@saasontools/strauss-kb 0.1.14 → 0.1.15

package/dist/{chunk-43KALLFU.js → chunk-KNIUBCZY.js}

@@ -24,16 +24,17 @@ var kbAnchorSchema = z.object({
    * (`https://github.com/org/name`) or a short name. Absent means the base's
    * own repository, which is what nearly every anchor means.
    *
-   * Unvalidated beyond not-blank: one repository has many spellings.
-   * Matched after normalisation; see ARCHITECTURE.
+   * Unvalidated beyond not-blank: one repository has many spellings, matched
+   * after normalisation. Only a full URL can be fetched from, so `validate`
+   * warns on a short one; see ARCHITECTURE.
    */
   repo: z.string().trim().min(1).optional(),
   /**
    * The git rev the evidence was taken at. Prefer a commit SHA: a branch
    * name is a moving pointer, so an anchor pinned to one says the evidence
    * came from wherever that branch happens to be now, which is not a
-   * baseline. Recorded and preserved in v1; ref-pinned reads land with
-   * SAA-709.
+   * baseline. A foreign anchor is checked at this rev, and compared against
+   * the remote's default branch on top of it.
    */
   ref: z.string().trim().min(1).optional(),
   hash: z.string().regex(/^sha256:[0-9a-f]{64}$/, {
@@ -415,12 +416,116 @@ function selectDecisions(records) {
   );
 }
 
-// src/anchor-resolver.ts
+// src/anchor-resolver/repo-identity.ts
 import { execFile } from "child_process";
-import { createHash } from "crypto";
-import { readFile, realpath, stat } from "fs/promises";
-import { isAbsolute, relative, resolve, sep } from "path";
 import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+function normalizeRepoUrl(value) {
+  let url = value.trim().replace(/^git\+/, "");
+  const scp = /^[\w.-]+@([\w.-]+):(.+)$/.exec(url);
+  if (scp) url = `https://${scp[1]}/${scp[2]}`;
+  url = url.replace(/^ssh:\/\/(?:[^@/]+@)?/, "https://");
+  url = trimTrailingSlashes(url);
+  if (url.endsWith(".git")) url = url.slice(0, -4);
+  return trimTrailingSlashes(url).toLowerCase();
+}
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
+}
+function isCanonicalRepoUrl(value) {
+  return /^[a-z0-9+.-]+:\/\//.test(normalizeRepoUrl(value));
+}
+function repoPath(normalized) {
+  const withoutScheme = normalized.replace(/^[a-z0-9+.-]+:\/\//, "");
+  const segments = withoutScheme.split("/").filter(Boolean);
+  return segments.length > 1 ? segments.slice(1).join("/") : "";
+}
+function repoIdentifies(declared, originUrl) {
+  if (!originUrl) return false;
+  const origin = normalizeRepoUrl(originUrl);
+  const want = normalizeRepoUrl(declared);
+  if (!want || !origin) return false;
+  if (want === origin) return true;
+  const path = repoPath(origin);
+  if (!path) return false;
+  return want === path || want === (path.split("/").pop() ?? "");
+}
+async function repoOriginUrl(repoRoot) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", repoRoot, "config", "--get", "remote.origin.url"],
+      { timeout: 5e3 }
+    );
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+var LazyOrigin = class {
+  constructor(repoRoot) {
+    this.repoRoot = repoRoot;
+  }
+  repoRoot;
+  url = null;
+  asked = false;
+  /** Asks git once, so later `isForeign` calls need no await. */
+  async prime() {
+    if (this.asked) return;
+    this.url = await repoOriginUrl(this.repoRoot);
+    this.asked = true;
+  }
+  /** Only meaningful after `prime`; an unprimed origin identifies nothing. */
+  isForeign(anchor) {
+    if (!anchor.repo) return false;
+    return !repoIdentifies(anchor.repo, this.url);
+  }
+  async foreign(anchor) {
+    if (!anchor.repo) return false;
+    await this.prime();
+    return this.isForeign(anchor);
+  }
+};
+
+// src/remote-repo/cache.ts
+import { homedir } from "os";
+import { join } from "path";
+function repoCacheDir(override) {
+  return override ?? process.env["STRAUSS_KB_REPO_CACHE"] ?? join(homedir(), ".strauss", "repo-cache");
+}
+var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
+function fetchTimeoutMs(override) {
+  if (override !== void 0) return override;
+  const fromEnv = Number(process.env["STRAUSS_KB_FETCH_TIMEOUT_MS"]);
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_FETCH_TIMEOUT_MS;
+}
+function cachePathFor(repo, cacheDir) {
+  const normalized = normalizeRepoUrl(repo);
+  const scheme = /^[a-z0-9+.-]+:\/\//.exec(normalized);
+  if (!scheme) return null;
+  const segments = normalized.slice(scheme[0].length).split("/").filter(Boolean).map((segment) => safeSegment(segment));
+  if (segments.length < 2 || segments.some((segment) => segment === null)) {
+    return null;
+  }
+  const path = segments;
+  return join(cacheDir, ...path.slice(0, -1), `${path[path.length - 1]}.git`);
+}
+function safeSegment(value) {
+  return value === "." || value === ".." || value.includes("\0") ? null : value.replace(/[/\\:]/g, "-");
+}
+function revRef(rev) {
+  const safe = rev.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 64);
+  let hash = 5381;
+  for (let at = 0; at < rev.length; at++) {
+    hash = (hash * 33 ^ rev.charCodeAt(at)) >>> 0;
+  }
+  return `refs/strauss/${safe}-${hash.toString(16)}`;
+}
+
+// src/remote-repo/read.ts
+import { mkdir } from "fs/promises";
 
 // src/concurrency.ts
 var DEFAULT_IO_CONCURRENCY = 16;
@@ -451,9 +556,415 @@ async function mapLimit(items, limit, fn) {
   return out;
 }
 
-// src/anchor-resolver.ts
-var execFileAsync = promisify(execFile);
+// src/remote-repo/git.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+
+// src/anchor-resolver/model.ts
 var MAX_ANCHOR_FILE_BYTES = 1048576;
+
+// src/remote-repo/git.ts
+var execFileAsync2 = promisify2(execFile2);
+function childEnv() {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"]) {
+    delete env[name];
+  }
+  return env;
+}
+async function git(args, options = {}) {
+  try {
+    const { stdout, stderr } = await execFileAsync2("git", args, {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      timeout: options.timeoutMs ?? 3e4,
+      maxBuffer: options.maxBytes ?? MAX_ANCHOR_FILE_BYTES,
+      encoding: "utf8",
+      windowsHide: true,
+      env: childEnv()
+    });
+    return { ok: true, stdout, stderr, overflowed: false };
+  } catch (error) {
+    const failure = error;
+    return {
+      ok: false,
+      stdout: failure.stdout ?? "",
+      stderr: failure.stderr ?? "",
+      overflowed: failure.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
+    };
+  }
+}
+function transportReason(stderr) {
+  const text = stderr.toLowerCase();
+  if (text.includes("authentication failed") || text.includes("permission denied") || text.includes("could not read username") || text.includes("403 forbidden") || text.includes("access denied")) {
+    return "repo-unauthorized";
+  }
+  if (text.includes("couldn't find remote ref") || text.includes("unadvertised object") || text.includes("not our ref")) {
+    return "ref-not-found";
+  }
+  return "remote-unreachable";
+}
+
+// src/remote-repo/model.ts
+var UNCHECKED_REASONS = [
+  "remote-unreachable",
+  "repo-unauthorized",
+  "default-branch-unknown"
+];
+function isUncheckedReason(reason) {
+  return reason !== void 0 && UNCHECKED_REASONS.includes(reason);
+}
+function wantKey(repo, ref, file) {
+  return `${repo}\0${ref ?? ""}\0${file}`;
+}
+
+// src/remote-repo/validate.ts
+var MAX_REF_LENGTH = 200;
+var REF_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+function refShapeIsSafe(ref) {
+  if (!ref || ref.length > MAX_REF_LENGTH) return false;
+  if (ref.includes("..")) return false;
+  return REF_SHAPE.test(ref);
+}
+async function refIsWellFormed(ref) {
+  if (!refShapeIsSafe(ref)) return false;
+  const checked = await git(["check-ref-format", "--allow-onelevel", ref]);
+  return checked.ok;
+}
+function filePathIsSafe(file) {
+  const path = file.replace(/^\.\//, "");
+  if (!path || path.startsWith("-") || path.includes("\0")) return false;
+  return !path.split("/").includes("..");
+}
+var DEFAULT_PROTOCOLS = ["https", "ssh", "git"];
+function allowedProtocols() {
+  const raw = process.env["STRAUSS_KB_REPO_PROTOCOLS"];
+  if (raw === void 0) return [...DEFAULT_PROTOCOLS];
+  const listed = raw.split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+  return listed.length ? listed : [...DEFAULT_PROTOCOLS];
+}
+function isShortRepoName(repo) {
+  return /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(repo.trim());
+}
+var SCP_LIKE = /^[\w.-]+@[\w.-]+:(?!\/)\S+$/;
+var URL_SCHEME = /^([A-Za-z0-9+.-]+):\/\//;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+function repoUrlIsSafe(repo) {
+  const url = repo.trim();
+  if (!url || url.startsWith("-") || CONTROL_CHARS.test(url)) return false;
+  const allowed = allowedProtocols();
+  if (SCP_LIKE.test(url)) return allowed.includes("ssh");
+  const scheme = URL_SCHEME.exec(url);
+  if (!scheme?.[1]) return false;
+  if (!allowed.includes(scheme[1].toLowerCase())) return false;
+  const authority = url.slice(scheme[0].length).split("/")[0] ?? "";
+  const at = authority.lastIndexOf("@");
+  return at < 0 || !authority.slice(0, at).includes(":");
+}
+function protocolArgs() {
+  const allowed = allowedProtocols();
+  return [
+    "-c",
+    "protocol.ext.allow=never",
+    "-c",
+    `protocol.file.allow=${allowed.includes("file") ? "user" : "never"}`
+  ];
+}
+
+// src/remote-repo/read.ts
+var DEFAULT_REPO_CONCURRENCY = 4;
+var IMMUTABLE_REV = /^[0-9a-f]{40}$/;
+async function readRemoteAnchors(wants, options = {}) {
+  const out = /* @__PURE__ */ new Map();
+  if (!wants.length) return out;
+  const cacheDir = repoCacheDir(options.cacheDir);
+  const timeoutMs = fetchTimeoutMs(options.fetchTimeoutMs);
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const want of wants) {
+    const key = normalizeRepoUrl(want.repo);
+    const group2 = byRepo.get(key) ?? { url: want.repo.trim(), wants: [] };
+    group2.wants.push(want);
+    byRepo.set(key, group2);
+  }
+  const groups = [...byRepo.entries()];
+  const results = await mapLimit(
+    groups,
+    Math.max(1, options.concurrency ?? DEFAULT_REPO_CONCURRENCY),
+    ([repo, group2]) => readOneRepo(repo, group2.url, group2.wants, {
+      cacheDir,
+      timeoutMs,
+      offline: options.offline === true
+    })
+  );
+  for (const result of results) {
+    for (const [key, read] of result) out.set(key, read);
+  }
+  return out;
+}
+async function readOneRepo(repo, url, declared, context) {
+  let wants = declared;
+  const all = (read) => new Map(wants.map((want) => [wantKey(repo, want.ref, want.file), read]));
+  if (isShortRepoName(url)) {
+    return all({ ok: false, reason: "remote-unreachable" });
+  }
+  if (!repoUrlIsSafe(url)) return all({ ok: false, reason: "repo-invalid" });
+  const cache = cachePathFor(repo, context.cacheDir);
+  if (!cache) return all({ ok: false, reason: "remote-unreachable" });
+  const rejected = /* @__PURE__ */ new Map();
+  const usable = [];
+  for (const want of wants) {
+    const reason = wantReason(want);
+    if (reason)
+      rejected.set(wantKey(repo, want.ref, want.file), { ok: false, reason });
+    else usable.push(want);
+  }
+  if (!usable.length) return rejected;
+  wants = usable;
+  const opened = await openCache(cache, url, context);
+  if (opened) return new Map([...rejected, ...all(opened)]);
+  const wantsDefault = wants.some((want) => want.ref === void 0);
+  const branch = wantsDefault ? await defaultBranch(cache, context) : {};
+  const revs = /* @__PURE__ */ new Map();
+  for (const rev of distinctRevs(wants, branch.name)) {
+    revs.set(
+      rev,
+      await refIsWellFormed(rev) ? await ensureRev(cache, rev, context) : { ok: false, reason: "ref-invalid" }
+    );
+  }
+  const reads = await mapLimit(
+    wants,
+    DEFAULT_IO_CONCURRENCY,
+    async (want) => {
+      const rev = want.ref ?? branch.name;
+      if (rev === void 0) {
+        return {
+          ok: false,
+          reason: branch.reason ?? "default-branch-unknown"
+        };
+      }
+      const failed = revs.get(rev);
+      if (failed) return failed;
+      return readBlob(cache, rev, want.file, context);
+    }
+  );
+  return new Map([
+    ...rejected,
+    ...wants.map(
+      (want, at) => [wantKey(repo, want.ref, want.file), reads[at]]
+    )
+  ]);
+}
+function wantReason(want) {
+  if (want.ref !== void 0 && !refShapeIsSafe(want.ref)) return "ref-invalid";
+  return filePathIsSafe(want.file) ? void 0 : "outside-repo";
+}
+function distinctRevs(wants, branch) {
+  const revs = /* @__PURE__ */ new Set();
+  for (const want of wants) {
+    if (want.ref !== void 0) revs.add(want.ref);
+    else if (branch) revs.add(branch);
+  }
+  return [...revs];
+}
+async function openCache(cache, url, context) {
+  try {
+    await mkdir(cache, { recursive: true });
+  } catch {
+    return { ok: false, reason: "remote-unreachable" };
+  }
+  const init = await git(["init", "--bare", "--quiet", cache], {
+    timeoutMs: context.timeoutMs
+  });
+  if (!init.ok) return { ok: false, reason: "remote-unreachable" };
+  const remote = await git(["config", "remote.origin.url", url], {
+    cwd: cache,
+    timeoutMs: context.timeoutMs
+  });
+  return remote.ok ? void 0 : { ok: false, reason: "remote-unreachable" };
+}
+async function defaultBranch(cache, context) {
+  if (!context.offline) {
+    const listed = await git(
+      [...protocolArgs(), "ls-remote", "--symref", "origin", "HEAD"],
+      {
+        cwd: cache,
+        timeoutMs: context.timeoutMs
+      }
+    );
+    const found = /^ref:\s+refs\/heads\/(\S+)\s+HEAD$/m.exec(listed.stdout);
+    if (listed.ok && found?.[1]) {
+      const name = found[1];
+      await git(["config", "strauss.defaultBranch", name], { cwd: cache });
+      return { name };
+    }
+    if (!listed.ok) {
+      const reason = transportReason(listed.stderr);
+      if (reason !== "ref-not-found") {
+        const cached2 = await cachedBranch(cache);
+        return cached2 ? { name: cached2 } : { reason };
+      }
+    }
+  }
+  const cached = await cachedBranch(cache);
+  if (cached) return { name: cached };
+  return {
+    reason: context.offline ? "remote-unreachable" : "default-branch-unknown"
+  };
+}
+async function cachedBranch(cache) {
+  const stored = await git(["config", "--get", "strauss.defaultBranch"], {
+    cwd: cache
+  });
+  if (stored.ok && stored.stdout.trim()) return stored.stdout.trim();
+  const head = await git(
+    ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"],
+    {
+      cwd: cache
+    }
+  );
+  const name = head.stdout.trim().replace(/^origin\//, "");
+  return head.ok && name ? name : void 0;
+}
+async function ensureRev(cache, rev, context) {
+  const ref = revRef(rev);
+  const have = await git(
+    ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`],
+    {
+      cwd: cache
+    }
+  );
+  const cached = have.ok && have.stdout.trim().length > 0;
+  if (cached && (context.offline || IMMUTABLE_REV.test(rev))) return void 0;
+  if (context.offline) return { ok: false, reason: "remote-unreachable" };
+  const fetched = await git(
+    [
+      ...protocolArgs(),
+      "fetch",
+      "--depth",
+      "1",
+      "origin",
+      "--end-of-options",
+      rev
+    ],
+    { cwd: cache, timeoutMs: context.timeoutMs }
+  );
+  if (!fetched.ok) {
+    const reason = transportReason(fetched.stderr);
+    if (cached && reason !== "ref-not-found") return void 0;
+    return { ok: false, reason };
+  }
+  const head = await git(["rev-parse", "FETCH_HEAD"], { cwd: cache });
+  const sha = head.stdout.trim();
+  if (!head.ok || !sha) return { ok: false, reason: "remote-unreachable" };
+  const updated = await git(["update-ref", ref, sha], { cwd: cache });
+  return updated.ok ? void 0 : { ok: false, reason: "remote-unreachable" };
+}
+async function readBlob(cache, rev, file, context) {
+  const path = file.replace(/^\.\//, "");
+  const blob = await git(
+    ["cat-file", "blob", "--end-of-options", `${revRef(rev)}:${path}`],
+    {
+      cwd: cache,
+      timeoutMs: context.timeoutMs
+    }
+  );
+  if (blob.ok) return { ok: true, source: blob.stdout };
+  if (blob.overflowed) return { ok: false, reason: "file-too-large" };
+  const text = blob.stderr.toLowerCase();
+  return text.includes("does not exist") || text.includes("not a valid object") ? { ok: false, reason: "file-missing" } : { ok: false, reason: "file-unreadable" };
+}
+
+// src/anchor-resolver/read.ts
+import { readFile, realpath, stat } from "fs/promises";
+import { isAbsolute, relative, resolve, sep } from "path";
+function anchorFilePath(repoRoot, file) {
+  const path = resolve(repoRoot, file.replace(/^\.\//, ""));
+  const rel = relative(resolve(repoRoot), path);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return null;
+  }
+  return path;
+}
+function contains(root, path) {
+  const rel = relative(root, path);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function errorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+}
+function anchorFileReader(repoRoot) {
+  let rootOnce;
+  const realRoot = () => {
+    rootOnce ??= realpath(resolve(repoRoot)).catch((error) => {
+      rootOnce = void 0;
+      throw error;
+    });
+    return rootOnce;
+  };
+  return (file) => readAnchorFileWithRoot(repoRoot, file, realRoot);
+}
+async function readAnchorFileWithRoot(repoRoot, file, realRoot) {
+  const lexical = anchorFilePath(repoRoot, file);
+  if (lexical === null) return { ok: false, reason: "outside-repo" };
+  let root;
+  let path;
+  try {
+    root = await realRoot();
+    path = await realpath(lexical);
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, reason: "file-missing" };
+    }
+    return { ok: false, reason: "file-unreadable" };
+  }
+  if (!contains(root, path)) return { ok: false, reason: "outside-repo" };
+  try {
+    const stats = await stat(path);
+    if (!stats.isFile()) return { ok: false, reason: "file-unreadable" };
+    if (stats.size > MAX_ANCHOR_FILE_BYTES) {
+      return { ok: false, reason: "file-too-large" };
+    }
+    return { ok: true, source: await readFile(path, "utf8") };
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, reason: "file-missing" };
+    }
+    return { ok: false, reason: "file-unreadable" };
+  }
+}
+function looksLikeWrongRepoRoot(drift) {
+  let checked = 0;
+  for (const entries of drift.values()) {
+    for (const entry of entries) {
+      if (entry.repo !== void 0) continue;
+      checked += 1;
+      if (entry.state !== "unresolved" || entry.reason !== "file-missing") {
+        return false;
+      }
+    }
+  }
+  return checked > 0;
+}
+async function readAnchorFiles(files, read, concurrency = DEFAULT_IO_CONCURRENCY) {
+  if (!Number.isInteger(concurrency) || concurrency < 1) {
+    throw new RangeError(
+      `readAnchorFiles: option "concurrency" must be a positive integer, got ${concurrency}`
+    );
+  }
+  const wanted = [...new Set(files)];
+  const results = await mapLimit(wanted, concurrency, async (file) => {
+    try {
+      return await read(file);
+    } catch {
+      return { ok: false, reason: "file-unreadable" };
+    }
+  });
+  return new Map(wanted.map((file, at) => [file, results[at]]));
+}
+
+// src/anchor-resolver/resolver.ts
+import { createHash } from "crypto";
 var PARENT_SCOPE_LINES = 50;
 var CLEAN_STATE = { blockComment: false, template: false };
 function stripLine(line, state) {
@@ -629,157 +1140,8 @@ function resolveAnchor(source, anchor, resolver = regexResolver) {
   }
   return resolver.resolve(normalized, anchor.symbol);
 }
-function anchorFilePath(repoRoot, file) {
-  const path = resolve(repoRoot, file.replace(/^\.\//, ""));
-  const rel = relative(resolve(repoRoot), path);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    return null;
-  }
-  return path;
-}
-function contains(root, path) {
-  const rel = relative(root, path);
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-}
-function normalizeRepoUrl(value) {
-  let url = value.trim().replace(/^git\+/, "");
-  const scp = /^[\w.-]+@([\w.-]+):(.+)$/.exec(url);
-  if (scp) url = `https://${scp[1]}/${scp[2]}`;
-  url = url.replace(/^ssh:\/\/(?:[^@/]+@)?/, "https://");
-  url = trimTrailingSlashes(url);
-  if (url.endsWith(".git")) url = url.slice(0, -4);
-  return trimTrailingSlashes(url).toLowerCase();
-}
-function trimTrailingSlashes(value) {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") end -= 1;
-  return value.slice(0, end);
-}
-function repoPath(normalized) {
-  const withoutScheme = normalized.replace(/^[a-z0-9+.-]+:\/\//, "");
-  const segments = withoutScheme.split("/").filter(Boolean);
-  return segments.length > 1 ? segments.slice(1).join("/") : "";
-}
-function repoIdentifies(declared, originUrl) {
-  if (!originUrl) return false;
-  const origin = normalizeRepoUrl(originUrl);
-  const want = normalizeRepoUrl(declared);
-  if (!want || !origin) return false;
-  if (want === origin) return true;
-  const path = repoPath(origin);
-  if (!path) return false;
-  return want === path || want === (path.split("/").pop() ?? "");
-}
-async function repoOriginUrl(repoRoot) {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["-C", repoRoot, "config", "--get", "remote.origin.url"],
-      { timeout: 5e3 }
-    );
-    return stdout.trim() || null;
-  } catch {
-    return null;
-  }
-}
-var LazyOrigin = class {
-  constructor(repoRoot) {
-    this.repoRoot = repoRoot;
-  }
-  repoRoot;
-  url = null;
-  asked = false;
-  /** Asks git once, so later `isForeign` calls need no await. */
-  async prime() {
-    if (this.asked) return;
-    this.url = await repoOriginUrl(this.repoRoot);
-    this.asked = true;
-  }
-  /** Only meaningful after `prime`; an unprimed origin identifies nothing. */
-  isForeign(anchor) {
-    if (!anchor.repo) return false;
-    return !repoIdentifies(anchor.repo, this.url);
-  }
-  async foreign(anchor) {
-    if (!anchor.repo) return false;
-    await this.prime();
-    return this.isForeign(anchor);
-  }
-};
-function errorCode(error) {
-  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
-}
-function anchorFileReader(repoRoot) {
-  let rootOnce;
-  const realRoot = () => {
-    rootOnce ??= realpath(resolve(repoRoot)).catch((error) => {
-      rootOnce = void 0;
-      throw error;
-    });
-    return rootOnce;
-  };
-  return (file) => readAnchorFileWithRoot(repoRoot, file, realRoot);
-}
-async function readAnchorFileWithRoot(repoRoot, file, realRoot) {
-  const lexical = anchorFilePath(repoRoot, file);
-  if (lexical === null) return { ok: false, reason: "outside-repo" };
-  let root;
-  let path;
-  try {
-    root = await realRoot();
-    path = await realpath(lexical);
-  } catch (error) {
-    const code = errorCode(error);
-    if (code === "ENOENT" || code === "ENOTDIR") {
-      return { ok: false, reason: "file-missing" };
-    }
-    return { ok: false, reason: "file-unreadable" };
-  }
-  if (!contains(root, path)) return { ok: false, reason: "outside-repo" };
-  try {
-    const stats = await stat(path);
-    if (!stats.isFile()) return { ok: false, reason: "file-unreadable" };
-    if (stats.size > MAX_ANCHOR_FILE_BYTES) {
-      return { ok: false, reason: "file-too-large" };
-    }
-    return { ok: true, source: await readFile(path, "utf8") };
-  } catch (error) {
-    const code = errorCode(error);
-    if (code === "ENOENT" || code === "ENOTDIR") {
-      return { ok: false, reason: "file-missing" };
-    }
-    return { ok: false, reason: "file-unreadable" };
-  }
-}
-function looksLikeWrongRepoRoot(drift) {
-  let checked = 0;
-  for (const entries of drift.values()) {
-    for (const entry of entries) {
-      if (entry.reason === "foreign-repo") continue;
-      checked += 1;
-      if (entry.state !== "unresolved" || entry.reason !== "file-missing") {
-        return false;
-      }
-    }
-  }
-  return checked > 0;
-}
-async function readAnchorFiles(files, read, concurrency = DEFAULT_IO_CONCURRENCY) {
-  if (!Number.isInteger(concurrency) || concurrency < 1) {
-    throw new RangeError(
-      `readAnchorFiles: option "concurrency" must be a positive integer, got ${concurrency}`
-    );
-  }
-  const wanted = [...new Set(files)];
-  const results = await mapLimit(wanted, concurrency, async (file) => {
-    try {
-      return await read(file);
-    } catch {
-      return { ok: false, reason: "file-unreadable" };
-    }
-  });
-  return new Map(wanted.map((file, at) => [file, results[at]]));
-}
+
+// src/anchor-resolver/drift.ts
 async function detectAnchorDrift(records, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   const resolver = options.resolver ?? regexResolver;
@@ -805,67 +1167,97 @@ async function detectAnchorDrift(records, options = {}) {
     }
   }
   const files = [];
+  const wants = [];
   for (const entries of planned.values()) {
-    for (const entry of entries) {
-      if (!entry.foreign) files.push(entry.anchor.file);
+    for (const { anchor, foreign } of entries) {
+      if (!foreign) files.push(anchor.file);
+      else wants.push(...remoteWants(anchor));
     }
   }
-  const reads = await readAnchorFiles(
-    files,
-    options.reader ?? anchorFileReader(repoRoot),
-    options.concurrency ?? DEFAULT_IO_CONCURRENCY
-  );
+  const [reads, remote] = await Promise.all([
+    readAnchorFiles(
+      files,
+      options.reader ?? anchorFileReader(repoRoot),
+      options.concurrency ?? DEFAULT_IO_CONCURRENCY
+    ),
+    (options.readRemote ?? readRemoteAnchors)(wants, options.remote ?? {})
+  ]);
   const drift = /* @__PURE__ */ new Map();
   for (const record of records) {
     const entries = [];
     for (const { anchor, foreign } of planned.get(record.conceptId) ?? []) {
-      const base = {
-        file: anchor.file,
-        ...anchor.symbol ? { symbol: anchor.symbol } : {},
-        storedHash: anchor.hash
-      };
-      if (foreign) {
-        entries.push({
-          ...base,
-          state: "unresolved",
-          diffSize: null,
-          reason: "foreign-repo"
-        });
-        continue;
-      }
-      const read = reads.get(anchor.file);
-      if (!read.ok) {
-        entries.push({
-          ...base,
-          state: "unresolved",
-          diffSize: null,
-          reason: read.reason
-        });
-        continue;
-      }
-      const resolved = resolveAnchor(read.source, anchor, resolver);
-      if (!resolved) {
-        entries.push({
-          ...base,
-          state: "unresolved",
-          diffSize: null,
-          reason: "symbol-not-found"
-        });
-        continue;
-      }
-      const currentHash = hashAnchorText(resolved.text);
-      const currentLines = resolved.endLine - resolved.startLine + 1;
-      entries.push({
-        ...base,
-        state: currentHash === anchor.hash ? "match" : "drifted",
-        currentHash,
-        diffSize: anchor.lines === void 0 ? null : Math.abs(currentLines - anchor.lines)
-      });
+      entries.push(
+        foreign ? remoteEntry(anchor, remote, resolver) : localEntry(anchor, reads.get(anchor.file), resolver)
+      );
     }
     if (entries.length) drift.set(record.conceptId, entries);
   }
   return drift;
 }
+function remoteWants(anchor) {
+  const repo = anchor.repo;
+  const wants = [{ repo, file: anchor.file }];
+  if (anchor.ref) wants.unshift({ repo, ref: anchor.ref, file: anchor.file });
+  return wants;
+}
+function base(anchor) {
+  return {
+    file: anchor.file,
+    ...anchor.symbol ? { symbol: anchor.symbol } : {},
+    storedHash: anchor.hash
+  };
+}
+function unresolved(anchor, reason, repo) {
+  return {
+    ...base(anchor),
+    state: "unresolved",
+    diffSize: null,
+    ...reason ? { reason } : {},
+    ...repo ? { repo } : {}
+  };
+}
+function hashIn(source, anchor, resolver) {
+  const resolved = resolveAnchor(source, anchor, resolver);
+  if (!resolved) return null;
+  return {
+    hash: hashAnchorText(resolved.text),
+    lines: resolved.endLine - resolved.startLine + 1
+  };
+}
+function compared(anchor, current, extra = {}) {
+  return {
+    ...base(anchor),
+    state: current.hash === anchor.hash ? "match" : "drifted",
+    currentHash: current.hash,
+    diffSize: anchor.lines === void 0 ? null : Math.abs(current.lines - anchor.lines),
+    ...extra
+  };
+}
+function localEntry(anchor, read, resolver) {
+  if (!read.ok) return unresolved(anchor, read.reason);
+  const current = hashIn(read.source, anchor, resolver);
+  return current ? compared(anchor, current) : unresolved(anchor, "symbol-not-found");
+}
+function remoteEntry(anchor, remote, resolver) {
+  const repo = anchor.repo;
+  const key = normalizeRepoUrl(repo);
+  const atDefault = remote.get(wantKey(key, void 0, anchor.file));
+  const primary = anchor.ref ? remote.get(wantKey(key, anchor.ref, anchor.file)) : atDefault;
+  if (!primary) return unresolved(anchor, "remote-unreachable", repo);
+  if (!primary.ok) return unresolved(anchor, primary.reason, repo);
+  const current = hashIn(primary.source, anchor, resolver);
+  if (!current) return unresolved(anchor, "symbol-not-found", repo);
+  if (!anchor.ref) return compared(anchor, current, { repo });
+  if (current.hash !== anchor.hash) {
+    return compared(anchor, current, { repo, remoteState: "drifted-from-ref" });
+  }
+  const head = atDefault?.ok ? hashIn(atDefault.source, anchor, resolver) : null;
+  return head && head.hash !== anchor.hash ? {
+    ...compared(anchor, head, { repo }),
+    state: "drifted",
+    remoteState: "drifted-on-default"
+  } : compared(anchor, current, { repo, remoteState: "matches-ref" });
+}
 
 // src/errors.ts
 var Fault = /* @__PURE__ */ ((Fault2) => {
@@ -1085,10 +1477,10 @@ var KbBaseFrozenError = class extends Error {
 };
 
 // src/kb-pins/model.ts
-import { join } from "path";
+import { join as join2 } from "path";
 import { z as z4 } from "zod";
-var PINS_FILE = join(".strauss", "kb-pins.json");
-var PINS_LOCAL_FILE = join(".strauss", "kb-pins.local.json");
+var PINS_FILE = join2(".strauss", "kb-pins.json");
+var PINS_LOCAL_FILE = join2(".strauss", "kb-pins.local.json");
 var PIN_LAYERS = ["project", "local", "user"];
 var pinSchema = z4.object({
   /** Relative to the manifest's root, so the file is committable. */
@@ -1134,17 +1526,17 @@ var pinsManifestSchema = z4.object({
 }).passthrough();
 
 // src/kb-pins/layers.ts
-import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
 function userRoot() {
-  return process.env.STRAUSS_KB_USER_ROOT || homedir();
+  return process.env.STRAUSS_KB_USER_ROOT || homedir2();
 }
 function layerRoot(workspaceDir, layer) {
   return layer === "user" ? userRoot() : resolve2(workspaceDir);
 }
 function layerFile(workspaceDir, layer) {
-  return join2(
+  return join3(
     layerRoot(workspaceDir, layer),
     layer === "local" ? PINS_LOCAL_FILE : PINS_FILE
   );
@@ -1177,7 +1569,7 @@ async function readPinsLayer(workspaceDir, layer) {
 }
 async function writePinsLayer(workspaceDir, layer, manifest) {
   const file = layerFile(workspaceDir, layer);
-  await mkdir(dirname(file), { recursive: true });
+  await mkdir2(dirname(file), { recursive: true });
   await writeFile(file, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
@@ -1367,23 +1759,34 @@ function adjudicate(hits, bundle, now = /* @__PURE__ */ new Date(), anchorDrift)
     if (!record.frontmatter.verified?.length) {
       warnings.push({ kind: "unverified" });
     }
-    const moved = (anchorDrift?.get(record.conceptId) ?? []).filter(
-      (entry) => entry.state !== "match" && entry.reason !== "foreign-repo"
+    const found = (anchorDrift?.get(record.conceptId) ?? []).filter(
+      (entry) => entry.state !== "match"
     );
+    const unchecked2 = found.filter((entry) => isUncheckedReason(entry.reason));
+    const moved = found.filter((entry) => !isUncheckedReason(entry.reason));
     if (moved.length) {
+      warnings.push({ kind: "drifted", anchors: moved.map(warningAnchor) });
+    }
+    if (unchecked2.length) {
       warnings.push({
-        kind: "drifted",
-        anchors: moved.map(({ file, symbol, diffSize, reason }) => ({
-          file,
-          ...symbol !== void 0 ? { symbol } : {},
-          diffSize,
-          ...reason !== void 0 ? { reason } : {}
-        }))
+        kind: "unchecked",
+        anchors: unchecked2.map(warningAnchor)
       });
     }
     return { record, standing: STANDING[status], heads, warnings };
   });
 }
+function warningAnchor(entry) {
+  const { file, symbol, diffSize, reason, repo, remoteState } = entry;
+  return {
+    file,
+    ...symbol !== void 0 ? { symbol } : {},
+    diffSize,
+    ...reason !== void 0 ? { reason } : {},
+    ...repo !== void 0 ? { repo } : {},
+    ...remoteState !== void 0 ? { remoteState } : {}
+  };
+}
 function resolveHeads(from, byId) {
   const warnings = [];
   const heads = /* @__PURE__ */ new Map();
@@ -1660,7 +2063,7 @@ async function buildContext(store, workspaceDir, options = {}) {
       operation: "kb.context.refused",
       approxTokens: total,
       budgetTokens,
-      bases: bases.map((base) => base.path)
+      bases: bases.map((base2) => base2.path)
     });
     const refusal = [
       HEADING2,
@@ -1670,7 +2073,7 @@ async function buildContext(store, workspaceDir, options = {}) {
       "from a complete one. The pinned bases:",
       "",
       ...bases.map(
-        (base) => `- ${base.path} \u2014 ~${base.approxTokens} tokens (bundlePath: \`${base.absolutePath}\`)`
+        (base2) => `- ${base2.path} \u2014 ~${base2.approxTokens} tokens (bundlePath: \`${base2.absolutePath}\`)`
       ),
       "",
       "For the question at hand, read what you need now \u2014 `kb_load` a base",
@@ -1886,6 +2289,16 @@ function validateBundle(records) {
         );
       }
     }
+    for (const anchor of fm.strauss_anchors ?? []) {
+      if (anchor.repo && !isCanonicalRepoUrl(anchor.repo)) {
+        report(
+          "anchor_repo",
+          conceptId2,
+          `anchor repo "${anchor.repo}" is not a full remote URL, so it cannot be resolved against a remote`,
+          "warning"
+        );
+      }
+    }
     if (fm.strauss_assumption && fm.sources?.length) {
       report("assumption", conceptId2, "marked an assumption but cites sources");
     }
@@ -1905,7 +2318,8 @@ var KB_DOCTOR_CHECKS = [
   "orphaned",
   "broken-supersession",
   "superseded-but-cited",
-  "drifted"
+  "drifted",
+  "unchecked"
 ];
 var CHECK_HEADLINES = {
   expired: "past its stale_after date",
@@ -1915,7 +2329,8 @@ var CHECK_HEADLINES = {
   orphaned: "no other record links to it",
   "broken-supersession": "the supersession pointers do not resolve",
   "superseded-but-cited": "a live record's body links to one that no longer holds",
-  drifted: "the code an anchor points at moved out from under its hash"
+  drifted: "the code an anchor points at moved out from under its hash",
+  unchecked: "an anchor in another repository nothing could reach"
 };
 var DAY_MS = 864e5;
 function doctor(bundle, options = {}) {
@@ -1940,7 +2355,8 @@ function doctor(bundle, options = {}) {
     group("orphaned", orphaned(bundle)),
     group("broken-supersession", brokenSupersession(bundle, adjudicated)),
     group("superseded-but-cited", supersededButCited(bundle, standings)),
-    group("drifted", drifted(inForce))
+    group("drifted", drifted(inForce)),
+    group("unchecked", unchecked(inForce))
   ];
   const counts = Object.fromEntries(
     groups.map((entry) => [entry.check, entry.count])
@@ -2127,21 +2543,38 @@ function supersededButCited(bundle, standings) {
   return findings;
 }
 function drifted(hits) {
+  return anchorFindings(
+    hits,
+    "drifted",
+    (count2) => count2 === 1 ? "anchor no longer matches" : "anchors no longer match"
+  );
+}
+function unchecked(hits) {
+  return anchorFindings(
+    hits,
+    "unchecked",
+    (count2) => count2 === 1 ? "anchor was not checked" : "anchors were not checked"
+  );
+}
+function anchorFindings(hits, kind, headline) {
   const findings = [];
   for (const hit of hits) {
-    const warning = hit.warnings.find((entry) => entry.kind === "drifted");
+    const warning = hit.warnings.find(
+      (entry) => entry.kind === kind
+    );
     if (!warning) continue;
+    const byRepo = /* @__PURE__ */ new Map();
+    for (const anchor of warning.anchors) {
+      const repo = anchor.repo ?? "";
+      byRepo.set(repo, [...byRepo.get(repo) ?? [], describeAnchor(anchor)]);
+    }
+    const detail = [...byRepo.entries()].map(
+      ([repo, entries]) => repo ? `${repo}: ${entries.join(", ")}` : entries.join(", ")
+    );
     findings.push(
       finding(
         hit.record,
-        `${warning.anchors.length} ${warning.anchors.length === 1 ? "anchor no longer matches" : "anchors no longer match"}: ${warning.anchors.map((anchor) => {
-          const at = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
-          if (anchor.reason) return `${at} (${anchor.reason})`;
-          if (anchor.diffSize === null) {
-            return `${at} (changed, size unrecorded)`;
-          }
-          return anchor.diffSize === 0 ? `${at} (content changed, same line count)` : `${at} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
-        }).join(", ")}`
+        `${warning.anchors.length} ${headline(warning.anchors.length)}: ${detail.join("; ")}`
       )
     );
   }
@@ -2149,6 +2582,15 @@ function drifted(hits) {
     (left, right) => left.conceptId.localeCompare(right.conceptId)
   );
 }
+function describeAnchor(anchor) {
+  const at = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
+  if (anchor.reason) return `${at} (${anchor.reason})`;
+  if (anchor.remoteState === "drifted-on-default") {
+    return `${at} (matches ref, moved on the default branch)`;
+  }
+  if (anchor.diffSize === null) return `${at} (changed, size unrecorded)`;
+  return anchor.diffSize === 0 ? `${at} (content changed, same line count)` : `${at} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
+}
 function replaces(later, earlier) {
   return (later.frontmatter.strauss_supersedes ?? []).includes(earlier.conceptId) || earlier.frontmatter.strauss_superseded_by === later.conceptId;
 }
@@ -2316,12 +2758,15 @@ function argvFlag(argv, name) {
 var anchorResolveCommand = define({
   name: "anchor-resolve",
   tool: "kb_anchor_resolve",
-  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--rebaseline] [--restamp]",
-  description: "Resolve a record's anchors against the working tree: stamp a hash onto anchors that lack one, report drift where the code moved. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was, not whether the claim still holds. Anchors naming another repository are skipped. Exits non-zero on drift.",
+  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp]",
+  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was. Exits non-zero on drift.",
   input: z8.object({
     bundlePath,
     conceptId,
     repoRoot: z8.string().min(1).optional(),
+    offline: z8.boolean().optional().describe(
+      "Resolve foreign anchors from the local repo cache only, never fetching."
+    ),
     rebaseline: z8.boolean().optional().describe(
       "Accept the current code as the new baseline for anchors that drifted."
     ),
@@ -2333,10 +2778,11 @@ var anchorResolveCommand = define({
     bundlePath: path,
     conceptId: argv[1],
     repoRoot: argvFlag(argv, "--repo-root"),
+    offline: argv.includes("--offline"),
     rebaseline: argv.includes("--rebaseline"),
     restamp: argv.includes("--restamp")
   }),
-  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, rebaseline, restamp }) => {
+  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, offline, rebaseline, restamp }) => {
     const root = repoRoot ?? process.cwd();
     const record = await store.read(path, id);
     if (!record) throw new KbRecordNotFoundError(id);
@@ -2351,18 +2797,10 @@ var anchorResolveCommand = define({
     }
     const results = [];
     const updated = [];
-    const origin = new LazyOrigin(root);
     let dirty = false;
-    if (anchors.some((anchor) => anchor.repo)) await origin.prime();
-    const foreign = new Map(
-      anchors.map((anchor) => [anchor, origin.isForeign(anchor)])
-    );
-    const reads = await readAnchorFiles(
-      anchors.filter((anchor) => !foreign.get(anchor)).map((anchor) => anchor.file),
-      anchorFileReader(root)
-    );
+    const sources = await readSources(anchors, root, offline === true);
     for (const anchor of anchors) {
-      const base = {
+      const base2 = {
         file: anchor.file,
         ...anchor.symbol ? { symbol: anchor.symbol } : {},
         // Carried onto unresolved findings too: an anchor that once hashed
@@ -2370,21 +2808,17 @@ var anchorResolveCommand = define({
         // has to be able to tell it from one nobody ever stamped.
         ...anchor.hash ? { storedHash: anchor.hash } : {}
       };
-      if (foreign.get(anchor)) {
-        results.push({ ...base, state: "unresolved", reason: "foreign-repo" });
+      const source = sources.get(anchor);
+      if (source.repo) base2.repo = source.repo;
+      if (!source.ok) {
+        results.push({ ...base2, state: "unresolved", reason: source.reason });
         updated.push(anchor);
         continue;
       }
-      const fileRead = reads.get(anchor.file);
-      if (!fileRead.ok) {
-        results.push({ ...base, state: "unresolved", reason: fileRead.reason });
-        updated.push(anchor);
-        continue;
-      }
-      const resolved = resolveAnchor(fileRead.source, anchor);
+      const resolved = resolveAnchor(source.source, anchor);
       if (!resolved) {
         results.push({
-          ...base,
+          ...base2,
           state: "unresolved",
           reason: "symbol-not-found"
         });
@@ -2399,30 +2833,47 @@ var anchorResolveCommand = define({
         lines: currentLines,
         resolved_at: now()
       };
+      const pinned = anchor.ref !== void 0 && source.repo !== void 0;
       if (!anchor.hash) {
-        results.push({ ...base, state: "stamped", currentHash });
+        results.push({ ...base2, state: "stamped", currentHash });
         updated.push(stamped);
         dirty = true;
-      } else if (anchor.hash === currentHash) {
-        results.push({
-          ...base,
-          state: "match",
-          currentHash
-        });
-        const refresh = restamp || anchor.resolved_at === void 0;
-        updated.push(refresh ? { ...anchor, resolved_at: now() } : anchor);
-        if (refresh) dirty = true;
-      } else {
+        continue;
+      }
+      if (anchor.hash !== currentHash) {
         results.push({
-          ...base,
+          ...base2,
           state: "drifted",
           currentHash,
-          diffSize: anchor.lines === void 0 ? null : Math.abs(currentLines - anchor.lines),
+          diffSize: lineDelta(anchor, currentLines),
+          ...pinned ? { remoteState: "drifted-from-ref" } : {},
           ...rebaseline ? { rebaselined: true } : {}
         });
         updated.push(rebaseline ? stamped : anchor);
         if (rebaseline) dirty = true;
+        continue;
       }
+      const onDefault = pinned ? headHash(source, anchor) : void 0;
+      if (onDefault && onDefault.hash !== anchor.hash) {
+        results.push({
+          ...base2,
+          state: "drifted",
+          currentHash: onDefault.hash,
+          diffSize: lineDelta(anchor, onDefault.lines),
+          remoteState: "drifted-on-default"
+        });
+        updated.push(anchor);
+        continue;
+      }
+      results.push({
+        ...base2,
+        state: "match",
+        currentHash,
+        ...pinned ? { remoteState: "matches-ref" } : {}
+      });
+      const refresh = restamp || anchor.resolved_at === void 0;
+      updated.push(refresh ? { ...anchor, resolved_at: now() } : anchor);
+      if (refresh) dirty = true;
     }
     let frozen = false;
     if (dirty) {
@@ -2435,16 +2886,19 @@ var anchorResolveCommand = define({
       if (!frozen) await store.updateAnchors(path, id, updated, actor);
     }
     const frozenNote = frozen ? { frozen: true, note: "base is frozen: nothing was stamped" } : {};
-    const checked = results.filter((entry) => entry.reason !== "foreign-repo");
-    const skipped = results.length - checked.length;
-    const matches2 = checked.filter((entry) => entry.state === "match").length;
-    const clean = checked.length > 0 && checked.every((entry) => entry.state === "match");
+    const unreachable = results.filter(
+      (entry) => isUncheckedReason(entry.reason)
+    ).length;
+    const checked = results.length - unreachable;
+    const matches2 = results.filter((entry) => entry.state === "match").length;
+    const note = `${matches2}/${checked} anchors match${unreachable ? `, ${unreachable} unreachable` : ""}`;
+    const clean = checked > 0 && matches2 === checked && unreachable === 0;
     if (clean) {
       try {
         await store.verify(
           path,
           id,
-          `anchor-resolve: ${matches2}/${checked.length} anchors match${skipped ? `, ${skipped} in another repo` : ""} (regex resolver)`,
+          `anchor-resolve: ${note} (regex resolver)`,
           actor,
           now()
         );
@@ -2460,18 +2914,81 @@ var anchorResolveCommand = define({
       }
       return { conceptId: id, results, verified: true, ...frozenNote };
     }
-    return { conceptId: id, results, verified: false, ...frozenNote };
+    return {
+      conceptId: id,
+      results,
+      verified: false,
+      ...unreachable ? { note } : {},
+      ...frozenNote
+    };
   },
   // A stored hash that no longer resolves is a broken anchor, not an absence:
   // the file was deleted or the symbol renamed, and exiting zero on it would
   // let the one edit that destroys an anchor pass the gate that exists to
   // catch it. An anchor nobody ever stamped is still just unstamped, and one
-  // belonging to another repository was never this run's to check — failing CI
-  // on either would gate on work this command did not do.
+  // whose remote nothing could reach was never checked — failing CI on either
+  // would gate on work this command did not do.
   failsWhen: (result) => result.results.some(
-    (entry) => entry.state === "drifted" || entry.state === "unresolved" && entry.storedHash !== void 0 && entry.reason !== "foreign-repo"
+    (entry) => entry.state === "drifted" || entry.state === "unresolved" && entry.storedHash !== void 0 && !isUncheckedReason(entry.reason)
   )
 });
+function lineDelta(anchor, current) {
+  return anchor.lines === void 0 ? null : Math.abs(current - anchor.lines);
+}
+function headHash(source, anchor) {
+  if (source.head === void 0) return void 0;
+  const resolved = resolveAnchor(source.head, anchor);
+  if (!resolved) return void 0;
+  return {
+    hash: hashAnchorText(resolved.text),
+    lines: resolved.endLine - resolved.startLine + 1
+  };
+}
+async function readSources(anchors, root, offline) {
+  const origin = new LazyOrigin(root);
+  if (anchors.some((anchor) => anchor.repo)) await origin.prime();
+  const foreign = new Map(
+    anchors.map((anchor) => [anchor, origin.isForeign(anchor)])
+  );
+  const local = anchors.filter((anchor) => !foreign.get(anchor));
+  const remote = anchors.filter((anchor) => foreign.get(anchor));
+  const reads = await readAnchorFiles(
+    local.map((anchor) => anchor.file),
+    anchorFileReader(root)
+  );
+  const blobs = await readRemoteAnchors(remote.flatMap(remoteWants), {
+    offline
+  });
+  const sources = /* @__PURE__ */ new Map();
+  for (const anchor of local) {
+    const read = reads.get(anchor.file);
+    sources.set(
+      anchor,
+      read.ok ? { ok: true, source: read.source } : { ok: false, reason: read.reason }
+    );
+  }
+  for (const anchor of remote) {
+    const repo = anchor.repo;
+    const key = normalizeRepoUrl(repo);
+    const atDefault = blobs.get(wantKey(key, void 0, anchor.file));
+    const primary = anchor.ref ? blobs.get(wantKey(key, anchor.ref, anchor.file)) : atDefault;
+    if (!primary?.ok) {
+      sources.set(anchor, {
+        ok: false,
+        reason: primary?.ok === false ? primary.reason : "remote-unreachable",
+        repo
+      });
+      continue;
+    }
+    sources.set(anchor, {
+      ok: true,
+      source: primary.source,
+      repo,
+      ...anchor.ref && atDefault?.ok ? { head: atDefault.source } : {}
+    });
+  }
+  return sources;
+}
 
 // src/commands/answer.ts
 import { z as z9 } from "zod";
@@ -2629,8 +3146,8 @@ var days = (what, fallback) => z13.number().int().positive().optional().describe
 var doctorCommand = define({
   name: "doctor",
   tool: "kb_doctor",
-  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--strict]",
-  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted anchors. Every group is reported even when empty; nothing is written or re-stamped. Use it when picking up a base you have not touched in a while; kb_validate only checks that pointers between records agree.",
+  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--offline] [--strict]",
+  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted and unchecked anchors. Every group is reported even when empty; nothing is written or re-stamped. Use it when picking up a base you have not touched in a while; kb_validate only checks that pointers between records agree.",
   input: z13.object({
     bundlePath,
     repoRoot: REPO_ROOT,
@@ -2646,6 +3163,9 @@ var doctorCommand = define({
       "How long a record may stay `open` or `proposed` before `aging` reports it, in days.",
       DEFAULT_AGING_DAYS
     ),
+    offline: z13.boolean().optional().describe(
+      "Read foreign anchors from the local repo cache only, never fetching."
+    ),
     strict: z13.boolean().optional().describe(
       "Turn an expired record into a non-zero exit for the CLI. No effect on the report itself."
     )
@@ -2665,13 +3185,23 @@ var doctorCommand = define({
       ...expiring2 !== void 0 ? { expiringDays: Number(expiring2) } : {},
       ...unverified2 !== void 0 ? { unverifiedDays: Number(unverified2) } : {},
       ...agingDays !== void 0 ? { agingDays: Number(agingDays) } : {},
+      ...argv.includes("--offline") ? { offline: true } : {},
       ...argv.includes("--strict") ? { strict: true } : {}
     };
   },
-  run: async ({ store, now }, { bundlePath: path, expiringDays, unverifiedDays, agingDays, repoRoot }) => {
+  run: async ({ store, now }, {
+    bundlePath: path,
+    expiringDays,
+    unverifiedDays,
+    agingDays,
+    repoRoot,
+    offline
+  }) => {
     const checkedAt = now();
     const records = await store.list(path);
-    const anchorDrift = await store.detectDrift(records, repoRoot);
+    const anchorDrift = await store.detectDrift(records, repoRoot, {
+      offline: offline === true
+    });
     const report = doctor(records, {
       ...expiringDays !== void 0 ? { expiringDays } : {},
       ...unverifiedDays !== void 0 ? { unverifiedDays } : {},
@@ -3381,7 +3911,7 @@ function parseMarkdownWithFrontmatter(text, schema) {
 
 // src/search-index.ts
 import { stat as stat2 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var SEARCH_INDEX_FILE = ".index.sqlite";
 var COLLECTION = "kb";
 async function searchBase(bundlePath2, query, options = {}) {
@@ -3390,7 +3920,7 @@ async function searchBase(bundlePath2, query, options = {}) {
   let store = null;
   try {
     store = await qmd.createStore({
-      dbPath: join3(bundlePath2, SEARCH_INDEX_FILE),
+      dbPath: join4(bundlePath2, SEARCH_INDEX_FILE),
       config: {
         collections: {
           [COLLECTION]: {
@@ -3425,7 +3955,7 @@ async function searchBase(bundlePath2, query, options = {}) {
   }
 }
 async function isStale(bundlePath2) {
-  const indexAt = await stat2(join3(bundlePath2, SEARCH_INDEX_FILE)).then((s) => s.mtimeMs).catch(() => 0);
+  const indexAt = await stat2(join4(bundlePath2, SEARCH_INDEX_FILE)).then((s) => s.mtimeMs).catch(() => 0);
   if (!indexAt) return true;
   const { readdir: readdir2 } = await import("fs/promises");
   const names = (await readdir2(bundlePath2).catch(() => [])).filter(
@@ -3434,7 +3964,7 @@ async function isStale(bundlePath2) {
   let stale = false;
   await mapLimit(names, DEFAULT_IO_CONCURRENCY, async (name) => {
     if (stale) return;
-    const at = await stat2(join3(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
+    const at = await stat2(join4(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
     if (at > indexAt) stale = true;
   });
   return stale;
@@ -3473,14 +4003,14 @@ import { createHash as createHash2 } from "crypto";
 import {
   appendFile,
   link,
-  mkdir as mkdir2,
+  mkdir as mkdir3,
   readdir,
   readFile as readFile4,
   rename,
   unlink,
   writeFile as writeFile3
 } from "fs/promises";
-import { join as join4, resolve as resolve5, sep as sep3 } from "path";
+import { join as join5, resolve as resolve5, sep as sep3 } from "path";
 
 // src/kb-links/inbound.ts
 function inboundIndex(bundle) {
@@ -3642,7 +4172,7 @@ function appendUnionMergeLine(contents) {
 }
 
 // src/kb-store.ts
-var KB_DIR = join4(".strauss", "kb");
+var KB_DIR = join5(".strauss", "kb");
 var STORE_OWNED = /* @__PURE__ */ new Set([INDEX_FILE, LOG_FILE, SEARCH_INDEX_FILE]);
 var DEFAULT_LOAD_BUDGET = 25e3;
 var KbStore = class {
@@ -3673,7 +4203,7 @@ var KbStore = class {
     const conceptId2 = `${input.type}.${input.slug}`;
     const root = this.root(bundlePath2);
     const target = this.recordPath(bundlePath2, conceptId2);
-    await mkdir2(root, { recursive: true });
+    await mkdir3(root, { recursive: true });
     await this.publish(
       target,
       stringifyMarkdownWithFrontmatter(input.body, frontmatter),
@@ -3737,7 +4267,7 @@ var KbStore = class {
     const records = await mapLimit(
       wanted,
       DEFAULT_IO_CONCURRENCY,
-      async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await readFile4(join4(root, name), "utf8"))
+      async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await readFile4(join5(root, name), "utf8"))
     );
     return records.filter((record) => record !== null);
   }
@@ -3905,7 +4435,8 @@ ${answer}
    * at the repo root, and the MCP server's cwd is the workspace.
    *
    * Public because `doctor` needs the same map with the same degradation: a
-   * sweep that failed to read the tree should report no drift, not fail.
+   * sweep that failed to read the tree should report no drift, not fail — and
+   * `offline: false` there, because a sweep is worth a fetch.
    *
    * When no root was given and not one anchored file was found, the finding is
    * discarded. A base read from somewhere other than the tree it describes
@@ -3917,10 +4448,13 @@ ${answer}
    * plausible, and the misses become findings again; an explicit `repoRoot` is
    * taken at its word either way.
    */
-  async detectDrift(records, repoRoot) {
+  async detectDrift(records, repoRoot, options = {}) {
     try {
       const drift = await detectAnchorDrift(records, {
-        repoRoot: repoRoot ?? process.cwd()
+        repoRoot: repoRoot ?? process.cwd(),
+        // Offline by default: a read path must never spend a network fetch per
+        // call. `doctor` and `anchor-resolve` are the verbs that go get it.
+        remote: { offline: options.offline !== false }
       });
       if (repoRoot === void 0 && looksLikeWrongRepoRoot(drift)) {
         this.logger.warn?.({
@@ -4038,11 +4572,11 @@ ${answer}
   async readIndex(bundlePath2) {
     const root = this.root(bundlePath2);
     const expected = renderIndex(await this.list(bundlePath2));
-    const stored = await readFile4(join4(root, INDEX_FILE), "utf8").catch(
+    const stored = await readFile4(join5(root, INDEX_FILE), "utf8").catch(
       () => null
     );
     if (indexIsStale(stored, expected)) {
-      await this.publish(join4(root, INDEX_FILE), expected, true, INDEX_FILE);
+      await this.publish(join5(root, INDEX_FILE), expected, true, INDEX_FILE);
       this.logger.info?.({
         operation: "kb.index.repair",
         bundlePath: root,
@@ -4060,7 +4594,7 @@ ${answer}
    */
   async readLog(bundlePath2) {
     const raw = await readFile4(
-      join4(this.root(bundlePath2), LOG_FILE),
+      join5(this.root(bundlePath2), LOG_FILE),
       "utf8"
     ).catch(() => "");
     const result = parseLog(raw);
@@ -4201,7 +4735,7 @@ ${answer}
    * file must not fail the mutation it guards.
    */
   async ensureGitattributes(root) {
-    const target = join4(root, GITATTRIBUTES_FILE);
+    const target = join5(root, GITATTRIBUTES_FILE);
     try {
       let existing;
       try {
@@ -4252,7 +4786,7 @@ ${answer}
   async record(root, entry) {
     await this.ensureGitattributes(root);
     const line = renderLogEntry({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
-    await appendFile(join4(root, LOG_FILE), line, "utf8").catch((error) => {
+    await appendFile(join5(root, LOG_FILE), line, "utf8").catch((error) => {
       this.logger.warn?.({
         operation: "kb.log.append",
         outcome: "failed",
@@ -4289,7 +4823,7 @@ ${answer}
         { conceptId: conceptId2 }
       );
     }
-    return join4(this.root(bundlePath2), `${conceptId2}.md`);
+    return join5(this.root(bundlePath2), `${conceptId2}.md`);
   }
 };
 function estimateTokens(record) {
@@ -4432,7 +4966,7 @@ function typeRank(record) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.14" : "0.0.0-dev";
+var VERSION = true ? "0.1.15" : "0.0.0-dev";
 
 export {
   kbSourceSchema,
@@ -4464,10 +4998,13 @@ export {
   composeNoDecisionRecord,
   isNoDecisionRecord,
   selectDecisions,
+  isCanonicalRepoUrl,
+  repoCacheDir,
+  readRemoteAnchors,
+  anchorFilePath,
   regexResolver,
   hashAnchorText,
   resolveAnchor,
-  anchorFilePath,
   detectAnchorDrift,
   Fault,
   ErrorTypes,
@@ -4545,4 +5082,4 @@ export {
   KbStore,
   VERSION
 };
-//# sourceMappingURL=chunk-43KALLFU.js.map
+//# sourceMappingURL=chunk-KNIUBCZY.js.map