@harness-engineering/cli 1.19.0 → 1.20.1

package/dist/{chunk-4KE55XRN.js → chunk-SQY4AAKP.js}

@@ -1,7 +1,7 @@
 import {
   detectEntropyDefinition,
   handleDetectEntropy
-} from "./chunk-ZR2C5FG2.js";
+} from "./chunk-4U4V7A6U.js";
 import {
   checkPerformanceDefinition,
   getCriticalPathsDefinition,
@@ -11,7 +11,7 @@ import {
   handleGetPerfBaselines,
   handleUpdatePerfBaselines,
   updatePerfBaselinesDefinition
-} from "./chunk-TCTYRFWX.js";
+} from "./chunk-PDEEQJHH.js";
 import {
   analyzeDiffDefinition,
   createSelfReviewDefinition,
@@ -19,15 +19,15 @@ import {
   handleCreateSelfReview,
   handleRequestPeerReview,
   requestPeerReviewDefinition
-} from "./chunk-DYY3YKA6.js";
+} from "./chunk-V73TEHIF.js";
 import {
   handleRunSecurityScan,
   runSecurityScanDefinition
-} from "./chunk-I2NEJO3P.js";
+} from "./chunk-LEWXD6PR.js";
 import {
   handleRunCodeReview,
   runCodeReviewDefinition
-} from "./chunk-WWXD6MAR.js";
+} from "./chunk-45ZJPG24.js";
 import {
   GENERATED_HEADER_CLAUDE,
   GENERATED_HEADER_CODEX,
@@ -40,25 +40,25 @@ import {
 import {
   handleValidateProject,
   validateToolDefinition
-} from "./chunk-DEMZ3JKK.js";
+} from "./chunk-LVJ7SCD7.js";
 import {
   loadGraphStore
 } from "./chunk-CZZXE6BL.js";
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-7WS7GIOW.js";
+} from "./chunk-A33LHIRD.js";
 import {
   resolveProjectConfig
 } from "./chunk-H7Y5CKTM.js";
 import {
   checkDocsDefinition,
   handleCheckDocs
-} from "./chunk-7KGLJ74A.js";
+} from "./chunk-H6KZAGHZ.js";
 import {
   TrackerConfigSchema,
   resolveConfig
-} from "./chunk-FUQDDES3.js";
+} from "./chunk-YDOGGQSF.js";
 import {
   resultToMcpResponse
 } from "./chunk-IDZNPTYD.js";
@@ -87,7 +87,7 @@ import {
   checkTaint,
   scanForInjection,
   writeTaint
-} from "./chunk-XULGZC2A.js";
+} from "./chunk-IC5CZSHF.js";
 import {
   Err,
   Ok
@@ -150,6 +150,7 @@ function isDestructiveOperation(toolName, toolInput, workspaceRoot) {
 function wrapWithInjectionGuard(toolName, handler, options = {}) {
   const projectRoot = options.projectRoot ?? process.cwd();
   const sessionId = options.sessionId ?? "default";
+  const trustedOutput = options.trustedOutputTools?.has(toolName) ?? false;
   return async (input) => {
     try {
       const taintCheck = checkTaint(projectRoot, sessionId);
@@ -181,29 +182,31 @@ function wrapWithInjectionGuard(toolName, handler, options = {}) {
         }
       }
       const result = await handler(input);
-      const outputText = extractResultText(result);
-      if (outputText) {
-        const outputFindings = scanForInjection(outputText);
-        const actionableOutput = outputFindings.filter(
-          (f) => f.severity === "high" || f.severity === "medium"
-        );
-        if (actionableOutput.length > 0) {
-          writeTaint(
-            projectRoot,
-            sessionId,
-            `Injection pattern detected in MCP:${toolName} result`,
-            actionableOutput,
-            `MCP:${toolName}:output`
-          );
-          const warningLines = actionableOutput.map(
-            (f) => `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output`
+      if (!trustedOutput) {
+        const outputText = extractResultText(result);
+        if (outputText) {
+          const outputFindings = scanForInjection(outputText);
+          const actionableOutput = outputFindings.filter(
+            (f) => f.severity === "high" || f.severity === "medium"
           );
-          result.content.push({
-            type: "text",
-            text: `
+          if (actionableOutput.length > 0) {
+            writeTaint(
+              projectRoot,
+              sessionId,
+              `Injection pattern detected in MCP:${toolName} result`,
+              actionableOutput,
+              `MCP:${toolName}:output`
+            );
+            const warningLines = actionableOutput.map(
+              (f) => `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output`
+            );
+            result.content.push({
+              type: "text",
+              text: `
 ---
 Sentinel Warning: ${warningLines.join("; ")}`
-          });
+            });
+          }
         }
       }
       return result;
@@ -554,7 +557,7 @@ ${skippedMsg}`
 async function handleInitProject(input) {
   const i = input;
   try {
-    const { TemplateEngine } = await import("./engine-R24ZLV44.js");
+    const { TemplateEngine } = await import("./engine-R5BZHIZB.js");
     const engine = new TemplateEngine(resolveTemplatesDir());
     const safePath = sanitizePath(i.path);
     const detected = tryDetectFramework(engine, safePath, i);
@@ -575,7 +578,7 @@ var listPersonasDefinition = {
   inputSchema: { type: "object", properties: {} }
 };
 async function handleListPersonas() {
-  const { listPersonas } = await import("./loader-NOLQCQGX.js");
+  const { listPersonas } = await import("./loader-2TBQUFWX.js");
   const result = listPersonas(resolvePersonasDir());
   return resultToMcpResponse(result);
 }
@@ -599,10 +602,10 @@ async function handleGeneratePersonaArtifacts(input) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.name)) {
     return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.name}`)));
   }
-  const { loadPersona } = await import("./loader-NOLQCQGX.js");
-  const { generateRuntime } = await import("./runtime-23OFHLCZ.js");
-  const { generateAgentsMd } = await import("./agents-md-DFY5W2DJ.js");
-  const { generateCIWorkflow } = await import("./ci-workflow-N2TJ7B7G.js");
+  const { loadPersona } = await import("./loader-2TBQUFWX.js");
+  const { generateRuntime } = await import("./runtime-BN7KGJAO.js");
+  const { generateAgentsMd } = await import("./agents-md-WHXVPOK2.js");
+  const { generateCIWorkflow } = await import("./ci-workflow-HWX5OVLI.js");
   const personasDir = resolvePersonasDir();
   const filePath = path3.join(personasDir, `${input.name}.yaml`);
   if (!filePath.startsWith(personasDir)) {
@@ -657,7 +660,7 @@ async function handleRunPersona(input) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(input.persona)) {
     return resultToMcpResponse(Err(new Error(`Invalid persona name: ${input.persona}`)));
   }
-  const { loadPersona } = await import("./loader-NOLQCQGX.js");
+  const { loadPersona } = await import("./loader-2TBQUFWX.js");
   const { runPersona } = await import("./runner-VMYLHWOC.js");
   const { executeSkill } = await import("./skill-executor-XEVDGXUM.js");
   const personasDir = resolvePersonasDir();
@@ -1275,7 +1278,7 @@ async function autoSyncRoadmap(projectPath) {
   try {
     const roadmapFile = path11.join(projectPath, "docs", "roadmap.md");
     if (!fs10.existsSync(roadmapFile)) return;
-    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-WABFDP2V.js");
+    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-WHL3NN5S.js");
     const raw = fs10.readFileSync(roadmapFile, "utf-8");
     const parseResult = parseRoadmap(raw);
     if (!parseResult.ok) return;
@@ -1295,9 +1298,14 @@ async function triggerExternalSync(projectPath, roadmapFile) {
   try {
     const trackerConfig = loadTrackerConfig(projectPath);
     if (!trackerConfig) return;
+    const projectEnvPath = path11.join(projectPath, ".env");
+    if (fs10.existsSync(projectEnvPath) && !process.env.GITHUB_TOKEN) {
+      const { config: loadDotenv } = await import("dotenv");
+      loadDotenv({ path: projectEnvPath });
+    }
     const token = process.env.GITHUB_TOKEN;
     if (!token) return;
-    const { fullSync, GitHubIssuesSyncAdapter } = await import("./dist-WABFDP2V.js");
+    const { fullSync, GitHubIssuesSyncAdapter } = await import("./dist-WHL3NN5S.js");
     const adapter = new GitHubIssuesSyncAdapter({
       token,
       config: trackerConfig
@@ -1409,12 +1417,12 @@ var manageStateDefinition = {
   }
 };
 async function handleShow(projectPath, input) {
-  const { loadState } = await import("./dist-WABFDP2V.js");
+  const { loadState } = await import("./dist-WHL3NN5S.js");
   return resultToMcpResponse(await loadState(projectPath, input.stream, input.session));
 }
 async function handleLearn(projectPath, input) {
   if (!input.learning) return mcpError("Error: learning is required for learn action");
-  const { appendLearning } = await import("./dist-WABFDP2V.js");
+  const { appendLearning } = await import("./dist-WHL3NN5S.js");
   const result = await appendLearning(
     projectPath,
     input.learning,
@@ -1429,7 +1437,7 @@ async function handleLearn(projectPath, input) {
 async function handleFailure(projectPath, input) {
   if (!input.description) return mcpError("Error: description is required for failure action");
   if (!input.failureType) return mcpError("Error: failureType is required for failure action");
-  const { appendFailure } = await import("./dist-WABFDP2V.js");
+  const { appendFailure } = await import("./dist-WHL3NN5S.js");
   const result = await appendFailure(
     projectPath,
     input.description,
@@ -1442,24 +1450,24 @@ async function handleFailure(projectPath, input) {
   return resultToMcpResponse(Ok({ recorded: true }));
 }
 async function handleArchive(projectPath, input) {
-  const { archiveFailures } = await import("./dist-WABFDP2V.js");
+  const { archiveFailures } = await import("./dist-WHL3NN5S.js");
   const result = await archiveFailures(projectPath, input.stream, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   return resultToMcpResponse(Ok({ archived: true }));
 }
 async function handleReset(projectPath, input) {
-  const { saveState, DEFAULT_STATE } = await import("./dist-WABFDP2V.js");
+  const { saveState, DEFAULT_STATE } = await import("./dist-WHL3NN5S.js");
   const result = await saveState(projectPath, { ...DEFAULT_STATE }, input.stream, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   return resultToMcpResponse(Ok({ reset: true }));
 }
 async function handleGate(projectPath, _input) {
-  const { runMechanicalGate } = await import("./dist-WABFDP2V.js");
+  const { runMechanicalGate } = await import("./dist-WHL3NN5S.js");
   return resultToMcpResponse(await runMechanicalGate(projectPath));
 }
 async function handleSaveHandoff(projectPath, input) {
   if (!input.handoff) return mcpError("Error: handoff is required for save-handoff action");
-  const { saveHandoff } = await import("./dist-WABFDP2V.js");
+  const { saveHandoff } = await import("./dist-WHL3NN5S.js");
   const result = await saveHandoff(
     projectPath,
     input.handoff,
@@ -1471,7 +1479,7 @@ async function handleSaveHandoff(projectPath, input) {
   return resultToMcpResponse(Ok({ saved: true }));
 }
 async function handleLoadHandoff(projectPath, input) {
-  const { loadHandoff } = await import("./dist-WABFDP2V.js");
+  const { loadHandoff } = await import("./dist-WHL3NN5S.js");
   return resultToMcpResponse(await loadHandoff(projectPath, input.stream, input.session));
 }
 async function handleAppendEntry(projectPath, input) {
@@ -1479,7 +1487,7 @@ async function handleAppendEntry(projectPath, input) {
   if (!input.section) return mcpError("Error: section is required for append_entry action");
   if (!input.authorSkill) return mcpError("Error: authorSkill is required for append_entry action");
   if (!input.content) return mcpError("Error: content is required for append_entry action");
-  const { appendSessionEntry } = await import("./dist-WABFDP2V.js");
+  const { appendSessionEntry } = await import("./dist-WHL3NN5S.js");
   const result = await appendSessionEntry(
     projectPath,
     input.session,
@@ -1495,7 +1503,7 @@ async function handleUpdateEntryStatus(projectPath, input) {
   if (!input.entryId) return mcpError("Error: entryId is required for update_entry_status action");
   if (!input.newStatus)
     return mcpError("Error: newStatus is required for update_entry_status action");
-  const { updateSessionEntryStatus } = await import("./dist-WABFDP2V.js");
+  const { updateSessionEntryStatus } = await import("./dist-WHL3NN5S.js");
   const result = await updateSessionEntryStatus(
     projectPath,
     input.session,
@@ -1508,7 +1516,7 @@ async function handleUpdateEntryStatus(projectPath, input) {
 async function handleReadSection(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for read_section action");
   if (!input.section) return mcpError("Error: section is required for read_section action");
-  const { readSessionSection } = await import("./dist-WABFDP2V.js");
+  const { readSessionSection } = await import("./dist-WHL3NN5S.js");
   const result = await readSessionSection(
     projectPath,
     input.session,
@@ -1518,13 +1526,13 @@ async function handleReadSection(projectPath, input) {
 }
 async function handleReadSections(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for read_sections action");
-  const { readSessionSections } = await import("./dist-WABFDP2V.js");
+  const { readSessionSections } = await import("./dist-WHL3NN5S.js");
   const result = await readSessionSections(projectPath, input.session);
   return resultToMcpResponse(result);
 }
 async function handleArchiveSession(projectPath, input) {
   if (!input.session) return mcpError("Error: session is required for archive_session action");
-  const { archiveSession } = await import("./dist-WABFDP2V.js");
+  const { archiveSession } = await import("./dist-WHL3NN5S.js");
   const result = await archiveSession(projectPath, input.session);
   if (!result.ok) return resultToMcpResponse(result);
   await autoSyncRoadmap(projectPath);
@@ -1588,7 +1596,7 @@ var listStreamsDefinition = {
 };
 async function handleListStreams(input) {
   try {
-    const { listStreams, loadStreamIndex } = await import("./dist-WABFDP2V.js");
+    const { listStreams, loadStreamIndex } = await import("./dist-WHL3NN5S.js");
     const projectPath = sanitizePath(input.path);
     const indexResult = await loadStreamIndex(projectPath);
     const streamsResult = await listStreams(projectPath);
@@ -1626,7 +1634,7 @@ var checkPhaseGateDefinition = {
 };
 async function handleCheckPhaseGate(input) {
   try {
-    const { runCheckPhaseGate } = await import("./check-phase-gate-PRCIABVA.js");
+    const { runCheckPhaseGate } = await import("./check-phase-gate-2VXVOUJ5.js");
     const result = await runCheckPhaseGate({ cwd: sanitizePath(input.path) });
     if (result.ok) {
       return { content: [{ type: "text", text: JSON.stringify(result.value) }] };
@@ -1682,7 +1690,7 @@ async function handleValidateCrossCheck(input) {
     };
   }
   try {
-    const { runCrossCheck } = await import("./validate-cross-check-MM23HXVY.js");
+    const { runCrossCheck } = await import("./validate-cross-check-76Z5P6EX.js");
     const specsDir = path12.resolve(projectPath, input.specsDir ?? "docs/specs");
     if (!specsDir.startsWith(projectPath)) {
       return {
@@ -2327,7 +2335,7 @@ async function handleGenerateSlashCommands(input) {
 // src/mcp/resources/state.ts
 async function getStateResource(projectRoot) {
   try {
-    const { loadState, migrateToStreams } = await import("./dist-WABFDP2V.js");
+    const { loadState, migrateToStreams } = await import("./dist-WHL3NN5S.js");
     await migrateToStreams(projectRoot);
     const result = await loadState(projectRoot);
     if (result.ok) {
@@ -3146,7 +3154,7 @@ var generateAgentDefinitionsDefinition = {
   }
 };
 async function handleGenerateAgentDefinitions(input) {
-  const { generateAgentDefinitions } = await import("./generate-agent-definitions-BDHDLUZK.js");
+  const { generateAgentDefinitions } = await import("./generate-agent-definitions-LN3A45OL.js");
   const platforms = input.platform === "all" || !input.platform ? ["claude-code", "gemini-cli"] : [input.platform];
   const results = generateAgentDefinitions({
     platforms: [...platforms],
@@ -3443,7 +3451,7 @@ function handleSync(projectPath, input, deps) {
 }
 async function handleManageRoadmap(input) {
   try {
-    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-WABFDP2V.js");
+    const { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges } = await import("./dist-WHL3NN5S.js");
     const { Ok: Ok2 } = await import("./dist-USY2C5JL.js");
     const projectPath = sanitizePath(input.path);
     const deps = { parseRoadmap, serializeRoadmap, syncRoadmap, applySyncChanges, Ok: Ok2 };
@@ -3871,7 +3879,7 @@ async function handleTransition(validInput, projectPath, id) {
   const transition = transitionResult.data;
   const prompt = renderTransition(transition);
   try {
-    const { saveHandoff } = await import("./dist-WABFDP2V.js");
+    const { saveHandoff } = await import("./dist-WHL3NN5S.js");
     await saveHandoff(
       projectPath,
       {
@@ -3941,7 +3949,7 @@ async function handleEmitInteraction(input) {
 }
 async function recordInteraction(projectPath, id, type, decision, stream) {
   try {
-    const { loadState, saveState } = await import("./dist-WABFDP2V.js");
+    const { loadState, saveState } = await import("./dist-WHL3NN5S.js");
     const stateResult = await loadState(projectPath, stream);
     if (stateResult.ok) {
       const state = stateResult.value;
@@ -4030,10 +4038,10 @@ async function handleGatherContext(input) {
     input.include ?? ["state", "learnings", "handoff", "graph", "validation"]
   );
   const errors = [];
-  const statePromise = includeSet.has("state") ? import("./dist-WABFDP2V.js").then(
+  const statePromise = includeSet.has("state") ? import("./dist-WHL3NN5S.js").then(
     (core) => core.loadState(projectPath, void 0, input.session)
   ) : Promise.resolve(null);
-  const learningsPromise = includeSet.has("learnings") ? import("./dist-WABFDP2V.js").then(
+  const learningsPromise = includeSet.has("learnings") ? import("./dist-WHL3NN5S.js").then(
     (core) => core.loadBudgetedLearnings(projectPath, {
       intent: input.intent,
       tokenBudget: input.learningsBudget ?? 1e3,
@@ -4042,7 +4050,7 @@ async function handleGatherContext(input) {
       ...input.depth !== void 0 && { depth: input.depth }
     })
   ) : Promise.resolve(null);
-  const handoffPromise = includeSet.has("handoff") ? import("./dist-WABFDP2V.js").then(
+  const handoffPromise = includeSet.has("handoff") ? import("./dist-WHL3NN5S.js").then(
     (core) => core.loadHandoff(projectPath, void 0, input.session)
   ) : Promise.resolve(null);
   const graphPromise = includeSet.has("graph") ? (async () => {
@@ -4086,11 +4094,11 @@ async function handleGatherContext(input) {
       context: contextBlocks
     };
   })() : Promise.resolve(null);
-  const sessionsPromise = includeSet.has("sessions") && input.session ? import("./dist-WABFDP2V.js").then(
+  const sessionsPromise = includeSet.has("sessions") && input.session ? import("./dist-WHL3NN5S.js").then(
     (core) => core.readSessionSections(projectPath, input.session)
   ) : Promise.resolve(null);
   const shouldIncludeEvents = input.includeEvents !== void 0 ? input.includeEvents : includeSet.has("events") || !!input.session && !input.include;
-  const eventsPromise = shouldIncludeEvents ? import("./dist-WABFDP2V.js").then(async (core) => {
+  const eventsPromise = shouldIncludeEvents ? import("./dist-WHL3NN5S.js").then(async (core) => {
     const result = await core.loadEvents(projectPath, {
       session: input.session
     });
@@ -4098,7 +4106,7 @@ async function handleGatherContext(input) {
     return core.formatEventTimeline(result.value);
   }) : Promise.resolve(null);
   const validationPromise = includeSet.has("validation") ? (async () => {
-    const { handleValidateProject: handleValidateProject2 } = await import("./validate-YLMMPRUI.js");
+    const { handleValidateProject: handleValidateProject2 } = await import("./validate-R5WGB2AV.js");
     const result = await handleValidateProject2({ path: projectPath });
     const first = result.content[0];
     return first ? JSON.parse(first.text) : null;
@@ -4192,7 +4200,7 @@ async function handleGatherContext(input) {
   };
   if (input.session) {
     try {
-      const core = await import("./dist-WABFDP2V.js");
+      const core = await import("./dist-WHL3NN5S.js");
       core.updateSessionIndex(
         projectPath,
         input.session,
@@ -4262,7 +4270,7 @@ async function handleAssessProject(input) {
   let validateResult = null;
   if (checksToRun.has("validate")) {
     try {
-      const { handleValidateProject: handleValidateProject2 } = await import("./validate-YLMMPRUI.js");
+      const { handleValidateProject: handleValidateProject2 } = await import("./validate-R5WGB2AV.js");
       const result = await handleValidateProject2({ path: projectPath });
       const first = result.content[0];
       const parsed = first ? JSON.parse(first.text) : {};
@@ -4287,7 +4295,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckDependencies: handleCheckDependencies2 } = await import("./architecture-E6PIU27A.js");
+          const { handleCheckDependencies: handleCheckDependencies2 } = await import("./architecture-45YCLD26.js");
           const result = await handleCheckDependencies2({ path: projectPath });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4314,7 +4322,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckDocs: handleCheckDocs2 } = await import("./docs-UOCKFYBH.js");
+          const { handleCheckDocs: handleCheckDocs2 } = await import("./docs-FJFY7GF2.js");
           const result = await handleCheckDocs2({ path: projectPath, scope: "coverage" });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4341,7 +4349,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleDetectEntropy: handleDetectEntropy2 } = await import("./entropy-5Y32Q6UO.js");
+          const { handleDetectEntropy: handleDetectEntropy2 } = await import("./entropy-Y2GE4MYS.js");
           const result = await handleDetectEntropy2({ path: projectPath, type: "all" });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4368,7 +4376,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleRunSecurityScan: handleRunSecurityScan2 } = await import("./security-NNEE7IQT.js");
+          const { handleRunSecurityScan: handleRunSecurityScan2 } = await import("./security-3T4JGDZP.js");
           const result = await handleRunSecurityScan2({ path: projectPath });
           const first = result.content[0];
           const parsed = first ? JSON.parse(first.text) : {};
@@ -4400,7 +4408,7 @@ async function handleAssessProject(input) {
     parallelChecks.push(
       (async () => {
         try {
-          const { handleCheckPerformance: handleCheckPerformance2 } = await import("./performance-AN4AJVEF.js");
+          const { handleCheckPerformance: handleCheckPerformance2 } = await import("./performance-BSOMMWK5.js");
           const result = await handleCheckPerformance2({ path: projectPath });
           if ("isError" in result && result.isError) {
             const msg = result.content[0]?.text ?? "Performance check failed";
@@ -4603,7 +4611,7 @@ async function handleReviewChanges(input) {
   }
 }
 async function runQuickReview(projectPath, diff, diffLines, downgraded) {
-  const { handleAnalyzeDiff: handleAnalyzeDiff2 } = await import("./feedback-NANNPO22.js");
+  const { handleAnalyzeDiff: handleAnalyzeDiff2 } = await import("./feedback-FKZ7GMPO.js");
   const result = await handleAnalyzeDiff2({ diff, path: projectPath });
   const firstContent = result.content[0];
   if (!firstContent) throw new Error("Empty analyze_diff response");
@@ -4634,7 +4642,7 @@ function extractFileCount(diffParsed) {
   return files?.length ?? 0;
 }
 async function runStandardReview(projectPath, diff, diffLines, downgraded) {
-  const { handleAnalyzeDiff: handleAnalyzeDiff2, handleCreateSelfReview: handleCreateSelfReview2 } = await import("./feedback-NANNPO22.js");
+  const { handleAnalyzeDiff: handleAnalyzeDiff2, handleCreateSelfReview: handleCreateSelfReview2 } = await import("./feedback-FKZ7GMPO.js");
   const [diffResult, reviewResult] = await Promise.all([
     handleAnalyzeDiff2({ diff, path: projectPath }),
     handleCreateSelfReview2({ path: projectPath, diff })
@@ -4666,7 +4674,7 @@ async function runStandardReview(projectPath, diff, diffLines, downgraded) {
   };
 }
 async function runDeepReview(projectPath, diff, diffLines, _downgraded) {
-  const { handleRunCodeReview: handleRunCodeReview2 } = await import("./review-pipeline-UBXJ4IAH.js");
+  const { handleRunCodeReview: handleRunCodeReview2 } = await import("./review-pipeline-KUBHP3RV.js");
   const result = await handleRunCodeReview2({ path: projectPath, diff });
   const deepContent = result.content[0];
   if (!deepContent) throw new Error("Empty code review response");
@@ -4952,7 +4960,7 @@ async function handleDetectStaleConstraints(input) {
         ]
       };
     }
-    const { detectStaleConstraints } = await import("./dist-WABFDP2V.js");
+    const { detectStaleConstraints } = await import("./dist-WHL3NN5S.js");
     const result = detectStaleConstraints(
       store,
       windowDays,
@@ -5084,7 +5092,7 @@ async function handleCodeOutline(input) {
     };
   }
   try {
-    const { getOutline, formatOutline, EXTENSION_MAP } = await import("./dist-WABFDP2V.js");
+    const { getOutline, formatOutline, EXTENSION_MAP } = await import("./dist-WHL3NN5S.js");
     const { stat } = await import("fs/promises");
     const stats = await stat(targetPath).catch(() => null);
     if (stats?.isFile()) {
@@ -5164,7 +5172,7 @@ async function handleCodeSearch(input) {
     };
   }
   try {
-    const { searchSymbols } = await import("./dist-WABFDP2V.js");
+    const { searchSymbols } = await import("./dist-WHL3NN5S.js");
     const result = await searchSymbols(input.query, directory, input.glob);
     const lines = [`Search: "${result.query}" \u2014 ${result.matches.length} matches`];
     for (const match of result.matches) {
@@ -5233,7 +5241,7 @@ async function handleCodeUnfold(input) {
   }
   try {
     if (input.symbol) {
-      const { unfoldSymbol } = await import("./dist-WABFDP2V.js");
+      const { unfoldSymbol } = await import("./dist-WHL3NN5S.js");
       const result = await unfoldSymbol(filePath, input.symbol);
       const header = result.warning ? `${result.file}:${result.startLine}-${result.endLine} ${result.warning}
 ` : `${result.file}:${result.startLine}-${result.endLine}
@@ -5241,7 +5249,7 @@ async function handleCodeUnfold(input) {
       return { content: [{ type: "text", text: header + result.content }] };
     }
     if (input.startLine != null && input.endLine != null) {
-      const { unfoldRange } = await import("./dist-WABFDP2V.js");
+      const { unfoldRange } = await import("./dist-WHL3NN5S.js");
       const result = await unfoldRange(filePath, input.startLine, input.endLine);
       const header = `${result.file}:${result.startLine}-${result.endLine}
 `;
@@ -5320,7 +5328,7 @@ var TOOL_DEFINITIONS = [
   codeOutlineDefinition,
   codeSearchDefinition,
   codeUnfoldDefinition
-];
+].map((def) => ({ ...def, trustedOutput: true }));
 var TOOL_HANDLERS = {
   validate_project: handleValidateProject,
   check_dependencies: handleCheckDependencies,
@@ -5456,7 +5464,7 @@ async function appendUpdateNotification(result, resolvedRoot) {
       shouldRunCheck,
       readCheckState,
       spawnBackgroundCheck
-    } = await import("./dist-WABFDP2V.js");
+    } = await import("./dist-WHL3NN5S.js");
     const { CLI_VERSION } = await import("./version-KFFPOQAX.js");
     const configInterval = readConfigInterval(resolvedRoot);
     const DEFAULT_INTERVAL = 864e5;
@@ -5488,7 +5496,13 @@ function createHarnessServer(projectRoot, toolFilter) {
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: filteredDefinitions
   }));
-  const guardedHandlers = applyInjectionGuard(filteredHandlers, { projectRoot: resolvedRoot });
+  const trustedOutputTools = new Set(
+    filteredDefinitions.filter((t) => t.trustedOutput === true).map((t) => t.name)
+  );
+  const guardedHandlers = applyInjectionGuard(filteredHandlers, {
+    projectRoot: resolvedRoot,
+    trustedOutputTools
+  });
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
     const handler = guardedHandlers[name];

package/dist/{chunk-DYY3YKA6.js → chunk-V73TEHIF.js}

@@ -33,7 +33,7 @@ var createSelfReviewDefinition = {
 };
 async function handleCreateSelfReview(input) {
   try {
-    const { parseDiff, createSelfReview } = await import("./dist-WABFDP2V.js");
+    const { parseDiff, createSelfReview } = await import("./dist-WHL3NN5S.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);
@@ -119,7 +119,7 @@ var analyzeDiffDefinition = {
 };
 async function handleAnalyzeDiff(input) {
   try {
-    const { parseDiff, analyzeDiff } = await import("./dist-WABFDP2V.js");
+    const { parseDiff, analyzeDiff } = await import("./dist-WHL3NN5S.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);
@@ -195,7 +195,7 @@ var requestPeerReviewDefinition = {
 };
 async function handleRequestPeerReview(input) {
   try {
-    const { parseDiff, requestPeerReview } = await import("./dist-WABFDP2V.js");
+    const { parseDiff, requestPeerReview } = await import("./dist-WHL3NN5S.js");
     const parseResult = parseDiff(input.diff);
     if (!parseResult.ok) {
       return resultToMcpResponse(parseResult);

package/dist/{chunk-FUQDDES3.js → chunk-YDOGGQSF.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-3WGJMBKH.js";
 import {
   ArchConfigSchema
-} from "./chunk-XULGZC2A.js";
+} from "./chunk-IC5CZSHF.js";
 import {
   Err,
   Ok

package/dist/{ci-workflow-N2TJ7B7G.js → ci-workflow-HWX5OVLI.js}

@@ -1,7 +1,7 @@
 import {
   generateCIWorkflow
 } from "./chunk-SD3SQOZ2.js";
-import "./chunk-XULGZC2A.js";
+import "./chunk-IC5CZSHF.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   generateCIWorkflow

package/dist/{dist-WABFDP2V.js → dist-WHL3NN5S.js}

@@ -291,7 +291,7 @@ import {
   writeSessionSummary,
   writeTaint,
   xssRules
-} from "./chunk-XULGZC2A.js";
+} from "./chunk-IC5CZSHF.js";
 import {
   Err,
   Ok,

package/dist/{docs-UOCKFYBH.js → docs-FJFY7GF2.js}

@@ -1,12 +1,12 @@
 import {
   checkDocsDefinition,
   handleCheckDocs
-} from "./chunk-7KGLJ74A.js";
-import "./chunk-FUQDDES3.js";
+} from "./chunk-H6KZAGHZ.js";
+import "./chunk-YDOGGQSF.js";
 import "./chunk-IDZNPTYD.js";
 import "./chunk-W6Y7ZW3Y.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-XULGZC2A.js";
+import "./chunk-IC5CZSHF.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   checkDocsDefinition,

package/dist/{engine-R24ZLV44.js → engine-R5BZHIZB.js}

@@ -1,7 +1,7 @@
 import {
   TemplateEngine
 } from "./chunk-YLN34N65.js";
-import "./chunk-XULGZC2A.js";
+import "./chunk-IC5CZSHF.js";
 import "./chunk-ERS5EVUZ.js";
 export {
   TemplateEngine