@hivelore/core 0.54.0 → 0.56.0

package/dist/index.js

@@ -1042,6 +1042,26 @@ function renderPreventionReceiptShare(receipt) {
   lines.push("", `<sub>${HIVELORE_ATTRIBUTION}</sub>`);
   return lines.join("\n");
 }
+var PREVENTION_RECEIPT_MARKER = "<!-- haive:prevention-receipt -->";
+function renderPreventionComment(receipt, findings = []) {
+  const fired = findings.filter((f) => f.code === "sensor-block" || f.code === "sensor-warn");
+  const lines = [PREVENTION_RECEIPT_MARKER, "", "## Hivelore prevention receipt", ""];
+  if (fired.length === 0) {
+    lines.push("No documented sensor fired on this PR.", "");
+  } else {
+    lines.push("### Fired on this PR", "");
+    for (const f of fired) {
+      const where = f.file ? ` \u2014 \`${f.file}\`` : "";
+      lines.push(`- **${f.memory_ids?.[0] ?? "sensor"}**${where} \u2014 ${f.message ?? "sensor fired"}`);
+      if (f.matched_line) lines.push(`  \`\`\`
+  ${f.matched_line}
+  \`\`\``);
+    }
+    lines.push("");
+  }
+  lines.push(renderPreventionReceiptShare(receipt));
+  return lines.join("\n");
+}
 async function loadPreventionEvents(paths) {
   const file = preventionLogPath(paths);
   if (!existsSync4(file)) return [];
@@ -1204,6 +1224,178 @@ async function recordProjectContextEmission(paths, hash, now = Date.now()) {
   });
 }
 
+// src/gate-reminder.ts
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import path8 from "path";
+var GATE_REMINDER_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function reminderMarkerPath(paths) {
+  return path8.join(paths.haiveDir, ".cache", "gate-reminders.json");
+}
+async function readMarkers(paths) {
+  const file = reminderMarkerPath(paths);
+  if (!existsSync6(file)) return {};
+  try {
+    const parsed = JSON.parse(await readFile6(file, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function shouldExpandGateReminder(paths, key, now = Date.now(), windowMs = GATE_REMINDER_WINDOW_MS) {
+  const last = (await readMarkers(paths))[key];
+  if (!last) return true;
+  const at = Date.parse(last);
+  return !Number.isFinite(at) || now - at >= windowMs;
+}
+async function recordGateReminder(paths, key, now = Date.now()) {
+  const file = reminderMarkerPath(paths);
+  const markers = await readMarkers(paths);
+  markers[key] = new Date(now).toISOString();
+  await mkdir4(path8.dirname(file), { recursive: true }).catch(() => {
+  });
+  await writeFile3(file, JSON.stringify(markers, null, 2), "utf8").catch(() => {
+  });
+}
+
+// src/gate-verdict.ts
+var PROCESS_GATE_CODES = /* @__PURE__ */ new Set([
+  "briefing-missing",
+  "session-recap-missing",
+  "decision-coverage-missing",
+  "bootstrap-incomplete"
+]);
+var CONTENT_CATCH_CODES = /* @__PURE__ */ new Set(["sensor-block", "precommit-policy-block"]);
+var CONTENT_CODES = /* @__PURE__ */ new Set([...CONTENT_CATCH_CODES, "sensor-warn"]);
+var SETUP_GATE_CODES = /* @__PURE__ */ new Set([
+  ...PROCESS_GATE_CODES,
+  "enforcement-score-below-threshold"
+]);
+var DEFAULT_POSTURE = "balanced";
+var POSTURE_DEFAULTS = {
+  // Report everything, refuse nothing. For adopting Hivelore on a repo mid-flight.
+  advisory: { mode: "advisory", processGate: "warn", humanCommits: "relaxed" },
+  // Refuse on deterministic, code-bound evidence only. The default.
+  balanced: { mode: "strict", processGate: "warn", humanCommits: "relaxed" },
+  // Process gates bind too, at the sharing points. For teams that want the workflow enforced.
+  strict: { mode: "strict", processGate: "block", humanCommits: "strict" }
+};
+function resolveGatePolicy(input) {
+  const cfg = input ?? {};
+  const posture = cfg.posture ?? DEFAULT_POSTURE;
+  const base = POSTURE_DEFAULTS[posture] ?? POSTURE_DEFAULTS[DEFAULT_POSTURE];
+  const overrides = [];
+  for (const key of ["mode", "processGate", "humanCommits"]) {
+    if (cfg[key] !== void 0) overrides.push(key);
+  }
+  return {
+    posture,
+    mode: cfg.mode ?? base.mode,
+    processGate: cfg.processGate ?? base.processGate,
+    humanCommits: cfg.humanCommits ?? base.humanCommits,
+    scoreThreshold: cfg.scoreThreshold ?? 80,
+    overrides
+  };
+}
+function describePosture(policy) {
+  const base = policy.posture === "advisory" ? "reports everything, refuses nothing" : policy.posture === "strict" ? "refuses on deterministic findings AND on process gates at pre-push/CI" : "refuses on deterministic findings only (sensors, anti-patterns, stale anchors on touched files)";
+  const pinned = policy.overrides.length > 0 ? ` \xB7 overridden: ${policy.overrides.join(", ")}` : "";
+  return `${policy.posture} \u2014 ${base}${pinned}`;
+}
+function processGateDecision(policy, stage, isAgent) {
+  if (policy.processGate !== "block") {
+    return {
+      refuses: false,
+      reason: `advisory: process gates report, they do not refuse \u2014 only sensors and other deterministic findings block. Set enforcement.posture="strict" (or processGate="block") to change that.`
+    };
+  }
+  if (stage === "pre-commit" || stage === "local") {
+    return {
+      refuses: false,
+      reason: "advisory at commit time: process gates bind the sharing points (pre-push, CI), not local iteration."
+    };
+  }
+  if (stage !== "ci" && !isAgent && policy.humanCommits === "relaxed") {
+    return {
+      refuses: false,
+      reason: `relaxed to a warning: no agent harness detected, so this human commit is not bound by agent process gates \u2014 set enforcement.humanCommits="strict" to change that.`
+    };
+  }
+  return { refuses: true, reason: "enforced: process gates bind at this sharing point." };
+}
+function penaltyOf(finding) {
+  if (finding.severity === "error") return finding.impact ?? 25;
+  if (finding.severity === "warn") return finding.impact ?? 8;
+  return 0;
+}
+function computeBaselineHealth(findings, threshold) {
+  const baseline = findings.filter((f) => !CONTENT_CODES.has(f.code));
+  const penalty = baseline.reduce((sum, f) => sum + penaltyOf(f), 0);
+  return {
+    score: Math.max(0, Math.min(100, 100 - penalty)),
+    threshold,
+    checks: {
+      total: findings.length,
+      ok: findings.filter((f) => f.severity === "ok").length,
+      warn: findings.filter((f) => f.severity === "warn").length,
+      error: findings.filter((f) => f.severity === "error").length
+    }
+  };
+}
+function dedupeRefusals(findings) {
+  const byMemory = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const finding of findings) {
+    if (!CONTENT_CATCH_CODES.has(finding.code) || finding.severity !== "error") continue;
+    const key = finding.memory_ids?.[0];
+    if (!key) {
+      out.push(finding);
+      continue;
+    }
+    const existing = byMemory.get(key);
+    if (!existing || !existing.matched_line && finding.matched_line) byMemory.set(key, finding);
+  }
+  return [...byMemory.values(), ...out];
+}
+function decideVerdict(input) {
+  const { policy, stage, isAgent } = input;
+  const process2 = processGateDecision(policy, stage, isAgent);
+  const findings = input.findings.map((finding) => {
+    if (finding.severity !== "error" || !PROCESS_GATE_CODES.has(finding.code)) return finding;
+    if (process2.refuses) return finding;
+    return {
+      ...finding,
+      severity: "warn",
+      // Capped so a downgraded gate cannot dominate the health score it no longer refuses on.
+      impact: Math.min(finding.impact ?? 8, 8),
+      reason: process2.reason,
+      message: `${finding.message} (${process2.reason})`
+    };
+  });
+  const baselineHealth = computeBaselineHealth(findings, policy.scoreThreshold);
+  const refusals = dedupeRefusals(findings);
+  const hasErrors = findings.some((f) => f.severity === "error");
+  return {
+    findings,
+    should_block: policy.mode === "strict" && hasErrors,
+    actor: isAgent ? `agent (${(input.agentSignals ?? []).join(", ")})` : process2.refuses ? "human \u2014 strict (enforcement.humanCommits)" : "human \u2014 process gates relaxed",
+    baseline_health: baselineHealth,
+    refusals,
+    process_gate_reason: process2.reason
+  };
+}
+function buildBaselineHealthFinding(findings, health, shouldBlock) {
+  if (shouldBlock || health.score >= health.threshold) return null;
+  const topPenalties = findings.filter((f) => !CONTENT_CODES.has(f.code)).map((f) => ({ code: f.code, penalty: penaltyOf(f) })).filter((p) => p.penalty > 0).sort((a, b) => b.penalty - a.penalty).slice(0, 3);
+  return {
+    severity: "warn",
+    code: "enforcement-score-below-threshold",
+    message: `Repo knowledge-layer health ${health.score}% is below the ${health.threshold}% target` + (topPenalties.length > 0 ? ` \u2014 top gaps: ${topPenalties.map((p) => `${p.code} (\u2212${p.penalty})`).join(", ")}` : "") + ". This measures the repo's baseline, not this change; it never blocks.",
+    fix: "Fill the gaps above (bootstrap, briefing, recap), then rerun `hivelore enforce check`.",
+    impact: 0
+  };
+}
+
 // src/priority.ts
 var DEFAULT_PRIORITY_SIGNALS = {
   type: "",
@@ -1394,10 +1586,10 @@ function sensorPatternBrittleness(pattern) {
 function normalizeProjectPath(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^[ab]\//, "").replace(/\/+$/g, "");
 }
-function sensorAppliesToPath(sensor, anchorPaths, path21) {
+function sensorAppliesToPath(sensor, anchorPaths, path22) {
   const scopes = sensor.paths.length > 0 ? sensor.paths : anchorPaths;
   if (scopes.length === 0) return true;
-  const target = normalizeProjectPath(path21);
+  const target = normalizeProjectPath(path22);
   return scopes.some((rawScope) => {
     const scope = normalizeProjectPath(rawScope);
     if (!scope) return false;
@@ -1722,6 +1914,34 @@ function judgeProposedSensor(sensor, input) {
   }
   return { accepted: true, self_check, brittle };
 }
+function explainSensorRejection(verdict, context) {
+  const retry = context.style === "cli" ? "re-run" : "re-propose";
+  switch (verdict.reason) {
+    case "fires-on-current": {
+      const where = verdict.self_check.fired_on.join(", ");
+      const warnCommand = context.style === "cli" ? `hivelore sensors propose ${context.memoryId ?? "<memory-id>"} --pattern '<same>' --severity warn` : `propose_sensor({ memory_id: "${context.memoryId ?? "<memory-id>"}", pattern: "<same>", severity: "warn" })`;
+      return [
+        `A block sensor must be silent on the current code, and this one fires on: ${where}.`,
+        "That means one of two things:",
+        `  1. The faulty pattern is STILL PRESENT \u2014 the usual case when you document a problem before`,
+        `     fixing it. A block sensor cannot be armed yet. Arm it as a warning now, fix the code,`,
+        `     then promote it:`,
+        `       ${warnCommand}`,
+        `       \u2026then re-run the same proposal with severity "block" once ${where} is clean.`,
+        `  2. The pattern also matches LEGITIMATE usage. Add or tighten the 'absent' companion so`,
+        `     correct usage is excluded, then ${retry}.`
+      ].join("\n");
+    }
+    case "fires-on-correct":
+      return `Inverted: the pattern matches the lesson's OWN recommended fix (its \`Instead, use:\` approach) \u2014 it would block correct code and never the mistake. Point the pattern at the FAULTY usage, then ${retry}.`;
+    case "missed-bad-example":
+      return `The sensor did not match the bad example, so it won't catch the mistake. Adjust the pattern, then ${retry}.`;
+    case "brittle":
+      return `The pattern is brittle (${verdict.brittle}). Use a durable pattern (avoid hardcoded line numbers), then ${retry}.`;
+    default:
+      return `Re-propose with a discriminating pattern, then ${retry}.`;
+  }
+}
 function isHarnessErrorOutput(output) {
   if (!output) return false;
   return HARNESS_ERROR_SIGNATURES.some((re) => re.test(output));
@@ -1884,7 +2104,33 @@ function suggestSensorSeed(body, anchorPaths, options = {}) {
     message: companion ? companionMessage(body, companion) : sensorMessageFromBody(body, token)
   };
   if (companion) seed.absent = escapeRegExp(companion.required);
-  return seed;
+  return seedFiresOnCorrectUsage(seed, body) ? null : seed;
+}
+function seedFiresOnCorrectUsage(seed, body) {
+  const correct = correctUsageText(body);
+  if (!correct) return false;
+  let re;
+  try {
+    re = new RegExp(seed.pattern, "m");
+  } catch {
+    return true;
+  }
+  if (!re.test(correct)) return false;
+  if (seed.absent) {
+    try {
+      if (new RegExp(seed.absent, "m").test(correct)) return false;
+    } catch {
+    }
+  }
+  return true;
+}
+function correctUsageText(body) {
+  const parts = [...extractCorrectApproachExamples(body)];
+  const headingRe = /^#{1,6}\s+(?:how to apply|instead|correct|the fix|fix|recommended|do this|guidance)\b[^\n]*\n([\s\S]*?)(?=^#{1,6}\s|(?![\s\S]))/gim;
+  for (const match of body.matchAll(headingRe)) {
+    if (match[1]) parts.push(match[1]);
+  }
+  return parts.join("\n").trim();
 }
 function suggestSensorFromMemory(body, anchorPaths, options = {}) {
   const seed = suggestSensorSeed(body, anchorPaths, options);
@@ -2649,10 +2895,11 @@ function allocateBudget(parts, maxTokens) {
 }
 
 // src/code-map.ts
-import { mkdir as mkdir4, readFile as readFile6, readdir as readdir3, writeFile as writeFile3 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
+import { mkdir as mkdir5, readFile as readFile7, readdir as readdir3, stat as stat2, writeFile as writeFile4 } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync7 } from "fs";
 import { spawnSync } from "child_process";
-import path8 from "path";
+import path9 from "path";
 
 // src/ast-parser.ts
 import { fileURLToPath } from "url";
@@ -3064,27 +3311,53 @@ var CODE_MAP_DEFAULT_EXCLUDE = [
 ];
 var TEST_FILE_RE = /\.(test|spec)\.[a-z]+$/i;
 function codeMapPath(paths) {
-  return path8.join(paths.haiveDir, CODE_MAP_FILE);
+  return path9.join(paths.haiveDir, CODE_MAP_FILE);
+}
+function codeMapMetaPath(paths) {
+  return path9.join(paths.runtimeDir, "code-map-meta.json");
+}
+function serializeCodeMap(map) {
+  const files = {};
+  for (const key of Object.keys(map.files).sort()) files[key] = map.files[key];
+  return `${JSON.stringify({ version: map.version, files }, null, 2)}
+`;
+}
+function codeMapContentHash(map) {
+  return createHash2("sha256").update(serializeCodeMap(map)).digest("hex").slice(0, 16);
 }
 async function loadCodeMap(paths) {
   const file = codeMapPath(paths);
-  if (!existsSync6(file)) return null;
-  return JSON.parse(await readFile6(file, "utf8"));
+  if (!existsSync7(file)) return null;
+  const parsed = JSON.parse(await readFile7(file, "utf8"));
+  const generatedAt = parsed.generated_at ?? await readFile7(codeMapMetaPath(paths), "utf8").then((raw) => JSON.parse(raw).generated_at).catch(() => void 0) ?? await stat2(file).then((s) => s.mtime.toISOString()).catch(() => (/* @__PURE__ */ new Date(0)).toISOString());
+  return { ...parsed, root: parsed.root ?? paths.root, generated_at: generatedAt };
 }
 async function saveCodeMap(paths, map) {
   const file = codeMapPath(paths);
-  await mkdir4(path8.dirname(file), { recursive: true });
-  await writeFile3(file, JSON.stringify(map, null, 2), "utf8");
+  const payload = serializeCodeMap(map);
+  const current = existsSync7(file) ? await readFile7(file, "utf8").catch(() => null) : null;
+  if (current === payload) return;
+  await mkdir5(path9.dirname(file), { recursive: true });
+  await writeFile4(file, payload, "utf8");
+  await mkdir5(paths.runtimeDir, { recursive: true }).catch(() => {
+  });
+  await writeFile4(
+    codeMapMetaPath(paths),
+    `${JSON.stringify({ generated_at: (/* @__PURE__ */ new Date()).toISOString(), content_hash: codeMapContentHash(map) }, null, 2)}
+`,
+    "utf8"
+  ).catch(() => {
+  });
 }
 async function buildCodeMap(root, options = {}) {
   const include = new Set(options.includeExtensions ?? CODE_MAP_DEFAULT_INCLUDE);
   const exclude = new Set(options.excludeDirs ?? CODE_MAP_DEFAULT_EXCLUDE);
   const files = {};
   for await (const abs of collectSourceFiles(root, include, exclude, options.includeUntracked)) {
-    const rel = path8.relative(root, abs).replace(/\\/g, "/");
+    const rel = path9.relative(root, abs).replace(/\\/g, "/");
     if (rel.startsWith(".ai/")) continue;
-    const content = await readFile6(abs, "utf8");
-    const ext = path8.extname(abs).toLowerCase();
+    const content = await readFile7(abs, "utf8");
+    const ext = path9.extname(abs).toLowerCase();
     const entry = await parseFileEntry(content, ext);
     if (entry.exports.length > 0) files[rel] = entry;
   }
@@ -3105,11 +3378,11 @@ async function countSourceFilesOnDisk(root, options = {}) {
 async function* collectSourceFiles(root, include, exclude, includeUntracked) {
   const gitFiles = gitSourceFiles(root, include, exclude, includeUntracked === true);
   if (gitFiles) {
-    for (const rel of gitFiles) yield path8.join(root, rel);
+    for (const rel of gitFiles) yield path9.join(root, rel);
     for await (const nested of findNestedGitRepos(root, exclude)) {
       const nestedFiles = gitSourceFiles(nested, include, exclude, includeUntracked === true);
       if (nestedFiles) {
-        for (const rel of nestedFiles) yield path8.join(nested, rel);
+        for (const rel of nestedFiles) yield path9.join(nested, rel);
       }
     }
     return;
@@ -3128,8 +3401,8 @@ async function* findNestedGitRepos(root, exclude, depth = 0) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".")) continue;
     if (exclude.has(entry.name)) continue;
-    const full = path8.join(root, entry.name);
-    if (existsSync6(path8.join(full, ".git"))) {
+    const full = path9.join(root, entry.name);
+    if (existsSync7(path9.join(full, ".git"))) {
       yield full;
     } else {
       yield* findNestedGitRepos(full, exclude, depth + 1);
@@ -3158,11 +3431,11 @@ async function* walkSourceFiles(dir, include, exclude) {
       if (entry.isDirectory()) continue;
     }
     if (exclude.has(entry.name)) continue;
-    const full = path8.join(dir, entry.name);
+    const full = path9.join(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkSourceFiles(full, include, exclude);
     } else if (entry.isFile()) {
-      const ext = path8.extname(entry.name).toLowerCase();
+      const ext = path9.extname(entry.name).toLowerCase();
       if (include.has(ext) && !TEST_FILE_RE.test(entry.name)) yield full;
     }
   }
@@ -3173,7 +3446,7 @@ function isIncludedSourcePath(rel, include, exclude) {
   const parts = normalized.split("/");
   if (parts.some((part) => exclude.has(part))) return false;
   const base = parts.at(-1) ?? "";
-  const ext = path8.extname(base).toLowerCase();
+  const ext = path9.extname(base).toLowerCase();
   return include.has(ext) && !TEST_FILE_RE.test(base);
 }
 var EXPORT_RE = /(?:^|;)[ \t]*export\s+(?:default\s+)?(async\s+)?(function|class|interface|type|const|let|var|enum)\s+(\*?)\s*([A-Za-z_$][\w$]*)/gm;
@@ -3435,10 +3708,10 @@ function queryCodeMap(map, options) {
 }
 
 // src/config.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { readFileSync } from "fs";
-import { readFile as readFile7, rm, writeFile as writeFile4 } from "fs/promises";
-import path9 from "path";
+import { readFile as readFile8, rm, writeFile as writeFile5 } from "fs/promises";
+import path10 from "path";
 var CONFIG_FILE = "hivelore.config.json";
 var LEGACY_CONFIG_FILE = "haive.config.json";
 var DEFAULT_BRIEFING_EXCLUDE_TAGS = [
@@ -3534,19 +3807,19 @@ function antiPatternGateParams(gate) {
   }
 }
 function configPath(paths) {
-  return path9.join(paths.haiveDir, CONFIG_FILE);
+  return path10.join(paths.haiveDir, CONFIG_FILE);
 }
 function resolveConfigPath(paths) {
   const current = configPath(paths);
-  if (existsSync7(current)) return current;
-  const legacy = path9.join(paths.haiveDir, LEGACY_CONFIG_FILE);
-  return existsSync7(legacy) ? legacy : current;
+  if (existsSync8(current)) return current;
+  const legacy = path10.join(paths.haiveDir, LEGACY_CONFIG_FILE);
+  return existsSync8(legacy) ? legacy : current;
 }
 async function loadConfig(paths) {
   const file = resolveConfigPath(paths);
-  if (!existsSync7(file)) return { ...DEFAULT_CONFIG };
+  if (!existsSync8(file)) return { ...DEFAULT_CONFIG };
   try {
-    const raw = await readFile7(file, "utf8");
+    const raw = await readFile8(file, "utf8");
     const parsed = JSON.parse(raw);
     const merged = mergeConfig(DEFAULT_CONFIG, parsed);
     if (merged.autopilot) {
@@ -3559,7 +3832,7 @@ async function loadConfig(paths) {
 }
 function loadConfigSync(paths) {
   const file = resolveConfigPath(paths);
-  if (!existsSync7(file)) return { ...DEFAULT_CONFIG };
+  if (!existsSync8(file)) return { ...DEFAULT_CONFIG };
   try {
     const parsed = JSON.parse(readFileSync(file, "utf8"));
     const merged = mergeConfig(DEFAULT_CONFIG, parsed);
@@ -3569,9 +3842,9 @@ function loadConfigSync(paths) {
   }
 }
 async function saveConfig(paths, config) {
-  await writeFile4(configPath(paths), JSON.stringify(config, null, 2) + "\n", "utf8");
-  const legacy = path9.join(paths.haiveDir, LEGACY_CONFIG_FILE);
-  if (existsSync7(legacy)) {
+  await writeFile5(configPath(paths), JSON.stringify(config, null, 2) + "\n", "utf8");
+  const legacy = path10.join(paths.haiveDir, LEGACY_CONFIG_FILE);
+  if (existsSync8(legacy)) {
     try {
       await rm(legacy, { force: true });
     } catch {
@@ -3594,21 +3867,21 @@ function mergeConfig(base, override) {
 }
 
 // src/cross-repo.ts
-import { existsSync as existsSync8 } from "fs";
-import { mkdir as mkdir5, readFile as readFile8, writeFile as writeFile5 } from "fs/promises";
-import path10 from "path";
+import { existsSync as existsSync9 } from "fs";
+import { mkdir as mkdir6, readFile as readFile9, writeFile as writeFile6 } from "fs/promises";
+import path11 from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 async function loadImportMap(cacheDir) {
-  const mapPath = path10.join(cacheDir, "import-map.json");
-  if (!existsSync8(mapPath)) return {};
+  const mapPath = path11.join(cacheDir, "import-map.json");
+  if (!existsSync9(mapPath)) return {};
   try {
-    return JSON.parse(await readFile8(mapPath, "utf8"));
+    return JSON.parse(await readFile9(mapPath, "utf8"));
   } catch {
     return {};
   }
 }
 async function saveImportMap(cacheDir, map) {
-  await writeFile5(path10.join(cacheDir, "import-map.json"), JSON.stringify(map, null, 2) + "\n", "utf8");
+  await writeFile6(path11.join(cacheDir, "import-map.json"), JSON.stringify(map, null, 2) + "\n", "utf8");
 }
 async function pullCrossRepoSources(paths, config, projectRoot) {
   const sources = config.crossRepoSources ?? [];
@@ -3629,8 +3902,8 @@ async function pullFromSource(paths, source, projectRoot) {
   };
   let sourceRoot = null;
   if (source.path) {
-    const resolved = path10.resolve(projectRoot, source.path);
-    if (!existsSync8(resolved)) {
+    const resolved = path11.resolve(projectRoot, source.path);
+    if (!existsSync9(resolved)) {
       report.errors.push(`Path not found: ${resolved}`);
       return report;
     }
@@ -3643,7 +3916,7 @@ async function pullFromSource(paths, source, projectRoot) {
     return report;
   }
   const sourcePaths = resolveHaivePaths(sourceRoot);
-  if (!existsSync8(sourcePaths.memoriesDir)) {
+  if (!existsSync9(sourcePaths.memoriesDir)) {
     report.errors.push(`No .ai/memories/ found at ${sourceRoot}`);
     return report;
   }
@@ -3666,10 +3939,10 @@ async function pullFromSource(paths, source, projectRoot) {
     report.skipped.push("no shared memories found in source");
     return report;
   }
-  const destDir = path10.join(paths.memoriesDir, "shared", source.name);
-  await mkdir5(destDir, { recursive: true });
-  const cacheDir = path10.join(paths.haiveDir, ".cache", "cross-repo", source.name);
-  await mkdir5(cacheDir, { recursive: true });
+  const destDir = path11.join(paths.memoriesDir, "shared", source.name);
+  await mkdir6(destDir, { recursive: true });
+  const cacheDir = path11.join(paths.haiveDir, ".cache", "cross-repo", source.name);
+  await mkdir6(cacheDir, { recursive: true });
   const importMap = await loadImportMap(cacheDir);
   const mapDirty = false;
   let dirty = mapDirty;
@@ -3683,7 +3956,7 @@ async function pullFromSource(paths, source, projectRoot) {
 
 `;
     const existingLocalPath = importMap[sourceId];
-    if (existingLocalPath && existsSync8(existingLocalPath)) {
+    if (existingLocalPath && existsSync9(existingLocalPath)) {
       const existingFiles = await loadMemoriesFromDir(destDir);
       const existingEntry = existingFiles.find(({ filePath }) => filePath === existingLocalPath);
       const sourceBodyStripped = memory.body.trim();
@@ -3694,7 +3967,7 @@ async function pullFromSource(paths, source, projectRoot) {
       }
       const updatedBody = importedBodyPrefix + memory.body;
       if (existingEntry) {
-        await writeFile5(
+        await writeFile6(
           existingLocalPath,
           serializeMemory({ frontmatter: existingEntry.memory.frontmatter, body: updatedBody }),
           "utf8"
@@ -3718,8 +3991,8 @@ async function pullFromSource(paths, source, projectRoot) {
         topic: fm.topic ? `${source.name}:${fm.topic}` : void 0
       });
       const body = importedBodyPrefix + memory.body;
-      const destPath = path10.join(destDir, `${newFm.id}.md`);
-      await writeFile5(destPath, serializeMemory({ frontmatter: newFm, body }), "utf8");
+      const destPath = path11.join(destDir, `${newFm.id}.md`);
+      await writeFile6(destPath, serializeMemory({ frontmatter: newFm, body }), "utf8");
       importMap[sourceId] = destPath;
       dirty = true;
       report.imported.push(sourceId);
@@ -3729,9 +4002,9 @@ async function pullFromSource(paths, source, projectRoot) {
   return report;
 }
 async function cloneOrFetchGitSource(source, paths, report) {
-  const cacheDir = path10.join(paths.haiveDir, ".cache", "cross-repo", source.name);
-  await mkdir5(cacheDir, { recursive: true });
-  if (existsSync8(path10.join(cacheDir, ".git"))) {
+  const cacheDir = path11.join(paths.haiveDir, ".cache", "cross-repo", source.name);
+  await mkdir6(cacheDir, { recursive: true });
+  if (existsSync9(path11.join(cacheDir, ".git"))) {
     const result = spawnSync2("git", ["fetch", "--depth=1", "origin"], {
       cwd: cacheDir,
       encoding: "utf8"
@@ -3756,9 +4029,9 @@ async function cloneOrFetchGitSource(source, paths, report) {
 }
 
 // src/dep-tracker.ts
-import { existsSync as existsSync9 } from "fs";
-import { readFile as readFile9, writeFile as writeFile6, mkdir as mkdir6 } from "fs/promises";
-import path11 from "path";
+import { existsSync as existsSync10 } from "fs";
+import { readFile as readFile10, writeFile as writeFile7, mkdir as mkdir7 } from "fs/promises";
+import path12 from "path";
 function parsePackageJson(content) {
   try {
     const pkg = JSON.parse(content);
@@ -3830,7 +4103,7 @@ var KNOWN_MANIFESTS = [
   { name: "pom.xml", parser: parsePomXml }
 ];
 function getParser(file) {
-  const base = path11.basename(file);
+  const base = path12.basename(file);
   return KNOWN_MANIFESTS.find((m) => m.name === base)?.parser ?? null;
 }
 function extractMajor(version) {
@@ -3848,32 +4121,32 @@ function isMajorBump(from, to) {
 }
 function resolveManifestFiles(projectRoot, configuredFiles) {
   if (configuredFiles !== void 0) {
-    return configuredFiles.map((f) => path11.resolve(projectRoot, f)).filter(existsSync9);
+    return configuredFiles.map((f) => path12.resolve(projectRoot, f)).filter(existsSync10);
   }
-  return KNOWN_MANIFESTS.map(({ name }) => path11.join(projectRoot, name)).filter(existsSync9);
+  return KNOWN_MANIFESTS.map(({ name }) => path12.join(projectRoot, name)).filter(existsSync10);
 }
 async function trackDependencies(projectRoot, haiveDir, manifestFiles) {
-  const contractsDir = path11.join(haiveDir, "contracts");
-  await mkdir6(contractsDir, { recursive: true });
+  const contractsDir = path12.join(haiveDir, "contracts");
+  await mkdir7(contractsDir, { recursive: true });
   const results = [];
   for (const manifestPath of manifestFiles) {
     const parser2 = getParser(manifestPath);
     if (!parser2) continue;
-    const content = await readFile9(manifestPath, "utf8");
+    const content = await readFile10(manifestPath, "utf8");
     const currentDeps = parser2(content);
-    const lockName = `deps-${path11.basename(manifestPath)}.lock`;
-    const lockPath = path11.join(contractsDir, lockName);
-    if (!existsSync9(lockPath)) {
+    const lockName = `deps-${path12.basename(manifestPath)}.lock`;
+    const lockPath = path12.join(contractsDir, lockName);
+    if (!existsSync10(lockPath)) {
       const snapshot2 = {
-        file: path11.relative(projectRoot, manifestPath),
-        format: path11.basename(manifestPath),
+        file: path12.relative(projectRoot, manifestPath),
+        format: path12.basename(manifestPath),
         captured_at: (/* @__PURE__ */ new Date()).toISOString(),
         deps: currentDeps
       };
-      await writeFile6(lockPath, JSON.stringify(snapshot2, null, 2) + "\n", "utf8");
+      await writeFile7(lockPath, JSON.stringify(snapshot2, null, 2) + "\n", "utf8");
       continue;
     }
-    const snapshot = JSON.parse(await readFile9(lockPath, "utf8"));
+    const snapshot = JSON.parse(await readFile10(lockPath, "utf8"));
     const changes = [];
     for (const [name, currentVer] of Object.entries(currentDeps)) {
       const prevVer = snapshot.deps[name];
@@ -3887,22 +4160,22 @@ async function trackDependencies(projectRoot, haiveDir, manifestFiles) {
       }
     }
     if (changes.length > 0) {
-      results.push({ file: path11.relative(projectRoot, manifestPath), changes });
+      results.push({ file: path12.relative(projectRoot, manifestPath), changes });
       const updated = {
         ...snapshot,
         captured_at: (/* @__PURE__ */ new Date()).toISOString(),
         deps: currentDeps
       };
-      await writeFile6(lockPath, JSON.stringify(updated, null, 2) + "\n", "utf8");
+      await writeFile7(lockPath, JSON.stringify(updated, null, 2) + "\n", "utf8");
     }
   }
   return results;
 }
 
 // src/contract-watcher.ts
-import { existsSync as existsSync10 } from "fs";
-import { readFile as readFile10, writeFile as writeFile7, mkdir as mkdir7 } from "fs/promises";
-import path12 from "path";
+import { existsSync as existsSync11 } from "fs";
+import { readFile as readFile11, writeFile as writeFile8, mkdir as mkdir8 } from "fs/promises";
+import path13 from "path";
 import crypto from "crypto";
 function sha256(content) {
   return crypto.createHash("sha256").update(content).digest("hex");
@@ -4105,14 +4378,14 @@ function diffSnapshots(before, after) {
   return changes;
 }
 function contractLockPath(haiveDir, name) {
-  return path12.join(haiveDir, "contracts", `${name}.lock`);
+  return path13.join(haiveDir, "contracts", `${name}.lock`);
 }
 async function snapshotContract(projectRoot, haiveDir, contract) {
-  const filePath = path12.resolve(projectRoot, contract.path);
-  if (!existsSync10(filePath)) {
+  const filePath = path13.resolve(projectRoot, contract.path);
+  if (!existsSync11(filePath)) {
     throw new Error(`Contract file not found: ${filePath}`);
   }
-  const content = await readFile10(filePath, "utf8");
+  const content = await readFile11(filePath, "utf8");
   const parsed = parseByFormat(content, contract.format, filePath);
   const snapshot = {
     name: contract.name,
@@ -4122,23 +4395,23 @@ async function snapshotContract(projectRoot, haiveDir, contract) {
     hash: sha256(content),
     ...parsed
   };
-  const contractsDir = path12.join(haiveDir, "contracts");
-  await mkdir7(contractsDir, { recursive: true });
-  await writeFile7(contractLockPath(haiveDir, contract.name), JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+  const contractsDir = path13.join(haiveDir, "contracts");
+  await mkdir8(contractsDir, { recursive: true });
+  await writeFile8(contractLockPath(haiveDir, contract.name), JSON.stringify(snapshot, null, 2) + "\n", "utf8");
   return snapshot;
 }
 async function diffContract(projectRoot, haiveDir, contract) {
-  const filePath = path12.resolve(projectRoot, contract.path);
-  if (!existsSync10(filePath)) {
+  const filePath = path13.resolve(projectRoot, contract.path);
+  if (!existsSync11(filePath)) {
     return { contract: contract.name, file: contract.path, changes: [], unchanged: true };
   }
   const lockPath = contractLockPath(haiveDir, contract.name);
-  if (!existsSync10(lockPath)) {
+  if (!existsSync11(lockPath)) {
     await snapshotContract(projectRoot, haiveDir, contract);
     return { contract: contract.name, file: contract.path, changes: [], unchanged: true };
   }
-  const content = await readFile10(filePath, "utf8");
-  const beforeSnapshot = JSON.parse(await readFile10(lockPath, "utf8"));
+  const content = await readFile11(filePath, "utf8");
+  const beforeSnapshot = JSON.parse(await readFile11(lockPath, "utf8"));
   const afterParsed = parseByFormat(content, contract.format, filePath);
   const afterSnapshot = {
     ...beforeSnapshot,
@@ -4148,7 +4421,7 @@ async function diffContract(projectRoot, haiveDir, contract) {
   };
   const changes = diffSnapshots(beforeSnapshot, afterSnapshot);
   if (changes.length > 0) {
-    await writeFile7(lockPath, JSON.stringify(afterSnapshot, null, 2) + "\n", "utf8");
+    await writeFile8(lockPath, JSON.stringify(afterSnapshot, null, 2) + "\n", "utf8");
   }
   return {
     contract: contract.name,
@@ -4166,27 +4439,27 @@ async function watchContracts(projectRoot, haiveDir, contractFiles) {
 }
 
 // src/usage-log.ts
-import { appendFile as appendFile2, mkdir as mkdir8, readFile as readFile11, stat as stat2 } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
-import path13 from "path";
+import { appendFile as appendFile2, mkdir as mkdir9, readFile as readFile12, stat as stat3 } from "fs/promises";
+import { existsSync as existsSync12 } from "fs";
+import path14 from "path";
 var USAGE_LOG_FILE = "tool-usage.jsonl";
 var USAGE_LOG_DIR = ".usage";
 function usageLogPath(paths) {
-  return path13.join(paths.haiveDir, USAGE_LOG_DIR, USAGE_LOG_FILE);
+  return path14.join(paths.haiveDir, USAGE_LOG_DIR, USAGE_LOG_FILE);
 }
 async function appendUsageEvent(paths, event) {
   try {
     const file = usageLogPath(paths);
-    const dir = path13.dirname(file);
-    if (!existsSync11(dir)) await mkdir8(dir, { recursive: true });
+    const dir = path14.dirname(file);
+    if (!existsSync12(dir)) await mkdir9(dir, { recursive: true });
     await appendFile2(file, JSON.stringify(event) + "\n", "utf8");
   } catch {
   }
 }
 async function readUsageEvents(paths) {
   const file = usageLogPath(paths);
-  if (!existsSync11(file)) return [];
-  const raw = await readFile11(file, "utf8");
+  if (!existsSync12(file)) return [];
+  const raw = await readFile12(file, "utf8");
   const out = [];
   for (const line of raw.split("\n")) {
     if (!line) continue;
@@ -4235,25 +4508,25 @@ function parseSince(input) {
 }
 async function usageLogSize(paths) {
   const file = usageLogPath(paths);
-  if (!existsSync11(file)) return { exists: false, size_bytes: 0, lines: 0 };
-  const st = await stat2(file);
-  const raw = await readFile11(file, "utf8");
+  if (!existsSync12(file)) return { exists: false, size_bytes: 0, lines: 0 };
+  const st = await stat3(file);
+  const raw = await readFile12(file, "utf8");
   return { exists: true, size_bytes: st.size, lines: raw.split("\n").filter((l) => l).length };
 }
 
 // src/friction.ts
-import { appendFile as appendFile3, mkdir as mkdir9, readFile as readFile12, writeFile as writeFile8 } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
-import { createHash as createHash2 } from "crypto";
-import path14 from "path";
+import { appendFile as appendFile3, mkdir as mkdir10, readFile as readFile13, writeFile as writeFile9 } from "fs/promises";
+import { existsSync as existsSync13 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import path15 from "path";
 var FRICTION_LOG_FILE = "friction.jsonl";
 var FRICTION_STATE_FILE = "friction-state.json";
 var FRICTION_FIELD_MAX = 2e3;
 function frictionLogPath(paths) {
-  return path14.join(paths.runtimeDir, FRICTION_LOG_FILE);
+  return path15.join(paths.runtimeDir, FRICTION_LOG_FILE);
 }
 function frictionStatePath(paths) {
-  return path14.join(paths.runtimeDir, FRICTION_STATE_FILE);
+  return path15.join(paths.runtimeDir, FRICTION_STATE_FILE);
 }
 function normalizeFrictionSummary(value) {
   return value.toLowerCase().replace(/[a-z]?:?[\\/](?:[\w.-]+[\\/])+/g, "/").replace(/\d{3,}/g, "N").replace(/\s+/g, " ").trim();
@@ -4264,7 +4537,7 @@ function frictionFingerprint(input) {
     input.surface.trim().toLowerCase(),
     normalizeFrictionSummary(input.summary)
   ].join("|");
-  return createHash2("sha256").update(basis).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(basis).digest("hex").slice(0, 16);
 }
 function truncate(value) {
   if (value === void 0) return void 0;
@@ -4298,7 +4571,7 @@ async function appendFrictionReport(paths, input) {
   };
   const prior = (await readFrictionReports(paths)).filter((r) => r.fingerprint === fingerprint);
   try {
-    if (!existsSync12(paths.runtimeDir)) await mkdir9(paths.runtimeDir, { recursive: true });
+    if (!existsSync13(paths.runtimeDir)) await mkdir10(paths.runtimeDir, { recursive: true });
     await appendFile3(frictionLogPath(paths), JSON.stringify(report) + "\n", "utf8");
   } catch {
   }
@@ -4312,10 +4585,10 @@ async function appendFrictionReport(paths, input) {
 }
 async function readFrictionReports(paths) {
   const file = frictionLogPath(paths);
-  if (!existsSync12(file)) return [];
+  if (!existsSync13(file)) return [];
   let raw;
   try {
-    raw = await readFile12(file, "utf8");
+    raw = await readFile13(file, "utf8");
   } catch {
     return [];
   }
@@ -4332,17 +4605,17 @@ async function readFrictionReports(paths) {
 }
 async function loadFrictionState(paths) {
   const file = frictionStatePath(paths);
-  if (!existsSync12(file)) return {};
+  if (!existsSync13(file)) return {};
   try {
-    const parsed = JSON.parse(await readFile12(file, "utf8"));
+    const parsed = JSON.parse(await readFile13(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
   }
 }
 async function saveFrictionState(paths, state) {
-  if (!existsSync12(paths.runtimeDir)) await mkdir9(paths.runtimeDir, { recursive: true });
-  await writeFile8(frictionStatePath(paths), JSON.stringify(state, null, 2) + "\n", "utf8");
+  if (!existsSync13(paths.runtimeDir)) await mkdir10(paths.runtimeDir, { recursive: true });
+  await writeFile9(frictionStatePath(paths), JSON.stringify(state, null, 2) + "\n", "utf8");
 }
 async function setFrictionStatus(paths, fingerprint, status, url) {
   const state = await loadFrictionState(paths);
@@ -4479,21 +4752,21 @@ function extractActionsBriefBody(markdown, maxChars = MAX_DEFAULT_CHARS) {
 }
 
 // src/resolve-project.ts
-import { existsSync as existsSync13 } from "fs";
-import path15 from "path";
+import { existsSync as existsSync14 } from "fs";
+import path16 from "path";
 var ROOT_MARKERS2 = [".ai", ".git", "package.json"];
 function markersAtRoot(root) {
   const found = [];
   for (const m of ROOT_MARKERS2) {
-    if (existsSync13(path15.join(root, m))) found.push(m);
+    if (existsSync14(path16.join(root, m))) found.push(m);
   }
   return found;
 }
 function resolveProjectInfo(opts = {}) {
   const env = opts.env ?? process.env;
-  const cwd = path15.resolve(opts.cwd ?? process.cwd());
+  const cwd = path16.resolve(opts.cwd ?? process.cwd());
   const raw = env.HAIVE_PROJECT_ROOT;
-  const explicit = raw !== void 0 && raw !== "" ? path15.resolve(raw) : null;
+  const explicit = raw !== void 0 && raw !== "" ? path16.resolve(raw) : null;
   const resolvedRoot = explicit ?? findProjectRoot(cwd);
   const paths = resolveHaivePaths(resolvedRoot);
   return {
@@ -4501,8 +4774,8 @@ function resolveProjectInfo(opts = {}) {
     resolved_root: resolvedRoot,
     haive_project_root_env: explicit,
     explicit_root: explicit != null,
-    haive_dir_exists: existsSync13(paths.haiveDir),
-    memories_dir_exists: existsSync13(paths.memoriesDir),
+    haive_dir_exists: existsSync14(paths.haiveDir),
+    memories_dir_exists: existsSync14(paths.memoriesDir),
     runtime_dir: paths.runtimeDir,
     markers_found: markersAtRoot(resolvedRoot)
   };
@@ -4757,16 +5030,16 @@ function findLexicalConflictPairs(memories, opts) {
 }
 
 // src/runtime-journal.ts
-import { mkdir as mkdir10, readFile as readFile13, appendFile as appendFile4 } from "fs/promises";
-import { existsSync as existsSync14 } from "fs";
-import path16 from "path";
+import { mkdir as mkdir11, readFile as readFile14, appendFile as appendFile4 } from "fs/promises";
+import { existsSync as existsSync15 } from "fs";
+import path17 from "path";
 var RUNTIME_JOURNAL_FILENAME = "session-journal.ndjson";
 function runtimeJournalPath(paths) {
-  return path16.join(paths.runtimeDir, RUNTIME_JOURNAL_FILENAME);
+  return path17.join(paths.runtimeDir, RUNTIME_JOURNAL_FILENAME);
 }
 async function appendRuntimeJournalEntry(paths, entry) {
   try {
-    await mkdir10(paths.runtimeDir, { recursive: true });
+    await mkdir11(paths.runtimeDir, { recursive: true });
     const line = {
       ts: entry.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
       kind: entry.kind,
@@ -4784,9 +5057,9 @@ async function appendRuntimeJournalEntry(paths, entry) {
 }
 async function readRuntimeJournalTail(paths, limit) {
   const file = runtimeJournalPath(paths);
-  if (!existsSync14(file) || limit <= 0) return [];
+  if (!existsSync15(file) || limit <= 0) return [];
   try {
-    const raw = await readFile13(file, "utf8");
+    const raw = await readFile14(file, "utf8");
     const lines = raw.trim().split("\n").filter(Boolean);
     const parsed = [];
     for (const line of lines.slice(-limit)) {
@@ -4802,22 +5075,22 @@ async function readRuntimeJournalTail(paths, limit) {
 }
 
 // src/enforcement.ts
-import { mkdir as mkdir11, readdir as readdir4, readFile as readFile14, writeFile as writeFile9 } from "fs/promises";
-import { existsSync as existsSync15 } from "fs";
-import path17 from "path";
+import { mkdir as mkdir12, readdir as readdir4, readFile as readFile15, writeFile as writeFile10 } from "fs/promises";
+import { existsSync as existsSync16 } from "fs";
+import path18 from "path";
 var BRIEFING_MARKER_TTL_MS = 12 * 60 * 60 * 1e3;
 var SESSION_RECAP_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 function enforcementDir(paths) {
-  return path17.join(paths.runtimeDir, "enforcement");
+  return path18.join(paths.runtimeDir, "enforcement");
 }
 function briefingMarkersDir(paths) {
-  return path17.join(enforcementDir(paths), "briefings");
+  return path18.join(enforcementDir(paths), "briefings");
 }
 function normalizeSessionId(sessionId) {
   return (sessionId?.trim() || "default").replace(/[^a-zA-Z0-9_.-]+/g, "-").slice(0, 120);
 }
 function briefingMarkerPath(paths, sessionId) {
-  return path17.join(briefingMarkersDir(paths), `${normalizeSessionId(sessionId)}.json`);
+  return path18.join(briefingMarkersDir(paths), `${normalizeSessionId(sessionId)}.json`);
 }
 async function writeBriefingMarker(paths, input) {
   const sessionId = normalizeSessionId(input.sessionId);
@@ -4842,8 +5115,8 @@ async function writeBriefingMarker(paths, input) {
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     root: paths.root
   };
-  await mkdir11(briefingMarkersDir(paths), { recursive: true });
-  await writeFile9(
+  await mkdir12(briefingMarkersDir(paths), { recursive: true });
+  await writeFile10(
     briefingMarkerPath(paths, marker.session_id),
     JSON.stringify(marker, null, 2) + "\n",
     "utf8"
@@ -4852,9 +5125,9 @@ async function writeBriefingMarker(paths, input) {
 }
 async function readSessionBriefingMarker(paths, sessionId, ttlMs = BRIEFING_MARKER_TTL_MS) {
   const file = briefingMarkerPath(paths, sessionId);
-  if (!existsSync15(file)) return null;
+  if (!existsSync16(file)) return null;
   try {
-    const marker = JSON.parse(await readFile14(file, "utf8"));
+    const marker = JSON.parse(await readFile15(file, "utf8"));
     const created = Date.parse(marker.created_at);
     if (!Number.isFinite(created) || Date.now() - created > ttlMs) return null;
     return marker;
@@ -4866,18 +5139,18 @@ async function hasRecentBriefingMarker(paths, sessionId, ttlMs = BRIEFING_MARKER
   const now = Date.now();
   const candidates = [];
   const exact = briefingMarkerPath(paths, sessionId);
-  if (existsSync15(exact)) candidates.push(exact);
+  if (existsSync16(exact)) candidates.push(exact);
   try {
     const dir = briefingMarkersDir(paths);
     const files = await readdir4(dir);
     for (const file of files) {
-      if (file.endsWith(".json")) candidates.push(path17.join(dir, file));
+      if (file.endsWith(".json")) candidates.push(path18.join(dir, file));
     }
   } catch {
   }
   for (const file of new Set(candidates)) {
     try {
-      const marker = JSON.parse(await readFile14(file, "utf8"));
+      const marker = JSON.parse(await readFile15(file, "utf8"));
       const created = Date.parse(marker.created_at);
       if (Number.isFinite(created) && now - created <= ttlMs) return true;
     } catch {
@@ -4889,12 +5162,12 @@ async function readRecentBriefingMarker(paths, sessionId, ttlMs = BRIEFING_MARKE
   const now = Date.now();
   const candidates = [];
   const exact = briefingMarkerPath(paths, sessionId);
-  if (existsSync15(exact)) candidates.push(exact);
+  if (existsSync16(exact)) candidates.push(exact);
   try {
     const dir = briefingMarkersDir(paths);
     const files = await readdir4(dir);
     for (const file of files) {
-      if (file.endsWith(".json")) candidates.push(path17.join(dir, file));
+      if (file.endsWith(".json")) candidates.push(path18.join(dir, file));
     }
   } catch {
   }
@@ -4902,7 +5175,7 @@ async function readRecentBriefingMarker(paths, sessionId, ttlMs = BRIEFING_MARKE
   let freshestTs = 0;
   for (const file of new Set(candidates)) {
     try {
-      const marker = JSON.parse(await readFile14(file, "utf8"));
+      const marker = JSON.parse(await readFile15(file, "utf8"));
       const created = Date.parse(marker.created_at);
       if (!Number.isFinite(created) || now - created > ttlMs) continue;
       if (created > freshestTs) {
@@ -4952,15 +5225,15 @@ function isRetiredMemory(fm, body = "", now = /* @__PURE__ */ new Date()) {
 }
 
 // src/sensor-ledger.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync2 } from "fs";
-import { appendFile as appendFile5, mkdir as mkdir12, readFile as readFile15, rename, writeFile as writeFile10 } from "fs/promises";
-import path18 from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync17, readFileSync as readFileSync2 } from "fs";
+import { appendFile as appendFile5, mkdir as mkdir13, readFile as readFile16, rename, writeFile as writeFile11 } from "fs/promises";
+import path19 from "path";
 var MAX_LINES = 1e4;
 var RETAINED_LINES = 8e3;
 var DAY_MS = 864e5;
 function sensorLedgerPath(paths) {
-  return path18.join(paths.runtimeDir, "enforcement", "sensor-ledger.ndjson");
+  return path19.join(paths.runtimeDir, "enforcement", "sensor-ledger.ndjson");
 }
 function isEvaluation(value) {
   if (!value || typeof value !== "object") return false;
@@ -4971,13 +5244,13 @@ async function appendSensorEvaluations(paths, evaluations) {
   if (evaluations.length === 0) return;
   try {
     const file = sensorLedgerPath(paths);
-    await mkdir12(path18.dirname(file), { recursive: true });
+    await mkdir13(path19.dirname(file), { recursive: true });
     await appendFile5(file, evaluations.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf8");
-    const raw = await readFile15(file, "utf8");
+    const raw = await readFile16(file, "utf8");
     const lines = raw.split("\n").filter(Boolean);
     if (lines.length > MAX_LINES) {
       const temp = `${file}.${process.pid}.tmp`;
-      await writeFile10(temp, lines.slice(-RETAINED_LINES).join("\n") + "\n", "utf8");
+      await writeFile11(temp, lines.slice(-RETAINED_LINES).join("\n") + "\n", "utf8");
       await rename(temp, file);
     }
   } catch {
@@ -4986,9 +5259,9 @@ async function appendSensorEvaluations(paths, evaluations) {
 async function loadSensorLedger(paths, opts = {}) {
   try {
     const file = sensorLedgerPath(paths);
-    if (!existsSync16(file)) return [];
+    if (!existsSync17(file)) return [];
     const since = opts.since ? Date.parse(opts.since) : Number.NEGATIVE_INFINITY;
-    const raw = await readFile15(file, "utf8");
+    const raw = await readFile16(file, "utf8");
     const out = [];
     for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
@@ -5010,11 +5283,11 @@ function computeScopeHash(root, scopedFiles) {
   try {
     const files = [...new Set(scopedFiles.map((f) => f.replace(/\\/g, "/")))].sort();
     if (files.length === 0) return "";
-    const hash = createHash3("sha256");
+    const hash = createHash4("sha256");
     let included = 0;
     for (const rel of files) {
-      const abs = path18.resolve(root, rel);
-      if (!existsSync16(abs)) continue;
+      const abs = path19.resolve(root, rel);
+      if (!existsSync17(abs)) continue;
       try {
         hash.update(rel);
         hash.update("\0");
@@ -5748,8 +6021,8 @@ function normalizeFindingSeverity(raw) {
       return "info";
   }
 }
-function findingKey(tool, ruleId, path21) {
-  return `${tool}:${ruleId}:${path21}`;
+function findingKey(tool, ruleId, path22) {
+  return `${tool}:${ruleId}:${path22}`;
 }
 function coerceJson(input) {
   if (typeof input === "string") {
@@ -5783,8 +6056,8 @@ function parseSarif(input) {
       const physical = asRecord(location.physicalLocation);
       const artifact = asRecord(physical.artifactLocation);
       const region = asRecord(physical.region);
-      const path21 = typeof artifact.uri === "string" ? normalizeUri(artifact.uri) : "";
-      if (!path21) continue;
+      const path22 = typeof artifact.uri === "string" ? normalizeUri(artifact.uri) : "";
+      if (!path22) continue;
       const line = typeof region.startLine === "number" ? region.startLine : void 0;
       const snippet = typeof asRecord(region.snippet).text === "string" ? asRecord(region.snippet).text.trim() : void 0;
       findings.push({
@@ -5792,10 +6065,10 @@ function parseSarif(input) {
         ruleId,
         message: message.trim(),
         severity,
-        path: path21,
+        path: path22,
         ...line !== void 0 ? { line } : {},
         ...snippet ? { snippet } : {},
-        key: findingKey(tool, ruleId, path21)
+        key: findingKey(tool, ruleId, path22)
       });
     }
   }
@@ -5814,17 +6087,17 @@ function parseSonar(input) {
       (typeof issue.severity === "string" ? issue.severity : void 0) ?? impactSeverity
     );
     const component = typeof issue.component === "string" ? issue.component : "";
-    const path21 = componentToPath(component);
-    if (!path21) continue;
+    const path22 = componentToPath(component);
+    if (!path22) continue;
     const line = typeof issue.line === "number" ? issue.line : void 0;
     findings.push({
       tool: "sonar",
       ruleId,
       message,
       severity,
-      path: path21,
+      path: path22,
       ...line !== void 0 ? { line } : {},
-      key: findingKey("sonar", ruleId, path21)
+      key: findingKey("sonar", ruleId, path22)
     });
   }
   return findings;
@@ -5837,7 +6110,7 @@ function parseEslintJson(input, opts = {}) {
     const file = asRecord(fileRaw);
     const rawPath = typeof file.filePath === "string" ? file.filePath : "";
     if (!rawPath) continue;
-    const path21 = cwd && rawPath.startsWith(cwd) ? rawPath.slice(cwd.length) : rawPath;
+    const path22 = cwd && rawPath.startsWith(cwd) ? rawPath.slice(cwd.length) : rawPath;
     for (const msgRaw of asArray(file.messages)) {
       const msg = asRecord(msgRaw);
       const ruleId = typeof msg.ruleId === "string" && msg.ruleId ? msg.ruleId : "parse-error";
@@ -5849,9 +6122,9 @@ function parseEslintJson(input, opts = {}) {
         ruleId,
         message,
         severity,
-        path: path21,
+        path: path22,
         ...line !== void 0 ? { line } : {},
-        key: findingKey("eslint", ruleId, path21)
+        key: findingKey("eslint", ruleId, path22)
       });
     }
   }
@@ -6301,7 +6574,7 @@ function tallyHotFiles(paths, source = "agent") {
     if (!norm) continue;
     counts.set(norm, (counts.get(norm) ?? 0) + 1);
   }
-  return [...counts.entries()].map(([path21, changes]) => ({ path: path21, changes, source })).sort((a, b) => b.changes - a.changes);
+  return [...counts.entries()].map(([path22, changes]) => ({ path: path22, changes, source })).sort((a, b) => b.changes - a.changes);
 }
 function mergeHotFiles(a, b) {
   const merged = /* @__PURE__ */ new Map();
@@ -6321,21 +6594,21 @@ function mergeHotFiles(a, b) {
 }
 
 // src/eval-history.ts
-import { appendFile as appendFile6, mkdir as mkdir13, readFile as readFile16 } from "fs/promises";
-import { existsSync as existsSync17 } from "fs";
-import path19 from "path";
+import { appendFile as appendFile6, mkdir as mkdir14, readFile as readFile17 } from "fs/promises";
+import { existsSync as existsSync18 } from "fs";
+import path20 from "path";
 function evalHistoryPath(paths) {
-  return path19.join(paths.haiveDir, ".cache", "eval-history.jsonl");
+  return path20.join(paths.haiveDir, ".cache", "eval-history.jsonl");
 }
 async function appendEvalHistory(paths, entry) {
   const file = evalHistoryPath(paths);
-  await mkdir13(path19.dirname(file), { recursive: true });
+  await mkdir14(path20.dirname(file), { recursive: true });
   await appendFile6(file, JSON.stringify(entry) + "\n", "utf8");
 }
 async function loadEvalHistory(paths) {
   const file = evalHistoryPath(paths);
-  if (!existsSync17(file)) return [];
-  const raw = await readFile16(file, "utf8").catch(() => "");
+  if (!existsSync18(file)) return [];
+  const raw = await readFile17(file, "utf8").catch(() => "");
   const out = [];
   for (const line of raw.split("\n")) {
     const trimmed = line.trim();
@@ -6678,12 +6951,12 @@ ${trimmed}`;
 }
 
 // src/handoff.ts
-import { writeFile as writeFile11, readFile as readFile17, stat as stat3 } from "fs/promises";
-import { existsSync as existsSync18 } from "fs";
-import path20 from "path";
+import { writeFile as writeFile12, readFile as readFile18, stat as stat4 } from "fs/promises";
+import { existsSync as existsSync19 } from "fs";
+import path21 from "path";
 var HANDOFF_FILENAME = "NEXT.md";
 function handoffFilePath(root) {
-  return path20.join(root, HANDOFF_FILENAME);
+  return path21.join(root, HANDOFF_FILENAME);
 }
 function buildHandoffMarkdown(data) {
   const at = (data.at ?? /* @__PURE__ */ new Date()).toISOString();
@@ -6732,20 +7005,20 @@ function buildHandoffMarkdown(data) {
 }
 async function writeSessionHandoff(root, data) {
   const file = handoffFilePath(root);
-  await writeFile11(file, buildHandoffMarkdown(data), "utf8");
+  await writeFile12(file, buildHandoffMarkdown(data), "utf8");
   return file;
 }
 async function readSessionHandoff(root) {
   const file = handoffFilePath(root);
-  if (!existsSync18(file)) return null;
-  const raw = await readFile17(file, "utf8").catch(() => "");
+  if (!existsSync19(file)) return null;
+  const raw = await readFile18(file, "utf8").catch(() => "");
   return raw.trim() ? raw : null;
 }
 async function handoffAgeMs(root, now = /* @__PURE__ */ new Date()) {
   const file = handoffFilePath(root);
-  if (!existsSync18(file)) return null;
+  if (!existsSync19(file)) return null;
   try {
-    const s = await stat3(file);
+    const s = await stat4(file);
     return Math.max(0, now.getTime() - s.mtimeMs);
   } catch {
     return null;
@@ -6870,6 +7143,7 @@ export {
   CODE_MAP_FILE,
   CODE_STOPWORDS,
   CONFIG_FILE,
+  CONTENT_CATCH_CODES,
   CrossRepoProvenanceSchema,
   DECAY_DAYS,
   DEFAULT_AUTO_PROMOTE_RULE,
@@ -6877,11 +7151,13 @@ export {
   DEFAULT_CONFIDENCE_THRESHOLDS,
   DEFAULT_CONFIG,
   DEFAULT_DORMANT_DAYS,
+  DEFAULT_POSTURE,
   DEFAULT_PRIORITY_SIGNALS,
   ENV_WORKAROUND_TAGS,
   FRICTION_FIELD_MAX,
   FRICTION_LOG_FILE,
   FRICTION_STATE_FILE,
+  GATE_REMINDER_WINDOW_MS,
   GUESSABLE_THRESHOLD,
   HAIVE_DIR,
   HAIVE_OWNED_FILES,
@@ -6895,6 +7171,8 @@ export {
   MemoryStatusSchema,
   MemoryTypeSchema,
   PREVENTION_DEBOUNCE_MS,
+  PREVENTION_RECEIPT_MARKER,
+  PROCESS_GATE_CODES,
   PROJECT_CONTEXT_FILE,
   PROJECT_CONTEXT_THROTTLE_MS,
   REVIEW_LEARNING_MARKER,
@@ -6904,6 +7182,7 @@ export {
   SENSOR_ABSENT_LOOKBACK,
   SENSOR_ABSENT_WINDOW,
   SESSION_RECAP_TTL_MS,
+  SETUP_GATE_CODES,
   STACK_PACK_TAG,
   SensorSchema,
   TEST_FRAMEWORKS,
@@ -6936,6 +7215,7 @@ export {
   briefingMarkerPath,
   briefingMarkersDir,
   briefingProofLine,
+  buildBaselineHealthFinding,
   buildCodeMap,
   buildCoverageIndex,
   buildDashboard,
@@ -6947,6 +7227,7 @@ export {
   buildReport,
   bumpRead,
   classifyMemoryPriority,
+  codeMapContentHash,
   codeMapPath,
   collectTimelineEntries,
   compactAutoRecapBody,
@@ -6955,6 +7236,7 @@ export {
   compareImpact,
   compileRegexSensor,
   componentOf,
+  computeBaselineHealth,
   computeEvalTrend,
   computeGatePrecision,
   computeImpact,
@@ -6964,8 +7246,11 @@ export {
   configPath,
   contractLockPath,
   countSourceFilesOnDisk,
+  decideVerdict,
+  dedupeRefusals,
   deriveConfidence,
   deriveMainAreas,
+  describePosture,
   detectAgentContext,
   detectSensorWeakening,
   detectStacksFromManifests,
@@ -6981,6 +7266,7 @@ export {
   evalHistoryPath,
   evaluateSkillActivation,
   existingGateMissShas,
+  explainSensorRejection,
   extractActionsBriefBody,
   extractCorrectApproachExamples,
   extractReferencedPaths,
@@ -7098,6 +7384,7 @@ export {
   readUsageEvents,
   recommendFeedbackAdjustment,
   recordApplied,
+  recordGateReminder,
   recordPrevention,
   recordPreventionHits,
   recordProjectContextEmission,
@@ -7106,10 +7393,12 @@ export {
   renderBehaviourCoverageLine,
   renderBootstrapChecklist,
   renderCaughtForYou,
+  renderPreventionComment,
   renderPreventionReceipt,
   renderPreventionReceiptShare,
   resolveBriefingBudget,
   resolveConfigPath,
+  resolveGatePolicy,
   resolveHaivePaths,
   resolveManifestFiles,
   resolveProjectInfo,
@@ -7137,8 +7426,10 @@ export {
   sensorPromotedAtMap,
   sensorSelfCheck,
   sensorTargetsFromDiff,
+  serializeCodeMap,
   serializeMemory,
   setFrictionStatus,
+  shouldExpandGateReminder,
   snapshotContract,
   specificityScore,
   stripPrivate,