@mnemonik/cli 7.140.1 → 7.140.3

package/dist/scanner/enable.js

@@ -729,13 +729,13 @@ var require_ignore = __commonJS({
         const rules = this._rules;
         const { length } = rules;
         const shortcut = this._basenameCount * 2 >= length;
-        const basename2 = shortcut ? basenameOf(path) : path;
+        const basename3 = shortcut ? basenameOf(path) : path;
         for (let index = 0; index < length; index++) {
           const rule = rules[index];
           const { negative } = rule;
           const skip = unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored;
           if (!skip && rule[mode].test(
-            shortcut && rule._basenameOnly ? basename2 : path
+            shortcut && rule._basenameOnly ? basename3 : path
           )) {
             ignored = !negative;
             unignored = negative;
@@ -885,6 +885,116 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+function isConfigurationOnly(text) {
+  try {
+    const value = JSON.parse(text);
+    return !!value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1);
+  } catch {
+    return false;
+  }
+}
+async function readIdentityFile(dir, options = {}) {
+  const path = join(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    const text = await readFile(path, "utf8");
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: "absent" };
+    return parseIdentityFile(text);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+    IDENTITY_KEYS = /* @__PURE__ */ new Set([
+      "schemaVersion",
+      "projectId",
+      "projectName",
+      "repositoryFingerprint"
+    ]);
+    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -893,7 +1003,7 @@ var init_hookTimeouts = __esm({
 });
 
 // packages/shared/dist/runtimeSigners.js
-import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
+import { basename, dirname as dirname2, join as join3, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
 function windowsCommand(file) {
   const root = process.env.SystemRoot;
@@ -982,18 +1092,265 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
+import { lstat as lstat2, readFile as readFile2, realpath } from "node:fs/promises";
+import { execFile as execFile2 } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
+function gitEnvironment() {
+  const env = {};
+  for (const key of GIT_ENV_KEYS) {
+    if (process.env[key] !== void 0)
+      env[key] = process.env[key];
+  }
+  env.LC_ALL = "C";
+  return env;
+}
+function runGit(cwd, args2) {
+  return new Promise((resolvePromise, reject) => {
+    execFile2("git", args2, { cwd, timeout: GIT_TIMEOUT_MS, encoding: "utf8", env: gitEnvironment() }, (error, stdout, stderr) => {
+      if (error)
+        reject(Object.assign(error, { stdout, stderr }));
+      else
+        resolvePromise({ stdout, stderr });
+    });
+  });
+}
+async function boundaryAt(path) {
+  try {
+    const stat = await lstat2(join4(path, ".git"));
+    if (stat.isDirectory())
+      return { path, kind: "directory" };
+    if (stat.isFile())
+      return { path, kind: "file" };
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR")
+      throw error;
+  }
+  return void 0;
+}
+async function confirmedBoundaryAt(path) {
+  const boundary = await boundaryAt(path);
+  if (!boundary)
+    return void 0;
+  try {
+    const { stdout } = await runGit(path, ["rev-parse", "--git-dir"]);
+    return stdout.trim() ? boundary : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function boundariesBetween(cwd, root) {
+  const boundaries = [];
+  let directory = cwd;
+  while (!samePath(directory, root)) {
+    const boundary = await confirmedBoundaryAt(directory);
+    if (boundary)
+      boundaries.push(boundary);
+    const parent = dirname3(directory);
+    if (parent === directory)
+      break;
+    directory = parent;
+  }
+  return boundaries;
+}
+async function containingRepository(root) {
+  let directory = dirname3(root);
+  while (true) {
+    const boundary = await confirmedBoundaryAt(directory);
+    if (boundary)
+      return boundary;
+    const parent = dirname3(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function canonicalPath(path) {
+  const absolute = resolve2(path);
+  return realpath(absolute).catch(() => absolute);
+}
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+async function resolveRepositoryRoot(cwd) {
+  const absoluteCwd = await canonicalPath(cwd);
+  try {
+    const { stdout } = await runGit(absoluteCwd, [
+      "rev-parse",
+      "--show-toplevel",
+      "--git-dir",
+      "--git-common-dir"
+    ]);
+    const [rootLine, gitDirLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
+    if (!rootLine || !gitDirLine || !commonLine || extra.length) {
+      return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
+    }
+    const fromGit = (line) => canonicalPath(resolve2(absoluteCwd, line));
+    const root = await fromGit(rootLine);
+    const gitDir = await fromGit(gitDirLine);
+    const commonDir = await fromGit(commonLine);
+    const isLinkedWorktree = !samePath(gitDir, commonDir);
+    const nested = await boundariesBetween(absoluteCwd, root);
+    if (!isLinkedWorktree && await containingRepository(root)) {
+      const boundary = await boundaryAt(root);
+      if (boundary)
+        nested.push(boundary);
+    }
+    return {
+      kind: "git",
+      root,
+      commonDir,
+      isLinkedWorktree,
+      nested
+    };
+  } catch (error) {
+    const failure = error;
+    if (failure.code === 128 && /not a git repository/i.test(failure.stderr ?? failure.message)) {
+      return { kind: "plain", root: absoluteCwd };
+    }
+    return { kind: "git_unavailable", detail: failure.message };
+  }
+}
+async function linkedWorktreeCommonDir(dir) {
+  try {
+    if (!(await lstat2(join4(dir, ".git"))).isFile())
+      return void 0;
+    const pointer = /^gitdir:\s*(.+?)\s*$/im.exec(await readFile2(join4(dir, ".git"), "utf8"))?.[1];
+    if (!pointer)
+      return void 0;
+    const gitDir = resolve2(dir, pointer);
+    const common = (await readFile2(join4(gitDir, "commondir"), "utf8")).trim();
+    return common ? await canonicalPath(resolve2(gitDir, common)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function mainCheckout(worktreeTop, commonDir) {
+  try {
+    const { stdout } = await runGit(worktreeTop, ["worktree", "list", "--porcelain"]);
+    const first = stdout.split(/\r?\n\r?\n/)[0] ?? "";
+    const path = /^worktree (.+)$/m.exec(first)?.[1];
+    if (path) {
+      const main = await canonicalPath(resolve2(worktreeTop, path));
+      return /^bare$/m.test(first) ? dirname3(main) : main;
+    }
+  } catch {
+  }
+  return dirname3(commonDir);
+}
+async function readPlainIdentity(start2) {
+  const home = await canonicalPath(homedir());
+  let directory = start2;
+  while (true) {
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (samePath(directory, home))
+      break;
+    const parent = dirname3(directory);
+    if (parent === directory)
+      break;
+    directory = parent;
+  }
+  return { root: start2, result: { kind: "absent" } };
+}
+async function nearestIdentity(start2) {
+  const home = await canonicalPath(homedir());
+  let directory = start2;
+  while (true) {
+    const commonDir = await linkedWorktreeCommonDir(directory);
+    if (commonDir)
+      return { worktreeTop: directory, commonDir };
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (samePath(directory, home))
+      return void 0;
+    const parent = dirname3(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function resolveNearestProjectIdentity(cwd) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const nested = repository.kind === "git" ? repository.nested : [];
+  let found = await nearestIdentity(start2);
+  if (found && "worktreeTop" in found) {
+    found = await readPlainIdentity(await mainCheckout(found.worktreeTop, found.commonDir));
+  }
+  if (found) {
+    return shapedIdentity(found, await projectFolderRepository(found.root, repository), nested);
+  }
+  return { ...withBase(repository, repository.root, nested), kind: "absent" };
+}
+async function resolveNamedProjectIdentity(cwd, options) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const commonDir = await linkedWorktreeCommonDir(start2);
+  const root = commonDir ? await mainCheckout(start2, commonDir) : start2;
+  return shapedIdentity({ root, result: await readIdentityFile(root, options) }, await projectFolderRepository(root, repository), repository.kind === "git" ? repository.nested : []);
+}
+function shapedIdentity(found, repository, nested) {
+  const base = withBase(repository, found.root, nested);
+  if (found.result.kind === "ok")
+    return { ...base, ...found.result };
+  if (found.result.kind === "unknown_version")
+    return { ...base, ...found.result, path: found.root };
+  if (found.result.kind === "malformed")
+    return { ...base, ...found.result, path: found.root };
+  return { ...base, kind: "absent" };
+}
+async function projectFolderRepository(projectRoot, known) {
+  if (known.kind === "git" && samePath(known.root, projectRoot))
+    return known;
+  const repository = await resolveRepositoryRoot(projectRoot);
+  if (repository.kind === "git" && samePath(repository.root, projectRoot))
+    return repository;
+  return { kind: "plain", root: projectRoot };
+}
+function withBase(repository, root, nested) {
+  return { root, repository, nested };
+}
+async function resolveProjectIdentity(cwd, options = {}) {
+  if (options.selectedRoot || options.namedRoot) {
+    return resolveNamedProjectIdentity(cwd, { selectedRoot: options.selectedRoot });
+  }
+  return resolveNearestProjectIdentity(cwd);
+}
+var GIT_TIMEOUT_MS, GIT_ENV_KEYS;
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
     "use strict";
     init_projectIdentityFile();
+    GIT_TIMEOUT_MS = 2e3;
+    GIT_ENV_KEYS = [
+      "PATH",
+      "HOME",
+      "LANG",
+      "LC_ALL",
+      "SYSTEMROOT",
+      "TEMP",
+      "TMP",
+      "USERPROFILE"
+    ];
+  }
+});
+
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
   }
 });
 
@@ -1068,10 +1425,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -1567,8 +1926,8 @@ var require_graceful_fs = __commonJS({
       fs4.createReadStream = createReadStream;
       fs4.createWriteStream = createWriteStream;
       var fs$readFile = fs4.readFile;
-      fs4.readFile = readFile3;
-      function readFile3(path, options, cb) {
+      fs4.readFile = readFile5;
+      function readFile5(path, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path, options, cb);
@@ -2574,12 +2933,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args2) => new Promise((resolve2, reject) => {
+      return (...args2) => new Promise((resolve3, reject) => {
         args2.push((err2, result) => {
           if (err2) {
             reject(err2);
           } else {
-            resolve2(result);
+            resolve3(result);
           }
         });
         method(...args2);
@@ -2654,12 +3013,12 @@ var require_proper_lockfile = __commonJS({
 
 // packages/cli/src/scanner/enable.ts
 import { revokeInstallComponent } from "../install/transaction.js";
-import { mkdir as mkdir2, readFile as readFile2, realpath } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile4, realpath as realpath2 } from "node:fs/promises";
+import { basename as basename2, join as join7 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -2696,6 +3055,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -4326,13 +4688,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url) => {
         if (isFileURI(url)) {
-          return new Promise((resolve2, reject) => {
+          return new Promise((resolve3, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve2(xhr.response);
+                resolve3(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -4528,9 +4890,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info22 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         Module["instantiateWasm"](info22, (mod, inst) => {
-          resolve2(receiveInstance(mod, inst));
+          resolve3(receiveInstance(mod, inst));
         });
       });
     }
@@ -5863,8 +6225,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve2, reject) => {
-      readyPromiseResolve = resolve2;
+    moduleRtn = new Promise((resolve3, reject) => {
+      readyPromiseResolve = resolve3;
       readyPromiseReject = reject;
     });
   }
@@ -6741,9 +7103,9 @@ var Query = class {
 };
 
 // packages/shared/dist/ast/grammars.js
-import { dirname, extname, join } from "node:path";
+import { dirname, extname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
-var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
+var WASM_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
@@ -6921,6 +7283,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6936,6 +7299,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/shared/dist/readiness.js
 var READINESS_SCHEMA_VERSION = 1;
@@ -7041,9 +7405,9 @@ init_hookRuntime();
 import { createHash, randomUUID } from "node:crypto";
 import { execFile as nodeExecFile } from "node:child_process";
 import fs2 from "node:fs";
-import { open, rename, readFile, mkdir, lstat, chmod, writeFile, unlink, rmdir } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname as dirname3, join as join3, win32 as win322, posix } from "node:path";
+import { open, rename, readFile as readFile3, mkdir, lstat as lstat3, chmod, writeFile, unlink, rmdir } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname4, join as join5, win32 as win322, posix } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 var lockfileKey = /* @__PURE__ */ Symbol.for("mnemonik.proper-lockfile");
 function sharedLockfile() {
@@ -7051,7 +7415,7 @@ function sharedLockfile() {
   return shared[lockfileKey] ??= Promise.resolve().then(() => __toESM(require_proper_lockfile(), 1)).then((module2) => module2.default);
 }
 var codeIs = (error, code) => error.code === code;
-function stateDirectory(platform = process.platform, env = process.env, home = homedir()) {
+function stateDirectory(platform = process.platform, env = process.env, home = homedir2()) {
   if (env.MNEMONIK_STATE_DIR)
     return env.MNEMONIK_STATE_DIR;
   if (platform === "win32")
@@ -7062,9 +7426,9 @@ function stateDirectory(platform = process.platform, env = process.env, home = h
 }
 async function readBytes(path) {
   try {
-    if (!(await lstat(path)).isFile())
+    if (!(await lstat3(path)).isFile())
       throw new Error("setup_requires_regular_file");
-    return await readFile(path);
+    return await readFile3(path);
   } catch (error) {
     if (codeIs(error, "ENOENT"))
       return null;
@@ -7085,9 +7449,9 @@ var windowsCurrentAccount = windowsCurrentAccountSync;
 async function windowsCurrentUserAcl(path, directory = false, options = {}, created = false) {
   const username = options.username ?? `*${windowsCurrentAccount().sid}`;
   const grant = `${username}:${directory ? "(OI)(CI)F" : "F"}`;
-  const execFile2 = options.execFile ?? nodeExecFile;
-  await new Promise((resolve2, reject) => {
-    execFile2("icacls.exe", [
+  const execFile3 = options.execFile ?? nodeExecFile;
+  await new Promise((resolve3, reject) => {
+    execFile3("icacls.exe", [
       path,
       "/inheritance:r",
       "/grant:r",
@@ -7097,7 +7461,7 @@ async function windowsCurrentUserAcl(path, directory = false, options = {}, crea
       if (error)
         reject(error);
       else
-        resolve2();
+        resolve3();
     });
   });
 }
@@ -7126,14 +7490,14 @@ async function atomicWrite(path, bytes, fault, assertOwned) {
   }
   await assertOwned?.();
   await rename(temp, path);
-  await syncDirectory(dirname3(path));
+  await syncDirectory(dirname4(path));
   return permissionStatus;
 }
 async function withLock(path, waitMs, work) {
   const lockfile = await sharedLockfile();
-  await mkdir(dirname3(path), { recursive: true, mode: 448 });
+  await mkdir(dirname4(path), { recursive: true, mode: 448 });
   const generation = randomUUID();
-  const owner = join3(`${path}.lock`, "owner");
+  const owner = join5(`${path}.lock`, "owner");
   let compromised = false;
   let acquired = false;
   const assertOwned = async () => {
@@ -7148,14 +7512,14 @@ async function withLock(path, waitMs, work) {
       void mkdir(dir).then(() => writeFile(owner, generation, { mode: 384, flag: "wx" })).then(() => callback(), callback);
     },
     rmdir: (dir, callback) => {
-      void unlink(join3(dir, "owner")).catch((error) => {
+      void unlink(join5(dir, "owner")).catch((error) => {
         if (!codeIs(error, "ENOENT"))
           throw error;
       }).then(() => rmdir(dir)).then(() => callback(), callback);
     },
     rmdirSync: (dir) => {
       try {
-        fs2.unlinkSync(join3(dir, "owner"));
+        fs2.unlinkSync(join5(dir, "owner"));
       } catch (error) {
         if (!codeIs(error, "ENOENT"))
           throw error;
@@ -7201,15 +7565,15 @@ async function withLock(path, waitMs, work) {
 import { spawn as nodeSpawn } from "node:child_process";
 import { realpathSync } from "node:fs";
 import { stat as nodeStat, utimes } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var DAY_MS = 864e5;
-var statePath = (stateDir) => join4(stateDir, "automatic-update.json");
+var statePath = (stateDir) => join6(stateDir, "automatic-update.json");
 function cliLauncherPath(options = {}) {
   const platform = options.platform ?? process.platform;
-  const home = options.home ?? homedir2();
-  return platform === "win32" ? join4(options.env?.LOCALAPPDATA || join4(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join4(home, ".local", "bin", "mnemonik");
+  const home = options.home ?? homedir3();
+  return platform === "win32" ? join6(options.env?.LOCALAPPDATA || join6(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join6(home, ".local", "bin", "mnemonik");
 }
 async function readState(path) {
   const bytes = await readBytes(path);
@@ -7317,6 +7681,8 @@ import {
   connectedProjectsMessage,
   createRealProjectRuntime,
   ensureProjectRoot,
+  insideProjectLine,
+  projectFolderFor,
   projectLimitMessage
 } from "../project.js";
 import { consentDraft, runScannerBoundaryPicker } from "./picker.js";
@@ -7324,10 +7690,10 @@ var scannerStateBytes = (state) => Buffer.from(`${JSON.stringify(state, null, 2)
 `);
 var SCANNER_APPROVAL_WAIT = "Waiting for approval in your browser, up to 10 minutes.";
 async function updateScannerRoots(options) {
-  await mkdir2(join5(options.stateDir, "scanner"), { recursive: true, mode: 448 });
-  return withLock(join5(options.stateDir, "scanner/enable"), 5e3, async () => {
-    const path = join5(options.stateDir, "scanner/state.json");
-    const state = JSON.parse(await readFile2(path, "utf8"));
+  await mkdir2(join7(options.stateDir, "scanner"), { recursive: true, mode: 448 });
+  return withLock(join7(options.stateDir, "scanner/enable"), 5e3, async () => {
+    const path = join7(options.stateDir, "scanner/state.json");
+    const state = JSON.parse(await readFile4(path, "utf8"));
     const response = await (options.fetch ?? fetch)(
       `${apiOrigin()}/api/v1/scanner-consent/current`,
       {
@@ -7392,7 +7758,10 @@ async function enableScanner(options) {
     const executor = await prepared.projectExecutor();
     const connected = [];
     let limit;
-    for (const root of [...prepared.roots]) {
+    const projectFolders = /* @__PURE__ */ new Set();
+    for (const folder of prepared.roots)
+      projectFolders.add(await projectFolderFor(folder, executor));
+    for (const root of projectFolders) {
       const result = await ensureProjectRoot(root, executor);
       if (result.status === "done") connected.push(root);
       else {
@@ -7415,13 +7784,13 @@ async function enableScanner(options) {
   });
 }
 async function prepareScanner(options, work) {
-  await mkdir2(join5(options.stateDir, "scanner"), { recursive: true, mode: 448 });
-  return withLock(join5(options.stateDir, "scanner/enable"), 5e3, async () => {
-    const path = join5(options.stateDir, "scanner/state.json");
+  await mkdir2(join7(options.stateDir, "scanner"), { recursive: true, mode: 448 });
+  return withLock(join7(options.stateDir, "scanner/enable"), 5e3, async () => {
+    const path = join7(options.stateDir, "scanner/state.json");
     if (await resumeAbandonedPause(options))
       if (options.nonInteractive) options.output.error(ABANDONED_PAUSE_RESUMED);
       else options.output.line(ABANDONED_PAUSE_RESUMED);
-    const saved = JSON.parse(await readFile2(path, "utf8").catch(() => "null"));
+    const saved = JSON.parse(await readFile4(path, "utf8").catch(() => "null"));
     const credentials = options.credentials ?? createCliCredentials({ stateDir: options.stateDir });
     const authorize = options.authorize ?? (async (selection, installation) => {
       const auth = createCliAuth({
@@ -7500,8 +7869,22 @@ async function prepareScanner(options, work) {
       if ("status" in picked) throw new Error("consent_declined");
       if (!picked.roots.length && !picked.candidates?.length)
         throw new Error("scan_roots_required");
-      picked.roots = await Promise.all(picked.roots.map((root) => realpath(root)));
-      picked.exclusions = await Promise.all(picked.exclusions.map((root) => realpath(root)));
+      picked.roots = await Promise.all(picked.roots.map((root) => realpath2(root)));
+      if (options.roots) {
+        const resolver = options.projectExecutor ?? { resolveProjectIdentity };
+        const folders = [];
+        for (const named of picked.roots) {
+          const folder = await projectFolderFor(named, resolver);
+          if (folder !== named) {
+            const line = insideProjectLine(basename2(named), folder);
+            if (options.nonInteractive) options.output.error(line);
+            else options.output.line(line);
+          }
+          if (!folders.includes(folder)) folders.push(folder);
+        }
+        picked.roots = folders;
+      }
+      picked.exclusions = await Promise.all(picked.exclusions.map((root) => realpath2(root)));
       for (const root of picked.roots) {
         const decision = await evaluateRoot(
           { kind: "absent", root, repository: await repositoryAt(root), nested: [] },
@@ -7757,7 +8140,7 @@ async function restoreScannerInstall(journal, options) {
     if (!before?.installed) await service.restore("scanner", record.before);
   }
   if (record?.started)
-    await observeScannerState(journal, join5(options.stateDir, "scanner/state.json"));
+    await observeScannerState(journal, join7(options.stateDir, "scanner/state.json"));
   for (const target of [...journal.data.targets].reverse().filter((t) => t.group?.startsWith("scanner:")))
     await journal.restore(target);
   if (record?.started && before?.installed) await service.restore("scanner", record.before);