json#packageManager"] : [],
-    ...lockManagers.filter(([, name]) => !declaredManager || name === declaredManager).map(([file]) => file),
-    ...!declaredManager && !lockManagers.length && manifest ? ["package.json"] : []
-  ];
-  const extensionLanguages = /* @__PURE__ */ new Map([
-    [".js", "JavaScript"],
-    [".mjs", "JavaScript"],
-    [".cjs", "JavaScript"],
-    [".jsx", "JavaScript"],
-    [".ts", "TypeScript"],
-    [".tsx", "TypeScript"],
-    [".py", "Python"],
-    [".go", "Go"],
-    [".rs", "Rust"],
-    [".java", "Java"],
-    [".kt", "Kotlin"],
-    [".swift", "Swift"],
-    [".rb", "Ruby"],
-    [".php", "PHP"],
-    [".cs", "C#"],
-    [".cpp", "C++"],
-    [".c", "C"],
-    [".vue", "Vue"],
-    [".svelte", "Svelte"]
-  ]);
+  const manifests = paths.filter((file) => manifestKind(file));
+  const units = manifests.map((file) => resolveUnit(projectRoot, file, container.members)).filter(Boolean).filter((unit) => container.members.length === 0 || unit.declared || unit.path === ".").filter((unit, index, all) => all.findIndex((candidate) => candidate.path === unit.path && candidate.kind === unit.kind) === index).sort((left, right) => left.path.localeCompare(right.path));
+  const unitFiles = paths.filter((file) => units.length === 0 || units.some((unit) => belongsToUnit(file, unit)));
+  const ownedFiles = unitFiles.filter((file) => !isVendoredAsset(file));
   const languageEvidence = /* @__PURE__ */ new Map();
-  for (const file of paths) {
+  for (const file of ownedFiles) {
     const language = extensionLanguages.get(path5.extname(file).toLowerCase());
     if (!language) continue;
     const evidence = languageEvidence.get(language) ?? [];
@@ -1701,58 +1907,77 @@ var analyzeProject = ({ root }) => {
     languageEvidence.set(language, evidence);
   }
   const languages = [...languageEvidence.keys()].sort();
-  const frameworkPackages = /* @__PURE__ */ new Map([
-    ["next", "Next.js"],
-    ["react", "React"],
-    ["vue", "Vue"],
-    ["@angular/core", "Angular"],
-    ["svelte", "Svelte"],
-    ["@sveltejs/kit", "SvelteKit"],
-    ["express", "Express"],
-    ["fastify", "Fastify"],
-    ["nestjs", "NestJS"],
-    ["@nestjs/core", "NestJS"],
-    ["vitest", "Vitest"],
-    ["jest", "Jest"],
-    ["playwright", "Playwright"],
-    ["@playwright/test", "Playwright"],
-    ["cypress", "Cypress"]
-  ]);
-  const frameworks = unique([...frameworkPackages].filter(([name]) => dependencies.has(name)).map(([, label]) => label));
-  const frameworkEvidence = [...frameworkPackages].filter(([name]) => dependencies.has(name)).map(([name]) => `package.json#${name}`);
-  const scripts = manifest?.scripts ?? {};
-  const commandOrder = ["install", "setup", "dev", "start", "build", "lint", "typecheck", "check", "test", "test:unit", "test:e2e"];
-  const commands = [];
-  for (const name of commandOrder) {
-    if (typeof scripts[name] === "string") commands.push({ name, command: packageCommand(manager, name), source: `package.json#scripts.${name}` });
+  const toolchainMap = /* @__PURE__ */ new Map();
+  for (const unit of units) {
+    const detector = manifestKinds.find((item) => item.id === unit.kind);
+    const current = toolchainMap.get(detector.toolchain) ?? [];
+    current.push(unit.manifest);
+    toolchainMap.set(detector.toolchain, current);
+  }
+  const lockToolchains = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "Yarn"],
+    ["bun.lock", "Bun"],
+    ["bun.lockb", "Bun"],
+    ["package-lock.json", "npm"],
+    ["uv.lock", "uv"],
+    ["poetry.lock", "Poetry"],
+    ["Pipfile.lock", "Pipenv"],
+    ["Cargo.lock", "Cargo"],
+    ["go.sum", "Go modules"],
+    ["composer.lock", "Composer"],
+    ["Gemfile.lock", "Bundler"]
+  ];
+  for (const [file, name] of lockToolchains) if (pathSet.has(file)) toolchainMap.set(name, unique([...toolchainMap.get(name) ?? [], file]));
+  const packagesConfig = ownedFiles.find((file) => path5.basename(file).toLowerCase() === "packages.config");
+  if (packagesConfig) toolchainMap.set("NuGet", unique([...toolchainMap.get("NuGet") ?? [], packagesConfig]));
+  const rootPackage = pathSet.has("package.json") ? readJson(path5.join(projectRoot, "package.json")) : null;
+  if (rootPackage?.packageManager) toolchainMap.set(rootPackage.packageManager.split("@")[0], unique([...toolchainMap.get(rootPackage.packageManager.split("@")[0]) ?? [], "package.json#packageManager"]));
+  const toolchains = [...toolchainMap].map(([name, evidence]) => ({ name, evidence: unique(evidence) })).sort((left, right) => left.name.localeCompare(right.name));
+  const dependencyManifests = ownedFiles.filter((file) => ["package.json", "composer.json", "packages.config", "requirements.txt", "cargo.toml", "pyproject.toml", "go.mod", "pom.xml", "build.gradle", "build.gradle.kts", "gemfile"].includes(path5.basename(file).toLowerCase()) || /\.gemspec$/i.test(file));
+  const dependencies = dependencyManifests.flatMap((file) => parseDependencies(projectRoot, file));
+  const technologyMap = /* @__PURE__ */ new Map();
+  const addTechnology = (name, evidence) => {
+    const versioned = name.match(/^(.*)\s+\d+(?:\.\d+)*$/);
+    if (versioned) technologyMap.delete(versioned[1]);
+    else if ([...technologyMap.keys()].some((item) => item.startsWith(`${name} `) && /^\d/.test(item.slice(name.length + 1)))) return;
+    technologyMap.set(name, unique([...technologyMap.get(name) ?? [], evidence]));
+  };
+  for (const dependency of dependencies) {
+    const mapping = dependencyTechnologies.get(dependency.name.toLowerCase());
+    if (!mapping) continue;
+    const label = mapping[1] === "major" && major(dependency.version) ? `${mapping[0]} ${major(dependency.version)}` : mapping[0];
+    addTechnology(label, dependency.evidence);
+  }
+  for (const file of unitFiles) {
+    if (/(^|\/)jquery-\d+(?:\.\d+)+(?:\.min)?\.js$/i.test(file)) addTechnology("jQuery", file);
+    if (/(^|\/)bootstrap(?:\.min)?\.(?:css|js)$/i.test(file)) {
+      const detectedMajor = readText(path5.join(projectRoot, file)).match(/\bBootstrap\s+v(\d+)/i)?.[1];
+      addTechnology(detectedMajor ? `Bootstrap ${detectedMajor}` : "Bootstrap", file);
+    }
   }
-  for (const name of Object.keys(scripts).sort()) {
-    if (!commands.some((item) => item.name === name) && /^(build|lint|typecheck|test|check)(:|$)/.test(name)) {
-      commands.push({ name, command: packageCommand(manager, name), source: `package.json#scripts.${name}` });
+  for (const unit of units.filter((item) => item.kind === "dotnet")) {
+    const content = readText(path5.join(projectRoot, unit.manifest));
+    for (const match of content.matchAll(/<(TargetFrameworkVersion|TargetFramework|TargetFrameworks)>([^<]+)<\/\1>/gi)) for (const value of match[2].split(";")) {
+      const label = targetFramework(value);
+      if (label) addTechnology(label, `${unit.manifest}#${match[1]}`);
     }
   }
+  const technologies = [...technologyMap].map(([name, evidence]) => ({ name, evidence: unique(evidence) })).sort((left, right) => left.name.localeCompare(right.name));
+  const commands = [];
+  const scripts = rootPackage?.scripts ?? {};
+  for (const name of Object.keys(scripts).sort()) if (/^(?:build|check|dev|install|lint|setup|start|test|typecheck)(?::|$)/.test(name)) {
+    const manager = rootPackage.packageManager?.split("@")[0] ?? (pathSet.has("pnpm-lock.yaml") ? "pnpm" : pathSet.has("yarn.lock") ? "yarn" : "npm");
+    commands.push({ name, command: scriptCommand(manager, name), source: `package.json#scripts.${name}` });
+  }
   const entrypoints = [];
-  for (const [field, value] of [["main", manifest?.main], ["module", manifest?.module]]) {
-    if (typeof value === "string") entrypoints.push({ path: value, source: `package.json#${field}` });
-  }
-  if (typeof manifest?.bin === "string") entrypoints.push({ path: manifest.bin, source: "package.json#bin" });
-  else for (const value of Object.values(manifest?.bin ?? {})) if (typeof value === "string") entrypoints.push({ path: value, source: "package.json#bin" });
-  for (const candidate of ["src/index.ts", "src/index.js", "src/main.ts", "src/main.js", "app/page.tsx", "app/page.jsx", "main.go", "Cargo.toml"]) {
-    if (pathSet.has(candidate) && !entrypoints.some((item) => item.path === candidate)) entrypoints.push({ path: candidate, source: candidate });
-  }
-  const modules = [];
-  const moduleRoots = unique(paths.filter((file) => extensionLanguages.has(path5.extname(file).toLowerCase())).map((file) => file.split("/")[0]).filter((name) => name && !name.startsWith(".")));
-  for (const name of moduleRoots.slice(0, 20)) {
-    const evidence = paths.filter((file) => file.startsWith(`${name}/`) && extensionLanguages.has(path5.extname(file).toLowerCase())).slice(0, 3);
-    modules.push({ name, path: name, evidence });
-  }
-  const testFiles = paths.filter((file) => /(^|\/)(__tests__\/|tests?\/|[^/]+\.(?:test|spec)\.[^.]+$)/.test(file));
-  const testConfigs = paths.filter((file) => /(^|\/)(vitest|jest|playwright|cypress)[^/]*\.(?:js|mjs|cjs|ts|json)$/.test(file));
-  const ciFiles = paths.filter((file) => file.startsWith(".github/workflows/") || [".gitlab-ci.yml", "Jenkinsfile", "azure-pipelines.yml"].includes(file));
-  const deploymentFiles = paths.filter((file) => /(^|\/)(Dockerfile|docker-compose\.ya?ml|vercel\.json|netlify\.toml|fly\.toml)$/.test(file));
-  const sourceFiles = paths.filter((file) => extensionLanguages.has(path5.extname(file).toLowerCase()));
+  for (const [field, value] of [["main", rootPackage?.main], ["module", rootPackage?.module]]) if (typeof value === "string") entrypoints.push({ path: value, source: `package.json#${field}` });
+  for (const file of ownedFiles.filter((item) => /(^|\/)(?:program\.cs|main\.(?:go|rs|py|js|ts)|global\.asax|app\/page\.(?:jsx?|tsx?))$/i.test(item)).slice(0, 30)) entrypoints.push({ path: file, source: file });
+  const testUnits = units.filter((unit) => /(^|[._-])tests?([._-]|$)/i.test(unit.name) || /(^|\/)tests?([/_-]|$)/i.test(unit.path));
+  const testFiles = ownedFiles.filter((file) => extensionLanguages.has(path5.extname(file).toLowerCase())).filter((file) => testUnits.some((unit) => belongsToUnit(file, unit)) || /(^|\/)(?:__tests__\/|tests?\/|[^/]+\.(?:test|spec)\.[^.]+$)/i.test(file)).filter((file) => !isVendoredAsset(file)).slice(0, 40);
+  const testConfigs = paths.filter((file) => /(^|\/)(?:vitest|jest|playwright|cypress)[^/]*\.(?:js|mjs|cjs|ts|json)$/i.test(file)).slice(0, 20);
   const namingEvidence = /* @__PURE__ */ new Map();
-  for (const file of sourceFiles) {
+  for (const file of ownedFiles.filter((item) => extensionLanguages.has(path5.extname(item).toLowerCase()))) {
     const style = classifyNaming(path5.basename(file, path5.extname(file)));
     if (!style) continue;
     const evidence = namingEvidence.get(style) ?? [];
@@ -1760,48 +1985,102 @@ var analyzeProject = ({ root }) => {
     namingEvidence.set(style, evidence);
   }
   const naming = [...namingEvidence].filter(([, evidence]) => evidence.length >= 3).sort((left, right) => right[1].length - left[1].length)[0];
-  const sourceRoots = ["src", "app", "lib", "packages", "apps", "services"].filter((directory) => paths.some((file) => file.startsWith(`${directory}/`)));
-  const securityEvidence = paths.filter(
-    (file) => !/^(?:\.agents\/context|\.codex-agent\/context|docs|templates)\//.test(file) && /(^|\/)(auth|security|permissions?|secrets?|\.env\.example)(\/|\.|$)/i.test(file)
-  ).slice(0, 20);
-  const boundaryDirectories = {
-    api: ["api", "routes", "controllers"],
-    ui: ["components", "views", "pages", "app"],
-    persistence: ["db", "database", "models", "repositories", "migrations"]
-  };
-  const boundaries = Object.fromEntries(Object.entries(boundaryDirectories).map(([kind, candidates]) => {
-    const found = candidates.filter((candidate) => paths.some((file) => file.split("/").includes(candidate)));
+  const ownedRoots = unique(units.map((unit) => unit.path === "." ? "." : unit.path.split("/")[0]));
+  const securityEvidence = ownedFiles.filter((file) => /(^|\/)(?:auth|security|permissions?|secrets?|\.env\.example)(\/|\.|$)/i.test(file)).slice(0, 20);
+  const boundaryCandidates = { api: ["api", "routes", "controllers"], ui: ["components", "views", "pages", "app"], persistence: ["db", "database", "models", "repositories", "migrations"] };
+  const boundaries = Object.fromEntries(Object.entries(boundaryCandidates).map(([kind, candidates]) => {
+    const found = unique(ownedFiles.flatMap((file) => {
+      const segments = file.split("/");
+      const index = segments.findIndex((segment) => candidates.includes(segment.toLowerCase()));
+      return index < 0 ? [] : [segments.slice(0, index + 1).join("/")];
+    })).sort();
     return [kind, found.length ? detected(found, found.map((item) => `directory:${item}`), "medium") : unknown([])];
   }));
+  const ciFiles = paths.filter((file) => file.startsWith(".github/workflows/") || [".gitlab-ci.yml", "Jenkinsfile", "azure-pipelines.yml"].includes(file));
+  const deploymentFiles = paths.filter((file) => /(^|\/)(?:Dockerfile|docker-compose\.ya?ml|vercel\.json|netlify\.toml|fly\.toml)$/i.test(file));
+  const rootSolution = rootFiles(projectRoot).find((file) => /\.sln$/i.test(file));
+  const projectName = rootPackage?.name ?? (rootSolution ? path5.basename(rootSolution, path5.extname(rootSolution)) : path5.basename(projectRoot));
+  const projectEvidence = rootPackage?.name ? ["package.json#name"] : rootSolution ? [rootSolution] : ["repository directory name"];
   return {
     $schema: "project-analysis.schema.json",
     version: ANALYSIS_VERSION,
     root: projectRoot,
-    project: manifest?.name ? detected({ name: manifest.name, private: Boolean(manifest.private) }, ["package.json#name"]) : inferred({ name: path5.basename(projectRoot) }, ["repository directory name"], "low"),
-    packageManager: manager ? declaredManager || lockManagers.length ? detected(manager, managerEvidence, "high") : inferred(manager, managerEvidence, "low") : unknown(null),
+    project: rootPackage?.name || rootSolution ? detected({ name: projectName, private: Boolean(rootPackage?.private) }, projectEvidence) : inferred({ name: projectName }, projectEvidence, "low"),
     languages: languages.length ? detected(languages, [...languageEvidence.values()].flat(), "high") : unknown([]),
-    frameworks: frameworks.length ? detected(frameworks, frameworkEvidence, "high") : unknown([]),
+    toolchains: toolchains.length ? detected(toolchains, toolchains.flatMap((item) => item.evidence), "high") : unknown([]),
+    technologies: technologies.length ? detected(technologies, technologies.flatMap((item) => item.evidence), "high") : unknown([]),
     commands: commands.length ? detected(commands, commands.map((item) => item.source), "high") : unknown([]),
-    modules: modules.length ? inferred(modules, modules.flatMap((item) => item.evidence), modules.length > 1 ? "medium" : "low") : unknown([]),
+    units: units.length ? detected(units, unique([...container.evidence, ...units.flatMap((item) => item.evidence)]), container.evidence.length ? "high" : "medium") : unknown([]),
     entrypoints: entrypoints.length ? detected(entrypoints, entrypoints.map((item) => item.source), "high") : unknown([]),
     conventions: {
-      sourceLayout: sourceRoots.length ? detected(sourceRoots, sourceRoots.map((item) => `directory:${item}`), "high") : unknown([]),
+      sourceLayout: ownedRoots.length ? detected(ownedRoots, units.flatMap((item) => item.evidence), "high") : unknown([]),
       fileNaming: naming ? inferred(naming[0], naming[1].slice(0, 8), "medium") : unknown(null),
       boundaries
     },
     security: securityEvidence.length ? detected(securityEvidence, securityEvidence, "medium") : unknown([]),
-    testing: testFiles.length || testConfigs.length ? detected({ files: testFiles.slice(0, 30), configs: testConfigs }, [...testFiles.slice(0, 10), ...testConfigs], "high") : unknown({ files: [], configs: [] }),
+    testing: testFiles.length || testConfigs.length || testUnits.length ? detected({ units: testUnits.map((unit) => unit.path), files: testFiles, configs: testConfigs }, unique([...testUnits.flatMap((unit) => unit.evidence), ...testFiles.slice(0, 10), ...testConfigs]), "high") : unknown({ units: [], files: [], configs: [] }),
     ciCd: ciFiles.length || deploymentFiles.length ? detected({ ci: ciFiles, deployment: deploymentFiles }, [...ciFiles, ...deploymentFiles], "high") : unknown({ ci: [], deployment: [] }),
-    existingGuidance: pathSet.has("AGENTS.md") ? detected(true, ["AGENTS.md"], "high") : detected(false, ["AGENTS.md not found"], "high")
+    scan: detected({ files: paths.length, truncated: inventory.truncated, limit: inventory.limit, excluded: inventory.excluded.slice(0, 100) }, unique(["repository directory name", ...parseIgnoreRules(projectRoot).map((rule) => rule.source), ...container.evidence]), inventory.truncated ? "medium" : "high"),
+    existingGuidance: fs5.existsSync(path5.join(projectRoot, "AGENTS.md")) ? detected(true, ["AGENTS.md"], "high") : detected(false, ["AGENTS.md not found"], "high")
   };
 };
+
+// ../../plugins/codex-agent/scripts/context-project.mjs
+var CONTEXT_LIFECYCLE_VERSION = 1;
+var HASH_PATTERN2 = /^[a-f0-9]{64}$/;
+var LIFECYCLE_PHASES = /* @__PURE__ */ new Set(["prepared", "migration-applied", "managed-running", "managed-applied"]);
+var MANAGED_CONTEXT = [
+  ["architecture", "architecture/system.md", "System architecture, project units, entrypoints, and detected boundaries.", ["architecture", "units", "entrypoints"], "high", ["units", "entrypoints", "conventions.boundaries"]],
+  ["code-quality", "standards/code-quality.md", "Detected source layout, naming, and engineering conventions.", ["code", "quality", "conventions"], "critical", ["conventions", "languages"]],
+  ["testing", "standards/testing.md", "Detected test tooling, locations, and repository commands.", ["test", "verification", "commands"], "high", ["testing", "commands"]],
+  ["security", "standards/security.md", "Detected security-sensitive boundaries and baseline safeguards.", ["security", "auth", "secrets"], "critical", ["security"]],
+  ["project-intelligence", "project-intelligence/project.md", "Detected stack, toolchains, CI, and project intelligence.", ["project", "stack", "ci"], "medium", ["project", "languages", "toolchains", "technologies", "ciCd", "scan"]]
+];
+var CODEX_AGENT_IGNORE_RULES = [
+  ".codex-agent/analysis.json",
+  ".codex-agent/sessions/",
+  ".codex-agent/backups/",
+  ".codex-agent/.locks/",
+  ".codex-agent/.transactions/",
+  ".codex-agent/**/*.tmp-*"
+];
+var BROAD_CODEX_AGENT_IGNORE_RULES = /* @__PURE__ */ new Set([
+  ".codex-agent",
+  ".codex-agent/",
+  ".codex-agent/**",
+  "/.codex-agent",
+  "/.codex-agent/",
+  "/.codex-agent/**"
+]);
+var MANAGED_CODEX_AGENT_IGNORE_RULES = new Set(CODEX_AGENT_IGNORE_RULES);
+var EXCLUDABLE_MANAGED_FILES = /* @__PURE__ */ new Set([".codex/config.toml", ".gitignore"]);
+var slash3 = (value) => value.split(path6.sep).join("/");
+var unique2 = (items) => [...new Set(items.filter(Boolean))];
+var relative2 = (root, file) => slash3(path6.relative(root, file));
+var normalizeManagedExclusions = (items = []) => {
+  if (!Array.isArray(items)) throw new Error("Managed exclusions must be an array");
+  const normalized = unique2(items.map((item) => safeRelativePath(item, "Managed exclusion"))).sort();
+  const unsupported = normalized.filter((item) => !EXCLUDABLE_MANAGED_FILES.has(item));
+  if (unsupported.length) {
+    throw new Error(`Unsupported managed exclusion: ${unsupported.join(", ")}. Supported paths: ${[...EXCLUDABLE_MANAGED_FILES].sort().join(", ")}`);
+  }
+  return normalized;
+};
+var readJson2 = (file) => {
+  try {
+    return JSON.parse(fs6.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var analyzeProject = analyzeRepository;
 var isSignal = (value) => value && typeof value === "object" && "value" in value && Array.isArray(value.evidence);
 var validateProjectAnalysis = (analysis) => {
   const errors = [];
   if (!analysis || typeof analysis !== "object" || Array.isArray(analysis)) return { ok: false, errors: ["analysis must be an object"] };
   if (analysis.version !== ANALYSIS_VERSION) errors.push(`version must be ${ANALYSIS_VERSION}`);
   if (typeof analysis.root !== "string" || !analysis.root) errors.push("root must be a non-empty string");
-  for (const field of ["project", "packageManager", "languages", "frameworks", "commands", "modules", "entrypoints", "security", "testing", "ciCd", "existingGuidance"]) {
+  for (const field of ["project", "languages", "toolchains", "technologies", "commands", "units", "entrypoints", "security", "testing", "ciCd", "scan", "existingGuidance"]) {
     if (!isSignal(analysis[field])) errors.push(`${field} must contain value, evidence, confidence, and status`);
   }
   if (!analysis.conventions || typeof analysis.conventions !== "object") errors.push("conventions must be an object");
@@ -1827,7 +2106,7 @@ var validateProjectAnalysis = (analysis) => {
   return { ok: errors.length === 0, errors };
 };
 var validateAnalysisEvidence = (analysis, root) => {
-  const projectRoot = path5.resolve(root);
+  const projectRoot = path6.resolve(root);
   const errors = [];
   const visit = (value, location) => {
     if (isSignal(value)) {
@@ -1836,17 +2115,17 @@ var validateAnalysisEvidence = (analysis, root) => {
         if (item === "repository directory name") continue;
         const missing = item.endsWith(" not found");
         const raw = (missing ? item.slice(0, -10) : item).replace(/^directory:/, "").split("#")[0];
-        if (!raw || path5.isAbsolute(raw)) {
+        if (!raw || path6.isAbsolute(raw)) {
           errors.push(`${location} has invalid evidence: ${item}`);
           continue;
         }
-        const target = path5.resolve(projectRoot, raw);
-        if (target !== projectRoot && !target.startsWith(`${projectRoot}${path5.sep}`)) {
+        const target = path6.resolve(projectRoot, raw);
+        if (target !== projectRoot && !target.startsWith(`${projectRoot}${path6.sep}`)) {
           errors.push(`${location} evidence escapes the project: ${item}`);
         } else {
           try {
             assertNoSymlink(projectRoot, target, `${location} evidence`);
-            if (missing ? fs5.existsSync(target) : !fs5.existsSync(target)) {
+            if (missing ? fs6.existsSync(target) : !fs6.existsSync(target)) {
               errors.push(`${location} evidence does not match the repository: ${item}`);
             }
           } catch (error) {
@@ -1920,6 +2199,10 @@ var renderAgents = (analysis) => {
   if (present(analysis.commands)) {
     parts.push(section("Repository commands", bullets(analysis.commands.value.map((item) => `${mdCode(item.command)} \u2014 ${safeText(item.name)} (${safeText(item.source)})`))));
   }
+  const stack = [];
+  if (present(analysis.languages)) stack.push(`Languages: ${analysis.languages.value.join(", ")}.${evidenceSuffix(analysis.languages)}`);
+  if (present(analysis.technologies)) stack.push(`Technologies: ${analysis.technologies.value.map((item) => safeText(item.name)).join(", ")}.${evidenceSuffix(analysis.technologies)}`);
+  if (stack.length) parts.push(section("Detected stack", bullets(stack)));
   const conventions = [];
   if (present(analysis.conventions?.sourceLayout)) conventions.push(`Source roots: ${analysis.conventions.sourceLayout.value.map((item) => mdCode(`${item}/`)).join(", ")}.${evidenceSuffix(analysis.conventions.sourceLayout)}`);
   if (present(analysis.conventions?.fileNaming)) conventions.push(`Observed file naming: ${mdCode(analysis.conventions.fileNaming.value)}. Apply it only where nearby files confirm the pattern.${evidenceSuffix(analysis.conventions.fileNaming)}`);
@@ -1937,7 +2220,7 @@ var renderAgents = (analysis) => {
 };
 var renderArchitecture = (analysis) => {
   const parts = [];
-  if (present(analysis.modules)) parts.push(section("Observed modules", bullets(analysis.modules.value.map((item) => `${mdCode(`${item.path}/`)} (${item.evidence.slice(0, 2).map(safeText).join(", ")})`))));
+  if (present(analysis.units)) parts.push(section("Project units", bullets(analysis.units.value.map((item) => `${mdCode(item.path === "." ? "." : `${item.path}/`)} \u2014 ${safeText(item.name)} (${safeText(item.kind)}; ${item.evidence.slice(0, 2).map(safeText).join(", ")})`))));
   if (present(analysis.entrypoints)) parts.push(section("Entrypoints", bullets(analysis.entrypoints.value.map((item) => `${mdCode(item.path)} from ${safeText(item.source)}`))));
   const boundaries = Object.entries(analysis.conventions?.boundaries ?? {}).filter(([, item]) => present(item));
   if (boundaries.length) parts.push(section("Observed boundaries", bullets(boundaries.map(([kind, item]) => `${kind}: ${item.value.map((value) => mdCode(`${value}/`)).join(", ")}${evidenceSuffix(item)}`))));
@@ -1956,6 +2239,7 @@ var renderTesting = (analysis) => {
     if (testCommands.length) parts.push(section("Commands", bullets(testCommands.map((item) => `${mdCode(item.command)} (${safeText(item.source)})`))));
   }
   if (present(analysis.testing)) {
+    if (analysis.testing.value.units?.length) parts.push(section("Test units", bullets(analysis.testing.value.units.map(mdCode))));
     if (analysis.testing.value.configs.length) parts.push(section("Configuration", bullets(analysis.testing.value.configs.map(mdCode))));
     if (analysis.testing.value.files.length) parts.push(section("Observed tests", bullets(analysis.testing.value.files.slice(0, 20).map(mdCode))));
   }
@@ -1972,15 +2256,16 @@ var renderSecurity = (analysis) => {
 };
 var renderProject = (analysis) => {
   const stack = [];
-  if (present(analysis.packageManager)) stack.push(`Package manager: ${mdCode(analysis.packageManager.value)}.${evidenceSuffix(analysis.packageManager)}`);
   if (present(analysis.languages)) stack.push(`Languages: ${analysis.languages.value.join(", ")}.${evidenceSuffix(analysis.languages)}`);
-  if (present(analysis.frameworks)) stack.push(`Frameworks/tooling: ${analysis.frameworks.value.join(", ")}.${evidenceSuffix(analysis.frameworks)}`);
+  if (present(analysis.toolchains)) stack.push(`Toolchains: ${analysis.toolchains.value.map((item) => safeText(item.name)).join(", ")}.${evidenceSuffix(analysis.toolchains)}`);
+  if (present(analysis.technologies)) stack.push(`Technologies: ${analysis.technologies.value.map((item) => safeText(item.name)).join(", ")}.${evidenceSuffix(analysis.technologies)}`);
   const parts = [];
   if (stack.length) parts.push(section("Detected stack", bullets(stack)));
   if (present(analysis.ciCd)) {
     const items = [...analysis.ciCd.value.ci.map((item) => `CI: ${mdCode(item)}`), ...analysis.ciCd.value.deployment.map((item) => `Deployment: ${mdCode(item)}`)];
     parts.push(section("CI and deployment", bullets(items)));
   }
+  if (present(analysis.scan) && analysis.scan.value.truncated) parts.push(section("Discovery limits", `Repository scan reached its ${analysis.scan.value.limit}-file budget; review a refined analysis before applying context.`));
   return parts.join("\n\n") || "No stack or CI facts were detected with sufficient evidence.";
 };
 var markdownBlock = (id, body) => `<!-- codex-agent:managed:start ${id} -->
@@ -2014,22 +2299,22 @@ var collectSignalEvidence = (value) => {
   ];
 };
 var managedEvidence = (analysis, id, signalPaths) => {
-  const projectRoot = path5.resolve(analysis.root);
-  const locators = unique(signalPaths.flatMap((signalPath) => collectSignalEvidence(nestedValue(analysis, signalPath)))).map((locator) => String(locator).split("#")[0]).filter((locator) => locator && !path5.isAbsolute(locator));
-  return unique(locators).flatMap((locator) => {
-    const target = path5.resolve(projectRoot, locator);
-    const relativePath = relative(projectRoot, target);
-    if (relativePath.startsWith("../") || path5.isAbsolute(relativePath) || relativePath.startsWith(".codex-agent/context/") || relativePath.startsWith(".agents/context/")) return [];
+  const projectRoot = path6.resolve(analysis.root);
+  const locators = unique2(signalPaths.flatMap((signalPath) => collectSignalEvidence(nestedValue(analysis, signalPath)))).map((locator) => String(locator).split("#")[0]).filter((locator) => locator && !path6.isAbsolute(locator));
+  return unique2(locators).flatMap((locator) => {
+    const target = path6.resolve(projectRoot, locator);
+    const relativePath = relative2(projectRoot, target);
+    if (relativePath.startsWith("../") || path6.isAbsolute(relativePath) || relativePath.startsWith(".codex-agent/context/") || relativePath.startsWith(".agents/context/")) return [];
     try {
       assertNoSymlink(projectRoot, target, `Managed context evidence ${locator}`);
-      if (!fs5.existsSync(target) || !fs5.statSync(target).isFile()) return [];
-      return [{ type: "repository", locator: relativePath, note: `Repository evidence used to generate ${id}.`, sha256: sha256(fs5.readFileSync(target)) }];
+      if (!fs6.existsSync(target) || !fs6.statSync(target).isFile()) return [];
+      return [{ type: "repository", locator: relativePath, note: `Repository evidence used to generate ${id}.`, sha256: sha256(fs6.readFileSync(target)) }];
     } catch {
       return [];
     }
   }).slice(0, 20);
 };
-var renderProjectFiles = (analysis, existingIndex = null) => {
+var renderProjectFiles = (analysis, existingIndex = null, { excludeManaged = [] } = {}) => {
   if (containsSensitiveContent(JSON.stringify({ analysis, existingIndex }))) {
     throw new Error("Project context rendering input appears to contain a secret or credential");
   }
@@ -2073,6 +2358,7 @@ var renderProjectFiles = (analysis, existingIndex = null) => {
   };
   files.set(".codex-agent/context/index.json", { kind: "json", content: `${JSON.stringify(index, null, 2)}
 ` });
+  for (const file of normalizeManagedExclusions(excludeManaged)) files.delete(file);
   for (const [file, descriptor] of files) {
     if (containsSensitiveContent(descriptor.content ?? descriptor.body ?? "")) {
       throw new Error(`Generated managed content for ${file} appears to contain a secret or credential`);
@@ -2130,13 +2416,13 @@ var lineDiff = (before, after) => {
   const added = newLines.slice(prefix, newLines.length - suffix).map((line) => `+ ${line}`);
   return [`@@ line ${prefix + 1} @@`, ...removed, ...added].join("\n");
 };
-var analysisPathFor = (root) => path5.join(root, ".codex-agent", "analysis.json");
+var analysisPathFor = (root) => path6.join(root, ".codex-agent", "analysis.json");
 var readProjectText = (projectRoot, target, label) => {
   assertInside(projectRoot, target, label);
   assertNoSymlink(projectRoot, target, label);
-  if (!fs5.existsSync(target)) return null;
-  if (!fs5.lstatSync(target).isFile()) throw new Error(`${label} is not a file: ${relative(projectRoot, target)}`);
-  const content = fs5.readFileSync(target, "utf8");
+  if (!fs6.existsSync(target)) return null;
+  if (!fs6.lstatSync(target).isFile()) throw new Error(`${label} is not a file: ${relative2(projectRoot, target)}`);
+  const content = fs6.readFileSync(target, "utf8");
   if (containsSensitiveContent(content)) throw new Error(`${label} appears to contain a secret or credential`);
   return content;
 };
@@ -2157,8 +2443,8 @@ var readableCatalog = (root) => {
 };
 var catalogIndex = (catalog) => {
   if (catalog?.index && typeof catalog.index === "object") return catalog.index;
-  const indexPath = catalog?.indexPath ?? (catalog?.root ? path5.join(catalog.root, "index.json") : null);
-  return indexPath && fs5.existsSync(indexPath) ? readJson(indexPath) : null;
+  const indexPath = catalog?.indexPath ?? (catalog?.root ? path6.join(catalog.root, "index.json") : null);
+  return indexPath && fs6.existsSync(indexPath) ? readJson2(indexPath) : null;
 };
 var migrationChanges = (migration) => (migration?.changes ?? []).map((change) => typeof change === "string" ? { path: change, status: "migrate", phase: "catalog-migration" } : {
   ...change,
@@ -2167,7 +2453,7 @@ var migrationChanges = (migration) => (migration?.changes ?? []).map((change) =>
   phase: "catalog-migration"
 });
 var uniqueStrings = (items) => [...new Set(items.filter((item) => typeof item === "string" && item))];
-var planManagedFiles = ({ projectRoot, analysis, existingIndex, force, contextBaselineRoot = null }) => {
+var planManagedFiles = ({ projectRoot, analysis, existingIndex, force, excludeManaged = [], contextBaselineRoot = null }) => {
   const ownershipConflicts = managedIndexOwnershipConflicts(existingIndex);
   if (ownershipConflicts.length) {
     return {
@@ -2180,7 +2466,7 @@ var planManagedFiles = ({ projectRoot, analysis, existingIndex, force, contextBa
       writePlan: []
     };
   }
-  const rendered = renderProjectFiles(analysis, existingIndex);
+  const rendered = renderProjectFiles(analysis, existingIndex, { excludeManaged });
   for (const [file, descriptor] of rendered) {
     if (containsSensitiveContent(descriptor.content ?? descriptor.body ?? "")) {
       throw new Error(`Generated managed content for ${file} appears to contain a secret or credential`);
@@ -2189,12 +2475,12 @@ var planManagedFiles = ({ projectRoot, analysis, existingIndex, force, contextBa
   const changes = [];
   const conflicts = [];
   const writePlan = [];
-  const canonicalContextRoot = path5.join(projectRoot, ".codex-agent", "context");
+  const canonicalContextRoot = path6.join(projectRoot, ".codex-agent", "context");
   for (const [file, descriptor] of rendered) {
-    const destination = path5.join(projectRoot, file);
-    const contextRelative = path5.relative(canonicalContextRoot, destination);
-    const usesContextBaseline = contextBaselineRoot !== null && contextRelative !== "" && contextRelative !== ".." && !contextRelative.startsWith(`..${path5.sep}`) && !path5.isAbsolute(contextRelative);
-    const currentPath = usesContextBaseline ? path5.join(contextBaselineRoot, contextRelative) : destination;
+    const destination = path6.join(projectRoot, file);
+    const contextRelative = path6.relative(canonicalContextRoot, destination);
+    const usesContextBaseline = contextBaselineRoot !== null && contextRelative !== "" && contextRelative !== ".." && !contextRelative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(contextRelative);
+    const currentPath = usesContextBaseline ? path6.join(contextBaselineRoot, contextRelative) : destination;
     const current = readProjectText(projectRoot, currentPath, `Managed project file ${file}`);
     const merged = replaceManaged(current, descriptor, force);
     if (merged.conflict && !force) {
@@ -2210,7 +2496,7 @@ var planManagedFiles = ({ projectRoot, analysis, existingIndex, force, contextBa
 };
 var applyManagedFiles = ({ projectRoot, writePlan, analysis, analysisCurrent, catalogPreconditions = [], lock = true }) => {
   const analysisPath = analysisPathFor(projectRoot);
-  const analysisRelative = relative(projectRoot, analysisPath);
+  const analysisRelative = relative2(projectRoot, analysisPath);
   const preconditionMap = new Map(catalogPreconditions.map((item) => [item.path, item.expected]));
   for (const { file, current } of writePlan) preconditionMap.set(file, current);
   preconditionMap.set(analysisRelative, analysisCurrent);
@@ -2252,7 +2538,7 @@ var snapshotCatalogPreconditions = ({ projectRoot, expected }) => {
   const current = assertCatalogPrecondition({ projectRoot, expected });
   if (current.state !== "canonical-only") return [];
   const preconditions = listTreeFiles(current.canonical.path).map((item) => ({
-    path: relative(projectRoot, item.absolute),
+    path: relative2(projectRoot, item.absolute),
     expected: readProjectText(projectRoot, item.absolute, `Canonical context file ${item.relative}`)
   }));
   assertCatalogPrecondition({ projectRoot, expected });
@@ -2261,7 +2547,7 @@ var snapshotCatalogPreconditions = ({ projectRoot, expected }) => {
 var assertManagedPreconditions = ({ projectRoot, writePlan, analysisCurrent, expectedCatalog }) => {
   assertCatalogPrecondition({ projectRoot, expected: expectedCatalog });
   for (const { file, current } of writePlan) {
-    const destination = path5.join(projectRoot, file);
+    const destination = path6.join(projectRoot, file);
     if (readProjectText(projectRoot, destination, `Managed project file ${file}`) !== current) {
       throw new Error(`Context managed-file precondition changed after preview: ${file}`);
     }
@@ -2282,10 +2568,11 @@ var managedPlanContract = (plan) => ({
   conflicts: [...plan.conflicts]
 });
 var managedPlanHash = (plan) => sha256(JSON.stringify(managedPlanContract(plan)));
-var lifecyclePlanHash = ({ operation, force, lifecycleCatalog, migrationPreview, analysis, analysisCurrent, analysisContent, plan, conflicts }) => sha256(JSON.stringify({
+var lifecyclePlanHash = ({ operation, force, excludedManaged, lifecycleCatalog, migrationPreview, analysis, analysisCurrent, analysisContent, plan, conflicts }) => sha256(JSON.stringify({
   version: CONTEXT_LIFECYCLE_VERSION,
   operation,
   force,
+  excludedManaged,
   catalog: {
     state: lifecycleCatalog.state,
     canonicalHash: lifecycleCatalog.canonical.hash,
@@ -2298,41 +2585,41 @@ var lifecyclePlanHash = ({ operation, force, lifecycleCatalog, migrationPreview,
   managed: managedPlanContract(plan),
   conflicts
 }));
-var lifecycleTransactionRoot = (projectRoot) => path5.join(projectRoot, ".codex-agent", ".transactions");
+var lifecycleTransactionRoot = (projectRoot) => path6.join(projectRoot, ".codex-agent", ".transactions");
 var lifecycleFileHash = ({ projectRoot, relativePath, label }) => {
   const normalized = safeRelativePath(relativePath, label);
-  const target = path5.join(projectRoot, ...normalized.split("/"));
+  const target = path6.join(projectRoot, ...normalized.split("/"));
   assertInside(projectRoot, target, label);
   assertNoSymlink(projectRoot, target, label);
-  if (!fs5.existsSync(target)) return null;
-  if (!fs5.lstatSync(target).isFile()) throw new Error(`${label} is not a regular file: ${normalized}`);
-  return sha256(fs5.readFileSync(target));
+  if (!fs6.existsSync(target)) return null;
+  if (!fs6.lstatSync(target).isFile()) throw new Error(`${label} is not a regular file: ${normalized}`);
+  return sha256(fs6.readFileSync(target));
 };
 var writeNewLifecycleJson = (destination, value) => {
-  const temporary = path5.join(path5.dirname(destination), `.${path5.basename(destination)}.tmp-${crypto4.randomUUID()}`);
+  const temporary = path6.join(path6.dirname(destination), `.${path6.basename(destination)}.tmp-${crypto4.randomUUID()}`);
   let descriptor;
   try {
-    descriptor = fs5.openSync(temporary, "wx", 384);
-    fs5.writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}
+    descriptor = fs6.openSync(temporary, "wx", 384);
+    fs6.writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}
 `);
-    fs5.fsyncSync(descriptor);
-    fs5.closeSync(descriptor);
+    fs6.fsyncSync(descriptor);
+    fs6.closeSync(descriptor);
     descriptor = void 0;
-    fs5.renameSync(temporary, destination);
+    fs6.renameSync(temporary, destination);
   } catch (error) {
     if (descriptor !== void 0) try {
-      fs5.closeSync(descriptor);
+      fs6.closeSync(descriptor);
     } catch {
     }
     try {
-      if (fs5.existsSync(temporary)) fs5.unlinkSync(temporary);
+      if (fs6.existsSync(temporary)) fs6.unlinkSync(temporary);
     } catch {
     }
     throw error;
   }
 };
 var validateLifecycleManifest = ({ projectRoot, transactionRoot, manifest }) => {
-  const transactionId2 = path5.basename(transactionRoot);
+  const transactionId2 = path6.basename(transactionRoot);
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || manifest.version !== CONTEXT_LIFECYCLE_VERSION || manifest.type !== "context-lifecycle" || manifest.transactionId !== transactionId2 || manifest.operation !== "context.init" || manifest.phase !== "prepared" || manifest.revision !== 1 || !HASH_PATTERN2.test(manifest.planHash ?? "")) {
     throw new Error(`Invalid context lifecycle recovery manifest: ${transactionId2}`);
   }
@@ -2375,16 +2662,16 @@ var lifecyclePhase = ({ projectRoot, transactionRoot, transactionId: transaction
   let phase = "prepared";
   let missingEarlier = false;
   for (const candidate of ["migration-applied", "managed-running", "managed-applied"]) {
-    const markerPath = path5.join(transactionRoot, `${candidate}.json`);
+    const markerPath = path6.join(transactionRoot, `${candidate}.json`);
     assertNoSymlink(projectRoot, markerPath, `Lifecycle phase marker ${candidate}`);
-    if (!fs5.existsSync(markerPath)) {
+    if (!fs6.existsSync(markerPath)) {
       missingEarlier = true;
       continue;
     }
     if (missingEarlier) throw new Error(`Lifecycle phase markers are not contiguous: ${transactionId2}`);
     let marker;
     try {
-      marker = JSON.parse(fs5.readFileSync(markerPath, "utf8"));
+      marker = JSON.parse(fs6.readFileSync(markerPath, "utf8"));
     } catch {
       throw new Error(`Invalid lifecycle phase marker: ${candidate}`);
     }
@@ -2396,13 +2683,13 @@ var lifecyclePhase = ({ projectRoot, transactionRoot, transactionId: transaction
   return phase;
 };
 var readLifecycleJournal = ({ projectRoot, transactionRoot }) => {
-  const manifestPath = path5.join(transactionRoot, "manifest.json");
+  const manifestPath = path6.join(transactionRoot, "manifest.json");
   assertNoSymlink(projectRoot, manifestPath, "Lifecycle recovery manifest");
   let manifest;
   try {
-    manifest = JSON.parse(fs5.readFileSync(manifestPath, "utf8"));
+    manifest = JSON.parse(fs6.readFileSync(manifestPath, "utf8"));
   } catch {
-    throw new Error(`Invalid context lifecycle recovery manifest: ${path5.basename(transactionRoot)}`);
+    throw new Error(`Invalid context lifecycle recovery manifest: ${path6.basename(transactionRoot)}`);
   }
   const normalized = validateLifecycleManifest({ projectRoot, transactionRoot, manifest });
   return {
@@ -2418,7 +2705,7 @@ var markLifecyclePhase = (journal, phase) => {
   if (order.indexOf(phase) !== order.indexOf(journal.phase) + 1) {
     throw new Error(`Invalid lifecycle phase transition: ${journal.phase} -> ${phase}`);
   }
-  writeNewLifecycleJson(path5.join(journal.transactionRoot, `${phase}.json`), {
+  writeNewLifecycleJson(path6.join(journal.transactionRoot, `${phase}.json`), {
     version: CONTEXT_LIFECYCLE_VERSION,
     transactionId: journal.normalized.transactionId,
     phase
@@ -2431,7 +2718,7 @@ var managedLifecycleItems = ({ plan, projectRoot, analysis, analysisCurrent }) =
     beforeHash: current === null ? null : sha256(current),
     afterHash: sha256(merged.content)
   }));
-  const analysisPath = relative(projectRoot, analysisPathFor(projectRoot));
+  const analysisPath = relative2(projectRoot, analysisPathFor(projectRoot));
   items.push({
     path: analysisPath,
     beforeHash: analysisCurrent === null ? null : sha256(analysisCurrent),
@@ -2443,9 +2730,9 @@ var managedLifecycleItems = ({ plan, projectRoot, analysis, analysisCurrent }) =
 var prepareLifecycleJournal = ({ projectRoot, lifecycleCatalog, planHash, plan, analysis, analysisCurrent }) => {
   const id = `lifecycle-${process.pid}-${Date.now()}-${crypto4.randomUUID()}`;
   const transactionsRoot = ensureDirectory(projectRoot, lifecycleTransactionRoot(projectRoot), "Context transaction directory");
-  const transactionRoot = path5.join(transactionsRoot, id);
-  const preparationRoot = path5.join(transactionsRoot, `.lifecycle-tmp-${id}`);
-  fs5.mkdirSync(preparationRoot, { recursive: false });
+  const transactionRoot = path6.join(transactionsRoot, id);
+  const preparationRoot = path6.join(transactionsRoot, `.lifecycle-tmp-${id}`);
+  fs6.mkdirSync(preparationRoot, { recursive: false });
   const manifest = {
     version: CONTEXT_LIFECYCLE_VERSION,
     type: "context-lifecycle",
@@ -2468,12 +2755,12 @@ var prepareLifecycleJournal = ({ projectRoot, lifecycleCatalog, planHash, plan,
     managed: managedLifecycleItems({ plan, projectRoot, analysis, analysisCurrent })
   };
   try {
-    writeNewLifecycleJson(path5.join(preparationRoot, "manifest.json"), manifest);
-    fs5.renameSync(preparationRoot, transactionRoot);
+    writeNewLifecycleJson(path6.join(preparationRoot, "manifest.json"), manifest);
+    fs6.renameSync(preparationRoot, transactionRoot);
     return readLifecycleJournal({ projectRoot, transactionRoot });
   } catch (error) {
-    fs5.rmSync(preparationRoot, { recursive: true, force: true });
-    fs5.rmSync(transactionRoot, { recursive: true, force: true });
+    fs6.rmSync(preparationRoot, { recursive: true, force: true });
+    fs6.rmSync(transactionRoot, { recursive: true, force: true });
     throw error;
   }
 };
@@ -2489,38 +2776,38 @@ var inspectLifecycleCatalog = ({ projectRoot, relativePath, expectedHash, label,
   return inspected;
 };
 var cleanupLifecycleJournal = ({ projectRoot, journal }) => {
-  const catalogTransactionRoot = path5.join(projectRoot, ...journal.normalized.paths.catalogTransaction.split("/"));
+  const catalogTransactionRoot = path6.join(projectRoot, ...journal.normalized.paths.catalogTransaction.split("/"));
   assertInside(projectRoot, catalogTransactionRoot, "Lifecycle catalog transaction directory");
   assertNoSymlink(projectRoot, catalogTransactionRoot, "Lifecycle catalog transaction directory");
-  if (fs5.existsSync(catalogTransactionRoot)) fs5.rmSync(catalogTransactionRoot, { recursive: true, force: true });
+  if (fs6.existsSync(catalogTransactionRoot)) fs6.rmSync(catalogTransactionRoot, { recursive: true, force: true });
   assertNoSymlink(projectRoot, journal.transactionRoot, "Lifecycle transaction directory");
-  fs5.rmSync(journal.transactionRoot, { recursive: true, force: true });
+  fs6.rmSync(journal.transactionRoot, { recursive: true, force: true });
 };
 var rollbackLifecycleMigration = ({ projectRoot, journal }) => {
   const { initial, paths } = journal.normalized;
-  const canonical = path5.join(projectRoot, ...paths.canonical.split("/"));
-  const legacy = path5.join(projectRoot, ...paths.legacy.split("/"));
-  const backup = path5.join(projectRoot, ...paths.backup.split("/"));
-  const quarantine = path5.join(journal.transactionRoot, "canonical-rollback");
+  const canonical = path6.join(projectRoot, ...paths.canonical.split("/"));
+  const legacy = path6.join(projectRoot, ...paths.legacy.split("/"));
+  const backup = path6.join(projectRoot, ...paths.backup.split("/"));
+  const quarantine = path6.join(journal.transactionRoot, "canonical-rollback");
   if (initial.state === "legacy-only") {
-    if (fs5.existsSync(canonical)) {
+    if (fs6.existsSync(canonical)) {
       inspectLifecycleCatalog({ projectRoot, relativePath: paths.canonical, expectedHash: initial.sourceHash, label: "Promoted canonical catalog" });
-      if (fs5.existsSync(quarantine)) throw new Error("Lifecycle canonical rollback quarantine already exists");
-      fs5.renameSync(canonical, quarantine);
-    } else if (fs5.existsSync(quarantine)) {
-      const quarantinePath = relative(projectRoot, quarantine);
+      if (fs6.existsSync(quarantine)) throw new Error("Lifecycle canonical rollback quarantine already exists");
+      fs6.renameSync(canonical, quarantine);
+    } else if (fs6.existsSync(quarantine)) {
+      const quarantinePath = relative2(projectRoot, quarantine);
       inspectLifecycleCatalog({ projectRoot, relativePath: quarantinePath, expectedHash: initial.sourceHash, label: "Quarantined canonical catalog" });
     }
   } else {
     inspectLifecycleCatalog({ projectRoot, relativePath: paths.canonical, expectedHash: initial.sourceHash, label: "Original canonical catalog" });
   }
-  if (!fs5.existsSync(legacy)) {
+  if (!fs6.existsSync(legacy)) {
     inspectLifecycleCatalog({ projectRoot, relativePath: paths.backup, expectedHash: initial.sourceHash, label: "Legacy catalog backup" });
-    ensureDirectory(projectRoot, path5.dirname(legacy), "Legacy context parent");
-    fs5.renameSync(backup, legacy);
+    ensureDirectory(projectRoot, path6.dirname(legacy), "Legacy context parent");
+    fs6.renameSync(backup, legacy);
   } else {
     inspectLifecycleCatalog({ projectRoot, relativePath: paths.legacy, expectedHash: initial.sourceHash, label: "Legacy context catalog" });
-    if (fs5.existsSync(backup)) throw new Error("Lifecycle recovery found both the legacy catalog and its migration backup");
+    if (fs6.existsSync(backup)) throw new Error("Lifecycle recovery found both the legacy catalog and its migration backup");
   }
   const restored = resolveContextCatalog({ root: projectRoot });
   if (restored.state !== initial.state || restored.legacy.hash !== initial.sourceHash) {
@@ -2561,26 +2848,75 @@ var recoverLifecycleJournal = ({ projectRoot, journal }) => {
 var pendingLifecycleDirectories = (projectRoot) => {
   const transactionsRoot = lifecycleTransactionRoot(projectRoot);
   assertNoSymlink(projectRoot, transactionsRoot, "Context transaction directory");
-  if (!fs5.existsSync(transactionsRoot)) return [];
-  return fs5.readdirSync(transactionsRoot, { withFileTypes: true }).filter((entry) => entry.name.startsWith("lifecycle-")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
+  if (!fs6.existsSync(transactionsRoot)) return [];
+  return fs6.readdirSync(transactionsRoot, { withFileTypes: true }).filter((entry) => entry.name.startsWith("lifecycle-")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     if (entry.isSymbolicLink() || !entry.isDirectory()) throw new Error(`Invalid lifecycle recovery entry: ${entry.name}`);
-    return path5.join(transactionsRoot, entry.name);
+    return path6.join(transactionsRoot, entry.name);
   });
 };
 var recoverPendingLifecycleTransactions = (projectRoot) => pendingLifecycleDirectories(projectRoot).map((transactionRoot) => {
   const journal = readLifecycleJournal({ projectRoot, transactionRoot });
   return { transactionId: journal.normalized.transactionId, outcome: recoverLifecycleJournal({ projectRoot, journal }) };
 });
+var approvalPlanFor = ({ operation, projectRoot, analysis, excludedManaged, changes, conflicts, planHash, applied }) => {
+  const activeChanges = changes.filter((change) => change.status !== "unchanged").map(({ path: file, status, phase }) => ({
+    path: file,
+    action: status,
+    phase
+  }));
+  const unchanged = changes.filter((change) => change.status === "unchanged").map((change) => change.path);
+  const names = (signal2) => Array.isArray(signal2?.value) ? signal2.value.map((item) => typeof item === "string" ? item : item?.name).filter(Boolean) : [];
+  const testUnits = Array.isArray(analysis.testing?.value?.units) ? analysis.testing.value.units : [];
+  const scan = analysis.scan?.value ?? {};
+  return {
+    title: operation === "context.init" ? "Initialize managed project context" : "Refresh managed project context",
+    outcome: operation === "context.init" ? "Create the first evidence-backed managed guidance and canonical context catalog." : "Reconcile managed guidance and canonical context with current repository evidence.",
+    status: conflicts.length ? "conflicts-require-resolution" : applied ? "applied" : "approval-required",
+    target: projectRoot,
+    analysis: {
+      project: analysis.project?.value?.name ?? path6.basename(projectRoot),
+      languages: names(analysis.languages),
+      toolchains: names(analysis.toolchains),
+      technologies: names(analysis.technologies),
+      units: Array.isArray(analysis.units?.value) ? analysis.units.value.length : 0,
+      testUnits: testUnits.length,
+      scan: {
+        files: Number.isSafeInteger(scan.files) ? scan.files : null,
+        truncated: Boolean(scan.truncated),
+        excluded: Array.isArray(scan.excluded) ? scan.excluded.map((item) => item.path).filter(Boolean) : []
+      }
+    },
+    changes: activeChanges,
+    preserved: {
+      unchanged,
+      excludedManaged: [...excludedManaged],
+      manualContent: "Content outside Codex-managed markers remains unchanged."
+    },
+    conflicts: [...conflicts],
+    safeguards: [
+      "Updated managed files are backed up during apply.",
+      "Repository or catalog drift invalidates this plan before any write."
+    ],
+    residualRisks: [
+      ...scan.truncated ? ["Repository discovery reached its scan limit, so the plan may omit facts beyond that boundary."] : [],
+      "Automated discovery can omit behavior that is not evidenced by repository files."
+    ],
+    approval: conflicts.length ? "Resolve the listed conflicts and review a new plan before approval." : applied ? "The reviewed plan was applied successfully." : "Approve this displayed plan or request changes. The integrity ID is retained by Codex and does not need to be copied.",
+    integrityId: planHash
+  };
+};
 var runContextLifecycleOperation = ({
   operation,
   root,
   apply = false,
   force = false,
+  excludeManaged = [],
   analysis: suppliedAnalysis = null,
   expectedPlanHash = null,
   lockHeld = false
 }) => {
-  const projectRoot = fs5.realpathSync(path5.resolve(root));
+  const projectRoot = fs6.realpathSync(path6.resolve(root));
+  const excludedManaged = normalizeManagedExclusions(excludeManaged);
   const isInit = operation === "context.init";
   const lifecycleCatalog = resolveContextCatalog({ root: projectRoot });
   if (isInit && lifecycleCatalog.state === "canonical-only") {
@@ -2602,9 +2938,9 @@ var runContextLifecycleOperation = ({
 - ${validation.errors.join("\n- ")}`);
   let suppliedRoot;
   try {
-    suppliedRoot = fs5.realpathSync(path5.resolve(analysis.root));
+    suppliedRoot = fs6.realpathSync(path6.resolve(analysis.root));
   } catch {
-    suppliedRoot = path5.resolve(analysis.root);
+    suppliedRoot = path6.resolve(analysis.root);
   }
   if (suppliedRoot !== projectRoot) throw new Error(`Analysis root does not match target root: ${analysis.root}`);
   const evidenceValidation = validateAnalysisEvidence(analysis, projectRoot);
@@ -2626,13 +2962,15 @@ var runContextLifecycleOperation = ({
     analysis,
     existingIndex: catalogIndex(activeCatalog),
     force,
-    contextBaselineRoot: isInit && lifecycleCatalog.state === "legacy-only" ? path5.join(projectRoot, ".agents", "context") : null
+    excludeManaged: excludedManaged,
+    contextBaselineRoot: isInit && lifecycleCatalog.state === "legacy-only" ? path6.join(projectRoot, ".agents", "context") : null
   });
   let conflicts = uniqueStrings([...migrationPreview.conflicts ?? [], ...plan.conflicts]);
   let backups = [...migrationPreview.backedUp ?? []];
   const planHash = lifecyclePlanHash({
     operation,
     force,
+    excludedManaged,
     lifecycleCatalog,
     migrationPreview,
     analysis,
@@ -2670,7 +3008,7 @@ var runContextLifecycleOperation = ({
           expectedHash: lifecycleCatalog.legacy.hash,
           ...lifecycleJournal ? {
             backupPath: lifecycleJournal.normalized.paths.backup,
-            transactionId: path5.basename(lifecycleJournal.normalized.paths.catalogTransaction)
+            transactionId: path6.basename(lifecycleJournal.normalized.paths.catalogTransaction)
           } : {},
           lock: !lockHeld
         });
@@ -2687,7 +3025,8 @@ var runContextLifecycleOperation = ({
             projectRoot,
             analysis,
             existingIndex: catalogIndex(activeCatalog),
-            force
+            force,
+            excludeManaged: excludedManaged
           });
           if (migration.applied && managedPlanHash(canonicalPlan) !== reviewedManagedPlanHash) {
             throw new Error("Context managed-file plan changed after preview; review a fresh preview");
@@ -2722,7 +3061,7 @@ var runContextLifecycleOperation = ({
         }
       }
     } catch (error) {
-      if (lifecycleJournal && fs5.existsSync(lifecycleJournal.transactionRoot)) {
+      if (lifecycleJournal && fs6.existsSync(lifecycleJournal.transactionRoot)) {
         try {
           const currentJournal = readLifecycleJournal({ projectRoot, transactionRoot: lifecycleJournal.transactionRoot });
           if (managedTransactionApplied) recoverLifecycleJournal({ projectRoot, journal: currentJournal });
@@ -2737,29 +3076,41 @@ var runContextLifecycleOperation = ({
   const migrationPlan = migrationChanges(apply ? migration : migrationPreview);
   const managedChanges = plan.changes.map((change) => ({ ...change, phase: "managed-context" }));
   const analysisChange = {
-    path: relative(projectRoot, analysisPath),
+    path: relative2(projectRoot, analysisPath),
     status: analysisCurrent === null ? "create" : analysisCurrent === analysisContent ? "unchanged" : "update",
     diff: analysisCurrent === analysisContent ? "" : lineDiff(analysisCurrent, analysisContent),
     phase: "analysis"
   };
   const applied = apply && conflicts.length === 0;
+  const changes = [...migrationPlan, ...managedChanges, analysisChange];
   return {
     schemaVersion: CONTEXT_LIFECYCLE_VERSION,
     operation,
     root: projectRoot,
     mode: apply ? "apply" : "preview",
-    analysisPath: relative(projectRoot, analysisPathFor(projectRoot)),
+    analysisPath: relative2(projectRoot, analysisPathFor(projectRoot)),
     analysis,
-    changes: [...migrationPlan, ...managedChanges, analysisChange],
+    excludedManaged,
+    changes,
     conflicts,
     backups,
     planHash,
     applied,
-    catalogMigration: migration
+    catalogMigration: migration,
+    approvalPlan: approvalPlanFor({
+      operation,
+      projectRoot,
+      analysis,
+      excludedManaged,
+      changes,
+      conflicts,
+      planHash,
+      applied
+    })
   };
 };
 var runContextLifecycle = (options) => {
-  const projectRoot = fs5.realpathSync(path5.resolve(options.root));
+  const projectRoot = fs6.realpathSync(path6.resolve(options.root));
   const hasPendingLifecycle = pendingLifecycleDirectories(projectRoot).length > 0;
   if (!options.apply && !hasPendingLifecycle) {
     return runContextLifecycleOperation({ ...options, root: projectRoot, lockHeld: false });
@@ -2773,8 +3124,8 @@ var initializeContext = (options) => runContextLifecycle({ ...options, operation
 var refreshContext = (options) => runContextLifecycle({ ...options, operation: "context.refresh" });
 
 // ../../plugins/codex-agent/skills/context-curation/scripts/context-save.mjs
-import fs6 from "node:fs";
-import path6 from "node:path";
+import fs7 from "node:fs";
+import path7 from "node:path";
 import { pathToFileURL } from "node:url";
 var KINDS2 = {
   decision: "decisions",
@@ -2801,7 +3152,7 @@ var PROPOSAL_FIELDS = /* @__PURE__ */ new Set([
   "aliases",
   "supersedes"
 ]);
-var unique2 = (items) => [...new Set(items)];
+var unique3 = (items) => [...new Set(items)];
 var safeText2 = (value, limit = 300) => String(value).replace(/[\r\n]+/g, " ").replace(/`/g, "'").trim().slice(0, limit);
 var mdCode2 = (value) => `\`${safeText2(value)}\``;
 var normalizeForComparison = (value) => String(value).toLowerCase().replace(/\s+/g, " ").trim();
@@ -2822,16 +3173,16 @@ var firstParagraph = (content, fallback) => {
   return candidate.length >= 10 ? candidate : String(fallback).replace(/\s+/g, " ").slice(0, 240);
 };
 var listMarkdown = (root) => {
-  if (!fs6.existsSync(root)) return [];
+  if (!fs7.existsSync(root)) return [];
   return listTreeFiles(root).filter((entry) => entry.relative.toLowerCase().endsWith(".md")).map((entry) => entry.absolute);
 };
 var prepareContextIndex = ({ root, pendingDocuments = [] }) => {
   const writable = assertWritableContextCatalog({ root });
   const projectRoot = writable.root;
   const contextRoot = writable.contextRoot;
-  if (!fs6.existsSync(contextRoot) && pendingDocuments.length === 0) throw new Error(`Context directory not found: ${contextRoot}`);
+  if (!fs7.existsSync(contextRoot) && pendingDocuments.length === 0) throw new Error(`Context directory not found: ${contextRoot}`);
   assertNoSymlink(projectRoot, contextRoot, "Canonical context root");
-  const indexPath = path6.join(contextRoot, "index.json");
+  const indexPath = path7.join(contextRoot, "index.json");
   const prior = upgradeContextIndex(writable.index);
   const priorByPath = new Map(prior.entries.map((entry) => [entry.path, entry]));
   const pending = /* @__PURE__ */ new Map();
@@ -2840,36 +3191,36 @@ var prepareContextIndex = ({ root, pendingDocuments = [] }) => {
       throw new Error(`Pending context document ${index2} is invalid`);
     }
     assertSafeMarkdownContent(document.content, `Pending context document ${index2}`);
-    const target = path6.resolve(contextRoot, document.path);
+    const target = path7.resolve(contextRoot, document.path);
     assertInside(contextRoot, target, `Pending context document ${index2}`);
-    const relative2 = slash(path6.relative(contextRoot, target));
-    if (!relative2 || relative2.startsWith("../") || relative2 === "index.json" || !relative2.endsWith(".md")) {
+    const relative3 = slash(path7.relative(contextRoot, target));
+    if (!relative3 || relative3.startsWith("../") || relative3 === "index.json" || !relative3.endsWith(".md")) {
       throw new Error(`Pending context document ${index2} has an invalid path: ${document.path}`);
     }
-    pending.set(relative2, document.content);
-  }
-  const diskPaths = listMarkdown(contextRoot).map((file) => slash(path6.relative(contextRoot, file)));
-  const entries = [.../* @__PURE__ */ new Set([...diskPaths, ...pending.keys()])].sort().map((relative2) => {
-    const content2 = pending.has(relative2) ? pending.get(relative2) : fs6.readFileSync(path6.join(contextRoot, ...relative2.split("/")), "utf8");
-    assertSafeMarkdownContent(content2, `Context Markdown ${relative2}`);
-    const title = firstHeading(content2, path6.basename(relative2, ".md"));
-    const existing = priorByPath.get(relative2);
-    const tags = unique2([
-      ...relative2.replace(/\.md$/, "").split("/"),
+    pending.set(relative3, document.content);
+  }
+  const diskPaths = listMarkdown(contextRoot).map((file) => slash(path7.relative(contextRoot, file)));
+  const entries = [.../* @__PURE__ */ new Set([...diskPaths, ...pending.keys()])].sort().map((relative3) => {
+    const content2 = pending.has(relative3) ? pending.get(relative3) : fs7.readFileSync(path7.join(contextRoot, ...relative3.split("/")), "utf8");
+    assertSafeMarkdownContent(content2, `Context Markdown ${relative3}`);
+    const title = firstHeading(content2, path7.basename(relative3, ".md"));
+    const existing = priorByPath.get(relative3);
+    const tags = unique3([
+      ...relative3.replace(/\.md$/, "").split("/"),
       ...title.toLowerCase().split(/[^a-z0-9_-]+/).filter((term) => term.length > 2)
     ].map(slug).filter(Boolean)).slice(0, 10);
     return upgradeContextIndexEntry({
       ...existing,
-      id: existing?.id || slug(relative2.replace(/\.md$/, "").replaceAll("/", "-")),
-      path: relative2,
+      id: existing?.id || slug(relative3.replace(/\.md$/, "").replaceAll("/", "-")),
+      path: relative3,
       summary: existing?.summary || firstParagraph(content2, `${title} project context.`),
       tags: existing?.tags?.length ? existing.tags : tags,
       priority: existing?.priority || "medium"
     });
   }).sort((left, right) => left.path.localeCompare(right.path));
-  const schemaPath = path6.join(projectRoot, "schemas", "context-index.schema.json");
+  const schemaPath = path7.join(projectRoot, "schemas", "context-index.schema.json");
   const index = {
-    ...fs6.existsSync(schemaPath) ? { $schema: "../../schemas/context-index.schema.json" } : prior.$schema ? { $schema: prior.$schema } : {},
+    ...fs7.existsSync(schemaPath) ? { $schema: "../../schemas/context-index.schema.json" } : prior.$schema ? { $schema: prior.$schema } : {},
     version: 2,
     entries
   };
@@ -2887,7 +3238,7 @@ var buildContextIndex = ({ root, dryRun = false }) => {
       root: prepared.projectRoot,
       documents: [],
       indexContent: prepared.content,
-      backupPaths: fs6.existsSync(prepared.path) ? ["index.json"] : [],
+      backupPaths: fs7.existsSync(prepared.path) ? ["index.json"] : [],
       lock: false
     });
     return { path: prepared.path, index: prepared.index, content: prepared.content, dryRun: false };
@@ -2932,7 +3283,7 @@ var validateContextProposal = (proposal, { root } = {}) => {
       } catch {
         errors.push(`evidence[${index}].url must be an absolute https URL`);
       }
-    } else if (typeof item.path !== "string" || !item.path || item.path.length > 300 || path6.isAbsolute(item.path)) {
+    } else if (typeof item.path !== "string" || !item.path || item.path.length > 300 || path7.isAbsolute(item.path)) {
       errors.push(`evidence[${index}].path must be repository-relative`);
     }
     if (typeof item.note !== "string" || item.note.trim().length < 5 || item.note.length > 300) errors.push(`evidence[${index}].note is invalid`);
@@ -2950,11 +3301,11 @@ var validateContextProposal = (proposal, { root } = {}) => {
   if (combined.includes("codex-agent:context:start") || combined.includes("codex-agent:context:end")) errors.push("proposal must not contain managed marker text");
   if (containsSensitiveContent(combined)) errors.push("proposal appears to contain a secret or credential");
   if (root && Array.isArray(proposal.evidence)) {
-    const projectRoot = fs6.realpathSync(path6.resolve(root));
+    const projectRoot = fs7.realpathSync(path7.resolve(root));
     for (const [index, item] of proposal.evidence.entries()) {
-      if (!item || item.type === "external" || typeof item.path !== "string" || path6.isAbsolute(item.path)) continue;
-      const target = path6.resolve(projectRoot, item.path);
-      if (target !== projectRoot && !target.startsWith(`${projectRoot}${path6.sep}`)) {
+      if (!item || item.type === "external" || typeof item.path !== "string" || path7.isAbsolute(item.path)) continue;
+      const target = path7.resolve(projectRoot, item.path);
+      if (target !== projectRoot && !target.startsWith(`${projectRoot}${path7.sep}`)) {
         errors.push(`evidence[${index}].path escapes the repository`);
         continue;
       }
@@ -2964,11 +3315,11 @@ var validateContextProposal = (proposal, { root } = {}) => {
         errors.push(`evidence[${index}].path must not traverse a symbolic link`);
         continue;
       }
-      const relative2 = slash(path6.relative(projectRoot, target));
-      if (relative2 === ".codex-agent/context" || relative2.startsWith(".codex-agent/context/") || relative2 === ".agents/context" || relative2.startsWith(".agents/context/") || relative2.startsWith(".codex-agent/sessions/") || relative2.startsWith(".codex-agent/backups/")) {
+      const relative3 = slash(path7.relative(projectRoot, target));
+      if (relative3 === ".codex-agent/context" || relative3.startsWith(".codex-agent/context/") || relative3 === ".agents/context" || relative3.startsWith(".agents/context/") || relative3.startsWith(".codex-agent/sessions/") || relative3.startsWith(".codex-agent/backups/")) {
         errors.push(`evidence[${index}].path must reference primary repository evidence, not derived context`);
-      } else if (!fs6.existsSync(target)) errors.push(`evidence[${index}].path does not exist: ${item.path}`);
-      else if (!fs6.statSync(target).isFile()) errors.push(`evidence[${index}].path must be a file`);
+      } else if (!fs7.existsSync(target)) errors.push(`evidence[${index}].path does not exist: ${item.path}`);
+      else if (!fs7.statSync(target).isFile()) errors.push(`evidence[${index}].path must be a file`);
     }
   }
   return { ok: errors.length === 0, errors };
@@ -3000,8 +3351,8 @@ var normalizeContextProposal = (proposal) => ({
   confidence: proposal.confidence,
   ...proposal.reviewWhen?.length ? { reviewWhen: proposal.reviewWhen.map((item) => item.trim()) } : {},
   ...proposal.reviewAfter ? { reviewAfter: proposal.reviewAfter } : {},
-  ...proposal.aliases?.length ? { aliases: unique2(proposal.aliases.map((item) => item.trim())) } : {},
-  ...proposal.supersedes?.length ? { supersedes: unique2(proposal.supersedes) } : {}
+  ...proposal.aliases?.length ? { aliases: unique3(proposal.aliases.map((item) => item.trim())) } : {},
+  ...proposal.supersedes?.length ? { supersedes: unique3(proposal.supersedes) } : {}
 });
 var renderContextProposal = (proposal, { recordedAt = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) } = {}) => {
   const id = `${proposal.kind}-${slug(proposal.title)}`;
@@ -3069,16 +3420,16 @@ var prepareContextProposal = ({ root, proposal, apply, update }) => {
   const writable = assertWritableContextCatalog({ root: projectRoot });
   const contextRoot = writable.contextRoot;
   const relativePath = `${KINDS2[normalized.kind]}/${slug(normalized.title)}.md`;
-  const destination = path6.join(contextRoot, ...relativePath.split("/"));
+  const destination = path7.join(contextRoot, ...relativePath.split("/"));
   assertInside(contextRoot, destination, "context destination");
   assertNoSymlink(projectRoot, contextRoot, "Canonical context root");
   assertNoSymlink(projectRoot, destination, "Context destination");
   const indexPath = writable.indexPath;
   const index = upgradeContextIndex(writable.index);
-  const currentIndexContent = fs6.existsSync(indexPath) ? fs6.readFileSync(indexPath, "utf8") : null;
+  const currentIndexContent = fs7.existsSync(indexPath) ? fs7.readFileSync(indexPath, "utf8") : null;
   const duplicate = index.entries.find((entry) => entry.path !== relativePath && !(normalized.supersedes ?? []).includes(entry.id) && (entry.id === rendered.id || normalizeForComparison(entry.summary) === normalizeForComparison(normalized.summary)));
   if (duplicate) throw new Error(`Duplicate context candidate: ${duplicate.path}`);
-  const current = fs6.existsSync(destination) ? fs6.readFileSync(destination, "utf8") : null;
+  const current = fs7.existsSync(destination) ? fs7.readFileSync(destination, "utf8") : null;
   const merge = mergeManaged(current, rendered, update);
   const priorEntry = index.entries.find((entry) => entry.path === relativePath || entry.id === rendered.id);
   if (priorEntry && priorEntry.path !== relativePath) throw new Error(`Context id already belongs to another path: ${priorEntry.path}`);
@@ -3094,7 +3445,7 @@ var prepareContextProposal = ({ root, proposal, apply, update }) => {
     type: item.type,
     locator: item.path,
     note: item.note,
-    sha256: sha256(fs6.readFileSync(path6.resolve(projectRoot, item.path))),
+    sha256: sha256(fs7.readFileSync(path7.resolve(projectRoot, item.path))),
     ...item.decisionId ? { decisionId: item.decisionId } : {},
     ...item.decidedAt ? { decidedAt: item.decidedAt } : {}
   });
@@ -3103,7 +3454,7 @@ var prepareContextProposal = ({ root, proposal, apply, update }) => {
     id: rendered.id,
     path: relativePath,
     summary: normalized.summary,
-    tags: unique2([normalized.kind, ...normalized.tags]).slice(0, 10),
+    tags: unique3([normalized.kind, ...normalized.tags]).slice(0, 10),
     priority: normalized.priority,
     kind: normalized.kind,
     scope: normalized.scope,
@@ -3119,7 +3470,7 @@ var prepareContextProposal = ({ root, proposal, apply, update }) => {
     if (supersededId === rendered.id) throw new Error("Context proposal must not supersede itself");
     if (!index.entries.some((entry) => entry.id === supersededId)) throw new Error(`Context proposal supersedes unknown id: ${supersededId}`);
   }
-  const supersededEntries = index.entries.map((entry) => (normalized.supersedes ?? []).includes(entry.id) ? upgradeContextIndexEntry({ ...entry, status: "superseded", supersededBy: unique2([...entry.supersededBy ?? [], rendered.id]) }) : entry);
+  const supersededEntries = index.entries.map((entry) => (normalized.supersedes ?? []).includes(entry.id) ? upgradeContextIndexEntry({ ...entry, status: "superseded", supersededBy: unique3([...entry.supersededBy ?? [], rendered.id]) }) : entry);
   const nextIndex = {
     ...index.$schema ? { $schema: index.$schema } : {},
     version: 2,
@@ -3181,16 +3532,16 @@ var option = (args, name, fallback) => {
 var main = (args = process.argv.slice(2)) => {
   const proposalFile = option(args, "--proposal");
   if (!proposalFile) throw new Error("context save requires --proposal FILE");
-  const absolute = path6.resolve(proposalFile);
-  if (!fs6.existsSync(absolute)) throw new Error(`Proposal file not found: ${absolute}`);
+  const absolute = path7.resolve(proposalFile);
+  if (!fs7.existsSync(absolute)) throw new Error(`Proposal file not found: ${absolute}`);
   let proposal;
   try {
-    proposal = JSON.parse(fs6.readFileSync(absolute, "utf8"));
+    proposal = JSON.parse(fs7.readFileSync(absolute, "utf8"));
   } catch (error) {
     throw new Error(`Could not parse proposal file: ${error instanceof Error ? error.message : String(error)}`);
   }
   const result = saveContextProposal({
-    root: path6.resolve(option(args, "--root", process.cwd())),
+    root: path7.resolve(option(args, "--root", process.cwd())),
     proposal,
     apply: args.includes("--apply"),
     update: args.includes("--update")
@@ -3199,7 +3550,7 @@ var main = (args = process.argv.slice(2)) => {
 `);
   if (result.conflicts.length) process.exitCode = 2;
 };
-if (process.argv[1] && path6.basename(process.argv[1]) === "context-save.mjs" && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (process.argv[1] && path7.basename(process.argv[1]) === "context-save.mjs" && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     main();
   } catch (error) {
@@ -3210,8 +3561,8 @@ if (process.argv[1] && path6.basename(process.argv[1]) === "context-save.mjs" &&
 }
 
 // ../../plugins/codex-agent/skills/context-curation/scripts/navigation-migrate.mjs
-import fs7 from "node:fs";
-import path7 from "node:path";
+import fs8 from "node:fs";
+import path8 from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 var PRIORITIES3 = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
 var MAX_FILES = 1e3;
@@ -3219,52 +3570,52 @@ var MAX_FILE_BYTES = 512 * 1024;
 var MAX_TOTAL_BYTES = 20 * 1024 * 1024;
 var MANAGED_START = (id) => `<!-- codex-agent:migrated:start ${id} -->`;
 var MANAGED_END = (id) => `<!-- codex-agent:migrated:end ${id} -->`;
-var unique3 = (items) => [...new Set(items.filter(Boolean))];
+var unique4 = (items) => [...new Set(items.filter(Boolean))];
 var safeText3 = (value, limit = 300) => String(value).replace(/[\r\n]+/g, " ").trim().slice(0, limit);
-var readJson2 = (file, label) => {
+var readJson3 = (file, label) => {
   try {
-    return JSON.parse(fs7.readFileSync(file, "utf8"));
+    return JSON.parse(fs8.readFileSync(file, "utf8"));
   } catch (error) {
     throw new Error(`Invalid ${label}: ${error instanceof Error ? error.message : String(error)}`);
   }
 };
-var hasNavigation = (directory) => fs7.existsSync(path7.join(directory, "navigation.md")) || fs7.existsSync(path7.join(directory, "index.md"));
+var hasNavigation = (directory) => fs8.existsSync(path8.join(directory, "navigation.md")) || fs8.existsSync(path8.join(directory, "index.md"));
 var discoverNavigationContext = ({ source }) => {
   if (!source) throw new Error("navigation migration requires --from PATH");
-  const requested = path7.resolve(source);
-  if (!fs7.existsSync(requested)) throw new Error(`Migration source not found: ${requested}`);
-  if (!fs7.statSync(requested).isDirectory()) throw new Error("Navigation migration source must be a directory");
-  const sourceRoot = fs7.realpathSync(requested);
+  const requested = path8.resolve(source);
+  if (!fs8.existsSync(requested)) throw new Error(`Migration source not found: ${requested}`);
+  if (!fs8.statSync(requested).isDirectory()) throw new Error("Navigation migration source must be a directory");
+  const sourceRoot = fs8.realpathSync(requested);
   const candidates = [];
-  const configPath = path7.join(sourceRoot, ".oac.json");
-  if (fs7.existsSync(configPath)) {
-    const config = readJson2(configPath, ".oac.json");
+  const configPath = path8.join(sourceRoot, ".oac.json");
+  if (fs8.existsSync(configPath)) {
+    const config = readJson3(configPath, ".oac.json");
     const configured = config?.context?.root;
     if (typeof configured === "string" && configured.trim()) {
-      if (path7.isAbsolute(configured)) throw new Error("Configured context root must be project-relative; pass a global context directory directly");
-      const target = path7.resolve(sourceRoot, configured);
+      if (path8.isAbsolute(configured)) throw new Error("Configured context root must be project-relative; pass a global context directory directly");
+      const target = path8.resolve(sourceRoot, configured);
       assertInside(sourceRoot, target, "Configured context root");
       candidates.push({ path: target, detectedBy: ".oac.json" });
     }
   }
   candidates.push(
-    { path: path7.join(sourceRoot, ".claude", "context"), detectedBy: ".claude/context" },
-    { path: path7.join(sourceRoot, "context"), detectedBy: "context" },
-    { path: path7.join(sourceRoot, ".opencode", "context"), detectedBy: ".opencode/context" },
+    { path: path8.join(sourceRoot, ".claude", "context"), detectedBy: ".claude/context" },
+    { path: path8.join(sourceRoot, "context"), detectedBy: "context" },
+    { path: path8.join(sourceRoot, ".opencode", "context"), detectedBy: ".opencode/context" },
     { path: sourceRoot, detectedBy: "source directory" }
   );
-  const selected = candidates.find((candidate, index) => candidates.findIndex((item) => item.path === candidate.path) === index && fs7.existsSync(candidate.path) && fs7.statSync(candidate.path).isDirectory() && hasNavigation(candidate.path));
+  const selected = candidates.find((candidate, index) => candidates.findIndex((item) => item.path === candidate.path) === index && fs8.existsSync(candidate.path) && fs8.statSync(candidate.path).isDirectory() && hasNavigation(candidate.path));
   if (!selected) throw new Error("Could not find a navigation-based context root. Pass the context directory directly or provide a valid .oac.json context.root");
   assertNoSymlink(sourceRoot, selected.path, "Context root");
-  const contextRoot = fs7.realpathSync(selected.path);
+  const contextRoot = fs8.realpathSync(selected.path);
   assertInside(sourceRoot, contextRoot, "Context root");
   const manifestCandidates = [
-    path7.join(contextRoot, ".context-manifest.json"),
-    path7.join(path7.dirname(contextRoot), ".context-manifest.json"),
-    path7.join(sourceRoot, ".context-manifest.json")
+    path8.join(contextRoot, ".context-manifest.json"),
+    path8.join(path8.dirname(contextRoot), ".context-manifest.json"),
+    path8.join(sourceRoot, ".context-manifest.json")
   ];
-  const manifestPath = unique3(manifestCandidates).find((file) => fs7.existsSync(file));
-  const manifest = manifestPath ? readJson2(manifestPath, ".context-manifest.json") : null;
+  const manifestPath = unique4(manifestCandidates).find((file) => fs8.existsSync(file));
+  const manifest = manifestPath ? readJson3(manifestPath, ".context-manifest.json") : null;
   return {
     sourceRoot,
     contextRoot,
@@ -3282,16 +3633,16 @@ var walkMarkdown = (root) => {
   const skipped = [];
   let totalBytes = 0;
   const visit = (directory) => {
-    for (const entry of fs7.readdirSync(directory, { withFileTypes: true })) {
-      const absolute = path7.join(directory, entry.name);
+    for (const entry of fs8.readdirSync(directory, { withFileTypes: true })) {
+      const absolute = path8.join(directory, entry.name);
       if (entry.isSymbolicLink()) {
-        skipped.push({ source: slash(path7.relative(root, absolute)), reason: "symbolic-link" });
+        skipped.push({ source: slash(path8.relative(root, absolute)), reason: "symbolic-link" });
         continue;
       }
       if (entry.isDirectory()) visit(absolute);
       else if (entry.isFile() && entry.name.toLowerCase().endsWith(".md")) {
-        const size = fs7.statSync(absolute).size;
-        if (size > MAX_FILE_BYTES) throw new Error(`Source context file exceeds ${MAX_FILE_BYTES} bytes: ${slash(path7.relative(root, absolute))}`);
+        const size = fs8.statSync(absolute).size;
+        if (size > MAX_FILE_BYTES) throw new Error(`Source context file exceeds ${MAX_FILE_BYTES} bytes: ${slash(path8.relative(root, absolute))}`);
         totalBytes += size;
         if (totalBytes > MAX_TOTAL_BYTES) throw new Error(`Source context exceeds ${MAX_TOTAL_BYTES} bytes`);
         files.push(absolute);
@@ -3327,9 +3678,9 @@ var runtimeReferenceCount = (content) => {
   ];
   return patterns.reduce((total, pattern) => total + (content.match(pattern)?.length ?? 0), 0);
 };
-var classify = ({ relative: relative2, content, includeNavigation, includeTemplates, includeWorkflows }) => {
-  const normalized = relative2.toLowerCase();
-  const basename = path7.posix.basename(normalized);
+var classify = ({ relative: relative3, content, includeNavigation, includeTemplates, includeWorkflows }) => {
+  const normalized = relative3.toLowerCase();
+  const basename = path8.posix.basename(normalized);
   const segments = normalized.split("/");
   if (!includeNavigation && (["navigation.md", "index.md"].includes(basename) || basename.endsWith("-navigation.md"))) return "navigation";
   if (/deprecated/i.test(content.slice(0, 1200))) return "deprecated";
@@ -3351,9 +3702,9 @@ var summary = (content, title) => {
   return safeText3(paragraphs[0] || `${title} migrated project context.`, 240);
 };
 var rewriteContent = (content) => content.replace(/\[([^\]]+)\]\([^)]*navigation\.md(?:#[^)]*)?\)/gi, "$1 (catalog: `.codex-agent/context/index.json`)").replace(/@?(?:\.opencode|\.claude)\/context\//g, ".codex-agent/context/migrated/").replace(/`(?:\.opencode|\.claude)\/context`/g, "`.codex-agent/context/migrated`").trim();
-var entryTags = ({ relative: relative2, metadata, title }) => unique3([
+var entryTags = ({ relative: relative3, metadata, title }) => unique4([
   "migrated",
-  ...relative2.replace(/\.md$/i, "").split("/"),
+  ...relative3.replace(/\.md$/i, "").split("/"),
   ...metadata.context ? metadata.context.split(/[\/\s]+/) : [],
   ...title.toLowerCase().split(/[^a-z0-9_-]+/).filter((term) => term.length > 2)
 ].map(slug)).slice(0, 10);
@@ -3394,50 +3745,50 @@ var prepareNavigationContext = ({
   const discovery = discoverNavigationContext({ source });
   const writableCatalog = assertWritableContextCatalog({ root: projectRoot });
   const contextRoot = writableCatalog.contextRoot;
-  const destinationRoot = path7.join(contextRoot, "migrated");
+  const destinationRoot = path8.join(contextRoot, "migrated");
   assertNoSymlink(projectRoot, contextRoot, "Target context root");
   const sourceWalk = walkMarkdown(discovery.contextRoot);
   const sourceFiles = sourceWalk.files;
   const skipped = [...sourceWalk.skipped];
   const candidates = [];
   for (const sourceFile of sourceFiles) {
-    const relative2 = slash(path7.relative(discovery.contextRoot, sourceFile));
-    const original = fs7.readFileSync(sourceFile, "utf8");
+    const relative3 = slash(path8.relative(discovery.contextRoot, sourceFile));
+    const original = fs8.readFileSync(sourceFile, "utf8");
     const metadata = parseMetadata(original);
-    const reason = containsSensitiveContent(original) ? "sensitive-content" : classify({ relative: relative2, content: metadata.content, includeNavigation, includeTemplates, includeWorkflows });
+    const reason = containsSensitiveContent(original) ? "sensitive-content" : classify({ relative: relative3, content: metadata.content, includeNavigation, includeTemplates, includeWorkflows });
     if (reason) {
-      skipped.push({ source: relative2, reason });
+      skipped.push({ source: relative3, reason });
       continue;
     }
     const transformed = rewriteContent(metadata.content);
     if (!transformed) {
-      skipped.push({ source: relative2, reason: "empty" });
+      skipped.push({ source: relative3, reason: "empty" });
       continue;
     }
-    const destinationRelative = `migrated/${relative2}`;
-    const id = slug(`migrated-${relative2.replace(/\.md$/i, "")}`);
-    const title = firstHeading2(transformed, path7.basename(relative2, ".md"));
+    const destinationRelative = `migrated/${relative3}`;
+    const id = slug(`migrated-${relative3.replace(/\.md$/i, "")}`);
+    const title = firstHeading2(transformed, path8.basename(relative3, ".md"));
     const managed = `${MANAGED_START(id)}
-<!-- source: ${relative2} -->
+<!-- source: ${relative3} -->
 ${transformed}
 ${MANAGED_END(id)}`;
     candidates.push({
       sourceFile,
-      source: relative2,
+      source: relative3,
       destinationRelative,
-      destination: path7.join(destinationRoot, ...relative2.split("/")),
+      destination: path8.join(destinationRoot, ...relative3.split("/")),
       id,
       title,
       summary: summary(transformed, title),
-      tags: entryTags({ relative: relative2, metadata, title }),
+      tags: entryTags({ relative: relative3, metadata, title }),
       priority: PRIORITIES3.has(metadata.priority) ? metadata.priority : "medium",
       metadata: { context: metadata.context, version: metadata.version, updated: metadata.updated },
       managed
     });
   }
-  const indexPath = path7.join(contextRoot, "index.json");
+  const indexPath = path8.join(contextRoot, "index.json");
   const targetIndex = upgradeContextIndex(writableCatalog.index);
-  const priorIndexContent = fs7.existsSync(indexPath) ? fs7.readFileSync(indexPath, "utf8") : null;
+  const priorIndexContent = fs8.existsSync(indexPath) ? fs8.readFileSync(indexPath, "utf8") : null;
   const changes = [];
   const conflicts = [];
   const migrationEntries = [];
@@ -3450,7 +3801,7 @@ ${MANAGED_END(id)}`;
   for (const candidate of candidates) {
     assertInside(destinationRoot, candidate.destination, `Migration destination ${candidate.destinationRelative}`);
     assertNoSymlink(projectRoot, candidate.destination, "Migration destination");
-    const current = fs7.existsSync(candidate.destination) ? fs7.readFileSync(candidate.destination, "utf8") : null;
+    const current = fs8.existsSync(candidate.destination) ? fs8.readFileSync(candidate.destination, "utf8") : null;
     const merge = mergeManaged2(current, candidate.id, candidate.managed, force);
     if (candidateIdOwners.get(candidate.id).size > 1) {
       conflicts.push(candidate.destinationRelative);
@@ -3522,14 +3873,14 @@ ${MANAGED_END(id)}`;
     mode: apply ? "apply" : "preview",
     format: "navigation-markdown",
     source: {
-      requested: path7.resolve(source),
+      requested: path8.resolve(source),
       contextRoot: discovery.contextRoot,
       detectedBy: discovery.detectedBy,
       manifest: discovery.manifest
     },
     changes: changes.map(({ destination, before, content, backup, ...change }) => change),
     skipped,
-    conflicts: unique3(conflicts),
+    conflicts: unique4(conflicts),
     backedUp: [],
     index: { path: ".codex-agent/context/index.json", entries: nextIndex.entries.length, diff: diff2(priorIndexContent, indexContent) },
     applied: false,
@@ -3572,7 +3923,7 @@ var option2 = (args, name, fallback) => {
 };
 var main2 = (args = process.argv.slice(2)) => {
   const result = migrateNavigationContext({
-    root: path7.resolve(option2(args, "--root", process.cwd())),
+    root: path8.resolve(option2(args, "--root", process.cwd())),
     source: option2(args, "--from"),
     apply: args.includes("--apply"),
     force: args.includes("--force"),
@@ -3584,7 +3935,7 @@ var main2 = (args = process.argv.slice(2)) => {
 `);
   if (result.conflicts.length) process.exitCode = 2;
 };
-if (process.argv[1] && path7.basename(process.argv[1]) === "navigation-migrate.mjs" && import.meta.url === pathToFileURL2(process.argv[1]).href) {
+if (process.argv[1] && path8.basename(process.argv[1]) === "navigation-migrate.mjs" && import.meta.url === pathToFileURL2(process.argv[1]).href) {
   try {
     main2();
   } catch (error) {
@@ -3595,8 +3946,8 @@ if (process.argv[1] && path7.basename(process.argv[1]) === "navigation-migrate.m
 }
 
 // ../../plugins/codex-agent/skills/context-lint/scripts/context-lint.mjs
-import fs8 from "node:fs";
-import path8 from "node:path";
+import fs9 from "node:fs";
+import path9 from "node:path";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
 var healthOrder = ["conflict", "orphan", "duplicate", "insufficient-evidence", "review-due", "healthy"];
 var normalize = (value) => String(value ?? "").normalize("NFKC").toLocaleLowerCase("en-US").replace(/\s+/g, " ").trim();
@@ -3650,13 +4001,13 @@ var lintContext = ({ root, strict = false, now = /* @__PURE__ */ new Date() }) =
       add("warning", "evidence-derived-only", entry, "external evidence alone cannot establish repository-specific context", "insufficient-evidence");
     }
     for (const evidence of localEvidence) {
-      const target = path8.resolve(catalog.root, evidence.locator);
-      const relative2 = slash(path8.relative(catalog.root, target));
-      if (relative2.startsWith("../") || path8.isAbsolute(relative2)) {
+      const target = path9.resolve(catalog.root, evidence.locator);
+      const relative3 = slash(path9.relative(catalog.root, target));
+      if (relative3.startsWith("../") || path9.isAbsolute(relative3)) {
         add("error", "evidence-escape", entry, `evidence escapes repository: ${evidence.locator}`, "insufficient-evidence");
         continue;
       }
-      if (relative2 === ".codex-agent/context" || relative2.startsWith(".codex-agent/context/") || relative2 === ".agents/context" || relative2.startsWith(".agents/context/")) {
+      if (relative3 === ".codex-agent/context" || relative3.startsWith(".codex-agent/context/") || relative3 === ".agents/context" || relative3.startsWith(".agents/context/")) {
         add("warning", "evidence-derived", entry, `evidence points to derived context: ${evidence.locator}`, "insufficient-evidence");
         continue;
       }
@@ -3668,13 +4019,13 @@ var lintContext = ({ root, strict = false, now = /* @__PURE__ */ new Date() }) =
         continue;
       }
       try {
-        stat = fs8.lstatSync(target);
+        stat = fs9.lstatSync(target);
       } catch {
         stat = null;
       }
       if (!stat) add("error", "evidence-missing-file", entry, `evidence file is missing: ${evidence.locator}`, "insufficient-evidence");
       else if (stat.isSymbolicLink() || !stat.isFile()) add("error", "evidence-invalid-file", entry, `evidence is not a regular file: ${evidence.locator}`, "insufficient-evidence");
-      else if (sha256(fs8.readFileSync(target)) !== evidence.sha256) add("error", "evidence-digest-mismatch", entry, `evidence changed: ${evidence.locator}`, "conflict");
+      else if (sha256(fs9.readFileSync(target)) !== evidence.sha256) add("error", "evidence-digest-mismatch", entry, `evidence changed: ${evidence.locator}`, "conflict");
     }
     for (const relatedId of entry.related ?? []) {
       const related = catalog.index.entries.find((item) => item.id === relatedId);
@@ -3685,7 +4036,7 @@ var lintContext = ({ root, strict = false, now = /* @__PURE__ */ new Date() }) =
   const contentOwners = /* @__PURE__ */ new Map();
   for (const entry of catalog.index.entries.filter((item) => item.status !== "superseded")) {
     const summaryKey = normalize(entry.summary);
-    const contentKey = sha256(fs8.readFileSync(path8.join(catalog.contextRoot, ...entry.path.split("/"))));
+    const contentKey = sha256(fs9.readFileSync(path9.join(catalog.contextRoot, ...entry.path.split("/"))));
     for (const [key, owners, label] of [[summaryKey, summaryOwners, "summary"], [contentKey, contentOwners, "content"]]) {
       const owner = owners.get(key);
       if (owner && !(entry.supersedes ?? []).includes(owner.id) && !(owner.supersedes ?? []).includes(entry.id)) {
@@ -3721,12 +4072,12 @@ var option3 = (args, name, fallback) => {
   return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 };
 var main3 = (args = process.argv.slice(2)) => {
-  const result = lintContext({ root: path8.resolve(option3(args, "--root", process.cwd())), strict: args.includes("--strict") });
+  const result = lintContext({ root: path9.resolve(option3(args, "--root", process.cwd())), strict: args.includes("--strict") });
   process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
   if (!result.ok) process.exitCode = 1;
 };
-if (process.argv[1] && path8.basename(process.argv[1]) === "context-lint.mjs" && import.meta.url === pathToFileURL3(process.argv[1]).href) {
+if (process.argv[1] && path9.basename(process.argv[1]) === "context-lint.mjs" && import.meta.url === pathToFileURL3(process.argv[1]).href) {
   try {
     main3();
   } catch (error) {
@@ -3738,11 +4089,11 @@ if (process.argv[1] && path8.basename(process.argv[1]) === "context-lint.mjs" &&
 
 // src/core.mjs
 var listFiles = (root) => {
-  if (!fs9.existsSync(root)) return [];
+  if (!fs10.existsSync(root)) return [];
   const files = [];
   const visit = (directory) => {
-    for (const entry of fs9.readdirSync(directory, { withFileTypes: true })) {
-      const absolute = path9.join(directory, entry.name);
+    for (const entry of fs10.readdirSync(directory, { withFileTypes: true })) {
+      const absolute = path10.join(directory, entry.name);
       if (entry.isDirectory()) visit(absolute);
       else if (entry.isFile()) files.push(absolute);
     }
@@ -3752,41 +4103,41 @@ var listFiles = (root) => {
 };
 var prepareContextMigration = ({ root, source, dryRun = false, force = false }) => {
   if (!source) throw new Error("migrate requires --from PATH");
-  const projectRoot = path9.resolve(root);
-  const sourceRoot = path9.resolve(source);
-  if (!fs9.existsSync(sourceRoot)) throw new Error(`Migration source not found: ${sourceRoot}`);
-  const sourceFiles = (fs9.statSync(sourceRoot).isDirectory() ? listFiles(sourceRoot) : [sourceRoot]).filter((file) => file.endsWith(".md"));
+  const projectRoot = path10.resolve(root);
+  const sourceRoot = path10.resolve(source);
+  if (!fs10.existsSync(sourceRoot)) throw new Error(`Migration source not found: ${sourceRoot}`);
+  const sourceFiles = (fs10.statSync(sourceRoot).isDirectory() ? listFiles(sourceRoot) : [sourceRoot]).filter((file) => file.endsWith(".md"));
   if (!sourceFiles.length) throw new Error("Migration source contains no Markdown context files.");
   const writableCatalog = assertWritableContextCatalog({ root: projectRoot });
   const catalogProjectRoot = writableCatalog.root;
   const contextRoot = writableCatalog.contextRoot;
   if (!contextRoot) throw new Error("Writable context catalog did not resolve a destination root.");
-  const destinationRoot = path9.join(contextRoot, "imported");
+  const destinationRoot = path10.join(contextRoot, "imported");
   const result = { imported: [], unchanged: [], conflicts: [], backedUp: [], dryRun, applied: false };
   const documents = [];
   const backupPaths = [];
   for (const sourceFile of sourceFiles) {
-    const relative2 = fs9.statSync(sourceRoot).isDirectory() ? path9.relative(sourceRoot, sourceFile) : path9.basename(sourceFile);
-    const destination = path9.join(destinationRoot, relative2);
-    const content = fs9.readFileSync(sourceFile);
+    const relative3 = fs10.statSync(sourceRoot).isDirectory() ? path10.relative(sourceRoot, sourceFile) : path10.basename(sourceFile);
+    const destination = path10.join(destinationRoot, relative3);
+    const content = fs10.readFileSync(sourceFile);
     if (containsSensitiveContent(content.toString("utf8"))) {
       throw new Error(`Migration source appears to contain a secret or credential: ${sourceFile}`);
     }
-    if (!fs9.existsSync(destination)) {
-      result.imported.push(path9.relative(catalogProjectRoot, destination));
-      documents.push({ path: path9.relative(contextRoot, destination).split(path9.sep).join("/"), content: content.toString("utf8") });
+    if (!fs10.existsSync(destination)) {
+      result.imported.push(path10.relative(catalogProjectRoot, destination));
+      documents.push({ path: path10.relative(contextRoot, destination).split(path10.sep).join("/"), content: content.toString("utf8") });
       continue;
     }
-    if (content.equals(fs9.readFileSync(destination))) {
-      result.unchanged.push(path9.relative(catalogProjectRoot, destination));
+    if (content.equals(fs10.readFileSync(destination))) {
+      result.unchanged.push(path10.relative(catalogProjectRoot, destination));
       continue;
     }
     if (!force) {
-      result.conflicts.push(path9.relative(catalogProjectRoot, destination));
+      result.conflicts.push(path10.relative(catalogProjectRoot, destination));
       continue;
     }
-    result.imported.push(path9.relative(catalogProjectRoot, destination));
-    const documentPath = path9.relative(contextRoot, destination).split(path9.sep).join("/");
+    result.imported.push(path10.relative(catalogProjectRoot, destination));
+    const documentPath = path10.relative(contextRoot, destination).split(path10.sep).join("/");
     documents.push({ path: documentPath, content: content.toString("utf8") });
     backupPaths.push(documentPath);
   }
@@ -3798,7 +4149,7 @@ var prepareContextMigration = ({ root, source, dryRun = false, force = false })
     index,
     backupPaths: [
       ...backupPaths,
-      ...index && fs9.existsSync(index.path) ? ["index.json"] : []
+      ...index && fs10.existsSync(index.path) ? ["index.json"] : []
     ]
   };
 };
@@ -3823,23 +4174,23 @@ var migrateContext = (options) => {
 var check = (checks, name, ok, detail) => checks.push({ name, ok: Boolean(ok), detail });
 var parseJson = (file) => {
   try {
-    return { value: JSON.parse(fs9.readFileSync(file, "utf8")) };
+    return { value: JSON.parse(fs10.readFileSync(file, "utf8")) };
   } catch (error) {
     return { error: error instanceof Error ? error.message : String(error) };
   }
 };
 var diagnoseProject = ({ root }) => {
-  const projectRoot = path9.resolve(root);
+  const projectRoot = path10.resolve(root);
   const checks = [];
   const nodeMajor = Number.parseInt(process.versions.node.split(".")[0], 10);
   check(checks, "node", nodeMajor >= 20, `Node.js ${process.versions.node}; requires 20 or newer`);
-  const manifest = path9.join(projectRoot, "plugins", "codex-agent", ".codex-plugin", "plugin.json");
-  const isSourceWorkspace = fs9.existsSync(manifest);
+  const manifest = path10.join(projectRoot, "plugins", "codex-agent", ".codex-plugin", "plugin.json");
+  const isSourceWorkspace = fs10.existsSync(manifest);
   check(checks, "mode", true, isSourceWorkspace ? "plugin source workspace" : "initialized consumer project");
   if (isSourceWorkspace) {
-    const marketplace = path9.join(projectRoot, ".agents", "plugins", "marketplace.json");
-    check(checks, "marketplace", fs9.existsSync(marketplace), marketplace);
-    if (fs9.existsSync(marketplace)) {
+    const marketplace = path10.join(projectRoot, ".agents", "plugins", "marketplace.json");
+    check(checks, "marketplace", fs10.existsSync(marketplace), marketplace);
+    if (fs10.existsSync(marketplace)) {
       const parsed2 = parseJson(marketplace);
       check(checks, "marketplace-json", !parsed2.error, parsed2.error || parsed2.value.name);
       check(
@@ -3854,10 +4205,10 @@ var diagnoseProject = ({ root }) => {
     check(checks, "plugin-json", !parsed.error, parsed.error || parsed.value.name);
     check(checks, "plugin-name", parsed.value?.name === "codex-agent", parsed.value?.name || "missing");
   } else {
-    const config = path9.join(projectRoot, ".codex", "config.toml");
-    const agents = path9.join(projectRoot, ".codex", "agents");
+    const config = path10.join(projectRoot, ".codex", "config.toml");
+    const agents = path10.join(projectRoot, ".codex", "agents");
     const profiles = listFiles(agents).filter((file) => file.endsWith(".toml"));
-    check(checks, "project-config", fs9.existsSync(config), config);
+    check(checks, "project-config", fs10.existsSync(config), config);
     check(checks, "project-agents", profiles.length === agentProfiles.length, `${profiles.length}/${agentProfiles.length} profiles in ${agents}`);
   }
   const resolvedCatalog = resolveContextCatalog({ root: projectRoot });
@@ -3868,38 +4219,38 @@ var diagnoseProject = ({ root }) => {
   } catch (error) {
     check(checks, "context-readable", false, error instanceof Error ? error.message : String(error));
   }
-  const contextIndex = readableCatalog2?.indexPath ?? (readableCatalog2?.root ? path9.join(readableCatalog2.root, "index.json") : null);
-  check(checks, "context-index", Boolean(contextIndex && fs9.existsSync(contextIndex)), contextIndex ?? "context index not found");
-  if (contextIndex && fs9.existsSync(contextIndex)) {
+  const contextIndex = readableCatalog2?.indexPath ?? (readableCatalog2?.root ? path10.join(readableCatalog2.root, "index.json") : null);
+  check(checks, "context-index", Boolean(contextIndex && fs10.existsSync(contextIndex)), contextIndex ?? "context index not found");
+  if (contextIndex && fs10.existsSync(contextIndex)) {
     const parsed = parseJson(contextIndex);
     check(checks, "context-json", !parsed.error, parsed.error || `${parsed.value.entries?.length ?? 0} entries`);
-    const contextRoot = path9.dirname(contextIndex);
+    const contextRoot = path10.dirname(contextIndex);
     const invalid = (parsed.value?.entries ?? []).filter((entry) => {
-      const target = path9.resolve(contextRoot, entry.path || "");
-      return !target.startsWith(`${contextRoot}${path9.sep}`) || !fs9.existsSync(target);
+      const target = path10.resolve(contextRoot, entry.path || "");
+      return !target.startsWith(`${contextRoot}${path10.sep}`) || !fs10.existsSync(target);
     });
     check(checks, "context-paths", invalid.length === 0, invalid.map((entry) => entry.path).join(", ") || "all paths valid");
   }
   if (isSourceWorkspace) {
-    const skillsRoot = path9.join(projectRoot, "plugins", "codex-agent", "skills");
-    const skillFiles = listFiles(skillsRoot).filter((file) => file.endsWith(`${path9.sep}SKILL.md`));
-    const skillDirectories = fs9.readdirSync(skillsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length;
+    const skillsRoot = path10.join(projectRoot, "plugins", "codex-agent", "skills");
+    const skillFiles = listFiles(skillsRoot).filter((file) => file.endsWith(`${path10.sep}SKILL.md`));
+    const skillDirectories = fs10.readdirSync(skillsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length;
     check(checks, "skills", skillFiles.length > 0 && skillFiles.length === skillDirectories, `${skillFiles.length}/${skillDirectories} skill entrypoints`);
-    const agentRoot = path9.join(projectRoot, "plugins", "codex-agent", "agents");
+    const agentRoot = path10.join(projectRoot, "plugins", "codex-agent", "agents");
     check(checks, "plugin-agents", listFiles(agentRoot).filter((file) => file.endsWith(".md")).length === agentProfiles.length, `${agentProfiles.length} canonical profiles in ${agentRoot}`);
-    const hooks = path9.join(projectRoot, "plugins", "codex-agent", "hooks", "hooks.json");
-    check(checks, "hooks", fs9.existsSync(hooks) && !parseJson(hooks).error, hooks);
+    const hooks = path10.join(projectRoot, "plugins", "codex-agent", "hooks", "hooks.json");
+    check(checks, "hooks", fs10.existsSync(hooks) && !parseJson(hooks).error, hooks);
   }
   return { root: projectRoot, ok: checks.every((item) => item.ok), checks };
 };
 var evaluateRouting = ({ root }) => {
-  const projectRoot = path9.resolve(root);
-  const suitePath = path9.join(projectRoot, "evals", "skill-routing.json");
-  if (!fs9.existsSync(suitePath)) throw new Error(`Routing suite not found: ${suitePath}`);
-  const suite = JSON.parse(fs9.readFileSync(suitePath, "utf8"));
-  const skillsRoot = path9.join(projectRoot, "plugins", "codex-agent", "skills");
+  const projectRoot = path10.resolve(root);
+  const suitePath = path10.join(projectRoot, "evals", "skill-routing.json");
+  if (!fs10.existsSync(suitePath)) throw new Error(`Routing suite not found: ${suitePath}`);
+  const suite = JSON.parse(fs10.readFileSync(suitePath, "utf8"));
+  const skillsRoot = path10.join(projectRoot, "plugins", "codex-agent", "skills");
   const available = new Set(
-    fs9.readdirSync(skillsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name)
+    fs10.readdirSync(skillsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name)
   );
   const ids = /* @__PURE__ */ new Set();
   const failures = [];
@@ -3937,13 +4288,13 @@ var evaluateRouting = ({ root }) => {
   return { ok: failures.length === 0, scenarios: suite.cases?.length ?? 0, skills: available.size, byKind, failures };
 };
 var evaluateBehaviorContracts = ({ root }) => {
-  const projectRoot = path9.resolve(root);
-  const suitePath = path9.join(projectRoot, "evals", "behavior-contracts.json");
-  if (!fs9.existsSync(suitePath)) throw new Error(`Behavior suite not found: ${suitePath}`);
-  const suite = JSON.parse(fs9.readFileSync(suitePath, "utf8"));
-  const skillsRoot = path9.join(projectRoot, "plugins", "codex-agent", "skills");
+  const projectRoot = path10.resolve(root);
+  const suitePath = path10.join(projectRoot, "evals", "behavior-contracts.json");
+  if (!fs10.existsSync(suitePath)) throw new Error(`Behavior suite not found: ${suitePath}`);
+  const suite = JSON.parse(fs10.readFileSync(suitePath, "utf8"));
+  const skillsRoot = path10.join(projectRoot, "plugins", "codex-agent", "skills");
   const availableSkills = new Set(
-    fs9.readdirSync(skillsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name)
+    fs10.readdirSync(skillsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name)
   );
   const availableAgents = new Set(agentProfiles.map((profile) => profile.name));
   const coveredSkills = /* @__PURE__ */ new Set();
@@ -3992,15 +4343,17 @@ Run "codex-agent context" to list context commands.`;
 var contextUsage = `Codex Agent context commands
 
 Usage:
-  codex-agent context init [--root PATH] [--analysis FILE] [--apply --plan-hash HASH] [--force] [--json]
-  codex-agent context refresh [--root PATH] [--analysis FILE] [--apply --plan-hash HASH] [--force] [--json]
+  codex-agent context init [--root PATH] [--analysis FILE] [--exclude-managed PATH ...] [--apply --plan-hash HASH] [--force] [--json]
+  codex-agent context refresh [--root PATH] [--analysis FILE] [--exclude-managed PATH ...] [--apply --plan-hash HASH] [--force] [--json]
   codex-agent context index [--root PATH] [--dry-run] [--json]
   codex-agent context lint [--root PATH] [--strict] [--json]
   codex-agent context save --proposal FILE [--root PATH] [--apply] [--update] [--json]
 
-Both init and refresh preview by default. Apply the exact reviewed preview by passing --apply with its planHash.`;
+Both init and refresh show a human-readable plan by default. Approve the displayed plan; the plan hash remains an internal integrity check for apply.
+Repeat --exclude-managed for optional managed paths that must remain untouched. Supported paths: .codex/config.toml and .gitignore.`;
 var OPTION_KEYS = /* @__PURE__ */ new Map([
   ["--analysis", "analysisFile"],
+  ["--exclude-managed", "excludeManaged"],
   ["--from", "source"],
   ["--plan-hash", "expectedPlanHash"],
   ["--proposal", "proposalFile"],
@@ -4021,16 +4374,19 @@ var parseOptions = (args, { command, options = [], flags = [] }) => {
   const allowedOptions = new Set(options);
   const allowedFlags = new Set(flags);
   const seen = /* @__PURE__ */ new Set();
+  const repeatableOptions = /* @__PURE__ */ new Set(["--exclude-managed"]);
   const parsed = {};
   for (let index = 0; index < args.length; index += 1) {
     const argument = args[index];
     if (!argument.startsWith("-")) throw new Error(`Unexpected argument for ${command}: ${argument}`);
-    if (seen.has(argument)) throw new Error(`Duplicate option for ${command}: ${argument}`);
-    seen.add(argument);
+    if (seen.has(argument) && !repeatableOptions.has(argument)) throw new Error(`Duplicate option for ${command}: ${argument}`);
+    if (!repeatableOptions.has(argument)) seen.add(argument);
     if (allowedOptions.has(argument)) {
       const value = args[index + 1];
       if (!value || value.startsWith("-")) throw new Error(`${argument} requires a value for ${command}`);
-      parsed[OPTION_KEYS.get(argument)] = value;
+      const key = OPTION_KEYS.get(argument);
+      if (repeatableOptions.has(argument)) parsed[key] = [...parsed[key] ?? [], value];
+      else parsed[key] = value;
       index += 1;
       continue;
     }
@@ -4040,13 +4396,13 @@ var parseOptions = (args, { command, options = [], flags = [] }) => {
     }
     throw new Error(`Unknown option for ${command}: ${argument}`);
   }
-  parsed.root = path10.resolve(parsed.root ?? process.cwd());
+  parsed.root = path11.resolve(parsed.root ?? process.cwd());
   return parsed;
 };
 var readJsonFile = (file, label) => {
-  const absolute = path10.resolve(file);
-  if (!fs10.existsSync(absolute)) throw new Error(`${label} file not found: ${absolute}`);
-  return JSON.parse(fs10.readFileSync(absolute, "utf8"));
+  const absolute = path11.resolve(file);
+  if (!fs11.existsSync(absolute)) throw new Error(`${label} file not found: ${absolute}`);
+  return JSON.parse(fs11.readFileSync(absolute, "utf8"));
 };
 var write = (value, json) => {
   if (json) {
@@ -4059,8 +4415,48 @@ var write = (value, json) => {
   else process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
+var listLine = (items, empty = "None") => items.length ? items.join(", ") : empty;
+var actionLabel = (action) => ({ create: "Create", update: "Update", preserve: "Preserve", remove: "Remove", migrate: "Migrate", conflict: "Conflict" })[action] ?? action;
+var formatContextLifecyclePlan = (result) => {
+  const plan = result.approvalPlan;
+  if (!plan) return JSON.stringify(result, null, 2);
+  const lines = [
+    plan.status === "applied" ? `Context operation applied: ${plan.title}` : `Context approval plan: ${plan.title}`,
+    "",
+    `Outcome: ${plan.outcome}`,
+    `Target: ${plan.target}`,
+    `Status: ${plan.status}`,
+    "",
+    "Repository evidence",
+    `- Project: ${plan.analysis.project}`,
+    `- Languages: ${listLine(plan.analysis.languages)}`,
+    `- Toolchains: ${listLine(plan.analysis.toolchains)}`,
+    `- Technologies: ${listLine(plan.analysis.technologies)}`,
+    `- Units: ${plan.analysis.units}; test units: ${plan.analysis.testUnits}`,
+    `- Scan: ${plan.analysis.scan.files ?? "unknown"} files; ${plan.analysis.scan.truncated ? "truncated" : "complete"}`,
+    "",
+    "Planned changes"
+  ];
+  if (plan.changes.length) for (const change of plan.changes) lines.push(`- ${actionLabel(change.action)} ${change.path}`);
+  else lines.push("- No file changes");
+  lines.push("", "Preserved");
+  lines.push(`- ${plan.preserved.manualContent}`);
+  lines.push(`- ${plan.preserved.unchanged.length} managed files are unchanged.`);
+  lines.push(`- Excluded managed paths: ${listLine(plan.preserved.excludedManaged)}`);
+  const excluded = plan.analysis.scan.excluded;
+  lines.push(`- Scan exclusions: ${listLine(excluded.slice(0, 12))}${excluded.length > 12 ? `, and ${excluded.length - 12} more` : ""}`);
+  lines.push("", "Conflicts");
+  if (plan.conflicts.length) for (const conflict of plan.conflicts) lines.push(`- ${conflict}`);
+  else lines.push("- None");
+  lines.push("", "Safeguards");
+  for (const safeguard of plan.safeguards) lines.push(`- ${safeguard}`);
+  lines.push("", "Residual risks");
+  for (const risk of plan.residualRisks) lines.push(`- ${risk}`);
+  lines.push("", `Approval: ${plan.approval}`, `Plan integrity: ${plan.integrityId}`);
+  return lines.join("\n");
+};
 var finishWithConflicts = (result, json) => {
-  write(result, json);
+  write(json || !result.approvalPlan ? result : formatContextLifecyclePlan(result), json);
   if (result.conflicts.length) process.exitCode = 2;
 };
 var main4 = async (args) => {
@@ -4089,7 +4485,7 @@ ${contextUsage}`);
     if (subcommand === "init" || subcommand === "refresh") {
       const options = parseOptions(contextArgs, {
         command: `context ${subcommand}`,
-        options: ["--root", "--analysis", "--plan-hash"],
+        options: ["--root", "--analysis", "--exclude-managed", "--plan-hash"],
         flags: ["--apply", "--force", "--json"]
       });
       const analysis = options.analysisFile ? readJsonFile(options.analysisFile, "Analysis") : null;