@rness/cli 0.18.0 → 0.19.0

package/dist/{chunk-VGBS7HDY.js → chunk-U5SBNWVD.js}

@@ -186,9 +186,9 @@ async function originUrl(dir) {
 async function init(dir) {
   await git(["init", "-q", "-b", "main"], dir);
 }
-async function commitAll(dir, message2) {
+async function commitAll(dir, message3) {
   await git(["add", "-A"], dir);
-  await git(["commit", "-q", "-m", message2], dir);
+  await git(["commit", "-q", "-m", message3], dir);
 }
 
 // src/core/remote.ts
@@ -296,8 +296,8 @@ var KEYS = [
   "repos",
   "scopes"
 ];
-function fail(message2) {
-  throw new Error(`rness.json: ${message2}`);
+function fail(message3) {
+  throw new Error(`rness.json: ${message3}`);
 }
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -424,6 +424,9 @@ async function loadManifest(rnessDir) {
   } catch {
     fail("not found");
   }
+  return parseManifest(raw);
+}
+function parseManifest(raw) {
   let data;
   try {
     data = JSON.parse(raw);
@@ -508,7 +511,7 @@ function parseRepoSpec(spec, org, host) {
 }
 
 // src/version.ts
-var VERSION = "0.18.0";
+var VERSION = "0.19.0";
 
 // src/core/pm.ts
 import { execFile as execFile2 } from "child_process";
@@ -588,8 +591,8 @@ async function installDependencies(pm, dir, opts = {}) {
 // src/core/frontmatter.ts
 import { parse } from "yaml";
 var FRONT_MATTER = /^---\r?\n(?:([\s\S]*?)\r?\n)?---(?:\r?\n|$)/;
-function fail2(message2) {
-  throw new Error(`front matter: ${message2}`);
+function fail2(message3) {
+  throw new Error(`front matter: ${message3}`);
 }
 function stripBom(source) {
   return source.startsWith("\uFEFF") ? source.slice(1) : source;
@@ -628,29 +631,31 @@ import { join as join3, posix, sep } from "path";
 function toPosix(rel) {
   return rel.split(sep).join(posix.sep);
 }
+function markdownItem(path, rel, body) {
+  let fields2 = null;
+  let fieldsError = null;
+  try {
+    fields2 = parseFrontMatter(body);
+  } catch (e) {
+    fieldsError = e instanceof Error ? e.message : String(e);
+  }
+  return {
+    path,
+    rel,
+    fields: fields2,
+    fieldsError,
+    title: extractTitle(body),
+    body,
+    content: stripFrontMatter(body)
+  };
+}
 async function collectMarkdown(dir) {
   const rels = [];
   for await (const rel of glob("**/*.md", { cwd: dir })) rels.push(toPosix(rel));
   const items = await Promise.all(
     rels.map(async (rel) => {
       const path = join3(dir, ...rel.split(posix.sep));
-      const body = await readFile3(path, "utf8");
-      let fields2 = null;
-      let fieldsError = null;
-      try {
-        fields2 = parseFrontMatter(body);
-      } catch (e) {
-        fieldsError = e instanceof Error ? e.message : String(e);
-      }
-      return {
-        path,
-        rel,
-        fields: fields2,
-        fieldsError,
-        title: extractTitle(body),
-        body,
-        content: stripFrontMatter(body)
-      };
+      return markdownItem(path, rel, await readFile3(path, "utf8"));
     })
   );
   return items.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
@@ -744,7 +749,13 @@ import { join as join5 } from "path";
 
 // src/core/documents.ts
 import { posix as posix2 } from "path";
+function documentDate(rel) {
+  return /^((?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))-/.exec(
+    posix2.basename(rel)
+  )?.[1] ?? null;
+}
 function documentNumber(rel) {
+  if (documentDate(rel) !== null) return null;
   return /^(\d{4})-/.exec(posix2.basename(rel))?.[1] ?? null;
 }
 function documentTitle(heading, number) {
@@ -768,11 +779,25 @@ var STATUSES = {
 };
 var SKIP = /* @__PURE__ */ new Set(["adr/0000-template.md"]);
 var PLACEMENT_KEYS = ["scopes", "scope"];
-async function checkContract(rnessDir) {
+async function itemsOf(rnessDir, name, override) {
+  const items = await collectMarkdown(join5(rnessDir, name));
+  const prefix = `${name}/`;
+  if (override === void 0 || !override.rel.startsWith(prefix)) return items;
+  const rel = override.rel.slice(prefix.length);
+  const item = markdownItem(
+    join5(rnessDir, ...override.rel.split("/")),
+    rel,
+    override.text
+  );
+  return [...items.filter((i) => i.rel !== rel), item].sort(
+    (a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0
+  );
+}
+async function checkContract(rnessDir, override) {
   const problems = [];
   for (const name of COLLECTIONS) {
     const allowed = STATUSES[name];
-    const items = await collectMarkdown(join5(rnessDir, name));
+    const items = await itemsOf(rnessDir, name, override);
     const byNumber = /* @__PURE__ */ new Map();
     for (const item of items) {
       const where = `${name}/${item.rel}`;
@@ -788,9 +813,16 @@ async function checkContract(rnessDir) {
           `${where}: the number ${number} is also that of ${files.filter((f) => f !== where).join(", ")}`
         );
     }
+    const next = String(
+      Math.max(0, ...[...byNumber.keys()].map(Number)) + 1
+    ).padStart(4, "0");
     for (const item of items) {
       const where = `${name}/${item.rel}`;
       if (SKIP.has(where)) continue;
+      if (allowed !== void 0 && documentNumber(item.rel) === null)
+        problems.push(
+          `${where}: not numbered; name it ${next}-<slug>.md, the next number of ${name}`
+        );
       if (item.fieldsError !== null) {
         problems.push(`${where}: invalid front matter (${item.fieldsError})`);
         continue;
@@ -1127,8 +1159,8 @@ function sessionsOf(item) {
 }
 function rowOf(dir, item) {
   const base = posix3.basename(item.rel, ".md");
-  const date = /^(\d{4}-\d{2}-\d{2})-/.exec(base)?.[1] ?? null;
-  const number = date === null ? documentNumber(item.rel) : null;
+  const date = documentDate(item.rel);
+  const number = documentNumber(item.rel);
   const sessions = sessionsOf(item);
   return {
     id: date ?? number ?? base,
@@ -1208,6 +1240,21 @@ function statusMarkdown(workspace, tabs) {
   }
   return out.join("\n");
 }
+async function plansInProgress(ws, manifest, scope) {
+  const context3 = await assembleContext({
+    rnessDir: ws.rnessDir,
+    manifest,
+    scope
+  });
+  const plans = context3.collections.find((c) => c.name === "plans");
+  return (plans?.files ?? []).filter((f) => {
+    try {
+      return parseFrontMatter(f.body)?.["status"] === "In progress";
+    } catch {
+      return false;
+    }
+  }).map((f) => `plans/${f.rel}`);
+}
 
 // src/pulse/body.ts
 import { createHash } from "crypto";
@@ -2027,9 +2074,9 @@ async function postJson(path, payload, options, explain = false, limited = () =>
       continue;
     }
     if (!ok) {
-      const message2 = explain && page.status !== 401 && page.status !== 429 && page.body !== null && typeof page.body === "object" ? page.body.message : void 0;
-      if (typeof message2 === "string" && message2 !== "")
-        throw new GitHubMessageError(message2, {
+      const message3 = explain && page.status !== 401 && page.status !== 429 && page.body !== null && typeof page.body === "object" ? page.body.message : void 0;
+      if (typeof message3 === "string" && message3 !== "")
+        throw new GitHubMessageError(message3, {
           cause: { status: page.status, path }
         });
       throw httpError(page, path);
@@ -2053,9 +2100,9 @@ async function getScopes(options) {
     const cause = { status: res.status, path: "/user" };
     if (res.status === 401)
       throw new Error("GitHub rejected the token (401)", { cause });
-    const message2 = body !== null && typeof body === "object" ? body["message"] : void 0;
-    if (typeof message2 === "string" && message2 !== "")
-      throw new GitHubMessageError(message2, { cause });
+    const message3 = body !== null && typeof body === "object" ? body["message"] : void 0;
+    if (typeof message3 === "string" && message3 !== "")
+      throw new GitHubMessageError(message3, { cause });
     throw new Error(`GitHub API answered ${res.status} for /user`, { cause });
   }
   const header2 = res.headers.get("x-oauth-scopes");
@@ -2102,8 +2149,8 @@ async function getOrgMembership(org, options) {
   }
   if (status2 === 404) return "not-member";
   if (status2 === 403) {
-    const message2 = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
-    if (/OAuth App access restrictions/i.test(message2)) return "restricted";
+    const message3 = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
+    if (/OAuth App access restrictions/i.test(message3)) return "restricted";
   }
   return "unknown";
 }
@@ -2125,8 +2172,8 @@ async function createRepository(owner, name, options) {
       throw new Error(`cannot reach the GitHub API: ${reason2(e)}`, { cause: e });
     }
     const body = await res.json().catch(() => void 0);
-    const message2 = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
-    return { status: res.status, message: message2 };
+    const message3 = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
+    return { status: res.status, message: message3 };
   };
   let answer = await post2(`/orgs/${encodeURIComponent(owner)}/repos`);
   if (answer.status === 404 && options.self !== void 0 && options.self !== null && options.self.toLowerCase() === owner.toLowerCase())
@@ -3948,6 +3995,9 @@ function inverse(text, stream = process.stdout) {
   const painted = styleText("inverse", text, { stream, validateStream: true });
   return painted === text ? plain : painted;
 }
+function count(n, [one, many]) {
+  return `${n} ${n === 1 ? one : many}`;
+}
 function grey(text, stream = process.stdout) {
   if (noColor()) return text;
   return styleText("gray", text, { stream, validateStream: true });
@@ -4021,12 +4071,12 @@ async function detectGithubSsh(opts) {
     child.stderr?.setEncoding("utf8");
     child.stderr?.on("data", (chunk) => chunks.push(chunk));
     let settled = false;
-    const settle = (access3) => {
+    const settle = (access2) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve8(access3);
+      resolve8(access2);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -4071,8 +4121,8 @@ async function testGithubSsh(transport, interactive, announce) {
   };
 }
 var loggedInAs = (login) => login === void 0 || login === null ? "" : `, logged in as ${login}`;
-function usingSentence(access3, login) {
-  return access3.ok ? `SSH works for github.com (as ${access3.login}) \u2014 repositories are cloned over SSH` : `No SSH access to github.com (${access3.reason}) \u2014 repositories are cloned over HTTPS${loggedInAs(login)}`;
+function usingSentence(access2, login) {
+  return access2.ok ? `SSH works for github.com (as ${access2.login}) \u2014 repositories are cloned over SSH` : `No SSH access to github.com (${access2.reason}) \u2014 repositories are cloned over HTTPS${loggedInAs(login)}`;
 }
 function isSshUrl(url, hosts) {
   return url.startsWith(hosts.ssh);
@@ -4083,8 +4133,8 @@ var CHECKING = [
   "ssh access to github.com\u2026",
   "Checking SSH access to github.com \u2014 ssh may ask for your passphrase"
 ];
-function usingRest(access3, login) {
-  return access3.ok ? `ssh (github.com as ${access3.login})` : `https (ssh to github.com unavailable: ${access3.reason}${loggedInAs(login)})`;
+function usingRest(access2, login) {
+  return access2.ok ? `ssh (github.com as ${access2.login})` : `https (ssh to github.com unavailable: ${access2.reason}${loggedInAs(login)})`;
 }
 function agentHintLines(platform = process.platform) {
   const mac = platform === "darwin";
@@ -4094,6 +4144,12 @@ function agentHintLines(platform = process.platform) {
     `  ~/.ssh/config: AddKeysToAgent yes${mac ? ", UseKeychain yes" : ""}`
   ];
 }
+function passphraseHint(platform = process.platform) {
+  return [
+    "ssh asked for your passphrase, and asks again for every repository unless an agent holds the key:",
+    ...agentHintLines(platform).slice(1)
+  ].join("\n");
+}
 function sshWorkspaceLines(reason3) {
   return [
     `this workspace clones over SSH (rness.json) but ssh to github.com fails: ${reason3}`,
@@ -4147,8 +4203,8 @@ function reportError(e) {
     process.stderr.write(`${e.stack}
 `);
   } else {
-    const message2 = e instanceof Error ? e.message : String(e);
-    process.stderr.write(`${paint("error", message2, process.stderr)}
+    const message3 = e instanceof Error ? e.message : String(e);
+    process.stderr.write(`${paint("error", message3, process.stderr)}
 `);
   }
   return 1;
@@ -4340,13 +4396,16 @@ async function ensureClaudeMd(dir) {
 }
 
 // src/commands/sync.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/core/agent-targets.ts
 import { mkdir as mkdir2, rm as rm4, rmdir } from "fs/promises";
-import { dirname as dirname4, join as join14 } from "path";
+import { dirname as dirname5, join as join15 } from "path";
 
 // src/core/claude-skills.ts
+import { readFileSync, statSync } from "fs";
+import { dirname as dirname4, join as join13 } from "path";
+import { fileURLToPath } from "url";
 var PLUGIN = ".claude/skills/rness";
 var PLUGIN_JSON = `${JSON.stringify(
   {
@@ -4364,7 +4423,9 @@ var PLUGIN_JSON = `${JSON.stringify(
       "adr",
       "specification",
       "plan"
-    ]
+    ],
+    // The contract of the mod's `$.state` (spec 0029 §3.1).
+    types: "./types/index.d.ts"
   },
   null,
   2
@@ -4613,6 +4674,45 @@ allowed-tools: Bash(${command}), Bash(${allocate})
 
 ${s.body(rness, allocate)}`;
 }
+function modDir() {
+  let dir = dirname4(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 4; i += 1) {
+    const candidate = join13(dir, "mod");
+    try {
+      if (statSync(join13(candidate, "hooks", "hooks.json")).isFile())
+        return candidate;
+    } catch {
+    }
+    dir = dirname4(dir);
+  }
+  throw new Error("mod directory not found next to the @rness/cli package");
+}
+var MOD_FILES = [
+  "hooks/hooks.json",
+  "hooks/register.tsx",
+  "types/index.d.ts"
+];
+var RNESS_LINE = "const RNESS = '.rness'";
+var modSources = null;
+function modSource(rel) {
+  if (modSources === null) {
+    const dir = modDir();
+    modSources = new Map(
+      MOD_FILES.map((f) => [
+        f,
+        readFileSync(join13(dir, ...f.split("/")), "utf8")
+      ])
+    );
+  }
+  return modSources.get(rel) ?? "";
+}
+function modFile(rel, rness) {
+  const text = modSource(rel);
+  if (rel !== "hooks/register.tsx") return text;
+  if (!text.includes(RNESS_LINE))
+    throw new Error(`mod/hooks/register.tsx lacks ${RNESS_LINE}`);
+  return text.replace(RNESS_LINE, `const RNESS = '${rness}'`);
+}
 function pluginFiles(rness, at, ctx) {
   return [
     { file: `${PLUGIN}/.claude-plugin/plugin.json`, at, content: PLUGIN_JSON },
@@ -4626,6 +4726,11 @@ function pluginFiles(rness, at, ctx) {
       at,
       content: lifecycleSkill(rness, s)
     })),
+    ...MOD_FILES.map((rel) => ({
+      file: `${PLUGIN}/${rel}`,
+      at,
+      content: modFile(rel, rness)
+    })),
     ...RETIRED_SKILLS.map((name) => ({
       file: `${PLUGIN}/skills/${name}/SKILL.md`,
       at,
@@ -4658,6 +4763,22 @@ function hooks(rness) {
       },
       label: "the rness session-start hook"
     },
+    {
+      // Before an edit: refused when it would change what sync generates,
+      // or break the contract of .rness (spec 0029 §4).
+      path: ["hooks", "PreToolUse"],
+      contains: {
+        matcher: "Edit|Write",
+        hooks: [
+          {
+            type: "command",
+            command: hookLine(rness, "pre-tool-use"),
+            timeout: 10
+          }
+        ]
+      },
+      label: "the rness pre-tool-use hook"
+    },
     {
       path: ["hooks", "PostToolUse"],
       contains: {
@@ -4852,7 +4973,7 @@ function describeGuarantee(g) {
 // src/core/pinned.ts
 import { execFile as execFile3 } from "child_process";
 import { readFile as readFile8 } from "fs/promises";
-import { basename as basename3, join as join13 } from "path";
+import { basename as basename3, join as join14 } from "path";
 import { promisify as promisify3 } from "util";
 var execFileP3 = promisify3(execFile3);
 var PACKAGE = "@rness/cli";
@@ -4877,7 +4998,7 @@ function compareVersions(a, b) {
 async function readPackageJson(rnessDir) {
   try {
     const parsed = JSON.parse(
-      await readFile8(join13(rnessDir, "package.json"), "utf8")
+      await readFile8(join14(rnessDir, "package.json"), "utf8")
     );
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
@@ -4896,7 +5017,7 @@ async function readPin(rnessDir) {
   return null;
 }
 async function writePin(rnessDir, from, to) {
-  const file = join13(rnessDir, "package.json");
+  const file = join14(rnessDir, "package.json");
   const text = await readFile8(file, "utf8");
   const entry = new RegExp(
     `("${PACKAGE}"\\s*:\\s*")${from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(")`
@@ -4919,12 +5040,12 @@ async function workspacePackageManager(rnessDir) {
     if (isPackageManager(name)) return name;
   }
   for (const [lockfile, pm] of LOCKFILES)
-    if (await exists(join13(rnessDir, lockfile))) return pm;
+    if (await exists(join14(rnessDir, lockfile))) return pm;
   return "npm";
 }
 async function hasLockfile(rnessDir, pm) {
   for (const [lockfile, owner] of LOCKFILES)
-    if (owner === pm && await exists(join13(rnessDir, lockfile))) return true;
+    if (owner === pm && await exists(join14(rnessDir, lockfile))) return true;
   return false;
 }
 async function pinDrift(rnessDir) {
@@ -4980,9 +5101,9 @@ async function ensureInstalled(rnessDir, opts = {}) {
   }
 }
 async function runPinnedSync(root) {
-  const installed = await readPinnedCli(join13(root, ".rness"));
+  const installed = await readPinnedCli(join14(root, ".rness"));
   if (installed === null) return null;
-  const pinned = join13(installed.dir, ...installed.bin.split("/"));
+  const pinned = join14(installed.dir, ...installed.bin.split("/"));
   if (!await exists(pinned))
     return {
       code: 1,
@@ -5057,7 +5178,7 @@ function syncOutcome(result, opts = {}) {
   };
 }
 async function syncPinned(root, shown, fallback) {
-  const rnessDir = join13(root, ".rness");
+  const rnessDir = join14(root, ".rness");
   const installed = await readPinnedCli(rnessDir);
   if (installed === null) {
     if (fallback !== void 0) return fallback();
@@ -5067,7 +5188,7 @@ async function syncPinned(root, shown, fallback) {
     );
     return 1;
   }
-  const pinned = join13(installed.dir, ...installed.bin.split("/"));
+  const pinned = join14(installed.dir, ...installed.bin.split("/"));
   if (!await exists(pinned)) {
     process.stderr.write(
       `@rness/cli in ${shown}/.rness is not installed correctly (missing ${installed.bin}); reinstall in .rness/
@@ -5107,30 +5228,30 @@ function wholeDiff(existing, content) {
 }
 async function contextOf(root) {
   return {
-    packageManager: await workspacePackageManager(join14(root, ".rness"))
+    packageManager: await workspacePackageManager(join15(root, ".rness"))
   };
 }
 var PATHS_ONLY = { packageManager: "npm" };
 async function filesOf(root, manifest, targets) {
   const files = [];
-  if (!await exists(join14(root, "org"))) return files;
+  if (!await exists(join15(root, "org"))) return files;
   const ctx = await contextOf(root);
   for (const target2 of targets)
     for (const owned of target2.files(ctx))
       if (owned.at === "root")
         files.push({
           ...owned,
-          file: join14(root, ...owned.file.split("/")),
+          file: join15(root, ...owned.file.split("/")),
           label: owned.file
         });
   for (const repo of Object.keys(manifest.repos)) {
-    if (!await exists(join14(root, "org", repo))) continue;
+    if (!await exists(join15(root, "org", repo))) continue;
     for (const target2 of targets)
       for (const owned of target2.files(ctx))
         if (owned.at === "clones")
           files.push({
             ...owned,
-            file: join14(root, "org", repo, ...owned.file.split("/")),
+            file: join15(root, "org", repo, ...owned.file.split("/")),
             label: `org/${repo}/${owned.file}`
           });
   }
@@ -5166,7 +5287,7 @@ async function agentTargets(root, manifest, opts) {
         continue;
       }
       await rm4(file);
-      await rmdir(dirname4(file)).catch(() => void 0);
+      await rmdir(dirname5(file)).catch(() => void 0);
       outcomes.push({ label, status: "removed", detail: null });
       continue;
     }
@@ -5177,7 +5298,7 @@ async function agentTargets(root, manifest, opts) {
       else if (opts.check)
         outcomes.push({ label, status: "stale", detail: diff });
       else {
-        await mkdir2(dirname4(file), { recursive: true });
+        await mkdir2(dirname5(file), { recursive: true });
         await writeFileAtomic(file, owned.content);
         outcomes.push({ label, status: "updated", detail: null });
       }
@@ -5206,7 +5327,7 @@ async function agentTargets(root, manifest, opts) {
       outcomes.push({ label, status: "unchanged", detail: null });
       continue;
     }
-    await mkdir2(dirname4(file), { recursive: true });
+    await mkdir2(dirname5(file), { recursive: true });
     await writeFileAtomic(file, ensured.text);
     outcomes.push({ label, status: "updated", detail: null });
   }
@@ -5398,8 +5519,8 @@ function sessionUi(p) {
     intro: (title) => {
       p.intro(badge(title));
     },
-    outro: (message2, tone = "done") => {
-      p.outro(badge(message2, tone));
+    outro: (message3, tone = "done") => {
+      p.outro(badge(message3, tone));
     },
     line: (verb, rest, sentence) => {
       say(verb, sentence ?? `${rest} ${verb}`);
@@ -5470,7 +5591,7 @@ function targetsOf(manifest, root, only) {
     const segments = entry.path.split("/");
     targets.push({
       scope: name,
-      dir: join15(root, ...segments),
+      dir: join16(root, ...segments),
       depth: segments.length,
       label: `${entry.path}/AGENTS.md`
     });
@@ -5509,7 +5630,7 @@ async function askWhatToSync(input) {
         {
           value: SELECT_ALL,
           label: "Select all",
-          hint: `${input.missing.length} repositories from rness.json`
+          hint: `${count(input.missing.length, ["repository", "repositories"])} from rness.json`
         },
         ...input.missing.map((name) => ({ value: name, label: name }))
       ],
@@ -5610,15 +5731,16 @@ async function syncCommand(opts, deps = {}) {
     if (!overSsh) ui.gitIsSilent = true;
     if (overSsh) {
       const interactive = opts.yes !== true && terminal.isTty();
-      const { access: access3, unattended } = await testGithubSsh(
+      const { access: access2, unattended } = await testGithubSsh(
         transport,
         interactive,
         () => ui.line(...CHECKING)
       );
       if (unattended) ui.gitIsSilent = true;
-      if (!access3.ok) {
+      else if (access2.ok) ui.hint(passphraseHint(), "stderr");
+      if (!access2.ok) {
         process.stderr.write(
-          `${[...sshWorkspaceLines(access3.reason), ...INSTEAD_OF_LINES].join("\n")}
+          `${[...sshWorkspaceLines(access2.reason), ...INSTEAD_OF_LINES].join("\n")}
 `
         );
         return 1;
@@ -5629,7 +5751,7 @@ async function syncCommand(opts, deps = {}) {
     try {
       const notCloned = /* @__PURE__ */ new Set();
       for (const [name, repo] of Object.entries(manifest.repos)) {
-        const dir = join15(ws.root, "org", name);
+        const dir = join16(ws.root, "org", name);
         const label = `org/${name}`;
         if (!await exists(dir)) {
           if (!toClone.has(name)) {
@@ -5681,7 +5803,7 @@ async function syncCommand(opts, deps = {}) {
         lines.push(
           `not in rness.json: ${undeclared.join(", ")} (${rnessCommand()} add <name> declares it)`
         );
-      if (!await exists(join15(ws.root, "org"))) {
+      if (!await exists(join16(ws.root, "org"))) {
         lines.push(["skipped", "blocks (no org/ directory here)"]);
       } else {
         let differences = 0;
@@ -5693,7 +5815,7 @@ async function syncCommand(opts, deps = {}) {
             continue;
           }
           const [agentsLinked, claudeLinked] = await Promise.all(
-            BLOCK_FILES.map((f) => isSymlink(join15(t.dir, f)))
+            BLOCK_FILES.map((f) => isSymlink(join16(t.dir, f)))
           );
           const atRoot = t.scope === null;
           if (!atRoot && (agentsLinked === true || claudeLinked === true)) {
@@ -5716,7 +5838,7 @@ async function syncCommand(opts, deps = {}) {
               `${t.label}: block is ${Math.round(block.bytes / 1024)} KB (over 32 KB)`
             );
           }
-          const agents = agentsLinked === true ? "skipped" : await syncBlockFile(join15(t.dir, "AGENTS.md"), block, check);
+          const agents = agentsLinked === true ? "skipped" : await syncBlockFile(join16(t.dir, "AGENTS.md"), block, check);
           if (typeof agents === "object") {
             problems.push(`${t.label}: ${agents.error}`);
             continue;
@@ -5731,7 +5853,7 @@ async function syncCommand(opts, deps = {}) {
           }
           if (claudeLinked === true) continue;
           const claude = await syncBlockFile(
-            join15(t.dir, "CLAUDE.md"),
+            join16(t.dir, "CLAUDE.md"),
             block,
             check,
             true
@@ -5788,7 +5910,7 @@ async function syncCommand(opts, deps = {}) {
 }
 
 // src/commands/add.ts
-import { basename as basename4, join as join16 } from "path";
+import { basename as basename4, join as join17 } from "path";
 function printDeclared(ui, result, already) {
   for (const name of result.declared) {
     if (already.has(name)) continue;
@@ -5847,20 +5969,21 @@ async function addCommand(spec, opts, deps = {}) {
     if (host === void 0 && opts.https === true) host = transport.hosts.https;
     if (host === void 0 && FULL_URL2.test(spec)) host = transport.hosts.https;
     if (host === void 0) {
-      const { access: access3, unattended } = await testGithubSsh(
+      const { access: access2, unattended } = await testGithubSsh(
         transport,
         interactive,
         () => ui.line(...CHECKING)
       );
-      if (unattended || !access3.ok) ui.gitIsSilent = true;
+      if (unattended || !access2.ok) ui.gitIsSilent = true;
+      else ui.hint(passphraseHint(), "stderr");
       const overSsh = Object.values(manifest.repos).some(
         (r) => isSshUrl(r.url, transport.hosts)
       );
-      if (access3.ok || !overSsh) {
-        ui.line("using", usingRest(access3), usingSentence(access3));
-        host = access3.ok ? transport.hosts.ssh : transport.hosts.https;
+      if (access2.ok || !overSsh) {
+        ui.line("using", usingRest(access2), usingSentence(access2));
+        host = access2.ok ? transport.hosts.ssh : transport.hosts.https;
       } else {
-        const lines = sshWorkspaceLines(access3.reason);
+        const lines = sshWorkspaceLines(access2.reason);
         if (!interactive) {
           process.stderr.write(
             `${[...lines, httpsFlagLine(spec)].join("\n")}
@@ -5881,7 +6004,7 @@ async function addCommand(spec, opts, deps = {}) {
     }
     parsed = parseRepoSpec(spec, org, host);
     const scopes = (opts.scopes ?? "").split(",").map((s) => s.trim()).filter((s) => s !== "");
-    const dir = join16(ws.root, "org", parsed.name);
+    const dir = join17(ws.root, "org", parsed.name);
     const present = await exists(dir);
     if (interactive) {
       const { confirm, isCancel } = await terminal.prompts();
@@ -6008,9 +6131,9 @@ async function contextCommand(opts) {
 }
 
 // src/core/scaffold.ts
-import { statSync } from "fs";
-import { dirname as dirname5, join as join17 } from "path";
-import { fileURLToPath } from "url";
+import { statSync as statSync2 } from "fs";
+import { dirname as dirname6, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var SCAFFOLD_FILES = [
   "AGENTS.md",
   "CONVENTIONS.md",
@@ -6031,27 +6154,27 @@ var SCAFFOLD_FILES = [
   "docs/.gitkeep"
 ];
 function scaffoldDir() {
-  let dir = dirname5(fileURLToPath(import.meta.url));
+  let dir = dirname6(fileURLToPath2(import.meta.url));
   for (let i = 0; i < 4; i += 1) {
-    const candidate = join17(dir, "scaffold");
+    const candidate = join18(dir, "scaffold");
     try {
-      if (statSync(join17(candidate, "rness.json")).isFile()) return candidate;
+      if (statSync2(join18(candidate, "rness.json")).isFile()) return candidate;
     } catch {
     }
-    dir = dirname5(dir);
+    dir = dirname6(dir);
   }
   throw new Error("scaffold directory not found next to the @rness/cli package");
 }
 
 // src/core/scaffold-copy.ts
 import { chmod as chmod2, mkdir as mkdir3, readFile as readFile9, stat as stat2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname6, join as join18 } from "path";
+import { dirname as dirname7, join as join19 } from "path";
 var TOKENISED = /* @__PURE__ */ new Set(["package.json"]);
 async function renderScaffold(source, tokens) {
   const files = [];
   for (const rel of SCAFFOLD_FILES) {
     if (rel === "rness.json") continue;
-    const from = join18(source, ...rel.split("/"));
+    const from = join19(source, ...rel.split("/"));
     let content = await readFile9(from, "utf8");
     if (TOKENISED.has(rel)) {
       content = content.replaceAll("__RNESS_VERSION__", tokens.version).replaceAll("__RNESS_PM__", tokens.packageManager);
@@ -6066,8 +6189,8 @@ async function renderScaffold(source, tokens) {
 }
 async function copyScaffold(dest, tokens) {
   for (const file of await renderScaffold(scaffoldDir(), tokens)) {
-    const to = join18(dest, ...file.path.split("/"));
-    await mkdir3(dirname6(to), { recursive: true });
+    const to = join19(dest, ...file.path.split("/"));
+    await mkdir3(dirname7(to), { recursive: true });
     await writeFile2(to, file.content, "utf8");
     if (file.executable) await chmod2(to, 493);
   }
@@ -6248,7 +6371,7 @@ async function loginCommand(opts, deps = {}) {
 // src/commands/create.ts
 import { mkdir as mkdir6, mkdtemp as mkdtemp2, rename as rename2, rm as rm7 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join22, relative as relative4, resolve as resolve5 } from "path";
+import { join as join23, relative as relative4, resolve as resolve5 } from "path";
 
 // src/core/approval.ts
 var APPROVAL_INTERVAL_MS = 5e3;
@@ -6262,12 +6385,12 @@ async function checkAccess(input) {
   const login = (await provider.identity())?.login;
   const as = login === void 0 ? "" : ` (as ${login})`;
   const member = () => ui.line("member", `${org}${as}`, `You are a member of ${org}${as}`);
-  const access3 = await provider.organizationAccess(org);
-  if (access3 === "member") {
+  const access2 = await provider.organizationAccess(org);
+  if (access2 === "member") {
     member();
-    return access3;
+    return access2;
   }
-  if (access3 !== "restricted") return access3;
+  if (access2 !== "restricted") return access2;
   const url = provider.approvalUrl();
   ui.warn(
     `${org} has not approved rness, so its private repositories are hidden`
@@ -6296,23 +6419,42 @@ async function checkAccess(input) {
   const who = input.canGrant === true ? org : `an owner of ${org}`;
   const waiting = `for ${who} to approve rness on github.com`;
   if (!ui.session) ui.line("waiting", `${waiting}\u2026`);
-  const outcome = await ui.step(
-    {
-      doing: `waiting  ${waiting}`,
-      sentence: `Waiting ${waiting}`,
-      quiet: true
-    },
-    async () => {
-      const deadline = now() + APPROVAL_WAIT_MS;
-      for (; ; ) {
-        await sleep(APPROVAL_INTERVAL_MS);
-        const again = await provider.organizationAccess(org);
-        if (again === "member" || again === "not-member") return again;
-        if (now() >= deadline) return "timeout";
-      }
-    },
-    (r) => r === "member" ? ["member", `${org}${as}`] : null
-  );
+  let interrupted = false;
+  let wake = () => void 0;
+  const interrupt = () => {
+    interrupted = true;
+    wake();
+  };
+  if (!ui.session) process.once("SIGINT", interrupt);
+  let outcome;
+  try {
+    outcome = await ui.step(
+      {
+        doing: `waiting  ${waiting}`,
+        sentence: `Waiting ${waiting}`,
+        quiet: true
+      },
+      async () => {
+        const deadline = now() + APPROVAL_WAIT_MS;
+        for (; ; ) {
+          await Promise.race([
+            sleep(APPROVAL_INTERVAL_MS),
+            new Promise((resolve8) => {
+              wake = resolve8;
+            })
+          ]);
+          if (interrupted) return "cancelled";
+          const again = await provider.organizationAccess(org);
+          if (again === "member" || again === "not-member") return again;
+          if (now() >= deadline) return "timeout";
+        }
+      },
+      (r) => r === "member" ? ["member", `${org}${as}`] : null
+    );
+  } finally {
+    process.off("SIGINT", interrupt);
+  }
+  if (outcome === "cancelled") return outcome;
   if (outcome === "member") {
     if (!ui.session) member();
     return outcome;
@@ -6348,13 +6490,13 @@ async function askProvider(p) {
 
 // src/core/new-workspace.ts
 import { mkdir as mkdir4, readdir as readdir4, rm as rm6, stat as stat3 } from "fs/promises";
-import { dirname as dirname8, join as join20, relative as relative2 } from "path";
+import { dirname as dirname9, join as join21, relative as relative2 } from "path";
 
 // src/core/scaffold-git.ts
 import { execFile as execFile5 } from "child_process";
 import { mkdtemp, realpath as realpath2, rm as rm5, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname7, join as join19, resolve as resolve3 } from "path";
+import { dirname as dirname8, join as join20, resolve as resolve3 } from "path";
 import { promisify as promisify5 } from "util";
 var execFileP5 = promisify5(execFile5);
 var CREATE_SUBJECT = "chore: rness workspace context";
@@ -6368,7 +6510,7 @@ async function run(dir, args, env = {}) {
         ...process.env,
         ...env,
         GIT_TERMINAL_PROMPT: "0",
-        GIT_CEILING_DIRECTORIES: dirname7(resolve3(dir))
+        GIT_CEILING_DIRECTORIES: dirname8(resolve3(dir))
       },
       maxBuffer: 16 * 1024 * 1024
     });
@@ -6395,13 +6537,13 @@ function scaffoldMessage(subject, version) {
 
 ${SCAFFOLD_TRAILER}: ${version}`;
 }
-async function commitUpgrade(rnessDir, message2) {
+async function commitUpgrade(rnessDir, message3) {
   const add = await run(rnessDir, ["add", "-A"]);
   if (add.code !== 0) return { kind: "refused", output: add.stderr.trim() };
   const staged = await run(rnessDir, ["diff", "--cached", "--quiet"]);
   if (staged.code === 0 && !await mergeInProgress(rnessDir))
     return { kind: "nothing" };
-  const commit = await run(rnessDir, ["commit", "-q", "-m", message2]);
+  const commit = await run(rnessDir, ["commit", "-q", "-m", message3]);
   if (commit.code !== 0)
     return {
       kind: "refused",
@@ -6442,8 +6584,8 @@ async function findScaffoldBase(rnessDir) {
   };
 }
 async function buildScaffoldCommit(rnessDir, base, files, version) {
-  const scratch = await mkdtemp(join19(tmpdir(), "rness-scaffold-"));
-  const env = { GIT_INDEX_FILE: join19(scratch, "index") };
+  const scratch = await mkdtemp(join20(tmpdir(), "rness-scaffold-"));
+  const env = { GIT_INDEX_FILE: join20(scratch, "index") };
   try {
     await must(
       rnessDir,
@@ -6451,7 +6593,7 @@ async function buildScaffoldCommit(rnessDir, base, files, version) {
       env
     );
     for (const [i, file] of files.entries()) {
-      const tmp = join19(scratch, `blob-${i}`);
+      const tmp = join20(scratch, `blob-${i}`);
       await writeFile3(tmp, file.content, "utf8");
       const blob = await must(rnessDir, [
         "hash-object",
@@ -6563,11 +6705,11 @@ async function insideWorkspace(dir) {
 }
 async function targetProblem(cwd, root, pm) {
   const shown = relative2(cwd, root) || ".";
-  if (await insideWorkspace(cwd) || await insideWorkspace(dirname8(root)))
+  if (await insideWorkspace(cwd) || await insideWorkspace(dirname9(root)))
     return "already inside an rness workspace; create runs from outside one";
   if (!await exists(root)) return null;
-  if (await exists(join20(root, ".rness", "rness.json"))) {
-    if (!await exists(join20(root, ".rness", "node_modules")))
+  if (await exists(join21(root, ".rness", "rness.json"))) {
+    if (!await exists(join21(root, ".rness", "node_modules")))
       return `${shown} holds an rness workspace whose dependencies are not installed; cd ${shown}/.rness && ${pm} install, then ${rnessCommand()} sync`;
     return `${shown} already holds an rness workspace (.rness/); run ${rnessCommand()} add inside it to add repositories`;
   }
@@ -6590,7 +6732,7 @@ async function installContext(input) {
 }
 async function buildContext(input) {
   const { ui, root, shown, pm } = input;
-  const rnessDir = join20(root, ".rness");
+  const rnessDir = join21(root, ".rness");
   const pmVersion = await packageManagerVersion(pm);
   await mkdir4(root, { recursive: true });
   try {
@@ -6662,7 +6804,7 @@ async function syncBlocks(ui, root, shown, inPlace, sshWorks) {
 
 // src/commands/create-blank.ts
 import { mkdir as mkdir5 } from "fs/promises";
-import { join as join21, relative as relative3, resolve as resolve4 } from "path";
+import { join as join22, relative as relative3, resolve as resolve4 } from "path";
 var WORKSPACE_NAME = /^(?!\.{1,2}$)[A-Za-z0-9._][A-Za-z0-9._-]*$/;
 function workspaceNameError(name) {
   return `workspace name "${name}" may only contain letters, digits, '.', '_' and '-', not starting with '-'`;
@@ -6744,8 +6886,8 @@ async function createBlank(input) {
     kind: "blank workspace"
   });
   if (!built) return 1;
-  await mkdir5(join21(root, "org"), { recursive: true });
-  await commitContext({ ui, rnessDir: join21(root, ".rness"), shown });
+  await mkdir5(join22(root, "org"), { recursive: true });
+  await commitContext({ ui, rnessDir: join22(root, ".rness"), shown });
   const code = await syncBlocks(
     ui,
     root,
@@ -6804,7 +6946,7 @@ async function pickRepositories(input) {
       // list below it must agree (spec 0009).
       (l) => [
         "listed",
-        `${l.repositories.filter(isMemberRepo).length} repositories of ${org}`
+        `${count(l.repositories.filter(isMemberRepo).length, ["repository", "repositories"])} of ${org}`
       ]
     );
     listed = listing.repositories;
@@ -6889,7 +7031,7 @@ async function cloneSelection(input) {
           { doing: `cloning  org/${repo}`, git: true },
           () => clone(
             entry.url,
-            join22(input.root, "org", repo),
+            join23(input.root, "org", repo),
             input.provider.credentialsFor(entry.url)
           ),
           () => ["cloned", `org/${repo}`]
@@ -6914,9 +7056,9 @@ async function cloneSelection(input) {
       manifest = result.manifest;
       ui.line("declared", `scope ${result.name} (org/${result.name})`);
     } catch (e) {
-      const message2 = firstLine5(e instanceof Error ? e.message : String(e));
-      ui.error(`${spec}: ${message2}`);
-      failures.push({ spec, message: message2 });
+      const message3 = firstLine5(e instanceof Error ? e.message : String(e));
+      ui.error(`${spec}: ${message3}`);
+      failures.push({ spec, message: message3 });
     }
   }
   return failures;
@@ -7085,6 +7227,7 @@ async function createCommand(opts, deps = {}) {
         () => ui.line(...CHECKING)
       );
       if (sshTest.unattended) ui.gitIsSilent = true;
+      else if (sshTest.access.ok) ui.hint(passphraseHint(), "stderr");
     }
     return sshTest.access;
   };
@@ -7094,12 +7237,12 @@ async function createCommand(opts, deps = {}) {
     if (opts.host !== void 0) return opts.host;
     if (opts.ssh === true) return transport.hosts.ssh;
     if (opts.https === true) return transport.hosts.https;
-    const access3 = await testSsh();
-    const github = access3.ok ? null : await getProvider();
+    const access2 = await testSsh();
+    const github = access2.ok ? null : await getProvider();
     const login = github?.authenticated ? (await github.identity())?.login : void 0;
-    ui.line("using", usingRest(access3, login), usingSentence(access3, login));
-    if (!access3.ok) ui.gitIsSilent = true;
-    return access3.ok ? transport.hosts.ssh : transport.hosts.https;
+    ui.line("using", usingRest(access2, login), usingSentence(access2, login));
+    if (!access2.ok) ui.gitIsSilent = true;
+    return access2.ok ? transport.hosts.ssh : transport.hosts.https;
   };
   let loaded;
   const prompts = async () => loaded ??= await terminal.prompts();
@@ -7251,8 +7394,8 @@ async function createCommand(opts, deps = {}) {
       scopes: {}
     };
     const staged = async () => {
-      staging ??= await mkdtemp2(join22(tmpdir2(), "rness-join-"));
-      return join22(staging, ".rness");
+      staging ??= await mkdtemp2(join23(tmpdir2(), "rness-join-"));
+      return join23(staging, ".rness");
     };
     if (joining) {
       const stagedDir = await staged();
@@ -7273,10 +7416,10 @@ async function createCommand(opts, deps = {}) {
         (r) => isSshUrl(r.url, transport.hosts)
       );
       if (overSsh && opts.ssh !== true && opts.host === void 0) {
-        const access3 = await testSsh();
-        if (!access3.ok) {
+        const access2 = await testSsh();
+        if (!access2.ok) {
           process.stderr.write(
-            `${[...sshWorkspaceLines(access3.reason), ...INSTEAD_OF_LINES].join("\n")}
+            `${[...sshWorkspaceLines(access2.reason), ...INSTEAD_OF_LINES].join("\n")}
 `
           );
           return 1;
@@ -7314,7 +7457,7 @@ async function createCommand(opts, deps = {}) {
       });
       if (p.isCancel(ok) || ok !== true) return cancelled(ui);
     }
-    const rnessDir = join22(root, ".rness");
+    const rnessDir = join23(root, ".rness");
     const install = () => installContext({ ui, pm, rnessDir, skip: opts.skipInstall === true });
     if (joining) {
       await mkdir6(root, { recursive: true });
@@ -7327,7 +7470,7 @@ async function createCommand(opts, deps = {}) {
       ui.line("cloned", `${shown}/.rness (joined ${org})`);
       if (opts.pm === void 0) pm = await workspacePackageManager(rnessDir);
       await install();
-      await mkdir6(join22(root, "org"), { recursive: true });
+      await mkdir6(join23(root, "org"), { recursive: true });
       const failures2 = await cloneSelection({
         root,
         rnessDir,
@@ -7380,7 +7523,7 @@ ${next2.map((l) => `  ${l}`).join("\n")}
       kind: "new workspace"
     });
     if (!built) return 1;
-    await mkdir6(join22(root, "org"), { recursive: true });
+    await mkdir6(join23(root, "org"), { recursive: true });
     const failures = await cloneSelection({
       root,
       rnessDir,
@@ -7452,7 +7595,7 @@ ${next2.map((l) => `  ${l}`).join("\n")}
 }
 
 // src/core/blocks.ts
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var PROBLEM = /* @__PURE__ */ new Set(["stale", "malformed"]);
 async function checkBlocks({
   root,
@@ -7461,15 +7604,15 @@ async function checkBlocks({
   org
 }) {
   const checks = [];
-  const note = (label, status2, message2 = null) => {
-    checks.push({ label, status: status2, message: message2 });
+  const note = (label, status2, message3 = null) => {
+    checks.push({ label, status: status2, message: message3 });
   };
   const derive = () => ({
     problems: checks.filter((c) => PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
     warnings: checks.filter((c) => !PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
     checks
   });
-  if (!await exists(join23(root, "org"))) return derive();
+  if (!await exists(join24(root, "org"))) return derive();
   const targets = [
     { scope: null, dir: root, depth: 0, file: "AGENTS.md", label: "AGENTS.md" },
     { scope: null, dir: root, depth: 0, file: "CLAUDE.md", label: "CLAUDE.md" }
@@ -7478,7 +7621,7 @@ async function checkBlocks({
     const segments = entry.path.split("/");
     targets.push({
       scope: name,
-      dir: join23(root, ...segments),
+      dir: join24(root, ...segments),
       depth: segments.length,
       file: "AGENTS.md",
       label: `${entry.path}/AGENTS.md`
@@ -7493,7 +7636,7 @@ async function checkBlocks({
       );
       continue;
     }
-    const text = await readOrNull(join23(t.dir, t.file));
+    const text = await readOrNull(join24(t.dir, t.file));
     const lines = text === null ? [] : text.split(/\r?\n/);
     const found = findBlock(lines);
     if (found.kind === "none") {
@@ -7564,7 +7707,7 @@ async function logoutCommand() {
 import { execFile as execFile6 } from "child_process";
 import { mkdtemp as mkdtemp3, readFile as readFile10, rm as rm8 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename5, join as join24, relative as relative5 } from "path";
+import { basename as basename5, join as join25, relative as relative5 } from "path";
 import { promisify as promisify6 } from "util";
 var execFileP6 = promisify6(execFile6);
 var NOTES = "https://github.com/rness-dev/rness/tree/main/packages/cli#readme";
@@ -7584,10 +7727,10 @@ async function latestVersion() {
 async function scaffoldFor(version, rnessDir) {
   if (version === VERSION) return { dir: scaffoldDir() };
   const installed = await readPinnedCli(rnessDir);
-  const inside2 = installed === null ? null : join24(installed.dir, "scaffold");
-  if (installed?.version === version && inside2 !== null && await exists(join24(inside2, "package.json")))
+  const inside2 = installed === null ? null : join25(installed.dir, "scaffold");
+  if (installed?.version === version && inside2 !== null && await exists(join25(inside2, "package.json")))
     return { dir: inside2 };
-  const scratch = await mkdtemp3(join24(tmpdir3(), "rness-pack-"));
+  const scratch = await mkdtemp3(join25(tmpdir3(), "rness-pack-"));
   const cleanup = () => rm8(scratch, { recursive: true, force: true });
   try {
     const { stdout } = await execFileP6(
@@ -7602,8 +7745,8 @@ async function scaffoldFor(version, rnessDir) {
       { timeout: 6e4 }
     );
     const tarball = stdout.trim().split("\n").at(-1) ?? "";
-    await execFileP6("tar", ["-xzf", join24(scratch, tarball), "-C", scratch]);
-    return { dir: join24(scratch, "package", "scaffold"), cleanup };
+    await execFileP6("tar", ["-xzf", join25(scratch, tarball), "-C", scratch]);
+    return { dir: join25(scratch, "package", "scaffold"), cleanup };
   } catch (e) {
     await cleanup();
     throw new Error(
@@ -7615,7 +7758,7 @@ async function scaffoldFor(version, rnessDir) {
 async function declaredManager(rnessDir, pm) {
   try {
     const pkg = JSON.parse(
-      await readFile10(join24(rnessDir, "package.json"), "utf8")
+      await readFile10(join25(rnessDir, "package.json"), "utf8")
     );
     if (typeof pkg.packageManager === "string") return pkg.packageManager;
   } catch {
@@ -7625,7 +7768,7 @@ async function declaredManager(rnessDir, pm) {
 async function clonesToCommit(root, cwd, manifest, files) {
   const clones = [];
   for (const repo of Object.keys(manifest.repos)) {
-    const dir = join24(root, "org", repo);
+    const dir = join25(root, "org", repo);
     if (!await exists(dir)) continue;
     try {
       const paths = await changedPaths(dir, files);
@@ -7643,7 +7786,7 @@ async function filesTheSyncWrites(root, rnessDir, manifest) {
   try {
     const { stdout } = await execFileP6(
       process.execPath,
-      [join24(pinned.dir, pinned.bin), "written-files", "--cwd", root],
+      [join25(pinned.dir, pinned.bin), "written-files", "--cwd", root],
       {
         cwd: root,
         env: { ...process.env, NO_COLOR: "1", RNESS_NO_INSTALL: "1" },
@@ -7659,14 +7802,14 @@ async function filesTheSyncWrites(root, rnessDir, manifest) {
 }
 function finish(ui, cwd, rnessDir, label, target2, ending) {
   const rel = relative5(cwd, rnessDir) || ".";
-  const message2 = `chore: rness ${target2}`;
+  const message3 = `chore: rness ${target2}`;
   const next = [];
   if (ending.commit === "committed") next.push(`git -C ${rel} push`);
   if (ending.commit === "refused")
-    next.push(`git -C ${rel} commit -m "${message2}"`);
+    next.push(`git -C ${rel} commit -m "${message3}"`);
   for (const c of ending.clones)
     next.push(
-      `git -C ${c.dir} add ${c.paths.join(" ")} && git -C ${c.dir} commit -m "${message2}"`
+      `git -C ${c.dir} add ${c.paths.join(" ")} && git -C ${c.dir} commit -m "${message3}"`
     );
   if (ending.commit !== "nothing")
     next.push("# teammates: git pull \u2014 the next rness command installs it");
@@ -7839,7 +7982,7 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
         await source.cleanup?.();
       }
     }
-    const packageFile = join24(ws.rnessDir, "package.json");
+    const packageFile = join25(ws.rnessDir, "package.json");
     const restore = /* @__PURE__ */ new Map([
       [packageFile, await readFile10(packageFile, "utf8")]
     ]);
@@ -7855,8 +7998,8 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
           () => ["installed", `dependencies with ${pm}`]
         );
       } catch (e) {
-        const message3 = e instanceof Error ? e.message : String(e);
-        ui.error(message3);
+        const message4 = e instanceof Error ? e.message : String(e);
+        ui.error(message4);
         if (!merged) {
           for (const [file, text] of restore) await writeFileAtomic(file, text);
           ui.hint(
@@ -7869,7 +8012,7 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
             `the scaffold merge is still staged; undo it with: git -C ${relative5(cwd, ws.rnessDir) || "."} merge --abort`,
             "stderr"
           );
-        if (/minimum.?release.?age|NO_MATURE/i.test(message3))
+        if (/minimum.?release.?age|NO_MATURE/i.test(message4))
           ui.hint(
             "pnpm refuses versions published less than 24 h ago: add '@rness/cli' under minimumReleaseAgeExclude in .rness/pnpm-workspace.yaml",
             "stderr"
@@ -7888,13 +8031,13 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
     ui.gitIsSilent = true;
     const code = await syncBlocks(ui, ws.root, basename5(ws.root));
     if (code !== 0) return code;
-    const message2 = `chore: rness ${target2}`;
-    const committed = await commitUpgrade(ws.rnessDir, message2);
+    const message3 = `chore: rness ${target2}`;
+    const committed = await commitUpgrade(ws.rnessDir, message3);
     if (committed.kind === "committed")
       ui.line(
         "committed",
-        `${label} \u2014 ${message2}`,
-        `Committed ${label}: ${message2}`
+        `${label} \u2014 ${message3}`,
+        `Committed ${label}: ${message3}`
       );
     if (committed.kind === "refused") {
       ui.error(
@@ -8008,8 +8151,8 @@ async function validateCommand(opts, deps = {}) {
 import { Command, CommanderError, Option } from "commander";
 
 // src/commands/doc.ts
-import { access as access2, mkdir as mkdir7, readFile as readFile11, writeFile as writeFile4 } from "fs/promises";
-import { join as join25 } from "path";
+import { mkdir as mkdir7, readFile as readFile11, writeFile as writeFile4 } from "fs/promises";
+import { join as join26 } from "path";
 var NUMBERED = Object.keys(STATUSES);
 var SECTIONS = {
   specs: [
@@ -8033,8 +8176,8 @@ function headingsOf(template) {
   return [...template.matchAll(/^## (.+)$/gm)].map((m) => (m[1] ?? "").trim());
 }
 async function adrSections(rnessDir) {
-  const own = join25(rnessDir, "adr", "0000-template.md");
-  const shipped = join25(scaffoldDir(), "adr", "0000-template.md");
+  const own = join26(rnessDir, "adr", "0000-template.md");
+  const shipped = join26(scaffoldDir(), "adr", "0000-template.md");
   for (const file of [own, shipped]) {
     try {
       const sections = headingsOf(await readFile11(file, "utf8"));
@@ -8044,6 +8187,19 @@ async function adrSections(rnessDir) {
   }
   return ["Context", "Decision", "Alternatives Considered", "Consequences"];
 }
+async function writeDocument(file, text) {
+  try {
+    await writeFile4(file, text, { flag: "wx" });
+  } catch (e) {
+    if (e.code !== "EEXIST") throw e;
+    process.stderr.write(`${file} exists; nothing written
+`);
+    return 1;
+  }
+  process.stdout.write(`${file}
+`);
+  return 0;
+}
 async function docNewCommand(collection, opts) {
   if (!NUMBERED.includes(collection)) {
     process.stderr.write(
@@ -8055,7 +8211,7 @@ async function docNewCommand(collection, opts) {
   const name = collection;
   try {
     const ws = await findWorkspace(opts.cwd ?? process.cwd());
-    const dir = join25(ws.rnessDir, name);
+    const dir = join26(ws.rnessDir, name);
     await mkdir7(dir, { recursive: true });
     let highest = 0;
     for (const item of await collectMarkdown(dir)) {
@@ -8064,7 +8220,7 @@ async function docNewCommand(collection, opts) {
     }
     const number = String(highest + 1).padStart(4, "0");
     const title = opts.title?.trim() || "Untitled";
-    const file = join25(dir, `${number}-${slugOf(title)}.md`);
+    const file = join26(dir, `${number}-${slugOf(title)}.md`);
     const status2 = STATUSES[name]?.[0] ?? "Draft";
     const date = today();
     const front = [
@@ -8083,20 +8239,8 @@ async function docNewCommand(collection, opts) {
       ...name === "plans" ? [] : ["", "---"],
       ...sections.flatMap((s) => ["", `## ${s}`])
     ];
-    try {
-      await access2(file);
-      process.stderr.write(`${file} exists; nothing written
-`);
-      return 1;
-    } catch {
-    }
-    await writeFile4(file, `${[...front, "", ...body].join("\n")}
-`, {
-      flag: "wx"
-    });
-    process.stdout.write(`${file}
+    return await writeDocument(file, `${[...front, "", ...body].join("\n")}
 `);
-    return 0;
   } catch (e) {
     return reportError(e);
   }
@@ -8129,9 +8273,243 @@ password=${resolved.token}
 import { realpath as realpath4 } from "fs/promises";
 import { isAbsolute as isAbsolute2, posix as posix8, relative as relative7, resolve as resolve7, sep as sep5 } from "path";
 
+// src/core/claude-code.ts
+import { mkdir as mkdir8, readFile as readFile12 } from "fs/promises";
+import { join as join27 } from "path";
+var MOD_FLOOR = "2.1.280";
+var AGENT = /^claude-code_(\d+)-(\d+)-(\d+)_[a-z]+$/;
+function claudeCodeVersion(env) {
+  const m = AGENT.exec(env["AI_AGENT"] ?? "");
+  return m === null ? null : `${m[1]}.${m[2]}.${m[3]}`;
+}
+function belowModFloor(version) {
+  const have = version.split(".").map(Number);
+  const floor = MOD_FLOOR.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    const a = have[i] ?? 0;
+    const b = floor[i] ?? 0;
+    if (a !== b) return a < b;
+  }
+  return false;
+}
+var noticeFile = () => join27(configDir(), "claude-code.json");
+async function shownVersions() {
+  try {
+    const data = JSON.parse(await readFile12(noticeFile(), "utf8"));
+    const shown = data !== null && typeof data === "object" ? data["modNoticeShown"] : void 0;
+    return Array.isArray(shown) ? shown.filter((v) => typeof v === "string") : [];
+  } catch {
+    return [];
+  }
+}
+async function takeModNotice(env) {
+  const version = claudeCodeVersion(env);
+  if (version === null || !belowModFloor(version)) return null;
+  if ((env["CLAUDE_CODE_ENTRYPOINT"] ?? "").startsWith("sdk-")) return null;
+  const shown = await shownVersions();
+  if (shown.includes(version)) return null;
+  try {
+    await mkdir8(configDir(), { recursive: true, mode: 448 });
+    await writeFileAtomic(
+      noticeFile(),
+      `${JSON.stringify({ modNoticeShown: [...shown, version] })}
+`
+    );
+  } catch {
+  }
+  return `rness: Claude Code ${version} shows no rness band, status line or pane; ${MOD_FLOOR} or later does \u2014 claude update`;
+}
+
+// src/core/edit-guard.ts
+function occurrences(text, needle) {
+  const spans = [];
+  for (let i = text.indexOf(needle); i !== -1; i = text.indexOf(needle, i + needle.length))
+    spans.push([i, i + needle.length]);
+  return spans;
+}
+var QUOTES = {
+  "\u2018": "'",
+  "\u2019": "'",
+  "\u201C": '"',
+  "\u201D": '"'
+};
+function loose(text) {
+  let out = "";
+  const at = [];
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i] ?? "";
+    if (c === "\r" && text[i + 1] === "\n") continue;
+    out += QUOTES[c] ?? c;
+    at.push(i);
+  }
+  at.push(text.length);
+  return { text: out, at };
+}
+function replayEdit(text, oldString, newString, all) {
+  if (oldString === "") return null;
+  let spans = occurrences(text, oldString);
+  if (spans.length === 0) {
+    const file = loose(text);
+    spans = occurrences(file.text, loose(oldString).text).map(
+      ([s, e]) => [file.at[s] ?? 0, (file.at[e - 1] ?? 0) + 1]
+    );
+  }
+  if (spans.length === 0 || !all && spans.length !== 1) return null;
+  let after = text;
+  for (const [s, e] of [...spans].reverse())
+    after = `${after.slice(0, s)}${newString}${after.slice(e)}`;
+  return { after, spans };
+}
+var OWNED = /(?:^|\/)\.claude\/skills\/rness\//;
+var ownedWhole = (rel) => OWNED.test(rel);
+function ownedRefusal(label) {
+  return `rness: ${label} is written whole by rness sync, and the next sync overwrites it. Leave it to rness.`;
+}
+var MARKER = /^<!-- rness: (\S+) -->$/;
+function blockOf(text) {
+  const lines = text.split(/\r?\n/);
+  const found = findBlock(lines);
+  if (found.kind !== "one") return null;
+  const starts = [0];
+  for (const m of text.matchAll(/\r?\n/g))
+    starts.push((m.index ?? 0) + m[0].length);
+  const from = starts[found.begin] ?? 0;
+  const to = (starts[found.end] ?? 0) + (lines[found.end] ?? "").length;
+  return { begin: found.begin, end: found.end, from, to, lines };
+}
+function lineAt(text, offset) {
+  return text.slice(0, offset).split(/\r?\n/).length - 1;
+}
+function sourceOf(block, line3) {
+  for (let i = Math.min(line3, block.end); i > block.begin; i--) {
+    const m = MARKER.exec((block.lines[i] ?? "").trimEnd());
+    if (m !== null) return `.rness/${m[1] ?? ""}`;
+  }
+  return ".rness/ and rness.json";
+}
+function blockRefusal(label, block, source) {
+  return `rness: lines ${block.begin + 1}\u2013${block.end + 1} of ${label} are generated by rness sync from ${source}. Edit that file, then run rness sync.`;
+}
+function editRefusal(label, before, spans) {
+  const block = blockOf(before);
+  if (block === null) return null;
+  const hit = spans.find(([s, e]) => s < block.to && e > block.from);
+  if (hit === void 0) return null;
+  return blockRefusal(
+    label,
+    block,
+    sourceOf(block, lineAt(before, Math.max(hit[0], block.from)))
+  );
+}
+function writeRefusal(label, before, after) {
+  const block = blockOf(before);
+  if (block === null) return null;
+  const kept = blockOf(after);
+  const was = before.slice(block.from, block.to);
+  if (kept !== null && after.slice(kept.from, kept.to) === was) return null;
+  const next = kept === null ? [] : kept.lines.slice(kept.begin, kept.end + 1);
+  const old = block.lines.slice(block.begin, block.end + 1);
+  const first = old.findIndex((line3, i) => line3 !== next[i]);
+  return blockRefusal(
+    label,
+    block,
+    kept === null ? ".rness/ and rness.json" : sourceOf(block, block.begin + Math.max(first, 0))
+  );
+}
+
+// src/core/safety-net.ts
+var SHOWN_PROBLEMS = 3;
+var message = (e) => e instanceof Error ? e.message : String(e);
+async function safetyNet(ws, manifest) {
+  const notes = [];
+  const drift = await pinDrift(ws.rnessDir);
+  if (drift !== null)
+    notes.push(
+      `.rness pins @rness/cli ${drift.pin} but ${drift.installed ?? "nothing"} is installed \u2014 run ${await workspacePackageManager(ws.rnessDir)} install in .rness`
+    );
+  try {
+    const { problems } = await checkWorkspace(ws, manifest);
+    if (problems.length > 0)
+      notes.push(
+        `${count(problems.length, ["problem", "problems"])} in the workspace context \u2014 run rness validate`,
+        ...problems.slice(0, SHOWN_PROBLEMS).map((p) => `  ${p}`)
+      );
+  } catch (e) {
+    notes.push(message(e));
+  }
+  return notes;
+}
+
+// src/pulse/detached.ts
+import { spawn as nodeSpawn } from "child_process";
+import { mkdir as mkdir9, open as open2, readFile as readFile13, rm as rm9, stat as stat4, writeFile as writeFile5 } from "fs/promises";
+import { join as join28 } from "path";
+import { setTimeout as delay2 } from "timers/promises";
+var detached = (args, cwd) => {
+  const bin = process.argv[1];
+  if (bin === void 0) return;
+  const child = nodeSpawn(process.execPath, [bin, ...args], {
+    detached: true,
+    stdio: "ignore",
+    cwd,
+    env: { ...process.env, RNESS_NO_DELEGATE: "1" }
+  });
+  child.on("error", () => void 0);
+  child.unref();
+};
+var failureFile = () => join28(configDir(), "pulse.json");
+async function recordFailure(reason3) {
+  try {
+    await mkdir9(configDir(), { recursive: true, mode: 448 });
+    await writeFile5(
+      failureFile(),
+      `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), reason: reason3 })}
+`
+    );
+  } catch {
+  }
+}
+async function takeFailure() {
+  try {
+    const data = JSON.parse(await readFile13(failureFile(), "utf8"));
+    await rm9(failureFile(), { force: true });
+    const reason3 = data !== null && typeof data === "object" ? data["reason"] : void 0;
+    return typeof reason3 === "string" && reason3 !== "" ? reason3 : null;
+  } catch {
+    return null;
+  }
+}
+var PULSE_LOCK_STALE_MS = 15 * 6e4;
+async function oneSyncAtATime(key, work, options = {}) {
+  await mkdir9(configDir(), { recursive: true, mode: 448 });
+  const file = join28(configDir(), `pulse-${key}.lock`);
+  for (; ; ) {
+    try {
+      const handle = await open2(file, "wx");
+      await handle.close();
+      break;
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+      const age = await stat4(file).then(
+        (s) => Date.now() - s.mtimeMs,
+        () => 0
+      );
+      if (age > PULSE_LOCK_STALE_MS) await rm9(file, { force: true });
+      else if (options.wait !== true) return false;
+      else await (options.sleep ?? ((ms) => delay2(ms)))(1e3);
+    }
+  }
+  try {
+    await work();
+    return true;
+  } finally {
+    await rm9(file, { force: true });
+  }
+}
+
 // src/mcp/tools.ts
-import { readFile as readFile12, realpath as realpath3, stat as stat4 } from "fs/promises";
-import { isAbsolute, join as join26, posix as posix7, relative as relative6, resolve as resolve6, sep as sep4 } from "path";
+import { readFile as readFile14, realpath as realpath3, stat as stat5 } from "fs/promises";
+import { isAbsolute, join as join29, posix as posix7, relative as relative6, resolve as resolve6, sep as sep4 } from "path";
 var LABELS = {
   standards: "Standards",
   adr: "Decisions",
@@ -8160,7 +8538,7 @@ async function documents(rnessDir, only) {
   const docs = [];
   for (const collection of COLLECTIONS) {
     if (only !== void 0 && collection !== only) continue;
-    for (const item of await collectMarkdown(join26(rnessDir, collection))) {
+    for (const item of await collectMarkdown(join29(rnessDir, collection))) {
       const path = `${collection}/${item.rel}`;
       if (path === TEMPLATE2) continue;
       const status2 = item.fields?.["status"];
@@ -8276,13 +8654,13 @@ async function read(cwd, args) {
   }
   if (!real.startsWith(`${root}${sep4}`))
     return refuse(`${path}: leads outside .rness/`);
-  const info = await stat4(real);
+  const info = await stat5(real);
   if (!info.isFile()) return refuse(`${path}: not a file`);
   if (info.size > READ_LIMIT)
     return refuse(
       `${path}: ${info.size} bytes, over the 256 KiB rness_read returns`
     );
-  return { text: await readFile12(real, "utf8") };
+  return { text: await readFile14(real, "utf8") };
 }
 async function search(cwd, args) {
   const { ws } = await workspaceAt(cwd);
@@ -8388,74 +8766,7 @@ function mcpTools(cwd) {
   ];
 }
 
-// src/pulse/detached.ts
-import { spawn as nodeSpawn } from "child_process";
-import { mkdir as mkdir8, open as open2, readFile as readFile13, rm as rm9, stat as stat5, writeFile as writeFile5 } from "fs/promises";
-import { join as join27 } from "path";
-import { setTimeout as delay2 } from "timers/promises";
-var detached = (args, cwd) => {
-  const bin = process.argv[1];
-  if (bin === void 0) return;
-  const child = nodeSpawn(process.execPath, [bin, ...args], {
-    detached: true,
-    stdio: "ignore",
-    cwd,
-    env: { ...process.env, RNESS_NO_DELEGATE: "1" }
-  });
-  child.on("error", () => void 0);
-  child.unref();
-};
-var failureFile = () => join27(configDir(), "pulse.json");
-async function recordFailure(reason3) {
-  try {
-    await mkdir8(configDir(), { recursive: true, mode: 448 });
-    await writeFile5(
-      failureFile(),
-      `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), reason: reason3 })}
-`
-    );
-  } catch {
-  }
-}
-async function takeFailure() {
-  try {
-    const data = JSON.parse(await readFile13(failureFile(), "utf8"));
-    await rm9(failureFile(), { force: true });
-    const reason3 = data !== null && typeof data === "object" ? data["reason"] : void 0;
-    return typeof reason3 === "string" && reason3 !== "" ? reason3 : null;
-  } catch {
-    return null;
-  }
-}
-var PULSE_LOCK_STALE_MS = 15 * 6e4;
-async function oneSyncAtATime(key, work, options = {}) {
-  await mkdir8(configDir(), { recursive: true, mode: 448 });
-  const file = join27(configDir(), `pulse-${key}.lock`);
-  for (; ; ) {
-    try {
-      const handle = await open2(file, "wx");
-      await handle.close();
-      break;
-    } catch (e) {
-      if (e.code !== "EEXIST") throw e;
-      const age = await stat5(file).then(
-        (s) => Date.now() - s.mtimeMs,
-        () => 0
-      );
-      if (age > PULSE_LOCK_STALE_MS) await rm9(file, { force: true });
-      else if (options.wait !== true) return false;
-      else await (options.sleep ?? ((ms) => delay2(ms)))(1e3);
-    }
-  }
-  try {
-    await work();
-    return true;
-  } finally {
-    await rm9(file, { force: true });
-  }
-}
-
-// src/commands/hook.ts
+// src/commands/snapshot.ts
 var NOUNS = {
   standards: ["standard", "standards"],
   adr: ["decision", "decisions"],
@@ -8463,7 +8774,37 @@ var NOUNS = {
   plans: ["plan", "plans"],
   skills: ["skill", "skills"]
 };
-var SHOWN_PROBLEMS = 3;
+async function scopeBanner(ws, manifest, scope) {
+  const summary = await scopeSummary(ws, manifest, scope);
+  const counts = COLLECTIONS.flatMap((c) => {
+    const n = summary.counts[c];
+    return n === void 0 ? [] : [count(n, NOUNS[c])];
+  });
+  const banner2 = `rness ${VERSION} \xB7 ${workspaceName(manifest, ws.root)} \xB7 ${scope === null ? "global scope" : `scope ${scope}`} \u2014 ${counts.length === 0 ? "nothing applies yet" : counts.join(", ")}`;
+  return { banner: banner2, lines: summary.lines };
+}
+var noteLines = (notes) => notes.map((n) => `rness: ${n}`);
+function statusLine(scope, inProgress, notes) {
+  const acting = notes.filter((n) => !n.startsWith(" ")).length;
+  return `${scope ?? "global"} \xB7 ${inProgress.length} in progress${acting > 0 ? ` \xB7 \u26A0 ${acting}` : ""}`;
+}
+async function statusSnapshot(ws, manifest, scope, tabs) {
+  const { banner: banner2 } = await scopeBanner(ws, manifest, scope);
+  const inProgress = await plansInProgress(ws, manifest, scope);
+  const notes = await safetyNet(ws, manifest);
+  return {
+    version: VERSION,
+    workspace: workspaceName(manifest, ws.root),
+    scope,
+    banner: banner2,
+    statusLine: statusLine(scope, inProgress, notes),
+    inProgress,
+    notes: noteLines(notes),
+    tabs
+  };
+}
+
+// src/commands/hook.ts
 async function readInput(input) {
   if (input.isTTY === true) return {};
   let text = "";
@@ -8475,35 +8816,13 @@ async function readInput(input) {
     return {};
   }
 }
-var message = (e) => e instanceof Error ? e.message : String(e);
+var message2 = (e) => e instanceof Error ? e.message : String(e);
 function cwdOf(input, env) {
   const cwd = input["cwd"];
   if (typeof cwd === "string" && cwd !== "") return cwd;
   return env["CLAUDE_PROJECT_DIR"] ?? process.cwd();
 }
 var toPosix2 = (p) => p.split(sep5).join(posix8.sep);
-function count(n, [one, many]) {
-  return `${n} ${n === 1 ? one : many}`;
-}
-async function safetyNet(ws, manifest) {
-  const notes = [];
-  const drift = await pinDrift(ws.rnessDir);
-  if (drift !== null)
-    notes.push(
-      `.rness pins @rness/cli ${drift.pin} but ${drift.installed ?? "nothing"} is installed \u2014 run ${await workspacePackageManager(ws.rnessDir)} install in .rness`
-    );
-  try {
-    const { problems } = await checkWorkspace(ws, manifest);
-    if (problems.length > 0)
-      notes.push(
-        `${count(problems.length, ["problem", "problems"])} in the workspace context \u2014 run rness validate`,
-        ...problems.slice(0, SHOWN_PROBLEMS).map((p) => `  ${p}`)
-      );
-  } catch (e) {
-    notes.push(message(e));
-  }
-  return notes;
-}
 function sessionOf(input) {
   const id = input["session_id"];
   if (typeof id !== "string" || id === "") return null;
@@ -8531,21 +8850,6 @@ async function markDetached(ws, input, io, rest) {
   } catch {
   }
 }
-async function plansInProgress(ws, manifest, scope) {
-  const context3 = await assembleContext({
-    rnessDir: ws.rnessDir,
-    manifest,
-    scope
-  });
-  const plans = context3.collections.find((c) => c.name === "plans");
-  return (plans?.files ?? []).filter((f) => {
-    try {
-      return parseFrontMatter(f.body)?.["status"] === "In progress";
-    } catch {
-      return false;
-    }
-  }).map((f) => `plans/${f.rel}`);
-}
 async function sessionStart(input, io) {
   const cwd = cwdOf(input, io.env);
   let banner2 = null;
@@ -8555,15 +8859,11 @@ async function sessionStart(input, io) {
     const ws = await findWorkspace(cwd);
     const manifest = await loadManifest(ws.rnessDir);
     const scope = resolveScope(manifest, toPosix2(relative7(ws.root, cwd)));
-    const summary = await scopeSummary(ws, manifest, scope);
-    const counts = COLLECTIONS.flatMap((c) => {
-      const n = summary.counts[c];
-      return n === void 0 ? [] : [count(n, NOUNS[c])];
-    });
-    banner2 = `rness ${VERSION} \xB7 ${workspaceName(manifest, ws.root)} \xB7 ${scope === null ? "global scope" : `scope ${scope}`} \u2014 ${counts.length === 0 ? "nothing applies yet" : counts.join(", ")}`;
+    const view = await scopeBanner(ws, manifest, scope);
+    banner2 = view.banner;
     const at = toPosix2(relative7(cwd, ws.rnessDir)) || ".rness";
     context3 = [
-      ...summary.lines,
+      ...view.lines,
       `These documents are in ${at}: read one there, or with rness_read when the rness MCP server is connected.`
     ];
     notes = await safetyNet(ws, manifest);
@@ -8575,14 +8875,17 @@ async function sessionStart(input, io) {
       (session) => paths.length === 0 ? null : ["--session", session, ...paths.flatMap((p) => ["--path", p])]
     );
   } catch (e) {
-    notes = [message(e)];
+    notes = [message2(e)];
   }
   const failure = await takeFailure();
   if (failure !== null) notes.push(`pulse not updated \u2014 ${failure}`);
-  const warnings = notes.map((n) => `rness: ${n}`);
+  const warnings = noteLines(notes);
+  const compact = input["source"] === "compact";
+  const tooOld = compact ? null : await takeModNotice(io.env);
   const shown = [
-    ...banner2 !== null && input["source"] !== "compact" ? [banner2] : [],
-    ...warnings
+    ...banner2 !== null && !compact ? [banner2] : [],
+    ...warnings,
+    ...tooOld !== null ? [tooOld] : []
   ];
   return {
     ...shown.length > 0 ? { systemMessage: shown.join("\n") } : {},
@@ -8607,11 +8910,7 @@ async function postToolUse(input, io) {
   } catch {
     return 0;
   }
-  const file = resolve7(cwd, path);
-  const rel = inside(ws.rnessDir, file) ?? inside(
-    await realpath4(ws.rnessDir).catch(() => ws.rnessDir),
-    await realpath4(file).catch(() => file)
-  );
+  const rel = await within(ws.rnessDir, resolve7(cwd, path));
   if (rel === null) return 0;
   const first = rel.split("/")[0] ?? "";
   let problems = [];
@@ -8620,7 +8919,7 @@ async function postToolUse(input, io) {
       const manifest = await loadManifest(ws.rnessDir);
       for (const s of Object.keys(manifest.scopes)) scopeChain(manifest, s);
     } catch (e) {
-      problems = [message(e)];
+      problems = [message2(e)];
     }
   } else if (COLLECTIONS.includes(first) && rel.endsWith(".md"))
     problems = (await checkContract(ws.rnessDir)).filter(
@@ -8643,6 +8942,95 @@ async function postToolUse(input, io) {
   );
   return 2;
 }
+async function within(base, file) {
+  return inside(base, file) ?? inside(
+    await realpath4(base).catch(() => base),
+    await realpath4(file).catch(() => file)
+  );
+}
+function manifestProblems(text) {
+  if (text === null) return [];
+  try {
+    const manifest = parseManifest(text);
+    for (const s of Object.keys(manifest.scopes)) scopeChain(manifest, s);
+    return [];
+  } catch (e) {
+    return [message2(e)];
+  }
+}
+async function addedProblems(ws, rel, before, after) {
+  let was;
+  let will;
+  if (rel === "rness.json") {
+    was = manifestProblems(before);
+    will = manifestProblems(after);
+  } else {
+    const first = rel.split("/")[0] ?? "";
+    if (!COLLECTIONS.includes(first) || !rel.endsWith(".md"))
+      return [];
+    const mine = (p) => p.startsWith(`${rel}:`);
+    was = (await checkContract(ws.rnessDir)).filter(mine);
+    will = (await checkContract(ws.rnessDir, { rel, text: after })).filter(mine);
+  }
+  return will.filter((p) => !was.includes(p));
+}
+async function preToolUse(input, io) {
+  const toolInput = input["tool_input"];
+  if (toolInput === null || typeof toolInput !== "object") return 0;
+  const args = toolInput;
+  const path = args["file_path"];
+  if (typeof path !== "string" || path === "") return 0;
+  try {
+    const cwd = cwdOf(input, io.env);
+    const ws = await findWorkspace(cwd);
+    const file = resolve7(cwd, path);
+    const label = await within(ws.root, file);
+    if (label === null) return 0;
+    if (ownedWhole(label)) return refuse2(io, [ownedRefusal(label)]);
+    const rel = await within(ws.rnessDir, file);
+    const blocked = BLOCK_FILES.includes(posix8.basename(label));
+    if (rel === null && !blocked) return 0;
+    const before = await readOrNull(file);
+    let after;
+    let spans = null;
+    if (input["tool_name"] === "Write") {
+      const content = args["content"];
+      if (typeof content !== "string") return 0;
+      after = content;
+    } else {
+      const { old_string, new_string, replace_all } = args;
+      if (before === null || typeof old_string !== "string" || typeof new_string !== "string")
+        return 0;
+      const replayed = replayEdit(
+        before,
+        old_string,
+        new_string,
+        replace_all === true
+      );
+      if (replayed === null) return 0;
+      after = replayed.after;
+      spans = replayed.spans;
+    }
+    if (blocked && before !== null) {
+      const reason3 = spans === null ? writeRefusal(label, before, after) : editRefusal(label, before, spans);
+      if (reason3 !== null) return refuse2(io, [reason3]);
+    }
+    if (rel === null) return 0;
+    const added = await addedProblems(ws, rel, before, after);
+    if (added.length === 0) return 0;
+    return refuse2(io, [
+      ...added.map((p) => `rness: ${p}`),
+      `Fix the edit of ${rel}; rness validate checks the whole workspace.`
+    ]);
+  } catch {
+    return 0;
+  }
+}
+function refuse2(io, lines) {
+  io.error.write(`${lines.join("\n")}
+`);
+  return 2;
+}
 async function sessionEnd(input, io) {
   try {
     const ws = await findWorkspace(cwdOf(input, io.env));
@@ -8661,14 +9049,15 @@ async function hookCommand(event, io = {
   error: process.stderr,
   env: process.env
 }) {
-  if (event !== "session-start" && event !== "post-tool-use" && event !== "session-end") {
+  if (event !== "session-start" && event !== "pre-tool-use" && event !== "post-tool-use" && event !== "session-end") {
     io.error.write(
-      `unknown hook event ${JSON.stringify(event)} (known: session-start, post-tool-use, session-end)
+      `unknown hook event ${JSON.stringify(event)} (known: session-start, pre-tool-use, post-tool-use, session-end)
 `
     );
     return 1;
   }
   const input = await readInput(io.input);
+  if (event === "pre-tool-use") return preToolUse(input, io);
   if (event === "post-tool-use") return postToolUse(input, io);
   if (event === "session-end") return sessionEnd(input, io);
   io.output.write(`${JSON.stringify(await sessionStart(input, io))}
@@ -8694,31 +9083,31 @@ var SERVER_INFO_KEY = "io.modelcontextprotocol/serverInfo";
 function isObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorLine(id, code, message2, data) {
+function errorLine(id, code, message3, data) {
   return JSON.stringify({
     jsonrpc: "2.0",
     id,
-    error: data === void 0 ? { code, message: message2 } : { code, message: message2, data }
+    error: data === void 0 ? { code, message: message3 } : { code, message: message3, data }
   });
 }
 function createProtocol(opts) {
   const serverInfo = { name: opts.name, version: opts.version };
   return {
     async handle(line3) {
-      let message2;
+      let message3;
       try {
-        message2 = JSON.parse(line3);
+        message3 = JSON.parse(line3);
       } catch {
         return errorLine(null, -32700, "Parse error");
       }
-      const rawId = isObject2(message2) ? message2["id"] : void 0;
+      const rawId = isObject2(message3) ? message3["id"] : void 0;
       const id = typeof rawId === "string" || typeof rawId === "number" ? rawId : null;
-      if (!isObject2(message2) || message2["jsonrpc"] !== "2.0" || typeof message2["method"] !== "string")
+      if (!isObject2(message3) || message3["jsonrpc"] !== "2.0" || typeof message3["method"] !== "string")
         return errorLine(id, -32600, "Invalid Request");
-      if (!("id" in message2)) return null;
+      if (!("id" in message3)) return null;
       if (id === null) return errorLine(null, -32600, "Invalid Request");
-      const method = message2["method"];
-      const params = isObject2(message2["params"]) ? message2["params"] : {};
+      const method = message3["method"];
+      const params = isObject2(message3["params"]) ? message3["params"] : {};
       const meta = isObject2(params["_meta"]) ? params["_meta"] : null;
       const modern = meta !== null && typeof meta[VERSION_KEY] === "string";
       if (modern) {
@@ -8826,13 +9215,13 @@ async function mcpCommand(opts, io = {
 }
 
 // src/commands/pulse.ts
-import { readFile as readFile15, readdir as readdir5 } from "fs/promises";
-import { join as join28 } from "path";
+import { readFile as readFile16, readdir as readdir5 } from "fs/promises";
+import { join as join30 } from "path";
 import { setTimeout as delay3 } from "timers/promises";
 
 // src/pulse/opened.ts
-import { mkdir as mkdir9, readFile as readFile14, rename as rename3, rm as rm10, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname9 } from "path";
+import { mkdir as mkdir10, readFile as readFile15, rename as rename3, rm as rm10, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname10 } from "path";
 var NAME2 = "rness/opened";
 function openedFile(rnessDir) {
   return gitPath(rnessDir, NAME2);
@@ -8843,7 +9232,7 @@ async function readOpened(file) {
   if (file === null) return opened;
   let data;
   try {
-    data = JSON.parse(await readFile14(file, "utf8"));
+    data = JSON.parse(await readFile15(file, "utf8"));
   } catch {
     return opened;
   }
@@ -8862,7 +9251,7 @@ async function writeOpened(file, opened) {
       return;
     }
     const entries = [...opened].sort(([a], [b]) => a - b);
-    await mkdir9(dirname9(file), { recursive: true });
+    await mkdir10(dirname10(file), { recursive: true });
     const temporary = `${file}.${process.pid}`;
     await writeFile6(
       temporary,
@@ -8940,10 +9329,10 @@ async function directoriesOf(dir) {
   }
 }
 async function scopeOf(c, name, tabs, owners) {
-  const within = (collection) => (path) => path.startsWith(`${collection}/`);
+  const within2 = (collection) => (path) => path.startsWith(`${collection}/`);
   if (name === PULSE) {
     const shown = tabs.filter((t) => !owners.includes(t.name));
-    const elsewhere = (path) => owners.some((o) => within(o)(path));
+    const elsewhere = (path) => owners.some((o) => within2(o)(path));
     return {
       label: "Agent Pulse",
       want: desiredOf(shown, c.org),
@@ -8958,7 +9347,7 @@ async function scopeOf(c, name, tabs, owners) {
     label: labelOf(name),
     rows: []
   };
-  const dir = join28(c.rnessDir, name);
+  const dir = join30(c.rnessDir, name);
   const shape = await readShape(c.rnessDir, name);
   const fronts = new Map(
     (await collectMarkdown(dir)).map((item) => [
@@ -8976,7 +9365,7 @@ async function scopeOf(c, name, tabs, owners) {
     want,
     layout: layoutOf([tab], { shape, want }),
     elsewhere: () => false,
-    mine: within(name),
+    mine: within2(name),
     own: { shape, updates: await readUpdates(c.rnessDir, name) }
   };
 }
@@ -9004,7 +9393,7 @@ async function working(ui, doing, count3, work) {
 async function filesOf2(rnessDir) {
   const files = /* @__PURE__ */ new Set();
   const walk = async (rel) => {
-    const dir = rel === "" ? rnessDir : join28(rnessDir, ...rel.split("/"));
+    const dir = rel === "" ? rnessDir : join30(rnessDir, ...rel.split("/"));
     for (const e of await readdir5(dir, { withFileTypes: true })) {
       const path = rel === "" ? e.name : `${rel}/${e.name}`;
       if (e.isDirectory()) {
@@ -9116,7 +9505,7 @@ async function syncBoard(c, board, ui, sayLayout, scope) {
         w.path,
         issueBody({
           path: w.path,
-          text: await readFile15(join28(c.rnessDir, ...w.path.split("/")), "utf8"),
+          text: await readFile16(join30(c.rnessDir, ...w.path.split("/")), "utf8"),
           org: c.org,
           numbers,
           files
@@ -9329,6 +9718,7 @@ async function mark(opts) {
 }
 
 // src/commands/status.ts
+import { posix as posix9, relative as relative8, sep as sep6 } from "path";
 import { emitKeypressEvents } from "readline";
 
 // src/core/status-view.ts
@@ -9531,7 +9921,8 @@ function showView(tabs, workspace, start, { input, output }) {
 }
 async function statusCommand(tab, opts, terminal = { input: process.stdin, output: process.stdout }) {
   try {
-    const ws = await findWorkspace(opts.cwd ?? process.cwd());
+    const cwd = opts.cwd ?? process.cwd();
+    const ws = await findWorkspace(cwd);
     const manifest = await loadManifest(ws.rnessDir);
     const workspace = workspaceName(manifest, ws.root);
     const tabs = await statusTabs(ws.rnessDir);
@@ -9543,6 +9934,18 @@ async function statusCommand(tab, opts, terminal = { input: process.stdin, outpu
       );
       return 2;
     }
+    const shown = wanted === void 0 ? tabs : [wanted];
+    if (opts.json === true) {
+      const scope = resolveScope(
+        manifest,
+        relative8(ws.root, cwd).split(sep6).join(posix9.sep)
+      );
+      terminal.output.write(
+        `${JSON.stringify(await statusSnapshot(ws, manifest, scope, shown))}
+`
+      );
+      return 0;
+    }
     if (terminal.input.isTTY === true && terminal.output.isTTY === true) {
       await showView(
         tabs,
@@ -9552,9 +9955,7 @@ async function statusCommand(tab, opts, terminal = { input: process.stdin, outpu
       );
       return 0;
     }
-    terminal.output.write(
-      statusMarkdown(workspace, wanted === void 0 ? tabs : [wanted])
-    );
+    terminal.output.write(statusMarkdown(workspace, shown));
     return 0;
   } catch (e) {
     return reportError(e);
@@ -9605,7 +10006,7 @@ function buildProgram(state) {
   });
   program.command("status").description(
     "Show the status of every decision, specification and plan, a tab per directory"
-  ).argument("[tab]", "open on this tab: adr, specs, plans, \u2026").addOption(new Option("--cwd <dir>").hideHelp()).action(async (tab, opts) => {
+  ).argument("[tab]", "open on this tab: adr, specs, plans, \u2026").option("--json", "print JSON instead: what the Claude Code plugin draws").addOption(new Option("--cwd <dir>").hideHelp()).action(async (tab, opts) => {
     state.code = await statusCommand(tab, opts);
   });
   const doc = program.command("doc").description("Documents of the workspace: doc new <collection>");
@@ -9687,7 +10088,10 @@ function buildProgram(state) {
   program.command("written-files", { hidden: true }).addOption(new Option("--cwd <dir>").hideHelp()).action(async (opts) => {
     state.code = await writtenFilesCommand(opts);
   });
-  program.command("hook", { hidden: true }).argument("<event>", "session-start, post-tool-use or session-end").action(async (event) => {
+  program.command("hook", { hidden: true }).argument(
+    "<event>",
+    "session-start, pre-tool-use, post-tool-use or session-end"
+  ).action(async (event) => {
     state.code = await hookCommand(event);
   });
   program.command("upgrade").alias("update").description(
@@ -9876,4 +10280,4 @@ export {
   OWN_COMMANDS,
   catchUp
 };
-//# sourceMappingURL=chunk-VGBS7HDY.js.map
+//# sourceMappingURL=chunk-U5SBNWVD.js.map