@inerrata-corporation/errata 2.0.6-dev.2198 → 2.0.6-dev.2250

package/errata.mjs

@@ -15984,12 +15984,35 @@ var init_project_symbol = __esm({
 });
 
 // ../../packages/shared/src/lockfile.ts
+function rankDirect(raw2, ecosystem = "npm") {
+  const byName = /* @__PURE__ */ new Map();
+  for (const { name: name2, version: version2 } of raw2) {
+    const prev = byName.get(name2);
+    if (prev) {
+      prev.importers++;
+      continue;
+    }
+    byName.set(name2, {
+      purl: `pkg:${ecosystem}/${name2}@${version2}`,
+      name: name2,
+      version: version2,
+      ecosystem,
+      importers: 1
+    });
+  }
+  return [...byName.values()].sort(
+    (a, b) => b.importers - a.importers || a.name.localeCompare(b.name)
+  );
+}
 function npmPurl(name2, version2) {
   return `pkg:npm/${name2}@${version2}`;
 }
 function component(name2, version2) {
   return { purl: npmPurl(name2, version2), name: name2, version: version2, ecosystem: "npm" };
 }
+function isNpmImporterPath(path2) {
+  return path2 === "" || !path2.includes("node_modules/");
+}
 function parsePackageLockJson(jsonText) {
   let doc;
   try {
@@ -16028,7 +16051,23 @@ function parsePackageLockJson(jsonText) {
     if (dependsOn.length > 0)
       dependencies.push({ ref: npmPurl(self.name, self.version), dependsOn });
   }
-  return { components, dependencies: dedupeRefs(dependencies) };
+  const directRaw = [];
+  for (const [path2, meta3] of Object.entries(packages)) {
+    if (!isNpmImporterPath(path2)) continue;
+    for (const section of [meta3.dependencies, meta3.devDependencies, meta3.optionalDependencies]) {
+      if (!section || typeof section !== "object") continue;
+      for (const name2 of Object.keys(section)) {
+        const target = hoisted.get(name2);
+        if (target) directRaw.push({ name: name2, version: target.version });
+      }
+    }
+  }
+  const direct = rankDirect(directRaw);
+  return {
+    components,
+    dependencies: dedupeRefs(dependencies),
+    ...direct.length > 0 ? { direct } : {}
+  };
 }
 function splitPnpmKey(raw2) {
   let k = raw2.trim().replace(/^['"]|['"]$/g, "");
@@ -16043,6 +16082,53 @@ function splitPnpmKey(raw2) {
   if (!name2 || !version2) return null;
   return { name: name2, version: version2 };
 }
+function parsePnpmImporters(lines) {
+  const DEP_SECTIONS = /* @__PURE__ */ new Set(["dependencies:", "devDependencies:", "optionalDependencies:"]);
+  const raw2 = [];
+  let inImporters = false;
+  let inDepSection = false;
+  let depName = null;
+  for (const line of lines) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    if (indent === 0) {
+      inImporters = line.trimEnd() === "importers:";
+      inDepSection = false;
+      depName = null;
+      continue;
+    }
+    if (!inImporters) continue;
+    if (indent === 2) {
+      inDepSection = false;
+      depName = null;
+      continue;
+    }
+    if (indent === 4) {
+      inDepSection = DEP_SECTIONS.has(line.trim());
+      depName = null;
+      continue;
+    }
+    if (!inDepSection) continue;
+    if (indent === 6 && line.trimEnd().endsWith(":")) {
+      depName = line.trim().slice(0, -1).replace(/^['"]|['"]$/g, "") || null;
+      continue;
+    }
+    if (indent === 8 && depName) {
+      const t = line.trim();
+      if (!t.startsWith("version:")) continue;
+      let version2 = t.slice("version:".length).trim().replace(/^['"]|['"]$/g, "");
+      const paren = version2.indexOf("(");
+      if (paren !== -1) version2 = version2.slice(0, paren);
+      if (!version2 || version2.startsWith("link:") || version2.startsWith("file:") || version2.includes("://")) {
+        depName = null;
+        continue;
+      }
+      raw2.push({ name: depName, version: version2 });
+      depName = null;
+    }
+  }
+  return rankDirect(raw2);
+}
 function parsePnpmLock(text) {
   const lines = text.split(/\r?\n/);
   const components = [];
@@ -16104,7 +16190,92 @@ function parsePnpmLock(text) {
     }
   }
   flushDeps();
-  return { components, dependencies: dedupeRefs(dependencies) };
+  const direct = parsePnpmImporters(lines);
+  return {
+    components,
+    dependencies: dedupeRefs(dependencies),
+    ...direct.length > 0 ? { direct } : {}
+  };
+}
+function parseGemfileLock(text) {
+  const lines = text.split(/\r?\n/);
+  const components = [];
+  const dependencies = [];
+  const seen = /* @__PURE__ */ new Set();
+  const registryVersions = /* @__PURE__ */ new Map();
+  const nonRegistry = /* @__PURE__ */ new Set();
+  const declared = [];
+  let section = null;
+  let inSpecs = false;
+  let currentGem = null;
+  const specLine = /^\s{4}([A-Za-z0-9_.-]+)\s*\(([^)]*)\)\s*$/;
+  const nestedDep = /^\s{6}([A-Za-z0-9_.-]+)/;
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    if (!/^\s/.test(line)) {
+      const header = line.trim();
+      section = header === "GEM" ? "gem" : header === "PATH" || header === "GIT" || header === "PLUGIN SOURCE" ? "path-or-git" : header === "DEPENDENCIES" ? "dependencies" : null;
+      inSpecs = false;
+      currentGem = null;
+      continue;
+    }
+    if (section === "dependencies") {
+      const d = /^\s{2}([A-Za-z0-9_.-]+)(!?)/.exec(line);
+      if (d?.[1] && d[2] !== "!") declared.push(d[1]);
+      continue;
+    }
+    if (!section) continue;
+    if (/^\s{2}specs:\s*$/.test(line)) {
+      inSpecs = true;
+      currentGem = null;
+      continue;
+    }
+    if (/^\s{2}\S/.test(line)) {
+      inSpecs = false;
+      currentGem = null;
+      continue;
+    }
+    if (!inSpecs) continue;
+    const spec = specLine.exec(line);
+    if (spec) {
+      const name2 = spec[1];
+      const version2 = (spec[2] ?? "").trim();
+      if (section === "path-or-git") {
+        nonRegistry.add(name2);
+        currentGem = null;
+        continue;
+      }
+      if (!version2) continue;
+      currentGem = { name: name2, version: version2 };
+      registryVersions.set(name2, version2);
+      const purl = `pkg:gem/${name2}@${version2}`;
+      if (!seen.has(purl)) {
+        seen.add(purl);
+        components.push({ purl, name: name2, version: version2, ecosystem: "gem" });
+      }
+      continue;
+    }
+    const nested = nestedDep.exec(line);
+    if (nested?.[1] && currentGem) {
+      dependencies.push({
+        ref: `pkg:gem/${currentGem.name}@${currentGem.version}`,
+        dependsOn: [nested[1]]
+      });
+    }
+  }
+  const resolved = dependencies.map((d) => ({
+    ref: d.ref,
+    dependsOn: d.dependsOn.filter((n) => !nonRegistry.has(n) && registryVersions.has(n)).map((n) => `pkg:gem/${n}@${registryVersions.get(n)}`)
+  })).filter((d) => d.dependsOn.length > 0);
+  const direct = rankDirect(
+    declared.filter((n) => !nonRegistry.has(n) && registryVersions.has(n)).map((n) => ({ name: n, version: registryVersions.get(n) })),
+    "gem"
+  );
+  return {
+    components,
+    dependencies: dedupeRefs(resolved),
+    ...direct.length > 0 ? { direct } : {}
+  };
 }
 function dedupeRefs(deps) {
   const byRef = /* @__PURE__ */ new Map();
@@ -16237,6 +16408,86 @@ function parseCargo(path2, text) {
   }
   return deps;
 }
+function mavenName(groupId, artifactId) {
+  return `${groupId.trim()}:${artifactId.trim()}`;
+}
+function parsePom(path2, text) {
+  const deps = [];
+  const coord = (block) => {
+    const g = /<groupId>([^<]+)<\/groupId>/.exec(block)?.[1];
+    const a = /<artifactId>([^<]+)<\/artifactId>/.exec(block)?.[1];
+    if (!g || !a) return null;
+    return { g, a, v: /<version>([^<]+)<\/version>/.exec(block)?.[1]?.trim() ?? null };
+  };
+  for (const m of text.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const c = coord(m[1] ?? "");
+    if (c) deps.push({ ecosystem: "maven", name: mavenName(c.g, c.a), version: c.v, kind: "package", manifest: path2 });
+  }
+  for (const m of text.matchAll(/<parent>([\s\S]*?)<\/parent>/g)) {
+    const c = coord(m[1] ?? "");
+    if (c) deps.push({ ecosystem: "maven", name: mavenName(c.g, c.a), version: c.v, kind: "sdk", manifest: path2 });
+  }
+  return deps;
+}
+function parseGradle(path2, text) {
+  const deps = [];
+  const re = new RegExp(`\\b(?:${GRADLE_CONFIGS})\\s*(?:\\(\\s*)?["']([^"']+)["']`, "g");
+  for (const m of text.matchAll(re)) {
+    const parts2 = (m[1] ?? "").split(":");
+    const [group, artifact, version2] = parts2;
+    if (!group || !artifact || parts2.length < 2) continue;
+    deps.push({
+      ecosystem: "maven",
+      name: mavenName(group, artifact),
+      version: version2?.trim() || null,
+      kind: "package",
+      manifest: path2
+    });
+  }
+  return deps;
+}
+function parseVersionCatalog(path2, text) {
+  const section = /^\s*\[libraries\]([\s\S]*?)(?=^\s*\[|(?![\s\S]))/m.exec(text);
+  if (!section) return [];
+  const deps = [];
+  for (const line of (section[1] ?? "").split(/\r?\n/)) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const module2 = /module\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
+    const version2 = /version(?:\.ref)?\s*=\s*["']([^"']+)["']/.exec(line)?.[1] ?? null;
+    if (module2) {
+      const [group2, artifact2] = module2.split(":");
+      if (group2 && artifact2) {
+        deps.push({ ecosystem: "maven", name: mavenName(group2, artifact2), version: version2, kind: "package", manifest: path2 });
+      }
+      continue;
+    }
+    const group = /\bgroup\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
+    const artifact = /\bname\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
+    if (group && artifact) {
+      deps.push({ ecosystem: "maven", name: mavenName(group, artifact), version: version2, kind: "package", manifest: path2 });
+    }
+  }
+  return deps;
+}
+function parseGemfile(path2, text) {
+  const deps = [];
+  for (const raw2 of text.split(/\r?\n/)) {
+    const line = (raw2.split("#", 1)[0] ?? "").trim();
+    const m = /^gem\s+["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/.exec(line);
+    if (!m?.[1]) continue;
+    deps.push({ ecosystem: "gem", name: m[1], version: m[2] ?? null, kind: "package", manifest: path2 });
+  }
+  return deps;
+}
+function parseGemspec(path2, text) {
+  const deps = [];
+  for (const m of text.matchAll(
+    /\.add_(?:runtime_|development_)?dependency\s*\(?\s*["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/g
+  )) {
+    if (m[1]) deps.push({ ecosystem: "gem", name: m[1], version: m[2] ?? null, kind: "package", manifest: path2 });
+  }
+  return deps;
+}
 function parseManifest(path2, text) {
   const name2 = basename(path2);
   if (name2.endsWith(".csproj") || name2.endsWith(".fsproj")) return parseCsproj(path2, text);
@@ -16248,12 +16499,17 @@ function parseManifest(path2, text) {
     return parseDocker(path2, text);
   }
   if (name2 === "go.mod") return parseGoMod(path2, text);
+  if (name2 === "libs.versions.toml") return parseVersionCatalog(path2, text);
   if (name2 === "Cargo.toml") return parseCargo(path2, text);
+  if (name2 === "pom.xml") return parsePom(path2, text);
+  if (name2 === "build.gradle" || name2 === "build.gradle.kts") return parseGradle(path2, text);
+  if (name2 === "Gemfile") return parseGemfile(path2, text);
+  if (name2.endsWith(".gemspec")) return parseGemspec(path2, text);
   return [];
 }
-function buildSpine(sha2, manifestPaths, readText) {
+function buildSpine(sha2, manifestPaths2, readText) {
   const manifests = {};
-  for (const p of manifestPaths) {
+  for (const p of manifestPaths2) {
     const deps = parseManifest(p, readText(p));
     if (deps.length > 0) manifests[p] = deps;
   }
@@ -16298,11 +16554,22 @@ function depsForUnit(spine, touched, readParentText) {
   for (const purl of declared.keys()) context.delete(purl);
   return { declared: [...declared.values()], context: [...context.values()] };
 }
-var ECOSYSTEM_LANGUAGE, TOOL_KINDS, MANIFEST_PATH_RE, LOCAL_IMAGE_RE, PACKAGE_JSON_SECTIONS;
+var ECOSYSTEM_SYSTEM, ECOSYSTEM_LANGUAGE, TOOL_KINDS, MANIFEST_PATH_RE, LOCAL_IMAGE_RE, PACKAGE_JSON_SECTIONS, GRADLE_CONFIGS;
 var init_manifests = __esm({
   "../../packages/shared/src/manifests.ts"() {
     "use strict";
     init_identity();
+    ECOSYSTEM_SYSTEM = {
+      npm: "npm",
+      pypi: "pypi",
+      cargo: "cargo",
+      go: "go",
+      golang: "go",
+      maven: "maven",
+      nuget: "nuget",
+      gem: "rubygems",
+      rubygems: "rubygems"
+    };
     ECOSYSTEM_LANGUAGE = {
       npm: "JavaScript",
       pypi: "Python",
@@ -16315,9 +16582,10 @@ var init_manifests = __esm({
       rubygems: "Ruby"
     };
     TOOL_KINDS = ["engine", "runtime"];
-    MANIFEST_PATH_RE = /(^|\/)(?:[^/]+\.csproj|[^/]+\.fsproj|project\.godot|package\.json|requirements[^/]*\.txt|pyproject\.toml|docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|Dockerfile(?:\.[^/]+)?|go\.mod|Cargo\.toml)$/;
+    MANIFEST_PATH_RE = /(^|\/)(?:[^/]+\.csproj|[^/]+\.fsproj|project\.godot|package\.json|requirements[^/]*\.txt|pyproject\.toml|docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|Dockerfile(?:\.[^/]+)?|go\.mod|Cargo\.toml|pom\.xml|build\.gradle(?:\.kts)?|libs\.versions\.toml|Gemfile|[^/]+\.gemspec)$/;
     LOCAL_IMAGE_RE = /^(openbane|local)[/-]|:local$/;
     PACKAGE_JSON_SECTIONS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+    GRADLE_CONFIGS = "implementation|api|compileOnly|compileOnlyApi|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|ksp|classpath|developmentOnly";
   }
 });
 
@@ -16377,6 +16645,7 @@ __export(src_exports, {
   DECOMPOSITION_EDGES: () => DECOMPOSITION_EDGES,
   DRIFT_KIND: () => DRIFT_KIND,
   ECOSYSTEM_LANGUAGE: () => ECOSYSTEM_LANGUAGE,
+  ECOSYSTEM_SYSTEM: () => ECOSYSTEM_SYSTEM,
   EDGE_CONDUCTANCE_OVERRIDES: () => EDGE_CONDUCTANCE_OVERRIDES,
   EDGE_RULES: () => EDGE_RULES,
   EDGE_WEIGHT: () => EDGE_WEIGHT,
@@ -16466,6 +16735,7 @@ __export(src_exports, {
   osNameForPlatform: () => osNameForPlatform,
   packageCanonicalId: () => packageCanonicalId,
   pagerankEdgeTypes: () => pagerankEdgeTypes,
+  parseGemfileLock: () => parseGemfileLock,
   parseManifest: () => parseManifest,
   parsePackageLockJson: () => parsePackageLockJson,
   parsePackageRef: () => parsePackageRef,
@@ -51216,16 +51486,16 @@ __export(witness_ledger_exports, {
   summarizeWitnessLedger: () => summarizeWitnessLedger,
   witnessLedgerPath: () => witnessLedgerPath
 });
-import { appendFileSync as appendFileSync3, existsSync as existsSync23, readFileSync as readFileSync23, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join28 } from "node:path";
+import { appendFileSync as appendFileSync3, existsSync as existsSync24, readFileSync as readFileSync24, writeFileSync as writeFileSync19 } from "node:fs";
+import { join as join29 } from "node:path";
 function witnessLedgerPath(configDir) {
-  return join28(configDir, "witness-ledger.jsonl");
+  return join29(configDir, "witness-ledger.jsonl");
 }
 function appendWitnessLedger(configDir, entry) {
   const path2 = witnessLedgerPath(configDir);
   try {
     appendFileSync3(path2, JSON.stringify(entry) + "\n");
-    const lines = readFileSync23(path2, "utf8").split("\n").filter(Boolean);
+    const lines = readFileSync24(path2, "utf8").split("\n").filter(Boolean);
     if (lines.length > LEDGER_MAX_LINES) {
       writeFileSync19(path2, lines.slice(-Math.floor(LEDGER_MAX_LINES / 2)).join("\n") + "\n");
     }
@@ -51234,9 +51504,9 @@ function appendWitnessLedger(configDir, entry) {
 }
 function readWitnessLedger(configDir) {
   const path2 = witnessLedgerPath(configDir);
-  if (!existsSync23(path2)) return [];
+  if (!existsSync24(path2)) return [];
   try {
-    return readFileSync23(path2, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).filter((e) => typeof e.ts === "number" && typeof e.channel === "string");
+    return readFileSync24(path2, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l)).filter((e) => typeof e.ts === "number" && typeof e.channel === "string");
   } catch {
     return [];
   }
@@ -70453,12 +70723,12 @@ var init_report_render = __esm({
 
 // src/cli.ts
 init_src6();
-import { closeSync as closeSync2, existsSync as existsSync32, openSync as openSync2, readFileSync as readFileSync31, renameSync as renameSync4, statSync as statSync7 } from "node:fs";
-import { join as join36, resolve as pathResolve } from "node:path";
+import { closeSync as closeSync2, existsSync as existsSync33, openSync as openSync2, readFileSync as readFileSync32, renameSync as renameSync4, statSync as statSync8 } from "node:fs";
+import { join as join37, resolve as pathResolve } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/daemon.ts
-import { existsSync as existsSync25, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync26, writeFileSync as writeFileSync21 } from "node:fs";
 
 // ../../node_modules/.pnpm/@hono+node-server@1.19.11_hono@4.12.8/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
@@ -71037,9 +71307,9 @@ init_webui();
 init_config();
 
 // src/engine.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync24, statSync as statSync6, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync3, readFileSync as readFileSync24, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join29, relative as relative6, sep as sep4 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync25, statSync as statSync7, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "node:fs";
+import { join as join30, relative as relative6, sep as sep4 } from "node:path";
 
 // ../../node_modules/.pnpm/chokidar@4.0.3/node_modules/chokidar/esm/index.js
 import { stat as statcb } from "fs";
@@ -75734,23 +76004,594 @@ async function pullCloudTriage(shared, cloud, profile, limit = 50) {
   return merged;
 }
 
-// src/git-sensor.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18, watch as fsWatch } from "node:fs";
+// src/retrieval-stack.ts
+init_src();
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync19, readFileSync as readFileSync18, statSync as statSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
 import { join as join23 } from "node:path";
+var RETRIEVAL_STACK_CAP = 24;
+var MANIFEST_SCAN_CAP = 400;
+var RUNTIME_TOKENS = /* @__PURE__ */ new Set([
+  "node",
+  "deno",
+  "bun",
+  "python",
+  "go",
+  "rust",
+  "java",
+  "ruby",
+  "php",
+  "dotnet",
+  "godot"
+]);
+var RUNTIME_KINDS = /* @__PURE__ */ new Set(["runtime", "engine"]);
+var KIND_WEIGHT = { package: 1, sdk: 0.9, image: 0.5 };
+var PUBLIC_NPM_HOSTS = /* @__PURE__ */ new Set(["registry.npmjs.org", "registry.yarnpkg.com"]);
+var PUBLIC_PYPI_HOSTS = /* @__PURE__ */ new Set(["pypi.org", "files.pythonhosted.org", "pypi.python.org"]);
+var PUBLIC_NUGET_HOSTS = /* @__PURE__ */ new Set(["api.nuget.org", "www.nuget.org", "nuget.org"]);
+var PUBLIC_GEM_HOSTS = /* @__PURE__ */ new Set(["rubygems.org", "index.rubygems.org"]);
+var PUBLIC_MAVEN_HOSTS = /* @__PURE__ */ new Set([
+  "repo.maven.apache.org",
+  "repo1.maven.org",
+  "central.sonatype.com",
+  "oss.sonatype.org",
+  "dl.google.com",
+  "maven.google.com",
+  "plugins.gradle.org"
+]);
+var PUBLIC_GO_HOSTS = /* @__PURE__ */ new Set([
+  "github.com",
+  "gitlab.com",
+  "bitbucket.org",
+  "golang.org",
+  "google.golang.org",
+  "cloud.google.com",
+  "gopkg.in",
+  "go.uber.org",
+  "go.opentelemetry.io",
+  "k8s.io",
+  "sigs.k8s.io",
+  "gotest.tools",
+  "gonum.org",
+  "modernc.org",
+  "rsc.io",
+  "honnef.co"
+]);
+var PUBLIC_REGISTRY_POLICY = {
+  blockedEcosystems: /* @__PURE__ */ new Set(),
+  npmPrivateScopes: /* @__PURE__ */ new Set(),
+  goPrivatePatterns: [],
+  privateGemNames: /* @__PURE__ */ new Set(),
+  selfTokens: []
+};
+function hostOf(value) {
+  try {
+    return new URL(value.trim()).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function urlIsPublic(value, publicHosts) {
+  const host = hostOf(value);
+  return host !== null && publicHosts.has(host);
+}
+var unquote = (s) => s.trim().replace(/^['"]|['"]$/g, "");
+function parseNpmrcPolicy(texts) {
+  let defaultPublic = null;
+  const privateScopes = /* @__PURE__ */ new Set();
+  const decidedScopes = /* @__PURE__ */ new Set();
+  for (const text of texts) {
+    for (const rawLine of text.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+      const eq = line.indexOf("=");
+      if (eq === -1) continue;
+      const key = line.slice(0, eq).trim().toLowerCase();
+      const value = line.slice(eq + 1).trim();
+      if (key === "registry") {
+        if (defaultPublic === null) defaultPublic = urlIsPublic(value, PUBLIC_NPM_HOSTS);
+        continue;
+      }
+      const scoped = /^(@[^:]+):registry$/.exec(key);
+      if (!scoped) continue;
+      const scope = (scoped[1] ?? "").toLowerCase();
+      if (decidedScopes.has(scope)) continue;
+      decidedScopes.add(scope);
+      if (!urlIsPublic(value, PUBLIC_NPM_HOSTS)) privateScopes.add(scope);
+    }
+  }
+  return { defaultPublic: defaultPublic ?? true, privateScopes };
+}
+function pypiIndexIsPrivate(texts) {
+  for (const text of texts) {
+    if (/^\s*\[\[?\s*tool\.(poetry\.source|uv\.index)\s*\]\]?/m.test(text)) {
+      const urls = [...text.matchAll(/^\s*url\s*=\s*(.+)$/gm)].map((m) => unquote(m[1] ?? ""));
+      if (urls.length === 0 || urls.some((u) => !urlIsPublic(u, PUBLIC_PYPI_HOSTS))) return true;
+    }
+    for (const m of text.matchAll(/^\s*(?:-i\b|--?(?:extra-)?index-url)\s*[=:]?\s*(\S+)/gm)) {
+      if (!urlIsPublic(unquote(m[1] ?? ""), PUBLIC_PYPI_HOSTS)) return true;
+    }
+    for (const m of text.matchAll(/^\s*(?:extra-)?index-url\s*=\s*(\S+)/gm)) {
+      if (!urlIsPublic(unquote(m[1] ?? ""), PUBLIC_PYPI_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function cargoRegistryIsPrivate(texts) {
+  return texts.some(
+    (t) => /^\s*\[registries(\.|\])/m.test(t) || /^\s*replace-with\s*=/m.test(t)
+  );
+}
+function nugetSourcesArePrivate(texts) {
+  for (const text of texts) {
+    const block = /<packageSources>([\s\S]*?)<\/packageSources>/i.exec(text);
+    if (!block) continue;
+    for (const m of (block[1] ?? "").matchAll(/<add\b[^>]*\bvalue\s*=\s*"([^"]+)"/gi)) {
+      if (!urlIsPublic(m[1] ?? "", PUBLIC_NUGET_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function parseGoPrivate(values) {
+  return values.flatMap((v) => (v ?? "").split(",")).map((s) => s.trim()).filter(Boolean);
+}
+function goPrivateMatches(patterns, modulePath) {
+  if (patterns.length === 0) return false;
+  const parts2 = modulePath.split("/");
+  const prefixes = parts2.map((_, i2) => parts2.slice(0, i2 + 1).join("/"));
+  return patterns.some((pattern) => {
+    const rx = new RegExp(
+      "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*") + "$"
+    );
+    return prefixes.some((p) => rx.test(p));
+  });
+}
+var OFFICIAL_DOCKER_IMAGES = /* @__PURE__ */ new Set([
+  "alpine",
+  "busybox",
+  "debian",
+  "ubuntu",
+  "fedora",
+  "rockylinux",
+  "postgres",
+  "mysql",
+  "mariadb",
+  "mongo",
+  "redis",
+  "memcached",
+  "cassandra",
+  "couchdb",
+  "influxdb",
+  "neo4j",
+  "elasticsearch",
+  "rabbitmq",
+  "nats",
+  "kafka",
+  "zookeeper",
+  "consul",
+  "vault",
+  "etcd",
+  "minio",
+  "clickhouse",
+  "nginx",
+  "httpd",
+  "haproxy",
+  "traefik",
+  "caddy",
+  "varnish",
+  "node",
+  "python",
+  "golang",
+  "rust",
+  "ruby",
+  "php",
+  "openjdk",
+  "eclipse-temurin",
+  "gradle",
+  "maven",
+  "composer",
+  "perl",
+  "erlang",
+  "elixir",
+  "haskell",
+  "docker",
+  "registry",
+  "grafana",
+  "prometheus",
+  "telegraf",
+  "jenkins",
+  "sonarqube",
+  "wordpress",
+  "drupal",
+  "ghost",
+  "nextcloud",
+  "gitlab",
+  "gitea",
+  "sentry",
+  "hello-world",
+  "selenium",
+  "playwright",
+  "ollama"
+]);
+function dockerImageIsPublicOfficial(name2) {
+  const n = name2.trim().toLowerCase();
+  if (!n || n.includes("/") || n.includes(":") || n.includes("@")) return false;
+  return OFFICIAL_DOCKER_IMAGES.has(n);
+}
+function mavenReposArePrivate(texts) {
+  for (const text of texts) {
+    if (/<servers>[\s\S]*?<server>/i.test(text)) return true;
+    for (const m of text.matchAll(/<(?:repository|pluginRepository|mirror)\b[\s\S]*?<\/(?:repository|pluginRepository|mirror)>/gi)) {
+      const url2 = /<url>([^<]+)<\/url>/i.exec(m[0])?.[1];
+      if (!url2 || !urlIsPublic(url2, PUBLIC_MAVEN_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function gemSourceIsPrivate(texts) {
+  for (const text of texts) {
+    for (const m of text.matchAll(/^\s*source\s+["']([^"']+)["']/gm)) {
+      if (!urlIsPublic(m[1] ?? "", PUBLIC_GEM_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function privateGemNamesIn(texts) {
+  const names = /* @__PURE__ */ new Set();
+  for (const text of texts) {
+    for (const raw2 of text.split(/\r?\n/)) {
+      const line = (raw2.split("#", 1)[0] ?? "").trim();
+      const m = /^gem\s+["']([^"']+)["']/.exec(line);
+      if (!m?.[1]) continue;
+      if (/(?::(?:git|path|github|gist|bitbucket)\s*=>|\b(?:git|path|github|gist|bitbucket):\s)/.test(line)) {
+        names.add(m[1]);
+      }
+    }
+  }
+  return names;
+}
+function selfTokensFromLocator(repoLocator) {
+  if (!repoLocator) return [];
+  const segments = repoLocator.toLowerCase().split("/").slice(1).filter(Boolean);
+  return [...new Set(segments.filter((s) => s.length >= 3))];
+}
+function mavenGroupIsSelfDisclosing(name2, selfTokens) {
+  if (selfTokens.length === 0) return false;
+  const group = (name2.split(":")[0] ?? "").toLowerCase();
+  const parts2 = group.split(".");
+  return selfTokens.some((t) => parts2.includes(t));
+}
+function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
+  const read2 = (p) => {
+    try {
+      return readFileSync18(p, "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const texts = (...paths) => paths.map(read2).filter((t) => t !== null);
+  const home = homedir6();
+  const npm = parseNpmrcPolicy(texts(join23(root, ".npmrc"), join23(home, ".npmrc")));
+  const blocked = /* @__PURE__ */ new Set();
+  if (!npm.defaultPublic) blocked.add("npm");
+  if (pypiIndexIsPrivate(
+    texts(
+      join23(root, "pip.conf"),
+      join23(root, "pip.ini"),
+      join23(root, "pyproject.toml"),
+      join23(root, "requirements.txt"),
+      join23(home, ".pip", "pip.conf"),
+      join23(home, ".config", "pip", "pip.conf"),
+      join23(env2["APPDATA"] ?? home, "pip", "pip.ini")
+    )
+  )) {
+    blocked.add("pypi");
+  }
+  if (cargoRegistryIsPrivate(
+    texts(
+      join23(root, ".cargo", "config.toml"),
+      join23(root, ".cargo", "config"),
+      join23(home, ".cargo", "config.toml"),
+      join23(home, ".cargo", "config")
+    )
+  )) {
+    blocked.add("cargo");
+  }
+  if (nugetSourcesArePrivate(
+    texts(
+      join23(root, "NuGet.config"),
+      join23(root, "nuget.config"),
+      join23(root, "NuGet.Config"),
+      join23(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
+      join23(home, ".nuget", "NuGet", "NuGet.Config")
+    )
+  )) {
+    blocked.add("nuget");
+  }
+  const goEnvFile = env2["GOENV"] ?? join23(env2["APPDATA"] ?? join23(home, ".config"), "go", "env");
+  const goEnvText = read2(goEnvFile) ?? "";
+  const fromFile = ["GOPRIVATE", "GONOSUMDB", "GONOSUMCHECK"].map(
+    (k) => new RegExp(`^${k}=(.*)$`, "m").exec(goEnvText)?.[1]
+  );
+  const goPrivatePatterns = parseGoPrivate([
+    env2["GOPRIVATE"],
+    env2["GONOSUMDB"],
+    env2["GONOSUMCHECK"],
+    ...fromFile
+  ]);
+  const gemfiles = texts(join23(root, "Gemfile"));
+  if (gemSourceIsPrivate(gemfiles)) blocked.add("gem");
+  if (mavenReposArePrivate(
+    texts(join23(root, "pom.xml"), join23(home, ".m2", "settings.xml"))
+  )) {
+    blocked.add("maven");
+  }
+  return {
+    blockedEcosystems: blocked,
+    npmPrivateScopes: npm.privateScopes,
+    goPrivatePatterns,
+    privateGemNames: privateGemNamesIn(gemfiles),
+    selfTokens: selfTokensFromLocator(repoLocator)
+  };
+}
+function npmScopeOf(name2) {
+  if (!name2.startsWith("@")) return null;
+  const slash = name2.indexOf("/");
+  return slash === -1 ? null : name2.slice(0, slash).toLowerCase();
+}
+function isPublicDep(dep, policy) {
+  const ecosystem = dep.ecosystem.toLowerCase();
+  if (policy.blockedEcosystems.has(ecosystem)) return false;
+  switch (ecosystem) {
+    case "npm": {
+      const scope = npmScopeOf(dep.name);
+      return scope === null || !policy.npmPrivateScopes.has(scope);
+    }
+    case "pypi":
+    case "cargo":
+      return true;
+    case "nuget":
+      return true;
+    case "maven":
+      return !mavenGroupIsSelfDisclosing(dep.name, policy.selfTokens);
+    case "gem":
+    case "rubygems":
+      return !policy.privateGemNames.has(dep.name);
+    case "go":
+    case "golang": {
+      if (goPrivateMatches(policy.goPrivatePatterns, dep.name)) return false;
+      const host = dep.name.split("/")[0]?.toLowerCase() ?? "";
+      return PUBLIC_GO_HOSTS.has(host);
+    }
+    case "docker":
+      return dockerImageIsPublicOfficial(dep.name);
+    default:
+      return false;
+  }
+}
+function normStackToken(raw2) {
+  return raw2.trim().toLowerCase().replace(/(?!^)[@\s].*$/, "");
+}
+function normStackTokens(xs) {
+  return (xs ?? []).map(normStackToken).filter(Boolean);
+}
+function isRuntimeToken(token) {
+  return RUNTIME_TOKENS.has(token);
+}
+function rankCandidates(cs) {
+  return [...cs].sort((a, b) => b.weight - a.weight || a.name.localeCompare(b.name));
+}
+function isLocalSpec(version2) {
+  if (!version2) return false;
+  const v = version2.trim().toLowerCase();
+  return v.startsWith("workspace:") || v.startsWith("link:") || v.startsWith("file:") || v.startsWith("portal:") || v.startsWith("path:") || v.startsWith("git:") || v.startsWith("git+") || v.includes("://");
+}
+function retrievalStackTokens(input) {
+  const cap = input.cap ?? RETRIEVAL_STACK_CAP;
+  const registry2 = input.registry ?? PUBLIC_REGISTRY_POLICY;
+  const ignore2 = input.ignorePatterns ?? [];
+  const ignored = (token) => ignore2.length > 0 && ignore2.some((p) => token.includes(p));
+  const packagesAllowed = input.contributePackages;
+  const tokens = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (token) => {
+    if (!token || seen.has(token) || ignored(token)) return false;
+    seen.add(token);
+    tokens.push(token);
+    return true;
+  };
+  const manifestDeps = input.manifestDeps ?? [];
+  const ecosystemLanguages = /* @__PURE__ */ new Set();
+  for (const d of [...manifestDeps, ...input.direct ?? []]) {
+    const lang = ECOSYSTEM_LANGUAGE[d.ecosystem.toLowerCase()];
+    if (lang) ecosystemLanguages.add(normStackToken(lang));
+  }
+  for (const l of [...ecosystemLanguages, ...normStackTokens(input.languages)]) push(l);
+  for (const t of normStackTokens(input.profileStack)) {
+    if (isRuntimeToken(t)) push(t);
+  }
+  for (const d of manifestDeps) {
+    if (RUNTIME_KINDS.has(d.kind)) push(normStackToken(d.name));
+  }
+  const byEcosystem = /* @__PURE__ */ new Map();
+  const add = (c) => {
+    const list = byEcosystem.get(c.ecosystem);
+    if (list) list.push(c);
+    else byEcosystem.set(c.ecosystem, [c]);
+  };
+  let fromLockfile = 0;
+  let fromManifest = 0;
+  const lockfileKeys = /* @__PURE__ */ new Set();
+  const ecoKey = (ecosystem, name2) => `${ecosystem.toLowerCase()}\0${name2.toLowerCase()}`;
+  if (packagesAllowed) {
+    for (const d of input.direct ?? []) {
+      lockfileKeys.add(ecoKey(d.ecosystem, d.name));
+      if (!isPublicDep(d, registry2)) continue;
+      add({ ecosystem: d.ecosystem.toLowerCase(), name: d.name, weight: d.importers });
+    }
+    const counted = /* @__PURE__ */ new Map();
+    for (const d of manifestDeps) {
+      if (RUNTIME_KINDS.has(d.kind)) continue;
+      const ecosystem = d.ecosystem.toLowerCase();
+      if (lockfileKeys.has(ecoKey(ecosystem, d.name))) continue;
+      if (isLocalSpec(d.version)) continue;
+      if (!isPublicDep({ ecosystem, name: d.name }, registry2)) continue;
+      const key = ecoKey(ecosystem, d.name);
+      const prev = counted.get(key);
+      const w = KIND_WEIGHT[d.kind] ?? 0.5;
+      if (prev) prev.weight += w;
+      else counted.set(key, { ecosystem, name: d.name, weight: w });
+    }
+    for (const c of counted.values()) add(c);
+  }
+  const queues = [...byEcosystem.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([ecosystem, cs]) => ({ ecosystem, items: rankCandidates(cs) }));
+  const usedEcosystems = /* @__PURE__ */ new Set();
+  for (let round2 = 0; tokens.length < cap; round2++) {
+    let emittedThisRound = false;
+    for (const q of queues) {
+      if (tokens.length >= cap) break;
+      const c = q.items[round2];
+      if (!c) continue;
+      emittedThisRound = true;
+      if (!push(normStackToken(c.name))) continue;
+      usedEcosystems.add(c.ecosystem);
+      if (lockfileKeys.has(ecoKey(c.ecosystem, c.name))) fromLockfile++;
+      else fromManifest++;
+    }
+    if (!emittedThisRound) break;
+  }
+  if (packagesAllowed) {
+    for (const t of normStackTokens(input.profileStack)) {
+      if (tokens.length >= cap) break;
+      if (isRuntimeToken(t)) continue;
+      if (!isPublicDep({ ecosystem: "npm", name: t }, registry2)) continue;
+      push(t);
+    }
+  }
+  const source = fromLockfile > 0 && fromManifest > 0 ? "both" : fromLockfile > 0 ? "lockfile" : fromManifest > 0 ? "manifest" : "profile";
+  return { tokens: tokens.slice(0, cap), source, ecosystems: [...usedEcosystems].sort() };
+}
+var LOCKFILES = [
+  { file: "pnpm-lock.yaml", family: "npm", parse: parsePnpmLock },
+  { file: "package-lock.json", family: "npm", parse: parsePackageLockJson },
+  { file: "Gemfile.lock", family: "gem", parse: parseGemfileLock }
+];
+var directCache = /* @__PURE__ */ new Map();
+function readDirectDependencies(root) {
+  const stamps = [];
+  const found = [];
+  const familiesSeen = /* @__PURE__ */ new Set();
+  for (const c of LOCKFILES) {
+    if (familiesSeen.has(c.family)) continue;
+    const p = join23(root, c.file);
+    if (!existsSync19(p)) continue;
+    try {
+      const s = statSync6(p);
+      stamps.push(`${c.file}:${s.mtimeMs}:${s.size}`);
+    } catch {
+      continue;
+    }
+    familiesSeen.add(c.family);
+    found.push({ c, path: p });
+  }
+  if (found.length === 0) {
+    directCache.delete(root);
+    return [];
+  }
+  const key = stamps.join("|");
+  const hit = directCache.get(root);
+  if (hit && hit.key === key) return hit.direct;
+  const direct = [];
+  for (const { c, path: path2 } of found) {
+    try {
+      direct.push(...c.parse(readFileSync18(path2, "utf8")).direct ?? []);
+    } catch {
+    }
+  }
+  directCache.set(root, { key, direct });
+  return direct;
+}
+function manifestPaths(root) {
+  try {
+    const out2 = execFileSync3("git", ["-C", root, "ls-files", "-z"], {
+      encoding: "utf8",
+      maxBuffer: 128 * 1024 * 1024,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const paths = out2.split("\0").filter((f) => f && isManifestPath(f));
+    if (paths.length > 0) return paths.slice(0, MANIFEST_SCAN_CAP);
+  } catch {
+  }
+  const ROOT_MANIFESTS = [
+    "package.json",
+    "pyproject.toml",
+    "requirements.txt",
+    "go.mod",
+    "Cargo.toml",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "gradle/libs.versions.toml",
+    "Gemfile",
+    "docker-compose.yml",
+    "docker-compose.yaml",
+    "compose.yaml",
+    "Dockerfile",
+    "project.godot"
+  ];
+  return ROOT_MANIFESTS.filter((f) => existsSync19(join23(root, f)));
+}
+var manifestCache = /* @__PURE__ */ new Map();
+function readManifestDependencies(root) {
+  const paths = manifestPaths(root);
+  if (paths.length === 0) {
+    manifestCache.delete(root);
+    return [];
+  }
+  const texts = /* @__PURE__ */ new Map();
+  const stamps = [];
+  for (const rel of paths) {
+    const abs = join23(root, rel);
+    try {
+      const s = statSync6(abs);
+      stamps.push(`${rel}:${s.mtimeMs}:${s.size}`);
+      texts.set(rel, readFileSync18(abs, "utf8"));
+    } catch {
+    }
+  }
+  const key = stamps.join("|");
+  const hit = manifestCache.get(root);
+  if (hit && hit.key === key) return hit.deps;
+  let deps = [];
+  try {
+    const spine = buildSpine("workspace", [...texts.keys()], (p) => texts.get(p) ?? "");
+    deps = Object.values(spine.manifests).flat();
+  } catch {
+    deps = [];
+  }
+  manifestCache.set(root, { key, deps });
+  return deps;
+}
+
+// src/git-sensor.ts
+import { existsSync as existsSync20, readFileSync as readFileSync19, watch as fsWatch } from "node:fs";
+import { join as join24 } from "node:path";
 function readFirstLine(path2) {
   try {
-    return readFileSync18(path2, "utf8").split(/\r?\n/, 1)[0].trim();
+    return readFileSync19(path2, "utf8").split(/\r?\n/, 1)[0].trim();
   } catch {
     return null;
   }
 }
 function readGitRefState(gitDir) {
-  const head2 = readFirstLine(join23(gitDir, "HEAD"));
+  const head2 = readFirstLine(join24(gitDir, "HEAD"));
   const m = head2 ? /^ref:\s*refs\/heads\/(.+)$/.exec(head2) : null;
   const branch = m ? m[1] : null;
   let sha2 = null;
   if (branch) {
-    sha2 = readFirstLine(join23(gitDir, "refs", "heads", branch));
+    sha2 = readFirstLine(join24(gitDir, "refs", "heads", branch));
     if (!sha2) sha2 = shaFromPackedRefs(gitDir, `refs/heads/${branch}`);
   } else if (head2 && /^[0-9a-f]{7,40}$/i.test(head2)) {
     sha2 = head2;
@@ -75758,13 +76599,13 @@ function readGitRefState(gitDir) {
   return {
     branch,
     sha: sha2,
-    mergeHeadExists: existsSync19(join23(gitDir, "MERGE_HEAD")),
-    origHeadExists: existsSync19(join23(gitDir, "ORIG_HEAD"))
+    mergeHeadExists: existsSync20(join24(gitDir, "MERGE_HEAD")),
+    origHeadExists: existsSync20(join24(gitDir, "ORIG_HEAD"))
   };
 }
 function shaFromPackedRefs(gitDir, ref) {
   try {
-    for (const line of readFileSync18(join23(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync19(join24(gitDir, "packed-refs"), "utf8").split(/\r?\n/)) {
       const [sha2, name2] = line.split(/\s+/);
       if (name2 === ref && sha2) return sha2;
     }
@@ -75798,7 +76639,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
   const settle = () => {
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => {
-      if (existsSync19(join23(gitDir, "index.lock"))) {
+      if (existsSync20(join24(gitDir, "index.lock"))) {
         settle();
         return;
       }
@@ -75809,7 +76650,7 @@ function startGitSensor(gitDir, onEvent, opts = {}) {
     }, debounceMs);
   };
   for (const sub of ["HEAD", "logs/HEAD", "MERGE_HEAD", "ORIG_HEAD"]) {
-    const p = join23(gitDir, sub);
+    const p = join24(gitDir, sub);
     try {
       watchers.push(fsWatch(p, settle));
     } catch {
@@ -76034,21 +76875,21 @@ var TelemetryRecorder = class {
 
 // src/skills.ts
 import {
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync8,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync15
 } from "node:fs";
-import { basename as basename6, join as join24 } from "node:path";
+import { basename as basename6, join as join25 } from "node:path";
 function skillFileName(id) {
   return `${id.replace(/[^A-Za-z0-9_.-]/g, "_")}.md`;
 }
 function readSkillManifest(manifestPath) {
-  if (!existsSync20(manifestPath)) return [];
+  if (!existsSync21(manifestPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync19(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync20(manifestPath, "utf8"));
     return (parsed.skills ?? []).map((s) => ({
       title: s.title ?? "",
       layer: s.layer ?? "technique",
@@ -76072,7 +76913,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
   for (const s of res.skills) {
     const fileName = skillFileName(s.id);
     keep.add(fileName);
-    writeFileSync15(join24(paths.skillsDir, fileName), s.markdown, "utf8");
+    writeFileSync15(join25(paths.skillsDir, fileName), s.markdown, "utf8");
     rows.push({
       id: s.id,
       title: s.title,
@@ -76085,7 +76926,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     const fileName = skillFileName(p.id);
     if (keep.has(fileName)) continue;
     keep.add(fileName);
-    writeFileSync15(join24(paths.skillsDir, fileName), p.markdown, "utf8");
+    writeFileSync15(join25(paths.skillsDir, fileName), p.markdown, "utf8");
     rows.push({
       id: p.id,
       title: p.title,
@@ -76099,7 +76940,7 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
     if (!f.endsWith(".md")) continue;
     if (keep.has(basename6(f))) continue;
     try {
-      unlinkSync2(join24(paths.skillsDir, f));
+      unlinkSync2(join25(paths.skillsDir, f));
       pruned++;
     } catch {
     }
@@ -76117,22 +76958,22 @@ async function syncSkills(paths, client, seed, pins = [], techSeed) {
 init_src2();
 import {
   cpSync,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   lstatSync,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readdirSync as readdirSync9,
   rmSync as rmSync3,
   symlinkSync,
   writeFileSync as writeFileSync16
 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 var SKILL_NS = "errata-";
 var HARNESS_SKILL_DIRS = [
-  { configDir: ".claude", skillsDir: join25(".claude", "skills") },
+  { configDir: ".claude", skillsDir: join26(".claude", "skills") },
   // Cursor adopted the standard; its exact project dir is still moving — kept
   // best-effort and gated on `.cursor/` presence so we never create it blind.
-  { configDir: ".cursor", skillsDir: join25(".cursor", "skills") }
+  { configDir: ".cursor", skillsDir: join26(".cursor", "skills") }
 ];
 function skillSlug(title, id) {
   const base = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || id.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "skill";
@@ -76177,12 +77018,12 @@ function skillCiteHandle(s) {
   return priorHandle({ id: s.id, description: s.title });
 }
 function reconcileNamespaced(dir, keep) {
-  if (!existsSync21(dir)) return 0;
+  if (!existsSync22(dir)) return 0;
   let pruned = 0;
   for (const name2 of readdirSync9(dir)) {
     if (!name2.startsWith(SKILL_NS) || keep.has(name2)) continue;
     try {
-      rmSync3(join25(dir, name2), { recursive: true, force: true });
+      rmSync3(join26(dir, name2), { recursive: true, force: true });
       pruned++;
     } catch {
     }
@@ -76191,7 +77032,7 @@ function reconcileNamespaced(dir, keep) {
 }
 function linkOrCopy(linkPath, target) {
   try {
-    if (existsSync21(linkPath) || safeLstat(linkPath)) rmSync3(linkPath, { recursive: true, force: true });
+    if (existsSync22(linkPath) || safeLstat(linkPath)) rmSync3(linkPath, { recursive: true, force: true });
   } catch {
   }
   try {
@@ -76212,7 +77053,7 @@ function safeLstat(p) {
   }
 }
 function emitAndProjectSkills(root, skills) {
-  const agentsSkillsDir = join25(root, ".agents", "skills");
+  const agentsSkillsDir = join26(root, ".agents", "skills");
   mkdirSync8(agentsSkillsDir, { recursive: true });
   const slugs = [];
   const keep = /* @__PURE__ */ new Set();
@@ -76220,7 +77061,7 @@ function emitAndProjectSkills(root, skills) {
   for (const s of skills) {
     let body2;
     try {
-      body2 = readFileSync20(s.bodyPath, "utf8");
+      body2 = readFileSync21(s.bodyPath, "utf8");
     } catch {
       continue;
     }
@@ -76229,9 +77070,9 @@ function emitAndProjectSkills(root, skills) {
     keep.add(slug2);
     slugs.push(slug2);
     const description = deriveDescription(s.title, s.layer, body2);
-    mkdirSync8(join25(agentsSkillsDir, slug2), { recursive: true });
+    mkdirSync8(join26(agentsSkillsDir, slug2), { recursive: true });
     writeFileSync16(
-      join25(agentsSkillsDir, slug2, "SKILL.md"),
+      join26(agentsSkillsDir, slug2, "SKILL.md"),
       renderSkillMd(slug2, description, body2, skillCiteHandle(s)),
       "utf8"
     );
@@ -76240,11 +77081,11 @@ function emitAndProjectSkills(root, skills) {
   reconcileNamespaced(agentsSkillsDir, keep);
   let projected = 0;
   for (const h of HARNESS_SKILL_DIRS) {
-    if (!existsSync21(join25(root, h.configDir))) continue;
-    const dir = join25(root, h.skillsDir);
+    if (!existsSync22(join26(root, h.configDir))) continue;
+    const dir = join26(root, h.skillsDir);
     mkdirSync8(dir, { recursive: true });
     for (const slug2 of slugs) {
-      linkOrCopy(join25(dir, slug2), join25(agentsSkillsDir, slug2));
+      linkOrCopy(join26(dir, slug2), join26(agentsSkillsDir, slug2));
       projected++;
     }
     reconcileNamespaced(dir, keep);
@@ -76253,15 +77094,15 @@ function emitAndProjectSkills(root, skills) {
   return { slugs, emitted, projected };
 }
 function emitInputsFromManifest(erretaDir, manifestPath) {
-  if (!existsSync21(manifestPath)) return [];
+  if (!existsSync22(manifestPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync20(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync21(manifestPath, "utf8"));
     return (parsed.skills ?? []).filter((s) => Boolean(s.id && s.file)).map((s) => ({
       id: s.id,
       title: s.title ?? s.id,
       layer: s.layer ?? "technique",
       confidence: s.confidence ?? 0,
-      bodyPath: join25(erretaDir, s.file)
+      bodyPath: join26(erretaDir, s.file)
     }));
   } catch {
     return [];
@@ -76275,10 +77116,10 @@ var GITIGNORE_LINES = [
   ".cursor/skills/errata-*/"
 ];
 function ensureSkillGitignore(root) {
-  const path2 = join25(root, ".gitignore");
+  const path2 = join26(root, ".gitignore");
   let current = "";
   try {
-    current = existsSync21(path2) ? readFileSync20(path2, "utf8") : "";
+    current = existsSync22(path2) ? readFileSync21(path2, "utf8") : "";
   } catch {
     return;
   }
@@ -76383,9 +77224,9 @@ init_paths();
 init_src2();
 init_paths();
 init_git_remote();
-import { existsSync as existsSync22, readFileSync as readFileSync21, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync22, writeFileSync as writeFileSync17 } from "node:fs";
 import { createHash as createHash14 } from "node:crypto";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function workspaceId(root) {
   return "wp_" + createHash14("sha256").update(root).digest("hex").slice(0, 12);
 }
@@ -76408,8 +77249,8 @@ function refreshRepoLocator(root, profile) {
 }
 function loadProfile(root) {
   const p = workspacePaths(root);
-  if (!existsSync22(p.workspaceJson)) return null;
-  return JSON.parse(readFileSync21(p.workspaceJson, "utf8"));
+  if (!existsSync23(p.workspaceJson)) return null;
+  return JSON.parse(readFileSync22(p.workspaceJson, "utf8"));
 }
 function saveProfile(root, profile) {
   const p = workspacePaths(root);
@@ -76422,14 +77263,17 @@ function autodetectProfile(root) {
   const p = emptyProfile(id, name2);
   const locator = detectRepoLocator(root);
   if (locator) p.repoLocator = locator;
-  const pkgPath = join26(root, "package.json");
-  if (existsSync22(pkgPath)) {
+  const pkgPath = join27(root, "package.json");
+  if (existsSync23(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync21(pkgPath, "utf8"));
-      p.languages.push("typescript", "javascript");
-      const nodeVer = pkg.engines?.node ?? "node";
-      p.stack.push(`node@${nodeVer}`);
+      const pkg = JSON.parse(readFileSync22(pkgPath, "utf8"));
       const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+      p.languages.push("javascript");
+      if (existsSync23(join27(root, "tsconfig.json")) || deps["typescript"]) {
+        p.languages.push("typescript");
+      }
+      const nodeVer = pkg.engines?.node?.trim();
+      p.stack.push(nodeVer ? `node@${nodeVer}` : "node");
       const interesting = [
         "next",
         "react",
@@ -76446,10 +77290,10 @@ function autodetectProfile(root) {
     } catch {
     }
   }
-  const pyproject = join26(root, "pyproject.toml");
-  if (existsSync22(pyproject)) {
+  const pyproject = join27(root, "pyproject.toml");
+  if (existsSync23(pyproject)) {
     try {
-      const txt = readFileSync21(pyproject, "utf8");
+      const txt = readFileSync22(pyproject, "utf8");
       const py = /python\s*=\s*"([^"]+)"/.exec(txt)?.[1];
       p.languages.push("python");
       p.stack.push(`python@${py ?? "3"}`);
@@ -76460,16 +77304,16 @@ function autodetectProfile(root) {
     } catch {
     }
   }
-  const reqs = join26(root, "requirements.txt");
-  if (existsSync22(reqs)) {
+  const reqs = join27(root, "requirements.txt");
+  if (existsSync23(reqs)) {
     if (!p.languages.includes("python")) p.languages.push("python");
     if (!p.stack.includes("python@3")) p.stack.push("python@3");
   }
-  if (existsSync22(join26(root, "go.mod"))) {
+  if (existsSync23(join27(root, "go.mod"))) {
     p.languages.push("go");
     p.stack.push("go");
   }
-  if (existsSync22(join26(root, "Cargo.toml"))) {
+  if (existsSync23(join27(root, "Cargo.toml"))) {
     p.languages.push("rust");
     p.stack.push("rust");
   }
@@ -76479,18 +77323,18 @@ function autodetectProfile(root) {
 }
 
 // src/witness-queue.ts
-import { readFileSync as readFileSync22, renameSync as renameSync2, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname11, join as join27 } from "node:path";
+import { readFileSync as readFileSync23, renameSync as renameSync2, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname11, join as join28 } from "node:path";
 var WITNESS_QUEUE_CAP = 500;
 var WITNESS_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
 var WITNESS_MAX_ATTEMPTS = 5;
 function witnessQueuePath(workspaceConfigDir) {
-  return join27(workspaceConfigDir, "witness-queue.json");
+  return join28(workspaceConfigDir, "witness-queue.json");
 }
 function loadWitnessQueueWithLosses(path2) {
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync22(path2, "utf8"));
+    raw2 = JSON.parse(readFileSync23(path2, "utf8"));
   } catch (err2) {
     const absent = err2?.code === "ENOENT";
     return { queue: [], fileUnreadable: !absent, malformedEntries: 0 };
@@ -76503,7 +77347,7 @@ function loadWitnessQueueWithLosses(path2) {
 }
 function saveWitnessQueue(path2, queue) {
   try {
-    const tmp = join27(dirname11(path2), `.${Date.now()}.witness-queue.tmp`);
+    const tmp = join28(dirname11(path2), `.${Date.now()}.witness-queue.tmp`);
     writeFileSync18(tmp, JSON.stringify(queue), "utf8");
     renameSync2(tmp, path2);
   } catch {
@@ -77077,7 +77921,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.2198" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2250" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -77088,7 +77932,7 @@ var CODEX_SWEEP_LOOKBACK_MS = 10 * 6e4;
 function appendIdentityAudit(path2, record2, line) {
   if (!record2.accepted && record2.score <= 0) return;
   try {
-    if (existsSync24(path2) && statSync6(path2).size >= IDENTITY_AUDIT_MAX_BYTES) {
+    if (existsSync25(path2) && statSync7(path2).size >= IDENTITY_AUDIT_MAX_BYTES) {
       renameSync3(path2, `${path2}.1`);
     }
     appendFileSync4(path2, line);
@@ -77098,7 +77942,7 @@ function appendIdentityAudit(path2, record2, line) {
 var yieldToLoop = () => new Promise((r) => setImmediate(r));
 function loadTurnCursors(path2) {
   try {
-    const raw2 = JSON.parse(readFileSync24(path2, "utf8"));
+    const raw2 = JSON.parse(readFileSync25(path2, "utf8"));
     return new Map(
       Object.entries(raw2).map(([k, v]) => [k, typeof v === "string" ? v : String(v?.uuid ?? "")])
     );
@@ -77108,7 +77952,7 @@ function loadTurnCursors(path2) {
 }
 function loadTurnOffsets(path2) {
   try {
-    const raw2 = JSON.parse(readFileSync24(path2, "utf8"));
+    const raw2 = JSON.parse(readFileSync25(path2, "utf8"));
     const out2 = /* @__PURE__ */ new Map();
     for (const [k, v] of Object.entries(raw2)) {
       const off = typeof v === "object" && v !== null ? v.offset : void 0;
@@ -77131,7 +77975,7 @@ function saveTurnCursors(path2, cursors, offsets) {
 function gitSourceWatchTargets(root) {
   const SOURCE = /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i;
   try {
-    const lsOut = execFileSync3("git", ["-C", root, "ls-files", "-z"], {
+    const lsOut = execFileSync4("git", ["-C", root, "ls-files", "-z"], {
       encoding: "utf8",
       maxBuffer: 128 * 1024 * 1024,
       windowsHide: true,
@@ -77141,12 +77985,12 @@ function gitSourceWatchTargets(root) {
     if (sourceFiles.length === 0) throw new Error("no tracked source");
     let ignoredDirs = [];
     try {
-      const igOut = execFileSync3(
+      const igOut = execFileSync4(
         "git",
         ["-C", root, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"],
         { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }
       );
-      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join29(root, d) + sep4));
+      ignoredDirs = igOut.split("\0").filter(Boolean).map((d) => d.replace(/\/+$/, "")).filter((d) => !IGNORED_PATH.test(join30(root, d) + sep4));
     } catch {
     }
     const hasIgnoredChild = (dir) => ignoredDirs.some((ig) => ig.startsWith(dir + "/"));
@@ -77158,19 +78002,19 @@ function gitSourceWatchTargets(root) {
         if (!f.startsWith(prefix)) continue;
         const rest2 = f.slice(prefix.length);
         if (rest2.includes("/")) children.add(dir === "" ? rest2.slice(0, rest2.indexOf("/")) : dir + "/" + rest2.slice(0, rest2.indexOf("/")));
-        else targets.add(join29(root, f));
+        else targets.add(join30(root, f));
       }
       for (const c of children) {
-        if (IGNORED_PATH.test(join29(root, c) + sep4)) continue;
+        if (IGNORED_PATH.test(join30(root, c) + sep4)) continue;
         if (hasIgnoredChild(c)) addUnder(c);
-        else targets.add(join29(root, c));
+        else targets.add(join30(root, c));
       }
     };
     addUnder("");
     if (targets.size > 0) return [...targets];
   } catch {
   }
-  return readdirSync10(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join29(root, String(e.name)) + sep4)).map((e) => join29(root, String(e.name)));
+  return readdirSync10(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !IGNORED_PATH.test(join30(root, String(e.name)) + sep4)).map((e) => join30(root, String(e.name)));
 }
 function createWorkspaceEngine(opts) {
   const paths = workspacePaths(opts.workspaceRoot);
@@ -77248,7 +78092,7 @@ function createWorkspaceEngine(opts) {
       }
       let size = 0;
       try {
-        size = statSync6(path2).size;
+        size = statSync7(path2).size;
       } catch {
       }
       lastActivityTs = Date.now();
@@ -77363,7 +78207,7 @@ function createWorkspaceEngine(opts) {
       const srcPaths = diff.changedPaths.filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(p));
       let episodeId2;
       if (srcPaths.length > 0) {
-        const abs = srcPaths.map((p) => join29(opts.workspaceRoot, p));
+        const abs = srcPaths.map((p) => join30(opts.workspaceRoot, p));
         try {
           const r = await runReindexPass(
             `git-reindex:${profile.name} (${abs.length} files)`,
@@ -77399,8 +78243,8 @@ function createWorkspaceEngine(opts) {
         `[errata] git: ${ev.kind} ${ev.newSha.slice(0, 7)} by ${meta3.authorName} \u2014 ${diff.changedPaths.length} file(s), ${diff.renames.length} rename(s)`
       );
     };
-    const gitDir = join29(opts.workspaceRoot, ".git");
-    if (existsSync24(gitDir)) {
+    const gitDir = join30(opts.workspaceRoot, ".git");
+    if (existsSync25(gitDir)) {
       stopGit = startGitSensor(gitDir, (ev) => {
         void handleGitEvent(ev).catch((err2) => {
           console.warn("[errata] git event handler failed:", err2);
@@ -77581,10 +78425,10 @@ function createWorkspaceEngine(opts) {
       console.warn("[errata] render ledger failed:", err2.message?.slice(0, 120));
     }
     writeContextFile(opts.workspaceRoot, body2);
-    const target = join29(opts.workspaceRoot, "AGENTS.md");
+    const target = join30(opts.workspaceRoot, "AGENTS.md");
     writeManagedBlock(target, { body: AGENTS_POINTER_BODY, stable: true, force: true });
     if (elicit) {
-      writePrimingHandles(join29(paths.configDir, "priming-handles.json"), [
+      writePrimingHandles(join30(paths.configDir, "priming-handles.json"), [
         ...snapshot.recentProblems.map((r) => r.node),
         // Resolved-band handles: the ✓ problem AND its Solution are citable
         // (a fix tag on an already-resolved problem no-ops idempotently; the
@@ -77604,7 +78448,21 @@ function createWorkspaceEngine(opts) {
     contextDirty = false;
     notifyDigest("recall");
   };
-  const normStackTokens = (xs) => (xs ?? []).map((t) => t.trim().toLowerCase().replace(/(?!^)[@\s].*$/, "")).filter(Boolean);
+  const outboundStack = () => retrievalStackTokens({
+    direct: readDirectDependencies(opts.workspaceRoot),
+    manifestDeps: readManifestDependencies(opts.workspaceRoot),
+    profileStack: profile?.stack ?? [],
+    // Languages ride the stack list: the cloud's context-affinity matcher
+    // resolves each token against both the Package and Language namespaces,
+    // and the profile keeps them in separate fields.
+    languages: profile?.languages ?? [],
+    contributePackages: loadConfig().consent.contributePackages,
+    // `repoLocator` feeds the Maven self-disclosure rule ONLY: a groupId
+    // carrying this project's own owner/repo token is the project naming
+    // itself, not a library it depends on.
+    registry: loadRegistryPolicy(opts.workspaceRoot, process.env, profile?.repoLocator),
+    ignorePatterns: loadClaimIgnorePatterns(opts.workspaceRoot)
+  }).tokens;
   const maybeRefreshRemotePriors = () => {
     if (opts.skipContextWriter || remoteInFlight) return;
     const now = Date.now();
@@ -77618,10 +78476,7 @@ function createWorkspaceEngine(opts) {
       const norm = normStackTokens;
       const seed = store.findNodesByLabel("Problem").sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt).slice(0, 6).map((p) => p.id);
       const q = {
-        // Languages ride the stack list: the cloud's context-affinity matcher
-        // resolves each token against both the Package and Language
-        // namespaces, and the profile keeps them in separate fields.
-        stack: norm([...profile.stack ?? [], ...profile.languages ?? []]),
+        stack: outboundStack(),
         domains: norm(profile.domains),
         kinds: ["Pattern", "Technique", "AntiPattern"],
         ...seed.length ? { seed } : {},
@@ -77665,7 +78520,7 @@ function createWorkspaceEngine(opts) {
       // longer concatenates these tokens into the embedding string, it
       // re-weights anchored hits with them (stated beats derived — the
       // intent text drives entry search, the stack only re-ranks).
-      stack: normStackTokens([...profile?.stack ?? [], ...profile?.languages ?? []]),
+      stack: outboundStack(),
       domains: normStackTokens(profile?.domains ?? []),
       kinds: ["Pattern", "Technique", "AntiPattern", "Problem", "Solution"],
       q: liveIntent,
@@ -77885,7 +78740,7 @@ function createWorkspaceEngine(opts) {
       resultSummary: { exitCode: e.exitCode ?? 1, errorTokens: e.errorTokens }
     });
   };
-  const turnCursorPath = join29(paths.configDir, "turn-cursors.json");
+  const turnCursorPath = join30(paths.configDir, "turn-cursors.json");
   const lastTurnUuid = loadTurnCursors(turnCursorPath);
   const turnOffset = loadTurnOffsets(turnCursorPath);
   const readLosses = { parseFailures: 0, ioFailures: 0, bytesUnreachable: 0, sliceGuardHits: 0 };
@@ -77940,7 +78795,7 @@ function createWorkspaceEngine(opts) {
     let processedTurns = 0;
     const seqAtStart = store.currentIngestSeq();
     const elicit = isEdgeElicitationEnabled();
-    const handleMap = elicit ? readPrimingHandles(join29(paths.configDir, "priming-handles.json")) : {};
+    const handleMap = elicit ? readPrimingHandles(join30(paths.configDir, "priming-handles.json")) : {};
     const wsRoot = (opts.workspaceRoot ?? "").replace(/\\/g, "/");
     const toRel = (abs) => {
       const p = abs.replace(/\\/g, "/");
@@ -78232,10 +79087,10 @@ function createWorkspaceEngine(opts) {
                 let enclosing = {};
                 if (p.location?.line !== void 0) {
                   try {
-                    const headSha = readGitRefState(join29(opts.workspaceRoot, ".git")).sha ?? void 0;
+                    const headSha = readGitRefState(join30(opts.workspaceRoot, ".git")).sha ?? void 0;
                     enclosing = {
                       line: p.location.line,
-                      fileText: readFileSync24(join29(opts.workspaceRoot, anchorPath), "utf8"),
+                      fileText: readFileSync25(join30(opts.workspaceRoot, anchorPath), "utf8"),
                       ...headSha ? { headSha } : {}
                     };
                   } catch {
@@ -78957,7 +79812,7 @@ B: ${b}`,
     try {
       const inputs = emitInputsFromManifest(paths.configDir, paths.skillsManifest);
       emitAndProjectSkills(opts.workspaceRoot, inputs);
-      writePrimingHandles(join29(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
+      writePrimingHandles(join30(paths.configDir, "priming-handles.json"), skillHandleNodes(inputs));
     } catch (err2) {
       console.warn("[skills] agent-skills projection failed (non-fatal):", err2 instanceof Error ? err2.message : err2);
     }
@@ -79250,7 +80105,7 @@ B: ${b}`,
         console.log(
           "[errata] sync skipped \u2014 cloud sync consent is off (enable with `errata consent sync on`)"
         );
-        const pending = existsSync24(paths.outbox) ? readdirSync10(paths.outbox).filter((f) => f.endsWith(".json")).length : 0;
+        const pending = existsSync25(paths.outbox) ? readdirSync10(paths.outbox).filter((f) => f.endsWith(".json")).length : 0;
         return { uploaded: 0, failed: 0, remaining: pending };
       }
       try {
@@ -79384,7 +80239,7 @@ async function startDaemon(opts) {
       );
       await engine.stop();
       try {
-        if (existsSync25(engine.paths.daemonLock)) {
+        if (existsSync26(engine.paths.daemonLock)) {
         }
       } catch {
       }
@@ -79406,7 +80261,7 @@ init_identity2();
 // src/multi.ts
 init_dist();
 init_src5();
-import { existsSync as existsSync31, readFileSync as readFileSync30, unlinkSync as unlinkSync3, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync32, readFileSync as readFileSync31, unlinkSync as unlinkSync3, writeFileSync as writeFileSync23 } from "node:fs";
 
 // src/principle-sync.ts
 init_src5();
@@ -79434,8 +80289,8 @@ init_reconcile();
 
 // src/lockfile-auto.ts
 init_src();
-import { existsSync as existsSync26, readFileSync as readFileSync25 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync26 } from "node:fs";
+import { join as join31 } from "node:path";
 
 // src/package-index.ts
 init_src();
@@ -79584,11 +80439,11 @@ function runLockfilePass(opts) {
     { file: "package-lock.json", parse: parsePackageLockJson }
   ];
   for (const c of candidates) {
-    const p = join30(opts.root, c.file);
-    if (!existsSync26(p)) continue;
+    const p = join31(opts.root, c.file);
+    if (!existsSync27(p)) continue;
     let sbom;
     try {
-      sbom = c.parse(readFileSync25(p, "utf8"));
+      sbom = c.parse(readFileSync26(p, "utf8"));
     } catch {
       continue;
     }
@@ -79645,8 +80500,8 @@ function noveltyAgainst(node2, neighbors, opts = {}) {
 }
 
 // src/public-symbols.ts
-import { readFileSync as readFileSync26, readdirSync as readdirSync11, existsSync as existsSync27 } from "node:fs";
-import { join as join31 } from "node:path";
+import { readFileSync as readFileSync27, readdirSync as readdirSync11, existsSync as existsSync28 } from "node:fs";
+import { join as join32 } from "node:path";
 var HEAD_BYTES = 8 * 1024;
 var INDEX_TTL_MS = 10 * 60 * 1e3;
 var MIN_SYMBOL_LEN = 4;
@@ -79679,20 +80534,20 @@ function bindingNames(clause) {
 function internalPackageNames(workspaceRoot) {
   const names = /* @__PURE__ */ new Set();
   const tryRead = (dir) => {
-    const pj = join31(dir, "package.json");
-    if (!existsSync27(pj)) return;
+    const pj = join32(dir, "package.json");
+    if (!existsSync28(pj)) return;
     try {
-      const name2 = JSON.parse(readFileSync26(pj, "utf8")).name;
+      const name2 = JSON.parse(readFileSync27(pj, "utf8")).name;
       if (typeof name2 === "string" && name2.length > 0) names.add(name2);
     } catch {
     }
   };
   tryRead(workspaceRoot);
   for (const group of ["packages", "apps"]) {
-    const groupDir = join31(workspaceRoot, group);
-    if (!existsSync27(groupDir)) continue;
+    const groupDir = join32(workspaceRoot, group);
+    if (!existsSync28(groupDir)) continue;
     try {
-      for (const entry of readdirSync11(groupDir)) tryRead(join31(groupDir, entry));
+      for (const entry of readdirSync11(groupDir)) tryRead(join32(groupDir, entry));
     } catch {
     }
   }
@@ -79705,7 +80560,7 @@ function publicSymbolIndex(store, workspaceRoot, deps = {}) {
   if (cached2 && now - cached2.builtAt < INDEX_TTL_MS) return cached2;
   const readHead = deps.readHead ?? ((absPath) => {
     try {
-      return readFileSync26(absPath, "utf8").slice(0, HEAD_BYTES);
+      return readFileSync27(absPath, "utf8").slice(0, HEAD_BYTES);
     } catch {
       return "";
     }
@@ -79725,7 +80580,7 @@ function publicSymbolIndex(store, workspaceRoot, deps = {}) {
   }
   const symbols = /* @__PURE__ */ new Set();
   for (const rel of files) {
-    const head2 = readHead(join31(workspaceRoot, rel));
+    const head2 = readHead(join32(workspaceRoot, rel));
     if (!head2) continue;
     for (const re of [NAMED_IMPORT_RE, REQUIRE_RE]) {
       re.lastIndex = 0;
@@ -80356,7 +81211,7 @@ var ConsolidateWorker = class {
 init_paths();
 
 // src/lock.ts
-import { existsSync as existsSync28, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync29, readFileSync as readFileSync28 } from "node:fs";
 function isProcessAlive(pid) {
   if (!pid || pid <= 0) return false;
   try {
@@ -80367,9 +81222,9 @@ function isProcessAlive(pid) {
   }
 }
 function readDaemonLock(lockPath) {
-  if (!existsSync28(lockPath)) return null;
+  if (!existsSync29(lockPath)) return null;
   try {
-    const lock = JSON.parse(readFileSync27(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync28(lockPath, "utf8"));
     return typeof lock.pid === "number" ? lock : null;
   } catch {
     return null;
@@ -80841,8 +81696,8 @@ async function hydrateProject(opts) {
 init_src7();
 init_src();
 import { execFile as execFile3 } from "node:child_process";
-import { readFileSync as readFileSync29 } from "node:fs";
-import { join as join33 } from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import { join as join34 } from "node:path";
 import { promisify } from "node:util";
 
 // src/history-walk.ts
@@ -81064,8 +81919,8 @@ function narrative(unit, group) {
 
 // src/history-bundle.ts
 import { execFile as execFile2 } from "node:child_process";
-import { readFileSync as readFileSync28 } from "node:fs";
-import { join as join32 } from "node:path";
+import { readFileSync as readFileSync29 } from "node:fs";
+import { join as join33 } from "node:path";
 
 // ../../packages/privacy/src/patterns/credentials.ts
 var CREDENTIAL_PATTERNS = [
@@ -81847,7 +82702,7 @@ function pathAllowedByFloor(path2) {
 function loadRepoIgnore(root, extraPatterns = []) {
   let source = "";
   try {
-    source = readFileSync28(join32(root, ".errataignore"), "utf8");
+    source = readFileSync29(join33(root, ".errataignore"), "utf8");
   } catch {
     source = "";
   }
@@ -82261,17 +83116,17 @@ async function defaultGit(root, args2) {
 function readIgnoreLines(root, profile) {
   let lines = [];
   try {
-    lines = readFileSync29(join33(root, ".errataignore"), "utf8").split("\n");
+    lines = readFileSync30(join34(root, ".errataignore"), "utf8").split("\n");
   } catch {
   }
   return [...lines, ...profile.ignoreExtra ?? []].map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 }
 async function spineForUnit(git3, root, unit) {
   const listing = await git3(root, ["ls-tree", "-r", "--name-only", unit.sha]);
-  const manifestPaths = listing.split("\n").map((l) => l.trim()).filter((p) => p && isManifestPath(p));
-  if (manifestPaths.length === 0) return void 0;
+  const manifestPaths2 = listing.split("\n").map((l) => l.trim()).filter((p) => p && isManifestPath(p));
+  if (manifestPaths2.length === 0) return void 0;
   const texts = /* @__PURE__ */ new Map();
-  for (const p of manifestPaths) {
+  for (const p of manifestPaths2) {
     try {
       texts.set(p, await git3(root, ["show", `${unit.sha}:${p}`]));
     } catch {
@@ -82589,9 +83444,9 @@ async function startHistoryStage(root, input, client, walk10 = {}) {
 // src/link-flow.ts
 init_cloud_auth();
 import { createHash as createHash15 } from "node:crypto";
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync29, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join34 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { existsSync as existsSync30, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join35 } from "node:path";
 
 // src/device-poll.ts
 var THROTTLED_POLL_MIN_WAIT_MS = 11e3;
@@ -82953,7 +83808,7 @@ async function linkThroughConsole(opts) {
 function collectRepoFacts(root) {
   const git3 = (args2) => {
     try {
-      return execFileSync4("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+      return execFileSync5("git", args2, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     } catch {
       return null;
     }
@@ -83024,8 +83879,8 @@ function applyLinkDecision(root, profile, config2, decision, now = Date.now) {
   delete nextProfile.projectLinkDisabled;
   let wroteIgnore = false;
   if (decision.writeIgnoreStarter !== false) {
-    const target = join34(root, ".errataignore");
-    if (!existsSync29(target)) {
+    const target = join35(root, ".errataignore");
+    if (!existsSync30(target)) {
       writeFileSync22(target, IGNORE_STARTER, "utf8");
       wroteIgnore = true;
     }
@@ -83038,12 +83893,12 @@ init_registry();
 
 // src/adopt.ts
 init_git_remote();
-import { existsSync as existsSync30 } from "node:fs";
-import { dirname as dirname12, join as join35 } from "node:path";
+import { existsSync as existsSync31 } from "node:fs";
+import { dirname as dirname12, join as join36 } from "node:path";
 function findGitRoot(absPath) {
   let dir = absPath;
   for (let depth = 0; depth < 64; depth++) {
-    if (existsSync30(join35(dir, ".git"))) return dir;
+    if (existsSync31(join36(dir, ".git"))) return dir;
     const parent = dirname12(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -83869,7 +84724,7 @@ async function startMultiDaemon(opts = {}) {
         lastActiveAt = Math.max(lastActiveAt, rec.engine.lastActivityAt());
       } catch {
       }
-      const reason = retireDecision({ exists: existsSync31(rec.root), lastActiveAt, now });
+      const reason = retireDecision({ exists: existsSync32(rec.root), lastActiveAt, now });
       if (reason) void retireWorkspace(rec, reason);
     }
   };
@@ -84756,7 +85611,7 @@ async function startMultiDaemon(opts = {}) {
       clearInterval(anchorPull);
       clearTimeout(codexWakeBoot);
       try {
-        const cur = readFileSync30(lockPath, "utf8");
+        const cur = readFileSync31(lockPath, "utf8");
         if (JSON.parse(cur).pid === process.pid) unlinkSync3(lockPath);
       } catch {
       }
@@ -85792,21 +86647,21 @@ async function cmdInit() {
   if (!skipHooks) {
     console.log("");
     console.log("installing harness hooks...");
-    const { existsSync: existsSync33 } = await import("node:fs");
-    const { join: join37 } = await import("node:path");
+    const { existsSync: existsSync34 } = await import("node:fs");
+    const { join: join38 } = await import("node:path");
     try {
       await installClaudeHooks(port);
     } catch (err2) {
       console.warn(`  \u26A0\uFE0F  Claude hook install failed: ${err2 instanceof Error ? err2.message : err2}`);
     }
-    if (existsSync33(join37(ROOT, ".cursor"))) {
+    if (existsSync34(join38(ROOT, ".cursor"))) {
       try {
         await installCursorMcpConfig();
       } catch (err2) {
         console.warn(`  \u26A0\uFE0F  Cursor MCP config failed: ${err2 instanceof Error ? err2.message : err2}`);
       }
     }
-    if (existsSync33(join37(ROOT, ".codex"))) {
+    if (existsSync34(join38(ROOT, ".codex"))) {
       try {
         await installCodexHooks(port);
       } catch (err2) {
@@ -85983,9 +86838,9 @@ async function cmdStatus() {
     console.log(`    stack:     ${profile.stack.join(", ") || "(none)"}`);
     console.log(`    languages: ${profile.languages.join(", ") || "(none)"}`);
   }
-  console.log(`  graph db:  ${existsSync32(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
-  console.log(`  event log: ${existsSync32(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
-  if (existsSync32(paths.castalia)) {
+  console.log(`  graph db:  ${existsSync33(paths.castalia) ? "yes" : "no"} (${paths.castalia})`);
+  console.log(`  event log: ${existsSync33(paths.eventLog) ? "yes" : "no"} (${paths.eventLog})`);
+  if (existsSync33(paths.castalia)) {
     try {
       const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
       const store = openGraphStore2({ path: paths.castalia });
@@ -86879,11 +87734,11 @@ function cmdInstallationProfile(args2) {
 }
 async function cmdReview() {
   const paths = workspacePaths(ROOT);
-  if (!existsSync32(paths.reviewQueue)) {
+  if (!existsSync33(paths.reviewQueue)) {
     console.log("(review queue empty)");
     return;
   }
-  const queue = JSON.parse(readFileSync31(paths.reviewQueue, "utf8"));
+  const queue = JSON.parse(readFileSync32(paths.reviewQueue, "utf8"));
   if (queue.length === 0) {
     console.log("(review queue empty)");
     return;
@@ -87554,7 +88409,7 @@ async function gatherRepo(store, ws) {
   };
 }
 async function gatherReportData(generatedAt) {
-  const { existsSync: existsSync33 } = await import("node:fs");
+  const { existsSync: existsSync34 } = await import("node:fs");
   const { openGraphStore: openGraphStore2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
   const cfg = loadConfig();
   const outbound = cfg.consent.sync ? "auto" : "off";
@@ -87562,7 +88417,7 @@ async function gatherReportData(generatedAt) {
   for (const ws of listWorkspaces()) {
     if (ws.missing) continue;
     const dbPath = workspacePaths(ws.path).castalia;
-    if (!existsSync33(dbPath)) continue;
+    if (!existsSync34(dbPath)) continue;
     let store = null;
     try {
       store = openGraphStore2({ path: dbPath });
@@ -87606,8 +88461,8 @@ async function cmdReport(args2) {
   const outDir = workspacePaths(ROOT).configDir;
   mkdirSync9(outDir, { recursive: true });
   const files = renderReport2(data, { includeFutureVerbs });
-  for (const f of files) writeFileSync24(join36(outDir, f.name), f.html, "utf8");
-  const indexPath = join36(outDir, "report.html");
+  for (const f of files) writeFileSync24(join37(outDir, f.name), f.html, "utf8");
+  const indexPath = join37(outDir, "report.html");
   console.log(`report \u2192 ${indexPath}`);
   console.log(
     `  ${data.repos.length} repo(s) \xB7 ${files.length} file(s) \xB7 ${data.rollup.nodes.toLocaleString("en-US")} nodes`
@@ -87662,7 +88517,7 @@ function spawnDaemonDetached(options = {}) {
   try {
     const logPath = daemonLogPath();
     try {
-      if (statSync7(logPath).size > 5 * 1024 * 1024) renameSync4(logPath, `${logPath}.1`);
+      if (statSync8(logPath).size > 5 * 1024 * 1024) renameSync4(logPath, `${logPath}.1`);
     } catch {
     }
     out2 = openSync2(logPath, "a");
@@ -87727,24 +88582,24 @@ async function cmdInstallHooks(args2) {
   }
 }
 async function installOpencodePlugin(port) {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync33, readFileSync: readFileSync32, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join37 } = await import("node:path");
-  const dir = join37(ROOT, ".opencode", "plugin");
-  if (!existsSync33(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join37(dir, "inerrata.js");
-  if (existsSync33(file2)) {
-    const head2 = readFileSync32(file2, "utf8").split("\n")[0] ?? "";
+  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
+  const { join: join38 } = await import("node:path");
+  const dir = join38(ROOT, ".opencode", "plugin");
+  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
+  const file2 = join38(dir, "inerrata.js");
+  if (existsSync34(file2)) {
+    const head2 = readFileSync33(file2, "utf8").split("\n")[0] ?? "";
     if (head2.trim() !== OPENCODE_PLUGIN_MARKER) {
       console.error(`refusing to overwrite ${file2}: not an errata-managed plugin (line 1 lacks the marker)`);
       process.exit(2);
     }
   }
   writeFileSync24(file2, buildOpencodePluginSource(port, { version: DAEMON_VERSION }), "utf8");
-  const cfgFile = join37(ROOT, "opencode.json");
+  const cfgFile = join38(ROOT, "opencode.json");
   let cfg = { $schema: "https://opencode.ai/config.json" };
-  if (existsSync33(cfgFile)) {
+  if (existsSync34(cfgFile)) {
     try {
-      cfg = JSON.parse(readFileSync32(cfgFile, "utf8"));
+      cfg = JSON.parse(readFileSync33(cfgFile, "utf8"));
     } catch {
       console.error(`refusing to touch invalid JSON at ${cfgFile} \u2014 fix it and re-run`);
       process.exit(2);
@@ -87775,15 +88630,15 @@ function errataMcpInvocation() {
   return { command: cmd2, args: args2 };
 }
 async function installClaudeHooks(port) {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync33, readFileSync: readFileSync32, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join37 } = await import("node:path");
-  const dir = join37(ROOT, ".claude");
-  if (!existsSync33(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join37(dir, "settings.json");
+  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
+  const { join: join38 } = await import("node:path");
+  const dir = join38(ROOT, ".claude");
+  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
+  const file2 = join38(dir, "settings.json");
   let settings = {};
-  if (existsSync33(file2)) {
+  if (existsSync34(file2)) {
     try {
-      settings = JSON.parse(readFileSync32(file2, "utf8"));
+      settings = JSON.parse(readFileSync33(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -87832,7 +88687,7 @@ async function installClaudeHooks(port) {
   writeFileSync24(file2, JSON.stringify(settings, null, 2) + "\n", "utf8");
   console.log(`installed Claude Code hooks \u2192 ${file2}`);
   await installClaudeMcpConfig();
-  const claudeMd = join37(ROOT, "CLAUDE.md");
+  const claudeMd = join38(ROOT, "CLAUDE.md");
   const recall = writeManagedBlock(claudeMd, { body: RECALL_FIRST_BLOCK });
   if (recall.kind === "collision") {
     console.warn(
@@ -87844,15 +88699,15 @@ async function installClaudeHooks(port) {
   console.log(`  endpoint: http://127.0.0.1:${port}/api/hook`);
 }
 async function installClaudeMcpConfig() {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync33, readFileSync: readFileSync32, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join37, dirname: dirname13 } = await import("node:path");
-  const file2 = join37(ROOT, ".mcp.json");
+  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
+  const { join: join38, dirname: dirname13 } = await import("node:path");
+  const file2 = join38(ROOT, ".mcp.json");
   const dir = dirname13(file2);
-  if (!existsSync33(dir)) mkdirSync9(dir, { recursive: true });
+  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
   let cfg = {};
-  if (existsSync33(file2)) {
+  if (existsSync34(file2)) {
     try {
-      cfg = JSON.parse(readFileSync32(file2, "utf8"));
+      cfg = JSON.parse(readFileSync33(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -87866,15 +88721,15 @@ async function installClaudeMcpConfig() {
   console.log(`  Tools: errata.search / locate / neighbors / callers_of / what_uses / show / similar`);
 }
 async function installCursorMcpConfig() {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync33, readFileSync: readFileSync32, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join37 } = await import("node:path");
-  const dir = join37(ROOT, ".cursor");
-  if (!existsSync33(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join37(dir, "mcp.json");
+  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
+  const { join: join38 } = await import("node:path");
+  const dir = join38(ROOT, ".cursor");
+  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
+  const file2 = join38(dir, "mcp.json");
   let cfg = {};
-  if (existsSync33(file2)) {
+  if (existsSync34(file2)) {
     try {
-      cfg = JSON.parse(readFileSync32(file2, "utf8"));
+      cfg = JSON.parse(readFileSync33(file2, "utf8"));
     } catch {
       console.error(`refusing to overwrite invalid JSON at ${file2}`);
       process.exit(2);
@@ -87890,14 +88745,14 @@ async function installCursorMcpConfig() {
   console.log(`  \u26A0\uFE0F  reload Cursor (Cmd/Ctrl-Shift-P \u2192 "Reload Window") to pick it up.`);
 }
 async function installCodexHooks(port) {
-  const { mkdirSync: mkdirSync9, existsSync: existsSync33, readFileSync: readFileSync32, writeFileSync: writeFileSync24 } = await import("node:fs");
-  const { join: join37 } = await import("node:path");
-  const dir = join37(ROOT, ".codex");
-  if (!existsSync33(dir)) mkdirSync9(dir, { recursive: true });
-  const file2 = join37(dir, "config.toml");
+  const { mkdirSync: mkdirSync9, existsSync: existsSync34, readFileSync: readFileSync33, writeFileSync: writeFileSync24 } = await import("node:fs");
+  const { join: join38 } = await import("node:path");
+  const dir = join38(ROOT, ".codex");
+  if (!existsSync34(dir)) mkdirSync9(dir, { recursive: true });
+  const file2 = join38(dir, "config.toml");
   let existing = "";
-  if (existsSync33(file2)) {
-    existing = readFileSync32(file2, "utf8");
+  if (existsSync34(file2)) {
+    existing = readFileSync33(file2, "utf8");
     const beginIdx = existing.indexOf(CODEX_HOOKS_BEGIN);
     const endIdx = existing.indexOf(CODEX_HOOKS_END);
     if (beginIdx >= 0 && endIdx > beginIdx) {
@@ -88252,7 +89107,7 @@ async function cmdDash(args2) {
       await yieldToLoop2();
       try {
         const items = selectDurableMemory(handle2.sharedStore, r.engine.profile);
-        const res = bleedRules(join36(r.root, ".claude", "rules"), items);
+        const res = bleedRules(join37(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(
             `[rules:${r.entry.name}] ${res.written} collective principle(s) \u2192 .claude/rules` + (res.pruned ? `, ${res.pruned} pruned` : "")