@garygentry/system1 0.3.2 → 0.4.1

package/dist/bundle/chunks/{chunk-5TUBFH7M.mjs → chunk-CUKOJ7OM.mjs}

@@ -9,7 +9,7 @@ import {
   __require,
   __toESM,
   isDecisionsError
-} from "./chunk-4ZZ3ZSJN.mjs";
+} from "./chunk-B62DSXC3.mjs";
 
 // ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
@@ -8969,9 +8969,9 @@ var require_picomatch = __commonJS({
     var utils = require_utils();
     var constants2 = require_constants();
     var isObject2 = (val) => val && typeof val === "object" && !Array.isArray(val);
-    var picomatch3 = (glob2, options, returnState = false) => {
+    var picomatch4 = (glob2, options, returnState = false) => {
       if (Array.isArray(glob2)) {
-        const fns = glob2.map((input) => picomatch3(input, options, returnState));
+        const fns = glob2.map((input) => picomatch4(input, options, returnState));
         const arrayMatcher = (str) => {
           for (const isMatch of fns) {
             const state2 = isMatch(str);
@@ -8987,16 +8987,16 @@ var require_picomatch = __commonJS({
       }
       const opts = options || {};
       const posix2 = opts.windows;
-      const regex = isState ? picomatch3.compileRe(glob2, options) : picomatch3.makeRe(glob2, options, false, true);
+      const regex = isState ? picomatch4.compileRe(glob2, options) : picomatch4.makeRe(glob2, options, false, true);
       const state = regex.state;
       delete regex.state;
       let isIgnored = () => false;
       if (opts.ignore) {
         const ignoreOpts = { ...options, ignore: null, onMatch: null, onResult: null };
-        isIgnored = picomatch3(opts.ignore, ignoreOpts, returnState);
+        isIgnored = picomatch4(opts.ignore, ignoreOpts, returnState);
       }
       const matcher = (input, returnObject = false) => {
-        const { isMatch, match, output } = picomatch3.test(input, regex, options, { glob: glob2, posix: posix2 });
+        const { isMatch, match, output } = picomatch4.test(input, regex, options, { glob: glob2, posix: posix2 });
         const result = { glob: glob2, state, regex, posix: posix2, input, output, match, isMatch };
         if (typeof opts.onResult === "function") {
           opts.onResult(result);
@@ -9022,7 +9022,7 @@ var require_picomatch = __commonJS({
       }
       return matcher;
     };
-    picomatch3.test = (input, regex, options, { glob: glob2, posix: posix2 } = {}) => {
+    picomatch4.test = (input, regex, options, { glob: glob2, posix: posix2 } = {}) => {
       if (typeof input !== "string") {
         throw new TypeError("Expected input to be a string");
       }
@@ -9039,24 +9039,24 @@ var require_picomatch = __commonJS({
       }
       if (match === false || opts.capture === true) {
         if (opts.matchBase === true || opts.basename === true) {
-          match = picomatch3.matchBase(input, regex, options, posix2);
+          match = picomatch4.matchBase(input, regex, options, posix2);
         } else {
           match = regex.exec(output);
         }
       }
       return { isMatch: Boolean(match), match, output };
     };
-    picomatch3.matchBase = (input, glob2, options, posix2 = options && options.windows) => {
-      const regex = glob2 instanceof RegExp ? glob2 : picomatch3.makeRe(glob2, options);
+    picomatch4.matchBase = (input, glob2, options, posix2 = options && options.windows) => {
+      const regex = glob2 instanceof RegExp ? glob2 : picomatch4.makeRe(glob2, options);
       return regex.test(utils.basename(input, { windows: posix2 }));
     };
-    picomatch3.isMatch = (str, patterns, options) => picomatch3(patterns, options)(str);
-    picomatch3.parse = (pattern, options) => {
-      if (Array.isArray(pattern)) return pattern.map((p) => picomatch3.parse(p, options));
+    picomatch4.isMatch = (str, patterns, options) => picomatch4(patterns, options)(str);
+    picomatch4.parse = (pattern, options) => {
+      if (Array.isArray(pattern)) return pattern.map((p) => picomatch4.parse(p, options));
       return parse3(pattern, { ...options, fastpaths: false });
     };
-    picomatch3.scan = (input, options) => scan(input, options);
-    picomatch3.compileRe = (state, options, returnOutput = false, returnState = false) => {
+    picomatch4.scan = (input, options) => scan(input, options);
+    picomatch4.compileRe = (state, options, returnOutput = false, returnState = false) => {
       if (returnOutput === true) {
         return state.output;
       }
@@ -9067,13 +9067,13 @@ var require_picomatch = __commonJS({
       if (state && state.negated === true) {
         source = `^(?!${source}).*$`;
       }
-      const regex = picomatch3.toRegex(source, options);
+      const regex = picomatch4.toRegex(source, options);
       if (returnState === true) {
         regex.state = state;
       }
       return regex;
     };
-    picomatch3.makeRe = (input, options = {}, returnOutput = false, returnState = false) => {
+    picomatch4.makeRe = (input, options = {}, returnOutput = false, returnState = false) => {
       if (!input || typeof input !== "string") {
         throw new TypeError("Expected a non-empty string");
       }
@@ -9084,9 +9084,9 @@ var require_picomatch = __commonJS({
       if (!parsed.output) {
         parsed = parse3(input, options);
       }
-      return picomatch3.compileRe(parsed, options, returnOutput, returnState);
+      return picomatch4.compileRe(parsed, options, returnOutput, returnState);
     };
-    picomatch3.toRegex = (source, options) => {
+    picomatch4.toRegex = (source, options) => {
       try {
         const opts = options || {};
         return new RegExp(source, opts.flags || (opts.nocase ? "i" : ""));
@@ -9095,8 +9095,8 @@ var require_picomatch = __commonJS({
         return /$^/;
       }
     };
-    picomatch3.constants = constants2;
-    module.exports = picomatch3;
+    picomatch4.constants = constants2;
+    module.exports = picomatch4;
   }
 });
 
@@ -9106,14 +9106,14 @@ var require_picomatch2 = __commonJS({
     "use strict";
     var pico = require_picomatch();
     var utils = require_utils();
-    function picomatch3(glob2, options, returnState = false) {
+    function picomatch4(glob2, options, returnState = false) {
       if (options && (options.windows === null || options.windows === void 0)) {
         options = { ...options, windows: utils.isWindows() };
       }
       return pico(glob2, options, returnState);
     }
-    Object.assign(picomatch3, pico);
-    module.exports = picomatch3;
+    Object.assign(picomatch4, pico);
+    module.exports = picomatch4;
   }
 });
 
@@ -9415,7 +9415,8 @@ var RETRY_STATUSES = /* @__PURE__ */ new Set([
   520,
   521,
   522,
-  524
+  524,
+  529
 ]);
 var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 function createOpenRouterTransport(options) {
@@ -9569,7 +9570,7 @@ function loadConfig(options = {}) {
     { layer: user, file: userFile }
   ];
   const pickFrom = (path, rule) => pick(path, rule, layers2, warnings);
-  const merged = {
+  const merged2 = {
     model: pickFrom("model", TEXT) ?? DEFAULTS.model,
     endpoint: pickFrom("endpoint", URL_TEXT) ?? DEFAULTS.endpoint,
     concurrency: pickFrom("concurrency", WHOLE) ?? DEFAULTS.concurrency,
@@ -9591,12 +9592,13 @@ function loadConfig(options = {}) {
   const key = resolveApiKey(env, userDir);
   const session = detectSession(env);
   return {
-    ...merged,
-    model: nonEmpty2(env.SYSTEM1_MODEL) ?? merged.model,
-    endpoint: nonEmpty2(env.SYSTEM1_ENDPOINT) ?? merged.endpoint,
+    ...merged2,
+    model: nonEmpty2(env.SYSTEM1_MODEL) ?? merged2.model,
+    endpoint: nonEmpty2(env.SYSTEM1_ENDPOINT) ?? merged2.endpoint,
     repoRoot,
     apiKey: key?.value,
     apiKeySource: key?.source,
+    apiKeyQuoted: key?.quoted ?? false,
     replay: /^(1|true|yes)$/i.test(env.SYSTEM1_REPLAY ?? ""),
     session: session?.id,
     sessionOrigin: session?.origin,
@@ -9840,18 +9842,36 @@ function triggerList(value, file) {
   });
 }
 function resolveApiKey(env, userDir) {
-  const fromEnv = nonEmpty2(env.OPENROUTER_API_KEY);
+  const fromEnv = unquoteKey(env.OPENROUTER_API_KEY);
   if (fromEnv)
-    return { value: fromEnv, source: "env" };
+    return { ...fromEnv, source: "env" };
   const file = join(userDir, "credentials");
   if (!existsSync(file))
     return void 0;
   if (process.platform !== "win32" && (statSync(file).mode & 63) !== 0) {
     throw new DecisionsError("config-error", `${file} is readable by other users. Run \`chmod 600 ${file}\`.`, { file });
   }
-  const parsed = readLayer(file);
-  const value = nonEmpty2(typeof parsed?.openrouter_api_key === "string" ? parsed.openrouter_api_key : void 0);
-  return value ? { value, source: "credentials", file } : void 0;
+  let parsed;
+  try {
+    parsed = readLayer(file);
+  } catch {
+    throw new DecisionsError("config-error", `${file} is not a valid YAML mapping; it should hold one line, \`openrouter_api_key: <key>\``, { file });
+  }
+  const key = unquoteKey(typeof parsed?.openrouter_api_key === "string" ? parsed.openrouter_api_key : void 0, `openrouter_api_key in ${file}`);
+  return key ? { ...key, source: "credentials", file } : void 0;
+}
+function unquoteKey(raw, source = "OPENROUTER_API_KEY") {
+  const value = nonEmpty2(raw);
+  if (!value)
+    return void 0;
+  const quoted = /^(["']).*\1$/s.test(value);
+  const key = quoted ? nonEmpty2(value.slice(1, -1)) : value;
+  if (!key)
+    return void 0;
+  if (/[^\x21-\x7e]/.test(key)) {
+    throw new DecisionsError("config-error", `${source} contains a space, line break or other character an API key can't have; set it again`);
+  }
+  return { value: key, quoted };
 }
 function nonEmpty2(value) {
   return value === void 0 || value.trim() === "" ? void 0 : value.trim();
@@ -9926,6 +9946,9 @@ function applyExcludes(items, extra = []) {
   }
   return { items: kept, excluded: [...excluded.values()] };
 }
+function isExcluded(path, extra = []) {
+  return [...DEFAULT_EXCLUDES, ...extra].find((p) => (0, import_picomatch.default)(p, { dot: true })(path));
+}
 
 // ../core/dist/ping.js
 function probeUrl(config) {
@@ -13109,8 +13132,8 @@ function Compare(left, right) {
 // ../../node_modules/.pnpm/typebox@1.3.34/node_modules/typebox/build/type/engine/evaluate/broaden.mjs
 function BroadenFilter(type, types, result = [], all = types) {
   return guard_exports.ShiftLeft(types, (left, right) => {
-    const compare = Compare(type, left);
-    return guard_exports.IsEqual(compare, CompareResultLeftInside) || guard_exports.IsEqual(compare, CompareResultEqual) ? all : guard_exports.IsEqual(compare, CompareResultDisjoint) ? BroadenFilter(type, right, [...result, left], all) : BroadenFilter(type, right, result, all);
+    const compare2 = Compare(type, left);
+    return guard_exports.IsEqual(compare2, CompareResultLeftInside) || guard_exports.IsEqual(compare2, CompareResultEqual) ? all : guard_exports.IsEqual(compare2, CompareResultDisjoint) ? BroadenFilter(type, right, [...result, left], all) : BroadenFilter(type, right, result, all);
   }, () => [...result, type]);
 }
 function BroadenType(type, types, result) {
@@ -13556,8 +13579,8 @@ function CollapseIntersectProperties(left, right) {
   const leftProperties = leftKeys.reduce((result, key) => ({ ...result, [key]: left[key] }), {});
   const rightProperties = rightKeys.reduce((result, key) => ({ ...result, [key]: right[key] }), {});
   const sharedProperties = sharedKeys.reduce((result, key) => ({ ...result, [key]: EvaluateIntersect([left[key], right[key]]) }), {});
-  const unique = memory_exports.Assign(leftProperties, rightProperties);
-  const shared = memory_exports.Assign(unique, sharedProperties);
+  const unique2 = memory_exports.Assign(leftProperties, rightProperties);
+  const shared = memory_exports.Assign(unique2, sharedProperties);
   return shared;
 }
 function FromIntersect(types) {
@@ -14993,15 +15016,15 @@ function NextPendingResource(stack, schema) {
   return IsId(schema) ? false : stack.pendingResource;
 }
 function NextLexicalBase(stack, schema) {
-  const entry = ResourceEntry(stack, schema);
-  if (entry)
-    return entry.base;
+  const entry2 = ResourceEntry(stack, schema);
+  if (entry2)
+    return entry2.base;
   return IsId(schema) ? NextUri(schema.$id, stack.lexicalBase).href : stack.lexicalBase;
 }
 function NextResourceBase(stack, schema) {
-  const entry = ResourceEntry(stack, schema);
-  if (entry)
-    return entry.base;
+  const entry2 = ResourceEntry(stack, schema);
+  if (entry2)
+    return entry2.base;
   return IsId(schema) && stack.pendingResource ? NextUri(schema.$id, stack.resourceBase).href : stack.resourceBase;
 }
 function NextUseResourceBaseForReference(stack, schema) {
@@ -15013,9 +15036,9 @@ function NextReferenceBase(stack, schema) {
   return isRetrieved || useResourceBaseForReference ? NextResourceBase(stack, schema) : NextLexicalBase(stack, schema);
 }
 function NextLexicalSchema(stack, schema) {
-  const entry = ResourceEntry(stack, schema);
-  if (entry)
-    return entry.root;
+  const entry2 = ResourceEntry(stack, schema);
+  if (entry2)
+    return entry2.root;
   return IsId(schema) ? schema : stack.lexicalSchema;
 }
 function HasStackKeywords(stack, schema) {
@@ -17975,10 +17998,10 @@ function FromArray13(context, type, value) {
   const repaired = maximum.map((value2) => FromType26(context, type.items, value2));
   if (!IsUniqueItems(type) || IsUniqueItems(type) && !guard_exports.IsEqual(type.uniqueItems, true))
     return repaired;
-  const unique = MakeUnique(repaired);
-  if (!Check2(context, type, unique))
+  const unique2 = MakeUnique(repaired);
+  if (!Check2(context, type, unique2))
     throw new RepairError(context, type, value, "Failed to repair Array due to uniqueItems constraint");
-  return unique;
+  return unique2;
 }
 
 // ../../node_modules/.pnpm/typebox@1.3.34/node_modules/typebox/build/value/repair/from_enum.mjs
@@ -18122,14 +18145,14 @@ function FromUnknown2(context, type, value) {
 
 // ../../node_modules/.pnpm/typebox@1.3.34/node_modules/typebox/build/value/repair/from_type.mjs
 function AssertRepairableValue(context, type, value) {
-  const unsupported = globals_exports.IsDate(value) || globals_exports.IsMap(value) || globals_exports.IsSet(value) || globals_exports.IsTypeArray(value) || guard_exports.IsConstructor(value) || guard_exports.IsFunction(value);
-  if (unsupported) {
+  const unsupported2 = globals_exports.IsDate(value) || globals_exports.IsMap(value) || globals_exports.IsSet(value) || globals_exports.IsTypeArray(value) || guard_exports.IsConstructor(value) || guard_exports.IsFunction(value);
+  if (unsupported2) {
     throw new RepairError(context, type, value, "Value is not repairable");
   }
 }
 function AssertRepairableType(context, type, value) {
-  const unsupported = IsConstructor2(type) || IsFunction2(type) || IsNever(type);
-  if (unsupported) {
+  const unsupported2 = IsConstructor2(type) || IsFunction2(type) || IsNever(type);
+  if (unsupported2) {
     throw new RepairError(context, type, value, "Type is not repairable");
   }
 }
@@ -18186,16 +18209,34 @@ var import_yaml3 = __toESM(require_dist(), 1);
 
 // ../core/dist/project/project.js
 var FILTER = /^\s*([A-Za-z_][\w-]*)((?:\.[\w-]+)*)\s*(>=|<=|!=|>|<|=|\s+in\s+)\s*(.+?)\s*$/;
-function parseFilter(text, questions) {
+function tokenizeFilter(text) {
   const m = FILTER.exec(text);
-  if (!m?.[1] || !m[3] || m[4] === void 0) {
-    throw new DecisionsError("invalid-request", `Cannot parse --keep "${text}". Use <question>[.<field>]<op><value>, e.g. relevant>=0.7 or kind in fix,feature`);
-  }
-  const question = m[1];
+  if (!m?.[1] || !m[3] || m[4] === void 0)
+    return void 0;
   const op = m[3].trim();
-  const field = m[2] ? m[2].slice(1) : defaultField(question, questions);
   const raw = m[4];
   const value = op === "in" ? raw.split(",").map((s) => s.trim()).filter(Boolean) : isNumeric(raw) ? Number(raw) : raw;
+  return { name: m[1], path: m[2] ? m[2].slice(1) : "", op, value };
+}
+function tokenizeSort(text) {
+  const m = /^\s*([A-Za-z_][\w-]*)((?:\.[\w-]+)*)(?::(asc|desc))?\s*$/.exec(text);
+  if (!m?.[1])
+    return void 0;
+  return {
+    name: m[1],
+    path: m[2] ? m[2].slice(1) : "",
+    direction: m[3] ?? "desc"
+  };
+}
+function parseFilter(text, questions) {
+  const t = tokenizeFilter(text);
+  if (!t) {
+    throw new DecisionsError("invalid-request", `Cannot parse --keep "${text}". Use <question>[.<field>]<op><value>, e.g. relevant>=0.7 or kind in fix,feature`);
+  }
+  const question = t.name;
+  const op = t.op;
+  const field = t.path || defaultField(question, questions);
+  const value = t.value;
   const filter = { question, field, op, value, source: text };
   if (questions)
     assertKnown(question, questions, text);
@@ -18205,14 +18246,14 @@ function parseFilter(text, questions) {
   return filter;
 }
 function parseSort(text, questions) {
-  const m = /^\s*([A-Za-z_][\w-]*)((?:\.[\w-]+)*)(?::(asc|desc))?\s*$/.exec(text);
-  if (!m?.[1]) {
+  const t = tokenizeSort(text);
+  if (!t) {
     throw new DecisionsError("invalid-request", `Cannot parse --sort "${text}". Use <question>[.<field>][:asc|desc]`);
   }
   if (questions)
-    assertKnown(m[1], questions, text);
-  const field = m[2] ? m[2].slice(1) : sortField(m[1], questions);
-  return { question: m[1], field, direction: m[3] ?? "desc" };
+    assertKnown(t.name, questions, text);
+  const field = t.path || sortField(t.name, questions);
+  return { question: t.name, field, direction: t.direction };
 }
 function matches(answers, filter) {
   const actual = read(answers[filter.question], filter.field);
@@ -18231,18 +18272,33 @@ function matches(answers, filter) {
     }
   }
 }
+function verdictOf(answers, flat, keep, keepAny = [], sortQuestion) {
+  const acted = [...keep.map((f) => f.question), ...sortQuestion ? [sortQuestion] : []];
+  const all = acted.length === 0 && keepAny.length === 0;
+  const blocking = flat.filter((q) => all || acted.includes(q));
+  if (blocking.length > 0)
+    return { verdict: "undecided", questions: [...blocking] };
+  if (!keep.every((f) => matches(answers, f)))
+    return { verdict: "dropped", questions: [] };
+  if (keepAny.length === 0)
+    return { verdict: "kept", questions: [] };
+  const decided = keepAny.filter((f) => !flat.includes(f.question));
+  if (decided.some((f) => matches(answers, f)))
+    return { verdict: "kept", questions: [] };
+  const open = [...new Set(keepAny.filter((f) => flat.includes(f.question)).map((f) => f.question))];
+  return open.length > 0 ? { verdict: "undecided", questions: open } : { verdict: "dropped", questions: [] };
+}
 function project(input) {
   const keep = input.keep ?? [];
-  const acted = [...keep.map((f) => f.question), ...input.sort ? [input.sort.question] : []];
-  const relevant = acted.length > 0 ? new Set(acted) : void 0;
+  const keepAny = input.keepAny ?? [];
   const kept = [];
   const undecided = [];
   let dropped = 0;
   for (const row2 of input.rows) {
-    const flat = input.undecidedOf(row2).filter((q) => !relevant || relevant.has(q));
-    if (flat.length > 0)
-      undecided.push({ row: row2, questions: [...flat] });
-    else if (keep.every((f) => matches(row2.answers, f)))
+    const v = verdictOf(row2.answers, input.undecidedOf(row2), keep, keepAny, input.sort?.question);
+    if (v.verdict === "undecided")
+      undecided.push({ row: row2, questions: v.questions });
+    else if (v.verdict === "kept")
       kept.push(row2);
     else
       dropped += 1;
@@ -18625,21 +18681,21 @@ var Walker = class {
     if (controller.aborted || signal && signal.aborted || maxFiles && paths.length > maxFiles) return;
     const files = this.getArray(this.state.paths);
     for (let i = 0; i < entries.length; ++i) {
-      const entry = entries[i];
-      if (entry.isFile() || entry.isSymbolicLink() && !resolveSymlinks$1 && !excludeSymlinks) {
-        const filename = this.joinPath(entry.name, directoryPath);
+      const entry2 = entries[i];
+      if (entry2.isFile() || entry2.isSymbolicLink() && !resolveSymlinks$1 && !excludeSymlinks) {
+        const filename = this.joinPath(entry2.name, directoryPath);
         this.pushFile(filename, files, this.state.counts, filters);
-      } else if (entry.isDirectory()) {
-        let path = joinDirectoryPath(entry.name, directoryPath, this.state.options.pathSeparator);
-        if (exclude && exclude(entry.name, path)) continue;
+      } else if (entry2.isDirectory()) {
+        let path = joinDirectoryPath(entry2.name, directoryPath, this.state.options.pathSeparator);
+        if (exclude && exclude(entry2.name, path)) continue;
         this.pushDirectory(path, paths, filters);
         this.walkDirectory(this.state, path, path, depth - 1, this.walk);
-      } else if (this.resolveSymlink && entry.isSymbolicLink()) {
-        let path = joinPathWithBasePath(entry.name, directoryPath);
+      } else if (this.resolveSymlink && entry2.isSymbolicLink()) {
+        let path = joinPathWithBasePath(entry2.name, directoryPath);
         this.resolveSymlink(path, this.state, (stat2, resolvedPath) => {
           if (stat2.isDirectory()) {
             resolvedPath = normalizePath(resolvedPath, this.state.options);
-            if (exclude && exclude(entry.name, useRealPaths ? resolvedPath : path + pathSeparator)) return;
+            if (exclude && exclude(entry2.name, useRealPaths ? resolvedPath : path + pathSeparator)) return;
             this.walkDirectory(this.state, resolvedPath, useRealPaths ? resolvedPath : path + pathSeparator, depth - 1, this.walk);
           } else {
             resolvedPath = useRealPaths ? resolvedPath : path;
@@ -19073,6 +19129,26 @@ async function glob(globInput, options) {
   return crawler ? formatPaths(await crawler.withPromise(), relative5) : [];
 }
 
+// ../core/dist/sources/filter.js
+var import_picomatch3 = __toESM(require_picomatch2(), 1);
+function applyFilter(items, patterns = []) {
+  if (patterns.length === 0)
+    return { items: [...items], filtered: [] };
+  const matchers = patterns.map((p) => ({ p, test: (0, import_picomatch3.default)(p, { dot: true }) }));
+  const kept = [];
+  const filtered = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const paths = [item.path, item.realPath].filter((p) => p !== void 0);
+    const hit = item.path === void 0 ? void 0 : matchers.find((m) => paths.some((p) => m.test(p)));
+    if (hit && item.path !== void 0) {
+      filtered.set(item.path, { path: item.path, reason: "filtered", detail: hit.p });
+    } else {
+      kept.push(item);
+    }
+  }
+  return { items: kept, filtered: [...filtered.values()] };
+}
+
 // ../core/dist/sources/read.js
 function resolvePath(cwd, path) {
   const absolute = resolve4(cwd, path);
@@ -19187,12 +19263,15 @@ async function readGlob(patterns, options) {
   });
   matches2.sort();
   const ignored = new Set(gitIgnored(options.cwd, matches2));
-  const kept = matches2.filter((m) => !ignored.has(m));
-  const result = readFiles(kept, options);
+  const candidates = matches2.filter((m) => !ignored.has(m));
+  const withheld = candidates.filter((m) => isExcluded(m, options.withhold));
+  const unfiltered = applyFilter(candidates.filter((m) => !withheld.includes(m)).map((path) => ({ path })), options.filter);
+  const result = readFiles([...withheld, ...unfiltered.items.map((m) => m.path)].sort(), options);
   return {
     documents: result.documents,
     skipped: [
       ...[...ignored].map((path) => ({ path, reason: "gitignored" })),
+      ...unfiltered.filtered,
       ...result.skipped
     ]
   };
@@ -19535,6 +19614,8 @@ var SpecSchema = typebox_exports.Object({
   description: typebox_exports.String({ minLength: 1 }),
   questions: typebox_exports.Record(typebox_exports.String(), typebox_exports.Unknown()),
   keep: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
+  /** Kept when any of these matches, as well as every `keep`. */
+  keepAny: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
   sort: typebox_exports.Optional(typebox_exports.String()),
   policy: typebox_exports.Optional(typebox_exports.Object({ thresholds: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), Threshold)) }, CLOSED)),
   source: typebox_exports.Optional(typebox_exports.Object({
@@ -19581,7 +19662,7 @@ function parseSpec(text, file, origin) {
     throw new DecisionsError("invalid-request", `${file}: ${error.message}`, { file });
   }
   const questions = spec.questions;
-  for (const text2 of spec.keep ?? [])
+  for (const text2 of [...spec.keep ?? [], ...spec.keepAny ?? []])
     wrap(file, () => parseFilter(text2, questions));
   if (spec.sort)
     wrap(file, () => parseSort(spec.sort, questions));
@@ -19684,11 +19765,11 @@ function listSpecs(dirs) {
   for (const [origin, dir] of layers(dirs)) {
     if (!existsSync4(dir))
       continue;
-    for (const entry of readdirSync2(dir).sort()) {
-      if (!/\.(ya?ml|json)$/.test(entry))
+    for (const entry2 of readdirSync2(dir).sort()) {
+      if (!/\.(ya?ml|json)$/.test(entry2))
         continue;
-      const file = join2(dir, entry);
-      const name = basename2(entry, extname(entry));
+      const file = join2(dir, entry2);
+      const name = basename2(entry2, extname(entry2));
       const shadowed = seen.has(name);
       seen.add(name);
       try {
@@ -19728,6 +19809,360 @@ function wrap(file, fn) {
   }
 }
 
+// ../core/dist/model/schema.js
+var QuestionSchema = typebox_exports.Union([
+  typebox_exports.Object({
+    type: typebox_exports.Literal("noul"),
+    instructions: typebox_exports.String({ minLength: 1 }),
+    /** Optional `true`/`false` criteria that sharpen an ambiguous statement. */
+    criteria: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), typebox_exports.String()))
+  }, { additionalProperties: false }),
+  typebox_exports.Object({
+    type: typebox_exports.Literal("choice"),
+    instructions: typebox_exports.String({ minLength: 1 }),
+    /** Option key to when it applies. At least two, including a way out. */
+    criteria: typebox_exports.Record(typebox_exports.String(), typebox_exports.String(), { minProperties: 2 })
+  }, { additionalProperties: false }),
+  typebox_exports.Object({
+    type: typebox_exports.Literal("score"),
+    instructions: typebox_exports.String({ minLength: 1 }),
+    /** Levels, lowest first and 0-indexed. */
+    criteria: typebox_exports.Array(typebox_exports.String(), { minItems: 2 })
+  }, { additionalProperties: false })
+]);
+
+// ../core/dist/opportunities/backlog.js
+import { createHash } from "node:crypto";
+import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync5, renameSync, rmSync, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname4, join as join3 } from "node:path";
+var BACKLOG_FORMAT = 1;
+var CLOSED2 = { additionalProperties: false };
+var Text = typebox_exports.String({ minLength: 1 });
+var Usd = typebox_exports.Number({ minimum: 0, maximum: 1e6 });
+var Status = typebox_exports.Union([
+  typebox_exports.Literal("new"),
+  typebox_exports.Literal("stale"),
+  typebox_exports.Literal("adopted"),
+  typebox_exports.Literal("rejected")
+]);
+var candidateFields = {
+  /** `code`: a codebase (Mode A). `agents`: skills, hooks, agent configuration (Mode B). */
+  mode: typebox_exports.Union([typebox_exports.Literal("code"), typebox_exports.Literal("agents")]),
+  location: typebox_exports.Object({
+    path: Text,
+    lines: typebox_exports.Optional(typebox_exports.Object({ start: typebox_exports.Integer({ minimum: 1 }), end: typebox_exports.Integer({ minimum: 1 }) }, CLOSED2))
+  }, CLOSED2),
+  /** What does the job today, e.g. "gpt-4o call parsed to an enum". */
+  mechanism: Text,
+  shape: typebox_exports.Union([
+    typebox_exports.Literal("single"),
+    typebox_exports.Literal("fanout"),
+    typebox_exports.Literal("cascade"),
+    typebox_exports.Literal("pairwise")
+  ]),
+  /**
+   * The text that triggered it, taken verbatim from the screened item. The id is
+   * derived from it, so it must be copied, not paraphrased.
+   */
+  evidence: typebox_exports.String({ pattern: "\\S" }),
+  /** A draft question set that would replace the mechanism. */
+  questions: typebox_exports.Record(typebox_exports.String(), QuestionSchema, { minProperties: 1 }),
+  /**
+   * What replacing the mechanism would mainly buy. `cost`: cheaper calls.
+   * `quality`: better or more consistent verdicts (a regex or heuristic that
+   * costs nothing today, so its `savingUsd` can be negative). `latency`:
+   * faster answers. Rank within a benefit, not across them.
+   */
+  benefit: typebox_exports.Union([typebox_exports.Literal("cost"), typebox_exports.Literal("quality"), typebox_exports.Literal("latency")]),
+  /** The inputs of the projected saving. The saving itself is computed here. */
+  projected: typebox_exports.Object({
+    volume: typebox_exports.Number({ minimum: 0, maximum: 1e12 }),
+    /** What `volume` counts per, e.g. "day", "PR", "run". */
+    per: Text,
+    currentCostPerItemUsd: Usd,
+    decisionCostPerItemUsd: Usd,
+    /** Where the figures came from. */
+    note: typebox_exports.Optional(typebox_exports.String())
+  }, CLOSED2),
+  risk: typebox_exports.Object({
+    level: typebox_exports.Union([typebox_exports.Literal("low"), typebox_exports.Literal("medium"), typebox_exports.Literal("high")]),
+    /** What would go wrong if the replacement erred. */
+    note: Text
+  }, CLOSED2),
+  /** The next step, e.g. "save the spec with design, then adopt". */
+  next: Text,
+  /** Defaults to `new`. `rejected` needs a `statusReason`. */
+  status: typebox_exports.Optional(Status),
+  statusReason: typebox_exports.Optional(Text),
+  /** Which sweep produced it, and whether its screening answers were live or replayed. */
+  source: typebox_exports.Object({
+    sweep: Text,
+    answers: typebox_exports.Union([typebox_exports.Literal("live"), typebox_exports.Literal("replay")])
+  }, CLOSED2)
+};
+var CandidateSchema = typebox_exports.Object(candidateFields, CLOSED2);
+var OpportunitySchema = typebox_exports.Object({
+  id: typebox_exports.String({ pattern: "^op-[0-9a-f]{12}$" }),
+  ...candidateFields,
+  status: Status,
+  projected: typebox_exports.Object({
+    ...candidateFields.projected.properties,
+    basis: typebox_exports.Literal("projected"),
+    /** volume × (current − decision), per `per`. Negative means it would cost more. */
+    savingUsd: typebox_exports.Number()
+  }, CLOSED2),
+  firstSeenAt: typebox_exports.String(),
+  seenAt: typebox_exports.String()
+}, CLOSED2);
+var BacklogSchema = typebox_exports.Object({
+  version: typebox_exports.Literal(BACKLOG_FORMAT),
+  opportunities: typebox_exports.Array(OpportunitySchema)
+}, CLOSED2);
+function backlogPath(repoRoot) {
+  return join3(stateDir(repoRoot), "opportunities.json");
+}
+function opportunityId(mode, evidence) {
+  const normal = evidence.replace(/\s+/g, " ").trim();
+  return `op-${createHash("sha256").update(`${mode}
+${normal}`).digest("hex").slice(0, 12)}`;
+}
+function projectedSaving(p) {
+  return round(p.volume * (p.currentCostPerItemUsd - p.decisionCostPerItemUsd));
+}
+function backlogProblems(value) {
+  const problems = [...value_exports.Errors(BacklogSchema, value)].map((e) => `${e.instancePath || "/"} ${e.message}`);
+  if (problems.length)
+    return problems;
+  const backlog = value;
+  const seen = /* @__PURE__ */ new Set();
+  backlog.opportunities.forEach((o, i) => {
+    if (seen.has(o.id))
+      problems.push(`/opportunities/${i}/id ${o.id} appears twice`);
+    seen.add(o.id);
+    if (o.id !== opportunityId(o.mode, o.evidence)) {
+      problems.push(`/opportunities/${i}/id does not match its mode and evidence`);
+    }
+    if (o.projected.savingUsd !== projectedSaving(o.projected)) {
+      problems.push(`/opportunities/${i}/projected/savingUsd does not match its inputs`);
+    }
+    problems.push(...candidateProblems(o, `/opportunities/${i}`));
+  });
+  return problems;
+}
+function candidateProblems(c, at) {
+  const problems = [];
+  if (c.status === "rejected" && !c.statusReason) {
+    problems.push(`${at}/statusReason is required when status is rejected`);
+  }
+  if (!Number.isFinite(projectedSaving(c.projected))) {
+    problems.push(`${at}/projected gives a saving that isn't a finite number`);
+  }
+  if (c.location.lines && c.location.lines.end < c.location.lines.start) {
+    problems.push(`${at}/location/lines end is before start`);
+  }
+  try {
+    assertQuestionSet(c.questions);
+  } catch (error) {
+    problems.push(`${at}/questions ${error.message}`);
+  }
+  return problems;
+}
+function readBacklog(file) {
+  if (!existsSync5(file))
+    return { version: BACKLOG_FORMAT, opportunities: [] };
+  let text;
+  try {
+    text = readFileSync5(file, "utf8");
+  } catch (error) {
+    throw malformed2(file, [`cannot read it: ${error.message}`]);
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    throw malformed2(file, [`not JSON: ${error.message}`]);
+  }
+  const problems = backlogProblems(value);
+  if (problems.length)
+    throw malformed2(file, problems);
+  return value;
+}
+function malformed2(file, problems) {
+  return new DecisionsError("invalid-request", `${file} is not a valid backlog (it was left as it is):
+  ${problems.join("\n  ")}`, { file, problems });
+}
+var LOCK_WAIT_MS = 5e3;
+var LOCK_STALE_MS = 3e4;
+function withBacklogLock(file, body) {
+  mkdirSync2(dirname4(file), { recursive: true });
+  const lock = `${file}.lock`;
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  for (; ; ) {
+    try {
+      closeSync(openSync(lock, "wx"));
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      try {
+        if (Date.now() - statSync4(lock).mtimeMs > LOCK_STALE_MS)
+          rmSync(lock, { force: true });
+      } catch {
+      }
+      if (Date.now() > deadline) {
+        throw new DecisionsError("invalid-request", `${file} is locked by another \`decide opportunities add\` (${lock}). Retry, or delete the lock file if no add is running.`, { file, lock });
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+  try {
+    return body();
+  } finally {
+    rmSync(lock, { force: true });
+  }
+}
+function writeBacklog(file, backlog) {
+  mkdirSync2(dirname4(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(backlog, null, 2)}
+`);
+  renameSync(tmp, file);
+}
+function mergeCandidates(backlog, candidates, now) {
+  const problems = candidates.flatMap((c, i) => candidateProblems(c, `/candidates/${i}`));
+  if (problems.length) {
+    throw new DecisionsError("invalid-request", `Invalid candidates:
+  ${problems.join("\n  ")}`, {
+      problems
+    });
+  }
+  const byId = new Map(backlog.opportunities.map((o) => [o.id, o]));
+  const existed = new Set(byId.keys());
+  const seen = /* @__PURE__ */ new Set();
+  for (const { statusReason: reason, ...c } of candidates) {
+    const id = opportunityId(c.mode, c.evidence);
+    seen.add(id);
+    const before = byId.get(id);
+    const statusReason = reason ?? (c.status ? void 0 : before?.statusReason);
+    byId.set(id, {
+      id,
+      ...c,
+      // Seeing the evidence again disproves "stale"; any other status stands.
+      status: c.status ?? (before?.status === "stale" ? "new" : before?.status) ?? "new",
+      ...statusReason ? { statusReason } : {},
+      projected: { ...c.projected, basis: "projected", savingUsd: projectedSaving(c.projected) },
+      firstSeenAt: before?.firstSeenAt ?? now,
+      seenAt: now
+    });
+  }
+  const added = [...seen].filter((id) => !existed.has(id));
+  const updated = [...seen].filter((id) => existed.has(id));
+  const key = (o) => `${o.mode}
+${o.location.path}
+${o.source.sweep}`;
+  const covered = new Set(candidates.map(key));
+  const staled = [];
+  for (const o of byId.values()) {
+    if (o.status === "new" && !seen.has(o.id) && covered.has(key(o))) {
+      byId.set(o.id, { ...o, status: "stale" });
+      staled.push(o.id);
+    }
+  }
+  return {
+    backlog: { version: BACKLOG_FORMAT, opportunities: [...byId.values()] },
+    added,
+    updated,
+    staled
+  };
+}
+var FIELDS = {
+  id: {},
+  mode: {},
+  benefit: {},
+  status: {},
+  statusReason: {},
+  shape: {},
+  mechanism: {},
+  evidence: {},
+  next: {},
+  firstSeenAt: {},
+  seenAt: {},
+  risk: { default: "level", subs: ["level", "note"] },
+  projected: {
+    default: "savingUsd",
+    subs: [
+      "savingUsd",
+      "volume",
+      "per",
+      "currentCostPerItemUsd",
+      "decisionCostPerItemUsd",
+      "basis",
+      "note"
+    ]
+  },
+  location: { default: "path", subs: ["path", "lines.start", "lines.end"] },
+  source: { default: "sweep", subs: ["sweep", "answers"] }
+};
+var ENTRY_FIELDS = [...Object.keys(OpportunitySchema.properties)];
+function parseRecordFilter(text) {
+  const t = tokenizeFilter(text);
+  if (!t) {
+    throw new DecisionsError("invalid-request", `Cannot parse --keep "${text}". Use <field>[.<sub>]<op><value>, e.g. status=new or projected>=0.01`);
+  }
+  const field = recordField(t.name, t.path, text);
+  if ((t.op === ">" || t.op === ">=" || t.op === "<" || t.op === "<=") && typeof t.value !== "number") {
+    throw new DecisionsError("invalid-request", `--keep "${text}": ${t.op} needs a number`);
+  }
+  return { field, op: t.op, value: t.value, source: text };
+}
+function parseRecordSort(text) {
+  const t = tokenizeSort(text);
+  if (!t) {
+    throw new DecisionsError("invalid-request", `Cannot parse --sort "${text}". Use <field>[.<sub>][:asc|desc]`);
+  }
+  return { field: recordField(t.name, t.path, text), direction: t.direction };
+}
+function recordField(name, path, text) {
+  const spec = Object.hasOwn(FIELDS, name) ? FIELDS[name] : void 0;
+  if (!spec) {
+    throw new DecisionsError("invalid-request", `"${text}": no field "${name}". Fields: ${Object.keys(FIELDS).join(", ")}`);
+  }
+  if (path && !spec.subs?.includes(path)) {
+    throw new DecisionsError("invalid-request", spec.subs ? `"${text}": ${name} has no "${path}". Use one of: ${spec.subs.join(", ")}` : `"${text}": ${name} has no sub-fields`);
+  }
+  const sub = path || spec.default;
+  return sub ? `${name}.${sub}` : name;
+}
+function readField(o, field) {
+  let value = o;
+  for (const key of field.split(".")) {
+    if (value === null || typeof value !== "object")
+      return void 0;
+    value = value[key];
+  }
+  return value;
+}
+function recordMatches(o, f) {
+  const actual = readField(o, f.field);
+  switch (f.op) {
+    case "in":
+      return f.value.includes(String(actual));
+    case "=":
+      return String(actual) === String(f.value);
+    case "!=":
+      return String(actual) !== String(f.value);
+    default: {
+      if (typeof actual !== "number")
+        return false;
+      const v = f.value;
+      return f.op === ">=" ? actual >= v : f.op === ">" ? actual > v : f.op === "<=" ? actual <= v : actual < v;
+    }
+  }
+}
+function round(n) {
+  return Math.round(n * 1e9) / 1e9;
+}
+
 // ../core/dist/tools/schemas.js
 var Source = typebox_exports.Union([
   typebox_exports.Object({
@@ -19750,26 +20185,6 @@ var Source = typebox_exports.Union([
     paths: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String()))
   })
 ]);
-var Question = typebox_exports.Union([
-  typebox_exports.Object({
-    type: typebox_exports.Literal("noul"),
-    instructions: typebox_exports.String({ minLength: 1 }),
-    /** Optional `true`/`false` criteria that sharpen an ambiguous statement. */
-    criteria: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), typebox_exports.String()))
-  }, { additionalProperties: false }),
-  typebox_exports.Object({
-    type: typebox_exports.Literal("choice"),
-    instructions: typebox_exports.String({ minLength: 1 }),
-    /** Option key to when it applies. At least two, including a way out. */
-    criteria: typebox_exports.Record(typebox_exports.String(), typebox_exports.String(), { minProperties: 2 })
-  }, { additionalProperties: false }),
-  typebox_exports.Object({
-    type: typebox_exports.Literal("score"),
-    instructions: typebox_exports.String({ minLength: 1 }),
-    /** Levels, lowest first and 0-indexed. */
-    criteria: typebox_exports.Array(typebox_exports.String(), { minItems: 2 })
-  }, { additionalProperties: false })
-]);
 var Mode = typebox_exports.Union([
   typebox_exports.Literal("auto"),
   typebox_exports.Literal("live"),
@@ -19780,13 +20195,20 @@ var Common = {
   /** A saved spec: name (repo → user → bundled) or path. */
   spec: typebox_exports.Optional(typebox_exports.String()),
   /** An inline question set; mutually exclusive with `spec`. */
-  questions: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), Question)),
+  questions: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), QuestionSchema)),
   /** Where the content comes from. Defaults to the spec's `source`. */
   sources: typebox_exports.Optional(typebox_exports.Array(Source)),
+  /**
+   * Leave out paths matching these globs (repo-relative, like `glob`). A per-call
+   * choice, reported as `filtered`; egress excludes still apply on top.
+   */
+  exclude: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String({ minLength: 1 }))),
   /** `file` | `hunk` | `row` | `lines:N[/overlap]`. */
   split: typebox_exports.Optional(typebox_exports.String()),
   /** Filters, ANDed: `relevant>=0.7`, `kind in fix,feature`. */
   keep: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
+  /** Kept when any of these matches (and every `keep` does): `a>=0.3`, `b>=0.3`. */
+  keepAny: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
   mode: typebox_exports.Optional(Mode),
   model: typebox_exports.Optional(typebox_exports.String()),
   /**
@@ -19824,6 +20246,24 @@ var SpecCheckInput = typebox_exports.Object({
   /** Proceed past the spend guard. */
   confirm: typebox_exports.Optional(typebox_exports.Boolean())
 }, strict);
+var SpecLintInput = typebox_exports.Object({
+  /** Spec name (repo → user → bundled) or path. Omitted: every spec in reach. */
+  spec: typebox_exports.Optional(typebox_exports.String({ minLength: 1 }))
+}, strict);
+var OpportunitiesAddInput = typebox_exports.Object({
+  /** Candidates to merge into `.system1/opportunities.json`. */
+  candidates: typebox_exports.Array(CandidateSchema, { minItems: 1 })
+}, strict);
+var OpportunitiesListInput = typebox_exports.Object({
+  /** Record filters, ANDed: `status=new`, `risk in medium,high`, `projected>=0.01`. */
+  keep: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
+  /** `projected:desc` (the default), `seenAt:asc`, … */
+  sort: typebox_exports.Optional(typebox_exports.String()),
+  limit: typebox_exports.Optional(typebox_exports.Integer({ minimum: 0 })),
+  /** Top-level fields to include per entry; `id` always is. */
+  fields: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String()))
+}, strict);
+var OpportunitiesCheckInput = typebox_exports.Object({}, strict);
 var RouteInput = typebox_exports.Object({
   /** The user's prompt, as the harness hook received it. */
   prompt: typebox_exports.String()
@@ -19833,11 +20273,15 @@ var TOOL_SCHEMAS = {
   many: ManyInput,
   usage: UsageInput,
   "spec-check": SpecCheckInput,
+  "spec-lint": SpecLintInput,
+  "opportunities-add": OpportunitiesAddInput,
+  "opportunities-list": OpportunitiesListInput,
+  "opportunities-check": OpportunitiesCheckInput,
   route: RouteInput
 };
 
 // ../core/dist/tools/context.js
-import { isAbsolute as isAbsolute4, join as join4, relative as relative4 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join5, relative as relative4 } from "node:path";
 
 // ../core/dist/egress/scrub.js
 var SECRET_NAME = "[A-Za-z0-9_.-]*(?:api[_-]?key|secret|token|passw(?:or)?d|pwd|credential|private[_-]?key|auth)[A-Za-z0-9_.-]*";
@@ -19857,6 +20301,13 @@ var RULES = [
   { kind: "slack-token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
   { kind: "stripe-key", pattern: /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
   { kind: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  // Service tokens with a known prefix and separator, whatever they are
+  // assigned to (MCP server env blocks name them freely: NOTION_INTEGRATION,
+  // HONEYCOMB_WRITEKEY).
+  {
+    kind: "service-token",
+    pattern: /\b(?:secret_|ntn_|glpat-|npm_|pypi-|shpat_|shpss_|dop_v1_|hcaik_|hcxik_|sntrys_|lin_api_|figd_|xapp-)[A-Za-z0-9_]{20,}\b/g
+  },
   { kind: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
   { kind: "url-credentials", pattern: /(?<=\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]{3,}(?=@)/gi },
   // NAME = "literal": a quoted value of 8+ chars assigned to a secret-sounding name.
@@ -19870,6 +20321,15 @@ var RULES = [
   {
     kind: "assigned-secret",
     pattern: new RegExp(`(?<=\\b${SECRET_NAME}\\s*[:=]\\s*)(?!\\$\\{|<|\\[REDACTED)(?=[A-Za-z_\\-+/=~]*\\d)[A-Za-z0-9_\\-+/=~]{8,}(?![\\w(.])`, "gi")
+  },
+  // ENV_NAME: "value" in upper-case environment style, ending in a credential
+  // word (API_WRITEKEY, SERVICE_PAT). Case-sensitive, and the value must look
+  // like a credential (12+ characters, letters and digits, no dots or colons),
+  // so UI constants (`PROBE_KEY = "pulse:probe"`) and code are left alone.
+  // Last, so a value an earlier rule already caught keeps that rule's name.
+  {
+    kind: "env-secret",
+    pattern: /(?<=\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PAT|CREDENTIALS?)["']?\s*[:=]\s*["']?)(?!\$\{|<|\[REDACTED)(?=[A-Za-z0-9_\-+/=~]*\d)(?=[A-Za-z0-9_\-+/=~]*[A-Za-z])[A-Za-z0-9_\-+/=~]{12,}(?=["'\s,}]|$)/gm
   }
 ];
 function scrubText(text, counts2 = {}) {
@@ -19927,13 +20387,13 @@ function assertStateFits(id, state, questions, profile) {
 }
 
 // ../core/dist/fixtures/store.js
-import { createHash } from "node:crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join3 } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5, join as join4 } from "node:path";
 var FIXTURE_VERSION = 1;
 function fixtureKey(request) {
   const { model, state, questions } = request;
-  return createHash("sha256").update(canonicalJson({ model, state, questions })).digest("hex");
+  return createHash2("sha256").update(canonicalJson({ model, state, questions })).digest("hex");
 }
 function canonicalJson(value) {
   return JSON.stringify(sortKeys(value));
@@ -19956,13 +20416,13 @@ var FixtureStore = class {
     if (!NAMESPACE.test(namespace)) {
       throw new Error(`Invalid fixture namespace "${namespace}" (lowercase letters, digits, . _ -)`);
     }
-    return join3(this.dir, namespace, `${key}.json`);
+    return join4(this.dir, namespace, `${key}.json`);
   }
   lookup(namespace, request) {
     const file = this.path(namespace, fixtureKey(request));
-    if (!existsSync5(file))
+    if (!existsSync6(file))
       return void 0;
-    const record = JSON.parse(readFileSync5(file, "utf8"));
+    const record = JSON.parse(readFileSync6(file, "utf8"));
     return record.v === FIXTURE_VERSION ? record : void 0;
   }
   record(namespace, request, response, now = /* @__PURE__ */ new Date()) {
@@ -19975,11 +20435,11 @@ var FixtureStore = class {
       response
     };
     const file = this.path(namespace, key);
-    mkdirSync2(dirname4(file), { recursive: true });
+    mkdirSync3(dirname5(file), { recursive: true });
     const temp = `${file}.${process.pid}.tmp`;
-    writeFileSync2(temp, `${JSON.stringify(record, null, 2)}
+    writeFileSync3(temp, `${JSON.stringify(record, null, 2)}
 `);
-    renameSync(temp, file);
+    renameSync2(temp, file);
     return record;
   }
 };
@@ -20057,8 +20517,8 @@ function createDecider(options) {
 }
 
 // ../core/dist/run/spend.js
-import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
 function sumUsage(usages) {
   const total = usages.reduce((sum, u) => ({
     input_tokens: sum.input_tokens + (u?.input_tokens ?? 0),
@@ -20072,15 +20532,15 @@ var SpendLedger = class {
   constructor(file) {
     this.file = file;
   }
-  append(entry) {
-    mkdirSync3(dirname5(this.file), { recursive: true });
-    appendFileSync(this.file, `${JSON.stringify(entry)}
+  append(entry2) {
+    mkdirSync4(dirname6(this.file), { recursive: true });
+    appendFileSync(this.file, `${JSON.stringify(entry2)}
 `);
   }
   entries() {
-    if (!existsSync6(this.file))
+    if (!existsSync7(this.file))
       return [];
-    return readFileSync6(this.file, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+    return readFileSync7(this.file, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
       try {
         return [JSON.parse(line)];
       } catch {
@@ -20145,15 +20605,33 @@ function resolveRequest(ctx, input) {
     sources,
     split: parseSplit(input.split ?? spec?.source?.split ?? "file"),
     keep: keepText.map((k) => parseFilter(k, questions)),
+    keepAny: (input.keepAny ?? spec?.keepAny ?? []).map((k) => parseFilter(k, questions)),
     ...sortText ? { sort: parseSort(sortText, questions) } : {},
-    profile
+    profile,
+    exclude: (input.exclude ?? []).map((p) => rebasePattern(p, ctx.cwd, ctx.config.repoRoot))
   };
 }
+function rebasePattern(pattern, cwd, repoRoot) {
+  if (pattern.startsWith("!")) {
+    throw new DecisionsError("invalid-request", `--exclude "${pattern}": negation isn't supported; name what to leave out`);
+  }
+  if (isAbsolute4(pattern)) {
+    const rel = relative4(repoRoot, pattern);
+    if (rel.startsWith("..") || isAbsolute4(rel)) {
+      throw new DecisionsError("invalid-request", `--exclude "${pattern}" is outside the repo (${repoRoot}), so it would match nothing`);
+    }
+    return rel;
+  }
+  const prefix = relative4(repoRoot, cwd);
+  if (prefix === "" || prefix.startsWith("..") || isAbsolute4(prefix) || pattern.startsWith("**/"))
+    return pattern;
+  return join5(prefix, pattern);
+}
 function rebase(source, cwd, repoRoot) {
   const prefix = relative4(repoRoot, cwd);
   if (prefix === "" || prefix.startsWith("..") || isAbsolute4(prefix))
     return source;
-  const move = (path) => isAbsolute4(path) ? path : join4(prefix, path);
+  const move = (path) => isAbsolute4(path) ? path : join5(prefix, path);
   switch (source.kind) {
     case "file":
       return { ...source, path: move(source.path) };
@@ -20193,14 +20671,14 @@ function deciderFor(ctx, profile, mode = "auto") {
         ...ctx.fetch ? { fetch: ctx.fetch } : {}
       })
     } : {},
-    fixtures: new FixtureStore(join4(dir, "fixtures")),
-    ledger: new SpendLedger(join4(dir, "usage.jsonl")),
+    fixtures: new FixtureStore(join5(dir, "fixtures")),
+    ledger: new SpendLedger(join5(dir, "usage.jsonl")),
     mode: config.replay ? "replay" : mode,
     ...config.session ? { session: config.session } : {}
   });
 }
 function ledgerFor(ctx) {
-  return new SpendLedger(join4(stateDir(ctx.config.repoRoot), "usage.jsonl"));
+  return new SpendLedger(join5(stateDir(ctx.config.repoRoot), "usage.jsonl"));
 }
 
 // ../core/dist/run/budget.js
@@ -20245,7 +20723,8 @@ async function prepare(input) {
   const read2 = await readSources(input.sources, {
     cwd: input.cwd,
     ...input.maxFileBytes ? { maxFileBytes: input.maxFileBytes } : {},
-    ...input.allowOutside ? { allowOutside: true } : {}
+    ...input.allowOutside ? { allowOutside: true } : {},
+    ...input.filter?.length ? { filter: input.filter, withhold: input.exclude ?? [] } : {}
   });
   const byKind = {};
   let redactedSources = 0;
@@ -20256,7 +20735,8 @@ async function prepare(input) {
     return found2;
   };
   const allowed = applyExcludes(read2.documents, input.exclude);
-  const documents = allowed.items.map((doc) => {
+  const chosen = applyFilter(allowed.items, input.filter);
+  const documents = chosen.items.map((doc) => {
     const counts2 = {};
     const scrubbed = {
       ...doc,
@@ -20270,17 +20750,36 @@ async function prepare(input) {
   const filtered = applyExcludes(split(documents, input.split), input.exclude);
   const kept = input.split.kind === "join" ? joinItems(filtered.items) : filtered.items;
   const tokens = [];
-  const items = kept.map((item) => {
+  const oversize = [];
+  const items = kept.flatMap((item) => {
     const counts2 = {};
     const state = scrubState(item.state, counts2);
     if (count(counts2) > 0)
       redactedSources += 1;
-    tokens.push(assertStateFits(item.id, state, input.questions, input.profile));
-    return { ...item, state };
+    try {
+      tokens.push(assertStateFits(item.id, state, input.questions, input.profile));
+    } catch (error) {
+      if (input.oversize !== "skip" || !isDecisionsError(error))
+        throw error;
+      const estimated = error.details.estimatedTokens;
+      oversize.push({
+        path: item.path ?? item.id,
+        reason: "too-large",
+        detail: `about ${estimated} tokens with its questions (limit ${input.profile.maxStateTokens}); re-run it with --split lines:400/40`
+      });
+      return [];
+    }
+    return [{ ...item, state }];
   });
   return {
     items,
-    skipped: [...read2.skipped, ...allowed.excluded, ...filtered.excluded],
+    skipped: unique([
+      ...read2.skipped,
+      ...allowed.excluded,
+      ...chosen.filtered,
+      ...filtered.excluded,
+      ...oversize
+    ]),
     redactions: {
       total: Object.values(byKind).reduce((a, b) => a + b, 0),
       byKind,
@@ -20299,6 +20798,16 @@ function assertChoicesFit(questions, profile) {
     }
   }
 }
+function unique(skipped) {
+  const seen = /* @__PURE__ */ new Set();
+  return skipped.filter((s) => {
+    const key = `${s.path}\0${s.reason}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
 
 // ../core/dist/run/pool.js
 async function mapWithConcurrency(items, limit, worker, onProgress) {
@@ -20339,6 +20848,8 @@ async function runMany(ctx, rawInput) {
     profile: req.profile,
     cwd: ctx.config.repoRoot,
     exclude: ctx.config.egress.exclude,
+    filter: req.exclude,
+    oversize: "skip",
     ...input.allowOutside ? { allowOutside: true } : {}
   });
   const base2 = {
@@ -20390,6 +20901,7 @@ async function runMany(ctx, rawInput) {
   const projected = project({
     rows,
     keep: req.keep,
+    keepAny: req.keepAny,
     ...req.sort ? { sort: req.sort } : {},
     ...input.limit !== void 0 ? { limit: input.limit } : {},
     ...input.fields ? { fields: input.fields } : {},
@@ -20455,11 +20967,14 @@ async function runAsk(ctx, rawInput) {
     profile: req.profile,
     cwd: ctx.config.repoRoot,
     exclude: ctx.config.egress.exclude,
+    filter: req.exclude,
     ...input.allowOutside ? { allowOutside: true } : {}
   });
   const [item, ...rest] = prepared.items;
   if (!item || rest.length > 0) {
-    const withheld = prepared.skipped.length ? ` (${prepared.skipped.length} withheld: ${prepared.skipped.map((s) => `${s.path} ${s.reason}`).join(", ")})` : "";
+    const held = prepared.skipped.filter((s) => s.reason !== "filtered");
+    const left = prepared.skipped.length - held.length;
+    const withheld = (held.length ? ` (${held.length} withheld: ${held.map((s) => `${s.path} ${s.reason}`).join(", ")})` : "") + (left ? ` (${left} left out by --exclude)` : "");
     throw new DecisionsError("invalid-request", item ? `ask needs exactly one state, but the source gave ${prepared.items.length}. Use \`decide many\` to fan out.` : `The source gave nothing to ask about${withheld}.`, { items: prepared.items.length });
   }
   const result = await deciderFor(ctx, req.profile, input.mode ?? "auto").decide({
@@ -20467,11 +20982,7 @@ async function runAsk(ctx, rawInput) {
     questions: req.questions,
     namespace: req.namespace
   });
-  let verdict;
-  if (req.keep.length > 0) {
-    const referenced = new Set(req.keep.map((f) => f.question));
-    verdict = result.undecided.some((q) => referenced.has(q)) ? "undecided" : req.keep.every((f) => matches(result.answers, f)) ? "kept" : "dropped";
-  }
+  const verdict = req.keep.length > 0 || req.keepAny.length > 0 ? verdictOf(result.answers, result.undecided, req.keep, req.keepAny).verdict : void 0;
   return {
     ...req.spec ? { spec: req.spec.name } : {},
     id: item.id,
@@ -20491,8 +21002,8 @@ async function runAsk(ctx, rawInput) {
 }
 
 // ../core/dist/tools/doctor.js
-import { accessSync, constants, statSync as statSync4 } from "node:fs";
-import { delimiter, join as join5 } from "node:path";
+import { accessSync, constants, existsSync as existsSync8, statSync as statSync5 } from "node:fs";
+import { delimiter, join as join6 } from "node:path";
 function routeCheck(config) {
   try {
     route("", config);
@@ -20518,6 +21029,32 @@ function routeCheck(config) {
     };
   }
 }
+function backlogProblem(error) {
+  const problems = isDecisionsError(error) ? error.details?.problems : void 0;
+  const first = Array.isArray(problems) ? problems[0] : void 0;
+  const count = Array.isArray(problems) && problems.length > 1 ? ` (+${problems.length - 1} more)` : "";
+  return `the backlog doesn't validate: ${first ?? (error instanceof Error ? error.message : String(error))}${count}`;
+}
+function backlogCheck(repoRoot) {
+  const file = backlogPath(repoRoot);
+  if (!existsSync8(file))
+    return { name: "backlog", status: "ok", detail: "no scout backlog yet" };
+  try {
+    const { opportunities } = readBacklog(file);
+    return {
+      name: "backlog",
+      status: "ok",
+      detail: `${opportunities.length} opportunit${opportunities.length === 1 ? "y" : "ies"} in ${file}`
+    };
+  } catch (error) {
+    return {
+      name: "backlog",
+      status: "warn",
+      detail: backlogProblem(error),
+      fix: "`decide opportunities check` lists every problem; correct the file by hand or move it aside (decide never repairs it)"
+    };
+  }
+}
 var CODEX_RULE = 'prefix_rule(pattern = ["decide"], decision = "allow")';
 async function runDoctor(options) {
   const { env } = options;
@@ -20564,12 +21101,23 @@ async function runDoctor(options) {
       fix: "correct or remove these keys (docs/configuration.md lists every key)"
     });
   }
-  checks.push(config.apiKey ? { name: "key", status: "ok", detail: `OPENROUTER_API_KEY present (${config.apiKeySource})` } : {
+  const credentials = join6(userConfigDir(env, options.home), "credentials");
+  checks.push(config.apiKey && config.apiKeyQuoted ? {
+    name: "key",
+    status: "warn",
+    detail: `OPENROUTER_API_KEY present (${config.apiKeySource}), but wrapped in quotes; they were removed`,
+    fix: config.apiKeySource === "env" ? "set OPENROUTER_API_KEY without the surrounding quotes" : `remove the extra quotes around openrouter_api_key in ${credentials}`,
+    advisory: true
+  } : config.apiKey ? {
+    name: "key",
+    status: "ok",
+    detail: `OPENROUTER_API_KEY present (${config.apiKeySource})`
+  } : {
     name: "key",
     status: "warn",
     detail: "no API key: only replay works",
     // The file this shell would read: XDG_CONFIG_HOME moves it.
-    fix: `set OPENROUTER_API_KEY, or write \`openrouter_api_key: <key>\` to ${join5(userConfigDir(env, options.home), "credentials")} (create its directory first; chmod 600)`
+    fix: `set OPENROUTER_API_KEY, or write \`openrouter_api_key: <key>\` to ${credentials} (create its directory first; chmod 600)`
   });
   checks.push(config.egress.consent.granted ? { name: "consent", status: "ok", detail: `egress consent granted for ${config.repoRoot}` } : {
     name: "consent",
@@ -20578,6 +21126,7 @@ async function runDoctor(options) {
     fix: "if the user agrees, they grant it themselves (an agent must not): `decide config egress allow` in a terminal in this repo, or through their agent prompt's shell escape (not as a chat message) with --confirm added"
   });
   checks.push(routeCheck(config.route));
+  checks.push(backlogCheck(config.repoRoot));
   let reach;
   try {
     reach = await ping({
@@ -20622,8 +21171,8 @@ function pathCheck(harness, env) {
     return {
       name: "path",
       status: "warn",
-      detail: "decide is not on PATH, so the decisions plugin's bin/ is not loaded",
-      fix: "install the decisions plugin from its marketplace, or start Claude Code with `--plugin-dir <checkout>/plugins/system1`"
+      detail: "decide is not on PATH, so the System 1 plugin's bin/ is not loaded",
+      fix: `npm i -g ${CLI_PACKAGE}@${VERSION} (also puts decide in your own terminal), or install the System 1 plugin from its marketplace`
     };
   }
   return {
@@ -20687,10 +21236,10 @@ function which(name, path) {
   for (const dir of path.split(delimiter)) {
     if (!dir)
       continue;
-    const candidate = join5(dir, name);
+    const candidate = join6(dir, name);
     try {
       accessSync(candidate, constants.X_OK);
-      if (statSync4(candidate).isFile())
+      if (statSync5(candidate).isFile())
         return candidate;
     } catch {
     }
@@ -20698,6 +21247,72 @@ function which(name, path) {
   return void 0;
 }
 
+// ../core/dist/tools/opportunities.js
+import { existsSync as existsSync9 } from "node:fs";
+function runOpportunitiesAdd(ctx, rawInput, now = () => /* @__PURE__ */ new Date()) {
+  const input = checkInput("opportunities-add", rawInput);
+  const file = backlogPath(ctx.config.repoRoot);
+  const merged2 = withBacklogLock(file, () => {
+    const result = mergeCandidates(readBacklog(file), input.candidates, now().toISOString());
+    writeBacklog(file, result.backlog);
+    return result;
+  });
+  return {
+    file,
+    added: merged2.added,
+    updated: merged2.updated,
+    staled: merged2.staled,
+    total: merged2.backlog.opportunities.length
+  };
+}
+function runOpportunitiesList(ctx, rawInput = {}) {
+  const input = checkInput("opportunities-list", rawInput);
+  const filters = (input.keep ?? []).map(parseRecordFilter);
+  const sort = parseRecordSort(input.sort ?? "projected:desc");
+  assertFields(input.fields);
+  const file = backlogPath(ctx.config.repoRoot);
+  const { opportunities } = readBacklog(file);
+  const matched = opportunities.filter((o) => filters.every((f) => recordMatches(o, f))).sort((a, b) => compare(readField(a, sort.field), readField(b, sort.field), sort.direction));
+  const shown = input.limit === void 0 ? matched : matched.slice(0, input.limit);
+  return {
+    file,
+    total: opportunities.length,
+    matched: matched.length,
+    basis: "projected",
+    opportunities: shown.map((o) => pick2(o, input.fields))
+  };
+}
+function runOpportunitiesCheck(ctx, rawInput = {}) {
+  checkInput("opportunities-check", rawInput);
+  const file = backlogPath(ctx.config.repoRoot);
+  const backlog = readBacklog(file);
+  const byStatus = {};
+  for (const o of backlog.opportunities)
+    byStatus[o.status] = (byStatus[o.status] ?? 0) + 1;
+  return { file, exists: existsSync9(file), entries: backlog.opportunities.length, byStatus };
+}
+function compare(a, b, direction) {
+  if (a === void 0 || b === void 0)
+    return a === b ? 0 : a === void 0 ? 1 : -1;
+  const order = typeof a === "number" && typeof b === "number" ? a - b : String(a).localeCompare(String(b));
+  return direction === "asc" ? order : -order;
+}
+function pick2(o, fields) {
+  if (!fields)
+    return o;
+  const out = { id: o.id };
+  for (const f of fields)
+    if (Object.hasOwn(o, f))
+      out[f] = o[f];
+  return out;
+}
+function assertFields(fields = []) {
+  const unknown = fields.filter((f) => !ENTRY_FIELDS.includes(f));
+  if (unknown.length) {
+    throw new DecisionsError("invalid-request", `--fields: no field ${unknown.join(", ")}. Fields: ${ENTRY_FIELDS.join(", ")}`);
+  }
+}
+
 // ../core/dist/tools/route.js
 function runRoute(options, rawInput) {
   const problems = checkRouteInput(rawInput);
@@ -20725,10 +21340,132 @@ function checkRouteInput(input) {
   ];
 }
 
+// ../core/dist/spec/lint.js
+var LINT_SEVERITY = {
+  "no-way-out": "warning",
+  "abstract-levels": "warning",
+  "unsupported-task": "warning",
+  "merged-question": "warning",
+  "unjustified-threshold": "warning",
+  "unknown-threshold": "error"
+};
+var WAY_OUT_KEY = /^(none|other|others|unclear|unknown|neither|na|nomatch|unsure|mixed|else|nothing|irrelevant|unrelated)$/i;
+var WAY_OUT_TEXT = /\b(none of|any other|anything else|something else|neither|unclear|not (?:clear|sure|applicable|enough)|no match|does(?:n't| not) (?:fit|apply)|other than (?:these|the above))\b/i;
+var UNSUPPORTED = [
+  {
+    kind: "counting or arithmetic",
+    pattern: /(^\s*count\b|\bhow many\b|\bthe number of\b|\bcount (?:all|every|each|how|the number)\b|\b(?:more|fewer|less|greater|longer|shorter|larger|smaller|higher|lower) than \d|\b(?:over|under|above|below|at least|at most|exactly|up to) \d|\b\d+(?:\.\d+)?\s?(?:%|percent)|\bsum of\b|\btotal of\b|\baverage of\b|\bon average\b)/i
+  },
+  {
+    kind: "dates",
+    pattern: /(\b(?:older|newer|younger) than \d+ (?:days?|weeks?|months?|years?)\b|\b\d+ (?:days?|weeks?|months?|years?) (?:ago|old)\b|\b(?:within|in) the (?:last|past|next) \d+ (?:days?|weeks?|months?|years?)\b|\b(?:yesterday|tomorrow)\b|\b(?:this|last|next) (?:week|month|quarter|year)\b|\b(?:before|after|since|until|by) (?:monday|tuesday|wednesday|thursday|friday|saturday|sunday|january|february|march|april|may|june|july|august|september|october|november|december|(?:19|20)\d\d)\b|\b(?:has|is|was) (?:expired|overdue)\b)/i
+  },
+  {
+    kind: "images",
+    pattern: /(\bscreenshot|\bphoto(?:graph)?s?\b|\b(?:the|this|an?) (?:image|picture) (?:shows?|contains?|depicts?)\b|\b(?:visible|shown|appears?|seen) in (?:the|this|an?) (?:image|picture)\b)/i
+  },
+  {
+    kind: "an exact fact to read or run, not judge",
+    pattern: /(\b(?:all|every|the) tests? (?:pass(?:es|ed)?|fail(?:s|ed)?|succeed(?:s|ed)?)\b|\btests? (?:pass(?:es|ed)?|are (?:passing|green))\b|\b(?:the )?(?:build|ci|pipeline) (?:passes|passed|succeeds|succeeded|is green)\b|\b(?:it )?compiles without errors\b)/i
+  }
+];
+function lintQuestions(questions) {
+  const out = [];
+  for (const [name, q] of Object.entries(questions)) {
+    out.push(...lintQuestion(name, q));
+  }
+  return out;
+}
+function lintSpec(spec) {
+  const out = lintQuestions(spec.questions);
+  const thresholds = spec.policy?.thresholds ?? {};
+  for (const name of Object.keys(thresholds)) {
+    if (!(name in spec.questions)) {
+      out.push(finding("unknown-threshold", `policy.thresholds.${name} names no question in this spec`, `Rename it to one of: ${Object.keys(spec.questions).join(", ")}, or remove it.`));
+    }
+  }
+  const justified = new Set(Object.keys(thresholds));
+  const reported = /* @__PURE__ */ new Set();
+  const filters = [
+    ...(spec.keep ?? []).map((text) => ({ text, list: "keep" })),
+    ...(spec.keepAny ?? []).map((text) => ({ text, list: "keepAny" }))
+  ];
+  for (const { text, list } of filters) {
+    const { question, op } = parseFilter(text, spec.questions);
+    if (!NUMERIC.has(op))
+      continue;
+    if (justified.has(question) || reported.has(question))
+      continue;
+    reported.add(question);
+    out.push(finding("unjustified-threshold", `${list} "${text}" has no policy.thresholds.${question} saying why`, `Add policy.thresholds.${question}: {value, why}, with the cost of a wrong keep and a wrong drop (see thresholds.md).`, question));
+  }
+  return out;
+}
+var NUMERIC = /* @__PURE__ */ new Set([">=", ">", "<=", "<"]);
+function lintQuestion(name, q) {
+  const out = [];
+  if (q.type === "choice") {
+    const options = Object.entries(q.criteria);
+    const wayOut = ([key, desc]) => key.split(/[_\-\s/]+/).some((t) => WAY_OUT_KEY.test(t)) || WAY_OUT_TEXT.test(desc);
+    if (!options.some(wayOut)) {
+      out.push(finding("no-way-out", `choice "${name}" has no none/other/unclear option`, "Add an option such as `none: None of these apply`, so text that fits nothing isn't forced onto an option.", name));
+    }
+  }
+  if (q.type === "score" && q.criteria.every((level) => words(level) <= 2)) {
+    out.push(finding("abstract-levels", `score "${name}" has one- or two-word levels (${q.criteria.join(" | ")})`, "Describe each level as a concrete situation someone could spot in the text, lowest first.", name));
+  }
+  out.push(...unsupported([q.instructions, ...criteriaTexts(q).map(unquoted)].join("\n"), name));
+  if (merged(q.instructions)) {
+    out.push(finding("merged-question", `"${name}" looks like two questions in one`, "Split it into one question per idea and combine the answers with --keep.", name));
+  }
+  return dedupe(out);
+}
+function unsupported(text, question) {
+  return UNSUPPORTED.filter(({ pattern }) => pattern.test(text)).map(({ kind, pattern }) => finding("unsupported-task", `${question ? `"${question}" ` : ""}asks for ${kind} ("${pattern.exec(text)?.[0]}")`, "Do that part in code (grep, a date check, a count) and ask the model only about what's left.", question));
+}
+function merged(instructions) {
+  const claims = instructions.replace(/\bhttps?:\/\/\S+/gi, "URL").replace(/\b(e\.g|i\.e|etc|vs|cf|mr|mrs|ms|dr|st|no|approx)\./gi, "$1").split(/[.?!](?:\s+|$)/).map((s) => s.trim()).filter((s) => words(s) >= 3 && !FRAMING.test(s));
+  return claims.length > 1 || /\band\/or\b/i.test(instructions) || /\beither\b.+\bor\b/i.test(instructions);
+}
+var FRAMING = /^(consider|only|ignore|answer|note|treat|assume|look|focus|read|judge|use|do not|don't|exclude|include|given|for example|e\.g|if|when|here|this question|count only|disregard)\b/i;
+function unquoted(text) {
+  return text.replace(/"[^"\n]*"|“[^”\n]*”/g, '""');
+}
+function criteriaTexts(q) {
+  if (q.type === "noul")
+    return q.criteria ? Object.values(q.criteria) : [];
+  if (q.type === "choice")
+    return Object.values(q.criteria);
+  return q.criteria;
+}
+function words(text) {
+  return text.trim().split(/\s+/).filter(Boolean).length;
+}
+function finding(check, message, fix, question) {
+  return {
+    check,
+    severity: LINT_SEVERITY[check],
+    ...question ? { question } : {},
+    message,
+    fix
+  };
+}
+function dedupe(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((f) => {
+    const key = `${f.check}\0${f.question ?? ""}\0${f.message}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+
 // ../core/dist/tools/spec-check.js
 async function runSpecCheck(ctx, rawInput) {
   const input = checkInput("spec-check", rawInput);
   const spec = loadSpec(input.spec, ctx.specDirs, ctx.cwd);
+  const lint = lintSpec(spec);
   const examples = spec.examples ?? [];
   if (examples.length === 0) {
     throw new DecisionsError("invalid-request", `Spec "${spec.name}" has no examples to check. Add some under examples: (id, state or file, expect).`);
@@ -20826,7 +21563,8 @@ async function runSpecCheck(ctx, rawInput) {
     counts: counts2,
     examples: results,
     usage: sumUsage(usages),
-    skipped: summariseSkipped(prepared.flatMap((p) => p.prep?.skipped ?? []))
+    skipped: summariseSkipped(prepared.flatMap((p) => p.prep?.skipped ?? [])),
+    lint
   };
 }
 function judge(id, answers, flat, expect) {
@@ -20858,6 +21596,43 @@ function judge(id, answers, flat, expect) {
   };
 }
 
+// ../core/dist/tools/spec-lint.js
+import { basename as basename3, extname as extname2 } from "node:path";
+function runSpecLint(ctx, rawInput = {}) {
+  const input = checkInput("spec-lint", rawInput);
+  const specs = input.spec ? [named(ctx, input.spec)] : listSpecs(ctx.specDirs).filter((s) => !s.shadowed).map((s) => s.error ? { name: s.name, file: s.file, origin: s.origin, findings: [], invalid: s.error } : (
+    // Loaded by path, so keep the layer it was listed from.
+    { ...entry(loadSpec(s.file, ctx.specDirs, ctx.cwd)), origin: s.origin }
+  ));
+  const all = specs.flatMap((s) => s.findings);
+  const counts2 = {
+    specs: specs.length,
+    errors: all.filter((f) => f.severity === "error").length,
+    warnings: all.filter((f) => f.severity === "warning").length,
+    invalid: specs.filter((s) => s.invalid).length
+  };
+  return { specs, counts: counts2, passed: counts2.errors === 0 && counts2.invalid === 0 };
+}
+function named(ctx, ref) {
+  try {
+    return entry(loadSpec(ref, ctx.specDirs, ctx.cwd));
+  } catch (error) {
+    const file = isDecisionsError(error) ? error.details?.file : void 0;
+    if (typeof file !== "string")
+      throw error;
+    return {
+      name: basename3(file, extname2(file)),
+      file,
+      origin: "path",
+      findings: [],
+      invalid: error.message
+    };
+  }
+}
+function entry(spec) {
+  return { name: spec.name, file: spec.file, origin: spec.origin, findings: lintSpec(spec) };
+}
+
 // ../core/dist/tools/usage.js
 function runUsage(ctx, rawInput = {}) {
   const input = checkInput("usage", rawInput);
@@ -20890,10 +21665,17 @@ function resolveConnection(env = process.env) {
   return {
     endpoint: nonEmpty3(env.SYSTEM1_ENDPOINT) ?? DEFAULT_ENDPOINT,
     model: nonEmpty3(env.SYSTEM1_MODEL) ?? DEFAULT_MODEL,
-    apiKey: nonEmpty3(env.OPENROUTER_API_KEY),
+    apiKey: envKey(env),
     replay: /^(1|true|yes)$/i.test(env.SYSTEM1_REPLAY ?? "")
   };
 }
+function envKey(env) {
+  try {
+    return unquoteKey(env.OPENROUTER_API_KEY)?.value;
+  } catch {
+    return void 0;
+  }
+}
 function nonEmpty3(value) {
   return value === void 0 || value.trim() === "" ? void 0 : value.trim();
 }
@@ -20918,8 +21700,12 @@ export {
   runMany,
   runAsk,
   runDoctor,
+  runOpportunitiesAdd,
+  runOpportunitiesList,
+  runOpportunitiesCheck,
   runRoute,
   runSpecCheck,
+  runSpecLint,
   runUsage,
   resolveConnection
 };