@fro.bot/systematic 3.14.5 → 3.15.1

package/dist/cli.js

@@ -1,25 +1,55 @@
 #!/usr/bin/env node
 // @bun
 import {
+  parseFrontmatter,
+  parse,
+  parseTree,
+  modify,
   applyEdits,
-  discoverSkills,
-  exports_external,
+  _isoDateTime,
+  _isoDate,
+  _isoTime,
+  _isoDuration,
+  string,
+  ZodISODateTime,
+  ZodISODate,
+  ZodISOTime,
+  ZodISODuration,
+  number,
+  boolean,
+  array,
+  object,
+  union,
+  discriminatedUnion,
+  _enum,
+  literal,
+  loadConfigWithSources,
+  getConfigPaths,
   extractString,
   findAgentsInDir,
   findCommandsInDir,
   findSkillsInDir,
-  getConfigPaths,
-  loadConfigWithSources,
-  modify,
-  parse,
-  parseFrontmatter,
-  parseTree
-} from "./index-0stf3ag0.js";
+  discoverSkills
+} from "./index-7cyxcwf5.js";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
 
 // src/cli.ts
-import fs5 from "fs";
+import fs6 from "fs";
 import os2 from "os";
-import path4 from "path";
+import path5 from "path";
 
 // src/lib/agent-resolver.ts
 import fs from "fs";
@@ -778,7 +808,30 @@ function buildCapabilitySnapshot(options) {
   options.outputSink?.(serialized);
   return snapshot;
 }
-
+// node_modules/.bun/zod@4.5.4/node_modules/zod/v4/classic/iso.js
+var exports_iso = {};
+__export(exports_iso, {
+  ZodISODate: () => ZodISODate,
+  ZodISODateTime: () => ZodISODateTime,
+  ZodISODuration: () => ZodISODuration,
+  ZodISOTime: () => ZodISOTime,
+  date: () => date,
+  datetime: () => datetime,
+  duration: () => duration,
+  time: () => time
+});
+function datetime(params) {
+  return _isoDateTime(ZodISODateTime, params);
+}
+function date(params) {
+  return _isoDate(ZodISODate, params);
+}
+function time(params) {
+  return _isoTime(ZodISOTime, params);
+}
+function duration(params) {
+  return _isoDuration(ZodISODuration, params);
+}
 // src/lib/pi-subagents-export.ts
 import * as crypto2 from "crypto";
 import * as fs3 from "fs";
@@ -1424,10 +1477,10 @@ function ownedFilenames(manifest) {
 function parseSourceCategoryAndKey(sourceRelPath) {
   const parts = sourceRelPath.split("/");
   if (parts.length >= 3 && parts[0] === "agents") {
-    const fileName2 = parts.at(-1) ?? "";
+    const fileName = parts.at(-1) ?? "";
     return {
       category: parts[1],
-      agentKey: fileName2.replace(/\.md$/, "")
+      agentKey: fileName.replace(/\.md$/, "")
     };
   }
   const fileName = parts.at(-1) ?? sourceRelPath;
@@ -1949,7 +2002,7 @@ function cleanup(agentsRoot, configOptions) {
       ...targets.map((t) => t.path),
       ...manifestPath ? [manifestPath] : []
     ];
-    const tx2 = runWithRollback(pathsToWatch, [
+    const tx = runWithRollback(pathsToWatch, [
       ...targets.map(({ path: p, filename, hash }) => () => {
         if (fs3.existsSync(p)) {
           assertHashMatchesOrThrow(p, hash, filename, "delete");
@@ -1963,7 +2016,7 @@ function cleanup(agentsRoot, configOptions) {
         }
       ] : []
     ]);
-    return { kind: "tx", tx: tx2 };
+    return { kind: "tx", tx };
   });
   if (!lockResult.locked) {
     if (lockResult.isContention)
@@ -1978,6 +2031,108 @@ function cleanup(agentsRoot, configOptions) {
   return { status: "ok" };
 }
 
+// src/lib/review-artifact-path.ts
+import fs4 from "fs";
+import path3 from "path";
+function formatReviewArtifactIssuePath(issuePath) {
+  if (issuePath.length === 0)
+    return "$";
+  return issuePath.map((segment) => typeof segment === "number" ? String(segment) : segment).join(".");
+}
+function readReviewArtifact(filePath) {
+  let content;
+  try {
+    content = fs4.readFileSync(filePath, "utf8");
+  } catch {
+    return { message: "Review artifact file could not be read", ok: false };
+  }
+  try {
+    return { ok: true, value: JSON.parse(content) };
+  } catch (error) {
+    return {
+      message: error instanceof SyntaxError ? "Review artifact contains malformed JSON" : "Review artifact file could not be read",
+      ok: false
+    };
+  }
+}
+function isLegacyReviewArtifact(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && !Object.hasOwn(value, "schema_version");
+}
+function hasParentDirectoryTraversal(input) {
+  return input.split(/[\\/]+/).some((segment) => segment === "..");
+}
+function pathContainsSymlink(candidate) {
+  let current = path3.parse(candidate).root;
+  const relative = path3.relative(current, candidate);
+  for (const segment of relative.split(path3.sep)) {
+    if (!segment)
+      continue;
+    current = path3.join(current, segment);
+    try {
+      if (fs4.lstatSync(current).isSymbolicLink())
+        return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function isWithinDirectory(candidate, directory) {
+  const relative = path3.relative(directory, candidate);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative);
+}
+function resolveReviewArtifactPath(input, cwd) {
+  if (hasParentDirectoryTraversal(input)) {
+    return {
+      message: "Review artifact path must not contain parent-directory traversal",
+      ok: false
+    };
+  }
+  const artifactRoot = path3.resolve(cwd, ".context", "systematic", "ce-review");
+  let canonicalRoot;
+  try {
+    canonicalRoot = fs4.realpathSync(artifactRoot);
+    if (!fs4.statSync(canonicalRoot).isDirectory()) {
+      return {
+        message: "Review artifact directory is not a directory",
+        ok: false
+      };
+    }
+  } catch {
+    return { message: "Review artifact directory is unavailable", ok: false };
+  }
+  const candidate = path3.resolve(cwd, input);
+  if (pathContainsSymlink(candidate)) {
+    return {
+      message: "Review artifact path must not contain symlinks",
+      ok: false
+    };
+  }
+  let canonicalTarget;
+  try {
+    canonicalTarget = fs4.realpathSync(candidate);
+  } catch {
+    return { message: "Review artifact file was not found", ok: false };
+  }
+  if (!isWithinDirectory(canonicalTarget, canonicalRoot)) {
+    return {
+      message: "Review artifact path must remain inside .context/systematic/ce-review",
+      ok: false
+    };
+  }
+  try {
+    if (!fs4.lstatSync(canonicalTarget).isFile()) {
+      return {
+        message: "Review artifact target is not a regular file",
+        ok: false
+      };
+    }
+  } catch {
+    return { message: "Review artifact file was not found", ok: false };
+  }
+  return { ok: true, path: canonicalTarget };
+}
+
 // src/lib/review-artifact-schema.ts
 var MAX_REVIEWER_LENGTH = 64;
 var MAX_RUN_ID_LENGTH = 64;
@@ -1994,14 +2149,14 @@ var REVIEW_ARTIFACT_CUSTOM_MESSAGES = [
   "unsatisfied risk coverage must not cite an input finding ID",
   "passed validation must not include a reason; non-passed validation requires a reason"
 ];
-var boundedText = (maxLength) => exports_external.string().min(1).max(maxLength).regex(/\S/);
-var DispatchOutcomeSchema = exports_external.enum([
+var boundedText = (maxLength) => string().min(1).max(maxLength).regex(/\S/);
+var DispatchOutcomeSchema = _enum([
   "findings",
   "empty",
   "malformed",
   "never_returned"
 ]);
-var DispositionSchema = exports_external.enum([
+var DispositionSchema = _enum([
   "surviving",
   "merged",
   "suppressed",
@@ -2009,12 +2164,12 @@ var DispositionSchema = exports_external.enum([
   "rejected"
 ]);
 var AdmittedDispositionSchema = DispositionSchema.exclude(["rejected"]);
-var HarnessSchema = exports_external.enum(["opencode", "pi", "claude-code"]);
+var HarnessSchema = _enum(["opencode", "pi", "claude-code"]);
 var RepoRelativePathSchema = boundedText(256).regex(/^(?!\/)(?![A-Za-z]:[\\/])(?!\\).+/);
 var ReviewerSchema = boundedText(MAX_REVIEWER_LENGTH);
-var BranchSchema = exports_external.string().max(MAX_BRANCH_LENGTH);
-var HeadShaSchema = exports_external.string().regex(/^[0-9a-f]{40}$/);
-var CompletedAtSchema = exports_external.iso.datetime({ offset: false });
+var BranchSchema = string().max(MAX_BRANCH_LENGTH);
+var HeadShaSchema = string().regex(/^[0-9a-f]{40}$/);
+var CompletedAtSchema = exports_iso.datetime({ offset: false });
 var ReasonSchema = boundedText(MAX_REASON_LENGTH);
 var RISK_CRITICAL_PERSONAS = [
   "security",
@@ -2023,42 +2178,42 @@ var RISK_CRITICAL_PERSONAS = [
   "reliability",
   "performance"
 ];
-var RiskCriticalPersonaSchema = exports_external.enum(RISK_CRITICAL_PERSONAS);
+var RiskCriticalPersonaSchema = _enum(RISK_CRITICAL_PERSONAS);
 var FindingTitleSchema = boundedText(256);
-var SeveritySchema = exports_external.enum(["P0", "P1", "P2", "P3", "unknown"]);
+var SeveritySchema = _enum(["P0", "P1", "P2", "P3", "unknown"]);
 var FindingSeveritySchema = SeveritySchema.exclude(["unknown"]);
-var AutofixClassSchema = exports_external.enum([
+var AutofixClassSchema = _enum([
   "safe_auto",
   "gated_auto",
   "manual",
   "advisory"
 ]);
-var OwnerSchema = exports_external.enum([
+var OwnerSchema = _enum([
   "review-fixer",
   "downstream-resolver",
   "human",
   "release"
 ]);
 var BoundedEvidenceStringSchema = boundedText(500).regex(/^(?!\/)(?![A-Za-z]:[\\/])(?!\\).+/);
-var OverflowEvidenceSchema = exports_external.object({
-  overflow: exports_external.literal(true),
+var OverflowEvidenceSchema = object({
+  overflow: literal(true),
   excerpt: BoundedEvidenceStringSchema
 }).strict();
-var EvidenceSchema = exports_external.array(exports_external.union([BoundedEvidenceStringSchema, OverflowEvidenceSchema])).min(1).max(5);
-var AdmittedInputFindingSchema = exports_external.object({
-  record_type: exports_external.literal("admitted"),
+var EvidenceSchema = array(union([BoundedEvidenceStringSchema, OverflowEvidenceSchema])).min(1).max(5);
+var AdmittedInputFindingSchema = object({
+  record_type: literal("admitted"),
   input_id: boundedText(MAX_INPUT_ID_LENGTH),
   reviewer: ReviewerSchema,
-  confidence: exports_external.number().min(0).max(1),
+  confidence: number().min(0).max(1),
   disposition: AdmittedDispositionSchema,
   reason: ReasonSchema
 }).strict();
-var RejectedInputFindingSchema = exports_external.object({
-  record_type: exports_external.literal("rejected_summary"),
+var RejectedInputFindingSchema = object({
+  record_type: literal("rejected_summary"),
   reviewer: ReviewerSchema,
   dispatch_outcome: DispatchOutcomeSchema,
-  rejected_finding_count: exports_external.number().int().positive().max(MAX_FINDINGS),
-  rejected_severities: exports_external.array(SeveritySchema).max(MAX_FINDINGS),
+  rejected_finding_count: number().int().positive().max(MAX_FINDINGS),
+  rejected_severities: array(SeveritySchema).max(MAX_FINDINGS),
   disposition: DispositionSchema.extract(["rejected"]),
   reason: ReasonSchema
 }).strict().superRefine((row, ctx) => {
@@ -2070,31 +2225,31 @@ var RejectedInputFindingSchema = exports_external.object({
     });
   }
 });
-var InputFindingSchema = exports_external.discriminatedUnion("record_type", [
+var InputFindingSchema = discriminatedUnion("record_type", [
   AdmittedInputFindingSchema,
   RejectedInputFindingSchema
 ]);
-var ProvenanceSchema = exports_external.object({
+var ProvenanceSchema = object({
   fingerprint: boundedText(512),
-  submitters: exports_external.array(ReviewerSchema).max(MAX_PERSONAS),
-  agreement_credit: exports_external.array(ReviewerSchema).max(MAX_PERSONAS)
+  submitters: array(ReviewerSchema).max(MAX_PERSONAS),
+  agreement_credit: array(ReviewerSchema).max(MAX_PERSONAS)
 }).strict();
-var SynthesizedFindingFieldsSchema = exports_external.object({
+var SynthesizedFindingFieldsSchema = object({
   title: FindingTitleSchema,
   severity: FindingSeveritySchema,
   file: RepoRelativePathSchema,
-  line: exports_external.number().int().positive(),
+  line: number().int().positive(),
   why_it_matters: boundedText(2048),
   autofix_class: AutofixClassSchema,
   owner: OwnerSchema,
-  requires_verification: exports_external.boolean(),
-  confidence: exports_external.number().min(0).max(1),
+  requires_verification: boolean(),
+  confidence: number().min(0).max(1),
   evidence: EvidenceSchema,
-  pre_existing: exports_external.boolean(),
-  suggested_fix: exports_external.string().max(2048).nullable().optional(),
-  validated: exports_external.boolean().optional(),
+  pre_existing: boolean(),
+  suggested_fix: string().max(2048).nullable().optional(),
+  validated: boolean().optional(),
   validation_reason: ReasonSchema.optional(),
-  input_finding_ids: exports_external.array(boundedText(MAX_INPUT_ID_LENGTH)).min(1).max(MAX_FINDINGS),
+  input_finding_ids: array(boundedText(MAX_INPUT_ID_LENGTH)).min(1).max(MAX_FINDINGS),
   provenance: ProvenanceSchema
 }).strict();
 var SynthesizedFindingSchema = SynthesizedFindingFieldsSchema.superRefine((finding, ctx) => {
@@ -2106,12 +2261,12 @@ var SynthesizedFindingSchema = SynthesizedFindingFieldsSchema.superRefine((findi
     });
   }
 });
-var DispatchSchema = exports_external.object({
+var DispatchSchema = object({
   persona: ReviewerSchema,
   dispatch_outcome: DispatchOutcomeSchema,
-  input_finding_count: exports_external.number().int().nonnegative().max(MAX_FINDINGS),
+  input_finding_count: number().int().nonnegative().max(MAX_FINDINGS),
   rejection_reason: ReasonSchema.optional(),
-  selection_surface: exports_external.array(RepoRelativePathSchema).max(MAX_FINDINGS).optional(),
+  selection_surface: array(RepoRelativePathSchema).max(MAX_FINDINGS).optional(),
   selection_reason: ReasonSchema.optional()
 }).strict().superRefine((dispatch, ctx) => {
   if (RISK_CRITICAL_PERSONAS.includes(dispatch.persona) && (!dispatch.selection_surface || dispatch.selection_surface.length === 0)) {
@@ -2122,29 +2277,29 @@ var DispatchSchema = exports_external.object({
     });
   }
 });
-var DispositionCountsSchema = exports_external.object({
-  surviving: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
-  merged: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
-  suppressed: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
-  filtered: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
-  rejected: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS)
+var DispositionCountsSchema = object({
+  surviving: number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  merged: number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  suppressed: number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  filtered: number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  rejected: number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS)
 }).strict();
-var CoverageSchema = exports_external.object({
-  reviewers: exports_external.number().int().nonnegative().max(MAX_PERSONAS).optional(),
-  validators: exports_external.number().int().nonnegative().max(MAX_PERSONAS).optional(),
-  residual_risks: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
-  testing_gaps: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
-  failed_reviewers: exports_external.array(ReviewerSchema).max(MAX_PERSONAS),
-  validator_failures: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
-  intent_uncertainty: exports_external.array(ReasonSchema).max(MAX_PERSONAS)
+var CoverageSchema = object({
+  reviewers: number().int().nonnegative().max(MAX_PERSONAS).optional(),
+  validators: number().int().nonnegative().max(MAX_PERSONAS).optional(),
+  residual_risks: array(ReasonSchema).max(MAX_PERSONAS),
+  testing_gaps: array(ReasonSchema).max(MAX_PERSONAS),
+  failed_reviewers: array(ReviewerSchema).max(MAX_PERSONAS),
+  validator_failures: array(ReasonSchema).max(MAX_PERSONAS),
+  intent_uncertainty: array(ReasonSchema).max(MAX_PERSONAS)
 }).strict();
-var DeclinedMergeSchema = exports_external.object({
+var DeclinedMergeSchema = object({
   file: RepoRelativePathSchema,
-  input_finding_ids: exports_external.array(boundedText(MAX_INPUT_ID_LENGTH)).min(2).max(MAX_FINDINGS),
+  input_finding_ids: array(boundedText(MAX_INPUT_ID_LENGTH)).min(2).max(MAX_FINDINGS),
   reason: ReasonSchema
 }).strict();
-var ValidationSchema = exports_external.object({
-  status: exports_external.enum([
+var ValidationSchema = object({
+  status: _enum([
     "passed",
     "failed",
     "unavailable",
@@ -2167,9 +2322,9 @@ var ValidationSchema = exports_external.object({
     });
   }
 });
-var RiskCoverageSchema = exports_external.object({
+var RiskCoverageSchema = object({
   persona: RiskCriticalPersonaSchema,
-  satisfied: exports_external.boolean(),
+  satisfied: boolean(),
   input_finding_id: boundedText(MAX_INPUT_ID_LENGTH).optional()
 }).strict().superRefine((coverage, ctx) => {
   if (coverage.satisfied && coverage.input_finding_id === undefined) {
@@ -2187,14 +2342,14 @@ var RiskCoverageSchema = exports_external.object({
     });
   }
 });
-var ReviewArtifactSchema = exports_external.object({
-  schema_version: exports_external.literal(1),
+var ReviewArtifactSchema = object({
+  schema_version: literal(1),
   run_id: boundedText(MAX_RUN_ID_LENGTH),
   branch: BranchSchema,
   head_sha: HeadShaSchema,
-  mode: exports_external.enum(["interactive", "autofix", "headless"]),
+  mode: _enum(["interactive", "autofix", "headless"]),
   harness: HarnessSchema,
-  run_status: exports_external.enum([
+  run_status: _enum([
     "in_progress",
     "completed",
     "degraded",
@@ -2202,22 +2357,22 @@ var ReviewArtifactSchema = exports_external.object({
   ]),
   verdict: boundedText(256),
   completed_at: CompletedAtSchema,
-  dispatches: exports_external.array(DispatchSchema).max(MAX_PERSONAS),
-  input_findings: exports_external.array(InputFindingSchema).max(MAX_FINDINGS * MAX_PERSONAS),
-  findings: exports_external.array(SynthesizedFindingSchema).max(MAX_FINDINGS),
-  declined_merges: exports_external.array(DeclinedMergeSchema).max(MAX_FINDINGS).optional(),
-  risk_coverage: exports_external.array(RiskCoverageSchema).max(MAX_PERSONAS).optional(),
+  dispatches: array(DispatchSchema).max(MAX_PERSONAS),
+  input_findings: array(InputFindingSchema).max(MAX_FINDINGS * MAX_PERSONAS),
+  findings: array(SynthesizedFindingSchema).max(MAX_FINDINGS),
+  declined_merges: array(DeclinedMergeSchema).max(MAX_FINDINGS).optional(),
+  risk_coverage: array(RiskCoverageSchema).max(MAX_PERSONAS).optional(),
   disposition_counts: DispositionCountsSchema,
-  applied_fixes: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
-  residual_actionable_work: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
-  advisory_outputs: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
+  applied_fixes: array(ReasonSchema).max(MAX_FINDINGS),
+  residual_actionable_work: array(ReasonSchema).max(MAX_FINDINGS),
+  advisory_outputs: array(ReasonSchema).max(MAX_FINDINGS),
   coverage: CoverageSchema,
   validation: ValidationSchema.optional()
 }).strict();
 
 // src/lib/setup.ts
-import fs4 from "fs";
-import path3 from "path";
+import fs5 from "fs";
+import path4 from "path";
 var SYSTEMATIC_PACKAGE_NAME = "@fro.bot/systematic";
 var PI_PACKAGE_IDENTIFIER = `npm:${SYSTEMATIC_PACKAGE_NAME}`;
 var SETUP_ERROR_NAME = "SetupError";
@@ -2227,10 +2382,10 @@ function createSetupError(message) {
   return error;
 }
 var DEFAULT_OPS = {
-  writeFileSync: fs4.writeFileSync,
-  renameSync: fs4.renameSync,
-  unlinkSync: fs4.unlinkSync,
-  chmodSync: fs4.chmodSync
+  writeFileSync: fs5.writeFileSync,
+  renameSync: fs5.renameSync,
+  unlinkSync: fs5.unlinkSync,
+  chmodSync: fs5.chmodSync
 };
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2252,7 +2407,7 @@ function isPiSystematicIdentifier(identifier) {
 }
 function lstatOrNull(targetPath) {
   try {
-    return fs4.lstatSync(targetPath);
+    return fs5.lstatSync(targetPath);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -2261,10 +2416,10 @@ function lstatOrNull(targetPath) {
   }
 }
 function assertRealpathUnderCwd(dir, cwd) {
-  const realDir = fs4.realpathSync(dir);
-  const realCwd = fs4.realpathSync(cwd);
-  const relative2 = path3.relative(realCwd, realDir);
-  if (relative2.startsWith("..") || path3.isAbsolute(relative2)) {
+  const realDir = fs5.realpathSync(dir);
+  const realCwd = fs5.realpathSync(cwd);
+  const relative = path4.relative(realCwd, realDir);
+  if (relative.startsWith("..") || path4.isAbsolute(relative)) {
     throw createSetupError(`Refusing to write under ${dir}: resolved directory escapes the project root`);
   }
 }
@@ -2277,7 +2432,7 @@ function assertParentTrusted(parentDir, cwd) {
     assertRealpathUnderCwd(parentDir, cwd);
     return;
   }
-  fs4.mkdirSync(parentDir, { recursive: true });
+  fs5.mkdirSync(parentDir, { recursive: true });
   assertRealpathUnderCwd(parentDir, cwd);
 }
 var OPENCODE_TARGET_CANDIDATES = [
@@ -2287,19 +2442,19 @@ var OPENCODE_TARGET_CANDIDATES = [
   "opencode.json"
 ];
 function resolveOpenCodeTargetPath(cwd) {
-  const opencodeDirStat = lstatOrNull(path3.join(cwd, ".opencode"));
+  const opencodeDirStat = lstatOrNull(path4.join(cwd, ".opencode"));
   if (opencodeDirStat?.isSymbolicLink()) {
-    return path3.join(cwd, OPENCODE_TARGET_CANDIDATES[0]);
+    return path4.join(cwd, OPENCODE_TARGET_CANDIDATES[0]);
   }
   for (const candidate of OPENCODE_TARGET_CANDIDATES) {
-    const candidatePath = path3.join(cwd, candidate);
+    const candidatePath = path4.join(cwd, candidate);
     if (lstatOrNull(candidatePath) !== null)
       return candidatePath;
   }
-  return path3.join(cwd, "opencode.jsonc");
+  return path4.join(cwd, "opencode.jsonc");
 }
 var IS_WINDOWS = process.platform === "win32";
-var OPEN_FLAGS = IS_WINDOWS ? fs4.constants.O_RDONLY : fs4.constants.O_RDONLY | fs4.constants.O_NOFOLLOW | fs4.constants.O_NONBLOCK;
+var OPEN_FLAGS = IS_WINDOWS ? fs5.constants.O_RDONLY : fs5.constants.O_RDONLY | fs5.constants.O_NOFOLLOW | fs5.constants.O_NONBLOCK;
 function assertWindowsPreOpenTrust(targetPath) {
   const preStat = lstatOrNull(targetPath);
   if (preStat && (preStat.isSymbolicLink() || !preStat.isFile())) {
@@ -2311,7 +2466,7 @@ function openTrustedExisting(targetPath) {
     assertWindowsPreOpenTrust(targetPath);
   let fd;
   try {
-    fd = fs4.openSync(targetPath, OPEN_FLAGS);
+    fd = fs5.openSync(targetPath, OPEN_FLAGS);
   } catch (error) {
     if (error instanceof Error && "code" in error) {
       if (error.code === "ENOENT")
@@ -2323,13 +2478,13 @@ function openTrustedExisting(targetPath) {
     throw error;
   }
   try {
-    const stat = fs4.fstatSync(fd);
+    const stat = fs5.fstatSync(fd);
     if (!stat.isFile()) {
       throw createSetupError(`Refusing to read ${targetPath}: not a regular file`);
     }
-    return { bytes: fs4.readFileSync(fd), mode: stat.mode & 511 };
+    return { bytes: fs5.readFileSync(fd), mode: stat.mode & 511 };
   } finally {
-    fs4.closeSync(fd);
+    fs5.closeSync(fd);
   }
 }
 function atomicWrite(targetPath, content, originalBytes, mode, ops) {
@@ -2344,8 +2499,8 @@ function atomicWrite(targetPath, content, originalBytes, mode, ops) {
   writeTempAndRename(targetPath, content, mode, preserveMode, ops);
 }
 function writeTempAndRename(destPath, content, mode, preserveExactMode, ops) {
-  const parentDir = path3.dirname(destPath);
-  const tempPath = makeTempPath(parentDir, path3.basename(destPath));
+  const parentDir = path4.dirname(destPath);
+  const tempPath = makeTempPath(parentDir, path4.basename(destPath));
   try {
     ops.writeFileSync(tempPath, content, { flag: "wx", mode });
     if (preserveExactMode) {
@@ -2357,11 +2512,11 @@ function writeTempAndRename(destPath, content, mode, preserveExactMode, ops) {
     throw error;
   }
 }
-function makeTempPath(parentDir, basename2) {
-  return path3.join(parentDir, `.${basename2}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+function makeTempPath(parentDir, basename) {
+  return path4.join(parentDir, `.${basename}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 }
 function cleanupTemp(tempPath, ops) {
-  if (!fs4.existsSync(tempPath))
+  if (!fs5.existsSync(tempPath))
     return;
   try {
     ops.unlinkSync(tempPath);
@@ -2395,7 +2550,7 @@ function parseOpenCodeJsonc(rawText, targetPath) {
 }
 function setupOpenCode(cwd, ops) {
   const targetPath = resolveOpenCodeTargetPath(cwd);
-  assertParentTrusted(path3.dirname(targetPath), cwd);
+  assertParentTrusted(path4.dirname(targetPath), cwd);
   const existing = openTrustedExisting(targetPath);
   if (existing === null) {
     const content = `${JSON.stringify({ plugin: [SYSTEMATIC_PACKAGE_NAME] }, null, 2)}
@@ -2413,8 +2568,8 @@ function setupOpenCode(cwd, ops) {
     throw createSetupError(`Invalid OpenCode config in ${targetPath}: \`plugins\` (plural) is not supported by OpenCode's schema; use singular \`plugin\``);
   }
   if (!Object.hasOwn(parsed, "plugin")) {
-    const edits2 = modify(rawText, ["plugin"], [SYSTEMATIC_PACKAGE_NAME], {});
-    atomicWrite(targetPath, applyEdits(rawText, edits2), existing.bytes, existing.mode, ops);
+    const edits = modify(rawText, ["plugin"], [SYSTEMATIC_PACKAGE_NAME], {});
+    atomicWrite(targetPath, applyEdits(rawText, edits), existing.bytes, existing.mode, ops);
     return { status: "configured", targetPath };
   }
   const existingValue = parsed.plugin;
@@ -2453,8 +2608,8 @@ function assertPiTaggedEntryUsable(entry, targetPath) {
   }
 }
 function setupPi(cwd, ops) {
-  const targetPath = path3.join(cwd, ".pi", "settings.json");
-  assertParentTrusted(path3.dirname(targetPath), cwd);
+  const targetPath = path4.join(cwd, ".pi", "settings.json");
+  assertParentTrusted(path4.dirname(targetPath), cwd);
   const existing = openTrustedExisting(targetPath);
   if (existing === null) {
     const content = `${JSON.stringify({ packages: [PI_PACKAGE_IDENTIFIER] }, null, 2)}
@@ -2475,8 +2630,8 @@ function setupPi(cwd, ops) {
   }
   const existingPackages = parsed.packages;
   if (existingPackages === undefined) {
-    const edits2 = modify(rawText, ["packages"], [PI_PACKAGE_IDENTIFIER], {});
-    atomicWrite(targetPath, applyEdits(rawText, edits2), existing.bytes, existing.mode, ops);
+    const edits = modify(rawText, ["packages"], [PI_PACKAGE_IDENTIFIER], {});
+    atomicWrite(targetPath, applyEdits(rawText, edits), existing.bytes, existing.mode, ops);
     return { status: "configured", targetPath };
   }
   if (!Array.isArray(existingPackages)) {
@@ -2514,10 +2669,10 @@ function setupHarness(harness, cwd, opsOverride) {
 // src/cli.ts
 function readPackageMetadata(packageRoot) {
   try {
-    const packageJsonPath = path4.join(packageRoot, "package.json");
-    if (!fs5.existsSync(packageJsonPath))
+    const packageJsonPath = path5.join(packageRoot, "package.json");
+    if (!fs6.existsSync(packageJsonPath))
       return {};
-    const content = fs5.readFileSync(packageJsonPath, "utf8");
+    const content = fs6.readFileSync(packageJsonPath, "utf8");
     const parsed = JSON.parse(content);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return {};
@@ -2531,7 +2686,7 @@ function readPackageMetadata(packageRoot) {
     return {};
   }
 }
-var PACKAGE_ROOT = path4.resolve(import.meta.dirname, "..");
+var PACKAGE_ROOT = path5.resolve(import.meta.dirname, "..");
 var VERSION = readPackageMetadata(PACKAGE_ROOT).version ?? "unknown";
 var HELP = `
 systematic - OpenCode plugin for systematic engineering workflows
@@ -2590,9 +2745,9 @@ Scope:
 var VALIDATE_REVIEW_ARTIFACT_USAGE = "Usage: systematic validate-review-artifact <path>";
 var REVIEW_ARTIFACT_SCHEMA_RELATIVE_PATH = "skills/ce-review/references/review-summary-schema.json";
 function defaultCapabilityRoots() {
-  const configDir = process.env.XDG_CONFIG_HOME ? path4.join(process.env.XDG_CONFIG_HOME, "opencode") : path4.join(os2.homedir(), ".config/opencode");
+  const configDir = process.env.XDG_CONFIG_HOME ? path5.join(process.env.XDG_CONFIG_HOME, "opencode") : path5.join(os2.homedir(), ".config/opencode");
   return {
-    agentsRoot: path4.join(PACKAGE_ROOT, "agents"),
+    agentsRoot: path5.join(PACKAGE_ROOT, "agents"),
     configDir,
     cwd: process.cwd(),
     homeDir: os2.homedir(),
@@ -2691,9 +2846,9 @@ function collectConfigMetadata(roots, injected) {
 }
 function resolveCapabilityRootPath(root) {
   try {
-    return fs5.realpathSync(root);
+    return fs6.realpathSync(root);
   } catch {
-    return path4.resolve(root);
+    return path5.resolve(root);
   }
 }
 function capabilityRoots(roots) {
@@ -2703,7 +2858,7 @@ function capabilityRoots(roots) {
     { id: "package", path: resolveCapabilityRootPath(roots.packageRoot) },
     {
       id: "skills",
-      path: resolveCapabilityRootPath(path4.join(roots.packageRoot, "skills"))
+      path: resolveCapabilityRootPath(path5.join(roots.packageRoot, "skills"))
     },
     { id: "user", path: resolveCapabilityRootPath(roots.homeDir) }
   ];
@@ -2744,85 +2899,6 @@ function runCapabilities(options) {
 function runCapabilitiesCli(options) {
   return runCapabilities(options);
 }
-function hasParentDirectoryTraversal(input) {
-  return input.split(/[\\/]+/).some((segment) => segment === "..");
-}
-function pathContainsSymlink(candidate) {
-  let current = path4.parse(candidate).root;
-  const relative2 = path4.relative(current, candidate);
-  for (const segment of relative2.split(path4.sep)) {
-    if (!segment)
-      continue;
-    current = path4.join(current, segment);
-    try {
-      if (fs5.lstatSync(current).isSymbolicLink())
-        return true;
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-function isWithinDirectory(candidate, directory) {
-  const relative2 = path4.relative(directory, candidate);
-  return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative2);
-}
-function resolveReviewArtifactPath(input, cwd) {
-  if (hasParentDirectoryTraversal(input)) {
-    return {
-      message: "Review artifact path must not contain parent-directory traversal",
-      ok: false
-    };
-  }
-  const artifactRoot = path4.resolve(cwd, ".context", "systematic", "ce-review");
-  let canonicalRoot;
-  try {
-    canonicalRoot = fs5.realpathSync(artifactRoot);
-    if (!fs5.statSync(canonicalRoot).isDirectory()) {
-      return {
-        message: "Review artifact directory is not a directory",
-        ok: false
-      };
-    }
-  } catch {
-    return { message: "Review artifact directory is unavailable", ok: false };
-  }
-  const candidate = path4.resolve(cwd, input);
-  if (pathContainsSymlink(candidate)) {
-    return {
-      message: "Review artifact path must not contain symlinks",
-      ok: false
-    };
-  }
-  let canonicalTarget;
-  try {
-    canonicalTarget = fs5.realpathSync(candidate);
-  } catch {
-    return { message: "Review artifact file was not found", ok: false };
-  }
-  if (!isWithinDirectory(canonicalTarget, canonicalRoot)) {
-    return {
-      message: "Review artifact path must remain inside .context/systematic/ce-review",
-      ok: false
-    };
-  }
-  try {
-    if (!fs5.lstatSync(canonicalTarget).isFile()) {
-      return {
-        message: "Review artifact target is not a regular file",
-        ok: false
-      };
-    }
-  } catch {
-    return { message: "Review artifact file was not found", ok: false };
-  }
-  return { ok: true, path: canonicalTarget };
-}
-function formatReviewArtifactIssuePath(issuePath) {
-  if (issuePath.length === 0)
-    return "$";
-  return issuePath.map((segment) => typeof segment === "number" ? String(segment) : segment).join(".");
-}
 function validateReviewArtifactArgument(argv) {
   const commandIndex = argv[0] === "systematic" ? 1 : 0;
   if (argv[commandIndex] !== "validate-review-artifact")
@@ -2831,25 +2907,6 @@ function validateReviewArtifactArgument(argv) {
     return;
   return argv[commandIndex + 1];
 }
-function readReviewArtifact(filePath) {
-  let content;
-  try {
-    content = fs5.readFileSync(filePath, "utf8");
-  } catch {
-    return { message: "Review artifact file could not be read", ok: false };
-  }
-  try {
-    return { ok: true, value: JSON.parse(content) };
-  } catch (error) {
-    return {
-      message: error instanceof SyntaxError ? "Review artifact contains malformed JSON" : "Review artifact file could not be read",
-      ok: false
-    };
-  }
-}
-function isLegacyReviewArtifact(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && !Object.hasOwn(value, "schema_version");
-}
 function runValidateReviewArtifact(options) {
   const outputSink = options.outputSink ?? ((message) => console.log(message));
   const errorSink = options.errorSink ?? ((message) => console.error(message));
@@ -2916,7 +2973,7 @@ function setupCommand(rest) {
   }
 }
 function listItems(type) {
-  const packageRoot = path4.resolve(import.meta.dirname, "..");
+  const packageRoot = path5.resolve(import.meta.dirname, "..");
   const bundledDir = packageRoot;
   let finder;
   let subdir;
@@ -2937,7 +2994,7 @@ function listItems(type) {
       console.error(`Unknown type: ${type}. Use: skills, agents, commands`);
       process.exit(1);
   }
-  const items = finder(path4.join(bundledDir, subdir));
+  const items = finder(path5.join(bundledDir, subdir));
   if (items.length === 0) {
     console.log(`No ${type} found.`);
     return;
@@ -2954,15 +3011,15 @@ function configShow() {
 `);
   console.log(`  User config:    ${paths.userConfig}`);
   console.log(`  Project config: ${paths.projectConfig}`);
-  if (fs5.existsSync(paths.projectConfig)) {
+  if (fs6.existsSync(paths.projectConfig)) {
     console.log(`
 Project configuration:`);
-    console.log(fs5.readFileSync(paths.projectConfig, "utf-8"));
+    console.log(fs6.readFileSync(paths.projectConfig, "utf-8"));
   }
-  if (fs5.existsSync(paths.userConfig)) {
+  if (fs6.existsSync(paths.userConfig)) {
     console.log(`
 User configuration:`);
-    console.log(fs5.readFileSync(paths.userConfig, "utf-8"));
+    console.log(fs6.readFileSync(paths.userConfig, "utf-8"));
   }
 }
 function configPath() {