@orquentra/codebuddy 2.6.2 → 2.8.0

package/dist/{chunk-R7CD6EXS.js → chunk-ZNLSCV3J.js}

@@ -1,67 +1,81 @@
-import {
-  MEMORY_CLASSES,
-  memoryCandidateSchema
-} from "./chunk-IHQM2ZDV.js";
 import {
   SessionCapsuleLedger,
   detectTestCommand,
   estimateTokens,
-  findCoveringTest,
+  findCoveringTest
+} from "./chunk-GKNYMNFM.js";
+import {
+  recordTrace
+} from "./chunk-XL2HLACE.js";
+import {
   hookRoot
-} from "./chunk-J2EAZ4MA.js";
+} from "./chunk-TGFTKWOR.js";
+import {
+  MEMORY_CLASSES,
+  memoryCandidateSchema
+} from "./chunk-DFV2SK6C.js";
+import {
+  INCIDENT_SEVERITIES,
+  MemoryFileStore,
+  admitsLexically,
+  isEligibleMemory,
+  lexicalTerms,
+  termOverlap
+} from "./chunk-6KGYAFG7.js";
+import {
+  generateEntityId
+} from "./chunk-CAEPHLHC.js";
 import {
   TASK_PATH_LIMIT,
   countTerms,
   discoverTaskPaths,
   identifierTokens,
-  loadFreshIndex,
   loadProjectArchitectureMap,
   namedSegments,
   readBoundedSource,
+  syncFileVectors,
   taskTerms
-} from "./chunk-NERKZSSE.js";
+} from "./chunk-TLWGZVPC.js";
+import {
+  loadFreshIndex
+} from "./chunk-ITQO632W.js";
 import {
   extractSymbolTable,
   supportsSymbols
-} from "./chunk-PQK3GKZH.js";
-import {
-  INCIDENT_SEVERITIES,
-  MemoryFileStore,
-  isEligibleMemory,
-  lexicalTerms,
-  termOverlap
-} from "./chunk-S6VEG4S2.js";
+} from "./chunk-Y7D7PUBE.js";
 import {
+  REDACTED_LINE,
   claimText,
+  isCredentialPath,
+  loadKnownSecretValues,
   redactPersisted,
   redactSensitive,
+  redactSourceText,
   scanFields,
   scanSensitive
-} from "./chunk-GDJH7XJC.js";
-import {
-  generateEntityId
-} from "./chunk-XBJQKCLU.js";
+} from "./chunk-AL6VBTNA.js";
 import {
   DEFAULT_RERANK_MODELS
-} from "./chunk-JPHJBCZB.js";
+} from "./chunk-HPOR6YXA.js";
 import {
-  assertNoSymlinkBetween,
-  composeMarkdown,
   loadPlanPolicy,
   loadRuntimeConfig,
+  readConfigFile
+} from "./chunk-KNR2P2UY.js";
+import {
+  assertNoSymlinkBetween,
+  composeMarkdown,
   parseFrontMatter,
-  readConfigFile,
   writeAtomic
-} from "./chunk-5KZY6OTG.js";
+} from "./chunk-CG5B3LYG.js";
 
 // src/hooks/runtime.ts
-import { mkdir as mkdir6, readFile as readFile8, rm as rm4, stat as stat5, writeFile } from "fs/promises";
-import { basename, dirname as dirname5, isAbsolute, join as join8, relative as relative5, resolve as resolve9, sep as sep5 } from "path";
+import { mkdir as mkdir5, readFile as readFile7, rm as rm4, stat as stat4, writeFile } from "fs/promises";
+import { basename, dirname as dirname5, isAbsolute, join as join7, relative as relative5, resolve as resolve9, sep as sep5 } from "path";
 import pTimeout2 from "p-timeout";
 
 // src/context/engine.ts
 import { execFile } from "child_process";
-import { readFile as readFile4 } from "fs/promises";
 import { join as join4, resolve as resolve5 } from "path";
 import { promisify } from "util";
 
@@ -307,193 +321,10 @@ async function releaseOwnedLock(lockPath) {
   }
 }
 
-// src/core/plan-lifecycle.ts
-var TRANSITIONS = {
-  draft: ["approved", "abandoned"],
-  approved: ["executing", "abandoned"],
-  executing: ["complete", "abandoned"],
-  complete: [],
-  abandoned: []
-};
-var AMENDABLE = ["draft", "executing"];
-var PlanTransitionError = class extends Error {
-  constructor(from, to) {
-    super(`Illegal plan transition: ${from} \u2192 ${to}.`);
-    this.name = "PlanTransitionError";
-  }
-};
-var PlanNotFoundError = class extends Error {
-  constructor(id) {
-    super(`Plan ${id} not found.`);
-    this.name = "PlanNotFoundError";
-  }
-};
-var ActivePlanExistsError = class extends Error {
-  activePlanId;
-  constructor(namespace, activePlanId) {
-    super(
-      `Namespace "${namespace}" already has an active plan (${activePlanId}). Complete or abandon it before approving another.`
-    );
-    this.name = "ActivePlanExistsError";
-    this.activePlanId = activePlanId;
-  }
-};
-var DEFAULT_BODY = [
-  "# Goal",
-  "",
-  "(what this plan achieves)",
-  "",
-  "# Approach",
-  "",
-  "(ordered steps)",
-  "",
-  "# Notes",
-  "",
-  "(freeform; ignored by tooling)"
-].join("\n");
-var PlanLifecycle = class {
-  store;
-  constructor(store) {
-    this.store = store;
-  }
-  async create(input) {
-    const id = generateEntityId("pln");
-    const now = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
-    await this.store.writePlan({
-      id,
-      namespace: input.namespace,
-      title: input.title,
-      status: "draft",
-      brief: input.brief,
-      filesToTouch: input.filesToTouch ?? [],
-      testsToAdd: input.testsToAdd ?? [],
-      outOfScope: input.outOfScope ?? [],
-      risks: input.risks ?? [],
-      createdAt: now,
-      createdByAgent: input.createdByAgent ?? null,
-      approvedAt: null,
-      executingAt: null,
-      completedAt: null,
-      abandonedAt: null,
-      commitSha: null,
-      abandonReason: null,
-      body: input.body ?? DEFAULT_BODY
-    });
-    return this.store.readPlan(id);
-  }
-  async approve(id, now = (/* @__PURE__ */ new Date()).toISOString()) {
-    const current = await this.require(id);
-    return this.store.withNamespaceLock(current.namespace, async () => {
-      const fresh = await this.require(id);
-      this.assertTransition(fresh.status, "approved");
-      const active = await this.store.findActivePlan(fresh.namespace);
-      if (active && active.id !== id) {
-        throw new ActivePlanExistsError(fresh.namespace, active.id);
-      }
-      return this.rewrite(fresh, { status: "approved", approvedAt: now });
-    });
-  }
-  async start(id, now = (/* @__PURE__ */ new Date()).toISOString()) {
-    const current = await this.require(id);
-    return this.store.withNamespaceLock(current.namespace, async () => {
-      const fresh = await this.require(id);
-      this.assertTransition(fresh.status, "executing");
-      return this.rewrite(fresh, { status: "executing", executingAt: now });
-    });
-  }
-  async complete(id, options = {}, now = (/* @__PURE__ */ new Date()).toISOString()) {
-    const current = await this.require(id);
-    return this.store.withNamespaceLock(current.namespace, async () => {
-      const fresh = await this.require(id);
-      this.assertTransition(fresh.status, "complete");
-      return this.rewrite(fresh, {
-        status: "complete",
-        completedAt: now,
-        ...options.commitSha !== void 0 ? { commitSha: options.commitSha } : {}
-      });
-    });
-  }
-  async abandon(id, options = {}, now = (/* @__PURE__ */ new Date()).toISOString()) {
-    const current = await this.require(id);
-    return this.store.withNamespaceLock(current.namespace, async () => {
-      const fresh = await this.require(id);
-      this.assertTransition(fresh.status, "abandoned");
-      return this.rewrite(fresh, {
-        status: "abandoned",
-        abandonedAt: now,
-        ...options.reason !== void 0 ? { abandonReason: options.reason } : {}
-      });
-    });
-  }
-  async amend(id, patch) {
-    const current = await this.require(id);
-    return this.store.withNamespaceLock(current.namespace, async () => {
-      const fresh = await this.require(id);
-      if (!AMENDABLE.includes(fresh.status)) {
-        throw new Error(
-          `Plan ${id} is ${fresh.status}; only draft or executing plans can be amended.`
-        );
-      }
-      return this.rewrite(fresh, {
-        ...patch.title !== void 0 ? { title: patch.title } : {},
-        ...patch.brief !== void 0 ? { brief: patch.brief } : {},
-        ...patch.filesToTouch !== void 0 ? { filesToTouch: patch.filesToTouch } : {},
-        ...patch.testsToAdd !== void 0 ? { testsToAdd: patch.testsToAdd } : {},
-        ...patch.outOfScope !== void 0 ? { outOfScope: patch.outOfScope } : {},
-        ...patch.risks !== void 0 ? { risks: patch.risks } : {},
-        ...patch.body !== void 0 ? { body: patch.body } : {}
-      });
-    });
-  }
-  async current(namespace) {
-    return this.store.findActivePlan(namespace);
-  }
-  assertTransition(from, to) {
-    if (!TRANSITIONS[from].includes(to)) {
-      throw new PlanTransitionError(from, to);
-    }
-  }
-  async require(id) {
-    try {
-      return await this.store.readPlan(id);
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        throw new PlanNotFoundError(id);
-      }
-      throw error;
-    }
-  }
-  /** Rewrite the plan file with a partial set of changed fields. */
-  async rewrite(plan, changes) {
-    const next = { ...plan, ...changes };
-    await this.store.writePlan({
-      id: next.id,
-      namespace: next.namespace,
-      title: next.title,
-      status: next.status,
-      brief: next.brief,
-      filesToTouch: next.filesToTouch,
-      testsToAdd: next.testsToAdd,
-      outOfScope: next.outOfScope,
-      risks: next.risks,
-      createdAt: next.createdAt,
-      createdByAgent: next.createdByAgent,
-      approvedAt: next.approvedAt,
-      executingAt: next.executingAt,
-      completedAt: next.completedAt,
-      abandonedAt: next.abandonedAt,
-      commitSha: next.commitSha,
-      abandonReason: next.abandonReason,
-      body: next.body
-    });
-    return this.store.readPlan(next.id);
-  }
-};
-
 // src/risk/service.ts
 import { spawn as spawn2 } from "child_process";
 import { realpath as realpath2 } from "fs/promises";
-import { relative as relative2, resolve as resolve3, sep as sep2 } from "path";
+import { dirname as dirname2, relative as relative2, resolve as resolve3, sep as sep2 } from "path";
 
 // src/risk/assessor.ts
 var RiskAssessor = class {
@@ -514,7 +345,7 @@ var RiskAssessor = class {
     const byPath = /* @__PURE__ */ new Map();
     const perSignal = /* @__PURE__ */ new Map();
     for (const { signal, contributions } of settled) {
-      const stat6 = perSignal.get(signal.id) ?? {
+      const stat5 = perSignal.get(signal.id) ?? {
         id: signal.id,
         category: signal.category,
         contributions: 0,
@@ -525,10 +356,10 @@ var RiskAssessor = class {
         const list = byPath.get(contribution.path) ?? [];
         list.push({ signal, contribution });
         byPath.set(contribution.path, list);
-        stat6.contributions += 1;
-        stat6.totalWeight += contribution.weight;
+        stat5.contributions += 1;
+        stat5.totalWeight += contribution.weight;
       }
-      perSignal.set(signal.id, stat6);
+      perSignal.set(signal.id, stat5);
     }
     const items = [];
     for (const [path, contributions] of byPath) {
@@ -594,9 +425,10 @@ function round2(value) {
 
 // src/risk/signals/churn.ts
 import { spawn } from "child_process";
-import { realpath } from "fs/promises";
+import { readFile as readFile2, realpath } from "fs/promises";
 import { resolve as resolve2 } from "path";
 var GIT_LOG_CONCURRENCY = 4;
+var DAY_MS = 864e5;
 function createChurnSignal(options) {
   return {
     id: "git-churn",
@@ -611,20 +443,56 @@ function createChurnSignal(options) {
       if (root.code !== 0 || resolve2(root.stdout.trim()) !== expected) {
         return [];
       }
-      const since = options.since ?? "30 days ago";
+      const lifetime = options.mode === "lifetime-size";
+      const asOf = options.asOf === void 0 ? void 0 : new Date(options.asOf);
+      const end = asOf ?? /* @__PURE__ */ new Date();
+      const range = [
+        ...lifetime ? [] : [
+          `--since=${options.since ?? new Date(end.getTime() - (options.windowDays ?? 30) * DAY_MS).toISOString()}`
+        ],
+        ...asOf ? [`--until=${asOf.toISOString()}`] : []
+      ];
+      const revision = lifetime && asOf ? (await runGit(options.repositoryRoot, [
+        "rev-list",
+        "-1",
+        `--before=${asOf.toISOString()}`,
+        "HEAD"
+      ])).stdout.trim() : null;
       const logs = [];
+      const sizes = [];
       for (let start = 0; start < input.paths.length; start += GIT_LOG_CONCURRENCY) {
         const batch = input.paths.slice(start, start + GIT_LOG_CONCURRENCY);
         logs.push(
           ...await Promise.all(
-            batch.map((path) => gitLogForPath(options.repositoryRoot, path, since))
+            batch.map((path) => gitLogForPath(options.repositoryRoot, path, range))
           )
         );
+        if (lifetime) {
+          sizes.push(
+            ...await Promise.all(
+              batch.map((path) => lineCount(options.repositoryRoot, path, revision))
+            )
+          );
+        }
       }
       const contributions = [];
       for (const [index, path] of input.paths.entries()) {
         const commits = logs[index] ?? [];
         if (commits.length === 0) continue;
+        if (lifetime) {
+          const lines = sizes[index] ?? 0;
+          contributions.push({
+            path,
+            // ponytail: hand-picked coefficients; fit them on the time-split eval before defaulting on.
+            weight: Math.min(
+              100,
+              Math.round(8 * Math.log2(1 + commits.length) + 4 * Math.log2(1 + lines))
+            ),
+            reason: `${path} has ${commits.length} commit${commits.length === 1 ? "" : "s"}, ${lines} line${lines === 1 ? "" : "s"} (lifetime churn and size).`,
+            evidence: evidenceOf(commits)
+          });
+          continue;
+        }
         const authors = new Set(commits.map((commit) => commit.author));
         const reverts = commits.filter((commit) => /revert|rollback|backout/i.test(commit.message));
         const weight = Math.min(100, commits.length * 8 + authors.size * 12 + reverts.length * 20);
@@ -632,23 +500,38 @@ function createChurnSignal(options) {
           path,
           weight,
           reason: `${path} changed ${commits.length} time${commits.length === 1 ? "" : "s"} in the recent git history by ${authors.size} author${authors.size === 1 ? "" : "s"}.`,
-          evidence: commits.slice(0, 5).map((commit) => ({
-            kind: "git_commit",
-            sha: commit.sha,
-            message: commit.message,
-            ts: commit.ts
-          }))
+          evidence: evidenceOf(commits)
         });
       }
       return contributions;
     }
   };
 }
-async function gitLogForPath(repositoryRoot, path, since) {
+function evidenceOf(commits) {
+  return commits.slice(0, 5).map((commit) => ({
+    kind: "git_commit",
+    sha: commit.sha,
+    message: commit.message,
+    ts: commit.ts
+  }));
+}
+async function lineCount(repositoryRoot, path, revision) {
+  let text = "";
+  if (revision === null) {
+    text = await readFile2(resolve2(repositoryRoot, path), "utf8").catch(() => "");
+  } else if (revision) {
+    const shown = await runGit(repositoryRoot, ["show", `${revision}:${path}`]);
+    if (shown.code === 0) text = shown.stdout;
+  }
+  if (text.length === 0) return 0;
+  return text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+}
+async function gitLogForPath(repositoryRoot, path, range) {
   const result = await runGit(repositoryRoot, [
     "log",
     "--follow",
-    `--since=${since}`,
+    "--max-count=1000",
+    ...range,
     "--format=%H%x1f%an%x1f%cI%x1f%s%x1e",
     "--",
     path
@@ -734,7 +617,7 @@ function severityWeight(severity) {
 }
 
 // src/risk/signals/policy.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { join as join2 } from "path";
 import { parse as parseYaml2 } from "yaml";
 import { z as z2 } from "zod";
@@ -786,7 +669,7 @@ function createPolicySignal(options) {
 }
 async function readPolicyFile(path) {
   try {
-    const raw = await readFile2(path, "utf8");
+    const raw = await readFile3(path, "utf8");
     return policyFileSchema.parse(parseYaml2(raw) ?? {});
   } catch (error) {
     if (error.code === "ENOENT") return { rules: [] };
@@ -822,10 +705,17 @@ async function assessRisk(input) {
     };
   }
   const memoryStore = new MemoryFileStore(repositoryRoot);
+  const churn = (await readConfigFile(repositoryRoot).catch(() => ({ risk: void 0 }))).risk;
   const signals = input.signals ?? [
     createIncidentSignal({ store: memoryStore }),
     createPolicySignal({ repositoryRoot }),
-    ...input.useGit === false ? [] : [createChurnSignal({ repositoryRoot })]
+    ...input.useGit === false ? [] : [
+      createChurnSignal({
+        repositoryRoot,
+        ...churn?.churnWindowDays !== void 0 ? { windowDays: churn.churnWindowDays } : {},
+        ...churn?.churnMode !== void 0 ? { mode: churn.churnMode } : {}
+      })
+    ]
   ];
   const assessment = await new RiskAssessor(signals).assess({
     paths,
@@ -859,15 +749,25 @@ async function resolveRiskPaths(input) {
   }
   const realRoot = await realpath2(input.repositoryRoot).catch(() => resolve3(input.repositoryRoot));
   const inside = await Promise.all(
-    [...paths].map(async (path) => {
-      const real = await realpath2(resolve3(input.repositoryRoot, path)).catch(() => null);
-      return real === null || real === realRoot || real.startsWith(`${realRoot}${sep2}`);
-    })
+    [...paths].map((path) => realPathInside(realRoot, resolve3(input.repositoryRoot, path)))
   );
   const resolved = [...paths].filter((_, index) => inside[index]).sort();
   return resolved.length > MAX_RESOLVED_PATHS ? resolved.slice(0, MAX_RESOLVED_PATHS) : resolved;
 }
 var MAX_RESOLVED_PATHS = 200;
+async function containedRepoPath(root, path) {
+  const contained = containedRelativePath(root, path);
+  if (contained === null) return null;
+  const realRoot = await realpath2(root).catch(() => resolve3(root));
+  return await realPathInside(realRoot, resolve3(root, contained)) ? contained : null;
+}
+async function realPathInside(realRoot, absolute) {
+  for (let current = absolute; ; current = dirname2(current)) {
+    const real = await realpath2(current).catch(() => null);
+    if (real !== null) return real === realRoot || real.startsWith(`${realRoot}${sep2}`);
+    if (dirname2(current) === current) return false;
+  }
+}
 function containedRelativePath(root, path) {
   const trimmed = normalizePath2(path);
   if (!trimmed || trimmed.includes("\0")) return null;
@@ -878,16 +778,18 @@ function containedRelativePath(root, path) {
 }
 async function changedGitPaths(repositoryRoot) {
   const [tracked, untracked] = await Promise.all([
-    runGit2(repositoryRoot, ["diff", "--name-only", "HEAD"]),
-    runGit2(repositoryRoot, ["ls-files", "--others", "--exclude-standard"])
+    // `-z`: NUL-separated, unquoted names (non-ASCII, quotes, tabs, newlines).
+    runGit2(repositoryRoot, ["diff", "--name-only", "-z", "HEAD"]),
+    runGit2(repositoryRoot, ["ls-files", "-z", "--others", "--exclude-standard"])
   ]);
-  return [...tracked.stdout.split("\n"), ...untracked.stdout.split("\n")].map((path) => path.trim()).filter((path) => path && !path.startsWith(".codebuddy/"));
+  return [...tracked.stdout.split("\0"), ...untracked.stdout.split("\0")].filter((path) => path && !path.split("/").some((segment) => segment.startsWith(".")));
 }
 function runGit2(cwd, args) {
   return new Promise((resolveResult, reject) => {
     const child = spawn2("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
+    child.stdout.setEncoding("utf8");
     child.stdout.on("data", (chunk) => {
       stdout += String(chunk);
     });
@@ -899,13 +801,206 @@ function runGit2(cwd, args) {
   });
 }
 function normalizePath2(path) {
-  return path.replace(/\\/g, "/").replace(/^\.\//, "");
+  return (sep2 === "\\" ? path.replace(/\\/g, "/") : path).replace(/^\.\//, "");
 }
 
+// src/core/plan-lifecycle.ts
+var TRANSITIONS = {
+  draft: ["approved", "abandoned"],
+  approved: ["executing", "abandoned"],
+  executing: ["complete", "abandoned"],
+  complete: [],
+  abandoned: []
+};
+var AMENDABLE = ["draft", "executing"];
+var PlanTransitionError = class extends Error {
+  constructor(from, to) {
+    super(`Illegal plan transition: ${from} \u2192 ${to}.`);
+    this.name = "PlanTransitionError";
+  }
+};
+var PlanNotFoundError = class extends Error {
+  constructor(id) {
+    super(`Plan ${id} not found.`);
+    this.name = "PlanNotFoundError";
+  }
+};
+var ActivePlanExistsError = class extends Error {
+  activePlanId;
+  constructor(namespace, activePlanId) {
+    super(
+      `Namespace "${namespace}" already has an active plan (${activePlanId}). Complete or abandon it before approving another.`
+    );
+    this.name = "ActivePlanExistsError";
+    this.activePlanId = activePlanId;
+  }
+};
+var DEFAULT_BODY = [
+  "# Goal",
+  "",
+  "(what this plan achieves)",
+  "",
+  "# Approach",
+  "",
+  "(ordered steps)",
+  "",
+  "# Notes",
+  "",
+  "(freeform; ignored by tooling)"
+].join("\n");
+var PlanLifecycle = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  async create(input) {
+    await this.assertPathsInside(input);
+    const id = generateEntityId("pln");
+    const now = input.now ?? (/* @__PURE__ */ new Date()).toISOString();
+    await this.store.writePlan({
+      id,
+      namespace: input.namespace,
+      title: input.title,
+      status: "draft",
+      brief: input.brief,
+      filesToTouch: input.filesToTouch ?? [],
+      testsToAdd: input.testsToAdd ?? [],
+      outOfScope: input.outOfScope ?? [],
+      risks: input.risks ?? [],
+      createdAt: now,
+      createdByAgent: input.createdByAgent ?? null,
+      approvedAt: null,
+      executingAt: null,
+      completedAt: null,
+      abandonedAt: null,
+      commitSha: null,
+      abandonReason: null,
+      body: input.body ?? DEFAULT_BODY
+    });
+    return this.store.readPlan(id);
+  }
+  async approve(id, now = (/* @__PURE__ */ new Date()).toISOString()) {
+    const current = await this.require(id);
+    return this.store.withNamespaceLock(current.namespace, async () => {
+      const fresh = await this.require(id);
+      this.assertTransition(fresh.status, "approved");
+      const active = await this.store.findActivePlan(fresh.namespace);
+      if (active && active.id !== id) {
+        throw new ActivePlanExistsError(fresh.namespace, active.id);
+      }
+      return this.rewrite(fresh, { status: "approved", approvedAt: now });
+    });
+  }
+  async start(id, now = (/* @__PURE__ */ new Date()).toISOString()) {
+    const current = await this.require(id);
+    return this.store.withNamespaceLock(current.namespace, async () => {
+      const fresh = await this.require(id);
+      this.assertTransition(fresh.status, "executing");
+      return this.rewrite(fresh, { status: "executing", executingAt: now });
+    });
+  }
+  async complete(id, options = {}, now = (/* @__PURE__ */ new Date()).toISOString()) {
+    const current = await this.require(id);
+    return this.store.withNamespaceLock(current.namespace, async () => {
+      const fresh = await this.require(id);
+      this.assertTransition(fresh.status, "complete");
+      return this.rewrite(fresh, {
+        status: "complete",
+        completedAt: now,
+        ...options.commitSha !== void 0 ? { commitSha: options.commitSha } : {}
+      });
+    });
+  }
+  async abandon(id, options = {}, now = (/* @__PURE__ */ new Date()).toISOString()) {
+    const current = await this.require(id);
+    return this.store.withNamespaceLock(current.namespace, async () => {
+      const fresh = await this.require(id);
+      this.assertTransition(fresh.status, "abandoned");
+      return this.rewrite(fresh, {
+        status: "abandoned",
+        abandonedAt: now,
+        ...options.reason !== void 0 ? { abandonReason: options.reason } : {}
+      });
+    });
+  }
+  async amend(id, patch) {
+    await this.assertPathsInside(patch);
+    const current = await this.require(id);
+    return this.store.withNamespaceLock(current.namespace, async () => {
+      const fresh = await this.require(id);
+      if (!AMENDABLE.includes(fresh.status)) {
+        throw new Error(
+          `Plan ${id} is ${fresh.status}; only draft or executing plans can be amended.`
+        );
+      }
+      return this.rewrite(fresh, {
+        ...patch.title !== void 0 ? { title: patch.title } : {},
+        ...patch.brief !== void 0 ? { brief: patch.brief } : {},
+        ...patch.filesToTouch !== void 0 ? { filesToTouch: patch.filesToTouch } : {},
+        ...patch.testsToAdd !== void 0 ? { testsToAdd: patch.testsToAdd } : {},
+        ...patch.outOfScope !== void 0 ? { outOfScope: patch.outOfScope } : {},
+        ...patch.risks !== void 0 ? { risks: patch.risks } : {},
+        ...patch.body !== void 0 ? { body: patch.body } : {}
+      });
+    });
+  }
+  /** Plan paths flow into risk, context and file reads; none may leave the repository. */
+  async assertPathsInside(input) {
+    for (const { path } of [...input.filesToTouch ?? [], ...input.testsToAdd ?? []]) {
+      if (await containedRepoPath(this.store.repositoryRoot, path) === null) {
+        throw new Error(`Plan path is outside the repository: ${path}`);
+      }
+    }
+  }
+  async current(namespace) {
+    return this.store.findActivePlan(namespace);
+  }
+  assertTransition(from, to) {
+    if (!TRANSITIONS[from].includes(to)) {
+      throw new PlanTransitionError(from, to);
+    }
+  }
+  async require(id) {
+    try {
+      return await this.store.readPlan(id);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw new PlanNotFoundError(id);
+      }
+      throw error;
+    }
+  }
+  /** Rewrite the plan file with a partial set of changed fields. */
+  async rewrite(plan, changes) {
+    const next = { ...plan, ...changes };
+    await this.store.writePlan({
+      id: next.id,
+      namespace: next.namespace,
+      title: next.title,
+      status: next.status,
+      brief: next.brief,
+      filesToTouch: next.filesToTouch,
+      testsToAdd: next.testsToAdd,
+      outOfScope: next.outOfScope,
+      risks: next.risks,
+      createdAt: next.createdAt,
+      createdByAgent: next.createdByAgent,
+      approvedAt: next.approvedAt,
+      executingAt: next.executingAt,
+      completedAt: next.completedAt,
+      abandonedAt: next.abandonedAt,
+      commitSha: next.commitSha,
+      abandonReason: next.abandonReason,
+      body: next.body
+    });
+    return this.store.readPlan(next.id);
+  }
+};
+
 // src/worklog/store.ts
 import { createHash } from "crypto";
-import { mkdir as mkdir2, readdir as readdir2, readFile as readFile3, stat as stat2 } from "fs/promises";
-import { dirname as dirname2, join as join3, relative as relative3, resolve as resolve4, sep as sep3 } from "path";
+import { mkdir as mkdir2, readdir as readdir2, readFile as readFile4, stat as stat2 } from "fs/promises";
+import { dirname as dirname3, join as join3, relative as relative3, resolve as resolve4, sep as sep3 } from "path";
 import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
 import { z as z3 } from "zod";
 var LIMITS = {
@@ -958,7 +1053,7 @@ var WorklogStore = class {
     if (existing) return existing.id;
     const id = generateEntityId("wlg", now.getTime());
     const path = this.entryPath(id);
-    await assertNoSymlinkBetween(this.repositoryRoot, dirname2(path));
+    await assertNoSymlinkBetween(this.repositoryRoot, dirname3(path));
     await mkdir2(this.directory, { recursive: true, mode: 448 });
     const frontMatter = stringifyYaml2({
       schemaVersion: 1,
@@ -981,7 +1076,7 @@ var WorklogStore = class {
   async read(id) {
     const path = this.entryPath(id);
     await assertNoSymlinkBetween(this.repositoryRoot, path);
-    const parsed = parseFrontMatter(await readFile3(path, "utf8"));
+    const parsed = parseFrontMatter(await readFile4(path, "utf8"));
     return {
       ...entrySchema.parse(parseYaml3(parsed.frontMatter)),
       summary: parsed.content.trim(),
@@ -1319,11 +1414,13 @@ async function buildBeforeEditContext(input) {
   const mapPromise = loadProjectArchitectureMap(repositoryRoot, manifest);
   const discovery = !hasExplicitTargets && input.task ? await discoverTaskPaths(repositoryRoot, input.task, manifest, mapPromise) : { paths: [], hits: [], explain: [] };
   const taskPaths = discovery.paths;
-  const targetPaths = hasExplicitTargets ? resolvedPaths : taskPaths.length > 0 ? taskPaths : resolvedPaths;
+  const askedTask = Boolean(input.task?.trim());
+  const targetPaths = hasExplicitTargets ? resolvedPaths : taskPaths.length > 0 ? taskPaths : askedTask && input.useGit !== true ? [] : resolvedPaths;
   const discoveredFromTask = taskPaths.length > 0;
   const pathSource = classifyPathSource(input, targetPaths.length, discoveredFromTask);
   const planStore = new PlanFileStore(repositoryRoot);
   const memoryStore = new MemoryFileStore(repositoryRoot);
+  const knownSecrets = await loadKnownSecretValues(repositoryRoot);
   const [referencedPlan, policy, policyFile, incidents, facts, risks, map, diffs, handoffs] = await Promise.all([
     resolveRelevantPlan(planStore, namespace, input.planId),
     loadPlanPolicy(repositoryRoot),
@@ -1338,7 +1435,7 @@ async function buildBeforeEditContext(input) {
       useGit: !hasExplicitTargets && input.useGit !== false
     }),
     mapPromise,
-    input.useGit === false ? Promise.resolve([]) : readGitDiffs(repositoryRoot, targetPaths),
+    input.useGit === false ? Promise.resolve([]) : readGitDiffs(repositoryRoot, targetPaths, knownSecrets),
     recallHandoffs(repositoryRoot, {
       namespace,
       paths: targetPaths,
@@ -1354,6 +1451,11 @@ async function buildBeforeEditContext(input) {
     );
   }
   explain.push(...discovery.explain);
+  if (askedTask && !hasExplicitTargets && taskPaths.length === 0) {
+    explain.push(
+      targetPaths.length > 0 ? "paths: no file matched the task; useGit asked for the uncommitted changes instead" : "paths: no file matched the task; none returned rather than unrelated changes"
+    );
+  }
   const plan = summarizePlan(referencedPlan);
   if (plan) explain.push(`plan: ${plan.id} (${plan.status})`);
   const policyRules = summarizeMatchingPolicyRules(policyFile.rules, targetPaths);
@@ -1376,7 +1478,8 @@ async function buildBeforeEditContext(input) {
     input.task ?? "",
     discovery.hits,
     "symbols" in discovery ? discovery.symbols ?? {} : {},
-    input.evidence ?? "overview"
+    input.evidence ?? "overview",
+    knownSecrets
   );
   if (symbols.length > 0) {
     const spans = symbols.reduce((total, file) => total + (file.spans?.length ?? 0), 0);
@@ -1543,7 +1646,7 @@ function computeNeighbours(map, paths) {
   }
   return result;
 }
-async function computeTargetSymbols(repositoryRoot, targetPaths, task, hits, picked = {}, evidence = "overview") {
+async function computeTargetSymbols(repositoryRoot, targetPaths, task, hits, picked = {}, evidence = "overview", knownSecrets = []) {
   const terms = taskTerms(task);
   const tokens = identifierTokens(task);
   const result = [];
@@ -1552,9 +1655,9 @@ async function computeTargetSymbols(repositoryRoot, targetPaths, task, hits, pic
   for (const path of targetPaths.slice(0, LIMITS2.symbolFiles)) {
     const source = await readBoundedSource(repositoryRoot, path);
     if (source === null) continue;
-    const lines = source.split(/\r?\n/);
+    const lines = redactSourceText(source, knownSecrets).split(/\r?\n/);
     const fileHits = hits.filter((hit2) => hit2.path === path && hit2.endLine <= lines.length);
-    const table = supportsSymbols(path) ? extractSymbolTable(source) : [];
+    const table = supportsSymbols(path) ? extractSymbolTable(source, path) : [];
     const credited = /* @__PURE__ */ new Map();
     for (const hit2 of fileHits) {
       const owner = table.filter((symbol) => hit2.startLine <= symbol.endLine && hit2.endLine >= symbol.startLine).sort(
@@ -1570,7 +1673,9 @@ async function computeTargetSymbols(repositoryRoot, targetPaths, task, hits, pic
     }).sort(
       (left, right) => right.score - left.score || left.symbol.startLine - right.symbol.startLine
     );
-    const signatures = ranked.filter(({ symbol, score }) => symbol.kind !== "method" || score > 0).slice(0, LIMITS2.symbolsPerFile).map(({ symbol }) => symbol.signature);
+    const signatures = ranked.filter(({ symbol, score }) => symbol.kind !== "method" || score > 0).slice(0, LIMITS2.symbolsPerFile).map(
+      ({ symbol }) => lines[symbol.startLine - 1] === REDACTED_LINE ? REDACTED_LINE : redactSourceText(symbol.signature, knownSecrets)
+    );
     const best = ranked[0]?.score ? ranked[0] : void 0;
     const hit = best ? best.hit : fileHits[0];
     const range = best?.symbol ?? hit;
@@ -1639,20 +1744,38 @@ function headInSignature(lines, symbol) {
   const line = (lines[symbol.startLine - 1] ?? "").trim();
   return !head.endsWith("\u2026") && line.startsWith(head) && /^[\s{=>(]*$/.test(line.slice(head.length));
 }
-async function readGitDiffs(repositoryRoot, paths) {
+async function readGitDiffs(repositoryRoot, paths, knownSecrets = []) {
   if (paths.length === 0) return [];
   const sections = [];
   try {
     const { stdout } = await execFileAsync(
       "git",
-      ["diff", "HEAD", "--no-ext-diff", "--unified=3", "--", ...paths],
+      [
+        "-c",
+        "core.quotePath=false",
+        "diff",
+        "HEAD",
+        "--no-ext-diff",
+        "--unified=3",
+        "--",
+        ...paths
+      ],
       { cwd: repositoryRoot, maxBuffer: 2e6 }
     );
     sections.push(stdout);
   } catch {
     for (const args of [
-      ["diff", "--cached", "--no-ext-diff", "--unified=3", "--", ...paths],
-      ["diff", "--no-ext-diff", "--unified=3", "--", ...paths]
+      [
+        "-c",
+        "core.quotePath=false",
+        "diff",
+        "--cached",
+        "--no-ext-diff",
+        "--unified=3",
+        "--",
+        ...paths
+      ],
+      ["-c", "core.quotePath=false", "diff", "--no-ext-diff", "--unified=3", "--", ...paths]
     ]) {
       try {
         const { stdout } = await execFileAsync("git", args, {
@@ -1664,21 +1787,59 @@ async function readGitDiffs(repositoryRoot, paths) {
       }
     }
   }
-  const parsed = parseGitDiff(sections.join("\n"));
+  const parsed = parseGitDiff(sections.join("\n"), knownSecrets);
   const known = new Set(parsed.map((diff) => diff.path));
   const untracked = await listUntrackedPaths(repositoryRoot, paths);
   for (const path of untracked) {
     if (known.has(path)) continue;
-    const patch = await buildUntrackedPatch(repositoryRoot, path);
+    const patch = isCredentialPath(path) ? withheldPatch(path) : await buildUntrackedPatch(repositoryRoot, path, knownSecrets);
     if (patch) parsed.push(patch);
   }
   return parsed.slice(0, MAX_DIFF_FILES);
 }
-function parseGitDiff(diff) {
+function diffHeaderPaths(section) {
+  const quoted = '"(?:[^"\\\\]|\\\\.)*"';
+  const header = new RegExp(`^diff --git (${quoted}|a/.+?) (${quoted}|b/.+?)\\n`, "m").exec(
+    section
+  );
+  if (!header?.[1] || !header[2]) return null;
+  const path = (raw) => (raw.startsWith('"') ? unquoteGitPath(raw) : raw).slice(2);
+  return [header[0], path(header[1]), path(header[2])];
+}
+var C_ESCAPES = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13 };
+function unquoteGitPath(raw) {
+  const bytes = [];
+  const body = raw.slice(1, -1);
+  for (let at = 0; at < body.length; at++) {
+    const char = body[at];
+    if (char !== "\\") {
+      bytes.push(...Buffer.from(char, "utf8"));
+      continue;
+    }
+    const next = body[++at] ?? "";
+    const octal = /^[0-7]{3}/.exec(body.slice(at))?.[0];
+    if (octal) {
+      bytes.push(Number.parseInt(octal, 8));
+      at += 2;
+    } else bytes.push(C_ESCAPES[next] ?? next.charCodeAt(0));
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function withheldPatch(path) {
+  return {
+    path,
+    patch: `diff --git a/${path} b/${path}
+(contents withheld: credential file)`
+  };
+}
+function parseGitDiff(diff, knownSecrets = []) {
   return diff.split(/(?=^diff --git )/m).filter((section) => section.startsWith("diff --git ")).flatMap((section) => {
-    const header = section.match(/^diff --git a\/(.+?) b\/(.+?)\n/m);
+    const header = diffHeaderPaths(section);
     if (!header?.[2]) return [];
-    const rawPatch = section.trim();
+    if (isCredentialPath(header[1] ?? "") || isCredentialPath(header[2])) {
+      return [withheldPatch(header[2])];
+    }
+    const rawPatch = redactSourceText(section.trim(), knownSecrets, true);
     const patch = rawPatch.slice(0, MAX_DIFF_CHARS_PER_FILE).trim();
     return patch ? [
       {
@@ -1693,20 +1854,20 @@ async function listUntrackedPaths(repositoryRoot, paths) {
   try {
     const { stdout } = await execFileAsync(
       "git",
-      ["ls-files", "--others", "--exclude-standard", "--", ...paths],
+      ["ls-files", "-z", "--others", "--exclude-standard", "--", ...paths],
       { cwd: repositoryRoot, maxBuffer: 1e6 }
     );
-    return stdout.split(/\r?\n/).map((path) => path.trim()).filter(Boolean);
+    return stdout.split("\0").filter(Boolean);
   } catch {
     return [];
   }
 }
-async function buildUntrackedPatch(repositoryRoot, path) {
+async function buildUntrackedPatch(repositoryRoot, path, knownSecrets) {
   try {
-    const content = await readFile4(join4(repositoryRoot, path), "utf8");
-    if (content.includes("\0")) return null;
+    const content = await readBoundedSource(repositoryRoot, path);
+    if (content === null) return null;
     const lines = content.split(/\r?\n/);
-    const body = lines.map((line) => `+${line}`).join("\n");
+    const body = redactSourceText(lines.map((line) => `+${line}`).join("\n"), knownSecrets, true);
     const rawPatch = [
       `diff --git a/${path} b/${path}`,
       "new file mode 100644",
@@ -1750,11 +1911,27 @@ async function rankRelevantFacts(facts, namespace, task, targetPaths, semanticRa
   const incidentText = new Set(
     eligible.filter((fact) => fact.category === "incident").map((fact) => normalizeText(fact.content || fact.object))
   );
-  const candidates = eligible.filter((fact) => fact.category !== "incident").filter((fact) => !incidentText.has(normalizeText(fact.content || fact.object))).map((fact) => {
+  const terms = lexicalTerms(task).filter((term) => term.length > 2);
+  const withTerms = eligible.filter((fact) => fact.category !== "incident").filter((fact) => !incidentText.has(normalizeText(fact.content || fact.object))).map((fact) => {
     const text = `${fact.subject} ${fact.predicate} ${fact.object} ${fact.content}`;
-    const taskScore = relevanceScore(text, task);
+    const words2 = new Set(text.toLowerCase().match(/[\p{L}\p{N}_]+/gu) ?? []);
+    return { fact, text, shared: terms.filter((term) => words2.has(term)) };
+  });
+  const documentFrequency = new Map(
+    terms.map((term) => [term, withTerms.filter(({ shared }) => shared.includes(term)).length])
+  );
+  const candidates = withTerms.map(({ fact, text, shared }) => {
+    const taskScore = shared.length * 3;
     const pathScore = fact.paths.some((path) => targetPaths.includes(path)) ? 5 : 0;
-    return { fact, text, taskScore, pathScore, lexical: taskScore + pathScore };
+    const admitted = admitsLexically(shared, documentFrequency, withTerms.length);
+    return {
+      fact,
+      text,
+      taskScore,
+      pathScore,
+      admitted,
+      lexical: (admitted ? taskScore : 0) + pathScore
+    };
   });
   const summarize = (fact, relevance, reason) => ({
     id: fact.id,
@@ -1830,10 +2007,10 @@ async function rankRelevantFacts(facts, namespace, task, targetPaths, semanticRa
     }
     selected.push(candidate);
   }
-  return selected.map(({ fact, taskScore, pathScore, score }) => {
+  return selected.map(({ fact, taskScore, pathScore, score, admitted }) => {
     const evidence = [
       pathScore > 0 ? "matches a target path" : "",
-      taskScore > 0 ? `shares ${taskScore / 3} task term(s)` : "",
+      admitted && taskScore > 0 ? `shares ${taskScore / 3} task term(s)` : "",
       cosine(fact.id) !== void 0 ? `semantic ${cosine(fact.id)?.toFixed(2)}` : ""
     ].filter(Boolean);
     return summarize(
@@ -1844,12 +2021,6 @@ async function rankRelevantFacts(facts, namespace, task, targetPaths, semanticRa
     );
   });
 }
-function relevanceScore(value, task) {
-  const terms = lexicalTerms(task).filter((term) => term.length > 2);
-  if (terms.length === 0) return 0;
-  const haystack = new Set(value.toLowerCase().match(/[\p{L}\p{N}_]+/gu) ?? []);
-  return terms.filter((term) => haystack.has(term)).length * 3;
-}
 function normalizeText(value) {
   return value.toLowerCase().replace(/[^a-z0-9_./-]+/g, " ").trim();
 }
@@ -1896,6 +2067,21 @@ var RULES = [
     confidence: 0.8,
     regex: EXPLICIT_RESOLUTION
   },
+  {
+    // An explicit label ("Decision: …") is the agent saying this is durable.
+    class: "decision",
+    subject: "decision",
+    predicate: "made",
+    confidence: 0.8,
+    regex: /^(?:decision|decided)\s*:/i
+  },
+  {
+    class: "fact",
+    subject: "project",
+    predicate: "fact",
+    confidence: 0.75,
+    regex: /^(?:convention|fact|rule|policy)\s*:/i
+  },
   {
     class: "decision",
     subject: "decision",
@@ -1915,11 +2101,20 @@ var RULES = [
     subject: "project",
     predicate: "fact",
     confidence: 0.55,
-    regex: /\b(uses?|is|are|requires?|depends on|stores?|returns?|implemented|added|supports?|configured|lives in|located|handles?)\b/i
+    regex: /\b(uses?|is|are|requires?|depends on|stores?|returns?|implemented|added|supports?|configured|lives in|located|handles?|must)\b|\b(?:always|never)\b(?!\s+(?:the|a|an|mind)\b)/i
   }
 ];
 var INCIDENT_REGEX = RULES.find((rule) => rule.predicate === "occurred").regex;
 var SPECULATIVE = /\b(might|maybe|possibly|could|consider(?:ing)?|planned|planning|should|if|would|unless|whether|suppose|hypothetical(?:ly)?|in theory|in case)\b/i;
+var HEDGED = /\b(might|maybe|perhaps|possibly|probably|could|consider(?:ing)?|planned|planning|would|whether|suppose|hypothetical(?:ly)?|in theory)\b/i;
+var NOT_DURABLE = /\b(?:for now|for the moment|right now|today|tonight|tomorrow|yesterday|this (?:session|turn|time|week|sprint)|for this (?:pr|change|task|ticket|branch|commit|session)|temporarily|as a temporary|i['’]ll|i will|i['’]m going to|let me|never ?mind|i think|i guess|i suspect)\b|^(?:it|this|that|there)\s+must\s+be\b/i;
+var DURABLE_LABEL = /^(?:decision|decided|rule|policy|convention|fact)\s*:/i;
+function stripDecoration(sentence) {
+  return sentence.replace(/^(?:[-*•]\s+|\d+[.)]\s+)/, "").replace(
+    /^(?:\*{1,2}|_{1,2})?(decision|decided|rule|policy|convention|fact)(?:\*{1,2}|_{1,2})?\s*:\s*(?:\*{1,2}|_{1,2})?\s*/i,
+    "$1: "
+  ).trim();
+}
 var NEGATION = /\b(no|not|never|none|nothing|nobody|without|zero|neither|nor|cannot)\b(?!\s+longer)|\w+n['’]t\b/i;
 var EXAMPLE = /\b(?:e\.g|i\.e|for example|for instance|such as|example|sample|hypothetical)\b/i;
 var QUOTED = /"[^"]*"|\u201c[^\u201d]*\u201d|`[^`]*`/g;
@@ -1946,17 +2141,19 @@ var SEVERITY_MARKERS = [
 function deterministicExtract(input) {
   const changedFiles = (input.changedFiles ?? []).filter(Boolean);
   const candidates = [];
-  for (const sentence of splitSentences(input.summary)) {
+  for (const sentence of splitSentences(input.summary).map(stripDecoration)) {
     const classified = classify(sentence);
     const doubt = classified?.class === "incident" ? incidentDoubt(sentence) : null;
-    const rule = doubt || SPECULATIVE.test(sentence) && !EXPLICIT_DECISION.test(sentence) && !EXPLICIT_RESOLUTION.test(sentence) ? {
+    const speculative = DURABLE_LABEL.test(sentence) ? HEDGED.test(sentence) : SPECULATIVE.test(sentence) && !EXPLICIT_DECISION.test(sentence) && !EXPLICIT_RESOLUTION.test(sentence);
+    const rule = doubt || speculative ? {
       class: "note",
       subject: "speculation",
       predicate: "consider",
       confidence: 0.3,
       regex: SPECULATIVE
     } : classified;
-    if (!rule) {
+    const passing = (rule?.class === "decision" || rule?.class === "fact") && NOT_DURABLE.test(sentence);
+    if (!rule || passing) {
       candidates.push(ignoredCandidate(sentence));
       continue;
     }
@@ -2094,7 +2291,7 @@ function matchResolution(fixText, pathCandidates, unresolved) {
 
 // src/memory-extract/review-store.ts
 import { mkdir as mkdir3, readdir as readdir3, readFile as readFile5, rename, rm as rm2 } from "fs/promises";
-import { dirname as dirname3, join as join5, relative as relative4, resolve as resolve6, sep as sep4 } from "path";
+import { dirname as dirname4, join as join5, relative as relative4, resolve as resolve6, sep as sep4 } from "path";
 import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
 import { z as z5 } from "zod";
 var reviewSchema = z5.object({
@@ -2137,7 +2334,7 @@ var ReviewStore = class {
     const input = redactPersisted(raw);
     const path = this.itemPath(input.id);
     await this.prepareDirectory();
-    await assertNoSymlinkBetween(this.repositoryRoot, dirname3(path));
+    await assertNoSymlinkBetween(this.repositoryRoot, dirname4(path));
     const frontMatter = stringifyYaml3({
       schemaVersion: 1,
       id: input.id,
@@ -2232,7 +2429,7 @@ var ReviewStore = class {
     return absolute;
   }
   async prepareDirectory() {
-    await assertNoSymlinkBetween(this.repositoryRoot, dirname3(this.reviewDirectory));
+    await assertNoSymlinkBetween(this.repositoryRoot, dirname4(this.reviewDirectory));
     await mkdir3(this.reviewDirectory, { recursive: true, mode: 448 });
   }
 };
@@ -2243,7 +2440,8 @@ var INJECTED_BLOCK = /^##\s*CodeBuddy\b/m;
 var FENCED_CODE = /```[\s\S]*?(?:```|$)/g;
 var QUOTE_LINE = /^\s*>.*$/gm;
 var RULE_PREFIX = /^(?:also,?\s+|please,?\s+)?(?:from now on|going forward|(?:a\s+)?rule\b[^:.]{0,60}:)[,:]?\s*/i;
-var IMPERATIVE = /^(?:please,?\s+)?(?:always|never)\s+\S+\s+\S+|^(?:we|you)\s+(?:always|never|must)\b|^every\s+(?!time\b)\S+.*\bmust\b/i;
+var IMPERATIVE = /^(?:please,?\s+)?(?:always|never)\s+(?!(?:the|a|an|mind|so|again|ever)\b)\S+\s+\S+|^(?:we|you)\s+(?:always|never|must)\b|^every\s+(?!time\b)\S+.*\bmust\b/i;
+var POLICY = /^(?:decision|decided|convention|policy)\s*:\s*\S+\s+\S+|^we\s+(?:decided|agreed|settled on|chose)\b|^(?!(?:i|it|this|that|there|he|she|they|which|what)\b)[a-z][\w-]*(?:\s+[\w./-]+){0,6}\s+must(?:\s+not|n['’]t)?\s+(?!be\s+\w+ing\b|have\s+(?:been\b|\w+ed\b))\w+/i;
 var QUESTION_START = /^(?:why|how|what|when|where|which|who|can|could|would|will|do|does|did|is|are|should)\b/i;
 var REVOCATION_MARKER = /^(?:please,?\s+)?stop\s+\w+ing\b|\bno longer\b|\b(?:don't|do not)\b.*\banymore\b|\b(?:forget|drop|remove)\s+the\s+rule\b/i;
 var STOPWORDS = /* @__PURE__ */ new Set([
@@ -2271,21 +2469,31 @@ var STOPWORDS = /* @__PURE__ */ new Set([
 function extractUserRules(prompts) {
   const rules = /* @__PURE__ */ new Map();
   const revocations = /* @__PURE__ */ new Map();
+  const policies = /* @__PURE__ */ new Map();
   for (const prompt of prompts) {
     const own = (prompt.split(INJECTED_BLOCK)[0] ?? "").replace(FENCED_CODE, "\n").replace(QUOTE_LINE, "");
     for (const raw of own.split(/(?<=[.!?])\s+|\n+/)) {
-      const sentence = raw.trim();
+      const sentence = stripDecoration(raw.trim());
       if (!sentence || sentence.length > MAX_RULE_CHARS || sentence.endsWith("?")) continue;
       if (QUESTION_START.test(sentence)) continue;
       const key = sentence.toLowerCase().replace(/\s+/g, " ").replace(/[.!]+$/, "");
       if (REVOCATION_MARKER.test(sentence)) {
         if (!revocations.has(key)) revocations.set(key, sentence);
-      } else if (isRule(sentence) && !SPECULATIVE.test(sentence)) {
+        continue;
+      }
+      if (HEDGED.test(sentence) || NOT_DURABLE.test(sentence)) continue;
+      if (isRule(sentence)) {
         if (!rules.has(key)) rules.set(key, sentence);
+      } else if (POLICY.test(sentence) && !policies.has(key)) {
+        policies.set(key, sentence);
       }
     }
   }
-  return { rules: [...rules.values()], revocations: [...revocations.values()] };
+  return {
+    rules: [...rules.values()],
+    revocations: [...revocations.values()],
+    policies: [...policies.values()]
+  };
 }
 function isRule(sentence) {
   const rest = sentence.replace(RULE_PREFIX, "");
@@ -2307,6 +2515,7 @@ function revokes(revocation, rule) {
 // src/memory-extract/engine.ts
 var AUTO_SAVE_THRESHOLD = 0.7;
 var STATED_CONFIDENCE = 0.9;
+var POLICY_CONFIDENCE = 0.6;
 async function captureAfterTurn(input, options = {}) {
   const repositoryRoot = resolve7(options.repositoryRoot ?? process.cwd());
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -2316,7 +2525,8 @@ async function captureAfterTurn(input, options = {}) {
   const source = extracted.source;
   const candidates = [
     ...extracted.candidates,
-    ...(input.userRules ?? []).map(ruleCandidate),
+    ...(input.userRules ?? []).map((rule) => ruleCandidate(rule)),
+    ...(input.userPolicies ?? []).map((policy) => ruleCandidate(policy, POLICY_CONFIDENCE)),
     ...await procedureCandidates(input, repositoryRoot)
   ];
   const saved = [];
@@ -2391,14 +2601,14 @@ async function recordWorklog(input, saved, queued, repositoryRoot, now, reasons)
     return null;
   }
 }
-function ruleCandidate(rule) {
+function ruleCandidate(rule, confidence = STATED_CONFIDENCE) {
   return {
     class: "decision",
     content: rule,
     subject: "rule",
     predicate: "rule",
     object: rule,
-    confidence: STATED_CONFIDENCE,
+    confidence,
     paths: [],
     severity: null
   };
@@ -2720,50 +2930,6 @@ async function approveReviewItem(id, options = {}) {
   return factId;
 }
 
-// src/tracing/log.ts
-import { appendFile, mkdir as mkdir4, readFile as readFile6, stat as stat3 } from "fs/promises";
-import { dirname as dirname4, join as join6 } from "path";
-var MAX_BYTES = 4 * 1024 * 1024;
-function tracePath(repositoryRoot) {
-  return join6(repositoryRoot, ".codebuddy", "cache", "traces.jsonl");
-}
-async function recordTrace(repositoryRoot, event) {
-  if (process.env.CODEBUDDY_TRACE === "0") return;
-  const path = tracePath(repositoryRoot);
-  try {
-    await mkdir4(dirname4(path), { recursive: true });
-    await appendFile(path, `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...event })}
-`);
-    if ((await stat3(path)).size > MAX_BYTES) {
-      const lines = (await readFile6(path, "utf8")).split("\n").filter(Boolean);
-      await writeAtomic(path, `${lines.slice(Math.floor(lines.length / 2)).join("\n")}
-`);
-    }
-  } catch {
-  }
-}
-async function readTraces(repositoryRoot, limit = 2e3) {
-  let raw;
-  try {
-    raw = await readFile6(tracePath(repositoryRoot), "utf8");
-  } catch {
-    return [];
-  }
-  return parseTraceLines(raw).slice(-limit);
-}
-function parseTraceLines(raw) {
-  const events = [];
-  for (const line of raw.split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      const event = JSON.parse(line);
-      if (typeof event.ts === "string" && typeof event.name === "string") events.push(event);
-    } catch {
-    }
-  }
-  return events;
-}
-
 // src/hooks/semantic.ts
 import pTimeout from "p-timeout";
 var CONNECT_BUDGET_MS = 2500;
@@ -2779,7 +2945,7 @@ async function configuredReranker(repositoryRoot) {
   if (provider === "local") {
     const revision = model === DEFAULT_RERANK_MODELS.local.id ? DEFAULT_RERANK_MODELS.local.revision : void 0;
     return async (task, documents) => {
-      const { rerankLocally } = await import("./local-5MZURLCZ.js");
+      const { rerankLocally } = await import("./local-ST4WMRCG.js");
       return bounded(
         rerankLocally({ id: model, ...revision ? { revision } : {} }, task, documents)
       );
@@ -2787,7 +2953,7 @@ async function configuredReranker(repositoryRoot) {
   }
   const apiKey = provider === "openrouter" ? process.env.OPENROUTER_API_KEY : process.env.HF_TOKEN ?? file.provider?.apiKey;
   if (!apiKey) return void 0;
-  const { rerankHuggingFace, rerankOpenRouter } = await import("./cloud-7WM3YLI4.js");
+  const { rerankHuggingFace, rerankOpenRouter } = await import("./cloud-LXZUR3U2.js");
   const call = provider === "openrouter" ? rerankOpenRouter : rerankHuggingFace;
   return (task, documents) => call({ apiKey, model, timeoutMs: RERANK_BUDGET_MS }, task, documents);
 }
@@ -2796,7 +2962,7 @@ async function openHookSemantics(repositoryRoot) {
   const connect = async () => {
     const config = await loadRuntimeConfig(repositoryRoot, { requireDatabase: false });
     if (!config.postgresUrl) return null;
-    const { createRuntime } = await import("./operations-POCHY3WR.js");
+    const { createRuntime } = await import("./operations-WJR7AZZF.js");
     const opening = createRuntime(config, {
       repositoryRoot,
       startWorker: false,
@@ -2831,20 +2997,20 @@ async function openHookSemantics(repositoryRoot) {
 }
 
 // src/hooks/staging.ts
-import { mkdir as mkdir5, readFile as readFile7, rename as rename2, rm as rm3, stat as stat4 } from "fs/promises";
-import { join as join7, resolve as resolve8 } from "path";
+import { mkdir as mkdir4, readFile as readFile6, rename as rename2, rm as rm3, stat as stat3 } from "fs/promises";
+import { join as join6, resolve as resolve8 } from "path";
 var STAGING_LOCK_STALE_MS = 1e4;
 var HookStagingStore = class {
   directory;
   operations = Promise.resolve();
   constructor(repositoryRoot = process.cwd()) {
-    this.directory = join7(resolve8(repositoryRoot), ".codebuddy", "cache", "hooks");
+    this.directory = join6(resolve8(repositoryRoot), ".codebuddy", "cache", "hooks");
   }
   async add(sessionId, paths) {
     await this.serialize(async () => {
       const clean = paths.map(normalize2).filter(Boolean);
       if (clean.length === 0) return;
-      await mkdir5(this.directory, { recursive: true, mode: 448 });
+      await mkdir4(this.directory, { recursive: true, mode: 448 });
       await this.withFileLock(sessionId, async () => {
         const merged = [.../* @__PURE__ */ new Set([...await this.read(sessionId), ...clean])].sort();
         await writeAtomic(
@@ -2857,7 +3023,7 @@ var HookStagingStore = class {
   }
   async read(sessionId) {
     try {
-      const parsed = JSON.parse(await readFile7(this.filePath(sessionId), "utf8"));
+      const parsed = JSON.parse(await readFile6(this.filePath(sessionId), "utf8"));
       return Array.isArray(parsed?.paths) ? parsed.paths.filter((p) => typeof p === "string") : [];
     } catch {
       return [];
@@ -2866,7 +3032,7 @@ var HookStagingStore = class {
   /** Return the staged paths and clear them. */
   async drain(sessionId) {
     return this.serialize(async () => {
-      await mkdir5(this.directory, { recursive: true, mode: 448 });
+      await mkdir4(this.directory, { recursive: true, mode: 448 });
       return this.withFileLock(sessionId, async () => {
         const path = this.filePath(sessionId);
         const draining = `${path}.${process.pid}.${Date.now()}.drain`;
@@ -2877,7 +3043,7 @@ var HookStagingStore = class {
           throw error;
         }
         try {
-          const parsed = JSON.parse(await readFile7(draining, "utf8"));
+          const parsed = JSON.parse(await readFile6(draining, "utf8"));
           return Array.isArray(parsed?.paths) ? parsed.paths.filter((item) => typeof item === "string") : [];
         } finally {
           await rm3(draining, { force: true });
@@ -2887,15 +3053,15 @@ var HookStagingStore = class {
   }
   /** Claim a batch without consuming edits staged while capture runs. */
   async claim(sessionId) {
-    await mkdir5(this.directory, { recursive: true, mode: 448 });
+    await mkdir4(this.directory, { recursive: true, mode: 448 });
     const captureLock = `${this.filePath(sessionId)}.capture-lock`;
     for (let attempt = 0; ; attempt++) {
       try {
-        await mkdir5(captureLock);
+        await mkdir4(captureLock);
         break;
       } catch (error) {
         if (error.code !== "EEXIST") throw error;
-        const age = Date.now() - (await stat4(captureLock).catch(() => ({ mtimeMs: Date.now() }))).mtimeMs;
+        const age = Date.now() - (await stat3(captureLock).catch(() => ({ mtimeMs: Date.now() }))).mtimeMs;
         if (age > 6e4) {
           await rm3(captureLock, { recursive: true, force: true });
           continue;
@@ -2908,13 +3074,13 @@ var HookStagingStore = class {
       return await this.withFileLock(sessionId, async () => {
         const claimed = this.claimPath(sessionId);
         try {
-          return parsePaths(await readFile7(claimed, "utf8"));
+          return parsePaths(await readFile6(claimed, "utf8"));
         } catch (error) {
           if (error.code !== "ENOENT") throw error;
         }
         try {
           await rename2(this.filePath(sessionId), claimed);
-          return parsePaths(await readFile7(claimed, "utf8"));
+          return parsePaths(await readFile6(claimed, "utf8"));
         } catch (error) {
           if (error.code === "ENOENT") return [];
           throw error;
@@ -2935,7 +3101,7 @@ var HookStagingStore = class {
   /** Restore the claimed batch for retry, merging edits that arrived during capture. */
   async rollback(sessionId) {
     await this.withFileLock(sessionId, async () => {
-      const claimed = await readFile7(this.claimPath(sessionId), "utf8").then(parsePaths).catch(() => []);
+      const claimed = await readFile6(this.claimPath(sessionId), "utf8").then(parsePaths).catch(() => []);
       const merged = [.../* @__PURE__ */ new Set([...claimed, ...await this.read(sessionId)])].sort();
       if (merged.length > 0)
         await writeAtomic(
@@ -2954,11 +3120,11 @@ var HookStagingStore = class {
     const lock = `${this.filePath(sessionId)}.lock`;
     for (let attempt = 0; ; attempt++) {
       try {
-        await mkdir5(lock);
+        await mkdir4(lock);
         break;
       } catch (error) {
         if (error.code !== "EEXIST" || attempt >= 200) throw error;
-        const age = await stat4(lock).then(
+        const age = await stat3(lock).then(
           (info) => Date.now() - info.mtimeMs,
           () => 0
         );
@@ -2990,7 +3156,7 @@ var HookStagingStore = class {
   }
   filePath(sessionId) {
     const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_") || "default";
-    return join7(this.directory, `${safe}.json`);
+    return join6(this.directory, `${safe}.json`);
   }
 };
 function normalize2(path) {
@@ -3003,6 +3169,7 @@ function parsePaths(raw) {
 
 // src/hooks/runtime.ts
 var CONTEXT_BLOCK_MAX_CHARS = 1800;
+var HOOK_TASK_FILES = 2;
 var PROMPT_FACTS = 3;
 var CONTEXT_HOOK_BUDGET_MS = 15e3;
 async function resolveNamespace(repositoryRoot) {
@@ -3021,7 +3188,8 @@ async function runContextHook(input, emit, budgetMs = CONTEXT_HOOK_BUDGET_MS) {
     beforeEdit = await buildBeforeEditContext({
       repositoryRoot,
       namespace,
-      useGit: true,
+      // Git changes are the targets only without a prompt; a prompt that
+      // matches no file gets none (an explicit useGit would force them back).
       ...input.prompt ? { task: input.prompt } : {},
       ...semantics?.semanticRanker ? { semanticRanker: semantics.semanticRanker } : {},
       ...semantics?.reranker ? { reranker: semantics.reranker } : {}
@@ -3066,16 +3234,20 @@ function recallTrace(input, beforeEdit, emitted, text, started, late) {
     tokensOut: estimateTokens(text),
     ...input.session_id ? { session: input.session_id } : {},
     detail: {
-      prompt: prompt.length > 120 ? `${prompt.slice(0, 119)}\u2026` : prompt,
+      prompt: clip2(prompt, 120),
       facts: facts.map((fact) => fact.summary.slice(0, 100)),
       dense: facts.filter((fact) => fact.reason.includes("semantic")).length,
       lexical: facts.filter((fact) => /task term|target path/.test(fact.reason)).length,
       files: (beforeEdit?.targetPaths ?? []).slice(0, 3),
       sections: emitted.length,
+      ...text.trim() ? { block: clip2(redactSensitive(text.trim()), 2e3) } : {},
       ...late ? { dropped: "built after the hook budget" } : {}
     }
   };
 }
+function clip2(text, max) {
+  return text.length > max ? `${text.slice(0, max - 1)}\u2026` : text;
+}
 async function runStageHook(input) {
   const repositoryRoot = hookRoot(input.cwd);
   const paths = extractEditedPaths(input.tool_input).map((path) => toRepoRelative(repositoryRoot, path)).filter((path) => path !== null);
@@ -3084,7 +3256,7 @@ async function runStageHook(input) {
 }
 async function llmMemoryOptions(repositoryRoot) {
   try {
-    return await (await import("./memory-KIC5FJVW.js")).llmCaptureOptions(repositoryRoot);
+    return await (await import("./memory-TGHVTBME.js")).llmCaptureOptions(repositoryRoot);
   } catch {
     return {};
   }
@@ -3101,12 +3273,12 @@ async function runCaptureHook(input) {
   const changedFiles = claimed;
   try {
     const prompts = input.transcript_path ? await turnUserPrompts(input.transcript_path) : [];
-    const { rules, revocations } = extractUserRules(prompts);
+    const { rules, revocations, policies } = extractUserRules(prompts);
     let investigation = false;
     if (changedFiles.length === 0) {
       const assistant = input.transcript_path ? await lastAssistantMessage(input.transcript_path) : input.last_assistant_message?.trim() ?? "";
       investigation = assistant.length >= INVESTIGATION_MIN_CHARS && NAMES_CODE.test(assistant);
-      if (!investigation && rules.length === 0 && revocations.length === 0) {
+      if (!investigation && rules.length === 0 && revocations.length === 0 && policies.length === 0) {
         await staging.acknowledge(sessionId);
         return { changedFiles, result: null };
       }
@@ -3131,6 +3303,7 @@ async function runCaptureHook(input) {
         sessionId,
         ...verification.length > 0 ? { verification } : {},
         ...rules.length > 0 ? { userRules: rules } : {},
+        ...policies.length > 0 ? { userPolicies: policies } : {},
         ...revocations.length > 0 ? { revokedRules: revocations } : {},
         ...investigation ? { investigation } : {},
         // Without edits, only the user's own rules and a handoff are kept: an
@@ -3166,14 +3339,14 @@ var SYNC_BUDGET_MS = 5 * 6e4;
 async function runSyncHook(repositoryRoot, options = {}) {
   const config = await loadRuntimeConfig(repositoryRoot, { requireDatabase: false });
   if (!config.postgresUrl) return null;
-  const lock = join8(repositoryRoot, ".codebuddy", "cache", "sync.lock");
-  const dirty = join8(repositoryRoot, ".codebuddy", "cache", "sync.dirty");
-  await mkdir6(dirname5(lock), { recursive: true });
+  const lock = join7(repositoryRoot, ".codebuddy", "cache", "sync.lock");
+  const dirty = join7(repositoryRoot, ".codebuddy", "cache", "sync.dirty");
+  await mkdir5(dirname5(lock), { recursive: true });
   if (!await takeLock(lock)) {
     await writeFile(dirty, "").catch(() => void 0);
     return null;
   }
-  const { createRuntime } = await import("./operations-POCHY3WR.js");
+  const { createRuntime } = await import("./operations-WJR7AZZF.js");
   const runtime = await createRuntime(config, { repositoryRoot }).catch(async (error) => {
     await rm4(lock, { recursive: true, force: true });
     throw error;
@@ -3205,10 +3378,23 @@ async function runSyncHook(repositoryRoot, options = {}) {
       });
       result = { reindex, drained };
       round += 1;
-    } while (round < 3 && await stat5(dirty).then(
+    } while (round < 3 && await stat4(dirty).then(
       () => true,
       () => false
     ));
+    if (config.provider.type === "local") {
+      const started = Date.now();
+      const vectors = await syncFileVectors(repositoryRoot, SYNC_BUDGET_MS);
+      if (vectors) {
+        await recordTrace(repositoryRoot, {
+          kind: "sync",
+          name: "file-vectors",
+          ms: Date.now() - started,
+          ok: true,
+          detail: { ...vectors }
+        });
+      }
+    }
     return result;
   } finally {
     await runtime.close();
@@ -3218,24 +3404,39 @@ async function runSyncHook(repositoryRoot, options = {}) {
 var SYNC_LOCK_STALE_MS = SYNC_BUDGET_MS + 6e4;
 async function takeLock(path) {
   try {
-    await mkdir6(path);
+    await mkdir5(path);
     return true;
   } catch {
-    const age = await stat5(path).then(
+    const age = await stat4(path).then(
       (info) => Date.now() - info.mtimeMs,
       () => 0
     );
     if (age < SYNC_LOCK_STALE_MS) return false;
     await rm4(path, { recursive: true, force: true });
-    return mkdir6(path).then(
+    return mkdir5(path).then(
       () => true,
       () => false
     );
   }
 }
-async function runResetHook(input) {
+async function runResetHook(input, emit) {
   const repositoryRoot = hookRoot(input.cwd);
-  await new SessionCapsuleLedger(repositoryRoot).reset(input.session_id ?? "default");
+  const sessionId = input.session_id ?? "default";
+  const ledger = new SessionCapsuleLedger(repositoryRoot);
+  await ledger.reset(sessionId);
+  if (input.hook_event_name !== "SessionStart") return "";
+  const namespace = await resolveNamespace(repositoryRoot);
+  const bootstrap = await buildBootstrapContext({ repositoryRoot, namespace });
+  const { text, emitted } = await renderContextBlock(
+    bootstrap,
+    null,
+    ledger,
+    sessionId,
+    input.session_id !== void 0
+  );
+  if (text.trim()) await emit?.(text);
+  await ledger.markSent(sessionId, emitted);
+  return text;
 }
 function extractEditedPaths(toolInput) {
   if (!toolInput) return [];
@@ -3279,7 +3480,7 @@ function isVerificationCommand(command) {
 async function turnVerification(transcriptPath) {
   let raw;
   try {
-    raw = await readFile8(transcriptPath, "utf8");
+    raw = await readFile7(transcriptPath, "utf8");
   } catch {
     return [];
   }
@@ -3331,7 +3532,7 @@ var TAGGED_BLOCK = /<([a-z][\w-]*)[^>]*>[\s\S]*?<\/\1>/gi;
 async function turnUserPrompts(transcriptPath) {
   let raw;
   try {
-    raw = await readFile8(transcriptPath, "utf8");
+    raw = await readFile7(transcriptPath, "utf8");
   } catch {
     return [];
   }
@@ -3362,7 +3563,7 @@ async function turnUserPrompts(transcriptPath) {
 }
 async function lastAssistantMessage(transcriptPath) {
   try {
-    const raw = await readFile8(transcriptPath, "utf8");
+    const raw = await readFile7(transcriptPath, "utf8");
     let latest = "";
     for (const line of raw.split("\n")) {
       const trimmed = line.trim();
@@ -3506,7 +3707,7 @@ async function renderContextBlock(bootstrap, beforeEdit, ledger, sessionId, anno
     items.push({
       priority: 3,
       text: bound(
-        `${targetLabel}: ${beforeEdit.targetPaths.slice(0, 8).join(", ")}` + (tests.length > 0 ? `; tests: ${tests.join(", ")}` : ""),
+        `${targetLabel}: ${beforeEdit.targetPaths.slice(0, beforeEdit.pathSource === "task" ? HOOK_TASK_FILES : 8).join(", ")}` + (tests.length > 0 ? `; tests: ${tests.join(", ")}` : ""),
         500
       )
     });
@@ -3555,11 +3756,6 @@ export {
   PlanLockError,
   PlanValidationError,
   PlanFileStore,
-  PlanTransitionError,
-  PlanNotFoundError,
-  ActivePlanExistsError,
-  PlanLifecycle,
-  enforceContextBudget,
   RiskAssessor,
   createChurnSignal,
   createIncidentSignal,
@@ -3567,16 +3763,17 @@ export {
   readPolicyFile,
   assessRisk,
   resolveRiskPaths,
+  PlanTransitionError,
+  PlanNotFoundError,
+  ActivePlanExistsError,
+  PlanLifecycle,
+  enforceContextBudget,
   WorklogStore,
   buildBootstrapContext,
   buildBeforeEditContext,
   ReviewStore,
   captureAfterTurn,
   approveReviewItem,
-  tracePath,
-  recordTrace,
-  readTraces,
-  parseTraceLines,
   configuredReranker,
   openHookSemantics,
   CONTEXT_HOOK_BUDGET_MS,
@@ -3594,4 +3791,4 @@ export {
   lastAssistantMessage,
   renderContextBlock
 };
-//# sourceMappingURL=chunk-R7CD6EXS.js.map
+//# sourceMappingURL=chunk-ZNLSCV3J.js.map